diff --git a/agent/app/dto/firewall.go b/agent/app/dto/firewall.go index 33de0b41a..1e4576baa 100644 --- a/agent/app/dto/firewall.go +++ b/agent/app/dto/firewall.go @@ -50,13 +50,12 @@ type FirewallBackendOption struct { } type FirewallBackendFamilyStatus struct { - Partial bool `json:"partial"` - Available bool `json:"available"` - Initialized bool `json:"initialized"` - Bound bool `json:"bound"` - Reason string `json:"reason,omitempty"` - ForwardPolicy string `json:"forwardPolicy,omitempty"` - RAInterfaces []string `json:"raInterfaces,omitempty"` + Partial bool `json:"partial"` + Available bool `json:"available"` + Initialized bool `json:"initialized"` + Bound bool `json:"bound"` + Reason string `json:"reason,omitempty"` + RAInterfaces []string `json:"raInterfaces,omitempty"` } type FirewallBackendGroup struct { diff --git a/agent/app/service/firewall.go b/agent/app/service/firewall.go index f781b9850..04de2134c 100644 --- a/agent/app/service/firewall.go +++ b/agent/app/service/firewall.go @@ -108,9 +108,7 @@ func (s *FirewallService) LoadBaseInfo(chainGroup string) (dto.FirewallSubsystem status.Reason = constant.FirewallBackendNotInstalled return status, nil } - status.IsExist = true - status.Message = err.Error() - return status, nil + return status, err } status.IsExist = true runtimeStatus, err := lifecycle.LoadStatus(client) diff --git a/agent/app/service/firewall_utils.go b/agent/app/service/firewall_utils.go index 3ff18d409..6a4c754e5 100644 --- a/agent/app/service/firewall_utils.go +++ b/agent/app/service/firewall_utils.go @@ -1185,15 +1185,17 @@ func loadForwardingFirewallOverview(manager forwarding.Adapter, families []strin } ipv6, ipv6Err := loadForwardingFamilyInfo(manager, constant.FirewallFamilyIPv6) if ipv6.Available { - interfaces, err := forwarding.IPv6RAInterfaces(os.ReadFile) + interfaces, err := forwarding.IPv6RAInterfaces(os.ReadFile, forwarding.LoadDockerIPv4BridgePorts) var pathError *os.PathError switch { case errors.As(err, &pathError) && errors.Is(err, os.ErrNotExist) && pathError.Path == "/proc/net/if_inet6": ipv6.Available, ipv6.Initialized, ipv6.Bound = false, false, false case err != nil: + global.LOG.Warnf("IPv6 forwarding RA check failed: %v", err) ipv6.Reason = "ipv6_ra_check_failed" ipv6.Bound = false case len(interfaces) > 0: + global.LOG.Warnf("IPv6 forwarding RA risk: interfaces %s may depend on RA/SLAAC with accept_ra=1", strings.Join(interfaces, ", ")) ipv6.Reason, ipv6.RAInterfaces = "ipv6_ra_required", interfaces ipv6.Bound = false case !ipv6.Bound: diff --git a/agent/app/service/forward.go b/agent/app/service/forward.go index bfb68d5d0..626a828e6 100644 --- a/agent/app/service/forward.go +++ b/agent/app/service/forward.go @@ -9,13 +9,10 @@ import ( "strconv" "strings" "sync" - "time" "github.com/1Panel-dev/1Panel/agent/app/dto" "github.com/1Panel-dev/1Panel/agent/app/task" "github.com/1Panel-dev/1Panel/agent/constant" - "github.com/1Panel-dev/1Panel/agent/global" - "github.com/1Panel-dev/1Panel/agent/utils/cmd" "github.com/1Panel-dev/1Panel/agent/utils/firewall" "github.com/1Panel-dev/1Panel/agent/utils/firewall/filter" "github.com/1Panel-dev/1Panel/agent/utils/firewall/forwarding" @@ -82,23 +79,6 @@ func (s *ForwardingService) LoadBaseInfo(ctx context.Context) (dto.FirewallSubsy baseInfo.PingStatus = firewall.LoadPingStatus() baseInfo.IsInit, baseInfo.IsBind = status.IsInit, status.IsBind baseInfo.IPv4, baseInfo.IPv6 = status.IPv4, status.IPv6 - for _, family := range []struct { - command string - status *dto.FirewallBackendFamilyStatus - }{ - {"iptables", &baseInfo.IPv4}, - {"ip6tables", &baseInfo.IPv6}, - } { - if family.command == "ip6tables" && !baseInfo.IPv6Enabled { - continue - } - policy, err := loadForwardPolicy(ctx, family.command) - if err != nil { - global.LOG.Warnf("inspect %s FORWARD policy: %v", family.command, err) - continue - } - family.status.ForwardPolicy = policy - } return baseInfo, nil } @@ -308,26 +288,3 @@ func (s *ForwardingService) Restore(ctx context.Context) error { func NewIForwardingService() IForwardingService { return newForwardingService() } - -func loadForwardPolicy(ctx context.Context, command string) (string, error) { - if !cmd.Which(command) { - command += "-nft" - if !cmd.Which(command) { - return "", nil - } - } - output, err := cmd.NewCommandMgr(cmd.WithContext(ctx), cmd.WithTimeout(5*time.Second)).RunWithOptionalSudoAndStdout(command, "-t", "filter", "-w", "2", "-S", "FORWARD") - if err != nil { - return "", err - } - for _, line := range strings.Split(output, "\n") { - fields := strings.Fields(line) - if len(fields) == 3 && fields[0] == "-P" && fields[1] == "FORWARD" { - if fields[2] != "ACCEPT" && fields[2] != "DROP" { - return "", fmt.Errorf("unexpected FORWARD policy: %s", fields[2]) - } - return fields[2], nil - } - } - return "", errors.New("FORWARD default policy was not found") -} diff --git a/agent/i18n/lang/en.yaml b/agent/i18n/lang/en.yaml index 63f7afaaa..ded8cd878 100644 --- a/agent/i18n/lang/en.yaml +++ b/agent/i18n/lang/en.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 forwarding is disabled. Set net.ipv4.ip_f ErrFirewallRuleSavedApplyFailed: "The new rule configuration was saved, but applying it to the firewall failed. Retry by synchronizing: {{ .detail }}" ErrFirewallRuleConflict: "A UFW rule with the same match conditions and a different action already exists. Edit the existing rule instead." ErrForwardInterfaceNotFound: "Network interface {{ .name }} specified by the forwarding rule does not exist. Check the interface name and retry." +ErrIPv6RARisk: "IPv6 forwarding is blocked to prevent possible network loss. See the documentation and system logs for details." +ErrIPv6RACheckFailed: "IPv6 forwarding is blocked because the network configuration could not be checked. See the system logs for details." ErrSSHPublicKey: "Enter a valid SSH public key" ErrSSHPrivateKey: "Invalid SSH private key or incorrect passphrase; encrypted keys require the original passphrase" diff --git a/agent/i18n/lang/es-ES.yaml b/agent/i18n/lang/es-ES.yaml index d464f7796..17d3243ae 100644 --- a/agent/i18n/lang/es-ES.yaml +++ b/agent/i18n/lang/es-ES.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "El reenvío IPv4 está desactivado. Configure ErrFirewallRuleSavedApplyFailed: "Se guardó la configuración de la nueva regla, pero no se pudo aplicar al cortafuegos. Vuelva a intentarlo mediante la sincronización: {{ .detail }}" ErrFirewallRuleConflict: "Ya existe una regla UFW con las mismas condiciones y una acción diferente. Edite la regla existente." ErrForwardInterfaceNotFound: "La interfaz de red {{ .name }} indicada en la regla de reenvío no existe. Compruebe el nombre e inténtelo de nuevo." +ErrIPv6RARisk: "El reenvío IPv6 está bloqueado para evitar una posible pérdida de conectividad. Consulte la documentación y los registros del sistema." +ErrIPv6RACheckFailed: "El reenvío IPv6 está bloqueado porque no se pudo comprobar la configuración de red. Consulte los registros del sistema." ErrSSHPublicKey: "Introduce una clave pública SSH válida" ErrSSHPrivateKey: "Clave privada SSH no válida o contraseña incorrecta; las claves cifradas requieren la contraseña original" diff --git a/agent/i18n/lang/fa.yaml b/agent/i18n/lang/fa.yaml index 940bef9dd..c6dd515b7 100644 --- a/agent/i18n/lang/fa.yaml +++ b/agent/i18n/lang/fa.yaml @@ -722,6 +722,8 @@ ErrDockerIPv4ForwardingDisabled: "ارسال IPv4 غیرفعال است. پیش ErrFirewallRuleSavedApplyFailed: "پیکربندی قانون جدید ذخیره شد، اما اعمال آن در دیوار آتش ناموفق بود. با همگام‌سازی دوباره تلاش کنید: {{ .detail }}" ErrFirewallRuleConflict: "یک قانون UFW با شرایط تطبیق یکسان و عملکرد متفاوت از قبل وجود دارد. قانون موجود را ویرایش کنید." ErrForwardInterfaceNotFound: "رابط شبکه {{ .name }} مشخص‌شده در قانون انتقال وجود ندارد. نام رابط را بررسی کرده و دوباره تلاش کنید." +ErrIPv6RARisk: "فعال‌سازی هدایت IPv6 به دلیل خطر قطع شبکه مسدود شد. مستندات و گزارش‌های سیستم را بررسی کنید." +ErrIPv6RACheckFailed: "فعال‌سازی هدایت IPv6 به دلیل عدم امکان بررسی پیکربندی شبکه مسدود شد. جزئیات در گزارش‌های سیستم موجود است." ErrSSHPublicKey: "یک کلید عمومی SSH معتبر وارد کنید" ErrSSHPrivateKey: "کلید خصوصی SSH نامعتبر یا عبارت عبور نادرست است؛ کلیدهای رمزگذاری‌شده به عبارت عبور اصلی نیاز دارند" diff --git a/agent/i18n/lang/ja.yaml b/agent/i18n/lang/ja.yaml index 79d274aa7..56e719e3b 100644 --- a/agent/i18n/lang/ja.yaml +++ b/agent/i18n/lang/ja.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 転送が無効です。Docker のファ ErrFirewallRuleSavedApplyFailed: "新しいルール設定は保存されましたが、ファイアウォールへの適用に失敗しました。同期で再試行してください：{{ .detail }}" ErrFirewallRuleConflict: "UFW に同じ一致条件でアクションが異なるルールが既に存在します。既存のルールを編集してください。" ErrForwardInterfaceNotFound: "転送ルールで指定されたネットワークインターフェース {{ .name }} は存在しません。名前を確認して再試行してください。" +ErrIPv6RARisk: "ネットワーク切断のおそれがあるため、IPv6 転送の有効化をブロックしました。ドキュメントとシステムログをご確認ください。" +ErrIPv6RACheckFailed: "ネットワーク設定を確認できないため、IPv6 転送の有効化をブロックしました。詳細はシステムログをご確認ください。" ErrSSHPublicKey: "有効な SSH 公開鍵を入力してください" ErrSSHPrivateKey: "SSH 秘密鍵の形式が無効か、パスフレーズが間違っています。暗号化された鍵には元のパスフレーズが必要です" diff --git a/agent/i18n/lang/ko.yaml b/agent/i18n/lang/ko.yaml index eb668a953..1a1df4adc 100644 --- a/agent/i18n/lang/ko.yaml +++ b/agent/i18n/lang/ko.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 전달이 비활성화되어 있습니다 ErrFirewallRuleSavedApplyFailed: "새 규칙 설정이 저장되었지만 방화벽에 적용하지 못했습니다. 동기화하여 다시 시도하세요: {{ .detail }}" ErrFirewallRuleConflict: "UFW에 일치 조건이 같지만 동작이 다른 규칙이 이미 있습니다. 기존 규칙을 편집하세요." ErrForwardInterfaceNotFound: "전달 규칙에 지정된 네트워크 인터페이스 {{ .name }}이 존재하지 않습니다. 이름을 확인한 후 다시 시도하세요." +ErrIPv6RARisk: "네트워크 연결이 끊길 위험이 있어 IPv6 전달 활성화를 차단했습니다. 문서와 시스템 로그를 확인하세요." +ErrIPv6RACheckFailed: "네트워크 구성을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 자세한 내용은 시스템 로그를 확인하세요." ErrSSHPublicKey: "유효한 SSH 공개 키를 입력하세요" ErrSSHPrivateKey: "SSH 개인 키 형식이 잘못되었거나 암호가 틀립니다. 암호화된 키에는 원래 암호가 필요합니다" diff --git a/agent/i18n/lang/lo.yaml b/agent/i18n/lang/lo.yaml index 521c97838..61e79e983 100644 --- a/agent/i18n/lang/lo.yaml +++ b/agent/i18n/lang/lo.yaml @@ -712,6 +712,8 @@ ErrDockerIPv4ForwardingDisabled: "ການສົ່ງຕໍ່ IPv4 ຖືກ ErrFirewallRuleSavedApplyFailed: "ບັນທຶກການຕັ້ງຄ່າກົດໃໝ່ແລ້ວ ແຕ່ນຳໃຊ້ກັບໄຟວໍບໍ່ສຳເລັດ. ລອງອີກຄັ້ງດ້ວຍການຊິງຂໍ້ມູນ: {{ .detail }}" ErrFirewallRuleConflict: "ມີກົດ UFW ທີ່ມີເງື່ອນໄຂກົງກັນແຕ່ການດຳເນີນການຕ່າງກັນແລ້ວ. ກະລຸນາແກ້ໄຂກົດທີ່ມີຢູ່." ErrForwardInterfaceNotFound: "ບໍ່ພົບອິນເຕີເຟດເຄືອຂ່າຍ {{ .name }} ທີ່ລະບຸໃນກົດສົ່ງຕໍ່. ກະລຸນາກວດສອບຊື່ ແລ້ວລອງໃໝ່." +ErrIPv6RARisk: "ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເພື່ອປ້ອງກັນຄວາມສ່ຽງທີ່ເຄືອຂ່າຍຈະຂາດການເຊື່ອມຕໍ່. ເບິ່ງເອກະສານ ແລະ ບັນທຶກລະບົບ." +ErrIPv6RACheckFailed: "ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເນື່ອງຈາກບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍໄດ້. ເບິ່ງລາຍລະອຽດໃນບັນທຶກລະບົບ." ErrSSHPublicKey: "ກະລຸນາປ້ອນຄີສາທາລະນະ SSH ທີ່ຖືກຕ້ອງ" ErrSSHPrivateKey: "ຄີສ່ວນຕົວ SSH ບໍ່ຖືກຕ້ອງ ຫຼື ລະຫັດຜ່ານຜິດ; ຄີທີ່ເຂົ້າລະຫັດຕ້ອງໃຊ້ລະຫັດຜ່ານເດີມ" diff --git a/agent/i18n/lang/ms.yaml b/agent/i18n/lang/ms.yaml index cc8a244db..dcd298788 100644 --- a/agent/i18n/lang/ms.yaml +++ b/agent/i18n/lang/ms.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "Pemajuan IPv4 dilumpuhkan. Tetapkan net.ipv4.i ErrFirewallRuleSavedApplyFailed: "Konfigurasi peraturan baharu telah disimpan, tetapi gagal digunakan pada tembok api. Cuba lagi melalui penyegerakan: {{ .detail }}" ErrFirewallRuleConflict: "Peraturan UFW dengan syarat padanan yang sama tetapi tindakan berbeza sudah wujud. Sila edit peraturan sedia ada." ErrForwardInterfaceNotFound: "Antara muka rangkaian {{ .name }} yang dinyatakan dalam peraturan pemajuan tidak wujud. Semak namanya dan cuba lagi." +ErrIPv6RARisk: "Pemajuan IPv6 disekat bagi mengelakkan risiko kehilangan sambungan rangkaian. Rujuk dokumentasi dan log sistem." +ErrIPv6RACheckFailed: "Pemajuan IPv6 disekat kerana konfigurasi rangkaian tidak dapat diperiksa. Lihat log sistem untuk butiran." ErrSSHPublicKey: "Masukkan kunci awam SSH yang sah" ErrSSHPrivateKey: "Kunci peribadi SSH tidak sah atau frasa laluan salah; kunci yang disulitkan memerlukan frasa laluan asal" diff --git a/agent/i18n/lang/pt-BR.yaml b/agent/i18n/lang/pt-BR.yaml index 728501f52..41d03a15a 100644 --- a/agent/i18n/lang/pt-BR.yaml +++ b/agent/i18n/lang/pt-BR.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "O encaminhamento IPv4 está desativado. Defina ErrFirewallRuleSavedApplyFailed: "A configuração da nova regra foi salva, mas não pôde ser aplicada ao firewall. Tente novamente por meio da sincronização: {{ .detail }}" ErrFirewallRuleConflict: "Já existe uma regra UFW com as mesmas condições e uma ação diferente. Edite a regra existente." ErrForwardInterfaceNotFound: "A interface de rede {{ .name }} especificada na regra de encaminhamento não existe. Verifique o nome e tente novamente." +ErrIPv6RARisk: "O encaminhamento IPv6 foi bloqueado para evitar uma possível perda de conexão. Consulte a documentação e os logs do sistema." +ErrIPv6RACheckFailed: "O encaminhamento IPv6 foi bloqueado porque não foi possível verificar a configuração de rede. Consulte os logs do sistema." ErrSSHPublicKey: "Informe uma chave pública SSH válida" ErrSSHPrivateKey: "Chave privada SSH inválida ou senha incorreta; chaves criptografadas exigem a senha original" diff --git a/agent/i18n/lang/ru.yaml b/agent/i18n/lang/ru.yaml index 91e03f72f..ceb19a527 100644 --- a/agent/i18n/lang/ru.yaml +++ b/agent/i18n/lang/ru.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "Пересылка IPv4 отключена. П ErrFirewallRuleSavedApplyFailed: "Настройки нового правила сохранены, но применить их к межсетевому экрану не удалось. Повторите попытку с помощью синхронизации: {{ .detail }}" ErrFirewallRuleConflict: "В UFW уже есть правило с такими же условиями и другим действием. Отредактируйте существующее правило." ErrForwardInterfaceNotFound: "Сетевой интерфейс {{ .name }}, указанный в правиле перенаправления, не существует. Проверьте имя и повторите попытку." +ErrIPv6RARisk: "Включение переадресации IPv6 заблокировано из-за риска потери связи. См. документацию и системные журналы." +ErrIPv6RACheckFailed: "Включение переадресации IPv6 заблокировано: не удалось проверить настройки сети. Подробности в системных журналах." ErrSSHPublicKey: "Введите действительный открытый ключ SSH" ErrSSHPrivateKey: "Недопустимый закрытый ключ SSH или неверная парольная фраза; для зашифрованных ключей требуется исходная парольная фраза" diff --git a/agent/i18n/lang/tr.yaml b/agent/i18n/lang/tr.yaml index f5830c0da..235e94598 100644 --- a/agent/i18n/lang/tr.yaml +++ b/agent/i18n/lang/tr.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 yönlendirmesi devre dışı. Docker güv ErrFirewallRuleSavedApplyFailed: "Yeni kural yapılandırması kaydedildi, ancak güvenlik duvarına uygulanamadı. Eşitleme yaparak yeniden deneyin: {{ .detail }}" ErrFirewallRuleConflict: "UFW içinde aynı eşleşme koşullarına sahip, farklı bir eylem uygulayan bir kural zaten var. Mevcut kuralı düzenleyin." ErrForwardInterfaceNotFound: "Yönlendirme kuralında belirtilen {{ .name }} ağ arayüzü mevcut değil. Arayüz adını kontrol edip yeniden deneyin." +ErrIPv6RARisk: "Ağ bağlantısının kesilme riski nedeniyle IPv6 yönlendirmesi engellendi. Belgeleri ve sistem günlüklerini inceleyin." +ErrIPv6RACheckFailed: "Ağ yapılandırması denetlenemediği için IPv6 yönlendirmesi engellendi. Ayrıntılar için sistem günlüklerini inceleyin." ErrSSHPublicKey: "Geçerli bir SSH açık anahtarı girin" ErrSSHPrivateKey: "SSH özel anahtarı geçersiz veya parola yanlış; şifreli anahtarlar mevcut parolayı gerektirir" diff --git a/agent/i18n/lang/zh-Hant.yaml b/agent/i18n/lang/zh-Hant.yaml index 97068a483..e37663cbf 100644 --- a/agent/i18n/lang/zh-Hant.yaml +++ b/agent/i18n/lang/zh-Hant.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 轉送尚未啟用，請先設定 net.ipv ErrFirewallRuleSavedApplyFailed: "新規則設定已儲存，但套用至防火牆失敗。可透過同步重試：{{ .detail }}" ErrFirewallRuleConflict: "UFW 中已存在比對條件相同但動作不同的規則，請編輯既有規則。" ErrForwardInterfaceNotFound: "轉發規則指定的網卡 {{ .name }} 不存在，請檢查網卡名稱後重試。" +ErrIPv6RARisk: "IPv6 轉送可能導致網路中斷，已阻止啟用。請參閱文件，詳情見系統日誌。" +ErrIPv6RACheckFailed: "無法檢查 IPv6 網路設定，已阻止啟用轉送。詳情見系統日誌。" ErrSSHPublicKey: "請輸入有效的 SSH 公鑰" ErrSSHPrivateKey: "SSH 私鑰格式無效或密碼錯誤；加密私鑰需要填寫原密碼" diff --git a/agent/i18n/lang/zh.yaml b/agent/i18n/lang/zh.yaml index 980ac7e67..911b88d4d 100644 --- a/agent/i18n/lang/zh.yaml +++ b/agent/i18n/lang/zh.yaml @@ -721,6 +721,8 @@ ErrDockerIPv4ForwardingDisabled: "IPv4 转发未开启，请先设置 net.ipv4.i ErrFirewallRuleSavedApplyFailed: "新规则配置已保存，但应用到防火墙失败。可通过同步重试：{{ .detail }}" ErrFirewallRuleConflict: "UFW 中已存在匹配条件相同但动作不同的规则，请编辑已有规则。" ErrForwardInterfaceNotFound: "转发规则指定的网卡 {{ .name }} 不存在，请检查网卡名称后重试。" +ErrIPv6RARisk: "IPv6 转发存在断网风险，已阻止启用。请参阅文档，详情见系统日志。" +ErrIPv6RACheckFailed: "无法检查 IPv6 网络配置，已阻止启用转发。详情见系统日志。" ErrSSHPublicKey: "请输入有效的 SSH 公钥" ErrSSHPrivateKey: "SSH 私钥格式无效或密码错误；加密私钥需要填写原密码" diff --git a/agent/utils/firewall/forwarding/sysctl.go b/agent/utils/firewall/forwarding/sysctl.go index 4f7a4d69a..3d8056ed7 100644 --- a/agent/utils/firewall/forwarding/sysctl.go +++ b/agent/utils/firewall/forwarding/sysctl.go @@ -1,6 +1,8 @@ package forwarding import ( + "context" + "encoding/json" "errors" "fmt" "os" @@ -8,19 +10,27 @@ import ( "sort" "strconv" "strings" + "time" + "github.com/1Panel-dev/1Panel/agent/buserr" "github.com/1Panel-dev/1Panel/agent/constant" + "github.com/1Panel-dev/1Panel/agent/global" + "github.com/1Panel-dev/1Panel/agent/utils/cmd" + "github.com/1Panel-dev/1Panel/agent/utils/docker" + "github.com/docker/docker/api/types/network" ) func ensureFamilyForwardingSysctls(system forwardingSystem, family string) error { withIPv6 := family == FamilyIPv6 if withIPv6 { - interfaces, err := IPv6RAInterfaces(system.ReadFile) + interfaces, err := IPv6RAInterfaces(system.ReadFile, LoadDockerIPv4BridgePorts) if err != nil { - return fmt.Errorf("check IPv6 Router Advertisement: %w", err) + global.LOG.Warnf("IPv6 forwarding blocked: failed to check Router Advertisement: %v", err) + return buserr.New("ErrIPv6RACheckFailed") } if len(interfaces) > 0 { - return fmt.Errorf("IPv6 forwarding blocked: interfaces %s may depend on RA/SLAAC with accept_ra=1; persist accept_ra=2 on interfaces that require RA before retrying", strings.Join(interfaces, ", ")) + global.LOG.Warnf("IPv6 forwarding blocked: interfaces %s may depend on RA/SLAAC with accept_ra=1; review the network configuration and persist accept_ra=2 on interfaces that require RA before retrying", strings.Join(interfaces, ", ")) + return buserr.New("ErrIPv6RARisk") } } paths := []string{"/proc/sys/net/ipv4/ip_forward"} @@ -43,7 +53,7 @@ func ensureFamilyForwardingSysctls(system forwardingSystem, family string) error return nil } -func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) { +func IPv6RAInterfaces(readFile func(string) ([]byte, error), loadDockerPorts func() (map[string]bool, error)) ([]string, error) { addresses, err := readFile("/proc/net/if_inet6") if err != nil { return nil, err @@ -67,21 +77,16 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) { if err != nil { return nil, err } - if _, exists := globalAddresses[name]; !exists { - globalAddresses[name] = false - } - if fields[3] == "00" { - globalAddresses[name] = true - if flags&permanentAddress == 0 { - raInterfaces[name] = true - } + globalAddresses[name] = globalAddresses[name] || fields[3] == "00" + if fields[3] == "00" && flags&permanentAddress == 0 { + raInterfaces[name] = true } } routes, err := readFile("/proc/net/ipv6_route") if err != nil { return nil, err } - const raRouteFlags = 0x00010000 | 0x00800000 + const raRouteFlags = 0x00010000 | 0x00080000 | 0x00800000 for _, line := range strings.Split(string(routes), "\n") { fields := strings.Fields(line) if len(fields) == 0 { @@ -98,12 +103,15 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) { raInterfaces[fields[9]] = true } } + uncertainInterfaces := make(map[string]bool) for name, hasGlobalAddress := range globalAddresses { - if !hasGlobalAddress { + if !hasGlobalAddress && !raInterfaces[name] { raInterfaces[name] = true + uncertainInterfaces[name] = true } } var interfaces []string + checkDockerPorts := false for name := range raInterfaces { if name == "lo" { continue @@ -118,15 +126,104 @@ func IPv6RAInterfaces(readFile func(string) ([]byte, error)) ([]string, error) { switch strings.TrimSpace(string(value)) { case "1": interfaces = append(interfaces, name) + checkDockerPorts = checkDockerPorts || uncertainInterfaces[name] case "0", "2": default: return nil, fmt.Errorf("invalid accept_ra value for %s", name) } } + if checkDockerPorts { + ports, err := loadDockerPorts() + if err != nil { + global.LOG.Warnf("IPv6 forwarding RA check: cannot exclude Docker bridge ports: %v", err) + } else { + kept := interfaces[:0] + for _, name := range interfaces { + if !uncertainInterfaces[name] || !ports[name] { + kept = append(kept, name) + } + } + interfaces = kept + } + } sort.Strings(interfaces) return interfaces, nil } +func LoadDockerIPv4BridgePorts() (map[string]bool, error) { + cli, err := docker.NewDockerClient() + if err != nil { + return nil, err + } + defer cli.Close() + if !strings.HasPrefix(cli.DaemonHost(), "unix://") { + return nil, errors.New("cannot verify local bridge ports using a remote Docker daemon") + } + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + info, err := cli.Info(ctx) + if err != nil { + return nil, err + } + for _, option := range info.SecurityOptions { + if option == "name=rootless" { + return nil, errors.New("cannot verify host bridge ports using a rootless Docker daemon") + } + } + networks, err := cli.NetworkList(ctx, network.ListOptions{}) + if err != nil { + return nil, err + } + output, err := cmd.NewCommandMgr(cmd.WithContext(ctx), cmd.WithTimeout(5*time.Second)).RunWithOptionalSudoAndStdout("ip", "-details", "-json", "link", "show") + if err != nil { + return nil, err + } + return dockerIPv4BridgePorts(networks, output) +} + +func dockerIPv4BridgePorts(networks []network.Summary, linkJSON string) (map[string]bool, error) { + bridges := make(map[string]bool) + for _, item := range networks { + if item.Driver != "bridge" || item.EnableIPv6 || item.ConfigOnly { + continue + } + name := item.Options["com.docker.network.bridge.name"] + if name == "" { + if item.Options["com.docker.network.bridge.default_bridge"] == "true" { + name = "docker0" + } else if len(item.ID) >= 12 { + name = "br-" + item.ID[:12] + } + } + if name != "" { + bridges[name] = true + } + } + var links []struct { + Name string `json:"ifname"` + Master string `json:"master"` + LinkInfo struct { + Kind string `json:"info_kind"` + } `json:"linkinfo"` + } + if err := json.Unmarshal([]byte(linkJSON), &links); err != nil { + return nil, err + } + confirmedBridges := make(map[string]bool) + for _, link := range links { + if link.LinkInfo.Kind == "bridge" && bridges[link.Name] { + confirmedBridges[link.Name] = true + } + } + ports := make(map[string]bool) + for _, link := range links { + if link.LinkInfo.Kind == "veth" && confirmedBridges[link.Master] { + ports[link.Name] = true + } + } + return ports, nil +} + func enableFamilyForwardingSysctls(content, family string) string { lines := strings.Split(strings.TrimRight(content, "\n"), "\n") wanted := map[string]string{"net.ipv4.ip_forward": "net.ipv4.ip_forward = 1"} diff --git a/core/cmd/server/docs/docs.go b/core/cmd/server/docs/docs.go index c1d887038..f157ad5d6 100644 --- a/core/cmd/server/docs/docs.go +++ b/core/cmd/server/docs/docs.go @@ -36372,9 +36372,6 @@ const docTemplate = `{ "bound": { "type": "boolean" }, - "forwardPolicy": { - "type": "string" - }, "initialized": { "type": "boolean" }, diff --git a/core/cmd/server/docs/swagger.json b/core/cmd/server/docs/swagger.json index 0a180e4cf..56fb0cd24 100644 --- a/core/cmd/server/docs/swagger.json +++ b/core/cmd/server/docs/swagger.json @@ -36368,9 +36368,6 @@ "bound": { "type": "boolean" }, - "forwardPolicy": { - "type": "string" - }, "initialized": { "type": "boolean" }, diff --git a/frontend/src/api/interface/firewall.ts b/frontend/src/api/interface/firewall.ts index 3d0bc8be2..b4106d58e 100644 --- a/frontend/src/api/interface/firewall.ts +++ b/frontend/src/api/interface/firewall.ts @@ -23,7 +23,6 @@ export namespace Firewall { initialized: boolean; bound: boolean; reason?: string; - forwardPolicy?: 'ACCEPT' | 'DROP'; raInterfaces?: string[]; } export interface BackendGroup { diff --git a/frontend/src/lang/modules/en.ts b/frontend/src/lang/modules/en.ts index 43a98db9c..29013a258 100644 --- a/frontend/src/lang/modules/en.ts +++ b/frontend/src/lang/modules/en.ts @@ -4306,8 +4306,6 @@ const message = { dockerGuard: 'Container Port Guard', systemFirewall: 'Host firewall', systemFirewallHelper: 'Controls host port access and inbound firewall rules.', - forwardPolicyDropWarning: - 'This server restricts network forwarding. Port forwarding rules may not take effect.', forwardingHelper: 'Manages port-forwarding rules.', dockerFirewallHelper: 'Selects how 1Panel manages container port protection.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental', @@ -4390,9 +4388,9 @@ const message = { 'Host INPUT rules do not directly protect this Docker published port. Click to open Container Port Guard.', notInitialized: 'Not initialized', ipv6RARisk: - 'IPv6 forwarding is blocked: interfaces {0} have accept_ra=1 and may rely on RA/SLAAC. Review the network configuration, persist accept_ra=2 on interfaces that need RA, then retry.', + 'IPv6 forwarding is blocked to prevent possible network loss. See the documentation and system logs for details.', ipv6RACheckFailed: - 'Cannot check IPv6 RA configuration. Enabling IPv6 forwarding is blocked. Check the system network configuration and retry.', + 'IPv6 forwarding is blocked because the network configuration could not be checked. See the system logs for details.', ipv6ForwardingOnDemand: 'IPv6 forwarding is not enabled. It will be checked and enabled when IPv6 rules are added or restored.', familyUnsupported: 'The system does not support {0}', diff --git a/frontend/src/lang/modules/es-es.ts b/frontend/src/lang/modules/es-es.ts index 87b0e7b90..32c23034f 100644 --- a/frontend/src/lang/modules/es-es.ts +++ b/frontend/src/lang/modules/es-es.ts @@ -4357,8 +4357,6 @@ const message = { dockerGuard: 'Protección de puertos de contenedores', systemFirewall: 'Firewall del host', systemFirewallHelper: 'Controla el acceso a los puertos del host y las reglas de entrada.', - forwardPolicyDropWarning: - 'Este servidor restringe el reenvío de red. Es posible que las reglas de reenvío de puertos no surtan efecto.', forwardingHelper: 'Gestiona las reglas de reenvío de puertos.', dockerFirewallHelper: 'Selecciona cómo gestiona 1Panel la protección de puertos de contenedores.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental', @@ -4443,9 +4441,9 @@ const message = { 'Las reglas INPUT del host no protegen directamente este puerto publicado por Docker. Haz clic para abrir la protección de puertos de contenedores.', notInitialized: 'No inicializado', ipv6RARisk: - 'El reenvío IPv6 está bloqueado: las interfaces {0} tienen accept_ra=1 y pueden depender de RA/SLAAC. Revise la configuración de red, configure accept_ra=2 de forma persistente en las interfaces que necesitan RA y vuelva a intentarlo.', + 'El reenvío IPv6 está bloqueado para evitar una posible pérdida de conectividad. Consulte la documentación y los registros del sistema.', ipv6RACheckFailed: - 'No se puede comprobar la configuración RA de IPv6. Se ha bloqueado la activación del reenvío IPv6. Revise la configuración de red y vuelva a intentarlo.', + 'El reenvío IPv6 está bloqueado porque no se pudo comprobar la configuración de red. Consulte los registros del sistema.', ipv6ForwardingOnDemand: 'El reenvío IPv6 no está habilitado. Se comprobará y habilitará al añadir o restaurar reglas IPv6.', familyUnsupported: 'El sistema no admite {0}', diff --git a/frontend/src/lang/modules/fa.ts b/frontend/src/lang/modules/fa.ts index 008ee0ced..a61ea989f 100644 --- a/frontend/src/lang/modules/fa.ts +++ b/frontend/src/lang/modules/fa.ts @@ -4271,7 +4271,6 @@ const message = { dockerGuard: 'محافظت از پورت کانتینر', systemFirewall: 'فایروال میزبان', systemFirewallHelper: 'دسترسی پورت‌های میزبان و قوانین ورودی را کنترل می‌کند.', - forwardPolicyDropWarning: 'این سرور هدایت ترافیک شبکه را محدود کرده است. ممکن است قوانین هدایت پورت کار نکنند.', forwardingHelper: 'قوانین انتقال پورت را مدیریت می‌کند.', dockerFirewallHelper: 'روش مدیریت محافظت از پورت کانتینر در 1Panel را انتخاب می‌کند.', dockerNftablesRequirement: 'Docker ≥ 29.0.0، آزمایشی', @@ -4355,10 +4354,9 @@ const message = { dockerInputNotProtected: 'قوانین INPUT میزبان مستقیماً از این پورت منتشرشده Docker محافظت نمی‌کنند. برای باز کردن محافظت از پورت کانتینر کلیک کنید.', notInitialized: 'راه‌اندازی نشده', - ipv6RARisk: - 'هدایت IPv6 مسدود شد: رابط‌های {0} دارای accept_ra=1 هستند و ممکن است به RA/SLAAC وابسته باشند. تنظیمات شبکه را بررسی کنید، برای رابط‌های نیازمند RA مقدار accept_ra=2 را به‌صورت پایدار تنظیم کنید و دوباره تلاش کنید.', + ipv6RARisk: 'فعال‌سازی هدایت IPv6 به دلیل خطر قطع شبکه مسدود شد. مستندات و گزارش‌های سیستم را بررسی کنید.', ipv6RACheckFailed: - 'بررسی تنظیمات RA در IPv6 ممکن نیست. فعال‌سازی هدایت IPv6 مسدود شده است. تنظیمات شبکه سیستم را بررسی کرده و دوباره تلاش کنید.', + 'فعال‌سازی هدایت IPv6 به دلیل عدم امکان بررسی پیکربندی شبکه مسدود شد. جزئیات در گزارش‌های سیستم موجود است.', ipv6ForwardingOnDemand: 'هدایت IPv6 فعال نیست. هنگام افزودن یا بازیابی قوانین IPv6 بررسی و فعال خواهد شد.', familyUnsupported: 'سیستم از {0} پشتیبانی نمی‌کند', familyChainIssue: '{0} · زنجیره {1} · {2}', diff --git a/frontend/src/lang/modules/ja.ts b/frontend/src/lang/modules/ja.ts index 18e16424b..96f448ed9 100644 --- a/frontend/src/lang/modules/ja.ts +++ b/frontend/src/lang/modules/ja.ts @@ -4294,8 +4294,6 @@ const message = { dockerGuard: 'コンテナポート保護', systemFirewall: 'ホストファイアウォール', systemFirewallHelper: 'ホストのポートアクセスと受信ルールを管理します。', - forwardPolicyDropWarning: - 'このサーバーではネットワーク転送が制限されているため、ポート転送ルールが機能しない可能性があります。', forwardingHelper: 'ポート転送ルールを管理します。', dockerFirewallHelper: '1Panel のコンテナポート保護の管理方法を選択します。', dockerNftablesRequirement: 'Docker ≥ 29.0.0、実験的', @@ -4377,9 +4375,9 @@ const message = { 'ホストの INPUT ルールでは、この Docker 公開ポートを直接保護できません。クリックしてコンテナポート保護を開きます。', notInitialized: '未初期化', ipv6RARisk: - 'IPv6 転送がブロックされています。インターフェース {0} は accept_ra=1 で、RA/SLAAC に依存している可能性があります。ネットワーク設定を確認し、RA が必要なインターフェースで accept_ra=2 を永続的に設定してから再試行してください。', + 'ネットワーク切断のおそれがあるため、IPv6 転送の有効化をブロックしました。ドキュメントとシステムログをご確認ください。', ipv6RACheckFailed: - 'IPv6 RA 設定を確認できないため、IPv6 転送の有効化をブロックしました。システムのネットワーク設定を確認して再試行してください。', + 'ネットワーク設定を確認できないため、IPv6 転送の有効化をブロックしました。詳細はシステムログをご確認ください。', ipv6ForwardingOnDemand: 'IPv6 転送は無効です。IPv6 ルールの追加または復元時に確認して有効化します。', familyUnsupported: 'システムは {0} をサポートしていません', familyChainIssue: '{0} · {1} チェーン · {2}', diff --git a/frontend/src/lang/modules/ko.ts b/frontend/src/lang/modules/ko.ts index fcb31974b..edfe95780 100644 --- a/frontend/src/lang/modules/ko.ts +++ b/frontend/src/lang/modules/ko.ts @@ -4215,7 +4215,6 @@ const message = { dockerGuard: '컨테이너 포트 보호', systemFirewall: '호스트 방화벽', systemFirewallHelper: '호스트 포트 접근과 인바운드 규칙을 관리합니다.', - forwardPolicyDropWarning: '현재 서버에서 네트워크 전달이 제한되어 포트 전달 규칙이 작동하지 않을 수 있습니다.', forwardingHelper: '포트 포워딩 규칙을 관리합니다.', dockerFirewallHelper: '1Panel 컨테이너 포트 보호 관리 방식을 선택합니다.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, 실험적', @@ -4296,9 +4295,9 @@ const message = { '호스트 INPUT 규칙은 이 Docker 게시 포트를 직접 보호하지 않습니다. 클릭하여 컨테이너 포트 보호를 여세요.', notInitialized: '초기화되지 않음', ipv6RARisk: - 'IPv6 전달이 차단되었습니다. 인터페이스 {0}의 accept_ra=1 설정으로 인해 RA/SLAAC에 의존할 수 있습니다. 네트워크 설정을 확인하고 RA가 필요한 인터페이스에 accept_ra=2를 영구 설정한 후 다시 시도하세요.', + '네트워크 연결이 끊길 위험이 있어 IPv6 전달 활성화를 차단했습니다. 문서와 시스템 로그를 확인하세요.', ipv6RACheckFailed: - 'IPv6 RA 설정을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 시스템 네트워크 설정을 확인한 후 다시 시도하세요.', + '네트워크 구성을 확인할 수 없어 IPv6 전달 활성화를 차단했습니다. 자세한 내용은 시스템 로그를 확인하세요.', ipv6ForwardingOnDemand: 'IPv6 전달이 활성화되지 않았습니다. IPv6 규칙을 추가하거나 복원할 때 확인 후 활성화됩니다.', familyUnsupported: '시스템에서 {0}을 지원하지 않습니다', diff --git a/frontend/src/lang/modules/lo.ts b/frontend/src/lang/modules/lo.ts index 4b2f04ffc..33a6dcdab 100644 --- a/frontend/src/lang/modules/lo.ts +++ b/frontend/src/lang/modules/lo.ts @@ -4182,7 +4182,6 @@ const message = { dockerGuard: 'ການປ້ອງກັນພອດຄອນເທນເນີ', systemFirewall: 'ໄຟວໍໂຮສ', systemFirewallHelper: 'ຄວບຄຸມການເຂົ້າເຖິງພອດໂຮສ ແລະ ກົດຂາເຂົ້າ.', - forwardPolicyDropWarning: 'ເຊີບເວີນີ້ຈຳກັດການສົ່ງຕໍ່ເຄືອຂ່າຍ. ກົດການສົ່ງຕໍ່ພອດອາດບໍ່ເຮັດວຽກ.', forwardingHelper: 'ຈັດການກົດການສົ່ງຕໍ່ພອດ.', dockerFirewallHelper: 'ເລືອກວິທີທີ່ 1Panel ຈັດການການປ້ອງກັນພອດຄອນເທນເນີ.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, ທົດລອງ', @@ -4260,9 +4259,9 @@ const message = { 'ກົດ INPUT ຂອງໂຮສບໍ່ໄດ້ປ້ອງກັນພອດ Docker ນີ້ໂດຍກົງ. ຄລິກເພື່ອເປີດການປ້ອງກັນພອດຄອນເທນເນີ.', notInitialized: 'ຍັງບໍ່ໄດ້ເລີ່ມຕົ້ນ', ipv6RARisk: - 'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກ: ອິນເຕີເຟດ {0} ມີ accept_ra=1 ແລະອາດອາໄສ RA/SLAAC. ກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍ, ຕັ້ງ accept_ra=2 ແບບຖາວອນໃຫ້ອິນເຕີເຟດທີ່ຕ້ອງການ RA ແລ້ວລອງໃໝ່.', + 'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເພື່ອປ້ອງກັນຄວາມສ່ຽງທີ່ເຄືອຂ່າຍຈະຂາດການເຊື່ອມຕໍ່. ເບິ່ງເອກະສານ ແລະ ບັນທຶກລະບົບ.', ipv6RACheckFailed: - 'ບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າ IPv6 RA ໄດ້. ການເປີດໃຊ້ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກ. ກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍແລ້ວລອງໃໝ່.', + 'ການສົ່ງຕໍ່ IPv6 ຖືກບລັອກເນື່ອງຈາກບໍ່ສາມາດກວດສອບການຕັ້ງຄ່າເຄືອຂ່າຍໄດ້. ເບິ່ງລາຍລະອຽດໃນບັນທຶກລະບົບ.', ipv6ForwardingOnDemand: 'ຍັງບໍ່ໄດ້ເປີດໃຊ້ການສົ່ງຕໍ່ IPv6. ລະບົບຈະກວດສອບແລະເປີດໃຊ້ເມື່ອເພີ່ມຫຼືກູ້ຄືນກົດ IPv6.', familyUnsupported: 'ລະບົບບໍ່ຮອງຮັບ {0}', familyChainIssue: '{0} · chain {1} · {2}', diff --git a/frontend/src/lang/modules/ms.ts b/frontend/src/lang/modules/ms.ts index 6d94adac9..4513d6b0c 100644 --- a/frontend/src/lang/modules/ms.ts +++ b/frontend/src/lang/modules/ms.ts @@ -4374,8 +4374,6 @@ const message = { dockerGuard: 'Perlindungan port bekas', systemFirewall: 'Tembok api hos', systemFirewallHelper: 'Mengawal akses port hos dan peraturan masuk.', - forwardPolicyDropWarning: - 'Pelayan ini mengehadkan pemajuan rangkaian. Peraturan pemajuan port mungkin tidak berfungsi.', forwardingHelper: 'Mengurus peraturan pemajuan port.', dockerFirewallHelper: 'Memilih cara 1Panel mengurus perlindungan port bekas.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, percubaan', @@ -4459,9 +4457,9 @@ const message = { 'Peraturan INPUT hos tidak melindungi port terbitan Docker ini secara langsung. Klik untuk membuka perlindungan port bekas.', notInitialized: 'Belum dimulakan', ipv6RARisk: - 'Pemajuan IPv6 disekat: antara muka {0} mempunyai accept_ra=1 dan mungkin bergantung pada RA/SLAAC. Semak konfigurasi rangkaian, tetapkan accept_ra=2 secara kekal pada antara muka yang memerlukan RA, kemudian cuba lagi.', + 'Pemajuan IPv6 disekat bagi mengelakkan risiko kehilangan sambungan rangkaian. Rujuk dokumentasi dan log sistem.', ipv6RACheckFailed: - 'Konfigurasi RA IPv6 tidak dapat diperiksa. Pengaktifan pemajuan IPv6 disekat. Semak konfigurasi rangkaian sistem dan cuba lagi.', + 'Pemajuan IPv6 disekat kerana konfigurasi rangkaian tidak dapat diperiksa. Lihat log sistem untuk butiran.', ipv6ForwardingOnDemand: 'Pemajuan IPv6 belum diaktifkan. Ia akan diperiksa dan diaktifkan apabila peraturan IPv6 ditambah atau dipulihkan.', familyUnsupported: 'Sistem tidak menyokong {0}', diff --git a/frontend/src/lang/modules/pt-br.ts b/frontend/src/lang/modules/pt-br.ts index 5122713f5..1cb2f933b 100644 --- a/frontend/src/lang/modules/pt-br.ts +++ b/frontend/src/lang/modules/pt-br.ts @@ -4395,8 +4395,6 @@ const message = { dockerGuard: 'Proteção de portas de contêineres', systemFirewall: 'Firewall do host', systemFirewallHelper: 'Controla o acesso às portas do host e as regras de entrada.', - forwardPolicyDropWarning: - 'Este servidor restringe o encaminhamento de rede. As regras de encaminhamento de portas podem não funcionar.', forwardingHelper: 'Gerencia regras de encaminhamento de portas.', dockerFirewallHelper: 'Seleciona como o 1Panel gerencia a proteção de portas de contêineres.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, experimental', @@ -4482,9 +4480,9 @@ const message = { 'As regras INPUT do host não protegem diretamente esta porta publicada pelo Docker. Clique para abrir a proteção de portas de contêineres.', notInitialized: 'Não inicializado', ipv6RARisk: - 'O encaminhamento IPv6 foi bloqueado: as interfaces {0} têm accept_ra=1 e podem depender de RA/SLAAC. Verifique a configuração de rede, configure accept_ra=2 de forma persistente nas interfaces que precisam de RA e tente novamente.', + 'O encaminhamento IPv6 foi bloqueado para evitar uma possível perda de conexão. Consulte a documentação e os logs do sistema.', ipv6RACheckFailed: - 'Não foi possível verificar a configuração RA do IPv6. A ativação do encaminhamento IPv6 foi bloqueada. Verifique a configuração de rede e tente novamente.', + 'O encaminhamento IPv6 foi bloqueado porque não foi possível verificar a configuração de rede. Consulte os logs do sistema.', ipv6ForwardingOnDemand: 'O encaminhamento IPv6 não está ativado. Ele será verificado e ativado ao adicionar ou restaurar regras IPv6.', familyUnsupported: 'O sistema não oferece suporte a {0}', diff --git a/frontend/src/lang/modules/ru.ts b/frontend/src/lang/modules/ru.ts index 5aa93c5d9..bab4678c9 100644 --- a/frontend/src/lang/modules/ru.ts +++ b/frontend/src/lang/modules/ru.ts @@ -4361,8 +4361,6 @@ const message = { dockerGuard: 'Защита портов контейнеров', systemFirewall: 'Брандмауэр хоста', systemFirewallHelper: 'Управляет доступом к портам хоста и входящими правилами.', - forwardPolicyDropWarning: - 'На этом сервере ограничена пересылка сетевого трафика. Правила перенаправления портов могут не работать.', forwardingHelper: 'Управляет правилами перенаправления портов.', dockerFirewallHelper: 'Выбирает способ управления защитой портов контейнеров в 1Panel.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, экспериментально', @@ -4447,9 +4445,9 @@ const message = { 'Правила INPUT хоста не защищают этот опубликованный Docker-порт напрямую. Нажмите, чтобы открыть защиту портов контейнеров.', notInitialized: 'Не инициализировано', ipv6RARisk: - 'Пересылка IPv6 заблокирована: интерфейсы {0} имеют accept_ra=1 и могут зависеть от RA/SLAAC. Проверьте настройки сети, сохраните accept_ra=2 для интерфейсов, которым нужен RA, и повторите попытку.', + 'Включение переадресации IPv6 заблокировано из-за риска потери связи. См. документацию и системные журналы.', ipv6RACheckFailed: - 'Не удалось проверить настройки RA для IPv6. Включение пересылки IPv6 заблокировано. Проверьте настройки сети и повторите попытку.', + 'Включение переадресации IPv6 заблокировано: не удалось проверить настройки сети. Подробности в системных журналах.', ipv6ForwardingOnDemand: 'Пересылка IPv6 не включена. Проверка и включение выполняются при добавлении или восстановлении правил IPv6.', familyUnsupported: 'Система не поддерживает {0}', diff --git a/frontend/src/lang/modules/tr.ts b/frontend/src/lang/modules/tr.ts index f2505ffbb..1b260ff5b 100644 --- a/frontend/src/lang/modules/tr.ts +++ b/frontend/src/lang/modules/tr.ts @@ -4379,7 +4379,6 @@ const message = { dockerGuard: 'Konteyner portu koruması', systemFirewall: 'Ana makine güvenlik duvarı', systemFirewallHelper: 'Ana makine port erişimini ve gelen kuralları yönetir.', - forwardPolicyDropWarning: 'Bu sunucu ağ yönlendirmesini kısıtlıyor. Port yönlendirme kuralları çalışmayabilir.', forwardingHelper: 'Port yönlendirme kurallarını yönetir.', dockerFirewallHelper: '1Panel konteyner portu korumasının nasıl yönetileceğini seçer.', dockerNftablesRequirement: 'Docker ≥ 29.0.0, deneysel', @@ -4466,9 +4465,9 @@ const message = { 'Ana makine INPUT kuralları bu Docker yayımlanmış portunu doğrudan korumaz. Konteyner portu korumasını açmak için tıklayın.', notInitialized: 'Başlatılmadı', ipv6RARisk: - 'IPv6 yönlendirme engellendi: {0} arayüzlerinde accept_ra=1 ayarlı ve bu arayüzler RA/SLAAC kullanıyor olabilir. Ağ yapılandırmasını kontrol edin, RA gereken arayüzlerde accept_ra=2 ayarını kalıcı olarak uygulayın ve yeniden deneyin.', + 'Ağ bağlantısının kesilme riski nedeniyle IPv6 yönlendirmesi engellendi. Belgeleri ve sistem günlüklerini inceleyin.', ipv6RACheckFailed: - 'IPv6 RA yapılandırması kontrol edilemedi. IPv6 yönlendirmeyi etkinleştirme engellendi. Sistem ağ yapılandırmasını kontrol edip yeniden deneyin.', + 'Ağ yapılandırması denetlenemediği için IPv6 yönlendirmesi engellendi. Ayrıntılar için sistem günlüklerini inceleyin.', ipv6ForwardingOnDemand: 'IPv6 yönlendirme etkin değil. IPv6 kuralları eklenirken veya geri yüklenirken kontrol edilip etkinleştirilecektir.', familyUnsupported: 'Sistem {0} desteğini sunmuyor', diff --git a/frontend/src/lang/modules/zh-Hant.ts b/frontend/src/lang/modules/zh-Hant.ts index 427affb2b..dd92ee85b 100644 --- a/frontend/src/lang/modules/zh-Hant.ts +++ b/frontend/src/lang/modules/zh-Hant.ts @@ -4020,7 +4020,6 @@ const message = { dockerGuard: '容器連接埠防護', systemFirewall: '主機防火牆', systemFirewallHelper: '用於管理主機連接埠存取和入站規則。', - forwardPolicyDropWarning: '目前伺服器限制了網路轉送，轉送規則可能無法生效。', forwardingHelper: '用於管理連接埠轉發規則。', dockerFirewallHelper: '用於選擇 1Panel 容器連接埠防護的管理方式。', dockerNftablesRequirement: 'Docker ≥ 29.0.0，實驗性', @@ -4092,9 +4091,8 @@ const message = { dockerInputUseHostFirewall: '此連接埠需要透過主機防火牆設定存取規則，請前往主機防火牆進行設定。', dockerInputNotProtected: '主機 INPUT 規則無法直接保護此 Docker 發佈連接埠，點擊前往容器連接埠防護。', notInitialized: '未初始化', - ipv6RARisk: - 'IPv6 轉送已阻止：網路介面 {0} 的 accept_ra=1，可能依賴 RA/SLAAC。請確認網路設定，為需要接收 RA 的介面持久化設定 accept_ra=2 後重試。', - ipv6RACheckFailed: '無法檢查 IPv6 RA 設定，已阻止啟用 IPv6 轉送。請檢查系統網路設定後重試。', + ipv6RARisk: 'IPv6 轉送可能導致網路中斷，已阻止啟用。請參閱文件，詳情見系統日誌。', + ipv6RACheckFailed: '無法檢查 IPv6 網路設定，已阻止啟用轉送。詳情見系統日誌。', ipv6ForwardingOnDemand: 'IPv6 轉送尚未啟用，將在新增或還原 IPv6 規則時檢查並啟用。', familyUnsupported: '系統不支援 {0}', familyChainIssue: '{0} · {1} 鏈 · {2}', diff --git a/frontend/src/lang/modules/zh.ts b/frontend/src/lang/modules/zh.ts index ff28bcf0a..086fcd033 100644 --- a/frontend/src/lang/modules/zh.ts +++ b/frontend/src/lang/modules/zh.ts @@ -4066,7 +4066,6 @@ const message = { dockerGuard: '容器端口防护', systemFirewall: '主机防火墙', systemFirewallHelper: '用于管理主机端口访问和入站规则。', - forwardPolicyDropWarning: '当前服务器限制了网络转发，转发规则可能无法生效。', forwardingHelper: '用于管理端口转发规则。', dockerFirewallHelper: '用于选择 1Panel 容器端口防护的管理方式。', dockerNftablesRequirement: 'Docker ≥ 29.0.0，实验性', @@ -4138,9 +4137,8 @@ const message = { dockerInputUseHostFirewall: '该端口需要通过主机防火墙设置访问规则，请前往主机防火墙进行配置。', dockerInputNotProtected: '宿主机 INPUT 规则不能直接保护此 Docker 发布端口，点击前往容器端口防护。', notInitialized: '未初始化', - ipv6RARisk: - 'IPv6 转发已阻止：网卡 {0} 的 accept_ra=1，可能依赖 RA/SLAAC。请确认网络配置，为需要接收 RA 的网卡持久化设置 accept_ra=2 后重试。', - ipv6RACheckFailed: '无法检查 IPv6 RA 配置，已阻止启用 IPv6 转发。请检查系统网络配置后重试。', + ipv6RARisk: 'IPv6 转发存在断网风险，已阻止启用。请参阅文档，详情见系统日志。', + ipv6RACheckFailed: '无法检查 IPv6 网络配置，已阻止启用转发。详情见系统日志。', ipv6ForwardingOnDemand: 'IPv6 转发尚未启用，将在添加或恢复 IPv6 规则时检查并启用。', familyUnsupported: '系统不支持 {0}', familyChainIssue: '{0} · {1} 链 · {2}', diff --git a/frontend/src/views/host/firewall/docker/import/index.vue b/frontend/src/views/host/firewall/docker/import/index.vue index 146edf1f1..3b2ddad99 100644 --- a/frontend/src/views/host/firewall/docker/import/index.vue +++ b/frontend/src/views/host/firewall/docker/import/index.vue @@ -6,7 +6,6 @@ :closable="false" :title="$t('firewall.importLimit', [FIREWALL_BATCH_LIMIT, FIREWALL_IMPORT_MAX_SIZE / 1024])" /> -
([]); const selects = ref(new Set()); const uploadRef = ref(); const uploaderFiles = ref([]); -const submitError = ref(''); const displaySources = (policy: Firewall.DockerGuardPolicy) => formatHostAddressList(policy.sources, policy.family); const fileOnChange = (uploadFile: UploadFile, uploadFiles: UploadFiles) => { @@ -109,7 +107,6 @@ const fileOnChange = (uploadFile: UploadFile, uploadFiles: UploadFiles) => { policies.value = []; selects.value = new Set(); - submitError.value = ''; uploaderFiles.value = uploadFiles; if (uploadFile.raw.size > FIREWALL_IMPORT_MAX_SIZE) { uploadRef.value?.clearFiles(); @@ -162,7 +159,6 @@ const onImport = async () => { return; } loading.value = true; - submitError.value = ''; try { const result = ( await upsertDockerPortGuardPolicies({ @@ -171,16 +167,17 @@ const onImport = async () => { }) ).data; if (!result.taskID || !result.queued) { - submitError.value = i18n.global.t('commons.msg.operationFailed'); + MsgError(i18n.global.t('commons.msg.operationFailed')); return; } visible.value = false; emit('created', result.taskID); } catch (error) { - submitError.value = + MsgError( (isAxiosError(error) && error.response?.data?.message) || - (error && getErrorMessage(error)) || - i18n.global.t('commons.res.commonError'); + (error && getErrorMessage(error)) || + i18n.global.t('commons.res.commonError'), + ); } finally { loading.value = false; } @@ -200,7 +197,6 @@ const acceptParams = () => { policies.value = []; selects.value = new Set(); uploaderFiles.value = []; - submitError.value = ''; uploadRef.value?.clearFiles(); visible.value = true; }; diff --git a/frontend/src/views/host/firewall/docker/index.vue b/frontend/src/views/host/firewall/docker/index.vue index 52b9abab7..ef48476fd 100644 --- a/frontend/src/views/host/firewall/docker/index.vue +++ b/frontend/src/views/host/firewall/docker/index.vue @@ -12,8 +12,7 @@ v-loading="loading" >