Add Brook and luci-app-brook-pro package

2025-04-19 03:43:29 +00:00 · 2018-02-27 22:47:21 +08:00 · 2018-02-27 22:47:21 +08:00 · 28931fea7f
commit 28931fea7f
parent 17e53ca22f
20 changed files with 3822 additions and 0 deletions
--- a/package/lean/brook/Makefile
+++ b/package/lean/brook/Makefile
@ -0,0 +1,59 @@
+#
+# Copyright (C) 2015-2016 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v3.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=brook
+PKG_VERSION:=1.0
+PKG_RELEASE:=20180227
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/$(PKG_NAME)
+	SECTION:=net
+	CATEGORY:=Network
+	TITLE:=Brook is a cross-platform proxy software
+	DEPENDS:=
+	URL:=https://github.com/txthinking/brook
+endef
+
+define Package/$(PKG_NAME)/description
+Brook is a cross-platform proxy software
+endef
+
+define Build/Prepare
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/$(PKG_NAME)/install
+	$(INSTALL_DIR) $(1)/usr/bin
+
+ifeq ($(ARCH),mipsel)
+	$(INSTALL_BIN) ./files/7620n/brook $(1)/usr/bin/
+endif
+ifeq ($(ARCH),mips)
+	$(INSTALL_BIN) ./files/ar71xx/brook $(1)/usr/bin/
+endif
+ifeq ($(ARCH),i386)
+	$(INSTALL_BIN) ./files/x86/brook $(1)/usr/bin/
+endif
+ifeq ($(ARCH),x86_64)
+	$(INSTALL_BIN) ./files/x86_64/brook $(1)/usr/bin/
+endif
+ifeq ($(ARCH),arm)
+	$(INSTALL_BIN) ./files/arm/brook $(1)/usr/bin/
+endif
+ifeq ($(ARCH),aarch64)
+	$(INSTALL_BIN) ./files/armv7/brook $(1)/usr/bin/
+endif
+endef
+
+$(eval $(call BuildPackage,$(PKG_NAME)))
--- a/package/lean/brook/files/7620n/brook
+++ b/package/lean/brook/files/7620n/brook
--- a/package/lean/brook/files/ar71xx/brook
+++ b/package/lean/brook/files/ar71xx/brook
--- a/package/lean/brook/files/arm/brook
+++ b/package/lean/brook/files/arm/brook
--- a/package/lean/brook/files/armv7/brook
+++ b/package/lean/brook/files/armv7/brook
--- a/package/lean/brook/files/x86/brook
+++ b/package/lean/brook/files/x86/brook
--- a/package/lean/brook/files/x86_64/brook
+++ b/package/lean/brook/files/x86_64/brook
--- a/package/lean/luci-app-brook-pro/Makefile
+++ b/package/lean/luci-app-brook-pro/Makefile
@ -0,0 +1,18 @@
+# Copyright (C) 2016 Openwrt.org
+#
+# This is free software, licensed under the Apache License, Version 2.0 .
+#
+
+include $(TOPDIR)/rules.mk
+
+LUCI_TITLE:=LuCI support for Brook
+LUCI_DEPENDS:=+iptables-mod-tproxy +kmod-ipt-tproxy +ip +ipset-lists +brook +pdnsd-alt +coreutils +coreutils-base64 +coreutils-nohup +dnsmasq-full
+LUCI_PKGARCH:=all
+PKG_VERSION:=1.0
+PKG_RELEASE:=2
+
+include $(TOPDIR)/feeds/luci/luci.mk
+
+# call BuildPackage - OpenWrt buildroot signature
+
+
--- a/package/lean/luci-app-brook-pro/luasrc/controller/brook.lua
+++ b/package/lean/luci-app-brook-pro/luasrc/controller/brook.lua
@ -0,0 +1,9 @@
+module("luci.controller.brook", package.seeall)
+function index()
+		if not nixio.fs.access("/etc/config/brook") then
+		return
+	end
+	local page
+	page = entry({"admin", "services", "brook"}, cbi("brook"), _("Brook Pro"))
+	page.dependent = true
+end
--- a/package/lean/luci-app-brook-pro/luasrc/model/cbi/brook.lua
+++ b/package/lean/luci-app-brook-pro/luasrc/model/cbi/brook.lua
@ -0,0 +1,180 @@
+
+local fs = require "nixio.fs"
+local NXFS = require "nixio.fs"
+local WLFS = require "nixio.fs"
+local SYS  = require "luci.sys"
+local ND = SYS.exec("cat /etc/gfwlist/china-banned | wc -l")
+local conf = "/etc/brook/base-gfwlist.txt"
+local watch = "/tmp/brook_watchdog.log"
+local dog = "/tmp/brookpro.log"
+
+local Status
+
+if SYS.call("pidof brook > /dev/null") == 0 then
+	Status = translate("<strong><font color=\"green\">Brook is Running</font></strong>")
+else
+	Status = translate("<strong><font color=\"red\">Brook is Not Running</font></strong>")
+end
+
+m = Map("brook")
+m.title	= translate("Brook Transparent Proxy")
+m.description = translate("A fast secure tunnel proxy that help you get through firewalls on your router")
+
+s = m:section(TypedSection, "brook")
+s.anonymous = true
+s.description = translate(string.format("%s<br /><br />", Status))
+
+-- ---------------------------------------------------
+
+s:tab("basic",  translate("Base Setting"))
+
+
+switch = s:taboption("basic",Flag, "enabled", translate("Enable"))
+switch.rmempty = false
+
+proxy_mode = s:taboption("basic",ListValue, "proxy_mode", translate("Proxy Mode"))
+proxy_mode:value("M", translate("Base on GFW-List Auto Proxy Mode(Recommend)"))
+proxy_mode:value("S", translate("Bypassing China Manland IP Mode(Be caution when using P2P download！)"))
+proxy_mode:value("G", translate("Global Mode"))
+proxy_mode:value("V", translate("Overseas users watch China video website Mode"))
+
+cronup = s:taboption("basic", Flag, "cron_mode", translate("Auto Update GFW-List"),
+	translate(string.format("GFW-List Lines： <strong><font color=\"blue\">%s</font></strong> Lines", ND)))
+cronup.default = 0
+cronup.rmempty = false
+
+updatead = s:taboption("basic", Button, "updatead", translate("Manually force update GFW-List"), translate("Note: It needs to download and convert the rules. The background process may takes 60-120 seconds to run. <br / > After completed it would automatically refresh, please do not duplicate click!"))
+updatead.inputtitle = translate("Manually force update GFW-List")
+updatead.inputstyle = "apply"
+updatead.write = function()
+	SYS.call("nohup sh /etc/brook/up-gfwlist.sh > /tmp/gfwupdate.log 2>&1 &")
+end
+
+safe_dns_tcp = s:taboption("basic",Flag, "safe_dns_tcp", translate("DNS uses TCP"),
+	translate("Through the server transfer mode inquires DNS pollution prevention (Safer and recommended)"))
+safe_dns_tcp.rmempty = false
+-- safe_dns_tcp:depends("more", "1")
+
+-- more_opt = s:taboption("basic",Flag, "more", translate("More Options"),
+-- 	translate("Options for advanced users"))
+
+-- timeout = s:taboption("basic",Value, "timeout", translate("Timeout"))
+-- timeout.datatype = "range(0,10000)"
+-- timeout.placeholder = "60"
+-- timeout.optional = false
+-- timeout:depends("more", "1")
+
+-- safe_dns = s:taboption("basic",Value, "safe_dns", translate("Safe DNS"),
+-- 	translate("8.8.8.8 or 8.8.4.4 is recommended"))
+-- safe_dns.datatype = "ip4addr"
+-- safe_dns.optional = false
+-- safe_dns:depends("more", "1")
+
+-- safe_dns_port = s:taboption("basic",Value, "safe_dns_port", translate("Safe DNS Port"),
+-- 	translate("Foreign DNS on UDP port 53 might be polluted"))
+-- safe_dns_port.datatype = "range(1,65535)"
+-- safe_dns_port.placeholder = "53"
+-- safe_dns_port.optional = false
+-- safe_dns_port:depends("more", "1")
+
+--fast_open =s:taboption("basic",Flag, "fast_open", translate("TCP Fast Open"),
+--	translate("Enable TCP fast open, only available on kernel > 3.7.0"))
+
+
+
+s:tab("main",  translate("Server Setting"))
+
+server = s:taboption("main",Value, "server", translate("Server Address"))
+server.optional = false
+server.datatype = "host"
+server.rmempty = false
+
+server_port = s:taboption("main",Value, "server_port", translate("Server Port"))
+server_port.datatype = "range(1,65535)"
+server_port.optional = false
+server_port.rmempty = false
+
+password = s:taboption("main",Value, "password", translate("Password"))
+password.password = true
+
+s:tab("list",  translate("User-defined GFW-List"))
+gfwlist = s:taboption("list", TextValue, "conf")
+gfwlist.description = translate("<br />（!）Note: When the domain name is entered and will automatically merge with the online GFW-List. Please manually update the GFW-List list after applying.")
+gfwlist.rows = 13
+gfwlist.wrap = "off"
+gfwlist.cfgvalue = function(self, section)
+	return NXFS.readfile(conf) or ""
+end
+gfwlist.write = function(self, section, value)
+	NXFS.writefile(conf, value:gsub("\r\n", "\n"))
+end
+
+local addipconf = "/etc/brook/addinip.txt"
+
+s:tab("addip",  translate("GFW-List Add-in IP"))
+gfwaddin = s:taboption("addip", TextValue, "addipconf")
+gfwaddin.description = translate("<br />（!）Note: IP add-in to GFW-List. Such as Telegram Messenger")
+gfwaddin.rows = 13
+gfwaddin.wrap = "off"
+gfwaddin.cfgvalue = function(self, section)
+	return NXFS.readfile(addipconf) or ""
+end
+gfwaddin.write = function(self, section, value)
+	NXFS.writefile(addipconf, value:gsub("\r\n", "\n"))
+end
+
+s:tab("status",  translate("Status and Tools"))
+s:taboption("status", DummyValue,"opennewwindow" , 
+	translate("<input type=\"button\" class=\"cbi-button cbi-button-apply\" value=\"IP111.CN\" onclick=\"window.open('http://www.ip111.cn/')\" />"))
+
+
+s:tab("watchdog",  translate("Watchdog Log"))
+log = s:taboption("watchdog", TextValue, "sylogtext")
+log.template = "cbi/tvalue"
+log.rows = 13
+log.wrap = "off"
+log.readonly="readonly"
+
+function log.cfgvalue(self, section)
+  SYS.exec("[ -f /tmp/brook_watchdog.log ] && sed '1!G;h;$!d' /tmp/brook_watchdog.log > /tmp/brookpro.log")
+	return nixio.fs.readfile(dog)
+end
+
+function log.write(self, section, value)
+	value = value:gsub("\r\n?", "\n")
+	nixio.fs.writefile(dog, value)
+end
+
+
+
+t=m:section(TypedSection,"acl_rule",translate("<strong>Client Proxy Mode Settings</strong>"),
+translate("Proxy mode settings can be set to specific LAN clients ( <font color=blue> No Proxy, Global Proxy, Game Mode</font>) . Does not need to be set by default."))
+t.template="cbi/tblsection"
+t.sortable=true
+t.anonymous=true
+t.addremove=true
+e=t:option(Value,"ipaddr",translate("IP Address"))
+e.width="40%"
+e.datatype="ip4addr"
+e.placeholder="0.0.0.0/0"
+luci.ip.neighbors({ family = 4 }, function(entry)
+	if entry.reachable then
+		e:value(entry.dest:string())
+	end
+end)
+
+e=t:option(ListValue,"filter_mode",translate("Proxy Mode"))
+e.width="40%"
+e.default="disable"
+e.rmempty=false
+e:value("disable",translate("No Proxy"))
+e:value("global",translate("Global Proxy"))
+e:value("game",translate("Game Mode"))
+
+-- ---------------------------------------------------
+local apply = luci.http.formvalue("cbi.apply")
+if apply then
+	os.execute("/etc/init.d/brookpro restart >/dev/null 2>&1 &")
+end
+
+return m
--- a/package/lean/luci-app-brook-pro/po/zh-cn/brook.po
+++ b/package/lean/luci-app-brook-pro/po/zh-cn/brook.po
@ -0,0 +1,114 @@
+msgid "<strong><font color=\"green\">Brook is Running</font></strong>"
+msgstr "<strong><font color=\"green\">Brook 正在运行</font></strong>"
+
+msgid "<strong><font color=\"red\">Brook is Not Running</font></strong>"
+msgstr "<strong><font color=\"red\">Brook 没有运行</font></strong>"
+
+msgid "Brook Transparent Proxy"
+msgstr "Brook 透明代理"
+
+msgid "A fast secure tunnel proxy that help you get through firewalls on your router"
+msgstr "一个快速安全隧道代理，帮助您穿过防火墙"
+
+msgid "Base Setting"
+msgstr "基本设置"
+
+msgid "Proxy Mode"
+msgstr "代理模式"
+
+msgid "Base on GFW-List Auto Proxy Mode(Recommend)"
+msgstr "基于GFW-List自动代理(推荐)"
+
+msgid "Bypassing China Manland IP Mode(Be caution when using P2P download！)"
+msgstr "绕过中国大陆IP地址(P2P 下载慎用！)"
+
+msgid "Global Mode"
+msgstr "全局代理"
+
+msgid "Overseas users watch China video website Mode"
+msgstr "海外用户回国看视频"
+
+msgid "Auto Update GFW-List"
+msgstr "自动更新GFW-List"
+
+msgid "Manually force update GFW-List"
+msgstr "手动强制更新GFW-List"
+
+msgid "DNS uses TCP"
+msgstr "启用DNS TCP防污染"
+
+msgid "Through the server transfer mode inquires DNS pollution prevention (Safer and recommended)"
+msgstr "往国外的DNS请求将通过服务器中转发出（更安全，推荐）"
+
+msgid "Server Setting"
+msgstr "服务器设置"
+
+msgid "Server Address"
+msgstr "服务器地址（支持域名）"
+
+msgid "Server Port"
+msgstr "服务器端口"
+
+msgid "Password"
+msgstr "密码"
+
+msgid "Encryption Method"
+msgstr "加密"
+
+msgid "Protocol"
+msgstr "协议"
+
+msgid "Protocol Param"
+msgstr "协议参数"
+
+msgid "Obfs Param"
+msgstr "混淆"
+
+msgid "Plug-in parameters"
+msgstr "插件参数"
+
+msgid "Confusing plug-in parameters"
+msgstr "混淆参数"
+
+msgid "Incorrect use of this parameter will cause IP to be blocked. Please use it with care"
+msgstr "不正确的使用参数可能会导致IP被封，请注意使用"
+
+msgid "User-defined GFW-List"
+msgstr "用户自定义GFW-List"
+
+msgid "<br />（!）Note: When the domain name is entered and will automatically merge with the online GFW-List. Please manually update the GFW-List list after applying."
+msgstr "用户自定义GFW-List将会和自动更新的自动合并。如果要新加入域名马上生效，请应用后点击手动强制更新GFW-List"
+
+msgid "Status and Tools"
+msgstr "状态与工具"
+
+msgid "Watchdog Log"
+msgstr "守护日志"
+
+msgid "<strong>Client Proxy Mode Settings</strong>"
+msgstr "<strong>客户端代理模式设置</strong>"
+
+msgid "Proxy mode settings can be set to specific LAN clients ( <font color=blue> No Proxy, Global Proxy, Game Mode</font>) . Does not need to be set by default."
+msgstr "可以为局域网客户端分别设置不同的代理模式 ( <font color=blue> 不代理, 全局代理, 游戏模式</font>).默认无需设置"
+
+msgid "GFW-List Add-in IP"
+msgstr "GFW-List附加IP"
+
+msgid "<br />（!）Note: IP add-in to GFW-List. Such as Telegram Messenger"
+msgstr "<br />（!）注意：有些应用使用IP而不是域名，例如 Telegram Messenger ，您需要把IP地址加入这里"
+
+msgid "No Proxy"
+msgstr "不代理"
+
+msgid "Global Proxy"
+msgstr "全局代理"
+
+msgid "Game Mode"
+msgstr "游戏模式"
+
+
+
+
+
+
+
--- a/package/lean/luci-app-brook-pro/root/etc/brook.include
+++ b/package/lean/luci-app-brook-pro/root/etc/brook.include
@ -0,0 +1,11 @@
+#!/bin/sh
+
+ssr_enable=$(uci get shadowsocksr.@shadowsocksr[0].enabled 2>/dev/null)
+
+if [ $ssr_enable -eq 1 ]; then
+	if pidof ssr-redir>/dev/null; then
+	   /etc/init.d/ssrpro reload
+	 else
+	   /etc/init.d/ssrpro restart
+  fi
+fi
--- a/package/lean/luci-app-brook-pro/root/etc/brook/addinip.txt
+++ b/package/lean/luci-app-brook-pro/root/etc/brook/addinip.txt
@ -0,0 +1,7 @@
+149.154.160.0/20
+149.154.164.0/22 
+149.154.168.0/21 
+67.198.55.0/24 
+91.108.4.0/22 
+91.108.56.0/22 
+109.239.140.0/24 
--- a/package/lean/luci-app-brook-pro/root/etc/brook/base-gfwlist.txt
+++ b/package/lean/luci-app-brook-pro/root/etc/brook/base-gfwlist.txt
--- a/package/lean/luci-app-brook-pro/root/etc/brook/gen-gfwlist.sh
+++ b/package/lean/luci-app-brook-pro/root/etc/brook/gen-gfwlist.sh
@ -0,0 +1,29 @@
+#!/bin/sh -e
+
+generate_china_banned()
+{
+	if [ ! -f /tmp/gfwlist.txt ]; then
+		wget-ssl --no-check-certificate https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt -O /tmp/gfwlist.b64 >&2
+		cat /tmp/gfwlist.b64 | base64 -d > /tmp/gfwlist.txt
+		rm -f /tmp/gfwlist.b64
+	fi
+
+	cat /tmp/gfwlist.txt | sort -u |
+		sed 's#!.\+##; s#|##g; s#@##g; s#http:\/\/##; s#https:\/\/##;' |
+		sed '/\*/d; /apple\.com/d; /sina\.cn/d; /sina\.com\.cn/d; /baidu\.com/d; /byr\.cn/d; /jlike\.com/d; /weibo\.com/d; /zhongsou\.com/d; /youdao\.com/d; /sogou\.com/d; /so\.com/d; /soso\.com/d; /aliyun\.com/d; /taobao\.com/d; /jd\.com/d; /qq\.com/d' |
+		sed '/^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$/d' |
+		grep '^[0-9a-zA-Z\.-]\+$' | grep '\.' | sed 's#^\.\+##' | sort -u |
+		awk '
+BEGIN { prev = "________"; }  {
+	cur = $0;
+	if (index(cur, prev) == 1 && substr(cur, 1 + length(prev) ,1) == ".") {
+	} else {
+		print cur;
+		prev = cur;
+	}
+}' | sort -u
+
+}
+
+
+generate_china_banned
--- a/package/lean/luci-app-brook-pro/root/etc/brook/ssr-watchdog
+++ b/package/lean/luci-app-brook-pro/root/etc/brook/ssr-watchdog
@ -0,0 +1,35 @@
+#!/bin/sh
+
+LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
+#GOOGLE=$(ping -4 www.gstatic.com -c 1 -w 5| sed '1{s/[^(]*(//;s/).*//;q}')
+
+#iptables -t nat -I OUTPUT -p tcp -d $GOOGLE -j REDIRECT --to-port 7070
+
+#sleep 3
+
+/usr/bin/wget --spider --quiet --tries=1 --timeout=3 www.gstatic.com/generate_204
+
+if [ "$?" == "0" ]; then
+	echo '['$LOGTIME'] ShadowsocksR No Problem.'
+else
+	/usr/bin/wget --spider --quiet --tries=1 --timeout=3 www.baidu.com
+	if [ "$?" == "0" ]; then
+		echo '['$LOGTIME'] Problem decteted, restarting ShadowsocksR...'
+		/etc/init.d/ssrpro restart
+	else
+		echo '['$LOGTIME'] Network Problem. Do nothing.'
+	fi
+fi
+
+#sleep 3
+
+#iptables -t nat -D OUTPUT -p tcp -d $GOOGLE -j REDIRECT --to-port 7070
+
+
+
+
+
+
+
+
+
--- a/package/lean/luci-app-brook-pro/root/etc/brook/up-gfwlist.sh
+++ b/package/lean/luci-app-brook-pro/root/etc/brook/up-gfwlist.sh
@ -0,0 +1,21 @@
+#!/bin/sh
+
+/etc/shadowsocksr/gen-gfwlist.sh > /tmp/ol-gfw.txt
+
+if [ -s "/tmp/ol-gfw.txt" ];then
+	sort -u /etc/shadowsocksr/base-gfwlist.txt /tmp/ol-gfw.txt > /tmp/china-banned
+	if ( ! cmp -s /tmp/china-banned /etc/gfwlist/china-banned );then
+		if [ -s "/tmp/china-banned" ];then
+			mv /tmp/china-banned /etc/gfwlist/china-banned
+			echo "Update GFW-List Done!"
+		fi
+	else
+		echo "GFW-List No Change!"
+	fi
+fi
+
+rm -f /tmp/gfwlist.txt
+rm -f /tmp/ol-gfw.txt
+
+/etc/init.d/ssrpro restart
+
--- a/package/lean/luci-app-brook-pro/root/etc/config/brook
+++ b/package/lean/luci-app-brook-pro/root/etc/config/brook
@ -0,0 +1,13 @@
+
+config brook
+	option gfwlist 'china-banned'
+	option server 'serv-ro.ddns.info'
+	option server_port '23143'
+	option password 'test.TEST'
+	option method 'aes-256-cfb'
+	option protocol 'origin'
+	option obfs 'plain'
+	option enabled '0'
+	option proxy_mode 'M'
+	option safe_dns_tcp '1'
+  option cron_mode '1'
--- a/package/lean/luci-app-brook-pro/root/etc/init.d/brookpro
+++ b/package/lean/luci-app-brook-pro/root/etc/init.d/brookpro
@ -0,0 +1,370 @@
+#!/bin/sh /etc/rc.common
+#
+#
+
+START=99
+
+SS_REDIR_PORT=7070
+SS_REDIR_PIDFILE=/var/run/ssr-redir-go.pid 
+PDNSD_LOCAL_PORT=7453
+SSRCONF=/etc/brook.json
+CRON_FILE=/etc/crontabs/root
+CONFIG=brook
+
+
+# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+
+	# $covered_subnets, $local_addresses are not required
+covered_subnets=`uci get brook.@brook[0].covered_subnets 2>/dev/null`
+local_addresses=`uci get brook.@brook[0].local_addresses 2>/dev/null`
+	# Get LAN settings as default parameters
+	[ -f /lib/functions/network.sh ] && . /lib/functions/network.sh
+	[ -z "$covered_subnets" ] && network_get_subnet covered_subnets lan
+	[ -z "$local_addresses" ] && network_get_ipaddr local_addresses lan
+vt_np_ipset="china"  # Must be global variable
+
+__gfwlist_by_mode()
+{
+	case "$1" in
+		V) echo unblock-youku;;
+		*) echo china-banned;;
+	esac
+}
+
+
+
+# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+
+start()
+{
+  local vt_enabled=`uci get brook.@brook[0].enabled 2>/dev/null`
+  local vt_server_addr=`uci get brook.@brook[0].server`
+  local vt_server_port=`uci get brook.@brook[0].server_port`
+  local vt_password=`uci get brook.@brook[0].password 2>/dev/null`
+  local vt_method=`uci get brook.@brook[0].method`
+  local vt_protocol=`uci get brook.@brook[0].protocol`
+  local vt_protoparam=`uci get brook.@brook[0].protoparam 2>/dev/null`
+  local vt_obfs=`uci get brook.@brook[0].obfs`
+  local vt_timeout=`uci get brook.@brook[0].timeout 2>/dev/null`
+  local vt_safe_dns=`uci get brook.@brook[0].safe_dns 2>/dev/null`
+  local vt_safe_dns_port=`uci get brook.@brook[0].safe_dns_port 2>/dev/null`
+  local vt_safe_dns_tcp=`uci get brook.@brook[0].safe_dns_tcp 2>/dev/null`
+  local vt_proxy_mode=`uci get brook.@brook[0].proxy_mode`
+  local obfs_param=`uci get brook.@brook[0].obfs_param 2>/dev/null`
+  local cron_mode=`uci get brook.@brook[0].cron_mode 2>/dev/null`
+  local vt_gfwlist=`__gfwlist_by_mode $vt_proxy_mode`
+
+	[ -f /etc/init.d/pdnsd ] && /etc/init.d/pdnsd disable 2>/dev/null
+
+	# -----------------------------------------------------------------
+	if [ "$vt_enabled" = 0 ]; then
+		echo "WARNING: brook is disabled."
+		return 1
+	fi
+
+	if [ -z "$vt_server_addr" -o -z "$vt_server_port" ]; then
+		echo "WARNING: brook not fully configured, not starting."
+		return 1
+	fi
+
+	[ -z "$vt_proxy_mode" ] && vt_proxy_mode=M
+	[ -z "$vt_method" ] && vt_method=table
+	[ -z "$vt_timeout" ] && vt_timeout=60
+	case "$vt_proxy_mode" in
+		M|S|G)
+			[ -z "$vt_safe_dns" ] && vt_safe_dns="8.8.8.8"
+			[ -z "$vt_safe_dns_tcp" ] && vt_safe_dns_tcp=1
+			;;
+	esac
+	[ -z "$vt_safe_dns_port" ] && vt_safe_dns_port=53
+
+	# -----------------------------------------------------------------
+
+	/usr/bin/brook tproxy -l 127.0.0.1:1080 -s $vt_server_addr:$vt_server_port -p $vt_password &>/dev/null &
+
+	# IPv4 firewall rules
+  add_rule
+  
+	# -----------------------------------------------------------------
+	mkdir -p /var/etc/dnsmasq-go.d
+	###### Anti-pollution configuration ######
+	if [ -n "$vt_safe_dns" ]; then
+		if [ "$vt_safe_dns_tcp" = 1 ]; then
+			start_pdnsd "$vt_safe_dns"
+			awk -vs="127.0.0.1#$PDNSD_LOCAL_PORT" '!/^$/&&!/^#/{printf("server=/%s/%s\n",$0,s)}' \
+				/etc/gfwlist/$vt_gfwlist > /var/etc/dnsmasq-go.d/01-pollution.conf
+		else
+			awk -vs="$vt_safe_dns#$vt_safe_dns_port" '!/^$/&&!/^#/{printf("server=/%s/%s\n",$0,s)}' \
+				/etc/gfwlist/$vt_gfwlist > /var/etc/dnsmasq-go.d/01-pollution.conf
+		fi
+	else
+		echo "WARNING: Not using secure DNS, DNS resolution might be polluted if you are in China."
+	fi
+
+	###### dnsmasq-to-ipset configuration ######
+	case "$vt_proxy_mode" in
+		M|V)
+			awk '!/^$/&&!/^#/{printf("ipset=/%s/'"$vt_gfwlist"'\n",$0)}' \
+				/etc/gfwlist/$vt_gfwlist > /var/etc/dnsmasq-go.d/02-ipset.conf
+			;;
+	esac
+
+	# -----------------------------------------------------------------
+	###### Restart main 'dnsmasq' service if needed ######
+	if ls /var/etc/dnsmasq-go.d/* >/dev/null 2>&1; then
+		mkdir -p /tmp/dnsmasq.d
+		cat > /tmp/dnsmasq.d/dnsmasq-go.conf <<EOF
+conf-dir=/var/etc/dnsmasq-go.d
+EOF
+		/etc/init.d/dnsmasq restart
+
+
+	fi
+	add_cron
+}
+
+stop()
+{
+  
+	# -----------------------------------------------------------------
+	rm -rf /var/etc/dnsmasq-go.d
+	if [ -f /tmp/dnsmasq.d/dnsmasq-go.conf ]; then
+		rm -f /tmp/dnsmasq.d/dnsmasq-go.conf
+		/etc/init.d/dnsmasq restart
+	fi
+
+	stop_pdnsd
+
+	# --STOP IPv4 firewall---------------------------------------------------------------
+  del_rule
+  
+	# -----------------------------------------------------------------
+	if [ -f $SS_REDIR_PIDFILE ]; then
+		kill -9 `cat $SS_REDIR_PIDFILE`
+		rm -f $SS_REDIR_PIDFILE
+	fi
+	killall -9 brook 2>/dev/null
+	del_cron
+}
+
+restart()
+{
+	KEEP_GFWLIST=Y
+	stop
+	start
+}
+
+reload()
+{
+  local vt_enabled=`uci get brook.@brook[0].enabled 2>/dev/null`
+  local vt_server_addr=`uci get brook.@brook[0].server`
+  local vt_server_port=`uci get brook.@brook[0].server_port`
+  local vt_safe_dns=`uci get brook.@brook[0].safe_dns 2>/dev/null`
+  local vt_safe_dns_port=`uci get brook.@brook[0].safe_dns_port 2>/dev/null`
+  local vt_safe_dns_tcp=`uci get brook.@brook[0].safe_dns_tcp 2>/dev/null`
+  local vt_proxy_mode=`uci get brook.@brook[0].proxy_mode`
+  local vt_gfwlist=`__gfwlist_by_mode $vt_proxy_mode`
+	KEEP_GFWLIST=Y
+	del_rule
+	add_rule
+	if [ "$vt_safe_dns_tcp" = 1 ]; then
+    stop_pdnsd
+    start_pdnsd
+	fi
+}
+
+# $1: upstream DNS server
+start_pdnsd()
+{
+	local safe_dns="$1"
+
+	local tcp_dns_list="208.67.222.222, 208.67.220.220"
+	[ -n "$safe_dns" ] && tcp_dns_list="$safe_dns,$tcp_dns_list"
+
+	#killall -9 pdnsd 2>/dev/null && sleep 1
+	kill -9 $(cat /var/run/pdnsd.pid) >/dev/null 2>&1 
+	
+	mkdir -p /var/etc /var/pdnsd
+	if ! test -f "/var/pdnsd/pdnsd.cache"; then
+    dd if=/dev/zero of="/var/pdnsd/pdnsd.cache" bs=1 count=4 2> /dev/null
+    chown -R nobody.nogroup /var/pdnsd
+  fi
+	
+	cat > /var/etc/pdnsd.conf <<EOF
+global {
+	perm_cache=10240;
+	cache_dir="/var/pdnsd";
+	pid_file = /var/run/pdnsd.pid;
+	run_as="nobody";
+	server_ip = 127.0.0.1;
+	server_port = $PDNSD_LOCAL_PORT;
+	status_ctl = on;
+	query_method = tcp_only;
+	min_ttl=1h;
+	max_ttl=1w;
+	timeout=10;
+	neg_domain_pol=on;
+	proc_limit=2;
+	procq_limit=8;
+}
+server {
+	label= "fwxxx";
+	ip = $tcp_dns_list;
+	port = 53;
+	timeout=6;
+	uptest=none;
+	interval=10m;
+	purge_cache=off;
+}
+EOF
+
+	/usr/sbin/pdnsd -c /var/etc/pdnsd.conf -d
+
+	# Access TCP DNS server through brook tunnel
+	if iptables -t nat -N pdnsd_output; then
+		iptables -t nat -A pdnsd_output -m set --match-set $vt_np_ipset dst -j RETURN
+		iptables -t nat -A pdnsd_output -p tcp -j REDIRECT --to $SS_REDIR_PORT
+	fi
+	iptables -t nat -I OUTPUT -p tcp --dport 53 -j pdnsd_output
+}
+
+stop_pdnsd()
+{
+	if iptables -t nat -F pdnsd_output 2>/dev/null; then
+		while iptables -t nat -D OUTPUT -p tcp --dport 53 -j pdnsd_output 2>/dev/null; do :; done
+		iptables -t nat -X pdnsd_output
+	fi
+	killall -9 pdnsd 2>/dev/null
+	rm -rf /var/pdnsd
+	rm -f /var/etc/pdnsd.conf
+}
+
+add_cron()
+{
+  sed -i '/up-gfwlist.sh/d' $CRON_FILE
+	sed -i '/brook_watchdog.log/d' $CRON_FILE
+	if [ $cron_mode -eq 1 ]; then
+		echo '0 5 * * * /etc/brook/up-gfwlist.sh > /tmp/gfwupdate.log 2>&1' >> $CRON_FILE	
+	fi
+	echo '0 */1 * * * /etc/brook/ssr-watchdog >> /tmp/brook_watchdog.log 2>&1' >> $CRON_FILE
+	echo '0 1 * * 0 echo "" > /tmp/brook_watchdog.log' >> $CRON_FILE
+	crontab $CRON_FILE
+}
+
+del_cron()
+{
+	sed -i '/up-gfwlist.sh/d' $CRON_FILE
+	sed -i '/brook_watchdog.log/d' $CRON_FILE
+	/etc/init.d/cron restart
+}
+
+
+
+uci_get_by_name() {
+	local ret=$(uci get $CONFIG.$1.$2 2>/dev/null)
+	echo ${ret:=$3}
+}
+
+uci_get_by_type() {
+	local index=0
+	if [ -n $4 ]; then
+		index=$4
+	fi
+	local ret=$(uci get $CONFIG.@$1[$index].$2 2>/dev/null)
+	echo ${ret:=$3}
+}
+
+add_rule()
+{
+	iptables -t nat -N brook_pre
+	iptables -t nat -F brook_pre
+	iptables -t nat -A brook_pre -m set --match-set local dst -j RETURN || {
+		iptables -t nat -A brook_pre -d 10.0.0.0/8 -j RETURN
+		iptables -t nat -A brook_pre -d 127.0.0.0/8 -j RETURN
+		iptables -t nat -A brook_pre -d 172.16.0.0/12 -j RETURN
+		iptables -t nat -A brook_pre -d 192.168.0.0/16 -j RETURN
+		iptables -t nat -A brook_pre -d 127.0.0.0/8 -j RETURN
+		iptables -t nat -A brook_pre -d 224.0.0.0/3 -j RETURN
+	}
+	iptables -t nat -A brook_pre -d $vt_server_addr -j RETURN
+	
+	iptables -N gameboost -t mangle
+	ipset -! create gameuser hash:ip maxelem 65536 2>/dev/null
+	/usr/bin/ip rule add fwmark 0x01/0x01 table 100
+	/usr/bin/ip route add local 0.0.0.0/0 dev lo table 100
+	iptables -t mangle -A gameboost -p udp -m set --match-set local dst -j RETURN
+	iptables -t mangle -A gameboost -p udp -m set --match-set china dst -j RETURN
+	iptables -t mangle -A gameboost -p udp --dport 53 -j RETURN
+	iptables -t mangle -A gameboost -p udp -j TPROXY --on-port 7070 --tproxy-mark 0x01/0x01
+	iptables -t mangle -A PREROUTING -m set --match-set gameuser src -j gameboost 
+
+	for i in $(seq 0 100)
+	do
+		local ip=$(uci_get_by_type acl_rule ipaddr '' $i)
+		local mode=$(uci_get_by_type acl_rule filter_mode '' $i)
+		case "$mode" in
+		disable)
+			iptables -t nat -A brook_pre -s $ip -j RETURN
+			;;
+		global)
+			iptables -t nat -A brook_pre -s $ip -p tcp -j REDIRECT --to $SS_REDIR_PORT
+			iptables -t nat -A brook_pre -s $ip -j RETURN 
+			;;
+		game)
+			iptables -t nat -A brook_pre -p tcp -s $ip -m set ! --match-set china dst -j REDIRECT --to $SS_REDIR_PORT
+			ipset -! add gameuser $ip
+			;;
+		esac
+	done
+
+	case "$vt_proxy_mode" in
+		G) : ;;
+		S)
+			iptables -t nat -A brook_pre -m set --match-set $vt_np_ipset dst -j RETURN
+			iptables -t nat -I OUTPUT -p tcp -m multiport --dports 80,443 -m set ! --match-set $vt_np_ipset dst -j REDIRECT --to $SS_REDIR_PORT
+			;;
+		M)
+			ipset -! create $vt_gfwlist hash:ip maxelem 65536 2>/dev/null
+      awk '!/^$/&&!/^#/{printf("add vt_gfwlist %s'" "'\n",$0)}' /etc/brook/addinip.txt > /tmp/addinip.ipset
+      sed -i "s/vt_gfwlist/$vt_gfwlist/g" /tmp/addinip.ipset
+      ipset -! restore < /tmp/addinip.ipset
+			iptables -t nat -A brook_pre -m set ! --match-set $vt_gfwlist dst -j RETURN
+			iptables -t nat -A brook_pre -m set --match-set $vt_np_ipset dst -j RETURN
+			iptables -t nat -I OUTPUT -p tcp -m multiport --dports 80,443 -m set --match-set $vt_gfwlist dst -j REDIRECT --to $SS_REDIR_PORT
+			;;
+		V)
+			vt_np_ipset=""
+			ipset -! create $vt_gfwlist hash:ip maxelem 65536 2>/dev/null
+			iptables -t nat -A brook_pre -m set ! --match-set $vt_gfwlist dst -j RETURN
+			;;
+	esac
+	local subnet
+	for subnet in $covered_subnets; do
+		iptables -t nat -A brook_pre -s $subnet -p tcp -j REDIRECT --to $SS_REDIR_PORT
+	done
+	iptables -t nat -I PREROUTING -p tcp -j brook_pre
+}
+
+del_rule()
+{
+	if iptables -t nat -F brook_pre 2>/dev/null; then
+		while iptables -t nat -D PREROUTING -p tcp -j brook_pre 2>/dev/null; do :; done
+		iptables -t nat -X brook_pre 2>/dev/null
+	fi
+	
+	iptables -t nat -D OUTPUT -p tcp -m multiport --dports 80,443 -m set --match-set china-banned dst -j REDIRECT --to $SS_REDIR_PORT 2>/dev/null
+	iptables -t nat -D OUTPUT -p tcp -m multiport --dports 80,443 -m set ! --match-set $vt_np_ipset dst -j REDIRECT --to $SS_REDIR_PORT 2>/dev/null
+	
+	/usr/bin/ip rule del fwmark 0x01/0x01 table 100
+	/usr/bin/ip route del local 0.0.0.0/0 dev lo table 100
+	if iptables -t mangle -F gameboost 2>/dev/null; then
+		while iptables -t mangle -D PREROUTING -m set --match-set gameuser src -j gameboost 2>/dev/null; do :; done
+		iptables -t mangle -X gameboost 2>/dev/null
+	fi
+
+	ipset destroy gameuser 2>/dev/null
+
+
+	# -----------------------------------------------------------------
+	[ "$KEEP_GFWLIST" = Y ] || ipset destroy "$vt_gfwlist" 2>/dev/null
+}
--- a/package/lean/luci-app-brook-pro/root/etc/uci-defaults/brook
+++ b/package/lean/luci-app-brook-pro/root/etc/uci-defaults/brook
@ -0,0 +1,16 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+	delete firewall.shadowsocksr
+	set firewall.shadowsocksr=include
+	set firewall.shadowsocksr.type=script
+	set firewall.shadowsocksr.path=/etc/shadowsocksr.include
+	set firewall.shadowsocksr.reload=1
+	commit firewall
+EOF
+
+/etc/init.d/shadowsocksr stop
+/etc/init.d/shadowsocksr disable
+
+rm -f /tmp/luci-indexcache
+exit 0