drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-04-19 13:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

sysv init calls : start-fw,stop-fw

Browse Source
This commit is contained in:
bolvan 2019-05-14 23:14:14 +03:00
parent 3b61dbc20f
commit 087c374959
5 changed files with 66 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/readme.txt
View File

@ -338,6 +338,10 @@ zapret_stop_daemons
Посмотрите init скрипт /opt/zapret/init.d/sysv/zapret и все поймете сами. Посмотрите init скрипт /opt/zapret/init.d/sysv/zapret и все поймете сами.
Есть вариант вызывать готовый скрипт по каким-то событиям :
/opt/zapret/init.d/sysv/zapret start-fw
/opt/zapret/init.d/sysv/zapret stop-fw
Пример установки на debian-подобную систему Пример установки на debian-подобную систему
------------------------------------------- -------------------------------------------

24
init.d/openwrt/functions
View File

@ -78,7 +78,9 @@ dnat6_target()
# get target ip address for DNAT. prefer link locals # get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible # tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup # link local address can appear not immediately after ifup
[ -n "$DNAT6_TARGET" ] || {
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ "$DNAT6_TARGET" = '-' ] || {
# no reason to query if its down # no reason to query if its down
network_is_up lan || return network_is_up lan || return
@ -95,9 +97,13 @@ dnat6_target()
sleep 1 sleep 1
do :; done do :; done
[ -z "$DNAT6_TARGET" ] && { [ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE) DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
} }
} }
} }
@ -161,8 +167,10 @@ __fw_tpws6()
done done
network_get_device DEVICE lan network_get_device DEVICE lan
dnat6_target dnat6_target
ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP [ "$DNAT6_TARGET" != '-' ] && {
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
[ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
}
} }
fw_tpws6() fw_tpws6()
{ {
@ -177,6 +185,6 @@ fw_tpws_https6()
create_ipset() create_ipset()
{ {
echo "Creating ipset" echo "Creating ipset"
"$IPSET_CR" $1 "$IPSET_CR" $1
} }

8
init.d/openwrt/zapret
View File

@ -48,8 +48,8 @@ run_daemon()
run_tpws() run_tpws()
{ {
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2" [ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2" run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
network_get_device DEVICE lan network_get_device DEVICE lan
[ -n "$DEVICE" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$DEVICE $2" [ -n "$DEVICE" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$DEVICE $2"
@ -57,8 +57,8 @@ run_tpws()
} }
stop_tpws() stop_tpws()
{ {
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS [ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS stop_daemon $((60+$1)) $TPWS
stop_daemon $((660+$1)) $TPWS stop_daemon $((660+$1)) $TPWS
} }

45
init.d/sysv/functions
View File

@ -103,8 +103,9 @@ dnat6_target()
# get target ip address for DNAT. prefer link locals # get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible # tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup # link local address can appear not immediately after ifup
[ -n "$DNAT6_TARGET" ] || {
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ "$DNAT6_TARGET" = '-' ] || {
local ct=0 local ct=0
while while
DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN) DNAT6_TARGET=$(get_ipv6_linklocal $IFACE_LAN)
@ -115,9 +116,13 @@ dnat6_target()
sleep 1 sleep 1
do :; done do :; done
[ -z "$DNAT6_TARGET" ] && { [ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN) DNAT6_TARGET=$(get_ipv6_global $IFACE_LAN)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
} }
} }
} }
@ -127,18 +132,18 @@ fw_tpws_add()
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
# $3 - tpws port # $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for tpws : $1" echo "Adding iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && { [ -n "$IFACE_LAN" ] && {
ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3 ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
} }
ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3 ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for tpws : $2" echo "Adding ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && { [ -n "$IFACE_LAN" ] && {
dnat6_target dnat6_target
ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3 [ "$DNAT6_TARGET" != '-' ] && ipt6 PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
} }
ipt6 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3 ipt6 OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
} }
@ -148,18 +153,18 @@ fw_tpws_del()
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
# $3 - tpws port # $3 - tpws port
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for tpws : $1" echo "Deleting iptables rule for tpws : $1"
[ -n "$IFACE_LAN" ] && { [ -n "$IFACE_LAN" ] && {
ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3 ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3
} }
ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3 ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for tpws : $2" echo "Deleting ip6tables rule for tpws : $2"
[ -n "$IFACE_LAN" ] && { [ -n "$IFACE_LAN" ] && {
dnat6_target dnat6_target
ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3 [ "$DNAT6_TARGET" != '-' ] && ipt6_del PREROUTING -t nat $IPT_ILAN -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
} }
ipt6_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3 ipt6_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $2 -j DNAT --to [::1]:$3
} }
@ -169,11 +174,11 @@ fw_nfqws_add_pre()
{ {
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws prerouting : $1" echo "Adding iptables rule for nfqws prerouting : $1"
ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws prerouting : $2" echo "Adding ip6tables rule for nfqws prerouting : $2"
ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
@ -182,11 +187,11 @@ fw_nfqws_del_pre()
{ {
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws prerouting : $1" echo "Deleting iptables rule for nfqws prerouting : $1"
ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws prerouting : $2" echo "Deleting ip6tables rule for nfqws prerouting : $2"
ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
@ -195,11 +200,11 @@ fw_nfqws_add_post()
{ {
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Adding iptables rule for nfqws postrouting : $1" echo "Adding iptables rule for nfqws postrouting : $1"
ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Adding ip6tables rule for nfqws postrouting : $2" echo "Adding ip6tables rule for nfqws postrouting : $2"
ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
@ -208,11 +213,11 @@ fw_nfqws_del_post()
{ {
# $1 - iptable filter for ipv4 # $1 - iptable filter for ipv4
# $2 - iptable filter for ipv6 # $2 - iptable filter for ipv6
[ "$DISABLE_IPV4" != "1" ] && { [ "$DISABLE_IPV4" = "1" ] || {
echo "Deleting iptables rule for nfqws postrouting : $1" echo "Deleting iptables rule for nfqws postrouting : $1"
ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
echo "Deleting ip6tables rule for nfqws postrouting : $2" echo "Deleting ip6tables rule for nfqws postrouting : $2"
ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
} }
@ -280,16 +285,16 @@ prepare_tpws()
run_tpws() run_tpws()
{ {
prepare_tpws prepare_tpws
[ "$DISABLE_IPV4" != "1" ] && run_daemon $1 $TPWS "$TPWS_OPT_BASE $2" [ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2" run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
[ -n "$IFACE_LAN" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$IFACE_LAN $2" [ -n "$IFACE_LAN" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$IFACE_LAN $2"
} }
} }
stop_tpws() stop_tpws()
{ {
[ "$DISABLE_IPV4" != "1" ] && stop_daemon $1 $TPWS [ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" != "1" ] && { [ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS stop_daemon $((60+$1)) $TPWS
[ -n "$IFACE_LAN" ] && stop_daemon $((660+$1)) $TPWS [ -n "$IFACE_LAN" ] && stop_daemon $((660+$1)) $TPWS
} }

25
init.d/sysv/zapret
View File

@ -14,19 +14,26 @@ NAME=zapret
DESC=anti-zapret DESC=anti-zapret
case "$1" in case "$1" in
start) start)
zapret_run_daemons zapret_run_daemons
[ "$INIT_APPLY_FW" = "1" ] && zapret_apply_firewall [ "$INIT_APPLY_FW" != "1" ] || zapret_apply_firewall
;; ;;
stop) stop)
zapret_stop_daemons zapret_stop_daemons
[ "$INIT_APPLY_FW" = "1" ] && zapret_unapply_firewall [ "$INIT_APPLY_FW" != "1" ] || zapret_unapply_firewall
;; ;;
start-fw)
zapret_apply_firewall
;;
stop-fw)
zapret_unapply_firewall
;;
*) *)
N=/etc/init.d/$NAME N=/etc/init.d/$NAME
echo "Usage: $N {start|stop}" >&2 echo "Usage: $N {start|stop|start-fw|stop-fw}" >&2
exit 1 exit 1
;; ;;
esac esac