cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-11-04 22:53:56 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

🤞 Sync 2026-09-30 09:28:31

Browse Source
This commit is contained in:
github-actions[bot] committed 2026-09-30 09:28:31 +08:00
1 parent 0108cfa10a
commit 3d9edb1c37
78 files changed
+4594 -1815
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/generator/client.uc
+14
View File
@@ -58,6 +58,20 @@ import { attachSchema, attachExperimental } from './common.uc';
export function generate(dm, env) {
const ctx = build_context(dm, env);
/* Everything the client prints lands in one file, and not all of it was
* decided here: when the proxy node cannot reach a destination, sing-box
* reports it through the same logger, so a line like
*
* open connection to 1.2.3.4:443 using outbound/direct[direct]:
* connect: connection refused
*
* can be the *node's* failure rather than this router sending the traffic
* direct. Reading it as a local routing decision already produced one
* wrong conclusion during review. What the router actually did is in the
* forwarding layer: `nft list chain inet fw4 homeproxy_redirect` (a
* `return` branch is direct, the final `goto` is the proxy port) and
* `/proc/net/nf_conntrack` (`sport=5331` on the reply tuple). See the
* README's troubleshooting section. */
const config = {
log: {
disabled: false,
luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/generator/context.uc
+18
View File
@@ -130,9 +130,27 @@ export function build_context(dm, env) {
udp_mapping = (udp_mapping_raw === 'default') ? '' : udp_mapping_raw,
udp_filtering = (udp_filtering_raw === 'default') ? '' : udp_filtering_raw;
/* Where a destination the preset lists do not mention goes. This is the
* mode's whole default policy, so it is declared once here and read by
* both consumers - the route rule chain and the DNS rule chain:
*
* bypass_mainland_china mainland -> direct, everything else -> proxy
* global everything -> proxy
* gfwlist only the list -> proxy, everything else direct
* proxy_mainland_china mainland -> proxy, everything else -> direct
*
* The two chains have to agree. They used to say it independently (a
* literal `main-dns` in dns.uc, a literal `main-out` in route.uc) with
* nothing tying them together, and the route side applied "unknown goes
* to the proxy" to all four modes - so "Only proxy mainland China" sent
* every unlisted destination through the proxy, which is the opposite of
* what the mode is named. Both now derive from this one value. */
const proxy_fallback = (routing_mode !== 'proxy_mainland_china');
/* Routing-mode-dependent defaults */
const ctx = {
routing_mode, proxy_mode, ipv6_support, log_level,
proxy_fallback,
self_mark, ntp_server, dns_port, mixed_port,
redirect_port, tproxy_port,
tun_name, tun_addr4, tun_addr6, tun_mtu,
luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/generator/dns.uc
+5 -1
View File
@@ -112,7 +112,11 @@ function append_proxy_dns(config, dm, ctx) {
detour: 'main-out',
...parse_dnsserver(ctx.dns_server, 'tcp')
});
config.dns.final = 'main-dns';
/* The DNS half of the mode's default policy. It has to name the same
* side the route chain falls through to (ctx.proxy_fallback), or a
* domain that ends up proxied would be resolved by the resolver of the
* other path. The pair is asserted per mode in the generator suite. */
config.dns.final = ctx.proxy_fallback ? 'main-dns' : 'default-dns';
if (length(ctx.direct_domain_list))
push(config.dns.rules, {
luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/generator/route.uc
+76 -22
View File
@@ -26,7 +26,7 @@
'use strict';
import { isEmpty, strToInt, strToTime, strToBool, parse_port } from '../homeproxy-pro.uc';
import { isEmpty, strToInt, strToTime, strToBool, parse_port, HP_DIR } from '../homeproxy-pro.uc';
import { get_outbound, get_resolver, get_ruleset, get_direct_override } from './common.uc';
@@ -92,15 +92,24 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
outbound: 'direct-out'
});
/* Bypass CN traffic: resolve the destination first, then route by IP.
sing-box does not match an IP-based rule set (geoip-cn) against a domain
destination unless it is resolved first, so add an explicit resolve
action; geoip-cn then sends China IPs to direct and everything else falls
through to main-out (proxy). This avoids relying on the geosite-* domain
lists, which can mis-classify foreign domains (e.g. Google's gvt2.com
beacons) as "cn" and send them direct to time out. Keep the direct-domain
fast-path above for known direct domains. */
if (ctx.routing_mode === 'bypass_mainland_china') {
/* Split by destination IP, in both directions.
*
* sing-box does not match an IP-based rule set (geoip-cn) against a
* domain destination unless it is resolved first, so an explicit resolve
* action comes first. Which way the split points is the mode's default
* policy (ctx.proxy_fallback):
*
* bypass/global/gfwlist mainland -> direct, the rest falls through to
* main-out (proxy)
* proxy_mainland_china mainland -> proxy, the rest falls through to
* direct-out
*
* Using geoip-cn rather than the geosite-* domain lists is deliberate:
* those mis-classify foreign domains (Google's gvt2.com beacons) as "cn"
* and would send them direct to time out. Keep the direct-domain
* fast-path above for known direct domains. */
if (ctx.routing_mode === 'bypass_mainland_china'
|| ctx.routing_mode === 'proxy_mainland_china') {
push(config.route.rules, {
action: 'resolve',
strategy: (ctx.ipv6_support !== '1') ? 'prefer_ipv4' : null
@@ -108,6 +117,23 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
push(config.route.rules, {
rule_set: 'geoip-cn',
action: 'route',
outbound: ctx.proxy_fallback ? 'direct-out' : 'main-out'
});
}
if (ctx.routing_mode === 'bypass_mainland_china') {
/* geoip-cn.srs is upstream's list; the firewall's mainland set is
* built from our own china_ip4.txt (firewall_post.ut reads it
* directly). The two disagree - the bundled list has 8.152.0.0/13
* (Alibaba Cloud) and geoip-cn.srs does not - so a connection into
* that range passes the firewall as "not mainland" and would then be
* sent direct by the rule above instead of to the proxy. This local
* rule-set is generated from the same china_ip4.txt, which is what
* makes both sides decide from one list. In
* proxy_mainland_china it is not needed twice: the geoip-cn rule
* already selects the mainland side for the proxy. */
push(config.route.rules, {
rule_set: 'china-ip',
action: 'route',
outbound: 'direct-out'
});
}
@@ -134,7 +160,10 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
override_port: main_override.override_port
});
config.route.final = 'main-out';
/* The route half of the mode's default policy - the other consumer of
* ctx.proxy_fallback, and the reason dns.final and this line are
* asserted together per mode. */
config.route.final = ctx.proxy_fallback ? 'main-out' : 'direct-out';
/* --- proxy-mode rule_set block ----------------------------------- */
@@ -162,7 +191,13 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
]
});
if (ctx.routing_mode === 'bypass_mainland_china') {
/* Both mainland modes split on geoip-cn, so both need it declared - it is
* what the route rule added above matches. `proxy_mainland_china` used
* to reach this point without it and sing-box refused the whole config
* with "initialize rule[3]: rule-set not found: geoip-cn", which the
* health gate turned into a rollback and an unproxied network. */
if (ctx.routing_mode === 'bypass_mainland_china'
|| ctx.routing_mode === 'proxy_mainland_china') {
/*
* Fetched straight from the upstream SagerNet repositories and
* downloaded through the selected node. A direct fetch depends on
@@ -170,18 +205,22 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
* makes it fail intermittently; the files total ~250 KB per
* day, so proxying the download costs almost nothing.
*
* Both geosite-cn and geoip-cn are still emitted, but they are
* consumed by different blocks:
* Both rule_sets are emitted, but they are consumed by different
* blocks:
*
* geoip-cn - referenced by the route rule above (line 105) to
* split CN destinations to direct-out.
* geoip-cn - referenced by the route rule above to split
* destinations by IP: mainland -> direct-out in
* bypass_mainland_china, mainland -> main-out in
* proxy_mainland_china.
* geosite-cn - referenced only by the DNS rule in
* generator/dns.uc line 135-139 (rule_set: geosite-cn
* -> server: china-dns); the route layer never
* matches it. Sing-box still loads and keeps the
* rule-set in memory even when only one block
* references it, so removing it would also break the
* DNS split.
* generator/dns.uc (rule_set: geosite-cn ->
* server: china-dns); the route layer never matches
* it. Sing-box still loads and keeps the rule-set in
* memory even when only one block references it, so
* removing it would also break the DNS split. It is
* only declared for bypass_mainland_china because that
* is the only mode whose DNS chain routes through
* china-dns.
*
* History: a third geosite-noncn used to be declared here as well,
* but no rule referenced it and sing-box still loaded and updated
@@ -205,6 +244,21 @@ function build_route_proxy(config, dm, ctx, direct_overrides) {
update_interval: '24h',
download_detour: 'main-out'
});
/* Local, and not downloaded: it is generated from the same
* china_ip4.txt the firewall renders homeproxy_mainland_addr_v4
* from, so the two cannot drift apart. `type: local` is watched by
* sing-box with fswatch, so when the resource updater replaces the
* file the running instance reloads it in place - no restart and,
* more importantly, no second copy of the list to keep in sync.
* China IPv6 is deliberately absent: the firewall only fills the v6
* set when ipv6_support is on, and the client refuses to resolve
* AAAA when it is off. */
push(config.route.rule_set, {
type: 'local',
tag: 'china-ip',
path: HP_DIR + '/resources/china_ip4.json'
});
}
if (isEmpty(config.route.rule_set))