🐶 Sync 2025-11-02 14:26:26

luci-app-passwall/luasrc/passwall/com.lua

@@ -0,0 +1,109 @@
+local _M = {}
+
+local function gh_release_url(self)
+	--return "https://api.github.com/repos/" .. self.repo .. "/releases/latest"
+	return "https://github.com/xiaorouji/openwrt-passwall-packages/releases/download/api-cache/" .. string.lower(self.name) .. "-release-api.json"
+end
+
+local function gh_pre_release_url(self)
+	--return "https://api.github.com/repos/" .. self.repo .. "/releases?per_page=1"
+	return "https://github.com/xiaorouji/openwrt-passwall-packages/releases/download/api-cache/" .. string.lower(self.name) .. "-pre-release-api.json"
+end
+
+-- 排序顺序定义
+_M.order = {
+	"geoview",
+	"chinadns-ng",
+	"xray",
+	"sing-box",
+	"hysteria"
+}
+
+_M.hysteria = {
+	name = "Hysteria",
+	repo = "HyNetwork/hysteria",
+	get_url = gh_release_url,
+	cmd_version = "version | awk '/^Version:/ {print $2}'",
+	remote_version_str_replace = "app/",
+	zipped = false,
+	default_path = "/usr/bin/hysteria",
+	match_fmt_str = "linux%%-%s$",
+	file_tree = {
+		armv6 = "arm",
+		armv7 = "arm",
+		mipsel = "mipsle"
+	}
+}
+
+_M["sing-box"] = {
+	name = "Sing-Box",
+	repo = "SagerNet/sing-box",
+	get_url = gh_release_url,
+	cmd_version = "version | awk '{print $3}' | sed -n 1P",
+	zipped = true,
+	zipped_suffix = "tar.gz",
+	default_path = "/usr/bin/sing-box",
+	match_fmt_str = "linux%%-%s",
+	file_tree = {
+		x86_64 = "amd64",
+		mips64el = "mips64le"
+	}
+}
+
+_M.xray = {
+	name = "Xray",
+	repo = "XTLS/Xray-core",
+	get_url = gh_pre_release_url,
+	cmd_version = "version | awk '{print $2}' | sed -n 1P",
+	zipped = true,
+	default_path = "/usr/bin/xray",
+	match_fmt_str = "linux%%-%s",
+	file_tree = {
+		x86_64 = "64",
+		x86    = "32",
+		mips   = "mips32",
+		mipsel = "mips32le",
+		mips64el = "mips64le"
+	}
+}
+
+_M["chinadns-ng"] = {
+	name = "ChinaDNS-NG",
+	repo = "zfl9/chinadns-ng",
+	get_url = gh_release_url,
+	cmd_version = "-V | awk '{print $2}'",
+	zipped = false,
+	default_path = "/usr/bin/chinadns-ng",
+	match_fmt_str = "%s",
+	file_tree = {
+		x86_64  = "wolfssl@x86_64.*x86_64@",
+		x86     = "wolfssl@i386.*i686",
+		mips    = "wolfssl@mips%-.*mips32%+soft_float@",
+		mips64  = "wolfssl@mips64%-.*mips64%+soft_float@",
+		mipsel  = "wolfssl@mipsel.*mips32%+soft_float@",
+		mips64el = "wolfssl@mips64el%-.*mips64%+soft_float@",
+		aarch64 = "wolfssl_noasm@aarch64.*v8a",
+		rockchip = "wolfssl@aarch64.*v8a",
+		armv5   = "wolfssl@arm.*v5te",
+		armv6   = "wolfssl@arm.*v6t2",
+		armv7   = "wolfssl@arm.*eabihf.*v7a",
+		armv8   = "wolfssl_noasm@aarch64.*v8a",
+		riscv64 = "wolfssl@riscv64.*"
+	}
+}
+
+_M.geoview = {
+	name = "Geoview",
+	repo = "snowie2000/geoview",
+	get_url = gh_release_url,
+	cmd_version = '-version 2>/dev/null | awk \'NR==1 && $1=="Geoview" {print $2}\'',
+	zipped = false,
+	default_path = "/usr/bin/geoview",
+	match_fmt_str = "linux%%-%s",
+	file_tree = {
+		mipsel = "mipsle",
+		mips64el = "mips64le"
+	}
+}
+
+return _M

luci-app-passwall/luasrc/passwall/server_app.lua

@@ -0,0 +1,262 @@
+#!/usr/bin/lua
+
+local action = arg[1]
+local api = require "luci.passwall.api"
+local sys = api.sys
+local uci = api.uci
+local jsonc = api.jsonc
+
+local CONFIG = "passwall_server"
+local CONFIG_PATH = "/tmp/etc/" .. CONFIG
+local NFT_INCLUDE_FILE = CONFIG_PATH .. "/" .. CONFIG .. ".nft"
+local LOG_APP_FILE = "/tmp/log/" .. CONFIG .. ".log"
+local TMP_BIN_PATH = CONFIG_PATH .. "/bin"
+local require_dir = "luci.passwall."
+
+local ipt_bin = sys.exec("echo -n $(/usr/share/passwall/iptables.sh get_ipt_bin)")
+local ip6t_bin = sys.exec("echo -n $(/usr/share/passwall/iptables.sh get_ip6t_bin)")
+
+local nft_flag = api.is_finded("fw4") and "1" or "0"
+
+local function log(...)
+	local f, err = io.open(LOG_APP_FILE, "a")
+	if f and err == nil then
+		local str = os.date("%Y-%m-%d %H:%M:%S: ") .. table.concat({...}, " ")
+		f:write(str .. "\n")
+		f:close()
+	end
+end
+
+local function cmd(cmd)
+	sys.call(cmd)
+end
+
+local function ipt(arg)
+	if ipt_bin and #ipt_bin > 0 then
+		cmd(ipt_bin .. " -w " .. arg)
+	end
+end
+
+local function ip6t(arg)
+	if ip6t_bin and #ip6t_bin > 0 then
+		cmd(ip6t_bin .. " -w " .. arg)
+	end
+end
+
+local function ln_run(s, d, command, output)
+	if not output then
+		output = "/dev/null"
+	end
+	d = TMP_BIN_PATH .. "/" .. d
+	cmd(string.format('[ ! -f "%s" ] && ln -s %s %s 2>/dev/null', d, s, d))
+	return string.format("%s >%s 2>&1 &", d .. " " .. command, output)
+end
+
+local function gen_include()
+	cmd(string.format("echo '#!/bin/sh' > /tmp/etc/%s.include", CONFIG))
+	local function extract_rules(n, a)
+		local _ipt = ipt_bin
+		if n == "6" then
+			_ipt = ip6t_bin
+		end
+		local result = "*" .. a
+		result = result .. "\n" .. sys.exec(_ipt .. '-save -t ' .. a .. ' | grep "PSW-SERVER" | sed -e "s/^-A \\(INPUT\\)/-I \\1 1/"')
+		result = result .. "COMMIT"
+		return result
+	end
+	local f, err = io.open("/tmp/etc/" .. CONFIG .. ".include", "a")
+	if f and err == nil then
+		if nft_flag == "0" then
+			f:write(ipt_bin .. '-save -c | grep -v "PSW-SERVER" | ' .. ipt_bin .. '-restore -c' .. "\n")
+			f:write(ipt_bin .. '-restore -n <<-EOT' .. "\n")
+			f:write(extract_rules("4", "filter") .. "\n")
+			f:write("EOT" .. "\n")
+			f:write(ip6t_bin .. '-save -c | grep -v "PSW-SERVER" | ' .. ip6t_bin .. '-restore -c' .. "\n")
+			f:write(ip6t_bin .. '-restore -n <<-EOT' .. "\n")
+			f:write(extract_rules("6", "filter") .. "\n")
+			f:write("EOT" .. "\n")
+			f:close()
+		else
+			f:write("nft -f " .. NFT_INCLUDE_FILE .. "\n")
+			f:close()
+		end
+	end
+end
+
+local function start()
+	local enabled = tonumber(uci:get(CONFIG, "@global[0]", "enable") or 0)
+	if enabled == nil or enabled == 0 then
+		return
+	end
+	cmd(string.format("mkdir -p %s %s", CONFIG_PATH, TMP_BIN_PATH))
+	cmd(string.format("touch %s", LOG_APP_FILE))
+	if nft_flag == "0" then
+		ipt("-N PSW-SERVER")
+		ipt("-I INPUT -j PSW-SERVER")
+		ip6t("-N PSW-SERVER")
+		ip6t("-I INPUT -j PSW-SERVER")
+	else
+		nft_file, err = io.open(NFT_INCLUDE_FILE, "w")
+		nft_file:write('#!/usr/sbin/nft -f\n')
+		nft_file:write('add chain inet fw4 PSW-SERVER\n')
+		nft_file:write('flush chain inet fw4 PSW-SERVER\n')
+		nft_file:write('insert rule inet fw4 input position 0 jump PSW-SERVER comment "PSW-SERVER"\n')
+	end
+	uci:foreach(CONFIG, "user", function(user)
+		local id = user[".name"]
+		local enable = user.enable
+		if enable and tonumber(enable) == 1 then
+			local enable_log = user.log
+			local log_path = nil
+			if enable_log and enable_log == "1" then
+				log_path = CONFIG_PATH .. "/" .. id .. ".log"
+			else
+				log_path = nil
+			end
+			local remarks = user.remarks
+			local port = tonumber(user.port)
+			local bin
+			local config = {}
+			local config_file = CONFIG_PATH .. "/" .. id .. ".json"
+			local udp_forward = 1
+			local type = user.type or ""
+			if type == "Socks" then
+				local auth = ""
+				if user.auth and user.auth == "1" then
+					local username = user.username or ""
+					local password = user.password or ""
+					if username ~= "" and password ~= "" then
+						username = "-u " .. username
+						password = "-P " .. password
+						auth = username .. " " .. password
+					end
+				end
+				bin = ln_run("/usr/bin/microsocks", "microsocks_" .. id, string.format("-i :: -p %s %s", port, auth), log_path)
+			elseif type == "SS" or type == "SSR" then
+				if user.custom == "1" and user.config_str then
+					config = jsonc.parse(api.base64Decode(user.config_str))
+				else
+					config = require(require_dir .. "util_shadowsocks").gen_config_server(user)
+				end
+				local udp_param = ""
+				udp_forward = tonumber(user.udp_forward) or 1
+				if udp_forward == 1 then
+					udp_param = "-u"
+				end
+				type = type:lower()
+				bin = ln_run("/usr/bin/" .. type .. "-server", type .. "-server", "-c " .. config_file .. " " .. udp_param, log_path)
+			elseif type == "SS-Rust" then
+				if user.custom == "1" and user.config_str then
+					config = jsonc.parse(api.base64Decode(user.config_str))
+				else
+					config = require(require_dir .. "util_shadowsocks").gen_config_server(user)
+				end
+				bin = ln_run("/usr/bin/ssserver", "ssserver", "-c " .. config_file, log_path)
+			elseif type == "Xray" then
+				if user.custom == "1" and user.config_str then
+					config = jsonc.parse(api.base64Decode(user.config_str))
+					if log_path then
+						if not config.log then
+							config.log = {}
+						end
+						config.log.loglevel = user.loglevel
+					end
+				else
+					config = require(require_dir .. "util_xray").gen_config_server(user)
+				end
+				bin = ln_run(api.get_app_path("xray"), "xray", "run -c " .. config_file, log_path)
+			elseif type == "sing-box" then
+				if user.custom == "1" and user.config_str then
+					config = jsonc.parse(api.base64Decode(user.config_str))
+					if log_path then
+						if not config.log then
+							config.log = {}
+						end
+						config.log.timestamp = true
+						config.log.disabled = false
+						config.log.level = user.loglevel
+						config.log.output = log_path
+					end
+				else
+					config = require(require_dir .. "util_sing-box").gen_config_server(user)
+				end
+				bin = ln_run(api.get_app_path("sing-box"), "sing-box", "run -c " .. config_file, log_path)
+			elseif type == "Hysteria2" then
+				if user.custom == "1" and user.config_str then
+					config = jsonc.parse(api.base64Decode(user.config_str))
+				else
+					config = require(require_dir .. "util_hysteria2").gen_config_server(user)
+				end
+				bin = ln_run(api.get_app_path("hysteria"), "hysteria", "-c " .. config_file .. " server", log_path)
+			elseif type == "Trojan" then
+				config = require(require_dir .. "util_trojan").gen_config_server(user)
+				bin = ln_run("/usr/sbin/trojan", "trojan", "-c " .. config_file, log_path)
+			elseif type == "Trojan-Plus" then
+				config = require(require_dir .. "util_trojan").gen_config_server(user)
+				bin = ln_run("/usr/sbin/trojan-plus", "trojan-plus", "-c " .. config_file, log_path)
+			end
+
+			if next(config) then
+				local f, err = io.open(config_file, "w")
+				if f and err == nil then
+					f:write(jsonc.stringify(config, 1))
+					f:close()
+				end
+				log(string.format("%s 生成配置文件并运行 - %s", remarks, config_file))
+			end
+
+			if bin then
+				cmd(bin)
+			end
+
+			local bind_local = user.bind_local or 0
+			if bind_local and tonumber(bind_local) ~= 1 and port then
+				if nft_flag == "0" then
+					ipt(string.format('-A PSW-SERVER -p tcp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks))
+					ip6t(string.format('-A PSW-SERVER -p tcp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks))
+					if udp_forward == 1 then
+						ipt(string.format('-A PSW-SERVER -p udp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks))
+						ip6t(string.format('-A PSW-SERVER -p udp --dport %s -m comment --comment "%s" -j ACCEPT', port, remarks))
+					end
+				else
+					nft_file:write(string.format('add rule inet fw4 PSW-SERVER meta l4proto tcp tcp dport {%s} counter accept comment "%s"\n', port, remarks))
+					if udp_forward == 1 then
+						nft_file:write(string.format('add rule inet fw4 PSW-SERVER meta l4proto udp udp dport {%s} counter accept comment "%s"\n', port, remarks))
+					end
+				end
+			end
+		end
+	end)
+	if nft_flag == "1" then
+		nft_file:write("add rule inet fw4 PSW-SERVER return\n")
+		nft_file:close()
+		cmd("nft -f " .. NFT_INCLUDE_FILE)
+	end
+	gen_include()
+end
+
+local function stop()
+	cmd(string.format("/bin/busybox top -bn1 | grep -v 'grep' | grep '%s/' | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1", CONFIG_PATH))
+	if nft_flag == "0" then
+		ipt("-D INPUT -j PSW-SERVER 2>/dev/null")
+		ipt("-F PSW-SERVER 2>/dev/null")
+		ipt("-X PSW-SERVER 2>/dev/null")
+		ip6t("-D INPUT -j PSW-SERVER 2>/dev/null")
+		ip6t("-F PSW-SERVER 2>/dev/null")
+		ip6t("-X PSW-SERVER 2>/dev/null")
+	else
+		local nft_cmd = "handles=$(nft -a list chain inet fw4 input | grep -E \"PSW-SERVER\" | awk -F '# handle ' '{print$2}')\n for handle in $handles; do\n nft delete rule inet fw4 input handle ${handle} 2>/dev/null\n done"
+		cmd(nft_cmd)
+		cmd("nft flush chain inet fw4 PSW-SERVER 2>/dev/null")
+		cmd("nft delete chain inet fw4 PSW-SERVER 2>/dev/null")
+	end
+	cmd(string.format("rm -rf %s %s /tmp/etc/%s.include", CONFIG_PATH, LOG_APP_FILE, CONFIG))
+end
+
+if action then
+	if action == "start" then
+		start()
+	elseif action == "stop" then
+		stop()
+	end
+end

luci-app-passwall/luasrc/passwall/util_hysteria2.lua

@@ -0,0 +1,141 @@
+module("luci.passwall.util_hysteria2", package.seeall)
+local api = require "luci.passwall.api"
+local uci = api.uci
+local jsonc = api.jsonc
+
+function gen_config_server(node)
+	local config = {
+		listen = ":" .. node.port,
+		tls = {
+			cert = node.tls_certificateFile,
+			key = node.tls_keyFile,
+		},
+		obfs = (node.hysteria2_obfs) and {
+			type = "salamander",
+			salamander = {
+				password = node.hysteria2_obfs
+			}
+		} or nil,
+		auth = {
+			type = "password",
+			password = node.hysteria2_auth_password
+		},
+		bandwidth = (node.hysteria2_up_mbps or node.hysteria2_down_mbps) and {
+			up = node.hysteria2_up_mbps and node.hysteria2_up_mbps .. " mbps" or nil,
+			down = node.hysteria2_down_mbps and node.hysteria2_down_mbps .. " mbps" or nil
+		} or nil,
+		ignoreClientBandwidth = (node.hysteria2_ignoreClientBandwidth == "1") and true or false,
+		disableUDP = (node.hysteria2_udp == "0") and true or false,
+	}
+	return config
+end
+
+function gen_config(var)
+	local node_id = var["-node"]
+	if not node_id then
+		print("-node 不能为空")
+		return
+	end
+	local node = uci:get_all("passwall", node_id)
+	local local_tcp_redir_port = var["-local_tcp_redir_port"]
+	local local_udp_redir_port = var["-local_udp_redir_port"]
+	local local_socks_address = var["-local_socks_address"] or "0.0.0.0"
+	local local_socks_port = var["-local_socks_port"]
+	local local_socks_username = var["-local_socks_username"]
+	local local_socks_password = var["-local_socks_password"]
+	local local_http_address = var["-local_http_address"] or "0.0.0.0"
+	local local_http_port = var["-local_http_port"]
+	local local_http_username = var["-local_http_username"]
+	local local_http_password = var["-local_http_password"]
+	local tcp_proxy_way = var["-tcp_proxy_way"]
+	local server_host = var["-server_host"] or node.address
+	local server_port = var["-server_port"] or node.port
+
+	if api.is_ipv6(server_host) then
+		server_host = api.get_ipv6_full(server_host)
+	end
+	local server = server_host .. ":" .. server_port
+
+	if (node.hysteria2_hop) then
+		server = server .. "," .. string.gsub(node.hysteria2_hop, ":", "-")
+	end
+
+	local config = {
+		server = server,
+		transport = {
+			type = node.protocol or "udp",
+			udp = {
+				hopInterval = (function()
+							local HopIntervalStr = tostring(node.hysteria2_hop_interval or "30s")
+							local HopInterval = tonumber(HopIntervalStr:match("^%d+"))
+							if HopInterval and HopInterval >= 5 then
+								return tostring(HopInterval) .. "s"
+							end
+							return "30s"
+						end)(),
+			}
+		},
+		obfs = (node.hysteria2_obfs) and {
+			type = "salamander",
+			salamander = {
+				password = node.hysteria2_obfs
+			}
+		} or nil,
+		auth = node.hysteria2_auth_password,
+		tls = {
+			sni = node.tls_serverName,
+			insecure = (node.tls_allowInsecure == "1") and true or false,
+			pinSHA256 = (node.hysteria2_tls_pinSHA256) and node.hysteria2_tls_pinSHA256 or nil,
+		},
+		quic = {
+			initStreamReceiveWindow = (node.hysteria2_recv_window) and tonumber(node.hysteria2_recv_window) or nil,
+			initConnReceiveWindow = (node.hysteria2_recv_window_conn) and tonumber(node.hysteria2_recv_window_conn) or nil,
+			maxIdleTimeout = (function()
+						local timeoutStr = tostring(node.hysteria2_idle_timeout or "")
+						local timeout = tonumber(timeoutStr:match("^%d+"))
+						if timeout and timeout >= 4 and timeout <= 120 then
+							return tostring(timeout) .. "s"
+						end
+						return nil
+					end)(),
+			disablePathMTUDiscovery = (node.hysteria2_disable_mtu_discovery) and true or false,
+		},
+		bandwidth = (node.hysteria2_up_mbps or node.hysteria2_down_mbps) and {
+			up = node.hysteria2_up_mbps and node.hysteria2_up_mbps .. " mbps" or nil,
+			down = node.hysteria2_down_mbps and node.hysteria2_down_mbps .. " mbps" or nil
+		} or nil,
+		fast_open = (node.fast_open == "1") and true or false,
+		lazy = (node.hysteria2_lazy_start == "1") and true or false,
+		socks5 = (local_socks_address and local_socks_port) and {
+			listen = local_socks_address .. ":" .. local_socks_port,
+			username = (local_socks_username and local_socks_password) and local_socks_username or nil,
+			password = (local_socks_username and local_socks_password) and local_socks_password or nil,
+			disableUDP = false,
+		} or nil,
+		http = (local_http_address and local_http_port) and {
+			listen = local_http_address .. ":" .. local_http_port,
+			username = (local_http_username and local_http_password) and local_http_username or nil,
+			password = (local_http_username and local_http_password) and local_http_password or nil,
+		} or nil,
+		tcpRedirect = ("redirect" == tcp_proxy_way and local_tcp_redir_port) and {
+			listen = "0.0.0.0:" .. local_tcp_redir_port
+		} or nil,
+		tcpTProxy = ("tproxy" == tcp_proxy_way and local_tcp_redir_port) and {
+			listen = "0.0.0.0:" .. local_tcp_redir_port
+		} or nil,
+		udpTProxy = (local_udp_redir_port) and {
+			listen = "0.0.0.0:" .. local_udp_redir_port
+		} or nil
+	}
+
+	return jsonc.stringify(config, 1)
+end
+
+_G.gen_config = gen_config
+
+if arg[1] then
+	local func =_G[arg[1]]
+	if func then
+		print(func(api.get_function_args(arg)))
+	end
+end

luci-app-passwall/luasrc/passwall/util_naiveproxy.lua

@@ -0,0 +1,39 @@
+module("luci.passwall.util_naiveproxy", package.seeall)
+local api = require "luci.passwall.api"
+local uci = api.uci
+local jsonc = api.jsonc
+
+function gen_config(var)
+	local node_id = var["-node"]
+	if not node_id then
+		print("-node 不能为空")
+		return
+	end
+	local node = uci:get_all("passwall", node_id)
+	local run_type = var["-run_type"]
+	local local_addr = var["-local_addr"]
+	local local_port = var["-local_port"]
+	local server_host = var["-server_host"] or node.address
+	local server_port = var["-server_port"] or node.port
+
+	if api.is_ipv6(server_host) then
+		server_host = api.get_ipv6_full(server_host)
+	end
+	local server = server_host .. ":" .. server_port
+
+	local config = {
+		listen = run_type .. "://" .. local_addr .. ":" .. local_port,
+		proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. server
+	}
+
+	return jsonc.stringify(config, 1)
+end
+
+_G.gen_config = gen_config
+
+if arg[1] then
+	local func =_G[arg[1]]
+	if func then
+		print(func(api.get_function_args(arg)))
+	end
+end

luci-app-passwall/luasrc/passwall/util_shadowsocks.lua

@@ -0,0 +1,161 @@
+module("luci.passwall.util_shadowsocks", package.seeall)
+local api = require "luci.passwall.api"
+local uci = api.uci
+local jsonc = api.jsonc
+
+function gen_config_server(node)
+	local config = {}
+	config.server_port = tonumber(node.port)
+	config.password = node.password
+	config.timeout = tonumber(node.timeout)
+	config.fast_open = (node.tcp_fast_open and node.tcp_fast_open == "1") and true or false
+	config.method = node.method
+
+	if node.type == "SS-Rust" then
+		config.server = "::"
+		config.mode = "tcp_and_udp"
+	else
+		config.server = {"[::0]", "0.0.0.0"}
+	end
+
+	if node.type == "SSR" then
+		config.protocol = node.protocol
+		config.protocol_param = node.protocol_param
+		config.obfs = node.obfs
+		config.obfs_param = node.obfs_param
+	end
+
+	return config
+end
+
+local plugin_sh, plugin_bin
+
+function gen_config(var)
+	local node_id = var["-node"]
+	if not node_id then
+		print("-node 不能为空")
+		return
+	end
+	local node = uci:get_all("passwall", node_id)
+	local server_host = var["-server_host"] or node.address
+	local server_port = var["-server_port"] or node.port
+	local local_addr = var["-local_addr"]
+	local local_port = var["-local_port"]
+	local mode = var["-mode"]
+	local local_socks_address = var["-local_socks_address"] or "0.0.0.0"
+	local local_socks_port = var["-local_socks_port"]
+	local local_socks_username = var["-local_socks_username"]
+	local local_socks_password = var["-local_socks_password"]
+	local local_http_address = var["-local_http_address"] or "0.0.0.0"
+	local local_http_port = var["-local_http_port"]
+	local local_http_username = var["-local_http_username"]
+	local local_http_password = var["-local_http_password"]
+	local local_tcp_redir_port = var["-local_tcp_redir_port"]
+	local local_tcp_redir_address = var["-local_tcp_redir_address"] or "0.0.0.0"
+	local local_udp_redir_port = var["-local_udp_redir_port"]
+	local local_udp_redir_address = var["-local_udp_redir_address"] or "0.0.0.0"
+
+	if api.is_ipv6(server_host) then
+		server_host = api.get_ipv6_only(server_host)
+	end
+	local server = server_host
+
+	local plugin_file
+	if node.plugin and node.plugin ~= "" and node.plugin ~= "none" then
+		plugin_sh = var["-plugin_sh"] or ""
+		plugin_file = (plugin_sh ~="") and plugin_sh or node.plugin
+		plugin_bin = node.plugin
+	end
+
+	local config = {
+		server = server,
+		server_port = tonumber(server_port),
+		local_address = local_addr,
+		local_port = tonumber(local_port),
+		password = node.password,
+		method = node.method,
+		timeout = tonumber(node.timeout),
+		fast_open = (node.tcp_fast_open and node.tcp_fast_open == "true") and true or false,
+		reuse_port = true,
+		tcp_tproxy = var["-tcp_tproxy"] and true or nil
+	}
+
+	if node.type == "SS" then
+		config.plugin = plugin_file or nil
+		config.plugin_opts = (plugin_file) and node.plugin_opts or nil
+		config.mode = mode
+	elseif node.type == "SSR" then
+		config.protocol = node.protocol
+		config.protocol_param = node.protocol_param
+		config.obfs = node.obfs
+		config.obfs_param = node.obfs_param
+	elseif node.type == "SS-Rust" then
+		config = {
+			servers = {
+				{
+					address = server,
+					port = tonumber(server_port),
+					method = node.method,
+					password = node.password,
+					timeout = tonumber(node.timeout),
+					plugin = plugin_file or nil,
+					plugin_opts = (plugin_file) and node.plugin_opts or nil
+				}
+			},
+			locals = {},
+			fast_open = (node.tcp_fast_open and node.tcp_fast_open == "true") and true or false
+		}
+		if local_socks_address and local_socks_port then
+			table.insert(config.locals, {
+				local_address = local_socks_address,
+				local_port = tonumber(local_socks_port),
+				mode = "tcp_and_udp"
+			})
+		end
+		if local_http_address and local_http_port then
+			table.insert(config.locals, {
+				protocol = "http",
+				local_address = local_http_address,
+				local_port = tonumber(local_http_port)
+			})
+		end
+		if local_tcp_redir_address and local_tcp_redir_port then
+			table.insert(config.locals, {
+				protocol = "redir",
+				mode = "tcp_only",
+				tcp_redir = var["-tcp_tproxy"] and "tproxy" or nil,
+				local_address = local_tcp_redir_address,
+				local_port = tonumber(local_tcp_redir_port)
+			})
+		end
+		if local_udp_redir_address and local_udp_redir_port then
+			table.insert(config.locals, {
+				protocol = "redir",
+				mode = "udp_only",
+				local_address = local_udp_redir_address,
+				local_port = tonumber(local_udp_redir_port)
+			})
+		end
+	end
+
+	return jsonc.stringify(config, 1)
+end
+
+_G.gen_config = gen_config
+
+if arg[1] then
+	local func =_G[arg[1]]
+	if func then
+		print(func(api.get_function_args(arg)))
+		if plugin_sh and plugin_sh ~="" and plugin_bin then
+			local f = io.open(plugin_sh, "w")
+			f:write("#!/bin/sh\n")
+			f:write("export PATH=/usr/sbin:/usr/bin:/sbin:/bin:/root/bin:$PATH\n")
+			f:write(plugin_bin .. " $@ &\n")
+			f:write("echo $! > " .. plugin_sh:gsub("%.sh$", ".pid") .. "\n")
+			f:write("wait\n")
+			f:close()
+			luci.sys.call("chmod +x " .. plugin_sh)
+		end
+	end
+end

luci-app-passwall/luasrc/passwall/util_trojan.lua

@@ -0,0 +1,104 @@
+module("luci.passwall.util_trojan", package.seeall)
+local api = require "luci.passwall.api"
+local uci = api.uci
+local json = api.jsonc
+
+function gen_config_server(node)
+	local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
+	local cipher13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384"
+	local config = {
+		run_type = "server",
+		local_addr = "::",
+		local_port = tonumber(node.port),
+		remote_addr = (node.remote_enable == "1" and node.remote_address) and node.remote_address or nil,
+		remote_port = (node.remote_enable == "1" and node.remote_port) and tonumber(node.remote_port) or nil,
+		password = node.uuid,
+		log_level = (node.log and node.log == "1") and tonumber(node.loglevel) or 5,
+		ssl = {
+			cert = node.tls_certificateFile,
+			key = node.tls_keyFile,
+			key_password = "",
+			cipher = cipher,
+			cipher_tls13 = cipher13,
+			prefer_server_cipher = true,
+			reuse_session = true,
+			session_ticket = (node.tls_sessionTicket == "1") and true or false,
+			session_timeout = 600,
+			plain_http_response = "",
+			curves = "",
+			dhparam = ""
+		},
+		tcp = {
+			prefer_ipv4 = false,
+			no_delay = true,
+			keep_alive = true,
+			reuse_port = false,
+			fast_open = (node.tcp_fast_open and node.tcp_fast_open == "1") and true or false,
+			fast_open_qlen = 20
+		}
+	}
+	return config
+end
+
+function gen_config(var)
+	local node_id = var["-node"]
+	if not node_id then
+		print("-node 不能为空")
+		return
+	end
+	local node = uci:get_all("passwall", node_id)
+	local run_type = var["-run_type"]
+	local local_addr = var["-local_addr"]
+	local local_port = var["-local_port"]
+	local server_host = var["-server_host"] or node.address
+	local server_port = var["-server_port"] or node.port
+	local loglevel = var["-loglevel"] or 2
+	local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
+	local cipher13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384"
+
+	if api.is_ipv6(server_host) then
+		server_host = api.get_ipv6_only(server_host)
+	end
+	local server = server_host
+
+	local trojan = {
+		run_type = run_type,
+		local_addr = local_addr,
+		local_port = tonumber(local_port),
+		remote_addr = server,
+		remote_port = tonumber(server_port),
+		password = {node.password},
+		log_level = tonumber(loglevel),
+		ssl = {
+			verify = (node.tls_allowInsecure ~= "1") and true or false,
+			verify_hostname = true,
+			cert = nil,
+			cipher = cipher,
+			cipher_tls13 = cipher13,
+			sni = node.tls_serverName or server,
+			alpn = {"h2", "http/1.1"},
+			reuse_session = true,
+			session_ticket = (node.tls_sessionTicket and node.tls_sessionTicket == "1") and true or false,
+			curves = ""
+		},
+		udp_timeout = 60,
+		tcp = {
+			use_tproxy = (node.type == "Trojan-Plus" and var["-use_tproxy"]) and true or nil,
+			no_delay = true,
+			keep_alive = true,
+			reuse_port = true,
+			fast_open = (node.tcp_fast_open == "true") and true or false,
+			fast_open_qlen = 20
+		}
+	}
+	return json.stringify(trojan, 1)
+end
+
+_G.gen_config = gen_config
+
+if arg[1] then
+	local func =_G[arg[1]]
+	if func then
+		print(func(api.get_function_args(arg)))
+	end
+end

luci-app-passwall/luasrc/passwall/util_tuic.lua

@@ -0,0 +1,57 @@
+module("luci.passwall.util_tuic", package.seeall)
+local api = require "luci.passwall.api"
+local uci = api.uci
+local json = api.jsonc
+
+function gen_config(var)
+	local node_id = var["-node"]
+	if not node_id then
+		print("-node 不能为空")
+		return
+	end
+	local node = uci:get_all("passwall", node_id)
+	local local_addr = var["-local_addr"]
+	local local_port = var["-local_port"]
+	local server_host = var["-server_host"] or node.address
+	local server_port = var["-server_port"] or node.port
+	local loglevel = var["-loglevel"] or "warn"
+
+	local tuic= {
+			relay = {
+				server = server_host .. ":" .. server_port,
+				ip = node.tuic_ip,
+				uuid = node.uuid,
+				password = node.tuic_password,
+				-- certificates = node.tuic_certificate and { node.tuic_certpath } or nil,
+				udp_relay_mode = node.tuic_udp_relay_mode,
+				congestion_control = node.tuic_congestion_control,
+				heartbeat = node.tuic_heartbeat .. "s",
+				timeout = node.tuic_timeout .. "s",
+				gc_interval = node.tuic_gc_interval .. "s",
+				gc_lifetime = node.tuic_gc_lifetime .. "s",
+				alpn = node.tuic_tls_alpn,
+				disable_sni = (node.tuic_disable_sni == "1"),
+				zero_rtt_handshake = (node.tuic_zero_rtt_handshake == "1"),
+				send_window = tonumber(node.tuic_send_window),
+				receive_window = tonumber(node.tuic_receive_window)
+			},
+			["local"] = {
+				server = "[::]:" .. local_port,
+				username = node.tuic_socks_username,
+				password = node.tuic_socks_password,
+				dual_stack = (node.tuic_dual_stack == "1") and true or false,
+				max_packet_size = tonumber(node.tuic_max_package_size)
+			},
+			log_level = loglevel
+	}
+	return json.stringify(tuic, 1)
+end
+
+_G.gen_config = gen_config
+
+if arg[1] then
+	local func =_G[arg[1]]
+	if func then
+		print(func(api.get_function_args(arg)))
+	end
+end