zapret/init.d/openwrt/functions

273 lines
6.6 KiB
Plaintext
Raw Normal View History

. /lib/functions/network.sh
2021-03-04 11:30:38 +00:00
[ -n "$ZAPRET_BASE" ] || ZAPRET_BASE=/opt/zapret
. "$ZAPRET_BASE/config"
2022-02-15 14:15:36 +00:00
. "$ZAPRET_BASE/common/base.sh"
. "$ZAPRET_BASE/common/fwtype.sh"
. "$ZAPRET_BASE/common/queue.sh"
. "$ZAPRET_BASE/common/linux_iphelper.sh"
. "$ZAPRET_BASE/common/ipt.sh"
. "$ZAPRET_BASE/common/nft.sh"
. "$ZAPRET_BASE/common/linux_fw.sh"
2022-07-27 13:48:49 +00:00
. "$ZAPRET_BASE/common/list.sh"
2021-03-04 11:30:38 +00:00
2021-03-06 08:20:25 +00:00
[ -n "$QNUM" ] || QNUM=200
[ -n "$TPPORT" ] || TPPORT=988
[ -n "$WS_USER" ] || WS_USER=daemon
2021-03-04 11:30:38 +00:00
[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
[ -n "$OPENWRT_LAN" ] || OPENWRT_LAN=lan
2021-03-04 11:30:38 +00:00
2022-02-15 14:15:36 +00:00
TPWS_LOCALHOST4=127.0.0.127
2021-03-04 11:30:38 +00:00
# max wait time for the link local ipv6 on the LAN interface
LINKLOCAL_WAIT_SEC=5
IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
CUSTOM_SCRIPT="$ZAPRET_BASE/init.d/openwrt/custom"
2021-03-04 11:30:38 +00:00
[ -f "$CUSTOM_SCRIPT" ] && . "$CUSTOM_SCRIPT"
IPSET_EXCLUDE="-m set ! --match-set nozapret"
IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
2023-10-26 12:12:32 +00:00
apply_unspecified_desync_modes
2021-03-04 11:30:38 +00:00
# can be multiple ipv6 outgoing interfaces
# uplink from isp, tunnelbroker, vpn, ...
# want them all. who knows what's the real one that blocks sites
# dont want any manual configuration - want to do it automatically
# standard network_find_wan[6] return only the first
# we use low level function from network.sh to avoid this limitation
# it can change theoretically and stop working
2022-02-16 12:46:29 +00:00
network_find_wan4_all()
{
2022-02-15 14:15:36 +00:00
__network_ifstatus "$1" "" "[@.route[@.target='0.0.0.0' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan $1
}
2022-02-16 12:46:29 +00:00
network_find_wan_all()
{
network_find_wan4_all "$@"
}
network_find_wan6_all()
{
2022-02-15 14:15:36 +00:00
__network_ifstatus "$1" "" "[@.route[@.target='::' && !@.table]].interface" "" 10 2>/dev/null && return
network_find_wan6 $1
}
2023-10-26 12:12:32 +00:00
network_find_wanX_devices()
{
# $1 - ip version: 4 or 6
# $2 - variable to put result to
local ifaces
network_find_wan${1}_all ifaces
call_for_multiple_items network_get_device $2 "$ifaces"
}
2022-02-15 14:15:36 +00:00
dnat6_target()
2021-03-04 11:30:38 +00:00
{
2022-02-15 14:15:36 +00:00
# $1 - lan network name
# $2 - var to store target ip6
2022-02-16 12:46:29 +00:00
network_is_up $1 || {
[ -n "$2" ] && eval $2=''
return
2022-02-15 14:15:36 +00:00
}
2022-02-16 12:46:29 +00:00
local DEVICE
network_get_device DEVICE $1
2022-02-15 14:15:36 +00:00
2022-02-16 12:46:29 +00:00
_dnat6_target $DEVICE $2
2021-03-04 11:30:38 +00:00
}
2022-02-16 12:46:29 +00:00
set_route_localnet()
2021-03-04 11:30:38 +00:00
{
2022-02-16 12:46:29 +00:00
# $1 - 1 = enable, 0 = disable
2021-03-04 11:30:38 +00:00
2022-02-16 12:46:29 +00:00
local DLAN
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
_set_route_localnet $1 $DLAN
}
2021-03-04 11:30:38 +00:00
2023-10-26 12:12:32 +00:00
fw_nfqws_prepost_x()
{
2022-02-15 14:15:36 +00:00
# $1 - 1 - add, 0 - del
2022-02-16 12:46:29 +00:00
# $2 - filter
2022-02-15 14:15:36 +00:00
# $3 - queue number
2023-10-26 12:12:32 +00:00
# $4 - 4/6
# $5 - post/pre
2023-10-26 12:12:32 +00:00
local ifaces DWAN
2022-02-16 12:46:29 +00:00
network_find_wan${4}_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces"
2023-10-26 12:12:32 +00:00
[ -n "$DWAN" ] && _fw_nfqws_${5}${4} $1 "$2" $3 "$(unique $DWAN)"
2021-03-04 11:30:38 +00:00
}
fw_nfqws_post4()
{
2023-10-26 12:12:32 +00:00
fw_nfqws_prepost_x $1 "$2" $3 4 post
2021-03-04 11:30:38 +00:00
}
fw_nfqws_post6()
{
2023-10-26 12:12:32 +00:00
fw_nfqws_prepost_x $1 "$2" $3 6 post
}
fw_nfqws_pre4()
{
fw_nfqws_prepost_x $1 "$2" $3 4 pre
}
fw_nfqws_pre6()
{
fw_nfqws_prepost_x $1 "$2" $3 6 pre
}
2022-02-16 12:46:29 +00:00
fw_tpws_x()
{
2022-02-15 14:15:36 +00:00
# $1 - 1 - add, 0 - del
2022-02-16 12:46:29 +00:00
# $2 - filter
# $3 - tpws port
# $4 - ip version : 4 or 6
2022-02-16 12:54:18 +00:00
local ifaces DLAN DWAN
2021-03-04 11:30:38 +00:00
2022-02-16 12:46:29 +00:00
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
network_find_wan${4}_all ifaces
call_for_multiple_items network_get_device DWAN "$ifaces"
2021-03-04 11:30:38 +00:00
[ -n "$DWAN" ] && _fw_tpws${4} $1 "$2" $3 "$DLAN" "$(unique $DWAN)"
2022-02-16 12:46:29 +00:00
}
fw_tpws4()
2021-03-04 11:30:38 +00:00
{
2022-02-16 12:46:29 +00:00
fw_tpws_x $1 "$2" $3 4
2021-03-04 11:30:38 +00:00
}
fw_tpws6()
2021-03-04 11:30:38 +00:00
{
2022-02-16 12:46:29 +00:00
fw_tpws_x $1 "$2" $3 6
}
2021-03-04 11:30:38 +00:00
create_ipset()
2021-03-04 11:30:38 +00:00
{
2022-02-15 14:15:36 +00:00
echo "Creating ip list table (firewall type $FWTYPE)"
"$IPSET_CR" "$@"
2021-03-04 11:30:38 +00:00
}
list_nfqws_rules()
{
# $1 = '' for ipv4, '6' for ipv6
ip$1tables -S POSTROUTING -t mangle | \
2023-07-02 15:46:26 +00:00
grep -E "NFQUEUE --queue-num $QNUM --queue-bypass|NFQUEUE --queue-num $(($QNUM+1)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+2)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+3)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+10)) --queue-bypass|NFQUEUE --queue-num $(($QNUM+11)) --queue-bypass" | \
sed -re 's/^-A POSTROUTING (.*) -j NFQUEUE.*$/\1/' -e "s/-m mark ! --mark $DESYNC_MARK\/$DESYNC_MARK//"
}
apply_flow_offloading_enable_rule()
{
# $1 = '' for ipv4, '6' for ipv6
local i off='-j FLOWOFFLOAD'
[ "$FLOWOFFLOAD" = "hardware" ] && off="$off --hw"
i="forwarding_rule_zapret -m comment --comment zapret_traffic_offloading_enable -m conntrack --ctstate RELATED,ESTABLISHED $off"
echo enabling ipv${1:-4} flow offloading : $i
ip$1tables -A $i
}
apply_flow_offloading_exempt_rule()
{
# $1 = '' for ipv4, '6' for ipv6
local i v
v=$1
shift
i="forwarding_rule_zapret $@ -m comment --comment zapret_traffic_offloading_exemption -j RETURN"
echo applying ipv${v:-4} flow offloading exemption : $i
ip${v}tables -A $i
}
2022-02-15 14:15:36 +00:00
flow_offloading_unexempt_v()
{
2023-10-26 12:12:32 +00:00
# $1 = '' for ipv4, '6' for ipv6
local DWAN
network_find_wanX_devices ${1:-4} DWAN
for i in $DWAN; do ipt$1_del FORWARD -o $i -j forwarding_rule_zapret ; done
2022-02-15 14:15:36 +00:00
ip$1tables -F forwarding_rule_zapret 2>/dev/null
ip$1tables -X forwarding_rule_zapret 2>/dev/null
}
flow_offloading_exempt_v()
{
# $1 = '' for ipv4, '6' for ipv6
2022-02-15 14:15:36 +00:00
is_ipt_flow_offload_avail $1 || return 0
2022-02-15 14:15:36 +00:00
flow_offloading_unexempt_v $1
2021-03-04 11:30:38 +00:00
[ "$FLOWOFFLOAD" = 'software' -o "$FLOWOFFLOAD" = 'hardware' ] && {
ip$1tables -N forwarding_rule_zapret
2021-03-04 11:30:38 +00:00
2023-10-26 12:12:32 +00:00
# remove outgoing interface
list_nfqws_rules $1 | sed -re 's/-o +[^ ]+//g' |
while read rule; do
apply_flow_offloading_exempt_rule "$1" $rule
done
apply_flow_offloading_enable_rule $1
2023-10-26 12:12:32 +00:00
# only outgoing to WAN packets trigger flow offloading
local DWAN
network_find_wanX_devices ${1:-4} DWAN
for i in $DWAN; do ipt$1 FORWARD -o $i -j forwarding_rule_zapret; done
}
return 0
}
flow_offloading_exempt()
2021-03-04 11:30:38 +00:00
{
[ "$DISABLE_IPV4" = "1" ] || flow_offloading_exempt_v
[ "$DISABLE_IPV6" = "1" ] || flow_offloading_exempt_v 6
}
2022-02-15 14:15:36 +00:00
flow_offloading_unexempt()
{
[ "$DISABLE_IPV4" = "1" ] || flow_offloading_unexempt_v
[ "$DISABLE_IPV6" = "1" ] || flow_offloading_unexempt_v 6
}
2021-03-04 11:30:38 +00:00
2022-02-16 12:46:29 +00:00
2022-02-15 20:11:43 +00:00
nft_fill_ifsets_overload()
{
local ifaces DLAN DWAN DWAN6 PDLAN PDWAN PDWAN6
2021-03-04 11:30:38 +00:00
2022-02-15 20:11:43 +00:00
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
call_for_multiple_items network_get_physdev PDLAN "$OPENWRT_LAN"
2021-03-04 11:30:38 +00:00
2022-02-16 12:46:29 +00:00
network_find_wan4_all ifaces
2022-02-15 20:11:43 +00:00
call_for_multiple_items network_get_device DWAN "$ifaces"
call_for_multiple_items network_get_physdev PDWAN "$ifaces"
2022-02-15 20:11:43 +00:00
network_find_wan6_all ifaces
call_for_multiple_items network_get_device DWAN6 "$ifaces"
call_for_multiple_items network_get_physdev PDWAN6 "$ifaces"
2022-02-15 14:15:36 +00:00
nft_fill_ifsets "$DLAN" "$DWAN" "$DWAN6" "$PDLAN" "$PDWAN" "$PDWAN6"
2022-02-15 14:15:36 +00:00
}
2022-02-16 12:50:20 +00:00
nft_fw_tpws4()
{
_nft_fw_tpws4 "$1" $2 always_apply_wan_filter
}
2022-02-15 14:15:36 +00:00
nft_fw_tpws6()
{
2022-02-16 12:54:18 +00:00
local DLAN
2022-02-16 12:46:29 +00:00
call_for_multiple_items network_get_device DLAN "$OPENWRT_LAN"
2022-02-16 12:50:20 +00:00
_nft_fw_tpws6 "$1" $2 "$DLAN" always_apply_wan_filter
}
nft_fw_nfqws_post4()
{
_nft_fw_nfqws_post4 "$1" $2 always_apply_wan_filter
}
nft_fw_nfqws_post6()
{
_nft_fw_nfqws_post6 "$1" $2 always_apply_wan_filter
2021-03-04 11:30:38 +00:00
}
2023-10-26 12:12:32 +00:00
nft_fw_nfqws_pre4()
{
_nft_fw_nfqws_pre4 "$1" $2 always_apply_wan_filter
}
nft_fw_nfqws_pre6()
{
_nft_fw_nfqws_pre6 "$1" $2 always_apply_wan_filter
}