meiandClaude Opus 5
f7ad3aac95
The rule editor no longer requires writing expr by hand. Conditions are rows of field + operator + values joined with AND or OR, each row negatable, and the generated expression is shown live and validated by the engine before a rule is accepted. Raw expression and YAML editing are still available. Fields cover the connection (protocol, source/destination IP and port), domains (TLS SNI, QUIC SNI, DNS query name), HTTP (host, path, method, User-Agent) and protocol detection. Operators cover CIDR membership, GeoIP countries, GeoSite categories, port ranges, wildcards, substrings and regular expressions. Multiple values in a row are OR-ed, so one row holds a whole domain or country list. Wildcards compile to the cheapest expression that matches them: *.x.com becomes endsWith, x.* startsWith, *ad* contains, and only a star in the middle falls back to a regular expression. Values are validated as they are typed, including a hint when a star is used with an operator that would match it literally. Country and category pickers are backed by the databases the engine actually loaded, via a new GET /api/v1/geo endpoint (cached, loaded on demand) built on new listing methods in the geo package. Country names and flags come from Intl.DisplayNames, so no name table is shipped. Note that the v2geo format has no AS numbers; the provider groups it does contain (cloudflare, google, telegram, ...) are listed alongside the countries. Opening an existing rule parses its expression back into conditions. Anything the builder cannot represent opens in the expression editor with a warning rather than being rewritten. ruleset/expr_test.go pins the canonical expressions the builder generates and compiles them with the real engine, and the devserver now uses the real ruleset compiler so the same errors show up during frontend work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
2.7 KiB
Markdown
65 lines
2.7 KiB
Markdown
# 
|
|
|
|
[](https://github.com/apernet/OpenGFW/actions/workflows/check.yaml)
|
|
[![License][1]][2]
|
|
|
|
[1]: https://img.shields.io/badge/License-MPL_2.0-brightgreen.svg
|
|
[2]: LICENSE
|
|
|
|
OpenGFW 是一个 Linux 上灵活、易用、开源的 DIY [GFW](https://zh.wikipedia.org/wiki/%E9%98%B2%E7%81%AB%E9%95%BF%E5%9F%8E) 实现，并且在许多方面比真正的 GFW 更强大。为何让那些掌权者独享乐趣？是时候把权力归还给人民，人人有墙建了。立即安装可以部署在家用路由器上的网络主权 - 你也能是老大哥。
|
|
|
|
**文档网站： https://gfw.dev/**
|
|
|
|
Telegram 群组： https://t.me/OpGFW
|
|
|
|
> [!CAUTION]
|
|
> 本项目仍处于早期开发阶段。测试时自行承担风险。我们正在寻求贡献者一起完善本项目。
|
|
|
|
## 功能
|
|
|
|
- 完整的 IP/TCP 重组，各种协议解析器
|
|
- HTTP, TLS, QUIC, DNS, SSH, SOCKS4/5, WireGuard, OpenVPN, 更多协议正在开发中
|
|
- Shadowsocks, VMess 等 "全加密流量" 检测 (https://gfw.report/publications/usenixsecurity23/zh/)
|
|
- Trojan 协议检测
|
|
- [开发中] 基于机器学习的流量分类
|
|
- 同等支持 IPv4 和 IPv6
|
|
- 基于流的多核负载均衡
|
|
- 连接 offloading
|
|
- 基于 [expr](https://github.com/expr-lang/expr) 的强大规则引擎
|
|
- 规则可以热重载 (发送 `SIGHUP` 信号)
|
|
- 灵活的协议解析和修改框架
|
|
- 可扩展的 IO 实现 (目前只有 NFQueue)
|
|
- Web UI，包含实时流量面板与规则编辑器
|
|
|
|
## Web UI
|
|
|
|
OpenGFW 内置了一个可选的 Web 控制面板：实时流量统计、带解析器属性的实时事件流，以及可以校验并热加载规则的规则编辑器。
|
|
界面同时适配手机和桌面浏览器。
|
|
|
|
规则既可以用条件列表来写——选择字段（SNI、DNS 域名、HTTP Host、IP、端口、识别到的协议）、
|
|
条件（通配符、CIDR、GeoIP 国家/地区、GeoSite 分类、端口区间、正则）以及一个或多个值——
|
|
也可以直接编写 expr 表达式或 YAML。国家/地区与站点分类直接从引擎加载的 geo 数据库中选择。
|
|
|
|
在配置文件中启用：
|
|
|
|
```yaml
|
|
web:
|
|
enabled: true
|
|
listen: :8080
|
|
secret: 你的密码 # 留空则启动时随机生成并打印到日志
|
|
# cert: /path/to/fullchain.pem
|
|
# key: /path/to/privkey.pem
|
|
```
|
|
|
|
前端已经打包进二进制文件，无需额外部署静态资源。请只在可信网络中开放该端口——拿到密码即可修改你的规则。
|
|
开发说明见 [web/README.md](web/README.md)。
|
|
|
|
## 使用场景
|
|
|
|
- 广告拦截
|
|
- 家长控制
|
|
- 恶意软件防护
|
|
- VPN/代理服务滥用防护
|
|
- 流量分析 (纯日志模式)
|
|
- 助你实现你的独裁野心
|