From 77391c5efaf004358d76be61dc0898d19b9d29f2 Mon Sep 17 00:00:00 2001 From: action Date: Mon, 24 Aug 2026 00:17:56 +0800 Subject: [PATCH] update 2026-08-24 00:17:56 --- .../model/cbi/passwall/client/acl_config.lua | 1 + .../model/cbi/passwall/client/other.lua | 1 + .../cbi/passwall/server/type/0_socks.lua | 10 ++ .../cbi/passwall/server/type/1_sing-box.lua | 11 +- .../model/cbi/passwall/server/type/2_xray.lua | 9 +- .../cbi/passwall/server/type/3_ss-rust.lua | 11 ++ .../model/cbi/passwall/server/type/4_ssr.lua | 11 ++ .../cbi/passwall/server/type/5_hysteria2.lua | 11 ++ .../luasrc/passwall/server_app.lua | 118 ++++-------------- .../luasrc/passwall/util_sing-box.lua | 2 +- .../luasrc/passwall/util_xray.lua | 2 +- luci-app-passwall/po/zh-cn/passwall.po | 9 ++ .../etc/uci-defaults/luci-app-passwall_server | 15 --- 13 files changed, 97 insertions(+), 114 deletions(-) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua index 683e41e8..1a21f5f9 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua @@ -172,6 +172,7 @@ o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"), o:value("", translate("Use global config") .. "(" .. UDP_NO_REDIR_PORTS .. ")") o:value("disable", translate("No patterns are used")) o:value("1:65535", translate("All")) +o:value("1:52,54:442,444:65535", translatef("Forward only %s", "53, 443")) o:depends("mode", "1") o.validate = port_validate diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua index 4f24a55f..d2cf8fdd 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua @@ -74,6 +74,7 @@ o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"), o.default = "disable" o:value("disable", translate("No patterns are used")) o:value("1:65535", translate("All")) +o:value("1:52,54:442,444:65535", translatef("Forward only %s", "53, 443")) o.validate = port_validate ---- TCP Proxy Drop Ports diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/0_socks.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/0_socks.lua index eb32702a..07689c23 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/0_socks.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/0_socks.lua @@ -30,6 +30,16 @@ for i, v in ipairs(user_list) do end o:depends({ auth = true }) +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) +o.default = "0" + +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ firewall_allow = true }) + o = s:option(Flag, "log", translate("Log")) o.default = "1" diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua index 50236d89..f3c8730e 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua @@ -456,9 +456,16 @@ if singbox_tags:find("with_wireguard") then o:depends({ protocol = "wireguard" }) end -o = s:option(Flag, "bind_local", translate("Bind Local"), translate("When selected, it can only be accessed localhost.")) +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) o.default = "0" -o:depends({ custom = false, is_endpoint = "" }) +o:depends({ custom = false }) + +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ custom = false, firewall_allow = true }) o = s:option(Flag, "accept_lan", translate("Accept LAN Access"), translate("When selected, it can accessed lan , this will not be safe!")) o.default = "0" diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua index a27e518c..98abded4 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua @@ -468,10 +468,17 @@ o = s:option(DummyValue, "gen_wireguard_key") o.template = m:template_path("/server/gen_wireguard_key") o:depends({ protocol = "wireguard" }) -o = s:option(Flag, "bind_local", translate("Bind Local"), translate("When selected, it can only be accessed localhost.")) +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) o.default = "0" o:depends({ custom = false }) +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ custom = false, firewall_allow = true }) + o = s:option(Flag, "accept_lan", translate("Accept LAN Access"), translate("When selected, it can accessed lan , this will not be safe!")) o.default = "0" o:depends({ custom = false }) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/3_ss-rust.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/3_ss-rust.lua index 40af02de..2672568a 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/3_ss-rust.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/3_ss-rust.lua @@ -72,6 +72,17 @@ o = s:option(Flag, "tcp_fast_open", "TCP " .. translate("Fast Open")) o.default = "0" o:depends({ custom = false }) +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) +o.default = "0" +o:depends({ custom = false }) + +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ custom = false, firewall_allow = true }) + o = s:option(Flag, "log", translate("Log")) o.default = "1" o.rmempty = false diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/4_ssr.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/4_ssr.lua index f7409233..42821c00 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/4_ssr.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/4_ssr.lua @@ -103,6 +103,17 @@ o = s:option(Flag, "udp_forward", translate("UDP Forward")) o.default = "1" o.rmempty = false +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) +o.default = "0" +o:depends({ custom = false }) + +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ custom = false, firewall_allow = true }) + o = s:option(Flag, "log", translate("Log")) o.default = "1" o.rmempty = false diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/5_hysteria2.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/5_hysteria2.lua index 3ba46043..f1803cdb 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/5_hysteria2.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/5_hysteria2.lua @@ -147,6 +147,17 @@ o.validate = function(self, value, t) end o:depends({ custom = false }) +o = s:option(Flag, "firewall_allow", translate("Firewall Allow")) +o.default = "0" +o:depends({ custom = false }) + +o = s:option(Value, "firewall_allow_src", translate("Source zone")) +o.nocreate = true +o.allowany = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" +o:depends({ custom = false, firewall_allow = true }) + o = s:option(Flag, "log", translate("Log")) o.default = "1" o.rmempty = false diff --git a/luci-app-passwall/luasrc/passwall/server_app.lua b/luci-app-passwall/luasrc/passwall/server_app.lua index cdfb2258..3c2d0197 100644 --- a/luci-app-passwall/luasrc/passwall/server_app.lua +++ b/luci-app-passwall/luasrc/passwall/server_app.lua @@ -8,16 +8,10 @@ local jsonc = api.jsonc local CONFIG = api.s_config local CONFIG_PATH = api.S_TMP_PATH -local NFT_INCLUDE_FILE = CONFIG_PATH .. "/" .. CONFIG .. ".nft" local LOG_APP_FILE = "/tmp/log/" .. CONFIG .. ".log" local TMP_BIN_PATH = CONFIG_PATH .. "/bin" local require_dir = "luci.passwall." -local ipt_bin = sys.exec("echo -n $(/usr/share/passwall/iptables.sh get_ipt_bin)") -local ip6t_bin = sys.exec("echo -n $(/usr/share/passwall/iptables.sh get_ip6t_bin)") - -local nft_flag = api.is_finded("fw4") and "1" or "0" - local function log(...) local f, err = io.open(LOG_APP_FILE, "a") if f and err == nil then @@ -31,18 +25,6 @@ local function cmd(cmd) sys.call(cmd) end -local function ipt(arg) - if ipt_bin and #ipt_bin > 0 then - cmd(ipt_bin .. " -w " .. arg) - end -end - -local function ip6t(arg) - if ip6t_bin and #ip6t_bin > 0 then - cmd(ip6t_bin .. " -w " .. arg) - end -end - local function ln_run(s, d, command, output) if not output then output = "/dev/null" @@ -52,37 +34,6 @@ local function ln_run(s, d, command, output) return string.format("%s >%s 2>&1 &", d .. " " .. command, output) end -local function gen_include() - cmd(string.format("echo '#!/bin/sh' > %s.include", CONFIG_PATH)) - local function extract_rules(n, a) - local _ipt = ipt_bin - if n == "6" then - _ipt = ip6t_bin - end - local result = "*" .. a - result = result .. "\n" .. sys.exec(_ipt .. '-save -t ' .. a .. ' | grep "PSW-SERVER" | sed -e "s/^-A \\(INPUT\\)/-I \\1 1/"') - result = result .. "COMMIT" - return result - end - local f, err = io.open(CONFIG_PATH .. ".include", "a") - if f and err == nil then - if nft_flag == "0" then - f:write(ipt_bin .. '-save -c | grep -v "PSW-SERVER" | ' .. ipt_bin .. '-restore -c' .. "\n") - f:write(ipt_bin .. '-restore -n <<-EOT' .. "\n") - f:write(extract_rules("4", "filter") .. "\n") - f:write("EOT" .. "\n") - f:write(ip6t_bin .. '-save -c | grep -v "PSW-SERVER" | ' .. ip6t_bin .. '-restore -c' .. "\n") - f:write(ip6t_bin .. '-restore -n <<-EOT' .. "\n") - f:write(extract_rules("6", "filter") .. "\n") - f:write("EOT" .. "\n") - f:close() - else - f:write("nft -f " .. NFT_INCLUDE_FILE .. "\n") - f:close() - end - end -end - local function start() local enabled = tonumber(api.uci_get_s("@global[0]", "enable") or 0) if enabled == nil or enabled == 0 then @@ -90,18 +41,7 @@ local function start() end cmd(string.format("mkdir -p %s %s", CONFIG_PATH, TMP_BIN_PATH)) cmd(string.format("touch %s", LOG_APP_FILE)) - if nft_flag == "0" then - ipt("-N PSW-SERVER") - ipt("-I INPUT -j PSW-SERVER") - ip6t("-N PSW-SERVER") - ip6t("-I INPUT -j PSW-SERVER") - else - nft_file, err = io.open(NFT_INCLUDE_FILE, "w") - nft_file:write('#!/usr/sbin/nft -f\n') - nft_file:write('add chain inet fw4 PSW-SERVER\n') - nft_file:write('flush chain inet fw4 PSW-SERVER\n') - nft_file:write('insert rule inet fw4 input position 0 jump PSW-SERVER comment "PSW-SERVER"\n') - end + local firewall_num = 0 api.uci_foreach_s("server", function(server) local id = server[".name"] local enable = server.enable @@ -207,48 +147,38 @@ local function start() cmd(bin) end - local bind_local = server.bind_local or 0 - if bind_local and tonumber(bind_local) ~= 1 and port then - if nft_flag == "0" then - ipt(string.format('-A PSW-SERVER -p tcp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks)) - ip6t(string.format('-A PSW-SERVER -p tcp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks)) - if udp_forward == 1 then - ipt(string.format('-A PSW-SERVER -p udp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks)) - ip6t(string.format('-A PSW-SERVER -p udp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks)) - end - else - nft_file:write(string.format('add rule inet fw4 PSW-SERVER meta l4proto tcp tcp dport {%s} counter accept comment "%s"\n', port, remarks)) - if udp_forward == 1 then - nft_file:write(string.format('add rule inet fw4 PSW-SERVER meta l4proto udp udp dport {%s} counter accept comment "%s"\n', port, remarks)) - end - end + local firewall_allow = server.firewall_allow + if firewall_allow == "1" then + firewall_num = firewall_num + 1 + local uid = CONFIG .. "_" .. id + uci:section("firewall", "rule", uid) + uci:set("firewall", uid, "name", uid) + uci:set("firewall", uid, "src", server.firewall_allow_src or "wan") + uci:set("firewall", uid, "dest_port", port) + uci:set("firewall", uid, "target", "ACCEPT") end end end) - if nft_flag == "1" then - nft_file:write("add rule inet fw4 PSW-SERVER return\n") - nft_file:close() - cmd("nft -f " .. NFT_INCLUDE_FILE) + if firewall_num > 0 then + api.uci_save(uci, "firewall", true, true) end - gen_include() end local function stop() cmd(string.format("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/' | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1", CONFIG_PATH)) - if nft_flag == "0" then - ipt("-D INPUT -j PSW-SERVER 2>/dev/null") - ipt("-F PSW-SERVER 2>/dev/null") - ipt("-X PSW-SERVER 2>/dev/null") - ip6t("-D INPUT -j PSW-SERVER 2>/dev/null") - ip6t("-F PSW-SERVER 2>/dev/null") - ip6t("-X PSW-SERVER 2>/dev/null") - else - local nft_cmd = "handles=$(nft -a list chain inet fw4 input | grep -E \"PSW-SERVER\" | awk -F '# handle ' '{print$2}')\n for handle in $handles; do\n nft delete rule inet fw4 input handle ${handle} 2>/dev/null\n done" - cmd(nft_cmd) - cmd("nft flush chain inet fw4 PSW-SERVER 2>/dev/null") - cmd("nft delete chain inet fw4 PSW-SERVER 2>/dev/null") + if true then + local num = 0 + uci:foreach("firewall", "rule", function(rule) + if rule[".name"]:find(CONFIG) == 1 then + num = num + 1 + uci:delete("firewall", rule[".name"]) + end + end) + if num > 0 then + api.uci_save(uci, "firewall", true, true) + end end - cmd(string.format("rm -rf %s %s %s", CONFIG_PATH, LOG_APP_FILE, CONFIG_PATH .. ".include")) + cmd(string.format("rm -rf %s %s", CONFIG_PATH, LOG_APP_FILE)) end if action then diff --git a/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/luci-app-passwall/luasrc/passwall/util_sing-box.lua index 8102f802..e6cdb63f 100644 --- a/luci-app-passwall/luasrc/passwall/util_sing-box.lua +++ b/luci-app-passwall/luasrc/passwall/util_sing-box.lua @@ -762,7 +762,7 @@ function gen_config_server(node) local inbound = { type = node.protocol, tag = "inbound", - listen = (node.bind_local == "1") and "127.0.0.1" or "::", + listen = "::", listen_port = tonumber(node.port), } diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua index 71336bd9..c2037d48 100644 --- a/luci-app-passwall/luasrc/passwall/util_xray.lua +++ b/luci-app-passwall/luasrc/passwall/util_xray.lua @@ -669,7 +669,7 @@ function gen_config_server(node) -- 传入连接 inbounds = { { - listen = (node.bind_local == "1") and "127.0.0.1" or nil, + listen = "::", port = tonumber(node.port), protocol = node.protocol, settings = settings, diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po index afc61746..c3ab224d 100644 --- a/luci-app-passwall/po/zh-cn/passwall.po +++ b/luci-app-passwall/po/zh-cn/passwall.po @@ -845,6 +845,9 @@ msgstr "常用的" msgid "Only Web" msgstr "仅网页" +msgid "Forward only %s" +msgstr "仅转发 %s 端口" + msgid "default" msgstr "默认" @@ -1571,6 +1574,12 @@ msgstr "本机监听" msgid "When selected, it can only be accessed localhost." msgstr "当勾选时，只能本机访问。" +msgid "Firewall Allow" +msgstr "允许通过防火墙" + +msgid "Source zone" +msgstr "源区域" + msgid "Accept LAN Access" msgstr "接受局域网访问" diff --git a/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall_server b/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall_server index 7636a1ba..9aeb328f 100755 --- a/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall_server +++ b/luci-app-passwall/root/etc/uci-defaults/luci-app-passwall_server @@ -9,21 +9,6 @@ if [ -e "/etc/config/ucitrack" ]; then EOF fi -uci -q batch <<-EOF - delete firewall.passwall_server - set firewall.passwall_server=include - set firewall.passwall_server.type='script' - set firewall.passwall_server.path='/var/etc/passwall_server.include' -EOF - -if [ -x "/sbin/fw3" ]; then - uci -q set firewall.passwall_server.reload='1' -else - uci -q delete firewall.passwall_server.reload - uci -q delete firewall.passwall_server.fw4_compatible -fi -uci commit firewall - # Migrate server sections from the old `user` section type. New user entries # also use `user`, so only sections with a server `type` option are renamed. for sid in $(uci -q show passwall_server | sed -n 's/^passwall_server\.\([^.=]*\)=user$/\1/p'); do