cwx/small-packages
1
0 Fork 0
mirror of https://github.com/caiwx86/small-packages.git synced 2026-11-03 22:43:56 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update 2026-10-06 04:10:42

Browse Source
This commit is contained in:
action committed 2026-10-06 04:10:42 +08:00
1 parent ec960a1df0
commit 4e01b07aa7
181 files changed
+41583 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-ssr-plus/root/usr/bin/ssr-rules
+17 -1
View File
@@ -295,7 +295,7 @@ flush_nftables() {
# Optional: force delete all ss_spec related sets (even if table was accidentally deleted)
for setname in ss_spec_lan_ac ss_spec_wan_ac ssr_gen_router \
china fplan bplan gmlan whitelist blacklist gfwlist music; do
china fplan bplan gmlan whitelist whitelist_domain blacklist gfwlist music; do
$NFT delete set inet ss_spec $setname 2>/dev/null
$NFT delete set ip ss_spec_mangle $setname 2>/dev/null
done
@@ -362,6 +362,13 @@ ipset_nft() {
fi
done
# DNS returns individual addresses; keep CIDR bypass entries in whitelist.
if ! $NFT list set inet ss_spec whitelist_domain >/dev/null 2>&1; then
$NFT add set inet ss_spec whitelist_domain '{ type ipv4_addr; }' 2>/dev/null
else
$NFT flush set inet ss_spec whitelist_domain 2>/dev/null
fi
# Bulk import china ip list safely (avoid huge single element limitation)
if [ -f "$IGNORE_LIST" ]; then
SKIP_INET=1 /usr/share/shadowsocksr/chinaipset.sh "$IGNORE_LIST"
@@ -405,6 +412,7 @@ ipset_nft() {
# Access control: blacklist -> whitelist -> fplan/bplan — TCP
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @blacklist jump ss_spec_wan_fw
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @whitelist return
$NFT add rule inet ss_spec ss_spec_wan_ac ip daddr @whitelist_domain return
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @fplan jump ss_spec_wan_fw
$NFT add rule inet ss_spec ss_spec_wan_ac ip saddr @bplan return
@@ -1448,6 +1456,14 @@ restore_from_persistence() {
return 1
fi
# Old snapshots lack the DNS-only whitelist used by dnsmasq. Regenerate
# them through the normal setup path instead of restoring stale schema.
if ! grep -q 'set whitelist_domain {' "$NFTABLES_RULES_FILE" ||
! grep -q 'ip daddr @whitelist_domain return' "$NFTABLES_RULES_FILE"; then
loger 6 "DNS whitelist set missing from persistence; rebuilding rules"
return 1
fi
loger 6 "Restoring rules from persistence file"
# Cleanup existing rules
luci-app-ssr-plus/root/usr/share/shadowsocksr/gfw2ipset.sh
+1 -1
View File
@@ -85,7 +85,7 @@ done
# 此处直接使用 cat 因为有 sed '/#/d' 删除了 数据
if [ "$nft_support" = "1" ]; then
sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1#$dns_port\nnftset=\/&\/inet#ss_spec#blacklist/" /etc/ssrplus/black.list > "$TMP_DNSMASQ_PATH/blacklist_forward.conf"
sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/nftset=\/&\/4#inet#ss_spec#whitelist/" /etc/ssrplus/white.list > "$TMP_DNSMASQ_PATH/whitelist_forward.conf"
sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/nftset=\/&\/4#inet#ss_spec#whitelist_domain/" /etc/ssrplus/white.list > "$TMP_DNSMASQ_PATH/whitelist_forward.conf"
elif [ "$nft_support" = "0" ]; then
sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1#$dns_port\nipset=\/&\/blacklist/" /etc/ssrplus/black.list > "$TMP_DNSMASQ_PATH/blacklist_forward.conf"
sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/ipset=\/&\/whitelist/" /etc/ssrplus/white.list > "$TMP_DNSMASQ_PATH/whitelist_forward.conf"