🌴 Sync 2026-03-05 23:51:42

luci-app-ttl/Makefile

@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2008-2014 The LuCI Team <luci@lists.subsignal.org>
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=Antitethering module for luci-app-firewall
+#LUCI_DEPENDS:= +luci-app-firewall
+
+PKG_LICENSE:=Apache-2.0
+PKG_VERSION:=0.0.5
+PKG_RELEASE:=1
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature

luci-app-ttl/htdocs/luci-static/resources/view/firewall/ttl.js

@@ -0,0 +1,77 @@
+'use strict';
+'require view';
+'require ui';
+'require rpc';
+'require uci';
+'require form';
+'require fs';
+'require network';
+'require firewall as fwmodel';
+'require tools.firewall as fwtool';
+'require tools.widgets as widgets';
+
+var briefInfo = _('In Method proxy Proxy server must be configured in transparent mode.<br />Default on lan ipaddress interface and port 3128 tcp.<br />Disable masquerade recommended.');
+
+return view.extend({
+
+	render: function() {
+		var m, s, o;
+
+		m = new form.Map('ttl', _('Antitethering Config'),
+			briefInfo);
+
+		s = m.section(form.TypedSection, 'ttl');
+		s.anonymous = true;
+
+		s = m.section(form.TypedSection, 'ttl', _('TTL or Proxy'));
+		s.anonymous = true;
+		s.addremove = true;
+
+		o = s.option(widgets.NetworkSelect, 'iface', _('Set interface'));
+		o.exclude = s.section;
+		o.nocreate = true;
+		o.optional = true;
+
+		o = s.option(form.ListValue, 'method', _('Method'),
+			_('TTL method outgoing interface<br />Proxy method incoming interface'));
+		o.value('ttl', 'TTL');
+		o.value('proxy', 'Proxy');
+
+		o = s.option(form.Flag, 'advanced', _('Advanced Option'));
+		o.default = '0';
+		o.rmempty = false;
+
+		o = s.option(form.ListValue, 'inet', _('Inet Family'));
+		o.value('ipv4', 'IPv4');
+		o.value('ipv6', 'IPv6');
+		o.value('ipv4v6', _('Both'));
+		o.rmempty = true;
+		o.editable = true;
+		o.depends('advanced', '1');
+
+		o = s.option(form.Value, 'ttl', _('TTL Value'),
+			_('Select TTL value. Range 1 - 255'));
+		o.value('64','64')
+		o.value('128','128')
+		o.default = '64';
+		o.rmempty = true;
+		o.editable = true;
+		o.depends({advanced: '1', method: /ttl/});
+
+		o = s.option(form.Value, 'ports', _('Ports'),
+			_('Incoming ports route to proxy-server<br />Custom ports range: 0-65535'));
+		o.editable = true;
+		o.rmempty = true;
+		o.value('all', _('ALL Ports'));
+		o.value('http', _('HTTP Ports'));
+		o.default = 'all';
+		o.depends({advanced: '1', method: /proxy/})
+
+		o = s.option(form.Value, 'proxy', _('Proxy Server Address'),
+                        _('IP-address proxy<br/>Format: <code>ipaddress:port</code><br />If not defined: use selected interface address.<br />Default: <code>lan</code> interface ipaddress'));
+                o.datatype = 'ipaddrport';
+                o.depends({advanced: '1', method: /proxy/})
+
+		return m.render();
+	},
+});

luci-app-ttl/po/ru/ttl.po

@@ -0,0 +1,56 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8"
+
+"Language: ru\n"
+"Last-Translator: Konstantine Shevlakov <shevlakov@132lan.ru\n"
+
+msgid "'In Method proxy Proxy server must be configured in transparent mode.<br />Default on lan ipaddress interface and port 3128 tcp.<br />Disable masquerade recommended.'"
+msgstr "В режиме прокси, прокси-сервер должен быть настроен в прозрачном режиме.<br />По-умолчанию прокси-сервер ожидается на адресе lan-интерфейса на порту 3128 tcp.<br />Рекомендуется отключить NAT."
+
+msgid "Antitethering Config"
+msgstr "Настройки антитетеринга"
+
+msgid "TTL or Proxy antitether"
+msgstr "TTL или прокси"
+
+msgid "Set interface"
+msgstr "Выбор интерфейса"
+
+msgid "Method"
+msgstr "Способ"
+
+msgid "TTL method outgoing interface<br />Proxy method incoming interface"
+msgstr "Для метода TTL интерфейс - исходящий<br />Для метода прокси интерфейс - входящий"
+
+msgid "Inet Family"
+msgstr "Протокол IP"
+
+msgid "Advanced Option"
+msgstr "Дополнительно" 
+
+msgid "Both"
+msgstr "Оба"
+
+msgid "Ports"
+msgstr "Порты"
+
+msgid "TTL Value"
+msgstr "Значение TTL"
+
+msgid "Select TTL value. Range 1 - 255"
+msgstr "Выбор значения TTL. От 1 до 255"
+
+msgid "Incoming ports route to proxy-server<br />Custom ports range: 0-65535"
+msgstr "Порты для перенаправления на прокси-сервер<br />Диапазон 0-65535"
+
+msgid "ALL Ports"
+msgstr "Все порты"
+
+msgid "HTTP Ports"
+msgstr "Порты HTTP"
+
+msgid "Proxy Server Address"
+msgstr "Адрес прокси-сервера"
+
+msgid "IP-address proxy<br/>Format: <code>ipaddress:port</code><br />If not defined: use selected interface address.<br />Default: <code>lan</code> interface ipaddress"
+msgstr "IP-адрес прокси<br />Формат: <code>ip-адрес:порт</code><br />Если не задано: используется адрес выбранного интерфейса.<br />По-умолчанию: адрес интерфейса <code>lan</code>"

luci-app-ttl/root/etc/hotplug.d/iface/90-ttl

@@ -0,0 +1,18 @@
+. /lib/functions.sh
+
+handle_config(){
+	config_get iface "$1" iface
+	[ "$iface" = "$INTERFACE" ] && {
+		run_ttl=1
+	}
+}
+
+config_load ttl
+config_foreach handle_config ttl
+
+case $run_ttl in
+	1) /etc/init.d/ttl reload ;;
+esac
+
+exit 0
+

luci-app-ttl/root/etc/init.d/ttl

@@ -0,0 +1,17 @@
+#!/bin/sh /etc/rc.common
+
+START=96
+USE_PROCD=1
+
+start_service(){
+	/usr/share/ttl.sh
+	logger -t "TTL" "TTL reload"
+}
+
+reload_service(){
+	sleep 10 && start &
+}
+
+service_triggers() {
+	procd_add_reload_trigger ttl
+}

luci-app-ttl/root/usr/share/luci/menu.d/luci-app-ttl.json

@@ -0,0 +1,24 @@
+{
+	"admin/network/firewall": {
+		"title": "Firewall",
+		"order": 60,
+		"action": {
+			"type": "alias",
+			"path": "admin/network/firewall/zones"
+		},
+		"depends": {
+			"acl": [ "luci-app-firewall" ],
+			"fs": { "/sbin/fw3": "executable" },
+			"uci": { "firewall": true }
+		}
+	},
+
+	"admin/network/firewall/ttl": {
+		"title": "TTL",
+		"order": 45,
+		"action": {
+			"type": "view",
+			"path": "firewall/ttl"
+		}
+	}
+}

luci-app-ttl/root/usr/share/rpcd/acl.d/luci-app-ttl.json

@@ -0,0 +1,25 @@
+{
+	"luci-app-ttl": {
+		"description": "Grant access to TTL configuration",
+		"read": {
+			"file": {
+				"/etc/init.d/ttl": [ "exec" ],
+				"/etc/init.d/firewall": [ "exec" ]
+			},
+			"cgi-io": [ "exec" ],
+			"ubus": {
+				"file": [ "exec" ],
+				"uci": [ "changes", "get" ]
+			},
+			"uci": [ "ttl" ]
+		},
+		"write": {
+			"cgi-io": [ "exec" ],
+			"ubus": {
+				"file": [ "exec" ],
+				"uci": [ "add", "apply", "confirm", "delete", "order", "rename", "set" ]
+			},
+			"uci": [ "ttl" ]
+		}
+	}
+}

luci-app-ttl/root/usr/share/ttl.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+
+SECTIONS=$(echo $(uci show ttl | awk -F [\]\[\@=] '/=ttl/{print $3}'))
+
+get_vars(){
+	for v in method advanced inet ports ttl iface proxy; do
+		eval $v=$(uci -q get ttl.@ttl[${s}].${v} 2>/dev/nul)
+	done
+}
+
+
+# check iptables or nft 
+#
+if [ -x /usr/sbin/iptables -o /usr/sbin/ip6tables -a ! -x /usr/sbin/nft ]; then
+	. /usr/share/ttlipt.sh
+else
+	. /usr/share/ttlnft.sh
+fi

luci-app-ttl/root/usr/share/ttlipt.sh

@@ -0,0 +1,152 @@
+method_ttl(){
+
+	ttl=${ttl:=64}
+
+	#case $(($ttl % 2)) in
+	#	0) TTL_INC=$(($ttl-1)) ;;
+	#	*) TTL_INC=$ttl ;;
+	#esac
+	TTL_INC=$(($ttl-1))
+
+	for T in $IPT; do
+		case $T in
+			iptables)
+				SUFFIX="TTL --ttl-set"
+				if [ $iface ]; then
+					$T -t mangle -A TTLFIX -i $DEV -m ttl --ttl 1 -j TTL --ttl-inc $TTL_INC
+				else
+					$T -t mangle -A TTLFIX -m ttl --ttl 1 -j TTL --ttl-inc $TTL_INC
+				fi
+			;;
+			ip6tables)
+				SUFFIX="HL --hl-set"
+				if [ $iface ]; then
+					$T -t mangle -A TTLFIX -i $DEV -m hl --hl 1 -j HL --hl-inc $TTL_INC
+				else
+					$T -t mangle -A TTLFIX -m hl --hl 1 -j HL --hl-inc $TTL_INC
+				fi
+			;;
+		esac
+
+		if [ $iface ]; then
+			$T -t mangle -A TTL_OUT -o $DEV -j $SUFFIX $ttl
+			$T -t mangle -A TTL_POST -o $DEV -j $SUFFIX $ttl
+		else
+			$T -t mangle -A TTL_OUT -j $SUFFIX $ttl
+			$T -t mangle -A TTL_POST -j $SUFFIX $ttl
+		fi
+	done
+}
+
+
+method_proxy(){
+
+	for T in $IPT; do
+		[ "$proxy" ] && {
+			IPADDR=${proxy%:*}
+			case $T in
+				iptables) END=${IPADDR}:${proxy#*:} ;;
+				ip6tables) END="[${IPADDR}]:${proxy#*:}" ;;
+			esac
+	        } || {
+			case $T in
+				iptables)
+					IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv4-address"][*]["address"]')
+					END="${IPADDR}:3128"
+				;;
+				ip6tables)
+					for a in $(ifstatus $ifn | jsonfilter -e '@["ipv6-prefix-assignment"][*]["local-address"]["address"]'); do
+						IPADDR="$a"
+					done
+					END="[$IPADDR]:3128"
+				;;
+			esac
+		}
+
+		$T -t nat -A PROXY -i $DEV -j FIXPROXY
+
+		case $ports in
+			all)
+				$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+					! -s ${IPADDR} -p tcp \
+					-j DNAT --to-destination $END
+			;;
+			http)
+				$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+					! -s ${IPADDR} -p tcp -m multiport \
+					--dports 80,443 -j DNAT --to-destination $END
+			;;
+			*)
+				if [ $ports ]; then
+					$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+						! -s ${IPADDR} -p tcp -m multiport \
+						--dports $ports -j DNAT --to-destination $END
+				else
+					$T -t nat -A FIXPROXY ! -d ${IPADDR} \
+						! -s ${IPADDR} -p tcp \
+						-j DNAT --to-destination $END
+				fi
+			;;
+		esac
+	done
+}
+
+# check nat66 module
+if [ -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+	IPT="iptables ip6tables"
+else
+	IPT="iptables"
+fi
+	
+# Create and flush mangle table
+for T in $IPT; do
+	for t in N F; do
+		for c in TTLFIX TTL_OUT TTL_POST; do
+			$T -t mangle -${t} ${c}
+		done
+	done
+	for a in D I; do
+		$T -t mangle -${a} PREROUTING -j TTLFIX
+		$T -t mangle -${a} OUTPUT -j TTL_OUT
+		$T -t mangle -${a} POSTROUTING -j TTL_POST
+	done
+done
+
+# Create and flush nat table
+for T in $IPT; do
+	for t in N F; do
+		$T -t nat -${t} PROXY
+		$T -t nat -${t} FIXPROXY
+	done
+	for a in D I; do
+		$T -t nat -${a} PREROUTING -j PROXY
+	done
+done
+
+for s in $SECTIONS; do
+	if [ "$s" ]; then
+		get_vars
+	else
+		exit 0
+	fi
+
+        [ -n $iface ] && {
+                ifn=$iface
+        } || {
+                ifn=lan
+        }
+
+	case $inet in
+		ipv4) IPT="iptables" ;;
+		ipv6) IPT="ip6tables" ;;
+		*) IPT="iptables ip6tables";;
+	esac
+	if ! [ -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+		IPT="iptables"
+	fi
+	DEV=$(ifstatus $iface | jsonfilter -e '@["l3_device"]')
+	case $method in
+		ttl) method_ttl ;;
+		proxy) method_proxy ;;
+	esac
+done

luci-app-ttl/root/usr/share/ttlnft.sh

@@ -0,0 +1,137 @@
+method_ttl(){
+
+    ttl=${ttl:=64}
+
+    # create mangle table
+    nft add table ip mangle 2>/dev/null
+    nft add table ip6 mangle 2>/dev/null
+
+    for fam in $family; do
+        [ "$fam" = "ip6" ] && [ "$inet" = "ipv4" ] && continue
+        [ "$fam" = "ip" ] && [ "$inet" = "ipv6" ] && continue
+
+        # define nftables chains
+        nft add chain $fam mangle TTLFIX { type filter hook prerouting priority -150 \; }
+        nft add chain $fam mangle TTL_OUT { type route hook output priority -150 \; }
+        nft add chain $fam mangle TTL_POST { type filter hook postrouting priority -150 \; }
+
+        # TTL/HL change rules
+	case $fam in
+		ip) TTLNAME=ttl ;;
+		ip6) TTLNAME=hoplimit ;;
+	esac
+	if [ $iface ]; then
+		nft add rule $fam mangle TTLFIX iif $DEV $fam $TTLNAME 1 $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_OUT oif $DEV $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_POST oif $DEV $fam $TTLNAME set $ttl
+	else
+		nft add rule $fam mangle TTLFIX $fam $TTLNAME 1 $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_OUT $fam $TTLNAME set $ttl
+		nft add rule $fam mangle TTL_POST $fam $TTLNAME set $ttl
+	fi
+    done
+}
+
+method_proxy(){
+    for fam in $family; do
+	# create nat table
+	nft add table $fam nat 2>/dev/null
+        [ "$fam" = "ip6" ] && [ "$inet" = "ipv4" ] && continue
+        [ "$fam" = "ip" ] && [ "$inet" = "ipv6" ] && continue
+
+	[ "$proxy" ] && {
+		IPADDR=${proxy%:*}
+		END=${IPADDR}:${proxy#*:}
+	} || {
+	        # get ipaddress from iface if not defined
+		case $fam in
+	        	ip)
+				IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv4-address"][*]["address"]')
+				END="${IPADDR}:3128"
+			;;
+			ip6)
+				IPADDR=$(ifstatus $ifn | jsonfilter -e '@["ipv6-prefix-assignment"][*]["local-address"]["address"]' | head -n1)
+				END="${IPADDR}:3128"
+			;;
+		esac
+	}
+
+        # create NAT chains
+        nft add chain $fam nat PROXY { type nat hook prerouting priority -100 \; }
+        nft add chain $fam nat FIXPROXY
+
+        # add traffic rule
+	[ $iface ] && {
+	        nft add rule $fam nat PROXY iif $DEV jump FIXPROXY
+	} || {
+		nft add rule $fam nat PROXY jump FIXPROXY
+	}
+
+
+        case $ports in
+            all)
+                nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                    meta l4proto tcp dnat to $END
+                ;;
+            http)
+                nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                    meta l4proto tcp tcp dport {80,443} dnat to $END
+                ;;
+            *)
+                if [ $ports ]; then
+                    nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                        meta l4proto tcp tcp dport {$(echo $ports | tr ',' ',')} dnat to $END
+                else
+                    nft add rule $fam nat FIXPROXY $fam daddr != $IPADDR $fam saddr != $IPADDR \
+                        meta l4proto tcp dnat to $END
+                fi
+                ;;
+        esac
+    done
+}
+
+# init tables and chains
+for fml in ip ip6; do
+    # create table mangle
+    nft delete table $fml mangle 2>/dev/null
+    nft delete table $fml nat 2>/dev/null
+
+    # define chains
+    nft add table $fml mangle
+    nft add chain $fml mangle TTLFIX { type filter hook prerouting priority -150 \; }
+    nft add chain $fml mangle TTL_OUT { type route hook output priority -150 \; }
+    nft add chain $fml mangle TTL_POST { type filter hook postrouting priority -150 \; }
+done
+
+for s in $SECTIONS; do
+	if [ "$s" ]; then
+		get_vars
+	else
+		exit 0
+	fi
+
+	[ $iface ] && {
+                ifn=$iface
+	} || {
+		ifn=lan
+	}
+
+	case $inet in
+		ipv4) family="ip" ;;
+		ipv6) family="ip6" ;;
+		*) family="ip ip6" ;;
+	esac
+
+	#if [ ! -f /lib/modules/$(uname -r)/ip6table_nat.ko ]; then
+	#	family="ip"
+	#fi
+
+	DEV=$(ifstatus $iface | jsonfilter -e '@["l3_device"]')
+
+	case $method in
+		ttl) method_ttl ;;
+		proxy) method_proxy ;;
+	esac
+
+done
+