🏅 Sync 2026-10-06 17:10:26

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/runtime/debug_report.uc

@@ -43,7 +43,7 @@
 
 import { popen } from 'fs';
 
-import { HP_DIR, RUN_DIR, shellQuote } from '../homeproxy-pro.uc';
+import { HP_DIR, RUN_DIR, shellQuote, udp_transport_verdict } from '../homeproxy-pro.uc';
 
 export const DEBUG_REPORT_PATH = RUN_DIR + '/debug.log';
 
@@ -274,6 +274,18 @@ function configSummary(uci) {
 			(v == null || v === '') ? '_(unset)_' : (isSecretKey(sw[1]) ? maskValue(v) : v));
 	}
 
+	/* The QUIC verdict, because it is the one conclusion in this report that
+	 * is derived rather than reported: the switches table shows
+	 * `main_udp_node`, and `main_udp_node` on its own does not say whether
+	 * QUIC was rejected by the firewall or why.  udp_transport_verdict() is
+	 * the same function firewall_post.ut gates the nft rule with, so this
+	 * line describes the rule that is actually loaded rather than a second
+	 * opinion about it. */
+	const udp = udp_transport_verdict('homeproxy-pro', uci);
+	out += sprintf('\n- UDP path: **%s** - %s\n',
+		udp.native ? 'UDP-native' : (udp.configured ? 'not UDP-native' : 'UDP not configured'),
+		udp.reason);
+
 	return out;
 };
 

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/runtime/health.sh

@@ -339,6 +339,47 @@ hp_probe_tcp() {
 	return 1
 }
 
+# hp_report_udp_transport
+# Say out loud, on every start, whether QUIC is being rejected and why.
+#
+# This is a shell script and the judgement lives in ucode (udp_transport_verdict
+# in homeproxy-pro.uc), which this file cannot call into: homeproxy-pro.uc imports
+# luci.http, which a plain `ucode -e` outside rpcd does not resolve.  So the
+# generator computes it once and drops it in RUN_DIR, and this reads that file.
+# Re-implementing the rule here instead would duplicate the protocol set, and
+# the log would then explain a different decision from the one nft actually has.
+#
+# The file is written by generate_client.uc at every generation.  A missing
+# file means generation has not run yet, which is not this function's problem
+# to report - it stays silent rather than guessing.
+hp_report_udp_transport() {
+	# Same inline default as runtime/dns.sh uses for its run-dir arguments:
+	# this file is sourced by init.d/homeproxy-pro but is also exercised by
+	# tests/runtime/ without it.
+	local run_dir="${HP_RUN_DIR:-/var/run/homeproxy-pro}"
+	local f="${run_dir}/udp-transport.txt"
+	local native configured proto reason
+
+	[ -r "$f" ] || return 0
+
+	{
+		read -r native
+		read -r configured
+		read -r proto
+		read -r reason
+	} < "$f"
+
+	[ -n "$native" ] || return 0
+
+	if [ "$native" = "1" ]; then
+		log "UDP path is UDP-native (${proto}): QUIC is proxied as-is."
+	elif [ "$configured" = "1" ]; then
+		log "Warning: ${reason}. QUIC on UDP 80/443 is rejected so browsers fall back to TCP; every other UDP flow is still proxied."
+	else
+		log "UDP path: ${reason}. QUIC on UDP 80/443 is rejected."
+	fi
+}
+
 # hp_run_probes <label> <dns-port> <mixed-port>
 # Report the probe results for one side. Returns 1 only when a probe failed
 # AND HP_PROBE_STRICT=1; a probe that could not be performed never fails it.
@@ -368,6 +409,8 @@ hp_run_probes() {
 		log "Warning: cannot probe the ${label} mixed inbound (no nc, or no mixed-in listener in the running configuration)." ;;
 	esac
 
+	hp_report_udp_transport
+
 	if [ "$failed" = "1" ] && [ "${HP_PROBE_STRICT:-0}" = "1" ]; then
 		log "Error: the ${label} functional probes failed and health_probe_strict is on."
 		return 1