⛄ Sync 2026-11-01 05:43:29

2026-11-13 20:08:05 +08:00 · 2026-11-01 05:43:29 +08:00
1 parent fae68afc83
commit d1e51134a0
@@ -0,0 +1,51 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=vless-core-cli
+PKG_VERSION:=1.1.4
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/notfence/vless-core-cli/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=skip
+
+PKG_MAINTAINER:=Konstantine Shevlakov <kosnt.shell@gmail.com>
+PKG_LICENSE_FILES:=THIRD_PARTY_LICENSES.txt
+
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/vless-core-cli
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Web Servers/Proxies
+  TITLE:=Standalone C VLESS client with local SOCKS5
+  URL:=https://github.com/notfence/vless-core-cli
+  DEPENDS:=+libopenssl
+endef
+
+define Package/vless-core-cli/description
+  Standalone C client for VLESS (TCP/XHTTP/gRPC/WS, Reality/TLS) and SOCKS5
+  upstreams. Listens on a local SOCKS5 port on 127.0.0.1.
+endef
+
+define Package/vless-core-cli/conffiles
+/etc/config/vless-core
+endef
+
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) linux \
+		CC="$(TARGET_CC)" \
+		COMMON_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS) -std=c11 -Wall" \
+		LDFLAGS="$(TARGET_LDFLAGS)" \
+		BIN_LINUX=vless-core
+endef
+
+define Package/vless-core-cli/install
+	$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/vless-core $(1)/usr/bin/vless-core
+	$(INSTALL_BIN) ./files/vless-core.init $(1)/etc/init.d/vless-core
+	$(INSTALL_CONF) ./files/vless-core.config $(1)/etc/config/vless-core
+endef
+
+$(eval $(call BuildPackage,vless-core-cli))
@@ -0,0 +1,141 @@
+# vless-core-cli
+
+OpenWrt package for [notfence/vless-core-cli](https://github.com/notfence/vless-core-cli) —
+a standalone C client for VLESS that exposes a local SOCKS5 proxy.
+
+Compared to Go-based cores it is tiny (the ipk is about ~70 KB) and depends only on `libopenssl`,
+which makes it suitable for devices with small flash and RAM.
+
+Supported upstreams: VLESS over TCP / XHTTP / gRPC / WebSocket with Reality, TLS or no security
+(`xtls-rprx-vision` on TCP), and plain SOCKS5.
+
+## Files
+
+| Path | Purpose |
+|------|---------|
+| `/usr/bin/vless-core` | client binary |
+| `/etc/init.d/vless-core` | procd init script |
+| `/etc/config/vless-core` | UCI config |
+
+## Quick start
+
+```sh
+uci set vless-core.main.uri='vless://UUID@example.com:443?type=tcp&security=reality&sni=www.example.org&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&flow=xtls-rprx-vision#server'
+uci set vless-core.main.listen_port='1080'
+uci set vless-core.main.enabled='1'
+uci commit vless-core
+/etc/init.d/vless-core enable
+/etc/init.d/vless-core start
+```
+
+Check:
+
+```sh
+curl -x socks5h://127.0.0.1:1080 https://2ip.io
+```
+
+The SOCKS5 listener binds to `127.0.0.1` only. Use it with tun2socks, redsocks or anything
+else that can talk to a SOCKS5 proxy. Logs go to `logread`.
+
+## UCI options
+
+Section `config vless-core 'main'`:
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `enabled` | `0` | Start the service (`1`/`0`) |
+| `uri` | – | `vless://...` or `socks5://host:port` upstream URI (required) |
+| `listen_port` | `1080` | Local SOCKS5 port on `127.0.0.1` |
+| `routing` | – | Optional routing rules, see below |
+| `tls_mode` | `strict` | Certificate verification: `strict`, `insecure` or `tofu` |
+
+Always quote the URI in `uci set`: it contains `&`, `#` and `?`.
+
+## URI examples
+
+Reality + Vision:
+
+```
+vless://UUID@example.com:443?type=tcp&security=reality&sni=www.example.org&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&flow=xtls-rprx-vision#reality
+```
+
+XHTTP + TLS:
+
+```
+vless://UUID@example.com:443?type=xhttp&security=tls&sni=example.com&path=%2Fxh&mode=auto#xhttp
+```
+
+WebSocket + TLS:
+
+```
+vless://UUID@example.com:443?type=ws&security=tls&sni=example.com&host=example.com&path=%2Fws#ws
+```
+
+gRPC + Reality:
+
+```
+vless://UUID@example.com:443?type=grpc&security=reality&serviceName=svc&sni=www.example.org&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID#grpc
+```
+
+Upstream SOCKS5:
+
+```
+socks5://192.0.2.1:1080
+```
+
+Supported `fp` values: `chrome`, `firefox`, `edge`, `random`, `randomized`, `qq`.
+
+## Routing
+
+`routing` is a single string, fields separated by `;`:
+
+```
+ENABLED;DEFAULT;LAN;action,type,value;action,type,value;...
+```
+
+| Field | Values |
+|-------|--------|
+| `ENABLED` | `1` / `0` |
+| `DEFAULT` | `proxy` / `direct` / `block` — used when no rule matches |
+| `LAN` | `1` / `0` — private IP ranges always go `direct` (checked before the rules) |
+| `action` | `proxy` / `direct` / `block` |
+| `type` | `domain` (exact), `suffix` (domain and subdomains), `cidr`, `port` (single or `a-b`) |
+
+Rules are checked in order, first match wins. Up to 48 rules, 8191 characters total.
+Domains are lowercase `a-z0-9-_.` without leading or trailing dot (`ru`, not `.ru`).
+
+Example: everything through the proxy, `.ru` and `.lan` direct, SMTP and one subnet blocked:
+
+```sh
+uci set vless-core.main.routing='1;proxy;1;direct,suffix,ru;direct,suffix,lan;block,port,25;block,cidr,203.0.113.0/24'
+uci commit vless-core
+/etc/init.d/vless-core restart
+```
+
+Notes:
+
+- Domain rules match when the client sends a hostname (`socks5h`). For a bare IP the client
+  tries to sniff the domain from the first packet, but only if domain/suffix rules exist.
+- `8.8.8.8:53` always goes through the proxy if no rule matched earlier, even with `DEFAULT=direct`.
+- A `direct` connection is opened by `vless-core` itself via the normal routing table. If your
+  default route points into a tun device (tun2socks), direct traffic will loop back into it.
+  The client has `--route-control-port` / `--route-control-socket` for an external controller,
+  they are not exposed in UCI.
+
+## TLS verification
+
+`tls_mode` is passed to the client as `VLESS_TLS_MODE`:
+
+- `strict` — only verified TLS, no fallback (default). For `security=tls` install `ca-bundle`.
+- `insecure` — never verify certificates.
+- `tofu` — pin the certificate on first connection, later connections must match.
+
+## Build notes
+
+Upstream hardcodes the output name `vless-core-linux-amd64` regardless of the target
+architecture, so the package passes `BIN_LINUX=vless-core` to upstream `make` and builds
+with the SDK `CC`/`CFLAGS`/`LDFLAGS`.
+
+## ToDo
+
+- `luci-app-vless-core` — LuCI web interface.
@@ -0,0 +1,6 @@
+config vless-core 'main'
+	option enabled '0'
+	option uri ''
+	option listen_port '19990'
+	option routing ''
+	option tls_mode 'strict'
@@ -0,0 +1,39 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+START=90
+STOP=10
+
+PROG=/usr/bin/vless-core
+CONF=vless-core
+
+start_service() {
+	local enabled uri listen_port routing tls_mode
+
+	config_load "$CONF"
+	config_get_bool enabled main enabled 0
+	[ "$enabled" -eq 1 ] || return 0
+
+	config_get uri main uri
+	config_get listen_port main listen_port 1080
+	config_get routing main routing
+	config_get tls_mode main tls_mode strict
+
+	[ -n "$uri" ] || {
+		logger -t vless-core "uri is not set"
+		return 1
+	}
+
+	procd_open_instance
+	procd_set_param command "$PROG" --uri "$uri" --listen-port "$listen_port"
+	[ -n "$routing" ] && procd_append_param command --routing "$routing"
+	procd_set_param env VLESS_TLS_MODE="$tls_mode"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+service_triggers() {
+	procd_add_reload_trigger "$CONF"
+}