API tools faq
paste
Advertisement
rs232

p2partisan 4.00

rs232
Sep 27th, 2014
310
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 25.75 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. #
  3. # p2partisan v4.00 (27/09/2014)
  4. #
  5. # <CONFIGURATION> ###########################################
  6. # Adjust location where the files are kept
  7. P2Partisandir=/cifs1/p2partisan
  8. #
  9. # Edit the file "blacklists" to customise if needed
  10. # Edit the "whitelist" to overwrite the blacklist if needed
  11. #
  12. # Enable logging? Use only for troubleshooting. 0=off 1=on
  13. syslogs=1
  14. # Maximum number of logs to be recorded in a given 60 min
  15. # Consider set this very low (like 3 or 6) once your are
  16. # happy with the installation. To troubleshoot blocked
  17. # connection close all the secondary traffic e.g. p2p
  18. # and try a connection to the blocked site/port you should
  19. # find a reference in the logs.
  20. maxloghour=1
  21. #
  22. # What do you want to block?
  23. # 1) Input (Router only, running transmission?)
  24. # 2) LAN (LAN clients only)
  25. # 3) Both *default
  26. protection=3
  27. #
  28. # ports to be whitelisted. Whitelisted ports will never be
  29. # blocked no matter what the source/destination IP is.
  30. # This is very important if you're running a service like
  31. # e.g. SMTP/HTTP/IMAP/else. Separate value in the list below
  32. # with commas - NOTE: Leave 80 and 443 untouched, add custom ports only
  33. # you might want to add remote admin and VPN ports here if any.
  34. # Standard iptables syntax, individual ports divided by "," and ":" to
  35. # define a range e.g. 80,443,2100:2130. Do not whitelist you P2P client!
  36. whiteports=53,80,123,443,1194:1197,1723
  37. #
  38. # Fastrouting will process the IP classes very quickly but use
  39. # Lot of resources. If you disable the effect is transparent
  40. # but the full process will take minutes rather than seconds
  41. # 0=disabled 1=enabled
  42. fastroutine=1
  43. #
  44. # Enable check on script availability to help autorun
  45. # E.g. wait for the file to be available in cifs before run it
  46. # instead of quit with a file missing error
  47. autorun_availability_check=1
  48. #
  49. # Schedule updates? (once a week is plenty). Custom syntax:
  50. # m = random minute picked up in the range[0-59]
  51. # h = random hour picked up in the range [1-5]am
  52. # d = random day of the week picked up in the range Sun to Sat [0-6]
  53. # if unwanted set your own specific time e.g.
  54. # "30 4 * * 1" 4:30 on a Monday
  55. # or use a combination e.g. random minute at 1am on a Tuesday:
  56. # "m 1 * * 3"
  57. # Specify this always in between "" please
  58. schedule="m h * * d"
  59. #
  60. # IP for testing Internet connectivity
  61. testip=8.8.8.8
  62. # </CONFIGURATION> ###########################################
  63.  
  64. # Wait until Internet is available
  65.     while :
  66.     do
  67.         ping -c 3 $testip >/dev/null 2>&1
  68.         if [ $? = 0 ]; then
  69.             break
  70.         fi
  71.         sleep 5
  72.     done
  73.  
  74. pidfile=/var/run/p2partisan.pid
  75. cd $P2Partisandir
  76. version=`head -3 ./p2partisan.sh | tail -1 | cut -f 3- -d " "`
  77.  
  78. alias ipset='/bin/nice -n19 /usr/sbin/ipset'
  79. alias sed='/bin/nice -n19 /bin/sed'
  80. alias iptables='/usr/sbin/iptables'
  81. alias service='/sbin/service'
  82. alias plog='logger -t P2PARTISAN -s'
  83. now=`date +"%H:%M:%S - %d/%m/%y"`
  84. wanif=`nvram get wan_ifname`
  85. lanif=`nvram get lan_ifname`
  86.  
  87.  
  88. psoftstop() {
  89.     ./iptables-del 2> /dev/null
  90.     plog "Stopping P2Partisan"
  91.     [ -f $pidfile ] && rm -f "$pidfile" 2> /dev/null
  92. }
  93.  
  94. pblock() {
  95.     plog "P2PArtisan: Applying paranoia block"
  96.     iptables -N PARANOIA-DROP 2> /dev/null
  97.    
  98.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  99.         a=1
  100.         b=8
  101.         rounds=`echo $(( $whiteports_number / $b ))`
  102.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  103.     while [ $rounds -gt 0 ]
  104.     do
  105.         w=`echo $whiteports | cut -d"," -f $a-$b`
  106.         a=`echo $(( $a + $b ))`
  107.         b=`echo $(( $b + $b ))`
  108. whitep="${whitep}iptables -A PARANOIA-DROP -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  109. iptables -A PARANOIA-DROP -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  110. iptables -A PARANOIA-DROP -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  111. iptables -A PARANOIA-DROP -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  112. "
  113.     rounds=`echo $(( $rounds - 1 ))`
  114.     done
  115.  
  116.     iptables -A PARANOIA-DROP -m limit --limit $maxloghour/hour --limit-burst 5 -j LOG --log-prefix "P2Partisan Rejected (paranoia): " --log-level 1 2> /dev/null
  117.     iptables -A PARANOIA-DROP -j DROP
  118.     iptables -I wanin 1 -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  119.     iptables -I wanout 1 -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  120.     iptables -I INPUT 1 -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  121.     iptables -I OUTPUT 1 -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  122. }
  123.  
  124. punblock() {
  125.     while iptables -L wanin 2> /dev/null | grep "PARANOIA-DROP"
  126.     do
  127.         iptables -D wanin -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  128.     done
  129.     while iptables -L wanout 2> /dev/null | grep "PARANOIA-DROP"
  130.     do
  131.         iptables -D wanout -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  132.     done
  133.     while iptables -L OUTPUT 2> /dev/null | grep "PARANOIA-DROP"
  134.     do
  135.         iptables -D OUTPUT -o $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  136.     done
  137.     while iptables -L INPUT 2> /dev/null | grep "PARANOIA-DROP"
  138.     do
  139.         iptables -D INPUT -i $wanif -m state --state NEW -j PARANOIA-DROP 2> /dev/null
  140.     done
  141.     iptables -F PARANOIA-DROP 2> /dev/null && plog "P2PArtisan: Removing paranoia block"
  142.     iptables -X PARANOIA-DROP 2> /dev/null
  143. }
  144.  
  145. pforcestop() {
  146.     while iptables -L wanin 2> /dev/null | grep P2PARTISAN-IN
  147.     do
  148.         iptables -D wanin -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  149.     done
  150.     while iptables -L wanout 2> /dev/null | grep P2PARTISAN-OUT
  151.     do
  152.         iptables -D wanout -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  153.     done
  154.     while iptables -L INPUT | grep P2PARTISAN-IN
  155.     do
  156.         iptables -D INPUT -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  157.     done
  158.     while iptables -L INPUT | grep P2PARTISAN-OUT
  159.     do
  160.         iptables -D INPUT -i $lanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  161.     done
  162.     while iptables -L OUTPUT | grep P2PARTISAN-OUT
  163.     do
  164.         iptables -D OUTPUT -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  165.     done
  166.     iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  167.     iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  168.     iptables -F P2PARTISAN-IN 2> /dev/null
  169.     iptables -F P2PARTISAN-OUT 2> /dev/null
  170.     iptables -X P2PARTISAN-DROP-IN 2> /dev/null
  171.     iptables -X P2PARTISAN-DROP-OUT 2> /dev/null   
  172.     iptables -X P2PARTISAN-IN 2> /dev/null
  173.     iptables -X P2PARTISAN-OUT 2> /dev/null
  174.     ipset -F
  175.     for i in `ipset --list | grep Name | cut -f2 -d ":" `; do
  176.         ipset -X $i
  177.     done
  178.     chmod 777 ./*.gz
  179.     [ -f iptables-add ] && rm iptables-add
  180.     [ -f iptables-del ] && rm iptables-del
  181.     [ -f ipset-del ] && rm ipset-del
  182.     [ -f $pidfile ] && rm -f "$pidfile" 2> /dev/null
  183. plog "Unloading ipset modules"
  184.     lsmod | grep "ipt_set" > /dev/null 2>&1 && sleep 2 ; rmmod -f ipt_set 2> /dev/null
  185.     lsmod | grep "ip_set_iptreemap" > /dev/null 2>&1 && sleep 2 ; rmmod -f ip_set_iptreemap 2> /dev/null
  186.     lsmod | grep "ip_set" > /dev/null 2>&1 && sleep 2 ; rmmod -f ip_set 2> /dev/null
  187. plog "Stopping P2Partisan"
  188. }
  189.  
  190. pstatus() {
  191.     running3=`iptables -L INPUT | grep P2PARTISAN-IN  2> /dev/null | wc -l`
  192.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  193.     running5=`nvram get script_fire | grep p2partisan >/dev/null && echo Yes || echo No`
  194.     running6=`cru l | grep P2Partisan-update >/dev/null && echo Yes || echo No`
  195.     running7=`tail -200 /var/log/messages | grep Rejected | tail -1`
  196.     running9=`nvram get script_fire | grep "p2partisan.sh tutor" >/dev/null && echo Yes || echo No`
  197.     runningA=`cat /var/log/messages | grep "Applying paranoia" | wc -l`
  198.     runningB=`cat /var/log/messages | grep "Stuck on Loading" | wc -l`
  199.     runningC=`cat blacklists | grep -v "^#" | grep -v "^$" | wc -l`
  200.     runningD=`cat ./runtime`
  201.    
  202.     from=`head -1 ./iptables-add 2> /dev/null | cut -c3-`
  203.     drop_packet_count_in=`iptables -vL P2PARTISAN-DROP-IN 2> /dev/null| grep " DROP " | awk '{print $1}'`
  204.     drop_packet_count_out=`iptables -vL P2PARTISAN-DROP-OUT 2> /dev/null| grep " REJECT " | awk '{print $1}'`
  205.    
  206.    
  207.     if [[ $running3 -eq "0" ]] && [[ $running4 -eq "0" ]]; then
  208.         running8=No
  209.     elif [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  210.         running8=Loading...
  211.     elif [[ $running3 -gt "0" ]] && [[ $running4 -eq "0" ]]; then
  212.         running8=Not quite... try to run \"p2partisan.sh update\"
  213.     else
  214.         running8=Yes
  215.     fi
  216.    
  217.     echo "################### P2Partisan ##########################
  218. #   Release version: $version
  219. ################# P2Partisan status #####################
  220. #   P2Partisan running:   $running8
  221. #   P2Partisan autorun:   $running5
  222. #   P2Partisan scheduled: $running6 / $runningA since boot
  223. #   P2Partisan tutor:     $running9 / $runningB since boot
  224. #########################################################
  225. #   Blacklists enabled:   $runningC
  226. #   Startup time needed:  $runningD seconds
  227. #########################################################
  228. #   P2Partisan activity since: $from
  229. #   Dropped connections inbound: $drop_packet_count_in
  230. #   Rejected connections outbound: $drop_packet_count_out"
  231.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  232.         a=1
  233.         b=8
  234.         rounds=`echo $(( $whiteports_number / $b ))`
  235.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  236.     while [ $rounds -gt 0 ]
  237.     do
  238.         w=`echo $whiteports | cut -d"," -f $a-$b`
  239.         a=`echo $(( $a + $b ))`
  240.         b=`echo $(( $b + $b ))`
  241.     echo "# Whitelisted ports: $w"
  242.         rounds=`echo $(( $rounds - 1 ))`
  243.     done
  244. echo "################# Last log recorded #####################
  245. #   Remember your max logs per hour is set to: $maxloghour
  246. $running7
  247. #########################################################"
  248. }
  249.  
  250. if [ $autorun_availability_check = 1 ]; then
  251. av="while true; do [ -f $P2Partisandir/p2partisan.sh ] && break || sleep 5; done ;"
  252. fi
  253.  
  254. pautorunset() {
  255.     p=`nvram get script_fire | grep "p2partisan.sh" | grep -v cru | wc -l`
  256.     if [ $p -eq "0" ] ; then
  257.         t=`nvram get script_fire`; t=`printf "$t\n$av$P2Partisandir/p2partisan.sh\n"` ; nvram set "script_fire=$t"
  258.     fi
  259.     plog "P2Partisan AUTO RUN is ON"
  260.     nvram commit
  261. }
  262.  
  263. pautorununset() {
  264.     p=`nvram get script_fire | grep "p2partisan.sh" | grep -v cru | wc -l`
  265.     if [ $p -eq "1" ]; then
  266.     t=`nvram get script_fire`; t=`printf "$t\n$P2Partisandir/p2partisan.sh\n" | grep -v p2partisan` ; nvram set "script_fire=$t"
  267.     fi
  268.     plog "P2Partisan AUTO RUN is OFF"
  269.     nvram commit
  270. }
  271.  
  272. pscheduleset() {
  273.     cru d P2Partisan-update
  274.     ab=`tr -cd 0-5 </dev/urandom | head -c 1`
  275.     a=`tr -cd 0-9 </dev/urandom | head -c 1`
  276.     a=`echo $ab$a`
  277.     b=`tr -cd 1-5 </dev/urandom | head -c 1`
  278.     c=`tr -cd 0-6 </dev/urandom | head -c 1`
  279.     scheduleme=`echo "$schedule" | tr "m" "$a"`
  280.     scheduleme=`echo "$schedule" | tr "h" "$b"`
  281.     scheduleme=`echo "$schedule" | tr "d" "$c"`
  282.     cru a P2Partisan-update "$scheduleme $P2Partisandir/p2partisan.sh paranoia-update"
  283.     pp=`nvram get script_fire | grep "p2partisan.sh paranoia-update" | grep -v cru | wc -l`
  284.     p=`nvram get script_fire | grep "cru a P2Partisan-update" | wc -l`
  285.     if [ $p -eq "0" ] ; then
  286.         if [ $pp -eq "0" ]; then
  287.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$scheduleme $P2Partisandir/p2partisan.sh paranoia-update\"\n"` ; nvram set "script_fire=$t"
  288.         else
  289.         pautorununset
  290.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$scheduleme $P2Partisandir/p2partisan.sh paranoia-update\"\n"` ; nvram set "script_fire=$t"
  291.         pautorunset
  292.         fi
  293.     fi
  294.     plog "P2Partisan AUTO UPDATE is ON"
  295.     nvram commit
  296. }
  297.  
  298. pscheduleunset() {
  299.     cru d P2Partisan-update
  300.     p=`nvram get script_fire | grep "cru a P2Partisan-update" | wc -l`
  301.     if [ $p -eq "1" ] ; then
  302.     t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-update \"$schedule $P2Partisandir/p2partisan.sh paranoia-update\"\n" | grep -v "cru a P2Partisan-update"` ; nvram set "script_fire=$t"
  303.     fi
  304.     plog "P2Partisan AUTO UPDATE is OFF"
  305.     nvram commit
  306. }
  307.  
  308. pupgrade() {
  309.     wget -q -O - http://pastebin.com/raw.php?i=jqHD3hfT | grep "p2partisan v" | grep -v grep> ./latest
  310.     latest=`cat ./latest | cut -c3-31`
  311.     current=`cat ./p2partisan.sh | grep "p2partisan v" | head -1 | cut -c3-32 `
  312.     if [ "$latest" == "$current" ]; then
  313.     echo "
  314. You're already running the latest version of P2Partisan
  315. "
  316.     else
  317.     echo "
  318. There's a new P2Partisan update available. Do you want to upgrade?
  319.    
  320.             current = $current
  321.    
  322.                     to
  323.            
  324.              latest = $latest
  325.  
  326. y/n"
  327.     read answer
  328.     # echo "You entered: $input_variable"
  329.         if [ $answer == "y" ]; then
  330.         echo "Upgrading, please wait:"
  331.         echo "1/6) Downloading the script"
  332.         wget -q -O ./p2partisan_new.sh http://pastebin.com/raw.php?i=jqHD3hfT
  333.         echo "2/6) Migrating the configuration"
  334.         sed '1,/P2Partisandir/{s@P2Partisandir=.*@'"P2Partisandir=$P2Partisandir"'@'} -i ./p2partisan_new.sh
  335.         sed '1,/syslogs/{s@syslogs=.*@'"syslogs=$syslogs"'@'} -i ./p2partisan_new.sh
  336.         sed '1,/maxloghour/{s@maxloghour=.*@'"maxloghour=$maxloghour"'@'} -i ./p2partisan_new.sh
  337.         sed '1,/protection/{s@protection=.*@'"protection=$protection"'@'} -i ./p2partisan_new.sh
  338.         sed '1,/whiteports/{s@whiteports=.*@'"whiteports=$whiteports"'@'} -i ./p2partisan_new.sh
  339.         sed '1,/fastroutine/{s@fastroutine=.*@'"fastroutine=$fastroutine"'@'} -i ./p2partisan_new.sh
  340.         sed '1,/autorun_availability_check/{s@autorun_availability_check=.*@'"autorun_availability_check=$autorun_availability_check"'@'} -i ./p2partisan_new.sh
  341.         sed '1,/schedule/{s@schedule=.*@'"schedule=\"$schedule\""'@'} -i ./p2partisan_new.sh
  342.         sed '1,/testip/{s@testip=.*@'"testip=$testip"'@'} -i ./p2partisan_new.sh       
  343.         tr -d "\r"< ./p2partisan_new.sh > ./.temp ; mv ./.temp ./p2partisan_new.sh
  344.         echo "3/6) Copying p2partisan.sh into p2partisan.sh.old"
  345.         cp ./p2partisan.sh ./p2partisan_old
  346.         echo "4/6) Installing new script into p2partisan.sh"
  347.         mv ./p2partisan_new.sh ./p2partisan.sh
  348.         echo "5/6) Setting up permissions"
  349.         chmod -R 777 ./p2partisan.sh
  350.         echo "6/6) all done, I'm now running the script for you.
  351. NOTE: autorun, autoupdate and tutor settings are left as they were found
  352. "
  353.         pforcestop
  354.         else
  355.         echo "Upgrade skipped. Quitting..."
  356.         exit
  357.         fi
  358.    
  359.     fi
  360.  }
  361.  
  362. ptutor() {
  363.     running3=`iptables -L INPUT | grep P2PARTISAN-IN  2> /dev/null | wc -l`
  364.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  365.     if [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  366.             plog "P2Partisan appears to be loading, I'll wait 5 minutes..."    
  367.             sleep 300
  368.         if [[ $running3 -eq "0" ]] && [[ $running4 -eq "1" ]]; then
  369.             psoftstop
  370.             plog "P2Partisan tutor had to restart due to Stuck on Loading"
  371.             pstart
  372.         fi
  373.     else
  374.     echo "P2Partisan up and running. The tutor is happy"
  375.     fi
  376.  }
  377.  
  378. ptutorset() {
  379.     cru d P2Partisan-tutor
  380.     ab=`tr -cd 0-5 </dev/urandom | head -c 1`
  381.     a=`tr -cd 0-9 </dev/urandom | head -c 1`
  382.     a=`echo $ab$a`
  383.     scheduleme=`echo "$a * * * *"`
  384.     cru a P2Partisan-tutor "$scheduleme $P2Partisandir/p2partisan.sh tutor"
  385.     pp=`nvram get script_fire | grep "p2partisan.sh tutor" | grep -v cru | wc -l`
  386.     p=`nvram get script_fire | grep "cru a P2Partisan-tutor" | wc -l`
  387.     if [ $p -eq "0" ] ; then
  388.         if [ $pp -eq "0" ]; then
  389.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$scheduleme $P2Partisandir/p2partisan.sh tutor\"\n"` ; nvram set "script_fire=$t"
  390.         else
  391.         t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$scheduleme $P2Partisandir/p2partisan.sh tutor\"\n"` ; nvram set "script_fire=$t"
  392.         fi
  393.     fi
  394.     plog "P2Partisan tutor is ON"
  395.     nvram commit
  396. }
  397.  
  398. ptutorunset() {
  399.     cru d P2Partisan-tutor
  400.     p=`nvram get script_fire | grep "cru a P2Partisan-tutor" | wc -l`
  401.     if [ $p -eq "1" ] ; then
  402.     t=`nvram get script_fire`; t=`printf "$t\ncru a P2Partisan-tutor \"$schedule $P2Partisandir/p2partisan.sh tutor\"\n" | grep -v "cru a P2Partisan-tutor"` ; nvram set "script_fire=$t"
  403.     fi
  404.     plog "P2Partisan tutor is OFF"
  405.     nvram commit
  406.  }
  407.  
  408. pstart() {
  409.     running4=`[ -f $pidfile ] && echo 1 || echo 0`
  410.     if [ $running4 -eq "0" ] ; then
  411.  
  412.     /bin/ntpsync > /dev/null 2>&1
  413.     pre=`date +%s`
  414.     sleep 2
  415.  
  416.     echo $$ > $pidfile
  417.    
  418.     [ -f iptables-add ] && rm iptables-add
  419.     [ -f iptables-del ] && rm iptables-del
  420.     [ -f ipset-del ] && rm ipset-del
  421.      
  422.     echo "### PREPARATION ###"
  423.     echo "Loading the ipset modules"
  424.     lsmod | cut -c1-20 | grep "ip_set " > /dev/null 2>&1 || insmod ip_set
  425.     lsmod | cut -c1-20 | grep "ip_set_iptreemap" > /dev/null 2>&1 || insmod ip_set_iptreemap
  426.     lsmod | cut -c1-20 | grep "ipt_set" > /dev/null 2>&1 || insmod ipt_set
  427.  
  428. counter=0
  429. pos=1
  430. couscous=`cat blacklist-custom | grep -v "^#" | grep -v "^$" | wc -l`
  431.  
  432.         echo "### CUSTOM BLACKLIST ###
  433. blacklist-custom file -> $couscous entries found"
  434.  if [ $couscous -eq "0" ]; then
  435.         echo "No custom blacklist entries found: skipping"
  436.  else
  437.         echo "loading blacklist #$counter --> ***Custom IP blacklist***"
  438.         ipset --create blacklist-custom iptreemap
  439.         if [ -e blacklist-custom ]; then
  440.         for IP in `cat blacklist-custom | grep -v "^#" | grep -v "^$" | cut -d: -f2`
  441.             do
  442.                 ipset -A blacklist-custom $IP
  443.             done
  444.         fi
  445. fi
  446.    
  447. echo "### WHITELIST ###"
  448.        
  449.     whiteports_number=`echo $whiteports | tr -d '\n' | sed 's/,/,\n/g' | sed 's/:/:\n/g' | wc -l`
  450.         a=1
  451.         b=8
  452.         rounds=`echo $(( $whiteports_number / $b ))`
  453.         if [ $rounds -eq 0 ]; then rounds="1"; fi
  454.     while [ $rounds -gt 0 ]
  455.     do
  456.         w=`echo $whiteports | cut -d"," -f $a-$b`
  457.         a=`echo $(( $a + $b ))`
  458.         b=`echo $(( $b + $b ))`
  459.     echo "loading whitelisted ports $w exemption"
  460. whitep="${whitep}iptables -A P2PARTISAN-IN -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  461. iptables -A P2PARTISAN-IN -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  462. iptables -A P2PARTISAN-IN -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  463. iptables -A P2PARTISAN-IN -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  464. iptables -A P2PARTISAN-OUT -p tcp --match multiport --sports $w -j ACCEPT 2> /dev/null
  465. iptables -A P2PARTISAN-OUT -p udp --match multiport --sports $w -j ACCEPT 2> /dev/null
  466. iptables -A P2PARTISAN-OUT -p tcp --match multiport --dports $w -j ACCEPT 2> /dev/null
  467. iptables -A P2PARTISAN-OUT -p udp --match multiport --dports $w -j ACCEPT 2> /dev/null
  468. "
  469.     rounds=`echo $(( $rounds - 1 ))`
  470.     done
  471.  
  472.  
  473.         echo "# $now
  474. iptables -N P2PARTISAN-IN 2> /dev/null
  475. iptables -N P2PARTISAN-OUT 2> /dev/null
  476. iptables -N P2PARTISAN-DROP-IN 2> /dev/null
  477. iptables -N P2PARTISAN-DROP-OUT 2> /dev/null
  478. iptables -F P2PARTISAN-IN 2> /dev/null
  479. iptables -F P2PARTISAN-OUT 2> /dev/null
  480. iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  481. iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  482. iptables -A P2PARTISAN-IN -m set --set blacklist-custom src -j P2PARTISAN-DROP-IN 2> /dev/null
  483. iptables -A P2PARTISAN-OUT -m set --set blacklist-custom src -j P2PARTISAN-DROP-OUT 2> /dev/null
  484. $whitep" >> iptables-add
  485.  
  486.  
  487.         echo "# $now
  488. iptables -D wanin -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  489. iptables -D wanout -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  490. iptables -D INPUT -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  491. iptables -D INPUT -i $lanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  492. iptables -D OUTPUT -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  493. iptables -F P2PARTISAN-DROP-IN 2> /dev/null
  494. iptables -F P2PARTISAN-DROP-OUT 2> /dev/null
  495. iptables -F P2PARTISAN-IN 2> /dev/null
  496. iptables -F P2PARTISAN-OUT 2> /dev/null
  497. iptables -X P2PARTISAN-IN 2> /dev/null
  498. iptables -X P2PARTISAN-OUT 2> /dev/null
  499. iptables -X P2PARTISAN-DROP-IN 2> /dev/null
  500. iptables -X P2PARTISAN-DROP-OUT 2> /dev/null" >> iptables-del
  501.  
  502.  
  503. echo "preparing the IP whitelist for the iptables"
  504. #Load the whitelist
  505. if [ "$(ipset --swap whitelist whitelist 2>&1 | grep 'Unknown set')" != "" ]
  506.     then
  507.     ipset --create whitelist iptreemap
  508.     cat whitelist | grep -v "^10." | grep -v "^172.16." | grep -v "^192.168." |
  509.     (
  510.     while read IP
  511.     do
  512.             echo "$IP" | grep "^#" >/dev/null 2>&1 && continue
  513.             echo "$IP" | grep "^$" >/dev/null 2>&1 && continue
  514.                     ipset -A whitelist $IP
  515.             done
  516.     )
  517. fi
  518.         echo "# $now
  519. ipset -F
  520. ipset -X blacklist-custom
  521. ipset -X whitelist" > ipset-del
  522.  
  523.             echo "loading the IP whitelist"
  524.             echo "iptables -A P2PARTISAN-IN -m set --set whitelist src -j ACCEPT 2> /dev/null
  525. iptables -A P2PARTISAN-OUT -m set --set whitelist dst -j ACCEPT 2> /dev/null" >> iptables-add
  526.  
  527.         if [ $syslogs -eq "1" ]; then        
  528.             echo "iptables -A P2PARTISAN-DROP-IN -m limit --limit $maxloghour/hour --limit-burst 1 -j LOG --log-prefix \"P2Partisan Dropped: \" --log-level 1 2> /dev/null" >> iptables-add
  529.             echo "iptables -A P2PARTISAN-DROP-OUT -m limit --limit $maxloghour/hour --limit-burst 1 -j LOG --log-prefix \"P2Partisan Rejected: \" --log-level 1 2> /dev/null" >> iptables-add
  530.        
  531.         fi
  532.         echo "iptables -A P2PARTISAN-DROP-IN -j DROP"  >> iptables-add
  533.         echo "iptables -A P2PARTISAN-DROP-OUT -j REJECT --reject-with icmp-admin-prohibited"  >> iptables-add
  534.  
  535.  
  536. echo "### BLACKLISTs ###"
  537.    
  538.     cat blacklists |
  539.    (
  540.     while read line
  541.     do
  542.             echo "$line" | grep "^#" >/dev/null 2>&1 && continue
  543.             echo "$line" | grep "^$" >/dev/null 2>&1 && continue
  544.             counter=`expr $counter + 1`
  545.             name=`echo $line |cut -d ' ' -f1`
  546.             url=`echo $line |cut -d ' ' -f2`
  547.             echo "loading blacklist #$counter --> ***$name***"
  548.      
  549.     if [ $fastroutine -eq "1" ]; then
  550.      
  551.      if [ "$(ipset --swap $name $name 2>&1 | grep 'Unknown set')" != "" ]
  552.       then
  553.           [ -f ./runtime ] && rm -f ./runtime 2> /dev/null
  554.           [ -e $name.gz ] || wget -q -O $name.gz "$url"
  555.           { echo "-N $name iptreemap"
  556.             gunzip -c  $name.gz | \
  557.             sed -e "/^[\t ]*#.*\|^[\t ]*$/d;s/^.*:/-A $name /"
  558.             echo COMMIT
  559.           } | ipset -R
  560.      fi
  561.     else
  562.      
  563.         if [ "$(ipset --swap $name $name 2>&1 | grep 'Unknown set')" != "" ]
  564.             then
  565.             [ -f ./runtime ] && rm -f ./runtime 2> /dev/null
  566.             ipset --create $name iptreemap
  567.             [ -e $name.lst ] || wget -q -O - "$url" | gunzip | cut -d: -f2 | grep -E "^[-0-9.]+$" > $name.lst
  568.             for IP in $(cat $name.lst)
  569.                     do
  570.                     ipset -A $name $IP
  571.                     done
  572.             fi
  573.              
  574.     fi
  575.  
  576.                 echo "ipset -X $name " >> ipset-del
  577.                 echo "iptables -A P2PARTISAN-IN -m set --set $name src -j P2PARTISAN-DROP-IN 2> /dev/null
  578. iptables -A P2PARTISAN-OUT -m set --set $name dst -j P2PARTISAN-DROP-OUT 2> /dev/null" >> iptables-add 
  579.             done
  580.     )
  581.  
  582.  
  583.         if [ $protection -eq "1" ]; then
  584.             echo "iptables -I INPUT $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  585. iptables -I OUTPUT $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null" >> iptables-add
  586.         elif [ $protection -eq "2" ]; then
  587.             echo "iptables -I wanin $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  588. iptables -I wanout $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  589. iptables -I INPUT $pos -i $lanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null" >> iptables-add
  590.         elif [ $protection -eq "3" ]; then
  591.             echo "iptables -I INPUT $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  592. iptables -I INPUT $pos -i $lanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  593. iptables -I OUTPUT $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null
  594. iptables -I wanin $pos -i $wanif -m state --state NEW -j P2PARTISAN-IN 2> /dev/null
  595. iptables -I wanout $pos -o $wanif -m state --state NEW -j P2PARTISAN-OUT 2> /dev/null" >> iptables-add
  596.  
  597.         fi
  598.  
  599. chmod 777 ./iptables-*
  600. chmod 777 ./ipset-*
  601. ./iptables-add  #protecting
  602.  
  603. plog "... P2Partisan started."
  604.  
  605. p=`nvram get dnsmasq_custom | grep log-async | wc -l`
  606. if [ $p -eq "1" ]; then
  607.     plog "log-async found under dnsmasq -> OK"
  608. else
  609.     plog "
  610. It appears like you don't have a log-async parameter
  611. in your dnsmasq config. This is strongly suggested
  612. due to the amount of logs involved. please consider
  613. adding the following command under Advanced/DHCP/DNS
  614. /Dnsmasq Custom configuration
  615.  
  616. log-async=10
  617. "
  618. fi
  619.  
  620. punblock  #remove paranoia DROPs if any
  621.  
  622.     post=`date +%s`
  623.     runtime=`echo $(( $post - $pre ))`
  624.     [ -f ./runtime ] || echo $runtime > ./runtime
  625.     else
  626.         echo "
  627.     It appears like P2Partisan is already running. Skipping...
  628.            
  629.     If this is not what you expected? Try:
  630.     p2partisan.sh update
  631.         "
  632.     fi
  633. }
  634.  
  635.  
  636. for p in $1
  637. do
  638. case "$p" in
  639.         "start")
  640.                 pstart
  641.                 exit
  642.                 ;;     
  643.         "stop")
  644.                 pforcestop
  645.                 exit
  646.                 ;;
  647.         "restart")
  648.                 pscheduleunset
  649.                 psoftstop
  650.                 pscheduleset
  651.                 ;;
  652.         "status")
  653.                 pstatus
  654.                 exit               
  655.                 ;;     
  656.         "update")
  657.                 pforcestop
  658.                 ;;
  659.         "paranoia-update")
  660.                 pblock
  661.                 pforcestop
  662.                 ;;
  663.         "autorun-on")
  664.                 pautorunset
  665.                 exit
  666.                 ;;
  667.         "autorun-off")
  668.                 pautorununset
  669.                 exit
  670.                 ;;
  671.         "autoupdate-on")
  672.                 pscheduleset
  673.                 exit
  674.                 ;;
  675.         "autoupdate-off")
  676.                 pscheduleunset
  677.                 exit
  678.                 ;;
  679.         "tutor-on")
  680.                 ptutorset
  681.                 exit
  682.                 ;;
  683.         "tutor-off")
  684.                 ptutorunset
  685.                 exit
  686.                 ;;
  687.         "tutor")
  688.                 ptutor
  689.                 exit
  690.                 ;;
  691.         "upgrade")
  692.                 pupgrade
  693.                 ;;
  694.         "help")
  695.                 echo " 
  696.     P2Partisan parameters:
  697.        
  698.     help            Display this text      
  699.     start           Starts the process (this runs also if no option
  700.                 is provided)
  701.     stop            Stops P2Partisan
  702.     restart         Soft restart, quick, updates iptables only
  703.     update          Hard restart, slow removes p2partisan, updates
  704.                 the lists and does a fresh start
  705.     paranoia-update     Like update but blocks any new connection until
  706.                 P2Partisan is running again
  707.     status          Display P2Partisan running status + extra info
  708.     autorun-on      Sets P2Partisan to boot with the router
  709.     autorun-off     Sets P2Partisan not to boot with the router
  710.     autoupdate-on       Sets automatic updates on
  711.     autoupdate-off      Sets automatic updates off
  712.     tutor-on        Schedule tutor check every hour
  713.     tutor-off       Unset the tutor schedule
  714.     upgrade         Download and install the latest P2Partisan
  715. "
  716.                 exit
  717.                 ;;
  718.         *)
  719.                 echo "parameter not valid. please run:
  720.                
  721.     p2partisan.sh help
  722.     "
  723.                 exit
  724.             ;;
  725.  
  726. esac
  727. done
  728.  
  729. pstart
  730.  
  731. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!