drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-05-24 22:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

history purge

Browse Source
This commit is contained in:
bol-van
2020-01-02 13:10:28 +03:00
commit ae2b6d1e86
117 changed files with 14137 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
init.d/openwrt/90-zapret Normal file
View File

@@ -0,0 +1,8 @@
#!/bin/sh
ZAPRET=/etc/init.d/zapret
[ -x "$ZAPRET" ] && [ "$INTERFACE" = "lan" ] && {
[ "$ACTION" = "ifup" ] && {
$ZAPRET enabled && $ZAPRET start
}
}

20
init.d/openwrt/custom Normal file
View File

@@ -0,0 +1,20 @@
# this script contain your special code to launch daemons and configure firewall
# use helpers from "functions" file and "zapret" init script
# in case of upgrade keep this file only, do not modify others
zapret_custom_daemons()
{
# PLACEHOLDER
echo !!! NEED ATTENTION !!!
echo Start daemon\(s\)
echo Study how other sections work
run_daemon 1 /bin/sleep 20
}
zapret_custom_firewall()
{
# PLACEHOLDER
echo !!! NEED ATTENTION !!!
echo Configure iptables for required actions
echo Study how other sections work
}

3
init.d/openwrt/firewall.zapret Normal file
View File

@@ -0,0 +1,3 @@
. /opt/zapret/init.d/openwrt/functions
zapret_apply_firewall

320
init.d/openwrt/functions Normal file
View File

@@ -0,0 +1,320 @@
. /lib/functions/network.sh
[ -n "$ZAPRET_BASE" ] || ZAPRET_BASE=/opt/zapret
. "$ZAPRET_BASE/config"
QNUM=200
TPPORT_HTTP=1188
TPPORT_HTTPS=1189
TPWS_USER=daemon
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
# max wait time for the link local ipv6 on the LAN interface
LINKLOCAL_WAIT_SEC=5
IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/openwrt/custom"
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
IPSET_EXCLUDE="-m set ! --match-set nozapret"
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
exists()
{
which "$1" >/dev/null 2>/dev/null
}
existf()
{
type "$1" >/dev/null 2>/dev/null
}
# can be multiple ipv6 outgoing interfaces
# uplink from isp, tunnelbroker, vpn, ...
# want them all. who knows what's the real one that blocks sites
# dont want any manual configuration - want to do it automatically
# standard network_find_wan[6] return only the first
# we use low level function from network.sh to avoid this limitation
# it can change theoretically and stop working
network_find_wan_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan $1
}
network_find_wan6_all()
{
__network_ifstatus "$1" "" "[@.route[@.target='::' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan6 $1
}
ipt()
{
iptables -C "$@" 2>/dev/null || iptables -I "$@"
}
ipt6()
{
ip6tables -C "$@" 2>/dev/null || ip6tables -I "$@"
}
# there's no route_localnet for ipv6
# the best we can is to route to link local of the incoming interface
# OUTPUT - can DNAT to ::1
# PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr
# not a good idea to expose tpws to the world (bind to ::)
get_ipv6_linklocal()
{
# $1 - interface name. if empty - any interface
if exists ip ; then
local dev
[ -n "$1" ] && dev="dev $1"
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope link.*$/\1/;t;d' | head -n 1
else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Link.*$/\1/;t;d' | head -n 1
fi
}
get_ipv6_global()
{
# $1 - interface name. if empty - any interface
if exists ip ; then
local dev
[ -n "$1" ] && dev="dev $1"
ip addr show $dev | sed -e 's/^.*inet6 \([^ ]*\)\/[0-9]* scope global.*$/\1/;t;d' | head -n 1
else
ifconfig $1 | sed -re 's/^.*inet6 addr: ([^ ]*)\/[0-9]* Scope:Global.*$/\1/;t;d' | head -n 1
fi
}
dnat6_target()
{
# get target ip address for DNAT. prefer link locals
# tpws should be as inaccessible from outside as possible
# link local address can appear not immediately after ifup
# DNAT6_TARGET=- means attempt was made but address was not found (to avoid multiple re-attempts)
[ -n "$DNAT6_TARGET" ] || {
# no reason to query if its down
network_is_up lan || return
local DEVICE
network_get_device DEVICE lan
local ct=0
while
DNAT6_TARGET=$(get_ipv6_linklocal $DEVICE)
[ -n "$DNAT6_TARGET" ] && break
[ "$ct" -ge "$LINKLOCAL_WAIT_SEC" ] && break
echo waiting for the link local for another $(($LINKLOCAL_WAIT_SEC - $ct)) seconds ...
ct=$(($ct+1))
sleep 1
do :; done
[ -n "$DNAT6_TARGET" ] || {
echo no link local. getting global
DNAT6_TARGET=$(get_ipv6_global $DEVICE)
[ -n "$DNAT6_TARGET" ] || {
echo could not get any address
DNAT6_TARGET=-
}
}
}
}
fw_nfqws_pre4()
{
# $1 - filter ipv4
# $2 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt PREROUTING -t mangle -i $DEVICE -p tcp $1 $IPSET_EXCLUDE src -j NFQUEUE --queue-num $2 --queue-bypass
done
}
}
fw_nfqws_pre6()
{
# $1 - filter ipv6
# $2 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 PREROUTING -t mangle -i $DEVICE -p tcp $1 $IPSET_EXCLUDE6 src -j NFQUEUE --queue-num $2 --queue-bypass
done
}
}
fw_nfqws_pre()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - queue number
fw_nfqws_pre4 "$1" $3
fw_nfqws_pre6 "$2" $3
}
fw_nfqws_post4()
{
# $1 - filter ipv4
# $2 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt POSTROUTING -t mangle -o $DEVICE -p tcp $1 $IPSET_EXCLUDE dst -j NFQUEUE --queue-num $2 --queue-bypass
done
}
}
fw_nfqws_post6()
{
# $1 - filter ipv6
# $2 - queue number
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 POSTROUTING -t mangle -o $DEVICE -p tcp $1 $IPSET_EXCLUDE6 dst -j NFQUEUE --queue-num $2 --queue-bypass
done
}
}
fw_nfqws_post()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - queue number
fw_nfqws_post4 "$1" $3
fw_nfqws_post6 "$2" $3
}
IPT_OWNER="-m owner ! --uid-owner $TPWS_USER"
fw_tpws4()
{
# $1 - filter ipv6
# $2 - tpws port
local DEVICE wan_iface
[ "$DISABLE_IPV4" = "1" ] || {
network_find_wan_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 $IPSET_EXCLUDE dst -j DNAT --to 127.0.0.1:$2
done
ipt prerouting_lan_rule -t nat -p tcp $1 $IPSET_EXCLUDE dst -j DNAT --to 127.0.0.1:$2
network_get_device DEVICE lan
sysctl -qw net.ipv4.conf.$DEVICE.route_localnet=1
}
}
fw_tpws6()
{
# $1 - filter ipv6
# $2 - tpws port
local DEVICE wan_iface
[ "$DISABLE_IPV6" = "1" ] || {
network_find_wan6_all wan_iface
for ext_iface in $wan_iface; do
network_get_device DEVICE $ext_iface
ipt6 OUTPUT -t nat -o $DEVICE $IPT_OWNER -p tcp $1 $IPSET_EXCLUDE6 dst -j DNAT --to [::1]:$2
done
network_get_device DEVICE lan
dnat6_target
[ "$DNAT6_TARGET" != "-" ] && ipt6 PREROUTING -t nat -i $DEVICE -p tcp $1 $IPSET_EXCLUDE6 dst -j DNAT --to [$DNAT6_TARGET]:$2
}
}
fw_tpws()
{
# $1 - filter ipv4
# $2 - filter ipv6
# $3 - tpws port
fw_tpws4 "$1" $3
fw_tpws6 "$2" $3
}
create_ipset()
{
echo "Creating ipset"
"$IPSET_CR" "$@"
}
zapret_apply_firewall()
{
local rule
local synack="--tcp-flags SYN,ACK SYN,ACK"
local ipset_zapret="-m set --match-set zapret"
local ipset_zapret6="-m set --match-set zapret6"
local desync="-m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 2:4 -m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
# always create ipsets. ip_exclude ipset is required
create_ipset no-update
case "${MODE}" in
tpws_hostlist|tpws_all)
fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
;;
tpws_ipset)
fw_tpws "--dport 80 $ipset_zapret dst" "--dport 80 $ipset_zapret6 dst" $TPPORT_HTTP
;;
tpws_ipset_https)
fw_tpws "--dport 80 $ipset_zapret dst" "--dport 80 $ipset_zapret6 dst" $TPPORT_HTTP
fw_tpws "--dport 443 $ipset_zapret dst" "--dport 443 $ipset_zapret6 dst" $TPPORT_HTTPS
;;
tpws_all_https)
fw_tpws "--dport 80" "--dport 80" $TPPORT_HTTP
fw_tpws "--dport 443" "--dport 443" $TPPORT_HTTPS
;;
nfqws_ipset)
fw_nfqws_pre "--sport 80 $synack $ipset_zapret src" "--sport 80 $synack $ipset_zapret6 src" $QNUM
fw_nfqws_post "--dport 80 $ipset_zapret dst" "--dport 80 $ipset_zapret6 dst" $QNUM
;;
nfqws_ipset_https)
rule="-m multiport --sports 80,443 $synack"
fw_nfqws_pre "$rule $ipset_zapret src" "$rule $ipset_zapret6 src" $QNUM
fw_nfqws_post "--dport 80 $ipset_zapret dst" "--dport 80 $ipset_zapret6 dst" $QNUM
;;
nfqws_all)
fw_nfqws_pre "--sport 80 $synack" "--sport 80 $synack" $QNUM
fw_nfqws_post "--dport 80" "--dport 80" $QNUM
;;
nfqws_all_https)
rule="-m multiport --sports 80,443 $synack"
fw_nfqws_pre "$rule" "$rule" $QNUM
fw_nfqws_post "--dport 80" "--dport 80" $QNUM
;;
nfqws_all_desync|nfqws_hostlist_desync)
rule="-m multiport --sports 80,443 $synack"
fw_nfqws_pre "$rule" "$rule" $QNUM
fw_nfqws_post "$desync" "$desync" $QNUM
;;
nfqws_ipset_desync)
rule="-m multiport --sports 80,443 $synack"
fw_nfqws_pre "$rule $ipset_zapret src" "$rule $ipset_zapret6 src" $QNUM
fw_nfqws_post "$desync $ipset_zapret dst" "$desync $ipset_zapret6 dst" $QNUM
;;
custom)
existf zapret_custom_firewall && zapret_custom_firewall
;;
esac
}

90
init.d/openwrt/zapret Executable file
View File

@@ -0,0 +1,90 @@
#!/bin/sh /etc/rc.common
USE_PROCD=1
# after network
START=21
ZAPRET_BASE=/opt/zapret
. "$ZAPRET_BASE/init.d/openwrt/functions"
# !!!!! in openwrt firewall rules are configured separately
PIDDIR=/var/run
QNUM=200
NFQWS_USER=daemon
NFQWS="$ZAPRET_BASE/nfq/nfqws"
NFQWS_OPT_BASE="--qnum=$QNUM --user=$NFQWS_USER"
TPWS_USER=daemon
TPPORT_HTTP=1188
TPPORT_HTTPS=1189
TPWS="$ZAPRET_BASE/tpws/tpws"
HOSTLIST="$ZAPRET_BASE/ipset/zapret-hosts.txt.gz"
[ -f "$HOSTLIST" ] || HOSTLIST="$ZAPRET_BASE/ipset/zapret-hosts-user.txt"
TPWS_OPT_BASE="--user=$TPWS_USER --bind-addr=127.0.0.1"
TPWS_OPT_BASE6="--user=$TPWS_USER --bind-addr=::1"
# first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
TPWS_OPT_BASE6_PRE="--user=$TPWS_USER --bind-linklocal=prefer --bind-wait-ifup=30 --bind-wait-ip=30 --bind-wait-ip-linklocal=3"
TPWS_OPT_BASE_HTTP="--port=$TPPORT_HTTP"
TPWS_OPT_BASE_HTTPS="--port=$TPPORT_HTTPS"
run_daemon()
{
# $1 - daemon string id or number. can use 1,2,3,...
# $2 - daemon
# $3 - daemon args
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
local DAEMONBASE=$(basename $2)
echo "Starting daemon $1: $2 $3"
procd_open_instance
procd_set_param command $2 $3
procd_set_param pidfile $PIDDIR/$DAEMONBASE$1.pid
procd_close_instance
}
run_tpws()
{
[ "$DISABLE_IPV4" = "1" ] || run_daemon $1 $TPWS "$TPWS_OPT_BASE $2"
[ "$DISABLE_IPV6" = "1" ] || {
run_daemon $((60+$1)) $TPWS "$TPWS_OPT_BASE6 $2"
network_get_device DEVICE lan
[ -n "$DEVICE" ] && run_daemon $((660+$1)) $TPWS "$TPWS_OPT_BASE6_PRE --bind-iface6=$DEVICE $2"
}
}
stop_tpws()
{
[ "$DISABLE_IPV4" = "1" ] || stop_daemon $1 $TPWS
[ "$DISABLE_IPV6" = "1" ] || {
stop_daemon $((60+$1)) $TPWS
stop_daemon $((660+$1)) $TPWS
}
}
start_service() {
case "${MODE}" in
tpws_hostlist)
run_tpws 1 "$TPWS_OPT_BASE_HTTP $TPWS_OPT_HTTP --hostlist=$HOSTLIST"
;;
tpws_ipset|tpws_all)
run_tpws 1 "$TPWS_OPT_BASE_HTTP $TPWS_OPT_HTTP"
;;
tpws_ipset_https|tpws_all_https)
run_tpws 1 "$TPWS_OPT_BASE_HTTP $TPWS_OPT_HTTP"
run_tpws 2 "$TPWS_OPT_BASE_HTTPS $TPWS_OPT_HTTPS"
;;
nfqws_ipset|nfqws_ipset_https|nfqws_all|nfqws_all_https)
run_daemon 1 $NFQWS "$NFQWS_OPT_BASE $NFQWS_OPT"
;;
nfqws_ipset_desync|nfqws_all_desync)
run_daemon 1 $NFQWS "$NFQWS_OPT_BASE $NFQWS_OPT_DESYNC"
;;
nfqws_hostlist_desync)
run_daemon 1 $NFQWS "$NFQWS_OPT_BASE $NFQWS_OPT_DESYNC --hostlist=$HOSTLIST"
;;
custom)
existf zapret_custom_daemons && zapret_custom_daemons $1
;;
esac
}