🏅 Sync 2026-10-25 22:22:42

clashoo/Makefile

@@ -1,17 +1,17 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=clashoo
-PKG_SHORT_SHA:=91e85ee
-PKG_COMMIT_DATE:=2026.10.24
+PKG_SHORT_SHA:=6780eee
+PKG_COMMIT_DATE:=2026.10.25
 
 PKG_VERSION:=$(PKG_COMMIT_DATE)~$(PKG_SHORT_SHA)
-PKG_RELEASE:=17
+PKG_RELEASE:=18
 
 PKG_SOURCE:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA).tar.gz
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-clashoo/releases/download/mihomo-src
-PKG_SOURCE_VERSION:=413a02e9b55b94dc3892616f43822e191516e493
+PKG_SOURCE_VERSION:=d831028ec8a3d336ea83295bea36c32fdc973ede
 PKG_HASH:=skip
 PKG_BUILD_VERSION:=alpha-$(PKG_SHORT_SHA)
 

clashoo/files/etc/init.d/clashoo

@@ -876,6 +876,10 @@ revert_dns() {
 
 add_cron(){
 #===========================================================================================================================
+	# core.log 落在 tmpfs 上，按分钟卡一次大小；内核对日志没有上限，
+	# 一旦刷屏写满 /tmp，dnsmasq 与配置生成都会跟着挂。
+	[ -z "$(grep -w "lib/core_log_guard.sh" "$CRON_FILE")" ] && echo "* * * * * sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1" >> "$CRON_FILE"
+
 	auto=$(uci get clashoo.config.auto_update 2>/dev/null)
 	clear=$(uci get clashoo.config.auto_clear_log 2>/dev/null)
 	if [ "${auto:-0}" -eq 1 ] || [ "${clear:-0}" -eq 1 ]; then
@@ -908,6 +912,7 @@ del_cron(){
 	sed -i '/update\/update_all.sh/d' "$CRON_FILE"
 	sed -i '/\/usr\/share\/clash\/update_all.sh/d' "$CRON_FILE"
 	sed -i '/update\/maintenance_cron.sh/d' "$CRON_FILE"
+	sed -i '/lib\/core_log_guard.sh/d' "$CRON_FILE"
 	sed -i '/clashoo.txt/d' "$CRON_FILE"
 	sed -i '/update\/lgbm_update.sh/d' "$CRON_FILE"
 	sed -i '/\/usr\/share\/clash\/lgbm_update.sh/d' "$CRON_FILE"
@@ -1049,7 +1054,7 @@ _user_dns_fields() {
 	command -v yq >/dev/null 2>&1 || return 0
 	[ -s "$CONFIG_YAML" ] || return 0
 	for field in nameserver proxy-server-nameserver fallback direct-nameserver \
-		default-nameserver nameserver-policy respect-rules; do
+		default-nameserver nameserver-policy proxy-server-nameserver-policy respect-rules; do
 		case ",$force," in *,"$field",*) continue ;; esac
 		[ "$(yq -M e "(.dns // {}) | has(\"${field}\")" "$CONFIG_YAML" 2>/dev/null)" = "true" ] &&
 			out="${out}${out:+,}${field}"
@@ -1091,7 +1096,7 @@ _clashoo_dns_force_fields() {
 	command -v yq >/dev/null 2>&1 || return 0
 	[ -s "$CONFIG_YAML" ] || return 0
 	local managed legacy fields
-	fields="nameserver,proxy-server-nameserver,direct-nameserver,default-nameserver,nameserver-policy,respect-rules"
+	fields="nameserver,proxy-server-nameserver,direct-nameserver,default-nameserver,nameserver-policy,proxy-server-nameserver-policy,respect-rules"
 	managed="$(yq -M e '(.dns."x-clashoo-managed-dns" // false) == true' "$CONFIG_YAML" 2>/dev/null)"
 	if [ "$managed" = "true" ]; then
 		printf '%s' "$fields"
@@ -1151,6 +1156,103 @@ _dns_nameserver_inherit_mode() {
 	printf '%s' inherit
 }
 
+# issue #73: mihomo resolves proxy server domains through
+# proxy-server-nameserver(-policy) and ignores nameserver-policy there. Airports
+# ship their own resolver for node domains (e.g. "+.chylink.xyz" -> DoT) which
+# answers with reachable relay IPs, so mirror the entries that match a node
+# server domain before mixin drops them.
+#
+# Everything travels through a private 0700 work dir: large airports can produce
+# hundreds of KB of policy entries, which neither argv nor env vars can carry
+# (E2BIG), and predictable /tmp names are symlink bait.
+_dns_node_policy_workdir=""
+
+_dns_node_policy_cleanup() {
+	[ -n "${_dns_node_policy_workdir:-}" ] || return 0
+	rm -rf "$_dns_node_policy_workdir" 2>/dev/null
+	_dns_node_policy_workdir=""
+	return 0
+}
+
+# Same inputs yml_change feeds mixin: settle FORCE/PRESENT here so the skip
+# decision cannot disagree with the config that mixin actually generates.
+_dns_node_policy_mode() {
+	CLASHOO_DNS_FORCE="$(_clashoo_dns_force_fields)"
+	CLASHOO_DNS_PRESENT="$(_user_dns_fields "$CLASHOO_DNS_FORCE")"
+	export CLASHOO_DNS_FORCE CLASHOO_DNS_PRESENT
+	_dns_nameserver_inherit_mode
+}
+
+_dns_node_policy_capture() {
+	_dns_node_policy_cleanup
+	command -v yq >/dev/null 2>&1 || return 0
+	command -v ucode >/dev/null 2>&1 || return 0
+
+	local helper workdir
+	helper="${CLASHOO_NODE_DNS_UC:-/usr/share/clashoo/runtime/dns_node_policy.uc}"
+	[ -r "$helper" ] || return 0
+	[ -s "$CONFIG_YAML" ] || return 0
+
+	# skip mode keeps the source DNS verbatim: mihomo already falls back to the
+	# normal DNS policy for node domains when no dedicated resolver is generated.
+	[ "$(_dns_node_policy_mode)" = "skip" ] && return 0
+
+	# sweep leftovers from an interrupted start; they are private to root anyway
+	find "${TMPDIR:-/tmp}" -maxdepth 1 -name 'clashoo-node-dns.*' -mmin +60 \
+		-exec rm -rf {} + >/dev/null 2>&1
+
+	workdir="$(mktemp -d "${TMPDIR:-/tmp}/clashoo-node-dns.XXXXXX" 2>/dev/null)" || return 0
+	chmod 700 "$workdir" 2>/dev/null
+
+	if ! yq -M e -o=json -I0 '({"policies": (.dns."nameserver-policy" // {}), "servers": [(.proxies // [])[] | select(type == "!!map") | .server // ""]})' "$CONFIG_YAML" > "$workdir/source.json" 2>/dev/null ||
+		[ ! -s "$workdir/source.json" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+	chmod 600 "$workdir/source.json" 2>/dev/null
+
+	if ! CLASHOO_NODE_DNS_SOURCE_FILE="$workdir/source.json" ucode "$helper" > "$workdir/policy.json" 2>/dev/null ||
+		[ ! -s "$workdir/policy.json" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+	chmod 600 "$workdir/policy.json" 2>/dev/null
+	rm -f "$workdir/source.json"
+
+	if [ "$(yq -M e -r 'length' "$workdir/policy.json" 2>/dev/null)" = "0" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+
+	_dns_node_policy_workdir="$workdir"
+	return 0
+}
+
+_dns_node_policy_apply() {
+	local policy_file rc
+	policy_file="${_dns_node_policy_workdir:+"$_dns_node_policy_workdir/policy.json"}"
+	if [ -z "$policy_file" ] || [ ! -s "$policy_file" ] || ! command -v yq >/dev/null 2>&1; then
+		_dns_node_policy_cleanup
+		return 0
+	fi
+
+	# existing keys keep their value; overlapping patterns are left to mihomo
+	CLASHOO_NODE_DNS_POLICY_FILE="$policy_file" yq -M e -i '(.dns // {}) as $dns |
+		(load(strenv(CLASHOO_NODE_DNS_POLICY_FILE)) // {}) as $derived |
+		.dns."proxy-server-nameserver-policy" = ($derived * ($dns."proxy-server-nameserver-policy" // {}))
+	' "$CONFIG_YAML" 2>/dev/null
+	rc=$?
+
+	# mihomo rejects a node policy without a proxy node resolver
+	if [ "$(yq -M e -r '((.dns."proxy-server-nameserver" // []) | length)' "$CONFIG_YAML" 2>/dev/null)" = "0" ]; then
+		yq -M e -i '.dns."proxy-server-nameserver" = (.dns."default-nameserver" // ["223.5.5.5"])' "$CONFIG_YAML" 2>/dev/null || true
+	fi
+
+	_dns_node_policy_cleanup
+	[ "$rc" = "0" ] && log_msg "Inherited node domain DNS policy from subscription" "已从订阅继承节点域名 DNS 策略"
+	return 0
+}
+
 _dns_proxy_nameservers() {
 	local i=0 t en a p port s out="" prefix
 	while :; do
@@ -2098,7 +2200,9 @@ _start_prepare_config() {
 			cp -f /usr/share/clashoo/ruleset/cn.mrs /etc/clashoo/ruleset/cn.mrs 2>/dev/null
 		fi
 	fi
+	_dns_node_policy_capture
 	yml_change >/dev/null 2>&1
+	_dns_node_policy_apply
 	append_luci_fake_ip_filter_extras >/dev/null 2>&1
 	normalize_fake_ip_filter >/dev/null 2>&1
 	drop_legacy_cn_ip_injection >/dev/null 2>&1
@@ -2156,12 +2260,25 @@ _core_only_ui_args() {
 	printf ' -ext-ui %s' "$(shell_quote /etc/clashoo/dashboard)"
 }
 
+_mihomo_proxy_dns_valid() {
+	local config="$1" proxy_count policy_count respect_rules
+	command -v yq >/dev/null 2>&1 || return 0
+	[ -s "$config" ] || return 0
+	proxy_count="$(yq -M e -r '(.dns."proxy-server-nameserver" // []) | length' "$config" 2>/dev/null)"
+	[ "$proxy_count" = "0" ] || return 0
+	policy_count="$(yq -M e -r '(.dns."proxy-server-nameserver-policy" // {}) | length' "$config" 2>/dev/null)"
+	respect_rules="$(yq -M e -r '.dns."respect-rules" // false' "$config" 2>/dev/null)"
+	[ "$policy_count" = "0" ] && [ "$respect_rules" != "true" ]
+}
+
 _start_launch_core() {
 	local _cmd _core_only
 	disable_quic_gso=$(uci get clashoo.config.disable_quic_gso 2>/dev/null)
 	_core_only=$(uci -q get clashoo.config.core_only 2>/dev/null)
 	mkdir -p "$(dirname "$CORE_LOG_PATH")" >/dev/null 2>&1
 	touch "$CORE_LOG_PATH" >/dev/null 2>&1
+	# core.log 在 tmpfs 上，先按大小裁剪，避免上次跑飞的大日志直接卡死启动
+	sh /usr/share/clashoo/lib/core_log_guard.sh "$CORE_LOG_PATH" >/dev/null 2>&1
 
 	# Core-only runs the imported config verbatim, which may reference absolute
 	# paths (e.g. OpenClash's external-ui /usr/share/openclash/ui). mihomo's
@@ -2169,6 +2286,13 @@ _start_launch_core() {
 	# in core-only the user is explicitly trusting their own config.
 	[ "$_core_only" = "1" ] && export SAFE_PATHS="/"
 
+	if ! _mihomo_proxy_dns_valid "${CLASH_CONFIG}/config.yaml"; then
+		log_msg "Proxy node DNS is required by node DNS policy or respect-rules; set a Proxy Node Domain Resolver in LuCI" "节点域名 DNS 策略或 DNS 遵循规则需要代理节点域名解析，请在 LuCI 中配置"
+		runtime_state_record_health "fail" "preflight:proxy_dns_missing"
+		echo "Clashoo" > "$REAL_LOG"
+		return 1
+	fi
+
 	# preflight dry-run with watchdog: bail on bad config without touching
 	# firewall/dnsmasq, and never let a geo auto-download (mihomo blocks ~90s on
 	# a missing GeoIP/GeoSite when GitHub is unreachable) freeze startup/UI.
@@ -2193,6 +2317,10 @@ _start_launch_core() {
 	procd_set_param command /bin/sh -c "$_cmd"
 	[ "$disable_quic_gso" = "1" ] && procd_set_param env QUIC_GO_DISABLE_GSO=1
 	[ "$_core_only" = "1" ] && procd_set_param env SAFE_PATHS=/
+	# 默认 4095 个 fd 顶不住 BT/PCDN 类连接洪水，打爆后核心会陷入
+	# accept 失败刷屏，与 sing-box 实例保持一致提到 1000000。
+	procd_set_param limits core="unlimited"
+	procd_set_param limits nofile="1000000 1000000"
 	procd_set_param respawn 3600 5 5
 	procd_close_instance
 	[ "$disable_quic_gso" = "1" ] && log_msg "Disable quic-go GSO support" "已启用：禁用 quic-go GSO 支持"
@@ -2557,6 +2685,11 @@ reload_service()
 			rm -f "$_candidate" "$_previous" "$_response" "$_dns_backup"
 			return 1
 		fi
+		if ! _mihomo_proxy_dns_valid "$_candidate"; then
+			_log_runtime_error "Mihomo reload failed: node DNS policy or respect-rules requires a Proxy Node Domain Resolver; current config preserved"
+			rm -f "$_candidate" "$_previous" "$_response" "$_dns_backup"
+			return 1
+		fi
 		if [ "$(uci -q get clashoo.config.core_only 2>/dev/null)" = "1" ]; then
 			SAFE_PATHS=/ _run_with_timeout 15 "$CLASH" -d "$CLASH_CONFIG" -f "$_candidate" -t >> "$CORE_LOG_PATH" 2>&1
 		else

clashoo/files/usr/share/clashoo/lib/core_log_guard.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# clashoo core log size guard
+# 用法: core_log_guard.sh [logfile]
+#
+# core.log 落在 /var/log（= /tmp 下的 tmpfs），没有大小上限时一次 accept
+# 失败风暴就能把它写到几百 MB，直接把 /tmp 写满（dnsmasq、配置生成、
+# cron 全部失效）。这里在超过上限时就地裁剪，只保留尾部内容。
+# 内核进程持有该文件的 O_APPEND fd，所以必须原地重写，不能替换 inode。
+
+set -u
+
+LOG="${1:-/var/log/clashoo/core.log}"
+MAX_KB="${CLASHOO_CORE_LOG_MAX_KB:-16384}"
+KEEP_KB="${CLASHOO_CORE_LOG_KEEP_KB:-1024}"
+
+[ -f "$LOG" ] || exit 0
+size="$(wc -c <"$LOG" 2>/dev/null)"
+case "${size:-}" in ''|*[!0-9]*) exit 0 ;; esac
+[ "$size" -gt $((MAX_KB * 1024)) ] || exit 0
+
+tmp="${LOG}.trim.$$"
+if tail -c $((KEEP_KB * 1024)) "$LOG" >"$tmp" 2>/dev/null && cat "$tmp" >"$LOG" 2>/dev/null; then
+	rm -f "$tmp"
+else
+	rm -f "$tmp"
+	: >"$LOG" 2>/dev/null || true
+fi
+exit 0

clashoo/files/usr/share/clashoo/net/access_check_daemon.sh

@@ -30,6 +30,8 @@ echo "$$" >"$PID_FILE"
 while :; do
 	[ "$(uci -q get clashoo.config.enable 2>/dev/null)" = "1" ] || break
 	/usr/share/clashoo/net/access_check_cache.sh >/dev/null 2>&1 || true
+	# 每轮顺手卡一下 core.log 大小（tmpfs 很小，跑飞会写满 /tmp）
+	sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1 || true
 	if [ -n "$INTERVAL_FIXED" ]; then
 		sleep "$INTERVAL_FIXED"
 	else

clashoo/files/usr/share/clashoo/runtime/dns_node_policy.uc

@@ -0,0 +1,118 @@
+#!/usr/bin/ucode
+'use strict';
+
+import { readfile } from 'fs';
+
+// Mirror node-domain DNS policies from the subscription into
+// proxy-server-nameserver-policy (issue #73).
+//
+// Airports publish their own resolver for node domains, e.g.
+//   nameserver-policy:
+//     "+.chylink.xyz": [tls://112.74.48.57:10853]
+// which answers with domestic relay IPs. mihomo resolves *proxy server* domains
+// through proxy-server-nameserver(-policy) and ignores nameserver-policy there,
+// so that resolver is never used and node domains fall back to public DNS -
+// which may return overseas CDN IPs that some lines cannot reach at all, leaving
+// every node (AnyTLS is TCP-only) timing out.
+//
+// Input : CLASHOO_NODE_DNS_SOURCE_FILE = path to {"policies": {...}, "servers": [...]}
+//         (CLASHOO_NODE_DNS_SOURCE with the JSON itself is still accepted)
+// Output: JSON map with only the policy entries matching a node server domain
+//         (nothing is printed when there is no match)
+
+let source = '';
+let source_file = getenv('CLASHOO_NODE_DNS_SOURCE_FILE') || '';
+
+if (length(source_file)) {
+	try {
+		source = readfile(source_file) || '';
+	}
+	catch (e) {
+		exit(0);
+	}
+}
+else {
+	source = getenv('CLASHOO_NODE_DNS_SOURCE') || '';
+}
+
+if (!length(source))
+	exit(0);
+
+let parsed;
+
+try {
+	parsed = json(source);
+}
+catch (e) {
+	exit(0);
+}
+
+if (type(parsed) != 'object')
+	exit(0);
+
+let policies = parsed.policies;
+let servers = parsed.servers;
+
+if (type(policies) != 'object' || type(servers) != 'array')
+	exit(0);
+
+let domains = [];
+let seen = {};
+
+for (let server in servers) {
+	if (type(server) != 'string' || !length(server))
+		continue;
+	server = lc(server);
+	if (seen[server])
+		continue;
+	seen[server] = true;
+	push(domains, server);
+}
+
+if (!length(domains))
+	exit(0);
+
+// suffix match on a label boundary: node.example.com matches +.example.com
+function domain_matches(key, domain) {
+	let key_len = length(key);
+	let domain_len = length(domain);
+
+	if (!key_len || domain_len < key_len)
+		return false;
+	if (domain == key)
+		return true;
+	if (substr(domain, domain_len - key_len) != key)
+		return false;
+	return substr(domain, domain_len - key_len - 1, 1) == '.';
+}
+
+let result = {};
+
+for (let key, value in policies) {
+	if (type(key) != 'string' || !length(key))
+		continue;
+
+	let lowered = lc(key);
+	let is_pattern = match(lowered, /^[+*]?\./) != null;
+	let domain = replace(lowered, /^\+\./, '');
+
+	domain = replace(domain, /^\*\./, '');
+	domain = replace(domain, /^\./, '');
+
+	let matched = false;
+
+	for (let candidate in domains) {
+		if (is_pattern ? domain_matches(domain, candidate) : (candidate == lowered)) {
+			matched = true;
+			break;
+		}
+	}
+
+	if (matched)
+		result[key] = value;
+}
+
+if (!length(keys(result)))
+	exit(0);
+
+print(sprintf('%J', result));

clashoo/files/usr/share/clashoo/runtime/mixin.uc

@@ -145,7 +145,7 @@ if (type(inherited_nameserver) != 'array') {
 		inherited_nameserver = [];
 }
 let dns_role_fields = ['nameserver', 'proxy-server-nameserver', 'direct-nameserver',
-	'default-nameserver', 'nameserver-policy', 'respect-rules'];
+	'default-nameserver', 'nameserver-policy', 'proxy-server-nameserver-policy', 'respect-rules'];
 let had_user_dns_roles = false;
 for (let f in dns_role_fields)
 	if (dns_present[f]) had_user_dns_roles = true;
@@ -200,18 +200,23 @@ if (length(bootstrap) && (!dns_present['default-nameserver'] || dns_force['defau
 	cfg['dns']['default-nameserver'] = bootstrap;
 
 let policies = {};
+let proxy_policies = {};
 uci.foreach('clashoo', 'dns_policy', function(sec) {
 	if (b(sec.enabled) == false) return;
-	if (s(sec.policy_type, 'nameserver-policy') != 'nameserver-policy') return;
+	let role = s(sec.policy_type, 'nameserver-policy');
+	if (role != 'nameserver-policy' && role != 'proxy-server-nameserver-policy') return;
 	let matcher = trim(sec.matcher || '');
 	let servers = sec.nameserver;
 	if (type(servers) != 'array') servers = servers != null ? [servers] : [];
 	if (!length(matcher) || !length(servers)) return;
 	if (matcher == 'geosite:cn') { matcher = 'rule-set:cn_domain'; need_cn_rs = true; }
-	policies[matcher] = servers;
+	if (role == 'nameserver-policy') policies[matcher] = servers;
+	else proxy_policies[matcher] = servers;
 });
 if (length(keys(policies)) && (!dns_present['nameserver-policy'] || dns_force['nameserver-policy']))
 	cfg['dns']['nameserver-policy'] = policies;
+if (length(keys(proxy_policies)) && (!dns_present['proxy-server-nameserver-policy'] || dns_force['proxy-server-nameserver-policy']))
+	cfg['dns']['proxy-server-nameserver-policy'] = proxy_policies;
 
 let respect_rules = a('dns_respect_rules') == null ? true : ab('dns_respect_rules');
 if (dns_force['respect-rules'])

clashoo/files/usr/share/clashoo/update/maintenance_cron.sh

@@ -32,5 +32,6 @@ fi
 
 if [ "$(uci -q get clashoo.config.auto_clear_log)" = "1" ] && due log_cleanup.status clear_time; then
 	: >"$LOG_FILE"
+	sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1
 	stamp log_cleanup.status
 fi