🍕 Sync 2026-08-28 16:44:23

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.8.26
-PKG_RELEASE:=248
+PKG_RELEASE:=249
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/luasrc/controller/passwall.lua

@@ -934,7 +934,8 @@ local backup_files = {
     "/usr/share/passwall/rules/direct_host",
     "/usr/share/passwall/rules/direct_ip",
     "/usr/share/passwall/rules/proxy_host",
-    "/usr/share/passwall/rules/proxy_ip"
+    "/usr/share/passwall/rules/proxy_ip",
+    "/usr/share/passwall/rules/domains_excluded"
 }
 
 function create_backup()

luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua

@@ -193,7 +193,7 @@ if has_xray then
 	o.default = 0
 	o.description = translate("Override the connection destination address with the sniffed domain.<br />Otherwise use sniffed domain for routing only.<br />If using shunt nodes, configure the domain shunt rules correctly.")
 
-	local domains_excluded = string.format("/usr/share/%s/domains_excluded", m.config)
+	local domains_excluded = string.format("/usr/share/%s/rules/domains_excluded", m.config)
 	o = s_xray:option(TextValue, "excluded_domains", translate("Excluded Domains"), translate("If the traffic sniffing result is in this list, the destination address will not be overridden."))
 	o.rows = 15
 	o.wrap = "off"

luci-app-passwall/luasrc/model/cbi/passwall/client/type/1_sing-box.lua

@@ -383,6 +383,10 @@ if singbox_tags:find("with_quic") then
 	o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
 	o:depends({ hysteria2_realms = "1" })
 
+	o = s:option(Flag, "hysteria2_realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+	o.default = "0"
+	o:depends({ hysteria2_realms = "1" })
+
 	o = s:option(Value, "hysteria2_auth_password", translate("Auth Password"))
 	o.password = true
 	o:depends({ protocol = "hysteria2"})

luci-app-passwall/luasrc/model/cbi/passwall/client/type/2_xray.lua

@@ -357,6 +357,10 @@ o = s:option(DynamicList, "hysteria2_realm_stun", translate("Realm STUN"))
 o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
 o:depends({ hysteria2_realms = "1" })
 
+o = s:option(Flag, "hysteria2_realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+o.default = "0"
+o:depends({ hysteria2_realms = "1" })
+
 o = s:option(Value, "hysteria2_auth_password", translate("Auth Password"))
 o.password = true
 o:depends({ protocol = "hysteria2"})

luci-app-passwall/luasrc/model/cbi/passwall/client/type/5_hysteria2.lua

@@ -61,6 +61,11 @@ o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio
 o.rewrite_option = _n(o.option)
 o:depends({ realms = "1" })
 
+o = s:option(Flag, "realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+o.default = "0"
+o.rewrite_option = _n(o.option)
+o:depends({ realms = "1" })
+
 o = s:option(Value, "auth_password", translate("Auth Password"))
 o.password = true
 o.rewrite_option = _n(o.option)
@@ -124,6 +129,20 @@ o = s:option(Flag, "disable_mtu_discovery", translate("Disable MTU detection"))
 o.default = "0"
 o.rewrite_option = _n(o.option)
 
+
+o = s:option(Flag, "ech", translate("ECH"))
+o.default = "0"
+o:depends({ realms = false })
+
+o = s:option(TextValue, "ech_config", translate("ECH Config"))
+o.default = ""
+o.rows = 5
+o.wrap = "soft"
+o:depends({ ech = "1" })
+o.validate = function(self, value)
+	return api.trim(value:gsub("[\r\n]", ""))
+end
+
 o = s:option(Flag, "lazy_start", translate("Lazy Start"))
 o.default = "0"
 o.rewrite_option = _n(o.option)

luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua

@@ -183,6 +183,10 @@ if singbox_tags:find("with_quic") then
 	o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
 	o:depends({ hysteria2_realms = "1" })
 
+	o = s:option(Flag, "hysteria2_realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+	o.default = "0"
+	o:depends({ hysteria2_realms = "1" })
+
 	o = s:option(ListValue, "hysteria2_obfs_type", translate("Obfs Type"))
 	o:value("", translate("Disable"))
 	o:value("salamander")

luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua

@@ -149,6 +149,10 @@ o = s:option(DynamicList, "hysteria2_realm_stun", translate("Realm STUN"))
 o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
 o:depends({ hysteria2_realms = "1" })
 
+o = s:option(Flag, "hysteria2_realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+o.default = "0"
+o:depends({ hysteria2_realms = "1" })
+
 o = s:option(ListValue, "hysteria2_obfs_type", translate("Obfs Type"))
 o:value("", translate("Disable"))
 o:value("salamander")

luci-app-passwall/luasrc/model/cbi/passwall/server/type/5_hysteria2.lua

@@ -73,6 +73,11 @@ o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio
 o.rewrite_option = _n(o.option)
 o:depends({ realms = "1" })
 
+o = s:option(Flag, "realm_upnp", translate("Enable") .. " UPnP/NAT-PMP", translate("Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."))
+o.default = "0"
+o.rewrite_option = _n(o.option)
+o:depends({ realms = "1" })
+
 o = s:option(ListValue, "obfs_type", translate("Obfs Type"))
 o:value("", translate("Disable"))
 o:value("salamander")
@@ -147,6 +152,19 @@ o.validate = function(self, value, t)
 end
 o:depends({ custom = false })
 
+o = s:option(FileUpload, "ech_keyFile", translate("ECH key absolute path"), translate("as:") .. "/etc/ssl/ech.pem")
+o.validate = function(self, value, t)
+	if value and value ~= "" then
+		if not fs.access(value) then
+			return nil, translate("Can't find this file!")
+		else
+			return value
+		end
+	end
+	return nil
+end
+o:depends({ custom = false })
+
 o = s:option(Flag, "firewall_allow", translate("Firewall Allow"))
 o.default = "0"
 o:depends({ custom = false })

luci-app-passwall/luasrc/passwall/util_hysteria2.lua

@@ -48,8 +48,10 @@ function gen_config_server(node)
 		ignoreClientBandwidth = (node.hysteria2_ignoreClientBandwidth == "1") and true or false,
 		disableUDP = (node.hysteria2_udp == "0") and true or false,
 		realm = (node.hysteria2_realms and node.hysteria2_realm_stun) and {
-			stunServers = node.hysteria2_realm_stun
-		} or nil
+			stunServers = node.hysteria2_realm_stun,
+			portMapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
+		} or nil,
+		ech = (node.ech_keyFile and node.ech_keyFile ~= "") and { keyPath = node.ech_keyFile } or nil
 	}
 
 	if config.obfs and config.obfs.gecko then
@@ -101,7 +103,8 @@ function gen_config(var)
 			return server
 		end)(),
 		realm = (node.hysteria2_realms and node.hysteria2_realm_stun) and {
-			stunServers = node.hysteria2_realm_stun
+			stunServers = node.hysteria2_realm_stun,
+			portMapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
 		} or nil,
 		transport = {
 			type = "udp",
@@ -138,6 +141,7 @@ function gen_config(var)
 			sni = node.tls_serverName,
 			insecure = (node.tls_allowInsecure == "1") and true or false,
 			pinSHA256 = (node.tls_pinSHA256) and node.tls_pinSHA256 or nil,
+			ech = (node.ech == "1") and node.ech_config or nil
 		},
 		quic = {
 			initStreamReceiveWindow = (node.hysteria2_recv_window) and tonumber(node.hysteria2_recv_window) or nil,

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -596,6 +596,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 						realm.scheme = nil
 						realm.address = nil
 						realm.port = nil
+						realm.port_mapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
 						return realm
 					end
 					return nil
@@ -951,6 +952,7 @@ function gen_config_server(node)
 					realm.address = nil
 					realm.port = nil
 					realm.stun_domain_resolver = "direct"
+					realm.port_mapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
 					return realm
 				end
 				return nil

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -15,7 +15,7 @@ local xray_version = api.get_app_version("xray")
 local xray_min_version = "26.3.27"
 
 local function get_domain_excluded()
-	local path = "/usr/share/passwall/domains_excluded"
+	local path = string.format("/usr/share/%s/rules/domains_excluded", api.c_config)
 	local content = fs.readfile(path)
 	if not content then return nil end
 	local hosts = {}
@@ -308,7 +308,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 								type = "realm",
 								settings = {
 									url = url,
-									stunServers = stun
+									stunServers = stun,
+									portMapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
 								}
 							}
 							udp[#udp+1] = r
@@ -782,7 +783,8 @@ function gen_config_server(node)
 									type = "realm",
 									settings = {
 										url = url,
-										stunServers = stun
+										stunServers = stun,
+										portMapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
 									}
 								}
 								udp[#udp+1] = r

luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm

@@ -594,6 +594,7 @@ local current_node = map:get(section)
 			params += opt.query("pinSHA256", dom_prefix + "tls_pinSHA256");
 			params += opt.query("pcs", dom_prefix + "tls_pinSHA256");
 			params += opt.query("vcn", dom_prefix + "tls_CertByName");
+			params += opt.query("ech", dom_prefix + "ech_config");
 			
 			var v_password = null;
 			
@@ -628,7 +629,7 @@ local current_node = map:get(section)
 			params = params.replace(/^&/, "");
 			url =
 				_address + ":" +
-				v_port.value + "?" +
+				(v_port.value || "443") + "?" +
 				params +
 				"#" + encodeURI(v_alias.value);
 			if (v_password) {
@@ -1664,6 +1665,8 @@ local current_node = map:get(section)
 			);
 			opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || queryParam.pinSHA256 || '');
 			opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');
+			opt.set(dom_prefix + 'ech', !!queryParam.ech);
+			opt.set(dom_prefix + 'ech_config', queryParam.ech || '');
 			if (m.hash) {
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}

luci-app-passwall/po/zh-cn/passwall.po

@@ -1646,6 +1646,9 @@ msgstr "公钥文件绝对路径"
 msgid "Private key absolute path"
 msgstr "私钥文件绝对路径"
 
+msgid "ECH key absolute path"
+msgstr "ECH 密钥绝对路径"
+
 msgid "Can't find this file!"
 msgstr "找不到这个文件！"
 
@@ -2202,6 +2205,9 @@ msgstr "Gecko 包大小（最小）"
 msgid "Gecko Packet Size (max)"
 msgstr "Gecko 包大小（最大）"
 
+msgid "Enable UPnP/NAT-PMP port mapping on your gateway to improve hole punching success."
+msgstr "在网关上启用 UPnP/NAT-PMP 端口映射以提升打洞成功率。"
+
 msgid "valid time (hh:mm)"
 msgstr "有效时间（hh:mm）"
 

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -1467,6 +1467,10 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 		result.hysteria2_up_mbps = params.upmbps or (sub_cfg and sub_hy_up_mbps or nil)
 		result.hysteria2_down_mbps = params.downmbps or (sub_cfg and sub_hy_down_mbps or nil)
 		result.hysteria2_hop = params.mport
+		if params.ech and params.ech ~= "" then
+			result.ech = "1"
+			result.ech_config = params.ech
+		end
 		if params["obfs-password"] or params["obfs_password"] then
 			result.hysteria2_obfs_type = params.obfs or "salamander"
 			result.hysteria2_obfs_password = params["obfs-password"] or params["obfs_password"]