diff --git a/luci-app-passwall2/Makefile b/luci-app-passwall2/Makefile index 79116653..79fdd5ee 100644 --- a/luci-app-passwall2/Makefile +++ b/luci-app-passwall2/Makefile @@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall2 -PKG_VERSION:=26.6.16 +PKG_VERSION:=26.7.12 PKG_RELEASE:=1 PKG_PO_VERSION:=$(PKG_VERSION) @@ -25,7 +25,7 @@ PKG_CONFIG_DEPENDS:= \ LUCI_TITLE:=LuCI support for PassWall 2 LUCI_PKGARCH:=all -LUCI_DEPENDS:=+coreutils +coreutils-base64 +coreutils-nohup +curl \ +LUCI_DEPENDS:=+coreutils +coreutils-base64 +coreutils-nohup +coreutils-timeout +curl \ +ip-full +libuci-lua +lua +luci-compat +luci-lib-jsonc +lyaml +resolveip +tcping \ +geoview +v2ray-geoip +v2ray-geosite \ +unzip @@ -136,6 +136,7 @@ endef define Package/$(PKG_NAME)/conffiles /etc/config/passwall2 /etc/config/passwall2_server +/usr/share/passwall2/direct_ip /usr/share/passwall2/domains_excluded endef diff --git a/luci-app-passwall2/luasrc/controller/passwall2.lua b/luci-app-passwall2/luasrc/controller/passwall2.lua index c6cd1a9e..a2bc949a 100644 --- a/luci-app-passwall2/luasrc/controller/passwall2.lua +++ b/luci-app-passwall2/luasrc/controller/passwall2.lua @@ -103,6 +103,7 @@ function index() for com, _ in pairs(coms) do entry({"admin", "services", appname, "check_" .. com}, call("com_check", com)).leaf = true entry({"admin", "services", appname, "update_" .. com}, call("com_update", com)).leaf = true + entry({"admin", "services", appname, "version_" .. com}, call("com_version", com)).leaf = true end --[[Backup]] @@ -699,6 +700,11 @@ function com_update(comname) http_write_json(json) end +function com_version(comname) + local version = api.get_app_version(comname) + http_write_json_ok(version) +end + local backup_files = { "/etc/config/passwall2", "/etc/config/passwall2_server", diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua index 5649b016..afdef1b9 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/app_update.lua @@ -1,19 +1,21 @@ local api = require "luci.passwall2.api" +local com = require "luci.passwall2.com" local appname = api.appname m = Map(appname) api.set_apply_on_parse(m) -- [[ App Settings ]]-- -s = m:section(TypedSection, "global_app", translate("App Update"), - "" .. - translate("Please confirm that your firmware supports FPU.") .. - "") +s = m:section(TypedSection, "global_app", translate("App Update")) s.anonymous = true -s:append(Template(appname .. "/app_update/app_version")) + +local app_version = Template(appname .. "/app_update/app_version") +app_version.api = api +app_version.config = m.config +app_version.com = com +s:append(app_version) local k, v -local com = require "luci.passwall2.com" for k, v in pairs(com) do o = s:option(Value, k:gsub("%-","_") .. "_file", translatef("%s App Path", v.name)) o.default = v.default_path or ("/usr/bin/" .. k) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua index e77b1aa1..6195b0bd 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua @@ -355,11 +355,13 @@ o.default = n + 1080 o.datatype = "port" o.rmempty = false +--[[ if has_singbox or has_xray then o = s2:option(Value, "http_port", "HTTP " .. translate("Listen Port") .. " " .. translate("0 is not use")) o.default = 0 o.datatype = "port" end +]]-- local o_node = s.fields["node"] local o_socks = s2.fields["node"] diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua index 0f2ea0fa..6a8732ee 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/haproxy.lua @@ -74,13 +74,14 @@ o:depends("balancing_enable", true) ---- Passwall Inner implement Probe URL o = s:option(Value, "health_probe_url", translate("Probe URL")) -o.default = "https://www.google.com/generate_204" o:value("https://cp.cloudflare.com/", "Cloudflare") o:value("https://www.gstatic.com/generate_204", "Gstatic") o:value("https://www.google.com/generate_204", "Google") o:value("https://www.youtube.com/generate_204", "YouTube") o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)") o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)") +o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)") +o.default = o.keylist[3] o.description = translate("The URL used to detect the connection status.") o:depends("health_check_type", "passwall_logic") diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua index 3265dcd9..745188de 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_list.lua @@ -25,6 +25,7 @@ o:value("https://www.google.com/generate_204", "Google") o:value("https://www.youtube.com/generate_204", "YouTube") o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)") o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)") +o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)") o.default = o.keylist[3] -- [[ Add the node via the link ]]-- diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua index 89f42efd..b5068ccc 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/node_subscribe_config.lua @@ -231,13 +231,8 @@ end o = s:option(Flag, "boot_update", translate("Update Once on Boot"), translate("Updates the subscription the first time runs automatically after each system boot.")) o.default = 0 ----- Enable auto update subscribe -o = s:option(Flag, "auto_update", translate("Enable auto update subscribe")) -o.default = 0 -o.rmempty = false - ----- Week Update -o = s:option(ListValue, "week_update", translate("Update Mode")) +o = s:option(ListValue, "update_week_mode", translate("Auto Update Mode")) +o:value("", translate("Disable")) o:value(8, translate("Loop Mode")) o:value(7, translate("Every day")) o:value(1, translate("Every Monday")) @@ -247,29 +242,39 @@ o:value(4, translate("Every Thursday")) o:value(5, translate("Every Friday")) o:value(6, translate("Every Saturday")) o:value(0, translate("Every Sunday")) -o.default = 7 -o:depends("auto_update", true) -o.rmempty = true ----- Time Update -o = s:option(ListValue, "time_update", translate("Update Time(every day)")) -for t = 0, 23 do o:value(t, t .. ":00") end -o.default = 0 -o:depends("week_update", "0") -o:depends("week_update", "1") -o:depends("week_update", "2") -o:depends("week_update", "3") -o:depends("week_update", "4") -o:depends("week_update", "5") -o:depends("week_update", "6") -o:depends("week_update", "7") -o.rmempty = true +o = s:option(Value, "update_time_mode", translate("Update Time")) +o:value("0:00") +for t = 0, 23 do + if t == 12 then + o:value(t .. ":30") + elseif t == 23 then + o:value(t .. ":59") + else + o:value(t .. ":00") + end +end +o.default = "0:00" +o.validate = function(self, value) + local b = api.is_timehhmm(value) + if b then + return value + end + return nil +end +o:depends("update_week_mode", "0") +o:depends("update_week_mode", "1") +o:depends("update_week_mode", "2") +o:depends("update_week_mode", "3") +o:depends("update_week_mode", "4") +o:depends("update_week_mode", "5") +o:depends("update_week_mode", "6") +o:depends("update_week_mode", "7") ----- Interval Update -o = s:option(ListValue, "interval_update", translate("Update Interval(hour)")) +o = s:option(ListValue, "update_interval_mode", translate("Update Interval(hour)")) for t = 1, 24 do o:value(t, t .. " " .. translate("hour")) end o.default = 2 -o:depends("week_update", "8") +o:depends("update_week_mode", "8") o.rmempty = true o = s:option(ListValue, "access_mode", translate("Subscribe URL Access Method")) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua index 25913c94..a715756c 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/other.lua @@ -29,7 +29,9 @@ o.rmempty = true for index, value in ipairs({"stop", "start", "restart"}) do o = s:option(ListValue, value .. "_week_mode", translate(value .. " automatically mode")) o:value("", translate("Disable")) - o:value(8, translate("Loop Mode")) + if value == "restart" then + o:value(8, translate("Loop Mode")) + end o:value(7, translate("Every day")) o:value(1, translate("Every Monday")) o:value(2, translate("Every Tuesday")) @@ -39,9 +41,25 @@ for index, value in ipairs({"stop", "start", "restart"}) do o:value(6, translate("Every Saturday")) o:value(0, translate("Every Sunday")) - o = s:option(ListValue, value .. "_time_mode", translate(value .. " Time(Every day)")) - for t = 0, 23 do o:value(t, t .. ":00") end - o.default = 0 + o = s:option(Value, value .. "_time_mode", translate(value .. " Time")) + o:value("0:00") + for t = 0, 23 do + if t == 12 then + o:value(t .. ":30") + elseif t == 23 then + o:value(t .. ":59") + else + o:value(t .. ":00") + end + end + o.default = "0:00" + o.validate = function(self, value) + local b = api.is_timehhmm(value) + if b then + return value + end + return nil + end o:depends(value .. "_week_mode", "0") o:depends(value .. "_week_mode", "1") o:depends(value .. "_week_mode", "2") @@ -150,8 +168,45 @@ o = s:option(Flag, "accept_icmpv6", translate("Hijacking ICMPv6 (IPv6 PING)")) o:depends("ipv6_tproxy", true) o.default = 0 -o = s:option(DynamicList, "force_proxy_lan_ip", translate("Force Proxy LAN IP"), translate("By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here.")) -o.datatype = "or(ipmask4,ipmask6)" +function clean_text(text) + local nbsp = string.char(0xC2, 0xA0) + local fullwidth_space = string.char(0xE3, 0x80, 0x80) + return text + :gsub("\t", " ") + :gsub(nbsp, " ") + :gsub(fullwidth_space, " ") + :gsub("^%s+", "") + :gsub("%s+$", "\n") + :gsub("\r\n", "\n") + :gsub("[ \t]*\n[ \t]*", "\n") +end + +local direct_ip_file = "/usr/share/passwall2/direct_ip" +o = s:option(TextValue, "direct_ip", translate("Direct IP List"), "" .. translate("These had been joined ip addresses will connect directly (not entering the core).") .. "") +o.rows = 15 +o.wrap = "off" +o.cfgvalue = function(self, section) + return fs.readfile(direct_ip_file) or "" +end +o.write = function(self, section, value) + fs.writefile(direct_ip_file, value:gsub("\r\n", "\n")) +end +o.remove = function(self, section, value) + fs.writefile(direct_ip_file, "") +end +o.validate = function(self, value) + local ipmasks= {} + value = clean_text(value) + string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, api.trim(w)) end) + for index, ipmask in ipairs(ipmasks) do + if ipmask ~= "" and not ipmask:find("^#") and not ipmask:find("^geoip:") then + if not ( datatypes.ipmask4(ipmask) or datatypes.ipmask6(ipmask) ) then + return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!") + end + end + end + return value +end if has_xray then s_xray = m:section(TypedSection, "global_xray", "Xray " .. translate("Settings")) @@ -170,19 +225,17 @@ if has_xray then o:value("1-5", "1-5") o:depends("fragment", true) - o = s_xray:option(Value, "fragment_length", translate("Fragment Length"), translate("Fragmented packet length (byte)")) - o.datatype = "or(uinteger,portrange)" - o.default = "100-200" + o = s_xray:option(Value, "fragment_lengths", translate("Fragment Length"), translate("Fragmented packet length (byte)")) + o.default = "3-5,6-8,10-20" o:depends("fragment", true) - o = s_xray:option(Value, "fragment_delay", translate("Fragment Delay"), translate("Fragmentation interval (ms)")) - o.datatype = "or(uinteger,portrange)" + o = s_xray:option(Value, "fragment_delays", translate("Fragment Delay"), translate("Fragmentation interval (ms)")) o.default = "10-20" o:depends("fragment", true) o = s_xray:option(Value, "fragment_maxSplit", translate("Max Split"), translate("Limit the maximum number of splits.")) o.datatype = "or(uinteger,portrange)" - o.default = "100-200" + o.default = "3-6" o:depends("fragment", true) o = s_xray:option(Flag, "noise", translate("Noise"), translate("UDP noise, Under some circumstances it can bypass some UDP based protocol restrictions.")) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua index 4b32eb00..2fba7319 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/rule.lua @@ -35,13 +35,8 @@ o.default = "/usr/share/v2ray/" o.placeholder = o.default o.rmempty = false ----- Auto Update -o = s:option(Flag, "auto_update", translate("Enable auto update rules")) -o.default = 0 -o.rmempty = false - ----- Week Update -o = s:option(ListValue, "week_update", translate("Update Mode")) +o = s:option(ListValue, "update_week_mode", translate("Auto Update Mode")) +o:value("", translate("Disable")) o:value(8, translate("Loop Mode")) o:value(7, translate("Every day")) o:value(1, translate("Every Monday")) @@ -51,29 +46,39 @@ o:value(4, translate("Every Thursday")) o:value(5, translate("Every Friday")) o:value(6, translate("Every Saturday")) o:value(0, translate("Every Sunday")) -o.default = 7 -o:depends("auto_update", true) -o.rmempty = true ----- Time Update -o = s:option(ListValue, "time_update", translate("Update Time(every day)")) -for t = 0, 23 do o:value(t, t .. ":00") end -o.default = 0 -o:depends("week_update", "0") -o:depends("week_update", "1") -o:depends("week_update", "2") -o:depends("week_update", "3") -o:depends("week_update", "4") -o:depends("week_update", "5") -o:depends("week_update", "6") -o:depends("week_update", "7") -o.rmempty = true +o = s:option(Value, "update_time_mode", translate("Update Time")) +o:value("0:00") +for t = 0, 23 do + if t == 12 then + o:value(t .. ":30") + elseif t == 23 then + o:value(t .. ":59") + else + o:value(t .. ":00") + end +end +o.default = "0:00" +o.validate = function(self, value) + local b = api.is_timehhmm(value) + if b then + return value + end + return nil +end +o:depends("update_week_mode", "0") +o:depends("update_week_mode", "1") +o:depends("update_week_mode", "2") +o:depends("update_week_mode", "3") +o:depends("update_week_mode", "4") +o:depends("update_week_mode", "5") +o:depends("update_week_mode", "6") +o:depends("update_week_mode", "7") ----- Interval Update -o = s:option(ListValue, "interval_update", translate("Update Interval(hour)")) +o = s:option(ListValue, "update_interval_mode", translate("Update Interval(hour)")) for t = 1, 24 do o:value(t, t .. " " .. translate("hour")) end o.default = 2 -o:depends("week_update", "8") +o:depends("update_week_mode", "8") o.rmempty = true --- The update option is always hidden by JavaScript. diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua index f3930ed4..59723a56 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/socks_config.lua @@ -128,6 +128,7 @@ o:value("https://www.google.com/generate_204", "Google") o:value("https://www.youtube.com/generate_204", "YouTube") o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)") o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)") +o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)") o.default = o.keylist[3] o:depends("enable_autoswitch", true) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua index 8cf95aed..2cbeb54d 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/hysteria2.lua @@ -46,6 +46,12 @@ o.rewrite_option = o.option o = s:option(Value, _n("realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o.rewrite_option = o.option o:depends({ [_n("realms")] = "1" }) +o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") +end o = s:option(DynamicList, _n("realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -67,6 +73,20 @@ o.rewrite_option = o.option o:depends({ [_n("obfs_type")] = "salamander" }) o:depends({ [_n("obfs_type")] = "gecko" }) +o = s:option(Value, _n("obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) +o.datatype = "uinteger" +o.placeholder = "512" +o.default = "512" +o:depends({ [_n("obfs_type")] = "gecko" }) +o.rewrite_option = o.option + +o = s:option(Value, _n("obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) +o.datatype = "uinteger" +o.placeholder = "1200" +o.default = "1200" +o:depends({ [_n("obfs_type")] = "gecko" }) +o.rewrite_option = o.option + o = s:option(Flag, _n("fast_open"), translate("Fast Open")) o.default = "0" diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua index 505d6b62..641b9169 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/ray.lua @@ -32,10 +32,10 @@ if formvalue_proto then s.val["protocol"] = formvalue_proto end local arg_select_proto = luci.http.formvalue("select_proto") or "" local ss_method_list = { - "none", "plain", "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" + "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" } -local security_list = { "none", "auto", "aes-128-gcm", "chacha20-poly1305", "zero" } +local security_list = { "auto", "aes-128-gcm", "chacha20-poly1305" } local header_type_list = { "none", "srtp", "utp", "wechat-video", "dtls", "wireguard", "dns" @@ -243,7 +243,8 @@ if load_balancing_options then -- [[ Load balancing Start ]] o:value("https://www.youtube.com/generate_204", "YouTube") o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)") o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)") - o.default = "https://www.google.com/generate_204" + o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)") + o.default = o.keylist[3] o.description = translate("The URL used to detect the connection status.") o = s:option(Value, _n("probeInterval"), translate("Probe Interval")) @@ -348,6 +349,12 @@ end o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o:depends({ [_n("hysteria2_realms")] = "1" }) +o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") +end o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -367,6 +374,18 @@ o = s:option(Value, _n("hysteria2_obfs_password"), translate("Obfs Password")) o:depends({ [_n("hysteria2_obfs_type")] = "salamander" }) o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) +o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) +o.datatype = "uinteger" +o.placeholder = "512" +o.default = "512" +o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + +o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) +o.datatype = "uinteger" +o.placeholder = "1200" +o.default = "1200" +o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Value, _n("hysteria2_up_mbps"), translate("Max upload Mbps")) o:depends({ [_n("protocol")] = "hysteria2" }) @@ -493,6 +512,7 @@ o:value("ios") o:value("android") o:value("random") o:value("randomized") +o:value("unsafe") o.default = "chrome" o:depends({ [_n("tls")] = true, [_n("utls")] = true }) o:depends({ [_n("tls")] = true, [_n("reality")] = true }) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua index 55d75677..e1023ae8 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/sing-box.lua @@ -165,7 +165,8 @@ if load_urltest_options then -- [[ URLTest Start ]] o:value("https://www.youtube.com/generate_204", "YouTube") o:value("https://connect.rom.miui.com/generate_204", "MIUI (CN)") o:value("https://connectivitycheck.platform.hicloud.com/generate_204", "HiCloud (CN)") - o.default = "https://www.gstatic.com/generate_204" + o:value("https://wifi.vivo.com.cn/generate_204", "VIVO (CN)") + o.default = o.keylist[3] o.description = translate("The URL used to detect the connection status.") o = s:option(Value, _n("urltest_interval"), translate("Test interval")) @@ -411,6 +412,12 @@ if singbox_tags:find("with_quic") then o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o:depends({ [_n("hysteria2_realms")] = "1" }) + o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") + end o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -430,6 +437,18 @@ if singbox_tags:find("with_quic") then o:depends({ [_n("hysteria2_obfs_type")] = "salamander" }) o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) + o.datatype = "uinteger" + o.placeholder = "512" + o.default = "512" + o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + + o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) + o.datatype = "uinteger" + o.placeholder = "1200" + o.default = "1200" + o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Value, _n("hysteria2_up_mbps"), translate("Max upload Mbps")) o:depends({ [_n("protocol")] = "hysteria2" }) @@ -679,12 +698,12 @@ o = s:option(Flag, _n("http_h2_health_check"), translate("Health check")) o:depends({ [_n("tls")] = true, [_n("transport")] = "http" }) o = s:option(Value, _n("http_h2_read_idle_timeout"), translate("Idle timeout")) -o.default = "10" -o:depends({ [_n("tls")] = true, [_n("transport")] = "http", [_n("http_h2_health_check")] = true }) +o.default = "15" +o:depends({ [_n("http_h2_health_check")] = true }) o = s:option(Value, _n("http_h2_health_check_timeout"), translate("Health check timeout")) o.default = "15" -o:depends({ [_n("tls")] = true, [_n("transport")] = "http", [_n("http_h2_health_check")] = true }) +o:depends({ [_n("http_h2_health_check")] = true }) -- [[ WebSocket ]]-- o = s:option(Value, _n("ws_host"), translate("WebSocket Host")) @@ -720,11 +739,11 @@ o = s:option(Flag, _n("grpc_health_check"), translate("Health check")) o:depends({ [_n("transport")] = "grpc" }) o = s:option(Value, _n("grpc_idle_timeout"), translate("Idle timeout")) -o.default = "10" +o.default = "15" o:depends({ [_n("grpc_health_check")] = true }) o = s:option(Value, _n("grpc_health_check_timeout"), translate("Health check timeout")) -o.default = "20" +o.default = "15" o:depends({ [_n("grpc_health_check")] = true }) o = s:option(Flag, _n("grpc_permit_without_stream"), translate("Permit without stream")) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua index cc9a733a..0b0dd1e2 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/hysteria2.lua @@ -34,6 +34,12 @@ o:depends({ [_n("custom")] = false }) o = s:option(Value, _n("realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o.rewrite_option = o.option o:depends({ [_n("realms")] = "1" }) +o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") +end o = s:option(DynamicList, _n("realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -57,6 +63,20 @@ o.rewrite_option = o.option o:depends({ [_n("obfs_type")] = "salamander" }) o:depends({ [_n("obfs_type")] = "gecko" }) +o = s:option(Value, _n("obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) +o.datatype = "uinteger" +o.placeholder = "512" +o.default = "512" +o:depends({ [_n("obfs_type")] = "gecko" }) +o.rewrite_option = o.option + +o = s:option(Value, _n("obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) +o.datatype = "uinteger" +o.placeholder = "1200" +o.default = "1200" +o:depends({ [_n("obfs_type")] = "gecko" }) +o.rewrite_option = o.option + o = s:option(Flag, _n("udp"), translate("UDP")) o.default = "1" o.rewrite_option = o.option diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua index 31104c2f..cf944c3f 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/ray.lua @@ -24,7 +24,7 @@ local function _n(name) end local x_ss_method_list = { - "none", "plain", "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" + "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" } local header_type_list = { @@ -130,6 +130,12 @@ o:depends({ [_n("protocol")] = "hysteria2"}) o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o:depends({ [_n("hysteria2_realms")] = "1" }) +o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") +end o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -149,6 +155,18 @@ o = s:option(Value, _n("hysteria2_obfs_password"), translate("Obfs Password")) o:depends({ [_n("hysteria2_obfs_type")] = "salamander" }) o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) +o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) +o.datatype = "uinteger" +o.placeholder = "512" +o.default = "512" +o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + +o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) +o.datatype = "uinteger" +o.placeholder = "1200" +o.default = "1200" +o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Flag, _n("hysteria2_ignore_client_bandwidth"), translate("Client BBR Flow Control")) o.default = 0 o:depends({ [_n("protocol")] = "hysteria2" }) diff --git a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua index f367a01c..d45dc4ad 100644 --- a/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua +++ b/luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua @@ -163,6 +163,12 @@ if singbox_tags:find("with_quic") then o = s:option(Value, _n("hysteria2_realm_url"), translate("Realm URL"), translate("Example:") .. "realm://public@realm.hy2.io/your-realm-name") o:depends({ [_n("hysteria2_realms")] = "1" }) + o.validate = function(self, value) + value = api.trim(value) + local realm = api.parse_realm_uri(value) + if realm then return value end + return nil, translate("Invalid Realm URL.") + end o = s:option(DynamicList, _n("hysteria2_realm_stun"), translate("Realm STUN")) o.default = { "stun.sip.us:3478", "stun.nextcloud.com:3478", "global.stun.twilio.com:3478" } @@ -182,6 +188,18 @@ if singbox_tags:find("with_quic") then o:depends({ [_n("hysteria2_obfs_type")] = "salamander" }) o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Value, _n("hysteria2_obfs_MinPacketSize"), translate("Gecko Packet Size (min)")) + o.datatype = "uinteger" + o.placeholder = "512" + o.default = "512" + o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + + o = s:option(Value, _n("hysteria2_obfs_MaxPacketSize"), translate("Gecko Packet Size (max)")) + o.datatype = "uinteger" + o.placeholder = "1200" + o.default = "1200" + o:depends({ [_n("hysteria2_obfs_type")] = "gecko" }) + o = s:option(Flag, _n("hysteria2_ignore_client_bandwidth"), translate("Client BBR Flow Control"), translate("Commands the client to use the BBR flow control algorithm")) o.default = 0 o:depends({ [_n("protocol")] = "hysteria2" }) diff --git a/luci-app-passwall2/luasrc/passwall2/api.lua b/luci-app-passwall2/luasrc/passwall2/api.lua index e3519254..561b7555 100644 --- a/luci-app-passwall2/luasrc/passwall2/api.lua +++ b/luci-app-passwall2/luasrc/passwall2/api.lua @@ -367,6 +367,18 @@ function strToTable(str) return loadstring("return " .. str)() end +function is_timehhmm(timeStr) + local hour, minute = string.match(timeStr, "^(%d?%d):(%d%d)$") + if hour and minute then + hour = tonumber(hour) + minute = tonumber(minute) + if hour >= 0 and hour <= 23 and minute >= 0 and minute <= 59 then + return true + end + end + return false +end + function is_normal_node(e) if e and e.type and e.protocol and (e.protocol == "_balancing" or e.protocol == "_shunt" or e.protocol == "_iface" or e.protocol == "_urltest") then return false @@ -1449,7 +1461,7 @@ function luci_types(id, m, s, type_name, option_prefix) end end end -function format_go_time(input) +function format_go_time(input, default) input = input and trim(input) local N = 0 if input and input:match("^%d+$") then @@ -1467,7 +1479,7 @@ function format_go_time(input) end end if N <= 0 then - return "0s" + return default or "0s" end local result = "" local h = math.floor(N / 3600) @@ -1610,22 +1622,34 @@ function get_dnsmasq_server_domain() end function parse_realm_uri(uri) - if type(uri) ~= "string" then return nil end + uri = trim(uri) + if uri == "" then return nil end -- realm[+http]://token@server/realm_id?query - local scheme, token, server_url, realm_id, query = trim(uri):match("^(realm%+http|realm)://([^@]+)@([^/]+)/([^?]*)%??(.*)$") - if not scheme or not token or not server_url or not realm_id then return nil end + local scheme = (uri:match("^realm%+http://") and "realm+http") or (uri:match("^realm://") and "realm") + if not scheme then return nil end + uri = uri:gsub("^realm%+http://", ""):gsub("^realm://", "") + local token, server_url, realm_id, query = uri:match("^([^@]+)@([^/]+)/([^?]*)%??(.*)$") + if not token or not server_url or not realm_id then return nil end realm_id = realm_id:gsub("/+$", "") + local address, port = server_url:match("^%[([^%]]+)%]:(%d+)$") --ipv6:port + if not address then + address, port = server_url:match("^([^:]+):(%d+)$") --ipv4[domain]:port + end + address = address or server_url:match("^%[([^%]]+)%]$") or server_url + port = tonumber(port) or (scheme == "realm+http" and 80 or 443) local realm = { scheme = scheme, token = token, server_url = server_url, + address = address, + port = port, realm_id = realm_id } -- Parse stun= in the query local stun_servers - for value in (query or ""):gmatch("[?&]?[Ss][Tt][Uu][Nn]=([^&]+)") do - if not stun_servers then stun_servers = {} end - stun_servers[#stun_servers + 1] = value + for v in (query or ""):gmatch("[Ss][Tt][Uu][Nn]=([^&]+)") do + stun_servers = stun_servers or {} + stun_servers[#stun_servers + 1] = v end realm.stun_servers = stun_servers return realm diff --git a/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua b/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua index 48673249..de2a1f2d 100644 --- a/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua +++ b/luci-app-passwall2/luasrc/passwall2/util_hysteria2.lua @@ -39,6 +39,18 @@ function gen_config_server(node) stunServers = node.hysteria2_realm_stun } or nil } + + if config.obfs and config.obfs.gecko then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + config.obfs.gecko.minPacketSize = min + config.obfs.gecko.maxPacketSize = max + end + return config end @@ -145,6 +157,17 @@ function gen_config(var) } or nil } + if config.obfs and config.obfs.gecko then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + config.obfs.gecko.minPacketSize = min + config.obfs.gecko.maxPacketSize = max + end + return jsonc.stringify(config, 1) end diff --git a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua index 39580747..bbb5e872 100644 --- a/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua +++ b/luci-app-passwall2/luasrc/passwall2/util_sing-box.lua @@ -327,8 +327,6 @@ function gen_outbound(flag, node, tag, proxy_table) headers = node.user_agent and { ["User-Agent"] = node.user_agent } or nil, - idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil, - ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil, } -- TLS is not enforced. If TLS is not configured, plain HTTP 1.1 will be used. end @@ -341,8 +339,8 @@ function gen_outbound(flag, node, tag, proxy_table) headers = node.user_agent and { ["User-Agent"] = node.user_agent } or nil, - idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil, - ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil, + idle_timeout = (node.http_h2_health_check == "1") and api.format_go_time(node.http_h2_read_idle_timeout, "15s") or nil, + ping_timeout = (node.http_h2_health_check == "1") and api.format_go_time(node.http_h2_health_check_timeout, "15s") or nil, } -- TLS is not enforced. If TLS is not configured, plain HTTP 1.1 will be used. end @@ -382,8 +380,8 @@ function gen_outbound(flag, node, tag, proxy_table) v2ray_transport = { type = "grpc", service_name = node.grpc_serviceName, - idle_timeout = tonumber(node.grpc_idle_timeout) or nil, - ping_timeout = tonumber(node.grpc_health_check_timeout) or nil, + idle_timeout = (node.grpc_health_check == "1") and api.format_go_time(node.grpc_idle_timeout, "15s") or nil, + ping_timeout = (node.grpc_health_check == "1") and api.format_go_time(node.grpc_health_check_timeout, "15s") or nil, permit_without_stream = (node.grpc_permit_without_stream == "1") and true or nil, } end @@ -595,20 +593,34 @@ function gen_outbound(flag, node, tag, proxy_table) hop_interval_max = interval_max, up_mbps = (node.hysteria2_up_mbps and tonumber(node.hysteria2_up_mbps)) and tonumber(node.hysteria2_up_mbps) or nil, down_mbps = (node.hysteria2_down_mbps and tonumber(node.hysteria2_down_mbps)) and tonumber(node.hysteria2_down_mbps) or nil, - obfs = node.hysteria2_obfs_type and { - type = node.hysteria2_obfs_type, - password = node.hysteria2_obfs_password - } or nil, + obfs = (function(t) + if not t or t == "" then return nil end + local o = { + type = t, + password = node.hysteria2_obfs_password + } + if t == "gecko" then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + o.min_packet_size = min + o.max_packet_size = max + end + return o + end)(node.hysteria2_obfs_type), password = node.hysteria2_auth_password or nil, idle_timeout = (function(t) if not version_ge_1_14_0 then return nil end t = tonumber(tostring(t or "30"):match("^%d+")) - return (t and t >= 4 and t <= 120) and t or 30 + return (t and t >= 4 and t <= 120) and t .. "s" or "30s" end)(node.hysteria2_idle_timeout), keep_alive_period = (function(t) if not version_ge_1_14_0 then return nil end t = tonumber(tostring(t or "0"):match("^%d+")) - return (t and t >= 2 and t <= 60) and t or nil + return (t and t >= 2 and t <= 60) and t .. "s" or nil end)(node.hysteria2_keep_alive_period), disable_path_mtu_discovery = version_ge_1_14_0 and (tonumber(node.hysteria2_disable_mtu_discovery) == 1) or nil, tls = tls, @@ -620,6 +632,8 @@ function gen_outbound(flag, node, tag, proxy_table) realm.server_url = (realm.scheme == "realm+http" and "http://" or "https://") .. realm.server_url realm.stun_servers = realm.stun_servers or node.hysteria2_realm_stun realm.scheme = nil + realm.address = nil + realm.port = nil return realm end return nil @@ -945,10 +959,24 @@ function gen_config_server(node) protocol_table = { up_mbps = (node.hysteria2_ignore_client_bandwidth ~= "1" and node.hysteria2_up_mbps and tonumber(node.hysteria2_up_mbps)) and tonumber(node.hysteria2_up_mbps) or nil, down_mbps = (node.hysteria2_ignore_client_bandwidth ~= "1" and node.hysteria2_down_mbps and tonumber(node.hysteria2_down_mbps)) and tonumber(node.hysteria2_down_mbps) or nil, - obfs = node.hysteria2_obfs_type and { - type = node.hysteria2_obfs_type, - password = node.hysteria2_obfs_password - } or nil, + obfs = (function(t) + if not t or t == "" then return nil end + local o = { + type = t, + password = node.hysteria2_obfs_password + } + if t == "gecko" then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + o.min_packet_size = min + o.max_packet_size = max + end + return o + end)(node.hysteria2_obfs_type), users = { { name = "user1", @@ -963,6 +991,8 @@ function gen_config_server(node) realm.server_url = (realm.scheme == "realm+http" and "http://" or "https://") .. realm.server_url realm.stun_servers = realm.stun_servers or node.hysteria2_realm_stun realm.scheme = nil + realm.address = nil + realm.port = nil realm.stun_domain_resolver = "direct" return realm end diff --git a/luci-app-passwall2/luasrc/passwall2/util_xray.lua b/luci-app-passwall2/luasrc/passwall2/util_xray.lua index 8702176e..6bb03c23 100644 --- a/luci-app-passwall2/luasrc/passwall2/util_xray.lua +++ b/luci-app-passwall2/luasrc/passwall2/util_xray.lua @@ -14,6 +14,8 @@ local GLOBAL = { local xray_version = api.get_app_version("xray") +local xray_min_version = "26.3.27" + local function get_domain_excluded() local path = string.format("/usr/share/%s/domains_excluded", appname) local content = fs.readfile(path) @@ -308,10 +310,18 @@ function gen_outbound(flag, node, tag, proxy_table) local o = { type = "salamander", settings = node.hysteria2_obfs_password and { - password = node.hysteria2_obfs_password, - packetSize = node.hysteria2_obfs_type == "gecko" and "512-1200" or nil + password = node.hysteria2_obfs_password } or nil } + if node.hysteria2_obfs_type == "gecko" then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + o.settings.packetSize = min .. "-" .. max + end udp[#udp+1] = o end if node.hysteria2_realms then @@ -413,6 +423,14 @@ function gen_outbound(flag, node, tag, proxy_table) } } + if node.protocol == "hysteria" and node.hysteria2_realms then + local realm = api.parse_realm_uri(node.hysteria2_realm_url) + if realm then + result.settings.address = realm.address + result.settings.port = realm.port + end + end + if node.protocol == "wireguard" then result.settings.noKernelTun = true if node.finalmask and node.finalmask ~= "" then @@ -736,10 +754,18 @@ function gen_config_server(node) local o = { type = "salamander", settings = node.hysteria2_obfs_password and { - password = node.hysteria2_obfs_password, - packetSize = node.hysteria2_obfs_type == "gecko" and "512-1200" or nil + password = node.hysteria2_obfs_password } or nil } + if node.hysteria2_obfs_type == "gecko" then + local min = tonumber(node.hysteria2_obfs_MinPacketSize) or 512 + local max = tonumber(node.hysteria2_obfs_MaxPacketSize) or 1200 + if min <= 0 or min > max or max > 2048 then + min = 512 + max = 1200 + end + o.settings.packetSize = min .. "-" .. max + end udp[#udp+1] = o end if node.hysteria2_realms then @@ -784,7 +810,10 @@ function gen_config_server(node) } }, outbounds = outbounds, - routing = routing + routing = routing, + version = { + min = xray_min_version + } } local alpn = {} @@ -881,13 +910,21 @@ function gen_config(var) local xray_settings = uci:get_all(appname, "@global_xray[0]") or {} if xray_settings.fragment == "1" then - local delay = xray_settings.fragment_delay + local lengths, delays = {}, {} + api.trim(xray_settings.fragment_lengths):gsub("[^,]+", function(w) + w = w:gsub("%s+", "") + if w ~= "" then lengths[#lengths+1] = w end + end) + api.trim(xray_settings.fragment_delays):gsub("[^,]+", function(w) + w = w:gsub("%s+", "") + if w ~= "" then delays[#delays+1] = w end + end) fragment_table = { type = "fragment", settings = { packets = xray_settings.fragment_packets, - length = xray_settings.fragment_length, - delay = delay and (delay:find("-", 1, true) and delay or tonumber(delay)) or nil, + lengths = #lengths > 0 and lengths or nil, + delays = #delays > 0 and delays or nil, maxSplit = xray_settings.fragment_maxSplit } } @@ -1971,6 +2008,10 @@ function gen_config(var) if inbounds or outbounds then local config = { + env = (function() + local asset_location = uci:get(appname, "@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/" + return { XRAY_LOCATION_ASSET = asset_location } + end)(), log = { --access = string.format("/tmp/etc/%s/%s_access.log", appname, "global"), --error = string.format("/tmp/etc/%s/%s_error.log", appname, "global"), @@ -2000,6 +2041,9 @@ function gen_config(var) -- statsInboundUplink = false, -- statsInboundDownlink = false -- } + }, + version = { + min = xray_min_version } } diff --git a/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm b/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm index 0dcbb559..7b31c08e 100644 --- a/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm +++ b/luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm @@ -1,7 +1,7 @@ +
<% -local api = require "luci.passwall2.api" -local com = require "luci.passwall2.com" -local version = {} +local api = self.api +local com = self.com -%> +
\ No newline at end of file diff --git a/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm b/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm index 28128380..f27e7a1f 100644 --- a/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm +++ b/luci-app-passwall2/luasrc/view/passwall2/node_config/link_share_man.htm @@ -552,8 +552,9 @@ local current_node = map:get(section) } params += "&type=" + v_transport; + var v_security = "none"; if (opt.get(dom_prefix + "tls").checked) { - var v_security = "tls"; + v_security = "tls"; if (opt.get(dom_prefix + "fingerprint") && opt.get(dom_prefix + "fingerprint").value != "") { let v_fp = opt.get(dom_prefix + "fingerprint").value; params += "&fp=" + v_fp; @@ -565,7 +566,6 @@ local current_node = map:get(section) params += opt.query("spx", dom_prefix + "reality_spiderX"); params += opt.query("pqv", dom_prefix + "reality_mldsa65Verify"); } - params += "&security=" + v_security; params += opt.query("alpn", dom_prefix + "alpn"); params += opt.query("sni", dom_prefix + "tls_serverName"); params += opt.query("allowinsecure", dom_prefix + "tls_allowInsecure"); @@ -573,6 +573,7 @@ local current_node = map:get(section) params += opt.query("vcn", dom_prefix + "tls_CertByName"); params += opt.query("ech", dom_prefix + "ech_config"); } + params += "&security=" + v_security; opt.get(dom_prefix + "tcp_fast_open")?.checked && (params += "&tfo=1"); if (opt.get(dom_prefix + "use_finalmask")?.checked) { @@ -598,10 +599,14 @@ local current_node = map:get(section) if (v_type === "Hysteria2") { v_password = opt.get("hysteria2_auth_password"); - var dom_obfs = opt.get("hysteria2_obfs_password"); - if (dom_obfs && dom_obfs.value != "") { + var dom_obfs_type = opt.get("hysteria2_obfs_type"); + if (dom_obfs_type && dom_obfs_type.value != "") { params += opt.query("obfs", "hysteria2_obfs_type"); params += opt.query("obfs-password", "hysteria2_obfs_password"); + if (dom_obfs_type.value === "gecko") { + params += opt.query("minPacketSize", "hysteria2_obfs_MinPacketSize"); + params += opt.query("maxPacketSize", "hysteria2_obfs_MaxPacketSize"); + } } params += opt.query("mport", "hysteria2_hop"); } else { @@ -610,6 +615,10 @@ local current_node = map:get(section) if (dom_obfs_type && dom_obfs_type.value != "") { params += opt.query("obfs", dom_prefix + "hysteria2_obfs_type"); params += opt.query("obfs-password", dom_prefix + "hysteria2_obfs_password"); + if (dom_obfs_type.value === "gecko") { + params += opt.query("minPacketSize", dom_prefix + "hysteria2_obfs_MinPacketSize"); + params += opt.query("maxPacketSize", dom_prefix + "hysteria2_obfs_MaxPacketSize"); + } } params += opt.query("mport", dom_prefix + "hysteria2_hop"); if (opt.get(dom_prefix + "use_finalmask")?.checked) { @@ -671,7 +680,7 @@ local current_node = map:get(section) params += "&security=" + v_security; params += opt.query("alpn", dom_prefix + "alpn"); params += opt.query("sni", dom_prefix + "tls_serverName"); - params += opt.query("allowinsecure", dom_prefix + "tls_allowInsecure"); + params += opt.query("insecure", dom_prefix + "tls_allowInsecure"); } params += "#" + encodeURI(v_alias.value); @@ -1295,17 +1304,37 @@ local current_node = map:get(section) } queryParam.security = queryParam.security || "tls"; - opt.set(dom_prefix + 'tls', queryParam.security === "tls"); - if (queryParam.security === "tls") { - opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || ""); - opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default'); - opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || ''); - opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || ''); + if (queryParam.security == "tls" || queryParam.security == "reality") { + if (queryParam.security == "tls") { + opt.set(dom_prefix + 'tls', true); + opt.set(dom_prefix + 'reality', false); + opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default'); + opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || ""); + if (queryParam.fp && queryParam.fp.trim() != "") { + opt.set(dom_prefix + 'utls', true); + opt.set(dom_prefix + 'fingerprint', queryParam.fp); + } + opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || ''); + opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || ''); + opt.set( + dom_prefix + 'tls_allowInsecure', + !((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0') + ); + } + if (queryParam.security == "reality") { + opt.set(dom_prefix + 'tls', true); + opt.set(dom_prefix + 'reality', true); + opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default'); + opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || ""); + if (queryParam.fp && queryParam.fp.trim() != "") { + opt.set(dom_prefix + 'utls', true); + opt.set(dom_prefix + 'fingerprint', queryParam.fp); + } + opt.set(dom_prefix + 'reality_publicKey', queryParam.pbk || ''); + opt.set(dom_prefix + 'reality_shortId', queryParam.sid || ''); + } } - opt.set( - dom_prefix + 'tls_allowInsecure', - !((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0') - ); + opt.set(dom_prefix + 'tcp_fast_open', queryParam.tfo); opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm); opt.set(dom_prefix + 'finalmask', queryParam.fm || ""); @@ -1417,11 +1446,9 @@ local current_node = map:get(section) } if (ssu[0] === "vless") { if (vless_type == "sing-box" && has_singbox) { - dom_prefix = "singbox_" - opt.set('type', "sing-box"); + dom_prefix = "singbox_"; } else { - dom_prefix = "xray_" - opt.set('type', "Xray"); + dom_prefix = "xray_"; } var m = parseNodeUrl(ssrurl); @@ -1444,20 +1471,22 @@ local current_node = map:get(section) queryParam.type = queryParam.type.toLowerCase(); if (["xhttp", "kcp", "mkcp"].includes(queryParam.type) && vless_type !== "xray" && has_xray) { - dom_prefix = "xray_" - opt.set('type', "Xray"); + dom_prefix = "xray_"; } + opt.set("type", dom_prefix === "singbox_" ? "sing-box" : "Xray"); + opt.set(dom_prefix + 'protocol', "vless"); opt.set(dom_prefix + 'uuid', password); opt.set(dom_prefix + 'address', unbracketIP(m.hostname)); opt.set(dom_prefix + 'port', m.port || "443"); opt.set(dom_prefix + 'encryption', queryParam.encryption || "none"); - opt.set(dom_prefix + 'flow', queryParam.flow || ''); + queryParam.security = (!queryParam.security && queryParam.flow) ? "tls" : queryParam.security; if (queryParam.security) { if (queryParam.security == "tls") { opt.set(dom_prefix + 'tls', true); opt.set(dom_prefix + 'reality', false); + opt.set(dom_prefix + 'flow', queryParam.flow || ''); opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default'); opt.set(dom_prefix + 'tls_serverName', queryParam.sni || ''); opt.set( @@ -1477,6 +1506,7 @@ local current_node = map:get(section) if (queryParam.security == "reality") { opt.set(dom_prefix + 'tls', true); opt.set(dom_prefix + 'reality', true); + opt.set(dom_prefix + 'flow', queryParam.flow || ''); opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default'); opt.set(dom_prefix + 'tls_serverName', queryParam.sni || ''); if (queryParam.fp && queryParam.fp.trim() != "") { @@ -1601,6 +1631,10 @@ local current_node = map:get(section) opt.set(dom_prefix + 'hysteria2_obfs_type', queryParam.obfs || "salamander"); opt.set(dom_prefix + 'hysteria2_obfs_password', queryParam["obfs-password"] || queryParam["obfs_password"]); } + if (queryParam.obfs === "gecko") { + opt.set(dom_prefix + 'hysteria2_obfs_MinPacketSize', queryParam.minPacketSize || "512"); + opt.set(dom_prefix + 'hysteria2_obfs_MaxPacketSize', queryParam.maxPacketSize || "1200"); + } opt.set(dom_prefix + 'hysteria2_hop', queryParam.mport || ""); opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm); opt.set(dom_prefix + 'finalmask', queryParam.fm || ""); @@ -1612,6 +1646,10 @@ local current_node = map:get(section) opt.set(dom_prefix + 'obfs_type', queryParam.obfs || "salamander"); opt.set(dom_prefix + 'obfs_password', queryParam["obfs-password"] || queryParam["obfs_password"]); } + if (queryParam.obfs === "gecko") { + opt.set(dom_prefix + 'obfs_MinPacketSize', queryParam.minPacketSize || "512"); + opt.set(dom_prefix + 'obfs_MaxPacketSize', queryParam.maxPacketSize || "1200"); + } opt.set(dom_prefix + 'hop', queryParam.mport || ""); } @@ -1704,9 +1742,7 @@ local current_node = map:get(section) queryParam[decodeURIComponent(params[0]).toLowerCase()] = decodeURIComponent(params[1] || ''); } } - if (!queryParam.security || queryParam.security == "") { - queryParam.security = "tls"; - } + queryParam.security = queryParam.security || "tls"; if (queryParam.security) { if (queryParam.security == "tls") { opt.set(dom_prefix + 'tls', true); diff --git a/luci-app-passwall2/po/fa/passwall2.po b/luci-app-passwall2/po/fa/passwall2.po index d30d9d94..f464183a 100644 --- a/luci-app-passwall2/po/fa/passwall2.po +++ b/luci-app-passwall2/po/fa/passwall2.po @@ -672,8 +672,8 @@ msgstr "واحد: دقیقه" msgid "stop automatically mode" msgstr "حالت توقف خودکار" -msgid "stop Time(Every day)" -msgstr "زمان توقف (هر روز)" +msgid "stop Time" +msgstr "زمان را متوقف کنید" msgid "stop Interval(Hour)" msgstr "بازه توقف (ساعت)" @@ -681,8 +681,8 @@ msgstr "بازه توقف (ساعت)" msgid "start automatically mode" msgstr "حالت شروع خودکار" -msgid "start Time(Every day)" -msgstr "زمان شروع (هر روز)" +msgid "start Time" +msgstr "زمان شروع" msgid "start Interval(Hour)" msgstr "بازه شروع (ساعت)" @@ -690,8 +690,8 @@ msgstr "بازه شروع (ساعت)" msgid "restart automatically mode" msgstr "حالت راه‌اندازی مجدد خودکار" -msgid "restart Time(Every day)" -msgstr "زمان راه‌اندازی مجدد (هر روز)" +msgid "restart Time" +msgstr "زمان راه اندازی مجدد" msgid "restart Interval(Hour)" msgstr "بازه راه‌اندازی مجدد (ساعت)" @@ -756,11 +756,11 @@ msgstr "ربودن ICMP (PING)" msgid "Hijacking ICMPv6 (IPv6 PING)" msgstr "ربودن ICMPv6 (IPv6 PING)" -msgid "Force Proxy LAN IP" -msgstr "IP پروکسی LAN را مجبور کنید" +msgid "Direct IP List" +msgstr "لیست آی‌پی‌های مستقیم" -msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here." -msgstr "به طور پیش‌فرض، محدوده‌های IP شبکه داخلی که معمولاً استفاده می‌شوند، مستقیماً متصل می‌شوند (و وارد هسته نمی‌شوند). اگر می‌خواهید محدوده شبکه خاصی از طریق پروکسی عبور کند، لطفاً آن را اینجا اضافه کنید." +msgid "These had been joined ip addresses will connect directly (not entering the core)." +msgstr "این آدرس‌های IP که به هم متصل شده‌اند، مستقیماً متصل می‌شوند (و وارد هسته نمی‌شوند)." msgid "Sniffing" msgstr "شنود (Sniffing)" @@ -897,17 +897,14 @@ msgstr "بازگردانی" msgid "Rollbacking..." msgstr "در حال بازگردانی..." -msgid "Enable auto update rules" -msgstr "فعال‌سازی به‌روزرسانی خودکار قوانین" - -msgid "Update Time(every day)" -msgstr "زمان به‌روزرسانی (هر روز)" +msgid "Update Time" +msgstr "زمان به‌روزرسانی" msgid "Update Interval(hour)" msgstr "بازه به‌روزرسانی (ساعت)" -msgid "Update Mode" -msgstr "حالت به‌روزرسانی" +msgid "Auto Update Mode" +msgstr "حالت به‌روزرسانی خودکار" msgid "Loop Mode" msgstr "حالت حلقه" @@ -1005,9 +1002,6 @@ msgstr "در حال انتقال..." msgid "App Update" msgstr "به‌روزرسانی برنامه" -msgid "Please confirm that your firmware supports FPU." -msgstr "لطفاً تأیید کنید که سیستم‌عامل شما از FPU پشتیبانی می‌کند." - msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually." msgstr "اگر می‌خواهید از حافظه اجرا کنید، مسیر را تغییر دهید، با /tmp شروع شود سپس برنامه را ذخیره و دستی به‌روزرسانی کنید." @@ -2394,3 +2388,12 @@ msgstr "اشتراک کامل شد..." msgid "Processing, please wait…" msgstr "در حال پردازش، لطفا صبر کنید…" + +msgid "Invalid Realm URL." +msgstr "آدرس اینترنتی (URL) نامعتبر است." + +msgid "Gecko Packet Size (min)" +msgstr "اندازه بسته Gecko (دقیقه)" + +msgid "Gecko Packet Size (max)" +msgstr "اندازه بسته Gecko (حداکثر)" \ No newline at end of file diff --git a/luci-app-passwall2/po/ru/passwall2.po b/luci-app-passwall2/po/ru/passwall2.po index 7b8e83d1..1465593f 100644 --- a/luci-app-passwall2/po/ru/passwall2.po +++ b/luci-app-passwall2/po/ru/passwall2.po @@ -673,8 +673,8 @@ msgstr "Единица: минуты" msgid "stop automatically mode" msgstr "Режим автоотключения" -msgid "stop Time(Every day)" -msgstr "Время отключения (ежедневно)" +msgid "stop Time" +msgstr "Время отключения" msgid "stop Interval(Hour)" msgstr "Интервал отключения (часы)" @@ -682,8 +682,8 @@ msgstr "Интервал отключения (часы)" msgid "start automatically mode" msgstr "Режим автозапуска" -msgid "start Time(Every day)" -msgstr "Время запуска (ежедневно)" +msgid "start Time" +msgstr "Время запуска" msgid "start Interval(Hour)" msgstr "Интервал запуска (часы)" @@ -691,8 +691,8 @@ msgstr "Интервал запуска (часы)" msgid "restart automatically mode" msgstr "Режим автоперезапуска" -msgid "restart Time(Every day)" -msgstr "Время перезапуска (ежедневно)" +msgid "restart Time" +msgstr "Время перезапуска" msgid "restart Interval(Hour)" msgstr "Интервал перезапуска (часы)" @@ -757,11 +757,11 @@ msgstr "Перехват ICMP (PING)" msgid "Hijacking ICMPv6 (IPv6 PING)" msgstr "Перехват ICMPv6 (IPv6 PING)" -msgid "Force Proxy LAN IP" -msgstr "Принудительное использование IP-адреса локальной сети (Local IP)" +msgid "Direct IP List" +msgstr "Список прямых IP-адресов" -msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here." -msgstr "По умолчанию, часто используемые диапазоны IP-адресов внутренней сети будут подключаться напрямую (без доступа к ядру сети). Если вы хотите, чтобы определенный диапазон IP-адресов сети проходил через прокси-сервер, укажите это здесь." +msgid "These had been joined ip addresses will connect directly (not entering the core)." +msgstr "Эти объединенные IP-адреса будут подключаться напрямую (не входя в ядро ​​сети)." msgid "Sniffing" msgstr "Анализ трафика" @@ -898,17 +898,14 @@ msgstr "Откатить" msgid "Rollbacking..." msgstr "Выполняется откат..." -msgid "Enable auto update rules" -msgstr "Автообновление правил" - -msgid "Update Time(every day)" -msgstr "Время обновления (ежедневно)" +msgid "Update Time" +msgstr "Время обновления" msgid "Update Interval(hour)" msgstr "Интервал обновления (часы)" -msgid "Update Mode" -msgstr "Режим обновления" +msgid "Auto Update Mode" +msgstr "Режим автоматического обновления" msgid "Loop Mode" msgstr "Циклический" @@ -1006,9 +1003,6 @@ msgstr "Перемещение..." msgid "App Update" msgstr "Обновление компонентов" -msgid "Please confirm that your firmware supports FPU." -msgstr "Убедитесь, что ваша прошивка поддерживает FPU." - msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually." msgstr "Если вы хотите запускать из оперативной памяти, измените путь на начинающийся с /tmp, затем сохраните настройки и обновите компонент вручную." @@ -2392,3 +2386,12 @@ msgstr "Подписка завершена..." msgid "Processing, please wait…" msgstr "Обработка, пожалуйста, подождите…" + +msgid "Invalid Realm URL." +msgstr "Неверный URL-адрес области." + +msgid "Gecko Packet Size (min)" +msgstr "Размер упаковки Gecko (мин)" + +msgid "Gecko Packet Size (max)" +msgstr "Размер упаковки Gecko (макс)" diff --git a/luci-app-passwall2/po/zh-cn/passwall2.po b/luci-app-passwall2/po/zh-cn/passwall2.po index e2aab053..4949ab1d 100644 --- a/luci-app-passwall2/po/zh-cn/passwall2.po +++ b/luci-app-passwall2/po/zh-cn/passwall2.po @@ -581,10 +581,10 @@ msgid "Certificate fingerprint" msgstr "证书指纹" msgid "Max upload Mbps" -msgstr "最大上行(Mbps)" +msgstr "最大上行（Mbps）" msgid "Max download Mbps" -msgstr "最大下行(Mbps)" +msgstr "最大下行（Mbps）" msgid "QUIC stream receive window" msgstr "QUIC 流接收窗口" @@ -664,8 +664,8 @@ msgstr "单位：分钟" msgid "stop automatically mode" msgstr "定时关闭模式" -msgid "stop Time(Every day)" -msgstr "关闭时间(每天)" +msgid "stop Time" +msgstr "关闭时间" msgid "stop Interval(Hour)" msgstr "关闭间隔(小时)" @@ -673,8 +673,8 @@ msgstr "关闭间隔(小时)" msgid "start automatically mode" msgstr "定时开启模式" -msgid "start Time(Every day)" -msgstr "开启时间(每天)" +msgid "start Time" +msgstr "开启时间" msgid "start Interval(Hour)" msgstr "开启间隔(小时)" @@ -682,8 +682,8 @@ msgstr "开启间隔(小时)" msgid "restart automatically mode" msgstr "定时重启模式" -msgid "restart Time(Every day)" -msgstr "重启时间(每天)" +msgid "restart Time" +msgstr "重启时间" msgid "restart Interval(Hour)" msgstr "重启间隔(小时)" @@ -748,11 +748,11 @@ msgstr "劫持ICMP (PING)" msgid "Hijacking ICMPv6 (IPv6 PING)" msgstr "劫持ICMPv6 (IPv6 PING)" -msgid "Force Proxy LAN IP" -msgstr "强制代理内网IP段" +msgid "Direct IP List" +msgstr "直连 IP 列表" -msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here." -msgstr "默认情况下，常用内网IP网段将直连（不进入内核），如果你希望某个网段走代理，请在此添加。" +msgid "These had been joined ip addresses will connect directly (not entering the core)." +msgstr "加入的IP段将直连（不进入内核）。" msgid "Sniffing" msgstr "流量嗅探" @@ -889,17 +889,14 @@ msgstr "回滚" msgid "Rollbacking..." msgstr "回滚中..." -msgid "Enable auto update rules" -msgstr "开启自动更新规则" - -msgid "Update Time(every day)" -msgstr "更新时间(每天)" +msgid "Update Time" +msgstr "更新时间" msgid "Update Interval(hour)" msgstr "更新间隔(小时)" -msgid "Update Mode" -msgstr "更新模式" +msgid "Auto Update Mode" +msgstr "自动更新模式" msgid "Loop Mode" msgstr "循环" @@ -997,9 +994,6 @@ msgstr "移动中" msgid "App Update" msgstr "组件更新" -msgid "Please confirm that your firmware supports FPU." -msgstr "请确认你的固件支持FPU。" - msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually." msgstr "如果你希望从内存中运行，请更改路径，/tmp 开头，然后保存应用后，再手动更新。" @@ -2380,3 +2374,12 @@ msgstr "订阅完毕..." msgid "Processing, please wait…" msgstr "正在处理，请稍候。" + +msgid "Invalid Realm URL." +msgstr "Realm URL 不正确。" + +msgid "Gecko Packet Size (min)" +msgstr "Gecko 包大小（最小）" + +msgid "Gecko Packet Size (max)" +msgstr "Gecko 包大小（最大）" diff --git a/luci-app-passwall2/po/zh-tw/passwall2.po b/luci-app-passwall2/po/zh-tw/passwall2.po index 2c5f7f3e..c82781b9 100644 --- a/luci-app-passwall2/po/zh-tw/passwall2.po +++ b/luci-app-passwall2/po/zh-tw/passwall2.po @@ -581,10 +581,10 @@ msgid "Certificate fingerprint" msgstr "證書指紋" msgid "Max upload Mbps" -msgstr "最大上行(Mbps)" +msgstr "最大上行（Mbps）" msgid "Max download Mbps" -msgstr "最大下行(Mbps)" +msgstr "最大下行（Mbps）" msgid "QUIC stream receive window" msgstr "QUIC 流接收窗口" @@ -664,8 +664,8 @@ msgstr "單位：分鐘" msgid "stop automatically mode" msgstr "定時關閉模式" -msgid "stop Time(Every day)" -msgstr "關閉時間(每天)" +msgid "stop Time" +msgstr "關閉時間" msgid "stop Interval(Hour)" msgstr "關閉間隔(小時)" @@ -673,8 +673,8 @@ msgstr "關閉間隔(小時)" msgid "start automatically mode" msgstr "定時開啟模式" -msgid "start Time(Every day)" -msgstr "開啟時間(每天)" +msgid "start Time" +msgstr "開啟時間" msgid "start Interval(Hour)" msgstr "開啟間隔(小時)" @@ -682,8 +682,8 @@ msgstr "開啟間隔(小時)" msgid "restart automatically mode" msgstr "定時重啟模式" -msgid "restart Time(Every day)" -msgstr "重啟時間(每天)" +msgid "restart Time" +msgstr "重啟時間" msgid "restart Interval(Hour)" msgstr "重啟間隔(小時)" @@ -748,11 +748,11 @@ msgstr "劫持ICMP (PING)" msgid "Hijacking ICMPv6 (IPv6 PING)" msgstr "劫持ICMPv6 (IPv6 PING)" -msgid "Force Proxy LAN IP" -msgstr "強制代理內網IP段" +msgid "Direct IP List" +msgstr "直連 IP 列表" -msgid "By default, commonly used internal network IP ranges will be connect directly (not entering the core). If you want a certain network range to go through a proxy, please add it here." -msgstr "預設情況下，常用內網IP網段將直連（不進入核心），如果你希望某個網段走代理，請在此新增。" +msgid "These had been joined ip addresses will connect directly (not entering the core)." +msgstr "加入的IP段将直接連接（不進入内核）。" msgid "Sniffing" msgstr "流量嗅探" @@ -889,17 +889,14 @@ msgstr "回滾" msgid "Rollbacking..." msgstr "回滾中..." -msgid "Enable auto update rules" -msgstr "開啟自動更新規則" - -msgid "Update Time(every day)" -msgstr "更新時間(每天)" +msgid "Update Time" +msgstr "更新時間" msgid "Update Interval(hour)" msgstr "更新間隔(小時)" -msgid "Update Mode" -msgstr "更新模式" +msgid "Auto Update Mode" +msgstr "自動更新模式" msgid "Loop Mode" msgstr "循环" @@ -997,9 +994,6 @@ msgstr "移動中" msgid "App Update" msgstr "组件更新" -msgid "Please confirm that your firmware supports FPU." -msgstr "請確認你的固件支持FPU。" - msgid "if you want to run from memory, change the path, /tmp beginning then save the application and update it manually." msgstr "如果你希望从內存中運行，請更改路径，/tmp 開头，然後保存應用後，再手動更新。" @@ -2386,3 +2380,12 @@ msgstr "訂閱完毕..." msgid "Processing, please wait…" msgstr "正在處理，請稍候。" + +msgid "Invalid Realm URL." +msgstr "Realm URL 不正確。" + +msgid "Gecko Packet Size (min)" +msgstr "Gecko 包大小（最小）" + +msgid "Gecko Packet Size (max)" +msgstr "Gecko 包大小（最大）" diff --git a/luci-app-passwall2/root/usr/share/passwall2/0_default_config b/luci-app-passwall2/root/usr/share/passwall2/0_default_config index 5dc1def0..16aa35f0 100644 --- a/luci-app-passwall2/root/usr/share/passwall2/0_default_config +++ b/luci-app-passwall2/root/usr/share/passwall2/0_default_config @@ -42,7 +42,6 @@ config global_other option show_node_info '0' config global_rules - option auto_update '0' option geosite_update '1' option geoip_update '1' option v2ray_location_asset '/usr/share/v2ray/' diff --git a/luci-app-passwall2/root/usr/share/passwall2/app.sh b/luci-app-passwall2/root/usr/share/passwall2/app.sh index 11161f1a..da00585d 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/app.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/app.sh @@ -815,34 +815,32 @@ start_crontab() { stop_week_mode=$(config_t_get global_delay stop_week_mode) stop_time_mode=$(config_t_get global_delay stop_time_mode) if [ -n "$stop_week_mode" ]; then - local t="0 $stop_time_mode * * $stop_week_mode" - [ "$stop_week_mode" = "7" ] && t="0 $stop_time_mode * * *" - if [ "$stop_week_mode" = "8" ]; then - update_loop=1 - else - echo "$t /etc/init.d/$CONFIG stop > /dev/null 2>&1 &" >>/etc/crontabs/root - fi + stop_time_hh=$(echo $stop_time_mode | awk -F ':' '{print $1}') + stop_time_mm=$(echo $stop_time_mode | awk -F ':' '{print $2}') + local t="$stop_time_mm $stop_time_hh * * $stop_week_mode" + [ "$stop_week_mode" = "7" ] && t="$stop_time_mm $stop_time_hh * * *" + echo "$t /etc/init.d/$CONFIG stop > /dev/null 2>&1 &" >>/etc/crontabs/root log_i18n 0 "Scheduled tasks: Auto stop service." fi start_week_mode=$(config_t_get global_delay start_week_mode) start_time_mode=$(config_t_get global_delay start_time_mode) if [ -n "$start_week_mode" ]; then - local t="0 $start_time_mode * * $start_week_mode" - [ "$start_week_mode" = "7" ] && t="0 $start_time_mode * * *" - if [ "$start_week_mode" = "8" ]; then - update_loop=1 - else - echo "$t /etc/init.d/$CONFIG start > /dev/null 2>&1 &" >>/etc/crontabs/root - fi + start_time_hh=$(echo $start_time_mode | awk -F ':' '{print $1}') + start_time_mm=$(echo $start_time_mode | awk -F ':' '{print $2}') + local t="$start_time_mm $start_time_hh * * $start_week_mode" + [ "$start_week_mode" = "7" ] && t="$start_time_mm $start_time_hh * * *" + echo "$t /etc/init.d/$CONFIG start > /dev/null 2>&1 &" >>/etc/crontabs/root log_i18n 0 "Scheduled tasks: Auto start service." fi restart_week_mode=$(config_t_get global_delay restart_week_mode) restart_time_mode=$(config_t_get global_delay restart_time_mode) if [ -n "$restart_week_mode" ]; then - local t="0 $restart_time_mode * * $restart_week_mode" - [ "$restart_week_mode" = "7" ] && t="0 $restart_time_mode * * *" + restart_time_hh=$(echo $restart_time_mode | awk -F ':' '{print $1}') + restart_time_mm=$(echo $restart_time_mode | awk -F ':' '{print $2}') + local t="$restart_time_mm $restart_time_hh * * $restart_week_mode" + [ "$restart_week_mode" = "7" ] && t="$restart_time_mm $restart_time_hh * * *" if [ "$restart_week_mode" = "8" ]; then update_loop=1 else @@ -851,13 +849,14 @@ start_crontab() { log_i18n 0 "Scheduled tasks: Auto restart service." fi - autoupdate=$(config_t_get global_rules auto_update) - weekupdate=$(config_t_get global_rules week_update) - dayupdate=$(config_t_get global_rules time_update) - if [ "$autoupdate" = "1" ]; then - local t="0 $dayupdate * * $weekupdate" - [ "$weekupdate" = "7" ] && t="0 $dayupdate * * *" - if [ "$weekupdate" = "8" ]; then + rules_update_week_mode=$(config_t_get global_rules update_week_mode) + rules_update_time_mode=$(config_t_get global_rules update_time_mode) + if [ -n "$rules_update_week_mode" ]; then + rules_update_time_hh=$(echo $rules_update_time_mode | awk -F ':' '{print $1}') + rules_update_time_mm=$(echo $rules_update_time_mode | awk -F ':' '{print $2}') + local t="$rules_update_time_mm $rules_update_time_hh * * $rules_update_week_mode" + [ "$rules_update_week_mode" = "7" ] && t="$rules_update_time_mm $rules_update_time_hh * * *" + if [ "$rules_update_week_mode" = "8" ]; then update_loop=1 else echo "$t lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 &" >>/etc/crontabs/root @@ -868,24 +867,26 @@ start_crontab() { TMP_SUB_PATH=$TMP_PATH/sub_crontabs mkdir -p $TMP_SUB_PATH for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do - if [ "$(config_n_get $item auto_update 0)" = "1" ]; then + sub_update_week_mode=$(config_n_get $item update_week_mode) + if [ -n "$sub_update_week_mode" ]; then cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1) remark=$(config_n_get $item remark) - week_update=$(config_n_get $item week_update) - time_update=$(config_n_get $item time_update) - echo "$cfgid" >> $TMP_SUB_PATH/${week_update}_${time_update} + sub_update_time_mode=$(config_n_get $item update_time_mode) + echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_time_mode} log_i18n 0 "Scheduled tasks: Auto update [%s] subscription." "${remark}" fi done [ -d "${TMP_SUB_PATH}" ] && { for name in $(ls ${TMP_SUB_PATH}); do - week_update=$(echo $name | awk -F '_' '{print $1}') - time_update=$(echo $name | awk -F '_' '{print $2}') cfgids=$(echo -n $(cat ${TMP_SUB_PATH}/${name}) | sed 's# #,#g') - local t="0 $time_update * * $week_update" - [ "$week_update" = "7" ] && t="0 $time_update * * *" - if [ "$week_update" = "8" ]; then + sub_update_week_mode=$(echo $name | awk -F '_' '{print $1}') + sub_update_time_mode=$(echo $name | awk -F '_' '{print $2}') + sub_update_time_hh=$(echo $sub_update_time_mode | awk -F ':' '{print $1}') + sub_update_time_mm=$(echo $sub_update_time_mode | awk -F ':' '{print $2}') + local t="$sub_update_time_mm $sub_update_time_hh * * $sub_update_week_mode" + [ "$sub_update_week_mode" = "7" ] && t="$sub_update_time_mm $sub_update_time_hh * * *" + if [ "$sub_update_week_mode" = "8" ]; then update_loop=1 else echo "$t lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 &" >>/etc/crontabs/root @@ -1228,8 +1229,9 @@ stop() { kill -9 "$pid" >/dev/null 2>&1 fi done - busybox pgrep -f "sleep.*(6s|9s|58s)" | xargs kill -9 >/dev/null 2>&1 - busybox pgrep -af "${CONFIG}/" | awk '! /app\.sh|subscribe\.lua|rule_update\.lua|tasks\.sh|server_app\.lua|ujail/{print $1}' | xargs kill -9 >/dev/null 2>&1 + busybox pgrep -af "${CONFIG}/monitor\.sh" | xargs -r kill -9 >/dev/null 2>&1 + busybox pgrep -f "sleep.*(6s|9s|58s)" | xargs -r kill -9 >/dev/null 2>&1 + busybox pgrep -af "${CONFIG}/" | awk '! /app\.sh|subscribe\.lua|rule_update\.lua|tasks\.sh|server_app\.lua|ujail/{print $1}' | xargs -r kill -9 >/dev/null 2>&1 unset V2RAY_LOCATION_ASSET unset XRAY_LOCATION_ASSET unset SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN diff --git a/luci-app-passwall2/root/usr/share/passwall2/direct_ip b/luci-app-passwall2/root/usr/share/passwall2/direct_ip new file mode 100644 index 00000000..fb08bf79 --- /dev/null +++ b/luci-app-passwall2/root/usr/share/passwall2/direct_ip @@ -0,0 +1,13 @@ +0.0.0.0/8 +10.0.0.0/8 +100.64.0.0/10 +127.0.0.0/8 +169.254.0.0/16 +172.16.0.0/12 +192.168.0.0/16 +224.0.0.0/4 +240.0.0.0/4 +::/127 +fc00::/7 +fe80::/10 +ff00::/8 \ No newline at end of file diff --git a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh index c3843150..52be6721 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/iptables.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/iptables.sh @@ -4,14 +4,12 @@ DIR="$(cd "$(dirname "$0")" && pwd)" MY_PATH=$DIR/iptables.sh UTILS_PATH=$DIR/utils.sh IPSET_LOCAL="psw2_local" -IPSET_PROXY_LAN="psw2_proxy_lan" -IPSET_LAN="psw2_lan" +IPSET_DIRECT="psw2_direct" IPSET_VPS="psw2_vps" IPSET_WAN="psw2_wan" IPSET_LOCAL6="psw2_local6" -IPSET_PROXY_LAN6="psw2_proxy_lan6" -IPSET_LAN6="psw2_lan6" +IPSET_DIRECT6="psw2_direct6" IPSET_VPS6="psw2_vps6" IPSET_WAN6="psw2_wan6" @@ -204,8 +202,8 @@ gen_shunt_list() { _SHUNT_LIST4="${_SHUNT_LIST4} ${ipset_v4}:${outbound}" _SHUNT_LIST6="${_SHUNT_LIST6} ${ipset_v6}:${outbound}" - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $ipset_v4 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $ipset_v6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $ipset_v4 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $ipset_v6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R [ "${enable_geoview_ip}" = "1" ] && { local _geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') [ -n "$_geoip_code" ] && { @@ -392,27 +390,23 @@ load_acl() { fi [ "$accept_icmp" = "1" ] && { - $ipt_n -I PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(dst $IPSET_PROXY_LAN) $(REDIRECT) $ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} -d $FAKE_IP $(REDIRECT) add_shunt_t_rule "${shunt_list4}" "$ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source}" "$(REDIRECT)" $ipt_n -A PSW2 $(comment "$remarks") -p icmp ${_ipt_source} $(REDIRECT) } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { - $ip6t_n -I PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) $(REDIRECT) 2>/dev/null $ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} -d $FAKE_IP_6 $(REDIRECT) 2>/dev/null add_shunt_t_rule "${shunt_list6}" "$ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source}" "$(REDIRECT)" 2>/dev/null $ip6t_n -A PSW2 $(comment "$remarks") -p ipv6-icmp ${_ipt_source} $(REDIRECT) 2>/dev/null } - $ipt_tmp -I PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $IPSET_PROXY_LAN) ${ipt_j} $ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP ${ipt_j} add_shunt_t_rule "${shunt_list4}" "$ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" "${ipt_j}" $tcp_redir_ports add_port_rules "$ipt_tmp -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "${ipt_j}" [ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY) [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && { - $ip6t_m -I PSW2 $(comment "$remarks") -p tcp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE 2>/dev/null $ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null add_shunt_t_rule "${shunt_list6}" "$ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" "${ipt_j}" $tcp_redir_ports 2>/dev/null add_port_rules "$ip6t_m -A PSW2 $(comment "$remarks") -p tcp ${_ipt_source}" $tcp_redir_ports "-j PSW2_RULE" 2>/dev/null @@ -426,14 +420,12 @@ load_acl() { [ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && { msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "${node_remark}")(TPROXY:${redir_port})" - $ipt_m -I PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $IPSET_PROXY_LAN) -j PSW2_RULE $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP -j PSW2_RULE add_shunt_t_rule "${shunt_list4}" "$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" "-j PSW2_RULE" $udp_redir_ports add_port_rules "$ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "-j PSW2_RULE" $ipt_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $redir_port TPROXY) [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && { - $ip6t_m -I PSW2 $(comment "$remarks") -p udp ${_ipt_source} $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE 2>/dev/null $ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source} -d $FAKE_IP_6 -j PSW2_RULE 2>/dev/null add_shunt_t_rule "${shunt_list6}" "$ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" "-j PSW2_RULE" $udp_redir_ports 2>/dev/null add_port_rules "$ip6t_m -A PSW2 $(comment "$remarks") -p udp ${_ipt_source}" $udp_redir_ports "-j PSW2_RULE" 2>/dev/null @@ -498,27 +490,23 @@ load_acl() { fi [ "$accept_icmp" = "1" ] && { - $ipt_n -I PSW2 $(comment "${comment_d}") -p icmp $(dst $IPSET_PROXY_LAN) $(REDIRECT) $ipt_n -A PSW2 $(comment "${comment_d}") -p icmp -d $FAKE_IP $(REDIRECT) add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_n -A PSW2 $(comment "${comment_d}") -p icmp" "$(REDIRECT)" $ipt_n -A PSW2 $(comment "${comment_d}") -p icmp $(REDIRECT) } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { - $ip6t_n -I PSW2 $(comment "${comment_d}") -p ipv6-icmp $(dst $IPSET_PROXY_LAN6) $(REDIRECT) $ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT) add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp" "$(REDIRECT)" $ip6t_n -A PSW2 $(comment "${comment_d}") -p ipv6-icmp $(REDIRECT) } - $ipt_tmp -I PSW2 $(comment "${comment_d}") -p tcp $(dst $IPSET_PROXY_LAN) ${ipt_j} $ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp -d $FAKE_IP ${ipt_j} add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp" "${ipt_j}" $TCP_REDIR_PORTS add_port_rules "$ipt_tmp -A PSW2 $(comment "${comment_d}") -p tcp" $TCP_REDIR_PORTS "${ipt_j}" [ -n "${is_tproxy}" ] && $ipt_m -A PSW2 $(comment "${comment_d}") -p tcp $(REDIRECT $REDIR_PORT TPROXY) [ "$PROXY_IPV6" == "1" ] && { - $ip6t_m -I PSW2 $(comment "${comment_d}") -p tcp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE $ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp -d $FAKE_IP_6 -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp" "-j PSW2_RULE" $TCP_REDIR_PORTS add_port_rules "$ip6t_m -A PSW2 $(comment "${comment_d}") -p tcp" $TCP_REDIR_PORTS "-j PSW2_RULE" @@ -531,14 +519,12 @@ load_acl() { if [ "$UDP_PROXY_MODE" != "disable" ] && [ -n "$NODE" ]; then msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "$(config_n_get $NODE remarks)")(TPROXY:${REDIR_PORT})" - $ipt_m -I PSW2 $(comment "${comment_d}") -p udp $(dst $IPSET_PROXY_LAN) -j PSW2_RULE $ipt_m -A PSW2 $(comment "${comment_d}") -p udp -d $FAKE_IP -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_m -A PSW2 $(comment "${comment_d}") -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS add_port_rules "$ipt_m -A PSW2 $(comment "${comment_d}") -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE" $ipt_m -A PSW2 $(comment "${comment_d}") -p udp $(REDIRECT $REDIR_PORT TPROXY) [ "$PROXY_IPV6" == "1" ] && { - $ip6t_m -I PSW2 $(comment "${comment_d}") -p udp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE $ip6t_m -A PSW2 $(comment "${comment_d}") -p udp -d $FAKE_IP_6 -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2 $(comment "${comment_d}") -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS add_port_rules "$ip6t_m -A PSW2 $(comment "${comment_d}") -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE" @@ -633,27 +619,29 @@ add_firewall_rule() { log_i18n 0 "Starting to load %s firewall rules..." "iptables" ipset -! create $IPSET_LOCAL nethash maxelem 1048576 - ipset -! create $IPSET_PROXY_LAN nethash maxelem 1048576 - ipset -! create $IPSET_LAN nethash maxelem 1048576 + ipset -! create $IPSET_DIRECT nethash maxelem 1048576 ipset -! create $IPSET_VPS iphash maxelem 1048576 ipset -! create $IPSET_WAN nethash maxelem 1048576 ipset -! create $IPSET_LOCAL6 nethash family inet6 maxelem 1048576 - ipset -! create $IPSET_PROXY_LAN6 nethash family inet6 maxelem 1048576 - ipset -! create $IPSET_LAN6 nethash family inet6 maxelem 1048576 + ipset -! create $IPSET_DIRECT6 nethash family inet6 maxelem 1048576 ipset -! create $IPSET_VPS6 iphash family inet6 maxelem 1048576 ipset -! create $IPSET_WAN6 nethash family inet6 maxelem 1048576 get_local_ips ip4 | sed "s/^/add $IPSET_LOCAL /" | ipset -! -R get_local_ips ip6 | sed "s/^/add $IPSET_LOCAL6 /" | ipset -! -R - ipset -! -R <<-EOF - $(gen_lanlist | sed -e "s/^/add $IPSET_LAN /") - EOF - - ipset -! -R <<-EOF - $(gen_lanlist_6 | sed -e "s/^/add $IPSET_LAN6 /") - EOF + for ip in $(cat /usr/share/passwall2/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d"); do + if [[ "$ip" == *::* ]]; then + ipset -! add $IPSET_DIRECT6 $ip + elif [[ "$ip" == "geoip:"* ]]; then + local _geoip_code=$(echo $ip | awk -F ':' '{print $2}') + get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_DIRECT &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_DIRECT6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + else + ipset -! add $IPSET_DIRECT $ip + fi + done # Ignore special IP ranges local lan_ifname lan_ip @@ -665,11 +653,11 @@ add_firewall_rule() { #log_i18n 1 "local network segments (%s) direct connection: %s" "IPv6" "${lan_ip6}" [ -n "$lan_ip" ] && ipset -! -R <<-EOF - $(echo $lan_ip | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_LAN /") + $(echo $lan_ip | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_DIRECT /") EOF [ -n "$lan_ip6" ] && ipset -! -R <<-EOF - $(echo $lan_ip6 | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_LAN6 /") + $(echo $lan_ip6 | sed -e "s/ /\n/g" | sed -e "s/^/add $IPSET_DIRECT6 /") EOF } @@ -677,28 +665,18 @@ add_firewall_rule() { [ -n "$ISP_DNS" ] && { for ispip in $ISP_DNS; do - ipset -! add $IPSET_LAN $ispip + ipset -! add $IPSET_DIRECT $ispip log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv4" "${ispip}")" done } [ -n "$ISP_DNS6" ] && { for ispip6 in $ISP_DNS6; do - ipset -! add $IPSET_LAN6 $ispip6 + ipset -! add $IPSET_DIRECT6 $ispip6 log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv6" "${ispip6}")" done } - # Force proxy LAN IP CIDR - force_proxy_lan_ip=$(config_t_get global_forwarding force_proxy_lan_ip) - for ip in $force_proxy_lan_ip; do - if [[ "$ip" == *::* ]]; then - ipset -! add $IPSET_PROXY_LAN6 $ip - else - ipset -! add $IPSET_PROXY_LAN $ip - fi - done - # Shunt rules IP list (import when use shunt node) gen_shunt_list "${NODE}" SHUNT_LIST4 SHUNT_LIST6 @@ -724,7 +702,7 @@ add_firewall_rule() { fi $ipt_n -N PSW2 - $ipt_n -A PSW2 $(dst $IPSET_LAN) -j RETURN + $ipt_n -A PSW2 $(dst $IPSET_DIRECT) -j RETURN $ipt_n -A PSW2 $(dst $IPSET_VPS) -j RETURN $ipt_n -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN @@ -732,16 +710,16 @@ add_firewall_rule() { [ -z "${is_tproxy}" ] && insert_rule_after "$ipt_n" "PREROUTING" "prerouting_rule" "-p tcp -j PSW2" $ipt_n -N PSW2_OUTPUT - $ipt_n -A PSW2_OUTPUT $(dst $IPSET_LAN) -j RETURN + $ipt_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN $ipt_n -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN $ipt_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN $ipt_n -N PSW2_DNS if [ $(config_t_get global dns_redirect "1") = "0" ]; then #Only hijack when dest address is local IP - $ipt_n -I PREROUTING -m set --match-set $IPSET_LAN src $(dst $IPSET_LOCAL) -j PSW2_DNS + $ipt_n -I PREROUTING -m set --match-set $IPSET_DIRECT src $(dst $IPSET_LOCAL) -j PSW2_DNS else - $ipt_n -I PREROUTING -m set --match-set $IPSET_LAN src -j PSW2_DNS + $ipt_n -I PREROUTING -m set --match-set $IPSET_DIRECT src -j PSW2_DNS fi $ipt_m -N PSW2_DIVERT @@ -756,7 +734,7 @@ add_firewall_rule() { $ipt_m -A PSW2_RULE -j CONNMARK --save-mark $ipt_m -N PSW2 - $ipt_m -A PSW2 $(dst $IPSET_LAN) -j RETURN + $ipt_m -A PSW2 $(dst $IPSET_DIRECT) -j RETURN $ipt_m -A PSW2 $(dst $IPSET_VPS) -j RETURN $ipt_m -A PSW2 $(comment "WAN_IP_RETURN") $(dst $IPSET_WAN) -j RETURN $ipt_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN @@ -766,7 +744,7 @@ add_firewall_rule() { insert_rule_before "$ipt_m" "PREROUTING" "PSW2" "-p tcp -m socket -j PSW2_DIVERT" $ipt_m -N PSW2_OUTPUT - $ipt_m -A PSW2_OUTPUT $(dst $IPSET_LAN) -j RETURN + $ipt_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT) -j RETURN $ipt_m -A PSW2_OUTPUT $(dst $IPSET_VPS) -j RETURN $ipt_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN $ipt_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN @@ -776,12 +754,12 @@ add_firewall_rule() { [ "$accept_icmpv6" = "1" ] && { $ip6t_n -N PSW2 - $ip6t_n -A PSW2 $(dst $IPSET_LAN6) -j RETURN + $ip6t_n -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN $ip6t_n -A PSW2 $(dst $IPSET_VPS6) -j RETURN $ip6t_n -A PREROUTING -p ipv6-icmp -j PSW2 $ip6t_n -N PSW2_OUTPUT - $ip6t_n -A PSW2_OUTPUT $(dst $IPSET_LAN6) -j RETURN + $ip6t_n -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN $ip6t_n -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN $ip6t_n -A PSW2_OUTPUT -m mark --mark 255 -j RETURN } @@ -789,9 +767,9 @@ add_firewall_rule() { $ip6t_n -N PSW2_DNS if [ $(config_t_get global dns_redirect "1") = "0" ]; then #Only hijack when dest address is local IP - $ip6t_n -I PREROUTING -m set --match-set $IPSET_LAN6 src $(dst $IPSET_LOCAL6) -j PSW2_DNS + $ip6t_n -I PREROUTING -m set --match-set $IPSET_DIRECT6 src $(dst $IPSET_LOCAL6) -j PSW2_DNS else - $ip6t_n -I PREROUTING -m set --match-set $IPSET_LAN6 src -j PSW2_DNS + $ip6t_n -I PREROUTING -m set --match-set $IPSET_DIRECT6 src -j PSW2_DNS fi $ip6t_m -N PSW2_DIVERT @@ -806,7 +784,7 @@ add_firewall_rule() { $ip6t_m -A PSW2_RULE -j CONNMARK --save-mark $ip6t_m -N PSW2 - $ip6t_m -A PSW2 $(dst $IPSET_LAN6) -j RETURN + $ip6t_m -A PSW2 $(dst $IPSET_DIRECT6) -j RETURN $ip6t_m -A PSW2 $(dst $IPSET_VPS6) -j RETURN $ip6t_m -A PSW2 $(comment "WAN6_IP_RETURN") $(dst $IPSET_WAN6) -j RETURN $ip6t_m -A PSW2 -m conntrack --ctdir REPLY -j RETURN @@ -817,7 +795,7 @@ add_firewall_rule() { $ip6t_m -N PSW2_OUTPUT $ip6t_m -A PSW2_OUTPUT -m mark --mark 255 -j RETURN - $ip6t_m -A PSW2_OUTPUT $(dst $IPSET_LAN6) -j RETURN + $ip6t_m -A PSW2_OUTPUT $(dst $IPSET_DIRECT6) -j RETURN $ip6t_m -A PSW2_OUTPUT $(dst $IPSET_VPS6) -j RETURN $ip6t_m -A PSW2_OUTPUT -m conntrack --ctdir REPLY -j RETURN @@ -883,7 +861,6 @@ add_firewall_rule() { if [ -n "$NODE" ] && [ "$TCP_LOCALHOST_PROXY" = "1" ]; then [ "$accept_icmp" = "1" ] && { $ipt_n -A OUTPUT -p icmp -j PSW2_OUTPUT - $ipt_n -I PSW2_OUTPUT -p icmp $(dst $IPSET_PROXY_LAN) $(REDIRECT) $ipt_n -A PSW2_OUTPUT -p icmp -d $FAKE_IP $(REDIRECT) add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_n -A PSW2_OUTPUT -p icmp" "$(REDIRECT)" $ipt_n -A PSW2_OUTPUT -p icmp $(REDIRECT) @@ -891,7 +868,6 @@ add_firewall_rule() { [ "$accept_icmpv6" = "1" ] && { $ip6t_n -A OUTPUT -p ipv6-icmp -j PSW2_OUTPUT - $ip6t_n -I PSW2_OUTPUT -p ipv6-icmp $(dst $IPSET_PROXY_LAN6) $(REDIRECT) $ip6t_n -A PSW2_OUTPUT -p ipv6-icmp -d $FAKE_IP_6 $(REDIRECT) add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_n -A PSW2_OUTPUT -p ipv6-icmp" "$(REDIRECT)" $ip6t_n -A PSW2_OUTPUT -p ipv6-icmp $(REDIRECT) @@ -903,24 +879,20 @@ add_firewall_rule() { ipt_j="$(REDIRECT $REDIR_PORT)" fi - $ipt_tmp -I PSW2_OUTPUT -p tcp $(dst $IPSET_PROXY_LAN) ${ipt_j} $ipt_tmp -A PSW2_OUTPUT -p tcp -d $FAKE_IP ${ipt_j} add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_tmp -A PSW2_OUTPUT -p tcp" "${ipt_j}" $TCP_REDIR_PORTS add_port_rules "$ipt_tmp -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "${ipt_j}" [ -z "${is_tproxy}" ] && $ipt_n -A OUTPUT -p tcp -j PSW2_OUTPUT [ -n "${is_tproxy}" ] && { - $ipt_m -I PSW2 $(comment "${comment_l}") -p tcp -i lo $(dst $IPSET_PROXY_LAN) $(REDIRECT $REDIR_PORT TPROXY) $ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY) $ipt_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT" } [ "$PROXY_IPV6" == "1" ] && { - $ip6t_m -I PSW2_OUTPUT -p tcp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE $ip6t_m -A PSW2_OUTPUT -p tcp -d $FAKE_IP_6 -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2_OUTPUT -p tcp" "-j PSW2_RULE" $TCP_REDIR_PORTS add_port_rules "$ip6t_m -A PSW2_OUTPUT -p tcp" $TCP_REDIR_PORTS "-j PSW2_RULE" - $ip6t_m -I PSW2 $(comment "${comment_l}") -p tcp -i lo $(dst $IPSET_PROXY_LAN6) $(REDIRECT $REDIR_PORT TPROXY) $ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo $(REDIRECT $REDIR_PORT TPROXY) $ip6t_m -A PSW2 $(comment "${comment_l}") -p tcp -i lo -j RETURN insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p tcp -j PSW2_OUTPUT" @@ -936,21 +908,17 @@ add_firewall_rule() { # Loading local router proxy UDP if [ -n "$NODE" ] && [ "$UDP_LOCALHOST_PROXY" = "1" ]; then - $ipt_m -I PSW2_OUTPUT -p udp $(dst $IPSET_PROXY_LAN) -j PSW2_RULE $ipt_m -A PSW2_OUTPUT -p udp -d $FAKE_IP -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST4}" "$ipt_m -A PSW2_OUTPUT -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS add_port_rules "$ipt_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE" - $ipt_m -I PSW2 $(comment "${comment_l}") -p udp -i lo $(dst $IPSET_PROXY_LAN) $(REDIRECT $REDIR_PORT TPROXY) $ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY) $ipt_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT" [ "$PROXY_IPV6" == "1" ] && { - $ip6t_m -I PSW2_OUTPUT -p udp $(dst $IPSET_PROXY_LAN6) -j PSW2_RULE $ip6t_m -A PSW2_OUTPUT -p udp -d $FAKE_IP_6 -j PSW2_RULE add_shunt_t_rule "${SHUNT_LIST6}" "$ip6t_m -A PSW2_OUTPUT -p udp" "-j PSW2_RULE" $UDP_REDIR_PORTS add_port_rules "$ip6t_m -A PSW2_OUTPUT -p udp" $UDP_REDIR_PORTS "-j PSW2_RULE" - $ip6t_m -I PSW2 $(comment "${comment_l}") -p udp -i lo $(dst $IPSET_PROXY_LAN6) $(REDIRECT $REDIR_PORT TPROXY) $ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo $(REDIRECT $REDIR_PORT TPROXY) $ip6t_m -A PSW2 $(comment "${comment_l}") -p udp -i lo -j RETURN insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW2) -p udp -j PSW2_OUTPUT" @@ -1101,8 +1069,6 @@ start() { stop() { [ -z "$(command -v log_i18n)" ] && . "$UTILS_PATH" del_firewall_rule - destroy_ipset $IPSET_PROXY_LAN - destroy_ipset $IPSET_PROXY_LAN6 [ $(config_t_get global flush_set "0") = "1" ] && { uci -q delete ${CONFIG}.@global[0].flush_set uci -q commit ${CONFIG} diff --git a/luci-app-passwall2/root/usr/share/passwall2/nftables.sh b/luci-app-passwall2/root/usr/share/passwall2/nftables.sh index a8655ac3..9d986894 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/nftables.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/nftables.sh @@ -5,14 +5,12 @@ MY_PATH=$DIR/nftables.sh UTILS_PATH=$DIR/utils.sh NFTABLE_NAME="inet passwall2" NFTSET_LOCAL="psw2_local" -NFTSET_PROXY_LAN="psw2_proxy_lan" -NFTSET_LAN="psw2_lan" +NFTSET_DIRECT="psw2_direct" NFTSET_VPS="psw2_vps" NFTSET_WAN="psw2_wan" NFTSET_LOCAL6="psw2_local6" -NFTSET_PROXY_LAN6="psw2_proxy_lan6" -NFTSET_LAN6="psw2_lan6" +NFTSET_DIRECT6="psw2_direct6" NFTSET_VPS6="psw2_vps6" NFTSET_WAN6="psw2_wan6" @@ -166,9 +164,9 @@ insert_nftset() { printf "%s\n" "$@" else cat - fi | tr -s ' \t' '\n' | awk -v s="$suffix" -v n="$nftset_name" -v t="$NFTABLE_NAME" ' - { - gsub(/^[ \t\r]+|[ \t\r]+$/, ""); + fi | awk -v s="$suffix" -v n="$nftset_name" -v t="$NFTABLE_NAME" ' + BEGIN { + RS = "[ \t\n\r]+" } $0 != "" { if (first == 0) { @@ -240,8 +238,8 @@ gen_shunt_list() { [ "$shunt_node" = "_default" ] && outbound="${default_outbound}" _SHUNT_LIST4="${_SHUNT_LIST4} ${nftset_v4}:${outbound}" _SHUNT_LIST6="${_SHUNT_LIST6} ${nftset_v6}:${outbound}" - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $nftset_v4 "0" - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $nftset_v6 "0" + config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $nftset_v4 "0" + config_n_get $shunt_id ip_list | sed 's/#.*//' | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $nftset_v6 "0" [ "${enable_geoview_ip}" = "1" ] && { local _geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') [ -n "$_geoip_code" ] && { @@ -419,7 +417,6 @@ load_acl() { fi [ "$accept_icmp" = "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN $(REDIRECT) comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr $FAKE_IP $(REDIRECT) comment \"$remarks\"" add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} ip daddr" "$(REDIRECT)" "$remarks" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ${_ipt_source} $(REDIRECT) comment \"$remarks\"" @@ -427,21 +424,18 @@ load_acl() { } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"$remarks\"" 2>/dev/null add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} ip6 daddr" "$(REDIRECT)" "$remarks" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} $(REDIRECT) comment \"$remarks\"" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ${_ipt_source} return comment \"$remarks\"" 2>/dev/null } - nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN ${nft_j} comment \"$remarks\"" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP ${nft_j} comment \"$remarks\"" add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip daddr" "${nft_j}" "$remarks" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ${nft_j} comment \"$remarks\"" [ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\"" [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 counter jump PSW2_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\"" add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") ip6 daddr" "counter jump PSW2_RULE" "$remarks" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null @@ -455,14 +449,12 @@ load_acl() { [ "$udp_proxy_mode" != "disable" ] && [ -n "$redir_port" ] && { msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "${node_remark}")(TPROXY:${redir_port})" - nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW2_RULE comment \"$remarks\"" add_shunt_t_rule "${shunt_list4}" "nft add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip daddr" "counter jump PSW2_RULE" "$remarks" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\"" [ "$PROXY_IPV6" == "1" ] && [ "$_ipv4" != "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr @$NFTSET_PROXY_LAN6 counter jump PSW2_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} ip6 daddr $FAKE_IP_6 counter jump PSW2_RULE comment \"$remarks\"" add_shunt_t_rule "${shunt_list6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr" "counter jump PSW2_RULE" "$remarks" 2>/dev/null nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW2_RULE comment \"$remarks\"" 2>/dev/null @@ -527,7 +519,6 @@ load_acl() { fi [ "$accept_icmp" = "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr @$NFTSET_PROXY_LAN $(REDIRECT) comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr $FAKE_IP $(REDIRECT) comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp ip daddr" "$(REDIRECT)" "${comment}" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip protocol icmp $(REDIRECT) comment \"${comment}\"" @@ -535,21 +526,18 @@ load_acl() { } [ "$accept_icmpv6" = "1" ] && [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT) comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 $(REDIRECT) comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 ip6 daddr" "$(REDIRECT)" "${comment}" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 $(REDIRECT) comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT meta l4proto icmpv6 return comment \"${comment}\"" } - nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_PROXY_LAN ${nft_j} comment \"${comment}\"" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j} comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr" "${nft_j}" "${comment}" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j} comment \"${comment}\"" [ -n "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment}\"" [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr" "${nft_j}" "${comment}" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW2_RULE comment \"${comment}\"" @@ -562,14 +550,12 @@ load_acl() { if [ "$UDP_PROXY_MODE" != "disable" ] && [ -n "$NODE" ]; then msg2="${msg}$(i18n "Use the %s node [%s]" "UDP" "$(config_n_get $NODE remarks)")(TPROXY:${REDIR_PORT})" - nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr" "counter jump PSW2_RULE" "${comment}" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment}\"" [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE comment \"${comment}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE comment \"${comment}\"" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr" "counter jump PSW2_RULE" "${comment}" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE comment \"${comment}\"" @@ -695,20 +681,30 @@ add_firewall_rule() { mwan3_start gen_nftset $NFTSET_LOCAL ipv4_addr 0 "-1" - gen_nftset $NFTSET_PROXY_LAN ipv4_addr 0 "-1" - gen_nftset $NFTSET_LAN ipv4_addr 0 "-1" $(gen_lanlist) + gen_nftset $NFTSET_DIRECT ipv4_addr 0 "-1" gen_nftset $NFTSET_VPS ipv4_addr 0 "-1" gen_nftset $NFTSET_WAN ipv4_addr 0 "-1" gen_nftset $NFTSET_LOCAL6 ipv6_addr 0 "-1" - gen_nftset $NFTSET_PROXY_LAN6 ipv6_addr 0 "-1" - gen_nftset $NFTSET_LAN6 ipv6_addr 0 "-1" $(gen_lanlist_6) + gen_nftset $NFTSET_DIRECT6 ipv6_addr 0 "-1" gen_nftset $NFTSET_VPS6 ipv6_addr 0 "-1" gen_nftset $NFTSET_WAN6 ipv6_addr 0 "-1" get_local_ips ip4 | insert_nftset $NFTSET_LOCAL "-1" get_local_ips ip6 | insert_nftset $NFTSET_LOCAL6 "-1" + for ip in $(cat /usr/share/passwall2/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d"); do + if [[ "$ip" == *::* ]]; then + echo "$ip" | insert_nftset $NFTSET_DIRECT6 0 + elif [[ "$ip" == "geoip:"* ]]; then + local _geoip_code=$(echo $ip | awk -F ':' '{print $2}') + get_geoip $_geoip_code ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | insert_nftset $NFTSET_DIRECT "0" + get_geoip $_geoip_code ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | insert_nftset $NFTSET_DIRECT6 "0" + else + echo "$ip" | insert_nftset $NFTSET_DIRECT 0 + fi + done + # Ignore special IP ranges local lan_ifname lan_ip lan_ifname=$(uci -q -p /tmp/state get network.lan.ifname) @@ -718,36 +714,26 @@ add_firewall_rule() { #log_i18n 1 "local network segments (%s) direct connection: %s" "IPv4" "${lan_ip}" #log_i18n 1 "local network segments (%s) direct connection: %s" "IPv6" "${lan_ip6}" - [ -n "$lan_ip" ] && echo $lan_ip | insert_nftset $NFTSET_LAN "-1" - [ -n "$lan_ip6" ] && echo $lan_ip6 | insert_nftset $NFTSET_LAN6 "-1" + [ -n "$lan_ip" ] && echo $lan_ip | insert_nftset $NFTSET_DIRECT "-1" + [ -n "$lan_ip6" ] && echo $lan_ip6 | insert_nftset $NFTSET_DIRECT6 "-1" } update_wan_sets [ -n "$ISP_DNS" ] && { - echo "$ISP_DNS" | insert_nftset $NFTSET_LAN 0 + echo "$ISP_DNS" | insert_nftset $NFTSET_DIRECT 0 for ispip in $ISP_DNS; do log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv4" "${ispip}")" done } [ -n "$ISP_DNS6" ] && { - echo $ISP_DNS6 | insert_nftset $NFTSET_LAN6 0 + echo $ISP_DNS6 | insert_nftset $NFTSET_DIRECT6 0 for ispip6 in $ISP_DNS6; do log_i18n 1 "$(i18n "Add ISP %s DNS to the whitelist: %s" "IPv6" "${ispip6}")" done } - # Force proxy LAN IP CIDR - force_proxy_lan_ip=$(config_t_get global_forwarding force_proxy_lan_ip) - for ip in $force_proxy_lan_ip; do - if [[ "$ip" == *::* ]]; then - echo "$ip" | insert_nftset $NFTSET_PROXY_LAN6 0 - else - echo "$ip" | insert_nftset $NFTSET_PROXY_LAN 0 - fi - done - # Shunt rules IP list (import when use shunt node) gen_shunt_list "${NODE}" SHUNT_LIST4 SHUNT_LIST6 @@ -780,11 +766,11 @@ add_firewall_rule() { nft "flush chain $NFTABLE_NAME PSW2_DNS" if [ $(config_t_get global dns_redirect "1") = "0" ]; then #Only hijack when dest address is local IP - nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_LAN} ip daddr @${NFTSET_LOCAL} jump PSW2_DNS" - nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_LAN6} ip6 daddr @${NFTSET_LOCAL6} jump PSW2_DNS" + nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_DIRECT} ip daddr @${NFTSET_LOCAL} jump PSW2_DNS" + nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_DIRECT6} ip6 daddr @${NFTSET_LOCAL6} jump PSW2_DNS" else - nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_LAN} jump PSW2_DNS" - nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_LAN6} jump PSW2_DNS" + nft "insert rule $NFTABLE_NAME dstnat ip saddr @${NFTSET_DIRECT} jump PSW2_DNS" + nft "insert rule $NFTABLE_NAME dstnat ip6 saddr @${NFTSET_DIRECT6} jump PSW2_DNS" fi # for ipv4 ipv6 tproxy mark @@ -799,13 +785,13 @@ add_firewall_rule() { #ipv4 tproxy mode and udp nft "add chain $NFTABLE_NAME PSW2_MANGLE" nft "flush chain $NFTABLE_NAME PSW2_MANGLE" - nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_LAN counter return" + nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_DIRECT counter return" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip daddr @$NFTSET_VPS counter return" nft "add rule $NFTABLE_NAME PSW2_MANGLE ct direction reply counter return" nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE" nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE" - nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_LAN counter return" + nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_DIRECT counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip daddr @$NFTSET_VPS counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ct direction reply counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE meta mark 255 counter return" @@ -819,13 +805,13 @@ add_firewall_rule() { [ -z "${is_tproxy}" ] && { nft "add chain $NFTABLE_NAME PSW2_NAT" nft "flush chain $NFTABLE_NAME PSW2_NAT" - nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_LAN counter return" + nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_DIRECT counter return" nft "add rule $NFTABLE_NAME PSW2_NAT ip daddr @$NFTSET_VPS counter return" nft "add rule $NFTABLE_NAME dstnat ip protocol tcp counter jump PSW2_NAT" nft "add chain $NFTABLE_NAME PSW2_OUTPUT_NAT" nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_NAT" - nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_LAN counter return" + nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_DIRECT counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT ip daddr @$NFTSET_VPS counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_NAT meta mark 255 counter return" } @@ -834,11 +820,11 @@ add_firewall_rule() { if [ "$accept_icmp" = "1" ]; then nft "add chain $NFTABLE_NAME PSW2_ICMP_REDIRECT" nft "flush chain $NFTABLE_NAME PSW2_ICMP_REDIRECT" - nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_LAN counter return" + nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_DIRECT counter return" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip daddr @$NFTSET_VPS counter return" [ "$accept_icmpv6" = "1" ] && { - nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_LAN6 counter return" + nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_DIRECT6 counter return" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT ip6 daddr @$NFTSET_VPS6 counter return" } @@ -856,13 +842,13 @@ add_firewall_rule() { #ipv6 tproxy mode and udp nft "add chain $NFTABLE_NAME PSW2_MANGLE_V6" nft "flush chain $NFTABLE_NAME PSW2_MANGLE_V6" - nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return" + nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 ct direction reply counter return" nft "add chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6" nft "flush chain $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6" - nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_LAN6 counter return" + nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_DIRECT6 counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ip6 daddr @$NFTSET_VPS6 counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 ct direction reply counter return" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta mark 255 counter return" @@ -933,7 +919,6 @@ add_firewall_rule() { # Loading local router proxy TCP if [ -n "$NODE" ] && [ "$TCP_LOCALHOST_PROXY" = "1" ]; then [ "$accept_icmp" = "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr @$NFTSET_PROXY_LAN counter redirect" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp ip daddr" "counter redirect" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo ip protocol icmp counter redirect" @@ -941,7 +926,6 @@ add_firewall_rule() { } [ "$accept_icmpv6" = "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr @$NFTSET_PROXY_LAN6 counter redirect" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr $FAKE_IP_6 counter redirect" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 ip6 daddr" "counter redirect" nft "add rule $NFTABLE_NAME PSW2_ICMP_REDIRECT oif lo meta l4proto icmpv6 counter redirect" @@ -956,24 +940,20 @@ add_firewall_rule() { nft_j="$(REDIRECT $REDIR_PORT)" fi - nft "insert rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr @$NFTSET_PROXY_LAN ${nft_j}" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp ip daddr $FAKE_IP ${nft_j}" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip daddr" "${nft_j}" nft "add rule $NFTABLE_NAME $nft_chain ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") ${nft_j}" [ -z "${is_tproxy}" ] && nft "add rule $NFTABLE_NAME nat_output ip protocol tcp counter jump PSW2_OUTPUT_NAT" [ -n "${is_tproxy}" ] && { - nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo ip daddr @$NFTSET_PROXY_LAN $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol tcp iif lo counter return comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME mangle_output ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\"" } [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp ip6 daddr $FAKE_IP_6 jump PSW2_RULE" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") ip6 daddr" "counter jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_REDIR_PORTS "tcp dport") counter jump PSW2_RULE" - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto tcp iif lo counter return comment \"${comment_l}\"" } @@ -988,21 +968,17 @@ add_firewall_rule() { # Loading local router proxy UDP if [ -n "$NODE" ] && [ "$UDP_LOCALHOST_PROXY" = "1" ]; then - nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_PROXY_LAN counter jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE" add_shunt_t_rule "${SHUNT_LIST4}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") ip daddr" "counter jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE" - nft "insert rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo ip daddr @$NFTSET_PROXY_LAN $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE ip protocol udp iif lo counter return comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME mangle_output ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\"" [ "$PROXY_IPV6" == "1" ] && { - nft "insert rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_PROXY_LAN6 jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE" add_shunt_t_rule "${SHUNT_LIST6}" "nft add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr" "counter jump PSW2_RULE" nft "add rule $NFTABLE_NAME PSW2_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW2_RULE" - nft "insert rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo ip6 daddr @$NFTSET_PROXY_LAN6 $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo $(REDIRECT $REDIR_PORT TPROXY6) comment \"${comment_l}\"" nft "add rule $NFTABLE_NAME PSW2_MANGLE_V6 meta l4proto udp iif lo counter return comment \"${comment_l}\"" } @@ -1052,12 +1028,12 @@ del_firewall_rule() { destroy_nftset $NFTSET_LOCAL destroy_nftset $NFTSET_WAN - destroy_nftset $NFTSET_LAN + destroy_nftset $NFTSET_DIRECT destroy_nftset $NFTSET_VPS destroy_nftset $NFTSET_LOCAL6 destroy_nftset $NFTSET_WAN6 - destroy_nftset $NFTSET_LAN6 + destroy_nftset $NFTSET_DIRECT6 destroy_nftset $NFTSET_VPS6 del_script_mwan3 @@ -1112,8 +1088,6 @@ start() { stop() { [ -z "$(command -v log_i18n)" ] && . "$UTILS_PATH" del_firewall_rule - destroy_nftset $NFTSET_PROXY_LAN - destroy_nftset $NFTSET_PROXY_LAN6 [ $(config_t_get global flush_set "0") = "1" ] && { uci -q delete ${CONFIG}.@global[0].flush_set uci -q commit ${CONFIG} diff --git a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua index 92a713cc..2ec0ca8d 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua +++ b/luci-app-passwall2/root/usr/share/passwall2/subscribe.lua @@ -481,7 +481,7 @@ local function parseClashNode(node, add_mode, group, sub_cfg) local sub_vmess_type = DEFAULT_VMESS_TYPE local sub_vless_type = DEFAULT_VLESS_TYPE local sub_hysteria2_type = DEFAULT_HYSTERIA2_TYPE - local sub_hy_up_mbps, sub_hy_down_mbps = 1000, 1000 + local sub_hy_up_mbps, sub_hy_down_mbps if sub_cfg then if sub_cfg.allowInsecure and sub_cfg.allowInsecure ~= "1" then sub_allowinsecure = nil @@ -800,7 +800,7 @@ local function processData(szType, content, add_mode, group, sub_cfg) local sub_vmess_type = DEFAULT_VMESS_TYPE local sub_vless_type = DEFAULT_VLESS_TYPE local sub_hysteria2_type = DEFAULT_HYSTERIA2_TYPE - local sub_hy_up_mbps, sub_hy_down_mbps = 1000, 1000 + local sub_hy_up_mbps, sub_hy_down_mbps if sub_cfg then if sub_cfg.allowInsecure and sub_cfg.allowInsecure ~= "1" then sub_allowinsecure = nil @@ -1354,12 +1354,25 @@ local function processData(szType, content, add_mode, group, sub_cfg) result.port = port - result.tls = '1' - result.tls_serverName = params.peer or params.sni or "" - result.tls_pinSHA256 = params.pcs - result.tls_CertByName = params.vcn - local insecure = params.allowinsecure or params.allowInsecure or params.insecure - result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0") + params.security = params.security or "tls" + if params.security == "tls" or params.security == "reality" then + result.tls = '1' + result.tls_serverName = params.peer or params.sni or "" + result.alpn = params.alpn + if params.fp and params.fp ~= "" then + result.utls = "1" + result.fingerprint = params.fp + end + if params.security == "reality" then + result.reality = "1" + result.reality_publicKey = params.pbk or nil + result.reality_shortId = params.sid or nil + end + result.tls_pinSHA256 = params.pcs + result.tls_CertByName = params.vcn + local insecure = params.allowinsecure or params.allowInsecure or params.insecure + result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0") + end if not params.type then params.type = "tcp" end params.type = string.lower(params.type) @@ -1433,7 +1446,6 @@ local function processData(szType, content, add_mode, group, sub_cfg) result.httpupgrade_path = params.path end - result.alpn = params.alpn result.tcp_fast_open = params.tfo result.use_finalmask = (params.fm and params.fm ~= "") and "1" or nil result.finalmask = (params.fm and params.fm ~= "") and api.base64Encode(params.fm) or nil @@ -1586,6 +1598,10 @@ local function processData(szType, content, add_mode, group, sub_cfg) result.encryption = params.encryption or "none" result.flow = params.flow + if (not params.security or params.security == "") and params.flow then + params.security = "tls" + end + result.tls = "0" if params.security == "tls" or params.security == "reality" then result.tls = "1" @@ -1721,6 +1737,10 @@ local function processData(szType, content, add_mode, group, sub_cfg) result.hysteria2_obfs_type = params.obfs or "salamander" result.hysteria2_obfs_password = params["obfs-password"] or params["obfs_password"] end + if params.obfs == "gecko" then + result.hysteria2_obfs_MinPacketSize = params.minpacketsize or "512" + result.hysteria2_obfs_MaxPacketSize = params.maxpacketsize or "1200" + end if (sub_hysteria2_type == "sing-box" and has_singbox) or (sub_hysteria2_type == "xray" and has_xray) then local is_singbox = sub_hysteria2_type == "sing-box" and has_singbox diff --git a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh index 90d14512..d89c7f99 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/tasks.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/tasks.sh @@ -17,24 +17,6 @@ do if [ "$CFG_UPDATE_INT" -ne 0 ]; then - stop_week_mode=$(config_t_get global_delay stop_week_mode) - stop_interval_mode=$(config_t_get global_delay stop_interval_mode) - stop_interval_mode=$(expr "$stop_interval_mode" \* 60) - if [ -n "$stop_week_mode" ]; then - [ "$stop_week_mode" = "8" ] && { - [ "$(expr "$CFG_UPDATE_INT" % "$stop_interval_mode")" -eq 0 ] && { /etc/init.d/$CONFIG stop > /dev/null 2>&1 & } - } - fi - - start_week_mode=$(config_t_get global_delay start_week_mode) - start_interval_mode=$(config_t_get global_delay start_interval_mode) - start_interval_mode=$(expr "$start_interval_mode" \* 60) - if [ -n "$start_week_mode" ]; then - [ "$start_week_mode" = "8" ] && { - [ "$(expr "$CFG_UPDATE_INT" % "$start_interval_mode")" -eq 0 ] && { /etc/init.d/$CONFIG start > /dev/null 2>&1 & } - } - fi - restart_week_mode=$(config_t_get global_delay restart_week_mode) restart_interval_mode=$(config_t_get global_delay restart_interval_mode) restart_interval_mode=$(expr "$restart_interval_mode" \* 60) @@ -44,36 +26,35 @@ do } fi - autoupdate=$(config_t_get global_rules auto_update) - weekupdate=$(config_t_get global_rules week_update) - hourupdate=$(config_t_get global_rules interval_update) - hourupdate=$(expr "$hourupdate" \* 60) - if [ "$autoupdate" = "1" ]; then - [ "$weekupdate" = "8" ] && { - [ "$(expr "$CFG_UPDATE_INT" % "$hourupdate")" -eq 0 ] && { lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 & } + rules_update_week_mode=$(config_t_get global_rules update_week_mode) + rules_update_interval_mode=$(config_t_get global_rules update_interval_mode) + rules_update_interval_mode=$(expr "$rules_update_interval_mode" \* 60) + if [ -n "$rules_update_week_mode" ]; then + [ "$rules_update_week_mode" = "8" ] && { + [ "$(expr "$CFG_UPDATE_INT" % "$rules_update_interval_mode")" -eq 0 ] && { lua $APP_PATH/rule_update.lua log all cron > /dev/null 2>&1 & } } fi TMP_SUB_PATH=$TMP_PATH/sub_tasks mkdir -p $TMP_SUB_PATH for item in $(uci show ${CONFIG} | grep "=subscribe_list" | cut -d '.' -sf 2 | cut -d '=' -sf 1); do - if [ "$(config_n_get $item auto_update 0)" = "1" ]; then + sub_update_week_mode=$(config_n_get $item update_week_mode) + if [ -n "$sub_update_week_mode" ]; then cfgid=$(uci show ${CONFIG}.$item | head -n 1 | cut -d '.' -sf 2 | cut -d '=' -sf 1) remark=$(config_n_get $item remark) - week_update=$(config_n_get $item week_update) - hour_update=$(config_n_get $item interval_update) - echo "$cfgid" >> $TMP_SUB_PATH/${week_update}_${hour_update} + sub_update_interval_mode=$(config_n_get $item update_interval_mode) + echo "$cfgid" >> $TMP_SUB_PATH/${sub_update_week_mode}_${sub_update_interval_mode} fi done [ -d "${TMP_SUB_PATH}" ] && { for name in $(ls ${TMP_SUB_PATH}); do - week_update=$(echo $name | awk -F '_' '{print $1}') - hour_update=$(echo $name | awk -F '_' '{print $2}') - hour_update=$(expr "$hour_update" \* 60) + sub_update_week_mode=$(echo $name | awk -F '_' '{print $1}') + sub_update_interval_mode=$(echo $name | awk -F '_' '{print $2}') + sub_update_interval_mode=$(expr "$sub_update_interval_mode" \* 60) cfgids=$(echo -n $(cat ${TMP_SUB_PATH}/${name}) | sed 's# #,#g') - [ "$week_update" = "8" ] && { - [ "$(expr "$CFG_UPDATE_INT" % "$hour_update")" -eq 0 ] && { lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 & } + [ "$sub_update_week_mode" = "8" ] && { + [ "$(expr "$CFG_UPDATE_INT" % "$sub_update_interval_mode")" -eq 0 ] && { lua $APP_PATH/subscribe.lua start $cfgids cron > /dev/null 2>&1 & } } done diff --git a/luci-app-passwall2/root/usr/share/passwall2/utils.sh b/luci-app-passwall2/root/usr/share/passwall2/utils.sh index b345c7ee..6bfc0ad7 100755 --- a/luci-app-passwall2/root/usr/share/passwall2/utils.sh +++ b/luci-app-passwall2/root/usr/share/passwall2/utils.sh @@ -426,38 +426,6 @@ kill_all() { kill -9 $(pidof "$@") >/dev/null 2>&1 } -gen_lanlist() { - cat <<-EOF - 0.0.0.0/8 - 10.0.0.0/8 - 100.64.0.0/10 - 127.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.168.0.0/16 - 224.0.0.0/4 - 240.0.0.0/4 - EOF -} - -gen_lanlist_6() { - cat <<-EOF - ::/128 - ::1/128 - ::ffff:0:0/96 - ::ffff:0:0:0/96 - 64:ff9b::/96 - 100::/64 - 2001::/32 - 2001:20::/28 - 2001:db8::/32 - 2002::/16 - fc00::/7 - fe80::/10 - ff00::/8 - EOF -} - get_wan_ips() { local family="$1" local NET_ADDR diff --git a/luci-app-syncthing/Makefile b/luci-app-syncthing/Makefile deleted file mode 100644 index 2219fcb2..00000000 --- a/luci-app-syncthing/Makefile +++ /dev/null @@ -1,22 +0,0 @@ -# Copyright (C) 2020 Gyj1109 -# 适配 OpenWrt 25.12 修改版 - -include $(TOPDIR)/rules.mk - -PKG_NAME:=luci-app-syncthing -PKG_VERSION:=1.0 -PKG_RELEASE:=3 - -LUCI_TITLE:=LuCI support for Syncthing -LUCI_PKGARCH:=all -# 适配 25.12：确保安装了 syncthing 后，LuCI 界面能正确拉起 -LUCI_DEPENDS:=+syncthing - -include $(TOPDIR)/feeds/luci/luci.mk - -# 明确定义配置文件的归属，这对 25.12 的 apk 管理器非常重要 -define Package/$(PKG_NAME)/conffiles -/etc/config/syncthing -endef - -$(eval $(call BuildPackage,$(PKG_NAME))) diff --git a/luci-app-syncthing/README.md b/luci-app-syncthing/README.md deleted file mode 100644 index b07298c1..00000000 --- a/luci-app-syncthing/README.md +++ /dev/null @@ -1,2 +0,0 @@ -# luci-app-syncthing -在Potat0000源码基础上进行了汉化优化，官方openwrt23.05.3编译后可使用 diff --git a/luci-app-syncthing/luasrc/controller/syncthing.lua b/luci-app-syncthing/luasrc/controller/syncthing.lua deleted file mode 100644 index ee2ca7ef..00000000 --- a/luci-app-syncthing/luasrc/controller/syncthing.lua +++ /dev/null @@ -1,17 +0,0 @@ -module("luci.controller.syncthing", package.seeall) - -function index() - if not nixio.fs.access("/etc/config/syncthing") then - return - end - - entry({"admin", "services", "syncthing"}, cbi("syncthing"), _("文件同步"), 10).dependent = true - entry({"admin", "services", "syncthing", "status"}, call("act_status")).leaf = true -end - -function act_status() - local e = {} - e.running = luci.sys.call("pgrep syncthing >/dev/null") == 0 - luci.http.prepare_content("application/json") - luci.http.write_json(e) -end diff --git a/luci-app-syncthing/luasrc/model/cbi/syncthing.lua b/luci-app-syncthing/luasrc/model/cbi/syncthing.lua deleted file mode 100644 index 324ea054..00000000 --- a/luci-app-syncthing/luasrc/model/cbi/syncthing.lua +++ /dev/null @@ -1,48 +0,0 @@ -require("nixio.fs") - -m = Map("syncthing", translate("Syncthing同步工具")) - -m:section(SimpleSection).template = "syncthing/syncthing_status" - -s = m:section(TypedSection, "syncthing") - -s.anonymous = true - -o = s:option(Flag, "enabled", translate("启用")) -o.default = 0 -o.rmempty = false - -gui_address = s:option(Value, "gui_address", translate("GUI访问地址")) -gui_address.description = translate("使用0.0.0.0以监控所有访问。") -gui_address.default = "http://0.0.0.0:8384" -gui_address.placeholder = "http://0.0.0.0:8384" -gui_address.rmempty = false - -home = s:option(Value, "home", translate("配置文件目录")) -home.description = translate("只有保存在/etc/syncthing中的配置会自动备份！") -home.default = "/etc/syncthing" -home.placeholder = "/etc/syncthing" -home.rmempty = false - -user = s:option(ListValue, "user", translate("用户")) -user.description = translate("默认是syncthing，但这可能会导致权限被拒绝。Syncthing官方不建议以root身份运行。") -user:value("", translate("syncthing")) -for u in luci.util.execi("cat /etc/passwd | cut -d ':' -f1") do - user:value(u) -end - -macprocs = s:option(Value, "macprocs", translate("线程限制")) -macprocs.description = translate("0表示匹配CPU数量（默认），>0表示显式指定并发数。") -macprocs.default = "0" -macprocs.placeholder = "0" -macprocs.datatype = "range(0,32)" -macprocs.rmempty = false - -nice = s:option(Value, "nice", translate("优先级")) -nice.description = translate("显式指定优先级值。0是最高，19是最低。（暂时不允许设置负值）") -nice.default = "19" -nice.placeholder = "19" -nice.datatype = "range(0,19)" -nice.rmempty = false - -return m diff --git a/luci-app-syncthing/luasrc/view/syncthing/syncthing_status.htm b/luci-app-syncthing/luasrc/view/syncthing/syncthing_status.htm deleted file mode 100644 index 566cc020..00000000 --- a/luci-app-syncthing/luasrc/view/syncthing/syncthing_status.htm +++ /dev/null @@ -1,27 +0,0 @@ - - -
-

- <%:正在收集数据...%> -

-
diff --git a/luci-app-syncthing/root/etc/uci-defaults/luci-syncthing b/luci-app-syncthing/root/etc/uci-defaults/luci-syncthing deleted file mode 100644 index 3adb7997..00000000 --- a/luci-app-syncthing/root/etc/uci-defaults/luci-syncthing +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -touch /etc/config/syncthing - -uci -q batch <<-EOF >/dev/null - delete ucitrack.@syncthing[-1] - add ucitrack syncthing - set ucitrack.@syncthing[-1].exec='/etc/init.d/syncthing stop && /etc/init.d/syncthing start' - commit ucitrack -EOF -# remove LuCI cache -rm -f /tmp/luci* -exit 0 diff --git a/luci-app-syncthing/root/usr/share/rpcd/acl.d/luci-app-syncthing.json b/luci-app-syncthing/root/usr/share/rpcd/acl.d/luci-app-syncthing.json deleted file mode 100644 index 9fc9cc54..00000000 --- a/luci-app-syncthing/root/usr/share/rpcd/acl.d/luci-app-syncthing.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "luci-app-syncthing": { - "description": "Grant UCI access for luci-app-syncthing", - "read": { - "uci": [ "syncthing" ] - }, - "write": { - "uci": [ "syncthing" ] - } - } -}