Bump version to v70.20250505

Source: dc1dc5c876

.github/workflows/build.yml

@@ -110,10 +110,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ openwrt-23.05, SNAPSHOT ]
+        branch: [ openwrt-24.10, SNAPSHOT ]
         arch:
           - aarch64_cortex-a53
           - aarch64_cortex-a72
+          - aarch64_cortex-a76
           - aarch64_generic
           - arm_arm1176jzf-s_vfp
           - arm_arm926ej-s
@@ -127,7 +128,6 @@ jobs:
           - arm_cortex-a9_neon
           - arm_cortex-a9_vfpv3-d16
           - arm_fa526
-          - arm_mpcore
           - arm_xscale
           - mips64_octeonplus
           - mips_24kc
@@ -141,20 +141,16 @@ jobs:
         isTestOrFake:
           - ${{ needs.check.outputs.test_build == 'true' || needs.check.outputs.fake_build == 'true' }}
         exclude:
-          - branch: SNAPSHOT
-            arch: arm_mpcore
           - branch: SNAPSHOT
             arch: arm_cortex-a9_vfpv3-d16
           - { isTestOrFake: true }
         include:
-          - branch: openwrt-23.05
+          - branch: openwrt-24.10
             arch: x86_64
-          - branch: openwrt-23.05
+          - branch: openwrt-24.10
             arch: aarch64_cortex-a53
           - branch: SNAPSHOT
             arch: aarch64_cortex-a53
-          - branch: SNAPSHOT
-            arch: aarch64_cortex-a76
     container:
       image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.branch }}
       options: --user root
@@ -181,7 +177,7 @@ jobs:
           sed -r -i 's/^rm.+//' setup.sh
           ./setup.sh
           ls -lh
-          if [ "$BRANCH" = "openwrt-23.05" ]; then
+          if [ "$BRANCH" = "openwrt-24.10" ]; then
               echo "PKGTYPE=ipk" >> $GITHUB_ENV
           else
               echo "PKGTYPE=apk" >> $GITHUB_ENV

luci-app-zapret/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-zapret
-PKG_VERSION:=70.20250213
+PKG_VERSION:=70.20250505
 PKG_LICENSE:=MIT
 PKG_MAINTAINER:=remittor <https://github.com/remittor>
 

luci-app-zapret/htdocs/luci-static/resources/view/zapret/service.js

@@ -45,7 +45,7 @@ return view.extend({
         return Promise.all([
             tools.getInitState(tools.appName),      // svc_boot
             fs.exec(tools.execPath, [ 'enabled' ]), // svc_en
-            fs.exec(tools.execPath, [ 'info' ]),    // svc_info
+            tools.getSvcInfo(),                     // svc_info
             fs.exec('/bin/busybox', [ 'ps' ]),      // process list
             fs.exec(tools.packager.path, tools.packager.args),  // installed packages
             uci.load(tools.appName),              // config
@@ -75,7 +75,7 @@ return view.extend({
         //console.log('svc_en: ' + svc_en.code);
         svc_en = (svc_en.code == 0) ? true : false;
         
-        if (svc_info.code != 0) {
+        if (typeof(svc_info) !== 'object') {
             ui.addNotification(null, E('p', _('Unable to read the service info') + ': setAppStatus()'));
             this.disableButtons(true, -1, elems);
             return;

luci-app-zapret/htdocs/luci-static/resources/view/zapret/settings.js

@@ -86,6 +86,10 @@ return view.extend({
         o.rmempty = false;
         o.default = 0;
 
+        o = s.taboption(tabname, form.Flag, 'FILTER_TTL_EXPIRED_ICMP', 'FILTER_TTL_EXPIRED_ICMP');
+        o.rmempty = false;
+        o.default = 1;
+
         o = s.taboption(tabname, form.ListValue, 'MODE_FILTER', _('MODE_FILTER'));
         //o.value('none',         'none');
         //o.value('ipset',        'ipset');
@@ -105,10 +109,13 @@ return view.extend({
         tabname = 'nfqws_params';
         s.tab(tabname, _('NFQWS options'));
 
-        let add_delim = function(sec) {
+        let add_delim = function(sec, url = null) {
             let o = sec.taboption(tabname, form.DummyValue, '_hr');
             o.rawhtml = true;
             o.default = '<hr style="width: 620px; height: 1px; margin: 1px 0 1px; border-top: 1px solid;">';
+            if (url) {
+                o.default += '<br/>' + _('Help') + ': <a href=%s>%s</a>'.format(url);
+            }
         };
 
         let add_param = function(sec, param, locname = null, rows = 10, multiline = false) {
@@ -140,7 +147,11 @@ return view.extend({
             val.validate = function(section_id, value) {
                 return (value) ? value.trim() : "";
             };
-            btn.onclick = () => new tools.longstrEditDialog('config', param, param, locname, rows, multiline).show();
+            let desc = locname;
+            if (multiline == 2) {
+                desc += '<br/>' + _('Example') + ': <a href=%s>%s</a>'.format(tools.nfqws_opt_url);
+            }
+            btn.onclick = () => new tools.longstrEditDialog('config', param, param, desc, rows, multiline).show();
         };
 
         o = s.taboption(tabname, form.Flag, 'NFQWS_ENABLE', _('NFQWS_ENABLE'));
@@ -189,8 +200,8 @@ return view.extend({
         o.rmempty     = false;
         o.datatype    = 'uinteger';
 
-        add_delim(s);
-        add_param(s, 'NFQWS_OPT', null, 18, 2);
+        add_delim(s, tools.nfqws_opt_url);
+        add_param(s, 'NFQWS_OPT', null, 21, 2);
 
         /* AutoHostList settings */
 

luci-app-zapret/htdocs/luci-static/resources/view/zapret/tools.js

@@ -52,7 +52,8 @@ return baseclass.extend({
     customdPrefixList : [ 10, 20, 50, 60, 90 ] ,
     customdFileFormat : '/opt/zapret/init.d/openwrt/custom.d/%s-script.sh',
     discord_num       : 50,
-    discord_url       : 'https://github.com/bol-van/zapret/blob/master/init.d/custom.d.examples.linux/50-discord',
+    discord_url       : 'https://github.com/bol-van/zapret/blob/4e8e3a9ed9dbeb1156db68dfaa7b353051c13797/init.d/custom.d.examples.linux/50-discord',
+    nfqws_opt_url     : 'https://github.com/remittor/zapret-openwrt/discussions/168',
 
     autoHostListFN    : '/opt/zapret/ipset/zapret-hosts-auto.txt',
     autoHostListDbgFN : '/opt/zapret/ipset/zapret-hosts-auto-debug.log',
@@ -73,6 +74,13 @@ return baseclass.extend({
         running  : { code: 4, name: _('Running')  , label: this.infoLabelRunning  },
     },
 
+    callServiceList: rpc.declare({
+        object: 'service',
+        method: 'list',
+        params: [ 'name', 'verbose' ],
+        expect: { '': {} }
+    }),
+
     callInitState: rpc.declare({
         object: 'luci',
         method: 'getInitList',
@@ -103,6 +111,17 @@ return baseclass.extend({
         }
     },
 
+    getSvcInfo: function(svc_name = null) {
+        this.init_consts();
+        let name = (svc_name) ? svc_name : this.appName;
+        let verbose = 1;
+        return this.callServiceList(name, verbose).then(res => {
+            return res;
+        }).catch(e => {
+            ui.addNotification(null, E('p', _('Failed to get %s service info: %s').format(name, e)));
+        });
+    },
+
     getInitState: function(name) {
         this.init_consts();
         return this.callInitState(name).then(res => {
@@ -161,6 +180,11 @@ return baseclass.extend({
                 if (spos > 0) {
                     ver = ver.substring(0, spos);
                 }
+                let mpos = ver.lastIndexOf("-");
+                if (mpos > 0 && ver.substring(mpos+1, mpos+2) == 'r') {
+                    // release number
+                    ver = ver.substring(0, mpos);
+                }
             }
             pkg_dict[name] = ver;
         }
@@ -195,9 +219,6 @@ return baseclass.extend({
             },
             "status": this.statusDict.error,
         };
-        if (svc_info.code != 0) {
-            return -1;
-        }
         if (proc_list.code != 0) {
             return -2;
         }        
@@ -206,22 +227,10 @@ return baseclass.extend({
         if (plist.length < 4) {
             return -3;
         }
-        if (typeof(svc_info.stdout) !== 'string') {
+        if (typeof(svc_info) !== 'object') {
             return -4;
         }
-        if (svc_info.stdout.length < 3) {
-            return -5;
-        }
-        let jdata;
-        try {
-            jdata = JSON.parse(svc_info.stdout);
-        } catch (e) {
-            console.log('Incorrect JSON: ' + svc_info.stdout);
-            return -6;
-        }
-        if (typeof(jdata) !== 'object') {
-            return -7;
-        }
+        let jdata = svc_info;
         if (typeof(jdata.zapret) == 'object') {
             result.dmn.inited = true;
             let dmn_list = jdata.zapret.instances;
@@ -435,6 +444,9 @@ return baseclass.extend({
             if (typeof(value) === 'string') {
                 value = value.trim();
                 if (this.multiline == 2) {
+                    value = value.replace(/\n\t\t\t--/g, "\n--");
+                    value = value.replace(/\n\t\t--/g, "\n--");
+                    value = value.replace(/\n\t--/g, "\n--");
                     value = value.replace(/\n  --/g, "\n--");
                     value = value.replace(/\n --/g, "\n--");
                     value = value.replace(/ --/g, "\n--");

luci-app-zapret/root/usr/share/rpcd/acl.d/luci-app-zapret.json

@@ -6,6 +6,7 @@
 			"file": {
 				"/opt/zapret/config": [ "read" ],
 				"/opt/zapret/ipset/*": [ "read" ],
+				"/opt/zapret/init.d/openwrt/custom.d/*": [ "read" ],
 				"/etc/crontabs/root": [ "read" ],
 				"/tmp/zapret*": [ "read" ],
 				"/etc/init.d/zapret*": [ "exec" ],
@@ -20,7 +21,8 @@
 			},
 			"uci": [ "zapret", "network" ],
 			"ubus": {
-				"luci": [ "getInitList", "setInitAction" ]
+				"luci": [ "getInitList", "setInitAction" ],
+				"service": [ "list" ]
 			}
 		},
 		"write": {

zapret-ip2net/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-ip2net
-PKG_VERSION:=70.20250213
+PKG_VERSION:=70.20250505
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=f62b289cb5e0566633aa51f163651c656f9e1cc1
-PKG_SOURCE_DATE:=2025-02-13
+PKG_SOURCE_VERSION:=b0c7af789a2a82d1cf285fba5282df0fe2951760
+PKG_SOURCE_DATE:=2025-05-05
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret-mdig/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-mdig
-PKG_VERSION:=70.20250213
+PKG_VERSION:=70.20250505
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=f62b289cb5e0566633aa51f163651c656f9e1cc1
-PKG_SOURCE_DATE:=2025-02-13
+PKG_SOURCE_VERSION:=b0c7af789a2a82d1cf285fba5282df0fe2951760
+PKG_SOURCE_DATE:=2025-05-05
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret-tpws/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-tpws
-PKG_VERSION:=70.20250213
+PKG_VERSION:=70.20250505
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=f62b289cb5e0566633aa51f163651c656f9e1cc1
-PKG_SOURCE_DATE:=2025-02-13
+PKG_SOURCE_VERSION:=b0c7af789a2a82d1cf285fba5282df0fe2951760
+PKG_SOURCE_DATE:=2025-05-05
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret
-PKG_VERSION:=70.20250213
+PKG_VERSION:=70.20250505
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -13,8 +13,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=f62b289cb5e0566633aa51f163651c656f9e1cc1
-PKG_SOURCE_DATE:=2025-02-13
+PKG_SOURCE_VERSION:=b0c7af789a2a82d1cf285fba5282df0fe2951760
+PKG_SOURCE_DATE:=2025-05-05
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?
@@ -108,7 +108,9 @@ if [ -z "$${IPKG_INSTROOT}" ]; then
 	fi
 	if [ "$${PKG_UPGRADE}" = "1" ]; then
 		# stop service if PKG_UPGRADE
-		[ -x "/etc/init.d/zapret" ] && /etc/init.d/zapret stop >/dev/null 2>&1
+		if [ -x "/etc/init.d/zapret" ]; then
+			/etc/init.d/zapret running && /etc/init.d/zapret stop >/dev/null 2>&1
+		fi
 	fi
 	if [ ! -f "/opt/zapret/ipset/zapret-hosts-google.txt" ]; then
 		if [ -f "/opt/zapret/ipset/zapret-hosts-user.txt" ]; then
@@ -186,8 +188,8 @@ if [ -z "$${IPKG_INSTROOT}" ]; then
 	. "$${ZAPRET_BASE}/common/fwtype.sh"
 	. "$${ZAPRET_BASE}/common/nft.sh"
 	. "$${ZAPRET_BASE}/common/installer.sh"
+	/etc/init.d/zapret running && /etc/init.d/zapret stop
 	/etc/init.d/zapret disable
-	/etc/init.d/zapret stop
 	ps w | grep '/opt/zapret/nfq/nfqws' | grep -v grep | awk '{print $$1}' | xargs -r kill -9
 	remove_openwrt_firewall
 	nft_del_table

zapret/comfunc.sh

@@ -21,8 +21,7 @@ CRONTAB_FILE="/etc/crontabs/root"
 
 function adapt_for_sed
 {
-	local str=$( ( echo $1|sed -r 's/([\$\.\*\/\[\\^])/\\\1/g'|sed 's/[]]/\\]/g' )>&1 )
-	echo "$str"
+	echo -n "$1" | tr '\r' ' ' | tr '\n' ' ' | tr '\t' ' ' | sed -r 's/([\$\.\*\/\[\\^])/\\\1/g' | sed 's/[]]/\\]/g'
 }
 
 function is_valid_config
@@ -145,6 +144,8 @@ function insert_cron_task_logs
 function init_before_start
 {
 	local DAEMON_LOG_ENABLE=$1
+	local HOSTLIST_FN="$ZAPRET_BASE/ipset/zapret-hosts-user.txt"
+	[ ! -f "$HOSTLIST_FN" ] && touch "$HOSTLIST_FN"
 	chmod 644 $ZAPRET_BASE/ipset/*.txt
 	chmod 666 $ZAPRET_BASE/ipset/*.log
 	rm -f /tmp/zapret*.log
@@ -155,3 +156,35 @@ function init_before_start
 		remove_cron_task_logs
 	fi
 }
+
+function patch_luci_header_ut
+{
+	# INFO: https://github.com/openwrt/luci/pull/7725
+	local header_ut=/usr/share/ucode/luci/template/header.ut
+	local runtime_uc=/usr/share/ucode/luci/runtime.uc
+	local newenv
+	[ ! -f $header_ut ] && return 0
+	[ ! -f $runtime_uc ] && return 0
+	if grep -q "pkgs_update_time" $runtime_uc; then
+		return 0
+	fi
+	if grep -q "pkgs_update_time" $header_ut; then
+		return 0
+	fi
+	sed -i "/^import { access/i import { stat } from 'fs';" $runtime_uc
+	if ! grep -q "{ stat }" $runtime_uc; then
+		return 1
+	fi
+	newenv="self.env.pkgs_update_time = stat('/lib/apk/db/installed')?.mtime ?? stat('/usr/lib/opkg/status')?.mtime ?? 0;"
+	newenv=`adapt_for_sed "$newenv"`
+	sed -i "/self.env.include =/i $newenv" $runtime_uc
+	if ! grep -q "pkgs_update_time" $runtime_uc; then
+		return 1
+	fi
+	sed -i 's/luci.js?v=\(.*\)"><\/script>/luci.js?v=\1-{{ pkgs_update_time }}"><\/script>/g' $header_ut
+	if ! grep -q "pkgs_update_time" $header_ut; then
+		return 1
+	fi
+	logger -p notice -t ZAPRET "patch_luci_header_ut: OK"
+	return 0
+}

zapret/config.default

@@ -90,8 +90,8 @@ NFQWS_UDP_PKT_IN="0"
 # normally it's needed only for stateless DPI that matches every packet in a single TCP session
 # typical example are plain HTTP keep alives
 # this mode can be very CPU consuming. enable with care !
-NFQWS_PORTS_TCP_KEEPALIVE=0
-NFQWS_PORTS_UDP_KEEPALIVE=0
+NFQWS_PORTS_TCP_KEEPALIVE=""
+NFQWS_PORTS_UDP_KEEPALIVE=""
 
 # use <HOSTLIST> and <HOSTLIST_NOAUTO> placeholders to engage standard hostlists and autohostlist in ipset dir
 # hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
@@ -136,6 +136,11 @@ DISABLE_IPV4=0
 # do not work with ipv6
 DISABLE_IPV6=1
 
+# drop icmp time exceeded messages for nfqws tampered connections
+# in POSTNAT mode this can interfere with default mtr/traceroute in tcp or udp mode. use source port not redirected to nfqws
+# set to 0 if you are not expecting connection breakage due to icmp in response to TCP SYN or UDP
+FILTER_TTL_EXPIRED_ICMP=1
+
 # select which init script will be used to get ip or host list
 # possible values : get_user.sh get_antizapret.sh get_combined.sh get_reestr.sh get_hostlist.sh
 # comment if not required

zapret/def-cfg.sh

@@ -14,6 +14,7 @@ function set_cfg_default_values
 		set $cfgname.config.INIT_APPLY_FW='1'
 		set $cfgname.config.DISABLE_IPV4='0'
 		set $cfgname.config.DISABLE_IPV6='1'
+		set $cfgname.config.FILTER_TTL_EXPIRED_ICMP='1'
 		set $cfgname.config.MODE_FILTER='hostlist'
 		set $cfgname.config.DISABLE_CUSTOM='0'
 		set $cfgname.config.WS_USER='daemon'

zapret/init.d.sh

@@ -25,6 +25,7 @@ is_run_on_boot && IS_RUN_ON_BOOT=1 || IS_RUN_ON_BOOT=0
 function enable
 {
 	local run_on_boot=""
+	patch_luci_header_ut
 	if [ "$IS_RUN_ON_BOOT" = "1" ]; then
 		if [ -n "$ZAPRET_CFG_SEC_NAME" ]; then
 			run_on_boot=$( get_run_on_boot_option )
@@ -59,6 +60,7 @@ function enabled
 function boot
 {
 	local run_on_boot=""
+	patch_luci_header_ut
 	if [ "$IS_RUN_ON_BOOT" = "1" ]; then
 		if [ -n "$ZAPRET_CFG_SEC_NAME" ]; then
 			run_on_boot=$( get_run_on_boot_option )

zapret/ipset/zapret-hosts-user-exclude.txt

@@ -1,6 +1,20 @@
+127.0.0.0/8
 10.0.0.0/8
 172.16.0.0/12
 192.168.0.0/16
 169.254.0.0/16
+::1
 fc00::/7
 fe80::/10
+play.google.com
+android.com
+google-analytics.com
+googleusercontent.com
+gstatic.com
+gvt1.com
+ggpht.com
+dl.google.com
+dl-ssl.google.com
+android.clients.google.com
+gvt2.com
+gvt3.com

zapret/ipset/zapret-hosts-user.txt

@@ -0,0 +1 @@
+abra-cadabra.com

zapret/sync_config.sh

@@ -48,6 +48,12 @@ function sync_param
 	if [ "$value" = "$TAB" ]; then
 		value=""
 	fi
+	if [ "$param" = "NFQWS_PORTS_TCP_KEEPALIVE" -o "$param" = "NFQWS_PORTS_UDP_KEEPALIVE" ]; then
+		[ "$value" = "0" ] && value=""
+	fi
+	if [ "$param" = "NFQWS_OPT" -a "$value" != "" ]; then
+		value=$( echo -n "$value" | sed '/^#/d' )
+	fi
 	if [ "$vtype" = "str" ]; then
 		set_param_value_str $param "$value"
 	else
@@ -74,6 +80,7 @@ sync_param FLOWOFFLOAD
 sync_param INIT_APPLY_FW
 sync_param DISABLE_IPV4
 sync_param DISABLE_IPV6
+sync_param FILTER_TTL_EXPIRED_ICMP
 sync_param MODE_FILTER
 sync_param DISABLE_CUSTOM
 sync_param WS_USER str
@@ -94,8 +101,8 @@ sync_param NFQWS_TCP_PKT_OUT str
 sync_param NFQWS_TCP_PKT_IN str
 sync_param NFQWS_UDP_PKT_OUT str
 sync_param NFQWS_UDP_PKT_IN str
-sync_param NFQWS_PORTS_TCP_KEEPALIVE
-sync_param NFQWS_PORTS_UDP_KEEPALIVE
+sync_param NFQWS_PORTS_TCP_KEEPALIVE str
+sync_param NFQWS_PORTS_UDP_KEEPALIVE str
 sync_param NFQWS_OPT str
 
 ZAPRET_CONFIG="$ZAPRET_CONFIG__SAVED"