update 2024-02-26 00:20:11

This commit is contained in:
github-actions[bot] 2024-02-26 00:20:11 +08:00
parent fccc91e98d
commit ce0fc5b94d
10 changed files with 75 additions and 57 deletions

View File

@ -5,7 +5,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-passwall2
PKG_VERSION:=1.26-2
PKG_VERSION:=1.26-3
PKG_RELEASE:=
PKG_CONFIG_DEPENDS:= \

View File

@ -255,6 +255,7 @@ o = s:option(Flag, option_name("tls"), translate("TLS"))
o.default = 0
o:depends({ [option_name("protocol")] = "vmess" })
o:depends({ [option_name("protocol")] = "vless" })
o:depends({ [option_name("protocol")] = "http" })
o:depends({ [option_name("protocol")] = "socks" })
o:depends({ [option_name("protocol")] = "trojan" })
o:depends({ [option_name("protocol")] = "shadowsocks" })

View File

@ -352,9 +352,8 @@ o = s:option(Flag, option_name("tls"), translate("TLS"))
o.default = 0
o:depends({ [option_name("protocol")] = "vmess" })
o:depends({ [option_name("protocol")] = "vless" })
o:depends({ [option_name("protocol")] = "socks" })
o:depends({ [option_name("protocol")] = "http" })
o:depends({ [option_name("protocol")] = "trojan" })
o:depends({ [option_name("protocol")] = "shadowsocks" })
o = s:option(ListValue, option_name("alpn"), translate("alpn"))
o.default = "default"
@ -625,4 +624,11 @@ o:value("v2ray-plugin")
o = s:option(Value, option_name("plugin_opts"), translate("opts"))
o:depends({ [option_name("plugin_enabled")] = true })
o = s:option(ListValue, option_name("domain_strategy"), "Domain Strategy", translate("If is domain name, The requested domain name will be resolved to IP before connect."))
o.default = "prefer_ipv6"
o:value("prefer_ipv4")
o:value("prefer_ipv6")
o:value("ipv4_only")
o:value("ipv6_only")
api.luci_types(arg[1], m, s, type_name, option_prefix)

View File

@ -129,6 +129,7 @@ o.validate = function(self, value, t)
end
o:depends({ [option_name("protocol")] = "vmess" })
o:depends({ [option_name("protocol")] = "vless" })
o:depends({ [option_name("protocol")] = "http" })
o:depends({ [option_name("protocol")] = "socks" })
o:depends({ [option_name("protocol")] = "shadowsocks" })
o:depends({ [option_name("protocol")] = "trojan" })

View File

@ -215,7 +215,6 @@ o.validate = function(self, value, t)
end
end
o:depends({ [option_name("protocol")] = "http" })
o:depends({ [option_name("protocol")] = "shadowsocks" })
o:depends({ [option_name("protocol")] = "vmess" })
o:depends({ [option_name("protocol")] = "vless" })
o:depends({ [option_name("protocol")] = "trojan" })
@ -224,10 +223,9 @@ if singbox_tags:find("with_reality_server") then
-- [[ REALITY部分 ]] --
o = s:option(Flag, option_name("reality"), translate("REALITY"))
o.default = 0
o:depends({ [option_name("protocol")] = "vless", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "vmess", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "shadowsocks", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "http", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "vmess", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "vless", [option_name("tls")] = true })
o:depends({ [option_name("protocol")] = "trojan", [option_name("tls")] = true })
o = s:option(Value, option_name("reality_private_key"), translate("Private Key"))

View File

@ -74,6 +74,7 @@ function gen_outbound(flag, node, tag, proxy_table)
type = node.protocol,
server = node.address,
server_port = tonumber(node.port),
domain_strategy = node.domain_strategy,
detour = node.detour,
}

View File

@ -1479,3 +1479,6 @@ msgstr "分片间隔"
msgid "Fragmentation interval (ms)"
msgstr "分片间隔ms"
msgid "If is domain name, The requested domain name will be resolved to IP before connect."
msgstr "如果是域名,域名将在请求发出之前解析为 IP。"

View File

@ -119,7 +119,9 @@ insert_nftset() {
local nftset_elements
[ -n "${1}" ] && {
if [ "$timeout_argument" == "0" ]; then
if [ "$timeout_argument" == "-1" ]; then
nftset_elements=$(echo -e $@ | sed 's/\s/, /g')
elif [ "$timeout_argument" == "0" ]; then
nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $defalut_timeout_argument, /g" | sed "s/$/ timeout $defalut_timeout_argument/")
else
nftset_elements=$(echo -e $@ | sed "s/\s/ timeout $timeout_argument, /g" | sed "s/$/ timeout $timeout_argument/")
@ -139,7 +141,8 @@ gen_nftset() {
local ip_type="${1}"; shift
# 0 - don't set defalut timeout
local timeout_argument_set="${1}"; shift
# 0 - don't let element timeout(3650 days)
# 0 - don't let element timeout(3650 days) when set's timeout parameters be seted
# -1 - follow the set's timeout parameters
local timeout_argument_element="${1}"; shift
nft "list set inet fw4 $nftset_name" &>/dev/null
@ -299,7 +302,7 @@ load_acl() {
else
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp ${_ipt_source} ip daddr $FAKE_IP counter jump PSW2_RULE comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp ${_ipt_source} $(factor $tcp_redir_ports "tcp dport") counter jump PSW2_RULE comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE meta nfproto {ipv4} meta l4proto tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp ${_ipt_source} $(REDIRECT $redir_port TPROXY4) comment \"$remarks\""
fi
[ "$PROXY_IPV6" == "1" ] && {
@ -322,7 +325,7 @@ load_acl() {
msg2="${msg}使用UDP节点[$node_remark] [$(get_action_chain_name $udp_proxy_mode)]"
msg2="${msg2}(TPROXY:${redir_port})代理"
[ "$udp_no_redir_ports" != "disable" ] && {
nft "add rule inet fw4 PSW2_MANGLE meta l4proto udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE_V6 meta l4proto udp ${_ipt_source} $(factor $udp_no_redir_ports "udp dport") counter return comment \"$remarks\"" 2>/dev/null
msg2="${msg2}[$?]除${udp_no_redir_ports}外的"
}
@ -392,7 +395,7 @@ load_acl() {
else
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp ip daddr $FAKE_IP counter jump PSW2_RULE comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") jump PSW2_RULE comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE meta l4proto tcp $(REDIRECT $REDIR_PORT TPROXY) comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp $(REDIRECT $REDIR_PORT TPROXY4) comment \"默认\""
fi
[ "$PROXY_IPV6" == "1" ] && {
@ -422,7 +425,7 @@ load_acl() {
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp ip daddr @$nftset_global_whitelist counter return comment \"$remarks\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") jump PSW2_RULE comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE meta l4proto udp $(REDIRECT $REDIR_PORT TPROXY) comment \"默认\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp $(REDIRECT $REDIR_PORT TPROXY4) comment \"默认\""
[ "$PROXY_IPV6" == "1" ] && [ "$PROXY_IPV6_UDP" == "1" ] && {
nft "add rule inet fw4 PSW2_MANGLE_V6 meta l4proto udp ip6 daddr @$nftset_global_whitelist6 counter return comment \"$remarks\""
@ -441,7 +444,7 @@ load_acl() {
filter_haproxy() {
for item in $(uci show $CONFIG | grep ".lbss=" | cut -d "'" -f 2); do
local ip=$(get_host_ip ipv4 $(echo $item | awk -F ":" '{print $1}') 1)
[ -n "$ip" ] && insert_nftset $NFTSET_VPSLIST 0 $ip
[ -n "$ip" ] && insert_nftset $NFTSET_VPSLIST "-1" $ip
done
echolog "加入负载均衡的节点到nftset[$NFTSET_VPSLIST]直连完成"
}
@ -450,14 +453,14 @@ filter_vps_addr() {
for server_host in $@; do
local vps_ip4=$(get_host_ip "ipv4" ${server_host})
local vps_ip6=$(get_host_ip "ipv6" ${server_host})
[ -n "$vps_ip4" ] && insert_nftset $NFTSET_VPSLIST 0 $vps_ip4
[ -n "$vps_ip6" ] && insert_nftset $NFTSET_VPSLIST6 0 $vps_ip6
[ -n "$vps_ip4" ] && insert_nftset $NFTSET_VPSLIST "-1" $vps_ip4
[ -n "$vps_ip6" ] && insert_nftset $NFTSET_VPSLIST6 "-1" $vps_ip6
done
}
filter_vpsip() {
insert_nftset $NFTSET_VPSLIST 0 $(uci show $CONFIG | grep ".address=" | cut -d "'" -f 2 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | sed -e "/^$/d")
insert_nftset $NFTSET_VPSLIST6 0 $(uci show $CONFIG | grep ".address=" | cut -d "'" -f 2 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "/^$/d")
insert_nftset $NFTSET_VPSLIST "-1" $(uci show $CONFIG | grep ".address=" | cut -d "'" -f 2 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | sed -e "/^$/d")
insert_nftset $NFTSET_VPSLIST6 "-1" $(uci show $CONFIG | grep ".address=" | cut -d "'" -f 2 | grep -E "([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}" | sed -e "/^$/d")
echolog "加入所有节点到nftset[$NFTSET_VPSLIST]直连完成"
}
@ -564,16 +567,16 @@ filter_node() {
}
dns_hijack() {
nft "add rule inet fw4 dstnat ip protocol udp ip dport 53 redirect to 53"
nft "add rule inet fw4 dstnat meta l4proto udp ip dport 53 redirect to 53"
echolog "强制转发本机DNS端口 UDP/53 的请求[$?]"
}
add_firewall_rule() {
echolog "开始加载防火墙规则..."
gen_nftset $NFTSET_LANLIST ipv4_addr 0 0 $(gen_lanlist)
gen_nftset $NFTSET_LANLIST ipv4_addr 0 "-1" $(gen_lanlist)
gen_nftset $NFTSET_VPSLIST ipv4_addr 0 0
gen_nftset $NFTSET_LANLIST6 ipv6_addr 0 0 $(gen_lanlist_6)
gen_nftset $NFTSET_LANLIST6 ipv6_addr 0 "-1" $(gen_lanlist_6)
gen_nftset $NFTSET_VPSLIST6 ipv6_addr 0 0
# 忽略特殊IP段
@ -585,14 +588,14 @@ add_firewall_rule() {
#echolog "本机IPv4网段互访直连${lan_ip}"
#echolog "本机IPv6网段互访直连${lan_ip6}"
[ -n "$lan_ip" ] && insert_nftset $NFTSET_LANLIST 0 $(echo $lan_ip | sed -e "s/ /\n/g")
[ -n "$lan_ip6" ] && insert_nftset $NFTSET_LANLIST6 0 $(echo $lan_ip6 | sed -e "s/ /\n/g")
[ -n "$lan_ip" ] && insert_nftset $NFTSET_LANLIST "-1" $(echo $lan_ip | sed -e "s/ /\n/g")
[ -n "$lan_ip6" ] && insert_nftset $NFTSET_LANLIST6 "-1" $(echo $lan_ip6 | sed -e "s/ /\n/g")
}
[ -n "$ISP_DNS" ] && {
#echolog "处理 ISP DNS 例外..."
for ispip in $ISP_DNS; do
insert_nftset $NFTSET_LANLIST 0 $ispip >/dev/null 2>&1 &
insert_nftset $NFTSET_LANLIST "-1" $ispip >/dev/null 2>&1 &
#echolog " - 追加到白名单:${ispip}"
done
}
@ -600,7 +603,7 @@ add_firewall_rule() {
[ -n "$ISP_DNS6" ] && {
#echolog "处理 ISP IPv6 DNS 例外..."
for ispip6 in $ISP_DNS6; do
insert_nftset $NFTSET_LANLIST6 0 $ispip6 >/dev/null 2>&1 &
insert_nftset $NFTSET_LANLIST6 "-1" $ispip6 >/dev/null 2>&1 &
#echolog " - 追加到白名单:${ispip6}"
done
}
@ -630,7 +633,7 @@ add_firewall_rule() {
nft_output_chain="PSW2_OUTPUT_MANGLE"
fi
nft "add chain inet fw4 nat_output { type nat hook output priority -1; }"
[ -z "$(nft list chain inet fw4 nat_output 2>/dev/null)" ] && nft "add chain inet fw4 nat_output { type nat hook output priority -1; }"
nft "add chain inet fw4 PSW2_DIVERT"
nft "flush chain inet fw4 PSW2_DIVERT"
@ -789,9 +792,9 @@ add_firewall_rule() {
else
nft "add rule inet fw4 PSW2_OUTPUT_MANGLE ip protocol tcp ip daddr $FAKE_IP counter jump PSW2_RULE"
nft "add rule inet fw4 PSW2_OUTPUT_MANGLE ip protocol tcp $(factor $TCP_REDIR_PORTS "tcp dport") jump PSW2_RULE"
nft "add rule inet fw4 PSW2_MANGLE meta l4proto tcp iif lo $(REDIRECT $REDIR_PORT TPROXY) comment \"本机\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"本机\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol tcp iif lo counter return comment \"本机\""
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} meta l4proto tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
fi
[ "$PROXY_IPV6" == "1" ] && {
@ -823,9 +826,9 @@ add_firewall_rule() {
nft "add rule inet fw4 PSW2_OUTPUT_MANGLE ip protocol udp ip daddr $FAKE_IP counter jump PSW2_RULE"
nft "add rule inet fw4 PSW2_OUTPUT_MANGLE ip protocol udp $(factor $UDP_REDIR_PORTS "udp dport") jump PSW2_RULE"
nft "add rule inet fw4 PSW2_MANGLE meta l4proto udp iif lo $(REDIRECT $REDIR_PORT TPROXY) comment \"本机\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp iif lo $(REDIRECT $REDIR_PORT TPROXY4) comment \"本机\""
nft "add rule inet fw4 PSW2_MANGLE ip protocol udp iif lo counter return comment \"本机\""
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} meta l4proto udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
if [ "$PROXY_IPV6_UDP" == "1" ]; then
nft "add rule inet fw4 PSW2_OUTPUT_MANGLE_V6 meta l4proto udp ip6 daddr $FAKE_IP_6 jump PSW2_RULE"
@ -950,11 +953,11 @@ gen_include() {
[ ! -z "\${WAN_IP}" ] && nft "replace rule inet fw4 PSW2_MANGLE handle \$PR_INDEX ip daddr "\${WAN_IP}" counter return comment \"WAN_IP_RETURN\""
fi
nft "add rule inet fw4 mangle_prerouting meta nfproto {ipv4} counter jump PSW2_MANGLE"
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} meta l4proto tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
nft "add rule inet fw4 mangle_output meta nfproto {ipv4} ip protocol tcp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
}
\$(sh ${MY_PATH} insert_rule_before "inet fw4" "mangle_prerouting" "PSW2_MANGLE" "counter jump PSW2_DIVERT")
[ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ] && nft "add rule inet fw4 mangle_output meta nfproto {ipv4} meta l4proto udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
[ "$UDP_NODE" != "nil" -o "$TCP_UDP" = "1" ] && nft "add rule inet fw4 mangle_output meta nfproto {ipv4} ip protocol udp counter jump PSW2_OUTPUT_MANGLE comment \"PSW2_OUTPUT_MANGLE\""
[ "$PROXY_IPV6" == "1" ] && {
PR_INDEX=\$(sh ${MY_PATH} RULE_LAST_INDEX "inet fw4" PSW2_MANGLE_V6 WAN6_IP_RETURN -1)

View File

@ -1110,33 +1110,38 @@ local function parse_link(raw, add_mode, add_from)
for _, v in ipairs(nodes) do
if v then
local result
if szType == 'ssd' then
result = processData(szType, v, add_mode, add_from)
elseif not szType then
local node = trim(v)
local dat = split(node, "://")
if dat and dat[1] and dat[2] then
if dat[1] == 'ss' or dat[1] == 'trojan' then
result = processData(dat[1], dat[2], add_mode, add_from)
xpcall(function ()
local result
if szType == 'ssd' then
result = processData(szType, v, add_mode, add_from)
elseif not szType then
local node = trim(v)
local dat = split(node, "://")
if dat and dat[1] and dat[2] then
if dat[1] == 'ss' or dat[1] == 'trojan' then
result = processData(dat[1], dat[2], add_mode, add_from)
else
result = processData(dat[1], base64Decode(dat[2]), add_mode, add_from)
end
end
else
log('跳过未知类型: ' .. szType)
end
-- log(result)
if result then
if not result.type then
log('丢弃节点:' .. result.remarks .. ",找不到可使用二进制.")
elseif (add_mode == "2" and is_filter_keyword(result.remarks)) or not result.address or result.remarks == "NULL" or result.address == "127.0.0.1" or
(not datatypes.hostname(result.address) and not (api.is_ip(result.address))) then
log('丢弃过滤节点: ' .. result.type .. ' 节点, ' .. result.remarks)
else
result = processData(dat[1], base64Decode(dat[2]), add_mode, add_from)
tinsert(node_list, result)
end
end
else
log('跳过未知类型: ' .. szType)
end
-- log(result)
if result then
if not result.type then
log('丢弃节点:' .. result.remarks .. ",找不到可使用二进制.")
elseif (add_mode == "2" and is_filter_keyword(result.remarks)) or not result.address or result.remarks == "NULL" or result.address == "127.0.0.1" or
(not datatypes.hostname(result.address) and not (api.is_ip(result.address))) then
log('丢弃过滤节点: ' .. result.type .. ' 节点, ' .. result.remarks)
else
tinsert(node_list, result)
end
end, function ()
log(v, "解析错误,跳过此节点。")
end
)
end
end
if #node_list > 0 then

View File

@ -1,12 +1,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=xray-core
PKG_VERSION:=1.8.7
PKG_VERSION:=1.8.8
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/XTLS/Xray-core/tar.gz/v$(PKG_VERSION)?
PKG_HASH:=e8f46177d792b89700f164ca28fbf1a3c7d95a3ecf98871cb0dd5e474b46a859
PKG_HASH:=156105b89465ca948971a774c0bc7e56ee68e764bdfde58923037dc837aab4be
PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
PKG_LICENSE:=MPL-2.0