passwall: add v2 tls settings
This commit is contained in:
CN_SZTL
parent
d7317101f8
commit
8ea328af97
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-passwall
|
||||
PKG_VERSION:=2.0
|
||||
PKG_RELEASE:=89-20191101
|
||||
PKG_RELEASE:=90-20191103
|
||||
|
||||
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
|
||||
PO2LMO:=./po2lmo
|
||||
|
||||
@ -60,7 +60,11 @@ local v2ray = {
|
||||
streamSettings = {
|
||||
network = server.v2ray_transport,
|
||||
security = server.v2ray_stream_security,
|
||||
tlsSettings = (server.v2ray_tls) and {} or nil,
|
||||
tlsSettings = (server.v2ray_stream_security == "tls") and {
|
||||
serverName = server.tls_serverName,
|
||||
allowInsecure = (server.tls_allowInsecure == "1") and true or
|
||||
false
|
||||
} or nil,
|
||||
kcpSettings = (server.v2ray_transport == "mkcp") and {
|
||||
mtu = tonumber(server.v2ray_mkcp_mtu),
|
||||
tti = tonumber(server.v2ray_mkcp_tti),
|
||||
|
||||
@ -11,8 +11,8 @@ end
|
||||
local function is_installed(e) return ipkg.installed(e) end
|
||||
|
||||
local ss_encrypt_method = {
|
||||
"rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb",
|
||||
"aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
|
||||
"rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr",
|
||||
"aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
|
||||
"camellia-192-cfb", "camellia-256-cfb", "salsa20", "chacha20",
|
||||
"chacha20-ietf", -- aead
|
||||
"aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305",
|
||||
@ -184,6 +184,16 @@ o:value("none", "none")
|
||||
o:value("tls", "tls")
|
||||
o:depends("server_type", "V2ray")
|
||||
|
||||
-- [[ TLS部分 ]] --
|
||||
o = s:option(Value, "tls_serverName", translate("Domain"))
|
||||
o:depends("v2ray_stream_security", "tls")
|
||||
|
||||
o = s:option(Flag, "tls_allowInsecure", translate("allowInsecure"), translate(
|
||||
"Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host."))
|
||||
o.default = "0"
|
||||
o.rmempty = false
|
||||
o:depends("v2ray_stream_security", "tls")
|
||||
|
||||
o = s:option(ListValue, "v2ray_transport", translate("Transport"))
|
||||
o:value("tcp", "TCP")
|
||||
o:value("mkcp", "mKCP")
|
||||
|
||||
@ -667,6 +667,9 @@ msgstr "传输层加密"
|
||||
msgid "Whether or not transport layer encryption is enabled, the supported options are \"none\" for unencrypted (default) and \"TLS\" for using TLS."
|
||||
msgstr "是否启入传输层加密，支持的选项有 \"none\" 表示不加密（默认值），\"tls\" 表示使用 TLS。"
|
||||
|
||||
msgid "Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host."
|
||||
msgstr "是否允许不安全连接。当勾选时，V2Ray 不会检查远端主机所提供的 TLS 证书的有效性。"
|
||||
|
||||
msgid "<br>none: default, no masquerade, data sent is packets with no characteristics.<br>srtp: disguised as an SRTP packet, it will be recognized as video call data (such as FaceTime).<br>utp: packets disguised as uTP will be recognized as bittorrent downloaded data.<br>wechat-video: packets disguised as WeChat video calls.<br>dtls: disguised as DTLS 1.2 packet.<br>wireguard: disguised as a WireGuard packet. (not really WireGuard protocol)"
|
||||
msgstr "<br>none：默认值，不进行伪装，发送的数据是没有特征的数据包。<br>srtp：伪装成 SRTP 数据包，会被识别为视频通话数据（如 FaceTime）。<br>utp：伪装成 uTP 数据包，会被识别为 BT 下载数据。<br>wechat-video：伪装成微信视频通话的数据包。<br>dtls：伪装成 DTLS 1.2 数据包。<br>wireguard：伪装成 WireGuard 数据包。(并不是真正的 WireGuard 协议)"
|
||||
|
||||
|
||||
@ -917,7 +917,7 @@ start_haproxy() {
|
||||
haproxy_bin=$(find_bin haproxy)
|
||||
[ -n "$haproxy_bin" ] && {
|
||||
bport=$(config_t_get global_haproxy haproxy_port)
|
||||
cat <<-EOF >$HAPROXY_FILE
|
||||
cat <<-EOF > $HAPROXY_FILE
|
||||
global
|
||||
log 127.0.0.1 local2
|
||||
chroot /usr/bin
|
||||
@ -926,6 +926,7 @@ start_haproxy() {
|
||||
stats socket $RUN_PID_PATH/haproxy.sock
|
||||
user root
|
||||
daemon
|
||||
|
||||
defaults
|
||||
mode tcp
|
||||
log global
|
||||
@ -943,7 +944,8 @@ start_haproxy() {
|
||||
timeout http-keep-alive 10s
|
||||
timeout check 10s
|
||||
maxconn 3000
|
||||
listen shadowsocks
|
||||
|
||||
listen passwall
|
||||
bind 0.0.0.0:$bport
|
||||
mode tcp
|
||||
EOF
|
||||
@ -958,20 +960,20 @@ start_haproxy() {
|
||||
fi
|
||||
if [ "$bbackup" = "1" ]; then
|
||||
bbackup=" backup"
|
||||
echolog "添加故障转移备服务器$bips"
|
||||
echolog "添加故障转移备服务器:$bips"
|
||||
else
|
||||
bbackup=""
|
||||
echolog "添加负载均衡主服务器$bips"
|
||||
echolog "添加负载均衡主服务器:$bips"
|
||||
fi
|
||||
si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
|
||||
if [ -z "$si" ]; then
|
||||
bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}')
|
||||
if [ -z "$bips" ]; then
|
||||
bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}')
|
||||
fi
|
||||
echolog "服务器IP为：$bips"
|
||||
fi
|
||||
echo " server ss$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >>$HAPROXY_FILE
|
||||
#si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
|
||||
#if [ -z "$si" ]; then
|
||||
# bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}')
|
||||
# if [ -z "$bips" ]; then
|
||||
# bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}')
|
||||
# fi
|
||||
# echolog "负载均衡${i} IP为：$bips"
|
||||
#fi
|
||||
echo " server server_$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >> $HAPROXY_FILE
|
||||
if [ "$exports" != "0" ]; then
|
||||
failcount=0
|
||||
while [ "$failcount" -lt "10" ]; do
|
||||
@ -996,15 +998,16 @@ start_haproxy() {
|
||||
adminport=$(config_t_get global_haproxy admin_port)
|
||||
adminuser=$(config_t_get global_haproxy admin_user)
|
||||
adminpassword=$(config_t_get global_haproxy admin_password)
|
||||
cat <<-EOF >>$HAPROXY_FILE
|
||||
cat <<-EOF >> $HAPROXY_FILE
|
||||
|
||||
listen status
|
||||
bind 0.0.0.0:$adminport
|
||||
mode http
|
||||
stats refresh 30s
|
||||
stats uri /
|
||||
stats auth $adminuser:$adminpassword
|
||||
#stats hide-version
|
||||
stats admin if TRUE
|
||||
bind 0.0.0.0:$adminport
|
||||
mode http
|
||||
stats refresh 30s
|
||||
stats uri /
|
||||
stats auth $adminuser:$adminpassword
|
||||
#stats hide-version
|
||||
stats admin if TRUE
|
||||
EOF
|
||||
fi
|
||||
nohup $haproxy_bin -f $HAPROXY_FILE 2>&1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user