Update On Wed Jan 14 19:44:20 CET 2026

openwrt-passwall/luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -50,32 +50,43 @@ local log = function(...)
 	end
 end
 
-local function gen_nftset(set_name, ip_type, tmp_file, input_file)
-	f = io.open(input_file, "r")
-	local element = f:read("*all")
-	f:close()
-
-	nft_file, err = io.open(tmp_file, "w")
-	nft_file:write('#!/usr/sbin/nft -f\n')
-	nft_file:write(string.format('define %s = {%s}\n', set_name, string.gsub(element, "%s*%c+", " timeout 3650d, ")))
-	if sys.call(string.format('nft "list set %s %s" >/dev/null 2>&1', nftable_name, set_name)) ~= 0 then
-		nft_file:write(string.format('add set %s %s { type %s; flags interval, timeout; timeout 2d; gc-interval 2d; auto-merge; }\n', nftable_name, set_name, ip_type))
-	end
-	nft_file:write(string.format('add element %s %s $%s\n', nftable_name, set_name, set_name))
-	nft_file:close()
-	sys.call(string.format('nft -f %s &>/dev/null',tmp_file))
-	os.remove(tmp_file)
-end
-
 --gen cache for nftset from file
 local function gen_cache(set_name, ip_type, input_file, output_file)
-	local tmp_dir = "/tmp/"
-	local tmp_file = output_file .. "_tmp"
-	local tmp_set_name = set_name .. "_tmp"
-	gen_nftset(tmp_set_name, ip_type, tmp_file, input_file)
-	sys.call(string.format('nft list set %s %s | sed "s/%s/%s/g" | cat > %s', nftable_name, tmp_set_name, tmp_set_name, set_name, output_file))
-	sys.call(string.format('nft flush set %s %s', nftable_name, tmp_set_name))
-	sys.call(string.format('nft delete set %s %s', nftable_name, tmp_set_name))
+	local tmp_set_name = set_name .. "_tmp_" .. os.time()
+	local f_in = io.open(input_file, "r")
+	if not f_in then return false end
+	local nft_pipe = io.popen("nft -f -", "w")
+	if not nft_pipe then 
+		f_in:close()
+		return false 
+	end
+	nft_pipe:write('#!/usr/sbin/nft -f\n')
+	nft_pipe:write(string.format('add table %s\n', nftable_name))
+	nft_pipe:write(string.format('add set %s %s { type %s; flags interval, timeout; timeout 2d; gc-interval 1h; auto-merge; }\n', nftable_name, tmp_set_name, ip_type))
+	nft_pipe:write(string.format('add element %s %s { ', nftable_name, tmp_set_name))
+	local count = 0
+	local batch_size = 500
+	for line in f_in:lines() do
+		local ip = line:match("^%s*(.-)%s*$")
+		if ip and ip ~= "" then
+			nft_pipe:write(ip, "timeout 365d, ")
+			count = count + 1
+			if count % batch_size == 0 then
+				nft_pipe:write("}\n")
+				nft_pipe:write(string.format('add element %s %s { ', nftable_name, tmp_set_name))
+			end
+		end
+	end
+	nft_pipe:write("}\n")
+	f_in:close()
+
+	local success = nft_pipe:close()
+	if not (success == true or success == 0) then
+		os.execute(string.format('nft delete set %s %s 2>/dev/null', nftable_name, tmp_set_name))
+		return false
+	end
+	os.execute(string.format('nft list set %s %s | sed "s/%s/%s/g" > %s', nftable_name, tmp_set_name, tmp_set_name, set_name, output_file))
+	os.execute(string.format('nft delete set %s %s 2>/dev/null', nftable_name, tmp_set_name))
 end
 
 -- curl
@@ -322,25 +333,29 @@ local function extract_domain(s)
 end
 
 local function non_file_check(file_path, vali_file)
-	if fs.readfile(file_path, 10) then
-		local size_str = sys.exec("grep -i 'Content-Length' " .. vali_file .. " | tail -n1 | sed 's/[^0-9]//g'")
-		local remote_file_size = tonumber(size_str)
-		remote_file_size = (remote_file_size and remote_file_size > 0) and remote_file_size or nil
-		local local_file_size = tonumber(fs.stat(file_path, "size"))
-		if remote_file_size and local_file_size then
-			if remote_file_size == local_file_size then
-				return nil;
-			else
-				log("下载文件大小校验出错，原始文件大小" .. remote_file_size .. "B，下载文件大小：" .. local_file_size .. "B。")
-				return true;
-			end
-		else
-			return nil;
-		end
-	else
-		log("下载文件读取出错。")
-		return true;
+	local local_file_size = tonumber(fs.stat(file_path, "size")) or 0
+	if local_file_size == 0 then
+		log("下载文件为空或读取出错。")
+		return true
 	end
+
+	local remote_file_size = nil
+	local f = io.open(vali_file, "r")
+	if f then
+		local header_content = f:read("*a")
+		f:close()
+		for size in header_content:gmatch("[Cc]ontent%-[Ll]ength:%s*(%d+)") do
+			local s = tonumber(size)
+			if s and s > 0 then
+				remote_file_size = s
+			end
+		end
+	end
+	if remote_file_size and remote_file_size ~= local_file_size then
+		log(string.format("校验出错：远程 %dB, 下载 %dB", remote_file_size, local_file_size))
+		return true
+	end
+	return nil
 end
 
 local function GeoToRule(rule_name, rule_type, out_path)
@@ -506,10 +521,10 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 					end
 					gen_cache(set_name, "ipv6_addr", file_tmp, output_file)
 				end
-				sys.call(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
+				os.execute(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
 				os.remove(output_file)
 			end
-			sys.call("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
+			os.execute("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
 			reboot = 1
 			log(rule_name.. " 更新成功，总规则数 " ..count.. " 条。")
 		else