update 2026-10-25 23:25:42

clashoo/Makefile

@@ -5,7 +5,7 @@ PKG_SHORT_SHA:=6780eee
 PKG_COMMIT_DATE:=2026.10.25
 
 PKG_VERSION:=$(PKG_COMMIT_DATE)~$(PKG_SHORT_SHA)
-PKG_RELEASE:=1
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA).tar.gz
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)

clashoo/files/etc/init.d/clashoo

@@ -876,6 +876,10 @@ revert_dns() {
 
 add_cron(){
 #===========================================================================================================================
+	# core.log 落在 tmpfs 上，按分钟卡一次大小；内核对日志没有上限，
+	# 一旦刷屏写满 /tmp，dnsmasq 与配置生成都会跟着挂。
+	[ -z "$(grep -w "lib/core_log_guard.sh" "$CRON_FILE")" ] && echo "* * * * * sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1" >> "$CRON_FILE"
+
 	auto=$(uci get clashoo.config.auto_update 2>/dev/null)
 	clear=$(uci get clashoo.config.auto_clear_log 2>/dev/null)
 	if [ "${auto:-0}" -eq 1 ] || [ "${clear:-0}" -eq 1 ]; then
@@ -908,6 +912,7 @@ del_cron(){
 	sed -i '/update\/update_all.sh/d' "$CRON_FILE"
 	sed -i '/\/usr\/share\/clash\/update_all.sh/d' "$CRON_FILE"
 	sed -i '/update\/maintenance_cron.sh/d' "$CRON_FILE"
+	sed -i '/lib\/core_log_guard.sh/d' "$CRON_FILE"
 	sed -i '/clashoo.txt/d' "$CRON_FILE"
 	sed -i '/update\/lgbm_update.sh/d' "$CRON_FILE"
 	sed -i '/\/usr\/share\/clash\/lgbm_update.sh/d' "$CRON_FILE"
@@ -1151,6 +1156,103 @@ _dns_nameserver_inherit_mode() {
 	printf '%s' inherit
 }
 
+# issue #73: mihomo resolves proxy server domains through
+# proxy-server-nameserver(-policy) and ignores nameserver-policy there. Airports
+# ship their own resolver for node domains (e.g. "+.chylink.xyz" -> DoT) which
+# answers with reachable relay IPs, so mirror the entries that match a node
+# server domain before mixin drops them.
+#
+# Everything travels through a private 0700 work dir: large airports can produce
+# hundreds of KB of policy entries, which neither argv nor env vars can carry
+# (E2BIG), and predictable /tmp names are symlink bait.
+_dns_node_policy_workdir=""
+
+_dns_node_policy_cleanup() {
+	[ -n "${_dns_node_policy_workdir:-}" ] || return 0
+	rm -rf "$_dns_node_policy_workdir" 2>/dev/null
+	_dns_node_policy_workdir=""
+	return 0
+}
+
+# Same inputs yml_change feeds mixin: settle FORCE/PRESENT here so the skip
+# decision cannot disagree with the config that mixin actually generates.
+_dns_node_policy_mode() {
+	CLASHOO_DNS_FORCE="$(_clashoo_dns_force_fields)"
+	CLASHOO_DNS_PRESENT="$(_user_dns_fields "$CLASHOO_DNS_FORCE")"
+	export CLASHOO_DNS_FORCE CLASHOO_DNS_PRESENT
+	_dns_nameserver_inherit_mode
+}
+
+_dns_node_policy_capture() {
+	_dns_node_policy_cleanup
+	command -v yq >/dev/null 2>&1 || return 0
+	command -v ucode >/dev/null 2>&1 || return 0
+
+	local helper workdir
+	helper="${CLASHOO_NODE_DNS_UC:-/usr/share/clashoo/runtime/dns_node_policy.uc}"
+	[ -r "$helper" ] || return 0
+	[ -s "$CONFIG_YAML" ] || return 0
+
+	# skip mode keeps the source DNS verbatim: mihomo already falls back to the
+	# normal DNS policy for node domains when no dedicated resolver is generated.
+	[ "$(_dns_node_policy_mode)" = "skip" ] && return 0
+
+	# sweep leftovers from an interrupted start; they are private to root anyway
+	find "${TMPDIR:-/tmp}" -maxdepth 1 -name 'clashoo-node-dns.*' -mmin +60 \
+		-exec rm -rf {} + >/dev/null 2>&1
+
+	workdir="$(mktemp -d "${TMPDIR:-/tmp}/clashoo-node-dns.XXXXXX" 2>/dev/null)" || return 0
+	chmod 700 "$workdir" 2>/dev/null
+
+	if ! yq -M e -o=json -I0 '({"policies": (.dns."nameserver-policy" // {}), "servers": [(.proxies // [])[] | select(type == "!!map") | .server // ""]})' "$CONFIG_YAML" > "$workdir/source.json" 2>/dev/null ||
+		[ ! -s "$workdir/source.json" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+	chmod 600 "$workdir/source.json" 2>/dev/null
+
+	if ! CLASHOO_NODE_DNS_SOURCE_FILE="$workdir/source.json" ucode "$helper" > "$workdir/policy.json" 2>/dev/null ||
+		[ ! -s "$workdir/policy.json" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+	chmod 600 "$workdir/policy.json" 2>/dev/null
+	rm -f "$workdir/source.json"
+
+	if [ "$(yq -M e -r 'length' "$workdir/policy.json" 2>/dev/null)" = "0" ]; then
+		rm -rf "$workdir"
+		return 0
+	fi
+
+	_dns_node_policy_workdir="$workdir"
+	return 0
+}
+
+_dns_node_policy_apply() {
+	local policy_file rc
+	policy_file="${_dns_node_policy_workdir:+"$_dns_node_policy_workdir/policy.json"}"
+	if [ -z "$policy_file" ] || [ ! -s "$policy_file" ] || ! command -v yq >/dev/null 2>&1; then
+		_dns_node_policy_cleanup
+		return 0
+	fi
+
+	# existing keys keep their value; overlapping patterns are left to mihomo
+	CLASHOO_NODE_DNS_POLICY_FILE="$policy_file" yq -M e -i '(.dns // {}) as $dns |
+		(load(strenv(CLASHOO_NODE_DNS_POLICY_FILE)) // {}) as $derived |
+		.dns."proxy-server-nameserver-policy" = ($derived * ($dns."proxy-server-nameserver-policy" // {}))
+	' "$CONFIG_YAML" 2>/dev/null
+	rc=$?
+
+	# mihomo rejects a node policy without a proxy node resolver
+	if [ "$(yq -M e -r '((.dns."proxy-server-nameserver" // []) | length)' "$CONFIG_YAML" 2>/dev/null)" = "0" ]; then
+		yq -M e -i '.dns."proxy-server-nameserver" = (.dns."default-nameserver" // ["223.5.5.5"])' "$CONFIG_YAML" 2>/dev/null || true
+	fi
+
+	_dns_node_policy_cleanup
+	[ "$rc" = "0" ] && log_msg "Inherited node domain DNS policy from subscription" "已从订阅继承节点域名 DNS 策略"
+	return 0
+}
+
 _dns_proxy_nameservers() {
 	local i=0 t en a p port s out="" prefix
 	while :; do
@@ -2098,7 +2200,9 @@ _start_prepare_config() {
 			cp -f /usr/share/clashoo/ruleset/cn.mrs /etc/clashoo/ruleset/cn.mrs 2>/dev/null
 		fi
 	fi
+	_dns_node_policy_capture
 	yml_change >/dev/null 2>&1
+	_dns_node_policy_apply
 	append_luci_fake_ip_filter_extras >/dev/null 2>&1
 	normalize_fake_ip_filter >/dev/null 2>&1
 	drop_legacy_cn_ip_injection >/dev/null 2>&1
@@ -2173,6 +2277,8 @@ _start_launch_core() {
 	_core_only=$(uci -q get clashoo.config.core_only 2>/dev/null)
 	mkdir -p "$(dirname "$CORE_LOG_PATH")" >/dev/null 2>&1
 	touch "$CORE_LOG_PATH" >/dev/null 2>&1
+	# core.log 在 tmpfs 上，先按大小裁剪，避免上次跑飞的大日志直接卡死启动
+	sh /usr/share/clashoo/lib/core_log_guard.sh "$CORE_LOG_PATH" >/dev/null 2>&1
 
 	# Core-only runs the imported config verbatim, which may reference absolute
 	# paths (e.g. OpenClash's external-ui /usr/share/openclash/ui). mihomo's
@@ -2211,6 +2317,10 @@ _start_launch_core() {
 	procd_set_param command /bin/sh -c "$_cmd"
 	[ "$disable_quic_gso" = "1" ] && procd_set_param env QUIC_GO_DISABLE_GSO=1
 	[ "$_core_only" = "1" ] && procd_set_param env SAFE_PATHS=/
+	# 默认 4095 个 fd 顶不住 BT/PCDN 类连接洪水，打爆后核心会陷入
+	# accept 失败刷屏，与 sing-box 实例保持一致提到 1000000。
+	procd_set_param limits core="unlimited"
+	procd_set_param limits nofile="1000000 1000000"
 	procd_set_param respawn 3600 5 5
 	procd_close_instance
 	[ "$disable_quic_gso" = "1" ] && log_msg "Disable quic-go GSO support" "已启用：禁用 quic-go GSO 支持"

clashoo/files/usr/share/clashoo/lib/core_log_guard.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# clashoo core log size guard
+# 用法: core_log_guard.sh [logfile]
+#
+# core.log 落在 /var/log（= /tmp 下的 tmpfs），没有大小上限时一次 accept
+# 失败风暴就能把它写到几百 MB，直接把 /tmp 写满（dnsmasq、配置生成、
+# cron 全部失效）。这里在超过上限时就地裁剪，只保留尾部内容。
+# 内核进程持有该文件的 O_APPEND fd，所以必须原地重写，不能替换 inode。
+
+set -u
+
+LOG="${1:-/var/log/clashoo/core.log}"
+MAX_KB="${CLASHOO_CORE_LOG_MAX_KB:-16384}"
+KEEP_KB="${CLASHOO_CORE_LOG_KEEP_KB:-1024}"
+
+[ -f "$LOG" ] || exit 0
+size="$(wc -c <"$LOG" 2>/dev/null)"
+case "${size:-}" in ''|*[!0-9]*) exit 0 ;; esac
+[ "$size" -gt $((MAX_KB * 1024)) ] || exit 0
+
+tmp="${LOG}.trim.$$"
+if tail -c $((KEEP_KB * 1024)) "$LOG" >"$tmp" 2>/dev/null && cat "$tmp" >"$LOG" 2>/dev/null; then
+	rm -f "$tmp"
+else
+	rm -f "$tmp"
+	: >"$LOG" 2>/dev/null || true
+fi
+exit 0

clashoo/files/usr/share/clashoo/net/access_check_daemon.sh

@@ -30,6 +30,8 @@ echo "$$" >"$PID_FILE"
 while :; do
 	[ "$(uci -q get clashoo.config.enable 2>/dev/null)" = "1" ] || break
 	/usr/share/clashoo/net/access_check_cache.sh >/dev/null 2>&1 || true
+	# 每轮顺手卡一下 core.log 大小（tmpfs 很小，跑飞会写满 /tmp）
+	sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1 || true
 	if [ -n "$INTERVAL_FIXED" ]; then
 		sleep "$INTERVAL_FIXED"
 	else

clashoo/files/usr/share/clashoo/runtime/dns_node_policy.uc

@@ -0,0 +1,118 @@
+#!/usr/bin/ucode
+'use strict';
+
+import { readfile } from 'fs';
+
+// Mirror node-domain DNS policies from the subscription into
+// proxy-server-nameserver-policy (issue #73).
+//
+// Airports publish their own resolver for node domains, e.g.
+//   nameserver-policy:
+//     "+.chylink.xyz": [tls://112.74.48.57:10853]
+// which answers with domestic relay IPs. mihomo resolves *proxy server* domains
+// through proxy-server-nameserver(-policy) and ignores nameserver-policy there,
+// so that resolver is never used and node domains fall back to public DNS -
+// which may return overseas CDN IPs that some lines cannot reach at all, leaving
+// every node (AnyTLS is TCP-only) timing out.
+//
+// Input : CLASHOO_NODE_DNS_SOURCE_FILE = path to {"policies": {...}, "servers": [...]}
+//         (CLASHOO_NODE_DNS_SOURCE with the JSON itself is still accepted)
+// Output: JSON map with only the policy entries matching a node server domain
+//         (nothing is printed when there is no match)
+
+let source = '';
+let source_file = getenv('CLASHOO_NODE_DNS_SOURCE_FILE') || '';
+
+if (length(source_file)) {
+	try {
+		source = readfile(source_file) || '';
+	}
+	catch (e) {
+		exit(0);
+	}
+}
+else {
+	source = getenv('CLASHOO_NODE_DNS_SOURCE') || '';
+}
+
+if (!length(source))
+	exit(0);
+
+let parsed;
+
+try {
+	parsed = json(source);
+}
+catch (e) {
+	exit(0);
+}
+
+if (type(parsed) != 'object')
+	exit(0);
+
+let policies = parsed.policies;
+let servers = parsed.servers;
+
+if (type(policies) != 'object' || type(servers) != 'array')
+	exit(0);
+
+let domains = [];
+let seen = {};
+
+for (let server in servers) {
+	if (type(server) != 'string' || !length(server))
+		continue;
+	server = lc(server);
+	if (seen[server])
+		continue;
+	seen[server] = true;
+	push(domains, server);
+}
+
+if (!length(domains))
+	exit(0);
+
+// suffix match on a label boundary: node.example.com matches +.example.com
+function domain_matches(key, domain) {
+	let key_len = length(key);
+	let domain_len = length(domain);
+
+	if (!key_len || domain_len < key_len)
+		return false;
+	if (domain == key)
+		return true;
+	if (substr(domain, domain_len - key_len) != key)
+		return false;
+	return substr(domain, domain_len - key_len - 1, 1) == '.';
+}
+
+let result = {};
+
+for (let key, value in policies) {
+	if (type(key) != 'string' || !length(key))
+		continue;
+
+	let lowered = lc(key);
+	let is_pattern = match(lowered, /^[+*]?\./) != null;
+	let domain = replace(lowered, /^\+\./, '');
+
+	domain = replace(domain, /^\*\./, '');
+	domain = replace(domain, /^\./, '');
+
+	let matched = false;
+
+	for (let candidate in domains) {
+		if (is_pattern ? domain_matches(domain, candidate) : (candidate == lowered)) {
+			matched = true;
+			break;
+		}
+	}
+
+	if (matched)
+		result[key] = value;
+}
+
+if (!length(keys(result)))
+	exit(0);
+
+print(sprintf('%J', result));

clashoo/files/usr/share/clashoo/update/maintenance_cron.sh

@@ -32,5 +32,6 @@ fi
 
 if [ "$(uci -q get clashoo.config.auto_clear_log)" = "1" ] && due log_cleanup.status clear_time; then
 	: >"$LOG_FILE"
+	sh /usr/share/clashoo/lib/core_log_guard.sh >/dev/null 2>&1
 	stamp log_cleanup.status
 fi

luci-app-eqosplus/.github/workflows/main.yml

@@ -0,0 +1,47 @@
+name: Build
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  build:
+    name: Build ${{ matrix.arch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - aarch64_generic
+          - i386_pentium-mmx
+          - loongarch64_generic
+          - mips_mips32
+          - mipsel_24kc
+          - mipsel_mips32
+          - x86_64
+    steps:
+      - uses: actions/checkout@main
+        with:
+          fetch-depth: 0
+      - name: Building packages
+        uses: sbwml/openwrt-gh-action-sdk@go1.24
+        env:
+          ARCH: ${{ matrix.arch }}-openwrt-24.10
+          FEEDNAME: packages_ci
+          PACKAGES: luci-app-eqosplus
+          NO_REFRESH_CHECK: true
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.arch }}
+          path: bin/packages/${{ matrix.arch }}/packages_ci/*.ipk
+
+      - name: Upload packages
+        uses: ncipollo/release-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          allowUpdates: true
+          replacesArtifacts: true
+          artifacts: "bin/packages/${{ matrix.arch }}/packages_ci/*.ipk"

luci-app-eqosplus/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 sirpdboy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

luci-app-eqosplus/Makefile

@@ -0,0 +1,39 @@
+#
+# Copyright (C) 2006-2017 OpenWrt.org#
+# Copyright (C) 2022-2025 sirpdboy herboy2008@gmail.com https://github.com/sirpdboy/luci-app-eqosplus
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+THEME_NAME:=eqosplus
+PKG_NAME:=luci-app-$(THEME_NAME)
+
+PKG_LICENSE:=Apache-2.0
+
+LUCI_TITLE:=LuCI support for eqosplus.
+LUCI_DESCRIPTION:=LuCI support for Easy eqosplus(Support speed limit based on IP address).
+LUCI_DEPENDS:=+ip-full +tc +nftables +bc +kmod-ifb
+LUCI_PKGARCH:=all
+
+PKG_VERSION:=1.3.0
+PKG_RELEASE:=20251128
+PKG_MAINTAINER:=sirpdboy <herboy2008@gmail.com>
+
+define Build/Compile
+endef
+
+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+rm -f /tmp/luci-*
+endef
+
+define Package/$(PKG_NAME)/conffiles
+/etc/config/eqosplus
+endef
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+

luci-app-eqosplus/README.md

@@ -0,0 +1,91 @@
+![hello](https://views.whatilearened.today/views/github/sirpdboy/deplives.svg) [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+
+<h1 align="center">
+  <br>luci-app-eqosplus<br>
+</h1>
+
+<p align="center">
+<a href="https://openwrt.org"><img alt="OpenWrt" src="https://img.shields.io/badge/OpenWrt-%E2%89%A519.07-ff0000?logo=openwrt&logoColor=white"></a>
+<a href="https://www.google.com/chrome/"><img alt="Chrome" src="https://img.shields.io/badge/Chrome-%E2%89%A5111-4285F3?logo=googlechrome&logoColor=white"></a>
+<a href="https://www.apple.com/safari/"><img alt="Safari" src="https://img.shields.io/badge/Safari-%E2%89%A516.4-000000?logo=safari&logoColor=white"></a>
+<a href="https://www.mozilla.org/firefox/"><img alt="Firefox" src="https://img.shields.io/badge/Firefox-%E2%89%A5128-FF7138?logo=firefoxbrowser&logoColor=white"></a>
+<a target="_blank" href="https://github.com/sirpdboy/luci-app-eqosplus/releases"> <img alt="GitHub release" src="https://img.shields.io/github/v/release/sirpdboy/luci-app-eqosplus"></a>
+<a href="https://github.com/sirpdboy/luci-app-eqosplus/releases"><img alt="Downloads" src="https://img.shields.io/github/downloads/sirpdboy/luci-app-eqosplus/total"></a>
+</p>
+
+[中文] | [English](README.md) 
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明1.jpg)
+
+Please read this page carefully, which includes precautions and instructions on how to use it.
+
+## Enhanced version of EQOS with timed speed limit and added features such as timed limit.
+
+### Method for downloading source code:
+
+ ```Brach
+    # downloading
+    git clone https://github.com/sirpdboy/luci-app-eqosplus package/luci-app-eqosplus
+    make menuconfig
+ ``` 
+### Configuration Menu
+ ```Brach
+    make menuconfig
+	# find LuCI -> Applications, select luci-app-eqosplus, save and exit
+ ``` 
+### compile
+
+ ```Brach 
+    # compile
+    make package/luci-app-eqosplus/compile V=s
+ ```
+
+
+## describe
+
+- luci-app-eqosplus ： https://github.com/sirpdboy/luci-app-eqosplus
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明2.jpg)
+
+
+## interface
+
+![screenshots](./doc/eqosplus0.png)
+
+![screenshots](./doc/eqosplus1.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus2.png)
+
+
+# My other project
+
+- Watch Dog ： https://github.com/sirpdboy/luci-app-watchdog
+- Net Speedtest ： https://github.com/sirpdboy/luci-app-netspeedtest
+- Task Plan : https://github.com/sirpdboy/luci-app-taskplan
+- Power Off Device : https://github.com/sirpdboy/luci-app-poweroffdevice
+- OpentoPD Theme : https://github.com/sirpdboy/luci-theme-opentopd
+- KuCat Theme : https://github.com/sirpdboy/luci-theme-kucat
+- KuCat Theme Config : https://github.com/sirpdboy/luci-app-kucat-config
+- NFT Time Control : https://github.com/sirpdboy/luci-app-timecontrol
+- Parent Control: https://github.com/sirpdboy/luci-theme-parentcontrol
+- Eqos Plus: https://github.com/sirpdboy/luci-app-eqosplus
+- Advanced : https://github.com/sirpdboy/luci-app-advanced
+- ddns-go : https://github.com/sirpdboy/luci-app-ddns-go
+- Advanced Plus）: https://github.com/sirpdboy/luci-app-advancedplus
+- Net Wizard: https://github.com/sirpdboy/luci-app-netwizard
+- Part Exp: https://github.com/sirpdboy/luci-app-partexp
+- Lukcy: https://github.com/sirpdboy/luci-app-lukcy
+
+## HELP
+
+|     <img src="https://img.shields.io/badge/-Alipay-F5F5F5.svg" href="#赞助支持本项目-" height="25" alt="图飞了"/>  |  <img src="https://img.shields.io/badge/-WeChat-F5F5F5.svg" height="25" alt="图飞了" href="#赞助支持本项目-"/>  | 
+| :-----------------: | :-------------: |
+|![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/支付宝.png) | ![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/微信.png) |
+
+<a href="#readme">
+    <img src="https://img.shields.io/badge/-TOP-orange.svg" alt="no" title="Return TOP" align="right"/>
+</a>
+
+![hello](https://visitor-badge-deno.deno.dev/sirpdboy.sirpdboy.svg) [![](https://img.shields.io/badge/TGGroup-ClickJoin-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)

luci-app-eqosplus/README_CN.md

@@ -0,0 +1,109 @@
+![hello](https://views.whatilearened.today/views/github/sirpdboy/deplives.svg) [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+
+<h1 align="center">
+  <br>luci-app-eqosplus<br>
+</h1>
+
+  <p align="center">
+
+  <a target="_blank" href="https://github.com/sirpdboy/luci-app-eqosplus/releases">
+    <img src="https://img.shields.io/github/release/sirpdboy/luci-app-eqosplus.svg?style=flat-square&label=luci-app-eqosplus&colorB=green">
+  </a>
+</p>
+
+[中文] | [English](README.md) 
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明1.jpg)
+
+请 **认真阅读完毕** 本页面，本页面包含注意事项和如何使用。
+
+## 功能说明：
+
+### 定时限速1.2.2版
+#### 2023.7.19 定时限速1.2.2：增加更多日期：工作日和休息日，自定义日期1，2，3中间用逗号分隔;加入MAC地址限速，从此不用担心IPV6和IPV4的限速问题。
+
+### 定时限速1.0版
+#### 2022.12.24 定时限速在eqos的加强版，加入定时限制等功能。
+
+## 编译使用方法 [![](https://img.shields.io/badge/-编译使用方法-F5F5F5.svg)](#编译使用方法-)
+
+将luci-app-eqosplus添加至 LEDE/OpenWRT 源码的方法。
+
+### 下载源码方法一：
+编辑源码文件夹根目录feeds.conf.default并加入如下内容:
+
+```Brach
+    # feeds获取源码：
+    src-git eqosplus  https://github.com/sirpdboy/luci-app-eqosplus
+ ``` 
+  ```Brach
+   # 更新feeds，并安装主题：
+    scripts/feeds update eqosplus
+	scripts/feeds install luci-app-eqosplus
+ ``` 	
+
+### 下载源码方法：
+ ```Brach
+    # 下载源码
+    git clone https://github.com/sirpdboy/luci-app-eqosplus package/luci-app-eqosplus
+    make menuconfig
+ ``` 
+### 配置菜单
+ ```Brach
+    make menuconfig
+	# 找到 LuCI -> Applications, 选择 luci-app-eqosplus, 保存后退出。
+ ``` 
+### 编译
+ ```Brach 
+    # 编译固件
+    make package/luci-app-eqosplus/compile V=s
+ ```
+
+## 说明 [![](https://img.shields.io/badge/-说明-F5F5F5.svg)](#说明-)
+
+源码来源：https://github.com/sirpdboy/luci-app-eqosplus
+
+
+- 你可以随意使用其中的源码，但请注明出处。
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明2.jpg)
+
+## 界面
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus.png)
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/eqosplus2.png)
+
+# My other project
+
+- 路由安全看门狗 ：https://github.com/sirpdboy/luci-app-watchdog
+- 网络速度测试 ：https://github.com/sirpdboy/luci-app-netspeedtest
+- 计划任务插件（原定时设置） : https://github.com/sirpdboy/luci-app-taskplan
+- 关机功能插件 : https://github.com/sirpdboy/luci-app-poweroffdevice
+- opentopd主题 : https://github.com/sirpdboy/luci-theme-opentopd
+- kucat酷猫主题: https://github.com/sirpdboy/luci-theme-kucat
+- kucat酷猫主题设置工具: https://github.com/sirpdboy/luci-app-kucat-config
+- NFT版上网时间控制插件: https://github.com/sirpdboy/luci-app-timecontrol
+- 家长控制: https://github.com/sirpdboy/luci-theme-parentcontrol
+- 定时限速: https://github.com/sirpdboy/luci-app-eqosplus
+- 系统高级设置 : https://github.com/sirpdboy/luci-app-advanced
+- ddns-go动态域名: https://github.com/sirpdboy/luci-app-ddns-go
+- 进阶设置（系统高级设置+主题设置kucat/agron/opentopd）: https://github.com/sirpdboy/luci-app-advancedplus
+- 网络设置向导: https://github.com/sirpdboy/luci-app-netwizard
+- 一键分区扩容: https://github.com/sirpdboy/luci-app-partexp
+- lukcy大吉: https://github.com/sirpdboy/luci-app-lukcy
+
+## 捐助
+
+![screenshots](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/说明3.jpg)
+
+|     <img src="https://img.shields.io/badge/-支付宝-F5F5F5.svg" href="#赞助支持本项目-" height="25" alt="图飞了"/>  |  <img src="https://img.shields.io/badge/-微信-F5F5F5.svg" height="25" alt="图飞了" href="#赞助支持本项目-"/>  | 
+| :-----------------: | :-------------: |
+|![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/支付宝.png) | ![xm1](https://raw.githubusercontent.com/sirpdboy/openwrt/master/doc/微信.png) |
+
+<a href="#readme">
+    <img src="https://img.shields.io/badge/-返回顶部-orange.svg" alt="图飞了" title="返回顶部" align="right"/>
+</a>
+
+![](https://visitor-badge-deno.deno.dev/sirpdboy.sirpdboy.svg)  [![](https://img.shields.io/badge/TG群-点击加入-FFFFFF.svg)](https://t.me/joinchat/AAAAAEpRF88NfOK5vBXGBQ)
+

luci-app-eqosplus/luasrc/controller/eqosplus.lua

@@ -0,0 +1,19 @@
+module("luci.controller.eqosplus", package.seeall)
+-- Copyright 2022-2023 sirpdboy <herboy2008@gmail.com>
+function index()
+    if not nixio.fs.access("/etc/config/eqosplus") then return end
+    entry({"admin", "control"}, firstchild(), "Control", 44).dependent = false
+
+    local e = entry({"admin", "control", "eqosplus"}, cbi("eqosplus"), _("Eqosplus"), 10)
+    e.dependent=false
+    e.acl_depends = { "luci-app-eqosplus" }
+    entry({"admin", "control", "eqosplus", "status"}, call("act_status")).leaf = true
+end
+
+function act_status()
+    local sys  = require "luci.sys"
+    local e = {} 
+     e.status = sys.call(" busybox ps -w | grep eqosplus | grep -v grep  >/dev/null ") == 0  
+    luci.http.prepare_content("application/json")
+    luci.http.write_json(e)
+end

luci-app-eqosplus/luasrc/model/cbi/eqosplus.lua

@@ -0,0 +1,190 @@
+-- Copyright 2022-2023 sirpdboy <herboy2008@gmail.com>
+-- Licensed to the public under the Apache License 2.0.
+local sys = require "luci.sys"
+local ifaces = sys.net:devices()
+local WADM = require "luci.tools.webadmin"
+local ipc = require "luci.ip"
+local a, t, e
+
+a = Map("eqosplus", translate("Network speed limit"))
+a.description = translate("Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second.")
+a.template = "eqosplus/index"
+
+t = a:section(TypedSection, "eqosplus")
+t.anonymous = true
+
+e = t:option(DummyValue, "eqosplus_status", translate("Status"))
+e.template = "eqosplus/eqosplus"
+e.value = translate("Collecting data...")
+
+
+ipi = t:option(ListValue, "ifname", translate("Interface"), translate("Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"))
+ipi.default = "1"
+ipi:value(1,translate("Automatic settings"))
+ipi:value("br-lan", translate("br-lan (LAN Bridge)"))
+local function get_wan_interfaces()
+    local result = {}
+    local ubus = require "ubus"
+    
+    local conn = ubus.connect()
+    if not conn then
+        return result
+    end
+
+    local network_status = conn:call("network.interface", "dump", {})
+    for _, iface in ipairs(network_status.interface) do
+        if iface.interface:match("^wan") or iface.interface:match("^pppoe") or iface.proto == "pppoe" then
+            local dev = iface.l3_device or iface.device
+            if dev then
+                table.insert(result, {
+                    name = dev,
+                    proto = iface.proto,
+                    logical_name = iface.interface
+                })
+            end
+        end
+    end
+
+    conn:close()
+    return result
+end
+
+local wan_ifaces = get_wan_interfaces()
+for _, iface in ipairs(wan_ifaces) do
+    ipi:value(iface.name, translate(iface.name) .. (iface.proto == "pppoe" and " (PPPoE)" or " (WAN)"))
+end
+
+t = a:section(TypedSection, "device")
+t.template = "cbi/tblsection"
+t.anonymous = true
+t.addremove = true
+
+comment = t:option(Value, "comment", translate("Comment"))
+comment.size = 8
+
+e = t:option(Flag, "enable", translate("Enabled"))
+e.rmempty = false
+e.size = 4
+
+ip = t:option(Value, "mac", translate("IP/MAC"))
+ip.size = 8
+
+local function get_devices()
+    local devices = {}
+    local seen_ips = {}
+    local ubus = require "ubus"
+    local conn = ubus.connect()
+    
+    local function get_hostname(ip)
+        local f = io.popen("nslookup "..ip.." 2>/dev/null | grep 'name =' | cut -d'=' -f2 | sed 's/\\.$//'")
+        if f then
+            local name = f:read("*l")
+            f:close()
+            if name and name ~= "" then
+                return name:match("^%s*(.-)%s*$")
+            end
+        end
+        local leases_file = io.open("/tmp/dhcp.leases", "r")
+        if leases_file then
+            for line in leases_file:lines() do
+                local mac, ip_lease, _, hostname = line:match("^(%S+)%s+(%S+)%s+(%S+)%s+(%S+)")
+                if ip_lease == ip and hostname ~= "*" then
+                    leases_file:close()
+                    return hostname
+                end
+            end
+            leases_file:close()
+        end
+       return "unknown"
+    end
+    if conn then
+        local leases = conn:call("dhcp", "ipv4leases", {}) or {}
+        for _, lease in ipairs(leases) do
+            if lease.ipaddr and lease.mac then
+                local hostname = lease.hostname or get_hostname(lease.ipaddr)
+                devices[#devices+1] = {
+                    ip = lease.ipaddr,
+                    mac = lease.mac:upper(),
+                    hostname = hostname,
+                    display = string.format("%s (%s) - %s", lease.ipaddr, lease.mac:upper(), hostname)
+                }
+                seen_ips[lease.ipaddr] = true
+            end
+        end
+        conn:close()
+    end
+    local arp_cmd = io.popen("ip -4 neigh show dev br-lan 2>/dev/null")
+    if arp_cmd then
+        for line in arp_cmd:lines() do
+            local ip_addr, mac = line:match("^(%S+)%s+.+%s+(%S+)%s+")
+            if ip_addr and mac and mac ~= "00:00:00:00:00:00" and not seen_ips[ip_addr] then
+                mac = mac:upper()
+                local hostname = get_hostname(ip_addr)
+                devices[#devices+1] = {
+                    ip = ip_addr,
+                    mac = mac,
+                    hostname = hostname,
+                    display = string.format("%s (%s) - %s", ip_addr, mac, hostname)
+                }
+                seen_ips[ip_addr] = true
+            end
+        end
+        arp_cmd:close()
+    end
+    table.sort(devices, function(a, b) return a.ip < b.ip end)
+    return devices
+end
+
+local devices = get_devices()
+for _, dev in ipairs(devices) do
+    ip:value(dev.ip, dev.display)
+end
+dl = t:option(Value, "download", translate("Downloads"))
+dl.default = '0.1'
+dl.size = 4
+
+ul = t:option(Value, "upload", translate("Uploads"))
+ul.default = '0.1'
+ul.size = 4
+function validate_time(self, value, section)
+        local hh, mm, ss
+        hh, mm, ss = string.match (value, "^(%d?%d):(%d%d)$")
+        hh = tonumber (hh)
+        mm = tonumber (mm)
+        if hh and mm and hh <= 23 and mm <= 59 then
+            return value
+        else
+            return nil, "Time HH:MM or space"
+        end
+end
+
+e = t:option(Value, "timestart", translate("Start control time"))
+e.placeholder = '00:00'
+e.default = '00:00'
+e.validate = validate_time
+e.rmempty = true
+e.size = 4
+
+e = t:option(Value, "timeend", translate("Stop control time"))
+e.placeholder = '00:00'
+e.default = '00:00'
+e.validate = validate_time
+e.rmempty = true
+e.size = 4
+
+week=t:option(Value,"week",translate("Week Day(1~7)"))
+week.rmempty = true
+week:value('0',translate("Everyday"))
+week:value(1,translate("Monday"))
+week:value(2,translate("Tuesday"))
+week:value(3,translate("Wednesday"))
+week:value(4,translate("Thursday"))
+week:value(5,translate("Friday"))
+week:value(6,translate("Saturday"))
+week:value(7,translate("Sunday"))
+week:value('1,2,3,4,5',translate("Workday"))
+week:value('6,7',translate("Rest Day"))
+week.default='0'
+week.size = 6
+
+return a

luci-app-eqosplus/luasrc/view/eqosplus/eqosplus.htm

@@ -0,0 +1,3 @@
+<%+cbi/valueheader%>
+<font class="eqosplus_status"><%=pcdata(self:cfgvalue(section) or self.default or "")%></font>
+<%+cbi/valuefooter%>

luci-app-eqosplus/luasrc/view/eqosplus/index.htm

@@ -0,0 +1,12 @@
+<% include("cbi/map") %>
+<script type="text/javascript">//<![CDATA[
+	XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "control", "eqosplus", "status" )%>', null,
+		function (x, result) {
+			var status = document.getElementsByClassName('eqosplus_status')[0];
+			status.setAttribute("style", "font-weight:bold;");
+			status.setAttribute("color", result.status ? "green" : "red");
+			status.innerHTML = result.status ? '<%=translate("RUNNING")%>' : '<%=translate("NOT RUNNING")%>';
+		}
+	)
+//]]>
+</script>

luci-app-eqosplus/po/templates/eqosplus.pot

@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr ""
+
+msgid "Network speed limit"
+msgstr ""
+
+msgid "Running state"
+msgstr ""
+
+msgid "Not running"
+msgstr ""
+
+msgid "Running"
+msgstr ""
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second."
+msgstr ""
+
+msgid "MAC/IP"
+msgstr ""
+
+msgid "Downloads"
+msgstr ""
+
+msgid "Uploads"
+msgstr ""
+
+msgid "Comment"
+msgstr ""
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr ""
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr ""
+
+msgid "Start control time"
+msgstr ""
+
+msgid "Stop control time"
+msgstr ""
+
+msgid "Week Day(1~7)"
+msgstr ""
+
+msgid "Suggested feedback:"
+msgstr ""
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr ""
+
+msgid "Rest Day"
+msgstr ""
+
+msgid "Workday"
+msgstr ""
+
+msgid "Automatic settings"
+msgstr ""
+

luci-app-eqosplus/po/zh-cn/eqosplus.po

@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr "定时限速"
+
+msgid "Network speed limit"
+msgstr "定时网速限制"
+
+msgid "Running state"
+msgstr "运行状态"
+
+msgid "Not running"
+msgstr "未运行"
+
+msgid "Running"
+msgstr "已运行"
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP.The speed unit is MB/second."
+msgstr "可以通过MAC，IP限制用户上传/下载的网速。速度单位为<font color=\"red\"><b> MB/秒 </b></font>。"
+
+msgid "MAC/IP"
+msgstr "MAC/IP"
+
+msgid "Downloads"
+msgstr "下载速度"
+
+msgid "Uploads"
+msgstr "上传速度"
+
+msgid "Comment"
+msgstr "备注"
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr "上传总带宽(Mbit/s)"
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr "下载总带宽(Mbit/s)"
+
+msgid "Start control time"
+msgstr "起控时间"
+
+msgid "Stop control time"
+msgstr "停控时间"
+
+msgid "Week Day(1~7)"
+msgstr "星期(1~7)"
+
+msgid "Suggested feedback:"
+msgstr "建议反馈:"
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr "设定用来限制网络速度的接口,拨号使用pppoe-wan,DHCP模式使用WAN口的硬件接口(如:eth1),通用使用br-lan接口"
+
+msgid "Rest Day"
+msgstr "休息日"
+
+msgid "Workday"
+msgstr "工作日"
+
+msgid "Automatic settings"
+msgstr "自动设置"
+

luci-app-eqosplus/po/zh_Hans/eqosplus.po

@@ -0,0 +1,61 @@
+
+msgid "Eqosplus"
+msgstr "定时限速"
+
+msgid "Network speed limit"
+msgstr "定时网速限制"
+
+msgid "Running state"
+msgstr "运行状态"
+
+msgid "Not running"
+msgstr "未运行"
+
+msgid "Running"
+msgstr "已运行"
+
+msgid "Users can limit the network speed for uploading/downloading through MAC, IP, and IP segments (192.168.110.00-192.168.10.200). The speed unit is MB/second."
+msgstr "用户可以通过MAC、IP、IP段（192.168.10.100-192.168.10.200),限制上传/下载的网络速度。速度单位为MB/秒。。"
+
+msgid "MAC/IP"
+msgstr "MAC/IP"
+
+msgid "Downloads"
+msgstr "下载速度"
+
+msgid "Uploads"
+msgstr "上传速度"
+
+msgid "Comment"
+msgstr "备注"
+
+msgid "Upload bandwidth(Mbit/s)"
+msgstr "上传总带宽(Mbit/s)"
+
+msgid "Download bandwidth(Mbit/s)"
+msgstr "下载总带宽(Mbit/s)"
+
+msgid "Start control time"
+msgstr "起控时间"
+
+msgid "Stop control time"
+msgstr "停控时间"
+
+msgid "Week Day(1~7)"
+msgstr "星期(1~7)"
+
+msgid "Suggested feedback:"
+msgstr "建议反馈:"
+
+msgid "Set the interface used for restriction, use pppoe-wan for dialing, use WAN hardware interface for DHCP mode (such as eth1), and use br-lan for bypass mode"
+msgstr "设定用来限制网络速度的接口,拨号使用pppoe-wan,DHCP模式使用WAN口的硬件接口(如:eth1),通用使用br-lan接口"
+
+msgid "Rest Day"
+msgstr "休息日"
+
+msgid "Workday"
+msgstr "工作日"
+
+msgid "Automatic settings"
+msgstr "自动设置"
+

luci-app-eqosplus/root/etc/config/eqosplus

@@ -0,0 +1,25 @@
+
+config eqosplus
+	option enabled '0'
+	option download '1000'
+	option upload '30'
+	option ifname '1'
+
+config device
+	option timestart '00:00'
+	option week '0'
+	option download '1'
+	option timeend '23:55'
+	option upload '1'
+	option mac '192.168.10.10'
+	option enable '0'
+
+config device
+	option mac '192.168.10.10-192.168.10.200'
+	option timestart '00:00'
+	option timeend '00:00'
+	option week '0'
+	option download '0.1'
+	option upload '0.1'
+	option enable '0'
+

luci-app-eqosplus/root/etc/hotplug.d/iface/10-eqosplus

@@ -0,0 +1,5 @@
+#!/bin/sh
+[ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ] && {
+    sleep 5
+    /etc/init.d/eqosplus restart
+}

luci-app-eqosplus/root/etc/init.d/eqosplus

@@ -0,0 +1,54 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (C) 2025 sirpdboy herboy2008@gmail.com https://github.com/sirpdboy/luci-app-eqosplus
+#
+
+START=99
+USE_PROCD=1
+
+NAME=eqosplus
+LOCK="/var/lock/$NAME.lock"
+CR=/etc/crontabs/root
+
+start_instance() {
+	 procd_open_instance
+	 procd_set_param command /usr/bin/eqosplusctrl
+	 procd_set_param respawn
+	 procd_set_param stderr 1
+	 procd_close_instance
+}
+
+_eqosplus_start() {
+	 if [ "$(grep -c 'option enable .1.' /etc/config/$NAME 2>/dev/null)" -gt "0" ]; then
+	 if [ x$(uci -q get turboacc.config.sw_flow) = 'x1' ] || [ x$(uci -q get turboacc.config.sfe_flow) = 'x1' ]  ;then
+	         uci -q set turboacc.config.sw_flow='0'
+	         uci -q set turboacc.config.sfe_flow='0'
+		 uci -q set turboacc.config.hw_flow='0'
+		 uci commit turboacc
+		 /etc/init.d/turboacc restart
+	  fi
+	    touch $LOCK
+	    eqosplus start
+	    start_instance
+	    (crontab -l ; echo "00 1 * * * /etc/init.d/eqosplus start") | sort - | uniq - | crontab -
+	 fi
+}
+
+start_service(){
+	[ -f $LOCK ] && exit
+	stop_service
+	_eqosplus_start
+	rm -f $LOCK
+}
+
+service_triggers() {
+ 	 procd_add_reload_trigger 'eqosplus'
+}
+
+stop_service(){
+	kill -9 $(busybox ps -w | grep 'eqosplusctrl' | grep -v 'grep' | awk '{print $1}') >/dev/null 2>&1
+	sed -i '/eqosplus/d' $CR >/dev/null 2>&1
+	rm -f $LOCK 2>/dev/null
+	eqosplus stop
+}
+

luci-app-eqosplus/root/etc/uci-defaults/luci-eqosplus

@@ -0,0 +1,13 @@
+#!/bin/sh
+chmod +x  /etc/init.d/eqosplus /usr/bin/eqosplus*
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@eqosplus[-1]
+	add ucitrack eqosplus
+	set ucitrack.@eqosplus[-1].init=eqosplus
+	commit ucitrack
+EOF
+
+[ -s /etc/config/eqosplus ] || echo "config eqosplus" > /etc/config/eqosplus
+
+rm -f /tmp/luci-indexcache
+exit 0

luci-app-eqosplus/root/usr/bin/eqosplus

@@ -0,0 +1,379 @@
+#!/bin/bash
+
+# Copyright (C) 2006 OpenWrt.org
+# Copyright 2022-2025 sirpdboy <herboy2008@gmail.com>
+
+crrun=$1
+crid=$2
+NAME=eqosplus
+IDLIST="/var/$NAME.idlist"
+LOCK="/var/lock/$NAME.lock"
+TMPID="/var/$NAME.tmpid"
+LOG="/var/$NAME_log.log"
+# idlist=`uci show $NAME | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' `
+
+
+if [ x$(uci get $NAME.@$NAME[0].ifname 2>/dev/null) = 'x1' ]; then
+    ifname=$(uci -q get network.lan.ifname)
+    [ "x$ifname" = "x" ] && ifname="device" || ifname="ifname"
+    dev=$(uci -q get network.wan.$ifname)
+    [ ! "$dev" ] && dev=br-lan
+else
+    dev=$(uci -q get $NAME.@$NAME[0].ifname 2>/dev/null)
+    [ ! "$dev" ] && dev=br-lan
+fi
+
+bin_nft=$(which nft)
+bin_tc=$(which tc)
+bin_ip=$(which ip)
+DEBUG=1
+
+nft_type() {
+    if command -v nft >/dev/null; then
+        nftables_ver="true"
+    fi
+}
+
+# Debug functions
+dbg_nft() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: nft $*"
+    $bin_nft "$@"
+}
+
+dbg_tc() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: tc $*"
+    $bin_tc "$@"
+}
+
+dbg_ip() {
+    [ "${DEBUG:-0}" -eq 0 ] || echo "DEBUG: ip $*"
+    $bin_ip "$@"
+}
+
+is_macaddr() {
+    ret=1
+    if echo "$1" | grep -qE '^([0-9A-Fa-f]{2}[-:]){5}[0-9A-Fa-f]{2}$'; then
+        ret=0
+    fi
+    return $ret
+}
+
+# 数值比较函数
+is_gt_zero() {
+    local value=$1
+    # 使用bc进行浮点数比较
+    echo "$value > 0" | bc -l 2>/dev/null | grep -q 1
+}
+
+# 转换为kbit
+to_kbit() {
+    local mb=$1
+    # MB/s 转 kbit/s: 1 MB/s = 8192 kbit/s
+    echo "scale=0; $mb * 8192 / 1" | bc 2>/dev/null || echo "0"
+}
+
+# Default commands
+tc="dbg_tc"
+ip="dbg_ip"
+nft="dbg_nft"
+
+nft_type
+
+stop_qos() {
+    for face in $(tc qdisc show 2>/dev/null | grep htb | awk '{print $5}'); do
+        $tc qdisc del dev $face root 2>/dev/null
+    done
+
+    $tc qdisc del dev ${dev} root 2>/dev/null
+    $tc qdisc del dev ${dev}_ifb root 2>/dev/null
+    $tc qdisc del dev ${dev} ingress 2>/dev/null
+        $ip link del dev ${dev}_ifb 2>/dev/null 2>&1
+
+    if [ -n "$nftables_ver" ]; then
+        $nft delete table inet ${NAME} 2>/dev/null
+        $nft delete table bridge ${NAME} 2>/dev/null
+    fi
+
+    echo "" > "$IDLIST" 2>/dev/null
+}
+
+init_qosplus() {
+
+    insmod sch_htb 2>/dev/null
+    insmod act_mirred 2>/dev/null
+    insmod ifb 2>/dev/null
+    
+    $ip link del dev ${dev}_ifb 2>/dev/null
+    $ip link add dev ${dev}_ifb name ${dev}_ifb type ifb
+    $ip link set dev ${dev}_ifb up
+
+    $tc qdisc del dev ${dev} root 2>/dev/null
+    $tc qdisc add dev ${dev} root handle 1:0 htb default 1
+    $tc class add dev ${dev} parent 1:0 classid 1:1 htb rate 1000mbit ceil 1000mbit
+    
+    $tc qdisc del dev ${dev}_ifb root 2>/dev/null
+    $tc qdisc add dev ${dev}_ifb root handle 1:0 htb default 1
+    $tc class add dev ${dev}_ifb parent 1:0 classid 1:1 htb rate 1000mbit ceil 1000mbit
+    lanipaddr=$(uci -q get network.lan.ipaddr 2>/dev/null | awk -F '.' '{print $1"."$2"."$3".0/24"}')
+    if [ -n "$lanipaddr" ]; then
+        $tc filter add dev $dev parent 1:0 protocol ip prio 1 u32 match ip src "$lanipaddr" match ip dst "$lanipaddr" flowid 1:1
+        $tc filter add dev ${dev}_ifb parent 1:0 protocol ip prio 1 u32 match ip src "$lanipaddr" match ip dst "$lanipaddr" flowid 1:1
+    fi
+    $tc qdisc del dev ${dev} ingress 2>/dev/null
+    $tc qdisc add dev ${dev} ingress
+    $tc filter add dev ${dev} parent ffff: protocol all prio 2 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev ${dev}_ifb
+
+    if [ -n "$nftables_ver" ]; then
+        $nft delete table inet ${NAME} 2>/dev/null
+        $nft delete table bridge ${NAME} 2>/dev/null
+        
+        $nft add table inet ${NAME}
+        
+        $nft add chain inet ${NAME} mark_forward { type filter hook forward priority -200\; policy accept\; }
+        $nft add chain inet ${NAME} mark_output { type filter hook output priority -200\; policy accept\; }
+        $nft add chain inet ${NAME} mark_postrouting { type filter hook postrouting priority -200\; policy accept\; }
+    fi
+    
+    return 0
+}
+
+
+del_id() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: del_id $@ --$id --$mac"
+    $tc filter del dev ${dev} parent 1: handle 800::$(printf "%x" $id) 2>/dev/null
+    $tc class del dev ${dev} parent 1:1 classid 1:$id 2>/dev/null
+    $tc filter del dev ${dev}_ifb parent 1: handle 800::$(printf "%x" $id) 2>/dev/null
+    $tc class del dev ${dev}_ifb parent 1:1 classid 1:$id 2>/dev/null
+    mac=$(uci -q get $NAME.@device[$list_id].mac 2>/dev/null)
+    if [ -n "$nftables_ver" ] && [ -n "$mac" ]; then
+        if is_macaddr "$mac"; then
+            $nft delete rule inet ${NAME} mark_forward ether saddr $mac counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_output ether saddr $mac counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_postrouting ether saddr $mac counter 2>/dev/null
+        else
+            Z=$(echo $mac | awk -F '[/]' '{print $2}')
+            [ -n "$Z" ] && mac=$(echo $mac | awk -F '[/]' '{print $1}') || Z=32
+            $nft delete rule inet ${NAME} mark_forward ip saddr $mac/$Z counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_output ip saddr $mac/$Z counter 2>/dev/null
+            $nft delete rule inet ${NAME} mark_postrouting ip saddr $mac/$Z counter 2>/dev/null
+        fi
+    fi
+}
+
+add_mac() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    M0=$(echo $mac | cut -d : -f 1)$(echo $mac | cut -d : -f 2)
+    M1=$(echo $mac | cut -d : -f 3)$(echo $mac | cut -d : -f 4)
+    M2=$(echo $mac | cut -d : -f 5)$(echo $mac | cut -d : -f 6)
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: add_mac $@ --id:$id --mac:$mac M012--$M0-$M1-$M2"
+
+    if is_gt_zero "$UL"; then
+        if [ -n "$nftables_ver" ]; then
+            $nft add rule inet ${NAME} mark_forward ether saddr $mac counter meta mark set $id
+            $nft add rule inet ${NAME} mark_output ether saddr $mac counter meta mark set $id
+            $nft add rule inet ${NAME} mark_postrouting ether saddr $mac counter meta mark set $id
+        fi
+        $tc class add dev ${dev}_ifb parent 1:1 classid 1:$id htb rate "${UL}kbit" ceil "${UL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev}_ifb parent 1:$id handle ${id}: sfq perturb 10
+
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $id handle $id fw flowid 1:$id
+
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $((id + 100)) u32 \
+            match u16 0x0800 0xFFFF at -2 \
+            match u16 0x${M2} 0xFFFF at -4 \
+            match u32 0x${M0}${M1} 0xFFFFFFFF at -8 \
+            flowid 1:$id
+    fi
+    if is_gt_zero "$DL"; then
+        $tc class add dev ${dev} parent 1:1 classid 1:$id htb rate "${DL}kbit" ceil "${DL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev} parent 1:$id handle ${id}: sfq perturb 10
+
+        $tc filter add dev ${dev} parent 1: protocol ip prio $id u32 \
+            match u16 0x0800 0xFFFF at -2 \
+            match u32 0x${M1}${M2} 0xFFFFFFFF at -12 \
+            match u16 0x${M0} 0xFFFF at -14 \
+            flowid 1:$id
+    fi
+}
+
+add_ip() {
+    local list_id=$1
+    id=$((list_id * 10 + 1000))
+    [ "${DEBUG:-0}" -eq 0 ] || echo "D: add_ip $@ --$id --$mac"
+    
+    Z=$(echo $mac | awk -F '[/]' '{print $2}')
+    [ -n "$Z" ] && mac=$(echo $mac | awk -F '[/]' '{print $1}') || Z=32
+    if is_gt_zero "$UL"; then
+        if [ -n "$nftables_ver" ]; then
+            $nft add rule inet ${NAME} mark_forward ip saddr $mac/$Z counter meta mark set $id
+            $nft add rule inet ${NAME} mark_output ip saddr $mac/$Z counter meta mark set $id
+            $nft add rule inet ${NAME} mark_postrouting ip saddr $mac/$Z counter meta mark set $id
+        fi
+        $tc class add dev ${dev}_ifb parent 1:1 classid 1:$id htb rate "${UL}kbit" ceil "${UL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev}_ifb parent 1:$id handle ${id}: sfq perturb 10
+        $tc filter add dev ${dev}_ifb parent 1: protocol ip prio $id handle $id fw flowid 1:$id
+        $tc filter add dev ${dev}_ifb parent 1:0 prio $((id + 100)) protocol ip u32 \
+            match ip src "$mac"/"$Z" \
+            flowid 1:$id
+    fi
+    if is_gt_zero "$DL"; then
+        $tc class add dev ${dev} parent 1:1 classid 1:$id htb rate "${DL}kbit" ceil "${DL}kbit" prio $id burst 15k cburst 15k
+        $tc qdisc add dev ${dev} parent 1:$id handle ${id}: sfq perturb 10
+        $tc filter add dev ${dev} parent 1:0 prio $id protocol ip u32 \
+            match ip dst "$mac"/"$Z" \
+            flowid 1:$id
+    fi
+}
+
+check_time() {
+    local start=$1
+    local end=$2
+    local current=$(date +%H%M)
+    local start_min=$((10#${start:0:2}*60 + 10#${start:3:2}))
+    local end_min=$((10#${end:0:2}*60 + 10#${end:3:2}))
+    local current_min=$((10#${current:0:2}*60 + 10#${current:2:2}))
+    
+    if [[ $start_min -lt $end_min ]]; then
+        [[ $current_min -ge $start_min && $current_min -lt $end_min ]]
+    else
+        [[ $current_min -ge $start_min || $current_min -lt $end_min ]]
+    fi
+}
+
+check_list() {
+    local i=$1
+    local start_time=$(uci -q get $NAME.@device[$i].timestart 2>/dev/null)
+    local end_time=$(uci -q get $NAME.@device[$i].timeend 2>/dev/null)
+    local wweek=$(uci -q get $NAME.@device[$i].week 2>/dev/null)
+    local current_weekday=$(date +%u)
+    [ -z "$start_time" ] && [ -z "$end_time" ] && [ -z "$wweek" ] && return 0
+    
+    if [ -n "$wweek" ] && [ "$wweek" != "0" ]; then
+        local day_match=0
+        for day in $(echo $wweek | tr ',' ' '); do
+            [ "$day" -eq "$current_weekday" ] && day_match=1 && break
+        done
+        [ "$day_match" -eq 0 ] && return 1
+    fi
+    
+    if [ -n "$start_time" ] && [ -n "$end_time" ]; then
+        check_time "$start_time" "$end_time" || return 1
+    fi
+    
+    return 0
+}
+
+case "$crrun" in
+    "stop")
+        stop_qos
+    ;;
+    "start")
+        stop_qos > /dev/null 2>&1
+        sleep 2
+        init_qosplus
+        idlist=$(uci show $NAME 2>/dev/null | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' | sort -nu | sed -e 's/^/!/g' -e 's/$/!/g' > $IDLIST; cat $IDLIST 2>/dev/null | sed -e 's/!//g')
+        
+        if [ ! -s "$IDLIST" ]; then
+            return 1
+        fi
+
+        device_count=0
+        for list in $(echo $idlist | sed -e 's/!//g'); do
+            if check_list $list; then
+                mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+                download_mb=$(uci -q get $NAME.@device[$list].download 2>/dev/null)
+                upload_mb=$(uci -q get $NAME.@device[$list].upload 2>/dev/null)
+                comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+                
+                # 转换为kbit
+                DL=$(to_kbit "$download_mb")
+                UL=$(to_kbit "$upload_mb")
+                
+                if [ -n "$mac" ]; then
+                    if is_macaddr "$mac"; then
+                        add_mac $list  >>$LOG
+                        echo "✅ MAC限速: $comment ($mac) - 下载:${download_mb}MB/s(${DL}kbit/s) 上传:${upload_mb}MB/s(${UL}kbit/s)"  >>$LOG
+                    else
+                        add_ip $list  >>$LOG
+                        echo "✅ IP限速: $comment ($mac) - 下载:${download_mb}MB/s(${DL}kbit/s) 上传:${upload_mb}MB/s(${UL}kbit/s)"  >>$LOG
+                    fi
+                    device_count=$((device_count + 1))
+                fi
+            else
+                [ -f "$IDLIST" ] && [ $(grep "!${list}!" "$IDLIST" 2>/dev/null | wc -l) -gt 0 ] && {
+                    del_id $list  >>$LOG
+                    sed -i "/!$list!/d" "$IDLIST" >/dev/null 2>&1
+                    comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+                }
+            fi
+        done
+        echo "EQOSPLUS限速服务启动完成，共配置 $device_count 个设备"  >>$LOG
+        echo ""
+        echo "当前限速状态:"   >>$LOG
+        tc -s class show dev $dev | grep "rate" | head -5   >>$LOG
+        tc -s class show dev ${dev}_ifb | grep "rate" | head -5   >>$LOG
+
+    ;;
+    "add")
+        echo "➕ 添加限速规则..."
+        for list in $(echo $crid | sed -e 's/!//g' | sed 's/,/ /g'); do
+            mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+            download_mb=$(uci -q get $NAME.@device[$list].download 2>/dev/null)
+            upload_mb=$(uci -q get $NAME.@device[$list].upload 2>/dev/null)
+            comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+            DL=$(to_kbit "$download_mb")
+            UL=$(to_kbit "$upload_mb")
+            
+            if is_macaddr $mac; then
+                add_mac $list
+                echo "✅ 添加MAC限速: $comment ($mac)" >>$LOG
+            else
+                add_ip $list
+                echo "✅ 添加IP限速: $comment ($mac)" >>$LOG
+            fi
+        done
+    ;;
+    "del")
+        for list in $(echo $crid | sed -e 's/!//g' | sed 's/,/ /g'); do 
+            comment=$(uci -q get $NAME.@device[$list].comment 2>/dev/null)
+            mac=$(uci -q get $NAME.@device[$list].mac 2>/dev/null)
+            del_id $list
+        done
+    ;;
+    "status")
+        echo "EQOSPLUS限速服务状态"
+        echo "### 网络接口: $dev ###"
+        echo "# 下载队列统计 #"
+        tc -s qdisc show dev $dev 2>/dev/null || echo "无下载队列"
+        echo "# 下载类统计 #"
+        tc -s class show dev $dev 2>/dev/null | grep -E "class htb|rate [0-9]" || echo "无下载类"
+        echo "# 下载过滤器 #"
+        tc -s filter show dev $dev parent 1: 2>/dev/null | head -10 || echo "无下载过滤器"
+        
+        echo "### 虚拟接口: ${dev}_ifb ###"
+        echo "# 上传队列统计 #"
+        tc -s qdisc show dev ${dev}_ifb 2>/dev/null || echo "无上传队列"
+        echo "# 上传类统计 #"
+        tc -s class show dev ${dev}_ifb 2>/dev/null | grep -E "class htb|rate [0-9]" || echo "无上传类"
+        echo "# 上传过滤器 #"
+        tc -s filter show dev ${dev}_ifb parent 1: 2>/dev/null | head -10 || echo "无上传过滤器"
+        
+        if [ -n "$nftables_ver" ]; then
+            echo "### NFTables规则 ###"
+            nft list table inet ${NAME} 2>/dev/null || echo "没有NFTables规则"
+        else
+            echo "NFTables不可用"
+        fi
+        
+        # 显示流量统计
+        echo "### 流量统计 ###"
+        echo "下载流量:"
+        tc -s class show dev $dev 2>/dev/null | grep "Sent" | head -5
+        echo "上传流量:"
+        tc -s class show dev ${dev}_ifb 2>/dev/null | grep "Sent" | head -5
+    ;;
+
+esac

luci-app-eqosplus/root/usr/bin/eqosplusctrl

@@ -0,0 +1,63 @@
+#!/bin/sh
+
+# Copyright (C) 2006 OpenWrt.org
+# Copyright 2022-2025 sirpdboy <herboy2008@gmail.com>
+NAME=eqosplus
+IDLIST="/var/$NAME.idlist"
+TMPID="/var/$NAME.tmpid"
+
+idlist=`uci show $NAME | grep "enable='1'" | grep "device" | grep -oE '\[.*?\]' | grep -o '[0-9]' `
+
+check_list() {
+	i=$1
+	checki='0'
+	start_time=$(uci -q get $NAME.@device[$i].timestart 2>/dev/null)
+	end_time=$(uci -q get $NAME.@device[$i].timeend 2>/dev/null)
+	wweek=`uci -q get $NAME.@device[$i].week `
+	current_time=$(date +%H:%M)
+	current_weekday=$(date +%u)
+	for ww in `echo $wweek | sed 's/,/ /g' `; do 
+		if [ $current_weekday = $ww ] || [ 'x0' = x$ww ] ;then 
+		       [ "$start_time" = "$end_time" ] && checki='1' || { 
+		       	   if  [ "$start_time" \< "$end_time" ]; then
+			       if  [ "$current_time" \> "$start_time" ]  &&  [ "$current_time" \< "$end_time" ] ; then
+		       	           checki='1'
+		       	       fi
+		       	   else 
+			       if [ "$start_time" \> "$end_time" ] ; then
+			          if [ "$current_time" \< "$start_time" ] && [ "$current_time" \> "$end_time" ] ; then
+		       	              checki='1'
+		       	          fi
+			       fi
+			   fi
+		       	}
+		fi
+	done
+	return
+}
+
+idlistusr(){
+   checki='0'
+   [ -s $IDLIST ] || touch $IDLIST
+   for list in $idlist ;do
+	check_list $list
+	if [ $checki == '1' ] ; then
+	     [ `cat $IDLIST  2>/dev/null | grep "!${list}!" | wc -l ` -gt 0 ] || { 
+	         eqosplus add $list
+	         echo "!${list}!" >> $IDLIST ;  cat $IDLIST | sort | uniq  > $TMPID ;cat $TMPID >$IDLIST ;rm -rf $TMPID
+	     }
+        else
+	     [ `cat $IDLIST  2>/dev/null | grep "!${list}!" | wc -l ` -gt 0 ] && {
+	         eqosplus del $list
+		 sed -i "/!$list!/d" $IDLIST >/dev/null 2>&1
+	     }
+	fi
+   done
+}
+
+
+while :;do
+	sleep 30
+	idlistusr
+	sleep 30
+done

luci-app-eqosplus/root/usr/share/rpcd/acl.d/luci-app-eqosplus.json

@@ -0,0 +1,11 @@
+{
+	"luci-app-eqosplus": {
+		"description": "Grant UCI access for luci-app-eqosplus",
+		"read": {
+			"uci": [ "eqosplus" ]
+		},
+		"write": {
+			"uci": [ "eqosplus" ]
+		}
+	}
+}

luci-app-mosdns/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-mosdns
-PKG_VERSION:=1.7.14
+PKG_VERSION:=1.7.15
 PKG_RELEASE:=1
 
 LUCI_TITLE:=LuCI Support for mosdns

luci-app-mosdns/root/usr/share/rpcd/ucode/luci.mosdns

@@ -247,11 +247,32 @@ const methods = {
 		call: function() {
 			try {
 				let path = get_logfile_path_internal();
-				if (path && stat(path)) {
-					return { log: readfile(path) };
-				} else {
+				let s = path ? stat(path) : null;
+				if (!s) {
 					return { error: 'Log file not accessible or does not exist.' };
 				}
+
+				let f = open(path, 'r');
+				if (!f) {
+					return { error: 'Failed to open log file.' };
+				}
+
+				let max_bytes = 262144;
+				if (s.size > max_bytes) {
+					f.seek(-max_bytes, 2);
+				}
+
+				let log = f.read(max_bytes) ?? '';
+				f.close();
+
+				if (s.size > max_bytes) {
+					let idx = index(log, '\n');
+					if (idx != -1) {
+						log = substr(log, idx + 1);
+					}
+				}
+
+				return { log: log };
 			} catch (e) {
 				return { error: String(e) };
 			}

luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua

@@ -725,7 +725,7 @@ if has_smartdns then
 		o = s:taboption("log", DummyValue, "_smartdns_ui_link", "WebUI")
 		o.rawhtml = true
 		o.cfgvalue = function(self, section)
-			local port = tonumber(m:get(section, "smartdns_ui_port")) or 9880
+			local port = tonumber((m:get(section, "smartdns_ui_port"))) or 9880
 			if port < 1 or port > 65535 or port % 1 ~= 0 then port = 9880 end
 			return string.format(
 				[[<input class="btn cbi-button cbi-button-apply" type="button" value="%s" onclick="var host = window.location.hostname; if (host.indexOf(':') !== -1 &amp;&amp; host.charAt(0) !== '[') host = '[' + host + ']'; window.open('http://' + host + ':%d', '_blank', 'noopener,noreferrer');" />]],

luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -396,6 +396,98 @@ local function non_file_check(file_path, header_content)
 	return false
 end
 
+-- 检查 Geo 所有分类的边界，每个分类抽查首条规则，仅用于识别 Geo 格式。
+local function validate_geo_file(file_path, geo_type)
+	if geo_type ~= "geoip" and geo_type ~= "geosite" then return false end
+	local file = io.open(file_path, "rb")
+	if not file then return false end
+	local size = file:seek("end")
+	if not size or size == 0 or not file:seek("set", 0) then file:close(); return false end
+	local pos, rules = 0, 0
+	-- 使用文件自身的读取缓冲，跳过内容时直接定位，无需维护额外缓冲区。
+	local function skip(length, limit)
+		assert(length <= limit - pos)
+		pos = pos + length
+		assert(file:seek("set", pos))
+	end
+	-- 未指定数值上限时，仅检查并跳过变长整数，避免 64 位属性值的精度问题。
+	local function varint(limit, maximum)
+		local value, factor = 0, 1
+		for i = 1, 10 do
+			assert(pos < limit)
+			local byte = assert(file:read(1)):byte()
+			pos = pos + 1
+			assert(i < 10 or byte <= 1)
+			if maximum then
+				local digit = byte % 128
+				assert(digit <= math.floor((maximum - value) / factor))
+				value = value + digit * factor
+			end
+			if byte < 128 then return value end
+			factor = factor * 128
+		end
+		error(false)
+	end
+	-- 字段定义：编码类型、子消息类型（可选）、数值上限（可选）。
+	local schema = {
+		list = {{2, geo_type}},
+		geoip = {{2}, {2, "cidr"}, {0}},
+		geosite = {{2}, {2, "domain"}},
+		cidr = {{2}, {0, nil, 4294967295}},
+		domain = {{0, nil, 3}, {2}, {2, "attribute"}},
+		attribute = {{2}, {0}, {0}}
+	}
+	local parse
+	parse = function(kind, limit)
+		local values, entries = {}, 0
+		local is_entry = kind == "geoip" or kind == "geosite"
+		while pos < limit do
+			if is_entry and values[1] and values[1] > 0 and entries > 0 then
+				skip(limit - pos, limit)
+				return
+			end
+			local tag = varint(limit, 4294967295)
+			local field, wire = math.floor(tag / 8), tag % 8
+			local spec = schema[kind][field]
+			assert(field > 0 and (not spec or wire == spec[1]))
+			local value
+			if wire == 0 then
+				value = varint(limit, spec and spec[3])
+			elseif wire == 2 then
+				value = varint(limit, limit - pos)
+				assert(value <= limit - pos)
+				if spec and spec[2] and not (is_entry and entries > 0) then
+					parse(spec[2], pos + value)
+				else
+					skip(value, limit)
+				end
+				if spec and spec[2] then entries = entries + 1 end
+			elseif wire == 1 or wire == 5 then
+				skip(wire == 1 and 8 or 4, limit)
+			else
+				-- Geo 格式不使用 Protobuf 分组字段。
+				error(false)
+			end
+			if spec then values[field] = value end
+		end
+		if kind == "list" then
+			assert(entries > 0 and rules > 0)
+		elseif kind == "geoip" or kind == "geosite" or kind == "attribute" then
+			assert(values[1] and values[1] > 0)
+		elseif kind == "cidr" then
+			assert(values[1] == 4 or values[1] == 16)
+			assert((values[2] or 0) <= (values[1] == 4 and 32 or 128))
+			rules = rules + 1
+		elseif kind == "domain" then
+			assert(values[2] and values[2] > 0)
+			rules = rules + 1
+		end
+	end
+	local valid = pcall(parse, "list", size)
+	file:close()
+	return valid
+end
+
 local function GeoToRule(rule_name, rule_type, out_path)
 	local bin = api.finded_com("geoview")
 	if not (bin and api.compare_versions(api.get_app_version("geoview"), ">=", "0.1.10")) then
@@ -416,11 +508,11 @@ local function GeoToRule(rule_name, rule_type, out_path)
 		geo_arg = geo_arg .. " -ipv4=false"
 	end
 	local cmd = string.format(bin .. " -input '%s' %s -lowmem=true -output '%s'", file_path, geo_arg, out_path)
-	sys.exec(cmd)
+	local code, out = api.exec_call(cmd)
 	local local_file_size = tonumber(fs.stat(out_path, "size") or 0)
-	if local_file_size == 0 then
+	if code ~= 0 or local_file_size == 0 then
 		api.remove(out_path)
-		log(rule_name .. " 生成失败，请确保 Geo 文件正确且包含目标规则。")
+		log(rule_name .. " 生成失败，原因：" .. out)
 		return false
 	end
 	return true
@@ -612,6 +704,10 @@ local function fetch_geofile(geo_name, geo_type, url)
 				return 1
 			end
 		else
+			if not validate_geo_file(tmp_path, geo_type) then
+				log(geo_type .. " 文件格式校验错误，更新失败。")
+				return 1
+			end
 			if fs.access(asset_path) and sys.call(string.format("cmp -s %s %s", tmp_path, asset_path)) == 0 then
 				log(geo_type .. " 版本一致，无需更新。")
 				return 0