From 8f6a6f0e3076ba12b759db5cbbd0a21019828a96 Mon Sep 17 00:00:00 2001 From: SakuraFallingMad <31793080+SakuraFallingMad@users.noreply.github.com> Date: Fri, 27 Dec 2024 14:16:02 +0800 Subject: [PATCH] luci-app-passwall: bump to 25.1.1 --- applications/luci-app-passwall/Makefile | 4 +- .../luasrc/controller/passwall.lua | 59 ++- .../model/cbi/passwall/client/acl_config.lua | 22 +- .../model/cbi/passwall/client/global.lua | 36 +- .../model/cbi/passwall/client/haproxy.lua | 3 +- .../model/cbi/passwall/client/node_config.lua | 14 +- .../model/cbi/passwall/client/rule_list.lua | 6 +- .../cbi/passwall/client/socks_config.lua | 9 +- .../model/cbi/passwall/client/type/ray.lua | 13 +- .../cbi/passwall/client/type/sing-box.lua | 5 +- .../luci-app-passwall/luasrc/passwall/api.lua | 85 ++--- .../luasrc/passwall/server_app.lua | 2 +- .../luasrc/passwall/util_hysteria2.lua | 2 +- .../luasrc/passwall/util_naiveproxy.lua | 2 +- .../luasrc/passwall/util_shadowsocks.lua | 2 +- .../luasrc/passwall/util_sing-box.lua | 2 +- .../luasrc/passwall/util_trojan.lua | 2 +- .../luasrc/passwall/util_tuic.lua | 2 +- .../luasrc/passwall/util_xray.lua | 18 +- .../luasrc/view/passwall/acl/footer.htm | 41 ++ .../luasrc/view/passwall/global/footer.htm | 28 ++ .../luasrc/view/passwall/global/status.htm | 8 +- .../passwall/node_list/link_share_man.htm | 109 ++++-- .../luasrc/view/passwall/rule_list/js.htm | 6 +- .../socks_auto_switch/{footer.htm => btn.htm} | 9 +- .../luci-app-passwall/po/zh_Hans/passwall.po | 3 + .../root/usr/share/passwall/0_default_config | 5 +- .../root/usr/share/passwall/app.sh | 356 +++++++++--------- .../root/usr/share/passwall/haproxy.lua | 2 +- .../share/passwall/helper_chinadns_add.lua | 13 +- .../usr/share/passwall/helper_dnsmasq.lua | 16 +- .../share/passwall/helper_smartdns_add.lua | 2 +- .../root/usr/share/passwall/iptables.sh | 52 ++- .../root/usr/share/passwall/nftables.sh | 49 +-- .../root/usr/share/passwall/rule_update.lua | 4 +- .../root/usr/share/passwall/subscribe.lua | 33 +- .../root/usr/share/passwall/test.sh | 11 +- 37 files changed, 582 insertions(+), 453 deletions(-) create mode 100644 applications/luci-app-passwall/luasrc/view/passwall/acl/footer.htm rename applications/luci-app-passwall/luasrc/view/passwall/socks_auto_switch/{footer.htm => btn.htm} (59%) diff --git a/applications/luci-app-passwall/Makefile b/applications/luci-app-passwall/Makefile index f3b73000af1..86c47c14c88 100644 --- a/applications/luci-app-passwall/Makefile +++ b/applications/luci-app-passwall/Makefile @@ -1,12 +1,12 @@ # Copyright (C) 2018-2020 L-WRT Team -# Copyright (C) 2021-2023 xiaorouji +# Copyright (C) 2021-2025 xiaorouji # # This is free software, licensed under the GNU General Public License v3. include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall -PKG_VERSION:=24.12.26 +PKG_VERSION:=25.1.1 PKG_RELEASE:=1 PKG_CONFIG_DEPENDS:= \ diff --git a/applications/luci-app-passwall/luasrc/controller/passwall.lua b/applications/luci-app-passwall/luasrc/controller/passwall.lua index 99c620fa890..4a46e1eb995 100644 --- a/applications/luci-app-passwall/luasrc/controller/passwall.lua +++ b/applications/luci-app-passwall/luasrc/controller/passwall.lua @@ -1,10 +1,10 @@ -- Copyright (C) 2018-2020 L-WRT Team --- Copyright (C) 2021-2023 xiaorouji +-- Copyright (C) 2021-2025 xiaorouji module("luci.controller.passwall", package.seeall) local api = require "luci.passwall.api" -local appname = "passwall" -- not available -local uci = api.libuci -- in funtion index() +local appname = "passwall" -- not available +local uci = api.uci -- in funtion index() local fs = api.fs local http = require "luci.http" local util = require "luci.util" @@ -17,8 +17,8 @@ function index() else return end end local api = require "luci.passwall.api" - local appname = "passwall" -- global definitions not available - local uci = api.libuci -- in function index() + local appname = "passwall" -- global definitions not available + local uci = api.uci -- in function index() local fs = api.fs entry({"admin", "services", appname}).dependent = true entry({"admin", "services", appname, "reset_config"}, call("reset_config")).leaf = true @@ -66,6 +66,7 @@ function index() entry({"admin", "services", appname, "get_now_use_node"}, call("get_now_use_node")).leaf = true entry({"admin", "services", appname, "get_redir_log"}, call("get_redir_log")).leaf = true entry({"admin", "services", appname, "get_socks_log"}, call("get_socks_log")).leaf = true + entry({"admin", "services", appname, "get_chinadns_log"}, call("get_chinadns_log")).leaf = true entry({"admin", "services", appname, "get_log"}, call("get_log")).leaf = true entry({"admin", "services", appname, "clear_log"}, call("clear_log")).leaf = true entry({"admin", "services", appname, "index_status"}, call("index_status")).leaf = true @@ -109,7 +110,7 @@ end function show_menu() uci:delete(appname, "@global[0]", "hide_from_luci") - uci:commit(appname) + api.uci_save(uci, appname, true) luci.sys.call("rm -rf /tmp/luci-*") luci.sys.call("/etc/init.d/rpcd restart >/dev/null") luci.http.redirect(api.url()) @@ -117,7 +118,7 @@ end function hide_menu() uci:set(appname, "@global[0]", "hide_from_luci","1") - uci:commit(appname) + api.uci_save(uci, appname, true) luci.sys.call("rm -rf /tmp/luci-*") luci.sys.call("/etc/init.d/rpcd restart >/dev/null") luci.http.redirect(luci.dispatcher.build_url("admin", "status", "overview")) @@ -134,6 +135,7 @@ function socks_autoswitch_add_node() local id = luci.http.formvalue("id") local key = luci.http.formvalue("key") if id and id ~= "" and key and key ~= "" then + uci:set(appname, id, "enable_autoswitch", "1") local new_list = uci:get(appname, id, "autoswitch_backup_node") or {} for i = #new_list, 1, -1 do if (uci:get(appname, new_list[i], "remarks") or ""):find(key) then @@ -145,8 +147,8 @@ function socks_autoswitch_add_node() table.insert(new_list, e.id) end end - api.uci_set_list(uci, appname, id, "autoswitch_backup_node", new_list) - uci:commit(appname) + uci:set_list(appname, id, "autoswitch_backup_node", new_list) + api.uci_save(uci, appname) end luci.http.redirect(api.url("socks_config", id)) end @@ -155,14 +157,15 @@ function socks_autoswitch_remove_node() local id = luci.http.formvalue("id") local key = luci.http.formvalue("key") if id and id ~= "" and key and key ~= "" then + uci:set(appname, id, "enable_autoswitch", "1") local new_list = uci:get(appname, id, "autoswitch_backup_node") or {} for i = #new_list, 1, -1 do if (uci:get(appname, new_list[i], "remarks") or ""):find(key) then table.remove(new_list, i) end end - api.uci_set_list(uci, appname, id, "autoswitch_backup_node", new_list) - uci:commit(appname) + uci:set_list(appname, id, "autoswitch_backup_node", new_list) + api.uci_save(uci, appname) end luci.http.redirect(api.url("socks_config", id)) end @@ -211,6 +214,18 @@ function get_socks_log() end end +function get_chinadns_log() + local flag = luci.http.formvalue("flag") + local path = "/tmp/etc/passwall/acl/" .. flag .. "/chinadns_ng.log" + if fs.access(path) then + local content = luci.sys.exec("cat ".. path) + content = content:gsub("\n", "
") + luci.http.write(content) + else + luci.http.write(string.format("", i18n.translate("Not enabled log"))) + end +end + function get_log() -- luci.sys.exec("[ -f /tmp/log/passwall.log ] && sed '1!G;h;$!d' /tmp/log/passwall.log > /tmp/log/passwall_show.log") luci.http.write(luci.sys.exec("[ -f '/tmp/log/passwall.log' ] && cat /tmp/log/passwall.log")) @@ -274,6 +289,12 @@ function connect_status() local gfw_list = uci:get(appname, "@global[0]", "use_gfw_list") or "1" local proxy_mode = uci:get(appname, "@global[0]", "tcp_proxy_mode") or "proxy" local socks_server = api.get_cache_var("GLOBAL_TCP_SOCKS_server") + + -- 兼容 curl 8.6 time_starttransfer 错误 + local curl_ver = luci.sys.exec("curl -V 2>/dev/null | head -n 1 | awk '{print $2}' | cut -d. -f1,2") or "0" + url = (curl_ver == "8.6") and "-w %{http_code}:%{time_appconnect} https://" .. url + or "-w %{http_code}:%{time_starttransfer} http://" .. url + if socks_server and socks_server ~= "" then if (chn_list == "proxy" and gfw_list == "0" and proxy_mode ~= "proxy" and baidu ~= nil) or (chn_list == "0" and gfw_list == "0" and proxy_mode == "proxy") then -- 中国列表+百度 or 全局 @@ -283,7 +304,7 @@ function connect_status() url = "-x socks5h://" .. socks_server .. " " .. url end end - local result = luci.sys.exec('curl --connect-timeout 3 -o /dev/null -I -sk -w "%{http_code}:%{time_appconnect}" ' .. url) + local result = luci.sys.exec('curl --connect-timeout 3 -o /dev/null -I -sk ' .. url) local code = tonumber(luci.sys.exec("echo -n '" .. result .. "' | awk -F ':' '{print $1}'") or "0") if code ~= 0 then local use_time = luci.sys.exec("echo -n '" .. result .. "' | awk -F ':' '{print $2}'") @@ -340,7 +361,7 @@ function set_node() local protocol = luci.http.formvalue("protocol") local section = luci.http.formvalue("section") uci:set(appname, "@global[0]", protocol .. "_node", section) - uci:commit(appname) + api.uci_save(uci, appname, true) luci.sys.call("/etc/init.d/passwall restart > /dev/null 2>&1 &") luci.http.redirect(api.url("log")) end @@ -348,7 +369,7 @@ end function copy_node() local section = luci.http.formvalue("section") local uuid = api.gen_short_uuid() - api.uci_section(uci, appname, "nodes", uuid) + uci:section(appname, "nodes", uuid) for k, v in pairs(uci:get_all(appname, section)) do local filter = k:find("%.") if filter and filter == 1 then @@ -362,7 +383,7 @@ function copy_node() end uci:delete(appname, uuid, "add_from") uci:set(appname, uuid, "add_mode", 1) - uci:commit(appname) + api.uci_save(uci, appname) luci.http.redirect(api.url("node_config", uuid)) end @@ -372,7 +393,7 @@ function clear_all_nodes() uci:delete(appname, '@global[0]', "udp_node") uci:foreach(appname, "socks", function(t) uci:delete(appname, t[".name"]) - api.uci_set_list(uci, appname, t[".name"], "autoswitch_backup_node", {}) + uci:set_list(appname, t[".name"], "autoswitch_backup_node", {}) end) uci:foreach(appname, "haproxy_config", function(t) uci:delete(appname, t[".name"]) @@ -385,7 +406,7 @@ function clear_all_nodes() uci:delete(appname, node['.name']) end) - uci:commit(appname) + api.uci_save(uci, appname, true) luci.sys.call("/etc/init.d/" .. appname .. " stop") end @@ -408,7 +429,7 @@ function delete_select_nodes() table.remove(auto_switch_node_list, i) end end - api.uci_set_list(uci, appname, t[".name"], "autoswitch_backup_node", auto_switch_node_list) + uci:set_list(appname, t[".name"], "autoswitch_backup_node", auto_switch_node_list) end) uci:foreach(appname, "haproxy_config", function(t) if t["lbss"] == w then @@ -435,7 +456,7 @@ function delete_select_nodes() end) uci:delete(appname, w) end) - uci:commit(appname) + api.uci_save(uci, appname, true) luci.sys.call("/etc/init.d/" .. appname .. " restart > /dev/null 2>&1 &") end diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua index 3248b18d9fd..7c867665f56 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/acl_config.lua @@ -1,12 +1,12 @@ local api = require "luci.passwall.api" local appname = "passwall" -local uci = api.libuci +local fs = api.fs local sys = api.sys local has_singbox = api.finded_com("singbox") local has_xray = api.finded_com("xray") -local has_gfwlist = api.fs.access("/usr/share/passwall/rules/gfwlist") -local has_chnlist = api.fs.access("/usr/share/passwall/rules/chnlist") -local has_chnroute = api.fs.access("/usr/share/passwall/rules/chnroute") +local has_gfwlist = fs.access("/usr/share/passwall/rules/gfwlist") +local has_chnlist = fs.access("/usr/share/passwall/rules/chnlist") +local has_chnroute = fs.access("/usr/share/passwall/rules/chnroute") local port_validate = function(self, value, t) return value:gsub("-", ":") @@ -146,7 +146,7 @@ end sources.write = dynamicList_write ---- TCP No Redir Ports -local TCP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_no_redir_ports") +local TCP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_no_redir_ports") o = s:option(Value, "tcp_no_redir_ports", translate("TCP No Redir Ports")) o:value("", translate("Use global config") .. "(" .. TCP_NO_REDIR_PORTS .. ")") o:value("disable", translate("No patterns are used")) @@ -154,7 +154,7 @@ o:value("1:65535", translate("All")) o.validate = port_validate ---- UDP No Redir Ports -local UDP_NO_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "udp_no_redir_ports") +local UDP_NO_REDIR_PORTS = m:get("@global_forwarding[0]", "udp_no_redir_ports") o = s:option(Value, "udp_no_redir_ports", translate("UDP No Redir Ports"), "" .. translate("Fill in the ports you don't want to be forwarded by the agent, with the highest priority.") .. @@ -203,7 +203,7 @@ o.value = "1" o:depends({ udp_node = "", ['!reverse'] = true }) ---- TCP Proxy Drop Ports -local TCP_PROXY_DROP_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_proxy_drop_ports") +local TCP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "tcp_proxy_drop_ports") o = s:option(Value, "tcp_proxy_drop_ports", translate("TCP Proxy Drop Ports")) o:value("", translate("Use global config") .. "(" .. TCP_PROXY_DROP_PORTS .. ")") o:value("disable", translate("No patterns are used")) @@ -212,7 +212,7 @@ o:depends({ use_global_config = true }) o:depends({ _tcp_node_bool = "1" }) ---- UDP Proxy Drop Ports -local UDP_PROXY_DROP_PORTS = uci:get(appname, "@global_forwarding[0]", "udp_proxy_drop_ports") +local UDP_PROXY_DROP_PORTS = m:get("@global_forwarding[0]", "udp_proxy_drop_ports") o = s:option(Value, "udp_proxy_drop_ports", translate("UDP Proxy Drop Ports")) o:value("", translate("Use global config") .. "(" .. UDP_PROXY_DROP_PORTS .. ")") o:value("disable", translate("No patterns are used")) @@ -222,7 +222,7 @@ o:depends({ use_global_config = true }) o:depends({ _tcp_node_bool = "1" }) ---- TCP Redir Ports -local TCP_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "tcp_redir_ports") +local TCP_REDIR_PORTS = m:get("@global_forwarding[0]", "tcp_redir_ports") o = s:option(Value, "tcp_redir_ports", translate("TCP Redir Ports"), translatef("Only work with using the %s node.", "TCP")) o:value("", translate("Use global config") .. "(" .. TCP_REDIR_PORTS .. ")") o:value("1:65535", translate("All")) @@ -234,7 +234,7 @@ o:depends({ use_global_config = true }) o:depends({ _tcp_node_bool = "1" }) ---- UDP Redir Ports -local UDP_REDIR_PORTS = uci:get(appname, "@global_forwarding[0]", "udp_redir_ports") +local UDP_REDIR_PORTS = m:get("@global_forwarding[0]", "udp_redir_ports") o = s:option(Value, "udp_redir_ports", translate("UDP Redir Ports"), translatef("Only work with using the %s node.", "UDP")) o:value("", translate("Use global config") .. "(" .. UDP_REDIR_PORTS .. ")") o:value("1:65535", translate("All")) @@ -418,4 +418,6 @@ o:value("direct", translate("Direct DNS")) o.description = desc .. "" o:depends({dns_shunt = "dnsmasq", tcp_proxy_mode = "proxy", chn_list = "direct"}) +m:append(Template(appname .. "/acl/footer")) + return m diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua index 411b04aa7e6..8d9cbe24fa2 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua @@ -1,12 +1,12 @@ local api = require "luci.passwall.api" local appname = "passwall" -local uci = api.libuci local datatypes = api.datatypes +local fs = api.fs local has_singbox = api.finded_com("singbox") local has_xray = api.finded_com("xray") -local has_gfwlist = api.fs.access("/usr/share/passwall/rules/gfwlist") -local has_chnlist = api.fs.access("/usr/share/passwall/rules/chnlist") -local has_chnroute = api.fs.access("/usr/share/passwall/rules/chnroute") +local has_gfwlist = fs.access("/usr/share/passwall/rules/gfwlist") +local has_chnlist = fs.access("/usr/share/passwall/rules/chnlist") +local has_chnroute = fs.access("/usr/share/passwall/rules/chnroute") local chinadns_tls = os.execute("chinadns-ng -V | grep -i wolfssl >/dev/null") m = Map(appname) @@ -37,13 +37,13 @@ end local socks_list = {} -local tcp_socks_server = "127.0.0.1" .. ":" .. (uci:get(appname, "@global[0]", "tcp_node_socks_port") or "1070") +local tcp_socks_server = "127.0.0.1" .. ":" .. (m:get("@global[0]", "tcp_node_socks_port") or "1070") local socks_table = {} socks_table[#socks_table + 1] = { id = tcp_socks_server, remark = tcp_socks_server .. " - " .. translate("TCP Node") } -uci:foreach(appname, "socks", function(s) +m.uci:foreach(appname, "socks", function(s) if s.enabled == "1" and s.node then local id, remark for k, n in pairs(nodes_table) do @@ -199,7 +199,7 @@ if (has_singbox or has_xray) and #nodes_table > 0 then type:depends("tcp_node", "__hide") --不存在的依赖，即始终隐藏 end - uci:foreach(appname, "shunt_rules", function(e) + m.uci:foreach(appname, "shunt_rules", function(e) local id = e[".name"] local node_option = vid .. "-" .. id .. "_node" if id and e.remarks then @@ -347,6 +347,7 @@ o:value("180.184.1.1") o:value("180.184.2.2") o:value("114.114.114.114") o:value("114.114.115.115") +o:value("119.28.28.28") o:depends("direct_dns_mode", "tcp") o = s:taboption("DNS", Value, "direct_dns_dot", translate("Direct DNS DoT")) @@ -388,7 +389,7 @@ end ---- SmartDNS Forward Mode if api.is_finded("smartdns") then o = s:taboption("DNS", ListValue, "smartdns_dns_mode", translate("Filter Mode")) - o:value("socks", "SOCKS") + o:value("socks", "Socks") if has_singbox then o:value("sing-box", "Sing-Box") end @@ -593,7 +594,7 @@ o = s:taboption("DNS", Flag, "dns_redirect", translate("DNS Redirect"), translat o.default = "1" o.rmempty = false -if (uci:get(appname, "@global_forwarding[0]", "use_nft") or "0") == "1" then +if (m:get("@global_forwarding[0]", "use_nft") or "0") == "1" then o = s:taboption("DNS", Button, "clear_ipset", translate("Clear NFTSET"), translate("Try this feature if the rule modification does not take effect.")) else o = s:taboption("DNS", Button, "clear_ipset", translate("Clear IPSET"), translate("Try this feature if the rule modification does not take effect.")) @@ -659,11 +660,11 @@ end s:tab("log", translate("Log")) o = s:taboption("log", Flag, "log_tcp", translate("Enable") .. " " .. translatef("%s Node Log", "TCP")) -o.default = "1" +o.default = "0" o.rmempty = false o = s:taboption("log", Flag, "log_udp", translate("Enable") .. " " .. translatef("%s Node Log", "UDP")) -o.default = "1" +o.default = "0" o.rmempty = false o = s:taboption("log", ListValue, "loglevel", "Sing-Box/Xray " .. translate("Log Level")) @@ -693,8 +694,17 @@ o:depends("advanced_log_feature", "1") o = s:taboption("log", Value, "log_event_cmd", translate("Shell Command"), translate("Shell command to execute, replace log content with %s.")) o:depends("advanced_log_feature", "1") -s:tab("faq", "FAQ") +o = s:taboption("log", Flag, "log_chinadns_ng", translate("Enable") .. " ChinaDNS-NG " .. translate("Log")) +o.default = "0" +o.rmempty = false + +o = s:taboption("log", DummyValue, "_log_tips", " ") +o.rawhtml = true +o.cfgvalue = function(t, n) + return string.format('%s', translate("It is recommended to disable logging during regular use to reduce system overhead.")) +end +s:tab("faq", "FAQ") o = s:taboption("faq", DummyValue, "") o.template = appname .. "/global/faq" @@ -728,7 +738,7 @@ o.rmempty = false o = s2:option(ListValue, "node", translate("Socks Node")) local n = 1 -uci:foreach(appname, "socks", function(s) +m.uci:foreach(appname, "socks", function(s) if s[".name"] == section then return false end diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua index effc8fa2d37..40a77bf8483 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/haproxy.lua @@ -1,8 +1,7 @@ local api = require "luci.passwall.api" local appname = "passwall" -local sys = api.sys -local net = require "luci.model.network".init() local datatypes = api.datatypes +local net = require "luci.model.network".init() local nodes_table = {} for k, e in ipairs(api.get_valid_nodes()) do diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua index b69cbefed94..d20d6e5e0c6 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua @@ -1,16 +1,13 @@ local api = require "luci.passwall.api" local appname = "passwall" -local uci = api.libuci -local fs = api.fs -local types_dir = "/usr/lib/lua/luci/model/cbi/passwall/client/type/" - -if not arg[1] or not uci:get(appname, arg[1]) then - luci.http.redirect(api.url("node_list")) -end m = Map(appname, translate("Node Config")) m.redirect = api.url() +if not arg[1] or not m:get(arg[1]) then + luci.http.redirect(api.url("node_list")) +end + s = m:section(NamedSection, arg[1], "nodes", "") s.addremove = false s.dynamic = false @@ -68,6 +65,9 @@ if api.is_finded("ipt2socks") then end end +local fs = api.fs +local types_dir = "/usr/lib/lua/luci/model/cbi/passwall/client/type/" + local type_table = {} for filename in fs.dir(types_dir) do table.insert(type_table, filename) diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua index 5c9abb15b5a..094b1dfd2ef 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua @@ -271,7 +271,7 @@ o.remove = function(self, section, value) fs.writefile(hosts, "") end -if api.fs.access(gfwlist_path) then +if fs.access(gfwlist_path) then s:tab("gfw_list", translate("GFW List")) o = s:taboption("gfw_list", DummyValue, "_gfw_fieldset") o.rawhtml = true @@ -284,7 +284,7 @@ if api.fs.access(gfwlist_path) then ]], translate("Read List")) end -if api.fs.access(chnlist_path) then +if fs.access(chnlist_path) then s:tab("chn_list", translate("China List") .. "(" .. translate("Domain") .. ")") o = s:taboption("chn_list", DummyValue, "_chn_fieldset") o.rawhtml = true @@ -297,7 +297,7 @@ if api.fs.access(chnlist_path) then ]], translate("Read List")) end -if api.fs.access(chnroute_path) then +if fs.access(chnroute_path) then s:tab("chnroute_list", translate("China List") .. "(IP)") o = s:taboption("chnroute_list", DummyValue, "_chnroute_fieldset") o.rawhtml = true diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua index 359ce024e06..fec3f5e894e 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/socks_config.lua @@ -1,6 +1,5 @@ local api = require "luci.passwall.api" local appname = "passwall" -local uci = api.libuci local has_singbox = api.finded_com("singbox") local has_xray = api.finded_com("xray") @@ -23,7 +22,7 @@ o.rmempty = false local auto_switch_tip local current_node = api.get_cache_var("socks_" .. arg[1]) if current_node then - local n = uci:get_all(appname, current_node) + local n = m:get(current_node) if n then if tonumber(m:get(arg[1], "enable_autoswitch") or 0) == 1 then if n then @@ -44,7 +43,7 @@ o = s:option(Flag, "bind_local", translate("Bind Local"), translate("When select o.default = "0" local n = 1 -uci:foreach(appname, "socks", function(s) +m.uci:foreach(appname, "socks", function(s) if s[".name"] == section then return false end @@ -124,6 +123,8 @@ for k, v in pairs(nodes_table) do socks_node:value(v.id, v["remark"]) end -m:append(Template(appname .. "/socks_auto_switch/footer")) +o = s:option(DummyValue, "btn", " ") +o.template = appname .. "/socks_auto_switch/btn" +o:depends("enable_autoswitch", true) return m diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua index f6b223f5234..028e120a1c8 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua @@ -8,7 +8,6 @@ end local appname = "passwall" local jsonc = api.jsonc -local uci = api.libuci local type_name = "Xray" @@ -19,7 +18,7 @@ local function _n(name) end local ss_method_list = { - "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" + "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "chacha20-ietf-poly1305", "xchacha20-poly1305", "xchacha20-ietf-poly1305", "2022-blake3-aes-128-gcm", "2022-blake3-aes-256-gcm", "2022-blake3-chacha20-poly1305" } local security_list = { "none", "auto", "aes-128-gcm", "chacha20-poly1305", "zero" } @@ -86,7 +85,7 @@ for k, e in ipairs(api.get_valid_nodes()) do end local socks_list = {} -uci:foreach(appname, "socks", function(s) +m.uci:foreach(appname, "socks", function(s) if s.enabled == "1" and s.node then socks_list[#socks_list + 1] = { id = "Socks_" .. s[".name"], @@ -181,7 +180,7 @@ if #nodes_table > 0 then o:value(v.id, v.remark) end end -uci:foreach(appname, "shunt_rules", function(e) +m.uci:foreach(appname, "shunt_rules", function(e) if e[".name"] and e.remarks then o = s:option(ListValue, _n(e[".name"]), string.format('* %s', api.url("shunt_rules", e[".name"]), e.remarks)) o:value("", translate("Close")) @@ -333,8 +332,10 @@ o:depends({ [_n("protocol")] = "shadowsocks" }) o = s:option(Flag, _n("reality"), translate("REALITY"), translate("Only recommend to use with VLESS-TCP-XTLS-Vision.")) o.default = 0 o:depends({ [_n("tls")] = true, [_n("transport")] = "raw" }) -o:depends({ [_n("tls")] = true, [_n("transport")] = "h2" }) +o:depends({ [_n("tls")] = true, [_n("transport")] = "ws" }) +o:depends({ [_n("tls")] = true, [_n("transport")] = "quic" }) o:depends({ [_n("tls")] = true, [_n("transport")] = "grpc" }) +o:depends({ [_n("tls")] = true, [_n("transport")] = "httpupgrade" }) o:depends({ [_n("tls")] = true, [_n("transport")] = "xhttp" }) o = s:option(ListValue, _n("alpn"), translate("alpn")) @@ -346,7 +347,7 @@ o:value("h3,h2") o:value("http/1.1") o:value("h2,http/1.1") o:value("h3,h2,http/1.1") -o:depends({ [_n("tls")] = true, [_n("reality")] = false }) +o:depends({ [_n("tls")] = true }) -- o = s:option(Value, _n("minversion"), translate("minversion")) -- o.default = "1.3" diff --git a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua index 1c30236838d..1314094f11c 100644 --- a/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua +++ b/applications/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua @@ -11,7 +11,6 @@ end local singbox_tags = luci.sys.exec(singbox_bin .. " version | grep 'Tags:' | awk '{print $2}'") local appname = "passwall" -local uci = api.libuci local type_name = "sing-box" @@ -83,7 +82,7 @@ for k, e in ipairs(api.get_valid_nodes()) do end local socks_list = {} -uci:foreach(appname, "socks", function(s) +m.uci:foreach(appname, "socks", function(s) if s.enabled == "1" and s.node then socks_list[#socks_list + 1] = { id = "Socks_" .. s[".name"], @@ -109,7 +108,7 @@ if #nodes_table > 0 then o:value(v.id, v.remark) end end -uci:foreach(appname, "shunt_rules", function(e) +m.uci:foreach(appname, "shunt_rules", function(e) if e[".name"] and e.remarks then o = s:option(ListValue, _n(e[".name"]), string.format('* %s', api.url("shunt_rules", e[".name"]), e.remarks)) o:value("", translate("Close")) diff --git a/applications/luci-app-passwall/luasrc/passwall/api.lua b/applications/luci-app-passwall/luasrc/passwall/api.lua index c866607ce01..3d9ac38822f 100644 --- a/applications/luci-app-passwall/luasrc/passwall/api.lua +++ b/applications/luci-app-passwall/luasrc/passwall/api.lua @@ -3,7 +3,7 @@ local com = require "luci.passwall.com" bin = require "nixio".bin fs = require "nixio.fs" sys = require "luci.sys" -libuci = require "uci".cursor() +uci = require "luci.model.uci".cursor() util = require "luci.util" datatypes = require "luci.cbi.datatypes" jsonc = require "luci.jsonc" @@ -30,49 +30,56 @@ function log(...) end end -function uci_set_list(cursor, config, section, option, value) - if config and section and option then - if not value or #value == 0 then - return cursor:delete(config, section, option) - end - return cursor:set( - config, section, option, - ( type(value) == "table" and value or { value } ) - ) - end - return false +function is_js_luci() + return sys.call('[ -f "/www/luci-static/resources/uci.js" ]') == 0 end -function uci_section(cursor, config, type, name, values) - local stat = true - if name then - stat = cursor:set(config, name, type) +function is_old_uci() + return sys.call("grep 'require \"uci\"' /usr/lib/lua/luci/model/uci.lua >/dev/null 2>&1") == 0 +end + +function uci_save(cursor, config, commit, apply) + if is_old_uci() then + cursor:save(config) + if commit then + cursor:commit(config) + if apply then + sys.call("/etc/init.d/" .. config .. " reload > /dev/null 2>&1 &") + end + end else - name = cursor:add(config, type) - stat = name and true + commit = true + if commit then + if apply then + cursor:commit(config) + else + sh_uci_commit(config) + end + end end - - return stat and name end function sh_uci_get(config, section, option) exec_call(string.format("uci -q get %s.%s.%s", config, section, option)) - exec_call(string.format("uci -q commit %s", config)) end -function sh_uci_set(config, section, option, val) +function sh_uci_set(config, section, option, val, commit) exec_call(string.format("uci -q set %s.%s.%s=\"%s\"", config, section, option, val)) - exec_call(string.format("uci -q commit %s", config)) + if commit then sh_uci_commit(config) end end -function sh_uci_del(config, section, option) +function sh_uci_del(config, section, option, commit) exec_call(string.format("uci -q delete %s.%s.%s", config, section, option)) - exec_call(string.format("uci -q commit %s", config)) + if commit then sh_uci_commit(config) end end -function sh_uci_add_list(config, section, option, val) +function sh_uci_add_list(config, section, option, val, commit) exec_call(string.format("uci -q del_list %s.%s.%s=\"%s\"", config, section, option, val)) exec_call(string.format("uci -q add_list %s.%s.%s=\"%s\"", config, section, option, val)) + if commit then sh_uci_commit(config) end +end + +function sh_uci_commit(config) exec_call(string.format("uci -q commit %s", config)) end @@ -175,7 +182,7 @@ end function curl_direct(url, file, args) --直连访问 - local chn_list = libuci:get(appname, "@global[0]", "chn_list") or "direct" + local chn_list = uci:get(appname, "@global[0]", "chn_list") or "direct" local Dns = (chn_list == "proxy") and "1.1.1.1" or "223.5.5.5" if not args then args = {} end local tmp_args = clone(args) @@ -419,30 +426,10 @@ function get_domain_from_url(url) return url end -function get_node_name(node_id) - local e - if type(node_id) == "table" then - e = node_id - else - e = libuci:get_all(appname, node_id) - end - if e then - if e.type and e.remarks then - if e.protocol and (e.protocol == "_balancing" or e.protocol == "_shunt" or e.protocol == "_iface") then - local type = e.type - if type == "sing-box" then type = "Sing-Box" end - local remark = "%s：[%s] " % {type .. " " .. i18n.translatef(e.protocol), e.remarks} - return remark - end - end - end - return "" -end - function get_valid_nodes() local show_node_info = uci_get_type("@global_other[0]", "show_node_info", "0") local nodes = {} - libuci:foreach(appname, "nodes", function(e) + uci:foreach(appname, "nodes", function(e) e.id = e[".name"] if e.type and e.remarks then if e.protocol and (e.protocol == "_balancing" or e.protocol == "_shunt" or e.protocol == "_iface") then @@ -539,7 +526,7 @@ function gen_short_uuid() end function uci_get_type(type, config, default) - local value = libuci:get(appname, type, config) or default + local value = uci:get(appname, type, config) or default if (value == nil or value == "") and (default and default ~= "") then value = default end diff --git a/applications/luci-app-passwall/luasrc/passwall/server_app.lua b/applications/luci-app-passwall/luasrc/passwall/server_app.lua index ef267c649aa..50357056b6f 100755 --- a/applications/luci-app-passwall/luasrc/passwall/server_app.lua +++ b/applications/luci-app-passwall/luasrc/passwall/server_app.lua @@ -3,7 +3,7 @@ local action = arg[1] local api = require "luci.passwall.api" local sys = api.sys -local uci = api.libuci +local uci = api.uci local jsonc = api.jsonc local CONFIG = "passwall_server" diff --git a/applications/luci-app-passwall/luasrc/passwall/util_hysteria2.lua b/applications/luci-app-passwall/luasrc/passwall/util_hysteria2.lua index 12afe6874b6..b818aadbfb0 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_hysteria2.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_hysteria2.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_hysteria2", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local jsonc = api.jsonc function gen_config_server(node) diff --git a/applications/luci-app-passwall/luasrc/passwall/util_naiveproxy.lua b/applications/luci-app-passwall/luasrc/passwall/util_naiveproxy.lua index b6ef39b3bfe..ee095c1e6c1 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_naiveproxy.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_naiveproxy.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_naiveproxy", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local jsonc = api.jsonc function gen_config(var) diff --git a/applications/luci-app-passwall/luasrc/passwall/util_shadowsocks.lua b/applications/luci-app-passwall/luasrc/passwall/util_shadowsocks.lua index 5e724e77ba5..e6080001b85 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_shadowsocks.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_shadowsocks.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_shadowsocks", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local jsonc = api.jsonc function gen_config_server(node) diff --git a/applications/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/applications/luci-app-passwall/luasrc/passwall/util_sing-box.lua index 7db399325ab..af640e77f31 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_sing-box.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_sing-box.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_sing-box", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local sys = api.sys local jsonc = api.jsonc local appname = "passwall" diff --git a/applications/luci-app-passwall/luasrc/passwall/util_trojan.lua b/applications/luci-app-passwall/luasrc/passwall/util_trojan.lua index 31bd67a4a35..848b689a560 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_trojan.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_trojan.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_trojan", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local json = api.jsonc function gen_config_server(node) diff --git a/applications/luci-app-passwall/luasrc/passwall/util_tuic.lua b/applications/luci-app-passwall/luasrc/passwall/util_tuic.lua index be00dcb8cf3..e138b6da56b 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_tuic.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_tuic.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_tuic", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local json = api.jsonc function gen_config(var) diff --git a/applications/luci-app-passwall/luasrc/passwall/util_xray.lua b/applications/luci-app-passwall/luasrc/passwall/util_xray.lua index d26ac1b1231..828b7681f75 100644 --- a/applications/luci-app-passwall/luasrc/passwall/util_xray.lua +++ b/applications/luci-app-passwall/luasrc/passwall/util_xray.lua @@ -1,6 +1,6 @@ module("luci.passwall.util_xray", package.seeall) local api = require "luci.passwall.api" -local uci = api.libuci +local uci = api.uci local sys = api.sys local jsonc = api.jsonc local appname = "passwall" @@ -246,7 +246,9 @@ function gen_outbound(flag, node, tag, proxy_table) { address = node.address, port = tonumber(node.port), - method = node.method or nil, + method = (node.method == "chacha20-ietf-poly1305" and "chacha20-poly1305") or + (node.method == "xchacha20-ietf-poly1305" and "xchacha20-poly1305") or + (node.method ~= "" and node.method) or nil, ivCheck = (node.protocol == "shadowsocks") and node.iv_check == "1" or nil, uot = (node.protocol == "shadowsocks") and node.uot == "1" or nil, password = node.password or "", @@ -653,11 +655,21 @@ function gen_config(var) } } if inbound.sniffing.enabled == true then - inbound.sniffing.destOverride = {"http", "tls", "quic", (remote_dns_fake) and "fakedns"} + inbound.sniffing.destOverride = {"http", "tls", "quic"} inbound.sniffing.metadataOnly = false inbound.sniffing.routeOnly = xray_settings.sniffing_override_dest ~= "1" or nil inbound.sniffing.domainsExcluded = xray_settings.sniffing_override_dest == "1" and get_domain_excluded() or nil end + if remote_dns_fake then + inbound.sniffing.enabled = true + if not inbound.sniffing.destOverride then + inbound.sniffing.destOverride = {"fakedns"} + inbound.sniffing.metadataOnly = true + else + table.insert(inbound.sniffing.destOverride, "fakedns") + inbound.sniffing.metadataOnly = false + end + end if tcp_redir_port then local tcp_inbound = api.clone(inbound) diff --git a/applications/luci-app-passwall/luasrc/view/passwall/acl/footer.htm b/applications/luci-app-passwall/luasrc/view/passwall/acl/footer.htm new file mode 100644 index 00000000000..6026e6dc92f --- /dev/null +++ b/applications/luci-app-passwall/luasrc/view/passwall/acl/footer.htm @@ -0,0 +1,41 @@ +<% +local api = require "luci.passwall.api" +-%> + diff --git a/applications/luci-app-passwall/luasrc/view/passwall/global/footer.htm b/applications/luci-app-passwall/luasrc/view/passwall/global/footer.htm index c51fdfcdebf..058bf1c7a34 100644 --- a/applications/luci-app-passwall/luasrc/view/passwall/global/footer.htm +++ b/applications/luci-app-passwall/luasrc/view/passwall/global/footer.htm @@ -148,5 +148,33 @@ } setTimeout("go()", 1000); + document.addEventListener("DOMContentLoaded", function () { + setTimeout(function () { + var selects = document.querySelectorAll("select[id*='dns_shunt']"); + selects.forEach(function (select, index) { + if (select.value === "chinadns-ng") { + addLogLink(select); + } + select.addEventListener("change", function () { + var existingLogLink = select.parentElement.querySelector("a.log-link"); + if (existingLogLink) { + existingLogLink.remove(); + } + if (select.value === "chinadns-ng") { + addLogLink(select); + } + }); + }); + function addLogLink(select) { + var logLink = document.createElement("a"); + logLink.innerHTML = "<%:Log%>"; + logLink.href = "#"; + logLink.className = "log-link"; + logLink.style.marginLeft = "10px"; + logLink.setAttribute("onclick", "window.open('" + '<%=api.url("get_chinadns_log")%>' + "?flag=default', '_blank')"); + select.insertAdjacentElement("afterend", logLink); + } + }, 1000); + }); //]]> diff --git a/applications/luci-app-passwall/luasrc/view/passwall/global/status.htm b/applications/luci-app-passwall/luasrc/view/passwall/global/status.htm index 8fb6ac95361..5b5cb72c840 100644 --- a/applications/luci-app-passwall/luasrc/view/passwall/global/status.htm +++ b/applications/luci-app-passwall/luasrc/view/passwall/global/status.htm @@ -138,7 +138,7 @@

<%:Load Balancing%>
<%:NOT RUNNIN -
+
@@ -150,7 +150,7 @@

<%:Baidu Connection%>

-
+
@@ -162,7 +162,7 @@

<%:Google Connection%>

-
+
@@ -174,7 +174,7 @@

<%:GitHub Connection%>

-
+
diff --git a/applications/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm b/applications/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm index 777afab83be..08d54e499a6 100644 --- a/applications/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm +++ b/applications/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm @@ -1,12 +1,24 @@ <%+cbi/valueheader%> <% local api = require "luci.passwall.api" +local appname = 'passwall' +local map = self.map +local ss_type = map:get("@global_subscribe[0]", "ss_type") or "xray" +local trojan_type = map:get("@global_subscribe[0]", "trojan_type") or "xray" +local vmess_type = map:get("@global_subscribe[0]", "vmess_type") or "xray" +local vless_type = map:get("@global_subscribe[0]", "vless_type") or "xray" +local hysteria2_type = map:get("@global_subscribe[0]", "hysteria2_type") or "sing-box" -%> - - +
" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>"> + +
+ + +
+
diff --git a/applications/luci-app-passwall/po/zh_Hans/passwall.po b/applications/luci-app-passwall/po/zh_Hans/passwall.po index 42884cf4191..92144fb2219 100644 --- a/applications/luci-app-passwall/po/zh_Hans/passwall.po +++ b/applications/luci-app-passwall/po/zh_Hans/passwall.po @@ -1510,6 +1510,9 @@ msgstr "要执行的 Shell 命令，用 %s 代替日志内容。" msgid "Not enabled log" msgstr "未启用日志" +msgid "It is recommended to disable logging during regular use to reduce system overhead." +msgstr "正常使用时建议关闭日志，以减少系统开销。" + msgid "UDP Forward" msgstr "UDP 转发" diff --git a/applications/luci-app-passwall/root/usr/share/passwall/0_default_config b/applications/luci-app-passwall/root/usr/share/passwall/0_default_config index 551c824f960..acacfedbd5b 100644 --- a/applications/luci-app-passwall/root/usr/share/passwall/0_default_config +++ b/applications/luci-app-passwall/root/usr/share/passwall/0_default_config @@ -21,10 +21,11 @@ config global option localhost_proxy '1' option client_proxy '1' option acl_enable '0' - option log_tcp '1' - option log_udp '1' + option log_tcp '0' + option log_udp '0' option loglevel 'error' option trojan_loglevel '4' + option log_chinadns_ng '0' config global_haproxy option balancing_enable '0' diff --git a/applications/luci-app-passwall/root/usr/share/passwall/app.sh b/applications/luci-app-passwall/root/usr/share/passwall/app.sh index 8dff1270ba6..2a44debe054 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/applications/luci-app-passwall/root/usr/share/passwall/app.sh @@ -1,6 +1,6 @@ #!/bin/sh # Copyright (C) 2018-2020 L-WRT Team -# Copyright (C) 2021-2023 xiaorouji +# Copyright (C) 2021-2025 xiaorouji . $IPKG_INSTROOT/lib/functions.sh . $IPKG_INSTROOT/lib/functions/service.sh @@ -17,17 +17,6 @@ GLOBAL_ACL_PATH=${TMP_ACL_PATH}/default LOG_FILE=/tmp/log/$CONFIG.log APP_PATH=/usr/share/$CONFIG RULES_PATH=/usr/share/${CONFIG}/rules -DNS_PORT=15353 -TUN_DNS="127.0.0.1#${DNS_PORT}" -LOCAL_DNS=119.29.29.29,223.5.5.5 -DEFAULT_DNS= -IPT_APPEND_DNS= -ENABLED_DEFAULT_ACL=0 -PROXY_IPV6=0 -PROXY_IPV6_UDP=0 -resolve_dns=0 -use_tcp_node_resolve_dns=0 -use_udp_node_resolve_dns=0 LUA_UTIL_PATH=/usr/lib/lua/luci/passwall UTIL_SINGBOX=$LUA_UTIL_PATH/util_sing-box.lua UTIL_SS=$LUA_UTIL_PATH/util_shadowsocks.lua @@ -296,7 +285,10 @@ ln_run() { fi #echo "${file_func} $*" >&2 [ -n "${file_func}" ] || echolog " - 找不到 ${ln_name}，无法启动..." - [ "${output}" != "/dev/null" ] && local persist_log_path=$(config_t_get global persist_log_path) && local sys_log=$(config_t_get global sys_log "0") + [ "${output}" != "/dev/null" ] && [ "${ln_name}" != "chinadns-ng" ] && { + local persist_log_path=$(config_t_get global persist_log_path) + local sys_log=$(config_t_get global sys_log "0") + } if [ -z "$persist_log_path" ] && [ "$sys_log" != "1" ]; then ${file_func:-echolog " - ${ln_name}"} "$@" >${output} 2>&1 & else @@ -376,7 +368,11 @@ set_cache_var() { local key="${1}" shift 1 local val="$@" - [ -n "${key}" ] && [ -n "${val}" ] && echo "${key}=\"${val}\"" >> $TMP_PATH/var + [ -n "${key}" ] && [ -n "${val}" ] && { + sed -i "/${key}=/d" $TMP_PATH/var >/dev/null 2>&1 + echo "${key}=\"${val}\"" >> $TMP_PATH/var + eval ${key}=\"${val}\" + } } get_cache_var() { @@ -386,6 +382,10 @@ get_cache_var() { } } +eval_cache_var() { + [ -s "$TMP_PATH/var" ] && eval $(cat "$TMP_PATH/var") +} + run_ipt2socks() { local flag proto tcp_tproxy local_port socks_address socks_port socks_username socks_password log_file local _extra_param="" @@ -412,8 +412,8 @@ run_ipt2socks() { } run_singbox() { - local flag type node tcp_redir_port udp_redir_port socks_address socks_port socks_username socks_password http_address http_port http_username http_password - local dns_listen_port direct_dns_port direct_dns_udp_server direct_dns_tcp_server direct_dns_dot_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port + local flag type node tcp_redir_port tcp_proxy_way udp_redir_port socks_address socks_port socks_username socks_password http_address http_port http_username http_password + local dns_listen_port direct_dns_query_strategy direct_dns_port direct_dns_udp_server direct_dns_tcp_server direct_dns_dot_server remote_dns_protocol remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port local loglevel log_file config_file server_host server_port local _extra_param="" eval_set_val $@ @@ -443,6 +443,7 @@ run_singbox() { [ -n "$server_host" ] && _extra_param="${_extra_param} -server_host $server_host" [ -n "$server_port" ] && _extra_param="${_extra_param} -server_port $server_port" [ -n "$tcp_redir_port" ] && _extra_param="${_extra_param} -tcp_redir_port $tcp_redir_port" + [ -n "$tcp_proxy_way" ] && _extra_param="${_extra_param} -tcp_proxy_way $tcp_proxy_way" [ -n "$udp_redir_port" ] && _extra_param="${_extra_param} -udp_redir_port $udp_redir_port" [ -n "$socks_address" ] && _extra_param="${_extra_param} -local_socks_address $socks_address" [ -n "$socks_port" ] && _extra_param="${_extra_param} -local_socks_port $socks_port" @@ -469,7 +470,8 @@ run_singbox() { direct_dns_port=$(echo ${local_dns} | awk -F '#' '{print $2}') fi _extra_param="${_extra_param} -direct_dns_port ${direct_dns_port:-53}" - _extra_param="${_extra_param} -direct_dns_query_strategy ${DIRECT_DNS_QUERY_STRATEGY}" + direct_dns_query_strategy=${direct_dns_query_strategy:-UseIP} + _extra_param="${_extra_param} -direct_dns_query_strategy ${direct_dns_query_strategy}" [ -n "$remote_dns_query_strategy" ] && _extra_param="${_extra_param} -remote_dns_query_strategy ${remote_dns_query_strategy}" case "$remote_dns_protocol" in @@ -488,14 +490,13 @@ run_singbox() { esac [ -n "$remote_dns_client_ip" ] && _extra_param="${_extra_param} -remote_dns_client_ip ${remote_dns_client_ip}" [ "$remote_fakedns" = "1" ] && _extra_param="${_extra_param} -remote_dns_fake 1" - _extra_param="${_extra_param} -tcp_proxy_way $tcp_proxy_way" lua $UTIL_SINGBOX gen_config ${_extra_param} > $config_file ln_run "$(first_type $(config_t_get global_app singbox_file) sing-box)" "sing-box" $log_file run -c "$config_file" } run_xray() { - local flag type node tcp_redir_port udp_redir_port socks_address socks_port socks_username socks_password http_address http_port http_username http_password - local dns_listen_port remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port + local flag type node tcp_redir_port tcp_proxy_way udp_redir_port socks_address socks_port socks_username socks_password http_address http_port http_username http_password + local dns_listen_port direct_dns_query_strategy remote_dns_udp_server remote_dns_tcp_server remote_dns_doh remote_dns_client_ip remote_fakedns remote_dns_query_strategy dns_cache dns_socks_address dns_socks_port local loglevel log_file config_file server_host server_port local _extra_param="" eval_set_val $@ @@ -514,6 +515,7 @@ run_xray() { [ -n "$server_host" ] && _extra_param="${_extra_param} -server_host $server_host" [ -n "$server_port" ] && _extra_param="${_extra_param} -server_port $server_port" [ -n "$tcp_redir_port" ] && _extra_param="${_extra_param} -tcp_redir_port $tcp_redir_port" + [ -n "$tcp_proxy_way" ] && _extra_param="${_extra_param} -tcp_proxy_way $tcp_proxy_way" [ -n "$udp_redir_port" ] && _extra_param="${_extra_param} -udp_redir_port $udp_redir_port" [ -n "$socks_address" ] && _extra_param="${_extra_param} -local_socks_address $socks_address" [ -n "$socks_port" ] && _extra_param="${_extra_param} -local_socks_port $socks_port" @@ -523,7 +525,8 @@ run_xray() { [ -n "$http_username" ] && [ -n "$http_password" ] && _extra_param="${_extra_param} -local_http_username $http_username -local_http_password $http_password" [ -n "$dns_socks_address" ] && [ -n "$dns_socks_port" ] && _extra_param="${_extra_param} -dns_socks_address ${dns_socks_address} -dns_socks_port ${dns_socks_port}" [ -n "$dns_listen_port" ] && _extra_param="${_extra_param} -dns_listen_port ${dns_listen_port}" - _extra_param="${_extra_param} -direct_dns_query_strategy ${DIRECT_DNS_QUERY_STRATEGY}" + direct_dns_query_strategy=${direct_dns_query_strategy:-UseIP} + _extra_param="${_extra_param} -direct_dns_query_strategy ${direct_dns_query_strategy}" [ -n "$remote_dns_query_strategy" ] && _extra_param="${_extra_param} -remote_dns_query_strategy ${remote_dns_query_strategy}" [ -n "$remote_dns_client_ip" ] && _extra_param="${_extra_param} -remote_dns_client_ip ${remote_dns_client_ip}" [ "$remote_fakedns" = "1" ] && _extra_param="${_extra_param} -remote_dns_fake 1" @@ -540,7 +543,6 @@ run_xray() { [ -n "$_doh_bootstrap" ] && _extra_param="${_extra_param} -remote_dns_doh_ip ${_doh_bootstrap}" _extra_param="${_extra_param} -remote_dns_doh_port ${_doh_port} -remote_dns_doh_url ${_doh_url} -remote_dns_doh_host ${_doh_host}" } - _extra_param="${_extra_param} -tcp_proxy_way $tcp_proxy_way" _extra_param="${_extra_param} -loglevel $loglevel" lua $UTIL_XRAY gen_config ${_extra_param} > $config_file ln_run "$(first_type $(config_t_get global_app ${type}_file) ${type})" ${type} $log_file run -c "$config_file" @@ -570,13 +572,14 @@ run_chinadns_ng() { eval_set_val $@ local _CONF_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.conf - local _LOG_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.log - _LOG_FILE="/dev/null" + local _LOG_FILE="/dev/null" + [ "$(config_t_get global log_chinadns_ng "0")" == "1" ] && _LOG_FILE=$TMP_ACL_PATH/$_flag/chinadns_ng.log _extra_param="-FLAG ${_flag} -TCP_NODE ${_tcp_node} -LISTEN_PORT ${_listen_port} -DNS_LOCAL ${_dns_local} -DNS_TRUST ${_dns_trust}" _extra_param="${_extra_param} -USE_DIRECT_LIST ${_use_direct_list} -USE_PROXY_LIST ${_use_proxy_list} -USE_BLOCK_LIST ${_use_block_list}" _extra_param="${_extra_param} -GFWLIST ${_gfwlist} -CHNLIST ${_chnlist} -NO_IPV6_TRUST ${_no_ipv6_trust} -DEFAULT_MODE ${_default_mode}" _extra_param="${_extra_param} -DEFAULT_TAG ${_default_tag} -NFTFLAG ${nftflag} -NO_LOGIC_LOG ${_no_logic_log} -REMOTE_FAKEDNS ${_remote_fakedns}" + _extra_param="${_extra_param} -LOG_FILE ${_LOG_FILE}" lua $APP_PATH/helper_chinadns_add.lua ${_extra_param} > ${_CONF_FILE} ln_run "$(first_type chinadns-ng)" chinadns-ng "${_LOG_FILE}" -C ${_CONF_FILE} @@ -758,7 +761,6 @@ run_redir() { } } [ "$bind" != "127.0.0.1" ] && echolog "${PROTO}节点：[$remarks]，监听端口：$local_port" - set_cache_var "${PROTO}_NODE_PORT" "${port}" case "$PROTO" in UDP) @@ -816,12 +818,11 @@ run_redir() { [ "$tcp_node_http_port" != "0" ] && tcp_node_http=1 if [ $PROXY_IPV6 == "1" ]; then echolog "开启实验性IPv6透明代理(TProxy)，请确认您的节点及类型支持IPv6！" - PROXY_IPV6_UDP=1 fi - if [ "$tcp_proxy_way" = "redirect" ]; then + if [ "${TCP_PROXY_WAY}" = "redirect" ]; then can_ipt=$(echo "$REDIRECT_LIST" | grep "$type") - elif [ "$tcp_proxy_way" = "tproxy" ]; then + elif [ "${TCP_PROXY_WAY}" = "tproxy" ]; then can_ipt=$(echo "$TPROXY_LIST" | grep "$type") fi [ -z "$can_ipt" ] && type="socks" @@ -875,14 +876,14 @@ run_redir() { } [ "${DNS_MODE}" = "sing-box" ] && { - resolve_dns=1 + NO_PLUGIN_DNS=1 config_file=$(echo $config_file | sed "s/.json/_DNS.json/g") _args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}" DNSMASQ_FILTER_PROXY_IPV6=0 local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip) [ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}" [ "${DNS_CACHE}" == "0" ] && _args="${_args} dns_cache=0" - resolve_dns_port=${dns_listen_port} + resolve_dns_port=${NEXT_DNS_LISTEN_PORT} _args="${_args} dns_listen_port=${resolve_dns_port}" case "$(config_t_get global direct_dns_mode "auto")" in @@ -918,9 +919,9 @@ run_redir() { _args="${_args} remote_fakedns=1" resolve_dns_log="${resolve_dns_log} + FakeDNS" } - dns_listen_port=$(expr $dns_listen_port + 1) + NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1) } - run_singbox flag=$_flag node=$node tcp_redir_port=$local_port config_file=$config_file log_file=$log_file ${_args} + run_singbox flag=$_flag node=$node tcp_redir_port=$local_port tcp_proxy_way=$TCP_PROXY_WAY config_file=$config_file log_file=$log_file ${_args} ;; xray) local _flag="TCP" @@ -953,14 +954,14 @@ run_redir() { } [ "${DNS_MODE}" = "xray" ] && { - resolve_dns=1 + NO_PLUGIN_DNS=1 config_file=$(echo $config_file | sed "s/.json/_DNS.json/g") _args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}" DNSMASQ_FILTER_PROXY_IPV6=0 local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip) [ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}" [ "${DNS_CACHE}" == "0" ] && _args="${_args} dns_cache=0" - resolve_dns_port=${dns_listen_port} + resolve_dns_port=${NEXT_DNS_LISTEN_PORT} _args="${_args} dns_listen_port=${resolve_dns_port}" _args="${_args} remote_dns_tcp_server=${REMOTE_DNS}" if [ "$v2ray_dns_mode" = "tcp+doh" ]; then @@ -976,12 +977,12 @@ run_redir() { _args="${_args} remote_fakedns=1" resolve_dns_log="${resolve_dns_log} + FakeDNS" } - dns_listen_port=$(expr $dns_listen_port + 1) + NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1) } - run_xray flag=$_flag node=$node tcp_redir_port=$local_port config_file=$config_file log_file=$log_file ${_args} + run_xray flag=$_flag node=$node tcp_redir_port=$local_port tcp_proxy_way=$TCP_PROXY_WAY config_file=$config_file log_file=$log_file ${_args} ;; trojan*) - [ "$tcp_proxy_way" = "tproxy" ] && lua_tproxy_arg="-use_tproxy true" + [ "${TCP_PROXY_WAY}" = "tproxy" ] && lua_tproxy_arg="-use_tproxy true" [ "$TCP_UDP" = "1" ] && { config_file=$(echo $config_file | sed "s/TCP/TCP_UDP/g") UDP_REDIR_PORT=$TCP_REDIR_PORT @@ -996,7 +997,7 @@ run_redir() { ln_run "$(first_type naive)" naive $log_file "$config_file" ;; ssr) - [ "$tcp_proxy_way" = "tproxy" ] && lua_tproxy_arg="-tcp_tproxy true" + [ "${TCP_PROXY_WAY}" = "tproxy" ] && lua_tproxy_arg="-tcp_tproxy true" [ "$TCP_UDP" = "1" ] && { config_file=$(echo $config_file | sed "s/TCP/TCP_UDP/g") UDP_REDIR_PORT=$TCP_REDIR_PORT @@ -1007,7 +1008,7 @@ run_redir() { ln_run "$(first_type ssr-redir)" "ssr-redir" $log_file -c "$config_file" -v ${_extra_param} ;; ss) - [ "$tcp_proxy_way" = "tproxy" ] && lua_tproxy_arg="-tcp_tproxy true" + [ "${TCP_PROXY_WAY}" = "tproxy" ] && lua_tproxy_arg="-tcp_tproxy true" lua_mode_arg="-mode tcp_only" [ "$TCP_UDP" = "1" ] && { config_file=$(echo $config_file | sed "s/TCP/TCP_UDP/g") @@ -1020,7 +1021,7 @@ run_redir() { ;; ss-rust) local _extra_param="-local_tcp_redir_port $local_port" - [ "$tcp_proxy_way" = "tproxy" ] && _extra_param="${_extra_param} -tcp_tproxy true" + [ "${TCP_PROXY_WAY}" = "tproxy" ] && _extra_param="${_extra_param} -tcp_tproxy true" [ "$tcp_node_socks" = "1" ] && { tcp_node_socks_flag=1 config_file=$(echo $config_file | sed "s/TCP/TCP_SOCKS/g") @@ -1058,7 +1059,7 @@ run_redir() { unset UDP_NODE _extra_param="${_extra_param} -local_udp_redir_port $local_port" } - _extra_param="${_extra_param} -tcp_proxy_way $tcp_proxy_way" + _extra_param="${_extra_param} -tcp_proxy_way ${TCP_PROXY_WAY}" lua $UTIL_HYSTERIA2 gen_config -node $node ${_extra_param} > $config_file ln_run "$(first_type $(config_t_get global_app hysteria_file))" "hysteria" $log_file -c "$config_file" client ;; @@ -1071,7 +1072,7 @@ run_redir() { unset UDP_NODE } local _socks_tproxy="" - [ "$tcp_proxy_way" = "tproxy" ] && _socks_tproxy="1" + [ "${TCP_PROXY_WAY}" = "tproxy" ] && _socks_tproxy="1" run_ipt2socks flag=default proto=${_flag} tcp_tproxy=${_socks_tproxy} local_port=${local_port} socks_address=${_socks_address} socks_port=${_socks_port} socks_username=${_socks_username} socks_password=${_socks_password} log_file=${log_file} fi @@ -1352,12 +1353,12 @@ start_dns() { #当全局（包括访问控制节点）开启chinadns-ng时，不启动新进程。 [ "$DNS_SHUNT" != "chinadns-ng" ] || [ "$ACL_RULE_DNSMASQ" = "1" ] && { - LOCAL_DNS="127.0.0.1#${dns_listen_port}" + LOCAL_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}" local china_ng_c_dns="tcp://$(get_first_dns DIRECT_DNS 53 | sed 's/:/#/g')" - ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b 127.0.0.1 -l ${dns_listen_port} -c ${china_ng_c_dns} -d chn + ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b 127.0.0.1 -l ${NEXT_DNS_LISTEN_PORT} -c ${china_ng_c_dns} -d chn echolog " - ChinaDNS-NG(${LOCAL_DNS}) -> ${china_ng_c_dns}" echolog " * 请确保上游直连 DNS 支持 TCP 查询。" - dns_listen_port=$(expr $dns_listen_port + 1) + NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1) } ;; dot) @@ -1367,11 +1368,11 @@ start_dns() { #当全局（包括访问控制节点）开启chinadns-ng时，不启动新进程。 [ "$DNS_SHUNT" != "chinadns-ng" ] || [ "$ACL_RULE_DNSMASQ" = "1" ] && { - LOCAL_DNS="127.0.0.1#${dns_listen_port}" - ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b 127.0.0.1 -l ${dns_listen_port} -c ${DIRECT_DNS} -d chn + LOCAL_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}" + ln_run "$(first_type chinadns-ng)" chinadns-ng "/dev/null" -b 127.0.0.1 -l ${NEXT_DNS_LISTEN_PORT} -c ${DIRECT_DNS} -d chn echolog " - ChinaDNS-NG(${LOCAL_DNS}) -> ${DIRECT_DNS}" echolog " * 请确保上游直连 DNS 支持 DoT 查询。" - dns_listen_port=$(expr $dns_listen_port + 1) + NEXT_DNS_LISTEN_PORT=$(expr $NEXT_DNS_LISTEN_PORT + 1) } local tmp_dot_ip=$(echo "$DIRECT_DNS" | sed -n 's/.*:\/\/\([^@#]*@\)*\([^@#]*\).*/\2/p') @@ -1403,30 +1404,31 @@ start_dns() { # 排除127.0.0.1的条目 IPT_APPEND_DNS=$(echo "$IPT_APPEND_DNS" | awk -F',' '{for(i=1;i<=NF;i++) if($i !~ /^127\.0\.0\.1/) printf (i>1?",":"") $i; print ""}' | sed 's/^,\|,$//g') - TUN_DNS="127.0.0.1#${dns_listen_port}" - [ "${resolve_dns}" == "1" ] && TUN_DNS="127.0.0.1#${resolve_dns_port}" + TUN_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}" + [ -n "${NO_PLUGIN_DNS}" ] && TUN_DNS="127.0.0.1#${resolve_dns_port}" case "$DNS_MODE" in dns2socks) local dns2socks_socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:1080) | sed "s/#/:/g") local dns2socks_forward=$(get_first_dns REMOTE_DNS 53 | sed 's/#/:/g') - run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${dns_listen_port} dns=$dns2socks_forward cache=$DNS_CACHE + run_dns2socks socks=$dns2socks_socks_server listen_address=127.0.0.1 listen_port=${NEXT_DNS_LISTEN_PORT} dns=$dns2socks_forward cache=$DNS_CACHE echolog " - dns2socks(${TUN_DNS})，${dns2socks_socks_server} -> tcp://${dns2socks_forward}" ;; sing-box) - [ "${resolve_dns}" == "0" ] && { + [ -z "${NO_PLUGIN_DNS}" ] && { local config_file=$TMP_PATH/DNS.json local log_file=$TMP_PATH/DNS.log local log_file=/dev/null local _args="type=$DNS_MODE config_file=$config_file log_file=$log_file" [ "${DNS_CACHE}" == "0" ] && _args="${_args} dns_cache=0" + _args="${_args} direct_dns_query_strategy=${DIRECT_DNS_QUERY_STRATEGY}" _args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}" DNSMASQ_FILTER_PROXY_IPV6=0 local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip) [ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}" - use_tcp_node_resolve_dns=1 + TCP_PROXY_DNS=1 local v2ray_dns_mode=$(config_t_get global v2ray_dns_mode tcp) - _args="${_args} dns_listen_port=${dns_listen_port}" + _args="${_args} dns_listen_port=${NEXT_DNS_LISTEN_PORT}" _args="${_args} remote_dns_protocol=${v2ray_dns_mode}" case "$v2ray_dns_mode" in tcp) @@ -1449,18 +1451,19 @@ start_dns() { } ;; xray) - [ "${resolve_dns}" == "0" ] && { + [ -z "${NO_PLUGIN_DNS}" ] && { local config_file=$TMP_PATH/DNS.json local log_file=$TMP_PATH/DNS.log local log_file=/dev/null local _args="type=$DNS_MODE config_file=$config_file log_file=$log_file" [ "${DNS_CACHE}" == "0" ] && _args="${_args} dns_cache=0" + _args="${_args} direct_dns_query_strategy=${DIRECT_DNS_QUERY_STRATEGY}" _args="${_args} remote_dns_query_strategy=${REMOTE_DNS_QUERY_STRATEGY}" DNSMASQ_FILTER_PROXY_IPV6=0 local _remote_dns_client_ip=$(config_t_get global remote_dns_client_ip) [ -n "${_remote_dns_client_ip}" ] && _args="${_args} remote_dns_client_ip=${_remote_dns_client_ip}" - use_tcp_node_resolve_dns=1 - _args="${_args} dns_listen_port=${dns_listen_port}" + TCP_PROXY_DNS=1 + _args="${_args} dns_listen_port=${NEXT_DNS_LISTEN_PORT}" _args="${_args} remote_dns_tcp_server=${REMOTE_DNS}" local v2ray_dns_mode=$(config_t_get global v2ray_dns_mode tcp) if [ "$v2ray_dns_mode" = "tcp+doh" ]; then @@ -1479,9 +1482,9 @@ start_dns() { } ;; dot) - use_tcp_node_resolve_dns=1 + TCP_PROXY_DNS=1 if [ "$chinadns_tls" != "nil" ]; then - local china_ng_listen_port=${dns_listen_port} + local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT} local china_ng_trust_dns=$(config_t_get global remote_dns_dot "tls://dns.google@8.8.4.4") local tmp_dot_ip=$(echo "$china_ng_trust_dns" | sed -n 's/.*:\/\/\([^@#]*@\)*\([^@#]*\).*/\2/p') local tmp_dot_port=$(echo "$china_ng_trust_dns" | sed -n 's/.*#\([0-9]\+\).*/\1/p') @@ -1494,7 +1497,7 @@ start_dns() { else echolog " - 你的ChinaDNS-NG版本不支持DoT，远程DNS将默认使用tcp://1.1.1.1" REMOTE_DNS="1.1.1.1" - local china_ng_listen_port=${dns_listen_port} + local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT} local china_ng_trust_dns="tcp://${REMOTE_DNS}" [ "$DNS_SHUNT" != "chinadns-ng" ] && { [ "$FILTER_PROXY_IPV6" = "1" ] && DNSMASQ_FILTER_PROXY_IPV6=0 && local no_ipv6_trust="-N" @@ -1504,8 +1507,8 @@ start_dns() { fi ;; udp) - use_udp_node_resolve_dns=1 - local china_ng_listen_port=${dns_listen_port} + UDP_PROXY_DNS=1 + local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT} local china_ng_trust_dns="udp://$(get_first_dns REMOTE_DNS 53 | sed 's/:/#/g')" if [ "$DNS_SHUNT" != "chinadns-ng" ] && [ "$FILTER_PROXY_IPV6" = "1" ]; then DNSMASQ_FILTER_PROXY_IPV6=0 @@ -1518,8 +1521,8 @@ start_dns() { fi ;; tcp) - use_tcp_node_resolve_dns=1 - local china_ng_listen_port=${dns_listen_port} + TCP_PROXY_DNS=1 + local china_ng_listen_port=${NEXT_DNS_LISTEN_PORT} local china_ng_trust_dns="tcp://$(get_first_dns REMOTE_DNS 53 | sed 's/:/#/g')" [ "$DNS_SHUNT" != "chinadns-ng" ] && { [ "$FILTER_PROXY_IPV6" = "1" ] && DNSMASQ_FILTER_PROXY_IPV6=0 && local no_ipv6_trust="-N" @@ -1531,8 +1534,8 @@ start_dns() { [ -n "${resolve_dns_log}" ] && echolog " - ${resolve_dns_log}" - [ "${use_tcp_node_resolve_dns}" = "1" ] && echolog " * 请确认上游 DNS 支持 TCP/DoT/DoH 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发！" - [ "${use_udp_node_resolve_dns}" = "1" ] && echolog " * 请确认上游 DNS 支持 UDP 查询并已使用 UDP 节点，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发！" + [ -n "${TCP_PROXY_DNS}" ] && echolog " * 请确认上游 DNS 支持 TCP/DoT/DoH 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发！" + [ -n "${UDP_PROXY_DNS}" ] && echolog " * 请确认上游 DNS 支持 UDP 查询并已使用 UDP 节点，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发！" [ "${DNS_SHUNT}" = "smartdns" ] && { if command -v smartdns > /dev/null 2>&1; then @@ -1568,7 +1571,7 @@ start_dns() { fi [ "$FILTER_PROXY_IPV6" = "1" ] && DNSMASQ_FILTER_PROXY_IPV6=0 - [ -z "${china_ng_listen_port}" ] && local china_ng_listen_port=$(expr $dns_listen_port + 1) + [ -z "${china_ng_listen_port}" ] && local china_ng_listen_port=$(expr $NEXT_DNS_LISTEN_PORT + 1) local china_ng_listen="127.0.0.1#${china_ng_listen_port}" [ -z "${china_ng_trust_dns}" ] && local china_ng_trust_dns=${TUN_DNS} @@ -1857,7 +1860,7 @@ acl_app() { local dnsmasq_conf=${acl_path}/dnsmasq.conf local dnsmasq_conf_path=${acl_path}/dnsmasq.d lua $APP_PATH/helper_dnsmasq.lua add_rule -FLAG ${sid} -TMP_DNSMASQ_PATH ${dnsmasq_conf_path} -DNSMASQ_CONF_FILE ${dnsmasq_conf} \ - -LISTEN_PORT ${dnsmasq_port} -DEFAULT_DNS $DEFAULT_DNS -LOCAL_DNS $LOCAL_DNS \ + -LISTEN_PORT ${dnsmasq_port} -DEFAULT_DNS ${DEFAULT_DNS} -LOCAL_DNS $LOCAL_DNS \ -USE_DIRECT_LIST "${use_direct_list}" -USE_PROXY_LIST "${use_proxy_list}" -USE_BLOCK_LIST "${use_block_list}" -USE_GFW_LIST "${use_gfw_list}" -CHN_LIST "${chn_list}" \ -TUN_DNS "127.0.0.1#${_dns_port}" -REMOTE_FAKEDNS 0 -USE_DEFAULT_DNS "${use_default_dns:-direct}" -CHINADNS_DNS ${_china_ng_listen:-0} \ -TCP_NODE $tcp_node -DEFAULT_PROXY_MODE ${tcp_proxy_mode} -NO_PROXY_IPV6 ${dnsmasq_filter_proxy_ipv6:-0} -NFTFLAG ${nftflag:-0} \ @@ -1986,6 +1989,10 @@ acl_app() { } start() { + mkdir -p /tmp/etc $TMP_PATH $TMP_BIN_PATH $TMP_SCRIPT_FUNC_PATH $TMP_ROUTE_PATH $TMP_ACL_PATH $TMP_PATH2 + get_config + export V2RAY_LOCATION_ASSET=$(config_t_get global_rules v2ray_location_asset "/usr/share/v2ray/") + export XRAY_LOCATION_ASSET=$V2RAY_LOCATION_ASSET ulimit -n 65535 start_haproxy start_socks @@ -2056,14 +2063,12 @@ start() { stop() { clean_log - [ -n "$($(source $APP_PATH/iptables.sh get_ipt_bin) -t mangle -t nat -L -nv 2>/dev/null | grep "PSW")" ] && source $APP_PATH/iptables.sh stop - [ -n "$(nft list chains 2>/dev/null | grep "PSW")" ] && source $APP_PATH/nftables.sh stop + eval_cache_var + [ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh stop delete_ip2route kill_all v2ray-plugin obfs-local pgrep -f "sleep.*(6s|9s|58s)" | xargs kill -9 >/dev/null 2>&1 pgrep -af "${CONFIG}/" | awk '! /app\.sh|subscribe\.lua|rule_update\.lua|tasks\.sh|ujail/{print $1}' | xargs kill -9 >/dev/null 2>&1 - unset V2RAY_LOCATION_ASSET - unset XRAY_LOCATION_ASSET stop_crontab source $APP_PATH/helper_smartdns.sh del rm -rf $GLOBAL_DNSMASQ_CONF @@ -2077,14 +2082,12 @@ stop() { uci -q delete ${CONFIG}.@global[0].dnsmasq_dns_redirect uci -q commit ${CONFIG} } - if [ -z "$(get_cache_var "ACL_default_dns_port")" ] || [ -n "${bak_dnsmasq_dns_redirect}" ]; then + if [ -z "${ACL_default_dns_port}" ] || [ -n "${bak_dnsmasq_dns_redirect}" ]; then uci -q del_list dhcp.@dnsmasq[0].addnmount="${GLOBAL_DNSMASQ_CONF_PATH}" uci -q commit dhcp lua $APP_PATH/helper_dnsmasq.lua restart -LOG 0 fi - bak_bridge_nf_ipt=$(get_cache_var "bak_bridge_nf_ipt") [ -n "${bak_bridge_nf_ipt}" ] && sysctl -w net.bridge.bridge-nf-call-iptables=${bak_bridge_nf_ipt} >/dev/null 2>&1 - bak_bridge_nf_ip6t=$(get_cache_var "bak_bridge_nf_ip6t") [ -n "${bak_bridge_nf_ip6t}" ] && sysctl -w net.bridge.bridge-nf-call-ip6tables=${bak_bridge_nf_ip6t} >/dev/null 2>&1 } rm -rf $TMP_PATH @@ -2093,97 +2096,97 @@ stop() { exit 0 } -ENABLED=$(config_t_get global enabled 0) -SOCKS_ENABLED=$(config_t_get global socks_enabled 0) -TCP_REDIR_PORT=1041 -TCP_NODE=$(config_t_get global tcp_node) -UDP_REDIR_PORT=1051 -UDP_NODE=$(config_t_get global udp_node) -TCP_UDP=0 -if [ "$UDP_NODE" == "tcp" ]; then - UDP_NODE=$TCP_NODE - TCP_UDP=1 -elif [ "$UDP_NODE" == "$TCP_NODE" ]; then - TCP_UDP=1 -fi -[ "$ENABLED" == 1 ] && { - [ -n "$TCP_NODE" ] && [ "$(config_get_type $TCP_NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1 - [ -n "$UDP_NODE" ] && [ "$(config_get_type $UDP_NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1 -} -ENABLED_ACLS=$(config_t_get global acl_enable 0) -[ "$ENABLED_ACLS" == 1 ] && { - [ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" == 0 ] && ENABLED_ACLS=0 -} - -tcp_proxy_way=$(config_t_get global_forwarding tcp_proxy_way redirect) -PROXY_IPV6=$(config_t_get global_forwarding ipv6_tproxy 0) -TCP_REDIR_PORTS=$(config_t_get global_forwarding tcp_redir_ports '80,443') -UDP_REDIR_PORTS=$(config_t_get global_forwarding udp_redir_ports '1:65535') -TCP_NO_REDIR_PORTS=$(config_t_get global_forwarding tcp_no_redir_ports 'disable') -UDP_NO_REDIR_PORTS=$(config_t_get global_forwarding udp_no_redir_ports 'disable') -TCP_PROXY_DROP_PORTS=$(config_t_get global_forwarding tcp_proxy_drop_ports 'disable') -UDP_PROXY_DROP_PORTS=$(config_t_get global_forwarding udp_proxy_drop_ports '80,443') -USE_DIRECT_LIST=$(config_t_get global use_direct_list 1) -USE_PROXY_LIST=$(config_t_get global use_proxy_list 1) -USE_BLOCK_LIST=$(config_t_get global use_block_list 1) -USE_GFW_LIST=$(config_t_get global use_gfw_list 1) -CHN_LIST=$(config_t_get global chn_list direct) -TCP_PROXY_MODE=$(config_t_get global tcp_proxy_mode proxy) -UDP_PROXY_MODE=$(config_t_get global udp_proxy_mode proxy) -[ "${TCP_PROXY_MODE}" != "disable" ] && TCP_PROXY_MODE="proxy" -[ "${UDP_PROXY_MODE}" != "disable" ] && UDP_PROXY_MODE="proxy" -LOCALHOST_PROXY=$(config_t_get global localhost_proxy 1) -[ "${LOCALHOST_PROXY}" == 1 ] && { - LOCALHOST_TCP_PROXY_MODE=$TCP_PROXY_MODE - LOCALHOST_UDP_PROXY_MODE=$UDP_PROXY_MODE -} -CLIENT_PROXY=$(config_t_get global client_proxy 1) -DNS_SHUNT=$(config_t_get global dns_shunt dnsmasq) -[ -z "$(first_type $DNS_SHUNT)" ] && DNS_SHUNT="dnsmasq" -DNS_MODE=$(config_t_get global dns_mode tcp) -SMARTDNS_DNS_MODE=$(config_t_get global smartdns_dns_mode socks) -[ "$DNS_SHUNT" = "smartdns" ] && DNS_MODE=$SMARTDNS_DNS_MODE -DNS_CACHE=0 -REMOTE_DNS=$(config_t_get global remote_dns 1.1.1.1:53 | sed 's/#/:/g' | sed -E 's/\:([^:]+)$/#\1/g') -USE_DEFAULT_DNS=$(config_t_get global use_default_dns direct) -FILTER_PROXY_IPV6=$(config_t_get global filter_proxy_ipv6 0) -DNS_REDIRECT=$(config_t_get global dns_redirect 1) -dns_listen_port=${DNS_PORT} - -REDIRECT_LIST="socks ss ss-rust ssr sing-box xray trojan-plus naiveproxy hysteria2" -TPROXY_LIST="socks ss ss-rust ssr sing-box xray trojan-plus hysteria2" -RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto -[ -f "${RESOLVFILE}" ] && [ -s "${RESOLVFILE}" ] || RESOLVFILE=/tmp/resolv.conf.auto - -ISP_DNS=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort -u | grep -v 0.0.0.0 | grep -v 127.0.0.1) -ISP_DNS6=$(cat $RESOLVFILE 2>/dev/null | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | awk -F % '{print $1}' | awk -F " " '{print $2}'| sort -u | grep -v -Fx ::1 | grep -v -Fx ::) - -DEFAULT_DNS=$(uci show dhcp.@dnsmasq[0] | grep "\.server=" | awk -F '=' '{print $2}' | sed "s/'//g" | tr ' ' '\n' | grep -v "\/" | head -2 | sed ':label;N;s/\n/,/;b label') -[ -z "${DEFAULT_DNS}" ] && [ "$(echo $ISP_DNS | tr ' ' '\n' | wc -l)" -le 2 ] && DEFAULT_DNS=$(echo -n $ISP_DNS | tr ' ' '\n' | head -2 | tr '\n' ',') -LOCAL_DNS="${DEFAULT_DNS:-119.29.29.29,223.5.5.5}" -IPT_APPEND_DNS=${LOCAL_DNS} - -DNSMASQ_CONF_DIR=/tmp/dnsmasq.d -DEFAULT_DNSMASQ_CFGID="$(uci -q show "dhcp.@dnsmasq[0]" | awk 'NR==1 {split($0, conf, /[.=]/); print conf[2]}')" -if [ -f "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID" ]; then - DNSMASQ_CONF_DIR="$(awk -F '=' '/^conf-dir=/ {print $2}' "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID")" - if [ -n "$DNSMASQ_CONF_DIR" ]; then - DNSMASQ_CONF_DIR=${DNSMASQ_CONF_DIR%*/} - else - DNSMASQ_CONF_DIR="/tmp/dnsmasq.d" +get_config() { + ENABLED_DEFAULT_ACL=0 + TCP_REDIR_PORT=1041 + UDP_REDIR_PORT=1051 + ENABLED=$(config_t_get global enabled 0) + SOCKS_ENABLED=$(config_t_get global socks_enabled 0) + TCP_NODE=$(config_t_get global tcp_node) + UDP_NODE=$(config_t_get global udp_node) + TCP_UDP=0 + if [ "$UDP_NODE" == "tcp" ]; then + UDP_NODE=$TCP_NODE + TCP_UDP=1 + elif [ "$UDP_NODE" == "$TCP_NODE" ]; then + TCP_UDP=1 fi -fi -GLOBAL_DNSMASQ_CONF=${DNSMASQ_CONF_DIR}/dnsmasq-${CONFIG}.conf -GLOBAL_DNSMASQ_CONF_PATH=${GLOBAL_ACL_PATH}/dnsmasq.d - -DIRECT_DNS_QUERY_STRATEGY="UseIP" -REMOTE_DNS_QUERY_STRATEGY="UseIP" -[ "$FILTER_PROXY_IPV6" = "1" ] && REMOTE_DNS_QUERY_STRATEGY="UseIPv4" -DNSMASQ_FILTER_PROXY_IPV6=${FILTER_PROXY_IPV6} + [ "$ENABLED" == 1 ] && { + [ -n "$TCP_NODE" ] && [ "$(config_get_type $TCP_NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1 + [ -n "$UDP_NODE" ] && [ "$(config_get_type $UDP_NODE)" == "nodes" ] && ENABLED_DEFAULT_ACL=1 + } + ENABLED_ACLS=$(config_t_get global acl_enable 0) + [ "$ENABLED_ACLS" == 1 ] && { + [ "$(uci show ${CONFIG} | grep "@acl_rule" | grep "enabled='1'" | wc -l)" == 0 ] && ENABLED_ACLS=0 + } -export V2RAY_LOCATION_ASSET=$(config_t_get global_rules v2ray_location_asset "/usr/share/v2ray/") -export XRAY_LOCATION_ASSET=$V2RAY_LOCATION_ASSET -mkdir -p /tmp/etc $TMP_PATH $TMP_BIN_PATH $TMP_SCRIPT_FUNC_PATH $TMP_ROUTE_PATH $TMP_ACL_PATH $TMP_PATH2 + TCP_PROXY_WAY=$(config_t_get global_forwarding tcp_proxy_way redirect) + PROXY_IPV6=$(config_t_get global_forwarding ipv6_tproxy 0) + TCP_REDIR_PORTS=$(config_t_get global_forwarding tcp_redir_ports '80,443') + UDP_REDIR_PORTS=$(config_t_get global_forwarding udp_redir_ports '1:65535') + TCP_NO_REDIR_PORTS=$(config_t_get global_forwarding tcp_no_redir_ports 'disable') + UDP_NO_REDIR_PORTS=$(config_t_get global_forwarding udp_no_redir_ports 'disable') + TCP_PROXY_DROP_PORTS=$(config_t_get global_forwarding tcp_proxy_drop_ports 'disable') + UDP_PROXY_DROP_PORTS=$(config_t_get global_forwarding udp_proxy_drop_ports '80,443') + USE_DIRECT_LIST=$(config_t_get global use_direct_list 1) + USE_PROXY_LIST=$(config_t_get global use_proxy_list 1) + USE_BLOCK_LIST=$(config_t_get global use_block_list 1) + USE_GFW_LIST=$(config_t_get global use_gfw_list 1) + CHN_LIST=$(config_t_get global chn_list direct) + TCP_PROXY_MODE=$(config_t_get global tcp_proxy_mode proxy) + UDP_PROXY_MODE=$(config_t_get global udp_proxy_mode proxy) + [ "${TCP_PROXY_MODE}" != "disable" ] && TCP_PROXY_MODE="proxy" + [ "${UDP_PROXY_MODE}" != "disable" ] && UDP_PROXY_MODE="proxy" + LOCALHOST_PROXY=$(config_t_get global localhost_proxy 1) + [ "${LOCALHOST_PROXY}" == 1 ] && { + LOCALHOST_TCP_PROXY_MODE=$TCP_PROXY_MODE + LOCALHOST_UDP_PROXY_MODE=$UDP_PROXY_MODE + } + CLIENT_PROXY=$(config_t_get global client_proxy 1) + DNS_SHUNT=$(config_t_get global dns_shunt dnsmasq) + [ -z "$(first_type $DNS_SHUNT)" ] && DNS_SHUNT="dnsmasq" + DNS_MODE=$(config_t_get global dns_mode tcp) + [ "$DNS_SHUNT" = "smartdns" ] && DNS_MODE=$(config_t_get global smartdns_dns_mode socks) + REMOTE_DNS=$(config_t_get global remote_dns 1.1.1.1:53 | sed 's/#/:/g' | sed -E 's/\:([^:]+)$/#\1/g') + USE_DEFAULT_DNS=$(config_t_get global use_default_dns direct) + FILTER_PROXY_IPV6=$(config_t_get global filter_proxy_ipv6 0) + DNS_REDIRECT=$(config_t_get global dns_redirect 1) + + REDIRECT_LIST="socks ss ss-rust ssr sing-box xray trojan-plus naiveproxy hysteria2" + TPROXY_LIST="socks ss ss-rust ssr sing-box xray trojan-plus hysteria2" + + NEXT_DNS_LISTEN_PORT=15353 + TUN_DNS="127.0.0.1#${NEXT_DNS_LISTEN_PORT}" + DNS_CACHE=0 + DIRECT_DNS_QUERY_STRATEGY="UseIP" + REMOTE_DNS_QUERY_STRATEGY="UseIP" + [ "$FILTER_PROXY_IPV6" = "1" ] && REMOTE_DNS_QUERY_STRATEGY="UseIPv4" + DNSMASQ_FILTER_PROXY_IPV6=${FILTER_PROXY_IPV6} + + RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto + [ -f "${RESOLVFILE}" ] && [ -s "${RESOLVFILE}" ] || RESOLVFILE=/tmp/resolv.conf.auto + + ISP_DNS=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort -u | grep -v 0.0.0.0 | grep -v 127.0.0.1) + ISP_DNS6=$(cat $RESOLVFILE 2>/dev/null | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | awk -F % '{print $1}' | awk -F " " '{print $2}'| sort -u | grep -v -Fx ::1 | grep -v -Fx ::) + + DEFAULT_DNS=$(uci show dhcp.@dnsmasq[0] | grep "\.server=" | awk -F '=' '{print $2}' | sed "s/'//g" | tr ' ' '\n' | grep -v "\/" | head -2 | sed ':label;N;s/\n/,/;b label') + [ -z "${DEFAULT_DNS}" ] && [ "$(echo $ISP_DNS | tr ' ' '\n' | wc -l)" -le 2 ] && DEFAULT_DNS=$(echo -n $ISP_DNS | tr ' ' '\n' | head -2 | tr '\n' ',' | sed 's/,$//') + LOCAL_DNS="${DEFAULT_DNS:-119.29.29.29,223.5.5.5}" + IPT_APPEND_DNS=${LOCAL_DNS} + + DNSMASQ_CONF_DIR=/tmp/dnsmasq.d + DEFAULT_DNSMASQ_CFGID="$(uci -q show "dhcp.@dnsmasq[0]" | awk 'NR==1 {split($0, conf, /[.=]/); print conf[2]}')" + if [ -f "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID" ]; then + DNSMASQ_CONF_DIR="$(awk -F '=' '/^conf-dir=/ {print $2}' "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID")" + if [ -n "$DNSMASQ_CONF_DIR" ]; then + DNSMASQ_CONF_DIR=${DNSMASQ_CONF_DIR%*/} + else + DNSMASQ_CONF_DIR="/tmp/dnsmasq.d" + fi + fi + set_cache_var GLOBAL_DNSMASQ_CONF ${DNSMASQ_CONF_DIR}/dnsmasq-${CONFIG}.conf + set_cache_var GLOBAL_DNSMASQ_CONF_PATH ${GLOBAL_ACL_PATH}/dnsmasq.d +} arg1=$1 shift @@ -2191,31 +2194,28 @@ case $arg1 in add_ip2route) add_ip2route $@ ;; -get_new_port) - get_new_port $@ - ;; -run_socks) - run_socks $@ - ;; -run_redir) - run_redir $@ - ;; -socks_node_switch) - socks_node_switch $@ - ;; echolog) echolog $@ ;; +get_new_port) + get_new_port $@ + ;; get_cache_var) get_cache_var $@ ;; set_cache_var) set_cache_var $@ ;; -stop) - stop +run_socks) + run_socks $@ + ;; +socks_node_switch) + socks_node_switch $@ ;; start) start ;; +stop) + stop + ;; esac diff --git a/applications/luci-app-passwall/root/usr/share/passwall/haproxy.lua b/applications/luci-app-passwall/root/usr/share/passwall/haproxy.lua index 46da40d4bff..50a3c4f39df 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/haproxy.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/haproxy.lua @@ -4,7 +4,7 @@ local api = require ("luci.passwall.api") local appname = "passwall" local fs = api.fs local jsonc = api.jsonc -local uci = api.libuci +local uci = api.uci local sys = api.sys local log = function(...) diff --git a/applications/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua b/applications/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua index 94d3869495e..72b3c7e0417 100644 --- a/applications/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua @@ -19,8 +19,9 @@ local NO_LOGIC_LOG = var["-NO_LOGIC_LOG"] local TCP_NODE = var["-TCP_NODE"] local NFTFLAG = var["-NFTFLAG"] local REMOTE_FAKEDNS = var["-REMOTE_FAKEDNS"] +local LOG_FILE = var["-LOG_FILE"] -local uci = api.libuci +local uci = api.uci local sys = api.sys local fs = api.fs local datatypes = api.datatypes @@ -104,7 +105,7 @@ local setflag = (NFTFLAG == "1") and "inet@passwall@" or "" local only_global = (DEFAULT_MODE == "proxy" and CHNLIST == "0" and GFWLIST == "0") and 1 config_lines = { - --"verbose", + LOG_FILE ~= "/dev/null" and "verbose" or "", "bind-addr 127.0.0.1", "bind-port " .. LISTEN_PORT, "china-dns " .. DNS_LOCAL, @@ -270,7 +271,7 @@ if USE_PROXY_LIST == "1" and is_file_nonzero(file_proxy_host) then "group proxylist", "group-dnl " .. file_proxy_host, "group-upstream " .. DNS_TRUST, - REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or nil + REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or "" } if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:proxylist") end insert_array_after(config_lines, tmp_lines, "#--3") @@ -292,7 +293,7 @@ if GFWLIST == "1" and is_file_nonzero(RULES_PATH .. "/gfwlist") then end tmp_lines = { "gfwlist-file " .. RULES_PATH .. "/gfwlist", - REMOTE_FAKEDNS ~= "1" and "add-taggfw-ip " .. table.concat(sets, ",") or nil + REMOTE_FAKEDNS ~= "1" and "add-taggfw-ip " .. table.concat(sets, ",") or "" } if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:gfw") end merge_array(config_lines, tmp_lines) @@ -323,7 +324,7 @@ if CHNLIST ~= "0" and is_file_nonzero(RULES_PATH .. "/chnlist") then "group chn_proxy", "group-dnl " .. RULES_PATH .. "/chnlist", "group-upstream " .. DNS_TRUST, - REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or nil + REMOTE_FAKEDNS ~= "1" and "group-ipset " .. table.concat(sets, ",") or "" } if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:chn_proxy") end insert_array_after(config_lines, tmp_lines, "#--1") @@ -448,7 +449,7 @@ if uci:get(appname, TCP_NODE, "protocol") == "_shunt" then "group shuntlist", "group-dnl " .. file_shunt_host, "group-upstream " .. DNS_TRUST, - (not only_global and REMOTE_FAKEDNS == "1") and nil or ("group-ipset " .. table.concat(sets, ",")) + (not only_global and REMOTE_FAKEDNS == "1") and "" or ("group-ipset " .. table.concat(sets, ",")) } if NO_IPV6_TRUST == "1" then table.insert(tmp_lines, "no-ipv6 tag:shuntlist") end insert_array_after(config_lines, tmp_lines, "#--2") diff --git a/applications/luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua b/applications/luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua index 6744e903af9..df0c9fe5091 100644 --- a/applications/luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua @@ -1,6 +1,6 @@ local api = require "luci.passwall.api" local appname = "passwall" -local uci = api.libuci +local uci = api.uci local sys = api.sys local fs = api.fs local datatypes = api.datatypes @@ -25,7 +25,7 @@ local function backup_servers() local DNSMASQ_DNS = uci:get("dhcp", "@dnsmasq[0]", "server") if DNSMASQ_DNS and #DNSMASQ_DNS > 0 then uci:set(appname, "@global[0]", "dnsmasq_servers", DNSMASQ_DNS) - uci:commit(appname) + api.uci_save(uci, appname, true) end end @@ -43,11 +43,11 @@ local function restore_servers() tinsert(dns_table, v) end uci:delete(appname, "@global[0]", "dnsmasq_servers") - uci:commit(appname) + api.uci_save(uci, appname, true) end if dns_table and #dns_table > 0 then - api.uci_set_list(uci, "dhcp", "@dnsmasq[0]", "server", dns_table) - uci:commit("dhcp") + uci:set_list("dhcp", "@dnsmasq[0]", "server", dns_table) + api.uci_save(uci, "dhcp", true) end end @@ -76,7 +76,7 @@ function stretch() end end uci:set("dhcp", "@dnsmasq[0]", "resolvfile", RESOLVFILE) - uci:commit("dhcp") + api.uci_save(uci, "dhcp", true) end end @@ -102,8 +102,8 @@ function logic_restart(var) tinsert(dns_table, v) end end - api.uci_set_list(uci, "dhcp", "@dnsmasq[0]", "server", dns_table) - uci:commit("dhcp") + uci:set_list("dhcp", "@dnsmasq[0]", "server", dns_table) + api.uci_save(uci, "dhcp", true) end sys.call("/etc/init.d/dnsmasq restart >/dev/null 2>&1") restore_servers() diff --git a/applications/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua b/applications/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua index 38caf5508cb..334345b99a7 100644 --- a/applications/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua @@ -28,7 +28,7 @@ local CACHE_FLAG = "smartdns_" .. FLAG local CACHE_DNS_PATH = CACHE_PATH .. "/" .. CACHE_FLAG local CACHE_DNS_FILE = CACHE_DNS_PATH .. ".conf" -local uci = api.libuci +local uci = api.uci local sys = api.sys local fs = api.fs local datatypes = api.datatypes diff --git a/applications/luci-app-passwall/root/usr/share/passwall/iptables.sh b/applications/luci-app-passwall/root/usr/share/passwall/iptables.sh index dd1aee966e7..9889682b363 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/applications/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -476,7 +476,7 @@ load_acl() { [ "${udp_proxy_mode}" != "disable" ] && $ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") -j PSW_RULE $ipt_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(REDIRECT $udp_port TPROXY) - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ "${use_proxy_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") $(dst $black6_set_name) -j PSW_RULE 2>/dev/null [ "${use_gfw_list}" = "1" ] && $ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") $(dst $gfw6_set_name) -j PSW_RULE 2>/dev/null [ "${chn_list}" != "0" ] && $ip6t_m -A PSW $(comment "$remarks") -p udp ${_ipt_source} $(factor $udp_redir_ports "-m multiport --dport") $(dst $IPSET_CHN6) $(get_jump_ipt ${chn_list} "-j PSW_RULE") 2>/dev/null @@ -653,7 +653,7 @@ load_acl() { [ "${UDP_PROXY_MODE}" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") -j PSW_RULE $ipt_m -A PSW $(comment "默认") -p udp $(REDIRECT $UDP_REDIR_PORT TPROXY) - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ "${USE_PROXY_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACK6) -j PSW_RULE [ "${USE_GFW_LIST}" = "1" ] && $ip6t_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_GFW6) -j PSW_RULE [ "${CHN_LIST}" != "0" ] && $ip6t_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_CHN6) $(get_jump_ipt ${CHN_LIST} "-j PSW_RULE") @@ -751,8 +751,8 @@ add_firewall_rule() { ipset -! create $IPSET_WHITE6 nethash family inet6 maxelem 1048576 timeout 172800 ipset -! create $IPSET_BLOCK6 nethash family inet6 maxelem 1048576 timeout 172800 - cat $RULES_PATH/chnroute | tr -s '\n' | grep -v "^#" | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - cat $RULES_PATH/chnroute6 | tr -s '\n' | grep -v "^#" | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + cat $RULES_PATH/chnroute | tr -s '\n' | grep -v "^#" | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN &/g" -e "s/$/ timeout 0/g" | ipset -! -R + cat $RULES_PATH/chnroute6 | tr -s '\n' | grep -v "^#" | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R #导入规则列表、分流规则中的IP列表 local USE_SHUNT_NODE=0 @@ -782,13 +782,13 @@ add_firewall_rule() { #直连列表 [ "$USE_DIRECT_LIST_ALL" = "1" ] && { - cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R + cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R [ "$USE_GEOVIEW" = "1" ] && { local GEOIP_CODE=$(cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') if [ -n "$GEOIP_CODE" ] && type geoview &> /dev/null; then - get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R + get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R echolog " - [$?]解析并加入[直连列表] GeoIP 到 IPSET 完成" fi } @@ -796,13 +796,13 @@ add_firewall_rule() { #代理列表 [ "$USE_PROXY_LIST_ALL" = "1" ] && { - cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R + cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R [ "$USE_GEOVIEW" = "1" ] && { local GEOIP_CODE=$(cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') if [ -n "$GEOIP_CODE" ] && type geoview &> /dev/null; then - get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R + get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R echolog " - [$?]解析并加入[代理列表] GeoIP 到 IPSET 完成" fi } @@ -810,13 +810,13 @@ add_firewall_rule() { #屏蔽列表 [ "$USE_BLOCK_LIST_ALL" = "1" ] && { - cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R + cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R [ "$USE_GEOVIEW" = "1" ] && { local GEOIP_CODE=$(cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') if [ -n "$GEOIP_CODE" ] && type geoview &> /dev/null; then - get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R + get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R echolog " - [$?]解析并加入[屏蔽列表] GeoIP 到 IPSET 完成" fi } @@ -827,16 +827,16 @@ add_firewall_rule() { local GEOIP_CODE="" local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}') for shunt_id in $shunt_ids; do - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R + config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | grep -v "^#" | sed -e "/^$/d" | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R [ "$USE_GEOVIEW" = "1" ] && { local geoip_code=$(config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g') [ -n "$geoip_code" ] && GEOIP_CODE="${GEOIP_CODE:+$GEOIP_CODE,}$geoip_code" } done if [ -n "$GEOIP_CODE" ] && type geoview &> /dev/null; then - get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R - get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R + get_geoip $GEOIP_CODE ipv4 | grep -E "(\.((2(5[0-5]|[0-4][0-9]))|[0-1]?[0-9]{1,2})){3}" | sed -e "s/^/add $IPSET_SHUNT &/g" -e "s/$/ timeout 0/g" | ipset -! -R + get_geoip $GEOIP_CODE ipv6 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "s/^/add $IPSET_SHUNT6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R echolog " - [$?]解析并加入[分流节点] GeoIP 到 IPSET 完成" fi } @@ -899,10 +899,9 @@ add_firewall_rule() { accept_icmp=$(config_t_get global_forwarding accept_icmp 0) accept_icmpv6=$(config_t_get global_forwarding accept_icmpv6 0) - local tcp_proxy_way=$(config_t_get global_forwarding tcp_proxy_way redirect) - if [ "$tcp_proxy_way" = "redirect" ]; then + if [ "${TCP_PROXY_WAY}" = "redirect" ]; then unset is_tproxy - elif [ "$tcp_proxy_way" = "tproxy" ]; then + elif [ "${TCP_PROXY_WAY}" = "tproxy" ]; then is_tproxy="TPROXY" fi @@ -1128,7 +1127,7 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 [${2}]:${3} 加入到路由器自身代理的 TCP 转发链，请确保您的节点支持IPv6，并开启IPv6透明代理！" fi } - [ "$use_tcp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 + [ -n "${TCP_PROXY_DNS}" ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 [ "$accept_icmp" = "1" ] && { $ipt_n -A OUTPUT -p icmp -j PSW_OUTPUT @@ -1202,8 +1201,7 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 [${2}]:${3} 加入到路由器自身代理的 UDP 转发链，请确保您的节点支持IPv6，并开启IPv6透明代理！" fi } - [ "$use_udp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 - + [ -n "${UDP_PROXY_DNS}" ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && { $ipt_m -A PSW_OUTPUT -p udp -d $FAKE_IP -j PSW_RULE [ "${USE_PROXY_LIST}" = "1" ] && $ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACK) -j PSW_RULE @@ -1216,7 +1214,7 @@ add_firewall_rule() { $ipt_m -A PSW $(comment "本机") -p udp -i lo -j RETURN insert_rule_before "$ipt_m" "OUTPUT" "mwan3" "$(comment mangle-OUTPUT-PSW) -p udp -j PSW_OUTPUT" - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ -n "$LOCALHOST_UDP_PROXY_MODE" ] && { [ "${USE_PROXY_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACK6) -j PSW_RULE [ "${USE_GFW_LIST}" = "1" ] && $ip6t_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_GFW6) -j PSW_RULE diff --git a/applications/luci-app-passwall/root/usr/share/passwall/nftables.sh b/applications/luci-app-passwall/root/usr/share/passwall/nftables.sh index 7676457ae8b..4af08b072c1 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/nftables.sh +++ b/applications/luci-app-passwall/root/usr/share/passwall/nftables.sh @@ -130,10 +130,8 @@ destroy_nftset() { } gen_nft_tables() { - if [ -z "$(nft list tables | grep 'inet passwall')" ]; then - local nft_table_file="$TMP_PATH/PSW_TABLE.nft" - # Set the correct priority to fit fw4 - cat > "$nft_table_file" <<-EOF + if ! nft list tables | grep -q "^table inet passwall$"; then + nft -f - <<-EOF table $NFTABLE_NAME { chain dstnat { type nat hook prerouting priority dstnat - 1; policy accept; @@ -149,33 +147,23 @@ gen_nft_tables() { } } EOF - - nft -f "$nft_table_file" - rm -rf "$nft_table_file" fi } insert_nftset() { local nftset_name="${1}"; shift local timeout_argument="${1}"; shift - local defalut_timeout_argument="3650d" - local nftset_elements - + local default_timeout_argument="3650d" [ -n "${1}" ] && { - if [ "$timeout_argument" == "-1" ]; then - nftset_elements=$(echo -e $@ | sed 's/\s/, /g') - elif [ "$timeout_argument" == "0" ]; then - nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $defalut_timeout_argument, /g" | sed "s/$/ timeout $defalut_timeout_argument/") - else - nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $timeout_argument, /g" | sed "s/$/ timeout $timeout_argument/") - fi - mkdir -p $TMP_PATH2/nftset - cat > "$TMP_PATH2/nftset/$nftset_name" <<-EOF - define $nftset_name = {$nftset_elements} - add element $NFTABLE_NAME $nftset_name \$$nftset_name + local nftset_elements + case "$timeout_argument" in + "-1") nftset_elements=$(echo -e $@ | sed 's/\s/, /g') ;; + "0") nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $default_timeout_argument, /g" | sed "s/$/ timeout $default_timeout_argument/") ;; + *) nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $timeout_argument, /g" | sed "s/$/ timeout $timeout_argument/") ;; + esac + nft -f - <<-EOF + add element $NFTABLE_NAME $nftset_name {$nftset_elements} EOF - nft -f "$TMP_PATH2/nftset/$nftset_name" - rm -rf "$TMP_PATH2/nftset" } } @@ -533,7 +521,7 @@ load_acl() { [ "${udp_proxy_mode}" != "disable" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") counter jump PSW_RULE comment \"$remarks\"" nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp ${_ipt_source} $(REDIRECT $udp_port TPROXY4) comment \"$remarks\"" - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ "${use_proxy_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$black6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null [ "${use_gfw_list}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$gfw6_set_name counter jump PSW_RULE comment \"$remarks\"" 2>/dev/null [ "${chn_list}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_redir_ports "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_ipt ${chn_list} "counter jump PSW_RULE") comment \"$remarks\"" 2>/dev/null @@ -716,7 +704,7 @@ load_acl() { nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp $(REDIRECT $UDP_REDIR_PORT TPROXY4) comment \"默认\"" nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp counter return comment \"默认\"" - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_BLACK6 counter jump PSW_RULE comment \"默认\"" [ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_GFW6 counter jump PSW_RULE comment \"默认\"" [ "${CHN_LIST}" != "0" ] && nft "add rule $NFTABLE_NAME PSW_MANGLE_V6 meta l4proto udp $(factor $UDP_REDIR_PORTS "udp dport") ip6 daddr @$NFTSET_CHN6 $(get_jump_ipt ${CHN_LIST} "counter jump PSW_RULE") comment \"默认\"" @@ -960,12 +948,11 @@ add_firewall_rule() { accept_icmp=$(config_t_get global_forwarding accept_icmp 0) accept_icmpv6=$(config_t_get global_forwarding accept_icmpv6 0) - local tcp_proxy_way=$(config_t_get global_forwarding tcp_proxy_way redirect) - if [ "$tcp_proxy_way" = "redirect" ]; then + if [ "${TCP_PROXY_WAY}" = "redirect" ]; then unset is_tproxy nft_prerouting_chain="PSW_NAT" nft_output_chain="PSW_OUTPUT_NAT" - elif [ "$tcp_proxy_way" = "tproxy" ]; then + elif [ "${TCP_PROXY_WAY}" = "tproxy" ]; then is_tproxy="TPROXY" nft_prerouting_chain="PSW_MANGLE" nft_output_chain="PSW_OUTPUT_MANGLE" @@ -1188,7 +1175,7 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 [${2}]:${3} 加入到路由器自身代理的 TCP 转发链，请确保您的节点支持IPv6，并开启IPv6透明代理！" fi } - [ "$use_tcp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 + [ "$TCP_PROXY_DNS" == 1 ] && hosts_foreach REMOTE_DNS _proxy_tcp_access 53 [ "$accept_icmp" = "1" ] && { nft "add rule $NFTABLE_NAME PSW_ICMP_REDIRECT oif lo ip protocol icmp ip daddr $FAKE_IP counter redirect" @@ -1267,7 +1254,7 @@ add_firewall_rule() { echolog " - [$?]将上游 DNS 服务器 [${2}]:${3} 加入到路由器自身代理的 UDP 转发链，请确保您的节点支持IPv6，并开启IPv6透明代理！" fi } - [ "$use_udp_node_resolve_dns" == 1 ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 + [ -n "${UDP_PROXY_DNS}" ] && hosts_foreach REMOTE_DNS _proxy_udp_access 53 [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && { nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW_RULE" [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE ip protocol udp ip daddr @$NFTSET_BLACK $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE" @@ -1280,7 +1267,7 @@ add_firewall_rule() { nft "add rule $NFTABLE_NAME PSW_MANGLE ip protocol udp iif lo counter return comment \"本机\"" nft "add rule $NFTABLE_NAME mangle_output ip protocol udp counter jump PSW_OUTPUT_MANGLE comment \"PSW_OUTPUT_MANGLE\"" - [ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && { + [ "$PROXY_IPV6" == "1" ] && { [ -n "${LOCALHOST_UDP_PROXY_MODE}" ] && { [ "${USE_PROXY_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_BLACK6 $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE" [ "${USE_GFW_LIST}" = "1" ] && nft "add rule $NFTABLE_NAME PSW_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr @$NFTSET_GFW6 $(factor $UDP_REDIR_PORTS "udp dport") counter jump PSW_RULE" diff --git a/applications/luci-app-passwall/root/usr/share/passwall/rule_update.lua b/applications/luci-app-passwall/root/usr/share/passwall/rule_update.lua index e399a70e8c8..f0ffc645e13 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/rule_update.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/rule_update.lua @@ -2,7 +2,7 @@ local api = require ("luci.passwall.api") local name = api.appname -local uci = api.libuci +local uci = api.uci local sys = api.sys local jsonc = api.jsonc local fs = api.fs @@ -469,7 +469,7 @@ uci:set(name, "@global_rules[0]", "chnroute6_update", chnroute6_update) uci:set(name, "@global_rules[0]", "chnlist_update", chnlist_update) uci:set(name, "@global_rules[0]", "geoip_update", geoip_update) uci:set(name, "@global_rules[0]", "geosite_update", geosite_update) -uci:commit(name) +api.uci_save(uci, name, true) if reboot == 1 then if arg3 == "cron" then diff --git a/applications/luci-app-passwall/root/usr/share/passwall/subscribe.lua b/applications/luci-app-passwall/root/usr/share/passwall/subscribe.lua index a672c3ed984..7c4b4aeb3f3 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/subscribe.lua +++ b/applications/luci-app-passwall/root/usr/share/passwall/subscribe.lua @@ -17,7 +17,7 @@ local ssub, slen, schar, sbyte, sformat, sgsub = string.sub, string.len, string. local split = api.split local jsonParse, jsonStringify = luci.jsonc.parse, luci.jsonc.stringify local base64Decode = api.base64Decode -local uci = api.libuci +local uci = api.uci local fs = api.fs uci:revert(appname) @@ -228,7 +228,7 @@ do set = function(o) for kk, vv in pairs(CONFIG) do if (vv.remarks == id .. "备用节点的列表") then - api.uci_set_list(uci, appname, id, "autoswitch_backup_node", vv.new_nodes) + uci:set_list(appname, id, "autoswitch_backup_node", vv.new_nodes) end end end @@ -299,8 +299,8 @@ do if (vv.remarks == "Xray负载均衡节点[" .. node_id .. "]列表") then uci:foreach(appname, "nodes", function(node2) if node2[".name"] == node[".name"] then - local section = api.uci_section(uci, appname, "nodes", node_id) - api.uci_set_list(uci, appname, section, "balancing_node", vv.new_nodes) + local section = uci:section(appname, "nodes", node_id) + uci:set_list(appname, section, "balancing_node", vv.new_nodes) end end) end @@ -465,6 +465,7 @@ local function processData(szType, content, add_mode, add_from) elseif result.type == "Xray" and info.net == "tcp" then info.net = "raw" end + if info.net == "splithttp" then info.net = "xhttp" end if info.net == 'h2' or info.net == 'http' then info.net = "http" result.transport = (result.type == "Xray") and "xhttp" or "http" @@ -527,7 +528,7 @@ local function processData(szType, content, add_mode, add_from) if info.net == 'grpc' then result.grpc_serviceName = info.path end - if info.net == 'xhttp' or info.net == 'splithttp' then + if info.net == 'xhttp' then result.xhttp_host = info.host result.xhttp_path = info.path end @@ -593,7 +594,7 @@ local function processData(szType, content, add_mode, add_from) info = info:sub(1, find_index - 1) end - local hostInfo = split(base64Decode(info), "@") + local hostInfo = split(base64Decode(UrlDecode(info)), "@") if hostInfo and #hostInfo > 0 then local host_port = hostInfo[#hostInfo] -- [2001:4860:4860::8888]:443 @@ -639,12 +640,9 @@ local function processData(szType, content, add_mode, add_from) result.protocol = 'shadowsocks' end - if result.type == "SS-Rust" and method:lower() == "chacha20-poly1305" then - result.method = "chacha20-ietf-poly1305" - end - - if result.type == "Xray" and method:lower() == "chacha20-ietf-poly1305" then - result.method = "chacha20-poly1305" + if result.type ~= "Xray" then + result.method = (method:lower() == "chacha20-poly1305" and "chacha20-ietf-poly1305") or + (method:lower() == "xchacha20-poly1305" and "xchacha20-ietf-poly1305") or method end if result.plugin then @@ -977,6 +975,7 @@ local function processData(szType, content, add_mode, add_from) elseif result.type == "Xray" and params.type == "tcp" then params.type = "raw" end + if params.type == "splithttp" then params.type = "xhttp" end if params.type == "h2" or params.type == "http" then params.type = "http" result.transport = (result.type == "Xray") and "xhttp" or "http" @@ -1040,7 +1039,7 @@ local function processData(szType, content, add_mode, add_from) if params.serviceName then result.grpc_serviceName = params.serviceName end result.grpc_mode = params.mode or "gun" end - if params.type == 'xhttp' or params.type == 'splithttp' then + if params.type == 'xhttp' then result.xhttp_host = params.host result.xhttp_path = params.path result.xhttp_mode = params.mode or "auto" @@ -1313,7 +1312,7 @@ local function truncate_nodes(add_from) end end end) - uci:commit(appname) + api.uci_save(uci, appname, true) end local function select_node(nodes, config) @@ -1455,7 +1454,7 @@ local function update_node(manual) local remark = v["remark"] local list = v["list"] for _, vv in ipairs(list) do - local cfgid = api.uci_section(uci, appname, "nodes", api.gen_short_uuid()) + local cfgid = uci:section(appname, "nodes", api.gen_short_uuid()) for kkk, vvv in pairs(vv) do uci:set(appname, cfgid, kkk, vvv) -- sing-box 域名解析策略 @@ -1465,7 +1464,7 @@ local function update_node(manual) end end end - uci:commit(appname) + api.uci_save(uci, appname, true) if next(CONFIG) then local nodes = {} @@ -1500,7 +1499,7 @@ local function update_node(manual) end ]]-- - uci:commit(appname) + api.uci_save(uci, appname, true) end if arg[3] == "cron" then diff --git a/applications/luci-app-passwall/root/usr/share/passwall/test.sh b/applications/luci-app-passwall/root/usr/share/passwall/test.sh index 1f596e92923..0ac24e56967 100755 --- a/applications/luci-app-passwall/root/usr/share/passwall/test.sh +++ b/applications/luci-app-passwall/root/usr/share/passwall/test.sh @@ -73,10 +73,15 @@ url_test_node() { local curlx="socks5h://127.0.0.1:${_tmp_port}" fi sleep 1s + # 兼容 curl 8.6 time_starttransfer 错误 + local curl_ver=$(curl -V 2>/dev/null | head -n 1 | awk '{print $2}' | cut -d. -f1,2) + local curl_arg="-w %{http_code}:%{time_starttransfer} http://" + [ "${curl_ver}" = "8.6" ] && curl_arg="-w %{http_code}:%{time_appconnect} https://" + local chn_list=$(config_n_get @global[0] chn_list direct) - local probeUrl="https://www.google.com/generate_204" - [ "${chn_list}" = "proxy" ] && probeUrl="https://www.baidu.com" - result=$(curl --connect-timeout 3 -o /dev/null -I -skL -w "%{http_code}:%{time_appconnect}" -x $curlx "${probeUrl}") + local probeUrl="www.google.com/generate_204" + [ "${chn_list}" = "proxy" ] && probeUrl="www.baidu.com" + result=$(curl --connect-timeout 3 -o /dev/null -I -skL -x $curlx ${curl_arg}${probeUrl}) pgrep -af "url_test_${node_id}" | awk '! /test\.sh/{print $1}' | xargs kill -9 >/dev/null 2>&1 rm -rf "/tmp/etc/${CONFIG}/url_test_${node_id}.json" }