dsh-vpn 0.1.2 → 0.1.3

package/README.md

@@ -25,7 +25,24 @@ dsh plugin --profile web add dsh-vpn
 1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。
 2. 勾选要安装的协议，选择证书类型（推荐「IP 证书」），保存后点「安装 / 更新」。
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
-4. 在云服务商控制台的安全组里放行页面提示的端口。用 IP 证书时，TCP 80 端口要一直开放，用于续期。
+4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
+
+## 防火墙
+
+安装时插件会检测 VPS 上启用的防火墙，自动放行所选协议的端口（使用 IP 证书时还有 TCP 80）：
+
+| 防火墙 | 做法 |
+|---|---|
+| ufw | `ufw allow` |
+| firewalld | 放行端口（永久规则和运行时规则都加） |
+| iptables（如 Oracle Cloud 镜像自带的 REJECT 规则） | 在 INPUT 链最前面插入放行规则，带 `dsh-vpn` 标签 |
+| nftables（原生规则集） | 在各个 input 链插入放行规则，带 `dsh-vpn` 标签 |
+| 没有启用防火墙 | 不做任何改动 |
+
+- 规则写在 `/etc/dsh-vpn/firewall.sh` 里，服务每次启动都会重新应用，所以 iptables/nftables 规则重启后也还在。
+- 重新安装时，先关闭上次放行的端口，再放行新的，所以取消勾选的协议端口会被关掉。卸载时会删除插件添加的所有规则。
+- 插件只添加和删除自己的规则，从不启用防火墙、修改默认策略或改动 SSH 端口。
+- **云服务商的安全组**（阿里云、腾讯云、AWS 等）在服务器外部，只能在服务商控制台修改，插件改不了；如果有安全组，仍需在控制台放行同样的端口。
 
 ## 证书
 
@@ -100,6 +117,12 @@ limactl start --name=vps --vm-type=vz --network=vzNAT --set '.mounts=[]' templat
 DSH_VPN_E2E_HOST=192.168.64.2 DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
 ```
 
+防火墙测试会依次启用 ufw、firewalld、iptables、nftables，**只能在测试虚拟机上运行**：
+
+```bash
+DSH_VPN_E2E_FIREWALL=1 DSH_VPN_E2E_HOST=… DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
+```
+
 IP 证书的测试需要一个本地 ACME 服务器，用 Let's Encrypt 官方的 [Pebble](https://github.com/letsencrypt/pebble) 模拟。**只能在测试虚拟机上运行**，因为它会把 Pebble 的根证书加入系统信任：
 
 ```bash
@@ -116,6 +139,6 @@ DSH_VPN_E2E_ACME=https://localhost:14000/dir DSH_VPN_E2E_HOST=… pnpm test:e2e
 - [ ] 可自定义 Reality 的 SNI、协议端口
 - [ ] 证书使用自己的域名（DNS 验证：Cloudflare / 阿里云）
 - [ ] IPv6 的 IP 证书（目前只在 IPv4 上验证过）
-- [ ] 支持 OpenRC（Alpine）和 iptables/nftables
+- [ ] 支持 OpenRC（Alpine）
 - [ ] 支持 GitHub 下载镜像
 - [ ] 在真实 VPS 上跑端到端测试（Debian 12 / Ubuntu 24.04 / Rocky 9）

package/assets/vpn-ops.md

@@ -9,7 +9,7 @@ Deploy and operate a personal sing-box server on the user's VPS. The plugin logs
    - Installed and active → offer `vpn_links` instead of reinstalling.
 2. **Install.** Call `vpn_install`. Omit `protocols` to use the selection saved in settings. Only pass `regenerate: true` when the user explicitly wants new keys, because every old link stops working.
 3. **Deliver.** Say the links are ready and that 设置 → VPN 设置 shows scannable QR codes (刷新二维码 button). Client apps: v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta / mihomo.
-4. **Remind** the user to open the reported ports in the cloud provider's security group, using the right transport for each protocol.
+4. **Firewall.** Install opens the ports in the VPS's own firewall automatically (ufw, firewalld, iptables or nftables; see `result.firewall`) and re-applies them after reboots. Don't ask the user to do that. Only mention that a cloud security group (Aliyun, Tencent Cloud, AWS…), which sits outside the server, may still need the same ports opened in the provider console.
 
 ## Certificates
 
@@ -38,7 +38,7 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 | `cert_failed` | IP certificate not issued (usually port 80 closed). The node fell back to self-signed and still works | Open TCP 80 in the security group, then install again |
 | `port80_in_use` | Another program (nginx, …) holds port 80 | Stop it, or use self-signed |
 | Status says the certificate expires within 24 h or has expired | Renewal failing | Open TCP 80; an expired certificate breaks every TLS protocol |
-| Installed and active, but the client times out | Cloud security group or upstream firewall | Open the TCP/UDP ports in the cloud console |
+| Installed and active, but the client times out | Cloud security group (the VPS firewall is handled automatically) | Open the ports from `result.firewall.opened` in the cloud console |
 | Reality fails, others work | SNI site blocked | Reinstall with another SNI (future option) |
 | UDP protocols fail, TCP works | ISP blocks or throttles UDP | Use Reality or AnyTLS |
 | Everything stopped after working | IP blocked | `vpn_install` with `regenerate: true` for new ports; if it is still blocked, the IP must change |

package/lib/client.js

@@ -124,7 +124,10 @@ var zh = {
   copy: "\u590D\u5236\u94FE\u63A5",
   copied: "\u5DF2\u590D\u5236",
   portLabel: "\u7AEF\u53E3 {port}",
-  cloudFirewall: "\u63D0\u9192\uFF1A\u8FD8\u9700\u8981\u5728\u4E91\u670D\u52A1\u5546\u63A7\u5236\u53F0\u7684\u5B89\u5168\u7EC4\u91CC\u653E\u884C\u4EE5\u4E0B\u7AEF\u53E3\uFF1A{ports}",
+  fwOpened: "\u5DF2\u81EA\u52A8\u5728\u670D\u52A1\u5668\u9632\u706B\u5899\uFF08{backend}\uFF09\u653E\u884C\u7AEF\u53E3\uFF1A{ports}\u3002",
+  fwNone: "\u670D\u52A1\u5668\u6CA1\u6709\u542F\u7528\u9632\u706B\u5899\uFF0C\u7AEF\u53E3\u65E0\u9700\u653E\u884C\u3002",
+  fwStatus: "\u670D\u52A1\u5668\u9632\u706B\u5899\uFF08{backend}\uFF09\u5DF2\u653E\u884C {count} \u4E2A\u7AEF\u53E3\uFF0C\u91CD\u542F\u540E\u81EA\u52A8\u6062\u590D\u3002",
+  cloudHint: "\u5982\u679C\u4E91\u670D\u52A1\u5546\u6709\u5B89\u5168\u7EC4\uFF08\u963F\u91CC\u4E91\u3001\u817E\u8BAF\u4E91\u3001AWS \u7B49\uFF09\uFF0C\u8FD9\u4E9B\u7AEF\u53E3\u8FD8\u9700\u5728\u5176\u63A7\u5236\u53F0\u653E\u884C\u3002",
   "err.not_configured": "\u8BF7\u5148\u586B\u5199\u5E76\u4FDD\u5B58\u670D\u52A1\u5668\u4FE1\u606F\u3002",
   "err.auth_failed": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF\u3002",
   "err.host_key_mismatch": "\u670D\u52A1\u5668\u6307\u7EB9\u4E0E\u4E0A\u6B21\u4E0D\u540C\uFF0C\u5DF2\u62D2\u7EDD\u8FDE\u63A5\u3002\u5982\u679C\u4F60\u91CD\u88C5\u4E86\u7CFB\u7EDF\u6216\u6362\u4E86\u673A\u5668\uFF0C\u8BF7\u70B9\u300C\u91CD\u7F6E\u6307\u7EB9\u300D\u540E\u91CD\u8BD5\u3002",
@@ -212,7 +215,10 @@ var en = {
   copy: "Copy link",
   copied: "Copied",
   portLabel: "Port {port}",
-  cloudFirewall: "Reminder: also open these ports in your cloud provider's security group: {ports}",
+  fwOpened: "Opened in the server firewall ({backend}): {ports}.",
+  fwNone: "The server has no firewall enabled; nothing to open.",
+  fwStatus: "Server firewall ({backend}) has {count} ports opened; re-applied after reboots.",
+  cloudHint: "If your cloud provider has a security group (Aliyun, Tencent Cloud, AWS\u2026), also open these ports in its console.",
   "err.not_configured": "Fill in and save the server details first.",
   "err.auth_failed": "SSH login failed: wrong username or password.",
   "err.host_key_mismatch": 'The server fingerprint changed, so the connection was refused. If you reinstalled or replaced the server, click "Reset fingerprint" and retry.',
@@ -1015,10 +1021,6 @@ function formOf(s) {
   return { host: s.host, port: s.port, username: s.username, password: "", protocols: [...s.protocols], certMode: s.certMode, linkAddress: s.linkAddress };
 }
 var sameForm = (a, b) => a.host === b.host && a.port === b.port && a.username === b.username && a.password === b.password && a.linkAddress === b.linkAddress && a.certMode === b.certMode && a.protocols.join() === [...b.protocols].join();
-function transportsFor(id) {
-  const t = PROTOCOLS.find((p) => p.id === id)?.transport ?? "TCP";
-  return t === "TCP+UDP" ? ["tcp", "udp"] : [t.toLowerCase()];
-}
 function Checkbox({ label, checked, disabled, onChange }) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-checkbox", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", checked, disabled, onChange: (e) => {
@@ -1107,19 +1109,22 @@ function VpnSettingsPage({ view, t, api }) {
       setForm((f) => f && { ...f });
     }
   };
-  const portsReminder = (l) => t("cloudFirewall", {
-    ports: [
-      ...l.items.map((i) => transportsFor(i.id).map((tr) => `${i.port}/${tr.toUpperCase()}`).join(" ")),
-      ...l.cert === "ip" ? ["80/TCP"] : []
-    ].join(", ")
-  });
+  const firewallNotice = (result) => {
+    const fw = result?.firewall;
+    if (!fw?.backend || fw.backend === "unknown") return "";
+    const ports = (fw.opened ?? []).map((p) => p.toUpperCase()).join(", ");
+    const line = fw.backend === "none" ? t("fwNone") : t("fwOpened", { backend: fw.backend, ports });
+    return `
+${line}
+${t("cloudHint")}`;
+  };
   const install = async () => {
     const r = await op("install", () => api.install(regenerate), (v) => {
       if (v.links) {
         setLinks(v.links);
         setRefreshedAt(/* @__PURE__ */ new Date());
       }
-      return { tone: "success", text: `${t("installed")} ${v.links ? portsReminder(v.links) : ""}` };
+      return { tone: "success", text: `${t("installed")}${firewallNotice(v.result)}` };
     });
     if (!r.ok && r.links) setLinks(r.links);
     setRegenerate(false);
@@ -1304,8 +1309,11 @@ ${t("certNotIssued")}` : hours < 0 ? `
 ${t("certExpired")}` : hours < 24 ? `
 ${t("certExpiring", { hours })}` : `
 ${t("certExpires", { date: new Date(cert.expires ?? "").toLocaleString(), hours })}`;
+                const fw = res.firewall;
+                const fwLine = !fw?.backend || fw.backend === "unknown" ? "" : `
+${fw.backend === "none" ? t("fwNone") : t("fwStatus", { backend: fw.backend, count: fw.opened?.length ?? 0 })}`;
                 const healthy = res.active === true && !certProblem;
-                return { tone: healthy ? "success" : "error", text: `${head} ${t("listening")}: ${listening}${certLine}` };
+                return { tone: healthy ? "success" : "error", text: `${head} ${t("listening")}: ${listening}${certLine}${fwLine}` };
               });
             },
             children: t("status")

package/lib/index.js

@@ -20751,7 +20751,7 @@ function apply(ctx, config) {
   const service = new VpnService(new CredentialSettingsStore(ctx), { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider });
   ctx.tools.register(defineTool({
     name: "vpn_install",
-    description: `Install or reconfigure sing-box on the VPS configured in dsh Settings \u2192 VPN, then return share links. Idempotent: rerunning keeps existing keys and ports unless \`regenerate\` is set. Protocols: ${PROTOCOL_IDS.join(", ")}; omit to use the ones selected in settings.`,
+    description: `Install or reconfigure sing-box on the VPS configured in dsh Settings \u2192 VPN, then return share links. Opens the ports in the VPS firewall automatically (result.firewall). Idempotent: rerunning keeps existing keys and ports unless \`regenerate\` is set. Protocols: ${PROTOCOL_IDS.join(", ")}; omit to use the ones selected in settings.`,
     parameters: {
       protocols: {
         type: "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "DeepSeek Harness plugin: one-click sing-box deployment to a VPS over SSH, with a settings page and QR codes",
   "keywords": [
     "dsh-plugin",

package/scripts/vpn.sh

@@ -400,6 +400,7 @@ After=network-online.target
 Wants=network-online.target
 
 [Service]
+ExecStartPre=-/bin/bash $FW_FILE open
 ExecStart=$BIN run -c $CONFIG_FILE
 Restart=on-failure
 RestartSec=3
@@ -429,22 +430,149 @@ protocol_transports() {
 
 protocol_port() { local var; var="$(echo "$1" | tr '[:lower:]' '[:upper:]')_PORT"; echo "${!var}"; }
 
-open_firewall() {
+# Host firewall. The rules live in a generated $FW_FILE so that the service
+# can re-apply them on every start (raw iptables/nftables rules do not survive
+# a reboot by themselves) and so that a later install or uninstall can close
+# exactly the ports this one opened. Cloud security groups sit outside the VPS
+# and cannot be changed from here.
+FW_FILE=$STATE_DIR/firewall.sh
+
+write_fw_script() {
+  {
+    printf '#!/usr/bin/env bash\n# Generated by dsh-vpn. Usage: firewall.sh open|close|backend\n'
+    printf 'RULES="%s"\n' "$1"
+    cat <<'FWEOF'
+TAG=dsh-vpn
+set -u
+have() { command -v "$1" >/dev/null 2>&1; }
+ufw_active() { have ufw && ufw status 2>/dev/null | grep -q '^Status: active'; }
+firewalld_active() { have firewall-cmd && firewall-cmd --state >/dev/null 2>&1; }
+# iptables (legacy or iptables-nft) whose INPUT drops or rejects something.
+ipt_blocks() { have "$1" && "$1" -S INPUT 2>/dev/null | grep -qE '^-P INPUT (DROP|REJECT)|-j (DROP|REJECT)'; }
+# Native nftables base chains on the input hook (iptables-nft's own tables excluded).
+nft_input_chains() {
+  have nft || return 0
+  local fam tbl ch
+  nft list chains 2>/dev/null | awk '/^table /{f=$2;t=$3} /^[[:space:]]*chain /{c=$2} /hook input/{print f, t, c}' |
+  while read -r fam tbl ch; do
+    nft list table "$fam" "$tbl" 2>/dev/null | grep -q 'managed by iptables-nft' || echo "$fam $tbl $ch"
+  done
+}
+nft_blocks() {
+  local fam tbl ch
+  while read -r fam tbl ch; do
+    [ -n "$fam" ] && nft list chain "$fam" "$tbl" "$ch" 2>/dev/null | grep -qE 'policy drop|[[:space:]](drop|reject)' && return 0
+  done < <(nft_input_chains)
+  return 1
+}
+backend() {
+  if ufw_active; then echo ufw; return; fi
+  if firewalld_active; then echo firewalld; return; fi
+  local b=""
+  { ipt_blocks iptables || ipt_blocks ip6tables; } && b=iptables
+  nft_blocks && b="${b:+$b+}nftables"
+  echo "${b:-none}"
+}
+ipt_close() {
+  local t rule
+  for t in iptables ip6tables; do
+    have "$t" || continue
+    "$t" -S INPUT 2>/dev/null | grep -- "--comment $TAG" | sed 's/^-A /-D /' | while read -r rule; do
+      eval "$t $rule" 2>/dev/null || true
+    done
+  done
+}
+nft_close() {
+  local fam tbl ch h
+  while read -r fam tbl ch; do
+    [ -n "$fam" ] || continue
+    nft -a list chain "$fam" "$tbl" "$ch" 2>/dev/null | grep "comment \"$TAG\"" | sed -n 's/.*# handle \([0-9]*\).*/\1/p' |
+    while read -r h; do nft delete rule "$fam" "$tbl" "$ch" handle "$h" 2>/dev/null || true; done
+  done < <(nft_input_chains)
+}
+close_all() {
+  local r
+  if have ufw; then for r in $RULES; do ufw delete allow "$r" >/dev/null 2>&1 || true; done; fi
+  if firewalld_active; then
+    for r in $RULES; do
+      firewall-cmd -q --permanent --remove-port="$r" 2>/dev/null || true
+      firewall-cmd -q --remove-port="$r" 2>/dev/null || true
+    done
+  fi
+  ipt_close
+  nft_close
+}
+open_all() {
+  local b r t port proto fam tbl ch
+  b=$(backend)
+  case "$b" in
+    ufw) for r in $RULES; do ufw allow "$r" comment "$TAG" >/dev/null 2>&1 || ufw allow "$r" >/dev/null; done ;;
+    firewalld)
+      for r in $RULES; do
+        firewall-cmd -q --permanent --add-port="$r" || true
+        firewall-cmd -q --add-port="$r" || true
+      done ;;
+    none) ;;
+    *)
+      ipt_close; nft_close  # re-add cleanly (idempotent across service restarts)
+      for r in $RULES; do
+        port=${r%/*}; proto=${r#*/}
+        if [[ $b == *iptables* ]]; then
+          for t in iptables ip6tables; do
+            have "$t" && "$t" -I INPUT 1 -p "$proto" --dport "$port" -m comment --comment "$TAG" -j ACCEPT 2>/dev/null || true
+          done
+        fi
+        if [[ $b == *nftables* ]]; then
+          while read -r fam tbl ch; do
+            [ -n "$fam" ] && nft insert rule "$fam" "$tbl" "$ch" "$proto" dport "$port" accept comment "\"$TAG\"" 2>/dev/null || true
+          done < <(nft_input_chains)
+        fi
+      done ;;
+  esac
+  echo "backend=$b"
+}
+case "${1:-}" in
+  open) open_all ;;
+  close) close_all; echo "backend=$(backend)" ;;
+  backend) echo "backend=$(backend)" ;;
+  *) echo "usage: firewall.sh open|close|backend" >&2; exit 2 ;;
+esac
+FWEOF
+  } >"$FW_FILE"
+  chmod 700 "$FW_FILE"
+}
+
+# Rules for the current selection, e.g. "52816/tcp 37689/udp 80/tcp".
+fw_rules() {
   local p t rules=()
   for p in $ALL_PROTOCOLS; do
     has_protocol "$p" || continue
     for t in $(protocol_transports "$p"); do rules+=("$(protocol_port "$p")/$t"); done
   done
   [ "$CERT_MODE" = ip ] && uses_cert && rules+=("80/tcp")
-  if command -v ufw >/dev/null && ufw status 2>/dev/null | grep -q 'Status: active'; then
-    log "opening ports in ufw: ${rules[*]}"
-    for r in "${rules[@]}"; do ufw allow "$r" >/dev/null; done
-  elif command -v firewall-cmd >/dev/null && firewall-cmd --state >/dev/null 2>&1; then
-    log "opening ports in firewalld: ${rules[*]}"
-    for r in "${rules[@]}"; do firewall-cmd -q --permanent --add-port="$r"; done
-    firewall-cmd -q --reload
-  fi
-  # TODO: raw iptables/nftables; cloud security groups must still be opened by the user.
+  echo "${rules[*]}"
+}
+
+open_firewall() {
+  local rules out
+  rules=$(fw_rules)
+  # Close what the previous install opened (unticked protocols, old ports).
+  if [ -f "$FW_FILE" ]; then bash "$FW_FILE" close >/dev/null 2>&1 || true; fi
+  write_fw_script "$rules"
+  out=$(bash "$FW_FILE" open 2>/dev/null) || true
+  FW_BACKEND=$(printf '%s\n' "$out" | sed -n 's/^backend=//p')
+  FW_BACKEND=${FW_BACKEND:-unknown}
+  FW_OPENED=$rules
+  log "firewall ($FW_BACKEND): ${rules:-nothing to open}"
+}
+
+firewall_json() {
+  # Split on spaces explicitly: callers such as cmd_status have IFS=",".
+  local r items=() rules=()
+  IFS=' ' read -r -a rules <<<"${FW_OPENED:-}"
+  for r in "${rules[@]}"; do items+=("\"$r\""); done
+  local IFS=,
+  printf '{"backend":"%s","opened":[%s]}' "${FW_BACKEND:-unknown}" "${items[*]}"
 }
 
 enable_bbr() {
@@ -578,13 +706,13 @@ cmd_install() {
   write_config
   write_unit
   open_firewall
-  if [ "$CERT_MODE" = ip ] && uses_cert && ! wait_for_cert; then cert_fallback; fi
+  if [ "$CERT_MODE" = ip ] && uses_cert && ! wait_for_cert; then cert_fallback; open_firewall; fi
   enable_bbr
   resolve_ip
   log "done"
   local head='"ok":true'
   [ -z "$CERT_FAILURE" ] || head="\"ok\":false,\"error\":\"cert_failed\",\"message\":\"$(json_escape "$CERT_FAILURE")\""
-  result "{$head,\"action\":\"install\",\"protocols\":\"$PROTOCOLS\",\"version\":\"$("$BIN" version | awk 'NR==1{print $3}')\",\"cert\":$(cert_status_json),\"links\":$(links_json)}"
+  result "{$head,\"action\":\"install\",\"protocols\":\"$PROTOCOLS\",\"version\":\"$("$BIN" version | awk 'NR==1{print $3}')\",\"cert\":$(cert_status_json),\"firewall\":$(firewall_json),\"links\":$(links_json)}"
 }
 
 cmd_status() {
@@ -604,7 +732,13 @@ cmd_status() {
   done
   local IFS=,
   local cert; cert=$(cert_status_json)
-  result "{\"ok\":true,\"action\":\"status\",\"installed\":true,\"active\":$active,\"version\":\"$version\",\"protocols\":\"$PROTOCOLS\",\"cert\":$cert,\"listening\":{${listening[*]}}}"
+  FW_OPENED=""; FW_BACKEND=unknown
+  if [ -f "$FW_FILE" ]; then
+    FW_OPENED=$(sed -n 's/^RULES="\(.*\)"$/\1/p' "$FW_FILE")
+    FW_BACKEND=$(bash "$FW_FILE" backend 2>/dev/null | sed -n 's/^backend=//p')
+  fi
+  local fw; fw=$(firewall_json)
+  result "{\"ok\":true,\"action\":\"status\",\"installed\":true,\"active\":$active,\"version\":\"$version\",\"protocols\":\"$PROTOCOLS\",\"cert\":$cert,\"firewall\":$fw,\"listening\":{${listening[*]}}}"
 }
 
 cmd_links() {
@@ -623,6 +757,7 @@ cmd_links() {
 cmd_uninstall() {
   require_root
   systemctl disable --now "$UNIT" >/dev/null 2>&1 || true
+  if [ -f "$FW_FILE" ]; then bash "$FW_FILE" close >/dev/null 2>&1 || true; fi
   rm -f "$UNIT_FILE" /etc/sysctl.d/99-dsh-vpn.conf
   systemctl daemon-reload 2>/dev/null || true
   rm -rf "$STATE_DIR" "$BIN"