+]]--
+
+local sys = require "luci.sys"
+local util = require "luci.util"
+local uci = require "luci.model.uci".cursor()
+
+ptype = {
+ "socks5",
+ "socks4",
+ "http",
+ "socks4a",
+}
+
+whocan = {
+ "anyone",
+ "friends",
+ "nobody",
+}
+
+function titlesplit(Value)
+ return "" .. translate(Value) .. "
"
+end
+
+m = Map("amule", translate("aMule"), translate("aMule is a ED2K/KAD client for all platforms.") .. "luci interface by maz-1 ")
+
+m:section(SimpleSection).template = "amule/overview_status"
+
+s = m:section(TypedSection, "amule", translate("aMule Settings"))
+s.addremove = false
+s.anonymous = true
+
+s:tab("general", translate("General"))
+s:tab("connection", translate("Connections"))
+s:tab("server", translate("Server"))
+s:tab("path_and_file", translate("Path And File"))
+s:tab("security", translate("Security"))
+s:tab("remote", translate("External Control"))
+s:tab("template", translate("Edit Template"))
+s:tab("logview", translate("Log File Viewer"))
+s:tab("amulecmd", translate("aMule command"))
+
+-- GENERAL --
+
+o = s:taboption("general", Flag, "enabled", translate("Enabled"))
+o.rmempty = false
+
+user = s:taboption("general", ListValue, "runasuser", translate("Run daemon as user"))
+local p_user
+for _, p_user in util.vspairs(util.split(sys.exec("cat /etc/passwd | cut -f 1 -d :"))) do
+ user:value(p_user)
+end
+
+o = s:taboption("general", Value, "config_dir", translate("Configuration directory"))
+o.rmempty = false
+o.placeholder = "/var/run/amule"
+
+o = s:taboption("general", Value, "mem_percentage", translate("Memory Limit"), translate("Percentage"))
+o.rmempty = false
+o.placeholder = "50"
+o.datatype = "range(1, 99)"
+
+o = s:taboption("general", Value, "nick", translate("Nickname"))
+o.placeholder = "http://www.aMule.org"
+
+o = s:taboption("general", Value, "max_upload", translate("Max upload speed"), translate("Unlimited when set to 0"))
+o.datatype = "uinteger"
+o.rmempty = false
+o.placeholder = "0"
+
+o = s:taboption("general", Value, "max_download", translate("Max download speed"), translate("Unlimited when set to 0"))
+o.datatype = "uinteger"
+o.rmempty = false
+o.placeholder = "0"
+
+o = s:taboption("general", Value, "slot_allocation", translate("Slot allocation"))
+o.datatype = "uinteger"
+o.rmempty = false
+o.placeholder = "2"
+
+o = s:taboption("general", Value, "max_connections", translate("Max connections"))
+o.datatype = "uinteger"
+o.rmempty = false
+o.placeholder = "500"
+
+o = s:taboption("general", Value, "max_sources_per_file", translate("Max sources per file"))
+o.datatype = "uinteger"
+o.rmempty = false
+o.placeholder = "300"
+
+-- CONNECTIONS --
+
+o = s:taboption("connection", Value, "port", translate("TCP port"))
+o.datatype = "port"
+o.rmempty = false
+o.placeholder = "4662"
+
+o = s:taboption("connection", Flag, "udp_enable", translate("Enable UDP port"))
+o.rmempty = false
+
+o = s:taboption("connection", Value, "udp_port", translate("UDP port"))
+o.datatype = "port"
+o.rmempty = false
+o.placeholder = "4672"
+
+o = s:taboption("connection", Flag, "upnp_enabled", translate("Enable UPnP"))
+o.rmempty = false
+
+o = s:taboption("connection", Value, "upnp_tcp_port", translate("UPnP TCP port"))
+o.datatype = "port"
+o.rmempty = false
+o.placeholder = "50000"
+
+o = s:taboption("connection", Value, "address", translate("Bind Address"), translate("Leave blank to bind all"))
+o.datatype = "ip4addr"
+o.rmempty = true
+
+o = s:taboption("connection", Flag, "auto_connect", translate("Automatically connect"))
+o.rmempty = false
+
+o = s:taboption("connection", Flag, "reconnect", translate("Automatically reconnect"))
+o.rmempty = false
+
+o = s:taboption("connection", Flag, "connect_to_kad", translate("Connect to Kad network"))
+o.rmempty = false
+
+o = s:taboption("connection", Flag, "connect_to_ed2k", translate("Connect to ED2K network"))
+o.rmempty = false
+
+s:taboption("connection", DummyValue,"titlesplit1" ,titlesplit(translate("Proxy Configuration")))
+
+o = s:taboption("connection", Flag, "proxy_enable_proxy", translate("Enable proxy"))
+o.rmempty = false
+
+o = s:taboption("connection", ListValue, "proxy_type", translate("Proxy type"))
+for i,v in ipairs(ptype) do
+ o:value(v)
+end
+o.rmempty = false
+
+o = s:taboption("connection", Value, "proxy_name", translate("Proxy name"))
+o.rmempty = true
+
+o = s:taboption("connection", Value, "proxy_port", translate("Proxy port"))
+o.datatype = "port"
+o.rmempty = true
+
+o = s:taboption("connection", Flag, "proxy_enable_password", translate("Proxy requires authentication"))
+o.rmempty = true
+
+o = s:taboption("connection", Value, "proxy_user", translate("Proxy user"))
+--o:depends("proxy_enable_password", "1")
+o.rmempty = true
+
+o = s:taboption("connection", Value, "proxy_password", translate("Proxy password"))
+o.password = true
+o.rmempty = true
+
+-- SERVER --
+
+o = s:taboption("server", Value, "kad_nodes_url", translate("Kad Nodes Url"), "
+ <%:aMule Status%>
+
+ <%:Collecting data...%>
+
+
+ <%:Collecting data...%>
+
+
diff --git a/package/lean/luci-app-amule/luasrc/view/amule/webshell.htm b/package/lean/luci-app-amule/luasrc/view/amule/webshell.htm
new file mode 100644
index 000000000..998fa170a
--- /dev/null
+++ b/package/lean/luci-app-amule/luasrc/view/amule/webshell.htm
@@ -0,0 +1,90 @@
+
+
+
+
+
+
+
+
+<%=translate("Command: ")%>
+
+
/>
+
/>
+
+
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI page for IPK upload
+LUCI_DEPENDS:=+luci-lib-fs
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
+
diff --git a/package/lean/luci-app-filetransfer/luasrc/controller/filetransfer.lua b/package/lean/luci-app-filetransfer/luasrc/controller/filetransfer.lua
new file mode 100644
index 000000000..727042786
--- /dev/null
+++ b/package/lean/luci-app-filetransfer/luasrc/controller/filetransfer.lua
@@ -0,0 +1,12 @@
+--[[
+luci-app-filetransfer
+Description: File upload / download
+Author: yuleniwo xzm2@qq.com QQ:529698939
+Modify: ayongwifi@126.com www.openwrtdl.com
+]]--
+
+module("luci.controller.filetransfer", package.seeall)
+
+function index()
+ entry({"admin", "system", "filetransfer"}, cbi("updownload"), _("FileTransfer"),89)
+end
diff --git a/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua b/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua
new file mode 100644
index 000000000..7b487cb21
--- /dev/null
+++ b/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua
@@ -0,0 +1,148 @@
+local fs = require "luci.fs"
+local http = luci.http
+
+ful = SimpleForm("upload", translate("Upload"), nil)
+ful.reset = false
+ful.submit = false
+
+sul = ful:section(SimpleSection, "", translate("Upload file to '/tmp/upload/'"))
+fu = sul:option(FileUpload, "")
+fu.template = "cbi/other_upload"
+um = sul:option(DummyValue, "", nil)
+um.template = "cbi/other_dvalue"
+
+fdl = SimpleForm("download", translate("Download"), nil)
+fdl.reset = false
+fdl.submit = false
+sdl = fdl:section(SimpleSection, "", translate("Download file"))
+fd = sdl:option(FileUpload, "")
+fd.template = "cbi/other_download"
+dm = sdl:option(DummyValue, "", nil)
+dm.template = "cbi/other_dvalue"
+
+function Download()
+ local sPath, sFile, fd, block
+ sPath = http.formvalue("dlfile")
+ sFile = nixio.fs.basename(sPath)
+ if luci.fs.isdirectory(sPath) then
+ fd = io.popen('tar -C "%s" -cz .' % {sPath}, "r")
+ sFile = sFile .. ".tar.gz"
+ else
+ fd = nixio.open(sPath, "r")
+ end
+ if not fd then
+ dm.value = translate("Couldn't open file: ") .. sPath
+ return
+ end
+ dm.value = nil
+ http.header('Content-Disposition', 'attachment; filename="%s"' % {sFile})
+ http.prepare_content("application/octet-stream")
+ while true do
+ block = fd:read(nixio.const.buffersize)
+ if (not block) or (#block ==0) then
+ break
+ else
+ http.write(block)
+ end
+ end
+ fd:close()
+ http.close()
+end
+
+local dir, fd
+dir = "/tmp/upload/"
+nixio.fs.mkdir(dir)
+http.setfilehandler(
+ function(meta, chunk, eof)
+ if not fd then
+ if not meta then return end
+
+ if meta and chunk then fd = nixio.open(dir .. meta.file, "w") end
+
+ if not fd then
+ um.value = translate("Create upload file error.")
+ return
+ end
+ end
+ if chunk and fd then
+ fd:write(chunk)
+ end
+ if eof and fd then
+ fd:close()
+ fd = nil
+ um.value = translate("File saved to") .. ' "/tmp/upload/' .. meta.file .. '"'
+ end
+ end
+)
+
+if luci.http.formvalue("upload") then
+
+
+ local f = luci.http.formvalue("ulfile")
+ if #f <= 0 then
+ um.value = translate("No specify upload file.")
+ end
+elseif luci.http.formvalue("download") then
+ Download()
+end
+
+local inits, attr = {}
+for i, f in ipairs(fs.glob("/tmp/upload/*")) do
+ attr = fs.stat(f)
+ if attr then
+ inits[i] = {}
+ inits[i].name = fs.basename(f)
+ inits[i].mtime = os.date("%Y-%m-%d %H:%M:%S", attr.mtime)
+ inits[i].modestr = attr.modestr
+ inits[i].size = tostring(attr.size)
+ inits[i].remove = 0
+ inits[i].install = false
+ end
+end
+
+form = SimpleForm("filelist", translate("Upload file list"), nil)
+form.reset = false
+form.submit = false
+
+tb = form:section(Table, inits)
+nm = tb:option(DummyValue, "name", translate("File name"))
+mt = tb:option(DummyValue, "mtime", translate("Modify time"))
+ms = tb:option(DummyValue, "modestr", translate("Mode string"))
+sz = tb:option(DummyValue, "size", translate("Size"))
+btnrm = tb:option(Button, "remove", translate("Remove"))
+btnrm.render = function(self, section, scope)
+ self.inputstyle = "remove"
+ Button.render(self, section, scope)
+end
+
+btnrm.write = function(self, section)
+ local v = luci.fs.unlink("/tmp/upload/" .. luci.fs.basename(inits[section].name))
+ if v then table.remove(inits, section) end
+ return v
+end
+
+function IsIpkFile(name)
+ name = name or ""
+ local ext = string.lower(string.sub(name, -4, -1))
+ return ext == ".ipk"
+end
+
+btnis = tb:option(Button, "install", translate("Install"))
+btnis.template = "cbi/other_button"
+btnis.render = function(self, section, scope)
+ if not inits[section] then return false end
+ if IsIpkFile(inits[section].name) then
+ scope.display = ""
+ else
+ scope.display = "none"
+ end
+ self.inputstyle = "apply"
+ Button.render(self, section, scope)
+end
+
+btnis.write = function(self, section)
+ local r = luci.sys.exec(string.format('opkg --force-depends install "/tmp/upload/%s"', inits[section].name))
+ form.description = string.format('%s ', r)
+end
+
+return ful, fdl, form
diff --git a/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_button.htm b/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_button.htm
new file mode 100644
index 000000000..1c391ad98
--- /dev/null
+++ b/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_button.htm
@@ -0,0 +1,7 @@
+<%+cbi/valueheader%>
+ <% if self:cfgvalue(section) ~= false then %>
+ <%:Path on Route:%>
+
+<%
+ local val = self:cfgvalue(section) or self.default or ""
+ write(pcdata(val))
+%>
+
+<%+cbi/valuefooter%>
diff --git a/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_upload.htm b/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_upload.htm
new file mode 100644
index 000000000..bb56f444f
--- /dev/null
+++ b/package/lean/luci-app-filetransfer/luasrc/view/cbi/other_upload.htm
@@ -0,0 +1,5 @@
+<%+cbi/valueheader%>
+ <%:Choose local file:%>
+
+#
+
+START=99
+
+start()
+{
+ local vt_enabled=`uci get ipsec.@service[0].enabled 2>/dev/null`
+ local vt_clientip=`uci get ipsec.@service[0].clientip`
+ local vt_clientdns=`uci get ipsec.@service[0].clientdns`
+ local vt_account=`uci get ipsec.@service[0].account`
+ local vt_password=`uci get ipsec.@service[0].password 2>/dev/null`
+ local vt_secret=`uci get ipsec.@service[0].secret 2>/dev/null`
+
+ # -----------------------------------------------------------------
+ if [ "$vt_enabled" = 0 ]; then
+ /etc/init.d/ipsec disable && /etc/init.d/ipsec stop
+ echo "WARNING: IPSec VPN is disabled."
+ return 1
+ fi
+
+ cat > /etc/ipsec.conf < /etc/ipsec.secrets </dev/null
+ delete firewall.ipsecd
+ set firewall.ipsecd=include
+ set firewall.ipsecd.type=script
+ set firewall.ipsecd.path=/etc/ipsec.include
+ set firewall.ipsecd.reload=1
+ commit firewall
+EOF
+
+/etc/init.d/ipsec disable && /etc/init.d/ipsec stop
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-mproxy/Makefile b/package/lean/luci-app-mproxy/Makefile
new file mode 100644
index 000000000..03605de62
--- /dev/null
+++ b/package/lean/luci-app-mproxy/Makefile
@@ -0,0 +1,17 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for Mproxy
+LUCI_DEPENDS:=+mproxy
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.0
+PKG_RELEASE:=3
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
diff --git a/package/lean/luci-app-mproxy/luasrc/controller/mproxy.lua b/package/lean/luci-app-mproxy/luasrc/controller/mproxy.lua
new file mode 100644
index 000000000..b93d5190e
--- /dev/null
+++ b/package/lean/luci-app-mproxy/luasrc/controller/mproxy.lua
@@ -0,0 +1,11 @@
+module("luci.controller.mproxy", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/mproxy") then
+ return
+ end
+ local page
+ page = entry({"admin", "services", "mproxy"}, cbi("mproxy"), _("Mproxy Server"), 100)
+ page.i18n = "mproxy"
+ page.dependent = true
+end
diff --git a/package/lean/luci-app-mproxy/luasrc/model/cbi/mproxy.lua b/package/lean/luci-app-mproxy/luasrc/model/cbi/mproxy.lua
new file mode 100644
index 000000000..63d71beb5
--- /dev/null
+++ b/package/lean/luci-app-mproxy/luasrc/model/cbi/mproxy.lua
@@ -0,0 +1,37 @@
+local m,s,o
+local SYS = require "luci.sys"
+
+
+if SYS.call("pidof mproxy >/dev/null") == 0 then
+ Status = translate("Mproxy is Running Mproxy is Not Running Mproxy is Running Mproxy 姝ｅ湪杩愯 Mproxy is Not Running Mproxy 鏈繍琛
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=n2n_v2 VPN Configuration module
+LUCI_DEPENDS:=+n2n_v2
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.0
+PKG_RELEASE:=1
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/package/lean/luci-app-n2n_v2/luasrc/controller/n2n_v2.lua b/package/lean/luci-app-n2n_v2/luasrc/controller/n2n_v2.lua
new file mode 100644
index 000000000..a1d599886
--- /dev/null
+++ b/package/lean/luci-app-n2n_v2/luasrc/controller/n2n_v2.lua
@@ -0,0 +1,18 @@
+--[[
+N2N V2 Luci configuration page.Made by 981213
+]]--
+
+module("luci.controller.n2n_v2", package.seeall)
+
+function index()
+
+ if not nixio.fs.access("/etc/config/n2n_v2") then
+ return
+ end
+
+ entry({"admin", "vpn"}, firstchild(), "VPN", 45).dependent = false
+
+ local page
+ page = entry({"admin", "vpn", "n2n_v2"}, cbi("n2n_v2"), _("N2N v2 VPN"), 45)
+ page.dependent = true
+end
diff --git a/package/lean/luci-app-n2n_v2/luasrc/model/cbi/n2n_v2.lua b/package/lean/luci-app-n2n_v2/luasrc/model/cbi/n2n_v2.lua
new file mode 100644
index 000000000..ec277394d
--- /dev/null
+++ b/package/lean/luci-app-n2n_v2/luasrc/model/cbi/n2n_v2.lua
@@ -0,0 +1,57 @@
+--[[
+--N2N VPN(V2) configuration page. Made by 981213
+--
+]]--
+
+local fs = require "nixio.fs"
+
+m = Map("n2n_v2", translate("N2N v2 VPN"),
+ translatef("n2n is a layer-two peer-to-peer virtual private network (VPN) which allows users to exploit features typical of P2P applications at network instead of application level."))
+
+s = m:section(TypedSection, "edge", translate("N2N Edge Settings"))
+s.anonymous = true
+
+switch = s:option(Flag, "enabled", translate("Enable"))
+switch.rmempty = false
+
+tunname = s:option(Value, "tunname", translate("TUN desvice name"))
+tunname.optional = false
+
+mode = s:option(ListValue, "mode", translate("Interface mode"))
+mode:value("dhcp")
+mode:value("static")
+
+ipaddr = s:option(Value, "ipaddr", translate("Interface IP address"))
+ipaddr.optional = false
+
+netmask = s:option(Value, "netmask", translate("Interface netmask"))
+netmask.optional = false
+
+supernode = s:option(Value, "supernode", translate("Supernode IP address"))
+supernode.optional = false
+
+port = s:option(Value, "port", translate("Supernode Port"))
+port.datatype = "range(0,65535)"
+port.optional = false
+
+community = s:option(Value, "community", translate("N2N Community name"))
+community.optional = false
+
+s:option(Value, "key", translate("Encryption key"))
+
+route = s:option(Flag, "route", translate("Enable packet forwarding"))
+route.rmempty = false
+
+s2 = m:section(TypedSection, "supernode", translate("N2N Supernode Settings"))
+s2.anonymous = true
+
+switch = s2:option(Flag, "enabled", translate("Enable"))
+switch.rmempty = false
+
+port = s2:option(Value, "port", translate("Port"))
+port.datatype = "range(0,65535)"
+port.optional = false
+
+return m
+
+
diff --git a/package/lean/luci-app-n2n_v2/po/zh-cn/n2n_v2.po b/package/lean/luci-app-n2n_v2/po/zh-cn/n2n_v2.po
new file mode 100755
index 000000000..beedc04ae
--- /dev/null
+++ b/package/lean/luci-app-n2n_v2/po/zh-cn/n2n_v2.po
@@ -0,0 +1,54 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2014-10-01\n"
+"PO-Revision-Date: 2014-10-01\n"
+"Last-Translator: 981213 \n"
+"Language: zh_CN\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+msgid "n2n is a layer-two peer-to-peer virtual private network (VPN) which allows users to exploit features typical of P2P applications at network instead of application level."
+msgstr "N2N鏄竴涓浜屽眰鐐瑰鐐筕PN绋嬪簭锛屽畠鍙互璁╃敤鎴峰湪缃戠粶灞傝屼笉鏄簲鐢ㄥ眰浣跨敤涓浜涚偣瀵圭偣鏈嶅姟銆"
+
+msgid "N2N Edge Settings"
+msgstr "N2N Edge鑺傜偣璁剧疆"
+
+msgid "TUN desvice name"
+msgstr "闅ч亾璁惧鍚嶇О"
+
+msgid "Enable"
+msgstr "鍚敤"
+
+msgid "Interface mode"
+msgstr "鎺ュ彛妯″紡"
+
+msgid "Interface IP address"
+msgstr "鎺ュ彛IP鍦板潃"
+
+msgid "Interface netmask"
+msgstr "鎺ュ彛瀛愮綉鎺╃爜"
+
+msgid "Supernode IP address"
+msgstr "Supernode鑺傜偣IP鍦板潃"
+
+msgid "N2N Community name"
+msgstr "N2N缃戠粶缁勫悕绉"
+
+msgid "Enable packet forwarding"
+msgstr "鍚敤鏁版嵁鍖呰浆鍙"
+
+msgid "N2N Supernode Settings"
+msgstr "N2N Supernode鑺傜偣璁剧疆"
+
+msgid "Port"
+msgstr "绔彛"
+
+msgid "Supernode Port"
+msgstr "Supernode鑺傜偣绔彛"
+
+msgid "Encryption key"
+msgstr "鍔犲瘑瀵嗛挜"
diff --git a/package/lean/luci-app-n2n_v2/root/etc/uci-defaults/luci-n2n_v2 b/package/lean/luci-app-n2n_v2/root/etc/uci-defaults/luci-n2n_v2
new file mode 100755
index 000000000..145579d55
--- /dev/null
+++ b/package/lean/luci-app-n2n_v2/root/etc/uci-defaults/luci-n2n_v2
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete ucitrack.@n2n_v2[-1]
+ add ucitrack n2n_v2
+ set ucitrack.@n2n_v2[-1].init=n2n_v2
+ commit ucitrack
+EOF
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-ngrokc/Makefile b/package/lean/luci-app-ngrokc/Makefile
new file mode 100644
index 000000000..7afd0386a
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/Makefile
@@ -0,0 +1,9 @@
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for NGROKC
+LUCI_DEPENDS:=+ngrokc
+LUCI_PKGARCH:=all
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/package/lean/luci-app-ngrokc/luasrc/controller/ngrokc.lua b/package/lean/luci-app-ngrokc/luasrc/controller/ngrokc.lua
new file mode 100644
index 000000000..54854c737
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/luasrc/controller/ngrokc.lua
@@ -0,0 +1,22 @@
+--[[
+LuCI - Lua Configuration Interface - aria2 support
+
+Copyright 2014 nanpuyue
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+]]--
+
+module("luci.controller.ngrokc", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/ngrokc") then
+ return
+ end
+
+ entry({"admin", "services", "ngrokc"}, cbi("ngrokc/overview"), _("Ngrok Settings")).dependent = true
+ entry({"admin", "services", "ngrokc", "detail"}, cbi("ngrokc/detail"), nil ).leaf = true
+end
diff --git a/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/detail.lua b/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/detail.lua
new file mode 100644
index 000000000..bd267bb80
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/detail.lua
@@ -0,0 +1,77 @@
+-- Copyright 2008 Steven Barth
+-- Copyright 2008 Jo-Philipp Wich
+-- Copyright 2013 Manuel Munz
+-- Copyright 2014-2015 Christian Schoenebeck
+-- Licensed to the public under the Apache License 2.0.
+
+local UCI = (require "luci.model.uci").cursor()
+local NX = require "nixio"
+local NXFS = require "nixio.fs"
+local SYS = require "luci.sys"
+local UTIL = require "luci.util"
+local DISP = require "luci.dispatcher"
+local DTYP = require "luci.cbi.datatypes"
+
+local apply = luci.http.formvalue("cbi.apply")
+if apply then
+ os.execute("/etc/init.d/ngrokc reload &") -- reload configuration
+end
+
+-- takeover arguments -- #######################################################
+local section = arg[1]
+
+m = Map("ngrokc")
+m.redirect = DISP.build_url("admin", "services", "ngrokc")
+
+tunnels = m:section( NamedSection, section, "tunnel", "" .. translate("Details") .. " : " .. section .. " ")
+tunnels.instance = section -- arg [1]
+
+enabled=tunnels:option(Flag, "enabled", translate("Enable"))
+enabled.anonymous = true
+enabled.addremove = false
+
+server=tunnels:option(ListValue, "server", translate("Server"))
+--server:value("tunnel_mobi", "tunnel.mobi:44433")
+--server:value("tunnel_org_cn", "tunnel.org.cn:4443")
+UCI.foreach("ngrokc", "servers", function(s) server:value(s['.name'], s['.name'] .. " ( " .. s.host .. ":" .. s.port .. " ) ") end)
+
+
+ptype=tunnels:option(ListValue, "type", translate("Type"))
+ptype:value("tcp", translate("TCP"))
+ptype:value("http", translate("HTTP"))
+ptype:value("https", translate("HTTPS"))
+
+lhost=tunnels:option(Value, "lhost", translate("Local Address"))
+lhost.rmempty = true
+lhost.placeholder="127.0.0.1"
+lhost.datatype = "ip4addr"
+
+lport=tunnels:option(Value, "lport", translate("Local Port"))
+lport.datatype = "port"
+lport.rmempty = false
+
+custom_domain=tunnels:option(Flag, "custom_domain", translate("Use Custom Domain"))
+custom_domain.default = "0"
+custom_domain.disabled = "0"
+custom_domain.enabled = "1"
+custom_domain.rmempty = false
+custom_domain:depends("type", "http")
+custom_domain:depends("type", "https")
+
+dname=tunnels:option(Value, "dname", translate("Custom Domain") .. "/" .. translate("SubDomain"), translate("Please set your domain's CNAME or A record to the tunnel server."))
+dname.datatype = "hostname"
+--dname.rmempty = false
+dname.rmempty = true
+dname:depends("type", "http")
+dname:depends("type", "https")
+
+rport=tunnels:option(Value, "rport", translate("Remote Port"))
+rport.datatype = "port"
+--rport.rmempty = false
+rport.rmempty = true
+rport:depends("type", "tcp")
+
+custom_html=tunnels:option(DummyValue, "none")
+custom_html.template = "ngrokc/ngrokc_script"
+
+return m
diff --git a/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/overview.lua b/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/overview.lua
new file mode 100644
index 000000000..c7bd1b7b8
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/luasrc/model/cbi/ngrokc/overview.lua
@@ -0,0 +1,108 @@
+-- Mantainer : maz-1 < ohmygod19993 at gmail dot com >
+
+
+m = Map("ngrokc", translate("Ngrok"),translate("Secure tunnels to localhost."))
+
+local apply = luci.http.formvalue("cbi.apply")
+if apply then
+ os.execute("/etc/init.d/ngrokc reload &") -- reload configuration
+end
+
+local DISP = require "luci.dispatcher"
+local CTRL = require "luci.controller.ngrokc"
+local HTTP = require "luci.http"
+local UCI = (require "luci.model.uci").cursor()
+
+servers=m:section(TypedSection, "servers", translate("Servers"))
+servers.template = "cbi/tblsection"
+servers.anonymous = false
+servers.addremove = true
+
+
+nhost=servers:option(Value, "host", translate("Ngrok Host"))
+nhost.rmempty = false
+nhost.datatype = "host"
+
+hport=servers:option(Value, "port", translate("Ngrok Port"))
+hport.rmempty = false
+hport.datatype = "port"
+
+servers:option(Value, "atoken", translate("Auth Token")).rmempty = true
+
+
+tunnel=m:section(TypedSection, "tunnel", translate("Tunnels"))
+tunnel.template = "cbi/tblsection"
+tunnel.anonymous = false
+tunnel.addremove = true
+
+tunnel.extedit = DISP.build_url("admin", "services", "ngrokc", "detail", "%s")
+function tunnel.create(self, name)
+ AbstractSection.create(self, name)
+ HTTP.redirect( self.extedit:format(name) )
+end
+
+ena=tunnel:option(Flag, "enabled", translate("Enabled"))
+ena.template = "ngrokc/overview_enabled"
+ena.rmempty = false
+
+lport=tunnel:option(DummyValue, "_lport", translate("Local Port"))
+lport.template = "ngrokc/overview_value"
+lport.rmempty = false
+function lport.set_one(self, section)
+ local localport = self.map:get(section, "lport") or ""
+ if localport ~= "" then
+ return localport
+ else
+ return [[]] .. translate("config error") .. [[ ]]
+ end
+end
+
+
+server=tunnel:option(DummyValue, "_server", translate("Server"))
+server.template = "ngrokc/overview_value"
+server.rmempty = false
+function server.set_one(self, section)
+ local servername = self.map:get(section, "server") or ""
+ local host = UCI.get("ngrokc", servername, "host") or ""
+ local port = UCI.get("ngrokc", servername, "port") or ""
+ if servername ~= "" or host ~= "" or port ~= "" then
+ return host .. ":" .. port
+ else
+ return [[]] .. translate("config error") .. [[ ]]
+ end
+end
+
+type=tunnel:option(DummyValue, "_type", translate("Type"))
+type.template = "ngrokc/overview_value"
+type.rmempty = false
+function type.set_one(self, section)
+ local tunneltype = self.map:get(section, "type") or ""
+ if tunneltype ~= "" then
+ return string.upper(tunneltype)
+ else
+ return [[]] .. translate("config error") .. [[ ]]
+ end
+end
+
+url=tunnel:option(DummyValue, "_url", translate("URL"))
+url.template = "ngrokc/overview_value"
+url.rmempty = false
+function url.set_one(self, section)
+ local servername = self.map:get(section, "server") or ""
+ local host = UCI.get("ngrokc", servername, "host") or ""
+ local tunneltype = self.map:get(section, "type") or ""
+ local dname = self.map:get(section, "dname") or ""
+ local cusdom = self.map:get(section, "custom_domain") or ""
+ local rport = self.map:get(section, "rport") or ""
+ if tunneltype == "tcp" and rport ~= "" then
+ return "tcp://" .. host .. ":" .. rport
+ elseif cusdom == "1" and dname ~= "" then
+ return tunneltype .. "://" .. dname
+ elseif dname ~= "" then
+ return tunneltype .. "://" .. dname .. "." .. string.gsub(host, "www", "")
+ else
+ return [[]] .. translate("config error") .. [[ ]]
+ end
+end
+
+return m
diff --git a/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/ngrokc_script.htm b/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/ngrokc_script.htm
new file mode 100644
index 000000000..e624f836b
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/ngrokc_script.htm
@@ -0,0 +1,10 @@
+
diff --git a/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/overview_enabled.htm b/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/overview_enabled.htm
new file mode 100644
index 000000000..0013807fb
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/luasrc/view/ngrokc/overview_enabled.htm
@@ -0,0 +1,15 @@
+
+
+<%+cbi/valueheader%>
+
+<%=self:set_one(section)%>
+
+<%+cbi/valuefooter%>
+
diff --git a/package/lean/luci-app-ngrokc/po/zh-cn/ngrokc.po b/package/lean/luci-app-ngrokc/po/zh-cn/ngrokc.po
new file mode 100644
index 000000000..a542bc672
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/po/zh-cn/ngrokc.po
@@ -0,0 +1,56 @@
+msgid ""
+msgstr "Content-Type: text/plain; charset=UTF-8\n"
+
+msgid "Ngrok Settings"
+msgstr "Ngrok璁剧疆"
+
+msgid "Ngrok"
+msgstr "Ngrok鍙嶅悜浠ｇ悊"
+
+msgid "Secure tunnels to localhost."
+msgstr "鏄撶敤鑰屽畨鍏ㄧ殑鍙嶅悜浠ｇ悊杞欢"
+
+msgid "Enable"
+msgstr "鍚敤"
+
+msgid "Ngrok Host"
+msgstr "Ngrok鏈嶅姟鍣"
+
+msgid "Ngrok Port"
+msgstr "Ngrok鏈嶅姟鍣ㄧ鍙"
+
+msgid "Auth Token"
+msgstr "浠ょ墝"
+
+msgid "Type"
+msgstr "绫诲瀷"
+
+msgid "Local Address"
+msgstr "鏈湴鍦板潃"
+
+msgid "Local Port"
+msgstr "鏈湴绔彛"
+
+msgid "Custom Domain"
+msgstr "鑷畾涔夊煙鍚"
+
+msgid "SubDomain"
+msgstr "瀛愬煙鍚"
+
+msgid "Use Custom Domain"
+msgstr "浣跨敤鑷畾涔夊煙鍚"
+
+msgid "Remote Port"
+msgstr "杩滅▼绔彛"
+
+msgid "Please set your domain's CNAME or A record to the tunnel server."
+msgstr "璇锋妸鍩熷悕鐨凜NAME璁板綍鎴朅璁板綍鎸囧悜Ngrok闅ч亾鏈嶅姟鍣ㄣ"
+
+msgid "Servers"
+msgstr "鏈嶅姟鍣"
+
+msgid "Tunnels"
+msgstr "閫氶亾"
+
+msgid "Details"
+msgstr "璇︽儏"
diff --git a/package/lean/luci-app-ngrokc/root/etc/config/ngrokc b/package/lean/luci-app-ngrokc/root/etc/config/ngrokc
new file mode 100644
index 000000000..ad23009d3
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/root/etc/config/ngrokc
@@ -0,0 +1,4 @@
+
+config servers 'ngrok_cc'
+ option host 'server.ngrok.cc'
+ option port '4443'
\ No newline at end of file
diff --git a/package/lean/luci-app-ngrokc/root/etc/init.d/ngrokc b/package/lean/luci-app-ngrokc/root/etc/init.d/ngrokc
new file mode 100755
index 000000000..3c693b8ee
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/root/etc/init.d/ngrokc
@@ -0,0 +1,54 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2007 OpenWrt.org
+
+START=99
+
+list_servers() {
+ SERVER_PARAMS=" -SER[Shost:"
+ config_get host "$1" 'host'
+ config_get port "$1" 'port'
+ config_get atoken "$1" 'atoken'
+ SERVER_PARAMS="${SERVER_PARAMS}""${host}"",Sport:""${port}"
+ [ ! $atoken ] && SERVER_PARAMS=${SERVER_PARAMS}"]" || SERVER_PARAMS=${SERVER_PARAMS}",Atoken:${atoken}]"
+ eval ${1}_PARAMS=\$SERVER_PARAMS
+}
+
+list_tunnels() {
+ config_get_bool enabled "$1" 'enabled'
+ config_get type "$1" 'type'
+ config_get lhost "$1" 'lhost'
+ config_get server "$1" 'server'
+ config_get lport "$1" 'lport'
+ config_get custom_domain "$1" 'custom_domain'
+ config_get rport "$1" 'rport'
+ config_get dname "$1" 'dname'
+ [ -z "$lhost" ] && lhost="127.0.0.1"
+ if [ "$enabled" = 1 ]; then
+ TUNNEL_PARAMS=" -AddTun[Type:${type},Lhost:${lhost},Lport:${lport}"
+ [ "z"$custom_domain = "z1" ] && DTYPE="Hostname" || DTYPE="Sdname"
+ [ ${type} = "tcp" ] && \
+ TUNNEL_PARAMS=${TUNNEL_PARAMS}",Rport:${rport}]" || \
+ TUNNEL_PARAMS=${TUNNEL_PARAMS}",${DTYPE}:${dname}]"
+ echo $server" : ngrokc"$TUNNEL_PARAMS
+ config_foreach list_servers 'servers'
+ eval "exec /usr/bin/ngrokc \$${server}_PARAMS \$TUNNEL_PARAMS 2>&1 > /dev/null & echo \$! >> /tmp/ngrokc/${1}.pid"
+ fi
+}
+
+start() {
+ mkdir -p /tmp/ngrokc
+ config_load 'ngrokc'
+ [ -f /tmp/ngrokc/ngrokc_running ] || \
+ ( config_foreach list_tunnels 'tunnel' ; touch /tmp/ngrokc/ngrokc_running )
+}
+
+stop() {
+ kill -2 `pidof ngrokc|sed "s/$$//g"` 2>/dev/null
+ rm -f /tmp/ngrokc/*
+ sleep 2
+}
+
+boot() {
+ sleep 10
+ start
+}
diff --git a/package/lean/luci-app-ngrokc/root/etc/uci-defaults/luci-app-ngrokc b/package/lean/luci-app-ngrokc/root/etc/uci-defaults/luci-app-ngrokc
new file mode 100644
index 000000000..e806bbb25
--- /dev/null
+++ b/package/lean/luci-app-ngrokc/root/etc/uci-defaults/luci-app-ngrokc
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete ucitrack.@ngrokc[-1]
+ add ucitrack ngrokc
+ set ucitrack.@ngrokc[-1].init=ngrokc
+ commit ucitrack
+EOF
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-openvpn-server/Makefile b/package/lean/luci-app-openvpn-server/Makefile
new file mode 100644
index 000000000..4c6c00475
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/Makefile
@@ -0,0 +1,21 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for OpenVPN Server
+LUCI_DEPENDS:=+openvpn-openssl +openvpn-easy-rsa
+LUCI_PKGARCH:=all
+PKG_NAME:=luci-app-openvpn-server
+PKG_VERSION:=2.0
+PKG_RELEASE:=12
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
+
+
+
diff --git a/package/lean/luci-app-openvpn-server/luasrc/controller/openvpn-server.lua b/package/lean/luci-app-openvpn-server/luasrc/controller/openvpn-server.lua
new file mode 100644
index 000000000..b5eb40a69
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/luasrc/controller/openvpn-server.lua
@@ -0,0 +1,14 @@
+
+module("luci.controller.openvpn-server", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/openvpn") then
+ return
+ end
+
+ entry({"admin", "vpn"}, firstchild(), "VPN", 45).dependent = false
+
+ local page
+
+ entry({"admin", "vpn", "openvpn-server"}, cbi("openvpn-server/openvpn-server"), _("OpenVPN Server"), 80).dependent=false
+end
diff --git a/package/lean/luci-app-openvpn-server/luasrc/model/cbi/openvpn-server/openvpn-server.lua b/package/lean/luci-app-openvpn-server/luasrc/model/cbi/openvpn-server/openvpn-server.lua
new file mode 100644
index 000000000..df795e4c9
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/luasrc/model/cbi/openvpn-server/openvpn-server.lua
@@ -0,0 +1,131 @@
+
+--require("luci.tools.webadmin")
+
+mp = Map("openvpn", "OpenVPN Server","")
+
+s = mp:section(TypedSection, "openvpn", "", translate("An easy config OpenVPN Server Web-UI"))
+s.anonymous = true
+s.addremove = false
+
+s:tab("basic", translate("Base Setting"))
+
+o = s:taboption("basic", Flag, "enabled", translate("Enable"))
+
+port = s:taboption("basic", Value, "port", translate("Port"))
+port.datatype = "range(1,65535)"
+
+ddns = s:taboption("basic", Value, "ddns", translate("WAN DDNS or IP"))
+ddns.datatype = "string"
+ddns.default = "exmple.com"
+ddns.rmempty = false
+
+localnet = s:taboption("basic", Value, "server", translate("Client Network"))
+localnet.datatype = "string"
+localnet.description = translate("VPN Client Network IP with subnet")
+
+list = s:taboption("basic", DynamicList, "push")
+list.title = translate("Client Settings")
+list.datatype = "string"
+list.description = translate("Set route 192.168.0.0 255.255.255.0 and dhcp-option DNS 192.168.0.1 base on your router")
+
+
+local o
+o = s:taboption("basic", Button,"certificate",translate("OpenVPN Client config file"))
+o.inputtitle = translate("Download .ovpn file")
+o.description = translate("If you are using IOS client, please download this .ovpn file and send it via QQ or Email to your IOS device")
+o.inputstyle = "reload"
+o.write = function()
+ luci.sys.call("sh /etc/genovpn.sh 2>&1 >/dev/null")
+ Download()
+end
+
+s:tab("code", translate("Special Code"))
+
+local conf = "/etc/ovpnadd.conf"
+local NXFS = require "nixio.fs"
+o = s:taboption("code", TextValue, "conf")
+o.description = translate("(!)Special Code you know that add in to client .ovpn file")
+o.rows = 13
+o.wrap = "off"
+o.cfgvalue = function(self, section)
+ return NXFS.readfile(conf) or ""
+end
+o.write = function(self, section, value)
+ NXFS.writefile(conf, value:gsub("\r\n", "\n"))
+end
+
+
+local pid = luci.util.exec("/usr/bin/pgrep openvpn")
+
+function openvpn_process_status()
+ local status = "OpenVPN is not running now "
+
+ if pid ~= "" then
+ status = "OpenVPN is running with the PID " .. pid .. ""
+ end
+
+ local status = { status=status }
+ local table = { pid=status }
+ return table
+end
+
+
+
+function Download()
+ local t,e
+ t=nixio.open("/tmp/my.ovpn","r")
+ luci.http.header('Content-Disposition','attachment; filename="my.ovpn"')
+ luci.http.prepare_content("application/octet-stream")
+ while true do
+ e=t:read(nixio.const.buffersize)
+ if(not e)or(#e==0)then
+ break
+ else
+ luci.http.write(e)
+ end
+ end
+ t:close()
+ luci.http.close()
+end
+
+t = mp:section(Table, openvpn_process_status())
+t.anonymous = true
+
+t:option(DummyValue, "status", translate("OpenVPN status"))
+
+if pid == "" then
+ start = t:option(Button, "_start", translate("Start"))
+ start.inputstyle = "apply"
+ function start.write(self, section)
+ luci.util.exec("uci set openvpn.myvpn.enabled=='1' && uci commit openvpn")
+ message = luci.util.exec("/etc/init.d/openvpn start 2>&1")
+ luci.util.exec("sleep 2")
+ luci.http.redirect(
+ luci.dispatcher.build_url("admin", "vpn", "openvpn-server") .. "?message=" .. message
+ )
+ end
+else
+ stop = t:option(Button, "_stop", translate("Stop"))
+ stop.inputstyle = "reset"
+ function stop.write(self, section)
+ luci.util.exec("uci set openvpn.myvpn.enabled=='0' && uci commit openvpn")
+ luci.util.exec("/etc/init.d/openvpn stop")
+ luci.util.exec("sleep 2")
+ luci.http.redirect(
+ luci.dispatcher.build_url("admin", "vpn", "openvpn-server")
+ )
+ end
+end
+
+function mp.on_after_commit(self)
+ os.execute("uci set firewall.openvpn.dest_port=$(uci get openvpn.myvpn.port) && uci commit firewall && /etc/init.d/firewall restart")
+ os.execute("/etc/init.d/openvpn restart")
+end
+
+
+--local apply = luci.http.formvalue("cbi.apply")
+--if apply then
+-- os.execute("/etc/init.d/openvpn restart")
+--end
+
+return mp
diff --git a/package/lean/luci-app-openvpn-server/po/zh-cn/openvpn.po b/package/lean/luci-app-openvpn-server/po/zh-cn/openvpn.po
new file mode 100644
index 000000000..960ba61b1
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/po/zh-cn/openvpn.po
@@ -0,0 +1,50 @@
+msgid "OpenVPN Server"
+msgstr "OpenVPN 鏈嶅姟鍣"
+
+msgid "An easy config OpenVPN Server Web-UI"
+msgstr "鏄撲簬浣跨敤鐨 OpenVPN 鏈嶅姟鍣 Web-UI"
+
+msgid "Base Setting"
+msgstr "鍩烘湰璁剧疆"
+
+msgid "Enable"
+msgstr "鍚敤"
+
+msgid "Port"
+msgstr "绔彛"
+
+msgid "WAN DDNS or IP"
+msgstr "WAN鍙ｇ殑 DDNS鍩熷悕 鎴栬 IP"
+
+
+msgid "Client Network"
+msgstr "瀹㈡埛绔綉娈"
+
+msgid "VPN Client Network IP with subnet"
+msgstr "瀹㈡埛绔垎閰嶇殑缃戞鍦板潃锛堥粯璁や负 10.8.0.0 255.255.255.0锛"
+
+
+msgid "Client Settings"
+msgstr "瀹㈡埛绔帹閫侀厤缃"
+
+msgid "OpenVPN Client config file"
+msgstr "OpenVPN 瀹㈡埛绔厤缃枃浠"
+
+
+msgid "Download .ovpn file"
+msgstr "涓閿笅杞 .ovpn 鏂囦欢"
+
+msgid "If you are using IOS client, please download this .ovpn file and send it via QQ or Email to your IOS device"
+msgstr "濡傛灉浣犱娇鐢ㄧ殑鏄 iOS 璁惧锛屼綘鍙互浣跨敤 QQ 鎴栬呴偖浠跺彂閫佸埌鑷繁鐨勮澶囦笂鐢 OpenVPN 瀹㈡埛绔墦寮瀵煎叆"
+
+msgid "Special Code"
+msgstr "鐗规畩浠ｇ爜"
+
+msgid "(!)Special Code you know that add in to client .ovpn file"
+msgstr "(!)鐗规畩浠ｇ爜灏嗚嚜鍔ㄥ悎骞跺埌瀹㈡埛绔殑 .ovpn 閰嶇疆鏂囦欢涓"
+
+msgid "Set route 192.168.0.0 255.255.255.0 and dhcp-option DNS 192.168.0.1 base on your router"
+msgstr "鏍规嵁璺敱鐨勫疄闄匧AN IP 淇敼 route 192.168.0.0 255.255.255.0 鍜 dhcp-option DNS 192.168.0.1 杩欎袱琛"
+
+msgid "OpenVPN status"
+msgstr "OpenVPN 鏈嶅姟鍣ㄨ繍琛岀姸鎬"
diff --git a/package/lean/luci-app-openvpn-server/root/etc/config/openvpn b/package/lean/luci-app-openvpn-server/root/etc/config/openvpn
new file mode 100644
index 000000000..6a829f4e6
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/config/openvpn
@@ -0,0 +1,28 @@
+
+config openvpn 'myvpn'
+ option enabled '0'
+ option proto 'tcp-server'
+ option port '1194'
+ option ddns example.com
+ option dev 'tun'
+ option topology 'subnet'
+ option server '10.8.0.0 255.255.255.0'
+ option comp_lzo 'adaptive'
+ option ca '/etc/openvpn/ca.crt'
+ option dh '/etc/openvpn/dh1024.pem'
+ option cert '/etc/openvpn/server.crt'
+ option key '/etc/openvpn/server.key'
+ option persist_key '1'
+ option persist_tun '1'
+ option user 'nobody'
+ option group 'nogroup'
+ option max_clients '10'
+ option keepalive '10 120'
+ option verb '3'
+ option status '/var/log/openvpn_status.log'
+ option log '/tmp/openvpn.log'
+ list push 'route 192.168.0.0 255.255.255.0'
+ list push 'comp-lzo adaptive'
+ list push 'redirect-gateway def1 bypass-dhcp'
+ list push 'dhcp-option DNS 192.168.0.1'
+
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/01.pem b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/01.pem
new file mode 100644
index 000000000..a73a757e9
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/01.pem
@@ -0,0 +1,74 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:42 2017 GMT
+ Not After : Aug 21 14:26:42 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:e0:67:2e:33:ab:4f:4f:a1:78:c6:32:ba:d3:1d:
+ 71:73:34:ba:45:40:88:87:76:03:fb:87:d8:4e:4e:
+ 7c:7d:95:22:7d:8e:70:dc:68:10:27:fe:7d:f0:79:
+ 93:86:83:ef:a9:16:78:ae:86:5e:ea:42:74:38:4d:
+ 37:0d:c9:34:a6:84:5e:64:ad:dd:91:dd:df:02:bf:
+ 53:f8:fb:c0:9b:cb:bd:93:7c:26:ab:bd:0a:c6:c3:
+ 5d:da:5d:b3:c0:ff:72:a1:2f:1e:0b:f6:a6:71:77:
+ f9:00:38:8a:ae:ab:c0:86:11:ab:12:de:1e:82:13:
+ e8:c3:d5:bb:6f:2e:bf:6e:c1
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Cert Type:
+ SSL Server
+ Netscape Comment:
+ Easy-RSA Generated Server Certificate
+ X509v3 Subject Key Identifier:
+ 1C:06:47:33:61:0E:15:84:D5:08:5A:40:E6:C9:23:EF:87:F3:EE:F9
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Server Authentication
+ X509v3 Key Usage:
+ Digital Signature, Key Encipherment
+ Signature Algorithm: sha256WithRSAEncryption
+ aa:b5:0d:7a:b3:09:7a:d4:e6:df:46:0d:54:39:e2:34:da:4f:
+ 9b:92:d6:41:db:10:b9:ed:66:34:7f:9d:a9:fa:af:6a:80:b4:
+ 1f:13:d3:39:a6:72:93:5a:6b:e8:4f:ba:95:f9:83:10:58:b3:
+ fe:12:3f:a9:e8:31:04:e0:8e:d8:4c:c1:f7:7e:fc:7a:ba:17:
+ d8:2e:76:ab:7c:17:ca:a4:1d:3d:c5:bc:df:02:e5:2e:91:c4:
+ b2:6c:40:a1:e2:3d:64:15:da:a6:b0:e4:1d:66:11:54:c0:49:
+ 05:91:c4:69:68:2d:bc:d5:f6:32:43:3c:18:c4:97:54:45:52:
+ 28:36
+-----BEGIN CERTIFICATE-----
+MIIDvzCCAyigAwIBAgIBATANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjQyWhcNMjcwODIxMTQyNjQyWjB+
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxDzANBgNVBAMTBnNlcnZlcjEQMA4GA1UEKRMHRWFz
+eVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkouY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDgZy4zq09PoXjGMrrTHXFzNLpFQIiHdgP7h9hOTnx9lSJ9jnDc
+aBAn/n3weZOGg++pFniuhl7qQnQ4TTcNyTSmhF5krd2R3d8Cv1P4+8Cby72TfCar
+vQrGw13aXbPA/3KhLx4L9qZxd/kAOIquq8CGEasS3h6CE+jD1btvLr9uwQIDAQAB
+o4IBTDCCAUgwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwNAYJYIZIAYb4
+QgENBCcWJUVhc3ktUlNBIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYD
+VR0OBBYEFBwGRzNhDhWE1QhaQObJI++H8+75MIGwBgNVHSMEgagwgaWAFI3VBHkQ
+BU8bEmMRrADU/MwxALgJoYGBpH8wfTELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpK
+MQswCQYDVQQHEwJaSjELMAkGA1UEChMCWkoxCzAJBgNVBAsTAlpKMQ4wDAYDVQQD
+EwVaSiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkou
+Y29tggkArhih4T1STfAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWg
+MA0GCSqGSIb3DQEBCwUAA4GBAKq1DXqzCXrU5t9GDVQ54jTaT5uS1kHbELntZjR/
+nan6r2qAtB8T0zmmcpNaa+hPupX5gxBYs/4SP6noMQTgjthMwfd+/Hq6F9gudqt8
+F8qkHT3FvN8C5S6RxLJsQKHiPWQV2qaw5B1mEVTASQWRxGloLbzV9jJDPBjEl1RF
+Uig2
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/02.pem b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/02.pem
new file mode 100644
index 000000000..c757880ea
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/02.pem
@@ -0,0 +1,71 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 2 (0x2)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:58 2017 GMT
+ Not After : Aug 21 14:26:58 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=client1/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:b7:6b:40:0b:c1:ef:a7:c3:fa:54:32:c2:d7:87:
+ fa:ac:85:18:ae:af:44:ba:dd:57:0f:43:73:eb:df:
+ 37:5e:5e:8f:ad:43:7a:87:dd:a6:bd:6a:0b:68:8d:
+ 75:0c:fe:49:39:e1:54:11:53:0f:b5:63:10:5b:21:
+ 98:7f:53:32:b3:d6:b0:3d:23:fc:1d:ad:06:b0:f0:
+ fb:10:27:83:e1:5e:5a:b4:f6:7c:02:87:4c:73:86:
+ 7b:79:07:ca:a7:1c:18:2c:70:e3:9d:e6:f0:89:06:
+ 4b:25:2c:09:39:51:c3:d4:44:ef:81:5e:aa:e0:63:
+ d8:11:c6:9c:e0:6f:d8:66:11
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ Easy-RSA Generated Certificate
+ X509v3 Subject Key Identifier:
+ E8:15:F9:71:C4:A7:C2:41:A3:AF:F5:C5:93:51:8E:5D:67:9B:12:E2
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication
+ X509v3 Key Usage:
+ Digital Signature
+ Signature Algorithm: sha256WithRSAEncryption
+ 5b:63:c2:e5:e4:04:ad:f4:b6:76:24:df:94:a5:b0:a2:99:38:
+ f9:e7:b4:2f:79:91:51:1b:06:4b:33:fc:4c:74:ce:47:3e:54:
+ 1b:da:ea:43:e3:6d:6e:ec:b4:cd:77:86:ea:ea:48:a1:79:70:
+ 5c:ff:99:0e:fb:bd:fc:0d:89:a6:2e:13:fe:86:82:69:33:4c:
+ 28:21:0d:a8:ba:1a:3e:c7:2e:2d:97:0c:5a:ed:e3:af:73:fc:
+ bb:c9:58:05:c5:26:56:13:1c:3e:8f:90:c7:e8:d9:e5:0b:1f:
+ 40:9a:fa:15:49:b9:d8:8e:6a:fd:71:f4:3c:df:a1:11:af:fb:
+ ea:a8
+-----BEGIN CERTIFICATE-----
+MIIDpjCCAw+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjU4WhcNMjcwODIxMTQyNjU4WjB/
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxEDAOBgNVBAMTB2NsaWVudDExEDAOBgNVBCkTB0Vh
+c3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAt2tAC8Hvp8P6VDLC14f6rIUYrq9Eut1XD0Nz6983Xl6PrUN6
+h92mvWoLaI11DP5JOeFUEVMPtWMQWyGYf1Mys9awPSP8Ha0GsPD7ECeD4V5atPZ8
+AodMc4Z7eQfKpxwYLHDjnebwiQZLJSwJOVHD1ETvgV6q4GPYEcac4G/YZhECAwEA
+AaOCATIwggEuMAkGA1UdEwQCMAAwLQYJYIZIAYb4QgENBCAWHkVhc3ktUlNBIEdl
+bmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU6BX5ccSnwkGjr/XFk1GOXWeb
+EuIwgbAGA1UdIwSBqDCBpYAUjdUEeRAFTxsSYxGsANT8zDEAuAmhgYGkfzB9MQsw
+CQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJa
+SjELMAkGA1UECxMCWkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNB
+MRgwFgYJKoZIhvcNAQkBFglaSkBaSi5jb22CCQCuGKHhPVJN8DATBgNVHSUEDDAK
+BggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAW2PC5eQE
+rfS2diTflKWwopk4+ee0L3mRURsGSzP8THTORz5UG9rqQ+Ntbuy0zXeG6upIoXlw
+XP+ZDvu9/A2Jpi4T/oaCaTNMKCENqLoaPscuLZcMWu3jr3P8u8lYBcUmVhMcPo+Q
+x+jZ5QsfQJr6FUm52I5q/XH0PN+hEa/76qg=
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.crt b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.crt
new file mode 100644
index 000000000..7b7ba5ef8
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDXDCCAsWgAwIBAgIJAK4YoeE9Uk3wMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAkNOMQswCQYDVQQIEwJaSjELMAkGA1UEBxMCWkoxCzAJBgNVBAoTAlpKMQsw
+CQYDVQQLEwJaSjEOMAwGA1UEAxMFWkogQ0ExEDAOBgNVBCkTB0Vhc3lSU0ExGDAW
+BgkqhkiG9w0BCQEWCVpKQFpKLmNvbTAeFw0xNzA4MjMxNDE4MDVaFw0yNzA4MjEx
+NDE4MDVaMH0xCzAJBgNVBAYTAkNOMQswCQYDVQQIEwJaSjELMAkGA1UEBxMCWkox
+CzAJBgNVBAoTAlpKMQswCQYDVQQLEwJaSjEOMAwGA1UEAxMFWkogQ0ExEDAOBgNV
+BCkTB0Vhc3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzANBgkqhkiG
+9w0BAQEFAAOBjQAwgYkCgYEAsLBNLkjfNUK4Rb3xgJD0EEgzp6b+5zkiibT3wdS9
+SKZqkqJRcM/z7Ifc79LKXDDHrVnajkyc8QSaXOKVW8pTx75fYnoHjNbeU9JZHoTg
+9GgRWq5HHUJlxhsdbcGeTxOHrMRz2d+VzvNvs5KOLJaqGkRmm/KMb7nTRnwjhx4A
+pWsCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUjdUEeRAFTxsSYxGsANT8zDEAuAkwgbAG
+A1UdIwSBqDCBpYAUjdUEeRAFTxsSYxGsANT8zDEAuAmhgYGkfzB9MQswCQYDVQQG
+EwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkG
+A1UECxMCWkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJ
+KoZIhvcNAQkBFglaSkBaSi5jb22CCQCuGKHhPVJN8DAMBgNVHRMEBTADAQH/MA0G
+CSqGSIb3DQEBCwUAA4GBAAAN0aRmQGNsF23CxShEnj3ohgpYA20F2FwEWYmCCWXe
+CKxuPGtPZAeLmToIMgn75QlyuvVG+Uoe7I6ylbEK3XoeNStcS61wAXL8hIPfMcUX
+fDsImBvc+Bo+LxQMWMSz0r88+B8784KELyaQKOnvPlTrnTuyP9RftjUWpjy23Kjd
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.key b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.key
new file mode 100644
index 000000000..796fbf10e
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/ca.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALCwTS5I3zVCuEW9
+8YCQ9BBIM6em/uc5Iom098HUvUimapKiUXDP8+yH3O/Sylwwx61Z2o5MnPEEmlzi
+lVvKU8e+X2J6B4zW3lPSWR6E4PRoEVquRx1CZcYbHW3Bnk8Th6zEc9nflc7zb7OS
+jiyWqhpEZpvyjG+500Z8I4ceAKVrAgMBAAECgYBfiTRyTlzCg6z3qNioV7hgBWpI
+wHcbtz0BkKRWXh1q5vDBEJtQkGCoCF5iHmvkpUuSY/9U6gACIicFCk8QLrpVZGzY
+1SgOQS796La2gYR0clCvtsf8Kg4BYCKkF40jGDGZTGKtWa9mPuOZXZFhSMZJiCQi
+UIfTN3D9Ngt/nLFMwQJBANwavdYXnPxGr/0rL1ct0RUjsZLyd9kmr1gD4Nq+/uwC
+FQrNHl/ieXOsSeD0eVNtuTFzmt8sTz963SXmbPv01dMCQQDNgPioq4M/1sluGUdI
+yK5bantPAD7A7wTb+uryP7lNMuDSGTXgLsh+RrhBuDlUdi+OPc0dIJV1fTjEiLbI
+fLsJAkEAoSSe6Zh+IaDrBfJRBYWQtuZcApasMfqFk227eMsuvcFEgJTt8QtRGeQA
+bsbt8Ku7Uz4tG8lH99TPBglurwRwawJAALVrJhnBUB0LgMexiTy37TTGzBTyInQw
+jhmlacRyfSOpxs+zcdx3cIgJ5qAeAn6N1227IViVa1xNL9BQ4QwdEQJBAJjLcCYS
+twmgoyOj4K5+8+aAuuXWj7lpxEakOZbghrBmy0GytiRKN9wb/x8QF6EtrJAmYltL
+wMMDUDE0zd+hc2Q=
+-----END PRIVATE KEY-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.crt b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.crt
new file mode 100644
index 000000000..c757880ea
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.crt
@@ -0,0 +1,71 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 2 (0x2)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:58 2017 GMT
+ Not After : Aug 21 14:26:58 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=client1/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:b7:6b:40:0b:c1:ef:a7:c3:fa:54:32:c2:d7:87:
+ fa:ac:85:18:ae:af:44:ba:dd:57:0f:43:73:eb:df:
+ 37:5e:5e:8f:ad:43:7a:87:dd:a6:bd:6a:0b:68:8d:
+ 75:0c:fe:49:39:e1:54:11:53:0f:b5:63:10:5b:21:
+ 98:7f:53:32:b3:d6:b0:3d:23:fc:1d:ad:06:b0:f0:
+ fb:10:27:83:e1:5e:5a:b4:f6:7c:02:87:4c:73:86:
+ 7b:79:07:ca:a7:1c:18:2c:70:e3:9d:e6:f0:89:06:
+ 4b:25:2c:09:39:51:c3:d4:44:ef:81:5e:aa:e0:63:
+ d8:11:c6:9c:e0:6f:d8:66:11
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ Easy-RSA Generated Certificate
+ X509v3 Subject Key Identifier:
+ E8:15:F9:71:C4:A7:C2:41:A3:AF:F5:C5:93:51:8E:5D:67:9B:12:E2
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication
+ X509v3 Key Usage:
+ Digital Signature
+ Signature Algorithm: sha256WithRSAEncryption
+ 5b:63:c2:e5:e4:04:ad:f4:b6:76:24:df:94:a5:b0:a2:99:38:
+ f9:e7:b4:2f:79:91:51:1b:06:4b:33:fc:4c:74:ce:47:3e:54:
+ 1b:da:ea:43:e3:6d:6e:ec:b4:cd:77:86:ea:ea:48:a1:79:70:
+ 5c:ff:99:0e:fb:bd:fc:0d:89:a6:2e:13:fe:86:82:69:33:4c:
+ 28:21:0d:a8:ba:1a:3e:c7:2e:2d:97:0c:5a:ed:e3:af:73:fc:
+ bb:c9:58:05:c5:26:56:13:1c:3e:8f:90:c7:e8:d9:e5:0b:1f:
+ 40:9a:fa:15:49:b9:d8:8e:6a:fd:71:f4:3c:df:a1:11:af:fb:
+ ea:a8
+-----BEGIN CERTIFICATE-----
+MIIDpjCCAw+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjU4WhcNMjcwODIxMTQyNjU4WjB/
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxEDAOBgNVBAMTB2NsaWVudDExEDAOBgNVBCkTB0Vh
+c3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAt2tAC8Hvp8P6VDLC14f6rIUYrq9Eut1XD0Nz6983Xl6PrUN6
+h92mvWoLaI11DP5JOeFUEVMPtWMQWyGYf1Mys9awPSP8Ha0GsPD7ECeD4V5atPZ8
+AodMc4Z7eQfKpxwYLHDjnebwiQZLJSwJOVHD1ETvgV6q4GPYEcac4G/YZhECAwEA
+AaOCATIwggEuMAkGA1UdEwQCMAAwLQYJYIZIAYb4QgENBCAWHkVhc3ktUlNBIEdl
+bmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU6BX5ccSnwkGjr/XFk1GOXWeb
+EuIwgbAGA1UdIwSBqDCBpYAUjdUEeRAFTxsSYxGsANT8zDEAuAmhgYGkfzB9MQsw
+CQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJa
+SjELMAkGA1UECxMCWkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNB
+MRgwFgYJKoZIhvcNAQkBFglaSkBaSi5jb22CCQCuGKHhPVJN8DATBgNVHSUEDDAK
+BggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAW2PC5eQE
+rfS2diTflKWwopk4+ee0L3mRURsGSzP8THTORz5UG9rqQ+Ntbuy0zXeG6upIoXlw
+XP+ZDvu9/A2Jpi4T/oaCaTNMKCENqLoaPscuLZcMWu3jr3P8u8lYBcUmVhMcPo+Q
+x+jZ5QsfQJr6FUm52I5q/XH0PN+hEa/76qg=
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.csr b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.csr
new file mode 100644
index 000000000..a3549ca15
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.csr
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBvzCCASgCAQAwfzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpKMQswCQYDVQQH
+EwJaSjELMAkGA1UEChMCWkoxCzAJBgNVBAsTAlpKMRAwDgYDVQQDEwdjbGllbnQx
+MRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcNAQkBFglaSkBaSi5jb20wgZ8w
+DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALdrQAvB76fD+lQywteH+qyFGK6vRLrd
+Vw9Dc+vfN15ej61Deofdpr1qC2iNdQz+STnhVBFTD7VjEFshmH9TMrPWsD0j/B2t
+BrDw+xAng+FeWrT2fAKHTHOGe3kHyqccGCxw453m8IkGSyUsCTlRw9RE74FequBj
+2BHGnOBv2GYRAgMBAAGgADANBgkqhkiG9w0BAQsFAAOBgQBfvn2fP2Tj8FTZH+Xk
+9u04rYaQdspSyL61F4QIEiP5UOUzbnSSU/B72KF5gm8b0irXGnTbHlXeMv6WXaAS
+VF1fEeM+gsGJIDOvomT5PKfudezr6DpGrUammQnRY3tho078Ao0Mkq8PAWpiVWGV
+Z7rsqHhI3mWYLNyne9n8K224pg==
+-----END CERTIFICATE REQUEST-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.key b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.key
new file mode 100644
index 000000000..076ce4e72
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALdrQAvB76fD+lQy
+wteH+qyFGK6vRLrdVw9Dc+vfN15ej61Deofdpr1qC2iNdQz+STnhVBFTD7VjEFsh
+mH9TMrPWsD0j/B2tBrDw+xAng+FeWrT2fAKHTHOGe3kHyqccGCxw453m8IkGSyUs
+CTlRw9RE74FequBj2BHGnOBv2GYRAgMBAAECgYBhWatEkkqA4KOczNRdUO7bYkkX
+bi8sfw4WK9b6+h6JF+dqLsZ6FkrJfd9QPsRBgTWcYtwb1dogi9PCirJF4gKmSsv1
+h/BISW4lrXJPf08aJAuBF0ym8XZUgVLLptn8KdXX3xc6YF6K336AnNNLZ80X4El8
+m7X4d8Y3F4k3Dj04AQJBAN9NkHYwevaZ8jfv5rZSTKECmdk1DZITd756+sObFAs1
+vX9VfunwVw6xWmaUyMt8oPFqb0wKES9zqrViaMhU9YkCQQDSRqV3ldHcaZJ6sTgm
+T8ZKm+UpbC4zat4rGSBYKaoeLRPh5nxP892rOfBAevkoIQzW7LfVfoMImM/i1J6T
+lNJJAkAHSOZ/lJFOXjNSs9bY99JcJlOSjHKG42+ynRx1KSf8PaKS9t0PELImXo7O
+begnC0fM2GYNGv74h1N4W1+DuZHRAkEAlNov3jSvh+EwMSxs/Cnyy/QJyEXteraH
+KWkzDVYJOC1e6sZXb93JKKHuIicrY63pwed2x2o0ZgyO9RrgWsa6CQJBAMogPcRO
+jUGjYs3IYXW6Suf1bRJN2aS81gx7lqyLQE3ignH6e9kMxcrzG4AzzePCLouY3waL
+HS1KW8V9I5c4qTs=
+-----END PRIVATE KEY-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.p12 b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.p12
new file mode 100644
index 000000000..1511e1d0a
Binary files /dev/null and b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/client1.p12 differ
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/dh1024.pem b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/dh1024.pem
new file mode 100644
index 000000000..01eba3e5a
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/dh1024.pem
@@ -0,0 +1,5 @@
+-----BEGIN DH PARAMETERS-----
+MIGHAoGBAMzJWsEtMQ76G81O8RzEweDaPrio4NihRBo0fmNuh3IjJtFJ++URPW4y
+HHtnGOkPoMwQjGQ3GQV+lfcR7QGWojET4NskXOk6mdFU+/nYB9s5YY7RR4qyln9b
+dNMp3KnMLtILNH1rJRoqYbSNoz3Z2cS59Ejp1dgXqN8kSP8wiqDjAgEC
+-----END DH PARAMETERS-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt
new file mode 100644
index 000000000..4bb34b80f
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt
@@ -0,0 +1,2 @@
+V 270821142642Z 01 unknown /C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
+V 270821142658Z 02 unknown /C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=client1/name=EasyRSA/emailAddress=ZJ@ZJ.com
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr.old b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr.old
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.attr.old
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.old b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.old
new file mode 100644
index 000000000..d74831ee4
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/index.txt.old
@@ -0,0 +1 @@
+V 270821142642Z 01 unknown /C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial
new file mode 100644
index 000000000..75016ea36
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial
@@ -0,0 +1 @@
+03
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial.old b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial.old
new file mode 100644
index 000000000..9e22bcb8e
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/serial.old
@@ -0,0 +1 @@
+02
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.crt b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.crt
new file mode 100644
index 000000000..a73a757e9
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.crt
@@ -0,0 +1,74 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:42 2017 GMT
+ Not After : Aug 21 14:26:42 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:e0:67:2e:33:ab:4f:4f:a1:78:c6:32:ba:d3:1d:
+ 71:73:34:ba:45:40:88:87:76:03:fb:87:d8:4e:4e:
+ 7c:7d:95:22:7d:8e:70:dc:68:10:27:fe:7d:f0:79:
+ 93:86:83:ef:a9:16:78:ae:86:5e:ea:42:74:38:4d:
+ 37:0d:c9:34:a6:84:5e:64:ad:dd:91:dd:df:02:bf:
+ 53:f8:fb:c0:9b:cb:bd:93:7c:26:ab:bd:0a:c6:c3:
+ 5d:da:5d:b3:c0:ff:72:a1:2f:1e:0b:f6:a6:71:77:
+ f9:00:38:8a:ae:ab:c0:86:11:ab:12:de:1e:82:13:
+ e8:c3:d5:bb:6f:2e:bf:6e:c1
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Cert Type:
+ SSL Server
+ Netscape Comment:
+ Easy-RSA Generated Server Certificate
+ X509v3 Subject Key Identifier:
+ 1C:06:47:33:61:0E:15:84:D5:08:5A:40:E6:C9:23:EF:87:F3:EE:F9
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Server Authentication
+ X509v3 Key Usage:
+ Digital Signature, Key Encipherment
+ Signature Algorithm: sha256WithRSAEncryption
+ aa:b5:0d:7a:b3:09:7a:d4:e6:df:46:0d:54:39:e2:34:da:4f:
+ 9b:92:d6:41:db:10:b9:ed:66:34:7f:9d:a9:fa:af:6a:80:b4:
+ 1f:13:d3:39:a6:72:93:5a:6b:e8:4f:ba:95:f9:83:10:58:b3:
+ fe:12:3f:a9:e8:31:04:e0:8e:d8:4c:c1:f7:7e:fc:7a:ba:17:
+ d8:2e:76:ab:7c:17:ca:a4:1d:3d:c5:bc:df:02:e5:2e:91:c4:
+ b2:6c:40:a1:e2:3d:64:15:da:a6:b0:e4:1d:66:11:54:c0:49:
+ 05:91:c4:69:68:2d:bc:d5:f6:32:43:3c:18:c4:97:54:45:52:
+ 28:36
+-----BEGIN CERTIFICATE-----
+MIIDvzCCAyigAwIBAgIBATANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjQyWhcNMjcwODIxMTQyNjQyWjB+
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxDzANBgNVBAMTBnNlcnZlcjEQMA4GA1UEKRMHRWFz
+eVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkouY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDgZy4zq09PoXjGMrrTHXFzNLpFQIiHdgP7h9hOTnx9lSJ9jnDc
+aBAn/n3weZOGg++pFniuhl7qQnQ4TTcNyTSmhF5krd2R3d8Cv1P4+8Cby72TfCar
+vQrGw13aXbPA/3KhLx4L9qZxd/kAOIquq8CGEasS3h6CE+jD1btvLr9uwQIDAQAB
+o4IBTDCCAUgwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwNAYJYIZIAYb4
+QgENBCcWJUVhc3ktUlNBIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYD
+VR0OBBYEFBwGRzNhDhWE1QhaQObJI++H8+75MIGwBgNVHSMEgagwgaWAFI3VBHkQ
+BU8bEmMRrADU/MwxALgJoYGBpH8wfTELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpK
+MQswCQYDVQQHEwJaSjELMAkGA1UEChMCWkoxCzAJBgNVBAsTAlpKMQ4wDAYDVQQD
+EwVaSiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkou
+Y29tggkArhih4T1STfAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWg
+MA0GCSqGSIb3DQEBCwUAA4GBAKq1DXqzCXrU5t9GDVQ54jTaT5uS1kHbELntZjR/
+nan6r2qAtB8T0zmmcpNaa+hPupX5gxBYs/4SP6noMQTgjthMwfd+/Hq6F9gudqt8
+F8qkHT3FvN8C5S6RxLJsQKHiPWQV2qaw5B1mEVTASQWRxGloLbzV9jJDPBjEl1RF
+Uig2
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.csr b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.csr
new file mode 100644
index 000000000..c83aadabe
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.csr
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBvjCCAScCAQAwfjELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpKMQswCQYDVQQH
+EwJaSjELMAkGA1UEChMCWkoxCzAJBgNVBAsTAlpKMQ8wDQYDVQQDEwZzZXJ2ZXIx
+EDAOBgNVBCkTB0Vhc3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzAN
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA4GcuM6tPT6F4xjK60x1xczS6RUCIh3YD
++4fYTk58fZUifY5w3GgQJ/598HmThoPvqRZ4roZe6kJ0OE03Dck0poReZK3dkd3f
+Ar9T+PvAm8u9k3wmq70KxsNd2l2zwP9yoS8eC/amcXf5ADiKrqvAhhGrEt4eghPo
+w9W7by6/bsECAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4GBAMrytQrG3MGVTD2vsZkw
+hJn9U4MYmikqFxEcSJ+JEeDJ0w3NTn95XJmFtmuT/CwsrnP9g+1neSpCXsZewozd
+QRisYBF9Rl9qw9fH2o1S/GIVpTDIiTtWjegZA6FPkhQQyY387LU9Lp4vG9hdNbuz
+QNDs6cI9T0U53PZiq7R65rGV
+-----END CERTIFICATE REQUEST-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.key b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.key
new file mode 100644
index 000000000..3aab5cd4b
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/keys/server.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOBnLjOrT0+heMYy
+utMdcXM0ukVAiId2A/uH2E5OfH2VIn2OcNxoECf+ffB5k4aD76kWeK6GXupCdDhN
+Nw3JNKaEXmSt3ZHd3wK/U/j7wJvLvZN8Jqu9CsbDXdpds8D/cqEvHgv2pnF3+QA4
+iq6rwIYRqxLeHoIT6MPVu28uv27BAgMBAAECgYEAqno4g1BVxG0rT4cin1fy5E7e
+Y9YO4ropdGFTVsoRkWZG+ZPI8eisvXV9P79c8AgzfgVwUUYLvXQWzt76QCLnN11x
+pBURloJbEReEEzIF6z3LiT9CKgVWY4vtC6f5OW4Kd+EZxXMftFz8kMzRuRQLvOzR
+WeU+3GD42mIwYjsXBrECQQD2P6azeZJ1ZIEf+9Ys19tSQ6uxbXyvghlTfhmZfBW3
+bshNRH4+L4lnnbm75pFkWqR0gYSAD3toRymccctN2K9jAkEA6UoRwURTjIER8yZO
+6gLTFtzb841jv6TPErOY7CzNZ/TYBUdUBmM/NB4+RgBpBNFXB3uqweNVPO6mhyQP
+zB88iwJBAOeH6YGOqTpfiVk9PJ9lRf4PSnvE6htLQ+zQ/9jkZrbWHtcns1tc7uDR
+2DToEYQ+BarVrHOMGwhtAJ7sD6/eMOkCQFjn8XxGHdEeH0kbAFgOW4QLB4f6Clmu
+5XurFkxrhpxnoyvf0xXcHOov3GuxHFTJsvEXICxkBsgB61T1WU/hV6ECQGzk5Eqo
+uik2OAYMOb7NPGYMWS68DpmP11QDuvoj5zm2vdzohXHyBM7mO12MLSrTpxfgjWhQ
+pqwEbErchuKkzN4=
+-----END PRIVATE KEY-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/openssl-1.0.0.cnf b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/openssl-1.0.0.cnf
new file mode 100644
index 000000000..93ac6eaba
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/openssl-1.0.0.cnf
@@ -0,0 +1,286 @@
+# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME = .
+RANDFILE = $ENV::HOME/.rnd
+openssl_conf = openssl_init
+
+[ openssl_init ]
+# Extra OBJECT IDENTIFIER info:
+#oid_file = $ENV::HOME/.oid
+oid_section = new_oids
+engines = engine_section
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions =
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca = CA_default # The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir = $ENV::KEY_DIR # Where everything is kept
+certs = $dir # Where the issued certs are kept
+crl_dir = $dir # Where the issued crl are kept
+database = $dir/index.txt # database index file.
+new_certs_dir = $dir # default place for new certs.
+
+certificate = $dir/ca.crt # The CA certificate
+serial = $dir/serial # The current serial number
+crl = $dir/crl.pem # The current CRL
+private_key = $dir/ca.key # The private key
+RANDFILE = $dir/.rand # private random number file
+
+x509_extensions = usr_cert # The extentions to add to the cert
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crl_extensions = crl_ext
+
+default_days = 3650 # how long to certify for
+default_crl_days= 30 # how long before next CRL
+default_md = sha256 # use public key default MD
+preserve = no # keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy = policy_anything
+
+# For the CA policy
+[ policy_match ]
+countryName = match
+stateOrProvinceName = match
+organizationName = match
+organizationalUnitName = optional
+commonName = supplied
+name = optional
+emailAddress = optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName = optional
+stateOrProvinceName = optional
+localityName = optional
+organizationName = optional
+organizationalUnitName = optional
+commonName = supplied
+name = optional
+emailAddress = optional
+
+####################################################################
+[ req ]
+default_bits = $ENV::KEY_SIZE
+default_keyfile = privkey.pem
+default_md = sha256
+distinguished_name = req_distinguished_name
+attributes = req_attributes
+x509_extensions = v3_ca # The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options.
+# default: PrintableString, T61String, BMPString.
+# pkix : PrintableString, BMPString (PKIX recommendation after 2004).
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName = Country Name (2 letter code)
+countryName_default = $ENV::KEY_COUNTRY
+countryName_min = 2
+countryName_max = 2
+
+stateOrProvinceName = State or Province Name (full name)
+stateOrProvinceName_default = $ENV::KEY_PROVINCE
+
+localityName = Locality Name (eg, city)
+localityName_default = $ENV::KEY_CITY
+
+0.organizationName = Organization Name (eg, company)
+0.organizationName_default = $ENV::KEY_ORG
+
+# we can do this but it is not needed normally :-)
+#1.organizationName = Second Organization Name (eg, company)
+#1.organizationName_default = World Wide Web Pty Ltd
+
+organizationalUnitName = Organizational Unit Name (eg, section)
+#organizationalUnitName_default =
+
+commonName = Common Name (eg, your name or your server\'s hostname)
+commonName_max = 64
+
+name = Name
+name_max = 64
+
+emailAddress = Email Address
+emailAddress_default = $ENV::KEY_EMAIL
+emailAddress_max = 40
+
+# JY -- added for batch mode
+organizationalUnitName_default = $ENV::KEY_OU
+commonName_default = $ENV::KEY_CN
+name_default = $ENV::KEY_NAME
+
+
+# SET-ex3 = SET extension number 3
+
+[ req_attributes ]
+challengePassword = A challenge password
+challengePassword_min = 4
+challengePassword_max = 20
+
+unstructuredName = An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType = server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment = "Easy-RSA Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=clientAuth
+keyUsage = digitalSignature
+
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ server ]
+
+# JY ADDED -- Make a cert with nsCertType set to "server"
+basicConstraints=CA:FALSE
+nsCertType = server
+nsComment = "Easy-RSA Generated Server Certificate"
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=serverAuth
+keyUsage = digitalSignature, keyEncipherment
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+
+[ engine_section ]
+#
+# If you are using PKCS#11
+# Install engine_pkcs11 of opensc (www.opensc.org)
+# And uncomment the following
+# verify that dynamic_path points to the correct location
+#
+#pkcs11 = pkcs11_section
+
+[ pkcs11_section ]
+engine_id = pkcs11
+dynamic_path = /usr/lib/engines/engine_pkcs11.so
+MODULE_PATH = $ENV::PKCS11_MODULE_PATH
+PIN = $ENV::PKCS11_PIN
+init = 0
diff --git a/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/vars b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/vars
new file mode 100644
index 000000000..4873fbcf7
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/easy-rsa/vars
@@ -0,0 +1,19 @@
+export EASY_RSA="/etc/easy-rsa"
+export OPENSSL="openssl"
+export PKCS11TOOL="pkcs11-tool"
+export GREP="grep"
+export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA`
+export KEY_DIR="$EASY_RSA/keys"
+echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
+export PKCS11_MODULE_PATH="dummy"
+export PKCS11_PIN="dummy"
+export KEY_SIZE=1024
+export CA_EXPIRE=3650
+export KEY_EXPIRE=3650
+export KEY_COUNTRY="CN"
+export KEY_PROVINCE="ZJ"
+export KEY_CITY="ZJ"
+export KEY_ORG="ZJ"
+export KEY_EMAIL="ZJ@ZJ.com"
+export KEY_OU="ZJ"
+export KEY_NAME="EasyRSA"
\ No newline at end of file
diff --git a/package/lean/luci-app-openvpn-server/root/etc/genovpn.sh b/package/lean/luci-app-openvpn-server/root/etc/genovpn.sh
new file mode 100755
index 000000000..964f8e859
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/genovpn.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+ddns=`uci get openvpn.myvpn.ddns`
+port=`uci get openvpn.myvpn.port`
+
+cat > /tmp/my.ovpn <' >> /tmp/my.ovpn
+cat /etc/openvpn/ca.crt >> /tmp/my.ovpn
+echo '' >> /tmp/my.ovpn
+echo '' >> /tmp/my.ovpn
+cat /etc/openvpn/client1.crt >> /tmp/my.ovpn
+echo ' ' >> /tmp/my.ovpn
+echo '' >> /tmp/my.ovpn
+cat /etc/openvpn/client1.key >> /tmp/my.ovpn
+echo ' ' >> /tmp/my.ovpn
+[ -f /etc/ovpnadd.conf ] && cat /etc/ovpnadd.conf >> /tmp/my.ovpn
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/ca.crt b/package/lean/luci-app-openvpn-server/root/etc/openvpn/ca.crt
new file mode 100644
index 000000000..7b7ba5ef8
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/ca.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDXDCCAsWgAwIBAgIJAK4YoeE9Uk3wMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAkNOMQswCQYDVQQIEwJaSjELMAkGA1UEBxMCWkoxCzAJBgNVBAoTAlpKMQsw
+CQYDVQQLEwJaSjEOMAwGA1UEAxMFWkogQ0ExEDAOBgNVBCkTB0Vhc3lSU0ExGDAW
+BgkqhkiG9w0BCQEWCVpKQFpKLmNvbTAeFw0xNzA4MjMxNDE4MDVaFw0yNzA4MjEx
+NDE4MDVaMH0xCzAJBgNVBAYTAkNOMQswCQYDVQQIEwJaSjELMAkGA1UEBxMCWkox
+CzAJBgNVBAoTAlpKMQswCQYDVQQLEwJaSjEOMAwGA1UEAxMFWkogQ0ExEDAOBgNV
+BCkTB0Vhc3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzANBgkqhkiG
+9w0BAQEFAAOBjQAwgYkCgYEAsLBNLkjfNUK4Rb3xgJD0EEgzp6b+5zkiibT3wdS9
+SKZqkqJRcM/z7Ifc79LKXDDHrVnajkyc8QSaXOKVW8pTx75fYnoHjNbeU9JZHoTg
+9GgRWq5HHUJlxhsdbcGeTxOHrMRz2d+VzvNvs5KOLJaqGkRmm/KMb7nTRnwjhx4A
+pWsCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUjdUEeRAFTxsSYxGsANT8zDEAuAkwgbAG
+A1UdIwSBqDCBpYAUjdUEeRAFTxsSYxGsANT8zDEAuAmhgYGkfzB9MQswCQYDVQQG
+EwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkG
+A1UECxMCWkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJ
+KoZIhvcNAQkBFglaSkBaSi5jb22CCQCuGKHhPVJN8DAMBgNVHRMEBTADAQH/MA0G
+CSqGSIb3DQEBCwUAA4GBAAAN0aRmQGNsF23CxShEnj3ohgpYA20F2FwEWYmCCWXe
+CKxuPGtPZAeLmToIMgn75QlyuvVG+Uoe7I6ylbEK3XoeNStcS61wAXL8hIPfMcUX
+fDsImBvc+Bo+LxQMWMSz0r88+B8784KELyaQKOnvPlTrnTuyP9RftjUWpjy23Kjd
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.crt b/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.crt
new file mode 100644
index 000000000..c757880ea
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.crt
@@ -0,0 +1,71 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 2 (0x2)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:58 2017 GMT
+ Not After : Aug 21 14:26:58 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=client1/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:b7:6b:40:0b:c1:ef:a7:c3:fa:54:32:c2:d7:87:
+ fa:ac:85:18:ae:af:44:ba:dd:57:0f:43:73:eb:df:
+ 37:5e:5e:8f:ad:43:7a:87:dd:a6:bd:6a:0b:68:8d:
+ 75:0c:fe:49:39:e1:54:11:53:0f:b5:63:10:5b:21:
+ 98:7f:53:32:b3:d6:b0:3d:23:fc:1d:ad:06:b0:f0:
+ fb:10:27:83:e1:5e:5a:b4:f6:7c:02:87:4c:73:86:
+ 7b:79:07:ca:a7:1c:18:2c:70:e3:9d:e6:f0:89:06:
+ 4b:25:2c:09:39:51:c3:d4:44:ef:81:5e:aa:e0:63:
+ d8:11:c6:9c:e0:6f:d8:66:11
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ Easy-RSA Generated Certificate
+ X509v3 Subject Key Identifier:
+ E8:15:F9:71:C4:A7:C2:41:A3:AF:F5:C5:93:51:8E:5D:67:9B:12:E2
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication
+ X509v3 Key Usage:
+ Digital Signature
+ Signature Algorithm: sha256WithRSAEncryption
+ 5b:63:c2:e5:e4:04:ad:f4:b6:76:24:df:94:a5:b0:a2:99:38:
+ f9:e7:b4:2f:79:91:51:1b:06:4b:33:fc:4c:74:ce:47:3e:54:
+ 1b:da:ea:43:e3:6d:6e:ec:b4:cd:77:86:ea:ea:48:a1:79:70:
+ 5c:ff:99:0e:fb:bd:fc:0d:89:a6:2e:13:fe:86:82:69:33:4c:
+ 28:21:0d:a8:ba:1a:3e:c7:2e:2d:97:0c:5a:ed:e3:af:73:fc:
+ bb:c9:58:05:c5:26:56:13:1c:3e:8f:90:c7:e8:d9:e5:0b:1f:
+ 40:9a:fa:15:49:b9:d8:8e:6a:fd:71:f4:3c:df:a1:11:af:fb:
+ ea:a8
+-----BEGIN CERTIFICATE-----
+MIIDpjCCAw+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjU4WhcNMjcwODIxMTQyNjU4WjB/
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxEDAOBgNVBAMTB2NsaWVudDExEDAOBgNVBCkTB0Vh
+c3lSU0ExGDAWBgkqhkiG9w0BCQEWCVpKQFpKLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAt2tAC8Hvp8P6VDLC14f6rIUYrq9Eut1XD0Nz6983Xl6PrUN6
+h92mvWoLaI11DP5JOeFUEVMPtWMQWyGYf1Mys9awPSP8Ha0GsPD7ECeD4V5atPZ8
+AodMc4Z7eQfKpxwYLHDjnebwiQZLJSwJOVHD1ETvgV6q4GPYEcac4G/YZhECAwEA
+AaOCATIwggEuMAkGA1UdEwQCMAAwLQYJYIZIAYb4QgENBCAWHkVhc3ktUlNBIEdl
+bmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU6BX5ccSnwkGjr/XFk1GOXWeb
+EuIwgbAGA1UdIwSBqDCBpYAUjdUEeRAFTxsSYxGsANT8zDEAuAmhgYGkfzB9MQsw
+CQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJa
+SjELMAkGA1UECxMCWkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNB
+MRgwFgYJKoZIhvcNAQkBFglaSkBaSi5jb22CCQCuGKHhPVJN8DATBgNVHSUEDDAK
+BggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAW2PC5eQE
+rfS2diTflKWwopk4+ee0L3mRURsGSzP8THTORz5UG9rqQ+Ntbuy0zXeG6upIoXlw
+XP+ZDvu9/A2Jpi4T/oaCaTNMKCENqLoaPscuLZcMWu3jr3P8u8lYBcUmVhMcPo+Q
+x+jZ5QsfQJr6FUm52I5q/XH0PN+hEa/76qg=
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.key b/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.key
new file mode 100644
index 000000000..076ce4e72
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/client1.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALdrQAvB76fD+lQy
+wteH+qyFGK6vRLrdVw9Dc+vfN15ej61Deofdpr1qC2iNdQz+STnhVBFTD7VjEFsh
+mH9TMrPWsD0j/B2tBrDw+xAng+FeWrT2fAKHTHOGe3kHyqccGCxw453m8IkGSyUs
+CTlRw9RE74FequBj2BHGnOBv2GYRAgMBAAECgYBhWatEkkqA4KOczNRdUO7bYkkX
+bi8sfw4WK9b6+h6JF+dqLsZ6FkrJfd9QPsRBgTWcYtwb1dogi9PCirJF4gKmSsv1
+h/BISW4lrXJPf08aJAuBF0ym8XZUgVLLptn8KdXX3xc6YF6K336AnNNLZ80X4El8
+m7X4d8Y3F4k3Dj04AQJBAN9NkHYwevaZ8jfv5rZSTKECmdk1DZITd756+sObFAs1
+vX9VfunwVw6xWmaUyMt8oPFqb0wKES9zqrViaMhU9YkCQQDSRqV3ldHcaZJ6sTgm
+T8ZKm+UpbC4zat4rGSBYKaoeLRPh5nxP892rOfBAevkoIQzW7LfVfoMImM/i1J6T
+lNJJAkAHSOZ/lJFOXjNSs9bY99JcJlOSjHKG42+ynRx1KSf8PaKS9t0PELImXo7O
+begnC0fM2GYNGv74h1N4W1+DuZHRAkEAlNov3jSvh+EwMSxs/Cnyy/QJyEXteraH
+KWkzDVYJOC1e6sZXb93JKKHuIicrY63pwed2x2o0ZgyO9RrgWsa6CQJBAMogPcRO
+jUGjYs3IYXW6Suf1bRJN2aS81gx7lqyLQE3ignH6e9kMxcrzG4AzzePCLouY3waL
+HS1KW8V9I5c4qTs=
+-----END PRIVATE KEY-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/dh1024.pem b/package/lean/luci-app-openvpn-server/root/etc/openvpn/dh1024.pem
new file mode 100644
index 000000000..01eba3e5a
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/dh1024.pem
@@ -0,0 +1,5 @@
+-----BEGIN DH PARAMETERS-----
+MIGHAoGBAMzJWsEtMQ76G81O8RzEweDaPrio4NihRBo0fmNuh3IjJtFJ++URPW4y
+HHtnGOkPoMwQjGQ3GQV+lfcR7QGWojET4NskXOk6mdFU+/nYB9s5YY7RR4qyln9b
+dNMp3KnMLtILNH1rJRoqYbSNoz3Z2cS59Ejp1dgXqN8kSP8wiqDjAgEC
+-----END DH PARAMETERS-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.crt b/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.crt
new file mode 100644
index 000000000..a73a757e9
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.crt
@@ -0,0 +1,74 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Validity
+ Not Before: Aug 23 14:26:42 2017 GMT
+ Not After : Aug 21 14:26:42 2027 GMT
+ Subject: C=CN, ST=ZJ, L=ZJ, O=ZJ, OU=ZJ, CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (1024 bit)
+ Modulus:
+ 00:e0:67:2e:33:ab:4f:4f:a1:78:c6:32:ba:d3:1d:
+ 71:73:34:ba:45:40:88:87:76:03:fb:87:d8:4e:4e:
+ 7c:7d:95:22:7d:8e:70:dc:68:10:27:fe:7d:f0:79:
+ 93:86:83:ef:a9:16:78:ae:86:5e:ea:42:74:38:4d:
+ 37:0d:c9:34:a6:84:5e:64:ad:dd:91:dd:df:02:bf:
+ 53:f8:fb:c0:9b:cb:bd:93:7c:26:ab:bd:0a:c6:c3:
+ 5d:da:5d:b3:c0:ff:72:a1:2f:1e:0b:f6:a6:71:77:
+ f9:00:38:8a:ae:ab:c0:86:11:ab:12:de:1e:82:13:
+ e8:c3:d5:bb:6f:2e:bf:6e:c1
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Cert Type:
+ SSL Server
+ Netscape Comment:
+ Easy-RSA Generated Server Certificate
+ X509v3 Subject Key Identifier:
+ 1C:06:47:33:61:0E:15:84:D5:08:5A:40:E6:C9:23:EF:87:F3:EE:F9
+ X509v3 Authority Key Identifier:
+ keyid:8D:D5:04:79:10:05:4F:1B:12:63:11:AC:00:D4:FC:CC:31:00:B8:09
+ DirName:/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=ZJ CA/name=EasyRSA/emailAddress=ZJ@ZJ.com
+ serial:AE:18:A1:E1:3D:52:4D:F0
+
+ X509v3 Extended Key Usage:
+ TLS Web Server Authentication
+ X509v3 Key Usage:
+ Digital Signature, Key Encipherment
+ Signature Algorithm: sha256WithRSAEncryption
+ aa:b5:0d:7a:b3:09:7a:d4:e6:df:46:0d:54:39:e2:34:da:4f:
+ 9b:92:d6:41:db:10:b9:ed:66:34:7f:9d:a9:fa:af:6a:80:b4:
+ 1f:13:d3:39:a6:72:93:5a:6b:e8:4f:ba:95:f9:83:10:58:b3:
+ fe:12:3f:a9:e8:31:04:e0:8e:d8:4c:c1:f7:7e:fc:7a:ba:17:
+ d8:2e:76:ab:7c:17:ca:a4:1d:3d:c5:bc:df:02:e5:2e:91:c4:
+ b2:6c:40:a1:e2:3d:64:15:da:a6:b0:e4:1d:66:11:54:c0:49:
+ 05:91:c4:69:68:2d:bc:d5:f6:32:43:3c:18:c4:97:54:45:52:
+ 28:36
+-----BEGIN CERTIFICATE-----
+MIIDvzCCAyigAwIBAgIBATANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJDTjEL
+MAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQKEwJaSjELMAkGA1UECxMC
+WkoxDjAMBgNVBAMTBVpKIENBMRAwDgYDVQQpEwdFYXN5UlNBMRgwFgYJKoZIhvcN
+AQkBFglaSkBaSi5jb20wHhcNMTcwODIzMTQyNjQyWhcNMjcwODIxMTQyNjQyWjB+
+MQswCQYDVQQGEwJDTjELMAkGA1UECBMCWkoxCzAJBgNVBAcTAlpKMQswCQYDVQQK
+EwJaSjELMAkGA1UECxMCWkoxDzANBgNVBAMTBnNlcnZlcjEQMA4GA1UEKRMHRWFz
+eVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkouY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDgZy4zq09PoXjGMrrTHXFzNLpFQIiHdgP7h9hOTnx9lSJ9jnDc
+aBAn/n3weZOGg++pFniuhl7qQnQ4TTcNyTSmhF5krd2R3d8Cv1P4+8Cby72TfCar
+vQrGw13aXbPA/3KhLx4L9qZxd/kAOIquq8CGEasS3h6CE+jD1btvLr9uwQIDAQAB
+o4IBTDCCAUgwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwNAYJYIZIAYb4
+QgENBCcWJUVhc3ktUlNBIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYD
+VR0OBBYEFBwGRzNhDhWE1QhaQObJI++H8+75MIGwBgNVHSMEgagwgaWAFI3VBHkQ
+BU8bEmMRrADU/MwxALgJoYGBpH8wfTELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlpK
+MQswCQYDVQQHEwJaSjELMAkGA1UEChMCWkoxCzAJBgNVBAsTAlpKMQ4wDAYDVQQD
+EwVaSiBDQTEQMA4GA1UEKRMHRWFzeVJTQTEYMBYGCSqGSIb3DQEJARYJWkpAWkou
+Y29tggkArhih4T1STfAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWg
+MA0GCSqGSIb3DQEBCwUAA4GBAKq1DXqzCXrU5t9GDVQ54jTaT5uS1kHbELntZjR/
+nan6r2qAtB8T0zmmcpNaa+hPupX5gxBYs/4SP6noMQTgjthMwfd+/Hq6F9gudqt8
+F8qkHT3FvN8C5S6RxLJsQKHiPWQV2qaw5B1mEVTASQWRxGloLbzV9jJDPBjEl1RF
+Uig2
+-----END CERTIFICATE-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.key b/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.key
new file mode 100644
index 000000000..3aab5cd4b
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpn/server.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOBnLjOrT0+heMYy
+utMdcXM0ukVAiId2A/uH2E5OfH2VIn2OcNxoECf+ffB5k4aD76kWeK6GXupCdDhN
+Nw3JNKaEXmSt3ZHd3wK/U/j7wJvLvZN8Jqu9CsbDXdpds8D/cqEvHgv2pnF3+QA4
+iq6rwIYRqxLeHoIT6MPVu28uv27BAgMBAAECgYEAqno4g1BVxG0rT4cin1fy5E7e
+Y9YO4ropdGFTVsoRkWZG+ZPI8eisvXV9P79c8AgzfgVwUUYLvXQWzt76QCLnN11x
+pBURloJbEReEEzIF6z3LiT9CKgVWY4vtC6f5OW4Kd+EZxXMftFz8kMzRuRQLvOzR
+WeU+3GD42mIwYjsXBrECQQD2P6azeZJ1ZIEf+9Ys19tSQ6uxbXyvghlTfhmZfBW3
+bshNRH4+L4lnnbm75pFkWqR0gYSAD3toRymccctN2K9jAkEA6UoRwURTjIER8yZO
+6gLTFtzb841jv6TPErOY7CzNZ/TYBUdUBmM/NB4+RgBpBNFXB3uqweNVPO6mhyQP
+zB88iwJBAOeH6YGOqTpfiVk9PJ9lRf4PSnvE6htLQ+zQ/9jkZrbWHtcns1tc7uDR
+2DToEYQ+BarVrHOMGwhtAJ7sD6/eMOkCQFjn8XxGHdEeH0kbAFgOW4QLB4f6Clmu
+5XurFkxrhpxnoyvf0xXcHOov3GuxHFTJsvEXICxkBsgB61T1WU/hV6ECQGzk5Eqo
+uik2OAYMOb7NPGYMWS68DpmP11QDuvoj5zm2vdzohXHyBM7mO12MLSrTpxfgjWhQ
+pqwEbErchuKkzN4=
+-----END PRIVATE KEY-----
diff --git a/package/lean/luci-app-openvpn-server/root/etc/openvpncert.sh b/package/lean/luci-app-openvpn-server/root/etc/openvpncert.sh
new file mode 100755
index 000000000..61d6f0cb9
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/openvpncert.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+clean-all
+echo -en "\n\n\n\n\n\n\n\n" | build-ca
+build-dh
+build-key-server server
+build-key-pkcs12 client1
+cp /etc/easy-rsa/keys/ca.crt /etc/openvpn/
+cp /etc/easy-rsa/keys/server.crt /etc/openvpn/
+cp /etc/easy-rsa/keys/server.key /etc/openvpn/
+cp /etc/easy-rsa/keys/dh1024.pem /etc/openvpn/
+cp /etc/easy-rsa/keys/client1.crt /etc/openvpn/
+cp /etc/easy-rsa/keys/client1.key /etc/openvpn/
+/etc/init.d/openvpn restart
+echo "OpenVPN Cert renew successfully"
\ No newline at end of file
diff --git a/package/lean/luci-app-openvpn-server/root/etc/ovpnadd.conf b/package/lean/luci-app-openvpn-server/root/etc/ovpnadd.conf
new file mode 100644
index 000000000..0d03f345b
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/ovpnadd.conf
@@ -0,0 +1,9 @@
+http-proxy-option EXT1 "POST http://rd.go.10086.cn"
+http-proxy-option EXT1 "GET http://rd.go.10086.cn"
+http-proxy-option EXT1 "X-Online-Host: rd.go.10086.cn"
+http-proxy-option EXT1 "POST http://rd.go.10086.cn"
+http-proxy-option EXT1 "X-Online-Host: rd.go.10086.cn"
+http-proxy-option EXT1 "POST http://rd.go.10086.cn"
+http-proxy-option EXT1 "Host: rd.go.10086.cn"
+http-proxy-option EXT1 "GET http://rd.go.10086.cn"
+http-proxy-option EXT1 "Host: rd.go.10086.cn"
\ No newline at end of file
diff --git a/package/lean/luci-app-openvpn-server/root/etc/uci-defaults/openvpn b/package/lean/luci-app-openvpn-server/root/etc/uci-defaults/openvpn
new file mode 100755
index 000000000..849754dfd
--- /dev/null
+++ b/package/lean/luci-app-openvpn-server/root/etc/uci-defaults/openvpn
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+uci set network.vpn0="interface"
+uci set network.vpn0.ifname="tun0"
+uci set network.vpn0.proto="none"
+uci commit network;
+/etc/init.d/network reload
+
+uci delete firewall.openvpn
+uci add firewall rule
+uci rename firewall.@rule[-1]="openvpn"
+uci set firewall.@rule[-1].name="openvpn"
+uci set firewall.@rule[-1].target="ACCEPT"
+uci set firewall.@rule[-1].src="wan"
+uci set firewall.@rule[-1].proto="tcp"
+uci set firewall.@rule[-1].dest_port="1194"
+
+uci delete firewall.vpn
+uci delete firewall.vpnwan
+uci delete firewall.vpnlan
+uci commit firewall
+
+uci add firewall zone
+uci rename firewall.@zone[-1]="vpn"
+uci set firewall.@zone[-1].name="vpn"
+uci set firewall.@zone[-1].input="ACCEPT"
+uci set firewall.@zone[-1].forward="ACCEPT"
+uci set firewall.@zone[-1].output="ACCEPT"
+uci set firewall.@zone[-1].masq="1"
+uci set firewall.@zone[-1].network="vpn0"
+uci add firewall forwarding
+uci rename firewall.@forwarding[-1]="vpnwan"
+uci set firewall.@forwarding[-1].src="vpn"
+uci set firewall.@forwarding[-1].dest="wan"
+uci add firewall forwarding
+uci rename firewall.@forwarding[-1]="vpnlan"
+uci set firewall.@forwarding[-1].src="vpn"
+uci set firewall.@forwarding[-1].dest="lan"
+uci commit firewall;
+/etc/init.d/firewall restart
+
+/etc/init.d/openvpn disable && /etc/init.d/openvpn stop
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-pptp-server/Makefile b/package/lean/luci-app-pptp-server/Makefile
new file mode 100644
index 000000000..0c84f20a9
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/Makefile
@@ -0,0 +1,21 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for PPTP VPN Server
+LUCI_DEPENDS:=+pptpd +kmod-mppe +ppp
+LUCI_PKGARCH:=all
+PKG_NAME:=luci-app-pptp-server
+PKG_VERSION:=2.0
+PKG_RELEASE:=5
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
+
+
+
diff --git a/package/lean/luci-app-pptp-server/luasrc/controller/pptp-server.lua b/package/lean/luci-app-pptp-server/luasrc/controller/pptp-server.lua
new file mode 100644
index 000000000..4274acd4f
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/luasrc/controller/pptp-server.lua
@@ -0,0 +1,14 @@
+
+module("luci.controller.pptp-server", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/pptpd") then
+ return
+ end
+
+ entry({"admin", "vpn"}, firstchild(), "VPN", 45).dependent = false
+
+ local page
+
+ entry({"admin", "vpn", "pptp-server"}, cbi("pptp-server/pptp-server"), _("PPTP VPN Server"), 80).dependent=false
+end
diff --git a/package/lean/luci-app-pptp-server/luasrc/model/cbi/pptp-server/pptp-server.lua b/package/lean/luci-app-pptp-server/luasrc/model/cbi/pptp-server/pptp-server.lua
new file mode 100644
index 000000000..1bc851a18
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/luasrc/model/cbi/pptp-server/pptp-server.lua
@@ -0,0 +1,137 @@
+
+--require("luci.tools.webadmin")
+
+mp = Map("pptpd", "PPTP Server","")
+
+s = mp:section(NamedSection, "pptpd", "service", translate("PPTP Service"))
+s.anonymouse = true
+--s.addremove = true
+
+enabled = s:option(Flag, "enabled", translate("Enable"))
+enabled.default = 0
+enabled.rmempty = false
+
+localip = s:option(Value, "localip", translate("Local IP"))
+localip.datatype = "ip4addr"
+
+clientip = s:option(Value, "remoteip", translate("Client IP"))
+clientip.datatype = "string"
+clientip.description = translate("LAN DHCP reserved start-to-end IP addresses with the same subnet mask")
+
+remotedns = s:option(Value, "remotedns", translate("Remote Client DNS"))
+remotedns.datatype = "ip4addr"
+
+logging = s:option(Flag, "logwtmp", translate("Debug Logging"))
+logging.default = 0
+logging.rmempty = false
+
+logins = mp:section(NamedSection, "login", "login", translate("PPTP Logins"))
+logins.anonymouse = true
+
+username = logins:option(Value, "username", translate("User name"))
+username.datatype = "string"
+
+password = logins:option(Value, "password", translate("Password"))
+password.password = true
+
+function mp.on_save(self)
+ require "luci.model.uci"
+ require "luci.sys"
+
+ local have_pptp_rule = false
+ local have_gre_rule = false
+
+ luci.model.uci.cursor():foreach('firewall', 'rule',
+ function (section)
+ if section.name == 'pptp' then
+ have_pptp_rule = true
+ end
+ if section.name == 'gre' then
+ have_gre_rule = true
+ end
+ end
+ )
+
+ if not have_pptp_rule then
+ local cursor = luci.model.uci.cursor()
+ local pptp_rulename = cursor:add('firewall','rule')
+ cursor:tset('firewall', pptp_rulename, {
+ ['name'] = 'pptp',
+ ['target'] = 'ACCEPT',
+ ['src'] = 'wan',
+ ['proto'] = 'tcp',
+ ['dest_port'] = 1723
+ })
+ cursor:save('firewall')
+ cursor:commit('firewall')
+ end
+ if not have_gre_rule then
+ local cursor = luci.model.uci.cursor()
+ local gre_rulename = cursor:add('firewall','rule')
+ cursor:tset('firewall', gre_rulename, {
+ ['name'] = 'gre',
+ ['target'] = 'ACCEPT',
+ ['src'] = 'wan',
+ ['proto'] = 47
+ })
+ cursor:save('firewall')
+ cursor:commit('firewall')
+ end
+
+
+end
+
+
+local pid = luci.util.exec("/usr/bin/pgrep pptpd")
+
+function pptpd_process_status()
+ local status = "PPTPD is not running now "
+
+ if pid ~= "" then
+ status = "PPTPD is running with the PID " .. pid .. ""
+ end
+
+ local status = { status=status }
+ local table = { pid=status }
+ return table
+end
+
+t = mp:section(Table, pptpd_process_status())
+t.anonymous = true
+
+t:option(DummyValue, "status", translate("PPTPD status"))
+
+if pid == "" then
+ start = t:option(Button, "_start", translate("Start"))
+ start.inputstyle = "apply"
+ function start.write(self, section)
+ luci.util.exec("uci set pptpd.pptpd.enabled='1' && uci commit pptpd")
+ message = luci.util.exec("/etc/init.d/pptpd start 2>&1")
+ luci.util.exec("sleep 2")
+ luci.http.redirect(
+ luci.dispatcher.build_url("admin", "vpn", "pptp-server") .. "?message=" .. message
+ )
+ end
+else
+ stop = t:option(Button, "_stop", translate("Stop"))
+ stop.inputstyle = "reset"
+ function stop.write(self, section)
+ luci.util.exec("uci set pptpd.pptpd.enabled='0' && uci commit pptpd")
+ luci.util.exec("/etc/init.d/pptpd stop")
+ luci.util.exec("sleep 2")
+ luci.http.redirect(
+ luci.dispatcher.build_url("admin", "vpn", "pptp-server")
+ )
+ end
+end
+
+function mp.on_before_commit (self)
+ os.execute("rm /var/etc/chap-secrets")
+end
+
+function mp.on_after_commit(self)
+ os.execute("/etc/init.d/pptpd restart >/dev/null 2>&1 &")
+end
+
+
+return mp
diff --git a/package/lean/luci-app-pptp-server/po/zh-cn/pptpd.po b/package/lean/luci-app-pptp-server/po/zh-cn/pptpd.po
new file mode 100644
index 000000000..f02496b5b
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/po/zh-cn/pptpd.po
@@ -0,0 +1,42 @@
+msgid "PPTP VPN Server"
+msgstr "PPTP VPN 鏈嶅姟鍣"
+
+msgid "PPTP Service"
+msgstr "PPTP 鏈嶅姟璁剧疆"
+
+msgid "Local IP"
+msgstr "PPTP 鏈嶅姟鍣↖P"
+
+msgid "Client IP"
+msgstr "瀹㈡埛绔垎閰嶇殑IP鑼冨洿"
+
+msgid "LAN DHCP reserved start-to-end IP addresses with the same subnet mask"
+msgstr "浣跨敤鍜 LAN 鍚屼竴缃戞銆傝浣跨敤 DHCP鍒嗛厤鍦板潃浠ュ鐨勭┖浣橧P鍦板潃鑼冨洿锛屼緥濡 192.168.0.20-30"
+
+msgid "Remote Client DNS"
+msgstr "瀹㈡埛绔垎閰岻P鐨凞NS鏈嶅姟鍣"
+
+msgid "Debug Logging"
+msgstr "璁板綍鏃ュ織"
+
+msgid "PPTP Logins"
+msgstr "PPTP 鐧诲綍璁剧疆"
+
+msgid "User name"
+msgstr "鐢ㄦ埛鍚"
+
+msgid "Password"
+msgstr "瀵嗙爜"
+
+msgid "Enable"
+msgstr "鍚敤"
+
+msgid "PPTPD status"
+msgstr "PPTPD 鏈嶅姟鐘舵"
+
+msgid "Start"
+msgstr "鍚姩"
+
+msgid "Stop"
+msgstr "鍏抽棴"
+
diff --git a/package/lean/luci-app-pptp-server/root/etc/config/pptpd b/package/lean/luci-app-pptp-server/root/etc/config/pptpd
new file mode 100644
index 000000000..c55cfa60c
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/root/etc/config/pptpd
@@ -0,0 +1,12 @@
+
+config service 'pptpd'
+ option enabled '0'
+ option remoteip '192.168.0.20-30'
+ option remotedns '192.168.0.1'
+ option logwtmp '0'
+ option localip '192.168.0.1'
+
+config login 'login'
+ option username 'lean'
+ option password 'I234567B'
+
diff --git a/package/lean/luci-app-pptp-server/root/etc/pptpd.include b/package/lean/luci-app-pptp-server/root/etc/pptpd.include
new file mode 100755
index 000000000..e14a2010b
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/root/etc/pptpd.include
@@ -0,0 +1 @@
+iptables -A FORWARD -i ppp+ -j ACCEPT
diff --git a/package/lean/luci-app-pptp-server/root/etc/uci-defaults/pptpd b/package/lean/luci-app-pptp-server/root/etc/uci-defaults/pptpd
new file mode 100755
index 000000000..eaaae9c15
--- /dev/null
+++ b/package/lean/luci-app-pptp-server/root/etc/uci-defaults/pptpd
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete firewall.pptpd
+ set firewall.pptpd=include
+ set firewall.pptpd.type=script
+ set firewall.pptpd.path=/etc/pptpd.include
+ set firewall.pptpd.reload=1
+ commit firewall
+EOF
+
+/etc/init.d/pptpd enable && /etc/init.d/pptpd restart
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-sfe/Makefile b/package/lean/luci-app-sfe/Makefile
new file mode 100644
index 000000000..9d30c703f
--- /dev/null
+++ b/package/lean/luci-app-sfe/Makefile
@@ -0,0 +1,17 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for SFE
+LUCI_DEPENDS:=+kmod-fast-classifier
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.0
+PKG_RELEASE:=2
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
diff --git a/package/lean/luci-app-sfe/luasrc/controller/sfe.lua b/package/lean/luci-app-sfe/luasrc/controller/sfe.lua
new file mode 100644
index 000000000..b21a71d26
--- /dev/null
+++ b/package/lean/luci-app-sfe/luasrc/controller/sfe.lua
@@ -0,0 +1,11 @@
+module("luci.controller.sfe", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/sfe") then
+ return
+ end
+ local page
+ page = entry({"admin", "network", "sfe"}, cbi("sfe"), _("SFE Acceleration"), 100)
+ page.i18n = "sfe"
+ page.dependent = true
+end
diff --git a/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua b/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua
new file mode 100644
index 000000000..0f2368870
--- /dev/null
+++ b/package/lean/luci-app-sfe/luasrc/model/cbi/sfe.lua
@@ -0,0 +1,38 @@
+local m,s,o
+local SYS = require "luci.sys"
+
+
+if SYS.call("lsmod | grep fast_classifier >/dev/null") == 0 then
+ Status = translate("Shortcut Forwarding Engine is Running Shortcut Forwarding Engine is Not Running Shortcut Forwarding Engine is Running SFE 杞彂鍔犻熷紩鎿庢鍦ㄨ繍琛 Shortcut Forwarding Engine is Not Running SFE 杞彂鍔犻熷紩鎿庢湭杩愯 ShadowsocksR is Running ShadowsocksR is Not Running %s Client Proxy Mode Settings "),
+translate("Proxy mode settings can be set to specific LAN clients ( No Proxy, Global Proxy, Game Mode ) . Does not need to be set by default."))
+t.template="cbi/tblsection"
+t.sortable=true
+t.anonymous=true
+t.addremove=true
+e=t:option(Value,"ipaddr",translate("IP Address"))
+e.width="40%"
+e.datatype="ip4addr"
+e.placeholder="0.0.0.0/0"
+luci.ip.neighbors({ family = 4 }, function(entry)
+ if entry.reachable then
+ e:value(entry.dest:string())
+ end
+end)
+
+e=t:option(ListValue,"filter_mode",translate("Proxy Mode"))
+e.width="40%"
+e.default="disable"
+e.rmempty=false
+e:value("disable",translate("No Proxy"))
+e:value("global",translate("Global Proxy"))
+e:value("game",translate("Game Mode"))
+
+-- ---------------------------------------------------
+local apply = luci.http.formvalue("cbi.apply")
+if apply then
+ os.execute("/etc/init.d/ssrpro restart >/dev/null 2>&1 &")
+end
+
+return m
diff --git a/package/lean/luci-app-shadowsocksr-pro/po/zh-cn/ssrpro.po b/package/lean/luci-app-shadowsocksr-pro/po/zh-cn/ssrpro.po
new file mode 100644
index 000000000..3127e2fbe
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/po/zh-cn/ssrpro.po
@@ -0,0 +1,102 @@
+msgid "ShadowsocksR is Running ShadowsocksR 姝ｅ湪杩愯 ShadowsocksR is Not Running ShadowsocksR 娌℃湁杩愯 Client Proxy Mode Settings "
+msgstr "瀹㈡埛绔唬鐞嗘ā寮忚缃 "
+
+msgid "Proxy mode settings can be set to specific LAN clients ( No Proxy, Global Proxy, Game Mode ) . Does not need to be set by default."
+msgstr "鍙互涓哄眬鍩熺綉瀹㈡埛绔垎鍒缃笉鍚岀殑浠ｇ悊妯″紡 ( 涓嶄唬鐞, 鍏ㄥ眬浠ｇ悊, 娓告垙妯″紡 ).榛樿鏃犻渶璁剧疆"
+
+msgid "GFW-List Add-in IP"
+msgstr "GFW-List闄勫姞IP"
+
+msgid " /var/etc/dnsmasq-go.d/01-pollution.conf
+ else
+ awk -vs="$vt_safe_dns#$vt_safe_dns_port" '!/^$/&&!/^#/{printf("server=/%s/%s\n",$0,s)}' \
+ /etc/gfwlist/$vt_gfwlist > /var/etc/dnsmasq-go.d/01-pollution.conf
+ fi
+ else
+ echo "WARNING: Not using secure DNS, DNS resolution might be polluted if you are in China."
+ fi
+
+ ###### dnsmasq-to-ipset configuration ######
+ case "$vt_proxy_mode" in
+ M|V)
+ awk '!/^$/&&!/^#/{printf("ipset=/%s/'"$vt_gfwlist"'\n",$0)}' \
+ /etc/gfwlist/$vt_gfwlist > /var/etc/dnsmasq-go.d/02-ipset.conf
+ ;;
+ esac
+
+ # -----------------------------------------------------------------
+ ###### Restart main 'dnsmasq' service if needed ######
+ if ls /var/etc/dnsmasq-go.d/* >/dev/null 2>&1; then
+ mkdir -p /tmp/dnsmasq.d
+ cat > /tmp/dnsmasq.d/dnsmasq-go.conf </dev/null
+ del_cron
+}
+
+restart()
+{
+ KEEP_GFWLIST=Y
+ stop
+ start
+}
+
+reload()
+{
+ local vt_enabled=`uci get shadowsocksr.@shadowsocksr[0].enabled 2>/dev/null`
+ local vt_server_addr=`uci get shadowsocksr.@shadowsocksr[0].server`
+ local vt_server_port=`uci get shadowsocksr.@shadowsocksr[0].server_port`
+ local vt_safe_dns=`uci get shadowsocksr.@shadowsocksr[0].safe_dns 2>/dev/null`
+ local vt_safe_dns_port=`uci get shadowsocksr.@shadowsocksr[0].safe_dns_port 2>/dev/null`
+ local vt_safe_dns_tcp=`uci get shadowsocksr.@shadowsocksr[0].safe_dns_tcp 2>/dev/null`
+ local vt_proxy_mode=`uci get shadowsocksr.@shadowsocksr[0].proxy_mode`
+ local vt_gfwlist=`__gfwlist_by_mode $vt_proxy_mode`
+ KEEP_GFWLIST=Y
+ del_rule
+ add_rule
+ if [ "$vt_safe_dns_tcp" = 1 ]; then
+ stop_pdnsd
+ start_pdnsd
+ fi
+}
+
+# $1: upstream DNS server
+start_pdnsd()
+{
+ local safe_dns="$1"
+
+ local tcp_dns_list="208.67.222.222, 208.67.220.220"
+ [ -n "$safe_dns" ] && tcp_dns_list="$safe_dns,$tcp_dns_list"
+
+ #killall -9 pdnsd 2>/dev/null && sleep 1
+ kill -9 $(cat /var/run/pdnsd.pid) >/dev/null 2>&1 && mkdir -p /var/etc /var/pdnsd
+ cat > /var/etc/pdnsd.conf </dev/null; then
+ while iptables -t nat -D OUTPUT -p tcp --dport 53 -j pdnsd_output 2>/dev/null; do :; done
+ iptables -t nat -X pdnsd_output
+ fi
+ killall -9 pdnsd 2>/dev/null
+ rm -rf /var/pdnsd
+ rm -f /var/etc/pdnsd.conf
+}
+
+add_cron()
+{
+ sed -i '/up-gfwlist.sh/d' $CRON_FILE
+ sed -i '/shadowsocksr_watchdog.log/d' $CRON_FILE
+ if [ $cron_mode -eq 1 ]; then
+ echo '0 5 * * * /etc/shadowsocksr/up-gfwlist.sh > /tmp/gfwupdate.log 2>&1' >> $CRON_FILE
+ fi
+ echo '0 */1 * * * /etc/shadowsocksr/ssr-watchdog >> /tmp/shadowsocksr_watchdog.log 2>&1' >> $CRON_FILE
+ echo '0 1 * * 0 echo "" > /tmp/shadowsocksr_watchdog.log' >> $CRON_FILE
+ crontab $CRON_FILE
+}
+
+del_cron()
+{
+ sed -i '/up-gfwlist.sh/d' $CRON_FILE
+ sed -i '/shadowsocksr_watchdog.log/d' $CRON_FILE
+ /etc/init.d/cron restart
+}
+
+
+
+uci_get_by_name() {
+ local ret=$(uci get $CONFIG.$1.$2 2>/dev/null)
+ echo ${ret:=$3}
+}
+
+uci_get_by_type() {
+ local index=0
+ if [ -n $4 ]; then
+ index=$4
+ fi
+ local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+ echo ${ret:=$3}
+}
+
+add_rule()
+{
+ iptables -t nat -N shadowsocksr_pre
+ iptables -t nat -F shadowsocksr_pre
+ iptables -t nat -A shadowsocksr_pre -m set --match-set local dst -j RETURN || {
+ iptables -t nat -A shadowsocksr_pre -d 10.0.0.0/8 -j RETURN
+ iptables -t nat -A shadowsocksr_pre -d 127.0.0.0/8 -j RETURN
+ iptables -t nat -A shadowsocksr_pre -d 172.16.0.0/12 -j RETURN
+ iptables -t nat -A shadowsocksr_pre -d 192.168.0.0/16 -j RETURN
+ iptables -t nat -A shadowsocksr_pre -d 127.0.0.0/8 -j RETURN
+ iptables -t nat -A shadowsocksr_pre -d 224.0.0.0/3 -j RETURN
+ }
+ iptables -t nat -A shadowsocksr_pre -d $vt_server_addr -j RETURN
+
+ iptables -N gameboost -t mangle
+ ipset -! create gameuser hash:ip maxelem 65536 2>/dev/null
+ /usr/bin/ip rule add fwmark 0x01/0x01 table 100
+ /usr/bin/ip route add local 0.0.0.0/0 dev lo table 100
+ iptables -t mangle -A gameboost -p udp -m set --match-set local dst -j RETURN
+ iptables -t mangle -A gameboost -p udp -m set --match-set china dst -j RETURN
+ iptables -t mangle -A gameboost -p udp --dport 53 -j RETURN
+ iptables -t mangle -A gameboost -p udp -j TPROXY --on-port 7070 --tproxy-mark 0x01/0x01
+ iptables -t mangle -A PREROUTING -m set --match-set gameuser src -j gameboost
+
+ for i in $(seq 0 100)
+ do
+ local ip=$(uci_get_by_type acl_rule ipaddr '' $i)
+ local mode=$(uci_get_by_type acl_rule filter_mode '' $i)
+ case "$mode" in
+ disable)
+ iptables -t nat -A shadowsocksr_pre -s $ip -j RETURN
+ ;;
+ global)
+ iptables -t nat -A shadowsocksr_pre -s $ip -p tcp -j REDIRECT --to $SS_REDIR_PORT
+ iptables -t nat -A shadowsocksr_pre -s $ip -j RETURN
+ ;;
+ game)
+ iptables -t nat -A shadowsocksr_pre -p tcp -s $ip -m set ! --match-set china dst -j REDIRECT --to $SS_REDIR_PORT
+ ipset -! add gameuser $ip
+ ;;
+ esac
+ done
+
+ case "$vt_proxy_mode" in
+ G) : ;;
+ S)
+ iptables -t nat -A shadowsocksr_pre -m set --match-set $vt_np_ipset dst -j RETURN
+ ;;
+ M)
+ ipset -! create $vt_gfwlist hash:ip maxelem 65536 2>/dev/null
+ awk '!/^$/&&!/^#/{printf("add vt_gfwlist %s'" "'\n",$0)}' /etc/shadowsocksr/addinip.txt > /tmp/addinip.ipset
+ sed -i "s/vt_gfwlist/$vt_gfwlist/g" /tmp/addinip.ipset
+ ipset -! restore < /tmp/addinip.ipset
+ iptables -t nat -A shadowsocksr_pre -m set ! --match-set $vt_gfwlist dst -j RETURN
+ iptables -t nat -A shadowsocksr_pre -m set --match-set $vt_np_ipset dst -j RETURN
+ ;;
+ V)
+ vt_np_ipset=""
+ ipset -! create $vt_gfwlist hash:ip maxelem 65536 2>/dev/null
+ iptables -t nat -A shadowsocksr_pre -m set ! --match-set $vt_gfwlist dst -j RETURN
+ ;;
+ esac
+ local subnet
+ for subnet in $covered_subnets; do
+ iptables -t nat -A shadowsocksr_pre -s $subnet -p tcp -j REDIRECT --to $SS_REDIR_PORT
+ done
+ iptables -t nat -I PREROUTING -p tcp -j shadowsocksr_pre
+}
+
+del_rule()
+{
+ if iptables -t nat -F shadowsocksr_pre 2>/dev/null; then
+ while iptables -t nat -D PREROUTING -p tcp -j shadowsocksr_pre 2>/dev/null; do :; done
+ iptables -t nat -X shadowsocksr_pre 2>/dev/null
+ fi
+
+ /usr/bin/ip rule del fwmark 0x01/0x01 table 100
+ /usr/bin/ip route del local 0.0.0.0/0 dev lo table 100
+ if iptables -t mangle -F gameboost 2>/dev/null; then
+ while iptables -t mangle -D PREROUTING -m set --match-set gameuser src -j gameboost 2>/dev/null; do :; done
+ iptables -t mangle -X gameboost 2>/dev/null
+ fi
+
+ ipset destroy gameuser 2>/dev/null
+
+
+ # -----------------------------------------------------------------
+ [ "$KEEP_GFWLIST" = Y ] || ipset destroy "$vt_gfwlist" 2>/dev/null
+}
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr.include b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr.include
new file mode 100755
index 000000000..1e270c09c
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr.include
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+ssr_enable=$(uci get shadowsocksr.@shadowsocksr[0].enabled 2>/dev/null)
+
+if [ $ssr_enable -eq 1 ]; then
+ if pidof ssr-redir>/dev/null; then
+ /etc/init.d/ssrpro reload
+ else
+ /etc/init.d/ssrpro restart
+ fi
+fi
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/addinip.txt b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/addinip.txt
new file mode 100644
index 000000000..64e2f9bb8
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/addinip.txt
@@ -0,0 +1,7 @@
+149.154.160.0/20
+149.154.164.0/22
+149.154.168.0/21
+67.198.55.0/24
+91.108.4.0/22
+91.108.56.0/22
+109.239.140.0/24
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/base-gfwlist.txt b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/base-gfwlist.txt
new file mode 100644
index 000000000..75277f6c0
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/base-gfwlist.txt
@@ -0,0 +1,2941 @@
+0rz.tw
+0to255.com
+10musume.com
+123rf.com
+12bet.com
+12vpn.com
+141hongkong.com
+173ng.com
+1984bbs.com
+1984bbs.org
+1-apple.com.tw
+1bao.org
+1eew.com
+1pondo.tv
+2000fun.com
+2008xianzhang.info
+21andy.com
+247realmedia.com
+24smile.org
+2-hand.info
+2mdn.net
+2shared.com
+301works.org
+315lz.com
+32red.com
+365singles.com.ar
+36rain.com
+4bluestones.biz
+4chan.org
+4pppc.gov.tw
+4shared.com
+4sq.com
+51.ca
+5i01.com
+5maodang.com
+64tianwang.com
+64wiki.com
+666kb.com
+6park.com
+7capture.com
+881903.com
+888.com
+89-64.org
+9001700.com
+91porn.com
+921.gov.tw
+92ccav.com
+9bis.com
+9bis.net
+9city.me
+a5.com.ru
+abc.pp.ru
+abitno.linpie.com
+ablwang.com
+aboluowang.com
+aboutgfw.com
+acgkj.com
+ac.jiruan.net
+ac.playstation.net
+actimes.com.au
+aculo.us
+ad1.nownews.com
+addictedtocoffee.de
+ads.backchina.com
+adultfriendfinder.com
+adultkeep.net
+advanscene.com
+advertfan.com
+aec.gov.tw
+aenhancers.com
+af.mil
+aftygh.gov.tw
+aide.gov.tw
+aiph.net
+aisex.com
+ait.org.tw
+aiweiweiblog.com
+aiweiwei.com
+ajaxplorer.info
+akamaihd.net
+akiba-online.com
+alabout.com
+alasbarricadas.org
+alexlur.org
+aliengu.com
+aliyun.com
+alkasir.com
+allaboutalpha.com
+allgirlsallowed.org
+alliance.org.hk
+allinfa.com
+allinfo.com
+allmovie.com
+allonlinux.free.fr
+all-that-is-interesting.com
+al-qimmah.net
+alternate-tools.com
+altrec.com
+alvinalexander.com
+alwaysdata.com
+alwaysdata.net
+am730.com.hk
+amazonaws.com
+ameblo.jp
+americangreencard.com
+amiblockedornot.com
+amnesty.org
+amnestyusa.org
+amoiist.com
+amzs.me
+analyze-v.com
+anchorfree.com
+andfaraway.net
+android.com
+angularjs.org
+animecrazy.net
+anobii.com
+anontext.com
+anonymizer.com
+a-normal-day.com
+answering-islam.org
+anthonycalzadilla.com
+anti.anti.cnn.googlepages.com
+antidrm.hpg.ig.com.br
+antiwave.net
+aobo.com.au
+aolchannels.aol.com
+aomiwang.com
+apetube.com
+apiary.io
+apidocs.linksalpha.com
+apigee.com
+api.linksalpha.com
+api.proxlet.com
+api.supertweet.net
+app.heywire.com
+app.hkatvnews.com
+appledaily.com
+appledaily.com.tw
+apps.hloli.net
+appspot.com
+archive.is
+archive.org
+arctosia.com
+areca-backup.org
+army.mil
+arte.gov.tw
+art-or-porn.com
+artsy.net
+asahichinese.com
+asdfg.jp
+asiafriendfinder.com
+asiaharvest.org
+asianews.it
+asianwomensfilm.de
+askstudent.com
+askynz.net
+assembla.com
+astonmartinnews.com
+atchinese.com
+atc.org.au
+atgfw.org
+atj.org.tw
+atlaspost.com
+atnext.com
+autoproxy.org
+avaaz.org
+avdb.in
+avidemux.org
+avoision.com
+awardwinningfjords.com
+axureformac.com
+babynet.com.hk
+backchina.com
+backpackers.com.tw
+badassjs.com
+badoo.com
+baidu.jp
+baixing.me
+bannedbook.org
+barnabu.co.uk
+basetimesheightdividedby2.com
+bayvoice.net
+bbcchinese.com
+bbc.com
+bbc.co.uk
+bbci.co.uk
+bbcimg.co.uk
+bbc.in
+bbg.gov
+bbs2.newsgroup.la
+bbs.ecstart.com
+bbsfeed.com
+bbs.kimy.com.tw
+bbsland.com
+bbs.morbell.com
+bbs.mychat.to
+bbs.newsgroup.la
+bbs.ozchinese.com
+bbs.qmzdd.com
+bbs.sina.com
+bbs.skykiwi.com
+bbs.tuitui.info
+bb.ttv.com.tw
+bcc.com.tw
+bcchinese.net
+bdhr.gov.tw
+bd.zhe.la
+bebo.com
+beeg.com
+beijing1989.com
+beijingspring.com
+benjaminste.in
+berlintwitterwall.com
+bestforchina.org
+bestvpnservice.com
+bet365.com
+beta.iset.com.tw
+beta.usejump.com
+betfair.com
+bettween.com
+betvictor.com
+bewww.net
+beyondfirewall.com
+bfnn.org
+biantailajiao.com
+biantailajiao.in
+bigfools.com
+bignews.org
+bigsound.org
+bill2-software.com
+billywr.com
+bill.zhong.pp.ru
+bipic.net
+bitcointalk.org
+bit.ly
+bitly.com
+bitshare.com
+bjzc.org
+blinkx.com
+blinw.com
+blip.tv
+blockcn.com
+blog.birdhouseapp.com
+blog.bitly.com
+blogblog.com
+blog.boxcar.io
+blogcatalog.com
+blog.davidziegler.net
+blog.dayoneapp.com
+blog.de
+blog.dribbble.com
+blog.exblog.co.jp
+blog.expofutures.com
+blog.fizzik.com
+blog.foolsmountain.com
+blogger.com
+blog.gowalla.com
+blog.hotpotato.com
+blog.ifttt.com
+blogimg.jp
+blog.instagram.com
+blog.instapaper.com
+blog.iphone-dev.org
+blog.istef.info
+blog.jackjia.com
+blog.joeyrobert.org
+blog.kangye.org
+blog.kickstarter.com
+blog.kl.am
+blog.klip.me
+blog.lester850.info
+blog.lightbox.com
+bloglines.com
+bloglovin.com
+blog.mongodb.org
+blog.openinkpot.org
+blog.palm.com
+blog.path.com
+blog.pathtosharepoint.com
+blog.pchome.com.tw
+blog.pentalogic.net
+blog.pikchur.com
+blog.pilotmoon.com
+blog.redren.com
+blog.rockmelt.com
+blog.romanandreg.com
+blog.s135.com
+blogs.icerocket.com
+blog.sina.com.tw
+blog.sogoo.org
+blog.sparrowmailapp.com
+blogspot.com
+blogspot.co.uk
+blogspot.de
+blogspot.fr
+blogspot.in
+blogspot.jp
+blogs.tampabay.com
+blog.summify.com
+blogs.yahoo.co.jp
+blog.syx86.cn
+blog.syx86.com
+blog.taragana.com
+blogtd.net
+blogtd.org
+blog.tiney.com
+blog.topify.com
+blog.usa.gov
+blog.xuite.net
+blog.youthwant.com.tw
+blog.youxu.info
+bloodshed.net
+bloomberg.cn
+bloomberg.com
+bloomberg.de
+bloomfortune.com
+bmediaasia.com
+bnrmetal.com
+boardreader.com
+bobulate.com
+bolin.netfirms.com
+bonbonme.com
+bonjourlesgeeks.com
+boobstagram.com
+books.com.tw
+bookshelfporn.com
+botanwang.com
+bot.nu
+bowenpress.com
+boxunblog.com
+boxunclub.com
+boxun.com
+boxun.tv
+bralio.com
+branch.com
+brandonhutchinson.com
+braumeister.org
+break.com
+breakingtweets.com
+briefdream.com
+brightcove.com
+brightkite.com
+brizzly.com
+broadbook.com
+br.st
+brucewang.net
+bt95.com
+btdigg.org
+btrd.net
+budaedu.org
+bugclub.org
+builtwithbootstrap.com
+bullogger.com
+bullog.org
+businesstimes.com.cn
+businessweek.com
+buugaa.com
+buy.yahoo.com.tw
+buzzurl.jp
+bwbx.io
+bwsj.hk
+bx.tl
+c1522.mooo.com
+cacnw.com
+cactusvpn.com
+cafepress.com
+cahr.org.tw
+calameo.com
+calebelston.com
+cams.com
+cams.org.sg
+canadameet.com
+canyu.org
+caobian.info
+caochangqing.com
+cao.im
+cari.com.my
+catch22.net
+catfightpayperview.xxx
+catholic.org.hk
+catholic.org.tw
+cbs.ntu.edu.tw
+cc9007.spaces.live.com
+ccavtop10.com
+ccdtr.org
+ccim.org
+cclife.org
+ccthere.com
+cctongbao.com
+ccue.ca
+ccue.com
+cdig.info
+cdjp.org
+cdnews.com.tw
+cdn.printfriendly.com
+cdp1998.org
+cdp2006.org
+cdp.sinica.edu.tw
+cdpusa.org
+cdpweb.org
+cdpwu.org
+cdw.com
+cecc.gov
+cellulo.info
+cenci.tk
+cenews.eu
+centralnation.com
+centurys.net
+c-est-simple.com
+cfhks.org.hk
+cftfc.com
+cgdepot.org
+chandoo.org
+change.org
+changp.com
+chaos.e-spacy.com
+chapm25.com
+chartbeat.net
+chaturbate.com
+chccc.gov.tw
+chengmingmag.com
+chenguangcheng.com
+chenpokong.com
+chenyehao.spaces.live.com
+cherrysave.com
+chevronwp7.com
+chicagoncmtv.com
+china101.com
+china21.com
+china21.org
+china5000.us
+chinaaffairs.org
+chinaaid.me
+chinaaid.net
+chinaaid.org
+chinaaid.us
+chinachange.org
+chinachannel.hk
+chinacomments.org
+chinadigitaltimes.net
+chinaeweekly.com
+chinafreepress.org
+chinagate.com
+chinageeks.org
+chinagfw.org
+chinagreenparty.org
+china-green-party.spaces.live.com
+chinahush.com
+chinainperspective.com
+chinainperspective.net
+chinainperspective.org
+chinainterimgov.org
+chinalawandpolicy.com
+chinalawtranslate.com
+chinamule.com
+chinamz.org
+chinarightsia.org
+chinasocialdemocraticparty.com
+chinaso.com
+chinasoul.org
+chinatimes.com
+chinatweeps.com
+chinaway.org
+china-week.com
+chinaworker.info
+chinaxchina.com
+chinayouth.org.hk
+chinayuanmin.org
+chinesedailynews.com
+chinese.engadget.com
+chinese-hermit.net
+chinese-memorial.org
+chinesen.de
+chinesenewsnet.com
+chinesepen.org
+chinese.rnw.nl
+chinese.soifind.com
+chinesetalks.net
+chinese.wsj.com
+chingcheong.com
+chn.chosun.com
+chrispederick.com
+chrispederick.net
+christianstudy.com
+christiantimes.org.hk
+christusrex.org
+chrlawyers.hk
+chrlcg-hk.org
+chromeadblock.com
+chrome.com
+ch.shvoong.com
+chubun.com
+chuizi.net
+chukuang.gov.tw
+circlethebayfortibet.org
+citizenlab.org
+citizensradio.org
+city9x.com
+civicparty.hk
+civilhrfront.org
+civilmedia.tw
+cjb.net
+ck101.com
+classicalguitarblog.net
+clb.org.hk
+cl.d0z.net
+clientsfromhell.net
+clipfish.de
+cl.ly
+cloudfront.net
+club.backchina.com
+cms.gov
+cmule.com
+cn2.streetvoice.com
+cna.com.tw
+cnavista.com.tw
+cn.calameo.com
+cn.dayabook.com
+cnd.org
+cn.fmnnow.com
+cn.ibtimes.com
+cnn.com
+cn.news.cnyes.com
+cn.streetvoice.com
+cn.uncyclopedia.wikia.com
+cn.voa.mobi
+cochina.org
+cocoapods.org
+cocoa.zonble.net
+code1984.com
+codeboxapp.com
+codeshare.io
+collateralmurder.com
+collateralmurder.org
+comefromchina.com
+comnews.gio.gov.tw
+compileheart.com
+connectedchina.reuters.com
+connect.facebook.net
+conoyo.com
+contactmagazine.net
+contests.twilio.com
+conviva.com
+cookingtothegoodlife.com
+coolaler.com
+coolder.com
+coolloud.org.tw
+corpus4u.org
+corumcollege.com
+cotweet.com
+couchdbwiki.com
+coveringweb.com
+cp-house.gov.tw
+cpj.org
+crackle.com
+crd-net.org
+creaders.net
+cromotc.nat.gov.tw
+crossthewall.net
+csdparty.com
+c-spanvideo.org
+css.pixnet.in
+csuchen.de
+cts.com.tw
+cubicle17.com
+cuhkacs.org
+cuihua.org
+cuiweiping.net
+culture.tw
+curvefish.com
+cwb.gov.tw
+cyanogenmod.org
+cyberghost.natado.com
+cyberghostvpn.com
+cycab.gov.tw
+cydia.ifuckgfw.com
+cynscribe.com
+cytode.us
+dabr.co.uk
+dabr.me
+dabr.mobi
+dadazim.com
+dadi360.com
+dafagood.com
+dafahao.com
+dailidaili.com
+dailymotion.com
+dailynews.sina.com
+dajiyuan.com
+dajiyuan.eu
+dajusha.baywords.com
+dalailama.com
+dalailama.ru
+dalailamaworld.com
+dalianmeng.org
+danke4china.net
+danwei.org
+daolan.net
+dapu-house.gov.tw
+darpa.mil
+date.fm
+davidslog.com
+daxa.cn
+dayaarmongol.ning.com
+daylife.com
+ddc.com.tw
+deck.ly
+default.secureserver.net
+delcamp.net
+delicious.com
+democrats.org
+demo.opera-mini.net
+derekhsu.homeip.net
+de-sci.org
+designerol.com
+destiny.xfiles.to
+deutsche-welle.de
+dev102.com
+developers.box.net
+deviantart.com
+deviantart.net
+devio.us
+devpn.com
+dfas.mil
+df.gov.tw
+diaoyuislands.org
+digitalnomadsproject.org
+diigo.com
+dimitrik.free.fr
+dipity.com
+directcreative.com
+discuss.com.hk
+disp.cc
+dit-inc.us
+dizhidizhi.com
+djangosnippets.org
+dl.box.net
+dl-laby.jp
+dl.playstation.net
+dlsite.com
+dmcdn.net
+dmtip.gov.tw
+dns2go.com
+dnscrypt.org
+docstoc.com
+dojin.com
+dok-forum.net
+dolc.de
+dollf.com
+domain.club.tw
+domainhelp.search.com
+dongde.com
+dongtaiwang.com
+dongtaiwang.net
+dongyangjing.com
+dontfilter.us
+dontmovetochina.com
+dotheyfolloweachother.com
+dotplane.com
+dotsub.com
+doubleaf.com
+doubleclick.net
+dougscripts.com
+dowei.org
+download.syniumsoftware.com
+doxygen.org
+dphk.org
+dpp.org.tw
+drewolanoff.com
+drgan.net
+dropbox.com
+dropboxusercontent.com
+drsunacademy.com
+drtuber.com
+dscn.info
+dtiblog.com
+dtic.mil
+dtiserv2.com
+duckduckgo.com
+duckload.com
+duckmylife.com
+duihuahrjournal.org
+duihua.org
+duoweitimes.com
+duping.net
+duplicati.com
+dupola.com
+dupola.net
+dvorak.org
+dw.de
+dwnews.com
+dwnews.net
+dw-world.com
+dw-world.de
+dy24k.info
+dynawebinc.com
+dyndns.org
+dzze.com
+e123.hk
+eamonnbrennan.com
+earthquake.usgs.gov
+easy-share.com
+ebookbrowse.com
+ebookee.com
+echofon.com
+ecministry.net
+edicypages.com
+edoors.com
+edubridge.com
+eevpn.com
+efcc.org.hk
+efksoft.com
+efmoe.com
+e-gold.com
+eic-av.com
+e-info.org.tw
+electionsmeter.com
+elpais.com
+eltondisney.com
+emacsblog.org
+embr.in
+emory.edu
+emule-ed2k.com
+emuparadise.me
+enewstree.com
+en.favotter.net
+englishfromengland.co.uk
+entermap.com
+en.wikipedia.org
+epochtimes-bg.com
+epochtimes.co.il
+epochtimes.co.kr
+epochtimes.com
+epochtimes.de
+epochtimes.fr
+epochtimes.ie
+epochtimes.jp
+epochtimes-romania.com
+epochtimes.ru
+epochtimes.se
+epochtimestr.com
+epochweekly.com
+erabaru.net
+erepublik.com
+erepublik.net
+erights.net
+eriversoft.com
+ernestmandel.org
+etaiwannews.com
+etizer.org
+etools.ncol.com
+e-traderland.net
+etraining.gov.tw
+ettoday.net
+evchk.wikia.com
+eventful.com
+everyday-carry.com
+exblog.jp
+expatshield.com
+exploader.net
+extremetube.com
+eyespirit.info
+eyevio.jp
+eyny.com
+ezpc.tk
+ezpeer.com
+facebook.com
+facebook.net
+facesofnyfw.com
+fail.hk
+faiththedog.info
+fakku.net
+falsefire.com
+falunart.org
+falundafamuseum.org
+falundafa.org
+falunhr.org
+famunion.com
+fangbinxing.com
+fangeming.com
+fanglizhi.info
+fangongheike.com
+fangong.org
+fan-qiang.com
+fanqianghou.com
+fanqiangyakexi.net
+fanswong.com
+fanyue.info
+fapdu.com
+farwestchina.com
+farxian.com
+fastpic.ru
+faststone.org
+favorious.com
+favstar.fm
+fawanghuihui.org
+faydao.com
+fbcdn.net
+fb.com
+fb.me
+fbsbx.com
+fc2china.com
+fc2.com
+f.cl.ly
+fdc89.jp
+feedbooks.mobi
+feedburner.com
+feeds2.feedburner.com
+feeds.feedburner.com
+feedzshare.com
+feelssh.com
+feer.com
+felixcat.net
+feministteacher.com
+fengzhenghu.com
+fetchvideo.com
+ff.im
+fflick.com
+fgmtv.net
+fgmtv.org
+filefactory.com
+files2me.com
+fileserve.com
+fillthesquare.org
+finalion.jp
+findbook.tw
+finler.net
+fireofliberty.org
+firstfivefollowers.com
+flecheinthepeche.fr
+fleshbot.com
+flickr.com
+flickrhivemind.net
+flightcaster.com
+flowerofhappiness.spaces.live.com
+focustaiwan.tw
+focusvpn.com
+fofg.org
+fooooo.com
+footwiball.com
+forum.baby-kingdom.com
+forum.cyberctm.com
+forum.idsam.com
+forum.iset.com.tw
+forum.my903.com
+forum.mymaji.com
+forum.newsgroup.la
+forum.nownews.com
+forum.omy.sg
+forum.palmislife.com
+forum.pchome.com.tw
+forum.setty.com.tw
+forum.sina.com.hk
+forum.slime.com.tw
+forum.tvb.com
+forum.yorkbbs.ca
+fotop.net
+fourface.nodesnoop.com
+fourthinternational.org
+foxdie.us
+foxsub.com
+foxtang.com
+fqrouter.com
+franklc.com
+freakshare.com
+fredwilson.vc
+free4u.com.ar
+freealim.com
+freechal.com
+freedomhouse.org
+free.fr
+freegao.com
+freegateget.googlepages.com
+free-gate.org
+free-hada-now.org
+freelotto.com
+freeman2.com
+freemoren.com
+freemorenews.com
+freenet-china.org
+freenetproject.org
+freenewscn.com
+freeopenvpn.com
+freeoz.org
+free-ssh.com
+freessh.us
+freetibet.org
+freevpn.nl
+freewallpaper4.me
+freewebs.com
+freeweibo.com
+freexinwen.com
+freeyoutubeproxy.net
+friendfeed.com
+friendfeed-media.com
+fring.com
+fringenetwork.com
+frommel.net
+frontlinedefenders.org
+fscked.org
+fsurf.com
+ftchinese.com
+fuckcnnic.net
+fuckgfw.com
+fuckgfw.org
+fulue.com
+funf.tw
+funp.com
+furinkan.com
+furl.net
+futurechinaforum.org
+futureme.org
+futuremessage.org
+fuyin.net
+fw.cm
+fxnetworks.com
+fzh999.com
+fzh999.net
+gabocorp.com
+gaeproxy.com
+gaeproxy.googlecode.com
+galenwu.com
+game735.com
+gamebase.com.tw
+gamer.com.tw
+gamez.com.tw
+ganges.com
+gaoming.net
+gaopi.net
+gaozhisheng.net
+gaozhisheng.org
+gardennetworks.com
+gardennetworks.org
+gartlive.com
+gather.com
+gaymap.cc
+gazotube.com
+gcc.org.hk
+gclooney.com
+g.co
+gcpnews.com
+gdbt.net
+gdzf.org
+geek-art.net
+geekerhome.com
+geekmade.co.uk
+geekmanuals.com
+generesis.com
+genuitec.com
+geocities.co.jp
+geocities.com
+geocities.jp
+geohot.com
+geometrictools.com
+getchu.com
+getcloudapp.com
+get-digital-help.com
+getfoxyproxy.org
+getfreedur.com
+getiton.com
+getjetso.com
+getlantern.org
+getsmartlinks.com
+getsocialscope.com
+gfwinterceptor.googlecode.com
+gfw.org.ua
+ggpht.com
+ggssl.com
+ghost.org
+ghut.org
+giga-web.jp
+gigporno.ru
+gimpshop.com
+girlbanker.com
+github.com
+git-scm.com
+givemesomethingtoread.com
+glennhilton.com
+globaljihad.net
+globalmuseumoncommunism.org
+globalrescue.net
+globalvoicesonline.org
+gmail.com
+gmbd.cn
+gmhz.org
+gmodules.com
+gmozomg.izihost.org
+gnci.org.hk
+goagent.biz
+goagent.googlecode.com
+goagentplus.com
+godfootsteps.org
+golang.org
+goldbetsports.com
+goldwave.com
+gongmeng.info
+gongm.in
+gongminliliang.com
+gongwt.com
+goodreaders.com
+goodreads.com
+goofind.com
+goo.gl
+googleadservices.com
+google-analytics.com
+googleapis.com
+googlecode.com
+google.co.jp
+google.com
+google.com.hk
+google.com.sg
+google.com.tw
+google.com.uk
+googledomains.com
+googledrive.com
+googleearth.com
+googlehosted.com
+googlelabs.com
+googlemail.com
+googleplus.com
+googlesile.com
+googlesource.com
+googlesyndication.com
+googletagmanager.com
+googletagservices.com
+googleusercontent.com
+googlevideo.com
+gopetition.com
+gospelherald.com
+gov.tw
+gpass1.com
+grandtrial.org
+graphis.ne.jp
+gravatar.com
+graylog2.org
+grb.gov.tw
+greatfire.org
+greatfirewall.biz
+great-firewall.com
+greatfirewallofchina.net
+greatfirewallofchina.org
+great-roc.org
+greatroc.org
+greatroc.tw
+greatzhonghua.org
+greenparty.org.tw
+greenvpn.net
+gs-discuss.com
+gseeker.com
+gsn-cert.nat.gov.tw
+gstatic.com
+gtap.googlecode.com
+gtricks.com
+guancha.org
+gufeng521.spaces.live.com
+guishan.org
+gunsamerica.com
+gun-world.net
+guomin.us
+gutteruncensored.com
+gvm.com.tw
+gyalwarinpoche.com
+gysd.nyc.gov.tw
+gzm.tv
+gzone-anime.info
+h1n1china.org
+hacken.cc
+hackthatphone.net
+hahlo.com
+hakkatv.org.tw
+hanunyi.com
+hardsextube.com
+hasaowall.com
+have8.com
+haygo.com
+hcc.gov.tw
+hchcc.gov.tw
+h-china.org
+hdtvb.net
+heartyit.com
+hecaitou.net
+hechaji.com
+heix.pp.ru
+heiyo.info
+helloandroid.com
+hellonewyork.us
+helloqueer.com
+hellotxt.com
+hellouk.org
+helpeachpeople.com
+helplinfen.com
+help.linksalpha.com
+help.opera.com
+helpzhuling.org
+hen.bao.li
+hengchuen.gov.tw
+heqinglian.net
+here4news.com
+heungkongdiscuss.com
+hgseav.com
+hidden-advent.org
+hidecloud.com
+hideipvpn.com
+hidemyass.com
+higfw.com
+highrockmedia.com
+hihiforum.com
+hihistory.net
+hiitch.com
+hikinggfw.org
+himemix.com
+himemix.net
+hjclub.info
+hk32168.com
+hkbc.net
+hkbf.org
+hkchurch.org
+hkdailynews.com.hk
+hkday.net
+hkej.com
+hkepc.com
+hkfront.org
+hk.geocities.com
+hkgolden.com
+hkgreenradio.org
+hkg.westkit.net
+hkheadline.com
+hkhkhk.com
+hkjc.com
+hk.jiepang.com
+hkjp.easyweb.hk
+hkjp.org
+hk.knowledge.yahoo.com
+hk.myblog.yahoo.com
+hk.news.yahoo.com
+hkptu.org
+hk-pub.com
+hk.rd.yahoo.com
+hkreporter.com
+hkreporter.loved.hk
+hk.search.yahoo.com
+hk.video.news.yahoo.com
+hkwcc.org.hk
+hk.yahoo.com
+hkzone.org
+hnjhj.com
+hola.com
+holyspiritspeaks.org
+holz.byethost8.com
+homeservershow.com
+home.sina.com
+home.so-net.net.tw
+honeonet.spaces.live.com
+hongmeimei.com
+hongzhi.li
+hootsuite.com
+hotpot.hk
+hotshame.com
+hotspotshield.com
+hougaige.com
+howtoforge.com
+hqcdp.org
+hrcir.com
+hrichina.org
+hrw.org
+hsinchu-cc.gov.tw
+hsjp.net
+hsselite.com
+htkou.net
+htl.li
+ht.ly
+htmldog.com
+huaglad.com
+huajiadi.spaces.live.com
+huanghuagang.org
+huaren.us
+huaxia-news.com
+huaxin.ph
+hua-yue.net
+hudatoriq.web.id
+hugoroy.eu
+huhamhire.com
+hujiachina.spaces.live.com
+hulu.com
+huluim.com
+humanities.uchicago.edu
+hungerstrikeforaids.org
+hung-ya.com
+huping.net
+hutianyi.net
+hutong9.net
+hwinfo.com
+hyperrate.com
+hypeshell.com
+i1.hk
+i2runner.com
+ialmostlaugh.com
+iask.bz
+iask.ca
+ibiblio.org
+iblogserv-f.net
+ibros.org
+icij.org
+icl-fi.org
+iconpaper.org
+icu-project.org
+idemocracy.asia
+identi.ca
+idiomconnection.com
+idouga.com
+idv.tw
+ieasynews.net
+ied2k.net
+ieemdai.spaces.live.com
+ifan.cz.cc
+ifanqiang.com
+ifanr.com
+ifcss.org
+ifjc.org
+igfw.net
+ignitedetroit.net
+igvita.com
+ihakka.net
+iicns.com
+illusionfactory.com
+ilove80.be
+im88.tw
+imageflea.com
+imagesblog.gio.gov.tw
+imageshack.us
+imagevenue.com
+imagezilla.net
+ime.baidu.jp
+img.ly
+imkev.com
+imlive.com
+immigration.gov.tw
+imrworldwide.com
+im.tv
+incredibox.fr
+iner.gov.tw
+initiativesforchina.org
+inmediahk.net
+innermongolia.org
+instagram.com
+interestinglaugh.com
+interfaceaddiction.com
+internationalrivers.org
+internetdefenseleague.org
+internetfreedom.org
+internetpopculture.com
+inxian.com
+iphone4hongkong.com
+iphonehacks.com
+iphonix.fr
+ipicture.ru
+ipobar.com
+ippotv.com
+iptorrents.com
+ipvanish.com
+iredmail.org
+ironbigfools.compython.net
+ironicsoftware.com
+ironpython.net
+isaacmao.com
+isgreat.org
+islamicity.com
+islam.org.hk
+ismprofessional.net
+isohunt.com
+israbox.com
+istockphoto.com
+isunaffairs.com
+isuntv.com
+itaboo.info
+ithelp.ithome.com.tw
+itrc.gov.tw
+itshidden.com
+itweet.net
+iu45.com
+iverycd.com
+ixquick.com
+izaobao.us
+izles.net
+japan-whores.com
+jayparkinsonmd.com
+jbtalks.cc
+jbtalks.com
+jbtalks.my
+jeanyim.com
+jgoodies.com
+jiaoyou8.com
+jiehua.cz
+jieshibaobao.com
+jike.com
+jimoparty.com
+jinbushe.org
+jingpin.org
+jitouch.com
+jkforum.net
+j.mp
+joachims.org
+jobso.tv
+joeedelman.com
+journalofdemocracy.org
+jpopforum.net
+juliereyc.com
+junauza.com
+junefourth-20.net
+justfreevpn.com
+justtristan.com
+juziyue.com
+jwmusic.org
+jyxf.net
+jyzj.waqn.com
+k2.xrea.com
+kagyuoffice.org.tw
+kaiyuan.de
+kakao.com
+kanzhongguo.com
+kanzhongguo.eu
+karayou.com
+ka-wai.com
+kcsoftwares.com
+kechara.com
+keepandshare.com
+kendincos.net
+kenengba.com
+keontech.net
+khcc.gov.tw
+khms.gov.tw
+khmusic.com.tw
+killwall.com
+kineox.free.fr
+kingdomsalvation.org
+kinghost.com
+kingstone.com.tw
+kissbbao.cn
+kissyoutube.com
+kk.gov.tw
+klccab.gov.tw
+klra.gov.tw
+klsio.gov.tw
+kmh.gov.tw
+kmseh.gov.tw
+knowledgerush.com
+kodingen.com
+kompozer.net
+koolsolutions.com
+koornk.com
+kt.kcome.org
+kui.name
+kun.im
+kurtmunger.com
+kusocity.com
+kwongwah.com.my
+kyohk.net
+kzeng.info
+labiennale.org
+ladbrokes.com
+la-forum.org
+lagranepoca.com
+lalulalu.com
+laogai.org
+laomiu.com
+laoyang.info
+laptoplockdown.com
+laqingdan.net
+larsgeorge.com
+lastfm.es
+latelinenews.com
+latimesblogs.latimes.com
+lazarsearlymusic.com
+leecheukyan.org
+legaltech.law.com
+lematin.ch
+lemonde.fr
+lenwhite.com
+lerosua.org
+lesoir.be
+lesscss.org
+letscorp.net
+liansi.org
+lianyue.net
+liaowangxizang.net
+liberal.org.hk
+libertytimes.com.tw
+lich355.megabyet.net
+lidecheng.com
+life.fly4ever.me
+limiao.net
+line.me
+linglingfa.com
+lingvodics.com
+linkideo.com
+linuxconfig.org
+linux-engineer.net
+linuxreviews.org
+linuxtoy.org
+lipuman.com
+listentoyoutube.com
+list.ly
+listorious.com
+lists.debian.org
+lists.w3.org
+littlebigdetails.com
+liudejun.com
+liuhanyu.com
+liujianshu.com
+liu.lu
+liuxiaotong.com
+liveleak.com
+livestation.com
+livestream.com
+livevideo.com
+livingonline.us
+livingstream.com
+lizhizhuangbi.com
+lkcn.net
+localpresshk.com
+lockdown.com
+lockestek.com
+logbot.net
+logiqx.com
+logmike.com
+log.riku.me
+london.neighborhoodr.com
+longhair.hk
+longtermly.net
+lookatgame.com
+lookingglasstheatre.org
+lookpic.com
+lotuslight.org.tw
+lovequicksilver.com
+lovesphinx.tk
+lrfz.com
+lsd.org.hk
+lsforum.net
+lsmchinese.org
+lsmkorean.org
+lsm.org
+lsxszzg.com
+lua.org
+lua-users.org
+lungtanhr.gov.tw
+luntan.zaobao.com
+lupm.org
+lushstories.com
+lvhai.org
+lyricsquote.com
+mad-ar.ch
+madmenunbuttoned.com
+magazines.sina.com.tw
+maiio.net
+mail-archive.com
+maiplus.com
+makemymood.com
+makzhou.warehouse333.com
+malaysiakini.com
+marc.info
+marco.org
+marguerite.su
+marines.mil
+markmilian.com
+martau.com
+martincartoons.com
+maruta.be
+marxist.com
+marxist.net
+marxists.org
+mashable.com
+mash.to
+matainja.com
+mathiew-badimon.com
+matsu-news.gov.tw
+matsushimakaede.com
+maxgif.com
+mayimayi.com
+mcadforums.com
+mcfog.com
+md-t.org
+mediafire.com
+meetup.com
+mefeedia.com
+megaporn.com
+megarotic.com
+megavideo.com
+megurineluka.com
+meirixiaochao.com
+melon-peach.com
+memedia.cn
+meme.yahoo.com
+memrijttm.org
+merit-times.com.tw
+mesotw.com
+metacafe.com
+meteorshowersonline.com
+metrolife.ca
+mgoon.com
+mgstage.com
+mh4u.org
+mhradio.org
+michaelanti.com
+michaelmarketl.com
+middle-way.net
+mihk.hk
+mihua.org
+mike.cz.cc
+mimivip.com
+minghui.org
+minghui-school.org
+mingjinglishi.com
+mingjingnews.com
+mingpaocanada.com
+mingpao.com
+mingpaomonthly.com
+mingpaonews.com
+mingpaony.com
+mingpaosf.com
+mingpaotor.com
+mingpaovan.com
+minimalmac.com
+mininova.org
+minzhuhua.net
+minzhuzhongguo.org
+miroguide.com
+mirrorbooks.com
+mitbbs.com
+mixedmedialabs.com
+mixero.com
+mixpod.com
+mixx.com
+mizzmona.com
+mk5000.com
+mlcool.com
+mmaaxx.com
+mmmca.com
+mobatek.net
+mobile01.com
+mobileways.de
+mobypicture.com
+moby.to
+modfetish.com
+moe.gov.tw
+mog.com
+molihua.org
+mondex.org
+monitorchina.org
+moonriver7.files.wordpress.com
+morningsun.org
+m.oulove.org
+movabletype.com
+moviefap.com
+mp3ye.eu
+mpettis.com
+mpfinance.com
+mpinews.com
+m.plixi.com
+mrdoob.com
+mrtweet.com
+msguancha.com
+m.slandr.net
+m-team.cc
+mthruf.com
+m.tweete.net
+mtw.tl
+multiply.com
+multiproxy.org
+multiupload.com
+muouju.com
+muselinks.co.jp
+music.jwmusic.org
+muzi.com
+muzi.net
+muzu.tv
+mvdis.gov.tw
+mx981.com
+myactimes.com
+my-addr.com
+myaudiocast.com
+myav.com.tw
+my.backchina.com
+myboooks.googlepages.com
+mychinamyhome.com
+myeclipseide.com
+myforum.com.hk
+myforum.com.uk
+myfreshnet.com
+my.keso.cn
+myopenid.com
+my.opera.com
+mypaper.pchome.com.tw
+myparagliding.com
+mypopescu.com
+my-proxy.com
+myshare.url.com.tw
+mysinablog.com
+myspace.com
+myvlog.im.tv
+naacoalition.org
+naitik.net
+nakido.com
+namsisi.com
+nanyang.com
+nanyangpost.com
+nanzao.com
+naol.ca
+national-lottery.co.uk
+navicat.com
+navigeaters.com
+navy.mil
+nccwatch.org.tw
+ncdr.nat.gov.tw
+nch.com.tw
+ncn.org
+ncree.gov.tw
+nde.de
+ndr.de
+nekoslovakia.net
+nerch.gov.tw
+ner.gov.tw
+nerhl.gov.tw
+nertt.gov.tw
+netcolony.com
+netflix.com
+netme.cc
+networkedblogs.com
+neverforget8964.org
+new-3lunch.net
+new-akiba.com
+newcenturymc.com
+newcenturynews.com
+newchen.com
+newgrounds.com
+newlandmagazine.com.au
+news100.com.tw
+newsancai.com
+news.atebits.com
+news.backchina.com
+news.bbc.co.uk
+newscn.org
+news.cnyes.com
+newsforums.bbc.co.uk
+news.ghostery.com
+news.google.com.hk
+newsminer.com
+news.msn.com.tw
+news.omy.sg
+news.pchome.com.tw
+newspeak.cc
+newspp.org
+news.sina.com.hk
+news.sina.com.tw
+news.singtao.ca
+newstapa.org
+newtaiwan.com.tw
+newtalk.tw
+newyorktimes.com
+nexton-net.jp
+nexttv.com.tw
+nf.id.au
+nga.mil
+ngensis.com
+nhri.gov.tw
+nic.cz.cc
+nici.nat.gov.tw
+nicovideo.tw
+nict.gov.tw
+nighost.org
+nintendium.com
+nintendowifi.net
+njactb.org
+njuice.com
+nlfreevpn.com
+nmh.gov.tw
+nmmba.gov.tw
+nmp.gov.tw
+nmtl.gov.tw
+nmvttc.gov.tw
+nobelprize.org
+nobel.se
+nobodycanstop.us
+nokogiri.org
+nokola.com
+noobbox.com
+notes.alexdong.com
+novelasia.com
+nownews.com
+nowtorrents.com
+noypf.com
+npa.go.jp
+npm.gov.tw
+nps.gov
+nrk.no
+nsc.gov.tw
+nspo.gov.tw
+nstm.gov.tw
+ntdmh.gov.tw
+ntdtv.ca
+ntdtv.co
+ntdtv.com
+ntdtv.org
+ntdtv.ru
+ntl.gov.tw
+ntsec.gov.tw
+ntuh.gov.tw
+nuexpo.com
+nurgo-software.com
+nuvid.com
+nuzcom.com
+nvquan.org
+nvri.gov.tw
+nydus.ca
+nysingtao.com
+nytco.com
+nyt.com
+nytimes.com
+nytimg.com
+nzchinese.net.nz
+observechina.net
+oclp.hk
+october-review.org
+offbeatchina.com
+ogaoga.org
+oikos.com.tw
+oiktv.com
+oizoblog.com
+okayfreedom.com
+old-cat.net
+old.nabble.com
+olumpo.com
+olympicwatch.org
+omgili.com
+omnitalk.com
+on.cc
+one.xthost.info
+onlylady.cn
+onmoon.com
+onmoon.net
+oopsforum.com
+ooyala.com
+open.com.hk
+opendemocracy.net
+openid.net
+openleaks.org
+openvpn.net
+openvpn.org
+openwebster.com
+opml.radiotime.com
+opnir.com
+orientaldaily.com.my
+orient-doll.com
+orn.jp
+orzistic.org
+osfoora.com
+ourdearamy.com
+oursogo.com
+oursteps.com.au
+overlapr.com
+owl.li
+ow.ly
+oyax.com
+ozchinese.com
+ozyoyo.com
+pabp.gov.tw
+pacificpoker.com
+packages.debian.org
+packetix.net
+page2rss.com
+page.bid.yahoo.com
+pagodabox.com
+paint.net
+palacemoon.com
+pandora.com
+pandora.tv
+panluan.net
+panoramio.com
+pao-pao.net
+paperb.us
+paper.li
+paper-replika.com
+parade.com
+parislemon.com
+pastebin.com
+pastie.org
+patehr.gov.tw
+pbs.org
+pbwiki.com
+pbworks.com
+pbxes.com
+pbxes.org
+pcdiscuss.com
+pcdvd.com.tw
+pchome.com.tw
+pct.org.tw
+pcworld.com
+pdetails.com
+pdproxy.com
+peacefire.org
+peacehall.com
+peeasian.com
+peerpong.com
+pekingduck.org
+penchinese.com
+penchinese.net
+pengyulong.com
+penthouse.com
+peopo.org
+percy.in
+perfectgirls.net
+perfectvpn.net
+perfspot.com
+perlhowto.com
+pet.gov.tw
+philly.com
+photofocus.com
+photos.dailyme.com
+photo.utom.us
+phuquocservices.com
+picasaweb.google.com
+picidae.net
+picturesocial.com
+pictures.playboy.com
+pidown.com
+pign.net
+pimg.tw
+pin6.com
+ping.fm
+pinoy-n.com
+pioneer-worker.forums-free.com
+piring.com
+pixanalytics.com
+pixelqi.com
+pixfs.net
+pixnet.cc
+pixnet.net
+pixplug.in
+pk.com
+placemix.com
+planetsuzy.org
+playboy.com
+plays.com.tw
+plm.org.hk
+plunder.com
+plurk.com
+plurktop.mmdays.com
+plus28.com
+plusbb.com
+pmates.com
+po2b.com
+podictionary.com
+pokerstars.com
+politicalchina.org
+popvote.hk
+popyard.com
+popyard.org
+porn2.com
+pornbase.org
+porn.com
+pornhub.com
+pornmm.net
+pornoxo.com
+pornrapidshare.com
+pornstarclub.com
+porntube.com
+pornvisit.com
+portis21.spaces.live.com
+pose.com
+postadult.com
+post.anyu.org
+posterous.com
+post.ly
+powerapple.com
+power.com
+powercx.com
+prayforchina.net
+premeforwindows7.com
+presentationzen.com
+president.gov.tw
+prestige-av.com
+previewshots.com
+privacybox.de
+privateinternetaccess.com
+privatepaste.com
+privatetunnel.com
+procopytips.com
+program-think.spaces.live.com
+prosiben.de
+provideocoalition.com
+proxifier.com
+proxomitron.info
+proxy.org
+proxypy.net
+proxyroad.com
+prozz.net
+psblog.name
+psiphon.ca
+psiphon.civisec.org
+pts.org.tw
+ptt.cc
+pubu.com.tw
+puffinbrowser.com
+puffstore.com
+pullfolio.com
+pulse.yahoo.com
+pure18.com
+pureconcepts.net
+purepdf.com
+purevpn.com
+putlocker.com
+puttycm.free.fr
+pwned.com
+python.com
+python.com.tw
+qanote.com
+qidian.ca
+qienkuen.org
+qi-gong.me
+qiwen.lu
+qixianglu.cn
+qkshare.com
+qoos.com
+qq.co.za
+qstatus.com
+qtrac.eu
+qtweeter.com
+quadedge.com
+qusi8.net
+qvodzy.org
+qxbbs.org
+radicalparty.org
+radioaustralia.net.au
+radiovaticana.org
+radiovncr.com
+raidcall.com.tw
+rangzen.org
+ranyunfei.com
+rapbull.net
+rapidshare8.com
+rapidsharedata.com
+rayfme.com
+rcinet.ca
+rconversation.blogs.com
+rdio.com
+read100.com
+readingtimes.com.tw
+readmoo.com
+realraptalk.com
+recordhistory.org
+redchinacn.org
+redtube.com
+referer.us
+reflectivecode.com
+relaxbbs.com
+renminbao.com
+renyurenquan.org
+retweeteffect.com
+retweetist.com
+retweetrank.com
+revleft.com
+revsci.net
+revver.com
+rfachina.com
+rfamobile.org
+rfa.org
+rferl.org
+rfi.fr
+rhcloud.com
+riku.me
+rileyguide.com
+rlwlw.com
+rmjdw.com
+rnw.nl
+robtex.com
+robustnessiskey.com
+rocmp.org
+rojo.com
+ronjoneswriter.com
+roodo.com
+rotten.com
+rsf-chinese.org
+rsf.org
+rssmeme.com
+rthk.hk
+rthk.org.hk
+rti.org.tw
+ruanyifeng.com
+rushbee.com
+rutube.ru
+ruyiseek.com
+rxhj.net
+s1heng.com
+s8forum.com
+sacom.hk
+sadpanda.us
+saiq.me
+salvation.org.hk
+samair.ru
+sammyjs.org
+samsoff.es
+sandnoble.com
+sankaizok.com
+sanmin.com.tw
+sapikachu.net
+savemedia.com
+savetibet.de
+savetibet.fr
+savetibet.nl
+savetibet.org
+savetibet.ru
+savevid.com
+say2.info
+scanscout.com
+scmpchinese.com
+scmp.com
+scorecardresearch.com
+scribd.com
+scriptspot.com
+seapuff.com
+secretchina.com
+secretgarden.no
+secure.wikimedia.org
+securitykiss.com
+seesmic.com
+seevpn.com
+seezone.net
+sejie.com
+sendoid.com
+sendspace.com
+sesawe.net
+sesawe.org
+sethwklein.net
+sevenload.com
+sex-11.com
+sex3.com
+sex8.cc
+sexandsubmission.com
+sex.com
+sexhuang.com
+sexhu.com
+sexinsex.net
+sfileydy.com
+shadow.ma
+shadowsocks.org
+shahamat-english.com
+shangfang.org
+shapeservices.com
+sharebee.com
+sharecool.org
+share.ovi.com
+share.skype.com
+share.youthwant.com.tw
+sharkdolphin.com
+sharpdaily.com.hk
+sharpdaily.hk
+shaunthesheep.com
+sheikyermami.com
+shellmix.com
+shenshou.org
+shenyunperformingarts.org
+shenzhoufilm.com
+shifeike.blog125.fc2blog.net
+shinychan.com
+shitaotv.org
+shixiao.org
+shizhao.org
+shkspr.mobi
+shodanhq.com
+shopping.com
+showbiz.omy.sg
+showtime.jp
+shwchurch3.com
+sidelinesnews.com
+sidelinessportseatery.com
+simplecd.me
+simplecd.org
+simpleproductivityblog.com
+sina.com.tw
+singtao.com
+singularitys.spaces.live.com
+sinoants.com
+sinocast.com
+sinocism.com
+sino-monthly.com
+sinomontreal.ca
+sinonet.ca
+sinopitt.info
+sinoquebec.com
+sis001.com
+sis001.us
+sis.xxx
+site90.net
+sitebro.tw
+siteks.uk.to
+site.locql.com
+sitemaps.org
+sites.google.com
+sitetag.us
+siyi123123123.spaces.live.com
+skimtube.com
+skybet.com
+skyvegas.com
+slacker.com
+slavasoft.com
+slheng.com
+slickvpn.com
+slideshare.net
+slinkset.com
+slutload.com
+smhric.org
+snapchat.com
+snaptu.com
+sndcdn.com
+sneakme.net
+snooper.co.uk
+sobees.com
+socialwhale.com
+sockslist.net
+so.com
+sod.co.jp
+softether.co.jp
+softether-download.com
+softether.org
+softwarebychuck.com
+so-ga.net
+sogclub.com
+sogou.com
+sogrady.me
+sohcradio.com
+sohfrance.org
+soh.tw
+sokamonline.com
+solozorro.tk
+somee.com
+so-news.com
+songjianjun.com
+sonidodelaesperanza.org
+sopcast.com
+sopcast.org
+sorting-algorithms.com
+soso.com
+soumo.info
+soundcloud.com
+soundofhope.kr
+soundofhope.org
+soupofmedia.com
+sourceforge.net
+southnews.com.tw
+sowers.org.hk
+space-scape.com
+spankwire.com
+spb.com
+speckleapp.com
+speedpluss.org
+spencertipping.com
+spinejs.com
+sports.williamhill.com
+spotify.com
+sproutcore.com
+squarespace.com
+srcf.ucam.org
+ssh91.com
+sshtunnel.googlecode.com
+sstatic.net
+stag.gov.tw
+standupfortibet.org
+starp2p.com
+startpage.com
+statcounter.com
+state168.com
+static.apple.nextmedia.com
+static.digg.com
+staticflickr.com
+static.nownews.com
+static.soup.io
+static.typepad.com
+status.twhirl.org
+stdtime.gov.tw
+steel-storm.com
+sthoo.com
+stickam.com
+stickeraction.com
+stonegames.net
+stoneip.info
+stoptibetcrisis.net
+storagenewsletter.com
+stoweboyd.com
+streamingthe.net
+strongvpn.com
+student.tw
+stuffimreading.com
+stuffimreading.net
+stupidvideos.com
+subacme.rerouted.org
+sublexical.spaces.live.com
+sufeng.org
+sugarsync.com
+summify.com
+sun1911.com
+suoluo.org
+surfeasy.com.au
+svwind.com
+sweux.com
+swift-tools.net
+s.xiaod.in
+sydneytoday.com
+sylfoundation.org
+syncback.com
+sysadmin1138.net
+sysresccd.org
+sytes.net
+szbbs.net
+szetowah.org.hk
+t35.com
+t66y.com
+taa-usa.org
+tabtter.jp
+tacem.org
+tafaward.com
+tagwalk.com
+taipei.gov.tw
+taipeisociety.org
+taitung-house.gov.tw
+taiwandaily.net
+taiwankiss.com
+taiwannation.50webs.com
+taiwannation.com
+taiwannation.com.tw
+taiwannews.com.tw
+taiwan-sex.com
+taiwantt.org.tw
+taiwanus.net
+taiwanyes.com
+taiwanyes.ning.com
+tamiaode.tk
+tanc.org
+tangben.com
+taolun.info
+taoyuan.gov.tw
+tap11.com
+target.com
+taweet.com
+tax.nat.gov.tw
+tbpic.info
+tbsec.org
+tbsn.org
+tbsseattle.org
+tchb.gov.tw
+tchrd.org
+t.co
+tcsac.gov.tw
+teamseesmic.com
+teashark.com
+techlifeweb.com
+techparaiso.com
+telecomspace.com
+telegraph.co.uk
+tenacy.com
+thbstc.gov.tw
+theampfactory.com
+theappleblog.com
+theatrum-belli.com
+thebcomplex.com
+theblemish.com
+thebodyshop-usa.com
+thechinabeat.org
+thedailywh.at
+thedieline.com
+thedw.us
+thegatesnotes.com
+thehots.info
+thehousenews.com
+thehungrydudes.com
+thehun.net
+theinternetwishlist.com
+thelifeyoucansave.com
+thelius.org
+thepiratebay.org
+thepiratebay.se
+theqii.info
+thereallove.kr
+thesartorialist.com
+thespeeder.com
+the-sun.on.cc
+thetibetpost.com
+thetrotskymovie.com
+thevivekspot.com
+thewgo.org
+thisav.com
+thisiswhyyouarefat.com
+thkphoto.com
+thomasbernhard.org
+threatchaos.com
+throughnightsfire.com
+t.huhaitai.com
+thumbzilla.com
+thywords.com
+tiananmenmother.org
+tiananmenuniv.com
+tiananmenuniv.net
+tiandixing.org
+tianhuayuan.com
+tiantibooks.org
+tianzhu.org
+tibetalk.com
+tibetanyouthcongress.org
+tibet.at
+tibet.com
+tibetcorps.org
+tibetfund.org
+tibetjustice.org
+tibet.net
+tibetoffice.org
+tibetonline.com
+tibetonline.tv
+tibet.org.tw
+tibetsun.com
+tibetwrites.org
+tidyread.com
+time.com
+times.hinet.net
+tinychat.com
+tinypaste.com
+tinypng.com
+tistory.com
+tjholowaychuk.com
+tkcs-collins.com
+tkforum.tk
+t.kun.im
+tmagazine.com
+tmi.me
+tnaflix.com
+tncsec.gov.tw
+t.neolee.cn
+togetter.com
+tokyo-247.com
+tokyocn.com
+tokyo-hot.com
+tomayko.com
+tomsc.com
+tono-oka.jp
+tonyyan.net
+toodoc.com
+toonel.net
+topic.youthwant.com.tw
+topnews.in
+topshare.us
+topshareware.com
+topstyle4.com
+topsy.com
+tora.to
+tor.blingblingsquad.net
+torproject.org
+torrentcrazy.com
+torrentproject.se
+tor.updatestar.com
+torvpn.com
+t.orzdream.com
+tosh.comedycentral.com
+touch99.com
+toutfr.com
+tpde.aide.gov.tw
+tphcc.gov.tw
+tpi.org.tw
+transgressionism.org
+transparency.org
+travelinlocal.com
+trendsmap.com
+trialofccp.org
+tripod.com
+trouw.nl
+trtc.com.tw
+trt.net.tr
+trulyergonomic.com
+trustedbi.com
+truth101.co.tv
+truthcn.com
+truveo.com
+tsctv.net
+tsemtulku.com
+tsquare.tv
+tsunagarumon.com
+tt1069.com
+tttan.com
+tuanzt.com
+tube8.com
+tubecao.com
+tube.com
+tubewolf.com
+tuidang.net
+tuidang.org
+tui.orzdream.com
+tuite.googlecode.com
+tumblr.awflasher.com
+tumblweed.org
+tumutanzi.com
+tunein.com
+tunnelbear.com
+turbobit.net
+turbotwitter.com
+turningtorso.com
+turntable.fm
+tuxtraining.com
+tvants.com
+tvboxnow.com
+tv.com
+tvider.com
+tv-intros.com
+tv.on.cc
+tvunetworks.com
+twapperkeeper.com
+twa.sh
+twaud.io
+twbbs.net.tw
+twbbs.org
+twbbs.tw
+twblogger.com
+tweepguide.com
+tweeplike.me
+tweepmag.com
+tweepml.org
+tweetbackup.com
+tweetboard.com
+tweetboner.biz
+tweetdeck.com
+tweetedtimes.com
+tweetmeme.com
+tweetmylast.fm
+tweetphoto.com
+tweetrans.com
+tweetree.com
+tweetwally.com
+tweetymail.com
+twftp.org
+twibase.com
+twibble.de
+twibbon.com
+twibs.com
+twicsy.com
+twifan.com
+twiffo.com
+twiggit.org
+twilog.org
+twimbow.com
+twimg.com
+twimg.edgesuite.net
+tw.img.nextmedia.com
+twindexx.com
+twipple.jp
+twistar.cc
+twisternow.com
+twistory.net
+twit2d.com
+twitbrowser.net
+twitcause.com
+twitese.spaces.live.com
+twitgether.com
+twitgoo.com
+twitiq.com
+twitlonger.com
+twitoaster.com
+twitonmsn.com
+twitpic.com
+twitreferral.com
+twitstat.com
+twittbot.net
+twitter4j.org
+twitter.com
+twittercounter.com
+twitterfeed.com
+twittergadget.com
+twitter.jp
+twitterkr.com
+twittermail.com
+twittertim.es
+twitthat.com
+twitturk.com
+twitturly.com
+twitvid.com
+twitzap.com
+twiyia.com
+tw.jiepang.com
+tw.myblog.yahoo.com
+tw.news.yahoo.com
+tw-npo.org
+tw.rd.yahoo.com
+twreg.info
+twstar.net
+tw.streetvoice.com
+twt.fm
+twtkr.com
+twtr2src.ogaoga.org
+twtrland.com
+twt.tl
+twttr.com
+twurl.nl
+tw.voa.mobi
+twyac.org
+tw.yahoo.com
+tycool.com
+tynsoe.org
+typepad.com
+tzangms.com
+ub0.cc
+uberproxy.net
+ucdc1998.org
+uderzo.it
+udn.com
+ufreevpn.com
+ugo.com
+uhrp.org
+uighurbiz.net
+ukliferadio.co.uk
+ulike.net
+ultravpn.fr
+ultraxs.com
+unblock.cn.com
+unblocksit.es
+uncyclomedia.org
+uncyclopedia.info
+uncyclopedia.tw
+unholyknight.com
+uni.cc
+unicode.org
+uniteddaily.com.my
+unix100.com
+unknownspace.org
+unpo.org
+uocn.org
+upcoming.yahoo.com
+update.playstation.net
+upload4u.info
+upload.backchina.com
+uploaded.to
+uploadstation.com
+upload.wikimedia.org
+urlborg.com
+urlparser.com
+usacn.com
+usfk.mil
+usinfo.state.gov
+usmc.mil
+us.to
+ustream.tv
+usus.cc
+uushare.com
+uwants.com
+uwants.net
+uyghurcongress.org
+uygur.org
+v70.us
+vaayoo.com
+value-domain.com
+van698.com
+vanemu.cn
+vanilla-jp.com
+vansky.com
+vapurl.com
+vatn.org
+vcfbuilder.org
+vcf-online.org
+veempiire.com
+velkaepocha.sk
+venbbs.com
+venchina.com
+ventureswell.com
+veoh.com
+verizon.net
+verybs.com
+vevo.com
+vft.com.tw
+vghks.gov.tw
+vghtc.gov.tw
+vghtpe.gov.tw
+video.aol.ca
+video.aol.com
+video.aol.co.uk
+video.ap.org
+videobam.com
+video.fdbox.com
+video.foxbusiness.com
+videomo.com
+video.tiscali.it
+video.yahoo.com
+vidoemo.com
+views.fm
+viki.com
+vimeocdn.com
+vimeo.com
+vimgolf.com
+vimperator.org
+vincnd.com
+vinniev.com
+vllcs.org
+vlog.xuite.net
+vmixcore.com
+voacantonese.com
+voachineseblog.com
+voachinese.com
+voagd.com
+voanews.com
+voatibetan.com
+vocn.tv
+vot.org
+vpnbook.com
+vpnfire.com
+vpngate.jp
+vpngate.net
+vpnpop.com
+vpnpronet.com
+v-state.org
+vtunnel.com
+w3schools.com
+waffle1999.com
+wahas.com
+waigaobu.com
+waikeung.org
+waiwaier.com
+wallornot.org
+wallpapercasa.com
+wanderinghorse.net
+wanfang.gov.tw
+wangafu.net
+wangjinbo.org
+wanglixiong.com
+wangruoshui.net
+wangyi64.spaces.live.com
+want-daily.com
+wapedia.mobi
+washeng.net
+watchmygf.net
+wattpad.com
+wdf5.com
+wearn.com
+web2project.net
+webbang.net
+webfee.tk
+weblagu.com
+webmproject.org
+webshots.com
+websitepulse.com
+webs-tv.net
+webworkerdaily.com
+weeewooo.net
+weekmag.info
+wefong.com
+weiboleak.com
+weigegebyc.dreamhosters.com
+weijingsheng.org
+weiming.info
+weiquanwang.org
+weisuo.ws
+wellplacedpixels.com
+wengewang.com
+wengewang.org
+wenhui.ch
+wenku.com
+wenxuecity.com
+wenyunchao.com
+wenyunchao.spaces.live.com
+wepn.info
+westca.com
+westernwolves.com
+wetplace.com
+wetpussygames.com
+wexiaobo.org
+wezhiyong.org
+wezone.net
+wforum.com
+whatblocked.com
+whereiswerner.com
+whippedass.com
+whitebear.freebearblog.org
+whydidyoubuymethat.com
+whylover.com
+whyx.org
+w.idaiwan.com
+wiki.cnitter.com
+wiki.jqueryui.com
+wiki.keso.cn
+wikileaks.ch
+wikileaks.de
+wikileaks.eu
+wikileaks.lu
+wikileaks.org
+wikileaks.pl
+wikilivres.info
+wikimapia.org
+wikimedia.org.mo
+wiki.moegirl.org
+wikinet.org
+wiki.oauth.net
+wikipedia.org
+wiki.phonegap.com
+wikiwiki.jp
+wikkii.com
+williamlong.spaces.live.com
+willw.net
+windowsphoneme.com
+winwhispers.info
+wiredbytes.com
+wiredpen.com
+wireshark.org
+wisevid.com
+witnessleeteaching.com
+witopia.net
+wlx.sowiki.net
+woeser.com
+wolfax.com
+womenbusiness.nyc.gov.tw
+womensrightsofchina.org
+woopie.jp
+woopie.tv
+wordboner.com
+wordpress.com
+wordsandturds.com
+w.org
+workatruna.com
+worldcat.org
+worldjournal.com
+worstthingieverate.com
+wo.tc
+wowlegacy.ml
+wow-life.net
+woxinghuiguo.com
+wozy.in
+wp.com
+wpoforum.com
+wqlhw.com
+wqyd.org
+wrchina.org
+wretch.cc
+writer.zoho.com
+wsj.com
+wsj.net
+wtfpeople.com
+wuala.com
+wuerkaixi.com
+wufi.org.tw
+wuguoguang.com
+wujieliulan.com
+wujie.net
+wukangrui.net
+wwitv.com
+www.6v6dota.com
+www.ajsands.com
+www.antd.org
+www.aolnews.com
+www.bulbous.freeserve.co.uk
+www.cmoinc.org
+www.dfanning.com
+www.dwheeler.com
+www.eulam.com
+www.exblog.jp
+www.forum4hk.com
+www.freetibet.org
+www.getyouram.com
+www.goldenmelody.com.tw
+www.idlcoyote.com
+www.immigration.gov.tw
+www.klip.me
+www.kodingen.com
+www.linksalpha.com
+www.loiclemeur.com
+www.macrovpn.com
+www.monlamit.org
+www.moztw.org
+www.mycould.com
+www.ned.org
+www.nownews.com
+www.orchidbbs.com
+www.owind.com
+www.oxid.it
+www.parkansky.com
+www.powerpointninja.com
+www.rnw.nl
+www.somee.com
+www.stackfile.com
+www.supertweet.net
+www.tiffanyarment.com
+www.tripod.com
+www.tv.com
+www.twtrland.com
+www.typepad.com
+www.urbanoutfitters.com
+www.vegorpedersen.com
+www.voy.com
+www.vpncup.com
+www.wangruowang.org
+www.wan-press.org
+www.wet123.com
+www.zaurus.org.uk
+wzyboy.im
+x1949x.com
+x365x.com
+xanga.com
+x-art.com
+xa.yimg.com
+xbabe.com
+xbookcn.com
+xcafe.in
+xcritic.com
+xfm.pp.ru
+xgmyd.com
+xh4n.cn
+xhamster.com
+xiaochuncnjp.com
+xiaohexie.com
+xiaoma.org
+xiezhua.com
+xing.com
+xinhuanet.org
+xinmiao.com.hk
+xinqimeng.over-blog.com
+xinsheng.net
+xinshijue.com
+xinyubbs.net
+xizang-zhiye.org
+xjp.cc
+xml-training-guide.com
+xmovies.com
+xmusic.fm
+xnxx.com
+xpdo.net
+xpud.org
+xskywalker.com
+xtube.com
+xuchao.net
+xuchao.org
+xuzhiyong.net
+xuzhuoer.com
+xvedios.com
+xvideos.com
+x-wall.org
+xxbbx.com
+x.xcity.jp
+xxxx.com.au
+xysblogs.org
+xys.dxiong.com
+xys.org
+xyy69.com
+xyy69.info
+yahoo.cn
+yahoo.com.hk
+yam.com
+yanghengjun.spaces.live.com
+yasni.co.uk
+yasukuni.or.jp
+yatsen.gov.tw
+ydy.com
+yeelou.com
+yeeyi.com
+yegle.net
+yezimary.spaces.live.com
+yfrog.com
+yhcw.net
+yidio.com
+yilubbs.com
+yi.org
+yipub.com
+ym.backchina.com
+yogichen.org
+yong.hu
+yorkbbs.ca
+youdao.com
+youjizz.com
+youmaker.com
+youpai.org
+youporn.com
+your-freedom.net
+yousendit.com
+youthbao.com
+youthnetradio.org
+youtu.be
+youtubecn.com
+youtube.com
+youtube-nocookie.com
+youversion.com
+youxu.info
+ytht.net
+ytimg.com
+yuanming.net
+yuming.flnet.org
+yunchao.net
+yvesgeleyn.com
+yvtc.gov.tw
+yx51.net
+yyii.org
+yymaya.com
+yzzk.com
+zacebook.com
+zannel.com
+zaobao.com
+zaobao.com.sg
+zaozon.com
+zarias.com
+zattoo.com
+zdnet.com.tw
+zengjinyan.org
+zengjinyan.spaces.live.com
+zeutch.com
+zgzcjj.net
+zhanbin.net
+zhao.jinhai.de
+zhenghui.org
+zhenlibu.info
+zhinengluyou.com
+zhllg.spaces.live.com
+zh.m.wikipedia.org
+zh.netlog.com
+zhonggtuotese.net
+zhongguotese.net
+zhongmeng.org
+zhongsou.com
+zh.pokerstrategy.com
+zhreader.com
+zh-tw.justin.tv
+zhuichaguoji.org
+zh.uncyclopedia.wikia.com
+zh.wikinews.org
+zh.wikipedia.org
+zh.wikisource.org
+ziddu.com
+zillionk.com
+zinio.com
+ziplib.com
+zkaip.com
+zmw.cn
+zomobo.net
+zonaeuropa.com
+zootool.com
+zoozle.net
+zozotown.com
+zshare.net
+zsrhao.com
+zuo.la
+zuola.com
+zvereff.com
+zyzc9.com
+zyzg.us
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/gen-gfwlist.sh b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/gen-gfwlist.sh
new file mode 100755
index 000000000..050de594c
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/gen-gfwlist.sh
@@ -0,0 +1,29 @@
+#!/bin/sh -e
+
+generate_china_banned()
+{
+ if [ ! -f /tmp/gfwlist.txt ]; then
+ wget-ssl --no-check-certificate https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt -O /tmp/gfwlist.b64 >&2
+ cat /tmp/gfwlist.b64 | base64 -d > /tmp/gfwlist.txt
+ rm -f /tmp/gfwlist.b64
+ fi
+
+ cat /tmp/gfwlist.txt | sort -u |
+ sed 's#!.\+##; s#|##g; s#@##g; s#http:\/\/##; s#https:\/\/##;' |
+ sed '/\*/d; /apple\.com/d; /sina\.cn/d; /sina\.com\.cn/d; /baidu\.com/d; /byr\.cn/d; /jlike\.com/d; /weibo\.com/d; /zhongsou\.com/d; /youdao\.com/d; /sogou\.com/d; /so\.com/d; /soso\.com/d; /aliyun\.com/d; /taobao\.com/d; /jd\.com/d; /qq\.com/d' |
+ sed '/^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$/d' |
+ grep '^[0-9a-zA-Z\.-]\+$' | grep '\.' | sed 's#^\.\+##' | sort -u |
+ awk '
+BEGIN { prev = "________"; } {
+ cur = $0;
+ if (index(cur, prev) == 1 && substr(cur, 1 + length(prev) ,1) == ".") {
+ } else {
+ print cur;
+ prev = cur;
+ }
+}' | sort -u
+
+}
+
+
+generate_china_banned
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/ssr-watchdog b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/ssr-watchdog
new file mode 100755
index 000000000..66f82b4f7
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/ssr-watchdog
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
+GOOGLE=$(ping -4 www.gstatic.com -c 1 -w 5| sed '1{s/[^(]*(//;s/).*//;q}')
+
+iptables -t nat -I OUTPUT -p tcp -d $GOOGLE -j REDIRECT --to-port 7070
+
+sleep 3
+
+/usr/bin/wget --spider --quiet --tries=1 --timeout=3 www.gstatic.com/generate_204
+
+if [ "$?" == "0" ]; then
+ echo '['$LOGTIME'] ShadowsocksR No Problem.'
+else
+ /usr/bin/wget --spider --quiet --tries=1 --timeout=3 www.baidu.com
+ if [ "$?" == "0" ]; then
+ echo '['$LOGTIME'] Problem decteted, restarting ShadowsocksR...'
+ /etc/init.d/ssrpro restart
+ else
+ echo '['$LOGTIME'] Network Problem. Do nothing.'
+ fi
+fi
+
+sleep 3
+
+iptables -t nat -D OUTPUT -p tcp -d $GOOGLE -j REDIRECT --to-port 7070
+
+
+
+
+
+
+
+
+
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/up-gfwlist.sh b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/up-gfwlist.sh
new file mode 100755
index 000000000..98f723e21
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/shadowsocksr/up-gfwlist.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+/etc/shadowsocksr/gen-gfwlist.sh > /tmp/ol-gfw.txt
+
+if [ -s "/tmp/ol-gfw.txt" ];then
+ sort -u /etc/shadowsocksr/base-gfwlist.txt /tmp/ol-gfw.txt > /tmp/china-banned
+ if ( ! cmp -s /tmp/china-banned /etc/gfwlist/china-banned );then
+ if [ -s "/tmp/china-banned" ];then
+ mv /tmp/china-banned /etc/gfwlist/china-banned
+ echo "Update GFW-List Done!"
+ fi
+ else
+ echo "GFW-List No Change!"
+ fi
+fi
+
+rm -f /tmp/gfwlist.txt
+rm -f /tmp/ol-gfw.txt
+
+/etc/init.d/ssrpro.sh restart
+
diff --git a/package/lean/luci-app-shadowsocksr-pro/root/etc/uci-defaults/shadowsocksr b/package/lean/luci-app-shadowsocksr-pro/root/etc/uci-defaults/shadowsocksr
new file mode 100755
index 000000000..86b57ce08
--- /dev/null
+++ b/package/lean/luci-app-shadowsocksr-pro/root/etc/uci-defaults/shadowsocksr
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete firewall.shadowsocksr
+ set firewall.shadowsocksr=include
+ set firewall.shadowsocksr.type=script
+ set firewall.shadowsocksr.path=/etc/shadowsocksr.include
+ set firewall.shadowsocksr.reload=1
+ commit firewall
+EOF
+
+/etc/init.d/shadowsocksr stop
+/etc/init.d/shadowsocksr disable
+
+rm -f /tmp/luci-indexcache
+exit 0
diff --git a/package/lean/luci-app-ssrserver-python/Makefile b/package/lean/luci-app-ssrserver-python/Makefile
new file mode 100644
index 000000000..757d79e03
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/Makefile
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2008-2014 The LuCI Team
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI for SSR Server Python
+LUCI_DEPENDS:=+python
+LUCI_PKGARCH:=all
+PKG_VERSION:=3.2.0
+PKG_RELEASE:=2
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
+
diff --git a/package/lean/luci-app-ssrserver-python/luasrc/controller/ssr_server.lua b/package/lean/luci-app-ssrserver-python/luasrc/controller/ssr_server.lua
new file mode 100644
index 000000000..2c0023789
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/luasrc/controller/ssr_server.lua
@@ -0,0 +1,21 @@
+module("luci.controller.ssr_server",package.seeall)
+
+function index()
+if not nixio.fs.access("/etc/config/ssr_server")then
+ return
+end
+
+entry({"admin", "vpn"}, firstchild(), "VPN", 45).dependent = false
+
+local page
+
+entry({"admin","vpn","ssr_server"},cbi("ssr_server"),_("SSR Python"),4).dependent=true
+entry({"admin","vpn","ssr_server","status"},call("act_status")).leaf=true
+end
+
+function act_status()
+ local e={}
+ e.server=luci.sys.call("ps | grep server.py |grep -v grep >/dev/null")==0
+ luci.http.prepare_content("application/json")
+ luci.http.write_json(e)
+end
diff --git a/package/lean/luci-app-ssrserver-python/luasrc/model/cbi/ssr_server.lua b/package/lean/luci-app-ssrserver-python/luasrc/model/cbi/ssr_server.lua
new file mode 100644
index 000000000..a90d7b337
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/luasrc/model/cbi/ssr_server.lua
@@ -0,0 +1,97 @@
+local a,t,e
+local m, s
+local o=require"nixio.fs"
+local n={
+"none",
+"aes-128-ctr",
+"aes-192-ctr",
+"aes-256-ctr",
+"aes-128-cfb",
+"aes-192-cfb",
+"aes-256-cfb",
+"rc4",
+"rc4-md5",
+"rc4-md5-6",
+}
+local s={
+"origin",
+"verify_deflate",
+"auth_sha1_v4",
+"auth_aes128_md5",
+"auth_aes128_sha1",
+"auth_chain_a",
+"auth_chain_b",
+"auth_chain_c",
+"auth_chain_d",
+}
+local i={
+"plain",
+"http_simple",
+"http_post",
+"random_head",
+"tls1.2_ticket_auth",
+"tls1.2_ticket_fastauth",
+}
+local o={
+"false",
+"true",
+}
+
+local running=(luci.sys.call("ps | grep server.py |grep -v grep >/dev/null") == 0)
+if running then
+ a= Map("ssr_server", translate("ShadowSocksR Server Config"), translate("SSR Server is running. SSR Server is not running. SSR Server is running. ShadowsocksR 鏈嶅姟鍣ㄨ繍琛屼腑 SSR Server is not running. ShadowsocksR 鏈嶅姟鍣ㄥ凡鍋滄 `__
+
+Usage
+~~~~~
+
+::
+
+ ssserver -p 443 -k password -m rc4-md5
+
+To run in the background:
+
+::
+
+ sudo ssserver -p 443 -k password -m rc4-md5 --user nobody -d start
+
+To stop:
+
+::
+
+ sudo ssserver -d stop
+
+To check the log:
+
+::
+
+ sudo less /var/log/shadowsocks.log
+
+Check all the options via ``-h``. You can also use a
+`Configuration `__
+file instead.
+
+Client
+------
+
+- `Windows `__
+ / `OS
+ X `__
+- `Android `__
+ / `iOS `__
+- `OpenWRT `__
+
+Use GUI clients on your local PC/phones. Check the README of your client
+for more information.
+
+Documentation
+-------------
+
+You can find all the documentation in the
+`Wiki `__.
+
+License
+-------
+
+Copyright 2015 clowwindy
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may
+not use this file except in compliance with the License. You may obtain
+a copy of the License at
+
+::
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Bugs and Issues
+---------------
+
+- `Troubleshooting `__
+- `Issue
+ Tracker `__
+- `Mailing list `__
+
+.. |PyPI version| image:: https://img.shields.io/pypi/v/shadowsocks.svg?style=flat
+ :target: https://pypi.python.org/pypi/shadowsocks
+.. |Build Status| image:: https://img.shields.io/travis/shadowsocks/shadowsocks/master.svg?style=flat
+ :target: https://travis-ci.org/shadowsocks/shadowsocks
+.. |Coverage Status| image:: https://jenkins.shadowvpn.org/result/shadowsocks
+ :target: https://jenkins.shadowvpn.org/job/Shadowsocks/ws/PYENV/py34/label/linux/htmlcov/index.html
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/apiconfig.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/apiconfig.py
new file mode 100644
index 000000000..5ee8be127
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/apiconfig.py
@@ -0,0 +1,15 @@
+锘# Config
+API_INTERFACE = 'sspanelv2' #mudbjson, sspanelv2, sspanelv3, sspanelv3ssr, glzjinmod, legendsockssr, muapiv2(not support)
+UPDATE_TIME = 60
+SERVER_PUB_ADDR = '127.0.0.1' # mujson_mgr need this to generate ssr link
+
+#mudb
+MUDB_FILE = 'mudb.json'
+
+# Mysql
+MYSQL_CONFIG = 'usermysql.json'
+
+# API
+MUAPI_CONFIG = 'usermuapi.json'
+
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/asyncmgr.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/asyncmgr.py
new file mode 100644
index 000000000..9bf4d0936
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/asyncmgr.py
@@ -0,0 +1,99 @@
+锘#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2014 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import time
+import os
+import socket
+import struct
+import re
+import logging
+from shadowsocks import common
+from shadowsocks import lru_cache
+from shadowsocks import eventloop
+import server_pool
+import Config
+
+class ServerMgr(object):
+
+ def __init__(self):
+ self._loop = None
+ self._request_id = 1
+ self._hosts = {}
+ self._hostname_status = {}
+ self._hostname_to_cb = {}
+ self._cb_to_hostname = {}
+ self._last_time = time.time()
+ self._sock = None
+ self._servers = None
+
+ def add_to_loop(self, loop):
+ if self._loop:
+ raise Exception('already add to loop')
+ self._loop = loop
+ # TODO when dns server is IPv6
+ self._sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ self._sock.bind((Config.MANAGE_BIND_IP, Config.MANAGE_PORT))
+ self._sock.setblocking(False)
+ loop.add(self._sock, eventloop.POLL_IN, self)
+
+ def _handle_data(self, sock):
+ data, addr = sock.recvfrom(128)
+ #manage pwd:port:passwd:action
+ args = data.split(':')
+ if len(args) < 4:
+ return
+ if args[0] == Config.MANAGE_PASS:
+ if args[3] == '0':
+ server_pool.ServerPool.get_instance().cb_del_server(args[1])
+ elif args[3] == '1':
+ server_pool.ServerPool.get_instance().new_server(args[1], args[2])
+
+ def handle_event(self, sock, fd, event):
+ if sock != self._sock:
+ return
+ if event & eventloop.POLL_ERR:
+ logging.error('mgr socket err')
+ self._loop.remove(self._sock)
+ self._sock.close()
+ # TODO when dns server is IPv6
+ self._sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ self._sock.setblocking(False)
+ self._loop.add(self._sock, eventloop.POLL_IN, self)
+ else:
+ self._handle_data(sock)
+
+ def close(self):
+ if self._sock:
+ if self._loop:
+ self._loop.remove(self._sock)
+ self._sock.close()
+ self._sock = None
+
+
+def test():
+ pass
+
+if __name__ == '__main__':
+ test()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/config.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/config.json
new file mode 100644
index 000000000..55f12b5f4
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/config.json
@@ -0,0 +1,25 @@
+{
+ "server": "0.0.0.0",
+ "server_ipv6": "::",
+ "server_port": 8388,
+ "local_address": "127.0.0.1",
+ "local_port": 1080,
+
+ "password": "m",
+ "method": "aes-128-ctr",
+ "protocol": "auth_aes128_md5",
+ "protocol_param": "",
+ "obfs": "tls1.2_ticket_auth_compatible",
+ "obfs_param": "",
+ "speed_limit_per_con": 0,
+ "speed_limit_per_user": 0,
+
+ "additional_ports" : {}, // only works under multi-user mode
+ "additional_ports_only" : false, // only works under multi-user mode
+ "timeout": 120,
+ "udp_timeout": 60,
+ "dns_ipv6": false,
+ "connect_verbose_info": 0,
+ "redirect": "",
+ "fast_open": false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/configloader.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/configloader.py
new file mode 100644
index 000000000..cf9d61961
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/configloader.py
@@ -0,0 +1,15 @@
+锘#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+import importloader
+
+g_config = None
+
+def load_config():
+ global g_config
+ g_config = importloader.loads(['userapiconfig', 'apiconfig'])
+
+def get_config():
+ return g_config
+
+load_config()
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/db_transfer.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/db_transfer.py
new file mode 100644
index 000000000..67bda6083
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/db_transfer.py
@@ -0,0 +1,631 @@
+锘#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+import logging
+import time
+import sys
+from server_pool import ServerPool
+import traceback
+from shadowsocks import common, shell, lru_cache, obfs
+from configloader import load_config, get_config
+import importloader
+
+switchrule = None
+db_instance = None
+
+class TransferBase(object):
+ def __init__(self):
+ import threading
+ self.event = threading.Event()
+ self.key_list = ['port', 'u', 'd', 'transfer_enable', 'passwd', 'enable']
+ self.last_get_transfer = {} #涓婁竴娆＄殑瀹為檯娴侀噺
+ self.last_update_transfer = {} #涓婁竴娆℃洿鏂板埌鐨勬祦閲忥紙灏忎簬绛変簬瀹為檯娴侀噺锛
+ self.force_update_transfer = set() #寮哄埗鎺ㄥ叆鏁版嵁搴撶殑ID
+ self.port_uid_table = {} #绔彛鍒皍id鐨勬槧灏勶紙浠卾3浠ヤ笂鏈夌敤锛
+ self.onlineuser_cache = lru_cache.LRUCache(timeout=60*30) #鐢ㄦ埛鍦ㄧ嚎鐘舵佽褰
+ self.pull_ok = False #璁板綍鏄惁宸茬粡鎷夊嚭杩囨暟鎹
+ self.mu_ports = {}
+
+ def load_cfg(self):
+ pass
+
+ def push_db_all_user(self):
+ if self.pull_ok is False:
+ return
+ #鏇存柊鐢ㄦ埛娴侀噺鍒版暟鎹簱
+ last_transfer = self.last_update_transfer
+ curr_transfer = ServerPool.get_instance().get_servers_transfer()
+ #涓婃鍜屾湰娆＄殑澧為噺
+ dt_transfer = {}
+ for id in self.force_update_transfer: #姝よ〃涓殑鐢ㄦ埛缁熻涓婃鏈鍏ョ殑娴侀噺
+ if id in self.last_get_transfer and id in last_transfer:
+ dt_transfer[id] = [self.last_get_transfer[id][0] - last_transfer[id][0], self.last_get_transfer[id][1] - last_transfer[id][1]]
+
+ for id in curr_transfer.keys():
+ if id in self.force_update_transfer or id in self.mu_ports:
+ continue
+ #绠楀嚭涓庝笂娆¤褰曠殑娴侀噺宸硷紝淇濆瓨浜巇t_transfer琛
+ if id in last_transfer:
+ if curr_transfer[id][0] + curr_transfer[id][1] - last_transfer[id][0] - last_transfer[id][1] <= 0:
+ continue
+ dt_transfer[id] = [curr_transfer[id][0] - last_transfer[id][0],
+ curr_transfer[id][1] - last_transfer[id][1]]
+ else:
+ if curr_transfer[id][0] + curr_transfer[id][1] <= 0:
+ continue
+ dt_transfer[id] = [curr_transfer[id][0], curr_transfer[id][1]]
+
+ #鏈夋祦閲忕殑锛屽厛璁板綍鍦ㄧ嚎鐘舵
+ if id in self.last_get_transfer:
+ if curr_transfer[id][0] + curr_transfer[id][1] > self.last_get_transfer[id][0] + self.last_get_transfer[id][1]:
+ self.onlineuser_cache[id] = curr_transfer[id][0] + curr_transfer[id][1]
+ else:
+ self.onlineuser_cache[id] = curr_transfer[id][0] + curr_transfer[id][1]
+
+ self.onlineuser_cache.sweep()
+
+ update_transfer = self.update_all_user(dt_transfer) #杩斿洖鏈夋洿鏂扮殑琛
+ for id in update_transfer.keys(): #鍏跺閲忓姞鍦ㄦ琛
+ if id not in self.force_update_transfer: #浣嗘帓闄ゅ湪force_update_transfer鍐呯殑
+ last = self.last_update_transfer.get(id, [0,0])
+ self.last_update_transfer[id] = [last[0] + update_transfer[id][0], last[1] + update_transfer[id][1]]
+ self.last_get_transfer = curr_transfer
+ for id in self.force_update_transfer:
+ if id in self.last_update_transfer:
+ del self.last_update_transfer[id]
+ if id in self.last_get_transfer:
+ del self.last_get_transfer[id]
+ self.force_update_transfer = set()
+
+ def del_server_out_of_bound_safe(self, last_rows, rows):
+ #鍋滄瓒呮祦閲忕殑鏈嶅姟
+ #鍚姩娌¤秴娴侀噺鐨勬湇鍔
+ try:
+ switchrule = importloader.load('switchrule')
+ except Exception as e:
+ logging.error('load switchrule.py fail')
+ cur_servers = {}
+ new_servers = {}
+ allow_users = {}
+ mu_servers = {}
+ config = shell.get_config(False)
+ for row in rows:
+ try:
+ allow = switchrule.isTurnOn(row) and row['enable'] == 1 and row['u'] + row['d'] < row['transfer_enable']
+ except Exception as e:
+ allow = False
+
+ port = row['port']
+ passwd = common.to_bytes(row['passwd'])
+ if hasattr(passwd, 'encode'):
+ passwd = passwd.encode('utf-8')
+ cfg = {'password': passwd}
+ if 'id' in row:
+ self.port_uid_table[row['port']] = row['id']
+
+ read_config_keys = ['method', 'obfs', 'obfs_param', 'protocol', 'protocol_param', 'forbidden_ip', 'forbidden_port', 'speed_limit_per_con', 'speed_limit_per_user']
+ for name in read_config_keys:
+ if name in row and row[name]:
+ cfg[name] = row[name]
+
+ merge_config_keys = ['password'] + read_config_keys
+ for name in cfg.keys():
+ if hasattr(cfg[name], 'encode'):
+ try:
+ cfg[name] = cfg[name].encode('utf-8')
+ except Exception as e:
+ logging.warning('encode cfg key "%s" fail, val "%s"' % (name, cfg[name]))
+
+ if port not in cur_servers:
+ cur_servers[port] = passwd
+ else:
+ logging.error('more than one user use the same port [%s]' % (port,))
+ continue
+
+ if 'protocol' in cfg and 'protocol_param' in cfg and common.to_str(cfg['protocol']) in obfs.mu_protocol():
+ if '#' in common.to_str(cfg['protocol_param']):
+ mu_servers[port] = passwd
+ allow = True
+
+ if allow:
+ if port not in mu_servers:
+ allow_users[port] = cfg
+
+ cfgchange = False
+ if port in ServerPool.get_instance().tcp_servers_pool:
+ relay = ServerPool.get_instance().tcp_servers_pool[port]
+ for name in merge_config_keys:
+ if name in cfg and not self.cmp(cfg[name], relay._config[name]):
+ cfgchange = True
+ break
+ if not cfgchange and port in ServerPool.get_instance().tcp_ipv6_servers_pool:
+ relay = ServerPool.get_instance().tcp_ipv6_servers_pool[port]
+ for name in merge_config_keys:
+ if (name in cfg) and ((name not in relay._config) or not self.cmp(cfg[name], relay._config[name])):
+ cfgchange = True
+ break
+
+ if port in mu_servers:
+ if ServerPool.get_instance().server_is_run(port) > 0:
+ if cfgchange:
+ logging.info('db stop server at port [%s] reason: config changed: %s' % (port, cfg))
+ ServerPool.get_instance().cb_del_server(port)
+ self.force_update_transfer.add(port)
+ new_servers[port] = (passwd, cfg)
+ else:
+ self.new_server(port, passwd, cfg)
+ else:
+ if ServerPool.get_instance().server_is_run(port) > 0:
+ if config['additional_ports_only'] or not allow:
+ logging.info('db stop server at port [%s]' % (port,))
+ ServerPool.get_instance().cb_del_server(port)
+ self.force_update_transfer.add(port)
+ else:
+ if cfgchange:
+ logging.info('db stop server at port [%s] reason: config changed: %s' % (port, cfg))
+ ServerPool.get_instance().cb_del_server(port)
+ self.force_update_transfer.add(port)
+ new_servers[port] = (passwd, cfg)
+
+ elif not config['additional_ports_only'] and allow and port > 0 and port < 65536 and ServerPool.get_instance().server_run_status(port) is False:
+ self.new_server(port, passwd, cfg)
+
+ for row in last_rows:
+ if row['port'] in cur_servers:
+ pass
+ else:
+ logging.info('db stop server at port [%s] reason: port not exist' % (row['port']))
+ ServerPool.get_instance().cb_del_server(row['port'])
+ self.clear_cache(row['port'])
+ if row['port'] in self.port_uid_table:
+ del self.port_uid_table[row['port']]
+
+ if len(new_servers) > 0:
+ from shadowsocks import eventloop
+ self.event.wait(eventloop.TIMEOUT_PRECISION + eventloop.TIMEOUT_PRECISION / 2)
+ for port in new_servers.keys():
+ passwd, cfg = new_servers[port]
+ self.new_server(port, passwd, cfg)
+
+ logging.debug('db allow users %s \nmu_servers %s' % (allow_users, mu_servers))
+ for port in mu_servers:
+ ServerPool.get_instance().update_mu_users(port, allow_users)
+
+ self.mu_ports = mu_servers
+
+ def clear_cache(self, port):
+ if port in self.force_update_transfer: del self.force_update_transfer[port]
+ if port in self.last_get_transfer: del self.last_get_transfer[port]
+ if port in self.last_update_transfer: del self.last_update_transfer[port]
+
+ def new_server(self, port, passwd, cfg):
+ protocol = cfg.get('protocol', ServerPool.get_instance().config.get('protocol', 'origin'))
+ method = cfg.get('method', ServerPool.get_instance().config.get('method', 'None'))
+ obfs = cfg.get('obfs', ServerPool.get_instance().config.get('obfs', 'plain'))
+ logging.info('db start server at port [%s] pass [%s] protocol [%s] method [%s] obfs [%s]' % (port, passwd, protocol, method, obfs))
+ ServerPool.get_instance().new_server(port, cfg)
+
+ def cmp(self, val1, val2):
+ if type(val1) is bytes:
+ val1 = common.to_str(val1)
+ if type(val2) is bytes:
+ val2 = common.to_str(val2)
+ return val1 == val2
+
+ @staticmethod
+ def del_servers():
+ for port in [v for v in ServerPool.get_instance().tcp_servers_pool.keys()]:
+ if ServerPool.get_instance().server_is_run(port) > 0:
+ ServerPool.get_instance().cb_del_server(port)
+ for port in [v for v in ServerPool.get_instance().tcp_ipv6_servers_pool.keys()]:
+ if ServerPool.get_instance().server_is_run(port) > 0:
+ ServerPool.get_instance().cb_del_server(port)
+
+ @staticmethod
+ def thread_db(obj):
+ import socket
+ import time
+ global db_instance
+ timeout = 60
+ socket.setdefaulttimeout(timeout)
+ last_rows = []
+ db_instance = obj()
+ ServerPool.get_instance()
+ shell.log_shadowsocks_version()
+
+ try:
+ import resource
+ logging.info('current process RLIMIT_NOFILE resource: soft %d hard %d' % resource.getrlimit(resource.RLIMIT_NOFILE))
+ except:
+ pass
+
+ try:
+ while True:
+ load_config()
+ db_instance.load_cfg()
+ try:
+ db_instance.push_db_all_user()
+ rows = db_instance.pull_db_all_user()
+ if rows:
+ db_instance.pull_ok = True
+ config = shell.get_config(False)
+ for port in config['additional_ports']:
+ val = config['additional_ports'][port]
+ val['port'] = int(port)
+ val['enable'] = 1
+ val['transfer_enable'] = 1024 ** 7
+ val['u'] = 0
+ val['d'] = 0
+ if "password" in val:
+ val["passwd"] = val["password"]
+ rows.append(val)
+ db_instance.del_server_out_of_bound_safe(last_rows, rows)
+ last_rows = rows
+ except Exception as e:
+ trace = traceback.format_exc()
+ logging.error(trace)
+ #logging.warn('db thread except:%s' % e)
+ if db_instance.event.wait(get_config().UPDATE_TIME) or not ServerPool.get_instance().thread.is_alive():
+ break
+ except KeyboardInterrupt as e:
+ pass
+ db_instance.del_servers()
+ ServerPool.get_instance().stop()
+ db_instance = None
+
+ @staticmethod
+ def thread_db_stop():
+ global db_instance
+ db_instance.event.set()
+
+class DbTransfer(TransferBase):
+ def __init__(self):
+ super(DbTransfer, self).__init__()
+ self.user_pass = {} #璁板綍鏇存柊姝ょ敤鎴锋祦閲忔椂琚烦杩囧灏戞
+ self.cfg = {
+ "host": "127.0.0.1",
+ "port": 3306,
+ "user": "ss",
+ "password": "pass",
+ "db": "shadowsocks",
+ "node_id": 0,
+ "transfer_mul": 1.0,
+ "ssl_enable": 0,
+ "ssl_ca": "",
+ "ssl_cert": "",
+ "ssl_key": ""}
+ self.load_cfg()
+
+ def load_cfg(self):
+ import json
+ config_path = get_config().MYSQL_CONFIG
+ cfg = None
+ with open(config_path, 'rb+') as f:
+ cfg = json.loads(f.read().decode('utf8'))
+
+ if cfg:
+ self.cfg.update(cfg)
+
+ def update_all_user(self, dt_transfer):
+ import cymysql
+ update_transfer = {}
+
+ query_head = 'UPDATE user'
+ query_sub_when = ''
+ query_sub_when2 = ''
+ query_sub_in = None
+ last_time = time.time()
+
+ for id in dt_transfer.keys():
+ transfer = dt_transfer[id]
+ #灏忎簬鏈浣庢洿鏂版祦閲忕殑鍏堜笉鏇存柊
+ update_trs = 1024 * (2048 - self.user_pass.get(id, 0) * 64)
+ if transfer[0] + transfer[1] < update_trs and id not in self.force_update_transfer:
+ self.user_pass[id] = self.user_pass.get(id, 0) + 1
+ continue
+ if id in self.user_pass:
+ del self.user_pass[id]
+
+ query_sub_when += ' WHEN %s THEN u+%s' % (id, int(transfer[0] * self.cfg["transfer_mul"]))
+ query_sub_when2 += ' WHEN %s THEN d+%s' % (id, int(transfer[1] * self.cfg["transfer_mul"]))
+ update_transfer[id] = transfer
+
+ if query_sub_in is not None:
+ query_sub_in += ',%s' % id
+ else:
+ query_sub_in = '%s' % id
+
+ if query_sub_when == '':
+ return update_transfer
+ query_sql = query_head + ' SET u = CASE port' + query_sub_when + \
+ ' END, d = CASE port' + query_sub_when2 + \
+ ' END, t = ' + str(int(last_time)) + \
+ ' WHERE port IN (%s)' % query_sub_in
+ if self.cfg["ssl_enable"] == 1:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8',
+ ssl={'ca':self.cfg["ssl_ca"],'cert':self.cfg["ssl_cert"],'key':self.cfg["ssl_key"]})
+ else:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8')
+
+ try:
+ cur = conn.cursor()
+ try:
+ cur.execute(query_sql)
+ except Exception as e:
+ logging.error(e)
+ update_transfer = {}
+
+ cur.close()
+ conn.commit()
+ except Exception as e:
+ logging.error(e)
+ update_transfer = {}
+ finally:
+ conn.close()
+
+ return update_transfer
+
+ def pull_db_all_user(self):
+ import cymysql
+ #鏁版嵁搴撴墍鏈夌敤鎴蜂俊鎭
+ if self.cfg["ssl_enable"] == 1:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8',
+ ssl={'ca':self.cfg["ssl_ca"],'cert':self.cfg["ssl_cert"],'key':self.cfg["ssl_key"]})
+ else:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8')
+
+ try:
+ rows = self.pull_db_users(conn)
+ finally:
+ conn.close()
+
+ if not rows:
+ logging.warn('no user in db')
+ return rows
+
+ def pull_db_users(self, conn):
+ try:
+ switchrule = importloader.load('switchrule')
+ keys = switchrule.getKeys(self.key_list)
+ except Exception as e:
+ keys = self.key_list
+
+ cur = conn.cursor()
+ cur.execute("SELECT " + ','.join(keys) + " FROM user")
+ rows = []
+ for r in cur.fetchall():
+ d = {}
+ for column in range(len(keys)):
+ d[keys[column]] = r[column]
+ rows.append(d)
+ cur.close()
+ return rows
+
+class Dbv3Transfer(DbTransfer):
+ def __init__(self):
+ super(Dbv3Transfer, self).__init__()
+ self.update_node_state = True if get_config().API_INTERFACE != 'legendsockssr' else False
+ if self.update_node_state:
+ self.key_list += ['id']
+ self.key_list += ['method']
+ if self.update_node_state:
+ self.ss_node_info_name = 'ss_node_info_log'
+ if get_config().API_INTERFACE == 'sspanelv3ssr':
+ self.key_list += ['obfs', 'protocol']
+ if get_config().API_INTERFACE == 'glzjinmod':
+ self.key_list += ['obfs', 'protocol']
+ self.ss_node_info_name = 'ss_node_info'
+ else:
+ self.key_list += ['obfs', 'protocol']
+ self.start_time = time.time()
+
+ def update_all_user(self, dt_transfer):
+ import cymysql
+ update_transfer = {}
+
+ query_head = 'UPDATE user'
+ query_sub_when = ''
+ query_sub_when2 = ''
+ query_sub_in = None
+ last_time = time.time()
+
+ alive_user_count = len(self.onlineuser_cache)
+ bandwidth_thistime = 0
+
+ if self.cfg["ssl_enable"] == 1:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8',
+ ssl={'ca':self.cfg["ssl_ca"],'cert':self.cfg["ssl_cert"],'key':self.cfg["ssl_key"]})
+ else:
+ conn = cymysql.connect(host=self.cfg["host"], port=self.cfg["port"],
+ user=self.cfg["user"], passwd=self.cfg["password"],
+ db=self.cfg["db"], charset='utf8')
+ conn.autocommit(True)
+
+ for id in dt_transfer.keys():
+ transfer = dt_transfer[id]
+ bandwidth_thistime = bandwidth_thistime + transfer[0] + transfer[1]
+
+ update_trs = 1024 * (2048 - self.user_pass.get(id, 0) * 64)
+ if transfer[0] + transfer[1] < update_trs:
+ self.user_pass[id] = self.user_pass.get(id, 0) + 1
+ continue
+ if id in self.user_pass:
+ del self.user_pass[id]
+
+ query_sub_when += ' WHEN %s THEN u+%s' % (id, int(transfer[0] * self.cfg["transfer_mul"]))
+ query_sub_when2 += ' WHEN %s THEN d+%s' % (id, int(transfer[1] * self.cfg["transfer_mul"]))
+ update_transfer[id] = transfer
+
+ if self.update_node_state:
+ cur = conn.cursor()
+ try:
+ if id in self.port_uid_table:
+ cur.execute("INSERT INTO `user_traffic_log` (`id`, `user_id`, `u`, `d`, `node_id`, `rate`, `traffic`, `log_time`) VALUES (NULL, '" + \
+ str(self.port_uid_table[id]) + "', '" + str(transfer[0]) + "', '" + str(transfer[1]) + "', '" + \
+ str(self.cfg["node_id"]) + "', '" + str(self.cfg["transfer_mul"]) + "', '" + \
+ self.traffic_format((transfer[0] + transfer[1]) * self.cfg["transfer_mul"]) + "', unix_timestamp()); ")
+ except:
+ logging.warn('no `user_traffic_log` in db')
+ cur.close()
+
+ if query_sub_in is not None:
+ query_sub_in += ',%s' % id
+ else:
+ query_sub_in = '%s' % id
+
+ if query_sub_when != '':
+ query_sql = query_head + ' SET u = CASE port' + query_sub_when + \
+ ' END, d = CASE port' + query_sub_when2 + \
+ ' END, t = ' + str(int(last_time)) + \
+ ' WHERE port IN (%s)' % query_sub_in
+ cur = conn.cursor()
+ try:
+ cur.execute(query_sql)
+ except Exception as e:
+ logging.error(e)
+ cur.close()
+
+ if self.update_node_state:
+ try:
+ cur = conn.cursor()
+ try:
+ cur.execute("INSERT INTO `ss_node_online_log` (`id`, `node_id`, `online_user`, `log_time`) VALUES (NULL, '" + \
+ str(self.cfg["node_id"]) + "', '" + str(alive_user_count) + "', unix_timestamp()); ")
+ except Exception as e:
+ logging.error(e)
+ cur.close()
+
+ cur = conn.cursor()
+ try:
+ cur.execute("INSERT INTO `" + self.ss_node_info_name + "` (`id`, `node_id`, `uptime`, `load`, `log_time`) VALUES (NULL, '" + \
+ str(self.cfg["node_id"]) + "', '" + str(self.uptime()) + "', '" + \
+ str(self.load()) + "', unix_timestamp()); ")
+ except Exception as e:
+ logging.error(e)
+ cur.close()
+ except:
+ logging.warn('no `ss_node_online_log` or `" + self.ss_node_info_name + "` in db')
+
+ conn.close()
+ return update_transfer
+
+ def pull_db_users(self, conn):
+ try:
+ switchrule = importloader.load('switchrule')
+ keys = switchrule.getKeys(self.key_list)
+ except Exception as e:
+ keys = self.key_list
+
+ cur = conn.cursor()
+
+ if self.update_node_state:
+ node_info_keys = ['traffic_rate']
+ try:
+ cur.execute("SELECT " + ','.join(node_info_keys) +" FROM ss_node where `id`='" + str(self.cfg["node_id"]) + "'")
+ nodeinfo = cur.fetchone()
+ except Exception as e:
+ logging.error(e)
+ nodeinfo = None
+
+ if nodeinfo == None:
+ rows = []
+ cur.close()
+ conn.commit()
+ logging.warn('None result when select node info from ss_node in db, maybe you set the incorrect node id')
+ return rows
+ cur.close()
+
+ node_info_dict = {}
+ for column in range(len(nodeinfo)):
+ node_info_dict[node_info_keys[column]] = nodeinfo[column]
+ self.cfg['transfer_mul'] = float(node_info_dict['traffic_rate'])
+
+ cur = conn.cursor()
+ try:
+ rows = []
+ cur.execute("SELECT " + ','.join(keys) + " FROM user")
+ for r in cur.fetchall():
+ d = {}
+ for column in range(len(keys)):
+ d[keys[column]] = r[column]
+ rows.append(d)
+ except Exception as e:
+ logging.error(e)
+ cur.close()
+ return rows
+
+ def load(self):
+ import os
+ return os.popen("cat /proc/loadavg | awk '{ print $1\" \"$2\" \"$3 }'").readlines()[0]
+
+ def uptime(self):
+ return time.time() - self.start_time
+
+ def traffic_format(self, traffic):
+ if traffic < 1024 * 8:
+ return str(int(traffic)) + "B";
+
+ if traffic < 1024 * 1024 * 2:
+ return str(round((traffic / 1024.0), 2)) + "KB";
+
+ return str(round((traffic / 1048576.0), 2)) + "MB";
+
+class MuJsonTransfer(TransferBase):
+ def __init__(self):
+ super(MuJsonTransfer, self).__init__()
+
+ def update_all_user(self, dt_transfer):
+ import json
+ rows = None
+
+ config_path = get_config().MUDB_FILE
+ with open(config_path, 'rb+') as f:
+ rows = json.loads(f.read().decode('utf8'))
+ for row in rows:
+ if "port" in row:
+ port = row["port"]
+ if port in dt_transfer:
+ row["u"] += dt_transfer[port][0]
+ row["d"] += dt_transfer[port][1]
+
+ if rows:
+ output = json.dumps(rows, sort_keys=True, indent=4, separators=(',', ': '))
+ with open(config_path, 'r+') as f:
+ f.write(output)
+ f.truncate()
+
+ return dt_transfer
+
+ def pull_db_all_user(self):
+ import json
+ rows = None
+
+ config_path = get_config().MUDB_FILE
+ with open(config_path, 'rb+') as f:
+ rows = json.loads(f.read().decode('utf8'))
+ for row in rows:
+ try:
+ if 'forbidden_ip' in row:
+ row['forbidden_ip'] = common.IPNetwork(row['forbidden_ip'])
+ except Exception as e:
+ logging.error(e)
+ try:
+ if 'forbidden_port' in row:
+ row['forbidden_port'] = common.PortRange(row['forbidden_port'])
+ except Exception as e:
+ logging.error(e)
+
+ if not rows:
+ logging.warn('no user in json file')
+ return rows
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/changelog b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/changelog
new file mode 100644
index 000000000..4e7ad163f
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/changelog
@@ -0,0 +1,5 @@
+shadowsocks (2.1.0-1) unstable; urgency=low
+
+ * Initial release (Closes: #758900)
+
+ -- Shell.Xu Sat, 23 Aug 2014 00:56:04 +0800
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/compat b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/compat
new file mode 100644
index 000000000..45a4fb75d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/compat
@@ -0,0 +1 @@
+8
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/config.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/config.json
new file mode 100644
index 000000000..35cb14a6c
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/config.json
@@ -0,0 +1,11 @@
+{
+ "server":"my_server_ip",
+ "server_port":8388,
+ "local_address": "127.0.0.1",
+ "local_port":1080,
+ "password":"mypassword",
+ "timeout":300,
+ "method":"aes-256-cfb",
+ "fast_open": false,
+ "workers": 1
+}
\ No newline at end of file
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/control b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/control
new file mode 100644
index 000000000..da0092004
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/control
@@ -0,0 +1,19 @@
+Source: shadowsocks
+Section: python
+Priority: extra
+Maintainer: Shell.Xu
+Build-Depends: debhelper (>= 8), python-all (>= 2.6.6-3~), python-setuptools
+Standards-Version: 3.9.5
+Homepage: https://github.com/clowwindy/shadowsocks
+Vcs-Git: git://github.com/shell909090/shadowsocks.git
+Vcs-Browser: http://github.com/shell909090/shadowsocks
+
+Package: shadowsocks
+Architecture: all
+Pre-Depends: dpkg (>= 1.15.6~)
+Depends: ${misc:Depends}, ${python:Depends}, python-pkg-resources, python-m2crypto
+Description: Fast tunnel proxy that helps you bypass firewalls
+ A secure socks5 proxy, designed to protect your Internet traffic.
+ .
+ This package contain local and server part of shadowsocks, a fast,
+ powerful tunnel proxy to bypass firewalls.
\ No newline at end of file
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/copyright b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/copyright
new file mode 100644
index 000000000..7be81625e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/copyright
@@ -0,0 +1,30 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: shadowsocks
+Source: https://github.com/clowwindy/shadowsocks
+
+Files: debian/*
+Copyright: 2014 Shell.Xu
+License: Expat
+
+Files: *
+Copyright: 2014 clowwindy
+License: Expat
+
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/docs b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/docs
new file mode 100644
index 000000000..0208fc1fe
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/docs
@@ -0,0 +1,2 @@
+README.md
+README.rst
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/init.d b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/init.d
new file mode 100644
index 000000000..2f4f3521e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/init.d
@@ -0,0 +1,149 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides: shadowsocks
+# Required-Start: $network $local_fs $remote_fs
+# Required-Stop: $network $local_fs $remote_fs
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Fast tunnel proxy that helps you bypass firewalls
+# Description: A secure socks5 proxy, designed to protect your Internet traffic.
+# This package contain local and server part of shadowsocks, a fast,
+# powerful tunnel proxy to bypass firewalls.
+### END INIT INFO
+
+# Author: Shell.Xu
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC=shadowsocks # Introduce a short description here
+NAME=shadowsocks # Introduce the short server's name here
+DAEMON=/usr/bin/ssserver # Introduce the server's location here
+DAEMON_ARGS="" # Arguments to run the daemon with
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+LOGFILE=/var/log/$NAME.log
+
+# Exit if the package is not installed
+[ -x $DAEMON ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON \
+ --background --make-pidfile --chdir / --chuid $USERID --no-close --test > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON \
+ --background --make-pidfile --chdir / --chuid $USERID --no-close -- \
+ $DAEMON_ARGS $DAEMON_OPTS >> $LOGFILE 2>&1 \
+ || return 2
+ # Add code here, if necessary, that waits for the process to be ready
+ # to handle requests from services started subsequently which depend
+ # on this one. As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE
+ RETVAL="$?"
+ [ "$RETVAL" = 2 ] && return 2
+ # Many daemons don't delete their pidfiles when they exit.
+ rm -f $PIDFILE
+ return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+ #
+ # If the daemon can reload its configuration without
+ # restarting (for example, when it is sent a SIGHUP),
+ # then implement that here.
+ #
+ start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
+ return 0
+}
+
+case "$1" in
+ start)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC " "$NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ stop)
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
+ ;;
+ status)
+ status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+ ;;
+ #reload|force-reload)
+ #
+ # If do_reload() is not implemented then leave this commented out
+ # and leave 'force-reload' as an alias for 'restart'.
+ #
+ #log_daemon_msg "Reloading $DESC" "$NAME"
+ #do_reload
+ #log_end_msg $?
+ #;;
+ restart|force-reload)
+ #
+ # If the "reload" option is implemented then remove the
+ # 'force-reload' alias
+ #
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+ *)
+ #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+ echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+ exit 3
+ ;;
+esac
+
+:
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/install b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/install
new file mode 100644
index 000000000..a61486462
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/install
@@ -0,0 +1 @@
+debian/config.json etc/shadowsocks/
\ No newline at end of file
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/rules b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/rules
new file mode 100755
index 000000000..62e2bb6f6
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/rules
@@ -0,0 +1,5 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+
+%:
+ dh $@ --with python2 --buildsystem=python_distutils
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.default b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.default
new file mode 100644
index 000000000..a52060279
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.default
@@ -0,0 +1,12 @@
+# Defaults for shadowsocks initscript
+# sourced by /etc/init.d/shadowsocks
+# installed at /etc/default/shadowsocks by the maintainer scripts
+
+USERID="nobody"
+
+#
+# This is a POSIX shell fragment
+#
+
+# Additional options that are passed to the Daemon.
+DAEMON_OPTS="-q -c /etc/shadowsocks/config.json"
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.manpages b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.manpages
new file mode 100644
index 000000000..3df8a3341
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/shadowsocks.manpages
@@ -0,0 +1,2 @@
+debian/sslocal.1
+debian/ssserver.1
\ No newline at end of file
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/source/format b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/source/format
new file mode 100644
index 000000000..163aaf8d8
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/sslocal.1 b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/sslocal.1
new file mode 100644
index 000000000..0c2cf5165
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/sslocal.1
@@ -0,0 +1,59 @@
+.\" Hey, EMACS: -*- nroff -*-
+.\" (C) Copyright 2014 Shell.Xu ,
+.\"
+.TH SHADOWSOCKS 1 "August 23, 2014"
+.SH NAME
+shadowsocks \- Fast tunnel proxy that helps you bypass firewalls
+.SH SYNOPSIS
+.B ssserver
+.RI [ options ]
+.br
+.B sslocal
+.RI [ options ]
+.SH DESCRIPTION
+shadowsocks is a tunnel proxy helps you bypass firewall.
+.B ssserver
+is the server part, and
+.B sslocal
+is the local part.
+.SH OPTIONS
+.TP
+.B \-h, \-\-help
+Show this help message and exit.
+.TP
+.B \-s SERVER_ADDR
+Server address, default: 0.0.0.0.
+.TP
+.B \-p SERVER_PORT
+Server port, default: 8388.
+.TP
+.B \-k PASSWORD
+Password.
+.TP
+.B \-m METHOD
+Encryption method, default: aes-256-cfb.
+.TP
+.B \-t TIMEOUT
+Timeout in seconds, default: 300.
+.TP
+.B \-c CONFIG
+Path to config file.
+.TP
+.B \-\-fast-open
+Use TCP_FASTOPEN, requires Linux 3.7+.
+.TP
+.B \-\-workers WORKERS
+Number of workers, available on Unix/Linux.
+.TP
+.B \-v, \-vv
+Verbose mode.
+.TP
+.B \-q, \-qq
+Quiet mode, only show warnings/errors.
+.SH SEE ALSO
+.br
+The programs are documented fully by
+.IR "Shell Xu "
+and
+.IR "Clowwindy ",
+available via the Info system.
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/ssserver.1 b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/ssserver.1
new file mode 100644
index 000000000..0c2cf5165
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/debian/ssserver.1
@@ -0,0 +1,59 @@
+.\" Hey, EMACS: -*- nroff -*-
+.\" (C) Copyright 2014 Shell.Xu ,
+.\"
+.TH SHADOWSOCKS 1 "August 23, 2014"
+.SH NAME
+shadowsocks \- Fast tunnel proxy that helps you bypass firewalls
+.SH SYNOPSIS
+.B ssserver
+.RI [ options ]
+.br
+.B sslocal
+.RI [ options ]
+.SH DESCRIPTION
+shadowsocks is a tunnel proxy helps you bypass firewall.
+.B ssserver
+is the server part, and
+.B sslocal
+is the local part.
+.SH OPTIONS
+.TP
+.B \-h, \-\-help
+Show this help message and exit.
+.TP
+.B \-s SERVER_ADDR
+Server address, default: 0.0.0.0.
+.TP
+.B \-p SERVER_PORT
+Server port, default: 8388.
+.TP
+.B \-k PASSWORD
+Password.
+.TP
+.B \-m METHOD
+Encryption method, default: aes-256-cfb.
+.TP
+.B \-t TIMEOUT
+Timeout in seconds, default: 300.
+.TP
+.B \-c CONFIG
+Path to config file.
+.TP
+.B \-\-fast-open
+Use TCP_FASTOPEN, requires Linux 3.7+.
+.TP
+.B \-\-workers WORKERS
+Number of workers, available on Unix/Linux.
+.TP
+.B \-v, \-vv
+Verbose mode.
+.TP
+.B \-q, \-qq
+Quiet mode, only show warnings/errors.
+.SH SEE ALSO
+.br
+The programs are documented fully by
+.IR "Shell Xu "
+and
+.IR "Clowwindy ",
+available via the Info system.
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/importloader.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/importloader.py
new file mode 100644
index 000000000..c917cb7d9
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/importloader.py
@@ -0,0 +1,24 @@
+锘#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+def load(name):
+ try:
+ obj = __import__(name)
+ reload(obj)
+ return obj
+ except:
+ pass
+
+ try:
+ import importlib
+ obj = importlib.__import__(name)
+ importlib.reload(obj)
+ return obj
+ except:
+ pass
+
+def loads(namelist):
+ for name in namelist:
+ obj = load(name)
+ if obj is not None:
+ return obj
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.bat b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.bat
new file mode 100644
index 000000000..6d0bce695
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.bat
@@ -0,0 +1,4 @@
+@echo off
+If Not Exist "userapiconfig.py" Copy "apiconfig.py" "userapiconfig.py"
+If Not Exist "user-config.json" Copy "config.json" "user-config.json"
+If Not Exist "usermysql.json" Copy "mysql.json" "usermysql.json"
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.sh
new file mode 100755
index 000000000..862d1abed
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initcfg.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+chmod +x *.sh
+chmod +x shadowsocks/*.sh
+cp -n apiconfig.py userapiconfig.py
+cp -n config.json user-config.json
+cp -n mysql.json usermysql.json
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initmudbjson.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initmudbjson.sh
new file mode 100755
index 000000000..09b07f332
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/initmudbjson.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+bash initcfg.sh
+sed -i "s/API_INTERFACE = .\+\?\#/API_INTERFACE = \'mudbjson\' \#/g" userapiconfig.py
+ip_addr=`ifconfig -a|grep inet|grep -v inet6|grep -v "127.0.0."|grep -v -e "192\.168\..[0-9]\+\.[0-9]\+"|grep -v -e "10\.[0-9]\+\.[0-9]\+\.[0-9]\+"|awk '{print $2}'|tr -d "addr:"`
+ip_count=`echo $ip_addr|grep -e "^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$" -c`
+
+if [[ $ip_count == 1 ]]; then
+ ip_addr=`ip a|grep inet|grep -v inet6|grep -v "127.0.0."|grep -v -e "192\.168\..[0-9]\+\.[0-9]\+"|grep -v -e "10\.[0-9]\+\.[0-9]\+\.[0-9]\+"|awk '{print $2}'`
+ ip_addr=${ip_addr%/*}
+ ip_count=`echo $ip_addr|grep -e "^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$" -c`
+fi
+if [[ $ip_count == 1 ]]; then
+ echo "server IP is "${ip_addr}
+ sed -i "s/SERVER_PUB_ADDR = .\+/SERVER_PUB_ADDR = \'"${ip_addr}"\'/g" userapiconfig.py
+ user_count=`python mujson_mgr.py -l|grep -c -e "[0-9]"`
+ if [[ $user_count == 0 ]]; then
+ port=`python -c 'import random;print(random.randint(10000, 65536))'`
+ python mujson_mgr.py -a -p ${port}
+ fi
+else
+ echo "unable to detect server IP"
+fi
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/logrun.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/logrun.sh
new file mode 100755
index 000000000..94153fe9e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/logrun.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+cd `dirname $0`
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py m" | awk '{print "kill "$2}')
+ulimit -n 512000
+nohup ${python_ver} server.py m>> ssserver.log 2>&1 &
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mudb.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mudb.json
new file mode 100644
index 000000000..0d4f101c7
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mudb.json
@@ -0,0 +1,2 @@
+[
+]
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mujson_mgr.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mujson_mgr.py
new file mode 100644
index 000000000..2eb05d59d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mujson_mgr.py
@@ -0,0 +1,358 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+import traceback
+from shadowsocks import shell, common
+from configloader import load_config, get_config
+import random
+import getopt
+import sys
+import json
+import base64
+
+
+class MuJsonLoader(object):
+ def __init__(self):
+ self.json = None
+
+ def load(self, path):
+ l = "[]"
+ try:
+ with open(path, 'rb+') as f:
+ l = f.read().decode('utf8')
+ except:
+ pass
+ self.json = json.loads(l)
+
+ def save(self, path):
+ if self.json is not None:
+ output = json.dumps(self.json, sort_keys=True, indent=4, separators=(',', ': '))
+ with open(path, 'a'):
+ pass
+ with open(path, 'rb+') as f:
+ f.write(output.encode('utf8'))
+ f.truncate()
+
+
+class MuMgr(object):
+ def __init__(self):
+ self.config_path = get_config().MUDB_FILE
+ try:
+ self.server_addr = get_config().SERVER_PUB_ADDR
+ except:
+ self.server_addr = '127.0.0.1'
+ self.data = MuJsonLoader()
+
+ if self.server_addr == '127.0.0.1':
+ self.server_addr = self.getipaddr()
+
+ def getipaddr(self, ifname='eth0'):
+ import socket
+ import struct
+ ret = '127.0.0.1'
+ try:
+ ret = socket.gethostbyname(socket.getfqdn(socket.gethostname()))
+ except:
+ pass
+ if ret == '127.0.0.1':
+ try:
+ import fcntl
+ s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ ret = socket.inet_ntoa(fcntl.ioctl(s.fileno(), 0x8915, struct.pack('256s', ifname[:15]))[20:24])
+ except:
+ pass
+ return ret
+
+ def ssrlink(self, user, encode, muid):
+ protocol = user.get('protocol', '')
+ obfs = user.get('obfs', '')
+ protocol = protocol.replace("_compatible", "")
+ obfs = obfs.replace("_compatible", "")
+ protocol_param = ''
+ if muid is not None:
+ protocol_param_ = user.get('protocol_param', '')
+ param = protocol_param_.split('#')
+ if len(param) == 2:
+ for row in self.data.json:
+ if int(row['port']) == muid:
+ param = str(muid) + ':' + row['passwd']
+ protocol_param = '/?protoparam=' + common.to_str(base64.urlsafe_b64encode(common.to_bytes(param))).replace("=", "")
+ break
+ link = ("%s:%s:%s:%s:%s:%s" % (self.server_addr, user['port'], protocol, user['method'], obfs, common.to_str(base64.urlsafe_b64encode(common.to_bytes(user['passwd']))).replace("=", ""))) + protocol_param
+ return "ssr://" + (encode and common.to_str(base64.urlsafe_b64encode(common.to_bytes(link))).replace("=", "") or link)
+
+ def userinfo(self, user, muid = None):
+ ret = ""
+ key_list = ['user', 'port', 'method', 'passwd', 'protocol', 'protocol_param', 'obfs', 'obfs_param', 'transfer_enable', 'u', 'd']
+ for key in sorted(user):
+ if key not in key_list:
+ key_list.append(key)
+ for key in key_list:
+ if key in ['enable'] or key not in user:
+ continue
+ ret += '\n'
+ if (muid is not None) and (key in ['protocol_param']):
+ for row in self.data.json:
+ if int(row['port']) == muid:
+ ret += " %s : %s" % (key, str(muid) + ':' + row['passwd'])
+ break
+ elif key in ['transfer_enable', 'u', 'd']:
+ if muid is not None:
+ for row in self.data.json:
+ if int(row['port']) == muid:
+ val = row[key]
+ break
+ else:
+ val = user[key]
+ if val / 1024 < 4:
+ ret += " %s : %s" % (key, val)
+ elif val / 1024 ** 2 < 4:
+ val /= float(1024)
+ ret += " %s : %s K Bytes" % (key, val)
+ elif val / 1024 ** 3 < 4:
+ val /= float(1024 ** 2)
+ ret += " %s : %s M Bytes" % (key, val)
+ else:
+ val /= float(1024 ** 3)
+ ret += " %s : %s G Bytes" % (key, val)
+ else:
+ ret += " %s : %s" % (key, user[key])
+ ret += "\n " + self.ssrlink(user, False, muid)
+ ret += "\n " + self.ssrlink(user, True, muid)
+ return ret
+
+ def rand_pass(self):
+ return ''.join([random.choice('''ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789~-_=+(){}[]^&%$@''') for i in range(8)])
+
+ def add(self, user):
+ up = {'enable': 1, 'u': 0, 'd': 0, 'method': "aes-128-ctr",
+ 'protocol': "auth_aes128_md5",
+ 'obfs': "tls1.2_ticket_auth_compatible",
+ 'transfer_enable': 9007199254740992}
+ up['passwd'] = self.rand_pass()
+ up.update(user)
+
+ self.data.load(self.config_path)
+ for row in self.data.json:
+ match = False
+ if 'user' in user and row['user'] == user['user']:
+ match = True
+ if 'port' in user and row['port'] == user['port']:
+ match = True
+ if match:
+ print("user [%s] port [%s] already exist" % (row['user'], row['port']))
+ return
+ self.data.json.append(up)
+ print("### add user info %s" % self.userinfo(up))
+ self.data.save(self.config_path)
+
+ def edit(self, user):
+ self.data.load(self.config_path)
+ for row in self.data.json:
+ match = True
+ if 'user' in user and row['user'] != user['user']:
+ match = False
+ if 'port' in user and row['port'] != user['port']:
+ match = False
+ if match:
+ print("edit user [%s]" % (row['user'],))
+ row.update(user)
+ print("### new user info %s" % self.userinfo(row))
+ break
+ self.data.save(self.config_path)
+
+ def delete(self, user):
+ self.data.load(self.config_path)
+ index = 0
+ for row in self.data.json:
+ match = True
+ if 'user' in user and row['user'] != user['user']:
+ match = False
+ if 'port' in user and row['port'] != user['port']:
+ match = False
+ if match:
+ print("delete user [%s]" % row['user'])
+ del self.data.json[index]
+ break
+ index += 1
+ self.data.save(self.config_path)
+
+ def clear_ud(self, user):
+ up = {'u': 0, 'd': 0}
+ self.data.load(self.config_path)
+ for row in self.data.json:
+ match = True
+ if 'user' in user and row['user'] != user['user']:
+ match = False
+ if 'port' in user and row['port'] != user['port']:
+ match = False
+ if match:
+ row.update(up)
+ print("clear user [%s]" % row['user'])
+ self.data.save(self.config_path)
+
+ def list_user(self, user):
+ self.data.load(self.config_path)
+ if not user:
+ for row in self.data.json:
+ print("user [%s] port %s" % (row['user'], row['port']))
+ return
+ for row in self.data.json:
+ match = True
+ if 'user' in user and row['user'] != user['user']:
+ match = False
+ if 'port' in user and row['port'] != user['port']:
+ match = False
+ if match:
+ muid = None
+ if 'muid' in user:
+ muid = user['muid']
+ print("### user [%s] info %s" % (row['user'], self.userinfo(row, muid)))
+
+
+def print_server_help():
+ print('''usage: python mujson_manage.py -a|-d|-e|-c|-l [OPTION]...
+
+Actions:
+ -a add/edit a user
+ -d delete a user
+ -e edit a user
+ -c set u&d to zero
+ -l display a user infomation or all users infomation
+
+Options:
+ -u USER the user name
+ -p PORT server port (only this option must be set if add a user)
+ -k PASSWORD password
+ -m METHOD encryption method, default: aes-128-ctr
+ -O PROTOCOL protocol plugin, default: auth_aes128_md5
+ -o OBFS obfs plugin, default: tls1.2_ticket_auth_compatible
+ -G PROTOCOL_PARAM protocol plugin param
+ -g OBFS_PARAM obfs plugin param
+ -t TRANSFER max transfer for G bytes, default: 8388608 (8 PB or 8192 TB)
+ -f FORBID set forbidden ports. Example (ban 1~79 and 81~100): -f "1-79,81-100"
+ -i MUID set sub id to display (only work with -l)
+ -s SPEED set speed_limit_per_con
+ -S SPEED set speed_limit_per_user
+
+General options:
+ -h, --help show this help message and exit
+''')
+
+
+def main():
+ shortopts = 'adeclu:i:p:k:O:o:G:g:m:t:f:hs:S:'
+ longopts = ['help']
+ action = None
+ user = {}
+ fast_set_obfs = {'0': 'plain',
+ '+1': 'http_simple_compatible',
+ '1': 'http_simple',
+ '+2': 'tls1.2_ticket_auth_compatible',
+ '2': 'tls1.2_ticket_auth'}
+ fast_set_protocol = {'0': 'origin',
+ 's4': 'auth_sha1_v4',
+ '+s4': 'auth_sha1_v4_compatible',
+ 'am': 'auth_aes128_md5',
+ 'as': 'auth_aes128_sha1',
+ 'ca': 'auth_chain_a',
+ }
+ fast_set_method = {'0': 'none',
+ 'a1c': 'aes-128-cfb',
+ 'a2c': 'aes-192-cfb',
+ 'a3c': 'aes-256-cfb',
+ 'r': 'rc4-md5',
+ 'r6': 'rc4-md5-6',
+ 'c': 'chacha20',
+ 'ci': 'chacha20-ietf',
+ 's': 'salsa20',
+ 'a1': 'aes-128-ctr',
+ 'a2': 'aes-192-ctr',
+ 'a3': 'aes-256-ctr'}
+ try:
+ optlist, args = getopt.getopt(sys.argv[1:], shortopts, longopts)
+ for key, value in optlist:
+ if key == '-a':
+ action = 1
+ elif key == '-d':
+ action = 2
+ elif key == '-e':
+ action = 3
+ elif key == '-l':
+ action = 4
+ elif key == '-c':
+ action = 0
+ elif key == '-u':
+ user['user'] = value
+ elif key == '-i':
+ user['muid'] = int(value)
+ elif key == '-p':
+ user['port'] = int(value)
+ elif key == '-k':
+ user['passwd'] = value
+ elif key == '-o':
+ if value in fast_set_obfs:
+ user['obfs'] = fast_set_obfs[value]
+ else:
+ user['obfs'] = value
+ elif key == '-O':
+ if value in fast_set_protocol:
+ user['protocol'] = fast_set_protocol[value]
+ else:
+ user['protocol'] = value
+ elif key == '-g':
+ user['obfs_param'] = value
+ elif key == '-G':
+ user['protocol_param'] = value
+ elif key == '-s':
+ user['speed_limit_per_con'] = int(value)
+ elif key == '-S':
+ user['speed_limit_per_user'] = int(value)
+ elif key == '-m':
+ if value in fast_set_method:
+ user['method'] = fast_set_method[value]
+ else:
+ user['method'] = value
+ elif key == '-f':
+ user['forbidden_port'] = value
+ elif key == '-t':
+ val = float(value)
+ try:
+ val = int(value)
+ except:
+ pass
+ user['transfer_enable'] = int(val * 1024) * (1024 ** 2)
+ elif key in ('-h', '--help'):
+ print_server_help()
+ sys.exit(0)
+ except getopt.GetoptError as e:
+ print(e)
+ sys.exit(2)
+
+ manage = MuMgr()
+ if action == 0:
+ manage.clear_ud(user)
+ elif action == 1:
+ if 'user' not in user and 'port' in user:
+ user['user'] = str(user['port'])
+ if 'user' in user and 'port' in user:
+ manage.add(user)
+ else:
+ print("You have to set the port with -p")
+ elif action == 2:
+ if 'user' in user or 'port' in user:
+ manage.delete(user)
+ else:
+ print("You have to set the user name or port with -u/-p")
+ elif action == 3:
+ if 'user' in user or 'port' in user:
+ manage.edit(user)
+ else:
+ print("You have to set the user name or port with -u/-p")
+ elif action == 4:
+ manage.list_user(user)
+ elif action is None:
+ print_server_help()
+
+if __name__ == '__main__':
+ main()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mysql.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mysql.json
new file mode 100644
index 000000000..1849e9e81
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/mysql.json
@@ -0,0 +1,13 @@
+{
+ "host": "127.0.0.1",
+ "port": 3306,
+ "user": "ss",
+ "password": "pass",
+ "db": "sspanel",
+ "node_id": 0,
+ "transfer_mul": 1.0,
+ "ssl_enable": 0,
+ "ssl_ca": "",
+ "ssl_cert": "",
+ "ssl_key": ""
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/run.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/run.sh
new file mode 100755
index 000000000..0de8d204c
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/run.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+cd `dirname $0`
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py m" | awk '{print "kill "$2}')
+ulimit -n 512000
+nohup ${python_ver} server.py m>> /dev/null 2>&1 &
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server.py
new file mode 100644
index 000000000..ba863b684
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server.py
@@ -0,0 +1,66 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 breakwall
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import time
+import sys
+import threading
+import os
+
+if __name__ == '__main__':
+ import inspect
+ os.chdir(os.path.dirname(os.path.realpath(inspect.getfile(inspect.currentframe()))))
+
+import server_pool
+import db_transfer
+from shadowsocks import shell
+from configloader import load_config, get_config
+
+class MainThread(threading.Thread):
+ def __init__(self, obj):
+ super(MainThread, self).__init__()
+ self.daemon = True
+ self.obj = obj
+
+ def run(self):
+ self.obj.thread_db(self.obj)
+
+ def stop(self):
+ self.obj.thread_db_stop()
+
+def main():
+ shell.check_python()
+ if False:
+ db_transfer.DbTransfer.thread_db()
+ else:
+ if get_config().API_INTERFACE == 'mudbjson':
+ thread = MainThread(db_transfer.MuJsonTransfer)
+ elif get_config().API_INTERFACE == 'sspanelv2':
+ thread = MainThread(db_transfer.DbTransfer)
+ else:
+ thread = MainThread(db_transfer.Dbv3Transfer)
+ thread.start()
+ try:
+ while thread.is_alive():
+ thread.join(10.0)
+ except (KeyboardInterrupt, IOError, OSError) as e:
+ import traceback
+ traceback.print_exc()
+ thread.stop()
+
+if __name__ == '__main__':
+ main()
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server_pool.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server_pool.py
new file mode 100644
index 000000000..d159817a3
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/server_pool.py
@@ -0,0 +1,293 @@
+锘#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2014 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import os
+import logging
+import struct
+import time
+from shadowsocks import shell, eventloop, tcprelay, udprelay, asyncdns, common
+import threading
+import sys
+import traceback
+from socket import *
+from configloader import load_config, get_config
+
+class MainThread(threading.Thread):
+ def __init__(self, params):
+ super(MainThread, self).__init__()
+ self.params = params
+
+ def run(self):
+ ServerPool._loop(*self.params)
+
+class ServerPool(object):
+
+ instance = None
+
+ def __init__(self):
+ shell.check_python()
+ self.config = shell.get_config(False)
+ self.dns_resolver = asyncdns.DNSResolver()
+ if not self.config.get('dns_ipv6', False):
+ asyncdns.IPV6_CONNECTION_SUPPORT = False
+
+ self.mgr = None #asyncmgr.ServerMgr()
+
+ self.tcp_servers_pool = {}
+ self.tcp_ipv6_servers_pool = {}
+ self.udp_servers_pool = {}
+ self.udp_ipv6_servers_pool = {}
+ self.stat_counter = {}
+
+ self.loop = eventloop.EventLoop()
+ self.thread = MainThread( (self.loop, self.dns_resolver, self.mgr) )
+ self.thread.start()
+
+ @staticmethod
+ def get_instance():
+ if ServerPool.instance is None:
+ ServerPool.instance = ServerPool()
+ return ServerPool.instance
+
+ def stop(self):
+ self.loop.stop()
+
+ @staticmethod
+ def _loop(loop, dns_resolver, mgr):
+ try:
+ if mgr is not None:
+ mgr.add_to_loop(loop)
+ dns_resolver.add_to_loop(loop)
+ loop.run()
+ except (KeyboardInterrupt, IOError, OSError) as e:
+ logging.error(e)
+ traceback.print_exc()
+ os.exit(0)
+ except Exception as e:
+ logging.error(e)
+ traceback.print_exc()
+
+ def server_is_run(self, port):
+ port = int(port)
+ ret = 0
+ if port in self.tcp_servers_pool:
+ ret = 1
+ if port in self.tcp_ipv6_servers_pool:
+ ret |= 2
+ return ret
+
+ def server_run_status(self, port):
+ if 'server' in self.config:
+ if port not in self.tcp_servers_pool:
+ return False
+ if 'server_ipv6' in self.config:
+ if port not in self.tcp_ipv6_servers_pool:
+ return False
+ return True
+
+ def new_server(self, port, user_config):
+ ret = True
+ port = int(port)
+ ipv6_ok = False
+
+ if 'server_ipv6' in self.config:
+ if port in self.tcp_ipv6_servers_pool:
+ logging.info("server already at %s:%d" % (self.config['server_ipv6'], port))
+ return 'this port server is already running'
+ else:
+ a_config = self.config.copy()
+ a_config.update(user_config)
+ if len(a_config['server_ipv6']) > 2 and a_config['server_ipv6'][0] == "[" and a_config['server_ipv6'][-1] == "]":
+ a_config['server_ipv6'] = a_config['server_ipv6'][1:-1]
+ a_config['server'] = a_config['server_ipv6']
+ a_config['server_port'] = port
+ a_config['max_connect'] = 128
+ a_config['method'] = common.to_str(a_config['method'])
+ try:
+ logging.info("starting server at [%s]:%d" % (common.to_str(a_config['server']), port))
+
+ tcp_server = tcprelay.TCPRelay(a_config, self.dns_resolver, False, stat_counter=self.stat_counter)
+ tcp_server.add_to_loop(self.loop)
+ self.tcp_ipv6_servers_pool.update({port: tcp_server})
+
+ udp_server = udprelay.UDPRelay(a_config, self.dns_resolver, False, stat_counter=self.stat_counter)
+ udp_server.add_to_loop(self.loop)
+ self.udp_ipv6_servers_pool.update({port: udp_server})
+
+ if common.to_str(a_config['server_ipv6']) == "::":
+ ipv6_ok = True
+ except Exception as e:
+ logging.warn("IPV6 %s " % (e,))
+
+ if 'server' in self.config:
+ if port in self.tcp_servers_pool:
+ logging.info("server already at %s:%d" % (common.to_str(self.config['server']), port))
+ return 'this port server is already running'
+ else:
+ a_config = self.config.copy()
+ a_config.update(user_config)
+ a_config['server_port'] = port
+ a_config['max_connect'] = 128
+ a_config['method'] = common.to_str(a_config['method'])
+ try:
+ logging.info("starting server at %s:%d" % (common.to_str(a_config['server']), port))
+
+ tcp_server = tcprelay.TCPRelay(a_config, self.dns_resolver, False)
+ tcp_server.add_to_loop(self.loop)
+ self.tcp_servers_pool.update({port: tcp_server})
+
+ udp_server = udprelay.UDPRelay(a_config, self.dns_resolver, False)
+ udp_server.add_to_loop(self.loop)
+ self.udp_servers_pool.update({port: udp_server})
+
+ except Exception as e:
+ if not ipv6_ok:
+ logging.warn("IPV4 %s " % (e,))
+
+ return True
+
+ def del_server(self, port):
+ port = int(port)
+ logging.info("del server at %d" % port)
+ try:
+ udpsock = socket(AF_INET, SOCK_DGRAM)
+ udpsock.sendto('%s:%s:0:0' % (get_config().MANAGE_PASS, port), (get_config().MANAGE_BIND_IP, get_config().MANAGE_PORT))
+ udpsock.close()
+ except Exception as e:
+ logging.warn(e)
+ return True
+
+ def cb_del_server(self, port):
+ port = int(port)
+
+ if port not in self.tcp_servers_pool:
+ logging.info("stopped server at %s:%d already stop" % (self.config['server'], port))
+ else:
+ logging.info("stopped server at %s:%d" % (self.config['server'], port))
+ try:
+ self.tcp_servers_pool[port].close(True)
+ del self.tcp_servers_pool[port]
+ except Exception as e:
+ logging.warn(e)
+ try:
+ self.udp_servers_pool[port].close(True)
+ del self.udp_servers_pool[port]
+ except Exception as e:
+ logging.warn(e)
+
+ if 'server_ipv6' in self.config:
+ if port not in self.tcp_ipv6_servers_pool:
+ logging.info("stopped server at [%s]:%d already stop" % (self.config['server_ipv6'], port))
+ else:
+ logging.info("stopped server at [%s]:%d" % (self.config['server_ipv6'], port))
+ try:
+ self.tcp_ipv6_servers_pool[port].close(True)
+ del self.tcp_ipv6_servers_pool[port]
+ except Exception as e:
+ logging.warn(e)
+ try:
+ self.udp_ipv6_servers_pool[port].close(True)
+ del self.udp_ipv6_servers_pool[port]
+ except Exception as e:
+ logging.warn(e)
+
+ return True
+
+ def update_mu_users(self, port, users):
+ port = int(port)
+ if port in self.tcp_servers_pool:
+ try:
+ self.tcp_servers_pool[port].update_users(users)
+ except Exception as e:
+ logging.warn(e)
+ try:
+ self.udp_servers_pool[port].update_users(users)
+ except Exception as e:
+ logging.warn(e)
+ if port in self.tcp_ipv6_servers_pool:
+ try:
+ self.tcp_ipv6_servers_pool[port].update_users(users)
+ except Exception as e:
+ logging.warn(e)
+ try:
+ self.udp_ipv6_servers_pool[port].update_users(users)
+ except Exception as e:
+ logging.warn(e)
+
+ def get_server_transfer(self, port):
+ port = int(port)
+ uid = struct.pack(' 63:
+ return None
+ results.append(common.chr(l))
+ results.append(label)
+ results.append(b'\0')
+ return b''.join(results)
+
+
+def build_request(address, qtype):
+ request_id = os.urandom(2)
+ header = struct.pack('!BBHHHH', 1, 0, 1, 0, 0, 0)
+ addr = build_address(address)
+ qtype_qclass = struct.pack('!HH', qtype, QCLASS_IN)
+ return request_id + header + addr + qtype_qclass
+
+
+def parse_ip(addrtype, data, length, offset):
+ if addrtype == QTYPE_A:
+ return socket.inet_ntop(socket.AF_INET, data[offset:offset + length])
+ elif addrtype == QTYPE_AAAA:
+ return socket.inet_ntop(socket.AF_INET6, data[offset:offset + length])
+ elif addrtype in [QTYPE_CNAME, QTYPE_NS]:
+ return parse_name(data, offset)[1]
+ else:
+ return data[offset:offset + length]
+
+
+def parse_name(data, offset):
+ p = offset
+ labels = []
+ l = common.ord(data[p])
+ while l > 0:
+ if (l & (128 + 64)) == (128 + 64):
+ # pointer
+ pointer = struct.unpack('!H', data[p:p + 2])[0]
+ pointer &= 0x3FFF
+ r = parse_name(data, pointer)
+ labels.append(r[1])
+ p += 2
+ # pointer is the end
+ return p - offset, b'.'.join(labels)
+ else:
+ labels.append(data[p + 1:p + 1 + l])
+ p += 1 + l
+ l = common.ord(data[p])
+ return p - offset + 1, b'.'.join(labels)
+
+
+# rfc1035
+# record
+# 1 1 1 1 1 1
+# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+# | |
+# / /
+# / NAME /
+# | |
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+# | TYPE |
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+# | CLASS |
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+# | TTL |
+# | |
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+# | RDLENGTH |
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--|
+# / RDATA /
+# / /
+# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+def parse_record(data, offset, question=False):
+ nlen, name = parse_name(data, offset)
+ if not question:
+ record_type, record_class, record_ttl, record_rdlength = struct.unpack(
+ '!HHiH', data[offset + nlen:offset + nlen + 10]
+ )
+ ip = parse_ip(record_type, data, record_rdlength, offset + nlen + 10)
+ return nlen + 10 + record_rdlength, \
+ (name, ip, record_type, record_class, record_ttl)
+ else:
+ record_type, record_class = struct.unpack(
+ '!HH', data[offset + nlen:offset + nlen + 4]
+ )
+ return nlen + 4, (name, None, record_type, record_class, None, None)
+
+
+def parse_header(data):
+ if len(data) >= 12:
+ header = struct.unpack('!HBBHHHH', data[:12])
+ res_id = header[0]
+ res_qr = header[1] & 128
+ res_tc = header[1] & 2
+ res_ra = header[2] & 128
+ res_rcode = header[2] & 15
+ # assert res_tc == 0
+ # assert res_rcode in [0, 3]
+ res_qdcount = header[3]
+ res_ancount = header[4]
+ res_nscount = header[5]
+ res_arcount = header[6]
+ return (res_id, res_qr, res_tc, res_ra, res_rcode, res_qdcount,
+ res_ancount, res_nscount, res_arcount)
+ return None
+
+
+def parse_response(data):
+ try:
+ if len(data) >= 12:
+ header = parse_header(data)
+ if not header:
+ return None
+ res_id, res_qr, res_tc, res_ra, res_rcode, res_qdcount, \
+ res_ancount, res_nscount, res_arcount = header
+
+ qds = []
+ ans = []
+ offset = 12
+ for i in range(0, res_qdcount):
+ l, r = parse_record(data, offset, True)
+ offset += l
+ if r:
+ qds.append(r)
+ for i in range(0, res_ancount):
+ l, r = parse_record(data, offset)
+ offset += l
+ if r:
+ ans.append(r)
+ for i in range(0, res_nscount):
+ l, r = parse_record(data, offset)
+ offset += l
+ for i in range(0, res_arcount):
+ l, r = parse_record(data, offset)
+ offset += l
+ response = DNSResponse()
+ if qds:
+ response.hostname = qds[0][0]
+ for an in qds:
+ response.questions.append((an[1], an[2], an[3]))
+ for an in ans:
+ response.answers.append((an[1], an[2], an[3]))
+ return response
+ except Exception as e:
+ shell.print_exception(e)
+ return None
+
+
+def is_valid_hostname(hostname):
+ if len(hostname) > 255:
+ return False
+ if hostname[-1] == b'.':
+ hostname = hostname[:-1]
+ return all(VALID_HOSTNAME.match(x) for x in hostname.split(b'.'))
+
+
+class DNSResponse(object):
+ def __init__(self):
+ self.hostname = None
+ self.questions = [] # each: (addr, type, class)
+ self.answers = [] # each: (addr, type, class)
+
+ def __str__(self):
+ return '%s: %s' % (self.hostname, str(self.answers))
+
+
+STATUS_IPV4 = 0
+STATUS_IPV6 = 1
+
+
+class DNSResolver(object):
+ def __init__(self, black_hostname_list=None):
+ self._loop = None
+ self._hosts = {}
+ self._hostname_status = {}
+ self._hostname_to_cb = {}
+ self._cb_to_hostname = {}
+ self._cache = lru_cache.LRUCache(timeout=300)
+ # read black_hostname_list from config
+ if type(black_hostname_list) != list:
+ self._black_hostname_list = []
+ else:
+ self._black_hostname_list = list(map(
+ (lambda t: t if type(t) == bytes else t.encode('utf8')),
+ black_hostname_list
+ ))
+ logging.info('black_hostname_list init as : ' + str(self._black_hostname_list))
+ self._sock = None
+ self._servers = None
+ self._parse_resolv()
+ self._parse_hosts()
+ # TODO monitor hosts change and reload hosts
+ # TODO parse /etc/gai.conf and follow its rules
+
+ def _parse_resolv(self):
+ self._servers = []
+ try:
+ with open('dns.conf', 'rb') as f:
+ content = f.readlines()
+ for line in content:
+ line = line.strip()
+ if line:
+ parts = line.split(b' ', 1)
+ if len(parts) >= 2:
+ server = parts[0]
+ port = int(parts[1])
+ else:
+ server = parts[0]
+ port = 53
+ if common.is_ip(server) == socket.AF_INET:
+ if type(server) != str:
+ server = server.decode('utf8')
+ self._servers.append((server, port))
+ except IOError:
+ pass
+ if not self._servers:
+ try:
+ with open('/etc/resolv.conf', 'rb') as f:
+ content = f.readlines()
+ for line in content:
+ line = line.strip()
+ if line:
+ if line.startswith(b'nameserver'):
+ parts = line.split()
+ if len(parts) >= 2:
+ server = parts[1]
+ if common.is_ip(server) == socket.AF_INET:
+ if type(server) != str:
+ server = server.decode('utf8')
+ self._servers.append((server, 53))
+ except IOError:
+ pass
+ if not self._servers:
+ self._servers = [('8.8.4.4', 53), ('8.8.8.8', 53)]
+ logging.info('dns server: %s' % (self._servers,))
+
+ def _parse_hosts(self):
+ etc_path = '/etc/hosts'
+ if 'WINDIR' in os.environ:
+ etc_path = os.environ['WINDIR'] + '/system32/drivers/etc/hosts'
+ try:
+ with open(etc_path, 'rb') as f:
+ for line in f.readlines():
+ line = line.strip()
+ if b"#" in line:
+ line = line[:line.find(b'#')]
+ parts = line.split()
+ if len(parts) >= 2:
+ ip = parts[0]
+ if common.is_ip(ip):
+ for i in range(1, len(parts)):
+ hostname = parts[i]
+ if hostname:
+ self._hosts[hostname] = ip
+ except IOError:
+ self._hosts['localhost'] = '127.0.0.1'
+
+ def add_to_loop(self, loop):
+ if self._loop:
+ raise Exception('already add to loop')
+ self._loop = loop
+ # TODO when dns server is IPv6
+ self._sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ self._sock.setblocking(False)
+ loop.add(self._sock, eventloop.POLL_IN, self)
+ loop.add_periodic(self.handle_periodic)
+
+ def _call_callback(self, hostname, ip, error=None):
+ callbacks = self._hostname_to_cb.get(hostname, [])
+ for callback in callbacks:
+ if callback in self._cb_to_hostname:
+ del self._cb_to_hostname[callback]
+ if ip or error:
+ callback((hostname, ip), error)
+ else:
+ callback((hostname, None),
+ Exception('unable to parse hostname %s' % hostname))
+ if hostname in self._hostname_to_cb:
+ del self._hostname_to_cb[hostname]
+ if hostname in self._hostname_status:
+ del self._hostname_status[hostname]
+
+ def _handle_data(self, data):
+ response = parse_response(data)
+ if response and response.hostname:
+ hostname = response.hostname
+ ip = None
+ for answer in response.answers:
+ if answer[1] in (QTYPE_A, QTYPE_AAAA) and \
+ answer[2] == QCLASS_IN:
+ ip = answer[0]
+ break
+ if IPV6_CONNECTION_SUPPORT:
+ if not ip and self._hostname_status.get(hostname, STATUS_IPV4) \
+ == STATUS_IPV6:
+ self._hostname_status[hostname] = STATUS_IPV4
+ self._send_req(hostname, QTYPE_A)
+ else:
+ if ip:
+ self._cache[hostname] = ip
+ self._call_callback(hostname, ip)
+ elif self._hostname_status.get(hostname, None) == STATUS_IPV4:
+ for question in response.questions:
+ if question[1] == QTYPE_A:
+ self._call_callback(hostname, None)
+ break
+ else:
+ if not ip and self._hostname_status.get(hostname, STATUS_IPV6) \
+ == STATUS_IPV4:
+ self._hostname_status[hostname] = STATUS_IPV6
+ self._send_req(hostname, QTYPE_AAAA)
+ else:
+ if ip:
+ self._cache[hostname] = ip
+ self._call_callback(hostname, ip)
+ elif self._hostname_status.get(hostname, None) == STATUS_IPV6:
+ for question in response.questions:
+ if question[1] == QTYPE_AAAA:
+ self._call_callback(hostname, None)
+ break
+
+ def handle_event(self, sock, fd, event):
+ if sock != self._sock:
+ return
+ if event & eventloop.POLL_ERR:
+ logging.error('dns socket err')
+ self._loop.remove(self._sock)
+ self._sock.close()
+ # TODO when dns server is IPv6
+ self._sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ self._sock.setblocking(False)
+ self._loop.add(self._sock, eventloop.POLL_IN, self)
+ else:
+ data, addr = sock.recvfrom(1024)
+ if addr not in self._servers:
+ logging.warn('received a packet other than our dns')
+ return
+ self._handle_data(data)
+
+ def handle_periodic(self):
+ self._cache.sweep()
+
+ def remove_callback(self, callback):
+ hostname = self._cb_to_hostname.get(callback)
+ if hostname:
+ del self._cb_to_hostname[callback]
+ arr = self._hostname_to_cb.get(hostname, None)
+ if arr:
+ arr.remove(callback)
+ if not arr:
+ del self._hostname_to_cb[hostname]
+ if hostname in self._hostname_status:
+ del self._hostname_status[hostname]
+
+ def _send_req(self, hostname, qtype):
+ req = build_request(hostname, qtype)
+ for server in self._servers:
+ logging.debug('resolving %s with type %d using server %s',
+ hostname, qtype, server)
+ self._sock.sendto(req, server)
+
+ def resolve(self, hostname, callback):
+ if type(hostname) != bytes:
+ hostname = hostname.encode('utf8')
+ if not hostname:
+ callback(None, Exception('empty hostname'))
+ elif common.is_ip(hostname):
+ callback((hostname, hostname), None)
+ elif hostname in self._hosts:
+ logging.debug('hit hosts: %s', hostname)
+ ip = self._hosts[hostname]
+ callback((hostname, ip), None)
+ elif hostname in self._cache:
+ logging.debug('hit cache: %s ==>> %s', hostname, self._cache[hostname])
+ ip = self._cache[hostname]
+ callback((hostname, ip), None)
+ elif any(hostname.endswith(t) for t in self._black_hostname_list):
+ callback(None, Exception('hostname <%s> is block by the black hostname list' % hostname))
+ return
+ else:
+ if not is_valid_hostname(hostname):
+ callback(None, Exception('invalid hostname: %s' % hostname))
+ return
+ if False:
+ addrs = socket.getaddrinfo(hostname, 0, 0,
+ socket.SOCK_DGRAM, socket.SOL_UDP)
+ if addrs:
+ af, socktype, proto, canonname, sa = addrs[0]
+ logging.debug('DNS resolve %s %s' % (hostname, sa[0]))
+ self._cache[hostname] = sa[0]
+ callback((hostname, sa[0]), None)
+ return
+ arr = self._hostname_to_cb.get(hostname, None)
+ if not arr:
+ if IPV6_CONNECTION_SUPPORT:
+ self._hostname_status[hostname] = STATUS_IPV6
+ self._send_req(hostname, QTYPE_AAAA)
+ else:
+ self._hostname_status[hostname] = STATUS_IPV4
+ self._send_req(hostname, QTYPE_A)
+ self._hostname_to_cb[hostname] = [callback]
+ self._cb_to_hostname[callback] = hostname
+ else:
+ arr.append(callback)
+ # TODO send again only if waited too long
+ if IPV6_CONNECTION_SUPPORT:
+ self._send_req(hostname, QTYPE_AAAA)
+ else:
+ self._send_req(hostname, QTYPE_A)
+
+ def close(self):
+ if self._sock:
+ if self._loop:
+ self._loop.remove_periodic(self.handle_periodic)
+ self._loop.remove(self._sock)
+ self._sock.close()
+ self._sock = None
+
+
+def test():
+ black_hostname_list = [
+ 'baidu.com',
+ 'yahoo.com',
+ ]
+ dns_resolver = DNSResolver(black_hostname_list=black_hostname_list)
+ loop = eventloop.EventLoop()
+ dns_resolver.add_to_loop(loop)
+
+ global counter
+ counter = 0
+
+ def make_callback():
+ global counter
+
+ def callback(result, error):
+ global counter
+ # TODO: what can we assert?
+ print(result, error)
+ counter += 1
+ if counter == 12:
+ dns_resolver.close()
+ loop.stop()
+
+ a_callback = callback
+ return a_callback
+
+ assert (make_callback() != make_callback())
+
+ dns_resolver.resolve(b'google.com', make_callback())
+ dns_resolver.resolve('google.com', make_callback())
+ dns_resolver.resolve('baidu.com', make_callback())
+ dns_resolver.resolve('map.baidu.com', make_callback())
+ dns_resolver.resolve('yahoo.com', make_callback())
+ dns_resolver.resolve('example.com', make_callback())
+ dns_resolver.resolve('ipv6.google.com', make_callback())
+ dns_resolver.resolve('www.facebook.com', make_callback())
+ dns_resolver.resolve('ns2.google.com', make_callback())
+ dns_resolver.resolve('invalid.@!#$%^&$@.hostname', make_callback())
+ dns_resolver.resolve('toooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'long.hostname', make_callback())
+ dns_resolver.resolve('toooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'ooooooooooooooooooooooooooooooooooooooooooooooooooo'
+ 'long.hostname', make_callback())
+ loop.run()
+ # test black_hostname_list
+ dns_resolver = DNSResolver(black_hostname_list=[])
+ assert type(dns_resolver._black_hostname_list) == list
+ assert len(dns_resolver._black_hostname_list) == 0
+ dns_resolver.close()
+ dns_resolver = DNSResolver(black_hostname_list=123)
+ assert type(dns_resolver._black_hostname_list) == list
+ assert len(dns_resolver._black_hostname_list) == 0
+ dns_resolver.close()
+ dns_resolver = DNSResolver(black_hostname_list=None)
+ assert type(dns_resolver._black_hostname_list) == list
+ assert len(dns_resolver._black_hostname_list) == 0
+ dns_resolver.close()
+ dns_resolver = DNSResolver()
+ assert type(dns_resolver._black_hostname_list) == list
+ assert dns_resolver._black_hostname_list.__len__() == 0
+ dns_resolver.close()
+
+
+if __name__ == '__main__':
+ test()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/common.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/common.py
new file mode 100644
index 000000000..c4484c046
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/common.py
@@ -0,0 +1,418 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2013-2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import socket
+import struct
+import logging
+import binascii
+import re
+
+from shadowsocks import lru_cache
+
+def compat_ord(s):
+ if type(s) == int:
+ return s
+ return _ord(s)
+
+
+def compat_chr(d):
+ if bytes == str:
+ return _chr(d)
+ return bytes([d])
+
+
+_ord = ord
+_chr = chr
+ord = compat_ord
+chr = compat_chr
+
+connect_log = logging.debug
+
+def to_bytes(s):
+ if bytes != str:
+ if type(s) == str:
+ return s.encode('utf-8')
+ return s
+
+
+def to_str(s):
+ if bytes != str:
+ if type(s) == bytes:
+ return s.decode('utf-8')
+ return s
+
+def int32(x):
+ if x > 0xFFFFFFFF or x < 0:
+ x &= 0xFFFFFFFF
+ if x > 0x7FFFFFFF:
+ x = int(0x100000000 - x)
+ if x < 0x80000000:
+ return -x
+ else:
+ return -2147483648
+ return x
+
+def inet_ntop(family, ipstr):
+ if family == socket.AF_INET:
+ return to_bytes(socket.inet_ntoa(ipstr))
+ elif family == socket.AF_INET6:
+ import re
+ v6addr = ':'.join(('%02X%02X' % (ord(i), ord(j))).lstrip('0')
+ for i, j in zip(ipstr[::2], ipstr[1::2]))
+ v6addr = re.sub('::+', '::', v6addr, count=1)
+ return to_bytes(v6addr)
+
+
+def inet_pton(family, addr):
+ addr = to_str(addr)
+ if family == socket.AF_INET:
+ return socket.inet_aton(addr)
+ elif family == socket.AF_INET6:
+ if '.' in addr: # a v4 addr
+ v4addr = addr[addr.rindex(':') + 1:]
+ v4addr = socket.inet_aton(v4addr)
+ v4addr = ['%02X' % ord(x) for x in v4addr]
+ v4addr.insert(2, ':')
+ newaddr = addr[:addr.rindex(':') + 1] + ''.join(v4addr)
+ return inet_pton(family, newaddr)
+ dbyts = [0] * 8 # 8 groups
+ grps = addr.split(':')
+ for i, v in enumerate(grps):
+ if v:
+ dbyts[i] = int(v, 16)
+ else:
+ for j, w in enumerate(grps[::-1]):
+ if w:
+ dbyts[7 - j] = int(w, 16)
+ else:
+ break
+ break
+ return b''.join((chr(i // 256) + chr(i % 256)) for i in dbyts)
+ else:
+ raise RuntimeError("What family?")
+
+
+def is_ip(address):
+ for family in (socket.AF_INET, socket.AF_INET6):
+ try:
+ if type(address) != str:
+ address = address.decode('utf8')
+ inet_pton(family, address)
+ return family
+ except (TypeError, ValueError, OSError, IOError):
+ pass
+ return False
+
+
+def match_regex(regex, text):
+ regex = re.compile(regex)
+ for item in regex.findall(text):
+ return True
+ return False
+
+
+def patch_socket():
+ if not hasattr(socket, 'inet_pton'):
+ socket.inet_pton = inet_pton
+
+ if not hasattr(socket, 'inet_ntop'):
+ socket.inet_ntop = inet_ntop
+
+
+patch_socket()
+
+
+ADDRTYPE_IPV4 = 1
+ADDRTYPE_IPV6 = 4
+ADDRTYPE_HOST = 3
+
+
+def pack_addr(address):
+ address_str = to_str(address)
+ for family in (socket.AF_INET, socket.AF_INET6):
+ try:
+ r = socket.inet_pton(family, address_str)
+ if family == socket.AF_INET6:
+ return b'\x04' + r
+ else:
+ return b'\x01' + r
+ except (TypeError, ValueError, OSError, IOError):
+ pass
+ if len(address) > 255:
+ address = address[:255] # TODO
+ return b'\x03' + chr(len(address)) + address
+
+def pre_parse_header(data):
+ if not data:
+ return None
+ datatype = ord(data[0])
+ if datatype == 0x80:
+ if len(data) <= 2:
+ return None
+ rand_data_size = ord(data[1])
+ if rand_data_size + 2 >= len(data):
+ logging.warn('header too short, maybe wrong password or '
+ 'encryption method')
+ return None
+ data = data[rand_data_size + 2:]
+ elif datatype == 0x81:
+ data = data[1:]
+ elif datatype == 0x82:
+ if len(data) <= 3:
+ return None
+ rand_data_size = struct.unpack('>H', data[1:3])[0]
+ if rand_data_size + 3 >= len(data):
+ logging.warn('header too short, maybe wrong password or '
+ 'encryption method')
+ return None
+ data = data[rand_data_size + 3:]
+ elif datatype == 0x88 or (~datatype & 0xff) == 0x88:
+ if len(data) <= 7 + 7:
+ return None
+ data_size = struct.unpack('>H', data[1:3])[0]
+ ogn_data = data
+ data = data[:data_size]
+ crc = binascii.crc32(data) & 0xffffffff
+ if crc != 0xffffffff:
+ logging.warn('uncorrect CRC32, maybe wrong password or '
+ 'encryption method')
+ return None
+ start_pos = 3 + ord(data[3])
+ data = data[start_pos:-4]
+ if data_size < len(ogn_data):
+ data += ogn_data[data_size:]
+ return data
+
+def parse_header(data):
+ addrtype = ord(data[0])
+ dest_addr = None
+ dest_port = None
+ header_length = 0
+ connecttype = (addrtype & 0x8) and 1 or 0
+ addrtype &= ~0x8
+ if addrtype == ADDRTYPE_IPV4:
+ if len(data) >= 7:
+ dest_addr = socket.inet_ntoa(data[1:5])
+ dest_port = struct.unpack('>H', data[5:7])[0]
+ header_length = 7
+ else:
+ logging.warn('header is too short')
+ elif addrtype == ADDRTYPE_HOST:
+ if len(data) > 2:
+ addrlen = ord(data[1])
+ if len(data) >= 4 + addrlen:
+ dest_addr = data[2:2 + addrlen]
+ dest_port = struct.unpack('>H', data[2 + addrlen:4 +
+ addrlen])[0]
+ header_length = 4 + addrlen
+ else:
+ logging.warn('header is too short')
+ else:
+ logging.warn('header is too short')
+ elif addrtype == ADDRTYPE_IPV6:
+ if len(data) >= 19:
+ dest_addr = socket.inet_ntop(socket.AF_INET6, data[1:17])
+ dest_port = struct.unpack('>H', data[17:19])[0]
+ header_length = 19
+ else:
+ logging.warn('header is too short')
+ else:
+ logging.warn('unsupported addrtype %d, maybe wrong password or '
+ 'encryption method' % addrtype)
+ if dest_addr is None:
+ return None
+ return connecttype, addrtype, to_bytes(dest_addr), dest_port, header_length
+
+
+class IPNetwork(object):
+ ADDRLENGTH = {socket.AF_INET: 32, socket.AF_INET6: 128, False: 0}
+
+ def __init__(self, addrs):
+ self.addrs_str = addrs
+ self._network_list_v4 = []
+ self._network_list_v6 = []
+ if type(addrs) == str:
+ addrs = addrs.split(',')
+ list(map(self.add_network, addrs))
+
+ def add_network(self, addr):
+ if addr is "":
+ return
+ block = addr.split('/')
+ addr_family = is_ip(block[0])
+ addr_len = IPNetwork.ADDRLENGTH[addr_family]
+ if addr_family is socket.AF_INET:
+ ip, = struct.unpack("!I", socket.inet_aton(block[0]))
+ elif addr_family is socket.AF_INET6:
+ hi, lo = struct.unpack("!QQ", inet_pton(addr_family, block[0]))
+ ip = (hi << 64) | lo
+ else:
+ raise Exception("Not a valid CIDR notation: %s" % addr)
+ if len(block) is 1:
+ prefix_size = 0
+ while (ip & 1) == 0 and ip is not 0:
+ ip >>= 1
+ prefix_size += 1
+ logging.warn("You did't specify CIDR routing prefix size for %s, "
+ "implicit treated as %s/%d" % (addr, addr, addr_len))
+ elif block[1].isdigit() and int(block[1]) <= addr_len:
+ prefix_size = addr_len - int(block[1])
+ ip >>= prefix_size
+ else:
+ raise Exception("Not a valid CIDR notation: %s" % addr)
+ if addr_family is socket.AF_INET:
+ self._network_list_v4.append((ip, prefix_size))
+ else:
+ self._network_list_v6.append((ip, prefix_size))
+
+ def __contains__(self, addr):
+ addr_family = is_ip(addr)
+ if addr_family is socket.AF_INET:
+ ip, = struct.unpack("!I", socket.inet_aton(addr))
+ return any(map(lambda n_ps: n_ps[0] == ip >> n_ps[1],
+ self._network_list_v4))
+ elif addr_family is socket.AF_INET6:
+ hi, lo = struct.unpack("!QQ", inet_pton(addr_family, addr))
+ ip = (hi << 64) | lo
+ return any(map(lambda n_ps: n_ps[0] == ip >> n_ps[1],
+ self._network_list_v6))
+ else:
+ return False
+
+ def __cmp__(self, other):
+ return cmp(self.addrs_str, other.addrs_str)
+
+ def __eq__(self, other):
+ return self.addrs_str == other.addrs_str
+
+ def __ne__(self, other):
+ return self.addrs_str != other.addrs_str
+
+class PortRange(object):
+ def __init__(self, range_str):
+ self.range_str = to_str(range_str)
+ self.range = set()
+ range_str = to_str(range_str).split(',')
+ for item in range_str:
+ try:
+ int_range = item.split('-')
+ if len(int_range) == 1:
+ if item:
+ self.range.add(int(item))
+ elif len(int_range) == 2:
+ int_range[0] = int(int_range[0])
+ int_range[1] = int(int_range[1])
+ if int_range[0] < 0:
+ int_range[0] = 0
+ if int_range[1] > 65535:
+ int_range[1] = 65535
+ i = int_range[0]
+ while i <= int_range[1]:
+ self.range.add(i)
+ i += 1
+ except Exception as e:
+ logging.error(e)
+
+ def __contains__(self, val):
+ return val in self.range
+
+ def __cmp__(self, other):
+ return cmp(self.range_str, other.range_str)
+
+ def __eq__(self, other):
+ return self.range_str == other.range_str
+
+ def __ne__(self, other):
+ return self.range_str != other.range_str
+
+class UDPAsyncDNSHandler(object):
+ dns_cache = lru_cache.LRUCache(timeout=1800)
+ def __init__(self, params):
+ self.params = params
+ self.remote_addr = None
+ self.call_back = None
+
+ def resolve(self, dns_resolver, remote_addr, call_back):
+ if remote_addr in UDPAsyncDNSHandler.dns_cache:
+ if call_back:
+ call_back("", remote_addr, UDPAsyncDNSHandler.dns_cache[remote_addr], self.params)
+ else:
+ self.call_back = call_back
+ self.remote_addr = remote_addr
+ dns_resolver.resolve(remote_addr[0], self._handle_dns_resolved)
+ UDPAsyncDNSHandler.dns_cache.sweep()
+
+ def _handle_dns_resolved(self, result, error):
+ if error:
+ logging.error("%s when resolve DNS" % (error,)) #drop
+ return self.call_back(error, self.remote_addr, None, self.params)
+ if result:
+ ip = result[1]
+ if ip:
+ return self.call_back("", self.remote_addr, ip, self.params)
+ logging.warning("can't resolve %s" % (self.remote_addr,))
+ return self.call_back("fail to resolve", self.remote_addr, None, self.params)
+
+def test_inet_conv():
+ ipv4 = b'8.8.4.4'
+ b = inet_pton(socket.AF_INET, ipv4)
+ assert inet_ntop(socket.AF_INET, b) == ipv4
+ ipv6 = b'2404:6800:4005:805::1011'
+ b = inet_pton(socket.AF_INET6, ipv6)
+ assert inet_ntop(socket.AF_INET6, b) == ipv6
+
+
+def test_parse_header():
+ assert parse_header(b'\x03\x0ewww.google.com\x00\x50') == \
+ (0, b'www.google.com', 80, 18)
+ assert parse_header(b'\x01\x08\x08\x08\x08\x00\x35') == \
+ (0, b'8.8.8.8', 53, 7)
+ assert parse_header((b'\x04$\x04h\x00@\x05\x08\x05\x00\x00\x00\x00\x00'
+ b'\x00\x10\x11\x00\x50')) == \
+ (0, b'2404:6800:4005:805::1011', 80, 19)
+
+
+def test_pack_header():
+ assert pack_addr(b'8.8.8.8') == b'\x01\x08\x08\x08\x08'
+ assert pack_addr(b'2404:6800:4005:805::1011') == \
+ b'\x04$\x04h\x00@\x05\x08\x05\x00\x00\x00\x00\x00\x00\x10\x11'
+ assert pack_addr(b'www.google.com') == b'\x03\x0ewww.google.com'
+
+
+def test_ip_network():
+ ip_network = IPNetwork('127.0.0.0/24,::ff:1/112,::1,192.168.1.1,192.0.2.0')
+ assert '127.0.0.1' in ip_network
+ assert '127.0.1.1' not in ip_network
+ assert ':ff:ffff' in ip_network
+ assert '::ffff:1' not in ip_network
+ assert '::1' in ip_network
+ assert '::2' not in ip_network
+ assert '192.168.1.1' in ip_network
+ assert '192.168.1.2' not in ip_network
+ assert '192.0.2.1' in ip_network
+ assert '192.0.3.1' in ip_network # 192.0.2.0 is treated as 192.0.2.0/23
+ assert 'www.google.com' not in ip_network
+
+
+if __name__ == '__main__':
+ test_inet_conv()
+ test_parse_header()
+ test_pack_header()
+ test_ip_network()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/__init__.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/__init__.py
new file mode 100644
index 000000000..401c7b726
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/__init__.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_libsodium.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_libsodium.py
new file mode 100644
index 000000000..efecfd415
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_libsodium.py
@@ -0,0 +1,135 @@
+#!/usr/bin/env python
+
+# Copyright (c) 2014 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import logging
+from ctypes import CDLL, c_char_p, c_int, c_ulonglong, byref, \
+ create_string_buffer, c_void_p
+
+__all__ = ['ciphers']
+
+libsodium = None
+loaded = False
+
+buf_size = 2048
+
+# for salsa20 and chacha20
+BLOCK_SIZE = 64
+
+
+def load_libsodium():
+ global loaded, libsodium, buf
+
+ from ctypes.util import find_library
+ for p in ('sodium',):
+ libsodium_path = find_library(p)
+ if libsodium_path:
+ break
+ else:
+ raise Exception('libsodium not found')
+ logging.info('loading libsodium from %s', libsodium_path)
+ libsodium = CDLL(libsodium_path)
+ libsodium.sodium_init.restype = c_int
+ libsodium.crypto_stream_salsa20_xor_ic.restype = c_int
+ libsodium.crypto_stream_salsa20_xor_ic.argtypes = (c_void_p, c_char_p,
+ c_ulonglong,
+ c_char_p, c_ulonglong,
+ c_char_p)
+ libsodium.crypto_stream_chacha20_xor_ic.restype = c_int
+ libsodium.crypto_stream_chacha20_xor_ic.argtypes = (c_void_p, c_char_p,
+ c_ulonglong,
+ c_char_p, c_ulonglong,
+ c_char_p)
+
+ libsodium.sodium_init()
+
+ buf = create_string_buffer(buf_size)
+ loaded = True
+
+
+class Salsa20Crypto(object):
+ def __init__(self, cipher_name, key, iv, op):
+ if not loaded:
+ load_libsodium()
+ self.key = key
+ self.iv = iv
+ self.key_ptr = c_char_p(key)
+ self.iv_ptr = c_char_p(iv)
+ if cipher_name == b'salsa20':
+ self.cipher = libsodium.crypto_stream_salsa20_xor_ic
+ elif cipher_name == b'chacha20':
+ self.cipher = libsodium.crypto_stream_chacha20_xor_ic
+ else:
+ raise Exception('Unknown cipher')
+ # byte counter, not block counter
+ self.counter = 0
+
+ def update(self, data):
+ global buf_size, buf
+ l = len(data)
+
+ # we can only prepend some padding to make the encryption align to
+ # blocks
+ padding = self.counter % BLOCK_SIZE
+ if buf_size < padding + l:
+ buf_size = (padding + l) * 2
+ buf = create_string_buffer(buf_size)
+
+ if padding:
+ data = (b'\0' * padding) + data
+ self.cipher(byref(buf), c_char_p(data), padding + l,
+ self.iv_ptr, int(self.counter / BLOCK_SIZE), self.key_ptr)
+ self.counter += l
+ # buf is copied to a str object when we access buf.raw
+ # strip off the padding
+ return buf.raw[padding:padding + l]
+
+
+ciphers = {
+ b'salsa20': (32, 8, Salsa20Crypto),
+ b'chacha20': (32, 8, Salsa20Crypto),
+}
+
+
+def test_salsa20():
+ from shadowsocks.crypto import util
+
+ cipher = Salsa20Crypto(b'salsa20', b'k' * 32, b'i' * 16, 1)
+ decipher = Salsa20Crypto(b'salsa20', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+def test_chacha20():
+ from shadowsocks.crypto import util
+
+ cipher = Salsa20Crypto(b'chacha20', b'k' * 32, b'i' * 16, 1)
+ decipher = Salsa20Crypto(b'chacha20', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+if __name__ == '__main__':
+ test_chacha20()
+ test_salsa20()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_openssl.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_openssl.py
new file mode 100644
index 000000000..0ef8ce0f8
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/ctypes_openssl.py
@@ -0,0 +1,188 @@
+#!/usr/bin/env python
+
+# Copyright (c) 2014 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import logging
+from ctypes import CDLL, c_char_p, c_int, c_long, byref,\
+ create_string_buffer, c_void_p
+
+__all__ = ['ciphers']
+
+libcrypto = None
+loaded = False
+
+buf_size = 2048
+
+
+def load_openssl():
+ global loaded, libcrypto, buf
+
+ from ctypes.util import find_library
+ for p in ('crypto', 'eay32', 'libeay32'):
+ libcrypto_path = find_library(p)
+ if libcrypto_path:
+ break
+ else:
+ raise Exception('libcrypto(OpenSSL) not found')
+ logging.info('loading libcrypto from %s', libcrypto_path)
+ libcrypto = CDLL(libcrypto_path)
+ libcrypto.EVP_get_cipherbyname.restype = c_void_p
+ libcrypto.EVP_CIPHER_CTX_new.restype = c_void_p
+
+ libcrypto.EVP_CipherInit_ex.argtypes = (c_void_p, c_void_p, c_char_p,
+ c_char_p, c_char_p, c_int)
+
+ libcrypto.EVP_CipherUpdate.argtypes = (c_void_p, c_void_p, c_void_p,
+ c_char_p, c_int)
+
+ libcrypto.EVP_CIPHER_CTX_cleanup.argtypes = (c_void_p,)
+ libcrypto.EVP_CIPHER_CTX_free.argtypes = (c_void_p,)
+ if hasattr(libcrypto, 'OpenSSL_add_all_ciphers'):
+ libcrypto.OpenSSL_add_all_ciphers()
+
+ buf = create_string_buffer(buf_size)
+ loaded = True
+
+
+def load_cipher(cipher_name):
+ func_name = b'EVP_' + cipher_name.replace(b'-', b'_')
+ if bytes != str:
+ func_name = str(func_name, 'utf-8')
+ cipher = getattr(libcrypto, func_name, None)
+ if cipher:
+ cipher.restype = c_void_p
+ return cipher()
+ return None
+
+
+class CtypesCrypto(object):
+ def __init__(self, cipher_name, key, iv, op):
+ if not loaded:
+ load_openssl()
+ self._ctx = None
+ cipher = libcrypto.EVP_get_cipherbyname(cipher_name)
+ if not cipher:
+ cipher = load_cipher(cipher_name)
+ if not cipher:
+ raise Exception('cipher %s not found in libcrypto' % cipher_name)
+ key_ptr = c_char_p(key)
+ iv_ptr = c_char_p(iv)
+ self._ctx = libcrypto.EVP_CIPHER_CTX_new()
+ if not self._ctx:
+ raise Exception('can not create cipher context')
+ r = libcrypto.EVP_CipherInit_ex(self._ctx, cipher, None,
+ key_ptr, iv_ptr, c_int(op))
+ if not r:
+ self.clean()
+ raise Exception('can not initialize cipher context')
+
+ def update(self, data):
+ global buf_size, buf
+ cipher_out_len = c_long(0)
+ l = len(data)
+ if buf_size < l:
+ buf_size = l * 2
+ buf = create_string_buffer(buf_size)
+ libcrypto.EVP_CipherUpdate(self._ctx, byref(buf),
+ byref(cipher_out_len), c_char_p(data), l)
+ # buf is copied to a str object when we access buf.raw
+ return buf.raw[:cipher_out_len.value]
+
+ def __del__(self):
+ self.clean()
+
+ def clean(self):
+ if self._ctx:
+ libcrypto.EVP_CIPHER_CTX_cleanup(self._ctx)
+ libcrypto.EVP_CIPHER_CTX_free(self._ctx)
+
+
+ciphers = {
+ b'aes-128-cfb': (16, 16, CtypesCrypto),
+ b'aes-192-cfb': (24, 16, CtypesCrypto),
+ b'aes-256-cfb': (32, 16, CtypesCrypto),
+ b'aes-128-ofb': (16, 16, CtypesCrypto),
+ b'aes-192-ofb': (24, 16, CtypesCrypto),
+ b'aes-256-ofb': (32, 16, CtypesCrypto),
+ b'aes-128-ctr': (16, 16, CtypesCrypto),
+ b'aes-192-ctr': (24, 16, CtypesCrypto),
+ b'aes-256-ctr': (32, 16, CtypesCrypto),
+ b'aes-128-cfb8': (16, 16, CtypesCrypto),
+ b'aes-192-cfb8': (24, 16, CtypesCrypto),
+ b'aes-256-cfb8': (32, 16, CtypesCrypto),
+ b'aes-128-cfb1': (16, 16, CtypesCrypto),
+ b'aes-192-cfb1': (24, 16, CtypesCrypto),
+ b'aes-256-cfb1': (32, 16, CtypesCrypto),
+ b'bf-cfb': (16, 8, CtypesCrypto),
+ b'camellia-128-cfb': (16, 16, CtypesCrypto),
+ b'camellia-192-cfb': (24, 16, CtypesCrypto),
+ b'camellia-256-cfb': (32, 16, CtypesCrypto),
+ b'cast5-cfb': (16, 8, CtypesCrypto),
+ b'des-cfb': (8, 8, CtypesCrypto),
+ b'idea-cfb': (16, 8, CtypesCrypto),
+ b'rc2-cfb': (16, 8, CtypesCrypto),
+ b'rc4': (16, 0, CtypesCrypto),
+ b'seed-cfb': (16, 16, CtypesCrypto),
+}
+
+
+def run_method(method):
+ from shadowsocks.crypto import util
+
+ cipher = CtypesCrypto(method, b'k' * 32, b'i' * 16, 1)
+ decipher = CtypesCrypto(method, b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+def test_aes_128_cfb():
+ run_method(b'aes-128-cfb')
+
+
+def test_aes_256_cfb():
+ run_method(b'aes-256-cfb')
+
+
+def test_aes_128_cfb8():
+ run_method(b'aes-128-cfb8')
+
+
+def test_aes_256_ofb():
+ run_method(b'aes-256-ofb')
+
+
+def test_aes_256_ctr():
+ run_method(b'aes-256-ctr')
+
+
+def test_bf_cfb():
+ run_method(b'bf-cfb')
+
+
+def test_rc4():
+ run_method(b'rc4')
+
+
+if __name__ == '__main__':
+ test_aes_128_cfb()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/openssl.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/openssl.py
new file mode 100644
index 000000000..0a8ca53fb
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/openssl.py
@@ -0,0 +1,199 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+from ctypes import c_char_p, c_int, c_long, byref,\
+ create_string_buffer, c_void_p
+
+from shadowsocks import common
+from shadowsocks.crypto import util
+
+__all__ = ['ciphers']
+
+libcrypto = None
+loaded = False
+
+buf_size = 2048
+
+
+def load_openssl():
+ global loaded, libcrypto, buf
+
+ libcrypto = util.find_library(('crypto', 'eay32'),
+ 'EVP_get_cipherbyname',
+ 'libcrypto')
+ if libcrypto is None:
+ raise Exception('libcrypto(OpenSSL) not found')
+
+ libcrypto.EVP_get_cipherbyname.restype = c_void_p
+ libcrypto.EVP_CIPHER_CTX_new.restype = c_void_p
+
+ libcrypto.EVP_CipherInit_ex.argtypes = (c_void_p, c_void_p, c_char_p,
+ c_char_p, c_char_p, c_int)
+
+ libcrypto.EVP_CipherUpdate.argtypes = (c_void_p, c_void_p, c_void_p,
+ c_char_p, c_int)
+
+ if hasattr(libcrypto, "EVP_CIPHER_CTX_cleanup"):
+ libcrypto.EVP_CIPHER_CTX_cleanup.argtypes = (c_void_p,)
+ else:
+ libcrypto.EVP_CIPHER_CTX_reset.argtypes = (c_void_p,)
+ libcrypto.EVP_CIPHER_CTX_free.argtypes = (c_void_p,)
+
+ libcrypto.RAND_bytes.restype = c_int
+ libcrypto.RAND_bytes.argtypes = (c_void_p, c_int)
+
+ if hasattr(libcrypto, 'OpenSSL_add_all_ciphers'):
+ libcrypto.OpenSSL_add_all_ciphers()
+
+ buf = create_string_buffer(buf_size)
+ loaded = True
+
+
+def load_cipher(cipher_name):
+ func_name = 'EVP_' + cipher_name.replace('-', '_')
+ cipher = getattr(libcrypto, func_name, None)
+ if cipher:
+ cipher.restype = c_void_p
+ return cipher()
+ return None
+
+def rand_bytes(length):
+ if not loaded:
+ load_openssl()
+ buf = create_string_buffer(length)
+ r = libcrypto.RAND_bytes(buf, length)
+ if r <= 0:
+ raise Exception('RAND_bytes return error')
+ return buf.raw
+
+class OpenSSLCrypto(object):
+ def __init__(self, cipher_name, key, iv, op):
+ self._ctx = None
+ if not loaded:
+ load_openssl()
+ cipher = libcrypto.EVP_get_cipherbyname(common.to_bytes(cipher_name))
+ if not cipher:
+ cipher = load_cipher(cipher_name)
+ if not cipher:
+ raise Exception('cipher %s not found in libcrypto' % cipher_name)
+ key_ptr = c_char_p(key)
+ iv_ptr = c_char_p(iv)
+ self._ctx = libcrypto.EVP_CIPHER_CTX_new()
+ if not self._ctx:
+ raise Exception('can not create cipher context')
+ r = libcrypto.EVP_CipherInit_ex(self._ctx, cipher, None,
+ key_ptr, iv_ptr, c_int(op))
+ if not r:
+ self.clean()
+ raise Exception('can not initialize cipher context')
+
+ def update(self, data):
+ global buf_size, buf
+ cipher_out_len = c_long(0)
+ l = len(data)
+ if buf_size < l:
+ buf_size = l * 2
+ buf = create_string_buffer(buf_size)
+ libcrypto.EVP_CipherUpdate(self._ctx, byref(buf),
+ byref(cipher_out_len), c_char_p(data), l)
+ # buf is copied to a str object when we access buf.raw
+ return buf.raw[:cipher_out_len.value]
+
+ def __del__(self):
+ self.clean()
+
+ def clean(self):
+ if self._ctx:
+ if hasattr(libcrypto, "EVP_CIPHER_CTX_cleanup"):
+ libcrypto.EVP_CIPHER_CTX_cleanup(self._ctx)
+ else:
+ libcrypto.EVP_CIPHER_CTX_reset(self._ctx)
+ libcrypto.EVP_CIPHER_CTX_free(self._ctx)
+
+
+ciphers = {
+ 'aes-128-cbc': (16, 16, OpenSSLCrypto),
+ 'aes-192-cbc': (24, 16, OpenSSLCrypto),
+ 'aes-256-cbc': (32, 16, OpenSSLCrypto),
+ 'aes-128-cfb': (16, 16, OpenSSLCrypto),
+ 'aes-192-cfb': (24, 16, OpenSSLCrypto),
+ 'aes-256-cfb': (32, 16, OpenSSLCrypto),
+ 'aes-128-ofb': (16, 16, OpenSSLCrypto),
+ 'aes-192-ofb': (24, 16, OpenSSLCrypto),
+ 'aes-256-ofb': (32, 16, OpenSSLCrypto),
+ 'aes-128-ctr': (16, 16, OpenSSLCrypto),
+ 'aes-192-ctr': (24, 16, OpenSSLCrypto),
+ 'aes-256-ctr': (32, 16, OpenSSLCrypto),
+ 'aes-128-cfb8': (16, 16, OpenSSLCrypto),
+ 'aes-192-cfb8': (24, 16, OpenSSLCrypto),
+ 'aes-256-cfb8': (32, 16, OpenSSLCrypto),
+ 'aes-128-cfb1': (16, 16, OpenSSLCrypto),
+ 'aes-192-cfb1': (24, 16, OpenSSLCrypto),
+ 'aes-256-cfb1': (32, 16, OpenSSLCrypto),
+ 'bf-cfb': (16, 8, OpenSSLCrypto),
+ 'camellia-128-cfb': (16, 16, OpenSSLCrypto),
+ 'camellia-192-cfb': (24, 16, OpenSSLCrypto),
+ 'camellia-256-cfb': (32, 16, OpenSSLCrypto),
+ 'cast5-cfb': (16, 8, OpenSSLCrypto),
+ 'des-cfb': (8, 8, OpenSSLCrypto),
+ 'idea-cfb': (16, 8, OpenSSLCrypto),
+ 'rc2-cfb': (16, 8, OpenSSLCrypto),
+ 'rc4': (16, 0, OpenSSLCrypto),
+ 'seed-cfb': (16, 16, OpenSSLCrypto),
+}
+
+
+def run_method(method):
+
+ cipher = OpenSSLCrypto(method, b'k' * 32, b'i' * 16, 1)
+ decipher = OpenSSLCrypto(method, b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+def test_aes_128_cfb():
+ run_method('aes-128-cfb')
+
+
+def test_aes_256_cfb():
+ run_method('aes-256-cfb')
+
+
+def test_aes_128_cfb8():
+ run_method('aes-128-cfb8')
+
+
+def test_aes_256_ofb():
+ run_method('aes-256-ofb')
+
+
+def test_aes_256_ctr():
+ run_method('aes-256-ctr')
+
+
+def test_bf_cfb():
+ run_method('bf-cfb')
+
+
+def test_rc4():
+ run_method('rc4')
+
+
+if __name__ == '__main__':
+ test_aes_128_cfb()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/rc4_md5.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/rc4_md5.py
new file mode 100644
index 000000000..b0105ec29
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/rc4_md5.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import hashlib
+
+from shadowsocks.crypto import openssl
+
+__all__ = ['ciphers']
+
+
+def create_cipher(alg, key, iv, op, key_as_bytes=0, d=None, salt=None,
+ i=1, padding=1):
+ md5 = hashlib.md5()
+ md5.update(key)
+ md5.update(iv)
+ rc4_key = md5.digest()
+ return openssl.OpenSSLCrypto(b'rc4', rc4_key, b'', op)
+
+
+ciphers = {
+ 'rc4-md5': (16, 16, create_cipher),
+ 'rc4-md5-6': (16, 6, create_cipher),
+}
+
+
+def test():
+ from shadowsocks.crypto import util
+
+ cipher = create_cipher('rc4-md5', b'k' * 32, b'i' * 16, 1)
+ decipher = create_cipher('rc4-md5', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+if __name__ == '__main__':
+ test()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/sodium.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/sodium.py
new file mode 100644
index 000000000..51d476bed
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/sodium.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+from ctypes import c_char_p, c_int, c_ulong, c_ulonglong, byref, \
+ create_string_buffer, c_void_p
+
+from shadowsocks.crypto import util
+
+__all__ = ['ciphers']
+
+libsodium = None
+loaded = False
+
+buf_size = 2048
+
+# for salsa20 and chacha20 and chacha20-ietf
+BLOCK_SIZE = 64
+
+
+def load_libsodium():
+ global loaded, libsodium, buf
+
+ libsodium = util.find_library('sodium', 'crypto_stream_salsa20_xor_ic',
+ 'libsodium')
+ if libsodium is None:
+ raise Exception('libsodium not found')
+
+ libsodium.crypto_stream_salsa20_xor_ic.restype = c_int
+ libsodium.crypto_stream_salsa20_xor_ic.argtypes = (c_void_p, c_char_p,
+ c_ulonglong,
+ c_char_p, c_ulonglong,
+ c_char_p)
+ libsodium.crypto_stream_chacha20_xor_ic.restype = c_int
+ libsodium.crypto_stream_chacha20_xor_ic.argtypes = (c_void_p, c_char_p,
+ c_ulonglong,
+ c_char_p, c_ulonglong,
+ c_char_p)
+
+ try:
+ libsodium.crypto_stream_chacha20_ietf_xor_ic.restype = c_int
+ libsodium.crypto_stream_chacha20_ietf_xor_ic.argtypes = (c_void_p, c_char_p,
+ c_ulonglong,
+ c_char_p, c_ulong,
+ c_char_p)
+ except:
+ pass
+
+ buf = create_string_buffer(buf_size)
+ loaded = True
+
+
+class SodiumCrypto(object):
+ def __init__(self, cipher_name, key, iv, op):
+ if not loaded:
+ load_libsodium()
+ self.key = key
+ self.iv = iv
+ self.key_ptr = c_char_p(key)
+ self.iv_ptr = c_char_p(iv)
+ if cipher_name == 'salsa20':
+ self.cipher = libsodium.crypto_stream_salsa20_xor_ic
+ elif cipher_name == 'chacha20':
+ self.cipher = libsodium.crypto_stream_chacha20_xor_ic
+ elif cipher_name == 'chacha20-ietf':
+ self.cipher = libsodium.crypto_stream_chacha20_ietf_xor_ic
+ else:
+ raise Exception('Unknown cipher')
+ # byte counter, not block counter
+ self.counter = 0
+
+ def update(self, data):
+ global buf_size, buf
+ l = len(data)
+
+ # we can only prepend some padding to make the encryption align to
+ # blocks
+ padding = self.counter % BLOCK_SIZE
+ if buf_size < padding + l:
+ buf_size = (padding + l) * 2
+ buf = create_string_buffer(buf_size)
+
+ if padding:
+ data = (b'\0' * padding) + data
+ self.cipher(byref(buf), c_char_p(data), padding + l,
+ self.iv_ptr, int(self.counter / BLOCK_SIZE), self.key_ptr)
+ self.counter += l
+ # buf is copied to a str object when we access buf.raw
+ # strip off the padding
+ return buf.raw[padding:padding + l]
+
+
+ciphers = {
+ 'salsa20': (32, 8, SodiumCrypto),
+ 'chacha20': (32, 8, SodiumCrypto),
+ 'chacha20-ietf': (32, 12, SodiumCrypto),
+}
+
+
+def test_salsa20():
+ cipher = SodiumCrypto('salsa20', b'k' * 32, b'i' * 16, 1)
+ decipher = SodiumCrypto('salsa20', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+def test_chacha20():
+
+ cipher = SodiumCrypto('chacha20', b'k' * 32, b'i' * 16, 1)
+ decipher = SodiumCrypto('chacha20', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+
+def test_chacha20_ietf():
+
+ cipher = SodiumCrypto('chacha20-ietf', b'k' * 32, b'i' * 16, 1)
+ decipher = SodiumCrypto('chacha20-ietf', b'k' * 32, b'i' * 16, 0)
+
+ util.run_cipher(cipher, decipher)
+
+if __name__ == '__main__':
+ test_chacha20_ietf()
+ test_chacha20()
+ test_salsa20()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/table.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/table.py
new file mode 100644
index 000000000..60c2f2451
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/crypto/table.py
@@ -0,0 +1,181 @@
+# !/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import string
+import struct
+import hashlib
+
+
+__all__ = ['ciphers']
+
+cached_tables = {}
+
+if hasattr(string, 'maketrans'):
+ maketrans = string.maketrans
+ translate = string.translate
+else:
+ maketrans = bytes.maketrans
+ translate = bytes.translate
+
+
+def get_table(key):
+ m = hashlib.md5()
+ m.update(key)
+ s = m.digest()
+ a, b = struct.unpack(' 0:
+ # parent waits for its child
+ time.sleep(5)
+ sys.exit(0)
+
+ # child signals its parent to exit
+ ppid = os.getppid()
+ pid = os.getpid()
+ if write_pid_file(pid_file, pid) != 0:
+ os.kill(ppid, signal.SIGINT)
+ sys.exit(1)
+
+ os.setsid()
+ signal.signal(signal.SIG_IGN, signal.SIGHUP)
+
+ print('started')
+ os.kill(ppid, signal.SIGTERM)
+
+ sys.stdin.close()
+ try:
+ freopen(log_file, 'a', sys.stdout)
+ freopen(log_file, 'a', sys.stderr)
+ except IOError as e:
+ shell.print_exception(e)
+ sys.exit(1)
+
+
+def daemon_stop(pid_file):
+ import errno
+ try:
+ with open(pid_file) as f:
+ buf = f.read()
+ pid = common.to_str(buf)
+ if not buf:
+ logging.error('not running')
+ except IOError as e:
+ shell.print_exception(e)
+ if e.errno == errno.ENOENT:
+ # always exit 0 if we are sure daemon is not running
+ logging.error('not running')
+ return
+ sys.exit(1)
+ pid = int(pid)
+ if pid > 0:
+ try:
+ os.kill(pid, signal.SIGTERM)
+ except OSError as e:
+ if e.errno == errno.ESRCH:
+ logging.error('not running')
+ # always exit 0 if we are sure daemon is not running
+ return
+ shell.print_exception(e)
+ sys.exit(1)
+ else:
+ logging.error('pid is not positive: %d', pid)
+
+ # sleep for maximum 10s
+ for i in range(0, 200):
+ try:
+ # query for the pid
+ os.kill(pid, 0)
+ except OSError as e:
+ if e.errno == errno.ESRCH:
+ break
+ time.sleep(0.05)
+ else:
+ logging.error('timed out when stopping pid %d', pid)
+ sys.exit(1)
+ print('stopped')
+ os.unlink(pid_file)
+
+
+def set_user(username):
+ if username is None:
+ return
+
+ import pwd
+ import grp
+
+ try:
+ pwrec = pwd.getpwnam(username)
+ except KeyError:
+ logging.error('user not found: %s' % username)
+ raise
+ user = pwrec[0]
+ uid = pwrec[2]
+ gid = pwrec[3]
+
+ cur_uid = os.getuid()
+ if uid == cur_uid:
+ return
+ if cur_uid != 0:
+ logging.error('can not set user as nonroot user')
+ # will raise later
+
+ # inspired by supervisor
+ if hasattr(os, 'setgroups'):
+ groups = [grprec[2] for grprec in grp.getgrall() if user in grprec[3]]
+ groups.insert(0, gid)
+ os.setgroups(groups)
+ os.setgid(gid)
+ os.setuid(uid)
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt.py
new file mode 100644
index 000000000..44f905250
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt.py
@@ -0,0 +1,236 @@
+#!/usr/bin/env python
+#
+# Copyright 2012-2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+
+from shadowsocks import common
+from shadowsocks.crypto import rc4_md5, openssl, sodium, table
+
+
+method_supported = {}
+method_supported.update(rc4_md5.ciphers)
+method_supported.update(openssl.ciphers)
+method_supported.update(sodium.ciphers)
+method_supported.update(table.ciphers)
+
+
+def random_string(length):
+ try:
+ return os.urandom(length)
+ except NotImplementedError as e:
+ return openssl.rand_bytes(length)
+
+cached_keys = {}
+
+
+def try_cipher(key, method=None):
+ Encryptor(key, method)
+
+
+def EVP_BytesToKey(password, key_len, iv_len):
+ # equivalent to OpenSSL's EVP_BytesToKey() with count 1
+ # so that we make the same key and iv as nodejs version
+ if hasattr(password, 'encode'):
+ password = password.encode('utf-8')
+ cached_key = '%s-%d-%d' % (password, key_len, iv_len)
+ r = cached_keys.get(cached_key, None)
+ if r:
+ return r
+ m = []
+ i = 0
+ while len(b''.join(m)) < (key_len + iv_len):
+ md5 = hashlib.md5()
+ data = password
+ if i > 0:
+ data = m[i - 1] + password
+ md5.update(data)
+ m.append(md5.digest())
+ i += 1
+ ms = b''.join(m)
+ key = ms[:key_len]
+ iv = ms[key_len:key_len + iv_len]
+ cached_keys[cached_key] = (key, iv)
+ return key, iv
+
+
+class Encryptor(object):
+ def __init__(self, key, method, iv = None):
+ self.key = key
+ self.method = method
+ self.iv = None
+ self.iv_sent = False
+ self.cipher_iv = b''
+ self.iv_buf = b''
+ self.cipher_key = b''
+ self.decipher = None
+ method = method.lower()
+ self._method_info = self.get_method_info(method)
+ if self._method_info:
+ if iv is None or len(iv) != self._method_info[1]:
+ self.cipher = self.get_cipher(key, method, 1,
+ random_string(self._method_info[1]))
+ else:
+ self.cipher = self.get_cipher(key, method, 1, iv)
+ else:
+ logging.error('method %s not supported' % method)
+ sys.exit(1)
+
+ def get_method_info(self, method):
+ method = method.lower()
+ m = method_supported.get(method)
+ return m
+
+ def iv_len(self):
+ return len(self.cipher_iv)
+
+ def get_cipher(self, password, method, op, iv):
+ password = common.to_bytes(password)
+ m = self._method_info
+ if m[0] > 0:
+ key, iv_ = EVP_BytesToKey(password, m[0], m[1])
+ else:
+ # key_length == 0 indicates we should use the key directly
+ key, iv = password, b''
+
+ iv = iv[:m[1]]
+ if op == 1:
+ # this iv is for cipher not decipher
+ self.cipher_iv = iv[:m[1]]
+ self.cipher_key = key
+ return m[2](method, key, iv, op)
+
+ def encrypt(self, buf):
+ if len(buf) == 0:
+ return buf
+ if self.iv_sent:
+ return self.cipher.update(buf)
+ else:
+ self.iv_sent = True
+ return self.cipher_iv + self.cipher.update(buf)
+
+ def decrypt(self, buf):
+ if len(buf) == 0:
+ return buf
+ if self.decipher is not None: #optimize
+ return self.decipher.update(buf)
+
+ decipher_iv_len = self._method_info[1]
+ if len(self.iv_buf) <= decipher_iv_len:
+ self.iv_buf += buf
+ if len(self.iv_buf) > decipher_iv_len:
+ decipher_iv = self.iv_buf[:decipher_iv_len]
+ self.decipher = self.get_cipher(self.key, self.method, 0,
+ iv=decipher_iv)
+ buf = self.iv_buf[decipher_iv_len:]
+ del self.iv_buf
+ return self.decipher.update(buf)
+ else:
+ return b''
+
+def encrypt_all(password, method, op, data):
+ result = []
+ method = method.lower()
+ (key_len, iv_len, m) = method_supported[method]
+ if key_len > 0:
+ key, _ = EVP_BytesToKey(password, key_len, iv_len)
+ else:
+ key = password
+ if op:
+ iv = random_string(iv_len)
+ result.append(iv)
+ else:
+ iv = data[:iv_len]
+ data = data[iv_len:]
+ cipher = m(method, key, iv, op)
+ result.append(cipher.update(data))
+ return b''.join(result)
+
+def encrypt_key(password, method):
+ method = method.lower()
+ (key_len, iv_len, m) = method_supported[method]
+ if key_len > 0:
+ key, _ = EVP_BytesToKey(password, key_len, iv_len)
+ else:
+ key = password
+ return key
+
+def encrypt_iv_len(method):
+ method = method.lower()
+ (key_len, iv_len, m) = method_supported[method]
+ return iv_len
+
+def encrypt_new_iv(method):
+ method = method.lower()
+ (key_len, iv_len, m) = method_supported[method]
+ return random_string(iv_len)
+
+def encrypt_all_iv(key, method, op, data, ref_iv):
+ result = []
+ method = method.lower()
+ (key_len, iv_len, m) = method_supported[method]
+ if op:
+ iv = ref_iv[0]
+ result.append(iv)
+ else:
+ iv = data[:iv_len]
+ data = data[iv_len:]
+ ref_iv[0] = iv
+ cipher = m(method, key, iv, op)
+ result.append(cipher.update(data))
+ return b''.join(result)
+
+
+CIPHERS_TO_TEST = [
+ 'aes-128-cfb',
+ 'aes-256-cfb',
+ 'rc4-md5',
+ 'salsa20',
+ 'chacha20',
+ 'table',
+]
+
+
+def test_encryptor():
+ from os import urandom
+ plain = urandom(10240)
+ for method in CIPHERS_TO_TEST:
+ logging.warn(method)
+ encryptor = Encryptor(b'key', method)
+ decryptor = Encryptor(b'key', method)
+ cipher = encryptor.encrypt(plain)
+ plain2 = decryptor.decrypt(cipher)
+ assert plain == plain2
+
+
+def test_encrypt_all():
+ from os import urandom
+ plain = urandom(10240)
+ for method in CIPHERS_TO_TEST:
+ logging.warn(method)
+ cipher = encrypt_all(b'key', method, 1, plain)
+ plain2 = encrypt_all(b'key', method, 0, cipher)
+ assert plain == plain2
+
+
+if __name__ == '__main__':
+ test_encrypt_all()
+ test_encryptor()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt_test.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt_test.py
new file mode 100644
index 000000000..d5e507789
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/encrypt_test.py
@@ -0,0 +1,51 @@
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import sys
+import os
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../'))
+
+
+from shadowsocks.crypto import rc4_md5
+from shadowsocks.crypto import openssl
+from shadowsocks.crypto import sodium
+from shadowsocks.crypto import table
+
+def run(func):
+ try:
+ func()
+ except:
+ pass
+
+def run_n(func, name):
+ try:
+ func(name)
+ except:
+ pass
+
+def main():
+ print("\n""rc4_md5")
+ rc4_md5.test()
+ print("\n""aes-256-cfb")
+ openssl.test_aes_256_cfb()
+ print("\n""aes-128-cfb")
+ openssl.test_aes_128_cfb()
+ print("\n""bf-cfb")
+ run(openssl.test_bf_cfb)
+ print("\n""camellia-128-cfb")
+ run_n(openssl.run_method, "camellia-128-cfb")
+ print("\n""cast5-cfb")
+ run_n(openssl.run_method, "cast5-cfb")
+ print("\n""idea-cfb")
+ run_n(openssl.run_method, "idea-cfb")
+ print("\n""seed-cfb")
+ run_n(openssl.run_method, "seed-cfb")
+ print("\n""salsa20")
+ run(sodium.test_salsa20)
+ print("\n""chacha20")
+ run(sodium.test_chacha20)
+
+if __name__ == '__main__':
+ main()
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/eventloop.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/eventloop.py
new file mode 100644
index 000000000..341620efd
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/eventloop.py
@@ -0,0 +1,258 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2013-2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# from ssloop
+# https://github.com/clowwindy/ssloop
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import time
+import socket
+import select
+import errno
+import logging
+from collections import defaultdict
+
+from shadowsocks import shell
+
+
+__all__ = ['EventLoop', 'POLL_NULL', 'POLL_IN', 'POLL_OUT', 'POLL_ERR',
+ 'POLL_HUP', 'POLL_NVAL', 'EVENT_NAMES']
+
+POLL_NULL = 0x00
+POLL_IN = 0x01
+POLL_OUT = 0x04
+POLL_ERR = 0x08
+POLL_HUP = 0x10
+POLL_NVAL = 0x20
+
+
+EVENT_NAMES = {
+ POLL_NULL: 'POLL_NULL',
+ POLL_IN: 'POLL_IN',
+ POLL_OUT: 'POLL_OUT',
+ POLL_ERR: 'POLL_ERR',
+ POLL_HUP: 'POLL_HUP',
+ POLL_NVAL: 'POLL_NVAL',
+}
+
+# we check timeouts every TIMEOUT_PRECISION seconds
+TIMEOUT_PRECISION = 2
+
+
+class KqueueLoop(object):
+
+ MAX_EVENTS = 1024
+
+ def __init__(self):
+ self._kqueue = select.kqueue()
+ self._fds = {}
+
+ def _control(self, fd, mode, flags):
+ events = []
+ if mode & POLL_IN:
+ events.append(select.kevent(fd, select.KQ_FILTER_READ, flags))
+ if mode & POLL_OUT:
+ events.append(select.kevent(fd, select.KQ_FILTER_WRITE, flags))
+ for e in events:
+ self._kqueue.control([e], 0)
+
+ def poll(self, timeout):
+ if timeout < 0:
+ timeout = None # kqueue behaviour
+ events = self._kqueue.control(None, KqueueLoop.MAX_EVENTS, timeout)
+ results = defaultdict(lambda: POLL_NULL)
+ for e in events:
+ fd = e.ident
+ if e.filter == select.KQ_FILTER_READ:
+ results[fd] |= POLL_IN
+ elif e.filter == select.KQ_FILTER_WRITE:
+ results[fd] |= POLL_OUT
+ return results.items()
+
+ def register(self, fd, mode):
+ self._fds[fd] = mode
+ self._control(fd, mode, select.KQ_EV_ADD)
+
+ def unregister(self, fd):
+ self._control(fd, self._fds[fd], select.KQ_EV_DELETE)
+ del self._fds[fd]
+
+ def modify(self, fd, mode):
+ self.unregister(fd)
+ self.register(fd, mode)
+
+ def close(self):
+ self._kqueue.close()
+
+
+class SelectLoop(object):
+
+ def __init__(self):
+ self._r_list = set()
+ self._w_list = set()
+ self._x_list = set()
+
+ def poll(self, timeout):
+ r, w, x = select.select(self._r_list, self._w_list, self._x_list,
+ timeout)
+ results = defaultdict(lambda: POLL_NULL)
+ for p in [(r, POLL_IN), (w, POLL_OUT), (x, POLL_ERR)]:
+ for fd in p[0]:
+ results[fd] |= p[1]
+ return results.items()
+
+ def register(self, fd, mode):
+ if mode & POLL_IN:
+ self._r_list.add(fd)
+ if mode & POLL_OUT:
+ self._w_list.add(fd)
+ if mode & POLL_ERR:
+ self._x_list.add(fd)
+
+ def unregister(self, fd):
+ if fd in self._r_list:
+ self._r_list.remove(fd)
+ if fd in self._w_list:
+ self._w_list.remove(fd)
+ if fd in self._x_list:
+ self._x_list.remove(fd)
+
+ def modify(self, fd, mode):
+ self.unregister(fd)
+ self.register(fd, mode)
+
+ def close(self):
+ pass
+
+
+class EventLoop(object):
+ def __init__(self):
+ if hasattr(select, 'epoll'):
+ self._impl = select.epoll()
+ model = 'epoll'
+ elif hasattr(select, 'kqueue'):
+ self._impl = KqueueLoop()
+ model = 'kqueue'
+ elif hasattr(select, 'select'):
+ self._impl = SelectLoop()
+ model = 'select'
+ else:
+ raise Exception('can not find any available functions in select '
+ 'package')
+ self._fdmap = {} # (f, handler)
+ self._last_time = time.time()
+ self._periodic_callbacks = []
+ self._stopping = False
+ logging.debug('using event model: %s', model)
+
+ def poll(self, timeout=None):
+ events = self._impl.poll(timeout)
+ return [(self._fdmap[fd][0], fd, event) for fd, event in events]
+
+ def add(self, f, mode, handler):
+ fd = f.fileno()
+ self._fdmap[fd] = (f, handler)
+ self._impl.register(fd, mode)
+
+ def remove(self, f):
+ fd = f.fileno()
+ del self._fdmap[fd]
+ self._impl.unregister(fd)
+
+ def removefd(self, fd):
+ del self._fdmap[fd]
+ self._impl.unregister(fd)
+
+ def add_periodic(self, callback):
+ self._periodic_callbacks.append(callback)
+
+ def remove_periodic(self, callback):
+ self._periodic_callbacks.remove(callback)
+
+ def modify(self, f, mode):
+ fd = f.fileno()
+ self._impl.modify(fd, mode)
+
+ def stop(self):
+ self._stopping = True
+
+ def run(self):
+ events = []
+ while not self._stopping:
+ asap = False
+ try:
+ events = self.poll(TIMEOUT_PRECISION)
+ except (OSError, IOError) as e:
+ if errno_from_exception(e) in (errno.EPIPE, errno.EINTR):
+ # EPIPE: Happens when the client closes the connection
+ # EINTR: Happens when received a signal
+ # handles them as soon as possible
+ asap = True
+ logging.debug('poll:%s', e)
+ else:
+ logging.error('poll:%s', e)
+ import traceback
+ traceback.print_exc()
+ continue
+
+ handle = False
+ for sock, fd, event in events:
+ handler = self._fdmap.get(fd, None)
+ if handler is not None:
+ handler = handler[1]
+ try:
+ handle = handler.handle_event(sock, fd, event) or handle
+ except (OSError, IOError) as e:
+ shell.print_exception(e)
+ now = time.time()
+ if asap or now - self._last_time >= TIMEOUT_PRECISION:
+ for callback in self._periodic_callbacks:
+ callback()
+ self._last_time = now
+ if events and not handle:
+ time.sleep(0.001)
+
+ def __del__(self):
+ self._impl.close()
+
+
+# from tornado
+def errno_from_exception(e):
+ """Provides the errno from an Exception object.
+
+ There are cases that the errno attribute was not set so we pull
+ the errno out of the args but if someone instatiates an Exception
+ without any args you will get a tuple error. So this function
+ abstracts all that behavior to give you a safe way to get the
+ errno.
+ """
+
+ if hasattr(e, 'errno'):
+ return e.errno
+ elif e.args:
+ return e.args[0]
+ else:
+ return None
+
+
+# from tornado
+def get_sock_error(sock):
+ error_number = sock.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
+ return socket.error(error_number, os.strerror(error_number))
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/local.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/local.py
new file mode 100755
index 000000000..9f54d9306
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/local.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2012-2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import sys
+import os
+import logging
+import signal
+
+if __name__ == '__main__':
+ import inspect
+ file_path = os.path.dirname(os.path.realpath(inspect.getfile(inspect.currentframe())))
+ sys.path.insert(0, os.path.join(file_path, '../'))
+
+from shadowsocks import shell, daemon, eventloop, tcprelay, udprelay, asyncdns
+
+
+def main():
+ shell.check_python()
+
+ # fix py2exe
+ if hasattr(sys, "frozen") and sys.frozen in \
+ ("windows_exe", "console_exe"):
+ p = os.path.dirname(os.path.abspath(sys.executable))
+ os.chdir(p)
+
+ config = shell.get_config(True)
+
+ if not config.get('dns_ipv6', False):
+ asyncdns.IPV6_CONNECTION_SUPPORT = False
+
+ daemon.daemon_exec(config)
+ logging.info("local start with protocol[%s] password [%s] method [%s] obfs [%s] obfs_param [%s]" %
+ (config['protocol'], config['password'], config['method'], config['obfs'], config['obfs_param']))
+
+ try:
+ logging.info("starting local at %s:%d" %
+ (config['local_address'], config['local_port']))
+
+ dns_resolver = asyncdns.DNSResolver()
+ tcp_server = tcprelay.TCPRelay(config, dns_resolver, True)
+ udp_server = udprelay.UDPRelay(config, dns_resolver, True)
+ loop = eventloop.EventLoop()
+ dns_resolver.add_to_loop(loop)
+ tcp_server.add_to_loop(loop)
+ udp_server.add_to_loop(loop)
+
+ def handler(signum, _):
+ logging.warn('received SIGQUIT, doing graceful shutting down..')
+ tcp_server.close(next_tick=True)
+ udp_server.close(next_tick=True)
+ signal.signal(getattr(signal, 'SIGQUIT', signal.SIGTERM), handler)
+
+ def int_handler(signum, _):
+ sys.exit(1)
+ signal.signal(signal.SIGINT, int_handler)
+
+ daemon.set_user(config.get('user', None))
+ loop.run()
+ except Exception as e:
+ shell.print_exception(e)
+ sys.exit(1)
+
+if __name__ == '__main__':
+ main()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/logrun.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/logrun.sh
new file mode 100755
index 000000000..fc081e1d2
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/logrun.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+cd `dirname $0`
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py a" | awk '{print "kill "$2}')
+ulimit -n 512000
+nohup ${python_ver} server.py a>> ssserver.log 2>&1 &
+
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/lru_cache.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/lru_cache.py
new file mode 100644
index 000000000..ab0d21086
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/lru_cache.py
@@ -0,0 +1,179 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import collections
+import logging
+import time
+
+if __name__ == '__main__':
+ import os, sys, inspect
+ file_path = os.path.dirname(os.path.realpath(inspect.getfile(inspect.currentframe())))
+ sys.path.insert(0, os.path.join(file_path, '../'))
+
+try:
+ from collections import OrderedDict
+except:
+ from shadowsocks.ordereddict import OrderedDict
+
+# this LRUCache is optimized for concurrency, not QPS
+# n: concurrency, keys stored in the cache
+# m: visits not timed out, proportional to QPS * timeout
+# get & set is O(1), not O(n). thus we can support very large n
+# sweep is O((n - m)) or O(1024) at most,
+# no metter how large the cache or timeout value is
+
+SWEEP_MAX_ITEMS = 1024
+
+class LRUCache(collections.MutableMapping):
+ """This class is not thread safe"""
+
+ def __init__(self, timeout=60, close_callback=None, *args, **kwargs):
+ self.timeout = timeout
+ self.close_callback = close_callback
+ self._store = {}
+ self._keys_to_last_time = OrderedDict()
+ self.update(dict(*args, **kwargs)) # use the free update to set keys
+
+ def __getitem__(self, key):
+ # O(1)
+ t = time.time()
+ last_t = self._keys_to_last_time[key]
+ del self._keys_to_last_time[key]
+ self._keys_to_last_time[key] = t
+ return self._store[key]
+
+ def __setitem__(self, key, value):
+ # O(1)
+ t = time.time()
+ if key in self._keys_to_last_time:
+ del self._keys_to_last_time[key]
+ self._keys_to_last_time[key] = t
+ self._store[key] = value
+
+ def __delitem__(self, key):
+ # O(1)
+ last_t = self._keys_to_last_time[key]
+ del self._store[key]
+ del self._keys_to_last_time[key]
+
+ def __contains__(self, key):
+ return key in self._store
+
+ def __iter__(self):
+ return iter(self._store)
+
+ def __len__(self):
+ return len(self._store)
+
+ def first(self):
+ if len(self._keys_to_last_time) > 0:
+ for key in self._keys_to_last_time:
+ return key
+
+ def sweep(self, sweep_item_cnt = SWEEP_MAX_ITEMS):
+ # O(n - m)
+ now = time.time()
+ c = 0
+ while c < sweep_item_cnt:
+ if len(self._keys_to_last_time) == 0:
+ break
+ for key in self._keys_to_last_time:
+ break
+ last_t = self._keys_to_last_time[key]
+ if now - last_t <= self.timeout:
+ break
+ value = self._store[key]
+ del self._store[key]
+ del self._keys_to_last_time[key]
+ if self.close_callback is not None:
+ self.close_callback(value)
+ c += 1
+ if c:
+ logging.debug('%d keys swept' % c)
+ return c < SWEEP_MAX_ITEMS
+
+ def clear(self, keep):
+ now = time.time()
+ c = 0
+ while len(self._keys_to_last_time) > keep:
+ if len(self._keys_to_last_time) == 0:
+ break
+ for key in self._keys_to_last_time:
+ break
+ last_t = self._keys_to_last_time[key]
+ value = self._store[key]
+ if self.close_callback is not None:
+ self.close_callback(value)
+ del self._store[key]
+ del self._keys_to_last_time[key]
+ c += 1
+ if c:
+ logging.debug('%d keys swept' % c)
+ return c < SWEEP_MAX_ITEMS
+
+def test():
+ c = LRUCache(timeout=0.3)
+
+ c['a'] = 1
+ assert c['a'] == 1
+ c['a'] = 1
+
+ time.sleep(0.5)
+ c.sweep()
+ assert 'a' not in c
+
+ c['a'] = 2
+ c['b'] = 3
+ time.sleep(0.2)
+ c.sweep()
+ assert c['a'] == 2
+ assert c['b'] == 3
+
+ time.sleep(0.2)
+ c.sweep()
+ c['b']
+ time.sleep(0.2)
+ c.sweep()
+ assert 'a' not in c
+ assert c['b'] == 3
+
+ time.sleep(0.5)
+ c.sweep()
+ assert 'a' not in c
+ assert 'b' not in c
+
+ global close_cb_called
+ close_cb_called = False
+
+ def close_cb(t):
+ global close_cb_called
+ assert not close_cb_called
+ close_cb_called = True
+
+ c = LRUCache(timeout=0.1, close_callback=close_cb)
+ c['s'] = 1
+ c['s']
+ time.sleep(0.1)
+ c['s']
+ time.sleep(0.3)
+ c.sweep()
+
+if __name__ == '__main__':
+ test()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/manager.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/manager.py
new file mode 100644
index 000000000..80d0a320b
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/manager.py
@@ -0,0 +1,291 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import errno
+import traceback
+import socket
+import logging
+import json
+import collections
+
+from shadowsocks import common, eventloop, tcprelay, udprelay, asyncdns, shell
+
+
+BUF_SIZE = 1506
+STAT_SEND_LIMIT = 50
+
+
+class Manager(object):
+
+ def __init__(self, config):
+ self._config = config
+ self._relays = {} # (tcprelay, udprelay)
+ self._loop = eventloop.EventLoop()
+ self._dns_resolver = asyncdns.DNSResolver()
+ self._dns_resolver.add_to_loop(self._loop)
+
+ self._statistics = collections.defaultdict(int)
+ self._control_client_addr = None
+ try:
+ manager_address = common.to_str(config['manager_address'])
+ if ':' in manager_address:
+ addr = manager_address.rsplit(':', 1)
+ addr = addr[0], int(addr[1])
+ addrs = socket.getaddrinfo(addr[0], addr[1])
+ if addrs:
+ family = addrs[0][0]
+ else:
+ logging.error('invalid address: %s', manager_address)
+ exit(1)
+ else:
+ addr = manager_address
+ family = socket.AF_UNIX
+ self._control_socket = socket.socket(family,
+ socket.SOCK_DGRAM)
+ self._control_socket.bind(addr)
+ self._control_socket.setblocking(False)
+ except (OSError, IOError) as e:
+ logging.error(e)
+ logging.error('can not bind to manager address')
+ exit(1)
+ self._loop.add(self._control_socket,
+ eventloop.POLL_IN, self)
+ self._loop.add_periodic(self.handle_periodic)
+
+ port_password = config['port_password']
+ del config['port_password']
+ for port, password in port_password.items():
+ a_config = config.copy()
+ a_config['server_port'] = int(port)
+ a_config['password'] = password
+ self.add_port(a_config)
+
+ def add_port(self, config):
+ port = int(config['server_port'])
+ servers = self._relays.get(port, None)
+ if servers:
+ logging.error("server already exists at %s:%d" % (config['server'],
+ port))
+ return
+ logging.info("adding server at %s:%d" % (config['server'], port))
+ t = tcprelay.TCPRelay(config, self._dns_resolver, False,
+ stat_callback=self.stat_callback)
+ u = udprelay.UDPRelay(config, self._dns_resolver, False,
+ stat_callback=self.stat_callback)
+ t.add_to_loop(self._loop)
+ u.add_to_loop(self._loop)
+ self._relays[port] = (t, u)
+
+ def remove_port(self, config):
+ port = int(config['server_port'])
+ servers = self._relays.get(port, None)
+ if servers:
+ logging.info("removing server at %s:%d" % (config['server'], port))
+ t, u = servers
+ t.close(next_tick=False)
+ u.close(next_tick=False)
+ del self._relays[port]
+ else:
+ logging.error("server not exist at %s:%d" % (config['server'],
+ port))
+
+ def handle_event(self, sock, fd, event):
+ if sock == self._control_socket and event == eventloop.POLL_IN:
+ data, self._control_client_addr = sock.recvfrom(BUF_SIZE)
+ parsed = self._parse_command(data)
+ if parsed:
+ command, config = parsed
+ a_config = self._config.copy()
+ if config:
+ # let the command override the configuration file
+ a_config.update(config)
+ if 'server_port' not in a_config:
+ logging.error('can not find server_port in config')
+ else:
+ if command == 'add':
+ self.add_port(a_config)
+ self._send_control_data(b'ok')
+ elif command == 'remove':
+ self.remove_port(a_config)
+ self._send_control_data(b'ok')
+ elif command == 'ping':
+ self._send_control_data(b'pong')
+ else:
+ logging.error('unknown command %s', command)
+
+ def _parse_command(self, data):
+ # commands:
+ # add: {"server_port": 8000, "password": "foobar"}
+ # remove: {"server_port": 8000"}
+ data = common.to_str(data)
+ parts = data.split(':', 1)
+ if len(parts) < 2:
+ return data, None
+ command, config_json = parts
+ try:
+ config = shell.parse_json_in_str(config_json)
+ return command, config
+ except Exception as e:
+ logging.error(e)
+ return None
+
+ def stat_callback(self, port, data_len):
+ self._statistics[port] += data_len
+
+ def handle_periodic(self):
+ r = {}
+ i = 0
+
+ def send_data(data_dict):
+ if data_dict:
+ # use compact JSON format (without space)
+ data = common.to_bytes(json.dumps(data_dict,
+ separators=(',', ':')))
+ self._send_control_data(b'stat: ' + data)
+
+ for k, v in self._statistics.items():
+ r[k] = v
+ i += 1
+ # split the data into segments that fit in UDP packets
+ if i >= STAT_SEND_LIMIT:
+ send_data(r)
+ r.clear()
+ i = 0
+ if len(r) > 0 :
+ send_data(r)
+ self._statistics.clear()
+
+ def _send_control_data(self, data):
+ if self._control_client_addr:
+ try:
+ self._control_socket.sendto(data, self._control_client_addr)
+ except (socket.error, OSError, IOError) as e:
+ error_no = eventloop.errno_from_exception(e)
+ if error_no in (errno.EAGAIN, errno.EINPROGRESS,
+ errno.EWOULDBLOCK):
+ return
+ else:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+
+ def run(self):
+ self._loop.run()
+
+
+def run(config):
+ Manager(config).run()
+
+
+def test():
+ import time
+ import threading
+ import struct
+ from shadowsocks import encrypt
+
+ logging.basicConfig(level=5,
+ format='%(asctime)s %(levelname)-8s %(message)s',
+ datefmt='%Y-%m-%d %H:%M:%S')
+ enc = []
+ eventloop.TIMEOUT_PRECISION = 1
+
+ def run_server():
+ config = shell.get_config(True)
+ config = config.copy()
+ a_config = {
+ 'server': '127.0.0.1',
+ 'local_port': 1081,
+ 'port_password': {
+ '8381': 'foobar1',
+ '8382': 'foobar2'
+ },
+ 'method': 'aes-256-cfb',
+ 'manager_address': '127.0.0.1:6001',
+ 'timeout': 60,
+ 'fast_open': False,
+ 'verbose': 2
+ }
+ config.update(a_config)
+ manager = Manager(config)
+ enc.append(manager)
+ manager.run()
+
+ t = threading.Thread(target=run_server)
+ t.start()
+ time.sleep(1)
+ manager = enc[0]
+ cli = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ cli.connect(('127.0.0.1', 6001))
+
+ # test add and remove
+ time.sleep(1)
+ cli.send(b'add: {"server_port":7001, "password":"asdfadsfasdf"}')
+ time.sleep(1)
+ assert 7001 in manager._relays
+ data, addr = cli.recvfrom(1506)
+ assert b'ok' in data
+
+ cli.send(b'remove: {"server_port":8381}')
+ time.sleep(1)
+ assert 8381 not in manager._relays
+ data, addr = cli.recvfrom(1506)
+ assert b'ok' in data
+ logging.info('add and remove test passed')
+
+ # test statistics for TCP
+ header = common.pack_addr(b'google.com') + struct.pack('>H', 80)
+ data = encrypt.encrypt_all(b'asdfadsfasdf', 'aes-256-cfb', 1,
+ header + b'GET /\r\n\r\n')
+ tcp_cli = socket.socket()
+ tcp_cli.connect(('127.0.0.1', 7001))
+ tcp_cli.send(data)
+ tcp_cli.recv(4096)
+ tcp_cli.close()
+
+ data, addr = cli.recvfrom(1506)
+ data = common.to_str(data)
+ assert data.startswith('stat: ')
+ data = data.split('stat:')[1]
+ stats = shell.parse_json_in_str(data)
+ assert '7001' in stats
+ logging.info('TCP statistics test passed')
+
+ # test statistics for UDP
+ header = common.pack_addr(b'127.0.0.1') + struct.pack('>H', 80)
+ data = encrypt.encrypt_all(b'foobar2', 'aes-256-cfb', 1,
+ header + b'test')
+ udp_cli = socket.socket(type=socket.SOCK_DGRAM)
+ udp_cli.sendto(data, ('127.0.0.1', 8382))
+ tcp_cli.close()
+
+ data, addr = cli.recvfrom(1506)
+ data = common.to_str(data)
+ assert data.startswith('stat: ')
+ data = data.split('stat:')[1]
+ stats = json.loads(data)
+ assert '8382' in stats
+ logging.info('UDP statistics test passed')
+
+ manager._loop.stop()
+ t.join()
+
+
+if __name__ == '__main__':
+ test()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfs.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfs.py
new file mode 100644
index 000000000..3dfdb141f
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfs.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python
+#
+# Copyright 2015-2015 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+
+from shadowsocks import common
+from shadowsocks.obfsplugin import plain, http_simple, obfs_tls, verify, auth, auth_chain
+
+
+method_supported = {}
+method_supported.update(plain.obfs_map)
+method_supported.update(http_simple.obfs_map)
+method_supported.update(obfs_tls.obfs_map)
+method_supported.update(verify.obfs_map)
+method_supported.update(auth.obfs_map)
+method_supported.update(auth_chain.obfs_map)
+
+def mu_protocol():
+ return ["auth_aes128_md5", "auth_aes128_sha1", "auth_chain_a"]
+
+class server_info(object):
+ def __init__(self, data):
+ self.data = data
+
+class obfs(object):
+ def __init__(self, method):
+ method = common.to_str(method)
+ self.method = method
+ self._method_info = self.get_method_info(method)
+ if self._method_info:
+ self.obfs = self.get_obfs(method)
+ else:
+ raise Exception('obfs plugin [%s] not supported' % method)
+
+ def init_data(self):
+ return self.obfs.init_data()
+
+ def set_server_info(self, server_info):
+ return self.obfs.set_server_info(server_info)
+
+ def get_server_info(self):
+ return self.obfs.get_server_info()
+
+ def get_method_info(self, method):
+ method = method.lower()
+ m = method_supported.get(method)
+ return m
+
+ def get_obfs(self, method):
+ m = self._method_info
+ return m[0](method)
+
+ def get_overhead(self, direction):
+ return self.obfs.get_overhead(direction)
+
+ def client_pre_encrypt(self, buf):
+ return self.obfs.client_pre_encrypt(buf)
+
+ def client_encode(self, buf):
+ return self.obfs.client_encode(buf)
+
+ def client_decode(self, buf):
+ return self.obfs.client_decode(buf)
+
+ def client_post_decrypt(self, buf):
+ return self.obfs.client_post_decrypt(buf)
+
+ def server_pre_encrypt(self, buf):
+ return self.obfs.server_pre_encrypt(buf)
+
+ def server_encode(self, buf):
+ return self.obfs.server_encode(buf)
+
+ def server_decode(self, buf):
+ return self.obfs.server_decode(buf)
+
+ def server_post_decrypt(self, buf):
+ return self.obfs.server_post_decrypt(buf)
+
+ def client_udp_pre_encrypt(self, buf):
+ return self.obfs.client_udp_pre_encrypt(buf)
+
+ def client_udp_post_decrypt(self, buf):
+ return self.obfs.client_udp_post_decrypt(buf)
+
+ def server_udp_pre_encrypt(self, buf, uid):
+ return self.obfs.server_udp_pre_encrypt(buf, uid)
+
+ def server_udp_post_decrypt(self, buf):
+ return self.obfs.server_udp_post_decrypt(buf)
+
+ def dispose(self):
+ self.obfs.dispose()
+ del self.obfs
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/__init__.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/__init__.py
new file mode 100644
index 000000000..401c7b726
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/__init__.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/auth.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/auth.py
new file mode 100755
index 000000000..a745e098f
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/auth.py
@@ -0,0 +1,787 @@
+#!/usr/bin/env python
+#
+# Copyright 2015-2015 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+import binascii
+import base64
+import time
+import datetime
+import random
+import math
+import struct
+import zlib
+import hmac
+import hashlib
+
+import shadowsocks
+from shadowsocks import common, lru_cache, encrypt
+from shadowsocks.obfsplugin import plain
+from shadowsocks.common import to_bytes, to_str, ord, chr
+
+def create_auth_sha1_v4(method):
+ return auth_sha1_v4(method)
+
+def create_auth_aes128_md5(method):
+ return auth_aes128_sha1(method, hashlib.md5)
+
+def create_auth_aes128_sha1(method):
+ return auth_aes128_sha1(method, hashlib.sha1)
+
+obfs_map = {
+ 'auth_sha1_v4': (create_auth_sha1_v4,),
+ 'auth_sha1_v4_compatible': (create_auth_sha1_v4,),
+ 'auth_aes128_md5': (create_auth_aes128_md5,),
+ 'auth_aes128_sha1': (create_auth_aes128_sha1,),
+}
+
+def match_begin(str1, str2):
+ if len(str1) >= len(str2):
+ if str1[:len(str2)] == str2:
+ return True
+ return False
+
+class auth_base(plain.plain):
+ def __init__(self, method):
+ super(auth_base, self).__init__(method)
+ self.method = method
+ self.no_compatible_method = ''
+ self.overhead = 7
+
+ def init_data(self):
+ return ''
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return self.overhead
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+
+ def client_encode(self, buf):
+ return buf
+
+ def client_decode(self, buf):
+ return (buf, False)
+
+ def server_encode(self, buf):
+ return buf
+
+ def server_decode(self, buf):
+ return (buf, True, False)
+
+ def not_match_return(self, buf):
+ self.raw_trans = True
+ self.overhead = 0
+ if self.method == self.no_compatible_method:
+ return (b'E'*2048, False)
+ return (buf, False)
+
+class client_queue(object):
+ def __init__(self, begin_id):
+ self.front = begin_id - 64
+ self.back = begin_id + 1
+ self.alloc = {}
+ self.enable = True
+ self.last_update = time.time()
+
+ def update(self):
+ self.last_update = time.time()
+
+ def is_active(self):
+ return time.time() - self.last_update < 60 * 3
+
+ def re_enable(self, connection_id):
+ self.enable = True
+ self.front = connection_id - 64
+ self.back = connection_id + 1
+ self.alloc = {}
+
+ def insert(self, connection_id):
+ if not self.enable:
+ logging.warn('obfs auth: not enable')
+ return False
+ if not self.is_active():
+ self.re_enable(connection_id)
+ self.update()
+ if connection_id < self.front:
+ logging.warn('obfs auth: deprecated id, someone replay attack')
+ return False
+ if connection_id > self.front + 0x4000:
+ logging.warn('obfs auth: wrong id')
+ return False
+ if connection_id in self.alloc:
+ logging.warn('obfs auth: duplicate id, someone replay attack')
+ return False
+ if self.back <= connection_id:
+ self.back = connection_id + 1
+ self.alloc[connection_id] = 1
+ while (self.front in self.alloc) or self.front + 0x1000 < self.back:
+ if self.front in self.alloc:
+ del self.alloc[self.front]
+ self.front += 1
+ return True
+
+class obfs_auth_v2_data(object):
+ def __init__(self):
+ self.client_id = lru_cache.LRUCache()
+ self.local_client_id = b''
+ self.connection_id = 0
+ self.set_max_client(64) # max active client count
+
+ def update(self, client_id, connection_id):
+ if client_id in self.client_id:
+ self.client_id[client_id].update()
+
+ def set_max_client(self, max_client):
+ self.max_client = max_client
+ self.max_buffer = max(self.max_client * 2, 1024)
+
+ def insert(self, client_id, connection_id):
+ if self.client_id.get(client_id, None) is None or not self.client_id[client_id].enable:
+ if self.client_id.first() is None or len(self.client_id) < self.max_client:
+ if client_id not in self.client_id:
+ #TODO: check
+ self.client_id[client_id] = client_queue(connection_id)
+ else:
+ self.client_id[client_id].re_enable(connection_id)
+ return self.client_id[client_id].insert(connection_id)
+
+ if not self.client_id[self.client_id.first()].is_active():
+ del self.client_id[self.client_id.first()]
+ if client_id not in self.client_id:
+ #TODO: check
+ self.client_id[client_id] = client_queue(connection_id)
+ else:
+ self.client_id[client_id].re_enable(connection_id)
+ return self.client_id[client_id].insert(connection_id)
+
+ logging.warn('auth_sha1_v2: no inactive client')
+ return False
+ else:
+ return self.client_id[client_id].insert(connection_id)
+
+class auth_sha1_v4(auth_base):
+ def __init__(self, method):
+ super(auth_sha1_v4, self).__init__(method)
+ self.recv_buf = b''
+ self.unit_len = 8100
+ self.decrypt_packet_num = 0
+ self.raw_trans = False
+ self.has_sent_header = False
+ self.has_recv_header = False
+ self.client_id = 0
+ self.connection_id = 0
+ self.max_time_dif = 60 * 60 * 24 # time dif (second) setting
+ self.salt = b"auth_sha1_v4"
+ self.no_compatible_method = 'auth_sha1_v4'
+
+ def init_data(self):
+ return obfs_auth_v2_data()
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+ try:
+ max_client = int(server_info.protocol_param)
+ except:
+ max_client = 64
+ self.server_info.data.set_max_client(max_client)
+
+ def rnd_data(self, buf_size):
+ if buf_size > 1200:
+ return b'\x01'
+
+ if buf_size > 400:
+ rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 256)
+ else:
+ rnd_data = os.urandom(struct.unpack('>H', os.urandom(2))[0] % 512)
+
+ if len(rnd_data) < 128:
+ return common.chr(len(rnd_data) + 1) + rnd_data
+ else:
+ return common.chr(255) + struct.pack('>H', len(rnd_data) + 3) + rnd_data
+
+ def pack_data(self, buf):
+ data = self.rnd_data(len(buf)) + buf
+ data_len = len(data) + 8
+ crc = binascii.crc32(struct.pack('>H', data_len)) & 0xFFFF
+ data = struct.pack('H', data_len) + data
+ adler32 = zlib.adler32(data) & 0xFFFFFFFF
+ data += struct.pack('H', data_len) + self.salt + self.server_info.key) & 0xFFFFFFFF
+ data = struct.pack('H', data_len) + data
+ data += hmac.new(self.server_info.iv + self.server_info.key, data, hashlib.sha1).digest()[:10]
+ return data
+
+ def auth_data(self):
+ utc_time = int(time.time()) & 0xFFFFFFFF
+ if self.server_info.data.connection_id > 0xFF000000:
+ self.server_info.data.local_client_id = b''
+ if not self.server_info.data.local_client_id:
+ self.server_info.data.local_client_id = os.urandom(4)
+ logging.debug("local_client_id %s" % (binascii.hexlify(self.server_info.data.local_client_id),))
+ self.server_info.data.connection_id = struct.unpack(' self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf)
+ return ret
+
+ def client_post_decrypt(self, buf):
+ if self.raw_trans:
+ return buf
+ self.recv_buf += buf
+ out_buf = b''
+ while len(self.recv_buf) > 4:
+ crc = struct.pack('H', self.recv_buf[:2])[0]
+ if length >= 8192 or length < 7:
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data error')
+ if length > len(self.recv_buf):
+ break
+
+ if struct.pack('H', self.recv_buf[5:7])[0] + 4
+ out_buf += self.recv_buf[pos:length - 4]
+ self.recv_buf = self.recv_buf[length:]
+
+ if out_buf:
+ self.decrypt_packet_num += 1
+ return out_buf
+
+ def server_pre_encrypt(self, buf):
+ if self.raw_trans:
+ return buf
+ ret = b''
+ while len(buf) > self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf)
+ return ret
+
+ def server_post_decrypt(self, buf):
+ if self.raw_trans:
+ return (buf, False)
+ self.recv_buf += buf
+ out_buf = b''
+ sendback = False
+
+ if not self.has_recv_header:
+ if len(self.recv_buf) <= 6:
+ return (b'', False)
+ crc = struct.pack('H', self.recv_buf[:2])[0]
+ if length > len(self.recv_buf):
+ return (b'', False)
+ sha1data = hmac.new(self.server_info.recv_iv + self.server_info.key, self.recv_buf[:length - 10], hashlib.sha1).digest()[:10]
+ if sha1data != self.recv_buf[length - 10:length]:
+ logging.error('auth_sha1_v4 data uncorrect auth HMAC-SHA1')
+ return self.not_match_return(self.recv_buf)
+ pos = common.ord(self.recv_buf[6])
+ if pos < 255:
+ pos += 6
+ else:
+ pos = struct.unpack('>H', self.recv_buf[7:9])[0] + 6
+ out_buf = self.recv_buf[pos:length - 10]
+ if len(out_buf) < 12:
+ logging.info('auth_sha1_v4: too short, data %s' % (binascii.hexlify(self.recv_buf),))
+ return self.not_match_return(self.recv_buf)
+ utc_time = struct.unpack(' self.max_time_dif:
+ logging.info('auth_sha1_v4: wrong timestamp, time_dif %d, data %s' % (time_dif, binascii.hexlify(out_buf),))
+ return self.not_match_return(self.recv_buf)
+ elif self.server_info.data.insert(client_id, connection_id):
+ self.has_recv_header = True
+ out_buf = out_buf[12:]
+ self.client_id = client_id
+ self.connection_id = connection_id
+ else:
+ logging.info('auth_sha1_v4: auth fail, data %s' % (binascii.hexlify(out_buf),))
+ return self.not_match_return(self.recv_buf)
+ self.recv_buf = self.recv_buf[length:]
+ self.has_recv_header = True
+ sendback = True
+
+ while len(self.recv_buf) > 4:
+ crc = struct.pack('H', self.recv_buf[:2])[0]
+ if length >= 8192 or length < 7:
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.decrypt_packet_num == 0:
+ logging.info('auth_sha1_v4: over size')
+ return (b'E'*2048, False)
+ else:
+ raise Exception('server_post_decrype data error')
+ if length > len(self.recv_buf):
+ break
+
+ if struct.pack('H', self.recv_buf[5:7])[0] + 4
+ out_buf += self.recv_buf[pos:length - 4]
+ self.recv_buf = self.recv_buf[length:]
+ if pos == length - 4:
+ sendback = True
+
+ if out_buf:
+ self.server_info.data.update(self.client_id, self.connection_id)
+ self.decrypt_packet_num += 1
+ return (out_buf, sendback)
+
+class obfs_auth_mu_data(object):
+ def __init__(self):
+ self.user_id = {}
+ self.local_client_id = b''
+ self.connection_id = 0
+ self.set_max_client(64) # max active client count
+
+ def update(self, user_id, client_id, connection_id):
+ if user_id not in self.user_id:
+ self.user_id[user_id] = lru_cache.LRUCache()
+ local_client_id = self.user_id[user_id]
+
+ if client_id in local_client_id:
+ local_client_id[client_id].update()
+
+ def set_max_client(self, max_client):
+ self.max_client = max_client
+ self.max_buffer = max(self.max_client * 2, 1024)
+
+ def insert(self, user_id, client_id, connection_id):
+ if user_id not in self.user_id:
+ self.user_id[user_id] = lru_cache.LRUCache()
+ local_client_id = self.user_id[user_id]
+
+ if local_client_id.get(client_id, None) is None or not local_client_id[client_id].enable:
+ if local_client_id.first() is None or len(local_client_id) < self.max_client:
+ if client_id not in local_client_id:
+ #TODO: check
+ local_client_id[client_id] = client_queue(connection_id)
+ else:
+ local_client_id[client_id].re_enable(connection_id)
+ return local_client_id[client_id].insert(connection_id)
+
+ if not local_client_id[local_client_id.first()].is_active():
+ del local_client_id[local_client_id.first()]
+ if client_id not in local_client_id:
+ #TODO: check
+ local_client_id[client_id] = client_queue(connection_id)
+ else:
+ local_client_id[client_id].re_enable(connection_id)
+ return local_client_id[client_id].insert(connection_id)
+
+ logging.warn('auth_aes128: no inactive client')
+ return False
+ else:
+ return local_client_id[client_id].insert(connection_id)
+
+class auth_aes128_sha1(auth_base):
+ def __init__(self, method, hashfunc):
+ super(auth_aes128_sha1, self).__init__(method)
+ self.hashfunc = hashfunc
+ self.recv_buf = b''
+ self.unit_len = 8100
+ self.raw_trans = False
+ self.has_sent_header = False
+ self.has_recv_header = False
+ self.client_id = 0
+ self.connection_id = 0
+ self.max_time_dif = 60 * 60 * 24 # time dif (second) setting
+ self.salt = hashfunc == hashlib.md5 and b"auth_aes128_md5" or b"auth_aes128_sha1"
+ self.no_compatible_method = hashfunc == hashlib.md5 and "auth_aes128_md5" or 'auth_aes128_sha1'
+ self.extra_wait_size = struct.unpack('>H', os.urandom(2))[0] % 1024
+ self.pack_id = 1
+ self.recv_id = 1
+ self.user_id = None
+ self.user_key = None
+ self.last_rnd_len = 0
+ self.overhead = 9
+
+ def init_data(self):
+ return obfs_auth_mu_data()
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return self.overhead
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+ try:
+ max_client = int(server_info.protocol_param.split('#')[0])
+ except:
+ max_client = 64
+ self.server_info.data.set_max_client(max_client)
+
+ def trapezoid_random_float(self, d):
+ if d == 0:
+ return random.random()
+ s = random.random()
+ a = 1 - d
+ return (math.sqrt(a * a + 4 * d * s) - a) / (2 * d)
+
+ def trapezoid_random_int(self, max_val, d):
+ v = self.trapezoid_random_float(d)
+ return int(v * max_val)
+
+ def rnd_data_len(self, buf_size, full_buf_size):
+ if full_buf_size >= self.server_info.buffer_size:
+ return 0
+ tcp_mss = self.server_info.tcp_mss
+ rev_len = tcp_mss - buf_size - 9
+ if rev_len == 0:
+ return 0
+ if rev_len < 0:
+ if rev_len > -tcp_mss:
+ return self.trapezoid_random_int(rev_len + tcp_mss, -0.3)
+ return common.ord(os.urandom(1)[0]) % 32
+ if buf_size > 900:
+ return struct.unpack('>H', os.urandom(2))[0] % rev_len
+ return self.trapezoid_random_int(rev_len, -0.3)
+
+ def rnd_data(self, buf_size, full_buf_size):
+ data_len = self.rnd_data_len(buf_size, full_buf_size)
+
+ if data_len < 128:
+ return common.chr(data_len + 1) + os.urandom(data_len)
+
+ return common.chr(255) + struct.pack(' 400:
+ rnd_len = struct.unpack(' 0xFF000000:
+ self.server_info.data.local_client_id = b''
+ if not self.server_info.data.local_client_id:
+ self.server_info.data.local_client_id = os.urandom(4)
+ logging.debug("local_client_id %s" % (binascii.hexlify(self.server_info.data.local_client_id),))
+ self.server_info.data.connection_id = struct.unpack(' self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len], ogn_data_len)
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf, ogn_data_len)
+ self.last_rnd_len = ogn_data_len
+ return ret
+
+ def client_post_decrypt(self, buf):
+ if self.raw_trans:
+ return buf
+ self.recv_buf += buf
+ out_buf = b''
+ while len(self.recv_buf) > 4:
+ mac_key = self.user_key + struct.pack('= 8192 or length < 7:
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data error')
+ if length > len(self.recv_buf):
+ break
+
+ if hmac.new(mac_key, self.recv_buf[:length - 4], self.hashfunc).digest()[:4] != self.recv_buf[length - 4:length]:
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data uncorrect checksum')
+
+ self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
+ pos = common.ord(self.recv_buf[4])
+ if pos < 255:
+ pos += 4
+ else:
+ pos = struct.unpack(' self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len], ogn_data_len)
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf, ogn_data_len)
+ self.last_rnd_len = ogn_data_len
+ return ret
+
+ def server_post_decrypt(self, buf):
+ if self.raw_trans:
+ return (buf, False)
+ self.recv_buf += buf
+ out_buf = b''
+ sendback = False
+
+ if not self.has_recv_header:
+ if len(self.recv_buf) >= 7 or len(self.recv_buf) in [2, 3]:
+ recv_len = min(len(self.recv_buf), 7)
+ mac_key = self.server_info.recv_iv + self.server_info.key
+ sha1data = hmac.new(mac_key, self.recv_buf[:1], self.hashfunc).digest()[:recv_len - 1]
+ if sha1data != self.recv_buf[1:recv_len]:
+ return self.not_match_return(self.recv_buf)
+
+ if len(self.recv_buf) < 31:
+ return (b'', False)
+ sha1data = hmac.new(mac_key, self.recv_buf[7:27], self.hashfunc).digest()[:4]
+ if sha1data != self.recv_buf[27:31]:
+ logging.error('%s data uncorrect auth HMAC-SHA1 from %s:%d, data %s' % (self.no_compatible_method, self.server_info.client, self.server_info.client_port, binascii.hexlify(self.recv_buf)))
+ if len(self.recv_buf) < 31 + self.extra_wait_size:
+ return (b'', False)
+ return self.not_match_return(self.recv_buf)
+
+ uid = self.recv_buf[7:11]
+ if uid in self.server_info.users:
+ self.user_id = uid
+ self.user_key = self.hashfunc(self.server_info.users[uid]).digest()
+ self.server_info.update_user_func(uid)
+ else:
+ if not self.server_info.users:
+ self.user_key = self.server_info.key
+ else:
+ self.user_key = self.server_info.recv_iv
+ encryptor = encrypt.Encryptor(to_bytes(base64.b64encode(self.user_key)) + self.salt, 'aes-128-cbc')
+ head = encryptor.decrypt(b'\x00' * 16 + self.recv_buf[11:27] + b'\x00') # need an extra byte or recv empty
+ length = struct.unpack(' self.max_time_dif:
+ logging.info('%s: wrong timestamp, time_dif %d, data %s' % (self.no_compatible_method, time_dif, binascii.hexlify(head)))
+ return self.not_match_return(self.recv_buf)
+ elif self.server_info.data.insert(self.user_id, client_id, connection_id):
+ self.has_recv_header = True
+ out_buf = self.recv_buf[31 + rnd_len:length - 4]
+ self.client_id = client_id
+ self.connection_id = connection_id
+ else:
+ logging.info('%s: auth fail, data %s' % (self.no_compatible_method, binascii.hexlify(out_buf)))
+ return self.not_match_return(self.recv_buf)
+ self.recv_buf = self.recv_buf[length:]
+ self.has_recv_header = True
+ sendback = True
+
+ while len(self.recv_buf) > 4:
+ mac_key = self.user_key + struct.pack('= 8192 or length < 7:
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.recv_id == 0:
+ logging.info(self.no_compatible_method + ': over size')
+ return (b'E'*2048, False)
+ else:
+ raise Exception('server_post_decrype data error')
+ if length > len(self.recv_buf):
+ break
+
+ if hmac.new(mac_key, self.recv_buf[:length - 4], self.hashfunc).digest()[:4] != self.recv_buf[length - 4:length]:
+ logging.info('%s: checksum error, data %s' % (self.no_compatible_method, binascii.hexlify(self.recv_buf[:length])))
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.recv_id == 0:
+ return (b'E'*2048, False)
+ else:
+ raise Exception('server_post_decrype data uncorrect checksum')
+
+ self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
+ pos = common.ord(self.recv_buf[4])
+ if pos < 255:
+ pos += 4
+ else:
+ pos = struct.unpack('> 17) ^ (y >> 26)) & xorshift128plus.max_int
+ self.v1 = x
+ return (x + y) & xorshift128plus.max_int
+
+ def init_from_bin(self, bin):
+ bin += b'\0' * 16
+ self.v0 = struct.unpack('= len(str2):
+ if str1[:len(str2)] == str2:
+ return True
+ return False
+
+
+class auth_base(plain.plain):
+ def __init__(self, method):
+ super(auth_base, self).__init__(method)
+ self.method = method
+ self.no_compatible_method = ''
+ self.overhead = 4
+
+ def init_data(self):
+ return ''
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return self.overhead
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+
+ def client_encode(self, buf):
+ return buf
+
+ def client_decode(self, buf):
+ return (buf, False)
+
+ def server_encode(self, buf):
+ return buf
+
+ def server_decode(self, buf):
+ return (buf, True, False)
+
+ def not_match_return(self, buf):
+ self.raw_trans = True
+ self.overhead = 0
+ if self.method == self.no_compatible_method:
+ return (b'E' * 2048, False)
+ return (buf, False)
+
+
+class client_queue(object):
+ def __init__(self, begin_id):
+ self.front = begin_id - 64
+ self.back = begin_id + 1
+ self.alloc = {}
+ self.enable = True
+ self.last_update = time.time()
+ self.ref = 0
+
+ def update(self):
+ self.last_update = time.time()
+
+ def addref(self):
+ self.ref += 1
+
+ def delref(self):
+ if self.ref > 0:
+ self.ref -= 1
+
+ def is_active(self):
+ return (self.ref > 0) and (time.time() - self.last_update < 60 * 10)
+
+ def re_enable(self, connection_id):
+ self.enable = True
+ self.front = connection_id - 64
+ self.back = connection_id + 1
+ self.alloc = {}
+
+ def insert(self, connection_id):
+ if not self.enable:
+ logging.warn('obfs auth: not enable')
+ return False
+ if not self.is_active():
+ self.re_enable(connection_id)
+ self.update()
+ if connection_id < self.front:
+ logging.warn('obfs auth: deprecated id, someone replay attack')
+ return False
+ if connection_id > self.front + 0x4000:
+ logging.warn('obfs auth: wrong id')
+ return False
+ if connection_id in self.alloc:
+ logging.warn('obfs auth: duplicate id, someone replay attack')
+ return False
+ if self.back <= connection_id:
+ self.back = connection_id + 1
+ self.alloc[connection_id] = 1
+ while (self.front in self.alloc) or self.front + 0x1000 < self.back:
+ if self.front in self.alloc:
+ del self.alloc[self.front]
+ self.front += 1
+ self.addref()
+ return True
+
+
+class obfs_auth_chain_data(object):
+ def __init__(self, name):
+ self.name = name
+ self.user_id = {}
+ self.local_client_id = b''
+ self.connection_id = 0
+ self.set_max_client(64) # max active client count
+
+ def update(self, user_id, client_id, connection_id):
+ if user_id not in self.user_id:
+ self.user_id[user_id] = lru_cache.LRUCache()
+ local_client_id = self.user_id[user_id]
+
+ if client_id in local_client_id:
+ local_client_id[client_id].update()
+
+ def set_max_client(self, max_client):
+ self.max_client = max_client
+ self.max_buffer = max(self.max_client * 2, 1024)
+
+ def insert(self, user_id, client_id, connection_id):
+ if user_id not in self.user_id:
+ self.user_id[user_id] = lru_cache.LRUCache()
+ local_client_id = self.user_id[user_id]
+
+ if local_client_id.get(client_id, None) is None or not local_client_id[client_id].enable:
+ if local_client_id.first() is None or len(local_client_id) < self.max_client:
+ if client_id not in local_client_id:
+ # TODO: check
+ local_client_id[client_id] = client_queue(connection_id)
+ else:
+ local_client_id[client_id].re_enable(connection_id)
+ return local_client_id[client_id].insert(connection_id)
+
+ if not local_client_id[local_client_id.first()].is_active():
+ del local_client_id[local_client_id.first()]
+ if client_id not in local_client_id:
+ # TODO: check
+ local_client_id[client_id] = client_queue(connection_id)
+ else:
+ local_client_id[client_id].re_enable(connection_id)
+ return local_client_id[client_id].insert(connection_id)
+
+ logging.warn(self.name + ': no inactive client')
+ return False
+ else:
+ return local_client_id[client_id].insert(connection_id)
+
+ def remove(self, user_id, client_id):
+ if user_id in self.user_id:
+ local_client_id = self.user_id[user_id]
+ if client_id in local_client_id:
+ local_client_id[client_id].delref()
+
+
+class auth_chain_a(auth_base):
+ def __init__(self, method):
+ super(auth_chain_a, self).__init__(method)
+ self.hashfunc = hashlib.md5
+ self.recv_buf = b''
+ self.unit_len = 2800
+ self.raw_trans = False
+ self.has_sent_header = False
+ self.has_recv_header = False
+ self.client_id = 0
+ self.connection_id = 0
+ self.max_time_dif = 60 * 60 * 24 # time dif (second) setting
+ self.salt = b"auth_chain_a"
+ self.no_compatible_method = 'auth_chain_a'
+ self.pack_id = 1
+ self.recv_id = 1
+ self.user_id = None
+ self.user_id_num = 0
+ self.user_key = None
+ self.overhead = 4
+ self.client_over_head = 4
+ self.last_client_hash = b''
+ self.last_server_hash = b''
+ self.random_client = xorshift128plus()
+ self.random_server = xorshift128plus()
+ self.encryptor = None
+
+ def init_data(self):
+ return obfs_auth_chain_data(self.method)
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return self.overhead
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+ try:
+ max_client = int(server_info.protocol_param.split('#')[0])
+ except:
+ max_client = 64
+ self.server_info.data.set_max_client(max_client)
+
+ def trapezoid_random_float(self, d):
+ if d == 0:
+ return random.random()
+ s = random.random()
+ a = 1 - d
+ return (math.sqrt(a * a + 4 * d * s) - a) / (2 * d)
+
+ def trapezoid_random_int(self, max_val, d):
+ v = self.trapezoid_random_float(d)
+ return int(v * max_val)
+
+ def rnd_data_len(self, buf_size, last_hash, random):
+ if buf_size > 1440:
+ return 0
+ random.init_from_bin_len(last_hash, buf_size)
+ if buf_size > 1300:
+ return random.next() % 31
+ if buf_size > 900:
+ return random.next() % 127
+ if buf_size > 400:
+ return random.next() % 521
+ return random.next() % 1021
+
+ def udp_rnd_data_len(self, last_hash, random):
+ random.init_from_bin(last_hash)
+ return random.next() % 127
+
+ def rnd_start_pos(self, rand_len, random):
+ if rand_len > 0:
+ return random.next() % 8589934609 % rand_len
+ return 0
+
+ def rnd_data(self, buf_size, buf, last_hash, random):
+ rand_len = self.rnd_data_len(buf_size, last_hash, random)
+
+ rnd_data_buf = os.urandom(rand_len)
+
+ if buf_size == 0:
+ return rnd_data_buf
+ else:
+ if rand_len > 0:
+ start_pos = self.rnd_start_pos(rand_len, random)
+ return rnd_data_buf[:start_pos] + buf + rnd_data_buf[start_pos:]
+ else:
+ return buf
+
+ def pack_client_data(self, buf):
+ buf = self.encryptor.encrypt(buf)
+ data = self.rnd_data(len(buf), buf, self.last_client_hash, self.random_client)
+ data_len = len(data) + 8
+ mac_key = self.user_key + struct.pack(' 0xFF000000:
+ self.server_info.data.local_client_id = b''
+ if not self.server_info.data.local_client_id:
+ self.server_info.data.local_client_id = os.urandom(4)
+ logging.debug("local_client_id %s" % (binascii.hexlify(self.server_info.data.local_client_id),))
+ self.server_info.data.connection_id = struct.unpack(' self.unit_len:
+ ret += self.pack_client_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_client_data(buf)
+ return ret
+
+ def client_post_decrypt(self, buf):
+ if self.raw_trans:
+ return buf
+ self.recv_buf += buf
+ out_buf = b''
+ while len(self.recv_buf) > 4:
+ mac_key = self.user_key + struct.pack('= 4096:
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data error')
+
+ if length + 4 > len(self.recv_buf):
+ break
+
+ server_hash = hmac.new(mac_key, self.recv_buf[:length + 2], self.hashfunc).digest()
+ if server_hash[:2] != self.recv_buf[length + 2: length + 4]:
+ logging.info('%s: checksum error, data %s'
+ % (self.no_compatible_method, binascii.hexlify(self.recv_buf[:length])))
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data uncorrect checksum')
+
+ pos = 2
+ if data_len > 0 and rand_len > 0:
+ pos = 2 + self.rnd_start_pos(rand_len, self.random_server)
+ out_buf += self.encryptor.decrypt(self.recv_buf[pos: data_len + pos])
+ self.last_server_hash = server_hash
+ if self.recv_id == 1:
+ self.server_info.tcp_mss = struct.unpack(' self.unit_len:
+ ret += self.pack_server_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_server_data(buf)
+ return ret
+
+ def server_post_decrypt(self, buf):
+ if self.raw_trans:
+ return (buf, False)
+ self.recv_buf += buf
+ out_buf = b''
+ sendback = False
+
+ if not self.has_recv_header:
+ if len(self.recv_buf) >= 12 or len(self.recv_buf) in [7, 8]:
+ recv_len = min(len(self.recv_buf), 12)
+ mac_key = self.server_info.recv_iv + self.server_info.key
+ md5data = hmac.new(mac_key, self.recv_buf[:4], self.hashfunc).digest()
+ if md5data[:recv_len - 4] != self.recv_buf[4:recv_len]:
+ return self.not_match_return(self.recv_buf)
+
+ if len(self.recv_buf) < 12 + 24:
+ return (b'', False)
+
+ self.last_client_hash = md5data
+ uid = struct.unpack(' self.max_time_dif:
+ logging.info('%s: wrong timestamp, time_dif %d, data %s' % (
+ self.no_compatible_method, time_dif, binascii.hexlify(head)
+ ))
+ return self.not_match_return(self.recv_buf)
+ elif self.server_info.data.insert(self.user_id, client_id, connection_id):
+ self.has_recv_header = True
+ self.client_id = client_id
+ self.connection_id = connection_id
+ else:
+ logging.info('%s: auth fail, data %s' % (self.no_compatible_method, binascii.hexlify(out_buf)))
+ return self.not_match_return(self.recv_buf)
+
+ self.encryptor = encrypt.Encryptor(
+ to_bytes(base64.b64encode(self.user_key)) + to_bytes(base64.b64encode(self.last_client_hash)), 'rc4')
+ self.recv_buf = self.recv_buf[36:]
+ self.has_recv_header = True
+ sendback = True
+
+ while len(self.recv_buf) > 4:
+ mac_key = self.user_key + struct.pack('= 4096:
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.recv_id == 0:
+ logging.info(self.no_compatible_method + ': over size')
+ return (b'E' * 2048, False)
+ else:
+ raise Exception('server_post_decrype data error')
+
+ if length + 4 > len(self.recv_buf):
+ break
+
+ client_hash = hmac.new(mac_key, self.recv_buf[:length + 2], self.hashfunc).digest()
+ if client_hash[:2] != self.recv_buf[length + 2: length + 4]:
+ logging.info('%s: checksum error, data %s' % (
+ self.no_compatible_method, binascii.hexlify(self.recv_buf[:length])
+ ))
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.recv_id == 0:
+ return (b'E' * 2048, False)
+ else:
+ raise Exception('server_post_decrype data uncorrect checksum')
+
+ self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
+ pos = 2
+ if data_len > 0 and rand_len > 0:
+ pos = 2 + self.rnd_start_pos(rand_len, self.random_client)
+ out_buf += self.encryptor.decrypt(self.recv_buf[pos: data_len + pos])
+ self.last_client_hash = client_hash
+ self.recv_buf = self.recv_buf[length + 4:]
+ if data_len == 0:
+ sendback = True
+
+ if out_buf:
+ self.server_info.data.update(self.user_id, self.client_id, self.connection_id)
+ return (out_buf, sendback)
+
+ def client_udp_pre_encrypt(self, buf):
+ if self.user_key is None:
+ if b':' in to_bytes(self.server_info.protocol_param):
+ try:
+ items = to_bytes(self.server_info.protocol_param).split(':')
+ self.user_key = self.hashfunc(items[1]).digest()
+ self.user_id = struct.pack('= 1440:
+ return 0
+ random.init_from_bin_len(last_hash, buf_size)
+ pos = bisect.bisect_left(self.data_size_list, buf_size + self.server_info.overhead)
+ final_pos = pos + random.next() % (len(self.data_size_list))
+ # 鍋囪random鍧囧寑鍒嗗竷锛屽垯瓒婇暱鐨勫師濮嬫暟鎹暱搴﹁秺瀹规槗if false
+ if final_pos < len(self.data_size_list):
+ return self.data_size_list[final_pos] - buf_size - self.server_info.overhead
+
+ # 涓婇潰if false鍚庨夋嫨2鍙疯ˉ鍏ㄦ暟缁勶紝姝ゅ鏈夋洿绮剧粏鐨勯暱搴﹀垎娈
+ pos = bisect.bisect_left(self.data_size_list2, buf_size + self.server_info.overhead)
+ final_pos = pos + random.next() % (len(self.data_size_list2))
+ if final_pos < len(self.data_size_list2):
+ return self.data_size_list2[final_pos] - buf_size - self.server_info.overhead
+ # final_pos 鎬绘槸鍒嗗竷鍦╬os~(data_size_list2.len-1)涔嬮棿
+ if final_pos < pos + len(self.data_size_list2) - 1:
+ return 0
+ # 鏈1/len(self.data_size_list2)鐨勬鐜囦笉婊¤冻涓婁竴涓猧f ?
+ # 鐞嗚涓婁笉浼氳繍琛屽埌姝ゅ锛屽洜姝ゅ彲浠ユ彃鍏ヨ繍琛屾柇瑷 ?
+ # assert False
+
+ if buf_size > 1300:
+ return random.next() % 31
+ if buf_size > 900:
+ return random.next() % 127
+ if buf_size > 400:
+ return random.next() % 521
+ return random.next() % 1021
+
+
+class auth_chain_c(auth_chain_b):
+ def __init__(self, method):
+ super(auth_chain_c, self).__init__(method)
+ self.salt = b"auth_chain_c"
+ self.no_compatible_method = 'auth_chain_c'
+ self.data_size_list0 = []
+
+ def init_data_size(self, key):
+ if self.data_size_list0:
+ self.data_size_list0 = []
+ random = xorshift128plus()
+ random.init_from_bin(key)
+ # 琛ュ叏鏁扮粍闀夸负12~24-1
+ list_len = random.next() % (8 + 16) + (4 + 8)
+ for i in range(0, list_len):
+ self.data_size_list0.append((int)(random.next() % 2340 % 2040 % 1440))
+ self.data_size_list0.sort()
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+ try:
+ max_client = int(server_info.protocol_param.split('#')[0])
+ except:
+ max_client = 64
+ self.server_info.data.set_max_client(max_client)
+ self.init_data_size(self.server_info.key)
+
+ def rnd_data_len(self, buf_size, last_hash, random):
+ other_data_size = buf_size + self.server_info.overhead
+ # 涓瀹氳鍦╮andom浣跨敤鍓嶅垵濮嬪寲锛屼互淇濊瘉鏈嶅姟鍣ㄤ笌瀹㈡埛绔悓姝ワ紝淇濊瘉鍖呭ぇ灏忛獙璇佺粨鏋滄纭
+ random.init_from_bin_len(last_hash, buf_size)
+ # final_pos 鎬绘槸鍒嗗竷鍦╬os~(data_size_list0.len-1)涔嬮棿
+ # 闄ら潪data_size_list0涓殑浠讳綍鍊煎潎杩囧皬浣垮叾鍏ㄩ儴閮芥棤娉曞绾砨uf
+ if other_data_size >= self.data_size_list0[-1]:
+ if other_data_size >= 1440:
+ return 0
+ if other_data_size > 1300:
+ return random.next() % 31
+ if other_data_size > 900:
+ return random.next() % 127
+ if other_data_size > 400:
+ return random.next() % 521
+ return random.next() % 1021
+
+ pos = bisect.bisect_left(self.data_size_list0, other_data_size)
+ # random select a size in the leftover data_size_list0
+ final_pos = pos + random.next() % (len(self.data_size_list0) - pos)
+ return self.data_size_list0[final_pos] - other_data_size
+
+
+class auth_chain_d(auth_chain_b):
+ def __init__(self, method):
+ super(auth_chain_d, self).__init__(method)
+ self.salt = b"auth_chain_d"
+ self.no_compatible_method = 'auth_chain_d'
+ self.data_size_list0 = []
+
+ def check_and_patch_data_size(self, random):
+ # append new item
+ # when the biggest item(first time) or the last append item(other time) are not big enough.
+ # but set a limit size (64) to avoid stack overflow.
+ if self.data_size_list0[-1] < 1300 and len(self.data_size_list0) < 64:
+ self.data_size_list0.append((int)(random.next() % 2340 % 2040 % 1440))
+ self.check_and_patch_data_size(random)
+
+ def init_data_size(self, key):
+ if self.data_size_list0:
+ self.data_size_list0 = []
+ random = xorshift128plus()
+ random.init_from_bin(key)
+ # 琛ュ叏鏁扮粍闀夸负12~24-1
+ list_len = random.next() % (8 + 16) + (4 + 8)
+ for i in range(0, list_len):
+ self.data_size_list0.append((int)(random.next() % 2340 % 2040 % 1440))
+ self.data_size_list0.sort()
+ old_len = len(self.data_size_list0)
+ self.check_and_patch_data_size(random)
+ # if check_and_patch_data_size are work, re-sort again.
+ if old_len != len(self.data_size_list0):
+ self.data_size_list0.sort()
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+ try:
+ max_client = int(server_info.protocol_param.split('#')[0])
+ except:
+ max_client = 64
+ self.server_info.data.set_max_client(max_client)
+ self.init_data_size(self.server_info.key)
+
+ def rnd_data_len(self, buf_size, last_hash, random):
+ other_data_size = buf_size + self.server_info.overhead
+ # if other_data_size > the bigest item in data_size_list0, not padding any data
+ if other_data_size >= self.data_size_list0[-1]:
+ return 0
+
+ random.init_from_bin_len(last_hash, buf_size)
+ pos = bisect.bisect_left(self.data_size_list0, other_data_size)
+ # random select a size in the leftover data_size_list0
+ final_pos = pos + random.next() % (len(self.data_size_list0) - pos)
+ return self.data_size_list0[final_pos] - other_data_size
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/http_simple.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/http_simple.py
new file mode 100644
index 000000000..ff3c5fdfb
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/http_simple.py
@@ -0,0 +1,315 @@
+#!/usr/bin/env python
+#
+# Copyright 2015-2015 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+import binascii
+import struct
+import base64
+import datetime
+import random
+
+from shadowsocks import common
+from shadowsocks.obfsplugin import plain
+from shadowsocks.common import to_bytes, to_str, ord, chr
+
+def create_http_simple_obfs(method):
+ return http_simple(method)
+
+def create_http_post_obfs(method):
+ return http_post(method)
+
+def create_random_head_obfs(method):
+ return random_head(method)
+
+obfs_map = {
+ 'http_simple': (create_http_simple_obfs,),
+ 'http_simple_compatible': (create_http_simple_obfs,),
+ 'http_post': (create_http_post_obfs,),
+ 'http_post_compatible': (create_http_post_obfs,),
+ 'random_head': (create_random_head_obfs,),
+ 'random_head_compatible': (create_random_head_obfs,),
+}
+
+def match_begin(str1, str2):
+ if len(str1) >= len(str2):
+ if str1[:len(str2)] == str2:
+ return True
+ return False
+
+class http_simple(plain.plain):
+ def __init__(self, method):
+ self.method = method
+ self.has_sent_header = False
+ self.has_recv_header = False
+ self.host = None
+ self.port = 0
+ self.recv_buffer = b''
+ # TODO user config user_agent
+ self.user_agent = [b"Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0",
+ b"Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/44.0",
+ b"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
+ b"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.11 (KHTML, like Gecko) Ubuntu/11.10 Chromium/27.0.1453.93 Chrome/27.0.1453.93 Safari/537.36",
+ b"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0",
+ b"Mozilla/5.0 (compatible; WOW64; MSIE 10.0; Windows NT 6.2)",
+ b"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27",
+ b"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C)",
+ b"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko",
+ b"Mozilla/5.0 (Linux; Android 4.4; Nexus 5 Build/BuildID) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36",
+ b"Mozilla/5.0 (iPad; CPU OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+ b"Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3"]
+
+ def encode_head(self, buf):
+ hexstr = binascii.hexlify(buf)
+ chs = []
+ for i in range(0, len(hexstr), 2):
+ chs.append(b"%" + hexstr[i:i+2])
+ return b''.join(chs)
+
+ def client_encode(self, buf):
+ if self.has_sent_header:
+ return buf
+ head_size = len(self.server_info.iv) + self.server_info.head_len
+ if len(buf) - head_size > 64:
+ headlen = head_size + random.randint(0, 64)
+ else:
+ headlen = len(buf)
+ headdata = buf[:headlen]
+ buf = buf[headlen:]
+ port = b''
+ if self.server_info.port != 80:
+ port = b':' + to_bytes(str(self.server_info.port))
+ body = None
+ hosts = (self.server_info.obfs_param or self.server_info.host)
+ pos = hosts.find("#")
+ if pos >= 0:
+ body = hosts[pos + 1:].replace("\n", "\r\n")
+ body = body.replace("\\n", "\r\n")
+ hosts = hosts[:pos]
+ hosts = hosts.split(',')
+ host = random.choice(hosts)
+ http_head = b"GET /" + self.encode_head(headdata) + b" HTTP/1.1\r\n"
+ http_head += b"Host: " + to_bytes(host) + port + b"\r\n"
+ if body:
+ http_head += body + "\r\n\r\n"
+ else:
+ http_head += b"User-Agent: " + random.choice(self.user_agent) + b"\r\n"
+ http_head += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\n\r\n"
+ self.has_sent_header = True
+ return http_head + buf
+
+ def client_decode(self, buf):
+ if self.has_recv_header:
+ return (buf, False)
+ pos = buf.find(b'\r\n\r\n')
+ if pos >= 0:
+ self.has_recv_header = True
+ return (buf[pos + 4:], False)
+ else:
+ return (b'', False)
+
+ def server_encode(self, buf):
+ if self.has_sent_header:
+ return buf
+
+ header = b'HTTP/1.1 200 OK\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nContent-Type: text/html\r\nDate: '
+ header += to_bytes(datetime.datetime.now().strftime('%a, %d %b %Y %H:%M:%S GMT'))
+ header += b'\r\nServer: nginx\r\nVary: Accept-Encoding\r\n\r\n'
+ self.has_sent_header = True
+ return header + buf
+
+ def get_data_from_http_header(self, buf):
+ ret_buf = b''
+ lines = buf.split(b'\r\n')
+ if lines and len(lines) > 1:
+ hex_items = lines[0].split(b'%')
+ if hex_items and len(hex_items) > 1:
+ for index in range(1, len(hex_items)):
+ if len(hex_items[index]) < 2:
+ ret_buf += binascii.unhexlify('0' + hex_items[index])
+ break
+ elif len(hex_items[index]) > 2:
+ ret_buf += binascii.unhexlify(hex_items[index][:2])
+ break
+ else:
+ ret_buf += binascii.unhexlify(hex_items[index])
+ return ret_buf
+ return b''
+
+ def get_host_from_http_header(self, buf):
+ ret_buf = b''
+ lines = buf.split(b'\r\n')
+ if lines and len(lines) > 1:
+ for line in lines:
+ if match_begin(line, b"Host: "):
+ return common.to_str(line[6:])
+
+ def not_match_return(self, buf):
+ self.has_sent_header = True
+ self.has_recv_header = True
+ if self.method == 'http_simple':
+ return (b'E'*2048, False, False)
+ return (buf, True, False)
+
+ def error_return(self, buf):
+ self.has_sent_header = True
+ self.has_recv_header = True
+ return (b'E'*2048, False, False)
+
+ def server_decode(self, buf):
+ if self.has_recv_header:
+ return (buf, True, False)
+
+ self.recv_buffer += buf
+ buf = self.recv_buffer
+ if len(buf) > 10:
+ if match_begin(buf, b'GET ') or match_begin(buf, b'POST '):
+ if len(buf) > 65536:
+ self.recv_buffer = None
+ logging.warn('http_simple: over size')
+ return self.not_match_return(buf)
+ else: #not http header, run on original protocol
+ self.recv_buffer = None
+ logging.debug('http_simple: not match begin')
+ return self.not_match_return(buf)
+ else:
+ return (b'', True, False)
+
+ if b'\r\n\r\n' in buf:
+ datas = buf.split(b'\r\n\r\n', 1)
+ ret_buf = self.get_data_from_http_header(buf)
+ host = self.get_host_from_http_header(buf)
+ if host and self.server_info.obfs_param:
+ pos = host.find(":")
+ if pos >= 0:
+ host = host[:pos]
+ hosts = self.server_info.obfs_param.split(',')
+ if host not in hosts:
+ return self.not_match_return(buf)
+ if len(ret_buf) < 4:
+ return self.error_return(buf)
+ if len(datas) > 1:
+ ret_buf += datas[1]
+ if len(ret_buf) >= 13:
+ self.has_recv_header = True
+ return (ret_buf, True, False)
+ return self.not_match_return(buf)
+ else:
+ return (b'', True, False)
+
+class http_post(http_simple):
+ def __init__(self, method):
+ super(http_post, self).__init__(method)
+
+ def boundary(self):
+ return to_bytes(''.join([random.choice("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") for i in range(32)]))
+
+ def client_encode(self, buf):
+ if self.has_sent_header:
+ return buf
+ head_size = len(self.server_info.iv) + self.server_info.head_len
+ if len(buf) - head_size > 64:
+ headlen = head_size + random.randint(0, 64)
+ else:
+ headlen = len(buf)
+ headdata = buf[:headlen]
+ buf = buf[headlen:]
+ port = b''
+ if self.server_info.port != 80:
+ port = b':' + to_bytes(str(self.server_info.port))
+ body = None
+ hosts = (self.server_info.obfs_param or self.server_info.host)
+ pos = hosts.find("#")
+ if pos >= 0:
+ body = hosts[pos + 1:].replace("\\n", "\r\n")
+ hosts = hosts[:pos]
+ hosts = hosts.split(',')
+ host = random.choice(hosts)
+ http_head = b"POST /" + self.encode_head(headdata) + b" HTTP/1.1\r\n"
+ http_head += b"Host: " + to_bytes(host) + port + b"\r\n"
+ if body:
+ http_head += body + "\r\n\r\n"
+ else:
+ http_head += b"User-Agent: " + random.choice(self.user_agent) + b"\r\n"
+ http_head += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.8\r\nAccept-Encoding: gzip, deflate\r\n"
+ http_head += b"Content-Type: multipart/form-data; boundary=" + self.boundary() + b"\r\nDNT: 1\r\n"
+ http_head += b"Connection: keep-alive\r\n\r\n"
+ self.has_sent_header = True
+ return http_head + buf
+
+ def not_match_return(self, buf):
+ self.has_sent_header = True
+ self.has_recv_header = True
+ if self.method == 'http_post':
+ return (b'E'*2048, False, False)
+ return (buf, True, False)
+
+class random_head(plain.plain):
+ def __init__(self, method):
+ self.method = method
+ self.has_sent_header = False
+ self.has_recv_header = False
+ self.raw_trans_sent = False
+ self.raw_trans_recv = False
+ self.send_buffer = b''
+
+ def client_encode(self, buf):
+ if self.raw_trans_sent:
+ return buf
+ self.send_buffer += buf
+ if not self.has_sent_header:
+ self.has_sent_header = True
+ data = os.urandom(common.ord(os.urandom(1)[0]) % 96 + 4)
+ crc = (0xffffffff - binascii.crc32(data)) & 0xffffffff
+ return data + struct.pack('= len(str2):
+ if str1[:len(str2)] == str2:
+ return True
+ return False
+
+class obfs_auth_data(object):
+ def __init__(self):
+ self.client_data = lru_cache.LRUCache(60 * 5)
+ self.client_id = os.urandom(32)
+ self.startup_time = int(time.time() - 60 * 30) & 0xFFFFFFFF
+ self.ticket_buf = {}
+
+class tls_ticket_auth(plain.plain):
+ def __init__(self, method):
+ self.method = method
+ self.handshake_status = 0
+ self.send_buffer = b''
+ self.recv_buffer = b''
+ self.client_id = b''
+ self.max_time_dif = 60 * 60 * 24 # time dif (second) setting
+ self.tls_version = b'\x03\x03'
+ self.overhead = 5
+
+ def init_data(self):
+ return obfs_auth_data()
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return self.overhead
+
+ def sni(self, url):
+ url = common.to_bytes(url)
+ data = b"\x00" + struct.pack('>H', len(url)) + url
+ data = b"\x00\x00" + struct.pack('>H', len(data) + 2) + struct.pack('>H', len(data)) + data
+ return data
+
+ def pack_auth_data(self, client_id):
+ utc_time = int(time.time()) & 0xFFFFFFFF
+ data = struct.pack('>I', utc_time) + os.urandom(18)
+ data += hmac.new(self.server_info.key + client_id, data, hashlib.sha1).digest()[:10]
+ return data
+
+ def client_encode(self, buf):
+ if self.handshake_status == -1:
+ return buf
+ if self.handshake_status == 8:
+ ret = b''
+ while len(buf) > 2048:
+ size = min(struct.unpack('>H', os.urandom(2))[0] % 4096 + 100, len(buf))
+ ret += b"\x17" + self.tls_version + struct.pack('>H', size) + buf[:size]
+ buf = buf[size:]
+ if len(buf) > 0:
+ ret += b"\x17" + self.tls_version + struct.pack('>H', len(buf)) + buf
+ return ret
+ if len(buf) > 0:
+ self.send_buffer += b"\x17" + self.tls_version + struct.pack('>H', len(buf)) + buf
+ if self.handshake_status == 0:
+ self.handshake_status = 1
+ data = self.tls_version + self.pack_auth_data(self.server_info.data.client_id) + b"\x20" + self.server_info.data.client_id + binascii.unhexlify(b"001cc02bc02fcca9cca8cc14cc13c00ac014c009c013009c0035002f000a" + b"0100")
+ ext = binascii.unhexlify(b"ff01000100")
+ host = self.server_info.obfs_param or self.server_info.host
+ if host and host[-1] in string.digits:
+ host = ''
+ hosts = host.split(',')
+ host = random.choice(hosts)
+ ext += self.sni(host)
+ ext += b"\x00\x17\x00\x00"
+ if host not in self.server_info.data.ticket_buf:
+ self.server_info.data.ticket_buf[host] = os.urandom((struct.unpack('>H', os.urandom(2))[0] % 17 + 8) * 16)
+ ext += b"\x00\x23" + struct.pack('>H', len(self.server_info.data.ticket_buf[host])) + self.server_info.data.ticket_buf[host]
+ ext += binascii.unhexlify(b"000d001600140601060305010503040104030301030302010203")
+ ext += binascii.unhexlify(b"000500050100000000")
+ ext += binascii.unhexlify(b"00120000")
+ ext += binascii.unhexlify(b"75500000")
+ ext += binascii.unhexlify(b"000b00020100")
+ ext += binascii.unhexlify(b"000a0006000400170018")
+ data += struct.pack('>H', len(ext)) + ext
+ data = b"\x01\x00" + struct.pack('>H', len(data)) + data
+ data = b"\x16\x03\x01" + struct.pack('>H', len(data)) + data
+ return data
+ elif self.handshake_status == 1 and len(buf) == 0:
+ data = b"\x14" + self.tls_version + b"\x00\x01\x01" #ChangeCipherSpec
+ data += b"\x16" + self.tls_version + b"\x00\x20" + os.urandom(22) #Finished
+ data += hmac.new(self.server_info.key + self.server_info.data.client_id, data, hashlib.sha1).digest()[:10]
+ ret = data + self.send_buffer
+ self.send_buffer = b''
+ self.handshake_status = 8
+ return ret
+ return b''
+
+ def client_decode(self, buf):
+ if self.handshake_status == -1:
+ return (buf, False)
+
+ if self.handshake_status == 8:
+ ret = b''
+ self.recv_buffer += buf
+ while len(self.recv_buffer) > 5:
+ if ord(self.recv_buffer[0]) != 0x17:
+ logging.info("data = %s" % (binascii.hexlify(self.recv_buffer)))
+ raise Exception('server_decode appdata error')
+ size = struct.unpack('>H', self.recv_buffer[3:5])[0]
+ if len(self.recv_buffer) < size + 5:
+ break
+ buf = self.recv_buffer[5:size+5]
+ ret += buf
+ self.recv_buffer = self.recv_buffer[size+5:]
+ return (ret, False)
+
+ if len(buf) < 11 + 32 + 1 + 32:
+ raise Exception('client_decode data error')
+ verify = buf[11:33]
+ if hmac.new(self.server_info.key + self.server_info.data.client_id, verify, hashlib.sha1).digest()[:10] != buf[33:43]:
+ raise Exception('client_decode data error')
+ if hmac.new(self.server_info.key + self.server_info.data.client_id, buf[:-10], hashlib.sha1).digest()[:10] != buf[-10:]:
+ raise Exception('client_decode data error')
+ return (b'', True)
+
+ def server_encode(self, buf):
+ if self.handshake_status == -1:
+ return buf
+ if (self.handshake_status & 8) == 8:
+ ret = b''
+ while len(buf) > 2048:
+ size = min(struct.unpack('>H', os.urandom(2))[0] % 4096 + 100, len(buf))
+ ret += b"\x17" + self.tls_version + struct.pack('>H', size) + buf[:size]
+ buf = buf[size:]
+ if len(buf) > 0:
+ ret += b"\x17" + self.tls_version + struct.pack('>H', len(buf)) + buf
+ return ret
+ self.handshake_status |= 8
+ data = self.tls_version + self.pack_auth_data(self.client_id) + b"\x20" + self.client_id + binascii.unhexlify(b"c02f000005ff01000100")
+ data = b"\x02\x00" + struct.pack('>H', len(data)) + data #server hello
+ data = b"\x16" + self.tls_version + struct.pack('>H', len(data)) + data
+ if random.randint(0, 8) < 1:
+ ticket = os.urandom((struct.unpack('>H', os.urandom(2))[0] % 164) * 2 + 64)
+ ticket = struct.pack('>H', len(ticket) + 4) + b"\x04\x00" + struct.pack('>H', len(ticket)) + ticket
+ data += b"\x16" + self.tls_version + ticket #New session ticket
+ data += b"\x14" + self.tls_version + b"\x00\x01\x01" #ChangeCipherSpec
+ finish_len = random.choice([32, 40])
+ data += b"\x16" + self.tls_version + struct.pack('>H', finish_len) + os.urandom(finish_len - 10) #Finished
+ data += hmac.new(self.server_info.key + self.client_id, data, hashlib.sha1).digest()[:10]
+ if buf:
+ data += self.server_encode(buf)
+ return data
+
+ def decode_error_return(self, buf):
+ self.handshake_status = -1
+ if self.overhead > 0:
+ self.server_info.overhead -= self.overhead
+ self.overhead = 0
+ if self.method in ['tls1.2_ticket_auth', 'tls1.2_ticket_fastauth']:
+ return (b'E'*2048, False, False)
+ return (buf, True, False)
+
+ def server_decode(self, buf):
+ if self.handshake_status == -1:
+ return (buf, True, False)
+
+ if (self.handshake_status & 4) == 4:
+ ret = b''
+ self.recv_buffer += buf
+ while len(self.recv_buffer) > 5:
+ if ord(self.recv_buffer[0]) != 0x17 or ord(self.recv_buffer[1]) != 0x3 or ord(self.recv_buffer[2]) != 0x3:
+ logging.info("data = %s" % (binascii.hexlify(self.recv_buffer)))
+ raise Exception('server_decode appdata error')
+ size = struct.unpack('>H', self.recv_buffer[3:5])[0]
+ if len(self.recv_buffer) < size + 5:
+ break
+ ret += self.recv_buffer[5:size+5]
+ self.recv_buffer = self.recv_buffer[size+5:]
+ return (ret, True, False)
+
+ if (self.handshake_status & 1) == 1:
+ self.recv_buffer += buf
+ buf = self.recv_buffer
+ verify = buf
+ if len(buf) < 11:
+ raise Exception('server_decode data error')
+ if not match_begin(buf, b"\x14" + self.tls_version + b"\x00\x01\x01"): #ChangeCipherSpec
+ raise Exception('server_decode data error')
+ buf = buf[6:]
+ if not match_begin(buf, b"\x16" + self.tls_version + b"\x00"): #Finished
+ raise Exception('server_decode data error')
+ verify_len = struct.unpack('>H', buf[3:5])[0] + 1 # 11 - 10
+ if len(verify) < verify_len + 10:
+ return (b'', False, False)
+ if hmac.new(self.server_info.key + self.client_id, verify[:verify_len], hashlib.sha1).digest()[:10] != verify[verify_len:verify_len+10]:
+ raise Exception('server_decode data error')
+ self.recv_buffer = verify[verify_len + 10:]
+ status = self.handshake_status
+ self.handshake_status |= 4
+ ret = self.server_decode(b'')
+ return ret;
+
+ #raise Exception("handshake data = %s" % (binascii.hexlify(buf)))
+ self.recv_buffer += buf
+ buf = self.recv_buffer
+ ogn_buf = buf
+ if len(buf) < 3:
+ return (b'', False, False)
+ if not match_begin(buf, b'\x16\x03\x01'):
+ return self.decode_error_return(ogn_buf)
+ buf = buf[3:]
+ header_len = struct.unpack('>H', buf[:2])[0]
+ if header_len > len(buf) - 2:
+ return (b'', False, False)
+
+ self.recv_buffer = self.recv_buffer[header_len + 5:]
+ self.handshake_status = 1
+ buf = buf[2:header_len + 2]
+ if not match_begin(buf, b'\x01\x00'): #client hello
+ logging.info("tls_auth not client hello message")
+ return self.decode_error_return(ogn_buf)
+ buf = buf[2:]
+ if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
+ logging.info("tls_auth wrong message size")
+ return self.decode_error_return(ogn_buf)
+ buf = buf[2:]
+ if not match_begin(buf, self.tls_version):
+ logging.info("tls_auth wrong tls version")
+ return self.decode_error_return(ogn_buf)
+ buf = buf[2:]
+ verifyid = buf[:32]
+ buf = buf[32:]
+ sessionid_len = ord(buf[0])
+ if sessionid_len < 32:
+ logging.info("tls_auth wrong sessionid_len")
+ return self.decode_error_return(ogn_buf)
+ sessionid = buf[1:sessionid_len + 1]
+ buf = buf[sessionid_len+1:]
+ self.client_id = sessionid
+ sha1 = hmac.new(self.server_info.key + sessionid, verifyid[:22], hashlib.sha1).digest()[:10]
+ utc_time = struct.unpack('>I', verifyid[:4])[0]
+ time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
+ if self.server_info.obfs_param:
+ try:
+ self.max_time_dif = int(self.server_info.obfs_param)
+ except:
+ pass
+ if self.max_time_dif > 0 and (time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
+ or common.int32(utc_time - self.server_info.data.startup_time) < -self.max_time_dif / 2):
+ logging.info("tls_auth wrong time")
+ return self.decode_error_return(ogn_buf)
+ if sha1 != verifyid[22:]:
+ logging.info("tls_auth wrong sha1")
+ return self.decode_error_return(ogn_buf)
+ if self.server_info.data.client_data.get(verifyid[:22]):
+ logging.info("replay attack detect, id = %s" % (binascii.hexlify(verifyid)))
+ return self.decode_error_return(ogn_buf)
+ self.server_info.data.client_data.sweep()
+ self.server_info.data.client_data[verifyid[:22]] = sessionid
+ if len(self.recv_buffer) >= 11:
+ ret = self.server_decode(b'')
+ return (ret[0], True, True)
+ # (buffer_to_recv, is_need_decrypt, is_need_to_encode_and_send_back)
+ return (b'', False, True)
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/plain.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/plain.py
new file mode 100644
index 000000000..8c6355c38
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/plain.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python
+#
+# Copyright 2015-2015 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+
+from shadowsocks.common import ord
+
+def create_obfs(method):
+ return plain(method)
+
+obfs_map = {
+ 'plain': (create_obfs,),
+ 'origin': (create_obfs,),
+}
+
+class plain(object):
+ def __init__(self, method):
+ self.method = method
+ self.server_info = None
+
+ def init_data(self):
+ return b''
+
+ def get_overhead(self, direction): # direction: true for c->s false for s->c
+ return 0
+
+ def get_server_info(self):
+ return self.server_info
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+
+ def client_pre_encrypt(self, buf):
+ return buf
+
+ def client_encode(self, buf):
+ return buf
+
+ def client_decode(self, buf):
+ # (buffer_to_recv, is_need_to_encode_and_send_back)
+ return (buf, False)
+
+ def client_post_decrypt(self, buf):
+ return buf
+
+ def server_pre_encrypt(self, buf):
+ return buf
+
+ def server_encode(self, buf):
+ return buf
+
+ def server_decode(self, buf):
+ # (buffer_to_recv, is_need_decrypt, is_need_to_encode_and_send_back)
+ return (buf, True, False)
+
+ def server_post_decrypt(self, buf):
+ return (buf, False)
+
+ def client_udp_pre_encrypt(self, buf):
+ return buf
+
+ def client_udp_post_decrypt(self, buf):
+ return buf
+
+ def server_udp_pre_encrypt(self, buf, uid):
+ return buf
+
+ def server_udp_post_decrypt(self, buf):
+ return (buf, None)
+
+ def dispose(self):
+ pass
+
+ def get_head_size(self, buf, def_value):
+ if len(buf) < 2:
+ return def_value
+ head_type = ord(buf[0]) & 0x7
+ if head_type == 1:
+ return 7
+ if head_type == 4:
+ return 19
+ if head_type == 3:
+ return 4 + ord(buf[1])
+ return def_value
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/verify.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/verify.py
new file mode 100644
index 000000000..0dc0ca6d1
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/obfsplugin/verify.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python
+#
+# Copyright 2015-2015 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import hashlib
+import logging
+import binascii
+import base64
+import time
+import datetime
+import random
+import struct
+import zlib
+import hmac
+import hashlib
+
+import shadowsocks
+from shadowsocks import common
+from shadowsocks.obfsplugin import plain
+from shadowsocks.common import to_bytes, to_str, ord, chr
+
+def create_verify_deflate(method):
+ return verify_deflate(method)
+
+obfs_map = {
+ 'verify_deflate': (create_verify_deflate,),
+}
+
+def match_begin(str1, str2):
+ if len(str1) >= len(str2):
+ if str1[:len(str2)] == str2:
+ return True
+ return False
+
+class obfs_verify_data(object):
+ def __init__(self):
+ pass
+
+class verify_base(plain.plain):
+ def __init__(self, method):
+ super(verify_base, self).__init__(method)
+ self.method = method
+
+ def init_data(self):
+ return obfs_verify_data()
+
+ def set_server_info(self, server_info):
+ self.server_info = server_info
+
+ def client_encode(self, buf):
+ return buf
+
+ def client_decode(self, buf):
+ return (buf, False)
+
+ def server_encode(self, buf):
+ return buf
+
+ def server_decode(self, buf):
+ return (buf, True, False)
+
+class verify_deflate(verify_base):
+ def __init__(self, method):
+ super(verify_deflate, self).__init__(method)
+ self.recv_buf = b''
+ self.unit_len = 32700
+ self.decrypt_packet_num = 0
+ self.raw_trans = False
+
+ def pack_data(self, buf):
+ if len(buf) == 0:
+ return b''
+ data = zlib.compress(buf)
+ data = struct.pack('>H', len(data)) + data[2:]
+ return data
+
+ def client_pre_encrypt(self, buf):
+ ret = b''
+ while len(buf) > self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf)
+ return ret
+
+ def client_post_decrypt(self, buf):
+ if self.raw_trans:
+ return buf
+ self.recv_buf += buf
+ out_buf = b''
+ while len(self.recv_buf) > 2:
+ length = struct.unpack('>H', self.recv_buf[:2])[0]
+ if length >= 32768 or length < 6:
+ self.raw_trans = True
+ self.recv_buf = b''
+ raise Exception('client_post_decrypt data error')
+ if length > len(self.recv_buf):
+ break
+
+ out_buf += zlib.decompress(b'x\x9c' + self.recv_buf[2:length])
+ self.recv_buf = self.recv_buf[length:]
+
+ if out_buf:
+ self.decrypt_packet_num += 1
+ return out_buf
+
+ def server_pre_encrypt(self, buf):
+ ret = b''
+ while len(buf) > self.unit_len:
+ ret += self.pack_data(buf[:self.unit_len])
+ buf = buf[self.unit_len:]
+ ret += self.pack_data(buf)
+ return ret
+
+ def server_post_decrypt(self, buf):
+ if self.raw_trans:
+ return (buf, False)
+ self.recv_buf += buf
+ out_buf = b''
+ while len(self.recv_buf) > 2:
+ length = struct.unpack('>H', self.recv_buf[:2])[0]
+ if length >= 32768 or length < 6:
+ self.raw_trans = True
+ self.recv_buf = b''
+ if self.decrypt_packet_num == 0:
+ return (b'E'*2048, False)
+ else:
+ raise Exception('server_post_decrype data error')
+ if length > len(self.recv_buf):
+ break
+
+ out_buf += zlib.decompress(b'\x78\x9c' + self.recv_buf[2:length])
+ self.recv_buf = self.recv_buf[length:]
+
+ if out_buf:
+ self.decrypt_packet_num += 1
+ return (out_buf, False)
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/ordereddict.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/ordereddict.py
new file mode 100644
index 000000000..e1918f5e0
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/ordereddict.py
@@ -0,0 +1,214 @@
+import collections
+
+################################################################################
+### OrderedDict
+################################################################################
+
+class OrderedDict(dict):
+ 'Dictionary that remembers insertion order'
+ # An inherited dict maps keys to values.
+ # The inherited dict provides __getitem__, __len__, __contains__, and get.
+ # The remaining methods are order-aware.
+ # Big-O running times for all methods are the same as regular dictionaries.
+
+ # The internal self.__map dict maps keys to links in a doubly linked list.
+ # The circular doubly linked list starts and ends with a sentinel element.
+ # The sentinel element never gets deleted (this simplifies the algorithm).
+ # Each link is stored as a list of length three: [PREV, NEXT, KEY].
+
+ def __init__(*args, **kwds):
+ '''Initialize an ordered dictionary. The signature is the same as
+ regular dictionaries, but keyword arguments are not recommended because
+ their insertion order is arbitrary.
+
+ '''
+ if not args:
+ raise TypeError("descriptor '__init__' of 'OrderedDict' object "
+ "needs an argument")
+ self = args[0]
+ args = args[1:]
+ if len(args) > 1:
+ raise TypeError('expected at most 1 arguments, got %d' % len(args))
+ try:
+ self.__root
+ except AttributeError:
+ self.__root = root = [] # sentinel node
+ root[:] = [root, root, None]
+ self.__map = {}
+ self.__update(*args, **kwds)
+
+ def __setitem__(self, key, value, dict_setitem=dict.__setitem__):
+ 'od.__setitem__(i, y) <==> od[i]=y'
+ # Setting a new item creates a new link at the end of the linked list,
+ # and the inherited dictionary is updated with the new key/value pair.
+ if key not in self:
+ root = self.__root
+ last = root[0]
+ last[1] = root[0] = self.__map[key] = [last, root, key]
+ return dict_setitem(self, key, value)
+
+ def __delitem__(self, key, dict_delitem=dict.__delitem__):
+ 'od.__delitem__(y) <==> del od[y]'
+ # Deleting an existing item uses self.__map to find the link which gets
+ # removed by updating the links in the predecessor and successor nodes.
+ dict_delitem(self, key)
+ link_prev, link_next, _ = self.__map.pop(key)
+ link_prev[1] = link_next # update link_prev[NEXT]
+ link_next[0] = link_prev # update link_next[PREV]
+
+ def __iter__(self):
+ 'od.__iter__() <==> iter(od)'
+ # Traverse the linked list in order.
+ root = self.__root
+ curr = root[1] # start at the first node
+ while curr is not root:
+ yield curr[2] # yield the curr[KEY]
+ curr = curr[1] # move to next node
+
+ def __reversed__(self):
+ 'od.__reversed__() <==> reversed(od)'
+ # Traverse the linked list in reverse order.
+ root = self.__root
+ curr = root[0] # start at the last node
+ while curr is not root:
+ yield curr[2] # yield the curr[KEY]
+ curr = curr[0] # move to previous node
+
+ def clear(self):
+ 'od.clear() -> None. Remove all items from od.'
+ root = self.__root
+ root[:] = [root, root, None]
+ self.__map.clear()
+ dict.clear(self)
+
+ # -- the following methods do not depend on the internal structure --
+
+ def keys(self):
+ 'od.keys() -> list of keys in od'
+ return list(self)
+
+ def values(self):
+ 'od.values() -> list of values in od'
+ return [self[key] for key in self]
+
+ def items(self):
+ 'od.items() -> list of (key, value) pairs in od'
+ return [(key, self[key]) for key in self]
+
+ def iterkeys(self):
+ 'od.iterkeys() -> an iterator over the keys in od'
+ return iter(self)
+
+ def itervalues(self):
+ 'od.itervalues -> an iterator over the values in od'
+ for k in self:
+ yield self[k]
+
+ def iteritems(self):
+ 'od.iteritems -> an iterator over the (key, value) pairs in od'
+ for k in self:
+ yield (k, self[k])
+
+ update = collections.MutableMapping.update
+
+ __update = update # let subclasses override update without breaking __init__
+
+ __marker = object()
+
+ def pop(self, key, default=__marker):
+ '''od.pop(k[,d]) -> v, remove specified key and return the corresponding
+ value. If key is not found, d is returned if given, otherwise KeyError
+ is raised.
+
+ '''
+ if key in self:
+ result = self[key]
+ del self[key]
+ return result
+ if default is self.__marker:
+ raise KeyError(key)
+ return default
+
+ def setdefault(self, key, default=None):
+ 'od.setdefault(k[,d]) -> od.get(k,d), also set od[k]=d if k not in od'
+ if key in self:
+ return self[key]
+ self[key] = default
+ return default
+
+ def popitem(self, last=True):
+ '''od.popitem() -> (k, v), return and remove a (key, value) pair.
+ Pairs are returned in LIFO order if last is true or FIFO order if false.
+
+ '''
+ if not self:
+ raise KeyError('dictionary is empty')
+ key = next(reversed(self) if last else iter(self))
+ value = self.pop(key)
+ return key, value
+
+ def __repr__(self, _repr_running={}):
+ 'od.__repr__() <==> repr(od)'
+ call_key = id(self), _get_ident()
+ if call_key in _repr_running:
+ return '...'
+ _repr_running[call_key] = 1
+ try:
+ if not self:
+ return '%s()' % (self.__class__.__name__,)
+ return '%s(%r)' % (self.__class__.__name__, self.items())
+ finally:
+ del _repr_running[call_key]
+
+ def __reduce__(self):
+ 'Return state information for pickling'
+ items = [[k, self[k]] for k in self]
+ inst_dict = vars(self).copy()
+ for k in vars(OrderedDict()):
+ inst_dict.pop(k, None)
+ if inst_dict:
+ return (self.__class__, (items,), inst_dict)
+ return self.__class__, (items,)
+
+ def copy(self):
+ 'od.copy() -> a shallow copy of od'
+ return self.__class__(self)
+
+ @classmethod
+ def fromkeys(cls, iterable, value=None):
+ '''OD.fromkeys(S[, v]) -> New ordered dictionary with keys from S.
+ If not specified, the value defaults to None.
+
+ '''
+ self = cls()
+ for key in iterable:
+ self[key] = value
+ return self
+
+ def __eq__(self, other):
+ '''od.__eq__(y) <==> od==y. Comparison to another OD is order-sensitive
+ while comparison to a regular mapping is order-insensitive.
+
+ '''
+ if isinstance(other, OrderedDict):
+ return dict.__eq__(self, other) and all(_imap(_eq, self, other))
+ return dict.__eq__(self, other)
+
+ def __ne__(self, other):
+ 'od.__ne__(y) <==> od!=y'
+ return not self == other
+
+ # -- the following methods support python 3.x style dictionary views --
+
+ def viewkeys(self):
+ "od.viewkeys() -> a set-like object providing a view on od's keys"
+ return KeysView(self)
+
+ def viewvalues(self):
+ "od.viewvalues() -> an object providing a view on od's values"
+ return ValuesView(self)
+
+ def viewitems(self):
+ "od.viewitems() -> a set-like object providing a view on od's items"
+ return ItemsView(self)
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/run.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/run.sh
new file mode 100755
index 000000000..43720308d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/run.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+cd `dirname $0`
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py a" | awk '{print "kill "$2}')
+ulimit -n 512000
+nohup ${python_ver} server.py a>> /dev/null 2>&1 &
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/server.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/server.py
new file mode 100755
index 000000000..081538933
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/server.py
@@ -0,0 +1,221 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import sys
+import os
+import logging
+import signal
+
+if __name__ == '__main__':
+ import inspect
+
+ file_path = os.path.dirname(os.path.realpath(inspect.getfile(inspect.currentframe())))
+ sys.path.insert(0, os.path.join(file_path, '../'))
+
+from shadowsocks import shell, daemon, eventloop, tcprelay, udprelay, \
+ asyncdns, manager, common
+
+
+def main():
+ shell.check_python()
+
+ config = shell.get_config(False)
+
+ shell.log_shadowsocks_version()
+
+ daemon.daemon_exec(config)
+
+ try:
+ import resource
+ logging.info(
+ 'current process RLIMIT_NOFILE resource: soft %d hard %d' % resource.getrlimit(resource.RLIMIT_NOFILE))
+ except ImportError:
+ pass
+
+ if config['port_password']:
+ pass
+ else:
+ config['port_password'] = {}
+ server_port = config['server_port']
+ if type(server_port) == list:
+ for a_server_port in server_port:
+ config['port_password'][a_server_port] = config['password']
+ else:
+ config['port_password'][str(server_port)] = config['password']
+
+ if not config.get('dns_ipv6', False):
+ asyncdns.IPV6_CONNECTION_SUPPORT = False
+
+ if config.get('manager_address', 0):
+ logging.info('entering manager mode')
+ manager.run(config)
+ return
+
+ tcp_servers = []
+ udp_servers = []
+ dns_resolver = asyncdns.DNSResolver(config['black_hostname_list'])
+ if int(config['workers']) > 1:
+ stat_counter_dict = None
+ else:
+ stat_counter_dict = {}
+ port_password = config['port_password']
+ config_password = config.get('password', 'm')
+ del config['port_password']
+ for port, password_obfs in port_password.items():
+ method = config["method"]
+ protocol = config.get("protocol", 'origin')
+ protocol_param = config.get("protocol_param", '')
+ obfs = config.get("obfs", 'plain')
+ obfs_param = config.get("obfs_param", '')
+ bind = config.get("out_bind", '')
+ bindv6 = config.get("out_bindv6", '')
+ if type(password_obfs) == list:
+ password = password_obfs[0]
+ obfs = common.to_str(password_obfs[1])
+ if len(password_obfs) > 2:
+ protocol = common.to_str(password_obfs[2])
+ elif type(password_obfs) == dict:
+ password = password_obfs.get('password', config_password)
+ method = common.to_str(password_obfs.get('method', method))
+ protocol = common.to_str(password_obfs.get('protocol', protocol))
+ protocol_param = common.to_str(password_obfs.get('protocol_param', protocol_param))
+ obfs = common.to_str(password_obfs.get('obfs', obfs))
+ obfs_param = common.to_str(password_obfs.get('obfs_param', obfs_param))
+ bind = password_obfs.get('out_bind', bind)
+ bindv6 = password_obfs.get('out_bindv6', bindv6)
+ else:
+ password = password_obfs
+ a_config = config.copy()
+ ipv6_ok = False
+ logging.info("server start with protocol[%s] password [%s] method [%s] obfs [%s] obfs_param [%s]" %
+ (protocol, password, method, obfs, obfs_param))
+ if 'server_ipv6' in a_config:
+ try:
+ if len(a_config['server_ipv6']) > 2 and a_config['server_ipv6'][0] == "[" and a_config['server_ipv6'][
+ -1] == "]":
+ a_config['server_ipv6'] = a_config['server_ipv6'][1:-1]
+ a_config['server_port'] = int(port)
+ a_config['password'] = password
+ a_config['method'] = method
+ a_config['protocol'] = protocol
+ a_config['protocol_param'] = protocol_param
+ a_config['obfs'] = obfs
+ a_config['obfs_param'] = obfs_param
+ a_config['out_bind'] = bind
+ a_config['out_bindv6'] = bindv6
+ a_config['server'] = a_config['server_ipv6']
+ logging.info("starting server at [%s]:%d" %
+ (a_config['server'], int(port)))
+ tcp_servers.append(tcprelay.TCPRelay(a_config, dns_resolver, False, stat_counter=stat_counter_dict))
+ udp_servers.append(udprelay.UDPRelay(a_config, dns_resolver, False, stat_counter=stat_counter_dict))
+ if a_config['server_ipv6'] == b"::":
+ ipv6_ok = True
+ except Exception as e:
+ shell.print_exception(e)
+
+ try:
+ a_config = config.copy()
+ a_config['server_port'] = int(port)
+ a_config['password'] = password
+ a_config['method'] = method
+ a_config['protocol'] = protocol
+ a_config['protocol_param'] = protocol_param
+ a_config['obfs'] = obfs
+ a_config['obfs_param'] = obfs_param
+ a_config['out_bind'] = bind
+ a_config['out_bindv6'] = bindv6
+ logging.info("starting server at %s:%d" %
+ (a_config['server'], int(port)))
+ tcp_servers.append(tcprelay.TCPRelay(a_config, dns_resolver, False, stat_counter=stat_counter_dict))
+ udp_servers.append(udprelay.UDPRelay(a_config, dns_resolver, False, stat_counter=stat_counter_dict))
+ except Exception as e:
+ if not ipv6_ok:
+ shell.print_exception(e)
+
+ def run_server():
+ def child_handler(signum, _):
+ logging.warn('received SIGQUIT, doing graceful shutting down..')
+ list(map(lambda s: s.close(next_tick=True),
+ tcp_servers + udp_servers))
+
+ signal.signal(getattr(signal, 'SIGQUIT', signal.SIGTERM),
+ child_handler)
+
+ def int_handler(signum, _):
+ sys.exit(1)
+
+ signal.signal(signal.SIGINT, int_handler)
+
+ try:
+ loop = eventloop.EventLoop()
+ dns_resolver.add_to_loop(loop)
+ list(map(lambda s: s.add_to_loop(loop), tcp_servers + udp_servers))
+
+ daemon.set_user(config.get('user', None))
+ loop.run()
+ except Exception as e:
+ shell.print_exception(e)
+ sys.exit(1)
+
+ if int(config['workers']) > 1:
+ if os.name == 'posix':
+ children = []
+ is_child = False
+ for i in range(0, int(config['workers'])):
+ r = os.fork()
+ if r == 0:
+ logging.info('worker started')
+ is_child = True
+ run_server()
+ break
+ else:
+ children.append(r)
+ if not is_child:
+ def handler(signum, _):
+ for pid in children:
+ try:
+ os.kill(pid, signum)
+ os.waitpid(pid, 0)
+ except OSError: # child may already exited
+ pass
+ sys.exit()
+
+ signal.signal(signal.SIGTERM, handler)
+ signal.signal(signal.SIGQUIT, handler)
+ signal.signal(signal.SIGINT, handler)
+
+ # master
+ for a_tcp_server in tcp_servers:
+ a_tcp_server.close()
+ for a_udp_server in udp_servers:
+ a_udp_server.close()
+ dns_resolver.close()
+
+ for child in children:
+ os.waitpid(child, 0)
+ else:
+ logging.warn('worker is only available on Unix/Linux')
+ run_server()
+ else:
+ run_server()
+
+
+if __name__ == '__main__':
+ main()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/shell.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/shell.py
new file mode 100755
index 000000000..a1547d082
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/shell.py
@@ -0,0 +1,451 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import json
+import sys
+import getopt
+import logging
+from shadowsocks.common import to_bytes, to_str, IPNetwork, PortRange
+from shadowsocks import encrypt
+
+VERBOSE_LEVEL = 5
+
+verbose = 0
+
+
+def check_python():
+ info = sys.version_info
+ if info[0] == 2 and not info[1] >= 6:
+ print('Python 2.6+ required')
+ sys.exit(1)
+ elif info[0] == 3 and not info[1] >= 3:
+ print('Python 3.3+ required')
+ sys.exit(1)
+ elif info[0] not in [2, 3]:
+ print('Python version not supported')
+ sys.exit(1)
+
+
+def print_exception(e):
+ global verbose
+ logging.error(e)
+ if verbose > 0:
+ import traceback
+ traceback.print_exc()
+
+
+def __version():
+ version_str = ''
+ try:
+ import pkg_resources
+ version_str = pkg_resources.get_distribution('shadowsocks').version
+ except Exception:
+ try:
+ from shadowsocks import version
+ version_str = version.version()
+ except Exception:
+ pass
+ return version_str
+
+
+def print_shadowsocks():
+ print('ShadowsocksR %s' % __version())
+
+
+def log_shadowsocks_version():
+ logging.info('ShadowsocksR %s' % __version())
+
+
+def find_config():
+ user_config_path = 'user-config.json'
+ config_path = 'config.json'
+
+ def sub_find(file_name):
+ if os.path.exists(file_name):
+ return file_name
+ file_name = os.path.join(os.path.abspath('..'), file_name)
+ return file_name if os.path.exists(file_name) else None
+
+ return sub_find(user_config_path) or sub_find(config_path)
+
+
+def check_config(config, is_local):
+ if config.get('daemon', None) == 'stop':
+ # no need to specify configuration for daemon stop
+ return
+
+ if is_local and not config.get('password', None):
+ logging.error('password not specified')
+ print_help(is_local)
+ sys.exit(2)
+
+ if not is_local and not config.get('password', None) \
+ and not config.get('port_password', None):
+ logging.error('password or port_password not specified')
+ print_help(is_local)
+ sys.exit(2)
+
+ if 'local_port' in config:
+ config['local_port'] = int(config['local_port'])
+
+ if 'server_port' in config and type(config['server_port']) != list:
+ config['server_port'] = int(config['server_port'])
+
+ if config.get('local_address', '') in [b'0.0.0.0']:
+ logging.warning('warning: local set to listen on 0.0.0.0, it\'s not safe')
+ if config.get('server', '') in ['127.0.0.1', 'localhost']:
+ logging.warning('warning: server set to listen on %s:%s, are you sure?' %
+ (to_str(config['server']), config['server_port']))
+ if config.get('timeout', 300) < 100:
+ logging.warning('warning: your timeout %d seems too short' %
+ int(config.get('timeout')))
+ if config.get('timeout', 300) > 600:
+ logging.warning('warning: your timeout %d seems too long' %
+ int(config.get('timeout')))
+ if config.get('password') in [b'mypassword']:
+ logging.error('DON\'T USE DEFAULT PASSWORD! Please change it in your '
+ 'config.json!')
+ sys.exit(1)
+ if config.get('user', None) is not None:
+ if os.name != 'posix':
+ logging.error('user can be used only on Unix')
+ sys.exit(1)
+
+ encrypt.try_cipher(config['password'], config['method'])
+
+
+def get_config(is_local):
+ global verbose
+ config = {}
+ config_path = None
+ logging.basicConfig(level=logging.INFO,
+ format='%(levelname)-s: %(message)s')
+ if is_local:
+ shortopts = 'hd:s:b:p:k:l:m:O:o:G:g:c:t:vq'
+ longopts = ['help', 'fast-open', 'pid-file=', 'log-file=', 'user=',
+ 'version']
+ else:
+ shortopts = 'hd:s:p:k:m:O:o:G:g:c:t:vq'
+ longopts = ['help', 'fast-open', 'pid-file=', 'log-file=', 'workers=',
+ 'forbidden-ip=', 'user=', 'manager-address=', 'version']
+ try:
+ optlist, args = getopt.getopt(sys.argv[1:], shortopts, longopts)
+ for key, value in optlist:
+ if key == '-c':
+ config_path = value
+ elif key in ('-h', '--help'):
+ print_help(is_local)
+ sys.exit(0)
+ elif key == '--version':
+ print_shadowsocks()
+ sys.exit(0)
+ else:
+ continue
+
+ if config_path is None:
+ config_path = find_config()
+
+ if config_path:
+ logging.debug('loading config from %s' % config_path)
+ with open(config_path, 'rb') as f:
+ try:
+ config = parse_json_in_str(remove_comment(f.read().decode('utf8')))
+ except ValueError as e:
+ logging.error('found an error in config.json: %s', str(e))
+ sys.exit(1)
+
+ v_count = 0
+ for key, value in optlist:
+ if key == '-p':
+ config['server_port'] = int(value)
+ elif key == '-k':
+ config['password'] = to_bytes(value)
+ elif key == '-l':
+ config['local_port'] = int(value)
+ elif key == '-s':
+ config['server'] = to_str(value)
+ elif key == '-m':
+ config['method'] = to_str(value)
+ elif key == '-O':
+ config['protocol'] = to_str(value)
+ elif key == '-o':
+ config['obfs'] = to_str(value)
+ elif key == '-G':
+ config['protocol_param'] = to_str(value)
+ elif key == '-g':
+ config['obfs_param'] = to_str(value)
+ elif key == '-b':
+ config['local_address'] = to_str(value)
+ elif key == '-v':
+ v_count += 1
+ # '-vv' turns on more verbose mode
+ config['verbose'] = v_count
+ elif key == '-t':
+ config['timeout'] = int(value)
+ elif key == '--fast-open':
+ config['fast_open'] = True
+ elif key == '--workers':
+ config['workers'] = int(value)
+ elif key == '--manager-address':
+ config['manager_address'] = value
+ elif key == '--user':
+ config['user'] = to_str(value)
+ elif key == '--forbidden-ip':
+ config['forbidden_ip'] = to_str(value)
+
+ elif key == '-d':
+ config['daemon'] = to_str(value)
+ elif key == '--pid-file':
+ config['pid-file'] = to_str(value)
+ elif key == '--log-file':
+ config['log-file'] = to_str(value)
+ elif key == '-q':
+ v_count -= 1
+ config['verbose'] = v_count
+ else:
+ continue
+ except getopt.GetoptError as e:
+ print(e, file=sys.stderr)
+ print_help(is_local)
+ sys.exit(2)
+
+ if not config:
+ logging.error('config not specified')
+ print_help(is_local)
+ sys.exit(2)
+
+ config['password'] = to_bytes(config.get('password', b''))
+ config['method'] = to_str(config.get('method', 'aes-256-cfb'))
+ config['protocol'] = to_str(config.get('protocol', 'origin'))
+ config['protocol_param'] = to_str(config.get('protocol_param', ''))
+ config['obfs'] = to_str(config.get('obfs', 'plain'))
+ config['obfs_param'] = to_str(config.get('obfs_param', ''))
+ config['port_password'] = config.get('port_password', None)
+ config['additional_ports'] = config.get('additional_ports', {})
+ config['additional_ports_only'] = config.get('additional_ports_only', False)
+ config['timeout'] = int(config.get('timeout', 300))
+ config['udp_timeout'] = int(config.get('udp_timeout', 120))
+ config['udp_cache'] = int(config.get('udp_cache', 64))
+ config['fast_open'] = config.get('fast_open', False)
+ config['workers'] = config.get('workers', 1)
+ config['pid-file'] = config.get('pid-file', '/var/run/shadowsocksr.pid')
+ config['log-file'] = config.get('log-file', '/var/log/shadowsocksr.log')
+ config['verbose'] = config.get('verbose', False)
+ config['connect_verbose_info'] = config.get('connect_verbose_info', 0)
+ config['local_address'] = to_str(config.get('local_address', '127.0.0.1'))
+ config['local_port'] = config.get('local_port', 1080)
+ if is_local:
+ if config.get('server', None) is None:
+ logging.error('server addr not specified')
+ print_local_help()
+ sys.exit(2)
+ else:
+ config['server'] = to_str(config['server'])
+ else:
+ config['server'] = to_str(config.get('server', '0.0.0.0'))
+ config['black_hostname_list'] = to_str(config.get('black_hostname_list', '')).split(',')
+ if len(config['black_hostname_list']) == 1 and config['black_hostname_list'][0] == '':
+ config['black_hostname_list'] = []
+ try:
+ config['forbidden_ip'] = \
+ IPNetwork(config.get('forbidden_ip', '127.0.0.0/8,::1/128'))
+ except Exception as e:
+ logging.error(e)
+ sys.exit(2)
+ try:
+ config['forbidden_port'] = PortRange(config.get('forbidden_port', ''))
+ except Exception as e:
+ logging.error(e)
+ sys.exit(2)
+ try:
+ config['ignore_bind'] = \
+ IPNetwork(config.get('ignore_bind', '127.0.0.0/8,::1/128,10.0.0.0/8,192.168.0.0/16'))
+ except Exception as e:
+ logging.error(e)
+ sys.exit(2)
+ config['server_port'] = config.get('server_port', 8388)
+
+ logging.getLogger('').handlers = []
+ logging.addLevelName(VERBOSE_LEVEL, 'VERBOSE')
+ if config['verbose'] >= 2:
+ level = VERBOSE_LEVEL
+ elif config['verbose'] == 1:
+ level = logging.DEBUG
+ elif config['verbose'] == -1:
+ level = logging.WARN
+ elif config['verbose'] <= -2:
+ level = logging.ERROR
+ else:
+ level = logging.INFO
+ verbose = config['verbose']
+ logging.basicConfig(level=level,
+ format='%(asctime)s %(levelname)-8s %(filename)s:%(lineno)s %(message)s',
+ datefmt='%Y-%m-%d %H:%M:%S')
+
+ check_config(config, is_local)
+
+ return config
+
+
+def print_help(is_local):
+ if is_local:
+ print_local_help()
+ else:
+ print_server_help()
+
+
+def print_local_help():
+ print('''usage: sslocal [OPTION]...
+A fast tunnel proxy that helps you bypass firewalls.
+
+You can supply configurations via either config file or command line arguments.
+
+Proxy options:
+ -c CONFIG path to config file
+ -s SERVER_ADDR server address
+ -p SERVER_PORT server port, default: 8388
+ -b LOCAL_ADDR local binding address, default: 127.0.0.1
+ -l LOCAL_PORT local port, default: 1080
+ -k PASSWORD password
+ -m METHOD encryption method, default: aes-256-cfb
+ -o OBFS obfsplugin, default: http_simple
+ -t TIMEOUT timeout in seconds, default: 300
+ --fast-open use TCP_FASTOPEN, requires Linux 3.7+
+
+General options:
+ -h, --help show this help message and exit
+ -d start/stop/restart daemon mode
+ --pid-file PID_FILE pid file for daemon mode
+ --log-file LOG_FILE log file for daemon mode
+ --user USER username to run as
+ -v, -vv verbose mode
+ -q, -qq quiet mode, only show warnings/errors
+ --version show version information
+
+Online help:
+''')
+
+
+def print_server_help():
+ print('''usage: ssserver [OPTION]...
+A fast tunnel proxy that helps you bypass firewalls.
+
+You can supply configurations via either config file or command line arguments.
+
+Proxy options:
+ -c CONFIG path to config file
+ -s SERVER_ADDR server address, default: 0.0.0.0
+ -p SERVER_PORT server port, default: 8388
+ -k PASSWORD password
+ -m METHOD encryption method, default: aes-256-cfb
+ -o OBFS obfsplugin, default: http_simple
+ -t TIMEOUT timeout in seconds, default: 300
+ --fast-open use TCP_FASTOPEN, requires Linux 3.7+
+ --workers WORKERS number of workers, available on Unix/Linux
+ --forbidden-ip IPLIST comma seperated IP list forbidden to connect
+ --manager-address ADDR optional server manager UDP address, see wiki
+
+General options:
+ -h, --help show this help message and exit
+ -d start/stop/restart daemon mode
+ --pid-file PID_FILE pid file for daemon mode
+ --log-file LOG_FILE log file for daemon mode
+ --user USER username to run as
+ -v, -vv verbose mode
+ -q, -qq quiet mode, only show warnings/errors
+ --version show version information
+
+Online help:
+''')
+
+
+def _decode_list(data):
+ rv = []
+ for item in data:
+ if hasattr(item, 'encode'):
+ item = item.encode('utf-8')
+ elif isinstance(item, list):
+ item = _decode_list(item)
+ elif isinstance(item, dict):
+ item = _decode_dict(item)
+ rv.append(item)
+ return rv
+
+
+def _decode_dict(data):
+ rv = {}
+ for key, value in data.items():
+ if hasattr(value, 'encode'):
+ value = value.encode('utf-8')
+ elif isinstance(value, list):
+ value = _decode_list(value)
+ elif isinstance(value, dict):
+ value = _decode_dict(value)
+ rv[key] = value
+ return rv
+
+
+class JSFormat:
+ def __init__(self):
+ self.state = 0
+
+ def push(self, ch):
+ ch = ord(ch)
+ if self.state == 0:
+ if ch == ord('"'):
+ self.state = 1
+ return to_str(chr(ch))
+ elif ch == ord('/'):
+ self.state = 3
+ else:
+ return to_str(chr(ch))
+ elif self.state == 1:
+ if ch == ord('"'):
+ self.state = 0
+ return to_str(chr(ch))
+ elif ch == ord('\\'):
+ self.state = 2
+ return to_str(chr(ch))
+ elif self.state == 2:
+ self.state = 1
+ if ch == ord('"'):
+ return to_str(chr(ch))
+ return "\\" + to_str(chr(ch))
+ elif self.state == 3:
+ if ch == ord('/'):
+ self.state = 4
+ else:
+ return "/" + to_str(chr(ch))
+ elif self.state == 4:
+ if ch == ord('\n'):
+ self.state = 0
+ return "\n"
+ return ""
+
+
+def remove_comment(json):
+ fmt = JSFormat()
+ return "".join([fmt.push(c) for c in json])
+
+
+def parse_json_in_str(data):
+ # parse json and convert everything from unicode to str
+ return json.loads(data, object_hook=_decode_dict)
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/stop.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/stop.sh
new file mode 100755
index 000000000..d7d29589e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/stop.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py a" | awk '{print "kill "$2}')
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tail.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tail.sh
new file mode 100755
index 000000000..aa3713939
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+tail -f ssserver.log
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tcprelay.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tcprelay.py
new file mode 100644
index 000000000..595e2be73
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/tcprelay.py
@@ -0,0 +1,1476 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import time
+import socket
+import errno
+import struct
+import logging
+import binascii
+import traceback
+import random
+import platform
+import threading
+
+from shadowsocks import encrypt, obfs, eventloop, shell, common, lru_cache, version
+from shadowsocks.common import pre_parse_header, parse_header
+
+# we clear at most TIMEOUTS_CLEAN_SIZE timeouts each time
+TIMEOUTS_CLEAN_SIZE = 512
+
+MSG_FASTOPEN = 0x20000000
+
+# SOCKS command definition
+CMD_CONNECT = 1
+CMD_BIND = 2
+CMD_UDP_ASSOCIATE = 3
+
+# for each opening port, we have a TCP Relay
+
+# for each connection, we have a TCP Relay Handler to handle the connection
+
+# for each handler, we have 2 sockets:
+# local: connected to the client
+# remote: connected to remote server
+
+# for each handler, it could be at one of several stages:
+
+# as sslocal:
+# stage 0 SOCKS hello received from local, send hello to local
+# stage 1 addr received from local, query DNS for remote
+# stage 2 UDP assoc
+# stage 3 DNS resolved, connect to remote
+# stage 4 still connecting, more data from local received
+# stage 5 remote connected, piping local and remote
+
+# as ssserver:
+# stage 0 just jump to stage 1
+# stage 1 addr received from local, query DNS for remote
+# stage 3 DNS resolved, connect to remote
+# stage 4 still connecting, more data from local received
+# stage 5 remote connected, piping local and remote
+
+STAGE_INIT = 0
+STAGE_ADDR = 1
+STAGE_UDP_ASSOC = 2
+STAGE_DNS = 3
+STAGE_CONNECTING = 4
+STAGE_STREAM = 5
+STAGE_DESTROYED = -1
+
+# for each handler, we have 2 stream directions:
+# upstream: from client to server direction
+# read local and write to remote
+# downstream: from server to client direction
+# read remote and write to local
+
+STREAM_UP = 0
+STREAM_DOWN = 1
+
+# for each stream, it's waiting for reading, or writing, or both
+WAIT_STATUS_INIT = 0
+WAIT_STATUS_READING = 1
+WAIT_STATUS_WRITING = 2
+WAIT_STATUS_READWRITING = WAIT_STATUS_READING | WAIT_STATUS_WRITING
+
+NETWORK_MTU = 1500
+TCP_MSS = NETWORK_MTU - 40
+BUF_SIZE = 32 * 1024
+UDP_MAX_BUF_SIZE = 65536
+
+class SpeedTester(object):
+ def __init__(self, max_speed = 0):
+ self.max_speed = max_speed * 1024
+ self.last_time = time.time()
+ self.sum_len = 0
+
+ def update_limit(self, max_speed):
+ self.max_speed = max_speed * 1024
+
+ def add(self, data_len):
+ if self.max_speed > 0:
+ cut_t = time.time()
+ self.sum_len -= (cut_t - self.last_time) * self.max_speed
+ if self.sum_len < 0:
+ self.sum_len = 0
+ self.last_time = cut_t
+ self.sum_len += data_len
+
+ def isExceed(self):
+ if self.max_speed > 0:
+ cut_t = time.time()
+ self.sum_len -= (cut_t - self.last_time) * self.max_speed
+ if self.sum_len < 0:
+ self.sum_len = 0
+ self.last_time = cut_t
+ return self.sum_len >= self.max_speed
+ return False
+
+class TCPRelayHandler(object):
+ def __init__(self, server, fd_to_handlers, loop, local_sock, config,
+ dns_resolver, is_local):
+ self._server = server
+ self._fd_to_handlers = fd_to_handlers
+ self._loop = loop
+ self._local_sock = local_sock
+ self._remote_sock = None
+ self._remote_sock_v6 = None
+ self._local_sock_fd = None
+ self._remote_sock_fd = None
+ self._remotev6_sock_fd = None
+ self._remote_udp = False
+ self._config = config
+ self._dns_resolver = dns_resolver
+ self._add_ref = 0
+ if not self._create_encryptor(config):
+ return
+
+ self._client_address = local_sock.getpeername()[:2]
+ self._accept_address = local_sock.getsockname()[:2]
+ self._user = None
+ self._user_id = server._listen_port
+ self._update_tcp_mss(local_sock)
+
+ # TCP Relay works as either sslocal or ssserver
+ # if is_local, this is sslocal
+ self._is_local = is_local
+ self._encrypt_correct = True
+ self._obfs = obfs.obfs(config['obfs'])
+ self._protocol = obfs.obfs(config['protocol'])
+ self._overhead = self._obfs.get_overhead(self._is_local) + self._protocol.get_overhead(self._is_local)
+ self._recv_buffer_size = BUF_SIZE - self._overhead
+
+ server_info = obfs.server_info(server.obfs_data)
+ server_info.host = config['server']
+ server_info.port = server._listen_port
+ #server_info.users = server.server_users
+ #server_info.update_user_func = self._update_user
+ server_info.client = self._client_address[0]
+ server_info.client_port = self._client_address[1]
+ server_info.protocol_param = ''
+ server_info.obfs_param = config['obfs_param']
+ server_info.iv = self._encryptor.cipher_iv
+ server_info.recv_iv = b''
+ server_info.key_str = common.to_bytes(config['password'])
+ server_info.key = self._encryptor.cipher_key
+ server_info.head_len = 30
+ server_info.tcp_mss = self._tcp_mss
+ server_info.buffer_size = self._recv_buffer_size
+ server_info.overhead = self._overhead
+ self._obfs.set_server_info(server_info)
+
+ server_info = obfs.server_info(server.protocol_data)
+ server_info.host = config['server']
+ server_info.port = server._listen_port
+ server_info.users = server.server_users
+ server_info.update_user_func = self._update_user
+ server_info.client = self._client_address[0]
+ server_info.client_port = self._client_address[1]
+ server_info.protocol_param = config['protocol_param']
+ server_info.obfs_param = ''
+ server_info.iv = self._encryptor.cipher_iv
+ server_info.recv_iv = b''
+ server_info.key_str = common.to_bytes(config['password'])
+ server_info.key = self._encryptor.cipher_key
+ server_info.head_len = 30
+ server_info.tcp_mss = self._tcp_mss
+ server_info.buffer_size = self._recv_buffer_size
+ server_info.overhead = self._overhead
+ self._protocol.set_server_info(server_info)
+
+ self._redir_list = config.get('redirect', ["*#0.0.0.0:0"])
+ self._is_redirect = False
+ self._bind = config.get('out_bind', '')
+ self._bindv6 = config.get('out_bindv6', '')
+ self._ignore_bind_list = config.get('ignore_bind', [])
+
+ self._fastopen_connected = False
+ self._data_to_write_to_local = []
+ self._data_to_write_to_remote = []
+ self._udp_data_send_buffer = b''
+ self._upstream_status = WAIT_STATUS_READING
+ self._downstream_status = WAIT_STATUS_INIT
+ self._remote_address = None
+
+ self._forbidden_iplist = config.get('forbidden_ip', None)
+ self._forbidden_portset = config.get('forbidden_port', None)
+ if is_local:
+ self._chosen_server = self._get_a_server()
+
+ self.last_activity = 0
+ self._update_activity()
+ self._server.add_connection(1)
+ self._server.stat_add(self._client_address[0], 1)
+ self._add_ref = 1
+ self.speed_tester_u = SpeedTester(config.get("speed_limit_per_con", 0))
+ self.speed_tester_d = SpeedTester(config.get("speed_limit_per_con", 0))
+ self._recv_u_max_size = BUF_SIZE
+ self._recv_d_max_size = BUF_SIZE
+ self._recv_pack_id = 0
+ self._udp_send_pack_id = 0
+ self._udpv6_send_pack_id = 0
+
+ local_sock.setblocking(False)
+ local_sock.setsockopt(socket.SOL_TCP, socket.TCP_NODELAY, 1)
+ self._local_sock_fd = local_sock.fileno()
+ fd_to_handlers[self._local_sock_fd] = self
+ loop.add(local_sock, eventloop.POLL_IN | eventloop.POLL_ERR, self._server)
+ self._stage = STAGE_INIT
+
+ def __hash__(self):
+ # default __hash__ is id / 16
+ # we want to eliminate collisions
+ return id(self)
+
+ @property
+ def remote_address(self):
+ return self._remote_address
+
+ def _get_a_server(self):
+ server = self._config['server']
+ server_port = self._config['server_port']
+ if type(server_port) == list:
+ server_port = random.choice(server_port)
+ if type(server) == list:
+ server = random.choice(server)
+ logging.debug('chosen server: %s:%d', server, server_port)
+ return server, server_port
+
+ def _update_tcp_mss(self, local_sock):
+ self._tcp_mss = TCP_MSS
+ try:
+ tcp_mss = local_sock.getsockopt(socket.SOL_TCP, socket.TCP_MAXSEG)
+ if tcp_mss > 500 and tcp_mss <= 1500:
+ self._tcp_mss = tcp_mss
+ logging.debug("TCP MSS = %d" % (self._tcp_mss,))
+ except:
+ pass
+
+ def _create_encryptor(self, config):
+ try:
+ self._encryptor = encrypt.Encryptor(config['password'],
+ config['method'])
+ return True
+ except Exception:
+ self._stage = STAGE_DESTROYED
+ logging.error('create encryptor fail at port %d', self._server._listen_port)
+
+ def _update_user(self, user):
+ self._user = user
+ self._user_id = struct.unpack(' 6:
+ length = struct.unpack('>H', self._udp_data_send_buffer[:2])[0]
+
+ if length > len(self._udp_data_send_buffer):
+ break
+
+ data = self._udp_data_send_buffer[:length]
+ self._udp_data_send_buffer = self._udp_data_send_buffer[length:]
+
+ frag = common.ord(data[2])
+ if frag != 0:
+ logging.warn('drop a message since frag is %d' % (frag,))
+ continue
+ else:
+ data = data[3:]
+ header_result = parse_header(data)
+ if header_result is None:
+ continue
+ connecttype, addrtype, dest_addr, dest_port, header_length = header_result
+ if (addrtype & 7) == 3:
+ af = common.is_ip(dest_addr)
+ if af == False:
+ handler = common.UDPAsyncDNSHandler(data[header_length:])
+ handler.resolve(self._dns_resolver, (dest_addr, dest_port), self._handle_server_dns_resolved)
+ else:
+ return self._handle_server_dns_resolved("", (dest_addr, dest_port), dest_addr, data[header_length:])
+ else:
+ return self._handle_server_dns_resolved("", (dest_addr, dest_port), dest_addr, data[header_length:])
+
+ except Exception as e:
+ #trace = traceback.format_exc()
+ #logging.error(trace)
+ error_no = eventloop.errno_from_exception(e)
+ if error_no in (errno.EAGAIN, errno.EINPROGRESS,
+ errno.EWOULDBLOCK):
+ uncomplete = True
+ else:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return False
+ return True
+ else:
+ try:
+ if self._encrypt_correct:
+ if sock == self._remote_sock:
+ self._server.add_transfer_u(self._user, len(data))
+ self._update_activity(len(data))
+ if data:
+ l = len(data)
+ s = sock.send(data)
+ if s < l:
+ data = data[s:]
+ uncomplete = True
+ else:
+ return
+ except (OSError, IOError) as e:
+ error_no = eventloop.errno_from_exception(e)
+ if error_no in (errno.EAGAIN, errno.EINPROGRESS,
+ errno.EWOULDBLOCK):
+ uncomplete = True
+ else:
+ #traceback.print_exc()
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return False
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return False
+ if uncomplete:
+ if sock == self._local_sock:
+ self._data_to_write_to_local.append(data)
+ self._update_stream(STREAM_DOWN, WAIT_STATUS_WRITING)
+ elif sock == self._remote_sock:
+ self._data_to_write_to_remote.append(data)
+ self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
+ else:
+ logging.error('write_all_to_sock:unknown socket from %s:%d' % (self._client_address[0], self._client_address[1]))
+ else:
+ if sock == self._local_sock:
+ self._update_stream(STREAM_DOWN, WAIT_STATUS_READING)
+ elif sock == self._remote_sock:
+ self._update_stream(STREAM_UP, WAIT_STATUS_READING)
+ else:
+ logging.error('write_all_to_sock:unknown socket from %s:%d' % (self._client_address[0], self._client_address[1]))
+ return True
+
+ def _handle_server_dns_resolved(self, error, remote_addr, server_addr, data):
+ if error:
+ return
+ try:
+ addrs = socket.getaddrinfo(server_addr, remote_addr[1], 0, socket.SOCK_DGRAM, socket.SOL_UDP)
+ if not addrs: # drop
+ return
+ af, socktype, proto, canonname, sa = addrs[0]
+ if af == socket.AF_INET6:
+ self._remote_sock_v6.sendto(data, (server_addr, remote_addr[1]))
+ if self._udpv6_send_pack_id == 0:
+ addr, port = self._remote_sock_v6.getsockname()[:2]
+ common.connect_log('UDPv6 sendto %s(%s):%d from %s:%d by user %d' %
+ (common.to_str(remote_addr[0]), common.to_str(server_addr), remote_addr[1], addr, port, self._user_id))
+ self._udpv6_send_pack_id += 1
+ else:
+ self._remote_sock.sendto(data, (server_addr, remote_addr[1]))
+ if self._udp_send_pack_id == 0:
+ addr, port = self._remote_sock.getsockname()[:2]
+ common.connect_log('UDP sendto %s(%s):%d from %s:%d by user %d' %
+ (common.to_str(remote_addr[0]), common.to_str(server_addr), remote_addr[1], addr, port, self._user_id))
+ self._udp_send_pack_id += 1
+ return True
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+
+ def _get_redirect_host(self, client_address, ogn_data):
+ host_list = self._redir_list or ["*#0.0.0.0:0"]
+
+ if type(host_list) != list:
+ host_list = [host_list]
+
+ items_sum = common.to_str(host_list[0]).rsplit('#', 1)
+ if len(items_sum) < 2:
+ hash_code = binascii.crc32(ogn_data)
+ addrs = socket.getaddrinfo(client_address[0], client_address[1], 0, socket.SOCK_STREAM, socket.SOL_TCP)
+ af, socktype, proto, canonname, sa = addrs[0]
+ address_bytes = common.inet_pton(af, sa[0])
+ if af == socket.AF_INET6:
+ addr = struct.unpack('>Q', address_bytes[8:])[0]
+ elif af == socket.AF_INET:
+ addr = struct.unpack('>I', address_bytes)[0]
+ else:
+ addr = 0
+
+ host_port = []
+ match_port = False
+ for host in host_list:
+ items = common.to_str(host).rsplit(':', 1)
+ if len(items) > 1:
+ try:
+ port = int(items[1])
+ if port == self._server._listen_port:
+ match_port = True
+ host_port.append((items[0], port))
+ except:
+ pass
+ else:
+ host_port.append((host, 80))
+
+ if match_port:
+ last_host_port = host_port
+ host_port = []
+ for host in last_host_port:
+ if host[1] == self._server._listen_port:
+ host_port.append(host)
+
+ return host_port[((hash_code & 0xffffffff) + addr) % len(host_port)]
+
+ else:
+ host_port = []
+ for host in host_list:
+ items_sum = common.to_str(host).rsplit('#', 1)
+ items_match = common.to_str(items_sum[0]).rsplit(':', 1)
+ items = common.to_str(items_sum[1]).rsplit(':', 1)
+ if len(items_match) > 1:
+ if items_match[1] != "*":
+ try:
+ if self._server._listen_port != int(items_match[1]) and int(items_match[1]) != 0:
+ continue
+ except:
+ pass
+
+ if items_match[0] != "*" and common.match_regex(
+ items_match[0], ogn_data) == False:
+ continue
+ if len(items) > 1:
+ try:
+ port = int(items[1])
+ return (items[0], port)
+ except:
+ pass
+ else:
+ return (items[0], 80)
+
+ return ("0.0.0.0", 0)
+
+ def _handel_protocol_error(self, client_address, ogn_data):
+ logging.warn("Protocol ERROR, TCP ogn data %s from %s:%d via port %d by UID %d" % (binascii.hexlify(ogn_data), client_address[0], client_address[1], self._server._listen_port, self._user_id))
+ self._encrypt_correct = False
+ #create redirect or disconnect by hash code
+ host, port = self._get_redirect_host(client_address, ogn_data)
+ if port == 0:
+ raise Exception('can not parse header')
+ data = b"\x03" + common.to_bytes(common.chr(len(host))) + common.to_bytes(host) + struct.pack('>H', port)
+ self._is_redirect = True
+ logging.warn("TCP data redir %s:%d %s" % (host, port, binascii.hexlify(data)))
+ return data + ogn_data
+
+ def _handle_stage_connecting(self, data):
+ if self._is_local:
+ if self._encryptor is not None:
+ data = self._protocol.client_pre_encrypt(data)
+ data = self._encryptor.encrypt(data)
+ data = self._obfs.client_encode(data)
+ if data:
+ self._data_to_write_to_remote.append(data)
+ if self._is_local and not self._fastopen_connected and \
+ self._config['fast_open']:
+ # for sslocal and fastopen, we basically wait for data and use
+ # sendto to connect
+ try:
+ # only connect once
+ self._fastopen_connected = True
+ remote_sock = \
+ self._create_remote_socket(self._chosen_server[0],
+ self._chosen_server[1])
+ self._loop.add(remote_sock, eventloop.POLL_ERR, self._server)
+ data = b''.join(self._data_to_write_to_remote)
+ l = len(data)
+ s = remote_sock.sendto(data, MSG_FASTOPEN, self._chosen_server)
+ if s < l:
+ data = data[s:]
+ self._data_to_write_to_remote = [data]
+ else:
+ self._data_to_write_to_remote = []
+ self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
+ except (OSError, IOError) as e:
+ if eventloop.errno_from_exception(e) == errno.EINPROGRESS:
+ # in this case data is not sent at all
+ self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
+ elif eventloop.errno_from_exception(e) == errno.ENOTCONN:
+ logging.error('fast open not supported on this OS')
+ self._config['fast_open'] = False
+ self.destroy()
+ else:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+
+ def _get_head_size(self, buf, def_value):
+ if len(buf) < 2:
+ return def_value
+ head_type = common.ord(buf[0]) & 0xF
+ if head_type == 1:
+ return 7
+ if head_type == 4:
+ return 19
+ if head_type == 3:
+ return 4 + common.ord(buf[1])
+ return def_value
+
+ def _handle_stage_addr(self, ogn_data, data):
+ try:
+ if self._is_local:
+ cmd = common.ord(data[1])
+ if cmd == CMD_UDP_ASSOCIATE:
+ logging.debug('UDP associate')
+ if self._local_sock.family == socket.AF_INET6:
+ header = b'\x05\x00\x00\x04'
+ else:
+ header = b'\x05\x00\x00\x01'
+ addr, port = self._local_sock.getsockname()[:2]
+ addr_to_send = socket.inet_pton(self._local_sock.family,
+ addr)
+ port_to_send = struct.pack('>H', port)
+ self._write_to_sock(header + addr_to_send + port_to_send,
+ self._local_sock)
+ self._stage = STAGE_UDP_ASSOC
+ # just wait for the client to disconnect
+ return
+ elif cmd == CMD_CONNECT:
+ # just trim VER CMD RSV
+ data = data[3:]
+ else:
+ logging.error('invalid command %d', cmd)
+ self.destroy()
+ return
+
+ before_parse_data = data
+ if self._is_local:
+ header_result = parse_header(data)
+ else:
+ data = pre_parse_header(data)
+ if data is None:
+ data = self._handel_protocol_error(self._client_address, ogn_data)
+ header_result = parse_header(data)
+ if header_result is not None:
+ try:
+ common.to_str(header_result[2])
+ except Exception as e:
+ header_result = None
+ if header_result is None:
+ data = self._handel_protocol_error(self._client_address, ogn_data)
+ header_result = parse_header(data)
+ self._overhead = self._obfs.get_overhead(self._is_local) + self._protocol.get_overhead(self._is_local)
+ self._recv_buffer_size = BUF_SIZE - self._overhead
+ server_info = self._obfs.get_server_info()
+ server_info.buffer_size = self._recv_buffer_size
+ server_info = self._protocol.get_server_info()
+ server_info.buffer_size = self._recv_buffer_size
+ connecttype, addrtype, remote_addr, remote_port, header_length = header_result
+ if connecttype != 0:
+ pass
+ #common.connect_log('UDP over TCP by user %d' %
+ # (self._user_id, ))
+ else:
+ common.connect_log('TCP request %s:%d by user %d' %
+ (common.to_str(remote_addr), remote_port, self._user_id))
+ self._remote_address = (common.to_str(remote_addr), remote_port)
+ self._remote_udp = (connecttype != 0)
+ # pause reading
+ self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
+ self._stage = STAGE_DNS
+ if self._is_local:
+ # forward address to remote
+ self._write_to_sock((b'\x05\x00\x00\x01'
+ b'\x00\x00\x00\x00\x10\x10'),
+ self._local_sock)
+ head_len = self._get_head_size(data, 30)
+ self._obfs.obfs.server_info.head_len = head_len
+ self._protocol.obfs.server_info.head_len = head_len
+ if self._encryptor is not None:
+ data = self._protocol.client_pre_encrypt(data)
+ data_to_send = self._encryptor.encrypt(data)
+ data_to_send = self._obfs.client_encode(data_to_send)
+ if data_to_send:
+ self._data_to_write_to_remote.append(data_to_send)
+ # notice here may go into _handle_dns_resolved directly
+ self._dns_resolver.resolve(self._chosen_server[0],
+ self._handle_dns_resolved)
+ else:
+ if len(data) > header_length:
+ self._data_to_write_to_remote.append(data[header_length:])
+ # notice here may go into _handle_dns_resolved directly
+ self._dns_resolver.resolve(remote_addr,
+ self._handle_dns_resolved)
+ except Exception as e:
+ self._log_error(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ self.destroy()
+
+ def _socket_bind_addr(self, sock, af):
+ bind_addr = ''
+ if self._bind and af == socket.AF_INET:
+ bind_addr = self._bind
+ elif self._bindv6 and af == socket.AF_INET6:
+ bind_addr = self._bindv6
+ else:
+ bind_addr = self._accept_address[0]
+
+ bind_addr = bind_addr.replace("::ffff:", "")
+ if bind_addr in self._ignore_bind_list:
+ bind_addr = None
+ if bind_addr:
+ local_addrs = socket.getaddrinfo(bind_addr, 0, 0, socket.SOCK_STREAM, socket.SOL_TCP)
+ if local_addrs[0][0] == af:
+ logging.debug("bind %s" % (bind_addr,))
+ try:
+ sock.bind((bind_addr, 0))
+ except Exception as e:
+ logging.warn("bind %s fail" % (bind_addr,))
+
+ def _create_remote_socket(self, ip, port):
+ if self._remote_udp:
+ addrs_v6 = socket.getaddrinfo("::", 0, 0, socket.SOCK_DGRAM, socket.SOL_UDP)
+ addrs = socket.getaddrinfo("0.0.0.0", 0, 0, socket.SOCK_DGRAM, socket.SOL_UDP)
+ else:
+ addrs = socket.getaddrinfo(ip, port, 0, socket.SOCK_STREAM, socket.SOL_TCP)
+ if len(addrs) == 0:
+ raise Exception("getaddrinfo failed for %s:%d" % (ip, port))
+ af, socktype, proto, canonname, sa = addrs[0]
+ if not self._remote_udp and not self._is_redirect:
+ if self._forbidden_iplist:
+ if common.to_str(sa[0]) in self._forbidden_iplist:
+ if self._remote_address:
+ raise Exception('IP %s is in forbidden list, when connect to %s:%d via port %d by UID %d' %
+ (common.to_str(sa[0]), self._remote_address[0], self._remote_address[1], self._server._listen_port, self._user_id))
+ raise Exception('IP %s is in forbidden list, reject' %
+ common.to_str(sa[0]))
+ if self._forbidden_portset:
+ if sa[1] in self._forbidden_portset:
+ if self._remote_address:
+ raise Exception('Port %d is in forbidden list, when connect to %s:%d via port %d by UID %d' %
+ (sa[1], self._remote_address[0], self._remote_address[1], self._server._listen_port, self._user_id))
+ raise Exception('Port %d is in forbidden list, reject' % sa[1])
+ remote_sock = socket.socket(af, socktype, proto)
+ self._remote_sock = remote_sock
+ self._remote_sock_fd = remote_sock.fileno()
+ self._fd_to_handlers[self._remote_sock_fd] = self
+
+ if self._remote_udp:
+ af, socktype, proto, canonname, sa = addrs_v6[0]
+ remote_sock_v6 = socket.socket(af, socktype, proto)
+ self._remote_sock_v6 = remote_sock_v6
+ self._remotev6_sock_fd = remote_sock_v6.fileno()
+ self._fd_to_handlers[self._remotev6_sock_fd] = self
+
+ remote_sock.setblocking(False)
+ if self._remote_udp:
+ remote_sock_v6.setblocking(False)
+
+ if not self._is_local:
+ self._socket_bind_addr(remote_sock, af)
+ self._socket_bind_addr(remote_sock_v6, af)
+ else:
+ remote_sock.setsockopt(socket.SOL_TCP, socket.TCP_NODELAY, 1)
+ if not self._is_local:
+ self._socket_bind_addr(remote_sock, af)
+ return remote_sock
+
+ def _handle_dns_resolved(self, result, error):
+ if error:
+ self._log_error(error)
+ self.destroy()
+ return
+ if result:
+ ip = result[1]
+ if ip:
+ try:
+ self._stage = STAGE_CONNECTING
+ remote_addr = ip
+ if self._is_local:
+ remote_port = self._chosen_server[1]
+ else:
+ remote_port = self._remote_address[1]
+
+ if self._is_local and self._config['fast_open']:
+ # for fastopen:
+ # wait for more data to arrive and send them in one SYN
+ self._stage = STAGE_CONNECTING
+ # we don't have to wait for remote since it's not
+ # created
+ self._update_stream(STREAM_UP, WAIT_STATUS_READING)
+ # TODO when there is already data in this packet
+ else:
+ # else do connect
+ remote_sock = self._create_remote_socket(remote_addr,
+ remote_port)
+ if self._remote_udp:
+ self._loop.add(remote_sock,
+ eventloop.POLL_IN,
+ self._server)
+ if self._remote_sock_v6:
+ self._loop.add(self._remote_sock_v6,
+ eventloop.POLL_IN,
+ self._server)
+ else:
+ try:
+ remote_sock.connect((remote_addr, remote_port))
+ except (OSError, IOError) as e:
+ if eventloop.errno_from_exception(e) in (errno.EINPROGRESS,
+ errno.EWOULDBLOCK):
+ pass # always goto here
+ else:
+ raise e
+ addr, port = self._remote_sock.getsockname()[:2]
+ common.connect_log('TCP connecting %s(%s):%d from %s:%d by user %d' %
+ (common.to_str(self._remote_address[0]), common.to_str(remote_addr), remote_port, addr, port, self._user_id))
+
+ self._loop.add(remote_sock,
+ eventloop.POLL_ERR | eventloop.POLL_OUT,
+ self._server)
+ self._stage = STAGE_CONNECTING
+ self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
+ self._update_stream(STREAM_DOWN, WAIT_STATUS_READING)
+ if self._remote_udp:
+ while self._data_to_write_to_remote:
+ data = self._data_to_write_to_remote[0]
+ del self._data_to_write_to_remote[0]
+ self._write_to_sock(data, self._remote_sock)
+ return
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+
+ def _get_read_size(self, sock, recv_buffer_size, up):
+ if self._overhead == 0:
+ return recv_buffer_size
+ buffer_size = len(sock.recv(recv_buffer_size, socket.MSG_PEEK))
+ frame_size = self._tcp_mss - self._overhead
+ if up:
+ buffer_size = min(buffer_size, self._recv_u_max_size)
+ self._recv_u_max_size = min(self._recv_u_max_size + frame_size, BUF_SIZE)
+ else:
+ buffer_size = min(buffer_size, self._recv_d_max_size)
+ self._recv_d_max_size = min(self._recv_d_max_size + frame_size, BUF_SIZE)
+ if buffer_size == recv_buffer_size:
+ return buffer_size
+ if buffer_size > frame_size:
+ buffer_size = int(buffer_size / frame_size) * frame_size
+ return buffer_size
+
+ def _on_local_read(self):
+ # handle all local read events and dispatch them to methods for
+ # each stage
+ if not self._local_sock:
+ return
+ is_local = self._is_local
+ if is_local:
+ recv_buffer_size = self._get_read_size(self._local_sock, self._recv_buffer_size, True)
+ else:
+ recv_buffer_size = BUF_SIZE
+ data = None
+ try:
+ data = self._local_sock.recv(recv_buffer_size)
+ except (OSError, IOError) as e:
+ if eventloop.errno_from_exception(e) in \
+ (errno.ETIMEDOUT, errno.EAGAIN, errno.EWOULDBLOCK):
+ return
+ if not data:
+ self.destroy()
+ return
+
+ self.speed_tester_u.add(len(data))
+ self._server.speed_tester_u(self._user_id).add(len(data))
+ ogn_data = data
+ if not is_local:
+ if self._encryptor is not None:
+ if self._encrypt_correct:
+ try:
+ obfs_decode = self._obfs.server_decode(data)
+ if self._stage == STAGE_INIT:
+ self._overhead = self._obfs.get_overhead(self._is_local) + self._protocol.get_overhead(self._is_local)
+ server_info = self._protocol.get_server_info()
+ server_info.overhead = self._overhead
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ if obfs_decode[2]:
+ data = self._obfs.server_encode(b'')
+ try:
+ self._write_to_sock(data, self._local_sock)
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ if obfs_decode[1]:
+ if not self._protocol.obfs.server_info.recv_iv:
+ iv_len = len(self._protocol.obfs.server_info.iv)
+ self._protocol.obfs.server_info.recv_iv = obfs_decode[0][:iv_len]
+ data = self._encryptor.decrypt(obfs_decode[0])
+ else:
+ data = obfs_decode[0]
+ try:
+ data, sendback = self._protocol.server_post_decrypt(data)
+ if sendback:
+ backdata = self._protocol.server_pre_encrypt(b'')
+ backdata = self._encryptor.encrypt(backdata)
+ backdata = self._obfs.server_encode(backdata)
+ try:
+ self._write_to_sock(backdata, self._local_sock)
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ else:
+ return
+ if not data:
+ return
+ if self._stage == STAGE_STREAM:
+ if self._is_local:
+ if self._encryptor is not None:
+ data = self._protocol.client_pre_encrypt(data)
+ data = self._encryptor.encrypt(data)
+ data = self._obfs.client_encode(data)
+ self._write_to_sock(data, self._remote_sock)
+ elif is_local and self._stage == STAGE_INIT:
+ # TODO check auth method
+ self._write_to_sock(b'\x05\00', self._local_sock)
+ self._stage = STAGE_ADDR
+ elif self._stage == STAGE_CONNECTING:
+ self._handle_stage_connecting(data)
+ elif (is_local and self._stage == STAGE_ADDR) or \
+ (not is_local and self._stage == STAGE_INIT):
+ self._handle_stage_addr(ogn_data, data)
+
+ def _on_remote_read(self, is_remote_sock):
+ # handle all remote read events
+ data = None
+ try:
+ if self._remote_udp:
+ if is_remote_sock:
+ data, addr = self._remote_sock.recvfrom(UDP_MAX_BUF_SIZE)
+ else:
+ data, addr = self._remote_sock_v6.recvfrom(UDP_MAX_BUF_SIZE)
+ port = struct.pack('>H', addr[1])
+ try:
+ ip = socket.inet_aton(addr[0])
+ data = b'\x00\x01' + ip + port + data
+ except Exception as e:
+ ip = socket.inet_pton(socket.AF_INET6, addr[0])
+ data = b'\x00\x04' + ip + port + data
+ size = len(data) + 2
+ data = struct.pack('>H', size) + data
+ #logging.info('UDP over TCP recvfrom %s:%d %d bytes to %s:%d' % (addr[0], addr[1], len(data), self._client_address[0], self._client_address[1]))
+ else:
+ if self._is_local:
+ recv_buffer_size = BUF_SIZE
+ else:
+ recv_buffer_size = self._get_read_size(self._remote_sock, self._recv_buffer_size, False)
+ data = self._remote_sock.recv(recv_buffer_size)
+ self._recv_pack_id += 1
+ except (OSError, IOError) as e:
+ if eventloop.errno_from_exception(e) in \
+ (errno.ETIMEDOUT, errno.EAGAIN, errno.EWOULDBLOCK, 10035): #errno.WSAEWOULDBLOCK
+ return
+ if not data:
+ self.destroy()
+ return
+
+ self.speed_tester_d.add(len(data))
+ self._server.speed_tester_d(self._user_id).add(len(data))
+ if self._encryptor is not None:
+ if self._is_local:
+ try:
+ obfs_decode = self._obfs.client_decode(data)
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ if obfs_decode[1]:
+ send_back = self._obfs.client_encode(b'')
+ self._write_to_sock(send_back, self._remote_sock)
+ if not self._protocol.obfs.server_info.recv_iv:
+ iv_len = len(self._protocol.obfs.server_info.iv)
+ self._protocol.obfs.server_info.recv_iv = obfs_decode[0][:iv_len]
+ data = self._encryptor.decrypt(obfs_decode[0])
+ try:
+ data = self._protocol.client_post_decrypt(data)
+ if self._recv_pack_id == 1:
+ self._tcp_mss = self._protocol.get_server_info().tcp_mss
+ except Exception as e:
+ shell.print_exception(e)
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+ return
+ else:
+ if self._encrypt_correct:
+ data = self._protocol.server_pre_encrypt(data)
+ data = self._encryptor.encrypt(data)
+ data = self._obfs.server_encode(data)
+ self._server.add_transfer_d(self._user, len(data))
+ self._update_activity(len(data))
+ else:
+ return
+ try:
+ self._write_to_sock(data, self._local_sock)
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ logging.error("exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+
+ def _on_local_write(self):
+ # handle local writable event
+ if self._data_to_write_to_local:
+ data = b''.join(self._data_to_write_to_local)
+ self._data_to_write_to_local = []
+ self._write_to_sock(data, self._local_sock)
+ else:
+ self._update_stream(STREAM_DOWN, WAIT_STATUS_READING)
+
+ def _on_remote_write(self):
+ # handle remote writable event
+ self._stage = STAGE_STREAM
+ if self._data_to_write_to_remote:
+ data = b''.join(self._data_to_write_to_remote)
+ self._data_to_write_to_remote = []
+ self._write_to_sock(data, self._remote_sock)
+ else:
+ self._update_stream(STREAM_UP, WAIT_STATUS_READING)
+
+ def _on_local_error(self):
+ if self._local_sock:
+ err = eventloop.get_sock_error(self._local_sock)
+ if err.errno not in [errno.ECONNRESET, errno.EPIPE]:
+ logging.error(err)
+ logging.error("local error, exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+
+ def _on_remote_error(self):
+ if self._remote_sock:
+ err = eventloop.get_sock_error(self._remote_sock)
+ if err.errno not in [errno.ECONNRESET]:
+ logging.error(err)
+ if self._remote_address:
+ logging.error("remote error, when connect to %s:%d" % (self._remote_address[0], self._remote_address[1]))
+ else:
+ logging.error("remote error, exception from %s:%d" % (self._client_address[0], self._client_address[1]))
+ self.destroy()
+
+ def handle_event(self, sock, fd, event):
+ # handle all events in this handler and dispatch them to methods
+ handle = False
+ if self._stage == STAGE_DESTROYED:
+ logging.debug('ignore handle_event: destroyed')
+ return True
+ if self._user is not None and self._user not in self._server.server_users:
+ self.destroy()
+ return True
+ if fd == self._remote_sock_fd or fd == self._remotev6_sock_fd:
+ if event & eventloop.POLL_ERR:
+ handle = True
+ self._on_remote_error()
+ elif event & (eventloop.POLL_IN | eventloop.POLL_HUP):
+ if not self.speed_tester_d.isExceed() and not self._server.speed_tester_d(self._user_id).isExceed():
+ handle = True
+ self._on_remote_read(sock == self._remote_sock)
+ else:
+ self._recv_d_max_size = self._tcp_mss - self._overhead
+ elif event & eventloop.POLL_OUT:
+ handle = True
+ self._on_remote_write()
+ elif fd == self._local_sock_fd:
+ if event & eventloop.POLL_ERR:
+ handle = True
+ self._on_local_error()
+ elif event & (eventloop.POLL_IN | eventloop.POLL_HUP):
+ if not self.speed_tester_u.isExceed() and not self._server.speed_tester_u(self._user_id).isExceed():
+ handle = True
+ self._on_local_read()
+ else:
+ self._recv_u_max_size = self._tcp_mss - self._overhead
+ elif event & eventloop.POLL_OUT:
+ handle = True
+ self._on_local_write()
+ else:
+ logging.warn('unknown socket from %s:%d' % (self._client_address[0], self._client_address[1]))
+ try:
+ self._loop.removefd(fd)
+ except Exception as e:
+ shell.print_exception(e)
+ try:
+ del self._fd_to_handlers[fd]
+ except Exception as e:
+ shell.print_exception(e)
+ sock.close()
+
+ return handle
+
+ def _log_error(self, e):
+ logging.error('%s when handling connection from %s:%d' %
+ (e, self._client_address[0], self._client_address[1]))
+
+ def stage(self):
+ return self._stage
+
+ def destroy(self):
+ # destroy the handler and release any resources
+ # promises:
+ # 1. destroy won't make another destroy() call inside
+ # 2. destroy releases resources so it prevents future call to destroy
+ # 3. destroy won't raise any exceptions
+ # if any of the promises are broken, it indicates a bug has been
+ # introduced! mostly likely memory leaks, etc
+ if self._stage == STAGE_DESTROYED:
+ # this couldn't happen
+ logging.debug('already destroyed')
+ return
+ self._stage = STAGE_DESTROYED
+ if self._remote_address:
+ logging.debug('destroy: %s:%d' %
+ self._remote_address)
+ else:
+ logging.debug('destroy')
+ if self._remote_sock:
+ logging.debug('destroying remote')
+ try:
+ self._loop.removefd(self._remote_sock_fd)
+ except Exception as e:
+ shell.print_exception(e)
+ try:
+ if self._remote_sock_fd is not None:
+ del self._fd_to_handlers[self._remote_sock_fd]
+ except Exception as e:
+ shell.print_exception(e)
+ self._remote_sock.close()
+ self._remote_sock = None
+ if self._remote_sock_v6:
+ logging.debug('destroying remote_v6')
+ try:
+ self._loop.removefd(self._remotev6_sock_fd)
+ except Exception as e:
+ shell.print_exception(e)
+ try:
+ if self._remotev6_sock_fd is not None:
+ del self._fd_to_handlers[self._remotev6_sock_fd]
+ except Exception as e:
+ shell.print_exception(e)
+ self._remote_sock_v6.close()
+ self._remote_sock_v6 = None
+ if self._local_sock:
+ logging.debug('destroying local')
+ try:
+ self._loop.removefd(self._local_sock_fd)
+ except Exception as e:
+ shell.print_exception(e)
+ try:
+ if self._local_sock_fd is not None:
+ del self._fd_to_handlers[self._local_sock_fd]
+ except Exception as e:
+ shell.print_exception(e)
+ self._local_sock.close()
+ self._local_sock = None
+ if self._obfs:
+ self._obfs.dispose()
+ self._obfs = None
+ if self._protocol:
+ self._protocol.dispose()
+ self._protocol = None
+ self._encryptor = None
+ self._dns_resolver.remove_callback(self._handle_dns_resolved)
+ self._server.remove_handler(self)
+ if self._add_ref > 0:
+ self._server.add_connection(-1)
+ self._server.stat_add(self._client_address[0], -1)
+
+class TCPRelay(object):
+ def __init__(self, config, dns_resolver, is_local, stat_callback=None, stat_counter=None):
+ self._config = config
+ self._is_local = is_local
+ self._dns_resolver = dns_resolver
+ self._closed = False
+ self._eventloop = None
+ self._fd_to_handlers = {}
+ self.server_transfer_ul = 0
+ self.server_transfer_dl = 0
+ self.server_users = {}
+ self.server_users_cfg = {}
+ self.server_user_transfer_ul = {}
+ self.server_user_transfer_dl = {}
+ self.mu = False
+ self._speed_tester_u = {}
+ self._speed_tester_d = {}
+ self.server_connections = 0
+ self.protocol_data = obfs.obfs(config['protocol']).init_data()
+ self.obfs_data = obfs.obfs(config['obfs']).init_data()
+
+ if config.get('connect_verbose_info', 0) > 0:
+ common.connect_log = logging.info
+
+ self._timeout = config['timeout']
+ self._timeout_cache = lru_cache.LRUCache(timeout=self._timeout,
+ close_callback=self._close_tcp_client)
+
+ if is_local:
+ listen_addr = config['local_address']
+ listen_port = config['local_port']
+ else:
+ listen_addr = config['server']
+ listen_port = config['server_port']
+ self._listen_port = listen_port
+
+ if common.to_str(config['protocol']) in obfs.mu_protocol():
+ self._update_users(None, None)
+
+ addrs = socket.getaddrinfo(listen_addr, listen_port, 0,
+ socket.SOCK_STREAM, socket.SOL_TCP)
+ if len(addrs) == 0:
+ raise Exception("can't get addrinfo for %s:%d" %
+ (listen_addr, listen_port))
+ af, socktype, proto, canonname, sa = addrs[0]
+ server_socket = socket.socket(af, socktype, proto)
+ server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+ server_socket.bind(sa)
+ server_socket.setblocking(False)
+ if config['fast_open']:
+ try:
+ server_socket.setsockopt(socket.SOL_TCP, 23, 5)
+ except socket.error:
+ logging.error('warning: fast open is not available')
+ self._config['fast_open'] = False
+ server_socket.listen(config.get('max_connect', 1024))
+ self._server_socket = server_socket
+ self._server_socket_fd = server_socket.fileno()
+ self._stat_counter = stat_counter
+ self._stat_callback = stat_callback
+
+ def add_to_loop(self, loop):
+ if self._eventloop:
+ raise Exception('already add to loop')
+ if self._closed:
+ raise Exception('already closed')
+ self._eventloop = loop
+ self._eventloop.add(self._server_socket,
+ eventloop.POLL_IN | eventloop.POLL_ERR, self)
+ self._eventloop.add_periodic(self.handle_periodic)
+
+ def remove_handler(self, client):
+ if hash(client) in self._timeout_cache:
+ del self._timeout_cache[hash(client)]
+
+ def add_connection(self, val):
+ self.server_connections += val
+ logging.debug('server port %5d connections = %d' % (self._listen_port, self.server_connections,))
+
+ def get_ud(self):
+ return (self.server_transfer_ul, self.server_transfer_dl)
+
+ def get_users_ud(self):
+ return (self.server_user_transfer_ul.copy(), self.server_user_transfer_dl.copy())
+
+ def _update_users(self, protocol_param, acl):
+ if protocol_param is None:
+ protocol_param = self._config['protocol_param']
+ param = common.to_bytes(protocol_param).split(b'#')
+ if len(param) == 2:
+ self.mu = True
+ user_list = param[1].split(b',')
+ if user_list:
+ for user in user_list:
+ items = user.split(b':')
+ if len(items) == 2:
+ user_int_id = int(items[0])
+ uid = struct.pack('= stat_dict.get(-1, 0) + connections_step:
+ logging.info('port %d connections up to %d' % (port, newval))
+ stat_dict[-1] = stat_dict.get(-1, 0) + connections_step
+ elif newval <= stat_dict.get(-1, 0) - connections_step:
+ logging.info('port %d connections down to %d' % (port, newval))
+ stat_dict[-1] = stat_dict.get(-1, 0) - connections_step
+
+ def stat_add(self, local_addr, val):
+ if self._stat_counter is not None:
+ if self._listen_port not in self._stat_counter:
+ self._stat_counter[self._listen_port] = {}
+ newval = self._stat_counter[self._listen_port].get(local_addr, 0) + val
+ logging.debug('port %d addr %s connections %d' % (self._listen_port, local_addr, newval))
+ self._stat_counter[self._listen_port][local_addr] = newval
+ self.update_stat(self._listen_port, self._stat_counter[self._listen_port], val)
+ if newval <= 0:
+ if local_addr in self._stat_counter[self._listen_port]:
+ del self._stat_counter[self._listen_port][local_addr]
+
+ newval = self._stat_counter.get(0, 0) + val
+ self._stat_counter[0] = newval
+ logging.debug('Total connections %d' % newval)
+
+ connections_step = 50
+ if newval >= self._stat_counter.get(-1, 0) + connections_step:
+ logging.info('Total connections up to %d' % newval)
+ self._stat_counter[-1] = self._stat_counter.get(-1, 0) + connections_step
+ elif newval <= self._stat_counter.get(-1, 0) - connections_step:
+ logging.info('Total connections down to %d' % newval)
+ self._stat_counter[-1] = self._stat_counter.get(-1, 0) - connections_step
+
+ def update_activity(self, client, data_len):
+ if data_len and self._stat_callback:
+ self._stat_callback(self._listen_port, data_len)
+
+ self._timeout_cache[hash(client)] = client
+
+ def _sweep_timeout(self):
+ self._timeout_cache.sweep()
+
+ def _close_tcp_client(self, client):
+ if client.remote_address:
+ logging.debug('timed out: %s:%d' %
+ client.remote_address)
+ else:
+ logging.debug('timed out')
+ client.destroy()
+
+ def handle_event(self, sock, fd, event):
+ # handle events and dispatch to handlers
+ handle = False
+ if sock:
+ logging.log(shell.VERBOSE_LEVEL, 'fd %d %s', fd,
+ eventloop.EVENT_NAMES.get(event, event))
+ if sock == self._server_socket:
+ if event & eventloop.POLL_ERR:
+ # TODO
+ raise Exception('server_socket error')
+ handler = None
+ handle = True
+ try:
+ logging.debug('accept')
+ conn = self._server_socket.accept()
+ handler = TCPRelayHandler(self, self._fd_to_handlers,
+ self._eventloop, conn[0], self._config,
+ self._dns_resolver, self._is_local)
+ if handler.stage() == STAGE_DESTROYED:
+ conn[0].close()
+ except (OSError, IOError) as e:
+ error_no = eventloop.errno_from_exception(e)
+ if error_no in (errno.EAGAIN, errno.EINPROGRESS,
+ errno.EWOULDBLOCK):
+ return
+ else:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ if handler:
+ handler.destroy()
+ else:
+ if sock:
+ handler = self._fd_to_handlers.get(fd, None)
+ if handler:
+ handle = handler.handle_event(sock, fd, event)
+ else:
+ logging.warn('unknown fd')
+ handle = True
+ try:
+ self._eventloop.removefd(fd)
+ except Exception as e:
+ shell.print_exception(e)
+ sock.close()
+ else:
+ logging.warn('poll removed fd')
+ handle = True
+ if fd in self._fd_to_handlers:
+ try:
+ del self._fd_to_handlers[fd]
+ except Exception as e:
+ shell.print_exception(e)
+ return handle
+
+ def handle_periodic(self):
+ if self._closed:
+ if self._server_socket:
+ self._eventloop.removefd(self._server_socket_fd)
+ self._server_socket.close()
+ self._server_socket = None
+ logging.info('closed TCP port %d', self._listen_port)
+ for handler in list(self._fd_to_handlers.values()):
+ handler.destroy()
+ self._sweep_timeout()
+
+ def close(self, next_tick=False):
+ logging.debug('TCP close')
+ self._closed = True
+ if not next_tick:
+ if self._eventloop:
+ self._eventloop.remove_periodic(self.handle_periodic)
+ self._eventloop.removefd(self._server_socket_fd)
+ self._server_socket.close()
+ for handler in list(self._fd_to_handlers.values()):
+ handler.destroy()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/udprelay.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/udprelay.py
new file mode 100644
index 000000000..b9606cd81
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/udprelay.py
@@ -0,0 +1,656 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# SOCKS5 UDP Request
+# +----+------+------+----------+----------+----------+
+# |RSV | FRAG | ATYP | DST.ADDR | DST.PORT | DATA |
+# +----+------+------+----------+----------+----------+
+# | 2 | 1 | 1 | Variable | 2 | Variable |
+# +----+------+------+----------+----------+----------+
+
+# SOCKS5 UDP Response
+# +----+------+------+----------+----------+----------+
+# |RSV | FRAG | ATYP | DST.ADDR | DST.PORT | DATA |
+# +----+------+------+----------+----------+----------+
+# | 2 | 1 | 1 | Variable | 2 | Variable |
+# +----+------+------+----------+----------+----------+
+
+# shadowsocks UDP Request (before encrypted)
+# +------+----------+----------+----------+
+# | ATYP | DST.ADDR | DST.PORT | DATA |
+# +------+----------+----------+----------+
+# | 1 | Variable | 2 | Variable |
+# +------+----------+----------+----------+
+
+# shadowsocks UDP Response (before encrypted)
+# +------+----------+----------+----------+
+# | ATYP | DST.ADDR | DST.PORT | DATA |
+# +------+----------+----------+----------+
+# | 1 | Variable | 2 | Variable |
+# +------+----------+----------+----------+
+
+# shadowsocks UDP Request and Response (after encrypted)
+# +-------+--------------+
+# | IV | PAYLOAD |
+# +-------+--------------+
+# | Fixed | Variable |
+# +-------+--------------+
+
+# HOW TO NAME THINGS
+# ------------------
+# `dest` means destination server, which is from DST fields in the SOCKS5
+# request
+# `local` means local server of shadowsocks
+# `remote` means remote server of shadowsocks
+# `client` means UDP clients that connects to other servers
+# `server` means the UDP server that handles user requests
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import time
+import socket
+import logging
+import struct
+import errno
+import random
+import binascii
+import traceback
+import threading
+
+from shadowsocks import encrypt, obfs, eventloop, lru_cache, common, shell
+from shadowsocks.common import pre_parse_header, parse_header, pack_addr
+
+# for each handler, we have 2 stream directions:
+# upstream: from client to server direction
+# read local and write to remote
+# downstream: from server to client direction
+# read remote and write to local
+
+STREAM_UP = 0
+STREAM_DOWN = 1
+
+# for each stream, it's waiting for reading, or writing, or both
+WAIT_STATUS_INIT = 0
+WAIT_STATUS_READING = 1
+WAIT_STATUS_WRITING = 2
+WAIT_STATUS_READWRITING = WAIT_STATUS_READING | WAIT_STATUS_WRITING
+
+BUF_SIZE = 65536
+DOUBLE_SEND_BEG_IDS = 16
+POST_MTU_MIN = 500
+POST_MTU_MAX = 1400
+SENDING_WINDOW_SIZE = 8192
+
+STAGE_INIT = 0
+STAGE_RSP_ID = 1
+STAGE_DNS = 2
+STAGE_CONNECTING = 3
+STAGE_STREAM = 4
+STAGE_DESTROYED = -1
+
+CMD_CONNECT = 0
+CMD_RSP_CONNECT = 1
+CMD_CONNECT_REMOTE = 2
+CMD_RSP_CONNECT_REMOTE = 3
+CMD_POST = 4
+CMD_SYN_STATUS = 5
+CMD_POST_64 = 6
+CMD_SYN_STATUS_64 = 7
+CMD_DISCONNECT = 8
+
+CMD_VER_STR = b"\x08"
+
+RSP_STATE_EMPTY = b""
+RSP_STATE_REJECT = b"\x00"
+RSP_STATE_CONNECTED = b"\x01"
+RSP_STATE_CONNECTEDREMOTE = b"\x02"
+RSP_STATE_ERROR = b"\x03"
+RSP_STATE_DISCONNECT = b"\x04"
+RSP_STATE_REDIRECT = b"\x05"
+
+def client_key(source_addr, server_af):
+ # notice this is server af, not dest af
+ return '%s:%s:%d' % (source_addr[0], source_addr[1], server_af)
+
+class UDPRelay(object):
+ def __init__(self, config, dns_resolver, is_local, stat_callback=None, stat_counter=None):
+ self._config = config
+ if config.get('connect_verbose_info', 0) > 0:
+ common.connect_log = logging.info
+ if is_local:
+ self._listen_addr = config['local_address']
+ self._listen_port = config['local_port']
+ self._remote_addr = config['server']
+ self._remote_port = config['server_port']
+ else:
+ self._listen_addr = config['server']
+ self._listen_port = config['server_port']
+ self._remote_addr = None
+ self._remote_port = None
+ self._dns_resolver = dns_resolver
+ self._password = common.to_bytes(config['password'])
+ self._method = config['method']
+ self._timeout = config['timeout']
+ self._is_local = is_local
+ self._udp_cache_size = config['udp_cache']
+ self._cache = lru_cache.LRUCache(timeout=config['udp_timeout'],
+ close_callback=self._close_client_pair)
+ self._cache_dns_client = lru_cache.LRUCache(timeout=10,
+ close_callback=self._close_client_pair)
+ self._client_fd_to_server_addr = {}
+ #self._dns_cache = lru_cache.LRUCache(timeout=1800)
+ self._eventloop = None
+ self._closed = False
+ self.server_transfer_ul = 0
+ self.server_transfer_dl = 0
+ self.server_users = {}
+ self.server_user_transfer_ul = {}
+ self.server_user_transfer_dl = {}
+
+ if common.to_bytes(config['protocol']) in obfs.mu_protocol():
+ self._update_users(None, None)
+
+ self.protocol_data = obfs.obfs(config['protocol']).init_data()
+ self._protocol = obfs.obfs(config['protocol'])
+ server_info = obfs.server_info(self.protocol_data)
+ server_info.host = self._listen_addr
+ server_info.port = self._listen_port
+ server_info.users = self.server_users
+ server_info.protocol_param = config['protocol_param']
+ server_info.obfs_param = ''
+ server_info.iv = b''
+ server_info.recv_iv = b''
+ server_info.key_str = common.to_bytes(config['password'])
+ server_info.key = encrypt.encrypt_key(self._password, self._method)
+ server_info.head_len = 30
+ server_info.tcp_mss = 1452
+ server_info.buffer_size = BUF_SIZE
+ server_info.overhead = 0
+ self._protocol.set_server_info(server_info)
+
+ self._sockets = set()
+ self._fd_to_handlers = {}
+ self._reqid_to_hd = {}
+ self._data_to_write_to_server_socket = []
+
+ self._timeout_cache = lru_cache.LRUCache(timeout=self._timeout,
+ close_callback=self._close_tcp_client)
+
+ self._bind = config.get('out_bind', '')
+ self._bindv6 = config.get('out_bindv6', '')
+ self._ignore_bind_list = config.get('ignore_bind', [])
+
+ if 'forbidden_ip' in config:
+ self._forbidden_iplist = config['forbidden_ip']
+ else:
+ self._forbidden_iplist = None
+ if 'forbidden_port' in config:
+ self._forbidden_portset = config['forbidden_port']
+ else:
+ self._forbidden_portset = None
+
+ addrs = socket.getaddrinfo(self._listen_addr, self._listen_port, 0,
+ socket.SOCK_DGRAM, socket.SOL_UDP)
+ if len(addrs) == 0:
+ raise Exception("can't get addrinfo for %s:%d" %
+ (self._listen_addr, self._listen_port))
+ af, socktype, proto, canonname, sa = addrs[0]
+ server_socket = socket.socket(af, socktype, proto)
+ server_socket.bind((self._listen_addr, self._listen_port))
+ server_socket.setblocking(False)
+ self._server_socket = server_socket
+ self._stat_callback = stat_callback
+
+ def _get_a_server(self):
+ server = self._config['server']
+ server_port = self._config['server_port']
+ if type(server_port) == list:
+ server_port = random.choice(server_port)
+ if type(server) == list:
+ server = random.choice(server)
+ logging.debug('chosen server: %s:%d', server, server_port)
+ return server, server_port
+
+ def get_ud(self):
+ return (self.server_transfer_ul, self.server_transfer_dl)
+
+ def get_users_ud(self):
+ ret = (self.server_user_transfer_ul.copy(), self.server_user_transfer_dl.copy())
+ return ret
+
+ def _update_users(self, protocol_param, acl):
+ if protocol_param is None:
+ protocol_param = self._config['protocol_param']
+ param = common.to_bytes(protocol_param).split(b'#')
+ if len(param) == 2:
+ user_list = param[1].split(b',')
+ if user_list:
+ for user in user_list:
+ items = user.split(b':')
+ if len(items) == 2:
+ user_int_id = int(items[0])
+ uid = struct.pack(' header_length + 13 and data[header_length + 4 : header_length + 12] == b"\x00\x01\x00\x00\x00\x00\x00\x00":
+ is_dns = True
+ else:
+ pass
+ if sa[1] == 53 and is_dns: #DNS
+ logging.debug("DNS query %s from %s:%d" % (common.to_str(sa[0]), r_addr[0], r_addr[1]))
+ self._cache_dns_client[key] = (client, uid)
+ else:
+ self._cache[key] = (client, uid)
+ self._client_fd_to_server_addr[client.fileno()] = (r_addr, af)
+
+ self._sockets.add(client.fileno())
+ self._eventloop.add(client, eventloop.POLL_IN, self)
+
+ logging.debug('UDP port %5d sockets %d' % (self._listen_port, len(self._sockets)))
+
+ if uid is not None:
+ user_id = struct.unpack(' 255:
+ # drop
+ return
+ data = pack_addr(r_addr[0]) + struct.pack('>H', r_addr[1]) + data
+ ref_iv = [encrypt.encrypt_new_iv(self._method)]
+ self._protocol.obfs.server_info.iv = ref_iv[0]
+ data = self._protocol.server_udp_pre_encrypt(data, client_uid)
+ response = encrypt.encrypt_all_iv(self._protocol.obfs.server_info.key, self._method, 1,
+ data, ref_iv)
+ if not response:
+ return
+ else:
+ ref_iv = [0]
+ data = encrypt.encrypt_all_iv(self._protocol.obfs.server_info.key, self._method, 0,
+ data, ref_iv)
+ if not data:
+ return
+ self._protocol.obfs.server_info.recv_iv = ref_iv[0]
+ data = self._protocol.client_udp_post_decrypt(data)
+ header_result = parse_header(data)
+ if header_result is None:
+ return
+ #connecttype, dest_addr, dest_port, header_length = header_result
+ #logging.debug('UDP handle_client %s:%d to %s:%d' % (common.to_str(r_addr[0]), r_addr[1], dest_addr, dest_port))
+
+ response = b'\x00\x00\x00' + data
+
+ if client_addr:
+ if client_uid:
+ self.add_transfer_d(client_uid, len(response))
+ else:
+ self.server_transfer_dl += len(response)
+ self.write_to_server_socket(response, client_addr[0])
+ if client_dns_pair:
+ logging.debug("remove dns client %s:%d" % (client_addr[0][0], client_addr[0][1]))
+ del self._cache_dns_client[key]
+ self._close_client(client_dns_pair[0])
+ else:
+ # this packet is from somewhere else we know
+ # simply drop that packet
+ pass
+
+ def write_to_server_socket(self, data, addr):
+ uncomplete = False
+ retry = 0
+ try:
+ self._server_socket.sendto(data, addr)
+ data = None
+ while self._data_to_write_to_server_socket:
+ data_buf = self._data_to_write_to_server_socket[0]
+ retry = data_buf[1] + 1
+ del self._data_to_write_to_server_socket[0]
+ data, addr = data_buf[0]
+ self._server_socket.sendto(data, addr)
+ except (OSError, IOError) as e:
+ error_no = eventloop.errno_from_exception(e)
+ uncomplete = True
+ if error_no in (errno.EWOULDBLOCK,):
+ pass
+ else:
+ shell.print_exception(e)
+ return False
+ #if uncomplete and data is not None and retry < 3:
+ # self._data_to_write_to_server_socket.append([(data, addr), retry])
+ #'''
+
+ def add_to_loop(self, loop):
+ if self._eventloop:
+ raise Exception('already add to loop')
+ if self._closed:
+ raise Exception('already closed')
+ self._eventloop = loop
+
+ server_socket = self._server_socket
+ self._eventloop.add(server_socket,
+ eventloop.POLL_IN | eventloop.POLL_ERR, self)
+ loop.add_periodic(self.handle_periodic)
+
+ def remove_handler(self, client):
+ if hash(client) in self._timeout_cache:
+ del self._timeout_cache[hash(client)]
+
+ def update_activity(self, client):
+ self._timeout_cache[hash(client)] = client
+
+ def _sweep_timeout(self):
+ self._timeout_cache.sweep()
+
+ def _close_tcp_client(self, client):
+ if client.remote_address:
+ logging.debug('timed out: %s:%d' %
+ client.remote_address)
+ else:
+ logging.debug('timed out')
+ client.destroy()
+ client.destroy_local()
+
+ def handle_event(self, sock, fd, event):
+ if sock == self._server_socket:
+ if event & eventloop.POLL_ERR:
+ logging.error('UDP server_socket err')
+ try:
+ self._handle_server()
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ elif sock and (fd in self._sockets):
+ if event & eventloop.POLL_ERR:
+ logging.error('UDP client_socket err')
+ try:
+ self._handle_client(sock)
+ except Exception as e:
+ shell.print_exception(e)
+ if self._config['verbose']:
+ traceback.print_exc()
+ else:
+ if sock:
+ handler = self._fd_to_handlers.get(fd, None)
+ if handler:
+ handler.handle_event(sock, event)
+ else:
+ logging.warn('poll removed fd')
+
+ def handle_periodic(self):
+ if self._closed:
+ self._cache.clear(0)
+ self._cache_dns_client.clear(0)
+ if self._eventloop:
+ self._eventloop.remove_periodic(self.handle_periodic)
+ self._eventloop.remove(self._server_socket)
+ if self._server_socket:
+ self._server_socket.close()
+ self._server_socket = None
+ logging.info('closed UDP port %d', self._listen_port)
+ else:
+ before_sweep_size = len(self._sockets)
+ self._cache.sweep()
+ self._cache_dns_client.sweep()
+ if before_sweep_size != len(self._sockets):
+ logging.debug('UDP port %5d sockets %d' % (self._listen_port, len(self._sockets)))
+ self._sweep_timeout()
+
+ def close(self, next_tick=False):
+ logging.debug('UDP close')
+ self._closed = True
+ if not next_tick:
+ if self._eventloop:
+ self._eventloop.remove_periodic(self.handle_periodic)
+ self._eventloop.remove(self._server_socket)
+ self._server_socket.close()
+ self._cache.clear(0)
+ self._cache_dns_client.clear(0)
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/version.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/version.py
new file mode 100644
index 000000000..f3e1ef796
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/shadowsocks/version.py
@@ -0,0 +1,20 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2017 breakwa11
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+def version():
+ return '3.4.0 2017-07-27'
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/stop.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/stop.sh
new file mode 100755
index 000000000..56567daa0
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/stop.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+python_ver=$(ls /usr/bin|grep -e "^python[23]\.[1-9]\+$"|tail -1)
+eval $(ps -ef | grep "[0-9] ${python_ver} server\\.py m" | awk '{print "kill "$2}')
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/switchrule.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/switchrule.py
new file mode 100644
index 000000000..6687e12cf
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/switchrule.py
@@ -0,0 +1,8 @@
+def getKeys(key_list):
+ return key_list
+ #return key_list + ['plan'] # append the column name 'plan'
+
+def isTurnOn(row):
+ return True
+ #return row['plan'] == 'B' # then judge here
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tail.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tail.sh
new file mode 100755
index 000000000..f36f605ee
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+cd `dirname $0`
+tail -f ssserver.log
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb1.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb1.json
new file mode 100644
index 000000000..40d0b2107
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb1.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb1",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb8.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb8.json
new file mode 100644
index 000000000..fb7014b1e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-cfb8.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb8",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-ctr.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-ctr.json
new file mode 100644
index 000000000..1fed8a8c7
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes-ctr.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-ctr",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes.json
new file mode 100644
index 000000000..a3d95b9b5
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/aes.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/assert.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/assert.sh
new file mode 100755
index 000000000..b0c679cbc
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/assert.sh
@@ -0,0 +1,148 @@
+#!/bin/bash
+# assert.sh 1.0 - bash unit testing framework
+# Copyright (C) 2009, 2010, 2011, 2012 Robert Lehmann
+#
+# http://github.com/lehmannro/assert.sh
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published
+# by the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see [stdin]
+ (( tests_ran++ )) || :
+ [[ -n "$DISCOVERONLY" ]] && return || true
+ # printf required for formatting
+ printf -v expected "x${2:-}" # x required to overwrite older results
+ result="$(eval 2>/dev/null $1 <<< ${3:-})" || true
+ # Note: $expected is already decorated
+ if [[ "x$result" == "$expected" ]]; then
+ [[ -n "$DEBUG" ]] && echo -n . || true
+ return
+ fi
+ result="$(sed -e :a -e '$!N;s/\n/\\n/;ta' <<< "$result")"
+ [[ -z "$result" ]] && result="nothing" || result="\"$result\""
+ [[ -z "$2" ]] && expected="nothing" || expected="\"$2\""
+ _assert_fail "expected $expected${_indent}got $result" "$1" "$3"
+}
+
+assert_raises() {
+ # assert_raises [stdin]
+ (( tests_ran++ )) || :
+ [[ -n "$DISCOVERONLY" ]] && return || true
+ status=0
+ (eval $1 <<< ${3:-}) > /dev/null 2>&1 || status=$?
+ expected=${2:-0}
+ if [[ "$status" -eq "$expected" ]]; then
+ [[ -n "$DEBUG" ]] && echo -n . || true
+ return
+ fi
+ _assert_fail "program terminated with code $status instead of $expected" "$1" "$3"
+}
+
+_assert_fail() {
+ # _assert_fail
+ [[ -n "$DEBUG" ]] && echo -n X
+ report="test #$tests_ran \"$2${3:+ <<< $3}\" failed:${_indent}$1"
+ if [[ -n "$STOP" ]]; then
+ [[ -n "$DEBUG" ]] && echo
+ echo "$report"
+ exit 1
+ fi
+ tests_errors[$tests_failed]="$report"
+ (( tests_failed++ )) || :
+}
+
+_assert_reset
+: ${tests_suite_status:=0} # remember if any of the tests failed so far
+_assert_cleanup() {
+ local status=$?
+ # modify exit code if it's not already non-zero
+ [[ $status -eq 0 && -z $CONTINUE ]] && exit $tests_suite_status
+}
+trap _assert_cleanup EXIT
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/chacha20.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/chacha20.json
new file mode 100644
index 000000000..541a9beb5
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/chacha20.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"salsa20_password",
+ "timeout":60,
+ "method":"chacha20",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/client-multi-server-ip.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/client-multi-server-ip.json
new file mode 100644
index 000000000..1823c2a75
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/client-multi-server-ip.json
@@ -0,0 +1,10 @@
+{
+ "server":["127.0.0.1", "127.0.0.1"],
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/coverage_server.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/coverage_server.py
new file mode 100644
index 000000000..23cc8cd71
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/coverage_server.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+if __name__ == '__main__':
+ import tornado.ioloop
+ import tornado.web
+ import urllib
+
+ class MainHandler(tornado.web.RequestHandler):
+ def get(self, project):
+ try:
+ with open('/tmp/%s-coverage' % project, 'rb') as f:
+ coverage = f.read().strip()
+ n = int(coverage.strip('%'))
+ if n >= 80:
+ color = 'brightgreen'
+ else:
+ color = 'yellow'
+ self.redirect(('https://img.shields.io/badge/'
+ 'coverage-%s-%s.svg'
+ '?style=flat') %
+ (urllib.quote(coverage), color))
+ except IOError:
+ raise tornado.web.HTTPError(404)
+
+ application = tornado.web.Application([
+ (r"/([a-zA-Z0-9\-_]+)", MainHandler),
+ ])
+
+ if __name__ == "__main__":
+ application.listen(8888, address='127.0.0.1')
+ tornado.ioloop.IOLoop.instance().start()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/fastopen.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/fastopen.json
new file mode 100644
index 000000000..f3980b65e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/fastopen.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"fastopen_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "fast_open":true
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6-client-side.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6-client-side.json
new file mode 100644
index 000000000..6c3cfaf8d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6-client-side.json
@@ -0,0 +1,10 @@
+{
+ "server":"::1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6.json
new file mode 100644
index 000000000..d855f9c47
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/ipv6.json
@@ -0,0 +1,10 @@
+{
+ "server":"::",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/jenkins.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/jenkins.sh
new file mode 100755
index 000000000..ea5c1630b
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/jenkins.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+result=0
+
+function run_test {
+ printf '\e[0;36m'
+ echo "running test: $command $@"
+ printf '\e[0m'
+
+ $command "$@"
+ status=$?
+ if [ $status -ne 0 ]; then
+ printf '\e[0;31m'
+ echo "test failed: $command $@"
+ printf '\e[0m'
+ echo
+ result=1
+ else
+ printf '\e[0;32m'
+ echo OK
+ printf '\e[0m'
+ echo
+ fi
+ return 0
+}
+
+python --version
+coverage erase
+mkdir tmp
+run_test pep8 --ignore=E402 .
+run_test pyflakes .
+run_test coverage run tests/nose_plugin.py -v
+run_test python setup.py sdist
+run_test tests/test_daemon.sh
+run_test python tests/test.py --with-coverage -c tests/aes.json
+run_test python tests/test.py --with-coverage -c tests/aes-ctr.json
+run_test python tests/test.py --with-coverage -c tests/aes-cfb1.json
+run_test python tests/test.py --with-coverage -c tests/aes-cfb8.json
+run_test python tests/test.py --with-coverage -c tests/rc4-md5.json
+run_test python tests/test.py --with-coverage -c tests/salsa20.json
+run_test python tests/test.py --with-coverage -c tests/chacha20.json
+run_test python tests/test.py --with-coverage -c tests/table.json
+run_test python tests/test.py --with-coverage -c tests/server-multi-ports.json
+run_test python tests/test.py --with-coverage -s tests/aes.json -c tests/client-multi-server-ip.json
+run_test python tests/test.py --with-coverage -s tests/server-multi-passwd.json -c tests/server-multi-passwd-client-side.json
+run_test python tests/test.py --with-coverage -c tests/workers.json
+run_test python tests/test.py --with-coverage -s tests/ipv6.json -c tests/ipv6-client-side.json
+run_test python tests/test.py --with-coverage -b "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -q" -a "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -vv"
+run_test python tests/test.py --with-coverage -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 --workers 1" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -t 30 -qq -b 127.0.0.1"
+run_test python tests/test.py --with-coverage --should-fail --url="http://127.0.0.1/" -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 --forbidden-ip=127.0.0.1,::1,8.8.8.8" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -t 30 -b 127.0.0.1"
+
+# test if DNS works
+run_test python tests/test.py --with-coverage -c tests/aes.json --url="https://clients1.google.com/generate_204"
+
+# test localhost is in the forbidden list by default
+run_test python tests/test.py --with-coverage --should-fail --tcp-only --url="http://127.0.0.1/" -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -t 30 -b 127.0.0.1"
+
+# test localhost is available when forbidden list is empty
+run_test python tests/test.py --with-coverage --tcp-only --url="http://127.0.0.1/" -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 --forbidden-ip=" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -t 30 -b 127.0.0.1"
+
+if [ -f /proc/sys/net/ipv4/tcp_fastopen ] ; then
+ if [ 3 -eq `cat /proc/sys/net/ipv4/tcp_fastopen` ] ; then
+ # we have to run it twice:
+ # the first time there's no syn cookie
+ # the second time there is syn cookie
+ run_test python tests/test.py --with-coverage -c tests/fastopen.json
+ run_test python tests/test.py --with-coverage -c tests/fastopen.json
+ fi
+fi
+
+run_test tests/test_large_file.sh
+run_test tests/test_udp_src.sh
+run_test tests/test_command.sh
+
+coverage combine && coverage report --include=shadowsocks/*
+rm -rf htmlcov
+rm -rf tmp
+coverage html --include=shadowsocks/*
+
+coverage report --include=shadowsocks/* | tail -n1 | rev | cut -d' ' -f 1 | rev > /tmp/shadowsocks-coverage
+
+exit $result
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/libsodium/install.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/libsodium/install.sh
new file mode 100755
index 000000000..b0e35fa13
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/libsodium/install.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ ! -d libsodium-1.0.1 ]; then
+ wget https://github.com/jedisct1/libsodium/releases/download/1.0.1/libsodium-1.0.1.tar.gz || exit 1
+ tar xf libsodium-1.0.1.tar.gz || exit 1
+fi
+pushd libsodium-1.0.1
+./configure && make -j2 && make install || exit 1
+sudo ldconfig
+popd
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/nose_plugin.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/nose_plugin.py
new file mode 100644
index 000000000..86b1a8653
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/nose_plugin.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import nose
+from nose.plugins.base import Plugin
+
+
+class ExtensionPlugin(Plugin):
+
+ name = "ExtensionPlugin"
+
+ def options(self, parser, env):
+ Plugin.options(self, parser, env)
+
+ def configure(self, options, config):
+ Plugin.configure(self, options, config)
+ self.enabled = True
+
+ def wantFile(self, file):
+ return file.endswith('.py')
+
+ def wantDirectory(self, directory):
+ return True
+
+ def wantModule(self, file):
+ return True
+
+
+if __name__ == '__main__':
+ nose.main(addplugins=[ExtensionPlugin()])
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/rc4-md5.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/rc4-md5.json
new file mode 100644
index 000000000..26ba0dfa7
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/rc4-md5.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"aes_password",
+ "timeout":60,
+ "method":"rc4-md5",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20-ctr.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20-ctr.json
new file mode 100644
index 000000000..5ca6c45f5
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20-ctr.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"salsa20_password",
+ "timeout":60,
+ "method":"salsa20-ctr",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20.json
new file mode 100644
index 000000000..7e303800d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/salsa20.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"salsa20_password",
+ "timeout":60,
+ "method":"salsa20",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-client-side.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-client-side.json
new file mode 100644
index 000000000..c822c98b9
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-client-side.json
@@ -0,0 +1,8 @@
+{
+ "server": "127.0.0.1",
+ "server_port": "8385",
+ "local_port": 1081,
+ "password": "foobar5",
+ "timeout": 60,
+ "method": "aes-256-cfb"
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-table.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-table.json
new file mode 100644
index 000000000..a2c0a8089
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd-table.json
@@ -0,0 +1,19 @@
+{
+ "server": "127.0.0.1",
+ "server_port": 8384,
+ "local_port": 1081,
+ "password": "foobar4",
+ "port_password": {
+ "8381": "foobar1",
+ "8382": "foobar2",
+ "8383": "foobar3",
+ "8384": "foobar4",
+ "8385": "foobar5",
+ "8386": "foobar6",
+ "8387": "foobar7",
+ "8388": "foobar8",
+ "8389": "foobar9"
+ },
+ "timeout": 60,
+ "method": "table"
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd.json
new file mode 100644
index 000000000..b1407f0a1
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-passwd.json
@@ -0,0 +1,17 @@
+{
+ "server": "127.0.0.1",
+ "local_port": 1081,
+ "port_password": {
+ "8381": "foobar1",
+ "8382": "foobar2",
+ "8383": "foobar3",
+ "8384": "foobar4",
+ "8385": "foobar5",
+ "8386": "foobar6",
+ "8387": "foobar7",
+ "8388": "foobar8",
+ "8389": "foobar9"
+ },
+ "timeout": 60,
+ "method": "aes-256-cfb"
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-ports.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-ports.json
new file mode 100644
index 000000000..5bdbcab64
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/server-multi-ports.json
@@ -0,0 +1,8 @@
+{
+ "server": "127.0.0.1",
+ "server_port": [8384, 8345, 8346, 8347],
+ "local_port": 1081,
+ "password": "foobar4",
+ "timeout": 60,
+ "method": "aes-256-cfb"
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/setup_tc.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/setup_tc.sh
new file mode 100755
index 000000000..1a5fa208b
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/setup_tc.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+DEV=lo
+PORT=8388
+DELAY=100ms
+
+type tc 2> /dev/null && (
+ tc qdisc add dev $DEV root handle 1: htb
+ tc class add dev $DEV parent 1: classid 1:1 htb rate 2mbps
+ tc class add dev $DEV parent 1:1 classid 1:6 htb rate 2mbps ceil 1mbps prio 0
+ tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 6 fw flowid 1:6
+
+ tc filter add dev $DEV parent 1:0 protocol ip u32 match ip dport $PORT 0xffff flowid 1:6
+ tc filter add dev $DEV parent 1:0 protocol ip u32 match ip sport $PORT 0xffff flowid 1:6
+
+ tc qdisc show dev lo
+)
+
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/install.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/install.sh
new file mode 100755
index 000000000..8eff72df0
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/install.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ ! -d dante-1.4.0 ]; then
+ wget http://www.inet.no/dante/files/dante-1.4.0.tar.gz || exit 1
+ tar xf dante-1.4.0.tar.gz || exit 1
+fi
+pushd dante-1.4.0
+./configure && make -j4 && make install || exit 1
+popd
+cp tests/socksify/socks.conf /etc/ || exit 1
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/socks.conf b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/socks.conf
new file mode 100644
index 000000000..13db772fd
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/socksify/socks.conf
@@ -0,0 +1,5 @@
+route {
+ from: 0.0.0.0/0 to: 0.0.0.0/0 via: 127.0.0.1 port = 1081
+ proxyprotocol: socks_v5
+ method: none
+}
\ No newline at end of file
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/table.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/table.json
new file mode 100644
index 000000000..cca6ac27e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/table.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"table_password",
+ "timeout":60,
+ "method":"table",
+ "local_address":"127.0.0.1",
+ "fast_open":false
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test.py
new file mode 100755
index 000000000..408340134
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test.py
@@ -0,0 +1,158 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2015 clowwindy
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import sys
+import os
+import signal
+import select
+import time
+import argparse
+from subprocess import Popen, PIPE
+
+python = ['python']
+
+default_url = 'http://localhost/'
+
+parser = argparse.ArgumentParser(description='test Shadowsocks')
+parser.add_argument('-c', '--client-conf', type=str, default=None)
+parser.add_argument('-s', '--server-conf', type=str, default=None)
+parser.add_argument('-a', '--client-args', type=str, default=None)
+parser.add_argument('-b', '--server-args', type=str, default=None)
+parser.add_argument('--with-coverage', action='store_true', default=None)
+parser.add_argument('--should-fail', action='store_true', default=None)
+parser.add_argument('--tcp-only', action='store_true', default=None)
+parser.add_argument('--url', type=str, default=default_url)
+parser.add_argument('--dns', type=str, default='8.8.8.8')
+
+config = parser.parse_args()
+
+if config.with_coverage:
+ python = ['coverage', 'run', '-p']
+
+client_args = python + ['shadowsocks/local.py', '-v']
+server_args = python + ['shadowsocks/server.py', '-v']
+
+if config.client_conf:
+ client_args.extend(['-c', config.client_conf])
+ if config.server_conf:
+ server_args.extend(['-c', config.server_conf])
+ else:
+ server_args.extend(['-c', config.client_conf])
+if config.client_args:
+ client_args.extend(config.client_args.split())
+ if config.server_args:
+ server_args.extend(config.server_args.split())
+ else:
+ server_args.extend(config.client_args.split())
+if config.url == default_url:
+ server_args.extend(['--forbidden-ip', ''])
+
+p1 = Popen(server_args, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
+p2 = Popen(client_args, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
+p3 = None
+p4 = None
+p3_fin = False
+p4_fin = False
+
+# 1 shadowsocks started
+# 2 curl started
+# 3 curl finished
+# 4 dig started
+# 5 dig finished
+stage = 1
+
+try:
+ local_ready = False
+ server_ready = False
+ fdset = [p1.stdout, p2.stdout, p1.stderr, p2.stderr]
+ while True:
+ r, w, e = select.select(fdset, [], fdset)
+ if e:
+ break
+
+ for fd in r:
+ line = fd.readline()
+ if not line:
+ if stage == 2 and fd == p3.stdout:
+ stage = 3
+ if stage == 4 and fd == p4.stdout:
+ stage = 5
+ if bytes != str:
+ line = str(line, 'utf8')
+ sys.stderr.write(line)
+ if line.find('starting local') >= 0:
+ local_ready = True
+ if line.find('starting server') >= 0:
+ server_ready = True
+
+ if stage == 1:
+ time.sleep(2)
+
+ p3 = Popen(['curl', config.url, '-v', '-L',
+ '--socks5-hostname', '127.0.0.1:1081',
+ '-m', '15', '--connect-timeout', '10'],
+ stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
+ if p3 is not None:
+ fdset.append(p3.stdout)
+ fdset.append(p3.stderr)
+ stage = 2
+ else:
+ sys.exit(1)
+
+ if stage == 3 and p3 is not None:
+ fdset.remove(p3.stdout)
+ fdset.remove(p3.stderr)
+ r = p3.wait()
+ if config.should_fail:
+ if r == 0:
+ sys.exit(1)
+ else:
+ if r != 0:
+ sys.exit(1)
+ if config.tcp_only:
+ break
+ p4 = Popen(['socksify', 'dig', '@%s' % config.dns,
+ 'www.google.com'],
+ stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
+ if p4 is not None:
+ fdset.append(p4.stdout)
+ fdset.append(p4.stderr)
+ stage = 4
+ else:
+ sys.exit(1)
+
+ if stage == 5:
+ r = p4.wait()
+ if config.should_fail:
+ if r == 0:
+ sys.exit(1)
+ print('test passed (expecting failure)')
+ else:
+ if r != 0:
+ sys.exit(1)
+ print('test passed')
+ break
+finally:
+ for p in [p1, p2]:
+ try:
+ os.kill(p.pid, signal.SIGINT)
+ os.waitpid(p.pid, 0)
+ except OSError:
+ pass
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_command.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_command.sh
new file mode 100755
index 000000000..a1a777b0d
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_command.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+. tests/assert.sh
+
+PYTHON="coverage run -p"
+LOCAL="$PYTHON shadowsocks/local.py"
+SERVER="$PYTHON shadowsocks/server.py"
+
+assert "$LOCAL --version 2>&1 | grep Shadowsocks | awk -F\" \" '{print \$1}'" "Shadowsocks"
+assert "$SERVER --version 2>&1 | grep Shadowsocks | awk -F\" \" '{print \$1}'" "Shadowsocks"
+
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d start | grep WARNING | awk -F\"WARNING\" '{print \$2}'" " warning: server set to listen on 127.0.0.1:8388, are you sure?"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 0.0.0.0 -p 8388 -t10 -d start | grep WARNING | awk -F\"WARNING\" '{print \$2}'" " warning: your timeout 10 seems too short"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 0.0.0.0 -p 8388 -t1000 -d start | grep WARNING | awk -F\"WARNING\" '{print \$2}'" " warning: your timeout 1000 seems too long"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4 -k testrc4 -s 0.0.0.0 -p 8388 -d start | grep WARNING | awk -F\"WARNING\" '{print \$2}'" " warning: RC4 is not safe; please use a safer cipher, like AES-256-CFB"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k mypassword -s 0.0.0.0 -p 8388 -d start | grep ERROR | awk -F\"ERROR\" '{print \$2}'" " DON'T USE DEFAULT PASSWORD! Please change it in your config.json!"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+
+assert "$SERVER 2>&1 --forbidden-ip 127.0.0.1/4a -m rc4-md5 -k 12345 -p 8388 -s 0.0.0.0 -d start | grep ERROR | awk -F\"ERROR\" '{print \$2}'" ": Not a valid CIDR notation: 127.0.0.1/4a"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert_end command
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_daemon.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_daemon.sh
new file mode 100755
index 000000000..7a192bdb1
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_daemon.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+function run_test {
+ expected=$1
+ shift
+ echo "running test: $command $@"
+ $command $@
+ status=$?
+ if [ $status -ne $expected ]; then
+ echo "exit $status != $expected"
+ exit 1
+ fi
+ echo "exit status $status == $expected"
+ echo OK
+ return
+}
+
+for module in local server
+do
+
+command="coverage run -p shadowsocks/$module.py"
+
+mkdir -p tmp
+
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 1 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d restart --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 0 -c tests/aes.json -d restart --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 1 -c tests/aes.json -d start --pid-file tmp/not_exist/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+done
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_large_file.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_large_file.sh
new file mode 100755
index 000000000..7a61caff1
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_large_file.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+PYTHON="coverage run -p"
+URL=http://127.0.0.1/file
+
+mkdir -p tmp
+
+$PYTHON shadowsocks/local.py -c tests/aes.json &
+LOCAL=$!
+
+$PYTHON shadowsocks/server.py -c tests/aes.json --forbidden-ip "" &
+SERVER=$!
+
+sleep 3
+
+time curl -o tmp/expected $URL
+time curl -o tmp/result --socks5-hostname 127.0.0.1:1081 $URL
+
+kill -s SIGINT $LOCAL
+kill -s SIGINT $SERVER
+
+sleep 2
+
+diff tmp/expected tmp/result || exit 1
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.py
new file mode 100644
index 000000000..e8fa5057e
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.py
@@ -0,0 +1,83 @@
+#!/usr/bin/python
+
+import socket
+import socks
+
+
+SERVER_IP = '127.0.0.1'
+SERVER_PORT = 1081
+
+
+if __name__ == '__main__':
+ # Test 1: same source port IPv4
+ sock_out = socks.socksocket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_out.set_proxy(socks.SOCKS5, SERVER_IP, SERVER_PORT)
+ sock_out.bind(('127.0.0.1', 9000))
+
+ sock_in1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_in2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+
+ sock_in1.bind(('127.0.0.1', 9001))
+ sock_in2.bind(('127.0.0.1', 9002))
+
+ sock_out.sendto(b'data', ('127.0.0.1', 9001))
+ result1 = sock_in1.recvfrom(8)
+
+ sock_out.sendto(b'data', ('127.0.0.1', 9002))
+ result2 = sock_in2.recvfrom(8)
+
+ sock_out.close()
+ sock_in1.close()
+ sock_in2.close()
+
+ # make sure they're from the same source port
+ assert result1 == result2
+
+ # Test 2: same source port IPv6
+ # try again from the same port but IPv6
+ sock_out = socks.socksocket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_out.set_proxy(socks.SOCKS5, SERVER_IP, SERVER_PORT)
+ sock_out.bind(('127.0.0.1', 9000))
+
+ sock_in1 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_in2 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+
+ sock_in1.bind(('::1', 9001))
+ sock_in2.bind(('::1', 9002))
+
+ sock_out.sendto(b'data', ('::1', 9001))
+ result1 = sock_in1.recvfrom(8)
+
+ sock_out.sendto(b'data', ('::1', 9002))
+ result2 = sock_in2.recvfrom(8)
+
+ sock_out.close()
+ sock_in1.close()
+ sock_in2.close()
+
+ # make sure they're from the same source port
+ assert result1 == result2
+
+ # Test 3: different source ports IPv6
+ sock_out = socks.socksocket(socket.AF_INET, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_out.set_proxy(socks.SOCKS5, SERVER_IP, SERVER_PORT)
+ sock_out.bind(('127.0.0.1', 9003))
+
+ sock_in1 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM,
+ socket.SOL_UDP)
+ sock_in1.bind(('::1', 9001))
+ sock_out.sendto(b'data', ('::1', 9001))
+ result3 = sock_in1.recvfrom(8)
+
+ # make sure they're from different source ports
+ assert result1 != result3
+
+ sock_out.close()
+ sock_in1.close()
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.sh b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.sh
new file mode 100755
index 000000000..6a778abc1
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/test_udp_src.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+PYTHON="coverage run -p"
+
+mkdir -p tmp
+
+$PYTHON shadowsocks/local.py -c tests/aes.json -v &
+LOCAL=$!
+
+$PYTHON shadowsocks/server.py -c tests/aes.json --forbidden-ip "" -v &
+SERVER=$!
+
+sleep 3
+
+python tests/test_udp_src.py
+r=$?
+
+kill -s SIGINT $LOCAL
+kill -s SIGINT $SERVER
+
+sleep 2
+
+exit $r
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/workers.json b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/workers.json
new file mode 100644
index 000000000..2015ff6c6
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/tests/workers.json
@@ -0,0 +1,10 @@
+{
+ "server":"127.0.0.1",
+ "server_port":8388,
+ "local_port":1081,
+ "password":"workers_password",
+ "timeout":60,
+ "method":"aes-256-cfb",
+ "local_address":"127.0.0.1",
+ "workers": 4
+}
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/README.md b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/README.md
new file mode 100644
index 000000000..f624309c7
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/README.md
@@ -0,0 +1,9 @@
+Useful Tools
+===========
+
+autoban.py
+----------
+
+Automatically ban IPs that try to brute force crack the server.
+
+See https://github.com/shadowsocks/shadowsocks/wiki/Ban-Brute-Force-Crackers
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py
new file mode 100755
index 000000000..1bbb65c9b
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py
@@ -0,0 +1,53 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2015 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from __future__ import absolute_import, division, print_function, \
+ with_statement
+
+import os
+import sys
+import argparse
+
+if __name__ == '__main__':
+ parser = argparse.ArgumentParser(description='See README')
+ parser.add_argument('-c', '--count', default=3, type=int,
+ help='with how many failure times it should be '
+ 'considered as an attack')
+ config = parser.parse_args()
+ ips = {}
+ banned = set()
+ for line in sys.stdin:
+ if 'can not parse header when' in line:
+ ip = line.split()[-1].split(':')[0]
+ if ip not in ips:
+ ips[ip] = 1
+ print(ip)
+ sys.stdout.flush()
+ else:
+ ips[ip] += 1
+ if ip not in banned and ips[ip] >= config.count:
+ banned.add(ip)
+ cmd = 'iptables -A INPUT -s %s -j DROP' % ip
+ print(cmd, file=sys.stderr)
+ sys.stderr.flush()
+ os.system(cmd)
diff --git a/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/fail2ban/shadowsocks.conf b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/fail2ban/shadowsocks.conf
new file mode 100644
index 000000000..9b1c7ec7a
--- /dev/null
+++ b/package/lean/luci-app-ssrserver-python/root/usr/share/ssr/utils/fail2ban/shadowsocks.conf
@@ -0,0 +1,5 @@
+[Definition]
+
+_daemon = shadowsocks
+
+failregex = ^\s+ERROR\s+can not parse header when handling connection from :\d+$
diff --git a/package/lean/luci-app-usb-printer/Makefile b/package/lean/luci-app-usb-printer/Makefile
new file mode 100644
index 000000000..fe3e8849b
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/Makefile
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2008-2014 The LuCI Team
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=USB Printer Share via TCP/IP
+LUCI_DEPENDS:=+p910nd +kmod-usb-printer
+PKG_VERSION:=1.0
+PKG_RELEASE:=1
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+#applications/luci-app-usb-printer/
+#applications/luci-app-usb-printer/
diff --git a/package/lean/luci-app-usb-printer/ipkg/postinst b/package/lean/luci-app-usb-printer/ipkg/postinst
new file mode 100755
index 000000000..97a343c7b
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/ipkg/postinst
@@ -0,0 +1,6 @@
+#!/bin/sh
+[ -n "${IPKG_INSTROOT}" ] || {
+ ( . /etc/uci-defaults/luci-usb-printer ) && rm -f /etc/uci-defaults/luci-usb-printer
+ exit 0
+}
+
diff --git a/package/lean/luci-app-usb-printer/luasrc/controller/usb_printer.lua b/package/lean/luci-app-usb-printer/luasrc/controller/usb_printer.lua
new file mode 100644
index 000000000..ebcee4f79
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/luasrc/controller/usb_printer.lua
@@ -0,0 +1,29 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+require("luci.sys")
+
+module("luci.controller.usb_printer", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/usb_printer") then
+ return
+ end
+
+ entry({"admin", "nas"}, firstchild(), "NAS", 44).dependent = false
+
+ local page
+
+ page = entry({"admin", "nas", "usb_printer"}, cbi("usb_printer"), _("USB Printer Server"), 50)
+end
diff --git a/package/lean/luci-app-usb-printer/luasrc/model/cbi/usb_printer.lua b/package/lean/luci-app-usb-printer/luasrc/model/cbi/usb_printer.lua
new file mode 100644
index 000000000..3cc7526ef
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/luasrc/model/cbi/usb_printer.lua
@@ -0,0 +1,130 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth
+Copyright 2005-2013 hackpascal
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+require "luci.util"
+local uci = luci.model.uci.cursor_state()
+local net = require "luci.model.network"
+
+m = Map("usb_printer", translate("USB Printer Server"),
+ translate("Shares multiple USB printers via TCP/IP.\n"
+"Language-Team: \n"
+"Language: zh_CN\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: Pootle 2.0.6\n"
+
+msgid "Bidirectional mode"
+msgstr "鍙屽悜妯″紡"
+
+msgid "Bindings"
+msgstr "缁戝畾"
+
+msgid "Device"
+msgstr "璁惧"
+
+msgid "Device Name"
+msgstr "璁惧鍚"
+
+msgid "Detected printers"
+msgstr "妫娴嬪埌鐨勬墦鍗版満"
+
+msgid ""
+"Shares multiple USB printers via TCP/IP.
+
+if [ x"$INTERFACE" = x"7/1/1" ] || [ x"$INTERFACE" = x"7/1/2" ]; then
+ /usr/bin/usb_printer_hotplug "$PRODUCT" "$ACTION"
+fi
diff --git a/package/lean/luci-app-usb-printer/root/etc/init.d/usb_printer b/package/lean/luci-app-usb-printer/root/etc/init.d/usb_printer
new file mode 100755
index 000000000..4da5e3445
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/root/etc/init.d/usb_printer
@@ -0,0 +1,22 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2005-2013 NowRush Studio
+# Author: hackpascal
+
+START=70
+
+stop() {
+ killall p910nd 2>/dev/null
+}
+
+start() {
+ for lps in `/usr/bin/detectlp`; do
+ product=`echo $lps | cut -d , -f 2`
+
+ /usr/bin/usb_printer_hotplug "$product" add
+ done
+}
+
+restart() {
+ stop
+ start
+}
diff --git a/package/lean/luci-app-usb-printer/root/etc/uci-defaults/luci-usb-printer b/package/lean/luci-app-usb-printer/root/etc/uci-defaults/luci-usb-printer
new file mode 100755
index 000000000..38c214f9c
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/root/etc/uci-defaults/luci-usb-printer
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete ucitrack.@usb_printer[-1]
+ add ucitrack usb_printer
+ set ucitrack.@usb_printer[-1].init=usb_printer
+ commit ucitrack
+EOF
+
+[ -f /etc/init.d/p910nd ] && /etc/init.d/p910nd disable
+
+exit 0
diff --git a/package/lean/luci-app-usb-printer/root/usr/bin/detectlp b/package/lean/luci-app-usb-printer/root/usr/bin/detectlp
new file mode 100755
index 000000000..b69385bb9
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/root/usr/bin/detectlp
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+lp_path=/sys/class/usbmisc
+
+if ! [ -d "$lp_path" ]; then
+ exit
+fi
+
+cd $lp_path
+
+for lps in `ls`; do
+ desc_file=$lp_path/$lps/device/ieee1284_id
+ uevent_file=$lp_path/$lps/device/uevent
+
+ name=`cat $desc_file | sed 's/.*DES:\(.*\);.*/\1/' | cut -d ';' -f 1`
+ model=`cat $desc_file | sed 's/.*MDL:\(.*\);.*/\1/' | cut -d ';' -f 1`
+ product=`cat $uevent_file | grep PRODUCT= | sed 's/PRODUCT=\(.*\)/\1/'`
+
+ echo $lps,$product,$model,$name;
+done
diff --git a/package/lean/luci-app-usb-printer/root/usr/bin/usb_printer_hotplug b/package/lean/luci-app-usb-printer/root/usr/bin/usb_printer_hotplug
new file mode 100755
index 000000000..e0a60b003
--- /dev/null
+++ b/package/lean/luci-app-usb-printer/root/usr/bin/usb_printer_hotplug
@@ -0,0 +1,72 @@
+#!/bin/sh
+# Copyright (C) 2005-2014 NowRush Studio
+# Author: hackpascal
+
+. $IPKG_INSTROOT/lib/functions.sh
+
+PRODUCT=$1
+ACTION=$2
+
+DEVICES=
+
+check_printer() {
+ local cfg=$1
+ local enabled
+ local device_id
+ local bind_ip
+ local port
+ local bidirect
+ local device_file
+ local args=""
+ local pid_file
+
+ config_get_bool enabled "$cfg" enabled 0
+ [ "$enabled" -eq 0 ] && return 0
+
+ config_get device_id "$cfg" device ""
+ config_get bind_ip "$cfg" bind "0.0.0.0"
+ config_get port "$cfg" port ""
+ config_get_bool bidirect "$cfg" bidirectional "0"
+
+ if [ -z "$device_id" ] || [ -z "$port" ]; then
+ return
+ fi
+
+ if [ x"$PRODUCT" != x"$device_id" ]; then
+ return
+ fi
+
+ device_file=`echo $DEVICES | grep $device_id | cut -d , -f 1`
+
+ if [ "$ACTION" = "add" ] && [ -z "$device_file" ]; then
+ return
+ fi
+
+ pid_file=/var/run/p910${port}d.pid
+ [ -f $pid_file ] && kill `cat $pid_file` 2>/dev/null
+
+ if [ "$ACTION" = "add" ]; then
+ if [ "$bidirect" != 0 ]; then
+ args='-b'
+ fi
+
+ logger "usb_printer: start p910nd on $bind_ip:$port for /dev/usb/$device_file"
+ /usr/sbin/p910nd $args -f /dev/usb/$device_file -i $bind_ip $port
+ fi
+}
+
+if [ -z "$PRODUCT" ] || [ -z "$ACTION" ]; then
+ echo "Arguements required"
+ exit 1
+fi
+
+if [ "$ACTION" != "add" ] && [ "$ACTION" != "remove" ]; then
+ echo "Invalid action arguement"
+ exit 1
+fi
+
+DEVICES=`/usr/bin/detectlp`
+
+config_load usb_printer
+
+config_foreach check_printer printer
diff --git a/package/lean/luci-app-vlmcsd b/package/lean/luci-app-vlmcsd
new file mode 160000
index 000000000..192bd9a48
--- /dev/null
+++ b/package/lean/luci-app-vlmcsd
@@ -0,0 +1 @@
+Subproject commit 192bd9a482dd15656613a56f64f5e8b49bf1bfb8
diff --git a/package/lean/luci-app-vsftpd/Makefile b/package/lean/luci-app-vsftpd/Makefile
new file mode 100644
index 000000000..97d181f01
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/Makefile
@@ -0,0 +1,17 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for VSFTPD
+LUCI_DEPENDS:=+vsftpd-alt
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.0
+PKG_RELEASE:=2
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
diff --git a/package/lean/luci-app-vsftpd/luasrc/controller/vsftpd.lua b/package/lean/luci-app-vsftpd/luasrc/controller/vsftpd.lua
new file mode 100644
index 000000000..de44711dc
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/controller/vsftpd.lua
@@ -0,0 +1,47 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+require("luci.sys")
+
+module("luci.controller.vsftpd", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/vsftpd") then
+ return
+ end
+
+ entry({"admin", "nas"}, firstchild(), "NAS", 44).dependent = false
+ entry({"admin", "nas", "vsftpd"},
+ alias("admin", "nas", "vsftpd", "general"),
+ _("FTP Server"))
+
+ entry({"admin", "nas", "vsftpd", "general"},
+ cbi("vsftpd/general"),
+ _("General Settings"), 10).leaf = true
+
+ entry({"admin", "nas", "vsftpd", "users"},
+ cbi("vsftpd/users"),
+ _("Virtual Users"), 20).leaf = true
+
+ entry({"admin", "nas", "vsftpd", "anonymous"},
+ cbi("vsftpd/anonymous"),
+ _("Anonymous User"), 30).leaf = true
+
+ entry({"admin", "nas", "vsftpd", "log"},
+ cbi("vsftpd/log"),
+ _("Log Settings"), 40).leaf = true
+
+ entry({"admin", "nas", "vsftpd", "item"},
+ cbi("vsftpd/item"), nil).leaf = true
+end
diff --git a/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/anonymous.lua b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/anonymous.lua
new file mode 100644
index 000000000..3ebbb4ba9
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/anonymous.lua
@@ -0,0 +1,44 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+m = Map("vsftpd", translate("FTP Server - Anonymous Settings"))
+
+sa = m:section(NamedSection, "anonymous", "anonymous", translate("Anonymous Settings"))
+
+o = sa:option(Flag, "enabled", translate("Enabled"))
+o.default = false
+
+o = sa:option(Value, "username", translate("Username"), translate("An actual local user to handle anonymous user"))
+o.default = "ftp"
+
+o = sa:option(Value, "root", translate("Root directory"))
+o.default = "/home/ftp"
+
+o = sa:option(Value, "umask", translate("File mode umask"))
+o.default = "022"
+
+o = sa:option(Value, "maxrate", translate("Max transmit rate"), translate("0 means no limitation"))
+o.default = "0"
+
+o = sa:option(Flag, "writemkdir", translate("Enable write/mkdir"))
+o.default = false
+
+o = sa:option(Flag, "upload", translate("Enable upload"))
+o.default = false
+
+o = sa:option(Flag, "others", translate("Enable other rights"), translate("Include rename, deletion ..."))
+o.default = false
+
+
+return m
diff --git a/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/general.lua b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/general.lua
new file mode 100644
index 000000000..74dbcad6e
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/general.lua
@@ -0,0 +1,114 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+m = Map("vsftpd", translate("FTP Server - General Settings"))
+
+sl = m:section(NamedSection, "listen", "listen", translate("Listening Settings"))
+
+o = sl:option(Flag, "enable4", translate("Enable IPv4"))
+o.rmempty = false
+o.default = true
+
+o = sl:option(Value, "ipv4", translate("IPv4 Address"))
+o.datatype = "ip4addr"
+o.default = "0.0.0.0"
+
+o = sl:option(Flag, "enable6", translate("Enable IPv6"))
+o.rmempty = false
+
+o = sl:option(Value, "ipv6", translate("IPv6 Address"))
+o.datatype = "ip6addr"
+o.default = "::"
+
+o = sl:option(Value, "port", translate("Listen Port"))
+o.datatype = "uinteger"
+o.default = "21"
+
+o = sl:option(Value, "dataport", translate("Data Port"))
+o.datatype = "uinteger"
+o.default = "20"
+
+
+sg = m:section(NamedSection, "global", "global", translate("Global Settings"))
+
+o = sg:option(Flag, "write", translate("Enable write"), translate("When disabled, all write request will give permission denied."));
+o.default = true
+
+o = sg:option(Flag, "download", translate("Enable download"), translate("When disabled, all download request will give permission denied."));
+o.default = true
+
+o = sg:option(Flag, "dirlist", translate("Enable directory list"), translate("When disabled, list commands will give permission denied."))
+o.default = true
+
+o = sg:option(Flag, "lsrecurse", translate("Allow directory recursely list"))
+
+o = sg:option(Flag, "dotfile", translate("Show dot files"), translate(". and .. are excluded."));
+o.default = true
+
+o = sg:option(Value, "umask", translate("File mode umask"), translate("Uploaded file mode will be 666 - <umask>; directory mode will be 777 - <umask>."))
+o.default = "022"
+
+o = sg:option(Value, "banner", translate("FTP Banner"))
+
+o = sg:option(Flag, "dirmessage", translate("Enable directory message"), translate("A message will be displayed when entering a directory."))
+
+o = sg:option(Value, "dirmsgfile", translate("Directory message filename"))
+o.default = ".message"
+
+
+sl = m:section(NamedSection, "local", "local", translate("Local Users"))
+
+o = sl:option(Flag, "enabled", translate("Enable local user"))
+o.rmempty = false
+
+o = sl:option(Value, "root", translate("Root directory"), translate("Leave empty will use user's home directory"))
+o.default = ""
+
+
+sc = m:section(NamedSection, "connection", "connection", translate("Connection Settings"))
+
+o = sc:option(Flag, "portmode", translate("Enable PORT mode"))
+o = sc:option(Flag, "pasvmode", translate("Enable PASV mode"))
+
+o = sc:option(ListValue, "ascii", translate("ASCII mode"))
+o:value("disabled", translate("Disabled"))
+o:value("download", translate("Download only"))
+o:value("upload", translate("Upload only"))
+o:value("both", translate("Both download and upload"))
+o.default = "both"
+
+o = sc:option(Value, "idletimeout", translate("Idle session timeout"), translate("in seconds"))
+o.datatype = "uinteger"
+o.default = "1800"
+o = sc:option(Value, "conntimeout", translate("Connection timeout"), translate("in seconds"))
+o.datatype = "uinteger"
+o.default = "120"
+o = sc:option(Value, "dataconntimeout", translate("Data connection timeout"), translate("in seconds"))
+o.datatype = "uinteger"
+o.default = "120"
+o = sc:option(Value, "maxclient", translate("Max clients"), translate("0 means no limitation"))
+o.datatype = "uinteger"
+o.default = "0"
+o = sc:option(Value, "maxperip", translate("Max clients per IP"), translate("0 means no limitation"))
+o.datatype = "uinteger"
+o.default = "0"
+o = sc:option(Value, "maxrate", translate("Max transmit rate"), translate("in KB/s, 0 means no limitation"))
+o.datatype = "uinteger"
+o.default = "0"
+o = sc:option(Value, "maxretry", translate("Max login fail count"), translate("Can not be zero, default is 3"))
+o.datatype = "uinteger"
+o.default = "3"
+
+
+return m
diff --git a/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/item.lua b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/item.lua
new file mode 100644
index 000000000..2a0003c8b
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/item.lua
@@ -0,0 +1,70 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local sid = arg[1]
+local utl = require "luci.util"
+
+m = Map("vsftpd", translate("FTP Server - Virtual User <new>"))
+
+m.redirect = luci.dispatcher.build_url("admin/nas/vsftpd/users")
+
+if m.uci:get("vsftpd", sid) ~= "user" then
+ luci.http.redirect(m.redirect)
+ return
+end
+
+m.uci:foreach("vsftpd", "user",
+ function(s)
+ if s['.name'] == sid and s.username then
+ m.title = translatef("FTP Server - Virtual User %q", s.username)
+ return false
+ end
+ end)
+
+s = m:section(NamedSection, sid, "settings", translate("User Settings"))
+s.addremove = false
+
+o = s:option(Value, "username", translate("Username"))
+o.rmempty = false
+
+function o.validate(self, value)
+ if value == "" then
+ return nil, translate("Username cannot be empty")
+ end
+ return value
+end
+
+o = s:option(Value, "password", translate("Password"))
+o.password = true
+
+o = s:option(Value, "home", translate("Home directory"))
+o.default = "/home/ftp"
+
+o = s:option(Value, "umask", translate("File mode umask"))
+o.default = "022"
+
+o = s:option(Value, "maxrate", translate("Max transmit rate"), translate("0 means no limitation"))
+o.default = "0"
+
+o = s:option(Flag, "writemkdir", translate("Enable write/mkdir"))
+o.default = false
+
+o = s:option(Flag, "upload", translate("Enable upload"))
+o.default = false
+
+o = s:option(Flag, "others", translate("Enable other rights"), translate("Include rename, deletion ..."))
+o.default = false
+
+
+return m
diff --git a/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/log.lua b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/log.lua
new file mode 100644
index 000000000..969ce817c
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/log.lua
@@ -0,0 +1,29 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+m = Map("vsftpd", translate("FTP Server - Log Settings"))
+
+sl = m:section(NamedSection, "log", "log", translate("Log Settings"))
+
+o = sl:option(Flag, "syslog", translate("Enable syslog"))
+o.default = false
+
+o = sl:option(Flag, "xreflog", translate("Enable file log"))
+o.default = true
+
+o = sl:option(Value, "file", translate("Log file"))
+o.default = "/var/log/vsftpd.log"
+
+
+return m
diff --git a/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/users.lua b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/users.lua
new file mode 100644
index 000000000..2ffaf759d
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/luasrc/model/cbi/vsftpd/users.lua
@@ -0,0 +1,54 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2016 Weijie Gao
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+m = Map("vsftpd", translate("FTP Server - Virtual User Settings"))
+
+sv = m:section(NamedSection, "vuser", "vuser", translate("Settings"))
+
+o = sv:option(Flag, "enabled", translate("Enabled"))
+o.default = false
+
+o = sv:option(Value, "username", translate("Username"), translate("An actual local user to handle virtual users"))
+o.default = "ftp"
+
+s = m:section(TypedSection, "user", translate("User lists"))
+s.template = "cbi/tblsection"
+s.extedit = luci.dispatcher.build_url("admin/nas/vsftpd/item/%s")
+s.addremove = true
+s.anonymous = true
+
+function s.create(...)
+ local id = TypedSection.create(...)
+ luci.http.redirect(s.extedit % id)
+end
+
+function s.remove(self, section)
+ return TypedSection.remove(self, section)
+end
+
+o = s:option(DummyValue, "username", translate("Username"))
+function o.cfgvalue(...)
+ local v = Value.cfgvalue(...) or ("<%s>" % translate("Unknown"))
+ return v
+end
+o.rmempty = false
+
+o = s:option(DummyValue, "home", translate("Home directory"))
+function o.cfgvalue(...)
+ local v = Value.cfgvalue(...) or ("/home/ftp")
+ return v
+end
+o.rmempty = false
+
+return m
diff --git a/package/lean/luci-app-vsftpd/po/zh-cn/vsftpd.po b/package/lean/luci-app-vsftpd/po/zh-cn/vsftpd.po
new file mode 100644
index 000000000..f8e3ba64a
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/po/zh-cn/vsftpd.po
@@ -0,0 +1,229 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2016-02-17 18:00+0800\n"\
+"Last-Translator: Weijie Gao \n"
+"Language-Team: \n"
+"Language: zh_CN\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: Pootle 2.0.6\n"
+
+msgid "NAS"
+msgstr "缃戠粶瀛樺偍"
+
+msgid ". and .. are excluded."
+msgstr ". 鍜 .. 灏嗚蹇界暐銆"
+
+msgid "0 means no limitation"
+msgstr "0 琛ㄦ槑涓嶉檺鍒"
+
+msgid "A message will be displayed when entering a directory."
+msgstr "鍦ㄨ繘鍏ヤ竴涓柊鐩綍鏃跺皢鏄剧ず鐨勬秷鎭"
+
+msgid "ASCII mode"
+msgstr "ASCII 妯″紡"
+
+msgid "Allow directory recursely list"
+msgstr "鍏佽閫掑綊鍒楃洰褰"
+
+msgid "An actual local user to handle anonymous user"
+msgstr "鎵胯浇鍖垮悕鐢ㄦ埛鐨勬湰鍦扮敤鎴"
+
+msgid "An actual local user to handle virtual users"
+msgstr "鎵胯浇铏氭嫙鐢ㄦ埛鐨勬湰鍦扮敤鎴"
+
+msgid "Anonymous Settings"
+msgstr "鍖垮悕鐢ㄦ埛璁剧疆"
+
+msgid "Anonymous User"
+msgstr "鍖垮悕鐢ㄦ埛"
+
+msgid "Both download and upload"
+msgstr "涓嬭浇鍜屼笂浼"
+
+msgid "Can not be zero, default is 3"
+msgstr "涓嶈兘涓 0锛岄粯璁や负 3"
+
+msgid "Connection Settings"
+msgstr "杩炴帴璁剧疆"
+
+msgid "Connection timeout"
+msgstr "杩炴帴瓒呮椂"
+
+msgid "Data Port"
+msgstr "鏁版嵁绔彛"
+
+msgid "Data connection timeout"
+msgstr "鏁版嵁杩炴帴瓒呮椂"
+
+msgid "Directory message filename"
+msgstr "鐩綍娑堟伅鏂囦欢鍚"
+
+msgid "Download only"
+msgstr "浠呬笅杞"
+
+msgid "Enable IPv4"
+msgstr "鍚敤 IPv4"
+
+msgid "Enable IPv6"
+msgstr "鍚敤 IPv6"
+
+msgid "Enable PASV mode"
+msgstr "鍚敤 PASV 妯″紡"
+
+msgid "Enable PORT mode"
+msgstr "鍚敤 PORT 妯″紡"
+
+msgid "Enable directory list"
+msgstr "鍏佽鍒楃洰褰"
+
+msgid "Enable directory message"
+msgstr "鍚敤鐩綍娑堟伅"
+
+msgid "Enable download"
+msgstr "鍏佽涓嬭浇"
+
+msgid "Enable file log"
+msgstr "鍚敤鏂囦欢鏃ュ織"
+
+msgid "Enable local user"
+msgstr "鍚敤鏈湴鐢ㄦ埛"
+
+msgid "Enable other rights"
+msgstr "鍏佽鍏跺畠鏉冮檺"
+
+msgid "Enable syslog"
+msgstr "鍚敤绯荤粺鏃ュ織"
+
+msgid "Enable upload"
+msgstr "鍏佽涓婁紶"
+
+msgid "Enable write"
+msgstr "鍏佽鍐"
+
+msgid "Enable write/mkdir"
+msgstr "鍏佽鍐/鍒涘缓鐩綍"
+
+msgid "FTP Banner"
+msgstr "FTP 娆㈣繋鎻愮ず"
+
+msgid "FTP Server"
+msgstr "FTP 鏈嶅姟鍣"
+
+msgid "FTP Server - Anonymous Settings"
+msgstr "FTP 鏈嶅姟鍣 - 鍖垮悕鐢ㄦ埛璁剧疆"
+
+msgid "FTP Server - General Settings"
+msgstr "FTP 鏈嶅姟鍣 - 甯歌璁剧疆"
+
+msgid "FTP Server - Log Settings"
+msgstr "FTP 鏈嶅姟鍣 - 鏃ュ織璁剧疆"
+
+msgid "FTP Server - Virtual User %q"
+msgstr "FTP 鏈嶅姟鍣 - 铏氭嫙鐢ㄦ埛 %q"
+
+msgid "FTP Server - Virtual User <new>"
+msgstr "FTP 鏈嶅姟鍣 - 铏氭嫙鐢ㄦ埛 <鏂扮敤鎴>"
+
+msgid "FTP Server - Virtual User Settings"
+msgstr "FTP 鏈嶅姟鍣 - 铏氭嫙鐢ㄦ埛璁剧疆"
+
+msgid "File mode umask"
+msgstr "鏂囦欢鏉冮檺鎺╃爜"
+
+msgid "General Settings"
+msgstr "甯歌璁剧疆"
+
+msgid "Global Settings"
+msgstr "鍏ㄥ眬璁剧疆"
+
+msgid "Home directory"
+msgstr "涓荤洰褰"
+
+msgid "IPv4 Address"
+msgstr "IPv4 鍦板潃"
+
+msgid "IPv6 Address"
+msgstr "IPv6 鍦板潃"
+
+msgid "Idle session timeout"
+msgstr "绌洪棽鍥炶瘽瓒呮椂"
+
+msgid "Include rename, deletion ..."
+msgstr "鍖呮嫭閲嶅懡鍚嶃佸垹闄 ..."
+
+msgid "Leave empty will use user's home directory"
+msgstr "鐣欑┖灏嗕娇鐢ㄧ敤鎴蜂富鐩綍"
+
+msgid "Listen Port"
+msgstr "鐩戝惉绔彛"
+
+msgid "Listening Settings"
+msgstr "鐩戝惉璁剧疆"
+
+msgid "Local Users"
+msgstr "鏈湴鐢ㄦ埛"
+
+msgid "Log Settings"
+msgstr "鏃ュ織璁剧疆"
+
+msgid "Log file"
+msgstr "鏃ュ織鏂囦欢"
+
+msgid "Max clients"
+msgstr "鏈澶ц繛鎺ユ暟"
+
+msgid "Max clients per IP"
+msgstr "鍚屼竴 IP 鐨勬渶澶ц繛鎺ユ暟"
+
+msgid "Max login fail count"
+msgstr "鏈澶х櫥褰曞皾璇曟暟"
+
+msgid "Max transmit rate"
+msgstr "鏈澶т紶杈撻熺巼"
+
+msgid "Root directory"
+msgstr "鏍圭洰褰"
+
+msgid "Settings"
+msgstr "璁剧疆"
+
+msgid "Show dot files"
+msgstr "鏄剧ず浠ョ偣寮澶寸殑鏂囦欢 (闅愯棌鏂囦欢)"
+
+msgid "Upload only"
+msgstr "浠呬笂浼"
+
+msgid "Uploaded file mode will be 666 - <umask>; directory mode will be 777 - <umask>."
+msgstr "涓婁紶鐨勬枃浠舵潈闄愬皢琚缃负 666 - <鎺╃爜>锛涚洰褰曟潈闄愬皢琚缃负 777 - <鎺╃爜>銆"
+
+msgid "User Settings"
+msgstr "鐢ㄦ埛璁剧疆"
+
+msgid "User lists"
+msgstr "鐢ㄦ埛鍒楄〃"
+
+msgid "Username cannot be empty"
+msgstr "鐢ㄦ埛鍚嶄笉鑳戒负绌"
+
+msgid "When disabled, all download request will give permission denied."
+msgstr "濡傛灉绂佹锛屾墍鏈夌殑涓嬭浇璇锋眰閮藉皢琚嫆缁濄"
+
+msgid "When disabled, all write request will give permission denied."
+msgstr "濡傛灉绂佹锛屾墍鏈夌殑鍐欑被鍨嬭姹傞兘灏嗚鎷掔粷銆"
+
+msgid "When disabled, list commands will give permission denied."
+msgstr "濡傛灉绂佹锛屽垪鐩綍鍛戒护灏嗚鎷掔粷銆"
+
+msgid "Virtual Users"
+msgstr "铏氭嫙鐢ㄦ埛"
+
+msgid "in seconds"
+msgstr "鍗曚綅涓虹"
+
+msgid "in KB/s, 0 means no limitation"
+msgstr "鍗曚綅涓 KB/s锛0 琛ㄦ槑涓嶉檺鍒"
diff --git a/package/lean/luci-app-vsftpd/root/etc/uci-defaults/luci-vsftpd b/package/lean/luci-app-vsftpd/root/etc/uci-defaults/luci-vsftpd
new file mode 100755
index 000000000..aa2f71a36
--- /dev/null
+++ b/package/lean/luci-app-vsftpd/root/etc/uci-defaults/luci-vsftpd
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+ delete ucitrack.@vsftpd[-1]
+ add ucitrack vsftpd
+ set ucitrack.@vsftpd[-1].init=vsftpd
+ commit ucitrack
+EOF
+
+rm -f /tmp/luci-vsftpd
+exit 0
diff --git a/package/lean/luci-app-xunlei/Makefile b/package/lean/luci-app-xunlei/Makefile
new file mode 100644
index 000000000..63691b4f9
--- /dev/null
+++ b/package/lean/luci-app-xunlei/Makefile
@@ -0,0 +1,16 @@
+#
+# Copyright (C) 2008-2014 The LuCI Team
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI Support for Xware downloading app.
+LUCI_DEPENDS:=+wget
+PKG_VERSION:=1.0
+PKG_RELEASE:=1
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
diff --git a/package/lean/luci-app-xunlei/luasrc/controller/xunlei.lua b/package/lean/luci-app-xunlei/luasrc/controller/xunlei.lua
new file mode 100755
index 000000000..b0d15cd13
--- /dev/null
+++ b/package/lean/luci-app-xunlei/luasrc/controller/xunlei.lua
@@ -0,0 +1,13 @@
+
+module("luci.controller.xunlei", package.seeall)
+
+function index()
+ if not nixio.fs.access("/etc/config/xunlei") then
+ return
+ end
+
+ local page
+ page = entry({"admin", "services", "xunlei"}, cbi("xunlei"), _("杩呴浄杩滅▼涓嬭浇"), 199)
+ page.i18n = "xunlei"
+ page.dependent = true
+end
diff --git a/package/lean/luci-app-xunlei/luasrc/model/cbi/xunlei.lua b/package/lean/luci-app-xunlei/luasrc/model/cbi/xunlei.lua
new file mode 100755
index 000000000..fd3bec29a
--- /dev/null
+++ b/package/lean/luci-app-xunlei/luasrc/model/cbi/xunlei.lua
@@ -0,0 +1,106 @@
+local fs = require "nixio.fs"
+local util = require "nixio.util"
+
+local running=(luci.sys.call("pidof EmbedThunderManager > /dev/null") == 0)
+local button=""
+local xunleiinfo=""
+local tblXLInfo={}
+local detailInfo = "杩呴浄杩滅▼涓嬭浇 杩愯涓 鍚姩淇℃伅锛歖] .. xunleiinfo .. [[
]]
+ if tonumber(tblXLInfo[1]) == 0 then
+ detailInfo = detailInfo .. [[鐘舵佹甯
]]
+ else
+ detailInfo = detailInfo .. [[鎵ц寮傚父
]]
+ end
+
+ if tonumber(tblXLInfo[2]) == 0 then
+ detailInfo = detailInfo .. [[缃戠粶寮傚父
]]
+ else
+ detailInfo = detailInfo .. [[缃戠粶姝ｅ父
]]
+ end
+
+ if tonumber(tblXLInfo[4]) == 0 then
+ detailInfo = detailInfo .. [[鏈粦瀹歖].. [[ 婵娲荤爜锛歖].. tblXLInfo[5] ..[[
]]
+ else
+ detailInfo = detailInfo .. [[宸茬粦瀹
]]
+ end
+
+ if tonumber(tblXLInfo[6]) == 0 then
+ detailInfo = detailInfo .. [[纾佺洏鎸傝浇妫娴嬪け璐
]]
+ else
+ detailInfo = detailInfo .. [[纾佺洏鎸傝浇妫娴嬫垚鍔
]]
+ end
+else
+ m = Map("xunlei", translate("Xware"), translate("杩呴浄杩滅▼涓嬭浇 鏈繍琛
", detailInfo)
+
+s:taboption("basic", DummyValue,"opennewwindow" ,"
", "
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+]]--
+
+local io = require "io"
+local os = require "os"
+local ltn12 = require "luci.ltn12"
+local fs = require "nixio.fs"
+local nutil = require "nixio.util"
+
+local type = type
+
+--- LuCI filesystem library.
+module "luci.fs"
+
+--- Test for file access permission on given path.
+-- @class function
+-- @name access
+-- @param str String value containing the path
+-- @return Number containing the return code, 0 on sucess or nil on error
+-- @return String containing the error description (if any)
+-- @return Number containing the os specific errno (if any)
+access = fs.access
+
+--- Evaluate given shell glob pattern and return a table containing all matching
+-- file and directory entries.
+-- @class function
+-- @name glob
+-- @param filename String containing the path of the file to read
+-- @return Table containing file and directory entries or nil if no matches
+-- @return String containing the error description (if no matches)
+-- @return Number containing the os specific errno (if no matches)
+function glob(...)
+ local iter, code, msg = fs.glob(...)
+ if iter then
+ return nutil.consume(iter)
+ else
+ return nil, code, msg
+ end
+end
+
+--- Checks wheather the given path exists and points to a regular file.
+-- @param filename String containing the path of the file to test
+-- @return Boolean indicating wheather given path points to regular file
+function isfile(filename)
+ return fs.stat(filename, "type") == "reg"
+end
+
+--- Checks wheather the given path exists and points to a directory.
+-- @param dirname String containing the path of the directory to test
+-- @return Boolean indicating wheather given path points to directory
+function isdirectory(dirname)
+ return fs.stat(dirname, "type") == "dir"
+end
+
+--- Read the whole content of the given file into memory.
+-- @param filename String containing the path of the file to read
+-- @return String containing the file contents or nil on error
+-- @return String containing the error message on error
+readfile = fs.readfile
+
+--- Write the contents of given string to given file.
+-- @param filename String containing the path of the file to read
+-- @param data String containing the data to write
+-- @return Boolean containing true on success or nil on error
+-- @return String containing the error message on error
+writefile = fs.writefile
+
+--- Copies a file.
+-- @param source Source file
+-- @param dest Destination
+-- @return Boolean containing true on success or nil on error
+copy = fs.datacopy
+
+--- Renames a file.
+-- @param source Source file
+-- @param dest Destination
+-- @return Boolean containing true on success or nil on error
+rename = fs.move
+
+--- Get the last modification time of given file path in Unix epoch format.
+-- @param path String containing the path of the file or directory to read
+-- @return Number containing the epoch time or nil on error
+-- @return String containing the error description (if any)
+-- @return Number containing the os specific errno (if any)
+function mtime(path)
+ return fs.stat(path, "mtime")
+end
+
+--- Set the last modification time of given file path in Unix epoch format.
+-- @param path String containing the path of the file or directory to read
+-- @param mtime Last modification timestamp
+-- @param atime Last accessed timestamp
+-- @return 0 in case of success nil on error
+-- @return String containing the error description (if any)
+-- @return Number containing the os specific errno (if any)
+function utime(path, mtime, atime)
+ return fs.utimes(path, atime, mtime)
+end
+
+--- Return the last element - usually the filename - from the given path with
+-- the directory component stripped.
+-- @class function
+-- @name basename
+-- @param path String containing the path to strip
+-- @return String containing the base name of given path
+-- @see dirname
+basename = fs.basename
+
+--- Return the directory component of the given path with the last element
+-- stripped of.
+-- @class function
+-- @name dirname
+-- @param path String containing the path to strip
+-- @return String containing the directory component of given path
+-- @see basename
+dirname = fs.dirname
+
+--- Return a table containing all entries of the specified directory.
+-- @class function
+-- @name dir
+-- @param path String containing the path of the directory to scan
+-- @return Table containing file and directory entries or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+function dir(...)
+ local iter, code, msg = fs.dir(...)
+ if iter then
+ local t = nutil.consume(iter)
+ t[#t+1] = "."
+ t[#t+1] = ".."
+ return t
+ else
+ return nil, code, msg
+ end
+end
+
+--- Create a new directory, recursively on demand.
+-- @param path String with the name or path of the directory to create
+-- @param recursive Create multiple directory levels (optional, default is true)
+-- @return Number with the return code, 0 on sucess or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+function mkdir(path, recursive)
+ return recursive and fs.mkdirr(path) or fs.mkdir(path)
+end
+
+--- Remove the given empty directory.
+-- @class function
+-- @name rmdir
+-- @param path String containing the path of the directory to remove
+-- @return Number with the return code, 0 on sucess or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+rmdir = fs.rmdir
+
+local stat_tr = {
+ reg = "regular",
+ dir = "directory",
+ lnk = "link",
+ chr = "character device",
+ blk = "block device",
+ fifo = "fifo",
+ sock = "socket"
+}
+--- Get information about given file or directory.
+-- @class function
+-- @name stat
+-- @param path String containing the path of the directory to query
+-- @return Table containing file or directory properties or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+function stat(path, key)
+ local data, code, msg = fs.stat(path)
+ if data then
+ data.mode = data.modestr
+ data.type = stat_tr[data.type] or "?"
+ end
+ return key and data and data[key] or data, code, msg
+end
+
+--- Set permissions on given file or directory.
+-- @class function
+-- @name chmod
+-- @param path String containing the path of the directory
+-- @param perm String containing the permissions to set ([ugoa][+-][rwx])
+-- @return Number with the return code, 0 on sucess or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+chmod = fs.chmod
+
+--- Create a hard- or symlink from given file (or directory) to specified target
+-- file (or directory) path.
+-- @class function
+-- @name link
+-- @param path1 String containing the source path to link
+-- @param path2 String containing the destination path for the link
+-- @param symlink Boolean indicating wheather to create a symlink (optional)
+-- @return Number with the return code, 0 on sucess or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+function link(src, dest, sym)
+ return sym and fs.symlink(src, dest) or fs.link(src, dest)
+end
+
+--- Remove the given file.
+-- @class function
+-- @name unlink
+-- @param path String containing the path of the file to remove
+-- @return Number with the return code, 0 on sucess or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+unlink = fs.unlink
+
+--- Retrieve target of given symlink.
+-- @class function
+-- @name readlink
+-- @param path String containing the path of the symlink to read
+-- @return String containing the link target or nil on error
+-- @return String containing the error description on error
+-- @return Number containing the os specific errno on error
+readlink = fs.readlink
diff --git a/package/lean/n2n_v2/Makefile b/package/lean/n2n_v2/Makefile
new file mode 100644
index 000000000..1103d2b20
--- /dev/null
+++ b/package/lean/n2n_v2/Makefile
@@ -0,0 +1,55 @@
+#
+# Copyright (C) 2007-2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_BRANCH:=trunk
+PKG_SOURCE_URL:=https://shop.ntop.org/svn/ntop/trunk/n2n/n2n_v2
+PKG_REV:=9349
+
+PKG_NAME:=n2n_v2
+PKG_VERSION:=$(PKG_REV)
+PKG_RELEASE:=1
+
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.gz
+PKG_SOURCE_PROTO:=svn
+PKG_SOURCE_VERSION:=$(PKG_REV)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/n2n_v2
+ SECTION:=net
+ CATEGORY:=Network
+ TITLE:=N2N VPN tunneling daemon(V2)
+ URL:=http://www.ntop.org/n2n/
+ SUBMENU:=VPN
+ DEPENDS:=+libpthread +kmod-tun +libopenssl
+endef
+
+define Build/Compile
+ $(MAKE) -C $(PKG_BUILD_DIR) \
+ $(TARGET_CONFIGURE_OPTS) \
+ CFLAGS="$(TARGET_CFLAGS)" \
+ INSTALL_PROG=":"
+endef
+
+define Package/n2n_v2/install
+ $(INSTALL_DIR) $(1)/usr/sbin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/edge $(1)/usr/sbin/
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/supernode $(1)/usr/sbin/
+ $(INSTALL_DIR) $(1)/etc/config
+ $(INSTALL_DATA) ./files/n2n_v2.config $(1)/etc/config/n2n_v2
+ $(INSTALL_DIR) $(1)/etc/init.d
+ $(INSTALL_BIN) ./files/n2n_v2.init $(1)/etc/init.d/n2n_v2
+endef
+
+define Package/n2n_v2/conffiles
+/etc/config/n2n_v2
+endef
+
+$(eval $(call BuildPackage,n2n_v2))
diff --git a/package/lean/n2n_v2/files/n2n_v2.config b/package/lean/n2n_v2/files/n2n_v2.config
new file mode 100644
index 000000000..c765d02dd
--- /dev/null
+++ b/package/lean/n2n_v2/files/n2n_v2.config
@@ -0,0 +1,15 @@
+config edge
+ option enabled '0'
+ option tunname 'n2n_edge'
+ option mode 'static'
+ option ipaddr '10.0.0.100'
+ option netmask '255.255.255.0'
+ option supernode '1.2.3.4'
+ option port '1234'
+ option community 'example'
+ option key 'password'
+ option route '0'
+
+config supernode
+ option enabled '0'
+ option port '1235'
diff --git a/package/lean/n2n_v2/files/n2n_v2.init b/package/lean/n2n_v2/files/n2n_v2.init
new file mode 100644
index 000000000..08dda79f3
--- /dev/null
+++ b/package/lean/n2n_v2/files/n2n_v2.init
@@ -0,0 +1,62 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2008-2012 OpenWrt.org
+
+START=90
+
+start_instance() {
+ local cfg="$1"
+
+ config_get type "$cfg" TYPE
+
+ case "$type" in
+ edge)
+ config_get_bool enabled "$cfg" 'enabled' '0'
+ [ "$enabled" = "0" ] && return 1
+ config_get tunname "$cfg" 'tunname'
+ config_get mode "$cfg" 'mode'
+ config_get ipaddr "$cfg" 'ipaddr'
+ config_get netmask "$cfg" 'netmask'
+ config_get supernode "$cfg" 'supernode'
+ config_get port "$cfg" 'port'
+ config_get community "$cfg" 'community'
+ config_get key "$cfg" 'key'
+ config_get_bool route "$cfg" 'route' '0'
+ [ "$route" = "1" ] && args='-r'
+ [ "$mode" = 'dhcp' ] && ipaddr='0.0.0.0'
+ /usr/sbin/edge -d $tunname -a ${mode}:${ipaddr} -c $community $([ -n "$key" ] && echo -k $key) -s ${netmask} -l ${supernode}:${port} $args
+ ;;
+ supernode)
+ config_get_bool enabled "$cfg" 'enabled' '0'
+ [ "$enabled" = "0" ] && return 1
+ config_get port "$cfg" port
+ /usr/sbin/supernode -l $port
+ ;;
+ esac
+}
+
+stop_instance() {
+ local cfg="$1"
+
+ config_get type "$cfg" TYPE
+
+ case "$type" in
+ edge)
+ killall -9 edge
+ ;;
+ supernode)
+ killall -9 supernode
+ ;;
+ esac
+}
+
+start() {
+ config_load 'n2n_v2'
+ config_foreach start_instance 'edge'
+ config_foreach start_instance 'supernode'
+}
+
+stop() {
+ config_load 'n2n_v2'
+ killall -9 edge
+ killall -9 supernode
+}
diff --git a/package/lean/ngrokc/Makefile b/package/lean/ngrokc/Makefile
new file mode 100644
index 000000000..a355b0ac3
--- /dev/null
+++ b/package/lean/ngrokc/Makefile
@@ -0,0 +1,36 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ngrokc
+PKG_VERSION:=20160829
+PKG_RELEASE:=1
+PKG_REV:=355aa8ba062e92cfe54966084ca79e9bd5ff8555
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/dosgo/ngrok-c.git
+PKG_SOURCE_VERSION:=$(PKG_REV)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ngrokc
+ SECTION:=net
+ CATEGORY:=Network
+ SUBMENU:=Web Servers/Proxies
+ TITLE:=Secure tunnels to localhost(C++ port)
+ URL:=https://github.com/dosgo/ngrok-c
+ DEPENDS:=+libc +libpthread +libopenssl +libstdcpp
+endef
+
+define Build/Prepare
+ $(call Build/Prepare/Default,)
+ $(CP) $(PKG_BUILD_DIR)/Makefile.openssl $(PKG_BUILD_DIR)/Makefile
+endef
+
+define Package/ngrokc/install
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/ngrokc $(1)/usr/bin
+endef
+
+
+$(eval $(call BuildPackage,ngrokc))
\ No newline at end of file
diff --git a/package/lean/openwrt-mproxy/Makefile b/package/lean/openwrt-mproxy/Makefile
new file mode 100644
index 000000000..74b473769
--- /dev/null
+++ b/package/lean/openwrt-mproxy/Makefile
@@ -0,0 +1,49 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=mproxy
+PKG_VERSION=1
+PKG_RELEASE:=6
+
+PKG_MAINTAINER:=lean
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_SOURCE_PROTO:=git
+#PKG_SOURCE_URL:=https://github.com/openwrt-develop/mproxy.git
+#PKG_SOURCE_VERSION:=0e0e27192e91ff08f4e235065b6b24c642541334
+PKG_SOURCE_URL:=https://github.com/lonsx/mproxy-mod.git
+PKG_SOURCE_VERSION:=ea3abaa40c901da6bb8e655cde63d3cac28b83ec
+
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)
+#PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.gz
+PKG_SOURCE:=$(PKG_NAME).$(PKG_VERSION).$(PKG_RELEASE).tar.gz
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_SUBDIR)
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/mproxy
+ SECTION:=net
+ CATEGORY:=Network
+ TITLE:=mproxy for OpenWRT
+ DEPENDS:=
+endef
+
+define Package/mproxy/description
+ mproxy is a Tiny Proxy in C.
+endef
+
+
+define Package/mproxy/Prepare
+ mkdir -p $(PKG_BUILD_DIR)
+ $(CP) ./src/* $(PKG_BUILD_DIR)/
+endef
+
+
+define Package/mproxy/install
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/mproxy $(1)/usr/bin/mproxy
+endef
+
+$(eval $(call BuildPackage,mproxy))
+
diff --git a/package/lean/openwrt-mproxy/src/Makefile b/package/lean/openwrt-mproxy/src/Makefile
new file mode 100644
index 000000000..d08aaa6f5
--- /dev/null
+++ b/package/lean/openwrt-mproxy/src/Makefile
@@ -0,0 +1,14 @@
+CC ?= gcc
+CFLAGS = -g -Wall -Werror -DDBUG
+
+all: mproxy
+
+mproxy: mproxy.o
+ $(CC) $(CFLAGS) mproxy.o -o mproxy
+
+mproxy.o: mproxy.c
+ $(CC) $(CFLAGS) -c mproxy.c
+
+clean:
+ rm -rf *.o
+ rm -rf mproxy
diff --git a/package/lean/openwrt-mproxy/src/mproxy.c b/package/lean/openwrt-mproxy/src/mproxy.c
new file mode 100644
index 000000000..822add6c1
--- /dev/null
+++ b/package/lean/openwrt-mproxy/src/mproxy.c
@@ -0,0 +1,862 @@
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+
+#include
+
+#define BUF_SIZE 8192
+
+#define READ 0
+#define WRITE 1
+
+#define DEFAULT_LOCAL_PORT 8080
+#define DEFAULT_REMOTE_PORT 8081
+#define DEFAULT_R_P 1024 /* 瀹氫箟-r 鏃堕粯璁ょ殑杞彂CONNECT娴佺殑绔彛 */
+#define DEFAULT_M_S Lbxx: /* 瀹氫箟-m 鏃堕粯璁ょ殑ML鍏抽敭瀛楃涓(缁忓垽鏂棤鐢紝鍙垗寮) */
+#define SERVER_SOCKET_ERROR -1
+#define SERVER_SETSOCKOPT_ERROR -2
+#define SERVER_BIND_ERROR -3
+#define SERVER_LISTEN_ERROR -4
+#define CLIENT_SOCKET_ERROR -5
+#define CLIENT_RESOLVE_ERROR -6
+#define CLIENT_CONNECT_ERROR -7
+#define CREATE_PIPE_ERROR -8
+#define BROKEN_PIPE_ERROR -9
+#define HEADER_BUFFER_FULL -10
+#define BAD_HTTP_PROTOCOL -11
+
+#define MAX_HEADER_SIZE 8192
+
+
+#if defined(OS_ANDROID)
+#include
+
+#define LOG(fmt...) __android_log_print(ANDROID_LOG_DEBUG,__FILE__,##fmt)
+
+#else
+#define LOG(fmt...) do { fprintf(stderr,"%s %s ",__DATE__,__TIME__); fprintf(stderr, ##fmt); } while(0)
+#endif
+
+
+char remote_host[128];
+int remote_port;
+int local_port;
+char r_h[128];
+int r_p;
+char m_s[128];
+
+int server_sock;
+int client_sock;
+int remote_sock;
+
+
+
+
+char * header_buffer ;
+
+
+enum
+{
+ FLG_NONE = 0, /* 姝ｅ父鏁版嵁娴佷笉杩涜缂栬В鐮 */
+ R_C_DEC = 1, /* 璇诲彇瀹㈡埛绔暟鎹粎杩涜瑙ｇ爜 */
+ W_S_ENC = 2 /* 鍙戦佸埌鏈嶅姟绔繘琛岀紪鐮 */
+};
+
+static int io_flag; /* 缃戠粶io鐨勪竴浜涙爣蹇椾綅 */
+static int r_flag; /* 鏄惁鍚敤-r 鍖归厤鍏嶆祦host鐩存帴杞彂CONNECT娴侀噺妯″紡 */
+static int m_flag; /* 鏄惁鍚敤-m 鍏抽敭瀛楀ご鍖归厤鍏嶆祦妯″紡 */
+static int m_pid; /* 淇濆瓨涓昏繘绋媔d */
+
+
+
+void server_loop();
+void stop_server();
+void handle_client(int client_sock, struct sockaddr_in client_addr);
+void forward_header(int destination_sock);
+void forward_data(int source_sock, int destination_sock);
+void rewrite_header();
+int send_data(int socket,char * buffer,int len );
+int receive_data(int socket, char * buffer, int len);
+void hand_mproxy_info_req(int sock,char * header_buffer) ;
+void get_info(char * output);
+const char * get_work_mode() ;
+int create_connection() ;
+int _main(int argc, char *argv[]) ;
+
+
+
+
+ssize_t readLine(int fd, void *buffer, size_t n)
+{
+ ssize_t numRead;
+ size_t totRead;
+ char *buf;
+ char ch;
+
+ if (n <= 0 || buffer == NULL) {
+ errno = EINVAL;
+ return -1;
+ }
+
+ buf = buffer;
+
+ totRead = 0;
+ for (;;) {
+ numRead = receive_data(fd, &ch, 1);
+
+ if (numRead == -1) {
+ if (errno == EINTR)
+ continue;
+ else
+ return -1; /* 鏈煡閿欒 */
+
+ } else if (numRead == 0) { /* EOF */
+ if (totRead == 0) /* No bytes read; return 0 */
+ return 0;
+ else /* Some bytes read; add '\0' */
+ break;
+
+ } else {
+
+ if (totRead < n - 1) { /* Discard > (n - 1) bytes */
+ totRead++;
+ *buf++ = ch;
+ }
+
+ if (ch == '\n')
+ break;
+ }
+ }
+
+ *buf = '\0';
+ return totRead;
+}
+
+int read_header(int fd, void * buffer)
+{
+ // bzero(header_buffer,sizeof(MAX_HEADER_SIZE));
+ memset(header_buffer,0,MAX_HEADER_SIZE);
+ char line_buffer[2048];
+ char * base_ptr = header_buffer;
+
+ for(;;)
+ {
+ memset(line_buffer,0,2048);
+
+ int total_read = readLine(fd,line_buffer,2048);
+ if(total_read <= 0)
+ {
+ return CLIENT_SOCKET_ERROR;
+ }
+ //闃叉header缂撳啿鍖鸿洰瓒婄晫
+ if(base_ptr + total_read - header_buffer <= MAX_HEADER_SIZE)
+ {
+ strncpy(base_ptr,line_buffer,total_read);
+ base_ptr += total_read;
+ } else
+ {
+ return HEADER_BUFFER_FULL;
+ }
+
+ //璇诲埌浜嗙┖琛岋紝http澶寸粨鏉
+ if(strcmp(line_buffer,"\r\n") == 0 || strcmp(line_buffer,"\n") == 0)
+ {
+ break;
+ }
+
+ }
+ return 0;
+
+}
+
+void extract_server_path(const char * header,char * output)
+{
+ char * p = strstr(header,"GET /");
+ if(p) {
+ char * p1 = strchr(p+4,' ');
+ strncpy(output,p+4,(int)(p1 - p - 4) );
+ }
+
+}
+
+int extract_host(const char * header)
+{
+ if(!m_flag)
+ {
+ if(!r_flag)
+ {
+ char * _p = strstr(header,"CONNECT"); /* 鍦 CONNECT 鏂规硶涓В鏋 闅ч亾涓绘満鍚嶇О鍙婄鍙ｅ彿 */
+ if(_p)
+ {
+ char * _p1 = strchr(_p,' ');
+
+ char * _p2 = strchr(_p1 + 1,':');
+ char * _p3 = strchr(_p1 + 1,' ');
+
+ if(_p2)
+ {
+ char s_port[10];
+ bzero(s_port,10);
+
+ strncpy(remote_host,_p1+1,(int)(_p2 - _p1) - 1);
+ strncpy(s_port,_p2+1,(int) (_p3 - _p2) -1);
+ remote_port = atoi(s_port);
+
+ } else
+ {
+ strncpy(remote_host,_p1+1,(int)(_p3 - _p1) -1);
+ remote_port = 80;
+ }
+
+
+ return 0;
+ }
+
+
+ char * p = strstr(header,"Host:");
+ if(!p)
+ {
+ return BAD_HTTP_PROTOCOL;
+ }
+ char * p1 = strchr(p,'\n');
+ if(!p1)
+ {
+ return BAD_HTTP_PROTOCOL;
+ }
+
+ char * p2 = strchr(p + 5,':'); /* 5鏄寚'Host:'鐨勯暱搴 */
+
+ if(p2 && p2 < p1)
+ {
+
+ int p_len = (int)(p1 - p2 -1);
+ char s_port[p_len];
+ strncpy(s_port,p2+1,p_len);
+ s_port[p_len] = '\0';
+ remote_port = atoi(s_port);
+
+ int h_len = (int)(p2 - p -5 -1 );
+ strncpy(remote_host,p + 5 + 1 ,h_len); //Host:
+ //assert h_len < 128;
+ remote_host[h_len] = '\0';
+ } else
+ {
+ int h_len = (int)(p1 - p - 5 -1 -1);
+ strncpy(remote_host,p + 5 + 1,h_len);
+ //assert h_len < 128;
+ remote_host[h_len] = '\0';
+ remote_port = 80;
+ }
+ } else
+ {
+ strncpy(remote_host, r_h, strlen(r_h));
+ remote_port = r_p;
+ }
+ } else
+ {
+ char * __p = strstr(header,"CONNECT"); /* 鍦 CONNECT 鏂规硶涓В鏋 闅ч亾涓绘満鍚嶇О鍙婄鍙ｅ彿 */
+ char * _p = strstr(header,m_s);
+ //printf("Show: %s\n",_p);
+ if(_p && __p)
+ {
+ char * _p1 = strchr(_p,' ');
+
+ char * _p2 = strchr(_p1 + 1,':');
+ char * _p3 = strchr(_p1 + 1,'\r');
+
+ if(_p2)
+ {
+ char s_port[10];
+ bzero(s_port,10);
+
+ strncpy(remote_host,_p1+1,(int)(_p2 - _p1) - 1);
+ strncpy(s_port,_p2+1,(int) (_p3 - _p2) -1);
+ remote_port = atoi(s_port);
+
+ } else
+ {
+ strncpy(remote_host,_p1+1,(int)(_p3 - _p1) -1);
+ remote_port = 80;
+ }
+
+
+ return 0;
+ }
+
+
+ char * p = strstr(header,m_s);
+ if(!p)
+ {
+ if(r_flag)
+ {
+ strncpy(remote_host, r_h, strlen(r_h));
+ remote_port = r_p;
+ return 0;
+ }else
+ {
+ return BAD_HTTP_PROTOCOL;
+ }
+ }
+ char * p1 = strchr(p,'\n');
+ if(!p1)
+ {
+ return BAD_HTTP_PROTOCOL;
+ }
+
+ int m_l = strlen(m_s);
+ char * p2 = strchr(p + m_l,':'); /* m_l鏄寚绫讳技鑷畾涔'Lbxx:'鐨勯暱搴 */
+
+ if(p2 && p2 < p1)
+ {
+
+ int p_len = (int)(p1 - p2 -1);
+ char s_port[p_len];
+ strncpy(s_port,p2+1,p_len);
+ s_port[p_len] = '\0';
+ remote_port = atoi(s_port);
+
+ int h_len = (int)(p2 - p - m_l -1 );
+ strncpy(remote_host,p + m_l + 1 ,h_len); //Host:
+ //assert h_len < 128;
+ remote_host[h_len] = '\0';
+ } else
+ {
+ int h_len = (int)(p1 - p - m_l -1 -1);
+ strncpy(remote_host,p + m_l + 1,h_len);
+ //assert h_len < 128;
+ remote_host[h_len] = '\0';
+ remote_port = 80;
+ }
+ }
+ return 0;
+}
+
+/* 鍝嶅簲闅ч亾杩炴帴璇锋眰 */
+int send_tunnel_ok(int client_sock)
+{
+ char * resp = "HTTP/1.1 200 Connection Established\r\n\r\n";
+ int len = strlen(resp);
+ char buffer[len+1];
+ strcpy(buffer,resp);
+ if(send_data(client_sock,buffer,len) < 0)
+ {
+ perror("Send http tunnel response failed\n");
+ return -1;
+ }
+ return 0;
+}
+
+
+//杩斿洖mproxy鐨勮繍琛屽熀鏈俊鎭
+void hand_mproxy_info_req(int sock, char * header) {
+ char server_path[255] ;
+ char response[8192];
+ extract_server_path(header,server_path);
+
+ LOG("server path:%s\n",server_path);
+ char info_buf[1024];
+ get_info(info_buf);
+ sprintf(response,"HTTP/1.0 200 OK\nServer: MProxy/0.1\n\
+ Content-type: text/html; charset=utf-8\n\n\
+ \
+ %s \
+ \n",info_buf);
+
+
+ write(sock,response,strlen(response));
+
+}
+
+/* 鑾峰彇杩愯鐨勫熀鏈俊鎭緭鍑哄埌鎸囧畾鐨勭紦鍐插尯 */
+void get_info(char * output)
+{
+ int pos = 0;
+ char line_buffer[512];
+ sprintf(line_buffer,"======= mproxy (v0.1) ========\n");
+ int len = strlen(line_buffer);
+ memcpy(output,line_buffer,len);
+ pos += len ;
+
+ sprintf(line_buffer,"%s\n",get_work_mode());
+ len = strlen(line_buffer);
+ memcpy(output + pos,line_buffer,len);
+ pos += len;
+
+ if(strlen(remote_host) > 0)
+ {
+ sprintf(line_buffer,"start server on %d and next hop is %s:%d\n",local_port,remote_host,remote_port);
+
+ } else
+ {
+ sprintf(line_buffer,"start server on %d\n",local_port);
+ }
+
+ len = strlen(line_buffer);
+ memcpy(output+ pos,line_buffer,len);
+ pos += len ;
+
+ output[pos] = '\0';
+
+}
+
+
+const char * get_work_mode()
+{
+
+ if(strlen(remote_host) == 0)
+ {
+ if(!r_flag && !m_flag)
+ {
+ if(io_flag == FLG_NONE)
+ {
+ return "start as normal http proxy";
+ } else if(io_flag == R_C_DEC)
+ {
+ return "start as remote forward proxy and do decode data when recevie data" ;
+ }
+ } else
+ {
+ return "start as -r or -m mode";
+ }
+
+ } else
+ {
+ if(io_flag == FLG_NONE)
+ {
+ return "start as remote forward proxy";
+ } else if(io_flag == W_S_ENC)
+ {
+ return "start as forward proxy and do encode data when send data";
+ }
+ }
+ return "unknow";
+
+
+}
+
+/* 澶勭悊瀹㈡埛绔殑杩炴帴 */
+void handle_client(int client_sock, struct sockaddr_in client_addr)
+{
+ int is_http_tunnel = 0;
+ if(strlen(remote_host) == 0) /* 鏈寚瀹氳繙绔富鏈哄悕绉颁粠http 璇锋眰 HOST 瀛楁涓幏鍙 */
+ {
+
+ #ifdef DEBUG
+ LOG(" ============ handle new client ============\n");
+ LOG(">>>Header:%s\n",header_buffer);
+ #endif
+
+ if(read_header(client_sock,header_buffer) < 0)
+ {
+ LOG("Read Http header failed\n");
+ return;
+ } else
+ {
+ char * p = strstr(header_buffer,"CONNECT"); /* 鍒ゆ柇鏄惁鏄痟ttp 闅ч亾璇锋眰 */
+ if(p)
+ {
+ LOG("receive CONNECT request\n");
+ is_http_tunnel = 1;
+ }
+
+ if(strstr(header_buffer,"GET /mproxy") >0 )
+ {
+ LOG("====== hand mproxy info request ====");
+ //杩斿洖mproxy鐨勮繍琛屽熀鏈俊鎭
+ hand_mproxy_info_req(client_sock,header_buffer);
+
+ return;
+ }
+
+ if(extract_host(header_buffer) < 0)
+ {
+ LOG("Cannot extract host field,bad http protrotol");
+ return;
+ }
+ LOG("Host:%s port: %d io_flag:%d\n",remote_host,remote_port,io_flag);
+
+ }
+ }
+
+ if ((remote_sock = create_connection()) < 0) {
+ LOG("Cannot connect to host [%s:%d]\n",remote_host,remote_port);
+ return;
+ }
+
+ if (fork() == 0) { // 鍒涘缓瀛愯繘绋嬬敤浜庝粠瀹㈡埛绔浆鍙戞暟鎹埌杩滅socket鎺ュ彛
+
+ if(strlen(header_buffer) > 0 && !is_http_tunnel)
+ {
+ forward_header(remote_sock); //鏅氱殑http璇锋眰鍏堣浆鍙慼eader
+ }
+
+ forward_data(client_sock, remote_sock);
+ exit(0);
+ }
+
+ if (fork() == 0) { // 鍒涘缓瀛愯繘绋嬬敤浜庤浆鍙戜粠杩滅socket鎺ュ彛杩囨潵鐨勬暟鎹埌瀹㈡埛绔
+
+ if(io_flag == W_S_ENC)
+ {
+ io_flag = R_C_DEC; //鍙戦佽姹傜粰鏈嶅姟绔繘琛岀紪鐮侊紝璇诲彇鏈嶅姟绔殑鍝嶅簲鍒欒繘琛岃В鐮
+ } else if (io_flag == R_C_DEC)
+ {
+ io_flag = W_S_ENC; //鎺ユ敹瀹㈡埛绔姹傝繘琛岃В鐮侊紝閭ｄ箞鍝嶅簲瀹㈡埛绔姹傞渶瑕佺紪鐮
+ }
+
+ if(is_http_tunnel)
+ {
+ send_tunnel_ok(client_sock);
+ }
+
+ forward_data(remote_sock, client_sock);
+ exit(0);
+ }
+
+ close(remote_sock);
+ close(client_sock);
+}
+
+void forward_header(int destination_sock)
+{
+ rewrite_header();
+ #ifdef DEBUG
+ LOG("================ The Forward HEAD =================");
+ LOG("%s\n",header_buffer);
+ #endif
+
+ int len = strlen(header_buffer);
+ send_data(destination_sock,header_buffer,len) ;
+}
+
+int send_data(int socket,char * buffer,int len)
+{
+
+ if(io_flag == W_S_ENC)
+ {
+ int i;
+ for(i = 0; i < len ; i++)
+ {
+ buffer[i] ^= 1;
+
+ }
+ }
+
+ return send(socket,buffer,len,0);
+}
+
+int receive_data(int socket, char * buffer, int len)
+{
+ int n = recv(socket, buffer, len, 0);
+ if(io_flag == R_C_DEC && n > 0)
+ {
+ int i;
+ for(i = 0; i< n; i++ )
+ {
+ buffer[i] ^= 1;
+ // printf("%d => %d\n",c,buffer[i]);
+ }
+ }
+
+ return n;
+}
+
+
+
+/* 浠ｇ悊涓殑瀹屾暣URL杞彂鍓嶉渶鏀规垚 path 鐨勫舰寮 */
+void rewrite_header()
+{
+ char * p = strstr(header_buffer,"http://");
+ char * p0 = strchr(p,'\0');
+ char * p5 = strstr(header_buffer,"HTTP/"); /* "HTTP/" 鏄崗璁爣璇 濡 "HTTP/1.1" */
+ int len = strlen(header_buffer);
+ if(p)
+ {
+ char * p1 = strchr(p + 7,'/');
+ if(p1 && (p5 > p1))
+ {
+ //杞崲url鍒 path
+ memcpy(p,p1,(int)(p0 -p1));
+ int l = len - (p1 - p) ;
+ header_buffer[l] = '\0';
+
+
+ } else
+ {
+ char * p2 = strchr(p,' '); //GET http://3g.sina.com.cn HTTP/1.1
+
+ // printf("%s\n",p2);
+ memcpy(p + 1,p2,(int)(p0-p2));
+ *p = '/'; //url 娌℃湁璺緞浣跨敤鏍
+ int l = len - (p2 - p ) + 1;
+ header_buffer[l] = '\0';
+
+ }
+ }
+
+
+ if(m_flag)
+ {
+ char * p6 = strstr(header_buffer,"Host:"); //...\r\nHost: miguvod.lovev.com:8080\r\nLbxx: tiny.cc\r\n....
+ char * p00 = strchr(p6,'\0'); // p6 p7 p8 p9 p00
+ char * p7 = strchr(p6,' ');
+ char * p8 = strstr(header_buffer,m_s);
+ char * p9 = strchr(p8,' ');
+ if(p6)
+ {
+ if(p8 && (p8 > p6))
+ {
+ memcpy(p7,p9,(int)(p00 -p9)); //浠bxx鐨勫艰鐩朒ost鐨勫硷紝杩欒姹侺bxx鍦ㄦā寮忎腑瑕佺揣璺熷湪Host鍚庨潰(浠呭http)
+ int l = len - (p9 - p7) ;
+ header_buffer[l] = '\0';
+ }
+ }
+ }
+}
+
+
+void forward_data(int source_sock, int destination_sock) {
+ char buffer[BUF_SIZE];
+ int n;
+
+ while ((n = receive_data(source_sock, buffer, BUF_SIZE)) > 0)
+ {
+
+ send_data(destination_sock, buffer, n);
+ }
+
+ shutdown(destination_sock, SHUT_RDWR);
+
+ shutdown(source_sock, SHUT_RDWR);
+}
+
+
+
+int create_connection() {
+ struct sockaddr_in server_addr;
+ struct hostent *server;
+ int sock;
+
+ if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+ return CLIENT_SOCKET_ERROR;
+ }
+
+ if ((server = gethostbyname(remote_host)) == NULL) {
+ errno = EFAULT;
+ return CLIENT_RESOLVE_ERROR;
+ }
+ LOG("======= forward request to remote host:%s port:%d ======= \n",remote_host,remote_port);
+ memset(&server_addr, 0, sizeof(server_addr));
+ server_addr.sin_family = AF_INET;
+ memcpy(&server_addr.sin_addr.s_addr, server->h_addr, server->h_length);
+ server_addr.sin_port = htons(remote_port);
+
+ if (connect(sock, (struct sockaddr *) &server_addr, sizeof(server_addr)) < 0) {
+ return CLIENT_CONNECT_ERROR;
+ }
+
+ return sock;
+}
+
+
+int create_server_socket(int port) {
+ int server_sock, optval;
+ struct sockaddr_in server_addr;
+
+ if ((server_sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+ return SERVER_SOCKET_ERROR;
+ }
+
+ if (setsockopt(server_sock, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval)) < 0) {
+ return SERVER_SETSOCKOPT_ERROR;
+ }
+
+ memset(&server_addr, 0, sizeof(server_addr));
+ server_addr.sin_family = AF_INET;
+ server_addr.sin_port = htons(port);
+ server_addr.sin_addr.s_addr = INADDR_ANY;
+
+ if (bind(server_sock, (struct sockaddr*)&server_addr, sizeof(server_addr)) != 0) {
+ return SERVER_BIND_ERROR;
+ }
+
+ if (listen(server_sock, 20) < 0) {
+ return SERVER_LISTEN_ERROR;
+ }
+
+ return server_sock;
+}
+
+/* 澶勭悊鍍靛案杩涚▼ */
+void sigchld_handler(int signal) {
+ while (waitpid(-1, NULL, WNOHANG) > 0);
+}
+
+void server_loop() {
+ struct sockaddr_in client_addr;
+ socklen_t addrlen = sizeof(client_addr);
+
+ while (1) {
+ client_sock = accept(server_sock, (struct sockaddr*)&client_addr, &addrlen);
+
+ if (fork() == 0) { // 鍒涘缓瀛愯繘绋嬪鐞嗗鎴风杩炴帴璇锋眰
+ close(server_sock);
+ handle_client(client_sock, client_addr);
+ exit(0);
+ }
+ close(client_sock);
+ }
+
+}
+
+void stop_server()
+{
+ kill(m_pid, SIGKILL);
+}
+
+void usage(void)
+{
+ printf("Usage:\n");
+ printf(" -l specifyed local listen port \n");
+ printf(" -h specifyed next hop server name to forward all trafic unhandled, prior to -m & -r\n");
+ printf(" -r specifyed server name to forward 'HTTP'&'CONNECT' to, no matter what host is\n");
+ printf(" -m specifyed key words replaced & recognized as 'Host:' function, prior to -r\n");
+ printf(" -d run as daemon\n");
+ printf(" -E encode data when forwarding data\n");
+ printf(" -D decode data when receiving data\n");
+ printf(" Notice:-h -r -m can not be used together.\n");
+ exit (8);
+}
+
+void start_server(int daemon)
+{
+ //鍒濆鍖栧叏灞鍙橀噺
+ header_buffer = (char *) malloc(MAX_HEADER_SIZE);
+
+ signal(SIGCHLD, sigchld_handler); // 闃叉瀛愯繘绋嬪彉鎴愬兊灏歌繘绋
+
+ if ((server_sock = create_server_socket(local_port)) < 0)
+ { // start server
+ LOG("Cannot run server on %d\n",local_port);
+ exit(server_sock);
+ }
+
+ if(daemon)
+ {
+ pid_t pid;
+ if((pid = fork()) == 0)
+ {
+ server_loop();
+ } else if (pid > 0 )
+ {
+ m_pid = pid;
+ LOG("mporxy pid is: [%d]\n",pid);
+ close(server_sock);
+ } else
+ {
+ LOG("Cannot daemonize\n");
+ exit(pid);
+ }
+
+ } else
+ {
+ server_loop();
+ }
+
+}
+
+int main(int argc, char *argv[])
+{
+ return _main(argc,argv);
+}
+
+int _main(int argc, char *argv[])
+{
+ local_port = DEFAULT_LOCAL_PORT;
+ io_flag = FLG_NONE;
+ r_flag = 0;
+ m_flag = 0;
+ //m_s = "DEFAULT_M_S";
+ int daemon = 0;
+
+ char info_buf[2048];
+
+ int opt;
+ char optstrs[] = ":l:h:r:m:dED";
+ char *p = NULL;
+ while(-1 != (opt = getopt(argc, argv, optstrs)))
+ {
+ switch(opt)
+ {
+ case 'l':
+ local_port = atoi(optarg);
+ break;
+ case 'h':
+ p = strchr(optarg, ':');
+ if(p)
+ {
+ strncpy(remote_host, optarg, p - optarg);
+ remote_port = atoi(p+1);
+ }
+ else
+ {
+ strncpy(remote_host, optarg, strlen(optarg));
+ remote_port = DEFAULT_REMOTE_PORT;
+ }
+ break;
+ case 'r':
+ p = strchr(optarg, ':');
+ if(p)
+ {
+ strncpy(r_h, optarg, p - optarg);
+ r_p = atoi(p+1);
+ }
+ else
+ {
+ strncpy(r_h, optarg, strlen(optarg));
+ r_p = DEFAULT_R_P;
+ }
+ printf("Your forward server is: %s:%d\n",r_h,r_p);
+ r_flag = 1;
+ break;
+ case 'm':
+ strncpy(m_s, optarg, strlen(optarg));
+ printf("Your sting is: %s\n",m_s);
+ m_flag = 1;
+ break;
+ case 'd':
+ daemon = 1;
+ break;
+ case 'E':
+ io_flag = W_S_ENC;
+ break;
+ case 'D':
+ io_flag = R_C_DEC;
+ break;
+ case ':':
+ printf("\nMissing argument after: -%c\n", optopt);
+ usage();
+ case '?':
+ printf("\nInvalid argument: %c\n", optopt);
+ default:
+ usage();
+ }
+ }
+
+ get_info(info_buf);
+ LOG("%s\n",info_buf);
+ start_server(daemon);
+ return 0;
+
+}
diff --git a/package/lean/openwrt-shadowsocksR-libev-full b/package/lean/openwrt-shadowsocksR-libev-full
new file mode 160000
index 000000000..6993a4a1c
--- /dev/null
+++ b/package/lean/openwrt-shadowsocksR-libev-full
@@ -0,0 +1 @@
+Subproject commit 6993a4a1ca6e6fd07700cf70a0580b4fcf1eb2c0
diff --git a/package/lean/openwrt-vlmcsd b/package/lean/openwrt-vlmcsd
new file mode 160000
index 000000000..68ad9fba5
--- /dev/null
+++ b/package/lean/openwrt-vlmcsd
@@ -0,0 +1 @@
+Subproject commit 68ad9fba57c70aba1d329c5b84e908557323ed5d
diff --git a/package/lean/pdnsd-alt/Makefile b/package/lean/pdnsd-alt/Makefile
new file mode 100644
index 000000000..c1b86bd80
--- /dev/null
+++ b/package/lean/pdnsd-alt/Makefile
@@ -0,0 +1,55 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=pdnsd
+PKG_VERSION:=1.2.9a-par
+PKG_RELEASE=$(PKG_SOURCE_VERSION)
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=git://gitorious.org/pdnsd/pdnsd.git
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+PKG_SOURCE_VERSION:=a8e46ccba7b0fa2230d6c42ab6dcd92926f6c21d
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
+# PKG_MIRROR_MD5SUM:=
+# CMAKE_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/pdnsd-alt
+ SECTION:=net
+ CATEGORY:=Network
+ SUBMENU:=Web Servers/Proxies
+ DEPENDS:=+libpthread
+ TITLE:=Proxy DNS Server
+endef
+
+define Package/pdnsd-alt/description
+ pdnsd, is an IPv6 capable proxy DNS server with permanent caching (the cache
+ contents are written to hard disk on exit) that is designed to cope with
+ unreachable or down DNS servers (for example in dial-in networking).
+
+ pdnsd can be used with applications that do dns lookups, eg on startup, and
+ can't be configured to change that behaviour, to prevent the often
+ minute-long hangs (or even crashes) that result from stalled dns queries.
+endef
+
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
+#TARGET_CFLAGS += -ggdb3
+
+CMAKE_OPTIONS += -DDEBUG=1
+
+CONFIGURE_ARGS += \
+ --with-cachedir=/var/pdnsd
+
+define Package/pdnsd-alt/install
+ $(INSTALL_DIR) $(1)/usr/sbin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/pdnsd $(1)/usr/sbin/
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/pdnsd-ctl/pdnsd-ctl $(1)/usr/bin/
+
+ #$(INSTALL_DIR) $(1)/etc/init.d
+ #$(INSTALL_BIN) ./files/pdnsd.init $(1)/etc/init.d/pdnsd
+ $(INSTALL_DIR) $(1)/etc
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/doc/pdnsd.conf $(1)/etc/
+endef
+
+$(eval $(call BuildPackage,pdnsd-alt))
diff --git a/package/lean/pdnsd-alt/files/pdnsd.init b/package/lean/pdnsd-alt/files/pdnsd.init
new file mode 100644
index 000000000..e678d8d6a
--- /dev/null
+++ b/package/lean/pdnsd-alt/files/pdnsd.init
@@ -0,0 +1,46 @@
+#!/bin/sh /etc/rc.common
+
+START=65
+NAME=pdnsd
+DESC="proxy DNS server"
+
+DAEMON=/usr/sbin/pdnsd
+PID_FILE=/var/run/$NAME.pid
+CACHEDIR=/var/pdnsd
+CACHE=$CACHEDIR/pdnsd.cache
+
+USER=nobody
+GROUP=nogroup
+
+start() {
+ echo -n "Starting $DESC: $NAME"
+
+ gen_cache
+
+ $DAEMON --daemon -p $PID_FILE
+ echo " ."
+}
+
+stop() {
+ echo -n "Stopping $DESC: $NAME"
+ kill `cat $PID_FILE` > /dev/null 2>&1
+ rm -rf $PID_FILE
+ echo " ."
+}
+
+restart() {
+ echo "Restarting $DESC: $NAME... "
+ stop
+ sleep 2
+ start
+}
+
+gen_cache()
+{
+ if ! test -f "$CACHE"; then
+ mkdir -p `dirname $CACHE`
+ dd if=/dev/zero of="$CACHE" bs=1 count=4 2> /dev/null
+ chown -R $USER.$GROUP $CACHEDIR
+ fi
+}
+