feat: add mixed proxy support for AmneziaWG sections and allow UDP on tunnel endpoints

luci-app-tachyon/htdocs/luci-static/resources/view/tachyon/section.js

@@ -9917,6 +9917,7 @@ function createSectionContent(section) {
   o.default = "0";
   o.rmempty = false;
   o.depends("action", "connection");
+  o.depends("action", "awg");
   o.depends("action", "byedpi");
   o.depends("action", "zapret");
   o.depends("action", "zapret2");
@@ -9931,6 +9932,7 @@ function createSectionContent(section) {
   );
   o.rmempty = false;
   o.depends({ action: "connection", mixed_proxy_enabled: "1" });
+  o.depends({ action: "awg", mixed_proxy_enabled: "1" });
   o.depends({ action: "byedpi", mixed_proxy_enabled: "1" });
   o.depends({ action: "zapret", mixed_proxy_enabled: "1" });
   o.depends({ action: "zapret2", mixed_proxy_enabled: "1" });
@@ -9958,6 +9960,7 @@ function createSectionContent(section) {
   o.default = "0";
   o.rmempty = false;
   o.depends({ action: "connection", mixed_proxy_enabled: "1" });
+  o.depends({ action: "awg", mixed_proxy_enabled: "1" });
   o.depends({ action: "byedpi", mixed_proxy_enabled: "1" });
   o.depends({ action: "zapret", mixed_proxy_enabled: "1" });
   o.depends({ action: "zapret2", mixed_proxy_enabled: "1" });
@@ -9975,6 +9978,11 @@ function createSectionContent(section) {
     mixed_proxy_enabled: "1",
     mixed_proxy_auth_enabled: "1",
   });
+  o.depends({
+    action: "awg",
+    mixed_proxy_enabled: "1",
+    mixed_proxy_auth_enabled: "1",
+  });
   o.depends({
     action: "byedpi",
     mixed_proxy_enabled: "1",
@@ -10011,6 +10019,11 @@ function createSectionContent(section) {
     mixed_proxy_enabled: "1",
     mixed_proxy_auth_enabled: "1",
   });
+  o.depends({
+    action: "awg",
+    mixed_proxy_enabled: "1",
+    mixed_proxy_auth_enabled: "1",
+  });
   o.depends({
     action: "byedpi",
     mixed_proxy_enabled: "1",

tachyon/files/usr/lib/service/state.uc

@@ -1366,7 +1366,7 @@ function append_sing_box_rule_signature_body(body, section, sections) {
         body = signature_add_mixed_proxy_body(body, section, prefix);
         body = signature_add_value(body, prefix + ".resolve_real_ip_for_routing", "1");
     }
-    else if (action == "zapret" || action == "zapret2") {
+    else if (action == "zapret" || action == "zapret2" || action == "awg") {
         body = signature_add_mixed_proxy_body(body, section, prefix);
     }
     else if (action == "dns") {

tachyon/files/usr/lib/singbox/generator_routes.uc

@@ -1237,6 +1237,10 @@ function outbound_supports_udp(config, tag_name, visited) {
             return true;
         }
     }
+    for (let ep in (config.endpoints || [])) {
+        if (as_string(ep.tag) == tag_name)
+            return true;
+    }
     return false;
 }
 

tests/server_awg.sh

@@ -116,7 +116,12 @@ cat >"$WORK_DIR/awg_fixture.json" <<'JSON'
       "awg_local_address": ["10.0.0.2/32"],
       "awg_keepalive": "25-35",
       "awg_random_trailers": "1",
-      "awg_disable_cookies": "1"
+      "awg_disable_cookies": "1",
+      "mixed_proxy_enabled": "1",
+      "mixed_proxy_port": "2085",
+      "mixed_proxy_auth_enabled": "1",
+      "mixed_proxy_username": "awguser",
+      "mixed_proxy_password": "awgpass"
     }
   ]
 }
@@ -138,6 +143,19 @@ grep -q '"jc": 5' "$out_json" || fail "sing-box config missing amnezia jc parame
 grep -q '"s1": 15' "$out_json" || fail "sing-box config missing amnezia s1 parameter"
 grep -q '"h1": 100' "$out_json" || fail "sing-box config missing amnezia h1 parameter"
 
+# Check AWG mixed proxy inbound and route
+grep -q '"tag": "my_awg_section-mixed-in"' "$out_json" || fail "sing-box config missing my_awg_section-mixed-in tag"
+grep -q '"listen_port": 2085' "$out_json" || fail "sing-box config missing mixed proxy port 2085"
+grep -q '"username": "awguser"' "$out_json" || fail "sing-box config missing mixed proxy username"
+grep -q '"password": "awgpass"' "$out_json" || fail "sing-box config missing mixed proxy password"
+grep -q '"inbound": "my_awg_section-mixed-in"' "$out_json" || fail "sing-box config missing route rule for mixed proxy"
+grep -q '"outbound": "my_awg_section-out"' "$out_json" || fail "sing-box config missing route target for mixed proxy"
+
+# Ensure UDP is NOT rejected for AWG mixed proxy (AWG is an endpoint with UDP capability)
+if grep -q '"inbound": "my_awg_section-mixed-in"' "$out_json" | grep -q '"action": "reject"'; then
+  fail "AWG mixed proxy must not have UDP rejected"
+fi
+
 # Check AWG 3.0 server inbound
 grep -q '"tag": "server-my_awg30_server-in"' "$out_json" || fail "sing-box config missing server-my_awg30_server-in tag"
 grep -q '"header_protection_key": "dyBkZypS0O8PSlG0Ide3Agjp4Fng3YdYlPvXzZIldYQ="' "$out_json" || fail "AWG 3.0 server missing header_protection_key"
@@ -164,5 +182,6 @@ ucode -L "$TACHYON_LIB" "$TACHYON_LIB/singbox/generator.uc" generate-config-fixt
   "$WORK_DIR/awg_fixture.json" "$out_json" "127.0.0.1" 0 0
 
 grep -q '"persistent_keepalive_interval": 25' "$out_json" || fail "Non-lx AWG outbound must safely fallback to integer keepalive"
+grep -q '"tag": "my_awg_section-mixed-in"' "$out_json" || fail "Non-lx AWG missing mixed inbound"
 
 printf 'AWG 2.0, 3.0, and 3.1 server and outbound configuration checks passed\n'