🌴 Sync 2026-09-10 18:27:49

.github/diy/patches/luci-app-passwall.patch

@@ -240,7 +240,7 @@
 @@ -825,7 +825,7 @@ for k, v in pairs(nodes_table) do
  end
  
- m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
+ m:appendTemplate("/global/footer")
 -
 +m:appendTemplate("/global/status_bottom")
  m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})

.github/diy/patches/luci-app-passwall2.patch

@@ -116,7 +116,7 @@
 @@ -383,7 +383,7 @@ for k, v in pairs(nodes_table) do
  end
  
- m:appendTemplate("/global/footer", {shunt_list = api.jsonc.stringify(shunt_list)})
+ m:appendTemplate("/global/footer")
 -
 +m:appendTemplate("/global/status_bottom")
  m:appendTemplate("/cbi/sortable", {sectiontype = s2.sectiontype})

.github/workflows/upstream.yml

@@ -152,6 +152,7 @@ jobs:
         git_clone https://github.com/Tencent-Cloud-Plugins/tencentcloud-openwrt-plugin-cos && mv -n tencentcloud-openwrt-plugin-cos/tencentcloud_cos ./luci-app-tencentcloud-cos; rm -rf tencentcloud-openwrt-plugin-cos
         git_clone https://github.com/doushang/luci-app-shortcutmenu luci-shortcutmenu && mv -n luci-shortcutmenu/luci-app-shortcutmenu ./ ; rm -rf luci-shortcutmenu
         git_clone https://github.com/aa65535/openwrt-dist-luci
+        git_clone https://github.com/minicom365/openwrt-smart-reboot && mv -f openwrt-smart-reboot/*smart-reboot ./;rm -rf openwrt-smart-reboot
         # git_clone https://github.com/morytyann/OpenWrt-msd && mvdir OpenWrt-msd
         # git_clone https://github.com/messense/aliyundrive-webdav aliyundrive && mv -n aliyundrive/openwrt/* ./ ; rm -rf aliyundrive
         # git_clone https://github.com/sbilly/netmaker-openwrt && mv -n netmaker-openwrt/netmaker ./; rm -rf netmaker-openwrt
@@ -176,6 +177,7 @@ jobs:
         git_clone https://github.com/nikkinikki-org/OpenWrt-momo && mv -f OpenWrt-momo/{luci-app-momo,momo} ./;rm -rf OpenWrt-momo
         git_clone https://github.com/fcshark-org/openwrt-fchomo && mvdir openwrt-fchomo
         git clone https://github.com/fw876/helloworld -b dev && mvdir helloworld
+        git_clone https://github.com/umk0/openwrt-luci-haproxy-manager && mv -f openwrt-luci-haproxy-manager/luci-app-haproxy-manager ./;rm -rf openwrt-luci-haproxy-manager
         ) &
         (
         git_clone https://github.com/ZeaKyX/speedtest-web
@@ -389,8 +391,8 @@ jobs:
         (
         git_sparse_clone develop "https://github.com/Ysurac/openmptcprouter-feeds" \
         dsvpn glorytun-udp glorytun grpcurl ipcalc luci-app-dsvpn luci-app-glorytun-tcp luci-app-glorytun-udp luci-app-mail luci-app-mlvpn luci-app-mptcp luci-app-nginx-ha luci-app-sqm-autorate luci-app-packet-capture luci-app-iperf luci-theme-openmptcprouter sqm-autorate speedtestc mlvpn mptcp tcptraceroute tracebox tsping atinout z8102
-        git_sparse_clone chawrt/24.10 "https://github.com/liudf0716/luci" applications/luci-app-yt-dlp applications/luci-app-apfree-wifidog applications/luci-app-ss-redir
-        git_sparse_clone chawrt/24.10 "https://github.com/liudf0716/packages" net/ss-redir
+        git_sparse_clone chawrt/25.12 "https://github.com/liudf0716/luci" applications/luci-app-aw-bpf applications/luci-app-xkcptun applications/luci-app-apfree-wifidog
+        git_sparse_clone chawrt/25.12 "https://github.com/liudf0716/packages" net/aw-bpf net/xkcptun net/apfree-wifidog
         ) &
         git_sparse_clone master "https://github.com/immortalwrt/packages" net/n2n net/qbittorrent \
         net/amule net/cdnspeedtest net/minieap net/ddns-go net/sysuh3c net/3proxy utils/filebrowser net/cloudreve \
@@ -466,7 +468,7 @@ jobs:
              -H "Authorization: Bearer ${{ secrets.TOKEN_KIDDIN9 }}" \
              -X POST -d '{ "query": "query {repository(owner: \"'"$1"'\", name: \"'"$2"'\"){latestRelease{tagName tagCommit{oid}}refs(refPrefix:\"refs/tags/\",last:1,orderBy:{field:TAG_COMMIT_DATE,direction:ASC}){edges{node{name target{oid}}}}defaultBranchRef{target{...on Commit {oid}}}}}"}' https://api.github.com/graphql)
         }
-        for pkg in $(ls !(luci-*|nikki|mihomo*|openwrt-einat-ebpf|qBittorrent-Enhanced-Edition|tuic-client|glorytun|dae|daed|shadowsocks-libev|mosdns|spotifyd|miniupnpd|openwrt-Toolkit|libdouble-conversion|wxbase|3proxy|ucode|mergerfs|openwrt-nezhav1|homebox|sub-web|tcptraceroute|frp|openwrt-caddy|mentohust|brlaser|rapidjson|smartdns|hysteria|gecoosac|libcryptopp|naiveproxy|rustdesk-server|shadowsocksr-libev|tuic-server|joker|ps3netsrv|natter|netmaker|openwrt-ympd|subconverter|sms-tool)/Makefile); do
+        for pkg in $(ls !(luci-*|nikki|mihomo*|dockermanager|kaiplus|baidudrive|openwrt-einat-ebpf|qBittorrent-Enhanced-Edition|tuic-client|glorytun|dae|daed|shadowsocks-libev|mosdns|spotifyd|miniupnpd|openwrt-Toolkit|libdouble-conversion|wxbase|3proxy|ucode|mergerfs|openwrt-nezhav1|homebox|sub-web|tcptraceroute|frp|openwrt-caddy|mentohust|brlaser|rapidjson|smartdns|hysteria|gecoosac|libcryptopp|naiveproxy|rustdesk-server|shadowsocksr-libev|tuic-server|joker|ps3netsrv|natter|netmaker|openwrt-ympd|subconverter|sms-tool)/Makefile); do
           repo="$(grep ^PKG_SOURCE_URL $pkg | grep github | cut -f 4-5 -d '/' | sed -e 's/.git//' | grep -E '[0-9a-zA-Z_-]+$')" || true
           if [ "$repo" ]; then
             owner="$(echo $repo | cut -f 1 -d '/')"

agentflow/Makefile

@@ -10,12 +10,12 @@ AGENTFLOW_ARCH_x86_64:=amd64
 AGENTFLOW_ARCH_aarch64:=arm64
 AGENTFLOW_ARCH:=$(AGENTFLOW_ARCH_$(ARCH))
 
-AGENTFLOW_HASH_x86_64:=996ccb6580043a187e83a3558c6bb2f0ff503bafbe46b7c995cff7f77629c088
-AGENTFLOW_HASH_aarch64:=6d733ebc49b095bf8670a1b655a13bb8ad98c90ced19701b67d5cdd4fe9a3db4
+AGENTFLOW_HASH_x86_64:=454857022d555b23979bd7b9116ef926ce7117e9e6034116f3223bb72cae07db
+AGENTFLOW_HASH_aarch64:=34dfe07fd2a1bcb7de8eadb41dd0a67b46d5db78f4ca14d1835fe94608c0579a
 
 PKG_NAME:=agentflow
-PKG_VERSION:=0.3.0
-PKG_RELEASE:=8
+PKG_VERSION:=0.3.1
+PKG_RELEASE:=9
 
 AGENTFLOW_URL_FILE:=agentflow-linux-$(AGENTFLOW_ARCH)
 AGENTFLOW_DOWNLOAD:=$(AGENTFLOW_URL_FILE)-$(AGENTFLOW_HASH_$(ARCH))

apfree-wifidog/Makefile

@@ -0,0 +1,70 @@
+#
+# Copyright (C) 2018 Dengfeng Liu
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=apfree-wifidog
+PKG_VERSION:=9.09.2938
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/liudf0716/$(PKG_NAME)/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=skip
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Dengfeng Liu <liudf0716@gmail.com>
+PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/apfree-wifidog
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+	DEPENDS:=+zlib +libjson-c +libevent2 +libevent2-openssl +libuci \
+						+openssl-util +libnetfilter-queue +conntrack +libmosquitto \
+						+libnftnl +libmnl +libbpf +aw-bpf
+  TITLE:=Apfree's wireless captive portal solution
+  URL:=https://github.com/liudf0716/apfree_wifidog
+endef
+
+define Package/apfree-wifidog/description
+  The ApFree Wifidog project is a complete and embeddable captive portal
+  solution for wireless community groups or individuals who wish to open a free
+  Hotspot while still preventing abuse of their Internet connection.
+  It's enhanced wifidog
+endef
+
+define Package/apfree-wifidog/conffiles
+/etc/config/wifidogx
+endef
+
+define Package/apfree-wifidog/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/wifidogx $(1)/usr/bin/wifidogx
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/wdctlx $(1)/usr/bin/wdctlx
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-msg.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html.front $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wifidog-redir.html.rear $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/authserver-offline.html $(1)/etc/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/internet-offline.html $(1)/etc/
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/wifidogx.init $(1)/etc/init.d/wifidogx
+	$(INSTALL_DIR) $(1)/etc/config
+	$(CP) ./files/wifidogx.conf $(1)/etc/config/wifidogx
+	$(INSTALL_DIR) $(1)/etc/wifidogx
+	$(INSTALL_DIR) $(1)/www/cgi-bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/wifi-config $(1)/www/cgi-bin/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/wifi-diag $(1)/www/cgi-bin/
+endef
+
+$(eval $(call BuildPackage,apfree-wifidog))

apfree-wifidog/README.md

@@ -0,0 +1,125 @@
+![ApFreeWiFiDog](https://github.com/liudf0716/apfree_wifidog/blob/master/logo.png)
+
+
+[![license][1]][2]
+[![PRs Welcome][3]][4]
+[![Issues Welcome][5]][6]
+[![Release Version][7]][8]
+[![OpenWrt][11]][12]
+[![Join the QQ Group][15]][16]
+
+
+[1]: https://img.shields.io/badge/license-GPLV3-brightgreen.svg?style=plastic
+[2]: https://github.com/liudf0716/apfree_wifidog/blob/master/COPYING
+[3]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=plastic
+[4]: https://github.com/liudf0716/apfree_wifidog/pulls
+[5]: https://img.shields.io/badge/Issues-welcome-brightgreen.svg?style=plastic
+[6]: https://github.com/liudf0716/apfree_wifidog/issues/new
+[7]: https://img.shields.io/badge/release-3.11.1716-red.svg?style=plastic
+[8]: https://github.com/liudf0716/apfree_wifidog/releases
+[11]: https://img.shields.io/badge/Platform-%20OpenWrt%7C%20LEDE%20-brightgreen.svg?style=plastic
+[12]: https://github.com/KunTengRom/kunteng-lede-17.01.4
+[13]: https://img.shields.io/badge/KunTeng-Inside-blue.svg?style=plastic
+[14]: https://www.kunteng.org.cn
+[15]: https://img.shields.io/badge/chat-qq%20group-brightgreen.svg
+[16]: https://jq.qq.com/?_wv=1027&k=4ADDSev
+
+## ApFree WiFiDog: A high performance captive portal solution for HTTP(s)
+
+ApFree WiFiDog is a high performance captive portal solution for HTTP(s), which mainly used in ([LEDE](https://github.com/lede-project/source) & [OpenWrt](https://github.com/openwrt/openwrt)) platform. 
+
+
+**[中文介绍](https://github.com/liudf0716/apfree_wifidog/blob/master/README_ZH.md)**
+
+## Enhancement of apfree-wifidog 
+
+In fact, the title should be why we choose apfree-wifidog, the reason was the following: 
+
+>  Stable
+
+apfree-wifidog was widely used in tens of thousands device, which were running in business scene. In order to improve its stable, we rewrite all iptables rule by api instead of fork call, which will easily cause deadlock in multithread-fork running environment. we also re-write the code and replace libhttpd (which is unmaintained for years) with libevent
+
+> Performance
+
+apfree-wifidog's http request-response is more quick, u can find statistic data in our test document
+
+> HTTPs redirect
+
+apfree-wifidog support https redirect, in current internet environment, captive portal solution without supporting https redirect will become unsuitable gradually
+
+
+> More features
+
+apfree-wifidog support mac temporary-pass, ip,domain,pan-domain,white-mac,black-mac rule and etc. all these rules can be applied without restarting wifidog
+
+> MQTT support
+
+by enable mqtt support, u can remotely deliver such as trusted ip, domain and pan-domain rules to apfree wifidog 
+
+> Compilable with wifidog protocol
+
+u don't need to modify your wifidog authentication server to adapt apfree-wifidog; if u have pression on server-side, apfree wifidog's improved protocol can greatly relieve it, which disabled by default
+
+
+## Getting started
+
+before starting apfree-wifidog, we must know how to configure it. apfree-wifidog use OpenWrt standard uci config system, all your apfree-wifidog configure information stored in `/etc/confg/wifidogx`, which will be parsed by  `/etc/init.d/wifidogx` to /tmp/wifidog.conf, apfree-wifidog's real configure file is `/tmp/wifidog.conf`
+
+The default apfree-wifidog UCI configuration file like this:
+
+```
+config wifidog
+    option  gateway_interface   'br-lan'
+    option  auth_server_hostname    'wifidog.kunteng.org.cn'
+    option  auth_server_port    443
+    option  auth_server_path    '/wifidog/'
+    option  check_interval      60
+    option  client_timeout      5
+    option  apple_cna           1
+    option  thread_number       5
+    option  wired_passed        0
+    option  enable      0
+```
+
+> auth_server_hostname was apfree-wifidog auth server, it can be domain or ip; wifidog.kunteng.org.cn is a free auth server we provided, it was also [open source](https://github.com/wificoin-project/wwas) 
+
+> apple_cna 1 apple captive detect deceive; 2 apple captive detect deceive to  disallow portal page appear
+
+> wired_passed means whether LAN access devices need to auth or not, value 1 means no need to auth 
+
+> enable means whether start apfree-wifidog when we executed `/etc/init.d/wifidogx start`, if u wanted to start apfree-wifidog, you must set enable to 1 before executing `/etc/init.d/wifidogx start`
+
+### How to support https redirect
+
+In order to support https redirect, apfree-wifidog need x509 pem cert and private key, u can generate yourself like this:
+
+```
+PX5G_BIN="/usr/sbin/px5g"
+OPENSSL_BIN="/usr/bin/openssl"
+APFREE_CERT="/etc/apfree.crt"
+APFREE_KEY="/etc/apfree.key"
+
+generate_keys() {
+    local days bits country state location commonname
+
+    # Prefer px5g for certificate generation (existence evaluated last)
+    local GENKEY_CMD=""
+    local UNIQUEID=$(dd if=/dev/urandom bs=1 count=4 | hexdump -e '1/1 "%02x"')
+    [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform pem -nodes"
+    [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -pem"
+    [ -n "$GENKEY_CMD" ] && {
+        $GENKEY_CMD \
+            -days ${days:-730} -newkey rsa:${bits:-2048} -keyout "${APFREE_KEY}.new" -out "${APFREE_CERT}.new" \
+            -subj /C="${country:-CN}"/ST="${state:-localhost}"/L="${location:-Unknown}"/O="${commonname:-ApFreeWiFidog}$UNIQUEID"/CN="${commonname:-ApFreeWiFidog}"
+        sync
+        mv "${APFREE_KEY}.new" "${APFREE_KEY}"
+        mv "${APFREE_CERT}.new" "${APFREE_CERT}"
+    }
+}
+
+```
+
+or when u start `/etc/init.d/wifidogx start`, it will generate it automatically
+
+
+For more information, please refer to the upstream [project page](https://github.com/liudf0716/apfree_wifidog)

apfree-wifidog/files/wifidogx.conf

@@ -0,0 +1,39 @@
+config wifidogx 'common'
+	option external_interface 'wan'
+	option check_interval '60'
+	option client_timeout '60'
+	option wired_passed '1'
+	option enabled '1'
+	option log_level '0'
+	option js_filter '1'
+	option apple_cna '1'
+	option auth_server_mode 'local'
+	option enable_anti_nat '0'
+	option ttl_values '64,128,255'
+	option ap_device_id 'AW85844955CC7D742A339'
+	option ap_mac_address '5C-C7-D7-42-A3-39'
+	option ap_longitude '116.395000'
+	option ap_latitude '039.911000'
+	option disable_portal_auth '0'
+	option enable_privileged_ops '0'
+	option privileged_ops_secret 'chawrt@2026'
+	option device_id 'AW58534605CC7D742A339'
+	option local_portal 'https://qq.com'
+
+config gateway 'apfree'
+	option gateway_name 'br-lan'
+	option gateway_channel 'apfree'
+	option gateway_auth_enabled '1'
+	option gateway_id '5CC7D742A336'
+	option gateway_subnetv4 '192.168.8.1/24'
+
+config auth 'local'
+	option auth_server_hostname '192.168.8.109'
+	option auth_server_port '8001'
+	option auth_server_path '/wifidog/'
+
+config longconn 'openclaw'
+	option long_conn_mode 'ws'
+	option ws_server_hostname '192.168.8.109'
+	option ws_server_port '8001'
+	option ws_server_path '/ws/wifidogx'

apfree-wifidog/files/wifidogx.init

@@ -0,0 +1,304 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2018 Dengfeng Liu
+
+# After aw-bpf (START=98) so dns_ringbuf_portal is pinned for wildcard trust.
+START=99
+USE_PROCD=1
+NAME=wifidogx
+PROG="/usr/bin/${NAME}"
+CONFIGFILE="/tmp/wifidogx.conf"
+
+handle_gateway() {
+	local section="$1"
+	local gateway_name gateway_channel gateway_id
+	local gateway_subnetv4
+	local gateway_auth_enabled
+
+	config_get gateway_name "$section" gateway_name
+	config_get gateway_channel "$section" gateway_channel
+	config_get gateway_id "$section" gateway_id
+	config_get gateway_auth_enabled "$section" gateway_auth_enabled 1
+
+
+	if [ -z "$gateway_name" ] || [ -z "$gateway_channel" ] ; then
+		echo "gateway_name and gateway_channel  are required for $section" >&2
+		return
+	fi
+
+	# Get gateway_id from gateway_name if not set
+	if [ -z "$gateway_id" ]; then
+		gateway_id=$(ifconfig "$gateway_name" | awk '/HWaddr/ {print toupper($5)}' | tr -d ':')
+		if [ -z "$gateway_id" ]; then
+			echo "Failed to get gateway_id for $gateway_name" >&2
+			return
+		fi
+		uci set wifidogx."$section".gateway_id="$gateway_id"
+		uci commit wifidogx
+	fi
+	# according to the gateway_name to get the subnetv4
+	local gateway_ipv4=$(ifconfig "$gateway_name" | awk '/inet addr:/ {print $2}' | cut -d: -f2)
+	local gateway_maskv4=$(ifconfig "$gateway_name" | awk '/Mask:/ {print $4}' | cut -d: -f2)
+	[ -z "$gateway_ipv4" ] && echo "Failed to get gateway_ipv4 for $gateway_name" >&2 && return
+	[ -z "$gateway_maskv4" ] && echo "Failed to get gateway_maskv4 for $gateway_name" >&2 && return
+
+	# change the gateway_ip4/gateway_maskv4 to CIDR format
+	local mask_bits=0
+	local mask_value=$(printf '%d' "0x$(echo $gateway_maskv4 | tr '.' ' ' | awk '{printf "%02x%02x%02x%02x",$1,$2,$3,$4}')")
+	while [ $mask_value -ne 0 ]; do
+		mask_bits=$((mask_bits + (mask_value & 1)))
+		mask_value=$((mask_value >> 1))
+	done
+	gateway_subnetv4="$gateway_ipv4/$mask_bits"
+	
+	uci set wifidogx."$section".gateway_subnetv4="$gateway_subnetv4"
+	uci commit wifidogx
+
+	printf "GatewaySetting {\n\tGatewayAuthEnabled %s\n\tGatewayInterface %s\n\tGatewayChannel %s\n\tGatewayID %s\n\tGatewaySubnetV4 %s\n}\n" \
+		 "${gateway_auth_enabled}" "${gateway_name}" "${gateway_channel}" "${gateway_id}" "${gateway_subnetv4}" >> "$CONFIGFILE"
+}
+
+add_white_list_entries() {
+	local list_type="$1"
+	local uci_field="$2"
+	local target_variable="$3"
+
+	list_type=$(uci get wifidogx.common."$list_type")
+	for group in $list_type; do
+		group_list=$(uci get wifidogx."$group"."$uci_field")
+		if [ -n "$group_list" ]; then
+			eval "$target_variable=\"\${$target_variable} \$group_list\""
+		fi
+	done
+}
+
+prepare_common_settings() {
+	printf "CheckInterval %s\nClientTimeout %s\nJsFilter %s\nWiredPassed %s\nBypassAppleCNA %s\n" \
+		"$check_interval" "$client_timeout" "$js_filter" "$wired_passed" "$apple_cna" >> "$CONFIGFILE"
+	
+	printf "EnableAntiNat %s\n" "$enable_anti_nat" >> "$CONFIGFILE"
+	printf "TTLValues %s\n" "$ttl_values" >> "$CONFIGFILE"
+	printf "DisablePortalAuth %s\n" "$disable_portal_auth" >> "$CONFIGFILE"
+	printf "EnablePrivilegedOps %s\n" "$enable_privileged_ops" >> "$CONFIGFILE"
+	[ -n "$privileged_ops_secret" ] && printf "PrivilegedOpsSecret %s\n" "$privileged_ops_secret" >> "$CONFIGFILE"
+
+	[ -n "$anti_nat_permit_macs" ] && printf "AntiNatPermitMACs %s\n" "$anti_nat_permit_macs" >> "$CONFIGFILE"
+	
+	process_trusted_list() {
+		local list="$1"
+		local config_name="$2"
+		
+		if [ -n "$list" ]; then
+			# Clean up whitespace and remove duplicates
+			list=$(echo "$list" | sed -e 's/^[[:space:]]*//;s/[[:space:]]*$//;s/[[:space:]]\+/ /g' \
+				| tr ' ' '\n' | sort -u | tr '\n' ',' | sed 's/,$//')
+			printf "%s %s\n" "$config_name" "$list" >> "$CONFIGFILE"
+		fi
+	}
+
+	process_trusted_list "$trusted_domains" "TrustedDomains"
+	process_trusted_list "$trusted_macs" "TrustedMACList"
+	process_trusted_list "$trusted_wildcard_domains" "TrustedWildcardDomains"
+}
+
+prepare_device_info() {
+	# Check if any device info fields are set
+	if [ -n "$ap_device_id" ] || [ -n "$ap_mac_address" ] || [ -n "$ap_longitude" ] || [ -n "$ap_latitude" ] || [ -n "$location_id" ]; then
+		printf "DeviceInfo {\n" >> "$CONFIGFILE"
+		
+		[ -n "$ap_device_id" ] && printf "\tApDeviceId %s\n" "$ap_device_id" >> "$CONFIGFILE"
+		[ -n "$ap_mac_address" ] && printf "\tApMacAddress %s\n" "$ap_mac_address" >> "$CONFIGFILE"
+		[ -n "$ap_longitude" ] && printf "\tApLongitude %s\n" "$ap_longitude" >> "$CONFIGFILE"
+		[ -n "$ap_latitude" ] && printf "\tApLatitude %s\n" "$ap_latitude" >> "$CONFIGFILE"
+		[ -n "$location_id" ] && printf "\tLocationId %s\n" "$location_id" >> "$CONFIGFILE"
+		
+		printf "}\n" >> "$CONFIGFILE"
+	fi
+}
+
+prepare_auth_server_settings() {
+	# 获取选中的认证服务器配置
+	local selected_auth_server
+	selected_auth_server=$(uci get wifidogx.common.selected_auth_server 2>/dev/null)
+	
+	# 如果是云认证或旁路模式，需要验证选中的认证服务器
+	if [ "$auth_server_mode" = "cloud" ] || [ "$auth_server_mode" = "bypass" ]; then
+		if [ -z "$selected_auth_server" ]; then
+			echo "Error: selected_auth_server is required for $auth_server_mode mode" >&2
+			return 1
+		fi
+		
+		local auth_server_hostname auth_server_port auth_server_path
+		
+		uci_validate_section "$NAME" "auth" "$selected_auth_server" \
+			'auth_server_hostname:string:192.168.1.1' \
+			'auth_server_port:port:80' \
+			'auth_server_path:string:/wifidog/'
+		
+		export auth_server_hostname
+		export auth_server_port
+		export auth_server_path
+	fi
+	
+	case "$auth_server_mode" in
+	cloud|bypass)
+		printf "AuthServerMode 0\n" >> "$CONFIGFILE"
+		printf "DeviceID %s\nAuthServer {\n\tHostname %s\n\tHTTPPort %s\n\tPath %s\n}\n" \
+			"$device_id" "$auth_server_hostname" "$auth_server_port" "$auth_server_path" >> "$CONFIGFILE"
+		;;
+	local)
+		printf "AuthServerMode 2\n" >> "$CONFIGFILE"
+		[ -n "$device_id" ] && printf "DeviceID %s\n" "$device_id" >> "$CONFIGFILE"
+		[ -n "$auth_server_offline_file" ] && printf "AuthServerOfflineFile %s\n" "$auth_server_offline_file" >> "$CONFIGFILE"
+		[ -n "$local_portal" ] && printf "LocalPortal %s\n" "$local_portal" >> "$CONFIGFILE"
+		;;
+	esac
+
+	[ -n "$internet_offline_file" ] && printf "InternetOfflineFile %s\n" "$internet_offline_file" >> "$CONFIGFILE"
+}
+
+prepare_longconn_settings() {
+	local long_conn_mode ws_server_hostname ws_server_port ws_server_path
+	local mqtt_server_hostname mqtt_server_port mqtt_username mqtt_password
+	local selected_long_conn
+
+	selected_long_conn=$(uci get wifidogx.common.selected_long_conn 2>/dev/null)
+	[ -z "$selected_long_conn" ] && return
+
+	if ! uci -q get wifidogx."$selected_long_conn" >/dev/null; then
+		echo "Long connection: selected section $selected_long_conn does not exist" >&2
+		return
+	fi
+
+	uci_validate_section "$NAME" "longconn" "$selected_long_conn" \
+		'long_conn_mode:or("ws","wss","mqtt","mqtts"):ws' \
+		'ws_server_hostname:string' \
+		'ws_server_port:port:443' \
+		'ws_server_path:string:/ws/wifidogx' \
+		'mqtt_server_hostname:string' \
+		'mqtt_server_port:port:1883' \
+		'mqtt_username:string' \
+		'mqtt_password:string'
+
+	case "$long_conn_mode" in
+	ws|wss)
+		if [ -z "$ws_server_hostname" ]; then
+			echo "Long connection: ws_server_hostname is required" >&2
+			return
+		fi
+		local ws_ssl
+		ws_ssl=$([ "$long_conn_mode" = "wss" ] && echo 1 || echo 0)
+		printf "WebSocket {\n\tWSServer %s\n\tWSServerPort %s\n\tWSServerPath %s\n\tWSServerSSL %s\n}\n" \
+			"$ws_server_hostname" "$ws_server_port" "$ws_server_path" "$ws_ssl" >> "$CONFIGFILE"
+		;;
+	mqtt|mqtts)
+		if [ -z "$mqtt_server_hostname" ]; then
+			echo "Long connection: mqtt_server_hostname is required" >&2
+			return
+		fi
+		local mqtt_ssl
+		mqtt_ssl=$([ "$long_conn_mode" = "mqtts" ] && echo 1 || echo 0)
+		printf "mqtt {\n\tserveraddr %s\n\tserverport %s\n\tmqttUseSSL %s\n\tmqttUsername %s\n\tmqttPassword %s\n}\n" \
+			"$mqtt_server_hostname" "$mqtt_server_port" "$mqtt_ssl" "${mqtt_username:-}" "${mqtt_password:-}" >> "$CONFIGFILE"
+		;;
+	esac
+}
+
+prepare_external_interface() {
+	[ -z "$external_interface" ] && echo "No ExternalInterface " >&2 && return
+	local external_interface_name
+
+	if [ "$external_interface" = "wwan" ]; then
+		external_interface_name=$(ubus call network.interface."$external_interface" status | jsonfilter -e '@.device')
+	else
+		external_interface_name=$(uci get network."$external_interface".device)
+	fi
+
+	[ -z "$external_interface_name" ] && echo "Failed to get device name for $external_interface" >&2 && return
+  
+	printf "ExternalInterface %s\n" "$external_interface_name" >> "$CONFIGFILE"
+}
+
+prepare_wifidog_conf() {
+	[ -f "$CONFIGFILE" ] && rm -f "$CONFIGFILE"
+	local auth_server_mode_value='"cloud", "bypass", "local"'
+	
+	# 获取选中的认证服务器
+	local selected_auth_server
+	selected_auth_server=$(uci get wifidogx.common.selected_auth_server 2>/dev/null)
+	
+    
+	uci_validate_section "$NAME" "$NAME" common \
+		'enabled:bool:0' \
+		"auth_server_mode:or($auth_server_mode_value)" \
+		'selected_auth_server:string' \
+		'selected_long_conn:string' \
+		'log_level:integer:7' \
+		'device_id:string' \
+		'check_interval:integer:60' \
+		'client_timeout:integer:5' \
+		'wired_passed:bool:1' \
+		'apple_cna:bool:0' \
+		'trusted_domains:list(host)' \
+		'trusted_wildcard_domains:list(string)' \
+		'trusted_macs:list(string)' \
+		'app_white_list:list(string)' \
+		'mac_white_list:list(string)' \
+		'wildcard_white_list:list(string)' \
+		'js_filter:bool:1' \
+		'auth_server_offline_file:string' \
+		'internet_offline_file:string' \
+		'local_portal:string' \
+		'external_interface:string'	\
+		'enable_anti_nat:bool:0' \
+		'enable_privileged_ops:bool:0' \
+		'privileged_ops_secret:string:chawrt@2026' \
+		'ttl_values:string:64,128' \
+		'anti_nat_permit_macs:string' \
+		'disable_portal_auth:bool:1' \
+		'ap_device_id:string' \
+		'ap_mac_address:string' \
+		'ap_longitude:string' \
+		'ap_latitude:string' \
+		'location_id:string'
+
+	[ -n "$app_white_list" ] && add_white_list_entries "app_white_list" "domain_name" "trusted_domains"
+	[ -n "$mac_white_list" ] && add_white_list_entries "mac_white_list" "mac_address" "trusted_macs"
+	[ -n "$wildcard_white_list" ] && add_white_list_entries "wildcard_white_list" "wildcard_domain" "trusted_wildcard_domains"
+
+	prepare_external_interface
+	prepare_auth_server_settings
+	prepare_longconn_settings
+	prepare_device_info
+	config_foreach handle_gateway gateway
+	prepare_common_settings
+}
+
+service_triggers() {
+	procd_add_reload_trigger "wifidogx"
+}
+
+start_service() {
+	config_load "$NAME"
+
+	prepare_wifidog_conf
+
+	if [ "$enabled" -eq 0 ]; then
+		echo "wifidogx is disabled, exit..." >&2
+		return
+	fi
+
+	procd_open_instance
+	procd_set_param command "$PROG" -c "$CONFIGFILE" -s -f -d "$log_level"
+	procd_set_param respawn
+	procd_set_param file /etc/config/wifidogx
+	procd_close_instance
+}
+
+status_service() {
+	/usr/bin/wdctlx status
+}
+
+reload_service() {
+	stop
+	start
+}

aw-bpf/Makefile

@@ -0,0 +1,79 @@
+#
+# Copyright (C) 2025 Dengfeng Liu
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=aw-bpf
+PKG_VERSION:=1.08.23
+PKG_RELEASE:=1
+
+PKG_SOURCE:=aw-bpf-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/liudf0716/$(PKG_NAME)/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=skip
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Dengfeng Liu <liudf0716@gmail.com>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_DEPENDS:=bpf-headers
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+include $(INCLUDE_DIR)/bpf.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+define Package/aw-bpf
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=ApFree eBPF programs and tools
+  DEPENDS:=+libbpf +libelf +libjson-c +libmnl +libnftnl +tc-full +bpftool-minimal +ip +kmod-xdpi +kmod-sched-bpf $(BPF_DEPENDS)
+  URL:=https://github.com/liudf0716/aw-bpf
+endef
+
+define Package/aw-bpf/description
+	ApFree eBPF provides eBPF programs for session tracking, xDPI, DNS monitoring
+	and user-space tools: aw-bpfctl (control CLI) and aw-eventd (session / DNS
+	consumer with independent nftables table inet awbpf).
+endef
+
+
+define KernelPackage/xdpi
+  SECTION:=kernel
+  SUBMENU:=Network Support
+  TITLE:=xdpi ebpf module
+  FILES:=$(PKG_BUILD_DIR)/xdpi_bpf.ko
+  AUTOLOAD:=$(call AutoProbe,xdpi_bpf)
+endef
+
+# Build cmake userspace first (aw-bpfctl, aw-eventd), then BPF objects and kmod.
+define Build/Compile
+	$(call Build/Compile/Default)
+	$(call CompileBPF,$(PKG_BUILD_DIR)/aw_bpf.c,$(if $(filter arm aarch64 x86_64 i386,$(ARCH)),-DENABLE_XDPI_FEATURE))
+	$(call CompileBPF,$(PKG_BUILD_DIR)/dns_bpf.c,$(if $(filter arm aarch64 x86_64 i386,$(ARCH)),-DENABLE_XDPI_FEATURE))
+	$(KERNEL_MAKE) M=$(PKG_BUILD_DIR) modules
+endef
+
+define Package/aw-bpf/conffiles
+/etc/config/aw-bpf
+endef
+
+define Package/aw-bpf/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/aw-bpfctl $(1)/usr/bin/aw-bpfctl
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/aw-eventd $(1)/usr/bin/aw-eventd
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/aw-bpf.init $(1)/etc/init.d/aw-bpf
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/aw-bpf.conf $(1)/etc/config/aw-bpf
+	$(INSTALL_DIR) $(1)/lib/bpf
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/aw_bpf.o $(1)/lib/bpf/aw-bpf.o
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/dns_bpf.o $(1)/lib/bpf/dns-bpf.o
+endef
+
+$(eval $(call BuildPackage,aw-bpf))
+$(eval $(call KernelPackage,xdpi))

aw-bpf/files/aw-bpf.conf

@@ -0,0 +1,2 @@
+config aw-bpf 'common'
+	option enable_event_log '0'

aw-bpf/files/aw-bpf.init

@@ -0,0 +1,325 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2025-2026 Dengfeng Liu
+# aw-bpf service - manages aw-bpf lifecycle: aw-eventd, xdpi module, BPF maps
+
+START=90
+STOP=10
+USE_PROCD=1
+NAME=aw-bpf
+PROG="/usr/bin/aw-eventd"
+CONF_FILE="/var/etc/eventd.conf"
+BPF_FS_ROOT="/sys/fs/bpf"
+AW_BPF_PIN_DIR="$BPF_FS_ROOT/tc/globals"
+AW_BPF_LEGACY_PIN_DIR="$BPF_FS_ROOT/xdp/globals"
+AW_BPF_MAPS="ipv4_map ipv6_map mac_map tcp_conn_map udp_conn_map xdpi_l7_map session_events_map prog_array_map dns_ringbuf dns_ringbuf_portal dns_stats_map"
+AW_BPF_PROGS="tc_ingress tc_egress"
+AW_BPF_LAN_IFACES=""
+AW_BPF_WAN_IFACES=""
+
+resolve_lan_ifaces() {
+	local lan_device lan_ifname
+
+	AW_BPF_LAN_IFACES=""
+
+	config_load network
+	config_get lan_device lan device
+	config_get lan_ifname lan ifname
+
+	if [ -n "$lan_device" ] && [ -e "/sys/class/net/$lan_device" ]; then
+		AW_BPF_LAN_IFACES="$lan_device"
+		return 0
+	fi
+
+	for iface in $lan_ifname; do
+		if [ -n "$iface" ] && [ -e "/sys/class/net/$iface" ]; then
+			AW_BPF_LAN_IFACES="$iface"
+			return 0
+		fi
+	done
+}
+
+resolve_wan_ifaces() {
+	local wan_device wan_ifname
+
+	AW_BPF_WAN_IFACES=""
+
+	config_load network
+	config_get wan_device wan device
+	config_get wan_ifname wan ifname
+
+	if [ -n "$wan_device" ] && [ -e "/sys/class/net/$wan_device" ]; then
+		AW_BPF_WAN_IFACES="$wan_device"
+		return 0
+	fi
+
+	for iface in $wan_ifname; do
+		if [ -n "$iface" ] && [ -e "/sys/class/net/$iface" ]; then
+			AW_BPF_WAN_IFACES="$iface"
+			return 0
+		fi
+	done
+}
+
+detach_tc_programs() {
+	local iface="$1"
+
+	[ -z "$iface" ] && return 0
+	[ ! -e "/sys/class/net/$iface" ] && return 0
+
+	tc filter del dev "$iface" ingress 2>/dev/null || true
+	tc filter del dev "$iface" egress 2>/dev/null || true
+	tc qdisc del dev "$iface" clsact 2>/dev/null || true
+}
+
+attach_tc_programs() {
+	local iface="$1"
+	local aw_bpf_file="/lib/bpf/aw-bpf.o"
+
+	[ -z "$iface" ] && return 0
+	[ ! -e "/sys/class/net/$iface" ] && return 0
+	[ ! -f "$aw_bpf_file" ] && {
+		echo "aw-bpf.o not found at $aw_bpf_file" >&2
+		return 1
+	}
+
+	tc qdisc del dev "$iface" clsact 2>/dev/null || true
+	tc qdisc add dev "$iface" clsact 2>/dev/null || true
+
+	if ! tc filter add dev "$iface" ingress prio 1 bpf da obj "$aw_bpf_file" sec tc/ingress 2>/tmp/aw-bpf.ingress.err; then
+		echo "Failed to attach aw-bpf ingress to $iface: $(cat /tmp/aw-bpf.ingress.err 2>/dev/null)" >&2
+		rm -f /tmp/aw-bpf.ingress.err
+		return 1
+	fi
+	rm -f /tmp/aw-bpf.ingress.err
+
+	if ! tc filter add dev "$iface" egress prio 1 bpf da obj "$aw_bpf_file" sec tc/egress 2>/tmp/aw-bpf.egress.err; then
+		echo "Failed to attach aw-bpf egress to $iface: $(cat /tmp/aw-bpf.egress.err 2>/dev/null)" >&2
+		rm -f /tmp/aw-bpf.egress.err
+		tc filter del dev "$iface" ingress 2>/dev/null || true
+		tc qdisc del dev "$iface" clsact 2>/dev/null || true
+		return 1
+	fi
+	rm -f /tmp/aw-bpf.egress.err
+
+	echo "aw-bpf attached on $iface" >&2
+	return 0
+}
+
+cleanup_aw_bpf_pins() {
+	local entry
+
+	for entry in $AW_BPF_PROGS $AW_BPF_MAPS; do
+		[ -e "$BPF_FS_ROOT/$entry" ] && rm -f "$BPF_FS_ROOT/$entry"
+		[ -e "$AW_BPF_PIN_DIR/$entry" ] && rm -f "$AW_BPF_PIN_DIR/$entry"
+		[ -e "$AW_BPF_LEGACY_PIN_DIR/$entry" ] && rm -f "$AW_BPF_LEGACY_PIN_DIR/$entry"
+	done
+}
+
+load_bpf_resources() {
+	echo "Loading BPF resources..." >&2
+	mkdir -p "$AW_BPF_PIN_DIR" 2>/dev/null || true
+
+	cleanup_aw_bpf_pins
+	resolve_lan_ifaces
+
+	if [ -z "$AW_BPF_LAN_IFACES" ]; then
+		echo "No valid interfaces found from network.lan" >&2
+		return 1
+	fi
+
+	for iface in $AW_BPF_LAN_IFACES; do
+		attach_tc_programs "$iface" || return 1
+	done
+
+	load_dns_bpf_program
+
+	return 0
+}
+
+load_xdpi() {
+	if lsmod | grep -q xdpi; then
+		echo "xdpi module already loaded" >&2
+		return 0
+	fi
+
+	if command -v modprobe >/dev/null 2>&1; then
+		if modprobe xdpi_bpf 2>/dev/null || modprobe xdpi-bpf 2>/dev/null; then
+			echo "xdpi module loaded via modprobe" >&2
+			return 0
+		fi
+	fi
+
+	for modfile in /lib/modules/$(uname -r)/xdpi_bpf.ko /lib/modules/$(uname -r)/xdpi-bpf.ko /lib/modules/$(uname -r)/extra/xdpi_bpf.ko /lib/modules/$(uname -r)/extra/xdpi-bpf.ko /lib/xdpi_bpf.ko /lib/xdpi-bpf.ko; do
+		if [ -f "$modfile" ]; then
+			insmod "$modfile" 2>/dev/null && echo "xdpi module loaded via insmod $modfile" >&2 && return 0 || true
+		fi
+	done
+
+	echo "Warning: xdpi module not found or failed to load" >&2
+	return 1
+}
+
+load_dns_bpf_program() {
+	local dns_bpf_file="/lib/bpf/dns-bpf.o"
+	local xdp_pin_base="/sys/fs/bpf/aw"
+
+	if [ ! -f "$dns_bpf_file" ]; then
+		echo "dns-bpf.o not found at $dns_bpf_file" >&2
+		return 0
+	fi
+
+	mkdir -p "$xdp_pin_base" 2>/dev/null || true
+
+	resolve_wan_ifaces
+	if [ -z "$AW_BPF_WAN_IFACES" ]; then
+		echo "No valid WAN interfaces found. Skip loading DNS XDP." >&2
+		return 1
+	fi
+
+	for iface in $AW_BPF_WAN_IFACES; do
+		echo "Attaching DNS XDP program to $iface..." >&2
+		ip link set dev "$iface" xdp off 2>/dev/null || true
+		if ! ip link set dev "$iface" xdp obj "$dns_bpf_file" sec xdp 2>/tmp/aw-bpf.xdp.err; then
+			echo "Failed to attach dns xdp to $iface: $(cat /tmp/aw-bpf.xdp.err 2>/dev/null)" >&2
+			rm -f /tmp/aw-bpf.xdp.err
+			return 1
+		fi
+		rm -f /tmp/aw-bpf.xdp.err
+	done
+
+	sleep 1
+
+	local xdp_prog_id=$(bpftool prog show name xdp_dns_monitor 2>/dev/null | head -n1 | cut -d':' -f1)
+		[ ! -e "$xdp_pin_base/dns_ringbuf" ] && bpftool map pin name dns_ringbuf "$xdp_pin_base/dns_ringbuf" 2>/dev/null
+		if [ ! -e "$xdp_pin_base/dns_ringbuf_portal" ]; then
+			bpftool map pin name dns_ringbuf_por "$xdp_pin_base/dns_ringbuf_portal" 2>/dev/null || \
+			bpftool map pin name dns_ringbuf_portal "$xdp_pin_base/dns_ringbuf_portal" 2>/dev/null
+		fi
+		[ ! -e "$xdp_pin_base/dns_stats_map" ] && bpftool map pin name dns_stats_map "$xdp_pin_base/dns_stats_map" 2>/dev/null
+
+	return 0
+}
+
+cleanup_bpf_resources() {
+	echo "Cleaning up global BPF resources..." >&2
+
+	resolve_lan_ifaces
+	for iface in $AW_BPF_LAN_IFACES; do
+		detach_tc_programs "$iface"
+	done
+	
+	resolve_wan_ifaces
+	for iface in $AW_BPF_WAN_IFACES; do
+		ip link set dev "$iface" xdp off 2>/dev/null || true
+	done
+
+	rm -rf /sys/fs/bpf/aw/dns_* 2>/dev/null
+	cleanup_aw_bpf_pins
+
+	return 0
+}
+
+unload_xdpi() {
+	if ! lsmod | grep -q xdpi; then
+		echo "xdpi module not loaded" >&2
+		return 0
+	fi
+
+	local rmmod_output
+	rmmod_output=$(rmmod xdpi_bpf 2>&1 || rmmod xdpi-bpf 2>&1)
+	local rmmod_status=$?
+
+	if [ $rmmod_status -ne 0 ]; then
+		echo "Note: Failed to unload xdpi module (may still be in use). Error: $rmmod_output" >&2
+		return 0
+	fi
+
+	if lsmod | grep -q xdpi; then
+		echo "Note: Module still loaded after rmmod attempt" >&2
+		return 0
+	fi
+
+	echo "xdpi module unloaded successfully" >&2
+	return 0
+}
+
+generate_conf() {
+	local enable_event_log
+	local location_id ap_device_id ap_mac_address ap_longitude ap_latitude
+
+	config_load "aw-bpf"
+	config_get enable_event_log "common" enable_event_log "0"
+	config_get location_id "common" location_id ""
+	config_get ap_device_id "common" ap_device_id ""
+	config_get ap_mac_address "common" ap_mac_address ""
+	config_get ap_longitude "common" ap_longitude ""
+	config_get ap_latitude "common" ap_latitude ""
+
+	# Inherit location/device audit info from wifidogx if not explicitly set in aw-bpf
+	if [ -f "/etc/config/wifidogx" ]; then
+		local w_loc w_dev w_mac w_long w_lat
+		config_load "wifidogx"
+		config_get w_loc "common" location_id ""
+		config_get w_dev "common" ap_device_id ""
+		config_get w_mac "common" ap_mac_address ""
+		config_get w_long "common" ap_longitude ""
+		config_get w_lat "common" ap_latitude ""
+
+		[ -z "$location_id" ] && location_id="$w_loc"
+		[ -z "$ap_device_id" ] && ap_device_id="$w_dev"
+		[ -z "$ap_mac_address" ] && ap_mac_address="$w_mac"
+		[ -z "$ap_longitude" ] && ap_longitude="$w_long"
+		[ -z "$ap_latitude" ] && ap_latitude="$w_lat"
+	fi
+
+	[ -z "$location_id" ] && location_id="UNKNOWN"
+	[ -z "$ap_device_id" ] && ap_device_id="UNKNOWN"
+	[ -z "$ap_mac_address" ] && ap_mac_address="UNKNOWN"
+	[ -z "$ap_longitude" ] && ap_longitude="0.000000"
+	[ -z "$ap_latitude" ] && ap_latitude="0.000000"
+
+	mkdir -p /var/etc
+	cat > "$CONF_FILE" <<EOF
+# Generated automatically by /etc/init.d/aw-bpf from UCI
+enable_event_log=${enable_event_log}
+location_id=${location_id}
+ap_device_id=${ap_device_id}
+ap_mac_address=${ap_mac_address}
+ap_longitude=${ap_longitude}
+ap_latitude=${ap_latitude}
+EOF
+}
+
+start_service() {
+	load_xdpi
+	load_bpf_resources
+
+	if ! command -v "$PROG" >/dev/null 2>&1; then
+		echo "aw-eventd binary not found" >&2
+		return 1
+	fi
+
+	generate_conf
+
+	echo "Starting aw-bpf service (aw-eventd)..." >&2
+	procd_open_instance
+	procd_set_param command "$PROG" -c "$CONF_FILE"
+	procd_set_param respawn 3600 5 0
+	procd_set_param file "$CONF_FILE"
+	procd_close_instance
+}
+
+stop_service() {
+	echo "Stopping aw-bpf service..." >&2
+	cleanup_bpf_resources
+	unload_xdpi
+	echo "aw-bpf cleanup completed" >&2
+}
+
+service_triggers() {
+	procd_add_reload_trigger "aw-bpf"
+}
+
+reload_service() {
+	restart
+}

baidudrive/Makefile

@@ -10,8 +10,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_BAIDUDRIVE:=$(ARCH)
 
 PKG_NAME:=baidudrive
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=19
+PKG_VERSION:=1.0.6
+PKG_RELEASE:=21
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/baidudrive-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

dae/Makefile

@@ -6,9 +6,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dae
 PKG_VERSION:=2026.09.06
-PKG_RELEASE:=42
+PKG_RELEASE:=43
 
-PKG_SOURCE:=dae-src-2026.09.06-bb80d29edd0f.tar.gz
+PKG_SOURCE:=dae-src-2026.09.06-80525dabf966.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/dae-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_HASH:=skip

daed/Makefile

@@ -6,9 +6,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=daed
 PKG_VERSION:=2026.09.06
-PKG_RELEASE:=53
+PKG_RELEASE:=54
 
-PKG_SOURCE:=daed-src-2026.09.06-00979296e45e.tar.gz
+PKG_SOURCE:=daed-src-2026.09.06-62f2e24ac52a.tar.gz
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-daede/releases/download/daed-src
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_HASH:=skip

dockermanager/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_DOCKERMANAGER:=$(ARCH)
 
 PKG_NAME:=dockermanager
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=5
+PKG_VERSION:=0.1.1
+PKG_RELEASE:=7
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/dockermanager-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

frp/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=frp
 PKG_VERSION:=0.71.0
-PKG_RELEASE:=6
+PKG_RELEASE:=9
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v$(PKG_VERSION)?

frp/files/frpc.config

@@ -1,4 +1,5 @@
 config init
+	option enabled '0'
 	option stdout '1'
 	option stderr '1'
 #	Uncomment to run frpc as an existing user/group. Keep disabled by

frp/files/frpc.init

@@ -912,6 +912,7 @@ service_triggers() {
 
 start_service() {
 	local init_cfg=
+	local enabled=0
 	local stdout=1
 	local stderr=1
 	local respawn=1
@@ -919,14 +920,19 @@ start_service() {
 	local run_group=
 	local old_umask
 
-	mkdir -p /var/etc
-	_TOML_ERR=0
-	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
-
 	config_load "$NAME"
 
 	config_foreach _find_init_section init
 
+	if [ -n "$init_cfg" ]; then
+		config_get_bool enabled "$init_cfg" enabled 0
+	fi
+	[ "$enabled" -eq 1 ] || return 0
+
+	mkdir -p /var/etc
+	_TOML_ERR=0
+	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
+
 	old_umask="$(umask)"
 	umask 077
 	: > "$CONF_FILE" || {
@@ -950,6 +956,7 @@ start_service() {
 
 	if [ -n "$init_cfg" ]; then
 		config_list_foreach "$init_cfg" conf_inc _append_conf_file
+		[ "$_TOML_ERR" = "0" ] || return 1
 
 		config_get_bool stdout "$init_cfg" stdout 1
 		config_get_bool stderr "$init_cfg" stderr 1

frp/files/frpc.uci-defaults

@@ -79,6 +79,7 @@ upgrade_init() {
 		changed=1
 	fi
 
+	set_if_empty "$init_section" enabled 1
 	set_if_empty "$init_section" stdout 1
 	set_if_empty "$init_section" stderr 1
 	set_if_empty "$init_section" respawn 1

frp/files/frps.config

@@ -1,4 +1,5 @@
 config init
+	option enabled '0'
 	option stdout '1'
 	option stderr '1'
 #	Uncomment to run frps as an existing user/group. Keep disabled by

frp/files/frps.init

@@ -689,6 +689,7 @@ service_triggers() {
 
 start_service() {
 	local init_cfg=
+	local enabled=0
 	local stdout=1
 	local stderr=1
 	local respawn=1
@@ -696,14 +697,19 @@ start_service() {
 	local run_group=
 	local old_umask
 
-	mkdir -p /var/etc
-	_TOML_ERR=0
-	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
-
 	config_load "$NAME"
 
 	config_foreach _find_init_section init
 
+	if [ -n "$init_cfg" ]; then
+		config_get_bool enabled "$init_cfg" enabled 0
+	fi
+	[ "$enabled" -eq 1 ] || return 0
+
+	mkdir -p /var/etc
+	_TOML_ERR=0
+	_ALLOW_UNSAFE_TOKEN_SOURCE_EXEC=0
+
 	old_umask="$(umask)"
 	umask 077
 	: > "$CONF_FILE" || {
@@ -727,6 +733,7 @@ start_service() {
 
 	if [ -n "$init_cfg" ]; then
 		config_list_foreach "$init_cfg" conf_inc _append_conf_file
+		[ "$_TOML_ERR" = "0" ] || return 1
 
 		config_get_bool stdout "$init_cfg" stdout 1
 		config_get_bool stderr "$init_cfg" stderr 1

frp/files/frps.uci-defaults

@@ -90,6 +90,7 @@ upgrade_init() {
 		changed=1
 	fi
 
+	set_if_empty "$init_section" enabled 1
 	set_if_empty "$init_section" stdout 1
 	set_if_empty "$init_section" stderr 1
 	set_if_empty "$init_section" respawn 1

glorytun/Makefile

@@ -9,7 +9,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=glorytun
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=95fa5ead2154adb546bcdb454c56c876e9f60bb5
 PKG_SOURCE:=glorytun-$(PKG_VERSION).tar.gz
@@ -50,13 +50,10 @@ endef
 define Package/$(PKG_NAME)/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/glorytun $(1)/usr/sbin/$(PKG_NAME)
-	$(INSTALL_BIN) files/glorytun-irq-affinity.sh $(1)/usr/sbin/glorytun-irq-affinity.sh
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) init $(1)/etc/init.d/$(PKG_NAME)
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DATA) glorytun.config $(1)/etc/config/glorytun
-	$(INSTALL_DIR) $(1)/etc/glorytun
-	$(INSTALL_DATA) files/glorytun-sysctl.conf $(1)/etc/glorytun/glorytun-sysctl.conf
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))

glorytun/files/glorytun-irq-affinity.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-
-# Set IRQ affinity for glorytun interfaces
-set_irq_affinity() {
-    local irq=$1
-    local cpu=$2
-    local mask=$(printf "%x" $((1 << $cpu)))
-    
-    echo "Setting IRQ $irq to CPU $cpu (mask: $mask)"
-    echo $mask > /proc/irq/$irq/smp_affinity
-}
-
-# Get interface IRQs
-get_interface_irqs() {
-    local interface=$1
-    grep -E "$interface" /proc/interrupts | awk '{print $1}' | tr -d ':'
-}
-
-# Main function
-setup_irq_affinity() {
-    # Get available CPU cores
-    local cpu_count=$(grep -c processor /proc/cpuinfo)
-    echo "Available CPU cores: $cpu_count"
-    
-    # Determine tun interface
-    local tun_interface=$(ip link | grep tun | awk -F': ' '{print $2}' | head -n1)
-    if [ -z "$tun_interface" ]; then
-        echo "No tun interface found"
-        return 1
-    fi
-    
-    echo "Found tun interface: $tun_interface"
-    
-    # Get IRQs for tun interface
-    local irqs=$(get_interface_irqs $tun_interface)
-    if [ -z "$irqs" ]; then
-        echo "No IRQs found for $tun_interface"
-        return 1
-    fi
-    
-    # Distribute IRQs across available cores (except CPU0)
-    local cpu=1
-    for irq in $irqs; do
-        set_irq_affinity $irq $cpu
-        cpu=$(( (cpu + 1) % cpu_count ))
-        if [ $cpu -eq 0 ]; then
-            cpu=1
-        fi
-    done
-    
-    # Set RPS (Receive Packet Steering) for better packet distribution
-    if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_cpus ]; then
-        # Calculate mask for all CPUs except CPU0
-        local rps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
-        echo "Setting RPS mask to $rps_mask for $tun_interface"
-        echo $rps_mask > /sys/class/net/$tun_interface/queues/rx-0/rps_cpus
-    fi
-    
-    # Set RFS (Receive Flow Steering) limits if available
-    if [ -e /proc/sys/net/core/rps_sock_flow_entries ]; then
-        echo 32768 > /proc/sys/net/core/rps_sock_flow_entries
-        if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt ]; then
-            echo 32768 > /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt
-        fi
-    fi
-    
-    # Set XPS (Transmit Packet Steering) if available
-    if [ -e /sys/class/net/$tun_interface/queues/tx-0/xps_cpus ]; then
-        # Use all CPUs except CPU0 for transmit
-        local xps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
-        echo "Setting XPS mask to $xps_mask for $tun_interface"
-        echo $xps_mask > /sys/class/net/$tun_interface/queues/tx-0/xps_cpus
-    fi
-    
-    # Increase network queue length for better performance
-    if [ -e /sys/class/net/$tun_interface/tx_queue_len ]; then
-        echo 1000 > /sys/class/net/$tun_interface/tx_queue_len
-    fi
-    
-    echo "IRQ affinity setup completed for $tun_interface"
-}
-
-# Run the main function
-setup_irq_affinity
-
-exit 0 

glorytun/files/glorytun-sysctl.conf

@@ -1,27 +0,0 @@
-# Glorytun-specific optimizations
-# Note: These settings complement the system-wide sysctl parameters
-
-# Buffer size optimization for glorytun tunnels
-# Increase only if not already set in system configuration
-net.core.rmem_max = 16777216
-net.core.wmem_max = 16777216
-net.core.optmem_max = 16777216
-
-# Enable BBR congestion control for better tunnel performance
-net.core.default_qdisc = fq
-
-# RPS/RFS settings for tunnel interfaces
-# These are critical for multicore performance with glorytun
-net.core.rps_sock_flow_entries = 32768
-
-# Network device tuning for tunnel interfaces
-net.core.netdev_max_backlog = 10000
-net.core.netdev_budget = 600
-net.core.netdev_budget_usecs = 10000
-
-# Lower TCP timeout for faster recovery of tunnel connections
-net.ipv4.tcp_keepalive_intvl = 10
-net.ipv4.tcp_keepalive_probes = 6
-
-# Disable slow start after idle for more consistent tunnel performance
-net.ipv4.tcp_slow_start_after_idle = 0 

glorytun/glorytun.config

@@ -11,6 +11,5 @@ config glorytun 'vpn'
 	option localip '10.255.255.2'
 	option remoteip '10.255.255.1'
 	option multiqueue '1'
-	option cpu_affinity '1'
 	option label 'Default VPN'
 	option timeout '10000'

glorytun/init

@@ -18,14 +18,6 @@ _err() {
 	logger -p daemon.err -t ${PROG_NAME} "$@"
 }
 
-# Apply system optimizations
-apply_sysctl_optimizations() {
-	if [ -f /etc/glorytun/glorytun-sysctl.conf ]; then
-		_log "Applying system optimizations"
-		sysctl -q -p /etc/glorytun/glorytun-sysctl.conf
-	fi
-}
-
 validate_section() {
 	uci_validate_section glorytun glorytun "${1}" \
 		'enable:bool:0'      \
@@ -38,50 +30,13 @@ validate_section() {
 		'timeout:uinteger:10000'         \
 		'chacha20:bool:0'    \
 		'multiqueue:bool:1'  \
-		'cpu_affinity:bool:1' \
 		'proto:string' \
 		'localip:string' \
 		'remoteip:string'
 }
 
-# New function for CPU core optimization
-optimize_cpu_cores() {
-	local dev="$1"
-	local multiqueue="$2"
-	local cpu_affinity="$3"
-	
-	if [ "$cpu_affinity" = "1" ]; then
-		_log "Setting up CPU affinity for $dev"
-		if [ -x /usr/sbin/glorytun-irq-affinity.sh ]; then
-			/usr/sbin/glorytun-irq-affinity.sh
-		fi
-	fi
-	
-	if [ "$multiqueue" = "1" ]; then
-		_log "Enabling multiqueue for $dev"
-		
-		# Get CPU count
-		local cpu_count=$(grep -c processor /proc/cpuinfo)
-		if [ "$cpu_count" -gt 1 ]; then
-			# Use half of available CPUs but at least 2
-			local queue_count=$(( cpu_count / 2 ))
-			[ "$queue_count" -lt 2 ] && queue_count=2
-			
-			# Set multiqueue parameters
-			ip link set dev "$dev" multiqueue on
-			
-			# Increase buffer sizes for better performance
-			if [ -e /proc/sys/net/core/rmem_max ]; then
-				echo 16777216 > /proc/sys/net/core/rmem_max
-				echo 16777216 > /proc/sys/net/core/wmem_max
-				echo 16777216 > /proc/sys/net/core/optmem_max
-			fi
-		fi
-	fi
-}
-
 start_instance() {
-	local enable key host port dev mptcp proto chacha20 mode multiqueue cpu_affinity timeout localip remoteip
+	local enable key host port dev mptcp proto chacha20 mode multiqueue timeout localip remoteip
 	local key_dir="/var/run/${PROG_NAME}"
 	local key_file="${key_dir}/${1}.key"
 
@@ -91,9 +46,6 @@ start_instance() {
 	}
 
 	[ "${enable}" = "1" ] || return 1
-
-	apply_sysctl_optimizations
-
 	[ "${proto}" = "tcp" ] || return 1
 	[ -n "${key}" ] || {
 		_err "Key empty"
@@ -148,16 +100,14 @@ start_instance() {
 
 	procd_close_instance
 
-	# Apply CPU optimizations after the instance is started
-	optimize_cpu_cores "$dev" "$multiqueue" "$cpu_affinity"
-	
-	# Configure interface IP addresses
+	# Configure the tunnel addresses once glorytun has created the device.
+	# RPS/XPS steering for it is set by /etc/hotplug.d/net/20-rps-xps
+	# (openmptcprouter package), which handles every interface.
 	if [ -n "$localip" ] && [ -n "$remoteip" ]; then
 	(
-                        # Wait for device to be created
-                        local count=0
+		count=0
 		while [ $count -lt 10 ]; do
-                                if ip link show "$dev" >/dev/null 2>&1; then
+			if [ -d "/sys/class/net/$dev" ]; then
 				ifconfig "$dev" "$localip" pointopoint "$remoteip" up && \
 					_log "Configured $dev with IP $localip peer $remoteip"
 				break

istoreenhance/Makefile

@@ -11,8 +11,8 @@ PKG_ARCH_ISTOREENHANCE:=$(ARCH)
 
 PKG_NAME:=istoreenhance
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
-PKG_SOURCE_DATE:=0.7.17
-PKG_RELEASE:=7
+PKG_SOURCE_DATE:=0.8.0
+PKG_RELEASE:=8
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
 ARCH_HEXCODE=8664

kaiplus/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_kaiplus:=$(ARCH)
 
 PKG_NAME:=kaiplus
-PKG_VERSION:=linkeasefull-runtime-v3.0.17
-PKG_RELEASE:=9
+PKG_VERSION:=1.0.7
+PKG_RELEASE:=11
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/kaiplus-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip

kaiplus/files/kaiplus-plugin.json

@@ -11,7 +11,8 @@
   },
   "standalone": {
     "entry": "index.html",
-    "basePath": "/apps/kaiplus/"
+    "basePath": "/apps/kaiplus/",
+    "url": "/apps/kaiplus/"
   },
   "config": {
     "providerOrder": ["uci"],

kaiplus/files/kaiplus.config

@@ -8,3 +8,4 @@ config kaiplus
 	option 'bind_addr' '0.0.0.0'
 	option 'base_path' '/apps/kaiplus/'
 	option 'system_role' 'istoreos'
+	option 'auth_mode' 'disabled'

kaiplus/files/kaiplus.init

@@ -13,6 +13,7 @@ get_config() {
 	config_get bind_addr "$1" bind_addr "0.0.0.0"
 	config_get base_path "$1" base_path "/apps/kaiplus/"
 	config_get system_role "$1" system_role "istoreos"
+	config_get auth_mode "$1" auth_mode "disabled"
 }
 
 mkdir_p() {
@@ -58,6 +59,8 @@ start_service() {
 		procd_set_param env \
 			KAIPLUS_HOME="$data_dir" \
 			KAIPLUS_SYSTEM_ROLE="$system_role" \
+			KAIPLUS_AUTH_MODE="$auth_mode" \
+			LINKEASE_AUTH_PROVIDER="$auth_mode" \
 			KAIPLUS_LISTEN_MODE="tcp" \
 			KAIPLUS_WORKSPACE_HELPER_DIR="/usr/share/kaiplus/helpers" \
 			KAIPLUS_WORKSPACE_TOOL_INSTALL_DIR="/tmp/kaiplus_workspace_tool" \
@@ -68,6 +71,8 @@ start_service() {
 		procd_set_param env \
 			KAIPLUS_HOME="$data_dir" \
 			KAIPLUS_SYSTEM_ROLE="$system_role" \
+			KAIPLUS_AUTH_MODE="$auth_mode" \
+			LINKEASE_AUTH_PROVIDER="$auth_mode" \
 			KAIPLUS_LISTEN_MODE="unix" \
 			KAIPLUS_SOCKET_PATH="$socket_path" \
 			KAIPLUS_WORKSPACE_HELPER_DIR="/usr/share/kaiplus/helpers" \

linkease-common-bin/Makefile

@@ -12,7 +12,7 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 PKG_NAME:=linkease-common-bin
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
 PKG_SOURCE_DATE:=1.7.5
-PKG_RELEASE:=25
+PKG_RELEASE:=29
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -28,7 +28,7 @@ else ifeq ($(ARCH),mipsel)
 ARCH_HEXCODE=1b0c
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=af4346ed87096bc76261ca089d336e3724731806
 PKG_SOURCE:=linkease-common-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkease-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-common-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE)

linkease/Makefile

@@ -12,7 +12,7 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 PKG_NAME:=linkease
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
 PKG_SOURCE_DATE:=1.7.5
-PKG_RELEASE:=28
+PKG_RELEASE:=32
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -28,7 +28,7 @@ else ifeq ($(ARCH),mipsel)
 ARCH_HEXCODE=1b0c
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=af4346ed87096bc76261ca089d336e3724731806
 PKG_SOURCE:=linkease-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkease-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-bin-$(PKG_SOURCE_DATE)-linux-$(PKG_ARCH_LINKEASE)

linkeasefull/Makefile

@@ -10,8 +10,8 @@ PKG_ARCH_LINKEASE:=$(ARCH)
 
 PKG_NAME:=linkeasefull
 # use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
-PKG_SOURCE_DATE:=3.0.17
-PKG_RELEASE:=27
+PKG_SOURCE_DATE:=3.0.19
+PKG_RELEASE:=31
 
 ARCH_HEXCODE:=
 ifeq ($(ARCH),x86_64)
@@ -24,7 +24,7 @@ LINKEASE_RUNTIME_ARCH:=arm64
 PKG_HASH:=skip
 endif
 
-PKG_SOURCE_VERSION:=7093bc8b705b7b239b8adde8e4d89928157de456
+PKG_SOURCE_VERSION:=af4346ed87096bc76261ca089d336e3724731806
 PKG_SOURCE:=linkease-runtime-$(PKG_SOURCE_DATE)-linux-$(LINKEASE_RUNTIME_ARCH).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/linkeasefull-runtime-v$(PKG_SOURCE_DATE)/
 PKG_BUILD_DIR:=$(BUILD_DIR)/linkease-runtime-$(PKG_SOURCE_DATE)-linux-$(LINKEASE_RUNTIME_ARCH)

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx.js

@@ -30,219 +30,6 @@ var callGetWanMac = rpc.declare({
 	expect: { result: {} }
 });
 
-// Generate Device ID: AW + 7 random digits + 12-char MAC (total 21 chars)
-function generateDeviceId(macAddress) {
-	var macPart = macAddress.replace(/-/g, ''); // Remove hyphens from MAC
-	var randomPart = '';
-	for (var i = 0; i < 7; i++) {
-		randomPart += Math.floor(Math.random() * 10);
-	}
-	return 'AW' + randomPart + macPart;
-}
-
-// Generate Location ID: 14 digits (AAAAAABBBCCCCC)
-// AAAAAA: Administrative division code (GB/T 2260) - using Beijing as default (110101)
-// BBB: Service type (100 for commercial internet service locations, positions 7-9)
-// CCCCC: 5-digit random sequence number (positions 10-14)
-function generateLocationId() {
-	var adminCode = '110101'; // Default to Beijing Dongcheng District (positions 1-6)
-	var serviceType = '100'; // Commercial internet service location (positions 7-9)
-	var sequenceNum = '';
-
-	// Generate 5-digit random sequence number (positions 10-14)
-	for (var i = 0; i < 5; i++) {
-		sequenceNum += Math.floor(Math.random() * 10);
-	}
-
-	return adminCode + serviceType + sequenceNum; // 6 + 3 + 5 = 14 digits
-}
-
-// Auto-fill helper functions
-function showAutoFillModal() {
-	ui.showModal(_('Auto Fill'), [
-		E('div', { 'class': 'cbi-section' }, [
-			E('div', { 'class': 'cbi-section-descr' }, _('Getting device information and location data, please wait...')),
-			E('div', { 'id': 'auto-fill-progress' }, [
-				E('ul', { 'style': 'margin: 10px 0;' }, [
-					E('li', { 'id': 'mac-status' }, _('Getting WAN MAC address...')),
-					E('li', { 'id': 'device-id-status' }, _('Generating Device ID...')),
-					E('li', { 'id': 'location-id-status' }, _('Generating Location ID...')),
-					E('li', { 'id': 'location-status' }, _('Getting location coordinates...'))
-				])
-			])
-		])
-	]);
-}
-
-function updateMacStatus(macAddr, isSuccess, errorMsg, isFallback) {
-	var statusElement = document.getElementById('mac-status');
-	if (isSuccess) {
-		var prefix = isFallback ? _('✓ WAN MAC address obtained (fallback): ') : _('✓ WAN MAC address obtained: ');
-		var suffix = isFallback ? '' : _(' (interface: ') + arguments[4] + _(')');
-		statusElement.innerHTML = prefix + macAddr + suffix;
-	} else {
-		statusElement.innerHTML = _('✗ Failed to get WAN MAC address: ') + (errorMsg || _('Unknown error'));
-	}
-}
-
-function generateAndUpdateIds(macAddr) {
-	var deviceId = generateDeviceId(macAddr);
-	var locationId = generateLocationId();
-
-	document.getElementById('device-id-status').innerHTML = _('✓ Device ID generated: ') + deviceId;
-	document.getElementById('location-id-status').innerHTML = _('✓ Location ID generated: ') + locationId;
-
-	return { deviceId: deviceId, locationId: locationId };
-}
-
-function getMacAddressPromise(results) {
-	return callGetWanMac().then(function (response) {
-		if (response && response.status === 'success') {
-			var macAddr = response.mac.toUpperCase().replace(/:/g, '-');
-			results.macAddress = macAddr;
-			updateMacStatus(macAddr, true, null, false, response.interface);
-
-			var ids = generateAndUpdateIds(macAddr);
-			results.deviceId = ids.deviceId;
-			results.locationId = ids.locationId;
-		} else {
-			return getMacAddressFallback(results);
-		}
-	}).catch(function (error) {
-		return getMacAddressFallback(results);
-	});
-}
-
-function getMacAddressFallback(results) {
-	document.getElementById('mac-status').innerHTML = _('RPC failed, trying fallback...');
-
-	return fs.exec('/bin/sh', ['-c', 'ip route | grep default | awk \'{print $5}\' | head -n1 | xargs -I {} cat /sys/class/net/{}/address 2>/dev/null || echo "failed"']).then(function (response) {
-		if (response.code === 0 && response.stdout && response.stdout.trim() !== 'failed') {
-			var macAddr = response.stdout.trim().toUpperCase().replace(/:/g, '-');
-			results.macAddress = macAddr;
-			updateMacStatus(macAddr, true, null, true);
-
-			var ids = generateAndUpdateIds(macAddr);
-			results.deviceId = ids.deviceId;
-			results.locationId = ids.locationId;
-		} else {
-			updateMacStatus(null, false, _('Unknown error'));
-			document.getElementById('device-id-status').innerHTML = _('✗ Cannot generate Device ID without MAC address');
-		}
-	}).catch(function (error) {
-		updateMacStatus(null, false, error.message);
-		document.getElementById('device-id-status').innerHTML = _('✗ Cannot generate Device ID due to MAC error');
-	});
-}
-
-function formatCoordinate(coord) {
-	var num = parseFloat(coord).toFixed(6);
-	if (num >= 0) {
-		return num.padStart(10, '0');
-	} else {
-		return '-' + Math.abs(num).toFixed(6).padStart(9, '0');
-	}
-}
-
-function getLocationPromise(results) {
-	return callGetLocation().then(function (response) {
-		if (response && response.status === 'success') {
-			var lat = formatCoordinate(response.lat);
-			var lon = formatCoordinate(response.lon);
-
-			results.longitude = lon;
-			results.latitude = lat;
-			document.getElementById('location-status').innerHTML = _('✓ Location obtained: ') + lat + ', ' + lon;
-		} else {
-			var errorMsg = (response && response.message) ? response.message : _('Unknown error');
-			document.getElementById('location-status').innerHTML = _('✗ Failed to get location: ') + errorMsg;
-		}
-	}).catch(function (error) {
-		return getLocationFallback(results);
-	});
-}
-
-function getLocationFallback(results) {
-	document.getElementById('location-status').innerHTML = _('RPC failed, trying direct method...');
-
-	return fs.exec('/bin/sh', ['-c', 'curl -s --connect-timeout 10 --max-time 30 "https://ipapi.co/json" 2>/dev/null || curl -s --connect-timeout 10 --max-time 30 "http://ipinfo.io/json" 2>/dev/null || echo "failed"']).then(function (response) {
-		if (response.code === 0 && response.stdout && response.stdout.trim() !== 'failed') {
-			try {
-				var data = JSON.parse(response.stdout);
-				var lat, lon;
-
-				if (data.latitude && data.longitude) {
-					lat = formatCoordinate(data.latitude);
-					lon = formatCoordinate(data.longitude);
-				} else if (data.loc) {
-					var coords = data.loc.split(',');
-					lat = formatCoordinate(coords[0]);
-					lon = formatCoordinate(coords[1]);
-				}
-
-				if (lat && lon) {
-					results.longitude = lon;
-					results.latitude = lat;
-					document.getElementById('location-status').innerHTML = _('✓ Location obtained (fallback): ') + lat + ', ' + lon;
-				} else {
-					document.getElementById('location-status').innerHTML = _('✗ No valid coordinates found');
-				}
-			} catch (e) {
-				document.getElementById('location-status').innerHTML = _('✗ Failed to parse location data');
-			}
-		} else {
-			document.getElementById('location-status').innerHTML = _('✗ Failed to get location data');
-		}
-	}).catch(function (fallbackError) {
-		document.getElementById('location-status').innerHTML = _('✗ Error getting location: ') + fallbackError.message;
-	});
-}
-
-function fillFormFields(results) {
-	var successCount = 0;
-	var totalFields = 0;
-	var messages = [];
-	var fieldMappings = [
-		{ result: 'macAddress', selector: 'ap_mac_address', label: _('MAC Address: ') },
-		{ result: 'deviceId', selector: 'ap_device_id', label: _('Device ID: ') },
-		{ result: 'locationId', selector: 'location_id', label: _('Location ID: ') },
-		{ result: 'longitude', selector: 'ap_longitude', label: _('Longitude: ') },
-		{ result: 'latitude', selector: 'ap_latitude', label: _('Latitude: ') }
-	];
-
-	fieldMappings.forEach(function (mapping) {
-		if (results[mapping.result]) {
-			var field = document.querySelector('input[data-name="' + mapping.selector + '"]') ||
-				document.querySelector('input[name*="' + mapping.selector + '"]') ||
-				document.querySelector('input[id*="' + mapping.selector + '"]') ||
-				document.querySelector('#cbid\\.wifidogx\\.default\\.' + mapping.selector);
-
-			if (field) {
-				field.value = results[mapping.result];
-				field.dispatchEvent(new Event('input', { bubbles: true }));
-				field.dispatchEvent(new Event('change', { bubbles: true }));
-				successCount++;
-				messages.push(mapping.label + results[mapping.result]);
-			}
-			totalFields++;
-		}
-	});
-
-	return { successCount: successCount, totalFields: totalFields, messages: messages };
-}
-
-function showAutoFillResult(stats) {
-	ui.hideModal();
-
-	if (stats.successCount === stats.totalFields && stats.totalFields > 0) {
-		ui.addNotification(null, E('p', _('Auto fill completed successfully! All fields have been filled.') + '<br>' + stats.messages.join('<br>')), 'info');
-	} else if (stats.successCount > 0) {
-		ui.addNotification(null, E('p', _('Auto fill partially completed.') + ' ' + stats.successCount + '/' + stats.totalFields + ' ' + _('fields filled successfully.') + '<br>' + stats.messages.join('<br>')), 'warning');
-	} else {
-		ui.addNotification(null, E('p', _('Auto fill failed. No fields could be filled. Please check your network connection and try again.')), 'error');
-	}
-}
-
 function getServiceStatus() {
 	return L.resolveDefault(callServiceList('wifidogx'), {}).then(function (res) {
 		var isRunning = false;
@@ -253,6 +40,25 @@ function getServiceStatus() {
 	});
 }
 
+function generateDeviceId(macAddress) {
+	var macPart = macAddress.replace(/-/g, '');
+	var randomPart = '';
+	for (var i = 0; i < 7; i++) {
+		randomPart += Math.floor(Math.random() * 10);
+	}
+	return 'AW' + randomPart + macPart;
+}
+
+function generateLocationId() {
+	var adminCode = '110101';
+	var serviceType = '100';
+	var sequenceNum = '';
+	for (var i = 0; i < 5; i++) {
+		sequenceNum += Math.floor(Math.random() * 10);
+	}
+	return adminCode + serviceType + sequenceNum;
+}
+
 function renderStatus(isRunning) {
 	var renderHTML = "";
 	var spanTemp = '<em><span style="color:%s"><strong>%s %s</strong></span></em>';
@@ -284,7 +90,6 @@ return view.extend({
 		s.tab('gateway', _('Gateway Settings'));
 		s.tab('advanced', _('Advanced Settings'));
 		s.tab('rule', _('Rule Settings'));
-		s.tab('qos', _('QoS Settings'));
 		s.tab('location', _('Authentication Location Settings'));
 
 		// basic settings
@@ -368,7 +173,7 @@ return view.extend({
 		o = s.taboption('basic', form.Flag, 'disable_portal_auth', _('Disable Portal Authentication'),
 			_('When enabled, users can access the internet without portal authentication. Firewall redirect rules will not be created. Use this mode for pure traffic statistics without captive portal.'));
 		o.rmempty = false;
-		o.default = '1';
+		o.default = '0';
 
 		o = s.taboption('basic', form.ListValue, 'log_level', _('Log Level'),
 			_('The log level of the apfree-wifidog.'));
@@ -380,7 +185,7 @@ return view.extend({
 		o.value(2, _('Critical'));
 		o.value(1, _('Alert'));
 		o.value(0, _('Emergency'));
-		o.defaulValue = 0;
+		o.default = 0;
 		o.optional = false;
 
 		// gateway settings
@@ -392,7 +197,7 @@ return view.extend({
 		o = ss.option(form.Flag, 'gateway_auth_enabled', _('Auth Enabled'),
 			_('Enable the authentication of the gateway.'));
 		o.rmempty = false;
-		o.defaulValue = true;
+		o.default = true;
 
 		o = ss.option(widgets.DeviceSelect, 'gateway_name', _('Gateway Name'));
 		o.rmempty = false;
@@ -425,14 +230,14 @@ return view.extend({
 		o.datatype = 'uinteger';
 		o.rmempty = false;
 		o.optional = false;
-		o.defaulValue = 60;
+		o.default = 60;
 
 		o = s.taboption('advanced', form.Value, 'client_timeout', _('Client Timeout'),
 			_('The timeout of the client.'));
 		o.datatype = 'uinteger';
 		o.rmempty = false;
 		o.optional = false;
-		o.defaulValue = 5;
+		o.default = 5;
 
 		o = s.taboption('advanced', form.Flag, 'wired_passed', _('Wired Passed'),
 			_('Wired users do not need to authenticate to access the internet.'));
@@ -441,23 +246,30 @@ return view.extend({
 		o = s.taboption('advanced', form.Flag, 'apple_cna', _('Apple CNA'),
 			_('Enable Apple Captive Network Assistant.'));
 		o.rmempty = false;
-		o.defaulValue = false;
+		o.default = false;
 
 		o = s.taboption('advanced', form.Flag, 'js_filter', _('JS Filter'),
 			_('Enable JS redirect.'));
 		o.rmempty = false;
-		o.defaulValue = true;
+		o.default = true;
 
 		o = s.taboption('advanced', form.Flag, 'enable_anti_nat', _('Enable Anti NAT'),
 			_('Enable Anti NAT devices.'));
 		o.rmempty = false;
-		o.defaulValue = false;
+		o.default = false;
+
+		o = s.taboption('advanced', form.Value, 'privileged_ops_secret', _('Privileged Ops Secret'),
+			_('Local secret required for AWAS cloud platform to dynamically authorize remote OTA, reboot and system changes. Change this from the default on production devices.'));
+		o.password = true;
+		o.rmempty = false;
+		o.optional = false;
+		o.default = 'chawrt@2026';
 
 		o = s.taboption('advanced', form.Value, 'ttl_value', _('TTL Value'),
 			_('The TTL value of the gateway support.'));
 		o.datatype = 'string';
 		o.rmempty = false;
-		o.defaulValue = '64,128';
+		o.default = '64,128';
 		o.depends('enable_anti_nat', '1');
 
 		o = s.taboption('advanced', form.Value, 'anti_nat_permit_macs', _('Anti NAT Permit MAC'),
@@ -466,17 +278,87 @@ return view.extend({
 		o.rmempty = true;
 		o.depends('enable_anti_nat', '1');
 
-		o = s.taboption('advanced', form.Flag, 'enable_event_log', _('Enable Internet Access Log'),
-			_('Enable logging of internet access events and user activities.'));
-		o.rmempty = false;
-		o.defaulValue = false;
-
 		// Auth Server Settings
 		o = s.taboption('auth', form.SectionValue, '_auth', form.GridSection, 'auth');
 		ss = o.subsection;
 		ss.addremove = true;
 		ss.nodescriptions = true;
 
+		ss.handleAdd = function (ev, name) {
+			var self = this;
+			if (name) {
+				var longconnSections = uci.sections('wifidogx', 'longconn');
+				for (var i = 0; i < longconnSections.length; i++) {
+					if (longconnSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+				var authSections = uci.sections('wifidogx', 'auth');
+				for (var i = 0; i < authSections.length; i++) {
+					if (authSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+			}
+			return this.super('handleAdd', [ev, name]);
+		};
+
+		ss.handleRename = function (section_id, ev) {
+			var self = this;
+			var oldName = section_id;
+			var nameEl = E('input', {
+				'type': 'text',
+				'class': 'cbi-input-text',
+				'id': 'auth-rename-input',
+				'value': oldName,
+				'style': 'width: 100%;'
+			});
+			ui.showModal(_('Rename Authentication Server'), [
+				E('div', { 'class': 'cbi-section' }, [
+					E('div', { 'class': 'cbi-section-descr' }, _('Enter a new unique name for this authentication server profile.')),
+					E('div', { 'class': 'cbi-section-table' }, [
+						E('div', { 'class': 'tr' }, [
+							E('div', { 'class': 'td' }, _('Name')),
+							E('div', { 'class': 'td' }, [nameEl])
+						])
+					])
+				]),
+				E('div', { 'class': 'right' }, [
+					E('button', { 'class': 'btn', 'click': function () { ui.hideModal(); } }, _('Cancel')),
+					E('button', { 'class': 'btn cbi-button cbi-button-positive', 'click': function () {
+						var newName = nameEl.value.trim();
+						if (!newName) {
+							ui.addNotification(null, E('p', _('Please enter a name.')), 'error');
+							return;
+						}
+						if (newName === oldName) {
+							ui.hideModal();
+							return;
+						}
+						var longconnSections = uci.sections('wifidogx', 'longconn');
+						for (var i = 0; i < longconnSections.length; i++) {
+							if (longconnSections[i]['.name'] === newName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						var authSections = uci.sections('wifidogx', 'auth');
+						for (var i = 0; i < authSections.length; i++) {
+							if (authSections[i]['.name'] === newName && authSections[i]['.name'] !== oldName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						ui.hideModal();
+						uci.rename('wifidogx', section_id, newName);
+						self.map.save(null, true);
+					}}, _('Rename'))
+				])
+			]);
+		};
+
 		o = ss.option(form.Value, 'auth_server_hostname', _('Auth Server Hostname'),
 			_('The domain or IP address of the authentication server.'));
 		o.rmempty = false;
@@ -499,29 +381,6 @@ return view.extend({
 		o.optional = false;
 		o.default = '/wifidog/';
 
-
-		// QoS settings
-		o = s.taboption('qos', form.Flag, 'enable_qos', _('Enable Global QoS'),
-			_('Enable Global QoS.'));
-		o.rmempty = false;
-		o.defaulValue = false;
-
-		o = s.taboption('qos', form.Value, 'qos_up', _('Global QoS Up'),
-			_('The global QoS up value(Mbps).'));
-		o.datatype = 'uinteger';
-		o.rmempty = true;
-		o.optional = true;
-		o.defaulValue = 0;
-		o.depends('enable_qos', '1');
-
-		o = s.taboption('qos', form.Value, 'qos_down', _('Global QoS Down'),
-			_('The global QoS down value(Mbps).'));
-		o.datatype = 'uinteger';
-		o.rmempty = true;
-		o.optional = true;
-		o.defaulValue = 0;
-		o.depends('enable_qos', '1');
-
 		// Authentication Location Settings
 		// Add auto-fill button
 		o = s.taboption('location', form.Button, '_auto_fill', _('Auto Fill All Fields'),
@@ -544,11 +403,8 @@ return view.extend({
 				getLocationPromise(results)
 			];
 
-			// Wait for all promises to complete and fill form fields
 			Promise.all(promises).then(function () {
-				setTimeout(function () {
 				fillFormFields(results);
-				}, 2000);
 			});
 		};
 
@@ -583,10 +439,11 @@ return view.extend({
 					results.locationId = generateLocationId();
 					document.getElementById('location-id-status').innerHTML = _('✓ Location ID generated: ') + results.locationId;
 				} else {
+					document.getElementById('mac-status').innerHTML = _('RPC returned error, trying fallback...');
 					return getMacAddressFallback(results);
 				}
 			}).catch(function (error) {
-				document.getElementById('mac-status').innerHTML = _('✗ RPC call failed, trying fallback...');
+				document.getElementById('mac-status').innerHTML = _('RPC call failed, trying fallback...');
 				return getMacAddressFallback(results);
 			});
 		}
@@ -625,8 +482,8 @@ return view.extend({
 					formatAndSetCoordinates(results, lat, lon);
 					document.getElementById('location-status').innerHTML = _('✓ Location obtained: ') + results.latitude + ', ' + results.longitude;
 				} else {
-					var errorMsg = (response && response.message) ? response.message : 'Unknown error';
-					document.getElementById('location-status').innerHTML = _('✗ Failed to get location: ') + errorMsg;
+					document.getElementById('location-status').innerHTML = _('RPC returned error, trying fallback...');
+					return getLocationFallback(results);
 				}
 			}).catch(function (error) {
 				document.getElementById('location-status').innerHTML = _('RPC failed, trying direct method...');
@@ -741,8 +598,6 @@ return view.extend({
 		o.rmempty = false;
 		o.datatype = 'string';
 		o.optional = false;
-		o.depends('auth_server_mode', 'cloud');
-		o.depends('auth_server_mode', 'bypass');
 		o.placeholder = '110101100123456';
 		o.validate = function (section_id, value) {
 			if (!value || value === '')
@@ -766,7 +621,8 @@ return view.extend({
 
 			// Validate service type code (7-9 digits)
 			var serviceType = value.substring(6, 9);
-			if (serviceType !== '100' && serviceType !== '2' + value.charAt(7) + value.charAt(8) && serviceType !== '3' + value.charAt(7) + value.charAt(8)) {
+			var firstDigit = serviceType.charAt(0);
+			if (serviceType !== '100' && firstDigit !== '2' && firstDigit !== '3') {
 				return _('Service type code (7-9 digits) must be "100" for commercial internet service locations, "2XX" for non-commercial locations, or "3XX" for WiFi wireless collection terminals');
 			}
 
@@ -936,6 +792,81 @@ return view.extend({
 		ss.addremove = true;
 		ss.nodescriptions = true;
 
+		ss.handleAdd = function (ev, name) {
+			var self = this;
+			if (name) {
+				var authSections = uci.sections('wifidogx', 'auth');
+				for (var i = 0; i < authSections.length; i++) {
+					if (authSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+				var longconnSections = uci.sections('wifidogx', 'longconn');
+				for (var i = 0; i < longconnSections.length; i++) {
+					if (longconnSections[i]['.name'] === name) {
+						ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(name)), 'error');
+						return Promise.resolve();
+					}
+				}
+			}
+			return this.super('handleAdd', [ev, name]);
+		};
+
+		ss.handleRename = function (section_id, ev) {
+			var self = this;
+			var oldName = section_id;
+			var nameEl = E('input', {
+				'type': 'text',
+				'class': 'cbi-input-text',
+				'id': 'longconn-rename-input',
+				'value': oldName,
+				'style': 'width: 100%;'
+			});
+			ui.showModal(_('Rename Long Connection Profile'), [
+				E('div', { 'class': 'cbi-section' }, [
+					E('div', { 'class': 'cbi-section-descr' }, _('Enter a new unique name for this long connection profile.')),
+					E('div', { 'class': 'cbi-section-table' }, [
+						E('div', { 'class': 'tr' }, [
+							E('div', { 'class': 'td' }, _('Name')),
+							E('div', { 'class': 'td' }, [nameEl])
+						])
+					])
+				]),
+				E('div', { 'class': 'right' }, [
+					E('button', { 'class': 'btn', 'click': function () { ui.hideModal(); } }, _('Cancel')),
+					E('button', { 'class': 'btn cbi-button cbi-button-positive', 'click': function () {
+						var newName = nameEl.value.trim();
+						if (!newName) {
+							ui.addNotification(null, E('p', _('Please enter a name.')), 'error');
+							return;
+						}
+						if (newName === oldName) {
+							ui.hideModal();
+							return;
+						}
+						var authSections = uci.sections('wifidogx', 'auth');
+						for (var i = 0; i < authSections.length; i++) {
+							if (authSections[i]['.name'] === newName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Auth Server profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						var longconnSections = uci.sections('wifidogx', 'longconn');
+						for (var i = 0; i < longconnSections.length; i++) {
+							if (longconnSections[i]['.name'] === newName && longconnSections[i]['.name'] !== oldName) {
+								ui.addNotification(null, E('p', _('The name "%s" already exists in Long Connection profiles. Please choose a different name.').format(newName)), 'error');
+								return;
+							}
+						}
+						ui.hideModal();
+						uci.rename('wifidogx', section_id, newName);
+						self.map.save(null, true);
+					}}, _('Rename'))
+				])
+			]);
+		};
+
 		o = ss.option(form.ListValue, 'long_conn_mode', _('Connection Mode'),
 			_('The type of persistent connection to the remote management server.'));
 		o.value('ws', _('WebSocket (ws://)'));
@@ -1011,7 +942,7 @@ return view.extend({
 
 		// rule settings
 		o = s.taboption('rule', form.DynamicList, 'trusted_wildcard_domains', _('Trusted Wildcard Domains'),
-			_('The trusted wildcard domains of the gateway'));
+			_('Requires aw-bpf DNS XDP (dns_ringbuf_portal). Patterns like .example.com; resolved IPs are added to the captive portal firewall (inet wifidogx), not inet awbpf.'));
 		o.rmempty = true;
 		o.optional = true;
 		o.datatype = 'wildcard';
@@ -1025,7 +956,7 @@ return view.extend({
 		o.placeholder = 'www.example.com';
 
 		o = s.taboption('rule', form.DynamicList, 'trusted_macs', _('Trusted MACs'),
-			_('The trusted wildcard domains of the gateway.'));
+			_('The trusted MAC addresses of the gateway.'));
 		o.rmempty = true;
 		o.optional = true;
 		o.datatype = 'macaddr';

luci-app-apfree-wifidog/htdocs/luci-static/resources/view/wifidogx/status.js

@@ -266,14 +266,14 @@ return view.extend({
             }
         }
 
+        // Initial update
+        updateStatus();
+
         // Poll status every 5 seconds
         L.Poll.add(function() {
             return updateStatus();
         }, 5);
 
-        // Initial update
-        updateStatus();
-
         return container;
     },
 

luci-app-apfree-wifidog/po/zh_Hans/apfree-wifidog.po

@@ -15,6 +15,9 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
+msgid "Settings"
+msgstr "设置"
+
 msgid "apfree-wifidog"
 msgstr "门户认证"
 
@@ -165,6 +168,9 @@ msgstr "信任的通配符域名"
 msgid "The trusted wildcard domains of the gateway."
 msgstr "网关的信任通配符域名"
 
+msgid "Requires aw-bpf DNS XDP (dns_ringbuf_portal). Patterns like .example.com; resolved IPs are added to the captive portal firewall (inet wifidogx), not inet awbpf."
+msgstr "依赖 aw-bpf 的 DNS XDP（dns_ringbuf_portal）。格式如 .example.com；解析到的 IP 写入门户防火墙 inet wifidogx，不会写入 inet awbpf。"
+
 msgid "App White List"
 msgstr "应用白名单"
 
@@ -228,6 +234,12 @@ msgstr "启用防NAT"
 msgid "Enable Anti NAT devices."
 msgstr "启用防NAT设备"
 
+msgid "Privileged Ops Secret"
+msgstr "特权管控秘钥"
+
+msgid "Local secret required for AWAS cloud platform to dynamically authorize remote OTA, reboot and system changes. Change this from the default on production devices."
+msgstr "AWAS云端管理平台动态授权远程OTA升级、重启及系统配置变更所需的本地安全秘钥。生产环境请修改默认值。"
+
 msgid "TTL Value"
 msgstr "TTL值"
 
@@ -1093,3 +1105,48 @@ msgstr "MQTT认证的用户名。"
 msgid "The password for MQTT authentication."
 msgstr "MQTT认证的密码。"
 
+msgid "Add Authentication Server"
+msgstr "添加认证服务器"
+
+msgid "Enter a unique name for this authentication server profile."
+msgstr "请输入认证服务器配置文件的唯一名称。"
+
+msgid "Add Long Connection Profile"
+msgstr "添加长连接配置"
+
+msgid "Enter a unique name for this long connection profile."
+msgstr "请输入长连接配置文件的唯一名称。"
+
+msgid "Rename Authentication Server"
+msgstr "重命名认证服务器"
+
+msgid "Enter a new unique name for this authentication server profile."
+msgstr "请输入认证服务器配置文件的新名称。"
+
+msgid "Rename Long Connection Profile"
+msgstr "重命名长连接配置"
+
+msgid "Enter a new unique name for this long connection profile."
+msgstr "请输入长连接配置文件的新名称。"
+
+msgid "Please enter a name."
+msgstr "请输入名称。"
+
+msgid "The name \"%s\" already exists in Auth Server profiles. Please choose a different name."
+msgstr "名称\"%s\"已存在于认证服务器配置中，请选择其他名称。"
+
+msgid "The name \"%s\" already exists in Long Connection profiles. Please choose a different name."
+msgstr "名称\"%s\"已存在于长连接配置中，请选择其他名称。"
+
+msgid "Created new authentication server profile \"%s\"."
+msgstr "已创建新的认证服务器配置\"%s\"。"
+
+msgid "Created new long connection profile \"%s\"."
+msgstr "已创建新的长连接配置\"%s\"。"
+
+msgid "Renamed authentication server profile from \"%s\" to \"%s\"."
+msgstr "已将认证服务器配置从\"%s\"重命名为\"%s\"。"
+
+msgid "Renamed long connection profile from \"%s\" to \"%s\"."
+msgstr "已将长连接配置从\"%s\"重命名为\"%s\"。"
+

luci-app-apfree-wifidog/root/usr/libexec/rpcd/luci.wifidogx

@@ -70,7 +70,7 @@ case "$1" in
 					json_init
 					json_add_object "result"
 					json_add_string "status" "fail"
-					json_add_string "message" "WAN interface not found. Available interfaces: $(ls /sys/class/net/ | tr '\n' ' ')"
+					json_add_string "message" "WAN interface not found"
 					json_close_object
 					json_dump
 				fi

luci-app-apfree-wifidog/root/usr/share/luci/menu.d/luci-app-apfree-wifidog.json

@@ -3,56 +3,27 @@
 		"title": "apfree-wifidog",
 		"order": 1,
 		"action": {
-			"type": "view",
-			"path": "wifidogx"
+			"type": "firstchild",
+			"recurse": true
 		},
 		"depends": {
 			"acl": [ "luci-app-apfree-wifidog" ]
 		}
 	},
-	"admin/QoS": {
-		"title": "QoS",
-		"order": 20,
-		"action": {
-			"type": "firstchild",
-			"recurse": true
-		}
-	},
-	"admin/QoS/wifidogx": {
-		"title": "Auth User",
-		"order": 2,
-		"action": {
-			"type": "alias",
-			"path": "admin/QoS/wifidogx/display"
-		},
-		"depends": {
-			"acl": [
-				"luci-app-apfree-wifidog"
-			]
-		}
-	},
-	"admin/QoS/wifidogx/display": {
-		"title": "Display",
+	"admin/services/wifidogx/config": {
+		"title": "Settings",
 		"order": 10,
 		"action": {
 			"type": "view",
-			"path": "wifidogx/display"
+			"path": "wifidogx"
 		}
 	},
-	"admin/QoS/wifidogx/status": {
+	"admin/services/wifidogx/status": {
 		"title": "Status",
 		"order": 20,
 		"action": {
 			"type": "view",
 			"path": "wifidogx/status"
 		}
-	},
-	"admin/QoS/xdpi": {
-		"title": "L7 application",
-		"order": 30,
-		"action": {
-			"type": "view",
-			"path": "xdpi/l7"
-		}
 	}
 }

luci-app-apfree-wifidog/root/usr/share/rpcd/acl.d/luci-app-apfree-wifidog.json

@@ -8,14 +8,12 @@
 			},
 			"file": {
 				"/etc/init.d/wifidogx": [ "exec" ],
-				"/usr/bin/wdctlx": [ "exec" ],
-				"/usr/bin/aw-bpfctl": [ "exec" ],
-				"/usr/bin/awk": [ "exec" ]
+				"/usr/bin/wdctlx": [ "exec" ]
 			},
-			"uci": ["wifidogx", "hostnames", "network"]
+			"uci": ["wifidogx", "network"]
 		},
 		"write": {
-			"uci": ["wifidogx", "hostnames"],
+			"uci": ["wifidogx"],
 			"file": {
 				"/etc/wifidogx/*": [ "write" ]
 			}

luci-app-aw-bpf/LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

luci-app-aw-bpf/Makefile

@@ -2,8 +2,8 @@
 
 include $(TOPDIR)/rules.mk
 
-LUCI_TITLE:=LuCI Support for yt-dlp
-LUCI_DEPENDS:=+yt-dlp
+LUCI_TITLE:=LuCI Support for aw-bpf traffic control
+LUCI_DEPENDS:=+aw-bpf +luci-lib-echarts
 
 PKG_LICENSE:=Apache-2.0
 PKG_MAINTAINER:=Dengfeng Liu <liudf0716@gmail.com>

luci-app-aw-bpf/htdocs/luci-static/resources/view/aw-bpf.css

@@ -1,33 +1,88 @@
-#chartjs-tooltip {
-	opacity: 0;
-	position: absolute;
-	background: rgba(0, 0, 0, .7);
-	color: white;
-	padding: 3px;
-	border-radius: 3px;
-	transition: all .1s ease;
-	pointer-events: none;
-	transform: translate(-50%, 0);
-	z-index: 20000;
+/* Theme tokens: follow LuCI bootstrap vars, Argon, or JS-set data-aw-theme */
+.l7-view-container,
+.display-view-container {
+	--aw-card-bg: var(--background-color-medium, var(--background-color, #f9f9f9));
+	--aw-card-border: var(--border-color-medium, #e0e0e0);
+	--aw-chart-bg: var(--background-color-high, #ffffff);
+	--aw-text: var(--text-color-highest, var(--text-color-high, #333333));
+	--aw-text-muted: var(--text-color-medium, #666666);
+	--aw-accent: var(--primary-color-high, var(--primary, #3771c8));
+	--aw-hover: var(--background-color-low, #f0f0f0);
+	--aw-error-bg: #ffefef;
+	--aw-error-fg: #c62828;
+	--aw-dl: #28a745;
+	--aw-ul: #007bff;
+	--aw-vol-dl: #17a2b8;
+	--aw-vol-ul: #6610f2;
+	--aw-pkt: #6c757d;
 }
 
-#chartjs-tooltip.above {
-	transform: translate(-50%, -100%);
+@media (prefers-color-scheme: dark) {
+	.l7-view-container:not([data-aw-theme="light"]),
+	.display-view-container:not([data-aw-theme="light"]) {
+		--aw-card-bg: #2a2a2a;
+		--aw-card-border: #3c3c3c;
+		--aw-chart-bg: #252526;
+		--aw-text: #cccccc;
+		--aw-text-muted: #adb5bd;
+		--aw-accent: #a5b2ff;
+		--aw-hover: #333333;
+		--aw-error-bg: #3a1f1f;
+		--aw-error-fg: #ff8a80;
+		--aw-dl: #5dd879;
+		--aw-ul: #6eb6ff;
+		--aw-vol-dl: #4ecbd8;
+		--aw-vol-ul: #b794f6;
+		--aw-pkt: #adb5bd;
+	}
 }
 
-#chartjs-tooltip.above:before {
-	border: solid;
-	border-color: #111 transparent;
-	border-color: rgba(0, 0, 0, .8) transparent;
-	border-width: 8px 8px 0 8px;
-	bottom: 1em;
-	content: "";
-	display: block;
-	left: 50%;
-	top: 100%;
-	position: absolute;
-	z-index: 99;
-	transform: translate(-50%, 0);
+[data-darkmode="true"] .l7-view-container,
+[data-darkmode="true"] .display-view-container,
+.l7-view-container[data-aw-theme="dark"],
+.display-view-container[data-aw-theme="dark"] {
+	--aw-card-bg: #2a2a2a;
+	--aw-card-border: #3c3c3c;
+	--aw-chart-bg: #252526;
+	--aw-text: #cccccc;
+	--aw-text-muted: #adb5bd;
+	--aw-accent: #a5b2ff;
+	--aw-hover: #333333;
+	--aw-error-bg: #3a1f1f;
+	--aw-error-fg: #ff8a80;
+	--aw-dl: #5dd879;
+	--aw-ul: #6eb6ff;
+	--aw-vol-dl: #4ecbd8;
+	--aw-vol-ul: #b794f6;
+	--aw-pkt: #adb5bd;
+}
+
+[data-darkmode="false"] .l7-view-container,
+[data-darkmode="false"] .display-view-container,
+.l7-view-container[data-aw-theme="light"],
+.display-view-container[data-aw-theme="light"] {
+	--aw-card-bg: #f9f9f9;
+	--aw-card-border: #e0e0e0;
+	--aw-chart-bg: #ffffff;
+	--aw-text: #333333;
+	--aw-text-muted: #666666;
+	--aw-accent: #3771c8;
+	--aw-hover: #f0f0f0;
+	--aw-error-bg: #ffefef;
+	--aw-error-fg: #c62828;
+	--aw-dl: #28a745;
+	--aw-ul: #007bff;
+	--aw-vol-dl: #17a2b8;
+	--aw-vol-ul: #6610f2;
+	--aw-pkt: #6c757d;
+}
+
+.aw-inner-tabs {
+	margin-top: 4px;
+}
+
+.aw-inner-tabs > .cbi-tabmenu {
+	margin-bottom: 12px;
 }
 
 .pie label {
@@ -125,7 +180,7 @@
 	flex: 0 0 120px;       /* 不伸缩、不收缩、基础宽度120px */
 	text-align: right;
 	font-weight: bold;
-	color: #333;
+	color: var(--aw-text, #333);
 }
 
 .th-sort-asc::after {
@@ -141,20 +196,20 @@
 }
 
 .table .th:hover {
-	background-color: #f0f0f0;
+	background-color: var(--aw-hover, #f0f0f0);
 }
 
 /* L7 View Specific Styles */
-.l7-view-container #l7-error-message { color: red; background-color: #ffefef; border: 1px solid red; padding: 10px; margin-bottom: 10px; display: none; }
+.l7-view-container #l7-error-message { color: var(--aw-error-fg, red); background-color: var(--aw-error-bg, #ffefef); border: 1px solid var(--aw-error-fg, red); padding: 10px; margin-bottom: 10px; display: none; }
 .l7-view-container .dashboard-container { display: flex; flex-direction: column; gap: 20px; margin-bottom: 20px; }
 .l7-view-container .line-chart-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(400px, 1fr)); gap: 20px; }
 .l7-view-container .kpi-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 20px; }
-.l7-view-container .kpi-card { background-color: #f9f9f9; border-radius: 8px; padding: 15px; text-align: center; border: 1px solid #e0e0e0; }
-.l7-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: #3771c8; }
-.l7-view-container .kpi-card-label { font-size: 0.9em; color: #666; }
+.l7-view-container .kpi-card { background-color: var(--aw-card-bg, #f9f9f9); border-radius: 8px; padding: 15px; text-align: center; border: 1px solid var(--aw-card-border, #e0e0e0); }
+.l7-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: var(--aw-accent, #3771c8); }
+.l7-view-container .kpi-card-label { font-size: 0.9em; color: var(--aw-text-muted, #666); }
 .l7-view-container .chart-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 20px; }
-.l7-view-container .chart-card { background-color: #ffffff; border-radius: 8px; padding: 20px; border: 1px solid #e0e0e0; }
-.l7-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; }
+.l7-view-container .chart-card { background-color: var(--aw-chart-bg, #ffffff); border-radius: 8px; padding: 20px; border: 1px solid var(--aw-card-border, #e0e0e0); }
+.l7-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; color: var(--aw-text, inherit); }
 .l7-view-container .l7-controls { 
 	display: flex; 
 	justify-content: space-between; 
@@ -175,12 +230,12 @@
 /* Display View Specific Styles */
 .display-view-container .dashboard-container { display: flex; flex-direction: column; gap: 20px; margin-bottom: 20px; }
 .display-view-container .kpi-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 20px; }
-.display-view-container .kpi-card { background-color: #f9f9f9; border-radius: 8px; padding: 15px; text-align: center; border: 1px solid #e0e0e0; }
-.display-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: #3771c8; }
-.display-view-container .kpi-card-label { font-size: 0.9em; color: #666; }
+.display-view-container .kpi-card { background-color: var(--aw-card-bg, #f9f9f9); border-radius: 8px; padding: 15px; text-align: center; border: 1px solid var(--aw-card-border, #e0e0e0); }
+.display-view-container .kpi-card big { display: block; font-size: 1.8em; font-weight: bold; color: var(--aw-accent, #3771c8); }
+.display-view-container .kpi-card-label { font-size: 0.9em; color: var(--aw-text-muted, #666); }
 .display-view-container .chart-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 20px; }
-.display-view-container .chart-card { background-color: #ffffff; border-radius: 8px; padding: 20px; border: 1px solid #e0e0e0; }
-.display-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; }
+.display-view-container .chart-card { background-color: var(--aw-chart-bg, #ffffff); border-radius: 8px; padding: 20px; border: 1px solid var(--aw-card-border, #e0e0e0); }
+.display-view-container .chart-card h4 { margin-top: 0; margin-bottom: 15px; text-align: center; font-size: 1.1em; color: var(--aw-text, inherit); }
 .display-view-container .display-controls { 
 	display: flex; 
 	justify-content: space-between; 
@@ -362,11 +417,11 @@
 }
 
 .speed-cell.download {
-	color: #28a745;
+	color: var(--aw-dl, #28a745);
 }
 
 .speed-cell.upload {
-	color: #007bff;
+	color: var(--aw-ul, #007bff);
 }
 
 .volume-cell {
@@ -378,11 +433,11 @@
 }
 
 .volume-cell.download {
-	color: #17a2b8;
+	color: var(--aw-vol-dl, #17a2b8);
 }
 
 .volume-cell.upload {
-	color: #6610f2;
+	color: var(--aw-vol-ul, #6610f2);
 }
 
 .packet-cell {
@@ -390,7 +445,7 @@
 	align-items: center;
 	justify-content: flex-end;
 	gap: 4px;
-	color: #6c757d;
+	color: var(--aw-pkt, #6c757d);
 	min-width: 80px;
 }
 
@@ -485,7 +540,7 @@
 
 /* Table Row Hover Effects */
 .table .tr:not(.table-titles):not(.placeholder):hover {
-	background-color: #f8f9fa;
+	background-color: var(--aw-hover, #f8f9fa);
 	transition: background-color 0.2s ease;
 }
 

luci-app-aw-bpf/htdocs/luci-static/resources/view/aw-bpf/display.js

@@ -41,6 +41,78 @@ function hexToRgba(hex, opacity) {
 		null;
 };
 
+function isDarkMode() {
+	var attr = document.documentElement.getAttribute('data-darkmode');
+	if (attr === 'true')
+		return true;
+	if (attr === 'false')
+		return false;
+
+	var bg = getComputedStyle(document.body).backgroundColor;
+	var m = bg && bg.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)/);
+	if (m) {
+		var lum = (0.299 * m[1] + 0.587 * m[2] + 0.114 * m[3]) / 255;
+		return lum < 0.5;
+	}
+
+	return window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
+}
+
+function getChartColors() {
+	var dark = isDarkMode();
+	return {
+		background: 'transparent',
+		text: dark ? '#cccccc' : '#333333',
+		muted: dark ? '#adb5bd' : '#666666',
+		axis: dark ? 'rgba(255,255,255,0.28)' : 'rgba(0,0,0,0.25)',
+		split: dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.08)',
+		pieBorder: dark ? '#252526' : '#ffffff',
+		tooltipBg: dark ? 'rgba(32,32,32,0.94)' : 'rgba(255,255,255,0.95)',
+		tooltipBorder: dark ? '#555555' : '#cccccc',
+		tooltipText: dark ? '#eeeeee' : '#333333'
+	};
+}
+
+function applyViewTheme() {
+	var theme = isDarkMode() ? 'dark' : 'light';
+	document.querySelectorAll('.l7-view-container, .display-view-container').forEach(function(el) {
+		el.setAttribute('data-aw-theme', theme);
+	});
+	return theme;
+}
+
+function observeChartEl(chart, el) {
+	if (!chart || !el || !window.ResizeObserver || el._awRo)
+		return;
+	el._awRo = new ResizeObserver(function() {
+		chart.resize();
+	});
+	el._awRo.observe(el);
+}
+
+function chartAxisTheme(colors) {
+	return {
+		backgroundColor: colors.background,
+		textStyle: { color: colors.text },
+		legend: { textStyle: { color: colors.text } },
+		tooltip: {
+			backgroundColor: colors.tooltipBg,
+			borderColor: colors.tooltipBorder,
+			textStyle: { color: colors.tooltipText }
+		},
+		xAxis: {
+			axisLine: { lineStyle: { color: colors.axis } },
+			axisLabel: { color: colors.muted },
+			splitLine: { show: false }
+		},
+		yAxis: {
+			axisLine: { lineStyle: { color: colors.axis } },
+			axisLabel: { color: colors.muted },
+			splitLine: { lineStyle: { color: colors.split } }
+		}
+	};
+}
+
 return view.extend({
 	// --- Core Data Logic from display.js ---
 
@@ -127,6 +199,41 @@ return view.extend({
 		}, this), 5);
 	},
 
+	resizeAllCharts: function() {
+		['ipv4', 'ipv6', 'mac'].forEach(function(type) {
+			if (downloadLineChart[type])
+				downloadLineChart[type].resize();
+			if (uploadLineChart[type])
+				uploadLineChart[type].resize();
+		});
+		Object.keys(chartRegistry).forEach(function(chartId) {
+			if (chartRegistry[chartId])
+				chartRegistry[chartId].resize();
+		});
+	},
+
+	bindTabChartResize: function(root) {
+		var self = this;
+		if (!root)
+			return;
+		var host = root.parentNode || root;
+		if (host._awTabResizeBound)
+			return;
+		host._awTabResizeBound = true;
+
+		var schedule = function() {
+			setTimeout(function() { self.resizeAllCharts(); }, 80);
+		};
+
+		host.addEventListener('click', function(ev) {
+			if (ev.target.closest && ev.target.closest('ul.cbi-tabmenu'))
+				schedule();
+		});
+		root.querySelectorAll('[data-tab]').forEach(function(pane) {
+			pane.addEventListener('cbi-tab-active', schedule);
+		});
+	},
+
 	// --- UI Rendering and Interaction (New structure based on l7.js) ---
 
 	pie: function(id, data, valueFormatter) {
@@ -144,9 +251,15 @@ return view.extend({
 			}
 		});
 
+		var colors = getChartColors();
 		var option = {
+			backgroundColor: colors.background,
+			textStyle: { color: colors.text },
 			tooltip: {
 				trigger: 'item',
+				backgroundColor: colors.tooltipBg,
+				borderColor: colors.tooltipBorder,
+				textStyle: { color: colors.tooltipText },
 				formatter: function(params) {
 					if (valueFormatter) {
 						// 将 ECharts params 对象转换为自定义格式
@@ -164,9 +277,9 @@ return view.extend({
 				radius: ['25%', '80%'],
 				avoidLabelOverlap: false,
 				padAngle: 10,
-				itemStyle: { borderRadius: 10, borderColor: '#fff', borderWidth: 2 },
-				label: { show: false, position: 'center' },
-				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold' } },
+				itemStyle: { borderRadius: 10, borderColor: colors.pieBorder, borderWidth: 2 },
+				label: { show: false, position: 'center', color: colors.text },
+				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold', color: colors.text } },
 				labelLine: { show: false },
 				data: data.map(function(d) {
 					return { value: d.value, name: d.label || d.name, itemStyle: { color: d.color } };
@@ -177,6 +290,7 @@ return view.extend({
 		var dom = typeof id === 'string' ? document.getElementById(id) : id;
 		if (!chartRegistry[id]) {
 			chartRegistry[id] = echarts.init(dom);
+			observeChartEl(chartRegistry[id], dom);
 		}
 		chartRegistry[id].setOption(option, true);
 		return chartRegistry[id];
@@ -230,9 +344,10 @@ return view.extend({
 
 		var legendData = downloadChartSeries.map(function(s) { return s.name; });
 
+		var colors = getChartColors();
 		if (downloadLineChart[type]) {
 			downloadLineChart[type].setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
+				legend: { data: legendData, type: 'scroll', top: 0, left: 'center', textStyle: { color: colors.text } },
 				series: downloadChartSeries,
 				xAxis: { data: lineCategories[type] }
 			});
@@ -240,7 +355,7 @@ return view.extend({
 
 		if (uploadLineChart[type]) {
 			uploadLineChart[type].setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
+				legend: { data: legendData, type: 'scroll', top: 0, left: 'center', textStyle: { color: colors.text } },
 				series: uploadChartSeries,
 				xAxis: { data: lineCategories[type] }
 			});
@@ -498,15 +613,21 @@ return view.extend({
 	},
 
 	initializeUI: function() {
+		applyViewTheme();
 		if (window.echarts) {
 			var self = this;
+			var colors = getChartColors();
+			var axisTheme = chartAxisTheme(colors);
 			['ipv4', 'ipv6', 'mac'].forEach(function(type) {
 				var dlChartEl = document.getElementById(type + '-download-speed-line-chart');
 				var ulChartEl = document.getElementById(type + '-upload-speed-line-chart');
 				if (!dlChartEl || !ulChartEl) return;
 
 				var baseChartOption = {
-					tooltip: {
+					backgroundColor: axisTheme.backgroundColor,
+					textStyle: axisTheme.textStyle,
+					legend: axisTheme.legend,
+					tooltip: Object.assign({
 						trigger: 'axis',
 						formatter: function (params) {
 							if (!params || params.length === 0) {
@@ -521,18 +642,32 @@ return view.extend({
 							});
 							return tooltipContent;
 						}
-					},
+					}, axisTheme.tooltip),
 					grid: { left: '3%', right: '4%', bottom: '10%', top: '50px', containLabel: true },
-					xAxis: { type: 'category', boundaryGap: false, data: lineCategories[type] },
-					yAxis: { type: 'value', axisLabel: { formatter: function(val) { return '%1024.2mBps'.format(val); } } },
+					xAxis: {
+						type: 'category',
+						boundaryGap: false,
+						data: lineCategories[type],
+						axisLine: axisTheme.xAxis.axisLine,
+						axisLabel: axisTheme.xAxis.axisLabel,
+						splitLine: axisTheme.xAxis.splitLine
+					},
+					yAxis: {
+						type: 'value',
+						axisLine: axisTheme.yAxis.axisLine,
+						splitLine: axisTheme.yAxis.splitLine,
+						axisLabel: { formatter: function(val) { return '%1024.2mBps'.format(val); }, color: colors.muted }
+					},
 					series: []
 				};
 
 				downloadLineChart[type] = echarts.init(dlChartEl);
 				downloadLineChart[type].setOption(baseChartOption);
+				observeChartEl(downloadLineChart[type], dlChartEl);
 
 				uploadLineChart[type] = echarts.init(ulChartEl);
 				uploadLineChart[type].setOption(baseChartOption);
+				observeChartEl(uploadLineChart[type], ulChartEl);
 			});
 
 			// 添加窗口大小变化监听器，使图表能够响应式调整
@@ -544,21 +679,7 @@ return view.extend({
 						clearTimeout(resizeTimer);
 					}
 					resizeTimer = setTimeout(function() {
-						// 调整折线图大小
-						['ipv4', 'ipv6', 'mac'].forEach(function(type) {
-							if (downloadLineChart[type]) {
-								downloadLineChart[type].resize();
-							}
-							if (uploadLineChart[type]) {
-								uploadLineChart[type].resize();
-							}
-						});
-						// 调整饼图大小
-						Object.keys(chartRegistry).forEach(function(chartId) {
-							if (chartRegistry[chartId]) {
-								chartRegistry[chartId].resize();
-							}
-						});
+						self.resizeAllCharts();
 					}, 200);
 				};
 				
@@ -578,8 +699,16 @@ return view.extend({
 		var self = this;
 
 		const createTab = (type, title, placeholder) => {
-			return E('div', { 'class': 'cbi-section', 'data-tab': type, 'data-tab-title': _(title) }, [
+			var innerTabs = E('div', { 'class': 'aw-inner-tabs' }, [
+				E('div', { 'class': 'cbi-section', 'data-tab': type + '-trend', 'data-tab-title': _('Speed Trend') }, [
 					E('div', { 'class': 'dashboard-container' }, [
+						E('div', { 'class': 'kpi-row' }, [
+							E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-host-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Hosts')) ]),
+							E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
+							E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
+							E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
+							E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
+						]),
 						E('div', { 'class': 'line-chart-row' }, [
 							E('div', { 'class': 'chart-card' }, [
 								E('h4', [_('Real-time Download Speed')]),
@@ -589,21 +718,20 @@ return view.extend({
 								E('h4', [_('Real-time Upload Speed')]),
 								E('div', { id: type + '-upload-speed-line-chart', style: 'width: 100%; height: 350px;' })
 							])
+						])
+					])
 				]),
-					E('div', { 'class': 'kpi-row' }, [
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-host-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Hosts')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: type + '-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
-					]),
+				E('div', { 'class': 'cbi-section', 'data-tab': type + '-share', 'data-tab-title': _('Traffic Share') }, [
+					E('div', { 'class': 'dashboard-container' }, [
 						E('div', { 'class': 'chart-grid' }, [
 							E('div', { 'class': 'chart-card' }, [ E('h4', [_('Download Speed / Host')]), E('div', { id: type + '-tx-rate-pie', style: 'width:100%; height:300px;' }) ]),
 							E('div', { 'class': 'chart-card' }, [ E('h4', [_('Upload Speed / Host')]), E('div', { id: type + '-rx-rate-pie', style: 'width:100%; height:300px;' }) ]),
 							E('div', { 'class': 'chart-card' }, [ E('h4', [_('Download Total')]), E('div', { id: type + '-tx-volume-pie', style: 'width:100%; height:300px;' }) ]),
 							E('div', { 'class': 'chart-card' }, [ E('h4', [_('Upload Total')]), E('div', { id: type + '-rx-volume-pie', style: 'width:100%; height:300px;' }) ])
 						])
+					])
 				]),
+				E('div', { 'class': 'cbi-section', 'data-tab': type + '-hosts', 'data-tab-title': _('Host List') }, [
 					E('table', { 'class': 'table', 'id': type + '-speed-data' }, [
 						E('tr', { 'class': 'tr table-titles' }, [
 							E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🖥️'), ' ', _('Host') ]),
@@ -619,6 +747,11 @@ return view.extend({
 						E('tr', { 'class': 'tr placeholder' }, [ E('td', { 'class': 'td', 'colspan': '9' }, [ E('em', { 'class': 'spinning' }, [ _('Collecting data...') ]) ]) ])
 					]),
 					self.createAddControls(type, placeholder)
+				])
+			]);
+
+			return E('div', { 'class': 'cbi-section', 'data-tab': type, 'data-tab-title': _(title) }, [
+				innerTabs
 			]);
 		};
 
@@ -629,15 +762,19 @@ return view.extend({
 		]);
 
 		var node = E([], [
-		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/wifidogx.css') }),
+		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/aw-bpf.css') }),
 		    E('script', { 'type': 'text/javascript', 'src': L.resource('echarts.min.js') }),
-		    E('div', { 'class': 'l7-view-container' }, [
-		        E('h2', [ _('Auth User Speed Monitor') ]),
+		    E('div', { 'class': 'l7-view-container', 'data-aw-theme': isDarkMode() ? 'dark' : 'light' }, [
+		        E('h2', [ _('Host Speed Monitor') ]),
 		        tabContainer
 		    ])
 		]);
 
+		tabContainer.querySelectorAll('.aw-inner-tabs').forEach(function(inner) {
+			ui.tabs.initTabGroup(inner.childNodes);
+		});
 		ui.tabs.initTabGroup(tabContainer.childNodes);
+		this.bindTabChartResize(tabContainer);
 
 		setTimeout(() => this.initializeUI(), 0);
 

luci-app-aw-bpf/htdocs/luci-static/resources/view/aw-bpf/l7.js

@@ -27,6 +27,7 @@ var isPaused = false;
 var lastUpdated = null;
 var pollActive = false;
 var lastSIDData = null;
+var lastL7ProtoData = null;
 var resizeListenerAdded = false;
 var resizeTimer = null;
 
@@ -43,14 +44,154 @@ function hexToRgba(hex, opacity) {
 		null;
 };
 
+function isDarkMode() {
+	var attr = document.documentElement.getAttribute('data-darkmode');
+	if (attr === 'true')
+		return true;
+	if (attr === 'false')
+		return false;
+
+	var bg = getComputedStyle(document.body).backgroundColor;
+	var m = bg && bg.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)/);
+	if (m) {
+		var lum = (0.299 * m[1] + 0.587 * m[2] + 0.114 * m[3]) / 255;
+		return lum < 0.5;
+	}
+
+	return window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
+}
+
+function getChartColors() {
+	var dark = isDarkMode();
+	return {
+		background: 'transparent',
+		text: dark ? '#cccccc' : '#333333',
+		muted: dark ? '#adb5bd' : '#666666',
+		axis: dark ? 'rgba(255,255,255,0.28)' : 'rgba(0,0,0,0.25)',
+		split: dark ? 'rgba(255,255,255,0.08)' : 'rgba(0,0,0,0.08)',
+		pieBorder: dark ? '#252526' : '#ffffff',
+		tooltipBg: dark ? 'rgba(32,32,32,0.94)' : 'rgba(255,255,255,0.95)',
+		tooltipBorder: dark ? '#555555' : '#cccccc',
+		tooltipText: dark ? '#eeeeee' : '#333333'
+	};
+}
+
+function applyViewTheme() {
+	var theme = isDarkMode() ? 'dark' : 'light';
+	document.querySelectorAll('.l7-view-container, .display-view-container').forEach(function(el) {
+		el.setAttribute('data-aw-theme', theme);
+	});
+	return theme;
+}
+
+function observeChartEl(chart, el) {
+	if (!chart || !el || !window.ResizeObserver || el._awRo)
+		return;
+	el._awRo = new ResizeObserver(function() {
+		chart.resize();
+	});
+	el._awRo.observe(el);
+}
+
+function chartAxisTheme(colors) {
+	return {
+		backgroundColor: colors.background,
+		textStyle: { color: colors.text },
+		legend: { textStyle: { color: colors.text } },
+		tooltip: {
+			backgroundColor: colors.tooltipBg,
+			borderColor: colors.tooltipBorder,
+			textStyle: { color: colors.tooltipText }
+		},
+		xAxis: {
+			axisLine: { lineStyle: { color: colors.axis } },
+			axisLabel: { color: colors.muted },
+			splitLine: { show: false }
+		},
+		yAxis: {
+			axisLine: { lineStyle: { color: colors.axis } },
+			axisLabel: { color: colors.muted },
+			splitLine: { lineStyle: { color: colors.split } }
+		}
+	};
+}
+
 return view.extend({
+	hasXdns: false,
+	xdnsDomains: {},
+
 	load: function() {
 		return Promise.all([
 			this.loadSIDData(),
-			this.loadL7ProtoData()
+			this.loadL7ProtoData(),
+			this.checkXdnsStatus()
 		]);
 	},
 
+	checkXdnsStatus: function() {
+		var self = this;
+		return fs.stat('/usr/bin/xdns-ctl').then(function(stat) {
+			if (stat && stat.type === 'file') {
+				self.hasXdns = true;
+				return fs.read_direct('/etc/xdns/whitelist.txt').then(function(content) {
+					var domains = {};
+					if (content) {
+						content.split('\n').forEach(function(line) {
+							line = line.trim();
+							if (!line || line.charAt(0) === '#') return;
+							if (line.indexOf('*.') === 0) line = line.substring(2);
+							if (line.charAt(0) === '.') line = line.substring(1);
+							domains[line.toLowerCase()] = true;
+						});
+					}
+					self.xdnsDomains = domains;
+					return true;
+				}).catch(function() {
+					self.xdnsDomains = {};
+					return true;
+				});
+			} else {
+				self.hasXdns = false;
+				return false;
+			}
+		}).catch(function() {
+			self.hasXdns = false;
+			return false;
+		});
+	},
+
+	isDomainProxied: function(dName) {
+		if (!dName || !this.xdnsDomains) return false;
+		dName = dName.toLowerCase();
+		if (this.xdnsDomains[dName]) return true;
+		var parts = dName.split('.');
+		for (var i = 1; i < parts.length - 1; i++) {
+			var parent = parts.slice(i).join('.');
+			if (this.xdnsDomains[parent]) return true;
+		}
+		return false;
+	},
+
+	handleAddXdnsDomain: function(domain, btn) {
+		var self = this;
+		if (!domain) return;
+		btn.disabled = true;
+		var origText = btn.textContent;
+		btn.textContent = _('添加中...');
+
+		fs.exec_direct('/usr/bin/xdns-ctl', ['add-domain', domain]).then(function() {
+			self.xdnsDomains[domain.toLowerCase()] = true;
+			ui.addNotification(null, E('p', _('域名「%s」已成功加入 xdns-bpf 代理名单并即刻生效！').format(domain)), 'info');
+			if (lastL7ProtoData) {
+				self.renderL7ProtoData(lastL7ProtoData);
+			}
+		}).catch(function(err) {
+			btn.disabled = false;
+			btn.textContent = origText;
+			ui.addNotification(null, E('p', _('加入代理名单失败: %s').format(err.message || err)), 'error');
+		});
+	},
+
 	showError: function(message) {
 		var errorEl = document.getElementById('l7-error-message');
 		if (errorEl) {
@@ -138,10 +279,11 @@ return view.extend({
 		var uploadChartSeries = processChartData(uploadSeriesData, perServiceUpload);
 	
 		var legendData = downloadChartSeries.map(function(s) { return s.name; });
+		var colors = getChartColors();
 
 		if (downloadLineChart) {
 			downloadLineChart.setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
+				legend: { data: legendData, type: 'scroll', top: 0, left: 'center', textStyle: { color: colors.text } },
 				series: downloadChartSeries,
 				xAxis: { data: lineCategories }
 			});
@@ -149,7 +291,7 @@ return view.extend({
 	
 		if (uploadLineChart) {
 			uploadLineChart.setOption({
-				legend: { data: legendData, type: 'scroll', top: 0, left: 'center' },
+				legend: { data: legendData, type: 'scroll', top: 0, left: 'center', textStyle: { color: colors.text } },
 				series: uploadChartSeries,
 				xAxis: { data: lineCategories }
 			});
@@ -172,9 +314,15 @@ return view.extend({
 			}
 		});
 
+		var colors = getChartColors();
 		var option = {
+			backgroundColor: colors.background,
+			textStyle: { color: colors.text },
 			tooltip: {
 				trigger: 'item',
+				backgroundColor: colors.tooltipBg,
+				borderColor: colors.tooltipBorder,
+				textStyle: { color: colors.tooltipText },
 				formatter: function(params) {
 					if (valueFormatter) {
 						// 将 ECharts params 对象转换为自定义格式
@@ -192,9 +340,9 @@ return view.extend({
 				radius: ['25%', '80%'],
 				avoidLabelOverlap: false,
 				padAngle: 10,
-				itemStyle: { borderRadius: 10, borderColor: '#fff', borderWidth: 2 },
-				label: { show: false, position: 'center' },
-				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold' } },
+				itemStyle: { borderRadius: 10, borderColor: colors.pieBorder, borderWidth: 2 },
+				label: { show: false, position: 'center', color: colors.text },
+				emphasis: { label: { show: true, fontSize: 14, fontWeight: 'bold', color: colors.text } },
 				labelLine: { show: false },
 				data: data.map(function(d) {
 					return { value: d.value, name: d.label || d.name, itemStyle: { color: d.color } };
@@ -206,6 +354,7 @@ return view.extend({
 
 		if (!chartRegistry[id]) {
 			chartRegistry[id] = echarts.init(dom);
+			observeChartEl(chartRegistry[id], dom);
 		}
 
 		chartRegistry[id].setOption(option, true);
@@ -351,7 +500,7 @@ return view.extend({
 		this.updateStackedLineCharts(perServiceTxRate, perServiceRxRate);
 
 		var table = document.getElementById('sid-data');
-		cbi_update_table('#sid-data', rows, E('em', _('No data recorded yet.')));
+		cbi_update_table(table, rows, E('em', _('No data recorded yet.')));
 
 		var headers = table.querySelectorAll('th');
 		
@@ -399,54 +548,110 @@ return view.extend({
 		}
 	},
 
-	renderL7ProtoData: function(data) {
-		var rows = [];
+	fillSortableTable: function(tableId, rows) {
+		var table = document.getElementById(tableId);
 		var self = this;
-		
-		sidLookupTable = {};
-		
-		if (data && data.status === 'success' && data.data) {
-			if (Array.isArray(data.data.protocols)) {
-				data.data.protocols.forEach(function(item) {
-					sidLookupTable[item.sid] = { type: 'protocol', name: item.protocol };
-					rows.push([
-						E('span', { 'class': 'id-cell' }, item.id),
-						E('span', { 'class': 'protocol-cell' }, [
-							E('span', { 'class': 'protocol-icon l7' }, '🔌'),
-							E('span', {}, ' ' + item.protocol)
-						]),
-						E('span', { 'class': 'sid-cell' }, item.sid)
-					]);
-				});
-			}
-			
-			if (Array.isArray(data.data.domains)) {
-				data.data.domains.forEach(function(item) {
-					sidLookupTable[item.sid] = { type: 'domain', name: item.domain };
-					rows.push([
-						E('span', { 'class': 'id-cell' }, item.id),
-						E('span', { 'class': 'protocol-cell' }, [
-							E('span', { 'class': 'protocol-icon domain' }, '🌍'),
-							E('span', {}, ' ' + item.domain)
-						]),
-						E('span', { 'class': 'sid-cell' }, item.sid)
-					]);
-				});
-			}
-		}
-
-		var table = document.getElementById('l7proto-data');
-		var headers = table.querySelectorAll('th');
+		if (!table)
+			return;
 
 		if (!table.hasAttribute('data-sort-initialized')) {
-			headers.forEach(function(header, index) {
+			table.querySelectorAll('th').forEach(function(header, index) {
 				header.style.cursor = 'pointer';
 				header.addEventListener('click', function() { self.sortTable(table, index); });
 			});
 			table.setAttribute('data-sort-initialized', 'true');
 		}
 
-		cbi_update_table('#l7proto-data', rows, E('em', _('No data recorded yet.')));
+		cbi_update_table(table, rows, E('em', _('No data recorded yet.')));
+
+		table.querySelectorAll('tr:not(.table-titles):not(.placeholder)').forEach(function(row, rowIndex) {
+			if (!rows[rowIndex])
+				return;
+			Array.from(row.cells).forEach(function(cell, cellIndex) {
+				if (Array.isArray(rows[rowIndex][cellIndex]))
+					cell.setAttribute('data-value', rows[rowIndex][cellIndex][0]);
+			});
+		});
+	},
+
+	renderL7ProtoData: function(data) {
+		var self = this;
+		var protoRows = [];
+		var domainRows = [];
+
+		lastL7ProtoData = data;
+		sidLookupTable = {};
+
+		if (data && data.status === 'success' && data.data) {
+			if (Array.isArray(data.data.protocols)) {
+				data.data.protocols.forEach(function(item) {
+					sidLookupTable[item.sid] = { type: 'protocol', name: item.protocol };
+					protoRows.push([
+						[ item.id, E('span', { 'class': 'id-cell' }, item.id) ],
+						E('span', { 'class': 'protocol-cell' }, [
+							E('span', { 'class': 'protocol-icon l7' }, '🔌'),
+							E('span', {}, ' ' + item.protocol)
+						]),
+						[ item.sid, E('span', { 'class': 'sid-cell' }, item.sid) ]
+					]);
+				});
+			}
+
+			if (Array.isArray(data.data.domains)) {
+				var domains = data.data.domains.slice().sort(function(a, b) {
+					var ac = (b.access_count || 0) - (a.access_count || 0);
+					if (ac !== 0)
+						return ac;
+					return (b.last_access || 0) - (a.last_access || 0);
+				});
+
+				domains.forEach(function(item) {
+					sidLookupTable[item.sid] = { type: 'domain', name: item.domain };
+					var row = [
+						[ item.id, E('span', { 'class': 'id-cell' }, item.id) ],
+						E('span', { 'class': 'protocol-cell' }, [
+							E('span', { 'class': 'protocol-icon domain' }, '🌍'),
+							E('span', {}, ' ' + item.domain)
+						]),
+						[ item.sid, E('span', { 'class': 'sid-cell' }, item.sid) ],
+						[ item.access_count || 0, E('span', { 'class': 'data-value' }, item.access_count || 0) ],
+						item.first_seen_str || '-',
+						item.last_access_str || '-'
+					];
+
+					if (self.hasXdns) {
+						var isProxied = self.isDomainProxied(item.domain);
+						if (isProxied) {
+							row.push(E('span', {
+								'class': 'badge success',
+								'style': 'color: #2ecc71; background: rgba(46,204,113,0.12); border: 1px solid rgba(46,204,113,0.3); padding: 2px 8px; border-radius: 4px; font-size: 85%; white-space: nowrap;'
+							}, [ '✔ ', _('已代理') ]));
+						} else {
+							row.push(E('button', {
+								'class': 'btn cbi-button cbi-button-action',
+								'style': 'padding: 2px 8px; font-size: 85%; white-space: nowrap;',
+								'click': function(ev) {
+									var b = ev.target.closest('button');
+									self.handleAddXdnsDomain(item.domain, b);
+								}
+							}, [ '➕ ', _('加入代理') ]));
+						}
+					}
+
+					domainRows.push(row);
+				});
+			}
+		}
+
+		this.fillSortableTable('l7-protocol-data', protoRows);
+		this.fillSortableTable('l7-domain-data', domainRows);
+
+		var protoCountEl = document.getElementById('l7-protocol-count');
+		if (protoCountEl)
+			protoCountEl.textContent = protoRows.length;
+		var domainCountEl = document.getElementById('l7-domain-count');
+		if (domainCountEl)
+			domainCountEl.textContent = domainRows.length;
 	},
 
 	pollL7Data: function() {
@@ -476,13 +681,20 @@ return view.extend({
 	},
 
 	initializeUI: function() {
+		applyViewTheme();
 		if (window.echarts) {
+			var self = this;
 			var dlChartEl = document.getElementById('download-speed-line-chart');
 			var ulChartEl = document.getElementById('upload-speed-line-chart');
 			if (!dlChartEl || !ulChartEl) return;
 
+			var colors = getChartColors();
+			var axisTheme = chartAxisTheme(colors);
 			var baseChartOption = {
-				tooltip: {
+				backgroundColor: axisTheme.backgroundColor,
+				textStyle: axisTheme.textStyle,
+				legend: axisTheme.legend,
+				tooltip: Object.assign({
 					trigger: 'axis',
 					formatter: function (params) {
 						if (!params || params.length === 0) {
@@ -497,19 +709,33 @@ return view.extend({
 						});
 						return tooltipContent;
 					}
-				},
+				}, axisTheme.tooltip),
 				grid: { left: '3%', right: '4%', bottom: '10%', top: '50px', containLabel: true },
-				xAxis: { type: 'category', boundaryGap: false, data: lineCategories },
-				yAxis: { type: 'value', axisLabel: { formatter: function(val) { return '%1024.2mbps'.format(val); } } },
+				xAxis: {
+					type: 'category',
+					boundaryGap: false,
+					data: lineCategories,
+					axisLine: axisTheme.xAxis.axisLine,
+					axisLabel: axisTheme.xAxis.axisLabel,
+					splitLine: axisTheme.xAxis.splitLine
+				},
+				yAxis: {
+					type: 'value',
+					axisLine: axisTheme.yAxis.axisLine,
+					splitLine: axisTheme.yAxis.splitLine,
+					axisLabel: { formatter: function(val) { return '%1024.2mbps'.format(val); }, color: colors.muted }
+				},
 				series: []
 			};
 
 
 		downloadLineChart = echarts.init(dlChartEl);
 		downloadLineChart.setOption(baseChartOption);
+		observeChartEl(downloadLineChart, dlChartEl);
 
 		uploadLineChart = echarts.init(ulChartEl);
 		uploadLineChart.setOption(baseChartOption);
+		observeChartEl(uploadLineChart, ulChartEl);
 
 		// 添加窗口大小变化监听器，使图表能够响应式调整
 		if (!resizeListenerAdded) {
@@ -520,19 +746,7 @@ return view.extend({
 					clearTimeout(resizeTimer);
 				}
 				resizeTimer = setTimeout(function() {
-					// 调整折线图大小
-					if (downloadLineChart) {
-						downloadLineChart.resize();
-					}
-					if (uploadLineChart) {
-						uploadLineChart.resize();
-					}
-					// 调整饼图大小
-					Object.keys(chartRegistry).forEach(function(chartId) {
-						if (chartRegistry[chartId]) {
-							chartRegistry[chartId].resize();
-						}
-					});
+					self.resizeAllCharts();
 				}, 200);
 			};
 			
@@ -544,7 +758,42 @@ return view.extend({
 	} else {
 		setTimeout(this.initializeUI.bind(this), 50);
 	}
-},	render: function() {
+	},
+
+	resizeAllCharts: function() {
+		if (downloadLineChart)
+			downloadLineChart.resize();
+		if (uploadLineChart)
+			uploadLineChart.resize();
+		Object.keys(chartRegistry).forEach(function(chartId) {
+			if (chartRegistry[chartId])
+				chartRegistry[chartId].resize();
+		});
+	},
+
+	bindTabChartResize: function(root) {
+		var self = this;
+		if (!root)
+			return;
+		var host = root.parentNode || root;
+		if (host._awTabResizeBound)
+			return;
+		host._awTabResizeBound = true;
+
+		var schedule = function() {
+			setTimeout(function() { self.resizeAllCharts(); }, 80);
+		};
+
+		host.addEventListener('click', function(ev) {
+			if (ev.target.closest && ev.target.closest('ul.cbi-tabmenu'))
+				schedule();
+		});
+		root.querySelectorAll('[data-tab]').forEach(function(pane) {
+			pane.addEventListener('cbi-tab-active', schedule);
+		});
+	},
+
+	render: function() {
 		var self = this;
 
 		var controls = E('div', { 'class': 'l7-controls' }, [
@@ -597,9 +846,16 @@ return view.extend({
 			])
 		]);
 
-		var tabContainer = E('div', {}, [
-			E('div', { 'class': 'cbi-section', 'data-tab': 'sid', 'data-tab-title': _('L7 SID Data') }, [
+		var sidInnerTabs = E('div', { 'class': 'aw-inner-tabs' }, [
+			E('div', { 'class': 'cbi-section', 'data-tab': 'sid-trend', 'data-tab-title': _('Speed Trend') }, [
 				E('div', { 'class': 'dashboard-container' }, [
+					E('div', { 'class': 'kpi-row' }, [
+						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-total-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('L7 Protocol Data')) ]),
+						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
+						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
+						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
+						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
+					]),
 					E('div', { 'class': 'line-chart-row' }, [
 						E('div', { 'class': 'chart-card' }, [
 							E('h4', [_('Real-time Download Speed')]),
@@ -609,14 +865,11 @@ return view.extend({
 							E('h4', [_('Real-time Upload Speed')]),
 							E('div', { id: 'upload-speed-line-chart', style: 'width: 100%; height: 350px;' })
 						])
+					])
+				])
 			]),
-					E('div', { 'class': 'kpi-row' }, [
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-total-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('L7 Protocol Data')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-rate-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Speed')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-tx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Download Total')) ]),
-						E('div', { 'class': 'kpi-card' }, [ E('big', { id: 'sid-rx-volume-val' }, '0'), E('span', { 'class': 'kpi-card-label' }, _('Upload Total')) ])
-					]),
+			E('div', { 'class': 'cbi-section', 'data-tab': 'sid-share', 'data-tab-title': _('Traffic Share') }, [
+				E('div', { 'class': 'dashboard-container' }, [
 					E('div', { 'class': 'chart-grid' }, [
 						E('div', { 'class': 'chart-card' }, [
 							E('h4', [_('Download Speed / SID')]),
@@ -635,7 +888,9 @@ return view.extend({
 							E('div', { id: 'sid-rx-volume-pie', style: 'width: 100%; height: 300px;' })
 						])
 					])
+				])
 			]),
+			E('div', { 'class': 'cbi-section', 'data-tab': 'sid-list', 'data-tab-title': _('SID List') }, [
 				E('table', { 'class': 'table', 'id': 'sid-data' }, [
 					E('tr', { 'class': 'tr table-titles' }, [
 						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🆔'), ' ', _('SID') ]),
@@ -654,12 +909,27 @@ return view.extend({
 					])
 				]),
 				controls
+			])
+		]);
+
+		var tabContainer = E('div', {}, [
+			E('div', { 'class': 'cbi-section', 'data-tab': 'sid', 'data-tab-title': _('L7 SID Data') }, [
+				sidInnerTabs
 			]),
 			E('div', { 'class': 'cbi-section', 'data-tab': 'l7proto', 'data-tab-title': _('L7 Protocol Data') }, [
-				E('table', { 'class': 'table', 'id': 'l7proto-data' }, [
+				E('div', { 'class': 'aw-inner-tabs' }, [
+					E('div', { 'class': 'cbi-section', 'data-tab': 'l7-protocols', 'data-tab-title': _('Protocol Library') }, [
+						E('p', { 'class': 'cbi-section-descr' }, [
+							_('Built-in L7 protocol signatures from aw-bpf.'),
+							' ',
+							_('Entries:'),
+							' ',
+							E('strong', { 'id': 'l7-protocol-count' }, '0')
+						]),
+						E('table', { 'class': 'table', 'id': 'l7-protocol-data' }, [
 							E('tr', { 'class': 'tr table-titles' }, [
 								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '#️⃣'), ' ', _('ID') ]),
-						E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🌐'), ' ', _('Domain&L7Protocol') ]),
+								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🔌'), ' ', _('Protocol') ]),
 								E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '🔑'), ' ', _('SID') ])
 							]),
 							E('tr', { 'class': 'tr placeholder' }, [
@@ -668,21 +938,52 @@ return view.extend({
 								])
 							])
 						])
+					]),
+					E('div', { 'class': 'cbi-section', 'data-tab': 'l7-domains', 'data-tab-title': _('常用域名') }, [
+						E('p', { 'class': 'cbi-section-descr' }, [
+							_('Frequently accessed domains discovered by xDPI, sorted by access count.'),
+							' ',
+							_('Entries:'),
+							' ',
+							E('strong', { 'id': 'l7-domain-count' }, '0')
+						]),
+						E('table', { 'class': 'table', 'id': 'l7-domain-data' }, [
+							E('tr', { 'class': 'tr table-titles' }, [
+								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '#️⃣'), ' ', _('ID') ]),
+								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🌍'), ' ', _('Domain') ]),
+								E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '🔑'), ' ', _('SID') ]),
+								E('th', { 'class': 'th right' }, [ E('span', { 'class': 'th-icon' }, '📊'), ' ', _('Access Count') ]),
+								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🕒'), ' ', _('First Seen') ]),
+								E('th', { 'class': 'th left' }, [ E('span', { 'class': 'th-icon' }, '🕒'), ' ', _('Last Access') ]),
+								this.hasXdns ? E('th', { 'class': 'th center' }, [ E('span', { 'class': 'th-icon' }, '⚡'), ' ', _('xdns代理') ]) : null
+							].filter(Boolean)),
+							E('tr', { 'class': 'tr placeholder' }, [
+								E('td', { 'class': 'td', 'colspan': this.hasXdns ? '7' : '6' }, [
+									E('em', { 'class': 'spinning' }, [ _('Collecting data...') ])
+								])
+							])
+						])
+					])
+				])
 			])
 		]);
 
 		var node = E([], [
-		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/wifidogx.css') }),
+		    E('link', { 'rel': 'stylesheet', 'href': L.resource('view/aw-bpf.css') }),
 		    E('script', { 'type': 'text/javascript', 'src': L.resource('echarts.min.js') }),
 
-		    E('div', { 'class': 'l7-view-container' }, [
+		    E('div', { 'class': 'l7-view-container', 'data-aw-theme': isDarkMode() ? 'dark' : 'light' }, [
 		        E('h2', [ _('L7 Data Monitor') ]),
 		        E('div', { 'id': 'l7-error-message' }),
 		        tabContainer
 		    ])
 		]);
 
+		tabContainer.querySelectorAll('.aw-inner-tabs').forEach(function(inner) {
+			ui.tabs.initTabGroup(inner.childNodes);
+		});
 		ui.tabs.initTabGroup(tabContainer.childNodes);
+		this.bindTabChartResize(tabContainer);
 
 		setTimeout(this.initializeUI.bind(this), 0);
 

luci-app-aw-bpf/htdocs/luci-static/resources/view/aw-bpf/settings.js

@@ -0,0 +1,28 @@
+'use strict';
+'require view';
+'require form';
+'require uci';
+
+return view.extend({
+	load: function() {
+		return uci.load('aw-bpf');
+	},
+
+	render: function() {
+		var m, s, o;
+
+		m = new form.Map('aw-bpf', _('eBPF Traffic Control & DPI'),
+			_('eBPF kernel-level bandwidth control, session audit logging and xDPI L7 application/domain recognition.'));
+
+		s = m.section(form.TypedSection, 'aw-bpf', _('General Settings'));
+		s.anonymous = true;
+		s.addremove = false;
+
+		o = s.option(form.Flag, 'enable_event_log', _('Enable Session Event Logging'),
+			_('Record TCP/UDP session connection events as structured JSON to system log / syslog. (DNS learning and xDPI protocol recognition are always active in background).'));
+		o.rmempty = false;
+		o.default = '0';
+
+		return m.render();
+	}
+});

luci-app-aw-bpf/root/usr/share/luci/menu.d/luci-app-aw-bpf.json

@@ -0,0 +1,46 @@
+{
+	"admin/qos": {
+		"title": "QoS",
+		"order": 60,
+		"action": {
+			"type": "firstchild",
+			"recurse": true
+		},
+		"depends": {
+			"acl": [ "luci-app-aw-bpf" ]
+		}
+	},
+	"admin/qos/hosts": {
+		"title": "Hosts",
+		"order": 10,
+		"action": {
+			"type": "view",
+			"path": "aw-bpf/display"
+		},
+		"depends": {
+			"acl": [ "luci-app-aw-bpf" ]
+		}
+	},
+	"admin/qos/l7": {
+		"title": "L7 application",
+		"order": 20,
+		"action": {
+			"type": "view",
+			"path": "aw-bpf/l7"
+		},
+		"depends": {
+			"acl": [ "luci-app-aw-bpf" ]
+		}
+	},
+	"admin/qos/settings": {
+		"title": "Settings",
+		"order": 30,
+		"action": {
+			"type": "view",
+			"path": "aw-bpf/settings"
+		},
+		"depends": {
+			"acl": [ "luci-app-aw-bpf" ]
+		}
+	}
+}

luci-app-aw-bpf/root/usr/share/rpcd/acl.d/luci-app-aw-bpf.json

@@ -0,0 +1,19 @@
+{
+	"luci-app-aw-bpf": {
+		"description": "Grant access to LuCI app aw-bpf",
+		"read": {
+			"file": {
+				"/usr/bin/aw-bpfctl": [ "exec" ],
+				"/usr/bin/xdns-ctl": [ "exec" ],
+				"/usr/bin/awk": [ "exec" ],
+				"/tmp/dhcp.leases": [ "read" ],
+				"/proc/net/arp": [ "read" ],
+				"/etc/xdns/whitelist.txt": [ "read" ]
+			},
+			"uci": [ "hostnames", "network", "aw-bpf" ]
+		},
+		"write": {
+			"uci": [ "hostnames", "aw-bpf" ]
+		}
+	}
+}

luci-app-frpc/Makefile

@@ -4,6 +4,7 @@ include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI Support for frp client
 LUCI_DEPENDS:=+luci-base +frpc
+LUCI_EXTRA_DEPENDS:=frpc (>=0.71.0-r2)
 
 PKG_LICENSE:=Apache-2.0
 

luci-app-frpc/htdocs/luci-static/resources/view/frpc.js

@@ -129,6 +129,16 @@
  */
 
 const startupConf = [
+	[form.Flag, 'enabled', _('Enable service'), null,
+	{
+		enabled: '1',
+		disabled: '0',
+		default: '0',
+		rmempty: false,
+		retain: true,
+		remove: writeFlagDisabled
+	}],
+
 	[form.Flag, 'stdout', _('Log stdout'), null,
 	{
 		enabled: '1',

luci-app-frps/Makefile

@@ -4,6 +4,7 @@ include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=LuCI Support for frp server
 LUCI_DEPENDS:=+luci-base +frps
+LUCI_EXTRA_DEPENDS:=frps (>=0.71.0-r2)
 
 PKG_LICENSE:=Apache-2.0
 

luci-app-frps/htdocs/luci-static/resources/view/frps.js

@@ -99,6 +99,16 @@
  */
 
 const startupConf = [
+	[form.Flag, 'enabled', _('Enable service'), null,
+	{
+		enabled: '1',
+		disabled: '0',
+		default: '0',
+		rmempty: false,
+		retain: true,
+		remove: writeFlagDisabled
+	}],
+
 	[form.Flag, 'stdout', _('Log stdout'), null,
 	{
 		enabled: '1',

luci-app-frps/po/ar/frps.po

@@ -11,185 +11,189 @@ msgstr ""
 "&& n%100<=10 ? 3 : n%100>=11 ? 4 : 5;\n"
 "X-Generator: Weblate 5.17.1-dev\n"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:982
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:992
 msgid "Access Control"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1008
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1018
 msgid "Add new HTTP plugin..."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:256
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:266
 msgid "Additional auth scopes"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:144
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:154
 msgid "Additional configs"
 msgstr "الاعدادات الإضافية"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:257
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:267
 msgid "Additional scopes to include authentication information."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:154
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:164
 msgid "Address that frps binds to."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:200
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:210
 msgid "Address that proxy listeners bind to."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:551
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:561
 msgid "Allow ports"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:449
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:459
 msgid "Assets dir"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:350
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:360
 msgid "Audience OIDC tokens should contain."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:978
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:988
 msgid "Authentication"
 msgstr "المصادقة"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:237
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:247
 msgid "Authentication method"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:238
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:248
 msgid "Authentication method used to authenticate frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:583
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:593
 msgid "Authorized keys file for SSH tunnel gateway."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:153
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:163
 msgid "Bind address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:157
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:167
 msgid "Bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:969
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:979
 msgid "Collecting data ..."
 msgstr "يتم جمع البيانات..."
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:323
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:333
 msgid "Command arguments passed to token source exec."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:300
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:310
 msgid ""
 "Command used to obtain the token. The init script adds --allow-"
 "unsafe=TokenSourceExec when this source type is used."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:977
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:987
 msgid "Common Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:368
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:378
 msgid "Configuration key: log.level."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:538
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:548
 msgid "Configuration key: transport.quic.keepalivePeriod."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:542
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:552
 msgid "Configuration key: transport.quic.maxIdleTimeout."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:546
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:556
 msgid "Configuration key: transport.quic.maxIncomingStreams."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:227
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:237
 msgid "Custom 404 page"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:507
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:517
 msgid "Detailed errors to client"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:375
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:385
 msgid "Disable log color"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:376
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:386
 msgid "Disable log colors when log output is console."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:264
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:274
 msgid "Disabled"
 msgstr "معطل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:220
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:230
 msgid "Do not update traffic when TCPMUX passthrough is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:224
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:234
 msgid "Domain suffix for subdomain-based HTTP/HTTPS proxies."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:454
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:464
 msgid ""
 "Enable Go pprof debug/profiling endpoints on the web server. It only takes "
 "effect when web server port is set."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:403
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:413
 msgid ""
 "Enable HTTPS for the frps web server. This switch controls whether "
 "webServer.tls.certFile and webServer.tls.keyFile are emitted."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:463
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:473
 msgid "Enable Prometheus"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:480
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:490
 msgid "Enable TCP stream multiplexing. This setting must match frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:453
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:463
 msgid "Enable pprof"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:402
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:102
+msgid "Enable service"
+msgstr ""
+
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:412
 msgid "Enable web HTTPS"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:135
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:145
 msgid "Environment variable"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:755
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:765
 msgid "Environment variable must use KEY=value format."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:333
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:343
 msgid "Environment variables passed to token source exec. Use KEY=value."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:464
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:474
 msgid ""
 "Export Prometheus metrics on webServer /metrics API. It only takes effect "
 "when web server port is set."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:145
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:155
 msgid ""
 "Extra root-level configuration fragments included before generated HTTP "
 "plugin sections. Use raw settings for table-specific extra options."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:521
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:531
 msgid "Force TLS"
 msgstr ""
 
@@ -197,311 +201,315 @@ msgstr ""
 msgid "Grant access to LuCI app frps"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1003
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1013
 msgid "HTTP Plugin Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:781
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:791
 msgid "HTTP plugin URL must include a host."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:777
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:787
 msgid "HTTP plugin address must be a single address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:593
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:799
+msgid "HTTP plugin address must be host:port or an http:// or https:// URL."
+msgstr ""
+
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:603
 msgid "HTTP plugin backend address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:797
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:807
 msgid ""
 "HTTP plugin operation must be a frps operation name, for example Login or "
 "NewProxy."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:765
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:775
 msgid "HTTP plugin path must start with /."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:604
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:614
 msgid "HTTP plugin request path."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:499
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:509
 msgid "Heartbeat timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:500
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:510
 msgid "Heartbeat timeout in seconds."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:161
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:171
 msgid "KCP bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:174
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:193
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:184
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:203
 msgid "KCP bind port and QUIC bind port must be different."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:492
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:502
 msgid "Keepalive interval for TCP mux."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:261
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:271
 msgid ""
 "Load token from an external source. File reads the token from a local file; "
 "exec runs a command and requires frp unsafe permission. Mutually exclusive "
 "with auth.token."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:984
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:994
 msgid "Log Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:367
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:377
 msgid "Log level"
 msgstr "مستوى التسجيل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:371
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:381
 msgid "Log max days"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:363
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:373
 msgid "Log output"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:364
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:374
 msgid "Log output path or console."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:112
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:122
 msgid "Log stderr"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:102
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:112
 msgid "Log stdout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:475
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:485
 msgid "Max pool count"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:560
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:570
 msgid "Max ports per client"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:372
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:382
 msgid "Maximum number of days to keep logs."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:476
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:486
 msgid "Maximum pool count for each proxy."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:561
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:571
 msgid "Maximum ports each client can use. 0 means no limit."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:504
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:514
 msgid "Maximum time to wait for a work connection."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:564
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:574
 msgid "NAT hole analysis reserve hours"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:942
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:952
 msgid "NOT RUNNING"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:349
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:359
 msgid "OIDC audience"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:345
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:355
 msgid "OIDC issuer"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:346
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:356
 msgid "OIDC issuer used to verify tokens."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:353
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:363
 msgid "OIDC skip expiry check"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:357
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:367
 msgid "OIDC skip issuer check"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:136
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:146
 msgid "OS environments passed to frp for config file template, see %s."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:522
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:532
 msgid "Only accept TLS-encrypted frpc connections."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:579
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:589
 msgid "Path for auto-generated private key."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:277
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:287
 msgid "Path of token file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:228
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:238
 msgid "Path to custom 404 page for HTTP requests."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:526
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:536
 msgid "Path to the TLS certificate file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:530
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:540
 msgid "Path to the TLS private key file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:414
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:424
 msgid "Path to the certificate file used by the HTTPS web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:432
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:442
 msgid "Path to the private key file used by the HTTPS web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:534
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:544
 msgid "Path to the trusted CA certificate file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:592
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:602
 msgid "Plugin address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:588
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:598
 msgid "Plugin name"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:614
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:624
 msgid "Plugin operations"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:603
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:613
 msgid "Plugin path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:204
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:214
 msgid "Port for HTTP virtual host requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:208
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:218
 msgid "Port for HTTPS virtual host requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:216
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:226
 msgid "Port for TCPMUX HTTP CONNECT requests. Empty or 0 disables it."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:719
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:729
 msgid "Port must be a number between 0 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:723
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:733
 msgid "Port must be between 0 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:742
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:752
 msgid "Port must be between 1 and 65535."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:745
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:755
 msgid "Port range start must not be greater than end."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:158
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:168
 msgid "Port that frps listens on."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:552
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:562
 msgid ""
 "Ports clients are allowed to bind. Use single port like 3001 or range like "
 "2000-3000."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:575
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:585
 msgid "Private key file for SSH tunnel gateway."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:199
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:209
 msgid "Proxy bind address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:180
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:190
 msgid "QUIC bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:537
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:547
 msgid "QUIC keepalive period"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:541
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:551
 msgid "QUIC max idle timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:545
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:555
 msgid "QUIC max incoming streams"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:942
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:952
 msgid "RUNNING"
 msgstr "قيد التشغيل"
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:125
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:135
 msgid "Respawn when crashed"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:212
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:222
 msgid "Response header timeout for vhost HTTP server, in seconds."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:565
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:575
 msgid "Retention time for NAT hole punching strategy data."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:123
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:133
 msgid "Run daemon as group"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:122
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:132
 msgid "Run daemon as user"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:983
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:993
 msgid "SSH Tunnel"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:582
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:592
 msgid "SSH tunnel authorized keys file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:578
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:588
 msgid "SSH tunnel auto-generated private key path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:570
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:580
 msgid "SSH tunnel bind port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:571
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:581
 msgid "SSH tunnel gateway bind port. Empty disables this feature."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:574
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:584
 msgid "SSH tunnel private key file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:508
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:518
 msgid "Send specific error details to frpc."
 msgstr ""
 
@@ -509,208 +517,208 @@ msgstr ""
 msgid "Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:358
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:368
 msgid "Skip checking whether OIDC token issuer matches configured issuer."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:354
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:364
 msgid "Skip checking whether the OIDC token is expired."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:985
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:996
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:995
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:1006
 msgid "Startup Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:223
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:233
 msgid "Subdomain host"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:495
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:505
 msgid "TCP keepalive"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:496
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:506
 msgid "TCP keepalive interval. Negative value disables keepalive."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:479
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:489
 msgid "TCP mux"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:491
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:501
 msgid "TCP mux keepalive interval"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:215
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:225
 msgid "TCPMUX HTTP CONNECT port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:219
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:229
 msgid "TCPMUX passthrough"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:980
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:990
 msgid "TLS / QUIC"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:413
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:525
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:423
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:535
 msgid "TLS certificate path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:425
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:435
 msgid "TLS certificate path is required when web HTTPS is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:431
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:529
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:441
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:539
 msgid "TLS private key path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:443
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:453
 msgid "TLS private key path is required when web HTTPS is enabled."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:533
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:543
 msgid "TLS trusted CA path"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:241
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:251
 msgid "Token"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:250
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:270
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:260
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:280
 msgid "Token and token source are mutually exclusive."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:299
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:309
 msgid "Token source command"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:322
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:332
 msgid "Token source command arguments"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:316
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:326
 msgid "Token source command is required when token source type is exec."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:332
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:342
 msgid "Token source environment"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:276
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:286
 msgid "Token source file"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:293
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:303
 msgid "Token source file path is required when token source type is file."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:260
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:270
 msgid "Token source type"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:242
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:252
 msgid "Token used for authentication."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:979
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:989
 msgid "Transport Settings"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:231
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:241
 msgid "UDP packet size"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:232
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:242
 msgid "UDP packet size in bytes. Should match frpc."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:162
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:172
 msgid ""
 "UDP port used for KCP. Empty disables KCP. Do not reuse the same UDP port as "
 "QUIC."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:181
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:191
 msgid ""
 "UDP port used for QUIC. Empty disables QUIC. Do not reuse the same UDP port "
 "as KCP."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:589
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:599
 msgid "Unique HTTP plugin name."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:736
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:746
 msgid "Use a single port like 3001 or a range like 2000-3000."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:503
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:513
 msgid "User connection timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:626
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:636
 msgid "Verify plugin TLS"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:627
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:637
 msgid ""
 "Verify the HTTP plugin TLS certificate when the plugin address uses HTTPS."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:203
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:213
 msgid "Vhost HTTP port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:211
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:221
 msgid "Vhost HTTP timeout"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:207
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:217
 msgid "Vhost HTTPS port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:981
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:991
 msgid "Web Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:381
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:391
 msgid "Web server address"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:450
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:460
 msgid "Web server assets directory."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:382
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:392
 msgid "Web server bind address."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:395
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:405
 msgid "Web server password"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:396
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:406
 msgid "Web server password."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:385
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:395
 msgid "Web server port"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:386
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:396
 msgid "Web server port. Leave empty or set to 0 to disable the web server."
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:389
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:399
 msgid "Web server user"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:390
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:400
 msgid "Web server username."
 msgstr ""
 
@@ -718,11 +726,11 @@ msgstr ""
 msgid "frp"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:945
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:952
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:955
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:962
 msgid "frp Server"
 msgstr ""
 
-#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:615
+#: applications/luci-app-frps/htdocs/luci-static/resources/view/frps.js:625
 msgid "frps operations handled by this HTTP plugin."
 msgstr ""