diff --git a/gowebdav/Makefile b/gowebdav/Makefile
index 90f72cd0..99d84a3b 100644
--- a/gowebdav/Makefile
+++ b/gowebdav/Makefile
@@ -6,8 +6,8 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=gowebdav
-PKG_VERSION:=5.13.0
-PKG_RELEASE:=16
+PKG_VERSION:=5.14.0
+PKG_RELEASE:=17
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/hacdias/webdav/tar.gz/v$(PKG_VERSION)?
diff --git a/luci-app-passwall2/Makefile b/luci-app-passwall2/Makefile
index 47d3daff..32455abe 100644
--- a/luci-app-passwall2/Makefile
+++ b/luci-app-passwall2/Makefile
@@ -6,8 +6,8 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.6.16
-PKG_RELEASE:=59
+PKG_VERSION:=26.7.12
+PKG_RELEASE:=60
PKG_PO_VERSION:=$(PKG_VERSION)
PKG_CONFIG_DEPENDS:= \
@@ -25,7 +25,7 @@ PKG_CONFIG_DEPENDS:= \
LUCI_TITLE:=LuCI support for PassWall 2
LUCI_PKGARCH:=all
-LUCI_DEPENDS:=+coreutils +coreutils-base64 +coreutils-nohup +curl \
+LUCI_DEPENDS:=+coreutils +coreutils-base64 +coreutils-nohup +coreutils-timeout +curl \
+ip-full +libuci-lua +lua +luci-compat +luci-lib-jsonc +lyaml +resolveip +tcping \
+geoview +v2ray-geoip +v2ray-geosite \
+unzip \
@@ -155,6 +155,7 @@ endef
define Package/$(PKG_NAME)/conffiles
/etc/config/passwall2
/etc/config/passwall2_server
+/usr/share/passwall2/direct_ip
/usr/share/passwall2/domains_excluded
endef
diff --git a/luci-app-passwall2/luasrc/controller/passwall2.lua b/luci-app-passwall2/luasrc/controller/passwall2.lua
index 4bb05586..c01dbae0 100644
--- a/luci-app-passwall2/luasrc/controller/passwall2.lua
+++ b/luci-app-passwall2/luasrc/controller/passwall2.lua
@@ -104,6 +104,7 @@ function index()
for com, _ in pairs(coms) do
entry({"admin", "services", appname, "check_" .. com}, call("com_check", com)).leaf = true
entry({"admin", "services", appname, "update_" .. com}, call("com_update", com)).leaf = true
+ entry({"admin", "services", appname, "version_" .. com}, call("com_version", com)).leaf = true
end
--[[Backup]]
@@ -755,6 +756,11 @@ function com_update(comname)
http_write_json(json)
end
+function com_version(comname)
+ local version = api.get_app_version(comname)
+ http_write_json_ok(version)
+end
+
local backup_files = {
"/etc/config/passwall2",
"/etc/config/passwall2_server",
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua
index 5649b016..afdef1b9 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua
@@ -1,19 +1,21 @@
local api = require "luci.passwall2.api"
+local com = require "luci.passwall2.com"
local appname = api.appname
m = Map(appname)
api.set_apply_on_parse(m)
-- [[ App Settings ]]--
-s = m:section(TypedSection, "global_app", translate("App Update"),
- "" ..
- translate("Please confirm that your firmware supports FPU.") ..
- "")
+s = m:section(TypedSection, "global_app", translate("App Update"))
s.anonymous = true
-s:append(Template(appname .. "/app_update/app_version"))
+
+local app_version = Template(appname .. "/app_update/app_version")
+app_version.api = api
+app_version.config = m.config
+app_version.com = com
+s:append(app_version)
local k, v
-local com = require "luci.passwall2.com"
for k, v in pairs(com) do
o = s:option(Value, k:gsub("%-","_") .. "_file", translatef("%s App Path", v.name))
o.default = v.default_path or ("/usr/bin/" .. k)
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
index 92de2f97..0afe66f8 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua
@@ -355,11 +355,13 @@ o.default = n + 1080
o.datatype = "port"
o.rmempty = false
+--[[
if has_singbox or has_xray then
o = s2:option(Value, "http_port", "HTTP " .. translate("Listen Port") .. " " .. translate("0 is not use"))
o.default = 0
o.datatype = "port"
end
+]]--
local o_node = s.fields["node"]
local o_socks = s2.fields["node"]
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
index 0f2ea0fa..6a8732ee 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua
@@ -74,13 +74,14 @@ o:depends("balancing_enable", true)
---- Passwall Inner implement Probe URL
o = s:option(Value, "health_probe_url", translate("Probe URL"))
-o.default = "https://www.google.com/generate_204"
o:value("https://cp.cloudflare.com/", "Cloudflare")
o:value("https://www.gstatic.com/generate_204", "Gstatic")
o:value("https://www.google.com/generate_204", "Google")
o:value("https://www.youtube.com/generate_204", "YouTube")
o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)")
o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)")
+o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)")
+o.default = o.keylist[3]
o.description = translate("The URL used to detect the connection status.")
o:depends("health_check_type", "passwall_logic")
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua
index 3265dcd9..745188de 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua
@@ -25,6 +25,7 @@ o:value("https://www.google.com/generate_204", "Google")
o:value("https://www.youtube.com/generate_204", "YouTube")
o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)")
o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)")
+o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)")
o.default = o.keylist[3]
-- [[ Add the node via the link ]]--
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua
index 89f42efd..b5068ccc 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua
@@ -231,13 +231,8 @@ end
o = s:option(Flag, "boot_update", translate("Update Once on Boot"), translate("Updates the subscription the first time runs automatically after each system boot."))
o.default = 0
----- Enable auto update subscribe
-o = s:option(Flag, "auto_update", translate("Enable auto update subscribe"))
-o.default = 0
-o.rmempty = false
-
----- Week Update
-o = s:option(ListValue, "week_update", translate("Update Mode"))
+o = s:option(ListValue, "update_week_mode", translate("Auto Update Mode"))
+o:value("", translate("Disable"))
o:value(8, translate("Loop Mode"))
o:value(7, translate("Every day"))
o:value(1, translate("Every Monday"))
@@ -247,29 +242,39 @@ o:value(4, translate("Every Thursday"))
o:value(5, translate("Every Friday"))
o:value(6, translate("Every Saturday"))
o:value(0, translate("Every Sunday"))
-o.default = 7
-o:depends("auto_update", true)
-o.rmempty = true
----- Time Update
-o = s:option(ListValue, "time_update", translate("Update Time(every day)"))
-for t = 0, 23 do o:value(t, t .. ":00") end
-o.default = 0
-o:depends("week_update", "0")
-o:depends("week_update", "1")
-o:depends("week_update", "2")
-o:depends("week_update", "3")
-o:depends("week_update", "4")
-o:depends("week_update", "5")
-o:depends("week_update", "6")
-o:depends("week_update", "7")
-o.rmempty = true
+o = s:option(Value, "update_time_mode", translate("Update Time"))
+o:value("0:00")
+for t = 0, 23 do
+ if t == 12 then
+ o:value(t .. ":30")
+ elseif t == 23 then
+ o:value(t .. ":59")
+ else
+ o:value(t .. ":00")
+ end
+end
+o.default = "0:00"
+o.validate = function(self, value)
+ local b = api.is_timehhmm(value)
+ if b then
+ return value
+ end
+ return nil
+end
+o:depends("update_week_mode", "0")
+o:depends("update_week_mode", "1")
+o:depends("update_week_mode", "2")
+o:depends("update_week_mode", "3")
+o:depends("update_week_mode", "4")
+o:depends("update_week_mode", "5")
+o:depends("update_week_mode", "6")
+o:depends("update_week_mode", "7")
----- Interval Update
-o = s:option(ListValue, "interval_update", translate("Update Interval(hour)"))
+o = s:option(ListValue, "update_interval_mode", translate("Update Interval(hour)"))
for t = 1, 24 do o:value(t, t .. " " .. translate("hour")) end
o.default = 2
-o:depends("week_update", "8")
+o:depends("update_week_mode", "8")
o.rmempty = true
o = s:option(ListValue, "access_mode", translate("Subscribe URL Access Method"))
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
index 25913c94..a715756c 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua
@@ -29,7 +29,9 @@ o.rmempty = true
for index, value in ipairs({"stop", "start", "restart"}) do
o = s:option(ListValue, value .. "_week_mode", translate(value .. " automatically mode"))
o:value("", translate("Disable"))
- o:value(8, translate("Loop Mode"))
+ if value == "restart" then
+ o:value(8, translate("Loop Mode"))
+ end
o:value(7, translate("Every day"))
o:value(1, translate("Every Monday"))
o:value(2, translate("Every Tuesday"))
@@ -39,9 +41,25 @@ for index, value in ipairs({"stop", "start", "restart"}) do
o:value(6, translate("Every Saturday"))
o:value(0, translate("Every Sunday"))
- o = s:option(ListValue, value .. "_time_mode", translate(value .. " Time(Every day)"))
- for t = 0, 23 do o:value(t, t .. ":00") end
- o.default = 0
+ o = s:option(Value, value .. "_time_mode", translate(value .. " Time"))
+ o:value("0:00")
+ for t = 0, 23 do
+ if t == 12 then
+ o:value(t .. ":30")
+ elseif t == 23 then
+ o:value(t .. ":59")
+ else
+ o:value(t .. ":00")
+ end
+ end
+ o.default = "0:00"
+ o.validate = function(self, value)
+ local b = api.is_timehhmm(value)
+ if b then
+ return value
+ end
+ return nil
+ end
o:depends(value .. "_week_mode", "0")
o:depends(value .. "_week_mode", "1")
o:depends(value .. "_week_mode", "2")
@@ -150,8 +168,45 @@ o = s:option(Flag, "accept_icmpv6", translate("Hijacking ICMPv6 (IPv6 PING)"))
o:depends("ipv6_tproxy", true)
o.default = 0
-o = s:option(DynamicList, "force_proxy_lan_ip", translate("Force Proxy LAN IP"), translate("By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here."))
-o.datatype = "or(ipmask4,ipmask6)"
+function clean_text(text)
+ local nbsp = string.char(0xC2, 0xA0)
+ local fullwidth_space = string.char(0xE3, 0x80, 0x80)
+ return text
+ :gsub("\t", " ")
+ :gsub(nbsp, " ")
+ :gsub(fullwidth_space, " ")
+ :gsub("^%s+", "")
+ :gsub("%s+$", "\n")
+ :gsub("\r\n", "\n")
+ :gsub("[ \t]*\n[ \t]*", "\n")
+end
+
+local direct_ip_file = "/usr/share/passwall2/direct_ip"
+o = s:option(TextValue, "direct_ip", translate("Direct IP List"), "" .. translate("These had been joined ip addresses will connect directly (not entering the core).") .. "")
+o.rows = 15
+o.wrap = "off"
+o.cfgvalue = function(self, section)
+ return fs.readfile(direct_ip_file) or ""
+end
+o.write = function(self, section, value)
+ fs.writefile(direct_ip_file, value:gsub("\r\n", "\n"))
+end
+o.remove = function(self, section, value)
+ fs.writefile(direct_ip_file, "")
+end
+o.validate = function(self, value)
+ local ipmasks= {}
+ value = clean_text(value)
+ string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, api.trim(w)) end)
+ for index, ipmask in ipairs(ipmasks) do
+ if ipmask ~= "" and not ipmask:find("^#") and not ipmask:find("^geoip:") then
+ if not ( datatypes.ipmask4(ipmask) or datatypes.ipmask6(ipmask) ) then
+ return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!")
+ end
+ end
+ end
+ return value
+end
if has_xray then
s_xray = m:section(TypedSection, "global_xray", "Xray " .. translate("Settings"))
@@ -170,19 +225,17 @@ if has_xray then
o:value("1-5", "1-5")
o:depends("fragment", true)
- o = s_xray:option(Value, "fragment_length", translate("Fragment Length"), translate("Fragmented packet length (byte)"))
- o.datatype = "or(uinteger,portrange)"
- o.default = "100-200"
+ o = s_xray:option(Value, "fragment_lengths", translate("Fragment Length"), translate("Fragmented packet length (byte)"))
+ o.default = "3-5,6-8,10-20"
o:depends("fragment", true)
- o = s_xray:option(Value, "fragment_delay", translate("Fragment Delay"), translate("Fragmentation interval (ms)"))
- o.datatype = "or(uinteger,portrange)"
+ o = s_xray:option(Value, "fragment_delays", translate("Fragment Delay"), translate("Fragmentation interval (ms)"))
o.default = "10-20"
o:depends("fragment", true)
o = s_xray:option(Value, "fragment_maxSplit", translate("Max Split"), translate("Limit the maximum number of splits."))
o.datatype = "or(uinteger,portrange)"
- o.default = "100-200"
+ o.default = "3-6"
o:depends("fragment", true)
o = s_xray:option(Flag, "noise", translate("Noise"), translate("UDP noise, Under some circumstances it can bypass some UDP based protocol restrictions."))
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua
index 4b32eb00..2fba7319 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua
@@ -35,13 +35,8 @@ o.default = "/usr/share/v2ray/"
o.placeholder = o.default
o.rmempty = false
----- Auto Update
-o = s:option(Flag, "auto_update", translate("Enable auto update rules"))
-o.default = 0
-o.rmempty = false
-
----- Week Update
-o = s:option(ListValue, "week_update", translate("Update Mode"))
+o = s:option(ListValue, "update_week_mode", translate("Auto Update Mode"))
+o:value("", translate("Disable"))
o:value(8, translate("Loop Mode"))
o:value(7, translate("Every day"))
o:value(1, translate("Every Monday"))
@@ -51,29 +46,39 @@ o:value(4, translate("Every Thursday"))
o:value(5, translate("Every Friday"))
o:value(6, translate("Every Saturday"))
o:value(0, translate("Every Sunday"))
-o.default = 7
-o:depends("auto_update", true)
-o.rmempty = true
----- Time Update
-o = s:option(ListValue, "time_update", translate("Update Time(every day)"))
-for t = 0, 23 do o:value(t, t .. ":00") end
-o.default = 0
-o:depends("week_update", "0")
-o:depends("week_update", "1")
-o:depends("week_update", "2")
-o:depends("week_update", "3")
-o:depends("week_update", "4")
-o:depends("week_update", "5")
-o:depends("week_update", "6")
-o:depends("week_update", "7")
-o.rmempty = true
+o = s:option(Value, "update_time_mode", translate("Update Time"))
+o:value("0:00")
+for t = 0, 23 do
+ if t == 12 then
+ o:value(t .. ":30")
+ elseif t == 23 then
+ o:value(t .. ":59")
+ else
+ o:value(t .. ":00")
+ end
+end
+o.default = "0:00"
+o.validate = function(self, value)
+ local b = api.is_timehhmm(value)
+ if b then
+ return value
+ end
+ return nil
+end
+o:depends("update_week_mode", "0")
+o:depends("update_week_mode", "1")
+o:depends("update_week_mode", "2")
+o:depends("update_week_mode", "3")
+o:depends("update_week_mode", "4")
+o:depends("update_week_mode", "5")
+o:depends("update_week_mode", "6")
+o:depends("update_week_mode", "7")
----- Interval Update
-o = s:option(ListValue, "interval_update", translate("Update Interval(hour)"))
+o = s:option(ListValue, "update_interval_mode", translate("Update Interval(hour)"))
for t = 1, 24 do o:value(t, t .. " " .. translate("hour")) end
o.default = 2
-o:depends("week_update", "8")
+o:depends("update_week_mode", "8")
o.rmempty = true
--- The update option is always hidden by JavaScript.
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
index f3930ed4..59723a56 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua
@@ -128,6 +128,7 @@ o:value("https://www.google.com/generate_204", "Google")
o:value("https://www.youtube.com/generate_204", "YouTube")
o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)")
o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)")
+o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)")
o.default = o.keylist[3]
o:depends("enable_autoswitch", true)
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua
index 8cf95aed..2cbeb54d 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua
@@ -46,6 +46,12 @@ o.rewrite_option = o.option
o = s:option(Value, _n("realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o.rewrite_option = o.option
o:depends({ [_n("realms")] = "1" })
+o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+end
o = s:option(DynamicList, _n("realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -67,6 +73,20 @@ o.rewrite_option = o.option
o:depends({ [_n("obfs_type")] = "salamander" })
o:depends({ [_n("obfs_type")] = "gecko" })
+o = s:option(Value, _n("obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+o.datatype = "uinteger"
+o.placeholder = "512"
+o.default = "512"
+o:depends({ [_n("obfs_type")] = "gecko" })
+o.rewrite_option = o.option
+
+o = s:option(Value, _n("obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+o.datatype = "uinteger"
+o.placeholder = "1200"
+o.default = "1200"
+o:depends({ [_n("obfs_type")] = "gecko" })
+o.rewrite_option = o.option
+
o = s:option(Flag, _n("fast_open"), translate("Fast Open"))
o.default = "0"
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
index 717c9ac4..d92660c4 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua
@@ -32,10 +32,10 @@ if formvalue_proto then s.val["protocol"] = formvalue_proto end
local arg_select_proto = luci.http.formvalue("select_proto") or ""
local ss_method_list = {
- "none", "plain", "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
+ "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
}
-local security_list = { "none", "auto", "aes-128-gcm", "chacha20-poly1305", "zero" }
+local security_list = { "auto", "aes-128-gcm", "chacha20-poly1305" }
local header_type_list = {
"none", "srtp", "utp", "wechat-video", "dtls", "wireguard", "dns"
@@ -243,7 +243,8 @@ if load_balancing_options then -- [[ Load balancing Start ]]
o:value("https://www.youtube.com/generate_204", "YouTube")
o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)")
o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)")
- o.default = "https://www.google.com/generate_204"
+ o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)")
+ o.default = o.keylist[3]
o.description = translate("The URL used to detect the connection status.")
o = s:option(Value, _n("probeInterval"), translate("Probe Interval"))
@@ -348,6 +349,12 @@ end
o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o:depends({ [_n("hysteria2_realms")] = "1" })
+o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+end
o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -367,6 +374,18 @@ o = s:option(Value, _n("hysteria2_obfs_password"), translate("Obfs Password"))
o:depends({ [_n("hysteria2_obfs_type")] = "salamander" })
o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+o.datatype = "uinteger"
+o.placeholder = "512"
+o.default = "512"
+o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
+o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+o.datatype = "uinteger"
+o.placeholder = "1200"
+o.default = "1200"
+o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
o = s:option(Value, _n("hysteria2_up_mbps"), translate("Max upload Mbps"))
o:depends({ [_n("protocol")] = "hysteria2" })
@@ -493,6 +512,7 @@ o:value("ios")
o:value("android")
o:value("random")
o:value("randomized")
+o:value("unsafe")
o.default = "chrome"
o:depends({ [_n("tls")] = true, [_n("utls")] = true })
o:depends({ [_n("tls")] = true, [_n("reality")] = true })
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua
index 55d75677..e1023ae8 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua
@@ -165,7 +165,8 @@ if load_urltest_options then -- [[ URLTest Start ]]
o:value("https://www.youtube.com/generate_204", "YouTube")
o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)")
o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)")
- o.default = "https://www.gstatic.com/generate_204"
+ o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)")
+ o.default = o.keylist[3]
o.description = translate("The URL used to detect the connection status.")
o = s:option(Value, _n("urltest_interval"), translate("Test interval"))
@@ -411,6 +412,12 @@ if singbox_tags:find("with_quic") then
o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o:depends({ [_n("hysteria2_realms")] = "1" })
+ o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+ end
o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -430,6 +437,18 @@ if singbox_tags:find("with_quic") then
o:depends({ [_n("hysteria2_obfs_type")] = "salamander" })
o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+ o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+ o.datatype = "uinteger"
+ o.placeholder = "512"
+ o.default = "512"
+ o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
+ o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+ o.datatype = "uinteger"
+ o.placeholder = "1200"
+ o.default = "1200"
+ o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
o = s:option(Value, _n("hysteria2_up_mbps"), translate("Max upload Mbps"))
o:depends({ [_n("protocol")] = "hysteria2" })
@@ -679,12 +698,12 @@ o = s:option(Flag, _n("http_h2_health_check"), translate("Health check"))
o:depends({ [_n("tls")] = true, [_n("transport")] = "http" })
o = s:option(Value, _n("http_h2_read_idle_timeout"), translate("Idle timeout"))
-o.default = "10"
-o:depends({ [_n("tls")] = true, [_n("transport")] = "http", [_n("http_h2_health_check")] = true })
+o.default = "15"
+o:depends({ [_n("http_h2_health_check")] = true })
o = s:option(Value, _n("http_h2_health_check_timeout"), translate("Health check timeout"))
o.default = "15"
-o:depends({ [_n("tls")] = true, [_n("transport")] = "http", [_n("http_h2_health_check")] = true })
+o:depends({ [_n("http_h2_health_check")] = true })
-- [[ WebSocket ]]--
o = s:option(Value, _n("ws_host"), translate("WebSocket Host"))
@@ -720,11 +739,11 @@ o = s:option(Flag, _n("grpc_health_check"), translate("Health check"))
o:depends({ [_n("transport")] = "grpc" })
o = s:option(Value, _n("grpc_idle_timeout"), translate("Idle timeout"))
-o.default = "10"
+o.default = "15"
o:depends({ [_n("grpc_health_check")] = true })
o = s:option(Value, _n("grpc_health_check_timeout"), translate("Health check timeout"))
-o.default = "20"
+o.default = "15"
o:depends({ [_n("grpc_health_check")] = true })
o = s:option(Flag, _n("grpc_permit_without_stream"), translate("Permit without stream"))
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua
index cc9a733a..0b0dd1e2 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua
@@ -34,6 +34,12 @@ o:depends({ [_n("custom")] = false })
o = s:option(Value, _n("realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o.rewrite_option = o.option
o:depends({ [_n("realms")] = "1" })
+o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+end
o = s:option(DynamicList, _n("realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -57,6 +63,20 @@ o.rewrite_option = o.option
o:depends({ [_n("obfs_type")] = "salamander" })
o:depends({ [_n("obfs_type")] = "gecko" })
+o = s:option(Value, _n("obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+o.datatype = "uinteger"
+o.placeholder = "512"
+o.default = "512"
+o:depends({ [_n("obfs_type")] = "gecko" })
+o.rewrite_option = o.option
+
+o = s:option(Value, _n("obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+o.datatype = "uinteger"
+o.placeholder = "1200"
+o.default = "1200"
+o:depends({ [_n("obfs_type")] = "gecko" })
+o.rewrite_option = o.option
+
o = s:option(Flag, _n("udp"), translate("UDP"))
o.default = "1"
o.rewrite_option = o.option
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua
index 31104c2f..cf944c3f 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua
@@ -24,7 +24,7 @@ local function _n(name)
end
local x_ss_method_list = {
- "none", "plain", "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
+ "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
}
local header_type_list = {
@@ -130,6 +130,12 @@ o:depends({ [_n("protocol")] = "hysteria2"})
o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o:depends({ [_n("hysteria2_realms")] = "1" })
+o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+end
o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -149,6 +155,18 @@ o = s:option(Value, _n("hysteria2_obfs_password"), translate("Obfs Password"))
o:depends({ [_n("hysteria2_obfs_type")] = "salamander" })
o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+o.datatype = "uinteger"
+o.placeholder = "512"
+o.default = "512"
+o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
+o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+o.datatype = "uinteger"
+o.placeholder = "1200"
+o.default = "1200"
+o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
o = s:option(Flag, _n("hysteria2_ignore_client_bandwidth"), translate("Client BBR Flow Control"))
o.default = 0
o:depends({ [_n("protocol")] = "hysteria2" })
diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua
index f367a01c..d45dc4ad 100644
--- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua
+++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua
@@ -163,6 +163,12 @@ if singbox_tags:find("with_quic") then
o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name")
o:depends({ [_n("hysteria2_realms")] = "1" })
+ o.validate = function(self, value)
+ value = api.trim(value)
+ local realm = api.parse_realm_uri(value)
+ if realm then return value end
+ return nil, translate("Invalid Realm URL.")
+ end
o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN"))
o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" }
@@ -182,6 +188,18 @@ if singbox_tags:find("with_quic") then
o:depends({ [_n("hysteria2_obfs_type")] = "salamander" })
o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+ o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)"))
+ o.datatype = "uinteger"
+ o.placeholder = "512"
+ o.default = "512"
+ o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
+ o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)"))
+ o.datatype = "uinteger"
+ o.placeholder = "1200"
+ o.default = "1200"
+ o:depends({ [_n("hysteria2_obfs_type")] = "gecko" })
+
o = s:option(Flag, _n("hysteria2_ignore_client_bandwidth"), translate("Client BBR Flow Control"), translate("Commands the client to use the BBR flow control algorithm"))
o.default = 0
o:depends({ [_n("protocol")] = "hysteria2" })
diff --git a/luci-app-passwall2/luasrc/passwall2/api.lua b/luci-app-passwall2/luasrc/passwall2/api.lua
index e3519254..561b7555 100644
--- a/luci-app-passwall2/luasrc/passwall2/api.lua
+++ b/luci-app-passwall2/luasrc/passwall2/api.lua
@@ -367,6 +367,18 @@ function strToTable(str)
return loadstring("return " .. str)()
end
+function is_timehhmm(timeStr)
+ local hour, minute = string.match(timeStr, "^(%d?%d):(%d%d)$")
+ if hour and minute then
+ hour = tonumber(hour)
+ minute = tonumber(minute)
+ if hour >= 0 and hour <= 23 and minute >= 0 and minute <= 59 then
+ return true
+ end
+ end
+ return false
+end
+
function is_normal_node(e)
if e and e.type and e.protocol and (e.protocol == "_balancing" or e.protocol == "_shunt" or e.protocol == "_iface" or e.protocol == "_urltest") then
return false
@@ -1449,7 +1461,7 @@ function luci_types(id, m, s, type_name, option_prefix)
end
end
end
-function format_go_time(input)
+function format_go_time(input, default)
input = input and trim(input)
local N = 0
if input and input:match("^%d+$") then
@@ -1467,7 +1479,7 @@ function format_go_time(input)
end
end
if N <= 0 then
- return "0s"
+ return default or "0s"
end
local result = ""
local h = math.floor(N / 3600)
@@ -1610,22 +1622,34 @@ function get_dnsmasq_server_domain()
end
function parse_realm_uri(uri)
- if type(uri) ~= "string" then return nil end
+ uri = trim(uri)
+ if uri == "" then return nil end
-- realm[+http]://token@server/realm_id?query
- local scheme, token, server_url, realm_id, query = trim(uri):match("^(realm%+http|realm)://([^@]+)@([^/]+)/([^?]*)%??(.*)$")
- if not scheme or not token or not server_url or not realm_id then return nil end
+ local scheme = (uri:match("^realm%+http://") and "realm+http") or (uri:match("^realm://") and "realm")
+ if not scheme then return nil end
+ uri = uri:gsub("^realm%+http://", ""):gsub("^realm://", "")
+ local token, server_url, realm_id, query = uri:match("^([^@]+)@([^/]+)/([^?]*)%??(.*)$")
+ if not token or not server_url or not realm_id then return nil end
realm_id = realm_id:gsub("/+$", "")
+ local address, port = server_url:match("^%[([^%]]+)%]:(%d+)$") --ipv6:port
+ if not address then
+ address, port = server_url:match("^([^:]+):(%d+)$") --ipv4[domain]:port
+ end
+ address = address or server_url:match("^%[([^%]]+)%]$") or server_url
+ port = tonumber(port) or (scheme == "realm+http" and 80 or 443)
local realm = {
scheme = scheme,
token = token,
server_url = server_url,
+ address = address,
+ port = port,
realm_id = realm_id
}
-- Parse stun= in the query
local stun_servers
- for value in (query or ""):gmatch("[?&]?[Ss][Tt][Uu][Nn]=([^&]+)") do
- if not stun_servers then stun_servers = {} end
- stun_servers[#stun_servers + 1] = value
+ for v in (query or ""):gmatch("[Ss][Tt][Uu][Nn]=([^&]+)") do
+ stun_servers = stun_servers or {}
+ stun_servers[#stun_servers + 1] = v
end
realm.stun_servers = stun_servers
return realm
diff --git a/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua b/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua
index 48673249..de2a1f2d 100644
--- a/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua
+++ b/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua
@@ -39,6 +39,18 @@ function gen_config_server(node)
stunServers = node.hysteria2_realm_stun
} or nil
}
+
+ if config.obfs and config.obfs.gecko then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ config.obfs.gecko.minPacketSize = min
+ config.obfs.gecko.maxPacketSize = max
+ end
+
return config
end
@@ -145,6 +157,17 @@ function gen_config(var)
} or nil
}
+ if config.obfs and config.obfs.gecko then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ config.obfs.gecko.minPacketSize = min
+ config.obfs.gecko.maxPacketSize = max
+ end
+
return jsonc.stringify(config, 1)
end
diff --git a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
index 39580747..bbb5e872 100644
--- a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
+++ b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua
@@ -327,8 +327,6 @@ function gen_outbound(flag, node, tag, proxy_table)
headers = node.user_agent and {
["User-Agent"] = node.user_agent
} or nil,
- idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil,
- ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil,
}
-- TLS is not enforced. If TLS is not configured, plain HTTP 1.1 will be used.
end
@@ -341,8 +339,8 @@ function gen_outbound(flag, node, tag, proxy_table)
headers = node.user_agent and {
["User-Agent"] = node.user_agent
} or nil,
- idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil,
- ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil,
+ idle_timeout = (node.http_h2_health_check == "1") and api.format_go_time(node.http_h2_read_idle_timeout, "15s") or nil,
+ ping_timeout = (node.http_h2_health_check == "1") and api.format_go_time(node.http_h2_health_check_timeout, "15s") or nil,
}
-- TLS is not enforced. If TLS is not configured, plain HTTP 1.1 will be used.
end
@@ -382,8 +380,8 @@ function gen_outbound(flag, node, tag, proxy_table)
v2ray_transport = {
type = "grpc",
service_name = node.grpc_serviceName,
- idle_timeout = tonumber(node.grpc_idle_timeout) or nil,
- ping_timeout = tonumber(node.grpc_health_check_timeout) or nil,
+ idle_timeout = (node.grpc_health_check == "1") and api.format_go_time(node.grpc_idle_timeout, "15s") or nil,
+ ping_timeout = (node.grpc_health_check == "1") and api.format_go_time(node.grpc_health_check_timeout, "15s") or nil,
permit_without_stream = (node.grpc_permit_without_stream == "1") and true or nil,
}
end
@@ -595,20 +593,34 @@ function gen_outbound(flag, node, tag, proxy_table)
hop_interval_max = interval_max,
up_mbps = (node.hysteria2_up_mbps and tonumber(node.hysteria2_up_mbps)) and tonumber(node.hysteria2_up_mbps) or nil,
down_mbps = (node.hysteria2_down_mbps and tonumber(node.hysteria2_down_mbps)) and tonumber(node.hysteria2_down_mbps) or nil,
- obfs = node.hysteria2_obfs_type and {
- type = node.hysteria2_obfs_type,
- password = node.hysteria2_obfs_password
- } or nil,
+ obfs = (function(t)
+ if not t or t == "" then return nil end
+ local o = {
+ type = t,
+ password = node.hysteria2_obfs_password
+ }
+ if t == "gecko" then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ o.min_packet_size = min
+ o.max_packet_size = max
+ end
+ return o
+ end)(node.hysteria2_obfs_type),
password = node.hysteria2_auth_password or nil,
idle_timeout = (function(t)
if not version_ge_1_14_0 then return nil end
t = tonumber(tostring(t or "30"):match("^%d+"))
- return (t and t >= 4 and t <= 120) and t or 30
+ return (t and t >= 4 and t <= 120) and t .. "s" or "30s"
end)(node.hysteria2_idle_timeout),
keep_alive_period = (function(t)
if not version_ge_1_14_0 then return nil end
t = tonumber(tostring(t or "0"):match("^%d+"))
- return (t and t >= 2 and t <= 60) and t or nil
+ return (t and t >= 2 and t <= 60) and t .. "s" or nil
end)(node.hysteria2_keep_alive_period),
disable_path_mtu_discovery = version_ge_1_14_0 and (tonumber(node.hysteria2_disable_mtu_discovery) == 1) or nil,
tls = tls,
@@ -620,6 +632,8 @@ function gen_outbound(flag, node, tag, proxy_table)
realm.server_url = (realm.scheme == "realm+http" and "http://" or "https://") .. realm.server_url
realm.stun_servers = realm.stun_servers or node.hysteria2_realm_stun
realm.scheme = nil
+ realm.address = nil
+ realm.port = nil
return realm
end
return nil
@@ -945,10 +959,24 @@ function gen_config_server(node)
protocol_table = {
up_mbps = (node.hysteria2_ignore_client_bandwidth ~= "1" and node.hysteria2_up_mbps and tonumber(node.hysteria2_up_mbps)) and tonumber(node.hysteria2_up_mbps) or nil,
down_mbps = (node.hysteria2_ignore_client_bandwidth ~= "1" and node.hysteria2_down_mbps and tonumber(node.hysteria2_down_mbps)) and tonumber(node.hysteria2_down_mbps) or nil,
- obfs = node.hysteria2_obfs_type and {
- type = node.hysteria2_obfs_type,
- password = node.hysteria2_obfs_password
- } or nil,
+ obfs = (function(t)
+ if not t or t == "" then return nil end
+ local o = {
+ type = t,
+ password = node.hysteria2_obfs_password
+ }
+ if t == "gecko" then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ o.min_packet_size = min
+ o.max_packet_size = max
+ end
+ return o
+ end)(node.hysteria2_obfs_type),
users = {
{
name = "user1",
@@ -963,6 +991,8 @@ function gen_config_server(node)
realm.server_url = (realm.scheme == "realm+http" and "http://" or "https://") .. realm.server_url
realm.stun_servers = realm.stun_servers or node.hysteria2_realm_stun
realm.scheme = nil
+ realm.address = nil
+ realm.port = nil
realm.stun_domain_resolver = "direct"
return realm
end
diff --git a/luci-app-passwall2/luasrc/passwall2/util_xray.lua b/luci-app-passwall2/luasrc/passwall2/util_xray.lua
index fa19ba07..e2335a41 100644
--- a/luci-app-passwall2/luasrc/passwall2/util_xray.lua
+++ b/luci-app-passwall2/luasrc/passwall2/util_xray.lua
@@ -14,6 +14,8 @@ local GLOBAL = {
local xray_version = api.get_app_version("xray")
+local xray_min_version = "26.3.27"
+
local function get_domain_excluded()
local path = string.format("/usr/share/%s/domains_excluded", appname)
local content = fs.readfile(path)
@@ -308,10 +310,18 @@ function gen_outbound(flag, node, tag, proxy_table)
local o = {
type = "salamander",
settings = node.hysteria2_obfs_password and {
- password = node.hysteria2_obfs_password,
- packetSize = node.hysteria2_obfs_type == "gecko" and "512-1200" or nil
+ password = node.hysteria2_obfs_password
} or nil
}
+ if node.hysteria2_obfs_type == "gecko" then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ o.settings.packetSize = min .. "-" .. max
+ end
udp[#udp+1] = o
end
if node.hysteria2_realms then
@@ -413,6 +423,14 @@ function gen_outbound(flag, node, tag, proxy_table)
}
}
+ if node.protocol == "hysteria" and node.hysteria2_realms then
+ local realm = api.parse_realm_uri(node.hysteria2_realm_url)
+ if realm then
+ result.settings.address = realm.address
+ result.settings.port = realm.port
+ end
+ end
+
if node.protocol == "wireguard" then
result.settings.noKernelTun = true
if node.finalmask and node.finalmask ~= "" then
@@ -736,10 +754,18 @@ function gen_config_server(node)
local o = {
type = "salamander",
settings = node.hysteria2_obfs_password and {
- password = node.hysteria2_obfs_password,
- packetSize = node.hysteria2_obfs_type == "gecko" and "512-1200" or nil
+ password = node.hysteria2_obfs_password
} or nil
}
+ if node.hysteria2_obfs_type == "gecko" then
+ local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512
+ local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200
+ if min <= 0 or min > max or max > 2048 then
+ min = 512
+ max = 1200
+ end
+ o.settings.packetSize = min .. "-" .. max
+ end
udp[#udp+1] = o
end
if node.hysteria2_realms then
@@ -784,7 +810,10 @@ function gen_config_server(node)
}
},
outbounds = outbounds,
- routing = routing
+ routing = routing,
+ version = {
+ min = xray_min_version
+ }
}
local alpn = {}
@@ -881,13 +910,21 @@ function gen_config(var)
local xray_settings = uci:get_all(appname, "@global_xray[0]") or {}
if xray_settings.fragment == "1" then
- local delay = xray_settings.fragment_delay
+ local lengths, delays = {}, {}
+ api.trim(xray_settings.fragment_lengths):gsub("[^,]+", function(w)
+ w = w:gsub("%s+", "")
+ if w ~= "" then lengths[#lengths+1] = w end
+ end)
+ api.trim(xray_settings.fragment_delays):gsub("[^,]+", function(w)
+ w = w:gsub("%s+", "")
+ if w ~= "" then delays[#delays+1] = w end
+ end)
fragment_table = {
type = "fragment",
settings = {
packets = xray_settings.fragment_packets,
- length = xray_settings.fragment_length,
- delay = delay and (delay:find("-", 1, true) and delay or tonumber(delay)) or nil,
+ lengths = #lengths > 0 and lengths or nil,
+ delays = #delays > 0 and delays or nil,
maxSplit = xray_settings.fragment_maxSplit
}
}
@@ -1971,6 +2008,10 @@ function gen_config(var)
if inbounds or outbounds then
local config = {
+ env = (function()
+ local asset_location = uci:get(appname, "@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/"
+ return { XRAY_LOCATION_ASSET = asset_location }
+ end)(),
log = {
--access = string.format("/tmp/etc/%s/%s_access.log", appname, "global"),
--error = string.format("/tmp/etc/%s/%s_error.log", appname, "global"),
@@ -2000,6 +2041,9 @@ function gen_config(var)
-- statsInboundUplink = false,
-- statsInboundDownlink = false
-- }
+ },
+ version = {
+ min = xray_min_version
}
}
diff --git a/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm b/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm
index 0dcbb559..7b31c08e 100644
--- a/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm
+++ b/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm
@@ -1,7 +1,7 @@
+
<%
-local api = require "luci.passwall2.api"
-local com = require "luci.passwall2.com"
-local version = {}
+local api = self.api
+local com = self.com
-%>
+
\ No newline at end of file
diff --git a/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm b/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm
index 28128380..f27e7a1f 100644
--- a/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm
+++ b/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm
@@ -552,8 +552,9 @@ local current_node = map:get(section)
}
params += "&type=" + v_transport;
+ var v_security = "none";
if (opt.get(dom_prefix + "tls").checked) {
- var v_security = "tls";
+ v_security = "tls";
if (opt.get(dom_prefix + "fingerprint") && opt.get(dom_prefix + "fingerprint").value != "") {
let v_fp = opt.get(dom_prefix + "fingerprint").value;
params += "&fp=" + v_fp;
@@ -565,7 +566,6 @@ local current_node = map:get(section)
params += opt.query("spx", dom_prefix + "reality_spiderX");
params += opt.query("pqv", dom_prefix + "reality_mldsa65Verify");
}
- params += "&security=" + v_security;
params += opt.query("alpn", dom_prefix + "alpn");
params += opt.query("sni", dom_prefix + "tls_serverName");
params += opt.query("allowinsecure", dom_prefix + "tls_allowInsecure");
@@ -573,6 +573,7 @@ local current_node = map:get(section)
params += opt.query("vcn", dom_prefix + "tls_CertByName");
params += opt.query("ech", dom_prefix + "ech_config");
}
+ params += "&security=" + v_security;
opt.get(dom_prefix + "tcp_fast_open")?.checked && (params += "&tfo=1");
if (opt.get(dom_prefix + "use_finalmask")?.checked) {
@@ -598,10 +599,14 @@ local current_node = map:get(section)
if (v_type === "Hysteria2") {
v_password = opt.get("hysteria2_auth_password");
- var dom_obfs = opt.get("hysteria2_obfs_password");
- if (dom_obfs && dom_obfs.value != "") {
+ var dom_obfs_type = opt.get("hysteria2_obfs_type");
+ if (dom_obfs_type && dom_obfs_type.value != "") {
params += opt.query("obfs", "hysteria2_obfs_type");
params += opt.query("obfs-password", "hysteria2_obfs_password");
+ if (dom_obfs_type.value === "gecko") {
+ params += opt.query("minPacketSize", "hysteria2_obfs_MinPacketSize");
+ params += opt.query("maxPacketSize", "hysteria2_obfs_MaxPacketSize");
+ }
}
params += opt.query("mport", "hysteria2_hop");
} else {
@@ -610,6 +615,10 @@ local current_node = map:get(section)
if (dom_obfs_type && dom_obfs_type.value != "") {
params += opt.query("obfs", dom_prefix + "hysteria2_obfs_type");
params += opt.query("obfs-password", dom_prefix + "hysteria2_obfs_password");
+ if (dom_obfs_type.value === "gecko") {
+ params += opt.query("minPacketSize", dom_prefix + "hysteria2_obfs_MinPacketSize");
+ params += opt.query("maxPacketSize", dom_prefix + "hysteria2_obfs_MaxPacketSize");
+ }
}
params += opt.query("mport", dom_prefix + "hysteria2_hop");
if (opt.get(dom_prefix + "use_finalmask")?.checked) {
@@ -671,7 +680,7 @@ local current_node = map:get(section)
params += "&security=" + v_security;
params += opt.query("alpn", dom_prefix + "alpn");
params += opt.query("sni", dom_prefix + "tls_serverName");
- params += opt.query("allowinsecure", dom_prefix + "tls_allowInsecure");
+ params += opt.query("insecure", dom_prefix + "tls_allowInsecure");
}
params += "#" + encodeURI(v_alias.value);
@@ -1295,17 +1304,37 @@ local current_node = map:get(section)
}
queryParam.security = queryParam.security || "tls";
- opt.set(dom_prefix + 'tls', queryParam.security === "tls");
- if (queryParam.security === "tls") {
- opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
- opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
- opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || '');
- opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');
+ if (queryParam.security == "tls" || queryParam.security == "reality") {
+ if (queryParam.security == "tls") {
+ opt.set(dom_prefix + 'tls', true);
+ opt.set(dom_prefix + 'reality', false);
+ opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
+ opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
+ if (queryParam.fp && queryParam.fp.trim() != "") {
+ opt.set(dom_prefix + 'utls', true);
+ opt.set(dom_prefix + 'fingerprint', queryParam.fp);
+ }
+ opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || '');
+ opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');
+ opt.set(
+ dom_prefix + 'tls_allowInsecure',
+ !((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0')
+ );
+ }
+ if (queryParam.security == "reality") {
+ opt.set(dom_prefix + 'tls', true);
+ opt.set(dom_prefix + 'reality', true);
+ opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
+ opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
+ if (queryParam.fp && queryParam.fp.trim() != "") {
+ opt.set(dom_prefix + 'utls', true);
+ opt.set(dom_prefix + 'fingerprint', queryParam.fp);
+ }
+ opt.set(dom_prefix + 'reality_publicKey', queryParam.pbk || '');
+ opt.set(dom_prefix + 'reality_shortId', queryParam.sid || '');
+ }
}
- opt.set(
- dom_prefix + 'tls_allowInsecure',
- !((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0')
- );
+
opt.set(dom_prefix + 'tcp_fast_open', queryParam.tfo);
opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm);
opt.set(dom_prefix + 'finalmask', queryParam.fm || "");
@@ -1417,11 +1446,9 @@ local current_node = map:get(section)
}
if (ssu[0] === "vless") {
if (vless_type == "sing-box" && has_singbox) {
- dom_prefix = "singbox_"
- opt.set('type', "sing-box");
+ dom_prefix = "singbox_";
} else {
- dom_prefix = "xray_"
- opt.set('type', "Xray");
+ dom_prefix = "xray_";
}
var m = parseNodeUrl(ssrurl);
@@ -1444,20 +1471,22 @@ local current_node = map:get(section)
queryParam.type = queryParam.type.toLowerCase();
if (["xhttp", "kcp", "mkcp"].includes(queryParam.type) && vless_type !== "xray" && has_xray) {
- dom_prefix = "xray_"
- opt.set('type', "Xray");
+ dom_prefix = "xray_";
}
+ opt.set("type", dom_prefix === "singbox_" ? "sing-box" : "Xray");
+
opt.set(dom_prefix + 'protocol', "vless");
opt.set(dom_prefix + 'uuid', password);
opt.set(dom_prefix + 'address', unbracketIP(m.hostname));
opt.set(dom_prefix + 'port', m.port || "443");
opt.set(dom_prefix + 'encryption', queryParam.encryption || "none");
- opt.set(dom_prefix + 'flow', queryParam.flow || '');
+ queryParam.security = (!queryParam.security && queryParam.flow) ? "tls" : queryParam.security;
if (queryParam.security) {
if (queryParam.security == "tls") {
opt.set(dom_prefix + 'tls', true);
opt.set(dom_prefix + 'reality', false);
+ opt.set(dom_prefix + 'flow', queryParam.flow || '');
opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
opt.set(dom_prefix + 'tls_serverName', queryParam.sni || '');
opt.set(
@@ -1477,6 +1506,7 @@ local current_node = map:get(section)
if (queryParam.security == "reality") {
opt.set(dom_prefix + 'tls', true);
opt.set(dom_prefix + 'reality', true);
+ opt.set(dom_prefix + 'flow', queryParam.flow || '');
opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
opt.set(dom_prefix + 'tls_serverName', queryParam.sni || '');
if (queryParam.fp && queryParam.fp.trim() != "") {
@@ -1601,6 +1631,10 @@ local current_node = map:get(section)
opt.set(dom_prefix + 'hysteria2_obfs_type', queryParam.obfs || "salamander");
opt.set(dom_prefix + 'hysteria2_obfs_password', queryParam["obfs-password"] || queryParam["obfs_password"]);
}
+ if (queryParam.obfs === "gecko") {
+ opt.set(dom_prefix + 'hysteria2_obfs_MinPacketSize', queryParam.minPacketSize || "512");
+ opt.set(dom_prefix + 'hysteria2_obfs_MaxPacketSize', queryParam.maxPacketSize || "1200");
+ }
opt.set(dom_prefix + 'hysteria2_hop', queryParam.mport || "");
opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm);
opt.set(dom_prefix + 'finalmask', queryParam.fm || "");
@@ -1612,6 +1646,10 @@ local current_node = map:get(section)
opt.set(dom_prefix + 'obfs_type', queryParam.obfs || "salamander");
opt.set(dom_prefix + 'obfs_password', queryParam["obfs-password"] || queryParam["obfs_password"]);
}
+ if (queryParam.obfs === "gecko") {
+ opt.set(dom_prefix + 'obfs_MinPacketSize', queryParam.minPacketSize || "512");
+ opt.set(dom_prefix + 'obfs_MaxPacketSize', queryParam.maxPacketSize || "1200");
+ }
opt.set(dom_prefix + 'hop', queryParam.mport || "");
}
@@ -1704,9 +1742,7 @@ local current_node = map:get(section)
queryParam[decodeURIComponent(params[0]).toLowerCase()] = decodeURIComponent(params[1] || '');
}
}
- if (!queryParam.security || queryParam.security == "") {
- queryParam.security = "tls";
- }
+ queryParam.security = queryParam.security || "tls";
if (queryParam.security) {
if (queryParam.security == "tls") {
opt.set(dom_prefix + 'tls', true);
diff --git a/luci-app-passwall2/po/fa/passwall2.po b/luci-app-passwall2/po/fa/passwall2.po
index d30d9d94..f464183a 100644
--- a/luci-app-passwall2/po/fa/passwall2.po
+++ b/luci-app-passwall2/po/fa/passwall2.po
@@ -672,8 +672,8 @@ msgstr "واحد: دقیقه"
msgid "stop automatically mode"
msgstr "حالت توقف خودکار"
-msgid "stop Time(Every day)"
-msgstr "زمان توقف (هر روز)"
+msgid "stop Time"
+msgstr "زمان را متوقف کنید"
msgid "stop Interval(Hour)"
msgstr "بازه توقف (ساعت)"
@@ -681,8 +681,8 @@ msgstr "بازه توقف (ساعت)"
msgid "start automatically mode"
msgstr "حالت شروع خودکار"
-msgid "start Time(Every day)"
-msgstr "زمان شروع (هر روز)"
+msgid "start Time"
+msgstr "زمان شروع"
msgid "start Interval(Hour)"
msgstr "بازه شروع (ساعت)"
@@ -690,8 +690,8 @@ msgstr "بازه شروع (ساعت)"
msgid "restart automatically mode"
msgstr "حالت راهاندازی مجدد خودکار"
-msgid "restart Time(Every day)"
-msgstr "زمان راهاندازی مجدد (هر روز)"
+msgid "restart Time"
+msgstr "زمان راه اندازی مجدد"
msgid "restart Interval(Hour)"
msgstr "بازه راهاندازی مجدد (ساعت)"
@@ -756,11 +756,11 @@ msgstr "ربودن ICMP (PING)"
msgid "Hijacking ICMPv6 (IPv6 PING)"
msgstr "ربودن ICMPv6 (IPv6 PING)"
-msgid "Force Proxy LAN IP"
-msgstr "IP پروکسی LAN را مجبور کنید"
+msgid "Direct IP List"
+msgstr "لیست آیپیهای مستقیم"
-msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here."
-msgstr "به طور پیشفرض، محدودههای IP شبکه داخلی که معمولاً استفاده میشوند، مستقیماً متصل میشوند (و وارد هسته نمیشوند). اگر میخواهید محدوده شبکه خاصی از طریق پروکسی عبور کند، لطفاً آن را اینجا اضافه کنید."
+msgid "These had been joined ip addresses will connect directly (not entering the core)."
+msgstr "این آدرسهای IP که به هم متصل شدهاند، مستقیماً متصل میشوند (و وارد هسته نمیشوند)."
msgid "Sniffing"
msgstr "شنود (Sniffing)"
@@ -897,17 +897,14 @@ msgstr "بازگردانی"
msgid "Rollbacking..."
msgstr "در حال بازگردانی..."
-msgid "Enable auto update rules"
-msgstr "فعالسازی بهروزرسانی خودکار قوانین"
-
-msgid "Update Time(every day)"
-msgstr "زمان بهروزرسانی (هر روز)"
+msgid "Update Time"
+msgstr "زمان بهروزرسانی"
msgid "Update Interval(hour)"
msgstr "بازه بهروزرسانی (ساعت)"
-msgid "Update Mode"
-msgstr "حالت بهروزرسانی"
+msgid "Auto Update Mode"
+msgstr "حالت بهروزرسانی خودکار"
msgid "Loop Mode"
msgstr "حالت حلقه"
@@ -1005,9 +1002,6 @@ msgstr "در حال انتقال..."
msgid "App Update"
msgstr "بهروزرسانی برنامه"
-msgid "Please confirm that your firmware supports FPU."
-msgstr "لطفاً تأیید کنید که سیستمعامل شما از FPU پشتیبانی میکند."
-
msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually."
msgstr "اگر میخواهید از حافظه اجرا کنید، مسیر را تغییر دهید، با /tmp شروع شود سپس برنامه را ذخیره و دستی بهروزرسانی کنید."
@@ -2394,3 +2388,12 @@ msgstr "اشتراک کامل شد..."
msgid "Processing, please wait…"
msgstr "در حال پردازش، لطفا صبر کنید…"
+
+msgid "Invalid Realm URL."
+msgstr "آدرس اینترنتی (URL) نامعتبر است."
+
+msgid "Gecko Packet Size (min)"
+msgstr "اندازه بسته Gecko (دقیقه)"
+
+msgid "Gecko Packet Size (max)"
+msgstr "اندازه بسته Gecko (حداکثر)"
\ No newline at end of file
diff --git a/luci-app-passwall2/po/ru/passwall2.po b/luci-app-passwall2/po/ru/passwall2.po
index 7b8e83d1..1465593f 100644
--- a/luci-app-passwall2/po/ru/passwall2.po
+++ b/luci-app-passwall2/po/ru/passwall2.po
@@ -673,8 +673,8 @@ msgstr "Единица: минуты"
msgid "stop automatically mode"
msgstr "Режим автоотключения"
-msgid "stop Time(Every day)"
-msgstr "Время отключения (ежедневно)"
+msgid "stop Time"
+msgstr "Время отключения"
msgid "stop Interval(Hour)"
msgstr "Интервал отключения (часы)"
@@ -682,8 +682,8 @@ msgstr "Интервал отключения (часы)"
msgid "start automatically mode"
msgstr "Режим автозапуска"
-msgid "start Time(Every day)"
-msgstr "Время запуска (ежедневно)"
+msgid "start Time"
+msgstr "Время запуска"
msgid "start Interval(Hour)"
msgstr "Интервал запуска (часы)"
@@ -691,8 +691,8 @@ msgstr "Интервал запуска (часы)"
msgid "restart automatically mode"
msgstr "Режим автоперезапуска"
-msgid "restart Time(Every day)"
-msgstr "Время перезапуска (ежедневно)"
+msgid "restart Time"
+msgstr "Время перезапуска"
msgid "restart Interval(Hour)"
msgstr "Интервал перезапуска (часы)"
@@ -757,11 +757,11 @@ msgstr "Перехват ICMP (PING)"
msgid "Hijacking ICMPv6 (IPv6 PING)"
msgstr "Перехват ICMPv6 (IPv6 PING)"
-msgid "Force Proxy LAN IP"
-msgstr "Принудительное использование IP-адреса локальной сети (Local IP)"
+msgid "Direct IP List"
+msgstr "Список прямых IP-адресов"
-msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here."
-msgstr "По умолчанию, часто используемые диапазоны IP-адресов внутренней сети будут подключаться напрямую (без доступа к ядру сети). Если вы хотите, чтобы определенный диапазон IP-адресов сети проходил через прокси-сервер, укажите это здесь."
+msgid "These had been joined ip addresses will connect directly (not entering the core)."
+msgstr "Эти объединенные IP-адреса будут подключаться напрямую (не входя в ядро сети)."
msgid "Sniffing"
msgstr "Анализ трафика"
@@ -898,17 +898,14 @@ msgstr "Откатить"
msgid "Rollbacking..."
msgstr "Выполняется откат..."
-msgid "Enable auto update rules"
-msgstr "Автообновление правил"
-
-msgid "Update Time(every day)"
-msgstr "Время обновления (ежедневно)"
+msgid "Update Time"
+msgstr "Время обновления"
msgid "Update Interval(hour)"
msgstr "Интервал обновления (часы)"
-msgid "Update Mode"
-msgstr "Режим обновления"
+msgid "Auto Update Mode"
+msgstr "Режим автоматического обновления"
msgid "Loop Mode"
msgstr "Циклический"
@@ -1006,9 +1003,6 @@ msgstr "Перемещение..."
msgid "App Update"
msgstr "Обновление компонентов"
-msgid "Please confirm that your firmware supports FPU."
-msgstr "Убедитесь, что ваша прошивка поддерживает FPU."
-
msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually."
msgstr "Если вы хотите запускать из оперативной памяти, измените путь на начинающийся с /tmp, затем сохраните настройки и обновите компонент вручную."
@@ -2392,3 +2386,12 @@ msgstr "Подписка завершена..."
msgid "Processing, please wait…"
msgstr "Обработка, пожалуйста, подождите…"
+
+msgid "Invalid Realm URL."
+msgstr "Неверный URL-адрес области."
+
+msgid "Gecko Packet Size (min)"
+msgstr "Размер упаковки Gecko (мин)"
+
+msgid "Gecko Packet Size (max)"
+msgstr "Размер упаковки Gecko (макс)"
diff --git a/luci-app-passwall2/po/zh-cn/passwall2.po b/luci-app-passwall2/po/zh-cn/passwall2.po
index e2aab053..4949ab1d 100644
--- a/luci-app-passwall2/po/zh-cn/passwall2.po
+++ b/luci-app-passwall2/po/zh-cn/passwall2.po
@@ -581,10 +581,10 @@ msgid "Certificate fingerprint"
msgstr "证书指纹"
msgid "Max upload Mbps"
-msgstr "最大上行(Mbps)"
+msgstr "最大上行（Mbps）"
msgid "Max download Mbps"
-msgstr "最大下行(Mbps)"
+msgstr "最大下行（Mbps）"
msgid "QUIC stream receive window"
msgstr "QUIC 流接收窗口"
@@ -664,8 +664,8 @@ msgstr "单位：分钟"
msgid "stop automatically mode"
msgstr "定时关闭模式"
-msgid "stop Time(Every day)"
-msgstr "关闭时间(每天)"
+msgid "stop Time"
+msgstr "关闭时间"
msgid "stop Interval(Hour)"
msgstr "关闭间隔(小时)"
@@ -673,8 +673,8 @@ msgstr "关闭间隔(小时)"
msgid "start automatically mode"
msgstr "定时开启模式"
-msgid "start Time(Every day)"
-msgstr "开启时间(每天)"
+msgid "start Time"
+msgstr "开启时间"
msgid "start Interval(Hour)"
msgstr "开启间隔(小时)"
@@ -682,8 +682,8 @@ msgstr "开启间隔(小时)"
msgid "restart automatically mode"
msgstr "定时重启模式"
-msgid "restart Time(Every day)"
-msgstr "重启时间(每天)"
+msgid "restart Time"
+msgstr "重启时间"
msgid "restart Interval(Hour)"
msgstr "重启间隔(小时)"
@@ -748,11 +748,11 @@ msgstr "劫持ICMP (PING)"
msgid "Hijacking ICMPv6 (IPv6 PING)"
msgstr "劫持ICMPv6 (IPv6 PING)"
-msgid "Force Proxy LAN IP"
-msgstr "强制代理内网IP段"
+msgid "Direct IP List"
+msgstr "直连 IP 列表"
-msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here."
-msgstr "默认情况下，常用内网IP网段将直连（不进入内核），如果你希望某个网段走代理，请在此添加。"
+msgid "These had been joined ip addresses will connect directly (not entering the core)."
+msgstr "加入的IP段将直连（不进入内核）。"
msgid "Sniffing"
msgstr "流量嗅探"
@@ -889,17 +889,14 @@ msgstr "回滚"
msgid "Rollbacking..."
msgstr "回滚中..."
-msgid "Enable auto update rules"
-msgstr "开启自动更新规则"
-
-msgid "Update Time(every day)"
-msgstr "更新时间(每天)"
+msgid "Update Time"
+msgstr "更新时间"
msgid "Update Interval(hour)"
msgstr "更新间隔(小时)"
-msgid "Update Mode"
-msgstr "更新模式"
+msgid "Auto Update Mode"
+msgstr "自动更新模式"
msgid "Loop Mode"
msgstr "循环"
@@ -997,9 +994,6 @@ msgstr "移动中"
msgid "App Update"
msgstr "组件更新"
-msgid "Please confirm that your firmware supports FPU."
-msgstr "请确认你的固件支持FPU。"
-
msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually."
msgstr "如果你希望从内存中运行，请更改路径，/tmp 开头，然后保存应用后，再手动更新。"
@@ -2380,3 +2374,12 @@ msgstr "订阅完毕..."
msgid "Processing, please wait…"
msgstr "正在处理，请稍候。"
+
+msgid "Invalid Realm URL."
+msgstr "Realm URL 不正确。"
+
+msgid "Gecko Packet Size (min)"
+msgstr "Gecko 包大小（最小）"
+
+msgid "Gecko Packet Size (max)"
+msgstr "Gecko 包大小（最大）"
diff --git a/luci-app-passwall2/po/zh-tw/passwall2.po b/luci-app-passwall2/po/zh-tw/passwall2.po
index 2c5f7f3e..c82781b9 100644
--- a/luci-app-passwall2/po/zh-tw/passwall2.po
+++ b/luci-app-passwall2/po/zh-tw/passwall2.po
@@ -581,10 +581,10 @@ msgid "Certificate fingerprint"
msgstr "證書指紋"
msgid "Max upload Mbps"
-msgstr "最大上行(Mbps)"
+msgstr "最大上行（Mbps）"
msgid "Max download Mbps"
-msgstr "最大下行(Mbps)"
+msgstr "最大下行（Mbps）"
msgid "QUIC stream receive window"
msgstr "QUIC 流接收窗口"
@@ -664,8 +664,8 @@ msgstr "單位：分鐘"
msgid "stop automatically mode"
msgstr "定時關閉模式"
-msgid "stop Time(Every day)"
-msgstr "關閉時間(每天)"
+msgid "stop Time"
+msgstr "關閉時間"
msgid "stop Interval(Hour)"
msgstr "關閉間隔(小時)"
@@ -673,8 +673,8 @@ msgstr "關閉間隔(小時)"
msgid "start automatically mode"
msgstr "定時開啟模式"
-msgid "start Time(Every day)"
-msgstr "開啟時間(每天)"
+msgid "start Time"
+msgstr "開啟時間"
msgid "start Interval(Hour)"
msgstr "開啟間隔(小時)"
@@ -682,8 +682,8 @@ msgstr "開啟間隔(小時)"
msgid "restart automatically mode"
msgstr "定時重啟模式"
-msgid "restart Time(Every day)"
-msgstr "重啟時間(每天)"
+msgid "restart Time"
+msgstr "重啟時間"
msgid "restart Interval(Hour)"
msgstr "重啟間隔(小時)"
@@ -748,11 +748,11 @@ msgstr "劫持ICMP (PING)"
msgid "Hijacking ICMPv6 (IPv6 PING)"
msgstr "劫持ICMPv6 (IPv6 PING)"
-msgid "Force Proxy LAN IP"
-msgstr "強制代理內網IP段"
+msgid "Direct IP List"
+msgstr "直連 IP 列表"
-msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here."
-msgstr "預設情況下，常用內網IP網段將直連（不進入核心），如果你希望某個網段走代理，請在此新增。"
+msgid "These had been joined ip addresses will connect directly (not entering the core)."
+msgstr "加入的IP段将直接連接（不進入内核）。"
msgid "Sniffing"
msgstr "流量嗅探"
@@ -889,17 +889,14 @@ msgstr "回滾"
msgid "Rollbacking..."
msgstr "回滾中..."
-msgid "Enable auto update rules"
-msgstr "開啟自動更新規則"
-
-msgid "Update Time(every day)"
-msgstr "更新時間(每天)"
+msgid "Update Time"
+msgstr "更新時間"
msgid "Update Interval(hour)"
msgstr "更新間隔(小時)"
-msgid "Update Mode"
-msgstr "更新模式"
+msgid "Auto Update Mode"
+msgstr "自動更新模式"
msgid "Loop Mode"
msgstr "循环"
@@ -997,9 +994,6 @@ msgstr "移動中"
msgid "App Update"
msgstr "组件更新"
-msgid "Please confirm that your firmware supports FPU."
-msgstr "請確認你的固件支持FPU。"
-
msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually."
msgstr "如果你希望从內存中運行，請更改路径，/tmp 開头，然後保存應用後，再手動更新。"
@@ -2386,3 +2380,12 @@ msgstr "訂閱完毕..."
msgid "Processing, please wait…"
msgstr "正在處理，請稍候。"
+
+msgid "Invalid Realm URL."
+msgstr "Realm URL 不正確。"
+
+msgid "Gecko Packet Size (min)"
+msgstr "Gecko 包大小（最小）"
+
+msgid "Gecko Packet Size (max)"
+msgstr "Gecko 包大小（最大）"
diff --git a/luci-app-passwall2/root/usr/share/passwall2/0_default_config b/luci-app-passwall2/root/usr/share/passwall2/0_default_config
index 5dc1def0..16aa35f0 100644
--- a/luci-app-passwall2/root/usr/share/passwall2/0_default_config
+++ b/luci-app-passwall2/root/usr/share/passwall2/0_default_config
@@ -42,7 +42,6 @@ config global_other
option show_node_info '0'
config global_rules
- option auto_update '0'
option geosite_update '1'
option geoip_update '1'
option v2ray_location_asset '/usr/share/v2ray/'
diff --git a/luci-app-passwall2/root/usr/share/passwall2/app.sh b/luci-app-passwall2/root/usr/share/passwall2/app.sh
index 11161f1a..da00585d 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/app.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/app.sh
@@ -815,34 +815,32 @@ start_crontab() {
stop_week_mode=$(config_t_get global_delay stop_week_mode)
stop_time_mode=$(config_t_get global_delay stop_time_mode)
if [ -n "$stop_week_mode" ]; then
- local t="0 $stop_time_mode * * $stop_week_mode"
- [ "$stop_week_mode" = "7" ] && t="0 $stop_time_mode * * *"
- if [ "$stop_week_mode" = "8" ]; then
- update_loop=1
- else
- echo "$t /etc/init.d/$CONFIG stop > /dev/null 2>&1 &" >>/etc/crontabs/root
- fi
+ stop_time_hh=$(echo $stop_time_mode | awk -F ':' '{print $1}')
+ stop_time_mm=$(echo $stop_time_mode | awk -F ':' '{print $2}')
+ local t="$stop_time_mm $stop_time_hh * * $stop_week_mode"
+ [ "$stop_week_mode" = "7" ] && t="$stop_time_mm $stop_time_hh * * *"
+ echo "$t /etc/init.d/$CONFIG stop > /dev/null 2>&1 &" >>/etc/crontabs/root
log_i18n 0 "Scheduled tasks: Auto stop service."
fi
start_week_mode=$(config_t_get global_delay start_week_mode)
start_time_mode=$(config_t_get global_delay start_time_mode)
if [ -n "$start_week_mode" ]; then
- local t="0 $start_time_mode * * $start_week_mode"
- [ "$start_week_mode" = "7" ] && t="0 $start_time_mode * * *"
- if [ "$start_week_mode" = "8" ]; then
- update_loop=1
- else
- echo "$t /etc/init.d/$CONFIG start > /dev/null 2>&1 &" >>/etc/crontabs/root
- fi
+ start_time_hh=$(echo $start_time_mode | awk -F ':' '{print $1}')
+ start_time_mm=$(echo $start_time_mode | awk -F ':' '{print $2}')
+ local t="$start_time_mm $start_time_hh * * $start_week_mode"
+ [ "$start_week_mode" = "7" ] && t="$start_time_mm $start_time_hh * * *"
+ echo "$t /etc/init.d/$CONFIG start > /dev/null 2>&1 &" >>/etc/crontabs/root
log_i18n 0 "Scheduled tasks: Auto start service."
fi
restart_week_mode=$(config_t_get global_delay restart_week_mode)
restart_time_mode=$(config_t_get global_delay restart_time_mode)
if [ -n "$restart_week_mode" ]; then
- local t="0 $restart_time_mode * * $restart_week_mode"
- [ "$restart_week_mode" = "7" ] && t="0 $restart_time_mode * * *"
+ restart_time_hh=$(echo $restart_time_mode | awk -F ':' '{print $1}')
+ restart_time_mm=$(echo $restart_time_mode | awk -F ':' '{print $2}')
+ local t="$restart_time_mm $restart_time_hh * * $restart_week_mode"
+ [ "$restart_week_mode" = "7" ] && t="$restart_time_mm $restart_time_hh * * *"
if [ "$restart_week_mode" = "8" ]; then
update_loop=1
else
@@ -851,13 +849,14 @@ start_crontab() {
log_i18n 0 "Scheduled tasks: Auto restart service."
fi
- autoupdate=$(config_t_get global_rules auto_update)
- weekupdate=$(config_t_get global_rules week_update)
- dayupdate=$(config_t_get global_rules time_update)
- if [ "$autoupdate" = "1" ]; then
- local t="0 $dayupdate * * $weekupdate"
- [ "$weekupdate" = "7" ] && t="0 $dayupdate * * *"
- if [ "$weekupdate" = "8" ]; then
+ rules_update_week_mode=$(config_t_get global_rules update_week_mode)
+ rules_update_time_mode=$(config_t_get global_rules update_time_mode)
+ if [ -n "$rules_update_week_mode" ]; then
+ rules_update_time_hh=$(echo $rules_update_time_mode | awk -F ':' '{print $1}')
+ rules_update_time_mm=$(echo $rules_update_time_mode | awk -F ':' '{print $2}')
+ local t="$rules_update_time_mm $rules_update_time_hh * * $rules_update_week_mode"
+ [ "$rules_update_week_mode" = "7" ] && t="$rules_update_time_mm $rules_update_time_hh * * *"
+ if [ "$rules_update_week_mode" = "8" ]; then
update_loop=1
else
echo "$t lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 &" >>/etc/crontabs/root
@@ -868,24 +867,26 @@ start_crontab() {
TMP_SUB_PATH=$TMP_PATH/sub_crontabs
mkdir -p $TMP_SUB_PATH
for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
- if [ "$(config_n_get $item auto_update 0)" = "1" ]; then
+ sub_update_week_mode=$(config_n_get $item update_week_mode)
+ if [ -n "$sub_update_week_mode" ]; then
cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
remark=$(config_n_get $item remark)
- week_update=$(config_n_get $item week_update)
- time_update=$(config_n_get $item time_update)
- echo "$cfgid" >> $TMP_SUB_PATH/${week_update}_${time_update}
+ sub_update_time_mode=$(config_n_get $item update_time_mode)
+ echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode}
log_i18n 0 "Scheduled tasks: Auto update [%s] subscription." "${remark}"
fi
done
[ -d "${TMP_SUB_PATH}" ] && {
for name in $(ls ${TMP_SUB_PATH}); do
- week_update=$(echo $name | awk -F '_' '{print $1}')
- time_update=$(echo $name | awk -F '_' '{print $2}')
cfgids=$(echo -n $(cat ${TMP_SUB_PATH}/${name}) | sed 's# #,#g')
- local t="0 $time_update * * $week_update"
- [ "$week_update" = "7" ] && t="0 $time_update * * *"
- if [ "$week_update" = "8" ]; then
+ sub_update_week_mode=$(echo $name | awk -F '_' '{print $1}')
+ sub_update_time_mode=$(echo $name | awk -F '_' '{print $2}')
+ sub_update_time_hh=$(echo $sub_update_time_mode | awk -F ':' '{print $1}')
+ sub_update_time_mm=$(echo $sub_update_time_mode | awk -F ':' '{print $2}')
+ local t="$sub_update_time_mm $sub_update_time_hh * * $sub_update_week_mode"
+ [ "$sub_update_week_mode" = "7" ] && t="$sub_update_time_mm $sub_update_time_hh * * *"
+ if [ "$sub_update_week_mode" = "8" ]; then
update_loop=1
else
echo "$t lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 &" >>/etc/crontabs/root
@@ -1228,8 +1229,9 @@ stop() {
kill -9 "$pid" >/dev/null 2>&1
fi
done
- busybox pgrep -f "sleep.*(6s|9s|58s)" | xargs kill -9 >/dev/null 2>&1
- busybox pgrep -af "${CONFIG}/" | awk '! /app\.sh|subscribe\.lua|rule_update\.lua|tasks\.sh|server_app\.lua|ujail/{print $1}' | xargs kill -9 >/dev/null 2>&1
+ busybox pgrep -af "${CONFIG}/monitor\.sh" | xargs -r kill -9 >/dev/null 2>&1
+ busybox pgrep -f "sleep.*(6s|9s|58s)" | xargs -r kill -9 >/dev/null 2>&1
+ busybox pgrep -af "${CONFIG}/" | awk '! /app\.sh|subscribe\.lua|rule_update\.lua|tasks\.sh|server_app\.lua|ujail/{print $1}' | xargs -r kill -9 >/dev/null 2>&1
unset V2RAY_LOCATION_ASSET
unset XRAY_LOCATION_ASSET
unset SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN
diff --git a/luci-app-passwall2/root/usr/share/passwall2/direct_ip b/luci-app-passwall2/root/usr/share/passwall2/direct_ip
new file mode 100644
index 00000000..fb08bf79
--- /dev/null
+++ b/luci-app-passwall2/root/usr/share/passwall2/direct_ip
@@ -0,0 +1,13 @@
+0.0.0.0/8
+10.0.0.0/8
+100.64.0.0/10
+127.0.0.0/8
+169.254.0.0/16
+172.16.0.0/12
+192.168.0.0/16
+224.0.0.0/4
+240.0.0.0/4
+::/127
+fc00::/7
+fe80::/10
+ff00::/8
\ No newline at end of file
diff --git a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh
index 61318230..9a0f7476 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh
@@ -4,14 +4,12 @@ DIR="$(cd "$(dirname "$0")" && pwd)"
MY_PATH=$DIR/iptables.sh
UTILS_PATH=$DIR/utils.sh
IPSET_LOCAL="psw2_local"
-IPSET_PROXY_LAN="psw2_proxy_lan"
-IPSET_LAN="psw2_lan"
+IPSET_DIRECT="psw2_direct"
IPSET_VPS="psw2_vps"
IPSET_WAN="psw2_wan"
IPSET_LOCAL6="psw2_local6"
-IPSET_PROXY_LAN6="psw2_proxy_lan6"
-IPSET_LAN6="psw2_lan6"
+IPSET_DIRECT6="psw2_direct6"
IPSET_VPS6="psw2_vps6"
IPSET_WAN6="psw2_wan6"
@@ -204,8 +202,8 @@ gen_shunt_list() {
_SHUNT_LIST4="${_SHUNT_LIST4} ${ipset_v4}:${outbound}"
_SHUNT_LIST6="${_SHUNT_LIST6} ${ipset_v6}:${outbound}"
- config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $ipset_v4 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
- config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $ipset_v6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+ config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $ipset_v4 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+ config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $ipset_v6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
[ "${enable_geoview_ip}" = "1" ] && {
local _geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
[ -n "$_geoip_code" ] && {
@@ -392,27 +390,23 @@ load_acl() {
fi
[ "$accept_icmp" = "1" ] && {
- $ipt_n -I PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(dst $IPSET_PROXY_LAN) $(REDIRECT)
$ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} -d $FAKE_IP $(REDIRECT)
add_shunt_t_rule "${shunt_list4}" "$ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source}" "$(REDIRECT)"
$ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(REDIRECT)
}
[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
- $ip6t_n -I PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) $(REDIRECT) 2>/dev/null
$ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} -d $FAKE_IP_6 $(REDIRECT) 2>/dev/null
add_shunt_t_rule "${shunt_list6}" "$ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source}" "$(REDIRECT)" 2>/dev/null
$ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(REDIRECT) 2>/dev/null
}
- $ipt_tmp -I PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $IPSET_PROXY_LAN) ${ipt_j}
$ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP ${ipt_j}
add_shunt_t_rule "${shunt_list4}" "$ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" "${ipt_j}" $tcp_redir_ports
add_port_rules "$ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "${ipt_j}"
[ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY)
[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
- $ip6t_m -I PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE 2>/dev/null
$ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null
add_shunt_t_rule "${shunt_list6}" "$ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" "${ipt_j}" $tcp_redir_ports 2>/dev/null
add_port_rules "$ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "-j PSW2_RULE" 2>/dev/null
@@ -426,14 +420,12 @@ load_acl() {
[ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && {
msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "${node_remark}")(TPROXY:${redir_port})"
- $ipt_m -I PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $IPSET_PROXY_LAN) -j PSW2_RULE
$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW2_RULE
add_shunt_t_rule "${shunt_list4}" "$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" "-j PSW2_RULE" $udp_redir_ports
add_port_rules "$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "-j PSW2_RULE"
$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $redir_port TPROXY)
[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
- $ip6t_m -I PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE 2>/dev/null
$ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null
add_shunt_t_rule "${shunt_list6}" "$ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" "-j PSW2_RULE" $udp_redir_ports 2>/dev/null
add_port_rules "$ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "-j PSW2_RULE" 2>/dev/null
@@ -498,27 +490,23 @@ load_acl() {
fi
[ "$accept_icmp" = "1" ] && {
- $ipt_n -I PSW2 $(comment "${comment_d}") -p icmp $(dst $IPSET_PROXY_LAN) $(REDIRECT)
$ipt_n -A PSW2 $(comment "${comment_d}") -p icmp -d $FAKE_IP $(REDIRECT)
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_n -A PSW2 $(comment "${comment_d}") -p icmp" "$(REDIRECT)"
$ipt_n -A PSW2 $(comment "${comment_d}") -p icmp $(REDIRECT)
}
[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
- $ip6t_n -I PSW2 $(comment "${comment_d}") -p ipv6-icmp $(dst $IPSET_PROXY_LAN6) $(REDIRECT)
$ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp" "$(REDIRECT)"
$ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp $(REDIRECT)
}
- $ipt_tmp -I PSW2 $(comment "${comment_d}") -p tcp $(dst $IPSET_PROXY_LAN) ${ipt_j}
$ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp -d $FAKE_IP ${ipt_j}
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp" "${ipt_j}" $TCP_REDIR_PORTS
add_port_rules "$ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp" $TCP_REDIR_PORTS "${ipt_j}"
[ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "${comment_d}") -p tcp $(REDIRECT $REDIR_PORT TPROXY)
[ "$PROXY_IPV6" == "1" ] && {
- $ip6t_m -I PSW2 $(comment "${comment_d}") -p tcp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE
$ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp -d $FAKE_IP_6 -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp" "-j PSW2_RULE" $TCP_REDIR_PORTS
add_port_rules "$ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp" $TCP_REDIR_PORTS "-j PSW2_RULE"
@@ -531,14 +519,12 @@ load_acl() {
if [ "$UDP_PROXY_MODE" != "disable" ] && [ -n "$NODE" ]; then
msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "$(config_n_get $NODE remarks)")(TPROXY:${REDIR_PORT})"
- $ipt_m -I PSW2 $(comment "${comment_d}") -p udp $(dst $IPSET_PROXY_LAN) -j PSW2_RULE
$ipt_m -A PSW2 $(comment "${comment_d}") -p udp -d $FAKE_IP -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_m -A PSW2 $(comment "${comment_d}") -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS
add_port_rules "$ipt_m -A PSW2 $(comment "${comment_d}") -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
$ipt_m -A PSW2 $(comment "${comment_d}") -p udp $(REDIRECT $REDIR_PORT TPROXY)
[ "$PROXY_IPV6" == "1" ] && {
- $ip6t_m -I PSW2 $(comment "${comment_d}") -p udp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE
$ip6t_m -A PSW2 $(comment "${comment_d}") -p udp -d $FAKE_IP_6 -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2 $(comment "${comment_d}") -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS
add_port_rules "$ip6t_m -A PSW2 $(comment "${comment_d}") -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
@@ -633,27 +619,29 @@ add_firewall_rule() {
log_i18n 0 "Starting to load %s firewall rules..." "iptables"
ipset -! create $IPSET_LOCAL nethash maxelem 1048576
- ipset -! create $IPSET_PROXY_LAN nethash maxelem 1048576
- ipset -! create $IPSET_LAN nethash maxelem 1048576
+ ipset -! create $IPSET_DIRECT nethash maxelem 1048576
ipset -! create $IPSET_VPS iphash maxelem 1048576
ipset -! create $IPSET_WAN nethash maxelem 1048576
ipset -! create $IPSET_LOCAL6 nethash family inet6 maxelem 1048576
- ipset -! create $IPSET_PROXY_LAN6 nethash family inet6 maxelem 1048576
- ipset -! create $IPSET_LAN6 nethash family inet6 maxelem 1048576
+ ipset -! create $IPSET_DIRECT6 nethash family inet6 maxelem 1048576
ipset -! create $IPSET_VPS6 iphash family inet6 maxelem 1048576
ipset -! create $IPSET_WAN6 nethash family inet6 maxelem 1048576
get_local_ips ip4 | sed "s/^/add $IPSET_LOCAL /" | ipset -! -R
get_local_ips ip6 | sed "s/^/add $IPSET_LOCAL6 /" | ipset -! -R
- ipset -! -R <<-EOF
- $(gen_lanlist | sed -e "s/^/add $IPSET_LAN /")
- EOF
-
- ipset -! -R <<-EOF
- $(gen_lanlist_6 | sed -e "s/^/add $IPSET_LAN6 /")
- EOF
+ for ip in $(cat /usr/share/passwall2/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d"); do
+ if [[ "$ip" == *::* ]]; then
+ ipset -! add $IPSET_DIRECT6 $ip
+ elif [[ "$ip" == "geoip:"* ]]; then
+ local _geoip_code=$(echo $ip | awk -F ':' '{print $2}')
+ get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_DIRECT &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+ get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_DIRECT6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+ else
+ ipset -! add $IPSET_DIRECT $ip
+ fi
+ done
# Ignore special IP ranges
local lan_ifname lan_ip
@@ -665,11 +653,11 @@ add_firewall_rule() {
#log_i18n 1 "local network segments (%s) direct connection: %s" "IPv6" "${lan_ip6}"
[ -n "$lan_ip" ] && ipset -! -R <<-EOF
- $(echo $lan_ip | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_LAN /")
+ $(echo $lan_ip | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_DIRECT /")
EOF
[ -n "$lan_ip6" ] && ipset -! -R <<-EOF
- $(echo $lan_ip6 | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_LAN6 /")
+ $(echo $lan_ip6 | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_DIRECT6 /")
EOF
}
@@ -677,28 +665,18 @@ add_firewall_rule() {
[ -n "$ISP_DNS" ] && {
for ispip in $ISP_DNS; do
- ipset -! add $IPSET_LAN $ispip
+ ipset -! add $IPSET_DIRECT $ispip
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv4" "${ispip}")"
done
}
[ -n "$ISP_DNS6" ] && {
for ispip6 in $ISP_DNS6; do
- ipset -! add $IPSET_LAN6 $ispip6
+ ipset -! add $IPSET_DIRECT6 $ispip6
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv6" "${ispip6}")"
done
}
- # Force proxy LAN IP CIDR
- force_proxy_lan_ip=$(config_t_get global_forwarding force_proxy_lan_ip)
- for ip in $force_proxy_lan_ip; do
- if [[ "$ip" == *::* ]]; then
- ipset -! add $IPSET_PROXY_LAN6 $ip
- else
- ipset -! add $IPSET_PROXY_LAN $ip
- fi
- done
-
# Shunt rules IP list (import when use shunt node)
gen_shunt_list "${NODE}" SHUNT_LIST4 SHUNT_LIST6
@@ -724,7 +702,7 @@ add_firewall_rule() {
fi
$ipt_n -N PSW2
- $ipt_n -A PSW2 $(dst $IPSET_LAN) -j RETURN
+ $ipt_n -A PSW2 $(dst $IPSET_DIRECT) -j RETURN
$ipt_n -A PSW2 $(dst $IPSET_VPS) -j RETURN
$ipt_n -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
@@ -732,16 +710,16 @@ add_firewall_rule() {
[ -z "${is_tproxy}" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW2"
$ipt_n -N PSW2_OUTPUT
- $ipt_n -A PSW2_OUTPUT $(dst $IPSET_LAN) -j RETURN
+ $ipt_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN
$ipt_n -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN
$ipt_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
$ipt_n -N PSW2_DNS
if [ $(config_t_get global dns_redirect "1") = "0" ]; then
#Only hijack when dest address is local IP
- $ipt_n -I PREROUTING -m set --match-set $IPSET_LAN src $(dst $IPSET_LOCAL) -j PSW2_DNS
+ $ipt_n -I PREROUTING -m set --match-set $IPSET_DIRECT src $(dst $IPSET_LOCAL) -j PSW2_DNS
else
- $ipt_n -I PREROUTING -m set --match-set $IPSET_LAN src -j PSW2_DNS
+ $ipt_n -I PREROUTING -m set --match-set $IPSET_DIRECT src -j PSW2_DNS
fi
$ipt_m -N PSW2_DIVERT
@@ -756,7 +734,7 @@ add_firewall_rule() {
$ipt_m -A PSW2_RULE -j CONNMARK --save-mark
$ipt_m -N PSW2
- $ipt_m -A PSW2 $(dst $IPSET_LAN) -j RETURN
+ $ipt_m -A PSW2 $(dst $IPSET_DIRECT) -j RETURN
$ipt_m -A PSW2 $(dst $IPSET_VPS) -j RETURN
$ipt_m -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN
$ipt_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
@@ -766,7 +744,7 @@ add_firewall_rule() {
insert_rule_before "$ipt_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT"
$ipt_m -N PSW2_OUTPUT
- $ipt_m -A PSW2_OUTPUT $(dst $IPSET_LAN) -j RETURN
+ $ipt_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN
$ipt_m -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN
$ipt_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN
$ipt_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
@@ -776,12 +754,12 @@ add_firewall_rule() {
[ "$accept_icmpv6" = "1" ] && {
$ip6t_n -N PSW2
- $ip6t_n -A PSW2 $(dst $IPSET_LAN6) -j RETURN
+ $ip6t_n -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN
$ip6t_n -A PSW2 $(dst $IPSET_VPS6) -j RETURN
$ip6t_n -A PREROUTING -p ipv6-icmp -j PSW2
$ip6t_n -N PSW2_OUTPUT
- $ip6t_n -A PSW2_OUTPUT $(dst $IPSET_LAN6) -j RETURN
+ $ip6t_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN
$ip6t_n -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN
$ip6t_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
}
@@ -789,9 +767,9 @@ add_firewall_rule() {
$ip6t_n -N PSW2_DNS
if [ $(config_t_get global dns_redirect "1") = "0" ]; then
#Only hijack when dest address is local IP
- $ip6t_n -I PREROUTING -m set --match-set $IPSET_LAN6 src $(dst $IPSET_LOCAL6) -j PSW2_DNS
+ $ip6t_n -I PREROUTING -m set --match-set $IPSET_DIRECT6 src $(dst $IPSET_LOCAL6) -j PSW2_DNS
else
- $ip6t_n -I PREROUTING -m set --match-set $IPSET_LAN6 src -j PSW2_DNS
+ $ip6t_n -I PREROUTING -m set --match-set $IPSET_DIRECT6 src -j PSW2_DNS
fi
$ip6t_m -N PSW2_DIVERT
@@ -806,7 +784,7 @@ add_firewall_rule() {
$ip6t_m -A PSW2_RULE -j CONNMARK --save-mark
$ip6t_m -N PSW2
- $ip6t_m -A PSW2 $(dst $IPSET_LAN6) -j RETURN
+ $ip6t_m -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN
$ip6t_m -A PSW2 $(dst $IPSET_VPS6) -j RETURN
$ip6t_m -A PSW2 $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN
$ip6t_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN
@@ -817,7 +795,7 @@ add_firewall_rule() {
$ip6t_m -N PSW2_OUTPUT
$ip6t_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN
- $ip6t_m -A PSW2_OUTPUT $(dst $IPSET_LAN6) -j RETURN
+ $ip6t_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN
$ip6t_m -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN
$ip6t_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN
@@ -883,7 +861,6 @@ add_firewall_rule() {
if [ -n "$NODE" ] && [ "$TCP_LOCALHOST_PROXY" = "1" ]; then
[ "$accept_icmp" = "1" ] && {
$ipt_n -A OUTPUT -p icmp -j PSW2_OUTPUT
- $ipt_n -I PSW2_OUTPUT -p icmp $(dst $IPSET_PROXY_LAN) $(REDIRECT)
$ipt_n -A PSW2_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT)
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_n -A PSW2_OUTPUT -p icmp" "$(REDIRECT)"
$ipt_n -A PSW2_OUTPUT -p icmp $(REDIRECT)
@@ -891,7 +868,6 @@ add_firewall_rule() {
[ "$accept_icmpv6" = "1" ] && {
$ip6t_n -A OUTPUT -p ipv6-icmp -j PSW2_OUTPUT
- $ip6t_n -I PSW2_OUTPUT -p ipv6-icmp $(dst $IPSET_PROXY_LAN6) $(REDIRECT)
$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT)
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp" "$(REDIRECT)"
$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp $(REDIRECT)
@@ -903,24 +879,20 @@ add_firewall_rule() {
ipt_j="$(REDIRECT $REDIR_PORT)"
fi
- $ipt_tmp -I PSW2_OUTPUT -p tcp $(dst $IPSET_PROXY_LAN) ${ipt_j}
$ipt_tmp -A PSW2_OUTPUT -p tcp -d $FAKE_IP ${ipt_j}
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_tmp -A PSW2_OUTPUT -p tcp" "${ipt_j}" $TCP_REDIR_PORTS
add_port_rules "$ipt_tmp -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "${ipt_j}"
[ -z "${is_tproxy}" ] && $ipt_n -A OUTPUT -p tcp -j PSW2_OUTPUT
[ -n "${is_tproxy}" ] && {
- $ipt_m -I PSW2 $(comment "${comment_l}") -p tcp -i lo $(dst $IPSET_PROXY_LAN) $(REDIRECT $REDIR_PORT TPROXY)
$ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY)
$ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT"
}
[ "$PROXY_IPV6" == "1" ] && {
- $ip6t_m -I PSW2_OUTPUT -p tcp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE
$ip6t_m -A PSW2_OUTPUT -p tcp -d $FAKE_IP_6 -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2_OUTPUT -p tcp" "-j PSW2_RULE" $TCP_REDIR_PORTS
add_port_rules "$ip6t_m -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "-j PSW2_RULE"
- $ip6t_m -I PSW2 $(comment "${comment_l}") -p tcp -i lo $(dst $IPSET_PROXY_LAN6) $(REDIRECT $REDIR_PORT TPROXY)
$ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY)
$ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT"
@@ -936,21 +908,17 @@ add_firewall_rule() {
# Loading local router proxy UDP
if [ -n "$NODE" ] && [ "$UDP_LOCALHOST_PROXY" = "1" ]; then
- $ipt_m -I PSW2_OUTPUT -p udp $(dst $IPSET_PROXY_LAN) -j PSW2_RULE
$ipt_m -A PSW2_OUTPUT -p udp -d $FAKE_IP -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_m -A PSW2_OUTPUT -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS
add_port_rules "$ipt_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
- $ipt_m -I PSW2 $(comment "${comment_l}") -p udp -i lo $(dst $IPSET_PROXY_LAN) $(REDIRECT $REDIR_PORT TPROXY)
$ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY)
$ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN
insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT"
[ "$PROXY_IPV6" == "1" ] && {
- $ip6t_m -I PSW2_OUTPUT -p udp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE
$ip6t_m -A PSW2_OUTPUT -p udp -d $FAKE_IP_6 -j PSW2_RULE
add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2_OUTPUT -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS
add_port_rules "$ip6t_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE"
- $ip6t_m -I PSW2 $(comment "${comment_l}") -p udp -i lo $(dst $IPSET_PROXY_LAN6) $(REDIRECT $REDIR_PORT TPROXY)
$ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY)
$ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN
insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT"
@@ -1101,8 +1069,6 @@ start() {
stop() {
[ -z "$(command -v log_i18n)" ] && . "$UTILS_PATH"
del_firewall_rule
- destroy_ipset $IPSET_PROXY_LAN
- destroy_ipset $IPSET_PROXY_LAN6
[ $(config_t_get global flush_set "0") = "1" ] && {
uci -q delete ${CONFIG}.@global[0].flush_set
uci -q commit ${CONFIG}
diff --git a/luci-app-passwall2/root/usr/share/passwall2/nftables.sh b/luci-app-passwall2/root/usr/share/passwall2/nftables.sh
index be3146a8..c12ccd59 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/nftables.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/nftables.sh
@@ -5,14 +5,12 @@ MY_PATH=$DIR/nftables.sh
UTILS_PATH=$DIR/utils.sh
NFTABLE_NAME="inet passwall2"
NFTSET_LOCAL="psw2_local"
-NFTSET_PROXY_LAN="psw2_proxy_lan"
-NFTSET_LAN="psw2_lan"
+NFTSET_DIRECT="psw2_direct"
NFTSET_VPS="psw2_vps"
NFTSET_WAN="psw2_wan"
NFTSET_LOCAL6="psw2_local6"
-NFTSET_PROXY_LAN6="psw2_proxy_lan6"
-NFTSET_LAN6="psw2_lan6"
+NFTSET_DIRECT6="psw2_direct6"
NFTSET_VPS6="psw2_vps6"
NFTSET_WAN6="psw2_wan6"
@@ -166,9 +164,9 @@ insert_nftset() {
printf "%s\n" "$@"
else
cat
- fi | tr -s ' \t' '\n' | awk -v s="$suffix" -v n="$nftset_name" -v t="$NFTABLE_NAME" '
- {
- gsub(/^[ \t\r]+|[ \t\r]+$/, "");
+ fi | awk -v s="$suffix" -v n="$nftset_name" -v t="$NFTABLE_NAME" '
+ BEGIN {
+ RS = "[ \t\n\r]+"
}
$0 != "" {
if (first == 0) {
@@ -240,8 +238,8 @@ gen_shunt_list() {
[ "$shunt_node" = "_default" ] && outbound="${default_outbound}"
_SHUNT_LIST4="${_SHUNT_LIST4} ${nftset_v4}:${outbound}"
_SHUNT_LIST6="${_SHUNT_LIST6} ${nftset_v6}:${outbound}"
- config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $nftset_v4 "0"
- config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $nftset_v6 "0"
+ config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $nftset_v4 "0"
+ config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $nftset_v6 "0"
[ "${enable_geoview_ip}" = "1" ] && {
local _geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
[ -n "$_geoip_code" ] && {
@@ -419,7 +417,6 @@ load_acl() {
fi
[ "$accept_icmp" = "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN $(REDIRECT) comment \"$remarks\""
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr $FAKE_IP $(REDIRECT) comment \"$remarks\""
add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr" "$(REDIRECT)" "$remarks"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} $(REDIRECT) comment \"$remarks\""
@@ -427,21 +424,18 @@ load_acl() {
}
[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null
add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr" "$(REDIRECT)" "$remarks" 2>/dev/null
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} $(REDIRECT) comment \"$remarks\"" 2>/dev/null
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} return comment \"$remarks\"" 2>/dev/null
}
- nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN ${nft_j} comment \"$remarks\""
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP ${nft_j} comment \"$remarks\""
add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip daddr" "${nft_j}" "$remarks"
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ${nft_j} comment \"$remarks\""
[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\""
[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 counter jump PSW2_RULE comment \"$remarks\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\""
add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip6 daddr" "counter jump PSW2_RULE" "$remarks" 2>/dev/null
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null
@@ -455,14 +449,12 @@ load_acl() {
[ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && {
msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "${node_remark}")(TPROXY:${redir_port})"
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE comment \"$remarks\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW2_RULE comment \"$remarks\""
add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr" "counter jump PSW2_RULE" "$remarks"
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\""
[ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 counter jump PSW2_RULE comment \"$remarks\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\""
add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr" "counter jump PSW2_RULE" "$remarks" 2>/dev/null
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null
@@ -527,7 +519,6 @@ load_acl() {
fi
[ "$accept_icmp" = "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr @$NFTSET_PROXY_LAN $(REDIRECT) comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr" "$(REDIRECT)" "${comment}"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp $(REDIRECT) comment \"${comment}\""
@@ -535,21 +526,18 @@ load_acl() {
}
[ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT) comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr" "$(REDIRECT)" "${comment}"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 $(REDIRECT) comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 return comment \"${comment}\""
}
- nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_PROXY_LAN ${nft_j} comment \"${comment}\""
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j} comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr" "${nft_j}" "${comment}"
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j} comment \"${comment}\""
[ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment}\""
[ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr" "${nft_j}" "${comment}"
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW2_RULE comment \"${comment}\""
@@ -562,14 +550,12 @@ load_acl() {
if [ "$UDP_PROXY_MODE" != "disable" ] && [ -n "$NODE" ]; then
msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "$(config_n_get $NODE remarks)")(TPROXY:${REDIR_PORT})"
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr" "counter jump PSW2_RULE" "${comment}"
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment}\""
[ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE comment \"${comment}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"${comment}\""
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr" "counter jump PSW2_RULE" "${comment}"
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"${comment}\""
@@ -695,20 +681,30 @@ add_firewall_rule() {
mwan3_start
gen_nftset $NFTSET_LOCAL ipv4_addr 0 "-1"
- gen_nftset $NFTSET_PROXY_LAN ipv4_addr 0 "-1"
- gen_nftset $NFTSET_LAN ipv4_addr 0 "-1" $(gen_lanlist)
+ gen_nftset $NFTSET_DIRECT ipv4_addr 0 "-1"
gen_nftset $NFTSET_VPS ipv4_addr 0 "-1"
gen_nftset $NFTSET_WAN ipv4_addr 0 "-1"
gen_nftset $NFTSET_LOCAL6 ipv6_addr 0 "-1"
- gen_nftset $NFTSET_PROXY_LAN6 ipv6_addr 0 "-1"
- gen_nftset $NFTSET_LAN6 ipv6_addr 0 "-1" $(gen_lanlist_6)
+ gen_nftset $NFTSET_DIRECT6 ipv6_addr 0 "-1"
gen_nftset $NFTSET_VPS6 ipv6_addr 0 "-1"
gen_nftset $NFTSET_WAN6 ipv6_addr 0 "-1"
get_local_ips ip4 | insert_nftset $NFTSET_LOCAL "-1"
get_local_ips ip6 | insert_nftset $NFTSET_LOCAL6 "-1"
+ for ip in $(cat /usr/share/passwall2/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d"); do
+ if [[ "$ip" == *::* ]]; then
+ echo "$ip" | insert_nftset $NFTSET_DIRECT6 0
+ elif [[ "$ip" == "geoip:"* ]]; then
+ local _geoip_code=$(echo $ip | awk -F ':' '{print $2}')
+ get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_DIRECT "0"
+ get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_DIRECT6 "0"
+ else
+ echo "$ip" | insert_nftset $NFTSET_DIRECT 0
+ fi
+ done
+
# Ignore special IP ranges
local lan_ifname lan_ip
lan_ifname=$(uci -q -p /tmp/state get network.lan.device)
@@ -718,36 +714,26 @@ add_firewall_rule() {
#log_i18n 1 "local network segments (%s) direct connection: %s" "IPv4" "${lan_ip}"
#log_i18n 1 "local network segments (%s) direct connection: %s" "IPv6" "${lan_ip6}"
- [ -n "$lan_ip" ] && echo $lan_ip | insert_nftset $NFTSET_LAN "-1"
- [ -n "$lan_ip6" ] && echo $lan_ip6 | insert_nftset $NFTSET_LAN6 "-1"
+ [ -n "$lan_ip" ] && echo $lan_ip | insert_nftset $NFTSET_DIRECT "-1"
+ [ -n "$lan_ip6" ] && echo $lan_ip6 | insert_nftset $NFTSET_DIRECT6 "-1"
}
update_wan_sets
[ -n "$ISP_DNS" ] && {
- echo "$ISP_DNS" | insert_nftset $NFTSET_LAN 0
+ echo "$ISP_DNS" | insert_nftset $NFTSET_DIRECT 0
for ispip in $ISP_DNS; do
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv4" "${ispip}")"
done
}
[ -n "$ISP_DNS6" ] && {
- echo $ISP_DNS6 | insert_nftset $NFTSET_LAN6 0
+ echo $ISP_DNS6 | insert_nftset $NFTSET_DIRECT6 0
for ispip6 in $ISP_DNS6; do
log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv6" "${ispip6}")"
done
}
- # Force proxy LAN IP CIDR
- force_proxy_lan_ip=$(config_t_get global_forwarding force_proxy_lan_ip)
- for ip in $force_proxy_lan_ip; do
- if [[ "$ip" == *::* ]]; then
- echo "$ip" | insert_nftset $NFTSET_PROXY_LAN6 0
- else
- echo "$ip" | insert_nftset $NFTSET_PROXY_LAN 0
- fi
- done
-
# Shunt rules IP list (import when use shunt node)
gen_shunt_list "${NODE}" SHUNT_LIST4 SHUNT_LIST6
@@ -780,11 +766,11 @@ add_firewall_rule() {
nft "flush chain $NFTABLE_NAME PSW2_DNS"
if [ $(config_t_get global dns_redirect "1") = "0" ]; then
#Only hijack when dest address is local IP
- nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_LAN} ip daddr @${NFTSET_LOCAL} jump PSW2_DNS"
- nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_LAN6} ip6 daddr @${NFTSET_LOCAL6} jump PSW2_DNS"
+ nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_DIRECT} ip daddr @${NFTSET_LOCAL} jump PSW2_DNS"
+ nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_DIRECT6} ip6 daddr @${NFTSET_LOCAL6} jump PSW2_DNS"
else
- nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_LAN} jump PSW2_DNS"
- nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_LAN6} jump PSW2_DNS"
+ nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_DIRECT} jump PSW2_DNS"
+ nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_DIRECT6} jump PSW2_DNS"
fi
# for ipv4 ipv6 tproxy mark
@@ -799,13 +785,13 @@ add_firewall_rule() {
#ipv4 tproxy mode and udp
nft "add chain $NFTABLE_NAME PSW2_MANGLE"
nft "flush chain $NFTABLE_NAME PSW2_MANGLE"
- nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_LAN counter return"
+ nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_DIRECT counter return"
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_VPS counter return"
nft "add rule $NFTABLE_NAME PSW2_MANGLE ct direction reply counter return"
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE"
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE"
- nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_LAN counter return"
+ nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_DIRECT counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_VPS counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ct direction reply counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE meta mark 255 counter return"
@@ -819,13 +805,13 @@ add_firewall_rule() {
[ -z "${is_tproxy}" ] && {
nft "add chain $NFTABLE_NAME PSW2_NAT"
nft "flush chain $NFTABLE_NAME PSW2_NAT"
- nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_LAN counter return"
+ nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_DIRECT counter return"
nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_VPS counter return"
nft "add rule $NFTABLE_NAME dstnat ip protocol tcp counter jump PSW2_NAT"
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_NAT"
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_NAT"
- nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_LAN counter return"
+ nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_DIRECT counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_VPS counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT meta mark 255 counter return"
}
@@ -834,11 +820,11 @@ add_firewall_rule() {
if [ "$accept_icmp" = "1" ]; then
nft "add chain $NFTABLE_NAME PSW2_ICMP_REDIRECT"
nft "flush chain $NFTABLE_NAME PSW2_ICMP_REDIRECT"
- nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_LAN counter return"
+ nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_DIRECT counter return"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_VPS counter return"
[ "$accept_icmpv6" = "1" ] && {
- nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_LAN6 counter return"
+ nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_DIRECT6 counter return"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_VPS6 counter return"
}
@@ -856,13 +842,13 @@ add_firewall_rule() {
#ipv6 tproxy mode and udp
nft "add chain $NFTABLE_NAME PSW2_MANGLE_V6"
nft "flush chain $NFTABLE_NAME PSW2_MANGLE_V6"
- nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return"
+ nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return"
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ct direction reply counter return"
nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6"
nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6"
- nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return"
+ nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ct direction reply counter return"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta mark 255 counter return"
@@ -933,7 +919,6 @@ add_firewall_rule() {
# Loading local router proxy TCP
if [ -n "$NODE" ] && [ "$TCP_LOCALHOST_PROXY" = "1" ]; then
[ "$accept_icmp" = "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_PROXY_LAN counter redirect"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect"
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr" "counter redirect"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp counter redirect"
@@ -941,7 +926,6 @@ add_firewall_rule() {
}
[ "$accept_icmpv6" = "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_PROXY_LAN6 counter redirect"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 counter redirect"
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr" "counter redirect"
nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter redirect"
@@ -956,24 +940,20 @@ add_firewall_rule() {
nft_j="$(REDIRECT $REDIR_PORT)"
fi
- nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_PROXY_LAN ${nft_j}"
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j}"
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr" "${nft_j}"
nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j}"
[ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME nat_output ip protocol tcp counter jump PSW2_OUTPUT_NAT"
[ -n "${is_tproxy}" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo ip daddr @$NFTSET_PROXY_LAN $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo counter return comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME mangle_output ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
}
[ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 jump PSW2_RULE"
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr" "counter jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW2_RULE"
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo counter return comment \"${comment_l}\""
}
@@ -988,21 +968,17 @@ add_firewall_rule() {
# Loading local router proxy UDP
if [ -n "$NODE" ] && [ "$UDP_LOCALHOST_PROXY" = "1" ]; then
- nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE"
add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr" "counter jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE"
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo ip daddr @$NFTSET_PROXY_LAN $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo counter return comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME mangle_output ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
[ "$PROXY_IPV6" == "1" ] && {
- nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE"
add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr" "counter jump PSW2_RULE"
nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE"
- nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\""
nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo counter return comment \"${comment_l}\""
}
@@ -1052,12 +1028,12 @@ del_firewall_rule() {
destroy_nftset $NFTSET_LOCAL
destroy_nftset $NFTSET_WAN
- destroy_nftset $NFTSET_LAN
+ destroy_nftset $NFTSET_DIRECT
destroy_nftset $NFTSET_VPS
destroy_nftset $NFTSET_LOCAL6
destroy_nftset $NFTSET_WAN6
- destroy_nftset $NFTSET_LAN6
+ destroy_nftset $NFTSET_DIRECT6
destroy_nftset $NFTSET_VPS6
del_script_mwan3
@@ -1112,8 +1088,6 @@ start() {
stop() {
[ -z "$(command -v log_i18n)" ] && . "$UTILS_PATH"
del_firewall_rule
- destroy_nftset $NFTSET_PROXY_LAN
- destroy_nftset $NFTSET_PROXY_LAN6
[ $(config_t_get global flush_set "0") = "1" ] && {
uci -q delete ${CONFIG}.@global[0].flush_set
uci -q commit ${CONFIG}
diff --git a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
index 92a713cc..2ec0ca8d 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
+++ b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua
@@ -481,7 +481,7 @@ local function parseClashNode(node, add_mode, group, sub_cfg)
local sub_vmess_type = DEFAULT_VMESS_TYPE
local sub_vless_type = DEFAULT_VLESS_TYPE
local sub_hysteria2_type = DEFAULT_HYSTERIA2_TYPE
- local sub_hy_up_mbps, sub_hy_down_mbps = 1000, 1000
+ local sub_hy_up_mbps, sub_hy_down_mbps
if sub_cfg then
if sub_cfg.allowInsecure and sub_cfg.allowInsecure ~= "1" then
sub_allowinsecure = nil
@@ -800,7 +800,7 @@ local function processData(szType, content, add_mode, group, sub_cfg)
local sub_vmess_type = DEFAULT_VMESS_TYPE
local sub_vless_type = DEFAULT_VLESS_TYPE
local sub_hysteria2_type = DEFAULT_HYSTERIA2_TYPE
- local sub_hy_up_mbps, sub_hy_down_mbps = 1000, 1000
+ local sub_hy_up_mbps, sub_hy_down_mbps
if sub_cfg then
if sub_cfg.allowInsecure and sub_cfg.allowInsecure ~= "1" then
sub_allowinsecure = nil
@@ -1354,12 +1354,25 @@ local function processData(szType, content, add_mode, group, sub_cfg)
result.port = port
- result.tls = '1'
- result.tls_serverName = params.peer or params.sni or ""
- result.tls_pinSHA256 = params.pcs
- result.tls_CertByName = params.vcn
- local insecure = params.allowinsecure or params.allowInsecure or params.insecure
- result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
+ params.security = params.security or "tls"
+ if params.security == "tls" or params.security == "reality" then
+ result.tls = '1'
+ result.tls_serverName = params.peer or params.sni or ""
+ result.alpn = params.alpn
+ if params.fp and params.fp ~= "" then
+ result.utls = "1"
+ result.fingerprint = params.fp
+ end
+ if params.security == "reality" then
+ result.reality = "1"
+ result.reality_publicKey = params.pbk or nil
+ result.reality_shortId = params.sid or nil
+ end
+ result.tls_pinSHA256 = params.pcs
+ result.tls_CertByName = params.vcn
+ local insecure = params.allowinsecure or params.allowInsecure or params.insecure
+ result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
+ end
if not params.type then params.type = "tcp" end
params.type = string.lower(params.type)
@@ -1433,7 +1446,6 @@ local function processData(szType, content, add_mode, group, sub_cfg)
result.httpupgrade_path = params.path
end
- result.alpn = params.alpn
result.tcp_fast_open = params.tfo
result.use_finalmask = (params.fm and params.fm ~= "") and "1" or nil
result.finalmask = (params.fm and params.fm ~= "") and api.base64Encode(params.fm) or nil
@@ -1586,6 +1598,10 @@ local function processData(szType, content, add_mode, group, sub_cfg)
result.encryption = params.encryption or "none"
result.flow = params.flow
+ if (not params.security or params.security == "") and params.flow then
+ params.security = "tls"
+ end
+
result.tls = "0"
if params.security == "tls" or params.security == "reality" then
result.tls = "1"
@@ -1721,6 +1737,10 @@ local function processData(szType, content, add_mode, group, sub_cfg)
result.hysteria2_obfs_type = params.obfs or "salamander"
result.hysteria2_obfs_password = params["obfs-password"] or params["obfs_password"]
end
+ if params.obfs == "gecko" then
+ result.hysteria2_obfs_MinPacketSize = params.minpacketsize or "512"
+ result.hysteria2_obfs_MaxPacketSize = params.maxpacketsize or "1200"
+ end
if (sub_hysteria2_type == "sing-box" and has_singbox) or (sub_hysteria2_type == "xray" and has_xray) then
local is_singbox = sub_hysteria2_type == "sing-box" and has_singbox
diff --git a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
index 90d14512..d89c7f99 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh
@@ -17,24 +17,6 @@ do
if [ "$CFG_UPDATE_INT" -ne 0 ]; then
- stop_week_mode=$(config_t_get global_delay stop_week_mode)
- stop_interval_mode=$(config_t_get global_delay stop_interval_mode)
- stop_interval_mode=$(expr "$stop_interval_mode" \* 60)
- if [ -n "$stop_week_mode" ]; then
- [ "$stop_week_mode" = "8" ] && {
- [ "$(expr "$CFG_UPDATE_INT" % "$stop_interval_mode")" -eq 0 ] && { /etc/init.d/$CONFIG stop > /dev/null 2>&1 & }
- }
- fi
-
- start_week_mode=$(config_t_get global_delay start_week_mode)
- start_interval_mode=$(config_t_get global_delay start_interval_mode)
- start_interval_mode=$(expr "$start_interval_mode" \* 60)
- if [ -n "$start_week_mode" ]; then
- [ "$start_week_mode" = "8" ] && {
- [ "$(expr "$CFG_UPDATE_INT" % "$start_interval_mode")" -eq 0 ] && { /etc/init.d/$CONFIG start > /dev/null 2>&1 & }
- }
- fi
-
restart_week_mode=$(config_t_get global_delay restart_week_mode)
restart_interval_mode=$(config_t_get global_delay restart_interval_mode)
restart_interval_mode=$(expr "$restart_interval_mode" \* 60)
@@ -44,36 +26,35 @@ do
}
fi
- autoupdate=$(config_t_get global_rules auto_update)
- weekupdate=$(config_t_get global_rules week_update)
- hourupdate=$(config_t_get global_rules interval_update)
- hourupdate=$(expr "$hourupdate" \* 60)
- if [ "$autoupdate" = "1" ]; then
- [ "$weekupdate" = "8" ] && {
- [ "$(expr "$CFG_UPDATE_INT" % "$hourupdate")" -eq 0 ] && { lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 & }
+ rules_update_week_mode=$(config_t_get global_rules update_week_mode)
+ rules_update_interval_mode=$(config_t_get global_rules update_interval_mode)
+ rules_update_interval_mode=$(expr "$rules_update_interval_mode" \* 60)
+ if [ -n "$rules_update_week_mode" ]; then
+ [ "$rules_update_week_mode" = "8" ] && {
+ [ "$(expr "$CFG_UPDATE_INT" % "$rules_update_interval_mode")" -eq 0 ] && { lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 & }
}
fi
TMP_SUB_PATH=$TMP_PATH/sub_tasks
mkdir -p $TMP_SUB_PATH
for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do
- if [ "$(config_n_get $item auto_update 0)" = "1" ]; then
+ sub_update_week_mode=$(config_n_get $item update_week_mode)
+ if [ -n "$sub_update_week_mode" ]; then
cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1)
remark=$(config_n_get $item remark)
- week_update=$(config_n_get $item week_update)
- hour_update=$(config_n_get $item interval_update)
- echo "$cfgid" >> $TMP_SUB_PATH/${week_update}_${hour_update}
+ sub_update_interval_mode=$(config_n_get $item update_interval_mode)
+ echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode}
fi
done
[ -d "${TMP_SUB_PATH}" ] && {
for name in $(ls ${TMP_SUB_PATH}); do
- week_update=$(echo $name | awk -F '_' '{print $1}')
- hour_update=$(echo $name | awk -F '_' '{print $2}')
- hour_update=$(expr "$hour_update" \* 60)
+ sub_update_week_mode=$(echo $name | awk -F '_' '{print $1}')
+ sub_update_interval_mode=$(echo $name | awk -F '_' '{print $2}')
+ sub_update_interval_mode=$(expr "$sub_update_interval_mode" \* 60)
cfgids=$(echo -n $(cat ${TMP_SUB_PATH}/${name}) | sed 's# #,#g')
- [ "$week_update" = "8" ] && {
- [ "$(expr "$CFG_UPDATE_INT" % "$hour_update")" -eq 0 ] && { lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 & }
+ [ "$sub_update_week_mode" = "8" ] && {
+ [ "$(expr "$CFG_UPDATE_INT" % "$sub_update_interval_mode")" -eq 0 ] && { lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 & }
}
done
diff --git a/luci-app-passwall2/root/usr/share/passwall2/utils.sh b/luci-app-passwall2/root/usr/share/passwall2/utils.sh
index b345c7ee..6bfc0ad7 100755
--- a/luci-app-passwall2/root/usr/share/passwall2/utils.sh
+++ b/luci-app-passwall2/root/usr/share/passwall2/utils.sh
@@ -426,38 +426,6 @@ kill_all() {
kill -9 $(pidof "$@") >/dev/null 2>&1
}
-gen_lanlist() {
- cat <<-EOF
- 0.0.0.0/8
- 10.0.0.0/8
- 100.64.0.0/10
- 127.0.0.0/8
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
- 224.0.0.0/4
- 240.0.0.0/4
- EOF
-}
-
-gen_lanlist_6() {
- cat <<-EOF
- ::/128
- ::1/128
- ::ffff:0:0/96
- ::ffff:0:0:0/96
- 64:ff9b::/96
- 100::/64
- 2001::/32
- 2001:20::/28
- 2001:db8::/32
- 2002::/16
- fc00::/7
- fe80::/10
- ff00::/8
- EOF
-}
-
get_wan_ips() {
local family="$1"
local NET_ADDR
diff --git a/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js b/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js
index 11db0cf0..345bfad5 100644
--- a/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js
+++ b/luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js
@@ -4393,8 +4393,8 @@ return view.extend({
const w = (bss.ht_operation.secondary_channel_offset == 'no secondary') ? 20 : 40;
uci.set('wireless', radioDev.getName(), 'htmode', 'HT'+w);
}
- else {
- uci.remove('wireless', radioDev.getName(), 'htmode');
+ else if (hwtype != 'mt_dbdc') {
+ uci.unset('wireless', radioDev.getName(), 'htmode');
}
uci.set('wireless', radioDev.getName(), 'channel', bss.channel);
@@ -4449,6 +4449,14 @@ return view.extend({
}
return network.addNetwork(nameval, { proto: 'dhcp' }).then(function(net) {
+ if (hwtype == 'mt_dbdc') {
+ const radioName = radioDev.getName();
+ const staDevice = (radioName == 'rax') ? 'apclix0' :
+ (radioName == 'rai') ? 'apclii0' : 'apcli0';
+
+ uci.set('network', nameval, 'device', staDevice);
+ }
+
firewall.deleteNetwork(net.getName());
const zonePromise = zoneval ?
@@ -4482,6 +4490,13 @@ return view.extend({
if (s != null && s['.type'] != 'interface')
return true;
+ for (const wifi of uci.sections('wireless', 'wifi-iface')) {
+ const networks = String(wifi.network || '').trim().split(/\s+/);
+
+ if (networks.indexOf(name) != -1)
+ return true;
+ }
+
const net = (s != null) ? network.instantiateNetwork(name) : null;
return (net != null && !net.isEmpty());
}
@@ -4525,7 +4540,7 @@ return view.extend({
if (bss.ssid != null) {
bssid = s2.option(form.Flag, 'bssid', _('Lock to BSSID'), _('Instead of joining any network with a matching SSID, only connect to the BSSID %h.').format(bss.bssid));
- bssid.default = '0';
+ bssid.default = (uci.get('wireless', radioDev.getName(), 'type') == 'mt_dbdc') ? '1' : '0';
}
zone = s2.option(widgets.ZoneSelect, 'zone', _('Create / Assign firewall-zone'), _('Choose the firewall zone you want to assign to this interface. Select unspecified to remove the interface from the associated zone or fill out the custom field to define a new zone and attach the interface to it.'));
diff --git a/natflow/Makefile b/natflow/Makefile
index 8eb172a2..eccad148 100644
--- a/natflow/Makefile
+++ b/natflow/Makefile
@@ -10,12 +10,12 @@ include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=natflow
PKG_VERSION:=20260531
-PKG_RELEASE:=44
+PKG_RELEASE:=45
PKG_SOURCE:=$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://github.com/ptpt52/natflow.git
PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=dd0a8370b9df62a57e31b4dbd12c74bc444c6a2b
+PKG_SOURCE_VERSION:=0a3d1131b6a5094959f6441ef435b2b3b6fa4819
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
PKG_MAINTAINER:=Chen Minqiang
PKG_LICENSE:=GPL-2.0
diff --git a/tun2socks/Makefile b/tun2socks/Makefile
index 3222346b..c60a272e 100644
--- a/tun2socks/Makefile
+++ b/tun2socks/Makefile
@@ -1,12 +1,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=tun2socks
-PKG_VERSION:=2.6.0
-PKG_RELEASE:=9
+PKG_VERSION:=2.7.0
+PKG_RELEASE:=10
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/xjasonlyu/tun2socks.git
-PKG_SOURCE_VERSION:=e8bd4553c483b1284bf30ca65544002f10f1ceeb
+PKG_SOURCE_VERSION:=8dda19e8e4613e014f0b12f3e624fdff5e5f23b3
PKG_MAINTAINER:=Konstantine Shevlakov
PKG_LICENSE:=GPL-3.0