mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-29 18:05:13 +08:00
🌴 Sync 2026-03-05 23:51:42
This commit is contained in:
github-actions[bot] committed
1 parent
97c049ed0a
commit
0acff03804
14253 files changed
+3893239
No files matched your search
@@ -0,0 +1,20 @@
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-ikoolproxy
|
||||
PKG_VERSION:=3.8.5
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_MAINTAINER:=panda-mute <wxuzju@gmail.com>
|
||||
|
||||
LUCI_TITLE:=LuCI support for koolproxy
|
||||
LUCI_PKGARCH:=all
|
||||
LUCI_DEPENDS:=+koolproxy +openssl-util +ipset +dnsmasq-full +@BUSYBOX_CONFIG_DIFF +iptables-mod-nat-extra +wget
|
||||
|
||||
define Package/$(PKG_NAME)/conffiles
|
||||
/etc/config/koolproxy
|
||||
/usr/share/koolproxy/data/rules/
|
||||
endef
|
||||
|
||||
include $(TOPDIR)/feeds/luci/luci.mk
|
||||
|
||||
# call BuildPackage - OpenWrt buildroot signature
|
||||
@@ -0,0 +1,131 @@
|
||||
## How to build
|
||||
git clone -b main https://github.com/ilxp/luci-app-ikoolproxy.git package/diy/luci-app-ikoolproxy
|
||||
|
||||
## 无法下载证书声明（2024.06.10版本已经解决此问题，感谢[Black-Steel](https://github.com/Black-Steel)）：
|
||||
目前因为openwrt的openssl升级为3.0了。导致ikoolproxy无法下载证书。lean大佬的lede可以回退。openwrt则不行。
|
||||
|
||||
## 整理声明：
|
||||
iKoolProxy是 [Beginner-Go](https://github.com/Beginner-Go) 大神基于koolproxyR重新整理而来的。主要参考：
|
||||
|
||||
1、以前Ameykyl大神的 [KoolProxyR](https://github.com/Ameykyl/luci-app-koolproxyR) (源码已经2020年4月删除）。源码来源于 [project-openwrt](https://github.com/project-openwrt/luci-app-koolproxyR) 收录的ameykyl的2020年3月最后一次更新。
|
||||
|
||||
2、感谢koolproxy官方组、shaoxia、Ameykyl、immortalwrt组、Beginner-Go等的无私奉献！
|
||||
|
||||
3、规则来源于 [KoolProxy](https://github.com/iwrt/koolproxy) 。在此特别鸣谢 [houzi-](https://github.com/houzi-) 。
|
||||
|
||||
## 本来是完全没有必要再造一个的，因为浪费时间。但各位大神都好久没有更新了，有些规则更新需要翻墙，有些名字是KP，有些是KPR，KPR Plus，KPR Plus+。既然在koolproxy上整理而来就暂且叫iKoolProxy。望理解！
|
||||
|
||||
|
||||
## 免责声明：
|
||||
KoolProxy 是一个免费软件，著作权归属 KoolProxy.com，用户可以非商业性地复制和使用 KoolProxy，但禁止将 KoolProxy 用于商业用途。
|
||||
KoolProxy 可以对 https 网络数据进行识别代理，使用 https 功能的用户需要自己提供相关证书，本程序提供的证书生成脚本仅供用户参考，证书的保密工作由用户自行负责。
|
||||
使用本软件的风险由用户自行承担，在适用法律允许的最大范围内，对因使用本产品所产生的损害及风险，包括但不限于直接或间接的个人损害、商业赢利的丧失、贸易中断、商业信息的丢失或任何其它经济损失，KoolProxy.com 不承担任何责任。
|
||||
|
||||
## 1、前言
|
||||
感謝 koolshare.cn 提供 KoolProxy, 使用风险由用户自行承担
|
||||
本程序运行需要联网下载最新的 KoolProxy 到内存中运行, 也正因此本程序大小可以忽略不计.
|
||||
|
||||
## 2、简介
|
||||
本软件包是 KoolProxy 的 LuCI 控制界面,
|
||||
|
||||
## 3、软件包文件结构:
|
||||
省
|
||||
|
||||
## 4、依赖
|
||||
软件包的正常使用需要依赖 curl, dnsmasq-full, iptables, ipset 和 dnsmasq-extra, openssl-util, diffutils, iptables-mod-nat-extra, wget, ca-bundle, ca-certificates, libustream-openssl
|
||||
|
||||
手动安装：在终端运行：
|
||||
opkg install openssl-util ipset dnsmasq-full diffutils iptables-mod-nat-extra wget ca-bundle ca-certificates libustream-openssl
|
||||
|
||||
如果没有 openssl ，就不能正常生成证书，导致https过滤失败！
|
||||
|
||||
如果没有 ipset, dnsmasq-full, diffutils，黑名单模式也会出现问题！（ipset 需要版本6）,如果你的固件的busybox带有支持diff支持，那么diffutils包可以不安装
|
||||
|
||||
如果没有 iptables-mod-nat-extra ，会导致mac过滤失效！
|
||||
|
||||
如果没有 wget, ca-bundle, ca-certificates, libustream-openssl，lua-openssl，会导致规则文件更新失败，host规则条数变为0,如果你的固件的busybox带有支持https的wget，那么这几个包可以不安装。
|
||||
|
||||
|
||||
懒人版本，在.config文件里添加如下代码：
|
||||
|
||||
#koolproxy支持
|
||||
|
||||
CONFIG_PACKAGE_iptables-mod-nat-extra=y
|
||||
|
||||
CONFIG_PACKAGE_kmod-ipt-extra=y
|
||||
|
||||
CONFIG_PACKAGE_diffutils=y
|
||||
|
||||
CONFIG_PACKAGE_openssl-util=y
|
||||
|
||||
CONFIG_PACKAGE_dnsmasq-full=y
|
||||
|
||||
CONFIG_PACKAGE_ca-bundle=y
|
||||
|
||||
CONFIG_PACKAGE_ca-certificates=y
|
||||
|
||||
CONFIG_PACKAGE_libustream-openssl=y
|
||||
|
||||
CONFIG_PACKAGE_lua-openssl=y
|
||||
|
||||
|
||||
## 5、配置,
|
||||
软件包的配置文件路径: /etc/config/koolproxy
|
||||
此文件为 UCI 配置文件, 配置方式可参考 Wiki -> Use-UCI-system 和 OpenWrt Wiki
|
||||
|
||||
## 6、编译
|
||||
git clone -b main https://github.com/ilxp/luci-app-ikoolproxy.git package/diy/luci-app-ikoolproxy
|
||||
|
||||
make && sudo make install
|
||||
|
||||
选择要编译的包 LuCI -> 3. Applications
|
||||
|
||||
make menuconfig
|
||||
|
||||
开始编译
|
||||
|
||||
make package/feeds/luci-app-ikoolproxy/compile V=s
|
||||
|
||||
# 7、关于IPv6支持(基于透明代理一刀切)
|
||||
需要在防火墙添加一条规则：
|
||||
|
||||
ip6tables -t nat -I PREROUTING -p tcp -j REDIRECT --to-ports 3000
|
||||
|
||||
```
|
||||
#已知副作用:
|
||||
#一刀切劫持内网所以设备的IPv6 TCP流量.
|
||||
#无法使用IPv6建立主动传入连接.
|
||||
#如果未安装证书,打开启用HTTPS的网站会报错.
|
||||
```
|
||||
|
||||
**NOTE:**
|
||||
|
||||
如果出现国外流量无法去广告(IPv4),请修改所使用代理的防火墙规则,必须让KP的规则在代理规则之上,检测命令:
|
||||
|
||||
``` bash
|
||||
iptables -t nat -L PREROUTING
|
||||
```
|
||||
|
||||
观察**KOOLPROXY**规则是否在所使用的代理的规则之上.
|
||||
|
||||
### 8、内置规则列表
|
||||
|
||||
[静态规则] [每日规则] [视频规则] [ipse] [adblock]
|
||||
|
||||
### 9、第三方规则（已做了转换，koolproxy能识别，不要用乘风大神的通用规则，会导致koolproxy停止运行）
|
||||
|
||||
[AdGuard规则]
|
||||
|
||||
[Yhosts规则]
|
||||
|
||||
[Steven规则]
|
||||
|
||||
[AntiAD规则]
|
||||
|
||||
[坂本规则]
|
||||
|
||||
### 10、订阅规则（user1121114685大神和某位大神（忘记名字了）整合而成，能过滤youtube等）
|
||||
|
||||
[订阅规则]
|
||||
|
||||
### 首次运行koolproxy的时候，保存并提交速度较慢，因为会生成证书。
|
||||
@@ -0,0 +1,28 @@
|
||||
## 更新：2024年6月10日：
|
||||
1、修复openssl3.0无法下载证书问题，感谢[Black-Steel](https://github.com/Black-Steel)
|
||||
2、修复init.d目录下的脚本有stop实现，但是没定义停止编号。会导致一些异常。感谢[lnc1995](https://github.com/lnc1995)
|
||||
|
||||
## 更新：2024年1月24日：
|
||||
1、支持5.10以及以上内核。但是因为openssl升级可能会导致证书无法下载。目前lean的openssl可以回退到老的版本即可。
|
||||
|
||||
## 更新：2022年10月11日：
|
||||
1、感谢群里Mr Conter（@biliconter）提供修复证书过期的二进制文件。
|
||||
|
||||
## 更新：2022年3月24日：
|
||||
1、删除以前所有commits。升级到了最新的comiits：其中重要的几次如下
|
||||
|
||||
## 更新：2022年2月12日：
|
||||
删除不必要的rmempty：luci-app-ikoolproxy: drop rmempty
|
||||
感谢 [Beginner-Go](https://github.com/Beginner-Go)
|
||||
|
||||
## 更新：2022年1月3日：
|
||||
感谢 [Beginner-Go](https://github.com/Beginner-Go) 升级koolproxy: x86_64 bin update to 3.8.6
|
||||
|
||||
## 更新：2021年3月23日：
|
||||
感谢 [maple's sky](https://github.com/maplesky) 大佬提供技术支持，修复状态栏不动态问题。
|
||||
|
||||
## 更新：2021年3月4日：
|
||||
感谢 [xiaoqi2020](https://github.com/xiaoqi2020) 提供，选择规则托管国内。
|
||||
|
||||
## 更新：2021年2月26日（元宵）：
|
||||
原来的码云以及coding规则已经无法获取（被封）了。现在托管在github上。
|
||||
@@ -0,0 +1,194 @@
|
||||
koolproxy插件/固件开发文档1.3
|
||||
更新日期：2017年7月7日（koolproxy 3.6.1）
|
||||
|
||||
================================================================================================
|
||||
声明：
|
||||
KoolProxy 是一个免费软件，著作权归属 KoolProxy.com，用户可以非商业性地复制和使用 KoolProxy，但禁止将 KoolProxy 用于商业用途。
|
||||
KoolProxy 可以对 https 网络数据进行识别代理，使用 https 功能的用户需要自己提供相关证书，本程序提供的证书生成脚本仅供用户参考，证书的保密工作由用户自行负责。
|
||||
使用本软件的风险由用户自行承担，在适用法律允许的最大范围内，对因使用本产品所产生的损害及风险，包括但不限于直接或间接的个人损害、商业赢利的丧失、贸易中断、商业信息的丢失或任何其它经济损失，KoolProxy.com 不承担任何责任。
|
||||
|
||||
================================================================================================
|
||||
KoolProxy By Xiaobao & Crwnet v3.6.1
|
||||
|
||||
USAGE:
|
||||
koolproxy [options] [arguments...]
|
||||
|
||||
OPTIONS:
|
||||
-p value listen port, default value is 3000
|
||||
-l value log level (0:DEBUG, 1:INFO, 2:AD, 3:WARNING, 4:ERROR), default value is ERROR
|
||||
-c value thread count, default value is the number of cpus
|
||||
-b value data path, default value is './data'
|
||||
-d run as daemon mode
|
||||
-v show version
|
||||
-h show help
|
||||
|
||||
ADVANCED:
|
||||
--cert generate ssl cert
|
||||
--ipv6 enable ipv6, works for ipv6 nat mode
|
||||
--video | -e video mode, load video rules only
|
||||
--mark mark mode, set the socket mark(src ip) when connect to remote host. requires the CAP_NET_ADMIN capability
|
||||
--ttl value ttl mode, set the socket ttl when connect to remote host. default value is 0 (disable)
|
||||
|
||||
================================================================================================
|
||||
交流地址：
|
||||
1 QQ群1： 595300867
|
||||
2 QQ群2： 203726739
|
||||
3 TG群： https://t.me/joinchat/AAAAAD-tO7GPvfOU131_vg
|
||||
4 更新日志：http://koolshare.cn/thread-64086-1-1.html
|
||||
|
||||
================================================================================================
|
||||
#koolproxy部署文件目录参考1（使用openssl生成证书）
|
||||
.
|
||||
├── data
|
||||
│ ├── gen_ca.sh #证书生成脚本
|
||||
│ ├── koolproxy_ipset.conf #ipset名单
|
||||
│ ├── openssl.cnf #证书生成所用配置文件
|
||||
│ ├── rules #规则存放文件夹
|
||||
│ │ ├── kp.dat #视频规则
|
||||
│ │ ├── koolproxy.txt #静态规则
|
||||
│ │ ├── daily.txt #每日规则
|
||||
│ │ └── user.txt #自定义规则
|
||||
│ └── version #插件版本号(merlin)
|
||||
└── koolproxy #koolproxy二进制(为了保证二进制顺利更新，请保证目录可写)
|
||||
|
||||
1 证书生成使用命令 sh gen_ca.sh，该脚本会调用系统内的openssl来生成证书，运行成功后会自动创建data/private data/cert目录
|
||||
私钥和公钥会分别存在data/private data/cert目录下，使用http://110.110.110.110会下载路由器内的证书
|
||||
|
||||
------------------------------------------------------------------------------------------------
|
||||
#koolproxy部署文件目录参考2（使用koolproxy生成证书）
|
||||
.
|
||||
└── koolproxy #koolproxy二进制(为了保证二进制顺利更新，请保证目录可写)
|
||||
1 因为规则文件会由koolproxy自动下载,下载后会自动创建data/rules目录
|
||||
2 使用koolproxy --cert命令可以生成证书，运行成功后会自动创建data/private data/cert目录
|
||||
私钥和公钥会分别存在data/private data/cert目录下，使用http://110.110.110.110会下载路由器内的证书
|
||||
因为mbedtls性能原因，在非软路由机器上用koolproxy --cert生成证书需要时间较长，请耐心等待
|
||||
|
||||
================================================================================================
|
||||
说明：
|
||||
1 koolproxy启动会自动检测规则更新，如果没有./data/rules文件夹，会自己创建并下载规则到此处
|
||||
2 koolproxy启动后会检测二进制文件更新，如果有更新，会替换./koolproxy，并且由父进程重启koolproxy，以后每20分钟检测一次更新
|
||||
3 现在不支持规则订阅了，只能识别kp.dat, koolproxy.txt, user.txt,daily.txt，需要自定义规则的可以修改user.txt
|
||||
|
||||
# 二进制下载固定地址
|
||||
https://koolproxy.com/downloads/i386
|
||||
https://koolproxy.com/downloads/x86_64
|
||||
https://koolproxy.com/downloads/arm
|
||||
https://koolproxy.com/downloads/mips
|
||||
https://koolproxy.com/downloads/mipsel
|
||||
|
||||
# 规则下载固定地址
|
||||
https://kprule.com/koolproxy.txt
|
||||
https://kprule.com/daily.txt
|
||||
https://kprule.com/kp.dat
|
||||
https://kprule.com/user.txt
|
||||
|
||||
# 规则下载对应的CDN地址
|
||||
https://kprules.b0.upaiyun.com/koolproxy.txt
|
||||
https://kprules.b0.upaiyun.com/daily.txt
|
||||
https://kprules.b0.upaiyun.com/kp.dat
|
||||
https://kprules.b0.upaiyun.com/user.txt
|
||||
|
||||
# 二进制文件和规则 github备份地址：
|
||||
二进制：https://github.com/koolproxy/koolproxy-bin (已作废)
|
||||
规则：https://github.com/koolproxy/koolproxy_rules (已作废)
|
||||
|
||||
|
||||
1 建议从上面的链接获取最新的二进制和基本的规则文件，然后按照上面的目录结构来部署
|
||||
2 如果不需要https过滤，只需要一个koolproxy程序就足够了，data文件夹和rules文件夹都会自己创建。
|
||||
3 koolproxy.txt内有视频规则、静态规则、每日规则的更新日期，可以用于提取并显示到界面
|
||||
|
||||
================================================================================================
|
||||
koolproxy运行：
|
||||
|
||||
1 在koolproxy主程序目录运行，例如merlin固件下运行：cd /koolshare/koolproxy && koolproxy -d
|
||||
2 不在koolproxy主程序目录运行（例如将koolproxy放在环境变量中），例如merlin固件下运行：koolproxy -b /koolshare/koolproxy -d -b为data路径
|
||||
其它运行方式可能会造成koolproxy识别不到data目录而无法加载规则
|
||||
koolproxy运行后默认会使用端口3000作为透明代理端口，需要利用iptables将数据导到端口3000才能发挥作用。
|
||||
|
||||
视频模式：
|
||||
1 使用命令koolproxy -e 即可开启
|
||||
2 开启后只会加载视频规则kp.dat和user.txt
|
||||
|
||||
调试模式：
|
||||
1 使用命令koolproxy -l0 即可开启，l后面的数字代表不同的日志详细程度
|
||||
2 需要检查规则命中行数可以需要使用-l2
|
||||
|
||||
ttl功能：
|
||||
1 使用命令koolproxy --ttl 160 即可开启ttl功能，后面的数值代表ttl大小
|
||||
2 ttl功能开启后，koolproxy会对经过它的所有数据ttl进行调整，可以利用iptables的match ttl功能数据进行匹配
|
||||
|
||||
mark功能：
|
||||
1 使用命令koolproxy --mark 即可开启mark功能
|
||||
2 mark功能开启后，koolproxy会对经过它的所有数据打上标记，mark值等于该数据的源ip转换为十六进制的值
|
||||
3 例如局域网内192.168.1.100的数据，将会被打上0xc0a80164的mark（192 = c0, 168 = a8, 1 = 01, 100 = 64 ）
|
||||
4 开发者可以用此功和SS配合，达到既科学上网，又能过滤这些科学上网的流量，还不影响科学上网访问控制的功能
|
||||
5 ip转换为mark值参考命令：echo 192.168.1.100 | awk -F "." '{printf ("0x%02x", $1)} {printf ("%02x", $2)} {printf ("%02x", $3)} {printf ("%02x\n", $4)}'
|
||||
|
||||
================================================================================================
|
||||
ss + kp过滤方案（2017年7月7日）：
|
||||
|
||||
方案1（优先SS，其次KP，不推荐）：
|
||||
1 在NAT PREROUTING链内，SS在前，KP在后，流量将先走SS，经过SS分流后，国外流量走ss-redir，实现翻墙；
|
||||
2 而剩下国内流量在PREROUTING链内继续往下匹配到koolrpxy规则，流量最终走koolproxy，实现过滤。
|
||||
结果：koolproxy只能过滤国内流量（SS剩下的）。
|
||||
|
||||
方案2（优先KP，其次SS，不推荐）;
|
||||
1 在NAT PREROUTING链内，KP在前，SS在后，流量将先走KP，实现过滤；
|
||||
2 为了SS能拿到KP过滤后的数据，使用match ttl匹配，在OUTPUT链内将流量全部给SS，实现翻墙；
|
||||
结果：因为在OUTPUT链内没有源ip信息，流量给SS后无法匹配到源ip，因此SS失去了acl（访问控制）功能。
|
||||
|
||||
方案3 (优先kp，其次SS，推荐)；
|
||||
为便于理解，以下iptables配置只展示流量经过顺序，不是iptables的创建顺序，PREROUTING内规则的创建实际上应该在最后
|
||||
0 koolproxy默认开启ttl和mark功能 KoolProxy --ttl 160 --mark -d（固件不支持ttl的仅开启mark也行: KoolProxy --mark -d）
|
||||
1 在NAT PREROUTING链内，KP在前，SS在后，KP开启--mark，流量将先走KP（80,443），实现过滤，过滤后每个主机会被打上不同的mark；
|
||||
#KP在前，所有tcp流量全部交给KOOLPROXY链
|
||||
-A PREROUTING -p tcp -j KOOLPROXY
|
||||
#SS在后，在kp开启的时候，只能拿到非80,443的流量，在kp关闭后，可以拿到所有端口的流量
|
||||
-A PREROUTING -p tcp -j SHADOWSOCKS
|
||||
|
||||
2 例如局域网内192.168.1.100主机的数据经过kp过滤后，将会被打上0xc0a80164的mark（192 = c0, 168 = a8, 1 = 01, 100 = 64 ）；
|
||||
#创建KOOLPROXY链，用于白名单和访问控制
|
||||
-N KOOLPROXY
|
||||
#创建KOOLPROXY_HTTP链，用于过滤http流量
|
||||
-N KOOLPROXY_HTTP
|
||||
#创建KOOLPROXY_HTTPS链，用于过滤https流量
|
||||
-N KOOLPROXY_HTTPS
|
||||
#局域网和保留地址不走kp
|
||||
-A KOOLPROXY -m set --match-set white_kp_list dst -j RETURN
|
||||
#主机192.168.1.100需要https过滤
|
||||
-A KOOLPROXY -s 192.168.1.100/32 -p tcp -g KOOLPROXY_HTTPS
|
||||
#其它主机过滤http流量
|
||||
-A KOOLPROXY -p tcp -j KOOLPROXY_HTTP
|
||||
|
||||
3 为了SS能拿到数据，在NAT OUTPUT链中，使用match ttl匹配，在OUTPUT链内将流量全部给SHADOWSOCKS_EXT链；
|
||||
#创建SHADOWSOCKS_EXT链，用于开启kp情况下ss的访问控制实现
|
||||
-N SHADOWSOCKS_EXT
|
||||
#使用ttl匹配将KP过滤后的数据转到SHADOWSOCKS_EXT链（如果固件不支持ttl匹配，使用下面的命令）
|
||||
-A OUTPUT -p tcp -m ttl --ttl-eq 160 -j SHADOWSOCKS_EXT
|
||||
#如果固件不支持ttl match，可以用mark匹配ip地址的前三位（用0xffffff00作为掩码的形式），来将KP过滤后的数据转到SHADOWSOCKS_EXT链
|
||||
# echo 192.168.1 | awk -F "." '{printf ("0x%02x", $1)} {printf ("%02x", $2)} {printf ("%02x", $3)} {printf ("00/0xffffff00\n")}' = 0xc0a80100/0xffffff00
|
||||
-A OUTPUT -p tcp -m mark --mark 0xc0a80100/0xffffff00 -j SHADOWSOCKS_EXT
|
||||
|
||||
4 如果开启了acl，比如需要192.168.1.75不走SS（全端口），192.168.1.246走gfwlist模式（80,443端口），192.168.1.214走大陆白名单模式（22,80,443端口），剩余主机全部走大陆白名单模式（全端口）：
|
||||
#主机192.168.1.75（0xc0a8014b），流量经过KP过滤后并打上mark后，通过OUTPUT链进入SHADOWSOCKS_EXT链，而未能翻墙（RETURN）
|
||||
-A SHADOWSOCKS_EXT -p tcp -m mark --mark 0xc0a8014b -j RETURN
|
||||
#主机192.168.1.246（0xc0a801f6），流量经过KP过滤后并打上mark后，通过OUTPUT链进入SHADOWSOCKS_EXT链，在此流量被导向了SHADOWSOCKS_GFW链，实现gfwlist模式翻墙（80,443端口）
|
||||
-A SHADOWSOCKS_EXT -p tcp -m multiport --dports 80,443 -m mark --mark 0xc0a801f6 -g SHADOWSOCKS_GFW
|
||||
#主机192.168.1.214（0xc0a801f6），流量经过KP过滤后并打上mark后，通过OUTPUT链进入SHADOWSOCKS_EXT链，在此流量被导向了SHADOWSOCKS_CHN链，实现大陆白名单模式翻墙（22,80,443端口）
|
||||
-A SHADOWSOCKS_EXT -p tcp -m multiport --dports 22,,80,443 -m mark --mark 0xc0a801d6 -g SHADOWSOCKS_CHN
|
||||
#剩余的主机，流量经过KP过滤后并打上mark后，通过OUTPUT链进入SHADOWSOCKS_EXT链，在此流量被导向了SHADOWSOCKS_CHN链，实现大陆白名单模式翻墙（全端口）
|
||||
-A SHADOWSOCKS_EXT -p tcp -j SHADOWSOCKS_CHN
|
||||
|
||||
情形：
|
||||
1 当SS开启，kp未开启：所有流量走ss PREROUTING过，经过分流后，国内的流量在经过OUTPUT的时候，因为KP没开，数据不会匹配到ttl值（或者没匹配到mark值），所以不会过滤广告，翻墙正常
|
||||
2 当KP开启，SS未开启，所有流量走kp PREROUTING过，广告过滤正常
|
||||
3 当SS开启，翻墙和acl工作正常的时候，开启KP：KP在PREROUTING内插入到SS前面，会先得到流量，广告过滤正常
|
||||
4 当KP开启，过滤广告正常的时候，开启SS：SS从原来的从PREROUTING拿流量变成从OUTPUT内拿流量，翻墙和acl会同样正常
|
||||
5 当KP和SS都开启，此时关闭SS，kp过滤广告正常
|
||||
6 当KP和SS都开启，此时关闭KP，ss翻墙和acl正常
|
||||
|
||||
总结：
|
||||
使用 ttl + mark （或者纯mark）的方式，可以实现原先很难实现的过滤经过SS流量的广告
|
||||
主要的改动在于给SS预置好OUTPUT和SHADOWSOCKS_EXT规则链，当kp启用时，它们就会工作，kp关闭时，不会影响正常数据
|
||||
次要的改动就是给koolproxy默认开启ttl + mark（或者纯mark）功能
|
||||
================================================================================================
|
||||
@@ -0,0 +1,43 @@
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=koolproxy
|
||||
PKG_VERSION:=3.8.5
|
||||
PKG_RELEASE:=$(AUTORELEASE)
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
define Package/koolproxy
|
||||
SECTION:=multimedia
|
||||
CATEGORY:=Multimedia
|
||||
DEPENDS:=@(aarch64||arm||i386||mips||mipsel||x86_64)
|
||||
TITLE:=koolproxy bin is from koolshare
|
||||
URL:=https://github.com/houzi-/CDN
|
||||
endef
|
||||
|
||||
define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/koolproxy/install
|
||||
$(INSTALL_DIR) $(1)/usr/share/koolproxy
|
||||
|
||||
ifeq ($(ARCH),aarch64)
|
||||
$(INSTALL_BIN) ./files/aarch64 $(1)/usr/share/koolproxy/koolproxy
|
||||
|
||||
else ifeq ($(ARCH),arm)
|
||||
$(INSTALL_BIN) ./files/arm $(1)/usr/share/koolproxy/koolproxy
|
||||
|
||||
else ifeq ($(ARCH),i386)
|
||||
$(INSTALL_BIN) ./files/i386 $(1)/usr/share/koolproxy/koolproxy
|
||||
|
||||
else ifeq ($(ARCH),mips)
|
||||
$(INSTALL_BIN) ./files/mips $(1)/usr/share/koolproxy/koolproxy
|
||||
|
||||
else ifeq ($(ARCH),mipsel)
|
||||
$(INSTALL_BIN) ./files/mipsel $(1)/usr/share/koolproxy/koolproxy
|
||||
|
||||
else ifeq ($(ARCH),x86_64)
|
||||
$(INSTALL_BIN) ./files/x86_64 $(1)/usr/share/koolproxy/koolproxy
|
||||
endif
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,koolproxy))
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,30 @@
|
||||
module("luci.controller.koolproxy",package.seeall)
|
||||
|
||||
function index()
|
||||
if not nixio.fs.access("/etc/config/koolproxy") then
|
||||
return
|
||||
end
|
||||
|
||||
entry({"admin", "services", "koolproxy"}, alias("admin", "services", "koolproxy", "basic"), _("iKoolProxy 滤广告"), 1).dependent = true
|
||||
entry({"admin", "services", "koolproxy", "basic"}, cbi("koolproxy/basic"), _("基本设置"), 1).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "control"}, cbi("koolproxy/control"), _("访问控制"), 2).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "add_rule"}, cbi("koolproxy/add_rule"), _("规则订阅"), 3).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "cert"}, cbi("koolproxy/cert"), _("证书管理"), 4).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "white_list"}, cbi("koolproxy/white_list"), _("网站白名单设置"), 5).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "black_list"}, cbi("koolproxy/black_list"), _("网站黑名单设置"), 6).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "ip_white_list"}, cbi("koolproxy/ip_white_list"), _("IP白名单设置"), 7).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "ip_black_list"}, cbi("koolproxy/ip_black_list"), _("IP黑名单设置"), 8).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "custom_rule"}, cbi("koolproxy/custom_rule"), _("自定义规则"), 9).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "update_log"}, cbi("koolproxy/update_log"), _("更新日志"), 10).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "tips"}, cbi("koolproxy/tips"), _("帮助支持"), 11).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "rss_rule"}, cbi("koolproxy/rss_rule"), nil).leaf = true
|
||||
entry({"admin", "services", "koolproxy", "status"}, call("act_status")).leaf = true
|
||||
end
|
||||
|
||||
function act_status()
|
||||
local e = {}
|
||||
e.running = luci.sys.call("pidof koolproxy >/dev/null") == 0
|
||||
e.bin_version = luci.sys.exec("/usr/share/koolproxy/koolproxy -v")
|
||||
luci.http.prepare_content("application/json")
|
||||
luci.http.write_json(e)
|
||||
end
|
||||
@@ -0,0 +1,34 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection,"rss_rule", translate("iKoolProxy 规则订阅"))
|
||||
t.description = translate("请确保订阅规则的兼容性")
|
||||
t.anonymous = true
|
||||
t.addremove = true
|
||||
t.sortable = true
|
||||
t.template = "cbi/tblsection"
|
||||
t.extedit = luci.dispatcher.build_url("admin/services/koolproxy/rss_rule/%s")
|
||||
|
||||
t.create = function(...)
|
||||
local sid = TypedSection.create(...)
|
||||
if sid then
|
||||
luci.http.redirect(t.extedit % sid)
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
e = t:option(Flag, "load", translate("启用"))
|
||||
e.default = 0
|
||||
|
||||
e = t:option(DummyValue, "name", translate("规则名称"))
|
||||
function e.cfgvalue(...)
|
||||
return Value.cfgvalue(...) or translate("None")
|
||||
end
|
||||
|
||||
e = t:option(DummyValue,"url", translate("规则地址"))
|
||||
function e.cfgvalue(...)
|
||||
return Value.cfgvalue(...) or translate("None")
|
||||
end
|
||||
|
||||
e = t:option(DummyValue, "time", translate("更新时间"))
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,100 @@
|
||||
|
||||
local o,t,e
|
||||
local a = luci.sys.exec("head -3 /usr/share/koolproxy/data/rules/koolproxy.txt | grep rules | awk -F' ' '{print $3,$4}'")
|
||||
local b = luci.sys.exec("head -4 /usr/share/koolproxy/data/rules/koolproxy.txt | grep video | awk -F' ' '{print $3,$4}'")
|
||||
local c = luci.sys.exec("head -3 /usr/share/koolproxy/data/rules/daily.txt | grep rules | awk -F' ' '{print $3,$4}'")
|
||||
local s = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/adg.txt | wc -l")
|
||||
local m = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/adgk.txt | wc -l")
|
||||
local u = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/steven.txt | wc -l")
|
||||
local p = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/yhosts.txt | wc -l")
|
||||
local h = luci.sys.exec("grep -v '^!' /usr/share/koolproxy/data/rules/user.txt | wc -l")
|
||||
local l = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/koolproxy.txt | wc -l")
|
||||
local q = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/daily.txt | wc -l")
|
||||
local f = luci.sys.exec("grep -v !x /usr/share/koolproxy/data/rules/antiad.txt | wc -l")
|
||||
local i = luci.sys.exec("cat /usr/share/koolproxy/dnsmasq.adblock | wc -l")
|
||||
|
||||
o = Map("koolproxy")
|
||||
o.title = translate("iKoolProxy滤广告")
|
||||
o.description = translate("iKoolProxy是基于KoolProxyR重新整理的能识别adblock规则的免费开源软件,追求体验更快、更清洁的网络，屏蔽烦人的广告！")
|
||||
|
||||
o:section(SimpleSection).template = "koolproxy/koolproxy_status"
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(Flag, "enabled", translate("启用"))
|
||||
e.default = 0
|
||||
|
||||
e = t:option(Value, "startup_delay", translate("启动延迟"))
|
||||
e:value(0, translate("不启用"))
|
||||
for _, v in ipairs({5, 10, 15, 25, 40, 60}) do
|
||||
e:value(v, translate("%u 秒") %{v})
|
||||
end
|
||||
e.datatype = "uinteger"
|
||||
e.default = 0
|
||||
|
||||
e = t:option(ListValue, "koolproxy_mode", translate("过滤模式"))
|
||||
e:value(1, translate("全局模式"))
|
||||
e:value(2, translate("IPSET模式"))
|
||||
e:value(3, translate("视频模式"))
|
||||
e.default = 1
|
||||
|
||||
e = t:option(MultiValue, "koolproxy_rules", translate("内置规则"))
|
||||
e:value("koolproxy.txt", translate("静态规则"))
|
||||
e:value("daily.txt", translate("每日规则"))
|
||||
e:value("kp.dat", translate("视频规则"))
|
||||
e:value("user.txt", translate("自定义规则"))
|
||||
e.optional = false
|
||||
|
||||
e = t:option(MultiValue, "thirdparty_rules", translate("第三方规则"))
|
||||
e:value("adg.txt", translate("AdGuard规则"))
|
||||
e:value("steven.txt", translate("Steven规则"))
|
||||
e:value("yhosts.txt", translate("Yhosts规则"))
|
||||
e:value("antiad.txt", translate("AntiAD规则"))
|
||||
e:value("adgk.txt", translate("Banben规则"))
|
||||
e.optional = false
|
||||
|
||||
e = t:option(ListValue, "koolproxy_port", translate("端口控制"))
|
||||
e:value(0, translate("关闭"))
|
||||
e:value(1, translate("开启"))
|
||||
e.default = 0
|
||||
|
||||
--e = t:option(ListValue, "koolproxy_ipv6", translate("IPv6支持"))
|
||||
--e:value(0, translate("关闭"))
|
||||
--e:value(1, translate("开启"))
|
||||
--e.default = 0
|
||||
|
||||
e = t:option(Value, "koolproxy_bp_port", translate("例外端口"))
|
||||
e.description = translate("单端口:80 多端口:80,443")
|
||||
e:depends("koolproxy_port", "1")
|
||||
|
||||
e = t:option(Flag, "koolproxy_host", translate("开启Adblock Plus Hosts"))
|
||||
e:depends("koolproxy_mode","2")
|
||||
e.default = 0
|
||||
|
||||
e = t:option(ListValue, "koolproxy_acl_default", translate("默认访问控制"))
|
||||
e.description = translate("访问控制设置中其他主机的默认规则")
|
||||
e:value(0, translate("不过滤"))
|
||||
e:value(1, translate("过滤HTTP协议"))
|
||||
e:value(2, translate("过滤HTTP(S)协议"))
|
||||
e:value(3, translate("过滤全端口"))
|
||||
e.default = 1
|
||||
|
||||
e = t:option(ListValue, "time_update", translate("定时更新"))
|
||||
e.description = translate("定时更新规则")
|
||||
for t = 0,23 do
|
||||
e:value(t,translate("每天"..t.."点"))
|
||||
end
|
||||
e:value(nil, translate("关闭"))
|
||||
e.default = nil
|
||||
|
||||
e = t:option(Button, "restart", translate("规则状态"))
|
||||
e.inputtitle = translate("更新规则")
|
||||
e.inputstyle = "reload"
|
||||
e.write = function()
|
||||
luci.sys.call("/usr/share/koolproxy/kpupdate 2>&1 >/dev/null")
|
||||
luci.http.redirect(luci.dispatcher.build_url("admin","services","koolproxy"))
|
||||
end
|
||||
e.description = translate(string.format("<font color=\"red\"><strong>更新订阅规则与Adblock Plus Hosts</strong></font><br /><font color=\"green\">AdGuard规则: %s条<br />Steven规则: %s条<br />Yhosts规则: %s条<br />AntiAD规则: %s条<br />Banben规则: %s条<br />静态规则: %s条<br />视频规则: %s<br />每日规则: %s条<br />自定义规则: %s条<br />Host: %s条</font><br />", s, u, p, f, m, l, b, q, h, i))
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,31 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(TextValue, "adblock_domain")
|
||||
e.description = translate("加入的网址将走广告过滤端口。只针对黑名单模式。只能输入WEB地址，如：google.com，每个地址一行。")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/etc/adblocklist/adblock"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
if value then
|
||||
value = value:gsub("\r\n", "\n")
|
||||
else
|
||||
value = ""
|
||||
end
|
||||
fs.writefile("/tmp/adblock", value)
|
||||
if (luci.sys.call("cmp -s /tmp/adblock /etc/adblocklist/adblock") == 1) then
|
||||
fs.writefile(i, value)
|
||||
end
|
||||
fs.remove("/tmp/adblock")
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,70 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global",translate("证书恢复"))
|
||||
t.description = translate("上传恢复已备份的证书，文件名必须为koolproxyCA.tar.gz")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(DummyValue, "c1status")
|
||||
e = t:option(FileUpload, "")
|
||||
e.template = "koolproxy/caupload"
|
||||
e = t:option(DummyValue,"",nil)
|
||||
e.template = "koolproxy/cadvalue"
|
||||
|
||||
if nixio.fs.access("/usr/share/koolproxy/data/certs/ca.crt") then
|
||||
|
||||
t = o:section(TypedSection, "global",translate("证书备份"))
|
||||
t.description = translate("下载备份的证书")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(DummyValue,"c2status")
|
||||
e = t:option(Button,"certificate")
|
||||
e.inputtitle = translate("下载证书备份")
|
||||
e.inputstyle = "reload"
|
||||
e.write = function()
|
||||
luci.sys.call("/usr/share/koolproxy/camanagement backup 2>&1 >/dev/null")
|
||||
Download()
|
||||
luci.http.redirect(luci.dispatcher.build_url("admin","services","koolproxy"))
|
||||
end
|
||||
end
|
||||
|
||||
function Download()
|
||||
local t,e
|
||||
t = nixio.open("/tmp/upload/koolproxyca.tar.gz","r")
|
||||
luci.http.header('Content-Disposition', 'attachment; filename="koolproxyCA.tar.gz"')
|
||||
luci.http.prepare_content("application/octet-stream")
|
||||
while true do
|
||||
e = t:read(nixio.const.buffersize)
|
||||
if (not e) or (#e==0) then
|
||||
break
|
||||
else
|
||||
luci.http.write(e)
|
||||
end
|
||||
end
|
||||
t:close()
|
||||
luci.http.close()
|
||||
end
|
||||
|
||||
local t,e
|
||||
t = "/tmp/upload/"
|
||||
nixio.fs.mkdir(t)
|
||||
luci.http.setfilehandler(
|
||||
function(o,a,i)
|
||||
if not e then
|
||||
if not o then return end
|
||||
e = nixio.open(t..o.file,"w")
|
||||
if not e then
|
||||
return
|
||||
end
|
||||
end
|
||||
if a and e then
|
||||
e:write(a)
|
||||
end
|
||||
if i and e then
|
||||
e:close()
|
||||
e = nil
|
||||
luci.sys.call("/usr/share/koolproxy/camanagement restore 2>&1 >/dev/null")
|
||||
end
|
||||
end
|
||||
)
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,40 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "acl_rule", translate("iKoolProxy 访问控制"))
|
||||
t.anonymous = true
|
||||
|
||||
t.description = translate("访问控制列表是用于指定特殊IP过滤模式的工具，如为已安装证书的客户端开启https广告过滤等，MAC或者IP必须填写其中一项。")
|
||||
t.template = "cbi/tblsection"
|
||||
t.sortable = true
|
||||
t.addremove = true
|
||||
|
||||
e = t:option(Value, "remarks", translate("客户端备注"))
|
||||
e.width = "30%"
|
||||
|
||||
e = t:option(Value, "ipaddr", translate("内部 IP 地址"))
|
||||
e.width = "20%"
|
||||
e.datatype = "ip4addr"
|
||||
luci.ip.neighbors({family = 4}, function(neighbor)
|
||||
if neighbor.reachable then
|
||||
e:value(neighbor.dest:string(), "%s (%s)" %{neighbor.dest:string(), neighbor.mac})
|
||||
end
|
||||
end)
|
||||
|
||||
e = t:option(Value,"mac",translate("MAC 地址"))
|
||||
e.width = "20%"
|
||||
e.datatype = "macaddr"
|
||||
luci.ip.neighbors({family = 4}, function(neighbor)
|
||||
if neighbor.reachable then
|
||||
e:value(neighbor.mac, "%s (%s)" %{neighbor.mac, neighbor.dest:string()})
|
||||
end
|
||||
end)
|
||||
|
||||
e = t:option(ListValue, "proxy_mode", translate("访问控制"))
|
||||
e.width = "20%"
|
||||
e:value(0,translate("不过滤"))
|
||||
e:value(1,translate("过滤HTTP协议"))
|
||||
e:value(2,translate("过滤HTTP(S)协议"))
|
||||
e:value(3,translate("过滤全端口"))
|
||||
e.default = 1
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,31 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(TextValue, "user_rule")
|
||||
e.description = translate("输入你的自定义规则，每条规则一行。")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/usr/share/koolproxy/data/user.txt"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
if value then
|
||||
value = value:gsub("\r\n", "\n")
|
||||
else
|
||||
value = ""
|
||||
end
|
||||
fs.writefile("/tmp/user.txt", value)
|
||||
if (luci.sys.call("cmp -s /tmp/user.txt /usr/share/koolproxy/data/user.txt") == 1) then
|
||||
fs.writefile(i, value)
|
||||
end
|
||||
fs.remove("/tmp/user.txt")
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,31 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(TextValue, "adblock_ip")
|
||||
e.description = translate("这些已经加入的ip地址不会使用过滤器.请输入ip地址或ip地址段，每行只能输入一个ip地址。例如，112.123.134.145 / 24或112.123.134.145。")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/etc/adblocklist/adblockip"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
if value then
|
||||
value = value:gsub("\r\n", "\n")
|
||||
else
|
||||
value = ""
|
||||
end
|
||||
fs.writefile("/tmp/adblockip", value)
|
||||
if (luci.sys.call("cmp -s /tmp/adblockip /etc/adblocklist/adblockip") == 1) then
|
||||
fs.writefile(i, value)
|
||||
end
|
||||
fs.remove("/tmp/adblockip")
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,31 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(TextValue, "adbypass_ip")
|
||||
e.description = translate("这些已加入的ip地址将使用代理，但只有GFW型号。请输入ip地址或ip地址段，每行只能输入一个ip地址。例如，112.123.134.145 / 24或112.123.134.145。")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/etc/adblocklist/adbypassip"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
if value then
|
||||
value = value:gsub("\r\n", "\n")
|
||||
else
|
||||
value = ""
|
||||
end
|
||||
fs.writefile("/tmp/adbypassip", value)
|
||||
if (luci.sys.call("cmp -s /tmp/adbypassip /etc/adblocklist/adbypassip") == 1) then
|
||||
fs.writefile(i, value)
|
||||
end
|
||||
fs.remove("/tmp/adbypassip")
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,34 @@
|
||||
local m, s, o
|
||||
local koolproxy = "koolproxy"
|
||||
local sid = arg[1]
|
||||
|
||||
m = Map(koolproxy)
|
||||
m.title = translate("iKoolProxy滤广告 - 编辑规则")
|
||||
m.redirect = luci.dispatcher.build_url("admin/services/koolproxy")
|
||||
|
||||
if not arg[1] or m.uci:get(koolproxy, sid) ~= "rss_rule" then
|
||||
luci.http.redirect(m.redirect)
|
||||
return
|
||||
end
|
||||
|
||||
-- [[ Edit Rule ]]--
|
||||
s = m:section(NamedSection, sid, "rss_rule")
|
||||
s.anonymous = true
|
||||
s.addremove = true
|
||||
|
||||
o = s:option(Flag, "load", translate("启用"))
|
||||
o.default = 0
|
||||
|
||||
o = s:option(Value, "name", translate("规则描述"))
|
||||
|
||||
o = s:option(Value, "url", translate("规则地址"))
|
||||
o.placeholder="[https|http|ftp]://[Hostname]/[File]"
|
||||
function o.validate(self, value)
|
||||
if not value then
|
||||
return nil
|
||||
else
|
||||
return value
|
||||
end
|
||||
end
|
||||
|
||||
return m
|
||||
@@ -0,0 +1,8 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "usetips")
|
||||
t.title = translate("iKoolProxy 帮助支持")
|
||||
t.anonymous = true
|
||||
t:append(Template("koolproxy/tips"))
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,21 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/var/log/koolproxy.log"
|
||||
|
||||
e = t:option(TextValue, "kpupdate_log")
|
||||
e.description = translate("查看最近的更新日志")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,31 @@
|
||||
o = Map("koolproxy")
|
||||
|
||||
t = o:section(TypedSection, "global")
|
||||
t.anonymous = true
|
||||
|
||||
e = t:option(TextValue, "adbypass_domain")
|
||||
e.description = translate("这些已经加入的网站将不会使用过滤器。请输入网站的域名，每行只能输入一个网站域名。例如google.com。")
|
||||
e.rows = 28
|
||||
e.wrap = "off"
|
||||
|
||||
local fs = require "nixio.fs"
|
||||
local i = "/etc/adblocklist/adbypass"
|
||||
|
||||
function e.cfgvalue()
|
||||
return fs.readfile(i) or ""
|
||||
end
|
||||
|
||||
function e.write(self, section, value)
|
||||
if value then
|
||||
value = value:gsub("\r\n", "\n")
|
||||
else
|
||||
value = ""
|
||||
end
|
||||
fs.writefile("/tmp/adbypass", value)
|
||||
if (luci.sys.call("cmp -s /tmp/adbypass /etc/adblocklist/adbypass") == 1) then
|
||||
fs.writefile(i, value)
|
||||
end
|
||||
fs.remove("/tmp/adbypass")
|
||||
end
|
||||
|
||||
return o
|
||||
@@ -0,0 +1,8 @@
|
||||
<%+cbi/valueheader%>
|
||||
<span style="color: green">
|
||||
<%
|
||||
local val = self:cfgvalue(section) or self.default or ""
|
||||
write(pcdata(val))
|
||||
%>
|
||||
</span>
|
||||
<%+cbi/valuefooter%>
|
||||
@@ -0,0 +1,5 @@
|
||||
<%+cbi/valueheader%>
|
||||
<label class="cbi-value" style="display:inline-block; width: 400px" for="ulfile"></label><br />
|
||||
<input class="cbi-input-file" style="width: 400px" type="file" id="ulfile" name="ulfile" />
|
||||
<input type="submit" class="cbi-button cbi-input-apply" name="upload" value="<%:上传恢复证书%>" />
|
||||
<%+cbi/valuefooter%>
|
||||
@@ -0,0 +1,21 @@
|
||||
<script type="text/javascript">//<![CDATA[
|
||||
XHR.poll(3, '<%=url([[admin]], [[services]], [[koolproxy]], [[status]])%>', null,
|
||||
function(x, data) {
|
||||
var tb = document.getElementById('koolproxy_status');
|
||||
if (data && tb) {
|
||||
if (data.running) {
|
||||
tb.innerHTML = '<em><b style=color:green><%:iKoolProxy 滤广告%>' + data.bin_version + '<%:运行中%></b></em>';
|
||||
} else {
|
||||
tb.innerHTML = '<em><b style=color:red><%:iKoolProxy 滤广告%>' + data.bin_version + '<%:未运行%></b></em>';
|
||||
}
|
||||
}
|
||||
}
|
||||
);
|
||||
//]]>
|
||||
</script>
|
||||
<style>.mar-10 {margin-left: 50px; margin-right: 10px;}</style>
|
||||
<fieldset class="cbi-section">
|
||||
<p id="koolproxy_status">
|
||||
<em><%:收集数据...%></em>
|
||||
</p>
|
||||
</fieldset>
|
||||
@@ -0,0 +1,31 @@
|
||||
</style>
|
||||
<div class="cbi-value">
|
||||
<label class="cbi-value-title">iKoolProxy的使用Tips：</label>
|
||||
<div class="cbi-value-field">
|
||||
<br />
|
||||
1、 一般配置：过滤模式（全局模式）+ 默认访问控制（过滤http协议）达到一般的过滤效果。
|
||||
<br />
|
||||
2、 最佳配置：在1的基础上，再在 访问控制 + 增加需要过滤的客户端 + 过滤HTTP(S)协议 + 对应客服端安装证书。
|
||||
<br />
|
||||
3、 使用步骤：A、更新规则，B、恢复证书，C、设置要过滤的https客户端ip，D、清除浏览器或APP数据或断网重连。
|
||||
<br />
|
||||
4、 Adblock Plus的Host列表 + KoolProxy黑名单模式运行更流畅上网体验。
|
||||
<br />
|
||||
5、 过滤HTTPS广告需要为相应客户端安装证书，在“访问控制”里添加客户端ip或者mac地址，并选择用<u><font color='#FF0000'>过滤HTTP(S)协议</font></u>！
|
||||
<br />
|
||||
6、 在路由器下的设备，在浏览器中输入<u><font color='#FF0000'>110.110.110.110</font></u>来下载证书，导入证书目录请选择“受信任的根证书颁发机构”。
|
||||
<br />
|
||||
7、 安装完证书后，请在客户端机器上<u><font color='#FF0000'>清除浏览器的缓存、视频APP的全部数据、断开网络重新联网</font></u>。如果访问网页弹出不安全提示，请检查证书是否安装正确。
|
||||
<br />
|
||||
8、 如果想在多台路由器上使用一个证书，请先备份证书，然后再在另一个路由器上恢复证书即可。
|
||||
<br />
|
||||
</div>
|
||||
|
||||
<div class="cbi-value">
|
||||
<label class="cbi-value-title">Shaoxia的KoolProxyR详细使用说明</label>
|
||||
<div class="cbi-value-field">
|
||||
<input type="button" class="cbi-button cbi-input-reload" value="点击前往" onclick="javascript:window.open('https://shaoxia.xyz/post/koolproxyr%E6%8C%87%E5%8D%97/','target');" />
|
||||
</div>
|
||||
</div>
|
||||
</fieldset>
|
||||
</fieldset>
|
||||
Whitespace-only changes.
Whitespace-only changes.
Whitespace-only changes.
Whitespace-only changes.
@@ -0,0 +1,20 @@
|
||||
config global
|
||||
option enabled '0'
|
||||
option koolproxy_port '0'
|
||||
option startup_delay '0'
|
||||
option koolproxy_acl_default '1'
|
||||
option koolproxy_mode '1'
|
||||
option koolproxy_host '1'
|
||||
option koolproxy_rules 'koolproxy.txt daily.txt kp.dat'
|
||||
option koolproxy_ipv6 '0'
|
||||
option time_update 'nil'
|
||||
|
||||
config acl_rule
|
||||
option proxy_mode '2'
|
||||
option remarks '选要滤https的客户端'
|
||||
option ipaddr '192.168.8.168'
|
||||
|
||||
config usetips
|
||||
option load '0'
|
||||
option name '1'
|
||||
option url '1'
|
||||
+477
@@ -0,0 +1,477 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
#
|
||||
# Copyright (C) 2015 OpenWrt-dist
|
||||
# Copyright (C) 2016 fw867 <ffkykzs@gmail.com>
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v3.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
START=99
|
||||
STOP=99
|
||||
USE_PROCD=1
|
||||
|
||||
CONFIG=koolproxy
|
||||
KP_DIR=/usr/share/koolproxy
|
||||
TMP_DIR=/tmp
|
||||
|
||||
alias echo_date='echo $(date +%Y年%m月%d日\ %X):'
|
||||
|
||||
config_n_get() {
|
||||
local ret=$(uci get $CONFIG.$1.$2 2>/dev/null)
|
||||
echo ${ret:=$3}
|
||||
}
|
||||
|
||||
config_t_get() {
|
||||
local index=0
|
||||
[ -n "$4" ] && index=$4
|
||||
local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
|
||||
echo ${ret:=$3}
|
||||
}
|
||||
|
||||
add_ipset_conf() {
|
||||
if [ -s /etc/adblocklist/adbypass ]; then
|
||||
echo_date 添加白名单软连接...
|
||||
cat /etc/adblocklist/adbypass | sed "s/,/\n/g" | sed "s/^/ipset=&\/./g" | sed "s/$/\/white_kp_list/g" >> /tmp/adbypass.conf
|
||||
rm -rf /tmp/dnsmasq.d/adbypass.conf
|
||||
ln -sf /tmp/adbypass.conf /tmp/dnsmasq.d/adbypass.conf
|
||||
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
|
||||
if [ "$koolproxy_mode" == "2" ]; then
|
||||
if [ "$koolproxy_host" == "1" ];then
|
||||
echo_date 添加Adblock Plus Host软连接...
|
||||
ln -sf $KP_DIR/dnsmasq.adblock /tmp/dnsmasq.d/dnsmasq.adblock
|
||||
fi
|
||||
|
||||
echo_date 添加黑名单软连接...
|
||||
rm -rf /tmp/dnsmasq.d/koolproxy_ipset.conf
|
||||
ln -sf $KP_DIR/koolproxy_ipset.conf /tmp/dnsmasq.d/koolproxy_ipset.conf
|
||||
|
||||
echo_date 添加自定义黑名单软连接...
|
||||
if [ -s /etc/adblocklist/adblock ]; then
|
||||
cat /etc/adblocklist/adblock | sed "s/,/\n/g" | sed "s/^/ipset=&\/./g" | sed "s/$/\/black_koolproxy/g" >> /tmp/adblock.conf
|
||||
rm -rf /tmp/dnsmasq.d/adblock.conf
|
||||
ln -sf /tmp/adblock.conf /tmp/dnsmasq.d/adblock.conf
|
||||
fi
|
||||
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
}
|
||||
|
||||
remove_ipset_conf() {
|
||||
if [ -L "/tmp/dnsmasq.d/adbypass.conf" ]; then
|
||||
echo_date 移除白名单软连接...
|
||||
rm -rf /tmp/adbypass.conf
|
||||
rm -rf /tmp/dnsmasq.d/adbypass.conf
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
|
||||
if [ -L "/tmp/dnsmasq.d/koolproxy_ipset.conf" ]; then
|
||||
echo_date 移除黑名单软连接...
|
||||
rm -rf /tmp/dnsmasq.d/koolproxy_ipset.conf
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
|
||||
if [ -L "/tmp/dnsmasq.d/adblock.conf" ]; then
|
||||
echo_date 移除自定义黑名单软连接...
|
||||
rm -rf /tmp/dnsmasq.d/adblock.conf
|
||||
rm -rf /tmp/adblock.conf
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
|
||||
if [ -L "/tmp/dnsmasq.d/dnsmasq.adblock" ]; then
|
||||
echo_date 移除Adblock Plus Host软连接...
|
||||
rm -rf /tmp/dnsmasq.d/dnsmasq.adblock
|
||||
dnsmasq_restart=1
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
restart_dnsmasq() {
|
||||
if [ "$dnsmasq_restart" == "1" ]; then
|
||||
echo_date 重启dnsmasq进程...
|
||||
/etc/init.d/dnsmasq restart > /dev/null 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
creat_ipset() {
|
||||
echo_date 创建ipset名单
|
||||
# Load ipset netfilter kernel modules and kernel modules
|
||||
ipset -! create white_kp_list nethash
|
||||
ipset -! create black_koolproxy iphash
|
||||
cat $KP_DIR/data/rules/yhosts.txt $KP_DIR/data/rules/adg.txt $KP_DIR/data/rules/steven.txt $KP_DIR/data/rules/antiad.txt $KP_DIR/data/rules/koolproxy.txt $KP_DIR/data/rules/adgk.txt $KP_DIR/data/rules/daily.txt $KP_DIR/data/rules/user.txt | grep -Eo "(.\w+\:[1-9][0-9]{1,4})/" | grep -Eo "([0-9]{1,5})" | sort -un | sed -e '$a\80' -e '$a\443' | sed -e "s/^/-A kp_full_port &/g" -e "1 i\-N kp_full_port bitmap:port range 0-65535 " | ipset -R -!
|
||||
}
|
||||
|
||||
add_white_black_ip() {
|
||||
echo_date 添加ipset名单
|
||||
ip_lan="0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.31.196.0/24 192.52.193.0/24 192.88.99.0/24 192.168.0.0/16 192.175.48.0/24 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4 255.255.255.255"
|
||||
for ip in $ip_lan
|
||||
do
|
||||
ipset -A white_kp_list $ip >/dev/null 2>&1
|
||||
|
||||
done
|
||||
sed -e "s/^/add white_kp_list &/g" /etc/adblocklist/adbypassip | awk '{print $0} END{print "COMMIT"}' | ipset -R 2>/dev/null
|
||||
ipset -A black_koolproxy 110.110.110.110 >/dev/null 2>&1
|
||||
sed -e "s/^/add black_koolproxy &/g" /etc/adblocklist/adblockip | awk '{print $0} END{print "COMMIT"}' | ipset -R 2>/dev/null
|
||||
}
|
||||
|
||||
load_config() {
|
||||
ENABLED=$(config_t_get global enabled 0)
|
||||
[ $ENABLED -ne 1 ] && return 0
|
||||
koolproxy_mode=$(config_t_get global koolproxy_mode 1)
|
||||
koolproxy_host=$(config_t_get global koolproxy_host 0)
|
||||
koolproxy_acl_default=$(config_t_get global koolproxy_acl_default 1)
|
||||
koolproxy_port=$(config_t_get global koolproxy_port 0)
|
||||
koolproxy_bp_port=$(config_t_get global koolproxy_bp_port)
|
||||
koolproxy_ipv6=$(config_t_get global koolproxy_ipv6 0)
|
||||
config_load $CONFIG
|
||||
return 1
|
||||
}
|
||||
|
||||
__load_lan_acl() {
|
||||
local mac
|
||||
local ipaddr
|
||||
local proxy_mode
|
||||
config_get mac $1 mac
|
||||
config_get ipaddr $1 ipaddr
|
||||
config_get proxy_mode $1 proxy_mode
|
||||
[ -n "$ipaddr" ] && [ -z "$mac" ] && echo_date 加载ACL规则：【$ipaddr】模式为：$(get_mode_name $proxy_mode)
|
||||
[ -z "$ipaddr" ] && [ -n "$mac" ] && echo_date 加载ACL规则：【$mac】模式为：$(get_mode_name $proxy_mode)
|
||||
[ -n "$ipaddr" ] && [ -n "$mac" ] && echo_date 加载ACL规则：【$ipaddr】【$mac】模式为：$(get_mode_name $proxy_mode)
|
||||
#echo iptables -t nat -A KOOLPROXY $(factor $ipaddr "-s") $(factor $mac "-m mac --mac-source") -p tcp $(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)
|
||||
iptables -t nat -A KOOLPROXY $(factor $ipaddr "-s") $(factor $mac "-m mac --mac-source") -p tcp $(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)
|
||||
|
||||
acl_nu=`expr $acl_nu + 1`
|
||||
}
|
||||
|
||||
lan_acess_control() {
|
||||
acl_nu=0
|
||||
[ -z "$koolproxy_acl_default" ] && koolproxy_acl_default=1
|
||||
config_foreach __load_lan_acl acl_rule
|
||||
if [ $acl_nu -ne 0 ]; then
|
||||
echo_date 加载ACL规则：其余主机模式为：$(get_mode_name $koolproxy_acl_default)
|
||||
else
|
||||
echo_date 加载ACL规则：所有模式为：$(get_mode_name $koolproxy_acl_default)
|
||||
fi
|
||||
}
|
||||
|
||||
__load_exrule() {
|
||||
local file
|
||||
local exrule
|
||||
local enable
|
||||
config_get file $1 file
|
||||
config_get exrule $1 url
|
||||
config_get enable $1 load
|
||||
if [ -n "$exrule" ]; then
|
||||
if [ $enable -ne 1 ]; then
|
||||
[ -n "$file" ] && [ -f $KP_DIR/data/rules/$file ] && rm -f $KP_DIR/data/rules/$file
|
||||
uci set koolproxy.$1.time=""
|
||||
uci commit koolproxy
|
||||
return
|
||||
fi
|
||||
|
||||
if [ -z "$file" ]; then
|
||||
file=$(echo $exrule |awk -F "/" '{print $NF}')
|
||||
uci set koolproxy.$1.file="$file"
|
||||
uci commit koolproxy
|
||||
fi
|
||||
|
||||
if [ ! -f $KP_DIR/data/rules/$file ]; then
|
||||
wget $exrule -q -O $TMP_DIR/$file
|
||||
if [ "$?" == "0" ]; then
|
||||
uci set koolproxy.$1.time="`date +%Y-%m-%d" "%H:%M`"
|
||||
uci commit koolproxy
|
||||
mv $TMP_DIR/$file $KP_DIR/data/rules/$file
|
||||
else
|
||||
echo "koolproxy download rule $file failed!"
|
||||
[ -f $TMP_DIR/$file ] && rm -f $TMP_DIR/$file
|
||||
fi
|
||||
fi
|
||||
cat $KP_DIR/data/rules/$file >>$KP_DIR/data/rules/user.txt
|
||||
fi
|
||||
}
|
||||
|
||||
load_user_rules() {
|
||||
cp $KP_DIR/data/user.txt $KP_DIR/data/rules/user.txt
|
||||
config_foreach __load_exrule rss_rule
|
||||
}
|
||||
|
||||
load_rules() {
|
||||
sed -i '1,9s/1/0/g' $KP_DIR/data/source.list
|
||||
local rulelist="$(uci -q get koolproxy.@global[0].koolproxy_rules)"
|
||||
for rule in $rulelist
|
||||
do
|
||||
case "$rule" in
|
||||
koolproxy.txt)
|
||||
sed -i '1s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
daily.txt)
|
||||
sed -i '2s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
kp.dat)
|
||||
sed -i '3s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
user.txt)
|
||||
sed -i '4s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
local rulelist="$(uci -q get koolproxy.@global[0].thirdparty_rules)"
|
||||
for rule in $rulelist
|
||||
do
|
||||
case "$rule" in
|
||||
yhosts.txt)
|
||||
sed -i '5s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
adg.txt)
|
||||
sed -i '6s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
steven.txt)
|
||||
sed -i '7s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
antiad.txt)
|
||||
sed -i '8s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
adgk.txt)
|
||||
sed -i '9s/0/1/g' $KP_DIR/data/source.list
|
||||
;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
get_mode_name() {
|
||||
case "$1" in
|
||||
0)
|
||||
echo "不过滤"
|
||||
;;
|
||||
1)
|
||||
echo "过滤HTTP协议"
|
||||
;;
|
||||
2)
|
||||
echo "过滤HTTP(S)协议"
|
||||
;;
|
||||
3)
|
||||
echo "过滤全端口"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
get_jump_mode() {
|
||||
case "$1" in
|
||||
0)
|
||||
echo "-j"
|
||||
;;
|
||||
*)
|
||||
echo "-g"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
get_action_chain() {
|
||||
case "$1" in
|
||||
0)
|
||||
echo "RETURN"
|
||||
;;
|
||||
1)
|
||||
echo "KP_HTTP"
|
||||
;;
|
||||
2)
|
||||
echo "KP_HTTPS"
|
||||
;;
|
||||
3)
|
||||
echo "KP_ALL_PORT"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
factor() {
|
||||
if [ -z "$1" ] || [ -z "$2" ]; then
|
||||
echo ""
|
||||
else
|
||||
echo "$2 $1"
|
||||
fi
|
||||
}
|
||||
|
||||
load_nat() {
|
||||
echo_date 加载nat规则！
|
||||
#----------------------BASIC RULES---------------------
|
||||
echo_date 写入iptables规则到nat表中...
|
||||
# 创建KOOLPROXY nat rule
|
||||
iptables -t nat -N KOOLPROXY
|
||||
# 局域网地址不走KP
|
||||
iptables -t nat -A KOOLPROXY -m set --match-set white_kp_list dst -j RETURN
|
||||
# 生成对应CHAIN
|
||||
iptables -t nat -N KP_HTTP
|
||||
iptables -t nat -A KP_HTTP -p tcp -m multiport --dport 80 -j REDIRECT --to-ports 3000
|
||||
iptables -t nat -N KP_HTTPS
|
||||
iptables -t nat -A KP_HTTPS -p tcp -m multiport --dport 80,443 -j REDIRECT --to-ports 3000
|
||||
iptables -t nat -N KP_ALL_PORT
|
||||
#iptables -t nat -A KP_ALL_PORT -p tcp -j REDIRECT --to-ports 3000
|
||||
# 端口控制
|
||||
if [ "$koolproxy_port" == "1" ]; then
|
||||
echo_date 开启端口控制：【$koolproxy_bp_port】
|
||||
if [ -n "$koolproxy_bp_port" ]; then
|
||||
iptables -t nat -A KP_ALL_PORT -p tcp -m multiport ! --dport $koolproxy_bp_port -m set --match-set kp_full_port dst -j REDIRECT --to-ports 3000
|
||||
else
|
||||
iptables -t nat -A KP_ALL_PORT -p tcp -m set --match-set kp_full_port dst -j REDIRECT --to-ports 3000
|
||||
fi
|
||||
else
|
||||
iptables -t nat -A KP_ALL_PORT -p tcp -m set --match-set kp_full_port dst -j REDIRECT --to-ports 3000
|
||||
fi
|
||||
[ "$koolproxy_ipv6" == "1" ] && ip6tables -t nat -I PREROUTING -p tcp -j REDIRECT --to-ports 3000
|
||||
# 局域网控制
|
||||
lan_acess_control
|
||||
# 剩余流量转发到缺省规则定义的链中
|
||||
iptables -t nat -A KOOLPROXY -p tcp -j $(get_action_chain $koolproxy_acl_default)
|
||||
# 重定所有流量到 KOOLPROXY
|
||||
# 全局模式和视频模式
|
||||
[ "$koolproxy_mode" == "1" ] || [ "$koolproxy_mode" == "3" ] && iptables -t nat -I PREROUTING 1 -p tcp -j KOOLPROXY
|
||||
# ipset 黑名单模式
|
||||
[ "$koolproxy_mode" == "2" ] && iptables -t nat -I PREROUTING 1 -p tcp -m set --match-set black_koolproxy dst -j KOOLPROXY
|
||||
}
|
||||
|
||||
add_cru() {
|
||||
time=$(config_t_get global time_update)
|
||||
wirtecron=$(cat /etc/crontabs/root | grep "00 $time * * *" | grep kpupdate)
|
||||
if [ -z "$wirtecron" ];then
|
||||
sed -i '/kpupdate/d' /etc/crontabs/root >/dev/null 2>&1
|
||||
echo "0 $time * * * /usr/share/koolproxy/kpupdate" >> /etc/crontabs/root
|
||||
fi
|
||||
}
|
||||
|
||||
del_cru() {
|
||||
sed -i '/kpupdate/d' /etc/crontabs/root >/dev/null 2>&1
|
||||
}
|
||||
|
||||
detect_cert(){
|
||||
if [ ! -f $KP_DIR/data/private/ca.key.pem -o ! -f $KP_DIR/data/cert/ca.crt ]; then
|
||||
echo_date 开始生成koolproxy证书，用于https过滤！
|
||||
cd $KP_DIR/data && sh gen_ca.sh
|
||||
fi
|
||||
}
|
||||
|
||||
flush_nat() {
|
||||
echo_date 移除nat规则...
|
||||
cd $TMP_DIR
|
||||
iptables -t nat -S | grep -E "KOOLPROXY|KP_HTTP|KP_HTTPS|KP_ALL_PORT" | sed 's/-A/iptables -t nat -D/g'|sed 1,4d > clean.sh && chmod 777 clean.sh && ./clean.sh
|
||||
[ -f $TMP_DIR/clean.sh ] && rm -f $TMP_DIR/clean.sh
|
||||
iptables -t nat -X KOOLPROXY > /dev/null 2>&1
|
||||
iptables -t nat -X KP_HTTP > /dev/null 2>&1
|
||||
iptables -t nat -X KP_HTTPS > /dev/null 2>&1
|
||||
iptables -t nat -X KP_ALL_PORT > /dev/null 2>&1
|
||||
ipset -F black_koolproxy > /dev/null 2>&1 && ipset -X black_koolproxy > /dev/null 2>&1
|
||||
ipset -F white_kp_list > /dev/null 2>&1 && ipset -X white_kp_list > /dev/null 2>&1
|
||||
ip6tables -t nat -D PREROUTING -p tcp -j REDIRECT --to-ports 3000 > /dev/null 2>&1
|
||||
}
|
||||
|
||||
export_ipt_rules() {
|
||||
FWI=$(uci get firewall.koolproxy.path 2>/dev/null)
|
||||
[ -n "$FWI" ] || return 0
|
||||
cat <<-CAT >>$FWI
|
||||
iptables-save -c | grep -v -E "KOOLPROXY|KP" | iptables-restore -c
|
||||
iptables-restore -n <<-EOF
|
||||
$(iptables-save | grep -E "KOOLPROXY|KP|^\*|^COMMIT" |\
|
||||
sed -e "s/^-A \(PREROUTING\)/-I \1 1/")
|
||||
EOF
|
||||
CAT
|
||||
return $?
|
||||
}
|
||||
|
||||
flush_ipt_rules() {
|
||||
FWI=$(uci get firewall.koolproxy.path 2>/dev/null)
|
||||
[ -n "$FWI" ] && echo '# firewall include file' >$FWI
|
||||
return 0
|
||||
}
|
||||
|
||||
pre_start() {
|
||||
load_config
|
||||
[ $? -ne 1 ] && return 0
|
||||
iptables -t nat -C PREROUTING -p tcp -j KOOLPROXY 2>/dev/null && [ $? -eq 0 ] && return 0;
|
||||
detect_cert
|
||||
load_rules
|
||||
load_user_rules
|
||||
add_ipset_conf && restart_dnsmasq
|
||||
creat_ipset
|
||||
add_white_black_ip
|
||||
load_nat
|
||||
flush_ipt_rules && export_ipt_rules
|
||||
add_cru
|
||||
[ "$koolproxy_mode" == "1" ] && echo_date 选择【全局过滤模式】
|
||||
[ "$koolproxy_mode" == "2" ] && echo_date 选择【IPSET过滤模式】
|
||||
if [ "$koolproxy_mode" == "3" ]; then
|
||||
echo_date 选择【视频过滤模式】
|
||||
sed -i '1s/1/0/g;2s/1/0/g' $KP_DIR/data/source.list
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
post_stop() {
|
||||
load_config
|
||||
[ $? -ne 1 ] && NO_RESTART_DNSMASQ=false
|
||||
if [ $NO_RESTART_DNSMASQ ]; then
|
||||
remove_ipset_conf
|
||||
else
|
||||
remove_ipset_conf && restart_dnsmasq
|
||||
fi
|
||||
flush_ipt_rules
|
||||
flush_nat
|
||||
del_cru
|
||||
return 0
|
||||
}
|
||||
|
||||
start_service() {
|
||||
echo_date ================== koolproxy启用 ================
|
||||
pre_start
|
||||
[ $? -ne 1 ] && return 0
|
||||
|
||||
procd_open_instance
|
||||
procd_set_param command /usr/share/koolproxy/koolproxy
|
||||
procd_append_param command --mark
|
||||
procd_append_param command --ttl 160
|
||||
|
||||
procd_set_param respawn
|
||||
|
||||
procd_set_param file /etc/adblocklist/adblock
|
||||
procd_set_param file /etc/adblocklist/adblockip
|
||||
procd_set_param file /usr/share/koolproxy/data/user.txt
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
procd_close_instance
|
||||
|
||||
logger "koolproxy has started."
|
||||
echo_date =================================================
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
echo_date ====================== 关闭 =====================
|
||||
post_stop
|
||||
logger "koolproxy has stopped."
|
||||
echo_date =================================================
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
logger "koolproxy reload service."
|
||||
NO_RESTART_DNSMASQ=true
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger "koolproxy"
|
||||
}
|
||||
|
||||
restart() {
|
||||
logger "koolproxy restart service."
|
||||
NO_RESTART_DNSMASQ=true
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
boot() {
|
||||
local delay=$(config_t_get global startup_delay 0)
|
||||
(sleep $delay && start >/dev/null 2>&1) &
|
||||
return 0
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
#!/bin/sh
|
||||
[ ! -f "/usr/share/ucitrack/luci-app-koolproxy.json" ] && {
|
||||
cat > /usr/share/ucitrack/luci-app-koolproxy.json << EEOF
|
||||
{
|
||||
"config": "koolproxy",
|
||||
"init": "koolproxy"
|
||||
}
|
||||
EEOF
|
||||
}
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
[ -e "/etc/config/ucitrack" ] && {
|
||||
delete ucitrack.@koolproxy[-1]
|
||||
add ucitrack koolproxy
|
||||
set ucitrack.@koolproxy[-1].init=koolproxy
|
||||
commit ucitrack
|
||||
}
|
||||
delete firewall.koolproxy
|
||||
set firewall.koolproxy=include
|
||||
set firewall.koolproxy.type=script
|
||||
set firewall.koolproxy.path=/var/etc/koolproxy.include
|
||||
set firewall.koolproxy.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
|
||||
rm -f /tmp/luci-indexcache
|
||||
exit 0
|
||||
@@ -0,0 +1,3 @@
|
||||
/usr/share/koolproxy/data/certs/ca.crt
|
||||
/usr/share/koolproxy/data/private/base.key.pem
|
||||
/usr/share/koolproxy/data/private/ca.key.pem
|
||||
+23
@@ -0,0 +1,23 @@
|
||||
#!/bin/sh
|
||||
echo "$(date "+%F %T"): 正在下载adblockplus规则..."
|
||||
wget-ssl --quiet --no-check-certificate https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt -O /tmp/adlist.txt
|
||||
if [ "$?" == "0" ]; then
|
||||
grep ^\|\|[^\*]*\^$ /tmp/adlist.txt | sed -e 's:||:address\=\/:' -e 's:\^:/0\.0\.0\.0:' > /tmp/dnsmasq.adblock
|
||||
rm -f /tmp/adlist.txt
|
||||
diff /tmp/dnsmasq.adblock /usr/share/koolproxy/dnsmasq.adblock >/dev/null
|
||||
[ $? = 0 ] && echo "$(date "+%F %T"): adblockplus本地规则和服务器规则相同，无需更新!" && rm -f /tmp/dnsmasq.adblock && return 1
|
||||
echo "$(date "+%F %T"): 检测到adblockplus规则有更新，开始转换规则！"
|
||||
sed -i '/youku/d' /tmp/dnsmasq.adblock >/dev/null 2>&1
|
||||
sed -i '/[1-9]\{1,3\}\.[1-9]\{1,3\}\.[1-9]\{1,3\}\.[1-9]\{1,3\}/d' /tmp/dnsmasq.adblock >/dev/null 2>&1
|
||||
mv /tmp/dnsmasq.adblock /usr/share/koolproxy/dnsmasq.adblock
|
||||
echo "$(date "+%F %T"): adblockplus规则转换完成，应用新规则。"
|
||||
echo ""
|
||||
echo "$(date "+%F %T"): 重启dnsmasq进程"
|
||||
/etc/init.d/dnsmasq restart > /dev/null 2>&1
|
||||
|
||||
return 0
|
||||
else
|
||||
echo "$(date "+%F %T"): 获取在线版本时出现错误! "
|
||||
[ -f /tmp/adlist.txt ] && rm -f /tmp/adlist.txt
|
||||
return 1
|
||||
fi
|
||||
Whitespace-only changes.
@@ -0,0 +1,66 @@
|
||||
#!/bin/sh
|
||||
kpfolder="/usr/share/koolproxy/data"
|
||||
kplogfile="/var/log/koolproxy.log"
|
||||
readyfolder="/tmp/upload/koolproxy"
|
||||
|
||||
backup() {
|
||||
if [ ! -f $kpfolder/private/ca.key.pem ]; then
|
||||
echo "未找到ca.key.pem，请先运行Koolproxy一次！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -f $kpfolder/private/base.key.pem ]; then
|
||||
echo "未找到base.key.pem，请先运行Koolproxy一次！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -f $kpfolder/certs/ca.crt ]; then
|
||||
echo "未找到ca.crt，请先运行Koolproxy一次！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p /tmp/upload
|
||||
cd $kpfolder
|
||||
tar czf /tmp/upload/koolproxyca.tar.gz private/ca.key.pem private/base.key.pem certs/ca.crt
|
||||
[ -f /tmp/upload/koolproxyca.tar.gz ] && echo "证书备份已成功生成。" > $kplogfile
|
||||
}
|
||||
|
||||
restore() {
|
||||
if [ ! -f /tmp/upload/koolproxyCA.tar.gz ]; then
|
||||
echo "未找到备份文件，文件名必须为koolproxyCA.tar.gz或已损坏，请检查备份文件！" >> $kplogfile
|
||||
else
|
||||
mkdir -p $readyfolder
|
||||
cd $readyfolder
|
||||
tar xzf /tmp/upload/koolproxyCA.tar.gz
|
||||
fi
|
||||
if [ ! -f $readyfolder/private/ca.key.pem ]; then
|
||||
echo "未找到ca.key.pem,备份文件不正确或已损坏，请检查备份文件！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -f $readyfolder/private/base.key.pem ]; then
|
||||
echo "未找到base.key.pem，备份文件不正确或已损坏，请检查备份文件！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
if [ ! -f $readyfolder/certs/ca.crt ]; then
|
||||
echo "未找到ca.crt，备份文件不正确或已损坏，请检查备份文件！" > $kplogfile
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mv -f $readyfolder/private/ca.key.pem $kpfolder/private/ca.key.pem
|
||||
mv -f $readyfolder/private/base.key.pem $kpfolder/private/base.key.pem
|
||||
mv -f $readyfolder/certs/ca.crt $kpfolder/certs/ca.crt
|
||||
rm -rf $readyfolder
|
||||
rm -f /tmp/upload/koolproxyCA.tar.gz
|
||||
echo "证书成功还原，重启Koolproxy。" > $kplogfile
|
||||
/etc/init.d/koolproxy restart
|
||||
}
|
||||
|
||||
case "$*" in
|
||||
"backup")
|
||||
backup
|
||||
;;
|
||||
"restore")
|
||||
restore
|
||||
;;
|
||||
"help")
|
||||
echo "use backup or restore"
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh
|
||||
alias echo_date='echo $(date +%Y年%m月%d日\ %X):'
|
||||
|
||||
if [ ! -f openssl.cnf ]; then
|
||||
echo_date "Cannot found openssl.cnf"
|
||||
exit 1
|
||||
fi
|
||||
if [ -f /usr/share/koolproxy/data/private/ca.key.pem ]; then
|
||||
echo_date "已经有证书了！"
|
||||
else
|
||||
echo_date "生成证书中..."
|
||||
|
||||
#step 1, root ca
|
||||
mkdir -p certs private
|
||||
rm -f serial private/ca.key.pem
|
||||
chmod 700 private
|
||||
echo 1000 > serial
|
||||
openssl genrsa -traditional -aes256 -passout pass:koolshare -out private/ca.key.pem 2048
|
||||
chmod 400 private/ca.key.pem
|
||||
openssl req -config openssl.cnf -passin pass:koolshare \
|
||||
-subj "/C=CN/ST=Beijing/L=KP/O=KoolProxy inc/CN=koolproxy.com" \
|
||||
-key private/ca.key.pem \
|
||||
-new -x509 -days 7300 -sha256 -extensions v3_ca \
|
||||
-out certs/ca.crt
|
||||
|
||||
#step 2, domain rsa key
|
||||
openssl genrsa -traditional -aes256 -passout pass:koolshare -out private/base.key.pem 2048
|
||||
echo_date "证书生成完毕..."
|
||||
fi
|
||||
@@ -0,0 +1,132 @@
|
||||
# OpenSSL root CA configuration file.
|
||||
# Copy to `/root/ca/openssl.cnf`.
|
||||
|
||||
[ ca ]
|
||||
# `man ca`
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
# Directory and file locations.
|
||||
dir = ./ca
|
||||
certs = $dir/certs
|
||||
crl_dir = $dir/crl
|
||||
new_certs_dir = $dir/newcerts
|
||||
database = $dir/index.txt
|
||||
serial = $dir/serial
|
||||
RANDFILE = $dir/private/.rand
|
||||
|
||||
# The root key and root certificate.
|
||||
private_key = $dir/private/ca.key.pem
|
||||
certificate = $dir/certs/ca.cert.pem
|
||||
|
||||
# For certificate revocation lists.
|
||||
crlnumber = $dir/crlnumber
|
||||
crl = $dir/crl/ca.crl.pem
|
||||
crl_extensions = crl_ext
|
||||
default_crl_days = 30
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 375
|
||||
preserve = no
|
||||
policy = policy_strict
|
||||
|
||||
[ policy_strict ]
|
||||
# The root CA should only sign intermediate certificates that match.
|
||||
# See the POLICY FORMAT section of `man ca`.
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_loose ]
|
||||
# Allow the intermediate CA to sign a more diverse range of certificates.
|
||||
# See the POLICY FORMAT section of the `ca` man page.
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 2048
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = GB
|
||||
stateOrProvinceName_default = England
|
||||
localityName_default =
|
||||
0.organizationName_default = Alice Ltd
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
[ v3_ca ]
|
||||
# Extensions for a typical CA (`man x509v3_config`).
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||
|
||||
[ v3_intermediate_ca ]
|
||||
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
basicConstraints = critical, CA:true, pathlen:0
|
||||
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||
|
||||
[ usr_cert ]
|
||||
# Extensions for client certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = client, email
|
||||
nsComment = "OpenSSL Generated Client Certificate"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = clientAuth, emailProtection
|
||||
|
||||
[ server_cert ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "OpenSSL Generated Server Certificate"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
|
||||
[ crl_ext ]
|
||||
# Extension for CRLs (`man x509v3_config`).
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ ocsp ]
|
||||
# Extension for OCSP signing certificates (`man ocsp`).
|
||||
basicConstraints = CA:FALSE
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, digitalSignature
|
||||
extendedKeyUsage = critical, OCSPSigning
|
||||
@@ -0,0 +1,49 @@
|
||||
! ******************************* KoolProxyR 自定义过滤语法简表 *******************************
|
||||
! ------------------------ 规则基于adblock规则，并进行了语法部分的扩展 ------------------------
|
||||
! ABP规则请参考https://adblockplus.org/zh_CN/filters，下面为大致摘要
|
||||
! "!" 为行注释符，注释行以该符号起始作为一行注释语义，用于规则描述
|
||||
! "@@" 为白名单符，白名单具有最高优先级，放行过滤的网站，例如:@@||taobao.com
|
||||
! "@@@@" 超级白名单，比白名单符拥有更高的优先级，主要用于放行https网站，例如:@@@@||https://taobao.com
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! "*" 为字符通配符，能够匹配0长度或任意长度的字符串，该通配符不能与正则语法混用。
|
||||
! "^" 为分隔符，可以是除了字母、数字或者 _ - . % 之外的任何字符。
|
||||
! "~" 为排除标识符，通配符能过滤大多数广告，但同时存在误杀, 可以通过排除标识符修正误杀链接。
|
||||
! 注：通配符仅在 url 规则中支持，html 规则中不支持
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! "|" 为管线符号，来表示地址的最前端或最末端
|
||||
! "||" 为子域通配符，方便匹配主域名下的所有子域
|
||||
! 用法及例子如下：(以下等号表示等价于)
|
||||
! ||xx.com/ad = http://xx.com/ad* || http://*.xx.com/ad*
|
||||
! ||http://xx.com/ad = http://xx.com/ad* || http://*.xx.com/ad*
|
||||
! ||https://xx.com/ad = https://xx.com/ad* || https://*.xx.com/ad*
|
||||
! |xx.com/ad = http://xx.com/ad*
|
||||
! |http://xx.com/ad = http://xx.com/ad*
|
||||
! |https://xx.com/ad = https://xx.com/ad*
|
||||
! ad = http://*ad*
|
||||
! http://ad = http://*ad*
|
||||
! https://ad = 不支持，需要指定域名，如下例
|
||||
! https://xx.com/ad = |https://xx.com/ad = https://xx.com/ad*
|
||||
! [同时可以表示两个以及两个以上的域名]如下例子
|
||||
! https://xx.ad.com 和 https://xxx.xx.ad.com = ||https://ad.com (注意! 由于https的原因使用要非常谨慎,不可以大范围使用)
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 兼容adblock规则的html规则语法，例如：
|
||||
! fulldls.com,torrentzap.com##.tp_reccomend_banner
|
||||
! 但是推荐写成以下标准写法：
|
||||
! ||fulldls.com##.tp_reccomend_banner
|
||||
! ||torrentzap.com##.tp_reccomend_banner
|
||||
! 如果一个网站html规则有多条，可以合并为这样：
|
||||
! ||torrentzap.com##.tp_reccomend_banner,.ad_top,[class="ad_right"]......
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 文本替换语法：$s@匹配内容@替换内容@
|
||||
! 非标准端口过滤语法：||abc.com:8081/ad.html或者|http://adb.com:8081/
|
||||
! 文本替换例子：|http://cdn.pcbeta.js.inimc.com/data/cache/common.js?$s@old@new@
|
||||
! 重定向语法：$r@匹配内容@替换内容@
|
||||
! 重定向例子：|http://koolshare.cn$r@http://koolshare.cn/*@http://www.qq.com@
|
||||
! 注：文本替换语法及重定向语法中的匹配内容不仅支持通配符功能，而且额外支持以下功能
|
||||
! 支持通配符 * 和 ? 表示单个字符
|
||||
! 支持全正则匹配，/正则内容/ 表示应用正则匹配
|
||||
! 正则替换：替换内容支持 $1 $2 这样的符号
|
||||
! 普通替换：替换内容支持 * 这样的符号，表示把命中的内容复制到替换的内容。（类似 $1 $2，但是 * 号会自动计算数字）
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 未来将逐步添加相关语法，兼容adblock puls的更多语法，敬请期待。
|
||||
! ******************************************************************************************
|
||||
@@ -0,0 +1,9 @@
|
||||
1|koolproxy.txt||静态规则
|
||||
1|daily.txt||每日规则
|
||||
1|kp.dat||视频规则
|
||||
1|user.txt||自定义规则
|
||||
1|yhosts.txt||Yhosts规则
|
||||
1|adg.txt||AdGuard规则
|
||||
1|steven.txt||Steven规则
|
||||
1|antiad.txt||AntiAD规则
|
||||
1|adgk.txt||坂本规则
|
||||
@@ -0,0 +1,49 @@
|
||||
! ******************************* KoolProxy 自定义过滤语法简表 *******************************
|
||||
! ------------------------ 规则基于adblock规则，并进行了语法部分的扩展 ------------------------
|
||||
! ABP规则请参考https://adblockplus.org/zh_CN/filters，下面为大致摘要
|
||||
! "!" 为行注释符，注释行以该符号起始作为一行注释语义，用于规则描述
|
||||
! "@@" 为白名单符，白名单具有最高优先级，放行过滤的网站，例如:@@||taobao.com
|
||||
! "@@@@" 超级白名单，比白名单符拥有更高的优先级，主要用于放行https网站，例如:@@@@||https://taobao.com
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! "*" 为字符通配符，能够匹配0长度或任意长度的字符串，该通配符不能与正则语法混用。
|
||||
! "^" 为分隔符，可以是除了字母、数字或者 _ - . % 之外的任何字符。
|
||||
! "~" 为排除标识符，通配符能过滤大多数广告，但同时存在误杀, 可以通过排除标识符修正误杀链接。
|
||||
! 注：通配符仅在 url 规则中支持，html 规则中不支持
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! "|" 为管线符号，来表示地址的最前端或最末端
|
||||
! "||" 为子域通配符，方便匹配主域名下的所有子域
|
||||
! 用法及例子如下：(以下等号表示等价于)
|
||||
! ||xx.com/ad = http://xx.com/ad* || http://*.xx.com/ad*
|
||||
! ||http://xx.com/ad = http://xx.com/ad* || http://*.xx.com/ad*
|
||||
! ||https://xx.com/ad = https://xx.com/ad* || https://*.xx.com/ad*
|
||||
! |xx.com/ad = http://xx.com/ad*
|
||||
! |http://xx.com/ad = http://xx.com/ad*
|
||||
! |https://xx.com/ad = https://xx.com/ad*
|
||||
! ad = http://*ad*
|
||||
! http://ad = http://*ad*
|
||||
! https://ad = 不支持，需要指定域名，如下例
|
||||
! https://xx.com/ad = |https://xx.com/ad = https://xx.com/ad*
|
||||
! [同时可以表示两个以及两个以上的域名]如下例子
|
||||
! https://xx.ad.com 和 https://xxx.xx.ad.com = ||https://ad.com (注意! 由于https的原因使用要非常谨慎,不可以大范围使用)
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 兼容adblock规则的html规则语法，例如：
|
||||
! fulldls.com,torrentzap.com##.tp_reccomend_banner
|
||||
! 但是推荐写成以下标准写法：
|
||||
! ||fulldls.com##.tp_reccomend_banner
|
||||
! ||torrentzap.com##.tp_reccomend_banner
|
||||
! 如果一个网站html规则有多条，可以合并为这样：
|
||||
! ||torrentzap.com##.tp_reccomend_banner,.ad_top,[class="ad_right"]......
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 文本替换语法：$s@匹配内容@替换内容@
|
||||
! 非标准端口过滤语法：||abc.com:8081/ad.html或者|http://adb.com:8081/
|
||||
! 文本替换例子：|http://cdn.pcbeta.js.inimc.com/data/cache/common.js?$s@old@new@
|
||||
! 重定向语法：$r@匹配内容@替换内容@
|
||||
! 重定向例子：|http://koolshare.cn$r@http://koolshare.cn/*@http://www.qq.com@
|
||||
! 注：文本替换语法及重定向语法中的匹配内容不仅支持通配符功能，而且额外支持以下功能
|
||||
! 支持通配符 * 和 ? 表示单个字符
|
||||
! 支持全正则匹配，/正则内容/ 表示应用正则匹配
|
||||
! 正则替换：替换内容支持 $1 $2 这样的符号
|
||||
! 普通替换：替换内容支持 * 这样的符号，表示把命中的内容复制到替换的内容。（类似 $1 $2，但是 * 号会自动计算数字）
|
||||
! ------------------------------------------------------------------------------------------
|
||||
! 未来将逐步添加相关语法，兼容adblock puls的更多语法，敬请期待。
|
||||
! ******************************************************************************************
|
||||
Whitespace-only changes.
Whitespace-only changes.
+171
@@ -0,0 +1,171 @@
|
||||
#!/bin/sh
|
||||
# set -x
|
||||
|
||||
. /lib/functions.sh
|
||||
|
||||
CONFIG=koolproxy
|
||||
KP_DIR=/usr/share/koolproxy
|
||||
TMP_DIR=/tmp/koolproxy
|
||||
LOGFILE="/var/log/koolproxy.log"
|
||||
|
||||
config_t_get() {
|
||||
local index=0
|
||||
[ -n "$4" ] && index=$4
|
||||
local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
|
||||
echo ${ret:=$3}
|
||||
}
|
||||
|
||||
limit_log() {
|
||||
local log=$1
|
||||
[ ! -f "$log" ] && return
|
||||
local sc=100
|
||||
[ -n "$2" ] && sc=$2
|
||||
local count=$(grep -c "" $log)
|
||||
if [ $count -gt $sc ];then
|
||||
let count=count-$sc
|
||||
sed -i "1,$count d" $log
|
||||
fi
|
||||
}
|
||||
|
||||
init_env() {
|
||||
rm -rf "$TMP_DIR"
|
||||
mkdir -p "$TMP_DIR"
|
||||
}
|
||||
|
||||
restart_koolproxy() {
|
||||
/etc/init.d/koolproxy restart
|
||||
}
|
||||
|
||||
__compare_file() {
|
||||
local descript=$1
|
||||
local localPath=$2
|
||||
local remoteUrl=$3
|
||||
|
||||
echo $(date "+%F %T"): ------------------- $descript更新 ------------------- >>$LOGFILE
|
||||
local filename=`basename $localPath`
|
||||
local remotePath="$TMP_DIR/$filename"
|
||||
wget "$remoteUrl" -q -O "$remotePath"
|
||||
if [ "$?" == "0" ]; then
|
||||
if [ -f "$localPath" ]; then
|
||||
localMD5=`md5sum "$localPath" | awk '{print $1}'`
|
||||
localNum=`cat "$localPath" | grep -v '^!' | wc -l`
|
||||
else
|
||||
localMD5="文件不存在"
|
||||
localNum="0"
|
||||
fi
|
||||
remoteMD5=`md5sum "$remotePath" | awk '{print $1}'`
|
||||
remoteNum=`cat "$remotePath" | grep -v '^!' | wc -l`
|
||||
|
||||
echo $(date "+%F %T"): 本地版本MD5：$localMD5 >>$LOGFILE
|
||||
echo $(date "+%F %T"): 本地版本条数：$localNum >>$LOGFILE
|
||||
echo >>$LOGFILE
|
||||
echo $(date "+%F %T"): 在线版本MD5：$remoteMD5 >>$LOGFILE
|
||||
echo $(date "+%F %T"): 在线版本条数：$remoteNum >>$LOGFILE
|
||||
echo >>$LOGFILE
|
||||
|
||||
if [ "$localMD5" != "$remoteMD5" ];then
|
||||
echo $(date "+%F %T"): 检测到更新，开始更新规则！ >>$LOGFILE
|
||||
mv -f "$remotePath" "$localPath"
|
||||
echo $(date "+%F %T"): 更新成功！ >>$LOGFILE
|
||||
echo >>$LOGFILE
|
||||
return 0
|
||||
fi
|
||||
else
|
||||
echo "$(date "+%F %T"): 获取在线版本时出现错误! " >>$LOGFILE
|
||||
echo >>$LOGFILE
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
__update_rule() {
|
||||
local name
|
||||
local file
|
||||
local exrule
|
||||
local enable
|
||||
config_get name $1 name
|
||||
config_get file $1 file
|
||||
config_get exrule $1 url
|
||||
config_get enable $1 load
|
||||
if [ -n "$file" ] && [ -n "$exrule" ]; then
|
||||
if [ $enable -ne 1 ]; then
|
||||
return
|
||||
fi
|
||||
__compare_file "$name" "$KP_DIR/data/rules/$file" "$exrule"
|
||||
if [ "$?" == "0" ]; then
|
||||
uci set koolproxy.$1.time="`date +%Y-%m-%d" "%H:%M`"
|
||||
uci commit koolproxy
|
||||
RESTART_KOOLPROXY=true
|
||||
fi
|
||||
cat $KP_DIR/data/rules/$file >>$KP_DIR/data/rules/user.txt
|
||||
echo >>$LOGFILE
|
||||
fi
|
||||
}
|
||||
|
||||
update_rss_rules() {
|
||||
cp $KP_DIR/data/user.txt $KP_DIR/data/rules/user.txt
|
||||
config_load $CONFIG
|
||||
config_foreach __update_rule rss_rule
|
||||
}
|
||||
|
||||
|
||||
|
||||
update_rules() {
|
||||
echo $(date "+%F %T"): ------------------- 内置规则更新 ------------------- >>$LOGFILE
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/kp.dat' -q -O $KP_DIR/data/rules/kp.dat
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/daily.txt' -q -O $KP_DIR/data/rules/daily.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/koolproxy.txt' -q -O $KP_DIR/data/rules/koolproxy.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/yhosts.txt' -q -O $KP_DIR/data/rules/yhosts.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/steven.txt' -q -O $KP_DIR/data/rules/steven.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/adg.txt' -q -O $KP_DIR/data/rules/adg.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/antiad.txt' -q -O $KP_DIR/data/rules/antiad.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/adgk.txt' -q -O $KP_DIR/data/rules/adgk.txt
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/koolproxy_ipset.conf' -q -O $KP_DIR/koolproxy_ipset.conf
|
||||
wget 'https://cdn.jsdelivr.net/gh/ilxp/koolproxy@main/rules/dnsmasq.adblock' -q -O $KP_DIR/dnsmasq.adblock
|
||||
adg_rules_local=`cat /usr/share/koolproxy/data/rules/adg.txt | sed -n '4p'|awk '{print $4}'`
|
||||
steven_rules_local=`cat /usr/share/koolproxy/data/rules/steven.txt | sed -n '2p'|awk '{print $3,$4,$5,$6}'`
|
||||
yhosts_rules_local=`cat /usr/share/koolproxy/data/rules/yhosts.txt | sed -n '1p' | cut -d ":" -f2`
|
||||
antiad_rules_local=`cat /usr/share/koolproxy/data/rules/antiad.txt | sed -n '2p' | cut -d "=" -f2`
|
||||
koolproxy_rules_local=`cat /usr/share/koolproxy/data/rules/koolproxy.txt | sed -n '3p'|awk '{print $3,$4}'`
|
||||
adgk_rules_local=`cat /usr/share/koolproxy/data/rules/adgk.txt | sed -n '2p'|awk '{print $3}'`
|
||||
echo $(date "+%F %T"): -------------------AdGuard规则 Version $adg_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): -------------------Steven规则 Version $steven_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): -------------------Yhosts规则 Version $yhosts_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): -------------------AntiAD规则 Version $antiad_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): -------------------坂本规则 Version $adgk_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): -------------------静态规则 Version $koolproxy_rules_local >>$LOGFILE
|
||||
echo $(date "+%F %T"): ------------------- 内置规则更新成功！ ------------------- >>$LOGFILE
|
||||
RESTART_KOOLPROXY=true
|
||||
|
||||
}
|
||||
|
||||
update_adb_host() {
|
||||
/usr/sbin/adblockplus >>$LOGFILE 2>&1 &
|
||||
if [ "$?" == "0" ]; then
|
||||
RESTART_DNSMASQ=true
|
||||
fi
|
||||
}
|
||||
|
||||
# main process
|
||||
init_env
|
||||
limit_log $LOGFILE
|
||||
|
||||
# update rules
|
||||
update_rules
|
||||
|
||||
# update user rules
|
||||
update_rss_rules
|
||||
|
||||
koolproxy_mode=$(config_t_get global koolproxy_mode 1)
|
||||
koolproxy_host=$(config_t_get global koolproxy_host 0)
|
||||
|
||||
# update ADB Plus Host
|
||||
if [ "$koolproxy_mode" == "2" ] && [ "$koolproxy_host" == "1" ];then
|
||||
update_adb_host
|
||||
fi
|
||||
|
||||
if [ $RESTART_KOOLPROXY ]; then
|
||||
restart_koolproxy
|
||||
echo $(date "+%F %T"): 重启koolproxy进程 >>$LOGFILE
|
||||
fi
|
||||
|
||||
init_env
|
||||
@@ -0,0 +1,11 @@
|
||||
{
|
||||
"luci-app-ikoolproxy": {
|
||||
"description": "Grant UCI access for luci-app-ikoolproxy",
|
||||
"read": {
|
||||
"uci": [ "koolproxy" ]
|
||||
},
|
||||
"write": {
|
||||
"uci": [ "koolproxy" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
{
|
||||
"config": "koolproxy",
|
||||
"init": "koolproxy"
|
||||
}
|
||||
Reference in new issue
Block a user