diff --git a/.github/update.log b/.github/update.log index 3b79ddc308..db7a8c1d68 100644 --- a/.github/update.log +++ b/.github/update.log @@ -1205,3 +1205,4 @@ Update On Thu Dec 4 19:44:01 CET 2025 Update On Fri Dec 5 19:41:34 CET 2025 Update On Sat Dec 6 19:36:39 CET 2025 Update On Sun Dec 7 19:36:46 CET 2025 +Update On Mon Dec 8 19:42:31 CET 2025 diff --git a/clash-meta/listener/sing_tun/dns.go b/clash-meta/listener/sing_tun/dns.go index 82a9fdb6c1..317fefce2d 100644 --- a/clash-meta/listener/sing_tun/dns.go +++ b/clash-meta/listener/sing_tun/dns.go @@ -18,17 +18,11 @@ import ( "github.com/metacubex/sing/common/network" ) -type ListenerHandler struct { - *sing.ListenerHandler - DnsAdds []netip.AddrPort - DisableICMPForwarding bool -} - func (h *ListenerHandler) ShouldHijackDns(targetAddr netip.AddrPort) bool { if targetAddr.Addr().IsLoopback() && targetAddr.Port() == 53 { // cause by system stack return true } - for _, addrPort := range h.DnsAdds { + for _, addrPort := range h.DnsAddrPorts { if addrPort == targetAddr || (addrPort.Addr().IsUnspecified() && targetAddr.Port() == 53) { return true } diff --git a/clash-meta/listener/sing_tun/prepare.go b/clash-meta/listener/sing_tun/prepare.go index e59947b84b..e97771c445 100644 --- a/clash-meta/listener/sing_tun/prepare.go +++ b/clash-meta/listener/sing_tun/prepare.go @@ -2,6 +2,7 @@ package sing_tun import ( "context" + "net/netip" "time" "github.com/metacubex/mihomo/component/dialer" @@ -17,7 +18,7 @@ import ( func (h *ListenerHandler) PrepareConnection(network string, source M.Socksaddr, destination M.Socksaddr, routeContext tun.DirectRouteContext, timeout time.Duration) (tun.DirectRouteDestination, error) { switch network { case N.NetworkICMP: // our fork only send those type to PrepareConnection now - if h.DisableICMPForwarding || resolver.IsFakeIP(destination.Addr) { // skip fakeip and if ICMP handling is disabled + if h.DisableICMPForwarding || h.skipPingForwardingByAddr(destination.Addr) { // skip if ICMP handling is disabled or other condition log.Infoln("[ICMP] %s %s --> %s using fake ping echo", network, source, destination) return nil, nil } @@ -32,3 +33,20 @@ func (h *ListenerHandler) PrepareConnection(network string, source M.Socksaddr, } return nil, nil } + +func (h *ListenerHandler) skipPingForwardingByAddr(addr netip.Addr) bool { + for _, prefix := range h.Inet4Address { // skip in interface ipv4 range + if prefix.Contains(addr) { + return true + } + } + for _, prefix := range h.Inet6Address { // skip in interface ipv6 range + if prefix.Contains(addr) { + return true + } + } + if resolver.IsFakeIP(addr) { // skip in fakeIp pool + return true + } + return false +} diff --git a/clash-meta/listener/sing_tun/server.go b/clash-meta/listener/sing_tun/server.go index 87f413d431..41ba895b4a 100644 --- a/clash-meta/listener/sing_tun/server.go +++ b/clash-meta/listener/sing_tun/server.go @@ -67,6 +67,14 @@ type Listener struct { dnsServerIp []string } +type ListenerHandler struct { + *sing.ListenerHandler + DnsAddrPorts []netip.AddrPort + Inet4Address []netip.Prefix + Inet6Address []netip.Prefix + DisableICMPForwarding bool +} + var emptyAddressSet = []*netipx.IPSet{{}} func CalculateInterfaceName(name string) (tunName string) { @@ -268,7 +276,9 @@ func New(options LC.Tun, tunnel C.Tunnel, additions ...inbound.Addition) (l *Lis handler := &ListenerHandler{ ListenerHandler: h, - DnsAdds: dnsAdds, + DnsAddrPorts: dnsAdds, + Inet4Address: options.Inet4Address, + Inet6Address: options.Inet6Address, DisableICMPForwarding: options.DisableICMPForwarding, } l = &Listener{ diff --git a/lede/include/kernel-5.10 b/lede/include/kernel-5.10 index b90abf0a6f..4fdca787db 100644 --- a/lede/include/kernel-5.10 +++ b/lede/include/kernel-5.10 @@ -1,2 +1,2 @@ -LINUX_VERSION-5.10 = .246 -LINUX_KERNEL_HASH-5.10.246 = eb6b76c269d2dc09791638b10b9dcb9d79fd2abd45113a31fc03f68731caa875 +LINUX_VERSION-5.10 = .247 +LINUX_KERNEL_HASH-5.10.247 = 70c8b87ba1fcd8bfa663661934dc9bda92d0b5f3c0fc3197bb56399f69d9fe0c diff --git a/lede/include/kernel-5.15 b/lede/include/kernel-5.15 index c32d036773..9c8f79fe7b 100644 --- a/lede/include/kernel-5.15 +++ b/lede/include/kernel-5.15 @@ -1,2 +1,2 @@ -LINUX_VERSION-5.15 = .196 -LINUX_KERNEL_HASH-5.15.196 = 83157953598b026fb721c906c60dfdfd8e986f25ecb9910f3504f690e2770e05 +LINUX_VERSION-5.15 = .197 +LINUX_KERNEL_HASH-5.15.197 = fd218df8e2107a4443b6c29fef7f95aad167031e0fbdbc7a858ae8471360668a diff --git a/lede/include/kernel-5.4 b/lede/include/kernel-5.4 index 7238ef6f5f..980bb4c348 100644 --- a/lede/include/kernel-5.4 +++ b/lede/include/kernel-5.4 @@ -1,2 +1,2 @@ -LINUX_VERSION-5.4 = .301 -LINUX_KERNEL_HASH-5.4.301 = b7718766d060e6714bbe47004c71c360e844758f42fbf62cbaa5571119527962 +LINUX_VERSION-5.4 = .302 +LINUX_KERNEL_HASH-5.4.302 = ae6a3207f12aa4d6cfb0fa793ec9da4a6fcdfdcb57d869d63d6b77e3a8c1423d diff --git a/lede/include/kernel-6.1 b/lede/include/kernel-6.1 index b8fd4ba2b9..bca274dcdf 100644 --- a/lede/include/kernel-6.1 +++ b/lede/include/kernel-6.1 @@ -1,2 +1,2 @@ -LINUX_VERSION-6.1 = .158 -LINUX_KERNEL_HASH-6.1.158 = ad068bfdb604ec0f4f7de385c8e7ab944008aa78a4aeeca94f53206e6726bfda +LINUX_VERSION-6.1 = .159 +LINUX_KERNEL_HASH-6.1.159 = 1f207ebe93980829ecc0a18b694816f22b715e9893767731651969a168342b9e diff --git a/lede/include/kernel-6.12 b/lede/include/kernel-6.12 index 73c2f33a10..c439fb2246 100644 --- a/lede/include/kernel-6.12 +++ b/lede/include/kernel-6.12 @@ -1,2 +1,2 @@ -LINUX_VERSION-6.12 = .60 -LINUX_KERNEL_HASH-6.12.60 = a63096b2147411d683cecbf87622bb2ff4885bac2b3641d3d4f10250c89cdcf8 +LINUX_VERSION-6.12 = .61 +LINUX_KERNEL_HASH-6.12.61 = 1a69745105528676f12f29dc2494945d96cb23666dcc5223794abc22415f1735 diff --git a/lede/include/kernel-6.6 b/lede/include/kernel-6.6 index e5c3c5c302..7f4bc6fbfa 100644 --- a/lede/include/kernel-6.6 +++ b/lede/include/kernel-6.6 @@ -1,2 +1,2 @@ -LINUX_VERSION-6.6 = .118 -LINUX_KERNEL_HASH-6.6.118 = 4bdddce35474afc8d26f74ebfbcd0e1045ecd15f69e60f53529dba143374b17d +LINUX_VERSION-6.6 = .119 +LINUX_KERNEL_HASH-6.6.119 = 3da09b980bb404cc28793479bb2d6c636522679215ffa65a04c893575253e5e8 diff --git a/lede/target/linux/generic/hack-6.1/983-add-bcm-fullconenat-to-nft.patch b/lede/target/linux/generic/hack-6.1/983-add-bcm-fullconenat-to-nft.patch index bb1cd62a36..dbedc1fbdf 100644 --- a/lede/target/linux/generic/hack-6.1/983-add-bcm-fullconenat-to-nft.patch +++ b/lede/target/linux/generic/hack-6.1/983-add-bcm-fullconenat-to-nft.patch @@ -53,8 +53,10 @@ if (priv->sreg_proto_min) { if (nft_dump_register(skb, NFTA_MASQ_REG_PROTO_MIN, priv->sreg_proto_min) || -@@ -112,6 +120,9 @@ static void nft_masq_eval(const struct n +@@ -112,6 +120,11 @@ static void nft_masq_eval(const struct n { ++ struct nft_masq *priv = nft_expr_priv(expr); ++ struct nf_nat_range2 range; switch (nft_pf(pkt)) { case NFPROTO_IPV4: + if (priv->fullcone) { diff --git a/mihomo/listener/sing_tun/dns.go b/mihomo/listener/sing_tun/dns.go index 82a9fdb6c1..317fefce2d 100644 --- a/mihomo/listener/sing_tun/dns.go +++ b/mihomo/listener/sing_tun/dns.go @@ -18,17 +18,11 @@ import ( "github.com/metacubex/sing/common/network" ) -type ListenerHandler struct { - *sing.ListenerHandler - DnsAdds []netip.AddrPort - DisableICMPForwarding bool -} - func (h *ListenerHandler) ShouldHijackDns(targetAddr netip.AddrPort) bool { if targetAddr.Addr().IsLoopback() && targetAddr.Port() == 53 { // cause by system stack return true } - for _, addrPort := range h.DnsAdds { + for _, addrPort := range h.DnsAddrPorts { if addrPort == targetAddr || (addrPort.Addr().IsUnspecified() && targetAddr.Port() == 53) { return true } diff --git a/mihomo/listener/sing_tun/prepare.go b/mihomo/listener/sing_tun/prepare.go index e59947b84b..e97771c445 100644 --- a/mihomo/listener/sing_tun/prepare.go +++ b/mihomo/listener/sing_tun/prepare.go @@ -2,6 +2,7 @@ package sing_tun import ( "context" + "net/netip" "time" "github.com/metacubex/mihomo/component/dialer" @@ -17,7 +18,7 @@ import ( func (h *ListenerHandler) PrepareConnection(network string, source M.Socksaddr, destination M.Socksaddr, routeContext tun.DirectRouteContext, timeout time.Duration) (tun.DirectRouteDestination, error) { switch network { case N.NetworkICMP: // our fork only send those type to PrepareConnection now - if h.DisableICMPForwarding || resolver.IsFakeIP(destination.Addr) { // skip fakeip and if ICMP handling is disabled + if h.DisableICMPForwarding || h.skipPingForwardingByAddr(destination.Addr) { // skip if ICMP handling is disabled or other condition log.Infoln("[ICMP] %s %s --> %s using fake ping echo", network, source, destination) return nil, nil } @@ -32,3 +33,20 @@ func (h *ListenerHandler) PrepareConnection(network string, source M.Socksaddr, } return nil, nil } + +func (h *ListenerHandler) skipPingForwardingByAddr(addr netip.Addr) bool { + for _, prefix := range h.Inet4Address { // skip in interface ipv4 range + if prefix.Contains(addr) { + return true + } + } + for _, prefix := range h.Inet6Address { // skip in interface ipv6 range + if prefix.Contains(addr) { + return true + } + } + if resolver.IsFakeIP(addr) { // skip in fakeIp pool + return true + } + return false +} diff --git a/mihomo/listener/sing_tun/server.go b/mihomo/listener/sing_tun/server.go index 87f413d431..41ba895b4a 100644 --- a/mihomo/listener/sing_tun/server.go +++ b/mihomo/listener/sing_tun/server.go @@ -67,6 +67,14 @@ type Listener struct { dnsServerIp []string } +type ListenerHandler struct { + *sing.ListenerHandler + DnsAddrPorts []netip.AddrPort + Inet4Address []netip.Prefix + Inet6Address []netip.Prefix + DisableICMPForwarding bool +} + var emptyAddressSet = []*netipx.IPSet{{}} func CalculateInterfaceName(name string) (tunName string) { @@ -268,7 +276,9 @@ func New(options LC.Tun, tunnel C.Tunnel, additions ...inbound.Addition) (l *Lis handler := &ListenerHandler{ ListenerHandler: h, - DnsAdds: dnsAdds, + DnsAddrPorts: dnsAdds, + Inet4Address: options.Inet4Address, + Inet6Address: options.Inet6Address, DisableICMPForwarding: options.DisableICMPForwarding, } l = &Listener{ diff --git a/openwrt-packages/adguardhome/Makefile b/openwrt-packages/adguardhome/Makefile index 32630469bb..1c00a8c17c 100644 --- a/openwrt-packages/adguardhome/Makefile +++ b/openwrt-packages/adguardhome/Makefile @@ -6,12 +6,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=adguardhome -PKG_VERSION:=0.107.70 +PKG_VERSION:=0.107.71 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/AdguardTeam/AdGuardHome/tar.gz/v$(PKG_VERSION)? -PKG_HASH:=5eb0c7076ab7b007f0e5afbaffc260d8950b5248bd04407464a2b2f0169694ba +PKG_HASH:=f3dde5da6ba48270ac25bd2f501c4ce1af54ddeef93fcd84ef3a8270cec9539f PKG_BUILD_DIR:=$(BUILD_DIR)/AdGuardHome-$(PKG_VERSION) PKG_LICENSE:=GPL-3.0-only @@ -58,7 +58,7 @@ define Download/adguardhome-frontend URL:=https://github.com/AdguardTeam/AdGuardHome/releases/download/v$(PKG_VERSION)/ URL_FILE:=AdGuardHome_frontend.tar.gz FILE:=$(FRONTEND_FILE) - HASH:=127658a4155d429fc8f7c6a4408107662a963b39f6db869f13dcd40aff12e6eb + HASH:=51b229a5dff010c17bd8894bbf4291907e93708c366801e32181be7f37dd4488 endef define Build/Prepare diff --git a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua index d3a707e1d2..5691f9e0cb 100644 --- a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua +++ b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/ray.lua @@ -511,6 +511,9 @@ o = s:option(DynamicList, _n("tcp_guise_http_path"), translate("HTTP Path")) o.placeholder = "/" o:depends({ [_n("tcp_guise")] = "http" }) +o = s:option(Value, _n("tcp_guise_http_user_agent"), translate("User-Agent")) +o:depends({ [_n("tcp_guise")] = "http" }) + -- [[ mKCP部分 ]]-- o = s:option(ListValue, _n("mkcp_guise"), translate("Camouflage Type"), translate('
none: default, no masquerade, data sent is packets with no characteristics.
srtp: disguised as an SRTP packet, it will be recognized as video call data (such as FaceTime).
utp: packets disguised as uTP will be recognized as bittorrent downloaded data.
wechat-video: packets disguised as WeChat video calls.
dtls: disguised as DTLS 1.2 packet.
wireguard: disguised as a WireGuard packet. (not really WireGuard protocol)
dns: Disguising traffic as DNS requests.')) @@ -558,6 +561,9 @@ o = s:option(Value, _n("ws_path"), translate("WebSocket Path")) o.placeholder = "/" o:depends({ [_n("transport")] = "ws" }) +o = s:option(Value, _n("ws_user_agent"), translate("User-Agent")) +o:depends({ [_n("transport")] = "ws" }) + o = s:option(Value, _n("ws_heartbeatPeriod"), translate("HeartbeatPeriod(second)")) o.datatype = "integer" o:depends({ [_n("transport")] = "ws" }) @@ -598,6 +604,9 @@ o = s:option(Value, _n("httpupgrade_path"), translate("HttpUpgrade Path")) o.placeholder = "/" o:depends({ [_n("transport")] = "httpupgrade" }) +o = s:option(Value, _n("httpupgrade_user_agent"), translate("User-Agent")) +o:depends({ [_n("transport")] = "httpupgrade" }) + -- [[ XHTTP部分 ]]-- o = s:option(ListValue, _n("xhttp_mode"), "XHTTP " .. translate("Mode")) o:depends({ [_n("transport")] = "xhttp" }) diff --git a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua index 5e27be824c..2452060385 100644 --- a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua +++ b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/type/sing-box.lua @@ -609,6 +609,9 @@ o = s:option(DynamicList, _n("tcp_guise_http_path"), translate("HTTP Path")) o.placeholder = "/" o:depends({ [_n("tcp_guise")] = "http" }) +o = s:option(Value, _n("tcp_guise_http_user_agent"), translate("User-Agent")) +o:depends({ [_n("tcp_guise")] = "http" }) + -- [[ HTTP部分 ]]-- o = s:option(DynamicList, _n("http_host"), translate("HTTP Host")) o:depends({ [_n("transport")] = "http" }) @@ -617,6 +620,9 @@ o = s:option(Value, _n("http_path"), translate("HTTP Path")) o.placeholder = "/" o:depends({ [_n("transport")] = "http" }) +o = s:option(Value, _n("http_user_agent"), translate("User-Agent")) +o:depends({ [_n("transport")] = "http" }) + o = s:option(Flag, _n("http_h2_health_check"), translate("Health check")) o:depends({ [_n("tls")] = true, [_n("transport")] = "http" }) @@ -636,6 +642,9 @@ o = s:option(Value, _n("ws_path"), translate("WebSocket Path")) o.placeholder = "/" o:depends({ [_n("transport")] = "ws" }) +o = s:option(Value, _n("ws_user_agent"), translate("User-Agent")) +o:depends({ [_n("transport")] = "ws" }) + o = s:option(Flag, _n("ws_enableEarlyData"), translate("Enable early data")) o:depends({ [_n("transport")] = "ws" }) @@ -654,6 +663,9 @@ o = s:option(Value, _n("httpupgrade_path"), translate("HTTPUpgrade Path")) o.placeholder = "/" o:depends({ [_n("transport")] = "httpupgrade" }) +o = s:option(Value, _n("httpupgrade_user_agent"), translate("User-Agent")) +o:depends({ [_n("transport")] = "httpupgrade" }) + -- [[ gRPC部分 ]]-- o = s:option(Value, _n("grpc_serviceName"), "ServiceName") o:depends({ [_n("transport")] = "grpc" }) diff --git a/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_sing-box.lua index 6ea08be46d..04c9618265 100644 --- a/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_sing-box.lua +++ b/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_sing-box.lua @@ -206,6 +206,9 @@ function gen_outbound(flag, node, tag, proxy_table) local first = node.tcp_guise_http_path[1] return (first == "" or not first) and "/" or first end)() or "/", + headers = { + ["User-Agent"] = node.tcp_guise_http_user_agent or nil + }, idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil, ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil, } @@ -217,6 +220,9 @@ function gen_outbound(flag, node, tag, proxy_table) type = "http", host = node.http_host or {}, path = node.http_path or "/", + headers = { + ["User-Agent"] = node.http_user_agent or nil + }, idle_timeout = (node.http_h2_health_check == "1") and node.http_h2_read_idle_timeout or nil, ping_timeout = (node.http_h2_health_check == "1") and node.http_h2_health_check_timeout or nil, } @@ -227,7 +233,10 @@ function gen_outbound(flag, node, tag, proxy_table) v2ray_transport = { type = "ws", path = node.ws_path or "/", - headers = (node.ws_host ~= nil) and { Host = node.ws_host } or nil, + headers = { + Host = node.ws_host or nil, + ["User-Agent"] = node.ws_user_agent or nil + }, max_early_data = tonumber(node.ws_maxEarlyData) or nil, early_data_header_name = (node.ws_earlyDataHeaderName) and node.ws_earlyDataHeaderName or nil --要与 Xray-core 兼容，请将其设置为 Sec-WebSocket-Protocol。它需要与服务器保持一致。 } @@ -238,6 +247,9 @@ function gen_outbound(flag, node, tag, proxy_table) type = "httpupgrade", host = node.httpupgrade_host, path = node.httpupgrade_path or "/", + headers = { + ["User-Agent"] = node.httpupgrade_user_agent or nil + } } end diff --git a/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua b/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua index 385c04ffb9..77be6be021 100644 --- a/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua +++ b/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua @@ -179,7 +179,8 @@ function gen_outbound(flag, node, tag, proxy_table) return r end)() or {"/"}, headers = { - Host = node.tcp_guise_http_host or {} + Host = node.tcp_guise_http_host or {}, + ["User-Agent"] = node.tcp_guise_http_user_agent and {node.tcp_guise_http_user_agent} or nil } } or nil } @@ -200,7 +201,10 @@ function gen_outbound(flag, node, tag, proxy_table) } or nil, wsSettings = (node.transport == "ws") and { path = node.ws_path or "/", - host = node.ws_host or nil, + headers = { + Host = node.ws_host or nil, + ["User-Agent"] = node.ws_user_agent or nil + }, maxEarlyData = tonumber(node.ws_maxEarlyData) or nil, earlyDataHeaderName = (node.ws_earlyDataHeaderName) and node.ws_earlyDataHeaderName or nil, heartbeatPeriod = tonumber(node.ws_heartbeatPeriod) or nil @@ -215,7 +219,10 @@ function gen_outbound(flag, node, tag, proxy_table) } or nil, httpupgradeSettings = (node.transport == "httpupgrade") and { path = node.httpupgrade_path or "/", - host = node.httpupgrade_host + host = node.httpupgrade_host, + headers = { + ["User-Agent"] = node.httpupgrade_user_agent or nil + } } or nil, xhttpSettings = (node.transport == "xhttp") and { mode = node.xhttp_mode or "auto", diff --git a/openwrt-passwall/luci-app-passwall/luasrc/view/passwall/cbi/nodes_multiselect.htm b/openwrt-passwall/luci-app-passwall/luasrc/view/passwall/cbi/nodes_multiselect.htm index 3f758c712f..b5b18f67e4 100644 --- a/openwrt-passwall/luci-app-passwall/luasrc/view/passwall/cbi/nodes_multiselect.htm +++ b/openwrt-passwall/luci-app-passwall/luasrc/view/passwall/cbi/nodes_multiselect.htm @@ -65,14 +65,14 @@ end } -
+
+ style="width:100%;padding:6px;margin-bottom:8px;border:1px solid #ccc;border-radius:4px;box-sizing:border-box;max-height:36px;" />
    @@ -85,7 +85,7 @@ end style="cursor:pointer;padding:6px;background:#f0f0f0;border-radius:4px;margin-bottom:4px;display:flex;align-items:center;white-space:nowrap;"> <%=gname%> - + (0/<%=#items%>)
@@ -93,7 +93,7 @@ end