xm/ShellCrash
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.6.13c

Browse Source 
~Tun网卡Redir-host及IPV6支持
~日志推送适配PashDeer
~增加ipv6出口本机IP屏蔽
~安装脚本优化，兼容zsh
This commit is contained in:
juewuy
2022-12-11 22:01:30 +08:00
parent 3f0475973c
commit 5ad7785eae
3 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
install.sh
View File

@@ -74,7 +74,7 @@ elif [ "$num" = "1" ];then
release_new=$(cat /tmp/clashrelease | head -1) release_new=$(cat /tmp/clashrelease | head -1)
url_dl="$url_cdn/$release_new" url_dl="$url_cdn/$release_new"
else else
echo "无法获取稳定版安装地址，将尝试安装公测版！" $echo "\033[33m无法获取稳定版安装地址，将尝试安装公测版！\033[0m"
fi fi
fi fi
[ -z "$url_dl" ] && url_dl=$url [ -z "$url_dl" ] && url_dl=$url
@@ -87,7 +87,11 @@ tarurl=$url_dl/bin/clashfm.tar.gz
gettar(){ gettar(){
webget /tmp/clashfm.tar.gz $tarurl webget /tmp/clashfm.tar.gz $tarurl
[ "$result" != "200" ] && echo "文件下载失败,请尝试使用其他安装源！" && exit 1 [ "$result" != "200" ] && {
$echo "\033[33m文件下载失败,请参考 \033[32mhttps://github.com/juewuy/ShellClash/blob/master/README_CN.md"
$echo "\033[33m使用其他安装源重新安装！\033[0m"
exit 1
}
$clashdir/start.sh stop 2>/dev/null $clashdir/start.sh stop 2>/dev/null
#解压 #解压
echo ----------------------------------------------- echo -----------------------------------------------
@@ -138,7 +142,7 @@ gettar(){
echo "export clashdir=\"$clashdir\"" >> ~/.zshrc echo "export clashdir=\"$clashdir\"" >> ~/.zshrc
} }
else else
echo 无法写入环境变量！请检查安装权限！ $echo "\033[33m无法写入环境变量！请检查安装权限！\033[0m"
exit 1 exit 1
fi fi
#梅林/Padavan额外设置 #梅林/Padavan额外设置

2
scripts/getdate.sh
View File

@@ -194,7 +194,7 @@ getlink2(){
read -p "请输入完整链接 > " link read -p "请输入完整链接 > " link
test=$(echo $link | grep -iE "tp.*://" ) test=$(echo $link | grep -iE "tp.*://" )
link=`echo ${link/\ \(*\)/''}` #删除恶心的超链接内容 link=`echo ${link/\ \(*\)/''}` #删除恶心的超链接内容
link=`echo ${link//\&/\%26}` #将分隔符 & 替换成urlcode：%26 link=`echo ${link//\&/\\\&}` #处理分隔符
if [ -n "$link" -a -n "$test" ];then if [ -n "$link" -a -n "$test" ];then
echo ----------------------------------------------- echo -----------------------------------------------
echo -e 请检查输入的链接是否正确： echo -e 请检查输入的链接是否正确：

29
scripts/start.sh
View File

@@ -414,11 +414,6 @@ EOF
sed -i "/^proxy-groups:/a\\$line #自定义策略组" $tmpdir/config.yaml sed -i "/^proxy-groups:/a\\$line #自定义策略组" $tmpdir/config.yaml
done done
fi fi
#tun/fake-ip防止流量回环
if [ "$redir_mod" = "混合模式" -o "$redir_mod" = "Tun模式" -o "$dns_mod" = "fake-ip" ];then
sed -i "/^rules:/a\\$space_rules- SRC-IP-CIDR,198.18.0.0/16,REJECT #自定义规则(防止回环)" $tmpdir/config.yaml
fi
#如果没有使用小闪存模式 #如果没有使用小闪存模式
if [ "$tmpdir" != "$bindir" ];then if [ "$tmpdir" != "$bindir" ];then
cmp -s $tmpdir/config.yaml $yaml >/dev/null 2>&1 cmp -s $tmpdir/config.yaml $yaml >/dev/null 2>&1
@@ -464,6 +459,7 @@ start_redir(){
[ -n "$host_lan" ] && iptables -t nat -A clash -d $host_lan -j RETURN [ -n "$host_lan" ] && iptables -t nat -A clash -d $host_lan -j RETURN
#绕过CN_IP #绕过CN_IP
[ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t nat -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t nat -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null
[ "$dns_mod" = "fake-ip" ] && iptables -t nat -A clash -s 198.18.0.0/16 -j RETURN
if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then
#mac白名单 #mac白名单
for mac in $(cat $clashdir/mac); do for mac in $(cat $clashdir/mac); do
@@ -497,7 +493,9 @@ start_redir(){
for mac in $(cat $clashdir/mac); do for mac in $(cat $clashdir/mac); do
ip6tables -t nat -A clashv6 -m mac --mac-source $mac -j RETURN ip6tables -t nat -A clashv6 -m mac --mac-source $mac -j RETURN
done done
[ -n "$wan_mac" ] && ip6tables -t nat -A clashv6 -m mac --mac-source $wan_mac -j RETURN #屏蔽本机出口网卡 for ip in $ipv6_wan ;do
ip6tables -t nat -A clashv6 -p tcp -s $ip -j RETURN #屏蔽本机ipv6地址
done
ip6tables -t nat -A clashv6 -p tcp $ports -j REDIRECT --to-ports $redir_port ip6tables -t nat -A clashv6 -p tcp $ports -j REDIRECT --to-ports $redir_port
fi fi
ip6tables -t nat -A PREROUTING -p tcp -j clashv6 ip6tables -t nat -A PREROUTING -p tcp -j clashv6
@@ -566,7 +564,7 @@ start_tproxy(){
iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN
[ -n "$host_lan" ] && iptables -t mangle -A clash -d $host_lan -j RETURN [ -n "$host_lan" ] && iptables -t mangle -A clash -d $host_lan -j RETURN
[ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null
[ "$dns_mod" = "fake-ip" ] && iptables -t mangle -A clash -s 198.18.0.0/16 -j RETURN
tproxy_set(){ tproxy_set(){
if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then
#mac白名单 #mac白名单
@@ -612,7 +610,9 @@ start_tproxy(){
for mac in $(cat $clashdir/mac); do for mac in $(cat $clashdir/mac); do
ip6tables -t mangle -A clashv6 -m mac --mac-source $mac -j RETURN ip6tables -t mangle -A clashv6 -m mac --mac-source $mac -j RETURN
done done
[ -n "$wan_mac" ] && ip6tables -t mangle -A clashv6 -m mac --mac-source $wan_mac -j RETURN #屏蔽本机出口网卡 for ip in $ipv6_wan ;do
ip6tables -t mangle -A clashv6 -p $1 -s $ip -j RETURN #屏蔽本机ipv6地址
done
ip6tables -t mangle -A clashv6 -p $1 -j TPROXY --on-port $tproxy_port --tproxy-mark 1 ip6tables -t mangle -A clashv6 -p $1 -j TPROXY --on-port $tproxy_port --tproxy-mark 1
fi fi
ip6tables -t mangle -A PREROUTING -p $1 $ports -j clashv6 ip6tables -t mangle -A PREROUTING -p $1 $ports -j clashv6
@@ -666,6 +666,7 @@ start_tun(){
modprobe tun &> /dev/null && { modprobe tun &> /dev/null && {
#允许流量 #允许流量
iptables -I FORWARD -o utun -j ACCEPT iptables -I FORWARD -o utun -j ACCEPT
iptables -I FORWARD -s 198.18.0.0/16 -o utun -j RETURN
#ip6tables -I FORWARD -o utun -j ACCEPT > /dev/null 2>&1 #ip6tables -I FORWARD -o utun -j ACCEPT > /dev/null 2>&1
#屏蔽QUIC #屏蔽QUIC
if [ "$quic_rj" = 已启用 ];then if [ "$quic_rj" = 已启用 ];then
@@ -695,6 +696,7 @@ start_tun(){
iptables -t mangle -A clash -d 192.168.0.0/16 -j RETURN iptables -t mangle -A clash -d 192.168.0.0/16 -j RETURN
iptables -t mangle -A clash -d 224.0.0.0/4 -j RETURN iptables -t mangle -A clash -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN iptables -t mangle -A clash -d 240.0.0.0/4 -j RETURN
iptables -t mangle -A clash -s 198.18.0.0/16 -j RETURN
[ -n "$host_lan" ] && iptables -t mangle -A clash -d $host_lan -j RETURN [ -n "$host_lan" ] && iptables -t mangle -A clash -d $host_lan -j RETURN
[ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && iptables -t mangle -A clash -m set --match-set cn_ip dst -j RETURN 2>/dev/null
if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then if [ "$macfilter_type" = "白名单" -a -n "$(cat $clashdir/mac)" ];then
@@ -733,6 +735,9 @@ start_tun(){
for mac in $(cat $clashdir/mac); do for mac in $(cat $clashdir/mac); do
ip6tables -t mangle -A clashv6 -m mac --mac-source $mac -j RETURN ip6tables -t mangle -A clashv6 -m mac --mac-source $mac -j RETURN
done done
for ip in $ipv6_wan ;do
ip6tables -t mangle -A clashv6 -s $ip -j RETURN #屏蔽本机ipv6地址
done
ip6tables -t mangle -A clashv6 -j MARK --set-mark 1 ip6tables -t mangle -A clashv6 -j MARK --set-mark 1
fi fi
ip6tables -t mangle -A PREROUTING -p udp $ports -j clashv6 ip6tables -t mangle -A PREROUTING -p udp $ports -j clashv6
@@ -776,7 +781,10 @@ start_nft(){
ip -6 rule add fwmark 1 table 101 2> /dev/null ip -6 rule add fwmark 1 table 101 2> /dev/null
ip -6 route add local ::/0 dev lo table 101 2> /dev/null ip -6 route add local ::/0 dev lo table 101 2> /dev/null
nft add rule inet shellclash prerouting ip6 daddr {${RESERVED_IP6}} return nft add rule inet shellclash prerouting ip6 daddr {${RESERVED_IP6}} return
[ -n "$wan_mac" ] && nft add rule inet shellclash prerouting ether saddr {${wan_mac}} return #屏蔽本机出口网卡 [ -n "$ipv6_wan" ] && {
LOCAL_IP6="{$(echo $ipv6_wan | sed s/\ /\,\ /g)}"
nft add rule inet shellclash prerouting ip6 daddr {${LOCAL_IP6}} return #屏蔽本机ipv6地址
}
else else
nft add rule inet shellclash prerouting meta nfproto ipv6 return nft add rule inet shellclash prerouting meta nfproto ipv6 return
fi fi
@@ -853,6 +861,7 @@ stop_firewall(){
iptables -t nat -X clash_dns 2> /dev/null iptables -t nat -X clash_dns 2> /dev/null
#tun #tun
iptables -D FORWARD -o utun -j ACCEPT 2> /dev/null iptables -D FORWARD -o utun -j ACCEPT 2> /dev/null
iptables -D FORWARD -s 198.18.0.0/16 -o utun -j RETURN 2> /dev/null
#屏蔽QUIC #屏蔽QUIC
[ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && set_cn_ip='-m set ! --match-set cn_ip dst' [ "$dns_mod" = "redir_host" -a "$cn_ip_route" = "已开启" ] && set_cn_ip='-m set ! --match-set cn_ip dst'
iptables -D INPUT -p udp --dport 443 -m comment --comment "ShellClash-QUIC-REJECT" $set_cn_ip -j REJECT 2> /dev/null iptables -D INPUT -p udp --dport 443 -m comment --comment "ShellClash-QUIC-REJECT" $set_cn_ip -j REJECT 2> /dev/null
@@ -1142,7 +1151,7 @@ afstart(){
fi fi
} }
#设置路由规则 #设置路由规则
wan_mac=$(ifconfig wan | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}') [ "$ipv6_redir" = "已开启" ] && ipv6_wan=$(ip addr show|grep -A1 'inet6 [^f:]'|grep -oE 'inet6 ([a-f0-9:]+)/'|sed s#inet6\ ##g|sed s#/##g)
[ "$redir_mod" = "Redir模式" ] && start_dns && start_redir [ "$redir_mod" = "Redir模式" ] && start_dns && start_redir
[ "$redir_mod" = "混合模式" ] && start_dns && start_redir && start_tun udp [ "$redir_mod" = "混合模式" ] && start_dns && start_redir && start_tun udp
[ "$redir_mod" = "Tproxy混合" ] && start_dns && start_redir && start_tproxy udp [ "$redir_mod" = "Tproxy混合" ] && start_dns && start_redir && start_tproxy udp