Merge Mainline

2020-10-10 23:26:37 +08:00 · 2020-10-10 23:26:37 +08:00 · 1412c99a3b
commit 1412c99a3b
parent 8ccd2aa81f 6ec9c9e2ac
27 changed files with 368 additions and 172 deletions
--- a/config/Config-build.in
+++ b/config/Config-build.in
@ -330,12 +330,15 @@ menu "Global build settings"
 	choice
 		prompt "default SELinux type"
 		depends on TARGET_ROOTFS_SECURITY_LABELS
-		default SELINUXTYPE_targeted
+		default SELINUXTYPE_dssp
 		help
 		  Choose SELinux policy to be used for build.
 		config SELINUXTYPE_targeted
 			bool "targeted"
 			select PACKAGE_refpolicy
+		config SELINUXTYPE_dssp
+			bool "dssp"
+			select PACKAGE_selinux-policy
 	endchoice

 endmenu
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@ -26,6 +26,7 @@ $(eval $(call TestHostCommand,proper-umask, \
 	Please build with umask 022 - other values produce broken packages, \
 	umask | grep -xE 0?0[012][012]))

+ifndef IB
 $(eval $(call SetupHostCommand,gcc, \
 	Please install the GNU C Compiler (gcc) 4.8 or later, \
 	$(CC) -dumpversion | grep -E '^(4\.[8-9]|[5-9]\.?|10\.?)', \
@ -37,7 +38,9 @@ $(eval $(call TestHostCommand,working-gcc, \
 	it appears to be broken, \
 	echo 'int main(int argc, char **argv) { return 0; }' | \
 		gcc -x c -o $(TMP_DIR)/a.out -))
+endif

+ifndef IB
 $(eval $(call SetupHostCommand,g++, \
 	Please install the GNU C++ Compiler (g++) 4.8 or later, \
 	$(CXX) -dumpversion | grep -E '^(4\.[8-9]|[5-9]\.?|10\.?)', \
@ -50,6 +53,7 @@ $(eval $(call TestHostCommand,working-g++, \
 	echo 'int main(int argc, char **argv) { return 0; }' | \
 		g++ -x c++ -o $(TMP_DIR)/a.out - -lstdc++ && \
 		$(TMP_DIR)/a.out))
+endif

 ifndef IB
 $(eval $(call TestHostCommand,ncurses, \
--- a/package/ctcgfw/luci-app-openclash/luasrc/controller/openclash.lua
+++ b/package/ctcgfw/luci-app-openclash/luasrc/controller/openclash.lua
@ -74,6 +74,10 @@ local function is_web()
 	return luci.sys.call("pidof clash >/dev/null") == 0
 end

+local function restricted_mode()
+	return luci.sys.exec("uci get openclash.config.restricted_mode 2>/dev/null |tr -d '\n'")
+end
+
 local function is_watchdog()
 	local ps_version = luci.sys.exec("ps --version 2>&1 |grep -c procps-ng |tr -d '\n'")
 	if ps_version == "0" then
@ -306,6 +310,7 @@ function action_status()
 		uh_port = uh_port(),
 		web = is_web(),
 		cn_port = cn_port(),
+		restricted_mode = restricted_mode(),
 		mode = mode();
 	})
 end
--- a/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/status.htm
+++ b/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/status.htm
@ -173,9 +173,16 @@
 	});
 	XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "services", "openclash", "status")%>', null, function(x, status) {
 		if ( x && x.status == 200 ) {
-			clash.innerHTML = status.clash ? '<b><font color=green><%:RUNNING%></font></b>' : '<b><font color=red><%:NOT RUNNING%></font></b>';
+			if ( status.restricted_mode != "1" )
+			{
+			   clash.innerHTML = status.clash ? '<b><font color=green><%:RUNNING%></font></b>' : '<b><font color=red><%:NOT RUNNING%></font></b>';
+			}
+			else
+			{
+			   clash.innerHTML = status.clash ? '<b><font color=green><%:RUNNING%><%: <功能受限状态> %></font></b>' : '<b><font color=red><%:NOT RUNNING%></font></b>';
+			}
 			if ( status.mode == "fake-ip\n" )
-      {
+			{
 			   mode.innerHTML = status.clash ? "<b><font color=green><%: Fake-IP（增强）模式 %></font></b>" : '<b><font color=red><%:NOT RUNNING%></font></b>';
 			}
 			else if ( status.mode == "redir-host\n" )
--- a/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/switch_mode.htm
+++ b/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/switch_mode.htm
@ -29,11 +29,11 @@
      	if ( x && x.status == 200 ) {
      	   if ( status.switch_mode == "redir-host" ) {
      	      alert('页面已切换为Fake-IP模式！')
-      	      window.location.href='<%="http://'+window.location.hostname+'/cgi-bin/luci/admin/services/openclash/settings"%>';
+      	      window.location.href='<%="settings"%>';
      	   }
      	   else {
      		    alert('页面已切换为Redir-Host模式！')
-      		    window.location.href='<%="http://'+window.location.hostname+'/cgi-bin/luci/admin/services/openclash/settings"%>';
+      		    window.location.href='<%="settings"%>';
           }
        }
      });
--- a/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/update.htm
+++ b/package/ctcgfw/luci-app-openclash/luasrc/view/openclash/update.htm
@ -323,11 +323,11 @@
        XHR.get('<%=luci.dispatcher.build_url("admin", "services", "openclash", "restore")%>', null, function(x, status) {
        	if ( x && x.status == 200 ) {
        		alert('还原默认配置成功！')
-        		window.location.href='<%="http://'+window.location.hostname+'/cgi-bin/luci/admin/services/openclash/settings"%>';
+        		window.location.href='<%="settings"%>';
        	}
          else {
            alert('还原默认配置失败！')
-            window.location.href='<%="http://'+window.location.hostname+'/cgi-bin/luci/admin/services/openclash/settings"%>';
+            window.location.href='<%="settings"%>';
           }
        });
        } else {
--- a/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
+++ b/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
@ -903,35 +903,6 @@ yml_custom_rule_provider()

 }

-ac_add()
-{
-   if [ -z "$1" ]; then
-      return
-   fi
-  
-   ipset add "$2" "$1" 2>/dev/null
-}
-
-firewall_redirect_exclude()
-{
-   local section="$1"
-   local src_dport
-   config_get "src_dport" "$section" "src_dport" ""
-   
-   if [ -z "$src_dport" ]; then
-      return
-   fi
-   
-   if [ -z "$en_mode_tun" ]; then
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-   elif [ "$en_mode_tun" -ne 3 ]; then
-      iptables -t mangle -A openclash -p tcp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-   else
-      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
-   fi
-}
-
 #配置文件选择
 config_choose()
 {
@ -1113,6 +1084,164 @@ start_run_core()
   uci commit openclash
 }

+check_core_status()
+{
+   check_time=1
+   while ( [ "$check_time" -le 3 ] && [ -z "$(pidof clash)" ] )
+   do
+      sleep 2
+      check_time=$(expr "$check_time" + 1)
+   done
+}
+
+#不修改配置文件启动
+raw_config_start()
+{
+   mv "$START_BACKUP" "$CONFIG_FILE"
+   dns_port=$(grep "^ \{0,\}listen:" "$CONFIG_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
+   en_mode=$(grep "^ \{0,\}enhanced-mode:" "$CONFIG_FILE" |awk -F ': ' '{print $2}' |awk -F '#' '{print $1}' 2>/dev/null |sed 's/^ \{0,\}//g' 2>/dev/null |sed 's/ \{0,\}$//g' 2>/dev/null)
+   proxy_port=$(grep "^ \{0,\}redir-port:" "$CONFIG_FILE" |awk -F ': ' '{print $2}' |awk -F '#' '{print $1}' 2>/dev/null |tr -cd "[0-9]")
+   
+   if [ -z "$dns_port" ] || [ -z "$en_mode" ] || [ -z "$proxy_port" ]; then
+      if [ -z "$dns_port" ]; then
+         echo "错误: 无法获取DNS部分的监听端口设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
+         echo "${LOGTIME} Get DNS 'listen' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         sleep 3
+      fi
+      if [ -z "$en_mode" ]; then
+         echo "错误: 无法获取DNS部分的运行模式设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
+         echo "${LOGTIME} Get DNS 'enhanced-mode' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         sleep 3
+      fi
+      if [ -z "$proxy_port" ]; then
+         echo "错误: 无法获取General部分的转发端口设置, OpenClash 使用原始配置文件启动失败" >$START_LOG
+         echo "${LOGTIME} Get General 'redir-port' Option Error, OpenClash Can Not Start With Raw Config File" >> $LOG_FILE
+         sleep 3
+      fi
+      start_fail
+   fi
+   
+   start_run_core
+   check_core_status
+   
+   if ! pidof clash >/dev/null; then
+      echo "错误: OpenClash 启动失败，请到日志页面查看详细错误信息！" >$START_LOG
+      echo "${LOGTIME} OpenClash Can Not Start, Please Check The Error Info And Try Again" >> $LOG_FILE
+      sleep 5
+      start_fail
+   fi
+   
+   if [ "$en_mode" = "redir-host" ]; then
+      case $en_mode_tun in
+      "1")
+         uci set openclash.config.en_mode=redir-host-tun
+      ;;
+      "2")
+         uci set openclash.config.en_mode=redir-host-vpn
+      ;;
+      "3")
+         uci set openclash.config.en_mode=redir-host-mix
+      ;;
+      *)
+         uci set openclash.config.en_mode=redir-host
+      esac
+   elif [ "$en_mode" = "fake-ip" ]; then
+   	  case $en_mode_tun in
+      "1")
+         uci set openclash.config.en_mode=fake-ip-tun
+      ;;
+      "2")
+         uci set openclash.config.en_mode=fake-ip-vpn
+      ;;
+      "3")
+         uci set openclash.config.en_mode=fake-ip-mix
+      ;;
+      *)
+         uci set openclash.config.en_mode=fake-ip
+      esac
+   fi
+   
+   dase=$(grep "^ \{0,\}Secret:" "$CONFIG_FILE" |awk -F ': ' '{print $2}' |awk -F '#' '{print $1}' |sed 's/^ \{0,\}//g' 2>/dev/null |sed 's/ \{0,\}$//g' 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed "s/\'//g" 2>/dev/null)
+   uci set openclash.config.dashboard_password=dase 2>/dev/null
+   
+   cn_port=$(grep "^ \{0,\}external-controller:" "$CONFIG_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
+   uci set openclash.config.dashboard_password=cn_port 2>/dev/null
+   
+   uci set openclash.config.restricted_mode=1
+   
+   uci commit openclash
+}
+
+try_restore_start()
+{
+   if [ -z "$(pidof clash)" ]; then
+      if [ "$rule_source" = 0 ] && [ "$enable_custom_clash_rules" = 0 ]; then
+         echo "错误: OpenClash 启动失败，尝试使用原始配置文件启动..." >$START_LOG
+         echo "${LOGTIME} OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
+         sleep 3
+         raw_config_start
+      else
+         echo "错误: OpenClash 启动失败，尝试还原第三方规则并重新启动 Clash 主程序..." >$START_LOG
+         echo "${LOGTIME} OpenClash Can Not Start, Try Use Backup Rules Start Again" >> $LOG_FILE
+         rm -rf /tmp/yaml_general 2>/dev/null
+         #获取备份rule_provider
+         rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$START_BACKUP" 2>/dev/null)
+         if [ -n "$rule_provider_bak_len" ]; then
+            /usr/share/openclash/yml_field_cut.sh "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$START_BACKUP"
+         fi 2>/dev/null
+         #获取备份script
+         script_bak_len=$(sed -n '/^script:/=' "$START_BACKUP" 2>/dev/null)
+         if [ -n "$script_bak_len" ]; then
+            /usr/share/openclash/yml_field_cut.sh "$script_bak_len" "$SCRIPT_BAK_FILE" "$START_BACKUP"
+         fi 2>/dev/null
+         #获取备份rule
+         rule_bak_len=$(sed -n '/^rules:/=' "$START_BACKUP" 2>/dev/null)
+         if [ -n "$rule_bak_len" ]; then
+            /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$START_BACKUP"
+         fi 2>/dev/null
+         yml_rule_bak_merge
+         nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
+         check_core_status
+         if ! pidof clash >/dev/null; then
+            echo "错误: OpenClash 启动失败，尝试使用原始配置文件启动..." >$START_LOG
+            echo "${LOGTIME} OpenClash Can Not Start, Try Use Raw Config Restart Again" >> $LOG_FILE
+            sleep 3
+            raw_config_start
+         fi
+      fi
+   fi
+}
+
+#防火墙设置部分
+ac_add()
+{
+   if [ -z "$1" ]; then
+      return
+   fi
+  
+   ipset add "$2" "$1" 2>/dev/null
+}
+
+firewall_redirect_exclude()
+{
+   local section="$1"
+   local src_dport
+   config_get "src_dport" "$section" "src_dport" ""
+   
+   if [ -z "$src_dport" ]; then
+      return
+   fi
+   
+   if [ -z "$en_mode_tun" ]; then
+      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+   elif [ "$en_mode_tun" -ne 3 ]; then
+      iptables -t mangle -A openclash -p tcp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+   else
+      iptables -t mangle -A openclash -p udp --dport "$src_dport" -j RETURN >/dev/null 2>&1
+   fi
+}
+
 set_firewall()
 {
 if [ "$(iptables -t nat -nL PREROUTING --line-number |grep "udp dpt:53" |grep "0.0.0.0/0 \{0,\}0.0.0.0/0" |wc -l)" -gt 1 ] && [ "$enable_redirect_dns" -eq "1" ]; then
@ -1462,29 +1591,7 @@ get_config()
   stack_type=$(uci get openclash.config.stack_type 2>/dev/null)
   china_ip_route=$(uci get openclash.config.china_ip_route 2>/dev/null)
   small_flash_memory=$(uci get openclash.config.small_flash_memory 2>/dev/null)
-}
-
-yml_field_check()
-{
-   if [ -f "$GROUP_FILE" ]; then
-      if [ ! -f "$PROXY_FILE" ] && [ ! -f "$PROXY_PROVIDER_FILE" ]; then
-         echo "错误: 配置文件完整性检查不通过，已自动还原配置文件，请对照模板格式检查修改配置文件！" >$START_LOG
-         mv "$START_BACKUP" "$CONFIG_FILE"
-         sleep 5
-         start_fail
-      elif [ ! -f "$RULE_FILE" ] && [ ! -f "$SCRIPT_FILE" ]; then
-         echo "错误: 配置文件完整性检查不通过，已自动还原配置文件，请对照模板格式检查修改配置文件！" >$START_LOG
-         mv "$START_BACKUP" "$CONFIG_FILE"
-         sleep 5
-         start_fail
-      fi
-   else
-      nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
-      echo "错误: 配置文件完整性检查不通过，已自动还原配置文件，请根据日志信息对照模板格式检查修改配置文件！" >$START_LOG
-      mv "$START_BACKUP" "$CONFIG_FILE"
-      sleep 5
-      start_fail
-   fi
+   uci set openclash.config.restricted_mode=0 && uci commit openclash
 }

 start()
@ -1510,7 +1617,6 @@ start()
   echo "第二步: 配置文件检查..." >$START_LOG
   yml_check "$en_mode" "$enable_custom_dns" "$CONFIG_FILE" "$BACKUP_FILE" "$START_BACKUP"
   yml_dns_check
-   yml_field_check
   
   echo "第三步: 修改配置文件..." >$START_LOG
   config_load "openclash"
@ -1543,68 +1649,40 @@ start()
   echo "第六步: 等待主程序下载外部文件..." >$START_LOG
   yml_provider_check "$PROXY_PROVIDER_FILE" "proxy_provider"
   yml_provider_check "$RULE_PROVIDER_FILE" "rule_provider"
-
-   echo "第七步: 设置控制面板..." >$START_LOG
+   
+   echo "第七步: 检查内核启动状态..." >$START_LOG
+   check_core_status
+   try_restore_start
+   
+   echo "第八步: 设置控制面板..." >$START_LOG
   ln -s /usr/share/openclash/yacd /www/luci-static/openclash 2>/dev/null
       
-   echo "第八步: 设置防火墙规则..." >$START_LOG
+   echo "第九步: 设置防火墙规则..." >$START_LOG
   set_firewall

-   echo "第九步: 重启 Dnsmasq 程序..." >$START_LOG
+   echo "第十步: 重启 Dnsmasq 程序..." >$START_LOG
   change_dns "$enable_redirect_dns" "$disable_masq_cache"
   /etc/init.d/dnsmasq restart >/dev/null 2>&1
-   
-   echo "第十步: 检查内核启动状态..." >$START_LOG
-   if [ -z "$(pidof clash)" ] && [ "$rule_source" = 0 ] && [ "$enable_custom_clash_rules" = 0 ]; then
-      echo "错误: OpenClash 启动失败，请到日志页面查看详细错误信息！" >$START_LOG
-      echo "${LOGTIME} OpenClash Can Not Start, Please Check The Error Info And Try Again" >> $LOG_FILE
-      sleep 5
-      start_fail
-   fi
-   if ! pidof clash >/dev/null; then
-      echo "错误: OpenClash 启动失败，尝试还原第三方规则并重新启动 Clash 主程序..." >$START_LOG
-      echo "${LOGTIME} OpenClash Can Not Start, Try Use Backup Rules Start Again" >> $LOG_FILE
-      rm -rf /tmp/yaml_general 2>/dev/null
-      #获取备份rule_provider
-      rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$START_BACKUP" 2>/dev/null)
-      if [ -n "$rule_provider_bak_len" ]; then
-         /usr/share/openclash/yml_field_cut.sh "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$START_BACKUP"
-      fi 2>/dev/null
-      #获取备份script
-      script_bak_len=$(sed -n '/^script:/=' "$START_BACKUP" 2>/dev/null)
-      if [ -n "$script_bak_len" ]; then
-         /usr/share/openclash/yml_field_cut.sh "$script_bak_len" "$SCRIPT_BAK_FILE" "$START_BACKUP"
-      fi 2>/dev/null
-      #获取备份rule
-      rule_bak_len=$(sed -n '/^rules:/=' "$START_BACKUP" 2>/dev/null)
-      if [ -n "$rule_bak_len" ]; then
-         /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$START_BACKUP"
-      fi 2>/dev/null
-      yml_rule_bak_merge
-      nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &
-      sleep 3
-      if ! pidof clash >/dev/null; then
-         echo "错误: OpenClash 启动失败，请到日志页面查看详细错误信息！" >$START_LOG
-         echo "${LOGTIME} OpenClash Can Not Start, Please Check The Error Info And Try Again" >> $LOG_FILE
-         sleep 5
-         start_fail
-      fi
-   fi
            
   echo "第十一步: 还原策略组节点状态..." >$START_LOG
   /usr/share/openclash/openclash_history_set.sh
   
   echo "第十二步: 添加计划任务,启动进程守护程序..." >$START_LOG
   add_cron
-   if [ -z "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ]; then
+   if [ -z "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ] && [ "$(uci get openclash.config.restricted_mode 2>/dev/null)" != "1" ]; then
      echo "OpenClash 启动成功，请等待服务器上线！" >$START_LOG
      echo "${LOGTIME} OpenClash Start Successful" >> $LOG_FILE
      sleep 5
-   else
+   elif [ -n "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ]; then
      echo "OpenClash 启动成功，检测到您启用了IPV6的DHCP服务，可能会造成连接异常！" >$START_LOG
      echo "${LOGTIME} OpenClash Start Successful, Please Note That Network May Abnormal With IPV6's DHCP Server" >> $LOG_FILE
      sleep 5
   fi
+   if [ "$(uci get openclash.config.restricted_mode 2>/dev/null)" = "1" ]; then
+      echo "OpenClash 使用原始配置文件启动成功，部分设置可能未生效！" >$START_LOG
+      echo "${LOGTIME} OpenClash Start Successful With Raw Config File, Please Note That It's Restricted Mode Now" >> $LOG_FILE
+      sleep 5
+   fi
   echo "OpenClash Already Start"
   echo "" >$START_LOG
   rm -rf $START_BACKUP 2>/dev/null
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_chnroute.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_chnroute.sh
@ -24,18 +24,12 @@
      echo "大陆IP白名单下载成功，检查版本是否更新..." >$START_LOG
      cmp -s /tmp/ChinaIP.yaml /etc/openclash/rule_provider/ChinaIP.yaml
         if [ "$?" -ne "0" ]; then
-         	  status=$(unify_ps_prevent)
-            while ( [ "$status" -gt 1 ] )
-            do
-               sleep 5
-               status=$(unify_ps_prevent)
-            done
            echo "大陆IP白名单有更新，开始替换旧版本..." >$START_LOG
            mv /tmp/ChinaIP.yaml /etc/openclash/rule_provider/ChinaIP.yaml >/dev/null 2>&1
            echo "删除下载缓存..." >$START_LOG
            rm -rf /tmp/ChinaIP.yaml >/dev/null 2>&1
            rm -rf /usr/share/openclash/res/china_ip_route.ipset >/dev/null 2>&1
-            [ "$china_ip_route" -eq 1 ] && /etc/init.d/openclash restart
+            [ "$china_ip_route" -eq 1 ] && [ "$(unify_ps_prevent)" -eq 0 ] && /etc/init.d/openclash restart
            echo "大陆IP白名单更新成功！" >$START_LOG
            echo "${LOGTIME} Chnroute Lists Update Successful" >>$LOG_FILE
            sleep 10
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ipdb.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ipdb.sh
@ -30,12 +30,6 @@
      echo "GEOIP 数据库下载成功，检查数据库版本是否更新..." >$START_LOG
      cmp -s /tmp/Country.mmdb "$geoip_path"
         if [ "$?" -ne "0" ]; then
-         	  status=$(unify_ps_prevent)
-            while ( [ "$status" -gt 1 ] )
-            do
-               sleep 5
-               status=$(unify_ps_prevent)
-            done
            echo "数据库版本有更新，开始替换数据库版本..." >$START_LOG
            mv /tmp/Country.mmdb "$geoip_path" >/dev/null 2>&1
            echo "删除下载缓存..." >$START_LOG
@ -43,7 +37,7 @@
            echo "GEOIP 数据库更新成功！" >$START_LOG
            echo "${LOGTIME} GEOIP Database Update Successful" >>$LOG_FILE
            sleep 5
-            /etc/init.d/openclash restart
+            [ "$(unify_ps_prevent)" -eq 0 ] && /etc/init.d/openclash restart
            echo "" >$START_LOG
         else
            echo "数据库版本没有更新，停止继续操作..." >$START_LOG
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ps.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_ps.sh
@ -18,9 +18,9 @@ unify_ps_pids() {

 unify_ps_prevent() {
 	if [ "$(ps --version 2>&1 |grep -c procps-ng)" -eq 1 ];then
-		echo "$(ps -ef |grep -v openclash_watchdog |grep -c openclash.sh 2>/dev/null)"
+		echo "$(ps -ef |grep -v grep |grep -c "/etc/init.d/openclash")"
 	else
-		echo "$(ps |grep -v openclash_watchdog |grep -c openclash.sh 2>/dev/null)"
+		echo "$(ps |grep -v grep |grep -c "/etc/init.d/openclash")"
 	fi
 }

--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
@ -75,14 +75,8 @@
         mv /tmp/rules.yaml /usr/share/openclash/res/"$RUlE_SOURCE".yaml >/dev/null 2>&1
         sed -i '/^rules:/a\##updated' /usr/share/openclash/res/"$RUlE_SOURCE".yaml >/dev/null 2>&1
         echo "替换成功，重新加载 OpenClash 应用新规则..." >$START_LOG
-         status=$(unify_ps_prevent)
-         while ( [ "$status" -gt 1 ] )
-         do
-            sleep 5
-            status=$(unify_ps_prevent)
-         done
-         /etc/init.d/openclash restart 2>/dev/null
         echo "${LOGTIME} Other Rules 【$RUlE_SOURCE】 Update Successful" >>$LOG_FILE
+         [ "$(unify_ps_prevent)" -eq 0 ] && /etc/init.d/openclash restart
      else
         echo "检测到下载的规则文件没有更新，停止继续操作..." >$START_LOG
         rm -rf /tmp/rules.yaml >/dev/null 2>&1
--- a/package/ctcgfw/openwrt-v2ray-plugin/Makefile
+++ b/package/ctcgfw/openwrt-v2ray-plugin/Makefile
@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray-plugin
-PKG_VERSION:=1.5.0
+PKG_VERSION:=1.6.0
 PKG_RELEASE:=1

 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/teddysun/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=edea83faafeecd5fc00f8a5ed9be27df4a034a550415bc5dcc278c2c67ce4dd7
+PKG_HASH:=489b86fc526a9995607a4f16b7ed1247be039e6ecd39138dd59ed08f31ead791

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/lean/frp/Makefile
+++ b/package/lean/frp/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=frp
-PKG_VERSION:=0.34.0
+PKG_VERSION:=0.34.1
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=3c4f354c7c82eb5001f0de5a55015acbaa1fba03aa97647a74131bc4118598a8
+PKG_HASH:=a47f952cc491a1d5d6f838306f221d6a8635db7cf626453df72fe6531613d560

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
--- a/package/lean/kcptun/Makefile
+++ b/package/lean/kcptun/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=kcptun
-PKG_VERSION:=20200701
+PKG_VERSION:=20201004
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/xtaci/kcptun/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=d5b2d212c6806f1c4eba5fbce8797734eaa8ae0f8cdd90dd06d0844392888ff0
+PKG_HASH:=35d33bda5b643f07fab8b211cc1181298e27781e558bfc94b77491ea6abe61af

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE.md
--- a/package/lean/v2ray/Makefile
+++ b/package/lean/v2ray/Makefile
@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray
-PKG_VERSION:=4.30.0
+PKG_VERSION:=4.31.0
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION)

 PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=ee7f615193708dcc5f0499c1918a3806b8dfb0a4aaada0dc3df62229c28220ed
+PKG_HASH:=4e475c700863320b92689cb36ef993133e9c799375bbfc4a2811da2283c3673f

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=66
-PKG_DATE:=20201004
+PKG_RELEASE:=68
+PKG_DATE:=20201006

 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua
@ -4,17 +4,13 @@ local node_section = arg[1]
 local run_type = arg[2]
 local local_addr = arg[3]
 local local_port = arg[4]
-local relay_port = arg[5]
+local server_host = arg[5]
+local server_port = arg[6]
 local node = ucursor:get_all("passwall", node_section)

-if relay_port and relay_port ~= "nil" then
-    node.address = "127.0.0.1"
-    node.port = tonumber(relay_port)
-end
-
 local config = {
    listen = run_type .. "://" .. local_addr .. ":" .. local_port,
-    proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. node.address .. ":" .. node.port
+    proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. (server_host or node.address) .. ":" .. (server_port or node.port)
 }

 print(jsonc.stringify(config, 1))
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_shadowsocks.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_shadowsocks.lua
@ -1,15 +1,16 @@
 local ucursor = require "luci.model.uci".cursor()
 local jsonc = require "luci.jsonc"
 local node_section = arg[1]
-local local_port = arg[2]
-local server_host = arg[3]
-local server_port = arg[4]
+local local_addr = arg[2]
+local local_port = arg[3]
+local server_host = arg[4]
+local server_port = arg[5]
 local node = ucursor:get_all("passwall", node_section)

 local config = {
    server = server_host or node.address,
-    server_port = server_port or tonumber(node.port),
-    local_address = "0.0.0.0",
+    server_port = tonumber(server_port) or tonumber(node.port),
+    local_address = local_addr,
    local_port = tonumber(local_port),
    password = node.password,
    method = node.method,
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan.lua
@ -4,7 +4,8 @@ local node_section = arg[1]
 local run_type = arg[2]
 local local_addr = arg[3]
 local local_port = arg[4]
-local relay_port = arg[5]
+local server_host = arg[5]
+local server_port = arg[6]
 local node = ucursor:get_all("passwall", node_section)

 local cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
@ -13,8 +14,8 @@ local trojan = {
    run_type = run_type,
    local_addr = local_addr,
    local_port = tonumber(local_port),
-    remote_addr = node.address,
-    remote_port = tonumber(node.port),
+    remote_addr = server_host or node.address,
+    remote_port = tonumber(server_port) or tonumber(node.port),
    password = {node.password},
    log_level = 1,
    ssl = {
@ -68,8 +69,4 @@ if node.type == "Trojan-Go" then
        password = node.ss_aead_pwd or ""
    } or nil
 end
-if relay_port and relay_port ~= "nil" then
-    trojan.remote_addr = "127.0.0.1"
-    trojan.remote_port = tonumber(relay_port)
-end
 print(json.stringify(trojan, 1))
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_v2ray.lua
@ -127,7 +127,7 @@ local function gen_outbound(node, tag, relay_port)
                                level = node.level and tonumber(node.level) or 0,
                                security = (node.protocol == "vmess") and node.security or nil,
                                encryption = node.encryption or "none",
-                                flow = (node.stream_security == "xtls") and node.flow or nil
+                                flow = node.flow or nil
                            }
                        }
                    }
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua
@ -374,6 +374,14 @@ level:depends({ type = "V2ray", protocol = "vmess" })
 level:depends({ type = "V2ray", protocol = "vless" })
 level:depends({ type = "V2ray", protocol = "trojan" })

+flow = s:option(Value, "flow", translate("flow"))
+flow.placeholder = "xtls-rprx-origin"
+--flow:value("xtls-rprx-origin")
+--flow:value("xtls-rprx-origin-udp443")
+--flow:value("xtls-rprx-direct")
+--flow:value("xtls-rprx-direct-udp443")
+flow:depends({ type = "V2ray", protocol = "vless" })
+
 stream_security = s:option(ListValue, "stream_security", translate("Transport Layer Encryption"), translate('Whether or not transport layer encryption is enabled, "none" for unencrypted, "tls" for using TLS, "xtls" for using XTLS.'))
 stream_security:value("none", "none")
 stream_security:value("tls", "tls")
@ -394,12 +402,6 @@ stream_security.validate = function(self, value)
    return value
 end

-flow = s:option(Value, "flow", translate("flow"))
-flow.default = "xtls-rprx-origin"
-flow:value("xtls-rprx-origin")
-flow:value("xtls-rprx-origin-udp443")
-flow:depends("stream_security", "xtls")
-
 -- [[ TLS部分 ]] --
 tls_sessionTicket = s:option(Flag, "tls_sessionTicket", translate("Session Ticket"))
 tls_sessionTicket.default = "0"
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@ -318,7 +318,6 @@ run_socks() {
 	[ -n "$relay_port" ] && {
 		server_host="127.0.0.1"
 		port=$relay_port
-		echo $relay_port
 	}
 	local msg tmp

@ -353,15 +352,15 @@ run_socks() {
 		ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray -config="$config_file"
 	;;
 	trojan-go)
-		lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file
+		lua $API_GEN_TROJAN $node client $bind $local_port $server_host $port > $config_file
 		ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file"
 	;;
 	trojan*)
-		lua $API_GEN_TROJAN $node client $bind $local_port $port > $config_file
+		lua $API_GEN_TROJAN $node client $bind $local_port $server_host $port > $config_file
 		ln_start_bin "$(first_type ${type})" "${type}" -c "$config_file"
 	;;
 	naiveproxy)
-		lua $API_GEN_NAIVE $node socks $bind $local_port $port > $config_file
+		lua $API_GEN_NAIVE $node socks $bind $local_port $server_host $port > $config_file
 		ln_start_bin "$(first_type naive)" naive "$config_file"
 	;;
 	brook)
@ -373,7 +372,7 @@ run_socks() {
 		ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" "brook_SOCKS_$5" "$protocol" --socks5 "$bind:$local_port" -s "$server_host:$port" -p "$(config_n_get $node password)"
 	;;
 	ss|ssr)
-		lua $API_GEN_SS $node $local_port $server_host $port > $config_file
+		lua $API_GEN_SS $node "0.0.0.0" $local_port $server_host $port > $config_file
 		ln_start_bin "$(first_type ${type}-local)" "${type}-local" -c "$config_file" -b "$bind" -u
 	;;
 	esac
@ -438,7 +437,7 @@ run_redir() {
 			fi
 		;;
 		ss|ssr)
-			lua $API_GEN_SS $node $local_port > $config_file
+			lua $API_GEN_SS $node "0.0.0.0" $local_port > $config_file
 			ln_start_bin "$(first_type ${type}-redir)" "${type}-redir" -c "$config_file" -U
 		;;
 		esac
@ -514,11 +513,11 @@ run_redir() {
 		;;
 		ss|ssr)
 			if [ "$kcptun_use" == "1" ]; then
-				lua $API_GEN_SS $node $local_port 127.0.0.1 $KCPTUN_REDIR_PORT > $config_file
+				lua $API_GEN_SS $node "0.0.0.0" $local_port "127.0.0.1" $KCPTUN_REDIR_PORT > $config_file
 				process=1
 				[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && echolog "Kcptun不支持UDP转发！"
 			else
-				lua $API_GEN_SS $node $local_port > $config_file
+				lua $API_GEN_SS $node "0.0.0.0" $local_port > $config_file
 				[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && extra_param="-u"
 			fi
 			for k in $(seq 1 $process); do
--- a/package/ntlf9t/openwrt-udp2raw/Makefile
+++ b/package/ntlf9t/openwrt-udp2raw/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=udp2raw-tunnel
-PKG_VERSION:=20190716.test.0
+PKG_VERSION:=20200818.0
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/wangyu-/udp2raw-tunnel.git
-PKG_SOURCE_VERSION:=5cc304a26181ee17bc583b79a2e80449ea63e1b7
+PKG_SOURCE_VERSION:=cc6ea766c495cf4c69d1c7485728ba022b0f19de
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz

--- a/package/system/selinux-policy/Makefile
+++ b/package/system/selinux-policy/Makefile
@ -0,0 +1,53 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=selinux-policy
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://git.defensec.nl/selinux-policy.git
+PKG_SOURCE_DATE:=2020-10-08
+PKG_SOURCE_VERSION:=cdedea73ecbb8968f9736c35c143b586c8371467
+PKG_MIRROR_HASH:=3d5a6d60b496b51ae272f7cb495a409c724ee193792f78652a2040b57fab56fe
+PKG_BUILD_DEPENDS:=secilc/host policycoreutils/host
+
+PKG_MAINTAINER:=Dominick Grift <dominick.grift@defensec.nl>
+PKG_CPE_ID:=cpe:/a:defensec:selinux-policy
+PKG_LICENSE:=Unlicense
+PKG_LICENSE_FILES:=LICENSE
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/selinux-policy
+	SECTION:=system
+	CATEGORY:=Base system
+	TITLE:=SELinux security policy for OpenWrt
+	URL:=https://git.defensec.nl/?p=selinux-policy.git;a=summary
+	PKGARCH:=all
+endef
+
+define Package/selinux-policy/description
+	Basic SELinux Security Policy designed specifically for
+	OpenWrt and written in Common Intermediate Language.
+endef
+
+define Build/Compile
+	$(call Build/Compile/Default,policy)
+endef
+
+define Package/selinux-policy/conffiles
+/etc/selinux/config
+endef
+
+define Package/selinux-policy/install
+	$(INSTALL_DIR) $(1)/etc/selinux/$(PKG_NAME)/contexts/files/
+	$(INSTALL_DIR) $(1)/etc/selinux/$(PKG_NAME)/policy/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/file_contexts.subs_dist $(1)/etc/selinux/$(PKG_NAME)/contexts/files/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/file_contexts $(1)/etc/selinux/$(PKG_NAME)/contexts/files/
+	$(INSTALL_CONF) $(PKG_BUILD_DIR)/policy.* $(1)/etc/selinux/$(PKG_NAME)/policy/
+	$(INSTALL_DATA) ./files/selinux-config $(1)/etc/selinux/config
+endef
+
+$(eval $(call BuildPackage,selinux-policy))
--- a/package/system/selinux-policy/files/selinux-config
+++ b/package/system/selinux-policy/files/selinux-config
@ -0,0 +1,2 @@
+SELINUX=enforcing
+SELINUXTYPE=selinux-policy
--- a/package/utils/secilc/Makefile
+++ b/package/utils/secilc/Makefile
@ -0,0 +1,66 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=secilc
+PKG_VERSION:=3.1
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
+PKG_HASH:=86117246fec3017af710a9ff7c1dae3ed1cd571e232a86cff3e2a3de2d6aa65c
+HOST_BUILD_DEPENDS:=libsepol/host
+
+PKG_MAINTAINER:=Dominick Grift <dominick.grift@defensec.nl>
+PKG_CPE_ID:=cpe:/a:selinuxproject:secilc
+PKG_LICENSE:=BSD-2-Clause
+PKG_LICENSE_FILES:=COPYING
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/nls.mk
+include $(INCLUDE_DIR)/package.mk
+
+HOST_LDFLAGS+=-Wl,-rpath=$(STAGING_DIR_HOSTPKG)/lib
+HOST_MAKE_FLAGS += \
+	DESTDIR=$(STAGING_DIR_HOSTPKG) \
+	PREFIX=
+
+define Package/secilc
+	SECTION:=utils
+	CATEGORY:=Utilities
+	TITLE:=SELinux Common Intermediate Language (CIL) Compiler
+	URL:=http://selinuxproject.org/page/Main_Page
+	DEPENDS:=+libsepol
+endef
+
+define Package/secilc/description
+	The SELinux CIL Compiler is a compiler that converts the CIL language as
+	described on the CIL design wiki into a kernel binary policy file.
+	Please see the CIL Design Wiki at:
+	http://github.com/SELinuxProject/cil/wiki/
+	for more information about the goals and features on the CIL language.
+endef
+
+define Build/Compile
+	$(call Build/Compile/Default,secilc)
+endef
+
+define Host/Compile
+	$(call Host/Compile/Default,secilc)
+endef
+
+define Host/Install
+	$(INSTALL_DIR) $(STAGING_DIR_HOSTPKG)/bin
+	$(INSTALL_BIN) $(HOST_BUILD_DIR)/secilc $(STAGING_DIR_HOSTPKG)/bin
+endef
+
+define Package/secilc/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/secilc $(1)/usr/bin
+endef
+
+$(eval $(call BuildPackage,secilc))
+$(eval $(call HostBuild))
--- a/target/linux/x86/config-4.14
+++ b/target/linux/x86/config-4.14
@ -315,6 +315,7 @@ CONFIG_MIGRATION=y
 # CONFIG_MK6 is not set
 # CONFIG_MK7 is not set
 # CONFIG_MK8 is not set
+CONFIG_MMC_SDHCI_ACPI=y
 # CONFIG_MODIFY_LDT_SYSCALL is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_MODULES_USE_ELF_REL=y