add ACL control support

Ref: coolsnowwolf/lede@1846bd9

Makefile

@@ -12,7 +12,7 @@ LUCI_DEPENDS:=+bash +busybox +coreutils-nohup +curl +dnsmasq-full +ipset +libope
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-unblockneteasemusic
 PKG_VERSION:=2.8
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_MAINTAINER:=[CTCGFW]Project-OpenWrt
 

README.md

@@ -63,6 +63,7 @@
 ## 鸣谢
 ##### [UnblockNeteaseMusic](https://github.com/nondanee/UnblockNeteaseMusic)的开发者：[nondanee](https://github.com/nondanee)
 ##### [luci-app-unblockmusic](https://github.com/maxlicheng/luci-app-unblockmusic)的开发者：[maxlicheng](https://github.com/maxlicheng)
-##### IPSet劫持方式指导：[恩山692049#125楼](https://www.right.com.cn/forum/forum.php?mod=viewthread&tid=692049&page=9#pid4104303) [Lean](https://github.com/coolsnowwolf/lede/tree/master/package/lean/luci-app-unblockmusic) [rufengsuixing](https://github.com/rufengsuixing/luci-app-unblockmusic) [binsee](https://github.com/binsee/luci-app-unblockmusic)
+##### [luci-app-unblockmusic（二次修改）](https://github.com/coolsnowwolf/lede/tree/master/package/lean/luci-app-unblockmusic)的开发者：[Lean](https://github.com/coolsnowwolf)
+##### IPSet劫持方式指导：[恩山692049#125楼](https://www.right.com.cn/forum/forum.php?mod=viewthread&tid=692049&page=9#pid4104303) [rufengsuixing](https://github.com/rufengsuixing/luci-app-unblockmusic) [binsee](https://github.com/binsee/luci-app-unblockmusic)
 ##### Hosts劫持方式指导：[UnblockNeteaseMusic](https://github.com/nondanee/UnblockNeteaseMusic) [云音乐安卓又搞事啦](https://jixun.moe/post/netease-android-hosts-bypass/)
 ##### 核心程序版本检测方法指导：[vernesong](https://github.com/vernesong)

luasrc/model/cbi/unblockneteasemusic.lua

@@ -167,4 +167,28 @@ self_issue_cert_key.placeholder = "/usr/share/unblockneteasemusic/core/server.ke
 self_issue_cert_key.datatype = "file"
 self_issue_cert_key:depends("advanced_mode", 1)
 
+acl_rule = mp:section(TypedSection,"acl_rule",translate("例外客户端规则"), translate("可以为局域网客户端分别设置不同的例外模式，默认无需设置"))
+acl_rule.template="cbi/tblsection"
+acl_rule.sortable=true
+acl_rule.anonymous=true
+acl_rule.addremove=true
+
+acl_ip_addr=acl_rule:option(Value, "acl_ip_addr", translate("IP 地址"))
+acl_ip_addr.width = "40%"
+acl_ip_addr.datatype = "ip4addr"
+acl_ip_addr.placeholder = "0.0.0.0/0"
+luci.ip.neighbors({ family = 4 }, function(entry)
+	if entry.reachable then
+		acl_ip_addr:value(entry.dest:string())
+	end
+end)
+
+acl_filter_mode = acl_rule:option(ListValue, "acl_filter_mode", translate("规则"))
+acl_filter_mode.width = "40%"
+acl_filter_mode.default = "disable_all"
+acl_filter_mode.rmempty = false
+acl_filter_mode:value("disable_all", translate("不代理HTTP和HTTPS"))
+acl_filter_mode:value("disable_http", translate("不代理HTTP"))
+acl_filter_mode:value("disable_https", translate("不代理HTTPS"))
+
 return mp

root/etc/config/unblockneteasemusic

@@ -21,3 +21,7 @@ config unblockneteasemusic
 	option proxy_server_ip ''
 	option self_issue_cert_crt '/usr/share/unblockneteasemusic/core/server.crt'
 	option self_issue_cert_key '/usr/share/unblockneteasemusic/core/server.key'
+
+config acl_rule
+	option ip_addr ''
+	option filter_mode 'disable_all'

root/etc/init.d/unblockneteasemusic

@@ -5,40 +5,59 @@
 START=80
 STOP=10
 
+NAME="unblockneteasemusic"
+
+uci_get_by_type() {
+	local "ret"
+	ret="$(uci get "$NAME".@"$1"[0]."$2" 2>/dev/null)"
+	echo "${ret:=$3}"
+}
+
+uci_get_by_name() {
+	local "index"
+	index=0
+	if [ -n "$4" ]; then
+		index="$4"
+	fi
+	ret="$(uci get "$NAME".@"$1"["${index}"]."$2" 2>/dev/null)"
+	echo "${ret:=$3}"
+}
+
 lan_addr="$(uci get network.lan.ipaddr)"
 
-enable="$(uci get unblockneteasemusic.@unblockneteasemusic[0].enable)"
+enable="$(uci_get_by_type "unblockneteasemusic" "enable" "0")"
 
-music_source="$(uci get unblockneteasemusic.@unblockneteasemusic[0].music_source)"
-neteasemusic_cookie="$(uci get unblockneteasemusic.@unblockneteasemusic[0].neteasemusic_cookie 2>"/dev/null")"
-qq_cookie="$(uci get unblockneteasemusic.@unblockneteasemusic[0].qq_cookie 2>"/dev/null")"
-youtube_key="$(uci get unblockneteasemusic.@unblockneteasemusic[0].youtube_key 2>"/dev/null")"
+music_source="$(uci_get_by_type "unblockneteasemusic" "music_source" "default")"
+neteasemusic_cookie="$(uci_get_by_type "unblockneteasemusic" "neteasemusic_cookie")"
+qq_cookie="$(uci_get_by_type "unblockneteasemusic" "qq_cookie")"
+youtube_key="$(uci_get_by_type "unblockneteasemusic" "youtube_key")"
 
-enable_flac="$(uci get unblockneteasemusic.@unblockneteasemusic[0].enable_flac)"
+enable_flac="$(uci_get_by_type "unblockneteasemusic" "enable_flac" "0")"
 [ "${enable_flac}" -eq "1" ] && flag_arg="ENABLE_FLAC=true"
 
-endpoint_url="$(uci get unblockneteasemusic.@unblockneteasemusic[0].endpoint_url || echo "http://music.163.com")"
-hijack_ways="$(uci get unblockneteasemusic.@unblockneteasemusic[0].hijack_ways || echo "use_ipset")"
+endpoint_url="$(uci_get_by_type "unblockneteasemusic" "endpoint_url" "http://music.163.com")"
+hijack_ways="$(uci_get_by_type "unblockneteasemusic" "hijack_ways" "use_ipset")"
 
-auto_update="$(uci get unblockneteasemusic.@unblockneteasemusic[0].auto_update)"
-update_time="$(uci get unblockneteasemusic.@unblockneteasemusic[0].update_time)"
+auto_update="$(uci_get_by_type "unblockneteasemusic" "auto_update" "1")"
+update_time="$(uci_get_by_type "unblockneteasemusic" "update_time" "3")"
 
-http_port="$(uci get unblockneteasemusic.@unblockneteasemusic[0].http_port 2>"/dev/null" || echo "5200")"
-https_port="$(uci get unblockneteasemusic.@unblockneteasemusic[0].https_port 2>"/dev/null" || echo "5201")"
+http_port="$(uci_get_by_type "unblockneteasemusic" "http_port" "5200")"
+https_port="$(uci_get_by_type "unblockneteasemusic" "https_port" "5201")"
 
-keep_core_when_upgrade="$(uci get unblockneteasemusic.@unblockneteasemusic[0].keep_core_when_upgrade 2>"/dev/null")"
-[ "*$(uci get unblockneteasemusic.@unblockneteasemusic[0].pub_access 2>"/dev/null")*" = "*1*" ] && addr="0.0.0.0" || addr="${lan_addr}"
-[ "*$(uci get unblockneteasemusic.@unblockneteasemusic[0].strict_mode 2>"/dev/null")*" = "*1*" ] && strict_mode="-s"
+keep_core_when_upgrade="$(uci_get_by_type "unblockneteasemusic" keep_core_when_upgrade)"
+[ "$(uci_get_by_type "unblockneteasemusic" "pub_access")" = "1" ] && addr="0.0.0.0" || addr="${lan_addr}"
+[ "$(uci_get_by_type "unblockneteasemusic" "strict_mode")" = "1" ] && strict_mode="-s"
 
-netease_server_ip="$(uci get unblockneteasemusic.@unblockneteasemusic[0].netease_server_ip 2>"/dev/null")"
+netease_server_ip="$(uci_get_by_type "unblockneteasemusic" "netease_server_ip")"
 [ -n "${netease_server_ip}" ] && netease_server_ip="-f ${netease_server_ip}"
-proxy_server_ip="$(uci get unblockneteasemusic.@unblockneteasemusic[0].proxy_server_ip 2>"/dev/null")"
+proxy_server_ip="$(uci_get_by_type "unblockneteasemusic" "proxy_server_ip")"
 [ -n "${proxy_server_ip}" ] && proxy_server_ip="-u ${proxy_server_ip}"
 
-self_issue_cert_crt="$(uci get unblockneteasemusic.@unblockneteasemusic[0].self_issue_cert_crt 2>"/dev/null")"
-self_issue_cert_key="$(uci get unblockneteasemusic.@unblockneteasemusic[0].self_issue_cert_key 2>"/dev/null")"
+self_issue_cert_crt="$(uci_get_by_type "unblockneteasemusic" "self_issue_cert_crt")"
+self_issue_cert_key="$(uci_get_by_type "unblockneteasemusic" "self_issue_cert_key")"
 
-set_ipset(){
+set_ipset()
+{
 	if [ "${set_type}" = "start" ]; then
 		mkdir -p "/tmp/dnsmasq.d"
 		rm -f "/tmp/dnsmasq.d/dnsmasq-unblockneteasemusic.conf"
@@ -54,6 +73,28 @@ ipset=/clientlog3.music.163.com/neteasemusic
 		EOF
 		/etc/init.d/dnsmasq reload > "/dev/null" 2>&1
 
+		if ! ipset list "acl_neteasemusic_http" > "/dev/null"; then ipset create "acl_neteasemusic_http" hash:ip; fi
+		if ! ipset list "acl_neteasemusic_https" > "/dev/null"; then ipset create "acl_neteasemusic_https" hash:ip; fi
+		ip_addr_num="$(uci show "unblockneteasemusic" | grep -c "filter_mode")"
+		let ip_addr_num="ip_addr_num-1"
+		[ "${ip_addr_num}" -ge "0" ] && for i in $(seq 0 "${ip_addr_num}")
+		do
+			ip_addr="$(uci_get_by_name "acl_rule" "ip_addr" "" "$i")"
+			filter_mode="$(uci_get_by_name "acl_rule" "filter_mode" "" "$i")"
+			case "${filter_mode}" in
+			"disable_http")
+				ipset -! add "acl_neteasemusic_http" "${ip_addr}"
+				;;
+			"disable_https")
+				ipset -! add "acl_neteasemusic_https" "${ip_addr}"
+				;;
+			"disable_all")
+				ipset -! add "acl_neteasemusic_http" "${ip_addr}"
+				ipset -! add "acl_neteasemusic_https" "${ip_addr}"
+				;;
+			esac
+		done
+
 		if ! ipset list "neteasemusic" > "/dev/null"; then ipset create "neteasemusic" hash:ip; fi
 		curl --retry "5" --retry-delay "3" -s "http://httpdns.n.netease.com/httpdns/v2/d?domain=music.163.com,interface.music.163.com,interface3.music.163.com,apm.music.163.com,apm3.music.163.com,clientlog.music.163.com,clientlog3.music.163.com" |grep -Eo '[0-9]+?\.[0-9]+?\.[0-9]+?\.[0-9]+?' |sort |uniq |awk '{print "ipset add neteasemusic "$1}' |bash > "/dev/null" 2>&1
 		iptables -t nat -N "netease_cloud_music"
@@ -65,11 +106,11 @@ ipset=/clientlog3.music.163.com/neteasemusic
 		iptables -t nat -A "netease_cloud_music" -d "192.168.0.0/16" -j RETURN
 		iptables -t nat -A "netease_cloud_music" -d "224.0.0.0/4" -j RETURN
 		iptables -t nat -A "netease_cloud_music" -d "240.0.0.0/4" -j RETURN
-		iptables -t nat -A "netease_cloud_music" -p tcp --dport 80 -j REDIRECT --to-ports "${http_port}"
-		iptables -t nat -A "netease_cloud_music" -p tcp --dport 443 -j REDIRECT --to-ports "${https_port}"
+		iptables -t nat -A "netease_cloud_music" -p tcp -m set ! --match-set "acl_neteasemusic_http" src --dport 80 -j "REDIRECT" --to-ports "${http_port}"
+		iptables -t nat -A "netease_cloud_music" -p tcp -m set ! --match-set "acl_neteasemusic_https" src --dport 443 -j "REDIRECT" --to-ports "${https_port}"
 		iptables -t nat -I PREROUTING -p tcp -m set --match-set "neteasemusic" dst -j "netease_cloud_music"
-		[ -z "$(iptables -t nat -L "ADBYBY" | grep "UnblockMusic" | sed 's/\/.*//')" ] && iptables -t nat -I "ADBYBY" -m set --match-set "neteasemusic" dst -j RETURN -m comment --comment "AD for UnblockMusic"
-		[ -z "$(iptables -t nat -L "KOOLPROXY" | grep "UnblockMusic" | sed 's/\/.*//')" ] && iptables -t nat -I "KOOLPROXY" -m set --match-set "neteasemusic" dst -j RETURN -m comment --comment "KP for UnblockMusic"
+		[ -z "$(iptables -t nat -L "ADBYBY" | grep "UnblockMusic" | sed 's/\/.*//')" ] && iptables -t nat -I "ADBYBY" -m "set" --match-set "neteasemusic" dst -j "RETURN" -m "comment" --comment "AD for UnblockMusic"
+		[ -z "$(iptables -t nat -L "KOOLPROXY" | grep "UnblockMusic" | sed 's/\/.*//')" ] && iptables -t nat -I "KOOLPROXY" -m "set" --match-set "neteasemusic" "dst" -j "RETURN" -m "comment" --comment "KP for UnblockMusic"
 
 		mkdir -p "/var/etc/"
 		echo "/etc/init.d/unblockneteasemusic restart" > "/var/etc/unblockneteasemusic.include"
@@ -80,6 +121,8 @@ ipset=/clientlog3.music.163.com/neteasemusic
 		iptables -t nat -F "netease_cloud_music"
 		iptables -t nat -X "netease_cloud_music"
 		ipset destroy "neteasemusic"
+		ipset destroy "acl_neteasemusic_http"
+		ipset destroy "acl_neteasemusic_https"
 
 		echo "" > "/var/etc/unblockneteasemusic.include"
 		rm -f "/tmp/dnsmasq.d/dnsmasq-unblockneteasemusic.conf"
@@ -87,7 +130,8 @@ ipset=/clientlog3.music.163.com/neteasemusic
 	fi
 }
 
-set_hosts(){
+set_hosts()
+{
 	if [ "${set_type}" = "start" ]; then
 		mkdir -p "/tmp/dnsmasq.d"
 		rm -f "/tmp/dnsmasq.d/dnsmasq-unblockneteasemusic.conf"
@@ -113,7 +157,8 @@ address=/music.httpdns.c.163.com/0.0.0.0
 	fi
 }
 
-set_ports(){
+set_ports()
+{
 	if [ "${set_type}" = "start" ]; then
 		iptables -I INPUT -p tcp --dport "${http_port}" -j ACCEPT
 		iptables -I INPUT -p tcp --dport "${https_port}" -j ACCEPT
@@ -174,7 +219,7 @@ start()
 		set_hosts > "/dev/null" 2>&1
 	fi
 
-	[ "*$(uci get unblockneteasemusic.@unblockneteasemusic[0].pub_access 2>"/dev/null")*" = "*1*" ] && set_ports > "/dev/null" 2>&1
+	[ "$(uci_get_by_type "unblockneteasemusic" pub_access)" = "1" ] && set_ports > "/dev/null" 2>&1
 
 	sed -i '/unblockneteasemusic/d' /etc/crontabs/root
 	[ "${auto_update}" -eq "1" ] && echo "0 ${update_time} * * * /usr/share/unblockneteasemusic/update.sh update_core" >> "/etc/crontabs/root"