🎉 Sync 2026-08-16 20:12:56

luci-app-fchomo/htdocs/luci-static/resources/fchomo/listeners.js

@@ -769,6 +769,7 @@ function renderListeners(s, uciconfig, isClient) {
 				...hm.loadLabelValues(this.config, 'proxy_group')
 			], section_id);
 		}
+		o.depends('tls_reality', '1');
 		o.depends({plugin_type: /^(shadow-tls|restls|jls)$/});
 		o.depends({type: 'shadowquic'});
 		o.modalonly = true;
@@ -1289,6 +1290,12 @@ function renderListeners(s, uciconfig, isClient) {
 	o.depends('tls_reality', '1');
 	o.modalonly = true;
 
+	o = s.taboption('field_tls', form.DynamicList, 'tls_reality_max_time_difference', _('REALITY max time difference'),
+		_('In millisecond.'));
+	o.datatype = 'uinteger';
+	o.depends('tls_reality', '1');
+	o.modalonly = true;
+
 	// @VMess-TLSmirror fields
 
 	/* Transport fields */

luci-app-fchomo/root/usr/share/fchomo/generate_client.uc

@@ -354,6 +354,8 @@ uci.foreach(uciconf, uciinbd, (cfg) => {
 
 	const listener = parseListener(cfg);
 	listener.proxy = get_proxy(listener.proxy);
+	if (listener["reality-config"])
+		listener["reality-config"].proxy = get_proxy(listener["reality-config"].proxy);
 	if (listener["shadow-tls"])
 		listener["shadow-tls"].handshake.proxy = get_proxy(listener["shadow-tls"].handshake.proxy);
 	if (listener["res-tls"])

luci-app-fchomo/root/usr/share/ucode/fchomo.uc

@@ -447,7 +447,9 @@ export function parseListener(cfg) {
 					dest: cfg.tls_reality_dest,
 					"private-key": cfg.tls_reality_private_key,
 					"short-id": cfg.tls_reality_short_id,
-					"server-names": cfg.tls_reality_server_names
+					"server-names": cfg.tls_reality_server_names,
+					"max-time-difference": strToInt(cfg.tls_reality_max_time_difference),
+					proxy: cfg.plugin_opts_dest_proxy, // raw data need post-processing
 				}
 			} : {
 				certificate: cfg.tls_cert_path,

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.8.12
-PKG_RELEASE:=221
+PKG_RELEASE:=222
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua

@@ -519,7 +519,7 @@ o.validate = function(self, value, t)
 		local _dns_mode = s.fields["dns_mode"]:formvalue(t)
 		local _tcp_node = s.fields["tcp_node"]:formvalue(t)
 		if _dns_mode and _tcp_node then
-			if (m:get(_tcp_node, "type") or ""):lower() ~= _dns_mode and not _tcp_node:find("Socks_") then
+			if (m:get(_tcp_node, "type") or ""):lower() ~= _dns_mode and not _tcp_node:find("socks_") then
 				return nil, translatef("TCP node must be '%s' type to use FakeDNS.", _dns_mode)
 			end
 		end
@@ -527,6 +527,11 @@ o.validate = function(self, value, t)
 	return value
 end
 
+o = s:option(Value, "remote_rewrite_ttl", translate("Remote DNS") .. " TTL")
+o.datatype = "min(1)"
+o.default = "30"
+o:depends({dns_mode = "sing-box"})
+
 o = s:option(ListValue, "chinadns_ng_default_tag", translate("Default DNS"))
 o.default = "none"
 o:value("gfw", translate("Remote DNS"))
@@ -588,6 +593,7 @@ for k, v in pairs(nodes_table) do
 
 			s.fields["singbox_dns_mode"]:depends({ _tcp_node_bool = "1", tcp_node = v.id })
 			s.fields["_node_sel_shunt"]:depends({ tcp_node = v.id })
+			s.fields["remote_rewrite_ttl"]:depends({ _tcp_node_bool = "1", tcp_node = v.id })
 		end
 	else
 		tcp:value(v.id, v["remark"])

luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua

@@ -480,7 +480,7 @@ o.validate = function(self, value, t)
 		end
 		local _tcp_node = s.fields["tcp_node"]:formvalue(t)
 		if _dns_mode and _tcp_node then
-			if (m:get(_tcp_node, "type") or ""):lower() ~= _dns_mode and not _tcp_node:find("Socks_") then
+			if (m:get(_tcp_node, "type") or ""):lower() ~= _dns_mode and not _tcp_node:find("socks_") then
 				return nil, translatef("TCP node must be '%s' type to use FakeDNS.", _dns_mode)
 			end
 		end
@@ -488,6 +488,13 @@ o.validate = function(self, value, t)
 	return value
 end
 
+o = s:taboption("DNS", Value, "remote_rewrite_ttl", translate("Remote DNS") .. " TTL")
+o.datatype = "min(1)"
+o.default = "30"
+o:depends({dns_mode = "sing-box", dns_shunt = "dnsmasq"})
+o:depends({dns_mode = "sing-box", dns_shunt = "chinadns-ng"})
+o:depends({smartdns_dns_mode = "sing-box", dns_shunt = "smartdns"})
+
 o = s:taboption("DNS", ListValue, "chinadns_ng_default_tag", translate("Default DNS"))
 o.default = "none"
 o:value("gfw", translate("Remote DNS"))
@@ -834,6 +841,7 @@ for k, v in pairs(nodes_table) do
 				s.fields["xray_dns_mode"]:depends({ tcp_node = v.id })
 			else
 				s.fields["singbox_dns_mode"]:depends({ tcp_node = v.id })
+				s.fields["remote_rewrite_ttl"]:depends({ tcp_node = v.id })
 			end
 		end
 	else

luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe_config.lua

@@ -92,7 +92,7 @@ o.write = function(self, section, value)
 	if old ~= value then
 		m:foreach("nodes", function(e)
 			if e["group"] and e["group"]:lower() == old:lower() then
-				self:set(e[".name"], "group", value)
+				self.map:set(e[".name"], "group", value)
 			end
 			if e["protocol"] and (e["protocol"] == "_balancing" or e["protocol"] == "_urltest") and e["node_group"] then
 				local gs = ""
@@ -104,7 +104,7 @@ o.write = function(self, section, value)
 					end
 				end
 				gs = api.trim(gs)
-				self:set(e[".name"], "node_group", gs)
+				self.map:set(e[".name"], "node_group", gs)
 			end
 		end)
 	end

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -1087,6 +1087,7 @@ function gen_config(var)
 	local remote_dns_client_ip = var["remote_dns_client_ip"]
 	local remote_dns_query_strategy = var["remote_dns_query_strategy"]
 	local remote_dns_fake = var["remote_dns_fake"]
+	local remote_rewrite_ttl = var["remote_rewrite_ttl"] or "30"
 	local dns_cache = var["dns_cache"]
 	local dns_socks_address = var["dns_socks_address"]
 	local dns_socks_port = var["dns_socks_port"]
@@ -2015,7 +2016,7 @@ function gen_config(var)
 					end
 					if value.outboundTag ~= "block" and value.outboundTag ~= "direct" then
 						dns_rule.server = "remote"
-						dns_rule.rewrite_ttl = 30
+						dns_rule.rewrite_ttl = tonumber(remote_rewrite_ttl)
 						if true then
 							local block_rule
 							if remote_strategy == "ipv4_only" then
@@ -2063,29 +2064,42 @@ function gen_config(var)
 			end
 		end
 		if default_dns_flag == "remote" then
+			local block_rule
 			local dns_rule_query_type = { "A", "AAAA" }
 			if remote_strategy == "ipv4_only" then
+				block_rule = {
+					query_type = { "AAAA" },
+					action = "predefined",
+					rcode = "NOERROR"
+				}
 				dns_rule_query_type = { "A" }
 			elseif remote_strategy == "ipv6_only" then
+				block_rule = {
+					query_type = { "A" },
+					action = "predefined",
+					rcode = "NOERROR"
+				}
 				dns_rule_query_type = { "AAAA" }
 			end
+			if block_rule then
+				table.insert(dns.rules, block_rule)
+			end
 			if remote_dns_fake then
 				-- When default is not direct and enable fakedns, default DNS use FakeDNS.
 				local fakedns_dns_rule = {
 					query_type = dns_rule_query_type,
 					server = fakedns_tag,
 					disable_cache = true,
-					rewrite_ttl = 30
+					rewrite_ttl = tonumber(remote_rewrite_ttl)
 				}
 				table.insert(dns.rules, fakedns_dns_rule)
-			else
-				local remote_dns_rule = {
-					query_type = dns_rule_query_type,
-					server = "remote",
-					disable_cache = true,
-				}
-				table.insert(dns.rules, remote_dns_rule)
 			end
+			local remote_dns_rule = {
+				server = "remote",
+				disable_cache = true,
+				rewrite_ttl = tonumber(remote_rewrite_ttl)
+			}
+			table.insert(dns.rules, remote_dns_rule)
 		end
 		local dns_in_inbound = {
 			type = "direct",

luci-app-passwall/root/etc/uci-defaults/luci-app-passwall_server

@@ -32,6 +32,15 @@ else
 fi
 uci commit firewall
 
+# Migrate server sections from the old `user` section type. New user entries
+# also use `user`, so only sections with a server `type` option are renamed.
+for sid in $(uci -q show passwall_server | sed -n 's/^passwall_server\.\([^.=]*\)=user$/\1/p'); do
+	if [ -n "$(uci -q get "passwall_server.${sid}.type")" ]; then
+		uci -q set "passwall_server.${sid}=server"
+	fi
+done
+uci -q commit passwall_server
+
 rm -f /tmp/luci-indexcache /tmp/luci-indexcache.*
 rm -rf /tmp/luci-modulecache/
 killall -HUP rpcd 2>/dev/null

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -98,7 +98,7 @@ run_ipt2socks() {
 
 run_singbox() {
 	local flag type node tcp_redir_port tcp_proxy_way udp_redir_port socks_address socks_port socks_username socks_password http_address http_port http_username http_password
-	local dns_listen_port direct_dns_query_strategy direct_dns_port direct_dns_udp_server direct_dns_tcp_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port
+	local dns_listen_port direct_dns_query_strategy direct_dns_port direct_dns_udp_server direct_dns_tcp_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy remote_rewrite_ttl dns_cache dns_socks_address dns_socks_port
 	local loglevel log_file config_file server_host server_port no_run use_proxy_list use_gfw_list chn_list
 	eval_set_val "$@"
 	[ -z "$type" ] && {
@@ -179,6 +179,7 @@ run_singbox() {
 
 	[ -n "$remote_dns_client_ip" ] && json_add_string "remote_dns_client_ip" "${remote_dns_client_ip}"
 	[ "$remote_fakedns" = "1" ] && json_add_string "remote_dns_fake" "1"
+	[ -n "$remote_rewrite_ttl" ] && json_add_string "remote_rewrite_ttl" "${remote_rewrite_ttl}"
 	[ -n "$no_run" ] && json_add_string "no_run" "1"
 	local _json_arg="$(json_dump)"
 	lua $UTIL_SINGBOX gen_config "${_json_arg}" > $config_file
@@ -763,6 +764,7 @@ run_redir() {
 					resolve_dns_log="${resolve_dns_log} + FakeDNS"
 					USE_FAKEDNS=1
 				}
+				_args="${_args} remote_rewrite_ttl=$(config_t_get global remote_rewrite_ttl)"
 				NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1)
 			}
 			_args="${_args} use_proxy_list=$USE_PROXY_LIST use_gfw_list=$USE_GFW_LIST chn_list=$CHN_LIST"
@@ -1274,6 +1276,7 @@ start_dns() {
 				_args="${_args} remote_fakedns=1"
 				USE_FAKEDNS=1
 			}
+			_args="${_args} remote_rewrite_ttl=$(config_t_get global remote_rewrite_ttl)"
 			local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip)
 			[ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}"
 			TCP_PROXY_DNS=1
@@ -1629,9 +1632,9 @@ acl_app() {
 								dns_mode=$type
 								[ "$type" = "xray" ] && [ "$v2ray_dns_mode" = "http3" ] && v2ray_dns_mode="tcp"
 							}
-							dns_cache_key="${dns_mode}_${remote_dns}_${v2ray_dns_mode:-none}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}"
+							dns_cache_key="${dns_mode}_${remote_dns}_${v2ray_dns_mode:-none}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}_${remote_rewrite_ttl:-30}"
 							([ "$v2ray_dns_mode" = "doh" ] || [ "$v2ray_dns_mode" = "http3" ]) && {
-								dns_cache_key="${dns_mode}_${remote_dns_doh:-https://1.1.1.1/dns-query}_${v2ray_dns_mode:-doh}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}"
+								dns_cache_key="${dns_mode}_${remote_dns_doh:-https://1.1.1.1/dns-query}_${v2ray_dns_mode:-doh}_${remote_dns_client_ip:-0}_${remote_fakedns:-0}_${remote_rewrite_ttl:-30}"
 							}
 
 							if [ "$remote_fakedns" = "1" ] || ([ "$protocol" = "_shunt" ] && [ "$(config_n_get $tcp_node fakedns)" = "1" ]); then
@@ -1758,7 +1761,10 @@ acl_app() {
 										_extra_param="${_extra_param} udp_redir_port=$redir_port"
 									}
 									config_file="$TMP_PATH/$config_file"
-									[ "${type}" = "sing-box" ] && type="singbox"
+									[ "${type}" = "sing-box" ] && {
+										type="singbox"
+										_extra_param="${_extra_param} remote_rewrite_ttl=${remote_rewrite_ttl:-30}"
+									}
 									_extra_param="${_extra_param} use_proxy_list=$use_proxy_list use_gfw_list=$use_gfw_list chn_list=$chn_list"
 									run_${type} flag=$tcp_node node=$tcp_node tcp_redir_port=$redir_port ${_extra_param} config_file=$config_file log_file=$log_file loglevel=$loglevel
 								else
@@ -1851,7 +1857,7 @@ acl_app() {
 			}
 			unset enabled sid remarks sources interface tcp_no_redir_ports udp_no_redir_ports use_global_config tcp_node udp_node use_direct_list use_proxy_list use_block_list use_gfw_list chn_list tcp_proxy_mode udp_proxy_mode filter_proxy_ipv6 dns_mode remote_dns v2ray_dns_mode remote_dns_doh remote_dns_client_ip
 			unset _ip _mac _iprange _ipset _ip_or_mac source_list tcp_port udp_port config_file _extra_param dns_cache_key log loglevel
-			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns
+			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns remote_rewrite_ttl
 		done
 		unset socks_port redir_port dns_port dnsmasq_port chinadns_port
 		[ -n "${has_enabled}" ] || {

luci-app-passwall2/Makefile

@@ -6,8 +6,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.8.14
+PKG_VERSION:=26.8.16
-PKG_RELEASE:=85
+PKG_RELEASE:=86
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \
@@ -15,7 +15,6 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Nftables_Transparent_Proxy \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Haproxy \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Hysteria \
-	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks_Rust_Client \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks_Rust_Server \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_Libev_Client \
@@ -110,12 +109,6 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_Hysteria
 	select PACKAGE_hysteria
 	default n
 
-config PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy
-	bool "Include NaiveProxy"
-	depends on !(arc||armeb||loongarch64||mips||mips64||powerpc||TARGET_gemini)
-	select PACKAGE_naiveproxy
-	default n
-
 config PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks_Rust_Client
 	bool "Include Shadowsocks Rust Client"
 	depends on !i386

luci-app-passwall2/luasrc/controller/passwall2.lua

@@ -523,14 +523,13 @@ end
 function delete_select_nodes()
 	local ids = http.formvalue("ids")
 	local redirect = http.formvalue("redirect")
+	local ids_t = {}
 	string.gsub(ids, '[^' .. "," .. ']+', function(w)
+		ids_t[#ids_t + 1] = w
 		if (uci_get("@global[0]", "node") or "") == w then
 			uci_del('@global[0]', "node")
 		end
 		uci_foreach("socks", function(t)
-			if t["node"] == w then
-				uci_del(t[".name"])
-			end
 			local changed = false
 			local auto_switch_node_list = uci_get(t[".name"], "autoswitch_backup_node") or {}
 			for i = #auto_switch_node_list, 1, -1 do
@@ -542,6 +541,14 @@ function delete_select_nodes()
 			if changed then
 				uci_set(t[".name"], "autoswitch_backup_node", auto_switch_node_list)
 			end
+			if t["node"] == w then
+				local new_node = api.get_random_normal_node(ids_t)
+				if new_node then
+					uci_set(t[".name"], "node", new_node[".name"])
+				else
+					uci_set(t[".name"], "enabled", "0")
+				end
+			end
 		end)
 		uci_foreach("haproxy_config", function(t)
 			if t["lbss"] == w then

luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua

@@ -308,6 +308,7 @@ o.rmempty = false
 
 s2 = m:section(TypedSection, "socks", translate("Socks Config"))
 s2.template = "cbi/tblsection"
+s2.sortable = true
 s2.anonymous = true
 s2.addremove = true
 s2.extedit = api.url("socks_config", "%s")
@@ -382,6 +383,7 @@ for k, v in pairs(nodes_table) do
 end
 
 m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
-m:appendTemplate(Template("/global/status_bottom"))
+m:appendTemplate("/global/status_bottom")
+m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})
 
 return api.return_map(m)

luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua

@@ -92,7 +92,7 @@ o.write = function(self, section, value)
 	if old ~= value then
 		m:foreach("nodes", function(e)
 			if e["group"] and e["group"]:lower() == old:lower() then
-				self:set(e[".name"], "group", value)
+				self.map:set(e[".name"], "group", value)
 			end
 			if e["protocol"] and (e["protocol"] == "_balancing" or e["protocol"] == "_urltest") and e["node_group"] then
 				local gs = ""
@@ -104,7 +104,7 @@ o.write = function(self, section, value)
 					end
 				end
 				gs = api.trim(gs)
-				self:set(e[".name"], "node_group", gs)
+				self.map:set(e[".name"], "node_group", gs)
 			end
 		end)
 	end

luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/6_naive.lua

@@ -1,33 +0,0 @@
-if not api.is_finded("naive") then
-	return
-end
-
--- [[ Naive ]]
-local m, s1 = ...
-local type_name = "Naiveproxy"
-
-s1.fields["type"]:value(type_name, "NaiveProxy")
-
-if s1.val["type"] ~= type_name then
-	return
-end
-
-local s = NamedSection(m, arg[1], "server")
-s.type_name = type_name
-s.option_prefix = "naive_"
-
-o = s:option(ListValue, "protocol", translate("Protocol"))
-o:value("https", translate("HTTPS"))
-o:value("quic", translate("QUIC"))
-
-o = s:option(Value, "address", translate("Address (Support Domain Name)"))
-
-o = s:option(Value, "port", translate("Port"))
-o.datatype = "port"
-
-o = s:option(Value, "username", translate("Username"))
-
-o = s:option(Value, "password", translate("Password"))
-o.password = true
-
-api.luci_types(s1, s)

luci-app-passwall2/luasrc/passwall2/api.lua

@@ -598,7 +598,7 @@ function get_valid_nodes()
 	local nodes = {}
 	local default_nodes = {}
 	local other_nodes = {}
-	uci:foreach(c_config, "nodes", function(e)
+	uci_foreach_c("nodes", function(e)
 		e.id = e[".name"]
 		if e.type and e.remarks then
 			local type_name = e.type
@@ -671,8 +671,8 @@ function get_node_list()
 		socks_list = {},
 		normal_list = {},
 	}
-	uci:foreach(c_config, "socks", function(s)
+	uci_foreach_c("socks", function(s)
-		if s.enabled == "1" and s.node then
+		if s.node then
 			node_list.socks_list[#node_list.socks_list + 1] = {
 				id = s[".name"],
 				remark = i18n.translate("Socks Config") .. " [" .. s.port .. i18n.translate("Port") .. "]",
@@ -760,6 +760,29 @@ function get_full_node_remarks(n)
 	return remarks
 end
 
+function get_random_normal_node(exclude_id)
+	local exclude_id_lookup = {}
+	if type(exclude_id) == "table" then
+		for i, v in ipairs(exclude_id) do
+			exclude_id_lookup[v] = true
+		end
+	elseif type(exclude_id) == "string" then
+		exclude_id_lookup[exclude_id] = true
+	end
+	local normal_list = {}
+	for k, e in ipairs(get_valid_nodes()) do
+		if e.node_type == "normal" and not exclude_id_lookup[e[".name"]] then
+			normal_list[#normal_list + 1] = e
+		end
+	end
+	if #normal_list > 0 then
+		math.randomseed(os.time())
+		local num = math.random(1, #normal_list)
+		return normal_list[num]
+	end
+	return nil
+end
+
 function gen_uuid()
 	local uuid = sys.exec("echo -n $(cat /proc/sys/kernel/random/uuid)")
 	return uuid

luci-app-passwall2/luasrc/passwall2/util_naiveproxy.lua

@@ -1,42 +0,0 @@
-module("luci.passwall2.util_navieproxy", package.seeall)
-local api = require "luci.passwall2.api"
-local jsonc = api.jsonc
-
-function gen_config(var)
-	local node_id = var["node"]
-	if not node_id then
-		print("node Cannot be empty!")
-		return
-	end
-	local node = api.uci_get_c(node_id)
-	local run_type = var["run_type"]
-	local local_addr = var["local_addr"]
-	local local_port = var["local_port"]
-	local server_host = var["server_host"] or (node.address or ""):lower()
-	local server_port = var["server_port"] or node.port
-
-	if api.is_ipv6(server_host) then
-		server_host = api.get_ipv6_full(server_host)
-	end
-	local server = server_host .. ":" .. server_port
-
-	local config = {
-		listen = run_type .. "://" .. local_addr .. ":" .. local_port,
-		proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. server
-	}
-
-	return jsonc.stringify(config, 1)
-end
-
-_G.gen_config = gen_config
-
-if arg[1] then
-	local func =_G[arg[1]]
-	if func then
-		local var = nil
-		if arg[2] then
-			var = jsonc.parse(arg[2])
-		end
-		print(func(var))
-	end
-end

luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm

@@ -26,7 +26,7 @@
     height: 2.6em;
     display: block;
     float: left;
-    margin-right: 1em;
+    margin: 0 1em;
 }
 
 .status-bar .inner .status-info {
@@ -39,7 +39,8 @@
 }
 
 .pure-u-1-2, .pure-u-12-24 {
-    width: 50%;
+    width: 49%;
+    display: inline-block;
 }
     
 @media screen and (max-width: 700px) {

luci-app-passwall2/root/usr/share/passwall2/app.sh

@@ -12,7 +12,6 @@ LUA_UTIL_PATH=/usr/lib/lua/luci/passwall2
 UTIL_SINGBOX=$LUA_UTIL_PATH/util_sing-box.lua
 UTIL_SS=$LUA_UTIL_PATH/util_shadowsocks.lua
 UTIL_XRAY=$LUA_UTIL_PATH/util_xray.lua
-UTIL_NAIVE=$LUA_UTIL_PATH/util_naiveproxy.lua
 UTIL_HYSTERIA2=$LUA_UTIL_PATH/util_hysteria2.lua
 SINGBOX_BIN=$(first_type $(config_t_get global_app sing_box_file) sing-box)
 XRAY_BIN=$(first_type $(config_t_get global_app xray_file) xray)
@@ -455,14 +454,6 @@ run_socks() {
 		lua $UTIL_XRAY gen_config "${_json_arg}" > $config_file
 		[ -z "$no_run" ] && ln_run ${QUEUE_RUN} "$XRAY_BIN" "xray" $log_file run -c "$config_file"
 	;;
-	naiveproxy)
-		json_add_string "local_addr" "${bind}"
-		json_add_string "local_port" "${socks_port}"
-		json_add_string "run_type" "socks"
-		local _json_arg="$(json_dump)"
-		lua $UTIL_NAIVE gen_config "${_json_arg}" > $config_file
-		[ -z "$no_run" ] && ln_run ${QUEUE_RUN} "$(first_type naive)" naive $log_file "$config_file"
-	;;
 	ssr)
 		json_add_string "local_addr" "${bind}"
 		json_add_string "local_port" "${socks_port}"

luci-app-ssr-plus/Makefile

@@ -4,7 +4,7 @@ LUCI_TITLE:=luci-app-ssr-plus
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=196
-PKG_RELEASE:=56
+PKG_RELEASE:=57
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Iptables_Transparent_Proxy \

luci-app-ssr-plus/luasrc/view/shadowsocksr/status_bottom.htm

@@ -26,7 +26,7 @@
     height: 2.6em;
     display: block;
     float: left;
-    margin-right: 1em;
+    margin: 0 1em;
 }
 
 .status-bar .inner .status-info {
@@ -39,7 +39,8 @@
 }
 
 .pure-u-1-2, .pure-u-12-24 {
-    width: 50%;
+    width: 49%;
+    display: inline-block;
 }
     
 @media screen and (max-width: 700px) {

luci-app-ssr-plus/root/etc/init.d/shadowsocksr

@@ -965,20 +965,27 @@ start_socks5_udp_with_ipt2socks() {
 	local local_port="$2"
 	local threads="$3"
 	local ipt2socks_bin
-	local auth_opts=""
+	local server_ip
 	local _i
 
 	ipt2socks_bin="$(first_type ipt2socks)"
+	server_ip="$(get_host_ip "$sid")"
 
 	[ -x "$ipt2socks_bin" ] || return 1
+	[ -n "$server_ip" ] || {
+		echolog "UDP TPROXY Relay:Socks5 无法解析服务器地址。"
+		return 1
+	}
+	set --
 	if [ "$(uci_get_by_name "$sid" auth_enable 0)" = "1" ]; then
-		auth_opts="-a $(uci_get_by_name "$sid" username) -k $(uci_get_by_name "$sid" password)"
+		set -- -a "$(uci_get_by_name "$sid" username)" \
+			-k "$(uci_get_by_name "$sid" password)"
 	fi
 	for _i in $(seq 1 "$threads"); do
 		ln_start_bin "$ipt2socks_bin" ipt2socks -U -r -b 0.0.0.0 -4 \
-			-s "$(uci_get_by_name "$sid" server)" \
+			-s "$server_ip" \
 			-p "$(uci_get_by_name "$sid" server_port)" \
-			-l "$local_port" "$auth_opts"
+			-l "$local_port" "$@"
 	done
 	echolog "UDP TPROXY Relay:Socks5 via IPT2Socks $threads Threads Started!"
 	return 0
@@ -989,21 +996,28 @@ start_socks5_redir_with_ipt2socks() {
 	local local_port="$2"
 	local threads="$3"
 	local ipt2socks_bin
-	local auth_opts=""
+	local server_ip
 	local _i
 
 	ipt2socks_bin="$(first_type ipt2socks)"
+	server_ip="$(get_host_ip "$sid")"
 
 	[ -x "$ipt2socks_bin" ] || return 1
+	[ -n "$server_ip" ] || {
+		echolog "Main node:Socks5 无法解析服务器地址。"
+		return 1
+	}
+	set --
 	if [ "$(uci_get_by_name "$sid" auth_enable 0)" = "1" ]; then
-		auth_opts="-a $(uci_get_by_name "$sid" username) -k $(uci_get_by_name "$sid" password)"
+		set -- -a "$(uci_get_by_name "$sid" username)" \
+			-k "$(uci_get_by_name "$sid" password)"
 	fi
 	for _i in $(seq 1 "$threads"); do
 		ln_start_bin "$ipt2socks_bin" ipt2socks \
 			-T -R -r -b 0.0.0.0 -4 \
-			-s "$(uci_get_by_name "$sid" server)" \
+			-s "$server_ip" \
 			-p "$(uci_get_by_name "$sid" server_port)" \
-			-l "$local_port" "$auth_opts"
+			-l "$local_port" "$@"
 	done
 	echolog "Main node:Socks5 via IPT2Socks $threads Threads Started!"
 	return 0

luci-app-ssr-plus/root/usr/bin/ssr-rules

@@ -1262,6 +1262,13 @@ compare_rules() {
 	return 0  # No update needed
 }
 
+append_nftables_comment() {
+	local name="$1"
+	local value
+	value=$(printf '%s' "$2" | tr '\r\n' '  ')
+	printf '# %s: %s\n' "$name" "$value" >> "$NFTABLES_RULES_FILE"
+}
+
 # Auto-update persistence rules
 persist_nftables_rules() {
 	if [ "$USE_NFT" != "1" ]; then
@@ -1296,12 +1303,12 @@ persist_nftables_rules() {
 	echo "# Auto-updated: $(date)" >> "$NFTABLES_RULES_FILE"
 	echo "# Runmode: ${RUNMODE:-router}" >> "$NFTABLES_RULES_FILE"
 	echo "# Server: $server, Port: $local_port" >> "$NFTABLES_RULES_FILE"
-	echo "# WAN_BP_IP: $WAN_BP_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "WAN_BP_IP" "$WAN_BP_IP"
-	echo "# LAN_AC_IP: $LAN_AC_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "LAN_AC_IP" "$LAN_AC_IP"
-	echo "# LAN_BP_IP: $LAN_BP_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "LAN_BP_IP" "$LAN_BP_IP"
-	echo "# WAN_FW_IP: $WAN_FW_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "WAN_FW_IP" "$WAN_FW_IP"
-	echo "# LAN_FP_IP: $LAN_FP_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "LAN_FP_IP" "$LAN_FP_IP"
-	echo "# LAN_GM_IP: $LAN_GM_IP" >> "$NFTABLES_RULES_FILE"
+	append_nftables_comment "LAN_GM_IP" "$LAN_GM_IP"
 	echo "" >> "$NFTABLES_RULES_FILE"
 
 	local HAS_RULES=0

luci-theme-footstrap/Makefile

@@ -17,7 +17,7 @@ LUCI_NAME:=luci-theme-footstrap
 FOOTSTRAP_VERSION?=
 ifneq ($(FOOTSTRAP_VERSION),)
 PKG_VERSION:=$(FOOTSTRAP_VERSION)
-PKG_RELEASE:=20
+PKG_RELEASE:=21
 endif
 
 LUCI_TITLE:=Footstrap Theme

luci-theme-footstrap/htdocs/luci-static/resources/fs-appearance.js

@@ -560,7 +560,10 @@ function build() {
 		'class': 'fs-ap-version',
 		'href': ver.REPO_URL,
 		'target': '_blank',
-		'rel': 'noopener noreferrer'
+		/* `noreferrer` alone: it implies noopener wherever it is honoured at all, and the theme's
+		 * other outward links — footer.ut's two and the footer's own — spell it that way. Two
+		 * spellings of one rule is how they drift. */
+		'rel': 'noreferrer'
 	}, [ ver.label() ]);
 
 	const defaults = [

luci-theme-footstrap/htdocs/luci-static/resources/fs-chrome.js

@@ -297,11 +297,14 @@ function nameThemeInFooter() {
 	const host = document.querySelector('footer.fs-footer span');
 	if (!host || host.querySelector('.fs-footer-self')) return;
 	const self = E('a', {
-		class: 'fs-footer-self',
+		'class': 'fs-footer-self',
-		href: version.REPO_URL,
+		'href': version.REPO_URL,
-		target: '_blank',
+		'target': '_blank',
-		rel: 'noreferrer',
+		/* `noreferrer` alone, matching footer.ut's own two anchors: it implies noopener in every
-	}, version.label());
+		 * engine that ships `rel=noreferrer` at all, so the pair reads as two rules where there is
+		 * one. fs-appearance.js's link to the same URL spells both — the two are now in step. */
+		'rel': 'noreferrer'
+	}, [ version.label() ]);
 	/* AFTER THE DISTRIBUTION, not at the end. The sentence lists the software that renders the page
 	 * — LuCI, the distribution, the theme — and footer.ut appends one more fragment after them that
 	 * is not a component but a state: "Lua compatibility mode active". Landing behind it read as if

luci-theme-footstrap/htdocs/luci-static/resources/fs-version.js

@@ -29,9 +29,10 @@ function isReal() { return ((/^\d+\.\d+/).test(FS_VERSION)) && !((/-dev$/).test(
 
 return baseclass.extend({
 	VERSION: FS_VERSION,
-	/* the project's page, for the link at the foot of the Appearance tab. One string, used once —
+	/* the project's page: the link at the foot of the Appearance tab, and the one
-	 * it was assembled from a separate FS_REPO constant that the retired self-update script needed to build
+	 * nameThemeInFooter() writes into the footer. It was assembled from a separate FS_REPO
-	 * API paths from, and nothing has needed the bare `owner/name` since. */
+	 * constant that the retired self-update script needed to build API paths from, and nothing
+	 * has needed the bare `owner/name` since. */
 	REPO_URL: 'https://github.com/VizzleTF/luci-theme-footstrap',
 	isReal,
 	/* what the Appearance tab's version row prints */

luci-theme-footstrap/styles/theme/20-shell.css

@@ -686,8 +686,16 @@
 		 * Found by tools/live-audit.mjs on CI's runner and not on the maintainer's stands: the wrap
 		 * width depends on text metrics, so the same 568px viewport breaks the line there and not
 		 * here. 26px, not 24: the criterion is that the two 24px circles must not meet, so 24 is the
-		 * boundary rather than a pass, and 26 leaves the footer visually unchanged on one line. */
+		 * boundary rather than a pass, and 26 leaves the footer visually unchanged on one line.
-		line-height: 26px;
+		 *
+		 * A FLOOR, not a fixed number, and not a bare ratio either. `--fs-type` is
+		 * `calc(13px * --fs-density-type)`, which is 0.9 at Compact and 1.15 at Large, so a plain
+		 * `26px` would be the one leading in this file that ignores the Density axis while the text
+		 * it leads follows it — and a unitless `2` would follow the axis straight back under 24px at
+		 * Compact (11.7px x 2 = 23.4), where the wrap this rule exists for is most likely. `max()`
+		 * is both: 26px at the default and at Compact, 29.9px at Large, tracking the axis in the one
+		 * direction where tracking it is safe. */
+		line-height: max(26px, calc(var(--fs-type) * 2));
 	}
 	footer a { color: var(--fs-dim); }
 	footer a:hover { color: var(--fs-accent); }

mihomo/Makefile

@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mihomo
-PKG_VERSION:=1.19.29
+PKG_VERSION:=1.19.30
-PKG_RELEASE:=31
+PKG_RELEASE:=32
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/metacubex/mihomo/tar.gz/v$(PKG_VERSION)?

natflow/Makefile

@@ -10,12 +10,12 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=natflow
 PKG_VERSION:=20260531
-PKG_RELEASE:=70
+PKG_RELEASE:=71
 
 PKG_SOURCE:=$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/ptpt52/natflow.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=bbd26afc851575c8c1b326a5d0bdfa3e6c2723c1
+PKG_SOURCE_VERSION:=6472300c8d6b9082112a27a6a7547ea6057577be
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_MAINTAINER:=Chen Minqiang <ptpt52@gmail.com>
 PKG_LICENSE:=GPL-2.0