#wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
#wget http://58.215.133.101:801/rpm/inotify-tools-3.14-1.el6.x86_64.rpm
#wget http://58.215.133.101:801/rpm/nginx-1.2.0-5.el6.x86_64.rpm
#wget http://58.215.133.101:801/rpm/opencdn-node-1.1-2.el6-noarch.rpm
#rpm -ivh epel-release-6-8.noarch.rpm
#rpm -ivh inotify-tools-3.14-1.el6.x86_64.rpm
#rpm -ihv nginx-1.2.0-5.el6.x86_64.rpm
**yum -y localinstall opencdn-node-1.1-2.el6-noarch**推荐这么安装。会动解决依赖关系.
检查Selinux状态
#sestatus
如果输出不为 SELinux status: disabled .可以昨时先关闭 .命令如下：
#setenforce 0
永久关闭方法：
#vim /etc/sysconfig/selinux 把SELINUX=disabled 并重启系统
#sed -i 's#localhost#8.8.8.8.#g' /usr/local/opencdn/conf/opencdn.conf 设置为你主控端ip 这里以8.8.8.8.为例
#sed -i 's#0.0.0.0#119.147.0.239#g' /etc/syslog-ng/syslog-ng.conf 修改syslog-ng 上传的日志中心（一般为主控端）
/etc/init.d/httpd restart
#/etc/init.d/opencdn restart
#cd /var/log/opencdn/ 相看相关日志 from https://github.com/firefoxbug/OpenCDN_Node------------------------------------------------ CDN software wget https://github.com/firefoxbug/OpenCDN2.0/archive/master.zip
unzip master.zip
cd OpenCDN2.0-master/
./install.sh service opencdn start
service nginx start
./unstall.sh from https://github.com/firefoxbug/OpenCDN_Node2.0---------------------------------------------------- #wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm #wget http://58.215.133.101:801/rpm/inotify-tools-3.14-1.el6.x86_64.rpm #wget http://58.215.133.101:801/rpm/opencdn-console-1.1-2.el6-noarch.rpm #rpm -ivh epel-release-6-8.noarch.rpm #rpm -ivh inotify-tools-3.14-1.el6.x86_64.rpm **yum -y localinstall opencdn-console-1.1-2.el6-noarch.rpm** 推荐这么安装。会动解决依赖关系. 检查Selinux状态 #sestatus 如果输出不为 SELinux status: disabled .可以昨时先关闭 .命令如下： #setenforce 0 永久关闭方法： #vim /etc/sysconfig/selinux 把SELINUX=disabled 并重启系统 #启动Mysql 并设置密码 #service mysqld start #/usr/bin/mysqladmin -u root password '123'设置mysql密码 ####导入数据#cd /usr/local/opencdn/ocdn #mysql -uroot -p123 -e 'create database cdn_info'新建cdn_info数据库 #mysql -uroot -p123 cdn_info ####重启webserver->http
/etc/init.d/httpd restart ####启动opencdn
#/etc/init.d/opencdn restart 检查一下opencdn开启状态,查看日志。查看有没有异常.
#cd /var/log/opencdn/ 相看相关日志 ####启动服务
#service httpd restart 访问http://x.x.x.x/ocdn/index.php
默认用户名：admin@ocdn.me密码：ocdn.me
from https://github.com/firefoxbug/OpenCDN_Console
波利尼西亚人确实好幸福
- Q：我的系统无法运行(秒出启动失败)
- A：是不是 64 位系统下着 32 位的包？
- Q：好像是的，眼瞎了 ……
- A：……
- Q：我的 win7 系统无法运行(秒出启动失败)，已确认是系统和软件版本位数一致
- A：如果是驱动问题，详见 issue #14，安装补丁 kb4503292 或者将系统更新至最新
- Q：我的系统无法运行（打都打不开）
- A：看下面，装一下运行库
- Q：装了啊，提示已经安装，但是还是不行
- A：建议您重装一下系统（已知有用户系统被玩坏了，安装其实根本没装上）
- Q：我的疯狂报错
- A：安装一下 .NET Framework 4.8 打上最新的 Visual C++ 合集先
- Q：照做了，还是有问题
- A：重装系统谢谢（已知有用户系统被玩坏了，安装其实根本没装上）
- Q：有时候报错提示 ShadowsocksR 进程已停止运行
- A：您好，这个问题我这里处理不了，我没法去修改 ssr-libev 的代码让其不异常退出，未来版本也会取消内置的 ShadowsocksR 支持，参考加入更多的 SSR 参数支持
如果重装系统不能解决问题。建议大哥考虑一下购买一台新电脑
- Q：为什么订阅导入不完整？
- A：导入后看看 logging 目录里的 application.log 吧（也许会暗示什么）
- Q：啥也没有
- A：私发订阅链接看看（加群后联系 @ConnectionRefused），一般来讲是订阅链接中有不被识别的 unicode 字符导致的，类似的问题参见 issue #7，这可能会是一个功能改进，但是目前没有时间表
- Q： xxx 游戏扫描后仍然无法代理
- A：除了自带的模式经测试后可用，其他游戏确实会出现代理后反而无法连接进入游戏的情况
bin文件夹下的 Shadowsocks.exe，如果你使用 Shadowsocks代理，模式中就不应该出现 Shadowsocks.exe这样的进程名。你可以通过修改你要代理的 exe 的名称，或者替换为进程名的全路径名（譬如 C:\xxx\xxx.exe）来避免这个问题bin/Redirector.exe的新 issue 请统一到 issue #152按照格式来回复bin/Redirector.exe覆盖即可bin/Redirector.exe有处理进程所在中文路径的能力，如果需要使用不支持中文路径的 bin/Redirector.exe，请自行修改进程所在路径bin/Redirector.exebin/Redirector.exebin/Redirector.exehttps://github.com/NetchX/Netch/raw/替换这里/binaries/x64/Redirector.exe，x86 版本换掉 x64 即可$ git log --pretty=oneline --decorate --source --tags binaries/x64/Redirector.exe
6a6a1db17092c668546eb073ac5b79bb717b0b7a 190929 1.3.3 [Redirector] Bypass IPv6 loopback
fc94119e7a68e9da16d5ee857c798ce908e1e54f 190928 1.3.2 Update x64 Redirector
e3a9a75343bd808593a5e93781e42e414e9c8e1c 190927 1.3.1 Return short path when fetching long path fails
4860e038c7d667026b48e7ea7e42a777646c6782 190917 1.3.0 Fix path contains chinese
349c44f8947e5f6aae8677b2ea93ea7eb441a537 190906 1.2.9 Update redirector, now support custom tcp port with -t arg
ed60a46dee8179836773731c0970d2e004375024 190904 1.2.9 Fix and optimize redirector
fee275a25c86b2f7c18a9362ff12a0882ae90bc1 190902 1.2.8-BETA [Redirector] Optimize speed statistics, Optimize performance, Add logs for UDP
9b837629fda39c1f30a4579cbe343076c0e14380 190831 1.2.7-STABLE Recompile redirector with new driver
ac57ae0be6137fcd5abf9b0529d55206fd81359b 190830 1.2.6-STABLE (tag: 1.2.6-STABLE) Optimize
a0a5b64833b520a065084024a425fe8ada2967f3 190830 1.2.6-STABLE Speed and bandwidth optimized
7b30473f41e4468d6744456dd040f0d62a271e7a 190830 1.2.6-STABLE Speed and bandwidth working now (Need optimize)
b8164a02419d630753fdfa27981100289abd9b89 190830 1.2.5-STABLE Update prebuilt binares
45954d7f4ed9500014d4dfae48c23b0887db1b77 190830 1.2.5-STABLE Update prebuilt binaries with upx compress
acb4bc24651509c21558420d97865262e959bc0c 190629 1.0.9-STABLE Rollback
5012a4d3011eafa3368f6cc97901e21af2e2874d 190628 1.0.9-STABLE Merge redirector and update version code to 1.0.9-STABLE
666050c3071dba67e2f0c6aae5eb5381a5acb39d 190625 1.0.5-STABLE Updated
- Q： xxx 游戏对 NAT 类型有要求，你们这个加速器代理后 NAT 类型还是严格 xxx ，我甚至用 NATTypeTester 测过了，还是不行 xxx
- A：经过测试这款软件是可以做到 Full Cone 的 NATType 。如果你自己测试不行，需要考虑三个方面的问题
- 第一个是你的服务器是否支持 Full Cone 的 NATType ，这可以通过其他软件的测试来佐证，譬如使用 Sockscap64 之类
- 第二个是你本地的网络环境问题，首先，关闭 windows 防火墙，经测试 windows 防火墙会将 Full Cone 限制到 Port Restricted Cone，无论你是使用 TUN/TAP 模式，还是进程模式，除非你的游戏对 NAT 不敏感，否则请务必先把 windows 防火墙关闭。其次，某些杀软的防火墙可能也会影响到 NAT 类型，根据情况你可以关闭杀软的防火墙，或者卸载杀软来避免问题发生
- 第三个是运营商的网络问题，经测试联通数据和长宽等网络，即使在代理后也无法做到 Full cone ，就算服务器是支持 Full cone 的。这种情况下你可能需要切换全局的 VPN 代理工具（WireGuard ， Badvpn ， Openvpn ， tinyfecVPN 等），也可以尝试 Netch 的 TUN/TAP 模式，或者更换本地网络环境
- 第四个是某些游戏的代理模式有问题，可能遇到各种玄学问题，参见上方
- Q：用来加速 Steam / 浏览器，结果无法正常打开页面
- A：有人测试可行有人测试不可行。首先声明一下，本软件的功能主要不是用来代理 Steam / 浏览器打开页面的，建议使用专门的工具，如 SteamCommunity 302，浏览器则建议用 shadowsocks-windows， clash for windows 等等，你甚至可以尝试
shadowsocks-windows over Netch，这可能会是一个功能改进，但是目前没有时间表
- Q：UWP 应用 xxx 无法代理
- A：请按照此方法设置即可
- Q：我想在电脑上代理斯维奇
- A：
腾讯加速器好像可以免费加速主机游戏- A：会考虑加入，但不会是高优先级，你可以考虑通过 Pull Request 的方式为本软件加入该支持
- Q：希望能加入更多的 SSR 参数支持，我那个机场的订阅好多节点无法导入 issue #11
- A：根据最新的 项目计划表，shadowsocksr的支持将在未来的版本由于各种原因而被放弃。在未来的版本中，可以通过 Socks5 代理进行中转
TC位，UDP 协议对于区域传输功能是不可接受的，不过是互联网上标准查询的推荐协议。通过 UDP 协议发送的查询可能会丢失，所以需要重传策略解决这个问题；TC字段判断是否需要通过 TCP 协议重复发出 DNS 查询请求；www.baidu.com域名的IP 地址的请求，从第四行的 05字节开始到最后就是 DNS 请求的内容，整个数据包中除了 DNS 协议相关的内容之外，还包含以太网、IP 和 UDP 的协议头： 0000 b0 6e bf 6a 4c 4038 f9 d3 ce 10 a6 08004500.n.jL@8.......E.
001000 3b 97 ae 00004011 0b 0a c0 a8 32 6d 7272.;....@.....2mrr
00207272 f3 2700350027 6b ee 0c 5a 01000001 rr.'.5.'k..Z....
003000000000000003777777→056261696475.......www.baidu
00400363 6f 6d 0000010001.com.....
000038 f9 d3 ce 10 a6 b0 6e bf 6a 4c 40080045008......n.jL@..E.
00100076000000009611 4c 7d 72727272 c0 a8 .v......L}rrrr..
002032 6d 0035 f3 270062 5b c2 0c 5a 81800001 2m.5.'.b[..Z....
003000030000000003777777056261696475.......www.baidu
00400363 6f 6d 0000010001 c0 0c 0005000100.com............
00500002 cb 00 0f 0377777701610673686966......www.a.shif
006065 6e c0 16 c0 2b 00010001000001180004 en...+..........
0070 3d 87 a9 7d c0 2b 00010001000001180004=..}.+..........
0080 3d 87 a9 79=..y
需要注意的是，我们在这里计算结果的前提是 DNS 解析器只需要与一个命名服务器或者权威服务器进行通信就可以获得 DNS 响应，但是在实际场景中，DNS 解析器可能会递归地与多个命名服务器进行通信，这也加倍地放大了 TCP 协议在额外开销上的劣势。如果 DNS 查询的请求体和响应分别是 15 和 70 字节，那么 TCP 相比于 UDP 协议会增加 ~250 字节和 ~145% 的额外开销，所以当请求体和响应的大小比较小时，通过 TCP 协议进行传输不仅需要传输更多的数据，还会消耗更多的资源，多次通信以及信息传输带来的时间成本在 DNS 查询较小时是无法被忽视的，TCP 连接带来的可靠性在 DNS 的场景中没能发挥太大的作用。
.请求顶级域名 DNS 服务的地址；me.的地址之后会向顶级域名服务请求负责 xyz.me.域名解析的命名服务；.来表示，这篇文章所在的域名一般写作 xyz.me，但是这里的写法其实省略了最后的 .，也就是全称域名（FQDN）xyz.me.。com、net和 me等顶级域名以及次级域名 xyz.me，我们一般在各个域名网站中购买和使用的都是次级域名、子域名和主机名了。$ dig -t A xyz.me +trace
xyz.me域名对应 IP 地址是如何被解析出来的，首先会向预置的 13 组根域名服务器发出请求获取顶级域名的地址：. 56335 IN NS m.root-servers.net.
. 56335 IN NS b.root-servers.net.
. 56335 IN NS c.root-servers.net.
. 56335 IN NS d.root-servers.net.
. 56335 IN NS e.root-servers.net.
. 56335 IN NS f.root-servers.net.
. 56335 IN NS g.root-servers.net.
. 56335 IN NS h.root-servers.net.
. 56335 IN NS i.root-servers.net.
. 56335 IN NS a.root-servers.net.
. 56335 IN NS j.root-servers.net.
. 56335 IN NS k.root-servers.net.
. 56335 IN NS l.root-servers.net.
. 56335 IN RRSIG NS 8 0 518400 20181111050000 20181029040000 2134 . G4NbgLqsAyin2zZFetV6YhBVVI29Xi3kwikHSSmrgkX+lq3sRgp3UuQ3 JQxpJ+bZY7mwzo3NxZWy4pqdJDJ55s92l+SKRt/ruBv2BCnk9CcnIzK+ OuGheC9/Coz/r/33rpV63CzssMTIAAMQBGHUyFvRSkiKJWFVOps7u3TM jcQR0Xp+rJSPxA7f4+tDPYohruYm0nVXGdWhO1CSadXPvmWs1xeeIKvb 9sXJ5hReLw6Vs6ZVomq4tbPrN1zycAbZ2tn/RxGSCHMNIeIROQ99kO5N QL9XgjIJGmNVDDYi4OF1+ki48UyYkFocEZnaUAor0pD3Dtpis37MASBQ fr6zqQ==
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 247 ms
根域名服务器是 DNS 中最高级别的域名服务器，这些服务器负责返回顶级域的权威域名服务器地址，这些域名服务器的数量总共有 13 组，域名的格式从上面返回的结果可以看到是在这里，我们获取到了以下的 5 条 NS 记录，也就是 5 台.root-servers.net，每个根域名服务器中只存储了顶级域服务器的 IP 地址，大小其实也只有 2MB 左右，虽然域名服务器总共只有 13 组，但是每一组服务器都通过提供了镜像服务，全球大概也有几百台的根域名服务器在运行。
me.定义域名 DNS 服务器：me. 172800 IN NS b0.nic.me.
me. 172800 IN NS a2.nic.me.
me. 172800 IN NS b2.nic.me.
me. 172800 IN NS a0.nic.me.
me. 172800 IN NS c0.nic.me.
me. 86400 IN DS 2569 7 1 09BA1EB4D20402620881FD9848994417800DB26A
me. 86400 IN DS 2569 7 2 94E798106F033500E67567B197AE9132C0E916764DC743C55A9ECA3C 7BF559E2
me. 86400 IN RRSIG DS 8 1 86400 20181113050000 20181031040000 2134 . O81bud61Qh+kJJ26XHzUOtKWRPN0GHoVDacDZ+pIvvD6ef0+HQpyT5nV rhEZXaFwf0YFo08PUzX8g5Pad8bpFj0O//Q5H2awGbjeoJnlMqbwp6Kl 7O9zzp1YCKmB+ARQgEb7koSCogC9pU7E8Kw/o0NnTKzVFmLq0LLQJGGE Y43ay3Ew6hzpG69lP8dmBHot3TbF8oFrlUzrm5nojE8W5QVTk1QQfrZM 90WBjfe5nm9b4BHLT48unpK3BaqUFPjqYQV19C3xJ32at4OwUyxZuQsa GWl0w9R5TiCTS5Ieupu+Q9fLZbW5ZMEgVSt8tNKtjYafBKsFox3cSJRn irGOmg==
;; Received 721 bytes from 192.36.148.17#53(i.root-servers.net) in 59 ms
.me服务器的地址之后，就可以访问这些顶级域名服务器其中的一台 b2.nic.me获取权威 DNS 的服务器的地址了：xyz.me. 86400 IN NS f1g1ns1.dnspod.net.
xyz.me. 86400 IN NS f1g1ns2.dnspod.net.
fsip6fkr2u8cf2kkg7scot4glihao6s1.me. 8400 IN NSEC3 1 1 1 D399EAAB FSJJ1I3A2LHPTHN80MA6Q7J64B15AO5K NS SOA RRSIG DNSKEY NSEC3PARAM
fsip6fkr2u8cf2kkg7scot4glihao6s1.me. 8400 IN RRSIG NSEC3 7 2 8400 20181121151954 20181031141954 2208 me. eac6+fEuQ6gK70KExV0EdUKnWeqPrzjqGiplqMDPNRpIRD1vkpX7Zd6C oN+c8b2yLoI3s3oLEoUd0bUi3dhyCrxF5n6Ap+sKtEv4zZ7o7CEz5Fw+ fpXHj7VeL+pI8KffXcgtYQGlPlCM/ylGUGYOcExrB/qPQ6f/62xrPWjb +r4=
qcolpi5mj0866sefv2jgp4jnbtfrehej.me. 8400 IN NSEC3 1 1 1 D399EAAB QD4QM6388QN4UMH78D429R72J1NR0U07 NS DS RRSIG
qcolpi5mj0866sefv2jgp4jnbtfrehej.me. 8400 IN RRSIG NSEC3 7 2 8400 20181115151844 20181025141844 2208 me. rPGaTz/LyNRVN3LQL3LO1udby0vy/MhuIvSjNfrNnLaKARsbQwpq2pA9 +jyt4ah8fvxRkGg9aciG1XSt/EVIgdLSKXqE82hB49ZgYDACX6onscgz naQGaCAbUTSGG385MuyxCGvqJdE9kEZBbCG8iZhcxSuvBksG4msWuo3k dTg=
;; Received 586 bytes from 199.249.127.1#53(b2.nic.me) in 267 ms
xyz.me域名对应的 IP 地址时，其实会从作者使用的 DNS 服务商 DNSPod 处请求服务的 IP 地址：xyz.me. 600 IN A 123.56.94.228
xyz.me. 86400 IN NS f1g1ns2.dnspod.net.
xyz.me. 86400 IN NS f1g1ns1.dnspod.net.
;; Received 123 bytes from 58.247.212.36#53(f1g1ns1.dnspod.net) in 28 ms
f1g1ns1.dnspod.net服务中获取了当前博客的 IP 地址 123.56.94.228，浏览器或者其他设备就能够通过 IP 向服务器获取请求的内容了。me.顶级域名服务器的时候，其实返回了 b0.nic.me等域名：me. 172800 IN NS b0.nic.me.
me. 172800 IN NS a2.nic.me.
me. 172800 IN NS b2.nic.me.
me. 172800 IN NS a0.nic.me.
me. 172800 IN NS c0.nic.me.
...
b0.nic.me作为一个 DNS 服务器，我也必须获取它的 IP 地址才能获得次级域名的 DNS 信息，但是这里就陷入了一种循环：xyz.me的 IP 地址，就需要访问 me顶级域名服务器 b0.nic.meb0.nic.me的 IP 地址，就需要访问 me顶级域名服务器 b0.nic.meb0.nic.me的 IP 地址，就需要访问 me顶级域名服务器 b0.nic.me$ dig +trace +additional xyz.me
...
me. 172800 IN NS a2.nic.me.
me. 172800 IN NS b2.nic.me.
me. 172800 IN NS b0.nic.me.
me. 172800 IN NS a0.nic.me.
me. 172800 IN NS c0.nic.me.
me. 86400 IN DS 2569 7 1 09BA1EB4D20402620881FD9848994417800DB26A
me. 86400 IN DS 2569 7 2 94E798106F033500E67567B197AE9132C0E916764DC743C55A9ECA3C 7BF559E2
me. 86400 IN RRSIG DS 8 1 86400 20181116050000 20181103040000 2134 . cT+rcDNiYD9X02M/NoSBombU2ZqW/7WnEi+b/TOPcO7cDbjb923LltFb ugMIaoU0Yj6k0Ydg++DrQOy6E5eeshughcH/6rYEbVlFcsIkCdbd9gOk QkOMH+luvDjCRdZ4L3MrdXZe5PJ5Y45C54V/0XUEdfVKel+NnAdJ1gLE F+aW8LKnVZpEN/Zu88alOBt9+FPAFfCRV9uQ7UmGwGEMU/WXITheRi5L h8VtV9w82E6Jh9DenhVFe2g82BYu9MvEbLZr3MKII9pxgyUE3pt50wGY Mhs40REB0v4pMsEU/KHePsgAfeS/mFSXkiPYPqz2fgke6OHFuwq7MgJk l7RruQ==
a0.nic.me. 172800 IN A 199.253.59.1
a2.nic.me. 172800 IN A 199.249.119.1
b0.nic.me. 172800 IN A 199.253.60.1
b2.nic.me. 172800 IN A 199.249.127.1
c0.nic.me. 172800 IN A 199.253.61.1
a0.nic.me. 172800 IN AAAA 2001:500:53::1
a2.nic.me. 172800 IN AAAA 2001:500:47::1
b0.nic.me. 172800 IN AAAA 2001:500:54::1
b2.nic.me. 172800 IN AAAA 2001:500:4f::1
c0.nic.me. 172800 IN AAAA 2001:500:55::1
;; Received 721 bytes from 192.112.36.4#53(g.root-servers.net) in 110 ms
...
BIN to your binary namecmd/myapp to cmd/$BINREGISTRY to the Docker registry you want to useSRC_DIRS if you use some other layoutVERSION values - git tags or manualUSER if you needgo mod vendor to create a vendor directory when you have dependencies.make or make build to compile your app. This will use a Docker image to build your app, with the current directory volume-mounted into place. This will store incremental state for the fastest possible build. Run make all-build to build for all architectures.make container to build the container image. It will calculate the image tag based on the most recent git tag, and whether the repo is "dirty" since that tag (see make version). Run make all-container to build containers for all architectures.make push to push the container image to REGISTRY. Run make all-pushto push the container images for all architectures.make clean to clean up.
Please note, if you need to test Apollo 2.5; for safety purposes, please seek the help of the
Apollo Engineering team. Your safety is our #1 priority,
and we want to ensure Apollo 2.5 was integrated correctly with your vehicle before you hit the road.
{
"notifications":{
"mail":{
"smtpHost":"smtp.gmail.com",
"port":587,
"username":"yourmailid@gmail.com",
"password":"your gmail password",
"from":"yourmailid@gmail.com",
"to":"destemailid@gmail.com"
}
},
"requests":[
{
"url":"http://mywebsite.com",
"requestType":"GET",
"checkEvery":30,
"responseTime":800
}
]
}
$ ./statusok --config config.json
$ ./statusok --config config.json &
$ jobs
$ kill %jobnumber {
"url":"http://mywebsite.com/v1/data",
"requestType":"POST",
"headers":{
"Authorization":"Bearer ac2168444f4de69c27d6384ea2ccf61a49669be5a2fb037ccc1f",
"Content-Type":"application/json"
},
"formParams":{
"description":"sanath test",
"url":"http://google.com"
},
"checkEvery":30,
"responseCode":200,
"responseTime":800
},
{
"url":"http://mywebsite.com/v1/data",
"requestType":"GET",
"headers":{
"Authorization":"Bearer ac2168444f4de69c27d6384ea2ccf61a49669be5a2fb037ccc1f",
},
"urlParams":{
"name":"statusok"
},
"checkEvery":300,
"responseCode":200,
"responseTime":800
},
{
"url":"http://something.com/v1/data",
"requestType":"DELETE",
"formParams":{
"name":"statusok"
},
"checkEvery":300,
"responseCode":200,
"responseTime":800
}
$ ./statusok --config config.json & docker run -d -v /path/to/config/folder:/config sanathp/statusok Note: Config folder should contain config file with name config.jsonversion: '2' services: statusok: build: sanathp/statusok volumes: - /path/to/config/folder:/config depends_on: - influxdb influxdb: image: tutum/influxdb:0.9 environment: - PRE_CREATE_DB="statusok" ports: - 8083:8083 - 8086:8086 grafana: image: grafana/grafana ports: - 3000:3000 Now run it:docker-compose up from https://github.com/sanathp/statusokhttps://github.com/sanathp/statusok/releases/ 相关帖子：https://briteming.blogspot.com/2018/03/titanic-theme-song-my-heart-will-go-on.html
| |||||
| Bypass the blocking of web sites http. |
| The project is mainly aimed at the Russian audience to fight russian regulator named "Roskomnadzor". |
| Some features of the project are russian reality specific (such as getting list of sites |
| blocked by Roskomnadzor), but most others are common. |
| How it works |
| ------------ |
| DPI providers have gaps. They happen because DPI rules are writtten for |
| ordinary user programs, omitting all possible cases that are permissible by standards. |
| This is done for simplicity and speed. It makes no sense to catch 0.01% hackers, |
| because these blockings are quite simple and easily bypassed even by ordinary users. |
| Some DPIs cannot recognize the http request if it is divided into TCP segments. |
| For example, a request of the form "GET / HTTP / 1.1 \ r \ nHost: kinozal.tv ......" |
| we send in 2 parts: first go "GET", then "/ HTTP / 1.1 \ r \ nHost: kinozal.tv .....". |
| Other DPIs stumble when the "Host:" header is written in another case: for example, "host:". |
| Sometimes work adding extra space after the method: "GET /" => "GET /" |
| or adding a dot at the end of the host name: "Host: kinozal.tv." |
| How to put this into practice in the linux system |
| ------------------------------------------------- |
| How to make the system break the request into parts? You can pipe the entire TCP session |
| through transparent proxy, or you can replace the tcp window size field on the first incoming TCP packet with a SYN, ACK. |
| Then the client will think that the server has set a small window size for it and the first data segment |
| will send no more than the specified length. In subsequent packages, we will not change anything. |
| The further behavior of the system depends on the implemented algorithm in the OS. |
| Experience shows that linux always sends first packet no more than the specified |
| in window size length, the rest of the packets until some time sends no more than max (36, specified_size). |
| After a number of packets, the window scaling mechanism is triggered and starts taking |
| the scaling factor into account. The packet size becomes no more than max (36, specified_ramer << scale_factor). |
| The behavior is not very elegant, but since we do not affect the size of the incoming packets, |
| and the amount of data received in http is usually much higher than the amount sent, then visually |
| there will be only small delays. |
| Windows behaves in a similar case much more predictably. First segment |
| the specified length goes away, then the window size changes depending on the value, |
| sent in new tcp packets. That is, the speed is almost immediately restored to the possible maximum. |
| Its easy to intercept a packet with SYN, ACK using iptables. |
| However, the options for editing packets in iptables are severely limited. |
| It’s not possible to change window size with standard modules. |
| For this, we will use the NFQUEUE. This tool allows transfer packets to the processes running in user mode. |
| The process, accepting a packet, can change it, which is what we need. |
| iptables -t mangle -I PREROUTING -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j NFQUEUE --queue-num 200 --queue-bypass |
| It will queue the packets we need to the process that listens on the queue with the number 200. |
| Process will replace the window size. PREROUTING will catch packets addressed to the host itself and routed packets. |
| That is, the solution works the same way as on the client, so on the router. On a PC-based or OpenWRT router. |
| In principle, this is enough. |
| However, with such an impact on TCP there will be a slight delay. |
| In order not to touch the hosts that are not blocked by the provider, you can make such a move. |
| Create a list of blocked domains, resolve them to IP addresses and save to ipset named "zapret". |
| Add to rule: |
| iptables -t mangle -I PREROUTING -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -m set --match-set zapret src -j NFQUEUE --queue-num 200 --queue-bypass |
| Thus, the impact will be made only on ip addresses related to blocked sites. |
| The list can be updated in scheduled task every few days. |
| If DPI cant be bypassed with splitting a request into segments, then sometimes helps changing case |
| of the "Host:" http header. We may not need a window size replacement, so the do not need PREROUTING chain. |
| Instead, we hang on outgoing packets in the POSTROUTING chain: |
| iptables -t mangle -I POSTROUTING -p tcp --dport 80 -m set --match-set zapret dst -j NFQUEUE --queue-num 200 --queue-bypass |
| In this case, additional points are also possible. DPI can catch only the first http request, ignoring |
| subsequent requests in the keep-alive session. Then we can reduce the cpu load abandoning the processing of unnecessary packages. |
| iptables -t mangle -I POSTROUTING -p tcp --dport 80 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:5 -m set --match-set zapret dst -j NFQUEUE --queue-num 200 --queue-bypass |
| It happens that the provider monitors the entire HTTP session with keep-alive requests. In this case |
| it is not enough to restrict the TCP window when establishing a connection. Each http request must be splitted |
| to multiple TCP segments. This task is solved through the full proxying of traffic using |
| transparent proxy (TPROXY or DNAT). TPROXY does not work with connections originating from the local system |
| so this solution is applicable only on the router. DNAT works with local connections, |
| but there is a danger of entering into endless recursion, so the daemon is launched as a separate user, |
| and for this user, DNAT is disabled via "-m owner". Full proxying requires more resources than outbound packet |
| manipulation without reconstructing a TCP connection. |
| iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:1188 |
| iptables -t nat -I OUTPUT -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to 127.0.0.1:1188 |
| NOTE: DNAT on localhost works in the OUTPUT chain, but does not work in the PREROUTING chain without enabling the route_localnet parameter: |
| sysctl -w net.ipv4.conf. |
| You can use "-j REDIRECT --to-port 1188" instead of DNAT, but in this case the transpareny proxy process |
| should listen on the ip address of the incoming interface or on all addresses. Listen all - not good |
| in terms of security. Listening one (local) is possible, but in the case of automated |
| script will have to recognize it, then dynamically enter it into the command. In any case, additional efforts are required. |
| ip6tables |
| --------- |
| ip6tables work almost exactly the same way as ipv4, but there are a number of important nuances. |
| In DNAT, you should take the address --to in square brackets. For example : |
| iptables -t nat -I OUTPUT -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to [::1]:1188 |
| The route_localnet parameter does not exist for ipv6. |
| DNAT to localhost (:: 1) is possible only in the OUTPUT chain. |
| In the PREROUTING DNAT chain, it is possible to any global address or to the link local address of the same interface |
| the packet came from. |
| NFQUEUE works without changes. |
| When it will not work |
| ---------------------- |
| * If DNS server returns false responses. ISP can return false IP addresses or not return anything |
| when blocked domains are queried. If this is the case change DNS to public ones, such as 8.8.8.8 or 1.1.1.1. |
| Sometimes ISP hijacks queries to any DNS server. Dnscrypt or dns-over-tls help. |
| * If blocking is done by IP. |
| * If a connection passes through a filter capable of reconstructing a TCP connection, and which |
| follows all standards. For example, we are routed to squid. Connection goes through the full OS tcpip stack, |
| fragmentation disappears immediately as a means of circumvention. Squid is correct, it will find everything |
| as it should, it is useless to deceive him. |
| BUT. Only small providers can afford using squid, since it is very resource intensive. |
| Large companies usually use DPI, which is designed for much greater bandwidth. |
| nfqws |
| ----- |
| This program is a packet modifier and a NFQUEUE queue handler. |
| It takes the following parameters: |
| --debug=0|1 ; 1=print debug info |
| --qnum= |
| --wsize= |
| --hostcase ; change Host: => host: |
| --hostspell=HoSt ; exact spelling of the "Host" header. must be 4 chars. default is "host" |
| --hostnospace ; remove space after Host: and add it to User-Agent: to preserve packet size |
| --daemon ; daemonize |
| --pidfile= |
| --user= |
| --uid=uid[:gid] ; drop root privs |
| --dpi-desync ; try to desync dpi state |
| --dpi-desync-fwmark= |
| --dpi-desync-ttl= |
| --dpi-desync-fooling=none|md5sig|badsum |
| --dpi-desync-retrans=0|1 ; 1(default)=drop original data packet to force its retransmission. this adds delay to make sure desync packet goes first |
| --dpi-desync-skip-nosni=0|1 ; 1(default)=do not apply desync to requests without hostname in the SNI |
| --hostlist= |
| The manipulation parameters can be combined in any way. |
| COMMENT. As described earlier, Linux behaves strangely when the window size is changed, unlike Windows. |
| Following segments do not restore their full length. Connection can go for a long time in batches of small packets. |
| Package modification parameters (--hostcase, ...) may not work, because nfqws does not work with the connection, |
| but only with separate packets in which the search may not be found, because scattered across multiple packets. |
| If the source of the packages is Windows, there is no such problem. |
| DPI DESYNC ATTACK |
| After completion of the tcp 3-way handshake, the first data packet from the client goes. |
| It usually has "GET / ..." or TLS ClientHello. We drop this packet, replacing with a fake version |
| with another harmless but valid http or https request. This packet must reach DPI and be validated as a good request, |
| but do not reach the destination server. The following means are available: set a low TTL, send a packet with bad checksum, |
| add tcp option "MD5 signature". All of them have their own disadvantages : |
| * md5sig does not work on all servers |
| * badsum doesn't work if your device is behind NAT which does not pass invalid packets. |
| Linux NAT by default does not pass them without special setting "sysctl -w net.netfilter.nf_conntrack_checksum=0" |
| Openwrt sets it from the box, other routers in most cases dont, and its not always possible to change it. |
| If nfqws is on the router, its not neccessary to switch of "net.netfilter.nf_conntrack_checksum". |
| Fake packet doesn't go through FORWARD chain, it goes through OUTPUT. But if your router is behind another NAT, for example ISP NAT, |
| and that NAT does not pass invalid packets, you cant do anything. |
| * TTL looks like the best option, but it requires special tuning for earch ISP. If DPI is further than local ISP websites |
| you can cut access to them. Manual IP exclude list is required. Its possible to use md5sig with ttl. |
| This way you cant hurt anything, but good chances it will help to open local ISP websites. |
| If automatic solution cannot be found then use zapret-hosts-user-exclude.txt. |
| Original packet is dropped, there is no response from the server. What will OS do ? Perform a retransmission. |
| The first retransmission occurs after 0.2 seconds, then the delay increases exponentially. |
| So there will be some delay at the beginning of each connection. Sites will load slower. |
| Unfortunately, if you send a fake packet right away, before the NFQUEUE verdict is issued on the original packet, there are no guarantees |
| which packet will go first. Therefore, a delay is required, it is implemented through the retransmission mechanism. |
| You can disable the drop of the original packet. Sometimes it works. But not very reliable. |
| Its possible to avoid delays for most sites by using hostlist or ipset filter. |
| Hostlist is applicable only to desync attack. It does not work for other options. |
| Hosts are extracted from plain http request Host: header and SNI of ClientHelllo TLS message. |
| Subdomains are applied automatically. gzip lists are supported. |
| iptables for performing the attack : |
| iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 2:4 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass |
| connbytes will only queue the first data packet. mark is needed to keep away generated packets from NFQUEUE. |
| nfqws sets fwmark when it sends generated packets. |
| tpws |
| ----- |
| tpws is transparent proxy. |
| --debug=0|1|2 ; 0(default)=silent 1=verbose 2=debug |
| --bind-addr= |
| --bind-iface4= |
| --bind-iface6= |
| --bind-linklocal=prefer|force ; prefer or force ipv6 link local |
| --bind-wait-ifup= |
| --bind-wait-ip= |
| --bind-wait-ip-linklocal= |
| --port= |
| --socks ; implement socks4/5 proxy instead of transparent proxy |
| --local-rcvbuf= |
| --local-sndbuf= |
| --remote-rcvbuf= |
| --remote-sndbuf= |
| --skip-nodelay ; do not set TCP_NODELAY for outgoing connections. incompatible with split. |
| --no-resolve ; disable socks5 remote dns |
| --maxconn= |
| --hostlist= |
| --split-http-req=method|host ; split http request at specified logical position |
| --split-pos= |
| --hostcase ; change Host: => host: |
| --hostspell ; exact spelling of "Host" header. must be 4 chars. default is "host" |
| --hostdot ; add "." after Host: name |
| --hosttab ; add tab after Host: name |
| --hostnospace ; remove space after Host: |
| --hostpad= |
| --methodspace ; add extra space after method |
| --methodeol ; add end-of-line before method |
| --unixeol ; replace 0D0A to 0A |
| --daemon ; daemonize |
| --pidfile= |
| --user= |
| --uid=uid[:gid] ; drop root privs |
| The manipulation parameters can be combined in any way. |
| There are exceptions: split-pos replaces split-http-req. hostdot and hosttab are mutually exclusive. |
| Only split-pos option works for non-HTTP traffic. |
| tpws can bind only to one ip or to all at once. |
| To bind to all ipv4, specify "0.0.0.0", to all ipv6 - "::". Without parameters, tpws bind to all ipv4 and ipv6. |
| The --bind-wait * parameters can help in situations where you need to get IP from the interface, but it is not there yet, it is not raised |
| or not configured. |
| In different systems, ifup events are caught in different ways and do not guarantee that the interface has already received an IP address of a certain type. |
| In the general case, there is no single mechanism to hang oneself on an event of the type "link local address appeared on the X interface." |
| in socks proxy mode no additional system privileges are required |
| connection to local IPs of the system where tpws runs are prohibited |
| tpws supports remote dns resolving (curl : --socks5-hostname firefox : socks_remote_dns=true) , but does it in blocking mode. |
| tpws uses async sockets for all activity but resolving can break this model. |
| if tpws serves many clients it can cause trouble. also DoS attack is possible against tpws. |
| if remote resolving causes trouble configure clients to use local name resolution and use |
| --no-resolve option on tpws side. |
| Ways to get a list of blocked IP |
| -------------------------------- |
| 1) Enter the blocked domains to ipset/zapret-hosts-user.txt and run ipset/get_user.sh |
| At the output, you get ipset/zapret-ip-user.txt with IP addresses. |
| 2) ipset/get_reestr_*.sh. Russian specific |
| 3) ipset/get_antifilter_*.sh. Russian specific |
| 4) ipset/get_config.sh. This script calls what is written into the GETLIST variable from the config file. |
| If the variable is not defined, then only lists for ipsets nozapret/nozapret6 are resolved. |
| So, if you're not russian, the only way for you is to manually add blocked domains. |
| Or write your own ipset/get_iran_blocklist.sh , if you know where to download this one. |
| On routers, it is not recommended to call these scripts more than once in 2 days to minimize flash memory writes. |
| ipset/create_ipset.sh executes forced ipset update. |
| The regulator list has already reached an impressive size of hundreds of thousands of IP addresses. Therefore, to optimize ipset |
| ip2net utility is used. It takes a list of individual IP addresses and tries to find in it subnets of the maximum size (from / 22 to / 30), |
| in which more than 3/4 addresses are blocked. ip2net is written in C because the operation is resource intensive. |
| If ip2net is compiled or a binary is copied to the ip2net directory, the create_ipset.sh script uses an ipset of the hash:net type, |
| piping the list through ip2net. Otherwise, ipset of hash:ip type is used, the list is loaded as is. |
| Accordingly, if you don’t like ip2net, just remove the binary from the ip2net directory. |
| create_ipset.sh supports loading ip lists from gzip files. First it looks for the filename with the ".gz" extension, |
| such as "zapret-ip.txt.gz", if not found it falls back to the original name "zapret-ip.txt". |
| So your own get_iran_blockslist.sh can use "zz" function to produce gz. Study how other russian get_XXX.sh work. |
| Gzipping helps saving a lot of precious flash space on embedded systems. |
| User lists are not gzipped because they are not expected to be very large. |
| You can add a list of domains to ipset/zapret-hosts-user-ipban.txt. Their ip addresses will be placed |
| in a separate ipset "ipban". It can be used to route connections to transparent proxy "redsocks" or VPN. |
| IPV6: if ipv6 is enabled, then additional txt's are created with the same name, but with a "6" at the end before the extension. |
| zapret-ip.txt => zapret-ip6.txt |
| The ipsets zapret6 and ipban6 are created. |
| IP EXCLUSION SYSTEM. All scripts resolve zapret-hosts-user-exclude.txt file, creating zapret-ip-exclude.txt and zapret-ip-exclude6.txt. |
| They are the source for ipsets nozapret/nozapret6. All rules created by init scripts are created with these ipsets in mind. |
| The IPs placed in them are not involved in the process. |
| zapret-hosts-user-exclude.txt can contain domains, ipv4 and ipv6 addresses or subnets. |
| Domain name filtering |
| --------------------- |
| An alternative to ipset is to use tpws with a list of domains. |
| tpws can only read one hostlist. |
| Enter the blocked domains to ipset/zapret-hosts-users.txt. Remove ipset/zapret-hosts.txt.gz. |
| Then the init script will run tpws with the zapret-hosts-users.txt list. |
| Other option ( Roskomnadzor list - get_hostlist.sh ) is russian specific. |
| You can write your own replacement for get_hostlist.sh. |
| When filtering by domain name, tpws should run without filtering by ipset. |
| All http traffic goes through tpws, and it decides whether to use manipulation depending on the Host: field in the http request. |
| This creates an increased load on the system. |
| The domain search itself works very quickly, the load is connected with pumping the amount of data through the process. |
| When using large regulator lists estimate the amount of RAM on the router! |
| Choosing parameters |
| ------------------- |
| The file /opt/zapret/config is used by various components of the system and contains basic settings. |
| It needs to be viewed and edited if necessary. |
| Select MODE: |
| nfqws_ipset - use nfqws for http. targets are filtered by ipset "zapret" |
| nfqws_ipset_https - use nfqws for http and https. targets are filtered by ipset "zapret" |
| nfqws_all - use nfqws for all http |
| nfqws_all_https - use nfqws for all http and https |
| nfqws_all_desync - use nfqws for DPI desync attack on http и https for all http and https |
| nfqws_ipset_desync - use nfqws for DPI desync attack on http и https for all http and https. targets are filtered by ipset "zapret" |
| nfqws_hostlist_desync - use nfqws for DPI desync attack on http и https , only to hosts from hostlist |
| tpws_ipset - use tpws for http. targets are filtered by ipset "zapret" |
| tpws_ipset_https - use tpws for http and https. targets are filtered by ipset "zapret" |
| tpws_all - use tpws for all http |
| tpws_all_https - use tpws for all http and https |
| tpws_hostlist - same as tpws_all but touch only domains from the hostlist |
| ipset - only fill ipset. futher actions depend on your own code |
| Its possible to change manipulation options used by the daemons : |
| NFQWS_OPT="--wsize=3 --hostspell=HOST" |
| TPWS_OPT_HTTP="--hostspell=HOST --split-http-req=method" |
| TPWS_OPT_HTTPS="--split-pos=3" |
| Options for DPI desync attack are configured separately: |
| DESYNC_MARK=0x40000000 |
| NFQWS_OPT_DESYNC="--dpi-desync --dpi-desync-ttl=0 --dpi-desync-fooling=badsum --dpi-desync-fwmark=$DESYNC_MARK" |
| The GETLIST parameter tells the install_easy.sh installer which script to call |
| to update the list of blocked ip or hosts. |
| Its called via get_config.sh from scheduled tasks (crontab or systemd timer). |
| Put here the name of the script that you will use to update the lists. |
| If not, then the parameter should be commented out. |
| You can individually disable ipv4 or ipv6. If the parameter is commented out or not equal to "1", |
| use of the protocol is permitted. |
| #DISABLE_IPV4=1 |
| DISABLE_IPV6=1 |
| The number of threads for mdig multithreaded DNS resolver (1..100). |
| The more of them, the faster, but will your DNS server be offended by hammering ? |
| MDIG_THREADS=30 |
| The following settings are not relevant for openwrt : |
| If your system works as a router, then you need to enter the names of the internal and external interfaces: |
| IFACE_LAN = eth0 |
| IFACE_WAN = eth1 |
| IMPORTANT: configuring routing, masquerade, etc. not a zapret task. |
| Only modes that intercept transit traffic are enabled. |
| The INIT_APPLY_FW=1 parameter enables the init script to independently apply iptables rules. |
| With other values or if the parameter is commented out, the rules will not be applied. |
| This is useful if you have a firewall management system, in the settings of which you should tie the rules. |
| Screwing to the firewall control system or your launch system |
| ------------------------------------------------------------- |
| If you use some kind of firewall management system, then it may conflict with an existing startup script. |
| When re-applying the rules, it could break the iptables settings from the zapret. |
| In this case, the rules for iptables should be screwed to your firewall separately from running tpws or nfqws. |
| The following calls allow you to apply or remove iptables rules separately: |
| /opt/zapret/init.d/sysv/zapret start-fw |
| /opt/zapret/init.d/sysv/zapret stop-fw |
| And you can start or stop the demons separately from the firewall: |
| /opt/zapret/init.d/sysv/zapret start-daemons |
| /opt/zapret/init.d/sysv/zapret stop-daemons |
| Simple install to desktop linux system |
| -------------------------------------- |
| Simple install works on most modern linux distributions with systemd. |
| Run install_easy.sh and answer its questions. |
| Simple install to openwrt |
| ------------------------- |
| install_easy.sh also works on openwrt but there're additional challenges. |
| They are mainly about possibly low flash free space. |
| Simple install will not work if it has no space to install itself and required packages from the repo. |
| Another challenge would be to bring zapret to the router. You can download zip from github and use it. |
| Do not repack zip contents in the Windows, because this way you break chmod and links. |
| Install openssh-sftp-server and unzip to openwrt and use sftp to transfer the file. |
| The best way to start is to put zapret dir to /tmp and run /tmp/zapret/install_easy.sh from there. |
| After installation remove /tmp/zapret to free RAM. |
| The absolute minimum for openwrt is 64/8 system, 64/16 is comfortable, 128/extroot is recommended. |
| Android |
| ------- |
| Its not possible to use nfqws and tpws in transparent proxy mode without root privileges. |
| Without root tpws can run in --socks mode. |
| I have no NFQUEUE presence statistics in stock android kernels, but its present on my MTK device. |
| If NFQUEUE is present nfqws works. |
| There's no ipset support unless you run custom kernel. In common case task of bringing up ipset |
| on android is ranging from "not easy" to "almost impossible", unless you find working kernel |
| image for your device. |
| Android does not use /etc/passwd, tpws --user won't work. There's replacement. |
| Use numeric uids in --uid option. |
| Its recommended to use gid 3003 (AID_INET), otherwise tpws will not have inet access. |
| Example : --uid 1:3003 |
| In iptables use : "! --uid-owner 1" instead of "! --uid-owner tpws". |
| Write your own shell script with iptables and tpws, run it using your root manager. |
| Autorun scripts are here : |
| magisk : /data/adb/service.d |
| supersu : /system/su.d |
| I haven't checked whether android can kill iptable rules at its own will during wifi connection/disconnection, |
| mobile data on/off, ... |
| Https blocking bypass |
| ---------------------- |
| As a rule, DPI tricks do not help to bypass https blocking. |
| You have to redirect traffic through a third-party host. |
| It is proposed to use transparent redirect through socks5 using iptables + redsocks, or iptables + iproute + vpn. |
| Redsocks variant is described in https.txt. |
| iproute + wireguard - in wireguard_iproute_openwrt.txt. |
| (they are russian) |
| SOMETIMES (but not often) a tls handshake split trick works. |
| Try MODE=..._https |
| May be you're lucky. |
