drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-05-24 22:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

major config re-think and re-write

Browse Source
This commit is contained in:
bol-van
2024-10-25 14:29:47 +03:00
parent d86aa42f48
commit 906e67af55
39 changed files with 963 additions and 1340 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
init.d/sysv/custom.d.examples/10-inherit-nfqws
View File

@@ -1,25 +0,0 @@
# this custom script applies nfqws mode as it would be with MODE=nfqws
OVERRIDE=nfqws
zapret_custom_daemons()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_daemons $1
}
zapret_custom_firewall()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_firewall_rules_ipt $1
}
zapret_custom_firewall_nft()
{
# stop logic is not required
local MODE_OVERRIDE=$OVERRIDE
zapret_apply_firewall_rules_nft
}

25
init.d/sysv/custom.d.examples/10-inherit-tpws
View File

@@ -1,25 +0,0 @@
# this custom script applies tpws mode as it would be with MODE=tpws
OVERRIDE=tpws
zapret_custom_daemons()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_daemons $1
}
zapret_custom_firewall()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_firewall_rules_ipt $1
}
zapret_custom_firewall_nft()
{
# stop logic is not required
local MODE_OVERRIDE=$OVERRIDE
zapret_apply_firewall_rules_nft
}

25
init.d/sysv/custom.d.examples/10-inherit-tpws-socks
View File

@@ -1,25 +0,0 @@
# this custom script applies tpws-socks mode as it would be with MODE=tpws-socks
OVERRIDE=tpws-socks
zapret_custom_daemons()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_daemons $1
}
zapret_custom_firewall()
{
# $1 - 1 - run, 0 - stop
local MODE_OVERRIDE=$OVERRIDE
zapret_do_firewall_rules_ipt $1
}
zapret_custom_firewall_nft()
{
# stop logic is not required
local MODE_OVERRIDE=$OVERRIDE
zapret_apply_firewall_rules_nft
}

35
init.d/sysv/custom.d.examples/10-inherit-tpws4http-nfqws4https
View File

@@ -1,35 +0,0 @@
# this custom script demonstrates how to apply tpws to http and nfqws to https and quic
# it's desired that inherited basic rules are low priority to allow specializations and exceptions in other custom scripts
nfqws_tpws_inheritor()
{
# $1 - inherited function
# $2 - 1 - run, 0 - stop
local MODE_OVERRIDE
[ "$MODE_HTTP" = "1" ] && {
MODE_OVERRIDE=tpws MODE_HTTPS=0 MODE_QUIC=0 $1 $2
}
[ "$MODE_HTTPS" = "1" -o "$MODE_QUIC" = "1" ] && {
MODE_OVERRIDE=nfqws MODE_HTTP=0 $1 $2
}
}
zapret_custom_daemons()
{
# $1 - 1 - run, 0 - stop
nfqws_tpws_inheritor zapret_do_daemons $1
}
zapret_custom_firewall()
{
# $1 - 1 - run, 0 - stop
nfqws_tpws_inheritor zapret_do_firewall_rules_ipt $1
}
zapret_custom_firewall_nft()
{
# stop logic is not required
nfqws_tpws_inheritor zapret_apply_firewall_rules_nft
}

12
init.d/sysv/custom.d.examples/50-dht4all
View File

@@ -1,5 +1,7 @@
# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
# need to add to config : NFQWS_OPT_DESYNC_DHT="--dpi-desync=fake --dpi-desync-ttl=5"
# can override in config :
NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}"
alloc_dnum DNUM_DHT4ALL
alloc_qnum QNUM_DHT4ALL
@@ -17,13 +19,11 @@ zapret_custom_firewall()
local f uf4 uf6
local first_packet_only="$ipt_connbytes 1:1"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
f='-p udp -m length --length 109:407 -m u32 --u32'
uf4='0>>22&0x3C@8>>16=0x6431'
uf6='48>>16=0x6431'
fw_nfqws_post $1 "$f $uf4 $desync $first_packet_only" "$f $uf6 $desync $first_packet_only" $QNUM_DHT4ALL
fw_nfqws_post $1 "$f $uf4 $first_packet_only" "$f $uf6 $first_packet_only" $QNUM_DHT4ALL
}
zapret_custom_firewall_nft()
{
@@ -31,9 +31,7 @@ zapret_custom_firewall_nft()
local f
local first_packet_only="$nft_connbytes 1"
local desync="mark and $DESYNC_MARK == 0"
f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
nft_fw_nfqws_post "$f $desync $first_packet_only" "$f $desync $first_packet_only" $QNUM_DHT4ALL
nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL
}

8
init.d/sysv/custom.d.examples/50-discord
View File

@@ -1,4 +1,4 @@
# this custom script in addition to MODE=nfqws runs desync of some udp packets to discord subnets
# this custom script runs desync of some udp packets to discord subnets
# idea taken from community. not tested and not optimized by author.
# can override in config :
@@ -24,7 +24,6 @@ zapret_custom_firewall()
local f
local first_packets_only="$ipt_connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
local DISCORD_PORTS_IPT=$(replace_char - : $DISCORD_PORTS)
local dest_set="-m set --match-set $DISCORD_SET_NAME dst"
local subnet
@@ -40,7 +39,7 @@ zapret_custom_firewall()
}
f="-p udp -m multiport --dports $DISCORD_PORTS_IPT"
fw_nfqws_post $1 "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
[ "$1" = 1 ] || {
ipset destroy $DISCORD_SET_NAME 2>/dev/null
@@ -53,7 +52,6 @@ zapret_custom_firewall_nft()
local f
local first_packets_only="$nft_connbytes 1-3"
local desync="mark and $DESYNC_MARK == 0"
local dest_set="ip daddr @$DISCORD_SET_NAME"
local subnets
@@ -65,7 +63,7 @@ zapret_custom_firewall_nft()
nft_add_set_element $DISCORD_SET_NAME "$subnets"
f="udp dport {$DISCORD_PORTS}"
nft_fw_nfqws_post "$f $desync $first_packets_only $dest_set" "" $QNUM_DISCORD
nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_DISCORD
}
zapret_custom_firewall_nft_flush()

37
init.d/sysv/custom.d.examples/50-quic4all
View File

@@ -1,37 +0,0 @@
# this custom script runs desync to all QUIC initial packets, without ipset/hostlist filtering
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
alloc_dnum DNUM_QUIC4ALL
alloc_qnum QNUM_QUIC4ALL
zapret_custom_daemons()
{
# $1 - 1 - run, 0 - stop
local opt="--qnum=$QNUM_QUIC4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_QUIC"
do_nfqws $1 $DNUM_QUIC4ALL "$opt"
}
zapret_custom_firewall()
{
# $1 - 1 - run, 0 - stop
local f
local first_packets_only="$ipt_connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
f="-p udp -m multiport --dports $QUIC_PORTS_IPT"
fw_nfqws_post $1 "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
}
zapret_custom_firewall_nft()
{
# stop logic is not required
local f
local first_packets_only="$nft_connbytes 1-3"
local desync="mark and $DESYNC_MARK == 0"
f="udp dport {$QUIC_PORTS}"
nft_fw_nfqws_post "$f $desync $first_packets_only" "$f $desync $first_packets_only" $QNUM_QUIC4ALL
}