Merge Mainline

2020-09-04 15:53:54 +08:00 · 2020-09-04 15:53:54 +08:00 · 4afad7690d
commit 4afad7690d
parent ce1558cff6 ac690d43b2
31 changed files with 492 additions and 111 deletions
--- a/package/base-files/files/lib/functions/network.sh
+++ b/package/base-files/files/lib/functions/network.sh
@ -255,7 +255,7 @@ network_find_wan() { __network_wan "$1" "0.0.0.0" "$2"; }

 # find the logical interface which holds the current IPv6 default route
 # 1: destination variable
-# 2: consider inactive dafault routes if "true" (optional)
+# 2: consider inactive default routes if "true" (optional)
 network_find_wan6() { __network_wan "$1" "::" "$2"; }

 # test whether the given logical interface is running
--- a/package/ctcgfw/naiveproxy/Makefile
+++ b/package/ctcgfw/naiveproxy/Makefile
@ -7,19 +7,18 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=naiveproxy
-PKG_VERSION:=84.0.4147.89-2
+PKG_VERSION:=85.0.4183.83-1
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/klzgrad/naiveproxy/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=f18fbb77dfb5326e97aff8340d42d327ec8572a82e5611e405e375454fe37b29
+PKG_HASH:=5fa9b2f26212f2414dc0ebc021f64c566585e26c20ec17955cef53ce3bc314da
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

-PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE:=BSD 3-Clause
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=CN_SZTL <cnsztl@project-openwrt.eu.org>

-PKG_FIXUP:=autoreconf
 PKG_BUILD_DEPENDS:=ninja/host python3/host
 PKG_USE_MIPS16:=0
 PKG_BUILD_PARALLEL:=1
--- a/package/ctcgfw/naiveproxy/src/init_env.sh
+++ b/package/ctcgfw/naiveproxy/src/init_env.sh
@ -65,6 +65,7 @@ treat_warnings_as_errors=false

 fieldtrial_testing_like_official_build=true

+enable_base_tracing=false
 enable_nacl=false
 enable_print_preview=false
 enable_remoting=false
@ -78,7 +79,6 @@ use_system_libdrm=false
 use_gnome_keyring=false
 use_libpci=false
 use_pangocairo=false
-use_aura=false
 use_glib=false
 use_pulseaudio=false
 use_udev=false
@ -109,5 +109,5 @@ ldso_path=\"${ldso_path}\""
 }
 [[ "mips mips64 mipsel mips64el" =~ (^|[[:space:]])"${target_arch}"($|[[:space:]]) ]] && {
 	naive_flags="${naive_flags} use_gold=false is_cfi=false use_cfi_icall=false use_thin_lto=false mips_arch_variant=\"r2\""
-	[[ "${target_arch}" =~ ^"mips"$|^"mipsel"$ ]] && naive_flags="mips_float_abi=\"soft\" mips_tune=\"${cpu_type}\""
+	[[ "${target_arch}" =~ ^"mips"$|^"mipsel"$ ]] && naive_flags="${naive_flags} mips_float_abi=\"soft\" mips_tune=\"${cpu_type}\""
 }
--- a/package/ctcgfw/openwrt-v2ray-plugin/Makefile
+++ b/package/ctcgfw/openwrt-v2ray-plugin/Makefile
@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray-plugin
-PKG_VERSION:=1.4.1
+PKG_VERSION:=1.4.2
 PKG_RELEASE:=1

 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/teddysun/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=ecd53ea59dea178f75b47f399a48ce0e0d09ec9e9d866c5becf82d1ed35a7634
+PKG_HASH:=4da541c2a6548be24db68ed74ee117b757b6620a9b61b5960637a71f77ad438a

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/lean/luci-app-ssr-plus/Makefile
+++ b/package/lean/luci-app-ssr-plus/Makefile
@ -60,4 +60,4 @@ LUCI_DEPENDS:=+shadowsocksr-libev-alt +ipset +ip-full +iptables-mod-tproxy +dnsm

 include $(TOPDIR)/feeds/luci/luci.mk

-# call BuildPackage - OpenWrt buildroot signature
+# call BuildPackage - OpenWrt buildroot signature
--- a/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua
+++ b/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua
@ -123,6 +123,7 @@ o:value("ss", translate("Shadowsocks New Version"))
 end
 if nixio.fs.access("/usr/bin/v2ray/v2ray") or nixio.fs.access("/usr/bin/v2ray") then
 o:value("v2ray", translate("V2Ray"))
+o:value("vless", translate("VLESS"))
 end
 if nixio.fs.access("/usr/sbin/trojan") then
 o:value("trojan", translate("Trojan"))
@ -151,6 +152,7 @@ o.rmempty = false
 o:depends("type", "ssr")
 o:depends("type", "ss")
 o:depends("type", "v2ray")
+o:depends("type", "vless")
 o:depends("type", "trojan")
 o:depends("type", "naiveproxy")
 o:depends("type", "socks5")
@ -161,6 +163,7 @@ o.rmempty = false
 o:depends("type", "ssr")
 o:depends("type", "ss")
 o:depends("type", "v2ray")
+o:depends("type", "vless")
 o:depends("type", "trojan")
 o:depends("type", "naiveproxy")
 o:depends("type", "socks5")
@ -227,10 +230,17 @@ o.rmempty = true
 o:depends("type", "v2ray")

 -- VmessId
-o = s:option(Value, "vmess_id", translate("VmessId (UUID)"))
+o = s:option(Value, "vmess_id", translate("Vmess/VLESS ID (UUID)"))
 o.rmempty = true
 o.default = uuid
 o:depends("type", "v2ray")
+o:depends("type", "vless")
+
+-- VLESS Encryption
+o = s:option(Value, "vless_encryption", translate("VLESS Encryption"))
+o.rmempty = true
+o.default = "none"
+o:depends("type", "vless")

 -- 加密方式
 o = s:option(ListValue, "security", translate("Encrypt Method"))
@ -247,6 +257,7 @@ o:value("h2", "HTTP/2")
 o:value("quic", "QUIC")
 o.rmempty = true
 o:depends("type", "v2ray")
+o:depends("type", "vless")

 -- [[ TCP部分 ]]--

@ -370,6 +381,7 @@ o.rmempty = true
 o = s:option(Flag, "insecure", translate("allowInsecure"))
 o.rmempty = false
 o:depends("type", "v2ray")
+o:depends("type", "vless")
 o:depends("type", "trojan")
 o.default = "1"
 o.description = translate("If true, allowss insecure connection at TLS client, e.g., TLS server uses unverifiable certificates.")
@ -378,6 +390,7 @@ o = s:option(Flag, "tls", translate("TLS"))
 o.rmempty = true
 o.default = "0"
 o:depends("type", "v2ray")
+o:depends("type", "vless")
 o:depends("type", "trojan")

 o = s:option(Value, "tls_host", translate("TLS Host"))
@ -390,6 +403,7 @@ o = s:option(Flag, "mux", translate("Mux"))
 o.rmempty = true
 o.default = "0"
 o:depends("type", "v2ray")
+o:depends("type", "vless")

 o = s:option(Value, "concurrency", translate("Concurrency"))
 o.datatype = "uinteger"
@ -403,6 +417,7 @@ o.rmempty = true
 o.default = "0"
 o:depends("type", "trojan")
 o:depends("type", "v2ray")
+o:depends("type", "vless")
 o.description = translate("If you have a self-signed certificate,please check the box")

 o = s:option(DummyValue, "upload", translate("Upload"))
--- a/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/servers.lua
+++ b/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/servers.lua
@ -92,7 +92,7 @@ end

 o = s:option(DummyValue, "type", translate("Type"))
 function o.cfgvalue(...)
-	return Value.cfgvalue(...) or ""
+	return (Value.cfgvalue(...) == "vless") and "VLESS" or Value.cfgvalue(...)
 end

 o = s:option(DummyValue, "alias", translate("Alias"))
--- a/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po
+++ b/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po
@ -61,6 +61,9 @@ msgstr "密码"
 msgid "Encrypt Method"
 msgstr "加密方式"

+msgid "VLESS Encryption"
+msgstr "VLESS 加密"
+
 msgid "Transport"
 msgstr "传输协议"

--- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
+++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
@ -114,7 +114,7 @@ find_bin() {
 	ssr) ret="/usr/bin/ssr-redir" ;;
 	ssr-local) ret="/usr/bin/ssr-local" ;;
 	ssr-server) ret="/usr/bin/ssr-server" ;;
-	v2ray) ret="/usr/bin/v2ray/v2ray" && [ ! -f "$ret" ] && ret="/usr/bin/v2ray" ;;
+	v2ray | vless) ret="/usr/bin/v2ray/v2ray" && [ ! -f "$ret" ] && ret="/usr/bin/v2ray" ;;
 	trojan) ret="/usr/sbin/trojan" ;;
 	naiveproxy) ret="/usr/bin/naive" ;;
 	socks5 | tun) ret="/usr/sbin/redsocks2" ;;
@ -186,8 +186,8 @@ gen_config_file() {
 			}
 		EOF
 		;;
-	v2ray)
-		lua /usr/share/shadowsocksr/genv2config.lua $GLOBAL_SERVER tcp $(uci_get_by_name $1 local_port) >/var/etc/v2-ssr-retcp.json
+	v2ray | vless)
+		lua /usr/share/shadowsocksr/gen${type}config.lua $GLOBAL_SERVER tcp $(uci_get_by_name $1 local_port) >/var/etc/v2-ssr-retcp.json
 		sed -i 's/\\//g' /var/etc/v2-ssr-retcp.json
 		;;
 	trojan)
@ -358,7 +358,7 @@ start_redir_tcp() {
 		done
 		echo "$(date "+%Y-%m-%d %H:%M:%S") Main node:$name $threads Threads Started!" >>/tmp/ssrplus.log
 		;;
-	v2ray)
+	v2ray | vless)
 		$bin -config /var/etc/v2-ssr-retcp.json >/dev/null 2>&1 &
 		echo "$(date "+%Y-%m-%d %H:%M:%S") Main node:$($bin -version | head -1) Started!" >>/tmp/ssrplus.log
 		;;
@ -411,8 +411,8 @@ start_redir_udp() {
 			$bin -c $last_config_file $ARG_OTA -U -f /var/run/ssr-reudp.pid >/dev/null 2>&1
 			echo "$(date "+%Y-%m-%d %H:%M:%S") UDP TPROXY Relay:$name Started!" >>/tmp/ssrplus.log
 			;;
-		v2ray)
-			lua /usr/share/shadowsocksr/genv2config.lua $UDP_RELAY_SERVER udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/var/etc/v2-ssr-reudp.json
+		v2ray | vless)
+			lua /usr/share/shadowsocksr/gen${type}config.lua $UDP_RELAY_SERVER udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/var/etc/v2-ssr-reudp.json
 			sed -i 's/\\//g' /var/etc/v2-ssr-reudp.json
 			$bin -config /var/etc/v2-ssr-reudp.json >/dev/null 2>&1 &
 			echo "$(date "+%Y-%m-%d %H:%M:%S") UDP TPROXY Relay:$($bin -version | head -1) Started!" >>/tmp/ssrplus.log
@ -462,8 +462,9 @@ start_shunt() {
 			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
 			echo "$(date "+%Y-%m-%d %H:%M:%S") Netflix shunt:$name Started!" >>/tmp/ssrplus.log
 			;;
-		v2ray)
-			lua /usr/share/shadowsocksr/genv2config.lua $NETFLIX_SERVER tcp 4321 1088 >/var/etc/v2-ssr-netflix.json
+		v2ray | vless)
+			lua /usr/share/shadowsocksr/gen${type}config.lua $NETFLIX_SERVER tcp 4321 1088 >/var/etc/v2-ssr-netflix.json
+			sed -i 's/\\//g' /var/etc/v2-ssr-netflix.json
 			$bin -config /var/etc/v2-ssr-netflix.json >/dev/null 2>&1 &
 			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
 			echo "$(date "+%Y-%m-%d %H:%M:%S") Netflix shunt:$($bin -version | head -1) Started!" >>/tmp/ssrplus.log
@ -524,8 +525,8 @@ start_local() {
 		$bin -c $CONFIG_SOCK5_FILE -u -f /var/run/ssr-local.pid >/dev/null 2>&1
 		echo "$(date "+%Y-%m-%d %H:%M:%S") Global_Socks5:$name Started!" >>/tmp/ssrplus.log
 		;;
-	v2ray)
-		lua /usr/share/shadowsocksr/genv2config.lua $local_server tcp 0 $(uci_get_by_type socks5_proxy local_port 1080) >/var/etc/v2-ssr-local.json
+	v2ray | vless)
+		lua /usr/share/shadowsocksr/gen${type}config.lua $local_server tcp 0 $(uci_get_by_type socks5_proxy local_port 1080) >/var/etc/v2-ssr-local.json
 		sed -i 's/\\//g' /var/etc/v2-ssr-local.json
 		$bin -config /var/etc/v2-ssr-local.json >/dev/null 2>&1 &
 		echo "$(date "+%Y-%m-%d %H:%M:%S") Global_Socks5:$($bin -version | head -1) Started!" >>/tmp/ssrplus.log
--- a/package/lean/luci-app-ssr-plus/root/etc/ssr/china_ssr.txt
+++ b/package/lean/luci-app-ssr-plus/root/etc/ssr/china_ssr.txt
@ -4079,6 +4079,8 @@
 103.154.242.0/23
 103.155.14.0/23
 103.155.16.0/23
+103.155.34.0/23
+103.155.48.0/23
 103.192.0.0/22
 103.192.4.0/22
 103.192.8.0/22
--- a/package/lean/luci-app-ssr-plus/root/etc/ssr/gfw_list.conf
+++ b/package/lean/luci-app-ssr-plus/root/etc/ssr/gfw_list.conf
@ -4648,6 +4648,8 @@ server=/ixxx.com/127.0.0.1#5335
 ipset=/ixxx.com/gfwlist
 server=/iyouport.com/127.0.0.1#5335
 ipset=/iyouport.com/gfwlist
+server=/iyouport.org/127.0.0.1#5335
+ipset=/iyouport.org/gfwlist
 server=/izaobao.us/127.0.0.1#5335
 ipset=/izaobao.us/gfwlist
 server=/izles.net/127.0.0.1#5335
@ -7794,6 +7796,8 @@ server=/stumbleupon.com/127.0.0.1#5335
 ipset=/stumbleupon.com/gfwlist
 server=/stupidvideos.com/127.0.0.1#5335
 ipset=/stupidvideos.com/gfwlist
+server=/stweetly.com/127.0.0.1#5335
+ipset=/stweetly.com/gfwlist
 server=/subacme.rerouted.org/127.0.0.1#5335
 ipset=/subacme.rerouted.org/gfwlist
 server=/successfn.com/127.0.0.1#5335
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/genv2rayconfig.lua
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/genv2rayconfig.lua
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/genvlessconfig.lua
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/genvlessconfig.lua
@ -0,0 +1,114 @@
+local ucursor = require "luci.model.uci".cursor()
+local json = require "luci.jsonc"
+local server_section = arg[1]
+local proto = arg[2]
+local local_port = arg[3] or "0"
+local socks_port = arg[4] or "0"
+local server = ucursor:get_all("shadowsocksr", server_section)
+local vless = {
+log = {
+-- error = "/var/ssrplus.log",
+loglevel = "warning"
+},
+-- 传入连接
+inbound = (local_port ~= "0") and {
+	port = local_port,
+	protocol = "dokodemo-door",
+	settings = {
+		network = proto,
+		followRedirect = true
+	},
+	sniffing = {
+		enabled = true,
+		destOverride = { "http", "tls" }
+	}
+} or nil,
+-- 开启 socks 代理
+inboundDetour = (proto == "tcp" and socks_port ~= "0") and {
+	{
+	protocol = "socks",
+	port = socks_port,
+		settings = {
+			auth = "noauth",
+			udp = true
+		}
+	}
+} or nil,
+-- 传出连接
+outbound = {
+	protocol = "vless",
+	settings = {
+		vnext = {
+			{
+				address = server.server,
+				port = tonumber(server.server_port),
+				users = {
+					{
+						id = server.vmess_id,
+						encryption = server.vless_encryption
+					}
+				}
+			}
+		}
+	},
+	-- 底层传输配置
+	streamSettings = {
+		network = server.transport,
+		security = (server.tls == '1') and "tls" or "none",
+		tlsSettings = {allowInsecure = (server.insecure ~= "0") and true or false,serverName=server.tls_host,},
+		tcpSettings = (server.transport == "tcp") and {
+			header = {
+				type = server.tcp_guise,
+				request = {
+					path = server.http_path or {"/"},
+					headers = {
+						Host = server.http_host or {}
+					}
+				} or {}
+			}
+		} or nil,
+		kcpSettings = (server.transport == "kcp") and {
+			mtu = tonumber(server.mtu),
+			tti = tonumber(server.tti),
+			uplinkCapacity = tonumber(server.uplink_capacity),
+			downlinkCapacity = tonumber(server.downlink_capacity),
+			congestion = (server.congestion == "1") and true or false,
+			readBufferSize = tonumber(server.read_buffer_size),
+			writeBufferSize = tonumber(server.write_buffer_size),
+			header = {
+				type = server.kcp_guise
+			}
+		} or nil,
+		wsSettings = (server.transport == "ws") and (server.ws_path ~= nil or server.ws_host ~= nil) and {
+			path = server.ws_path,
+			headers = (server.ws_host ~= nil) and {
+				Host = server.ws_host
+			} or nil,
+		} or nil,
+		httpSettings = (server.transport == "h2") and {
+			path = server.h2_path,
+			host = server.h2_host,
+		} or nil,
+		quicSettings = (server.transport == "quic") and {
+			security = server.quic_security,
+			key = server.quic_key,
+			header = {
+				type = server.quic_guise
+			}
+		} or nil
+	},
+	mux = {
+		enabled = (server.mux == "1") and true or false,
+		concurrency = tonumber(server.concurrency)
+	}
+},
+-- 额外传出连接
+outboundDetour = {
+		{
+			protocol = "freedom",
+			tag = "direct",
+			settings = { keep = "" }
+		}
+	}
+}
+print(json.stringify(vless, 1))
--- a/package/lean/n2n_v2/Makefile
+++ b/package/lean/n2n_v2/Makefile
@ -6,8 +6,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=n2n
 PKG_SOURCE_URL:=https://github.com/ntop/n2n.git
-PKG_SOURCE_VERSION:=bc0a6bf8b78c90dd902efa75891d41d2a489286e
-PKG_VERSION:=2.6.0_git-$(PKG_SOURCE_VERSION)
+PKG_SOURCE_VERSION:=3c983286184ebf2e06db6ccfb3223ea9430c216b
+PKG_VERSION:=2.8.0_git-$(PKG_SOURCE_VERSION)
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
@ -34,12 +34,13 @@ endef
 define Package/n2n-edge
  $(call Package/n2n/Default)
  TITLE+= client (edge node)
-  DEPENDS+=+kmod-tun +resolveip +libopenssl
+  DEPENDS+=+kmod-tun +resolveip +libopenssl +libcap +libzstd
 endef

 define Package/n2n-supernode
  $(call Package/n2n/Default)
  TITLE+= server (supernode)
+  DEPENDS+=+libcap
 endef

 define Package/n2n-edge/description
--- a/package/lean/v2ray/Makefile
+++ b/package/lean/v2ray/Makefile
@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray
-PKG_VERSION:=4.27.4
+PKG_VERSION:=4.27.5
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION)

 PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=4259e6b66b2c035054f4fe4416ba5109f3ac5f4bc82d42e6998e716f06ced531
+PKG_HASH:=f289d8d85ab0851851a6e3c101226e77bed0052fd60f9185df8852b601e657f8

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/libs/libaudit/Makefile
+++ b/package/libs/libaudit/Makefile
@ -14,6 +14,7 @@ PKG_SOURCE:=$(PKG_SOURCE_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://people.redhat.com/sgrubb/audit
 PKG_HASH:=0e5d4103646e00f8d1981e1cd2faea7a2ae28e854c31a803e907a383c5e2ecb7
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_NAME)-$(PKG_VERSION)
+HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_SOURCE_NAME)-$(PKG_VERSION)
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
@ -50,28 +51,42 @@ CONFIGURE_ARGS += \
 	--without-python3 \
 	--disable-zos-remote

-HOST_CONFIGURE_ARGS += \
-	--without-python \
-	--without-python3 \
-	--disable-zos-remote \
-	--without-libcap-ng
-
 ifeq ($(ARCH),aarch64)
 CONFIGURE_ARGS += --with-aarch64
 else ifeq ($(ARCH),arm)
 CONFIGURE_ARGS += --with-arm
 endif

+HOST_CONFIGURE_ARGS += \
+	--without-libcap-ng \
+	--disable-systemd \
+	--without-python \
+	--without-python3 \
+	--disable-zos-remote
+
+MAKE_PATH:=lib
+
+# Host/Compile/default doesn't include $(MAKE_PATH), override to use,
+# so we avoid building and installing unnecessary parts on the host.
+define Host/Compile
+	+$(HOST_MAKE_VARS) $(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR)/$(MAKE_PATH) $(HOST_MAKE_FLAGS) all
+endef
+
+define Host/Install
+	+$(HOST_MAKE_VARS) $(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR)/lib $(HOST_MAKE_FLAGS) install
+	+$(HOST_MAKE_VARS) $(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR)/init.d $(HOST_MAKE_FLAGS) install
+endef
+
 # We can't use the default, as the default passes $(MAKE_ARGS), which
 # overrides CC, CFLAGS, etc. and defeats the *_FOR_BUILD definitions
 # passed in CONFIGURE_VARS
 define Build/Compile
-	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/$(MAKE_PATH)/lib
+	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/$(MAKE_PATH)
 endef

 define Build/Install
-	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/$(MAKE_PATH)/lib $(MAKE_INSTALL_FLAGS) install
-	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/$(MAKE_PATH)/init.d $(MAKE_INSTALL_FLAGS) install
+	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/lib $(MAKE_INSTALL_FLAGS) install
+	$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR)/init.d $(MAKE_INSTALL_FLAGS) install
 endef

 define Build/InstallDev
@ -90,4 +105,5 @@ define Package/libaudit/install
 	$(CP) $(PKG_INSTALL_DIR)/etc/libaudit.conf $(1)/etc/
 endef

+$(eval $(call HostBuild))
 $(eval $(call BuildPackage,libaudit))
--- a/package/libs/libsemanage/Makefile
+++ b/package/libs/libsemanage/Makefile
@ -18,7 +18,7 @@ PKG_LICENSE_FILES:=COPYING
 PKG_CPE_ID:=cpe:/a:selinuxproject:libsemanage


-HOST_BUILD_DEPENDS:=audit/host libselinux/host bzip2/host
+HOST_BUILD_DEPENDS:=libaudit/host libselinux/host bzip2/host


 include $(INCLUDE_DIR)/package.mk
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=43
-PKG_DATE:=20200825
+PKG_RELEASE:=51
+PKG_DATE:=20200903

 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

@ -65,6 +65,10 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd
 	bool "Include pdnsd"
 	default y
 	
+config PACKAGE_$(PKG_NAME)_INCLUDE_https_dns_proxy
+	bool "Include Https DNS Proxy(DoH)"
+	default y
+	
 config PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks
 	bool "Include dns2socks"
 	default y
@ -101,6 +105,7 @@ define Package/$(PKG_NAME)
  +PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \
  +PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS_NG:chinadns-ng \
  +PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd:pdnsd-alt \
+  +PACKAGE_$(PKG_NAME)_INCLUDE_https_dns_proxy:https-dns-proxy \
  +PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks:dns2socks \
  +PACKAGE_$(PKG_NAME)_INCLUDE_v2ray-plugin:v2ray-plugin \
  +PACKAGE_$(PKG_NAME)_INCLUDE_simple-obfs:simple-obfs
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_naiveproxy.lua
@ -0,0 +1,14 @@
+local ucursor = require "luci.model.uci".cursor()
+local jsonc = require "luci.jsonc"
+local node_section = arg[1]
+local run_type = arg[2]
+local local_addr = arg[3]
+local local_port = arg[4]
+local node = ucursor:get_all("passwall", node_section)
+
+local config = {
+    listen = run_type .. "://" .. local_addr .. ":" .. local_port,
+    proxy = node.protocol .. "://" .. node.username .. ":" .. node.password .. "@" .. node.address .. ":" .. node.port
+}
+
+print(jsonc.stringify(config, 1))
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@ -88,8 +88,9 @@ for i = 1, udp_node_num, 1 do
        o = s:taboption("Main", ListValue, "udp_node" .. i, translate("UDP Node"))
        o.description = translate("For proxy game network, DNS hijack etc.") .. translate(" The selected server will not use Kcptun.")
        o:value("nil", translate("Close"))
-        o:value("tcp", translate("Same as the tcp node"))
-        o:value("tcp_", translate("Same as the tcp node") .. "（" .. translate("New process") .. "）")
+        o:value("tcp_", translate("Same as the tcp node"))
+        --o:value("tcp", translate("Same as the tcp node"))
+        --o:value("tcp_", translate("Same as the tcp node") .. "（" .. translate("New process") .. "）")
    else
        o = s:taboption("Main", ListValue, "udp_node" .. i,
                     translate("UDP Node") .. " " .. i)
@ -101,9 +102,12 @@ end
 s:tab("DNS", translate("DNS"))

 o = s:taboption("DNS", Value, "up_china_dns", translate("Resolver For Local/WhiteList Domains") .. "(UDP)")
-o.description = translate("IP:Port mode acceptable, multi value split with english comma.")
+o.description = translate("IP:Port mode acceptable, multi value split with english comma.") .. "<br />" .. translate("When the selection is not the default, this DNS is forced to be set to dnsmasq upstream DNS.")
 o.default = "default"
 o:value("default", translate("Default"))
+if api.is_finded("https-dns-proxy") then
+    o:value("https-dns-proxy", "https-dns-proxy(DoH)")
+end
 o:value("223.5.5.5", "223.5.5.5 (" .. translate("Ali") .. "DNS)")
 o:value("223.6.6.6", "223.6.6.6 (" .. translate("Ali") .. "DNS)")
 o:value("114.114.114.114", "114.114.114.114 (114DNS)")
@ -114,8 +118,19 @@ o:value("1.2.4.8", "1.2.4.8 (CNNIC DNS)")
 o:value("210.2.4.8", "210.2.4.8 (CNNIC DNS)")
 o:value("180.76.76.76", "180.76.76.76 (" .. translate("Baidu") .. "DNS)")

+---- DoH URL
+o = s:taboption("DNS", Value, "up_china_dns_doh_url", translate("DoH request address"))
+o.default = "https://dns.alidns.com/dns-query"
+o:depends("up_china_dns", "https-dns-proxy")
+
+---- DoH Bootstrap
+o = s:taboption("DNS", Value, "up_china_dns_doh_bootstrap", translate("DoH bootstrap DNS"), translate("The Bootstrap DNS server is used to resolve the IP address of the DoH resolver you specify as the upstream."))
+o.default = "223.5.5.5,223.6.6.6"
+o:depends("up_china_dns", "https-dns-proxy")
+
 ---- DNS Forward Mode
 o = s:taboption("DNS", Value, "dns_mode", translate("Filter Mode"))
+o.description = translate("When the selection is chinadns-ng, forced to be set to dnsmasq upstream DNS.")
 o.rmempty = false
 o:reset_values()
 if api.is_finded("chinadns-ng") then
@ -127,6 +142,9 @@ end
 if api.is_finded("dns2socks") then
    o:value("dns2socks", "dns2socks")
 end
+if api.is_finded("https-dns-proxy") then
+    o:value("https-dns-proxy", "https-dns-proxy(DoH)")
+end
 o:value("nonuse", translate("No Filter"))

 o = s:taboption("DNS", ListValue, "up_trust_pdnsd_dns", translate("Resolver For The List Proxied"))
@ -150,20 +168,47 @@ o:value("udp", translate("Access Filtered DNS By ") .. translate("UDP Node"))
 if api.is_finded("dns2socks") then
    o:value("dns2socks", "dns2socks")
 end
+if api.is_finded("https-dns-proxy") then
+    o:value("https-dns-proxy", "https-dns-proxy(DoH)")
+end
 o:depends("dns_mode", "chinadns-ng")

+o = s:taboption("DNS", ListValue, "up_trust_doh_dns", translate("Resolver For The List Proxied"))
+o:value("tcp", translate("Access Filtered DNS By ") .. translate("TCP Node"))
+o:value("socks", translate("Access Filtered DNS By ") .. translate("Socks Node"))
+o:depends("dns_mode", "https-dns-proxy")
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})
+
 ---- Upstream trust DNS Mode for ChinaDNS-NG
 o = s:taboption("DNS", Value, "socks_server", translate("Socks Server"), translate("Make sure socks service is available on this address if 'dns2socks' selected."))
 o.default = ""
 for k, v in pairs(socks_table) do o:value(v.id, v.remarks) end
+o:depends({dns_mode = "pdnsd", up_trust_pdnsd_dns = "dns2socks"})
 o:depends({dns_mode = "dns2socks"})
 o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})
-o:depends({dns_mode = "pdnsd", up_trust_pdnsd_dns = "dns2socks"})
+o:depends({dns_mode = "https-dns-proxy", up_trust_doh_dns = "socks"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy", up_trust_doh_dns = "socks"})

 o = s:taboption("DNS", Flag, "fair_mode", translate("ChinaDNS-NG Fair Mode"))
 o.default = "1"
 o:depends({dns_mode = "chinadns-ng"})

+---- DoH URL
+o = s:taboption("DNS", Value, "doh_url", translate("DoH request address"))
+o.default = "https://dns.google/dns-query"
+o:depends({dns_mode = "https-dns-proxy"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})
+
+---- DoH Bootstrap
+o = s:taboption("DNS", Value, "doh_bootstrap", translate("DoH bootstrap DNS"), translate("The Bootstrap DNS server is used to resolve the IP address of the DoH resolver you specify as the upstream."))
+o.default = "8.8.4.4"
+o:value("8.8.4.4", "8.8.4.4 (Google DNS)")
+o:value("8.8.8.8", "8.8.8.8 (Google DNS)")
+o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
+o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
+o:depends({dns_mode = "https-dns-proxy"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})
+
 ---- DNS Forward
 o = s:taboption("DNS", Value, "dns_forward", translate("Filtered DNS(For Proxied Domains)"), translate("IP:Port mode acceptable, the 1st for 'dns2socks' if split with english comma."))
 o.default = "8.8.4.4"
@ -171,9 +216,11 @@ o:value("8.8.4.4", "8.8.4.4 (Google DNS)")
 o:value("8.8.8.8", "8.8.8.8 (Google DNS)")
 o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
 o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
-o:depends({dns_mode = "chinadns-ng"})
 o:depends({dns_mode = "dns2socks"})
 o:depends({dns_mode = "pdnsd"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "pdnsd"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "udp"})
+o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})

 o = s:taboption("DNS", Flag, "dns_cache", translate("Cache Resolved"))
 o.default = "1"
@ -182,10 +229,8 @@ o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})
 o:depends({dns_mode = "dns2socks"})
 o:depends({dns_mode = "pdnsd"})

-o = s:taboption("DNS", ListValue, "dns_default", translate("Dnsmasq default dns"), translate("When the accessed domain name does not exist in the rule list, the default DNS used."))
-o.default = "china"
-o:value("china", translate("China"))
-o:value("remote", translate("Remote"))
+o = s:taboption("DNS", Flag, "use_chnlist", translate("Use ChinaList"), translate("Only useful in non-gfwlist mode.") .. "<br />" .. translate("When used, the domestic DNS will be used only when the chnlist rule is hit, and the domain name that misses the rule will be resolved by remote DNS."))
+o.default = "0"

 o = s:taboption("DNS", Button, "clear_ipset", translate("Clear IPSET"), translate("Try this feature if the rule modification does not take effect."))
 o.inputstyle = "remove"
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/node_config.lua
@ -96,6 +96,9 @@ end
 if api.is_finded("trojan-go") then
    type:value("Trojan-Go", translate("Trojan-Go"))
 end
+if api.is_finded("naive") then
+    type:value("Naiveproxy", translate("NaiveProxy"))
+end

 protocol = s:option(ListValue, "protocol", translate("Protocol"))
 protocol:value("vmess", translate("Vmess"))
@ -142,7 +145,7 @@ for k, v in pairs(nodes_table) do default_node:value(v.id, v.remarks) end
 default_node:depends("protocol", "_shunt")

 -- Brook协议
-brook_protocol = s:option(ListValue, "brook_protocol", translate("Brook Protocol"))
+brook_protocol = s:option(ListValue, "brook_protocol", translate("Protocol"))
 brook_protocol:value("client", translate("Brook"))
 brook_protocol:value("wsclient", translate("WebSocket"))
 brook_protocol:depends("type", "Brook")
@ -156,6 +159,18 @@ end
 brook_tls = s:option(Flag, "brook_tls", translate("Use TLS"))
 brook_tls:depends("brook_protocol", "wsclient")

+-- Naiveproxy协议
+naiveproxy_protocol = s:option(ListValue, "naiveproxy_protocol", translate("Protocol"))
+naiveproxy_protocol:value("https", translate("HTTPS"))
+naiveproxy_protocol:value("quic", translate("QUIC"))
+naiveproxy_protocol:depends("type", "Naiveproxy")
+function naiveproxy_protocol.cfgvalue(self, section)
+	return m:get(section, "protocol")
+end
+function naiveproxy_protocol.write(self, section, value)
+	m:set(section, "protocol", value)
+end
+
 address = s:option(Value, "address", translate("Address (Support Domain Name)"))
 address.rmempty = false
 address:depends("type", "Socks")
@ -170,6 +185,7 @@ address:depends("type", "Brook")
 address:depends("type", "Trojan")
 address:depends("type", "Trojan-Plus")
 address:depends("type", "Trojan-Go")
+address:depends("type", "Naiveproxy")

 --[[
 use_ipv6 = s:option(Flag, "use_ipv6", translate("Use IPv6"))
@ -203,9 +219,11 @@ port:depends("type", "Brook")
 port:depends("type", "Trojan")
 port:depends("type", "Trojan-Plus")
 port:depends("type", "Trojan-Go")
+port:depends("type", "Naiveproxy")

 username = s:option(Value, "username", translate("Username"))
 username:depends("type", "Socks")
+username:depends("type", "Naiveproxy")
 username:depends("protocol", "http")
 username:depends("protocol", "socks")

@ -218,6 +236,7 @@ password:depends("type", "Brook")
 password:depends("type", "Trojan")
 password:depends("type", "Trojan-Plus")
 password:depends("type", "Trojan-Go")
+password:depends("type", "Naiveproxy")
 password:depends("protocol", "http")
 password:depends("protocol", "socks")
 password:depends("protocol", "shadowsocks")
@ -405,7 +424,7 @@ trojan_transport:value("original", "Original")
 trojan_transport:value("ws", "WebSocket")
 trojan_transport:value("h2", "HTTP/2")
 trojan_transport:value("h2+ws", "HTTP/2 & WebSocket")
-trojan_transport.default = "ws"
+trojan_transport.default = "original"
 trojan_transport:depends("type", "Trojan-Go")

 trojan_plugin = s:option(ListValue, "plugin_type", translate("Plugin Type"))
--- a/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm
+++ b/package/lienol/luci-app-passwall/luasrc/view/passwall/node_list/link_share_man.htm
@ -400,7 +400,7 @@ local dsp = require "luci.dispatcher"
 				}
 			}
 		} else if (ssu[0] === "trojan") {
-			var stype = "Trojan";
+			var stype = "Trojan-Plus";
 			var m = parseNodeUrl(ssrurl);
 			console.log(m.search);
 			var password = m.passwd;
--- a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
+++ b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
@ -154,6 +154,21 @@ msgstr "解析本地和白名单域名"
 msgid "IP:Port mode acceptable, multi value split with english comma."
 msgstr "接受 IP:Port 形式的输入，多个以英文逗号分隔。"

+msgid "When the selection is not the default, this DNS is forced to be set to dnsmasq upstream DNS."
+msgstr "当选择的不是默认，则将此DNS强制设置为dnsmasq上游DNS。"
+
+msgid "When the selection is chinadns-ng, forced to be set to dnsmasq upstream DNS."
+msgstr "当选择的是ChinaDNS-NG，则将强制设置为dnsmasq上游DNS。"
+
+msgid "Use ChinaList"
+msgstr "使用chnlist"
+
+msgid "Only useful in non-gfwlist mode."
+msgstr "仅可用于非防火墙表。"
+
+msgid "When used, the domestic DNS will be used only when the chnlist rule is hit, and the domain name that misses the rule will be resolved by remote DNS."
+msgstr "当使用时，只有当命中chnlist规则时，才会使用国内DNS，未命中规则的域名将会使用远程DNS解析。"
+
 msgid "Ali"
 msgstr "阿里"

@ -184,6 +199,15 @@ msgstr "ChinaDNS-NG 公平模式"
 msgid "Filtered DNS(For Proxied Domains)"
 msgstr "域名过滤服务(用于被代理的域名)"

+msgid "DoH request address"
+msgstr "DoH 请求地址"
+
+msgid "DoH bootstrap DNS"
+msgstr "DoH Bootstrap DNS"
+
+msgid "The Bootstrap DNS server is used to resolve the IP address of the DoH resolver you specify as the upstream."
+msgstr "Bootstrap DNS 服务器用于解析您指定为上游的 DoH 解析器的 IP 地址。"
+
 msgid "IP:Port mode acceptable, the 1st for 'dns2socks' if split with english comma."
 msgstr "接受 IP:Port 形式的输入，多个以英文逗号分隔 ，'dns2socks' 模式下仅首个有效。"

@ -871,6 +895,9 @@ msgstr "Brook协议"
 msgid "Use TLS"
 msgstr "使用TLS"

+msgid "Naiveproxy Protocol"
+msgstr "Naiveproxy协议"
+
 msgid "V2ray Protocol"
 msgstr "V2ray协议"

--- a/package/lienol/luci-app-passwall/root/etc/config/passwall
+++ b/package/lienol/luci-app-passwall/root/etc/config/passwall
@ -6,7 +6,7 @@ config global
 	option dns_mode 'pdnsd'
 	option up_china_dns 'default'
 	option dns_forward '8.8.4.4'
-	option dns_default 'china'
+	option use_chnlist '1'
 	option use_tcp_node_resolve_dns '1'
 	option tcp_proxy_mode 'chnroute'
 	option udp_proxy_mode 'chnroute'
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@ -15,6 +15,7 @@ RULES_PATH=/usr/share/${CONFIG}/rules
 TMP_DNSMASQ_PATH=/var/etc/dnsmasq-passwall.d
 DNSMASQ_PATH=/etc/dnsmasq.d
 RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto
+LOCAL_DOH_PORT=7912
 DNS_PORT=7913
 TUN_DNS="127.0.0.1#${DNS_PORT}"
 IS_DEFAULT_DNS=
@ -27,6 +28,7 @@ LUA_API_PATH=/usr/lib/lua/luci/model/cbi/$CONFIG/api
 API_GEN_SS=$LUA_API_PATH/gen_shadowsocks.lua
 API_GEN_V2RAY=$LUA_API_PATH/gen_v2ray.lua
 API_GEN_TROJAN=$LUA_API_PATH/gen_trojan.lua
+API_GEN_NAIVE=$LUA_API_PATH/gen_naiveproxy.lua
 echolog() {
 	local d="$(date "+%Y-%m-%d %H:%M:%S")"
 	echo -e "$d: $*" >>$LOG_FILE
@ -283,7 +285,7 @@ load_config() {
 	DNS_MODE=$(config_t_get global dns_mode pdnsd)
 	DNS_FORWARD=$(config_t_get global dns_forward 8.8.4.4:53 | sed 's/:/#/g')
 	DNS_CACHE=$(config_t_get global dns_cache 1)
-	DNS_DEFAULT=$(config_t_get global dns_default china)
+	USE_CHNLIST=$(config_t_get global use_chnlist 0)
 	process=1
 	if [ "$(config_t_get global_forwarding process 0)" = "0" ]; then
 		process=$(cat /proc/cpuinfo | grep 'processor' | wc -l)
@ -341,6 +343,9 @@ run_socks() {
 	elif [ "$type" == "trojan-go" ]; then
 		lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
 		ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file"
+	elif [ "$type" == "naiveproxy" ]; then
+		lua $API_GEN_NAIVE $node socks $bind $local_port > $config_file
+		ln_start_bin "$(first_type naive)" naive "$config_file"
 	elif [ "$type" == "brook" ]; then
 		local protocol=$(config_n_get $node protocol client)
 		local brook_tls=$(config_n_get $node brook_tls 0)
@ -397,6 +402,8 @@ run_redir() {
 		elif [ "$type" == "trojan-go" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port >$config_file
 			ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file"
+		elif [ "$type" == "naiveproxy" ]; then
+			echolog "Naiveproxy不支持UDP转发！"
 		elif [ "$type" == "brook" ]; then
 			local protocol=$(config_n_get $node protocol client)
 			if [ "$protocol" == "wsclient" ]; then
@ -438,6 +445,9 @@ run_redir() {
 		elif [ "$type" == "trojan-go" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port > $config_file
 			ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go -config "$config_file"
+		elif [ "$type" == "naiveproxy" ]; then
+			lua $API_GEN_NAIVE $node redir "0.0.0.0" $local_port > $config_file
+			ln_start_bin "$(first_type naive)" naive "$config_file"
 		else
 			local kcptun_use=$(config_n_get $node use_kcp 0)
 			if [ "$kcptun_use" == "1" ]; then
@ -619,12 +629,20 @@ stop_crontab() {
 }

 start_dns() {
-	local dns2socks_socks_server dns2socks_forward dns2sock_cache pdnsd_port pdnsd_forward other_port up_trust_pdnsd_dns msg
+	if [ "${LOCAL_DNS}" = "https-dns-proxy" ]; then
+		up_china_dns_doh_url=$(config_t_get global up_china_dns_doh_url "https://dns.alidns.com/dns-query")
+		up_china_dns_doh_bootstrap=$(config_t_get global up_china_dns_doh_bootstrap "223.5.5.5,223.6.6.6")
+		ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${LOCAL_DOH_PORT}" -b "${up_china_dns_doh_bootstrap}" -r "${up_china_dns_doh_url}" -4
+		LOCAL_DNS="127.0.0.1#${LOCAL_DOH_PORT}"
+	fi
+
+	local dns2socks_socks_server dns2socks_forward dns2sock_cache doh_port pdnsd_port pdnsd_forward other_port up_trust_pdnsd_dns msg
 	local global chnlist returnhome china_ng_chn china_ng_gfw chnlist_param gfwlist_param extra_mode up_trust_chinadns_ng_dns
 	dns2socks_socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:9050) | sed "s/#/:/g")
 	dns2socks_forward=$(get_first_dns DNS_FORWARD 53 | sed 's/#/:/g')
 	dns2socks_listen="127.0.0.1:${DNS_PORT}"
 	[ "$DNS_CACHE" == "0" ] && dns2sock_cache="/d"
+	doh_port=${DNS_PORT}
 	pdnsd_port=${DNS_PORT}
 	pdnsd_forward=${DNS_FORWARD}
 	china_ng_chn="${LOCAL_DNS}"
@ -644,10 +662,21 @@ start_dns() {
 	dns2socks)
 		echolog "  - 域名解析 dns2socks..."
 	;;
+	https-dns-proxy)
+		up_trust_doh_dns=$(config_t_get global up_trust_doh_dns "tcp")
+		if [ "$up_trust_doh_dns" = "socks" ]; then
+			use_tcp_node_resolve_dns=0
+			msg="Socks节点"
+		elif [ "${up_trust_doh_dns}" = "tcp" ]; then
+			use_tcp_node_resolve_dns=1
+			msg="TCP节点"
+		fi
+		echolog "  - 域名解析 https-dns-proxy(DOH)..."
+	;;
 	pdnsd)
 		up_trust_pdnsd_dns=$(config_t_get global up_trust_pdnsd_dns "nil")
 		if [ "$up_trust_pdnsd_dns" = "dns2socks" ]; then
-			[ -n "${returnhome}" ] && pdnsd_forward=${china_ng_chn} ||  pdnsd_forward=${china_ng_gfw}
+			[ -n "${returnhome}" ] && pdnsd_forward=${china_ng_chn} || pdnsd_forward=${china_ng_gfw}
 			dns2socks_listen=${pdnsd_forward}
 			msg="dns2socks"
 		elif [ "$up_trust_pdnsd_dns" = "udp" ]; then
@ -670,8 +699,11 @@ start_dns() {
 			msg="pdnsd"
 		elif [ "$up_trust_chinadns_ng_dns" = "dns2socks" ]; then
 			dns2socks_listen=${china_ng_gfw}
-			[ -n "${global}${chnlist}" ] && TUN_DNS="${dns2socks_listen}"
+			#[ -n "${global}${chnlist}" ] && TUN_DNS="${dns2socks_listen}"
 			msg="dns2socks"
+		elif [ "$up_trust_chinadns_ng_dns" = "https-dns-proxy" ]; then
+			doh_port=${other_port}
+			msg="https-dns-proxy(DoH)"
 		elif [ "$up_trust_chinadns_ng_dns" = "udp" ]; then
 			use_udp_node_resolve_dns=1
 			if [ -z "${returnhome}" ]; then
@ -681,21 +713,25 @@ start_dns() {
 			fi
 			msg="udp"
 		fi
-		cp -a "${RULES_PATH}/chnlist" "${TMP_PATH}/chnlist"
-		if [ -z "${returnhome}" ]; then
-			cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist"
-			echolog "  | - [$?](chinadns-ng) 域名白名单合并到中国域名表"
-			cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt"
-			echolog "  | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表"
-			gfwlist_param="${TMP_PATH}/gfwlist.txt"
-		else
-			echolog "  | - (chinadns-ng) 白名单不与中国域名表合并"
-			cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist"
-			echolog "  | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表"
-		fi
-		chnlist_param="${TMP_PATH}/chnlist"
+		chnlist_param=
+		[ "$USE_CHNLIST" = "1" ] && {
+			cp -a "${RULES_PATH}/chnlist" "${TMP_PATH}/chnlist"
+			if [ -z "${returnhome}" ]; then
+				cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist"
+				echolog "  | - [$?](chinadns-ng) 域名白名单合并到中国域名表"
+				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt"
+				echolog "  | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表"
+				gfwlist_param="${TMP_PATH}/gfwlist.txt"
+			else
+				echolog "  | - (chinadns-ng) 白名单不与中国域名表合并"
+				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist"
+				echolog "  | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表"
+			fi
+			chnlist_param="${TMP_PATH}/chnlist"
+			chnlist_param=${chnlist_param:+-m "${chnlist_param}" -M}
+		}
 		[ "$(config_t_get global fair_mode 1)" = "1" ] && extra_mode="-f"
-		ln_start_bin "$(first_type chinadns-ng)" chinadns-ng -l "${DNS_PORT}" ${china_ng_chn:+-c "${china_ng_chn}"} ${chnlist_param:+-m "${chnlist_param}" -M} ${china_ng_gfw:+-t "${china_ng_gfw}"} ${gfwlist_param:+-g "${gfwlist_param}"} $extra_mode
+		ln_start_bin "$(first_type chinadns-ng)" chinadns-ng -l "${DNS_PORT}" ${china_ng_chn:+-c "${china_ng_chn}"} ${chnlist_param} ${china_ng_gfw:+-t "${china_ng_gfw}"} ${gfwlist_param:+-g "${gfwlist_param}"} $extra_mode
 		echolog "  + 过滤服务：ChinaDNS-NG(:${DNS_PORT}${extra_mode}) + ${msg}：中国域名列表：${china_ng_chn:-D114.114.114.114}，防火墙域名列表：${china_ng_gfw:-D8.8.8.8}"
 		#[ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS="${china_ng_gfw}"
 	;;
@ -709,18 +745,31 @@ start_dns() {
 		gen_pdnsd_config "${pdnsd_port}" "${pdnsd_forward}"
 		ln_start_bin "$(first_type pdnsd)" pdnsd --daemon -c "${TMP_PATH}/pdnsd/pdnsd.conf" -d
 	fi
+	if [ -n "$(echo ${DNS_MODE}${up_trust_chinadns_ng_dns} | grep 'https-dns-proxy')" ]; then
+		doh_url=$(config_t_get global doh_url "https://dns.google/dns-query")
+		doh_bootstrap=$(config_t_get global doh_bootstrap "8.8.4.4")
+		
+		up_trust_doh_dns=$(config_t_get global up_trust_doh_dns "tcp")
+		if [ "$up_trust_doh_dns" = "socks" ]; then
+			socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:9050) | sed "s/#/:/g")
+			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${doh_port}" -b "${doh_bootstrap}" -r "${doh_url}" -4 -t socks5h://${socks_server}
+		elif [ "${up_trust_doh_dns}" = "tcp" ]; then
+			DNS_FORWARD=${doh_bootstrap}:443
+			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${doh_port}" -b "${doh_bootstrap}" -r "${doh_url}" -4
+		fi
+	fi
 	if [ -n "$(echo ${DNS_MODE}${up_trust_chinadns_ng_dns}${up_trust_pdnsd_dns} | grep dns2socks)" ]; then
 		dns2socks_listen=$(echo "${dns2socks_listen}" | sed 's/#/:/g')
 		ln_start_bin "$(first_type dns2socks)" dns2socks "$dns2socks_socks_server" "$dns2socks_forward" "$dns2socks_listen" $dns2sock_cache
 		echolog "  - dns2sock(${dns2socks_listen}${dns2sock_cache})，${dns2socks_socks_server:-127.0.0.1:9050} -> ${dns2socks_forward-D46.182.19.48:53}"
-		[ "${DNS_MODE}" = "chinadns-ng" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS="${dns2socks_listen}"
+		#[ "${DNS_MODE}" = "chinadns-ng" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS=$(echo "${dns2socks_listen}" | sed 's/:/#/g')
 	fi
 	[ "${use_udp_node_resolve_dns}" = "1" ] && echolog "  * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发"
 	[ "${use_tcp_node_resolve_dns}" = "1" ] && echolog "  * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发"
 }

 add_dnsmasq() {
-	local global returnhome chnlist gfwlist force_local filtered_dns fwd_dns items item servers msg
+	local global returnhome chnlist gfwlist fwd_dns items item servers msg

 	mkdir -p "${TMP_DNSMASQ_PATH}" "${DNSMASQ_PATH}" "/var/dnsmasq.d"
 	[ "$(config_t_get global_rules adblock 0)" = "1" ] && {
@ -735,13 +784,10 @@ add_dnsmasq() {
 		returnhome=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "returnhome")
 		chnlist=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "chnroute")
 		gfwlist=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "gfwlist")
-		if [ "${IS_DEFAULT_DNS}" = "1" ]; then
-			force_local=1
-			[ -n "${chnlist}" ] && force_local=2
-			[ "${DNS_MODE}" = "other_dns" ] || [ "${DNS_MODE}" = "chinadns-ng" ] && force_local=3
+		
+		if [ "${USE_CHNLIST}" = "1" ] && [ -n "${gfwlist}" ]; then
+			USE_CHNLIST=0
 		fi
-		[ "${DNS_MODE}" = "other_dns" ] || [ "${DNS_MODE}" = "chinadns-ng" ] || [ -n "${global}${chnlist}" ] && filtered_dns=1
-		[ "${DNS_DEFAULT}" = "china" ] && unset filtered_dns
 		
 		#始终用国内DNS解析节点域名
 		fwd_dns="${LOCAL_DNS}"
@ -749,40 +795,57 @@ add_dnsmasq() {
 		hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/vpsiplist_host.conf"
 		echolog "  - [$?]节点列表中的域名(vpsiplist)：${fwd_dns:-默认}"

+		#始终用国内DNS解析直连（白名单）列表		
 		fwd_dns="${LOCAL_DNS}"
-		[ -z "${global}" ] && {
-			[ -z "${chnlist}" ] || [ -n "${returnhome}" ] && [ -n "${force_local}" ] && unset fwd_dns
-			[ "${DNS_DEFAULT}" = "china" ] && unset fwd_dns
-			[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
-			[ "${DNS_MODE}" = "other_dns" ] && fwd_dns="${TUN_DNS}"
-			sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf"
-			echolog "  - [$?]域名白名单(whitelist)：${fwd_dns:-默认}"
-		}
-
-		[ -n "${returnhome}" ] || [ "${filtered_dns}" = "1" ] && {
-			[ -n "${gfwlist}" ] && fwd_dns="${LOCAL_DNS}"
-			[ -n "${returnhome}" ] && fwd_dns="${TUN_DNS}"
-			[ "${filtered_dns}" = "1" ] && [ -z "${chnlist}" ] && unset fwd_dns
-			[ "${DNS_DEFAULT}" = "china" ] && unset fwd_dns
-			[ -n "${global}" ] && unset fwd_dns
-			sort -u "${RULES_PATH}/chnlist" | gen_dnsmasq_items "chnroute" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/chinalist_host.conf"
-			echolog "  - [$?]中国域名表(chnroute)：${fwd_dns:-默认}"
+		#如果使用Chinadns-NG直接交给Chinadns-NG处理
+		[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+		#如果没使用chnlist直接使用默认DNS
+		[ "${USE_CHNLIST}" = "0" ] && unset fwd_dns
+		sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf"
+		echolog "  - [$?]域名白名单(whitelist)：${fwd_dns:-默认}"
+
+		#当勾选使用chnlist，仅当使用大陆白名单或回国模式
+		[ "${USE_CHNLIST}" = "1" ] && {
+			fwd_dns="${LOCAL_DNS}"
+			[ -n "${returnhome}" ] || [ -n "${chnlist}" ] && {
+				[ -n "${global}" ] && unset fwd_dns
+				#如果使用Chinadns-NG直接交给Chinadns-NG处理
+				[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+				#如果使用回国模式，设置dns为远程DNS。
+				[ -n "${returnhome}" ] && fwd_dns="${TUN_DNS}"
+				sort -u "${RULES_PATH}/chnlist" | gen_dnsmasq_items "chnroute" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/chinalist_host.conf"
+				echolog "  - [$?]中国域名表(chnroute)：${fwd_dns:-默认}"
+			}
 		}

+		#始终使用远程DNS解析代理（黑名单）列表
 		fwd_dns="${TUN_DNS}"
-		[ "${filtered_dns}" = "1" ] && [ -z "${returnhome}" ] && unset fwd_dns
-		[ "${DNS_MODE}" = "chinadns-ng" ] || [ -n "${global}" ] && [ -z "${returnhome}" ] && unset fwd_dns
+		#如果使用Chinadns-NG直接交给Chinadns-NG处理
+		[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+		#如果使用chnlist直接使用默认DNS
+		[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 		sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/proxy_host.conf"
 		echolog "  - [$?]代理域名表(blacklist)：${fwd_dns:-默认}"

+		#如果没有使用回国模式
 		[ -z "${returnhome}" ] && {
-			[ "${filtered_dns}" = "1" ] && [ "${DNS_MODE}" != "chinadns-ng" ] && unset fwd_dns
+			fwd_dns="${TUN_DNS}"
+			#如果使用Chinadns-NG直接交给Chinadns-NG处理
+			[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+			#如果使用chnlist直接使用默认DNS
+			[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 			sort -u "${TMP_PATH}/gfwlist.txt" | gen_dnsmasq_items "gfwlist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/gfwlist.conf"
 			#sort -u "${TMP_PATH}/gfwlist.txt" | gen_dnsmasq_items "gfwlist,gfwlist6" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/gfwlist.conf"
 			echolog "  - [$?]防火墙域名表(gfwlist)：${fwd_dns:-默认}"
 		}

+		#如果开启了通过代理订阅
 		[ "$(config_t_get global_subscribe subscribe_proxy 0)" = "1" ] && {
+			fwd_dns="${TUN_DNS}"
+			#如果使用Chinadns-NG直接交给Chinadns-NG处理
+			[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+			#如果使用chnlist直接使用默认DNS
+			[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 			items=$(get_enabled_anonymous_secs "@subscribe_list")
 			for item in ${items}; do
 				host_from_url "$(config_n_get ${item} url)" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/subscribe.conf"
@ -795,20 +858,18 @@ add_dnsmasq() {
 		msg="ISP"
 		servers="${LOCAL_DNS}"
 		echo "conf-dir=${TMP_DNSMASQ_PATH}" > "/var/dnsmasq.d/dnsmasq-${CONFIG}.conf"
+		#兼容旧版dnsmasq
 		echo "conf-dir=${TMP_DNSMASQ_PATH}" > "${DNSMASQ_PATH}/dnsmasq-${CONFIG}.conf"

-		[ "${filtered_dns}" = "1" ] && [ -z "${returnhome}" ] && servers="${TUN_DNS}"
+		[ "${USE_CHNLIST}" = "1" ] && servers="${TUN_DNS}"
 		[ -n "${chnlist}" ] && msg="中国列表以外"
 		[ -n "${returnhome}" ] && msg="中国列表"
 		[ -n "${global}" ] && msg="全局"
-		if [ "${DNS_MODE}" = "other_dns" ]; then
-			msg="指定DNS"
-		elif [ "${DNS_MODE}" = "chinadns-ng" ]; then
-			#[ -z "${global}${chnlist}" ] && servers="127.0.0.1#${DNS_PORT}" && msg="chinadns-ng"
+		if [ "${DNS_MODE}" = "chinadns-ng" ]; then
 			#直接交给Chinadns-ng处理
 			servers="${TUN_DNS}" && msg="chinadns-ng"
 		else
-			[ "${IS_DEFAULT_DNS}" = "1" ] && [ "${filtered_dns}" != "1" ] && {
+			[ "${IS_DEFAULT_DNS}" = "1" ] && [ "${USE_CHNLIST}" = "0" ] && {
 				echolog "  - 不强制设置默认DNS(上级分配)！"
 				return
 			}
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/subscribe.lua
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/subscribe.lua
@ -575,7 +575,7 @@ local function processData(szType, content, add_mode)
 		log('暂时不支持' .. szType .. "类型的节点订阅，跳过此节点。")
 		return nil
 	end
-	if not result.remarks then
+	if not result.remarks or result.remarks == "" then
 		if result.address and result.port then
 			result.remarks = result.address .. ':' .. result.port
 		else
@ -841,7 +841,7 @@ local function parse_link(raw, remark, manual)
 				end
 				-- log(result)
 				if result then
-					if is_filter_keyword(result.remarks) or
+					if (not manual and is_filter_keyword(result.remarks)) or
 						not result.address or
 						result.remarks == "NULL" or
 						result.address:match("[^0-9a-zA-Z%-%_%.%s]") or -- 中文做地址的 也没有人拿中文域名搞，就算中文域也有Puny Code SB 机场
--- a/package/system/refpolicy/Makefile
+++ b/package/system/refpolicy/Makefile
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=refpolicy
 PKG_VERSION:=2.20200229
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_2_20200229
--- a/package/system/refpolicy/patches/100-no-docs.patch
+++ b/package/system/refpolicy/patches/100-no-docs.patch
@ -0,0 +1,12 @@
+Index: refpolicy-2.20200229/Makefile
+===================================================================
+--- refpolicy-2.20200229.orig/Makefile
+++ refpolicy-2.20200229/Makefile
+@@ -648,6 +648,6 @@ ifneq ($(generated_fc),)
+ endif
+ endif
+ 
+-.PHONY: install-src install-appconfig install-headers generate xml conf html bare tags
+.PHONY: install-src install-appconfig install-headers generate conf bare tags
+ .SUFFIXES:
+ .SUFFIXES: .c
--- a/package/utils/ugps/Makefile
+++ b/package/utils/ugps/Makefile
@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ugps.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-05-29
-PKG_SOURCE_VERSION:=0c54380e3d8920100fcfd41f0a1fe9872eb37d0e
-PKG_MIRROR_HASH:=cf7e5af73f9feabf643f988c040fd3783dc44c6f4b1ecada0957d4ee3d67c14e
+PKG_SOURCE_DATE:=2020-08-29
+PKG_SOURCE_VERSION:=511a5b3c84fa715ef0305cf26c98619c12a4867a
+PKG_MIRROR_HASH:=551d57b4c18da4c4695fa2f7a959c25a03be35d14cf872785e7db740f12366e2

 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=GPL-2.0+
--- a/rules.mk
+++ b/rules.mk
@ -266,7 +266,13 @@ endif

 BUILD_KEY=$(TOPDIR)/key-build

-FAKEROOT:=$(STAGING_DIR_HOST)/bin/fakeroot -l $(STAGING_DIR_HOST)/lib/libfakeroot.so -f $(STAGING_DIR_HOST)/bin/faked
+ifeq ($(HOST_OS),Darwin)
+  FAKEROOT_SO:=$(STAGING_DIR_HOST)/lib/libfakeroot.dylib
+else
+  FAKEROOT_SO:=$(STAGING_DIR_HOST)/lib/libfakeroot.so
+endif
+FAKEROOT:=$(STAGING_DIR_HOST)/bin/fakeroot -l $(FAKEROOT_SO) -f $(STAGING_DIR_HOST)/bin/faked
+
 TARGET_CC:=$(TARGET_CROSS)gcc
 TARGET_CXX:=$(TARGET_CROSS)g++
 KPATCH:=$(SCRIPT_DIR)/patch-kernel.sh
--- a/tools/squashfskit4/patches/0010-portability.patch
+++ b/tools/squashfskit4/patches/0010-portability.patch
@ -0,0 +1,37 @@
+--- a/squashfs-tools/xattr.c
+++ b/squashfs-tools/xattr.c
+@@ -113,6 +113,7 @@ static int get_prefix(struct xattr_list
+ 
+ static int read_xattrs_from_system(char *filename, struct xattr_list **xattrs)
+ {
+#if defined(linux)
+ 	ssize_t size, vsize;
+ 	char *xattr_names, *p;
+ 	int i;
+@@ -222,6 +223,10 @@ failed:
+ 	free(xattr_list);
+ 	free(xattr_names);
+ 	return 0;
+#else
+	*xattrs = NULL;
+	return 0;
+#endif
+ }
+ 
+ 
+--- a/squashfs-tools/unsquashfs_xattr.c
+++ b/squashfs-tools/unsquashfs_xattr.c
+@@ -34,6 +34,7 @@ extern int user_xattrs;
+ 
+ void write_xattr(char *pathname, unsigned int xattr)
+ {
+#if defined(linux)
+ 	unsigned int count;
+ 	struct xattr_list *xattr_list;
+ 	int i;
+@@ -136,4 +137,5 @@ void write_xattr(char *pathname, unsigne
+ 	}
+ 
+ 	free_xattr(xattr_list, count);
+#endif
+ }