hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(nft,telegram): fix terminal redirect counter syntax error in dns_block rules and table name

Browse Source
This commit is contained in:
Dushnilin
2026-09-09 22:56:55 +03:00
parent b51809c81d
commit 5e24cd9ae6
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tachyon/files/usr/lib/nft/apply.uc
+4 -4
View File
@@ -1154,7 +1154,7 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
append_array(match_args, [ "meta", "hour", sprintf("\"%s\"-\"%s\"", interval[0], interval[1]) ]);
}
append_array(match_args, days_args);
append_array(match_args, [ "udp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
append_array(match_args, [ "udp", "dport", "53", "counter", "redirect", "to", DNS_BLOCK_TARGET, "comment", "\"" + comment + "\"" ]);
if (!nft_add_rule(table, "dns_block", match_args))
return false;
added = true;
@@ -1171,7 +1171,7 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
append_array(tcp_args, [ "meta", "hour", sprintf("\"%s\"-\"%s\"", interval[0], interval[1]) ]);
}
append_array(tcp_args, days_args);
append_array(tcp_args, [ "tcp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
append_array(tcp_args, [ "tcp", "dport", "53", "counter", "redirect", "to", DNS_BLOCK_TARGET, "comment", "\"" + comment + "\"" ]);
if (!nft_add_rule(table, "dns_block", tcp_args))
return false;
added = true;
@@ -1216,7 +1216,7 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
append_array(match_args, [ "ip6", "saddr", dev_str ]);
else
append_array(match_args, [ "ip", "saddr", dev_str ]);
append_array(match_args, [ "udp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
append_array(match_args, [ "udp", "dport", "53", "counter", "redirect", "to", DNS_BLOCK_TARGET, "comment", "\"" + comment + "\"" ]);
if (!nft_add_rule(table, "dns_block", match_args))
return false;
added = true;
@@ -1228,7 +1228,7 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
append_array(tcp_args, [ "ip6", "saddr", dev_str ]);
else
append_array(tcp_args, [ "ip", "saddr", dev_str ]);
append_array(tcp_args, [ "tcp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
append_array(tcp_args, [ "tcp", "dport", "53", "counter", "redirect", "to", DNS_BLOCK_TARGET, "comment", "\"" + comment + "\"" ]);
if (!nft_add_rule(table, "dns_block", tcp_args))
return false;
added = true;
tachyon/files/usr/lib/service/telegram.uc
+2 -1
View File
@@ -11,6 +11,7 @@ let i18n = require("service.i18n");
const CONFIG_NAME = getenv("TACHYON_CONFIG_NAME") || "tachyon";
const LIB_DIR = getenv("TACHYON_LIB") || "/usr/lib/tachyon";
const NFT_TABLE_NAME = getenv("NFT_TABLE_NAME") || "TachyonTable";
const PID_FILE = "/var/run/tachyon_telegram.pid";
const OFFSET_FILE = "/var/run/tachyon_telegram_offset";
@@ -3187,7 +3188,7 @@ function check_blocked_activity(cfg) {
let schedules = block_schedules_with_notify();
if (length(schedules) == 0) return;
let out = command_capture(command_from_args([ "nft", "list", "chain", "inet", "tachyon", "dns_block" ]));
let out = command_capture(command_from_args([ "nft", "list", "chain", "inet", NFT_TABLE_NAME, "dns_block" ]));
if (!out || out.status != 0) return;
let previous = load_blocked_counts();
tests/content_blocking.sh
+4 -4
View File
@@ -230,9 +230,9 @@ JSON
nft_ucode nft-add-dns-block-rules-fixture "$WORK_DIR/nft_fixture.json" "tachyon"
# Time-gated rule: IP device, meta hour window, redirect to block target
assert_contains "$NFT_LOG" "dns_block ip saddr 192.168.1.150 meta hour \"22:00:00\"-\"23:59:59\" udp dport 53 redirect to :1053 counter comment" "time-gated udp redirect"
assert_contains "$NFT_LOG" "dns_block ip saddr 192.168.1.150 meta hour \"00:00:00\"-\"08:00:00\" udp dport 53 redirect to :1053" "midnight wrap udp redirect"
assert_contains "$NFT_LOG" "tcp dport 53 redirect to :1053" "tcp dns redirect"
assert_contains "$NFT_LOG" "dns_block ip saddr 192.168.1.150 meta hour \"22:00:00\"-\"23:59:59\" udp dport 53 counter redirect to :1053 comment" "time-gated udp redirect"
assert_contains "$NFT_LOG" "dns_block ip saddr 192.168.1.150 meta hour \"00:00:00\"-\"08:00:00\" udp dport 53 counter redirect to :1053" "midnight wrap udp redirect"
assert_contains "$NFT_LOG" "tcp dport 53 counter redirect to :1053" "tcp dns redirect"
# MAC device redirect
assert_contains "$NFT_LOG" "dns_block ether saddr 11:22:33:44:55:66 meta hour" "mac redirect with time"
@@ -241,7 +241,7 @@ assert_contains "$NFT_LOG" "dns_block ether saddr 11:22:33:44:55:66 meta hour" "
if grep -Fq "192.168.1.160 meta hour" "$NFT_LOG"; then
fail "always-on schedule must not carry meta hour matcher"
fi
assert_contains "$NFT_LOG" "ip saddr 192.168.1.160 udp dport 53 redirect to :1053" "always-on redirect"
assert_contains "$NFT_LOG" "ip saddr 192.168.1.160 udp dport 53 counter redirect to :1053" "always-on redirect"
# ─── Validator: invalid blocked domain rejected ──────────────────────────────
cat >"$WORK_DIR/invalid_domain.json" <<'JSON'