blockcheck: nftables support

blockcheck.sh

@@ -23,6 +23,8 @@ ZAPRET_BASE="$EXEDIR"
 HDRTEMP=/tmp/zapret-hdr.txt
 ECHON="echo -n"
 
+NFT_TABLE=blockcheck
+
 [ -n "$DNSCHECK_DNS" ] || DNSCHECK_DNS="8.8.8.8 1.1.1.1 77.88.8.1"
 [ -n "$DNSCHECK_DOM" ] || DNSCHECK_DOM="pornhub.com putinhuylo.com rutracker.org nnmclub.to startmail.com"
 DNSCHECK_DIG1=/tmp/dig1.txt
@@ -139,6 +141,17 @@ ipt_has_nfq()
 	done
 	return 0
 }
+nft_has_nfq()
+{
+	local res=1
+	nft delete table ${NFT_TABLE}_test 2>/dev/null
+	nft add table ${NFT_TABLE}_test 2>/dev/null && {
+		nft add chain ${NFT_TABLE}_test test
+		nft add rule ${NFT_TABLE}_test test queue num $QNUM bypass 2>/dev/null && res=0
+		nft delete table ${NFT_TABLE}_test
+	}
+	return $res
+}
 
 check_system()
 {
@@ -146,6 +159,7 @@ check_system()
 
 	UNAME=$(uname)
 	SUBSYS=
+	FWTYPE=
 
 	case "$UNAME" in
 		Linux)
@@ -154,17 +168,38 @@ check_system()
 			local INIT=$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)
 			[ -L "$INIT" ] && INIT=$(readlink "$INIT")
 			INIT=$(basename "$INIT")
-			[ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] && SUBSYS=openwrt
+			if [ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] ; then
+				SUBSYS=openwrt
+				# new openwrt version abandon iptables and use nftables instead
+				# no iptables/ip6tables/ipt-kmods are installed by default
+				# fw4 firewall is used, fw3 is symbolic link to fw4
+				# no more firewall includes
+				# make sure nft was not just installed by user but all the system is based on fw4
+				if [ -x /sbin/fw4 ] && exists nft; then
+					FWTYPE=nftables
+				else
+					FWTYPE=iptables
+				fi
+			else
+				# generic linux
+				if exists nft; then
+					FWTYPE=nftables
+				else
+					FWTYPE=iptables
+				fi
+			fi
 			;;
 		FreeBSD)
 			PKTWS="$DVTWS"
 			PKTWSD=dvtws
+			FWTYPE=ipfw
 			;;
 		*)
 			echo $UNAME not supported
 			exitp 5
 	esac
 	echo $UNAME${SUBSYS:+/$SUBSYS} detected
+	echo firewall type is $FWTYPE
 }
 
 freebsd_module_loaded()
@@ -194,6 +229,8 @@ check_prerequisites()
 	local prog progs='curl'
 	case "$UNAME" in
 		Linux)
+			case "$FWTYPE" in
+				iptables)
 					progs="$progs iptables ip6tables"
 					ipt_has_nfq || {
 						echo NFQUEUE iptables or ip6tables target is missing. pls install modules.
@@ -201,6 +238,15 @@ check_prerequisites()
 						exitp 6
 					}
 					;;
+				nftables)
+					nft_has_nfq || {
+						echo nftables queue support is not available. pls install modules.
+						[ "$SUBSYS" = openwrt ] && echo 'OpenWRT : opkg update ; opkg install kmod-nft-queue'
+						exitp 6
+					}
+					;;
+			esac
+			;;
 		FreeBSD)
 			progs="$progs ipfw"
 			freebsd_modules_loaded ipfw ipdivert || {
@@ -340,8 +386,8 @@ curl_test_https_tls13()
 pktws_ipt_prepare()
 {
 	# $1 - port
-	case "$UNAME" in
+	case "$FWTYPE" in
-		Linux)
+		iptables)
 			# to avoid possible INVALID state drop
 			IPT INPUT -p tcp --sport $1 ! --syn -j ACCEPT
 			IPT OUTPUT -p tcp --dport $1 -m conntrack --ctstate INVALID -j ACCEPT
@@ -352,19 +398,27 @@ pktws_ipt_prepare()
 				# enable fragments
 				IPT OUTPUT -f -j ACCEPT
 			fi
-
 			IPT POSTROUTING -t mangle -p tcp --dport $1 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK -j NFQUEUE --queue-num $QNUM
 			;;
-		FreeBSD)
+		nftables)
-			IPFW_ADD divert $IPFW_DIVERT_PORT tcp from me to any 80,443 proto ip${IPV} out not diverted not sockarg
+			nft add table inet $NFT_TABLE
+			[ "$IPV" = 6 -a -n "$IP6_DEFRAG_DISABLE" ] && {
+				nft "add chain inet $NFT_TABLE predefrag { type filter hook output priority -401; }"
+				nft "add rule inet $NFT_TABLE predefrag meta nfproto ipv${IPV} exthdr frag exists notrack"
+			}
+			nft "add chain inet $NFT_TABLE premangle { type filter hook output priority -151; }"
+			nft "add rule inet $NFT_TABLE premangle meta nfproto ipv${IPV} tcp dport $1 mark and 0x40000000 != 0x40000000 queue num $QNUM bypass"
+			;;
+		ipfw)
+			IPFW_ADD divert $IPFW_DIVERT_PORT tcp from me to any $1 proto ip${IPV} out not diverted not sockarg
 			;;
 	esac
 }
 pktws_ipt_unprepare()
 {
 	# $1 - port
-	case "$UNAME" in
+	case "$FWTYPE" in
-		Linux)
+		iptables)
 			IPT_DEL POSTROUTING -t mangle -p tcp --dport $1 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK -j NFQUEUE --queue-num $QNUM
 
 			IPT_DEL INPUT -p tcp --sport $1 ! --syn -j ACCEPT
@@ -375,7 +429,10 @@ pktws_ipt_unprepare()
 				IPT_DEL OUTPUT -f -j ACCEPT
 			fi
 			;;
-		FreeBSD)
+		nftables)
+			nft delete table inet $NFT_TABLE 2>/dev/null
+			;;
+		ipfw)
 			IPFW_DEL
 			;;
 	esac
@@ -383,23 +440,32 @@ pktws_ipt_unprepare()
 tpws_ipt_prepare()
 {
 	# $1 - port
-	case "$UNAME" in
+	case "$FWTYPE" in
-		Linux)
+		iptables)
 			IPT OUTPUT -t nat -p tcp --dport $1 -m owner ! --uid-owner $TPWS_UID -j DNAT --to $LOCALHOST_IPT:$TPPORT
 			;;
-		FreeBSD)
+		nftables)
-			IPFW_ADD fwd $LOCALHOST,$TPPORT tcp from me to any 80,443 proto ip${IPV} not uid $TPWS_UID
+			nft add table inet $NFT_TABLE
+			# -101 = pre dstnat
+			nft "add chain inet $NFT_TABLE output { type nat hook output priority -101; }"
+			nft "add rule inet $NFT_TABLE output tcp dport $1 skuid != $TPWS_UID dnat ip${IPVV} to $LOCALHOST_IPT:$TPPORT"
+			;;
+		ipfw)
+			IPFW_ADD fwd $LOCALHOST,$TPPORT tcp from me to any $1 proto ip${IPV} not uid $TPWS_UID
 			;;
 	esac
 }
 tpws_ipt_unprepare()
 {
 	# $1 - port
-	case "$UNAME" in
+	case "$FWTYPE" in
-		Linux)
+		iptables)
 			IPT_DEL OUTPUT -t nat -p tcp --dport $1 -m owner ! --uid-owner $TPWS_UID -j DNAT --to $LOCALHOST_IPT:$TPPORT
 			;;
-		FreeBSD)
+		nftables)
+			nft delete table inet $NFT_TABLE 2>/dev/null
+			;;
+		ipfw)
 			IPFW_DEL
 			;;
 	esac
@@ -710,14 +776,16 @@ check_domain_https_tls13()
 configure_ip_version()
 {
 	if [ "$IPV" = 6 ]; then
-		IPTABLES=ip6tables
 		LOCALHOST=::1
-		LOCALHOST_IPT=[::1]
+		LOCALHOST_IPT=[${LOCALHOST}]
+		IPVV=6
 	else
 		IPTABLES=iptables
 		LOCALHOST=127.0.0.1
-		LOCALHOST_IPT=127.0.0.1
+		LOCALHOST_IPT=$LOCALHOST
+		IPVV=
 	fi
+	IPTABLES=ip${IPVV}tables
 }
 configure_curl_opt()
 {
@@ -731,15 +799,30 @@ configure_curl_opt()
 	curl_supports_tls13 && TLS13=1
 }
 
-configure_defrag()
+linux_ipv6_defrag_can_be_disabled()
 {
-	case "$UNAME" in
-		Linux)
-			IP6_DEFRAG_DISABLE=
-			[ "$IPVS" = 6 -o "$IPVS" = "4 6" ] && {
 	local V1=$(sed -nre 's/^Linux version ([0-9]+)\.[0-9]+.*$/\1/p' /proc/version)
 	local V2=$(sed -nre 's/^Linux version [0-9]+\.([0-9]+).*$/\1/p' /proc/version)
-				if [ "$V1" -gt 4 -o "$V1" = 4 -a "$V2" -ge 16 ]; then
+	[ -n "$V1" -a -n "$V2" ] && [ "$V1" -gt 4 -o "$V1" = 4 -a "$V2" -ge 16 ]
+}
+
+configure_defrag()
+{
+	IP6_DEFRAG_DISABLE=
+
+	[ "$IPVS" = 4 ] && return
+
+	[ "$UNAME" = "Linux" ] && {
+		linux_ipv6_defrag_can_be_disabled || {
+			echo "WARNING ! ipv6 defrag can only be effectively disabled in linux kernel 4.16+"
+			echo "WARNING ! ipv6 ipfrag tests are disabled"
+			echo
+			return
+		}
+	}
+
+	case "$FWTYPE" in
+		iptables)
 			if ipt6_has_raw ; then
 				if ipt6_has_frag; then
 					IP6_DEFRAG_DISABLE=1
@@ -751,11 +834,6 @@ configure_defrag()
 				echo "WARNING ! ip6tables raw table is not available, ipv6 ipfrag tests are disabled"
 				echo
 			fi
-				else
-					echo "WARNING ! ipv6 defrag can only be effectively disabled in linux kernel 4.16+"
-					echo "WARNING ! ipv6 ipfrag tests are disabled"
-					echo
-				fi
 			[ -n "$IP6_DEFRAG_DISABLE" ] && {
 				local ipexe="$(readlink -f $(whichq ip6tables))"
 				if [ "${ipexe#*nft}" != "$ipexe" ]; then
@@ -765,7 +843,6 @@ configure_defrag()
 				fi
 				echo
 			}
-			}
 			;;
 		*)
 			IP6_DEFRAG_DISABLE=1