update 2026-08-15 04:24:58

luci-app-passwall2/luasrc/controller/passwall2.lua

@@ -119,6 +119,7 @@ function index()
 	entry({"admin", "services", appname, "geo_view"}, call("geo_view")).leaf = true
 
 	entry({"admin", "services", appname, "fetch_certsha256"}, call("fetch_certsha256")).leaf = true
+	entry({"admin", "services", appname, "gen_wireguard_key"}, call("gen_wireguard_key")).leaf = true
 end
 
 local function http_write_json(content)
@@ -1029,3 +1030,12 @@ function delete_select_shunt_rules()
 		uci_save(true, true)
 	end
 end
+
+function gen_wireguard_key()
+	local key = api.gen_wireguard_key()
+	if key then
+		http_write_json_ok(key)
+	else
+		http_write_json_error()
+	end
+end

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/sing-box.lua

@@ -53,6 +53,9 @@ if singbox_tags:find("with_quic") then
 	o:value("hysteria2", "Hysteria2")
 end
 o:value("anytls", "AnyTLS")
+if singbox_tags:find("with_wireguard") then
+	o:value("wireguard", "WireGuard")
+end
 o:value("direct", "Direct")
 o:depends({ [_n("custom")] = false })
 
@@ -76,6 +79,7 @@ o:depends({ [_n("protocol")] = "hysteria" })
 o:depends({ [_n("protocol")] = "tuic" })
 o:depends({ [_n("protocol")] = "hysteria2" })
 o:depends({ [_n("protocol")] = "anytls" })
+o:depends({ [_n("protocol")] = "wireguard" })
 
 if singbox_tags:find("with_quic") then
 	o = s:option(Value, _n("hysteria_obfs"), translate("Obfs Password"))
@@ -400,6 +404,32 @@ o = s:option(Value, _n("tcpbrutal_down_mbps"), translate("Max download Mbps"))
 o.default = "50"
 o:depends({ [_n("tcpbrutal")] = true })
 
+if singbox_tags:find("with_wireguard") then
+	o = s:option(Flag, _n("wireguard_system_interface"), translate("System interface"))
+	o.default = 0
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_mtu"), "MTU")
+	o.default = "1408"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(DynamicList, _n("wireguard_local_address"), translate("Local Address"))
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_private_key"), translate("Private Key"))
+	o.datatype = "base64"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_public_key"), translate("Public Key"))
+	o.datatype = "base64"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(DummyValue, _n("gen_wireguard_key"))
+	o.prefix = option_prefix
+	o.template = m:template_path("/server/server_wireguard")
+	o:depends({ [_n("protocol")] = "wireguard" })
+end
+
 o = s:option(Flag, _n("bind_local"), translate("Bind Local"), translate("When selected, it can only be accessed localhost."))
 o.default = "0"
 o:depends({ [_n("custom")] = false })

luci-app-passwall2/luasrc/model/cbi/passwall2/server/user_config.lua

@@ -37,4 +37,18 @@ o.datatype = "uuid"
 o.default = api.gen_uuid()
 o.rmempty = false
 
+o = s:option(Value, "wireguard_public_key", "Wireguard " .. translate("Public Key"))
+o.datatype = "base64"
+
+o = s:option(Value, "wireguard_private_key", "Wireguard " .. translate("Private Key"))
+o.datatype = "base64"
+
+o = s:option(DummyValue, "gen_wireguard_key")
+o.template = m:template_path("/server/server_wireguard")
+
+o = s:option(Value, "wireguard_pre_shared_key", "Wireguard " .. translate("Pre shared key"))
+o.datatype = "base64"
+
+o = s:option(DynamicList, "allowed_ips", "Wireguard " .. translate("Allowed IPs"))
+
 return api.return_map(m)

luci-app-passwall2/luasrc/passwall2/api.lua

@@ -2018,3 +2018,36 @@ function table_remove_duplicates(t)
 	end
 	return new_t
 end
+
+function gen_wireguard_key()
+	if sys.call("command -v wg >/dev/null") == 0 then
+		local private_key = sys.exec('echo -n $(wg genkey)')
+		local public_key = sys.exec('echo -n $(echo "%s" | wg pubkey)' % private_key)
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+	local xray = finded_com("xray")
+	if xray then
+		local result = sys.exec(xray .. " wg | awk -F ': ' '{print $2}'")
+		local s = split(result, "\n")
+		local private_key = s[1]
+		local public_key = s[2]
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+	local sb = finded_com("sing-box")
+	if sb then
+		local result = sys.exec(sb .. " generate wg-keypair | awk '{print $2}'")
+		local s = split(result, "\n")
+		local private_key = s[1]
+		local public_key = s[2]
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+end

luci-app-passwall2/luasrc/passwall2/util_sing-box.lua

@@ -683,6 +683,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 end
 
 function gen_config_server(node)
+	local endpoints = {}
+	local inbounds = {}
 	local outbounds = {
 		{ type = "direct", tag = "direct" }
 	}
@@ -825,6 +827,12 @@ function gen_config_server(node)
 					u.name = user.username
 					u.password = user.password
 				end
+				if node.protocol == "wireguard" then
+					u.public_key = user.wireguard_public_key
+					u.pre_shared_key = user.wireguard_pre_shared_key
+					u.allowed_ips = user.allowed_ips or {}
+					u.persistent_keepalive_interval = 0
+				end
 				users[#users + 1] = u
 			end
 		end
@@ -992,6 +1000,18 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "wireguard" then
+		inbound.listen = nil
+		inbound.system = node.wireguard_system_interface == "1" and true or false
+		inbound.name = "sbwg_" .. node[".name"]
+		inbound.mtu = tonumber(node.wireguard_mtu or 1408)
+		inbound.address = node.wireguard_local_address
+		inbound.private_key = node.wireguard_private_key
+		if users then
+			inbound.peers = users
+		end
+	end
+
 	if node.protocol == "direct" then
 		protocol_table = {
 			network = (node.d_protocol ~= "TCP,UDP") and node.d_protocol or nil,
@@ -1006,6 +1026,13 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "wireguard" then
+		inbound.listen = nil
+		table.insert(endpoints, inbound)
+	else
+		table.insert(inbounds, inbound)
+	end
+
 	local route = {
 		rules = {
 			{
@@ -1061,7 +1088,8 @@ function gen_config_server(node)
 				}
 			}
 		},
-		inbounds = { inbound },
+		endpoints = endpoints,
+		inbounds = inbounds,
 		outbounds = outbounds,
 		route = route
 	}

luci-app-passwall2/luasrc/view/passwall2/server/server_wireguard.htm

@@ -0,0 +1,28 @@
+<%
+local map = self.map
+local api = map.api
+local prefix = self.prefix
+-%>
+<div class="cbi-value" id="cbi-<%=self.config.."-"..section.."-"..self.option%>" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>">
+	<label class="cbi-value-title"><%:Generate key%></label>
+	<div class="cbi-value-field">
+		<input class="btn cbi-button" type="button" onclick="gen_wireguard_key(this)" value="<%:Generate key%>" />
+	</div>
+</div>
+
+<script>
+	function gen_wireguard_key() {
+		XHR.get('<%=api.url("gen_wireguard_key")%>', {},
+		function(x, data) {
+			if (x && x.status == 200 && data.code == 1) {
+				const private_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_private_key");
+				private_key_dom.value = data.data.private_key;
+				
+				const public_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_public_key");
+				public_key_dom.value = data.data.public_key;
+			} else {
+				alert("<%:Error%>");
+			}
+		});
+	}
+</script>

luci-app-passwall2/po/fa/passwall2.po

@@ -1306,6 +1306,12 @@ msgstr "کلید خصوصی"
 msgid "Pre shared key"
 msgstr "کلید از پیش به اشتراک گذاشته شده"
 
+msgid "Allowed IPs"
+msgstr "آی‌پی‌های مجاز"
+
+msgid "Generate key"
+msgstr "کلید تولید کنید"
+
 msgid "Local Address"
 msgstr "آدرس محلی"
 

luci-app-passwall2/po/ru/passwall2.po

@@ -1307,6 +1307,12 @@ msgstr "Приватный ключ"
 msgid "Pre shared key"
 msgstr "Дополнительный симметричный ключ"
 
+msgid "Allowed IPs"
+msgstr "Разрешенные IP-адреса"
+
+msgid "Generate key"
+msgstr "Сгенерировать ключ"
+
 msgid "Local Address"
 msgstr "Локальный адрес"
 

luci-app-passwall2/po/zh-cn/passwall2.po

@@ -1298,6 +1298,12 @@ msgstr "私钥"
 msgid "Pre shared key"
 msgstr "额外的对称加密密钥"
 
+msgid "Allowed IPs"
+msgstr "允许的 IP"
+
+msgid "Generate key"
+msgstr "生成密钥"
+
 msgid "Local Address"
 msgstr "本地地址"
 

luci-app-passwall2/po/zh-tw/passwall2.po

@@ -1298,6 +1298,12 @@ msgstr "私鑰"
 msgid "Pre shared key"
 msgstr "额外的對称加密密鑰"
 
+msgid "Allowed IPs"
+msgstr "允許的 IP"
+
+msgid "Generate key"
+msgstr "生成密鑰"
+
 msgid "Local Address"
 msgstr "本地地址"
 

luci-app-passwall2/root/usr/share/passwall2/socks_auto_switch.sh

@@ -18,15 +18,35 @@ test_url() {
 	local timeout=2
 	[ -n "$3" ] && timeout=$3
 	local extra_params=$4
-	if /usr/bin/curl --help all | grep -q "\-\-retry-all-errors"; then
-		extra_params="--retry-all-errors ${extra_params}"
+	local repeat=$5
+
+	if [ -z "$curl_retry_all_errors" ]; then
+		if /usr/bin/curl --help all | grep -q "\-\-retry-all-errors"; then
+			curl_retry_all_errors=1
+		fi
 	fi
-	local status=$(/usr/bin/curl -I -o /dev/null -skL ${extra_params} --connect-timeout ${timeout} --retry ${try} -w %{http_code} "$url")
+	[ "$curl_retry_all_errors" = "1" ] && extra_params="--retry-all-errors ${extra_params}"
+
+	local max_time=$((timeout * (try + 1) + try + 3))
+	curl_test() {
+		/usr/bin/curl -I -o /dev/null -skL ${extra_params} --max-time ${max_time} --connect-timeout ${timeout} --retry ${try} --retry-delay 1 -w "%{http_code}" "$url"
+	}
+
+	local status=$(curl_test)
 	case "$status" in
 		204)
 			status=200
 		;;
 	esac
+	if [ "$status" = "200" ] && [ "$repeat" = "1" ]; then
+		sleep 3s
+		status=$(curl_test)
+		case "$status" in
+			204)
+				status=200
+			;;
+		esac
+	fi
 	echo $status
 }
 
@@ -59,7 +79,7 @@ test_node() {
 		NO_REC_PROCESS=1 $APP_FILE run_socks flag="test_node_${node_id}" node=${node_id} bind=127.0.0.1 socks_port=${_tmp_port} config_file=test_node_${node_id}.json
 		sleep 2s
 		local curlx="socks5h://127.0.0.1:${_tmp_port}"
-		local _proxy_status=$(test_url "${probe_url}" ${retry_num} ${connect_timeout} "-x $curlx")
+		local _proxy_status=$(test_url "${probe_url}" ${retry_num} ${connect_timeout} "-x $curlx" 1)
 		# Kill the SS plugin process
 		local pid_file="/tmp/etc/${CONFIG}/test_node_${node_id}_plugin.pid"
 		[ -s "$pid_file" ] && kill -9 "$(head -n 1 "$pid_file")" >/dev/null 2>&1