🎨 Sync 2026-09-12 22:40:36

fastnet/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_FASTNET:=$(ARCH)
 
 PKG_NAME:=fastnet
-PKG_VERSION:=kaiplus-runtime-v1.0.9
-PKG_RELEASE:=3
+PKG_VERSION:=0.7.7
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/fastnet-runtime-v$(PKG_VERSION)/

luci-app-frpc/htdocs/luci-static/resources/view/frpc.js

@@ -1422,7 +1422,7 @@ return view.extend({
 				});
 			});
 
-			return E('div', { class: 'cbi-map' },
+			return E('div', {},
 				E('fieldset', { class: 'cbi-section' }, [
 					E('p', { id: 'service_status' }, _('Collecting data ...'))
 				])

luci-app-frps/htdocs/luci-static/resources/view/frps.js

@@ -982,7 +982,7 @@ return view.extend({
 				});
 			});
 
-			return E('div', { class: 'cbi-map' },
+			return E('div', {},
 				E('fieldset', { class: 'cbi-section' }, [
 					E('p', { id: 'service_status' }, _('Collecting data ...'))
 				])

luci-app-fwlive/Makefile

@@ -12,7 +12,7 @@ LUCI_DEPENDS:=+luci-base +logd +jsonfilter
 LUCI_PKGARCH:=all
 
 PKG_VERSION:=0.1.41
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 
 # Reproducible build: honor SOURCE_DATE_EPOCH from the build environment (set by docker-sdk.sh / CI).
 ifdef SOURCE_DATE_EPOCH

luci-app-fwlive/htdocs/luci-static/resources/fwlive/log.js

@@ -360,6 +360,26 @@ return baseclass.extend({
 		].join('|');
 	},
 
+	extractAddrs: function (kv) {
+		return {
+			src: kv.SRC || '',
+			dst: kv.DST || '',
+			sport: kv.SPT || '',
+			dport: kv.DPT || ''
+		};
+	},
+
+	extractIfaces: function (kv) {
+		const ifaceIn = kv.IN || '';
+		const ifaceOut = kv.OUT || '';
+		return {
+			ifaceIn: ifaceIn,
+			ifaceOut: ifaceOut,
+			iface: ifaceIn || ifaceOut || '',
+			dir: ifaceIn && ifaceOut ? 'forward' : ifaceIn ? 'in' : ifaceOut ? 'out' : 'unknown'
+		};
+	},
+
 	normalizeEntry: function (entry) {
 		const kv = this.parseKeyValueLog(entry.msg || '');
 		const tsUnix = this.timestampUnix(entry);
@@ -371,14 +391,8 @@ return baseclass.extend({
 			this.detectAction(entry.msg || '')
 		);
 		const action = this.normalizeAction(actionRaw);
-		const src = kv.SRC || '';
-		const dst = kv.DST || '';
-		const sport = kv.SPT || '';
-		const dport = kv.DPT || '';
-		const ifaceIn = kv.IN || '';
-		const ifaceOut = kv.OUT || '';
-		const iface = ifaceIn || ifaceOut || '';
-		const dir = ifaceIn && ifaceOut ? 'forward' : ifaceIn ? 'in' : ifaceOut ? 'out' : 'unknown';
+		const addrs = this.extractAddrs(kv);
+		const ifs = this.extractIfaces(kv);
 		const flags = this.parseFlags(entry.msg || '', kv);
 		const length = this.parseLength(kv);
 		const ruleHint = this.parseRuleHint(entry.msg || '');
@@ -389,13 +403,13 @@ return baseclass.extend({
 				entry,
 				tsUnix,
 				action,
-				src,
-				dst,
-				sport,
-				dport,
+				addrs.src,
+				addrs.dst,
+				addrs.sport,
+				addrs.dport,
 				proto,
-				ifaceIn,
-				ifaceOut
+				ifs.ifaceIn,
+				ifs.ifaceOut
 			),
 			log_id: entry && entry.id != null ? Number(entry.id) : null,
 			timestamp: tsUnix,
@@ -404,15 +418,15 @@ return baseclass.extend({
 			rule_label: ruleLabel,
 			action: action,
 			action_raw: actionRaw,
-			interface: iface,
-			interface_in: ifaceIn,
-			interface_out: ifaceOut,
-			direction: dir,
+			interface: ifs.iface,
+			interface_in: ifs.ifaceIn,
+			interface_out: ifs.ifaceOut,
+			direction: ifs.dir,
 			proto: proto,
-			src: src,
-			sport: sport,
-			dst: dst,
-			dport: dport,
+			src: addrs.src,
+			sport: addrs.sport,
+			dst: addrs.dst,
+			dport: addrs.dport,
 			flags: flags,
 			length: length,
 			message: entry.msg || ''
@@ -467,42 +481,42 @@ return baseclass.extend({
 		return p.negate ? !hit : hit;
 	},
 
+	matchesQueryField: function (row, spec) {
+		const p = this.parseFilterValue(spec);
+		if (!p.value) return true;
+
+		const keys = Object.keys(row);
+		const parts = [];
+		for (let i = 0; i < keys.length; i++) parts.push(row[keys[i]]);
+		const blob = parts.join(' ').toLowerCase();
+		const hit = blob.indexOf(p.value.toLowerCase()) !== -1;
+		return p.negate ? !hit : hit;
+	},
+
+	matchesActionField: function (row, spec) {
+		const p = this.parseFilterValue(spec);
+		if (!p.value) return true;
+
+		const want = p.value.toLowerCase();
+		const hit =
+			row.action === want || (row.action_raw || '').toUpperCase() === p.value.toUpperCase();
+		return p.negate ? !hit : hit;
+	},
+
+	matchesInterfaceField: function (row, spec) {
+		const p = this.parseFilterValue(spec);
+		if (!p.value) return true;
+
+		const iface = p.value;
+		const hit =
+			row.interface === iface || row.interface_in === iface || row.interface_out === iface;
+		return p.negate ? !hit : hit;
+	},
+
 	matchesFilter: function (row, filters) {
-		if (filters.q) {
-			const p = this.parseFilterValue(filters.q);
-			if (p.value) {
-				const keys = Object.keys(row);
-				const parts = [];
-				for (let i = 0; i < keys.length; i++) parts.push(row[keys[i]]);
-				const blob = parts.join(' ').toLowerCase();
-				const hit = blob.indexOf(p.value.toLowerCase()) !== -1;
-				if (p.negate ? hit : !hit) return false;
-			}
-		}
-
-		if (filters.action) {
-			const p = this.parseFilterValue(filters.action);
-			if (p.value) {
-				const want = p.value.toLowerCase();
-				const hit =
-					row.action === want ||
-					(row.action_raw || '').toUpperCase() === p.value.toUpperCase();
-				if (p.negate ? hit : !hit) return false;
-			}
-		}
-
-		if (filters.interface) {
-			const p = this.parseFilterValue(filters.interface);
-			if (p.value) {
-				const iface = p.value;
-				const hit =
-					row.interface === iface ||
-					row.interface_in === iface ||
-					row.interface_out === iface;
-				if (p.negate ? hit : !hit) return false;
-			}
-		}
-
+		if (filters.q && !this.matchesQueryField(row, filters.q)) return false;
+		if (filters.action && !this.matchesActionField(row, filters.action)) return false;
+		if (filters.interface && !this.matchesInterfaceField(row, filters.interface)) return false;
 		if (filters.proto && !this.matchesExactField(row.proto, filters.proto)) return false;
 		if (filters.src && !this.matchesTextField(row.src, filters.src)) return false;
 		if (filters.dst && !this.matchesTextField(row.dst, filters.dst)) return false;

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.9.9
-PKG_RELEASE:=268
+PKG_RELEASE:=269
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/htdocs/luci-static/resources/view/passwall/func.js

@@ -61,14 +61,11 @@ function getOption(config, section, opt) {
 	const id = `cbid.${config}.${section}.${opt}`;
 	obj = document.getElementsByName(id)[0] || document.getElementById(id);
 	if (obj) {
+		//lua luci combobox
 		const combobox = document.getElementById('cbi.combobox.' + id);
 		if (combobox) {
 			obj.combobox = combobox;
 		}
-		const div = document.getElementById(id);
-		if (div && div.getElementsByTagName("li").length > 0) {
-			obj = div;
-		}
 		return obj;
 	} else {
 		return null;

luci-app-passwall/luasrc/model/cbi/passwall/client/type/1_sing-box.lua

@@ -620,6 +620,7 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "shadowsocks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
+	o:depends({ protocol = "http", tls = true })
 
 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })

luci-app-passwall/luasrc/model/cbi/passwall/client/type/2_xray.lua

@@ -401,6 +401,7 @@ o = s:option(Flag, "tls", translate("TLS"))
 o.default = 0
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "shadowsocks" })
 
@@ -719,6 +720,8 @@ o:depends({ protocol = "vless", transport = "raw" })
 o:depends({ protocol = "vless", transport = "ws" })
 o:depends({ protocol = "vless", transport = "grpc" })
 o:depends({ protocol = "vless", transport = "httpupgrade" })
+o:depends({ protocol = "http" })
+o:depends({ protocol = "socks" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })
 

luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua

@@ -206,13 +206,18 @@ o.validate = function(self, value, t)
 end
 o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
+o:depends({ protocol = "http" })
 o:depends({ protocol = "shadowsocks" })
 o:depends({ protocol = "trojan" })
 
 -- [[ REALITY部分 ]] --
 o = s:option(Flag, "reality", translate("REALITY"))
 o.default = 0
-o:depends({ tls = true })
+o:depends({ tls = true, transport = "raw" })
+o:depends({ tls = true, transport = "ws" })
+o:depends({ tls = true, transport = "grpc" })
+o:depends({ tls = true, transport = "httpupgrade" })
+o:depends({ tls = true, transport = "xhttp" })
 
 o = s:option(Value, "reality_private_key", translate("Private Key"))
 o:depends({ reality = true })

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -481,9 +481,9 @@ function gen_outbound(flag, node, tag, proxy_table)
 				obfs = node.hysteria_obfs,
 				auth = (node.hysteria_auth_type == "base64") and node.hysteria_auth_password or nil,
 				auth_str = (node.hysteria_auth_type == "string") and node.hysteria_auth_password or nil,
-				recv_window_conn = tonumber(node.hysteria_recv_window_conn),  --1.14 将变更为 stream_receive_window
-				recv_window = tonumber(node.hysteria_recv_window),  --1.14 将变更为 connection_receive_window
-				disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 将变更为 disable_path_mtu_discovery
+				stream_receive_window = tonumber(node.hysteria_recv_window_conn),
+				connection_receive_window = tonumber(node.hysteria_recv_window),
+				disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 				tls = tls
 			}
 		end
@@ -910,10 +910,10 @@ function gen_config_server(node)
 			down_mbps = tonumber(node.hysteria_down_mbps),
 			obfs = node.hysteria_obfs,
 			users = users,
-			recv_window_conn = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil, --1.14 to stream_receive_window
-			recv_window_client = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil, --1.14 to connection_receive_window
-			max_conn_client = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,  --1.14 to max_concurrent_streams
-			disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 to disable_path_mtu_discover
+			stream_receive_window = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil,
+			connection_receive_window = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil,
+			max_concurrent_streams = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,
+			disable_path_mtu_discover = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 			tls = tls
 		}
 	end

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -120,6 +120,10 @@ function gen_outbound(flag, node, tag, proxy_table)
 			node.stream_security = "tls"
 		end
 
+		if node.protocol == "http" and node.stream_security == "tls" then
+			node.transport = "raw"
+		end
+
 		if remarks then
 			tag = tag .. ":" .. remarks
 		end
@@ -138,7 +142,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 				xudpConcurrency = (node.mux == "1" and ((node.xudp_concurrency) and tonumber(node.xudp_concurrency) or 8)) or nil
 			} or nil,
 			-- 底层传输配置
-			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria") and {
+			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria" or node.protocol == "http") and {
 				sockopt = {
 					mark = 255,
 					domainStrategy = node.domain_strategy or "UseIP",
@@ -544,7 +548,7 @@ function gen_config_server(node)
 			allowTransparent = false,
 			users = users
 		}
-		node.transport = "tcp"
+		node.transport = "raw"
 		node.tcp_guise = "none"
 	elseif node.protocol == "shadowsocks" then
 		settings = {

luci-app-passwall/luasrc/view/passwall/node_config/footer.htm

@@ -26,12 +26,18 @@ local config = map.config
 						update_config(node_id, {
 							remarks: getOption("<%=config%>", "<%=sid%>", "remarks").value,
 							group: getOption("<%=config%>", "<%=sid%>", "group").value,
-							type: getOption("<%=config%>", "<%=sid%>", "type").value,
+							type: el.value,
 							//protocol: ''
 						}, node_config_url);
 					}
 				}
 			});
+			const fromUrlCache = JSON.parse(sessionStorage.getItem("fromUrl"));
+			if (fromUrlCache && fromUrlCache.savetime && (Date.now() - fromUrlCache.timestamp) < fromUrlCache.savetime) {
+				fromUrl(fromUrlCache.link, true)
+			} else {
+				sessionStorage.removeItem("fromUrl");
+			}
 		});
 		waitForElement('select[name*="<%=config%>"][name*="protocol"]', function(el) {
 			let o_val = el.value;
@@ -56,7 +62,7 @@ local config = map.config
 					update_config(node_id, {
 						remarks: getOption("<%=config%>", "<%=sid%>", "remarks").value,
 						group: getOption("<%=config%>", "<%=sid%>", "group").value,
-						protocol: getOption("<%=config%>", "<%=sid%>", name).value,
+						protocol: el.value,
 					}, node_config_url);
 					*/
 				}

luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm

@@ -1,8 +1,8 @@
 <%+cbi/valueheader%>
 <%
-local api = require "luci.passwall.api"
-local appname = api.appname
 local map = self.map
+local api = map.api
+local config = map.config
 
 local has_ss_rust = api.is_finded("sslocal")
 local has_singbox = api.finded_com("sing-box")
@@ -17,7 +17,7 @@ local hysteria2_type = api.get_core("hysteria2_type", {{has_hysteria2,"hysteria2
 
 local current_node = map:get(section)
 -%>
-<script src="<%=resource%>/view/<%=appname%>/qrcode.min.js"></script>
+<script src="<%=resource%>/view/<%=api.appname%>/qrcode.min.js"></script>
 <script type="text/javascript">//<![CDATA[
 	let has_singbox = "<%=has_singbox%>"
 	let has_xray = "<%=has_xray%>"
@@ -112,8 +112,7 @@ local current_node = map:get(section)
 
 	function buildUrl(btn, urlname, sid) {
 		var opt = {
-			base: "cbid.<%=appname%>",
-			client: true,
+			base: "cbid.<%=config%>",
 			get: function (opt) {
 				var id = this.base + "." + opt;
 				var obj = document.getElementsByName(id)[0] || document.getElementsByClassName(id)[0] || document.getElementById(id)
@@ -158,7 +157,6 @@ local current_node = map:get(section)
 			}
 		}
 		opt.base = "cbid." + urlname + "." + sid;
-		opt.client = urlname.indexOf("server") === -1;
 		var v_type = opt.get("type").value;
 		var v_alias = opt.get("remarks");
 
@@ -753,34 +751,41 @@ local current_node = map:get(section)
 		return server.replace(/^\[/, '').replace(/\]$/, '');
 	}
 
-	function fromUrl(btn, urlname, sid, cacheData) {
-		var opt = {
-			base: 'cbid.<%=appname%>',
-			client: true,
+	function tofromUrl(btn) {
+		let link = prompt('<%:Paste Share URL Here%>', '');
+		if (link === null || link === "") {
+			return false;
+		}
+		return fromUrl(link);
+	}
+
+	function fromUrl(link, from_cache) {
+		if (!link) {
+			return false;
+		}
+		const s = document.getElementById("<%=self.option%>-status");
+		if (!s) {
+			alert("Never");
+			return false;
+		}
+		s.innerHTML = "";
+
+		const current_type = '<%=current_node.type or ""%>';
+		let switch_type = null;
+
+		const opt = {
+			base: "cbid.<%=self.option%>.<%=self.value%>",
 			get: function (opt) {
-				var obj;
-				var id = this.base + '.' + opt;
-				obj = document.getElementsByName(id)[0] || document.getElementById(id);
-				if (obj) {
-					var combobox = document.getElementById('cbi.combobox.' + id);
-					if (combobox) {
-						obj.combobox = combobox;
-					}
-					var div = document.getElementById(id);
-					if (div && div.getElementsByTagName("li").length > 0) {
-						obj = div;
-					}
-					return obj;
-				} else {
-					return null;
-				}
+				return getOption("<%=config%>", "<%=self.value%>", opt);
 			},
 			set: function (opt, val) {
+				if (!switch_type && opt == "type" && current_type != val) {
+					switch_type = val;
+					return;
+				}
 				var obj;
 				obj = this.get(opt);
 				if (obj) {
-					var event = document.createEvent("HTMLEvents");
-					event.initEvent("change", true, true);
 					if (obj.type === 'checkbox') {
 						obj.checked = val;
 					} else {
@@ -814,17 +819,17 @@ local current_node = map:get(section)
 						}
 					}
 					try {
-						obj.dispatchEvent(event);
+						obj.dispatchEvent(new Event("change", { bubbles: true, cancelable: true }));
 					} catch (err) {}
 				} else {
 					//alert('<%:Faltal on set option, please help in debug: %>' + opt + ' = ' + val);
-					// 处理 DynamicList
+					// Processing DynamicList
 					var fullName = this.base + '.' + opt;
 					var lists = document.querySelectorAll('.cbi-dynlist');
 					for (var i = 0; i < lists.length; i++) {
 						var parent = lists[i].closest('.cbi-value');
 						if (!parent) continue;
-						// 尝试从 label 的 for 属性中提取 fullName
+						// Try to extract fullName from the label's for attribute.
 						var label = parent.querySelector('label.cbi-value-title');
 						var labelFor = label?.getAttribute('for');
 						if (labelFor === fullName) {
@@ -838,58 +843,20 @@ local current_node = map:get(section)
 						}
 					}
 				}
-			},
-			setlist: function (opt, vlist) {
-				var id = this.base + "." + opt;
-				var objs = document.getElementsByName(id) || document.getElementsByClassName(id);
-				if (objs) {
-					var values = "";
-					for (var i = 0; i < vlist.length; i++) {
-						values += vlist[i] + ", ";
-					}
-					alert("Manually input the option:\n" + opt + "s:\n[" + values + "]");
-				} else {
-					//alert("<%:Faltal on set option, please help in debug: %>" + opt);
-				}
 			}
 		}
 
-		var s = document.getElementById(urlname + '-status');
-		if (!s) {
-			alert("Never");
-			return false;
-		}
-		opt.base = "cbid." + urlname + "." + sid;
-		opt.client = urlname.indexOf("server") === -1;
-		var ssrurl = null;
-		if (cacheData) {
-			ssrurl = cacheData.ssrurl
-		} else {
-			ssrurl = prompt('<%:Paste Share URL Here%>', '');
-			if (ssrurl === null || ssrurl === "") {
-				return false;
-			}
-			sessionStorage.setItem("fromUrl", JSON.stringify({
-				timestamp: Date.now(),
-				savetime: 60 * 1000,
-				urlname: urlname,
-				sid: sid,
-				ssrurl: ssrurl
-			}));
-		}
-		ssrurl = ssrurl.split(/\r\n|\r|\n/, 1)[0];
-		ssrurl = ssrurl.replace(/&amp;/gi, '&').replace(/\s*#\s*/, '#').trim();  //一些奇葩的链接用"&amp;"当做"&"，"#"前后带空格
-		s.innerHTML = "";
-		var ssu = ssrurl.split('://');
-		var event = document.createEvent("HTMLEvents");
-		event.initEvent("change", true, true);
+		link = link.split(/\r\n|\r|\n/, 1)[0];
+		link = link.replace(/&amp;/gi, '&').replace(/\s*#\s*/, '#').trim();  //一些奇葩的链接用"&amp;"当做"&"，"#"前后带空格
+		const link_split = link.split('://');
+		const link_type = link_split[0];
 
-		var dom_prefix = null
+		let dom_prefix = null;
 
-		if (ssu[0] === "ssr") {
+		if (link_type === "ssr") {
 			dom_prefix = "ssr_"
-			//var b64c = ssu[1].match(/([A-Za-z0-9_-]+)/);
-			var sstr = b64decsafe((ssu[1] || "").replace(/#.*/, "").trim());
+			//var b64c = link_split[1].match(/([A-Za-z0-9_-]+)/);
+			var sstr = b64decsafe((link_split[1] || "").replace(/#.*/, "").trim());
 			var ploc = sstr.indexOf("/?");
 			var url0 = "", param = "";
 			if (ploc > 0) {
@@ -924,8 +891,8 @@ local current_node = map:get(section)
 			if (typeof (rem) !== 'undefined' && rem !== '' && rem.length > 0)
 				opt.set('remarks', b64decutf8safe(rem));
 		}
-		if (ssu[0] === "ss") {
-			var url0 = ssu[1] || "";
+		if (link_type === "ss") {
+			var url0 = link_split[1] || "";
 			param = "";
 
 			var ploc = url0.indexOf("#");
@@ -1000,15 +967,15 @@ local current_node = map:get(section)
 					queryParam.type && queryParam.type !== "tcp" &&
 					queryParam.headerType && queryParam.headerType !== "none";
 			if (has_xray && (ss_type == "xray" || needUpgrade || queryParam.type === "xhttp")) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 				opt.set(dom_prefix + 'protocol', "shadowsocks");
 			} else if (has_singbox && (ss_type == "sing-box" || needUpgrade)) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 				opt.set(dom_prefix + 'protocol', "shadowsocks");
 			} else {
-				dom_prefix = "ssrust_"
+				dom_prefix = "ssrust_";
 				opt.set('type', "SS-Rust");
 			}
 
@@ -1208,17 +1175,17 @@ local current_node = map:get(section)
 				}
 			}
 		}
-		if (ssu[0] === "trojan") {
+		if (link_type === "trojan") {
 			if (trojan_type == "sing-box" && has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 				opt.set(dom_prefix + 'protocol', "trojan");
 			} else if (trojan_type == "xray" && has_xray) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 				opt.set(dom_prefix + 'protocol', "trojan");
 			}
-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1346,14 +1313,14 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "vmess") {
-			var sstr = b64DecodeUnicode((ssu[1] || "").replace(/#.*/, "").trim());
+		if (link_type === "vmess") {
+			var sstr = b64DecodeUnicode((link_split[1] || "").replace(/#.*/, "").trim());
 			var ploc = sstr.indexOf("/?");
 			if (vmess_type == "sing-box" && has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			} else if (has_xray) {
-				dom_prefix = "xray_"
+				dom_prefix = "xray_";
 				opt.set('type', "Xray");
 			}
 			opt.set(dom_prefix + 'protocol', "vmess");
@@ -1447,14 +1414,14 @@ local current_node = map:get(section)
 			opt.set(dom_prefix + 'use_finalmask', !!ssm.fm);
 			opt.set(dom_prefix + 'finalmask', ssm.fm || "");
 		}
-		if (ssu[0] === "vless") {
+		if (link_type === "vless") {
 			if (vless_type == "sing-box" && has_singbox) {
 				dom_prefix = "singbox_";
 			} else if (has_xray) {
 				dom_prefix = "xray_";
 			}
 
-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1476,7 +1443,7 @@ local current_node = map:get(section)
 			if (["xhttp", "kcp", "mkcp"].includes(queryParam.type) && vless_type !== "xray" && has_xray) {
 				dom_prefix = "xray_";
 			}
-			opt.set("type", dom_prefix === "singbox_" ? "sing-box" : "Xray");
+			opt.set('type', dom_prefix == "singbox_" ? "sing-box" : "Xray");
 
 			opt.set(dom_prefix + 'protocol', "vless");
 			opt.set(dom_prefix + 'uuid', password);
@@ -1606,8 +1573,8 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "hysteria2" || ssu[0] === "hy2") {
-			var m = parseNodeUrl(ssrurl);
+		if (link_type === "hysteria2" || link_type === "hy2") {
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1672,13 +1639,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "tuic") {
+		if (link_type === "tuic") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "tuic");
-			var _parsedUrl = new URL("http://" + ssu[1]);
+			var _parsedUrl = new URL("http://" + link_split[1]);
 			var username = _parsedUrl.username;
 			var password = _parsedUrl.password;
 			var hostname = _parsedUrl.hostname;
@@ -1721,13 +1688,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "anytls") {
+		if (link_type === "anytls") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "anytls");
-			var m = parseNodeUrl(ssrurl);
+			var m = parseNodeUrl(link);
 			var password = m.passwd;
 			if (password === "") {
 				s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
@@ -1777,13 +1744,13 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(m.hash.substr(1)));
 			}
 		}
-		if (ssu[0] === "naive+https" || ssu[0] === "naive+quic") {
+		if (link_type === "naive+https" || link_type === "naive+quic") {
 			if (has_singbox) {
-				dom_prefix = "singbox_"
+				dom_prefix = "singbox_";
 				opt.set('type', "sing-box");
 			}
 			opt.set(dom_prefix + 'protocol', "naive");
-			var _parsedUrl = new URL("http://" + ssu[1]);
+			var _parsedUrl = new URL("http://" + link_split[1]);
 			var username = _parsedUrl.username;
 			var password = _parsedUrl.password;
 			var hostname = _parsedUrl.hostname;
@@ -1818,7 +1785,7 @@ local current_node = map:get(section)
 			opt.set(dom_prefix + 'tls_serverName', queryParam.sni || '');
 			opt.set(dom_prefix + 'ech', !!queryParam.ech);
 			opt.set(dom_prefix + 'ech_config', queryParam.ech || '');
-			if (ssu[0] === "naive+quic") {
+			if (link_type === "naive+quic") {
 				opt.set(dom_prefix + 'naive_quic', true);
 				opt.set(dom_prefix + 'naive_congestion_control', queryParam.congestion_control || 'bbr');
 			}
@@ -1826,20 +1793,25 @@ local current_node = map:get(section)
 				opt.set('remarks', decodeURIComponent(hash.substr(1)));
 			}
 		}
-		if (dom_prefix && dom_prefix != null) {
-			const port = opt.get(dom_prefix + 'port');
-			if (!port) {
-				return false;
-			}
-			if (port.value) {
-				port.focus();
-				port.blur();
-			}
-		} else {
+
+		if (switch_type) {
+			sessionStorage.setItem("fromUrl", JSON.stringify({
+				timestamp: Date.now(),
+				savetime: 60 * 1000,
+				link: link
+			}));
+			opt.set("type", switch_type);
+			return
+		}
+		if (!dom_prefix) {
 			s.innerHTML = "<font color='red'><%:Invalid Share URL Format%></font>";
 			sessionStorage.removeItem("fromUrl");
 			return false;
 		}
+		if (opt.get(dom_prefix + 'port')) {
+			opt.get(dom_prefix + 'port').focus();
+			opt.get(dom_prefix + 'port').blur();
+		}
 		s.innerHTML = "<font color='green'><%:Import Finished %></font>";
 		sessionStorage.removeItem("fromUrl");
 		return true;
@@ -1849,17 +1821,6 @@ local current_node = map:get(section)
 		window.open('<%=api.url("gen_client_config")%>?id=' + sid, "_blank")
 	}
 
-	document.addEventListener("DOMContentLoaded", function () {
-		setTimeout(function () {
-			const fromUrlCache = JSON.parse(sessionStorage.getItem("fromUrl"));
-			if (fromUrlCache && fromUrlCache.savetime && (Date.now() - fromUrlCache.timestamp) < fromUrlCache.savetime) {
-				fromUrl(null, fromUrlCache.urlname, fromUrlCache.sid, fromUrlCache)
-			} else {
-				sessionStorage.removeItem("fromUrl");
-			}
-		}, 500);
-	})
-
 //]]></script>
 <style>
 .share-toolbar {
@@ -1892,7 +1853,7 @@ local current_node = map:get(section)
 <div class="share-toolbar">
 	<div class="toolbar-buttons">
 		<% if not current_node.protocol or not current_node.protocol:find("^_") then -%>
-		<input id="fromUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:From Share URL%>' onclick="return fromUrl(this, '<%=self.option%>', '<%=self.value%>')" />
+		<input id="fromUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:From Share URL%>' onclick="return tofromUrl()" />
 		<input id="exportUrlBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:Build Share URL%>' onclick="return exportUrl(this, '<%=self.option%>', '<%=self.value%>')" />
 		<input id="genQrcodeBtn" type="button" class="btn cbi-button cbi-button-apply" value='<%:Generate QRCode%>' onclick="return genQrcode(this, '<%=self.option%>', '<%=self.value%>')" />
 		<% end -%>

luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm

@@ -5,20 +5,21 @@ local appname = map.config
 local is_js_luci = api.is_js_luci()
 local section_tag = is_js_luci and "div" or "fieldset"
 
-local default_node_type = ""
 local shunt_rule_list = {}
 local node = map:get("@global[0]", "node")
 if node then
-	local node_type = map:get(node, "type")
 	local node_protocol = map:get(node, "protocol")
-	if (node_type == "Xray" or node_type == "sing-box") and node_protocol == "_shunt" then
-		default_node_type = node_protocol
+	if node_protocol == "_shunt" then
 		local node_shunt_group = map:get(node, "shunt_group")
 		map:foreach("shunt_rules", function(e)
 			if e[".name"] and e.remarks and e.group == node_shunt_group then
 				shunt_rule_list[#shunt_rule_list + 1] = e
 			end
 		end)
+		shunt_rule_list[#shunt_rule_list + 1] = {
+			[".name"] = "default_node",
+			remarks = translate("Default")
+		}
 	end
 end
 -%>
@@ -1671,14 +1672,13 @@ table td, .table .td {
 					<input class="btn cbi-button" type="button" onclick="set_node_div.set('@global[0]', 'node')" value="<%:OK%>" />
 				</div>
 			</div>
-			<% if default_node_type == "_shunt" then %>
+			<% if #shunt_rule_list > 0 then %>
 			<div id="set_node_shunt_div" style="margin: 0.5em 0; padding: 0.5em; background: #f7f7f7; border-radius: 4px;">
 				<div class="cbi-section-descr" style="text-align: left;"><a style="color:#FF8C00"><%:Set as the routing rule node:%></a></div>
 				<div>
 				<% for i, v in ipairs(shunt_rule_list) do %>
 					<input class="btn cbi-button" type="button" onclick="set_node_div.set('<%=node%>', '<%=v[".name"]%>')" value="<%=v.remarks%>" />
 				<% end %>
-					<input class="btn cbi-button" type="button" onclick="set_node_div.set('<%=node%>', 'default_node')" value="<%:Default%>" />
 				</div>
 			</div>
 			<% end %>

luci-app-passwall2/Makefile

@@ -6,8 +6,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.9.9
-PKG_RELEASE:=118
+PKG_VERSION:=26.9.12
+PKG_RELEASE:=119
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/1_sing-box.lua

@@ -668,7 +668,8 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "socks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
-	
+	o:depends({ protocol = "http", tls = true })
+
 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })
 	

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/2_xray.lua

@@ -213,7 +213,11 @@ o:depends({ protocol = "trojan" })
 -- [[ REALITY ]] --
 o = s:option(Flag, "reality", translate("REALITY"))
 o.default = 0
-o:depends({ tls = true })
+o:depends({ tls = true, transport = "raw" })
+o:depends({ tls = true, transport = "ws" })
+o:depends({ tls = true, transport = "grpc" })
+o:depends({ tls = true, transport = "httpupgrade" })
+o:depends({ tls = true, transport = "xhttp" })
 
 o = s:option(Value, "reality_private_key", translate("Private Key"))
 o:depends({ reality = true })

luci-app-passwall2/luasrc/passwall2/util_sing-box.lua

@@ -502,9 +502,9 @@ function gen_outbound(flag, node, tag, proxy_table)
 				obfs = node.hysteria_obfs,
 				auth = (node.hysteria_auth_type == "base64") and node.hysteria_auth_password or nil,
 				auth_str = (node.hysteria_auth_type == "string") and node.hysteria_auth_password or nil,
-				recv_window_conn = tonumber(node.hysteria_recv_window_conn),  --1.14 将变更为 stream_receive_window
-				recv_window = tonumber(node.hysteria_recv_window),  --1.14 将变更为 connection_receive_window
-				disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 将变更为 disable_path_mtu_discovery
+				stream_receive_window = tonumber(node.hysteria_recv_window_conn),
+				connection_receive_window = tonumber(node.hysteria_recv_window),
+				disable_path_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 				tls = tls
 			}
 		end
@@ -931,10 +931,10 @@ function gen_config_server(node)
 			down_mbps = tonumber(node.hysteria_down_mbps),
 			obfs = node.hysteria_obfs,
 			users = users,
-			recv_window_conn = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil, --1.14 to stream_receive_window
-			recv_window_client = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil, --1.14 to connection_receive_window
-			max_conn_client = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,  --1.14 to max_concurrent_streams
-			disable_mtu_discovery = (node.hysteria_disable_mtu_discovery == "1") and true or false,  --1.14 to disable_path_mtu_discover
+			stream_receive_window = node.hysteria_recv_window_conn and tonumber(node.hysteria_recv_window_conn) or nil,
+			connection_receive_window = node.hysteria_recv_window_client and tonumber(node.hysteria_recv_window_client) or nil,
+			max_concurrent_streams = node.hysteria_max_conn_client and tonumber(node.hysteria_max_conn_client) or nil,
+			disable_path_mtu_discover = (node.hysteria_disable_mtu_discovery == "1") and true or false,
 			tls = tls
 		}
 	end

luci-app-passwall2/luasrc/passwall2/util_xray.lua

@@ -131,6 +131,10 @@ function gen_outbound(flag, node, tag, proxy_table)
 			node.stream_security = "tls"
 		end
 
+		if node.protocol == "http" and node.stream_security == "tls" then
+			node.transport = "raw"
+		end
+
 		if remarks then
 			tag = tag .. ":" .. remarks
 		end
@@ -148,7 +152,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 				concurrency = (node.mux == "1" and ((node.mux_concurrency) and tonumber(node.mux_concurrency) or -1)) or nil,
 				xudpConcurrency = (node.mux == "1" and ((node.xudp_concurrency) and tonumber(node.xudp_concurrency) or 8)) or nil
 			} or nil,
-			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria") and {
+			streamSettings = (node.streamSettings or dialer_proxy_tag or node.protocol == "vmess" or node.protocol == "vless" or node.protocol == "socks" or node.protocol == "shadowsocks" or node.protocol == "trojan" or node.protocol == "hysteria" or node.protocol == "http") and {
 				sockopt = {
 					mark = 255,
 					domainStrategy = node.domain_strategy or "UseIP",
@@ -552,7 +556,7 @@ function gen_config_server(node)
 			allowTransparent = false,
 			users = users
 		}
-		node.transport = "tcp"
+		node.transport = "raw"
 		node.tcp_guise = "none"
 	elseif node.protocol == "shadowsocks" then
 		settings = {

luci-app-passwall2/root/usr/share/passwall2/nftables.sh

@@ -818,7 +818,7 @@ add_firewall_rule() {
 
 	# jump chains
 	# Only TCP, UDP Invalid.
-	nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv4 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept"
+	nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv4 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept comment PSW2_SOCKET"
 	nft "add rule $NFTABLE_NAME mangle_prerouting ip daddr != @$NFTSET_DIRECT ip protocol udp counter jump PSW2_MANGLE"
 	[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME mangle_prerouting ip daddr != @$NFTSET_DIRECT ip protocol tcp counter jump PSW2_MANGLE"
 
@@ -889,7 +889,7 @@ add_firewall_rule() {
 	# jump chains
 	[ "$PROXY_IPV6" == "1" ] && {
 		# Only TCP, UDP Invalid.
-		nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv6 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept"
+		nft "add rule $NFTABLE_NAME mangle_prerouting meta nfproto ipv6 meta l4proto tcp socket transparent 1 mark set ${FWMARK} counter accept comment PSW2_SOCKET"
 		nft "add rule $NFTABLE_NAME mangle_prerouting ip6 daddr != @$NFTSET_DIRECT6 meta nfproto {ipv6} counter jump PSW2_MANGLE_V6"
 		nft "add rule $NFTABLE_NAME mangle_output ip6 daddr != @$NFTSET_DIRECT6 meta nfproto {ipv6} counter jump PSW2_OUTPUT_MANGLE_V6 comment \"PSW2_OUTPUT_MANGLE\""
 

luci-app-ssr-plus/Makefile

@@ -4,7 +4,7 @@ LUCI_TITLE:=luci-app-ssr-plus
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=196
-PKG_RELEASE:=68
+PKG_RELEASE:=69
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Iptables_Transparent_Proxy \
@@ -32,7 +32,7 @@ LUCI_PKGARCH:=all
 LUCI_DEPENDS:= \
 	+libuci-lua +lua +luci-compat +coreutils +coreutils-base64 +dns2tcp +dnsmasq-full \
 	+jq +ip-full +lua-neturl +libuci-lua +microsocks +ipt2socks +lyaml \
-	+resolveip +curl +nping +unzip +xz-utils +xz \
+	+resolveip +bind-dig +curl +nping +unzip +xz-utils +xz \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Xray:xray-core \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Xray:coreutils-timeout \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Http_Proxy:3proxy \

luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client.lua

@@ -5,24 +5,27 @@
 local m, s, sec, o
 local uci = require "luci.model.uci".cursor()
 local URL = require "url"
+local sys = require "luci.sys"
+local util = require "luci.util"
+local datatypes = require "luci.cbi.datatypes"
 
 -- 获取 LAN IP 地址
 function lanip()
 	local lan_ip
 
 	-- 尝试从 UCI 直接读取
-	lan_ip = luci.sys.exec("uci -q get network.lan.ipaddr 2>/dev/null | awk -F'/' '{print $1}' | tr -d '\\n'")
+	lan_ip = sys.exec("uci -q get network.lan.ipaddr 2>/dev/null | awk -F'/' '{print $1}' | tr -d '\\n'")
 
 	-- 尝试从 LAN 接口信息中读取（优先 ifname，再 fallback 到 device）
 	if not lan_ip or lan_ip == "" then
-		lan_ip = luci.sys.exec([[
+		lan_ip = sys.exec([[
 ip -4 addr show $(uci -q -p /tmp/state get network.lan.device || uci -q -p /tmp/state get network.lan.device) 2>/dev/null \
   | grep -w 'inet' | awk '{print $2}' | cut -d'/' -f1 | grep -v '^127\.' | head -n1 | tr -d '\n']])
 	end
 
 	-- 取任意一个 global IPv4 地址
 	if not lan_ip or lan_ip == "" then
-		lan_ip = luci.sys.exec([[
+		lan_ip = sys.exec([[
 ip -4 addr show scope global 2>/dev/null \
   | grep -w 'inet' | awk '{print $2}' | cut -d'/' -f1 | grep -v '^127\.' | head -n1 | tr -d '\n']])
 	end
@@ -31,10 +34,9 @@ ip -4 addr show scope global 2>/dev/null \
 end
 
 local lan_ip = lanip()
-local validation = require "luci.cbi.datatypes"
 local clash_nodes = {}
 local function is_finded(e)
-	return luci.sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
+	return sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
 end
 
 local function clash_display_name(s)
@@ -48,6 +50,28 @@ local function clash_display_name(s)
 	return "[CLASH]"
 end
 
+local function is_valid_dns(str)
+	if datatypes.ip4addrport(str) then
+		return true
+	end
+
+	local scheme, target = str:match("^([a-zA-Z0-9%+%-%.]+)://(.+)$")
+	if scheme and target and #target > 0 then
+		return true
+	end
+
+	local host = str:match("^([^:]+):%d+$") or str
+	if host:match("[a-zA-Z]") 
+	   and not host:match("[^%w%.%-]") 
+	   and not host:match("^[%.%-]") 
+	   and not host:match("[%.%-]$") 
+	   and not host:match("%.%.") then
+		return true
+	end
+
+	return false
+end
+
 m = Map("shadowsocksr", translate("ShadowSocksR Plus+ Settings"), translate("<h3>Support SS/SSR/V2RAY/XRAY/TROJAN/TUIC/HYSTERIA2/NAIVEPROXY/SOCKS5/CLASH etc.</h3>"))
 m:section(SimpleSection).template = "shadowsocksr/status"
 
@@ -131,7 +155,7 @@ o:value("7", translate("Prefer module built-in DNS"))
 o:value("0", translate("Use Local DNS Service listen port 5335"))
 o.default = 1
 
-o = s:option(Value, "tunnel_forward", translate("Anti-pollution DNS Server"))
+o = s:option(Value, "dns2tcp_tunnel_forward", translate("Anti-pollution DNS Server"))
 o:value("8.8.4.4:53", translate("Google Public DNS (8.8.4.4)"))
 o:value("8.8.8.8:53", translate("Google Public DNS (8.8.8.8)"))
 o:value("208.67.222.222:53", translate("OpenDNS (208.67.222.222)"))
@@ -144,11 +168,55 @@ o:value("4.2.2.3:53", translate("Level 3 Public DNS (4.2.2.3)"))
 o:value("4.2.2.4:53", translate("Level 3 Public DNS (4.2.2.4)"))
 o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)"))
 o:depends("pdnsd_enable", "1")
-o:depends("pdnsd_enable", "7")
 o.description = translate("Custom DNS Server format as IP:PORT (default: 8.8.4.4:53)")
 o.datatype = "ip4addrport"
 o.default = "8.8.4.4:53"
 
+o = s:option(Value, "tunnel_forward", translate("Anti-pollution DNS Server"))
+o:value("8.8.4.4:53", translate("Google Public DNS (8.8.4.4)"))
+o:value("8.8.8.8:53", translate("Google Public DNS (8.8.8.8)"))
+o:value("208.67.222.222:53", translate("OpenDNS (208.67.222.222)"))
+o:value("208.67.220.220:53", translate("OpenDNS (208.67.220.220)"))
+o:value("209.244.0.3:53", translate("Level 3 Public DNS (209.244.0.3)"))
+o:value("209.244.0.4:53", translate("Level 3 Public DNS (209.244.0.4)"))
+o:value("4.2.2.1:53", translate("Level 3 Public DNS (4.2.2.1)"))
+o:value("4.2.2.2:53", translate("Level 3 Public DNS (4.2.2.2)"))
+o:value("4.2.2.3:53", translate("Level 3 Public DNS (4.2.2.3)"))
+o:value("4.2.2.4:53", translate("Level 3 Public DNS (4.2.2.4)"))
+o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)"))
+o:depends("pdnsd_enable", "7")
+o.datatype = nil
+o.description =
+	"<ul>" ..
+	"<li>" .. translate("Custom DNS Server (supports format IP:PORT, domain name, or scheme://...).") .. "</li>" ..
+	"<li>" .. translate("Muitiple DNS server can saperate with ','") .. "</li>" ..
+	"<li>" .. translate("Note: IP addresses MUST specify a port.") .. "</li>" ..
+	"</ul>"
+o.default = "8.8.4.4:53"
+o.validate = function(self, value, section)
+	if section and value and value ~= "" then
+		local parts = {}
+		for part in (value .. ","):gmatch("(.-),") do
+			part = part:gsub("^%s*", ""):gsub("%s*$", "")
+			if part ~= "" then
+				if not is_valid_dns(part) then
+					return nil, translate("Expecting: %s"):format(translate("IP:PORT, Domain, or Protocol URL (e.g. 8.8.8.8:53, dns.google, https://...).") ..
+						"<br>".. translate("Note: Pure IP without port is not allowed."))
+				end
+				table.insert(parts, part)
+			end
+		end
+
+		if #parts > 0 then
+			return table.concat(parts, ",")
+		end
+
+		return nil, translate("Expecting: %s"):format(translate("valid address:port")) -- 有效的地址:端口
+	end
+
+	return value
+end
+
 o = s:option(Value, "tunnel_forward_mosdns", translate("Anti-pollution DNS Server"))
 o:value("tcp://8.8.4.4:53,tcp://8.8.8.8:53", translate("Google Public DNS"))
 o:value("tcp://208.67.222.222:53,tcp://208.67.220.220:53", translate("OpenDNS"))
@@ -225,7 +293,7 @@ if is_finded("chinadns-ng") then
 				local parts = {}
 				for part in string.gmatch(value, "[^,]+") do
 					part = part:gsub("^%s*", ""):gsub("%s*$", "")
-					if not validation.ip4addrport(part) then
+					if not datatypes.ip4addrport(part) then
 						return nil, translate("Expecting: %s"):format(translate("valid address:port (comma separated)"))
 					end
 					table.insert(parts, part)
@@ -236,7 +304,7 @@ if is_finded("chinadns-ng") then
 				return table.concat(parts, ",")
 			end
 
-			if validation.ip4addrport(value) then
+			if datatypes.ip4addrport(value) then
 				return value
 			end
 

luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/control.lua

@@ -1,8 +1,11 @@
 require "luci.ip"
 require "nixio.fs"
 require "luci.sys"
+local ucic = luci.model.uci.cursor()
 local m, s, o
 
+local enable_mihomo = ucic:get_first('shadowsocksr', 'server_subscribe', 'enable_mihomo') or ''
+
 m = Map("shadowsocksr")
 
 s = m:section(TypedSection, "access_control")
@@ -116,7 +119,7 @@ o.rows = 13
 o.wrap = "off"
 o.rmempty = true
 o.cfgvalue = function(self, section)
-	return nixio.fs.readfile(denydomainconf) or " "
+	return nixio.fs.readfile(denydomainconf) or ""
 end
 o.write = function(self, section, value)
 	nixio.fs.writefile(denydomainconf, value:gsub("\r\n", "\n"))
@@ -125,6 +128,54 @@ o.remove = function(self, section, value)
 	nixio.fs.writefile(denydomainconf, "")
 end
 
+if enable_mihomo == "1" then
+	s:tab("fake_ip_filter", translate("Fake-IP Filter and Fallback Lists"))
+	local fake_ip_filter_conf = "/etc/ssrplus/fake_ip_filter.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fake_ip_filter_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fake-IP filter list.") .. "</font>") -- 专用于编辑 Fake-IP 过滤规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fake_ip_filter_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fake_ip_filter_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fake_ip_filter_conf, "")
+	end
+
+	local fallback_ipcidr_conf = "/etc/ssrplus/fallback_ipcidr.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fallback_ipcidr_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fallback IP-CIDR list.") .. "</font>") -- 专用于编辑 Fallback IP-CIDR 规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fallback_ipcidr_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fallback_ipcidr_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fallback_ipcidr_conf, "")
+	end
+
+	local fallback_domain_conf = "/etc/ssrplus/fallback_domain.list"
+	o = s:taboption("fake_ip_filter", TextValue, "fallback_domain_conf", "", "<font style=color:red>" .. translate("Specifically for editing the Fallback domain filter list.") .. "</font>") -- 专用于编辑 Fallback 域名过滤规则文件。
+	o.rows = 13
+	o.wrap = "off"
+	o.rmempty = true
+	o.cfgvalue = function(self, section)
+		return nixio.fs.readfile(fallback_domain_conf) or ""
+	end
+	o.write = function(self, section, value)
+		nixio.fs.writefile(fallback_domain_conf, value:gsub("\r\n", "\n"))
+	end
+	o.remove = function(self, section, value)
+		nixio.fs.writefile(fallback_domain_conf, "")
+	end
+end
+
 if luci.sys.call('[ -f "/www/luci-static/resources/uci.js" ]') == 0 then
 	m.apply_on_parse = true
 	function m.on_apply(self)

luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/servers.lua

@@ -188,9 +188,10 @@ local function save_uploaded_clash_node(upload_name, final_path)
 	local alias
 
 	if not sid then
-		sid = uci:add("shadowsocksr", "servers")
+		local sid_output = luci.sys.exec("uci add shadowsocksr servers 2>/dev/null")
+		sid = trim(sid_output)
 	end
-	if not sid then
+	if not sid or sid == "" then
 		return nil
 	end
 
@@ -200,20 +201,50 @@ local function save_uploaded_clash_node(upload_name, final_path)
 		alias = upload_alias(upload_name)
 	end
 
-	uci:set("shadowsocksr", sid, "type", "clash")
-	uci:set("shadowsocksr", sid, "alias", alias)
-	uci:set("shadowsocksr", sid, "server", "127.0.0.1")
-	uci:set("shadowsocksr", sid, "server_port", "0")
-	uci:delete("shadowsocksr", sid, "clash_url")
-	uci:set("shadowsocksr", sid, "clash_path", final_path)
-	uci:set("shadowsocksr", sid, "clash_user_agent", uci:get("shadowsocksr", sid, "clash_user_agent") or "clash")
-	if not uci:get("shadowsocksr", sid, "switch_enable") then
-		uci:set("shadowsocksr", sid, "switch_enable", uci:get_first("shadowsocksr", "server_subscribe", "switch", "1") or "1")
+	local switch_enable = uci:get("shadowsocksr", sid, "switch_enable")
+	if not switch_enable or switch_enable == "" then
+		switch_enable = uci:get_first("shadowsocksr", "server_subscribe", "switch", "1") or "1"
+	end
+
+	local clash_user_agent = uci:get("shadowsocksr", sid, "clash_user_agent")
+	if not clash_user_agent or clash_user_agent == "" then
+		clash_user_agent = "clash"
+	end
+
+	local safe_sid = luci.util.shellquote(sid)
+	local safe_alias = luci.util.shellquote(alias)
+	local safe_path = luci.util.shellquote(final_path)
+	local safe_upload_name = luci.util.shellquote(upload_name)
+	local safe_switch_enable = luci.util.shellquote(switch_enable)
+	local safe_user_agent = luci.util.shellquote(clash_user_agent)
+
+	local cmd = string.format(
+		"uci set shadowsocksr.%s.type=clash && " ..
+		"uci set shadowsocksr.%s.alias=%s && " ..
+		"uci set shadowsocksr.%s.server=127.0.0.1 && " ..
+		"uci set shadowsocksr.%s.server_port=0 && " ..
+		"uci delete shadowsocksr.%s.clash_url 2>/dev/null; " ..
+		"uci set shadowsocksr.%s.clash_path=%s && " ..
+		"uci set shadowsocksr.%s.clash_user_agent=%s && " ..
+		"uci set shadowsocksr.%s.switch_enable=%s && " ..
+		"uci set shadowsocksr.%s.yaml_upload=1 && " ..
+		"uci set shadowsocksr.%s.yaml_upload_name=%s && " ..
+		"uci commit shadowsocksr",
+		safe_sid,
+		safe_sid, safe_alias,
+		safe_sid,
+		safe_sid,
+		safe_sid,
+		safe_sid, safe_path,
+		safe_sid, safe_user_agent,
+		safe_sid, safe_switch_enable,
+		safe_sid,
+		safe_sid, safe_upload_name
+	)
+
+	if luci.sys.call(cmd) ~= 0 then
+		return nil
 	end
-	uci:set("shadowsocksr", sid, "yaml_upload", "1")
-	uci:set("shadowsocksr", sid, "yaml_upload_name", upload_name)
-	uci:save("shadowsocksr")
-	uci:commit("shadowsocksr")
 
 	cleanup_old_clash_path(old_path, final_path, sid)
 	luci.sys.call(string.format("/etc/init.d/shadowsocksr clash_cache %s >/dev/null 2>&1 &", luci.util.shellquote(sid)))
@@ -267,32 +298,48 @@ if has_mihomo then
 			local tmp_output = string.format("%s/.upload-%d-%d.yaml", CLASH_YAML_DIR, nixio.getpid(), os.time())
 			local sid
 			local alias
+			local redirect_message_url
 
 			nixio.fs.mkdirr(CLASH_YAML_DIR)
 			nixio.fs.remove(tmp_output)
 			if preprocess_clash_yaml(upload_tmp_path, tmp_output) then
 				hash = hash_file(tmp_output)
-				if hash == "" then
-					nixio.fs.remove(tmp_output)
+				if not hash or hash == "" then
 					upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
 				else
 					final_path = string.format("%s/%s.yaml", CLASH_YAML_DIR, hash)
-					luci.sys.call(string.format("mv -f %s %s", luci.util.shellquote(tmp_output), luci.util.shellquote(final_path)))
-					sid, alias = save_uploaded_clash_node(upload_filename, final_path)
-					if sid then
-						upload_message = string.format(translate("Custom YAML imported successfully: %s"), alias or sid)
+					local mv_ret = luci.sys.call(string.format("mv -f %s %s", luci.util.shellquote(tmp_output), luci.util.shellquote(final_path)))
+					if mv_ret == 0 and nixio.fs.access(final_path) then
+						sid, alias = save_uploaded_clash_node(upload_filename, final_path)
+						if sid then
+							local message = string.format(translate("Custom YAML imported successfully: %s"), alias or sid)
+							local redirect_url = luci.dispatcher.build_url("admin", "services", "shadowsocksr", "servers")
+							redirect_message_url = redirect_url .. "?upload_message=" .. luci.http.urlencode(message)
+						else
+							upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+							if final_path and nixio.fs.access(final_path) then
+								nixio.fs.remove(final_path)
+							end
+						end
 					else
-						upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+						upload_errmessage = translate("Failed to move uploaded YAML to target directory.")
 					end
 				end
 			else
-				nixio.fs.remove(tmp_output)
-				upload_errmessage = translate("Uploaded YAML validation or preprocessing failed.")
+				upload_errmessage = upload_errmessage or translate("Uploaded YAML validation or preprocessing failed.")
 			end
-		end
 
-		if upload_tmp_path then
-			nixio.fs.remove(upload_tmp_path)
+			if upload_tmp_path and nixio.fs.access(upload_tmp_path) then
+				nixio.fs.remove(upload_tmp_path)
+			end
+			if tmp_output and nixio.fs.access(tmp_output) then
+				nixio.fs.remove(tmp_output)
+			end
+
+			if redirect_message_url then
+				luci.http.redirect(redirect_message_url)
+				return
+			end
 		end
 	end
 end
@@ -407,8 +454,11 @@ end
 m = Map("shadowsocksr", translate("Servers subscription and manage"))
 if upload_errmessage then
 	m.errmessage = upload_errmessage
-elseif upload_message then
-	m.message = upload_message
+else
+	local message = luci.http.formvalue("upload_message")
+	if message and message ~= "" then
+		m.message = message
+	end
 end
 
 local style_section = m:section(SimpleSection)
@@ -566,6 +616,29 @@ if has_mihomo then
 	o.rmempty = true
 	o.description = translate("Disabled means use Xray or ShadowSocks-Rust core.")
 
+	o = s:option(Flag, "enable_fake_ip", string.format("<b><span style='color:red;'>%s</span></b>", translate("Enable Fake-IP Mode")))
+	o.default = "0"
+	o.rmempty = true
+	o:depends("enable_mihomo", "1")
+	o.description = translate(
+		"<ul>" ..
+		"<li>" .. translate("Enable Fake-IP mode; disable to use redir-host mode.") .. "</li>" ..
+		"<li>" .. translate("Enable Fake-IP mode for better performance.") .. "</li>" ..
+		"<li>" .. translate("If disabled, Redir-Host mode will be used which returns real IP addresses.") .. "</li>" ..
+		"<li>" .. translate("Tips: Fake-IP Filter and Fallback Lists:") .. " " ..
+		"<span id='fake_ip_filter_control_link'></span>" ..
+		"<script type='text/javascript'>" ..
+			"(function() {" ..
+				"var url = '" .. luci.dispatcher.build_url("admin", "services", "shadowsocksr", "control") .. "?tab=fake_ip_filter#fake_ip_filter';" ..
+				"var linkText = '<font style=\"color:green\"><b>" .. translate("Click here to manage") .. "</b></font>';" ..
+				"var elem = document.getElementById('fake_ip_filter_control_link');" ..
+				"if (elem) elem.innerHTML = '<a href=\"' + url + '\">' + linkText + '</a>';" ..
+			"})();" ..
+		"</script>" ..
+		"</li>" ..
+		"</ul>"
+	)
+
 	o = s:option(Flag, "sub_convert", translate("Subscribe Convert Online"))
 	o.description = translate("Convert subscriptions to Clash/Mihomo YAML with a subscription template URL.")
 	o.default = "0"

luci-app-ssr-plus/luasrc/view/shadowsocksr/clash_yaml_upload.htm

@@ -1,4 +1,4 @@
 <%+cbi/valueheader%>
 	<input class="cbi-input-file" style="width: 400px" type="file" id="clash_yaml_file" name="clash_yaml_file" accept=".yaml,.yml" />
-	<input type="submit" class="cbi-button cbi-input-apply" name="upload_clash_yaml" value="<%:Upload%>" />
+	<input type="submit" class="bt cbi-button cbi-input-apply" name="upload_clash_yaml" value="<%:Upload%>" />
 <%+cbi/valuefooter%>

luci-app-ssr-plus/root/etc/init.d/shadowsocksr

@@ -608,6 +608,7 @@ prepare_clash_runtime_config() {
 	local dns_mode
 	local client_policy_stats
 	local client_rules
+	local enable_fake_ip
 
 	cache_file="$(get_clash_cache_file "$sid")"
 	workdir="$(get_clash_workdir "$sid")"
@@ -623,6 +624,7 @@ prepare_clash_runtime_config() {
 	dns_mode="$(uci_get_by_type global pdnsd_enable 0)"
 	client_policy_stats=""
 	client_rules=0
+	enable_fake_ip="$(uci_get_by_type server_subscribe enable_fake_ip "")"
 
 	[ -s "$cache_file" ] || return 1
 
@@ -640,15 +642,33 @@ prepare_clash_runtime_config() {
 		routing-mark: $CLASH_OUTBOUND_MARK
 		profile:
 		  store-selected: true
+		  store-fake-ip: true
 		tun:
 		  enable: false
-		dns:
-		  enable: $( [ "$dns_mode" = "7" ] && echo "true" || echo "false" )
-		  enhanced-mode: redir-host
-		  listen: 127.0.0.1:$dns_port
-		  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
 	EOF
 
+	# 根据 dns_mode 添加不同的 dns 配置
+	if [ "$dns_mode" = "7" ]; then
+		# 根据 enable_fake_ip 决定 enhanced-mode
+		if [ "$enable_fake_ip" = "1" ]; then
+			ENHANCED_MODE="fake-ip"
+		else
+			ENHANCED_MODE="redir-host"
+		fi
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: true
+			  enhanced-mode: $ENHANCED_MODE
+			  listen: 127.0.0.1:$dns_port
+			  ipv6: $( [ "$dns_ipv4_only" = "1" ] && echo "false" || echo "true" )
+		EOF
+	else
+		cat >> "$overlay_file" <<-EOF
+			dns:
+			  enable: false
+		EOF
+	fi
+
 	if [ -n "$socks_port" ] && [ "$socks_port" != "0" ]; then
 		echo "socks-port: $socks_port" >>"$overlay_file"
 	fi
@@ -1230,14 +1250,24 @@ start_dns() {
 	ssrplus_dns="$(uci_get_by_type global pdnsd_enable 0)"
 	global_server_type="$(uci_get_by_name "$GLOBAL_SERVER" type)"
 	builtin_dns_enabled=0
-	dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
 
 	if [ "$ssrplus_dns" = "5" ]; then
 		ssrplus_dns="$(force_dns2tcp_fallback "旧版 DNSPROXY 模式已移除")" || return 1
 		uci_set_by_type global pdnsd_enable "$ssrplus_dns"
-	elif [ "$ssrplus_dns" = "6" ]; then
-		dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
 	fi
+	case "$ssrplus_dns" in
+		1)
+			dnsserver="$(uci_get_by_type global dns2tcp_tunnel_forward 8.8.4.4:53)"
+		;;
+		6)
+			dnsserver="$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)"
+		;;
+		7)
+			dnsserver="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
+		;;
+		*)
+			;;
+	esac
 	run_mode="$(normalize_run_mode)"
 
 	if [ "$ssrplus_dns" = "4" ] && ! is_finded "mosdns"; then
@@ -1503,15 +1533,15 @@ generate_xray_config() {
 		{
 			"log": {
 				"loglevel": "warning"
-		},
-		"inbounds": [$inbound_json],
-		"outbounds": [
-			{
-				"protocol": "freedom",
-				"settings": {}
-			}
-		]
-	}
+			},
+			"inbounds": [$inbound_json],
+			"outbounds": [
+				{
+					"protocol": "freedom",
+					"settings": {}
+				}
+			]
+		}
 	EOF
 	return 0
 }
@@ -2887,12 +2917,18 @@ start_rules() {
 	local ac_ips
 	local custom_ports
 	local proxyport
+	local enable_fake_ip
 
 	server=$(get_host_ip "$GLOBAL_SERVER")
 	local_port=$(get_default_node_local_port)
 	lan_ac_ips=$(uci_get_by_type access_control lan_ac_ips)
 	lan_ac_mode=$(uci_get_by_type access_control lan_ac_mode)
 
+	enable_fake_ip=$(uci_get_by_type server_subscribe enable_fake_ip "")
+	if [ -z "$enable_fake_ip" ]; then
+		enable_fake_ip="0"
+	fi
+
 	if [ "$kcp_enable_flag" = "0" ] && [ "$redir_udp" = "1" ]; then
 		udp_server=$(get_host_ip "$UDP_RELAY_SERVER")
 		udp_local_port=$tmp_udp_port
@@ -2937,26 +2973,27 @@ start_rules() {
 		fi
 	elif [ "$USE_TABLES" = "iptables" ]; then
 		ARG_A=""
-		fi
-		/usr/share/shadowsocksr/gfw2ipset.sh
-		/usr/bin/ssr-rules \
-			-s "$server" \
-			-l "$local_port" \
-			-S "$udp_server" \
-			-L "$udp_local_port" \
-			-a "$ac_ips" \
-			-i "/etc/ssrplus/china_ssr.txt" \
-			-b "$(uci_get_by_type access_control wan_bp_ips)" \
-			-w "$(uci_get_by_type access_control wan_fw_ips)" \
-			-B "$(uci_get_by_type access_control lan_bp_ips)" \
-			-p "$(uci_get_by_type access_control lan_fp_ips)" \
-			-G "$(uci_get_by_type access_control lan_gm_ips)" \
-			-m "$(uci_get_by_type access_control Interface)" \
-			-D "$proxyport" \
-			"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"
+	fi
+	/usr/share/shadowsocksr/gfw2ipset.sh
+	/usr/bin/ssr-rules \
+		-s "$server" \
+		-l "$local_port" \
+		-S "$udp_server" \
+		-L "$udp_local_port" \
+		-a "$ac_ips" \
+		-i "/etc/ssrplus/china_ssr.txt" \
+		-b "$(uci_get_by_type access_control wan_bp_ips)" \
+		-w "$(uci_get_by_type access_control wan_fw_ips)" \
+		-B "$(uci_get_by_type access_control lan_bp_ips)" \
+		-p "$(uci_get_by_type access_control lan_fp_ips)" \
+		-G "$(uci_get_by_type access_control lan_gm_ips)" \
+		-m "$(uci_get_by_type access_control Interface)" \
+		-D "$proxyport" \
+		-E "$enable_fake_ip" \
+		"$(get_arg_out)" "$(gfwmode)" "$ARG_UDP" "$ARG_UDP_RULES" "$ARG_A"
 
-		return $?
-	}
+	return $?
+}
 
 start() {
 	local run_mode

luci-app-ssr-plus/root/etc/ssrplus/fake_ip_filter.list

@@ -0,0 +1,78 @@
+*.lan
+*.localdomain
+*.example
+*.invalid
+*.localhost
+*.test
+*.local
+*.home.arpa
+time.*.com
+time.*.gov
+time.*.edu.cn
+time.*.apple.com
+time1.*.com
+time2.*.com
+time3.*.com
+time4.*.com
+time5.*.com
+time6.*.com
+time7.*.com
+ntp.*.com
+ntp1.*.com
+ntp2.*.com
+ntp3.*.com
+ntp4.*.com
+ntp5.*.com
+ntp6.*.com
+ntp7.*.com
+*.time.edu.cn
+*.ntp.org.cn
++.pool.ntp.org
+time1.cloud.tencent.com
+stun.*.*
+stun.*.*.*
+swscan.apple.com
+mesu.apple.com
+music.163.com
+*.music.163.com
+*.126.net
+musicapi.taihe.com
+music.taihe.com
+songsearch.kugou.com
+trackercdn.kugou.com
+*.kuwo.cn
+api-jooxtt.sanook.com
+api.joox.com
+y.qq.com
+*.y.qq.com
+streamoc.music.tc.qq.com
+mobileoc.music.tc.qq.com
+isure.stream.qqmusic.qq.com
+dl.stream.qqmusic.qq.com
+aqqmusic.tc.qq.com
+amobile.music.tc.qq.com
+localhost.ptlogin2.qq.com
+*.msftconnecttest.com
+*.msftncsi.com
+*.xiami.com
+*.music.migu.cn
+music.migu.cn
++.wotgame.cn
++.wggames.cn
++.wowsgame.cn
++.wargaming.net
+*.*.*.srv.nintendo.net
+*.*.stun.playstation.net
+xbox.*.*.microsoft.com
+*.*.xboxlive.com
+*.ipv6.microsoft.com
+teredo.*.*.*
+teredo.*.*
+speedtest.cros.wr.pvp.net
++.jjvip8.com
+www.douyu.com
+activityapi.huya.com
+activityapi.huya.com.w.cdngslb.com
+www.bilibili.com
+api.bilibili.com
+a.w.bilicdn1.com

luci-app-ssr-plus/root/etc/ssrplus/fallback_domain.list

@@ -0,0 +1,9 @@
++.google.com
++.facebook.com
++.youtube.com
++.twitter.com
++.telegram.org
++.githubusercontent.com
++.googlevideo.com
++.msftconnecttest.com
++.msftncsi.com

luci-app-ssr-plus/root/etc/ssrplus/fallback_ipcidr.list

@@ -0,0 +1,15 @@
+0.0.0.0/8
+10.0.0.0/8
+100.64.0.0/10
+127.0.0.0/8
+169.254.0.0/16
+172.16.0.0/12
+192.0.0.0/24
+192.0.2.0/24
+192.88.99.0/24
+192.168.0.0/16
+198.51.100.0/24
+203.0.113.0/24
+224.0.0.0/4
+240.0.0.0/4
+255.255.255.255/32

luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus

@@ -47,6 +47,18 @@ if [ -s "/etc/config/shadowsocksr" ]; then
         uci -q set shadowsocksr.@server_subscribe[0].auto_update_min_time='0'
     fi
 
+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_mihomo > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_mihomo='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].enable_fake_ip > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].enable_fake_ip='1'
+    fi
+
+    if ! uci -q get shadowsocksr.@server_subscribe[0].sub_convert > /dev/null; then
+        uci -q set shadowsocksr.@server_subscribe[0].sub_convert='1'
+    fi
+
     if ! uci -q get shadowsocksr.@server_subscribe[0].config_auto_update_mode > /dev/null; then
         uci -q set shadowsocksr.@server_subscribe[0].config_auto_update_mode='0'
     fi

luci-app-ssr-plus/root/usr/bin/ssr-rules

@@ -46,6 +46,7 @@ CHECK_STATUS=0
 RESTORE_RULES=0
 FLUSH_RULES=0
 CLEANUP_PERSISTENCE=0
+ENABLE_FAKE_IP=0
 # ASCII code for SSRP.Use whatever,just not the same.
 FWMARK="0x53535250"
 
@@ -83,14 +84,15 @@ usage() {
 		    -m <Interface>          Interface name
 		    -I <ip_list_file>       a file content is bypassed shunt ip list
 		    -e <extra_options>      extra options for iptables
+		    -E <0|1>				enable_fake_ip status
 		    -o                      apply the rules to the OUTPUT chain
 		    -O                      apply the global rules to the OUTPUT chain
-			    -u                      enable udprelay mode, TPROXY is required
-			    -U                      enable udprelay mode, using different IP
-			                            and ports for TCP and UDP
-			    -y                      disable all auxiliary UDP rules when UDP
-			                            transparent proxy is unavailable
-			    -f                      flush the rules
+		    -u                      enable udprelay mode, TPROXY is required
+		    -U                      enable udprelay mode, using different IP
+			                        and ports for TCP and UDP
+		    -y                      disable all auxiliary UDP rules when UDP
+			                        transparent proxy is unavailable
+		    -f                      flush the rules
 		    -g                      gfwlist mode
 		    -r                      router mode
 		    -z                      all mode
@@ -232,6 +234,12 @@ cleanup_persistence_files() {
 		loger 5 "Removed xhttp hash file: /tmp/.last_xhttp_hash"
 	fi
 
+	# Remove Fake_IP Mode state file
+	if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+		rm -f "$ENABLE_FAKE_IP_STATE_FILE" 2>/dev/null
+		loger 5 "Removed Fake_IP Mode state file: $ENABLE_FAKE_IP_STATE_FILE"
+	fi
+
 	loger 5 "Persistence cleanup completed"
 	return 0
 }
@@ -315,25 +323,64 @@ flush_nftables() {
 
 flush_iptables_legacy() {
 	flush_iptables() {
-		local ipt="iptables -t $1"
-		local DAT=$(iptables-save -t $1)
-		eval $(echo "$DAT" | grep "$TAG" | sed -e 's/^-A/$ipt -D/' -e 's/$/;/')
-		for chain in $(echo "$DAT" | awk '/^:SS_SPEC/{print $1}'); do
-			$ipt -F ${chain:1} 2>/dev/null && $ipt -X ${chain:1}
+		local table=$1
+		local ipt="iptables -t $table"
+		local DAT
+
+		DAT=$(iptables-save -t $table 2>/dev/null)
+
+		[ -z "$DAT" ] && return 0
+
+		# 1. 解除所有引用 SS_SPEC* 链的规则
+		echo "$DAT" | grep -E "^-A .*SS_SPEC" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
 		done
+
+		# 2. 删除带 TAG 或 mark 的残留规则（同样加上 eval）
+		echo "$DAT" | grep -E "^-A " | grep -E "$TAG|-m mark|--mark" | while read -r line; do
+			local chain rule
+			chain=$(echo "$line" | awk '{print $2}')
+			rule=$(echo "$line" | sed 's/^-A [^ ]* //')
+			[ -n "$chain" ] && [ -n "$rule" ] && \
+				eval "$ipt -D \"$chain\" $rule 2>/dev/null"
+		done
+
+		# 3. 提取所有以 SS_SPEC 开头的自定义链
+		local chains
+		chains=$(echo "$DAT" | awk '/^:SS_SPEC/{sub(/^:/,"",$1); print $1}')
+
+		# 4. 清空并彻底删除 SS_SPEC* 自定义链
+		for chain in $chains; do
+			$ipt -F "$chain" 2>/dev/null
+			$ipt -X "$chain" 2>/dev/null
+		done
+
+		return 0
 	}
+
+	# 依次对 nat 和 mangle 表执行清理
 	flush_iptables nat
 	flush_iptables mangle
-	if ip rule show | grep -Eq "fwmark ${FWMARK}.*lookup 999"; then
+
+	# 清理策略路由与路由表
+	if ip rule show | grep -Eiq "fwmark ${FWMARK}.*lookup 999"; then
 		ip rule del fwmark ${FWMARK} table 999 2>/dev/null
 	fi
 	if ip route show table 999 | grep -Eq "^local.*dev lo"; then
 		ip route del local 0.0.0.0/0 dev lo table 999 2>/dev/null
 	fi
+
+	# 清理 IPSET 集合（先 -F 清空，后 -X 销毁）
 	for setname in ss_spec_lan_ac ss_spec_wan_ac ssr_gen_router \
 			china fplan bplan gmlan whitelist blacklist gfwlist music; do
+		ipset -F $setname 2>/dev/null
 		ipset -X $setname 2>/dev/null
 	done
+
 	[ -n "$FWI" ] && echo '#!/bin/sh' >$FWI
 	return 0
 }
@@ -524,6 +571,11 @@ fw_rule() {
 }
 
 fw_rule_nft() {
+	# 优先将 Fake-IP (198.18.0.0/16) 的 TCP 流量重定向至代理端口
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule inet ss_spec ss_spec_wan_fw ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+	fi
+
 	# redirect/translation: when PROXY_PORTS present, redirect those tcp ports to local_port
 	if [ -n "$PROXY_PORTS" ]; then
 		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
@@ -559,6 +611,10 @@ fw_rule_iptables() {
 		$IPT -A SS_SPEC_WAN_FW -d "$net" -j RETURN
 	done
 
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$IPT -A SS_SPEC_WAN_FW -d 198.18.0.0/16 -p tcp -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+	fi
+
 	$IPT -A SS_SPEC_WAN_FW -p tcp $PROXY_PORTS -j REDIRECT --to-ports "$local_port" 2>/dev/null || {
 		loger 3 "Can't redirect TCP, please check the iptables."
 		exit 1
@@ -611,6 +667,33 @@ ac_rule_nft() {
 	fi
 	$NFT flush chain inet ss_spec ss_spec_prerouting 2>/dev/null
 
+	# Fake-IP 重定向处理 (引入 Interface 匹配，防止 WAN 口越权)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			else
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+				$NFT add rule inet ss_spec ss_spec_prerouting ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			fi
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 $MATCH_SET meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					else
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+						$NFT add rule inet ss_spec ss_spec_prerouting meta iifname "$IFNAME" ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+					fi
+				fi
+			done
+		fi
+	fi
+
 	# Exclude special local addresses
 	if $NFT list chain inet ss_spec ss_spec_prerouting >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
@@ -625,16 +708,6 @@ ac_rule_nft() {
 	#	done
 	#fi
 
-	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
-	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
-		fi
-	else
-		TCP_EXT_ARGS="meta l4proto tcp"
-	fi
-
 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
 		# Add UDP 443 block rule
@@ -658,6 +731,17 @@ ac_rule_nft() {
 			done
 		fi
 	fi
+
+	# Build a rule in the prerouting hook chain that jumps to business chain with conditions
+	if [ -n "$PROXY_PORTS" ]; then
+		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		if [ -n "$PORTS_ARGS" ]; then
+			TCP_EXT_ARGS="meta l4proto tcp tcp dport { $PORTS_ARGS }"
+		fi
+	else
+		TCP_EXT_ARGS="meta l4proto tcp"
+	fi
+
 	if [ -z "$Interface" ]; then
 		# generic prerouting jump already exists (see ipset_nft), but if we have MATCH_SET_CONDITION we add a more specific rule
 		if [ -n "$MATCH_SET" ]; then
@@ -683,11 +767,16 @@ ac_rule_nft() {
 	case "$OUTPUT" in
 	1)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -708,11 +797,16 @@ ac_rule_nft() {
 		;;
 	2)
 		# Create ss_spec_output tcp chain
-			if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
-				$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
-			fi
-			$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
-			$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+		if ! $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
+			$NFT add chain inet ss_spec ss_spec_output '{ type nat hook output priority 0; policy accept; }'
+		fi
+		$NFT flush chain inet ss_spec ss_spec_output 2>/dev/null
+		$NFT add rule inet ss_spec ss_spec_output meta mark 255 return 2>/dev/null
+
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto tcp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+			$NFT add rule inet ss_spec ss_spec_output ip daddr 198.18.0.0/16 meta l4proto udp redirect to :$local_port comment "\"$TAG\"" 2>/dev/null
+		fi
 		
 		# Exclude special local addresses
 		if $NFT list chain inet ss_spec ss_spec_output >/dev/null 2>&1; then
@@ -754,11 +848,38 @@ ac_rule_iptables() {
 			return 2
 			;;
 		esac
+
+		local ip_list="${LAN_AC_IP#?}"
+		ipset -! create ss_spec_lan_ac hash:net 2>/dev/null
+		ipset flush ss_spec_lan_ac 2>/dev/null
+		if [ -n "$ip_list" ]; then
+			for ip in $ip_list; do
+				ipset add ss_spec_lan_ac "$ip" 2>/dev/null
+			done
+		fi
+	fi
+
+	# 2. PREROUTING 链处理
+	if [ -z "$Interface" ]; then
+		# Global rules
+		if [ -n "$MATCH_SET" ]; then
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
+	else
+		for name in $Interface; do
+			local IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+			if [ -n "$IFNAME" ]; then
+				if [ -n "$MATCH_SET" ]; then
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				else
+					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+				fi
+			fi
+		done
 	fi
-	ipset -! -R <<-EOF || return 1
-		create ss_spec_lan_ac hash:net
-		$(for ip in ${LAN_AC_IP#?}; do echo "add ss_spec_lan_ac $ip"; done)
-	EOF
 
 	# Block UDP port 443 when TPROXY not Enable
 	if [ -z "$TPROXY" ] && [ "$DISABLE_UDP_RULES" != "1" ]; then
@@ -784,42 +905,67 @@ ac_rule_iptables() {
 			done
 		fi
 	fi
-	if [ -z "$Interface" ]; then
-		# Global rules
-		if [ -n "$MATCH_SET" ]; then
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		else
-			$IPT -I PREROUTING 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-		fi
-	else
-		for name in $Interface; do
-			local IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
-			[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
-			if [ -n "$IFNAME" ]; then
-				if [ -n "$MATCH_SET" ]; then
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS $MATCH_SET -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				else
-					$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
-				fi
+
+	# 拦截 Fake-IP 流量 (198.18.0.0/16)，受 Interface 和 LAN_AC 控制
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		if [ -z "$Interface" ]; then
+			if [ -n "$MATCH_SET" ]; then
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			else
+				$IPT -I PREROUTING 1 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+				$IPT -I PREROUTING 2 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
 			fi
-		done
+		else
+			for name in $Interface; do
+				local IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				[ -z "$IFNAME" ] && IFNAME=$(uci -P /var/state get network."$name".device 2>/dev/null)
+				if [ -n "$IFNAME" ]; then
+					if [ -n "$MATCH_SET" ]; then
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 $MATCH_SET -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					else
+						$IPT -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+						$IPT -I PREROUTING 2 ${IFNAME:+-i $IFNAME} -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+					fi
+				fi
+			done
+		fi
 	fi
 
 	case "$OUTPUT" in
 	1)
-		$IPT -I OUTPUT 1 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp $EXT_ARGS -m comment --comment "$TAG" -j SS_SPEC_WAN_AC
+		fi
 		;;
 	2)
 		ipset -! -R <<-EOF || return 1
 			create ssr_gen_router hash:net
 			$(gen_spec_iplist | sed -e "s/^/add ssr_gen_router /")
 		EOF
-			$IPT -N SS_SPEC_ROUTER 2>/dev/null
-			$IPT -F SS_SPEC_ROUTER 2>/dev/null
-			$IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN && \
-			$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
-		$IPT -I OUTPUT 1 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		$IPT -N SS_SPEC_ROUTER 2>/dev/null
+		$IPT -F SS_SPEC_ROUTER 2>/dev/null
+		# $IPT -A SS_SPEC_ROUTER -m mark --mark 255 -j RETURN
+		$IPT -A SS_SPEC_ROUTER -m set --match-set ssr_gen_router dst -j RETURN
+		$IPT -A SS_SPEC_ROUTER -j SS_SPEC_WAN_FW
+		# fake-ip first
+		if [ "$ENABLE_FAKE_IP" = "1" ]; then
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 3 -p udp -d 198.18.0.0/16 -j REDIRECT --to-ports "$local_port" -m comment --comment "$TAG"
+			$IPT -I OUTPUT 4 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		else
+			$IPT -I OUTPUT 1 -m mark --mark 255 -j RETURN 2>/dev/null
+			$IPT -I OUTPUT 2 -p tcp -m comment --comment "$TAG" -j SS_SPEC_ROUTER
+		fi
 		;;
 	esac
 	return $?
@@ -855,29 +1001,29 @@ tp_rule_nft() {
 	fi
 
 	local MATCH_SET=""
+	local EXT_ARGS=""
 
 	if [ -n "$PROXY_PORTS" ]; then
-		PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
-		if [ -n "$PORTS_ARGS" ]; then
-			EXT_ARGS="udp dport { $PORTS_ARGS }"
-		else
-			EXT_ARGS=""
-		fi
+		local PORTS_ARGS=$(echo "$PROXY_PORTS" | sed 's/-m multiport --dports //')
+		[ -n "$PORTS_ARGS" ] && EXT_ARGS="udp dport { $PORTS_ARGS }"
 	fi
 
 	if [ -n "$LAN_AC_IP" ]; then
 		# Create LAN access control set if needed
+		local mode="${LAN_AC_IP:0:1}"
+		local ips="${LAN_AC_IP:1}"
+
 		if ! $NFT list set ip ss_spec_mangle ss_spec_lan_ac >/dev/null 2>&1; then
 			$NFT add set ip ss_spec_mangle ss_spec_lan_ac '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		else
 			$NFT flush set ip ss_spec_mangle ss_spec_lan_ac 2>/dev/null
 		fi
 
-		for ip in ${LAN_AC_IP#?}; do
+		for ip in $ips; do
 			[ -n "$ip" ] && $NFT add element ip ss_spec_mangle ss_spec_lan_ac "{ $ip }" 2>/dev/null
 		done
 
-		case "${LAN_AC_IP%${LAN_AC_IP#?}}" in
+		case "$mode" in
 		w | W)
 			MATCH_SET="ip saddr @ss_spec_lan_ac"
 			;;
@@ -906,8 +1052,10 @@ tp_rule_nft() {
 	fi
 
 	# Bulk import xhttp ip list into nft whitelist (server + shunt)
-	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
-		$NFT add element ip ss_spec_mangle whitelist "{ $(tr '\n' ',' < "${xhttp_ip}" | sed 's/,$//') }" 2>/dev/null
+	local xhttp_file="${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}"
+	if [ -s "$xhttp_file" ]; then
+		local xhttp_content=$(tr '\n' ',' < "$xhttp_file" | sed 's/,$//')
+		[ -n "$xhttp_content" ] && $NFT add element ip ss_spec_mangle whitelist "{ $xhttp_content }" 2>/dev/null
 	fi
 
 	# use priority mangle for compatibility with other rules
@@ -917,6 +1065,12 @@ tp_rule_nft() {
 		$NFT flush chain ip ss_spec_mangle ss_spec_tproxy 2>/dev/null
 	fi
 
+	# 优先对 Fake-IP 进行 TPROXY 重定向 (无需受限于 PROXY_PORTS 限制)
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr 198.18.0.0/16 counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
+	fi
+
+	# Exclude special local addresses
 	if $NFT list chain ip ss_spec_mangle ss_spec_tproxy >/dev/null 2>&1; then
 		for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
 			$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr $net return 2>/dev/null
@@ -934,9 +1088,9 @@ tp_rule_nft() {
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport 53 return 2>/dev/null
 
 	# avoid redirecting to udp server address
-	if [ -n "$server" ]; then
-		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
-	fi
+	# if [ -n "$server" ]; then
+	# 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp dport != 53 ip daddr "$server" return 2>/dev/null
+	# fi
 
 	# if server != SERVER add SERVER to whitelist set (so tproxy won't touch it)
 	if [ -n "$server" ]; then
@@ -946,6 +1100,9 @@ tp_rule_nft() {
 		$NFT add element ip ss_spec_mangle whitelist "{ $SERVER }" 2>/dev/null
 	fi
 
+	# 显式豁免白名单集合中的 IP
+	$NFT add rule ip ss_spec_mangle ss_spec_tproxy ip daddr @whitelist return 2>/dev/null
+
 	# access control and tproxy rules
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @bplan return 2>/dev/null
 	$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip saddr @fplan counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -965,7 +1122,9 @@ tp_rule_nft() {
 
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @ss_spec_wan_ac return 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr != @ss_spec_wan_ac counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -975,7 +1134,9 @@ tp_rule_nft() {
 			$NFT add set ip ss_spec_mangle gfwlist '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null
 		fi
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip daddr @china return 2>/dev/null
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 80 counter drop comment "\"$TAG\"" 2>/dev/null
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp udp dport 443 counter drop comment "\"$TAG\"" 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp $EXT_ARGS ip daddr @gfwlist counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
 		$NFT add rule ip ss_spec_mangle ss_spec_tproxy meta l4proto udp ip saddr @gmlan ip daddr != @china counter tproxy ip to :"$LOCAL_PORT" meta mark set ${FWMARK} 2>/dev/null
@@ -988,6 +1149,8 @@ tp_rule_nft() {
 	# finally, ensure prerouting hook entry to jump to tproxy chain
 	if ! $NFT list chain ip ss_spec_mangle prerouting >/dev/null 2>&1; then
 		$NFT add chain ip ss_spec_mangle prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
+	else
+		$NFT flush chain ip ss_spec_mangle prerouting 2>/dev/null
 	fi
 
 	# add prerouting jump (idempotent)
@@ -1056,8 +1219,14 @@ tp_rule_iptables() {
 	do
 		$ipt -A SS_SPEC_TPROXY -p udp -d "$net" -j RETURN
 	done
+	# fake-ip 规则
+	if [ "$ENABLE_FAKE_IP" = "1" ]; then
+		$ipt -A SS_SPEC_TPROXY -p udp $MATCH_SET -d 198.18.0.0/16 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	fi
+
 	[ -n "$SERVER" ] && $ipt -A SS_SPEC_TPROXY -p udp ! --dport 53 -d "$SERVER" -j RETURN
 	[ -n "$SERVER" ] && [ "$server" != "$SERVER" ] && ipset -! add whitelist "$SERVER"
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set whitelist dst -j RETURN
 	if [ -f "${xhttp_ip:=/etc/ssrplus/xhttp_address.txt}" ]; then
 		while IFS= read -r ip; do
 			[ -n "$ip" ] && ipset add whitelist "$ip" -exist
@@ -1065,6 +1234,7 @@ tp_rule_iptables() {
 	fi
 	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set bplan src -j RETURN
 	$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set fplan src -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+	$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set blacklist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 	case "$RUNMODE" in
 	router)
 		ipset -! -R <<-EOF || return 1
@@ -1073,15 +1243,27 @@ tp_rule_iptables() {
 		EOF
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set ss_spec_wan_ac dst -j RETURN
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp -m set ! --match-set china dst --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set ! --match-set ss_spec_wan_ac dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
 	gfw)
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set china dst -j RETURN
+		# 80 端口规则：非国内 IP 的 80 端口，走 TPROXY
 		$ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j DROP
-		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP 
+		# 443 端口规则：非国内 IP 的 443 端口，走 TPROXY
+		$ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j DROP
+		# 保留海外 QUIC 代理
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 80 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
+		# $ipt -A SS_SPEC_TPROXY -p udp --dport 443 -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set gfwlist dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		$ipt -A SS_SPEC_TPROXY -p udp -m set --match-set gmlan src -m set ! --match-set china dst -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark ${FWMARK}
 		;;
@@ -1463,7 +1645,7 @@ restore_from_persistence() {
 	fi
 }
 
-while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
+while getopts ":m:s:l:S:L:i:e:E:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	case "$arg" in
 	m)
 		Interface=$OPTARG
@@ -1486,6 +1668,9 @@ while getopts ":m:s:l:S:L:i:e:a:B:b:w:p:G:D:F:N:M:I:oOuUyfgrzAKPCRXh" arg; do
 	e)
 		EXT_ARGS=$OPTARG
 		;;
+	E)
+		ENABLE_FAKE_IP=$OPTARG
+		;;
 	a)
 		LAN_AC_IP=$OPTARG
 		;;
@@ -1689,6 +1874,14 @@ if [ -n "$local_port" ]; then
 
 	if [ "$USE_NFT" = "1" ]; then
 		# NFTables
+		# Detect Fake_IP Mode state change (execute first)
+		ENABLE_FAKE_IP_STATE_FILE="/tmp/.last_enable_fake_ip"
+		if [ -f "$ENABLE_FAKE_IP_STATE_FILE" ]; then
+			LAST_ENABLE_FAKE_IP=$(cat "$ENABLE_FAKE_IP_STATE_FILE")
+		else
+			LAST_ENABLE_FAKE_IP=""
+		fi
+
 		# Save previous TPROXY state file
 		TPROXY_STATE_FILE="/tmp/.last_tproxy"
 		if [ -f "$TPROXY_STATE_FILE" ]; then
@@ -1778,6 +1971,13 @@ if [ -n "$local_port" ]; then
 			LAST_XHTTP_FILE_HASH=""
 		fi
 
+		# Check if Fake_IP Mode state has changed
+		ENABLE_FAKE_IP_CHANGED=0
+		if [ "$LAST_ENABLE_FAKE_IP" != "$ENABLE_FAKE_IP" ]; then
+			loger 6 "Fake_IP Mode state changed: $LAST_ENABLE_FAKE_IP -> $ENABLE_FAKE_IP"
+			ENABLE_FAKE_IP_CHANGED=1
+		fi
+
 		# STEP 1: Check if TPROXY has value (1 or 2)
 		if [ "$TPROXY" = "1" ] || [ "$TPROXY" = "2" ]; then
 			TPROXY_HAS_VALUE=1
@@ -1873,7 +2073,9 @@ if [ -n "$local_port" ]; then
 		# 1. TPROXY changes from empty ↔ has value
 		# 2. PROXY_PORTS changes from empty ↔ has value
 		# 3. Any IP list has changed
-		if [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
+		# 4. ENABLE_FAKE_IP state changed
+		if [ "$ENABLE_FAKE_IP_CHANGED" = "1" ] || \
+		   [ "$TPROXY_HAS_VALUE" != "$LAST_HAS_VALUE" ] || \
 		   [ "$PROXY_HAS_VALUE" != "$LAST_PROXY_HAS_VALUE" ] || \
 		   [ "$ANY_IP_LIST_CHANGED" = "1" ]; then
 			FORCE_RECREATE=1
@@ -1891,6 +2093,7 @@ if [ -n "$local_port" ]; then
 		fi
 
 		# STEP 4: Save current state
+		echo "$ENABLE_FAKE_IP" > "$ENABLE_FAKE_IP_STATE_FILE"
 		echo "$TPROXY" > "$TPROXY_STATE_FILE"
 		echo "$PROXY_PORTS" > "$PROXY_PORTS_STATE_FILE"
 		echo "$(normalize_ip_list "$WAN_BP_IP")" > "$WAN_BP_IP_STATE_FILE"

luci-app-ssr-plus/root/usr/share/shadowsocksr/gen_config.lua

@@ -3,6 +3,7 @@
 require "luci.sys"
 local ucursor = require "luci.model.uci".cursor()
 local json = require "luci.jsonc"
+local datatypes = require "luci.cbi.datatypes"
 
 -- An omitted value reaches us either as a missing argument or as an empty
 -- string, depending on whether the caller quoted the expansion. Empty strings
@@ -181,6 +182,62 @@ local function format_host_port(host, port)
 	return host .. ":" .. tostring(port)
 end
 
+local function format_dns_server(proxy)
+	if not proxy or proxy == "" then
+		return proxy
+	end
+
+	local scheme, rest = proxy:match("^([a-zA-Z0-9%+%-%.]+)://(.+)$")
+	if scheme then
+		scheme = scheme:lower()
+		if scheme == "tls" or scheme == "dot" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":853"
+			end
+			return "tls://" .. rest
+		elseif scheme == "https" or scheme == "doh" or scheme == "dohl" or scheme == "doq" or scheme == "doql" then
+			local host, path = rest:match("^([^/]+)(.*)$")
+			host = host or rest
+			path = path or ""
+			if path == "" or path == "/" then
+				path = "/dns-query"
+			end
+			return "https://" .. host .. path
+		elseif scheme == "tcp" or scheme == "udp" then
+			if not rest:match(":%d+$") then
+				rest = rest .. ":53"
+			end
+			return scheme .. "://" .. rest
+		else
+			return proxy
+		end
+	end
+
+	local host, port = proxy:match("^([^:]+):(%d+)$")
+	if host and port then
+		if port == "853" then
+			return "tls://" .. host .. ":853"
+		elseif port == "443" then
+			return "https://" .. host .. "/dns-query"
+		elseif port == "53" then
+			return host -- 53 端口输出纯 IP / Host (如 8.8.4.4)
+		else
+			return "udp://" .. host .. ":" .. port
+		end
+	end
+
+	-- 确保包含字母，防止把 IP 当成域名
+	if proxy:match("[a-zA-Z]") and not proxy:match("[^%w%.%-]") then
+		local path = ""
+		if not proxy:match("/") then
+			path = "/dns-query"
+		end
+		return "https://" .. proxy .. path
+	end
+
+	return proxy
+end
+
 -- 确保正确判断程序是否存在
 local function is_finded(e)
 	return luci.sys.exec(string.format('type -t -p "%s" -p "/usr/libexec/%s" 2>/dev/null', e, e)) ~= ""
@@ -391,31 +448,141 @@ local Xray = {
 }
 
 if server.type == "v2ray" and dns_mode == "7" and os.getenv("SSR_SWITCH_PROBE") ~= "1" then
-	local dns_host = builtin_dns_server:match("^([^:]+)") or "8.8.4.4"
-	local dns_port = tonumber(builtin_dns_server:match(":(%d+)$")) or 53
+	local raw_servers_str = builtin_dns_server or "8.8.4.4:53"
 
+	local dns_servers = {}
+	local host_list = {}
+	local port_list = {}
+	local first_host = nil
+	local first_port = nil
+
+	-- 按逗号或空格分割多个 DNS 地址
+	for raw_server in string.gmatch(raw_servers_str, "[^,%s\r\n]+") do
+		if raw_server and raw_server ~= "" then
+			-- 1. 先进行格式化处理
+			local formatted = format_dns_server(raw_server)
+
+			local host = nil
+			local port = nil
+
+			-- 2. 解析 host 和对应的实际端口
+			if formatted:match("^https://") then
+				local target = formatted:match("^https://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 443
+				end
+			elseif formatted:match("^tls://") then
+				local target = formatted:match("^tls://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 853
+				end
+			elseif formatted:match("^tcp://") or formatted:match("^udp://") then
+				local target = formatted:match("^[a-zA-Z0-9%+%-%.]+://([^/]+)")
+				if target:match(":%d+$") then
+					host, port = target:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = target
+					port = 53
+				end
+			else
+				if formatted:match(":%d+$") then
+					host, port = formatted:match("^([^:]+):(%d+)$")
+					port = tonumber(port)
+				else
+					host = formatted
+					port = 53
+				end
+			end
+
+			-- 保存格式化后的 Xray.dns.servers 条目
+			table.insert(dns_servers, formatted)
+
+			-- 分别收集 Host 与 Port
+			if host and port then
+				table.insert(host_list, host)
+				table.insert(port_list, port)
+				-- 保存第一个 DNS 的 host 和 port
+				-- if not first_host then --dokodemo-door 入站的 address 单个地址使用。
+				-- 	first_host = host  --dokodemo-door 入站的 address 单个地址使用。
+				--	first_port = port  --dokodemo-door 入站的 address 单个地址使用。
+				-- end
+			end
+		end
+	end
+
+	-- 如果没有有效的 DNS 服务器，使用默认值
+	if #dns_servers == 0 then
+		table.insert(dns_servers, "8.8.4.4")
+		table.insert(host_list, "8.8.4.4")
+		table.insert(port_list, 53)
+		-- first_host = "8.8.4.4" --dokodemo-door 入站的 address 单个地址使用。
+		-- first_port = 53 --dokodemo-door 入站的 address 单个地址使用。
+	end
+
+	-- 构建 dns 出站地址（支持逗号分隔的多个地址）
+	-- 检查所有 DNS 端口是否一致
+	--local outbound_address = "" --dokodemo-door 入站的 address 单个地址使用。
+	local all_same_port = true
+	local common_port = port_list[1]
+	for i = 2, #port_list do
+		if port_list[i] ~= common_port then
+			all_same_port = false
+			break
+		end
+	end
+
+	-- 根据端口一致性计算 address 与 target_port
+	local address_str = ""
+	local target_port = 0
+
+	if all_same_port then
+		-- outbound_address = table.concat(host_list, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(host_list, ",")
+		target_port = common_port
+	else
+		local combined = {}
+		for i = 1, #host_list do
+			table.insert(combined, string.format("%s:%d", host_list[i], port_list[i]))
+		end
+		-- outbound_address = table.concat(combined, ",") --dokodemo-door 入站的 address 单个地址时使用。
+		address_str = table.concat(combined, ",")
+		target_port = 0
+	end
+	
+	-- 构建 Xray.dns 配置
 	Xray.dns = {
 		queryStrategy = (dns_ipv4_only == "1") and "UseIPv4" or "UseIP",
-		servers = {
-			string.format("tcp://%s:%d", dns_host, dns_port)
-		}
+		servers = dns_servers
 	}
 
+	-- 构建 dokodemo-door 入站
 	table.insert(Xray.inbounds, {
 		listen = "127.0.0.1",
 		port = 5335,
 		protocol = "dokodemo-door",
 		settings = {
-			address = dns_host,
-			port = dns_port,
+			address = address_str,
+			-- address = first_host,        -- 单个地址
+			port = target_port,
+			-- port = first_port,           -- 对应端口
 			network = "tcp,udp"
 		},
 		tag = "builtin-dns-in"
 	})
-
+	
 	xray_builtin_dns = {
-		address = dns_host,
-		port = dns_port
+		address = address_str,
+		-- address = outbound_address, --dokodemo-door 入站的 address 单个地址时使用。
+		port = target_port
 	}
 end
 	-- 传入连接

luci-app-ssr-plus/root/usr/share/shadowsocksr/shadowsocksr.config

@@ -27,6 +27,9 @@ config server_subscribe
 	option auto_update_week_time '*'
 	option auto_update_day_time '2'
 	option auto_update_min_time '0'
+	option enable_mihomo '1'
+	option enable_fake_ip '1'
+	option sub_convert '1'
 	option url_test_url 'https://www.google.com/generate_204'
 	option user_agent 'v2rayN/9.99'
 	option filter_words '过期/重置/套餐/剩余/网址/QQ群/官网/防失联/回国'

luci-app-wwand/Makefile

@@ -17,12 +17,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-wwand
-PKG_VERSION:=1.6.6_p3
-PKG_RELEASE:=18
+PKG_VERSION:=1.6.6_p7
+PKG_RELEASE:=19
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/luci-app-wwand.git
-PKG_SOURCE_VERSION:=4676454a1a8356de565fc02e44f66a6813c66b09
+PKG_SOURCE_VERSION:=ef4b59a891229d189ad5167def96eab22a5ceb03
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only
@@ -80,8 +80,8 @@ endef
 # luci-app-statistics. A new resource has to be added here, and that is the
 # point of listing them.
 LUCI_WWAND_VIEW:=modems.js settings.js status.js
-LUCI_WWAND_RES:=bands.js esim.js format.js graph.js mccmnc.js modemopts.js \
-	modemsid.js netsel.js rpc.js signal.svg simlist.js
+LUCI_WWAND_RES:=bands.js esim.js format.js graph.js logbox.js mccmnc.js \
+	modemopts.js modemsid.js netsel.js rpc.js signal.svg simlist.js
 
 define Package/luci-app-wwand/install
 	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/wwand

luci-app-xray-status/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-xray-status
 PKG_VERSION:=3.7.2
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_LICENSE:=MPLv2
 PKG_LICENSE_FILES:=LICENSE

luci-app-xray-status/root/usr/share/rpcd/acl.d/luci-app-xray-status.json

@@ -15,4 +15,4 @@
             }
         }
     }
-}
+}

luci-app-xray/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-xray
 PKG_VERSION:=3.7.2
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 
 PKG_LICENSE:=MPLv2
 PKG_LICENSE_FILES:=LICENSE

luci-app-xray/root/usr/share/xray/gen_config.uc

@@ -205,12 +205,14 @@ function rules(proxy, bridge, manual_tproxy, extra_inbound, fakedns) {
                 domain: blocked_domain_rules(proxy),
             });
         }
-        splice(result, 0, 0, {
-            type: "field",
-            inboundTag: [...tproxy_tcp_inbound_v4_tags, ...tproxy_udp_inbound_v4_tags, ...tproxy_tcp_inbound_v6_tags, ...tproxy_udp_inbound_v6_tags, ...extra_inbound_global_tcp_tags, ...extra_inbound_global_udp_tags],
-            outboundTag: "direct",
-            domain: fast_domain_rules(proxy)
-        });
+        if (length(fast_domain_rules(proxy)) > 0) {
+            splice(result, 0, 0, {
+                type: "field",
+                inboundTag: [...tproxy_tcp_inbound_v4_tags, ...tproxy_udp_inbound_v4_tags, ...tproxy_tcp_inbound_v6_tags, ...tproxy_udp_inbound_v6_tags, ...extra_inbound_global_tcp_tags, ...extra_inbound_global_udp_tags],
+                outboundTag: "direct",
+                domain: fast_domain_rules(proxy)
+            });
+        }
         if (proxy["direct_bittorrent"] == "1") {
             splice(result, 0, 0, {
                 type: "field",

luci-theme-footstrap/Makefile

@@ -17,7 +17,7 @@ LUCI_NAME:=luci-theme-footstrap
 FOOTSTRAP_VERSION?=
 ifneq ($(FOOTSTRAP_VERSION),)
 PKG_VERSION:=$(FOOTSTRAP_VERSION)
-PKG_RELEASE:=69
+PKG_RELEASE:=70
 endif
 
 LUCI_TITLE:=Footstrap Theme

luci-theme-footstrap/htdocs/luci-static/resources/fs-fit.js

@@ -879,22 +879,28 @@ function anchorEnabled() {
  * reports zero and this does nothing. Same guards as the main correction — not while the reader
  * scrolls, not across a navigation, never more than a viewport. */
 let _lateFrame = 0;
+/* WHY THE LAST LATE CORRECTION DID OR DID NOT WRITE — an unmarked export for the sweep, the same
+ * shape and the same reason as `restAt()` and `engineTrusted()` beside it. `lateDrift()` has eight
+ * ways to return without writing, and from outside they are one symptom: `writes: []`. Three CI
+ * runs were spent guessing between them — whether the theme tried and missed, had no reference to
+ * try from, or read the engine as having already done the job — and each guess cost a push. One
+ * short string, set at every exit, ends that: the finding names the line instead of the silence. */
+let _lateWhy = null;
+function why(w) { _lateWhy = w; }
 
 function lateDrift(ref, grow, floorShrink) {
 	/* the reference from BEFORE this tick, captured by the caller: one taken after the mutation
 	 * describes the page as the mutation left it, so its drift is zero by construction */
-	if (_lateFrame || !ref) return;
+	if (_lateFrame) return why('busy');
+	if (!ref) return why('no-reference');
+	why('armed');
 	_lateFrame = requestAnimationFrame(() => {
 		const seen = scrollTop();
-		/* STILL FOR SCROLL_IDLE, the interval this file already calls a page nobody is scrolling.
-		 * A frame is not long enough to tell a flick from a still page: a flick moves the offset in
-		 * steps of tens of milliseconds and two rAFs (~16 ms) fall inside one step, so the offset
-		 * reads the same twice while the page is plainly moving. 120 ms was still short enough to
-		 * let one 160px correction through on a loaded runner. */
-		_lateFrame = window.setTimeout(() => {
+		const settle = () => {
 			_lateFrame = 0;
-			if (!anchorEnabled() || Date.now() < _userUntil) return;
-			if (_restPage !== pageStamp()) return;
+			if (!anchorEnabled()) return why('anchoring-off');
+			if (Date.now() < _userUntil) return why('reader-intent');
+			if (_restPage !== pageStamp()) return why('page-changed');
 			/* THE OFFSET, NOT THE EVENT STREAM. `scrolling()` cannot answer this one: the engine's
 			 * own compensation moves the offset and starts the motion sampler, so gating on it
 			 * skips every tick this exists for — and in WebKit a programmatic scroll's event
@@ -904,6 +910,11 @@ function lateDrift(ref, grow, floorShrink) {
 			 * moved since, and whatever this would put back they have already scrolled past. A
 			 * correction landing inside a flick is itself a jump (161px, webkit/Overview).
 			 *
+			 * The wait-length fork at the bottom of this function does consult `scrolling()`, and
+			 * it is not this rule loosened: it decides HOW LONG to wait, never WHETHER to write. A
+			 * tick the engine did move the offset for takes the long road and still arrives here,
+			 * where this same check is what answers.
+			 *
 			 * `ref.at` and not `_restAt`: run() re-remembers between the mutation and this frame,
 			 * and where the sampler has not started yet — WebKit again — that re-take records the
 			 * offset the reader has already flicked to, so comparing against it compares a value
@@ -913,12 +924,12 @@ function lateDrift(ref, grow, floorShrink) {
 			 * against 600px of growth — so an offset that merely differs is the engine working, and
 			 * refusing on that leaves the engine's own residual (58px) uncorrected. What must not be
 			 * touched is a page still in motion, which is asked directly instead. */
-			if (scrollTop() !== seen) return;
+			if (scrollTop() !== seen) return why('offset-moved');
 			/* the tick usually replaces the element this was taken on, so without the section
 			 * fallback the correction does nothing on the tick it exists for */
 			let el = ref.el, was = ref.top;
 			if (!el || !el.isConnected) {
-				if (!ref.sec || !ref.sec.isConnected || ref.secTop == null) return;
+				if (!ref.sec || !ref.sec.isConnected || ref.secTop == null) return why('reference-gone');
 				el = ref.sec; was = ref.secTop;
 			}
 			let drift = el.getBoundingClientRect().top - was;
@@ -984,7 +995,7 @@ function lateDrift(ref, grow, floorShrink) {
 					 * REPEAT's own mark never moved (misses [true,true,false]) — e0b6db4's fault on the
 					 * other side of the same comparison. */
 					rememberRest(true);
-					return;
+					return why('engine-partly-' + Math.round(compensated) + '-of-' + Math.round(grow));
 				}
 				/* else: within table-row rounding — drift is still whatever it was (< 1 per the guard
 				 * above), so the plain `drift < 1` return two lines down is what fires, unwritten and
@@ -1007,12 +1018,13 @@ function lateDrift(ref, grow, floorShrink) {
 				 * second of three back-to-back refills, unchanged — chromium/firefox/webkit alike,
 				 * `_engineTrusted` true throughout. */
 				if (grow > 1 || floorShrink > 1) rememberRest(true);
-				return;						/* the engine put it back */
+				return why('no-drift-grow-' + Math.round(grow));	/* the engine put it back */
 			}
-			if (Math.abs(drift) > (window.innerHeight || 800)) return;
+			if (Math.abs(drift) > (window.innerHeight || 800)) return why('drift-too-big');
 			const sc = scroller();
 			const at = sc ? sc.scrollTop : window.scrollY;
 			writeOffset(sc, at + drift);
+			why('wrote-' + Math.round(drift));
 			/* A FRESH, FORCED rememberRest(), not just `_restAt = scrollTop()` — task refill2. The
 			 * write moves the page by exactly the drift measured, so `_rest.top` still holds FOR THIS
 			 * TICK's own `el`, but `_rest` itself was taken by run() at the top of THIS callback,
@@ -1030,7 +1042,7 @@ function lateDrift(ref, grow, floorShrink) {
 			 * `force`, `moved 0, 0, 0` with it, both `trusted true` throughout). */
 			rememberRest(true);
 			/* A DROP IN THIS SAME BOX'S OWN FLOOR IS NOT EVIDENCE ABOUT THE ENGINE — task refill2. Every
-			 * `run()` clears and rewrites `r.target`'s `min-height`, and a WRITE to that property is a
+			 * `run()` clears and rewrites the floored box's `min-height`, and a WRITE to that property is a
 			 * scroll-anchor invalidation in its own right (`holdFloor()`'s own citation), independent of
 			 * how reliably this engine otherwise keeps a reference: a floored box whose content really
 			 * did shrink pays this cost on every engine, every time, structurally — counting it toward
@@ -1056,7 +1068,50 @@ function lateDrift(ref, grow, floorShrink) {
 			/* This engine did not keep the reference across a container refill, once more on this
 			 * page — see LATE_MISS_LIMIT above for what happens once that has been measured twice. */
 			if (++_lateMisses >= LATE_MISS_LIMIT) { _engineTrusted = false; _lateHits = 0; }
-		}, SCROLL_IDLE);
+		};
+		/* HOW LONG TO WAIT IS A QUESTION ABOUT THE READER, NOT A CONSTANT — task late419.
+		 *
+		 * STILL FOR SCROLL_IDLE is the answer where the page is, or might be, in motion: a frame is
+		 * not long enough to tell a flick from a still page by the offset alone, because a flick
+		 * moves it in steps of tens of milliseconds and two rAFs (~16ms) fall inside one step, so
+		 * the offset reads the same twice while the page is plainly moving. 120ms was still short
+		 * enough to let one 160px correction through on a loaded runner. That is unchanged, and it
+		 * is what every branch below still runs on.
+		 *
+		 * But a page the theme ALREADY KNOWS is still does not need to be asked again. `scrolling()`
+		 * is this file's own answer to "has anything moved the offset in the last SCROLL_IDLE",
+		 * sampled from the POSITION every frame rather than from the event stream, so it sees
+		 * momentum and rubber-banding that dispatch nothing (its own comment) — and `_userUntil` is
+		 * the reader's hand on the page: a `touchstart`, `wheel`, `mousedown` or `keydown` arrives
+		 * BEFORE the offset it is about to move, so a flick about to begin has already said so.
+		 * Where both answer "nobody is driving and nothing has moved", the only thing that can have
+		 * touched the offset since the reference was taken is the engine, whose own correction
+		 * window is measured at 7-36ms — not 400 — so the wait is the next frame and the same
+		 * `scrollTop() !== seen` check decides, exactly as it does on the long path. Two rAFs in
+		 * total, one apart: `settleDeferredFloor()`'s own shape, and for its stated reason — the
+		 * offset read twice a frame apart is the check, and the wait is only there to space the
+		 * two reads. A third frame was measured and is not bought: it costs 11-16ms of the
+		 * headroom under the gate's own `LATE_MS` and changes no reading — webkit 67/71/72ms
+		 * against 51/54/61ms on the same three stands, everything else identical.
+		 *
+		 * NEITHER GUARD ALONE WOULD DO, and that is the whole reason this is a pair. `_userUntil` is
+		 * a 400ms timer off the last EVENT, and iOS momentum carries the page long after the finger
+		 * has gone — the same fault `scrolling()` exists because of. And `scrolling()` alone would
+		 * write into the moment a finger is down on a page that has not moved yet. A synthetic flick
+		 * makes the first half concrete: `tools/scroll-anchor.mjs`'s QUIET drives its 24 steps by
+		 * assigning `scrollTop`, so it carries no intent event at all, and an intent-only gate would
+		 * take the short path straight through the middle of it.
+		 *
+		 * Measured (`tools/scroll-anchor.mjs`, the `engine DECLINES` cell this task added — the
+		 * engine ablated off while the theme still trusts it, which is the state CI caught 2 runs in
+		 * 3 and no local run ever): 404-422ms before, 8-61ms after, on nine cells — three engines
+		 * against three stands, `@1440 side compact overview`, the cell CI reported. The other two
+		 * cells of the same axis are untouched, which is the point: the engine-anchoring-on cell
+		 * corrects at 4-19ms (the engine's own work, which never reaches this path) and the
+		 * engine-OFF cell at 6-44ms (`applyAnchor()`, a different function). `mid-flick surprises`
+		 * reads 0 on all 27. */
+		if (!scrolling() && Date.now() >= _userUntil) _lateFrame = requestAnimationFrame(settle);
+		else _lateFrame = window.setTimeout(settle, SCROLL_IDLE);
 	});
 }
 
@@ -1270,12 +1325,35 @@ function observeContent() {
 		 * nothing on the distrusted path too, in the recovery check right below, so the read can no
 		 * longer be skipped there. One extra `records.find` and an `offsetHeight` per distrusted
 		 * tick — the one path that used to pay nothing here at all. */
-		const r = records.find((m) => m.type === 'childList' && m.target.hasAttribute('data-fs-floor'));
+		/* THE FLOORED BOX THE RECORD SITS IN, not only a record whose target IS one — task blindgrow.
+		 * `dom.content()` empties and refills the node it is handed, and that node is often a level
+		 * or two INSIDE the box `holdFloor()` pinned: measured live on Overview (webkit/owrtsnapb,
+		 * `../tmp/floorprobe.mjs`), of twelve nodes a poll refills on that page one sits inside a
+		 * floored box without wearing the mark itself. For those the old `m.target.hasAttribute`
+		 * matched nothing, `grew` read 0, and a `lateDrift()` whose element-based `drift` was ALSO
+		 * blind — `anchorRef()` having hit-tested something the growth never reached — concluded
+		 * there was nothing to correct and wrote nothing at all. That is the `writes: []`,
+		 * `corrected never` shape CI reported on `webkit owrtsnap @1440 side compact overview` in
+		 * three runs of three while every local run of the same cell passed: locally the fold
+		 * happened to land BELOW the growing block, so `drift` carried the correction on its own and
+		 * the missing `grew` never showed.
+		 *
+		 * `closest()` and not a parent walk: it stops at the first floored ancestor, which is the box
+		 * whose `min-height` holds the pre-tick height this measures against, and it costs one call
+		 * on the handful of records a tick delivers. Strictly wider than what it replaces — a target
+		 * that already wore the mark is its own `closest()` — so no tick that used to find a witness
+		 * can stop finding one. */
+		let r = null, box = null;
+		for (const m of records) {
+			if (m.type !== 'childList' || !m.target.closest) continue;
+			const b = m.target.closest(FLOORED);
+			if (b) { r = m; box = b; break; }
+		}
 		/* a box freshly wearing its FIRST floor has no "before" to measure against — parseFloat
 		 * of an unset `min-height` is NaN, `|| 0` reads as "no growth" rather than false growth
 		 * the size of the whole box */
-		const before = r && (parseFloat(r.target.style.minHeight) || 0);
-		const grew = before ? r.target.offsetHeight - before : 0;
+		const before = box && (parseFloat(box.style.minHeight) || 0);
+		const grew = before ? box.offsetHeight - before : 0;
 		/* RECOVERY EVIDENCE, task trust — read here and nowhere else; see TRUST_RECOVERY_LIMIT's own
 		 * comment for why `applyAnchor()` cannot see it. THE SAME REFERENCE `lateDrift()` trusts on
 		 * the other path (`_rest.el`'s own rect against the top it was remembered at), read before
@@ -1299,7 +1377,7 @@ function observeContent() {
 			_lateMisses = _lateHits = 0;
 		}
 		/* THE SAME BOX'S FLOOR, BEFORE AND AFTER THIS run() — task refill2. `holdFloor()` inside
-		 * run() clears and rewrites `r.target`'s own `min-height` every tick, which is a scroll-
+		 * run() clears and rewrites `box`'s own `min-height` every tick, which is a scroll-
 		 * anchor-invalidating style write on its own account (css-scroll-anchoring-1 §2.2.2,
 		 * `holdFloor()`'s own comment) — so a floored box whose CONTENT genuinely shrinks (a poll's
 		 * data losing rows, or in this callback the mutation record ITSELF being a removal) drops the
@@ -1320,10 +1398,10 @@ function observeContent() {
 		 * own `run()`, or another mutation's) leaves nothing stale behind — cleared below the moment
 		 * any tick's `holdFloor()` actually runs, for the identical reason. */
 		const wasScrolling = scrolling();
-		if (r && before && wasScrolling) _deferredFloor = r.target;
+		if (r && before && wasScrolling) _deferredFloor = box;
 		run(records);
 		if (!wasScrolling) _deferredFloor = null;
-		const floorShrink = (r && before) ? Math.max(0, before - (parseFloat(r.target.style.minHeight) || 0)) : 0;
+		const floorShrink = (r && before) ? Math.max(0, before - (parseFloat(box.style.minHeight) || 0)) : 0;
 		/* `#view` ITSELF EMPTIED AND REFILLED IS A PAGE SWAP, NOT A REFILL — task latecommit,
 		 * docs/anchoring.md "The commit is not a refill". The router commits a client navigation
 		 * with `dom.content()` on the live `#view` (commitStage(), fs-router.js) and the browser
@@ -1448,6 +1526,8 @@ return baseclass.extend({
 	/* "is the reader scrolling" and "I could not measure, wake me when they stop": a pass that reads
 	 * layout asks the first and calls the second, one that only writes does neither */
 	scrolling,
+	/* unmarked, for tools/scroll-anchor.mjs — see `_lateWhy` */
+	lateWhy: () => _lateWhy,
 	deferMeasurement,
 
 	/* -> the offset this file last took a reference at, or null before it has taken one.

wwand/Makefile

@@ -49,12 +49,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand
-PKG_VERSION:=1.6.6_p16
-PKG_RELEASE:=32
+PKG_VERSION:=1.6.6_p22
+PKG_RELEASE:=33
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/wwand.git
-PKG_SOURCE_VERSION:=78e295b05c360787631f914e389d7394c092ba4a
+PKG_SOURCE_VERSION:=f1c7fb3195f3ed7a69548bb5dbac648c4897031b
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only