fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

luci-app-passwall: bump to 3.9-66

Browse Source
This commit is contained in:
CN_SZTL 2020-10-04 06:53:57 +08:00
parent 37069a4992
commit 6fec104ca5
No known key found for this signature in database
GPG Key ID: 6850B6345C862176
7 changed files with 128 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/lienol/luci-app-passwall/Makefile
View File

@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-passwall
PKG_VERSION:=3.9
PKG_RELEASE:=65
PKG_DATE:=20201003
PKG_RELEASE:=66
PKG_DATE:=20201004
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

6
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua
View File

@ -4,8 +4,14 @@ local node_section = arg[1]
local run_type = arg[2]
local local_addr = arg[3]
local local_port = arg[4]
local relay_port = arg[5]
local node = ucursor:get_all("passwall", node_section)
if relay_port and relay_port ~= "nil" then
node.address = "127.0.0.1"
node.port = tonumber(relay_port)
end
local config = {
listen = run_type .. "://" .. local_addr .. ":" .. local_port,
proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. node.address .. ":" .. node.port

7
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua
View File

@ -4,6 +4,7 @@ local node_section = arg[1]
local run_type = arg[2]
local local_addr = arg[3]
local local_port = arg[4]
local relay_port = arg[5]
local node = ucursor:get_all("passwall", node_section)
local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
@ -22,7 +23,7 @@ local trojan = {
cert = node.trojan_cert_path,
cipher = cipher,
cipher_tls13 = cipher13,
sni = node.tls_serverName,
sni = node.tls_serverName or node.address,
alpn = {"h2", "http/1.1"},
reuse_session = true,
session_ticket = (node.tls_sessionTicket and node.tls_sessionTicket == "1") and true or false,
@ -67,4 +68,8 @@ if node.type == "Trojan-Go" then
password = node.ss_aead_pwd or ""
} or nil
end
if relay_port and relay_port ~= "nil" then
trojan.remote_addr = "127.0.0.1"
trojan.remote_port = tonumber(relay_port)
end
print(json.stringify(trojan, 1))

59
package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua
View File

@ -11,8 +11,18 @@ local inbounds = {}
local outbounds = {}
local network = proto
local routing = nil
local new_port
local function gen_outbound(node, tag)
local function get_new_port()
if new_port then
new_port = tonumber(sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port %s tcp)", appname, new_port + 1)))
else
new_port = tonumber(sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port auto tcp)", appname)))
end
return new_port
end
local function gen_outbound(node, tag, relay_port)
local result = nil
if node then
local node_id = node[".name"]
@ -25,15 +35,17 @@ local function gen_outbound(node, tag)
node.transport = "tcp"
else
local node_type = (proto and proto ~= "nil") and proto or "socks"
local new_port = sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port auto tcp)", appname))
new_port = get_new_port()
node.port = new_port
sys.call(string.format("/usr/share/%s/app.sh run_socks %s %s %s %s %s > /dev/null",
sys.call(string.format('/usr/share/%s/app.sh run_socks "%s" "%s" "%s" "%s" "%s" "%s"> /dev/null',
appname,
node_id,
"127.0.0.1",
new_port,
string.format("/var/etc/%s/v2_%s_%s.json", appname, node_type, node_id),
"4")
"4",
relay_port and tostring(relay_port) or ""
)
)
node.protocol = "socks"
node.transport = "tcp"
@ -140,7 +152,7 @@ end
if socks_proxy_port ~= "nil" then
table.insert(inbounds, {
listen = "0.0.0.0",
port = socks_proxy_port,
port = tonumber(socks_proxy_port),
protocol = "socks",
settings = {auth = "noauth", udp = true, ip = "127.0.0.1"}
})
@ -149,7 +161,7 @@ end
if redir_port ~= "nil" then
table.insert(inbounds, {
port = redir_port,
port = tonumber(redir_port),
protocol = "dokodemo-door",
settings = {network = proto, followRedirect = true},
sniffing = {enabled = true, destOverride = {"http", "tls"}}
@ -175,14 +187,39 @@ end
if node.protocol == "_shunt" then
local rules = {}
ucursor:foreach(appname, "shunt_rules", function(e)
local _node_id = node[e[".name"]] or nil
local name = e[".name"]
local _node_id = node[name] or nil
if _node_id and _node_id ~= "nil" then
local _node = ucursor:get_all(appname, _node_id)
local _outbound = gen_outbound(_node, e[".name"])
local is_proxy = node[name .. "_proxy"]
local relay_port
if is_proxy and is_proxy == "1" then
new_port = get_new_port()
relay_port = new_port
table.insert(inbounds, {
tag = "proxy_" .. name,
listen = "127.0.0.1",
port = new_port,
protocol = "dokodemo-door",
settings = {network = "tcp,udp", address = _node.address, port = tonumber(_node.port)}
})
if _node.tls_serverName == nil then
_node.tls_serverName = _node.address
end
_node.address = "127.0.0.1"
_node.port = new_port
end
local _outbound = gen_outbound(_node, name, relay_port)
if _outbound then
table.insert(outbounds, _outbound)
if is_proxy and is_proxy == "1" then
table.insert(rules, {
type = "field",
inboundTag = {"proxy_" .. name},
outboundTag = "default"
})
end
if e.domain_list then
local _domain = {}
string.gsub(e.domain_list, '[^' .. "\r\n" .. ']+', function(w)
@ -190,7 +227,7 @@ if node.protocol == "_shunt" then
end)
table.insert(rules, {
type = "field",
outboundTag = e[".name"],
outboundTag = name,
domain = _domain
})
end
@ -201,7 +238,7 @@ if node.protocol == "_shunt" then
end)
table.insert(rules, {
type = "field",
outboundTag = e[".name"],
outboundTag = name,
ip = _ip
})
end

15
package/lienol/luci-app-passwall/root/etc/config/passwall
View File

@ -80,14 +80,25 @@ gvt2.com'
config shunt_rules 'netflix'
option remarks '奈飞'
option domain_list 'netflix
option domain_list 'fast.com
netflix
netflix.com
netflix.net
nflxso.net
nflxext.com
nflximg.com
nflximg.net
nflxvideo.net
fast.com'
netflixdnstest0.com
netflixdnstest1.com
netflixdnstest2.com
netflixdnstest3.com
netflixdnstest4.com
netflixdnstest5.com
netflixdnstest6.com
netflixdnstest7.com
netflixdnstest8.com
netflixdnstest9.com'
config shunt_rules 'TVB'
option remarks 'TVB'

42
package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
View File

@ -218,12 +218,12 @@ ln_start_bin() {
shift 2;
if [ "${file_func%%/*}" != "${file_func}" ]; then
[ ! -L "${file_func}" ] && {
ln -s "${file_func}" "${TMP_BIN_PATH}/${ln_name}"
ln -s "${file_func}" "${TMP_BIN_PATH}/${ln_name}" >/dev/null 2>&1
file_func="${TMP_BIN_PATH}/${ln_name}"
}
[ -x "${file_func}" ] || echolog " - $(readlink ${file_func}) 没有执行权限，无法启动：${file_func} $*"
fi
echo "${file_func} $*" >&2
#echo "${file_func} $*" >&2
[ -n "${file_func}" ] || echolog " - 找不到 ${ln_name}，无法启动..."
${file_func:-echolog " - ${ln_name}"} "$@" >/dev/null 2>&1 &
}
@ -310,10 +310,16 @@ run_socks() {
local bind=$2
local local_port=$3
local config_file=$4
local relay_port=$6
local type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z')
local remarks=$(config_n_get $node remarks)
local server_host=$(config_n_get $node address)
local port=$(config_n_get $node port)
[ -n "$relay_port" ] && {
server_host="127.0.0.1"
port=$relay_port
echo $relay_port
}
local msg tmp
if [ -n "$server_host" ] && [ -n "$port" ]; then
@ -347,15 +353,15 @@ run_socks() {
ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray -config="$config_file"
;;
trojan-go)
lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file
ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file"
;;
trojan*)
lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file
ln_start_bin "$(first_type ${type})" "${type}" -c "$config_file"
;;
naiveproxy)
lua $API_GEN_NAIVE $node socks $bind $local_port > $config_file
lua $API_GEN_NAIVE $node socks $bind $local_port $port > $config_file
ln_start_bin "$(first_type naive)" naive "$config_file"
;;
brook)
@ -367,7 +373,7 @@ run_socks() {
ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" "brook_SOCKS_$5" "$protocol" --socks5 "$bind:$local_port" -s "$server_host:$port" -p "$(config_n_get $node password)"
;;
ss|ssr)
lua $API_GEN_SS $node $local_port > $config_file
lua $API_GEN_SS $node $local_port $server_host $port > $config_file
ln_start_bin "$(first_type ${type}-local)" "${type}-local" -c "$config_file" -b "$bind" -u
;;
esac
@ -863,6 +869,16 @@ add_dnsmasq() {
echolog " - [$?]中国域名表(chnroute)：${fwd_dns:-默认}"
}
}
#分流规则
fwd_dns="${TUN_DNS}"
#如果使用chnlist直接使用默认DNS
[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}')
for shunt_id in $shunt_ids; do
config_n_get $shunt_id domain_list | tr -s "\r\n" "\n" | gen_dnsmasq_items "shuntlist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/shunt_host.conf"
echolog " - [$?]$shunt_id分流规则(shuntlist)：${fwd_dns:-默认}"
done
#始终使用远程DNS解析代理（黑名单）列表
fwd_dns="${TUN_DNS}"
@ -1184,21 +1200,23 @@ stop() {
echolog "清空并关闭相关程序和缓存完成。"
}
case $1 in
arg1=$1
shift
case $arg1 in
get_new_port)
get_new_port $2 $3
get_new_port $@
;;
run_socks)
run_socks $2 $3 $4 $5 $6
run_socks $@
;;
run_redir)
run_redir $2 $3 $4 $5 $6 $7
run_redir $@
;;
node_switch)
node_switch $2 $3 $4 $5
node_switch $@
;;
stop)
[ "$2" = "force" ] && force_stop
[ "$1" = "force" ] && force_stop
stop
;;
start)

30
package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh
View File

@ -2,6 +2,7 @@
IPSET_LANIPLIST="laniplist"
IPSET_VPSIPLIST="vpsiplist"
IPSET_SHUNTLIST="shuntlist"
IPSET_GFW="gfwlist"
#IPSET_GFW6="gfwlist6"
IPSET_CHN="chnroute"
@ -163,6 +164,7 @@ load_acl() {
msg2="${msg2}[$?]除${tcp_no_redir_ports}外的"
}
msg2="${msg2}所有端口"
$ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $tcp_port $is_tproxy)
$ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $tcp_port $is_tproxy)
$ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(get_redirect_ipt $tcp_proxy_mode $tcp_port $is_tproxy)
}
@ -180,6 +182,7 @@ load_acl() {
msg2="${msg2}[$?]除${udp_no_redir_ports}外的"
}
msg2="${msg2}所有端口"
$ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $udp_port TPROXY)
$ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $udp_port TPROXY)
$ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $udp_proxy_mode $udp_port TPROXY)
}
@ -247,6 +250,7 @@ load_acl() {
fi
[ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
msg="${msg}所有端口"
$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy)
$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy)
$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy)
echolog "${msg}"
@ -276,6 +280,7 @@ load_acl() {
msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理"
[ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
msg="${msg}所有端口"
$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY)
$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY)
$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY)
echolog "${msg}"
@ -353,10 +358,17 @@ filter_node() {
local proxy_protocol=$(config_n_get $proxy_node protocol)
local proxy_type=$(echo $(config_n_get $proxy_node type nil) | tr 'A-Z' 'a-z')
[ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 0
if [ "$proxy_protocol" == "_shunt" ]; then
if [ "$proxy_protocol" == "_balancing" ]; then
#echolog " - 多节点负载均衡（${proxy_type}）..."
proxy_node=$(config_n_get $proxy_node balancing_node)
for _node in $proxy_node; do
filter_rules "$_node" "$stream"
done
elif [ "$proxy_protocol" == "_shunt" ]; then
#echolog " - 按请求目的地址分流（${proxy_type}）..."
local default_node=$(config_n_get $proxy_node default_node nil)
filter_rules $default_node $stream
:<<!
local default_node_address=$(get_host_ip ipv4 $(config_n_get $default_node address) 1)
local default_node_port=$(config_n_get $default_node port)
@ -375,12 +387,7 @@ filter_node() {
filter_rules "$(config_n_get $proxy_node $shunt_id)" "$stream" "$shunt_proxy" "$proxy_port"
}
done
elif [ "$proxy_protocol" == "_balancing" ]; then
#echolog " - 多节点负载均衡（${proxy_type}）..."
proxy_node=$(config_n_get $proxy_node balancing_node)
for _node in $proxy_node; do
filter_rules "$_node" "$stream"
done
!
else
#echolog " - 普通节点（${proxy_type}）..."
filter_rules "$proxy_node" "$stream"
@ -396,6 +403,7 @@ add_firewall_rule() {
echolog "开始加载防火墙规则..."
ipset -! create $IPSET_LANIPLIST nethash
ipset -! create $IPSET_VPSIPLIST nethash
ipset -! create $IPSET_SHUNTLIST nethash
ipset -! create $IPSET_GFW nethash
#ipset -! create $IPSET_GFW6 nethash family inet6
ipset -! create $IPSET_CHN nethash
@ -405,6 +413,10 @@ add_firewall_rule() {
ipset -! create $IPSET_BLACKLIST3 nethash
ipset -! create $IPSET_WHITELIST nethash
local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}')
for shunt_id in $shunt_ids; do
config_n_get $shunt_id ip_list | tr -s "\r\n" "\n" | sed -e "/^$/d" | sed -e "s/^/add $IPSET_SHUNTLIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
done
cat $RULES_PATH/chnroute | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
cat $RULES_PATH/chnroute6 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
cat $RULES_PATH/proxy_ip | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
@ -499,6 +511,7 @@ add_firewall_rule() {
$ipt_tmp -A PSW_OUTPUT -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
echolog " - [$?]不代理TCP 端口：$TCP_NO_REDIR_PORTS"
}
$ipt_tmp -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $blist_r
$ipt_tmp -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $blist_r
$ipt_tmp -A PSW_OUTPUT -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $p_r
fi
@ -606,6 +619,7 @@ add_firewall_rule() {
$ipt_m -A PSW_OUTPUT -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN
echolog " - [$?]不代理 UDP 端口：$UDP_NO_REDIR_PORTS"
}
$ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT 1 MARK)
$ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT 1 MARK)
$ipt_m -A PSW_OUTPUT -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $LOCALHOST_UDP_PROXY_MODE 1 MARK)
fi
@ -647,6 +661,7 @@ del_firewall_rule() {
ipset -F $IPSET_LANIPLIST >/dev/null 2>&1 && ipset -X $IPSET_LANIPLIST >/dev/null 2>&1 &
ipset -F $IPSET_VPSIPLIST >/dev/null 2>&1 && ipset -X $IPSET_VPSIPLIST >/dev/null 2>&1 &
#ipset -F $IPSET_SHUNTLIST >/dev/null 2>&1 && ipset -X $IPSET_SHUNTLIST >/dev/null 2>&1 &
#ipset -F $IPSET_GFW >/dev/null 2>&1 && ipset -X $IPSET_GFW >/dev/null 2>&1 &
#ipset -F $IPSET_GFW6 >/dev/null 2>&1 && ipset -X $IPSET_GFW6 >/dev/null 2>&1 &
#ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 &
@ -661,6 +676,7 @@ del_firewall_rule() {
flush_ipset() {
ipset -F $IPSET_LANIPLIST >/dev/null 2>&1 && ipset -X $IPSET_LANIPLIST >/dev/null 2>&1 &
ipset -F $IPSET_VPSIPLIST >/dev/null 2>&1 && ipset -X $IPSET_VPSIPLIST >/dev/null 2>&1 &
ipset -F $IPSET_SHUNTLIST >/dev/null 2>&1 && ipset -X $IPSET_SHUNTLIST >/dev/null 2>&1 &
ipset -F $IPSET_GFW >/dev/null 2>&1 && ipset -X $IPSET_GFW >/dev/null 2>&1 &
#ipset -F $IPSET_GFW6 >/dev/null 2>&1 && ipset -X $IPSET_GFW6 >/dev/null 2>&1 &
ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 &