major config re-think and re-write

2025-05-24 22:32:58 +03:00 · 2024-10-25 14:29:47 +03:00
parent d86aa42f48
commit 906e67af55
39 changed files with 963 additions and 1340 deletions
--- a/init.d/openwrt/custom.d.examples/10-inherit-nfqws
+++ b/init.d/openwrt/custom.d.examples/10-inherit-nfqws
@@ -1,25 +0,0 @@
-# this custom script applies nfqws mode as it would be with MODE=nfqws
-
-OVERRIDE=nfqws
-
-zapret_custom_daemons()
-{
-        # stop logic is managed by procd
-
-	local MODE_OVERRIDE=$OVERRIDE
-	start_daemons_procd
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_do_firewall_rules_ipt $1
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_apply_firewall_rules_nft
-}
--- a/init.d/openwrt/custom.d.examples/10-inherit-tpws
+++ b/init.d/openwrt/custom.d.examples/10-inherit-tpws
@@ -1,25 +0,0 @@
-# this custom script applies tpws mode as it would be with MODE=tpws
-
-OVERRIDE=tpws
-
-zapret_custom_daemons()
-{
-        # stop logic is managed by procd
-
-	local MODE_OVERRIDE=$OVERRIDE
-	start_daemons_procd
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_do_firewall_rules_ipt $1
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_apply_firewall_rules_nft
-}
--- a/init.d/openwrt/custom.d.examples/10-inherit-tpws-socks
+++ b/init.d/openwrt/custom.d.examples/10-inherit-tpws-socks
@@ -1,25 +0,0 @@
-# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
-
-OVERRIDE=tpws-socks
-
-zapret_custom_daemons()
-{
-        # stop logic is managed by procd
-
-	local MODE_OVERRIDE=$OVERRIDE
-	start_daemons_procd
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_do_firewall_rules_ipt $1
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	local MODE_OVERRIDE=$OVERRIDE
-	zapret_apply_firewall_rules_nft
-}
--- a/init.d/openwrt/custom.d.examples/10-inherit-tpws4http-nfqws4https
+++ b/init.d/openwrt/custom.d.examples/10-inherit-tpws4http-nfqws4https
@@ -1,35 +0,0 @@
-# this custom script demonstrates how to apply tpws to http and nfqws to https and quic
-# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts
-
-nfqws_tpws_inheritor()
-{
-	# $1 - inherited function
-	# $2 - 1 - run, 0 - stop
-	local MODE_OVERRIDE
-	[ "$MODE_HTTP" = "1" ] && {
-		MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2
-	}
-
-	[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && {
-		MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2
-	}
-}
-
-zapret_custom_daemons()
-{
-        # stop logic is managed by procd
-
-	nfqws_tpws_inheritor start_daemons_procd
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	nfqws_tpws_inheritor zapret_apply_firewall_rules_nft
-}
--- a/init.d/openwrt/custom.d.examples/50-dht4all
+++ b/init.d/openwrt/custom.d.examples/50-dht4all
@@ -1,5 +1,7 @@
 # this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
-# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
+
+# can override in config :
+NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}"

 alloc_dnum DNUM_DHT4ALL
 alloc_qnum QNUM_DHT4ALL
@@ -17,12 +19,11 @@ zapret_custom_firewall()

        local f uf4 uf6
        local first_packet_only="$ipt_connbytes 1:1"
-        local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"

        f='-p udp -m length --length 109:407 -m u32 --u32'
 	uf4='0>>22&0x3C@8>>16=0x6431'
 	uf6='48>>16=0x6431'
-        fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only"  "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL
+        fw_nfqws_post $1 "$f $uf4 $first_packet_only"  "$f $uf6 $first_packet_only" $QNUM_DHT4ALL

 }
 zapret_custom_firewall_nft()
@@ -31,8 +32,7 @@ zapret_custom_firewall_nft()

        local f
        local first_packet_only="$nft_connbytes 1"
-        local desync="mark and $DESYNC_MARK == 0"

        f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
-        nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL
+        nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL
 }
--- a/init.d/openwrt/custom.d.examples/50-discord
+++ b/init.d/openwrt/custom.d.examples/50-discord
@@ -1,4 +1,4 @@
-# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
+# this custom script runs desync of some udp packets to discord subnets
 # idea taken from community. not tested and not optimized by author.

 # can override in config :
@@ -24,7 +24,6 @@ zapret_custom_firewall()

 	local f
 	local first_packets_only="$ipt_connbytes 1:3"
-	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
 	local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
 	local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
 	local subnet
@@ -40,7 +39,7 @@ zapret_custom_firewall()
 	}

 	f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
-	fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
+	fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_DISCORD

 	[ "$1" = 1 ] || {
 		ipset destroy $DISCORD_SET_NAME 2>/dev/null
@@ -53,7 +52,6 @@ zapret_custom_firewall_nft()

 	local f
 	local first_packets_only="$nft_connbytes 1-3"
-	local desync="mark and $DESYNC_MARK == 0"
 	local dest_set="ip daddr @$DISCORD_SET_NAME"
 	local subnets

@@ -65,7 +63,7 @@ zapret_custom_firewall_nft()
 	nft_add_set_element $DISCORD_SET_NAME "$subnets"

 	f="udp dport {$DISCORD_PORTS}"
-	nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
+	nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
 }

 zapret_custom_firewall_nft_flush()
--- a/init.d/openwrt/custom.d.examples/50-quic4all
+++ b/init.d/openwrt/custom.d.examples/50-quic4all
@@ -1,37 +0,0 @@
-# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
-# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
-# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
-
-alloc_dnum DNUM_QUIC4ALL
-alloc_qnum QNUM_QUIC4ALL
-
-zapret_custom_daemons()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
-	run_daemon $DNUM_QUIC4ALL $NFQWS "$opt"
-}
-zapret_custom_firewall()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local f
-	local first_packets_only="$ipt_connbytes 1:3"
-	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
-
-	f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
-	fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
-
-}
-zapret_custom_firewall_nft()
-{
-	# stop logic is not required
-
-	local f
-	local first_packets_only="$nft_connbytes 1-3"
-	local desync="mark and $DESYNC_MARK == 0"
-
-	f="udp dport {$QUIC_PORTS}"
-	nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
-}
--- a/init.d/openwrt/functions
+++ b/init.d/openwrt/functions
@@ -6,7 +6,6 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
 . "$ZAPRET_CONFIG"
 . "$ZAPRET_BASE/common/base.sh"
 . "$ZAPRET_BASE/common/fwtype.sh"
-. "$ZAPRET_BASE/common/queue.sh"
 . "$ZAPRET_BASE/common/linux_iphelper.sh"
 . "$ZAPRET_BASE/common/ipt.sh"
 . "$ZAPRET_BASE/common/nft.sh"
@@ -17,6 +16,7 @@ CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"

 [ -n "$QNUM" ] || QNUM=200
 [ -n "$TPPORT" ] || TPPORT=988
+[ -n "$TPPORT_SOCKS" ] || TPPORT_SOCKS=987
 [ -n "$WS_USER" ] || WS_USER=daemon
 [ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
 [ -n "$DESYNC_MARK_POSTNAT" ] || DESYNC_MARK_POSTNAT=0x20000000
@@ -32,8 +32,6 @@ IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
 IPSET_EXCLUDE="-m set ! --match-set nozapret"
 IPSET_EXCLUDE6="-m set ! --match-set nozapret6"

-apply_unspecified_desync_modes
-

 # can be multiple ipv6 outgoing interfaces
 # uplink from isp, tunnelbroker, vpn, ...
--- a/init.d/openwrt/zapret
+++ b/init.d/openwrt/zapret
@@ -114,68 +114,30 @@ tpws_apply_socks_binds()
 }


+standard_mode_daemons()
+{
+	local opt
+	[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$TPWS_OPT" && {
+		opt="--port=$TPPORT $TPWS_OPT"
+		filter_apply_hostlist_target opt
+		run_tpws 1 "$opt"
+	}
+	[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
+		opt="--port=$TPPORT_SOCKS $TPWS_OPT"
+		filter_apply_hostlist_target opt
+		run_tpws_socks 2 "$opt"
+	}
+	[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$NFQWS_OPT" && {
+		opt="--qnum=$QNUM $NFQWS_OPT"
+		filter_apply_hostlist_target opt
+		run_daemon 3 "$NFQWS" "$opt"
+	}
+}
+
 start_daemons_procd()
 {
-	local opt qn qns qn6 qns6
-
-	case "${MODE_OVERRIDE:-$MODE}" in
-		tpws)
-			opt="--port=$TPPORT $TPWS_OPT"
-			filter_apply_hostlist_target opt
-			filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
-			run_tpws 1 "$opt"
-			;;
-		tpws-socks)
-			opt="--port=$TPPORT $TPWS_OPT"
-			filter_apply_hostlist_target opt
-			filter_apply_suffix opt "$TPWS_OPT_SUFFIX"
-			run_tpws_socks 1 "$opt"
-			;;
-		nfqws)
-			# quite complex but we need to minimize nfqws processes to save RAM
-			get_nfqws_qnums qn qns qn6 qns6
-			[ -z "$qn" ] || {
-				opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP_SUFFIX"
-				run_daemon 1 "$NFQWS" "$opt"
-			}
-			[ -z "$qns" ] || [ "$qns" = "$qn" ] || {
-				opt="--qnum=$qns $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS_SUFFIX"
-				run_daemon 2 "$NFQWS" "$opt"
-			}
-			[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || [ "$qn6" = "$qns" ] || {
-				opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTP6"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTP6_SUFFIX"
-				run_daemon 3 "$NFQWS" "$opt"
-			}
-			[ -z "$qns6" ] || [ "$qns6" = "$qn" ] || [ "$qns6" = "$qns" ] || [ "$qns6" = "$qn6" ] || {
-				opt="--qnum=$qns6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_HTTPS6"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_HTTPS6_SUFFIX"
-				run_daemon 4 "$NFQWS" "$opt"
-			}
-			get_nfqws_qnums_quic qn qn6
-			[ -z "$qn" ] || {
-				opt="--qnum=$qn $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC_SUFFIX"
-				run_daemon 10 "$NFQWS" "$opt"
-			}
-			[ -z "$qn6" ] || [ "$qn6" = "$qn" ] || {
-				opt="--qnum=$qn6 $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC6"
-				filter_apply_hostlist_target opt
-				filter_apply_suffix opt "$NFQWS_OPT_DESYNC_QUIC6_SUFFIX"
-				run_daemon 11 "$NFQWS" "$opt"
-			}
-			;;
-		custom)
-	    		custom_runner zapret_custom_daemons $1
-			;;
-	esac
+	standard_mode_daemons
+	custom_runner zapret_custom_daemons

 	return 0
 }