hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: resolve parental & profile blocklists saving and enforcement, add dashboard support for missing protocols

Browse Source
This commit is contained in:
Dushnilin
2026-09-09 20:10:30 +03:00
parent c85811cbe0
commit f2865b4bb2
18 changed files with 587 additions and 306 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tachyon/files/usr/lib/core/constants.uc
+1 -1
View File
@@ -136,7 +136,7 @@ function constants_map() {
c.SB_DNS_INBOUND_ADDRESS = env("SB_DNS_INBOUND_ADDRESS", "127.0.0.42");
c.SB_DNS_INBOUND_PORT = env("SB_DNS_INBOUND_PORT", "53");
c.SB_DNS_BLOCK_INBOUND_TAG = env("SB_DNS_BLOCK_INBOUND_TAG", "dns-block-in");
c.SB_DNS_BLOCK_INBOUND_ADDRESS = env("SB_DNS_BLOCK_INBOUND_ADDRESS", "127.0.0.43");
c.SB_DNS_BLOCK_INBOUND_ADDRESS = env("SB_DNS_BLOCK_INBOUND_ADDRESS", "::");
c.SB_DNS_BLOCK_INBOUND_PORT = env("SB_DNS_BLOCK_INBOUND_PORT", "1053");
c.SB_SERVICE_MIXED_INBOUND_TAG = env("SB_SERVICE_MIXED_INBOUND_TAG", "service-mixed-in");
c.SB_SERVICE_MIXED_INBOUND_ADDRESS = env("SB_SERVICE_MIXED_INBOUND_ADDRESS", "127.0.0.1");
tachyon/files/usr/lib/nft/apply.uc
+13 -4
View File
@@ -11,7 +11,8 @@ let connections = require("config.connections");
let routing_rulesets = require("routing.rulesets");
let runtime_constants = require("singbox.constants");
const CONFIG_NAME = getenv("TACHYON_CONFIG_NAME") || "tachyon";
const DNS_BLOCK_TARGET = getenv("SB_DNS_BLOCK_INBOUND_ADDRESS") || "127.0.0.43:1053";
const DNS_BLOCK_PORT = int(getenv("SB_DNS_BLOCK_INBOUND_PORT") || runtime_constants.DNS_BLOCK_INBOUND_PORT);
const DNS_BLOCK_TARGET = ":" + DNS_BLOCK_PORT;
const DNS_SOURCE_SET = runtime_constants.DNS_SOURCE_SET;
const DNS_SOURCE6_SET = runtime_constants.DNS_SOURCE6_SET;
@@ -1135,13 +1136,15 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
if (dev_str == "") continue;
let is_mac = match(dev_str, /^([0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}$/) != null;
let family = is_mac ? 0 : core_ip.ip_family(dev_str);
if (!is_mac && family != 4)
continue; // dns-block-in listens on IPv4 only
if (!is_mac && family != 4 && family != 6)
continue;
for (let interval in intervals) {
let match_args = [];
if (is_mac) {
append_array(match_args, [ "ether", "saddr", lc(replace(dev_str, "-", ":")) ]);
} else if (family == 6) {
append_array(match_args, [ "ip6", "saddr", dev_str ]);
} else {
append_array(match_args, [ "ip", "saddr", dev_str ]);
}
@@ -1157,6 +1160,8 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
let tcp_args = [];
if (is_mac) {
append_array(tcp_args, [ "ether", "saddr", lc(replace(dev_str, "-", ":")) ]);
} else if (family == 6) {
append_array(tcp_args, [ "ip6", "saddr", dev_str ]);
} else {
append_array(tcp_args, [ "ip", "saddr", dev_str ]);
}
@@ -1199,12 +1204,14 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
if (dev_str == "") continue;
let is_mac = match(dev_str, /^([0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}$/) != null;
let family = is_mac ? 0 : core_ip.ip_family(dev_str);
if (!is_mac && family != 4)
if (!is_mac && family != 4 && family != 6)
continue;
let match_args = [];
if (is_mac)
append_array(match_args, [ "ether", "saddr", lc(replace(dev_str, "-", ":")) ]);
else if (family == 6)
append_array(match_args, [ "ip6", "saddr", dev_str ]);
else
append_array(match_args, [ "ip", "saddr", dev_str ]);
append_array(match_args, [ "udp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
@@ -1215,6 +1222,8 @@ function nft_add_dns_block_rules_from_schedules(schedules, table, profiles) {
let tcp_args = [];
if (is_mac)
append_array(tcp_args, [ "ether", "saddr", lc(replace(dev_str, "-", ":")) ]);
else if (family == 6)
append_array(tcp_args, [ "ip6", "saddr", dev_str ]);
else
append_array(tcp_args, [ "ip", "saddr", dev_str ]);
append_array(tcp_args, [ "tcp", "dport", "53", "redirect", "to", DNS_BLOCK_TARGET, "counter", "comment", "\"" + comment + "\"" ]);
tachyon/files/usr/lib/singbox/constants.uc
+1 -1
View File
@@ -16,7 +16,7 @@ const DNS_INBOUND_TAG = "dns-in";
const DNS_INBOUND_ADDRESS = "127.0.0.42";
const DNS_INBOUND_PORT = 53;
const DNS_BLOCK_INBOUND_TAG = "dns-block-in";
const DNS_BLOCK_INBOUND_ADDRESS = "127.0.0.43";
const DNS_BLOCK_INBOUND_ADDRESS = "::";
const DNS_BLOCK_INBOUND_PORT = 1053;
const SOURCE_DNS_INBOUND_TAG = "source-dns-in";
const SOURCE_DNS_INBOUND_ADDRESS = "::";
tachyon/files/usr/lib/singbox/generator.uc
+28 -5
View File
@@ -836,10 +836,12 @@ function schedule_domain_matcher_rule(rule, schedule) {
push(keyword, trim(substr(value, 8)));
else if (substr(value, 0, 6) == "regex:")
push(regex, trim(substr(value, 6)));
else if (substr(value, 0, 1) == "." || index(value, "*") >= 0)
push(plain, value);
else if (substr(value, 0, 1) == ".")
push(plain, substr(value, 1));
else if (index(value, "*") >= 0)
push(plain, replace(value, "*.", ""));
else
push(full, value);
push(plain, value);
}
if (length(full) > 0)
rule.domain = full;
@@ -852,6 +854,22 @@ function schedule_domain_matcher_rule(rule, schedule) {
return rule;
}
function schedule_has_mac_devices(schedule) {
for (let raw in schedule_list_value(schedule, "device_ip")) {
let device = trim(as_string(raw));
if (match(device, /^([0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}$/) != null)
return true;
}
for (let p_name in schedule_list_value(schedule, "profile")) {
let prof = ctx.uci_cursor().get_all(CONFIG_NAME, p_name);
if (prof != null && section_enabled(prof)) {
if (schedule_has_mac_devices(prof))
return true;
}
}
return false;
}
function schedule_blocked_domains(schedule) {
let result = [];
for (let domain in schedule_list_value(schedule, "blocked_domains")) {
@@ -942,7 +960,7 @@ function add_content_block_dns_inbound(config) {
push(config.inbounds, {
type: "direct",
tag: runtime_constants.DNS_BLOCK_INBOUND_TAG,
listen: runtime_constants.DNS_BLOCK_INBOUND_ADDRESS,
listen: core_ip.ipv6_supported() ? runtime_constants.DNS_BLOCK_INBOUND_ADDRESS : "0.0.0.0",
listen_port: runtime_constants.DNS_BLOCK_INBOUND_PORT
});
}
@@ -952,6 +970,7 @@ function add_content_block_dns_rules(config, schedules) {
for (let schedule in schedules) {
let mode = option(schedule, "mode", "block");
let sources = schedule_source_ip_cidrs(schedule);
let has_mac = schedule_has_mac_devices(schedule);
for (let raw_domain in schedule_blocked_domains(schedule)) {
let domain_value = trim(as_string(raw_domain));
if (domain_value == "")
@@ -966,7 +985,7 @@ function add_content_block_dns_rules(config, schedules) {
if (matchers[key] != null)
rule[key] = matchers[key];
}
if (length(sources) > 0)
if (length(sources) > 0 && !has_mac)
rule.source_ip_cidr = sources;
if (mode == "allow")
rule.invert = true;
@@ -1006,6 +1025,10 @@ function add_content_blocking(config) {
return;
add_content_block_dns_inbound(config);
unshift(config.route.rules, {
action: "hijack-dns",
inbound: [ runtime_constants.DNS_BLOCK_INBOUND_TAG ]
});
add_content_block_dns_rules(config, schedules);
add_content_block_dns_rules(config, profiles);
add_safesearch_dns_rules(config, safesearch_profiles);