From d2f5fd15be7aaa51d482db3b89165818cebaa73c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 6 Mar 2024 05:32:52 +0800 Subject: [PATCH] update 2024-03-06 05:32:52 --- gn/Makefile | 17 +- gn/src/out/last_commit_position.h | 4 +- luci-app-passwall/Makefile | 2 +- .../model/cbi/passwall/client/acl_config.lua | 38 ++-- .../model/cbi/passwall/client/global.lua | 28 +-- .../model/cbi/passwall/client/other.lua | 2 +- .../luasrc/view/passwall/global/proxy.htm | 6 - luci-app-passwall/po/zh-cn/passwall.po | 22 +- .../root/usr/share/passwall/0_default_config | 4 +- .../root/usr/share/passwall/app.sh | 35 ++- .../root/usr/share/passwall/iptables.sh | 214 ++++++++++-------- .../root/usr/share/passwall/nftables.sh | 204 +++++++++-------- redsocks2/Makefile | 10 +- 13 files changed, 294 insertions(+), 292 deletions(-) diff --git a/gn/Makefile b/gn/Makefile index b62abd3f7..13c98f089 100644 --- a/gn/Makefile +++ b/gn/Makefile @@ -9,9 +9,9 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://gn.googlesource.com/gn.git -PKG_SOURCE_DATE:=2024-01-24 -PKG_SOURCE_VERSION:=a2e2717ea670249a34b0de4b3e54f268d320bdfa -PKG_MIRROR_HASH:=13d4b2ac0ca78cedf25ca9919c2969eb37c36b6dd5e8e6e8cd114441500daa76 +PKG_SOURCE_DATE:=2024-02-20 +PKG_SOURCE_VERSION:=03d10f1657b4ddace618c34ab61b6357d1ae9c9a +PKG_MIRROR_HASH:=424f80efe89652aa226f8432f36166ab89c2cde5ad6b6f37a1f4224ce7bf560f PKG_LICENSE:=BSD 3-Clause PKG_LICENSE_FILES:=LICENSE @@ -20,17 +20,6 @@ PKG_MAINTAINER:=Tianling Shen PKG_HOST_ONLY:=1 HOST_BUILD_PARALLEL:=1 -ifeq ($(strip $(NINJA)),) -ifneq ($(wildcard $(TOPDIR)/feeds/packages/devel/ninja/ninja.mk),) -HOST_BUILD_DEPENDS:=ninja/host -NINJA = \ - MAKEFLAGS="$(MAKE_JOBSERVER)" \ - $(STAGING_DIR_HOSTPKG)/bin/ninja \ - $(if $(findstring c,$(OPENWRT_VERBOSE)),-v) \ - $(if $(MAKE_JOBSERVER),,-j1) -endif -endif - include $(INCLUDE_DIR)/host-build.mk include $(INCLUDE_DIR)/package.mk diff --git a/gn/src/out/last_commit_position.h b/gn/src/out/last_commit_position.h index 5f82253b9..e7cb30eb6 100644 --- a/gn/src/out/last_commit_position.h +++ b/gn/src/out/last_commit_position.h @@ -3,7 +3,7 @@ #ifndef OUT_LAST_COMMIT_POSITION_H_ #define OUT_LAST_COMMIT_POSITION_H_ -#define LAST_COMMIT_POSITION_NUM 2143 -#define LAST_COMMIT_POSITION "2143 (a2e2717ea670)" +#define LAST_COMMIT_POSITION_NUM 2152 +#define LAST_COMMIT_POSITION "2152 (03d10f1657b4)" #endif // OUT_LAST_COMMIT_POSITION_H_ diff --git a/luci-app-passwall/Makefile b/luci-app-passwall/Makefile index cdf1283ac..8fa07e5ed 100644 --- a/luci-app-passwall/Makefile +++ b/luci-app-passwall/Makefile @@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall -PKG_VERSION:=4.75-5 +PKG_VERSION:=4.75-6 PKG_RELEASE:= PKG_CONFIG_DEPENDS:= \ diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua index 55e21430c..8b1fe829c 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua @@ -141,6 +141,24 @@ sources.validate = function(self, value, t) end sources.write = dynamicList_write +---- TCP No Redir Ports +local TCP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_no_redir_ports") +o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports")) +o.default = "default" +o:value("disable", translate("No patterns are used")) +o:value("default", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")") +o:value("1:65535", translate("All")) +o.validate = port_validate + +---- UDP No Redir Ports +local UDP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "udp_no_redir_ports") +o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports")) +o.default = "default" +o:value("disable", translate("No patterns are used")) +o:value("default", translate("Use global config") .. "(" .. UDP_NO_REDIR_PORTS .. ")") +o:value("1:65535", translate("All")) +o.validate = port_validate + --local TCP_NODE = uci:get(appname, "@global[0]", "tcp_node") tcp_node = s:option(ListValue, "tcp_node", "" .. translate("TCP Node") .. "") tcp_node.default = "nil" @@ -159,26 +177,6 @@ for k, v in pairs(nodes_table) do udp_node:value(v.id, v["remark"]) end ----- TCP No Redir Ports -local TCP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_no_redir_ports") -o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports")) -o.default = "default" -o:value("disable", translate("No patterns are used")) -o:value("default", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")") -o:value("1:65535", translate("All")) -o.validate = port_validate -o:depends({ tcp_node = "nil", ['!reverse'] = true }) - ----- UDP No Redir Ports -local UDP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "udp_no_redir_ports") -o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports")) -o.default = "default" -o:value("disable", translate("No patterns are used")) -o:value("default", translate("Use global config") .. "(" .. UDP_NO_REDIR_PORTS .. ")") -o:value("1:65535", translate("All")) -o.validate = port_validate -o:depends({ udp_node = "nil", ['!reverse'] = true }) - ---- TCP Proxy Drop Ports local TCP_PROXY_DROP_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_proxy_drop_ports") o = s:option(Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports")) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua index 6be4aa438..3b4b82876 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua @@ -444,26 +444,20 @@ udp_proxy_mode:value("disable", translate("No Proxy")) udp_proxy_mode:value("proxy", translate("Proxy")) udp_proxy_mode.default = "proxy" ----- Localhost TCP Proxy Mode -localhost_tcp_proxy_mode = s:taboption("Proxy", ListValue, "localhost_tcp_proxy_mode", translate("Router Localhost") .. " TCP " .. translate("Proxy Mode")) -localhost_tcp_proxy_mode:value("default", translatef("Same as the %s default proxy mode", "TCP")) -localhost_tcp_proxy_mode:value("disable", translate("No Proxy")) -localhost_tcp_proxy_mode:value("proxy", translate("Proxy")) -localhost_tcp_proxy_mode.default = "default" - ----- Localhost UDP Proxy Mode -localhost_udp_proxy_mode = s:taboption("Proxy", ListValue, "localhost_udp_proxy_mode", translate("Router Localhost") .. " UDP " .. translate("Proxy Mode")) -localhost_udp_proxy_mode:value("default", translatef("Same as the %s default proxy mode", "UDP")) -localhost_udp_proxy_mode:value("disable", translate("No Proxy")) -localhost_udp_proxy_mode:value("proxy", translate("Proxy")) -localhost_udp_proxy_mode.default = "default" - o = s:taboption("Proxy", DummyValue, "", " ") o.template = appname .. "/global/proxy" -tips = s:taboption("Proxy", DummyValue, "tips", " ") -tips.rawhtml = true -tips.cfgvalue = function(t, n) +o = s:taboption("Proxy", Flag, "localhost_proxy", translate("Localhost Proxy"), translate("When selected, localhost can transparent proxy.")) +o.default = "1" +o.rmempty = false + +o = s:taboption("Proxy", Flag, "client_proxy", translate("Client Proxy"), translate("When selected, devices in LAN can transparent proxy. Otherwise, it will not be proxy.")) +o.default = "1" +o.rmempty = false + +o = s:taboption("Proxy", DummyValue, "_proxy_tips", " ") +o.rawhtml = true +o.cfgvalue = function(t, n) return string.format('%s', api.url("acl"), translate("Want different devices to use different proxy modes/ports/nodes? Please use access control.")) end diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua index 4ebbf57ef..f14cf7110 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua @@ -159,7 +159,7 @@ if has_xray then o = s_xray:option(Flag, "fragment", translate("Fragment"), translate("TCP fragments, which can deceive the censorship system in some cases, such as bypassing SNI blacklists.")) o.default = 0 - o = s_xray:option(ListValue, "fragment_packets", translate("Fragment Packets"), translate(" \"1-3\" is for segmentation at TCP layer, applying to the beginning 1 to 3 data writes by the client. \"tlshello\" is for TLS client hello packet fragmentation.")) + o = s_xray:option(ListValue, "fragment_packets", translate("Fragment Packets"), translate("\"1-3\" is for segmentation at TCP layer, applying to the beginning 1 to 3 data writes by the client. \"tlshello\" is for TLS client hello packet fragmentation.")) o.default = "tlshello" o:value("1-3", "1-3") o:value("tlshello", "tlshello") diff --git a/luci-app-passwall/luasrc/view/passwall/global/proxy.htm b/luci-app-passwall/luasrc/view/passwall/global/proxy.htm index 4e05f3336..ccdcc3dd0 100644 --- a/luci-app-passwall/luasrc/view/passwall/global/proxy.htm +++ b/luci-app-passwall/luasrc/view/passwall/global/proxy.htm @@ -84,8 +84,6 @@ opt.set("chn_list", "0"); opt.set("tcp_proxy_mode", "disable"); opt.set("udp_proxy_mode", "disable"); - opt.set("localhost_tcp_proxy_mode", "default"); - opt.set("localhost_udp_proxy_mode", "default"); } function switch_chnroute_mode() { @@ -93,8 +91,6 @@ opt.set("chn_list", "direct"); opt.set("tcp_proxy_mode", "proxy"); opt.set("udp_proxy_mode", "proxy"); - opt.set("localhost_tcp_proxy_mode", "default"); - opt.set("localhost_udp_proxy_mode", "default"); } function switch_returnhome_mode() { @@ -102,7 +98,5 @@ opt.set("chn_list", "proxy"); opt.set("tcp_proxy_mode", "disable"); opt.set("udp_proxy_mode", "disable"); - opt.set("localhost_tcp_proxy_mode", "default"); - opt.set("localhost_udp_proxy_mode", "default"); } diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po index fe2be6c9a..fbb56cda7 100644 --- a/luci-app-passwall/po/zh-cn/passwall.po +++ b/luci-app-passwall/po/zh-cn/passwall.po @@ -283,15 +283,21 @@ msgstr "中国列表" msgid "Localhost" msgstr "本机" -msgid "Router Localhost" -msgstr "路由器本机" - -msgid "Same as the %s default proxy mode" -msgstr "与 %s 默认代理模式相同" - msgid "Switch Mode" msgstr "切换模式" +msgid "Localhost Proxy" +msgstr "路由器本机代理" + +msgid "When selected, localhost can transparent proxy." +msgstr "当勾选时，路由器本机可以透明代理。" + +msgid "Client Proxy" +msgstr "客户端代理" + +msgid "When selected, devices in LAN can transparent proxy. Otherwise, it will not be proxy." +msgstr "当勾选时，局域网内的设备可以透明代理。否则，将不代理。" + msgid "Want different devices to use different proxy modes/ports/nodes? Please use access control." msgstr "希望不同设备使用不同的代理模式/端口/节点？请使用访问控制。" @@ -1561,8 +1567,8 @@ msgstr "TCP 分片，在某些情况下可以欺骗审查系统，比如绕过 S msgid "Fragment Packets" msgstr "分片方式" -msgid " \"1-3\" is for segmentation at TCP layer, applying to the beginning 1 to 3 data writes by the client. \"tlshello\" is for TLS client hello packet fragmentation." -msgstr " \"1-3\" 是 TCP 的流切片，应用于客户端第 1 至第 3 次写数据。\"tlshello\" 是 TLS 握手包切片。" +msgid "\"1-3\" is for segmentation at TCP layer, applying to the beginning 1 to 3 data writes by the client. \"tlshello\" is for TLS client hello packet fragmentation." +msgstr "\"1-3\" 是 TCP 的流切片，应用于客户端第 1 至第 3 次写数据。\"tlshello\" 是 TLS 握手包切片。" msgid "Fragment Length" msgstr "分片包长" diff --git a/luci-app-passwall/root/usr/share/passwall/0_default_config b/luci-app-passwall/root/usr/share/passwall/0_default_config index b9b7dd073..13ea9855d 100644 --- a/luci-app-passwall/root/usr/share/passwall/0_default_config +++ b/luci-app-passwall/root/usr/share/passwall/0_default_config @@ -16,8 +16,8 @@ config global option chn_list 'direct' option tcp_proxy_mode 'proxy' option udp_proxy_mode 'proxy' - option localhost_tcp_proxy_mode 'default' - option localhost_udp_proxy_mode 'default' + option localhost_proxy '1' + option client_proxy '1' option acl_enable '0' option close_log_tcp '0' option close_log_udp '0' diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh index 46e261748..ff6e02e57 100755 --- a/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/luci-app-passwall/root/usr/share/passwall/app.sh @@ -1273,19 +1273,17 @@ start_dns() { USE_DEFAULT_DNS="chinadns_ng" } - [ "$DNS_SHUNT" = "dnsmasq" ] && { - [ "$USE_DEFAULT_DNS" = "remote" ] && { - dnsmasq_version=$(dnsmasq -v | grep -i "Dnsmasq version " | awk '{print $3}') - [ "$(expr $dnsmasq_version \>= 2.87)" == 0 ] && echolog "Dnsmasq版本低于2.87，有可能无法正常使用！！！" - } - source $APP_PATH/helper_dnsmasq.sh stretch - lua $APP_PATH/helper_dnsmasq_add.lua -FLAG "default" -TMP_DNSMASQ_PATH ${TMP_DNSMASQ_PATH} \ - -DNSMASQ_CONF_FILE "/tmp/dnsmasq.d/dnsmasq-passwall.conf" -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS ${LOCAL_DNS} \ - -TUN_DNS ${TUN_DNS} -REMOTE_FAKEDNS ${fakedns:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \ - -USE_DIRECT_LIST "${USE_DIRECT_LIST}" -USE_PROXY_LIST "${USE_PROXY_LIST}" -USE_BLOCK_LIST "${USE_BLOCK_LIST}" -USE_GFW_LIST "${USE_GFW_LIST}" -CHN_LIST "${CHN_LIST}" \ - -TCP_NODE ${TCP_NODE} -DEFAULT_PROXY_MODE "${TCP_PROXY_MODE}" -NO_PROXY_IPV6 ${FILTER_PROXY_IPV6:-0} -NFTFLAG ${nftflag:-0} \ - -NO_LOGIC_LOG ${NO_LOGIC_LOG:-0} + [ "$USE_DEFAULT_DNS" = "remote" ] && { + dnsmasq_version=$(dnsmasq -v | grep -i "Dnsmasq version " | awk '{print $3}') + [ "$(expr $dnsmasq_version \>= 2.87)" == 0 ] && echolog "Dnsmasq版本低于2.87，有可能无法正常使用！！！" } + source $APP_PATH/helper_dnsmasq.sh stretch + lua $APP_PATH/helper_dnsmasq_add.lua -FLAG "default" -TMP_DNSMASQ_PATH ${TMP_DNSMASQ_PATH} \ + -DNSMASQ_CONF_FILE "/tmp/dnsmasq.d/dnsmasq-passwall.conf" -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS ${LOCAL_DNS} \ + -TUN_DNS ${TUN_DNS} -REMOTE_FAKEDNS ${fakedns:-0} -USE_DEFAULT_DNS "${USE_DEFAULT_DNS:-direct}" -CHINADNS_DNS ${china_ng_listen:-0} \ + -USE_DIRECT_LIST "${USE_DIRECT_LIST}" -USE_PROXY_LIST "${USE_PROXY_LIST}" -USE_BLOCK_LIST "${USE_BLOCK_LIST}" -USE_GFW_LIST "${USE_GFW_LIST}" -CHN_LIST "${CHN_LIST}" \ + -TCP_NODE ${TCP_NODE} -DEFAULT_PROXY_MODE "${TCP_PROXY_MODE}" -NO_PROXY_IPV6 ${FILTER_PROXY_IPV6:-0} -NFTFLAG ${nftflag:-0} \ + -NO_LOGIC_LOG ${NO_LOGIC_LOG:-0} } add_ip2route() { @@ -1680,13 +1678,12 @@ TCP_PROXY_MODE=$(config_t_get global tcp_proxy_mode proxy) UDP_PROXY_MODE=$(config_t_get global udp_proxy_mode proxy) [ "${TCP_PROXY_MODE}" != "disable" ] && TCP_PROXY_MODE="proxy" [ "${UDP_PROXY_MODE}" != "disable" ] && UDP_PROXY_MODE="proxy" -LOCALHOST_TCP_PROXY_MODE=$(config_t_get global localhost_tcp_proxy_mode default) -LOCALHOST_UDP_PROXY_MODE=$(config_t_get global localhost_udp_proxy_mode default) -[ "${LOCALHOST_TCP_PROXY_MODE}" == "default" ] && LOCALHOST_TCP_PROXY_MODE=$TCP_PROXY_MODE -[ "${LOCALHOST_UDP_PROXY_MODE}" == "default" ] && LOCALHOST_UDP_PROXY_MODE=$UDP_PROXY_MODE -[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && LOCALHOST_TCP_PROXY_MODE="proxy" -[ "${LOCALHOST_UDP_PROXY_MODE}" != "disable" ] && LOCALHOST_UDP_PROXY_MODE="proxy" -DNS_SHUNT="dnsmasq" +LOCALHOST_PROXY=$(config_t_get global localhost_proxy 1) +[ "${LOCALHOST_PROXY}" == 1 ] && { + LOCALHOST_TCP_PROXY_MODE=$TCP_PROXY_MODE + LOCALHOST_UDP_PROXY_MODE=$UDP_PROXY_MODE +} +CLIENT_PROXY=$(config_t_get global client_proxy 1) DNS_MODE=$(config_t_get global dns_mode dns2tcp) DNS_CACHE=$(config_t_get global dns_cache 0) REMOTE_DNS=$(config_t_get global remote_dns 1.1.1.1:53 | sed 's/#/:/g' | sed -E 's/\:([^:]+)$/#\1/g') diff --git a/luci-app-passwall/root/usr/share/passwall/iptables.sh b/luci-app-passwall/root/usr/share/passwall/iptables.sh index 06aae44ca..bcc1e4b9c 100755 --- a/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -132,17 +132,6 @@ REDIRECT() { echo $s } -get_action_chain_name() { - case "$1" in - disable) - echo "不代理" - ;; - proxy) - echo "代理" - ;; - esac -} - get_jump_ipt() { case "$1" in direct) @@ -251,23 +240,50 @@ load_acl() { ipt_tmp=$ipt_n [ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m - [ "${use_direct_list}" = "1" ] && $ipt_n -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST) -j RETURN - [ "${use_direct_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST) -j RETURN - [ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCKLIST) -j DROP - [ "$PROXY_IPV6" == "1" ] && { - [ "${use_direct_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST6) -j RETURN 2>/dev/null - [ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCKLIST6) -j DROP 2>/dev/null + + [ "$tcp_no_redir_ports" != "disable" ] && { + if [ "$tcp_no_redir_ports" != "1:65535" ]; then + #结束时return，无需多余的规则。 + $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN 2>/dev/null + $ipt_tmp -A PSW $(comment "$remarks") ${_ipt_source} -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN + echolog " - ${msg}不代理TCP端口[${tcp_no_redir_ports}]" + else + unset tcp_port + echolog " - ${msg}不代理所有TCP端口" + fi + } + + [ "$udp_no_redir_ports" != "disable" ] && { + if [ "$udp_no_redir_ports" != "1:65535" ]; then + #结束时return，无需多余的规则。 + $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -p udp -m multiport --dport $udp_no_redir_ports -j RETURN 2>/dev/null + $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} -p udp -m multiport --dport $udp_no_redir_ports -j RETURN + echolog " - ${msg}不代理UDP端口[${udp_no_redir_ports}]" + else + unset udp_port + echolog " - ${msg}不代理所有UDP端口" + fi + } + + [ -n "$tcp_port" -o -n "$udp_port" ] && { + [ "${use_direct_list}" = "1" ] && $ipt_n -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST) -j RETURN + [ "${use_direct_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST) -j RETURN + [ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCKLIST) -j DROP + [ "$PROXY_IPV6" == "1" ] && { + [ "${use_direct_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITELIST6) -j RETURN 2>/dev/null + [ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCKLIST6) -j DROP 2>/dev/null + } } [ -n "$tcp_port" ] && { if [ -n "${tcp_proxy_mode}" ]; then [ -s "${TMP_ACL_PATH}/${sid}/var_redirect_dns_port" ] && $ipt_n -A PSW_REDIRECT $(comment "$remarks") -p udp ${_ipt_source} --dport 53 -j REDIRECT --to-ports $(cat ${TMP_ACL_PATH}/${sid}/var_redirect_dns_port) - msg2="${msg}使用TCP节点[$tcp_node_remark] [$(get_action_chain_name $tcp_proxy_mode)]" + msg2="${msg}使用TCP节点[$tcp_node_remark]" if [ -n "${is_tproxy}" ]; then - msg2="${msg2}(TPROXY:${tcp_port})代理" + msg2="${msg2}(TPROXY:${tcp_port})" ipt_tmp=$ipt_m else - msg2="${msg2}(REDIRECT:${tcp_port})代理" + msg2="${msg2}(REDIRECT:${tcp_port})" fi [ "$accept_icmp" = "1" ] && { @@ -287,13 +303,6 @@ load_acl() { [ "${tcp_proxy_mode}" != "disable" ] && $ip6t_n -A PSW $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(REDIRECT) 2>/dev/null } - [ "$tcp_no_redir_ports" != "disable" ] && { - $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN 2>/dev/null - $ipt_tmp -A PSW $(comment "$remarks") ${_ipt_source} -p tcp -m multiport --dport $tcp_no_redir_ports -j RETURN - msg2="${msg2}[$?]除${tcp_no_redir_ports}外的" - } - msg2="${msg2}所有端口" - [ "$tcp_proxy_drop_ports" != "disable" ] && { [ "$PROXY_IPV6" == "1" ] && { $ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "-m multiport --dport") $(dst $IPSET_SHUNTLIST6) -j DROP 2>/dev/null @@ -363,14 +372,8 @@ load_acl() { [ -n "$udp_port" ] && { if [ -n "${udp_proxy_mode}" ]; then - msg2="${msg}使用UDP节点[$udp_node_remark] [$(get_action_chain_name $udp_proxy_mode)]" - msg2="${msg2}(TPROXY:${udp_port})代理" - [ "$udp_no_redir_ports" != "disable" ] && { - $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -p udp -m multiport --dport $udp_no_redir_ports -j RETURN 2>/dev/null - $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} -p udp -m multiport --dport $udp_no_redir_ports -j RETURN - msg2="${msg2}[$?]除${udp_no_redir_ports}外的" - } - msg2="${msg2}所有端口" + msg2="${msg}使用UDP节点[$udp_node_remark]" + msg2="${msg2}(TPROXY:${udp_port})" $ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW_RULE $ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") $(dst $IPSET_SHUNTLIST) -j PSW_RULE @@ -402,14 +405,42 @@ load_acl() { done } - [ "$ENABLED_DEFAULT_ACL" == 1 ] && { - [ "${USE_DIRECT_LIST}" = "1" ] && $ipt_n -A PSW $(comment "默认") $(dst $IPSET_WHITELIST) -j RETURN - [ "${USE_DIRECT_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_WHITELIST) -j RETURN - [ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCKLIST) -j DROP - [ "$PROXY_IPV6" == "1" ] && { - [ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_WHITELIST6) -j RETURN 2>/dev/null - [ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCKLIST6) -j DROP 2>/dev/null + [ "$ENABLED_DEFAULT_ACL" == 1 ] && [ "$CLIENT_PROXY" == 1 ] && { + local ipt_tmp=$ipt_n + [ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m + + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { + $ip6t_m -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + if [ "$TCP_NO_REDIR_PORTS" != "1:65535" ]; then + echolog "TCP默认代理：不代理TCP端口[${TCP_NO_REDIR_PORTS}]" + else + unset TCP_PROXY_MODE + echolog "TCP默认代理：不代理所有TCP端口" + fi } + + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { + $ip6t_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN + $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN + if [ "$UDP_NO_REDIR_PORTS" != "1:65535" ]; then + echolog "UDP默认代理：不代理UDP端口[${UDP_NO_REDIR_PORTS}]" + else + unset UDP_PROXY_MODE + echolog "UDP默认代理：不代理所有UDP端口" + fi + } + + [ -n "${TCP_PROXY_MODE}" -o -n "${UDP_PROXY_MODE}" ] && { + [ "${USE_DIRECT_LIST}" = "1" ] && $ipt_n -A PSW $(comment "默认") $(dst $IPSET_WHITELIST) -j RETURN + [ "${USE_DIRECT_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_WHITELIST) -j RETURN + [ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCKLIST) -j DROP + [ "$PROXY_IPV6" == "1" ] && { + [ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_WHITELIST6) -j RETURN 2>/dev/null + [ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCKLIST6) -j DROP 2>/dev/null + } + } + # 加载TCP默认代理模式 [ "$TCP_PROXY_DROP_PORTS" != "disable" ] && { [ "$PROXY_IPV6" == "1" ] && { @@ -428,23 +459,14 @@ load_acl() { } if [ -n "${TCP_PROXY_MODE}" ]; then - local ipt_tmp=$ipt_n - [ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { - $ip6t_m -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - } [ "$TCP_NODE" != "nil" ] && { - msg="TCP默认代理：使用TCP节点[$(config_n_get $TCP_NODE remarks)] [$(get_action_chain_name $TCP_PROXY_MODE)]" + msg="TCP默认代理：使用TCP节点[$(config_n_get $TCP_NODE remarks)]" if [ -n "${is_tproxy}" ]; then - msg="${msg}(TPROXY:${TCP_REDIR_PORT})代理" + msg="${msg}(TPROXY:${TCP_REDIR_PORT})" else - msg="${msg}(REDIRECT:${TCP_REDIR_PORT})代理" + msg="${msg}(REDIRECT:${TCP_REDIR_PORT})" fi - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" - [ "$accept_icmp" = "1" ] && { $ipt_n -A PSW $(comment "默认") -p icmp -d $FAKE_IP $(REDIRECT) $ipt_n -A PSW $(comment "默认") -p icmp $(dst $IPSET_SHUNTLIST) $(REDIRECT) @@ -512,17 +534,9 @@ load_acl() { [ "${UDP_PROXY_MODE}" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_PROXY_DROP_PORTS "-m multiport --dport") -j DROP } if [ -n "${UDP_PROXY_MODE}" ]; then - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { - $ip6t_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN - $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN - } - [ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ] && { [ "$TCP_UDP" = "1" ] && [ "$UDP_NODE" = "nil" ] && UDP_NODE=$TCP_NODE - msg="UDP默认代理：使用UDP节点[$(config_n_get $UDP_NODE remarks)] [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT})代理" - - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${UDP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" + msg="UDP默认代理：使用UDP节点[$(config_n_get $UDP_NODE remarks)](TPROXY:${UDP_REDIR_PORT})" $ipt_m -A PSW $(comment "默认") -p udp -d $FAKE_IP -j PSW_RULE $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) -j PSW_RULE @@ -908,36 +922,26 @@ add_firewall_rule() { filter_node $node $stream $port > /dev/null 2>&1 & fi done + + local ipt_tmp=$ipt_n + [ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m + + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { + $ipt_tmp -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + $ip6t_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN + [ "$TCP_NO_REDIR_PORTS" == "1:65535" ] && unset LOCALHOST_TCP_PROXY_MODE + } + + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { + $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN + $ip6t_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN + [ "$UDP_NO_REDIR_PORTS" == "1:65535" ] && unset LOCALHOST_UDP_PROXY_MODE + } # 加载路由器自身代理 TCP if [ "$TCP_NODE" != "nil" ]; then echolog "加载路由器自身 TCP 代理..." - [ "$accept_icmp" = "1" ] && { - $ipt_n -A OUTPUT -p icmp -j PSW_OUTPUT - $ipt_n -A PSW_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT) - $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_SHUNTLIST) $(REDIRECT) - [ "${USE_PROXY_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_BLACKLIST) $(REDIRECT) - [ "${USE_GFW_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_GFW) $(REDIRECT) - [ "${CHN_LIST}" != "0" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST}) - [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && $ipt_n -A PSW_OUTPUT -p icmp $(REDIRECT) - } - - [ "$accept_icmpv6" = "1" ] && { - $ip6t_n -A OUTPUT -p ipv6-icmp -j PSW_OUTPUT - $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_SHUNTLIST6) $(REDIRECT) - [ "${USE_PROXY_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_BLACKLIST6) $(REDIRECT) - [ "${USE_GFW_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_GFW6) $(REDIRECT) - [ "${CHN_LIST}" != "0" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST}) - [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(REDIRECT) - } - - local ipt_tmp=$ipt_n - [ -n "${is_tproxy}" ] && { - echolog " - 启用 TPROXY 模式" - ipt_tmp=$ipt_m - } - _proxy_tcp_access() { [ -n "${2}" ] || return 0 ipset -q test $IPSET_LANLIST ${2} @@ -945,7 +949,7 @@ add_firewall_rule() { echolog " - 上游 DNS 服务器 ${2} 已在直接访问的列表中，不强制向 TCP 代理转发对该服务器 TCP/${3} 端口的访问" return 0 } - if [ "${ipt_tmp}" = "${ipt_n}" ]; then + if [ -z "${is_tproxy}" ]; then $ipt_n -I PSW_OUTPUT -p tcp -d ${2} --dport ${3} $(REDIRECT $TCP_REDIR_PORT) else $ipt_m -I PSW_OUTPUT -p tcp -d ${2} --dport ${3} -j PSW_RULE @@ -953,13 +957,27 @@ add_firewall_rule() { fi echolog " - [$?]将上游 DNS 服务器 ${2}:${3} 加入到路由器自身代理的 TCP 转发链" } - [ "$use_tcp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { - $ipt_tmp -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - $ip6t_m -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN - echolog " - [$?]不代理TCP 端口：$TCP_NO_REDIR_PORTS" + + [ "$accept_icmp" = "1" ] && { + $ipt_n -A OUTPUT -p icmp -j PSW_OUTPUT + $ipt_n -A PSW_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT) + $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_SHUNTLIST) $(REDIRECT) + [ "${USE_PROXY_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_BLACKLIST) $(REDIRECT) + [ "${USE_GFW_LIST}" = "1" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_GFW) $(REDIRECT) + [ "${CHN_LIST}" != "0" ] && $ipt_n -A PSW_OUTPUT -p icmp $(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST}) + [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && $ipt_n -A PSW_OUTPUT -p icmp $(REDIRECT) } + + [ "$accept_icmpv6" = "1" ] && { + $ip6t_n -A OUTPUT -p ipv6-icmp -j PSW_OUTPUT + $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_SHUNTLIST6) $(REDIRECT) + [ "${USE_PROXY_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_BLACKLIST6) $(REDIRECT) + [ "${USE_GFW_LIST}" = "1" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_GFW6) $(REDIRECT) + [ "${CHN_LIST}" != "0" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST}) + [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && $ip6t_n -A PSW_OUTPUT -p ipv6-icmp $(REDIRECT) + } + [ "$TCP_PROXY_DROP_PORTS" != "disable" ] && [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && { $ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_PROXY_DROP_PORTS "-m multiport --dport") -d $FAKE_IP -j DROP $ipt_m -A PSW_OUTPUT -p tcp $(factor $TCP_PROXY_DROP_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) -j DROP @@ -970,7 +988,7 @@ add_firewall_rule() { echolog " - [$?]，屏蔽代理TCP 端口：$TCP_PROXY_DROP_PORTS" } - if [ "${ipt_tmp}" = "${ipt_n}" ]; then + if [ -z "${is_tproxy}" ]; then [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && { $ipt_n -A PSW_OUTPUT -p tcp -d $FAKE_IP $(REDIRECT $TCP_REDIR_PORT) $ipt_n -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $TCP_REDIR_PORT) @@ -1020,6 +1038,7 @@ add_firewall_rule() { } if [ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ]; then echolog "加载路由器自身 UDP 代理..." + _proxy_udp_access() { [ -n "${2}" ] || return 0 ipset -q test $IPSET_LANLIST ${2} @@ -1032,11 +1051,6 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 ${2}:${3} 加入到路由器自身代理的 UDP 转发链" } [ "$use_udp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { - $ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN - $ip6t_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN - echolog " - [$?]不代理 UDP 端口：$UDP_NO_REDIR_PORTS" - } [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && { $ipt_m -A PSW_OUTPUT -p udp -d $FAKE_IP -j PSW_RULE diff --git a/luci-app-passwall/root/usr/share/passwall/nftables.sh b/luci-app-passwall/root/usr/share/passwall/nftables.sh index 78fba3143..2d8c6f988 100755 --- a/luci-app-passwall/root/usr/share/passwall/nftables.sh +++ b/luci-app-passwall/root/usr/share/passwall/nftables.sh @@ -167,17 +167,6 @@ gen_nftset() { [ -n "${1}" ] && insert_nftset $nftset_name $timeout_argument_element $@ } -get_action_chain_name() { - case "$1" in - disable) - echo "不代理" - ;; - proxy) - echo "代理" - ;; - esac -} - get_jump_ipt() { case "$1" in direct) @@ -286,23 +275,49 @@ load_acl() { continue fi - [ "${use_direct_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ${_ipt_source} ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" - [ "${use_direct_list}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ${_ipt_source} ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" - [ "${use_block_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ${_ipt_source} ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" - [ "${use_block_list}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ${_ipt_source} ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" - [ "$PROXY_IPV6" == "1" ] && { - [ "${use_direct_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} ip6 daddr @$NFTSET_WHITELIST6 counter return comment \"$remarks\"" - [ "${use_block_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} ip6 daddr @$NFTSET_BLOCKLIST6 counter drop comment \"$remarks\"" + [ "$tcp_no_redir_ports" != "disable" ] && { + if [ "$tcp_no_redir_ports" != "1:65535" ]; then + #结束时return，无需多余的规则。 + nft "add rule inet fw4 $nft_prerouting_chain ${_ipt_source} ip protocol tcp $(factor $tcp_no_redir_ports "tcp dport") counter return comment \"$remarks\"" + nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} meta l4proto tcp $(factor $tcp_no_redir_ports "tcp dport") counter return comment \"$remarks\"" + echolog " - ${msg}不代理TCP端口[${tcp_no_redir_ports}]" + else + unset tcp_port + echolog " - ${msg}不代理所有TCP端口" + fi + } + + [ "$udp_no_redir_ports" != "disable" ] && { + if [ "$udp_no_redir_ports" != "1:65535" ]; then + #结束时return，无需多余的规则。 + nft "add rule inet fw4 PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\"" + nft "add rule inet fw4 PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\"" 2>/dev/null + echolog " - ${msg}不代理UDP端口[${udp_no_redir_ports}]" + else + unset udp_port + echolog " - ${msg}不代理所有UDP端口" + fi + } + + [ -n "$tcp_port" -o -n "$udp_port" ] && { + [ "${use_direct_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ${_ipt_source} ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" + [ "${use_direct_list}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ${_ipt_source} ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" + [ "${use_block_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ${_ipt_source} ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" + [ "${use_block_list}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ${_ipt_source} ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" + [ "$PROXY_IPV6" == "1" ] && { + [ "${use_direct_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} ip6 daddr @$NFTSET_WHITELIST6 counter return comment \"$remarks\"" + [ "${use_block_list}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} ip6 daddr @$NFTSET_BLOCKLIST6 counter drop comment \"$remarks\"" + } } [ -n "$tcp_port" ] && { if [ -n "${tcp_proxy_mode}" ]; then [ -s "${TMP_ACL_PATH}/${sid}/var_redirect_dns_port" ] && nft "add rule inet fw4 PSW_REDIRECT ip protocol udp ${_ipt_source} udp dport 53 counter redirect to $(cat ${TMP_ACL_PATH}/${sid}/var_redirect_dns_port) comment \"$remarks\"" - msg2="${msg}使用TCP节点[$tcp_node_remark] [$(get_action_chain_name $tcp_proxy_mode)]" + msg2="${msg}使用TCP节点[$tcp_node_remark]" if [ -n "${is_tproxy}" ]; then - msg2="${msg2}(TPROXY:${tcp_port})代理" + msg2="${msg2}(TPROXY:${tcp_port})" else - msg2="${msg2}(REDIRECT:${tcp_port})代理" + msg2="${msg2}(REDIRECT:${tcp_port})" fi [ "$accept_icmp" = "1" ] && { @@ -326,13 +341,6 @@ load_acl() { nft "add rule inet fw4 PSW_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} return comment \"$remarks\"" 2>/dev/null } - [ "$tcp_no_redir_ports" != "disable" ] && { - nft "add rule inet fw4 $nft_prerouting_chain ${_ipt_source} ip protocol tcp $(factor $tcp_no_redir_ports "tcp dport") counter return comment \"$remarks\"" - nft "add rule inet fw4 PSW_MANGLE_V6 ${_ipt_source} meta l4proto tcp $(factor $tcp_no_redir_ports "tcp dport") counter return comment \"$remarks\"" - msg2="${msg2}[$?]除${tcp_no_redir_ports}外的" - } - msg2="${msg2}所有端口" - [ "$tcp_proxy_drop_ports" != "disable" ] && { [ "$PROXY_IPV6" == "1" ] && { nft "add rule inet fw4 PSW_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_proxy_drop_ports "tcp dport") ip6 daddr @$NFTSET_SHUNTLIST6 counter drop comment \"$remarks\"" 2>/dev/null @@ -403,14 +411,8 @@ load_acl() { [ -n "$udp_port" ] && { if [ -n "${udp_proxy_mode}" ]; then - msg2="${msg}使用UDP节点[$udp_node_remark] [$(get_action_chain_name $udp_proxy_mode)]" - msg2="${msg2}(TPROXY:${udp_port})代理" - [ "$udp_no_redir_ports" != "disable" ] && { - nft "add rule inet fw4 PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\"" - nft "add rule inet fw4 PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\"" 2>/dev/null - msg2="${msg2}[$?]除${udp_no_redir_ports}外的" - } - msg2="${msg2}所有端口" + msg2="${msg}使用UDP节点[$udp_node_remark]" + msg2="${msg2}(TPROXY:${udp_port})" nft "add rule inet fw4 PSW_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW_RULE comment \"$remarks\"" nft "add rule inet fw4 PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr @$NFTSET_SHUNTLIST counter jump PSW_RULE comment \"$remarks\"" @@ -442,15 +444,40 @@ load_acl() { done } - [ "$ENABLED_DEFAULT_ACL" == 1 ] && { - [ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" - [ "${USE_DIRECT_LIST}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" - [ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" - [ "${USE_BLOCK_LIST}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" - [ "$PROXY_IPV6" == "1" ] && { - [ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ip6 daddr @$NFTSET_WHITELIST6 counter return comment \"$remarks\"" - [ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ip6 daddr @$NFTSET_BLOCKLIST6 counter drop comment \"$remarks\"" + [ "$ENABLED_DEFAULT_ACL" == 1 ] && [ "$CLIENT_PROXY" == 1 ] && { + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { + nft "add rule inet fw4 $nft_prerouting_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return comment \"默认\"" + nft "add rule inet fw4 PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return comment \"默认\"" + if [ "$TCP_NO_REDIR_PORTS" != "1:65535" ]; then + echolog "TCP默认代理：不代理TCP端口[${TCP_NO_REDIR_PORTS}]" + else + unset TCP_PROXY_MODE + echolog "TCP默认代理：不代理所有TCP端口" + fi } + + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { + nft "add inet fw4 PSW_MANGLE ip protocol udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return comment \"默认\"" + nft "add inet fw4 PSW_MANGLE_V6 counter meta l4proto udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return comment \"默认\"" + if [ "$UDP_NO_REDIR_PORTS" != "1:65535" ]; then + echolog "UDP默认代理：不代理UDP端口[${UDP_NO_REDIR_PORTS}]" + else + unset UDP_PROXY_MODE + echolog "UDP默认代理：不代理所有UDP端口" + fi + } + + [ -n "${TCP_PROXY_MODE}" -o -n "${UDP_PROXY_MODE}" ] && { + [ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" + [ "${USE_DIRECT_LIST}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ip daddr @$NFTSET_WHITELIST counter return comment \"$remarks\"" + [ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" + [ "${USE_BLOCK_LIST}" = "1" ] && [ -z "${is_tproxy}" ] && nft "add rule inet fw4 PSW_NAT ip daddr @$NFTSET_BLOCKLIST counter drop comment \"$remarks\"" + [ "$PROXY_IPV6" == "1" ] && { + [ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ip6 daddr @$NFTSET_WHITELIST6 counter return comment \"$remarks\"" + [ "${USE_BLOCK_LIST}" = "1" ] && nft "add rule inet fw4 PSW_MANGLE_V6 ip6 daddr @$NFTSET_BLOCKLIST6 counter drop comment \"$remarks\"" + } + } + # 加载TCP默认代理模式 [ "$TCP_PROXY_DROP_PORTS" != "disable" ] && { [ "$PROXY_IPV6" == "1" ] && { @@ -470,21 +497,14 @@ load_acl() { } if [ -n "${TCP_PROXY_MODE}" ]; then - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { - nft add rule inet fw4 $nft_prerouting_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return comment \"默认\" - nft add rule inet fw4 PSW_MANGLE_V6 meta l4proto tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return comment \"默认\" - } [ "$TCP_NODE" != "nil" ] && { - msg="TCP默认代理：使用TCP节点[$(config_n_get $TCP_NODE remarks)] [$(get_action_chain_name $TCP_PROXY_MODE)]" + msg="TCP默认代理：使用TCP节点[$(config_n_get $TCP_NODE remarks)]" if [ -n "${is_tproxy}" ]; then - msg="${msg}(TPROXY:${TCP_REDIR_PORT})代理" + msg="${msg}(TPROXY:${TCP_REDIR_PORT})" else - msg="${msg}(REDIRECT:${TCP_REDIR_PORT})代理" + msg="${msg}(REDIRECT:${TCP_REDIR_PORT})" fi - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" - [ "$accept_icmp" = "1" ] && { [ "${USE_DIRECT_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT ip daddr @$NFTSET_WHITELIST counter return comment \"默认\"" nft "add rule inet fw4 PSW_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"默认\"" @@ -556,17 +576,9 @@ load_acl() { [ "${UDP_PROXY_MODE}" != "disable" ] && nft "add inet fw4 PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter drop comment \"默认\"" } if [ -n "${UDP_PROXY_MODE}" ]; then - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { - nft "add inet fw4 PSW_MANGLE ip protocol udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return comment \"默认\"" - nft "add inet fw4 PSW_MANGLE_V6 counter meta l4proto udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return comment \"默认\"" - } - [ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ] && { [ "$TCP_UDP" = "1" ] && [ "$UDP_NODE" = "nil" ] && UDP_NODE=$TCP_NODE - msg="UDP默认代理：使用UDP节点[$(config_n_get $UDP_NODE remarks)] [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT})代理" - - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${UDP_NO_REDIR_PORTS}外的" - msg="${msg}所有端口" + msg="UDP默认代理：使用UDP节点[$(config_n_get $UDP_NODE remarks)](TPROXY:${UDP_REDIR_PORT})" nft "add rule inet fw4 PSW_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE comment \"默认\"" nft "add rule inet fw4 PSW_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr @$NFTSET_SHUNTLIST counter jump PSW_RULE comment \"默认\"" @@ -963,34 +975,23 @@ add_firewall_rule() { filter_node $node $stream $port > /dev/null 2>&1 & fi done + + [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { + nft "add rule inet fw4 $nft_output_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return" + nft "add rule inet fw4 PSW_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return" + [ "$TCP_NO_REDIR_PORTS" == "1:65535" ] && unset LOCALHOST_TCP_PROXY_MODE + } + + [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { + nft "add rule inet fw4 PSW_OUTPUT_MANGLE ip protocol udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return" + nft "add rule inet fw4 PSW_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return" + [ "$UDP_NO_REDIR_PORTS" == "1:65535" ] && unset LOCALHOST_UDP_PROXY_MODE + } # 加载路由器自身代理 TCP if [ "$TCP_NODE" != "nil" ]; then echolog "加载路由器自身 TCP 代理..." - [ "$accept_icmp" = "1" ] && { - nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect" - nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_SHUNTLIST counter redirect" - [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_BLACKLIST counter redirect" - [ "${USE_GFW_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_GFW counter redirect" - [ "${CHN_LIST}" != "0" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_CHN $(get_jump_ipt ${CHN_LIST})" - [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp counter redirect" - nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp counter return" - } - - [ "$accept_icmpv6" = "1" ] && { - nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_SHUNTLIST6 counter redirect" - [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_BLACKLIST6 counter redirect" - [ "${USE_GFW_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_GFW6 counter redirect" - [ "${CHN_LIST}" != "0" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_CHN6 $(get_jump_ipt ${CHN_LIST})" - [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter redirect" - nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter return" - } - - [ -n "${is_tproxy}" ] && { - echolog " - 启用 TPROXY 模式" - } - _proxy_tcp_access() { [ -n "${2}" ] || return 0 nft "get element inet fw4 $NFTSET_LANLIST {${2}}" &>/dev/null @@ -1006,13 +1007,27 @@ add_firewall_rule() { fi echolog " - [$?]将上游 DNS 服务器 ${2}:${3} 加入到路由器自身代理的 TCP 转发链" } - [ "$use_tcp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 - [ "$TCP_NO_REDIR_PORTS" != "disable" ] && { - nft "add rule inet fw4 $nft_output_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return" - nft "add rule inet fw4 PSW_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return" - echolog " - [$?]不代理TCP 端口：$TCP_NO_REDIR_PORTS" + + [ "$accept_icmp" = "1" ] && { + nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect" + nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_SHUNTLIST counter redirect" + [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_BLACKLIST counter redirect" + [ "${USE_GFW_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_GFW counter redirect" + [ "${CHN_LIST}" != "0" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_CHN $(get_jump_ipt ${CHN_LIST})" + [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp counter redirect" + nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo ip protocol icmp counter return" } + + [ "$accept_icmpv6" = "1" ] && { + nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_SHUNTLIST6 counter redirect" + [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_BLACKLIST6 counter redirect" + [ "${USE_GFW_LIST}" = "1" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_GFW6 counter redirect" + [ "${CHN_LIST}" != "0" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_CHN6 $(get_jump_ipt ${CHN_LIST})" + [ -n "${LOCALHOST_TCP_PROXY_MODE}" ] && [ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter redirect" + nft "add rule inet fw4 PSW_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter return" + } + [ "$TCP_PROXY_DROP_PORTS" != "disable" ] && [ -n "$LOCALHOST_TCP_PROXY_MODE" ] && { nft add rule inet fw4 $nft_output_chain ip protocol tcp ip daddr $FAKE_IP $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop nft add rule inet fw4 $nft_output_chain ip protocol tcp ip daddr @$NFTSET_SHUNTLIST $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter drop @@ -1072,6 +1087,7 @@ add_firewall_rule() { } if [ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ]; then echolog "加载路由器自身 UDP 代理..." + _proxy_udp_access() { [ -n "${2}" ] || return 0 nft "get element inet fw4 $NFTSET_LANLIST {${2}}" &>/dev/null @@ -1084,12 +1100,6 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 ${2}:${3} 加入到路由器自身代理的 UDP 转发链" } [ "$use_udp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 - [ "$UDP_NO_REDIR_PORTS" != "disable" ] && { - nft add rule inet fw4 PSW_OUTPUT_MANGLE ip protocol udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return - nft add rule inet fw4 PSW_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return - echolog " - [$?]不代理 UDP 端口：$UDP_NO_REDIR_PORTS" - } - [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && { nft "add rule inet fw4 PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE" nft "add rule inet fw4 PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_SHUNTLIST $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE" diff --git a/redsocks2/Makefile b/redsocks2/Makefile index eb7256b64..f68f88ed6 100644 --- a/redsocks2/Makefile +++ b/redsocks2/Makefile @@ -5,14 +5,14 @@ include $(TOPDIR)/rules.mk PKG_NAME:=redsocks2 -PKG_VERSION:=0.67 -PKG_RELEASE:=5 +PKG_VERSION:=release-test4 +PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://github.com/semigodking/redsocks.git -PKG_SOURCE_DATE:=2020-05-10 -PKG_SOURCE_VERSION:=d94c245ea47859cda5b4b7373308589206b97bdc -PKG_MIRROR_HASH:=5ca32b2f849af7ebda2cab90bbe286bfd97a69de1a85dac09c8df2fbdd8c947c +PKG_SOURCE_DATE:=2024-01-27 +PKG_SOURCE_VERSION:=92dbff008a54540159bbb4c0ff19ccf224155d76 +PKG_MIRROR_HASH:=6c45324e824fd261eb919592207b368c8a2668c01ef882bd348868362ea80f44 PKG_MAINTAINER:=semigodking PKG_LICENSE:=Apache-2.0