🤞 Sync 2026-08-09 18:27:19

gecoosac/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gecoosac
 PKG_VERSION:=2.2.20251015
-PKG_RELEASE:=17
+PKG_RELEASE:=18
 
 PKG_MAINTAINER:=Roc Lai <laipeng668@qq.com>
 PKG_LICENSE:=AGPL-3.0-only
@@ -44,7 +44,7 @@ define Package/$(PKG_NAME)
   TITLE:=gecoosac server (version $(PKG_VERSION))
   URL:=http://www.cnrouter.com/
   DEPENDS:=@(aarch64||arm||i386||mips||mipsel||x86_64) +openssl-util
-  REPLACES:=luci-app-gecoosac
+  PROVIDES:=gecoosac-files
 endef
 
 define Package/$(PKG_NAME)/conffiles

gecoosac/files/etc/uci-defaults/gecoosac

@@ -3,6 +3,7 @@
 changed=0
 DEFAULT_DB_DIR=/etc/gecoosac
 DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload
+LEGACY_UPLOAD_DIR=/etc/gecoosac/upload
 DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt
 DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key
 DEFAULT_PID_DIR=/var/run
@@ -123,6 +124,23 @@ is_path_in_dir() {
 	[ "${path#"$root"/}" != "$path" ]
 }
 
+path_has_mount() {
+	local root line mount_path
+
+	root="$(normalize_path "$1")" || return 2
+	[ -r /proc/self/mountinfo ] || return 2
+
+	while IFS= read -r line; do
+		mount_path="$(printf '%s\n' "$line" | cut -d ' ' -f 5)" || return 2
+		[ -n "$mount_path" ] || return 2
+		mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2
+		mount_path="$(normalize_path "$mount_path")" || return 2
+		is_path_in_dir "$mount_path" "$root" && return 0
+	done < /proc/self/mountinfo
+
+	return 1
+}
+
 is_safe_db_dir() {
 	local path upload_root physical physical_upload_root
 
@@ -175,6 +193,58 @@ normalize_upload_dir() {
 	changed=1
 }
 
+configured_path_in_legacy_upload() {
+	local option path resolved
+
+	for option in db_dir piddir crt_file key_file; do
+		path="$(uci -q get "gecoosac.config.${option}")"
+		[ -n "$path" ] || continue
+		path="$(normalize_path "$path")" || return 0
+		is_path_in_dir "$path" "$LEGACY_UPLOAD_DIR" && return 0
+
+		if [ -e "$path" ] || [ -L "$path" ]; then
+			resolved="$(readlink -f "$path" 2>/dev/null)" || return 0
+			resolved="$(normalize_path "$resolved")" || return 0
+			is_path_in_dir "$resolved" "$LEGACY_UPLOAD_DIR" && return 0
+		fi
+	done
+
+	return 1
+}
+
+cleanup_legacy_upload_dir() {
+	local mount_state
+
+	[ -e "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ] || return 0
+	if [ ! -d "$LEGACY_UPLOAD_DIR" ] || [ -L "$LEGACY_UPLOAD_DIR" ]; then
+		logger -t gecoosac "refusing to remove unsafe legacy upload path: $LEGACY_UPLOAD_DIR"
+		return 0
+	fi
+	if configured_path_in_legacy_upload; then
+		logger -t gecoosac "preserving legacy upload path referenced by configuration: $LEGACY_UPLOAD_DIR"
+		return 0
+	fi
+
+	path_has_mount "$LEGACY_UPLOAD_DIR"
+	mount_state="$?"
+	case "$mount_state" in
+		0)
+			logger -t gecoosac "preserving legacy upload path containing a mount: $LEGACY_UPLOAD_DIR"
+			return 0
+		;;
+		2)
+			logger -t gecoosac "unable to validate legacy upload mounts: $LEGACY_UPLOAD_DIR"
+			return 0
+		;;
+	esac
+
+	rm -rf "$LEGACY_UPLOAD_DIR" || {
+		logger -t gecoosac "failed to remove legacy upload path: $LEGACY_UPLOAD_DIR"
+		return 1
+	}
+	[ ! -e "$LEGACY_UPLOAD_DIR" ] && [ ! -L "$LEGACY_UPLOAD_DIR" ]
+}
+
 normalize_dir_option() {
 	local option="$1"
 	local validator="$3"
@@ -208,8 +278,8 @@ is_regular_file_or_absent() {
 	[ -f "$1" ] && [ ! -L "$1" ]
 }
 
-migrate_legacy_cert_paths() {
-	local crt_file key_file old_crt old_key new_crt new_key path
+migrate_default_certificates() {
+	local crt_file key_file path
 
 	crt_file="$(uci -q get gecoosac.config.crt_file)"
 	key_file="$(uci -q get gecoosac.config.key_file)"
@@ -223,39 +293,8 @@ migrate_legacy_cert_paths() {
 		}
 	done
 
-	old_crt=0
-	old_key=0
-	new_crt=0
-	new_key=0
-	[ -f "$OLD_CRT_FILE" ] && old_crt=1
-	[ -f "$OLD_KEY_FILE" ] && old_key=1
-	[ -f "$DEFAULT_CRT_FILE" ] && new_crt=1
-	[ -f "$DEFAULT_KEY_FILE" ] && new_key=1
-
-	if { [ "$old_crt" = "1" ] && [ "$new_crt" = "1" ]; } || \
-		{ [ "$old_key" = "1" ] && [ "$new_key" = "1" ]; }; then
-		logger -t gecoosac "refusing conflicting legacy and current certificate files"
-		return 1
-	fi
-	if [ "$old_crt" = "1" ] && [ "$new_key" = "1" ]; then
-		logger -t gecoosac "refusing reverse-split certificate migration state"
-		return 1
-	fi
-	if [ $((old_crt + new_crt)) -ne $((old_key + new_key)) ]; then
-		logger -t gecoosac "refusing incomplete certificate migration state"
-		return 1
-	fi
-
-	if [ "$old_crt" = "1" ]; then
-		mv "$OLD_CRT_FILE" "$DEFAULT_CRT_FILE" || return 1
-	fi
-	if [ "$old_key" = "1" ]; then
-		mv "$OLD_KEY_FILE" "$DEFAULT_KEY_FILE" || return 1
-	fi
-	if [ -f "$DEFAULT_CRT_FILE" ]; then
-		chmod 644 "$DEFAULT_CRT_FILE" || return 1
-		chmod 600 "$DEFAULT_KEY_FILE" || return 1
-	fi
+	# Managed certificates are regenerated when HTTPS next starts.
+	rm -f "$OLD_CRT_FILE" "$OLD_KEY_FILE" "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE" || return 1
 
 	if [ "$crt_file" != "$DEFAULT_CRT_FILE" ]; then
 		uci -q set "gecoosac.config.crt_file=${DEFAULT_CRT_FILE}" || return 1
@@ -270,9 +309,10 @@ migrate_legacy_cert_paths() {
 migrate_config() {
 	local compat
 
-	migrate_legacy_cert_paths || return 1
 	compat="$(uci -q get gecoosac.config.config_compat)"
 	[ "$compat" = "$CONFIG_COMPAT" ] && return 0
+	migrate_default_certificates || return 1
+	cleanup_legacy_upload_dir || return 1
 	uci -q set "gecoosac.config.config_compat=${CONFIG_COMPAT}" || return 1
 	changed=1
 }

hysteria/Makefile

@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hysteria
-PKG_VERSION:=2.12.0
-PKG_RELEASE:=14
+PKG_VERSION:=2.12.1
+PKG_RELEASE:=15
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/apernet/hysteria/tar.gz/app/v$(PKG_VERSION)?

luci-app-fchomo/root/usr/share/rpcd/acl.d/luci-app-fchomo.json

@@ -6,8 +6,11 @@
 				"/etc/init.d/fchomo reload *": [ "exec" ],
 				"/usr/libexec/fchomo/natcheck.sh": [ "exec" ],
 				"/var/run/fchomo/fchomo.log": [ "read" ],
+				"/tmp/run/fchomo/fchomo.log": [ "read" ],
 				"/var/run/fchomo/mihomo-c.log": [ "read" ],
-				"/var/run/fchomo/mihomo-s.log": [ "read" ]
+				"/tmp/run/fchomo/mihomo-c.log": [ "read" ],
+				"/var/run/fchomo/mihomo-s.log": [ "read" ],
+				"/tmp/run/fchomo/mihomo-s.log": [ "read" ]
 			},
 			"ubus": {
 				"service": [ "list" ],

luci-app-gecoosac/Makefile

@@ -7,11 +7,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-gecoosac
 PKG_VERSION:=2.2
-PKG_RELEASE:=17
+PKG_RELEASE:=18
 
 LUCI_TITLE:=LuCI Support for gecoosac
-LUCI_DEPENDS:=+luci-base +gecoosac
-LUCI_EXTRA_DEPENDS:=gecoosac (>=2.2.20251015-r4)
+LUCI_DEPENDS:=+luci-base +gecoosac +gecoosac-files
+LUCI_EXTRA_DEPENDS:=gecoosac (>=2.2.20251015)
 LUCI_PKGARCH:=all
 PKG_LICENSE:=AGPL-3.0-only
 

luci-app-gecoosac/htdocs/luci-static/resources/view/gecoosac.js

@@ -42,6 +42,7 @@ const RPC_ERROR_MESSAGES = {
 	'Invalid service status response': _('Invalid service status response'),
 	'Expecting an absolute path': _('Expecting an absolute path'),
 	'Only Gecoos upload directories can be cleared': _('Only Gecoos upload directories can be cleared'),
+	'Upload directory contains a mount point': _('Upload directory contains a mount point'),
 	'Upload directory or its parent is not root-owned and private': _('Upload directory or its parent is not root-owned and private'),
 	'Unable to resolve upload directory': _('Unable to resolve upload directory'),
 	'Unable to read Gecoos configuration': _('Unable to read Gecoos configuration'),

luci-app-gecoosac/po/zh_Hans/gecoosac.po

@@ -139,6 +139,9 @@ msgstr "请输入绝对路径"
 msgid "Only Gecoos upload directories can be cleared"
 msgstr "只能清理集客 AC 上传目录"
 
+msgid "Upload directory contains a mount point"
+msgstr "上传目录包含挂载点"
+
 msgid "Upload directory was not cleared"
 msgstr "上传目录未清理"
 

luci-app-gecoosac/po/zh_Hant/gecoosac.po

@@ -139,6 +139,9 @@ msgstr "請輸入絕對路徑"
 msgid "Only Gecoos upload directories can be cleared"
 msgstr "只能清除集客 AC 上傳目錄"
 
+msgid "Upload directory contains a mount point"
+msgstr "上傳目錄包含掛載點"
+
 msgid "Upload directory was not cleared"
 msgstr "上傳目錄未清除"
 

luci-app-gecoosac/root/usr/libexec/rpcd/luci.gecoosac

@@ -129,6 +129,23 @@ path_in_dir() {
 	[ "${path#"$root"/}" != "$path" ]
 }
 
+path_has_mount() {
+	local root line mount_path
+
+	root="$(normalize_path "$1")" || return 2
+	[ -r /proc/self/mountinfo ] || return 2
+
+	while IFS= read -r line; do
+		mount_path="$(printf '%s\n' "$line" | cut -d ' ' -f 5)" || return 2
+		[ -n "$mount_path" ] || return 2
+		mount_path="$(printf '%b\n' "$mount_path" 2>/dev/null)" || return 2
+		mount_path="$(normalize_path "$mount_path")" || return 2
+		path_in_dir "$mount_path" "$root" && return 0
+	done < /proc/self/mountinfo
+
+	return 1
+}
+
 is_secure_dir() {
 	local allow_sticky="$2" owner permissions metadata
 
@@ -339,6 +356,49 @@ restore_staged_upload() {
 	rmdir "$stage" 2>/dev/null
 }
 
+clear_upload_rollback_result() {
+	local stage="$1" live="$2" message="$3" path="$4"
+
+	if [ -n "$stage" ] && ! restore_staged_upload "$stage" "$live"; then
+		logger -t gecoosac "upload cleanup retained staged data at $stage"
+		path="$stage"
+	fi
+	clear_upload_locked_result 0 "$message" "$path"
+}
+
+clear_upload_error_result() {
+	local message="$1" path="$2"
+
+	if [ -n "$stage" ]; then
+		clear_upload_rollback_result "$stage" "$physical" "$message" "$path"
+	else
+		clear_upload_locked_result 0 "$message" "$path"
+	fi
+}
+
+remove_clear_stage() {
+	local candidate="$1" mount_state
+
+	clear_stage_error=
+	if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then
+		path_has_mount "$candidate/upload"
+		mount_state="$?"
+		case "$mount_state" in
+			0) clear_stage_error="Upload directory contains a mount point"; return 1 ;;
+			2) clear_stage_error="Unable to validate upload cleanup stage"; return 1 ;;
+		esac
+		rm -rf "$candidate/upload" || {
+			logger -t gecoosac "upload cleanup retained staged data at $candidate"
+			clear_stage_error="Unable to remove upload directory contents"
+			return 1
+		}
+	fi
+	rmdir "$candidate" || {
+		clear_stage_error="Unable to remove upload cleanup stage"
+		return 1
+	}
+}
+
 validate_clear_protected_paths() {
 	local root="$1" live_logical="${2:-$1}" live_physical="${3:-$1}" option
 
@@ -354,7 +414,7 @@ validate_clear_protected_paths() {
 }
 
 clear_upload() {
-	local logical physical resolved parent stage candidate stages live_exists current
+	local logical physical resolved parent stage candidate stages live_exists current clear_stage_error
 	local clear_upload_dir clear_db_dir clear_piddir clear_crt_file clear_key_file
 	local initial_upload initial_db initial_pid initial_crt initial_key
 
@@ -459,6 +519,11 @@ clear_upload() {
 			return
 		}
 		if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then
+			path_has_mount "$candidate/upload"
+			case "$?" in
+				0) clear_upload_locked_result 0 "Upload directory contains a mount point" "$candidate"; return ;;
+				2) clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$candidate"; return ;;
+			esac
 			validate_clear_protected_paths "$candidate/upload" "$logical" "$physical"
 			case "$?" in
 				0) clear_upload_locked_result 0 "Upload cleanup stage contains a configured protected path" "$candidate"; return ;;
@@ -474,6 +539,13 @@ clear_upload() {
 		clear_upload_locked_result 0 "Upload directory or its parent is not root-owned and private" "$logical"
 		return
 	fi
+	if [ "$live_exists" = "1" ]; then
+		path_has_mount "$physical"
+		case "$?" in
+			0) clear_upload_locked_result 0 "Upload directory contains a mount point" "$logical"; return ;;
+			2) clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$logical"; return ;;
+		esac
+	fi
 	if [ "$live_exists" = "0" ] && [ "$stages" = "0" ]; then
 		clear_upload_locked_result 1 "" "$logical"
 		return
@@ -520,7 +592,7 @@ clear_upload() {
 	fi
 
 	load_clear_config || {
-		clear_upload_locked_result 0 "Unable to read Gecoos configuration" "$logical"
+		clear_upload_rollback_result "$stage" "$physical" "Unable to read Gecoos configuration" "$logical"
 		return
 	}
 	if [ "$clear_upload_dir" != "$initial_upload" ] || \
@@ -528,38 +600,42 @@ clear_upload() {
 		[ "$clear_piddir" != "$initial_pid" ] || \
 		[ "$clear_crt_file" != "$initial_crt" ] || \
 		[ "$clear_key_file" != "$initial_key" ]; then
-		clear_upload_locked_result 0 "Gecoos configuration changed during cleanup" "$logical"
+		clear_upload_rollback_result "$stage" "$physical" "Gecoos configuration changed during cleanup" "$logical"
 		return
 	fi
 	for candidate in "$parent"/.gecoosac-clear.??????; do
 		[ "$candidate" != "$parent/.gecoosac-clear.??????" ] || continue
 		is_safe_clear_stage "$candidate" || {
-			clear_upload_locked_result 0 "Unable to validate upload cleanup stage" "$candidate"
+			clear_upload_error_result "Unable to validate upload cleanup stage" "$candidate"
 			return
 		}
 		if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then
+			path_has_mount "$candidate/upload"
+			case "$?" in
+				0) clear_upload_error_result "Upload directory contains a mount point" "$candidate"; return ;;
+				2) clear_upload_error_result "Unable to validate upload cleanup stage" "$candidate"; return ;;
+			esac
 			validate_clear_protected_paths "$candidate/upload" "$logical" "$physical"
 			case "$?" in
-				0) clear_upload_locked_result 0 "Upload cleanup stage contains a configured protected path" "$candidate"; return ;;
+				0) clear_upload_error_result "Upload cleanup stage contains a configured protected path" "$candidate"; return ;;
 				1) ;;
-				*) clear_upload_locked_result 0 "Unable to validate configured paths" "$candidate"; return ;;
+				*) clear_upload_error_result "Unable to validate configured paths" "$candidate"; return ;;
 			esac
 		fi
 	done
 	for candidate in "$parent"/.gecoosac-clear.??????; do
 		[ "$candidate" != "$parent/.gecoosac-clear.??????" ] || continue
-		if [ -e "$candidate/upload" ] || [ -L "$candidate/upload" ]; then
-			rm -rf "$candidate/upload" || {
-				logger -t gecoosac "upload cleanup retained staged data at $candidate"
-				clear_upload_locked_result 0 "Unable to remove upload directory contents" "$logical"
-				return
-			}
-		fi
-		rmdir "$candidate" || {
-			clear_upload_locked_result 0 "Unable to remove upload cleanup stage" "$candidate"
+		[ "$candidate" = "$stage" ] && continue
+		if ! remove_clear_stage "$candidate"; then
+			clear_upload_error_result "$clear_stage_error" "$candidate"
 			return
-		}
+		fi
 	done
+	if [ -n "$stage" ] && ! remove_clear_stage "$stage"; then
+		clear_upload_error_result "$clear_stage_error" "$stage"
+		return
+	fi
+	stage=
 
 	clear_upload_locked_result 1 "" "$logical"
 }

luci-app-natmapt/root/usr/share/rpcd/acl.d/luci-app-natmap.json

@@ -8,6 +8,7 @@
 				"/etc/natmap/ddns": [ "list" ],
 				"/etc/init.d/natmap reload *": [ "exec" ],
 				"/var/run/natmap/*": [ "read" ],
+				"/tmp/run/natmap/*": [ "read" ],
 				"/tmp/natmap-natBehavior": [ "read" ],
 				"/usr/libexec/natmap/natcheck.sh": [ "exec" ]
 			},

luci-app-packagesync/root/usr/share/rpcd/acl.d/luci-app-packagesync.json

@@ -6,9 +6,13 @@
         "/etc/init.d/packagesync": [ "exec" ],
         "/bin/df -hT": [ "exec" ],
         "/var/packagesync/releaseslist": [ "read" ],
+        "/tmp/packagesync/releaseslist": [ "read" ],
         "/var/packagesync/targetslist": [ "read" ],
+        "/tmp/packagesync/targetslist": [ "read" ],
         "/var/packagesync/pkgarchslist": [ "read" ],
-        "/var/run/packagesync.pid": [ "read" ]
+        "/tmp/packagesync/pkgarchslist": [ "read" ],
+        "/var/run/packagesync.pid": [ "read" ],
+        "/tmp/run/packagesync.pid": [ "read" ]
       },
       "ubus": {
         "service": [ "list" ]

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.8.1
-PKG_RELEASE:=206
+PKG_RELEASE:=207
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/luasrc/controller/passwall.lua

@@ -572,22 +572,22 @@ end
 function add_node()
 	local redirect = http.formvalue("redirect")
 
-	local uuid = api.gen_short_uuid()
-	uci:section(appname, "nodes", uuid)
+	local uid = api.gen_random_char()
+	uci:section(appname, "nodes", uid)
 
 	local group = http.formvalue("group")
 	if group and group ~= "default" then
-		uci:set(appname, uuid, "group", group)
+		uci:set(appname, uid, "group", group)
 	end
 
-	uci:set(appname, uuid, "type", "Socks")
+	uci:set(appname, uid, "type", "Socks")
 
 	if redirect == "1" then
 		api.uci_save(uci, appname)
-		http.redirect(api.url("node_config", uuid))
+		http.redirect(api.url("node_config", uid))
 	else
 		api.uci_save(uci, appname, true, true)
-		http_write_json({result = uuid})
+		http_write_json({result = uid})
 	end
 end
 
@@ -615,17 +615,17 @@ end
 
 function copy_node()
 	local section = http.formvalue("section")
-	local uuid = api.gen_short_uuid()
-	uci:section(appname, "nodes", uuid)
+	local uid = api.gen_random_char()
+	uci:section(appname, "nodes", uid)
 	for k, v in pairs(uci:get_all(appname, section)) do
 		if not k:match("^%.") and k ~= "group" then
 			if k == "remarks" then v = (v or "") .. "(1)" end
-			uci:set(appname, uuid, k, v)
+			uci:set(appname, uid, k, v)
 		end
 	end
-	uci:set(appname, uuid, "add_mode", 1)
+	uci:set(appname, uid, "add_mode", 1)
 	api.uci_save(uci, appname)
-	http.redirect(api.url("node_config", uuid))
+	http.redirect(api.url("node_config", uid))
 end
 
 function clear_all_nodes()
@@ -1242,29 +1242,29 @@ function add_shunt_rule()
 	local add_name = http.formvalue("add_name")
 	local redirect = http.formvalue("redirect")
 
-	local uuid = add_name
+	local uid = add_name
 	if add_name then
-		local has = uci:get(appname, uuid)
+		local has = uci:get(appname, uid)
 		if has then
 			http_write_json_error({ message = "This ID already exists." })
 			return
 		end
 	else
-		uuid = api.gen_short_uuid()
+		uid = api.gen_random_char()
 	end
-	uci:section(appname, "shunt_rules", uuid)
+	uci:section(appname, "shunt_rules", uid)
 
 	local group = http.formvalue("group")
 	if group and group ~= "default" then
-		uci:set(appname, uuid, "group", group)
+		uci:set(appname, uid, "group", group)
 	end
 
 	if redirect == "1" then
 		api.uci_save(uci, appname)
-		http.redirect(api.url("shunt_rules", uuid))
+		http.redirect(api.url("shunt_rules", uid))
 	else
 		api.uci_save(uci, appname)
-		http_write_json_ok({uuid = uuid, redirect_url = api.url("shunt_rules", uuid)})
+		http_write_json_ok({uid = uid, redirect_url = api.url("shunt_rules", uid)})
 	end
 end
 

luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua

@@ -23,8 +23,9 @@ s.anonymous = true
 s.addremove = true
 s.extedit = api.url("acl_config", "%s")
 function s.create(e, t)
-	t = TypedSection.create(e, t)
-	luci.http.redirect(e.extedit:format(t))
+	local uid = "acl_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 function s.remove(e, t)
 	sys.call("rm -rf /tmp/etc/passwall_tmp/dns_" .. t .. "*")
@@ -48,6 +49,15 @@ sys.net.mac_hints(function(e, t)
 	}
 end)
 
+i = s:option(DummyValue, "interface", translate("Source Interface"))
+i.cfgvalue = function(t, n)
+	local v = Value.cfgvalue(t, n) or ''
+	if v == "" then
+		return translate("All")
+	end
+	return v
+end
+
 o = s:option(DummyValue, "sources", translate("Source"))
 o.rawhtml = true
 o.cfgvalue = function(t, n)
@@ -66,10 +76,13 @@ o.cfgvalue = function(t, n)
 	return e
 end
 
-o = s:option(DummyValue, "interface", translate("Source Interface"))
-o.cfgvalue = function(t, n)
-	local v = Value.cfgvalue(t, n) or '-'
-	return v
+i = s:option(DummyValue, "mode", translate("Mode"))
+i.cfgvalue = function(t, n)
+	local v = Value.cfgvalue(t, n) or '0'
+	if v == "1" then
+		return translate("Proxy")
+	end
+	return translate("No Proxy")
 end
 
 --[[

luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua

@@ -84,19 +84,6 @@ o = s:option(Value, "remarks", translate("Remarks"))
 o.default = cfgid
 o.rmempty = false
 
----- Log
-o = s:option(Flag, "log", translate("Log"))
-o.default = 0
-o.rmempty = false
-
-o = s:option(ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
-o.default = "warning"
-o:value("debug")
-o:value("info")
-o:value("warning")
-o:value("error")
-o:depends("log", "1")
-
 o = s:option(Value, "interface", translate("Source Interface"))
 o:value("", translate("All"))
 local iface = api.get_network_devices()
@@ -196,12 +183,17 @@ sources.validate = function(self, value, t)
 end
 sources.write = dynamicList_write
 
+o = s:option(ListValue, "mode", translate("Mode"))
+o:value("0", translate("No Proxy"))
+o:value("1", translate("Proxy"))
+
 ---- TCP No Redir Ports
 local TCP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_no_redir_ports")
 o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports"))
 o:value("", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")")
 o:value("disable", translate("No patterns are used"))
 o:value("1:65535", translate("All"))
+o:depends("mode", "1")
 o.validate = port_validate
 
 ---- UDP No Redir Ports
@@ -213,11 +205,13 @@ o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"),
 o:value("", translate("Use global config") .. "(" .. UDP_NO_REDIR_PORTS .. ")")
 o:value("disable", translate("No patterns are used"))
 o:value("1:65535", translate("All"))
+o:depends("mode", "1")
 o.validate = port_validate
 
 o = s:option(DummyValue, "_hide_node_option", "")
 o.template = "passwall/cbi/hidevalue"
 o.value = "1"
+o:depends("mode", "0")
 o:depends({ tcp_no_redir_ports = "1:65535", udp_no_redir_ports = "1:65535" })
 if TCP_NO_REDIR_PORTS == "1:65535" and UDP_NO_REDIR_PORTS == "1:65535" then
 	o:depends({ tcp_no_redir_ports = "", udp_no_redir_ports = "" })
@@ -280,6 +274,20 @@ o.value = "1"
 o:depends({ udp_node = "",  ['!reverse'] = true })
 o:depends({ shunt_udp_node = "tcp" })
 
+---- Log
+o = s:option(Flag, "log", translate("Enable Node Log"))
+o.default = 0
+o.rmempty = false
+o:depends({ _hide_node_option = false, use_global_config = false })
+
+o = s:option(ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
+o.default = "warn"
+o:value("debug", "Debug")
+o:value("info", "Info")
+o:value("warn", "Warning")
+o:value("error", "Error")
+o:depends("log", "1")
+
 ---- TCP Proxy Drop Ports
 local TCP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "tcp_proxy_drop_ports")
 o = s:option(Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports"))

luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua

@@ -689,11 +689,11 @@ o.default = "0"
 o.rmempty = false
 
 o = s:taboption("log", ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level"))
-o.default = "warning"
-o:value("debug")
-o:value("info")
-o:value("warning")
-o:value("error")
+o.default = "warn"
+o:value("debug", "Debug")
+o:value("info", "Info")
+o:value("warn", "Warning")
+o:value("error", "Error")
 
 o = s:taboption("log", Flag, "advanced_log_feature", translate("Advanced log feature"), translate("For professionals only."))
 o.default = "0"
@@ -735,10 +735,9 @@ s2.anonymous = true
 s2.addremove = true
 s2.extedit = api.url("socks_config", "%s")
 function s2.create(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "socks_" .. uuid
-	TypedSection.create(e, uuid)
-	luci.http.redirect(e.extedit:format(uuid))
+	local uid = "socks_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 function s2.remove(e, t)
 	local socks = "Socks_" .. t

luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua

@@ -114,9 +114,8 @@ s.anonymous = true
 s.addremove = true
 
 s.create = function(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "haproxy_" .. uuid
-	TypedSection.create(e, uuid)
+	local uid = "haproxy_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
 end
 
 s.remove = function(self, section)

luci-app-passwall/luasrc/model/cbi/passwall/client/node_subscribe.lua

@@ -138,11 +138,11 @@ s.template = "cbi/tblsection"
 s.extedit = api.url("node_subscribe_config", "%s")
 function s.create(e, t)
 	m.no_commit = true
-	local id = TypedSection.create(e, t)
-	uci:set(appname, id, "hysteria_up_mbps", "100")
-	uci:set(appname, id, "hysteria_down_mbps", "100")
-	api.uci_save(uci, appname)
-	luci.http.redirect(e.extedit:format(id))
+	local uid = "sub_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	m:set(uid, "hysteria_up_mbps", "100")
+	m:set(uid, "hysteria_down_mbps", "100")
+	luci.http.redirect(e.extedit:format(uid))
 end
 
 o = s:option(Value, "remark", translate("Remarks"))

luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua

@@ -222,9 +222,8 @@ if has_xray then
 	s_xray_noise.addremove = true
 
 	s_xray_noise.create = function(e, t)
-		local uuid = api.gen_short_uuid(5)
-		uuid = "xray_noise_" .. uuid
-		TypedSection.create(e, uuid)
+		local uid = "xray_noise_" .. api.gen_random_char(5)
+		TypedSection.create(e, uid)
 	end
 
 	s_xray_noise.remove = function(self, section)

luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua

@@ -513,6 +513,9 @@ o.default = "chrome"
 o:depends({ [_n("tls")] = true, [_n("utls")] = true })
 o:depends({ [_n("tls")] = true, [_n("reality")] = true })
 
+o = s:option(Value, _n("cipherSuites"), translate("Cipher Suites"), '<a href="https://go.dev/src/crypto/tls/cipher_suites.go#L44" target="_blank">***</a>' .. " " .. translate("Configures the list of supported cipher suites, separated by :"))
+o:depends({ [_n("tls")] = true, [_n("reality")] = false })
+
 o = s:option(Flag, _n("use_mldsa65Verify"), translate("ML-DSA-65"))
 o.default = "0"
 o:depends({ [_n("tls")] = true, [_n("reality")] = true })

luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua

@@ -536,6 +536,9 @@ o.validate = function(self, value)
 	return value
 end
 
+o = s:option(Value, _n("cipherSuites"), translate("Cipher Suites"), '<a href="https://go.dev/src/crypto/tls/cipher_suites.go#L44" target="_blank">***</a>' .. " " .. translate("Configures the list of supported cipher suites, separated by :"))
+o:depends({ [_n("tls")] = true })
+
 o = s:option(Flag, _n("ech"), translate("ECH"))
 o.default = "0"
 o:depends({ [_n("tls")] = true, [_n("flow")] = "", [_n("reality")] = false })

luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua

@@ -26,10 +26,9 @@ t.sortable = true
 t.template = "cbi/tblsection"
 t.extedit = api.url("server_user", "%s")
 function t.create(e, t)
-	local uuid = api.gen_uuid()
-	t = uuid
-	TypedSection.create(e, t)
-	luci.http.redirect(e.extedit:format(t))
+	local uid = api.gen_random_char()
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 function t.remove(e, t)
 	e.map.proceed = true

luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua

@@ -111,7 +111,7 @@ o:depends({ [_n("protocol")] = "socks" })
 
 o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password"))
 for i = 1, 3 do
-	o:value(api.gen_uuid(1))
+	o:value(api.gen_uuid())
 end
 o:depends({ [_n("protocol")] = "vmess" })
 o:depends({ [_n("protocol")] = "vless" })

luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua

@@ -235,7 +235,7 @@ o:depends({ [_n("protocol")] = "shadowsocks" })
 
 o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password"))
 for i = 1, 3 do
-	o:value(api.gen_uuid(1))
+	o:value(api.gen_uuid())
 end
 o:depends({ [_n("protocol")] = "vmess" })
 o:depends({ [_n("protocol")] = "vless" })

luci-app-passwall/luasrc/passwall/api.lua

@@ -642,15 +642,12 @@ function get_full_node_remarks(n)
 	return remarks
 end
 
-function gen_uuid(format)
+function gen_uuid()
 	local uuid = sys.exec("echo -n $(cat /proc/sys/kernel/random/uuid)")
-	if format == nil then
-		uuid = string.gsub(uuid, "-", "")
-	end
 	return uuid
 end
 
-function gen_short_uuid(length)
+function gen_random_char(length)
 	if not length then length = 8 end
 	return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c %s)" % length)
 end

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -5,7 +5,6 @@ local sys = api.sys
 local jsonc = api.jsonc
 local appname = "passwall"
 local fs = api.fs
-local split = api.split
 local ech_domain = {}
 
 local local_version = api.get_app_version("sing-box"):match("[^v]+")
@@ -88,6 +87,11 @@ local function convert_geofile()
 	convert(GEO_VAR.IP_PATH, "geoip", GEO_VAR.IP_TAGS)
 end
 
+local function get_log_level(s)
+	if s == "warning" then s = "warn" end
+	return s
+end
+
 function gen_outbound(flag, node, tag, proxy_table)
 	local result = nil
 	if node then
@@ -190,7 +194,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 			if not GLOBAL.DNS_SERVER[dns_key] then
 				GLOBAL.DNS_SERVER[dns_key] = {
 					server = {
-						tag = "dns-node-" .. api.gen_short_uuid(),
+						tag = "dns-node-" .. api.gen_random_char(),
 						type = dns_proto,
 						server = server_address,
 						server_port = server_port,
@@ -232,7 +236,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 				--max_version = "1.3",
 				fragment = fragment,
 				record_fragment = record_fragment,
-				certificate = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and split(node.tls_certificate_pem, "\n") or nil,
+				certificate = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and api.split(node.tls_certificate_pem, "\n") or nil,
+				cipher_suites = (node.cipherSuites and node.cipherSuites ~= "") and api.split(node.cipherSuites, ":") or nil,
 				ech = (node.ech == "1") and (function()
 					local function get_ech_domain(s) --兼容xray "域名+DNS" 格式ech
 						local domain, dns = s:match("^([^+]+)%+(.+)$")
@@ -1042,7 +1047,7 @@ function gen_config_server(node)
 	local config = {
 		log = {
 			disabled = (not node or node.log == "0") and true or false,
-			level = node.loglevel or "info",
+			level = get_log_level(node.loglevel) or "info",
 			timestamp = true,
 			--output = logfile,
 		},
@@ -2169,7 +2174,7 @@ function gen_config(var)
 		local config = {
 			log = {
 				disabled = log == "0" and true or false,
-				level = loglevel,
+				level = get_log_level(loglevel),
 				timestamp = true,
 				output = logfile,
 			},

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -31,6 +31,11 @@ local function get_domain_excluded()
 	return hosts
 end
 
+local function get_log_level(s)
+	if s == "warn" then s = "warning" end
+	return s
+end
+
 function gen_outbound(flag, node, tag, proxy_table)
 	local result = nil
 	if node then
@@ -165,7 +170,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 					certificates = (node.tls_certificate == "1" and node.tls_certificate_pem ~= "") and {
 						certificate = api.split(node.tls_certificate_pem, "\n"),
 						usage = "verify"
-					} or nil
+					} or nil,
+					cipherSuites = node.cipherSuites or nil
 				} or nil,
 				realitySettings = (node.stream_security == "reality") and {
 					serverName = node.tls_serverName,
@@ -453,7 +459,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 			local dns_key = dns_proto .. "|" .. config_address .. "|" .. tostring(config_port)
 			if not GLOBAL.DNS_SERVER[dns_key] then
 				GLOBAL.DNS_SERVER[dns_key] = {
-					tag = "dns-node-" .. api.gen_short_uuid(),
+					tag = "dns-node-" .. api.gen_random_char(),
 					-- queryStrategy = node.domain_strategy or "UseIP",
 					address = config_address,
 					port = config_port,
@@ -635,7 +641,7 @@ function gen_config_server(node)
 	local config = {
 		log = {
 			-- error = "/tmp/etc/passwall_server/log/" .. user[".name"] .. ".log",
-			loglevel = ("1" == node.log) and node.loglevel or "none"
+			loglevel = ("1" == node.log) and get_log_level(node.loglevel) or "none"
 		},
 		-- 传入连接
 		inbounds = {
@@ -1966,7 +1972,7 @@ function gen_config(var)
 			end)(),
 			log = {
 				-- error = string.format("/tmp/etc/%s/%s.log", appname, node[".name"]),
-				loglevel = loglevel
+				loglevel = get_log_level(loglevel)
 			},
 			-- DNS
 			dns = dns,

luci-app-passwall/po/zh-cn/passwall.po

@@ -1673,6 +1673,9 @@ msgstr "日志"
 msgid "Log"
 msgstr "日志"
 
+msgid "Enable Node Log"
+msgstr "启用节点日志"
+
 msgid "%s Node Log"
 msgstr "%s 节点日志"
 
@@ -2198,3 +2201,12 @@ msgstr "Gecko 包大小（最大）"
 
 msgid "valid time (hh:mm)"
 msgstr "有效时间（hh:mm）"
+
+msgid "Not Set"
+msgstr "未设置"
+
+msgid "Cipher Suites"
+msgstr "密码套件"
+
+msgid "Configures the list of supported cipher suites, separated by :"
+msgstr "配置支持的密码套件列表，以冒号 (:) 分隔。"

luci-app-passwall/root/etc/uci-defaults/luci-passwall

@@ -68,6 +68,16 @@ for sid in $(uci show passwall | grep "=socks" | awk -F '.' '{print $2}' | awk -
 		unset sid new_id
 	fi
 done
+for sid in $(uci show passwall | grep "@acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
+	new_id="acl_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)"
+	uci -q rename passwall.${sid}="${new_id}"
+	unset sid new_id
+done
+for sid in $(uci show passwall | grep "@subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
+	new_id="sub_$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 5)"
+	uci -q rename passwall.${sid}="${new_id}"
+	unset sid new_id
+done
 
 uci -q commit passwall
 

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -115,7 +115,6 @@ run_singbox() {
 		json_add_string "logfile" "${log_file}"
 	fi
 	[ -z "$loglevel" ] && local loglevel=$(config_t_get global loglevel "warn")
-	[ "$loglevel" = "warning" ] && loglevel="warn"
 	json_add_string "loglevel" "$loglevel"
 
 	[ -n "$flag" ] && json_add_string "flag" "$flag"
@@ -1050,9 +1049,6 @@ socks_node_switch() {
 		LOG_FILE="/dev/null"
 		run_socks flag=$flag node=$new_node bind=$bind socks_port=$port config_file=$config_file http_port=$http_port http_config_file=$http_config_file log_file=$log_file
 		set_cache_var "${flag}" "$new_node"
-		local ENABLED_DEFAULT_ACL=$(get_cache_var "ENABLED_DEFAULT_ACL")
-		local ENABLED_ACLS=$(get_cache_var "ENABLED_ACLS")
-		[ "$ENABLED_DEFAULT_ACL" != "1" ] && [ "$ENABLED_ACLS" != "1" ] && return
 		local USE_TABLES=$(get_cache_var "USE_TABLES")
 		[ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh filter_direct_node_list
 	}
@@ -1147,14 +1143,13 @@ start_crontab() {
 	# ===== subscribe =====
 	local TMP_SUB_PATH=$TMP_PATH/sub_crontabs
 	mkdir -p "$TMP_SUB_PATH"
-	local item cfgid remark sub_update_week_mode sub_update_time_mode
+	local item remark sub_update_week_mode sub_update_time_mode
 	for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 		sub_update_week_mode=$(config_n_get $item update_week_mode)
 		if [ -n "$sub_update_week_mode" ]; then
-			cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
 			remark=$(config_n_get "$item" remark)
 			sub_update_time_mode=$(config_n_get $item update_time_mode)
-			echo "$cfgid" >> "$TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}"
+			echo "$item" >> "$TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}"
 			echolog "配置定时任务：自动更新【$remark】订阅。"
 		fi
 	done
@@ -1519,8 +1514,13 @@ start_haproxy() {
 
 acl_app() {
 	local items=$(uci show ${CONFIG} | grep "=acl_rule" | cut -d '.' -sf 2 | cut -d '=' -sf 1)
-	[ -n "$items" ] && {
-		local item
+	if [ -z "$items" ]; then
+		ENABLED_ACLS=0
+		set_cache_var ENABLED_ACLS $ENABLED_ACLS
+		return
+	else
+		local has_enabled
+		local sid
 		local socks_port redir_port dns_port dnsmasq_port chinadns_port
 		local msg msg2
 		socks_port=11100
@@ -1528,13 +1528,13 @@ acl_app() {
 		dns_port=11300
 		dnsmasq_port=${GLOBAL_DNSMASQ_PORT:-11400}
 		chinadns_port=11500
-		for item in $items; do
-			local sid=$(uci -q show "${CONFIG}.${item}" | grep "=acl_rule" | awk -F '=' '{print $1}' | awk -F '.' '{print $2}')
+		for sid in $items; do
 			[ "$(config_n_get $sid enabled)" = "1" ] || continue
-			eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
+			has_enabled=1
+			eval $(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)
 
 			log=${log:-0}
-			loglevel=${loglevel:-warning}
+			loglevel=${loglevel:-warn}
 
 			if [ -n "${sources}" ]; then
 				for s in $sources; do
@@ -1854,7 +1854,11 @@ acl_app() {
 			unset _china_ng_listen _chinadns_local_dns _direct_dns_mode chinadns_ng_default_tag dnsmasq_filter_proxy_ipv6 remote_fakedns force_https_soa use_fakedns
 		done
 		unset socks_port redir_port dns_port dnsmasq_port chinadns_port
-	}
+		[ -n "${has_enabled}" ] || {
+			ENABLED_ACLS=0
+			set_cache_var ENABLED_ACLS $ENABLED_ACLS
+		}
+	fi
 }
 
 start() {
@@ -1912,8 +1916,7 @@ start() {
 		local cfgids item
 		for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 			if [ "$(config_n_get "$item" boot_update 0)" = "1" ]; then
-				local cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
-				cfgids="${cfgids:+$cfgids,}$cfgid"
+				cfgids="${cfgids:+$cfgids,}$item"
 			fi
 		done
 		[ -n "$cfgids" ] && {
@@ -2003,9 +2006,6 @@ get_config() {
 		done
 	}
 	ENABLED_ACLS=$(config_t_get global acl_enable 0)
-	[ "$ENABLED_ACLS" = 1 ] && {
-		[ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" = 0 ] && ENABLED_ACLS=0
-	}
 	set_cache_var ENABLED_DEFAULT_ACL $ENABLED_DEFAULT_ACL
 	set_cache_var ENABLED_ACLS $ENABLED_ACLS
 

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -203,6 +203,7 @@ load_acl() {
 		for sid in $(ls -F ${TMP_ACL_PATH} | grep '/$' | awk -F '/' '{print $1}' | grep -v 'default'); do
 			eval "$(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)"
 
+			mode=${mode:-0}
 			tcp_no_redir_ports=${tcp_no_redir_ports:-default}
 			udp_no_redir_ports=${udp_no_redir_ports:-default}
 			use_global_config=${use_global_config:-0}
@@ -217,6 +218,10 @@ load_acl() {
 			chn_list=${chn_list:-direct}
 			tcp_proxy_mode=${tcp_proxy_mode:-proxy}
 			udp_proxy_mode=${udp_proxy_mode:-proxy}
+			[ "$mode" = "0" ] && {
+				tcp_no_redir_ports="1:65535"
+				udp_no_redir_ports="1:65535"
+			}
 			[ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS
 			[ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS
 			[ "$tcp_proxy_drop_ports" = "default" ] && tcp_proxy_drop_ports=$TCP_PROXY_DROP_PORTS

luci-app-passwall/root/usr/share/passwall/nftables.sh

@@ -263,6 +263,7 @@ load_acl() {
 		for sid in $(ls -F ${TMP_ACL_PATH} | grep '/$' | awk -F '/' '{print $1}' | grep -v 'default'); do
 			eval "$(uci -q show "${CONFIG}.${sid}" | cut -d'.' -sf 3-)"
 
+			mode=${mode:-0}
 			tcp_no_redir_ports=${tcp_no_redir_ports:-default}
 			udp_no_redir_ports=${udp_no_redir_ports:-default}
 			use_global_config=${use_global_config:-0}
@@ -277,6 +278,10 @@ load_acl() {
 			chn_list=${chn_list:-direct}
 			tcp_proxy_mode=${tcp_proxy_mode:-proxy}
 			udp_proxy_mode=${udp_proxy_mode:-proxy}
+			[ "$mode" = "0" ] && {
+				tcp_no_redir_ports="1:65535"
+				udp_no_redir_ports="1:65535"
+			}
 			[ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS
 			[ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS
 			[ "$tcp_proxy_drop_ports" = "default" ] && tcp_proxy_drop_ports=$TCP_PROXY_DROP_PORTS

luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -533,7 +533,7 @@ local function fetch_geofile(geo_name, geo_type, url)
 	local tmp_path = "/tmp/" .. geo_name
 	local asset_path = asset_location .. geo_name
 	local down_filename = url:match("^.*/([^/?#]+)")
-	local sha_url = url:gsub(down_filename, down_filename .. ".sha256sum")
+	local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum")
 	local sha_path = tmp_path .. ".sha256sum"
 
 	local function verify_sha256(sha_file)

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -180,9 +180,9 @@ do
 				local flag = "Socks节点列表[" .. i .. "]备用节点的列表"
 				local currentNodes = {}
 				local newNodes = {}
-				for k, asb_node in ipairs(t.autoswitch_backup_node) do
-					if asb_node then
-						local currentNode = uci:get_all(appname, asb_node) or {}
+				for k, asb_node_id in ipairs(t.autoswitch_backup_node) do
+					if asb_node_id then
+						local currentNode = uci:get_all(appname, asb_node_id) or {}
 						if currentNode[".type"] == "nodes" then
 							currentNodes[#currentNodes + 1] = {
 								log = true,
@@ -1931,7 +1931,7 @@ local function update_node(manual)
 			chain_node_type = (outbound_iface_group ~= "") and "iface" or chain_node_type
 		end
 		for _, vv in ipairs(list) do
-			local cfgid = uci:section(appname, "nodes", api.gen_short_uuid())
+			local cfgid = uci:section(appname, "nodes", api.gen_random_char())
 			for kkk, vvv in pairs(vv) do
 				if type(vvv) == "table" and next(vvv) ~= nil then
 					uci:set_list(appname, cfgid, kkk, vvv)

luci-app-passwall/root/usr/share/passwall/tasks.sh

@@ -41,10 +41,9 @@ do
 		for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
 			sub_update_week_mode=$(config_n_get $item update_week_mode)
 			if [ -n "$sub_update_week_mode" ]; then
-				cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
 				remark=$(config_n_get $item remark)
 				sub_update_interval_mode=$(config_n_get $item update_interval_mode)
-				echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
+				echo "$item" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
 			fi
 		done
 

luci-app-passwall2/Makefile

@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
 PKG_VERSION:=26.8.7
-PKG_RELEASE:=70
+PKG_RELEASE:=71
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall2/luasrc/controller/passwall2.lua

@@ -449,22 +449,22 @@ end
 function add_node()
 	local redirect = http.formvalue("redirect")
 
-	local uuid = api.gen_short_uuid()
-	uci:section(appname, "nodes", uuid)
+	local uid = api.gen_random_char()
+	uci:section(appname, "nodes", uid)
 
 	local group = http.formvalue("group")
 	if group and group ~= "default" then
-		uci:set(appname, uuid, "group", group)
+		uci:set(appname, uid, "group", group)
 	end
 
-	uci:set(appname, uuid, "type", "Xray")
+	uci:set(appname, uid, "type", "Xray")
 
 	if redirect == "1" then
 		api.uci_save(uci, appname)
-		http.redirect(api.url("node_config", uuid))
+		http.redirect(api.url("node_config", uid))
 	else
 		api.uci_save(uci, appname, true, true)
-		http_write_json({result = uuid})
+		http_write_json({result = uid})
 	end
 end
 
@@ -479,17 +479,17 @@ end
 
 function copy_node()
 	local section = http.formvalue("section")
-	local uuid = api.gen_short_uuid()
-	uci:section(appname, "nodes", uuid)
+	local uid = api.gen_random_char()
+	uci:section(appname, "nodes", uid)
 	for k, v in pairs(uci:get_all(appname, section)) do
 		if not k:match("^%.") and k ~= "group" then
 			if k == "remarks" then v = (v or "") .. "(1)" end
-			uci:set(appname, uuid, k, v)
+			uci:set(appname, uid, k, v)
 		end
 	end
-	uci:set(appname, uuid, "add_mode", 1)
+	uci:set(appname, uid, "add_mode", 1)
 	api.uci_save(uci, appname)
-	http.redirect(api.url("node_config", uuid))
+	http.redirect(api.url("node_config", uid))
 end
 
 function clear_all_nodes()
@@ -1055,29 +1055,29 @@ function add_shunt_rule()
 	local add_name = http.formvalue("add_name")
 	local redirect = http.formvalue("redirect")
 
-	local uuid = add_name
+	local uid = add_name
 	if add_name then
-		local has = uci:get(appname, uuid)
+		local has = uci:get(appname, uid)
 		if has then
 			http_write_json_error({ message = "This ID already exists." })
 			return
 		end
 	else
-		uuid = api.gen_short_uuid()
+		uid = api.gen_random_char()
 	end
-	uci:section(appname, "shunt_rules", uuid)
+	uci:section(appname, "shunt_rules", uid)
 
 	local group = http.formvalue("group")
 	if group and group ~= "default" then
-		uci:set(appname, uuid, "group", group)
+		uci:set(appname, uid, "group", group)
 	end
 
 	if redirect == "1" then
 		api.uci_save(uci, appname)
-		http.redirect(api.url("shunt_rules", uuid))
+		http.redirect(api.url("shunt_rules", uid))
 	else
 		api.uci_save(uci, appname)
-		http_write_json_ok({uuid = uuid, redirect_url = api.url("shunt_rules", uuid)})
+		http_write_json_ok({uid = uid, redirect_url = api.url("shunt_rules", uid)})
 	end
 end
 

luci-app-passwall2/luasrc/model/cbi/passwall2/client/acl.lua

@@ -23,10 +23,9 @@ s.anonymous = true
 s.addremove = true
 s.extedit = api.url("acl_config", "%s")
 function s.create(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "acl_" .. uuid
-	TypedSection.create(e, uuid)
-	luci.http.redirect(e.extedit:format(uuid))
+	local uid = "acl_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 
 ---- Enable

luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua

@@ -326,10 +326,9 @@ s2.anonymous = true
 s2.addremove = true
 s2.extedit = api.url("socks_config", "%s")
 function s2.create(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "socks_" .. uuid
-	TypedSection.create(e, uuid)
-	luci.http.redirect(e.extedit:format(uuid))
+	local uid = "socks_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 
 o = s2:option(DummyValue, "status", translate("Status"))

luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua

@@ -113,9 +113,8 @@ s.anonymous = true
 s.addremove = true
 
 s.create = function(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "haproxy_" .. uuid
-	TypedSection.create(e, uuid)
+	local uid = "haproxy_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
 end
 
 s.remove = function(self, section)

luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe.lua

@@ -134,12 +134,11 @@ s.sortable = true
 s.template = "cbi/tblsection"
 s.extedit = api.url("node_subscribe_config", "%s")
 function s.create(e, t)
-	local uuid = api.gen_short_uuid(5)
-	uuid = "sub_" .. uuid
-	TypedSection.create(e, uuid)
-	m:set(uuid, "hysteria_up_mbps", "100")
-	m:set(uuid, "hysteria_down_mbps", "100")
-	luci.http.redirect(e.extedit:format(uuid))
+	local uid = "sub_" .. api.gen_random_char(5)
+	TypedSection.create(e, uid)
+	m:set(uid, "hysteria_up_mbps", "100")
+	m:set(uid, "hysteria_down_mbps", "100")
+	luci.http.redirect(e.extedit:format(uid))
 end
 
 o = s:option(Value, "remark", translate("Remarks"))

luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua

@@ -263,9 +263,8 @@ if has_xray then
 	s_xray_noise.addremove = true
 
 	s_xray_noise.create = function(e, t)
-		local uuid = api.gen_short_uuid(5)
-		uuid = "xray_noise_" .. uuid
-		TypedSection.create(e, uuid)
+		local uid = "xray_noise_" .. api.gen_random_char(5)
+		TypedSection.create(e, uid)
 	end
 
 	s_xray_noise.remove = function(self, section)

luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua

@@ -21,10 +21,9 @@ t.sortable = true
 t.template = "cbi/tblsection"
 t.extedit = api.url("server_user", "%s")
 function t.create(e, t)
-	local uuid = api.gen_uuid()
-	t = uuid
-	TypedSection.create(e, t)
-	luci.http.redirect(e.extedit:format(t))
+	local uid = api.gen_random_char()
+	TypedSection.create(e, uid)
+	luci.http.redirect(e.extedit:format(uid))
 end
 function t.remove(e, t)
 	e.map.proceed = true

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua

@@ -111,7 +111,7 @@ o:depends({ [_n("protocol")] = "socks" })
 
 o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password"))
 for i = 1, 3 do
-	o:value(api.gen_uuid(1))
+	o:value(api.gen_uuid())
 end
 o:depends({ [_n("protocol")] = "vmess" })
 o:depends({ [_n("protocol")] = "vless" })

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua

@@ -235,7 +235,7 @@ o:depends({ [_n("protocol")] = "shadowsocks" })
 
 o = s:option(DynamicList, _n("uuid"), translate("ID") .. "/" .. translate("Password"))
 for i = 1, 3 do
-	o:value(api.gen_uuid(1))
+	o:value(api.gen_uuid())
 end
 o:depends({ [_n("protocol")] = "vmess" })
 o:depends({ [_n("protocol")] = "vless" })

luci-app-passwall2/luasrc/passwall2/api.lua

@@ -669,15 +669,12 @@ function get_full_node_remarks(n)
 	return remarks
 end
 
-function gen_uuid(format)
+function gen_uuid()
 	local uuid = sys.exec("echo -n $(cat /proc/sys/kernel/random/uuid)")
-	if format == nil then
-		uuid = string.gsub(uuid, "-", "")
-	end
 	return uuid
 end
 
-function gen_short_uuid(length)
+function gen_random_char(length)
 	if not length then length = 8 end
 	return sys.exec("echo -n $(head /dev/urandom | tr -dc A-Za-z0-9 | head -c %s)" % length)
 end

luci-app-passwall2/luasrc/view/passwall2/global/status_bottom.htm

@@ -56,15 +56,15 @@ display:block !important;
     <div class="inner">
         <div class="pure-g">
             <div class="pure-u-1-2">
-                <span class="flag"><img src="/luci-static/passwall/flags/loading.svg" class="pure-img"></span> <span
+                <span class="flag"><img src="/luci-static/passwall2/flags/loading.svg" class="pure-img"></span> <span
                     class="status-info">获取中...</span>
             </div>
             <div class="pure-u-1-2">
                 <div class="icon-con">
-                    <img src="/luci-static/passwall/img/site_icon1_01.png" class="pure-img i1">
-                    <img src="/luci-static/passwall/img/site_icon1_02.png" class="pure-img i2">
-                    <img src="/luci-static/passwall/img/site_icon1_03.png" class="pure-img i3">
-                    <img src="/luci-static/passwall/img/site_icon1_04.png" class="pure-img i4">
+                    <img src="/luci-static/passwall2/img/site_icon1_01.png" class="pure-img i1">
+                    <img src="/luci-static/passwall2/img/site_icon1_02.png" class="pure-img i2">
+                    <img src="/luci-static/passwall2/img/site_icon1_03.png" class="pure-img i3">
+                    <img src="/luci-static/passwall2/img/site_icon1_04.png" class="pure-img i4">
                 </div>
             </div>
         </div>
@@ -72,8 +72,8 @@ display:block !important;
 </div>
 
 <script>
-const _ASSETS = '/luci-static/passwall/';
-const CHECK_IP_URL = '<%=url([[admin]], [[services]], [[passwall]], [[ip]])%>';
+const _ASSETS = '/luci-static/passwall2/';
+const CHECK_IP_URL = '<%=url([[admin]], [[services]], [[passwall2]], [[ip]])%>';
 
 let wW = window.innerWidth;
 

luci-app-passwall2/root/usr/share/passwall2/subscribe.lua

@@ -2274,7 +2274,7 @@ local function update_node(manual)
 			chain_node_type = (outbound_iface_group ~= "") and "iface" or chain_node_type
 		end
 		for _, vv in ipairs(list) do
-			local cfgid = uci:section(appname, "nodes", api.gen_short_uuid())
+			local cfgid = uci:section(appname, "nodes", api.gen_random_char())
 			for kkk, vvv in pairs(vv) do
 				if type(vvv) == "table" and next(vvv) ~= nil then
 					uci:set_list(appname, cfgid, kkk, vvv)

luci-app-ssr-plus/Makefile

@@ -4,7 +4,7 @@ LUCI_TITLE:=luci-app-ssr-plus
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=196
-PKG_RELEASE:=53
+PKG_RELEASE:=54
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_$(PKG_NAME)_Iptables_Transparent_Proxy \

luci-app-ssr-plus/luasrc/view/shadowsocksr/status_bottom.htm

@@ -38,7 +38,7 @@
     text-align: right;
 }
 
-#cbi-passwall+.cbi-page-actions.control-group.fixed {
+#cbi-shadowsocksr+.cbi-page-actions.control-group.fixed {
     bottom: 3.3rem;
 }
 
@@ -56,15 +56,15 @@ display:block !important;
     <div class="inner">
         <div class="pure-g">
             <div class="pure-u-1-2">
-                <span class="flag"><img src="/luci-static/passwall/flags/loading.svg" class="pure-img"></span> <span
+                <span class="flag"><img src="/luci-static/shadowsocksr/flags/loading.svg" class="pure-img"></span> <span
                     class="status-info">获取中...</span>
             </div>
             <div class="pure-u-1-2">
                 <div class="icon-con">
-                    <img src="/luci-static/passwall/img/site_icon1_01.png" class="pure-img i1">
-                    <img src="/luci-static/passwall/img/site_icon1_02.png" class="pure-img i2">
-                    <img src="/luci-static/passwall/img/site_icon1_03.png" class="pure-img i3">
-                    <img src="/luci-static/passwall/img/site_icon1_04.png" class="pure-img i4">
+                    <img src="/luci-static/shadowsocksr/img/site_icon1_01.png" class="pure-img i1">
+                    <img src="/luci-static/shadowsocksr/img/site_icon1_02.png" class="pure-img i2">
+                    <img src="/luci-static/shadowsocksr/img/site_icon1_03.png" class="pure-img i3">
+                    <img src="/luci-static/shadowsocksr/img/site_icon1_04.png" class="pure-img i4">
                 </div>
             </div>
         </div>
@@ -72,8 +72,8 @@ display:block !important;
 </div>
 
 <script>
-const _ASSETS = '/luci-static/passwall/';
-const CHECK_IP_URL = '<%=url([[admin]], [[services]], [[passwall]], [[ip]])%>';
+const _ASSETS = '/luci-static/shadowsocksr/';
+const CHECK_IP_URL = '<%=url([[admin]], [[services]], [[shadowsocksr]], [[ip]])%>';
 
 let wW = window.innerWidth;
 

luci-app-tinyfilemanager/Makefile

@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 LUCI_NAME:=luci-app-tinyfilemanager
 PKG_VERSION:=2.6
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 LUCI_TITLE:=LuCI Tiny File Manager
 LUCI_DEPENDS:=+php8 +php8-cgi +php8-fastcgi +php8-fpm +php8-mod-session +php8-mod-ctype +php8-mod-fileinfo +php8-mod-zip +php8-mod-iconv +php8-mod-mbstring +coreutils-stat +zoneinfo-asia +bash +curl +tar +inotifywait
@@ -22,7 +22,7 @@ define Package/$(LUCI_NAME)/conffiles
 /etc/config/tinyfilemanager
 endef
 
-define Package/$(LUCI_NAME)/preinst
+define Package/$(LUCI_NAME)/postinst
 #!/bin/sh
 mkdir -p "$${IPKG_INSTROOT}/www/tinyfilemanager" 2>/dev/null
 [ ! -d "$${IPKG_INSTROOT}/www/tinyfilemanager/rootfs" ] && ln -s / "$${IPKG_INSTROOT}/www/tinyfilemanager/rootfs"

luci-app-tinyfilemanager/root/usr/share/rpcd/acl.d/luci-app-tinyfilemanager.json

@@ -6,7 +6,8 @@
         "/usr/libexec/tinyfilemanager-update": [ "exec" ],
         "/etc/init.d/tinyfilemanager check": [ "exec" ],
         "/etc/init.d/tinyfilemanager reload": [ "exec" ],
-        "/var/tinyfilemanager/releaseslist": [ "read" ]
+        "/var/tinyfilemanager/releaseslist": [ "read" ],
+        "/tmp/tinyfilemanager/releaseslist": [ "read" ]
       },
       "uci": [ "tinyfilemanager" ]
     },

nps/Makefile

@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nps
-PKG_VERSION:=0.26.36
-PKG_RELEASE:=11
+PKG_VERSION:=0.26.37
+PKG_RELEASE:=12
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/yisier/nps/tar.gz/v$(PKG_VERSION)?

sing-box/Makefile

@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sing-box
-PKG_VERSION:=1.13.16
-PKG_RELEASE:=24
+PKG_VERSION:=1.13.18
+PKG_RELEASE:=25
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/SagerNet/sing-box/tar.gz/v$(PKG_VERSION)?