From c7d3d81aac41d373f66e99a4b67fe852ca3658aa Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Sat, 19 Sep 2020 00:40:51 +0800 Subject: [PATCH] luci-app-passwall: bump to 3.9-60 --- package/lienol/luci-app-passwall/Makefile | 9 +- .../luasrc/model/cbi/passwall/client/acl.lua | 4 +- .../model/cbi/passwall/client/rule_list.lua | 78 +++++++++++ .../luasrc/view/passwall/log/log.htm | 2 +- .../root/etc/config/passwall | 1 + .../root/usr/share/passwall/app.sh | 23 ++-- .../root/usr/share/passwall/iptables.sh | 124 ++++++++++++++---- 7 files changed, 201 insertions(+), 40 deletions(-) diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile index 4aa6200392..fa9e4478e1 100644 --- a/package/lienol/luci-app-passwall/Makefile +++ b/package/lienol/luci-app-passwall/Makefile @@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=3.9 -PKG_RELEASE:=57 -PKG_DATE:=20200912 +PKG_RELEASE:=60 +PKG_DATE:=20200917 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) @@ -49,6 +49,10 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_Brook bool "Include Brook" default n +config PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy + bool "Include NaiveProxy" + default n + config PACKAGE_$(PKG_NAME)_INCLUDE_kcptun bool "Include kcptun" default n @@ -100,6 +104,7 @@ define Package/$(PKG_NAME) +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \ +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus:trojan-plus \ +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_GO:trojan-go \ + +PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy:naiveproxy \ +PACKAGE_$(PKG_NAME)_INCLUDE_Brook:brook \ +PACKAGE_$(PKG_NAME)_INCLUDE_kcptun:kcptun-client \ +PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \ diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua index 09fb8aea50..d68b2143f2 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua @@ -96,8 +96,8 @@ o.default = "default" o:value("default", translate("Default")) o:value("1:65535", translate("All")) o:value("80,443", "80,443") -o:value("80:", "80 " .. translate("or more")) -o:value(":443", "443 " .. translate("or less")) +o:value("80:65535", "80 " .. translate("or more")) +o:value("1:443", "443 " .. translate("or less")) ---- UDP Redir Ports o = s:option(Value, "udp_redir_ports", translate("UDP Redir Ports")) diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua index 954670a1f2..bd5ad352d7 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua @@ -9,6 +9,8 @@ s.anonymous = true s:tab("direct_list", translate("Direct List")) s:tab("proxy_list", translate("Proxy List")) +s:tab("proxy_list2", translate("Proxy List") .. " 2") +s:tab("proxy_list3", translate("Proxy List") .. " 3") ---- Direct Hosts local direct_host = string.format("/usr/share/%s/rules/direct_host", appname) @@ -86,4 +88,80 @@ o.validate = function(self, value) return value end +---- Proxy Hosts 2 +local proxy_host2 = string.format("/usr/share/%s/rules/proxy_host2", appname) +o = s:taboption("proxy_list2", TextValue, "proxy_host2", "", "" .. translate("These had been joined websites will use proxy. Please input the domain names of websites,every line can input only one website domain. For example: google.com.") .. "") +o.rows = 15 +o.wrap = "off" +o.cfgvalue = function(self, section) return fs.readfile(proxy_host2) or "" end +o.write = function(self, section, value) fs.writefile(proxy_host2, value:gsub("\r\n", "\n")) end +o.remove = function(self, section, value) fs.writefile(proxy_host2, "") end +o.validate = function(self, value) + local hosts= {} + string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(hosts, w) end) + for index, host in ipairs(hosts) do + if not datatypes.hostname(host) then + return nil, host .. " " .. translate("Not valid domain name, please re-enter!") + end + end + return value +end + +---- Proxy IP 2 +local proxy_ip2 = string.format("/usr/share/%s/rules/proxy_ip2", appname) +o = s:taboption("proxy_list2", TextValue, "blacklist_ip2", "", "" .. translate("These had been joined ip addresses will use proxy.Please input the ip address or ip address segment,every line can input only one ip address.For example: 35.24.0.0/24 or 8.8.4.4.") .. "") +o.rows = 15 +o.wrap = "off" +o.cfgvalue = function(self, section) return fs.readfile(proxy_ip2) or "" end +o.write = function(self, section, value) fs.writefile(proxy_ip2, value:gsub("\r\n", "\n")) end +o.remove = function(self, section, value) fs.writefile(proxy_ip2, "") end +o.validate = function(self, value) + local ipmasks= {} + string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, w) end) + for index, ipmask in ipairs(ipmasks) do + if not datatypes.ipmask4(ipmask) then + return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!") + end + end + return value +end + +---- Proxy Hosts 3 +local proxy_host3 = string.format("/usr/share/%s/rules/proxy_host3", appname) +o = s:taboption("proxy_list3", TextValue, "proxy_host3", "", "" .. translate("These had been joined websites will use proxy. Please input the domain names of websites,every line can input only one website domain. For example: google.com.") .. "") +o.rows = 15 +o.wrap = "off" +o.cfgvalue = function(self, section) return fs.readfile(proxy_host3) or "" end +o.write = function(self, section, value) fs.writefile(proxy_host3, value:gsub("\r\n", "\n")) end +o.remove = function(self, section, value) fs.writefile(proxy_host3, "") end +o.validate = function(self, value) + local hosts= {} + string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(hosts, w) end) + for index, host in ipairs(hosts) do + if not datatypes.hostname(host) then + return nil, host .. " " .. translate("Not valid domain name, please re-enter!") + end + end + return value +end + +---- Proxy IP 3 +local proxy_ip3 = string.format("/usr/share/%s/rules/proxy_ip3", appname) +o = s:taboption("proxy_list3", TextValue, "blacklist_ip3", "", "" .. translate("These had been joined ip addresses will use proxy.Please input the ip address or ip address segment,every line can input only one ip address.For example: 35.24.0.0/24 or 8.8.4.4.") .. "") +o.rows = 15 +o.wrap = "off" +o.cfgvalue = function(self, section) return fs.readfile(proxy_ip3) or "" end +o.write = function(self, section, value) fs.writefile(proxy_ip3, value:gsub("\r\n", "\n")) end +o.remove = function(self, section, value) fs.writefile(proxy_ip3, "") end +o.validate = function(self, value) + local ipmasks= {} + string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, w) end) + for index, ipmask in ipairs(ipmasks) do + if not datatypes.ipmask4(ipmask) then + return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!") + end + end + return value +end + return m diff --git a/package/lienol/luci-app-passwall/luasrc/view/passwall/log/log.htm b/package/lienol/luci-app-passwall/luasrc/view/passwall/log/log.htm index 8d1467aa33..c9af2f6554 100644 --- a/package/lienol/luci-app-passwall/luasrc/view/passwall/log/log.htm +++ b/package/lienol/luci-app-passwall/luasrc/view/passwall/log/log.htm @@ -11,7 +11,7 @@ } ); } - XHR.poll(30, '<%=url([[admin]], [[services]], [[passwall]], [[get_log]])%>', null, + XHR.poll(5, '<%=url([[admin]], [[services]], [[passwall]], [[get_log]])%>', null, function(x, data) { if(x && x.status == 200) { var log_textarea = document.getElementById('log_textarea'); diff --git a/package/lienol/luci-app-passwall/root/etc/config/passwall b/package/lienol/luci-app-passwall/root/etc/config/passwall index 460fc8d7d7..c96dc855ed 100644 --- a/package/lienol/luci-app-passwall/root/etc/config/passwall +++ b/package/lienol/luci-app-passwall/root/etc/config/passwall @@ -52,6 +52,7 @@ config global_app option trojan_go_file '/usr/bin/trojan-go' option kcptun_client_file '/usr/bin/kcptun-client' option brook_file '/usr/bin/brook' + option trojan_go_latest 'https://api.github.com/repos/peter-tank/trojan-go/releases/latest' config global_subscribe option subscribe_proxy '0' diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh index a11f348478..49fa473747 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh @@ -716,11 +716,15 @@ start_dns() { cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist" echolog " | - [$?](chinadns-ng) 域名白名单合并到中国域名表" cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt" + [ -f "${RULES_PATH}/proxy_host2" ] && cat "${RULES_PATH}/proxy_host2" >> "${TMP_PATH}/gfwlist.txt" + [ -f "${RULES_PATH}/proxy_host3" ] && cat "${RULES_PATH}/proxy_host3" >> "${TMP_PATH}/gfwlist.txt" echolog " | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表" gfwlist_param="${TMP_PATH}/gfwlist.txt" else echolog " | - (chinadns-ng) 白名单不与中国域名表合并" cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist" + [ -f "${RULES_PATH}/proxy_host2" ] && cat "${RULES_PATH}/proxy_host2" >> "${TMP_PATH}/chnlist" + [ -f "${RULES_PATH}/proxy_host3" ] && cat "${RULES_PATH}/proxy_host3" >> "${TMP_PATH}/chnlist" echolog " | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表" fi chnlist_param="${TMP_PATH}/chnlist" @@ -739,7 +743,7 @@ start_dns() { TUN_DNS="" ;; dns2socks) - echolog " - 域名解析 dns2socks..." + echolog " - 域名解析：dns2socks..." ;; https-dns-proxy) up_trust_doh_dns=$(config_t_get global up_trust_doh_dns "tcp") @@ -764,13 +768,14 @@ start_dns() { ;; udp) use_udp_node_resolve_dns=1 - msg="直接使用UDP节点请求DNS" + TUN_DNS=${DNS_FORWARD} + echolog " - 域名解析：直接使用UDP节点请求DNS（$TUN_DNS）" ;; custom) [ "$CHINADNS_NG" != "1" ] && { custom_dns=$(config_t_get global custom_dns) TUN_DNS="$(echo ${custom_dns} | sed 's/:/#/g')" - echolog " - 域名解析 直接使用UDP协议自定义DNS（$TUN_DNS）解析..." + echolog " - 域名解析：直接使用UDP协议自定义DNS（$TUN_DNS）解析..." } ;; esac @@ -808,8 +813,8 @@ start_dns() { echolog " - dns2sock(127.0.0.1:${dns_listen_port}${dns2sock_cache})，${dns2socks_socks_server:-127.0.0.1:9050} -> ${dns2socks_forward-D46.182.19.48:53}" #[ "$CHINADNS_NG" = "1" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS=$(echo "${dns_listen_port}" | sed 's/:/#/g') fi - [ "${use_udp_node_resolve_dns}" = "1" ] && echolog " * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发" - [ "${use_tcp_node_resolve_dns}" = "1" ] && echolog " * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发" + [ "${use_udp_node_resolve_dns}" = "1" ] && echolog " * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发！" + [ "${use_tcp_node_resolve_dns}" = "1" ] && echolog " * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发！" } add_dnsmasq() { @@ -836,7 +841,7 @@ add_dnsmasq() { #始终用国内DNS解析节点域名 fwd_dns="${LOCAL_DNS}" servers=$(uci show "${CONFIG}" | grep ".address=" | cut -d "'" -f 2) - hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/vpsiplist_host.conf" + hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/01-vpsiplist_host.conf" echolog " - [$?]节点列表中的域名(vpsiplist)：${fwd_dns:-默认}" #始终用国内DNS解析直连（白名单）列表 @@ -845,7 +850,7 @@ add_dnsmasq() { [ "$CHINADNS_NG" = "1" ] && unset fwd_dns #如果没使用chnlist直接使用默认DNS [ "${USE_CHNLIST}" = "0" ] && unset fwd_dns - sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf" + sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/00-direct_host.conf" echolog " - [$?]域名白名单(whitelist)：${fwd_dns:-默认}" #当勾选使用chnlist，仅当使用大陆白名单或回国模式 @@ -868,7 +873,9 @@ add_dnsmasq() { [ "$CHINADNS_NG" = "1" ] && unset fwd_dns #如果使用chnlist直接使用默认DNS [ "${USE_CHNLIST}" = "1" ] && unset fwd_dns - sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/proxy_host.conf" + sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/12-proxy_host.conf" + [ "2" -le "$TCP_NODE_NUM" ] && sort -u "${RULES_PATH}/proxy_host2" | gen_dnsmasq_items "blacklist2" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/11-proxy_host2.conf" + [ "3" -le "$TCP_NODE_NUM" ] && sort -u "${RULES_PATH}/proxy_host3" | gen_dnsmasq_items "blacklist3" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/10-proxy_host3.conf" echolog " - [$?]代理域名表(blacklist)：${fwd_dns:-默认}" #如果没有使用回国模式 diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh index bc4b87438a..d03f8d6f30 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -7,6 +7,8 @@ IPSET_GFW="gfwlist" IPSET_CHN="chnroute" IPSET_CHN6="chnroute6" IPSET_BLACKLIST="blacklist" +IPSET_BLACKLIST2="blacklist2" +IPSET_BLACKLIST3="blacklist3" IPSET_WHITELIST="whitelist" FORCE_INDEX=2 @@ -130,8 +132,8 @@ load_acl() { udp_redir_ports=${udp_redir_ports:-default} [ "$tcp_proxy_mode" = "default" ] && tcp_proxy_mode=$TCP_PROXY_MODE [ "$udp_proxy_mode" = "default" ] && udp_proxy_mode=$UDP_PROXY_MODE - [ "$TCP_NODE_NUM" == "1" ] && tcp_node=1 - [ "$UDP_NODE_NUM" == "1" ] && udp_node=1 + [ "$tcp_node" -gt "$TCP_NODE_NUM" ] && tcp_node=1 + [ "$udp_node" -gt "$UDP_NODE_NUM" ] && udp_node=1 [ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS [ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS [ "$tcp_redir_ports" = "default" ] && tcp_redir_ports=$TCP_REDIR_PORTS @@ -191,33 +193,93 @@ load_acl() { local ipt_tmp=$ipt_n local is_tproxy msg unset is_tproxy msg - [ "$TCP_NODE1" != "nil" ] && [ "$TCP_PROXY_MODE" != "disable" ] && { - local TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z') - [ "$TCP_NODE1_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE1 protocol client)" == "client" ] && is_tproxy=1 - #[ "$TCP_NODE1_TYPE" == "trojan-go" ] && is_tproxy=1 - msg="TCP默认代理：使用TCP节点1 [$(get_action_chain_name $TCP_PROXY_MODE)]" - if [ -n "$is_tproxy" ]; then - ipt_tmp=$ipt_m && is_tproxy="TPROXY" - msg="${msg}(TPROXY:${TCP_REDIR_PORT1})代理" - else - msg="${msg}(REDIRECT:${TCP_REDIR_PORT1})代理" - fi - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN && msg="除${TCP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" - $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy) - $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy) - echolog "${msg}" - } - $ipt_tmp -A PSW $(comment "默认") -p tcp -j RETURN + + if [ "$TCP_PROXY_MODE" != "disable" ]; then + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + ipt_tmp=$ipt_n + unset is_tproxy msg + [ "3" -le "$TCP_NODE_NUM" ] && [ "$TCP_NODE3" != "nil" ] && { + local TCP_NODE3_TYPE=$(echo $(config_n_get $TCP_NODE3 type) | tr 'A-Z' 'a-z') + [ "$TCP_NODE3_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE3 protocol client)" == "client" ] && is_tproxy=1 + #[ "$TCP_NODE3_TYPE" == "trojan-go" ] && is_tproxy=1 + msg="TCP代理列表3：使用TCP节点3" + if [ -n "$is_tproxy" ]; then + ipt_tmp=$ipt_m && is_tproxy="TPROXY" + msg="${msg}(TPROXY:${TCP_REDIR_PORT3})代理" + else + msg="${msg}(REDIRECT:${TCP_REDIR_PORT3})代理" + fi + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_tmp -A PSW $(comment "列表3") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST3) $(REDIRECT $TCP_REDIR_PORT3 $is_tproxy) + echolog "${msg}" + } + ipt_tmp=$ipt_n + unset is_tproxy msg + [ "2" -le "$TCP_NODE_NUM" ] && [ "$TCP_NODE2" != "nil" ] && { + local TCP_NODE2_TYPE=$(echo $(config_n_get $TCP_NODE2 type) | tr 'A-Z' 'a-z') + [ "$TCP_NODE2_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE2 protocol client)" == "client" ] && is_tproxy=1 + #[ "$TCP_NODE2_TYPE" == "trojan-go" ] && is_tproxy=1 + msg="TCP代理列表2：使用TCP节点2" + if [ -n "$is_tproxy" ]; then + ipt_tmp=$ipt_m && is_tproxy="TPROXY" + msg="${msg}(TPROXY:${TCP_REDIR_PORT2})代理" + else + msg="${msg}(REDIRECT:${TCP_REDIR_PORT2})代理" + fi + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_tmp -A PSW $(comment "列表2") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST2) $(REDIRECT $TCP_REDIR_PORT2 $is_tproxy) + echolog "${msg}" + } + ipt_tmp=$ipt_n + unset is_tproxy msg + [ "$TCP_NODE1" != "nil" ] && { + local TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z') + [ "$TCP_NODE1_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE1 protocol client)" == "client" ] && is_tproxy=1 + #[ "$TCP_NODE1_TYPE" == "trojan-go" ] && is_tproxy=1 + msg="TCP默认代理：使用TCP节点1 [$(get_action_chain_name $TCP_PROXY_MODE)]" + if [ -n "$is_tproxy" ]; then + ipt_tmp=$ipt_m && is_tproxy="TPROXY" + msg="${msg}(TPROXY:${TCP_REDIR_PORT1})代理" + else + msg="${msg}(REDIRECT:${TCP_REDIR_PORT1})代理" + fi + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy) + $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy) + echolog "${msg}" + } + fi + $ipt_n -A PSW $(comment "默认") -p tcp -j RETURN + $ipt_m -A PSW $(comment "默认") -p tcp -j RETURN # 加载UDP默认代理模式 - if [ "$UDP_NODE1" != "nil" ] && [ "$UDP_PROXY_MODE" != "disable" ]; then - msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理" - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN && msg="除${TCP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" - $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY) - $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY) - echolog "${msg}" + if [ "$UDP_PROXY_MODE" != "disable" ]; then + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN + [ "3" -le "$UDP_NODE_NUM" ] && [ "$UDP_NODE3" != "nil" ] && { + msg="UDP代理列表3：使用UDP节点3 (TPROXY:${UDP_REDIR_PORT3})代理" + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_m -A PSW $(comment "列表3") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST3) $(REDIRECT $UDP_REDIR_PORT3 TPROXY) + echolog "${msg}" + } + [ "2" -le "$UDP_NODE_NUM" ] && [ "$UDP_NODE2" != "nil" ] && { + msg="UDP代理列表2：使用UDP节点2 (TPROXY:${UDP_REDIR_PORT2})代理" + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_m -A PSW $(comment "列表2") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST2) $(REDIRECT $UDP_REDIR_PORT2 TPROXY) + echolog "${msg}" + } + [ "$UDP_NODE1" != "nil" ] && { + msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理" + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" + msg="${msg}所有端口" + $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY) + $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY) + echolog "${msg}" + } fi $ipt_m -A PSW $(comment "默认") -p udp -j RETURN } @@ -339,11 +401,15 @@ add_firewall_rule() { ipset -! create $IPSET_CHN nethash ipset -! create $IPSET_CHN6 nethash family inet6 ipset -! create $IPSET_BLACKLIST nethash + ipset -! create $IPSET_BLACKLIST2 nethash + ipset -! create $IPSET_BLACKLIST3 nethash ipset -! create $IPSET_WHITELIST nethash cat $RULES_PATH/chnroute | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R cat $RULES_PATH/chnroute6 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R cat $RULES_PATH/proxy_ip | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + [ -f "$RULES_PATH/proxy_ip2" ] && cat $RULES_PATH/proxy_ip2 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST2 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + [ -f "$RULES_PATH/proxy_ip3" ] && cat $RULES_PATH/proxy_ip3 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST3 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R cat $RULES_PATH/direct_ip | sed -e "/^$/d" | sed -e "s/^/add $IPSET_WHITELIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R ipset -! -R <<-EOF @@ -586,6 +652,8 @@ del_firewall_rule() { #ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 & #ipset -F $IPSET_CHN6 >/dev/null 2>&1 && ipset -X $IPSET_CHN6 >/dev/null 2>&1 & #ipset -F $IPSET_BLACKLIST >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST >/dev/null 2>&1 & + #ipset -F $IPSET_BLACKLIST2 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST2 >/dev/null 2>&1 & + #ipset -F $IPSET_BLACKLIST3 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST3 >/dev/null 2>&1 & ipset -F $IPSET_WHITELIST >/dev/null 2>&1 && ipset -X $IPSET_WHITELIST >/dev/null 2>&1 & #echolog "删除相关防火墙规则完成。" } @@ -598,6 +666,8 @@ flush_ipset() { ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 & ipset -F $IPSET_CHN6 >/dev/null 2>&1 && ipset -X $IPSET_CHN6 >/dev/null 2>&1 & ipset -F $IPSET_BLACKLIST >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST >/dev/null 2>&1 & + ipset -F $IPSET_BLACKLIST2 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST2 >/dev/null 2>&1 & + ipset -F $IPSET_BLACKLIST3 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST3 >/dev/null 2>&1 & ipset -F $IPSET_WHITELIST >/dev/null 2>&1 && ipset -X $IPSET_WHITELIST >/dev/null 2>&1 & }