update 2026-09-15 17:08:00

clashoo/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=clashoo
-PKG_SHORT_SHA:=dc66a8a
+PKG_SHORT_SHA:=ab405ba
 PKG_COMMIT_DATE:=2026.09.14
 
 PKG_VERSION:=$(PKG_COMMIT_DATE)~$(PKG_SHORT_SHA)
@@ -11,8 +11,8 @@ PKG_SOURCE:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA).tar.gz
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-clashoo/releases/download/mihomo-src
-PKG_SOURCE_VERSION:=dc66a8a180c0fa1c2b91cf5413426e68dbca320e
-PKG_HASH:=e7003359dc55a62a6f31b45f9123fc14a0a58f66c8cc4a3514ab15e94f08008b
+PKG_SOURCE_VERSION:=ab405bad5beeeac8b003bb01f60f134f6df54471
+PKG_HASH:=bd7a8035d67755720178a8fd2c49a9d82a4578493aae80ae46d5e6d3141cfaee
 PKG_BUILD_VERSION:=alpha-$(PKG_SHORT_SHA)
 
 PKG_LICENSE:=GPL3.0+

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -93,15 +93,11 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end
 		local remarks = node.remarks
 
-		local proxy_tag = nil
-		local fragment = nil
-		local record_fragment = nil
-		local run_socks_instance = true
+		local proxy_tag, fragment, record_fragment
 		if proxy_table ~= nil and type(proxy_table) == "table" then
 			proxy_tag = proxy_table.tag or nil
 			fragment = (proxy_table.fragment and node.protocol ~= "naive" and not node.hysteria2_realms) and true or nil
 			record_fragment = (proxy_table.record_fragment and node.protocol ~= "naive" and not node.hysteria2_realms) and true or nil
-			run_socks_instance = proxy_table.run_socks_instance
 		end
 
 		if node.type ~= "sing-box" then
@@ -110,7 +106,12 @@ function gen_outbound(flag, node, tag, proxy_table)
 				proxy_tag = "socks <- " .. node_id
 			else
 				local new_port
-				if run_socks_instance then
+				local run_socks_instance = true
+				if NO_RUN then
+					TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001
+					new_port = TMP_PORT
+					run_socks_instance = nil
+				else
 					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
 					if relay_port == "" then
 						local cache = api.get_socks_port_by_cache(node_id)
@@ -140,9 +141,6 @@ function gen_outbound(flag, node, tag, proxy_table)
 							api.set_socks_port_to_cache(node_id, new_port)
 						end
 					end
-				else
-					TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001  -- 导出配置时作为演示
-					new_port = TMP_PORT
 				end
 				if new_port then
 					node = {
@@ -1163,10 +1161,11 @@ function gen_config(var)
 	local dns_cache = var["dns_cache"]
 	local dns_socks_address = var["dns_socks_address"]
 	local dns_socks_port = var["dns_socks_port"]
-	local no_run = var["no_run"]
 	local use_proxy_list = var["use_proxy_list"]
 	local use_gfw_list = var["use_gfw_list"]
 	local chn_list = var["chn_list"]
+	local run_in_global = var["run_in_global"]
+	NO_RUN = var["no_run"]
 
 	local dns_domain_rules = {}
 	local dns = nil
@@ -1360,7 +1359,9 @@ function gen_config(var)
 				ut_nodes = _node.urltest_node
 			end
 
-			-- api.log("  - 加载 Sing-Box URLTest 节点【" .. (_node.remarks or "") .. "】，子节点数量：" .. #(ut_nodes or {}))
+			if not NO_RUN and run_in_global then
+				api.log("  - 加载 Sing-Box URLTest 节点【" .. (_node.remarks or "") .. "】，子节点数量：" .. #(ut_nodes or {}))
+			end
 
 			local valid_nodes = {}
 			for i = 1, #(ut_nodes or {}) do
@@ -1375,7 +1376,7 @@ function gen_config(var)
 					end
 				end
 				if is_new_ut_node then
-					local outboundTag = gen_outbound_get_tag(flag, ut_node_id, ut_node_tag, { fragment = singbox_settings.fragment == "1" or nil, record_fragment = singbox_settings.record_fragment == "1" or nil, run_socks_instance = not no_run })
+					local outboundTag = gen_outbound_get_tag(flag, ut_node_id, ut_node_tag, { fragment = singbox_settings.fragment == "1" or nil, record_fragment = singbox_settings.record_fragment == "1" or nil })
 					if outboundTag then
 						valid_nodes[#valid_nodes + 1] = outboundTag
 					end
@@ -1478,7 +1479,6 @@ function gen_config(var)
 						to_node.port = new_port
 						to_outbound = gen_outbound(node[".name"], to_node, tag, {
 							tag = tag,
-							run_socks_instance = not no_run
 						})
 					else
 						to_outbound = gen_outbound(node[".name"], to_node)
@@ -1571,7 +1571,6 @@ function gen_config(var)
 					local proxy_table = {
 						fragment = singbox_settings.fragment == "1",
 						record_fragment = singbox_settings.record_fragment == "1",
-						run_socks_instance = not no_run,
 					}
 					local preproxy_node_id = node[rule_name .. "_proxy_tag"]
 					if preproxy_node_id == _node_id then preproxy_node_id = nil end
@@ -1855,7 +1854,6 @@ function gen_config(var)
 			COMMON.default_outbound_tag = gen_outbound_get_tag(flag, node or node_id, nil, {
 				fragment = singbox_settings.fragment == "1" or nil,
 				record_fragment = singbox_settings.record_fragment == "1" or nil,
-				run_socks_instance = not no_run
 			})
 		end
 
@@ -2316,7 +2314,7 @@ function gen_config(var)
 			routing_mark = 255,
 		})
 		for index, value in ipairs(config.outbounds) do
-			if not value["_flag_proxy_tag"] and not value.detour and value["_id"] and value.server and (value.server_port or value.server_ports) and not no_run then
+			if not value["_flag_proxy_tag"] and not value.detour and value["_id"] and value.server and (value.server_port or value.server_ports) and not NO_RUN then
 				sys.call(string.format("echo '%s' >> %s", value["_id"], api.TMP_PATH .. "/direct_node_list"))
 			end
 			if not value.detour and not value.bind_interface and value.server then
@@ -2464,7 +2462,7 @@ if arg[1] then
 			var = jsonc.parse(arg[2])
 		end
 		print(func(var))
-		if (next(GEO_VAR.SITE_TAGS) or next(GEO_VAR.IP_TAGS)) and not no_run then
+		if (next(GEO_VAR.SITE_TAGS) or next(GEO_VAR.IP_TAGS)) and not NO_RUN then
 			convert_geofile()
 		end
 	end

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -43,16 +43,11 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end
 		local remarks = node.remarks
 
-		local proxy_tag = nil
-		local dialer_proxy_tag = nil
-		local fragment = nil
-		local noise = nil
-		local run_socks_instance = true
+		local proxy_tag, dialer_proxy_tag, fragment, noise
 		if proxy_table ~= nil and type(proxy_table) == "table" then
 			proxy_tag = proxy_table.tag or nil
 			fragment = (proxy_table.fragment and not node.hysteria2_realms) and true or nil
 			noise = (proxy_table.noise and not node.hysteria2_realms) and true or nil
-			run_socks_instance = proxy_table.run_socks_instance
 		end
 
 		if node.type ~= "Xray" then
@@ -61,7 +56,12 @@ function gen_outbound(flag, node, tag, proxy_table)
 				node.transport = "raw"
 			else
 				local new_port
-				if run_socks_instance then
+				local run_socks_instance = true
+				if NO_RUN then
+					TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001
+					new_port = TMP_PORT
+					run_socks_instance = nil
+				else
 					local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
 					if relay_port == "" then
 						local cache = api.get_socks_port_by_cache(node_id)
@@ -91,9 +91,6 @@ function gen_outbound(flag, node, tag, proxy_table)
 							api.set_socks_port_to_cache(node_id, new_port)
 						end
 					end
-				else
-					TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001  -- 导出配置时作为演示
-					new_port = TMP_PORT
 				end
 				if new_port then
 					node = {}
@@ -913,10 +910,11 @@ function gen_config(var)
 	local dns_socks_address = var["dns_socks_address"]
 	local dns_socks_port = var["dns_socks_port"]
 	local loglevel = var["loglevel"] or "warning"
-	local no_run = var["no_run"]
 	local use_proxy_list = var["use_proxy_list"]
 	local use_gfw_list = var["use_gfw_list"]
 	local chn_list = var["chn_list"]
+	local run_in_global = var["run_in_global"]
+	NO_RUN = var["no_run"]
 
 	local dns_domain_rules = {}
 	local dns = nil
@@ -1091,7 +1089,9 @@ function gen_config(var)
 				blc_nodes = _node.balancing_node
 			end
 
-			-- api.log("  - 加载 Xray 负载均衡 节点【" .. (_node.remarks or "") .. "】，子节点数量：" .. #(blc_nodes or {}))
+			if not NO_RUN and run_in_global then
+				api.log("  - 加载 Xray 负载均衡 节点【" .. (_node.remarks or "") .. "】，子节点数量：" .. #(blc_nodes or {}))
+			end
 
 			local valid_nodes = {}
 			for i = 1, #(blc_nodes or {}) do
@@ -1106,7 +1106,7 @@ function gen_config(var)
 					end
 				end
 				if is_new_blc_node then
-					local outboundTag = gen_outbound_get_tag(flag, blc_node_id, blc_node_tag, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil, run_socks_instance = not no_run })
+					local outboundTag = gen_outbound_get_tag(flag, blc_node_id, blc_node_tag, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil })
 					if outboundTag then
 						valid_nodes[#valid_nodes + 1] = outboundTag
 					end
@@ -1135,7 +1135,7 @@ function gen_config(var)
 					local fallback_node = get_node_by_id(fallback_node_id)
 					if fallback_node then
 						if fallback_node.protocol ~= "_balancing" then
-							local outboundTag = gen_outbound_get_tag(flag, fallback_node, fallback_node_id, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil, run_socks_instance = not no_run })
+							local outboundTag = gen_outbound_get_tag(flag, fallback_node, fallback_node_id, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil })
 							if outboundTag then
 								fallback_node_tag = outboundTag
 							end
@@ -1267,7 +1267,6 @@ function gen_config(var)
 						})
 						to_outbound = gen_outbound(node[".name"], to_node, to_node[".name"], {
 							tag = to_node[".name"],
-							run_socks_instance = not no_run
 						})
 					else
 						to_outbound = gen_outbound(node[".name"], to_node)
@@ -1375,7 +1374,6 @@ function gen_config(var)
 					local proxy_table = {
 						fragment = xray_settings.fragment == "1",
 						noise = xray_settings.noise == "1",
-						run_socks_instance = not no_run,
 					}
 					local preproxy_node_id = node[rule_name .. "_proxy_tag"]
 					if preproxy_node_id == _node_id then preproxy_node_id = nil end
@@ -1577,7 +1575,6 @@ function gen_config(var)
 			COMMON.default_outbound_tag = gen_outbound_get_tag(flag, node or node_id, nil, {
 				fragment = xray_settings.fragment == "1" or nil,
 				noise = xray_settings.noise == "1" or nil,
-				run_socks_instance = not no_run
 			})
 			if COMMON.default_outbound_tag then
 				routing = {
@@ -2073,7 +2070,7 @@ function gen_config(var)
 		for index, value in ipairs(config.outbounds) do
 			local pt = value.protocol
 			local exclude = { blackhole=1, dns=1, freedom=1, loopback=1 }
-			if not value["_flag_proxy_tag"] and value["_id"] and pt and not exclude[pt] and not no_run then
+			if not value["_flag_proxy_tag"] and value["_id"] and pt and not exclude[pt] and not NO_RUN then
 				sys.call(string.format("echo '%s' >> %s", value["_id"], api.TMP_PATH .. "/direct_node_list"))
 			end
 			for k, v in pairs(config.outbounds[index]) do

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -87,7 +87,7 @@ run_ipt2socks() {
 run_singbox() {
 	local flag type node redir_port tcp_proxy_way socks_address socks_port socks_username socks_password http_address http_port http_username http_password
 	local dns_listen_port direct_dns_query_strategy direct_dns_port direct_dns_udp_server direct_dns_tcp_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy remote_rewrite_ttl dns_cache dns_socks_address dns_socks_port
-	local loglevel log_file config_file server_host server_port no_run use_proxy_list use_gfw_list chn_list
+	local loglevel log_file config_file server_host server_port no_run use_proxy_list use_gfw_list chn_list run_in_global
 	eval_set_val "$@"
 	[ -z "$type" ] && {
 		type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
@@ -182,13 +182,17 @@ run_singbox() {
 	[ "$remote_fakedns" = "1" ] && json_add_string "remote_dns_fake" "1"
 	[ -n "$remote_rewrite_ttl" ] && json_add_string "remote_rewrite_ttl" "${remote_rewrite_ttl}"
 	[ -n "$no_run" ] && json_add_string "no_run" "1"
+	[ -n "$run_in_global" ] && json_add_string "run_in_global" "1"
 	local _json_arg="$(json_dump)"
 	lua $UTIL_SINGBOX gen_config "${_json_arg}" > $config_file
 	[ -n "$no_run" ] && return
 
 	local test_log_file=$log_file
+	local status=0
 	[ "$test_log_file" = "/dev/null" ] && test_log_file="${TMP_PATH}/${config_file##*/}_test.log"
-	$SINGBOX_BIN check -c "$config_file" > $test_log_file 2>&1; local status=$?
+	[ -n "$run_in_global" ] && {
+		$SINGBOX_BIN check -c "$config_file" > $test_log_file 2>&1; status=$?
+	}
 	if [ "${status}" = 0 ]; then
 		ln_run "$SINGBOX_BIN" "sing-box" "${log_file}" run -c "$config_file"
 	else
@@ -201,7 +205,7 @@ run_singbox() {
 run_xray() {
 	local flag type node redir_port tcp_proxy_way socks_address socks_port socks_username socks_password http_address http_port http_username http_password
 	local dns_listen_port direct_dns_query_strategy direct_dns_port direct_dns_udp_server direct_dns_tcp_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port
-	local loglevel log_file config_file server_host server_port no_run use_proxy_list use_gfw_list chn_list
+	local loglevel log_file config_file server_host server_port no_run use_proxy_list use_gfw_list chn_list run_in_global
 	eval_set_val "$@"
 	[ -z "$type" ] && {
 		type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
@@ -278,13 +282,17 @@ run_xray() {
 
 	json_add_string "loglevel" "$loglevel"
 	[ -n "$no_run" ] && json_add_string "no_run" "1"
+	[ -n "$run_in_global" ] && json_add_string "run_in_global" "1"
 	local _json_arg="$(json_dump)"
 	lua $UTIL_XRAY gen_config "${_json_arg}" > $config_file
 	[ -n "$no_run" ] && return
 
 	local test_log_file=$log_file
+	local status=0
 	[ "$test_log_file" = "/dev/null" ] && test_log_file="${TMP_PATH}/${config_file##*/}_test.log"
-	$XRAY_BIN run -test -c "$config_file" > $test_log_file; local status=$?
+	[ -n "$run_in_global" ] && {
+		$XRAY_BIN run -test -c "$config_file" > $test_log_file; status=$?
+	}
 	if [ "${status}" = 0 ]; then
 		ln_run "$XRAY_BIN" "xray" "${log_file}" run -c "$config_file"
 	else
@@ -599,7 +607,7 @@ start_global() {
 	;;
 	sing-box)
 		local _flag="global"
-		local _args=""
+		local _args="run_in_global=1"
 		[ "$on_node_socks" = "1" ] && {
 			node_socks_flag=1
 			_args="${_args} socks_address=${node_socks_bind} socks_port=${GLOBAL_SOCKS_port}"
@@ -677,7 +685,7 @@ start_global() {
 	;;
 	xray)
 		local _flag="global"
-		local _args=""
+		local _args="run_in_global=1"
 		[ "$on_node_socks" = "1" ] && {
 			node_socks_flag=1
 			_args="${_args} socks_address=${node_socks_bind} socks_port=${GLOBAL_SOCKS_port}"

luci-app-passwall2/luasrc/controller/passwall2.lua

@@ -238,7 +238,7 @@ end
 
 function get_now_use_node()
 	local e = {}
-	local node = api.get_cache_var("ACL_GLOBAL_node")
+	local node = api.get_cache_var(("ACL_${flag}_node"):gsub("${flag}", "acl_default"))
 	if node then
 		e["global"] = node
 	end

luci-app-passwall2/luasrc/passwall2/api.lua

@@ -292,12 +292,15 @@ end
 
 function curl_proxy(url, file, args)
 	-- Use the proxy
-	local socks_server = get_cache_var("GLOBAL_SOCKS_server")
-	if socks_server and socks_server ~= "" then
-		if not args then args = {} end
-		local tmp_args = clone(args)
-		tmp_args[#tmp_args + 1] = "-x socks5h://" .. socks_server
-		return curl_base(url, file, tmp_args)
+	local socks_port = get_cache_var(("ACL_${flag}_node_socks_port"):gsub("${flag}", "acl_default"))
+	if socks_port then
+		local socks_server = "127.0.0.1:%s" % socks_port
+		if socks_server and socks_server ~= "" then
+			if not args then args = {} end
+			local tmp_args = clone(args)
+			tmp_args[#tmp_args + 1] = "-x socks5h://" .. socks_server
+			return curl_base(url, file, tmp_args)
+		end
 	end
 	return nil, nil
 end

luci-app-passwall2/luasrc/passwall2/util_sing-box.lua

@@ -111,20 +111,21 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end
 		local remarks = node.remarks
 
-		local proxy_tag = nil
-		local fragment = nil
-		local record_fragment = nil
-		local run_socks_instance = true
+		local proxy_tag, fragment, record_fragment
 		if proxy_table ~= nil and type(proxy_table) == "table" then
 			proxy_tag = proxy_table.tag or nil
 			fragment = (proxy_table.fragment and node.protocol ~= "naive" and not node.hysteria2_realms) and true or nil
 			record_fragment = (proxy_table.record_fragment and node.protocol ~= "naive" and not node.hysteria2_realms) and true or nil
-			run_socks_instance = proxy_table.run_socks_instance
 		end
 
 		if node.type ~= "sing-box" then
 			local new_port
-			if run_socks_instance then
+			local run_socks_instance = true
+			if NO_RUN then
+				TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001
+				new_port = TMP_PORT
+				run_socks_instance = nil
+			else
 				local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
 				if relay_port == "" then
 					local cache = api.get_socks_port_by_cache(node_id)
@@ -1181,8 +1182,7 @@ function gen_config(var)
 	local remote_dns_client_ip = var["remote_dns_client_ip"]
 	local remote_rewrite_ttl = var["remote_rewrite_ttl"] or "30"
 	local dns_cache = var["dns_cache"]
-	local tags = var["tags"]
-	local no_run = var["no_run"]
+	NO_RUN = var["no_run"]
 
 	local dns_domain_rules = {}
 	local dns = {}
@@ -1405,7 +1405,7 @@ function gen_config(var)
 					end
 				end
 				if is_new_ut_node then
-					local outboundTag = gen_outbound_get_tag(flag, ut_node_id, ut_node_tag, { fragment = singbox_settings.fragment == "1" or nil, record_fragment = singbox_settings.record_fragment == "1" or nil, run_socks_instance = not no_run })
+					local outboundTag = gen_outbound_get_tag(flag, ut_node_id, ut_node_tag, { fragment = singbox_settings.fragment == "1" or nil, record_fragment = singbox_settings.record_fragment == "1" or nil })
 					if outboundTag then
 						valid_nodes[#valid_nodes + 1] = outboundTag
 					end
@@ -1508,7 +1508,6 @@ function gen_config(var)
 						to_node.port = new_port
 						to_outbound = gen_outbound(node[".name"], to_node, tag, {
 							tag = tag,
-							run_socks_instance = not no_run
 						})
 					else
 						to_outbound = gen_outbound(node[".name"], to_node)
@@ -1607,7 +1606,6 @@ function gen_config(var)
 					local proxy_table = {
 						fragment = singbox_settings.fragment == "1",
 						record_fragment = singbox_settings.record_fragment == "1",
-						run_socks_instance = not no_run,
 					}
 					local preproxy_node_id = node[rule_name .. "_proxy_tag"]
 					if preproxy_node_id == _node_id then preproxy_node_id = nil end
@@ -2284,7 +2282,7 @@ function gen_config(var)
 			routing_mark = 255,
 		})
 		for index, value in ipairs(config.outbounds) do
-			if not value["_flag_proxy_tag"] and not value.detour and value["_id"] and value.server and value.server_port and not no_run then
+			if not value["_flag_proxy_tag"] and not value.detour and value["_id"] and value.server and value.server_port and not NO_RUN then
 				sys.call(string.format("echo '%s' >> %s", value["_id"], api.TMP_PATH .. "/direct_node_list"))
 			end
 			if not value.detour and not value.bind_interface and value.server then
@@ -2427,7 +2425,7 @@ if arg[1] then
 			var = jsonc.parse(arg[2])
 		end
 		print(func(var))
-		if (next(GEO_VAR.SITE_TAGS) or next(GEO_VAR.IP_TAGS)) and not no_run then
+		if (next(GEO_VAR.SITE_TAGS) or next(GEO_VAR.IP_TAGS)) and not NO_RUN then
 			convert_geofile()
 		end
 	end

luci-app-passwall2/luasrc/passwall2/util_xray.lua

@@ -12,7 +12,7 @@ local GLOBAL = {
 
 local xray_version = api.get_app_version("xray")
 
-local xray_min_version = "26.3.27"
+local xray_min_version = "26.7.11"
 
 local function get_domain_excluded()
 	local path = "/usr/share/passwall2/domains_excluded"
@@ -58,21 +58,21 @@ function gen_outbound(flag, node, tag, proxy_table)
 		end
 		local remarks = node.remarks
 
-		local proxy_tag = nil
-		local dialer_proxy_tag = nil
-		local fragment = nil
-		local noise = nil
-		local run_socks_instance = true
+		local proxy_tag, dialer_proxy_tag, fragment, noise
 		if proxy_table ~= nil and type(proxy_table) == "table" then
 			proxy_tag = proxy_table.tag or nil
 			fragment = (proxy_table.fragment and not node.hysteria2_realms) and true or nil
 			noise = (proxy_table.noise and not node.hysteria2_realms) and true or nil
-			run_socks_instance = proxy_table.run_socks_instance
 		end
 
 		if node.type ~= "Xray" then
 			local new_port
-			if run_socks_instance then
+			local run_socks_instance = true
+			if NO_RUN then
+				TMP_PORT = TMP_PORT and TMP_PORT + 1 or 3001
+				new_port = TMP_PORT
+				run_socks_instance = nil
+			else
 				local relay_port = (proxy_tag and node.port) and tostring(node.port) or ""
 				if relay_port == "" then
 					local cache = api.get_socks_port_by_cache(node_id)
@@ -106,7 +106,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 			if new_port then
 				node = {}
 				node.protocol = "socks"
-				node.transport = "tcp"
+				node.transport = "raw"
 				node.address = "127.0.0.1"
 				node.port = new_port
 				node.stream_security = "none"
@@ -181,7 +181,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 					} or nil,
 					dialerProxy = dialer_proxy_tag,
 				},
-				[(api.compare_versions(xray_version, "<", "26.7.11")) and "network" or "method"] = node.transport, -- Todo: Remove version check and "network"
+				method = node.transport,
 				security = node.stream_security,
 				tlsSettings = (node.stream_security == "tls") and {
 					serverName = node.tls_serverName,
@@ -665,7 +665,7 @@ function gen_config_server(node)
 				outbound_node_t = {
 					type = node.type,
 					protocol = node.outbound_node:gsub("_", ""),
-					transport = "tcp",
+					transport = "raw",
 					address = node.outbound_node_address,
 					port = node.outbound_node_port,
 					username = (node.outbound_node_username and node.outbound_node_username ~= "") and node.outbound_node_username or nil,
@@ -696,7 +696,7 @@ function gen_config_server(node)
 				protocol = node.protocol,
 				settings = settings,
 				streamSettings = {
-					[(api.compare_versions(xray_version, "<", "26.7.11")) and "network" or "method"] = node.transport, -- Todo: Remove version check and "network"
+					method = node.transport,
 					security = "none",
 					tlsSettings = ("1" == node.tls) and {
 						disableSystemRoot = false,
@@ -877,9 +877,6 @@ function gen_config_server(node)
 				config.outbounds[index][k] = nil
 			end
 		end
-		if value.protocol == "freedom" and api.compare_versions(xray_version, "<", "26.5.3") then -- Todo is to remove it
-			value.settings = nil
-		end
 	end
 
 	return config
@@ -921,7 +918,7 @@ function gen_config(var)
 	local remote_dns_query_strategy = var["remote_dns_query_strategy"]
 	local remote_dns_detour = var["remote_dns_detour"]
 	local dns_cache = var["dns_cache"]
-	local no_run = var["no_run"]
+	NO_RUN = var["no_run"]
 
 	local dns_domain_rules = {}
 	local dns = {}
@@ -1046,7 +1043,7 @@ function gen_config(var)
 				protocol = "socks",
 				address = "127.0.0.1",
 				port = section.port,
-				transport = "tcp",
+				transport = "raw",
 				stream_security = "none"
 			}
 		end
@@ -1104,7 +1101,7 @@ function gen_config(var)
 				end
 			end
 			if is_new_blc_node then
-				local outboundTag = gen_outbound_get_tag(flag, blc_node_id, blc_node_tag, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil, run_socks_instance = not no_run })
+				local outboundTag = gen_outbound_get_tag(flag, blc_node_id, blc_node_tag, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil })
 				if outboundTag then
 					valid_nodes[#valid_nodes + 1] = outboundTag
 				end
@@ -1133,7 +1130,7 @@ function gen_config(var)
 				local fallback_node = get_node_by_id(fallback_node_id)
 				if fallback_node then
 					if fallback_node.protocol ~= "_balancing" then
-						local outboundTag = gen_outbound_get_tag(flag, fallback_node, fallback_node_id, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil, run_socks_instance = not no_run })
+						local outboundTag = gen_outbound_get_tag(flag, fallback_node, fallback_node_id, { fragment = xray_settings.fragment == "1" or nil, noise = xray_settings.noise == "1" or nil })
 						if outboundTag then
 							fallback_node_tag = outboundTag
 						end
@@ -1265,7 +1262,6 @@ function gen_config(var)
 					})
 					to_outbound = gen_outbound(node[".name"], to_node, to_node[".name"], {
 						tag = to_node[".name"],
-						run_socks_instance = not no_run
 					})
 				else
 					to_outbound = gen_outbound(node[".name"], to_node)
@@ -1336,9 +1332,9 @@ function gen_config(var)
 								interface = node.iface
 							}
 						},
-						settings = (api.compare_versions(xray_version, ">", "26.4.25")) and {  -- Todo: Remove version check
+						settings = {
 							finalRules = {{ action = "allow" }}
-						} or nil
+						}
 					}
 					sys.call(string.format("mkdir -p %s && touch %s/%s", api.TMP_IFACE_PATH, api.TMP_IFACE_PATH, node.iface))
 				end
@@ -1398,7 +1394,6 @@ function gen_config(var)
 					local proxy_table = {
 						fragment = xray_settings.fragment == "1",
 						noise = xray_settings.noise == "1",
-						run_socks_instance = not no_run,
 					}
 					local preproxy_node_id = node[rule_name .. "_proxy_tag"]
 					if preproxy_node_id == _node_id then preproxy_node_id = nil end
@@ -1750,12 +1745,10 @@ function gen_config(var)
 			})
 			local direct_type_dns = {
 				settings = {
-					address = direct_dns_udp_server,
-					port = tonumber(direct_dns_udp_port) or 53,
-					network = "udp",
-					nonIPQuery = (api.compare_versions(xray_version, "<", "26.4.25")) and "skip" or nil, -- Todo is to remove it
-					blockTypes = (api.compare_versions(xray_version, "<", "26.4.25")) and { 65 } or nil,  -- Todo is to remove it
-					rules = (api.compare_versions(xray_version, ">", "26.4.17")) and {
+					rewriteAddress = direct_dns_udp_server,
+					rewritePort = tonumber(direct_dns_udp_port) or 53,
+					rewriteNetwork = "udp",
+					rules = {
 						{
 							qType = "1,28",
 							action = "hijack"
@@ -1776,11 +1769,10 @@ function gen_config(var)
 			}
 			local remote_type_dns = {
 				settings = {
-					address = remote_dns_udp_server,
-					port = tonumber(remote_dns_udp_port) or 53,
-					network = _remote_dns_proto or "tcp",
-					nonIPQuery = (api.compare_versions(xray_version, "<", "26.4.25")) and "reject" or nil, -- Todo is to remove it
-					rules = (api.compare_versions(xray_version, ">", "26.4.17")) and {
+					rewriteAddress = remote_dns_udp_server,
+					rewritePort = tonumber(remote_dns_udp_port) or 53,
+					rewriteNetwork = _remote_dns_proto or "tcp",
+					rules = {
 						{
 							qType = "1,28",
 							action = "hijack"
@@ -2058,7 +2050,7 @@ function gen_config(var)
 		local direct_outbound = {
 			protocol = "freedom",
 			tag = "direct",
-			settings = (api.compare_versions(xray_version, ">", "26.4.25")) and {  -- Todo: Remove version check
+			settings = {
 				finalRules = {{ action = "allow" }}
 			} or nil,
 			streamSettings = {
@@ -2086,7 +2078,7 @@ function gen_config(var)
 
 		for index, value in ipairs(config.outbounds) do
 			local s = value.settings
-			if not value["_flag_proxy_tag"] and value["_id"] and s and not no_run and
+			if not value["_flag_proxy_tag"] and value["_id"] and s and not NO_RUN and
 			((s.vnext and s.vnext[1] and s.vnext[1].address and s.vnext[1].port) or 
 			(s.servers and s.servers[1] and s.servers[1].address and s.servers[1].port) or
 			(s.peers and s.peers[1] and s.peers[1].endpoint) or
@@ -2168,7 +2160,7 @@ function gen_proto_config(var)
 		local outbound = {
 			protocol = server_proto,
 			streamSettings = {
-				network = "tcp",
+				method = "raw",
 				security = "none"
 			},
 			settings = {
@@ -2192,10 +2184,12 @@ function gen_proto_config(var)
 	table.insert(outbounds, {
 		protocol = "freedom",
 		tag = "direct",
-		settings = (api.compare_versions(xray_version, ">", "26.4.25")) and { -- Todo: Remove version check
+		settings = {
 			finalRules = {{ action = "allow" }}
 		} or nil,
-		sockopt = {mark = 255}
+		streamSettings = {
+			sockopt = {mark = 255}
+		}
 	})
 	
 	local config = {
@@ -2204,7 +2198,10 @@ function gen_proto_config(var)
 		},
 		inbounds = inbounds,
 		outbounds = outbounds,
-		routing = routing
+		routing = routing,
+		version = {
+			min = xray_min_version
+		}
 	}
 	return jsonc.stringify(config, 1)
 end

luci-app-passwall2/root/etc/hotplug.d/ntp/30-passwall2-resync

@@ -1,17 +1,12 @@
 #!/bin/sh
 
-# Devices without a hardware RTC boot with a wrong system clock: sysfixtime can
-# only restore the mtime of the newest file under /etc, so the clock is usually
-# hours behind after a cold boot. passwall2 is then started by
-# /etc/hotplug.d/iface/98-passwall2 on ifup, which typically happens before NTP
-# has corrected the time, and time-sensitive handshakes (VMess AEAD, TLS) fail.
-#
-# Nothing restarts passwall2 once the clock is corrected, so it stays broken
-# until the user restarts it manually. Restart once when ntpd reports that the
-# time is valid -- the same approach dnsmasq uses for DNSSEC in
-# /etc/hotplug.d/ntp/25-dnsmasqsec.
+[ "$ACTION" = "step" ] || exit 0
 
-[ "$ACTION" = "stratum" ] || exit 0
+offset=${offset#-}
+offset=${offset%.*}
+
+# Skip service restart if the time adjustment is less than 120 seconds.
+[ "$offset" -lt 120 ] && exit 0
 
 . /usr/share/passwall2/utils.sh
 
@@ -23,5 +18,5 @@ NTP_LOCK_FILE="${LOCK_PATH}/${CONFIG}_ntp.lock"
 	echo $$ > ${NTP_LOCK_FILE}
 
 	/etc/init.d/${CONFIG} restart >/dev/null 2>&1 &
-	logger -p notice -t network -s "${CONFIG}: restart after NTP time became valid"
+	logger -p notice -t network -s "${CONFIG}: restart after NTP time step (${offset}s)"
 }

luci-app-passwall2/root/usr/share/passwall2/app.sh

@@ -856,8 +856,8 @@ acl_node() {
 		local DNSMASQ_LOCAL_DNS="${LOCAL_DNS:-${AUTO_DNS}}"
 		[ -n "${DIRECT_DNS_DNSMASQ_SERVER}" ] && DNSMASQ_LOCAL_DNS="${DIRECT_DNS_DNSMASQ_SERVER}"
 		if [ "${flag}" = "acl_default" ]; then
-			set_cache_var "GLOBAL_SOCKS_server" "127.0.0.1:$socks_port"
-			set_cache_var "ACL_GLOBAL_node" "$node"
+			set_cache_var "ACL_${flag}_node" "$node"
+			set_cache_var "ACL_${flag}_node_socks_port" "$socks_port"
 			run_new_dnsmasq=$(config_n_get @global[0] dns_redirect 1)
 			if [ "${run_new_dnsmasq}" != "1" ]; then
 				#Rewrite the default DNS service configuration
@@ -865,15 +865,15 @@ acl_node() {
 				lua $APP_PATH/helper_dnsmasq.lua stretch
 				json_init
 				json_add_string "FLAG" "${flag}"
-				json_add_string "TMP_DNSMASQ_PATH" "${GLOBAL_DNSMASQ_CONF_PATH}"
-				json_add_string "DNSMASQ_CONF_FILE" "${GLOBAL_DNSMASQ_CONF}"
+				json_add_string "TMP_DNSMASQ_PATH" "${DEFAULT_DNSMASQ_CONF_PATH}"
+				json_add_string "DNSMASQ_CONF_FILE" "${DEFAULT_DNSMASQ_CONF}"
 				json_add_string "DEFAULT_DNS" "${DNSMASQ_DEFAULT_DNS}"
 				json_add_string "LOCAL_DNS" "${DNSMASQ_LOCAL_DNS}"
 				json_add_string "TUN_DNS" "${DNSMASQ_TUN_DNS}"
 				json_add_string "NFTFLAG" "${nftflag:-0}"
 				json_add_string "NO_LOGIC_LOG" "${NO_LOGIC_LOG:-0}"
 				lua $APP_PATH/helper_dnsmasq.lua add_rule "$(json_dump)"
-				uci -q add_list dhcp.@dnsmasq[0].addnmount=${GLOBAL_DNSMASQ_CONF_PATH}
+				uci -q add_list dhcp.@dnsmasq[0].addnmount=${DEFAULT_DNSMASQ_CONF_PATH}
 				uci -q commit dhcp
 
 				lua $APP_PATH/helper_dnsmasq.lua logic_restart
@@ -973,8 +973,8 @@ stop() {
 	unset XRAY_LOCATION_ASSET
 	unset SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN
 	stop_crontab
-	rm -rf $GLOBAL_DNSMASQ_CONF
-	rm -rf $GLOBAL_DNSMASQ_CONF_PATH
+	rm -rf $DEFAULT_DNSMASQ_CONF
+	rm -rf $DEFAULT_DNSMASQ_CONF_PATH
 	[ "1" = "1" ] && {
 		#restore logic
 		bak_dnsmasq_dns_redirect=$(config_n_get @global[0] dnsmasq_dns_redirect)
@@ -985,7 +985,7 @@ stop() {
 			uci -q commit ${CONFIG}
 		}
 		if [ -z "${ACL_default_dns_port}" ] || [ -n "${bak_dnsmasq_dns_redirect}" ]; then
-			uci -q del_list dhcp.@dnsmasq[0].addnmount="${GLOBAL_DNSMASQ_CONF_PATH}"
+			uci -q del_list dhcp.@dnsmasq[0].addnmount="${DEFAULT_DNSMASQ_CONF_PATH}"
 			uci -q commit dhcp
 
 			json_init
@@ -1061,8 +1061,8 @@ get_config() {
 			DNSMASQ_CONF_DIR=${DEFAULT_DNSMASQ_CONF_DIR}
 		fi
 	fi
-	set_cache_var GLOBAL_DNSMASQ_CONF ${DNSMASQ_CONF_DIR}/dnsmasq-${CONFIG}.conf
-	set_cache_var GLOBAL_DNSMASQ_CONF_PATH ${TMP_ACL_PATH}/acl_default_dnsmasq.d
+	set_cache_var DEFAULT_DNSMASQ_CONF ${DNSMASQ_CONF_DIR}/dnsmasq-${CONFIG}.conf
+	set_cache_var DEFAULT_DNSMASQ_CONF_PATH ${TMP_ACL_PATH}/acl_default_dnsmasq.d
 
 	QUEUE_RUN=1
 }

luci-app-passwall2/root/usr/share/passwall2/iptables.sh

@@ -230,7 +230,7 @@ gen_shunt_list() {
 	}
 	[ -n "${_SHUNT_LIST4}" ] && eval ${shunt_list4_var_name}=\"${_SHUNT_LIST4}\"
 	[ -n "${_SHUNT_LIST6}" ] && eval ${shunt_list6_var_name}=\"${_SHUNT_LIST6}\"
-	set_cache_var "gen_shunt_list_${node}" "1"
+	set_cache_var "node_${node}_gen_shunt_list" "1"
 }
 
 add_shunt_t_rule() {
@@ -261,7 +261,7 @@ load_acl() {
 	for sid in $(jsonfilter -s "${ACL_JSON}" -e '$.acl[*].flag'); do
 		eval local $(cat "${TMP_ACL_PATH}/${sid}/var")
 
-		[ -z "$(get_cache_var "gen_shunt_list_${node}")" ] && [ -n "${node}" ] && gen_shunt_list "${node}" shunt_list4 shunt_list6
+		[ -z "$(get_cache_var "node_${node}_gen_shunt_list")" ] && [ -n "${node}" ] && gen_shunt_list "${node}" shunt_list4 shunt_list6
 		[ -n "${use}" ] && local dns_redirect_port=$(get_cache_var "ACL_${use}_dns_port")
 
 		local ipt_tmp=$ipt_n

luci-app-passwall2/root/usr/share/passwall2/nftables.sh

@@ -271,7 +271,7 @@ gen_shunt_list() {
 	}
 	[ -n "${_SHUNT_LIST4}" ] && eval ${shunt_list4_var_name}=\"${_SHUNT_LIST4}\"
 	[ -n "${_SHUNT_LIST6}" ] && eval ${shunt_list6_var_name}=\"${_SHUNT_LIST6}\"
-	set_cache_var "gen_shunt_list_${node}" "1"
+	set_cache_var "node_${node}_gen_shunt_list" "1"
 }
 
 add_shunt_t_rule() {
@@ -299,7 +299,7 @@ load_acl() {
 	for sid in $(jsonfilter -s "${ACL_JSON}" -e '$.acl[*].flag'); do
 		eval $(cat "${TMP_ACL_PATH}/${sid}/var")
 
-		[ -z "$(get_cache_var "gen_shunt_list_${node}")" ] && [ -n "${node}" ] && gen_shunt_list "${node}" shunt_list4 shunt_list6
+		[ -z "$(get_cache_var "node_${node}_gen_shunt_list")" ] && [ -n "${node}" ] && gen_shunt_list "${node}" shunt_list4 shunt_list6
 		[ -n "${use}" ] && local dns_redirect_port=$(get_cache_var "ACL_${use}_dns_port")
 
 		[ "${local_proxy}" = "1" ] && {

sing-box/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sing-box
-PKG_VERSION:=1.14.0
+PKG_VERSION:=1.14.1
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/SagerNet/sing-box/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=87baf6852e37941cbe40bdd94bec81c957c88a56751cecd6bbf0e6108bc69398
+PKG_HASH:=1ea41f7d06b0017fe3d3ba7ee30959048aa0ddde31cb0165dab9257edf673321
 
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=LICENSE