eric/proxy-station
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 限制边缘节点仅使用 IPv4 并记录维护约定

Browse Source
This commit is contained in:
杨建宽
2026-10-04 00:21:36 +08:00
parent 5326c572a2
commit 349ab8329e
8 changed files with 69 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
.claude/skills/edge-node-multi-protocol/scripts/08-xui-bootstrap.py
View File

@@ -107,22 +107,26 @@ TEMPLATE = {
"inbounds": [{"listen": "127.0.0.1", "port": 62789, "protocol": "dokodemo-door",
"settings": {"address": "127.0.0.1"}, "tag": "api"}],
"outbounds": [
{"protocol": "freedom", "settings": {}},
{"protocol": "freedom", "settings": {"domainStrategy": "ForceIPv4"},
"streamSettings": {"sockopt": {"domainStrategy": "ForceIPv4"}}},
{"tag": "warp-outbound", "protocol": "freedom",
"settings": {"domainStrategy": "UseIPv6v4"}, "proxySettings": {"tag": "warp-socks"}},
"settings": {"domainStrategy": "ForceIPv4"},
"streamSettings": {"sockopt": {"domainStrategy": "ForceIPv4"}},
"proxySettings": {"tag": "warp-socks"}},
{"tag": "warp-socks", "protocol": "socks",
"settings": {"servers": [{"address": "127.0.0.1", "port": WARP_SOCKS_PORT}]}},
{"protocol": "blackhole", "settings": {}, "tag": "blocked"},
],
"policy": {"system": {"statsInboundDownlink": True, "statsInboundUplink": True}},
"routing": {"rules": [
{"ip": ["::/0"], "outboundTag": "blocked", "type": "field"},
{"inboundTag": ["api"], "outboundTag": "api", "type": "field"},
{"inboundTag": [], "outboundTag": "warp-outbound", "type": "field"}, # tags filled in below
{"ip": ["geoip:private"], "outboundTag": "blocked", "type": "field"},
{"protocol": ["bittorrent"], "outboundTag": "blocked", "type": "field"},
]},
"stats": {},
"dns": {"servers": ["1.1.1.1"], "queryStrategy": "UseIP"},
"dns": {"servers": ["1.1.1.1"], "queryStrategy": "UseIPv4"},
}
@@ -258,6 +262,16 @@ def main():
# WARP routing rule: read-modify-write (fix #4) -- append, never clobber.
row = cur.execute("SELECT value FROM settings WHERE key='xrayTemplateConfig'").fetchone()
tmpl = json.loads(row[0]) if row else TEMPLATE
# Enforce the fleet's IPv4-only policy when extending an existing template too.
for outbound in tmpl["outbounds"]:
if outbound.get("protocol") == "freedom":
outbound.setdefault("settings", {})["domainStrategy"] = "ForceIPv4"
outbound.setdefault("streamSettings", {}).setdefault("sockopt", {})["domainStrategy"] = "ForceIPv4"
tmpl.setdefault("dns", {})["queryStrategy"] = "UseIPv4"
blocked_tag = next(o["tag"] for o in tmpl["outbounds"] if o.get("protocol") == "blackhole")
ipv6_rule = {"ip": ["::/0"], "outboundTag": blocked_tag, "type": "field"}
if ipv6_rule not in tmpl["routing"]["rules"]:
tmpl["routing"]["rules"].insert(0, ipv6_rule)
for rule in tmpl["routing"]["rules"]:
if rule.get("outboundTag") == "warp-outbound":
for t in warp_tags:
@@ -269,7 +283,8 @@ def main():
cur.execute("INSERT INTO settings (key, value) VALUES ('xrayTemplateConfig', ?)", (json.dumps(tmpl, ensure_ascii=False),))
conn.commit()
conn.close()
print(" xrayTemplateConfig written, warp rule tags:", tmpl["routing"]["rules"][1]["inboundTag"])
print(" xrayTemplateConfig written, warp rule tags:",
next(r["inboundTag"] for r in tmpl["routing"]["rules"] if r.get("outboundTag") == "warp-outbound"))
subprocess.run(["systemctl", "restart", "x-ui"], check=True)
time.sleep(6)