update 2026-10-03 17:36:19

luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua

@@ -93,15 +93,13 @@ end
 local function get_geosite(list_arg, out_path)
 	local geosite_path = api.uci_get_c("@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/"
 	geosite_path = geosite_path:match("^(.*)/") .. "/geosite.dat"
-	if not is_file_nonzero(geosite_path) then return 1 end
+	if not is_file_nonzero(geosite_path) then return 1, "File geosite.dat not found" end
+	if not list_arg or list_arg == "" then return 1, "Site list cannot be empty" end
+	if not out_path or out_path == "" then return 1, "Output path cannot be empty" end
 	local bin = api.finded_com("geoview")
-	if bin and list_arg and out_path then
-		local cmd = string.format("%q -type geosite -append=true -input %q -list %q -output %q -lowmem=true",
-			bin, geosite_path, list_arg, out_path)
-		sys.call(cmd)
-		return 0
-	end
-	return 1
+	local cmd = string.format("%q -type geosite -append=true -input %q -list %q -output %q -lowmem=true",
+		bin, geosite_path, list_arg, out_path)
+	return api.exec_call(cmd)
 end
 
 sys.call("mkdir -p %s" % FLAG_PATH)
@@ -127,6 +125,9 @@ end
 --自定义规则组，后声明的组具有更高优先级
 --屏蔽列表
 local file_block_host = CACHE_RULES_PATH .. "/block_host"
+if not fs.access(file_block_host .. "_ok") then
+	api.remove(file_block_host)
+end
 if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 	local block_domain, lookup_block_domain = {}, {}
 	local geosite_arg = ""
@@ -152,13 +153,19 @@ if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_block_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_block_host)
+		if code == 0 then
 			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)完成")
 		else
-			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)失败！")
+			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_block_host) then
+		sys.call("touch " .. file_block_host .. "_ok")
+	end
 end
 if USE_BLOCK_LIST == "1" and is_file_nonzero(file_block_host) then
 	tmp_lines = {
@@ -214,6 +221,9 @@ end
 
 --直连（白名单）列表
 local file_direct_host = CACHE_RULES_PATH .. "/direct_host"
+if not fs.access(file_direct_host .. "_ok") then
+	api.remove(file_direct_host)
+end
 if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 	local direct_domain, lookup_direct_domain = {}, {}
 	local geosite_arg = ""
@@ -239,13 +249,19 @@ if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_direct_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_direct_host)
+		if code == 0 then
 			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)完成")
 		else
-			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)失败！")
+			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_direct_host) then
+		sys.call("touch " .. file_direct_host .. "_ok")
+	end
 end
 if USE_DIRECT_LIST == "1" and is_file_nonzero(file_direct_host) then
 	local sets = {
@@ -264,6 +280,9 @@ end
 
 --代理（黑名单）列表
 local file_proxy_host = CACHE_RULES_PATH .. "/proxy_host"
+if not fs.access(file_proxy_host .. "_ok") then
+	api.remove(file_proxy_host)
+end
 if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 	local proxy_domain, lookup_proxy_domain = {}, {}
 	local geosite_arg = ""
@@ -289,13 +308,19 @@ if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_proxy_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_proxy_host)
+		if code == 0 then
 			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)完成")
 		else
-			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)失败！")
+			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_proxy_host) then
+		sys.call("touch " .. file_proxy_host .. "_ok")
+	end
 end
 if USE_PROXY_LIST == "1" and is_file_nonzero(file_proxy_host) then
 	local sets = {
@@ -480,20 +505,22 @@ if IS_SHUNT_NODE and not only_global then
 	end
 
 	if not USE_CACHE and USE_GEOVIEW == "1" then
-		local return_direct, return_proxy, return_black
-		if geosite_direct_arg ~= "" then
-			return_direct = get_geosite(geosite_direct_arg, shunt_direct_host_tmp)
+		local ok = true
+		local function resolve(arg, dest)
+		if arg == "" then return end
+			local code, out = get_geosite(arg, dest)
+			if code ~= 0 then
+				ok = false
+				log("  - 解析[分流节点] Geosite 失败！[" .. out .. "]")
+			end
 		end
-		if geosite_proxy_arg ~= "" then
-			return_proxy = get_geosite(geosite_proxy_arg, shunt_proxy_host)
-		end
-		if geosite_black_arg ~= "" then
-			return_black = get_geosite(geosite_black_arg, shunt_black_host)
-		end
-		if return_direct == 0 and return_proxy == 0 and return_black == 0 then
+		resolve(geosite_direct_arg, shunt_direct_host_tmp)
+		resolve(geosite_proxy_arg,  shunt_proxy_host)
+		resolve(geosite_black_arg,  shunt_black_host)
+		if ok then
 			log("  - 解析[分流节点] Geosite 完成")
 		else
-			log("  - 解析[分流节点] Geosite 失败！")
+			api.remove(MD5_FILE)
 		end
 	end
 
@@ -577,7 +604,7 @@ end
 --是否接受直连 DNS 空响应
 if DEFAULT_TAG == "none_noip" then table.insert(config_lines, "noip-as-chnip") end
 
-if DEFAULT_TAG == nil or DEFAULT_TAG == "smart" or DEFAULT_TAG == "none_noip" then DEFAULT_TAG = "none" end
+if not DEFAULT_TAG or DEFAULT_TAG == "smart" or DEFAULT_TAG == "none_noip" then DEFAULT_TAG = "none" end
 
 table.insert(config_lines, "default-tag " .. DEFAULT_TAG)
 

luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua

@@ -321,16 +321,16 @@ function add_rule(var)
 	local function foreach_geosite(list_arg, callback)
 		local geosite_path = api.uci_get_c("@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/"
 		geosite_path = geosite_path:match("^(.*)/") .. "/geosite.dat"
-		if not fs.access(geosite_path) then return end
+		if not fs.access(geosite_path) then return 1, "File geosite.dat not found" end
+		if not list_arg or list_arg == "" then return 1, "Site list cannot be empty" end
 		local bin = api.finded_com("geoview")
-		if not (bin and list_arg) then return end
 		local cmd = string.format("%q -type geosite -action extract -input %q -list %q -lowmem=true", bin, geosite_path, list_arg)
-		local pipe = io.popen(cmd)
-		if not pipe then return end
-		for line in pipe:lines() do
-			if line ~= "" then callback(line) end
+		local code, out = api.exec_call(cmd)
+		if code ~= 0 then return code, out end
+		for line in out:gmatch("[^\r\n]+") do
+			callback(line)
 		end
-		pipe:close()
+		return 0
 	end
 
 	local function get_dns_config_key()
@@ -405,6 +405,7 @@ function add_rule(var)
 
 	if not fs.access(CACHE_DNS_PATH) then
 		fs.mkdir(CACHE_DNS_PATH)
+		local GEO_SUCCESS = true
 
 		--屏蔽列表
 		if USE_CHINADNS_NG == "0" and USE_BLOCK_LIST == "1" then
@@ -425,10 +426,15 @@ function add_rule(var)
 				f:close()
 			end
 			if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-				foreach_geosite(geosite_arg, function(line)
+				local code, out = foreach_geosite(geosite_arg, function(line)
 					set_domain_address(line, "")
 				end)
-				log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)完成")
+				if code == 0 then
+					log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)完成")
+				else
+					log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)失败！[" .. out .. "]")
+					GEO_SUCCESS = false
+				end
 			end
 		end
 
@@ -503,12 +509,17 @@ function add_rule(var)
 					log(string.format("  - 域名白名单(whitelist)：%s", fwd_dns or "默认"))
 				end
 				if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-					foreach_geosite(geosite_arg, function(line)
+					local code, out = foreach_geosite(geosite_arg, function(line)
 						add_excluded_domain(line)
 						set_domain_dns(line, fwd_dns)
 						set_domain_ipset(line, table.concat(sets, ","))
 					end)
-					log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)完成")
+					if code == 0 then
+						log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)完成")
+					else
+						log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)失败！[" .. out .. "]")
+						GEO_SUCCESS = false
+					end
 				end
 			end
 		end
@@ -556,7 +567,7 @@ function add_rule(var)
 					log(string.format("  - 代理域名表(blacklist)：%s", fwd_dns or "默认"))
 				end
 				if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-					foreach_geosite(geosite_arg, function(line)
+					local code, out = foreach_geosite(geosite_arg, function(line)
 						add_excluded_domain(line)
 						if NO_PROXY_IPV6 == "1" then
 							set_domain_address(line, "::")
@@ -564,7 +575,12 @@ function add_rule(var)
 						set_domain_dns(line, fwd_dns)
 						set_domain_ipset(line, table.concat(sets, ","))
 					end)
-					log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)完成")
+					if code == 0 then
+						log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)完成")
+					else
+						log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)失败！[" .. out .. "]")
+						GEO_SUCCESS = false
+					end
 				end
 			end
 		end
@@ -698,12 +714,17 @@ function add_rule(var)
 					end
 
 					if USE_GFW_LIST == "1" and CHN_LIST == "0" and USE_GEOVIEW == "1" and geosite_arg ~= "" then  --仅GFW模式解析geosite
-						foreach_geosite(geosite_arg, function(line)
+						local code, out = foreach_geosite(geosite_arg, function(line)
 							add_excluded_domain(line)
 							set_domain_dns(line, fwd_dns)
 							set_domain_ipset(line, table.concat(sets, ","))
 						end)
-						log(string.format("  - 解析分流规则(%s) Geosite 完成", s.remarks))
+						if code == 0 then
+							log(string.format("  - 解析分流规则(%s) Geosite 完成", s.remarks))
+						else
+							log(string.format("  - 解析分流规则(%s) Geosite 失败！[" .. out .. "]", s.remarks))
+							GEO_SUCCESS = false
+						end
 					end
 
 					log(string.format("  - Sing-Box/Xray分流规则(%s)：%s", s.remarks, fwd_dns or "默认"))
@@ -755,7 +776,8 @@ function add_rule(var)
 			server_out:close()
 			ipset_out:close()
 		end
-
+		
+		if not GEO_SUCCESS then new_text = "" end
 		local f_out = io.open(CACHE_TEXT_FILE, "a")
 		f_out:write(new_text)
 		f_out:close()

luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua

@@ -99,15 +99,13 @@ end
 local function get_geosite(list_arg, out_path)
 	local geosite_path = api.uci_get_c("@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/"
 	geosite_path = geosite_path:match("^(.*)/") .. "/geosite.dat"
-	if not is_file_nonzero(geosite_path) then return 1 end
+	if not is_file_nonzero(geosite_path) then return 1, "File geosite.dat not found" end
+	if not list_arg or list_arg == "" then return 1, "Site list cannot be empty" end
+	if not out_path or out_path == "" then return 1, "Output path cannot be empty" end
 	local bin = api.finded_com("geoview")
-	if bin and list_arg and out_path then
-		local cmd = string.format("%q -type geosite -append=true -input %q -list %q -output %q -lowmem=true",
-			bin, geosite_path, list_arg, out_path)
-		sys.call(cmd)
-		return 0
-	end
-	return 1
+	local cmd = string.format("%q -type geosite -append=true -input %q -list %q -output %q -lowmem=true",
+		bin, geosite_path, list_arg, out_path)
+	return api.exec_call(cmd)
 end
 
 sys.call("mkdir -p %s" % FLAG_PATH)
@@ -285,6 +283,9 @@ end
 
 --屏蔽列表
 local file_block_host = CACHE_RULES_PATH .. "/block_host"
+if not fs.access(file_block_host .. "_ok") then
+	api.remove(file_block_host)
+end
 if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 	local block_domain, lookup_block_domain = {}, {}
 	local geosite_arg = ""
@@ -310,13 +311,19 @@ if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_block_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_block_host)
+		if code == 0 then
 			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)完成")
 		else
-			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)失败！")
+			log("  - 解析[屏蔽列表] Geosite 到屏蔽域名表(blocklist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_block_host) then
+		sys.call("touch " .. file_block_host .. "_ok")
+	end
 end
 if USE_BLOCK_LIST == "1" and is_file_nonzero(file_block_host) then
 	local domain_set_name = "psw-block"
@@ -375,6 +382,9 @@ end
 
 --直连（白名单）列表
 local file_direct_host = CACHE_RULES_PATH .. "/direct_host"
+if not fs.access(file_direct_host .. "_ok") then
+	api.remove(file_direct_host)
+end
 if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 	local direct_domain, lookup_direct_domain = {}, {}
 	local geosite_arg = ""
@@ -400,13 +410,19 @@ if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_direct_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_direct_host)
+		if code == 0 then
 			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)完成")
 		else
-			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)失败！")
+			log("  - 解析[直连列表] Geosite 到域名白名单(whitelist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_direct_host) then
+		sys.call("touch " .. file_direct_host .. "_ok")
+	end
 end
 if USE_DIRECT_LIST == "1" and is_file_nonzero(file_direct_host) then
 	local domain_set_name = "psw-directlist"
@@ -427,6 +443,9 @@ end
 
 --代理（黑名单）列表
 local file_proxy_host = CACHE_RULES_PATH .. "/proxy_host"
+if not fs.access(file_proxy_host .. "_ok") then
+	api.remove(file_proxy_host)
+end
 if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 	local proxy_domain, lookup_proxy_domain = {}, {}
 	local geosite_arg = ""
@@ -452,13 +471,19 @@ if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 		end
 		f_out:close()
 	end
+	local success = true
 	if USE_GEOVIEW == "1" and geosite_arg ~= "" then
-		if get_geosite(geosite_arg, file_proxy_host) == 0 then
+		local code, out = get_geosite(geosite_arg, file_proxy_host)
+		if code == 0 then
 			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)完成")
 		else
-			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)失败！")
+			log("  - 解析[代理列表] Geosite 到代理域名表(blacklist)失败！[" .. out .. "]")
+			success = false
 		end
 	end
+	if success and fs.access(file_proxy_host) then
+		sys.call("touch " .. file_proxy_host .. "_ok")
+	end
 end
 if USE_PROXY_LIST == "1" and is_file_nonzero(file_proxy_host) then
 	local domain_set_name = "psw-proxylist"
@@ -647,20 +672,22 @@ if IS_SHUNT_NODE and not only_global then
 	end
 
 	if not USE_CACHE and USE_GEOVIEW == "1" then
-		local return_direct, return_proxy, return_black
-		if geosite_direct_arg ~= "" then
-			return_direct = get_geosite(geosite_direct_arg, shunt_direct_host)
+		local ok = true
+		local function resolve(arg, dest)
+		if arg == "" then return end
+			local code, out = get_geosite(arg, dest)
+			if code ~= 0 then
+				ok = false
+				log("  - 解析[分流节点] Geosite 失败！[" .. out .. "]")
+			end
 		end
-		if geosite_proxy_arg ~= "" then
-			return_proxy = get_geosite(geosite_proxy_arg, shunt_proxy_host)
-		end
-		if geosite_black_arg ~= "" then
-			return_black = get_geosite(geosite_black_arg, shunt_black_host)
-		end
-		if return_direct == 0 and return_proxy == 0 and return_black == 0 then
+		resolve(geosite_direct_arg, shunt_direct_host)
+		resolve(geosite_proxy_arg,  shunt_proxy_host)
+		resolve(geosite_black_arg,  shunt_black_host)
+		if ok then
 			log("  - 解析[分流节点] Geosite 完成")
 		else
-			log("  - 解析[分流节点] Geosite 失败！")
+			api.remove(MD5_FILE)
 		end
 	end
 

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -40,7 +40,7 @@ ip6t_m="$ip6t -t mangle -w"
 [ -z "$ip6t" ] || [ -z "$(lsmod | grep 'ip6table_nat')" ] && ip6t_n="eval #$ip6t_n"
 [ -z "$ip6t" ] || [ -z "$(lsmod | grep 'ip6table_mangle')" ] && ip6t_m="eval #$ip6t_m"
 FWI=$(uci -q get firewall.passwall.path 2>/dev/null)
-FAKE_IP="198.18.0.0/15"
+FAKE_IP="198.18.0.0/16"
 FAKE_IP_6="2001:2::/48"
 
 USE_GEOVIEW=0

luci-app-passwall/root/usr/share/passwall/nftables.sh

@@ -46,7 +46,7 @@ NFTSET_SHUNT6_STATIC="${NFTSET_SHUNT6}_static"
 FWMARK="0x50535731"
 
 FWI=$(uci -q get firewall.passwall.path 2>/dev/null)
-FAKE_IP="198.18.0.0/15"
+FAKE_IP="198.18.0.0/16"
 FAKE_IP_6="2001:2::/48"
 
 USE_GEOVIEW=0