From 6fec104ca505c2305d21054b0a925042dff5bef6 Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Sun, 4 Oct 2020 06:53:57 +0800 Subject: [PATCH] luci-app-passwall: bump to 3.9-66 --- package/lienol/luci-app-passwall/Makefile | 4 +- .../model/cbi/passwall/api/gen_naiveproxy.lua | 6 ++ .../model/cbi/passwall/api/gen_trojan.lua | 7 ++- .../model/cbi/passwall/api/gen_v2ray.lua | 59 +++++++++++++++---- .../root/etc/config/passwall | 15 ++++- .../root/usr/share/passwall/app.sh | 42 +++++++++---- .../root/usr/share/passwall/iptables.sh | 30 +++++++--- 7 files changed, 128 insertions(+), 35 deletions(-) diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile index 643ce86ead..4e966196ac 100644 --- a/package/lienol/luci-app-passwall/Makefile +++ b/package/lienol/luci-app-passwall/Makefile @@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=3.9 -PKG_RELEASE:=65 -PKG_DATE:=20201003 +PKG_RELEASE:=66 +PKG_DATE:=20201004 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua index 06bad70c7d..f45ca60cb9 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua @@ -4,8 +4,14 @@ local node_section = arg[1] local run_type = arg[2] local local_addr = arg[3] local local_port = arg[4] +local relay_port = arg[5] local node = ucursor:get_all("passwall", node_section) +if relay_port and relay_port ~= "nil" then + node.address = "127.0.0.1" + node.port = tonumber(relay_port) +end + local config = { listen = run_type .. "://" .. local_addr .. ":" .. local_port, proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. node.address .. ":" .. node.port diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua index c8fd459899..a8e75f5dd8 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua @@ -4,6 +4,7 @@ local node_section = arg[1] local run_type = arg[2] local local_addr = arg[3] local local_port = arg[4] +local relay_port = arg[5] local node = ucursor:get_all("passwall", node_section) local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA" @@ -22,7 +23,7 @@ local trojan = { cert = node.trojan_cert_path, cipher = cipher, cipher_tls13 = cipher13, - sni = node.tls_serverName, + sni = node.tls_serverName or node.address, alpn = {"h2", "http/1.1"}, reuse_session = true, session_ticket = (node.tls_sessionTicket and node.tls_sessionTicket == "1") and true or false, @@ -67,4 +68,8 @@ if node.type == "Trojan-Go" then password = node.ss_aead_pwd or "" } or nil end +if relay_port and relay_port ~= "nil" then + trojan.remote_addr = "127.0.0.1" + trojan.remote_port = tonumber(relay_port) +end print(json.stringify(trojan, 1)) diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua index 5b5f0222bd..52495f2fc3 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua @@ -11,8 +11,18 @@ local inbounds = {} local outbounds = {} local network = proto local routing = nil +local new_port -local function gen_outbound(node, tag) +local function get_new_port() + if new_port then + new_port = tonumber(sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port %s tcp)", appname, new_port + 1))) + else + new_port = tonumber(sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port auto tcp)", appname))) + end + return new_port +end + +local function gen_outbound(node, tag, relay_port) local result = nil if node then local node_id = node[".name"] @@ -25,15 +35,17 @@ local function gen_outbound(node, tag) node.transport = "tcp" else local node_type = (proto and proto ~= "nil") and proto or "socks" - local new_port = sys.exec(string.format("echo -n $(/usr/share/%s/app.sh get_new_port auto tcp)", appname)) + new_port = get_new_port() node.port = new_port - sys.call(string.format("/usr/share/%s/app.sh run_socks %s %s %s %s %s > /dev/null", + sys.call(string.format('/usr/share/%s/app.sh run_socks "%s" "%s" "%s" "%s" "%s" "%s"> /dev/null', appname, node_id, "127.0.0.1", new_port, string.format("/var/etc/%s/v2_%s_%s.json", appname, node_type, node_id), - "4") + "4", + relay_port and tostring(relay_port) or "" + ) ) node.protocol = "socks" node.transport = "tcp" @@ -140,7 +152,7 @@ end if socks_proxy_port ~= "nil" then table.insert(inbounds, { listen = "0.0.0.0", - port = socks_proxy_port, + port = tonumber(socks_proxy_port), protocol = "socks", settings = {auth = "noauth", udp = true, ip = "127.0.0.1"} }) @@ -149,7 +161,7 @@ end if redir_port ~= "nil" then table.insert(inbounds, { - port = redir_port, + port = tonumber(redir_port), protocol = "dokodemo-door", settings = {network = proto, followRedirect = true}, sniffing = {enabled = true, destOverride = {"http", "tls"}} @@ -175,14 +187,39 @@ end if node.protocol == "_shunt" then local rules = {} - ucursor:foreach(appname, "shunt_rules", function(e) - local _node_id = node[e[".name"]] or nil + local name = e[".name"] + local _node_id = node[name] or nil if _node_id and _node_id ~= "nil" then local _node = ucursor:get_all(appname, _node_id) - local _outbound = gen_outbound(_node, e[".name"]) + local is_proxy = node[name .. "_proxy"] + local relay_port + if is_proxy and is_proxy == "1" then + new_port = get_new_port() + relay_port = new_port + table.insert(inbounds, { + tag = "proxy_" .. name, + listen = "127.0.0.1", + port = new_port, + protocol = "dokodemo-door", + settings = {network = "tcp,udp", address = _node.address, port = tonumber(_node.port)} + }) + if _node.tls_serverName == nil then + _node.tls_serverName = _node.address + end + _node.address = "127.0.0.1" + _node.port = new_port + end + local _outbound = gen_outbound(_node, name, relay_port) if _outbound then table.insert(outbounds, _outbound) + if is_proxy and is_proxy == "1" then + table.insert(rules, { + type = "field", + inboundTag = {"proxy_" .. name}, + outboundTag = "default" + }) + end if e.domain_list then local _domain = {} string.gsub(e.domain_list, '[^' .. "\r\n" .. ']+', function(w) @@ -190,7 +227,7 @@ if node.protocol == "_shunt" then end) table.insert(rules, { type = "field", - outboundTag = e[".name"], + outboundTag = name, domain = _domain }) end @@ -201,7 +238,7 @@ if node.protocol == "_shunt" then end) table.insert(rules, { type = "field", - outboundTag = e[".name"], + outboundTag = name, ip = _ip }) end diff --git a/package/lienol/luci-app-passwall/root/etc/config/passwall b/package/lienol/luci-app-passwall/root/etc/config/passwall index c96dc855ed..b95c03068b 100644 --- a/package/lienol/luci-app-passwall/root/etc/config/passwall +++ b/package/lienol/luci-app-passwall/root/etc/config/passwall @@ -80,14 +80,25 @@ gvt2.com' config shunt_rules 'netflix' option remarks '奈飞' - option domain_list 'netflix + option domain_list 'fast.com +netflix netflix.com +netflix.net nflxso.net nflxext.com nflximg.com nflximg.net nflxvideo.net -fast.com' +netflixdnstest0.com +netflixdnstest1.com +netflixdnstest2.com +netflixdnstest3.com +netflixdnstest4.com +netflixdnstest5.com +netflixdnstest6.com +netflixdnstest7.com +netflixdnstest8.com +netflixdnstest9.com' config shunt_rules 'TVB' option remarks 'TVB' diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh index 161c341762..22005f34fa 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh @@ -218,12 +218,12 @@ ln_start_bin() { shift 2; if [ "${file_func%%/*}" != "${file_func}" ]; then [ ! -L "${file_func}" ] && { - ln -s "${file_func}" "${TMP_BIN_PATH}/${ln_name}" + ln -s "${file_func}" "${TMP_BIN_PATH}/${ln_name}" >/dev/null 2>&1 file_func="${TMP_BIN_PATH}/${ln_name}" } [ -x "${file_func}" ] || echolog " - $(readlink ${file_func}) 没有执行权限，无法启动：${file_func} $*" fi - echo "${file_func} $*" >&2 + #echo "${file_func} $*" >&2 [ -n "${file_func}" ] || echolog " - 找不到 ${ln_name}，无法启动..." ${file_func:-echolog " - ${ln_name}"} "$@" >/dev/null 2>&1 & } @@ -310,10 +310,16 @@ run_socks() { local bind=$2 local local_port=$3 local config_file=$4 + local relay_port=$6 local type=$(echo $(config_n_get $node type) | tr 'A-Z' 'a-z') local remarks=$(config_n_get $node remarks) local server_host=$(config_n_get $node address) local port=$(config_n_get $node port) + [ -n "$relay_port" ] && { + server_host="127.0.0.1" + port=$relay_port + echo $relay_port + } local msg tmp if [ -n "$server_host" ] && [ -n "$port" ]; then @@ -347,15 +353,15 @@ run_socks() { ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray -config="$config_file" ;; trojan-go) - lua $API_GEN_TROJAN $node client $bind $local_port > $config_file + lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file" ;; trojan*) - lua $API_GEN_TROJAN $node client $bind $local_port > $config_file + lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file ln_start_bin "$(first_type ${type})" "${type}" -c "$config_file" ;; naiveproxy) - lua $API_GEN_NAIVE $node socks $bind $local_port > $config_file + lua $API_GEN_NAIVE $node socks $bind $local_port $port > $config_file ln_start_bin "$(first_type naive)" naive "$config_file" ;; brook) @@ -367,7 +373,7 @@ run_socks() { ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" "brook_SOCKS_$5" "$protocol" --socks5 "$bind:$local_port" -s "$server_host:$port" -p "$(config_n_get $node password)" ;; ss|ssr) - lua $API_GEN_SS $node $local_port > $config_file + lua $API_GEN_SS $node $local_port $server_host $port > $config_file ln_start_bin "$(first_type ${type}-local)" "${type}-local" -c "$config_file" -b "$bind" -u ;; esac @@ -863,6 +869,16 @@ add_dnsmasq() { echolog " - [$?]中国域名表(chnroute)：${fwd_dns:-默认}" } } + + #分流规则 + fwd_dns="${TUN_DNS}" + #如果使用chnlist直接使用默认DNS + [ "${USE_CHNLIST}" = "1" ] && unset fwd_dns + local shunt_ids=$(uci show $CONFIG | grep "=shunt_rules" | awk -F '.' '{print $2}' | awk -F '=' '{print $1}') + for shunt_id in $shunt_ids; do + config_n_get $shunt_id domain_list | tr -s "\r\n" "\n" | gen_dnsmasq_items "shuntlist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/shunt_host.conf" + echolog " - [$?]$shunt_id分流规则(shuntlist)：${fwd_dns:-默认}" + done #始终使用远程DNS解析代理（黑名单）列表 fwd_dns="${TUN_DNS}" @@ -1184,21 +1200,23 @@ stop() { echolog "清空并关闭相关程序和缓存完成。" } -case $1 in +arg1=$1 +shift +case $arg1 in get_new_port) - get_new_port $2 $3 + get_new_port $@ ;; run_socks) - run_socks $2 $3 $4 $5 $6 + run_socks $@ ;; run_redir) - run_redir $2 $3 $4 $5 $6 $7 + run_redir $@ ;; node_switch) - node_switch $2 $3 $4 $5 + node_switch $@ ;; stop) - [ "$2" = "force" ] && force_stop + [ "$1" = "force" ] && force_stop stop ;; start) diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh index d03f8d6f30..3ec658cf73 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh @@ -2,6 +2,7 @@ IPSET_LANIPLIST="laniplist" IPSET_VPSIPLIST="vpsiplist" +IPSET_SHUNTLIST="shuntlist" IPSET_GFW="gfwlist" #IPSET_GFW6="gfwlist6" IPSET_CHN="chnroute" @@ -163,6 +164,7 @@ load_acl() { msg2="${msg2}[$?]除${tcp_no_redir_ports}外的" } msg2="${msg2}所有端口" + $ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $tcp_port $is_tproxy) $ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $tcp_port $is_tproxy) $ipt_tmp -A PSW $(comment "$remarks") -p tcp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $tcp_redir_ports "-m multiport --dport") $(get_redirect_ipt $tcp_proxy_mode $tcp_port $is_tproxy) } @@ -180,6 +182,7 @@ load_acl() { msg2="${msg2}[$?]除${udp_no_redir_ports}外的" } msg2="${msg2}所有端口" + $ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $udp_port TPROXY) $ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $udp_port TPROXY) $ipt_m -A PSW $(comment "$remarks") -p udp $(factor $ip "-s") $(factor $mac "-m mac --mac-source") $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $udp_proxy_mode $udp_port TPROXY) } @@ -247,6 +250,7 @@ load_acl() { fi [ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" msg="${msg}所有端口" + $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy) $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy) $ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy) echolog "${msg}" @@ -276,6 +280,7 @@ load_acl() { msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理" [ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的" msg="${msg}所有端口" + $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_SHUNTLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY) $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY) $ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY) echolog "${msg}" @@ -353,10 +358,17 @@ filter_node() { local proxy_protocol=$(config_n_get $proxy_node protocol) local proxy_type=$(echo $(config_n_get $proxy_node type nil) | tr 'A-Z' 'a-z') [ "$proxy_type" == "nil" ] && echolog " - 节点配置不正常，略过！：${proxy_node}" && return 0 - if [ "$proxy_protocol" == "_shunt" ]; then + if [ "$proxy_protocol" == "_balancing" ]; then + #echolog " - 多节点负载均衡（${proxy_type}）..." + proxy_node=$(config_n_get $proxy_node balancing_node) + for _node in $proxy_node; do + filter_rules "$_node" "$stream" + done + elif [ "$proxy_protocol" == "_shunt" ]; then #echolog " - 按请求目的地址分流（${proxy_type}）..." local default_node=$(config_n_get $proxy_node default_node nil) filter_rules $default_node $stream +:</dev/null 2>&1 && ipset -X $IPSET_LANIPLIST >/dev/null 2>&1 & ipset -F $IPSET_VPSIPLIST >/dev/null 2>&1 && ipset -X $IPSET_VPSIPLIST >/dev/null 2>&1 & + #ipset -F $IPSET_SHUNTLIST >/dev/null 2>&1 && ipset -X $IPSET_SHUNTLIST >/dev/null 2>&1 & #ipset -F $IPSET_GFW >/dev/null 2>&1 && ipset -X $IPSET_GFW >/dev/null 2>&1 & #ipset -F $IPSET_GFW6 >/dev/null 2>&1 && ipset -X $IPSET_GFW6 >/dev/null 2>&1 & #ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 & @@ -661,6 +676,7 @@ del_firewall_rule() { flush_ipset() { ipset -F $IPSET_LANIPLIST >/dev/null 2>&1 && ipset -X $IPSET_LANIPLIST >/dev/null 2>&1 & ipset -F $IPSET_VPSIPLIST >/dev/null 2>&1 && ipset -X $IPSET_VPSIPLIST >/dev/null 2>&1 & + ipset -F $IPSET_SHUNTLIST >/dev/null 2>&1 && ipset -X $IPSET_SHUNTLIST >/dev/null 2>&1 & ipset -F $IPSET_GFW >/dev/null 2>&1 && ipset -X $IPSET_GFW >/dev/null 2>&1 & #ipset -F $IPSET_GFW6 >/dev/null 2>&1 && ipset -X $IPSET_GFW6 >/dev/null 2>&1 & ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 &