drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-08-17 00:03:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fixed typos, misspellings, abbreviations, Markdown linting, etc.

Browse Source
This commit is contained in:
conc3rned
2024-09-17 16:12:39 +03:00
parent b15ca040df
commit 03312cbb67
41 changed files with 437 additions and 425 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/base.sh
View File

@@ -143,7 +143,7 @@ linux_get_subsys() {
elif [ -x "/bin/ndm" ]; then
SUBSYS=keenetic
else
# generic linux
# generic Linux
SUBSYS=
fi
}

2
common/dialog.sh
View File

@@ -43,7 +43,7 @@ ask_list() {
echo $n: "$m"
n=$(($n + 1))
done
printf "your choice (default : $M_DEFAULT) : "
printf "your choice (default: $M_DEFAULT): "
read m
[ -n "$m" ] && M=$(echo "$2" | cut -d ' ' -f"$m" 2>/dev/null)
[ -z "$M" ] && M="$M_DEFAULT"

2
common/fwtype.sh
View File

@@ -22,7 +22,7 @@ linux_fwtype() {
fi
else
SUBSYS=
# generic linux
# generic Linux
# flowtable is implemented since kernel 4.16
if linux_nft_avail && linux_min_version 4 16; then
FWTYPE=nftables

19
common/installer.sh
View File

@@ -47,7 +47,7 @@ edit_vars() {
# $1,$2,... - var names
local n=1 var v tmp="/tmp/zvars"
rm -f "$tmp"
while [ 1=1 ]; do
while true; do
eval var="\$$n"
[ -n "$var" ] || break
eval v="\$$var"
@@ -60,7 +60,7 @@ edit_vars() {
openrc_test() {
exists rc-update || return 1
# some systems do not usse openrc-init but launch openrc from inittab
# some systems do not use openrc-init but launch openrc from inittab
[ "$INIT" = "openrc-init" ] || grep -qE "sysinit.*openrc" /etc/inittab 2>/dev/null
}
check_system() {
@@ -103,9 +103,9 @@ check_system() {
elif openrc_test; then
SYSTEM=openrc
else
echo system is not either systemd, openrc or openwrt based
echo system is not either systemd, openrc or OpenWrt based
echo easy installer can set up config settings but can\'t configure auto start
echo you have to do it manually. check readme.txt for manual setup info.
echo you have to do it manually. check readme.md for manual setup info.
if [ -n "$1" ] || ask_yes_no N "do you want to continue"; then
SYSTEM=linux
else
@@ -116,7 +116,7 @@ check_system() {
elif [ "$UNAME" = "Darwin" ]; then
SYSTEM=macos
else
echo easy installer only supports Linux and MacOS. check readme.txt for supported systems and manual setup info.
echo easy installer only supports Linux and macOS. check readme.md for supported systems and manual setup info.
exitp 5
fi
echo system is based on $SYSTEM
@@ -142,7 +142,7 @@ crontab_del() {
CRONTMP=/tmp/cron.tmp
crontab -l >$CRONTMP 2>/dev/null
if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
echo removing following entries from crontab :
echo removing following entries from crontab:
grep "$GET_LIST_PREFIX" $CRONTMP
grep -v "$GET_LIST_PREFIX" $CRONTMP >$CRONTMP.2
crontab $CRONTMP.2
@@ -172,7 +172,7 @@ crontab_add() {
CRONTMP=/tmp/cron.tmp
crontab -l >$CRONTMP 2>/dev/null
if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
echo some entries already exist in crontab. check if this is corrent :
echo some entries already exist in crontab. check if this is corrent:
grep "$GET_LIST_PREFIX" $CRONTMP
else
end_with_newline <"$CRONTMP" || echo >>"$CRONTMP"
@@ -358,7 +358,6 @@ install_openwrt_firewall() {
echo should specify MODE in "$ZAPRET_CONFIG"
exitp 7
}
echo "linking: $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
@@ -614,7 +613,7 @@ select_ipv6() {
[ "$DISABLE_IPV6" != '1' ] && T=Y
local old6=$DISABLE_IPV6
echo
if ask_yes_no $T "enable ipv6 support"; then
if ask_yes_no $T "enable IPv6 support"; then
DISABLE_IPV6=0
else
DISABLE_IPV6=1
@@ -625,7 +624,7 @@ select_fwtype() {
echo
[ $(get_ram_mb) -le 400 ] && {
echo WARNING ! you are running a low RAM system
echo WARNING ! nft requires lots of RAM to load huge ip sets, much more than ipsets require
echo WARNING ! nft requires lots of RAM to load huge ip sets, much more than IP sets require
echo WARNING ! if you need large lists it may be necessary to fall back to iptables+ipset firewall
}
echo select firewall type :

22
common/ipt.sh
View File

@@ -111,9 +111,9 @@ unprepare_tpws_fw() {
ipt_print_op() {
if [ "$1" = "1" ]; then
echo "Adding ip$4tables rule for $3 : $2"
echo "Adding ip$4tables rule for $3: $2"
else
echo "Deleting ip$4tables rule for $3 : $2"
echo "Deleting ip$4tables rule for $3: $2"
fi
}
@@ -121,8 +121,8 @@ _fw_tpws4() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - tpws port
# $4 - lan interface names space separated
# $5 - wan interface names space separated
# $4 - LAN interface names space separated
# $5 - WAN interface names space separated
[ "$DISABLE_IPV4" = "1" -o -z "$2" ] || {
local i rule
@@ -149,8 +149,8 @@ _fw_tpws6() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - tpws port
# $4 - lan interface names space separated
# $5 - wan interface names space separated
# $4 - LAN interface names space separated
# $5 - WAN interface names space separated
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i rule DNAT6
@@ -186,7 +186,7 @@ _fw_nfqws_post4() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - queue number
# $4 - wan interface names space separated
# $4 - WAN interface names space separated
[ "$DISABLE_IPV4" = "1" -o -z "$2" ] || {
local i
@@ -206,7 +206,7 @@ _fw_nfqws_post6() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
# $4 - wan interface names space separated
# $4 - WAN interface names space separated
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i
@@ -235,7 +235,7 @@ _fw_nfqws_pre4() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv4
# $3 - queue number
# $4 - wan interface names space separated
# $4 - WAN interface names space separated
[ "$DISABLE_IPV4" = "1" -o -z "$2" ] || {
local i
@@ -258,7 +258,7 @@ _fw_nfqws_pre6() {
# $1 - 1 - add, 0 - del
# $2 - iptable filter for ipv6
# $3 - queue number
# $4 - wan interface names space separated
# $4 - WAN interface names space separated
[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || {
local i
@@ -415,7 +415,7 @@ zapret_do_firewall_ipt() {
[ "$mode" = "tpws-socks" ] && return 0
# always create ipsets. ip_exclude ipset is required
# always create IP sets. ip_exclude ipset is required
[ "$1" = 1 ] && create_ipset no-update
zapret_do_firewall_rules_ipt "$@"

2
common/linux_fw.sh
View File

@@ -16,7 +16,7 @@ zapret_do_firewall() {
;;
esac
# russian DPI sends RST,ACK with wrong ACK.
# Russian DPI sends RST,ACK with wrong ACK.
# this is sometimes treated by conntrack as invalid and connbytes fw rules do not pass RST packet to nfqws.
# switch on liberal mode on zapret firewall start and switch off on zapret firewall stop
# this is only required for processing incoming bad RSTs. incoming rules are only applied in autohostlist mode

2
common/linux_iphelper.sh
View File

@@ -1,4 +1,4 @@
# there's no route_localnet for ipv6
# there's no route_localnet for IPv6
# the best we can is to route to link local of the incoming interface
# OUTPUT - can DNAT to ::1
# PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr

26
common/nft.sh
View File

@@ -1,7 +1,7 @@
[ -n "$ZAPRET_NFT_TABLE" ] || ZAPRET_NFT_TABLE=zapret
readonly nft_connbytes="ct original packets"
# required for : nft -f -
# required for: nft -f -
create_dev_stdin
std_ports
@@ -100,7 +100,7 @@ nft_create_chains() {
EOF
[ -n "$POSTNAT_ALL" ] && {
nft_flush_chain predefrag_nfqws
nft_add_rule predefrag_nfqws notrack comment \"do not track nfqws generated packets to avoid nat tampering and defragmentation\"
nft_add_rule predefrag_nfqws notrack comment \"do not track nfqws generated packets to avoid NAT tampering and defragmentation\"
}
}
nft_del_chains() {
@@ -130,12 +130,12 @@ nft_del_flowtable() {
nft_create_or_update_flowtable() {
# $1 = flags ('offload' for hw offload)
# $2,$3,$4,... - interfaces
# can be called multiple times to add interfaces. interfaces can only be added , not removed
# can be called multiple times to add interfaces. interfaces can only be added, not removed
local flags=$1 devices makelist
shift
# warning ! nft versions at least up to 1.0.1 do not allow interface names starting with digit in flowtable and do not allow quoting
# warning ! openwrt fixes this in post-21.x snapshots with special nft patch
# warning ! in traditional linux distros nft is unpatched and will fail with quoted interface definitions if unfixed
# warning ! OpenWrt fixes this in post-21.x snapshots with special nft patch
# warning ! in traditional Linux distros nft is unpatched and will fail with quoted interface definitions if unfixed
[ -n "$flags" ] && flags="flags $flags;"
for makelist in make_quoted_comma_list make_comma_list; do
$makelist devices "$@"
@@ -172,7 +172,7 @@ nft_del_firewall() {
nft_del_chains
nft_del_flowtable
nft_flush_link_local
# leave ifsets and ipsets because they may be used by custom rules
# leave ifsets and IP sets because they may be used by custom rules
}
nft_add_rule() {
@@ -363,7 +363,7 @@ nft_print_op() {
_nft_fw_tpws4() {
# $1 - filter ipv4
# $2 - tpws port
# $3 - not-empty if wan interface filtering required
# $3 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
local filter="$1" port="$2"
@@ -376,8 +376,8 @@ _nft_fw_tpws4() {
_nft_fw_tpws6() {
# $1 - filter ipv6
# $2 - tpws port
# $3 - lan interface names space separated
# $4 - not-empty if wan interface filtering required
# $3 - LAN interface names space separated
# $4 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" DNAT6 i
@@ -421,7 +421,7 @@ get_prechain() {
_nft_fw_nfqws_post4() {
# $1 - filter ipv4
# $2 - queue number
# $3 - not-empty if wan interface filtering required
# $3 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" rule chain=$(get_postchain) setmark
@@ -435,7 +435,7 @@ _nft_fw_nfqws_post4() {
_nft_fw_nfqws_post6() {
# $1 - filter ipv6
# $2 - queue number
# $3 - not-empty if wan interface filtering required
# $3 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" rule chain=$(get_postchain) setmark
@@ -458,7 +458,7 @@ nft_fw_nfqws_post() {
_nft_fw_nfqws_pre4() {
# $1 - filter ipv4
# $2 - queue number
# $3 - not-empty if wan interface filtering required
# $3 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" rule
@@ -470,7 +470,7 @@ _nft_fw_nfqws_pre4() {
_nft_fw_nfqws_pre6() {
# $1 - filter ipv6
# $2 - queue number
# $3 - not-empty if wan interface filtering required
# $3 - not-empty if WAN interface filtering required
[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
local filter="$1" port="$2" rule