🍕 Sync 2026-09-14 23:30:37

luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js

@@ -1,5 +1,7 @@
 'use strict';
 'require view';
+'require fs';
+'require poll';
 'require rpc';
 'require uci';
 'require form';
@@ -15,10 +17,16 @@ return view.extend({
 		expect: { result: [] }
 	}),
 
+	getRuntimeStatus() {
+		return L.resolveDefault(
+			fs.exec_direct('/usr/libexec/luci-firewall-status', [], 'json'), {});
+	},
+
 	load() {
 		return Promise.all([
 			this.callConntrackHelpers(),
-			firewall.getDefaults()
+			firewall.getDefaults(),
+			this.getRuntimeStatus()
 		]);
 	},
 
@@ -29,9 +37,24 @@ return view.extend({
 			return this.renderZones(data);
 	},
 
-	renderZones([ctHelpers, fwDefaults]) {
+	renderZones([ctHelpers, fwDefaults, runtimeStatus]) {
 		let m, s, o, out;
 		const fw4 = L.hasSystemFeature('firewall4');
+		const runtimeStatusText = E('span', {}, [ '-' ]);
+		const updateRuntimeStatus = (status) => {
+			const natModes = {
+				fullcone: 'FULLCONENAT',
+				nat1: _('Broadcom Fullcone NAT1'),
+				disabled: _('Disabled')
+			};
+			const natMode = natModes[status?.nat_mode] || _('Unknown');
+			const tcpcca = status?.tcp_cca
+				? status.tcp_cca.toUpperCase()
+				: _('Unknown');
+
+			runtimeStatusText.textContent =
+				_('Running status: %s, TCP congestion control algorithm is %s').format(natMode, tcpcca);
+		};
 		const addTCPCCAOption = () => {
 			const tcpcca = s.option(form.ListValue, 'tcpcca', _('TCP CCA'),
 				_('TCP congestion control algorithm.'));
@@ -42,6 +65,8 @@ return view.extend({
 			tcpcca.rmempty = false;
 		};
 
+		updateRuntimeStatus(runtimeStatus);
+
 		m = new form.Map('firewall', _('Firewall - Zone Settings'),
 			_('The firewall creates zones over your network interfaces to control network traffic flow.'));
 
@@ -462,6 +487,24 @@ return view.extend({
 		o.filter = out.filter;
 		o.cfgvalue = out.cfgvalue;
 
-		return m.render();
+		return m.render().then(L.bind(function(mapEl) {
+			const firstSection = mapEl.querySelector('.cbi-section');
+			const statusSection = E('div', {
+				'class': 'cbi-section firewall-runtime-status',
+				'style': 'overflow-x:auto'
+			}, [
+				E('div', {
+					'style': 'padding:.75em 1.5em;color:#008000;font-size:1em;font-weight:600;white-space:nowrap'
+				}, [ runtimeStatusText ])
+			]);
+
+			firstSection.parentNode.insertBefore(statusSection, firstSection);
+
+			poll.add(L.bind(function() {
+				return this.getRuntimeStatus().then(updateRuntimeStatus);
+			}, this), 5);
+
+			return mapEl;
+		}, this));
 	}
 });

luci-app-firewall/po/templates/firewall.pot

@@ -260,6 +260,22 @@ msgstr ""
 msgid "Destination zone"
 msgstr ""
 
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:49
+msgid "Disabled"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:48
+msgid "Broadcom Fullcone NAT1"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:56
+msgid "Running status: %s, TCP congestion control algorithm is %s"
+msgstr ""
+
+#: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:54
+msgid "Unknown"
+msgstr ""
+
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:263
 msgid "Device name"
 msgstr ""

luci-app-firewall/po/zh_Hans/firewall.po

@@ -344,6 +344,18 @@ msgstr "TCP 拥塞控制算法"
 msgid "TCP congestion control algorithm."
 msgstr "TCP 拥塞控制算法。"
 
+msgid "Running status: %s, TCP congestion control algorithm is %s"
+msgstr "当前运行状态：%s，TCP 拥塞控制算法为 %s"
+
+msgid "Broadcom Fullcone NAT1"
+msgstr "Broadcom Fullcone NAT1"
+
+msgid "Disabled"
+msgstr "已禁用"
+
+msgid "Unknown"
+msgstr "未知"
+
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js:346
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/rules.js:463
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/snats.js:339

luci-app-firewall/po/zh_Hant/firewall.po

@@ -328,6 +328,18 @@ msgstr "啟用"
 msgid "Enable NAT Loopback"
 msgstr "啟用 NAT 回送"
 
+msgid "Running status: %s, TCP congestion control algorithm is %s"
+msgstr "目前執行狀態：%s，TCP 壅塞控制演算法為 %s"
+
+msgid "Broadcom Fullcone NAT1"
+msgstr "Broadcom Fullcone NAT1"
+
+msgid "Disabled"
+msgstr "已停用"
+
+msgid "Unknown"
+msgstr "未知"
+
 #: applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/zones.js:43
 msgid "Enable SYN-flood protection"
 msgstr "啟用 SYN 洪水保護"

luci-app-firewall/root/usr/libexec/luci-firewall-status

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+tcp_cca="$(cat /proc/sys/net/ipv4/tcp_congestion_control 2>/dev/null)"
+nat_mode="disabled"
+
+rules="$(iptables-save -t nat 2>/dev/null)"
+
+if printf '%s\n' "$rules" | grep -q -- '--mode fullcone'; then
+	nat_mode="nat1"
+elif printf '%s\n' "$rules" | grep -q -- '-j FULLCONENAT'; then
+	nat_mode="fullcone"
+else
+	rules="$(nft list ruleset 2>/dev/null)"
+
+	if printf '%s\n' "$rules" | grep -Eq 'masquerade[[:space:]]+fullcone'; then
+		nat_mode="nat1"
+	elif printf '%s\n' "$rules" | grep -Eq '(^|[[:space:]])fullcone([[:space:]]|$)'; then
+		nat_mode="fullcone"
+	fi
+fi
+
+printf '{"nat_mode":"%s","tcp_cca":"%s"}\n' "$nat_mode" "$tcp_cca"

luci-app-firewall/root/usr/share/rpcd/acl.d/luci-app-firewall.json

@@ -2,8 +2,10 @@
 	"luci-app-firewall": {
 		"description": "Grant access to firewall configuration",
 		"read": {
+			"cgi-io": [ "exec" ],
 			"file": {
-				"/etc/firewall.user": [ "read" ]
+				"/etc/firewall.user": [ "read" ],
+				"/usr/libexec/luci-firewall-status": [ "exec" ]
 			},
 			"ubus": {
 				"file": [ "read" ],