mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-07-27 10:31:38 +08:00
46 lines
980 B
Bash
46 lines
980 B
Bash
#!/bin/sh
|
|
|
|
. /lib/functions/network.sh
|
|
|
|
nft_insert() {
|
|
local chain="$1"
|
|
local position="$2"
|
|
shift 2
|
|
|
|
local line="$(
|
|
nft list chain inet fw4 "$chain" \
|
|
| wc \
|
|
| awk '{print $1 - 4}'
|
|
)"
|
|
|
|
[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))
|
|
|
|
[[ "$position" -lt 1 ]] && position=1
|
|
[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"
|
|
|
|
nft insert rule inet fw4 "$chain" index $(( position - 1 )) $@
|
|
}
|
|
|
|
nft_check_and_insert() {
|
|
local chain="$1"
|
|
local position="$2"
|
|
shift 2
|
|
|
|
nft list chain inet fw4 "$chain" | grep -q "$*" 2>/dev/null \
|
|
|| nft_insert "$chain" "$position" $@
|
|
}
|
|
|
|
main() {
|
|
nft add chain inet fw4 "mnh"
|
|
|
|
network_find_wan wan_iface
|
|
network_get_device wan_device "$wan_iface"
|
|
# avoid dead lock in `fw4 reload`
|
|
wan_zone=$(QUIET=1 ACTION=device OBJECT=$wan_device utpl -S /usr/share/firewall4/main.uc)
|
|
|
|
# before REJECT
|
|
nft_check_and_insert "input_${wan_zone}" -2 jump "mnh" comment \"Hook into mnh input chain\"
|
|
}
|
|
|
|
main
|