mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-01 16:44:23 +08:00
🦄 Sync 2026-09-27 22:25:23
This commit is contained in:
github-actions[bot] committed
1 parent
67a7165b7e
commit
4c6d0df36f
67 files changed
+415
-8397
No files matched your search
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-meow
|
||||
PKG_VERSION:=0.21.2
|
||||
PKG_RELEASE:=1
|
||||
PKG_RELEASE:=2
|
||||
|
||||
LUCI_TITLE:=LuCI support for meow (panel + settings)
|
||||
LUCI_DEPENDS:=+luci-base +meow
|
||||
@@ -1,10 +0,0 @@
|
||||
本仓库完全自包含:init 脚本、UCI 默认配置、默认 YAML、LuCI JS/JSON 均已收录
|
||||
(取自 meow-rs 仓库 `openwrt/` 目录),CI 里不需要再从上游仓库复制任何文件;
|
||||
构建时唯一的外部依赖是 `meow/Makefile` 声明的官方 release tarball
|
||||
(`PKG_SOURCE_URL` + `PKG_HASH` 校验)。
|
||||
|
||||
## 参考
|
||||
|
||||
- meow-rs: https://github.com/meow-rs/meow-rs
|
||||
- OpenWrt feeds 文档: https://openwrt.org/docs/guide-developer/feeds
|
||||
- OpenWrt apk 包管理器(25.12+): https://openwrt.org/docs/guide-user/additional-software/apk
|
||||
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
@@ -1,53 +0,0 @@
|
||||
# package/meow/Makefile
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=meow
|
||||
PKG_VERSION:=0.21.2
|
||||
PKG_RELEASE:=1
|
||||
PKG_MAINTAINER:=Max Lv <max.c.lv@gmail.com>
|
||||
PKG_LICENSE:=MIT
|
||||
PKG_LICENSE_FILES:=LICENSE
|
||||
|
||||
PKG_SOURCE:=meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl.tar.gz
|
||||
PKG_SOURCE_URL:=https://github.com/meow-rs/meow-rs/releases/download/v$(PKG_VERSION)/
|
||||
PKG_HASH:=7966b35ee2101e32406009f074f97cbbcc8017489daa02cd3fc5b91b4dbcbfeb
|
||||
PKG_BUILD_DIR:=$(BUILD_DIR)/meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
define Package/meow
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
TITLE:=meow - mihomo-compatible tunneling proxy kernel (Rust, static musl)
|
||||
URL:=https://github.com/meow-rs/meow-rs
|
||||
DEPENDS:=+libc
|
||||
endef
|
||||
|
||||
define Package/meow/description
|
||||
A high-performance, rule-based tunneling proxy kernel in Rust, compatible
|
||||
with mihomo (Clash Meta). Static binary; YAML config in /etc/meow/config.yaml,
|
||||
service settings in /etc/config/meow.
|
||||
endef
|
||||
|
||||
define Package/meow/conffiles
|
||||
/etc/config/meow
|
||||
/etc/meow/config.yaml
|
||||
endef
|
||||
|
||||
# 二进制是官方发布的静态 musl 构建,无需在 buildroot 内编译
|
||||
define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/meow/install
|
||||
$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config $(1)/etc/meow $(1)/etc/uci-defaults
|
||||
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/meow $(1)/usr/bin/meow
|
||||
$(INSTALL_BIN) ./files/meow.init $(1)/etc/init.d/meow
|
||||
$(INSTALL_DATA) ./files/meow.config $(1)/etc/config/meow
|
||||
$(INSTALL_DATA) ./files/config.yaml $(1)/etc/meow/config.yaml
|
||||
$(INSTALL_DATA) ./files/gateway.nft.template $(1)/etc/meow/gateway.nft.template
|
||||
$(INSTALL_BIN) ./files/firewall.sh $(1)/etc/meow/firewall.sh
|
||||
$(INSTALL_BIN) ./files/uci-defaults/99-meow-firewall $(1)/etc/uci-defaults/99-meow-firewall
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,meow))
|
||||
@@ -1,57 +0,0 @@
|
||||
# Default meow-rs configuration shipped with the OpenWrt package.
|
||||
# Edit this file, then restart the service: /etc/init.d/meow restart
|
||||
# Full reference: https://github.com/meow-rs/meow-rs/blob/main/config.example.yaml
|
||||
|
||||
# Combined HTTP + SOCKS5 proxy for LAN clients.
|
||||
mixed-port: 7890
|
||||
allow-lan: true
|
||||
bind-address: "0.0.0.0"
|
||||
|
||||
# DIRECT sockets carry this mark so the managed output-chain rule skips them
|
||||
# (loop avoidance). Keep this even with an external firewall.
|
||||
routing-mark: 9527
|
||||
|
||||
mode: rule
|
||||
log-level: info
|
||||
ipv6: false
|
||||
|
||||
# REST API + built-in web panel (served at /ui).
|
||||
external-controller: 0.0.0.0:9090
|
||||
secret: ""
|
||||
|
||||
# Transparent-gateway listener. MUST be declared here, NOT via the top-level
|
||||
# `tproxy-port:` shorthand: that shorthand hard-binds 127.0.0.1, so forwarded
|
||||
# LAN traffic (which the prerouting REDIRECT sends to LAN_IP:<port>) never
|
||||
# reaches it. `port` must match `tproxy_port` in /etc/config/meow.
|
||||
# Do NOT also set the top-level tproxy-port.
|
||||
listeners:
|
||||
- name: tproxy-gw
|
||||
type: tproxy
|
||||
listen: '0.0.0.0' # IPv4; see the nft template's `meta nfproto ipv6 return`
|
||||
port: 7893
|
||||
|
||||
# Recover the hostname for direct-IP TLS/HTTP where no DNS lookup happened.
|
||||
sniffer:
|
||||
enable: true
|
||||
override-destination: false
|
||||
sniff:
|
||||
TLS: { ports: [443] }
|
||||
HTTP: { ports: [80] }
|
||||
|
||||
dns:
|
||||
enable: true
|
||||
# Bind 0.0.0.0 (not 127.0.0.1): the nft rules DNAT LAN :53 to <LAN_IP>:1053.
|
||||
listen: 0.0.0.0:1053
|
||||
# DNS mode is intentionally left at the default. Before switching to fake-ip
|
||||
# you MUST add real proxies and make the LAST rule MATCH,<a proxy group>:
|
||||
# with fake-ip the dst is always a synthetic 198.18.x.x address, and a
|
||||
# trailing `MATCH,DIRECT` would send every unmatched domain to an unroutable
|
||||
# address. Also keep 198.18.0.0/16 OUT of the nft bypass sets.
|
||||
# enhanced-mode: fake-ip
|
||||
# fake-ip-range: 198.18.0.0/16
|
||||
nameserver:
|
||||
- 223.5.5.5
|
||||
- 1.1.1.1
|
||||
|
||||
rules:
|
||||
- MATCH,DIRECT # placeholder: replace with MATCH,<proxy group> once proxies are added
|
||||
@@ -1,23 +0,0 @@
|
||||
#!/bin/sh
|
||||
# fw4 回调入口: 由 /etc/config/firewall 的 include (type=script) 触发
|
||||
|
||||
MEOW_NFT=/etc/meow/gateway.nft
|
||||
|
||||
# 只有在“服务已启用 + 已开网关模式 + 进程在跑 + 规则文件已生成”
|
||||
# 时才装载规则，
|
||||
# 其余情况一律清表 —— 否则规则会指向一个没人监听的端口，
|
||||
# 直接黑洞整个 LAN。
|
||||
meow_rules_allowed() {
|
||||
[ "$(uci -q get meow.main.enabled)" = "1" ] || return 1
|
||||
[ "$(uci -q get meow.main.gateway)" = "1" ] || return 1
|
||||
[ -f "$MEOW_NFT" ] || return 1
|
||||
/etc/init.d/meow running 2>/dev/null || return 1
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
if meow_rules_allowed; then
|
||||
nft -f "$MEOW_NFT" 2>/dev/null || logger -t meow-firewall "nft rules load failed"
|
||||
else
|
||||
nft delete table inet meow_gateway 2>/dev/null
|
||||
fi
|
||||
@@ -1,43 +0,0 @@
|
||||
#!/usr/sbin/nft -f
|
||||
# Idempotent load: declare-then-delete ensures the table is rebuilt from
|
||||
# scratch on every `nft -f`, no matter how many times init / firewall.sh /
|
||||
# fw4 reload apply it. Without this header a second load fails with
|
||||
# "File exists" and the init script reports "failed to load gateway nft rules".
|
||||
table inet meow_gateway
|
||||
delete table inet meow_gateway
|
||||
|
||||
table inet meow_gateway {
|
||||
set reserved4 {
|
||||
type ipv4_addr; flags interval
|
||||
elements = { 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16,
|
||||
172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 }
|
||||
}
|
||||
set reserved6 {
|
||||
type ipv6_addr; flags interval
|
||||
elements = { ::1/128, fc00::/7, fe80::/10, ff00::/8 }
|
||||
}
|
||||
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
# Only forward traffic from LAN
|
||||
iifname != "@LAN_IF@" return
|
||||
|
||||
# DNS hijack: any :53 query from LAN -> meow DNS on @LAN_IP@:@DNSPORT@
|
||||
# (covers clients with hard-coded 8.8.8.8 etc.)
|
||||
meta nfproto ipv4 meta l4proto { tcp, udp } th dport 53 \
|
||||
dnat ip to @LAN_IP@:@DNSPORT@
|
||||
|
||||
# Skip traffic to the router itself / reserved ranges
|
||||
fib daddr type local return
|
||||
ip daddr @reserved4 return
|
||||
ip6 daddr @reserved6 return
|
||||
|
||||
# meow is configured IPv4-only (ipv6: false): never redirect forwarded
|
||||
# IPv6 to the v4 listener, or all IPv6 traffic is blackholed.
|
||||
meta nfproto ipv6 return
|
||||
|
||||
# Remaining TCP -> tproxy listener
|
||||
meta l4proto tcp redirect to :@TPORT@
|
||||
}
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
config meow 'main'
|
||||
# Set to '1' to start meow at boot and via /etc/init.d/meow start.
|
||||
option enabled '0'
|
||||
# meow YAML configuration (proxies, rules, DNS, listeners, ...).
|
||||
option config_file '/etc/meow/config.yaml'
|
||||
# Working directory for GeoIP databases, caches, downloaded rulesets.
|
||||
option work_dir '/etc/meow'
|
||||
# Port of the REST API / built-in web panel. Informational for LuCI:
|
||||
# it must match the `external-controller` port in config.yaml.
|
||||
option panel_port '9090'
|
||||
option tproxy_port '7893'
|
||||
option dns_port '1053'
|
||||
@@ -1,183 +0,0 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
USE_PROCD=1
|
||||
|
||||
START=99
|
||||
STOP=15
|
||||
|
||||
PROG=/usr/bin/meow
|
||||
CONF=/etc/meow/config.yaml
|
||||
|
||||
NFT_TEMPLATE=/etc/meow/gateway.nft.template
|
||||
NFT_RULES=/etc/meow/gateway.nft
|
||||
|
||||
extra_command "render_nft" "Render nft rules"
|
||||
|
||||
boot() {
|
||||
START=99
|
||||
start "$@"
|
||||
}
|
||||
|
||||
config_gateway_enabled() {
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get_bool gateway main gateway 0
|
||||
|
||||
[ "$enabled" = "1" ] && [ "$gateway" = "1" ]
|
||||
}
|
||||
|
||||
render_nft() {
|
||||
local lan_if lan_ip tport dnsport
|
||||
|
||||
config_load meow
|
||||
|
||||
config_get_bool gateway main gateway 0
|
||||
config_get tport main tproxy_port 7893
|
||||
config_get dnsport main dns_port 1053
|
||||
|
||||
[ "$gateway" = "1" ] || return 1
|
||||
|
||||
lan_if="$(uci -q get network.lan.device)"
|
||||
[ -n "$lan_if" ] || lan_if="br-lan"
|
||||
|
||||
lan_ip="$(uci -q get network.lan.ipaddr)"
|
||||
lan_ip="${lan_ip%%/*}"
|
||||
|
||||
[ -n "$lan_ip" ] || return 1
|
||||
|
||||
sed \
|
||||
-e "s|@LAN_IF@|$lan_if|g" \
|
||||
-e "s|@LAN_IP@|$lan_ip|g" \
|
||||
-e "s|@TPORT@|$tport|g" \
|
||||
-e "s|@DNSPORT@|$dnsport|g" \
|
||||
"$NFT_TEMPLATE" \
|
||||
> "$NFT_RULES"
|
||||
|
||||
logger -t meow "nft generated"
|
||||
}
|
||||
|
||||
wait_listener() {
|
||||
local port="$1" i=0
|
||||
|
||||
# 以“端口已 LISTEN”为准（文档 wait-tproxy.sh 的语义）：
|
||||
# 进程 running 不等于监听已 bind。优先 ss，回退 busybox netstat。
|
||||
while [ $i -lt 30 ]; do
|
||||
{ ss -lnt 2>/dev/null || netstat -lnt 2>/dev/null; } |
|
||||
grep -q ":$port " && return 0
|
||||
|
||||
sleep 1
|
||||
i=$((i+1))
|
||||
done
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
apply_gateway_rules() {
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get_bool gateway main gateway 0
|
||||
|
||||
# 未启用或未开网关模式：绝不允许留下规则
|
||||
if [ "$enabled" != "1" ] || [ "$gateway" != "1" ]; then
|
||||
remove_gateway_rules
|
||||
return 0
|
||||
fi
|
||||
|
||||
# 服务没在跑时绝不装规则 —— 这是“关掉 meow 后整网断”的根源
|
||||
if ! service_running; then
|
||||
logger -t meow "meow not running; gateway rules NOT applied"
|
||||
remove_gateway_rules
|
||||
return 1
|
||||
fi
|
||||
|
||||
config_get tport main tproxy_port 7893
|
||||
|
||||
render_nft || return 1
|
||||
|
||||
# 超时后仍加载规则（fail-closed，宁可挡住也不放行泄漏），
|
||||
# 与文档 wait-tproxy.sh 的“proceed regardless”一致；
|
||||
# 与旧实现的区别是：上面已确认服务确实在运行。
|
||||
if ! wait_listener "$tport"; then
|
||||
logger -t meow "listener :$tport not up after 30s; loading rules anyway (fail-closed)"
|
||||
fi
|
||||
|
||||
nft -f "$NFT_RULES"
|
||||
}
|
||||
|
||||
remove_gateway_rules() {
|
||||
nft delete table inet meow_gateway 2>/dev/null
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger meow
|
||||
procd_add_reload_trigger network
|
||||
}
|
||||
|
||||
start_service() {
|
||||
local enabled config_file work_dir
|
||||
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get config_file main config_file "$CONF"
|
||||
config_get work_dir main work_dir /etc/meow
|
||||
|
||||
# 关闭服务的路径不会调用 service_stopped，
|
||||
# 这里必须先清掉残留规则
|
||||
if [ "$enabled" != "1" ]; then
|
||||
remove_gateway_rules
|
||||
logger -t meow "disabled"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! "$PROG" -f "$config_file" -t >/dev/null 2>&1; then
|
||||
logger -t meow "config test failed"
|
||||
return 1
|
||||
fi
|
||||
|
||||
procd_open_instance
|
||||
|
||||
procd_set_param command \
|
||||
"$PROG" \
|
||||
-f "$config_file" \
|
||||
-d "$work_dir"
|
||||
|
||||
# OpenWrt 25.12 apk环境修正
|
||||
procd_set_param env HOME="$work_dir"
|
||||
|
||||
procd_set_param respawn
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
|
||||
procd_set_param file \
|
||||
"$config_file" \
|
||||
"/etc/config/meow"
|
||||
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
remove_gateway_rules
|
||||
}
|
||||
|
||||
# 显式提供 reload_service，避免 rc.common 把 reload 退化成 start
|
||||
# 从而绕过 service_stopped 的规则清理。
|
||||
reload_service() {
|
||||
stop "$@"
|
||||
start "$@"
|
||||
}
|
||||
|
||||
service_started() {
|
||||
if ! config_gateway_enabled; then
|
||||
remove_gateway_rules
|
||||
return 0
|
||||
fi
|
||||
|
||||
apply_gateway_rules
|
||||
}
|
||||
|
||||
service_stopped() {
|
||||
remove_gateway_rules
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# 注册 meow 的 nft 规则回调到 fw4：每次 firewall reload 都会执行该脚本
|
||||
[ -f /etc/config/firewall ] || touch /etc/config/firewall
|
||||
|
||||
uci -q get firewall.meow >/dev/null 2>&1 || {
|
||||
uci -q set firewall.meow=include >/dev/null
|
||||
uci -q set firewall.meow.name='meow transparent gateway' >/dev/null
|
||||
}
|
||||
uci -q set firewall.meow.type='script' >/dev/null
|
||||
uci -q set firewall.meow.path='/etc/meow/firewall.sh' >/dev/null
|
||||
uci -q set firewall.meow.enabled='1' >/dev/null
|
||||
uci -q commit firewall
|
||||
|
||||
exit 0
|
||||
File renamed without changes.
File renamed without changes.
@@ -1,50 +0,0 @@
|
||||
#!/bin/bash
|
||||
# scripts/update_meow_version.sh — 跟随 meow-rs 上游 release 自动更新 feed
|
||||
# 行为:
|
||||
# 1) 通过 GitHub API 获取 meow-rs 最新 release tag(形如 v0.21.2)
|
||||
# 2) 下载对应 aarch64 musl tarball,运行时计算真实 SHA256(不硬编码)
|
||||
# 3) 用 sed 更新 meow/Makefile 的 PKG_VERSION 与 PKG_HASH(保留 Tab 缩进)
|
||||
# 以及 luci-app-meow/Makefile 的 PKG_VERSION(两个包版本保持一致)
|
||||
# 4) 已是最新版本时无修改、退出码 0(CI 判定为无变化)
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
cd "$REPO_ROOT"
|
||||
|
||||
UPSTREAM="meow-rs/meow-rs"
|
||||
TARBALL_PREFIX="aarch64-unknown-linux-musl.tar.gz" # 静态 musl 二进制包
|
||||
MEOW_MK="meow/Makefile"
|
||||
LUCI_MK="luci-app-meow/Makefile"
|
||||
|
||||
# ---- 1. 获取最新 release tag ----
|
||||
TAG="$(curl -fsSL --retry 3 \
|
||||
"https://api.github.com/repos/${UPSTREAM}/releases/latest" \
|
||||
| grep -oP '"tag_name":\s*"\K[^"]+')"
|
||||
[ -n "${TAG}" ] || { echo "ERROR: 无法获取上游 release tag" >&2; exit 1; }
|
||||
VERSION="${TAG#v}" # PKG_VERSION 不带 v 前缀(源码 URL 用 v$(PKG_VERSION) 拼接)
|
||||
|
||||
CURRENT="$(grep '^PKG_VERSION:=' "${MEOW_MK}" | cut -d= -f2)"
|
||||
if [ "${VERSION}" = "${CURRENT}" ]; then
|
||||
echo "meow 已是最新版本 ${TAG},无需更新。"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ---- 2. 下载并计算真实 SHA256 ----
|
||||
URL="https://github.com/${UPSTREAM}/releases/download/${TAG}/meow-${TAG}-${TARBALL_PREFIX}"
|
||||
TMP="$(mktemp)"
|
||||
trap 'rm -f "${TMP}"' EXIT
|
||||
curl -fsSL --retry 3 -o "${TMP}" "${URL}"
|
||||
HASH="$(sha256sum "${TMP}" | cut -d' ' -f1)"
|
||||
echo "上游 ${TAG} tarball SHA256 = ${HASH}"
|
||||
|
||||
# ---- 3. 更新 Makefile(sed 保留行内 Tab;两个包版本同步) ----
|
||||
sed -i "s|^PKG_VERSION:=.*|PKG_VERSION:=${VERSION}|" "${MEOW_MK}" "${LUCI_MK}"
|
||||
sed -i "s|^PKG_HASH:=.*|PKG_HASH:=${HASH}|" "${MEOW_MK}"
|
||||
|
||||
# ---- 4. 完整性自检:PKG_SOURCE/URL 拼接 + 哈希回验 ----
|
||||
SOURCE_NAME="meow-v${VERSION}-${TARBALL_PREFIX}"
|
||||
[ -f "${TMP}" ] && [ "$(sha256sum "${TMP}" | cut -d' ' -f1)" = "${HASH}" ] \
|
||||
|| { echo "ERROR: 哈希回验失败" >&2; exit 1; }
|
||||
echo "已更新 ${MEOW_MK}: PKG_VERSION=${VERSION}, PKG_HASH=${HASH}"
|
||||
echo "已更新 ${LUCI_MK}: PKG_VERSION=${VERSION}"
|
||||
echo "源码包名(由 \$(PKG_VERSION) 拼接): ${SOURCE_NAME}"
|
||||
Reference in new issue
Block a user