update 2026-08-17 00:17:21

luci-app-mosdns/Makefile

@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-mosdns
-PKG_VERSION:=1.7.4
+PKG_VERSION:=1.7.5
 PKG_RELEASE:=1
 
 LUCI_TITLE:=LuCI Support for mosdns
 LUCI_PKGARCH:=all
-LUCI_DEPENDS:=+mosdns +curl +v2ray-geoip +v2ray-geosite +v2dat
+LUCI_DEPENDS:=+mosdns +curl +v2ray-geoip +v2ray-geosite +v2dat +ucode
 
 PKG_MAINTAINER:=sbwml <admin@cooluc.com>
 

luci-app-passwall/luasrc/controller/passwall.lua

@@ -122,6 +122,7 @@ function index()
 	entry({"admin", "services", appname, "geo_view"}, call("geo_view")).leaf = true
 
 	entry({"admin", "services", appname, "fetch_certsha256"}, call("fetch_certsha256")).leaf = true
+	entry({"admin", "services", appname, "gen_wireguard_key"}, call("gen_wireguard_key")).leaf = true
 end
 
 local function http_write_json(content)
@@ -245,7 +246,7 @@ function gen_client_config()
 end
 
 function get_now_use_node()
-	local path = "/tmp/etc/passwall/acl/default"
+	local path = api.TMP_PATH .. "/acl/default"
 	local e = {}
 	local tcp_node = api.get_cache_var("ACL_GLOBAL_TCP_node")
 	if tcp_node then
@@ -261,7 +262,7 @@ end
 function get_redir_log()
 	local name = http.formvalue("name")
 	local proto = http.formvalue("proto"):upper()
-	local path = "/tmp/etc/passwall/acl/" .. name
+	local path = api.TMP_PATH .. "/acl/" .. name
 
 	local function alert(msg)
 		http.write(string.format("<script>alert('%s');window.close();</script>", i18n.translate(msg)))
@@ -278,14 +279,14 @@ function get_redir_log()
 		local acl_udp = uci_get(name, "udp_node") or "nil"
 		local global_enabled = uci_get("@global[0]", "enabled") == "1"
 		if proto == "TCP" and acl_tcp == global_tcp and global_enabled then
-			path = "/tmp/etc/passwall/acl/default"
+			path = api.TMP_PATH .. "/acl/default"
 			if uci_get("@global[0]", "log_tcp") ~= "1" then
 				alert("The access control node is the same as the global node. Please enable global logging.")
 				return
 			end
 		end
 		if proto == "UDP" and acl_udp == global_udp and global_enabled then
-			path = "/tmp/etc/passwall/acl/default"
+			path = api.TMP_PATH .. "/acl/default"
 			if uci_get("@global[0]", "log_udp") ~= "1" then
 				alert("The access control node is the same as the global node. Please enable global logging.")
 				return
@@ -307,7 +308,7 @@ end
 
 function get_socks_log()
 	local name = http.formvalue("name")
-	local path = "/tmp/etc/passwall/" .. name .. ".log"
+	local path = api.TMP_PATH .. "/" .. name .. ".log"
 	if fs.access(path) then
 		local content = luci.sys.exec("cat ".. path)
 		content = content:gsub("\n", "<br />")
@@ -319,12 +320,12 @@ end
 
 function get_chinadns_log()
 	local flag = http.formvalue("flag")
-	local path = "/tmp/etc/passwall/acl/" .. flag .. "/chinadns_ng.log"
+	local path = api.TMP_PATH .. "/acl/" .. flag .. "/chinadns_ng.log"
 	if flag ~= "default" then
 		local global_tcp = uci_get("@global[0]", "tcp_node") or "nil"
 		local acl_tcp = uci_get(flag, "tcp_node") or "nil"
 		if acl_tcp == global_tcp and uci_get("@global[0]", "enabled") == "1" then
-			path = "/tmp/etc/passwall/acl/default/chinadns_ng.log"
+			path = api.TMP_PATH .. "/acl/default/chinadns_ng.log"
 			if uci_get("@global[0]", "log_chinadns_ng") ~= "1" then
 				http.write(string.format("<script>alert('%s');window.close();</script>", i18n.translate("The access control node is the same as the global node. Please enable global logging.")))
 				return
@@ -355,31 +356,31 @@ function index_status()
 	local dns_shunt = uci_get("@global[0]", "dns_shunt") or "dnsmasq"
 	if dns_shunt == "smartdns" then
 		local port = api.get_cache_var("SMARTDNS_LOCAL_PORT") or 0
-		e.dns_mode_status = (port ~= 0) and luci.sys.call(string.format("netstat -apn | grep ':%s ' >/dev/null", port)) == 0 or false
+		e.dns_mode_status = (port ~= 0) and luci.sys.call("netstat -apn | grep ':%s ' >/dev/null" % port) == 0 or false
 	elseif dns_shunt == "chinadns-ng" then
-		e.dns_mode_status = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '/tmp/etc/passwall/bin/' | grep 'default' | grep 'chinadns_ng' >/dev/null") == 0
+		e.dns_mode_status = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep 'default' | grep 'chinadns_ng' >/dev/null" % api.TMP_PATH) == 0
 	else
 		e.dns_mode_status = luci.sys.call("netstat -apn | grep ':15353 ' >/dev/null") == 0
 	end
 
 	e.haproxy_status = "-1"
 	if api.is_finded("haproxy") then
-		e.haproxy_status = (luci.sys.call(string.format("/bin/busybox top -bn1 | grep -v grep | grep '%s/bin/' | grep haproxy >/dev/null", appname)) == 0) and "0" or "1"
+		e.haproxy_status = (luci.sys.call("/bin/busybox top -bn1 | grep -v grep | grep '%s/bin/' | grep haproxy >/dev/null" % appname) == 0) and "0" or "1"
 	end
 
-	e["tcp_node_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '/tmp/etc/passwall/bin/' | grep 'default' | grep 'TCP' >/dev/null") == 0
+	e["tcp_node_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep 'default' | grep 'TCP' >/dev/null" % api.TMP_PATH) == 0
 
 	if (uci_get("@global[0]", "udp_node") or "nil") == "tcp" then
 		e["udp_node_status"] = e["tcp_node_status"]
 	else
-		e["udp_node_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '/tmp/etc/passwall/bin/' | grep 'default' | grep 'UDP' >/dev/null") == 0
+		e["udp_node_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep 'default' | grep 'UDP' >/dev/null" % api.TMP_PATH) == 0
 	end
 	http_write_json(e)
 end
 
 function haproxy_status()
 	local e = {}
-	e["status"] = luci.sys.call(string.format("/bin/busybox top -bn1 | grep -v grep | grep '%s/bin/' | grep haproxy >/dev/null", appname)) == 0
+	e["status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v grep | grep '%s/bin/' | grep haproxy >/dev/null" % appname) == 0
 	http_write_json(e)
 end
 
@@ -792,8 +793,9 @@ end
 
 function server_log()
 	local id = http.formvalue("id")
-	if fs.access("/tmp/etc/passwall_server/" .. id .. ".log") then
-		local content = luci.sys.exec("cat /tmp/etc/passwall_server/" .. id .. ".log")
+	local f_file = api.S_TMP_PATH .. "/" .. id .. ".log"
+	if nixio.fs.access(f_file) then
+		local content = luci.sys.exec("cat " .. f_file)
 		content = content:gsub("\n", "<br />")
 		http.write(content)
 	else
@@ -1191,3 +1193,12 @@ function delete_select_shunt_rules()
 		uci_save(true, true)
 	end
 end
+
+function gen_wireguard_key()
+	local key = api.gen_wireguard_key()
+	if key then
+		http_write_json_ok(key)
+	else
+		http_write_json_error()
+	end
+end

luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua

@@ -2,6 +2,7 @@ local api = require "luci.passwall.api"
 api.set_default_cbi()
 
 m = Map()
+m.redirect = api.url()
 
 if not arg[1] or not m:get(arg[1]) then
 	luci.http.redirect(m.redirect)

luci-app-passwall/luasrc/model/cbi/passwall/server/type/ray.lua

@@ -40,7 +40,8 @@ o:value("vmess", "Vmess")
 o:value("vless", "VLESS")
 o:value("shadowsocks", "Shadowsocks")
 o:value("trojan", "Trojan")
-o:value("hysteria2", translate("Hysteria2"))
+o:value("hysteria2", "Hysteria2")
+o:value("wireguard", "WireGuard")
 o:value("dokodemo-door", "dokodemo-door")
 o:depends({ [_n("custom")] = false })
 
@@ -60,6 +61,7 @@ o:depends({ [_n("protocol")] = "vmess" })
 o:depends({ [_n("protocol")] = "vless" })
 o:depends({ [_n("protocol")] = "trojan" })
 o:depends({ [_n("protocol")] = "hysteria2" })
+o:depends({ [_n("protocol")] = "wireguard" })
 
 o = s:option(ListValue, _n("d_protocol"), translate("Destination protocol"))
 o:value("tcp", "TCP")
@@ -363,7 +365,6 @@ o:depends({ [_n("custom")] = false, [_n("protocol")] = "vmess" })
 o:depends({ [_n("custom")] = false, [_n("protocol")] = "vless" })
 o:depends({ [_n("custom")] = false, [_n("protocol")] = "trojan" })
 o:depends({ [_n("custom")] = false, [_n("protocol")] = "shadowsocks" })
-o:depends({ [_n("custom")] = false, [_n("protocol")] = "wireguard" })
 o:depends({ [_n("custom")] = false, [_n("protocol")] = "hysteria2", [_n("hysteria2_realms")] = false })
 
 o = s:option(TextValue, _n("finalmask"), "FinalMask JSON")
@@ -417,6 +418,36 @@ o:depends({ [_n("fallback")] = true })
 o = s:option(DynamicList, _n("fallback_list"), "Fallback", translate("format: dest,path,xver"))
 o:depends({ [_n("fallback")] = true })
 
+-- Not supported at present
+--[[
+o = s:option(Flag, _n("wireguard_system_interface"), translate("System interface"))
+o.default = 0
+o:depends({ [_n("protocol")] = "wireguard" })
+]]--
+
+o = s:option(Value, _n("wireguard_mtu"), "MTU")
+o.default = "1420"
+o:depends({ [_n("protocol")] = "wireguard" })
+
+-- Not supported at present
+--[[
+o = s:option(DynamicList, _n("wireguard_local_address"), translate("Local Address"))
+o:depends({ [_n("protocol")] = "wireguard" })
+]]--
+
+o = s:option(Value, _n("wireguard_private_key"), translate("Private Key"))
+o.datatype = "base64"
+o:depends({ [_n("protocol")] = "wireguard" })
+
+o = s:option(Value, _n("wireguard_public_key"), translate("Public Key"))
+o.datatype = "base64"
+o:depends({ [_n("protocol")] = "wireguard" })
+
+o = s:option(DummyValue, _n("gen_wireguard_key"))
+o.prefix = option_prefix
+o.template = m:template_path("/server/server_wireguard")
+o:depends({ [_n("protocol")] = "wireguard" })
+
 o = s:option(Flag, _n("bind_local"), translate("Bind Local"), translate("When selected, it can only be accessed localhost."))
 o.default = "0"
 o:depends({ [_n("custom")] = false })

luci-app-passwall/luasrc/model/cbi/passwall/server/type/sing-box.lua

@@ -53,6 +53,9 @@ if singbox_tags:find("with_quic") then
 	o:value("hysteria2", "Hysteria2")
 end
 o:value("anytls", "AnyTLS")
+if singbox_tags:find("with_wireguard") then
+	o:value("wireguard", "WireGuard")
+end
 o:value("direct", "Direct")
 o:depends({ [_n("custom")] = false })
 
@@ -76,6 +79,7 @@ o:depends({ [_n("protocol")] = "hysteria" })
 o:depends({ [_n("protocol")] = "tuic" })
 o:depends({ [_n("protocol")] = "hysteria2" })
 o:depends({ [_n("protocol")] = "anytls" })
+o:depends({ [_n("protocol")] = "wireguard" })
 
 if singbox_tags:find("with_quic") then
 	o = s:option(Value, _n("hysteria_obfs"), translate("Obfs Password"))
@@ -400,6 +404,32 @@ o = s:option(Value, _n("tcpbrutal_down_mbps"), translate("Max download Mbps"))
 o.default = "50"
 o:depends({ [_n("tcpbrutal")] = true })
 
+if singbox_tags:find("with_wireguard") then
+	o = s:option(Flag, _n("wireguard_system_interface"), translate("System interface"))
+	o.default = 0
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_mtu"), "MTU")
+	o.default = "1408"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(DynamicList, _n("wireguard_local_address"), translate("Local Address"))
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_private_key"), translate("Private Key"))
+	o.datatype = "base64"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(Value, _n("wireguard_public_key"), translate("Public Key"))
+	o.datatype = "base64"
+	o:depends({ [_n("protocol")] = "wireguard" })
+
+	o = s:option(DummyValue, _n("gen_wireguard_key"))
+	o.prefix = option_prefix
+	o.template = m:template_path("/server/server_wireguard")
+	o:depends({ [_n("protocol")] = "wireguard" })
+end
+
 o = s:option(Flag, _n("bind_local"), translate("Bind Local"), translate("When selected, it can only be accessed localhost."))
 o.default = "0"
 o:depends({ [_n("custom")] = false })

luci-app-passwall/luasrc/model/cbi/passwall/server/user_config.lua

@@ -37,4 +37,18 @@ o.datatype = "uuid"
 o.default = api.gen_uuid()
 o.rmempty = false
 
+o = s:option(Value, "wireguard_public_key", "Wireguard " .. translate("Public Key"))
+o.datatype = "base64"
+
+o = s:option(Value, "wireguard_private_key", "Wireguard " .. translate("Private Key"))
+o.datatype = "base64"
+
+o = s:option(DummyValue, "gen_wireguard_key")
+o.template = m:template_path("/server/server_wireguard")
+
+o = s:option(Value, "wireguard_pre_shared_key", "Wireguard " .. translate("Pre shared key"))
+o.datatype = "base64"
+
+o = s:option(DynamicList, "allowed_ips", "Wireguard " .. translate("Allowed IPs"))
+
 return api.return_map(m)

luci-app-passwall/luasrc/passwall/api.lua

@@ -19,10 +19,11 @@ OPENWRT_ARCH = nil
 DISTRIB_ARCH = nil
 OPENWRT_BOARD = nil
 
-LOCK_PREFIX = "/tmp/lock/passwall"
-LOG_FILE = "/tmp/log/passwall.log"
-TMP_PATH = "/tmp/etc/passwall"
+LOCK_PREFIX = "/tmp/lock/" .. c_config
+LOG_FILE = "/tmp/log/" .. c_config .. ".log"
+TMP_PATH = "/tmp/etc/" .. c_config
 CACHE_PATH = TMP_PATH .. "_tmp"
+S_TMP_PATH = "/tmp/etc/" .. s_config
 TMP_IFACE_PATH = TMP_PATH .. "/iface"
 
 function log(...)
@@ -784,16 +785,16 @@ function clone(org)
 end
 
 function get_bin_version_cache(file, cmd)
-	sys.call("mkdir -p /tmp/etc/passwall_tmp")
+	sys.call("mkdir -p " .. CACHE_PATH)
 	if fs.access(file) then
 		chmod_755(file)
 		local md5 = sys.exec("echo -n $(md5sum " .. file .. " | awk '{print $1}')")
-		if fs.access("/tmp/etc/passwall_tmp/" .. md5) then
-			return sys.exec("echo -n $(cat /tmp/etc/passwall_tmp/%s)" % md5)
+		if fs.access(CACHE_PATH .. "/" .. md5) then
+			return sys.exec("echo -n $(cat %s)" % { CACHE_PATH .. "/" .. md5 })
 		else
 			local version = sys.exec(string.format("echo -n $(%s %s)", file, cmd))
 			if version and version ~= "" then
-				sys.call("echo '" .. version .. "' > " .. "/tmp/etc/passwall_tmp/" .. md5)
+				sys.call("echo '%s' > %s"  % { version, CACHE_PATH .. "/" .. md5})
 				return version
 			end
 		end
@@ -1410,29 +1411,24 @@ function set_default_cbi()
 	if true then
 		--Map
 		local Map = cbi.Map
-
-		if not Map._passwall_default_cbi then
-			Map._passwall_default_cbi = true
-			local original_parse = Map.parse
-			function Map.parse(self, ...)
-				if is_js_luci() then
-					apply_redirect(self)
-					local old = self.on_after_save
-					self.on_after_save = function(map)
-						if old then old(map) end
-						map:set("@global[0]", "timestamp", os.time())
-					end
-				end
-				return original_parse(self, ...)
-			end
-		end
-
-		local original_init = Map.__init__
+		local default_init = Map.__init__
 		function Map.__init__(self, config, ...)
 			if not config then config = c_config end
-			original_init(self, config, ...)
+			default_init(self, config, ...)
 			self.api = require "luci.passwall.api"
 		end
+		if is_js_luci() == true then
+			local default_parse = Map.parse
+			function Map.parse(self, ...)
+				apply_redirect(self)
+				local old = self.on_after_save
+				self.on_after_save = function(self)
+					if old then old(self) end
+					self:set("@global[0]", "timestamp", os.time())
+				end
+				return default_parse(self, ...)
+			end
+		end
 		function Map.foreach(self, stype, func)
 			self.uci:foreach(self.config, stype, func)
 		end
@@ -1470,9 +1466,9 @@ function set_default_cbi()
 	if true then
 		--TextValue
 		local TextValue = cbi.TextValue
-		local original_init = TextValue.__init__
+		local default_init = TextValue.__init__
 		function TextValue.__init__(self, ...)
-			original_init(self, ...)
+			default_init(self, ...)
 			self.template  = appname .. "/cbi/tvalue"
 		end
 	end
@@ -1599,7 +1595,9 @@ function luci_types(id, m, s, type_name, option_prefix)
 			local deps = s.fields[key].deps
 			if #deps > 0 then
 				for index, value in ipairs(deps) do
-					deps[index]["type"] = type_name
+					if not deps[index]['!reverse'] then
+						deps[index]["type"] = type_name
+					end
 				end
 			else
 				s.fields[key]:depends({ type = type_name })
@@ -2045,3 +2043,36 @@ function table_remove_duplicates(t)
 	end
 	return new_t
 end
+
+function gen_wireguard_key()
+	if sys.call("command -v wg >/dev/null") == 0 then
+		local private_key = sys.exec('echo -n $(wg genkey)')
+		local public_key = sys.exec('echo -n $(echo "%s" | wg pubkey)' % private_key)
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+	local xray = finded_com("xray")
+	if xray then
+		local result = sys.exec(xray .. " wg | awk -F ': ' '{print $2}'")
+		local s = split(result, "\n")
+		local private_key = s[1]
+		local public_key = s[2]
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+	local sb = finded_com("sing-box")
+	if sb then
+		local result = sys.exec(sb .. " generate wg-keypair | awk '{print $2}'")
+		local s = split(result, "\n")
+		local private_key = s[1]
+		local public_key = s[2]
+		return {
+			private_key = private_key,
+			public_key = public_key
+		}
+	end
+end

luci-app-passwall/luasrc/passwall/server_app.lua

@@ -7,7 +7,7 @@ local uci = api.uci
 local jsonc = api.jsonc
 
 local CONFIG = api.s_config
-local CONFIG_PATH = "/tmp/etc/" .. CONFIG
+local CONFIG_PATH = api.S_TMP_PATH
 local NFT_INCLUDE_FILE = CONFIG_PATH .. "/" .. CONFIG .. ".nft"
 local LOG_APP_FILE = "/tmp/log/" .. CONFIG .. ".log"
 local TMP_BIN_PATH = CONFIG_PATH .. "/bin"
@@ -53,7 +53,7 @@ local function ln_run(s, d, command, output)
 end
 
 local function gen_include()
-	cmd(string.format("echo '#!/bin/sh' > /tmp/etc/%s.include", CONFIG))
+	cmd(string.format("echo '#!/bin/sh' > %s.include", CONFIG_PATH))
 	local function extract_rules(n, a)
 		local _ipt = ipt_bin
 		if n == "6" then
@@ -64,7 +64,7 @@ local function gen_include()
 		result = result .. "COMMIT"
 		return result
 	end
-	local f, err = io.open("/tmp/etc/" .. CONFIG .. ".include", "a")
+	local f, err = io.open(CONFIG_PATH .. ".include", "a")
 	if f and err == nil then
 		if nft_flag == "0" then
 			f:write(ipt_bin .. '-save -c | grep -v "PSW-SERVER" | ' .. ipt_bin .. '-restore -c' .. "\n")
@@ -248,7 +248,7 @@ local function stop()
 		cmd("nft flush chain inet fw4 PSW-SERVER 2>/dev/null")
 		cmd("nft delete chain inet fw4 PSW-SERVER 2>/dev/null")
 	end
-	cmd(string.format("rm -rf %s %s /tmp/etc/%s.include", CONFIG_PATH, LOG_APP_FILE, CONFIG))
+	cmd(string.format("rm -rf %s %s %s", CONFIG_PATH, LOG_APP_FILE, CONFIG_PATH .. ".include"))
 end
 
 if action then

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -661,6 +661,8 @@ function gen_outbound(flag, node, tag, proxy_table)
 end
 
 function gen_config_server(node)
+	local endpoints = {}
+	local inbounds = {}
 	local outbounds = {
 		{ type = "direct", tag = "direct" }
 	}
@@ -803,6 +805,12 @@ function gen_config_server(node)
 					u.name = user.username
 					u.password = user.password
 				end
+				if node.protocol == "wireguard" then
+					u.public_key = user.wireguard_public_key
+					u.pre_shared_key = user.wireguard_pre_shared_key
+					u.allowed_ips = user.allowed_ips or {}
+					u.persistent_keepalive_interval = 0
+				end
 				users[#users + 1] = u
 			end
 		end
@@ -970,6 +978,18 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "wireguard" then
+		inbound.listen = nil
+		inbound.system = node.wireguard_system_interface == "1" and true or false
+		inbound.name = "sbwg_" .. node[".name"]
+		inbound.mtu = tonumber(node.wireguard_mtu or 1408)
+		inbound.address = node.wireguard_local_address
+		inbound.private_key = node.wireguard_private_key
+		if users then
+			inbound.peers = users
+		end
+	end
+
 	if node.protocol == "direct" then
 		protocol_table = {
 			network = (node.d_protocol ~= "TCP,UDP") and node.d_protocol or nil,
@@ -984,6 +1004,13 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "wireguard" then
+		inbound.listen = nil
+		table.insert(endpoints, inbound)
+	else
+		table.insert(inbounds, inbound)
+	end
+
 	local route = {
 		rules = {
 			{
@@ -1038,7 +1065,8 @@ function gen_config_server(node)
 				tag = "direct"
 			}}
 		},
-		inbounds = { inbound },
+		endpoints = endpoints,
+		inbounds = inbounds,
 		outbounds = outbounds,
 		route = route
 	}

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -515,6 +515,12 @@ function gen_config_server(node)
 					u.email = user.username
 					u.auth = user.password
 				end
+				if node.protocol == "wireguard" then
+					u.publicKey = user.wireguard_public_key
+					u.preSharedKey = user.wireguard_pre_shared_key
+					u.keepAlive = 0
+					u.allowedIPs = user.allowed_ips
+				end
 				users[#users + 1] = u
 			end
 		end
@@ -567,6 +573,14 @@ function gen_config_server(node)
 			address = node.d_address,
 			port = tonumber(node.d_port)
 		}
+	elseif node.protocol == "wireguard" then
+		settings = {
+			secretKey = node.wireguard_private_key,
+			--address = node.wireguard_local_address,
+			--noKernelTun = node.wireguard_system_interface ~= "1" and true or false,
+			mtu = tonumber(node.wireguard_mtu or 1420),
+			peers = users
+		}
 	end
 
 	if node.fallback and node.fallback == "1" then

luci-app-passwall/luasrc/view/passwall/server/server_wireguard.htm

@@ -0,0 +1,28 @@
+<%
+local map = self.map
+local api = map.api
+local prefix = self.prefix
+-%>
+<div class="cbi-value" id="cbi-<%=self.config.."-"..section.."-"..self.option%>" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>">
+	<label class="cbi-value-title"><%:Generate key%></label>
+	<div class="cbi-value-field">
+		<input class="btn cbi-button" type="button" onclick="gen_wireguard_key(this)" value="<%:Generate key%>" />
+	</div>
+</div>
+
+<script>
+	function gen_wireguard_key() {
+		XHR.get('<%=api.url("gen_wireguard_key")%>', {},
+		function(x, data) {
+			if (x && x.status == 200 && data.code == 1) {
+				const private_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_private_key");
+				private_key_dom.value = data.data.private_key;
+				
+				const public_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_public_key");
+				public_key_dom.value = data.data.public_key;
+			} else {
+				alert("<%:Error%>");
+			}
+		});
+	}
+</script>

luci-app-passwall/po/zh-cn/passwall.po

@@ -1448,9 +1448,18 @@ msgstr "私钥"
 msgid "Pre shared key"
 msgstr "额外的对称加密密钥"
 
+msgid "Allowed IPs"
+msgstr "允许的 IP"
+
+msgid "Generate key"
+msgstr "生成密钥"
+
 msgid "Local Address"
 msgstr "本地地址"
 
+msgid "System interface"
+msgstr "系统接口"
+
 msgid "Decimal numbers separated by \",\" or Base64-encoded strings."
 msgstr "用“,”隔开的十进制数字或 Base64 编码字符串。"
 

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -1860,7 +1860,7 @@ acl_app() {
 }
 
 start() {
-	busybox pgrep -f /tmp/etc/passwall/bin > /dev/null 2>&1 && {
+	busybox pgrep -f ${TMP_PATH}/bin > /dev/null 2>&1 && {
 		logger -t PSW-RESTART "Upgrade or overload residue is detected, and the subprocess is being called to perform complete cleaning..."
 		(stop)
 		sleep 2

luci-app-passwall/root/usr/share/passwall/socks_auto_switch.sh

@@ -71,10 +71,10 @@ test_node() {
 		local curlx="socks5h://127.0.0.1:${_tmp_port}"
 		local _proxy_status=$(test_url "${probe_url}" ${retry_num} ${connect_timeout} "-x $curlx" 1)
 		# 结束 SS 插件进程
-		local pid_file="/tmp/etc/${CONFIG}/test_node_${node_id}_plugin.pid"
+		local pid_file="${TMP_PATH}/test_node_${node_id}_plugin.pid"
 		[ -s "$pid_file" ] && kill -9 "$(head -n 1 "$pid_file")" >/dev/null 2>&1
 		busybox pgrep -af "test_node_${node_id}" | awk '! /socks_auto_switch\.sh/{print $1}' | xargs kill -9 >/dev/null 2>&1
-		rm -rf /tmp/etc/${CONFIG}/test_node_${node_id}*.*
+		rm -rf ${TMP_PATH}/test_node_${node_id}*.*
 		if [ "${_proxy_status}" -eq 200 ]; then
 			return 0
 		fi

luci-app-passwall/root/usr/share/passwall/test.sh

@@ -64,10 +64,10 @@ url_test_node() {
 		local probeUrl=$(config_t_get global_other url_test_url https://www.google.com/generate_204)
 		result=$(curl --connect-timeout 3 --max-time 5 -o /dev/null -I -skL -w "%{http_code}:%{time_pretransfer}" -x ${curlx} "${probeUrl}")
 		# 结束 SS 插件进程
-		local pid_file="/tmp/etc/${CONFIG}/url_test_${node_id}_plugin.pid"
+		local pid_file="${TMP_PATH}/url_test_${node_id}_plugin.pid"
 		[ -s "$pid_file" ] && kill -9 "$(head -n 1 "$pid_file")" >/dev/null 2>&1
 		busybox pgrep -af "url_test_${node_id}" | awk '! /test\.sh/{print $1}' | xargs kill -9 >/dev/null 2>&1
-		rm -rf /tmp/etc/${CONFIG}/*url_test_${node_id}*.*
+		rm -rf ${TMP_PATH}/*url_test_${node_id}*.*
 	}
 	echo $result
 }

luci-app-passwall2/luasrc/model/cbi/passwall2/server/user_config.lua

@@ -44,7 +44,7 @@ o = s:option(Value, "wireguard_private_key", "Wireguard " .. translate("Private
 o.datatype = "base64"
 
 o = s:option(DummyValue, "gen_wireguard_key")
-o.template = m:template_path("/server/server_wireguard")
+o.template = m:template_path("/server/gen_wireguard_key")
 
 o = s:option(Value, "wireguard_pre_shared_key", "Wireguard " .. translate("Pre shared key"))
 o.datatype = "base64"

v2ray-geodata/Makefile

@@ -21,13 +21,13 @@ define Download/geoip
   HASH:=c67bd077eb102cec74fab759b73d17f99275f56af10a87c14d9fd983508f5ce1
 endef
 
-GEOSITE_VER:=20260815024016
+GEOSITE_VER:=20260816111744
 GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
 define Download/geosite
   URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
   URL_FILE:=dlc.dat
   FILE:=$(GEOSITE_FILE)
-  HASH:=b26e0105f9123eadcdef5185bcdd3f7231dea566157032d0bde0f5e564804b61
+  HASH:=52b17e9039e0e2ad0091686eb5d10e160c84fcf24632efba9017c7cce8a20f7b
 endef
 
 GEOSITE_IRAN_VER:=202608100039