update 2026-09-24 16:56:26

luci-app-autoipsetadder/root/usr/bin/autoipsetadder/autoaddlist.sh

@@ -0,0 +1,164 @@
+#!/bin/sh
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+logfile=$(uci get autoipsetadder.autoipsetadder.logfile)
+[ -z "$logfile" ] && logfile="/tmp/addlist.log"
+dnslogfile=$(uci get autoipsetadder.autoipsetadder.dnslogfile)
+[ -z "$logfile" ] && dnslogfile="/tmp/dnsmasq.log"
+config=$(uci get autoipsetadder.autoipsetadder.config 2>/dev/null)
+[ "${config//nochina/}" == "$config" ] && nochina="0" || nochina="1"
+[ "${config//packetpass/}" == "$config" ] && packetpass="0" || packetpass="1"
+(tail -F $dnslogfile & echo $! >/var/run/autoipsetadder.pid ) | awk -v nochina="$nochina" -v packetpass="$packetpass" -F "[, ]+" '/reply/{
+ip=$8;
+if (ip=="" || ip=="127.0.0.1"|| ip=="0.0.0.0")
+{
+next;
+}
+if (index(ip,"<CNAME>")!=0)
+{
+if (cname==1)
+{
+    next;
+}
+cname=1;
+domain=$6;
+#第一次cname时锁定域名，防止解析cname对其改动
+next;
+}
+#以上获得上行是否为cname，本行不是cname执行以下内容
+#lastdomain记录上次非cname的域名，与本次域名对比
+if(lastdomain!=$6){
+    for (ipindex in ipcache)
+    {
+        delete ipcache[ipindex];
+    }
+    ipcount=0;
+    createpid=1;
+#上行非cname，并且不是同cname解析域名的多个ip，更新域名，清理同域名免试flag
+if (cname!=1)
+{
+    domain=$6;
+    testall=0;
+}}
+ipcount++;
+cname=0;
+lastdomain=$6
+#去除非ipv4
+if (index(ip,".")==0)
+{
+    next;
+}
+#不重复探测ip
+if (!(ip in a))
+{   
+#包数>12的同域名放过
+if (passdomain==domain)
+{
+    print(ip" "domain" pass by same domain ok");
+    a[ip]=domain;
+    next;
+}
+if (nochina==1){
+"ipset test china "ip" 2>&1"| getline ipset;
+close("ipset test china "ip" 2>&1");
+if (index(ipset,"Warning")!=0){
+	print("china "ip" pass");
+	a[ip]=domain;
+	next;
+}}
+"ipset test gfwlist "ip" 2>&1"| getline ipset;
+close("ipset test gfwlist "ip" 2>&1");
+if (index(ipset,"Warning")!=0){
+	print("gfwlist "ip" pass");
+	a[ip]=domain;
+	next;
+    }
+
+#ip压入缓存，用于未检测到443/80的缓存
+ipcache[ipcount]=ip;
+if (testall==0){
+    tryhttps=0;
+    tryhttp=0;
+    #探测 nf_conntrack 的443/80
+    while ("grep "ip" /proc/net/nf_conntrack"| getline ret > 0)
+    {
+        split(ret, b," +");
+        split(b[11], pagnum,"=");
+        #包数>12的放过
+        if (packetpass==1 && pagnum[2]>12)
+        {
+            print("pass by packets="pagnum[2]" "ip" "domain);
+            for (ipindex in ipcache)
+            {
+                a[ipcache[ipindex]]=domain;
+                delete ipcache[ipindex];
+            }
+            passdomain=domain;
+            close("grep "ip" /proc/net/nf_conntrack");
+            ipcount--;
+            next;
+        }
+        if (b[8]=="dst="ip)
+        {
+            if (b[10]=="dport=443"){
+                tryhttps=1;
+                break;
+            }
+            else if (b[10]=="dport=80"){
+                tryhttp=1;
+            }
+        }
+    }
+    close("grep "ip" /proc/net/nf_conntrack");
+}else{
+    if (testall==443)
+    {
+        tryhttps=1
+    }else{
+        tryhttp=1
+    }
+}
+if (tryhttps==1)
+{   if (createpid==1)
+    {
+        print "">"/tmp/run/autoipsetadder/"domain
+        close("/tmp/run/autoipsetadder/"domain);
+        print("create"domain);
+        print(ip" "domain" 443"ipcount-1);
+        a[ip]=domain;
+        #正在使用的ip用最大延迟，最后探测，减少打断tcp的可能
+        system("/usr/bin/autoipsetadder/testip.sh "ip" "domain" 443 "ipcount-1" &");
+        delete ipcache[ipcount];
+        createpid=0;
+    }
+    #未检测到443/80同域名缓存的ip进行测试，ipindex-1为测试延迟时间
+    for (ipindex in ipcache){
+        print(ipcache[ipindex]" "domain" 443 "ipindex-1);
+        a[ipcache[ipindex]]=domain;
+        system("/usr/bin/autoipsetadder/testip.sh "ipcache[ipindex]" "domain" 443 "ipindex-1" &");
+        delete ipcache[ipindex];
+    }
+    #后续同域名ip免nf_conntrack测试
+    testall=443;
+}
+else if (tryhttp==1)
+{   
+    if (createpid==1)
+    {
+        print "">"/tmp/run/autoipsetadder/"domain
+        close("/tmp/run/autoipsetadder/"domain);
+        print("create"domain);
+        print(ip" "domain" 80 "ipcount-1);
+        a[ip]=domain;
+        system("/usr/bin/autoipsetadder/testip.sh "ip" "domain" 80 "ipcount-1" &");
+        delete ipcache[ipcount];
+        createpid=0;
+    }
+    for (ipindex in ipcache){
+        print(ipcache[ipindex]" "domain" 80 "ipindex-1);
+        a[ipcache[ipindex]]=domain;
+        system("/usr/bin/autoipsetadder/testip.sh "ipcache[ipindex]" "domain" 80 "ipindex-1" &");
+        delete ipcache[ipindex];
+    }
+    testall=80;
+}}
+}'  >> $logfile

luci-app-autoipsetadder/root/usr/bin/autoipsetadder/debugip.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+dlchina=$1;
+logfile=$(uci get autoipsetadder.autoipsetadder.logfile)
+[ -z "$logfile" ] && logfile="/tmp/addlist.log"
+
+dnslogfile=$(uci get autoipsetadder.autoipsetadder.dnslogfile)
+[ -z "$logfile" ] && dnslogfile="/tmp/dnsmasq.log"
+
+
+ipset list gfwlist | awk -v dlchina="$dlchina" -v dnslogfile="$dnslogfile" -v logfile="$logfile" '{
+if (index($0,".")==0)
+{
+    next;
+}
+if ($0=="127.0.0.1") {system("ipset d gfwlist 127.0.0.1");next;}
+"ipset test whitelist "$0" 2>&1"| getline ipset;
+close("ipset test whitelist "$0" 2>&1");
+    if (index(ipset,"Warning")==0){
+        white=0;
+    }else{
+        white=1;
+    }
+    "ipset test china "$0" 2>&1"| getline ipset;
+    close("ipset test china "$0" 2>&1");
+    if (index(ipset,"Warning")!=0){
+        china=1;
+    }
+    else{
+        china=0;
+    }
+    if (white==1)
+    {
+        if (china==0)
+        {
+        print("warning white ip not china"$0);
+        ret=system("grep "$0" "logfile);
+        if (ret!=0)
+        {
+            ret=system("grep "$0" "dnslogfile);
+        }
+        }
+    }else if (china==1)
+	{
+		print("warning china ip not white"$0);
+		ret=system("grep "$0" "logfile)
+		if (ret!=0)
+		{
+			ret=system("grep "$0" "dnslogfile);
+		}
+		if (dlchina)
+		{
+			system("ipset del gfwlist "$0);
+		}
+	}  
+}'

luci-app-autoipsetadder/root/usr/bin/autoipsetadder/tailto.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+tail -n $1 "$2" > /var/run/tailtmp
+cat /var/run/tailtmp > "$2"
+rm /var/run/tailtmp

luci-app-autoipsetadder/root/usr/bin/autoipsetadder/testip.sh

@@ -0,0 +1,182 @@
+#!/bin/sh
+config=$(uci get autoipsetadder.autoipsetadder.config 2>/dev/null)
+[ "${config//pingadd/}" == "$config" ] && pingadd="0" || pingadd="1"
+echo $* | awk -v pingadd="$pingadd" '{
+if ($4=="")
+{ 
+wait=0;
+}else
+{wait=$4;}
+system("sleep "wait);
+ERRNO="";
+pidfile="/tmp/run/autoipsetadder/"$2
+getline drop< pidfile;
+close(pidfile);
+if (ERRNO) {
+addlist=0;
+print("bypass"$1" "$2);
+next;}
+if ($3=="443")
+{
+cmd=("httping -c 1 -t 4 -l "$2" --divert-connect "$1);
+}
+else if ($3=="80")
+{
+cmd=("httping -c 1 -t 4 "$2" --divert-connect "$1);
+}
+addlist=0;
+slow=0;
+while ((cmd | getline ret) > 0)
+{
+    if (addlist!=0)
+    {
+        continue;
+    }
+    else if (index(ret,"short read")!=0)
+    {
+        if (system("httping -q -c 1 -t 4 -l "$2" --divert-connect "$1)==0)
+        {
+            addlist=-1;
+            break;
+        }else{
+            print("doname rst autoaddip "$1" "$2);
+            addlist=1;
+        }
+    } 
+    else if (index(ret,"timeout")!=0)
+    {
+        while ((cmd | getline ret) > 0)
+        {
+            if (index(ret,"timeout")!=0)
+            {
+                print("direct so slow autoaddip "$1" "$2);
+                addlist=1;
+                slow=1;
+            }
+        }
+    }else if (index(ret,"SSL handshake error: (null)")!=0)
+    {
+        if(system("curl -m 10 --resolve "$2":443:"$1" https://"$2" -o /dev/null 2>/dev/null")==0){
+            addlist=-1;
+            break;
+        }
+    }else if (index(ret,"Connection refused")!=0){
+        print("direct Connection refused autoaddip"$1" "$2);
+        addlist=1;
+    }
+}
+close(cmd);
+
+if (addlist!=1)
+{
+    if (addlist==0){
+        split(ret, c,"[ /]+");
+        print(c[6]);
+        if (c[6]=="failed,"){
+            print("can not connect autoaddip "$1" "$2);
+            addlist=1;
+        }
+        else if (c[6]+0>10000)
+        {
+            print("direct ssl so slow autoaddip "$1" "$2);
+            addlist=1;
+        }else{
+            addlist=-1;}
+    }
+    if (addlist==-1 && pingadd==1)
+    {
+        while (("ping -c 5 -q -A "$1 | getline ret) > 0)
+        {
+            if (index(ret,"packet loss")!=0)
+            {
+                split(ret, p,"[ ]+");
+                if (p[4]>0 && p[4]<5)
+                {
+                    print("ping packet loss autoaddip "$1" "$2);
+                    pingloss=1;
+                    addlist=1;
+                }else{pingloss=0;}
+                break;
+            } 
+        }
+        close("ping -c 5 -q "$1);
+    }
+}
+ERRNO="";
+if (pingloss!=1){
+    getline drop< pidfile;
+    close(pidfile);
+}
+if (ERRNO) {addlist=0;next;}
+if (addlist==1){
+system("ipset add gfwlist "$1);
+while ((cmd | getline ret) > 0)
+{
+    if (addlist==1)
+    {
+    if (index(ret,"short read")!=0)
+    {
+    system("ipset del gfwlist "$1);
+    print("doname proxy rst autodelip "$1" "$2);
+    addlist=-2;
+    }
+    else if (index(ret,"SSL handshake error: (null)")!=0)
+    {
+        if(system("curl -m 10 --resolve "$2":443:"$1" https://"$2" -o /dev/null 2>/dev/null")==0)
+        {
+            addlist=2;
+        }
+    }
+    }
+}
+close(cmd);
+if (addlist==1){
+    split(ret, c,"[ /]+");
+    print(c[6]);
+    if (c[6]=="failed,")
+    {
+        system("ipset del gfwlist "$1);
+        print("proxy can not connect autodelip "$1" "$2);
+        addlist=-2;
+    }else{
+        addlist=2;
+    }
+}
+}
+}END{
+if (addlist==2)
+{   if (pingloss==0){
+    ERRNO="";
+    getline drop< pidfile;
+    if (ERRNO) {
+        system("ipset del gfwlist "$1);
+        print("cancel add myself "$1" "$2" due to one ip success direct");
+    }else{
+    print $1"\n">>pidfile;
+    }
+    close(pidfile);}
+}else if (addlist==-1)
+{
+    print($1" "$2" direct success");
+    while ((getline ret< pidfile) > 0)
+    {
+        if (ret!=""){
+        system("ipset del gfwlist "ret);
+        print("cancel add someone "ret" "$2" due to me"$1" success direct");
+        }
+    }
+    close(pidfile);
+    system("rm "pidfile" 2>/dev/null");
+    print($1" del "$2);
+}else if (addlist==-2)
+{   
+    system("sleep 10");
+    while ((getline ret< pidfile) > 0)
+    {
+        if (ret!=""){
+        system("ipset add gfwlist "$1);
+        print("add "ret" "$2" due to one ip success proxy");
+        break;}
+    }
+    close(pidfile);
+}}'