cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-11-05 01:44:16 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

🔥 Sync 2026-04-14 01:23:04

Browse Source
This commit is contained in:
github-actions[bot] committed 2026-04-14 01:23:04 +08:00
1 parent 010610b1e5
commit b9b070f39f
25 files changed
+261 -178
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-passwall/root/usr/share/passwall/app.sh
+10 -6
View File
@@ -751,12 +751,11 @@ run_redir() {
}
local protocol=$(config_n_get $node protocol)
local default_node=$(config_n_get $node default_node)
local v2ray_dns_mode=$(config_t_get global v2ray_dns_mode tcp)
[ "${DNS_MODE}" != "sing-box" ] && [ "${DNS_MODE}" != "udp" ] && [ "$protocol" = "_shunt" ] && [ "$default_node" = "_direct" ] && {
[ "${DNS_MODE}" != "sing-box" ] && [ "$protocol" = "_shunt" ] && {
DNS_MODE="sing-box"
v2ray_dns_mode="tcp"
echolog "* 当前TCP节点采用Sing-Box分流且默认节点为直连，远程DNS过滤模式将默认使用Sing-Box(TCP)，防止环回！"
echolog "* 当前 TCP 节点采用 Sing-Box 分流，远程 DNS 过滤模式将默认使用 Sing-Box(TCP)。！"
}
[ "$protocol" = "_shunt" ] && {
@@ -832,12 +831,11 @@ run_redir() {
}
local protocol=$(config_n_get $node protocol)
local default_node=$(config_n_get $node default_node)
local v2ray_dns_mode=$(config_t_get global v2ray_dns_mode tcp)
[ "${DNS_MODE}" != "xray" ] && [ "${DNS_MODE}" != "udp" ] && [ "$protocol" = "_shunt" ] && [ "$default_node" = "_direct" ] && {
[ "${DNS_MODE}" != "xray" ] && [ "$protocol" = "_shunt" ] && {
DNS_MODE="xray"
v2ray_dns_mode="tcp"
echolog "* 当前TCP节点采用Xray分流且默认节点为直连，远程DNS过滤模式将默认使用Xray(TCP)，防止环回！"
echolog "* 当前 TCP 节点采用 Xray 分流，远程 DNS 过滤模式将默认使用Xray(TCP)。"
}
[ "$protocol" = "_shunt" ] && {
@@ -1767,6 +1765,12 @@ acl_app() {
local type=$(echo $(config_n_get $tcp_node type) | tr 'A-Z' 'a-z')
if [ -n "${type}" ] && ([ "${type}" = "sing-box" ] || [ "${type}" = "xray" ]); then
local protocol=$(config_n_get $tcp_node protocol)
[ "$protocol" = "_shunt" ] && [ "${type}" != "${dns_mode}" ] && {
dns_mode=${type}
v2ray_dns_mode="tcp"
remote_dns="1.1.1.1"
}
config_file="acl/${tcp_node}_TCP_${redir_port}.json"
_extra_param="socks_address=127.0.0.1 socks_port=$socks_port"
if ([ "$dns_mode" = "sing-box" ] || [ "$dns_mode" = "xray" ]) && [ "${type}" = "${dns_mode}" ]; then
luci-app-passwall/root/usr/share/passwall/iptables.sh
+48 -48
View File
@@ -792,6 +792,38 @@ filter_direct_node_list() {
done
}
update_wan_sets() {
local log=$1
local WAN_IP=$(get_wan_ips ip4)
[ -n "$WAN_IP" ] && {
ipset -F "$IPSET_WAN"
for wan_ip in $WAN_IP; do
ipset -! add "$IPSET_WAN" "$wan_ip"
done
[ "$log" = "log" ] && {
local wan_ip
for wan_ip in $WAN_IP; do
echolog " - [$?]加入WAN IPv4到ipset[$IPSET_WAN]：${wan_ip}"
done
}
}
local WAN6_IP=$(get_wan_ips ip6)
[ -n "$WAN6_IP" ] && {
ipset -F "$IPSET_WAN6"
for wan6_ip in $WAN6_IP; do
ipset -! add "$IPSET_WAN6" "$wan6_ip"
done
[ "$log" = "log" ] && {
local wan6_ip
for wan6_ip in $WAN6_IP; do
echolog " - [$?]加入WAN IPv6到ipset[$IPSET_WAN6]：${wan6_ip}"
done
}
}
}
add_firewall_rule() {
echolog "开始加载 iptables 防火墙规则..."
ipset -! create $IPSET_LOCAL nethash maxelem 1048576
@@ -942,6 +974,8 @@ add_firewall_rule() {
EOF
}
update_wan_sets "log"
[ -n "$ISP_DNS" ] && {
#echolog "处理 ISP DNS 例外..."
for ispip in $ISP_DNS; do
@@ -975,13 +1009,8 @@ add_firewall_rule() {
$ipt_n -A PSW $(dst $IPSET_LAN) -j RETURN
$ipt_n -A PSW $(dst $IPSET_VPS) -j RETURN
WAN_IP=$(get_wan_ips ip4)
[ ! -z "${WAN_IP}" ] && {
for wan_ip in $WAN_IP; do
$ipt_n -A PSW $(comment "WAN_IP_RETURN") -d "${wan_ip}" -j RETURN
done
}
$ipt_n -A PSW $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
[ "$accept_icmp" = "1" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p icmp -j PSW"
[ -z "${is_tproxy}" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW"
@@ -1014,16 +1043,8 @@ add_firewall_rule() {
$ipt_m -A PSW $(dst $IPSET_LAN) -j RETURN
$ipt_m -A PSW $(dst $IPSET_VPS) -j RETURN
$ipt_m -A PSW -m conntrack --ctdir REPLY -j RETURN
[ ! -z "${WAN_IP}" ] && {
ipset -F $IPSET_WAN
for wan_ip in $WAN_IP; do
ipset -! add $IPSET_WAN ${wan_ip}
echolog " - [$?]加入WAN IPv4到ipset[$IPSET_WAN]：${wan_ip}"
done
$ipt_m -A PSW $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
}
unset WAN_IP wan_ip
$ipt_m -A PSW $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW"
# Only TCP, UDP Invalid.
@@ -1093,17 +1114,8 @@ add_firewall_rule() {
$ip6t_m -A PSW $(dst $IPSET_LAN6) -j RETURN
$ip6t_m -A PSW $(dst $IPSET_VPS6) -j RETURN
$ip6t_m -A PSW -m conntrack --ctdir REPLY -j RETURN
WAN6_IP=$(get_wan_ips ip6)
[ ! -z "${WAN6_IP}" ] && {
ipset -F $IPSET_WAN6
for wan6_ip in $WAN6_IP; do
ipset -! add $IPSET_WAN6 ${wan6_ip}
echolog " - [$?]加入WAN IPv6到ipset[$IPSET_WAN6]：${wan6_ip}"
done
$ip6t_m -A PSW $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN
}
unset WAN6_IP wan6_ip
$ip6t_m -A PSW $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN
insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW"
# Only TCP, UDP Invalid.
@@ -1119,7 +1131,7 @@ add_firewall_rule() {
ip -6 rule add fwmark ${FWMARK} table 999 priority 999
ip -6 route add local ::/0 dev lo table 999
[ "$TCP_UDP" = "1" ] && [ -z "$UDP_NODE" ] && UDP_NODE=$TCP_NODE
[ "$ENABLED_DEFAULT_ACL" == 1 ] && {
@@ -1412,7 +1424,9 @@ gen_include() {
local __ipt=""
[ -n "${ipt}" ] && {
__ipt=$(cat <<- EOF
. $UTILS_PATH
${MY_PATH} update_wan_sets
mangle_output_psw=\$(${ipt}-save -t mangle | grep "PSW" | grep "mangle\-OUTPUT\-PSW" | sed "s#-A OUTPUT ##g")
$ipt-save -c | grep -v "PSW" | $ipt-restore -c
$ipt-restore -n <<-EOT
@@ -1429,21 +1443,12 @@ gen_include() {
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "mwan3" "-j PSW")
\$(${MY_PATH} insert_rule_before "$ipt_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
WAN_IP=\$(get_wan_ips ip4)
[ ! -z "\${WAN_IP}" ] && {
ipset -F $IPSET_WAN
for wan_ip in \$WAN_IP; do
ipset -! add $IPSET_WAN \${wan_ip}
done
}
EOF
)
}
local __ip6t=""
[ -n "${ip6t}" ] && {
__ip6t=$(cat <<- EOF
. $UTILS_PATH
mangle_output_psw=\$(${ip6t}-save -t mangle | grep "PSW" | grep "mangle\-OUTPUT\-PSW" | sed "s#-A OUTPUT ##g")
$ip6t-save -c | grep -v "PSW" | $ip6t-restore -c
$ip6t-restore -n <<-EOT
@@ -1459,20 +1464,12 @@ gen_include() {
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "mwan3" "-j PSW")
\$(${MY_PATH} insert_rule_before "$ip6t_m" "PREROUTING" "PSW" "-p tcp -m socket -j PSW_DIVERT")
WAN6_IP=\$(get_wan_ips ip6)
[ ! -z "\${WAN6_IP}" ] && {
ipset -F $IPSET_WAN6
for wan6_ip in \$WAN6_IP; do
ipset -! add $IPSET_WAN6 \${wan6_ip}
done
}
EOF
)
}
cat <<-EOF >> $FWI
${__ipt}
${__ip6t}
return 0
@@ -1529,6 +1526,9 @@ get_ip6t_bin)
filter_direct_node_list)
filter_direct_node_list
;;
update_wan_sets)
update_wan_sets "$@"
;;
stop)
stop
;;
luci-app-passwall/root/usr/share/passwall/nftables.sh
+41 -35
View File
@@ -858,6 +858,34 @@ mwan3_start() {
nft list chain ip mangle mwan3_hook >/dev/null 2>&1 && nft insert rule ip mangle mwan3_hook ct mark ${FWMARK} counter return >/dev/null 2>&1
}
update_wan_sets() {
local log=$1
local WAN_IP=$(get_wan_ips ip4)
[ -n "$WAN_IP" ] && {
nft flush set $NFTABLE_NAME $NFTSET_WAN
echo "$WAN_IP" | insert_nftset $NFTSET_WAN "-1"
[ "$log" = "log" ] && {
local wan_ip
for wan_ip in $WAN_IP; do
echolog " - [$?]加入WAN IPv4到nftset[$NFTSET_WAN]：${wan_ip}"
done
}
}
local WAN6_IP=$(get_wan_ips ip6)
[ -n "${WAN6_IP}" ] && {
nft flush set $NFTABLE_NAME $NFTSET_WAN6
echo "$WAN6_IP" | insert_nftset $NFTSET_WAN6 "-1"
[ "$log" = "log" ] && {
local wan6_ip
for wan6_ip in $WAN6_IP; do
echolog " - [$?]加入WAN IPv6到nftset[$NFTSET_WAN6]：${wan6_ip}"
done
}
}
}
add_firewall_rule() {
echolog "开始加载 nftables 防火墙规则..."
gen_nft_tables
@@ -999,6 +1027,8 @@ add_firewall_rule() {
[ -n "$lan_ip6" ] && echo $lan_ip6 | insert_nftset $NFTSET_LAN6 "-1"
}
update_wan_sets "log"
[ -n "$ISP_DNS" ] && {
#echolog "处理 ISP DNS 例外..."
echo "$ISP_DNS" | insert_nftset $NFTSET_WHITE 0
@@ -1113,17 +1143,9 @@ add_firewall_rule() {
nft "add rule $NFTABLE_NAME nat_output meta l4proto {icmp,icmpv6} counter jump PSW_ICMP_REDIRECT"
fi
WAN_IP=$(get_wan_ips ip4)
if [ -n "${WAN_IP}" ]; then
nft flush set $NFTABLE_NAME $NFTSET_WAN
echo $WAN_IP | insert_nftset $NFTSET_WAN "-1"
[ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW_NAT ip daddr @$NFTSET_WAN counter return comment \"WAN_IP_RETURN\""
nft "add rule $NFTABLE_NAME PSW_MANGLE ip daddr @$NFTSET_WAN counter return comment \"WAN_IP_RETURN\""
for wan_ip in $WAN_IP; do
echolog " - [$?]加入WAN IPv4到nftset[$NFTSET_WAN]：${wan_ip}"
done
fi
unset WAN_IP wan_ip
#ipv4 wan_ip
[ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW_NAT ip daddr @$NFTSET_WAN counter return comment \"WAN_IP_RETURN\""
nft "add rule $NFTABLE_NAME PSW_MANGLE ip daddr @$NFTSET_WAN counter return comment \"WAN_IP_RETURN\""
ip rule add fwmark ${FWMARK} table 999 priority 999
ip route add local 0.0.0.0/0 dev lo table 999
@@ -1166,21 +1188,12 @@ add_firewall_rule() {
nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto {ipv6} counter jump PSW_MANGLE_V6"
nft "add rule $NFTABLE_NAME mangle_output meta nfproto {ipv6} counter jump PSW_OUTPUT_MANGLE_V6 comment \"PSW_OUTPUT_MANGLE\""
WAN6_IP=$(get_wan_ips ip6)
[ -n "${WAN6_IP}" ] && {
nft flush set $NFTABLE_NAME $NFTSET_WAN6
echo $WAN6_IP | insert_nftset $NFTSET_WAN6 "-1"
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 ip6 daddr @$NFTSET_WAN6 counter return comment \"WAN6_IP_RETURN\""
for wan6_ip in $WAN6_IP; do
echolog " - [$?]加入WAN IPv6到nftset[$NFTSET_WAN6]：${wan6_ip}"
done
}
unset WAN6_IP wan6_ip
nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 ip6 daddr @$NFTSET_WAN6 counter return comment \"WAN6_IP_RETURN\""
ip -6 rule add fwmark ${FWMARK} table 999 priority 999
ip -6 route add local ::/0 dev lo table 999
}
[ "$TCP_UDP" = "1" ] && [ -z "$UDP_NODE" ] && UDP_NODE=$TCP_NODE
[ "$ENABLED_DEFAULT_ACL" == 1 ] && {
@@ -1466,20 +1479,10 @@ gen_include() {
local __nft=" "
__nft=$(cat <<- EOF
. $UTILS_PATH
[ -z "\$(nft list chain $NFTABLE_NAME mangle_prerouting | grep PSW_DIVERT)" ] && nft -f ${nft_chain_file}
WAN_IP=\$(get_wan_ips ip4)
[ ! -z "\${WAN_IP}" ] && {
nft flush set $NFTABLE_NAME $NFTSET_WAN
echo "\${WAN_IP}" | sh ${MY_PATH} insert_nftset $NFTSET_WAN "-1"
}
[ "$PROXY_IPV6" == "1" ] && {
WAN6_IP=\$(get_wan_ips ip6)
[ ! -z "\${WAN6_IP}" ] && {
nft flush set $NFTABLE_NAME $NFTSET_WAN6
echo "\${WAN6_IP}" | sh ${MY_PATH} insert_nftset $NFTSET_WAN6 "-1"
}
}
${MY_PATH} update_wan_sets
EOF
)
@@ -1527,6 +1530,9 @@ mwan3_start)
mwan3_stop)
mwan3_stop
;;
update_wan_sets)
update_wan_sets "$@"
;;
stop)
stop
;;
luci-app-passwall/root/usr/share/passwall/subscribe.lua
+8
View File
@@ -254,12 +254,20 @@ do
uci:foreach(appname, "shunt_rules", function(e)
if e[".name"] and e.remarks then
table.insert(rules, e)
table.insert(rules, {
[".name"] = e[".name"] .. "_proxy_tag",
remarks = e.remarks .. " 前置代理"
})
end
end)
table.insert(rules, {
[".name"] = "default_node",
remarks = "默认"
})
table.insert(rules, {
[".name"] = "default_proxy_tag",
remarks = "默认 前置代理"
})
for k, e in pairs(rules) do
local _node_id = node[e[".name"]] or nil