From 9a5495b4cefaab99507dd02ff9cb2fca6de18671 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sun, 5 Apr 2026 20:21:37 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=92=8B=20Sync=202026-04-05=2020:21:37?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../root/usr/share/passwall/app.sh | 5 ++ .../root/usr/share/passwall/iptables.sh | 63 ++++++++++--------- .../root/usr/share/passwall/nftables.sh | 53 ++++++++-------- 3 files changed, 66 insertions(+), 55 deletions(-) diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh index 4acc19cf..fc427ad2 100755 --- a/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/luci-app-passwall/root/usr/share/passwall/app.sh @@ -1101,6 +1101,9 @@ socks_node_switch() { LOG_FILE="/dev/null" run_socks flag=$flag node=$new_node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file set_cache_var "socks_${flag}" "$new_node" + local ENABLED_DEFAULT_ACL=$(get_cache_var "ENABLED_DEFAULT_ACL") + local ENABLED_ACLS=$(get_cache_var "ENABLED_ACLS") + [ "$ENABLED_DEFAULT_ACL" != "1" -a "$ENABLED_ACLS" != "1" ] && return local USE_TABLES=$(get_cache_var "USE_TABLES") [ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh filter_direct_node_list } @@ -1979,6 +1982,8 @@ get_config() { [ "$ENABLED_ACLS" = 1 ] && { [ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" == 0 ] && ENABLED_ACLS=0 } + set_cache_var ENABLED_DEFAULT_ACL $ENABLED_DEFAULT_ACL + set_cache_var ENABLED_ACLS $ENABLED_ACLS TCP_PROXY_WAY=$(config_t_get global_forwarding tcp_proxy_way redirect) PROXY_IPV6=$(config_t_get global_forwarding ipv6_tproxy 0) diff --git a/luci-app-passwall/root/usr/share/passwall/iptables.sh b/luci-app-passwall/root/usr/share/passwall/iptables.sh index 391ad56b..93b73dd6 100755 --- a/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -742,43 +742,50 @@ filter_vpsip() { } filter_server_port() { - local address=${1} - local port=${2} - local stream=${3} - stream=$(echo ${3} | tr 'A-Z' 'a-z') - local _is_tproxy ipt_tmp - ipt_tmp=$ipt_n - _is_tproxy=${is_tproxy} - [ "$stream" == "udp" ] && _is_tproxy="TPROXY" - [ -n "${_is_tproxy}" ] && ipt_tmp=$ipt_m - - for _ipt in 4 6; do - [ "$_ipt" == "4" ] && _ipt=$ipt_tmp - [ "$_ipt" == "6" ] && _ipt=$ip6t_m - $_ipt -n -L PSW_OUTPUT | grep -q "${address}:${port}" - if [ $? -ne 0 ]; then - $_ipt -I PSW_OUTPUT $(comment "${address}:${port}") -p $stream -d $address --dport $port -j RETURN 2>/dev/null + local address="$1" + local port=$(echo "$2" | tr '-' ':' | tr -d ' ') + local stream=$(echo "$3" | tr 'A-Z' 'a-z') + local ipt_tmp="$ipt_n" _is_tproxy _ipt_cmd _ver multi_ports p ports + [ "$(config_t_get global_forwarding tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY" + [ "$stream" = "udp" ] && _is_tproxy="TPROXY" + [ -n "$_is_tproxy" ] && ipt_tmp="$ipt_m" + for _ver in 4 6; do + [ "$_ver" = "4" ] && _ipt_cmd="$ipt_tmp" + [ "$_ver" = "6" ] && _ipt_cmd="$ip6t_m" + multi_ports="" + for p in $(echo "$port" | tr ',' ' '); do + case "$p" in + *:* ) + $_ipt_cmd -n -L PSW_OUTPUT 2>/dev/null | grep -q "${address}:${p}:${stream}" || \ + $_ipt_cmd -I PSW_OUTPUT $(comment "${address}:${p}:${stream}") -p "$stream" -d "$address" --dport "$p" -j RETURN 2>/dev/null + ;; + * ) + multi_ports="${multi_ports},$p" + ;; + esac + done + if [ -n "$multi_ports" ]; then + ports=$(printf "%s\n" "${multi_ports#,}" | tr ',' '\n' | sort -n | tr '\n' ',' | sed 's/,$//') + $_ipt_cmd -n -L PSW_OUTPUT 2>/dev/null | grep -q "${address}:${ports}:${stream}" || \ + $_ipt_cmd -I PSW_OUTPUT $(comment "${address}:${ports}:${stream}") -p "$stream" -d "$address" -m multiport --dports "$ports" -j RETURN 2>/dev/null fi done } filter_node() { - local node=${1} - local stream=${2} - if [ -n "$node" ]; then - local address=$(config_n_get $node address) - local port=$(config_n_get $node port) - [ -z "$address" ] && [ -z "$port" ] && { - return 1 - } - filter_server_port $address $port $stream - filter_server_port $address $port $stream - fi + local node="$1" stream="$2" + [ -z "$node" ] && return 1 + local address=$(config_n_get "$node" address) + local port=$(config_n_get "$node" port) + local hop=$(config_n_get "$node" hysteria2_hop) + [ -n "$hop" ] && port="${port:+$port,}$hop" + [ -z "$address" -o -z "$port" ] && return 1 + filter_server_port "$address" "$port" "$stream" } filter_direct_node_list() { [ ! -s "$TMP_PATH/direct_node_list" ] && return - for _node_id in $(cat $TMP_PATH/direct_node_list | awk '!seen[$0]++'); do + awk '!seen[$0]++' "$TMP_PATH/direct_node_list" | while read -r _node_id; do filter_node "$_node_id" TCP filter_node "$_node_id" UDP unset _node_id diff --git a/luci-app-passwall/root/usr/share/passwall/nftables.sh b/luci-app-passwall/root/usr/share/passwall/nftables.sh index 3c6bcc91..1717a76f 100755 --- a/luci-app-passwall/root/usr/share/passwall/nftables.sh +++ b/luci-app-passwall/root/usr/share/passwall/nftables.sh @@ -793,41 +793,40 @@ filter_vpsip() { } filter_server_port() { - local address=${1} - local port=${2} - local stream=${3} - stream=$(echo ${3} | tr 'A-Z' 'a-z') - local _is_tproxy - _is_tproxy=${is_tproxy} - [ "$stream" == "udp" ] && _is_tproxy="TPROXY" - - for _ipt in 4 6; do - [ "$_ipt" == "4" ] && _ip_type=ip - [ "$_ipt" == "6" ] && _ip_type=ip6 - nft "list chain $NFTABLE_NAME $nft_output_chain" 2>/dev/null | grep -q "${address}:${port}" - if [ $? -ne 0 ]; then - nft "insert rule $NFTABLE_NAME $nft_output_chain meta l4proto $stream $_ip_type daddr $address $stream dport $port return comment \"${address}:${port}\"" 2>/dev/null - fi + local address="$1" + local port=$(echo "$2" | tr ':' '-' | tr -d ' ') + local stream=$(echo "$3" | tr 'A-Z' 'a-z') + local _ip_type _port_expr _ver _is_tproxy + local _nft_output_chain="PSW_OUTPUT_NAT" + [ "$(config_t_get global_forwarding tcp_proxy_way redirect)" = "tproxy" ] && _is_tproxy="TPROXY" + [ "$stream" = "udp" ] && _is_tproxy="TPROXY" + [ -n "$_is_tproxy" ] && _nft_output_chain="PSW_OUTPUT_MANGLE" + case "$port" in + *,*) _port_expr="{ $port }" ;; + *) _port_expr="$port" ;; + esac + for _ver in 4 6; do + [ "$_ver" = "4" ] && _ip_type="ip" + [ "$_ver" = "6" ] && _ip_type="ip6" && _nft_output_chain="PSW_OUTPUT_MANGLE_V6" + nft list chain "$NFTABLE_NAME" "$_nft_output_chain" 2>/dev/null | grep -q "comment \"${address}:${port}:${stream}\"" || \ + nft insert rule "$NFTABLE_NAME" "$_nft_output_chain" meta l4proto "$stream" $_ip_type daddr "$address" "$stream" dport $_port_expr return comment "\"${address}:${port}:${stream}\"" 2>/dev/null done } filter_node() { - local node=${1} - local stream=${2} - if [ -n "$node" ]; then - local address=$(config_n_get $node address) - local port=$(config_n_get $node port) - [ -z "$address" ] && [ -z "$port" ] && { - return 1 - } - filter_server_port $address $port $stream - filter_server_port $address $port $stream - fi + local node="$1" stream="$2" + [ -z "$node" ] && return 1 + local address=$(config_n_get "$node" address) + local port=$(config_n_get "$node" port) + local hop=$(config_n_get "$node" hysteria2_hop) + [ -n "$hop" ] && port="${port:+$port,}$hop" + [ -z "$address" -o -z "$port" ] && return 1 + filter_server_port "$address" "$port" "$stream" } filter_direct_node_list() { [ ! -s "$TMP_PATH/direct_node_list" ] && return - for _node_id in $(cat $TMP_PATH/direct_node_list | awk '!seen[$0]++'); do + awk '!seen[$0]++' "$TMP_PATH/direct_node_list" | while read -r _node_id; do filter_node "$_node_id" TCP filter_node "$_node_id" UDP unset _node_id