🛸 Sync 2026-10-18 10:48:36

luci-app-fwlive/root/usr/libexec/fwlive-is-firewall-event.awk

@@ -54,8 +54,36 @@ function strip_kv(s, out, i, n, prev, rest) {
 	}
 	return out
 }
+function action_word_prefix(first, words, n, i) {
+	n = split("ACCEPT ALLOW PASS DROP REJECT DENY BLOCK", words, " ")
+	first = tolower(first)
+	for (i = 1; i <= n; i++) {
+		if (tolower(words[i]) == first) return 1
+	}
+	return 0
+}
+function strip_leading_rule_hint(s, first, rest) {
+	sub(/^\[[[:space:]]*[0-9.]+\][[:space:]]*/, "", s)
+	if (match(tolower(s), /^fw4:[[:space:]]*/))
+		s = substr(s, RSTART + RLENGTH)
+	if (match(s, "^[A-Za-z0-9_.-]+(:|[[:space:]]+)(IN=|OUT=|SRC=|DST=|PROTO=)")) {
+		match(s, "^[A-Za-z0-9_.-]+")
+		first = substr(s, RSTART, RLENGTH)
+		if (!action_word_prefix(first)) {
+			rest = substr(s, RSTART + RLENGTH)
+			match(rest, "^(:|[[:space:]]+)")
+			s = substr(rest, RSTART + RLENGTH)
+		}
+	}
+	else if (match(s, "^[A-Za-z0-9_.-]+:")) {
+		first = substr(s, RSTART, RLENGTH - 1)
+		if (tolower(first) != "kernel" && tolower(first) != "iptables" && !action_word_prefix(first))
+			s = substr(s, RSTART + RLENGTH)
+	}
+	return s
+}
 function detect_action(s, words, n, i, w, wl, lc, start, pos, before, afterc, best, bestpos) {
-	s = strip_kv(s)
+	s = strip_kv(strip_leading_rule_hint(s))
 	n = split("ACCEPT ALLOW PASS DROP REJECT DENY BLOCK", words, " ")
 	lc = tolower(s)
 	best = ""