mirror of
https://github.com/bol-van/zapret.git
synced 2026-03-09 14:55:25 +00:00
nftables support
This commit is contained in:
bol-van
634
install_easy.sh
634
install_easy.sh
@@ -9,64 +9,23 @@ ZAPRET_CONFIG="$EXEDIR/config"
|
||||
ZAPRET_BASE="$EXEDIR"
|
||||
|
||||
. "$ZAPRET_CONFIG"
|
||||
. "$ZAPRET_BASE/common/base.sh"
|
||||
. "$ZAPRET_BASE/common/elevate.sh"
|
||||
. "$ZAPRET_BASE/common/fwtype.sh"
|
||||
. "$ZAPRET_BASE/common/dialog.sh"
|
||||
. "$ZAPRET_BASE/common/ipt.sh"
|
||||
. "$ZAPRET_BASE/common/installer.sh"
|
||||
|
||||
# install target
|
||||
ZAPRET_TARGET=/opt/zapret
|
||||
|
||||
GET_LIST="$IPSET_DIR/get_config.sh"
|
||||
GET_LIST_PREFIX=/ipset/get_
|
||||
INIT_SCRIPT=/etc/init.d/zapret
|
||||
|
||||
[ -n "$TPPORT" ] || TPPORT=988
|
||||
|
||||
SYSTEMD_DIR=/lib/systemd
|
||||
[ -d "$SYSTEMD_DIR" ] || SYSTEMD_DIR=/usr/lib/systemd
|
||||
[ -d "$SYSTEMD_DIR" ] && SYSTEMD_SYSTEM_DIR="$SYSTEMD_DIR/system"
|
||||
|
||||
ECHON="echo -n"
|
||||
|
||||
exists()
|
||||
{
|
||||
which $1 >/dev/null 2>/dev/null
|
||||
}
|
||||
whichq()
|
||||
{
|
||||
which $1 2>/dev/null
|
||||
}
|
||||
|
||||
MD5=md5sum
|
||||
exists $MD5 || MD5=md5
|
||||
|
||||
contains()
|
||||
{
|
||||
# check if substring $2 contains in $1
|
||||
[ "${1#*$2}" != "$1" ]
|
||||
}
|
||||
|
||||
exitp()
|
||||
{
|
||||
local A
|
||||
|
||||
echo
|
||||
echo press enter to continue
|
||||
read A
|
||||
exit $1
|
||||
}
|
||||
|
||||
require_root()
|
||||
{
|
||||
local exe
|
||||
echo \* checking privileges
|
||||
[ $(id -u) -ne "0" ] && {
|
||||
echo root is required
|
||||
exe="$EXEDIR/$(basename "$0")"
|
||||
exists sudo && exec sudo "$exe"
|
||||
exists su && exec su root -c "$exe"
|
||||
echo su or sudo not found
|
||||
exitp 2
|
||||
}
|
||||
}
|
||||
|
||||
sedi()
|
||||
{
|
||||
# MacOS doesnt support -i without parameter. busybox doesnt support -i with parameter.
|
||||
@@ -78,58 +37,6 @@ sedi()
|
||||
fi
|
||||
}
|
||||
|
||||
read_yes_no()
|
||||
{
|
||||
# $1 - default (Y/N)
|
||||
local A
|
||||
read A
|
||||
[ -z "$A" ] || ([ "$A" != "Y" ] && [ "$A" != "y" ] && [ "$A" != "N" ] && [ "$A" != "n" ]) && A=$1
|
||||
[ "$A" = "Y" ] || [ "$A" = "y" ] || [ "$A" = "1" ]
|
||||
}
|
||||
ask_yes_no()
|
||||
{
|
||||
# $1 - default (Y/N or 0/1)
|
||||
# $2 - text
|
||||
local DEFAULT=$1
|
||||
[ "$1" = "1" ] && DEFAULT=Y
|
||||
[ "$1" = "0" ] && DEFAULT=N
|
||||
[ -z "$DEFAULT" ] && DEFAULT=N
|
||||
$ECHON "$2 (default : $DEFAULT) (Y/N) ? "
|
||||
read_yes_no $DEFAULT
|
||||
}
|
||||
ask_yes_no_var()
|
||||
{
|
||||
# $1 - variable name for answer : 0/1
|
||||
# $2 - text
|
||||
local DEFAULT
|
||||
eval DEFAULT="\$$1"
|
||||
if ask_yes_no "$DEFAULT" "$2"; then
|
||||
eval $1=1
|
||||
else
|
||||
eval $1=0
|
||||
fi
|
||||
}
|
||||
|
||||
on_off_function()
|
||||
{
|
||||
# $1 : function name on
|
||||
# $2 : function name off
|
||||
# $3 : 0 - off, 1 - on
|
||||
local F="$1"
|
||||
[ "$3" = "1" ] || F="$2"
|
||||
shift
|
||||
shift
|
||||
shift
|
||||
"$F" "$@"
|
||||
}
|
||||
|
||||
get_dir_inode()
|
||||
{
|
||||
local dir="$1"
|
||||
[ -L "$dir" ] && dir=$(readlink "$dir")
|
||||
ls -id "$dir" | awk '{print $1}'
|
||||
}
|
||||
|
||||
random()
|
||||
{
|
||||
# $1 - min, $2 - max
|
||||
@@ -144,96 +51,6 @@ random()
|
||||
echo $(( ($r % ($2-$1+1)) + $1 ))
|
||||
}
|
||||
|
||||
parse_var_checked()
|
||||
{
|
||||
# $1 - file name
|
||||
# $2 - var name
|
||||
local sed="sed -nre s/^[[:space:]]*$2=[\\\"|\']?([^\\\"|\']*)[\\\"|\']?/\1/p"
|
||||
local v="$($sed <"$1" | tail -n 1)"
|
||||
eval $2=\"$v\"
|
||||
}
|
||||
parse_vars_checked()
|
||||
{
|
||||
# $1 - file name
|
||||
# $2,$3,... - var names
|
||||
local f="$1"
|
||||
shift
|
||||
while [ -n "$1" ]; do
|
||||
parse_var_checked "$f" $1
|
||||
shift
|
||||
done
|
||||
}
|
||||
edit_file()
|
||||
{
|
||||
# $1 - file name
|
||||
local ed="$EDITOR"
|
||||
[ -n "$ed" ] || {
|
||||
for e in mcedit nano vi; do
|
||||
exists "$e" && {
|
||||
ed="$e"
|
||||
break
|
||||
}
|
||||
done
|
||||
}
|
||||
[ -n "$ed" ] && "$ed" "$1"
|
||||
}
|
||||
edit_vars()
|
||||
{
|
||||
# $1,$2,... - var names
|
||||
local n=1 var v tmp="/tmp/zvars"
|
||||
rm -f "$tmp"
|
||||
while [ 1=1 ]; do
|
||||
eval var="\$$n"
|
||||
[ -n "$var" ] || break
|
||||
eval v="\$$var"
|
||||
echo $var=\"$v\" >>"$tmp"
|
||||
n=$(($n+1))
|
||||
done
|
||||
edit_file "$tmp" && parse_vars_checked "$tmp" "$@"
|
||||
rm -f "$tmp"
|
||||
}
|
||||
|
||||
check_system()
|
||||
{
|
||||
echo \* checking system
|
||||
|
||||
SYSTEM=""
|
||||
SYSTEMCTL=$(whichq systemctl)
|
||||
|
||||
local UNAME=$(uname)
|
||||
if [ "$UNAME" = "Linux" ]; then
|
||||
# do not use 'exe' because it requires root
|
||||
local INIT=$(sed 's/\x0/\n/g' /proc/1/cmdline | head -n 1)
|
||||
[ -L "$INIT" ] && INIT=$(readlink "$INIT")
|
||||
INIT=$(basename "$INIT")
|
||||
# some distros include systemctl without systemd
|
||||
if [ -d "$SYSTEMD_DIR" ] && [ -x "$SYSTEMCTL" ] && [ "$INIT" = "systemd" ]; then
|
||||
SYSTEM=systemd
|
||||
elif exists rc-update && [ "$INIT" = "openrc-init" ]; then
|
||||
SYSTEM=openrc
|
||||
elif [ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] ; then
|
||||
SYSTEM=openwrt
|
||||
else
|
||||
echo system is not either systemd, openrc or openwrt based
|
||||
echo easy installer can set up config settings but can\'t configure auto start
|
||||
echo you have to do it manually. check readme.txt for manual setup info.
|
||||
if ask_yes_no N "do you want to continue"; then
|
||||
SYSTEM=linux
|
||||
else
|
||||
exitp 5
|
||||
fi
|
||||
fi
|
||||
elif [ "$UNAME" = "Darwin" ]; then
|
||||
SYSTEM=macos
|
||||
# MacOS echo from /bin/sh does not support -n
|
||||
ECHON=printf
|
||||
else
|
||||
echo easy installer only supports Linux and MacOS. check readme.txt for supported systems and manual setup info.
|
||||
exitp 5
|
||||
fi
|
||||
echo system is based on $SYSTEM
|
||||
}
|
||||
|
||||
check_readonly_system()
|
||||
{
|
||||
local RO
|
||||
@@ -304,43 +121,6 @@ install_binaries()
|
||||
}
|
||||
}
|
||||
|
||||
find_str_in_list()
|
||||
{
|
||||
[ -n "$1" ] && {
|
||||
for v in $2; do
|
||||
[ "$v" = "$1" ] && return 0
|
||||
done
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
ask_list()
|
||||
{
|
||||
# $1 - mode var
|
||||
# $2 - space separated value list
|
||||
# $3 - (optional) default value
|
||||
local M_DEFAULT
|
||||
eval M_DEFAULT="\$$1"
|
||||
local M_ALL=$M_DEFAULT
|
||||
local M=""
|
||||
local m
|
||||
|
||||
[ -n "$3" ] && { find_str_in_list "$M_DEFAULT" "$2" || M_DEFAULT="$3" ;}
|
||||
|
||||
n=1
|
||||
for m in $2; do
|
||||
echo $n : $m
|
||||
n=$(($n+1))
|
||||
done
|
||||
$ECHON "your choice (default : $M_DEFAULT) : "
|
||||
read m
|
||||
[ -n "$m" ] && M=$(echo $2 | cut -d ' ' -f$m 2>/dev/null)
|
||||
[ -z "$M" ] && M="$M_DEFAULT"
|
||||
echo selected : $M
|
||||
eval $1="\"$M\""
|
||||
|
||||
[ "$M" != "$M_OLD" ]
|
||||
}
|
||||
write_config_var()
|
||||
{
|
||||
# $1 - mode var
|
||||
@@ -488,6 +268,17 @@ select_ipv6()
|
||||
fi
|
||||
[ "$old6" != "$DISABLE_IPV6" ] && write_config_var DISABLE_IPV6
|
||||
}
|
||||
select_fwtype()
|
||||
{
|
||||
echo
|
||||
[ $(get_ram_mb) -le 400 ] && {
|
||||
echo WARNING ! you are running a low RAM system
|
||||
echo WARNING ! nft requires lots of RAM to load huge ip sets, much more than ipsets require
|
||||
echo WARNING ! if you need large lists it may be necessary to fall back to iptables+ipset firewall
|
||||
}
|
||||
echo select firewall type :
|
||||
ask_list FWTYPE "iptables nftables" "$FWTYPE" && write_config_var FWTYPE
|
||||
}
|
||||
|
||||
ask_config()
|
||||
{
|
||||
@@ -497,7 +288,7 @@ ask_config()
|
||||
|
||||
ask_config_offload()
|
||||
{
|
||||
is_flow_offload_avail && {
|
||||
[ "$FWTYPE" = nftables ] || is_ipt_flow_offload_avail && {
|
||||
echo
|
||||
echo flow offloading can greatly increase speed on slow devices and high speed links \(usually 150+ mbits\)
|
||||
echo unfortuantely its not compatible with most nfqws options. nfqws traffic must be exempted from flow offloading.
|
||||
@@ -510,20 +301,6 @@ ask_config_offload()
|
||||
}
|
||||
}
|
||||
|
||||
get_free_space_mb()
|
||||
{
|
||||
df -m $PWD | awk '/[0-9]%/{print $(NF-2)}'
|
||||
}
|
||||
get_ram_kb()
|
||||
{
|
||||
grep MemTotal /proc/meminfo | awk '{print $2}'
|
||||
}
|
||||
get_ram_mb()
|
||||
{
|
||||
local R=$(get_ram_kb)
|
||||
echo $(($R/1024))
|
||||
}
|
||||
|
||||
ask_config_tmpdir()
|
||||
{
|
||||
# ask tmpdir change for low ram systems with enough free disk space
|
||||
@@ -643,7 +420,7 @@ copy_openwrt()
|
||||
[ -d "$2" ] || mkdir -p "$2"
|
||||
|
||||
mkdir "$2/tpws" "$2/nfq" "$2/ip2net" "$2/mdig" "$2/binaries" "$2/binaries/$ARCH" "$2/init.d" "$2/tmp"
|
||||
cp -R "$1/ipset" "$2"
|
||||
cp -R "$1/common" "$1/ipset" "$2"
|
||||
cp -R "$1/init.d/openwrt" "$2/init.d"
|
||||
cp "$1/config" "$1/install_easy.sh" "$1/uninstall_easy.sh" "$1/install_bin.sh" "$1/blockcheck.sh" "$2"
|
||||
cp "$BINDIR/tpws" "$BINDIR/nfqws" "$BINDIR/ip2net" "$BINDIR/mdig" "$2/binaries/$ARCH"
|
||||
@@ -718,19 +495,34 @@ check_prerequisites_linux()
|
||||
{
|
||||
echo \* checking prerequisites
|
||||
|
||||
if exists iptables && exists ip6tables ; then
|
||||
echo iptables present
|
||||
else
|
||||
# looks like it's a limited system. will not guess how to install base tools
|
||||
echo '! iptables/ip6tables NOT present. you must install them manually.'
|
||||
exitp 5
|
||||
fi
|
||||
local s cmd PKGS UTILS req="curl curl"
|
||||
case "$FWTYPE" in
|
||||
iptables)
|
||||
req="$req iptables iptables ip6tables iptables ipset ipset"
|
||||
;;
|
||||
nftables)
|
||||
req="$req nft nftables"
|
||||
;;
|
||||
esac
|
||||
|
||||
if exists ipset && exists curl ; then
|
||||
echo ipset and curl are present
|
||||
PKGS=$(for s in $req; do echo $s; done |
|
||||
while read cmd; do
|
||||
read pkg
|
||||
exists $cmd || echo $pkg
|
||||
done | sort -u | xargs)
|
||||
UTILS=$(for s in $req; do echo $s; done |
|
||||
while read cmd; do
|
||||
read pkg
|
||||
echo $cmd
|
||||
done | sort -u | xargs)
|
||||
|
||||
if [ -z "$PKGS" ] ; then
|
||||
echo required utilities exist : $UTILS
|
||||
else
|
||||
echo \* installing prerequisites
|
||||
|
||||
echo packages required : $PKGS
|
||||
|
||||
APTGET=$(whichq apt-get)
|
||||
YUM=$(whichq yum)
|
||||
PACMAN=$(whichq pacman)
|
||||
@@ -739,39 +531,42 @@ check_prerequisites_linux()
|
||||
APK=$(whichq apk)
|
||||
if [ -x "$APTGET" ] ; then
|
||||
"$APTGET" update
|
||||
"$APTGET" install -y --no-install-recommends ipset curl dnsutils || {
|
||||
"$APTGET" install -y --no-install-recommends $PKGS dnsutils || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
elif [ -x "$YUM" ] ; then
|
||||
"$YUM" -y install curl ipset || {
|
||||
"$YUM" -y install $PKGS || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
elif [ -x "$PACMAN" ] ; then
|
||||
"$PACMAN" -Syy
|
||||
"$PACMAN" --noconfirm -S ipset curl || {
|
||||
"$PACMAN" --noconfirm -S $PKGS || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
elif [ -x "$ZYPPER" ] ; then
|
||||
"$ZYPPER" --non-interactive install ipset curl || {
|
||||
"$ZYPPER" --non-interactive install $PKGS || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
elif [ -x "$EOPKG" ] ; then
|
||||
"$EOPKG" -y install ipset curl || {
|
||||
"$EOPKG" -y install $PKGS || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
elif [ -x "$APK" ] ; then
|
||||
"$APK" add ipset curl || {
|
||||
"$APK" update
|
||||
# for alpine
|
||||
[ "$FWTYPE" = iptables ] && [ -n "$($APK list ip6tables)" ] && PKGS="$PKGS ip6tables"
|
||||
"$APK" add $PKGS || {
|
||||
echo could not install prerequisites
|
||||
exitp 6
|
||||
}
|
||||
else
|
||||
echo supported package manager not found
|
||||
echo you must manually install : ipset curl
|
||||
echo you must manually install : $UTILS
|
||||
exitp 5
|
||||
fi
|
||||
fi
|
||||
@@ -795,25 +590,6 @@ service_install_systemd()
|
||||
fi
|
||||
}
|
||||
|
||||
service_stop_systemd()
|
||||
{
|
||||
echo \* stopping zapret service
|
||||
|
||||
"$SYSTEMCTL" daemon-reload
|
||||
"$SYSTEMCTL" disable zapret
|
||||
"$SYSTEMCTL" stop zapret
|
||||
}
|
||||
|
||||
service_start_systemd()
|
||||
{
|
||||
echo \* starting zapret service
|
||||
|
||||
"$SYSTEMCTL" start zapret || {
|
||||
echo could not start zapret service
|
||||
exitp 30
|
||||
}
|
||||
}
|
||||
|
||||
timer_install_systemd()
|
||||
{
|
||||
echo \* installing zapret-list-update timer
|
||||
@@ -851,59 +627,6 @@ download_list()
|
||||
}
|
||||
}
|
||||
|
||||
end_with_newline()
|
||||
{
|
||||
local c=$(tail -c 1)
|
||||
[ "$c" = "" ]
|
||||
}
|
||||
|
||||
crontab_del_quiet()
|
||||
{
|
||||
exists crontab || return
|
||||
|
||||
CRONTMP=/tmp/cron.tmp
|
||||
crontab -l >$CRONTMP 2>/dev/null
|
||||
if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
|
||||
grep -v "$GET_LIST_PREFIX" $CRONTMP >$CRONTMP.2
|
||||
crontab $CRONTMP.2
|
||||
rm -f $CRONTMP.2
|
||||
fi
|
||||
rm -f $CRONTMP
|
||||
}
|
||||
|
||||
crontab_add()
|
||||
{
|
||||
# $1 - hour min
|
||||
# $2 - hour max
|
||||
[ -x "$GET_LIST" ] && {
|
||||
echo \* adding crontab entry
|
||||
|
||||
if exists crontab; then
|
||||
CRONTMP=/tmp/cron.tmp
|
||||
crontab -l >$CRONTMP 2>/dev/null
|
||||
if grep -q "$GET_LIST_PREFIX" $CRONTMP; then
|
||||
echo some entries already exist in crontab. check if this is corrent :
|
||||
grep "$GET_LIST_PREFIX" $CRONTMP
|
||||
else
|
||||
end_with_newline <"$CRONTMP" || echo >>"$CRONTMP"
|
||||
echo "$(random 0 59) $(random $1 $2) */2 * * $GET_LIST" >>$CRONTMP
|
||||
crontab $CRONTMP
|
||||
fi
|
||||
rm -f $CRONTMP
|
||||
else
|
||||
echo '!!! CRON IS ABSENT !!! LISTS AUTO UPDATE WILL NOT WORK !!!'
|
||||
fi
|
||||
}
|
||||
}
|
||||
cron_ensure_running()
|
||||
{
|
||||
# if no crontabs present in /etc/cron openwrt init script does not launch crond. this is default
|
||||
[ "$SYSTEM" = "openwrt" ] && {
|
||||
/etc/init.d/cron enable
|
||||
/etc/init.d/cron start
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dnstest()
|
||||
{
|
||||
@@ -930,10 +653,11 @@ install_systemd()
|
||||
require_root
|
||||
check_readonly_system
|
||||
check_location copy_all
|
||||
check_prerequisites_linux
|
||||
service_stop_systemd
|
||||
install_binaries
|
||||
check_dns
|
||||
service_stop_systemd
|
||||
select_fwtype
|
||||
check_prerequisites_linux
|
||||
install_binaries
|
||||
select_ipv6
|
||||
ask_config
|
||||
service_install_systemd
|
||||
@@ -945,66 +669,19 @@ install_systemd()
|
||||
service_start_systemd
|
||||
}
|
||||
|
||||
|
||||
|
||||
install_sysv_init()
|
||||
{
|
||||
# $1 - "0"=disable
|
||||
echo \* installing init script
|
||||
|
||||
[ -x "$INIT_SCRIPT" ] && {
|
||||
"$INIT_SCRIPT" stop
|
||||
"$INIT_SCRIPT" disable
|
||||
}
|
||||
ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
|
||||
[ "$1" != "0" ] && "$INIT_SCRIPT" enable
|
||||
}
|
||||
|
||||
install_openrc_init()
|
||||
{
|
||||
# $1 - "0"=disable
|
||||
echo \* installing init script
|
||||
|
||||
[ -x "$INIT_SCRIPT" ] && {
|
||||
"$INIT_SCRIPT" stop
|
||||
rc-update del zapret
|
||||
}
|
||||
ln -fs "$INIT_SCRIPT_SRC" "$INIT_SCRIPT"
|
||||
[ "$1" != "0" ] && rc-update add zapret
|
||||
}
|
||||
|
||||
service_start_sysv()
|
||||
{
|
||||
[ -x "$INIT_SCRIPT" ] && {
|
||||
echo \* starting zapret service
|
||||
"$INIT_SCRIPT" start || {
|
||||
echo could not start zapret service
|
||||
exitp 30
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
service_stop_sysv()
|
||||
{
|
||||
[ -x "$INIT_SCRIPT" ] && {
|
||||
echo \* stopping zapret service
|
||||
"$INIT_SCRIPT" stop
|
||||
}
|
||||
}
|
||||
|
||||
_install_sysv()
|
||||
{
|
||||
# $1 - install init script
|
||||
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
|
||||
|
||||
check_bins
|
||||
require_root
|
||||
check_readonly_system
|
||||
check_location copy_all
|
||||
check_prerequisites_linux
|
||||
service_stop_sysv
|
||||
install_binaries
|
||||
check_dns
|
||||
service_stop_sysv
|
||||
select_fwtype
|
||||
check_prerequisites_linux
|
||||
install_binaries
|
||||
select_ipv6
|
||||
ask_config
|
||||
$1
|
||||
@@ -1017,11 +694,13 @@ _install_sysv()
|
||||
|
||||
install_sysv()
|
||||
{
|
||||
INIT_SCRIPT_SRC="$EXEDIR/init.d/sysv/zapret"
|
||||
_install_sysv install_sysv_init
|
||||
}
|
||||
|
||||
install_openrc()
|
||||
{
|
||||
INIT_SCRIPT_SRC="$EXEDIR/init.d/openrc/zapret"
|
||||
_install_sysv install_openrc_init
|
||||
}
|
||||
|
||||
@@ -1033,9 +712,10 @@ install_linux()
|
||||
check_bins
|
||||
require_root
|
||||
check_location copy_all
|
||||
check_dns
|
||||
select_fwtype
|
||||
check_prerequisites_linux
|
||||
install_binaries
|
||||
check_dns
|
||||
select_ipv6
|
||||
ask_config
|
||||
download_list
|
||||
@@ -1051,45 +731,22 @@ install_linux()
|
||||
}
|
||||
|
||||
|
||||
check_kmod()
|
||||
{
|
||||
[ -f "/lib/modules/$(uname -r)/$1.ko" ]
|
||||
}
|
||||
check_package_exists_openwrt()
|
||||
{
|
||||
[ -n "$(opkg list $1)" ]
|
||||
}
|
||||
check_package_openwrt()
|
||||
{
|
||||
[ -n "$(opkg list-installed $1)" ]
|
||||
}
|
||||
check_packages_openwrt()
|
||||
{
|
||||
for pkg in $@; do
|
||||
check_package_openwrt $pkg || return
|
||||
done
|
||||
}
|
||||
|
||||
is_linked_to_busybox()
|
||||
{
|
||||
local IFS F P
|
||||
|
||||
IFS=:
|
||||
for path in $PATH; do
|
||||
F=$path/$1
|
||||
P="$(readlink $F)"
|
||||
if [ -z "$P" ] && [ -x $F ] && [ ! -L $F ]; then return 1; fi
|
||||
[ "${P%busybox*}" != "$P" ] && return
|
||||
done
|
||||
}
|
||||
|
||||
check_prerequisites_openwrt()
|
||||
{
|
||||
echo \* checking prerequisites
|
||||
|
||||
local PKGS="iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra ipset curl"
|
||||
[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS ip6tables-mod-nat ip6tables-extra"
|
||||
local UPD=0
|
||||
local PKGS="curl" PKGS UPD=0
|
||||
|
||||
case "$FWTYPE" in
|
||||
iptables)
|
||||
PKGS="ipset iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
|
||||
[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS ip6tables-mod-nat ip6tables-extra"
|
||||
;;
|
||||
nftables)
|
||||
PKGS="nftables kmod-nft-nat kmod-nft-offload kmod-nft-queue"
|
||||
[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS kmod-nft-nat6"
|
||||
;;
|
||||
esac
|
||||
|
||||
if check_packages_openwrt $PKGS ; then
|
||||
echo everything is present
|
||||
@@ -1149,111 +806,11 @@ check_prerequisites_openwrt()
|
||||
}
|
||||
}
|
||||
|
||||
openwrt_fw_section_find()
|
||||
{
|
||||
# $1 - fw include postfix
|
||||
# echoes section number
|
||||
|
||||
i=0
|
||||
while true
|
||||
do
|
||||
path=$(uci -q get firewall.@include[$i].path)
|
||||
[ -n "$path" ] || break
|
||||
[ "$path" = "$OPENWRT_FW_INCLUDE$1" ] && {
|
||||
echo $i
|
||||
return 0
|
||||
}
|
||||
i=$(($i+1))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
openwrt_fw_section_del()
|
||||
{
|
||||
# $1 - fw include postfix
|
||||
|
||||
local id=$(openwrt_fw_section_find $1)
|
||||
[ -n "$id" ] && {
|
||||
uci delete firewall.@include[$id] && uci commit firewall
|
||||
rm -f "$OPENWRT_FW_INCLUDE$1"
|
||||
}
|
||||
}
|
||||
openwrt_fw_section_add()
|
||||
{
|
||||
openwrt_fw_section_find ||
|
||||
{
|
||||
uci add firewall include >/dev/null || return
|
||||
echo -1
|
||||
}
|
||||
}
|
||||
openwrt_fw_section_configure()
|
||||
{
|
||||
local id=$(openwrt_fw_section_add $1)
|
||||
[ -z "$id" ] ||
|
||||
! uci set firewall.@include[$id].path="$OPENWRT_FW_INCLUDE" ||
|
||||
! uci set firewall.@include[$id].reload="1" ||
|
||||
! uci commit firewall &&
|
||||
{
|
||||
echo could not add firewall include
|
||||
exitp 50
|
||||
}
|
||||
}
|
||||
|
||||
install_openwrt_firewall()
|
||||
{
|
||||
echo \* installing firewall script $1
|
||||
|
||||
[ -n "MODE" ] || {
|
||||
echo should specify MODE in $ZAPRET_CONFIG
|
||||
exitp 7
|
||||
}
|
||||
|
||||
echo "linking : $FW_SCRIPT_SRC => $OPENWRT_FW_INCLUDE"
|
||||
ln -fs "$FW_SCRIPT_SRC" "$OPENWRT_FW_INCLUDE"
|
||||
|
||||
openwrt_fw_section_configure $1
|
||||
}
|
||||
|
||||
|
||||
restart_openwrt_firewall()
|
||||
{
|
||||
echo \* restarting firewall
|
||||
|
||||
fw3 -q restart || {
|
||||
echo could not restart firewall
|
||||
exitp 30
|
||||
}
|
||||
}
|
||||
|
||||
remove_openwrt_firewall()
|
||||
{
|
||||
echo \* removing firewall script
|
||||
|
||||
openwrt_fw_section_del
|
||||
# from old zapret versions. now we use single include
|
||||
openwrt_fw_section_del 6
|
||||
|
||||
# free some RAM
|
||||
"$IPSET_DIR/create_ipset.sh" clear
|
||||
}
|
||||
|
||||
install_openwrt_iface_hook()
|
||||
{
|
||||
echo \* installing ifup hook
|
||||
|
||||
ln -fs "$OPENWRT_IFACE_HOOK" /etc/hotplug.d/iface
|
||||
}
|
||||
|
||||
is_flow_offload_avail()
|
||||
{
|
||||
# $1 = '' for ipv4, '6' for ipv6
|
||||
grep -q FLOWOFFLOAD /proc/net/ip$1_tables_targets
|
||||
}
|
||||
|
||||
deoffload_openwrt_firewall()
|
||||
{
|
||||
echo \* checking flow offloading
|
||||
|
||||
is_flow_offload_avail || {
|
||||
[ "$FWTYPE" = "nftables" ] || is_ipt_flow_offload_avail || {
|
||||
echo unavailable
|
||||
return
|
||||
}
|
||||
@@ -1262,7 +819,7 @@ deoffload_openwrt_firewall()
|
||||
|
||||
if [ "$fo" = "1" ] ; then
|
||||
local mod=0
|
||||
$ECHON "system wide flow offloading detected. "
|
||||
printf "system wide flow offloading detected. "
|
||||
case $FLOWOFFLOAD in
|
||||
donttouch)
|
||||
if [ "$MODE" = "nfqws" ]; then
|
||||
@@ -1303,23 +860,31 @@ install_openwrt()
|
||||
check_location copy_openwrt
|
||||
install_binaries
|
||||
check_dns
|
||||
|
||||
echo \* stopping current firewall rules/daemons
|
||||
"$INIT_SCRIPT_SRC" stop_fw
|
||||
"$INIT_SCRIPT_SRC" stop_daemons
|
||||
|
||||
select_fwtype
|
||||
select_ipv6
|
||||
check_prerequisites_openwrt
|
||||
ask_config
|
||||
ask_config_tmpdir
|
||||
ask_config_offload
|
||||
# stop and reinstall sysv init
|
||||
install_sysv_init
|
||||
# can be previous firewall preventing access
|
||||
remove_openwrt_firewall
|
||||
restart_openwrt_firewall
|
||||
# free some RAM
|
||||
clear_ipset
|
||||
download_list
|
||||
crontab_del_quiet
|
||||
# router system : works 24/7. night is the best time
|
||||
crontab_add 0 6
|
||||
cron_ensure_running
|
||||
service_start_sysv
|
||||
install_openwrt_iface_hook
|
||||
install_openwrt_firewall
|
||||
# in case of nftables or iptables without fw3 sysv init script also controls firewall
|
||||
[ -n "$OPENWRT_FW3" -a "$FWTYPE" = iptables ] && install_openwrt_firewall
|
||||
service_start_sysv
|
||||
deoffload_openwrt_firewall
|
||||
restart_openwrt_firewall
|
||||
}
|
||||
@@ -1332,24 +897,7 @@ remove_pf_zapret_hooks()
|
||||
|
||||
pf_anchors_clear
|
||||
}
|
||||
service_install_macos()
|
||||
{
|
||||
echo \* installing zapret service
|
||||
|
||||
ln -fs /opt/zapret/init.d/macos/zapret.plist /Library/LaunchDaemons
|
||||
}
|
||||
service_start_macos()
|
||||
{
|
||||
echo \* starting zapret service
|
||||
|
||||
"$INIT_SCRIPT_SRC" start
|
||||
}
|
||||
service_stop_macos()
|
||||
{
|
||||
echo \* stopping zapret service
|
||||
|
||||
"$INIT_SCRIPT_SRC" stop
|
||||
}
|
||||
macos_fw_reload_trigger_clear()
|
||||
{
|
||||
case "$MODE" in
|
||||
|
||||
Reference in New Issue
Block a user