🎉 Sync 2026-10-14 03:01:37

luci-app-passwall2/root/usr/share/passwall2/app.sh

@@ -47,7 +47,7 @@ check_run_environment() {
 		[ -d "/lib/apk/packages" ] && { file_path="/lib/apk/packages"; file_ext=".list"; }
 
 		if [ "$USE_TABLES" = "iptables" ]; then
-			dep_list="iptables-mod-tproxy iptables-mod-socket iptables-mod-iprange iptables-mod-conntrack-extra kmod-ipt-nat"
+			dep_list="iptables-mod-tproxy iptables-mod-socket iptables-mod-iprange iptables-mod-conntrack-extra iptables-mod-extra kmod-ipt-nat"
 		else
 			dep_list="kmod-nft-socket kmod-nft-tproxy kmod-nft-nat"
 			nftflag=1
@@ -923,6 +923,8 @@ start() {
 			set_cache_var "USE_TABLES" "$USE_TABLES"
 		fi
 	}
+	set_cache_var "ENABLED_DEFAULT_ACL" "$ENABLED_DEFAULT_ACL"
+	set_cache_var "ENABLED_ACLS" "$ENABLED_ACLS"
 	if [ "$ENABLED_DEFAULT_ACL" == 1 ] || [ "$ENABLED_ACLS" == 1 ]; then
 		bridge_nf_ipt=$(sysctl -e -n net.bridge.bridge-nf-call-iptables)
 		set_cache_var "bak_bridge_nf_ipt" "$bridge_nf_ipt"
@@ -1059,6 +1061,12 @@ get_config() {
 	DIRECT_DNS_QUERY_STRATEGY=$(config_n_get @global[0] direct_dns_query_strategy UseIP)
 
 	get_direct_dns
+	# nslookup uses UDP; TCP direct DNS remains configured for the proxy cores.
+	if [ "$DIRECT_DNS_PROTO" = "udp" ]; then
+		set_cache_var "DIRECT_DNS" "${DIRECT_DNS_SERVER}#${DIRECT_DNS_PORT}"
+	else
+		set_cache_var "DIRECT_DNS" "${AUTO_DNS%%,*}"
+	fi
 
 	DEFAULT_DNSMASQ_CONF_DIR=/tmp/dnsmasq.d
 	DNSMASQ_CONF_DIR=${DEFAULT_DNSMASQ_CONF_DIR}

luci-app-passwall2/root/usr/share/passwall2/haproxy.lua

@@ -21,7 +21,7 @@ local haproxy_dns = "127.0.0.1"
 
 local cpu_thread = sys.exec('echo -n $(cat /proc/cpuinfo | grep "processor" | wc -l)') or "1"
 local health_check_type = api.uci_get_c("@global_haproxy[0]", "health_check_type") or "tcp"
-local health_check_inter = api.uci_get_c("@global_haproxy[0]", "health_check_inter") or "20"
+local health_check_inter = api.uci_get_c("@global_haproxy[0]", "health_check_inter") or "60"
 local balancingStrategy = api.uci_get_c("@global_haproxy[0]", "balancingStrategy") or "roundrobin"
 local console_port = api.uci_get_c("@global_haproxy[0]", "console_port")
 local bind_local = api.uci_get_c("@global_haproxy[0]", "bind_local") or "0"
@@ -44,7 +44,7 @@ global
 	nbthread {{nbthread}}
 	external-check
 	insecure-fork-wanted
-	spread-checks 50
+	spread-checks 20
 	tune.max-checks-per-thread 5
 
 defaults
@@ -99,7 +99,7 @@ api.uci_foreach_c("haproxy_config", function(t)
 		local lbss = t.lbss
 		local listen_port = tonumber(t.haproxy_port) or 0
 		local server_node = api.uci_get_c(lbss)
-		local hop = (health_check_type == "script_logic") and (server_node.hysteria_hop or server_node.hysteria2_hop) or nil
+		local hop = (health_check_type == "script_logic") and server_node and (server_node.hysteria_hop or server_node.hysteria2_hop) or nil
 		hop = hop and hop:gsub(":", "-") or nil
 		if server_node and server_node.address and (server_node.port or hop) then
 			server_remark = server_node.address .. ":" .. (server_node.port or hop)
@@ -153,9 +153,12 @@ api.uci_foreach_c("haproxy_config", function(t)
 	end
 end)
 
-local inter = tonumber((health_check_inter or "20"):match("^%d+"))
-inter = (inter and inter >= 20) and inter or 20
-local inter_arg = "inter " .. inter .. "s fastinter " .. inter / 2 .. "s downinter " .. inter * 1.5 .. "s"
+local inter = tonumber(health_check_inter:match("^%d+")) or 60
+inter = math.max(inter, 20)
+-- Bound transition checks so long normal intervals do not delay removal or recovery.
+local fastinter = math.max(10, math.min(15, math.floor(inter / 2)))
+local downinter = math.ceil(inter * 1.5)
+local inter_arg = string.format("inter %ds fastinter %ds downinter %ds", inter, fastinter, downinter)
 
 local sortTable = {}
 for i in pairs(listens) do
@@ -165,7 +168,28 @@ for i in pairs(listens) do
 end
 table.sort(sortTable, function(a,b) return (a < b) end)
 
-for i, port in pairs(sortTable) do
+local function server_endpoint(o)
+	local address = o.server_address:gsub("^%[(.*)%]$", "%1")
+	if address:find(":", 1, true) then address = "[" .. address .. "]" end
+	return address .. ":" .. o.server_port
+end
+
+local check_counts = {}
+if health_check_type == "script_logic" then
+	for _, port in ipairs(sortTable) do
+		for _, o in ipairs(listens[port]) do
+			-- Domains can resolve to different IPs; share checks only for actual IP endpoints.
+			if api.is_ip(o.server_address) then
+				local endpoint = server_endpoint(o)
+				check_counts[endpoint] = (check_counts[endpoint] or 0) + 1
+			end
+		end
+	end
+end
+local shared_checks = {}
+local shared_check_names = {}
+
+for i, port in ipairs(sortTable) do
 	log(1, api.i18n.translatef("Entrance %s:%s", bind_address, port))
 
 	f_out:write("\n" .. string.format([[
@@ -184,7 +208,7 @@ listen %s
 
 	local count_M, count_B = 1, 1
 	for i, o in ipairs(listens[port]) do
-		local remark = o.server_remark or ""
+		local remark = (o.server_remark or ""):gsub("[%[%]]", "")
 		-- To prevent duplicate names from causing the program to fail to run.
 		if tostring(o.backup) ~= "1" then
 			remark = "M" .. count_M .. "-" .. remark
@@ -193,8 +217,18 @@ listen %s
 			remark = "B" .. count_B .. "-" .. remark
 			count_B = count_B + 1
 		end
-		local server = o.server_address .. ":" .. o.server_port
-		local server_conf = "server {{remark}} {{server}} weight {{weight}} {{resolvers}} check {{inter_arg}} rise 2 fall 2 {{backup}}"
+		local server = server_endpoint(o)
+		local check_arg = "check " .. inter_arg .. " rise 2 fall 2"
+		if (check_counts[server] or 0) > 1 then
+			local name = shared_check_names[server]
+			if not name then
+				name = "check_" .. (#shared_checks + 1)
+				shared_check_names[server] = name
+				table.insert(shared_checks, {name = name, server = server})
+			end
+			check_arg = "track " .. appname .. "_health_checks/" .. name
+		end
+		local server_conf = "server {{remark}} {{server}} weight {{weight}} {{resolvers}} {{check_arg}} {{backup}}"
 		server_conf = server_conf:gsub("{{remark}}", remark)
 		server_conf = server_conf:gsub("{{server}}", server)
 		server_conf = server_conf:gsub("{{weight}}", o.lbweight)
@@ -203,7 +237,7 @@ listen %s
 			resolvers = ""
 		end
 		server_conf = server_conf:gsub("{{resolvers}}", resolvers)
-		server_conf = server_conf:gsub("{{inter_arg}}", inter_arg)
+		server_conf = server_conf:gsub("{{check_arg}}", check_arg)
 		server_conf = server_conf:gsub("{{backup}}", tostring(o.backup) == "1" and "backup" or "")
 
 		f_out:write("	" .. api.trim(server_conf) .. "\n")
@@ -216,6 +250,20 @@ listen %s
 	end
 end
 
+-- A separate backend keeps manual maintenance on one listener from affecting others.
+if #shared_checks > 0 then
+	f_out:write(string.format([[
+
+backend %s_health_checks
+	mode tcp
+	option external-check
+	external-check command "/usr/share/%s/haproxy_check.sh"
+]], appname, appname))
+	for _, check in ipairs(shared_checks) do
+		f_out:write(string.format("\tserver %s %s check %s rise 2 fall 2\n", check.name, check.server, inter_arg))
+	end
+end
+
 -- Console config
 local console_user = api.uci_get_c("@global_haproxy[0]", "console_user")
 local console_password = api.uci_get_c("@global_haproxy[0]", "console_password")
@@ -234,8 +282,7 @@ f_out:close()
 
 -- Built-in health check URL
 if health_check_type == "script_logic" then
-	local probeUrl = api.uci_get_c("@global_haproxy[0]", "health_probe_url") or "https://www.google.com/generate_204"
-	local f_url = io.open(haproxy_path .. "/Probe_URL", "w")
-	f_url:write(probeUrl)
-	f_url:close()
+	local probeUrl = api.trim(api.uci_get_c("@global_haproxy[0]", "health_probe_url") or "")
+	if probeUrl == "" then probeUrl = "https://www.google.com/generate_204" end
+	api.set_cache_var("HAPROXY_PROBE_URL", probeUrl)
 end

luci-app-passwall2/root/usr/share/passwall2/haproxy_check.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin:/root/bin
-CONFIG=passwall2
+. /usr/share/passwall2/utils.sh
 
 listen_address=$1
 listen_port=$2
@@ -13,19 +13,16 @@ busybox pgrep -af "${CONFIG}/" | grep -E 'app\.sh.*(start|stop)|nftables\.sh|ipt
 	exit 0
 }
 
-probe_file="/tmp/etc/${CONFIG}/haproxy/Probe_URL"
-probeUrl="https://www.google.com/generate_204"
-if [ -f "$probe_file" ]; then
-	firstLine=$(head -n 1 "$probe_file" | tr -d ' \t\n')
-	[ -n "$firstLine" ] && probeUrl="$firstLine"
-fi
+probeUrl=$(get_cache_var "HAPROXY_PROBE_URL")
+probeUrl="${probeUrl:-https://www.google.com/generate_204}"
 
-extra_params="-x socks5h://${server_address}:${server_port}"
-if /usr/bin/curl --help all | grep -q "\-\-retry-all-errors"; then
-	extra_params="${extra_params} --retry-all-errors"
-fi
+case "$server_address" in
+	\[*\]) ;;
+	*:*) server_address="[$server_address]" ;;
+esac
 
-status=$(/usr/bin/curl -I -o /dev/null -skL ${extra_params} --connect-timeout 3 --retry 1 --max-time 6 -w "%{http_code}" "${probeUrl}")
+# Probe once per round; HAProxy rise/fall handles consecutive successes and failures.
+status=$(/usr/bin/curl -q -I -o /dev/null -sk --noproxy "" -x "socks5h://${server_address}:${server_port}" --connect-timeout 3 --max-time 6 -w "%{http_code}" "$probeUrl") || exit 1
 
 case "$status" in
 	200|204)

luci-app-passwall2/root/usr/share/passwall2/iptables.sh

@@ -851,6 +851,11 @@ add_firewall_rule() {
 		done
 	}
 
+	local direct_ipt
+	for direct_ipt in "$ipt_n" "$ipt_m" "$ip6t_n" "$ip6t_m"; do
+		$direct_ipt -I OUTPUT $(comment "PSW2_DIRECT") -m owner --gid-owner $DIRECT_GID -j RETURN
+	done
+
 	log_i18n 0 "%s firewall rules load complete!" "iptables"
 }
 
@@ -896,7 +901,7 @@ gen_include() {
 		[ -z "${_ipt}" ] && return
 
 		echo "*$2"
-		${_ipt}-save -t $2 | grep "PSW2" | grep -v "\-j PSW2$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
+		${_ipt}-save -t $2 | grep "PSW2" | grep -v "PSW2_DIRECT" | grep -v "\-j PSW2$" | sed -e "s/^-A \(OUTPUT\|PREROUTING\)/-I \1 1/"
 		echo 'COMMIT'
 	}
 	local __ipt=""
@@ -908,6 +913,8 @@ gen_include() {
 			$(extract_rules 4 nat)
 			$(extract_rules 4 mangle)
 			EOT
+			$ipt_n -I OUTPUT $(comment "PSW2_DIRECT") -m owner --gid-owner $DIRECT_GID -j RETURN
+			$ipt_m -I OUTPUT $(comment "PSW2_DIRECT") -m owner --gid-owner $DIRECT_GID -j RETURN
 
 			[ "$accept_icmp" = "1" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p icmp -j PSW2")
 			[ -z "${is_tproxy}" ] && \$(${MY_PATH} insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "$(dst $IPSET_DIRECT !) -p tcp -j PSW2")
@@ -925,6 +932,8 @@ gen_include() {
 			$(extract_rules 6 nat)
 			$(extract_rules 6 mangle)
 			EOT
+			$ip6t_n -I OUTPUT $(comment "PSW2_DIRECT") -m owner --gid-owner $DIRECT_GID -j RETURN
+			$ip6t_m -I OUTPUT $(comment "PSW2_DIRECT") -m owner --gid-owner $DIRECT_GID -j RETURN
 
 			[ "$accept_icmpv6" = "1" ] && $ip6t_n -A PREROUTING $(dst $IPSET_DIRECT6 !) -p ipv6-icmp -j PSW2
 

luci-app-passwall2/root/usr/share/passwall2/nftables.sh

@@ -902,6 +902,9 @@ add_firewall_rule() {
 
 	filter_direct_node_list > /dev/null 2>&1 &
 
+	nft "insert rule $NFTABLE_NAME mangle_output meta skgid $DIRECT_GID counter return comment \"PSW2_DIRECT\""
+	nft "insert rule $NFTABLE_NAME nat_output meta skgid $DIRECT_GID counter return comment \"PSW2_DIRECT\""
+
 	log_i18n 0 "%s firewall rules load complete!" "nftables"
 }
 

luci-app-passwall2/root/usr/share/passwall2/utils.sh

@@ -3,6 +3,7 @@
 # Copyright (C) 2026 Openwrt-Passwall Organization
 
 CONFIG=passwall2
+DIRECT_GID=9912
 APP_PATH=/usr/share/${CONFIG}
 TMP_PATH=/tmp/etc/${CONFIG}
 TMP_PATH2=${TMP_PATH}_tmp