mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-31 15:45:13 +08:00
🦄 Sync 2026-09-27 22:25:23
This commit is contained in:
github-actions[bot] committed
1 parent
67a7165b7e
commit
4c6d0df36f
67 files changed
+415
-8397
No files matched your search
@@ -0,0 +1,53 @@
|
||||
# package/meow/Makefile
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=meow
|
||||
PKG_VERSION:=0.21.2
|
||||
PKG_RELEASE:=1
|
||||
PKG_MAINTAINER:=Max Lv <max.c.lv@gmail.com>
|
||||
PKG_LICENSE:=MIT
|
||||
PKG_LICENSE_FILES:=LICENSE
|
||||
|
||||
PKG_SOURCE:=meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl.tar.gz
|
||||
PKG_SOURCE_URL:=https://github.com/meow-rs/meow-rs/releases/download/v$(PKG_VERSION)/
|
||||
PKG_HASH:=skip
|
||||
PKG_BUILD_DIR:=$(BUILD_DIR)/meow-v$(PKG_VERSION)-aarch64-unknown-linux-musl
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
define Package/meow
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
TITLE:=meow - mihomo-compatible tunneling proxy kernel (Rust, static musl)
|
||||
URL:=https://github.com/meow-rs/meow-rs
|
||||
DEPENDS:=+libc
|
||||
endef
|
||||
|
||||
define Package/meow/description
|
||||
A high-performance, rule-based tunneling proxy kernel in Rust, compatible
|
||||
with mihomo (Clash Meta). Static binary; YAML config in /etc/meow/config.yaml,
|
||||
service settings in /etc/config/meow.
|
||||
endef
|
||||
|
||||
define Package/meow/conffiles
|
||||
/etc/config/meow
|
||||
/etc/meow/config.yaml
|
||||
endef
|
||||
|
||||
# 二进制是官方发布的静态 musl 构建,无需在 buildroot 内编译
|
||||
define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/meow/install
|
||||
$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config $(1)/etc/meow $(1)/etc/uci-defaults
|
||||
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/meow $(1)/usr/bin/meow
|
||||
$(INSTALL_BIN) ./files/meow.init $(1)/etc/init.d/meow
|
||||
$(INSTALL_DATA) ./files/meow.config $(1)/etc/config/meow
|
||||
$(INSTALL_DATA) ./files/config.yaml $(1)/etc/meow/config.yaml
|
||||
$(INSTALL_DATA) ./files/gateway.nft.template $(1)/etc/meow/gateway.nft.template
|
||||
$(INSTALL_BIN) ./files/firewall.sh $(1)/etc/meow/firewall.sh
|
||||
$(INSTALL_BIN) ./files/uci-defaults/99-meow-firewall $(1)/etc/uci-defaults/99-meow-firewall
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,meow))
|
||||
@@ -0,0 +1,57 @@
|
||||
# Default meow-rs configuration shipped with the OpenWrt package.
|
||||
# Edit this file, then restart the service: /etc/init.d/meow restart
|
||||
# Full reference: https://github.com/meow-rs/meow-rs/blob/main/config.example.yaml
|
||||
|
||||
# Combined HTTP + SOCKS5 proxy for LAN clients.
|
||||
mixed-port: 7890
|
||||
allow-lan: true
|
||||
bind-address: "0.0.0.0"
|
||||
|
||||
# DIRECT sockets carry this mark so the managed output-chain rule skips them
|
||||
# (loop avoidance). Keep this even with an external firewall.
|
||||
routing-mark: 9527
|
||||
|
||||
mode: rule
|
||||
log-level: info
|
||||
ipv6: false
|
||||
|
||||
# REST API + built-in web panel (served at /ui).
|
||||
external-controller: 0.0.0.0:9090
|
||||
secret: ""
|
||||
|
||||
# Transparent-gateway listener. MUST be declared here, NOT via the top-level
|
||||
# `tproxy-port:` shorthand: that shorthand hard-binds 127.0.0.1, so forwarded
|
||||
# LAN traffic (which the prerouting REDIRECT sends to LAN_IP:<port>) never
|
||||
# reaches it. `port` must match `tproxy_port` in /etc/config/meow.
|
||||
# Do NOT also set the top-level tproxy-port.
|
||||
listeners:
|
||||
- name: tproxy-gw
|
||||
type: tproxy
|
||||
listen: '0.0.0.0' # IPv4; see the nft template's `meta nfproto ipv6 return`
|
||||
port: 7893
|
||||
|
||||
# Recover the hostname for direct-IP TLS/HTTP where no DNS lookup happened.
|
||||
sniffer:
|
||||
enable: true
|
||||
override-destination: false
|
||||
sniff:
|
||||
TLS: { ports: [443] }
|
||||
HTTP: { ports: [80] }
|
||||
|
||||
dns:
|
||||
enable: true
|
||||
# Bind 0.0.0.0 (not 127.0.0.1): the nft rules DNAT LAN :53 to <LAN_IP>:1053.
|
||||
listen: 0.0.0.0:1053
|
||||
# DNS mode is intentionally left at the default. Before switching to fake-ip
|
||||
# you MUST add real proxies and make the LAST rule MATCH,<a proxy group>:
|
||||
# with fake-ip the dst is always a synthetic 198.18.x.x address, and a
|
||||
# trailing `MATCH,DIRECT` would send every unmatched domain to an unroutable
|
||||
# address. Also keep 198.18.0.0/16 OUT of the nft bypass sets.
|
||||
# enhanced-mode: fake-ip
|
||||
# fake-ip-range: 198.18.0.0/16
|
||||
nameserver:
|
||||
- 223.5.5.5
|
||||
- 1.1.1.1
|
||||
|
||||
rules:
|
||||
- MATCH,DIRECT # placeholder: replace with MATCH,<proxy group> once proxies are added
|
||||
@@ -0,0 +1,23 @@
|
||||
#!/bin/sh
|
||||
# fw4 回调入口: 由 /etc/config/firewall 的 include (type=script) 触发
|
||||
|
||||
MEOW_NFT=/etc/meow/gateway.nft
|
||||
|
||||
# 只有在“服务已启用 + 已开网关模式 + 进程在跑 + 规则文件已生成”
|
||||
# 时才装载规则，
|
||||
# 其余情况一律清表 —— 否则规则会指向一个没人监听的端口，
|
||||
# 直接黑洞整个 LAN。
|
||||
meow_rules_allowed() {
|
||||
[ "$(uci -q get meow.main.enabled)" = "1" ] || return 1
|
||||
[ "$(uci -q get meow.main.gateway)" = "1" ] || return 1
|
||||
[ -f "$MEOW_NFT" ] || return 1
|
||||
/etc/init.d/meow running 2>/dev/null || return 1
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
if meow_rules_allowed; then
|
||||
nft -f "$MEOW_NFT" 2>/dev/null || logger -t meow-firewall "nft rules load failed"
|
||||
else
|
||||
nft delete table inet meow_gateway 2>/dev/null
|
||||
fi
|
||||
@@ -0,0 +1,43 @@
|
||||
#!/usr/sbin/nft -f
|
||||
# Idempotent load: declare-then-delete ensures the table is rebuilt from
|
||||
# scratch on every `nft -f`, no matter how many times init / firewall.sh /
|
||||
# fw4 reload apply it. Without this header a second load fails with
|
||||
# "File exists" and the init script reports "failed to load gateway nft rules".
|
||||
table inet meow_gateway
|
||||
delete table inet meow_gateway
|
||||
|
||||
table inet meow_gateway {
|
||||
set reserved4 {
|
||||
type ipv4_addr; flags interval
|
||||
elements = { 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16,
|
||||
172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 }
|
||||
}
|
||||
set reserved6 {
|
||||
type ipv6_addr; flags interval
|
||||
elements = { ::1/128, fc00::/7, fe80::/10, ff00::/8 }
|
||||
}
|
||||
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
# Only forward traffic from LAN
|
||||
iifname != "@LAN_IF@" return
|
||||
|
||||
# DNS hijack: any :53 query from LAN -> meow DNS on @LAN_IP@:@DNSPORT@
|
||||
# (covers clients with hard-coded 8.8.8.8 etc.)
|
||||
meta nfproto ipv4 meta l4proto { tcp, udp } th dport 53 \
|
||||
dnat ip to @LAN_IP@:@DNSPORT@
|
||||
|
||||
# Skip traffic to the router itself / reserved ranges
|
||||
fib daddr type local return
|
||||
ip daddr @reserved4 return
|
||||
ip6 daddr @reserved6 return
|
||||
|
||||
# meow is configured IPv4-only (ipv6: false): never redirect forwarded
|
||||
# IPv6 to the v4 listener, or all IPv6 traffic is blackholed.
|
||||
meta nfproto ipv6 return
|
||||
|
||||
# Remaining TCP -> tproxy listener
|
||||
meta l4proto tcp redirect to :@TPORT@
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
config meow 'main'
|
||||
# Set to '1' to start meow at boot and via /etc/init.d/meow start.
|
||||
option enabled '0'
|
||||
# meow YAML configuration (proxies, rules, DNS, listeners, ...).
|
||||
option config_file '/etc/meow/config.yaml'
|
||||
# Working directory for GeoIP databases, caches, downloaded rulesets.
|
||||
option work_dir '/etc/meow'
|
||||
# Port of the REST API / built-in web panel. Informational for LuCI:
|
||||
# it must match the `external-controller` port in config.yaml.
|
||||
option panel_port '9090'
|
||||
option tproxy_port '7893'
|
||||
option dns_port '1053'
|
||||
@@ -0,0 +1,183 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
USE_PROCD=1
|
||||
|
||||
START=99
|
||||
STOP=15
|
||||
|
||||
PROG=/usr/bin/meow
|
||||
CONF=/etc/meow/config.yaml
|
||||
|
||||
NFT_TEMPLATE=/etc/meow/gateway.nft.template
|
||||
NFT_RULES=/etc/meow/gateway.nft
|
||||
|
||||
extra_command "render_nft" "Render nft rules"
|
||||
|
||||
boot() {
|
||||
START=99
|
||||
start "$@"
|
||||
}
|
||||
|
||||
config_gateway_enabled() {
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get_bool gateway main gateway 0
|
||||
|
||||
[ "$enabled" = "1" ] && [ "$gateway" = "1" ]
|
||||
}
|
||||
|
||||
render_nft() {
|
||||
local lan_if lan_ip tport dnsport
|
||||
|
||||
config_load meow
|
||||
|
||||
config_get_bool gateway main gateway 0
|
||||
config_get tport main tproxy_port 7893
|
||||
config_get dnsport main dns_port 1053
|
||||
|
||||
[ "$gateway" = "1" ] || return 1
|
||||
|
||||
lan_if="$(uci -q get network.lan.device)"
|
||||
[ -n "$lan_if" ] || lan_if="br-lan"
|
||||
|
||||
lan_ip="$(uci -q get network.lan.ipaddr)"
|
||||
lan_ip="${lan_ip%%/*}"
|
||||
|
||||
[ -n "$lan_ip" ] || return 1
|
||||
|
||||
sed \
|
||||
-e "s|@LAN_IF@|$lan_if|g" \
|
||||
-e "s|@LAN_IP@|$lan_ip|g" \
|
||||
-e "s|@TPORT@|$tport|g" \
|
||||
-e "s|@DNSPORT@|$dnsport|g" \
|
||||
"$NFT_TEMPLATE" \
|
||||
> "$NFT_RULES"
|
||||
|
||||
logger -t meow "nft generated"
|
||||
}
|
||||
|
||||
wait_listener() {
|
||||
local port="$1" i=0
|
||||
|
||||
# 以“端口已 LISTEN”为准（文档 wait-tproxy.sh 的语义）：
|
||||
# 进程 running 不等于监听已 bind。优先 ss，回退 busybox netstat。
|
||||
while [ $i -lt 30 ]; do
|
||||
{ ss -lnt 2>/dev/null || netstat -lnt 2>/dev/null; } |
|
||||
grep -q ":$port " && return 0
|
||||
|
||||
sleep 1
|
||||
i=$((i+1))
|
||||
done
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
apply_gateway_rules() {
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get_bool gateway main gateway 0
|
||||
|
||||
# 未启用或未开网关模式：绝不允许留下规则
|
||||
if [ "$enabled" != "1" ] || [ "$gateway" != "1" ]; then
|
||||
remove_gateway_rules
|
||||
return 0
|
||||
fi
|
||||
|
||||
# 服务没在跑时绝不装规则 —— 这是“关掉 meow 后整网断”的根源
|
||||
if ! service_running; then
|
||||
logger -t meow "meow not running; gateway rules NOT applied"
|
||||
remove_gateway_rules
|
||||
return 1
|
||||
fi
|
||||
|
||||
config_get tport main tproxy_port 7893
|
||||
|
||||
render_nft || return 1
|
||||
|
||||
# 超时后仍加载规则（fail-closed，宁可挡住也不放行泄漏），
|
||||
# 与文档 wait-tproxy.sh 的“proceed regardless”一致；
|
||||
# 与旧实现的区别是：上面已确认服务确实在运行。
|
||||
if ! wait_listener "$tport"; then
|
||||
logger -t meow "listener :$tport not up after 30s; loading rules anyway (fail-closed)"
|
||||
fi
|
||||
|
||||
nft -f "$NFT_RULES"
|
||||
}
|
||||
|
||||
remove_gateway_rules() {
|
||||
nft delete table inet meow_gateway 2>/dev/null
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger meow
|
||||
procd_add_reload_trigger network
|
||||
}
|
||||
|
||||
start_service() {
|
||||
local enabled config_file work_dir
|
||||
|
||||
config_load meow
|
||||
|
||||
config_get_bool enabled main enabled 0
|
||||
config_get config_file main config_file "$CONF"
|
||||
config_get work_dir main work_dir /etc/meow
|
||||
|
||||
# 关闭服务的路径不会调用 service_stopped，
|
||||
# 这里必须先清掉残留规则
|
||||
if [ "$enabled" != "1" ]; then
|
||||
remove_gateway_rules
|
||||
logger -t meow "disabled"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! "$PROG" -f "$config_file" -t >/dev/null 2>&1; then
|
||||
logger -t meow "config test failed"
|
||||
return 1
|
||||
fi
|
||||
|
||||
procd_open_instance
|
||||
|
||||
procd_set_param command \
|
||||
"$PROG" \
|
||||
-f "$config_file" \
|
||||
-d "$work_dir"
|
||||
|
||||
# OpenWrt 25.12 apk环境修正
|
||||
procd_set_param env HOME="$work_dir"
|
||||
|
||||
procd_set_param respawn
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
|
||||
procd_set_param file \
|
||||
"$config_file" \
|
||||
"/etc/config/meow"
|
||||
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
remove_gateway_rules
|
||||
}
|
||||
|
||||
# 显式提供 reload_service，避免 rc.common 把 reload 退化成 start
|
||||
# 从而绕过 service_stopped 的规则清理。
|
||||
reload_service() {
|
||||
stop "$@"
|
||||
start "$@"
|
||||
}
|
||||
|
||||
service_started() {
|
||||
if ! config_gateway_enabled; then
|
||||
remove_gateway_rules
|
||||
return 0
|
||||
fi
|
||||
|
||||
apply_gateway_rules
|
||||
}
|
||||
|
||||
service_stopped() {
|
||||
remove_gateway_rules
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
# 注册 meow 的 nft 规则回调到 fw4：每次 firewall reload 都会执行该脚本
|
||||
[ -f /etc/config/firewall ] || touch /etc/config/firewall
|
||||
|
||||
uci -q get firewall.meow >/dev/null 2>&1 || {
|
||||
uci -q set firewall.meow=include >/dev/null
|
||||
uci -q set firewall.meow.name='meow transparent gateway' >/dev/null
|
||||
}
|
||||
uci -q set firewall.meow.type='script' >/dev/null
|
||||
uci -q set firewall.meow.path='/etc/meow/firewall.sh' >/dev/null
|
||||
uci -q set firewall.meow.enabled='1' >/dev/null
|
||||
uci -q commit firewall
|
||||
|
||||
exit 0
|
||||
Reference in new issue
Block a user