gitea-action
parent
9f6444824e
commit
fc086418e1
@ -70,10 +70,10 @@ o = s:option(Value, "remarks", translate("Remarks"))
|
||||
o.default = arg[1]
|
||||
o.rmempty = true
|
||||
|
||||
use_if = s:option(Flag, "use_interface", translate("Use Interface With ACLs"))
|
||||
use_if.default = 0
|
||||
use_if.rmempty = false
|
||||
|
||||
o = s:option(ListValue, "interface", translate("Source Interface"))
|
||||
o:value("", translate("All"))
|
||||
local wa = require "luci.tools.webadmin"
|
||||
wa.cbi_add_networks(o)
|
||||
|
||||
local mac_t = {}
|
||||
sys.net.mac_hints(function(e, t)
|
||||
@ -95,17 +95,6 @@ table.sort(mac_t, function(a,b)
|
||||
return false
|
||||
end)
|
||||
|
||||
local device_list = {}
|
||||
device_list = sys.net.devices()
|
||||
table.sort(device_list)
|
||||
interface = s:option(ListValue, "interface", translate("Source Interface"))
|
||||
|
||||
for k, name in ipairs(device_list) do
|
||||
interface:value(name)
|
||||
end
|
||||
|
||||
interface:depends({ use_interface = 1 })
|
||||
|
||||
---- Source
|
||||
sources = s:option(DynamicList, "sources", translate("Source"))
|
||||
sources.description = "<ul><li>" .. translate("Example:")
|
||||
@ -119,7 +108,6 @@ sources.cast = "string"
|
||||
for _, key in pairs(mac_t) do
|
||||
sources:value(key.mac, "%s (%s)" % {key.mac, key.ip})
|
||||
end
|
||||
sources:depends({ use_interface = 0 })
|
||||
|
||||
sources.cfgvalue = function(self, section)
|
||||
local value
|
||||
|
||||
@ -962,35 +962,33 @@ acl_app() {
|
||||
for item in $items; do
|
||||
index=$(expr $index + 1)
|
||||
local enabled sid remarks sources node direct_dns_query_strategy remote_dns_protocol remote_dns remote_dns_doh remote_dns_client_ip remote_dns_detour remote_fakedns remote_dns_query_strategy interface use_interface
|
||||
local _ip _mac _iprange _ipset _ip_or_mac rule_list interface_list config_file
|
||||
local _ip _mac _iprange _ipset _ip_or_mac source_list config_file
|
||||
sid=$(uci -q show "${CONFIG}.${item}" | grep "=acl_rule" | awk -F '=' '{print $1}' | awk -F '.' '{print $2}')
|
||||
eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
|
||||
|
||||
[ "$enabled" = "1" ] || continue
|
||||
|
||||
[ -z "${sources}" ] && [ -z "${interface}" ] && continue
|
||||
for s in $sources; do
|
||||
local s2
|
||||
is_iprange=$(lua_api "iprange(\"${s}\")")
|
||||
if [ "${is_iprange}" = "true" ]; then
|
||||
rule_list="${rule_list}\niprange:${s}"
|
||||
s2="iprange:${s}"
|
||||
elif [ -n "$(echo ${s} | grep '^ipset:')" ]; then
|
||||
rule_list="${rule_list}\nipset:${s}"
|
||||
s2="ipset:${s}"
|
||||
else
|
||||
_ip_or_mac=$(lua_api "ip_or_mac(\"${s}\")")
|
||||
if [ "${_ip_or_mac}" = "ip" ]; then
|
||||
rule_list="${rule_list}\nip:${s}"
|
||||
s2="ip:${s}"
|
||||
elif [ "${_ip_or_mac}" = "mac" ]; then
|
||||
rule_list="${rule_list}\nmac:${s}"
|
||||
s2="mac:${s}"
|
||||
fi
|
||||
fi
|
||||
[ -n "${s2}" ] && source_list="${source_list}\n${s2}"
|
||||
unset s2
|
||||
done
|
||||
for i in $interface; do
|
||||
interface_list="${interface_list}\n$i"
|
||||
done
|
||||
[ -z "${rule_list}" ] && [ -z "${interface_list}" ] && continue
|
||||
mkdir -p $TMP_ACL_PATH/$sid
|
||||
|
||||
[ ! -z "${rule_list}" ] && echo -e "${rule_list}" | sed '/^$/d' > $TMP_ACL_PATH/$sid/rule_list
|
||||
[ ! -z "${interface_list}" ] && echo -e "${interface_list}" | sed '/^$/d' > $TMP_ACL_PATH/$sid/interface_list
|
||||
mkdir -p $TMP_ACL_PATH/$sid
|
||||
[ ! -z "${source_list}" ] && echo -e "${source_list}" | sed '/^$/d' > $TMP_ACL_PATH/$sid/source_list
|
||||
|
||||
tcp_proxy_mode="global"
|
||||
udp_proxy_mode="global"
|
||||
@ -1062,7 +1060,7 @@ acl_app() {
|
||||
}
|
||||
[ -n "$redirect_dns_port" ] && echo "${redirect_dns_port}" > $TMP_ACL_PATH/$sid/var_redirect_dns_port
|
||||
unset enabled sid remarks sources interface node direct_dns_query_strategy remote_dns_protocol remote_dns remote_dns_doh remote_dns_client_ip remote_dns_detour remote_fakedns remote_dns_query_strategy
|
||||
unset _ip _mac _iprange _ipset _ip_or_mac rule_list config_file interface_list
|
||||
unset _ip _mac _iprange _ipset _ip_or_mac source_list config_file
|
||||
unset redirect_dns_port
|
||||
done
|
||||
unset redir_port dns_port dnsmasq_port
|
||||
|
||||
@ -222,36 +222,51 @@ load_acl() {
|
||||
fi
|
||||
}
|
||||
|
||||
_acl_list=${TMP_ACL_PATH}/${sid}/rule_list
|
||||
[ "$use_interface" = "1" ] && _acl_list=${TMP_ACL_PATH}/${sid}/interface_list
|
||||
_acl_list=${TMP_ACL_PATH}/${sid}/source_list
|
||||
|
||||
for i in $(cat $_acl_list); do
|
||||
if [ "$use_interface" = "0" ]; then
|
||||
local _ipt_source
|
||||
local msg
|
||||
if [ -n "${interface}" ]; then
|
||||
. /lib/functions/network.sh
|
||||
local gateway device
|
||||
network_get_gateway gateway "${interface}"
|
||||
network_get_device device "${interface}"
|
||||
[ -z "${device}" ] && device="${interface}"
|
||||
_ipt_source="-i ${device} "
|
||||
msg="源接口【${device}】，"
|
||||
fi
|
||||
if [ -n "$(echo ${i} | grep '^iprange:')" ]; then
|
||||
_iprange=$(echo ${i} | sed 's#iprange:##g')
|
||||
_ipt_source=$(factor ${_iprange} "-m iprange --src-range")
|
||||
msg="【$remarks】，IP range【${_iprange}】，"
|
||||
_ipt_source=$(factor ${_iprange} "${_ipt_source}-m iprange --src-range")
|
||||
msg="${msg}IP range【${_iprange}】，"
|
||||
unset _iprange
|
||||
elif [ -n "$(echo ${i} | grep '^ipset:')" ]; then
|
||||
_ipset=$(echo ${i} | sed 's#ipset:##g')
|
||||
_ipt_source="-m set --match-set ${_ipset} src"
|
||||
msg="【$remarks】，IPset【${_ipset}】，"
|
||||
msg="${msg}IPset【${_ipset}】，"
|
||||
ipset -q list ${_ipset} >/dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
_ipt_source="${_ipt_source}-m set --match-set ${_ipset} src"
|
||||
unset _ipset
|
||||
else
|
||||
echolog " - 【$remarks】，${msg}不存在，忽略。"
|
||||
unset _ipset
|
||||
continue
|
||||
fi
|
||||
elif [ -n "$(echo ${i} | grep '^ip:')" ]; then
|
||||
_ip=$(echo ${i} | sed 's#ip:##g')
|
||||
_ipt_source=$(factor ${_ip} "-s")
|
||||
msg="【$remarks】，IP【${_ip}】，"
|
||||
_ipt_source=$(factor ${_ip} "${_ipt_source}-s")
|
||||
msg="${msg}IP【${_ip}】，"
|
||||
unset _ip
|
||||
elif [ -n "$(echo ${i} | grep '^mac:')" ]; then
|
||||
_mac=$(echo ${i} | sed 's#mac:##g')
|
||||
_ipt_source=$(factor ${_mac} "-m mac --mac-source")
|
||||
msg="【$remarks】，MAC【${_mac}】，"
|
||||
_ipt_source=$(factor ${_mac} "${_ipt_source}-m mac --mac-source")
|
||||
msg="${msg}MAC【${_mac}】，"
|
||||
unset _mac
|
||||
else
|
||||
continue
|
||||
fi
|
||||
else
|
||||
[ -z "${i}" ] && continue
|
||||
_ifname="${i}"
|
||||
_ipt_source="-i $_ifname"
|
||||
msg="【$remarks】，IF【${_ifname}】，"
|
||||
fi
|
||||
msg="【$remarks】，${msg}"
|
||||
|
||||
ipt_tmp=$ipt_n
|
||||
[ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m
|
||||
@ -338,10 +353,10 @@ load_acl() {
|
||||
}
|
||||
$ipt_m -A PSW2 $(comment "$remarks") ${_ipt_source} -p udp -j RETURN
|
||||
$ip6t_m -A PSW2 $(comment "$remarks") ${_ipt_source} -p udp -j RETURN 2>/dev/null
|
||||
unset ipt_tmp _ipt_source msg msg2
|
||||
done
|
||||
unset enabled sid remarks sources tcp_no_redir_ports udp_no_redir_ports tcp_redir_ports udp_redir_ports node use_interface interface
|
||||
unset _ip _mac _iprange _ipset _ip_or_mac rule_list node_remark _acl_list
|
||||
unset ipt_tmp msg msg2
|
||||
unset enabled sid remarks sources tcp_no_redir_ports udp_no_redir_ports tcp_redir_ports udp_redir_ports node interface
|
||||
unset node_remark _acl_list
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
@ -276,36 +276,44 @@ load_acl() {
|
||||
fi
|
||||
}
|
||||
|
||||
_acl_list=${TMP_ACL_PATH}/${sid}/rule_list
|
||||
[ "$use_interface" = "1" ] && _acl_list=${TMP_ACL_PATH}/${sid}/interface_list
|
||||
_acl_list=${TMP_ACL_PATH}/${sid}/source_list
|
||||
|
||||
for i in $(cat $_acl_list); do
|
||||
if [ "$use_interface" = "0" ]; then
|
||||
local _ipt_source
|
||||
local msg
|
||||
if [ -n "${interface}" ]; then
|
||||
. /lib/functions/network.sh
|
||||
local gateway device
|
||||
network_get_gateway gateway "${interface}"
|
||||
network_get_device device "${interface}"
|
||||
[ -z "${device}" ] && device="${interface}"
|
||||
_ipt_source="iifname ${device} "
|
||||
msg="源接口【${device}】，"
|
||||
fi
|
||||
if [ -n "$(echo ${i} | grep '^iprange:')" ]; then
|
||||
_iprange=$(echo ${i} | sed 's#iprange:##g')
|
||||
_ipt_source=$(factor ${_iprange} "ip saddr")
|
||||
msg="【$remarks】，IP range【${_iprange}】，"
|
||||
_ipt_source=$(factor ${_iprange} "${_ipt_source}ip saddr")
|
||||
msg="${msg}IP range【${_iprange}】，"
|
||||
unset _iprange
|
||||
elif [ -n "$(echo ${i} | grep '^ipset:')" ]; then
|
||||
_ipset=$(echo ${i} | sed 's#ipset:##g')
|
||||
_ipt_source="ip daddr @${_ipset}"
|
||||
msg="【$remarks】，NFTset【${_ipset}】，"
|
||||
_ipt_source="${_ipt_source}ip daddr @${_ipset}"
|
||||
msg="${msg}NFTset【${_ipset}】，"
|
||||
unset _ipset
|
||||
elif [ -n "$(echo ${i} | grep '^ip:')" ]; then
|
||||
_ip=$(echo ${i} | sed 's#ip:##g')
|
||||
_ipt_source=$(factor ${_ip} "ip saddr")
|
||||
msg="【$remarks】，IP【${_ip}】，"
|
||||
_ipt_source=$(factor ${_ip} "${_ipt_source}ip saddr")
|
||||
msg="${msg}IP【${_ip}】，"
|
||||
unset _ip
|
||||
elif [ -n "$(echo ${i} | grep '^mac:')" ]; then
|
||||
_mac=$(echo ${i} | sed 's#mac:##g')
|
||||
_ipt_source=$(factor ${_mac} "ether saddr")
|
||||
msg="【$remarks】，MAC【${_mac}】，"
|
||||
_ipt_source=$(factor ${_mac} "${_ipt_source}ether saddr")
|
||||
msg="${msg}MAC【${_mac}】，"
|
||||
unset _mac
|
||||
else
|
||||
continue
|
||||
fi
|
||||
else
|
||||
[ -z "${i}" ] && continue
|
||||
_ifname="${i}"
|
||||
_ipt_source="iifname $_ifname"
|
||||
msg="【$remarks】，IF【${_ifname}】，"
|
||||
fi
|
||||
msg="【$remarks】，${msg}"
|
||||
|
||||
[ "$tcp_no_redir_ports" != "disable" ] && {
|
||||
if [ "$tcp_no_redir_ports" != "1:65535" ]; then
|
||||
@ -393,10 +401,10 @@ load_acl() {
|
||||
}
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} counter return comment \"$remarks\""
|
||||
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} counter return comment \"$remarks\"" 2>/dev/null
|
||||
unset _ipt_source msg msg2
|
||||
done
|
||||
unset enabled sid remarks sources tcp_proxy_mode udp_proxy_mode tcp_no_redir_ports udp_no_redir_ports tcp_redir_ports udp_redir_ports node use_interface interface
|
||||
unset _ip _mac _iprange _ipset _ip_or_mac rule_list redir_port node_remark _acl_list _ifname
|
||||
unset msg msg2
|
||||
unset enabled sid remarks sources tcp_proxy_mode udp_proxy_mode tcp_no_redir_ports udp_no_redir_ports tcp_redir_ports udp_redir_ports node interface
|
||||
unset redir_port node_remark _acl_list
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user