From 981ebc09a4edfb7b372191361c3b2b079f174027 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sun, 9 Aug 2026 18:27:19 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=A4=9E=20Sync=202026-08-09=2018:27:19?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- gecoosac/Makefile | 4 +- gecoosac/files/etc/uci-defaults/gecoosac | 112 ++++++++++++------ hysteria/Makefile | 4 +- .../usr/share/rpcd/acl.d/luci-app-fchomo.json | 5 +- luci-app-gecoosac/Makefile | 6 +- .../luci-static/resources/view/gecoosac.js | 1 + luci-app-gecoosac/po/zh_Hans/gecoosac.po | 3 + luci-app-gecoosac/po/zh_Hant/gecoosac.po | 3 + .../root/usr/libexec/rpcd/luci.gecoosac | 108 ++++++++++++++--- .../usr/share/rpcd/acl.d/luci-app-natmap.json | 1 + .../rpcd/acl.d/luci-app-packagesync.json | 6 +- luci-app-passwall/Makefile | 2 +- .../luasrc/controller/passwall.lua | 36 +++--- .../luasrc/model/cbi/passwall/client/acl.lua | 25 +++- .../model/cbi/passwall/client/acl_config.lua | 34 ++++-- .../model/cbi/passwall/client/global.lua | 17 ++- .../model/cbi/passwall/client/haproxy.lua | 5 +- .../cbi/passwall/client/node_subscribe.lua | 10 +- .../model/cbi/passwall/client/other.lua | 5 +- .../model/cbi/passwall/client/type/ray.lua | 3 + .../cbi/passwall/client/type/sing-box.lua | 3 + .../model/cbi/passwall/server/index.lua | 7 +- .../model/cbi/passwall/server/type/ray.lua | 2 +- .../cbi/passwall/server/type/sing-box.lua | 2 +- luci-app-passwall/luasrc/passwall/api.lua | 7 +- .../luasrc/passwall/util_sing-box.lua | 15 ++- .../luasrc/passwall/util_xray.lua | 14 ++- luci-app-passwall/po/zh-cn/passwall.po | 12 ++ .../root/etc/uci-defaults/luci-passwall | 10 ++ .../root/usr/share/passwall/app.sh | 38 +++--- .../root/usr/share/passwall/iptables.sh | 5 + .../root/usr/share/passwall/nftables.sh | 5 + .../root/usr/share/passwall/rule_update.lua | 2 +- .../root/usr/share/passwall/subscribe.lua | 8 +- .../root/usr/share/passwall/tasks.sh | 3 +- luci-app-passwall2/Makefile | 2 +- .../luasrc/controller/passwall2.lua | 36 +++--- .../luasrc/model/cbi/passwall2/client/acl.lua | 7 +- .../model/cbi/passwall2/client/global.lua | 7 +- .../model/cbi/passwall2/client/haproxy.lua | 5 +- .../cbi/passwall2/client/node_subscribe.lua | 11 +- .../model/cbi/passwall2/client/other.lua | 5 +- .../model/cbi/passwall2/server/index.lua | 7 +- .../model/cbi/passwall2/server/type/ray.lua | 2 +- .../cbi/passwall2/server/type/sing-box.lua | 2 +- luci-app-passwall2/luasrc/passwall2/api.lua | 7 +- .../view/passwall2/global/status_bottom.htm | 14 +-- .../root/usr/share/passwall2/subscribe.lua | 2 +- luci-app-ssr-plus/Makefile | 2 +- .../view/shadowsocksr/status_bottom.htm | 16 +-- luci-app-tinyfilemanager/Makefile | 4 +- .../rpcd/acl.d/luci-app-tinyfilemanager.json | 3 +- nps/Makefile | 4 +- sing-box/Makefile | 4 +- 54 files changed, 424 insertions(+), 239 deletions(-) diff --git a/gecoosac/Makefile b/gecoosac/Makefile index bbd3d933..4d73d277 100644 --- a/gecoosac/Makefile +++ b/gecoosac/Makefile @@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=gecoosac PKG_VERSION:=2.2.20251015 -PKG_RELEASE:=17 +PKG_RELEASE:=18 PKG_MAINTAINER:=Roc Lai PKG_LICENSE:=AGPL-3.0-only @@ -44,7 +44,7 @@ define Package/$(PKG_NAME) TITLE:=gecoosac server (version $(PKG_VERSION)) URL:=http://www.cnrouter.com/ DEPENDS:=@(aarch64||arm||i386||mips||mipsel||x86_64) +openssl-util - REPLACES:=luci-app-gecoosac + PROVIDES:=gecoosac-files endef define Package/$(PKG_NAME)/conffiles diff --git a/gecoosac/files/etc/uci-defaults/gecoosac b/gecoosac/files/etc/uci-defaults/gecoosac index 48e33ac7..f00d9034 100644 --- a/gecoosac/files/etc/uci-defaults/gecoosac +++ b/gecoosac/files/etc/uci-defaults/gecoosac @@ -3,6 +3,7 @@ changed=0 DEFAULT_DB_DIR=/etc/gecoosac DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload +LEGACY_UPLOAD_DIR=/etc/gecoosac/upload DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key DEFAULT_PID_DIR=/var/run @@ -123,6 +124,23 @@ is_path_in_dir() { [ "${path#"$root"/}" != "$path" ] } +path_has_mount() { + local root line mount_path + + root="$(normalize_path "$1")" || return 2 + [ -r /proc/self/mountinfo ] || return 2 + + while IFS= read -r line; do + mount_path="$(printf '%s\n' "$line" | cut -d ' ' -f 5)" || return 2 + [ -n "$mount_path" ] || return 2 + mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2 + mount_path="$(normalize_path "$mount_path")" || return 2 + is_path_in_dir "$mount_path" "$root" && return 0 + done < /proc/self/mountinfo + + return 1 +} + is_safe_db_dir() { local path upload_root physical physical_upload_root @@ -175,6 +193,58 @@ normalize_upload_dir() { changed=1 } +configured_path_in_legacy_upload() { + local option path resolved + + for option in db_dir piddir crt_file key_file; do + path="$(uci -q get "gecoosac.config.${option}")" + [ -n "$path" ] || continue + path="$(normalize_path "$path")" || return 0 + is_path_in_dir "$path" "$LEGACY_UPLOAD_DIR" && return 0 + + if [ -e "$path" ] || [ -L "$path" ]; then + resolved="$(readlink -f "$path" 2>/dev/null)" || return 0 + resolved="$(normalize_path "$resolved")" || return 0 + is_path_in_dir "$resolved" "$LEGACY_UPLOAD_DIR" && return 0 + fi + done + + return 1 +} + +cleanup_legacy_upload_dir() { + local mount_state + + [ -e "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ] || return 0 + if [ ! -d "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ]; then + logger -t gecoosac "refusing to remove unsafe legacy upload path: $LEGACY_UPLOAD_DIR" + return 0 + fi + if configured_path_in_legacy_upload; then + logger -t gecoosac "preserving legacy upload path referenced by configuration: $LEGACY_UPLOAD_DIR" + return 0 + fi + + path_has_mount "$LEGACY_UPLOAD_DIR" + mount_state="$?" + case "$mount_state" in + 0) + logger -t gecoosac "preserving legacy upload path containing a mount: $LEGACY_UPLOAD_DIR" + return 0 + ;; + 2) + logger -t gecoosac "unable to validate legacy upload mounts: $LEGACY_UPLOAD_DIR" + return 0 + ;; + esac + + rm -rf "$LEGACY_UPLOAD_DIR" || { + logger -t gecoosac "failed to remove legacy upload path: $LEGACY_UPLOAD_DIR" + return 1 + } + [ ! -e "$LEGACY_UPLOAD_DIR" ] && [ ! -L "$LEGACY_UPLOAD_DIR" ] +} + normalize_dir_option() { local option="$1" local validator="$3" @@ -208,8 +278,8 @@ is_regular_file_or_absent() { [ -f "$1" ] && [ ! -L "$1" ] } -migrate_legacy_cert_paths() { - local crt_file key_file old_crt old_key new_crt new_key path +migrate_default_certificates() { + local crt_file key_file path crt_file="$(uci -q get gecoosac.config.crt_file)" key_file="$(uci -q get gecoosac.config.key_file)" @@ -223,39 +293,8 @@ migrate_legacy_cert_paths() { } done - old_crt=0 - old_key=0 - new_crt=0 - new_key=0 - [ -f "$OLD_CRT_FILE" ] && old_crt=1 - [ -f "$OLD_KEY_FILE" ] && old_key=1 - [ -f "$DEFAULT_CRT_FILE" ] && new_crt=1 - [ -f "$DEFAULT_KEY_FILE" ] && new_key=1 - - if { [ "$old_crt" = "1" ] && [ "$new_crt" = "1" ]; } || \ - { [ "$old_key" = "1" ] && [ "$new_key" = "1" ]; }; then - logger -t gecoosac "refusing conflicting legacy and current certificate files" - return 1 - fi - if [ "$old_crt" = "1" ] && [ "$new_key" = "1" ]; then - logger -t gecoosac "refusing reverse-split certificate migration state" - return 1 - fi - if [ $((old_crt + new_crt)) -ne $((old_key + new_key)) ]; then - logger -t gecoosac "refusing incomplete certificate migration state" - return 1 - fi - - if [ "$old_crt" = "1" ]; then - mv "$OLD_CRT_FILE" "$DEFAULT_CRT_FILE" || return 1 - fi - if [ "$old_key" = "1" ]; then - mv "$OLD_KEY_FILE" "$DEFAULT_KEY_FILE" || return 1 - fi - if [ -f "$DEFAULT_CRT_FILE" ]; then - chmod 644 "$DEFAULT_CRT_FILE" || return 1 - chmod 600 "$DEFAULT_KEY_FILE" || return 1 - fi + # Managed certificates are regenerated when HTTPS next starts. + rm -f "$OLD_CRT_FILE" "$OLD_KEY_FILE" "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE" || return 1 if [ "$crt_file" != "$DEFAULT_CRT_FILE" ]; then uci -q set "gecoosac.config.crt_file=${DEFAULT_CRT_FILE}" || return 1 @@ -270,9 +309,10 @@ migrate_legacy_cert_paths() { migrate_config() { local compat - migrate_legacy_cert_paths || return 1 compat="$(uci -q get gecoosac.config.config_compat)" [ "$compat" = "$CONFIG_COMPAT" ] && return 0 + migrate_default_certificates || return 1 + cleanup_legacy_upload_dir || return 1 uci -q set "gecoosac.config.config_compat=${CONFIG_COMPAT}" || return 1 changed=1 } diff --git a/hysteria/Makefile b/hysteria/Makefile index 3202c148..6b9baf93 100644 --- a/hysteria/Makefile +++ b/hysteria/Makefile @@ -5,8 +5,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=hysteria -PKG_VERSION:=2.12.0 -PKG_RELEASE:=14 +PKG_VERSION:=2.12.1 +PKG_RELEASE:=15 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/apernet/hysteria/tar.gz/app/v$(PKG_VERSION)? diff --git a/luci-app-fchomo/root/usr/share/rpcd/acl.d/luci-app-fchomo.json b/luci-app-fchomo/root/usr/share/rpcd/acl.d/luci-app-fchomo.json index 025ad0e9..dbbf950c 100644 --- a/luci-app-fchomo/root/usr/share/rpcd/acl.d/luci-app-fchomo.json +++ b/luci-app-fchomo/root/usr/share/rpcd/acl.d/luci-app-fchomo.json @@ -6,8 +6,11 @@ "/etc/init.d/fchomo reload *": [ "exec" ], "/usr/libexec/fchomo/natcheck.sh": [ "exec" ], "/var/run/fchomo/fchomo.log": [ "read" ], + "/tmp/run/fchomo/fchomo.log": [ "read" ], "/var/run/fchomo/mihomo-c.log": [ "read" ], - "/var/run/fchomo/mihomo-s.log": [ "read" ] + "/tmp/run/fchomo/mihomo-c.log": [ "read" ], + "/var/run/fchomo/mihomo-s.log": [ "read" ], + "/tmp/run/fchomo/mihomo-s.log": [ "read" ] }, "ubus": { "service": [ "list" ], diff --git a/luci-app-gecoosac/Makefile b/luci-app-gecoosac/Makefile index 1c0bd0ca..41a47bf8 100644 --- a/luci-app-gecoosac/Makefile +++ b/luci-app-gecoosac/Makefile @@ -7,11 +7,11 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-gecoosac PKG_VERSION:=2.2 -PKG_RELEASE:=17 +PKG_RELEASE:=18 LUCI_TITLE:=LuCI Support for gecoosac -LUCI_DEPENDS:=+luci-base +gecoosac -LUCI_EXTRA_DEPENDS:=gecoosac (>=2.2.20251015-r4) +LUCI_DEPENDS:=+luci-base +gecoosac +gecoosac-files +LUCI_EXTRA_DEPENDS:=gecoosac (>=2.2.20251015) LUCI_PKGARCH:=all PKG_LICENSE:=AGPL-3.0-only diff --git a/luci-app-gecoosac/htdocs/luci-static/resources/view/gecoosac.js b/luci-app-gecoosac/htdocs/luci-static/resources/view/gecoosac.js index d6e7eaf5..bdb77fd5 100644 --- a/luci-app-gecoosac/htdocs/luci-static/resources/view/gecoosac.js +++ b/luci-app-gecoosac/htdocs/luci-static/resources/view/gecoosac.js @@ -42,6 +42,7 @@ const RPC_ERROR_MESSAGES = { 'Invalid service status response': _('Invalid service status response'), 'Expecting an absolute path': _('Expecting an absolute path'), 'Only Gecoos upload directories can be cleared': _('Only Gecoos upload directories can be cleared'), + 'Upload directory contains a mount point': _('Upload directory contains a mount point'), 'Upload directory or its parent is not root-owned and private': _('Upload directory or its parent is not root-owned and private'), 'Unable to resolve upload directory': _('Unable to resolve upload directory'), 'Unable to read Gecoos configuration': _('Unable to read Gecoos configuration'), diff --git a/luci-app-gecoosac/po/zh_Hans/gecoosac.po b/luci-app-gecoosac/po/zh_Hans/gecoosac.po index 9c7735e3..a5a51eb6 100644 --- a/luci-app-gecoosac/po/zh_Hans/gecoosac.po +++ b/luci-app-gecoosac/po/zh_Hans/gecoosac.po @@ -139,6 +139,9 @@ msgstr "请输入绝对路径" msgid "Only Gecoos upload directories can be cleared" msgstr "只能清理集客 AC 上传目录" +msgid "Upload directory contains a mount point" +msgstr "上传目录包含挂载点" + msgid "Upload directory was not cleared" msgstr "上传目录未清理" diff --git a/luci-app-gecoosac/po/zh_Hant/gecoosac.po b/luci-app-gecoosac/po/zh_Hant/gecoosac.po index eb7729d4..6c1f6d9d 100644 --- a/luci-app-gecoosac/po/zh_Hant/gecoosac.po +++ b/luci-app-gecoosac/po/zh_Hant/gecoosac.po @@ -139,6 +139,9 @@ msgstr "請輸入絕對路徑" msgid "Only Gecoos upload directories can be cleared" msgstr "只能清除集客 AC 上傳目錄" +msgid "Upload directory contains a mount point" +msgstr "上傳目錄包含掛載點" + msgid "Upload directory was not cleared" msgstr "上傳目錄未清除" diff --git a/luci-app-gecoosac/root/usr/libexec/rpcd/luci.gecoosac b/luci-app-gecoosac/root/usr/libexec/rpcd/luci.gecoosac index 4cebd662..27cbc35b 100755 --- a/luci-app-gecoosac/root/usr/libexec/rpcd/luci.gecoosac +++ b/luci-app-gecoosac/root/usr/libexec/rpcd/luci.gecoosac @@ -129,6 +129,23 @@ path_in_dir() { [ "${path#"$root"/}" != "$path" ] } +path_has_mount() { + local root line mount_path + + root="$(normalize_path "$1")" || return 2 + [ -r /proc/self/mountinfo ] || return 2 + + while IFS= read -r line; do + mount_path="$(printf '%s\n' "$line" | cut -d ' ' -f 5)" || return 2 + [ -n "$mount_path" ] || return 2 + mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2 + mount_path="$(normalize_path "$mount_path")" || return 2 + path_in_dir "$mount_path" "$root" && return 0 + done < /proc/self/mountinfo + + return 1 +} + is_secure_dir() { local allow_sticky="$2" owner permissions metadata @@ -339,6 +356,49 @@ restore_staged_upload() { rmdir "$stage" 2>/dev/null } +clear_upload_rollback_result() { + local stage="$1" live="$2" message="$3" path="$4" + + if [ -n "$stage" ] && ! restore_staged_upload "$stage" "$live"; then + logger -t gecoosac "upload cleanup retained staged data at $stage" + path="$stage" + fi + clear_upload_locked_result 0 "$message" "$path" +} + +clear_upload_error_result() { + local message="$1" path="$2" + + if [ -n "$stage" ]; then + clear_upload_rollback_result "$stage" "$physical" "$message" "$path" + else + clear_upload_locked_result 0 "$message" "$path" + fi +} + +remove_clear_stage() { + local candidate="$1" mount_state + + clear_stage_error= + if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then + path_has_mount "$candidate/upload" + mount_state="$?" + case "$mount_state" in + 0) clear_stage_error="Upload directory contains a mount point"; return 1 ;; + 2) clear_stage_error="Unable to validate upload cleanup stage"; return 1 ;; + esac + rm -rf "$candidate/upload" || { + logger -t gecoosac "upload cleanup retained staged data at $candidate" + clear_stage_error="Unable to remove upload directory contents" + return 1 + } + fi + rmdir "$candidate" || { + clear_stage_error="Unable to remove upload cleanup stage" + return 1 + } +} + validate_clear_protected_paths() { local root="$1" live_logical="${2:-$1}" live_physical="${3:-$1}" option @@ -354,7 +414,7 @@ validate_clear_protected_paths() { } clear_upload() { - local logical physical resolved parent stage candidate stages live_exists current + local logical physical resolved parent stage candidate stages live_exists current clear_stage_error local clear_upload_dir clear_db_dir clear_piddir clear_crt_file clear_key_file local initial_upload initial_db initial_pid initial_crt initial_key @@ -459,6 +519,11 @@ clear_upload() { return } if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then + path_has_mount "$candidate/upload" + case "$?" in + 0) clear_upload_locked_result 0 "Upload directory contains a mount point" "$candidate"; return ;; + 2) clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$candidate"; return ;; + esac validate_clear_protected_paths "$candidate/upload" "$logical" "$physical" case "$?" in 0) clear_upload_locked_result 0 "Upload cleanup stage contains a configured protected path" "$candidate"; return ;; @@ -474,6 +539,13 @@ clear_upload() { clear_upload_locked_result 0 "Upload directory or its parent is not root-owned and private" "$logical" return fi + if [ "$live_exists" = "1" ]; then + path_has_mount "$physical" + case "$?" in + 0) clear_upload_locked_result 0 "Upload directory contains a mount point" "$logical"; return ;; + 2) clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$logical"; return ;; + esac + fi if [ "$live_exists" = "0" ] && [ "$stages" = "0" ]; then clear_upload_locked_result 1 "" "$logical" return @@ -520,7 +592,7 @@ clear_upload() { fi load_clear_config || { - clear_upload_locked_result 0 "Unable to read Gecoos configuration" "$logical" + clear_upload_rollback_result "$stage" "$physical" "Unable to read Gecoos configuration" "$logical" return } if [ "$clear_upload_dir" != "$initial_upload" ] || \ @@ -528,38 +600,42 @@ clear_upload() { [ "$clear_piddir" != "$initial_pid" ] || \ [ "$clear_crt_file" != "$initial_crt" ] || \ [ "$clear_key_file" != "$initial_key" ]; then - clear_upload_locked_result 0 "Gecoos configuration changed during cleanup" "$logical" + clear_upload_rollback_result "$stage" "$physical" "Gecoos configuration changed during cleanup" "$logical" return fi for candidate in "$parent"/.gecoosac-clear.??????; do [ "$candidate" != "$parent/.gecoosac-clear.??????" ] || continue is_safe_clear_stage "$candidate" || { - clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$candidate" + clear_upload_error_result "Unable to validate upload cleanup stage" "$candidate" return } if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then + path_has_mount "$candidate/upload" + case "$?" in + 0) clear_upload_error_result "Upload directory contains a mount point" "$candidate"; return ;; + 2) clear_upload_error_result "Unable to validate upload cleanup stage" "$candidate"; return ;; + esac validate_clear_protected_paths "$candidate/upload" "$logical" "$physical" case "$?" in - 0) clear_upload_locked_result 0 "Upload cleanup stage contains a configured protected path" "$candidate"; return ;; + 0) clear_upload_error_result "Upload cleanup stage contains a configured protected path" "$candidate"; return ;; 1) ;; - *) clear_upload_locked_result 0 "Unable to validate configured paths" "$candidate"; return ;; + *) clear_upload_error_result "Unable to validate configured paths" "$candidate"; return ;; esac fi done for candidate in "$parent"/.gecoosac-clear.??????; do [ "$candidate" != "$parent/.gecoosac-clear.??????" ] || continue - if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then - rm -rf "$candidate/upload" || { - logger -t gecoosac "upload cleanup retained staged data at $candidate" - clear_upload_locked_result 0 "Unable to remove upload directory contents" "$logical" - return - } - fi - rmdir "$candidate" || { - clear_upload_locked_result 0 "Unable to remove upload cleanup stage" "$candidate" + [ "$candidate" = "$stage" ] && continue + if ! remove_clear_stage "$candidate"; then + clear_upload_error_result "$clear_stage_error" "$candidate" return - } + fi done + if [ -n "$stage" ] && ! remove_clear_stage "$stage"; then + clear_upload_error_result "$clear_stage_error" "$stage" + return + fi + stage= clear_upload_locked_result 1 "" "$logical" } diff --git a/luci-app-natmapt/root/usr/share/rpcd/acl.d/luci-app-natmap.json b/luci-app-natmapt/root/usr/share/rpcd/acl.d/luci-app-natmap.json index 3f3c3aae..69dea28f 100644 --- a/luci-app-natmapt/root/usr/share/rpcd/acl.d/luci-app-natmap.json +++ b/luci-app-natmapt/root/usr/share/rpcd/acl.d/luci-app-natmap.json @@ -8,6 +8,7 @@ "/etc/natmap/ddns": [ "list" ], "/etc/init.d/natmap reload *": [ "exec" ], "/var/run/natmap/*": [ "read" ], + "/tmp/run/natmap/*": [ "read" ], "/tmp/natmap-natBehavior": [ "read" ], "/usr/libexec/natmap/natcheck.sh": [ "exec" ] }, diff --git a/luci-app-packagesync/root/usr/share/rpcd/acl.d/luci-app-packagesync.json b/luci-app-packagesync/root/usr/share/rpcd/acl.d/luci-app-packagesync.json index 16cb1edb..5c543c4f 100644 --- a/luci-app-packagesync/root/usr/share/rpcd/acl.d/luci-app-packagesync.json +++ b/luci-app-packagesync/root/usr/share/rpcd/acl.d/luci-app-packagesync.json @@ -6,9 +6,13 @@ "/etc/init.d/packagesync": [ "exec" ], "/bin/df -hT": [ "exec" ], "/var/packagesync/releaseslist": [ "read" ], + "/tmp/packagesync/releaseslist": [ "read" ], "/var/packagesync/targetslist": [ "read" ], + "/tmp/packagesync/targetslist": [ "read" ], "/var/packagesync/pkgarchslist": [ "read" ], - "/var/run/packagesync.pid": [ "read" ] + "/tmp/packagesync/pkgarchslist": [ "read" ], + "/var/run/packagesync.pid": [ "read" ], + "/tmp/run/packagesync.pid": [ "read" ] }, "ubus": { "service": [ "list" ] diff --git a/luci-app-passwall/Makefile b/luci-app-passwall/Makefile index 7dacc800..f8fa80d3 100644 --- a/luci-app-passwall/Makefile +++ b/luci-app-passwall/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=26.8.1 -PKG_RELEASE:=206 +PKG_RELEASE:=207 PKG_PO_VERSION:=$(PKG_VERSION) PKG_CONFIG_DEPENDS:= \ diff --git a/luci-app-passwall/luasrc/controller/passwall.lua b/luci-app-passwall/luasrc/controller/passwall.lua index 4721fc0b..c3b3afa9 100644 --- a/luci-app-passwall/luasrc/controller/passwall.lua +++ b/luci-app-passwall/luasrc/controller/passwall.lua @@ -572,22 +572,22 @@ end function add_node() local redirect = http.formvalue("redirect") - local uuid = api.gen_short_uuid() - uci:section(appname, "nodes", uuid) + local uid = api.gen_random_char() + uci:section(appname, "nodes", uid) local group = http.formvalue("group") if group and group ~= "default" then - uci:set(appname, uuid, "group", group) + uci:set(appname, uid, "group", group) end - uci:set(appname, uuid, "type", "Socks") + uci:set(appname, uid, "type", "Socks") if redirect == "1" then api.uci_save(uci, appname) - http.redirect(api.url("node_config", uuid)) + http.redirect(api.url("node_config", uid)) else api.uci_save(uci, appname, true, true) - http_write_json({result = uuid}) + http_write_json({result = uid}) end end @@ -615,17 +615,17 @@ end function copy_node() local section = http.formvalue("section") - local uuid = api.gen_short_uuid() - uci:section(appname, "nodes", uuid) + local uid = api.gen_random_char() + uci:section(appname, "nodes", uid) for k, v in pairs(uci:get_all(appname, section)) do if not k:match("^%.") and k ~= "group" then if k == "remarks" then v = (v or "") .. "(1)" end - uci:set(appname, uuid, k, v) + uci:set(appname, uid, k, v) end end - uci:set(appname, uuid, "add_mode", 1) + uci:set(appname, uid, "add_mode", 1) api.uci_save(uci, appname) - http.redirect(api.url("node_config", uuid)) + http.redirect(api.url("node_config", uid)) end function clear_all_nodes() @@ -1242,29 +1242,29 @@ function add_shunt_rule() local add_name = http.formvalue("add_name") local redirect = http.formvalue("redirect") - local uuid = add_name + local uid = add_name if add_name then - local has = uci:get(appname, uuid) + local has = uci:get(appname, uid) if has then http_write_json_error({ message = "This ID already exists." }) return end else - uuid = api.gen_short_uuid() + uid = api.gen_random_char() end - uci:section(appname, "shunt_rules", uuid) + uci:section(appname, "shunt_rules", uid) local group = http.formvalue("group") if group and group ~= "default" then - uci:set(appname, uuid, "group", group) + uci:set(appname, uid, "group", group) end if redirect == "1" then api.uci_save(uci, appname) - http.redirect(api.url("shunt_rules", uuid)) + http.redirect(api.url("shunt_rules", uid)) else api.uci_save(uci, appname) - http_write_json_ok({uuid = uuid, redirect_url = api.url("shunt_rules", uuid)}) + http_write_json_ok({uid = uid, redirect_url = api.url("shunt_rules", uid)}) end end diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua index e3f3d9a1..03765191 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua @@ -23,8 +23,9 @@ s.anonymous = true s.addremove = true s.extedit = api.url("acl_config", "%s") function s.create(e, t) - t = TypedSection.create(e, t) - luci.http.redirect(e.extedit:format(t)) + local uid = "acl_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end function s.remove(e, t) sys.call("rm -rf /tmp/etc/passwall_tmp/dns_" .. t .. "*") @@ -48,6 +49,15 @@ sys.net.mac_hints(function(e, t) } end) +i = s:option(DummyValue, "interface", translate("Source Interface")) +i.cfgvalue = function(t, n) + local v = Value.cfgvalue(t, n) or '' + if v == "" then + return translate("All") + end + return v +end + o = s:option(DummyValue, "sources", translate("Source")) o.rawhtml = true o.cfgvalue = function(t, n) @@ -66,10 +76,13 @@ o.cfgvalue = function(t, n) return e end -o = s:option(DummyValue, "interface", translate("Source Interface")) -o.cfgvalue = function(t, n) - local v = Value.cfgvalue(t, n) or '-' - return v +i = s:option(DummyValue, "mode", translate("Mode")) +i.cfgvalue = function(t, n) + local v = Value.cfgvalue(t, n) or '0' + if v == "1" then + return translate("Proxy") + end + return translate("No Proxy") end --[[ diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua index 2160416a..7d428241 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua @@ -84,19 +84,6 @@ o = s:option(Value, "remarks", translate("Remarks")) o.default = cfgid o.rmempty = false ----- Log -o = s:option(Flag, "log", translate("Log")) -o.default = 0 -o.rmempty = false - -o = s:option(ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level")) -o.default = "warning" -o:value("debug") -o:value("info") -o:value("warning") -o:value("error") -o:depends("log", "1") - o = s:option(Value, "interface", translate("Source Interface")) o:value("", translate("All")) local iface = api.get_network_devices() @@ -196,12 +183,17 @@ sources.validate = function(self, value, t) end sources.write = dynamicList_write +o = s:option(ListValue, "mode", translate("Mode")) +o:value("0", translate("No Proxy")) +o:value("1", translate("Proxy")) + ---- TCP No Redir Ports local TCP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_no_redir_ports") o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports")) o:value("", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")") o:value("disable", translate("No patterns are used")) o:value("1:65535", translate("All")) +o:depends("mode", "1") o.validate = port_validate ---- UDP No Redir Ports @@ -213,11 +205,13 @@ o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"), o:value("", translate("Use global config") .. "(" .. UDP_NO_REDIR_PORTS .. ")") o:value("disable", translate("No patterns are used")) o:value("1:65535", translate("All")) +o:depends("mode", "1") o.validate = port_validate o = s:option(DummyValue, "_hide_node_option", "") o.template = "passwall/cbi/hidevalue" o.value = "1" +o:depends("mode", "0") o:depends({ tcp_no_redir_ports = "1:65535", udp_no_redir_ports = "1:65535" }) if TCP_NO_REDIR_PORTS == "1:65535" and UDP_NO_REDIR_PORTS == "1:65535" then o:depends({ tcp_no_redir_ports = "", udp_no_redir_ports = "" }) @@ -280,6 +274,20 @@ o.value = "1" o:depends({ udp_node = "", ['!reverse'] = true }) o:depends({ shunt_udp_node = "tcp" }) +---- Log +o = s:option(Flag, "log", translate("Enable Node Log")) +o.default = 0 +o.rmempty = false +o:depends({ _hide_node_option = false, use_global_config = false }) + +o = s:option(ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level")) +o.default = "warn" +o:value("debug", "Debug") +o:value("info", "Info") +o:value("warn", "Warning") +o:value("error", "Error") +o:depends("log", "1") + ---- TCP Proxy Drop Ports local TCP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "tcp_proxy_drop_ports") o = s:option(Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports")) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua index c83415c2..c1ba96ff 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua @@ -689,11 +689,11 @@ o.default = "0" o.rmempty = false o = s:taboption("log", ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level")) -o.default = "warning" -o:value("debug") -o:value("info") -o:value("warning") -o:value("error") +o.default = "warn" +o:value("debug", "Debug") +o:value("info", "Info") +o:value("warn", "Warning") +o:value("error", "Error") o = s:taboption("log", Flag, "advanced_log_feature", translate("Advanced log feature"), translate("For professionals only.")) o.default = "0" @@ -735,10 +735,9 @@ s2.anonymous = true s2.addremove = true s2.extedit = api.url("socks_config", "%s") function s2.create(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "socks_" .. uuid - TypedSection.create(e, uuid) - luci.http.redirect(e.extedit:format(uuid)) + local uid = "socks_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end function s2.remove(e, t) local socks = "Socks_" .. t diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua index 9818b537..bc3046ce 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua @@ -114,9 +114,8 @@ s.anonymous = true s.addremove = true s.create = function(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "haproxy_" .. uuid - TypedSection.create(e, uuid) + local uid = "haproxy_" .. api.gen_random_char(5) + TypedSection.create(e, uid) end s.remove = function(self, section) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua index 5d8ad73d..6080e87f 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua @@ -138,11 +138,11 @@ s.template = "cbi/tblsection" s.extedit = api.url("node_subscribe_config", "%s") function s.create(e, t) m.no_commit = true - local id = TypedSection.create(e, t) - uci:set(appname, id, "hysteria_up_mbps", "100") - uci:set(appname, id, "hysteria_down_mbps", "100") - api.uci_save(uci, appname) - luci.http.redirect(e.extedit:format(id)) + local uid = "sub_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + m:set(uid, "hysteria_up_mbps", "100") + m:set(uid, "hysteria_down_mbps", "100") + luci.http.redirect(e.extedit:format(uid)) end o = s:option(Value, "remark", translate("Remarks")) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua index 069aad75..9ef39d15 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua @@ -222,9 +222,8 @@ if has_xray then s_xray_noise.addremove = true s_xray_noise.create = function(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "xray_noise_" .. uuid - TypedSection.create(e, uuid) + local uid = "xray_noise_" .. api.gen_random_char(5) + TypedSection.create(e, uid) end s_xray_noise.remove = function(self, section) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua index d45ae3c0..ab44838c 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua @@ -513,6 +513,9 @@ o.default = "chrome" o:depends({ [_n("tls")] = true, [_n("utls")] = true }) o:depends({ [_n("tls")] = true, [_n("reality")] = true }) +o = s:option(Value, _n("cipherSuites"), translate("Cipher Suites"), '***' .. " " .. translate("Configures the list of supported cipher suites, separated by :")) +o:depends({ [_n("tls")] = true, [_n("reality")] = false }) + o = s:option(Flag, _n("use_mldsa65Verify"), translate("ML-DSA-65")) o.default = "0" o:depends({ [_n("tls")] = true, [_n("reality")] = true }) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua index a62cfeeb..7bcce0ba 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua @@ -536,6 +536,9 @@ o.validate = function(self, value) return value end +o = s:option(Value, _n("cipherSuites"), translate("Cipher Suites"), '***' .. " " .. translate("Configures the list of supported cipher suites, separated by :")) +o:depends({ [_n("tls")] = true }) + o = s:option(Flag, _n("ech"), translate("ECH")) o.default = "0" o:depends({ [_n("tls")] = true, [_n("flow")] = "", [_n("reality")] = false }) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua index d9a8b50d..0cca99bc 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua @@ -26,10 +26,9 @@ t.sortable = true t.template = "cbi/tblsection" t.extedit = api.url("server_user", "%s") function t.create(e, t) - local uuid = api.gen_uuid() - t = uuid - TypedSection.create(e, t) - luci.http.redirect(e.extedit:format(t)) + local uid = api.gen_random_char() + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end function t.remove(e, t) e.map.proceed = true diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua index 7e1cf876..b3efefdb 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua @@ -111,7 +111,7 @@ o:depends({ [_n("protocol")] = "socks" }) o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password")) for i = 1, 3 do - o:value(api.gen_uuid(1)) + o:value(api.gen_uuid()) end o:depends({ [_n("protocol")] = "vmess" }) o:depends({ [_n("protocol")] = "vless" }) diff --git a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua index 75d2553b..8ac9630e 100644 --- a/luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua +++ b/luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua @@ -235,7 +235,7 @@ o:depends({ [_n("protocol")] = "shadowsocks" }) o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password")) for i = 1, 3 do - o:value(api.gen_uuid(1)) + o:value(api.gen_uuid()) end o:depends({ [_n("protocol")] = "vmess" }) o:depends({ [_n("protocol")] = "vless" }) diff --git a/luci-app-passwall/luasrc/passwall/api.lua b/luci-app-passwall/luasrc/passwall/api.lua index 3cf885fd..6dc1b152 100644 --- a/luci-app-passwall/luasrc/passwall/api.lua +++ b/luci-app-passwall/luasrc/passwall/api.lua @@ -642,15 +642,12 @@ function get_full_node_remarks(n) return remarks end -function gen_uuid(format) +function gen_uuid() local uuid = sys.exec("echo -n $(cat /proc/sys/kernel/random/uuid)") - if format == nil then - uuid = string.gsub(uuid, "-", "") - end return uuid end -function gen_short_uuid(length) +function gen_random_char(length) if not length then length = 8 end return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c %s)" % length) end diff --git a/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/luci-app-passwall/luasrc/passwall/util_sing-box.lua index e17d3e33..dc871255 100644 --- a/luci-app-passwall/luasrc/passwall/util_sing-box.lua +++ b/luci-app-passwall/luasrc/passwall/util_sing-box.lua @@ -5,7 +5,6 @@ local sys = api.sys local jsonc = api.jsonc local appname = "passwall" local fs = api.fs -local split = api.split local ech_domain = {} local local_version = api.get_app_version("sing-box"):match("[^v]+") @@ -88,6 +87,11 @@ local function convert_geofile() convert(GEO_VAR.IP_PATH, "geoip", GEO_VAR.IP_TAGS) end +local function get_log_level(s) + if s == "warning" then s = "warn" end + return s +end + function gen_outbound(flag, node, tag, proxy_table) local result = nil if node then @@ -190,7 +194,7 @@ function gen_outbound(flag, node, tag, proxy_table) if not GLOBAL.DNS_SERVER[dns_key] then GLOBAL.DNS_SERVER[dns_key] = { server = { - tag = "dns-node-" .. api.gen_short_uuid(), + tag = "dns-node-" .. api.gen_random_char(), type = dns_proto, server = server_address, server_port = server_port, @@ -232,7 +236,8 @@ function gen_outbound(flag, node, tag, proxy_table) --max_version = "1.3", fragment = fragment, record_fragment = record_fragment, - certificate = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and split(node.tls_certificate_pem, "\n") or nil, + certificate = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and api.split(node.tls_certificate_pem, "\n") or nil, + cipher_suites = (node.cipherSuites and node.cipherSuites ~= "") and api.split(node.cipherSuites, ":") or nil, ech = (node.ech == "1") and (function() local function get_ech_domain(s) --兼容xray "域名+DNS" 格式ech local domain, dns = s:match("^([^+]+)%+(.+)$") @@ -1042,7 +1047,7 @@ function gen_config_server(node) local config = { log = { disabled = (not node or node.log == "0") and true or false, - level = node.loglevel or "info", + level = get_log_level(node.loglevel) or "info", timestamp = true, --output = logfile, }, @@ -2169,7 +2174,7 @@ function gen_config(var) local config = { log = { disabled = log == "0" and true or false, - level = loglevel, + level = get_log_level(loglevel), timestamp = true, output = logfile, }, diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua index 985a4577..35287bda 100644 --- a/luci-app-passwall/luasrc/passwall/util_xray.lua +++ b/luci-app-passwall/luasrc/passwall/util_xray.lua @@ -31,6 +31,11 @@ local function get_domain_excluded() return hosts end +local function get_log_level(s) + if s == "warn" then s = "warning" end + return s +end + function gen_outbound(flag, node, tag, proxy_table) local result = nil if node then @@ -165,7 +170,8 @@ function gen_outbound(flag, node, tag, proxy_table) certificates = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and { certificate = api.split(node.tls_certificate_pem, "\n"), usage = "verify" - } or nil + } or nil, + cipherSuites = node.cipherSuites or nil } or nil, realitySettings = (node.stream_security == "reality") and { serverName = node.tls_serverName, @@ -453,7 +459,7 @@ function gen_outbound(flag, node, tag, proxy_table) local dns_key = dns_proto .. "|" .. config_address .. "|" .. tostring(config_port) if not GLOBAL.DNS_SERVER[dns_key] then GLOBAL.DNS_SERVER[dns_key] = { - tag = "dns-node-" .. api.gen_short_uuid(), + tag = "dns-node-" .. api.gen_random_char(), -- queryStrategy = node.domain_strategy or "UseIP", address = config_address, port = config_port, @@ -635,7 +641,7 @@ function gen_config_server(node) local config = { log = { -- error = "/tmp/etc/passwall_server/log/" .. user[".name"] .. ".log", - loglevel = ("1" == node.log) and node.loglevel or "none" + loglevel = ("1" == node.log) and get_log_level(node.loglevel) or "none" }, -- 传入连接 inbounds = { @@ -1966,7 +1972,7 @@ function gen_config(var) end)(), log = { -- error = string.format("/tmp/etc/%s/%s.log", appname, node[".name"]), - loglevel = loglevel + loglevel = get_log_level(loglevel) }, -- DNS dns = dns, diff --git a/luci-app-passwall/po/zh-cn/passwall.po b/luci-app-passwall/po/zh-cn/passwall.po index e151818a..89c5c558 100644 --- a/luci-app-passwall/po/zh-cn/passwall.po +++ b/luci-app-passwall/po/zh-cn/passwall.po @@ -1673,6 +1673,9 @@ msgstr "日志" msgid "Log" msgstr "日志" +msgid "Enable Node Log" +msgstr "启用节点日志" + msgid "%s Node Log" msgstr "%s 节点日志" @@ -2198,3 +2201,12 @@ msgstr "Gecko 包大小（最大）" msgid "valid time (hh:mm)" msgstr "有效时间（hh:mm）" + +msgid "Not Set" +msgstr "未设置" + +msgid "Cipher Suites" +msgstr "密码套件" + +msgid "Configures the list of supported cipher suites, separated by :" +msgstr "配置支持的密码套件列表，以冒号 (:) 分隔。" diff --git a/luci-app-passwall/root/etc/uci-defaults/luci-passwall b/luci-app-passwall/root/etc/uci-defaults/luci-passwall index 07472230..39a56e9f 100644 --- a/luci-app-passwall/root/etc/uci-defaults/luci-passwall +++ b/luci-app-passwall/root/etc/uci-defaults/luci-passwall @@ -68,6 +68,16 @@ for sid in $(uci show passwall | grep "=socks" | awk -F '.' '{print $2}' | awk - unset sid new_id fi done +for sid in $(uci show passwall | grep "@acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do + new_id="acl_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)" + uci -q rename passwall.${sid}="${new_id}" + unset sid new_id +done +for sid in $(uci show passwall | grep "@subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do + new_id="sub_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)" + uci -q rename passwall.${sid}="${new_id}" + unset sid new_id +done uci -q commit passwall diff --git a/luci-app-passwall/root/usr/share/passwall/app.sh b/luci-app-passwall/root/usr/share/passwall/app.sh index 0797852e..947a2622 100755 --- a/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/luci-app-passwall/root/usr/share/passwall/app.sh @@ -115,7 +115,6 @@ run_singbox() { json_add_string "logfile" "${log_file}" fi [ -z "$loglevel" ] && local loglevel=$(config_t_get global loglevel "warn") - [ "$loglevel" = "warning" ] && loglevel="warn" json_add_string "loglevel" "$loglevel" [ -n "$flag" ] && json_add_string "flag" "$flag" @@ -1050,9 +1049,6 @@ socks_node_switch() { LOG_FILE="/dev/null" run_socks flag=$flag node=$new_node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file set_cache_var "${flag}" "$new_node" - local ENABLED_DEFAULT_ACL=$(get_cache_var "ENABLED_DEFAULT_ACL") - local ENABLED_ACLS=$(get_cache_var "ENABLED_ACLS") - [ "$ENABLED_DEFAULT_ACL" != "1" ] && [ "$ENABLED_ACLS" != "1" ] && return local USE_TABLES=$(get_cache_var "USE_TABLES") [ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh filter_direct_node_list } @@ -1147,14 +1143,13 @@ start_crontab() { # ===== subscribe ===== local TMP_SUB_PATH=$TMP_PATH/sub_crontabs mkdir -p "$TMP_SUB_PATH" - local item cfgid remark sub_update_week_mode sub_update_time_mode + local item remark sub_update_week_mode sub_update_time_mode for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do sub_update_week_mode=$(config_n_get $item update_week_mode) if [ -n "$sub_update_week_mode" ]; then - cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1) remark=$(config_n_get "$item" remark) sub_update_time_mode=$(config_n_get $item update_time_mode) - echo "$cfgid" >> "$TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}" + echo "$item" >> "$TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}" echolog "配置定时任务：自动更新【$remark】订阅。" fi done @@ -1519,8 +1514,13 @@ start_haproxy() { acl_app() { local items=$(uci show ${CONFIG} | grep "=acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1) - [ -n "$items" ] && { - local item + if [ -z "$items" ]; then + ENABLED_ACLS=0 + set_cache_var ENABLED_ACLS $ENABLED_ACLS + return + else + local has_enabled + local sid local socks_port redir_port dns_port dnsmasq_port chinadns_port local msg msg2 socks_port=11100 @@ -1528,13 +1528,13 @@ acl_app() { dns_port=11300 dnsmasq_port=${GLOBAL_DNSMASQ_PORT:-11400} chinadns_port=11500 - for item in $items; do - local sid=$(uci -q show "${CONFIG}.${item}" | grep "=acl_rule" | awk -F '=' '{print $1}' | awk -F '.' '{print $2}') + for sid in $items; do [ "$(config_n_get $sid enabled)" = "1" ] || continue - eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-) + has_enabled=1 + eval $(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-) log=${log:-0} - loglevel=${loglevel:-warning} + loglevel=${loglevel:-warn} if [ -n "${sources}" ]; then for s in $sources; do @@ -1854,7 +1854,11 @@ acl_app() { unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns done unset socks_port redir_port dns_port dnsmasq_port chinadns_port - } + [ -n "${has_enabled}" ] || { + ENABLED_ACLS=0 + set_cache_var ENABLED_ACLS $ENABLED_ACLS + } + fi } start() { @@ -1912,8 +1916,7 @@ start() { local cfgids item for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do if [ "$(config_n_get "$item" boot_update 0)" = "1" ]; then - local cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1) - cfgids="${cfgids:+$cfgids,}$cfgid" + cfgids="${cfgids:+$cfgids,}$item" fi done [ -n "$cfgids" ] && { @@ -2003,9 +2006,6 @@ get_config() { done } ENABLED_ACLS=$(config_t_get global acl_enable 0) - [ "$ENABLED_ACLS" = 1 ] && { - [ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" = 0 ] && ENABLED_ACLS=0 - } set_cache_var ENABLED_DEFAULT_ACL $ENABLED_DEFAULT_ACL set_cache_var ENABLED_ACLS $ENABLED_ACLS diff --git a/luci-app-passwall/root/usr/share/passwall/iptables.sh b/luci-app-passwall/root/usr/share/passwall/iptables.sh index b1f0490e..6454d1c9 100755 --- a/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -203,6 +203,7 @@ load_acl() { for sid in $(ls -F ${TMP_ACL_PATH} | grep '/$' | awk -F '/' '{print $1}' | grep -v 'default'); do eval "$(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)" + mode=${mode:-0} tcp_no_redir_ports=${tcp_no_redir_ports:-default} udp_no_redir_ports=${udp_no_redir_ports:-default} use_global_config=${use_global_config:-0} @@ -217,6 +218,10 @@ load_acl() { chn_list=${chn_list:-direct} tcp_proxy_mode=${tcp_proxy_mode:-proxy} udp_proxy_mode=${udp_proxy_mode:-proxy} + [ "$mode" = "0" ] && { + tcp_no_redir_ports="1:65535" + udp_no_redir_ports="1:65535" + } [ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS [ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS [ "$tcp_proxy_drop_ports" = "default" ] && tcp_proxy_drop_ports=$TCP_PROXY_DROP_PORTS diff --git a/luci-app-passwall/root/usr/share/passwall/nftables.sh b/luci-app-passwall/root/usr/share/passwall/nftables.sh index 4d85e7b8..e71c4568 100755 --- a/luci-app-passwall/root/usr/share/passwall/nftables.sh +++ b/luci-app-passwall/root/usr/share/passwall/nftables.sh @@ -263,6 +263,7 @@ load_acl() { for sid in $(ls -F ${TMP_ACL_PATH} | grep '/$' | awk -F '/' '{print $1}' | grep -v 'default'); do eval "$(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)" + mode=${mode:-0} tcp_no_redir_ports=${tcp_no_redir_ports:-default} udp_no_redir_ports=${udp_no_redir_ports:-default} use_global_config=${use_global_config:-0} @@ -277,6 +278,10 @@ load_acl() { chn_list=${chn_list:-direct} tcp_proxy_mode=${tcp_proxy_mode:-proxy} udp_proxy_mode=${udp_proxy_mode:-proxy} + [ "$mode" = "0" ] && { + tcp_no_redir_ports="1:65535" + udp_no_redir_ports="1:65535" + } [ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS [ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS [ "$tcp_proxy_drop_ports" = "default" ] && tcp_proxy_drop_ports=$TCP_PROXY_DROP_PORTS diff --git a/luci-app-passwall/root/usr/share/passwall/rule_update.lua b/luci-app-passwall/root/usr/share/passwall/rule_update.lua index 53db2e1d..e236d425 100755 --- a/luci-app-passwall/root/usr/share/passwall/rule_update.lua +++ b/luci-app-passwall/root/usr/share/passwall/rule_update.lua @@ -533,7 +533,7 @@ local function fetch_geofile(geo_name, geo_type, url) local tmp_path = "/tmp/" .. geo_name local asset_path = asset_location .. geo_name local down_filename = url:match("^.*/([^/?#]+)") - local sha_url = url:gsub(down_filename, down_filename .. ".sha256sum") + local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum") local sha_path = tmp_path .. ".sha256sum" local function verify_sha256(sha_file) diff --git a/luci-app-passwall/root/usr/share/passwall/subscribe.lua b/luci-app-passwall/root/usr/share/passwall/subscribe.lua index 3437b004..fa6924ab 100755 --- a/luci-app-passwall/root/usr/share/passwall/subscribe.lua +++ b/luci-app-passwall/root/usr/share/passwall/subscribe.lua @@ -180,9 +180,9 @@ do local flag = "Socks节点列表[" .. i .. "]备用节点的列表" local currentNodes = {} local newNodes = {} - for k, asb_node in ipairs(t.autoswitch_backup_node) do - if asb_node then - local currentNode = uci:get_all(appname, asb_node) or {} + for k, asb_node_id in ipairs(t.autoswitch_backup_node) do + if asb_node_id then + local currentNode = uci:get_all(appname, asb_node_id) or {} if currentNode[".type"] == "nodes" then currentNodes[#currentNodes + 1] = { log = true, @@ -1931,7 +1931,7 @@ local function update_node(manual) chain_node_type = (outbound_iface_group ~= "") and "iface" or chain_node_type end for _, vv in ipairs(list) do - local cfgid = uci:section(appname, "nodes", api.gen_short_uuid()) + local cfgid = uci:section(appname, "nodes", api.gen_random_char()) for kkk, vvv in pairs(vv) do if type(vvv) == "table" and next(vvv) ~= nil then uci:set_list(appname, cfgid, kkk, vvv) diff --git a/luci-app-passwall/root/usr/share/passwall/tasks.sh b/luci-app-passwall/root/usr/share/passwall/tasks.sh index 25d2320e..f696e13e 100755 --- a/luci-app-passwall/root/usr/share/passwall/tasks.sh +++ b/luci-app-passwall/root/usr/share/passwall/tasks.sh @@ -41,10 +41,9 @@ do for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do sub_update_week_mode=$(config_n_get $item update_week_mode) if [ -n "$sub_update_week_mode" ]; then - cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1) remark=$(config_n_get $item remark) sub_update_interval_mode=$(config_n_get $item update_interval_mode) - echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode} + echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode} fi done diff --git a/luci-app-passwall2/Makefile b/luci-app-passwall2/Makefile index 2cfad31e..1b86a41b 100644 --- a/luci-app-passwall2/Makefile +++ b/luci-app-passwall2/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall2 PKG_VERSION:=26.8.7 -PKG_RELEASE:=70 +PKG_RELEASE:=71 PKG_PO_VERSION:=$(PKG_VERSION) PKG_CONFIG_DEPENDS:= \ diff --git a/luci-app-passwall2/luasrc/controller/passwall2.lua b/luci-app-passwall2/luasrc/controller/passwall2.lua index ebf2f86b..c9fb53b6 100644 --- a/luci-app-passwall2/luasrc/controller/passwall2.lua +++ b/luci-app-passwall2/luasrc/controller/passwall2.lua @@ -449,22 +449,22 @@ end function add_node() local redirect = http.formvalue("redirect") - local uuid = api.gen_short_uuid() - uci:section(appname, "nodes", uuid) + local uid = api.gen_random_char() + uci:section(appname, "nodes", uid) local group = http.formvalue("group") if group and group ~= "default" then - uci:set(appname, uuid, "group", group) + uci:set(appname, uid, "group", group) end - uci:set(appname, uuid, "type", "Xray") + uci:set(appname, uid, "type", "Xray") if redirect == "1" then api.uci_save(uci, appname) - http.redirect(api.url("node_config", uuid)) + http.redirect(api.url("node_config", uid)) else api.uci_save(uci, appname, true, true) - http_write_json({result = uuid}) + http_write_json({result = uid}) end end @@ -479,17 +479,17 @@ end function copy_node() local section = http.formvalue("section") - local uuid = api.gen_short_uuid() - uci:section(appname, "nodes", uuid) + local uid = api.gen_random_char() + uci:section(appname, "nodes", uid) for k, v in pairs(uci:get_all(appname, section)) do if not k:match("^%.") and k ~= "group" then if k == "remarks" then v = (v or "") .. "(1)" end - uci:set(appname, uuid, k, v) + uci:set(appname, uid, k, v) end end - uci:set(appname, uuid, "add_mode", 1) + uci:set(appname, uid, "add_mode", 1) api.uci_save(uci, appname) - http.redirect(api.url("node_config", uuid)) + http.redirect(api.url("node_config", uid)) end function clear_all_nodes() @@ -1055,29 +1055,29 @@ function add_shunt_rule() local add_name = http.formvalue("add_name") local redirect = http.formvalue("redirect") - local uuid = add_name + local uid = add_name if add_name then - local has = uci:get(appname, uuid) + local has = uci:get(appname, uid) if has then http_write_json_error({ message = "This ID already exists." }) return end else - uuid = api.gen_short_uuid() + uid = api.gen_random_char() end - uci:section(appname, "shunt_rules", uuid) + uci:section(appname, "shunt_rules", uid) local group = http.formvalue("group") if group and group ~= "default" then - uci:set(appname, uuid, "group", group) + uci:set(appname, uid, "group", group) end if redirect == "1" then api.uci_save(uci, appname) - http.redirect(api.url("shunt_rules", uuid)) + http.redirect(api.url("shunt_rules", uid)) else api.uci_save(uci, appname) - http_write_json_ok({uuid = uuid, redirect_url = api.url("shunt_rules", uuid)}) + http_write_json_ok({uid = uid, redirect_url = api.url("shunt_rules", uid)}) end end diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua index 979e5580..f24e2b50 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua @@ -23,10 +23,9 @@ s.anonymous = true s.addremove = true s.extedit = api.url("acl_config", "%s") function s.create(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "acl_" .. uuid - TypedSection.create(e, uuid) - luci.http.redirect(e.extedit:format(uuid)) + local uid = "acl_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end ---- Enable diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua index 17714348..17d67606 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua @@ -326,10 +326,9 @@ s2.anonymous = true s2.addremove = true s2.extedit = api.url("socks_config", "%s") function s2.create(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "socks_" .. uuid - TypedSection.create(e, uuid) - luci.http.redirect(e.extedit:format(uuid)) + local uid = "socks_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end o = s2:option(DummyValue, "status", translate("Status")) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua index d6f14020..a1ce99f7 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua @@ -113,9 +113,8 @@ s.anonymous = true s.addremove = true s.create = function(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "haproxy_" .. uuid - TypedSection.create(e, uuid) + local uid = "haproxy_" .. api.gen_random_char(5) + TypedSection.create(e, uid) end s.remove = function(self, section) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua index 66df5407..3f7e7c68 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua @@ -134,12 +134,11 @@ s.sortable = true s.template = "cbi/tblsection" s.extedit = api.url("node_subscribe_config", "%s") function s.create(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "sub_" .. uuid - TypedSection.create(e, uuid) - m:set(uuid, "hysteria_up_mbps", "100") - m:set(uuid, "hysteria_down_mbps", "100") - luci.http.redirect(e.extedit:format(uuid)) + local uid = "sub_" .. api.gen_random_char(5) + TypedSection.create(e, uid) + m:set(uid, "hysteria_up_mbps", "100") + m:set(uid, "hysteria_down_mbps", "100") + luci.http.redirect(e.extedit:format(uid)) end o = s:option(Value, "remark", translate("Remarks")) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua index 74cc6f14..1a91208c 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua @@ -263,9 +263,8 @@ if has_xray then s_xray_noise.addremove = true s_xray_noise.create = function(e, t) - local uuid = api.gen_short_uuid(5) - uuid = "xray_noise_" .. uuid - TypedSection.create(e, uuid) + local uid = "xray_noise_" .. api.gen_random_char(5) + TypedSection.create(e, uid) end s_xray_noise.remove = function(self, section) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua index 33f24596..ef9ba277 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua @@ -21,10 +21,9 @@ t.sortable = true t.template = "cbi/tblsection" t.extedit = api.url("server_user", "%s") function t.create(e, t) - local uuid = api.gen_uuid() - t = uuid - TypedSection.create(e, t) - luci.http.redirect(e.extedit:format(t)) + local uid = api.gen_random_char() + TypedSection.create(e, uid) + luci.http.redirect(e.extedit:format(uid)) end function t.remove(e, t) e.map.proceed = true diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua index 09dd948d..11bfc669 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua @@ -111,7 +111,7 @@ o:depends({ [_n("protocol")] = "socks" }) o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password")) for i = 1, 3 do - o:value(api.gen_uuid(1)) + o:value(api.gen_uuid()) end o:depends({ [_n("protocol")] = "vmess" }) o:depends({ [_n("protocol")] = "vless" }) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua index 8f906243..d0f01773 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua @@ -235,7 +235,7 @@ o:depends({ [_n("protocol")] = "shadowsocks" }) o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password")) for i = 1, 3 do - o:value(api.gen_uuid(1)) + o:value(api.gen_uuid()) end o:depends({ [_n("protocol")] = "vmess" }) o:depends({ [_n("protocol")] = "vless" }) diff --git a/luci-app-passwall2/luasrc/passwall2/api.lua b/luci-app-passwall2/luasrc/passwall2/api.lua index f11ef1a7..5437f4f7 100644 --- a/luci-app-passwall2/luasrc/passwall2/api.lua +++ b/luci-app-passwall2/luasrc/passwall2/api.lua @@ -669,15 +669,12 @@ function get_full_node_remarks(n) return remarks end -function gen_uuid(format) +function gen_uuid() local uuid = sys.exec("echo -n $(cat /proc/sys/kernel/random/uuid)") - if format == nil then - uuid = string.gsub(uuid, "-", "") - end return uuid end -function gen_short_uuid(length) +function gen_random_char(length) if not length then length = 8 end return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c %s)" % length) end diff --git a/luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm b/luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm index daac51d1..cd962d7c 100644 --- a/luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm +++ b/luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm @@ -56,15 +56,15 @@ display:block !important;
- 获取中...
- - - - + + + +
@@ -72,8 +72,8 @@ display:block !important;