🌴 Sync 2026-03-05 23:51:42

luci-app-control-webrestriction/Makefile

@@ -0,0 +1,15 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for Webrestriction
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.1
+PKG_RELEASE:=1
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature

luci-app-control-webrestriction/luasrc/controller/webrestriction.lua

@@ -0,0 +1,16 @@
+module("luci.controller.webrestriction", package.seeall)
+
+function index()
+    if not nixio.fs.access("/etc/config/webrestriction") then return end
+
+    entry({"admin", "control"}, firstchild(), "Control", 44).dependent = false
+    entry({"admin", "control", "webrestriction"}, cbi("webrestriction"), _("Access Control"), 11).dependent = true
+    entry({"admin", "control", "webrestriction", "status"}, call("status")).leaf = true
+end
+
+function status()
+    local e = {}
+    e.status = luci.sys.call("iptables -L FORWARD | grep WEB_RESTRICTION >/dev/null") == 0
+    luci.http.prepare_content("application/json")
+    luci.http.write_json(e)
+end

luci-app-control-webrestriction/luasrc/model/cbi/webrestriction.lua

@@ -0,0 +1,36 @@
+local o = require "luci.sys"
+
+a = Map("webrestriction", translate("Access Control"), translate("Use the blacklist or whitelist mode to control whether a client in the list can connect to the Internet."))
+a.template = "webrestriction/index"
+
+e = a:section(TypedSection, "basic", translate("Running Status"))
+e.anonymous = true
+
+t = e:option(DummyValue, "webrestriction_status", translate("Running Status"))
+t.template = "webrestriction/webrestriction"
+t.value = translate("Collecting data...")
+
+e = a:section(TypedSection, "basic", translate("Global setting"))
+e.anonymous = true
+
+t = e:option(Flag, "enable", translate("Enable"))
+t.rmempty = false
+
+t = e:option(ListValue, "limit_type", translate("Limit mode"))
+t.default = "blacklist"
+t:value("whitelist", translate("Whitelist"))
+t:value("blacklist", translate("Blacklist"))
+
+e = a:section(TypedSection, "macbind", translate("List setting"), translate("In blacklist mode, the client in the list is prohibited from connecting to the Internet. In whitelist mode, only the clients in the list can connect to the Internet."))
+e.template = "cbi/tblsection"
+e.anonymous = true
+e.addremove = true
+
+t = e:option(Flag, "enable", translate("Enable"))
+t.rmempty = false
+
+t = e:option(Value, "macaddr", translate("MAC Address"))
+t.rmempty = true
+
+o.net.mac_hints(function(e, a) t:value(e, "%s (%s)" % {e, a}) end)
+return a

luci-app-control-webrestriction/luasrc/view/webrestriction/index.htm

@@ -0,0 +1,18 @@
+<%#
+ Copyright 2016 Chen RuiWei <crwbak@gmail.com>
+ Licensed to the public under the Apache License 2.0.
+-%>
+
+<% include("cbi/map") %>
+<script type="text/javascript">//<![CDATA[
+	XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "control", "webrestriction", "status")%>', null,
+		function(x, result)
+		{
+			var status = document.getElementsByClassName('webrestriction_status')[0];
+			status.setAttribute("style","font-weight:bold;");
+			status.setAttribute("color",result.status ? "green":"red");
+			status.innerHTML = result.status?'<%=translate("RUNNING")%>':'<%=translate("NOT RUNNING")%>';
+		}
+	)
+//]]>
+</script>

luci-app-control-webrestriction/luasrc/view/webrestriction/webrestriction.htm

@@ -0,0 +1,3 @@
+<%+cbi/valueheader%>
+<font class="webrestriction_status"><%=pcdata(self:cfgvalue(section) or self.default or "")%></font>
+<%+cbi/valuefooter%>

luci-app-control-webrestriction/po/zh-cn/webrestriction.po

@@ -0,0 +1,44 @@
+msgid "Control"
+msgstr "管控"
+
+msgid "Running Status"
+msgstr "运行状态"
+
+msgid "Collecting data..."
+msgstr "正在收集数据..."
+
+msgid "NOT RUNNING"
+msgstr "未运行"
+
+msgid "RUNNING"
+msgstr "运行中"
+
+msgid "Access Control"
+msgstr "访问限制"
+
+msgid "Use the blacklist or whitelist mode to control whether a client in the list can connect to the Internet."
+msgstr "使用黑名单或者白名单模式控制列表中的客户端是否能够连接到互联网。"
+
+msgid "Global setting"
+msgstr "全局设置"
+
+msgid "Enable"
+msgstr "开启"
+
+msgid "Limit mode"
+msgstr "限制模式"
+
+msgid "Whitelist"
+msgstr "白名单"
+
+msgid "Blacklist"
+msgstr "黑名单"
+
+msgid "List setting"
+msgstr "名单设置"
+
+msgid "In blacklist mode, the client in the list is prohibited from connecting to the Internet. In whitelist mode, only the clients in the list can connect to the Internet."
+msgstr "如果是黑名单模式，列表中的客户端将被禁止连接到互联网；白名单模式表示仅有列表中的客户端可以连接到互联网。"
+
+msgid "MAC Address"
+msgstr "MAC 地址"

luci-app-control-webrestriction/po/zh_Hans

@@ -0,0 +1 @@
+zh-cn

luci-app-control-webrestriction/root/etc/config/webrestriction

@@ -0,0 +1,5 @@
+
+config basic
+	option enable '0'
+	option limit_type 'blacklist'
+

luci-app-control-webrestriction/root/etc/init.d/webrestriction

@@ -0,0 +1,86 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2016 fw867 <ffkykzs@gmail.com>
+# Copyright (C) 2024 Lienol
+
+START=99
+
+CONFIG=webrestriction
+ipt="iptables -w"
+ip6t="ip6tables -w"
+
+add_rule(){
+	action=$1
+	local items=$(uci show ${CONFIG} | grep "=macbind" | cut -d '.' -sf 2 | cut -d '=' -sf 1)
+	for i in $items; do
+		enable=$(uci -q get ${CONFIG}.${i}.enable)
+		macaddr=$(uci -q get ${CONFIG}.${i}.macaddr)
+		if [ -z $enable ] || [ -z $macaddr ]; then
+			continue
+		fi
+		if [ "$enable" == "1" ]; then
+			$ipt -A WEB_RESTRICTION -m mac --mac-source $macaddr -j $action
+			$ip6t -A WEB_RESTRICTION -m mac --mac-source $macaddr -j $action 2>/dev/null
+			[ "$limit_type" == "blacklist" ] && {
+				$ipt -t nat -A WEB_RESTRICTION -m mac --mac-source $macaddr -j RETURN
+				$ip6t -t nat -A WEB_RESTRICTION -m mac --mac-source $macaddr -j RETURN 2>/dev/null
+			}
+		fi
+		unset enable macaddr
+	done
+}
+
+start(){
+	stop
+	ENABLED=$(uci -q get ${CONFIG}.@basic[0].enable || echo "0")
+	[ "${ENABLED}" != "1" ] && exit 0
+	limit_type=$(uci -q get ${CONFIG}.@basic[0].limit_type)
+
+	$ipt -N WEB_RESTRICTION
+	$ip6t -N WEB_RESTRICTION 2>/dev/null
+	if [ "$limit_type" == "blacklist" ]; then
+		$ipt -t nat -N WEB_RESTRICTION
+		$ip6t -t nat -N WEB_RESTRICTION 2>/dev/null
+		add_rule DROP
+	else
+		add_rule ACCEPT
+		$ipt -A WEB_RESTRICTION -j DROP
+		$ip6t -A WEB_RESTRICTION -j DROP 2>/dev/null
+	fi
+
+	#获取FORWARD ACCEPT规则行号
+	FA_INDEX=`$ipt -L FORWARD --line-numbers | tail -n +3 | grep -E ACCEPT | grep ctstate | grep fw3 | awk '{print $1}'`
+	[ -n "$FA_INDEX" ] && let FA_INDEX+=1
+	$ipt -I FORWARD $FA_INDEX -j WEB_RESTRICTION
+
+	#获取FORWARD ACCEPT规则行号
+	FA_INDEX=`$ip6t -L FORWARD --line-numbers | tail -n +3 | grep -E ACCEPT | grep ctstate | grep fw3 | awk '{print $1}'`
+	[ -n "$FA_INDEX" ] && let FA_INDEX+=1
+	$ip6t -I FORWARD $FA_INDEX -j WEB_RESTRICTION
+
+	[ "$limit_type" == "blacklist" ] && {
+		$ipt -t nat -I PREROUTING 1 -j WEB_RESTRICTION
+		$ip6t -t nat -I PREROUTING 1 -j WEB_RESTRICTION 2>/dev/null
+	}
+}
+stop(){
+	ipt_del() {
+		for i in $(seq 1 $($1 -nL $2 | grep -c "WEB_RESTRICTION")); do
+			local index=$($1 --line-number -nL $2 | grep "WEB_RESTRICTION" | head -1 | awk '{print $1}')
+			$1 -w -D $2 $index 2>/dev/null
+		done
+	}
+	ipt_del "$ipt" "FORWARD"
+	ipt_del "$ipt" "INPUT"
+	ipt_del "$ipt -t nat" "PREROUTING"
+	ipt_del "$ip6t" "FORWARD"
+	ipt_del "$ip6t" "INPUT"
+	ipt_del "$ip6t -t nat" "PREROUTING"
+	$ipt -F WEB_RESTRICTION 2>/dev/null
+	$ipt -X WEB_RESTRICTION 2>/dev/null
+	$ipt -t nat -F WEB_RESTRICTION 2>/dev/null
+	$ipt -t nat -X WEB_RESTRICTION 2>/dev/null
+	$ip6t -F WEB_RESTRICTION 2>/dev/null
+	$ip6t -X WEB_RESTRICTION 2>/dev/null
+	$ip6t -t nat -F WEB_RESTRICTION 2>/dev/null
+	$ip6t -t nat -X WEB_RESTRICTION 2>/dev/null
+}

luci-app-control-webrestriction/root/etc/uci-defaults/luci-app-control-webrestriction

@@ -0,0 +1,19 @@
+#!/bin/sh
+[ ! -f "/usr/share/ucitrack/luci-app-webrestriction.json" ] && {
+    cat > /usr/share/ucitrack/luci-app-webrestriction.json << EEOF
+{
+    "config": "webrestriction",
+    "init": "webrestriction"
+}
+EEOF
+}
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@webrestriction[-1]
+	add ucitrack webrestriction
+	set ucitrack.@webrestriction[-1].init=webrestriction
+	commit ucitrack
+EOF
+
+rm -f /tmp/luci-indexcache
+exit 0

luci-app-control-webrestriction/root/usr/share/rpcd/acl.d/luci-app-control-webrestriction.json

@@ -0,0 +1,11 @@
+{
+	"luci-app-control-webrestriction": {
+		"description": "Grant UCI access for luci-app-control-webrestriction",
+		"read": {
+			"uci": [ "webrestriction" ]
+		},
+		"write": {
+			"uci": [ "webrestriction" ]
+		}
+	}
+}

luci-app-control-webrestriction/root/usr/share/ucitrack/luci-app-control-webrestriction.json

@@ -0,0 +1,4 @@
+{
+	"config": "webrestriction",
+	"init": "webrestriction"
+}