update 2026-08-19 20:34:50

luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm

@@ -1639,6 +1639,7 @@ local current_node = map:get(section)
 				opt.set(dom_prefix + 'hysteria2_hop', queryParam.mport || "");
 				opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm);
 				opt.set(dom_prefix + 'finalmask', queryParam.fm || "");
+				if (is_singbox && (queryParam.pcs || queryParam.pinSHA256)) queryParam.allowinsecure = '1';
 			} else if (has_hysteria2) {
 				opt.set('type', "Hysteria2");
 				dom_prefix = "hysteria2_"
@@ -1652,15 +1653,14 @@ local current_node = map:get(section)
 					opt.set(dom_prefix + 'obfs_MaxPacketSize', queryParam.maxPacketSize || "1200");
 				}
 				opt.set(dom_prefix + 'hop', queryParam.mport || "");
+				if (queryParam.pcs || queryParam.pinSHA256) queryParam.allowinsecure = '0';
 			}
-			
 			opt.set(dom_prefix + 'address', unbracketIP(m.hostname));
 			opt.set(dom_prefix + 'port', m.port || "443");
-			
 			opt.set(dom_prefix + 'tls_serverName', queryParam.sni || "");
 			opt.set(
 				dom_prefix + 'tls_allowInsecure',
-				!((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0')
+				(queryParam.allowinsecure ?? queryParam.allowInsecure ?? queryParam.insecure ?? '0') === '1'
 			);
 			opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || queryParam.pinSHA256 || '');
 			opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');

luci-app-passwall/root/usr/share/passwall/monitor.sh

@@ -27,6 +27,8 @@ while [ 1 -eq 1 ]; do
 			*dns2socks*) cmd_check=${cmd_check//:/ } ;;
 		esac
 
+		cmd_check=$(printf '%s' "$cmd_check" | sed 's/[^a-zA-Z0-9 ]/\\&/g')
+
 		filename=$(basename "$file")
 		stats_file="${RESTART_STATS_DIR}/${filename}.count"
 		if [ -s "$stats_file" ]; then
@@ -38,11 +40,11 @@ while [ 1 -eq 1 ]; do
 		# 检查是否超过最大重启次数
 		[ "$restart_count" -ge "$MAX_RESTART_COUNT" ] && continue
 
-		if ! busybox pgrep -f "$cmd_check" >/dev/null; then
+		if ! busybox pgrep -f "${cmd_check}" >/dev/null; then
 			restart_count=$((restart_count + 1))
 			echo "$restart_count" > "$stats_file"
 			#echo "${cmd} 进程挂掉，重启" >> /tmp/log/passwall.log
-			sh -c "nohup $cmd 2>&1 &"
+			sh -c "nohup ${cmd} 2>&1 &"
 			sleep 1
 		fi
 	done

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -1471,8 +1471,6 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 		result.tls_serverName = params.sni
 		result.tls_pinSHA256 = params.pcs or params.pinsha256
 		result.tls_CertByName = params.vcn
-		local insecure = params.allowinsecure or params.insecure
-		result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
 		result.hysteria2_up_mbps = params.upmbps or (sub_cfg and sub_hy_up_mbps or nil)
 		result.hysteria2_down_mbps = params.downmbps or (sub_cfg and sub_hy_down_mbps or nil)
 		result.hysteria2_hop = params.mport
@@ -1484,19 +1482,26 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			result.hysteria2_obfs_MinPacketSize = params.minpacketsize or "512"
 			result.hysteria2_obfs_MaxPacketSize = params.maxpacketsize or "1200"
 		end
-
 		if (sub_hysteria2_type == "sing-box" and has_singbox) or (sub_hysteria2_type == "xray" and has_xray) then
 			local is_singbox = sub_hysteria2_type == "sing-box" and has_singbox
 			result.type = is_singbox and 'sing-box' or 'Xray'
 			result.protocol = "hysteria2"
 			result.use_finalmask = (params.fm and params.fm ~= "") and "1" or nil
 			result.finalmask = (params.fm and params.fm ~= "") and api.base64Encode(params.fm) or nil
+			if is_singbox and (params.pcs or params.pinsha256) then
+				params.allowinsecure = "1"
+			end
 		elseif has_hysteria2 then
 			result.type = "Hysteria2"
+			if params.pcs or params.pinsha256 then
+				params.allowinsecure = "0"
+			end
 		else
 			log("跳过 Hysteria2 节点，因未适配到 Hysteria2 核心程序，或未正确设置节点使用类型。")
 			return nil
 		end
+		local insecure = params.allowinsecure or params.insecure
+		result.tls_allowInsecure = (insecure == "1" or insecure == "0") and insecure or (sub_allowinsecure and "1" or "0")
 	elseif szType == 'tuic' then
 		if has_singbox then
 			result.type = 'sing-box'

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/2_xray.lua

@@ -63,15 +63,9 @@ o:value("shadowsocks", "Shadowsocks")
 o:value("trojan", "Trojan")
 o:value("hysteria2", "Hysteria2")
 o:value("wireguard", "WireGuard")
-o:value("dokodemo-door", "dokodemo-door")
+o:value("tunnel", "Tunnel")
 o:depends({ custom = false })
 
-o = s:option(DummyValue, "is_endpoint", "")
-o.not_rewrite = true
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
-o:depends({ custom = false, protocol = "wireguard" })
-
 o = s:option(Value, "port", translate("Listen Port"))
 o.datatype = "port"
 o:depends({ custom = false })
@@ -93,14 +87,14 @@ o = s:option(ListValue, "d_protocol", translate("Destination protocol"))
 o:value("tcp", "TCP")
 o:value("udp", "UDP")
 o:value("tcp,udp", "TCP,UDP")
-o:depends({ protocol = "dokodemo-door" })
+o:depends({ protocol = "tunnel" })
 
 o = s:option(Value, "d_address", translate("Destination address"))
-o:depends({ protocol = "dokodemo-door" })
+o:depends({ protocol = "tunnel" })
 
 o = s:option(Value, "d_port", translate("Destination port"))
 o.datatype = "port"
-o:depends({ protocol = "dokodemo-door" })
+o:depends({ protocol = "tunnel" })
 
 o = s:option(Value, "decryption", translate("Encrypt Method") .. " (decryption)")
 o.default = "none"
@@ -416,7 +410,8 @@ end
 --[[acceptProxyProtocol]]
 o = s:option(Flag, "acceptProxyProtocol", translate("acceptProxyProtocol"), translate("Whether to receive PROXY protocol, when this node want to be fallback or forwarded by proxy, it must be enable, otherwise it cannot be used."))
 o.default = "0"
-o:depends({ custom = false, is_endpoint = "" })
+o:depends({ transport = "raw" })
+o:depends({ transport = "ws" })
 
 --[[Fast Open]]
 o = s:option(Flag, "tcp_fast_open", "TCP " .. translate("Fast Open"))

luci-app-passwall2/luasrc/passwall2/util_xray.lua

@@ -575,11 +575,11 @@ function gen_config_server(node)
 			version = 2,
 			users = users
 		}
-	elseif node.protocol == "dokodemo-door" then
+	elseif node.protocol == "tunnel" then
 		settings = {
-			network = node.d_protocol,
-			address = node.d_address,
-			port = tonumber(node.d_port)
+			allowedNetwork = node.d_protocol,
+			rewriteAddress = node.d_address,
+			rewritePort = tonumber(node.d_port)
 		}
 	elseif node.protocol == "wireguard" then
 		settings = {
@@ -1227,8 +1227,8 @@ function gen_config(var)
 						tag = in_tag,
 						listen = "127.0.0.1",
 						port = new_port,
-						protocol = "dokodemo-door",
-						settings = {network = "tcp,udp", address = to_node.address, port = tonumber(to_node.port)}
+						protocol = "tunnel",
+						settings = {allowedNetwork = "tcp,udp", rewriteAddress = to_node.address, rewritePort = tonumber(to_node.port)}
 					})
 					if to_node.tls_serverName == nil then
 						to_node.tls_serverName = to_node.address
@@ -1712,11 +1712,10 @@ function gen_config(var)
 			table.insert(inbounds, {
 				listen = "127.0.0.1",
 				port = tonumber(dns_listen_port),
-				protocol = "dokodemo-door",
+				protocol = "tunnel",
 				tag = "dns-in",
 				settings = {
-					address = "0.0.0.0",
-					network = "tcp,udp"
+					allowedNetwork = "tcp,udp"
 				}
 			})
 			local direct_type_dns = {
@@ -1949,8 +1948,8 @@ function gen_config(var)
 	if redir_port then
 		local inbound = {
 			port = tonumber(redir_port),
-			protocol = "dokodemo-door",
-			settings = {network = "tcp,udp", followRedirect = true},
+			protocol = "tunnel",
+			settings = {allowedNetwork = "tcp,udp", followRedirect = true},
 			streamSettings = {sockopt = {tproxy = "tproxy"}},
 			sniffing = {
 				enabled = xray_settings.sniffing_override_dest == "1" or node.protocol == "_shunt"
@@ -1975,13 +1974,13 @@ function gen_config(var)
 
 		local tcp_inbound = api.clone(inbound)
 		tcp_inbound.tag = "tcp_redir"
-		tcp_inbound.settings.network = "tcp"
+		tcp_inbound.settings.allowedNetwork = "tcp"
 		tcp_inbound.streamSettings.sockopt.tproxy = tcp_proxy_way
 		table.insert(inbounds, tcp_inbound)
 
 		local udp_inbound = api.clone(inbound)
 		udp_inbound.tag = "udp_redir"
-		udp_inbound.settings.network = "udp"
+		udp_inbound.settings.allowedNetwork = "udp"
 		table.insert(inbounds, udp_inbound)
 	end
 	

luci-app-passwall2/root/usr/share/passwall2/monitor.sh

@@ -18,9 +18,10 @@ while [ "$ENABLED" -eq 1 ]; do
 		for filename in $(ls ${TMP_SCRIPT_FUNC_PATH} | grep -v "^_"); do
 			cmd=$(cat ${TMP_SCRIPT_FUNC_PATH}/${filename})
 			cmd_check=$(echo $cmd | awk -F '>' '{print $1}')
-			icount=$(busybox pgrep -f "$(echo $cmd_check)" | wc -l)
+			escape_cmd="$(echo $cmd_check | sed 's/[^a-zA-Z0-9]/\\&/g')"
+			icount=$(busybox pgrep -f "${escape_cmd}" | wc -l)
 			if [ $icount = 0 ]; then
-				#echo "${cmd} crashed, restarting." >> /tmp/log/passwall2.log
+				log 0 "${cmd} crashed, restarting."
 				eval $(echo "nohup ${cmd} 2>&1 &") >/dev/null 2>&1 &
 			fi
 		done

my-default-settings/files/etc/uci-defaults/99-default-settings

@@ -155,8 +155,7 @@ if [ -z "$version" ] || [ "$version" -lt 1 ]; then
 	uci -q set dhcp.@dnsmasq[0].rebind_protection='0'
 	uci -q set dhcp.@dnsmasq[0].rebind_localhost='1'
 	uci commit dhcp
-	
-	uci -q set system.@system[0].zram_comp_algo='zstd'
+
 	uci -q set system.@system[0].zram_size_mb="$((memtotal / 1024 / 3))"
 	uci commit system
 	

v2ray-geodata/Makefile

@@ -21,13 +21,13 @@ define Download/geoip
   HASH:=c67bd077eb102cec74fab759b73d17f99275f56af10a87c14d9fd983508f5ce1
 endef
 
-GEOSITE_VER:=20260818030538
+GEOSITE_VER:=20260819072259
 GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
 define Download/geosite
   URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
   URL_FILE:=dlc.dat
   FILE:=$(GEOSITE_FILE)
-  HASH:=8e0e54f44a4d781e3fa308e4a3e8e41cb889a52fd74c27dd2251acace8ce6fe0
+  HASH:=794cc7fda6c8d0f2579333e6c0c6702955f6f32b39b764fe4fe422794db2967c
 endef
 
 GEOSITE_IRAN_VER:=202608170024