mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-03 03:13:56 +08:00
🍕 Sync 2026-09-14 23:30:37
This commit is contained in:
github-actions[bot] committed
1 parent
0603b094cf
commit
81fe4cd866
214 files changed
+10806
-2630
No files matched your search
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-passwall
|
||||
PKG_VERSION:=26.9.9
|
||||
PKG_RELEASE:=270
|
||||
PKG_RELEASE:=271
|
||||
PKG_PO_VERSION:=$(PKG_VERSION)
|
||||
|
||||
PKG_CONFIG_DEPENDS:= \
|
||||
|
||||
@@ -652,21 +652,46 @@ o:value("info", "Info")
|
||||
o:value("warn", "Warning")
|
||||
o:value("error", "Error")
|
||||
|
||||
o = s:taboption("log", Flag, "advanced_log_feature", translate("Advanced log feature"), translate("For professionals only."))
|
||||
o.default = "0"
|
||||
o = s:taboption("log", Flag, "sys_log", translate("Logging to system log"), translate("Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."))
|
||||
o:depends("advanced_log_feature", "1")
|
||||
o.default = "0"
|
||||
o = s:taboption("log", Value, "persist_log_path", translate("Persist log file directory"), translate("The path to the directory used to store persist log files, the \"/\" at the end can be omitted. Leave it blank to disable this feature."))
|
||||
o:depends({ ["advanced_log_feature"] = 1, ["sys_log"] = 0 })
|
||||
o = s:taboption("log", Value, "log_event_filter", translate("Log Event Filter"), translate("Support regular expression."))
|
||||
o:depends("advanced_log_feature", "1")
|
||||
o = s:taboption("log", Value, "log_event_cmd", translate("Shell Command"), translate("Shell command to execute, replace log content with %s."))
|
||||
o:depends("advanced_log_feature", "1")
|
||||
o = s:taboption("log", DummyValue, "_node_log", translate("Log File"))
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
local log_file = api.TMP_PATH .. "/acl/default/global.log"
|
||||
local log_url = api.url("get_redir_log") .. "?id=default"
|
||||
local s = "<code>%s</code> " % log_file
|
||||
if api.fs.access(log_file) then
|
||||
local btn = string.format(
|
||||
'<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="window.open(\'%s\', \'_blank\')" />',
|
||||
translate("View Log"),
|
||||
log_url
|
||||
)
|
||||
s = s .. btn
|
||||
end
|
||||
return s
|
||||
end
|
||||
o:depends("log_node", "1")
|
||||
|
||||
o = s:taboption("log", Flag, "log_chinadns_ng", translate("Enable") .. " ChinaDNS-NG " .. translate("Log"))
|
||||
o.default = "0"
|
||||
o.rmempty = false
|
||||
o:depends("dns_shunt", "chinadns-ng")
|
||||
|
||||
o = s:taboption("log", DummyValue, "_chinadns_ng_log", translate("Log File"))
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
local log_file = api.TMP_PATH .. "/acl/default/chinadns_ng.log"
|
||||
local log_url = api.url("get_chinadns_log") .. "?flag=default"
|
||||
local s = "<code>%s</code> " % log_file
|
||||
if api.fs.access(log_file) then
|
||||
local btn = string.format(
|
||||
'<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="window.open(\'%s\', \'_blank\')" />',
|
||||
translate("View Log"),
|
||||
log_url
|
||||
)
|
||||
s = s .. btn
|
||||
end
|
||||
return s
|
||||
end
|
||||
o:depends("log_chinadns_ng", "1")
|
||||
|
||||
o = s:taboption("log", DummyValue, "_log_tips", " ")
|
||||
o.rawhtml = true
|
||||
|
||||
@@ -163,12 +163,16 @@ function sh_uci_commit(config)
|
||||
exec_call(string.format("uci -q commit %s", config))
|
||||
end
|
||||
|
||||
function del_cache_var(key)
|
||||
sys.call(string.format('. /usr/share/passwall2/utils.sh ; del_cache_var "%s"', key))
|
||||
end
|
||||
|
||||
function set_cache_var(key, val)
|
||||
sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var %s "%s"', key, val))
|
||||
sys.call(string.format('. /usr/share/passwall/utils.sh ; set_cache_var "%s" "%s"', key, val))
|
||||
end
|
||||
|
||||
function get_cache_var(key)
|
||||
local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var %s)', key))
|
||||
local val = sys.exec(string.format('. /usr/share/passwall/utils.sh ; echo -n $(get_cache_var "%s")', key))
|
||||
if val == "" then val = nil end
|
||||
return val
|
||||
end
|
||||
@@ -2072,3 +2076,11 @@ function gen_wireguard_key()
|
||||
}
|
||||
end
|
||||
end
|
||||
|
||||
function get_socks_port_by_cache(node_id)
|
||||
return get_cache_var("node_%s_socks_port" % { node_id })
|
||||
end
|
||||
|
||||
function set_socks_port_to_cache(node_id, v)
|
||||
set_cache_var("node_%s_socks_port" % { node_id }, v)
|
||||
end
|
||||
@@ -105,31 +105,54 @@ function gen_outbound(flag, node, tag, proxy_table)
|
||||
end
|
||||
|
||||
if node.type ~= "sing-box" then
|
||||
local relay_port = node.port
|
||||
local new_port = api.get_new_port()
|
||||
local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
|
||||
if tag and node_id and not tag:find(node_id) then
|
||||
config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
|
||||
end
|
||||
if run_socks_instance then
|
||||
sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
|
||||
new_port, --flag
|
||||
node_id, --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file, --config file
|
||||
(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
|
||||
if node.type == "Socks" then
|
||||
node.protocol = "socks"
|
||||
proxy_tag = "socks <- " .. node_id
|
||||
else
|
||||
local new_port
|
||||
if run_socks_instance then
|
||||
local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
|
||||
if relay_port == "" then
|
||||
local cache = api.get_socks_port_by_cache(node_id)
|
||||
if cache then
|
||||
new_port = cache
|
||||
run_socks_instance = nil
|
||||
end
|
||||
end
|
||||
if run_socks_instance then
|
||||
new_port = api.get_new_port()
|
||||
local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
|
||||
if tag and node_id and not tag:find(node_id) then
|
||||
config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
|
||||
end
|
||||
sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
|
||||
new_port, --flag
|
||||
node_id, --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file, --config file
|
||||
relay_port --relay port
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
if relay_port == "" then
|
||||
api.set_socks_port_to_cache(node_id, new_port)
|
||||
end
|
||||
end
|
||||
else
|
||||
TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001 -- 导出配置时作为演示
|
||||
new_port = TMP_PORT
|
||||
end
|
||||
if new_port then
|
||||
node = {
|
||||
protocol = "socks",
|
||||
address = "127.0.0.1",
|
||||
port = new_port
|
||||
}
|
||||
proxy_tag = "socks <- " .. node_id
|
||||
end
|
||||
end
|
||||
node = {
|
||||
protocol = "socks",
|
||||
address = "127.0.0.1",
|
||||
port = new_port
|
||||
}
|
||||
proxy_tag = "socks <- " .. node_id
|
||||
else
|
||||
if proxy_tag then
|
||||
node.detour = proxy_tag
|
||||
|
||||
@@ -12,7 +12,7 @@ local GLOBAL = {
|
||||
|
||||
local xray_version = api.get_app_version("xray")
|
||||
|
||||
local xray_min_version = "26.3.27"
|
||||
local xray_min_version = "26.7.11"
|
||||
|
||||
local function get_domain_excluded()
|
||||
local path = string.format("/usr/share/%s/rules/domains_excluded", api.c_config)
|
||||
@@ -58,31 +58,50 @@ function gen_outbound(flag, node, tag, proxy_table)
|
||||
if node.type ~= "Xray" then
|
||||
if node.type == "Socks" then
|
||||
node.protocol = "socks"
|
||||
node.transport = "tcp"
|
||||
node.transport = "raw"
|
||||
else
|
||||
local relay_port = node.port
|
||||
local new_port = api.get_new_port()
|
||||
local config_file = string.format("%s_%s_%s.json", flag, tag, new_port)
|
||||
if tag and node_id and not tag:find(node_id) then
|
||||
config_file = string.format("%s_%s_%s_%s.json", flag, tag, node_id, new_port)
|
||||
end
|
||||
local new_port
|
||||
if run_socks_instance then
|
||||
sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
|
||||
new_port, --flag
|
||||
node_id, --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file, --config file
|
||||
(proxy_tag and relay_port) and tostring(relay_port) or "" --relay port
|
||||
local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
|
||||
if relay_port == "" then
|
||||
local cache = api.get_socks_port_by_cache(node_id)
|
||||
if cache then
|
||||
new_port = cache
|
||||
run_socks_instance = nil
|
||||
end
|
||||
end
|
||||
if run_socks_instance then
|
||||
new_port = api.get_new_port()
|
||||
local config_file = string.format("nodesocks_%s_%s.json", node_id, new_port)
|
||||
if tag and node_id and not tag:find(node_id) then
|
||||
config_file = string.format("nodesocks_%s_%s_%s.json", tag, node_id, new_port)
|
||||
end
|
||||
sys.call(string.format('/usr/share/passwall/app.sh run_socks "%s"> /dev/null',
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s relay_port=%s",
|
||||
new_port, --flag
|
||||
node_id, --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file, --config file
|
||||
relay_port --relay port
|
||||
)
|
||||
)
|
||||
)
|
||||
))
|
||||
if relay_port == "" then
|
||||
api.set_socks_port_to_cache(node_id, new_port)
|
||||
end
|
||||
end
|
||||
else
|
||||
TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001 -- 导出配置时作为演示
|
||||
new_port = TMP_PORT
|
||||
end
|
||||
if new_port then
|
||||
node = {}
|
||||
node.protocol = "socks"
|
||||
node.transport = "raw"
|
||||
node.address = "127.0.0.1"
|
||||
node.port = new_port
|
||||
end
|
||||
node = {}
|
||||
node.protocol = "socks"
|
||||
node.transport = "tcp"
|
||||
node.address = "127.0.0.1"
|
||||
node.port = new_port
|
||||
end
|
||||
node.stream_security = "none"
|
||||
proxy_tag = "socks <- " .. node_id
|
||||
@@ -156,7 +175,7 @@ function gen_outbound(flag, node, tag, proxy_table)
|
||||
} or nil,
|
||||
dialerProxy = dialer_proxy_tag,
|
||||
},
|
||||
[(api.compare_versions(xray_version, "<", "26.7.11")) and "network" or "method"] = node.transport, -- Todo: Remove version check and "network"
|
||||
method = node.transport,
|
||||
security = node.stream_security,
|
||||
tlsSettings = (node.stream_security == "tls") and {
|
||||
serverName = node.tls_serverName,
|
||||
@@ -483,7 +502,7 @@ function gen_config_server(node)
|
||||
local settings = nil
|
||||
local routing = nil
|
||||
local outbounds = {
|
||||
{ protocol = "freedom", tag = "direct", settings = { finalRules = {{ action = "allow" }}}}, { protocol = "blackhole", tag = "blocked" }
|
||||
{ protocol = "freedom", tag = "direct", finalRules = {{ action = "allow" }}}, { protocol = "blackhole", tag = "blocked" }
|
||||
}
|
||||
|
||||
local users = node.users or {}
|
||||
@@ -631,9 +650,7 @@ function gen_config_server(node)
|
||||
interface = node.outbound_node_iface
|
||||
}
|
||||
},
|
||||
settings = {
|
||||
finalRules = {{ action = "allow" }}
|
||||
}
|
||||
finalRules = {{ action = "allow" }}
|
||||
}
|
||||
sys.call(string.format("mkdir -p %s && touch %s/%s", api.TMP_IFACE_PATH, api.TMP_IFACE_PATH, node.outbound_node_iface))
|
||||
else
|
||||
@@ -675,7 +692,7 @@ function gen_config_server(node)
|
||||
protocol = node.protocol,
|
||||
settings = settings,
|
||||
streamSettings = {
|
||||
[(api.compare_versions(xray_version, "<", "26.7.11")) and "network" or "method"] = node.transport, -- Todo: Remove version check and "network"
|
||||
method = node.transport,
|
||||
security = "none",
|
||||
tlsSettings = ("1" == node.tls) and {
|
||||
disableSystemRoot = false,
|
||||
@@ -857,9 +874,6 @@ function gen_config_server(node)
|
||||
config.outbounds[index][k] = nil
|
||||
end
|
||||
end
|
||||
if value.protocol == "freedom" and api.compare_versions(xray_version, "<", "26.5.3") then -- Todo is to remove it
|
||||
value.settings = nil
|
||||
end
|
||||
end
|
||||
|
||||
return config
|
||||
@@ -1316,9 +1330,7 @@ function gen_config(var)
|
||||
interface = node.iface
|
||||
}
|
||||
},
|
||||
settings = (api.compare_versions(xray_version, ">", "26.4.25")) and { -- Todo: Remove version check
|
||||
finalRules = {{ action = "allow" }}
|
||||
} or nil
|
||||
finalRules = {{ action = "allow" }}
|
||||
}
|
||||
sys.call(string.format("mkdir -p %s && touch %s/%s", api.TMP_IFACE_PATH, api.TMP_IFACE_PATH, node.iface))
|
||||
end
|
||||
@@ -1802,11 +1814,10 @@ function gen_config(var)
|
||||
sockopt = { dialerProxy = (dns_outbound_tag ~= "blackhole") and dns_outbound_tag or "direct" }
|
||||
} or nil,
|
||||
settings = {
|
||||
address = (chn_list ~= "proxy") and "8.8.8.8" or "223.5.5.5",
|
||||
port = 53,
|
||||
network = "tcp",
|
||||
nonIPQuery = (api.compare_versions(xray_version, "<", "26.4.25")) and "reject" or nil, -- Todo is to remove it
|
||||
rules = (api.compare_versions(xray_version, ">", "26.4.17")) and {} or nil
|
||||
rewriteAddress = (chn_list ~= "proxy") and "8.8.8.8" or "223.5.5.5",
|
||||
rewritePort = 53,
|
||||
rewriteNetwork = "tcp",
|
||||
rules = {}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2030,9 +2041,7 @@ function gen_config(var)
|
||||
local direct_outbound = {
|
||||
protocol = "freedom",
|
||||
tag = "direct",
|
||||
settings = (api.compare_versions(xray_version, ">", "26.4.25")) and { -- Todo: Remove version check
|
||||
finalRules = {{ action = "allow" }}
|
||||
} or nil,
|
||||
finalRules = {{ action = "allow" }},
|
||||
streamSettings = {
|
||||
sockopt = {
|
||||
mark = 255,
|
||||
@@ -2136,7 +2145,7 @@ function gen_proto_config(var)
|
||||
local outbound = {
|
||||
protocol = server_proto,
|
||||
streamSettings = {
|
||||
network = "tcp",
|
||||
method = "raw",
|
||||
security = "none"
|
||||
},
|
||||
settings = {
|
||||
@@ -2161,10 +2170,10 @@ function gen_proto_config(var)
|
||||
table.insert(outbounds, {
|
||||
protocol = "freedom",
|
||||
tag = "direct",
|
||||
settings = (api.compare_versions(xray_version, ">", "26.4.25")) and { -- Todo: Remove version check
|
||||
finalRules = {{ action = "allow" }}
|
||||
} or nil,
|
||||
sockopt = {mark = 255}
|
||||
finalRules = {{ action = "allow" }},
|
||||
streamSettings = {
|
||||
sockopt = {mark = 255}
|
||||
}
|
||||
})
|
||||
|
||||
local config = {
|
||||
@@ -2176,7 +2185,10 @@ function gen_proto_config(var)
|
||||
-- 传出连接
|
||||
outbounds = outbounds,
|
||||
-- 路由
|
||||
routing = routing
|
||||
routing = routing,
|
||||
version = {
|
||||
min = xray_min_version
|
||||
}
|
||||
}
|
||||
return jsonc.stringify(config, 1)
|
||||
end
|
||||
|
||||
@@ -1685,36 +1685,6 @@ msgstr "启用节点日志"
|
||||
msgid "Log Level"
|
||||
msgstr "日志等级"
|
||||
|
||||
msgid "Advanced log feature"
|
||||
msgstr "高级日志功能"
|
||||
|
||||
msgid "For professionals only."
|
||||
msgstr "仅限专业人士使用。"
|
||||
|
||||
msgid "Persist log file directory"
|
||||
msgstr "持久性日志文件目录"
|
||||
|
||||
msgid "The path to the directory used to store persist log files, the \"/\" at the end can be omitted. Leave it blank to disable this feature."
|
||||
msgstr "用来存储持久性日志文件的目录路径，末尾的 “/” 可以省略。留空以禁用此功能。"
|
||||
|
||||
msgid "Logging to system log"
|
||||
msgstr "记录到系统日志"
|
||||
|
||||
msgid "Logging to the system log for more advanced functions. For example, send logs to a dedicated log server."
|
||||
msgstr "将日志记录到系统日志，以实现更加高级的功能。例如，把日志发送到专门的日志服务器。"
|
||||
|
||||
msgid "Log Event Filter"
|
||||
msgstr "日志事件过滤器"
|
||||
|
||||
msgid "Support regular expression."
|
||||
msgstr "支持正则表达式。"
|
||||
|
||||
msgid "Shell Command"
|
||||
msgstr "Shell 命令"
|
||||
|
||||
msgid "Shell command to execute, replace log content with %s."
|
||||
msgstr "要执行的 Shell 命令，用 %s 代替日志内容。"
|
||||
|
||||
msgid "Not enabled log"
|
||||
msgstr "未启用日志"
|
||||
|
||||
|
||||
@@ -1,17 +1,12 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Devices without a hardware RTC boot with a wrong system clock: sysfixtime can
|
||||
# only restore the mtime of the newest file under /etc, so the clock is usually
|
||||
# hours behind after a cold boot. passwall is then started by
|
||||
# /etc/hotplug.d/iface/98-passwall on ifup, which typically happens before NTP
|
||||
# has corrected the time, and time-sensitive handshakes (VMess AEAD, TLS) fail.
|
||||
#
|
||||
# Nothing restarts passwall once the clock is corrected, so it stays broken
|
||||
# until the user restarts it manually. Restart once when ntpd reports that the
|
||||
# time is valid -- the same approach dnsmasq uses for DNSSEC in
|
||||
# /etc/hotplug.d/ntp/25-dnsmasqsec.
|
||||
[ "$ACTION" = "step" ] || exit 0
|
||||
|
||||
[ "$ACTION" = "stratum" ] || exit 0
|
||||
offset=${offset#-}
|
||||
offset=${offset%.*}
|
||||
|
||||
# Skip service restart if the time adjustment is less than 120 seconds.
|
||||
[ "$offset" -lt 120 ] && exit 0
|
||||
|
||||
. /usr/share/passwall/utils.sh
|
||||
|
||||
@@ -23,5 +18,5 @@ NTP_LOCK_FILE="${LOCK_PATH}/${CONFIG}_ntp.lock"
|
||||
echo $$ > ${NTP_LOCK_FILE}
|
||||
|
||||
/etc/init.d/${CONFIG} restart >/dev/null 2>&1 &
|
||||
logger -p notice -t network -s "${CONFIG}: restart after NTP time became valid"
|
||||
logger -p notice -t network -s "${CONFIG}: restart after NTP time step (${offset}s)"
|
||||
}
|
||||
@@ -109,20 +109,26 @@ api.uci_foreach_c("haproxy_config", function(t)
|
||||
t.origin_port = server_port
|
||||
if health_check_type == "script_logic" then
|
||||
if server_node.type ~= "Socks" then
|
||||
local relay_port = server_node.port
|
||||
local new_port = api.get_new_port()
|
||||
local config_file = string.format("%s_%s.json", t[".name"], new_port)
|
||||
sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
|
||||
appname,
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
|
||||
new_port, --flag
|
||||
server_node[".name"], --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file --config file
|
||||
local new_port
|
||||
local cache = api.get_socks_port_by_cache(server_node[".name"])
|
||||
if cache then
|
||||
new_port = cache
|
||||
else
|
||||
new_port = api.get_new_port()
|
||||
local config_file = string.format("%s_%s.json", t[".name"], new_port)
|
||||
sys.call(string.format('/usr/share/%s/app.sh run_socks "%s"> /dev/null',
|
||||
appname,
|
||||
string.format("flag=%s node=%s bind=%s socks_port=%s config_file=%s",
|
||||
new_port, --flag
|
||||
server_node[".name"], --node
|
||||
"127.0.0.1", --bind
|
||||
new_port, --socks port
|
||||
config_file --config file
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
api.set_socks_port_to_cache(server_node[".name"], new_port)
|
||||
end
|
||||
server_address = "127.0.0.1"
|
||||
server_port = new_port
|
||||
end
|
||||
|
||||
@@ -469,16 +469,28 @@ load_acl() {
|
||||
else
|
||||
[ -n "${DIRECT_DNSMASQ_PORT}" ] && dns_redirect=${DIRECT_DNSMASQ_PORT}
|
||||
fi
|
||||
if [ -n "${dns_redirect}" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
|
||||
[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
|
||||
[ "$_ipv4" != "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
|
||||
#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
|
||||
#nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :${dns_redirect} comment \"$remarks\""
|
||||
|
||||
if ([ -n "$tcp_port" ] || [ -n "$udp_port" ]) && [ -n "$dns_redirect" ]; then
|
||||
if [ "$PROXY_IPV6" = "1" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} udp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
|
||||
else
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} udp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp ${_ipt_source} tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter redirect to :$dns_redirect comment \"$remarks\""
|
||||
fi
|
||||
[ -z "$(get_cache_var "ACL_${sid}_default")" ] && echolog " - ${msg}节点不同于全局配置，DNS 重定向到专用服务器[${dns_redirect}]。"
|
||||
else
|
||||
if [ "$PROXY_IPV6" = "1" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
|
||||
else
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp ${_ipt_source} udp dport 53 counter return comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp ${_ipt_source} tcp dport 53 counter return comment \"$remarks\""
|
||||
fi
|
||||
fi
|
||||
|
||||
[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
|
||||
@@ -657,15 +669,26 @@ load_acl() {
|
||||
[ -n "${DIRECT_DNSMASQ_PORT}" ] && DNS_REDIRECT=${DIRECT_DNSMASQ_PORT}
|
||||
fi
|
||||
|
||||
if [ -n "${DNS_REDIRECT}" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :${DNS_REDIRECT} comment \"默认\""
|
||||
if ([ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ]) && [ -n "$DNS_REDIRECT" ]; then
|
||||
if [ "$PROXY_IPV6" = "1" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
|
||||
else
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp udp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol tcp tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT comment \"默认\""
|
||||
fi
|
||||
else
|
||||
if [ "$PROXY_IPV6" = "1" ]; then
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto udp udp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS meta l4proto tcp tcp dport 53 counter return comment \"默认\""
|
||||
else
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol udp udp dport 53 counter return comment \"默认\""
|
||||
nft "add rule $NFTABLE_NAME PSW_DNS ip protocol tcp tcp dport 53 counter return comment \"默认\""
|
||||
fi
|
||||
fi
|
||||
|
||||
[ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ] && {
|
||||
@@ -1310,10 +1333,15 @@ add_firewall_rule() {
|
||||
|
||||
if [ -n "$NODE" ] && ([ -n "${LOCALHOST_TCP_PROXY_MODE}" ] || [ -n "${LOCALHOST_UDP_PROXY_MODE}" ]); then
|
||||
[ -n "$DNS_REDIRECT_PORT" ] && {
|
||||
nft "add rule $NFTABLE_NAME nat_output ip protocol udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
nft "add rule $NFTABLE_NAME nat_output ip protocol tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
nft "add rule $NFTABLE_NAME nat_output meta l4proto udp oif lo udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
nft "add rule $NFTABLE_NAME nat_output meta l4proto tcp oif lo tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
if [ "$PROXY_IPV6" == "1" ]; then
|
||||
#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp udp dport 53 counter accept"
|
||||
#nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp tcp dport 53 counter accept"
|
||||
nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
nft "add rule $NFTABLE_NAME nat_output oif lo meta l4proto tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
else
|
||||
nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol udp udp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
nft "add rule $NFTABLE_NAME nat_output oif lo ip protocol tcp tcp dport 53 counter redirect to :$DNS_REDIRECT_PORT comment \"PSW_DNS\""
|
||||
fi
|
||||
}
|
||||
fi
|
||||
|
||||
|
||||
@@ -183,8 +183,6 @@ test_auto_switch() {
|
||||
start() {
|
||||
id=$1
|
||||
LOCK_FILE=${LOCK_PATH}/${CONFIG}_socks_auto_switch_${id}.lock
|
||||
LOG_EVENT_FILTER=$(uci -q get "${CONFIG}.global[0].log_event_filter" 2>/dev/null)
|
||||
LOG_EVENT_CMD=$(uci -q get "${CONFIG}.global[0].log_event_cmd" 2>/dev/null)
|
||||
main_node=$(config_n_get $id node)
|
||||
socks_port=$(config_n_get $id port 0)
|
||||
delay=$(config_n_get $id autoswitch_testing_time 30)
|
||||
|
||||
@@ -384,15 +384,25 @@ lua_api() {
|
||||
echo $(lua -e "local api = require 'luci.passwall.api' print(api.${func})")
|
||||
}
|
||||
|
||||
|
||||
del_cache_var() {
|
||||
local key="${1}"
|
||||
[ -n "${key}" ] && [ -f "${TMP_PATH}/var" ] && {
|
||||
sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
|
||||
}
|
||||
}
|
||||
|
||||
set_cache_var() {
|
||||
local key="${1}"
|
||||
shift 1
|
||||
local val="$@"
|
||||
[ -n "${key}" ] && [ -n "${val}" ] && {
|
||||
[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
|
||||
sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1
|
||||
echo "${key}=\"${val}\"" >> $TMP_PATH/var
|
||||
eval ${key}=\"${val}\"
|
||||
[ -n "${key}" ] && {
|
||||
del_cache_var ${key}
|
||||
local val="$@"
|
||||
[ -n "${val}" ] && {
|
||||
[ ! -d $TMP_PATH ] && mkdir -p $TMP_PATH
|
||||
echo "${key}=\"${val}\"" >> $TMP_PATH/var
|
||||
eval ${key}=\"${val}\"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -470,25 +480,9 @@ ln_run() {
|
||||
echolog " - 找不到 ${ln_name}，无法启动..."
|
||||
return 1
|
||||
}
|
||||
[ "${output}" != "/dev/null" ] && [ -n "$(echo "${output}" | grep -E "default|socks_")" ] && [ "${ln_name}" != "chinadns-ng" ] && {
|
||||
local persist_log_path=$(config_n_get @global[0] persist_log_path)
|
||||
local sys_log=$(config_n_get @global[0] sys_log "0")
|
||||
}
|
||||
if [ -z "$persist_log_path" ] && [ "$sys_log" != "1" ]; then
|
||||
${file_func:-echolog " - ${ln_name}"} "$@" >${output} 2>&1 &
|
||||
else
|
||||
if [ -n "${persist_log_path}" ]; then
|
||||
mkdir -p ${persist_log_path}
|
||||
local log_file=${persist_log_path}/passwall_global_${ln_name}_$(date '+%F').log
|
||||
echolog "记录到持久性日志文件：${log_file}"
|
||||
${file_func:-echolog " - ${ln_name}"} "$@" >> ${log_file} 2>&1 &
|
||||
sys_log=0
|
||||
fi
|
||||
if [ "${sys_log}" = "1" ]; then
|
||||
echolog "记录 ${ln_name}_global 到系统日志"
|
||||
${file_func:-echolog " - ${ln_name}"} "$@" 2>&1 | logger -t PASSWALL_global_${ln_name} &
|
||||
fi
|
||||
fi
|
||||
|
||||
${file_func:-echolog " - ${ln_name}"} "$@" >${output} 2>&1 &
|
||||
|
||||
[ "$NO_REC_PROCESS" = "1" ] && return
|
||||
process_count=$(ls $TMP_SCRIPT_FUNC_PATH | wc -l)
|
||||
process_count=$((process_count + 1))
|
||||
|
||||
Reference in new issue
Block a user