update 2026-10-06 04:10:42

luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua

@@ -31,6 +31,7 @@ local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | aw
 
 local local_version = api.get_app_version("sing-box"):match("[^v]+")
 local version_ge_1_14_0 = api.compare_versions(local_version, ">=", "1.14.0")
+local version_ge_1_15_0 = api.compare_versions(local_version, ">=", "1.15.0")
 
 local ss_method_list = {
 	"none", "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305",
@@ -249,6 +250,25 @@ o:value("", translate("Disable"))
 o:value("xtls-rprx-vision")
 o:depends({ protocol = "vless" , tls = true })
 
+-- [[ MASQUE ]] --
+if version_ge_1_15_0 and singbox_tags:find("with_quic") then
+	s.fields["protocol"]:value("masque", "MASQUE")
+	s.fields["users"]:depends({ protocol = "masque" })
+
+	o = s:option(Value, "masque_path", translate("MASQUE Path"))
+	o:depends({ protocol = "masque" })
+
+	o = s:option(DynamicList, "masque_address", translate("MASQUE Address"))
+	o.rmempty = false
+	o:depends({ protocol = "masque" })
+
+	o = s:option(Value, "masque_mtu", "MTU")
+	o.datatype = "uinteger"
+	o.default = "1280"
+	o:depends({ protocol = "masque" })
+end
+
+---- [[ TLS ]]
 o = s:option(Flag, "tls", translate("TLS"))
 o.default = 0
 o.validate = function(self, value, t)
@@ -325,6 +345,7 @@ o:depends({ protocol = "naive" })
 o:depends({ protocol = "hysteria" })
 o:depends({ protocol = "tuic" })
 o:depends({ protocol = "hysteria2" })
+o:depends({ protocol = "masque" })
 
 o = s:option(FileUpload, "tls_certificateFile", translate("Path to the certificate file"), translate("as:") .. "/etc/ssl/fullchain.crt")
 o.default = m:get(s.section, "tls_certificateFile") or "/etc/config/ssl/" .. arg[1] .. ".crt"
@@ -334,6 +355,7 @@ o:depends({ protocol = "naive", tls_use_pem = false })
 o:depends({ protocol = "hysteria", tls_use_pem = false })
 o:depends({ protocol = "tuic", tls_use_pem = false })
 o:depends({ protocol = "hysteria2", tls_use_pem = false })
+o:depends({ protocol = "masque", tls_use_pem = false })
 o.validate = function(self, value, t)
 	if value and value ~= "" then
 		if not api.fs.access(value) then
@@ -353,6 +375,7 @@ o:depends({ protocol = "naive", tls_use_pem = false })
 o:depends({ protocol = "hysteria", tls_use_pem = false })
 o:depends({ protocol = "tuic", tls_use_pem = false })
 o:depends({ protocol = "hysteria2", tls_use_pem = false })
+o:depends({ protocol = "masque", tls_use_pem = false })
 o.validate = function(self, value, t)
 	if value and value ~= "" then
 		if not api.fs.access(value) then
@@ -397,6 +420,7 @@ o:depends({ protocol = "naive" })
 o:depends({ protocol = "hysteria" })
 o:depends({ protocol = "tuic" })
 o:depends({ protocol = "hysteria2", hysteria2_realms = false })
+o:depends({ protocol = "masque" })
 
 o = s:option(TextValue, "ech_key", translate("ECH Key"))
 o.default = ""

luci-app-passwall/luasrc/model/cbi/passwall/server/type/2_xray.lua

@@ -65,6 +65,7 @@ o:value("shadowsocks", "Shadowsocks")
 o:value("trojan", "Trojan")
 o:value("hysteria2", "Hysteria2")
 o:value("wireguard", "WireGuard")
+o:value("masque", "MASQUE")
 o:value("tunnel", "Tunnel")
 o:depends({ custom = false })
 
@@ -85,6 +86,7 @@ o:depends({ protocol = "vless" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "hysteria2" })
 o:depends({ protocol = "wireguard" })
+o:depends({ protocol = "masque" })
 
 o = s:option(ListValue, "d_protocol", translate("Destination protocol"))
 o:value("tcp", "TCP")
@@ -188,6 +190,19 @@ o:depends({ protocol = "hysteria2", hysteria2_ignore_client_bandwidth = false })
 o = s:option(Value, "hysteria2_down_mbps", translate("Max download Mbps"))
 o:depends({ protocol = "hysteria2", hysteria2_ignore_client_bandwidth = false })
 
+-- [[ MASQUE ]] --
+o = s:option(Value, "masque_path", translate("MASQUE Path"))
+o:depends({ protocol = "masque" })
+
+o = s:option(DynamicList, "masque_address", translate("MASQUE Address"))
+o.rmempty = false
+o:depends({ protocol = "masque" })
+
+o = s:option(Value, "masque_mtu", "MTU")
+o.datatype = "uinteger"
+o.default = "1280"
+o:depends({ protocol = "masque" })
+
 ---- [[ TLS ]]
 o = s:option(Flag, "tls", translate("TLS"))
 o.default = 0
@@ -274,12 +289,14 @@ end
 o = s:option(Flag, "tls_use_pem", translate("Use PEM"), translate("Use certificate and private key PEM content."))
 o:depends({ tls = true, reality = false })
 o:depends({ protocol = "hysteria2" })
+o:depends({ protocol = "masque" })
 
 o = s:option(FileUpload, "tls_certificateFile", translate("Path to the certificate file"), translate("as:") .. "/etc/ssl/fullchain.crt")
 o.default = m:get(s.section, "tls_certificateFile") or "/etc/config/ssl/" .. s.section .. ".crt"
 if o and o:formvalue(s.section) then o.default = o:formvalue(s.section) end
 o:depends({ tls = true, reality = false, tls_use_pem = false })
 o:depends({ protocol = "hysteria2", tls_use_pem = false })
+o:depends({ protocol = "masque", tls_use_pem = false })
 o.validate = function(self, value, t)
 	if value and value ~= "" then
 		if not api.fs.access(value) then
@@ -296,6 +313,7 @@ o.default = m:get(s.section, "tls_keyFile") or "/etc/config/ssl/" .. s.section .
 if o and o:formvalue(s.section) then o.default = o:formvalue(s.section) end
 o:depends({ tls = true, reality = false, tls_use_pem = false })
 o:depends({ protocol = "hysteria2", tls_use_pem = false })
+o:depends({ protocol = "masque", tls_use_pem = false })
 o.validate = function(self, value, t)
 	if value and value ~= "" then
 		if not api.fs.access(value) then
@@ -336,6 +354,7 @@ end
 o = s:option(Flag, "ech", translate("ECH"))
 o.default = "0"
 o:depends({ tls = true, reality = false })
+o:depends({ protocol = "masque" })
 
 o = s:option(TextValue, "ech_key", translate("ECH Key"))
 o.default = ""

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -742,6 +742,11 @@ function gen_config_server(node)
 		{ type = "direct", tag = "direct" }
 	}
 
+	if node.protocol == "masque" then
+		node.tls = "1"
+		node.reality = nil
+	end
+
 	local tls = {
 		enabled = true,
 		certificate_path = (node.tls_use_pem ~= "1") and node.tls_certificateFile or nil,
@@ -853,7 +858,7 @@ function gen_config_server(node)
 			local user = api.uci_get_s(v) or {}
 			if user[".type"] == "user" then
 				local u = {}
-				if node.protocol == "mixed" or node.protocol == "socks" or node.protocol == "http" or node.protocol == "naive" then
+				if node.protocol == "mixed" or node.protocol == "socks" or node.protocol == "http" or node.protocol == "naive" or node.protocol == "masque" then
 					u.username = user.username
 					u.password = user.password
 				end
@@ -900,6 +905,18 @@ function gen_config_server(node)
 
 	local protocol_table = nil
 
+	if node.protocol == "masque" then
+		tls.alpn = nil
+		protocol_table = {
+			type = "masque-server",
+			users = users,
+			path = (node.masque_path and node.masque_path ~= "") and node.masque_path or nil,
+			address = node.masque_address,
+			mtu = tonumber(node.masque_mtu or 1280),
+			tls = tls
+		}
+	end
+
 	if node.protocol == "mixed" then
 		protocol_table = {
 			users = users,
@@ -1095,8 +1112,7 @@ function gen_config_server(node)
 		end
 	end
 
-	if node.protocol == "wireguard" then
-		inbound.listen = nil
+	if node.protocol == "wireguard" or node.protocol == "masque" then
 		table.insert(endpoints, inbound)
 	else
 		table.insert(inbounds, inbound)

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -540,6 +540,10 @@ function gen_config_server(node)
 					u.user = user.username
 					u.pass = user.password
 				end
+				if node.protocol == "masque" then
+					u.email = user.username
+					u.pass = user.password
+				end
 				if node.protocol == "shadowsocks" or node.protocol == "trojan" then
 					u.email = user.username
 					u.password = user.password
@@ -610,6 +614,18 @@ function gen_config_server(node)
 			version = 2,
 			users = users
 		}
+	elseif node.protocol == "masque" then
+		node.transport = "masque"
+		node.tls = "1"
+		node.reality = nil
+		node.alpn = nil
+		node.fallback = nil
+		node.finalmask = nil
+		settings = {
+			users = users,
+			address = node.masque_address,
+			mtu = tonumber(node.masque_mtu or 1280)
+		}
 	elseif node.protocol == "tunnel" then
 		settings = {
 			allowedNetwork = node.d_protocol,
@@ -719,6 +735,9 @@ function gen_config_server(node)
 				streamSettings = {
 					method = node.transport,
 					security = "none",
+					masqueSettings = (node.protocol == "masque") and {
+						path = (node.masque_path and node.masque_path ~= "") and node.masque_path or nil
+					} or nil,
 					tlsSettings = ("1" == node.tls) and {
 						disableSystemRoot = false,
 						certificates = {

luci-app-passwall/po/zh-cn/passwall.po

@@ -2183,3 +2183,6 @@ msgstr "MASQUE 路径"
 
 msgid "Custom HTTP Headers"
 msgstr "自定义 HTTP 请求头"
+
+msgid "MASQUE Address"
+msgstr "MASQUE 隧道地址"