update 2026-09-03 03:09:55

dae/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dae
-PKG_VERSION:=2026.08.31
+PKG_VERSION:=2026.09.02
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=93a9957e08c14a40e742581e6342450122916294
+PKG_SOURCE_VERSION:=ebbec6b5624d7790c58a11e081604e30b6c947b3
 PKG_SOURCE_URL:=https://github.com/olicesx/dae.git
 PKG_MIRROR_HASH:=skip
 

luci-app-passwall/luasrc/controller/passwall.lua

@@ -346,12 +346,8 @@ function index_status()
 			has_tproxy = (mods:find("TPROXY") or mods:find("nft_tproxy")) and "1" or "0"
 			api.set_cache_var("HAS_TPROXY", has_tproxy)
 		end
-		local tcp_redir = api.get_cache_var("DEFAULT_TCP_REDIR")
-		local udp_redir = api.get_cache_var("DEFAULT_UDP_REDIR")
-		if tcp_redir == "1" then
-			e["tcp_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep 'default' | grep 'global' >/dev/null" % api.TMP_PATH) == 0
-		end
-		if has_tproxy == "1" and udp_redir == "1" then
+		e["tcp_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/bin/' | grep 'default' | grep 'global' >/dev/null" % api.TMP_PATH) == 0
+		if has_tproxy == "1" then
 			e["udp_status"] = luci.sys.call("/bin/busybox top -bn1 | grep -v -E 'grep|naive' | grep '%s/bin/' | grep 'default' | grep 'global' >/dev/null" % api.TMP_PATH) == 0
 		end
 	end

luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua

@@ -160,7 +160,7 @@ o = s:option(Value, "autoswitch_retry_num", translate("Timeout retry num"))
 o.datatype = "range(1,5)"
 o.default = 1
 o:depends("enable_autoswitch", true)
-	
+
 o = s:option(Flag, "autoswitch_restore_switch", translate("Restore Switch"), translate("Immediately switch back to the main node when it becomes available."))
 o:depends("enable_autoswitch", true)
 

luci-app-passwall/luasrc/model/cbi/passwall/client/type/1_sing-box.lua

@@ -40,6 +40,7 @@ local security_list = { "none", "auto", "aes-128-gcm", "chacha20-poly1305", "zer
 local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | awk '{print $2}'")
 
 local singbox_version = api.get_app_version("sing-box"):match("[^v]+")
+local version_ge_1_14_0 = api.compare_versions(singbox_version, ">=", "1.14.0")
 
 o = s:option(ListValue, "protocol", translate("Protocol"))
 o:value("socks", "Socks")
@@ -65,6 +66,9 @@ o:value("ssh", "SSH")
 if singbox_tags:find("with_naive_outbound") then
 	o:value("naive", "NaïveProxy")
 end
+if version_ge_1_14_0 then
+	o:value("snell", "Snell")
+end
 o:value("_urltest", translate("URLTest"))
 o:value("_shunt", translate("Shunt"))
 o:value("_iface", translate("Custom Interface"))
@@ -232,6 +236,43 @@ o:depends({ protocol = "anytls" })
 o:depends({ protocol = "ssh" })
 o:depends({ protocol = "naive" })
 
+if version_ge_1_14_0 then
+	-- snell
+	s.fields["password"]:depends({ protocol = "snell" })
+
+	o = s:option(Value, "snell_psk", translate("Pre shared key"))
+	o.rmempty = false
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_version", translate("Version"))
+	o:value("4")
+	o:value("6")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(Flag, "snell_reuse", translate("Connection Reuse"))
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_network", translate("Transport"))
+	o:value("", "TCP UDP")
+	o:value("tcp", "TCP")
+	o:value("udp", "UDP")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_obfs_mode", translate("Camouflage Type"))
+	o:value("none")
+	o:value("http")
+	o:depends({ protocol = "snell", snell_version = "4" })
+
+	o = s:option(Value, "snell_obfs_host", translate("HTTP Host"))
+	o:depends({ protocol = "snell", snell_version = "4", snell_obfs_mode = "http" })
+
+	o = s:option(ListValue, "snell_mode", translate("Mode"))
+	o:value("default")
+	o:value("unshaped")
+	o:value("unsafe-raw")
+	o:depends({ protocol = "snell", snell_version = "6" })
+end
+
 o = s:option(ListValue, "security", translate("Encrypt Method"))
 for a, t in ipairs(security_list) do o:value(t) end
 o:depends({ protocol = "vmess" })
@@ -364,7 +405,7 @@ if singbox_tags:find("with_quic") then
 
 	o = s:option(Flag, "hysteria2_realms", translate("Realms"))
 	o.default = "0"
-	if api.compare_versions(singbox_version, ">=", "1.14.0") then
+	if version_ge_1_14_0 then
 		o:depends({ protocol = "hysteria2"})
 	else
 		o:depends({ protocol = "__hide"})
@@ -587,10 +628,10 @@ if singbox_tags:find("with_utls") then
 	o:depends({ protocol = "shadowsocks", tls = true })
 	o:depends({ protocol = "trojan", tls = true })
 	o:depends({ protocol = "anytls", tls = true })
-	
+
 	o = s:option(Value, "reality_publicKey", translate("Public Key"))
 	o:depends({ reality = true })
-	
+
 	o = s:option(Value, "reality_shortId", translate("Short Id"))
 	o:depends({ reality = true })
 end

luci-app-passwall/luasrc/model/cbi/passwall/server/index.lua

@@ -2,6 +2,7 @@ local api = require "luci.passwall.api"
 api.set_default_cbi()
 
 m = Map(api.s_config)
+m.redirect = api.url("server")
 
 t = m:section(NamedSection, "global", "global", translate("Server-Side"))
 t.anonymous = true

luci-app-passwall/luasrc/model/cbi/passwall/server/type/1_sing-box.lua

@@ -27,6 +27,9 @@ s.option_prefix = "singbox_"
 
 local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | awk '{print $2}'")
 
+local local_version = api.get_app_version("sing-box"):match("[^v]+")
+local version_ge_1_14_0 = api.compare_versions(local_version, ">=", "1.14.0")
+
 local ss_method_list = {
 	"none", "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305",
 	"2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
@@ -56,6 +59,7 @@ o.custom_write = function(self, section, value)
 end
 
 o = s:option(ListValue, "protocol", translate("Protocol"))
+o:value("direct", "Direct")
 o:value("mixed", "Mixed")
 o:value("socks", "Socks")
 o:value("http", "HTTP")
@@ -63,29 +67,12 @@ o:value("shadowsocks", "Shadowsocks")
 o:value("vmess", "Vmess")
 o:value("vless", "VLESS")
 o:value("trojan", "Trojan")
-o:value("naive", "Naive")
-if singbox_tags:find("with_quic") then
-	o:value("hysteria", "Hysteria")
-end
-if singbox_tags:find("with_quic") then
-	o:value("tuic", "TUIC")
-end
-if singbox_tags:find("with_quic") then
-	o:value("hysteria2", "Hysteria2")
+if singbox_tags:find("with_naive_outbound") then
+	o:value("naive", "Naive")
 end
 o:value("anytls", "AnyTLS")
-if singbox_tags:find("with_wireguard") then
-	o:value("wireguard", "WireGuard")
-end
-o:value("direct", "Direct")
 o:depends({ custom = false })
 
-o = s:option(DummyValue, "is_endpoint", "")
-o.not_rewrite = true
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
-o:depends({ custom = false, protocol = "wireguard" })
-
 o = s:option(Value, "port", translate("Listen Port"))
 o.datatype = "port"
 o:depends({ custom = false })
@@ -102,13 +89,13 @@ o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "naive" })
-o:depends({ protocol = "hysteria" })
-o:depends({ protocol = "tuic" })
-o:depends({ protocol = "hysteria2" })
 o:depends({ protocol = "anytls" })
-o:depends({ protocol = "wireguard" })
 
 if singbox_tags:find("with_quic") then
+	-- hysteria
+	s.fields["protocol"]:value("hysteria", "Hysteria")
+	s.fields["users"]:depends({ protocol = "hysteria" })
+
 	o = s:option(Value, "hysteria_obfs", translate("Obfs Password"))
 	o:depends({ protocol = "hysteria" })
 
@@ -135,6 +122,10 @@ if singbox_tags:find("with_quic") then
 end
 
 if singbox_tags:find("with_quic") then
+	-- tuic
+	s.fields["protocol"]:value("tuic", "TUIC")
+	s.fields["users"]:depends({ protocol = "tuic" })
+
 	o = s:option(ListValue, "tuic_congestion_control", translate("Congestion control algorithm"))
 	o.default = "cubic"
 	o:value("bbr", translate("BBR"))
@@ -166,6 +157,10 @@ if singbox_tags:find("with_quic") then
 end
 
 if singbox_tags:find("with_quic") then
+	-- hysteria2
+	s.fields["protocol"]:value("hysteria2", "Hysteria2")
+	s.fields["users"]:depends({ protocol = "hysteria2" })
+
 	o = s:option(Flag, "hysteria2_realms", translate("Realms"))
 	o.default = "0"
 	o:depends({ protocol = "hysteria2"})
@@ -436,6 +431,10 @@ o.default = "50"
 o:depends({ tcpbrutal = true })
 
 if singbox_tags:find("with_wireguard") then
+	-- wireguard
+	s.fields["protocol"]:value("wireguard", "WireGuard")
+	s.fields["users"]:depends({ protocol = "wireguard" })
+
 	o = s:option(Flag, "wireguard_system_interface", translate("System interface"))
 	o.default = 0
 	o:depends({ protocol = "wireguard" })
@@ -460,6 +459,32 @@ if singbox_tags:find("with_wireguard") then
 	o:depends({ protocol = "wireguard" })
 end
 
+if version_ge_1_14_0 then
+	-- snell
+	s.fields["protocol"]:value("snell", "Snell")
+	s.fields["users"]:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_version", translate("Version"))
+	o:value("5")
+	o:value("6")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(Value, "snell_psk", translate("Pre shared key"))
+	o.rmempty = false
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_obfs_mode", translate("Obfs"))
+	o:value("none")
+	o:value("http")
+	o:depends({ protocol = "snell", snell_version = "5" })
+
+	o = s:option(ListValue, "snell_mode", translate("Mode"))
+	o:value("default")
+	o:value("unshaped")
+	o:value("unsafe-raw")
+	o:depends({ protocol = "snell", snell_version = "6" })
+end
+
 o = s:option(Flag, "firewall_allow", translate("Firewall Allow"))
 o.default = "0"
 o:depends({ custom = false })

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -597,6 +597,7 @@ function gen_outbound(flag, node, tag, proxy_table)
 						realm.address = nil
 						realm.port = nil
 						realm.port_mapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
+						realm.http_client = "direct_http_client"
 						return realm
 					end
 					return nil
@@ -645,6 +646,19 @@ function gen_outbound(flag, node, tag, proxy_table)
 			}
 		end
 
+		if node.protocol == "snell" then
+			protocol_table = {
+				version = tonumber(node.snell_version),
+				psk = node.snell_psk,
+				userkey = node.password,
+				reuse = node.snell_reuse == "1" and true or false,
+				network = node.snell_network,
+				obfs_mode = node.snell_version == "4" and node.snell_obfs_mode or nil,
+				obfs_host = node.snell_version == "4" and node.snell_obfs_host or nil,
+				mode = node.snell_version == "6" and node.snell_mode or nil,
+			}
+		end
+
 		if protocol_table then
 			for key, value in pairs(protocol_table) do
 				result[key] = value
@@ -801,6 +815,10 @@ function gen_config_server(node)
 					u.allowed_ips = user.allowed_ips or {}
 					u.persistent_keepalive_interval = 0
 				end
+				if node.protocol == "snell" then
+					u.name = user.username
+					u.userkey = user.password
+				end
 				users[#users + 1] = u
 			end
 		end
@@ -953,6 +971,7 @@ function gen_config_server(node)
 					realm.port = nil
 					realm.stun_domain_resolver = "direct"
 					realm.port_mapping = (node.hysteria2_realm_upnp == "1") and { enabled = true } or nil
+					realm.http_client = { detour = "direct" }
 					return realm
 				end
 				return nil
@@ -981,6 +1000,16 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "snell" then
+		protocol_table = {
+			users = users,
+			version = tonumber(node.snell_version),
+			psk = node.snell_psk,
+			obfs_mode = node.snell_version == "5" and node.snell_obfs_mode or nil,
+			mode = node.snell_version == "6" and node.snell_mode or nil,
+		}
+	end
+
 	if node.protocol == "direct" then
 		protocol_table = {
 			network = (node.d_protocol ~= "TCP,UDP") and node.d_protocol or nil,
@@ -1167,8 +1196,8 @@ function gen_config(var)
 							format = format,
 							path = _type == "local" and w or nil,
 							url = _type == "remote" and w or nil,
-							--download_detour = _type == "remote" and "",
-							--update_interval = _type == "remote" and "",
+							http_client = _type == "remote" and "remote_http_client" or nil,
+							--update_interval = _type == "remote" and "1d" or nil,
 						}
 					end
 				end
@@ -1621,7 +1650,7 @@ function gen_config(var)
 							end
 						end
 					end
-					
+
 					local rule = {
 						action = "route",
 						inbound = inboundTag,
@@ -2202,7 +2231,37 @@ function gen_config(var)
 			table.insert(route.rule_set, v)
 		end
 	end
-	
+
+	local http_clients
+	if outbounds then
+		local proxy_tag = COMMON.default_outbound_tag
+		if proxy_tag == "block" or proxy_tag == "direct" then  -- 如默认节点是特殊节点，则选一个可用节点作为出口(urltest优先)
+			local first_node
+			for _, v in ipairs(outbounds) do
+				if not v["_flag_proxy_tag"] and not v.detour and v["_id"] and ((v.server and (v.server_port or v.server_ports)) or v.type == "urltest") then
+					first_node = first_node or v.tag
+					if v.type == "urltest" then
+						proxy_tag = v.tag
+						break
+					end
+				end
+			end
+			if proxy_tag == COMMON.default_outbound_tag then
+				proxy_tag = first_node
+			end
+		end
+		http_clients = {
+			{
+				tag = "remote_http_client",
+				detour = proxy_tag
+			},
+			{
+				tag = "direct_http_client",
+				detour = "direct"
+			}
+		}
+	end
+
 	if inbounds or outbounds then
 		local config = {
 			log = {
@@ -2219,8 +2278,10 @@ function gen_config(var)
 			outbounds = outbounds,
 			-- 路由
 			route = route,
-			--实验性
+			-- 实验性
 			experimental = experimental,
+			-- HTTP Client
+			http_clients = http_clients
 		}
 		table.insert(outbounds, {
 			type = "direct",
@@ -2349,7 +2410,7 @@ function gen_proto_config(var)
 		}
 		if outbound then table.insert(outbounds, outbound) end
 	end
-	
+
 	local config = {
 		log = {
 			disabled = true,

luci-app-passwall/luasrc/view/passwall/cbi/nodes_dynamiclist_com.htm

@@ -213,7 +213,7 @@
 		if (!rgb) return 'unknown'; // Handle invalid colors
 		// Calculate YIQ brightness (human eye perception)
 		const brightness = ((rgb.r * 299) + (rgb.g * 587) + (rgb.b * 114)) / 1000;
-		
+
 		return brightness > 128 ? 'light' : 'dark';
 	}
 

luci-app-passwall/luasrc/view/passwall/cbi/nodes_listvalue_com.htm

@@ -207,7 +207,7 @@
 		if (!rgb) return 'unknown'; // Handle invalid colors
 		// Calculate YIQ brightness (human eye perception)
 		const brightness = ((rgb.r * 299) + (rgb.g * 587) + (rgb.b * 114)) / 1000;
-		
+
 		return brightness > 128 ? 'light' : 'dark';
 	}
 
@@ -538,7 +538,7 @@
 			"&":"&amp;", "<":"&lt;", ">":"&gt;", '"':"&quot;", "'":"&#39;"
 		}[c]));
 	}
-	
+
 	function lv_change(cbid, listContainer, hiddenSelect, labelSpan, searchInput, new_key, new_text) {
 		//改值
 		hiddenSelect.options[0].value = new_key;
@@ -549,7 +549,7 @@
 		lv_highlightSelectedItem(listContainer, hiddenSelect);
 		lv_updateGroupCounts(cbid, listContainer, hiddenSelect, searchInput);
 	}
-	
+
 	function lv_render_dropdown_list(cbid, panel, listContainer, hiddenSelect, labelSpan, searchInput, display) {
 		if (window.lv_dropdown_rendered[cbid]) return;
 		const data = window.lv_dropdown_data[cbid];

luci-app-passwall/luasrc/view/passwall/cbi/nodes_multivalue_com.htm

@@ -163,7 +163,7 @@
 		if (!rgb) return 'unknown'; // Handle invalid colors
 		// Calculate YIQ brightness (human eye perception)
 		const brightness = ((rgb.r * 299) + (rgb.g * 587) + (rgb.b * 114)) / 1000;
-		
+
 		return brightness > 128 ? 'light' : 'dark';
 	}
 

luci-app-passwall/luasrc/view/passwall/cbi/nodes_value_com.htm

@@ -202,7 +202,7 @@
 		if (!rgb) return 'unknown'; // Handle invalid colors
 		// Calculate YIQ brightness (human eye perception)
 		const brightness = ((rgb.r * 299) + (rgb.g * 587) + (rgb.b * 114)) / 1000;
-		
+
 		return brightness > 128 ? 'light' : 'dark';
 	}
 

luci-app-passwall/luasrc/view/passwall/cbi/sortable.htm

@@ -36,7 +36,7 @@ local appname = self.appname or map.config
 		background-color: rgba(131, 191, 255, 0.7) !important;
 		box-shadow: 0 4px 6px rgba(0,0,0,0.1);
 	}
-	
+
 	@media screen and (max-width: 1152px) {
 		#cbi-<%=appname%>-<%=sectiontype%> .cbi-section-table-titles {
 			display: none !important;
@@ -116,7 +116,7 @@ local appname = self.appname or map.config
 				hiddenInput.value = changed ? newOrder.join(" ") : "";
 			}
 		}
-		
+
 		// hide lua luci version up/down
 		function hideSortColumn(section) {
 			var table = section.getElementsByTagName("table")[0];

luci-app-passwall/luasrc/view/passwall/global/faq.htm

@@ -50,13 +50,13 @@ local api = map.api
 	var origin = window.location.origin;
 	var hide_url = origin + "<%=api.url("hide")%>";
 	var show_url = origin + "<%=api.url("show")%>";
-	
+
 	function hide(url) {
 		if (confirm('<%:Are you sure to hide?%>') == true) {
 			window.location.href = hide_url;
 		}
 	}
-	
+
 	var dom = document.getElementById("faq_reset");
 	if (dom) {
 		var li = "";

luci-app-passwall/luasrc/view/passwall/global/proxy.htm

@@ -79,28 +79,28 @@
 			}
 		}
 	}
-	
+
 	function switch_gfw_mode() {
 		opt.set("use_gfw_list", true);
 		opt.set("chn_list", "0");
 		opt.set("tcp_proxy_mode", "disable");
 		opt.set("udp_proxy_mode", "disable");
 	}
-	
+
 	function switch_chnroute_mode() {
 		opt.set("use_gfw_list", true);
 		opt.set("chn_list", "direct");
 		opt.set("tcp_proxy_mode", "proxy");
 		opt.set("udp_proxy_mode", "proxy");
 	}
-	
+
 	function switch_returnhome_mode() {
 		opt.set("use_gfw_list", false);
 		opt.set("chn_list", "proxy");
 		opt.set("tcp_proxy_mode", "disable");
 		opt.set("udp_proxy_mode", "disable");
 	}
-	
+
 	function switch_global_mode() {
 		opt.set("use_gfw_list", false);
 		opt.set("chn_list", "0");

luci-app-passwall/luasrc/view/passwall/node_config/link_share_man.htm

@@ -95,7 +95,7 @@ local current_node = map:get(section)
 		};
 		return r;
 	}
-	
+
 	function genQrcode(btn, urlname, sid) {
 		var qrcode_div = document.getElementById("qrcode_div");
 		qrcode_div.style.display = null;
@@ -201,7 +201,7 @@ local current_node = map:get(section)
 			url = b64encsafe(v_method.value + ":" + v_password.value) + "@" +
 				_address + ":" +
 				v_port.value + "/?";
-			
+
 			var shadow_tls;
 			//生成SS Shadow-TLS 插件参数
 			const generateShadowTLSBase64 = function(paramStr) {
@@ -595,9 +595,9 @@ local current_node = map:get(section)
 			params += opt.query("pcs", dom_prefix + "tls_pinSHA256");
 			params += opt.query("vcn", dom_prefix + "tls_CertByName");
 			params += opt.query("ech", dom_prefix + "ech_config");
-			
+
 			var v_password = null;
-			
+
 			if (v_type === "Hysteria2") {
 				v_password = opt.get("hysteria2_auth_password");
 				var dom_obfs_type = opt.get("hysteria2_obfs_type");
@@ -1127,7 +1127,7 @@ local current_node = map:get(section)
 							var kv = ws_path_params_array[i].split('=');
 							ws_path_params[decodeURIComponent(kv[0]).toLowerCase()] = decodeURIComponent(kv[1] || '');
 						}
-						
+
 						if (ws_path_params.ed) {
 							opt.set(dom_prefix + 'ws_path', ws_path);
 							opt.set(dom_prefix + 'ws_enableEarlyData', true);
@@ -1165,7 +1165,7 @@ local current_node = map:get(section)
 				opt.set(dom_prefix + 'uot', queryParam.udp);
 				opt.set(dom_prefix + 'use_finalmask', !!queryParam.fm);
 				opt.set(dom_prefix + 'finalmask', queryParam.fm || "");
-			
+
 				if (queryParam["shadow-tls"]) {
 					//解析SS Shadow-TLS 插件参数
 					const parseShadowTLSParams = function(base64Str, outObj) {
@@ -1274,7 +1274,7 @@ local current_node = map:get(section)
 						var kv = ws_path_params_array[i].split('=');
 						ws_path_params[decodeURIComponent(kv[0]).toLowerCase()] = decodeURIComponent(kv[1] || '');
 					}
-					
+
 					if (ws_path_params.ed) {
 						opt.set(dom_prefix + 'ws_path', ws_path);
 						opt.set(dom_prefix + 'ws_enableEarlyData', true);
@@ -1416,7 +1416,7 @@ local current_node = map:get(section)
 						var kv = ws_path_params_array[i].split('=');
 						ws_path_params[decodeURIComponent(kv[0]).toLowerCase()] = decodeURIComponent(kv[1] || '');
 					}
-					
+
 					if (ws_path_params.ed) {
 						opt.set(dom_prefix + 'ws_path', ws_path);
 						opt.set(dom_prefix + 'ws_enableEarlyData', true);
@@ -1452,7 +1452,7 @@ local current_node = map:get(section)
 			} else if (has_xray) {
 				dom_prefix = "xray_";
 			}
-			
+
 			var m = parseNodeUrl(ssrurl);
 			var password = m.passwd;
 			if (password === "") {
@@ -1559,7 +1559,7 @@ local current_node = map:get(section)
 						var kv = ws_path_params_array[i].split('=');
 						ws_path_params[decodeURIComponent(kv[0]).toLowerCase()] = decodeURIComponent(kv[1] || '');
 					}
-					
+
 					if (ws_path_params.ed) {
 						opt.set(dom_prefix + 'ws_path', ws_path);
 						opt.set(dom_prefix + 'ws_enableEarlyData', true);

luci-app-passwall/luasrc/view/passwall/node_list/node_list.htm

@@ -1110,7 +1110,7 @@ table td, .table .td {
 			const dom = document.getElementById('modal-mask');
 			dom.style.display = 'block';
 			dom.innerHTML = '<div style="position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);color:#fff;"><%:Processing, please wait…%></div>';
-			
+
 			const chunkSize = 1000;  // Fragmented sending to overcome uhttpd's limitations, with each fragment containing 1000 characters.
 			const totalChunks = Math.ceil(link.length / chunkSize);
 			let currentChunk = 0;
@@ -1213,7 +1213,7 @@ table td, .table .td {
 			}
 		}
 	}
-	
+
 	const set_node_div = {
 		section: '',
 		open(cbi_id, protocol) {
@@ -1546,7 +1546,7 @@ table td, .table .td {
 				onChange("auto_detection_time", auto_detection_time);
 			});
 		});
-		
+
 		const links = document.querySelectorAll('a');
 		links.forEach(link => {
 			link.addEventListener('click', (e) => {

luci-app-passwall/luasrc/view/passwall/rule/shunt_rule_list.htm

@@ -393,7 +393,7 @@ table td, .table .td {
 					'' + table_html +
 					'</div>'
 			}
-			
+
 			function addTabDOM(li, content) {
 				let tab_ul_html = '<ul class="cbi-tabmenu">';
 				let tab_content_html = '<<%=section_tag%> class="cbi-section-shunt_rule cbi-section-shunt_rule-tabbed" id="cbi-<%=appname%>-shunt_rules">';
@@ -417,7 +417,7 @@ table td, .table .td {
 			if (default_group) {
 				cbi_t_switch("<%=appname%>.shunt_rules", default_group)
 			}
-			
+
 			origin_group_shunt_rule_order = {};
 			for (let group in group_shunt_rules) {
 				origin_group_shunt_rule_order[group] = get_shunt_rule_order(group);

luci-app-passwall/luasrc/view/passwall/server/gen_wireguard_key.htm

@@ -17,7 +17,7 @@ local prefix = self.option_prefix or ""
 			if (x && x.status == 200 && data.code == 1) {
 				const private_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_private_key");
 				private_key_dom.value = data.data.private_key;
-				
+
 				const public_key_dom = getOption("<%=self.config%>", "<%=section%>", "<%=prefix%>wireguard_public_key");
 				public_key_dom.value = data.data.public_key;
 			} else {

luci-app-passwall/luasrc/view/passwall/server/server_list_status.htm

@@ -21,7 +21,7 @@ local sectiontype = self.sectiontype
 			}
 		);
 	}
-	
+
 	var edit_btn = document.getElementById("cbi-<%=config%>-<%=sectiontype%>").getElementsByClassName("cbi-button cbi-button-edit");
 	for (var i = 0; i < edit_btn.length; i++) {
 		try {

luci-app-passwall/po/zh-cn/passwall.po

@@ -2183,3 +2183,6 @@ msgstr "密码套件"
 
 msgid "Configures the list of supported cipher suites, separated by :"
 msgstr "配置支持的密码套件列表，以冒号 (:) 分隔。"
+
+msgid "Connection Reuse"
+msgstr "连接复用"

luci-app-passwall/root/etc/hotplug.d/iface/98-passwall

@@ -26,10 +26,10 @@
 			cat /dev/null > ${LOCK_FILE}
 		fi
 		echo $$ > ${LOCK_FILE}
-		
+
 		/etc/init.d/${CONFIG} restart >/dev/null 2>&1 &
 		logger -p notice -t network -s "${CONFIG}: restart when $INTERFACE ifup"
-		
+
 		rm -rf ${LOCK_FILE}
 	}
 }

luci-app-passwall/root/usr/share/passwall/app.sh

@@ -223,7 +223,7 @@ run_xray() {
 		json_add_string "dns_socks_port" "${dns_socks_port}"
 	}
 	[ -n "$dns_listen_port" ] && json_add_string "dns_listen_port" "${dns_listen_port}"
-	
+
 	if [ -n "$direct_dns_udp_server" ]; then
 		direct_dns_port=$(echo ${direct_dns_udp_server} | awk -F '#' '{print $2}')
 		json_add_string "direct_dns_udp_server" "$(echo ${direct_dns_udp_server} | awk -F '#' '{print $1}')"
@@ -1287,7 +1287,7 @@ start_dns() {
 			ln_run "$(first_type dnsmasq)" "dnsmasq_direct" "/dev/null" -C ${DIRECT_DNSMASQ_CONF} -x ${GLOBAL_ACL_PATH}/direct_dnsmasq.pid
 			echo "${DIRECT_DNSMASQ_PORT}" > ${GLOBAL_ACL_PATH}/direct_dnsmasq_port
 		}
-		
+
 		#Rewrite the default DNS service configuration
 		#Modify the default dnsmasq service
 		lua $APP_PATH/helper_dnsmasq.lua stretch
@@ -1653,7 +1653,7 @@ start() {
 			sysctl -w net.bridge.bridge-nf-call-ip6tables=0 >/dev/null 2>&1
 		}
 	fi
-	
+
 	start_crontab
 	echolog "运行完成！\n"
 

luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua

@@ -491,7 +491,6 @@ if IS_SHUNT_NODE then
 			}
 			insert_array_after(config_lines, tmp_lines, "#--4")
 		end
-		
 	end
 
 	if is_file_nonzero(file_shunt_host) then

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -560,8 +560,6 @@ load_acl() {
 		msg="【默认】，"
 		local ipt_tmp=$ipt_n
 		[ -n "${is_tproxy}" ] && ipt_tmp=$ipt_m
-		local DEFAULT_TCP_REDIR=1
-		local DEFAULT_UDP_REDIR=1
 
 		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && {
 			add_port_rules "$ip6t_m -A PSW $(comment "默认") -p tcp" $TCP_NO_REDIR_PORTS "-j RETURN"
@@ -570,7 +568,6 @@ load_acl() {
 				echolog "     - ${msg}不代理 TCP 端口[${TCP_NO_REDIR_PORTS}]"
 			else
 				unset TCP_PROXY_MODE
-				DEFAULT_TCP_REDIR=0
 				echolog "     - ${msg}不代理所有 TCP 端口"
 			fi
 		}
@@ -582,7 +579,6 @@ load_acl() {
 				echolog "     - ${msg}不代理 UDP 端口[${UDP_NO_REDIR_PORTS}]"
 			else
 				unset UDP_PROXY_MODE
-				DEFAULT_UDP_REDIR=0
 				echolog "     - ${msg}不代理所有 UDP 端口"
 			fi
 		}
@@ -630,9 +626,6 @@ load_acl() {
 				[ "${USE_SHUNT_NODE}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS $(dst $IPSET_SHUNT) "-j MARK --set-mark 88"
 				[ "${TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "     - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
-				if has_1_65535 "$TCP_PROXY_DROP_PORTS"; then
-					DEFAULT_TCP_REDIR=0
-				fi
 			}
 
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
@@ -651,9 +644,6 @@ load_acl() {
 				[ "${USE_SHUNT_NODE}" = "1" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_SHUNT) -j MARK --set-mark 88"
 				[ "${UDP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW $(comment "默认") -p udp" $UDP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "     - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
-				if has_1_65535 "$UDP_PROXY_DROP_PORTS"; then
-					DEFAULT_UDP_REDIR=0
-				fi
 			}
 
 			$ipt_m -A PSW $(comment "默认") -m mark --mark 88 -j ACCEPT 2>/dev/null
@@ -662,9 +652,6 @@ load_acl() {
 			}
 		}
 
-		set_cache_var "DEFAULT_TCP_REDIR" "$DEFAULT_TCP_REDIR"
-		set_cache_var "DEFAULT_UDP_REDIR" "$DEFAULT_UDP_REDIR"
-
 		#  加载TCP默认代理模式
 		if [ -n "${TCP_PROXY_MODE}" ]; then
 			[ -n "$NODE" ] && {
@@ -995,7 +982,7 @@ add_firewall_rule() {
 			echolog "  - [$?]解析并加入[分流节点] GeoIP 到 IPSET 完成"
 		fi
 	}
-	
+
 	get_local_ips ip4 | sed "s/^/add $IPSET_LOCAL /" | ipset -! -R
 	get_local_ips ip6 | sed "s/^/add $IPSET_LOCAL6 /" | ipset -! -R
 
@@ -1198,7 +1185,7 @@ add_firewall_rule() {
 		else
 			ipt_j="$(REDIRECT $REDIR_PORT)"
 		fi
-		
+
 		msg="【路由器本机】，"
 		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && {
 			add_port_rules "$ipt_tmp -A PSW_OUTPUT -p tcp" $TCP_NO_REDIR_PORTS "-j RETURN"
@@ -1210,7 +1197,7 @@ add_firewall_rule() {
 				echolog "  - ${msg}不代理所有 TCP 端口"
 			fi
 		}
-		
+
 		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && {
 			add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_NO_REDIR_PORTS "-j RETURN"
 			add_port_rules "$ip6t_m -A PSW_OUTPUT -p udp" $UDP_NO_REDIR_PORTS "-j RETURN"
@@ -1241,7 +1228,7 @@ add_firewall_rule() {
 				[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p tcp" $TCP_PROXY_DROP_PORTS "-j MARK --set-mark 88"
 				echolog "  - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
 			}
-			
+
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "${USE_FAKEDNS}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "-d $FAKE_IP -j MARK --set-mark 88"
 				[ "${USE_PROXY_LIST}" = "1" ] && add_port_rules "$ipt_m -A PSW_OUTPUT -p udp" $UDP_PROXY_DROP_PORTS "$(dst $IPSET_BLACK) -j MARK --set-mark 88"
@@ -1387,7 +1374,7 @@ add_firewall_rule() {
 
 		$ipt_m -I OUTPUT $(comment "mangle-OUTPUT-PSW") -o lo -j RETURN
 		insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW) -m mark --mark ${FWMARK} -j RETURN"
-		
+
 		$ip6t_m -I OUTPUT $(comment "mangle-OUTPUT-PSW") -o lo -j RETURN
 		insert_rule_before "$ip6t_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW) -m mark --mark ${FWMARK} -j RETURN"
 	}

luci-app-passwall/root/usr/share/passwall/monitor.sh

@@ -26,7 +26,7 @@ while [ "$ENABLED" -eq 1 ]; do
 		IFS= read -r cmd < "$file"
 		[ -z "$cmd" ] && continue
 		cmd_check=$(printf '%s' "$cmd" | sed 's/>.*$//;s/[[:space:]]*$//')
-		
+
 		case "$cmd_check" in
 			*dns2socks*) cmd_check=${cmd_check//:/ } ;;
 		esac

luci-app-passwall/root/usr/share/passwall/nftables.sh

@@ -620,8 +620,6 @@ load_acl() {
 	}
 
 	[ "$ENABLED_DEFAULT_ACL" = 1 ] && [ "$CLIENT_PROXY" = 1 ] && {
-		local DEFAULT_TCP_REDIR=1
-		local DEFAULT_UDP_REDIR=1
 		msg="【默认】，"
 		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && {
 			nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return comment \"默认\""
@@ -630,7 +628,6 @@ load_acl() {
 				echolog "     - ${msg}不代理 TCP 端口[${TCP_NO_REDIR_PORTS}]"
 			else
 				unset TCP_PROXY_MODE
-				DEFAULT_TCP_REDIR=0
 				echolog "     - ${msg}不代理所有 TCP 端口"
 			fi
 		}
@@ -642,7 +639,6 @@ load_acl() {
 				echolog "     - ${msg}不代理 UDP 端口[${UDP_NO_REDIR_PORTS}]"
 			else
 				unset UDP_PROXY_MODE
-				DEFAULT_UDP_REDIR=0
 				echolog "     - ${msg}不代理所有 UDP 端口"
 			fi
 		}
@@ -693,9 +689,6 @@ load_acl() {
 				[ "${USE_SHUNT_NODE}" = "1" ] && nft_rule_dual "$nft_prerouting_chain" "ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") ip daddr" "$NFTSET_SHUNT" "counter reject comment \"默认\""
 				[ "${TCP_PROXY_MODE}" != "disable" ] && nft "add rule $NFTABLE_NAME $nft_prerouting_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter reject comment \"默认\""
 				echolog "     - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
-				if has_1_65535 "$TCP_PROXY_DROP_PORTS"; then
-					DEFAULT_TCP_REDIR=0
-				fi
 			}
 
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
@@ -714,15 +707,9 @@ load_acl() {
 				[ "${USE_SHUNT_NODE}" = "1" ] && nft_rule_dual "PSW_MANGLE" "ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") ip daddr" "$NFTSET_SHUNT" "counter reject comment \"默认\""
 				[ "${UDP_PROXY_MODE}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter reject comment \"默认\""
 				echolog "     - ${msg}屏蔽代理 UDP 端口[${UDP_PROXY_DROP_PORTS}]"
-				if has_1_65535 "$UDP_PROXY_DROP_PORTS"; then
-					DEFAULT_UDP_REDIR=0
-				fi
 			}
 		}
 
-		set_cache_var "DEFAULT_TCP_REDIR" "$DEFAULT_TCP_REDIR"
-		set_cache_var "DEFAULT_UDP_REDIR" "$DEFAULT_UDP_REDIR"
-
 		#  加载TCP默认代理模式
 		if [ -n "${TCP_PROXY_MODE}" ]; then
 			[ -n "$NODE" ] && {
@@ -1284,7 +1271,7 @@ add_firewall_rule() {
 
 	[ "$ENABLED_DEFAULT_ACL" = 1 ] && {
 		msg="【路由器本机】，"
-		
+
 		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && {
 			nft "add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return"
 			nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto tcp $(factor $TCP_NO_REDIR_PORTS "tcp dport") counter return"
@@ -1295,7 +1282,7 @@ add_firewall_rule() {
 				echolog "  - ${msg}不代理所有 TCP 端口"
 			fi
 		}
-		
+
 		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && {
 			nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return"
 			nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp $(factor $UDP_NO_REDIR_PORTS "udp dport") counter return"
@@ -1326,7 +1313,7 @@ add_firewall_rule() {
 				[ "${LOCALHOST_TCP_PROXY_MODE}" != "disable" ] && nft add rule $NFTABLE_NAME $nft_output_chain ip protocol tcp $(factor $TCP_PROXY_DROP_PORTS "tcp dport") counter reject
 				echolog "  - ${msg}屏蔽代理 TCP 端口[${TCP_PROXY_DROP_PORTS}]"
 			}
-			
+
 			[ "$UDP_PROXY_DROP_PORTS" != "disable" ] && {
 				[ "${USE_FAKEDNS}" = "1" ] && nft add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP $(factor $UDP_PROXY_DROP_PORTS "udp dport") counter reject
 				[ "${USE_PROXY_LIST}" = "1" ] && nft_rule_dual "PSW_OUTPUT_MANGLE" "ip protocol udp ip daddr" "$NFTSET_BLACK" "$(factor $UDP_PROXY_DROP_PORTS "udp dport") counter reject"

luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -510,7 +510,7 @@ local function fetch_rule(rule_name, rule_type, url, exclude_domain, max_retries
 				local set_name = "psw_" .. rule_name
 				if rule_name == "chnroute" then set_name = "psw_chn"
 				elseif rule_name == "chnroute6" then set_name = "psw_chn6" end
-                
+
 				local addr_type = (rule_type == "ip4") and "ipv4_addr" or "ipv6_addr"
 				gen_cache(set_name, addr_type, file_tmp, nft_file)
 				os.execute(string.format("mv -f %s %s.nft", nft_file, rule_final_path))

luci-app-passwall/root/usr/share/passwall/subscribe.lua

@@ -1047,7 +1047,7 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			log("跳过 Trojan 节点，因未适配到 Trojan 核心程序，或未正确设置节点使用类型。")
 			return nil
 		end
-		
+
 		local alias = ""
 		if content:find("#") then
 			local idx_sp = content:find("#")
@@ -1391,7 +1391,7 @@ local function processData(szType, content, add_mode, group, sub_cfg)
 			content = content:sub(0, idx_sp - 1)
 		end
 		result.remarks = UrlDecode(alias)
-		
+
 		local query = split(content:gsub("/%?", "?"), '%?')
 		local host_port = query[1]
 		local params = {}

luci-app-passwall2/Makefile

@@ -6,7 +6,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.8.27
+PKG_VERSION:=26.9.2
 PKG_RELEASE:=1
 PKG_PO_VERSION:=$(PKG_VERSION)
 

luci-app-passwall2/luasrc/controller/passwall2.lua

@@ -797,7 +797,7 @@ function geo_view()
 		return
 	end
 	local function get_rules(str, type)
-		local rules_id = {}
+		local rules = {}
 		uci_foreach("shunt_rules", function(s)
 			local list
 			if type == "geoip" then list = s.ip_list else list = s.domain_list end
@@ -806,14 +806,18 @@ function geo_view()
 					local prefix, main = line:match("^(.-):(.*)")
 					if not main then main = line end
 					if type == "geoip" and (api.datatypes.ipaddr(str) or api.datatypes.ip6addr(str)) then
-						if main:find(str, 1, true) then rules_id[#rules_id + 1] = s[".name"] end
+						if main:find(str, 1, true) then
+							table.insert(rules, {id = s[".name"], group = s.group or i18n.translate("default")})
+						end
 					else
-						if main == str then rules_id[#rules_id + 1] = s[".name"] end
+						if main == str then
+							table.insert(rules, {id = s[".name"], group = s.group or i18n.translate("default")})
+						end
 					end
 				end
 			end
 		end)
-		return rules_id
+		return rules
 	end
 	local geo_dir = (uci_get("@global_rules[0]", "v2ray_location_asset") or "/usr/share/v2ray/"):match("^(.*)/")
 	local geosite_path = geo_dir .. "/geosite.dat"
@@ -834,11 +838,17 @@ function geo_view()
 			for line in geo_string:gmatch("([^\n]+)") do
 				lines[#lines + 1] = geo_type .. ":" .. line
 				for _, r in ipairs(get_rules(line, geo_type) or {}) do
-					if not seen[r] then seen[r] = true; rules[#rules + 1] = r end
+					if not seen[r.id] then
+						seen[r.id] = true
+						rules[#rules + 1] = string.format("[%s]%s", r.group, r.id)
+					end
 				end
 			end
 			for _, r in ipairs(get_rules(value, geo_type) or {}) do
-				if not seen[r] then seen[r] = true; rules[#rules + 1] = r end
+				if not seen[r.id] then
+					seen[r.id] = true
+					rules[#rules + 1] = string.format("[%s]%s", r.group, r.id)
+				end
 			end
 			geo_string = table.concat(lines, "\n")
 			if #rules > 0 then

luci-app-passwall2/luasrc/model/cbi/passwall2/client/type/1_sing-box.lua

@@ -40,6 +40,7 @@ local security_list = { "none", "auto", "aes-128-gcm", "chacha20-poly1305", "zer
 local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | awk '{print $2}'")
 
 local singbox_version = api.get_app_version("sing-box"):match("[^v]+")
+local version_ge_1_14_0 = api.compare_versions(singbox_version, ">=", "1.14.0")
 
 o = s:option(ListValue, "protocol", translate("Protocol"))
 o:value("socks", "Socks")
@@ -68,6 +69,9 @@ o:value("ssh", "SSH")
 if singbox_tags:find("with_naive_outbound") then
 	o:value("naive", "NaïveProxy")
 end
+if version_ge_1_14_0 then
+	o:value("snell", "Snell")
+end
 o:value("_urltest", translate("URLTest"))
 o:value("_shunt", translate("Shunt"))
 o:value("_iface", translate("Custom Interface"))
@@ -237,6 +241,43 @@ o:depends({ protocol = "anytls" })
 o:depends({ protocol = "ssh" })
 o:depends({ protocol = "naive" })
 
+if version_ge_1_14_0 then
+	-- snell
+	s.fields["password"]:depends({ protocol = "snell" })
+
+	o = s:option(Value, "snell_psk", translate("Pre shared key"))
+	o.rmempty = false
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_version", translate("Version"))
+	o:value("4")
+	o:value("6")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(Flag, "snell_reuse", translate("reuse"))
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_network", translate("Transport"))
+	o:value("", "TCP UDP")
+	o:value("tcp", "TCP")
+	o:value("udp", "UDP")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_obfs_mode", translate("Camouflage Type"))
+	o:value("none")
+	o:value("http")
+	o:depends({ protocol = "snell", snell_version = "4" })
+
+	o = s:option(Value, "snell_obfs_host", translate("HTTP Host"))
+	o:depends({ protocol = "snell", snell_version = "4", snell_obfs_mode = "http" })
+
+	o = s:option(ListValue, "snell_mode", translate("Mode"))
+	o:value("default")
+	o:value("unshaped")
+	o:value("unsafe-raw")
+	o:depends({ protocol = "snell", snell_version = "6" })
+end
+
 o = s:option(ListValue, "security", translate("Encrypt Method"))
 for a, t in ipairs(security_list) do o:value(t) end
 o:depends({ protocol = "vmess" })
@@ -400,7 +441,7 @@ if singbox_tags:find("with_quic") then
 
 	o = s:option(Flag, "hysteria2_realms", translate("Realms"))
 	o.default = "0"
-	if api.compare_versions(singbox_version, ">=", "1.14.0") then
+	if version_ge_1_14_0 then
 		o:depends({ protocol = "hysteria2"})
 	else
 		o:depends({ protocol = "__hide"})

luci-app-passwall2/luasrc/model/cbi/passwall2/server/index.lua

@@ -2,6 +2,7 @@ local api = require "luci.passwall2.api"
 api.set_default_cbi()
 
 m = Map(api.s_config)
+m.redirect = api.url("server")
 
 t = m:section(NamedSection, "global", "global", translate("Server-Side"))
 t.anonymous = true

luci-app-passwall2/luasrc/model/cbi/passwall2/server/type/1_sing-box.lua

@@ -27,6 +27,9 @@ s.option_prefix = "singbox_"
 
 local singbox_tags = luci.sys.exec(singbox_bin .. " version  | grep 'Tags:' | awk '{print $2}'")
 
+local local_version = api.get_app_version("sing-box"):match("[^v]+")
+local version_ge_1_14_0 = api.compare_versions(local_version, ">=", "1.14.0")
+
 local ss_method_list = {
 	"none", "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305",
 	"2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305"
@@ -56,6 +59,7 @@ o.custom_write = function(self, section, value)
 end
 
 o = s:option(ListValue, "protocol", translate("Protocol"))
+o:value("direct", "Direct")
 o:value("mixed", "Mixed")
 o:value("socks", "Socks")
 o:value("http", "HTTP")
@@ -64,28 +68,9 @@ o:value("vmess", "Vmess")
 o:value("vless", "VLESS")
 o:value("trojan", "Trojan")
 o:value("naive", "Naive")
-if singbox_tags:find("with_quic") then
-	o:value("hysteria", "Hysteria")
-end
-if singbox_tags:find("with_quic") then
-	o:value("tuic", "TUIC")
-end
-if singbox_tags:find("with_quic") then
-	o:value("hysteria2", "Hysteria2")
-end
 o:value("anytls", "AnyTLS")
-if singbox_tags:find("with_wireguard") then
-	o:value("wireguard", "WireGuard")
-end
-o:value("direct", "Direct")
 o:depends({ custom = false })
 
-o = s:option(DummyValue, "is_endpoint", "")
-o.not_rewrite = true
-o.template = m:template_path("/cbi/hidevalue")
-o.value = "1"
-o:depends({ custom = false, protocol = "wireguard" })
-
 o = s:option(Value, "port", translate("Listen Port"))
 o.datatype = "port"
 o:depends({ custom = false })
@@ -102,13 +87,13 @@ o:depends({ protocol = "vmess" })
 o:depends({ protocol = "vless" })
 o:depends({ protocol = "trojan" })
 o:depends({ protocol = "naive" })
-o:depends({ protocol = "hysteria" })
-o:depends({ protocol = "tuic" })
-o:depends({ protocol = "hysteria2" })
 o:depends({ protocol = "anytls" })
-o:depends({ protocol = "wireguard" })
 
 if singbox_tags:find("with_quic") then
+	-- hysteria
+	s.fields["protocol"]:value("hysteria", "Hysteria")
+	s.fields["users"]:depends({ protocol = "hysteria" })
+
 	o = s:option(Value, "hysteria_obfs", translate("Obfs Password"))
 	o:depends({ protocol = "hysteria" })
 
@@ -135,6 +120,10 @@ if singbox_tags:find("with_quic") then
 end
 
 if singbox_tags:find("with_quic") then
+	-- tuic
+	s.fields["protocol"]:value("tuic", "TUIC")
+	s.fields["users"]:depends({ protocol = "tuic" })
+
 	o = s:option(ListValue, "tuic_congestion_control", translate("Congestion control algorithm"))
 	o.default = "cubic"
 	o:value("bbr", translate("BBR"))
@@ -166,6 +155,10 @@ if singbox_tags:find("with_quic") then
 end
 
 if singbox_tags:find("with_quic") then
+	-- hysteria2
+	s.fields["protocol"]:value("hysteria2", "Hysteria2")
+	s.fields["users"]:depends({ protocol = "hysteria2" })
+
 	o = s:option(Flag, "hysteria2_realms", translate("Realms"))
 	o.default = "0"
 	o:depends({ protocol = "hysteria2"})
@@ -435,6 +428,10 @@ o.default = "50"
 o:depends({ tcpbrutal = true })
 
 if singbox_tags:find("with_wireguard") then
+	-- wireguard
+	s.fields["protocol"]:value("wireguard", "WireGuard")
+	s.fields["users"]:depends({ protocol = "wireguard" })
+
 	o = s:option(Flag, "wireguard_system_interface", translate("System interface"))
 	o.default = 0
 	o:depends({ protocol = "wireguard" })
@@ -459,6 +456,32 @@ if singbox_tags:find("with_wireguard") then
 	o:depends({ protocol = "wireguard" })
 end
 
+if version_ge_1_14_0 then
+	-- snell
+	s.fields["protocol"]:value("snell", "Snell")
+	s.fields["users"]:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_version", translate("Version"))
+	o:value("5")
+	o:value("6")
+	o:depends({ protocol = "snell" })
+
+	o = s:option(Value, "snell_psk", translate("Pre shared key"))
+	o.rmempty = false
+	o:depends({ protocol = "snell" })
+
+	o = s:option(ListValue, "snell_obfs_mode", translate("Obfs"))
+	o:value("none")
+	o:value("http")
+	o:depends({ protocol = "snell", snell_version = "5" })
+
+	o = s:option(ListValue, "snell_mode", translate("Mode"))
+	o:value("default")
+	o:value("unshaped")
+	o:value("unsafe-raw")
+	o:depends({ protocol = "snell", snell_version = "6" })
+end
+
 o = s:option(Flag, "firewall_allow", translate("Firewall Allow"))
 o.default = "0"
 o:depends({ custom = false })

luci-app-passwall2/luasrc/passwall2/util_sing-box.lua

@@ -667,6 +667,19 @@ function gen_outbound(flag, node, tag, proxy_table)
 			}
 		end
 
+		if node.protocol == "snell" then
+			protocol_table = {
+				version = tonumber(node.snell_version),
+				psk = node.snell_psk,
+				userkey = node.password,
+				reuse = node.snell_reuse == "1" and true or false,
+				network = node.snell_network,
+				obfs_mode = node.snell_version == "4" and node.snell_obfs_mode or nil,
+				obfs_host = node.snell_version == "4" and node.snell_obfs_host or nil,
+				mode = node.snell_version == "6" and node.snell_mode or nil,
+			}
+		end
+
 		if protocol_table then
 			for key, value in pairs(protocol_table) do
 				result[key] = value
@@ -823,6 +836,10 @@ function gen_config_server(node)
 					u.allowed_ips = user.allowed_ips or {}
 					u.persistent_keepalive_interval = 0
 				end
+				if node.protocol == "snell" then
+					u.name = user.username
+					u.userkey = user.password
+				end
 				users[#users + 1] = u
 			end
 		end
@@ -1003,6 +1020,16 @@ function gen_config_server(node)
 		end
 	end
 
+	if node.protocol == "snell" then
+		protocol_table = {
+			users = users,
+			version = tonumber(node.snell_version),
+			psk = node.snell_psk,
+			obfs_mode = node.snell_version == "5" and node.snell_obfs_mode or nil,
+			mode = node.snell_version == "6" and node.snell_mode or nil,
+		}
+	end
+
 	if node.protocol == "direct" then
 		protocol_table = {
 			network = (node.d_protocol ~= "TCP,UDP") and node.d_protocol or nil,

luci-app-passwall2/luasrc/passwall2/util_xray.lua

@@ -1838,7 +1838,7 @@ function gen_config(var)
 								end
 							end
 						end
-						if dns_outboundTag == "blackhole" then
+						if value.outboundTag == "blackhole" then
 							table.insert(dns_out_rules, {
 								action = "return",
 								rCode = 0,