update 2026-07-28 01:38:11

luci-app-ssr-plus/root/usr/bin/ssr-monitor

@@ -0,0 +1,227 @@
+#!/bin/sh
+#
+# Copyright (C) 2017 openwrt-ssr
+# Copyright (C) 2017 yushi studio <ywb94@qq.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+. $IPKG_INSTROOT/etc/init.d/shadowsocksr
+LOCK_FILE="/var/lock/ssr-monitor.lock"
+[ -f "$LOCK_FILE" ] && exit 2
+touch "$LOCK_FILE"
+
+ps_list() {
+	if busybox ps -w >/dev/null 2>&1; then
+		busybox ps -w
+	else
+		busybox ps
+	fi
+}
+
+match_proc_count() {
+	local pattern="$1"
+	ps_list | grep -E "$pattern" | grep -v grep | wc -l
+}
+
+redir_tcp_running() {
+	local ssr_count
+	local ipt_count
+	ssr_count=$(match_proc_count 'ssr-retcp')
+	ipt_count=$(ps_list | grep 'ipt2socks' | grep -v grep | grep -E ' -T( |$)| --tcp-only( |$)' | wc -l)
+	echo $((ssr_count + ipt_count))
+}
+
+redir_udp_running() {
+	local ssr_count
+	local ipt_count
+	ssr_count=$(match_proc_count 'ssr-reudp')
+	ipt_count=$(ps_list | grep 'ipt2socks' | grep -v grep | grep -E ' -U( |$)| --udp-only( |$)' | wc -l)
+	echo $((ssr_count + ipt_count))
+}
+
+kill_matched_procs() {
+	local pattern="$1"
+	ps_list | grep -E "$pattern" | grep -v grep | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
+}
+
+get_expected_threads() {
+	local threads
+	threads=$(uci_get_by_type global threads 0)
+	if [ "$threads" = "0" ] || [ -z "$threads" ]; then
+		threads=$(grep -c '^processor' /proc/cpuinfo 2>/dev/null)
+	fi
+
+	case "$threads" in
+		''|*[!0-9]*)
+			threads=1
+			;;
+	esac
+
+	[ "$threads" -lt 1 ] && threads=1
+	echo "$threads"
+}
+
+server_process_count=$1
+redir_tcp_process=$2
+redir_udp_process=$3
+kcp_process=$4
+local_process=$5
+pdnsd_process=$6
+if [ -z "$pdnsd_process" ]; then
+	pdnsd_process=0
+fi
+i=0
+GLOBAL_SERVER=$(uci_get_by_type global global_server)
+GLOBAL_TYPE=$(uci_get_by_name $GLOBAL_SERVER type)
+EXPECTED_THREADS=$(get_expected_threads)
+server=$(uci_get_by_name $GLOBAL_SERVER server)
+kcp_port=$(uci_get_by_name $GLOBAL_SERVER kcp_port)
+server_port=$(uci_get_by_name $GLOBAL_SERVER server_port)
+password=$(uci_get_by_name $GLOBAL_SERVER kcp_password)
+kcp_param=$(uci_get_by_name $GLOBAL_SERVER kcp_param)
+[ "$password" != "" ] && password="--key "${password}
+
+while [ "1" == "1" ]; do #死循环
+	sleep 000030s
+	#redir tcp
+	if [ "$redir_tcp_process" -gt 0 ]; then
+		icount=$(redir_tcp_running)
+		local tcp_expected="$redir_tcp_process"
+		if [ "$GLOBAL_TYPE" = "socks5" ]; then
+			tcp_expected="$EXPECTED_THREADS"
+		fi
+		if [ "$icount" -lt "$tcp_expected" ]; then
+			logger -t "$NAME" "ssrplus redir tcp error.restart!"
+			echolog "ssrplus redir tcp error.restart!"
+			/etc/init.d/shadowsocksr restart
+			exit 0
+		fi
+	fi
+	#redir udp
+	if [ "$redir_udp_process" -gt 0 ]; then
+		icount=$(redir_udp_running)
+		local udp_expected="$redir_udp_process"
+		if [ "$GLOBAL_TYPE" = "socks5" ]; then
+			udp_expected="$EXPECTED_THREADS"
+		fi
+		if [ "$icount" -lt "$udp_expected" ]; then
+			logger -t "$NAME" "ssrplus redir udp error.restart!"
+			echolog "ssrplus redir udp error.restart!"
+			/etc/init.d/shadowsocksr restart
+			exit 0
+		fi
+	fi
+	#server
+	if [ "$server_process_count" -gt 0 ]; then
+		icount=$(match_proc_count 'ssr-server|ss-server-|xray-server-')
+		if [ "$icount" -lt "$server_process_count" ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "ssrplus server error.restart!"
+			echolog "ssrplus server error.restart!"
+			kill_matched_procs 'ssr-server|ss-server-'
+			/etc/init.d/shadowsocksr restart
+			exit 0
+		fi
+	fi
+	#kcptun
+	if [ "$kcp_process" -gt 0 ]; then
+		icount=$(ps_list | grep kcptun-client | grep -v grep | wc -l)
+		if [ "$icount" -lt "$kcp_process" ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "ssrplus kcptun error.restart!"
+			echolog "ssrplus kcptun error.restart!"
+			killall -q -9 kcptun-client
+			(/usr/bin/kcptun-client -r $server:$kcp_port -l :$server_port $password $kcp_param &)
+		fi
+	fi
+	#localsocks
+	if [ "$local_process" -gt 0 ]; then
+		icount=$(match_proc_count 'ssr-local|ss-local|tuic-local')
+		if [ "$icount" -lt "$local_process" ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "global socks server error.restart!"
+			echolog "global socks server error.restart!"
+			kill_matched_procs 'ssr-local|ss-local|tuic-local'
+			/etc/init.d/shadowsocksr restart
+			exit 0
+		fi
+	fi
+	#dns2tcp
+	if [ "$pdnsd_process" -eq 1 ]; then
+		icount=$(ps_list | grep $TMP_BIN_PATH/dns2tcp | grep -v grep | wc -l)
+		if [ "$icount" -lt 1 ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "dns2tcp tunnel error.restart!"
+			echolog "dns2tcp tunnel error.restart!"
+			dnsserver=$(uci_get_by_type global tunnel_forward 8.8.4.4:53)
+			kill -9 $(ps_list | grep $TMP_BIN_PATH/dns2tcp | grep -v grep | awk '{print $1}') >/dev/null 2>&1
+			start_dns2tcp "$dnsserver"
+		fi
+	#mosdns
+	elif [ "$pdnsd_process" -eq 4 ]; then
+		icount=$(ps_list | grep $TMP_BIN_PATH/mosdns | grep -v grep | wc -l)
+		if [ "$icount" -lt 1 ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "mosdns tunnel error.restart!"
+			echolog "mosdns tunnel error.restart!"
+			dnsserver=$(uci_get_by_type global tunnel_forward 8.8.4.4:53)
+			kill -9 $(ps_list | grep $TMP_BIN_PATH/mosdns | grep -v grep | awk '{print $1}') >/dev/null 2>&1
+			ln_start_bin $(first_type mosdns) mosdns start -c /etc/mosdns/config.yaml
+		fi
+	#chinadns-ng(proxy)
+	elif [ "$pdnsd_process" -eq 6 ]; then
+		icount=$(ps_list | grep -e ssrplus-dns -e "chinadns-ng -b 127.0.0.1 -l $tmp_dns_port" | grep -v grep | wc -l)
+		if [ "$icount" -lt 1 ]; then #如果进程挂掉就重启它
+			logger -t "$NAME" "chinadns-ng $dnsserver tunnel error.restart!"
+			echolog "chinadns-ng $dnsserver tunnel error.restart!"
+			dnsserver=$(uci_get_by_type global chinadns_ng_tunnel_forward 8.8.4.4:53)
+			kill -9 $(ps_list | grep "chinadns-ng -b 127.0.0.1 -l $tmp_dns_port" | grep -v grep | awk '{print $1}') >/dev/null 2>&1
+			local chinadns_ng_proto="$(uci_get_by_type global chinadns_ng_proto)"
+			local chinadns_ng_dns=""
+			IFS=','
+			for chinadns_ng_server in $dnsserver; do
+				local chinadns_ng_ip="${chinadns_ng_server%%:*}"
+				local chinadns_ng_port="${chinadns_ng_server##*:}"
+				[ "$chinadns_ng_ip" = "$chinadns_ng_port" ] && chinadns_ng_port="53"
+				chinadns_ng_tls_port="853"
+				case "$chinadns_ng_proto" in
+					"none")
+						chinadns_ng_server="${chinadns_ng_ip}#${chinadns_ng_port}"
+						;;
+					"tls")
+						chinadns_ng_server="${chinadns_ng_proto}://${chinadns_ng_ip}#${chinadns_ng_tls_port}"
+						;;
+					*)
+						chinadns_ng_server="${chinadns_ng_proto}://${chinadns_ng_ip}#${chinadns_ng_port}"
+						;;
+				esac
+					chinadns_ng_dns="${chinadns_ng_dns} -t ${chinadns_ng_server}"
+			done
+			unset IFS
+			dnsserver="$chinadns_ng_dns"
+			ln_start_bin $(first_type chinadns-ng) chinadns-ng -b 127.0.0.1 -l $tmp_dns_port -l $dns_port -p 3 -d gfw $dnsserver -N --filter-qtype 64,65 -f -r --cache 4096 --cache-stale 86400 --cache-refresh 20
+		fi
+	#built-in dns
+	elif [ "$pdnsd_process" -eq 7 ]; then
+		if ! is_builtin_dns_active; then
+			logger -t "$NAME" "builtin dns error.restart!"
+			echolog "builtin dns error.restart!"
+			/etc/init.d/shadowsocksr restart
+			exit 0
+		fi
+	fi
+	#chinadns-ng(china)
+	if [ "$(uci -q get "dhcp.@dnsmasq[0]._unused_ssrp_changed")" = "1" ]; then
+		chinadns=$(uci_get_by_type global chinadns_forward)
+		if [ -n "$chinadns" ] && [ "$chinadns" != "none" ]; then
+			icount=$(ps_list | grep $TMP_BIN_PATH/chinadns-ng | grep -v grep | wc -l)
+			if [ "$icount" -lt 1 ]; then #如果进程挂掉就重启它
+				logger -t "$NAME" "chinadns-ng tunnel error.restart!"
+				echolog "chinadns-ng tunnel error.restart!"
+				wandns="$(ifstatus wan | jsonfilter -e '@["dns-server"][0]' || echo "119.29.29.29")"
+				case "$chinadns" in
+				"wan") chinadns="$wandns" ;;
+				""|"wan_114") chinadns="$wandns,114.114.114.114" ;;
+				esac
+				kill -9 $(ps_list | grep $TMP_BIN_PATH/chinadns-ng | grep -v grep | awk '{print $1}') >/dev/null 2>&1
+				ln_start_bin $(first_type chinadns-ng) chinadns-ng -l $china_dns_port -4 china -p 3 -c ${chinadns/:/#} -t 127.0.0.1#$dns_port -N -f -r
+			fi
+		fi
+	fi
+done

luci-app-ssr-plus/root/usr/bin/ssr-switch

@@ -0,0 +1,274 @@
+#!/bin/sh
+#
+# Copyright (C) 2017 openwrt-ssr
+# Copyright (C) 2017 yushi studio <ywb94@qq.com>
+#
+# This is free software, licensed under the GNU General Public License v3.
+# See /LICENSE for more information.
+#
+
+ORIG_ARG1="${1:-}"
+ORIG_ARG2="${2:-}"
+ORIG_ARG3="${3:-}"
+[ -f /lib/functions.sh ] && . /lib/functions.sh
+. $IPKG_INSTROOT/etc/init.d/shadowsocksr
+LOCK_FILE="/var/lock/ssr-switch.lock"
+PROBE_SID=""
+
+cycle_time=60
+switch_time=3
+probe_socks_port=10800
+direct_fail_count=0
+direct_fail_limit=3
+probe_url="$(uci_get_by_type server_subscribe url_test_url)"
+[ -n "$probe_url" ] || probe_url="https://www.google.com/generate_204"
+PROBE_INSTANCE_KEY="ssr-switch-probe-local"
+
+DEFAULT_SERVER="$(uci_get_by_type global global_server)"
+CURRENT_SERVER="$DEFAULT_SERVER"
+ENABLE_SERVER="nil"
+
+cleanup_probe_socks() {
+	ps_list | grep -v "grep" | grep -E "tcp-http-ssr-switch-local\\.json|ss-${PROBE_INSTANCE_KEY}/config\\.yaml|tuic-${PROBE_INSTANCE_KEY}/config\\.yaml|v2ray-${PROBE_INSTANCE_KEY}/config\\.yaml" | awk '{print $1}' | xargs kill >/dev/null 2>&1
+	sleep 1
+	ps_list | grep -v "grep" | grep -E "tcp-http-ssr-switch-local\\.json|ss-${PROBE_INSTANCE_KEY}/config\\.yaml|tuic-${PROBE_INSTANCE_KEY}/config\\.yaml|v2ray-${PROBE_INSTANCE_KEY}/config\\.yaml" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
+	rm -f "$TMP_PATH/tcp-http-ssr-switch-local.json" 2>/dev/null
+	rm -rf "$TMP_PATH/ss-${PROBE_INSTANCE_KEY}" "$TMP_PATH/tuic-${PROBE_INSTANCE_KEY}" "$TMP_PATH/v2ray-${PROBE_INSTANCE_KEY}" 2>/dev/null
+	rm -f /tmp/ssr-switch-probe.log 2>/dev/null
+}
+
+start_probe_socks() {
+	local sid="$1"
+	local server_type
+
+	server_type="$(uci_get_by_name "$sid" type)"
+	[ "$server_type" = "clash" ] && return 1
+	[ "$server_type" = "tuic" ] && return 1
+	[ "$server_type" = "socks5" ] && return 1
+
+	cleanup_probe_socks
+	LOCAL_SERVER="$sid"
+	local_config_file="$TMP_PATH/tcp-http-ssr-switch-local.json"
+	_local="2"
+	local_enable=0
+	tmp_local_port=
+	mode="tcp,udp"
+
+	export SSR_SWITCH_PROBE=1
+	export SSR_SWITCH_PROBE_INSTANCE_KEY="$PROBE_INSTANCE_KEY"
+	start_local_with_port "$probe_socks_port" >/tmp/ssr-switch-probe.log 2>&1
+	local rc=$?
+	unset SSR_SWITCH_PROBE_INSTANCE_KEY
+	unset SSR_SWITCH_PROBE
+	[ "$rc" = "0" ] || return 1
+
+	sleep 2
+	return 0
+}
+
+probe_http_ok() {
+	case "$1" in
+		[1-5][0-9][0-9])
+			return 0
+			;;
+	esac
+	return 1
+}
+
+check_direct_probe() {
+	local code
+
+	code="$(curl -k -sS -L -o /dev/null \
+		--connect-timeout "$switch_time" \
+		--max-time "$switch_time" \
+		-w '%{http_code}' \
+		"$probe_url" 2>/dev/null || true)"
+	probe_http_ok "$code"
+}
+
+check_proxy_via_socks() {
+	local try_count
+	local code
+	local proxy_host
+
+	try_count="$(uci_get_by_type global switch_try_count 3)"
+	for i in $(seq 1 "$try_count"); do
+		for proxy_host in "127.0.0.1:$probe_socks_port" "[::1]:$probe_socks_port"; do
+			code="$(curl -k -sS -L -o /dev/null \
+				--connect-timeout "$switch_time" \
+				--max-time "$switch_time" \
+				--socks5-hostname "$proxy_host" \
+				-w '%{http_code}' \
+				"$probe_url" 2>/dev/null || true)"
+			probe_http_ok "$code" && return 0
+		done
+		sleep 1
+	done
+	return 1
+}
+
+test_proxy() {
+	local sid="$1"
+	[ "$(uci_get_by_name "$sid" type)" = "clash" ] && return 1
+	[ "$(uci_get_by_name "$sid" type)" = "tuic" ] && return 1
+	start_probe_socks "$sid" || {
+		cleanup_probe_socks
+		return 1
+	}
+	check_proxy_via_socks
+	local ret=$?
+	cleanup_probe_socks
+	return $ret
+}
+
+search_proxy() {
+	local sid="$1"
+	[ "$(uci_get_by_name "$sid" switch_enable 0)" = "1" ] || return 1
+	[ "$(uci_get_by_name "$sid" type)" = "clash" ] && return 1
+	[ "$(uci_get_by_name "$sid" type)" = "tuic" ] && return 1
+	[ "$sid" = "$CURRENT_SERVER" ] && return 1
+	[ "$ENABLE_SERVER" != "nil" ] && return 0
+
+	if test_proxy "$sid"; then
+		ENABLE_SERVER="$sid"
+		return 0
+	fi
+	return 1
+}
+
+select_proxy() {
+	config_load "$NAME"
+	ENABLE_SERVER="nil"
+	config_foreach search_proxy servers
+}
+
+set_main_server() {
+	local sid="$1"
+	[ -n "$sid" ] || return 1
+	uci set shadowsocksr.@global[0].global_server="$sid"
+	uci commit shadowsocksr
+	return 0
+}
+
+switch_proxy() {
+	set_main_server "$1" || return 1
+	/etc/init.d/shadowsocksr restart "$1"
+	return 0
+}
+
+start() {
+	while [ "1" = "1" ]; do
+		sleep "0000$cycle_time"
+		run_once
+	done
+}
+
+run_once() {
+	DEFAULT_SERVER="$(uci_get_by_type global global_server)"
+	[ "$DEFAULT_SERVER" = "nil" ] && {
+		direct_fail_count=0
+		return 0
+	}
+	[ "$(uci_get_by_name "$DEFAULT_SERVER" type)" = "clash" ] && {
+		direct_fail_count=0
+		cleanup_probe_socks
+		return 0
+	}
+	[ "$(uci_get_by_name "$DEFAULT_SERVER" type)" = "tuic" ] && {
+		direct_fail_count=0
+		cleanup_probe_socks
+		return 0
+	}
+	[ "$(uci_get_by_name "$DEFAULT_SERVER" kcp_enable 0)" = "1" ] && {
+		direct_fail_count=0
+		cleanup_probe_socks
+		return 1
+	}
+
+	CURRENT_SERVER="$DEFAULT_SERVER"
+
+	if check_direct_probe; then
+		direct_fail_count=0
+		return 0
+	fi
+
+	direct_fail_count=$((direct_fail_count + 1))
+	[ "$direct_fail_count" -lt "$direct_fail_limit" ] && return 0
+	direct_fail_count=0
+
+	if test_proxy "$CURRENT_SERVER"; then
+		return 0
+	fi
+
+	echolog "Current server error, try to switch another server."
+	select_proxy
+	if [ "$ENABLE_SERVER" != "nil" ]; then
+		CURRENT_SERVER="$ENABLE_SERVER"
+		switch_proxy "$CURRENT_SERVER"
+		echolog "Switch to $(uci_get_by_name "$CURRENT_SERVER" alias) proxy!"
+	else
+		switch_proxy "$CURRENT_SERVER"
+		echolog "Try restart current server."
+	fi
+	return 0
+}
+
+probe_once() {
+	local sid="$1"
+	[ -n "$sid" ] || {
+		echo "missing_sid"
+		return 1
+	}
+	cleanup_probe_socks
+	if ! start_probe_socks "$sid"; then
+		echo "probe_start:fail"
+		return 1
+	fi
+	echo "probe_start:ok"
+	echo "probe:curl_ipv4"
+	curl -k -sS -L -o /dev/null \
+		--connect-timeout "$switch_time" \
+		--max-time "$switch_time" \
+		--socks5-hostname "127.0.0.1:$probe_socks_port" \
+		-w 'code=%{http_code}\n' \
+		"$probe_url" 2>/dev/null || true
+	echo "probe:curl_ipv6"
+	curl -g -k -sS -L -o /dev/null \
+		--connect-timeout "$switch_time" \
+		--max-time "$switch_time" \
+		--socks5-hostname "[::1]:$probe_socks_port" \
+		-w 'code=%{http_code}\n' \
+		"$probe_url" 2>/dev/null || true
+	cleanup_probe_socks
+	return 0
+}
+
+main() {
+	case "${ORIG_ARG1:-}" in
+		probe)
+			PROBE_SID="${ORIG_ARG2:-}"
+			probe_once "$PROBE_SID"
+			;;
+		once)
+			run_once
+			;;
+		start)
+			[ -n "$ORIG_ARG2" ] && cycle_time="$ORIG_ARG2"
+			[ -n "$ORIG_ARG3" ] && switch_time="$ORIG_ARG3"
+			[ -f "$LOCK_FILE" ] && exit 2
+			touch "$LOCK_FILE"
+			start
+			;;
+		*)
+			[ -n "$ORIG_ARG1" ] && cycle_time="$ORIG_ARG1"
+			[ -n "$ORIG_ARG2" ] && switch_time="$ORIG_ARG2"
+			[ -f "$LOCK_FILE" ] && exit 2
+			touch "$LOCK_FILE"
+			start
+			;;
+	esac
+}
+
+if [ "${0##*/}" = "ssr-switch" ]; then
+	main "$@"
+fi

luci-app-ssr-plus/root/usr/share/rpcd/acl.d/luci-app-ssr-plus.json

@@ -0,0 +1,17 @@
+{
+	"luci-app-ssr-plus": {
+		"description": "Grant UCI access for luci-app-ssr-plus",
+		"read": {
+			"file": {
+				"/etc/ssrplus/*": [ "read" ]
+			},
+			"uci": ["shadowsocksr"]
+		},
+		"write": {
+			"file": {
+				"/etc/ssrplus/*": [ "write" ]
+			},
+			"uci": ["shadowsocksr"]
+		}
+	}
+}

luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+. $IPKG_INSTROOT/etc/init.d/shadowsocksr
+
+check_run_environment
+
+# 设置 china_ip 变量并检查文件是否存在
+china_ip="${1:-${china_ip:-/etc/ssrplus/china_ssr.txt}}"
+[ -f "$china_ip" ] || exit 1
+
+case "$USE_TABLES" in
+	nftables)
+		skip_inet="${SKIP_INET:-0}"
+
+		case "$skip_inet" in
+			1)
+				{
+					# ss_spec / inet (仅在表和 set 存在时添加)
+					if nft list set inet ss_spec china >/dev/null 2>&1; then
+						echo "add element inet ss_spec china {"
+						grep -vE '^\s*#|^\s*$' "$china_ip" | sed 's/^/  /;s/$/,/'
+						echo "}"
+					fi
+				} | nft -f - || exit 1
+				;;
+			2)
+				{
+					# ss_spec_mangle / ip (仅在表和 set 存在时添加)
+					if nft list set ip ss_spec_mangle china >/dev/null 2>&1; then
+						echo "add element ip ss_spec_mangle china {"
+						grep -vE '^\s*#|^\s*$' "$china_ip" | sed 's/^/  /;s/$/,/'
+						echo "}"
+					fi
+				} | nft -f - || exit 1
+				;;
+			*)
+				echolog "chinaipset: invalid SKIP_INET=$skip_inet"
+				exit 1
+				;;
+		esac
+		;;
+	iptables)
+		ipset -! flush china 2>/dev/null
+		ipset -! -R <<-EOF || exit 1
+			create china hash:net
+			$(grep -vE '^\s*#|^\s*$' "$china_ip" | sed 's/^/add china /')
+		EOF
+		;;
+	*)
+		echolog "ERROR: No supported firewall backend detected"
+		exit 1
+		;;
+esac

luci-app-ssr-plus/root/usr/share/shadowsocksr/gfw2ipset.sh

@@ -0,0 +1,138 @@
+#!/bin/sh
+
+. $IPKG_INSTROOT/etc/init.d/shadowsocksr
+
+check_run_environment
+
+case "$USE_TABLES" in
+	nftables)
+		nft_support=1
+		echolog "gfw2ipset: Using nftables"
+		;;
+	iptables)
+		nft_support=0
+		echolog "gfw2ipset: Using iptables"
+		;;
+	*)
+		echolog "ERROR: No supported firewall backend detected"
+		exit 1
+		;;
+esac
+mkdir -p $TMP_DNSMASQ_PATH
+
+run_mode=$(normalize_run_mode)
+
+cp -rf /etc/ssrplus/gfw_list.conf $TMP_DNSMASQ_PATH/
+cp -rf /etc/ssrplus/gfw_base.conf $TMP_DNSMASQ_PATH/
+
+for conf_file in gfw_base.conf gfw_list.conf; do
+	conf="$TMP_DNSMASQ_PATH/$conf_file"
+	[ -f "$conf" ] || continue
+
+	if [ "$run_mode" = "gfw" ]; then
+		if [ "$nft_support" = "1" ]; then
+			# gfw + nft：ipset → nftset
+			sed -i 's|ipset=/\([^/]*\)/\([^[:space:]]*\)|nftset=/\1/inet#ss_spec#\2|g' "$conf"
+		fi
+	else
+		# 非 gfw：无条件清理所有分流引用
+		# sed -i '/^[[:space:]]*\(ipset=\|nftset=\)/d' "$conf"
+		sed -i '/^[[:space:]]*ipset=/d' "$conf"
+	fi
+done
+
+# 此处使用 for 方式读取 防止 /etc/ssrplus/ 目录下的 black.list white.list deny.list 等2个或多个文件一行中存在空格 比如:# abc.com 而丢失：server
+# Optimize: Batch filter using grep
+for list_file in /etc/ssrplus/black.list /etc/ssrplus/white.list /etc/ssrplus/deny.list; do
+	if [ -s "$list_file" ]; then
+		# 清理注释和空行
+		grep -vE '^\s*#|^\s*$' "$list_file" | sed 's/\r//g' > "${list_file}.clean"
+		if [ -s "${list_file}.clean" ]; then
+			for target_file in "$TMP_DNSMASQ_PATH/gfw_list.conf" "$TMP_DNSMASQ_PATH/gfw_base.conf"; do
+				[ -f "$target_file" ] || continue
+				tmp_file="${target_file}.tmp"
+				awk -v list="${list_file}.clean" '
+				BEGIN {
+					while ((getline line < list) > 0) {
+						gsub(/\r/, "", line)
+						if (line != "") {
+							domain[line] = 1
+							# 同时支持 *.domain
+							domain["*." line] = 1
+						}
+					}
+					close(list)
+				}
+				{
+					# 提取 server=/domain/xxx
+					if (match($0, /^server=\/([^\/]+)\//, m)) {
+						if (m[1] in domain) next
+					}
+					# 提取 ipset=/domain/xxx
+					if (match($0, /^ipset=\/([^\/]+)\//, m)) {
+						if (m[1] in domain) next
+					}
+					print
+				}
+				' "$target_file" > "$tmp_file"
+				mv "$tmp_file" "$target_file"
+			done
+		fi
+		rm -f "${list_file}.clean"
+	fi
+done
+
+# 此处直接使用 cat 因为有 sed '/#/d' 删除了 数据
+if [ "$nft_support" = "1" ]; then
+	sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1#$dns_port\nnftset=\/&\/inet#ss_spec#blacklist/" /etc/ssrplus/black.list > "$TMP_DNSMASQ_PATH/blacklist_forward.conf"
+	sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1\nnftset=\/&\/inet#ss_spec#whitelist/" /etc/ssrplus/white.list > "$TMP_DNSMASQ_PATH/whitelist_forward.conf"
+elif [ "$nft_support" = "0" ]; then
+	sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1#$dns_port\nipset=\/&\/blacklist/" /etc/ssrplus/black.list > "$TMP_DNSMASQ_PATH/blacklist_forward.conf"
+	sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/server=\/&\/127.0.0.1\nipset=\/&\/whitelist/" /etc/ssrplus/white.list > "$TMP_DNSMASQ_PATH/whitelist_forward.conf"
+fi
+
+sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' -e "s/.*/address=\/&\//" /etc/ssrplus/deny.list > "$TMP_DNSMASQ_PATH/denylist.conf"
+
+if [ "$(uci_get_by_type global adblock 0)" == "1" ]; then
+	cp -f /etc/ssrplus/ad.conf "$TMP_DNSMASQ_PATH/"
+	if [ -f "$TMP_DNSMASQ_PATH/ad.conf" ]; then
+		for list_file in /etc/ssrplus/black.list /etc/ssrplus/white.list /etc/ssrplus/deny.list; do
+			if [ -s "$list_file" ]; then
+				# 清理注释 & 空行
+				grep -vE '^\s*#|^\s*$' "$list_file" | sed 's/\r//g' > "${list_file}.clean"
+				if [ -s "${list_file}.clean" ]; then
+					tmp_file="$TMP_DNSMASQ_PATH/ad.conf.tmp"
+					awk -v list="${list_file}.clean" '
+					BEGIN {
+						while ((getline line < list) > 0) {
+							gsub(/\r/, "", line)
+							if (line != "") {
+								domain[line] = 1
+								# 支持泛域名
+								domain["*." line] = 1
+							}
+						}
+						close(list)
+					}
+					{
+						keep = 1
+						# 精确匹配 server=/domain/
+						if (match($0, /^server=\/([^\/]+)\//, m)) {
+							if (m[1] in domain) keep = 0
+						}
+						# 精确匹配 ipset=/domain/
+						if (match($0, /^ipset=\/([^\/]+)\//, m)) {
+							if (m[1] in domain) keep = 0
+						}
+						if (keep) print
+					}
+					' "$TMP_DNSMASQ_PATH/ad.conf" > "$tmp_file"
+					mv "$tmp_file" "$TMP_DNSMASQ_PATH/ad.conf"
+				fi
+				rm -f "${list_file}.clean"
+			fi
+		done
+	fi
+else
+	rm -f "$TMP_DNSMASQ_PATH/ad.conf"
+fi

luci-app-ssr-plus/root/usr/share/shadowsocksr/shadowsocksr.config

@@ -0,0 +1,67 @@
+
+config global
+	option global_server 'nil'
+	option threads '0'
+	option run_mode 'router'
+	option dports '2'
+	option custom_ports '80,443'
+	option pdnsd_enable '1'
+	option filter_aaaa '1'
+	option tunnel_forward '8.8.4.4:53'
+	option monitor_enable '1'
+	option enable_switch '1'
+	option switch_time '667'
+	option switch_timeout '5'
+	option switch_try_count '3'
+	option default_node_local_port '1234'
+	option component_mirror 'direct'
+	option gfwlist_url 'https://fastly.jsdelivr.net/gh/YW5vbnltb3Vz/domain-list-community@release/gfwlist.txt'
+	option chnroute_url 'https://ispip.clang.cn/all_cn.txt'
+	option adblock_url 'https://anti-ad.net/anti-ad-for-dnsmasq.conf'
+
+config server_subscribe
+	option proxy '1'
+	option auto_update '1'
+	option config_auto_update_mode '0'
+	option config_update_interval '60'
+	option auto_update_week_time '*'
+	option auto_update_day_time '2'
+	option auto_update_min_time '0'
+	option url_test_url 'https://www.google.com/generate_204'
+	option user_agent 'v2rayN/9.99'
+	option filter_words '过期/重置/套餐/剩余/网址/QQ群/官网/防失联/回国'
+
+config access_control
+	option lan_ac_mode '0'
+	option router_proxy '1'
+	list wan_fw_ips '149.154.160.0/20'
+	list wan_fw_ips '67.198.55.0/24'
+	list wan_fw_ips '91.108.4.0/22'
+	list wan_fw_ips '91.108.56.0/22'
+	list wan_fw_ips '109.239.140.0/24'
+	list wan_fw_ips '8.8.8.8'
+	list wan_fw_ips '1.1.1.1'
+	list Interface 'lan'
+
+config socks5_proxy
+	option server 'nil'
+	option local_port '1080'
+
+config http_proxy
+	option server 'nil'
+	option local_port '3128'
+	option http_auth 'none'
+
+config server_global
+	option enable_server '0'
+
+config global_xray_fragment
+	option fragment '0'
+	option noise '0'
+
+config clash_client_group
+	option enabled '0'
+	option remarks ''
+	option ip_addr ''
+	option client_mac ''
+	option policy_group ''

luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+LOCK_DIR="/var/run/ssrplusupdate.lock"
+LOOP_STAMP="/var/run/ssrplusupdate.loop"
+MODE="$(uci -q get shadowsocksr.@server_subscribe[0].config_auto_update_mode 2>/dev/null || echo 0)"
+
+mkdir "$LOCK_DIR" 2>/dev/null || exit 0
+trap 'rmdir "$LOCK_DIR" 2>/dev/null' EXIT INT TERM
+
+if [ "$1" = "loop" ]; then
+	[ "$(uci -q get shadowsocksr.@server_subscribe[0].auto_update 2>/dev/null || echo 0)" = "1" ] || exit 0
+	[ "$MODE" = "1" ] || exit 0
+
+	INTERVAL="$(uci -q get shadowsocksr.@server_subscribe[0].config_update_interval 2>/dev/null || echo 60)"
+	case "$INTERVAL" in
+		''|*[!0-9]*)
+			INTERVAL=60
+		;;
+	esac
+	[ "$INTERVAL" -gt 0 ] 2>/dev/null || INTERVAL=60
+
+	NOW="$(date +%s)"
+	LAST_RUN=0
+	[ -f "$LOOP_STAMP" ] && LAST_RUN="$(cat "$LOOP_STAMP" 2>/dev/null || echo 0)"
+	case "$LAST_RUN" in
+		''|*[!0-9]*)
+			LAST_RUN=0
+		;;
+	esac
+
+	if [ $((NOW - LAST_RUN)) -lt $((INTERVAL * 60)) ]; then
+		exit 0
+	fi
+fi
+
+/usr/bin/lua /usr/share/shadowsocksr/update.lua
+sleep 2s
+/usr/share/shadowsocksr/chinaipset.sh /var/etc/ssrplus/china_ssr.txt
+sleep 2s
+/usr/bin/lua /usr/share/shadowsocksr/subscribe.lua
+
+if [ "$1" = "loop" ]; then
+	date +%s > "$LOOP_STAMP"
+fi

luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua

@@ -0,0 +1,266 @@
+#!/usr/bin/lua
+
+------------------------------------------------
+-- This file is part of the luci-app-ssr-plus update.lua
+-- By Mattraks
+------------------------------------------------
+require "luci.sys"
+require "luci.model.uci"
+local icount = 0
+local args = arg[1]
+local uci = require "luci.model.uci".cursor()
+
+-- 以下设置更新数据库至 DNSMASQ 配置路径
+-- 获取 DNSMASQ 配置 ID
+local DNSMASQ_UCI_CONFIG = uci:get_first("dhcp", "dnsmasq", ".name")
+
+-- 获取 DNSMASQ 默认配置文件
+local DNSMASQ_CONF_PATH = "/tmp/etc/dnsmasq.conf." .. DNSMASQ_UCI_CONFIG
+
+-- 检查 DNSMASQ 配置文件是否存在，如果存在则提取 conf-dir
+for line in io.lines(DNSMASQ_CONF_PATH) do
+    local conf_dir = line:match("^conf%-dir=(.+)")
+    if conf_dir then
+        DNSMASQ_CONF_DIR = conf_dir:gsub("%s+", "") -- 去除空白字符
+        break
+    end
+end
+
+-- 设置 dnsmasq-ssrplus.d 目录路径，并去除路径末尾的斜杠
+local TMP_DNSMASQ_PATH = DNSMASQ_CONF_DIR:match("^(.-)/?$") .. "/dnsmasq-ssrplus.d"
+
+local TMP_PATH = "/var/etc/ssrplus"
+-- match comments/title/whitelist/ip address/excluded_domain
+local comment_pattern = "^[!\\[@]+"
+local ip_pattern = "^%d+%.%d+%.%d+%.%d+"
+local domain_pattern = "([%w%-%_]+%.[%w%.%-%_]+)[%/%*]*"
+local excluded_domain = {
+    "apple.com", "sina.cn", "sina.com.cn", "baidu.com", "byr.cn", "jlike.com", 
+    "weibo.com", "zhongsou.com", "youdao.com", "sogou.com", "so.com", "soso.com", 
+    "aliyun.com", "taobao.com", "jd.com", "qq.com"
+}
+-- gfwlist parameter
+local mydnsip = '127.0.0.1'
+local mydnsport = '5335'
+local ipsetname = 'gfwlist'
+local new_appledns = uci:get_first("shadowsocksr", "global", "apple_dns", "")
+local bc = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+-- base64decoding
+local function base64_dec(data)
+	data = string.gsub(data, '[^' .. bc .. '=]', '')
+	return (data:gsub('.', function(x)
+		if (x == '=') then
+			return ''
+		end
+		local r, f = '', (bc:find(x) - 1)
+		for i = 6, 1, -1 do
+			r = r .. (f % 2 ^ i - f % 2 ^ (i - 1) > 0 and '1' or '0')
+		end
+		return r;
+	end):gsub('%d%d%d?%d?%d?%d?%d?%d?', function(x)
+		if (#x ~= 8) then
+			return ''
+		end
+		local c = 0
+		for i = 1, 8 do
+			c = c + (x:sub(i, i) == '1' and 2 ^ (8 - i) or 0)
+		end
+		return string.char(c)
+	end))
+end
+-- check if domain is excluded
+local function check_excluded_domain(value)
+	for _, domain in ipairs(excluded_domain) do
+		if value:find(domain) then
+			return true
+		end
+	end
+end
+-- gfwlist转码至dnsmasq格式
+local function generate_gfwlist(type)
+    local domains, domains_map = {}, {}
+    local out = io.open("/tmp/ssr-update." .. type, "w")
+    for line in io.lines("/tmp/ssr-update.tmp") do
+        if not (string.find(line, comment_pattern) or string.find(line, ip_pattern) or check_excluded_domain(line)) then
+            local start, finish, match = string.find(line, domain_pattern)
+            if start and not domains_map[match] then
+                domains_map[match] = true
+                table.insert(domains, match)
+            end
+        end
+    end
+    for _, domain in ipairs(domains) do
+        out:write(string.format("server=/%s/%s#%s\n", domain, mydnsip, mydnsport))
+        out:write(string.format("ipset=/%s/%s\n", domain, ipsetname))
+    end
+    out:close()
+    os.remove("/tmp/ssr-update.tmp")
+end
+
+-- 更换 Apple dns
+local function generate_apple(type)
+	local domains, domains_map = {}, {}
+	local out = io.open("/tmp/ssr-update." .. type, "w")
+	for line in io.lines("/tmp/ssr-update.tmp") do
+		if not (string.find(line, comment_pattern)) then
+			local start, finish, match = string.find(line, domain_pattern)
+			if start and not domains_map[match] then
+				domains_map[match] = true
+				match = string.gsub(match, "%s", "") --从域名中去除所有空白字符
+				table.insert(domains, match)
+			end
+		end
+	end
+	for _, domain in ipairs(domains) do
+		out:write(string.format("server=/%s/%s\n", domain, new_appledns))
+	end
+	out:close()
+	os.remove("/tmp/ssr-update.tmp")
+end
+
+-- adblock转码至dnsmasq格式
+local function generate_adblock(type)
+	local domains, domains_map = {}, {}
+	local out = io.open("/tmp/ssr-update." .. type, "w")
+	for line in io.lines("/tmp/ssr-update.tmp") do
+		if not (string.find(line, comment_pattern)) then
+			local start, finish, match = string.find(line, domain_pattern)
+			if start and not domains_map[match] then
+				domains_map[match] = true
+				table.insert(domains, match)
+			end
+		end
+	end
+	for _, domain in ipairs(domains) do
+		out:write(string.format("address=/%s/\n", domain))
+	end
+	out:close()
+	os.remove("/tmp/ssr-update.tmp")
+end
+
+local log = function(...)
+	if args then
+		print("{ret=" .. table.concat({...}, ",retcount=") .. "}")
+	else
+		print(os.date("%Y-%m-%d %H:%M:%S ") .. table.concat({...}, " "))
+	end
+end
+
+local function update(url, file, type, file2)
+	local Num = 1
+	local refresh_cmd = "curl -sSL --insecure -o /tmp/ssr-update." .. type .. " " .. url
+	local sret = luci.sys.call(refresh_cmd)
+	if sret == 0 then
+		if type == "gfw_data" then
+			local gfwlist = io.open("/tmp/ssr-update." .. type, "r")
+			local decode = gfwlist:read("*a")
+			if not decode:find("google") then
+				decode = base64_dec(decode)
+			end
+			gfwlist:close()
+			-- 写回gfwlist
+			gfwlist = io.open("/tmp/ssr-update.tmp", "w")
+			gfwlist:write(decode)
+			gfwlist:close()
+			generate_gfwlist(type)
+			Num = 2
+		end
+		if type == "apple_data" then
+			local apple = io.open("/tmp/ssr-update." .. type, "r")
+			local decode = apple:read("*a")
+			if not decode:find("apple") then
+				decode = base64_dec(decode)
+			end
+			apple:close()
+			-- 写回applechina
+			apple = io.open("/tmp/ssr-update.tmp", "w")
+			apple:write(decode)
+			apple:close()
+			if new_appledns and new_appledns ~= "" then
+				generate_apple(type)
+			else
+				os.remove("/tmp/ssr-update.tmp")
+			end
+		end
+		if type == "ad_data" then
+			local adblock = io.open("/tmp/ssr-update." .. type, "r")
+			local decode = adblock:read("*a")
+			if decode:find("address=") then
+				adblock:close()
+			else
+				adblock:close()
+				-- 写回adblock
+				adblock = io.open("/tmp/ssr-update.tmp", "w")
+				adblock:write(decode)
+				adblock:close()
+				generate_adblock(type)
+			end
+		end
+		local new_md5 = luci.sys.exec("echo -n $([ -f '/tmp/ssr-update." .. type .. "' ] && md5sum /tmp/ssr-update." .. type .. " | awk '{print $1}')")
+		local old_md5 = luci.sys.exec("echo -n $([ -f '" .. file .. "' ] && md5sum " .. file .. " | awk '{print $1}')")
+		if new_md5 == old_md5 then
+			if args then
+				log(1)
+			else
+				log("你已经是最新数据，无需更新！")
+			end
+		else
+			icount = luci.sys.exec("cat /tmp/ssr-update." .. type .. " | wc -l")
+			luci.sys.exec("cp -f /tmp/ssr-update." .. type .. " " .. file)
+			if file2 then
+				luci.sys.exec("cp -f /tmp/ssr-update." .. type .. " " .. file2)
+			end
+			if type == "gfw_data" or type == "ad_data" then
+				luci.sys.call("/usr/share/shadowsocksr/gfw2ipset.sh")
+			else
+				if luci.sys.call("command -v ipset >/dev/null 2>&1") == 0 then
+					luci.sys.call("/usr/share/shadowsocksr/chinaipset.sh " .. TMP_PATH .. "/china_ssr.txt")
+				end
+			end
+			if args then
+				log(0, tonumber(icount) / Num)
+			else
+				log("更新成功！ 新的总记录数：" .. tostring(tonumber(icount) / Num))
+			end
+		end
+	else
+		if args then
+			log(-1)
+		else
+			log("更新失败！")
+		end
+	end
+	os.remove("/tmp/ssr-update." .. type)
+end
+
+if args then
+	if args == "gfw_data" then
+		update(uci:get_first("shadowsocksr", "global", "gfwlist_url"), "/etc/ssrplus/gfw_list.conf", args, TMP_DNSMASQ_PATH .. "/gfw_list.conf")
+		os.exit(0)
+	end
+	if args == "ip_data" then
+		update(uci:get_first("shadowsocksr", "global", "chnroute_url"), "/etc/ssrplus/china_ssr.txt", args, TMP_PATH .. "/china_ssr.txt")
+		os.exit(0)
+	end
+	if args == "apple_data" then
+		update(uci:get_first("shadowsocksr", "global", "apple_url"), "/etc/ssrplus/applechina.conf", args, TMP_DNSMASQ_PATH .. "/applechina.conf")
+		os.exit(0)
+	end
+	if args == "ad_data" then
+		update(uci:get_first("shadowsocksr", "global", "adblock_url"), "/etc/ssrplus/ad.conf", args, TMP_DNSMASQ_PATH .. "/ad.conf")
+		os.exit(0)
+	end
+else
+	log("正在更新【GFW列表】数据库")
+	update(uci:get_first("shadowsocksr", "global", "gfwlist_url"), "/etc/ssrplus/gfw_list.conf", "gfw_data", TMP_DNSMASQ_PATH .. "/gfw_list.conf")
+	log("正在更新【国内IP段】数据库")
+	update(uci:get_first("shadowsocksr", "global", "chnroute_url"), "/etc/ssrplus/china_ssr.txt", "ip_data", TMP_PATH .. "/china_ssr.txt")
+	if uci:get_first("shadowsocksr", "global", "apple_optimization", "0") == "1" then
+		log("正在更新【Apple域名】数据库")
+		update(uci:get_first("shadowsocksr", "global", "apple_url"), "/etc/ssrplus/applechina.conf", "apple_data", TMP_DNSMASQ_PATH .. "/applechina.conf")
+	end
+	if uci:get_first("shadowsocksr", "global", "adblock", "0") == "1" then
+		log("正在更新【广告屏蔽】数据库")
+		update(uci:get_first("shadowsocksr", "global", "adblock_url"), "/etc/ssrplus/ad.conf", "ad_data", TMP_DNSMASQ_PATH .. "/ad.conf")
+	end
+end

luci-app-ssr-plus/root/usr/share/ucitrack/luci-app-ssr-plus.json

@@ -0,0 +1,4 @@
+{
+	"config": "shadowsocksr",
+	"init": "shadowsocksr"
+}