From 5368e34d3dfbbfd5b45df9360c319b4a42ea6a7e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 12 Dec 2024 00:34:50 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=8E=84=20Sync=202024-12-12=2000:34?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- luci-app-ddns-go/ddns-go/Makefile | 8 +- .../luasrc/model/cbi/eqosplus.lua | 42 +++++---- .../model/cbi/passwall/client/other.lua | 2 +- .../luasrc/passwall/util_xray.lua | 21 +++-- .../passwall/node_list/link_share_man.htm | 12 +++ luci-app-passwall/po/zh-cn/passwall.po | 3 + luci-app-passwall2/Makefile | 2 +- .../model/cbi/passwall2/client/other.lua | 2 +- .../luasrc/passwall2/util_xray.lua | 22 +++-- .../passwall2/node_list/link_share_man.htm | 12 +++ luci-app-passwall2/po/zh-cn/passwall2.po | 3 + .../root/usr/share/passwall2/iptables.sh | 87 +++++++++--------- .../root/usr/share/passwall2/nftables.sh | 91 ++++++++++--------- 13 files changed, 184 insertions(+), 123 deletions(-) diff --git a/luci-app-ddns-go/ddns-go/Makefile b/luci-app-ddns-go/ddns-go/Makefile index fbc53861..fea4f2d5 100644 --- a/luci-app-ddns-go/ddns-go/Makefile +++ b/luci-app-ddns-go/ddns-go/Makefile @@ -3,18 +3,18 @@ # Copyright (C) 2021-2023 sirpdboy # # This is free software, licensed under the Apache License, Version 2.0 . -# + include $(TOPDIR)/rules.mk PKG_NAME:=ddns-go -PKG_VERSION:=6.7.6 +PKG_VERSION:=6.7.7 PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://github.com/jeessy2/ddns-go.git -PKG_MIRROR_HASH:=34bd601fdc310b8b9f5cb4972708adf8a7e1eae09ac8e04bdb4079624ac4cf5a -PKG_SOURCE_VERSION:=52f0e67a4e3391b7c02060492d07414ed62b881c +PKG_MIRROR_HASH:=424ef8965c2fe26cfbe469be6e5cd8637ba36313862631caa764c33fd8337a21 +PKG_SOURCE_VERSION:=e0dc641faefa350af644381b5dd8bc43a211b0db PKG_LICENSE:=AGPL-3.0-only PKG_LICENSE_FILES:=LICENSE diff --git a/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua b/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua index b3ce35ba..78432ed0 100644 --- a/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua +++ b/luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua @@ -1,8 +1,7 @@ -- Copyright 2022-2023 sirpdboy -- Licensed to the public under the Apache License 2.0. local sys = require "luci.sys" -local ifaces = sys.net:devices() -local WADM = require "luci.tools.webadmin" +local interfaces = sys.exec("ls -l /sys/class/net/ 2>/dev/null |awk '{print $9}' 2>/dev/null") local ipc = require "luci.ip" local a, t, e @@ -22,11 +21,10 @@ ipi = t:option(ListValue, "ifname", translate("Interface"), translate("Set the i ipi.default = "1" ipi:value(1,translate("Automatic settings")) ipi.rmempty = false -for _, v in pairs(ifaces) do - net = WADM.iface_get_network(v) - if net and net ~= "loopback" then - ipi:value(v) - end +for interface in string.gmatch(interfaces, "%S+") do + if interface and interface ~= "loopback" then + ipi:value(interface) + end end t = a:section(TypedSection, "device") @@ -41,18 +39,26 @@ e = t:option(Flag, "enable", translate("Enabled")) e.rmempty = false e.size = 4 -ip = t:option(Value, "mac", translate("IP/MAC")) +local lan_interfaces = {} +for interface in string.gmatch(interfaces, "%S+") do + if string.match(interface, "lan") then + table.insert(lan_interfaces, interface) + end +end -ipc.neighbors({family = 4, dev = "br-lan"}, function(n) - if n.mac and n.dest then - ip:value(n.dest:string(), "%s (%s)" %{ n.dest:string(), n.mac }) - end -end) -ipc.neighbors({family = 4, dev = "br-lan"}, function(n) - if n.mac and n.dest then - ip:value(n.mac, "%s (%s)" %{n.mac, n.dest:string() }) - end -end) +ip = t:option(Value, "mac", translate("IP/MAC")) +for _, lan_interface in ipairs(lan_interfaces) do + ipc.neighbors({family = 4, dev = lan_interface}, function(n) + if n.mac and n.dest then + ip:value(n.dest:string(), "%s (%s)" %{ n.dest:string(), n.mac }) + end + end) + ipc.neighbors({family = 4, dev = lan_interface}, function(n) + if n.mac and n.dest then + ip:value(n.mac, "%s (%s)" %{n.mac, n.dest:string() }) + end + end) +end e.size = 8 dl = t:option(Value, "download", translate("Downloads")) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua index 11a052dd..0bc15c66 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua @@ -180,7 +180,7 @@ if has_xray then o = s_xray:option(Flag, "sniffing_override_dest", translate("Override the connection destination address")) o.default = 0 - o.description = translate("Override the connection destination address with the sniffed domain.
When enabled, traffic will match only by domain, ignoring IP rules.
If using shunt nodes, configure the domain shunt rules correctly.") + o.description = translate("Override the connection destination address with the sniffed domain.
Otherwise use sniffed domain for routing only.
If using shunt nodes, configure the domain shunt rules correctly.") local domains_excluded = string.format("/usr/share/%s/rules/domains_excluded", appname) o = s_xray:option(TextValue, "excluded_domains", translate("Excluded Domains"), translate("If the traffic sniffing result is in this list, the destination address will not be overridden.")) diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua index 3c990775..05a9f1dd 100644 --- a/luci-app-passwall/luasrc/passwall/util_xray.lua +++ b/luci-app-passwall/luasrc/passwall/util_xray.lua @@ -612,8 +612,15 @@ function gen_config(var) port = tonumber(local_socks_port), protocol = "socks", settings = {auth = "noauth", udp = true}, - sniffing = {enabled = true, destOverride = {"http", "tls", "quic"}} + sniffing = { + enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt" + } } + if inbound.sniffing.enabled == true then + inbound.sniffing.destOverride = {"http", "tls", "quic"} + inbound.sniffing.routeOnly = xray_settings.sniffing_override_dest ~= "1" or nil + inbound.sniffing.domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + end if local_socks_username and local_socks_password and local_socks_username ~= "" and local_socks_password ~= "" then inbound.settings.auth = "password" inbound.settings.accounts = { @@ -649,13 +656,15 @@ function gen_config(var) settings = {network = "tcp,udp", followRedirect = true}, streamSettings = {sockopt = {tproxy = "tproxy"}}, sniffing = { - enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt", - destOverride = {"http", "tls", "quic"}, - metadataOnly = false, - routeOnly = node.protocol == "_shunt" and xray_settings.sniffing_override_dest ~= "1" or nil, - domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt" } } + if inbound.sniffing.enabled == true then + inbound.sniffing.destOverride = {"http", "tls", "quic", (remote_dns_fake) and "fakedns"} + inbound.sniffing.metadataOnly = false + inbound.sniffing.routeOnly = xray_settings.sniffing_override_dest ~= "1" or nil + inbound.sniffing.domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + end if tcp_redir_port then local tcp_inbound = api.clone(inbound) diff --git a/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm b/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm index 29653c5b..3dad68b7 100644 --- a/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm +++ b/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm @@ -976,6 +976,18 @@ local api = require "luci.passwall.api" opt.set(dom_prefix + 'grpc_mode', queryParam.mode || "gun"); } + opt.set(dom_prefix + 'tls', queryParam.security === "tls"); + if (queryParam.security === "tls") { + var tls_serverName = queryParam.peer; + if (queryParam.sni) { + tls_serverName = queryParam.sni + } + opt.set(dom_prefix + 'tls_serverName', tls_serverName); + } + if (queryParam.allowinsecure === '1') { + opt.set(dom_prefix + 'tls_allowInsecure', true); + } + if (m.hash) { opt.set('remarks', decodeURIComponent(m.hash.substr(1))); } diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po index a32f413f..610fe9bc 100644 --- a/luci-app-passwall/po/zh-cn/passwall.po +++ b/luci-app-passwall/po/zh-cn/passwall.po @@ -1645,6 +1645,9 @@ msgstr "握手服务器" msgid "Handshake Server Port" msgstr "握手服务器端口" +msgid "Override the connection destination address with the sniffed domain.
Otherwise use sniffed domain for routing only.
If using shunt nodes, configure the domain shunt rules correctly." +msgstr "用探测出的域名覆盖连接目标地址。
否则仅将探测得到的域名用于路由。
如使用分流节点，请正确设置域名分流规则。" + msgid "Override the connection destination address with the sniffed domain.
When enabled, traffic will match only by domain, ignoring IP rules.
If using shunt nodes, configure the domain shunt rules correctly." msgstr "用探测出的域名覆盖连接目标地址。
启用后仅使用域名进行流量匹配，将忽略IP规则。
如使用分流节点，请正确设置域名分流规则。" diff --git a/luci-app-passwall2/Makefile b/luci-app-passwall2/Makefile index 1994f808..a1a23df0 100644 --- a/luci-app-passwall2/Makefile +++ b/luci-app-passwall2/Makefile @@ -5,7 +5,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall2 -PKG_VERSION:=24.12.05 +PKG_VERSION:=24.12.11 PKG_RELEASE:=1 PKG_CONFIG_DEPENDS:= \ diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua index 0930eb71..c8b9693d 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua @@ -166,7 +166,7 @@ if has_xray then o = s_xray:option(Flag, "sniffing_override_dest", translate("Override the connection destination address")) o.default = 0 - o.description = translate("Override the connection destination address with the sniffed domain.
When enabled, traffic will match only by domain, ignoring IP rules.
If using shunt nodes, configure the domain shunt rules correctly.") + o.description = translate("Override the connection destination address with the sniffed domain.
Otherwise use sniffed domain for routing only.
If using shunt nodes, configure the domain shunt rules correctly.") o = s_xray:option(Flag, "route_only", translate("Sniffing Route Only")) o.default = 0 diff --git a/luci-app-passwall2/luasrc/passwall2/util_xray.lua b/luci-app-passwall2/luasrc/passwall2/util_xray.lua index 4f0eb3b8..a179e345 100644 --- a/luci-app-passwall2/luasrc/passwall2/util_xray.lua +++ b/luci-app-passwall2/luasrc/passwall2/util_xray.lua @@ -612,8 +612,15 @@ function gen_config(var) port = tonumber(local_socks_port), protocol = "socks", settings = {auth = "noauth", udp = true}, - sniffing = {enabled = true, destOverride = {"http", "tls", "quic"}} + sniffing = { + enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt" + } } + if inbound.sniffing.enabled == true then + inbound.sniffing.destOverride = {"http", "tls", "quic"} + inbound.sniffing.routeOnly = xray_settings.sniffing_override_dest ~= "1" or nil + inbound.sniffing.domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + end if local_socks_username and local_socks_password and local_socks_username ~= "" and local_socks_password ~= "" then inbound.settings.auth = "password" inbound.settings.accounts = { @@ -651,13 +658,16 @@ function gen_config(var) settings = {network = "tcp,udp", followRedirect = true}, streamSettings = {sockopt = {tproxy = "tproxy"}}, sniffing = { - enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt", - destOverride = {"http", "tls", "quic", (remote_dns_fake) and "fakedns"}, - metadataOnly = false, - routeOnly = node.protocol == "_shunt" and xray_settings.sniffing_override_dest ~= "1" or nil, - domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt" } } + if inbound.sniffing.enabled == true then + inbound.sniffing.destOverride = {"http", "tls", "quic", (remote_dns_fake) and "fakedns"} + inbound.sniffing.metadataOnly = false + inbound.sniffing.routeOnly = xray_settings.sniffing_override_dest ~= "1" or nil + inbound.sniffing.domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil + end + local tcp_inbound = api.clone(inbound) tcp_inbound.tag = "tcp_redir" tcp_inbound.settings.network = "tcp" diff --git a/luci-app-passwall2/luasrc/view/passwall2/node_list/link_share_man.htm b/luci-app-passwall2/luasrc/view/passwall2/node_list/link_share_man.htm index ae9fceee..80003a30 100644 --- a/luci-app-passwall2/luasrc/view/passwall2/node_list/link_share_man.htm +++ b/luci-app-passwall2/luasrc/view/passwall2/node_list/link_share_man.htm @@ -957,6 +957,18 @@ local api = require "luci.passwall2.api" opt.set(dom_prefix + 'grpc_mode', queryParam.mode || "gun"); } + opt.set(dom_prefix + 'tls', queryParam.security === "tls"); + if (queryParam.security === "tls") { + var tls_serverName = queryParam.peer; + if (queryParam.sni) { + tls_serverName = queryParam.sni + } + opt.set(dom_prefix + 'tls_serverName', tls_serverName); + } + if (queryParam.allowinsecure === '1') { + opt.set(dom_prefix + 'tls_allowInsecure', true); + } + opt.set(dom_prefix + 'mux', queryParam.mux === '1'); if (m.hash) { opt.set('remarks', decodeURIComponent(m.hash.substr(1))); diff --git a/luci-app-passwall2/po/zh-cn/passwall2.po b/luci-app-passwall2/po/zh-cn/passwall2.po index 6e07733c..6e79108d 100644 --- a/luci-app-passwall2/po/zh-cn/passwall2.po +++ b/luci-app-passwall2/po/zh-cn/passwall2.po @@ -1486,6 +1486,9 @@ msgstr "Sing-Box 会在启动时自动下载资源文件，您可以使用此功 msgid "Override the connection destination address" msgstr "覆盖连接目标地址" +msgid "Override the connection destination address with the sniffed domain.
Otherwise use sniffed domain for routing only.
If using shunt nodes, configure the domain shunt rules correctly." +msgstr "用探测出的域名覆盖连接目标地址。
否则仅将探测得到的域名用于路由。
如使用分流节点，请正确设置域名分流规则。" + msgid "Override the connection destination address with the sniffed domain.
When enabled, traffic will match only by domain, ignoring IP rules.
If using shunt nodes, configure the domain shunt rules correctly." msgstr "用探测出的域名覆盖连接目标地址。
启用后仅使用域名进行流量匹配，将忽略IP规则。
如使用分流节点，请正确设置域名分流规则。" diff --git a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh index 0a4e2d9d..af9679bd 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh @@ -334,25 +334,26 @@ load_acl() { ipt_j="$(REDIRECT $redir_port)" fi - [ "${write_ipset_direct}" = "1" ] && $ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $ipset_whitelist) ! -d $FAKE_IP -j RETURN - [ "$accept_icmp" = "1" ] && { $ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} -d $FAKE_IP $(REDIRECT) + [ "${write_ipset_direct}" = "1" ] && $ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(dst $ipset_whitelist) -j RETURN $ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(REDIRECT) } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { $ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} -d $FAKE_IP_6 $(REDIRECT) 2>/dev/null + [ "${write_ipset_direct}" = "1" ] && $ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $ipset_whitelist6) -j RETURN $ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(REDIRECT) 2>/dev/null } $ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP ${ipt_j} + [ "${write_ipset_direct}" = "1" ] && $ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $ipset_whitelist) -j RETURN $ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(factor $tcp_redir_ports "-m multiport --dport") ${ipt_j} [ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY) [ "$PROXY_IPV6" == "1" ] && { - [ "${write_ipset_direct}" = "1" ] && $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $ipset_whitelist6) ! -d $FAKE_IP_6 -j RETURN $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null + [ "${write_ipset_direct}" = "1" ] && $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $ipset_whitelist6) -j RETURN $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(factor $tcp_redir_ports "-m multiport --dport") -j PSW2_RULE 2>/dev/null $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY) 2>/dev/null } @@ -364,14 +365,14 @@ load_acl() { [ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && { msg2="${msg}使用 UDP 节点[$node_remark](TPROXY:${redir_port})" - [ "${write_ipset_direct}" = "1" ] && $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $ipset_whitelist) ! -d $FAKE_IP -j RETURN $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW2_RULE + [ "${write_ipset_direct}" = "1" ] && $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $ipset_whitelist) -j RETURN $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") -j PSW2_RULE $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $redir_port TPROXY) [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { - [ "${write_ipset_direct}" = "1" ] && $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $ipset_whitelist6) ! -d $FAKE_IP_6 -j RETURN $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null + [ "${write_ipset_direct}" = "1" ] && $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $ipset_whitelist6) -j RETURN $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") -j PSW2_RULE 2>/dev/null $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $redir_port TPROXY) 2>/dev/null } @@ -424,25 +425,26 @@ load_acl() { ipt_j="$(REDIRECT $REDIR_PORT)" fi - [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ipt_tmp -A PSW2 $(comment "默认") -p tcp $(dst $ipset_global_whitelist) ! -d $FAKE_IP -j RETURN - [ "$accept_icmp" = "1" ] && { $ipt_n -A PSW2 $(comment "默认") -p icmp -d $FAKE_IP $(REDIRECT) + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ipt_n -A PSW2 $(comment "默认") -p icmp $(dst $ipset_global_whitelist) -j RETURN $ipt_n -A PSW2 $(comment "默认") -p icmp $(REDIRECT) } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { $ip6t_n -A PSW2 $(comment "默认") -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT) + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ip6t_n -A PSW2 $(comment "默认") -p ipv6-icmp $(dst $ipset_global_whitelist6) -j RETURN $ip6t_n -A PSW2 $(comment "默认") -p ipv6-icmp $(REDIRECT) } $ipt_tmp -A PSW2 $(comment "默认") -p tcp -d $FAKE_IP ${ipt_j} + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ipt_tmp -A PSW2 $(comment "默认") -p tcp $(dst $ipset_global_whitelist) -j RETURN $ipt_tmp -A PSW2 $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") ${ipt_j} [ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "默认") -p tcp $(REDIRECT $REDIR_PORT TPROXY) [ "$PROXY_IPV6" == "1" ] && { - [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ip6t_m -A PSW2 $(comment "默认") -p tcp $(dst $ipset_global_whitelist6) ! -d $FAKE_IP_6 -j RETURN $ip6t_m -A PSW2 $(comment "默认") -p tcp -d $FAKE_IP_6 -j PSW2_RULE + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ip6t_m -A PSW2 $(comment "默认") -p tcp $(dst $ipset_global_whitelist6) -j RETURN $ip6t_m -A PSW2 $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j PSW2_RULE $ip6t_m -A PSW2 $(comment "默认") -p tcp $(REDIRECT $REDIR_PORT TPROXY) } @@ -453,14 +455,14 @@ load_acl() { if [ "$UDP_PROXY_MODE" != "disable" ] && [ "$NODE" != "nil" ]; then msg2="${msg}使用 UDP 节点[$(config_n_get $NODE remarks)](TPROXY:${REDIR_PORT})" - [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ipt_m -A PSW2 $(comment "默认") -p udp $(dst $ipset_global_whitelist) ! -d $FAKE_IP -j RETURN $ipt_m -A PSW2 $(comment "默认") -p udp -d $FAKE_IP -j PSW2_RULE + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ipt_m -A PSW2 $(comment "默认") -p udp $(dst $ipset_global_whitelist) -j RETURN $ipt_m -A PSW2 $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") -j PSW2_RULE $ipt_m -A PSW2 $(comment "默认") -p udp $(REDIRECT $REDIR_PORT TPROXY) if [ "$PROXY_IPV6_UDP" == "1" ]; then - [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ip6t_m -A PSW2 $(comment "默认") -p udp $(dst $ipset_global_whitelist6) ! -d $FAKE_IP_6 -j RETURN $ip6t_m -A PSW2 $(comment "默认") -p udp -d $FAKE_IP_6 -j PSW2_RULE + [ "${WRITE_IPSET_DIRECT}" = "1" ] && $ip6t_m -A PSW2 $(comment "默认") -p udp $(dst $ipset_global_whitelist6) -j RETURN $ip6t_m -A PSW2 $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") -j PSW2_RULE $ip6t_m -A PSW2 $(comment "默认") -p udp $(REDIRECT $REDIR_PORT TPROXY) fi @@ -501,6 +503,10 @@ filter_node() { local type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z') local address=$(config_n_get $node address) local port=$(config_n_get $node port) + [ -z "$address" ] && [ -z "$port" ] && { + echolog " - 节点配置不正常，略过" + return 1 + } ipt_tmp=$ipt_n _is_tproxy=${is_tproxy} [ "$stream" == "udp" ] && _is_tproxy="TPROXY" @@ -512,7 +518,7 @@ filter_node() { fi else echolog " - 节点配置不正常，略过" - return 0 + return 1 fi local ADD_INDEX=$FORCE_INDEX @@ -521,7 +527,6 @@ filter_node() { [ "$_ipt" == "6" ] && _ipt=$ip6t_m $_ipt -n -L PSW2_OUTPUT | grep -q "${address}:${port}" if [ $? -ne 0 ]; then - unset dst_rule local dst_rule="-j PSW2_RULE" msg2="按规则路由(${msg})" [ "$_ipt" == "$ipt_m" -o "$_ipt" == "$ip6t_m" ] || { @@ -544,7 +549,7 @@ filter_node() { local proxy_protocol=$(config_n_get $proxy_node protocol) local proxy_type=$(echo $(config_n_get $proxy_node type nil) | tr 'A-Z' 'a-z') - [ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 0 + [ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 1 if [ "$proxy_protocol" == "_balancing" ]; then #echolog " - 多节点负载均衡（${proxy_type}）..." proxy_node=$(config_n_get $proxy_node balancing_node) @@ -553,36 +558,34 @@ filter_node() { done elif [ "$proxy_protocol" == "_shunt" ]; then #echolog " - 按请求目的地址分流（${proxy_type}）..." + local preproxy_enabled=$(config_n_get $proxy_node preproxy_enabled 0) + [ "$preproxy_enabled" == "1" ] && { + local preproxy_node=$(config_n_get $proxy_node main_node nil) + [ "$preproxy_node" != "nil" ] && { + local preproxy_node_address=$(config_n_get $preproxy_node address) + if [ -n "$preproxy_node_address" ]; then + filter_rules $preproxy_node $stream + else + preproxy_enabled=0 + fi + } + } local default_node=$(config_n_get $proxy_node default_node _direct) - local main_node=$(config_n_get $proxy_node main_node nil) - if [ "$main_node" != "nil" ]; then - filter_rules $main_node $stream - else - if [ "$default_node" != "_direct" ] && [ "$default_node" != "_blackhole" ]; then - filter_rules $default_node $stream - fi + if [ "$default_node" != "_direct" ] && [ "$default_node" != "_blackhole" ]; then + local default_proxy_tag=$(config_n_get $proxy_node default_proxy_tag nil) + [ "$default_proxy_tag" == "main" ] && [ "$preproxy_enabled" == "0" ] && default_proxy_tag="nil" + [ "$default_proxy_tag" == "nil" ] && filter_rules $default_node $stream fi -:</dev/null + [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$nftset_whitelist6 counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} $(REDIRECT) comment \"$remarks\"" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} return comment \"$remarks\"" 2>/dev/null } nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP ${nft_j} comment \"$remarks\"" + [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr @$nftset_whitelist counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ${nft_j} comment \"$remarks\"" [ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\"" [ "$PROXY_IPV6" == "1" ] && { - [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr @$nftset_whitelist6 counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\"" + [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr @$nftset_whitelist6 counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY) comment \"$remarks\"" 2>/dev/null } @@ -413,14 +413,14 @@ load_acl() { [ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && { msg2="${msg}使用 UDP 节点[$node_remark](TPROXY:${redir_port})" - [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr @$nftset_whitelist counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW2_RULE comment \"$remarks\"" + [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr @$nftset_whitelist counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\"" [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { - [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr @$nftset_whitelist6 counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\"" + [ "${write_ipset_direct}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr @$nftset_whitelist6 counter return comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(REDIRECT $redir_port TPROXY) comment \"$remarks\"" 2>/dev/null } @@ -473,28 +473,28 @@ load_acl() { nft_j="$(REDIRECT $REDIR_PORT)" fi - [ "${WRITE_IPSET_DIRECT}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_NAT ip protocol tcp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" - [ "${WRITE_IPSET_DIRECT}" = "1" ] && [ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" - [ "$accept_icmp" = "1" ] && { nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp $(REDIRECT) comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp return comment \"默认\"" } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$nftset_global_whitelist6 counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 $(REDIRECT) comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 return comment \"默认\"" } nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j} comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j} comment \"默认\"" [ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp $(REDIRECT $REDIR_PORT TPROXY4) comment \"默认\"" [ "$PROXY_IPV6" == "1" ] && { - [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr @$nftset_global_whitelist6 counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr @$nftset_global_whitelist6 counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW2_RULE comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(REDIRECT $REDIR_PORT TPROXY) comment \"默认\"" } @@ -505,14 +505,14 @@ load_acl() { if [ "$UDP_PROXY_MODE" != "disable" ] && [ "$NODE" != "nil" ]; then msg2="${msg}使用 UDP 节点[$(config_n_get $NODE remarks)](TPROXY:${REDIR_PORT})" - [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr @$nftset_global_whitelist counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(REDIRECT $REDIR_PORT TPROXY4) comment \"默认\"" [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { - [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr @$nftset_global_whitelist6 counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"默认\"" + [ "${WRITE_IPSET_DIRECT}" = "1" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr @$nftset_global_whitelist6 counter return comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"默认\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(REDIRECT $REDIR_PORT TPROXY) comment \"默认\"" } @@ -563,6 +563,10 @@ filter_node() { local type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z') local address=$(config_n_get $node address) local port=$(config_n_get $node port) + [ -z "$address" ] && [ -z "$port" ] && { + echolog " - 节点配置不正常，略过" + return 1 + } _is_tproxy=${is_tproxy} [ "$stream" == "udp" ] && _is_tproxy="TPROXY" if [ -n "${_is_tproxy}" ]; then @@ -572,7 +576,7 @@ filter_node() { fi else echolog " - 节点配置不正常，略过" - return 0 + return 1 fi local ADD_INDEX=$FORCE_INDEX @@ -581,7 +585,6 @@ filter_node() { [ "$_ipt" == "6" ] && _ip_type=ip6 && _set_name=$NFTSET_VPSLIST6 nft "list chain $NFTABLE_NAME $nft_output_chain" 2>/dev/null | grep -q "${address}:${port}" if [ $? -ne 0 ]; then - unset dst_rule local dst_rule="jump PSW2_RULE" msg2="按规则路由(${msg})" [ -n "${is_tproxy}" ] || { @@ -604,7 +607,7 @@ filter_node() { local proxy_protocol=$(config_n_get $proxy_node protocol) local proxy_type=$(echo $(config_n_get $proxy_node type nil) | tr 'A-Z' 'a-z') - [ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 0 + [ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 1 if [ "$proxy_protocol" == "_balancing" ]; then #echolog " - 多节点负载均衡（${proxy_type}）..." proxy_node=$(config_n_get $proxy_node balancing_node) @@ -613,36 +616,34 @@ filter_node() { done elif [ "$proxy_protocol" == "_shunt" ]; then #echolog " - 按请求目的地址分流（${proxy_type}）..." + local preproxy_enabled=$(config_n_get $proxy_node preproxy_enabled 0) + [ "$preproxy_enabled" == "1" ] && { + local preproxy_node=$(config_n_get $proxy_node main_node nil) + [ "$preproxy_node" != "nil" ] && { + local preproxy_node_address=$(config_n_get $preproxy_node address) + if [ -n "$preproxy_node_address" ]; then + filter_rules $preproxy_node $stream + else + preproxy_enabled=0 + fi + } + } local default_node=$(config_n_get $proxy_node default_node _direct) - local main_node=$(config_n_get $proxy_node main_node nil) - if [ "$main_node" != "nil" ]; then - filter_rules $main_node $stream - else - if [ "$default_node" != "_direct" ] && [ "$default_node" != "_blackhole" ]; then - filter_rules $default_node $stream - fi + if [ "$default_node" != "_direct" ] && [ "$default_node" != "_blackhole" ]; then + local default_proxy_tag=$(config_n_get $proxy_node default_proxy_tag nil) + [ "$default_proxy_tag" == "main" ] && [ "$preproxy_enabled" == "0" ] && default_proxy_tag="nil" + [ "$default_proxy_tag" == "nil" ] && filter_rules $default_node $stream fi -:<