cwx/op-packages
1
0
Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-08-04 00:29:27 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

🔥 Sync 2026-07-19 20:20:12

Browse Source
This commit is contained in:
github-actions[bot] 2026-07-19 20:20:12 +08:00
parent 7974ca67ae
commit c0107db2e8
29 changed files with 1161 additions and 1032 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
daed/Makefile
View File

@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=daed
PKG_VERSION:=2026.07.17
PKG_RELEASE:=24
PKG_RELEASE:=25
PKG_SOURCE:=daed-src-2026.07.17-1e3ce69d866f.tar.gz
PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src

6
daed/files/daed-cleanup.sh
View File

@ -15,9 +15,13 @@ daed_cleanup_runtime() {
fi
if ! ip netns del daens 2>/dev/null; then
umount /run/netns/daens 2>/dev/null
umount -l /run/netns/daens 2>/dev/null
rm -f /run/netns/daens
fi
ip link del dae0 2>/dev/null || true
[ ! -e /run/netns/daens ] || return 1
! ip netns list 2>/dev/null | awk '$1 == "daens" { found=1 } END { exit !found }' || return 1
! ip link show dae0 >/dev/null 2>&1 || return 1
}

5
daed/files/daed-guard
View File

@ -2,5 +2,8 @@
. /usr/share/daed/cleanup.sh
daed_cleanup_runtime
if ! daed_cleanup_runtime; then
echo "daed: stale network state could not be removed" >&2
exit 1
fi
exec /usr/bin/daed "$@"

51
daed/patches/0005-bound-startup-network-wait.patch Normal file
View File

@ -0,0 +1,51 @@
From: kenzok8 <kenzok8@noreply>
Date: 2026-07-19
Subject: [PATCH] daed: bound startup network wait
Purge stale dae filters before probing the network and stop waiting after 60
seconds so the dashboard remains available for recovery.
---
--- a/dae/utils.go
+++ b/dae/utils.go
@@ -97 +97 @@
-func WaitForNetwork(log *logrus.Logger) {
+func WaitForNetwork(log *logrus.Logger) error {
@@ -98,0 +99 @@
+ deadline := time.Now().Add(60 * time.Second)
@@ -117,0 +119,3 @@
+ if time.Now().After(deadline) {
+ return fmt.Errorf("network unavailable after 60 seconds")
+ }
@@ -136,0 +141 @@
+ return nil
--- a/dae/run.go
+++ b/dae/run.go
@@ -35 +35,2 @@
-var onceWaitingNetwork sync.Once
+var waitingNetworkMu sync.Mutex
+var networkReady bool
@@ -54,0 +56,13 @@
+func waitForNetwork(log *logrus.Logger) error {
+ waitingNetworkMu.Lock()
+ defer waitingNetworkMu.Unlock()
+ if networkReady {
+ return nil
+ }
+ if err := WaitForNetwork(log); err != nil {
+ return err
+ }
+ networkReady = true
+ return nil
+}
+
@@ -223,0 +238,3 @@
+ if bpf == nil {
+ control.PurgeStaleTCFilters(log)
+ }
@@ -231,3 +248,3 @@
- onceWaitingNetwork.Do(func() {
- WaitForNetwork(log)
- })
+ if err = waitForNetwork(log); err != nil {
+ return nil, err
+ }

2
luci-app-daede/Makefile
View File

@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-daede
PKG_VERSION:=1.14.7
PKG_RELEASE:=33
PKG_RELEASE:=34
PKG_MAINTAINER:=kenzok8
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

2
luci-app-daede/htdocs/luci-static/resources/view/daede/daed.js
View File

@ -99,7 +99,7 @@ function renderDaedSettings() {
const err = (res.stderr || res.stdout || ('exit ' + res.code)).trim().split('\n')[0];
flash(_('Subscription update failed: %s').format(err), 'err', 9000);
} else {
flash(_('Subscriptions updated (daed restarted)'), 'ok');
flash(_('Subscriptions updated and applied'), 'ok');
}
}).catch(function(e) {
flash(_('Subscription update failed: %s').format(e.message || e), 'err', 9000);

38
luci-app-daede/htdocs/luci-static/resources/view/daede/log.js
View File

@ -9,6 +9,14 @@
const MAX_LINES = 5000;
function execChecked(command, args) {
return fs.exec(command, args || []).then(function(res) {
if (res && res.code !== 0)
throw new Error((res.stderr || res.stdout || ('exit ' + res.code)).trim());
return res;
});
}
const CSS = [
'.dd-log-wrap{padding:4px 0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC",sans-serif}',
'.dd-log-card{border:1px solid rgba(0,0,0,.06);border-radius:10px;padding:10px 14px;margin-bottom:10px;box-shadow:0 2px 8px rgba(0,0,0,.03);background:rgba(255,255,255,.02)}',
@ -20,6 +28,7 @@ const CSS = [
'.dd-log-toolbar input[type="text"]{font-size:11.5px;padding:4px 8px;border-radius:5px;border:1px solid rgba(128,128,128,.28);background:transparent;color:inherit;min-width:160px}',
'.dd-log-toolbar .dd-log-btn{font-size:11.5px;line-height:1.4;min-height:0;height:auto;padding:4px 12px;border-radius:5px;border:1px solid rgba(128,128,128,.28);background:transparent;color:inherit;cursor:pointer}',
'.dd-log-toolbar .dd-log-btn:hover{background:rgba(128,128,128,.1)}',
'.dd-log-toolbar .dd-log-stop{color:#d9534f;border-color:rgba(217,83,79,.45)}',
'.dd-log-toolbar .dd-log-meta{margin-left:auto;font-size:10.5px;opacity:.55;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace}',
'.dd-log-pane{height:60vh;min-height:360px;overflow:auto;padding:8px 10px;border:1px solid rgba(0,0,0,.08);border-radius:7px;background:#1a1d21;color:#d8dde6;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono",monospace;font-size:11.5px;line-height:1.55;white-space:pre-wrap;word-break:break-all}',
'.dd-log-pane .dd-line{padding:1px 4px;border-radius:3px;display:block}',
@ -192,6 +201,25 @@ return view.extend({
}).catch(function() {});
});
let btnStop = null;
if (ctx.name === 'daed') {
btnStop = E('button', { 'class': 'dd-log-btn dd-log-stop' }, _('Stop daed'));
btnStop.addEventListener('click', function() {
if (!confirm(_('Stop daed now?')))
return;
btnStop.disabled = true;
execChecked('/sbin/uci', ['set', 'daed.config.enabled=0'])
.then(function() { return execChecked('/sbin/uci', ['commit', 'daed']); })
.then(function() { return execChecked('/etc/init.d/daed', ['disable']); })
.then(function() { return execChecked('/etc/init.d/daed', ['stop']); })
.then(function() { btnStop.textContent = _('daed stopped'); })
.catch(function(e) {
btnStop.disabled = false;
ui.addNotification(null, E('p', {}, _('Failed to stop daed: %s').format(e.message || e)), 'error');
});
});
}
function applyFilter() {
const f = state.filter;
pane.querySelectorAll('.dd-line').forEach(function(el) {
@ -281,15 +309,17 @@ return view.extend({
poll.add(tick);
tick();
const toolbar = E('div', { 'class': 'dd-log-toolbar' }, [
const toolbarItems = [
E('label', {}, [ cbAuto, _('Auto-scroll') ]),
E('label', {}, [ cbPause, _('Pause') ]),
selFilter,
btnClear,
btnDownload,
btnTruncate,
meta
]);
btnTruncate
];
if (btnStop) toolbarItems.push(btnStop);
toolbarItems.push(meta);
const toolbar = E('div', { 'class': 'dd-log-toolbar' }, toolbarItems);
return E('div', { 'class': 'dd-log-wrap' }, [
E('style', {}, CSS),

15
luci-app-daede/po/templates/daede.pot
View File

@ -388,6 +388,18 @@ msgstr ""
msgid "Download"
msgstr ""
msgid "Stop daed"
msgstr ""
msgid "Stop daed now?"
msgstr ""
msgid "daed stopped"
msgstr ""
msgid "Failed to stop daed: %s"
msgstr ""
#: dae.js
msgid "One node share link per line — ss, vmess, vless, trojan, tuic, hysteria2, socks5."
msgstr ""
@ -464,6 +476,9 @@ msgstr ""
msgid "Subscriptions updated (dae reloaded)"
msgstr ""
msgid "Subscriptions updated and applied"
msgstr ""
#: dae.js
msgid "Save manual config"
msgstr ""

16
luci-app-daede/po/zh-cn/daede.po
View File

@ -400,6 +400,18 @@ msgstr "清空文件"
msgid "Download"
msgstr "下载"
msgid "Stop daed"
msgstr "停止 daed"
msgid "Stop daed now?"
msgstr "立即停止 daed？"
msgid "daed stopped"
msgstr "daed 已停止"
msgid "Failed to stop daed: %s"
msgstr "停止 daed 失败：%s"
# ---- config.js: Subscription Card ----
msgid "Subscription Management"
msgstr "订阅管理"
@ -628,8 +640,8 @@ msgstr "更新失败：%s"
msgid "Subscriptions updated (dae reloaded)"
msgstr "订阅已更新（dae 已重载）"
msgid "Subscriptions updated (daed restarted)"
msgstr "订阅已更新，daed 已重启"
msgid "Subscriptions updated and applied"
msgstr "订阅已更新并应用"
msgid "Section"
msgstr "区块"

16
luci-app-daede/po/zh_Hans/daede.po
View File

@ -400,6 +400,18 @@ msgstr "清空文件"
msgid "Download"
msgstr "下载"
msgid "Stop daed"
msgstr "停止 daed"
msgid "Stop daed now?"
msgstr "立即停止 daed？"
msgid "daed stopped"
msgstr "daed 已停止"
msgid "Failed to stop daed: %s"
msgstr "停止 daed 失败：%s"
# ---- config.js: Subscription Card ----
msgid "Subscription Management"
msgstr "订阅管理"
@ -628,8 +640,8 @@ msgstr "更新失败：%s"
msgid "Subscriptions updated (dae reloaded)"
msgstr "订阅已更新（dae 已重载）"
msgid "Subscriptions updated (daed restarted)"
msgstr "订阅已更新，daed 已重启"
msgid "Subscriptions updated and applied"
msgstr "订阅已更新并应用"
msgid "Section"
msgstr "区块"

9
luci-app-daede/root/usr/share/luci-app-daede/daed-sub-update.sh
View File

@ -121,9 +121,12 @@ if [ "$fail" -ne 0 ]; then
fi
if [ "$count" -gt 0 ] && [ "$ok" -gt 0 ] && /bin/pidof daed >/dev/null 2>&1; then
log "restarting daed to apply updated subscriptions"
if ! /etc/init.d/daed restart >>"$LOG" 2>&1; then
fail 8 "daed restart failed after subscription update"
run_body="$TMPDIR/run.json"
run_resp="$TMPDIR/run.out"
printf '{"query":"mutation Run($dry:Boolean!){run(dry:$dry)}","variables":{"dry":false}}' > "$run_body"
log "applying updated subscriptions"
if ! post_graphql "$run_body" "$run_resp" "$token" || grep -q '"errors"' "$run_resp"; then
fail 8 "failed to apply updated subscriptions: $(cat "$run_resp" 2>/dev/null)"
fi
fi

7
luci-app-daede/root/usr/share/luci-app-daede/update-geo.sh
View File

@ -61,10 +61,15 @@ fi
rc=1
else
size=$(wc -c < "$TMP" 2>/dev/null || echo 0)
if [ "$size" -lt 102400 ]; then
magic=$(hexdump -n 1 -e '1/1 "%02x"' "$TMP" 2>/dev/null)
if [ "$size" -lt 1024 ]; then
echo "$(date '+%F %T') file too small ($size bytes)"
rm -f "$TMP"
rc=2
elif [ "$magic" != "0a" ]; then
echo "$(date '+%F %T') invalid geodata format"
rm -f "$TMP"
rc=3
else
mv "$TMP" "$DEST"
echo "$(date '+%F %T') updated $DEST ($size bytes)"

2
luci-app-passwall/Makefile
View File

@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-passwall
PKG_VERSION:=26.7.16
PKG_RELEASE:=186
PKG_RELEASE:=187
PKG_PO_VERSION:=$(PKG_VERSION)
PKG_CONFIG_DEPENDS:= \

6
luci-app-passwall/root/usr/share/passwall/app.sh
View File

@ -53,11 +53,11 @@ check_run_environment() {
if [ "$USE_TABLES" = "iptables" ]; then
dep_list="iptables-mod-tproxy iptables-mod-socket iptables-mod-iprange iptables-mod-conntrack-extra kmod-ipt-nat"
else
dep_list="kmod-nft-socket kmod-nft-tproxy kmod-nft-nat"
dep_list="kmod-nft-socket kmod-nft-tproxy kmod-nft-nat kmod-nf-reject kmod-nf-reject6"
nftflag=1
local v_num=$(echo "$dnsmasq_ver" | tr -cd '0-9')
if [ "${v_num:-0}" -lt 290 ]; then
echolog "提示：Dnsmasq ($dnsmasq_ver) 低于 2.90，建议升级以增强稳定性。"
if [ "${v_num:-0}" -lt 292 ]; then
echolog "提示：Dnsmasq ($dnsmasq_ver) 低于 2.92，建议升级以增强稳定性。"
fi
fi
local pkg

158
luci-app-passwall/root/usr/share/passwall/iptables.sh
View File

@ -34,8 +34,10 @@ FWMARK="0x50535731"
ipt=$(command -v iptables-legacy || command -v iptables)
ip6t=$(command -v ip6tables-legacy || command -v ip6tables)
ipt_f="$ipt -w"
ipt_n="$ipt -t nat -w"
ipt_m="$ipt -t mangle -w"
ip6t_f="$ip6t -w"
ip6t_n="$ip6t -t nat -w"
ip6t_m="$ip6t -t mangle -w"
[ -z "$ip6t" ] || [ -z "$(lsmod | grep 'ip6table_nat')" ] && ip6t_n="eval #$ip6t_n"
@ -404,48 +406,53 @@ load_acl() {
fi
[ -n "$tcp_port" ] || [ -n "$udp_port" ] && {
[ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK) -j DROP
[ "${use_block_list}" = "1" ] && $ipt_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK) -j MARK --set-mark 88
[ "${use_direct_list}" = "1" ] && $ipt_tmp -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITE) -j RETURN
[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
[ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK6) -j DROP 2>/dev/null
[ "${use_block_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_BLOCK6) -j MARK --set-mark 88 2>/dev/null
[ "${use_direct_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} $(dst $IPSET_WHITE6) -j RETURN 2>/dev/null
}
[ "$tcp_proxy_drop_ports" != "disable" ] && {
[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j DROP" 2>/dev/null
[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP_6 -j MARK --set-mark 88" 2>/dev/null
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")" 2>/dev/null
[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j MARK --set-mark 88" 2>/dev/null
}
[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j DROP"
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt_set_name) -j DROP"
[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j DROP"
[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-d $FAKE_IP -j MARK --set-mark 88"
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $black_set_name) -j MARK --set-mark 88"
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $gfw_set_name) -j MARK --set-mark 88"
[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")"
[ "${use_shunt_tcp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "$(dst $shunt_set_name) -j MARK --set-mark 88"
[ "${tcp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_proxy_drop_ports "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 TCP 端口[${tcp_proxy_drop_ports}]"
}
[ "$udp_proxy_drop_ports" != "disable" ] && {
[ "$PROXY_IPV6" = "1" ] && [ "$_ipv4" != "1" ] && {
[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j DROP" 2>/dev/null
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black6_set_name) -j DROP" 2>/dev/null
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw6_set_name) -j DROP" 2>/dev/null
[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j DROP")" 2>/dev/null
[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt6_set_name) -j DROP" 2>/dev/null
[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j DROP" 2>/dev/null
[ "${use_fakedns}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP_6 -j MARK --set-mark 88" 2>/dev/null
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${chn_list}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")" 2>/dev/null
[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt6_set_name) -j MARK --set-mark 88" 2>/dev/null
[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j MARK --set-mark 88" 2>/dev/null
}
[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j DROP"
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black_set_name) -j DROP"
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw_set_name) -j DROP"
[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j DROP")"
[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt_set_name) -j DROP"
[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j DROP"
[ "${use_fakedns}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-d $FAKE_IP -j MARK --set-mark 88"
[ "${use_proxy_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $black_set_name) -j MARK --set-mark 88"
[ "${use_gfw_list}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $gfw_set_name) -j MARK --set-mark 88"
[ "${chn_list}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $IPSET_CHN) $(get_jump_ipt ${chn_list} "-j MARK --set-mark 88")"
[ "${use_shunt_udp}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "$(dst $shunt_set_name) -j MARK --set-mark 88"
[ "${udp_proxy_mode}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source}" $udp_proxy_drop_ports "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 UDP 端口[${udp_proxy_drop_ports}]"
}
$ipt_m -A PSW $(comment "$remarks") ${_ipt_source} -m mark --mark 88 -j ACCEPT 2>/dev/null
[ "$PROXY_IPV6" = "1" ] && {
$ip6t_m -A PSW $(comment "$remarks") ${_ipt_source} -m mark --mark 88 -j ACCEPT 2>/dev/null
}
}
[ -n "$tcp_port" ] && {
@ -587,48 +594,53 @@ load_acl() {
fi
[ -n "${TCP_PROXY_MODE}" ] || [ -n "${UDP_PROXY_MODE}" ] && {
[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK) -j DROP
[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK) -j MARK --set-mark 88
[ "${USE_DIRECT_LIST}" = "1" ] && $ipt_tmp -A PSW $(comment "默认") $(dst $IPSET_WHITE) -j RETURN
[ "$PROXY_IPV6" = "1" ] && {
[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK6) -j DROP 2>/dev/null
[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_BLOCK6) -j MARK --set-mark 88 2>/dev/null
[ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") $(dst $IPSET_WHITE6) -j RETURN 2>/dev/null
}
[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
[ "$PROXY_IPV6" = "1" ] && {
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j MARK --set-mark 88"
[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
}
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS $(dst $IPSET_SHUNT) "-j DROP"
[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS $(dst $IPSET_SHUNT) "-j MARK --set-mark 88"
[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
}
[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
[ "$PROXY_IPV6" = "1" ] && {
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j DROP"
[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP_6 -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK6) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW6) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT6) -j MARK --set-mark 88"
[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ip6t_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
}
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
}
$ipt_m -A PSW $(comment "默认") -m mark --mark 88 -j ACCEPT 2>/dev/null
[ "$PROXY_IPV6" = "1" ] && {
$ip6t_m -A PSW $(comment "默认") -m mark --mark 88 -j ACCEPT 2>/dev/null
}
}
# 加载TCP默认代理模式
@ -1016,6 +1028,9 @@ add_firewall_rule() {
is_tproxy="TPROXY"
fi
$ipt_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p tcp -j REJECT --reject-with tcp-reset
$ipt_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p udp -j REJECT
$ipt_n -N PSW
$ipt_n -A PSW $(dst $IPSET_LAN) -j RETURN
$ipt_n -A PSW $(dst $IPSET_VPS) -j RETURN
@ -1081,7 +1096,7 @@ add_firewall_rule() {
done
}
[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_BLOCK) -j DROP
[ "${USE_BLOCK_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_BLOCK) -j MARK --set-mark 88
[ "${USE_DIRECT_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT $(dst $IPSET_WHITE) -j RETURN
$ipt_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
$ipt_m -A PSW_OUTPUT -m mark --mark 255 -j RETURN
@ -1121,6 +1136,9 @@ add_firewall_rule() {
$ip6t_m -A PSW_RULE -p udp -m conntrack --ctstate NEW,RELATED -j MARK --set-xmark ${FWMARK}
$ip6t_m -A PSW_RULE -j CONNMARK --save-mark
$ip6t_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p tcp -j REJECT --reject-with tcp-reset
$ip6t_f -I FORWARD $(comment "PSW_REJECT") -m mark --mark 88 -p udp -j REJECT
$ip6t_m -N PSW
$ip6t_m -A PSW $(dst $IPSET_LAN6) -j RETURN
$ip6t_m -A PSW $(dst $IPSET_VPS6) -j RETURN
@ -1136,7 +1154,7 @@ add_firewall_rule() {
$ip6t_m -A PSW_OUTPUT -m mark --mark 255 -j RETURN
$ip6t_m -A PSW_OUTPUT $(dst $IPSET_LAN6) -j RETURN
$ip6t_m -A PSW_OUTPUT $(dst $IPSET_VPS6) -j RETURN
[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_BLOCK6) -j DROP
[ "${USE_BLOCK_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_BLOCK6) -j MARK --set-mark 88
[ "${USE_DIRECT_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT $(dst $IPSET_WHITE6) -j RETURN
$ip6t_m -A PSW_OUTPUT -m conntrack --ctdir REPLY -j RETURN
@ -1188,22 +1206,22 @@ add_firewall_rule() {
[ -n "${LOCALHOST_TCP_PROXY_MODE}" ] || [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && {
[ "$TCP_PROXY_DROP_PORTS" != "disable" ] && {
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_TCP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
}
[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j DROP"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j DROP"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j DROP"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j DROP")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j DROP"
[ "${LOCALHOST_UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-j DROP"
[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
[ "${USE_GFW_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_GFW) -j MARK --set-mark 88"
[ "${CHN_LIST}" != "0" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_CHN) $(get_jump_ipt ${CHN_LIST} "-j MARK --set-mark 88")"
[ "${USE_SHUNT_UDP}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
[ "${LOCALHOST_UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
echolog " - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
}
}
@ -1378,6 +1396,14 @@ del_firewall_rule() {
$ipt -X $chain 2>/dev/null
done
done
for ipt in "$ipt_f" "$ip6t_f"; do
for chain in "FORWARD" "INPUT" "OUTPUT"; do
for i in $(seq 1 $($ipt -nL $chain | grep -c PSW)); do
local index=$($ipt --line-number -nL $chain | grep PSW | head -1 | awk '{print $1}')
$ipt -D $chain $index 2>/dev/null
done
done
done
ip rule del fwmark ${FWMARK} 2>/dev/null
ip route del local 0.0.0.0/0 dev lo table 999 2>/dev/null

1091
luci-app-passwall/root/usr/share/passwall/rules/chnlist
View File

File diff suppressed because it is too large Load Diff

133
luci-app-passwall/root/usr/share/passwall/rules/chnroute
View File

@ -206,7 +206,8 @@
103.130.160.0/23
103.131.138.0/23
103.131.152.0/22
103.131.168.0/23
103.131.168.0/24
103.131.176.0/22
103.132.212.0/23
103.132.22.0/23
103.133.128.0/23
@ -224,7 +225,6 @@
103.140.14.0/23
103.141.10.0/23
103.142.234.0/23
103.142.82.0/23
103.142.96.0/23
103.143.16.0/22
103.143.228.0/23
@ -320,6 +320,8 @@
103.200.144.0/21
103.200.220.0/22
103.200.224.0/24
103.200.228.0/24
103.200.232.0/24
103.201.192.0/24
103.201.196.0/24
103.201.200.0/24
@ -357,6 +359,7 @@
103.212.2.0/24
103.212.4.0/22
103.212.48.0/23
103.212.50.0/24
103.213.132.0/22
103.213.144.0/23
103.213.148.0/22
@ -402,6 +405,7 @@
103.224.220.0/22
103.224.232.0/22
103.226.57.0/24
103.226.59.0/24
103.227.120.0/22
103.227.136.0/22
103.227.228.0/22
@ -443,6 +447,7 @@
103.235.220.0/22
103.235.224.0/19
103.235.85.0/24
103.236.116.0/23
103.236.120.0/22
103.236.244.0/22
103.236.248.0/21
@ -471,8 +476,7 @@
103.238.96.0/23
103.238.98.0/24
103.239.152.0/22
103.239.184.0/23
103.239.186.0/24
103.239.184.0/22
103.239.192.0/22
103.239.204.0/22
103.239.224.0/22
@ -499,7 +503,6 @@
103.244.64.0/22
103.244.80.0/22
103.245.128.0/22
103.245.23.0/24
103.246.152.0/22
103.247.168.0/22
103.247.176.0/22
@ -598,7 +601,6 @@
103.39.224.0/21
103.39.232.0/22
103.39.64.0/22
103.4.56.0/22
103.40.12.0/22
103.40.173.0/24
103.40.174.0/23
@ -736,6 +738,7 @@
103.83.44.0/22
103.83.64.0/22
103.83.72.0/22
103.84.136.0/22
103.84.170.0/23
103.85.147.0/24
103.85.164.0/22
@ -832,7 +835,8 @@
106.3.32.0/20
106.3.80.0/22
106.3.88.0/21
106.3.96.0/22
106.3.96.0/23
106.3.99.0/24
106.32.0.0/12
106.4.0.0/14
106.48.16.0/21
@ -850,7 +854,6 @@
106.80.0.0/13
106.88.0.0/14
106.92.0.0/16
107.158.37.0/24
108.165.168.0/24
108.165.240.0/24
109.244.0.0/16
@ -968,7 +971,6 @@
113.194.0.0/15
113.197.101.0/24
113.197.103.0/24
113.197.104.0/23
113.200.0.0/15
113.204.0.0/14
113.208.112.0/21
@ -2051,7 +2053,6 @@
150.138.0.0/15
150.158.0.0/16
150.223.0.0/16
150.242.120.0/22
150.242.156.0/23
150.242.168.0/22
150.242.184.0/22
@ -2064,7 +2065,9 @@
150.242.80.0/22
150.242.96.0/22
150.255.0.0/16
151.158.14.0/23
151.246.165.0/24
151.246.184.0/24
151.247.148.0/23
152.104.128.0/17
152.136.0.0/16
@ -2105,7 +2108,7 @@
155.102.198.0/24
155.102.2.0/24
155.102.20.0/24
155.102.201.0/24
155.102.200.0/23
155.102.202.0/24
155.102.205.0/24
155.102.206.0/23
@ -2130,8 +2133,9 @@
155.102.70.0/24
155.102.72.0/21
155.102.8.0/21
155.102.86.0/24
155.102.91.0/24
155.102.92.0/22
155.102.92.0/24
155.102.98.0/23
155.126.176.0/23
156.107.160.0/23
@ -2187,6 +2191,7 @@
162.14.0.0/16
163.0.0.0/16
163.125.0.0/16
163.128.254.0/23
163.142.0.0/16
163.177.0.0/16
163.179.0.0/16
@ -2241,14 +2246,13 @@
163.181.26.0/24
163.181.32.0/21
163.181.40.0/24
163.181.42.0/24
163.181.42.0/23
163.181.44.0/22
163.181.48.0/21
163.181.56.0/22
163.181.60.0/23
163.181.63.0/24
163.181.66.0/23
163.181.69.0/24
163.181.71.0/24
163.181.72.0/23
163.181.74.0/24
@ -2282,6 +2286,7 @@
163.61.202.0/23
163.61.214.0/23
164.163.236.0/22
164.37.202.0/23
165.101.208.0/23
165.101.70.0/23
166.111.0.0/16
@ -2293,7 +2298,6 @@
168.160.158.0/23
168.160.160.0/21
168.160.168.0/24
168.160.224.0/19
170.33.98.0/24
171.104.0.0/13
171.112.0.0/12
@ -2394,6 +2398,7 @@
180.91.192.0/20
180.95.128.0/17
180.96.0.0/11
181.41.212.0/24
182.128.0.0/12
182.144.0.0/13
182.157.0.0/16
@ -2440,6 +2445,7 @@
183.81.180.0/22
183.84.0.0/15
183.91.144.0/20
183.91.37.0/24
183.91.39.0/24
183.91.40.0/21
183.91.48.0/21
@ -2452,15 +2458,18 @@
185.75.173.0/24
185.75.174.0/24
188.131.128.0/17
188.220.127.0/24
188.221.14.0/24
188.221.99.0/24
189.12.48.0/24
189.31.222.0/24
189.73.18.0/24
189.75.185.0/24
189.75.186.0/24
191.217.175.0/24
191.219.18.0/24
191.222.242.0/24
191.222.244.0/24
191.222.244.0/23
191.222.43.0/24
191.44.18.0/24
192.140.160.0/19
@ -2477,7 +2486,6 @@
194.138.245.0/24
194.179.146.0/24
194.231.140.0/24
195.162.246.0/24
195.40.157.0/24
195.40.158.0/24
198.208.112.0/23
@ -2595,9 +2603,10 @@
202.46.232.0/23
202.47.104.0/21
202.55.0.0/19
202.57.192.0/24
202.57.192.0/23
202.57.196.0/22
202.57.200.0/23
202.57.202.0/24
202.57.204.0/23
202.59.213.0/24
202.59.214.0/23
@ -2640,7 +2649,9 @@
203.100.92.0/22
203.104.32.0/20
203.107.1.0/24
203.107.116.0/22
203.107.112.0/21
203.107.120.0/22
203.107.124.0/23
203.107.13.0/24
203.107.2.0/24
203.107.20.0/22
@ -2672,6 +2683,7 @@
203.119.83.0/24
203.12.91.0/24
203.12.93.0/24
203.12.95.0/24
203.129.12.0/22
203.13.81.0/24
203.130.32.0/22
@ -2737,7 +2749,8 @@
203.2.64.0/21
203.201.181.0/24
203.202.236.0/23
203.205.88.0/24
203.205.88.0/23
203.205.90.0/24
203.207.104.0/22
203.207.112.0/20
203.207.128.0/18
@ -2928,6 +2941,7 @@
203.95.128.0/23
203.95.2.0/24
203.95.4.0/22
203.99.18.0/24
203.99.20.0/22
203.99.24.0/21
204.14.76.0/24
@ -3014,7 +3028,6 @@
210.78.128.0/24
210.78.134.0/23
210.78.139.0/24
210.78.144.0/23
210.79.224.0/19
210.82.0.0/15
210.87.128.0/18
@ -3058,7 +3071,8 @@
211.144.96.0/23
211.145.0.0/18
211.145.64.0/20
211.146.0.0/16
211.146.0.0/19
211.146.32.0/21
211.147.0.0/18
211.147.128.0/19
211.147.208.0/20
@ -3161,7 +3175,8 @@
211.167.64.0/18
211.64.0.0/13
211.80.0.0/13
211.88.0.0/15
211.88.0.0/16
211.89.230.0/23
211.90.0.0/17
211.90.128.0/18
211.90.192.0/20
@ -3195,7 +3210,12 @@
211.95.0.0/17
211.95.128.0/19
211.95.192.0/18
211.96.0.0/15
211.96.0.0/16
211.97.0.0/17
211.97.128.0/19
211.97.160.0/21
211.97.176.0/20
211.97.192.0/18
211.98.0.0/16
211.99.128.0/18
211.99.16.0/23
@ -3209,6 +3229,7 @@
212.189.97.0/24
212.64.0.0/17
213.210.55.0/24
216.75.141.0/24
218.0.0.0/11
218.100.88.0/21
218.104.0.0/15
@ -3458,7 +3479,7 @@
223.0.16.0/24
223.0.2.0/24
223.0.30.0/24
223.0.40.0/23
223.0.41.0/24
223.0.8.0/22
223.128.0.0/15
223.144.0.0/12
@ -3486,7 +3507,7 @@
223.202.0.0/24
223.202.131.0/24
223.202.132.0/24
223.202.134.0/23
223.202.135.0/24
223.202.211.0/24
223.202.212.0/24
223.202.67.0/24
@ -3577,16 +3598,14 @@
38.105.24.0/24
38.105.26.0/23
38.105.28.0/22
38.134.56.0/24
38.134.58.0/23
38.247.24.0/22
38.247.32.0/23
38.247.35.0/24
38.247.36.0/22
38.247.24.0/24
38.247.27.0/24
38.247.38.0/24
38.84.220.0/24
38.95.118.0/23
38.95.121.0/24
38.95.122.0/23
38.95.122.0/24
38.95.124.0/22
39.104.0.0/14
39.108.0.0/16
@ -3657,39 +3676,40 @@
43.102.144.0/20
43.109.0.0/23
43.109.10.0/24
43.109.100.0/23
43.109.102.0/24
43.109.100.0/22
43.109.105.0/24
43.109.107.0/24
43.109.106.0/23
43.109.108.0/22
43.109.112.0/24
43.109.114.0/23
43.109.116.0/23
43.109.118.0/24
43.109.12.0/22
43.109.120.0/24
43.109.133.0/24
43.109.134.0/23
43.109.136.0/22
43.109.140.0/23
43.109.143.0/24
43.109.144.0/23
43.109.146.0/24
43.109.148.0/24
43.109.148.0/23
43.109.150.0/24
43.109.156.0/24
43.109.16.0/22
43.109.160.0/22
43.109.164.0/24
43.109.164.0/23
43.109.167.0/24
43.109.169.0/24
43.109.170.0/24
43.109.172.0/22
43.109.168.0/21
43.109.176.0/24
43.109.184.0/23
43.109.191.0/24
43.109.190.0/23
43.109.192.0/21
43.109.2.0/24
43.109.200.0/23
43.109.202.0/24
43.109.206.0/24
43.109.208.0/24
43.109.208.0/23
43.109.21.0/24
43.109.22.0/24
43.109.223.0/24
@ -3700,8 +3720,7 @@
43.109.30.0/23
43.109.32.0/23
43.109.34.0/24
43.109.37.0/24
43.109.38.0/23
43.109.36.0/22
43.109.4.0/23
43.109.40.0/22
43.109.44.0/23
@ -3722,7 +3741,7 @@
43.109.83.0/24
43.109.84.0/22
43.109.88.0/22
43.109.93.0/24
43.109.92.0/23
43.109.94.0/24
43.109.96.0/23
43.136.0.0/13
@ -3791,7 +3810,7 @@
43.231.46.0/23
43.231.96.0/20
43.239.120.0/22
43.239.172.0/24
43.239.172.0/23
43.240.0.0/22
43.240.124.0/22
43.240.128.0/22
@ -3903,9 +3922,14 @@
44.30.120.0/24
44.30.130.0/23
44.30.152.0/24
44.30.164.0/24
44.30.169.0/24
44.30.171.0/24
44.31.212.0/24
44.31.216.0/24
44.31.28.0/24
44.31.43.0/24
44.32.185.0/24
44.32.191.0/24
44.32.69.0/24
45.112.232.0/22
@ -3944,6 +3968,7 @@
45.124.68.0/22
45.124.76.0/22
45.124.80.0/22
45.125.25.0/24
45.125.44.0/22
45.125.56.0/22
45.126.112.0/22
@ -4030,6 +4055,7 @@
49.120.0.0/14
49.140.0.0/15
49.208.0.0/14
49.213.62.0/23
49.221.128.0/19
49.221.26.0/23
49.221.64.0/19
@ -4050,6 +4076,10 @@
5.10.140.0/24
5.10.143.0/24
50.114.121.0/24
51.146.239.0/24
51.194.210.0/24
51.241.139.0/24
51.241.143.0/24
52.130.0.0/15
52.80.0.0/15
52.82.0.0/17
@ -4218,10 +4248,13 @@
63.140.0.0/24
63.140.3.0/24
65.86.192.0/24
65.86.204.0/24
66.102.240.0/21
66.102.248.0/22
66.102.252.0/24
66.102.254.0/23
68.166.193.0/24
68.166.209.0/24
68.79.0.0/18
69.163.104.0/24
69.163.106.0/24
@ -4230,10 +4263,12 @@
69.231.128.0/18
69.234.192.0/18
69.235.128.0/18
69.33.203.0/24
71.131.192.0/18
71.132.0.0/18
71.136.64.0/18
71.137.0.0/18
78.105.125.0/24
78.105.147.0/24
78.105.182.0/23
78.154.108.0/24
@ -4258,11 +4293,12 @@
8.150.64.0/23
8.152.0.0/13
8.160.0.0/15
8.162.0.0/18
8.162.64.0/19
8.162.0.0/17
8.163.0.0/16
8.164.0.0/14
8.168.0.0/15
8.176.0.0/17
8.176.128.0/19
8.25.82.0/24
8.38.121.0/24
8.45.176.0/24
@ -4284,4 +4320,5 @@
87.76.221.0/24
87.76.222.0/24
87.83.2.0/24
92.118.189.0/24
94.191.0.0/17

344
luci-app-passwall/root/usr/share/passwall/rules/chnroute6
View File

@ -4,7 +4,11 @@
2001:4510:1480::/41
2001:4510:400::/40
2001:4511:1480::/41
2001:678:10d0::/48
2001:678:120::/48
2001:678:53c::/48
2001:67c:c28::/48
2001:67c:ebc::/48
2001:c68::/32
2001:cc0::/32
2001:da8::/32
@ -12,6 +16,7 @@
2001:daa:2::/47
2001:daa:4::/47
2001:daa:6::/48
2001:daa:9::/48
2001:dc7::/32
2001:dd8:1::/48
2001:dd9::/48
@ -21,7 +26,6 @@
2400:3200::/32
2400:5280:f803::/48
2400:5a00::/32
2400:5a60:2::/48
2400:6000::/32
2400:6600::/32
2400:6e60:1301::/48
@ -75,12 +79,14 @@
2400:9380:9260::/48
2400:9380:9271::/48
2400:9380:9280::/47
2400:9380:9282::/48
2400:9380:92b1::/48
2400:9380:92b2::/47
2400:9380:92b4::/46
2400:95e0::/48
2400:9600:8800::/48
2400:9620::/32
2400:a040::/32
2400:a860:1::/48
2400:a860:2::/47
2400:a860:4::/47
@ -181,7 +187,7 @@
2401:ec00::/32
2401:f860:100::/40
2401:f860:85::/48
2401:f860:88::/47
2401:f860:88::/48
2401:f860:90::/48
2401:f860:92::/47
2401:f860:94::/48
@ -208,8 +214,10 @@
2402:4440:a000::/39
2402:4440:a800::/46
2402:4440:a810::/46
2402:4820::/32
2402:4b80::/32
2402:4e00::/32
2402:5920::/48
2402:5e40::/32
2402:5ec0::/32
2402:6e80::/32
@ -280,36 +288,151 @@
2403:b400::/32
2403:c80::/32
2403:c980::/32
2403:cec0::/32
2403:d400::/32
2403:e7c0:3::/48
2403:f4c0::/48
2403:ffc0:1100::/40
2403:ffc0:1200::/39
2404:1c40:503::/48
2404:1c80::/32
2404:2280:105::/48
2404:2280:10b::/48
2404:2280:106::/47
2404:2280:109::/48
2404:2280:10a::/47
2404:2280:10d::/48
2404:2280:112::/48
2404:2280:10f::/48
2404:2280:112::/47
2404:2280:115::/48
2404:2280:11c::/48
2404:2280:116::/48
2404:2280:11a::/47
2404:2280:11c::/46
2404:2280:123::/48
2404:2280:127::/48
2404:2280:12b::/48
2404:2280:125::/48
2404:2280:126::/47
2404:2280:128::/46
2404:2280:12e::/48
2404:2280:130::/48
2404:2280:134::/48
2404:2280:136::/47
2404:2280:138::/48
2404:2280:13b::/48
2404:2280:13c::/47
2404:2280:142::/48
2404:2280:147::/48
2404:2280:14f::/48
2404:2280:150::/48
2404:2280:154::/48
2404:2280:156::/47
2404:2280:17b::/48
2404:2280:159::/48
2404:2280:15d::/48
2404:2280:15e::/47
2404:2280:160::/48
2404:2280:170::/48
2404:2280:177::/48
2404:2280:17a::/47
2404:2280:17c::/46
2404:2280:180::/47
2404:2280:183::/48
2404:2280:18a::/48
2404:2280:18d::/48
2404:2280:18e::/47
2404:2280:187::/48
2404:2280:18a::/47
2404:2280:18c::/46
2404:2280:190::/48
2404:2280:193::/48
2404:2280:196::/48
2404:2280:19a::/47
2404:2280:19c::/48
2404:2280:277::/48
2404:2280:198::/45
2404:2280:1a4::/46
2404:2280:1a8::/47
2404:2280:1b0::/48
2404:2280:1b2::/48
2404:2280:1b4::/46
2404:2280:1b8::/47
2404:2280:1ba::/48
2404:2280:1bf::/48
2404:2280:1c1::/48
2404:2280:1c2::/47
2404:2280:1c4::/46
2404:2280:1c8::/48
2404:2280:1cb::/48
2404:2280:1cc::/48
2404:2280:1cf::/48
2404:2280:1d0::/47
2404:2280:1d3::/48
2404:2280:1d4::/48
2404:2280:1d6::/47
2404:2280:1d8::/45
2404:2280:1e0::/45
2404:2280:1e8::/46
2404:2280:1ec::/47
2404:2280:1ee::/48
2404:2280:1f0::/45
2404:2280:1f8::/46
2404:2280:1fe::/48
2404:2280:201::/48
2404:2280:202::/47
2404:2280:205::/48
2404:2280:206::/47
2404:2280:208::/46
2404:2280:20c::/47
2404:2280:20e::/48
2404:2280:210::/46
2404:2280:214::/48
2404:2280:216::/47
2404:2280:218::/46
2404:2280:21d::/48
2404:2280:21e::/48
2404:2280:221::/48
2404:2280:226::/47
2404:2280:259::/48
2404:2280:25a::/47
2404:2280:25c::/48
2404:2280:265::/48
2404:2280:266::/47
2404:2280:268::/45
2404:2280:270::/44
2404:2280:282::/47
2404:2280:284::/47
2404:2280:288::/46
2404:2280:28c::/48
2404:2280:291::/48
2404:2280:292::/48
2404:2280:296::/47
2404:2280:298::/46
2404:2280:29c::/47
2404:2280:2a0::/47
2404:2280:2a3::/48
2404:2280:2a4::/46
2404:2280:2a9::/48
2404:2280:2aa::/48
2404:2280:2ad::/48
2404:2280:2ae::/47
2404:2280:2b1::/48
2404:2280:2b2::/47
2404:2280:2b5::/48
2404:2280:2b6::/47
2404:2280:2b8::/47
2404:2280:2ba::/48
2404:2280:2bc::/46
2404:2280:2c2::/47
2404:2280:2c5::/48
2404:2280:2c6::/47
2404:2280:2c8::/46
2404:2280:2cd::/48
2404:2280:2ce::/47
2404:2280:2da::/47
2404:2280:2dc::/47
2404:2280:2df::/48
2404:2280:2f1::/48
2404:2280:2f2::/48
2404:2280:2f6::/47
2404:2280:2f8::/47
2404:2280:2fb::/48
2404:2280:2fc::/48
2404:2280:308::/46
2404:2280:30d::/48
2404:2280:313::/48
2404:2280:314::/48
2404:2280:317::/48
2404:3700::/48
2404:4dc0::/32
2404:6380:1000::/48
@ -332,6 +455,8 @@
2404:7240::/33
2404:7600::/32
2404:7940::/32
2404:8d02:28c8::/48
2404:8d02:4881::/48
2404:bc0:1::/48
2404:bc0:4000::/43
2404:bc0:4100::/43
@ -339,6 +464,7 @@
2404:bc0:4300::/44
2404:bc0:4400::/43
2404:bc0:4500::/43
2404:bc0:4620::/44
2404:bc0:4f00::/43
2404:c2c0:240::/44
2404:c2c0:280::/44
@ -355,10 +481,12 @@
2404:c940::/48
2404:e280::/47
2404:e8c0::/32
2404:eb80::/48
2404:f4c0:f000::/44
2405:1480:1000::/48
2405:1480:2000::/48
2405:1480:3000::/47
2405:1640:6::/48
2405:3140:11::/48
2405:3140:21::/48
2405:3140:31::/48
@ -450,7 +578,7 @@
2406:840:981a::/48
2406:840:981c::/46
2406:840:9962::/47
2406:840:9966::/48
2406:840:9966::/47
2406:840:996c::/48
2406:840:9970::/44
2406:840:a10::/48
@ -463,16 +591,14 @@
2406:840:e0cf::/48
2406:840:e0e0::/46
2406:840:e0e4::/47
2406:840:e0e8::/48
2406:840:e10f::/48
2406:840:e14f::/48
2406:840:e280::/44
2406:840:e301::/48
2406:840:e302::/48
2406:840:e302::/47
2406:840:e304::/48
2406:840:e306::/48
2406:840:e330::/44
2406:840:e57e::/48
2406:840:e600::/44
2406:840:e620::/47
2406:840:e80f::/48
@ -488,6 +614,7 @@
2406:840:ee4b::/48
2406:840:ee4d::/48
2406:840:eee5::/48
2406:840:eff0::/44
2406:840:f0a1::/48
2406:840:f0aa::/48
2406:840:f380::/44
@ -500,49 +627,19 @@
2406:840:f86c::/48
2406:840:f889::/48
2406:840:fa01::/48
2406:840:fa40::/48
2406:840:fa60::/44
2406:840:fc10::/47
2406:840:fc12::/48
2406:840:fc20::/47
2406:840:fc22::/48
2406:840:fc30::/47
2406:840:fc32::/48
2406:840:fc40::/47
2406:840:fc42::/48
2406:840:fc50::/47
2406:840:fc52::/48
2406:840:fc60::/47
2406:840:fc62::/48
2406:840:fc70::/47
2406:840:fc72::/48
2406:840:fc90::/47
2406:840:fc92::/48
2406:840:fca0::/47
2406:840:fca2::/48
2406:840:fcb0::/47
2406:840:fcb2::/48
2406:840:fc10::/44
2406:840:fc20::/43
2406:840:fc40::/42
2406:840:fc90::/44
2406:840:fca0::/43
2406:840:fcd0::/48
2406:840:fcf0::/46
2406:840:fcf4::/47
2406:840:fd30::/44
2406:840:fd40::/48
2406:840:fd46::/47
2406:840:fd48::/48
2406:840:fd50::/48
2406:840:fd56::/47
2406:840:fd58::/48
2406:840:fd60::/48
2406:840:fd66::/47
2406:840:fd68::/48
2406:840:fd70::/48
2406:840:fd76::/47
2406:840:fd78::/48
2406:840:fd80::/48
2406:840:fd86::/47
2406:840:fd88::/48
2406:840:fd90::/47
2406:840:fd92::/48
2406:840:fd9f::/48
2406:840:fd40::/42
2406:840:fd80::/43
2406:840:fda0::/48
2406:840:fda7::/48
2406:840:fdb0::/48
@ -1276,8 +1373,10 @@
2602:f92a:a462::/48
2602:f92a:a468::/48
2602:f92a:a46d::/48
2602:f92a:a470::/48
2602:f92a:a474::/48
2602:f92a:a47d::/48
2602:f92a:dead::/48
2602:f9ba:10c::/48
2602:f9f6:400::/47
2602:f9f6:402::/48
@ -1305,6 +1404,8 @@
2605:9d80:9092::/48
2804:1e48:9001::/48
2804:1e48:9002::/48
2a01:e281:a400::/48
2a01:e281:a410::/44
2a04:3e00:1002::/48
2a04:f580:8010::/47
2a04:f580:8090::/48
@ -1336,25 +1437,55 @@
2a06:3600:fc00::/38
2a06:3605::/32
2a06:3606::/31
2a06:9801:74c::/48
2a06:9f81:4600::/42
2a06:9f81:4640::/43
2a06:9f81:4660::/44
2a06:a005:2040::/44
2a06:a005:260::/43
2a06:a005:280::/43
2a06:a005:2a0::/44
2a06:a005:e50::/44
2a06:a005:e70::/44
2a07:54c1:2200::/46
2a07:54c1:2205::/48
2a0a:6040:6c40::/44
2a0a:6040:c700::/42
2a0a:6040:c770::/44
2a0a:6040:c7a0::/48
2a0a:6040:d600::/44
2a0a:6040:d610::/46
2a0a:6040:d615::/48
2a0a:6040:d616::/48
2a0a:6040:d618::/47
2a0a:6040:d623::/48
2a0a:6040:d624::/48
2a0a:6040:d629::/48
2a0a:6040:e541::/48
2a0a:6040:e543::/48
2a0a:6040:e544::/48
2a0a:6040:e54c::/48
2a0a:d680:8100::/47
2a0a:d680:a31::/48
2a0a:d681:e000::/40
2a0a:d681:fb00::/40
2a0a:d681:fc00::/38
2a0a:d685:1ff::/48
2a0a:d685:200::/48
2a0a:d685:1fe::/47
2a0a:d685:200::/47
2a0a:d685:300::/40
2a0a:d687:f001::/48
2a0a:d687:f004::/47
2a0a:d687:f007::/48
2a0a:d687:f008::/48
2a0b:4340:90::/48
2a0b:4340:97::/48
2a0b:4e07:b8::/47
2a0c:b641:570::/47
2a0c:b641:573::/48
2a0d:c7c7:400::/38
2a0e:4005:ff13::/48
2a0e:4005:ff20::/48
2a0e:97c0:5ef::/48
2a0e:aa06:400::/44
2a0e:aa06:440::/48
2a0e:aa06:450::/44
@ -1364,6 +1495,7 @@
2a0e:aa07:e144::/48
2a0e:aa07:e146::/48
2a0e:aa07:e148::/48
2a0e:aa07:e1a0::/44
2a0e:aa07:e280::/47
2a0e:aa07:e284::/46
2a0e:aa07:e288::/46
@ -1375,6 +1507,7 @@
2a0e:aa07:f0de::/47
2a0e:b107:14a0::/44
2a0e:b107:1522::/48
2a0e:b107:1a40::/46
2a0e:b107:2440::/44
2a0e:b107:740::/44
2a0e:b107:da0::/44
@ -1385,15 +1518,16 @@
2a0f:1cc5:1041::/48
2a0f:1cc5:110::/44
2a0f:1cc5:130::/44
2a0f:1cc5:1310::/44
2a0f:1cc5:140::/42
2a0f:1cc5:14::/46
2a0f:1cc5:1600::/44
2a0f:1cc5:1901::/48
2a0f:1cc5:1c00::/47
2a0f:1cc5:1c02::/48
2a0f:1cc5:1c20::/48
2a0f:1cc5:1c30::/48
2a0f:1cc5:1cc0::/48
2a0f:1cc5:1d10::/47
2a0f:1cc5:1f::/48
2a0f:1cc5:2000::/40
2a0f:1cc5:2510::/44
@ -1402,32 +1536,50 @@
2a0f:1cc5:2680::/42
2a0f:1cc5:2d01::/48
2a0f:1cc5:2d03::/48
2a0f:1cc5:3203::/48
2a0f:1cc5:3222::/48
2a0f:1cc5:3700::/43
2a0f:1cc5:40::/48
2a0f:1cc5:4508::/46
2a0f:1cc5:450c::/47
2a0f:1cc5:45ff::/48
2a0f:1cc5:4700::/40
2a0f:1cc5:600::/47
2a0f:1cc5:603::/48
2a0f:1cc5:642::/48
2a0f:1cc5:661::/48
2a0f:1cc5:662::/48
2a0f:1cc5:6a0::/48
2a0f:1cc5:f01::/48
2a0f:1cc5:f02::/47
2a0f:1cc5:f04::/46
2a0f:1cc5:a00::/48
2a0f:1cc5:c01::/48
2a0f:1cc5:f00::/45
2a0f:1cc5:f08::/47
2a0f:1cc5:fff::/48
2a0f:1cc6:b110::/47
2a0f:1cc6:b210::/47
2a0f:1cc6:b212::/48
2a0f:2706::/32
2a0f:6280:1400::/44
2a0f:6280:1430::/44
2a0f:6280:1440::/43
2a0f:6280:1460::/44
2a0f:6280:1480::/44
2a0f:6284:4c00::/43
2a0f:6284:4c20::/44
2a0f:6284:4c30::/48
2a0f:6284:4c40::/43
2a0f:6284:4c60::/44
2a0f:6284:4c80::/43
2a0f:6284:4ca0::/44
2a0f:6284:4cc0::/43
2a0f:85c1:bfe::/48
2a0f:9400:6110::/48
2a10:ccc0:cc1::/48
2a10:ccc0:cc2::/48
2a10:ccc0:ccc::/48
2a12:3fc2:aa40::/44
2a12:cb41:1200::/44
2a12:cb41:1300::/44
2a12:cb41:1300::/43
2a12:cb41:13f0::/44
2a12:cb41:600::/44
2a12:cb41::/44
2a12:cb46::/36
2a12:cb47:ffff::/48
@ -1439,23 +1591,50 @@
2a13:1801:200::/44
2a13:1802::/43
2a13:8c87::/32
2a13:9500:194::/47
2a13:a5c3:f000::/40
2a13:a5c3:ff41::/48
2a13:a5c3:ff50::/44
2a13:a5c5::/48
2a13:aac4:f000::/44
2a13:b487:1200::/42
2a14:67c1:b500::/48
2a13:b487:1330::/47
2a14:67c1:70::/48
2a14:67c1:74::/47
2a14:67c1:a020::/48
2a14:67c1:a023::/48
2a14:67c1:a024::/48
2a14:67c1:a02a::/48
2a14:67c1:a02f::/48
2a14:67c1:a110::/44
2a14:67c1:a123::/48
2a14:67c1:a125::/48
2a14:67c1:a128::/48
2a14:67c1:a144::/48
2a14:67c1:b100::/46
2a14:67c1:b105::/48
2a14:67c1:b107::/48
2a14:67c1:b110::/48
2a14:67c1:b130::/46
2a14:67c1:b134::/48
2a14:67c1:b136::/48
2a14:67c1:b141::/48
2a14:67c1:b142::/47
2a14:67c1:b146::/47
2a14:67c1:b148::/48
2a14:67c1:b511::/48
2a14:67c1:b514::/48
2a14:67c1:b530::/44
2a14:67c1:b563::/48
2a14:67c1:b578::/48
2a14:67c1:b582::/48
2a14:67c1:b586::/47
2a14:67c1:b588::/47
2a14:67c1:b590::/48
2a14:67c1:b599::/48
2a14:67c1:b5e0::/44
2a14:67c2:519::/48
2a14:67c1:c300::/40
2a14:67c1:c600::/40
2a14:67c2:500::/40
2a14:67c2:a10::/47
2a14:67c2:a21::/48
2a14:67c2:a22::/47
@ -1466,9 +1645,19 @@
2a14:67c2:a70::/47
2a14:67c2:a80::/47
2a14:67c2:a90::/48
2a14:67c3:1100::/47
2a14:67c2:aa1::/48
2a14:67c2:c05::/48
2a14:67c2:c08::/47
2a14:67c2:c0c::/47
2a14:67c3:190::/47
2a14:67c3:192::/48
2a14:67c3:30::/44
2a14:67c3:360::/48
2a14:67c3:9990::/44
2a14:67c3:c0::/48
2a14:67c3:caf0::/44
2a14:67c3:fff0::/44
2a14:7580:730::/44
2a14:7580:740::/44
2a14:7580:d00::/43
2a14:7580:d20::/46
@ -1476,15 +1665,22 @@
2a14:7580:d42::/47
2a14:7580:dff::/48
2a14:7580:fffa::/48
2a14:7581:3810::/47
2a14:7581:30b6::/48
2a14:7581:3100::/40
2a14:7581:3810::/48
2a14:7581:3814::/48
2a14:7581:ffb::/48
2a14:7583:efff::/48
2a14:7583:f220::/43
2a14:7583:f240::/42
2a14:7583:f300::/46
2a14:7583:f304::/47
2a14:7583:f306::/48
2a14:7583:f411::/48
2a14:7583:f4f0::/48
2a14:7583:f4f0::/47
2a14:7583:f4f4::/48
2a14:7583:f4fe::/48
2a14:7583:f500::/48
2a14:7583:f701::/48
2a14:7583:f703::/48
2a14:7583:f704::/46
@ -1495,13 +1691,15 @@
2a14:7583:f764::/48
2a14:7586:6100::/47
2a14:7586:6103::/48
2a14:7586:6104::/47
2a14:7586:6106::/48
2a14:7586:6104::/46
2a14:7586:6108::/48
2a14:7586:6110::/48
2a14:7586:6113::/48
2a14:7586:6300::/44
2a14:7586:6500::/48
2a14:7dc0:506::/48
2a14:7dc0:520::/48
2a14:7dc0:52f::/48
2a14:ae00:50::/44
2c0f:f7a8:8011::/48
2c0f:f7a8:8050::/48

20
luci-app-passwall/root/usr/share/passwall/rules/gfwlist
View File

@ -131,6 +131,7 @@ aiosearch.com
aiph.net
airconsole.com
airitilibrary.com
airuniversity.af.edu
airvpn.org
ait.org.tw
aiweiweiblog.com
@ -870,6 +871,7 @@ crazypool.org
crazyshit.com
crbug.com
crchina.org
creader.com
creaders.net
creativelab5.com
cristyli.com
@ -1161,6 +1163,7 @@ expatshield.com
expecthim.com
expekt.com
exploader.net
expressnews.com
expressvpn.com
exrates.me
extmatrix.com
@ -1403,6 +1406,7 @@ gaoming.net
gaopi.net
gartlive.com
garudalinux.org
gate.com
gate.io
gatecoin.com
gather.com
@ -1423,6 +1427,7 @@ generated.photos
genius.com
geph.io
get.app
get.dappcdn.com
get.dev
get.how
get.page
@ -1779,6 +1784,7 @@ gtv.org
gtv1.org
gu-chu-sum.org
guaguass.com
guangming.com.my
guishan.org
gumroad.com
gunsamerica.com
@ -1869,6 +1875,7 @@ hkgolden.com
hkgpao.com
hklts.org.hk
hkmap.live
hkong.hk
hkopentv.com
hkpeanut.com
hkreporter.com
@ -2173,6 +2180,7 @@ kenengba.com
kepard.com
kex.com
keycdn.com
kfor.com
khatrimaza.org
kichiku-doujinko.com
kik.com
@ -2425,6 +2433,7 @@ mfxmedia.com
mgoon.com
mgstage.com
mh4u.org
mhwindow.org
microvpn.com
mihua.org
mij.rip
@ -2809,6 +2818,7 @@ pbs.org
pbworks.com
pbxes.com
pbxes.org
pcgamesn.com
pcgamestorrents.com
pcij.org
pct.org.tw
@ -2827,6 +2837,7 @@ peoplenews.tw
peopo.org
perfect-privacy.com
periscope.tv
perma.cc
perplexity.ai
pewresearch.org
phayul.com
@ -3075,6 +3086,7 @@ rentry.co
renyurenquan.org
resilio.com
resistchina.org
restofworld.org
retweetrank.com
reuters.com
reutersmedia.net
@ -3310,6 +3322,7 @@ southmongolia.org
southnews.com.tw
southpark.cc.com
sowers.org.hk
spaceforce.mil
spaces.hightail.com
spacex.com
spankbang.com
@ -3401,6 +3414,7 @@ superpages.com
supervpn.net
superzooi.com
support.futunn.com
supremecourt.gov
suprememastertv.com
surfeasy.com
surfeasy.com.au
@ -3511,6 +3525,7 @@ thehansindia.com
thehindu.com
thehun.net
theinitium.com
theintercept.com
thenewslens.com
thepiratebay.org
theporndude.com
@ -3668,6 +3683,7 @@ trendsmap.com
tronscan.org
trouw.nl
trt.net.tr
trtworld.com
truebuddha-md.org
trustwallet.com
truthsocial.com
@ -3763,6 +3779,7 @@ twitturk.com
twitturly.com
twkan.com
twreporter.org
twstalker.com
twt.tl
twtkr.com
twttr.com
@ -3977,6 +3994,7 @@ wanz-factory.com
warroom.org
waselpro.com
washingtonpost.com
washingtontimes.com
watchinese.com
watchmygf.net
watchout.tw
@ -3995,6 +4013,7 @@ webmproject.org
webpkgcache.com
webrtc.org
websdr.org
webshare.io
website.new
webwarper.net
wechatlawsuit.com
@ -4197,6 +4216,7 @@ xskywalker.com
xt.com
xt.pub
xtube.com
xuan.com.my
xuchao.net
xuchao.org
xuehua.us

2
luci-theme-aurora/.dev/.env.example
View File

@ -1,4 +1,4 @@
# Optional — run `pnpm setup` once and you usually don't need a .env at all.
# Optional — run `pnpm setup:router` once and it writes/updates every value below.
# OpenWrt router address — bare IP/hostname; the web proxy target and the
# .ut-sync ssh target both derive from it (ssh key selection etc. belongs

4
luci-theme-aurora/.dev/.npmrc Normal file
View File

@ -0,0 +1,4 @@
# Fail `pnpm install` early with a clear message on unsupported Node versions
# (the range in package.json `engines` mirrors Vite 7's requirement) instead
# of letting the install die somewhere deep inside a dependency.
engine-strict=true

35
luci-theme-aurora/.dev/docs/DEVELOPMENT.md
View File

@ -4,7 +4,7 @@ This guide covers the complete development workflow for the Aurora theme, from e
## Prerequisites
- **[Node.js v20.19+](https://nodejs.org/en/download)** - JavaScript runtime
- **[Node.js 20.19+ / 22.12+](https://nodejs.org/en/download)** - JavaScript runtime (mirrors Vite 7's support range — odd releases like 21.x don't qualify; enforced at `pnpm install` time via `engines` + `engine-strict`, so an unsupported Node fails fast with a clear message)
- **pnpm** - Package manager (managed via [Corepack](https://github.com/nodejs/corepack))
- **Tailwind CSS knowledge** - Required for styling. See [Tailwind CSS Documentation](https://tailwindcss.com/docs)
- **Network access** - Development machine must be on the same network as your OpenWrt router
@ -28,11 +28,29 @@ pnpm install
### 2. Configure Environment
```bash
# One-shot wizard: asks for the router IP, generates/installs an SSH key
# (one router-password prompt), and writes .env
pnpm setup
# One-shot wizard: asks for every .env value (router IP, dev-server host/port,
# current .env entries as defaults), generates/installs an SSH key (one
# router-password prompt), verifies template sync end-to-end, and writes .env
pnpm setup:router
# Non-interactive: pass the IP directly (no prompts; dev-server values keep
# their saved .env entries or defaults)
pnpm setup:router 192.168.2.1
```
> The script is named `setup:router` (not `setup`) because `pnpm setup` resolves to pnpm's own built-in setup command and would never run a package script.
**What it does** (`scripts/setup.js`), in order:
1. **Collects the `.env` values.** With no argument it prompts for each variable in turn, showing the current `.env` entry as the default (an empty answer keeps it). With an IP argument it takes that as `VITE_OPENWRT_HOST` non-interactively and leaves the dev-server values alone. Nothing is written yet — `.env` is only updated once every step below has succeeded.
2. **Pre-flights the connection.** A raw TCP probe of `<host>:22` with a 2s timeout, so an unreachable device or one with SSH disabled fails immediately with a clear message instead of hanging inside ssh.
3. **Finds or generates an SSH key.** It looks for `~/.ssh/id_ed25519.pub`, `id_rsa.pub`, `id_ecdsa.pub` in that order and reuses the first one present — an existing key is never overwritten. **If you have no key at all, it generates one** (`ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519`). The empty passphrase is deliberate: `.ut` sync has to run unattended for the whole `pnpm dev` session.
4. **Installs the public key on the router.** It first tests whether passwordless SSH already works (`ssh -o BatchMode=yes … echo ok`) and skips the install if so — after a full reflash that wipes the key, the test fails and the install simply runs again. Otherwise it appends the key to `/etc/dropbear/authorized_keys` over one interactive SSH session; the append is guarded by `grep -qxF`, so re-running never duplicates the entry. **This is the only step that asks for the router's root password, and it asks once.** Afterwards it re-tests passwordless auth and classifies any failure (wrong password / host unreachable / other). On a device running openssh rather than dropbear the key belongs in `/root/.ssh/authorized_keys` instead — install it manually there and this step detects it and skips.
5. **Verifies the sync end-to-end.** Rather than trusting `echo ok`, it pushes `ucode/template/themes/aurora/` through the exact `tar -cf - | ssh … tar -xf -` pipeline the `ut-sync` plugin uses (see [Template (`.ut`) Live Sync](#template-ut-live-sync)). If this passes, `pnpm dev`'s template sync will too.
6. **Writes `.env`.** Managed keys are rewritten in place so surrounding comments keep their meaning, missing ones are appended, and any other line passes through untouched.
> The password prompt in step 4 comes from the **local** ssh client, which reads it straight from `/dev/tty` rather than stdin — so it shows up normally even though the script pipes ssh's stderr in order to classify errors. It does mean the step needs a controlling terminal **on the development machine** (the router side is unaffected): run it from a normal shell, not from CI, `nohup`, or an editor task pane, where ssh has no way to ask and the run fails at authentication. Check with `tty` if unsure; in such an environment, install the key by hand instead.
If the router is at the default `192.168.1.1` and passwordless SSH already works, no `.env` is needed at all — every value below has a working default.
**Environment Variables** (all optional):
@ -182,11 +200,11 @@ For LuCI-specific JavaScript development, refer to the official API documentatio
- **CSS changes**: Trigger full page reload via custom HMR handler
- **JS changes**: Trigger full page reload via custom HMR handler
- **Template changes** (`.ut` files): Auto-synced to router over SSH and trigger full page reload (one-time `pnpm setup` required, see below)
- **Template changes** (`.ut` files): Auto-synced to router over SSH and trigger full page reload (one-time `pnpm setup:router` required, see below)
### Template (`.ut`) Live Sync
The `.ut` template files are rendered server-side on the OpenWrt device, so unlike CSS/JS they can't be served locally — the dev server pushes them to the router instead. Run `pnpm setup` once to configure passwordless SSH; after that it's fully automatic:
The `.ut` template files are rendered server-side on the OpenWrt device, so unlike CSS/JS they can't be served locally — the dev server pushes them to the router instead. Run `pnpm setup:router` once to configure passwordless SSH; after that it's fully automatic:
- **On startup**, the whole template directory is pushed (as one tarball over ssh stdin — Dropbear has no SFTP server for scp), so edits made while the dev server was down never leave the router stale.
- **On save**, changes are debounced and the directory is pushed again, then the browser reloads.
@ -195,7 +213,7 @@ The `.ut` template files are rendered server-side on the OpenWrt device, so unli
**Troubleshooting** — sync errors are printed with the fix:
- **Host key mismatch** (device was reflashed): Run `ssh-keygen -R <device-ip>`, then restart the dev server
- **Authentication failed** (public key not on device): Run `pnpm setup`
- **Authentication failed** (public key not on device, e.g. after a reflash): Run `pnpm setup:router`
- **Connection refused/timed out**: Check that the device is online and SSH is enabled
A failed sync is retried on the next `.ut` change; CSS/JS dev features work normally without SSH.
@ -271,7 +289,8 @@ luci-theme-aurora/
│ │ └── images/ # Theme images + PWA icons
│ ├── scripts/ # Build scripts
│ │ ├── clean.js # Build cleanup utility
│ │ └── gen-tokens.js # Regenerates src/media/_tokens.css from @eamonxg/aurora-tokens
│ │ ├── gen-tokens.js # Regenerates src/media/_tokens.css from @eamonxg/aurora-tokens
│ │ └── setup.js # pnpm setup:router — .env wizard + passwordless SSH to the router
│ ├── src/ # Source code
│ │ ├── assets/icons/ # SVG icons
│ │ ├── media/ # CSS source (Tailwind CSS v4)

5
luci-theme-aurora/.dev/package.json
View File

@ -4,12 +4,15 @@
"type": "module",
"scripts": {
"dev": "vite",
"setup": "node scripts/setup.js",
"setup:router": "node scripts/setup.js",
"build": "npm run clean && npm run gen:tokens && vite build",
"clean": "node scripts/clean.js",
"gen:tokens": "node scripts/gen-tokens.js",
"test": "node --test tests/*.test.js"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"devDependencies": {
"@eamonxg/aurora-tokens": "^1.2.0",
"@tailwindcss/vite": "^4.1.11",

210
luci-theme-aurora/.dev/scripts/setup.js
View File

@ -1,12 +1,19 @@
/**
* One-shot dev environment setup: writes .env and installs an SSH key on the
* router so ut-sync works without any manual ssh configuration.
* Router connection setup: writes .env and installs an SSH key on the router
* so ut-sync works without any manual ssh configuration.
*
* Usage: pnpm setup (asks for the router IP, then one router password prompt)
* Usage: pnpm setup:router [ip]
* ip router address; omit for the interactive wizard, which asks for
* every .env value (router IP, dev-server host/port) with the
* current .env entries as defaults
*
* (The script is named `setup:router` because plain `pnpm setup` resolves to
* pnpm's own built-in setup command, never a package.json script.)
*/
import { spawnSync } from "node:child_process";
import { execSync, spawnSync } from "node:child_process";
import { existsSync, readFileSync, writeFileSync } from "node:fs";
import { connect } from "node:net";
import { homedir } from "node:os";
import { join, resolve } from "node:path";
import { createInterface } from "node:readline/promises";
@ -18,22 +25,121 @@ const SSH_OPTS = [
"UserKnownHostsFile=/dev/null",
];
// Must match the ut-sync plugin in vite.config.ts — the final push below is a
// real template sync, so setup only succeeds if `pnpm dev` sync will too.
const UT_TEMPLATE_DIR = resolve(
process.cwd(),
"../ucode/template/themes/aurora",
);
const UT_REMOTE_DIR = "/usr/share/ucode/luci/template/themes/aurora";
function canAuth(host) {
return (
spawnSync(
"ssh",
[...SSH_OPTS, "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", host, "echo ok"],
[
...SSH_OPTS,
"-o",
"BatchMode=yes",
"-o",
"ConnectTimeout=5",
host,
"echo ok",
],
{ stdio: "ignore" },
).status === 0
);
}
const rl = createInterface({ input: process.stdin, output: process.stdout });
const ip =
(await rl.question("Router IP [192.168.1.1]: ")).trim() || "192.168.1.1";
rl.close();
function canReachSsh(hostname, timeout = 2000) {
return new Promise((done) => {
const sock = connect({ host: hostname, port: 22, timeout });
const finish = (ok) => {
sock.destroy();
done(ok);
};
sock.once("connect", () => finish(true));
sock.once("timeout", () => finish(false));
sock.once("error", () => finish(false));
});
}
console.log("Aurora router setup — passwordless SSH + .env for `pnpm dev`\n");
const args = process.argv.slice(2);
const argIp = args.find((a) => !a.startsWith("-"));
// Every variable the wizard manages (the full .env surface, see
// .env.example); any other lines in .env pass through untouched.
const ENV_VARS = [
{ key: "VITE_OPENWRT_HOST", label: "Router IP", fallback: "192.168.1.1" },
{ key: "VITE_DEV_HOST", label: "Dev server host", fallback: "127.0.0.1" },
{ key: "VITE_DEV_PORT", label: "Dev server port", fallback: "5173" },
];
const envPath = resolve(process.cwd(), ".env");
const envLines = existsSync(envPath)
? readFileSync(envPath, "utf-8").split("\n")
: [];
const savedValue = (key) =>
envLines
.find((l) => l.startsWith(`${key}=`))
?.slice(key.length + 1)
.trim();
const values = Object.fromEntries(
ENV_VARS.map(({ key, fallback }) => [key, savedValue(key) || fallback]),
);
if (argIp) {
// Arg mode is non-interactive: take the IP from argv and keep the saved
// (or default) dev-server values.
values.VITE_OPENWRT_HOST = argIp;
} else {
const rl = createInterface({ input: process.stdin, output: process.stdout });
// Answers come through the async iterator — unlike rl.question, it buffers
// lines, so piped input (`printf 'ip\nhost\nport\n' | …`) is not dropped
// between questions, and EOF just leaves the remaining defaults in place.
const lines = rl[Symbol.asyncIterator]();
for (const { key, label } of ENV_VARS) {
rl.setPrompt(`${label} [${values[key]}]: `);
rl.prompt();
const { value, done } = await lines.next();
if (done) {
console.log();
break;
}
const answer = value.trim();
if (answer) values[key] = answer;
}
rl.close();
}
if (!/^\d+$/.test(values.VITE_DEV_PORT)) {
console.log(
` Ignoring invalid port "${values.VITE_DEV_PORT}" — using 5173.`,
);
values.VITE_DEV_PORT = "5173";
}
const ip = values.VITE_OPENWRT_HOST;
// Accept the same forms vite.config.ts does (bare IP, host:port, http:// URL);
// ssh always targets the bare hostname — port/key overrides live in ~/.ssh/config.
const hostname = new URL(/^https?:\/\//.test(ip) ? ip : `http://${ip}`)
.hostname;
const host = `root@${hostname}`;
if (!(await canReachSsh(hostname))) {
console.error(`✗ Cannot reach ${hostname}:22 (2s timeout).`);
console.error(
" Check that the device is powered on, on the same network, and has SSH enabled.",
);
console.error(
" (If it listens on a non-standard port, add a Host block to ~/.ssh/config.)",
);
process.exit(1);
}
const host = `root@${ip}`;
const sshDir = join(homedir(), ".ssh");
let pubKeyPath = ["id_ed25519.pub", "id_rsa.pub", "id_ecdsa.pub"]
@ -55,39 +161,93 @@ if (!pubKeyPath) {
}
if (canAuth(host)) {
console.log(`✓ Passwordless SSH to ${host} already works.`);
console.log(
`✓ Passwordless SSH to ${host} already works (checked: ssh echo).`,
);
} else {
console.log(
`Installing ${pubKeyPath} on the router (enter the router password once):`,
);
const pubKey = readFileSync(pubKeyPath, "utf-8").trim();
// stderr is piped so failures can be classified below; ssh's password prompt
// goes straight to the tty, so interactive login still works.
const install = spawnSync(
"ssh",
[
...SSH_OPTS,
"-o",
"ConnectTimeout=5",
host,
`mkdir -p /etc/dropbear && echo '${pubKey}' >> /etc/dropbear/authorized_keys && chmod 600 /etc/dropbear/authorized_keys`,
`mkdir -p /etc/dropbear && touch /etc/dropbear/authorized_keys && (grep -qxF '${pubKey}' /etc/dropbear/authorized_keys || echo '${pubKey}' >> /etc/dropbear/authorized_keys) && chmod 600 /etc/dropbear/authorized_keys`,
],
{ stdio: "inherit" },
{ stdio: ["inherit", "inherit", "pipe"], encoding: "utf-8" },
);
if (install.status !== 0 || !canAuth(host)) {
if (install.status !== 0) {
const stderr = (install.stderr || "").trim();
if (/Permission denied|Authentication failed/i.test(stderr)) {
console.error(
"✗ Authentication failed — likely a wrong password. Re-run pnpm setup:router.",
);
console.error(
" (If the device runs openssh instead of dropbear, keys belong in /root/.ssh/authorized_keys.)",
);
} else if (
/timed out|No route to host|Connection refused|Could not resolve/i.test(
stderr,
)
) {
console.error(`✗ ${hostname} did not respond as an SSH host.`);
console.error(
" Check the IP and that SSH is enabled on the device. (A VPN/proxy in TUN mode can also intercept the connection.)",
);
} else {
console.error("✗ Key install failed:");
}
if (stderr) console.error(` ${stderr.replace(/\n/g, "\n ")}`);
process.exit(1);
}
if (!canAuth(host)) {
console.error("✗ Key installed, but passwordless SSH still fails.");
console.error(
`✗ Key install failed. Check that the device at ${ip} is reachable and the password is correct, then re-run pnpm setup.`,
" Check the dropbear config on the device (PubkeyAuth) and /etc/dropbear/authorized_keys.",
);
process.exit(1);
}
console.log("✓ Passwordless SSH configured.");
}
const envPath = resolve(process.cwd(), ".env");
const kept = existsSync(envPath)
? readFileSync(envPath, "utf-8")
.split("\n")
.filter((l) => l && !l.startsWith("VITE_OPENWRT_HOST="))
: [];
writeFileSync(
envPath,
[`VITE_OPENWRT_HOST=${ip}`, ...kept].join("\n") + "\n",
// End-to-end check: push the templates through the exact pipeline ut-sync uses.
// `ssh echo ok` alone can pass while the real tar-over-ssh sync would not.
const started = Date.now();
try {
execSync(
`tar -C "${UT_TEMPLATE_DIR}" -cf - . | ssh ${SSH_OPTS.join(" ")} -o BatchMode=yes -o ConnectTimeout=5 "${host}" "mkdir -p '${UT_REMOTE_DIR}' && tar -xf - -C '${UT_REMOTE_DIR}'"`,
{ stdio: ["ignore", "pipe", "pipe"] },
);
console.log(
`✓ Templates pushed to ${host}:${UT_REMOTE_DIR} (${Date.now() - started}ms) — dev sync verified.`,
);
} catch (err) {
console.error(
"✗ Template push failed — `pnpm dev` template sync will not work:",
);
console.error(` ${String(err?.stderr || err?.message || err).trim()}`);
process.exit(1);
}
// Update managed keys in place so surrounding comments keep their meaning,
// then append any the file does not have yet; other lines pass through.
const out = envLines.map((l) => {
const managed = ENV_VARS.find(({ key }) => l.startsWith(`${key}=`));
return managed ? `${managed.key}=${values[managed.key]}` : l;
});
while (out.length && !out[out.length - 1]) out.pop();
for (const { key } of ENV_VARS) {
if (!out.some((l) => l.startsWith(`${key}=`)))
out.push(`${key}=${values[key]}`);
}
writeFileSync(envPath, out.join("\n") + "\n");
console.log(
`✓ Wrote .env (${ENV_VARS.map(({ key }) => `${key}=${values[key]}`).join(", ")})`,
);
console.log(`✓ Wrote .env (VITE_OPENWRT_HOST=${ip})`);
console.log("Done — run `pnpm dev`.");

2
luci-theme-aurora/.dev/vite.config.ts
View File

@ -185,7 +185,7 @@ function reportSshError(err: any, sshHost: string): void {
) {
console.error(`\n${utTag()} SSH authentication failed for ${sshHost}.`);
console.error(
`${utTag()} Run \`pnpm setup\` to configure passwordless login.\n`,
`${utTag()} Run \`pnpm setup:router\` to configure passwordless login.\n`,
);
} else if (
stderr.includes("Connection refused") ||

2
luci-theme-aurora/CLAUDE.md
View File

@ -8,7 +8,7 @@ All dev commands run from `.dev/`:
```bash
cd .dev/
pnpm setup # One-shot dev setup: router IP → .env, installs SSH key on device
pnpm setup:router # One-shot dev setup: all .env values (router IP, dev host/port) → .env, installs SSH key on device ([ip] to run non-interactively; safe to re-run after a reflash)
pnpm dev # Start Vite dev server (proxies to OpenWrt device)
pnpm build # Clean + regenerate tokens + build production assets to htdocs/luci-static/
pnpm gen:tokens # Regenerate src/media/_tokens.css from tokens/ (also runs as part of build)

2
luci-theme-aurora/Makefile
View File

@ -9,7 +9,7 @@ LUCI_TITLE:=Aurora Theme (A modern browser theme built with Vite and Tailwind CS
LUCI_DEPENDS:=+luci-base
PKG_VERSION:=1.1.0
PKG_RELEASE:=49
PKG_RELEASE:=50
PKG_LICENSE:=Apache-2.0
LUCI_MINIFY_CSS:=

4
natflow/Makefile
View File

@ -10,12 +10,12 @@ include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=natflow
PKG_VERSION:=20260531
PKG_RELEASE:=50
PKG_RELEASE:=51
PKG_SOURCE:=$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://github.com/ptpt52/natflow.git
PKG_SOURCE_PROTO:=git
PKG_SOURCE_VERSION:=18b46f71fc2a6ed6d9b6acceb2b5c2ebaf287cf2
PKG_SOURCE_VERSION:=37544bcdb66633d841f9a0b077643dc092e1d897
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
PKG_MAINTAINER:=Chen Minqiang <ptpt52@gmail.com>
PKG_LICENSE:=GPL-2.0

4
openwrt-go-stun/Makefile
View File

@ -8,11 +8,11 @@ PKG_NAME:=go-stun
PKG_UPSTREAM_VERSION:=0.1.4
PKG_UPSTREAM_GITHASH:=d32c135f5e509d278e95ba9945849903f966a91f
PKG_VERSION:=$(PKG_UPSTREAM_VERSION)~$(call version_abbrev,$(PKG_UPSTREAM_GITHASH))
PKG_RELEASE:=4
PKG_RELEASE:=5
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/ccding/go-stun.git
PKG_SOURCE_VERSION:=d32c135f5e509d278e95ba9945849903f966a91f
PKG_SOURCE_VERSION:=c6f6521d99a27227538c3bd8a7729f8b2f2a69dd
PKG_MIRROR_HASH:=skip
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION)