openwrt : move to the single firewall include

docs/readme.txt

@@ -616,11 +616,8 @@ ipset можно выкинуть, если не будем пользовать
 может быть критично, они не запустятся после перезагрузки.
 Cкрипт из /etc/hotplug.d/iface запустит недостающие службы при поднятии интерфейса lan.
 
-Если не включен параметр DISABLE_IPV4 :
+Создать ссылку на firewall include :
-В зависимости от выбранного в файле config MODE создать ссылку на нужный файл настроек фаервола :
+ ln -fs /opt/zapret/init.d/openwrt/firewall.zapret /etc/firewall.zapret
- ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.$MODE /etc/firewall.zapret
-Например :
- ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.tpws_ipset_https /etc/firewall.zapret
 Проверить была ли создана ранее запись о firewall include :
  uci show firewall | grep firewall.zapret
 Если firewall.zapret нет, значит добавить :
@@ -631,21 +628,6 @@ Cкрипт из /etc/hotplug.d/iface запустит недостающие с
 Перезапустить фаервол :
  fw3 restart
 
-Если не включен параметр DISABLE_IPV6 :
-В зависимости от выбранного в файле config MODE создать ссылку на нужный файл настроек фаервола :
- ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.${MODE}6 /etc/firewall.zapret6
-Например :
- ln -fs /opt/zapret/init.d/openwrt/firewall.zapret.tpws_ipset_https6 /etc/firewall.zapret6
-Проверить была ли создана ранее запись о firewall include :
- uci show firewall | grep firewall.zapret6
-Если firewall.zapret6 нет, значит добавить :
- uci add firewall include
- uci set firewall.@include[-1].path="/etc/firewall.zapret6"
- uci set firewall.@include[-1].reload="1"
- uci commit firewall
-Перезапустить фаервол :
- fw3 restart
- 
 Посмотреть через iptables -nL, ip6tables -nL или через luci вкладку "firewall" появились ли нужные правила.
 
 ЭКОНОМИЯ МЕСТА : если его мало, то можно оставить в директории zapret лишь подкаталог ipset, файл config и init.d/openwrt.
@@ -656,7 +638,7 @@ Cкрипт из /etc/hotplug.d/iface запустит недостающие с
 ЕСЛИ ВСЕ ПЛОХО С МЕСТОМ : откажитесь от работы со списком РКН. используйте только get_user.sh
 
 ЕСЛИ СОВСЕМ ВСЕ УЖАСНО С МЕСТОМ : не надо устанавливать дополнительные пакеты через opkg.
-оставьте лишь /opt/zapret/tpws/tpws, /opt/zapret/config, /etc/init.d/zapret, /etc/firewall.zapret
+оставьте лишь /opt/zapret/tpws/tpws, /opt/zapret/config, /opt/zapret/init.d/openwrt
 используйте MODE=tpws_all или tpws_all_https
 такой вариант потребует около 100 кб места и полностью статичен.
 отсутствуют любые загрузки, обновления, изменения файлов.

init.d/openwrt/firewall.zapret

@@ -1,4 +1,3 @@
 . /opt/zapret/init.d/openwrt/functions
 
-create_ipset no-update
+zapret_apply_firewall
-

init.d/openwrt/firewall.zapret.ipset6

@@ -1 +0,0 @@
-firewall.zapret.ipset

init.d/openwrt/firewall.zapret.nfqws_all

@@ -1,6 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80"
-IPT_FILTER_POST="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_nfqws

init.d/openwrt/firewall.zapret.nfqws_all6

@@ -1,6 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80"
-IPT_FILTER_POST="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_nfqws6

init.d/openwrt/firewall.zapret.nfqws_all_https

@@ -1,6 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443"
-IPT_FILTER_POST="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_nfqws

init.d/openwrt/firewall.zapret.nfqws_all_https6

@@ -1,6 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443"
-IPT_FILTER_POST="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_nfqws6

init.d/openwrt/firewall.zapret.nfqws_ipset

@@ -1,7 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80 -m set --match-set zapret src"
-IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_nfqws

init.d/openwrt/firewall.zapret.nfqws_ipset6

@@ -1,7 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK --sport 80 -m set --match-set zapret6 src"
-IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret6 dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_nfqws6

init.d/openwrt/firewall.zapret.nfqws_ipset_https

@@ -1,7 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443 -m set --match-set zapret src"
-IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_nfqws

init.d/openwrt/firewall.zapret.nfqws_ipset_https6

@@ -1,7 +0,0 @@
-IPT_FILTER_PRE="-p tcp --tcp-flags SYN,ACK SYN,ACK -m multiport --sports 80,443 -m set --match-set zapret6 src"
-IPT_FILTER_POST="-p tcp --dport 80 -m set --match-set zapret6 dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_nfqws6

init.d/openwrt/firewall.zapret.tpws_all

@@ -1,5 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_tpws

init.d/openwrt/firewall.zapret.tpws_all6

@@ -1,5 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_tpws6

init.d/openwrt/firewall.zapret.tpws_all_https

@@ -1,6 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80"
-IPT_FILTER_HTTPS="-p tcp --dport 443"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_tpws_https

init.d/openwrt/firewall.zapret.tpws_all_https6

@@ -1,6 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80"
-IPT_FILTER_HTTPS="-p tcp --dport 443"
-
-. /opt/zapret/init.d/openwrt/functions
-
-fw_tpws_https6

init.d/openwrt/firewall.zapret.tpws_hostlist

@@ -1 +0,0 @@
-firewall.zapret.tpws_all

init.d/openwrt/firewall.zapret.tpws_hostlist6

@@ -1 +0,0 @@
-firewall.zapret.tpws_all6

init.d/openwrt/firewall.zapret.tpws_ipset

@@ -1,6 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_tpws

init.d/openwrt/firewall.zapret.tpws_ipset6

@@ -1,6 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret6 dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_tpws6

init.d/openwrt/firewall.zapret.tpws_ipset_https

@@ -1,7 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret dst"
-IPT_FILTER_HTTPS="-p tcp --dport 443 -m set --match-set zapret dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_tpws_https

init.d/openwrt/firewall.zapret.tpws_ipset_https6

@@ -1,7 +0,0 @@
-IPT_FILTER_HTTP="-p tcp --dport 80 -m set --match-set zapret6 dst"
-IPT_FILTER_HTTPS="-p tcp --dport 443 -m set --match-set zapret6 dst"
-
-. /opt/zapret/init.d/openwrt/functions
-
-create_ipset no-update
-fw_tpws_https6

init.d/openwrt/functions

@@ -82,6 +82,7 @@ dnat6_target()
  # link local address can appear not immediately after ifup
  
  # DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
+
  [ -n "$DNAT6_TARGET" ] || {
     # no reason to query if its down
     network_is_up lan || return
@@ -111,86 +112,138 @@ dnat6_target()
 }
 
 
-fw_nfqws()
+fw_nfqws_pre()
 {
- [ "$DISABLE_IPV4" = "1" ] && return
+ # $1 - filter ipv4
+ # $2 - filter ipv6
+
  local DEVICE wan_iface
- network_find_wan_all wan_iface
+
- for ext_iface in $wan_iface; do
+ [ "$DISABLE_IPV4" = "1" ] || {
-    network_get_device DEVICE $ext_iface
+    network_find_wan_all wan_iface
-    ipt POSTROUTING -t mangle -o $DEVICE $IPT_FILTER_POST -j NFQUEUE --queue-num $QNUM --queue-bypass
+    for ext_iface in $wan_iface; do
-    ipt PREROUTING -t raw -i $DEVICE $IPT_FILTER_PRE -j NFQUEUE --queue-num $QNUM --queue-bypass
+       network_get_device DEVICE $ext_iface
- done
+       ipt PREROUTING -t raw -i $DEVICE -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
+    done
+ }
+ [ "$DISABLE_IPV6" = "1" ] || {
+    network_find_wan6_all wan_iface
+    for ext_iface in $wan_iface; do
+       network_get_device DEVICE $ext_iface
+       ipt6 PREROUTING -t raw -i $DEVICE -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
+    done
+ }
 }
-fw_nfqws6()
+fw_nfqws_post()
 {
- [ "$DISABLE_IPV6" = "1" ] && return
+ # $1 - filter ipv4
+ # $2 - filter ipv6
+
  local DEVICE wan_iface
- network_find_wan6_all wan_iface
+
- for ext_iface in $wan_iface; do
+ [ "$DISABLE_IPV4" = "1" ] || {
-    network_get_device DEVICE $ext_iface
+    network_find_wan_all wan_iface
-    ipt6 POSTROUTING -t mangle -o $DEVICE $IPT_FILTER_POST -j NFQUEUE --queue-num $QNUM --queue-bypass
+    for ext_iface in $wan_iface; do
-    ipt6 PREROUTING -t raw -i $DEVICE $IPT_FILTER_PRE -j NFQUEUE --queue-num $QNUM --queue-bypass
+       network_get_device DEVICE $ext_iface
- done
+       ipt POSTROUTING -t mangle -o $DEVICE -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass
+    done
+ }
+ [ "$DISABLE_IPV6" = "1" ] || {
+    network_find_wan6_all wan_iface
+    for ext_iface in $wan_iface; do
+       network_get_device DEVICE $ext_iface
+       ipt6 POSTROUTING -t mangle -o $DEVICE -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass
+    done
+ }
 }
 
 IPT_OWNER="-m owner ! --uid-owner $TPWS_USER"
-__fw_tpws()
-{
- # $1 - use https
- [ "$DISABLE_IPV4" = "1" ] && return
- local DEVICE wan_iface
- network_find_wan_all wan_iface
- for ext_iface in $wan_iface; do
-    network_get_device DEVICE $ext_iface
-    ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTP -j DNAT --to 127.0.0.1:$TPPORT_HTTP
-    [ "$1" != "1" ] || ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTPS -j DNAT --to 127.0.0.1:$TPPORT_HTTPS
- done
- network_get_device DEVICE lan
- sysctl -w net.ipv4.conf.$DEVICE.route_localnet=1
- ipt prerouting_lan_rule -t nat $IPT_FILTER_HTTP -j DNAT --to 127.0.0.1:$TPPORT_HTTP
- [ "$1" != "1" ] || ipt prerouting_lan_rule -t nat $IPT_FILTER_HTTPS -j DNAT --to 127.0.0.1:$TPPORT_HTTPS
-}
 fw_tpws()
 {
- __fw_tpws 0
+ # $1 - filter ipv4
-}
+ # $2 - filter ipv6
-fw_tpws_https()
+ # $3 - tpws port
-{
- __fw_tpws 1
-}
 
-__fw_tpws6()
+ local DEVICE wan_iface
-{
+ 
- # $1 - use https
+ [ "$DISABLE_IPV4" = "1" ] || {
- [ "$DISABLE_IPV6" = "1" ] && return
+    network_find_wan_all wan_iface
- local DEVICE wan_iface ip6
+    for ext_iface in $wan_iface; do
- network_find_wan6_all wan_iface
+       network_get_device DEVICE $ext_iface
- for ext_iface in $wan_iface; do
+       ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 -j DNAT --to 127.0.0.1:$3
-    network_get_device DEVICE $ext_iface
+    done
-    ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTP -j DNAT --to [::1]:$TPPORT_HTTP
+    ipt prerouting_lan_rule -t nat -p tcp $1 -j DNAT --to 127.0.0.1:$3
-    [ "$1" != "1" ] || ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER $IPT_FILTER_HTTPS -j DNAT --to [::1]:$TPPORT_HTTPS
+    network_get_device DEVICE lan
- done
+    sysctl -qw net.ipv4.conf.$DEVICE.route_localnet=1
- network_get_device DEVICE lan
+ }
- dnat6_target
+ [ "$DISABLE_IPV6" = "1" ] || {
- [ "$DNAT6_TARGET" != "-" ] && {
+    network_find_wan6_all wan_iface
-    ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTP -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTP
+    for ext_iface in $wan_iface; do
-    [ "$1" != "1" ] || ipt6 PREROUTING -t nat -i $DEVICE $IPT_FILTER_HTTPS -j DNAT --to [$DNAT6_TARGET]:$TPPORT_HTTPS
+       network_get_device DEVICE $ext_iface
+       ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $2 -j DNAT --to [::1]:$3
+    done
+    network_get_device DEVICE lan
+    dnat6_target
+    [ "$DNAT6_TARGET" != "-" ] && ipt6 PREROUTING -t nat -i $DEVICE -p tcp $2 -j DNAT --to [$DNAT6_TARGET]:$3
  }
 }
-fw_tpws6()
-{
- __fw_tpws6 0
-}
-fw_tpws_https6()
-{
- __fw_tpws6 1
-}
-
 
 
 create_ipset()
 {
  echo "Creating ipset"
- "$IPSET_CR" $1
+ "$IPSET_CR" "$@"
+}
+
+
+zapret_apply_firewall()
+{
+	case "${MODE}" in
+	    tpws_hostlist)
+			fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
+			;;
+	    tpws_ipset)
+			create_ipset no-update
+			fw_tpws "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst" $TPPORT_HTTP
+			;;
+	    tpws_ipset_https)
+			create_ipset no-update
+			fw_tpws "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst" $TPPORT_HTTP
+			fw_tpws "--dport 443 -m set --match-set zapret dst" "--dport 443 -m set --match-set zapret6 dst" $TPPORT_HTTPS
+			;;
+	    tpws_all)
+			fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
+			;;
+	    tpws_all_https)
+			fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
+			fw_tpws "--dport 443" "--dport 443" $TPPORT_HTTPS
+			;;
+	    nfqws_ipset)
+			create_ipset no-update
+			fw_nfqws_pre "--sport 80 -m set --match-set zapret src" "--sport 80 -m set --match-set zapret6 src"
+			fw_nfqws_post "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst"
+			;;
+	    nfqws_ipset_https)
+			create_ipset no-update
+			fw_nfqws_pre "-m multiport --sports 80,443 -m set --match-set zapret src" "-m multiport --sports 80,443 -m set --match-set zapret6 src"
+			fw_nfqws_post "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst"
+			;;
+	    nfqws_all)
+			fw_nfqws_pre "--sport 80" "--sport 80"
+			fw_nfqws_post "--dport 80" "--dport 80"
+			;;
+	    nfqws_all_https)
+			fw_nfqws_pre "-m multiport --sports 80,443" "-m multiport --sports 80,443"
+			fw_nfqws_post "--dport 80" "--dport 80"
+			;;
+	    ipset)
+			create_ipset no-update
+			;;
+	    custom)
+			# PLACEHOLDER
+			echo !!! NEED ATTENTION !!!
+			echo Configure iptables for required actions
+			echo Study how other sections work
+			;;
+	esac
 }

init.d/sysv/functions

@@ -292,7 +292,7 @@ do_tpws()
 create_ipset()
 {
 	echo "Creating ipset"
-	"$IPSET_CR"
+	"$IPSET_CR" "$@"
 }
 
 

install_easy.sh

@@ -559,32 +559,29 @@ openwrt_fw_section_find()
 	false
 	return
 }
-openwrt_fw_section_add()
-{
-	# $1 - fw include postfix
-	# echoes section number
-
-	openwrt_fw_section_find $1 ||
-	{
-		uci add firewall include >/dev/null || return
-		echo -1
-	}
-}
 openwrt_fw_section_del()
 {
 	# $1 - fw include postfix
+
 	local id=$(openwrt_fw_section_find $1)
 	[ -n "$id" ] && {
 		uci delete firewall.@include[$id] && uci commit firewall
 		rm -f "$OPENWRT_FW_INCLUDE$1"
 	}
 }
+openwrt_fw_section_add()
+{
+	openwrt_fw_section_find ||
+	{
+		uci add firewall include >/dev/null || return
+		echo -1
+	}
+}
 openwrt_fw_section_configure()
 {
-	# $1 - fw include postfix
 	local id=$(openwrt_fw_section_add $1)
 	[ -z "$id" ] ||
-	 ! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE$1" ||
+	 ! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" ||
 	 ! uci set firewall.@include[$id].reload="1" ||
 	 ! uci commit firewall &&
 	{
@@ -595,8 +592,6 @@ openwrt_fw_section_configure()
 
 install_openwrt_firewall()
 {
-	# $1 - fw include postfix
-
 	echo \* installing firewall script $1
 	
 	[ -n "MODE" ] || {
@@ -604,31 +599,12 @@ install_openwrt_firewall()
 		exitp 7
 	}
 	
-	local FW_SCRIPT_SRC="$FW_SCRIPT_SRC_DIR.$MODE$1"
+	echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
-	[ -f "$FW_SCRIPT_SRC" ] || {
+	ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
-		echo firewall script $FW_SCRIPT_SRC not found. removing firewall include
-		openwrt_fw_section_del
-		return
-	}
-	echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE$1"
-	ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE$1"
 	
 	openwrt_fw_section_configure $1
 }
 
-install_openwrt_firewall_all()
-{
-	if [ "$DISABLE_IPV4" = "1" ] ; then
-		openwrt_fw_section_del
-	else
-		install_openwrt_firewall
-	fi
-	if [ "$DISABLE_IPV6" = "1" ] ; then
-		openwrt_fw_section_del 6
-	else
-		install_openwrt_firewall 6
-	fi
-}
 
 restart_openwrt_firewall()
 {
@@ -645,6 +621,7 @@ remove_openwrt_firewall()
 	echo \* removing firewall script
 	
 	openwrt_fw_section_del
+	# from old zapret versions. now we use single include
 	openwrt_fw_section_del 6
 }
 
@@ -683,7 +660,7 @@ service_start_sysv()
 install_openwrt()
 {
 	INIT_SCRIPT_SRC=$EXEDIR/init.d/openwrt/zapret
-	FW_SCRIPT_SRC_DIR=$EXEDIR/init.d/openwrt/firewall.zapret
+	FW_SCRIPT_SRC=$EXEDIR/init.d/openwrt/firewall.zapret
 	OPENWRT_FW_INCLUDE=/etc/firewall.zapret
 	OPENWRT_IFACE_HOOK=$EXEDIR/init.d/openwrt/90-zapret
 	
@@ -701,7 +678,7 @@ install_openwrt()
 	crontab_add 0 6
 	service_start_sysv
 	install_openwrt_iface_hook
-	install_openwrt_firewall_all
+	install_openwrt_firewall
 	restart_openwrt_firewall
 }
 

uninstall_easy.sh

@@ -121,7 +121,6 @@ remove_systemd()
 
 
 
-
 openwrt_fw_section_find()
 {
 	# $1 - fw include postfix
@@ -157,6 +156,7 @@ remove_openwrt_firewall()
 	echo \* removing firewall script
 	
 	openwrt_fw_section_del
+	# from old zapret versions. now we use single include
 	openwrt_fw_section_del 6
 }