From 8ea328af97cad6c221f2e2f0734595ea7c976b0b Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Fri, 8 Nov 2019 21:03:08 +0800 Subject: [PATCH] passwall: add v2 tls settings --- package/lienol/luci-app-passwall/Makefile | 2 +- .../api/gen_v2ray_client_config_file.lua | 6 ++- .../model/cbi/passwall/serverconfig.lua | 14 +++++- .../luci-app-passwall/po/zh-cn/passwall.po | 3 ++ .../root/usr/share/passwall/app.sh | 45 ++++++++++--------- 5 files changed, 45 insertions(+), 25 deletions(-) diff --git a/package/lienol/luci-app-passwall/Makefile b/package/lienol/luci-app-passwall/Makefile index 88b6f11aab..15c3cd92a2 100644 --- a/package/lienol/luci-app-passwall/Makefile +++ b/package/lienol/luci-app-passwall/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-passwall PKG_VERSION:=2.0 -PKG_RELEASE:=89-20191101 +PKG_RELEASE:=90-20191103 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) PO2LMO:=./po2lmo diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua index 07b28c8b38..e7bf79de33 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray_client_config_file.lua @@ -60,7 +60,11 @@ local v2ray = { streamSettings = { network = server.v2ray_transport, security = server.v2ray_stream_security, - tlsSettings = (server.v2ray_tls) and {} or nil, + tlsSettings = (server.v2ray_stream_security == "tls") and { + serverName = server.tls_serverName, + allowInsecure = (server.tls_allowInsecure == "1") and true or + false + } or nil, kcpSettings = (server.v2ray_transport == "mkcp") and { mtu = tonumber(server.v2ray_mkcp_mtu), tti = tonumber(server.v2ray_mkcp_tti), diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua index e1a42b8539..fd45573cbf 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/serverconfig.lua @@ -11,8 +11,8 @@ end local function is_installed(e) return ipkg.installed(e) end local ss_encrypt_method = { - "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", - "aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb", + "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr", + "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb", "camellia-192-cfb", "camellia-256-cfb", "salsa20", "chacha20", "chacha20-ietf", -- aead "aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", @@ -184,6 +184,16 @@ o:value("none", "none") o:value("tls", "tls") o:depends("server_type", "V2ray") +-- [[ TLS部分 ]] -- +o = s:option(Value, "tls_serverName", translate("Domain")) +o:depends("v2ray_stream_security", "tls") + +o = s:option(Flag, "tls_allowInsecure", translate("allowInsecure"), translate( + "Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host.")) +o.default = "0" +o.rmempty = false +o:depends("v2ray_stream_security", "tls") + o = s:option(ListValue, "v2ray_transport", translate("Transport")) o:value("tcp", "TCP") o:value("mkcp", "mKCP") diff --git a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po index a590c0e49f..0bc0dcabba 100644 --- a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po +++ b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po @@ -667,6 +667,9 @@ msgstr "传输层加密" msgid "Whether or not transport layer encryption is enabled, the supported options are \"none\" for unencrypted (default) and \"TLS\" for using TLS." msgstr "是否启入传输层加密，支持的选项有 \"none\" 表示不加密（默认值），\"tls\" 表示使用 TLS。" +msgid "Whether unsafe connections are allowed. When checked, V2Ray does not check the validity of the TLS certificate provided by the remote host." +msgstr "是否允许不安全连接。当勾选时，V2Ray 不会检查远端主机所提供的 TLS 证书的有效性。" + msgid "
none: default, no masquerade, data sent is packets with no characteristics.
srtp: disguised as an SRTP packet, it will be recognized as video call data (such as FaceTime).
utp: packets disguised as uTP will be recognized as bittorrent downloaded data.
wechat-video: packets disguised as WeChat video calls.
dtls: disguised as DTLS 1.2 packet.
wireguard: disguised as a WireGuard packet. (not really WireGuard protocol)" msgstr "
none：默认值，不进行伪装，发送的数据是没有特征的数据包。
srtp：伪装成 SRTP 数据包，会被识别为视频通话数据（如 FaceTime）。
utp：伪装成 uTP 数据包，会被识别为 BT 下载数据。
wechat-video：伪装成微信视频通话的数据包。
dtls：伪装成 DTLS 1.2 数据包。
wireguard：伪装成 WireGuard 数据包。(并不是真正的 WireGuard 协议)" diff --git a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh index 5a9ffd263d..bcebda3efa 100755 --- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh +++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh @@ -917,7 +917,7 @@ start_haproxy() { haproxy_bin=$(find_bin haproxy) [ -n "$haproxy_bin" ] && { bport=$(config_t_get global_haproxy haproxy_port) - cat <<-EOF >$HAPROXY_FILE + cat <<-EOF > $HAPROXY_FILE global log 127.0.0.1 local2 chroot /usr/bin @@ -926,6 +926,7 @@ start_haproxy() { stats socket $RUN_PID_PATH/haproxy.sock user root daemon + defaults mode tcp log global @@ -943,7 +944,8 @@ start_haproxy() { timeout http-keep-alive 10s timeout check 10s maxconn 3000 - listen shadowsocks + + listen passwall bind 0.0.0.0:$bport mode tcp EOF @@ -958,20 +960,20 @@ start_haproxy() { fi if [ "$bbackup" = "1" ]; then bbackup=" backup" - echolog "添加故障转移备服务器$bips" + echolog "添加故障转移备服务器:$bips" else bbackup="" - echolog "添加负载均衡主服务器$bips" + echolog "添加负载均衡主服务器:$bips" fi - si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}") - if [ -z "$si" ]; then - bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}') - if [ -z "$bips" ]; then - bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}') - fi - echolog "服务器IP为：$bips" - fi - echo " server ss$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >>$HAPROXY_FILE + #si=$(echo $bips | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}") + #if [ -z "$si" ]; then + # bips=$(resolveip -4 -t 2 $bips | awk 'NR==1{print}') + # if [ -z "$bips" ]; then + # bips=$(nslookup $bips localhost | sed '1,4d' | awk '{print $3}' | grep -v : | awk 'NR==1{print}') + # fi + # echolog "负载均衡${i} IP为：$bips" + #fi + echo " server server_$i $bips:$bports weight $bweight check inter 1500 rise 1 fall 3 $bbackup" >> $HAPROXY_FILE if [ "$exports" != "0" ]; then failcount=0 while [ "$failcount" -lt "10" ]; do @@ -996,15 +998,16 @@ start_haproxy() { adminport=$(config_t_get global_haproxy admin_port) adminuser=$(config_t_get global_haproxy admin_user) adminpassword=$(config_t_get global_haproxy admin_password) - cat <<-EOF >>$HAPROXY_FILE + cat <<-EOF >> $HAPROXY_FILE + listen status - bind 0.0.0.0:$adminport - mode http - stats refresh 30s - stats uri / - stats auth $adminuser:$adminpassword - #stats hide-version - stats admin if TRUE + bind 0.0.0.0:$adminport + mode http + stats refresh 30s + stats uri / + stats auth $adminuser:$adminpassword + #stats hide-version + stats admin if TRUE EOF fi nohup $haproxy_bin -f $HAPROXY_FILE 2>&1