From 9716fefb96f98d80c51c5693bb53c5332338bc58 Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Tue, 3 Mar 2020 15:32:00 +0800 Subject: [PATCH] luci-app-passwall: sync with upstream source --- package/lienol/luci-app-passwall/Makefile | 4 +- .../luasrc/model/cbi/passwall/global.lua | 40 +++--- .../view/passwall/node_list/node_list.htm | 4 +- .../root/usr/share/passwall/app.sh | 28 ++-- .../root/usr/share/passwall/iptables.sh | 129 ++++++++++-------- 5 files changed, 109 insertions(+), 96 deletions(-) diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile index fec9826fb3..9e0655cf4a 100644 --- a/package/lienol/luci-app-passwall/Makefile +++ b/package/lienol/luci-app-passwall/Makefile @@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=3.6 -PKG_RELEASE:=7 -PKG_DATE:=20200228 +PKG_RELEASE:=9 +PKG_DATE:=20200302 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua index b14c847468..9881b07059 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua @@ -58,8 +58,8 @@ local tcp_node_num = tonumber( api.uci_get_type("global_other", "tcp_node_num", 1)) for i = 1, tcp_node_num, 1 do if i == 1 then - o = s:option(ListValue, "tcp_node" .. i, translate("TCP Node"), - translate("For used to surf the Internet.")) + o = s:option(ListValue, "tcp_node" .. i, translate("TCP Node")) + -- o.description = translate("For used to surf the Internet.") else o = s:option(ListValue, "tcp_node" .. i, translate("TCP Node") .. " " .. i) @@ -73,9 +73,8 @@ local udp_node_num = tonumber( api.uci_get_type("global_other", "udp_node_num", 1)) for i = 1, udp_node_num, 1 do if i == 1 then - o = s:option(ListValue, "udp_node" .. i, translate("UDP Node"), - translate("For Game Mode or DNS resolution and more.") .. - translate("The selected server will not use Kcptun.")) + o = s:option(ListValue, "udp_node" .. i, translate("UDP Node")) + -- o.description = translate("For Game Mode or DNS resolution and more.") .. translate("The selected server will not use Kcptun.") o:value("nil", translate("Close")) o:value("tcp", translate("Same as the tcp node")) else @@ -91,8 +90,8 @@ local socks5_node_num = tonumber(api.uci_get_type("global_other", "socks5_node_num", 1)) for i = 1, socks5_node_num, 1 do if i == 1 then - o = s:option(ListValue, "socks5_node" .. i, translate("Socks5 Node"), - translate("The client can use the router's Socks5 proxy.")) + o = s:option(ListValue, "socks5_node" .. i, translate("Socks5 Node")) + -- o.description = translate("The client can use the router's Socks5 proxy.") o:value("nil", translate("Close")) o:value("tcp", translate("Same as the tcp node")) else @@ -104,9 +103,9 @@ for i = 1, socks5_node_num, 1 do end if api.uci_get_type("global_other", "wangejibadns", "0") == "1" then - o = s:option(Value, "up_china_dns", - translate("China DNS Server") .. "(UDP)", translate( - "If you want to work with other DNS acceleration services, use the default.
Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.")) + o = + s:option(Value, "up_china_dns", translate("China DNS Server") .. "(UDP)") + -- o.description = translate("If you want to work with other DNS acceleration services, use the default.
Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.") o.default = "default" o:value("default", translate("default")) o:value("dnsbyisp", translate("dnsbyisp")) @@ -122,8 +121,8 @@ if api.uci_get_type("global_other", "wangejibadns", "0") == "1" then end ---- DNS Forward Mode -o = s:option(ListValue, "dns_mode", translate("DNS Mode"), translate( - "if has problem, please try another mode.
if you use no patterns are used, DNS of wan will be used by default as upstream of dnsmasq.")) +o = s:option(ListValue, "dns_mode", translate("DNS Mode")) +-- o.description = translate("if has problem, please try another mode.
if you use no patterns are used, DNS of wan will be used by default as upstream of dnsmasq.") o.rmempty = false o:reset_values() if is_finded("chinadns-ng") then o:value("chinadns-ng", "ChinaDNS-NG") end @@ -139,9 +138,8 @@ o:value("nonuse", translate("No patterns are used")) ---- Upstream trust DNS Server for ChinaDNS-NG o = s:option(Value, "up_trust_chinadns_ng_dns", - translate("Upstream trust DNS Server for ChinaDNS-NG") .. "(UDP)", - translate( - "You can use other resolving DNS services as trusted DNS, Example: dns2socks, dns-forwarder... 127.0.0.1#5353
Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.")) + translate("Upstream trust DNS Server for ChinaDNS-NG") .. "(UDP)") +-- o.description = translate("You can use other resolving DNS services as trusted DNS, Example: dns2socks, dns-forwarder... 127.0.0.1#5353
Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.") o.default = "pdnsd" if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then o:value("pdnsd", "pdnsd + " .. translate("Use TCP Node Resolve DNS")) @@ -158,8 +156,8 @@ o:depends("dns_mode", "chinadns-ng") ---- Use TCP Node Resolve DNS --[[ if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then o = s:option(Flag, "use_tcp_node_resolve_dns", - translate("Use TCP Node Resolve DNS"), - translate("If checked, DNS is resolved using the TCP node.")) + translate("Use TCP Node Resolve DNS")) +-- o.description = translate("If checked, DNS is resolved using the TCP node.") o.default = 1 o:depends("dns_mode", "pdnsd") end @@ -185,8 +183,8 @@ o:depends("up_trust_chinadns_ng_dns", "pdnsd") ---- Default Proxy Mode o = s:option(ListValue, "proxy_mode", - translate("Default") .. translate("Proxy Mode"), - translate("If not available, try clearing the cache.")) + translate("Default") .. translate("Proxy Mode")) +-- o.description = translate("If not available, try clearing the cache.") o.default = "chnroute" o.rmempty = false o:value("disable", translate("No Proxy")) @@ -198,8 +196,8 @@ o:value("returnhome", translate("Return Home")) ---- Localhost Proxy Mode o = s:option(ListValue, "localhost_proxy_mode", - translate("Localhost") .. translate("Proxy Mode"), translate( - "The server client can also use this rule to scientifically surf the Internet.")) + translate("Localhost") .. translate("Proxy Mode")) +-- o.description = translate("The server client can also use this rule to scientifically surf the Internet.") o:value("default", translate("Default")) o:value("gfwlist", translate("GFW List")) o:value("chnroute", translate("China WhiteList")) diff --git a/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm b/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm index 04bdcd88cd..c4063830cf 100644 --- a/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm +++ b/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm @@ -16,6 +16,8 @@ table th, .table .th { table td, .table .td { text-align: center; + white-space: nowrap; + word-break: keep-all; } #set_node_div{ @@ -163,7 +165,7 @@ table td, .table .td { <% end %> //判断是否含有汉字 var reg = new RegExp("[\\u4E00-\\u9FFF]+","g"); - if ((address != null && address != "") && (port != null && port != "") && reg.test(address) == false) { + if ((address != null && address != "") && (port != null && port != "") && reg.test(address) == false && (address.indexOf(".") != -1 && address.charAt(address.address - 1) != ".")) { ajax.post('<%=dsp.build_url("admin/vpn/passwall/ping_node")%>', { index: index, address: address, diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh index 3f93e248df..90c5bb8d96 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh @@ -30,7 +30,7 @@ find_bin() { bin_name=$1 result=$(find /usr/*bin -iname "$bin_name" -type f) if [ -z "$result" ]; then - echo "" + echo "null" else echo "$result" fi @@ -118,18 +118,20 @@ get_not_exists_port_after() { ln_start_bin() { local file=$1 - local bin=$2 - local cmd=$3 - if [ -n "${TMP_BIN_PATH}/$bin" -a -f "${TMP_BIN_PATH}/$bin" ];then - ${TMP_BIN_PATH}/$bin $cmd >/dev/null 2>&1 & - else - if [ -n "$file" -a -f "$file" ];then - ln -s $file ${TMP_BIN_PATH}/$bin + [ "$file" != "null" ] && { + local bin=$2 + local cmd=$3 + if [ -n "${TMP_BIN_PATH}/$bin" -a -f "${TMP_BIN_PATH}/$bin" ];then ${TMP_BIN_PATH}/$bin $cmd >/dev/null 2>&1 & else - echolog "找不到$bin主程序，无法启动！" + if [ -n "$file" -a -f "$file" ];then + ln -s $file ${TMP_BIN_PATH}/$bin + ${TMP_BIN_PATH}/$bin $cmd >/dev/null 2>&1 & + else + echolog "找不到$bin主程序，无法启动！" + fi fi - fi + } } ENABLED=$(config_t_get global enabled 0) @@ -267,12 +269,12 @@ gen_start_config() { server_host=$(config_n_get $node address) port=$(config_n_get $node port) [ -n "$server_host" -a -n "$port" ] && { - # 过滤URL + # 判断节点服务器地址是否URL并去掉~ server_host=$(echo $server_host | sed 's/^\(http:\/\/\|https:\/\/\)//g' | awk -F '/' '{print $1}') - # 过滤包含汉字的节点（SB机场） + # 判断节点服务器地址是否包含汉字~ local tmp=$(echo -n $server_host | awk '{print gensub(/[!-~]/,"","g",$0)}') [ -n "$tmp" ] && { - echolog "$redir_type节点，非法的地址，无法启动！" + echolog "$redir_type节点，非法的服务器地址，无法启动！" return 1 } echolog "$redir_type节点：$remarks，节点：${server_host}:${port}，监听端口：$local_port" diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh index f564b362d1..be61590129 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -30,14 +30,6 @@ get_jump_mode() { esac } -get_ip_mark() { - if [ -z "$1" ]; then - echo "" - else - echo $1 | awk -F "." '{printf ("0x%02X", $1)} {printf ("%02X", $2)} {printf ("%02X", $3)} {printf ("%02X", $4)}' - fi -} - dst() { echo "-m set $2 --match-set $1 dst" } @@ -151,33 +143,24 @@ load_acl() { [ "$TCP_NODE" != "nil" ] && { eval TCP_NODE_TYPE=$(echo $(config_n_get $TCP_NODE type) | tr 'A-Z' 'a-z') if [ "$TCP_NODE_TYPE" == "brook" -a "$(config_n_get $TCP_NODE brook_protocol client)" == "client" ]; then - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + [ "$tcp_no_redir_ports" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") $(comment "$remarks") -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_node $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(comment "$remarks") -j RETURN else - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + [ "$tcp_no_redir_ports" != "disable" ] && $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN eval tcp_redir_port=\$TCP_REDIR_PORT$tcp_node $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(factor $tcp_redir_ports "-m multiport --dport") $(comment "$remarks") -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$tcp_node $ipt_n -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p tcp $(comment "$remarks") -j RETURN fi } [ "$UDP_NODE" != "nil" ] && { - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp -m multiport --dport $udp_no_redir_ports -j RETURN eval udp_redir_port=\$UDP_REDIR_PORT$udp_node $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(factor $udp_redir_ports "-m multiport --dport") $(comment "$remarks") -$(get_jump_mode $proxy_mode) $(get_action_chain $proxy_mode)$udp_node $ipt_m -A PSW_ACL $(factor $ip "-s") $(factor $mac "-m mac --mac-source") -p udp $(comment "$remarks") -j RETURN } fi - [ -z "$ip" ] && { - lower_mac=$(echo $mac | tr '[A-Z]' '[a-z]') - ip=$(ip neigh show | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | grep $lower_mac | awk '{print $1}') - [ -z "$ip" ] && { - dhcp_index=$(uci show dhcp | grep $lower_mac | awk -F'.' '{print $2}') - ip=$(uci -q get dhcp.$dhcp_index.ip) - } - [ -z "$ip" ] && ip=$(cat /tmp/dhcp.leases | grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | grep $lower_mac | awk '{print $3}') - } fi } done @@ -191,27 +174,35 @@ filter_vpsip() { local ret=$(uci -q get $CONFIG.@nodes[$1].$2) echo ${ret:=$3} } + echolog "开始过滤所有节点到白名单" for i in $(seq 0 $count); do local use_ipv6=$(u_get $i use_ipv6 0) local network_type="ipv4" [ "$use_ipv6" == "1" ] && network_type="ipv6" local server=$(u_get $i address) [ -n "$server" ] && { - # 过滤URL + # 判断节点服务器地址是否URL并去掉~ server=$(echo $server | sed 's/^\(http:\/\/\|https:\/\/\)//g' | awk -F '/' '{print $1}') - # 过滤包含汉字的节点（SB机场） + # 判断节点服务器地址是否包含汉字，跳过~ local tmp=$(echo -n $server | awk '{print gensub(/[!-~]/,"","g",$0)}') [ -z "$tmp" ] && { [ "$network_type" == "ipv4" ] && { isip=$(echo $server | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}") if [ -n "$isip" ]; then + # 判断节点的服务器地址是否是DNS + [ -n "$(echo $DNS_FORWARD | grep -w $isip)" ] && continue ipset -! add $IPSET_VPSIPLIST $isip >/dev/null 2>&1 & else - # 判断节点的服务器地址是否包含在GFWLIST，比如某（SB机场）的 www.google.com 导致不走google代理 + # 跳过不合法的域名 + server=$(echo $server | grep -E '.*\..*$' | grep '[a-zA-Z]$') + [ -z "$server" ] && continue + # 判断节点的服务器地址是否包含在GFWLIST，比如（某机场）的 www.google.com 导致不走google代理..... + local tmp=$server local suffix=$(echo ${server##*.}) local top_host=$(echo ${server%.*} | awk -F '.' '{print $NF}') - [ -n "$suffix" -a -n "$top_host" ] && server="$top_host.$suffix" - is_gfwlist=$(cat $TMP_DNSMASQ_PATH/gfwlist.conf | grep -c "$server") + [ "$suffix" == "$top_host" ] && continue + [ -n "$suffix" -a -n "$top_host" ] && tmp="$top_host.$suffix" + is_gfwlist=$(cat $TMP_DNSMASQ_PATH/gfwlist.conf | grep -c "$tmp") [ "$is_gfwlist" == 0 ] && { has=$([ -f "$TMP_DNSMASQ_PATH/vpsiplist_host.conf" ] && cat $TMP_DNSMASQ_PATH/vpsiplist_host.conf | grep "$server") [ -z "$has" ] && echo "$server" | sed -e "/^$/d" | sed "s/^/ipset=&\//g" | sed "s/$/\/&vpsiplist/g" | sort | awk '{if ($0!=line) print;line=$0}' >> $TMP_DNSMASQ_PATH/vpsiplist_host.conf @@ -221,6 +212,7 @@ filter_vpsip() { } } done + echolog "过滤所有节点完成" } } @@ -264,6 +256,15 @@ filter_node() { fi } +dns_hijack() { + if [ "$1" = "force" ]; then + [ -n "$lan_ifname" -a -n "$lan_ip" ] && { + local ip=$(echo $lan_ip | awk -F '/' '{print $1}') + $ipt_n -I PSW -i $lan_ifname -p udp --dport 53 -j DNAT --to $ip + } + fi +} + add_firewall_rule() { echolog "开始加载防火墙规则..." echolog "默认代理模式：$(get_action_chain_name $PROXY_MODE)" @@ -423,20 +424,6 @@ add_firewall_rule() { [ "$LOCALHOST_PROXY_MODE" == "gfwlist" ] && $ipt_m -A PSW_OUTPUT -p tcp $(dst $IPSET_GFW) $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 [ "$LOCALHOST_PROXY_MODE" == "chnroute" ] && $ipt_m -A PSW_OUTPUT -p tcp -m set ! --match-set $IPSET_CHN dst $(factor $TCP_REDIR_PORTS "-m multiport --dport") -j MARK --set-mark 1 else - PRE_INDEX=1 - KP_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "KOOLPROXY" | sed -n '$p' | awk '{print $1}') - ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}') - if [ -n "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then - PRE_INDEX=$(expr $KP_INDEX + 1) - elif [ -z "$KP_INDEX" -a -n "$ADBYBY_INDEX" ]; then - PRE_INDEX=$(expr $ADBYBY_INDEX + 1) - elif [ -z "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then - PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}') - [ -n "$PR_INDEX" ] && { - PRE_INDEX=$(expr $PR_INDEX + 1) - } - fi - # 用于本机流量转发 $ipt_n -A OUTPUT -p tcp -j PSW_OUTPUT [ "$use_tcp_node_resolve_dns" == 1 -a -n "$DNS_FORWARD" ] && { @@ -445,7 +432,10 @@ add_firewall_rule() { local dns_ip=$(echo $dns | awk -F "#" '{print $1}') local dns_port=$(echo $dns | awk -F "#" '{print $2}') [ -z "$dns_port" ] && dns_port=53 - $ipt_n -I PSW_OUTPUT 2 -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1 + local ADD_INDEX=4 + local INDEX=$($ipt_n -L PSW --line-numbers | grep "$IPSET_WHITELIST" | sed -n '$p' | awk '{print $1}') + [ -n "$INDEX" ] && ADD_INDEX=$(expr $INDEX + 1) + $ipt_n -I PSW_OUTPUT $ADD_INDEX -p tcp -d $dns_ip --dport $dns_port -j REDIRECT --to-ports $TCP_REDIR_PORT1 done } [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_n -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN @@ -458,28 +448,44 @@ add_firewall_rule() { echolog "IPv4 防火墙TCP转发规则加载完成！" if [ "$PROXY_IPV6" == "1" ]; then - lan_ipv6=$(ip address show br-lan | grep -w "inet6" | awk '{print $2}') #当前LAN IPv6段 - $ip6t_n -N PSW - $ip6t_n -N PSW_ACL - $ip6t_n -A PREROUTING -j PSW - [ -n "$lan_ipv6" ] && { - for ip in $lan_ipv6; do - $ip6t_n -A PSW -d $ip -j RETURN - done + [ -n "$lan_ifname" ] && { + lan_ipv6=$(ip address show $lan_ifname | grep -w "inet6" | awk '{print $2}') #当前LAN IPv6段 + [ -n "$lan_ipv6" ] && { + $ip6t_n -N PSW + $ip6t_n -N PSW_ACL + $ip6t_n -A PREROUTING -j PSW + [ -n "$lan_ipv6" ] && { + for ip in $lan_ipv6; do + $ip6t_n -A PSW -d $ip -j RETURN + done + } + [ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6t_n -A PSW -d $server_ip -j RETURN + $ip6t_n -N PSW_GLO$k + $ip6t_n -N PSW_GFW$k + $ip6t_n -N PSW_CHN$k + $ip6t_n -N PSW_HOME$k + $ip6t_n -A PSW_GLO$k -p tcp -j REDIRECT --to $TCP_REDIR_PORT + $ip6t_n -A PSW -j PSW_GLO$k + #$ip6t_n -I OUTPUT -p tcp -j PSW + echolog "IPv6防火墙规则加载完成！" + } } - [ "$use_ipv6" == "1" -a -n "$server_ip" ] && $ip6t_n -A PSW -d $server_ip -j RETURN - $ip6t_n -N PSW_GLO$k - $ip6t_n -N PSW_GFW$k - $ip6t_n -N PSW_CHN$k - $ip6t_n -N PSW_HOME$k - $ip6t_n -A PSW_GLO$k -p tcp -j REDIRECT --to $TCP_REDIR_PORT - $ip6t_n -A PSW -j PSW_GLO$k - #$ip6t_n -I OUTPUT -p tcp -j PSW - echolog "IPv6防火墙规则加载完成！" fi fi done $ipt_n -A PSW -j PSW_ACL + + PRE_INDEX=1 + KP_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "KOOLPROXY" | sed -n '$p' | awk '{print $1}') + ADBYBY_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "ADBYBY" | sed -n '$p' | awk '{print $1}') + if [ -n "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then + PRE_INDEX=$(expr $KP_INDEX + 1) + elif [ -z "$KP_INDEX" -a -n "$ADBYBY_INDEX" ]; then + PRE_INDEX=$(expr $ADBYBY_INDEX + 1) + elif [ -z "$KP_INDEX" -a -z "$ADBYBY_INDEX" ]; then + PR_INDEX=$($ipt_n -L PREROUTING --line-numbers | grep "prerouting_rule" | sed -n '$p' | awk '{print $1}') + [ -n "$PR_INDEX" ] && PRE_INDEX=$(expr $PR_INDEX + 1) + fi $ipt_n -I PREROUTING $PRE_INDEX -j PSW else echolog "主节点未选择，无法转发TCP！" @@ -523,8 +529,11 @@ add_firewall_rule() { local dns_ip=$(echo $dns | awk -F "#" '{print $1}') local dns_port=$(echo $dns | awk -F "#" '{print $2}') [ -z "$dns_port" ] && dns_port=53 - $ipt_m -I PSW 2 -p udp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port - $ipt_m -I PSW_OUTPUT 2 -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1 + local ADD_INDEX=4 + local INDEX=$($ipt_m -L PSW --line-numbers | grep "$IPSET_WHITELIST" | sed -n '$p' | awk '{print $1}') + [ -n "$INDEX" ] && ADD_INDEX=$(expr $INDEX + 1) + $ipt_m -I PSW $ADD_INDEX -p udp -d $dns_ip --dport $dns_port -j TPROXY --tproxy-mark 0x1/0x1 --on-port $local_port + $ipt_m -I PSW_OUTPUT $ADD_INDEX -p udp -d $dns_ip --dport $dns_port -j MARK --set-mark 1 done } @@ -570,6 +579,8 @@ add_firewall_rule() { # 过滤所有节点IP filter_vpsip + + dns_hijack "force" } del_firewall_rule() {