Truncated history

.gitattributes

@@ -0,0 +1,4 @@
+* text=auto eol=lf
+binaries/win64/readme.txt eol=crlf
+*.cmd eol=crlf
+*.bat eol=crlf

.gitignore

@@ -0,0 +1,12 @@
+config
+ip2net/ip2net
+mdig/mdig
+nfq/nfqws
+tpws/tpws
+binaries/my/
+binaries/win64/zapret-winws/autohostlist.txt
+init.d/**/custom
+ipset/zapret-ip*.txt
+ipset/zapret-ip*.gz
+ipset/zapret-hosts*.txt
+ipset/zapret-hosts*.gz

Makefile

@@ -0,0 +1,48 @@
+DIRS := nfq tpws ip2net mdig
+DIRS_MAC := tpws ip2net mdig
+TGT := binaries/my
+
+all:	clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
+bsd:	clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" bsd || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
+mac:	clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS_MAC); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" mac || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
+clean:
+	@[ -d "$(TGT)" ] && rm -rf "$(TGT)" ; \
+	for dir in $(DIRS); do \
+		$(MAKE) -C "$$dir" clean; \
+	done

binaries/win64/readme.txt

@@ -0,0 +1,9 @@
+Standalone version in zapret-winws folder !!
+From this folder winws can be started only from cygwin shell.
+
+Cygwin refuses to start winws if a copy of cygwin1.dll is present !
+
+How to get win7 and winws compatible version of cygwin :
+
+curl -O https://www.cygwin.com/setup-x86_64.exe
+setup-x86_64.exe --allow-unsupported-windows --no-verify --site http://ctm.crouchingtigerhiddenfruitbat.org/pub/cygwin/circa/64bit/2024/01/30/231215

binaries/win64/zapret-winws/list-youtube.txt

@@ -0,0 +1,3 @@
+googlevideo.com
+youtubei.googleapis.com
+i.ytimg.com

binaries/win64/zapret-winws/preset_russia.cmd

@@ -0,0 +1,7 @@
+start "zapret: http,https,quic" /min "%~dp0winws.exe" ^
+--wf-tcp=80,443 --wf-udp=443 ^
+--filter-udp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%~dp0quic_initial_www_google_com.bin" --new ^
+--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new ^
+--filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --new ^
+--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
+--dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig

binaries/win64/zapret-winws/preset_russia_autohostlist.cmd

@@ -0,0 +1,7 @@
+start "zapret: http,https,quic" /min "%~dp0winws.exe" ^
+--wf-tcp=80,443 --wf-udp=443 ^
+--filter-udp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%~dp0quic_initial_www_google_com.bin" --new ^
+--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new ^
+--filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="%~dp0autohostlist.txt" --new ^
+--filter-tcp=443 --hostlist="%~dp0list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="%~dp0tls_clienthello_www_google_com.bin" --new ^
+--dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="%~dp0autohostlist.txt"

binaries/win64/zapret-winws/service_create.cmd

@@ -0,0 +1,12 @@
+set ARGS=--wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig
+call :srvinst winws1
+rem set ARGS=--wf-l3=ipv4,ipv6 --wf-udp=443 --dpi-desync=fake 
+rem call :srvinst winws2
+goto :eof
+
+:srvinst
+net stop %1
+sc delete %1
+sc create %1 binPath= "\"%~dp0winws.exe\" %ARGS%" DisplayName= "zapret DPI bypass : %1" start= auto
+sc description %1 "zapret DPI bypass software"
+sc start %1

binaries/win64/zapret-winws/service_del.cmd

@@ -0,0 +1,7 @@
+call :srvdel winws1
+rem call :srvdel winws2
+goto :eof
+
+:srvdel
+net stop %1
+sc delete %1

binaries/win64/zapret-winws/service_start.cmd

@@ -0,0 +1,2 @@
+sc start winws1
+rem sc start winws2

binaries/win64/zapret-winws/service_stop.cmd

@@ -0,0 +1,2 @@
+net stop winws1
+rem net stop winws2

binaries/win64/zapret-winws/task_create.cmd

@@ -0,0 +1,4 @@
+set WINWS1=--wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig
+schtasks /Create /F /TN winws1 /NP /RU "" /SC onstart /TR "\"%~dp0winws.exe\" %WINWS1%"
+rem set WINWS2=--wf-l3=ipv4,ipv6 --wf-udp=443 --dpi-desync=fake
+rem schtasks /Create /F /TN winws2 /NP /RU "" /SC onstart /TR "\"%~dp0winws.exe\" %WINWS2%"

binaries/win64/zapret-winws/task_remove.cmd

@@ -0,0 +1,4 @@
+schtasks /End /TN winws1
+schtasks /Delete /TN winws1 /F
+rem schtasks /End /TN winws2
+rem schtasks /Delete /TN winws2 /F

binaries/win64/zapret-winws/task_start.cmd

@@ -0,0 +1,2 @@
+schtasks /Run /TN winws1
+rem schtasks /Run /TN winws2

binaries/win64/zapret-winws/task_stop.cmd

@@ -0,0 +1,2 @@
+schtasks /End /TN winws1
+rem schtasks /End /TN winws2

common/base.sh

@@ -0,0 +1,340 @@
+which()
+{
+	# on some systems 'which' command is considered deprecated and not installed by default
+	# 'command -v' replacement does not work exactly the same way. it outputs shell aliases if present
+	# $1 - executable name
+	local IFS=:
+	for p in $PATH; do
+	    [ -x "$p/$1" ] && {
+		echo "$p/$1"
+		return 0
+	    }
+	done
+	return 1
+}
+exists()
+{
+	which "$1" >/dev/null 2>/dev/null
+}
+existf()
+{
+	type "$1" >/dev/null 2>/dev/null
+}
+whichq()
+{
+	which $1 2>/dev/null
+}
+exist_all()
+{
+	while [ -n "$1" ]; do
+		exists "$1" || return 1
+		shift
+	done
+	return 0
+}
+on_off_function()
+{
+	# $1 : function name on
+	# $2 : function name off
+	# $3 : 0 - off, 1 - on
+	local F="$1"
+	[ "$3" = "1" ] || F="$2"
+	shift
+	shift
+	shift
+	"$F" "$@"
+}
+contains()
+{
+	# check if substring $2 contains in $1
+	[ "${1#*$2}" != "$1" ]
+}
+starts_with()
+{
+	# $1 : what
+	# $2 : starts with
+	case "$1" in
+		"$2"*)
+			return 0
+			;;
+	esac
+	return 1
+}
+find_str_in_list()
+{
+	[ -n "$1" ] && {
+		for v in $2; do
+			[ "$v" = "$1" ] && return 0
+		done
+	}
+	return 1
+}
+end_with_newline()
+{
+	local c="$(tail -c 1)"
+	[ "$c" = "" ]
+}
+
+append_separator_list()
+{
+	# $1 - var name to receive result
+	# $2 - separator
+	# $3 - quoter
+	# $4,$5,... - elements
+	local _var="$1" sep="$2" quo="$3" i
+
+	eval i="\$$_var"
+	shift; shift; shift
+	while [ -n "$1" ]; do
+		if [ -n "$i" ] ; then
+			i="$i$sep$quo$1$quo"
+		else
+			i="$quo$1$quo"
+		fi
+		shift
+	done
+	eval $_var="\$i"
+}
+make_separator_list()
+{
+	eval $1=''
+	append_separator_list "$@"
+}
+make_comma_list()
+{
+	# $1 - var name to receive result
+	# $2,$3,... - elements
+	local var="$1"
+	shift
+	make_separator_list $var , '' "$@"
+}
+make_quoted_comma_list()
+{
+	# $1 - var name to receive result
+	# $2,$3,... - elements
+	local var="$1"
+	shift
+	make_separator_list $var , '"' "$@"
+}
+unique()
+{
+	local i
+	for i in "$@"; do echo $i; done | sort -u | xargs
+}
+
+is_linked_to_busybox()
+{
+	local IFS F P
+	
+	IFS=:
+	for path in $PATH; do
+		F=$path/$1
+		P="$(readlink $F)"
+		if [ -z "$P" ] && [ -x $F ] && [ ! -L $F ]; then return 1; fi
+		[ "${P%busybox*}" != "$P" ] && return
+	done
+}
+get_dir_inode()
+{
+	local dir="$1"
+	[ -L "$dir" ] && dir=$(readlink "$dir")
+	ls -id "$dir" | awk '{print $1}'
+}
+
+linux_min_version()
+{
+	# $1 - major ver
+	# $2 - minor ver
+	local V1=$(sed -nre 's/^Linux version ([0-9]+)\.[0-9]+.*$/\1/p' /proc/version)
+	local V2=$(sed -nre 's/^Linux version [0-9]+\.([0-9]+).*$/\1/p' /proc/version)
+	[ -n "$V1" -a -n "$V2" ] && [ "$V1" -gt "$1" -o "$V1" -eq "$1" -a "$V2" -ge "$2" ]
+}
+linux_get_subsys()
+{
+	local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)"
+
+	[ -L "$INIT" ] && INIT=$(readlink "$INIT")
+	INIT="$(basename "$INIT")"
+	if [ -f "/etc/openwrt_release" ] && [ "$INIT" = "procd" ] ; then
+		SUBSYS=openwrt
+	elif [ -x "/bin/ndm" ] ; then
+		SUBSYS=keenetic
+	else
+		# generic linux
+		SUBSYS=
+	fi
+}
+openwrt_fw3()
+{
+	[ ! -x /sbin/fw4 -a -x /sbin/fw3 ]
+}
+openwrt_fw4()
+{
+	[ -x /sbin/fw4 ]
+}
+openwrt_fw3_integration()
+{
+	[ "$FWTYPE" = iptables ] && openwrt_fw3
+}
+
+create_dev_stdin()
+{
+	[ -e /dev/stdin ] || ln -s /proc/self/fd/0 /dev/stdin
+}
+
+call_for_multiple_items()
+{
+	# $1 - function to get an item
+	# $2 - variable name to put result into
+	# $3 - space separated parameters to function $1
+
+	local i item items
+	for i in $3; do
+		$1 item $i
+		[ -n "$item" ] && {
+			if [ -n "$items" ]; then
+				items="$items $item"
+			else
+				items="$item"
+			fi
+		}
+	done
+	eval $2=\"$items\"
+}
+
+fix_sbin_path()
+{
+	local IFS=':'
+	printf "%s\n" $PATH | grep -Fxq '/usr/sbin' || PATH="/usr/sbin:$PATH"
+	printf "%s\n" $PATH | grep -Fxq '/sbin' || PATH="/sbin:$PATH"
+	export PATH
+}
+
+# it can calculate floating point expr
+calc()
+{
+	awk "BEGIN { print $*}";
+}
+
+fsleep_setup()
+{
+    [ -n "$FSLEEP" ] || {
+	if sleep 0.001 2>/dev/null; then
+		FSLEEP=1
+	elif busybox usleep 1 2>/dev/null; then
+		FSLEEP=2
+	else
+		local errtext="$(read -t 0.001 2>&1)"
+		if [ -z "$errtext" ]; then
+			FSLEEP=3
+		# newer openwrt has ucode with system function that supports timeout in ms
+		elif ucode -e "system(['sleep','1'], 1)" 2>/dev/null; then
+			FSLEEP=4
+		# older openwrt may have lua and nixio lua module
+		elif lua -e 'require "nixio".nanosleep(0,1)' 2>/dev/null ; then
+			FSLEEP=5
+		else
+			FSLEEP=0
+		fi
+	fi
+    }
+}
+msleep()
+{
+    # $1 - milliseconds
+    case "$FSLEEP" in
+	1)
+		sleep $(calc $1/1000)
+		;;
+	2)
+		busybox usleep $(calc $1*1000)
+		;;
+	3)
+		read -t $(calc $1/1000)
+		;;
+	4)
+		ucode -e "system(['sleep','2147483647'], $1)"
+		;;
+	5)
+		lua -e "require 'nixio'.nanosleep($(($1/1000)),$(calc $1%1000*1000000))"
+		;;
+    	*)
+		sleep $((($1+999)/1000))
+    esac
+}
+minsleep()
+{
+	msleep 100
+}
+
+replace_char()
+{
+	local a=$1
+	local b=$2
+	shift; shift
+	echo "$@" | tr $a $b
+}
+
+setup_md5()
+{
+	[ -n "$MD5" ] && return
+	MD5=md5sum
+	exists $MD5 || MD5=md5
+}
+
+random()
+{
+	# $1 - min, $2 - max
+	local r rs
+	setup_md5
+	if [ -c /dev/urandom ]; then
+		read rs </dev/urandom
+	else
+		rs="$RANDOM$RANDOM$(date)"
+	fi
+	# shells use signed int64
+	r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | cut -c 1-17)
+	echo $(( ($r % ($2-$1+1)) + $1 ))
+}
+
+shell_name()
+{
+	[ -n "$SHELL_NAME" ] || {
+		[ -n "$UNAME" ] || UNAME="$(uname)"
+
+		if [ "$UNAME" = "Linux" ]; then
+			SHELL_NAME="$(readlink /proc/$$/exe)"
+			SHELL_NAME="$(basename "$SHELL_NAME")"
+		else
+			SHELL_NAME=$(ps -p $$ -o comm=)
+		fi
+
+		[ -n "$SHELL_NAME" ] || SHELL_NAME="$(basename "$SHELL")"
+	}
+}
+
+process_exists()
+{
+	if exists pgrep; then
+		pgrep ^$1$ >/dev/null
+	elif exists pidof; then
+		pidof $1 >/dev/null
+	else
+		return 1
+	fi 
+}
+
+win_process_exists()
+{
+	tasklist /NH /FI "IMAGENAME eq ${1}.exe" | grep -q "^${1}.exe"
+}
+
+std_ports()
+{
+        HTTP_PORTS=${HTTP_PORTS:-80}
+	HTTPS_PORTS=${HTTPS_PORTS:-443}
+	QUIC_PORTS=${QUIC_PORTS:-443}
+        HTTP_PORTS_IPT=$(replace_char - : $HTTP_PORTS)
+        HTTPS_PORTS_IPT=$(replace_char - : $HTTPS_PORTS)
+        QUIC_PORTS_IPT=$(replace_char - : $QUIC_PORTS)
+}

common/custom.sh

@@ -0,0 +1,25 @@
+custom_runner()
+{
+	# $1 - function name
+	# $2+ - params
+
+	local n script FUNC=$1
+
+	shift
+
+	[ -f "$CUSTOM_DIR/custom" ] && {
+		unset -f $FUNC
+		. "$CUSTOM_DIR/custom"
+		existf $FUNC && $FUNC "$@"
+	}
+	[ -d "$CUSTOM_DIR/custom.d" ] && {
+		n=$(ls "$CUSTOM_DIR/custom.d" | wc -c | xargs)
+		[ "$n" = 0 ] || {
+			for script in "$CUSTOM_DIR/custom.d/"*; do
+				unset -f $FUNC
+				. "$script"
+				existf $FUNC && $FUNC "$@"
+			done
+		}
+	}
+}

common/dialog.sh

@@ -0,0 +1,58 @@
+read_yes_no()
+{
+	# $1 - default (Y/N)
+	local A
+	read A
+	[ -z "$A" ] || ([ "$A" != "Y" ] && [ "$A" != "y" ] && [ "$A" != "N" ] && [ "$A" != "n" ]) && A=$1
+	[ "$A" = "Y" ] || [ "$A" = "y" ] || [ "$A" = "1" ]
+}
+ask_yes_no()
+{
+	# $1 - default (Y/N or 0/1)
+	# $2 - text
+	local DEFAULT=$1
+	[ "$1" = "1" ] && DEFAULT=Y
+	[ "$1" = "0" ] && DEFAULT=N
+	[ -z "$DEFAULT" ] && DEFAULT=N
+	printf "$2 (default : $DEFAULT) (Y/N) ? "
+	read_yes_no $DEFAULT
+}
+ask_yes_no_var()
+{
+	# $1 - variable name for answer : 0/1
+	# $2 - text
+	local DEFAULT
+	eval DEFAULT="\$$1"
+	if ask_yes_no "$DEFAULT" "$2"; then
+		eval $1=1
+	else
+		eval $1=0
+	fi
+}
+ask_list()
+{
+	# $1 - mode var
+	# $2 - space separated value list
+	# $3 - (optional) default value
+	local M_DEFAULT
+	eval M_DEFAULT="\$$1"
+	local M_ALL=$M_DEFAULT
+	local M=""
+	local m
+	
+	[ -n "$3" ] && { find_str_in_list "$M_DEFAULT" "$2" || M_DEFAULT="$3" ;}
+	
+	n=1
+	for m in $2; do
+		echo $n : $m
+		n=$(($n+1))
+	done
+	printf "your choice (default : $M_DEFAULT) : "
+	read m
+	[ -n "$m" ] && M=$(echo $2 | cut -d ' ' -f$m 2>/dev/null)
+	[ -z "$M" ] && M="$M_DEFAULT"
+	echo selected : $M
+	eval $1="\"$M\""
+	
+	[ "$M" != "$M_OLD" ]
+}

common/elevate.sh

@@ -0,0 +1,13 @@
+require_root()
+{
+	local exe
+	echo \* checking privileges
+	[ $(id -u) -ne "0" ] && {
+		echo root is required
+		exe="$EXEDIR/$(basename "$0")"
+		exists sudo && exec sudo sh "$exe"
+		exists su && exec su root -c "sh \"$exe\""
+		echo su or sudo not found
+		exitp 2
+	}
+}

common/fwtype.sh

@@ -0,0 +1,64 @@
+linux_ipt_avail()
+{
+	exists iptables && exists ip6tables
+}
+linux_maybe_iptables_fwtype()
+{
+	linux_ipt_avail && FWTYPE=iptables
+}
+linux_nft_avail()
+{
+	exists nft
+}
+linux_fwtype()
+{
+	[ -n "$FWTYPE" ] && return
+
+	FWTYPE=unsupported
+
+	linux_get_subsys
+	if [ "$SUBSYS" = openwrt ] ; then
+		# linux kernel is new enough if fw4 is there
+		if [ -x /sbin/fw4 ] && linux_nft_avail ; then
+			FWTYPE=nftables
+		else
+			linux_maybe_iptables_fwtype
+		fi
+	else
+		SUBSYS=
+		# generic linux
+		# flowtable is implemented since kernel 4.16
+		if linux_nft_avail && linux_min_version 4 16; then
+			FWTYPE=nftables
+		else
+			linux_maybe_iptables_fwtype
+		fi
+	fi
+
+	export FWTYPE
+}
+
+get_fwtype()
+{
+	[ -n "$FWTYPE" ] && return
+
+	local UNAME="$(uname)"
+
+	case "$UNAME" in
+		Linux)
+			linux_fwtype
+			;;
+		FreeBSD)
+			if exists ipfw ; then
+				FWTYPE=ipfw
+			else
+				FWTYPE=unsupported
+			fi
+			;;
+		*)
+			FWTYPE=unsupported
+			;;
+	esac
+
+	export FWTYPE
+}

common/installer.sh

@@ -0,0 +1,689 @@
+GET_LIST_PREFIX=/ipset/get_
+
+SYSTEMD_DIR=/lib/systemd
+[ -d "$SYSTEMD_DIR" ] || SYSTEMD_DIR=/usr/lib/systemd
+[ -d "$SYSTEMD_DIR" ] && SYSTEMD_SYSTEM_DIR="$SYSTEMD_DIR/system"
+
+INIT_SCRIPT=/etc/init.d/zapret
+
+
+exitp()
+{
+	echo
+	echo press enter to continue
+	read A
+	exit $1
+}
+
+parse_var_checked()
+{
+	# $1 - file name
+	# $2 - var name
+	local sed="sed -nre s/^[[:space:]]*$2=[\\\"|\']?([^\\\"|\']*)[\\\"|\']?/\1/p"
+	local v="$($sed <"$1" | tail -n 1)"
+	eval $2=\"$v\"
+}
+parse_vars_checked()
+{
+	# $1 - file name
+	# $2,$3,... - var names
+	local f="$1"
+	shift
+	while [ -n "$1" ]; do
+		parse_var_checked "$f" $1
+		shift
+	done	
+}
+edit_file()
+{
+	# $1 - file name
+	local ed="$EDITOR"
+	[ -n "$ed" ] || {
+		for e in mcedit nano vim vi; do
+			exists "$e" && {
+				ed="$e"
+				break
+			}
+		done
+	}
+	[ -n "$ed" ] && "$ed" "$1"
+}
+edit_vars()
+{
+	# $1,$2,... - var names
+	local n=1 var v tmp="/tmp/zvars"
+	rm -f "$tmp"
+	while [ 1=1 ]; do
+		eval var="\${$n}"
+		[ -n "$var" ] || break
+		eval v="\$$var"
+		echo $var=\"$v\" >>"$tmp"
+		n=$(($n+1))
+	done
+	edit_file "$tmp" && parse_vars_checked "$tmp" "$@"
+	rm -f "$tmp"
+}
+
+openrc_test()
+{
+	exists rc-update || return 1
+	# some systems do not usse openrc-init but launch openrc from inittab
+	[ "$INIT" = "openrc-init" ] || grep -qE "sysinit.*openrc" /etc/inittab 2>/dev/null
+}
+check_system()
+{
+	# $1 - nonempty = do not fail on unknown rc system
+
+	echo \* checking system
+
+	SYSTEM=
+	SUBSYS=
+	SYSTEMCTL=$(whichq systemctl)
+
+	get_fwtype
+	OPENWRT_FW3=
+
+	local info
+	UNAME=$(uname)
+	if [ "$UNAME" = "Linux" ]; then
+		# do not use 'exe' because it requires root
+		local INIT="$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)"
+		[ -L "$INIT" ] && INIT=$(readlink "$INIT")
+		INIT="$(basename "$INIT")"
+		# some distros include systemctl without systemd
+		if [ -d "$SYSTEMD_DIR" ] && [ -x "$SYSTEMCTL" ] && [ "$INIT" = "systemd" ]; then
+			SYSTEM=systemd
+		elif [ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] ; then
+		{
+			SYSTEM=openwrt
+			if openwrt_fw3 ; then
+				OPENWRT_FW3=1
+				info="openwrt firewall uses fw3"
+				if is_ipt_flow_offload_avail; then
+					info="$info. hardware flow offloading requires iptables."
+				else
+					info="$info. flow offloading unavailable."
+				fi
+			elif openwrt_fw4; then
+				info="openwrt firewall uses fw4. flow offloading requires nftables."
+			fi
+		}
+		elif openrc_test; then
+			SYSTEM=openrc
+		else
+			echo system is not either systemd, openrc or openwrt based
+			echo easy installer can set up config settings but can\'t configure auto start
+			echo you have to do it manually. check readme.txt for manual setup info.
+			if [ -n "$1" ] || ask_yes_no N "do you want to continue"; then
+			    SYSTEM=linux
+			else
+			    exitp 5
+			fi
+		fi
+		linux_get_subsys
+	elif [ "$UNAME" = "Darwin" ]; then
+		SYSTEM=macos
+	else
+		echo easy installer only supports Linux and MacOS. check readme.txt for supported systems and manual setup info.
+		exitp 5
+	fi
+	echo system is based on $SYSTEM
+	[ -n "$info" ] && echo $info
+}
+
+get_free_space_mb()
+{
+    df -m $PWD | awk '/[0-9]%/{print $(NF-2)}'
+}
+get_ram_kb()
+{
+    grep MemTotal /proc/meminfo | awk '{print $2}'
+}
+get_ram_mb()
+{
+    local R=$(get_ram_kb)
+    echo $(($R/1024))
+}
+
+crontab_del()
+{
+	exists crontab || return
+
+	echo \* removing crontab entry
+
+	CRONTMP=/tmp/cron.tmp
+	crontab -l >$CRONTMP 2>/dev/null
+	if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
+		echo removing following entries from crontab :
+		grep "$GET_LIST_PREFIX" $CRONTMP
+		grep -v "$GET_LIST_PREFIX" $CRONTMP >$CRONTMP.2
+		crontab $CRONTMP.2
+		rm -f $CRONTMP.2
+	fi
+	rm -f $CRONTMP
+}
+crontab_del_quiet()
+{
+	exists crontab || return
+
+	CRONTMP=/tmp/cron.tmp
+	crontab -l >$CRONTMP 2>/dev/null
+	if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
+		grep -v "$GET_LIST_PREFIX" $CRONTMP >$CRONTMP.2
+		crontab $CRONTMP.2
+		rm -f $CRONTMP.2
+	fi
+	rm -f $CRONTMP
+}
+crontab_add()
+{
+	# $1 - hour min
+	# $2 - hour max
+	[ -x "$GET_LIST" ] &&	{
+		echo \* adding crontab entry
+
+		if exists crontab; then
+			CRONTMP=/tmp/cron.tmp
+			crontab -l >$CRONTMP 2>/dev/null
+			if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
+				echo some entries already exist in crontab. check if this is corrent :
+				grep "$GET_LIST_PREFIX" $CRONTMP
+			else
+				end_with_newline <"$CRONTMP" || echo >>"$CRONTMP"
+				echo "$(random 0 59) $(random $1 $2) */2 * * $GET_LIST" >>$CRONTMP
+				crontab $CRONTMP
+			fi
+			rm -f $CRONTMP
+		else
+			echo '!!! CRON IS ABSENT !!! LISTS AUTO UPDATE WILL NOT WORK !!!'
+		fi
+	}
+}
+cron_ensure_running()
+{
+	# if no crontabs present in /etc/cron openwrt init script does not launch crond. this is default
+	[ "$SYSTEM" = "openwrt" ] && {
+		/etc/init.d/cron enable
+		/etc/init.d/cron start
+	}
+}
+
+
+service_start_systemd()
+{
+	echo \* starting zapret service
+
+	"$SYSTEMCTL" start zapret || {
+		echo could not start zapret service
+		exitp 30
+	}
+}
+service_stop_systemd()
+{
+	echo \* stopping zapret service
+
+	"$SYSTEMCTL" daemon-reload
+	"$SYSTEMCTL" disable zapret
+	"$SYSTEMCTL" stop zapret
+}
+service_remove_systemd()
+{
+	echo \* removing zapret service
+
+	rm -f "$SYSTEMD_SYSTEM_DIR/zapret.service"
+	"$SYSTEMCTL" daemon-reload
+}
+timer_remove_systemd()
+{
+	echo \* removing zapret-list-update timer
+
+	"$SYSTEMCTL" daemon-reload
+	"$SYSTEMCTL" disable zapret-list-update.timer
+	"$SYSTEMCTL" stop zapret-list-update.timer
+	rm -f "$SYSTEMD_SYSTEM_DIR/zapret-list-update.service" "$SYSTEMD_SYSTEM_DIR/zapret-list-update.timer"
+	"$SYSTEMCTL" daemon-reload
+}
+
+install_sysv_init()
+{
+	# $1 - "0"=disable
+	echo \* installing init script
+
+	[ -x "$INIT_SCRIPT" ] && {
+		"$INIT_SCRIPT" stop
+		"$INIT_SCRIPT" disable
+	}
+	ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
+	[ "$1" != "0" ] && "$INIT_SCRIPT" enable
+}
+install_openrc_init()
+{
+	# $1 - "0"=disable
+	echo \* installing init script
+
+	[ -x "$INIT_SCRIPT" ] && {
+		"$INIT_SCRIPT" stop
+		rc-update del zapret
+	}
+	ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
+	[ "$1" != "0" ] && rc-update add zapret
+}
+service_remove_openrc()
+{
+	echo \* removing zapret service
+
+	[ -x "$INIT_SCRIPT" ] && {
+		rc-update del zapret
+		"$INIT_SCRIPT" stop
+	}
+	rm -f "$INIT_SCRIPT"
+}
+service_start_sysv()
+{
+	[ -x "$INIT_SCRIPT" ] && {
+		echo \* starting zapret service
+		"$INIT_SCRIPT" start || {
+			echo could not start zapret service
+			exitp 30
+		}
+	}
+}
+service_stop_sysv()
+{
+	[ -x "$INIT_SCRIPT" ] && {
+		echo \* stopping zapret service
+		"$INIT_SCRIPT" stop
+	}
+}
+service_remove_sysv()
+{
+	echo \* removing zapret service
+
+	[ -x "$INIT_SCRIPT" ] && {
+		"$INIT_SCRIPT" disable
+		"$INIT_SCRIPT" stop
+	}
+	rm -f "$INIT_SCRIPT"
+}
+
+check_kmod()
+{
+	[ -f "/lib/modules/$(uname -r)/$1.ko" ]
+}
+check_package_exists_openwrt()
+{
+	[ -n "$(opkg list $1)" ]
+}
+check_package_openwrt()
+{
+	[ -n "$(opkg list-installed $1)" ] && return 0
+	local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
+	[ -n "$what" ] || return 1
+	[ -n "$(opkg list-installed $what)" ]
+}
+check_packages_openwrt()
+{
+	for pkg in $@; do
+		check_package_openwrt $pkg || return
+	done
+}
+
+install_openwrt_iface_hook()
+{
+	echo \* installing ifup hook
+	
+	ln -fs "$OPENWRT_IFACE_HOOK" /etc/hotplug.d/iface
+}
+remove_openwrt_iface_hook()
+{
+	echo \* removing ifup hook
+	
+	rm -f /etc/hotplug.d/iface/??-zapret
+}
+openwrt_fw_section_find()
+{
+	# $1 - fw include postfix
+	# echoes section number
+	
+	i=0
+	while true
+	do
+		path=$(uci -q get firewall.@include[$i].path)
+		[ -n "$path" ] || break
+		[ "$path" = "$OPENWRT_FW_INCLUDE$1" ] && {
+	 		echo $i
+	 		return 0
+		}
+		i=$(($i+1))
+	done
+	return 1
+}
+openwrt_fw_section_del()
+{
+	# $1 - fw include postfix
+
+	local id="$(openwrt_fw_section_find $1)"
+	[ -n "$id" ] && {
+		uci delete firewall.@include[$id] && uci commit firewall
+		rm -f "$OPENWRT_FW_INCLUDE$1"
+	}
+}
+openwrt_fw_section_add()
+{
+	openwrt_fw_section_find ||
+	{
+		uci add firewall include >/dev/null || return
+		echo -1
+	}
+}
+openwrt_fw_section_configure()
+{
+	local id="$(openwrt_fw_section_add $1)"
+	[ -z "$id" ] ||
+	 ! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" ||
+	 ! uci set firewall.@include[$id].reload="1" ||
+	 ! uci commit firewall &&
+	{
+		echo could not add firewall include
+		exitp 50
+	}
+}
+install_openwrt_firewall()
+{
+	echo \* installing firewall script $1
+	
+	[ -n "MODE" ] || {
+		echo should specify MODE in $ZAPRET_CONFIG
+		exitp 7
+	}
+	
+	echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
+	ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
+	
+	openwrt_fw_section_configure $1
+}
+restart_openwrt_firewall()
+{
+	echo \* restarting firewall
+
+	local FW=fw4
+	[ -n "$OPENWRT_FW3" ] && FW=fw3
+	$FW -q restart || {
+		echo could not restart firewall $FW
+		exitp 30
+	}
+}
+remove_openwrt_firewall()
+{
+	echo \* removing firewall script
+	
+	openwrt_fw_section_del
+	# from old zapret versions. now we use single include
+	openwrt_fw_section_del 6
+}
+
+clear_ipset()
+{
+	echo "* clearing ipset(s)"
+
+	# free some RAM
+	"$IPSET_DIR/create_ipset.sh" clear
+}
+
+
+service_install_macos()
+{
+	echo \* installing zapret service
+
+	ln -fs "$ZAPRET_BASE/init.d/macos/zapret.plist" /Library/LaunchDaemons
+}
+service_start_macos()
+{
+	echo \* starting zapret service
+
+	"$INIT_SCRIPT_SRC" start
+}
+service_stop_macos()
+{
+	echo \* stopping zapret service
+
+	"$INIT_SCRIPT_SRC" stop
+}
+service_remove_macos()
+{
+	echo \* removing zapret service
+
+	rm -f /Library/LaunchDaemons/zapret.plist
+	zapret_stop_daemons
+}
+
+remove_macos_firewall()
+{
+	echo \* removing zapret PF hooks
+
+	pf_anchors_clear
+	pf_anchors_del
+	pf_anchor_root_del
+	pf_anchor_root_reload
+}
+
+sedi()
+{
+	# MacOS doesnt support -i without parameter. busybox doesnt support -i with parameter.
+	# its not possible to put "sed -i ''" to a variable and then use it
+	if [ "$SYSTEM" = "macos" ]; then
+		sed -i '' "$@"
+	else
+		sed -i "$@"
+	fi
+}
+
+write_config_var()
+{
+	# $1 - mode var
+	local M
+	eval M="\$$1"
+
+	if grep -q "^$1=\|^#$1=" "$ZAPRET_CONFIG"; then
+		# replace / => \/
+		#M=${M//\//\\\/}
+		M=$(echo $M | sed 's/\//\\\//g')
+		if [ -n "$M" ]; then
+			if contains "$M" " "; then
+				sedi -Ee "s/^#?$1=.*$/$1=\"$M\"/" "$ZAPRET_CONFIG"
+			else
+				sedi -Ee "s/^#?$1=.*$/$1=$M/" "$ZAPRET_CONFIG"
+			fi
+		else
+			# write with comment at the beginning
+			sedi -Ee "s/^#?$1=.*$/#$1=/" "$ZAPRET_CONFIG"
+		fi
+	else
+		# var does not exist in config. add it
+		contains "$M" " " && M="\"$M\""
+		if [ -n "$M" ]; then
+			echo "$1=$M" >>"$ZAPRET_CONFIG"
+		else
+			echo "#$1=$M" >>"$ZAPRET_CONFIG"
+		fi
+	fi
+}
+
+check_prerequisites_linux()
+{
+	echo \* checking prerequisites
+
+	local s cmd PKGS UTILS req="curl curl"
+	case "$FWTYPE" in
+		iptables)
+			req="$req iptables iptables ip6tables iptables ipset ipset"
+			;;
+		nftables)
+			req="$req nft nftables"
+			;;
+	esac
+
+	PKGS=$(for s in $req; do echo $s; done |
+		while read cmd; do
+			read pkg
+			exists $cmd || echo $pkg
+		done | sort -u | xargs)
+	UTILS=$(for s in $req; do echo $s; done |
+		while read cmd; do
+			read pkg
+			echo $cmd
+		done | sort -u | xargs)
+
+	if [ -z "$PKGS" ] ; then
+		echo required utilities exist : $UTILS
+	else
+		echo \* installing prerequisites
+
+		echo packages required : $PKGS
+
+		APTGET=$(whichq apt-get)
+		YUM=$(whichq yum)
+		PACMAN=$(whichq pacman)
+		ZYPPER=$(whichq zypper)
+		EOPKG=$(whichq eopkg)
+		APK=$(whichq apk)
+		if [ -x "$APTGET" ] ; then
+			"$APTGET" update
+			"$APTGET" install -y --no-install-recommends $PKGS dnsutils || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		elif [ -x "$YUM" ] ; then
+			"$YUM" -y install $PKGS || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		elif [ -x "$PACMAN" ] ; then
+			"$PACMAN" -Syy
+			"$PACMAN" --noconfirm -S $PKGS || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		elif [ -x "$ZYPPER" ] ; then
+			"$ZYPPER" --non-interactive install $PKGS || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		elif [ -x "$EOPKG" ] ; then
+			"$EOPKG" -y install $PKGS || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		elif [ -x "$APK" ] ; then
+			"$APK" update
+			# for alpine
+			[ "$FWTYPE" = iptables ] && [ -n "$($APK list ip6tables)" ] && PKGS="$PKGS ip6tables"
+			"$APK" add $PKGS || {
+				echo could not install prerequisites
+				exitp 6
+			}
+		else
+			echo supported package manager not found
+			echo you must manually install : $UTILS
+			exitp 5
+		fi
+	fi
+}
+
+check_prerequisites_openwrt()
+{
+	echo \* checking prerequisites
+
+	local PKGS="curl" UPD=0
+
+	case "$FWTYPE" in
+		iptables)
+			PKGS="$PKGS ipset iptables iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
+			[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS ip6tables ip6tables-mod-nat ip6tables-extra"
+			;;
+		nftables)
+			PKGS="$PKGS nftables kmod-nft-nat kmod-nft-offload kmod-nft-queue"
+			;;
+	esac
+
+	if check_packages_openwrt $PKGS ; then
+		echo everything is present
+	else
+		echo \* installing prerequisites
+
+		opkg update
+		UPD=1
+		opkg install $PKGS || {
+			echo could not install prerequisites
+			exitp 6
+		}
+	fi
+	
+	is_linked_to_busybox gzip && {
+		echo
+		echo your system uses default busybox gzip. its several times slower than GNU gzip.
+		echo ip/host list scripts will run much faster with GNU gzip
+		echo installer can install GNU gzip but it requires about 100 Kb space
+		if ask_yes_no N "do you want to install GNU gzip"; then
+			[ "$UPD" = "0" ] && {
+				opkg update
+				UPD=1
+			}
+			opkg install --force-overwrite gzip
+		fi
+	}
+	is_linked_to_busybox sort && {
+		echo
+		echo your system uses default busybox sort. its much slower and consumes much more RAM than GNU sort
+		echo ip/host list scripts will run much faster with GNU sort
+		echo installer can install GNU sort but it requires about 100 Kb space
+		if ask_yes_no N "do you want to install GNU sort"; then
+			[ "$UPD" = "0" ] && {
+				opkg update
+				UPD=1
+			}
+			opkg install --force-overwrite coreutils-sort
+		fi
+	}
+	[ "$FSLEEP" = 0 ] && is_linked_to_busybox sleep && {
+		echo
+		echo no methods of sub-second sleep were found.
+		echo if you want to speed up blockcheck install coreutils-sleep. it requires about 40 Kb space
+		if ask_yes_no N "do you want to install COREUTILS sleep"; then
+			[ "$UPD" = "0" ] && {
+				opkg update
+				UPD=1
+			}
+			opkg install --force-overwrite coreutils-sleep
+			fsleep_setup
+		fi
+	}
+}
+
+
+
+select_ipv6()
+{
+	local T=N
+
+	[ "$DISABLE_IPV6" != '1' ] && T=Y
+	local old6=$DISABLE_IPV6
+	echo
+	if ask_yes_no $T "enable ipv6 support"; then
+		DISABLE_IPV6=0
+	else
+		DISABLE_IPV6=1
+	fi