mirror of
https://github.com/Ysurac/openmptcprouter-feeds.git
synced 2025-03-09 15:40:03 +00:00
omr-bypass: New way to bypass services without nDPI
This commit is contained in:
Ycarus (Yannick Chabanois)
parent
9c1c926ad4
commit
7fcfd3be07
6 changed files with 310 additions and 20 deletions
|
|
@ -45,6 +45,12 @@ _add_proto() {
|
|||
done
|
||||
}
|
||||
|
||||
_add_proto_without_ndpi() {
|
||||
protoname=$1
|
||||
[ -z "$protoname" ] && return
|
||||
echo "$protoname" >> /usr/share/omr-bypass/omr-bypass-proto.lst
|
||||
}
|
||||
|
||||
_bypass_ip() {
|
||||
local ip=$1
|
||||
local type=$2
|
||||
|
|
@ -469,6 +475,111 @@ _bypass_proto() {
|
|||
fi
|
||||
}
|
||||
|
||||
_bypass_proto_without_ndpi() {
|
||||
local proto
|
||||
local intf
|
||||
local enabled
|
||||
config_get proto $1 proto
|
||||
config_get intf $1 interface
|
||||
config_get enabled $1 enabled
|
||||
config_get ndpi $1 ndpi
|
||||
config_get noipv6 $1 noipv6
|
||||
config_get family $1 family
|
||||
[ "$enabled" = "0" ] && return
|
||||
[ -z "$noipv6" ] && noipv6="0"
|
||||
[ -z "$family" ] && family="ipv4ipv6"
|
||||
intf=$(echo $intf | sed -e 's/\./_/')
|
||||
[ -n "$intf" ] && [ -z "$(ipset --list | grep omr_dst_bypass_$intf)" ] && return
|
||||
local intfid="$(uci -q get omr-bypass.$intf.id)"
|
||||
|
||||
[ -z "$intf" ] && intf="all"
|
||||
[ -z "$proto" ] && return
|
||||
if [ "$(uci -q get openmptcprouter.settings.ndpi)" == "0" ] || [ "$ndpi" == "0" ]; then
|
||||
ipset -q flush bypass_$proto > /dev/null 2>&1
|
||||
ipset -q --exist restore <<-EOF
|
||||
create bypass_$proto hash:net hashsize 64
|
||||
EOF
|
||||
ALLIPS=$(sqlite3 omr-bypass.db "select ip from ipproto where proto='"$proto"';" ".exit")
|
||||
for ip in $ALLIPS; do
|
||||
ipset -q add bypass_$proto $ip
|
||||
done
|
||||
if [ "$intf" = "all" ]; then
|
||||
if [ "$family" = "ipv4" ] || [ "$family" = "ipv4ipv6" ]; then
|
||||
$IPTABLESRESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m set --match-set $proto -j MARK --set-mark 0x539
|
||||
-A omr-bypass-dpi -m mark --mark 0x539 -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$disableipv6" = "0" ] && ([ "$family" = "ipv6" ] || [ "$family" = "ipv4ipv6" ]); then
|
||||
$IP6TABLESRESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass6-dpi -m set --match-set $proto -j MARK --set-mark 0x6539
|
||||
-A omr-bypass6-dpi -m mark --mark 0x6539 -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
else
|
||||
if [ "$family" = "ipv4" ] || [ "$family" = "ipv4ipv6" ]; then
|
||||
$IPTABLESRESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass-dpi -m set --match-set $proto -j MARK --set-mark 0x539$intfid
|
||||
-A omr-bypass-dpi -m mark --mark 0x539$intfid -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
if [ "$disableipv6" = "0" ] && ([ "$family" = "ipv6" ] || [ "$family" = "ipv4ipv6" ]); then
|
||||
$IP6TABLESRESTORE -w --wait=60 --noflush <<-EOF
|
||||
*mangle
|
||||
-A omr-bypass6-dpi -m set --match-set $proto -j MARK --set-mark 0x6539$intfid
|
||||
-A omr-bypass6-dpi -m mark --mark 0x6539$intfid -j RETURN
|
||||
COMMIT
|
||||
EOF
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
# Use dnsmasq ipset to bypass domains of the proto
|
||||
local domains
|
||||
#domains="$(cat /proc/net/xt_ndpi/host_proto | grep -i $proto: | sed -e "s/$proto://i" -e 's/*//' -e 's/,/ /g')"
|
||||
domains=$(sqlite3 omr-bypass.db "select host from hostproto where proto='"$proto"';" ".exit")
|
||||
if [ -n "$domains" ]; then
|
||||
tlds=`curl --max-time 4 -s -k https://data.iana.org/TLD/tlds-alpha-by-domain.txt`
|
||||
for domain in $domains; do
|
||||
if [ -n "$domain" ]; then
|
||||
domain="$(echo $domain | sed 's/^\.//')"
|
||||
if [ "$(echo $domain | grep '\.$')" != "" ]; then
|
||||
domainlist=""
|
||||
# construct list of domains to query
|
||||
i=0
|
||||
for tld in $tlds; do
|
||||
i=$((i+1))
|
||||
# trim off header
|
||||
if [ "$i" -lt "12" ] || [ "$i" -gt "50" ]; then
|
||||
continue
|
||||
fi
|
||||
# add to command
|
||||
domainlist="${domainlist} ${domain}${tld}"
|
||||
done
|
||||
domainlist="$(echo $domainlist `# Get the list of valid domains, pass it to awk` \
|
||||
| awk '{print tolower($0)}' `# awk lowercases the whole string and passes it to ` \
|
||||
| xargs -n8 -P12 `# xargs sends 8 arguments at a time to` \
|
||||
dig a +timeout=1 +tries=1 +retry=1 +nocmd +noall +answer `# dig, which passes results (if any) to` \
|
||||
| awk '{print $1}' `# awk, which outputs queried domain to` \
|
||||
| sed -e 's/.$//' `# sed, which trims off the trailing dot (google.com. -> google.com)` to \
|
||||
| grep $domain `# grep, only keep wanted domain` \
|
||||
| awk '{for (i=1;i<=NF;i++) if (!a[$i]++) printf("%s%s",$i,FS)}{printf("\n")}')" # deduplicate
|
||||
for validdomain in $domainlist; do
|
||||
_bypass_domain $validdomain $intf $family $noipv6
|
||||
done
|
||||
else
|
||||
_bypass_domain $domain $intf $family $noipv6
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
_intf_rule_ss_rules() {
|
||||
rule_name=$1
|
||||
[ "$rule_name" = "ss_rules" ] && rule_name="def"
|
||||
|
|
@ -760,8 +871,10 @@ start_service() {
|
|||
#local count
|
||||
logger -t "omr-bypass" "Starting OMR-ByPass..."
|
||||
add_domains="false"
|
||||
[ -d /proc/net/xt_ndpi ] && config_load omr-bypass
|
||||
config_foreach _add_proto proto
|
||||
[ -d /proc/net/xt_ndpi ] && {
|
||||
config_load omr-bypass
|
||||
config_foreach _add_proto proto
|
||||
}
|
||||
disableipv6="$(uci -q get openmptcprouter.settings.disable_ipv6)"
|
||||
#noipv6="$(uci -q get omr-bypass.global.noipv6)"
|
||||
|
||||
|
|
@ -877,6 +990,7 @@ start_service() {
|
|||
fi
|
||||
config_load omr-bypass
|
||||
[ -d /proc/net/xt_ndpi/proto ] && config_foreach _bypass_proto dpis
|
||||
config_foreach _bypass_proto_without_ndpi dpis
|
||||
uci -q commit omr-bypass
|
||||
|
||||
[ -z "$RELOAD" ] && [ "$add_domains" = "true" ] && {
|
||||
|
|
@ -887,6 +1001,13 @@ start_service() {
|
|||
logger -t "omr-bypass" "Reload dnsmasq..."
|
||||
/etc/init.d/dnsmasq reload
|
||||
}
|
||||
|
||||
# Create a protocol list for UI from a sqlite DB when NDPI is not available
|
||||
sqlite3 /usr/share/omr-bypass/omr-bypass.db "select distinct(proto) from (select proto from hostproto union all select proto from ipproto) a order by proto;" ".exit" > /usr/share/omr-bypass/omr-bypass-proto.lst
|
||||
config_load omr-bypass
|
||||
config_foreach _add_proto_without_ndpi proto
|
||||
sort -o /usr/share/omr-bypass/omr-bypass-proto.lst /usr/share/omr-bypass/omr-bypass-proto.lst
|
||||
|
||||
logger -t "omr-bypass" "OMR-ByPass is running"
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue