mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-15 04:53:00 +08:00
868 lines
33 KiB
Lua
868 lines
33 KiB
Lua
module("luci.controller.minigate", package.seeall)
|
||
|
||
local RUN_DIR = "/var/run/minigate"
|
||
local JOB_DIR = RUN_DIR .. "/jobs"
|
||
local DDNS_STATE_DIR = RUN_DIR .. "/ddns"
|
||
local ACME_STATE_FILE = RUN_DIR .. "/acme.state"
|
||
local PROXY_STATUS_FILE = RUN_DIR .. "/proxy.status"
|
||
local CERT_DIR = "/etc/minigate/certs"
|
||
|
||
local function shellquote(value)
|
||
value = tostring(value or "")
|
||
return "'" .. value:gsub("'", "'\"'\"'") .. "'"
|
||
end
|
||
|
||
local function write_json(data)
|
||
luci.http.prepare_content("application/json")
|
||
luci.http.write_json(data)
|
||
end
|
||
|
||
local function bad_request(message, extra)
|
||
luci.http.status(400, "Bad Request")
|
||
local data = extra or {}
|
||
data.success = false
|
||
data.message = message
|
||
write_json(data)
|
||
end
|
||
|
||
-- 读取 key=value 状态文件；warning 等可重复的键收集为数组
|
||
function read_state(path)
|
||
local data = {}
|
||
local file = io.open(path, "r")
|
||
if not file then return nil end
|
||
for line in file:lines() do
|
||
local key, value = line:match("^([%w_]+)=(.*)$")
|
||
if key == "warning" then
|
||
data.warnings = data.warnings or {}
|
||
data.warnings[#data.warnings + 1] = value
|
||
elseif key then
|
||
data[key] = value
|
||
end
|
||
end
|
||
file:close()
|
||
return data
|
||
end
|
||
|
||
-- 与 ddns.sh 的 state_key 和 IP 历史文件使用相同的域名清洗规则
|
||
function state_key(domain)
|
||
return (tostring(domain or ""):gsub("[^%w_%-]", "_"))
|
||
end
|
||
|
||
function ddns_state(domain)
|
||
if not domain or domain == "" then return {} end
|
||
return read_state(DDNS_STATE_DIR .. "/" .. state_key(domain) .. ".state") or {}
|
||
end
|
||
|
||
local MONTHS = {Jan=1, Feb=2, Mar=3, Apr=4, May=5, Jun=6, Jul=7, Aug=8, Sep=9, Oct=10, Nov=11, Dec=12}
|
||
|
||
-- 公历日期转 UTC 秒数，不依赖路由器时区
|
||
local function utc_epoch(y, m, d, hh, mm, ss)
|
||
y = (m <= 2) and (y - 1) or y
|
||
local era = math.floor(y / 400)
|
||
local yoe = y - era * 400
|
||
local mp = (m + 9) % 12
|
||
local doy = math.floor((153 * mp + 2) / 5) + d - 1
|
||
local doe = yoe * 365 + math.floor(yoe / 4) - math.floor(yoe / 100) + doy
|
||
local days = era * 146097 + doe - 719468
|
||
return days * 86400 + hh * 3600 + mm * 60 + ss
|
||
end
|
||
|
||
-- openssl 的 notAfter 形如 "Dec 16 12:00:00 2026 GMT"
|
||
function parse_cert_time(value)
|
||
local mon, d, hh, mm, ss, y = tostring(value or ""):match("^(%a+)%s+(%d+)%s+(%d+):(%d+):(%d+)%s+(%d+)")
|
||
if not mon or not MONTHS[mon] then return nil end
|
||
return utc_epoch(tonumber(y), MONTHS[mon], tonumber(d), tonumber(hh), tonumber(mm), tonumber(ss))
|
||
end
|
||
|
||
-- 读取已签发证书：域名、到期日期、剩余天数、是否为测试证书
|
||
function cert_list()
|
||
local fs = require "nixio.fs"
|
||
local certs = {}
|
||
if not fs.dir(CERT_DIR) then return certs end
|
||
local now = os.time()
|
||
for entry in fs.dir(CERT_DIR) do
|
||
local path = CERT_DIR .. "/" .. entry
|
||
local st = fs.lstat(path)
|
||
if entry ~= "_default" and st and st.type == "dir" and fs.access(path .. "/fullchain.pem") then
|
||
local handle = io.popen("openssl x509 -in " .. shellquote(path .. "/fullchain.pem") .. " -noout -enddate -issuer 2>/dev/null")
|
||
local output = handle and handle:read("*a") or ""
|
||
if handle then handle:close() end
|
||
local not_after = output:match("notAfter=([^\n]+)")
|
||
local issuer = output:match("issuer=([^\n]+)") or ""
|
||
local expires = parse_cert_time(not_after)
|
||
local item = {
|
||
domain = entry:gsub("^_wildcard_%.", "*."),
|
||
path = path,
|
||
staging = (issuer:lower():find("staging", 1, true) or issuer:lower():find("fake", 1, true)) and true or false
|
||
}
|
||
if expires then
|
||
item.expires = expires
|
||
item.expires_date = os.date("%Y-%m-%d", expires)
|
||
item.days_left = math.floor((expires - now) / 86400)
|
||
end
|
||
certs[#certs + 1] = item
|
||
end
|
||
end
|
||
table.sort(certs, function(a, b) return (a.expires or 0) < (b.expires or 0) end)
|
||
return certs
|
||
end
|
||
|
||
function index()
|
||
entry({"admin","services","minigate"}, alias("admin","services","minigate","general"), "MiniGate", 60).dependent=false
|
||
entry({"admin","services","minigate","general"}, cbi("minigate/general"), "总览", 10)
|
||
entry({"admin","services","minigate","ddns"}, cbi("minigate/ddns"), "动态DNS", 20)
|
||
entry({"admin","services","minigate","acme"}, cbi("minigate/acme"), "SSL 证书", 30)
|
||
entry({"admin","services","minigate","proxy"}, cbi("minigate/proxy"), "反向代理", 40)
|
||
entry({"admin","services","minigate","login_guard"}, cbi("minigate/login_guard"), "登录防护", 45)
|
||
entry({"admin","services","minigate","log"}, template("minigate/log"), "日志", 50)
|
||
entry({"admin","services","minigate","status"}, call("action_status")).leaf=true
|
||
entry({"admin","services","minigate","get_log"}, call("action_get_log")).leaf=true
|
||
entry({"admin","services","minigate","acme_install"}, post("action_acme_install")).leaf=true
|
||
entry({"admin","services","minigate","acme_issue"}, post("action_acme_issue")).leaf=true
|
||
entry({"admin","services","minigate","acme_job"}, call("action_acme_job")).leaf=true
|
||
entry({"admin","services","minigate","ddns_sync"}, post("action_ddns_sync")).leaf=true
|
||
entry({"admin","services","minigate","ddns_job"}, call("action_ddns_job")).leaf=true
|
||
entry({"admin","services","minigate","ddns_history"}, call("action_ddns_history")).leaf=true
|
||
entry({"admin","services","minigate","proxy_access"}, call("action_proxy_access")).leaf=true
|
||
entry({"admin","services","minigate","geo_lookup"}, call("action_geo_lookup")).leaf=true
|
||
entry({"admin","services","minigate","lg_status"}, call("action_lg_status")).leaf=true
|
||
entry({"admin","services","minigate","lg_ban"}, post("action_lg_ban")).leaf=true
|
||
entry({"admin","services","minigate","lg_unban"}, post("action_lg_unban")).leaf=true
|
||
entry({"admin","services","minigate","lg_flush"}, post("action_lg_flush")).leaf=true
|
||
entry({"admin","services","minigate","update_status"}, call("action_update_status")).leaf=true
|
||
entry({"admin","services","minigate","update_auto"}, call("action_update_auto")).leaf=true
|
||
entry({"admin","services","minigate","update_check"}, call("action_update_check")).leaf=true
|
||
entry({"admin","services","minigate","update_apply"}, post("action_update_apply")).leaf=true
|
||
entry({"admin","services","minigate","uninstall"}, post("action_uninstall")).leaf=true
|
||
end
|
||
|
||
-- ============== 后台任务 ==============
|
||
|
||
local function job_state(name)
|
||
return read_state(JOB_DIR .. "/" .. name .. ".state") or {}
|
||
end
|
||
|
||
-- 同名任务正在运行时不重复启动；超过 15 分钟仍为 running 视为异常退出
|
||
local function job_running(name)
|
||
local state = job_state(name)
|
||
local started = tonumber(state.started or "")
|
||
return state.status == "running" and started ~= nil and os.time() - started < 900
|
||
end
|
||
|
||
local function start_job(name, command)
|
||
local sys = require "luci.sys"
|
||
if job_running(name) then return true end
|
||
return sys.call("( /bin/sh /usr/lib/minigate/job.sh " .. name .. " " .. command ..
|
||
" ) </dev/null >/dev/null 2>&1 &") == 0
|
||
end
|
||
|
||
local function job_response(name)
|
||
local state = job_state(name)
|
||
return {
|
||
running = job_running(name),
|
||
done = state.status == "done",
|
||
code = tonumber(state.code or ""),
|
||
finished = tonumber(state.finished or "")
|
||
}
|
||
end
|
||
|
||
-- ============== 软件更新与卸载 ==============
|
||
|
||
local function update_response(command)
|
||
local sys = require "luci.sys"
|
||
local jsonc = require "luci.jsonc"
|
||
local fs = require "nixio.fs"
|
||
local raw = sys.exec("/bin/sh /usr/lib/minigate/update.sh " .. command .. " 2>/dev/null") or ""
|
||
local ok, data = pcall(jsonc.parse, raw)
|
||
if not ok or type(data) ~= "table" then
|
||
data = {
|
||
status = "error",
|
||
progress = 0,
|
||
current = "",
|
||
latest = "",
|
||
available = false,
|
||
running = false,
|
||
success = false,
|
||
message = "更新服务返回了无效结果"
|
||
}
|
||
end
|
||
|
||
local release_raw = fs.readfile("/tmp/minigate-update-release.json")
|
||
if release_raw and data.latest and data.latest ~= "" then
|
||
local release_ok, release = pcall(jsonc.parse, release_raw)
|
||
if release_ok and type(release) == "table" then
|
||
local tag = tostring(release.tag_name or ""):gsub("^v", "")
|
||
if tag == tostring(data.latest) then
|
||
local title = type(release.name) == "string" and release.name or ("MiniGate v" .. tag)
|
||
local notes = type(release.body) == "string" and release.body or ""
|
||
data.release_title = title
|
||
data.release_notes = notes
|
||
end
|
||
end
|
||
end
|
||
write_json(data)
|
||
end
|
||
|
||
function action_update_status()
|
||
update_response("status")
|
||
end
|
||
|
||
function action_update_auto()
|
||
update_response("auto")
|
||
end
|
||
|
||
function action_update_check()
|
||
update_response("check")
|
||
end
|
||
|
||
function action_update_apply()
|
||
local sys = require "luci.sys"
|
||
local fs = require "nixio.fs"
|
||
local version = luci.http.formvalue("version")
|
||
local ok = false
|
||
|
||
if type(version) ~= "string" or #version > 32 or not (
|
||
version:match("^%d+%.%d+%.%d+$") or version:match("^%d+%.%d+%.%d+%-%d+$")) then
|
||
bad_request("请先查看更新内容并确认版本")
|
||
return
|
||
end
|
||
|
||
if fs.access("/usr/lib/minigate/update.sh") then
|
||
ok = sys.call("runner=$(mktemp /tmp/minigate-update-run.XXXXXX)" ..
|
||
" && cp /usr/lib/minigate/update.sh \"$runner\" && chmod 700 \"$runner\"" ..
|
||
" && ( ( /bin/sh \"$runner\" apply " .. shellquote(version) ..
|
||
"; rm -f \"$runner\" ) >/dev/null 2>&1 & )") == 0
|
||
end
|
||
|
||
write_json({
|
||
success = ok,
|
||
message = ok and "更新任务已启动" or "无法启动更新任务"
|
||
})
|
||
end
|
||
|
||
function action_uninstall()
|
||
local sys = require "luci.sys"
|
||
local fs = require "nixio.fs"
|
||
local confirm = luci.http.formvalue("confirm")
|
||
local purge = luci.http.formvalue("purge")
|
||
local ok = false
|
||
|
||
if confirm ~= "uninstall-minigate" or (purge ~= "0" and purge ~= "1") then
|
||
bad_request("卸载确认无效，请重新操作")
|
||
return
|
||
end
|
||
|
||
if fs.access("/usr/lib/minigate/uninstall.sh") then
|
||
ok = sys.call("runner=$(mktemp /tmp/minigate-uninstall.XXXXXX)" ..
|
||
" && cp /usr/lib/minigate/uninstall.sh \"$runner\" && chmod 700 \"$runner\"" ..
|
||
" && ( ( sleep 1; /bin/sh \"$runner\" " .. shellquote(purge) ..
|
||
"; rm -f \"$runner\" ) >/dev/null 2>&1 & )") == 0
|
||
end
|
||
|
||
write_json({
|
||
success = ok,
|
||
message = ok and "卸载任务已启动" or "无法启动卸载任务"
|
||
})
|
||
end
|
||
|
||
-- ============== 总览状态 ==============
|
||
|
||
local STATUS_RANK = {error=4, partial=3, unknown=2, stopped=1, ok=0}
|
||
|
||
function action_status()
|
||
local uci = require "luci.model.uci".cursor()
|
||
local pr = false
|
||
local f = io.open("/var/run/minigate-nginx.pid", "r")
|
||
if f then
|
||
local p = f:read("*l"); f:close()
|
||
if p and tonumber(p) then pr = (os.execute("kill -0 " .. p .. " 2>/dev/null") == 0) end
|
||
end
|
||
local enabled = uci:get("minigate", "global", "enabled") or "0"
|
||
|
||
-- DDNS：列出所有记录，并给出最差状态用于卡片颜色
|
||
local dl = {}
|
||
local worst = nil
|
||
uci:foreach("minigate", "ddns", function(s)
|
||
local st = ddns_state(s.domain)
|
||
local status = st.status or "unknown"
|
||
local on = s.enabled == "1"
|
||
if not on then status = "disabled" end
|
||
dl[#dl + 1] = {
|
||
name = s[".name"],
|
||
enabled = on and "1" or "0",
|
||
domain = s.domain or "",
|
||
ip_version = s.ip_version or "ipv4",
|
||
status = status,
|
||
status_msg = st.message or "",
|
||
last_ip = st.ip or "",
|
||
last_ip6 = st.ip6 or "",
|
||
last_update = st.updated or "",
|
||
next_sync = st.next or ""
|
||
}
|
||
if on and (worst == nil or (STATUS_RANK[status] or 2) > (STATUS_RANK[worst] or 2)) then worst = status end
|
||
end)
|
||
|
||
local ipv6_listen = uci:get("minigate", "global", "ipv6_listen") or "0"
|
||
|
||
-- 反代规则：与 proxy.sh 一致，主域名未启用的子域名不显示
|
||
local proxy_rules = {}
|
||
local wc_ports = {}
|
||
uci:foreach("minigate", "proxy_wildcard", function(s)
|
||
if s.enabled == "1" and s.domain then
|
||
local base = (s.domain or ""):gsub("^%*%.", "")
|
||
wc_ports[base] = {port = s.listen_port or "443", ssl = tostring(s.ssl or "0")}
|
||
end
|
||
end)
|
||
uci:foreach("minigate", "subproxy", function(s)
|
||
local parent = s.parent_domain or ""
|
||
local prefix = s.prefix or ""
|
||
local wc = wc_ports[parent]
|
||
if prefix ~= "" and wc and (s.enabled or "1") == "1" then
|
||
proxy_rules[#proxy_rules + 1] = {
|
||
domain = prefix .. "." .. parent,
|
||
target = (s.target_addr or "") .. ":" .. (s.target_port or "80"),
|
||
listen_port = wc.port,
|
||
scheme = wc.ssl == "1" and "https" or "http",
|
||
ipv6_listen = ipv6_listen
|
||
}
|
||
end
|
||
end)
|
||
uci:foreach("minigate", "proxy", function(s)
|
||
if s.enabled == "1" and s.domain and s.target_addr then
|
||
proxy_rules[#proxy_rules + 1] = {
|
||
domain = s.domain,
|
||
target = (s.target_addr or "") .. ":" .. (s.target_port or "80"),
|
||
listen_port = s.listen_port or "443",
|
||
scheme = tostring(s.ssl or "1") == "1" and "https" or "http",
|
||
ipv6_listen = ipv6_listen
|
||
}
|
||
end
|
||
end)
|
||
|
||
local proxy_state = read_state(PROXY_STATUS_FILE) or {}
|
||
local acme_state = read_state(ACME_STATE_FILE) or {}
|
||
|
||
write_json({
|
||
enabled = enabled,
|
||
ipv6_listen = ipv6_listen,
|
||
proxy_running = pr,
|
||
proxy_check = proxy_state.result or "",
|
||
proxy_message = proxy_state.message or "",
|
||
proxy_time = proxy_state.time or "",
|
||
proxy_warnings = proxy_state.warnings or {},
|
||
ddns_status = worst or "",
|
||
ddns_list = dl,
|
||
proxy_rules = proxy_rules,
|
||
certs = cert_list(),
|
||
acme = {
|
||
enabled = uci:get("minigate", "acme", "enabled") or "0",
|
||
staging = uci:get("minigate", "acme", "staging") or "0",
|
||
result = acme_state.result or "",
|
||
domain = acme_state.domain or "",
|
||
message = acme_state.message or "",
|
||
time = acme_state.time or ""
|
||
}
|
||
})
|
||
end
|
||
|
||
-- ============== 日志 ==============
|
||
|
||
local LOG_SOURCES = {
|
||
ddns = {{"DDNS", "/var/log/minigate-ddns.log"}},
|
||
acme = {{"证书", "/var/log/minigate-acme.log"}},
|
||
proxy = {{"反代", "/var/log/minigate-proxy.log"}, {"Nginx", "/var/log/minigate-nginx-error.log"}},
|
||
login_guard = {{"登录防护", "/var/log/minigate-login-guard.log"}},
|
||
update = {{"更新", "/var/log/minigate-update.log"}}
|
||
}
|
||
local LOG_ORDER = {"ddns", "acme", "proxy", "login_guard", "update"}
|
||
|
||
local function tail_lines(path, count)
|
||
local lines = {}
|
||
local file = io.open(path, "r")
|
||
if not file then return lines end
|
||
for line in file:lines() do
|
||
lines[#lines + 1] = line
|
||
if #lines > count then table.remove(lines, 1) end
|
||
end
|
||
file:close()
|
||
return lines
|
||
end
|
||
|
||
-- 统一时间戳便于合并：nginx 用 2026/10/28，其余脚本用 2026-10-28
|
||
local function line_time(line)
|
||
local stamp = line:match("^(%d%d%d%d[-/]%d%d[-/]%d%d %d%d:%d%d:%d%d)")
|
||
return stamp and stamp:gsub("/", "-") or nil
|
||
end
|
||
|
||
-- 「全部」按时间合并各来源，每行标出来源；没有时间戳的行（如 curl 输出）跟随上一行
|
||
function merge_logs(sources, limit)
|
||
local rows = {}
|
||
for source_index, source in ipairs(sources) do
|
||
local last = ""
|
||
for line_index, line in ipairs(tail_lines(source[2], limit)) do
|
||
last = line_time(line) or last
|
||
rows[#rows + 1] = {time = last, source = source_index, index = line_index, text = "[" .. source[1] .. "] " .. line}
|
||
end
|
||
end
|
||
table.sort(rows, function(a, b)
|
||
if a.time ~= b.time then return a.time < b.time end
|
||
if a.source ~= b.source then return a.source < b.source end
|
||
return a.index < b.index
|
||
end)
|
||
local out = {}
|
||
for i = math.max(1, #rows - limit + 1), #rows do out[#out + 1] = rows[i].text end
|
||
return table.concat(out, "\n")
|
||
end
|
||
|
||
function action_get_log()
|
||
local source = luci.http.formvalue("source") or "all"
|
||
local sources = {}
|
||
if LOG_SOURCES[source] then
|
||
sources = LOG_SOURCES[source]
|
||
else
|
||
for _, name in ipairs(LOG_ORDER) do
|
||
for _, item in ipairs(LOG_SOURCES[name]) do sources[#sources + 1] = item end
|
||
end
|
||
end
|
||
write_json({log = merge_logs(sources, 300)})
|
||
end
|
||
|
||
-- ============== 证书 ==============
|
||
|
||
function action_acme_install()
|
||
local ok = start_job("acme", "/bin/sh /usr/lib/minigate/acme.sh install")
|
||
write_json({success = ok, message = ok and "已开始安装" or "无法启动安装任务"})
|
||
end
|
||
|
||
function action_acme_issue()
|
||
local d = luci.http.formvalue("domain") or ""
|
||
if d ~= "" and (#d > 253 or not d:match("^[%*%w][%w%.%-]*$")) then
|
||
bad_request("域名无效")
|
||
return
|
||
end
|
||
local ok = start_job("acme", "/bin/sh /usr/lib/minigate/acme.sh issue " .. shellquote(d))
|
||
write_json({success = ok, message = ok and "已开始签发" or "无法启动签发任务"})
|
||
end
|
||
|
||
function action_acme_job()
|
||
local fs = require "nixio.fs"
|
||
local data = job_response("acme")
|
||
local state = read_state(ACME_STATE_FILE) or {}
|
||
data.result = state.result or ""
|
||
data.message = state.message or ""
|
||
data.domain = state.domain or ""
|
||
data.installed = fs.access("/etc/minigate/acme/data/acme.sh") and fs.access("/etc/minigate/acme/data/dnsapi/dns_cf.sh") and true or false
|
||
write_json(data)
|
||
end
|
||
|
||
-- ============== DDNS ==============
|
||
|
||
local function valid_ddns_section(sec)
|
||
return sec ~= "" and #sec <= 64 and sec:match("^[%w_]+$") and
|
||
require"luci.model.uci".cursor():get("minigate", sec) == "ddns"
|
||
end
|
||
|
||
function action_ddns_sync()
|
||
local sec = luci.http.formvalue("section") or ""
|
||
if not valid_ddns_section(sec) then
|
||
bad_request("DDNS 记录参数无效", {status = "invalid"})
|
||
return
|
||
end
|
||
local ok = start_job("ddns-" .. sec, "/bin/sh /usr/lib/minigate/ddns.sh single " .. shellquote(sec))
|
||
write_json({success = ok, message = ok and "已开始同步" or "无法启动同步任务"})
|
||
end
|
||
|
||
function action_ddns_job()
|
||
local sec = luci.http.formvalue("section") or ""
|
||
if not valid_ddns_section(sec) then
|
||
bad_request("DDNS 记录参数无效", {status = "invalid"})
|
||
return
|
||
end
|
||
local uci = require "luci.model.uci".cursor()
|
||
local data = job_response("ddns-" .. sec)
|
||
local st = ddns_state(uci:get("minigate", sec, "domain"))
|
||
data.status = st.status or "unknown"
|
||
data.message = st.message or ""
|
||
data.ip = st.ip or ""
|
||
data.ip6 = st.ip6 or ""
|
||
data.updated = st.updated or ""
|
||
data.next = st.next or ""
|
||
data.success = data.status == "ok" or data.status == "partial"
|
||
write_json(data)
|
||
end
|
||
|
||
local function history_section_name(value)
|
||
return tostring(value or ""):gsub("[^%w_%-]", "_")
|
||
end
|
||
|
||
local function history_ip_valid(family, ip)
|
||
if family == "ipv4" then
|
||
return ip:match("^%d+%.%d+%.%d+%.%d+$") ~= nil
|
||
end
|
||
return ip:match("^[%x:]+$") ~= nil and ip:find(":", 1, true) ~= nil
|
||
end
|
||
|
||
local function read_history_events(path, family, now)
|
||
local events = {}
|
||
local file = io.open(path, "r")
|
||
if not file then return events end
|
||
|
||
for line in file:lines() do
|
||
local raw_ts, ip = line:match("^(%d+)\t([^\t\r\n]+)$")
|
||
local ts = tonumber(raw_ts)
|
||
if ts and ts > 0 and ts <= now + 300 and history_ip_valid(family, ip or "") then
|
||
local previous = events[#events]
|
||
if not previous or previous.ip ~= ip then
|
||
events[#events + 1] = {timestamp=ts, ip=ip}
|
||
end
|
||
end
|
||
end
|
||
file:close()
|
||
table.sort(events, function(a, b) return a.timestamp < b.timestamp end)
|
||
return events
|
||
end
|
||
|
||
function action_ddns_history()
|
||
local uci = require "luci.model.uci".cursor()
|
||
local history_dir = os.getenv("MINIGATE_HISTORY_DIR") or "/etc/minigate/ddns-history"
|
||
local requested = luci.http.formvalue("section") or ""
|
||
local now = os.time()
|
||
local cutoff = now - 86400
|
||
local rows = {}
|
||
local sections = {}
|
||
|
||
if #requested > 64 or (requested ~= "" and not requested:match("^[%w_%-]+$")) then
|
||
bad_request("DDNS 记录参数无效")
|
||
return
|
||
end
|
||
|
||
uci:foreach("minigate", "ddns", function(section)
|
||
local name = section[".name"] or ""
|
||
if name ~= "" and (requested == "" or requested == name) then
|
||
sections[#sections + 1] = {
|
||
name=name,
|
||
domain=section.domain or name,
|
||
enabled=(section.enabled == "1" or section.enabled == true),
|
||
ip_version=section.ip_version or "ipv4"
|
||
}
|
||
end
|
||
end)
|
||
|
||
for _, section in ipairs(sections) do
|
||
if section.enabled then
|
||
local families = {}
|
||
if section.ip_version == "ipv4" or section.ip_version == "dual" then families[#families + 1] = "ipv4" end
|
||
if section.ip_version == "ipv6" or section.ip_version == "dual" then families[#families + 1] = "ipv6" end
|
||
|
||
for _, family in ipairs(families) do
|
||
local path = history_dir .. "/" .. history_section_name(section.domain) .. "." .. family .. ".tsv"
|
||
local events = read_history_events(path, family, now)
|
||
for index, event in ipairs(events) do
|
||
local next_event = events[index + 1]
|
||
local end_time = next_event and next_event.timestamp or now
|
||
if end_time > cutoff and event.timestamp <= now then
|
||
rows[#rows + 1] = {
|
||
section=section.name,
|
||
domain=section.domain,
|
||
family=family,
|
||
ip=event.ip,
|
||
start_time=event.timestamp,
|
||
end_time=end_time,
|
||
duration=math.max(0, end_time - event.timestamp),
|
||
active=(next_event == nil)
|
||
}
|
||
end
|
||
end
|
||
end
|
||
end
|
||
end
|
||
|
||
table.sort(rows, function(a, b)
|
||
if a.start_time == b.start_time then return a.domain < b.domain end
|
||
return a.start_time > b.start_time
|
||
end)
|
||
|
||
write_json({
|
||
success=true,
|
||
generated_at=now,
|
||
window_start=cutoff,
|
||
window_seconds=86400,
|
||
sections=sections,
|
||
records=rows
|
||
})
|
||
end
|
||
|
||
-- ============== 访问记录 ==============
|
||
|
||
function action_proxy_access()
|
||
local sys = require "luci.sys"
|
||
local limit = tonumber(luci.http.formvalue("limit") or "5") or 5
|
||
if limit ~= 20 and limit ~= 50 then
|
||
limit = 5
|
||
end
|
||
-- 读取最近 500 条日志，按 IP 聚合
|
||
local raw = sys.exec("cat /var/log/minigate-access.log.1 /var/log/minigate-access.log 2>/dev/null | tail -n 500") or ""
|
||
local visitors = {}
|
||
local order = {} -- 保持顺序
|
||
|
||
for line in raw:gmatch("[^\n]+") do
|
||
local time = line:match('"time":"([^"]*)"')
|
||
local domain = line:match('"domain":"([^"]*)"')
|
||
local client = line:match('"client":"([^"]*)"')
|
||
local status = tonumber(line:match('"status"%s*:%s*(%d+)'))
|
||
local upstream = line:match('"upstream_status":"([^"]*)"')
|
||
if time and client and client ~= "" then
|
||
local outcome = "unknown"
|
||
if status == 444 or (status == 400 and domain == "_") then
|
||
outcome = "blocked"
|
||
elseif status and (status >= 500 or status == 499) then
|
||
outcome = "error"
|
||
elseif status and upstream and upstream ~= "" and upstream ~= "-" then
|
||
outcome = "forwarded"
|
||
elseif status and status >= 100 and status < 400 then
|
||
outcome = "responded"
|
||
elseif status and status >= 400 then
|
||
outcome = "error"
|
||
end
|
||
if not visitors[client] then
|
||
visitors[client] = { count = 0, forwarded_count = 0, blocked_count = 0, other_count = 0 }
|
||
order[#order + 1] = client
|
||
end
|
||
local v = visitors[client]
|
||
v.last_time, v.domain, v.status, v.outcome = time, domain or "", status, outcome
|
||
v.count = v.count + 1
|
||
local counter = outcome == "forwarded" and "forwarded_count" or
|
||
(outcome == "blocked" and "blocked_count" or "other_count")
|
||
v[counter] = v[counter] + 1
|
||
end
|
||
end
|
||
|
||
-- 按最后访问时间倒序
|
||
table.sort(order, function(a, b)
|
||
return visitors[a].last_time > visitors[b].last_time
|
||
end)
|
||
|
||
-- 按前端选择取前 N 个，默认 5 个
|
||
local result = {}
|
||
local now = os.time()
|
||
for i = 1, math.min(#order, limit) do
|
||
local ip = order[i]
|
||
local v = visitors[ip]
|
||
-- 仅表示最近有请求，不能据此推断访客在线或已通过准入。
|
||
local recent = false
|
||
local y,mo,da,h,mi,se = v.last_time:match("(%d+)-(%d+)-(%d+)T(%d+):(%d+):(%d+)")
|
||
if y then
|
||
local ts = os.time({year=tonumber(y),month=tonumber(mo),day=tonumber(da),hour=tonumber(h),min=tonumber(mi),sec=tonumber(se)})
|
||
recent = now >= ts and (now - ts) < 300
|
||
end
|
||
result[#result + 1] = {
|
||
ip = ip,
|
||
last_time = v.last_time,
|
||
domain = v.domain,
|
||
count = v.count,
|
||
recent = recent,
|
||
outcome = v.outcome,
|
||
status = v.status,
|
||
forwarded_count = v.forwarded_count,
|
||
blocked_count = v.blocked_count,
|
||
other_count = v.other_count
|
||
}
|
||
end
|
||
|
||
write_json({ visitors = result })
|
||
end
|
||
|
||
-- ============== 归属地 ==============
|
||
|
||
local GEO_CACHE_DIR = "/tmp/minigate-geo-cache"
|
||
local GEO_CACHE_MAX = 500
|
||
|
||
-- 缓存超过上限时删除最旧的一批，避免长期遭遇扫描时占满内存
|
||
local function prune_geo_cache()
|
||
local sys = require "luci.sys"
|
||
local count = tonumber((sys.exec("ls " .. GEO_CACHE_DIR .. " 2>/dev/null | wc -l") or ""):match("%d+") or "0") or 0
|
||
if count > GEO_CACHE_MAX then
|
||
sys.call("cd " .. GEO_CACHE_DIR .. " && ls -tr | head -n 100 | xargs rm -f -- 2>/dev/null")
|
||
end
|
||
end
|
||
|
||
local function json_field(raw, key)
|
||
return raw:match('"' .. key .. '"%s*:%s*"([^"]*)"') or ""
|
||
end
|
||
|
||
function action_geo_lookup()
|
||
local sys = require "luci.sys"
|
||
local fs = require "nixio.fs"
|
||
local ip = luci.http.formvalue("ip") or ""
|
||
-- 安全校验：只允许 IP 地址字符
|
||
if #ip > 39 or not ip:match("^[%d%.%:a-fA-F]+$") then
|
||
write_json({ ip = ip, geo = "无效IP" })
|
||
return
|
||
end
|
||
|
||
local cache_file = GEO_CACHE_DIR .. "/" .. ip:gsub("[^%w%.%-_:]", "_")
|
||
fs.mkdirr(GEO_CACHE_DIR)
|
||
local cached = fs.readfile(cache_file)
|
||
if cached and cached ~= "" then
|
||
write_json({ ip = ip, geo = cached:gsub("%s+$", "") })
|
||
return
|
||
end
|
||
|
||
-- 先查随包的离线省级地址库，命中时不把访客 IP 发给任何外部服务
|
||
local geo = (sys.exec("/bin/sh /usr/lib/minigate/geo_lookup.sh " .. shellquote(ip) .. " 2>/dev/null") or ""):gsub("%s+$", "")
|
||
if geo == "" then geo = nil end
|
||
|
||
-- 境外或离线库未覆盖的地址，再用 HTTPS 接口查询
|
||
if not geo then
|
||
local raw = sys.exec("curl -s --proto '=https' --connect-timeout 1 --max-time 2 " .. shellquote("https://ip9.com.cn/get?ip=" .. ip) .. " 2>/dev/null") or ""
|
||
local loc = (json_field(raw, "country") .. json_field(raw, "prov") .. json_field(raw, "city")):gsub("中国", "")
|
||
local isp = json_field(raw, "isp")
|
||
if isp ~= "" then loc = loc .. " " .. isp end
|
||
loc = loc:gsub("^%s+", ""):gsub("%s+$", "")
|
||
if loc ~= "" then geo = loc end
|
||
end
|
||
|
||
if not geo then
|
||
local raw = sys.exec("curl -s --proto '=https' --connect-timeout 1 --max-time 2 " .. shellquote("https://whois.pconline.com.cn/ipJson.jsp?ip=" .. ip .. "&json=true") .. " 2>/dev/null | iconv -f gbk -t utf-8 2>/dev/null") or ""
|
||
local addr = json_field(raw, "addr")
|
||
if addr ~= "" then geo = addr:gsub("%s+", " "):gsub("^%s+", ""):gsub("%s+$", "") end
|
||
end
|
||
|
||
fs.writefile(cache_file, geo or "未知")
|
||
prune_geo_cache()
|
||
write_json({ ip = ip, geo = geo or "未知" })
|
||
end
|
||
|
||
-- ============== 登录防护 API ==============
|
||
|
||
local function valid_ban_ip(ip)
|
||
if ip:match("^%d+%.%d+%.%d+%.%d+$") then return true end
|
||
return #ip <= 39 and ip:match("^[%x:]+$") ~= nil and select(2, ip:gsub(":", "")) >= 2
|
||
end
|
||
|
||
local function parse_ban_set(raw, banned)
|
||
-- nft -j 在 key 和 value 之间有空格，要用 %s* 匹配；按 elem 块配对 val 与 expires
|
||
for block in raw:gmatch('{[^{}]-"val"%s*:%s*"[^"]+"[^{}]-}') do
|
||
local ip = block:match('"val"%s*:%s*"([%x:%.]+)"')
|
||
local expires = tonumber(block:match('"expires"%s*:%s*(%d+)') or "")
|
||
if ip and expires then banned[#banned + 1] = { ip = ip, remaining = expires } end
|
||
end
|
||
end
|
||
|
||
function action_lg_status()
|
||
local sys = require "luci.sys"
|
||
local fs = require "nixio.fs"
|
||
local uci = require "luci.model.uci".cursor()
|
||
|
||
local watch_limit = tonumber(luci.http.formvalue("watch_limit") or "5") or 5
|
||
if watch_limit ~= 20 and watch_limit ~= 30 then
|
||
watch_limit = 5
|
||
end
|
||
local ban_limit = tonumber(luci.http.formvalue("ban_limit") or "5") or 5
|
||
if ban_limit ~= 20 and ban_limit ~= 30 then
|
||
ban_limit = 5
|
||
end
|
||
|
||
local enabled = uci:get("minigate","login_guard","enabled") or "0"
|
||
local threshold = tonumber(uci:get("minigate","login_guard","threshold")) or 3
|
||
local bantime = tonumber(uci:get("minigate","login_guard","bantime")) or 43200
|
||
local window_s = tonumber(uci:get("minigate","login_guard","window")) or 600
|
||
|
||
-- 服务是否在跑（procd 以 /bin/sh login_guard.sh run 启动）
|
||
local pid_out = sys.exec("pgrep -f '^/bin/sh /usr/lib/minigate/login_guard.sh run' 2>/dev/null")
|
||
local running = (pid_out ~= nil and pid_out:match("%d") ~= nil)
|
||
|
||
local banned = {}
|
||
parse_ban_set(sys.exec("nft -j list set inet fw4 login_banned_v4 2>/dev/null") or "", banned)
|
||
parse_ban_set(sys.exec("nft -j list set inet fw4 login_banned_v6 2>/dev/null") or "", banned)
|
||
-- 按剩余时间倒序
|
||
table.sort(banned, function(a,b) return a.remaining > b.remaining end)
|
||
local banned_total = #banned
|
||
local banned_limited = {}
|
||
for i = 1, math.min(banned_total, ban_limit) do
|
||
banned_limited[#banned_limited + 1] = banned[i]
|
||
end
|
||
|
||
-- 失败计数中（读 /var/run/minigate/login-guard/counters/）
|
||
local watching = {}
|
||
local counter_dir = "/var/run/minigate/login-guard/counters"
|
||
local now = os.time()
|
||
if fs.dir(counter_dir) then
|
||
for ip in fs.dir(counter_dir) do
|
||
local path = counter_dir .. "/" .. ip
|
||
local fh = io.open(path, "r")
|
||
if fh then
|
||
local line = fh:read("*l") or ""
|
||
fh:close()
|
||
local first, count = line:match("(%d+)%s+(%d+)")
|
||
if first and count then
|
||
local first_time = tonumber(first)
|
||
local stat = fs.stat(path)
|
||
local last_time = (stat and stat.mtime) or first_time
|
||
local age = now - first_time
|
||
if age <= window_s then
|
||
watching[#watching+1] = {
|
||
ip = ip,
|
||
count = tonumber(count),
|
||
age = age,
|
||
first_time = first_time,
|
||
last_time = last_time,
|
||
last_seen = os.date("%Y-%m-%d %H:%M:%S", last_time)
|
||
}
|
||
end
|
||
end
|
||
end
|
||
end
|
||
end
|
||
table.sort(watching, function(a,b)
|
||
return (a.last_time or 0) > (b.last_time or 0)
|
||
end)
|
||
local watching_total = #watching
|
||
local watching_limited = {}
|
||
for i = 1, math.min(watching_total, watch_limit) do
|
||
watching_limited[#watching_limited + 1] = watching[i]
|
||
end
|
||
|
||
write_json({
|
||
enabled = enabled,
|
||
running = running,
|
||
threshold = threshold,
|
||
bantime = bantime,
|
||
window = window_s,
|
||
banned = banned_limited,
|
||
banned_total = banned_total,
|
||
ban_limit = ban_limit,
|
||
watching = watching_limited,
|
||
watching_total = watching_total,
|
||
watch_limit = watch_limit
|
||
})
|
||
end
|
||
|
||
function action_lg_ban()
|
||
local sys = require "luci.sys"
|
||
local ip = luci.http.formvalue("ip") or ""
|
||
if not valid_ban_ip(ip) then
|
||
write_json({success=false, error="无效 IP"})
|
||
return
|
||
end
|
||
local rc = sys.call("/bin/sh /usr/lib/minigate/login_guard.sh ban " .. shellquote(ip) .. " >/dev/null 2>&1")
|
||
write_json({success = (rc == 0), ip = ip})
|
||
end
|
||
|
||
function action_lg_unban()
|
||
local sys = require "luci.sys"
|
||
local ip = luci.http.formvalue("ip") or ""
|
||
if not valid_ban_ip(ip) then
|
||
write_json({success=false, error="无效 IP"})
|
||
return
|
||
end
|
||
local rc = sys.call("/bin/sh /usr/lib/minigate/login_guard.sh unban " .. shellquote(ip) .. " >/dev/null 2>&1")
|
||
write_json({success = (rc == 0), ip = ip})
|
||
end
|
||
|
||
function action_lg_flush()
|
||
local sys = require "luci.sys"
|
||
local rc = sys.call("/bin/sh /usr/lib/minigate/login_guard.sh flush >/dev/null 2>&1")
|
||
write_json({success = (rc == 0)})
|
||
end
|