From 8e7b694076716727334ca0031c9a365accee5d79 Mon Sep 17 00:00:00 2001 From: bol-van Date: Mon, 9 Dec 2024 13:20:05 +0300 Subject: [PATCH] init.d: 20-fw-extra --- common/ipt.sh | 20 +++++-- common/linux_daemons.sh | 55 ++++++++++++++++++ common/nft.sh | 16 ++++-- init.d/custom.d.examples.linux/20-fw-extra | 66 ++++++++++++++++++++++ init.d/openwrt/functions | 1 + init.d/openwrt/zapret | 28 --------- init.d/sysv/functions | 43 +------------- 7 files changed, 149 insertions(+), 80 deletions(-) create mode 100644 common/linux_daemons.sh create mode 100644 init.d/custom.d.examples.linux/20-fw-extra diff --git a/common/ipt.sh b/common/ipt.sh index 5e4a30f..f9fbce7 100644 --- a/common/ipt.sh +++ b/common/ipt.sh @@ -349,27 +349,37 @@ ipt_do_nfqws_in_out() } } -zapret_do_firewall_standard_rules_ipt() +zapret_do_firewall_standard_tpws_rules_ipt() { # $1 - 1 - add, 0 - del local f4 f6 - [ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && - { + [ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && { f4="-p tcp -m multiport --dports $TPWS_PORTS_IPT" f6=$f4 filter_apply_ipset_target f4 f6 fw_tpws $1 "$f4" "$f6" $TPPORT } - [ "$NFQWS_ENABLE" = 1 ] && - { +} +zapret_do_firewall_standard_nfqws_rules_ipt() +{ + # $1 - 1 - add, 0 - del + + [ "$NFQWS_ENABLE" = 1 ] && { ipt_do_nfqws_in_out $1 tcp "$NFQWS_PORTS_TCP_IPT" "$NFQWS_TCP_PKT_OUT" "$NFQWS_TCP_PKT_IN" ipt_do_nfqws_in_out $1 tcp "$NFQWS_PORTS_TCP_KEEPALIVE_IPT" keepalive "$NFQWS_TCP_PKT_IN" ipt_do_nfqws_in_out $1 udp "$NFQWS_PORTS_UDP_IPT" "$NFQWS_UDP_PKT_OUT" "$NFQWS_UDP_PKT_IN" ipt_do_nfqws_in_out $1 udp "$NFQWS_PORTS_UDP_KEEPALIVE_IPT" keepalive "$NFQWS_UDP_PKT_IN" } } +zapret_do_firewall_standard_rules_ipt() +{ + # $1 - 1 - add, 0 - del + + zapret_do_firewall_standard_tpws_rules_ipt $1 + zapret_do_firewall_standard_nfqws_rules_ipt $1 +} zapret_do_firewall_rules_ipt() { diff --git a/common/linux_daemons.sh b/common/linux_daemons.sh new file mode 100644 index 0000000..b543b3e --- /dev/null +++ b/common/linux_daemons.sh @@ -0,0 +1,55 @@ +standard_mode_tpws_socks() +{ + # $1 - 1 - run, 0 - stop + local opt + [ "$TPWS_SOCKS_ENABLE" = 1 ] && { + opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT" + filter_apply_hostlist_target opt + do_tpws_socks $1 2 "$opt" + } +} +standard_mode_tpws() +{ + # $1 - 1 - run, 0 - stop + local opt + [ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && { + opt="--port=$TPPORT $TPWS_OPT" + filter_apply_hostlist_target opt + do_tpws $1 1 "$opt" + } +} +standard_mode_nfqws() +{ + # $1 - 1 - run, 0 - stop + local opt + [ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && { + opt="--qnum=$QNUM $NFQWS_OPT" + filter_apply_hostlist_target opt + do_nfqws $1 3 "$opt" + } +} +standard_mode_daemons() +{ + # $1 - 1 - run, 0 - stop + + standard_mode_tpws_socks $1 + standard_mode_tpws $1 + standard_mode_nfqws $1 +} +zapret_do_daemons() +{ + # $1 - 1 - run, 0 - stop + + standard_mode_daemons $1 + custom_runner zapret_custom_daemons $1 + + return 0 +} +zapret_run_daemons() +{ + zapret_do_daemons 1 "$@" +} +zapret_stop_daemons() +{ + zapret_do_daemons 0 "$@" +} diff --git a/common/nft.sh b/common/nft.sh index bcf9886..0f029ff 100644 --- a/common/nft.sh +++ b/common/nft.sh @@ -640,25 +640,31 @@ nft_apply_nfqws_in_out() } } -zapret_apply_firewall_standard_rules_nft() +zapret_apply_firewall_standard_tpws_rules_nft() { local f4 f6 - [ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && - { + [ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && { f4="tcp dport {$TPWS_PORTS}" f6=$f4 nft_filter_apply_ipset_target f4 f6 nft_fw_tpws "$f4" "$f6" $TPPORT } - [ "$NFQWS_ENABLE" = 1 ] && - { +} +zapret_apply_firewall_standard_nfqws_rules_nft() +{ + [ "$NFQWS_ENABLE" = 1 ] && { nft_apply_nfqws_in_out tcp "$NFQWS_PORTS_TCP" "$NFQWS_TCP_PKT_OUT" "$NFQWS_TCP_PKT_IN" nft_apply_nfqws_in_out tcp "$NFQWS_PORTS_TCP_KEEPALIVE" keepalive "$NFQWS_TCP_PKT_IN" nft_apply_nfqws_in_out udp "$NFQWS_PORTS_UDP" "$NFQWS_UDP_PKT_OUT" "$NFQWS_UDP_PKT_IN" nft_apply_nfqws_in_out udp "$NFQWS_PORTS_UDP_KEEPALIVE" keepalive "$NFQWS_UDP_PKT_IN" } } +zapret_apply_firewall_standard_rules_nft() +{ + zapret_apply_firewall_standard_tpws_rules_nft + zapret_apply_firewall_standard_nfqws_rules_nft +} zapret_apply_firewall_rules_nft() { diff --git a/init.d/custom.d.examples.linux/20-fw-extra b/init.d/custom.d.examples.linux/20-fw-extra new file mode 100644 index 0000000..c93ef63 --- /dev/null +++ b/init.d/custom.d.examples.linux/20-fw-extra @@ -0,0 +1,66 @@ +# this custom script runs standard mode with extra firewall rules + +# config: use TPWS_ENABLE_OVERRIDE, NFQWS_ENABLE_OVERRIDE to enable standard mode daemons +# standard and override switches cannot be enabled simultaneously ! + +TPWS_ENABLE_OVERRIDE=${TPWS_ENABLE_OVERRIDE:-0} +NFQWS_ENABLE_OVERRIDE=${NFQWS_ENABLE_OVERRIDE:-0} + +# config: some if these values must be set in config. not setting any of these makes this script meaningless. +# pre vars put ipt/nft code to the rule beginning +#FW_EXTRA_PRE_TPWS_IPT= +#FW_EXTRA_PRE_TPWS_NFT= +#FW_EXTRA_PRE_NFQWS_IPT="-m mark --mark 0x10000000/0x10000000" +#FW_EXTRA_PRE_NFQWS_NFT="mark and 0x10000000 != 0" +# post vars put ipt/nft code to the rule end +#FW_EXTRA_POST_TPWS_IPT= +#FW_EXTRA_POST_TPWS_NFT= +#FW_EXTRA_POST_NFQWS_IPT= +#FW_EXTRA_POST_NFQWS_NFT= + +check_std_intersect() +{ + [ "$TPWS_ENABLE_OVERRIDE" = 1 -a "$TPWS_ENABLE" = 1 ] && { + echo "ERROR ! both TPWS_ENABLE_OVERRIDE and TPWS_ENABLE are enabled" + return 1 + } + [ "$NFQWS_ENABLE_OVERRIDE" = 1 -a "$NFQWS_ENABLE" = 1 ] && { + echo "ERROR ! both NFQWS_ENABLE_OVERRIDE and NFQWS_ENABLE are enabled" + return 1 + } + return 0 +} + +zapret_custom_daemons() +{ + # $1 - 1 - add, 0 - stop + + check_std_intersect || return + + local TPWS_SOCKS_ENABLE=0 TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE + standard_mode_daemons "$1" +} +zapret_custom_firewall() +{ + # $1 - 1 - run, 0 - stop + + check_std_intersect || return + + local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE + FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_IPT" + zapret_do_firewall_standard_tpws_rules_ipt $1 + FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_IPT" + zapret_do_firewall_standard_nfqws_rules_ipt $1 +} +zapret_custom_firewall_nft() +{ + # stop logic is not required + + check_std_intersect || return + + local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE + FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_NFT" + zapret_apply_firewall_standard_tpws_rules_nft + FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_NFT" + zapret_apply_firewall_standard_nfqws_rules_nft +} diff --git a/init.d/openwrt/functions b/init.d/openwrt/functions index 77fd5f9..2cd1e1f 100644 --- a/init.d/openwrt/functions +++ b/init.d/openwrt/functions @@ -10,6 +10,7 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"} . "$ZAPRET_BASE/common/ipt.sh" . "$ZAPRET_BASE/common/nft.sh" . "$ZAPRET_BASE/common/linux_fw.sh" +. "$ZAPRET_BASE/common/linux_daemons.sh" . "$ZAPRET_BASE/common/list.sh" . "$ZAPRET_BASE/common/custom.sh" CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt" diff --git a/init.d/openwrt/zapret b/init.d/openwrt/zapret index 16b4e4b..8d6d3a9 100755 --- a/init.d/openwrt/zapret +++ b/init.d/openwrt/zapret @@ -123,34 +123,6 @@ do_nfqws() [ "$1" = 0 ] || { shift; run_nfqws "$@"; } } - - - -standard_mode_daemons() -{ - # $1 - 1 - run, 0 - stop - - # stop logic is managed by procd - [ "$1" = 0 ] && return 0 - - local opt - [ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$TPWS_OPT" && { - opt="--port=$TPPORT $TPWS_OPT" - filter_apply_hostlist_target opt - run_tpws 1 "$opt" - } - [ "$TPWS_SOCKS_ENABLE" = 1 ] && { - opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT" - filter_apply_hostlist_target opt - run_tpws_socks 2 "$opt" - } - [ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$NFQWS_OPT" && { - opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT" - filter_apply_hostlist_target opt - run_daemon 3 "$NFQWS" "$opt" - } -} - start_daemons_procd() { standard_mode_daemons 1 diff --git a/init.d/sysv/functions b/init.d/sysv/functions index e847780..abe6098 100644 --- a/init.d/sysv/functions +++ b/init.d/sysv/functions @@ -10,6 +10,7 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"} . "$ZAPRET_BASE/common/ipt.sh" . "$ZAPRET_BASE/common/nft.sh" . "$ZAPRET_BASE/common/linux_fw.sh" +. "$ZAPRET_BASE/common/linux_daemons.sh" . "$ZAPRET_BASE/common/list.sh" . "$ZAPRET_BASE/common/custom.sh" CUSTOM_DIR="$ZAPRET_RW/init.d/sysv" @@ -275,45 +276,3 @@ create_ipset() echo "Creating ip list table (firewall type $FWTYPE)" "$IPSET_CR" "$@" } - - -standard_mode_daemons() -{ - # $1 - 1 - run, 0 - stop - - local opt - - [ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && { - opt="--port=$TPPORT $TPWS_OPT" - filter_apply_hostlist_target opt - do_tpws $1 1 "$opt" - } - [ "$TPWS_SOCKS_ENABLE" = 1 ] && { - opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT" - filter_apply_hostlist_target opt - do_tpws_socks $1 2 "$opt" - } - [ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && { - opt="--qnum=$QNUM $NFQWS_OPT" - filter_apply_hostlist_target opt - do_nfqws $1 3 "$opt" - } -} - -zapret_do_daemons() -{ - # $1 - 1 - run, 0 - stop - - standard_mode_daemons $1 - custom_runner zapret_custom_daemons $1 - - return 0 -} -zapret_run_daemons() -{ - zapret_do_daemons 1 "$@" -} -zapret_stop_daemons() -{ - zapret_do_daemons 0 "$@" -}