update 2026-06-29 16:54:16

luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm

@@ -552,8 +552,9 @@ local current_node = map:get(section)
 			}
 			params += "&type=" + v_transport;
 
+			var v_security = "none";
 			if (opt.get(dom_prefix + "tls").checked) {
-				var v_security = "tls";
+				v_security = "tls";
 				if (opt.get(dom_prefix + "fingerprint") && opt.get(dom_prefix + "fingerprint").value != "") {
 					let v_fp = opt.get(dom_prefix + "fingerprint").value;
 					params += "&fp=" + v_fp;
@@ -565,7 +566,6 @@ local current_node = map:get(section)
 					params += opt.query("spx", dom_prefix + "reality_spiderX");
 					params += opt.query("pqv", dom_prefix + "reality_mldsa65Verify");
 				}
-				params += "&security=" + v_security;
 				params += opt.query("alpn", dom_prefix + "alpn");
 				params += opt.query("sni", dom_prefix + "tls_serverName");
 				params += opt.query("allowinsecure", dom_prefix + "tls_allowInsecure");
@@ -573,6 +573,7 @@ local current_node = map:get(section)
 				params += opt.query("vcn", dom_prefix + "tls_CertByName");
 				params += opt.query("ech", dom_prefix + "ech_config");
 			}
+			params += "&security=" + v_security;
 
 			opt.get(dom_prefix + "tcp_fast_open")?.checked && (params += "&tfo=1");
 			if (opt.get(dom_prefix + "use_finalmask")?.checked) {
@@ -1302,17 +1303,37 @@ local current_node = map:get(section)
 			}
 
 			queryParam.security = queryParam.security || "tls";
-			opt.set(dom_prefix + 'tls', queryParam.security === "tls");
-			if (queryParam.security === "tls") {
-				opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
-				opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
-				opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || '');
-				opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');
+			if (queryParam.security == "tls" || queryParam.security == "reality") {
+				if (queryParam.security == "tls") {
+					opt.set(dom_prefix + 'tls', true);
+					opt.set(dom_prefix + 'reality', false);
+					opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
+					opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
+					if (queryParam.fp && queryParam.fp.trim() != "") {
+						opt.set(dom_prefix + 'utls', true);
+						opt.set(dom_prefix + 'fingerprint', queryParam.fp);
+					}
+					opt.set(dom_prefix + 'tls_pinSHA256', queryParam.pcs || '');
+					opt.set(dom_prefix + 'tls_CertByName', queryParam.vcn || '');
+					opt.set(
+						dom_prefix + 'tls_allowInsecure',
+						!((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0')
+					);
+				}
+				if (queryParam.security == "reality") {
+					opt.set(dom_prefix + 'tls', true);
+					opt.set(dom_prefix + 'reality', true);
+					opt.set(dom_prefix + 'alpn', queryParam.alpn || 'default');
+					opt.set(dom_prefix + 'tls_serverName', queryParam.peer || queryParam.sni || "");
+					if (queryParam.fp && queryParam.fp.trim() != "") {
+						opt.set(dom_prefix + 'utls', true);
+						opt.set(dom_prefix + 'fingerprint', queryParam.fp);
+					}
+					opt.set(dom_prefix + 'reality_publicKey', queryParam.pbk || '');
+					opt.set(dom_prefix + 'reality_shortId', queryParam.sid || '');
+				}
 			}
-			opt.set(
-				dom_prefix + 'tls_allowInsecure',
-				!((queryParam.allowinsecure ?? '0') === '0' && (queryParam.allowInsecure ?? '0') === '0' && (queryParam.insecure ?? '0') === '0')
-			);
+
 			opt.set(dom_prefix + 'tcp_fast_open', queryParam.tfo);
 			opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm);
 			opt.set(dom_prefix + 'finalmask', queryParam.fm || "");

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -1055,11 +1055,24 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			end
 			result.port = port
 
-			result.tls = '1'
-			result.tls_serverName = params.peer or params.sni or ""
-			result.tls_pinSHA256 = params.pcs
-			result.tls_CertByName = params.vcn
-			result.tls_allowInsecure = params.allowinsecure or params.allowInsecure or params.insecure
+			params.security = params.security or "tls"
+			if params.security == "tls" or params.security == "reality" then
+				result.tls = '1'
+				result.tls_serverName = params.peer or params.sni or ""
+				result.alpn = params.alpn
+				if params.fp and params.fp ~= "" then
+					result.utls = "1"
+					result.fingerprint = params.fp
+				end
+				if params.security == "reality" then
+					result.reality = "1"
+					result.reality_publicKey = params.pbk or nil
+					result.reality_shortId = params.sid or nil
+				end
+				result.tls_pinSHA256 = params.pcs
+				result.tls_CertByName = params.vcn
+				result.tls_allowInsecure = params.allowinsecure or params.allowInsecure or params.insecure
+			end
 
 			if not params.type then params.type = "tcp" end
 			params.type = string.lower(params.type)
@@ -1133,7 +1146,6 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 				result.httpupgrade_path = params.path
 			end
 
-			result.alpn = params.alpn
 			result.tcp_fast_open = params.tfo
 			result.use_finalmask = (params.fm and params.fm ~= "") and "1" or nil
 			result.finalmask = (params.fm and params.fm ~= "") and api.base64Encode(params.fm) or nil