API tools faq
paste
Advertisement
rs232

p2partisan 4.10

rs232
Oct 1st, 2014
375
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 26.14 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. #
  3. # p2partisan v4.10 (01/10/2014)
  4. #
  5. # <CONFIGURATION> ###########################################
  6. # Adjust location where the files are kept
  7. P2Partisandir=/cifs1/p2partisan
  8. #
  9. # Edit the file "blacklists" to customise if needed
  10. # Edit the "whitelist" to overwrite the blacklist if needed
  11. #
  12. # Enable logging? Use only for troubleshooting. 0=off 1=on
  13. syslogs=1
  14. # Maximum number of logs to be recorded in a given 60 min
  15. # Consider set this very low (like 3 or 6) once your are
  16. # happy with the installation. To troubleshoot blocked
  17. # connection close all the secondary traffic e.g. p2p
  18. # and try a connection to the blocked site/port you should
  19. # find a reference in the logs.
  20. maxloghour=1
  21. #
  22. # What do you want to block?
  23. # 1) Input (Router only, running transmission?)
  24. # 2) LAN (LAN clients only)
  25. # 3) Both *default
  26. protection=3
  27. #
  28. # ports to be whitelisted. Whitelisted ports will never be
  29. # blocked no matter what the source/destination IP is.
  30. # This is very important if you're running a service like
  31. # e.g. SMTP/HTTP/IMAP/else. Separate value in the list below
  32. # with commas - NOTE: Leave 80 and 443 untouched, add custom ports only
  33. # you might want to add remote admin and VPN ports here if any.
  34. # Standard iptables syntax, individual ports divided by "," and ":" to
  35. # define a range e.g. 80,443,2100:2130. Do not whitelist you P2P client!
  36. whiteports=53,80,123,443,1194:1197,1723
  37. #
  38. # Fastrouting will process the IP classes very quickly but use
  39. # Lot of resources. If you disable the effect is transparent
  40. # but the full process will take minutes rather than seconds
  41. # 0=disabled 1=enabled
  42. fastroutine=1
  43. #
  44. # Enable check on script availability to help autorun
  45. # E.g. wait for the file to be available in cifs before run it
  46. # instead of quit with a file missing error
  47. autorun_availability_check=1
  48. #
  49. # Schedule updates? (once a week is plenty). Custom syntax:
  50. # m = random minute picked up in the range[0-59]
  51. # h = random hour picked up in the range [1-5]am
  52. # d = random day of the week picked up in the range Sun to Sat [0-6]
  53. # if unwanted set your own specific time e.g.
  54. # "30 4 * * 1" 4:30 on a Monday
  55. # or use a combination e.g. random minute at 1am on a Tuesday:
  56. # "m 1 * * 3"
  57. # Specify this always in between "" please
  58. schedule="m h * * d"
  59. #
  60. # IP for testing Internet connectivity
  61. testip=8.8.8.8
  62. # </CONFIGURATION> ###########################################
  63.  
  64. # Wait until Internet is available
  65.     while :
  66.     do
  67.         ping -c 3 $testip >/dev/null 2>&1
  68.         if [ $? = 0 ]; then
  69.             break
  70.         fi
  71.         sleep 5
  72.     done
  73.  
  74. pidfile=/var/run/p2partisan.pid
  75. cd $P2Partisandir
  76. version=`head -3 ./p2partisan.sh | tail -1 | cut -f 3- -d " "`
  77.  
  78. alias ipset='/bin/nice -n19 /usr/sbin/ipset'
  79. alias sed='/bin/nice -n19 /bin/sed'
  80. alias iptables='/usr/sbin/iptables'
  81. alias service='/sbin/service'
  82. alias plog='logger -t P2PARTISAN -s'
  83. now=`date +%s`
  84. wanif=`nvram get wan_ifname`
  85. lanif=`nvram get lan_ifname`
  86.  
  87.  
  88. psoftstop() {
  89.     ./iptables-del 2> /dev/null
  90.     plog "Stopping P2Partisan"
  91.     [ -f $pidfile ] && rm -f "$pidfile" 2> /dev/null
  92.     [ -f iptables-add ] && rm -f "iptables-add" 2> /dev/null
  93.     [ -f iptables-del ] && rm -f "iptables-del" 2> /dev/null
  94. }
  95.  
  96. pblock() {
  97.     plog "P2PArtisan: Applying paranoia block"
  98.     iptables -N PARANOIA-DROP 2> /dev/null
  99.    
  100.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  101.         a=1
  102.         b=8
  103.         rounds=`echo $(( $whiteports_number / $b ))`
  104.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  105.     while [ $rounds -gt 0 ]
  106.     do
  107.         w=`echo $whiteports | cut -d"," -f $a-$b`
  108.         a=`echo $(( $a + $b ))`
  109.         b=`echo $(( $b + $b ))`
  110. whitep="${whitep}iptables -A PARANOIA-DROP -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  111. iptables -A PARANOIA-DROP -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  112. iptables -A PARANOIA-DROP -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  113. iptables -A PARANOIA-DROP -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  114. "
  115.     rounds=`echo $(( $rounds - 1 ))`
  116.     done
  117.  
  118.     iptables -A PARANOIA-DROP -m limit --limit $maxloghour/hour --limit-burst 5 -j LOG --log-prefix "P2Partisan Rejected (paranoia): " --log-level 1 2> /dev/null
  119.     iptables -A PARANOIA-DROP -j DROP
  120.     iptables -I wanin 1 -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  121.     iptables -I wanout 1 -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  122.     iptables -I INPUT 1 -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  123.     iptables -I OUTPUT 1 -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  124. }
  125.  
  126. punblock() {
  127.     while iptables -L wanin 2> /dev/null | grep "PARANOIA-DROP"
  128.     do
  129.         iptables -D wanin -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  130.     done
  131.     while iptables -L wanout 2> /dev/null | grep "PARANOIA-DROP"
  132.     do
  133.         iptables -D wanout -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  134.     done
  135.     while iptables -L OUTPUT 2> /dev/null | grep "PARANOIA-DROP"
  136.     do
  137.         iptables -D OUTPUT -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  138.     done
  139.     while iptables -L INPUT 2> /dev/null | grep "PARANOIA-DROP"
  140.     do
  141.         iptables -D INPUT -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  142.     done
  143.     iptables -F PARANOIA-DROP 2> /dev/null && plog "P2PArtisan: Removing paranoia block"
  144.     iptables -X PARANOIA-DROP 2> /dev/null
  145. }
  146.  
  147. pforcestop() {
  148.     while iptables -L wanin 2> /dev/null | grep P2PARTISAN-IN
  149.     do
  150.         iptables -D wanin -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  151.     done
  152.     while iptables -L wanout 2> /dev/null | grep P2PARTISAN-OUT
  153.     do
  154.         iptables -D wanout -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  155.     done
  156.     while iptables -L INPUT | grep P2PARTISAN-IN
  157.     do
  158.         iptables -D INPUT -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  159.     done
  160.     while iptables -L INPUT | grep P2PARTISAN-OUT
  161.     do
  162.         iptables -D INPUT -i $lanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  163.     done
  164.     while iptables -L OUTPUT | grep P2PARTISAN-OUT
  165.     do
  166.         iptables -D OUTPUT -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  167.     done
  168.     iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  169.     iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  170.     iptables -F P2PARTISAN-IN 2> /dev/null
  171.     iptables -F P2PARTISAN-OUT 2> /dev/null
  172.     iptables -X P2PARTISAN-DROP-IN 2> /dev/null
  173.     iptables -X P2PARTISAN-DROP-OUT 2> /dev/null   
  174.     iptables -X P2PARTISAN-IN 2> /dev/null
  175.     iptables -X P2PARTISAN-OUT 2> /dev/null
  176.     ipset -F
  177.     for i in `ipset --list | grep Name | cut -f2 -d ":" `; do
  178.         ipset -X $i
  179.     done
  180.     chmod 777 ./*.gz
  181.     [ -f iptables-add ] && rm iptables-add
  182.     [ -f iptables-del ] && rm iptables-del
  183.     [ -f ipset-del ] && rm ipset-del
  184.     [ -f $pidfile ] && rm -f "$pidfile" 2> /dev/null
  185.     [ -f runtime ] && rm -f "runtime" 2> /dev/null
  186. plog "Unloading ipset modules"
  187.     lsmod | grep "ipt_set" > /dev/null 2>&1 && sleep 2 ; rmmod -f ipt_set 2> /dev/null
  188.     lsmod | grep "ip_set_iptreemap" > /dev/null 2>&1 && sleep 2 ; rmmod -f ip_set_iptreemap 2> /dev/null
  189.     lsmod | grep "ip_set" > /dev/null 2>&1 && sleep 2 ; rmmod -f ip_set 2> /dev/null
  190. plog "Stopping P2Partisan"
  191. }
  192.  
  193. pstatus() {
  194.     running3=`iptables -L INPUT | grep P2PARTISAN-IN  2> /dev/null | wc -l`
  195.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  196.     running5=`nvram get script_fire | grep p2partisan >/dev/null && echo Yes || echo No`
  197.     running6=`cru l | grep P2Partisan-update >/dev/null && echo Yes || echo No`
  198.     running7=`tail -200 /var/log/messages | grep Rejected | tail -1`
  199.     running9=`nvram get script_fire | grep "p2partisan.sh tutor" >/dev/null && echo Yes || echo No`
  200.     runningA=`cat /var/log/messages | grep "Applying paranoia" | wc -l`
  201.     runningB=`cat /var/log/messages | grep "Stuck on Loading" | wc -l`
  202.     runningC=`cat blacklists | grep -v "^#" | grep -v "^$" | wc -l`
  203.     runningD=`cat ./runtime`
  204.    
  205.     from=`head -1 ./iptables-add 2> /dev/null | cut -c3-`
  206.     runtime=`echo $(( $now - $from ))`
  207.     from=`date -d @$from`
  208.     h=`echo $(( $runtime / 3600 ))`
  209.     m=`echo $((( $runtime / 60) %60 ))`
  210.     s=`echo $(( $runtime %60 ))`
  211.     runtime=`printf "%02d:%02d:%02d\n" $h $m $s`
  212.     drop_packet_count_in=`iptables -vL P2PARTISAN-DROP-IN 2> /dev/null| grep " DROP " | awk '{print $1}'`
  213.     drop_packet_count_out=`iptables -vL P2PARTISAN-DROP-OUT 2> /dev/null| grep " REJECT " | awk '{print $1}'`
  214.    
  215.    
  216.     if [[ $running3 -eq "0" ]] && [[ $running4 -eq "0" ]]; then
  217.         running8=No
  218.     elif [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  219.         running8=Loading...
  220.     elif [[ $running3 -gt "0" ]] && [[ $running4 -eq "0" ]]; then
  221.         running8=Not quite... try to run \"p2partisan.sh update\"
  222.     else
  223.         running8=Yes
  224.     fi
  225.  
  226.    
  227.     echo "################### P2Partisan ##########################
  228. #   Release version: $version
  229. ################# P2Partisan status #####################
  230. # Running:      $running8
  231. # Autorun:      $running5
  232. # Scheduled:    $running6 / $runningA since boot
  233. # Tutor:        $running9 / $runningB since boot
  234. #########################################################
  235. # Uptime:       $runtime
  236. # Dropped in:   $drop_packet_count_in
  237. # Rejected out: $drop_packet_count_out
  238. #########################################################
  239. # Blacklists:   $runningC
  240. # Startup time: $runningD seconds"
  241.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  242.         a=1
  243.         b=8
  244.         rounds=`echo $(( $whiteports_number / $b ))`
  245.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  246.     while [ $rounds -gt 0 ]
  247.     do
  248.         w=`echo $whiteports | cut -d"," -f $a-$b`
  249.         a=`echo $(( $a + $b ))`
  250.         b=`echo $(( $b + $b ))`
  251.     echo "# White ports:  $w"
  252.         rounds=`echo $(( $rounds - 1 ))`
  253.     done
  254. echo "################# Last log recorded #####################
  255. # Remember your max logs per hour is set to: $maxloghour
  256. $running7
  257. #########################################################"
  258. }
  259.  
  260.  
  261. if [ $autorun_availability_check = 1 ]; then
  262. av="while true; do [ -f $P2Partisandir/p2partisan.sh ] && break || sleep 5; done ;"
  263. fi
  264.  
  265. pautorunset() {
  266.     p=`nvram get script_fire | grep "p2partisan.sh" | grep -v cru | wc -l`
  267.     if [ $p -eq "0" ] ; then
  268.         t=`nvram get script_fire`; t=`printf "$t\n$av$P2Partisandir/p2partisan.sh\n"` ; nvram set "script_fire=$t"
  269.     fi
  270.     plog "P2Partisan AUTO RUN is ON"
  271.     nvram commit
  272. }
  273.  
  274. pautorununset() {
  275.     p=`nvram get script_fire | grep "p2partisan.sh" | grep -v cru | wc -l`
  276.     if [ $p -eq "1" ]; then
  277.     t=`nvram get script_fire`; t=`printf "$t\n$P2Partisandir/p2partisan.sh\n" | grep -v p2partisan` ; nvram set "script_fire=$t"
  278.     fi
  279.     plog "P2Partisan AUTO RUN is OFF"
  280.     nvram commit
  281. }
  282.  
  283. pscheduleset() {
  284.     cru d P2Partisan-update
  285.     e=`tr -cd 0-5 </dev/urandom | head -c 1`
  286.     f=`tr -cd 0-9 </dev/urandom | head -c 1`
  287.     a=`echo $e$f`
  288.     b=`tr -cd 1-5 </dev/urandom | head -c 1`
  289.     c=`tr -cd 0-6 </dev/urandom | head -c 1`
  290.     scheduleme=`echo "$schedule" | tr "m" "$a"`
  291.     scheduleme=`echo "$scheduleme" | tr "h" "$b"`
  292.     scheduleme=`echo "$scheduleme" | tr "d" "$c"`
  293.     cru a P2Partisan-update "$scheduleme $P2Partisandir/p2partisan.sh paranoia-update"
  294.     pp=`nvram get script_fire | grep "p2partisan.sh paranoia-update" | grep -v cru | wc -l`
  295.     p=`nvram get script_fire | grep "cru a P2Partisan-update" | wc -l`
  296.     if [ $p -eq "0" ] ; then
  297.         if [ $pp -eq "0" ]; then
  298.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$scheduleme $P2Partisandir/p2partisan.sh paranoia-update\"\n"` ; nvram set "script_fire=$t"
  299.         else
  300.         pautorununset
  301.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$scheduleme $P2Partisandir/p2partisan.sh paranoia-update\"\n"` ; nvram set "script_fire=$t"
  302.         pautorunset
  303.         fi
  304.     fi
  305.     plog "P2Partisan AUTO UPDATE is ON"
  306.     nvram commit
  307. }
  308.  
  309. pscheduleunset() {
  310.     cru d P2Partisan-update
  311.     p=`nvram get script_fire | grep "cru a P2Partisan-update" | wc -l`
  312.     if [ $p -eq "1" ] ; then
  313.     t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$schedule $P2Partisandir/p2partisan.sh paranoia-update\"\n" | grep -v "cru a P2Partisan-update"` ; nvram set "script_fire=$t"
  314.     fi
  315.     plog "P2Partisan AUTO UPDATE is OFF"
  316.     nvram commit
  317. }
  318.  
  319. pupgrade() {
  320.     wget -q -O - http://pastebin.com/raw.php?i=jqHD3hfT | grep "p2partisan v" | grep -v grep> ./latest
  321.     latest=`cat ./latest | cut -c3-31`
  322.     current=`cat ./p2partisan.sh | grep "p2partisan v" | head -1 | cut -c3-32 `
  323.     if [ "$latest" == "$current" ]; then
  324.     echo "
  325. You're already running the latest version of P2Partisan
  326. "
  327.     else
  328.     echo "
  329. There's a new P2Partisan update available. Do you want to upgrade?
  330.    
  331.             current = $current
  332.    
  333.                     to
  334.            
  335.              latest = $latest
  336.  
  337. y/n"
  338.     read answer
  339.     # echo "You entered: $input_variable"
  340.         if [ $answer == "y" ]; then
  341.         echo "Upgrading, please wait:"
  342.         echo "1/6) Downloading the script"
  343.         wget -q -O ./p2partisan_new.sh http://pastebin.com/raw.php?i=jqHD3hfT
  344.         echo "2/6) Migrating the configuration"
  345.         sed '1,/P2Partisandir/{s@P2Partisandir=.*@'"P2Partisandir=$P2Partisandir"'@'} -i ./p2partisan_new.sh
  346.         sed '1,/syslogs/{s@syslogs=.*@'"syslogs=$syslogs"'@'} -i ./p2partisan_new.sh
  347.         sed '1,/maxloghour/{s@maxloghour=.*@'"maxloghour=$maxloghour"'@'} -i ./p2partisan_new.sh
  348.         sed '1,/protection/{s@protection=.*@'"protection=$protection"'@'} -i ./p2partisan_new.sh
  349.         sed '1,/whiteports/{s@whiteports=.*@'"whiteports=$whiteports"'@'} -i ./p2partisan_new.sh
  350.         sed '1,/fastroutine/{s@fastroutine=.*@'"fastroutine=$fastroutine"'@'} -i ./p2partisan_new.sh
  351.         sed '1,/autorun_availability_check/{s@autorun_availability_check=.*@'"autorun_availability_check=$autorun_availability_check"'@'} -i ./p2partisan_new.sh
  352.         sed '1,/schedule/{s@schedule=.*@'"schedule=\"$schedule\""'@'} -i ./p2partisan_new.sh
  353.         sed '1,/testip/{s@testip=.*@'"testip=$testip"'@'} -i ./p2partisan_new.sh       
  354.         tr -d "\r"< ./p2partisan_new.sh > ./.temp ; mv ./.temp ./p2partisan_new.sh
  355.         echo "3/6) Copying p2partisan.sh into p2partisan.sh.old"
  356.         cp ./p2partisan.sh ./p2partisan_old
  357.         echo "4/6) Installing new script into p2partisan.sh"
  358.         mv ./p2partisan_new.sh ./p2partisan.sh
  359.         echo "5/6) Setting up permissions"
  360.         chmod -R 777 ./p2partisan.sh
  361.         echo "6/6) all done, I'm now running the script for you.
  362. NOTE: autorun, autoupdate and tutor settings are left as they were found
  363. "
  364.         pforcestop
  365.         else
  366.         echo "Upgrade skipped. Quitting..."
  367.         exit
  368.         fi
  369.    
  370.     fi
  371.  }
  372.  
  373. ptutor() {
  374.     running3=`iptables -L INPUT | grep P2PARTISAN-IN  2> /dev/null | wc -l`
  375.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  376.     if [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  377.             plog "P2Partisan appears to be loading, I'll wait 5 minutes..."    
  378.             sleep 300
  379.         if [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  380.             psoftstop
  381.             plog "P2Partisan tutor had to restart due to Stuck on Loading"
  382.             pstart
  383.         fi
  384.     else
  385.     echo "P2Partisan up and running. The tutor is happy"
  386.     fi
  387.  }
  388.  
  389. ptutorset() {
  390.     cru d P2Partisan-tutor
  391.     ab=`tr -cd 0-5 </dev/urandom | head -c 1`
  392.     a=`tr -cd 0-9 </dev/urandom | head -c 1`
  393.     a=`echo $ab$a`
  394.     scheduleme=`echo "$a * * * *"`
  395.     cru a P2Partisan-tutor "$scheduleme $P2Partisandir/p2partisan.sh tutor"
  396.     pp=`nvram get script_fire | grep "p2partisan.sh tutor" | grep -v cru | wc -l`
  397.     p=`nvram get script_fire | grep "cru a P2Partisan-tutor" | wc -l`
  398.     if [ $p -eq "0" ] ; then
  399.         if [ $pp -eq "0" ]; then
  400.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$scheduleme $P2Partisandir/p2partisan.sh tutor\"\n"` ; nvram set "script_fire=$t"
  401.         else
  402.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$scheduleme $P2Partisandir/p2partisan.sh tutor\"\n"` ; nvram set "script_fire=$t"
  403.         fi
  404.     fi
  405.     plog "P2Partisan tutor is ON"
  406.     nvram commit
  407. }
  408.  
  409. ptutorunset() {
  410.     cru d P2Partisan-tutor
  411.     p=`nvram get script_fire | grep "cru a P2Partisan-tutor" | wc -l`
  412.     if [ $p -eq "1" ] ; then
  413.     t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$schedule $P2Partisandir/p2partisan.sh tutor\"\n" | grep -v "cru a P2Partisan-tutor"` ; nvram set "script_fire=$t"
  414.     fi
  415.     plog "P2Partisan tutor is OFF"
  416.     nvram commit
  417.  }
  418.  
  419. pstart() {
  420.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  421.     if [ $running4 -eq "0" ] ; then
  422.  
  423.     /bin/ntpsync > /dev/null 2>&1
  424.     pre=`date +%s`
  425.     sleep 2
  426.  
  427.     echo $$ > $pidfile
  428.    
  429.     [ -f iptables-add ] && rm iptables-add
  430.     [ -f iptables-del ] && rm iptables-del
  431.     [ -f ipset-del ] && rm ipset-del
  432.      
  433.     echo "### PREPARATION ###"
  434.     echo "Loading the ipset modules"
  435.     lsmod | cut -c1-20 | grep "ip_set " > /dev/null 2>&1 || insmod ip_set
  436.     lsmod | cut -c1-20 | grep "ip_set_iptreemap" > /dev/null 2>&1 || insmod ip_set_iptreemap
  437.     lsmod | cut -c1-20 | grep "ipt_set" > /dev/null 2>&1 || insmod ipt_set
  438.  
  439. counter=0
  440. pos=1
  441. couscous=`cat blacklist-custom | grep -v "^#" | grep -v "^$" | wc -l`
  442.  
  443.         echo "### CUSTOM BLACKLIST ###
  444. blacklist-custom file -> $couscous entries found"
  445.  if [ $couscous -eq "0" ]; then
  446.         echo "No custom blacklist entries found: skipping"
  447.  else
  448.         echo "loading blacklist #$counter --> ***Custom IP blacklist***"
  449.         ipset --create blacklist-custom iptreemap
  450.         if [ -e blacklist-custom ]; then
  451.         for IP in `cat blacklist-custom | grep -v "^#" | grep -v "^$" | cut -d: -f2`
  452.             do
  453.                 ipset -A blacklist-custom $IP
  454.             done
  455.         fi
  456. fi
  457.    
  458. echo "### WHITELIST ###"
  459.        
  460.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  461.         a=1
  462.         b=8
  463.         rounds=`echo $(( $whiteports_number / $b ))`
  464.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  465.     while [ $rounds -gt 0 ]
  466.     do
  467.         w=`echo $whiteports | cut -d"," -f $a-$b`
  468.         a=`echo $(( $a + $b ))`
  469.         b=`echo $(( $b + $b ))`
  470.     echo "loading whitelisted ports $w exemption"
  471. whitep="${whitep}iptables -A P2PARTISAN-IN -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  472. iptables -A P2PARTISAN-IN -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  473. iptables -A P2PARTISAN-IN -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  474. iptables -A P2PARTISAN-IN -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  475. iptables -A P2PARTISAN-OUT -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  476. iptables -A P2PARTISAN-OUT -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  477. iptables -A P2PARTISAN-OUT -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  478. iptables -A P2PARTISAN-OUT -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  479. "
  480.     rounds=`echo $(( $rounds - 1 ))`
  481.     done
  482.  
  483.  
  484.         echo "# $now
  485. iptables -N P2PARTISAN-IN 2> /dev/null
  486. iptables -N P2PARTISAN-OUT 2> /dev/null
  487. iptables -N P2PARTISAN-DROP-IN 2> /dev/null
  488. iptables -N P2PARTISAN-DROP-OUT 2> /dev/null
  489. iptables -F P2PARTISAN-IN 2> /dev/null
  490. iptables -F P2PARTISAN-OUT 2> /dev/null
  491. iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  492. iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  493. iptables -A P2PARTISAN-IN -m set --set blacklist-custom src -j P2PARTISAN-DROP-IN 2> /dev/null
  494. iptables -A P2PARTISAN-OUT -m set --set blacklist-custom src -j P2PARTISAN-DROP-OUT 2> /dev/null
  495. $whitep" >> iptables-add
  496.  
  497.  
  498.         echo "# $now
  499. iptables -D wanin -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  500. iptables -D wanout -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  501. iptables -D INPUT -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  502. iptables -D INPUT -i $lanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  503. iptables -D OUTPUT -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  504. iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  505. iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  506. iptables -F P2PARTISAN-IN 2> /dev/null
  507. iptables -F P2PARTISAN-OUT 2> /dev/null
  508. iptables -X P2PARTISAN-IN 2> /dev/null
  509. iptables -X P2PARTISAN-OUT 2> /dev/null
  510. iptables -X P2PARTISAN-DROP-IN 2> /dev/null
  511. iptables -X P2PARTISAN-DROP-OUT 2> /dev/null" >> iptables-del
  512.  
  513.  
  514. echo "preparing the IP whitelist for the iptables"
  515. #Load the whitelist
  516. if [ "$(ipset --swap whitelist whitelist 2>&1 | grep 'Unknown set')" != "" ]
  517.     then
  518.     ipset --create whitelist iptreemap
  519.     cat whitelist | grep -v "^10." | grep -v "^172.16." | grep -v "^192.168." |
  520.     (
  521.     while read IP
  522.     do
  523.             echo "$IP" | grep "^#" >/dev/null 2>&1 && continue
  524.             echo "$IP" | grep "^$" >/dev/null 2>&1 && continue
  525.                     ipset -A whitelist $IP
  526.             done
  527.     )
  528. fi
  529.         echo "# $now
  530. ipset -F
  531. ipset -X blacklist-custom
  532. ipset -X whitelist" > ipset-del
  533.  
  534.             echo "loading the IP whitelist"
  535.             echo "iptables -A P2PARTISAN-IN -m set --set whitelist src -j ACCEPT 2> /dev/null
  536. iptables -A P2PARTISAN-OUT -m set --set whitelist dst -j ACCEPT 2> /dev/null" >> iptables-add
  537.  
  538.         if [ $syslogs -eq "1" ]; then        
  539.             echo "iptables -A P2PARTISAN-DROP-IN -m limit --limit $maxloghour/hour --limit-burst 1 -j LOG --log-prefix \"P2Partisan Dropped: \" --log-level 1 2> /dev/null" >> iptables-add
  540.             echo "iptables -A P2PARTISAN-DROP-OUT -m limit --limit $maxloghour/hour --limit-burst 1 -j LOG --log-prefix \"P2Partisan Rejected: \" --log-level 1 2> /dev/null" >> iptables-add
  541.        
  542.         fi
  543.         echo "iptables -A P2PARTISAN-DROP-IN -j DROP"  >> iptables-add
  544.         echo "iptables -A P2PARTISAN-DROP-OUT -j REJECT --reject-with icmp-admin-prohibited"  >> iptables-add
  545.  
  546.  
  547. echo "### BLACKLISTs ###"
  548.    
  549.     cat blacklists |
  550.    (
  551.     while read line
  552.     do
  553.             echo "$line" | grep "^#" >/dev/null 2>&1 && continue
  554.             echo "$line" | grep "^$" >/dev/null 2>&1 && continue
  555.             counter=`expr $counter + 1`
  556.             name=`echo $line |cut -d ' ' -f1`
  557.             url=`echo $line |cut -d ' ' -f2`
  558.             echo "loading blacklist #$counter --> ***$name***"
  559.      
  560.     if [ $fastroutine -eq "1" ]; then
  561.      
  562.      if [ "$(ipset --swap $name $name 2>&1 | grep 'Unknown set')" != "" ]
  563.       then
  564.           [ -f ./runtime ] && rm -f ./runtime 2> /dev/null
  565.           [ -e $name.gz ] || wget -q -O $name.gz "$url"
  566.           { echo "-N $name iptreemap"
  567.             gunzip -c  $name.gz | \
  568.             sed -e "/^[\t ]*#.*\|^[\t ]*$/d;s/^.*:/-A $name /"
  569.             echo COMMIT
  570.           } | ipset -R
  571.      fi
  572.     else
  573.      
  574.         if [ "$(ipset --swap $name $name 2>&1 | grep 'Unknown set')" != "" ]
  575.             then
  576.             [ -f ./runtime ] && rm -f ./runtime 2> /dev/null
  577.             ipset --create $name iptreemap
  578.             [ -e $name.lst ] || wget -q -O - "$url" | gunzip | cut -d: -f2 | grep -E "^[-0-9.]+$" > $name.lst
  579.             for IP in $(cat $name.lst)
  580.                     do
  581.                     ipset -A $name $IP
  582.                     done
  583.             fi
  584.              
  585.     fi
  586.  
  587.                 echo "ipset -X $name " >> ipset-del
  588.                 echo "iptables -A P2PARTISAN-IN -m set --set $name src -j P2PARTISAN-DROP-IN 2> /dev/null
  589. iptables -A P2PARTISAN-OUT -m set --set $name dst -j P2PARTISAN-DROP-OUT 2> /dev/null" >> iptables-add 
  590.             done
  591.     )
  592.  
  593.  
  594.         if [ $protection -eq "1" ]; then
  595.             echo "iptables -I INPUT $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  596. iptables -I OUTPUT $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null" >> iptables-add
  597.         elif [ $protection -eq "2" ]; then
  598.             echo "iptables -I wanin $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  599. iptables -I wanout $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  600. iptables -I INPUT $pos -i $lanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null" >> iptables-add
  601.         elif [ $protection -eq "3" ]; then
  602.             echo "iptables -I INPUT $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  603. iptables -I INPUT $pos -i $lanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  604. iptables -I OUTPUT $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  605. iptables -I wanin $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  606. iptables -I wanout $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null" >> iptables-add
  607.  
  608.         fi
  609.  
  610. chmod 777 ./iptables-*
  611. chmod 777 ./ipset-*
  612. ./iptables-add  #protecting
  613.  
  614. plog "... P2Partisan started."
  615.  
  616. p=`nvram get dnsmasq_custom | grep log-async | wc -l`
  617. if [ $p -eq "1" ]; then
  618.     plog "log-async found under dnsmasq -> OK"
  619. else
  620.     plog "
  621. It appears like you don't have a log-async parameter
  622. in your dnsmasq config. This is strongly suggested
  623. due to the amount of logs involved. please consider
  624. adding the following command under Advanced/DHCP/DNS
  625. /Dnsmasq Custom configuration
  626.  
  627. log-async=10
  628. "
  629. fi
  630.  
  631. punblock  #remove paranoia DROPs if any
  632.  
  633.     post=`date +%s`
  634.     runtime=`echo $(( $post - $pre ))`
  635.     [ -f ./runtime ] || echo $runtime > ./runtime
  636.     else
  637.         echo "
  638.     It appears like P2Partisan is already running. Skipping...
  639.            
  640.     If this is not what you expected? Try:
  641.     p2partisan.sh update
  642.         "
  643.     fi
  644. }
  645.  
  646.  
  647. for p in $1
  648. do
  649. case "$p" in
  650.         "start")
  651.                 pstart
  652.                 exit
  653.                 ;;     
  654.         "stop")
  655.                 pforcestop
  656.                 exit
  657.                 ;;
  658.         "restart")
  659.                 pscheduleunset
  660.                 psoftstop
  661.                 pscheduleset
  662.                 ;;
  663.         "status")
  664.                 pstatus
  665.                 exit               
  666.                 ;;
  667.         "pause")
  668.                 psoftstop
  669.                 exit
  670.                 ;;
  671.         "update")
  672.                 pforcestop
  673.                 ;;
  674.         "paranoia-update")
  675.                 pblock
  676.                 pforcestop
  677.                 ;;
  678.         "autorun-on")
  679.                 pautorunset
  680.                 exit
  681.                 ;;
  682.         "autorun-off")
  683.                 pautorununset
  684.                 exit
  685.                 ;;
  686.         "autoupdate-on")
  687.                 pscheduleset
  688.                 exit
  689.                 ;;
  690.         "autoupdate-off")
  691.                 pscheduleunset
  692.                 exit
  693.                 ;;
  694.         "tutor-on")
  695.                 ptutorset
  696.                 exit
  697.                 ;;
  698.         "tutor-off")
  699.                 ptutorunset
  700.                 exit
  701.                 ;;
  702.         "tutor")
  703.                 ptutor
  704.                 exit
  705.                 ;;
  706.         "upgrade")
  707.                 pupgrade
  708.                 ;;
  709.         "help")
  710.                 echo " 
  711.     P2Partisan parameters:
  712.        
  713.     help            Display this text      
  714.     start           Starts the process (this runs also if no option
  715.                 is provided)
  716.     stop            Stops P2Partisan
  717.     restart         Soft restart, quick, updates iptables only
  718.     pause           stops P2Partisan allowing for quick start
  719.     update          Hard restart, slow removes p2partisan, updates
  720.                 the lists and does a fresh start
  721.     paranoia-update     Like update but blocks any new connection until
  722.                 P2Partisan is running again
  723.     status          Display P2Partisan running status + extra info
  724.     autorun-on      Sets P2Partisan to boot with the router
  725.     autorun-off     Sets P2Partisan not to boot with the router
  726.     autoupdate-on       Sets automatic updates on
  727.     autoupdate-off      Sets automatic updates off
  728.     tutor-on        Schedule tutor check every hour
  729.     tutor-off       Unset the tutor schedule
  730.     upgrade         Download and install the latest P2Partisan
  731. "
  732.                 exit
  733.                 ;;
  734.         *)
  735.                 echo "parameter not valid. please run:
  736.                
  737.     p2partisan.sh help
  738.     "
  739.                 exit
  740.             ;;
  741.  
  742. esac
  743. done
  744.  
  745. pstart
  746.  
  747. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!