init.d: number pools. FW_EXTRA. nft insert. customs reorder

init.d/sysv/custom.d.examples/10-inherit-tpws4http-nfqws4https

@@ -0,0 +1,35 @@
+# this custom script demonstrates how to apply tpws to http and nfqws to https and quic
+# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts
+
+nfqws_tpws_inheritor()
+{
+	# $1 - inherited function
+	# $2 - 1 - run, 0 - stop
+	
+	[ "$MODE_HTTP" = "1" ] && {
+		MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2
+	}
+
+	[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && {
+		MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2
+	}
+}
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	nfqws_tpws_inheritor zapret_do_daemons $1
+}
+zapret_custom_firewall()
+{
+	# $1 - 1 - run, 0 - stop
+
+	nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1
+}
+zapret_custom_firewall_nft()
+{
+	# stop logic is not required
+
+	nfqws_tpws_inheritor zapret_apply_firewall_rules_nft
+}

init.d/sysv/custom.d.examples/50-dht4all

@@ -1,15 +1,15 @@
 # this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
 # need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
 
-DNUM=101
-QNUM2=$(($DNUM * 5))
+alloc_dnum DNUM_DHT4ALL
+alloc_qnum QNUM_DHT4ALL
 
 zapret_custom_daemons()
 {
         # stop logic is managed by procd
 
-        local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
-	do_nfqws $1 $DNUM "$opt"
+        local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
+	do_nfqws $1 $DNUM_DHT4ALL "$opt"
 }
 zapret_custom_firewall()
 {
@@ -22,7 +22,7 @@ zapret_custom_firewall()
         f='-p udp -m length --length 109:407 -m u32 --u32'
 	uf4='0>>22&0x3C@8>>16=0x6431'
 	uf6='48>>16=0x6431'
-        fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only"  "$f $uf6 $desync $first_packet_only" $QNUM2
+        fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only"  "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL
 
 }
 zapret_custom_firewall_nft()
@@ -34,6 +34,6 @@ zapret_custom_firewall_nft()
         local desync="mark and $DESYNC_MARK == 0"
 
         f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
-        nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM2
+        nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL
 }
 

init.d/sysv/custom.d.examples/50-quic4all

@@ -2,15 +2,15 @@
 # need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
 # NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
 
-DNUM=102
-QNUM2=$(($DNUM * 5))
+alloc_dnum DNUM_QUIC4ALL
+alloc_qnum QNUM_QUIC4ALL
 
 zapret_custom_daemons()
 {
 	# $1 - 1 - run, 0 - stop
 
-	local opt="--qnum=$QNUM2 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
-	do_nfqws $1 $DNUM "$opt"
+	local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
+	do_nfqws $1 $DNUM_QUIC4ALL "$opt"
 }
 zapret_custom_firewall()
 {
@@ -21,7 +21,7 @@ zapret_custom_firewall()
 	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
 
 	f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
-	fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
+	fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
 
 }
 zapret_custom_firewall_nft()
@@ -33,5 +33,5 @@ zapret_custom_firewall_nft()
 	local desync="mark and $DESYNC_MARK == 0"
 
 	f="udp dport {$QUIC_PORTS}"
-	nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM2
+	nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
 }

init.d/sysv/custom.d.examples/50-tpws4http-nfqws4https

@@ -1,71 +0,0 @@
-# this custom script demonstrates how to apply tpws to http and nfqws to https
-# it preserves config settings : MODE_HTTP, MODE_HTTPS, MODE_FILTER, TPWS_OPT, NFQWS_OPT_DESYNC, NFQWS_OPT_DESYNC_HTTPS
-
-zapret_custom_daemons()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local opt
-
-	[ "$MODE_HTTP" = "1" ] && {
-		opt="--port=$TPPORT $TPWS_OPT"
-		filter_apply_hostlist_target opt
-		filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
-		do_tpws $1 1 "$opt"
-	}
-
-	[ "$MODE_HTTPS" = "1" ] && {
-		opt="--qnum=$QNUM $NFQWS_OPT_DESYNC_HTTPS"
-		filter_apply_hostlist_target opt
-		filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX"
-		do_nfqws $1 2 "$opt"
-	}
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local f4 f6
-	local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)"
-	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
-
-	[ "$MODE_HTTP" = "1" ] && {
-		f4="-p tcp -m multiport --dports $HTTP_PORTS_IPT"
-		f6=$f4
-		filter_apply_ipset_target f4 f6
-		fw_tpws $1 "$f4" "$f6" $TPPORT
-	}
-	
-	[ "$MODE_HTTPS" = "1" ] && {
-		f4="-p tcp -m multiport --dports $HTTPS_PORTS_IPT $first_packet_only"
-		f6=$f4
-		filter_apply_ipset_target f4 f6
-		fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM
-		# for modes that require incoming traffic
-		fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM
-	}
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	local f4 f6
-	local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)"
-	local desync="mark and $DESYNC_MARK == 0"
-
-	[ "$MODE_HTTP" = "1" ] && {
-		f4="tcp dport {$HTTP_PORTS}"
-		f6=$f4
-		nft_filter_apply_ipset_target f4 f6
-		nft_fw_tpws "$f4" "$f6" $TPPORT
-	}
-	
-	[ "$MODE_HTTPS" = "1" ] && {
-		f4="tcp dport {$HTTPS_PORTS} $first_packet_only"
-		f6=$f4
-		nft_filter_apply_ipset_target f4 f6
-		nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM
-		# for modes that require incoming traffic
-		nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM
-	}
-}