Compare commits

...

15 Commits

Author SHA1 Message Date
NewUse
9ed07a252d
Merge branch 'bol-van:master' into tpws-luci 2024-10-22 01:45:55 +03:00
bol-van
8b3cac6a9a init.d: openwrt-minimal exclude localnet 2024-10-21 22:18:30 +03:00
bol-van
2914da35d6 init.d: openwrt-minimal disable ipv6 instructions 2024-10-21 22:14:10 +03:00
bol-van
5f60131f9f init.d: openwrt minimal fw4 restart instead of reload 2024-10-21 21:47:43 +03:00
bol-van
72a7cda579 init.d: openwrt-minimal remove exists check 2024-10-21 20:54:22 +03:00
bol-van
9831bb78f2 init.d: openwrt-minimal exclude local subnets 2024-10-21 20:50:28 +03:00
bol-van
238ee06da6 init.d: openwrt-minimal update disk reqs 2024-10-21 18:33:07 +03:00
bol-van
7b36760ab5 init.d: openwrt-minimal iptables 2024-10-21 18:29:51 +03:00
bol-van
ad0d65e492 init.d: openwrt min disk space startup 2024-10-21 17:53:55 +03:00
bol-van
2692735c61 init.d: openwrt min disk space startup 2024-10-21 17:53:25 +03:00
bol-van
3cfadd1717 init.d: openwrt min disk space startup 2024-10-21 17:51:02 +03:00
bol-van
386164f1f7 init.d: openwrt min disk space startup 2024-10-21 17:44:32 +03:00
bol-van
a54d6c1437 config.default: remove wrong GETLIST 2024-10-20 16:19:11 +03:00
bol-van
ee253fe5c6 preset-russia.cmd : remove autottl from youtube profile 2024-10-20 09:39:49 +03:00
bol-van
e42e0513c5 nfqws: fix autottl remove after profile change 2024-10-18 23:18:19 +03:00
23 changed files with 232 additions and 4 deletions

2
.gitignore vendored
View File

@ -1,4 +1,4 @@
config
/config
ip2net/ip2net
mdig/mdig
nfq/nfqws

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

View File

@ -5,5 +5,5 @@ start "zapret: http,https,quic" /min "%~dp0winws.exe" ^
--filter-udp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%~dp0quic_initial_www_google_com.bin" --new ^
--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new ^
--filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --new ^
--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-repeats=11 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-repeats=11 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
--dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig

View File

@ -5,5 +5,5 @@ start "zapret: http,https,quic" /min "%~dp0winws.exe" ^
--filter-udp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%~dp0quic_initial_www_google_com.bin" --new ^
--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new ^
--filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="%~dp0autohostlist.txt" --new ^
--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-repeats=11 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-repeats=11 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
--dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="%~dp0autohostlist.txt"

Binary file not shown.

Binary file not shown.

View File

@ -123,4 +123,4 @@ DISABLE_IPV6=1
# select which init script will be used to get ip or host list
# possible values : get_user.sh get_antizapret.sh get_combined.sh get_reestr.sh get_hostlist.sh
# comment if not required
GETLIST=get_antifilter_ipsmart.sh
#GETLIST=

View File

@ -1716,6 +1716,64 @@ install_easy.sh автоматизирует ручные варианты пр
Система простой инсталяции заточена на любое умышленное или неумышленное изменение прав доступа на файлы.
Устойчива к репаку под windows. После копирования в /opt права будут принудительно восстановлены.
Установка на openwrt в режиме острой нехватки места на диске
------------------------------------------------------------
Требуется около 120-200 кб на диске. Придется отказаться от всего, кроме tpws.
* Инструкция для openwrt 22 и выше с nftables.
Никаких зависимостей устанавливать не нужно.
Установка :
Скопируйте все из init.d/openwrt-minimal/tpws/* в корень openwrt.
Скопируйте бинарник tpws подходящей архитектуры в /usr/bin/tpws.
Установите права на файлы : chmod 755 /etc/init.d/tpws /usr/bin/tpws
Отредактируйте /etc/config/tpws
Если не нужен ipv6, отредактируйте /etc/nftables.d/90-tpws.nft и закомментируйте строки с редиректом ipv6.
/etc/init.d/tpws enable
/etc/init.d/tpws start
fw4 restart
Полное удаление :
/etc/init.d/tpws disable
/etc/init.d/tpws stop
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws /usr/bin/tpws
fw4 restart
* Инструкция для openwrt 21 и ниже с iptables.
Установите зависимости :
opkg update
opkg install iptables-mod-extra
только для IPV6 : opkg install ip6tables-mod-nat
Убедитесь, что в /etc/firewall.user нет ничего значимого.
Если есть - не следуйте слепо инструкции. Обьедините код или создайте свой firewall include в /etc/config/firewall.
Установка :
Скопируйте все из init.d/openwrt-minimal/tpws/* в корень openwrt.
Скопируйте бинарник tpws подходящей архитектуры в /usr/bin/tpws.
Установите права на файлы : chmod 755 /etc/init.d/tpws /usr/bin/tpws
Отредактируйте /etc/config/tpws
Если не нужен ipv6, отредактируйте /etc/firewall.user и установите там DISABLE_IPV6=1.
/etc/init.d/tpws enable
/etc/init.d/tpws start
fw3 restart
Полное удаление :
/etc/init.d/tpws disable
/etc/init.d/tpws stop
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws
touch /etc/firewall.user
fw3 restart
Android
-------

View File

@ -0,0 +1,54 @@
Minimal tpws startup script for low storage openwrt.
--- openwrt with NFTABLES (22+)
Make sure you are running openwrt with nftables, not iptables.
No opkg dependencies required !
* install :
Copy everything from tpws directory to the root of the router.
Copy tpws binary for your architecture to /usr/bin/tpws
Set proper access rights : chmod 755 /etc/init.d/tpws /usr/bin/tpws
EDIT /etc/config/tpws
If you don't want ipv6 : edit /etc/nftables.d and comment lines with ipv6 redirect
/etc/init.d/tpws enable
/etc/init.d/tpws start
fw4 restart
* full uninstall :
/etc/init.d/tpws disable
/etc/init.d/tpws stop
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws
fw4 restart
--- openwrt with IPTABLES (21-)
Make sure you are running openwrt with iptables, not nftables.
Make sure you do not have anything valuable in /etc/firewall.user.
If you have - do not blindly follow instruction in firewall.user part.
Merge the code instead or setup your own firewall include in /etc/config/firewall.
opkg update
opkg install iptables-mod-extra
IPV6 ONLY : opkg install ip6tables-mod-nat
* install :
Copy everything from tpws directory to the root of the router.
Copy tpws binary for your architecture to /usr/bin/tpws
Set proper access rights : chmod 755 /etc/init.d/tpws /usr/bin/tpws
EDIT /etc/config/tpws
If you don't want ipv6 : edit /etc/firewall.user and set DISABLE_IPV6=1
/etc/init.d/tpws enable
/etc/init.d/tpws start
fw3 restart
* full uninstall :
/etc/init.d/tpws disable
/etc/init.d/tpws stop
rm -f /etc/nftables.d/90-tpws.nft /etc/firewall.user /etc/init.d/tpws
touch /etc/firewall.user
fw3 restart

View File

@ -0,0 +1,12 @@
config global defaults
option user daemon
option tpws /usr/bin/tpws
config tpws
option port 900
option opt '--split-pos=2 --oob'
option enabled 1
config tpws
option port 901
option opt '--split-tls=sni --disorder'
option enabled 0

View File

@ -0,0 +1,49 @@
DISABLE_IPV6=0
TP_PORT=900
TP_USER=daemon
EXCLUDE4="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 127.0.0.0/8"
EXCLUDE6="fc00::/7 fe80::/10 ::1"
IPTS="iptables ip6tables"
[ "$DISABLE_IPV6" = 1 ] && IPTS=iptables
exists()
{
which "$1" >/dev/null 2>/dev/null
}
ipt()
{
$IPTABLES -C "$@" >/dev/null 2>/dev/null || $IPTABLES -I "$@"
}
redirect_port()
{
ipt tpws -t nat -p tcp --dport $1 -j REDIRECT --to-port $2
}
redirect()
{
redirect_port 80 $TP_PORT
redirect_port 443 $TP_PORT
}
for IPTABLES in $IPTS; do
$IPTABLES -t nat -N tpws 2>/dev/null
$IPTABLES -t nat -F tpws
redirect
done
for net in $EXCLUDE4; do
iptables -t nat -I tpws -d $net -j RETURN
done
[ "$DISABLE_IPV6" = 1 ] || {
for net in $EXCLUDE6; do
ip6tables -t nat -I tpws -d $net -j RETURN
done
}
for IPTABLES in $IPTS; do
ipt PREROUTING -t nat -j tpws
ipt OUTPUT -t nat -m owner ! --uid-owner $TP_USER -j tpws
done

View File

@ -0,0 +1,34 @@
#!/bin/sh /etc/rc.common
TPWS_DEFAULT=/usr/bin/tpws
TPWS_USER_DEFAULT=daemon
START=99
STOP=01
USE_PROCD=1
tpws_instance()
{
config_get "$@"
local enabled port opt
config_get_bool enabled "$1" enabled 0
[ "$enabled" -eq 1 ] || return 1
config_get port "$1" port
config_get opt "$1" opt
local COMMAND="$TPWS --user=$TPWS_USER --port=$port $opt"
procd_open_instance
procd_set_param command $COMMAND
procd_close_instance
}
start_service()
{
config_load tpws
config_get TPWS_USER defaults user $TPWS_USER_DEFAULT
config_get TPWS defaults tpws $TPWS_DEFAULT
config_foreach tpws_instance tpws
}

View File

@ -0,0 +1,18 @@
set tpws_exclude4 {
type ipv4_addr; flags interval; auto-merge;
elements = { 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,127.0.0.0/8 }
}
set tpws_exclude6 {
type ipv6_addr; flags interval; auto-merge;
elements = { fc00::/7, fe80::/10, ::1 }
}
chain tpws_pre {
type nat hook prerouting priority dstnat; policy accept;
tcp dport {80,443} ip daddr != @tpws_exclude4 redirect to :900
tcp dport {80,443} ip6 daddr != @tpws_exclude6 redirect to :900
}
chain tpws_out {
type nat hook output priority -100; policy accept;
tcp dport {80,443} skuid != daemon ip daddr != @tpws_exclude4 redirect to :900
tcp dport {80,443} skuid != daemon ip6 daddr != @tpws_exclude6 redirect to :900
}

View File

@ -486,6 +486,7 @@ init.d/runit/zapret/finish \
init.d/openrc/zapret \
init.d/sysv/zapret \
init.d/openwrt/zapret \
init.d/openwrt-minimal/tpws/etc/init.d/tpws \
uninstall_easy.sh \
; do chmod 755 "$1/$f" 2>/dev/null ; done
}

View File

@ -612,6 +612,8 @@ static void autottl_discover(t_ctrack *ctrack, bool bIpv6)
else
DLOG("autottl: could not guess\n");
}
else
ctrack->autottl = 0;
}
}