mirror of
https://github.com/bol-van/zapret.git
synced 2025-08-10 01:02:03 +03:00
major config re-think and re-write
This commit is contained in:
bol-van
@@ -1,7 +1,6 @@
|
||||
# this script is an example describing how to run tpws on a custom port
|
||||
|
||||
TPWS_OPT_EXTRA=${TPWS_OPT_EXTRA:---split-pos=2}
|
||||
TPWS_OPT_SUFFIX_EXTRA="${TPWS_OPT_SUFFIX_EXTRA:-}"
|
||||
DPORTS_EXTRA=${DPORTS_EXTRA:-20443,20444,30000-30009}
|
||||
|
||||
alloc_dnum DNUM_EXTRA_TPWS
|
||||
@@ -14,7 +13,6 @@ zapret_custom_daemons()
|
||||
tpws_apply_binds opt
|
||||
opt="$opt $TPWS_OPT_EXTRA"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX_EXTRA"
|
||||
do_daemon $1 $DNUM_EXTRA_TPWS "$TPWS" "$opt"
|
||||
}
|
||||
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
MODE_OVERRIDE=$OVERRIDE zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall_v4()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v4
|
||||
}
|
||||
zapret_custom_firewall_v6()
|
||||
{
|
||||
MODE_OVERRIDE=$OVERRIDE pf_anchor_zapret_v6
|
||||
}
|
||||
@@ -15,6 +15,7 @@ IPSET_DIR=$ZAPRET_BASE/ipset
|
||||
|
||||
PIDDIR=/var/run
|
||||
[ -n "$TPPORT" ] || TPPORT=988
|
||||
[ -n "$TPPORT_SOCKS" ] || TPPORT=987
|
||||
[ -n "$WS_USER" ] || WS_USER=daemon
|
||||
TPWS_WAIT="--bind-wait-ifup=30 --bind-wait-ip=30"
|
||||
TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
|
||||
@@ -117,18 +118,14 @@ zapret_do_firewall()
|
||||
[ "$1" = 1 -a -n "$INIT_FW_PRE_UP_HOOK" ] && $INIT_FW_PRE_UP_HOOK
|
||||
[ "$1" = 0 -a -n "$INIT_FW_PRE_DOWN_HOOK" ] && $INIT_FW_PRE_DOWN_HOOK
|
||||
|
||||
case "${MODE_OVERRIDE:-$MODE}" in
|
||||
tpws|filter|custom)
|
||||
if [ "$1" = "1" ] ; then
|
||||
pf_anchor_root || return 1
|
||||
pf_anchors_create
|
||||
pf_anchors_load || return 1
|
||||
pf_enable
|
||||
else
|
||||
pf_anchors_clear
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
if [ "$1" = "1" ] ; then
|
||||
pf_anchor_root || return 1
|
||||
pf_anchors_create
|
||||
pf_anchors_load || return 1
|
||||
pf_enable
|
||||
else
|
||||
pf_anchors_clear
|
||||
fi
|
||||
|
||||
[ "$1" = 1 -a -n "$INIT_FW_POST_UP_HOOK" ] && $INIT_FW_POST_UP_HOOK
|
||||
[ "$1" = 0 -a -n "$INIT_FW_POST_DOWN_HOOK" ] && $INIT_FW_POST_DOWN_HOOK
|
||||
@@ -150,49 +147,36 @@ zapret_restart_firewall()
|
||||
}
|
||||
|
||||
|
||||
standard_mode_daemons()
|
||||
{
|
||||
local opt
|
||||
|
||||
if [ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] ; then
|
||||
echo "both ipv4 and ipv6 are disabled. nothing to do"
|
||||
else
|
||||
[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && {
|
||||
opt="--user=root --port=$TPPORT"
|
||||
tpws_apply_binds opt
|
||||
opt="$opt $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_daemon $1 1 "$TPWS" "$opt"
|
||||
}
|
||||
[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
|
||||
opt="--socks --user=$WS_USER --port=$TPPORT_SOCKS"
|
||||
tpws_apply_socks_binds opt
|
||||
opt="$opt $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_daemon $1 2 "$TPWS" "$opt"
|
||||
}
|
||||
fi
|
||||
}
|
||||
|
||||
zapret_do_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt
|
||||
|
||||
case "${MODE_OVERRIDE:-$MODE}" in
|
||||
tpws)
|
||||
[ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && {
|
||||
echo "both ipv4 and ipv6 are disabled. nothing to do"
|
||||
return 0
|
||||
}
|
||||
# MacOS requires root. kernel hardcoded requirement for /dev/pf ioctls
|
||||
opt="--user=root --port=$TPPORT"
|
||||
tpws_apply_binds opt
|
||||
opt="$opt $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
do_daemon $1 1 "$TPWS" "$opt"
|
||||
;;
|
||||
tpws-socks)
|
||||
[ "$1" = "1" ] && [ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && {
|
||||
echo "both ipv4 and ipv6 are disabled. nothing to do"
|
||||
return 0
|
||||
}
|
||||
opt="--socks --user=$WS_USER --port=$TPPORT"
|
||||
tpws_apply_socks_binds opt
|
||||
opt="$opt $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
do_daemon $1 1 "$TPWS" "$opt"
|
||||
;;
|
||||
filter)
|
||||
;;
|
||||
custom)
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
*)
|
||||
echo "unsupported MODE=$MODE"
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
standard_mode_daemons $1
|
||||
custom_runner zapret_custom_daemons $1
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies nfqws mode as it would be with MODE=nfqws
|
||||
|
||||
OVERRIDE=nfqws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic
|
||||
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts
|
||||
|
||||
nfqws_tpws_inheritor()
|
||||
{
|
||||
# $1 - inherited function
|
||||
# $2 - 1 - run, 0 - stop
|
||||
local MODE_OVERRIDE
|
||||
[ "$MODE_HTTP" = "1" ] && {
|
||||
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2
|
||||
}
|
||||
|
||||
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && {
|
||||
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2
|
||||
}
|
||||
}
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# stop logic is managed by procd
|
||||
|
||||
nfqws_tpws_inheritor start_daemons_procd
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,5 +1,7 @@
|
||||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
|
||||
|
||||
# can override in config :
|
||||
NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}"
|
||||
|
||||
alloc_dnum DNUM_DHT4ALL
|
||||
alloc_qnum QNUM_DHT4ALL
|
||||
@@ -17,12 +19,11 @@ zapret_custom_firewall()
|
||||
|
||||
local f uf4 uf6
|
||||
local first_packet_only="$ipt_connbytes 1:1"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32'
|
||||
uf4='0>>22&0x3C@8>>16=0x6431'
|
||||
uf6='48>>16=0x6431'
|
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL
|
||||
fw_nfqws_post $1 "$f $uf4 $first_packet_only" "$f $uf6 $first_packet_only" $QNUM_DHT4ALL
|
||||
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
@@ -31,8 +32,7 @@ zapret_custom_firewall_nft()
|
||||
|
||||
local f
|
||||
local first_packet_only="$nft_connbytes 1"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
|
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL
|
||||
nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
|
||||
# this custom script runs desync of some udp packets to discord subnets
|
||||
# idea taken from community. not tested and not optimized by author.
|
||||
|
||||
# can override in config :
|
||||
@@ -24,7 +24,6 @@ zapret_custom_firewall()
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
|
||||
local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
|
||||
local subnet
|
||||
@@ -40,7 +39,7 @@ zapret_custom_firewall()
|
||||
}
|
||||
|
||||
f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
|
||||
[ "$1" = 1 ] || {
|
||||
ipset destroy $DISCORD_SET_NAME 2>/dev/null
|
||||
@@ -53,7 +52,6 @@ zapret_custom_firewall_nft()
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
local dest_set="ip daddr @$DISCORD_SET_NAME"
|
||||
local subnets
|
||||
|
||||
@@ -65,7 +63,7 @@ zapret_custom_firewall_nft()
|
||||
nft_add_set_element $DISCORD_SET_NAME "$subnets"
|
||||
|
||||
f="udp dport {$DISCORD_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
}
|
||||
|
||||
zapret_custom_firewall_nft_flush()
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
|
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
|
||||
|
||||
alloc_dnum DNUM_QUIC4ALL
|
||||
alloc_qnum QNUM_QUIC4ALL
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
run_daemon $DNUM_QUIC4ALL $NFQWS "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
|
||||
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
f="udp dport {$QUIC_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
|
||||
}
|
||||
@@ -6,7 +6,6 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
|
||||
. "$ZAPRET_CONFIG"
|
||||
. "$ZAPRET_BASE/common/base.sh"
|
||||
. "$ZAPRET_BASE/common/fwtype.sh"
|
||||
. "$ZAPRET_BASE/common/queue.sh"
|
||||
. "$ZAPRET_BASE/common/linux_iphelper.sh"
|
||||
. "$ZAPRET_BASE/common/ipt.sh"
|
||||
. "$ZAPRET_BASE/common/nft.sh"
|
||||
@@ -17,6 +16,7 @@ CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"
|
||||
|
||||
[ -n "$QNUM" ] || QNUM=200
|
||||
[ -n "$TPPORT" ] || TPPORT=988
|
||||
[ -n "$TPPORT_SOCKS" ] || TPPORT_SOCKS=987
|
||||
[ -n "$WS_USER" ] || WS_USER=daemon
|
||||
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
|
||||
[ -n "$DESYNC_MARK_POSTNAT" ] || DESYNC_MARK_POSTNAT=0x20000000
|
||||
@@ -32,8 +32,6 @@ IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
|
||||
IPSET_EXCLUDE="-m set ! --match-set nozapret"
|
||||
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
|
||||
|
||||
apply_unspecified_desync_modes
|
||||
|
||||
|
||||
# can be multiple ipv6 outgoing interfaces
|
||||
# uplink from isp, tunnelbroker, vpn, ...
|
||||
|
||||
@@ -114,68 +114,30 @@ tpws_apply_socks_binds()
|
||||
}
|
||||
|
||||
|
||||
standard_mode_daemons()
|
||||
{
|
||||
local opt
|
||||
[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$TPWS_OPT" && {
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
run_tpws 1 "$opt"
|
||||
}
|
||||
[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
|
||||
opt="--port=$TPPORT_SOCKS $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
run_tpws_socks 2 "$opt"
|
||||
}
|
||||
[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$NFQWS_OPT" && {
|
||||
opt="--qnum=$QNUM $NFQWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
run_daemon 3 "$NFQWS" "$opt"
|
||||
}
|
||||
}
|
||||
|
||||
start_daemons_procd()
|
||||
{
|
||||
local opt qn qns qn6 qns6
|
||||
|
||||
case "${MODE_OVERRIDE:-$MODE}" in
|
||||
tpws)
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
run_tpws 1 "$opt"
|
||||
;;
|
||||
tpws-socks)
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
run_tpws_socks 1 "$opt"
|
||||
;;
|
||||
nfqws)
|
||||
# quite complex but we need to minimize nfqws processes to save RAM
|
||||
get_nfqws_qnums qn qns qn6 qns6
|
||||
[ -z "$qn" ] || {
|
||||
opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP_SUFFIX"
|
||||
run_daemon 1 "$NFQWS" "$opt"
|
||||
}
|
||||
[ -z "$qns" ] || [ "$qns" = "$qn" ] || {
|
||||
opt="--qnum=$qns $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX"
|
||||
run_daemon 2 "$NFQWS" "$opt"
|
||||
}
|
||||
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
|
||||
opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP6_SUFFIX"
|
||||
run_daemon 3 "$NFQWS" "$opt"
|
||||
}
|
||||
[ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
|
||||
opt="--qnum=$qns6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS6_SUFFIX"
|
||||
run_daemon 4 "$NFQWS" "$opt"
|
||||
}
|
||||
get_nfqws_qnums_quic qn qn6
|
||||
[ -z "$qn" ] || {
|
||||
opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC_SUFFIX"
|
||||
run_daemon 10 "$NFQWS" "$opt"
|
||||
}
|
||||
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || {
|
||||
opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC6_SUFFIX"
|
||||
run_daemon 11 "$NFQWS" "$opt"
|
||||
}
|
||||
;;
|
||||
custom)
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
esac
|
||||
standard_mode_daemons
|
||||
custom_runner zapret_custom_daemons
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies nfqws mode as it would be with MODE=nfqws
|
||||
|
||||
OVERRIDE=nfqws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies tpws mode as it would be with MODE=tpws
|
||||
|
||||
OVERRIDE=tpws
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
|
||||
|
||||
OVERRIDE=tpws-socks
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local MODE_OVERRIDE=$OVERRIDE
|
||||
zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic
|
||||
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts
|
||||
|
||||
nfqws_tpws_inheritor()
|
||||
{
|
||||
# $1 - inherited function
|
||||
# $2 - 1 - run, 0 - stop
|
||||
local MODE_OVERRIDE
|
||||
[ "$MODE_HTTP" = "1" ] && {
|
||||
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2
|
||||
}
|
||||
|
||||
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && {
|
||||
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2
|
||||
}
|
||||
}
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
nfqws_tpws_inheritor zapret_do_daemons $1
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft
|
||||
}
|
||||
@@ -1,5 +1,7 @@
|
||||
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
|
||||
|
||||
# can override in config :
|
||||
NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}"
|
||||
|
||||
alloc_dnum DNUM_DHT4ALL
|
||||
alloc_qnum QNUM_DHT4ALL
|
||||
@@ -17,13 +19,11 @@ zapret_custom_firewall()
|
||||
|
||||
local f uf4 uf6
|
||||
local first_packet_only="$ipt_connbytes 1:1"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
f='-p udp -m length --length 109:407 -m u32 --u32'
|
||||
uf4='0>>22&0x3C@8>>16=0x6431'
|
||||
uf6='48>>16=0x6431'
|
||||
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL
|
||||
|
||||
fw_nfqws_post $1 "$f $uf4 $first_packet_only" "$f $uf6 $first_packet_only" $QNUM_DHT4ALL
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
@@ -31,9 +31,7 @@ zapret_custom_firewall_nft()
|
||||
|
||||
local f
|
||||
local first_packet_only="$nft_connbytes 1"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
|
||||
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL
|
||||
nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL
|
||||
}
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
|
||||
# this custom script runs desync of some udp packets to discord subnets
|
||||
# idea taken from community. not tested and not optimized by author.
|
||||
|
||||
# can override in config :
|
||||
@@ -24,7 +24,6 @@ zapret_custom_firewall()
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
|
||||
local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
|
||||
local subnet
|
||||
@@ -40,7 +39,7 @@ zapret_custom_firewall()
|
||||
}
|
||||
|
||||
f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
|
||||
[ "$1" = 1 ] || {
|
||||
ipset destroy $DISCORD_SET_NAME 2>/dev/null
|
||||
@@ -53,7 +52,6 @@ zapret_custom_firewall_nft()
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
local dest_set="ip daddr @$DISCORD_SET_NAME"
|
||||
local subnets
|
||||
|
||||
@@ -65,7 +63,7 @@ zapret_custom_firewall_nft()
|
||||
nft_add_set_element $DISCORD_SET_NAME "$subnets"
|
||||
|
||||
f="udp dport {$DISCORD_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
|
||||
}
|
||||
|
||||
zapret_custom_firewall_nft_flush()
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
|
||||
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
|
||||
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
|
||||
|
||||
alloc_dnum DNUM_QUIC4ALL
|
||||
alloc_qnum QNUM_QUIC4ALL
|
||||
|
||||
zapret_custom_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
do_nfqws $1 $DNUM_QUIC4ALL "$opt"
|
||||
}
|
||||
zapret_custom_firewall()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local f
|
||||
local first_packets_only="$ipt_connbytes 1:3"
|
||||
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
|
||||
|
||||
f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
|
||||
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
|
||||
|
||||
}
|
||||
zapret_custom_firewall_nft()
|
||||
{
|
||||
# stop logic is not required
|
||||
|
||||
local f
|
||||
local first_packets_only="$nft_connbytes 1-3"
|
||||
local desync="mark and $DESYNC_MARK == 0"
|
||||
|
||||
f="udp dport {$QUIC_PORTS}"
|
||||
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
|
||||
}
|
||||
@@ -6,7 +6,6 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
|
||||
. "$ZAPRET_CONFIG"
|
||||
. "$ZAPRET_BASE/common/base.sh"
|
||||
. "$ZAPRET_BASE/common/fwtype.sh"
|
||||
. "$ZAPRET_BASE/common/queue.sh"
|
||||
. "$ZAPRET_BASE/common/linux_iphelper.sh"
|
||||
. "$ZAPRET_BASE/common/ipt.sh"
|
||||
. "$ZAPRET_BASE/common/nft.sh"
|
||||
@@ -76,9 +75,9 @@ IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
|
||||
[ -n "$QNUM" ] || QNUM=200
|
||||
[ -n "$NFQWS" ] || NFQWS="$ZAPRET_BASE/nfq/nfqws"
|
||||
NFQWS_OPT_BASE="$USEROPT --dpi-desync-fwmark=$DESYNC_MARK"
|
||||
apply_unspecified_desync_modes
|
||||
|
||||
[ -n "$TPPORT" ] || TPPORT=988
|
||||
[ -n "$TPPORT_SOCKS" ] || TPPORT_SOCKS=987
|
||||
[ -n "$TPWS" ] || TPWS="$ZAPRET_BASE/tpws/tpws"
|
||||
TPWS_LOCALHOST4=127.0.0.127
|
||||
|
||||
@@ -280,69 +279,35 @@ create_ipset()
|
||||
}
|
||||
|
||||
|
||||
standard_mode_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt
|
||||
|
||||
[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && {
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_tpws $1 1 "$opt"
|
||||
}
|
||||
[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
|
||||
opt="--port=$TPPORT_SOCKS $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_tpws_socks $1 2 "$opt"
|
||||
}
|
||||
[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && {
|
||||
opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
do_nfqws $1 3 "$opt"
|
||||
}
|
||||
}
|
||||
|
||||
zapret_do_daemons()
|
||||
{
|
||||
# $1 - 1 - run, 0 - stop
|
||||
|
||||
local opt qn qns qn6 qns6
|
||||
|
||||
case "${MODE_OVERRIDE:-$MODE}" in
|
||||
tpws)
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
do_tpws $1 1 "$opt"
|
||||
;;
|
||||
tpws-socks)
|
||||
opt="--port=$TPPORT $TPWS_OPT"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
|
||||
do_tpws_socks $1 1 "$opt"
|
||||
;;
|
||||
nfqws)
|
||||
get_nfqws_qnums qn qns qn6 qns6
|
||||
[ -z "$qn" ] || {
|
||||
opt="--qnum=$qn $NFQWS_OPT_DESYNC_HTTP"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP_SUFFIX"
|
||||
do_nfqws $1 1 "$opt"
|
||||
}
|
||||
[ -z "$qns" ] || [ "$qns" = "$qn" ] || {
|
||||
opt="--qnum=$qns $NFQWS_OPT_DESYNC_HTTPS"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX"
|
||||
do_nfqws $1 2 "$opt"
|
||||
}
|
||||
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
|
||||
opt="--qnum=$qn6 $NFQWS_OPT_DESYNC_HTTP6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP6_SUFFIX"
|
||||
do_nfqws $1 3 "$opt"
|
||||
}
|
||||
[ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
|
||||
opt="--qnum=$qns6 $NFQWS_OPT_DESYNC_HTTPS6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS6_SUFFIX"
|
||||
do_nfqws $1 4 "$opt"
|
||||
}
|
||||
get_nfqws_qnums_quic qn qn6
|
||||
[ -z "$qn" ] || {
|
||||
opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC_SUFFIX"
|
||||
do_nfqws $1 10 "$opt"
|
||||
}
|
||||
[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || {
|
||||
opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC6"
|
||||
filter_apply_hostlist_target opt
|
||||
filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC6_SUFFIX"
|
||||
do_nfqws $1 11 "$opt"
|
||||
}
|
||||
;;
|
||||
custom)
|
||||
custom_runner zapret_custom_daemons $1
|
||||
;;
|
||||
esac
|
||||
standard_mode_daemons $1
|
||||
custom_runner zapret_custom_daemons $1
|
||||
|
||||
return 0
|
||||
}
|
||||
@@ -354,4 +319,3 @@ zapret_stop_daemons()
|
||||
{
|
||||
zapret_do_daemons 0 "$@"
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user