Merge Mainline

package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash

@@ -26,6 +26,9 @@ PROXY_FILE="/tmp/yaml_proxy.yaml"
 PROXY_PROVIDER_FILE="/tmp/yaml_proxy_provider.yaml"
 GROUP_FILE="/tmp/yaml_group.yaml"
 GAME_RULE_FILE="/tmp/yaml_game_rule_group.yaml"
+CFW_LATE_FILE="/tmp/yaml_cfw_late_file.yaml"
+CFW_PASS_FILE="/tmp/yaml_cfw_pass_file.yaml"
+FALLBACK_FILTER_FILE="/tmp/yaml_fallback_filter_file.yaml"
 HOSTS_FILE="/etc/openclash/custom/openclash_custom_hosts.list"
 PROXY_FWMARK="0x162"
 PROXY_ROUTE_TABLE="0x162"
@@ -116,44 +119,6 @@ kill_clash()
    sleep 1
 }
 
-field_cut()
-{
-   local i lines end_len
-   proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null |sed -n 1p)
-   provider_len=$(sed -n '/^proxy-providers:/=' "$3" 2>/dev/null)
-   group_len=$(sed -n '/^proxy-groups:/=' "$3" 2>/dev/null)
-   rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
-   rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
-   script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
-   lines="$proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
-   
-   for i in $lines; do
-      if [ -z "$1" ]; then
-         break
-      fi
-      
-      if [ "$1" -ge "$i" ]; then
-         continue
-      fi
-	    
-      if [ "$end_len" -gt "$i" ] || [ -z "$end_len" ]; then
-	       end_len="$i"
-      fi
-   done 2>/dev/null
-   
-   if [ -n "$1" ] && [ -z "$end_len" ]; then
-      end_len=$(sed -n '$=' "$3")
-   elif [ -n "$end_len" ]; then
-      end_len=$(expr "$end_len" - 1)
-   fi
-   
-   sed -n "${1},${end_len}p" "$3" > "$2" 2>/dev/null
-   
-   if [ -z "$4" ]; then
-      sed -i "${1},${end_len}d" "$3" 2>/dev/null
-   fi
-}
-
 yml_merge()
 {
 #合并文件
@@ -173,14 +138,10 @@ yml_check()
    sed -i "s/- \{2,\}/- /g" "$3" 2>/dev/null
    sed -i "s/^\.\.\.$//g" "$3" 2>/dev/null
    sed -i "s/^---$//g" "$3" 2>/dev/null
+   sed -i "s/^ \{1,\}dns:/dns:/g" "$3" 2>/dev/null
 
    #检查关键字避免后续操作出错
    /usr/share/openclash/yml_field_name_ch.sh "$3" 2>/dev/null
-
-   #dns
-   [ -z "$(grep "^dns:" "$3")" ] && {
-      sed -i "s/^ \{1,\}dns:/dns:/g" "$3" 2>/dev/null
-   }
 	 
 	 #创建启动备份
    cp "$3" "$5"
@@ -190,164 +151,157 @@ yml_check()
       cp "$3" "$4"
    fi
 
-   #位置检查
-   proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null |sed -n 1p)
+   #取出general部分
+   /usr/share/openclash/yml_field_cut.sh "general" "$CHANGE_FILE" "$3"
+   
+   #取出dns部分
+   nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
+   if [ -n "$nameserver_len" ]; then
+      /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "$DNS_FILE" "$3"
+   fi 2>/dev/null
+   
+   #取出proxy部分
+   proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null)
+   if [ -n "$proxy_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$proxy_len" "$PROXY_FILE" "$3"
+   fi 2>/dev/null
+   
+   #取出proxy-providers部分
    provider_len=$(sed -n '/^proxy-providers:/=' "$3" 2>/dev/null)
+   if [ -n "$provider_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$provider_len" "$PROXY_PROVIDER_FILE" "$3"
+   fi 2>/dev/null
+   
+   #取出group部分
    group_len=$(sed -n '/^proxy-groups:/=' "$3" 2>/dev/null)
-   dns_len=$(sed -n '/^dns:/=' "$3" 2>/dev/null)
-   rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
-
-   if [ "$dns_len" -ge "$proxy_len" ] || [ "$dns_len" -ge "$rule_len" ] || [ "$dns_len" -ge "$group_len" ]; then
-   	  kill_clash
-   	  stop
-   	  echo "错误: 不支持的配置文件， General 设置部分应位于开头，请根据模板修改后重试！" > $START_LOG
-   	  echo "${LOGTIME} Unsupported Config, Please Check The General Setting's location And Try-again!" >> $LOG_FILE
-      mv "$START_BACKUP" "$CONFIG_FILE"
-      exit 0
-   fi 2>/dev/null
-   	
-   if [ "$proxy_len" -ge "$rule_len" ]; then
-   	  kill_clash
-   	  stop
-   	  echo "错误: 不支持的配置文件，服务器节点设置部分应位于规则之前，请根据模板修改后重试！" > $START_LOG
-   	  echo "${LOGTIME} Unsupported Config, Please Check The Proxy Setting's location And Try-again!" >> $LOG_FILE
-      mv "$START_BACKUP" "$CONFIG_FILE"
-      exit 0
+   if [ -n "$group_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$group_len" "$GROUP_FILE" "$3"
    fi 2>/dev/null
    
-   if [ "$group_len" -ge "$rule_len" ] || [ "$proxy_len" -ge "$group_len" ]; then
-   	  kill_clash
-   	  stop
-   	  echo "错误: 不支持的配置文件，策略组设置部分应位于规则之前、节点之后，请根据模板修改后重试！" > $START_LOG
-   	  echo "${LOGTIME} Unsupported Config, Please Check The Group Setting's location And Try-again!" >> $LOG_FILE
-      mv "$START_BACKUP" "$CONFIG_FILE"
-      exit 0
-   fi 2>/dev/null
-
-   #处理proxy_provider位置
-   if [ "$provider_len" -ge "$proxy_len" ] || [ "$provider_len" -ge "$group_len" ]; then
-      field_cut "$provider_len" "$PROXY_PROVIDER_FILE" "$3"
-      if [ -n "$proxy_len" ]; then
-         sed -i '/^Proxy:/i\proxy-provider-tag' "$3" 2>/dev/null
-         sed -i '/proxy-provider-tag/r/tmp/yaml_proxy_provider.yaml' "$3" 2>/dev/null
-         sed -i '/proxy-provider-tag/d' "$3" 2>/dev/null
-      elif [ -n "$group_len" ]; then
-         sed -i '/^proxy-groups:/i\proxy-provider-tag' "$3" 2>/dev/null
-         sed -i '/proxy-provider-tag/r/tmp/yaml_proxy_provider.yaml' "$3" 2>/dev/null
-         sed -i '/proxy-provider-tag/d' "$3" 2>/dev/null
-      fi
-   fi 2>/dev/null
-   
-   #处理rule_provider位置
+   #取出rule_provider部分
    rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
    if [ -n "$rule_provider_len" ]; then
-   	  field_cut "$rule_provider_len" "$RULE_PROVIDER_FILE" "$3"
+   	  /usr/share/openclash/yml_field_cut.sh "$rule_provider_len" "$RULE_PROVIDER_FILE" "$3"
    fi 2>/dev/null
    
-   #处理备份rule_provider位置
-   rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$4" 2>/dev/null)
-   if [ -n "$rule_provider_bak_len" ]; then
-   	  field_cut "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$4" "backups"
-   fi 2>/dev/null
-   
-   #处理script位置
+   #取出script部分
    script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
    if [ -n "$script_len" ]; then
-   	  field_cut "$script_len" "$SCRIPT_FILE" "$3"
+   	  /usr/share/openclash/yml_field_cut.sh "$script_len" "$SCRIPT_FILE" "$3"
+   fi 2>/dev/null
+    
+   #取出rule部分
+   rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
+   if [ -n "$rule_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$rule_len" "$RULE_FILE" "$3"
    fi 2>/dev/null
    
-   #处理备份script位置
-   script_bak_len=$(sed -n '/^script:/=' "$4" 2>/dev/null)
-   if [ -n "$script_bak_len" ]; then
-   	  field_cut "$script_bak_len" "$SCRIPT_BAK_FILE" "$4" "backups"
+   #取出cfw部分
+   cfw_bypass_len=$(sed -n '/^ \{0,\}cfw-bypass:/=' "$DNS_FILE" 2>/dev/null)
+   if [ -n "$cfw_bypass_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$cfw_bypass_len" "$CFW_LATE_FILE" "$DNS_FILE" "dns"
    fi 2>/dev/null
    
-   #处理备份rule位置
-   rule_bak_len=$(sed -n '/^rules:/=' "$4" 2>/dev/null)
-   if [ -n "$rule_bak_len" ]; then
-   	  field_cut "$rule_bak_len" "$RULE_BAK_FILE" "$4" "backups"
+   #取出cfw部分
+   cfw_latency_timeout_len=$(sed -n '/^ \{0,\}cfw-latency-timeout:/=' "$DNS_FILE" 2>/dev/null)
+   if [ -n "$cfw_latency_timeout_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$cfw_latency_timeout_len" "$CFW_LATE_FILE" "$DNS_FILE" "dns"
+   fi 2>/dev/null
+   
+   #取出fallback-filter部分
+   fallback_filter_len=$(sed -n '/^ \{0,\}fallback-filter:/=' "$DNS_FILE" 2>/dev/null)
+   if [ -n "$fallback_filter_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$fallback_filter_len" "$FALLBACK_FILTER_FILE" "$DNS_FILE" "dns"
    fi 2>/dev/null
 
-   if [ -n "$provider_len" ]; then
-      proxy_provider_mode=1
-   fi
+   #备份rule_provider部分
+   rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$4" 2>/dev/null)
+   if [ -n "$rule_provider_bak_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$4"
+   fi 2>/dev/null
+   
+   #备份script部分
+   script_bak_len=$(sed -n '/^script:/=' "$4" 2>/dev/null)
+   if [ -n "$script_bak_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$script_bak_len" "$SCRIPT_BAK_FILE" "$4"
+   fi 2>/dev/null
+   
+   #备份rule部分
+   rule_bak_len=$(sed -n '/^rules:/=' "$4" 2>/dev/null)
+   if [ -n "$rule_bak_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$4"
+   fi 2>/dev/null
    
    #自定义DNS还原
-   if [ "$(grep -c '##Custom DNS##' "$3")" -gt 0 ] && [ "$2" = 0 ] && [ -f "$4" ]; then
-      if [ "$proxy_provider_mode" -eq 1 ]; then
-         awk '/^ {0,}nameserver:/,/proxy-providers:/{print}' "$4" | sed '/^proxy-providers:/d' >/tmp/backdns.config 2>/dev/null
-      else
-         awk '/^ {0,}nameserver:/,/Proxy:/{print}' "$4" | sed '/^Proxy:/d' >/tmp/backdns.config 2>/dev/null
+   if [ "$(grep -c '##Custom DNS##' "$CHANGE_FILE")" -gt 0 ] || [ "$(grep -c '##Custom DNS##' "$DNS_FILE")" -gt 0 ]; then
+      if [ "$2" = 0 ] && [ -f "$4" ]; then
+   	     #取出dns备份
+   	     nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$4" 2>/dev/null)
+   	     if [ -n "$nameserver_len" ]; then
+   	        /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "/tmp/backdns.config" "$4" "dns"
+   	     fi 2>/dev/null
+         sed -i '/^ \{0,\}nameserver:/,$d' "$DNS_FILE" 2>/dev/null
+         sed -i '/##Custom DNS##/d' "$CHANGE_FILE" 2>/dev/null
+         cat "/tmp/backdns.config" >> "$DNS_FILE"
+         rm -rf /tmp/backdns.config 2>/dev/null
       fi
-      sed -i '/OpenClash-General-Settings/i\Custom DNS End' "$3" 2>/dev/null
-      sed -i '/^ \{0,\}nameserver:/,/^Custom DNS End$/d' "$3" 2>/dev/null
-      sed -i '/##Custom DNS##/r/tmp/bakdns.config' "$3" 2>/dev/null
-      rm -rf /tmp/backdns.config 2>/dev/null
    fi 2>/dev/null
 
    yml_dns_check
 
-	 if [ -n "$(grep "^ \{1,\}port:" "$3")" ] || [ -n "$(grep "^ \{1,\}mode:" "$3")" ] || [ -n "$(grep "^ \{1,\}log-level:" "$3")" ]; then
-	    cp "$3" /tmp/config.check 2>/dev/null
+	 if [ -n "$(grep "^ \{1,\}port:" "$CHANGE_FILE")" ] || [ -n "$(grep "^ \{1,\}mode:" "$CHANGE_FILE")" ] || [ -n "$(grep "^ \{1,\}log-level:" "$CHANGE_FILE")" ]; then
+	    cp "$CHANGE_FILE" /tmp/config.check 2>/dev/null
 	    sed -i '/^dns:/,$d' /tmp/config.check 2>/dev/null
 	    sed -i 's/^[ \t]*//' /tmp/config.check 2>/dev/null
-	    sed -n '/^dns:/,$p' "$3" >> /tmp/config.check 2>/dev/null
-	    mv /tmp/config.check "$3" 2>/dev/null
+	    sed -n '/^dns:/,$p' "$CHANGE_FILE" >> /tmp/config.check 2>/dev/null
+	    mv /tmp/config.check "$CHANGE_FILE" 2>/dev/null
 	 fi
 	 
    #添加标识
-   sed -i '/OpenClash-General/d' "$3" 2>/dev/null
-   if [ "$proxy_provider_mode" -eq 1 ]; then
-      sed -i '/^proxy-providers:/i\#===================== OpenClash-General-Settings =====================#' "$3" 2>/dev/null
-   else
-      sed -i '/^Proxy:/i\#===================== OpenClash-General-Settings =====================#' "$3" 2>/dev/null
-   fi 2>/dev/null
+   sed -i '/OpenClash-General/d' "$DNS_FILE" 2>/dev/null
+   sed -i '/OpenClash-General/d' "$FALLBACK_FILTER_FILE" 2>/dev/null
+   echo '#===================== OpenClash-General-Settings =====================#' >> "$FALLBACK_FILTER_FILE" 2>/dev/null
+
 }
 
 #检查DNS设置
 yml_dns_check()
 {
 
-   if [ -z "$(grep '^dns:' "$CONFIG_FILE")" ]; then
-      if [ "$proxy_provider_mode" -eq 1 ]; then
-      	 sed -i '/^proxy-providers:/i\dns:' "$CONFIG_FILE" 2>/dev/null
-      else
-         sed -i '/^Proxy:/i\dns:' "$CONFIG_FILE" 2>/dev/null
-      fi 2>/dev/null
+   if [ -z "$(grep '^dns:' "$CHANGE_FILE")" ]; then
+      echo "dns:" >> "$CHANGE_FILE" 2>/dev/null
    fi
 
-   if [ -z "$(grep '^ \{0,\}nameserver:' "$CONFIG_FILE")" ]; then
-      if [ "$proxy_provider_mode" -eq 1 ]; then
-         sed -i '/^proxy-providers:/i\  nameserver:' "$CONFIG_FILE" 2>/dev/null
-      else
-         sed -i '/^Proxy:/i\  nameserver:' "$CONFIG_FILE" 2>/dev/null
-      fi 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - tls://8.8.8.8:853" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - https://1.1.1.1/dns-query" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - https://dns.google/dns-query" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - https://cloudflare-dns.com/dns-query" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  fallback:" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - https://doh.rixcloud.dev/dns-query" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - 119.29.29.29" "$CONFIG_FILE" 2>/dev/null
-      sed -i "/^ \{0,\}nameserver:/a\  - 114.114.114.114" "$CONFIG_FILE" 2>/dev/null
+   if [ -z "$(grep '^ \{0,\}nameserver:' "$DNS_FILE")" ]; then
+   	echo "  nameserver:" > "$DNS_FILE" 2>/dev/null
+   	cat >> "$DNS_FILE" <<-EOF
+  - 114.114.114.114
+  - 119.29.29.29
+  - https://doh.rixcloud.dev/dns-query
+  fallback:
+  - https://cloudflare-dns.com/dns-query
+  - https://dns.google/dns-query
+  - https://1.1.1.1/dns-query
+  - tls://8.8.8.8:853
+EOF
    fi
 
-   dns_port=$(grep "^ \{0,\}listen:" "$CONFIG_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
+   dns_port=$(grep "^ \{0,\}listen:" "$CHANGE_FILE" |awk -F ':' '{print $3}' |awk -F '#' '{print $1}' |tr -cd "[0-9]" 2>/dev/null)
    if [ -z "$dns_port" ] || [ "$dns_port" -eq 53 ]; then
       dns_port=7874
    fi
 
-   if [ -n "$(grep "^ \{0,\}listen:" "$CONFIG_FILE")" ]; then
+   if [ -n "$(grep "^ \{0,\}listen:" "$CHANGE_FILE")" ]; then
       if [ "$ipv6_enable" != "1" ]; then
-         sed -i "/^ \{0,\}listen:/c\  listen: 127.0.0.1:${dns_port}" "$CONFIG_FILE" 2>/dev/null
+         sed -i "/^ \{0,\}listen:/c\  listen: 127.0.0.1:${dns_port}" "$CHANGE_FILE" 2>/dev/null
       else
-         sed -i "/^ \{0,\}listen:/c\  listen: 0.0.0.0:${dns_port}" "$CONFIG_FILE" 2>/dev/null
+         sed -i "/^ \{0,\}listen:/c\  listen: 0.0.0.0:${dns_port}" "$CHANGE_FILE" 2>/dev/null
       fi
    else
       if [ "$ipv6_enable" != "1" ]; then
-         sed -i "/^dns:/a\  listen: 127.0.0.1:${dns_port}" "$CONFIG_FILE" 2>/dev/null
+         sed -i "/^dns:/a\  listen: 127.0.0.1:${dns_port}" "$CHANGE_FILE" 2>/dev/null
       else
-         sed -i "/^dns:/a\  listen: 0.0.0.0:${dns_port}" "$CONFIG_FILE" 2>/dev/null
+         sed -i "/^dns:/a\  listen: 0.0.0.0:${dns_port}" "$CHANGE_FILE" 2>/dev/null
       fi
    fi 2>/dev/null
 
@@ -452,33 +406,6 @@ fi
 
 }
 
-#切割配置文件以分开处理
-yml_cut()
-{
-    cp "$4" "$1"
-    sed -i '/^rules:/,$d' "$1" 2>/dev/null
-    sed -n '/^ \{0,\}nameserver:/,$p' "$1" >"$3" 2>/dev/null
-    if [ "$proxy_provider_mode" -eq 1 ]; then
-    	 sed -n '/^ \{0,\}proxy-groups:/,$p' "$3" >"$7" 2>/dev/null
-    	 sed -n '/^ \{0,\}Proxy:/,$p' "$3" >"$5" 2>/dev/null
-       sed -n '/^ \{0,\}proxy-providers:/,$p' "$3" >"$6" 2>/dev/null
-       sed -i '/^ \{0,\}proxy-groups:/,$d' "$5" 2>/dev/null
-       sed -i '/^ \{0,\}Proxy:/,$d' "$6" 2>/dev/null
-       sed -i '/^ \{0,\}proxy-groups:/,$d' "$6" 2>/dev/null
-    else
-       sed -n '/^ \{0,\}proxy-groups:/,$p' "$3" >"$7" 2>/dev/null
-       sed -n '/^ \{0,\}Proxy:/,$p' "$3" >"$5" 2>/dev/null
-       sed -i '/^ \{0,\}proxy-groups:/,$d' "$5" 2>/dev/null
-    fi 2>/dev/null
-    sed -i '/^ \{0,\}nameserver:/,$d' "$1" 2>/dev/null
-    if [ "$proxy_provider_mode" -eq 1 ]; then
-       sed -i '/^ \{0,\}proxy-providers:/,$d' "$3" 2>/dev/null
-    else
-       sed -i '/^ \{0,\}Proxy:/,$d' "$3" 2>/dev/null
-    fi 2>/dev/null
-    sed -n '/^rules:/,$p' "$4" >"$2" 2>/dev/null
-}
-
 #获取自定义DNS设置
 yml_dns_get()
 {
@@ -519,47 +446,39 @@ yml_dns_get()
 
    if [ -n "$group" ]; then
       if [ "$group" = "nameserver" ]; then
-         echo "  $dns_type$dns_address" >>/etc/openclash/config.namedns
+         echo "  $dns_type$dns_address" >>/tmp/config.namedns
       else
-         if [ -z "$(grep "fallback:$" /etc/openclash/config.falldns 2>/dev/null)" ]; then
-            echo "  fallback:" >/etc/openclash/config.falldns
+         if [ -z "$(grep "fallback:$" /tmp/config.falldns 2>/dev/null)" ]; then
+            echo "  fallback:" >/tmp/config.falldns
          fi
-         echo "  $dns_type$dns_address" >>/etc/openclash/config.falldns
+         echo "  $dns_type$dns_address" >>/tmp/config.falldns
       fi
    else
       return
    fi
-
 }
 
 #添加自定义DNS设置
 yml_dns_custom()
 {
    if [ "$1" = 1 ]; then
-      echo "  nameserver:" >/etc/openclash/config.namedns
+      echo "  nameserver:" >/tmp/config.namedns
+      echo "##Custom DNS##" >> /tmp/config.namedns 2>/dev/null
       config_load "openclash"
       config_foreach yml_dns_get "dns_servers"
-      sed -i '/^ \{0,\}nameserver:/i\##Custom DNS##' "$2" 2>/dev/null
-      sed -i '/OpenClash-General-Settings/i\Custom DNS End' "$2" 2>/dev/null
-      sed -i '/^ \{0,\}nameserver:/,/^Custom DNS End$/d' "$2" 2>/dev/null
-      sed -i '/##Custom DNS##/r/etc/openclash/config.falldns' "$2" 2>/dev/null
-      sed -i '/##Custom DNS##/r/etc/openclash/config.namedns' "$2" 2>/dev/null
-      rm -rf /etc/openclash/config.namedns 2>/dev/null
-      rm -rf /etc/openclash/config.falldns 2>/dev/null
-   else
+      sed -i '/^ \{0,\}nameserver:/,$d' "$2" 2>/dev/null
+      cat "/tmp/config.namedns" >> "$2" 2>/dev/null
+      cat "/tmp/config.falldns" >> "$2" 2>/dev/null
+      rm -rf /tmp/config.namedns 2>/dev/null
+      rm -rf /tmp/config.falldns 2>/dev/null
+   elif [ -z "$(grep "##Custom DNS##" "$2" 2>/dev/null)" ]; then
       sed -i "/^ \{0,\}nameserver:/c\  nameserver:" "$2" 2>/dev/null
       sed -i "/^ \{0,\}fallback:/c\  fallback:" "$2" 2>/dev/null
    fi
 
 #fallback-filter
-   if [ -n "$(grep "^ \{0,\}fallback:" "$2")" ]; then
-      if [ -z "$(grep "^ \{0,\}fallback-filter:" "$2")" ]; then
-         awk '/^ {0,}fallback:/,/OpenClash-General-Settings/{print}' "$2" |sed '1d' |sed '$d' >/tmp/fallback.cache 2>/dev/null
-         sed -i '/cfw-bypass:/,$d' /tmp/fallback.cache 2>/dev/null
-         sed -i '/cfw-latency-timeout:/,$d' /tmp/fallback.cache 2>/dev/null
-         sed -i '/fallback:/,$d' "$2" 2>/dev/null
-cat >> "$2" <<-EOF
-  fallback:
+   if [ -n "$(grep "^ \{0,\}fallback:" "$2")" ] && [ -z "$(grep "^ \{0,\}fallback-filter:" "$3")" ]; then
+cat >> "$3" <<-EOF
   fallback-filter:
     geoip: true
     ipcidr:
@@ -580,38 +499,24 @@ cat >> "$2" <<-EOF
       - 240.0.0.0/4
       - 255.255.255.255/32
 EOF
-         sed -i '/  fallback:/r/tmp/fallback.cache' "$2" 2>/dev/null
-         rm -rf /tmp/fallback.cache 2>/dev/null
-         echo "#===================== OpenClash-General-Settings =====================#" >>"$2"
-      else
-         if [ -z "$(grep "^  fallback-filter:" "$2")" ]; then
-            sed -i "/fallback-filter:/c\  fallback-filter:" "$2" 2>/dev/null
-         fi
-         if [ -z "$(grep "^    geoip: true" "$2")" ]; then
-            sed -i "/geoip: true/c\    geoip: true" "$2" 2>/dev/null
-         fi
-         if [ -z "$(grep "^    ipcidr:" "$2")" ]; then
-            sed -i "/ipcidr:/c\    ipcidr:" "$2" 2>/dev/null
-         fi
+      sed -i '/OpenClash-General/d' "$3" 2>/dev/null
+      echo "#===================== OpenClash-General-Settings =====================#" >>"$3"
+   elif [ -n "$(grep "^ \{0,\}fallback-filter:" "$3")" ]; then
+      if [ -z "$(grep "^  fallback-filter:" "$3")" ]; then
+         sed -i "/fallback-filter:/c\  fallback-filter:" "$2" 2>/dev/null
       fi
-      if [ -z "$(grep "^  - " "$2")" ]; then
-         sed -i '/^ \{0,\}nameserver:/,/^ \{0,\}fallback-filter:/ {s/^ \{0,\}- /  - /}' "$2" 2>/dev/null #修改参数空格
+      if [ -z "$(grep "^    geoip: true" "$3")" ]; then
+         sed -i "/geoip: true/c\    geoip: true" "$3" 2>/dev/null
       fi
-      if [ -z "$(grep "^      - " "$2")" ]; then
-         sed -i '/^ \{0,\}ipcidr:/,/OpenClash-General-Settings/ {s/^ \{0,\}- /      - /}' "$2" 2>/dev/null #修改参数空格
+      if [ -z "$(grep "^    ipcidr:" "$3")" ]; then
+         sed -i "/ipcidr:/c\    ipcidr:" "$3" 2>/dev/null
       fi
-#删除fallback-filter
-   else
-      if [ -n "$(grep "^ \{0,\}fallback-filter:" "$2")" ]; then
-         sed -i '/fallback-filter:/,$d' "$2" 2>/dev/null
-         echo "#===================== OpenClash-General-Settings =====================#" >>"$2"
-      fi
-      if [ -n "$(grep "^ \{0,1\}- " "$2")" ]; then
- #添加参数空格
-	       sed -i "s/^ \{0,\}- /  - /" "$2" 2>/dev/null
+      if [ -z "$(grep "^      - " "$3")" ]; then
+         sed -i '/^ \{0,\}ipcidr:/,/OpenClash-General-Settings/ {s/^ \{0,\}- /      - /}' "$3" 2>/dev/null #修改参数空格
       fi
    fi
 
+   cat "$3" >> "$2" 2>/dev/null
 }
 
 #获取认证信息
@@ -630,7 +535,7 @@ yml_auth_get()
    if [ -z "$username" ] || [ -z "$password" ]; then
       return
    else
-      echo "  - $username:$password" >>/etc/openclash/config.auth
+      echo "  - $username:$password" >>/tmp/config.auth
    fi
 }
 
@@ -641,10 +546,10 @@ yml_auth_custom()
       sed -i '/^dns:/i\#authentication' "$1" 2>/dev/null
       sed -i '/^authentication:/,/^#authentication/d' "$1" 2>/dev/null
    fi
-   if [ -f /etc/openclash/config.auth ]; then
+   if [ -f /tmp/config.auth ]; then
       sed -i '/^dns:/i\authentication:' "$1" 2>/dev/null
-      sed -i '/^authentication:/r/etc/openclash/config.auth' "$1" 2>/dev/null
-      mv /etc/openclash/config.auth /tmp/openclash.auth 2>/dev/null
+      sed -i '/^authentication:/r/tmp/config.auth' "$1" 2>/dev/null
+      mv /tmp/config.auth /tmp/openclash.auth 2>/dev/null
    else
       rm -rf /tmp/openclash.auth 2>/dev/null
    fi
@@ -1493,15 +1398,15 @@ if [ "$enable" -eq 1 ] && [ -f "$CONFIG_FILE" ]; then
     get_config
     echo "第二步: 配置文件检查..." >$START_LOG
     yml_check "$en_mode" "$enable_custom_dns" "$CONFIG_FILE" "$BACKUP_FILE" "$START_BACKUP"
-    if [ -n "$(grep "^ \{0,\}proxy-groups:" "$CONFIG_FILE")" ]; then
-       if [ -z "$(grep "^ \{0,\}Proxy:" "$CONFIG_FILE" 2>/dev/null)" ] && [ -z "$(grep "^ \{0,\}proxy-providers:" "$CONFIG_FILE" 2>/dev/null)" ]; then
+    if [ -f "$GROUP_FILE" ]; then
+       if [ ! -f "$PROXY_FILE" ] && [ ! -f "$PROXY_PROVIDER_FILE" ]; then
           kill_clash
           stop
           echo "错误: 配置文件完整性检查不通过，已自动还原配置文件，请对照模板格式检查修改配置文件！" >$START_LOG
           mv "$START_BACKUP" "$CONFIG_FILE"
           sleep 5
           echo "" >$START_LOG
-       elif [ -z "$(grep "^ \{0,\}rules:" "$CONFIG_FILE" 2>/dev/null)" ] && [ -z "$(grep "^ \{0,\}script:" "$SCRIPT_FILE" 2>/dev/null)" ]; then
+       elif [ ! -f "$RULE_FILE" ] && [ ! -f "$SCRIPT_FILE" ]; then
           kill_clash
           stop
           echo "错误: 配置文件完整性检查不通过，已自动还原配置文件，请对照模板格式检查修改配置文件！" >$START_LOG
@@ -1512,9 +1417,8 @@ if [ "$enable" -eq 1 ] && [ -f "$CONFIG_FILE" ]; then
           echo "第三步: 修改配置文件..." >$START_LOG
           config_load "openclash"
           config_foreach yml_auth_get "authentication"
-          yml_auth_custom "$CONFIG_FILE"
-          yml_cut "$CHANGE_FILE" "$RULE_FILE" "$DNS_FILE" "$CONFIG_FILE" "$PROXY_FILE" "$PROXY_PROVIDER_FILE" "$GROUP_FILE"
-          yml_dns_custom "$enable_custom_dns" "$DNS_FILE"
+          yml_auth_custom "$CHANGE_FILE"
+          yml_dns_custom "$enable_custom_dns" "$DNS_FILE" "$FALLBACK_FILTER_FILE"
           /usr/share/openclash/yml_change.sh >/dev/null 2>&1 "$LOGTIME" "$en_mode" "$enable_custom_dns" "$da_password" "$cn_port" "$proxy_port" "$CHANGE_FILE" "$ipv6_enable" "$http_port" "$socks_port" "$lan_ip" "$log_level" "$proxy_mode" "$intranet_allowed" "$en_mode_tun" "$stack_type" &
           /usr/share/openclash/yml_rules_change.sh >/dev/null 2>&1 "$LOGTIME" "$rule_source" "$enable_custom_clash_rules" "$RULE_FILE" "$set_rule_file" "$en_mode" "$enable_rule_proxy" "$BACKUP_FILE" "$RULE_PROVIDER_FILE" &
           wait
@@ -1591,17 +1495,17 @@ if [ "$enable" -eq 1 ] && [ -f "$CONFIG_FILE" ]; then
                    #获取备份rule_provider
                    rule_provider_bak_len=$(sed -n '/^rule-providers:/=' "$START_BACKUP" 2>/dev/null)
                    if [ -n "$rule_provider_bak_len" ]; then
-                      field_cut "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$START_BACKUP" "backups"
+                      /usr/share/openclash/yml_field_cut.sh "$rule_provider_bak_len" "$RULE_PROVIDER_BAK_FILE" "$START_BACKUP"
                    fi 2>/dev/null
                    #获取备份script
                    script_bak_len=$(sed -n '/^script:/=' "$START_BACKUP" 2>/dev/null)
                    if [ -n "$script_bak_len" ]; then
-                      field_cut "$script_bak_len" "$SCRIPT_BAK_FILE" "$START_BACKUP" "backups"
+                      /usr/share/openclash/yml_field_cut.sh "$script_bak_len" "$SCRIPT_BAK_FILE" "$START_BACKUP"
                    fi 2>/dev/null
                    #获取备份rule
                    rule_bak_len=$(sed -n '/^rules:/=' "$START_BACKUP" 2>/dev/null)
                    if [ -n "$rule_bak_len" ]; then
-                      field_cut "$rule_bak_len" "$RULE_BAK_FILE" "$START_BACKUP" "backups"
+                      /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$RULE_BAK_FILE" "$START_BACKUP"
                    fi 2>/dev/null
                    yml_rule_bak_merge
                    nohup "$CLASH" -d "$CLASH_CONFIG" -f "$CONFIG_FILE" >> $LOG_FILE 2>&1 &

package/ctcgfw/luci-app-openclash/files/etc/openclash/default.yaml

@@ -1,63 +1,120 @@
 # Copyright (c) 2018 Dreamacro
 # 接管：不支持在此页面直接修改，请到全局设置页面进行修改
 
-# port of HTTP
-port: 7890 # 此项将被接管
+# Port of HTTP(S) proxy server on the local end
+# 此项将被接管
+port: 7890
 
-# port of SOCKS5
-socks-port: 7891 # 此项将被接管
+# Port of SOCKS5 proxy server on the local end
+# 此项将被接管
+socks-port: 7891
 
-# redir port for Linux and macOS
-redir-port: 7892 # 此项将被接管
+# Transparent proxy server port for Linux and macOS
+# 此项将被接管
+redir-port: 7892
+	
+# HTTP(S) and SOCKS5 server on the same port
+mixed-port: 7890
 
-allow-lan: true # 此项将被接管为true
+# Set to true to allow connections to the local-end server from
+# other LAN IP addresses
+# 此项将被接管为true
+allow-lan: true
 
-# Only applicable when setting allow-lan to true
-# "*": bind all IP addresses
+# This is only applicable when `allow-lan` is `true`
+# '*': bind all IP addresses
 # 192.168.122.11: bind a single IPv4 address
 # "[aaaa::a8aa:ff:fe09:57d8]": bind a single IPv6 address
-bind-address: "*" # HTTP(S)\SOCKS5 监听地址，此项将被接管为all
+# HTTP(S)\SOCKS5 监听地址，此项将被接管为all
+bind-address: "*" 
 
-# rule / global / direct (default is rule)
-mode: rule # 此项将被接管
+# Clash router working mode
+# rule: rule-based packet routing
+# global: all packets will be forwarded to a single endpoint
+# direct: directly forward the packets to the Internet
+# 此项将被接管
+mode: rule
 
-# set log level to stdout (default is info)
+# Clash by default prints logs to STDOUT
 # info / warning / error / debug / silent
-log-level: info # 此项将被接管
+# 此项将被接管
+log-level: info
 
-# A RESTful API for clash
-external-controller: 0.0.0.0:9090 # 此项将被接管
+# When set to false, resolver won't translate hostnames to IPv6 addresses
+# 此项将被接管
+ipv6: false
 
-# you can put the static web resource (such as clash-dashboard) to a directory, and clash would serve in `${API}/ui`
-# input is a relative path to the configuration directory or an absolute path
-external-ui: "/usr/share/openclash/dashboard" # 此项将被接管
+# RESTful web API listening address
+# 此项将被接管
+external-controller: 0.0.0.0:9090
 
-# Secret for RESTful API (Optional)
-secret: '123456' # 此项将被接管
+# A relative path to the configuration directory or an absolute path to a
+# directory in which you put some static web resource. Clash core will then
+# serve it at `http://{{external-controller}}/ui`.
+# 此项将被接管
+external-ui: "/usr/share/openclash/dashboard"
+
+# Secret for the RESTful API (optional)
+# Authenticate by spedifying HTTP header `Authorization: Bearer ${secret}`
+# ALWAYS set a secret if RESTful API is listening on 0.0.0.0
+# 此项将被接管
+secret: '123456'
 
 # authentication of local SOCKS5/HTTP(S) server
-authentication: # 此项将被接管
+# 此项将被接管
+authentication:
   - "user1:pass1"
   - "user2:pass2"
+  	
+# Outbound interface name
+interface-name: en0
 
-# # hosts, support wildcard (e.g. *.clash.dev Even *.foo.*.example.com)
-# # static domain has a higher priority than wildcard domain (foo.example.com > *.example.com > .example.com)
-# # +.foo.com equal .foo.com and foo.com
-# hosts:
-#   '*.clash.dev': 127.0.0.1
-#   '.dev': 127.0.0.1
-#   'alpha.clash.dev': '::1'
-#   '+.foo.dev': 127.0.0.1
+# tun option
+# 此项将被接管
+tun:
+#  enable: false
+#  stack: system
+#  dns-hijack:
+#  - tcp://8.8.8.8:53
+#  - tcp://8.8.4.4:53
 
-dns:  # 如订阅配置无包括此项的所有DNS设置，OpenClash将自动添加
+# Static hosts for DNS server and connection establishment, only works
+# when `dns.enhanced-mode` is `redir-host`.
+#
+# Wildcard hostnames are supported (e.g. *.clash.dev, *.foo.*.example.com)
+# Non-wildcard domain names have a higher priority than wildcard domain names
+# e.g. foo.example.com > *.example.com > .example.com
+# P.S. +.foo.com equals to .foo.com and foo.com
+hosts:
+  # '*.clash.dev': 127.0.0.1
+  # '.dev': 127.0.0.1
+  # 'alpha.clash.dev': '::1'
+
+# DNS server settings
+# This section is optional. When not present, the DNS server will be disabled.
+# 如订阅配置无包括此项的所有DNS设置，OpenClash将自动添加
+dns:
   enable: true # set true to enable dns (default is false) # 此项将被接管为true
   ipv6: false # default is false # 此项将被接管
   listen: 0.0.0.0:53 # 端口为53时将被接管为7874
+  # These nameservers are used to resolve the DNS nameserver hostnames below.
+  # Specify IP addresses only
+  default-nameserver:
+    - 114.114.114.114
+    - 8.8.8.8
   enhanced-mode: redir-host # or fake-ip # 此项将被接管
-  fake-ip-range: 198.18.0.1/16 # if you don't know what it is, don't change it # 此项将被接管
-#  fake-ip-filter: # fake ip white domain list
-#  - '*.lan'
-#  - localhost.ptlogin2.qq.com
+  fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR # 此项将被接管
+  use-hosts: true # lookup hosts and return IP record # 此项将被接管
+  # Hostnames in this list will not be resolved with fake IPs
+  # i.e. questions to these domain names will always be answered with their
+  # real IP addresses
+  # fake-ip-filter:
+  #   - '*.lan'
+  #   - localhost.ptlogin2.qq.com
+  
+  # Supports UDP, TCP, DoT, DoH. You can specify the port to connect to.
+  # All DNS questions are sent directly to the nameserver, without proxies
+  # involved. Clash answers the DNS question with the first result gathered.
   nameserver:
   - 114.114.114.114
   - https://1.1.1.1/dns-query # dns over https

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_chnroute.sh

@@ -30,13 +30,12 @@
                sleep 5
                status=$(unify_ps_prevent)
             done
-            [ "$china_ip_route" -eq 1 ] && /etc/init.d/openclash stop
-            echo "大陆IP白名单有更新，开始替换旧版本..." >$START_LOG\
-            && mv /tmp/ChinaIP.yaml /etc/openclash/rule_provider/ChinaIP.yaml >/dev/null 2>&1\
-            && echo "删除下载缓存..." >$START_LOG\
-            && rm -rf /tmp/ChinaIP.yaml >/dev/null 2>&1\
-            && rm -rf /etc/openclash/china_ip_route.ipset >/dev/null 2>&1
-            [ "$china_ip_route" -eq 1 ] && /etc/init.d/openclash start
+            echo "大陆IP白名单有更新，开始替换旧版本..." >$START_LOG
+            mv /tmp/ChinaIP.yaml /etc/openclash/rule_provider/ChinaIP.yaml >/dev/null 2>&1
+            echo "删除下载缓存..." >$START_LOG
+            rm -rf /tmp/ChinaIP.yaml >/dev/null 2>&1
+            rm -rf /etc/openclash/china_ip_route.ipset >/dev/null 2>&1
+            [ "$china_ip_route" -eq 1 ] && /etc/init.d/openclash restart
             echo "大陆IP白名单更新成功！" >$START_LOG
             echo "${LOGTIME} Chnroute Lists Update Successful" >>$LOG_FILE
             sleep 10

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_debug.sh

@@ -7,6 +7,8 @@ status=$(unify_ps_status "openclash_debug.sh")
 
 DEBUG_LOG="/tmp/openclash_debug.log"
 LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
+CHANGE_FILE="/tmp/yaml_change.yaml"
+DNS_FILE="/tmp/yaml_dns.yaml"
 uci commit openclash
 
 enable_custom_dns=$(uci get openclash.config.enable_custom_dns 2>/dev/null)
@@ -264,32 +266,16 @@ if [ -n "$(grep OpenClash-General-Settings "$CONFIG_FILE")" ]; then
    sed '/OpenClash-General-Settings/,$d' "$CONFIG_FILE" >> "$DEBUG_LOG" 2>/dev/null
 else
    /usr/share/openclash/yml_field_name_ch.sh "$CONFIG_FILE" 2>/dev/null
-   proxy_len=$(sed -n '/^Proxy:/=' "$CONFIG_FILE" 2>/dev/null)
-   provider_len=$(sed -n '/^proxy-providers:/=' "$CONFIG_FILE" 2>/dev/null)
-   group_len=$(sed -n '/^proxy-groups:/=' "$CONFIG_FILE" 2>/dev/null)
-   dns_len=$(sed -n '/^dns:/=' "$CONFIG_FILE" 2>/dev/null)
-   rule_len=$(sed -n '/^rules:/=' "$CONFIG_FILE" 2>/dev/null)
-   if [ "$dns_len" -ge "$proxy_len" ] || [ "$dns_len" -ge "$rule_len" ] || [ "$dns_len" -ge "$group_len" ]; then
-   	  echo "错误: 不支持的配置文件， General 设置部分应位于开头，请根据模板修改后重试！" >> "$DEBUG_LOG"
-   fi 2>/dev/null
-   	
-   if [ "$proxy_len" -ge "$rule_len" ] || [ "$provider_len" -ge "$rule_len" ]; then
-   	  echo "错误: 不支持的配置文件，服务器节点设置部分应位于规则之前，请根据模板修改后重试！" >> "$DEBUG_LOG"
+   #取出general部分
+   /usr/share/openclash/yml_field_cut.sh "general" "$CHANGE_FILE" "$CONFIG_FILE"
+   
+   #取出dns部分
+   nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$CONFIG_FILE" 2>/dev/null)
+   if [ -n "$nameserver_len" ]; then
+      /usr/share/openclash/yml_field_cut.sh "$nameserver_len" "$DNS_FILE" "$CONFIG_FILE"
    fi 2>/dev/null
    
-   if [ "$group_len" -ge "$rule_len" ] || [ "$proxy_len" -ge "$group_len" ]; then
-   	  echo "错误: 不支持的配置文件，策略组设置部分应位于规则之前、节点之后，请根据模板修改后重试！" >> "$DEBUG_LOG"
-   fi 2>/dev/null
-   
-   if [ "$proxy_len" -le "$provider_len" ]; then
-      sed '/^ \{0,\}Proxy:/,$d' "$CONFIG_FILE" >> "$DEBUG_LOG" 2>/dev/null
-   elif [ "$proxy_len" -ge "$provider_len" ]; then
-      sed '/^ \{0,\}proxy-providers:/,$d' "$CONFIG_FILE" >> "$DEBUG_LOG" 2>/dev/null
-   elif [ -n "$proxy_len" ] && [ -z "$provider_len" ]; then
-      sed '/^ \{0,\}Proxy:/,$d' "$CONFIG_FILE" >> "$DEBUG_LOG" 2>/dev/null
-   elif [ -z "$proxy_len" ] && [ -n "$provider_len" ]; then
-      sed '/^ \{0,\}proxy-providers:/,$d' "$CONFIG_FILE" >> "$DEBUG_LOG" 2>/dev/null
-   fi 2>/dev/null
+   cat "$CONFIG_FILE" "$DNS_FILE" >> "$DEBUG_LOG"
 fi
 
 #firewall

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_ipdb.sh

@@ -28,12 +28,11 @@
                sleep 5
                status=$(unify_ps_prevent)
             done
-            /etc/init.d/openclash stop
-            echo "数据库版本有更新，开始替换数据库版本..." >$START_LOG\
-            && mv /tmp/Country.mmdb /etc/openclash/Country.mmdb >/dev/null 2>&1\
-            && /etc/init.d/openclash start\
-            && echo "删除下载缓存..." >$START_LOG\
-            && rm -rf /tmp/Country.mmdb >/dev/null 2>&1
+            echo "数据库版本有更新，开始替换数据库版本..." >$START_LOG
+            mv /tmp/Country.mmdb /etc/openclash/Country.mmdb >/dev/null 2>&1
+            /etc/init.d/openclash restart
+            echo "删除下载缓存..." >$START_LOG
+            rm -rf /tmp/Country.mmdb >/dev/null 2>&1
             echo "GEOIP 数据库更新成功！" >$START_LOG
             echo "${LOGTIME} GEOIP Database Update Successful" >>$LOG_FILE
             sleep 10

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_rule.sh

@@ -2,41 +2,6 @@
 . /usr/share/openclash/openclash_ps.sh
 . /lib/functions.sh
 
-field_cut()
-{
-   local i lines end_len
-   rule_len=$(sed -n '/^ \{0,\}rules:/=' "$3" 2>/dev/null)
-   rule_provider_len=$(sed -n '/^ \{0,\}rule-providers:/=' "$3" 2>/dev/null)
-   script_len=$(sed -n '/^ \{0,\}script:/=' "$3" 2>/dev/null)
-   lines="$rule_len $rule_provider_len $script_len"
-   
-   for i in $lines; do
-      if [ -z "$1" ]; then
-         break
-      fi
-      
-      if [ "$1" -ge "$i" ]; then
-         continue
-      fi
-	    
-      if [ "$end_len" -gt "$i" ] || [ -z "$end_len" ]; then
-	       end_len="$i"
-      fi
-   done 2>/dev/null
-   
-   if [ -n "$1" ] && [ -z "$end_len" ]; then
-      end_len=$(sed -n '$=' "$3")
-   elif [ -n "$end_len" ]; then
-      end_len=$(expr "$end_len" - 1)
-   fi
-   
-   sed -n "${1},${end_len}p" "$3" > "$2" 2>/dev/null
-   
-   if [ -z "$4" ]; then
-      sed -i "${1},${end_len}d" "$3" 2>/dev/null
-   fi
-}
-
    status=$(unify_ps_status "openclash_rule.sh")
    [ "$status" -gt 3 ] && exit 0
    
@@ -86,17 +51,17 @@ field_cut()
       #处理rule_provider位置
       rule_provider_len=$(sed -n '/^ \{0,\}rule-providers:/=' "/tmp/rules.yaml" 2>/dev/null)
       if [ -n "$rule_provider_len" ]; then
-   	     field_cut "$rule_provider_len" "$OTHER_RULE_PROVIDER_FILE" "/tmp/rules.yaml"
+   	     /usr/share/openclash/yml_field_cut.sh "$rule_provider_len" "$OTHER_RULE_PROVIDER_FILE" "/tmp/rules.yaml"
       fi 2>/dev/null
       #处理script位置
       script_len=$(sed -n '/^ \{0,\}script:/=' "/tmp/rules.yaml" 2>/dev/null)
       if [ -n "$script_len" ]; then
-   	     field_cut "$script_len" "$OTHER_SCRIPT_FILE" "/tmp/rules.yaml"
+   	     /usr/share/openclash/yml_field_cut.sh "$script_len" "$OTHER_SCRIPT_FILE" "/tmp/rules.yaml"
       fi 2>/dev/null
       #处理备份rule位置
       rule_bak_len=$(sed -n '/^ \{0,\}rules:/=' "/tmp/rules.yaml" 2>/dev/null)
       if [ -n "$rule_bak_len" ]; then
-   	     field_cut "$rule_bak_len" "$OTHER_RULE_FILE" "/tmp/rules.yaml"
+   	     /usr/share/openclash/yml_field_cut.sh "$rule_bak_len" "$OTHER_RULE_FILE" "/tmp/rules.yaml"
       fi 2>/dev/null
       #合并
       cat "$OTHER_RULE_PROVIDER_FILE" "$OTHER_SCRIPT_FILE" "$OTHER_RULE_FILE" > "/tmp/rules.yaml" 2>/dev/null

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_change.sh

@@ -116,23 +116,6 @@
     fi
     
     uci commit openclash
-    
-    dns_hijack_len=$(sed -n '/dns-hijack:/=' "$7" 2>/dev/null)
-    if [ -n "$dns_hijack_len" ]; then
-       dns_hijack_end_len=$dns_hijack_len
-       while ( [ -n "$(echo "$hijack_line" |grep "^ \{0,\}-")" ] || [ -n "$(echo "$hijack_line" |grep "^ \{0,\}$")" ] || [ -z "$hijack_line" ] )
-       do
-    	   dns_hijack_end_len=$(expr "$dns_hijack_end_len" + 1)
-    	   hijack_line=$(sed -n "${dns_hijack_end_len}p" "$7")
-       done 2>/dev/null
-       dns_hijack_end_len=$(expr "$dns_hijack_end_len" - 1)
-       sed -i "${dns_hijack_len},${dns_hijack_end_len}d" "$7" 2>/dev/null
-    fi
-    sed -i '/^ \{0,\}tun:/,/^ \{0,\}enable:/d' "$7" 2>/dev/null
-    sed -i '/^ \{0,\}dns-hijack:/d' "$7" 2>/dev/null
-    sed -i '/^ \{0,\}stack:/d' "$7" 2>/dev/null
-    sed -i '/^ \{0,\}device-url:/d' "$7" 2>/dev/null
-    sed -i '/^ \{0,\}dns-listen:/d' "$7" 2>/dev/null
 
     if [ -z "$(grep "^   enable: true" "$7")" ]; then
        if [ ! -z "$(grep "^ \{0,\}enable:" "$7")" ]; then

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_field_cut.sh

@@ -0,0 +1,104 @@
+#!/bin/sh
+. /lib/functions.sh
+
+field_cut()
+{
+   local i lines end_len
+   if [ "$4" != "dns" ]; then
+      proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null |sed -n 1p)
+      provider_len=$(sed -n '/^proxy-providers:/=' "$3" 2>/dev/null)
+      group_len=$(sed -n '/^proxy-groups:/=' "$3" 2>/dev/null)
+      rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
+      rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
+      script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
+      nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
+      lines="$general_len $nameserver_len $proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
+   else
+      fallback_filter_len=$(sed -n '/^ \{0,\}fallback-filter:/=' "$3" 2>/dev/null)
+      cfw_bypass_len=$(sed -n '/^ \{0,\}cfw-bypass:/=' "$3" 2>/dev/null)
+      cfw_latency_timeout_len=$(sed -n '/^ \{0,\}cfw-latency-timeout:/=' "$3" 2>/dev/null)
+      nameserver_len=$(sed -n '/^ \{0,\}nameserver:/=' "$3" 2>/dev/null)
+      lines="$nameserver_len $fallback_filter_len $cfw_bypass_len $cfw_latency_timeout_len"
+   fi
+   
+   for i in $lines; do
+      if [ -z "$1" ]; then
+         break
+      fi
+      
+      if [ "$1" -ge "$i" ]; then
+         continue
+      fi
+	    
+      if [ "$end_len" -gt "$i" ] || [ -z "$end_len" ]; then
+	       end_len="$i"
+      fi
+   done 2>/dev/null
+   
+   if [ -n "$1" ] && [ -z "$end_len" ]; then
+      end_len=$(sed -n '$=' "$3")
+   elif [ -n "$end_len" ]; then
+      end_len=$(expr "$end_len" - 1)
+   fi
+   
+   if [ "$4" != "yaml_get" ]; then
+      sed -n "${1},${end_len}p" "$3" > "$2" 2>/dev/null
+   else
+      sed -n "${1},${end_len}p" "$3" |sed 's/\"//g' 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed 's/\t/ /g' 2>/dev/null > "$2" 2>/dev/null
+   fi
+
+}
+
+   #识别general部分
+   space_num=$(grep "^ \{0,\}socks-port:" "$3" 2>/dev/null |awk -F ':' '{print $1}' |grep -c " ")
+   if [ -z "$space_num" ]; then
+      space_num=$(grep "^ \{0,\}allow-lan:" "$3" 2>/dev/null |awk -F ':' '{print $1}' |grep -c " ")
+   fi
+   cat "/etc/openclash/default.yaml" |awk '1;/dns:/{exit}' 2>/dev/null |sed '/^ \{0,\}#\|^ \{0,\}-\|^ \{0,\}$/d' 2>/dev/null |awk -F ':' '{print $1}' |while read -r line
+   do
+      if [ -z "$line" ]; then
+         continue
+      fi
+      
+      line_len=$(sed -n "/^ \{0,${space_num}\}${line}:/=" "$3" 2>/dev/null)
+      
+      if [ -z "$line_len" ] || [ "$(echo $line_len |awk -F ' ' '{print NF}' 2>/dev/null)" -ge 2 ]; then
+         continue
+      fi
+      
+      if [ -z "$general_len" ]; then
+         general_len=$line_len
+         echo $general_len >/tmp/yaml_general
+         continue
+      fi
+      
+      if [ "$general_len" -gt "$line_len" ]; then
+         general_len=$line_len
+         echo $general_len >/tmp/yaml_general
+      fi
+   done
+   
+   general_len=$(cat /tmp/yaml_general)
+   if [ "$1" = "general" ]; then
+      field_cut "$general_len" "$2" "$3"
+   else
+      field_cut "$1" "$2" "$3" "$4"
+   fi
+   
+   dns_hijack_len=$(sed -n '/dns-hijack:/=' "$2" 2>/dev/null)
+   if [ -n "$dns_hijack_len" ]; then
+      dns_hijack_end_len=$dns_hijack_len
+      while ( [ -n "$(echo "$hijack_line" |grep "^ \{0,\}-")" ] || [ -n "$(echo "$hijack_line" |grep "^ \{0,\}$")" ] || [ -z "$hijack_line" ] )
+      do
+    	   dns_hijack_end_len=$(expr "$dns_hijack_end_len" + 1)
+    	   hijack_line=$(sed -n "${dns_hijack_end_len}p" "$2")
+      done 2>/dev/null
+      dns_hijack_end_len=$(expr "$dns_hijack_end_len" - 1)
+      sed -i "${dns_hijack_len},${dns_hijack_end_len}d" "$2" 2>/dev/null
+   fi
+   sed -i '/^ \{0,\}tun:/,/^ \{0,\}enable:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}dns-hijack:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}stack:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}device-url:/d' "$2" 2>/dev/null
+   sed -i '/^ \{0,\}dns-listen:/d' "$2" 2>/dev/null
+   rm -rf /tmp/yaml_general 2>/dev/null

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_groups_get.sh

@@ -48,42 +48,9 @@ echo "开始更新【$CONFIG_NAME】的策略组配置..." >$START_LOG
 	exit 0
 }
 
-field_cut()
-{
-   local i lines end_len
-   proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null |sed -n 1p)
-   provider_len=$(sed -n '/^proxy-providers:/=' "$3" 2>/dev/null)
-   group_len=$(sed -n '/^proxy-groups:/=' "$3" 2>/dev/null)
-   rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
-   rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
-   script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
-   lines="$proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
-   
-   for i in $lines; do
-      if [ -z "$1" ]; then
-         break
-      fi
-      
-      if [ "$1" -ge "$i" ]; then
-         continue
-      fi
-	    
-      if [ "$end_len" -gt "$i" ] || [ -z "$end_len" ]; then
-	       end_len="$i"
-      fi
-   done 2>/dev/null
-   
-   if [ -n "$1" ] && [ -z "$end_len" ]; then
-      end_len=$(sed -n '$=' "$3")
-   elif [ -n "$end_len" ]; then
-      end_len=$(expr "$end_len" - 1)
-   fi
-   sed -n "${1},${end_len}p" "$3" |sed 's/\"//g' 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed 's/\t/ /g' 2>/dev/null > "$2" 2>/dev/null
-}
-
 #判断各个区位置
 group_len=$(sed -n '/^ \{0,\}proxy-groups:/=' "$CONFIG_FILE" 2>/dev/null)
-field_cut "$group_len" "/tmp/yaml_group.yaml" "$CONFIG_FILE"
+/usr/share/openclash/yml_field_cut.sh "$group_len" "/tmp/yaml_group.yaml" "$CONFIG_FILE" "yaml_get"
 
 #判断当前配置文件是否有策略组信息
 cfg_group_name()

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_groups_name_get.sh

@@ -1,31 +1,8 @@
 #!/bin/sh
-. /lib/functions.sh
 
 CFG_FILE=$(uci get openclash.config.config_path 2>/dev/null)
 UPDATE_CONFIG_FILE=$(uci get openclash.config.config_update_path 2>/dev/null)
-
-get_nextlen()
-{
-
-	 if [ "$#" -eq 0 ]; then
-	    return
-	 fi
-
-   for i in $@; do
-      if [ -z "$group_len" ]; then
-         break
-      fi
-      
-	    if [ "$group_len" -ge "$i" ]; then
-	       continue
-	    fi
-	    
-	    if [ "$next_len" -gt "$i" ] || [ -z "$next_len" ]; then
-	       next_len="$i"
-	    fi
-   done 2>/dev/null
-
-}
+GROUP_FILE="/tmp/yaml_group_cache.yaml"
 
 if [ ! -z "$UPDATE_CONFIG_FILE" ]; then
    CFG_FILE="$UPDATE_CONFIG_FILE"
@@ -39,18 +16,15 @@ if [ -f "$CFG_FILE" ]; then
    #检查关键字避免后续操作出错
 	 /usr/share/openclash/yml_field_name_ch.sh "$CFG_FILE"
    
-#判断各个区位置
+   #取出group部分
    group_len=$(sed -n '/^proxy-groups:/=' "$CFG_FILE" 2>/dev/null)
-   provider_len=$(sed -n '/proxy-providers:/=' "$CFG_FILE" 2>/dev/null)
-   rule_provider_len=$(sed -n '/^rule-providers:/=' "$CFG_FILE" 2>/dev/null)
-   script_len=$(sed -n '/^script:/=' "$CFG_FILE" 2>/dev/null)
-   get_nextlen "$provider_len" "$rule_provider_len" "$script_len"
+   if [ -n "$group_len" ]; then
+   	  /usr/share/openclash/yml_field_cut.sh "$group_len" "$GROUP_FILE" "$CFG_FILE"
+   fi 2>/dev/null
    
-   if [ -n "$next_len" ]; then
-       sed -n "${group_len},${next_len}p" "$CFG_FILE" 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed 's/\"//g' 2>/dev/null |sed 's/\t/ /g' 2>/dev/null |grep name: |awk -F 'name:' '{print $2}' |sed 's/,.*//' |sed 's/^ \{0,\}//' 2>/dev/null |sed 's/ \{0,\}$//' 2>/dev/null |sed 's/ \{0,\}\}\{0,\}$//g' 2>/dev/null >/tmp/Proxy_Group 2>&1
-   else
-       awk '/proxy-groups:/,/rules:/{print}' "$CFG_FILE" 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed 's/\"//g' 2>/dev/null |sed 's/\t/ /g' 2>/dev/null |grep name: |awk -F 'name:' '{print $2}' |sed 's/,.*//' |sed 's/^ \{0,\}//' 2>/dev/null |sed 's/ \{0,\}$//' 2>/dev/null |sed 's/ \{0,\}\}\{0,\}$//g' 2>/dev/null >/tmp/Proxy_Group 2>&1
-   fi
+   cat "$GROUP_FILE" |sed "s/\'//g" 2>/dev/null |sed 's/\"//g' 2>/dev/null |sed 's/\t/ /g' 2>/dev/null |grep name: |awk -F 'name:' '{print $2}' |sed 's/,.*//' |sed 's/^ \{0,\}//' 2>/dev/null |sed 's/ \{0,\}$//' 2>/dev/null |sed 's/ \{0,\}\}\{0,\}$//g' 2>/dev/null >/tmp/Proxy_Group 2>&1
+   
+   rm -rf "$GROUP_FILE" 2>/dev/null
 
    if [ "$?" -eq "0" ]; then
       echo 'DIRECT' >>/tmp/Proxy_Group

package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_proxys_get.sh

@@ -35,44 +35,11 @@ elif [ ! -s "$CONFIG_FILE" ] && [ -s "$BACKUP_FILE" ]; then
    mv "$BACKUP_FILE" "$CONFIG_FILE"
 fi
 
-field_cut()
-{
-   local i lines end_len
-   proxy_len=$(sed -n '/^Proxy:/=' "$3" 2>/dev/null |sed -n 1p)
-   provider_len=$(sed -n '/^proxy-providers:/=' "$3" 2>/dev/null)
-   group_len=$(sed -n '/^proxy-groups:/=' "$3" 2>/dev/null)
-   rule_len=$(sed -n '/^rules:/=' "$3" 2>/dev/null)
-   rule_provider_len=$(sed -n '/^rule-providers:/=' "$3" 2>/dev/null)
-   script_len=$(sed -n '/^script:/=' "$3" 2>/dev/null)
-   lines="$proxy_len $provider_len $group_len $rule_len $rule_provider_len $script_len"
-   
-   for i in $lines; do
-      if [ -z "$1" ]; then
-         break
-      fi
-      
-      if [ "$1" -ge "$i" ]; then
-         continue
-      fi
-	    
-      if [ "$end_len" -gt "$i" ] || [ -z "$end_len" ]; then
-	       end_len="$i"
-      fi
-   done 2>/dev/null
-   
-   if [ -n "$1" ] && [ -z "$end_len" ]; then
-      end_len=$(sed -n '$=' "$3")
-   elif [ -n "$end_len" ]; then
-      end_len=$(expr "$end_len" - 1)
-   fi
-   sed -n "${1},${end_len}p" "$3" |sed 's/\"//g' 2>/dev/null |sed "s/\'//g" 2>/dev/null |sed 's/\t/ /g' 2>/dev/null > "$2" 2>/dev/null
-}
-
 #判断各个区位置
 proxy_len=$(sed -n '/^ \{0,\}Proxy:/=' "$CONFIG_FILE" 2>/dev/null)
-field_cut "$proxy_len" "/tmp/yaml_proxy.yaml" "$CONFIG_FILE"
+/usr/share/openclash/yml_field_cut.sh "$proxy_len" "/tmp/yaml_proxy.yaml" "$CONFIG_FILE" "yaml_get"
 provider_len=$(sed -n '/^ \{0,\}proxy-providers:/=' "$CONFIG_FILE" 2>/dev/null)
-field_cut "$provider_len" "/tmp/yaml_provider.yaml" "$CONFIG_FILE"
+/usr/share/openclash/yml_field_cut.sh "$provider_len" "/tmp/yaml_provider.yaml" "$CONFIG_FILE" "yaml_get"
 
 
 CFG_FILE="/etc/config/openclash"

package/firmware/amd64-microcode/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=amd64-microcode
-PKG_VERSION:=20180524
+PKG_VERSION:=20191218
 PKG_RELEASE:=1
 
 PKG_SOURCE:=amd64-microcode_3.$(PKG_VERSION).$(PKG_RELEASE).tar.xz
 PKG_SOURCE_URL:=http://ftp.debian.org/debian/pool/non-free/a/amd64-microcode/
-PKG_HASH:=7c389c357c242e7161f6872bf4e12011a71e4c0683f06fb1bcfad650a78bf0a9
+PKG_HASH:=f469b79348097c5f04641b67a39d0ee5a2a1916c9556281626c04f2275d4132d
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-3.$(PKG_VERSION).$(PKG_RELEASE)
 
 PKG_LICENSE_FILE:=LICENSE.amd-ucode

package/firmware/intel-microcode/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20190918
+PKG_VERSION:=20200616
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).$(PKG_RELEASE).tar.xz
 PKG_SOURCE_URL:=http://ftp.debian.org/debian/pool/non-free/i/intel-microcode/
-PKG_HASH:=b7ecb5dd30d71e9b3c2ab184693a876171392e0d80d138c3560c662e5f2a2247
+PKG_HASH:=bcc3b81c452fe4649a948c022475d76c1cdfbb730f36749a082f412f1406a3b9
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-3.$(PKG_VERSION).$(PKG_RELEASE)
 
 PKG_BUILD_DEPENDS:=iucode-tool/host

package/kernel/linux/modules/other.mk

@@ -1151,53 +1151,6 @@ endef
 $(eval $(call KernelPackage,echo))
 
 
-define KernelPackage/bmp085
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=BMP085/BMP18x pressure sensor
-  DEPENDS:= +kmod-regmap-core
-  KCONFIG:= CONFIG_BMP085
-  FILES:= $(LINUX_DIR)/drivers/misc/bmp085.ko
-endef
-
-define KernelPackage/bmp085/description
- This driver adds support for Bosch Sensortec's digital pressure
- sensors BMP085 and BMP18x.
-endef
-
-$(eval $(call KernelPackage,bmp085))
-
-
-define KernelPackage/bmp085-i2c
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=BMP085/BMP18x pressure sensor I2C
-  DEPENDS:= +kmod-bmp085
-  KCONFIG:= CONFIG_BMP085_I2C
-  FILES:= $(LINUX_DIR)/drivers/misc/bmp085-i2c.ko
-  AUTOLOAD:=$(call AutoProbe,bmp085-i2c)
-endef
-define KernelPackage/bmp085-i2c/description
- This driver adds support for Bosch Sensortec's digital pressure
- sensor connected via I2C.
-endef
-
-$(eval $(call KernelPackage,bmp085-i2c))
-
-
-define KernelPackage/bmp085-spi
-  SUBMENU:=$(OTHER_MENU)
-  TITLE:=BMP085/BMP18x pressure sensor SPI
-  DEPENDS:= +kmod-bmp085
-  KCONFIG:= CONFIG_BMP085_SPI
-  FILES:= $(LINUX_DIR)/drivers/misc/bmp085-spi.ko
-  AUTOLOAD:=$(call AutoProbe,bmp085-spi)
-endef
-define KernelPackage/bmp085-spi/description
- This driver adds support for Bosch Sensortec's digital pressure
- sensor connected via SPI.
-endef
-
-$(eval $(call KernelPackage,bmp085-spi))
-
 define KernelPackage/tpm
   SUBMENU:=$(OTHER_MENU)
   TITLE:=TPM Hardware Support

package/lean/v2ray/Makefile

@@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=v2ray
-PKG_VERSION:=4.28.1
+PKG_VERSION:=4.28.2
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION)
 
 PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=9f61500c4a262f8d38833d11218baf73a94bd7592bc89528aa7824ff6192c9e5
+PKG_HASH:=e78446333fd28ef8a3ec2c25612458bfc024a226008888ed5277201136f4ca97
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE

package/lienol/luci-app-passwall/Makefile

@@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=57
-PKG_DATE:=20200912
+PKG_RELEASE:=60
+PKG_DATE:=20200917
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 
@@ -49,6 +49,10 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_Brook
 	bool "Include Brook"
 	default n
 	
+config PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy
+	bool "Include NaiveProxy"
+	default n
+
 config PACKAGE_$(PKG_NAME)_INCLUDE_kcptun
 	bool "Include kcptun"
 	default n
@@ -100,6 +104,7 @@ define Package/$(PKG_NAME)
   +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \
   +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus:trojan-plus \
   +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_GO:trojan-go \
+  +PACKAGE_$(PKG_NAME)_INCLUDE_NaiveProxy:naiveproxy \
   +PACKAGE_$(PKG_NAME)_INCLUDE_Brook:brook \
   +PACKAGE_$(PKG_NAME)_INCLUDE_kcptun:kcptun-client \
   +PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \

package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/acl.lua

@@ -96,8 +96,8 @@ o.default = "default"
 o:value("default", translate("Default"))
 o:value("1:65535", translate("All"))
 o:value("80,443", "80,443")
-o:value("80:", "80 " .. translate("or more"))
-o:value(":443", "443 " .. translate("or less"))
+o:value("80:65535", "80 " .. translate("or more"))
+o:value("1:443", "443 " .. translate("or less"))
 
 ---- UDP Redir Ports
 o = s:option(Value, "udp_redir_ports", translate("UDP Redir Ports"))

package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua

@@ -9,6 +9,8 @@ s.anonymous = true
 
 s:tab("direct_list", translate("Direct List"))
 s:tab("proxy_list", translate("Proxy List"))
+s:tab("proxy_list2", translate("Proxy List") .. " 2")
+s:tab("proxy_list3", translate("Proxy List") .. " 3")
 
 ---- Direct Hosts
 local direct_host = string.format("/usr/share/%s/rules/direct_host", appname)
@@ -86,4 +88,80 @@ o.validate = function(self, value)
     return value
 end
 
+---- Proxy Hosts 2
+local proxy_host2 = string.format("/usr/share/%s/rules/proxy_host2", appname)
+o = s:taboption("proxy_list2", TextValue, "proxy_host2", "", "<font color='red'>" .. translate("These had been joined websites will use proxy. Please input the domain names of websites,every line can input only one website domain. For example: google.com.") .. "</font>")
+o.rows = 15
+o.wrap = "off"
+o.cfgvalue = function(self, section) return fs.readfile(proxy_host2) or "" end
+o.write = function(self, section, value) fs.writefile(proxy_host2, value:gsub("\r\n", "\n")) end
+o.remove = function(self, section, value) fs.writefile(proxy_host2, "") end
+o.validate = function(self, value)
+    local hosts= {}
+    string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(hosts, w) end)
+    for index, host in ipairs(hosts) do
+        if not datatypes.hostname(host) then
+            return nil, host .. " " .. translate("Not valid domain name, please re-enter!")
+        end
+    end
+    return value
+end
+
+---- Proxy IP 2
+local proxy_ip2 = string.format("/usr/share/%s/rules/proxy_ip2", appname)
+o = s:taboption("proxy_list2", TextValue, "blacklist_ip2", "", "<font color='red'>" .. translate("These had been joined ip addresses will use proxy.Please input the ip address or ip address segment,every line can input only one ip address.For example: 35.24.0.0/24 or 8.8.4.4.") .. "</font>")
+o.rows = 15
+o.wrap = "off"
+o.cfgvalue = function(self, section) return fs.readfile(proxy_ip2) or "" end
+o.write = function(self, section, value) fs.writefile(proxy_ip2, value:gsub("\r\n", "\n")) end
+o.remove = function(self, section, value) fs.writefile(proxy_ip2, "") end
+o.validate = function(self, value)
+    local ipmasks= {}
+    string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, w) end)
+    for index, ipmask in ipairs(ipmasks) do
+        if not datatypes.ipmask4(ipmask) then
+            return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!")
+        end
+    end
+    return value
+end
+
+---- Proxy Hosts 3
+local proxy_host3 = string.format("/usr/share/%s/rules/proxy_host3", appname)
+o = s:taboption("proxy_list3", TextValue, "proxy_host3", "", "<font color='red'>" .. translate("These had been joined websites will use proxy. Please input the domain names of websites,every line can input only one website domain. For example: google.com.") .. "</font>")
+o.rows = 15
+o.wrap = "off"
+o.cfgvalue = function(self, section) return fs.readfile(proxy_host3) or "" end
+o.write = function(self, section, value) fs.writefile(proxy_host3, value:gsub("\r\n", "\n")) end
+o.remove = function(self, section, value) fs.writefile(proxy_host3, "") end
+o.validate = function(self, value)
+    local hosts= {}
+    string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(hosts, w) end)
+    for index, host in ipairs(hosts) do
+        if not datatypes.hostname(host) then
+            return nil, host .. " " .. translate("Not valid domain name, please re-enter!")
+        end
+    end
+    return value
+end
+
+---- Proxy IP 3
+local proxy_ip3 = string.format("/usr/share/%s/rules/proxy_ip3", appname)
+o = s:taboption("proxy_list3", TextValue, "blacklist_ip3", "", "<font color='red'>" .. translate("These had been joined ip addresses will use proxy.Please input the ip address or ip address segment,every line can input only one ip address.For example: 35.24.0.0/24 or 8.8.4.4.") .. "</font>")
+o.rows = 15
+o.wrap = "off"
+o.cfgvalue = function(self, section) return fs.readfile(proxy_ip3) or "" end
+o.write = function(self, section, value) fs.writefile(proxy_ip3, value:gsub("\r\n", "\n")) end
+o.remove = function(self, section, value) fs.writefile(proxy_ip3, "") end
+o.validate = function(self, value)
+    local ipmasks= {}
+    string.gsub(value, '[^' .. "\r\n" .. ']+', function(w) table.insert(ipmasks, w) end)
+    for index, ipmask in ipairs(ipmasks) do
+        if not datatypes.ipmask4(ipmask) then
+            return nil, ipmask .. " " .. translate("Not valid IP format, please re-enter!")
+        end
+    end
+    return value
+end
+
 return m

package/lienol/luci-app-passwall/luasrc/view/passwall/log/log.htm

@@ -11,7 +11,7 @@
 			}
 		);
 	}
-	XHR.poll(30, '<%=url([[admin]], [[services]], [[passwall]], [[get_log]])%>', null,
+	XHR.poll(5, '<%=url([[admin]], [[services]], [[passwall]], [[get_log]])%>', null,
 		function(x, data) {
 			if(x && x.status == 200) {
 				var log_textarea = document.getElementById('log_textarea');

package/lienol/luci-app-passwall/root/etc/config/passwall

@@ -52,6 +52,7 @@ config global_app
 	option trojan_go_file '/usr/bin/trojan-go'
 	option kcptun_client_file '/usr/bin/kcptun-client'
 	option brook_file '/usr/bin/brook'
+	option trojan_go_latest 'https://api.github.com/repos/peter-tank/trojan-go/releases/latest'
 
 config global_subscribe
 	option subscribe_proxy '0'

package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh

@@ -716,11 +716,15 @@ start_dns() {
 				cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist"
 				echolog "  | - [$?](chinadns-ng) 域名白名单合并到中国域名表"
 				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt"
+				[ -f "${RULES_PATH}/proxy_host2" ] && cat "${RULES_PATH}/proxy_host2" >> "${TMP_PATH}/gfwlist.txt"
+				[ -f "${RULES_PATH}/proxy_host3" ] && cat "${RULES_PATH}/proxy_host3" >> "${TMP_PATH}/gfwlist.txt"
 				echolog "  | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表"
 				gfwlist_param="${TMP_PATH}/gfwlist.txt"
 			else
 				echolog "  | - (chinadns-ng) 白名单不与中国域名表合并"
 				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist"
+				[ -f "${RULES_PATH}/proxy_host2" ] && cat "${RULES_PATH}/proxy_host2" >> "${TMP_PATH}/chnlist"
+				[ -f "${RULES_PATH}/proxy_host3" ] && cat "${RULES_PATH}/proxy_host3" >> "${TMP_PATH}/chnlist"
 				echolog "  | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表"
 			fi
 			chnlist_param="${TMP_PATH}/chnlist"
@@ -739,7 +743,7 @@ start_dns() {
 		TUN_DNS=""
 	;;
 	dns2socks)
-		echolog "  - 域名解析 dns2socks..."
+		echolog "  - 域名解析：dns2socks..."
 	;;
 	https-dns-proxy)
 		up_trust_doh_dns=$(config_t_get global up_trust_doh_dns "tcp")
@@ -764,13 +768,14 @@ start_dns() {
 	;;
 	udp)
 		use_udp_node_resolve_dns=1
-		msg="直接使用UDP节点请求DNS"
+		TUN_DNS=${DNS_FORWARD}
+		echolog "  - 域名解析：直接使用UDP节点请求DNS（$TUN_DNS）"
 	;;
 	custom)
 		[ "$CHINADNS_NG" != "1" ] && {
 			custom_dns=$(config_t_get global custom_dns)
 			TUN_DNS="$(echo ${custom_dns} | sed 's/:/#/g')"
-			echolog "  - 域名解析 直接使用UDP协议自定义DNS（$TUN_DNS）解析..."
+			echolog "  - 域名解析：直接使用UDP协议自定义DNS（$TUN_DNS）解析..."
 		}
 	;;
 	esac
@@ -808,8 +813,8 @@ start_dns() {
 		echolog "  - dns2sock(127.0.0.1:${dns_listen_port}${dns2sock_cache})，${dns2socks_socks_server:-127.0.0.1:9050} -> ${dns2socks_forward-D46.182.19.48:53}"
 		#[ "$CHINADNS_NG" = "1" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS=$(echo "${dns_listen_port}" | sed 's/:/#/g')
 	fi
-	[ "${use_udp_node_resolve_dns}" = "1" ] && echolog "  * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发"
-	[ "${use_tcp_node_resolve_dns}" = "1" ] && echolog "  * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发"
+	[ "${use_udp_node_resolve_dns}" = "1" ] && echolog "  * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发！"
+	[ "${use_tcp_node_resolve_dns}" = "1" ] && echolog "  * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发！"
 }
 
 add_dnsmasq() {
@@ -836,7 +841,7 @@ add_dnsmasq() {
 		#始终用国内DNS解析节点域名
 		fwd_dns="${LOCAL_DNS}"
 		servers=$(uci show "${CONFIG}" | grep ".address=" | cut -d "'" -f 2)
-		hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/vpsiplist_host.conf"
+		hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/01-vpsiplist_host.conf"
 		echolog "  - [$?]节点列表中的域名(vpsiplist)：${fwd_dns:-默认}"
 
 		#始终用国内DNS解析直连（白名单）列表		
@@ -845,7 +850,7 @@ add_dnsmasq() {
 		[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 		#如果没使用chnlist直接使用默认DNS
 		[ "${USE_CHNLIST}" = "0" ] && unset fwd_dns
-		sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf"
+		sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/00-direct_host.conf"
 		echolog "  - [$?]域名白名单(whitelist)：${fwd_dns:-默认}"
 
 		#当勾选使用chnlist，仅当使用大陆白名单或回国模式
@@ -868,7 +873,9 @@ add_dnsmasq() {
 		[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 		#如果使用chnlist直接使用默认DNS
 		[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
-		sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/proxy_host.conf"
+		sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/12-proxy_host.conf"
+		[ "2" -le "$TCP_NODE_NUM" ] && sort -u "${RULES_PATH}/proxy_host2" | gen_dnsmasq_items "blacklist2" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/11-proxy_host2.conf"
+		[ "3" -le "$TCP_NODE_NUM" ] && sort -u "${RULES_PATH}/proxy_host3" | gen_dnsmasq_items "blacklist3" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/10-proxy_host3.conf"
 		echolog "  - [$?]代理域名表(blacklist)：${fwd_dns:-默认}"
 
 		#如果没有使用回国模式

package/lienol/luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -7,6 +7,8 @@ IPSET_GFW="gfwlist"
 IPSET_CHN="chnroute"
 IPSET_CHN6="chnroute6"
 IPSET_BLACKLIST="blacklist"
+IPSET_BLACKLIST2="blacklist2"
+IPSET_BLACKLIST3="blacklist3"
 IPSET_WHITELIST="whitelist"
 
 FORCE_INDEX=2
@@ -130,8 +132,8 @@ load_acl() {
 			udp_redir_ports=${udp_redir_ports:-default}
 			[ "$tcp_proxy_mode" = "default" ] && tcp_proxy_mode=$TCP_PROXY_MODE
 			[ "$udp_proxy_mode" = "default" ] && udp_proxy_mode=$UDP_PROXY_MODE
-			[ "$TCP_NODE_NUM" == "1" ] && tcp_node=1
-			[ "$UDP_NODE_NUM" == "1" ] && udp_node=1
+			[ "$tcp_node" -gt "$TCP_NODE_NUM" ] && tcp_node=1
+			[ "$udp_node" -gt "$UDP_NODE_NUM" ] && udp_node=1
 			[ "$tcp_no_redir_ports" = "default" ] && tcp_no_redir_ports=$TCP_NO_REDIR_PORTS
 			[ "$udp_no_redir_ports" = "default" ] && udp_no_redir_ports=$UDP_NO_REDIR_PORTS
 			[ "$tcp_redir_ports" = "default" ] && tcp_redir_ports=$TCP_REDIR_PORTS
@@ -191,33 +193,93 @@ load_acl() {
 	local ipt_tmp=$ipt_n
 	local is_tproxy msg
 	unset is_tproxy msg
-	[ "$TCP_NODE1" != "nil" ] && [ "$TCP_PROXY_MODE" != "disable" ] && {
-		local TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z')
-		[ "$TCP_NODE1_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE1 protocol client)" == "client" ] && is_tproxy=1
-		#[ "$TCP_NODE1_TYPE" == "trojan-go" ] && is_tproxy=1
-			msg="TCP默认代理：使用TCP节点1 [$(get_action_chain_name $TCP_PROXY_MODE)]"
-		if [ -n "$is_tproxy" ]; then
-			ipt_tmp=$ipt_m && is_tproxy="TPROXY"
-			msg="${msg}(TPROXY:${TCP_REDIR_PORT1})代理"
-		else
-			msg="${msg}(REDIRECT:${TCP_REDIR_PORT1})代理"
-		fi
-		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN && msg="除${TCP_NO_REDIR_PORTS}外的"
-		msg="${msg}所有端口"
-		$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy)
-		$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy)
-		echolog "${msg}"
-	}
-	$ipt_tmp -A PSW $(comment "默认") -p tcp -j RETURN
+
+	if [ "$TCP_PROXY_MODE" != "disable" ]; then
+		[ "$TCP_NO_REDIR_PORTS" != "disable" ] && $ipt_tmp -A PSW $(comment "默认") -p tcp -m multiport --dport $TCP_NO_REDIR_PORTS -j RETURN
+		ipt_tmp=$ipt_n
+		unset is_tproxy msg
+		[ "3" -le "$TCP_NODE_NUM" ] && [ "$TCP_NODE3" != "nil" ] && {
+			local TCP_NODE3_TYPE=$(echo $(config_n_get $TCP_NODE3 type) | tr 'A-Z' 'a-z')
+			[ "$TCP_NODE3_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE3 protocol client)" == "client" ] && is_tproxy=1
+			#[ "$TCP_NODE3_TYPE" == "trojan-go" ] && is_tproxy=1
+				msg="TCP代理列表3：使用TCP节点3"
+			if [ -n "$is_tproxy" ]; then
+				ipt_tmp=$ipt_m && is_tproxy="TPROXY"
+				msg="${msg}(TPROXY:${TCP_REDIR_PORT3})代理"
+			else
+				msg="${msg}(REDIRECT:${TCP_REDIR_PORT3})代理"
+			fi
+			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_tmp -A PSW $(comment "列表3") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST3) $(REDIRECT $TCP_REDIR_PORT3 $is_tproxy)
+			echolog "${msg}"
+		}
+		ipt_tmp=$ipt_n
+		unset is_tproxy msg
+		[ "2" -le "$TCP_NODE_NUM" ] && [ "$TCP_NODE2" != "nil" ] && {
+			local TCP_NODE2_TYPE=$(echo $(config_n_get $TCP_NODE2 type) | tr 'A-Z' 'a-z')
+			[ "$TCP_NODE2_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE2 protocol client)" == "client" ] && is_tproxy=1
+			#[ "$TCP_NODE2_TYPE" == "trojan-go" ] && is_tproxy=1
+				msg="TCP代理列表2：使用TCP节点2"
+			if [ -n "$is_tproxy" ]; then
+				ipt_tmp=$ipt_m && is_tproxy="TPROXY"
+				msg="${msg}(TPROXY:${TCP_REDIR_PORT2})代理"
+			else
+				msg="${msg}(REDIRECT:${TCP_REDIR_PORT2})代理"
+			fi
+			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_tmp -A PSW $(comment "列表2") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST2) $(REDIRECT $TCP_REDIR_PORT2 $is_tproxy)
+			echolog "${msg}"
+		}
+		ipt_tmp=$ipt_n
+		unset is_tproxy msg
+		[ "$TCP_NODE1" != "nil" ] && {
+			local TCP_NODE1_TYPE=$(echo $(config_n_get $TCP_NODE1 type) | tr 'A-Z' 'a-z')
+			[ "$TCP_NODE1_TYPE" == "brook" ] && [ "$(config_n_get $TCP_NODE1 protocol client)" == "client" ] && is_tproxy=1
+			#[ "$TCP_NODE1_TYPE" == "trojan-go" ] && is_tproxy=1
+				msg="TCP默认代理：使用TCP节点1 [$(get_action_chain_name $TCP_PROXY_MODE)]"
+			if [ -n "$is_tproxy" ]; then
+				ipt_tmp=$ipt_m && is_tproxy="TPROXY"
+				msg="${msg}(TPROXY:${TCP_REDIR_PORT1})代理"
+			else
+				msg="${msg}(REDIRECT:${TCP_REDIR_PORT1})代理"
+			fi
+			[ "$TCP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $TCP_REDIR_PORT1 $is_tproxy)
+			$ipt_tmp -A PSW $(comment "默认") -p tcp $(factor $TCP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $TCP_PROXY_MODE $TCP_REDIR_PORT1 $is_tproxy)
+			echolog "${msg}"
+		}
+	fi
+	$ipt_n -A PSW $(comment "默认") -p tcp -j RETURN
+	$ipt_m -A PSW $(comment "默认") -p tcp -j RETURN
 
 	#  加载UDP默认代理模式
-	if [ "$UDP_NODE1" != "nil" ] && [ "$UDP_PROXY_MODE" != "disable" ]; then
-		msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理"
-		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN && msg="除${TCP_NO_REDIR_PORTS}外的"
-		msg="${msg}所有端口"
-		$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY)
-		$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY)
-		echolog "${msg}"
+	if [ "$UDP_PROXY_MODE" != "disable" ]; then
+		[ "$UDP_NO_REDIR_PORTS" != "disable" ] && $ipt_m -A PSW $(comment "默认") -p udp -m multiport --dport $UDP_NO_REDIR_PORTS -j RETURN
+		[ "3" -le "$UDP_NODE_NUM" ] && [ "$UDP_NODE3" != "nil" ] && {
+			msg="UDP代理列表3：使用UDP节点3 (TPROXY:${UDP_REDIR_PORT3})代理"
+			[ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_m -A PSW $(comment "列表3") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST3) $(REDIRECT $UDP_REDIR_PORT3 TPROXY)
+			echolog "${msg}"
+		}
+		[ "2" -le "$UDP_NODE_NUM" ] && [ "$UDP_NODE2" != "nil" ] && {
+			msg="UDP代理列表2：使用UDP节点2 (TPROXY:${UDP_REDIR_PORT2})代理"
+			[ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_m -A PSW $(comment "列表2") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST2) $(REDIRECT $UDP_REDIR_PORT2 TPROXY)
+			echolog "${msg}"
+		}
+		[ "$UDP_NODE1" != "nil" ] && {
+			msg="UDP默认代理：使用UDP节点1 [$(get_action_chain_name $UDP_PROXY_MODE)](TPROXY:${UDP_REDIR_PORT1})代理"
+			[ "$UDP_NO_REDIR_PORTS" != "disable" ] && msg="${msg}除${TCP_NO_REDIR_PORTS}外的"
+			msg="${msg}所有端口"
+			$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(dst $IPSET_BLACKLIST) $(REDIRECT $UDP_REDIR_PORT1 TPROXY)
+			$ipt_m -A PSW $(comment "默认") -p udp $(factor $UDP_REDIR_PORTS "-m multiport --dport") $(get_redirect_ipt $UDP_PROXY_MODE $UDP_REDIR_PORT1 TPROXY)
+			echolog "${msg}"
+		}
 	fi
 	$ipt_m -A PSW $(comment "默认") -p udp -j RETURN
 }
@@ -339,11 +401,15 @@ add_firewall_rule() {
 	ipset -! create $IPSET_CHN nethash
 	ipset -! create $IPSET_CHN6 nethash family inet6
 	ipset -! create $IPSET_BLACKLIST nethash
+	ipset -! create $IPSET_BLACKLIST2 nethash
+	ipset -! create $IPSET_BLACKLIST3 nethash
 	ipset -! create $IPSET_WHITELIST nethash
 
 	cat $RULES_PATH/chnroute | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
 	cat $RULES_PATH/chnroute6 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_CHN6 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
 	cat $RULES_PATH/proxy_ip | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+	[ -f "$RULES_PATH/proxy_ip2" ] && cat $RULES_PATH/proxy_ip2 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST2 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
+	[ -f "$RULES_PATH/proxy_ip3" ] && cat $RULES_PATH/proxy_ip3 | sed -e "/^$/d" | sed -e "s/^/add $IPSET_BLACKLIST3 &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
 	cat $RULES_PATH/direct_ip | sed -e "/^$/d" | sed -e "s/^/add $IPSET_WHITELIST &/g" | awk '{print $0} END{print "COMMIT"}' | ipset -! -R
 
 	ipset -! -R <<-EOF
@@ -586,6 +652,8 @@ del_firewall_rule() {
 	#ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 &
 	#ipset -F $IPSET_CHN6 >/dev/null 2>&1 && ipset -X $IPSET_CHN6 >/dev/null 2>&1 &
 	#ipset -F $IPSET_BLACKLIST >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST >/dev/null 2>&1 &
+	#ipset -F $IPSET_BLACKLIST2 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST2 >/dev/null 2>&1 &
+	#ipset -F $IPSET_BLACKLIST3 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST3 >/dev/null 2>&1 &
 	ipset -F $IPSET_WHITELIST >/dev/null 2>&1 && ipset -X $IPSET_WHITELIST >/dev/null 2>&1 &
 	#echolog "删除相关防火墙规则完成。"
 }
@@ -598,6 +666,8 @@ flush_ipset() {
 	ipset -F $IPSET_CHN >/dev/null 2>&1 && ipset -X $IPSET_CHN >/dev/null 2>&1 &
 	ipset -F $IPSET_CHN6 >/dev/null 2>&1 && ipset -X $IPSET_CHN6 >/dev/null 2>&1 &
 	ipset -F $IPSET_BLACKLIST >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST >/dev/null 2>&1 &
+	ipset -F $IPSET_BLACKLIST2 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST2 >/dev/null 2>&1 &
+	ipset -F $IPSET_BLACKLIST3 >/dev/null 2>&1 && ipset -X $IPSET_BLACKLIST3 >/dev/null 2>&1 &
 	ipset -F $IPSET_WHITELIST >/dev/null 2>&1 && ipset -X $IPSET_WHITELIST >/dev/null 2>&1 &
 }
 

package/network/services/umdns/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/mdnsd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-06-08
-PKG_SOURCE_VERSION:=d13290b427487bb05581e11875af3bfe74d6da2d
-PKG_MIRROR_HASH:=6cd38b41b341212359ddc723fc54ea16a2a7009519db015fb51cd2afb7324369
+PKG_SOURCE_DATE:=2020-07-20
+PKG_SOURCE_VERSION:=eadfa26a5cf31e27f551c37c1362983e9db37c4d
+PKG_MIRROR_HASH:=a7ea35b9078543050399cda08da49199f49e2535cb8dd957e0dc5a7ff86c32a4
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=LGPL-2.1

package/network/utils/bpftools/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bpftools
-PKG_VERSION:=5.8.3
+PKG_VERSION:=5.8.9
 PKG_RELEASE:=1
 
 PKG_SOURCE:=linux-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/v5.x
-PKG_HASH:=8ea27e1ed38981f772cc6d5f16ab8dbb8052c3800ba0494bd798fbb95dcc1779
+PKG_HASH:=99d8bc1b82f17d7d79f9af4a94af4c0e3772159e9e6e278761bde8569f93e15f
 
 PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
 
@@ -32,6 +32,7 @@ TAR_OPTIONS+= \
 	$(addprefix $(LINUX_TLD)/,$(BPF_FILES))
 
 include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
 
 define Package/bpftool/Default
   SECTION:=net
@@ -92,6 +93,10 @@ ifneq ($(BUILD_VARIANT),lib)
   TARGET_LDFLAGS += -Wl,--gc-sections
 endif
 
+ifneq ($(INTL_FULL),)
+  TARGET_LDFLAGS += -Wl,-lintl
+endif
+
 MAKE_FLAGS += \
 	EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
 	LDFLAGS="$(TARGET_LDFLAGS)" \
@@ -125,9 +130,9 @@ define Build/Configure
 		$(MAKE_FLAGS) FEATURES_DUMP= $(PKG_BUILD_DIR)//libbpf/libbpf.a
 	(cd $(PKG_BUILD_DIR); cat FEATURE-DUMP.bpftool libbpf/FEATURE-DUMP.libbpf \
 		| sort | uniq > FEATURE-DUMP.openwrt)
-	$(SED) 's/feature-libbfd=[01]/feature-libbfd=$(HAVE_LIBBFD)/' \
-		-e 's/feature-libcap=[01]/feature-libcap=$(HAVE_LIBCAP)/' \
-		-e 's/feature-clang-bpf-global-var=[01]/feature-clang-bpf-global-var=$(HAVE_CLANG)/' \
+	$(SED) 's/feature-libbfd=1/feature-libbfd=$(HAVE_LIBBFD)/' \
+		-e 's/feature-libcap=1/feature-libcap=$(HAVE_LIBCAP)/' \
+		-e 's/feature-clang-bpf-global-var=1/feature-clang-bpf-global-var=$(HAVE_CLANG)/' \
 		$(PKG_BUILD_DIR)/FEATURE-DUMP.openwrt
 endef
 

package/network/utils/bpftools/patches/001-libbpf-ensure-no-local-symbols-counted-in-ABI-check.patch

@@ -11,11 +11,9 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  tools/lib/bpf/Makefile | 2 ++
  1 file changed, 2 insertions(+)
 
-diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
-index bf8ed134cb8a..c820b0be9d63 100644
 --- a/tools/lib/bpf/Makefile
 +++ b/tools/lib/bpf/Makefile
-@@ -152,6 +152,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \
+@@ -152,6 +152,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --
  			   awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \
  			   sort -u | wc -l)
  VERSIONED_SYM_COUNT = $(shell readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \
@@ -31,6 +29,3 @@ index bf8ed134cb8a..c820b0be9d63 100644
  		    grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 |		 \
  		    sort -u > $(OUTPUT)libbpf_versioned_syms.tmp; 	 \
  		diff -u $(OUTPUT)libbpf_global_syms.tmp			 \
--- 
-2.25.1
-

package/network/utils/bpftools/patches/002-libbpf-fix-build-failure-from-uninitialized-variable.patch

@@ -27,12 +27,10 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  tools/lib/bpf/libbpf.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
-index 11e4725b8b1c..a72296797357 100644
 --- a/tools/lib/bpf/libbpf.c
 +++ b/tools/lib/bpf/libbpf.c
-@@ -5028,8 +5028,8 @@ static int bpf_object__collect_map_relos(struct bpf_object *obj,
- 	int i, j, nrels, new_sz, ptr_sz = sizeof(void *);
+@@ -5030,8 +5030,8 @@ static int bpf_object__collect_map_relos
+ 	int i, j, nrels, new_sz;
  	const struct btf_var_secinfo *vi = NULL;
  	const struct btf_type *sec, *var, *def;
 +	struct bpf_map *map = NULL, *targ_map;
@@ -41,6 +39,3 @@ index 11e4725b8b1c..a72296797357 100644
  	const char *name, *mname;
  	Elf_Data *symbols;
  	unsigned int moff;
--- 
-2.25.1
-

package/network/utils/bpftools/patches/003-bpftool-allow-passing-BPFTOOL_VERSION-to-make.patch

@@ -8,8 +8,6 @@ Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
  tools/bpf/bpftool/Makefile | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
-index 9e85f101be85..d9d821736c31 100644
 --- a/tools/bpf/bpftool/Makefile
 +++ b/tools/bpf/bpftool/Makefile
 @@ -25,7 +25,7 @@ endif
@@ -21,6 +19,3 @@ index 9e85f101be85..d9d821736c31 100644
  
  $(LIBBPF): FORCE
  	$(if $(LIBBPF_OUTPUT),@mkdir -p $(LIBBPF_OUTPUT))
--- 
-2.25.1
-

package/network/utils/bpftools/patches/004-v5.9-bpftool-use-only-ftw-for-file-tree-parsing.patch

@@ -26,8 +26,6 @@ Link: https://lore.kernel.org/bpf/20200721024817.13701-1-Tony.Ambardar@gmail.com
  tools/bpf/bpftool/main.h   |   4 +-
  2 files changed, 82 insertions(+), 59 deletions(-)
 
-diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
-index 88264abaa738..d8bb4dd18c8a 100644
 --- a/tools/bpf/bpftool/common.c
 +++ b/tools/bpf/bpftool/common.c
 @@ -1,10 +1,11 @@
@@ -86,7 +84,7 @@ index 88264abaa738..d8bb4dd18c8a 100644
  {
  	enum bpf_obj_type type;
  	int fd;
-@@ -353,71 +365,82 @@ void print_hex_data_json(uint8_t *data, size_t len)
+@@ -330,71 +342,82 @@ void print_hex_data_json(uint8_t *data,
  	jsonw_end_array(json_wtr);
  }
  
@@ -218,11 +216,9 @@ index 88264abaa738..d8bb4dd18c8a 100644
  }
  
  void delete_pinned_obj_table(struct pinned_obj_table *tab)
-diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
-index af9ad56c303a..b02e763f1e9c 100644
 --- a/tools/bpf/bpftool/main.h
 +++ b/tools/bpf/bpftool/main.h
-@@ -140,8 +140,8 @@ int cmd_select(const struct cmd *cmds, int argc, char **argv,
+@@ -196,8 +196,8 @@ int cmd_select(const struct cmd *cmds, i
  int get_fd_type(int fd);
  const char *get_fd_type_name(enum bpf_obj_type type);
  char *get_fdinfo(int fd, const char *key);
@@ -231,8 +227,5 @@ index af9ad56c303a..b02e763f1e9c 100644
 +int open_obj_pinned(const char *path, bool quiet);
 +int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type);
  int mount_bpffs_for_pin(const char *name);
- int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32));
+ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(int *, char ***));
  int do_pin_fd(int fd, const char *name);
--- 
-2.17.1
-

package/network/utils/bpftools/patches/005-tools-arch-powerpc-fix-EDEADLOCK-redefinition-errors.patch

@@ -0,0 +1,56 @@
+From afe3f4c765b17ced23811fe652c7f7adf7a0c0cf Mon Sep 17 00:00:00 2001
+From: Tony Ambardar <Tony.Ambardar@gmail.com>
+Date: Mon, 14 Sep 2020 23:05:26 -0700
+Subject: [PATCH] tools/arch/powerpc: fix EDEADLOCK redefinition errors in
+ errno.h
+
+A few archs like powerpc have different errno.h values for macros
+EDEADLOCK and EDEADLK. In code including both libc and linux versions of
+errno.h, this can result in multiple definitions of EDEADLOCK in the
+include chain. Definitions to the same value (e.g. seen with mips) do
+not raise warnings, but on powerpc there are redefinitions changing the
+value, which raise warnings and errors (with "-Werror").
+
+Guard against these redefinitions to avoid build errors like the following,
+first seen cross-compiling libbpf v5.8.9 for powerpc using GCC 8.4.0 with
+musl 1.1.24:
+
+  In file included from ../../arch/powerpc/include/uapi/asm/errno.h:5,
+                   from ../../include/linux/err.h:8,
+                   from libbpf.c:29:
+  ../../include/uapi/asm-generic/errno.h:40: error: "EDEADLOCK" redefined [-Werror]
+   #define EDEADLOCK EDEADLK
+
+  In file included from toolchain-powerpc_8540_gcc-8.4.0_musl/include/errno.h:10,
+                   from libbpf.c:26:
+  toolchain-powerpc_8540_gcc-8.4.0_musl/include/bits/errno.h:58: note: this is the location of the previous definition
+   #define EDEADLOCK       58
+
+  cc1: all warnings being treated as errors
+  make[5]: *** [target-powerpc_8540_musl/bpftools-5.8.9/tools/build/Makefile.build:97: /home/kodidev/openwrt-project/build_dir/target-powerpc_8540_musl/bpftools-minimal/bpftools-5.8.9//libbpf/staticobjs/libbpf.o] Error 1
+
+Fixes: 95f28190aa01 ("tools include arch: Grab a copy of errno.h for arch's
+                      supported by perf")
+Fixes: c3617f72036c ("UAPI: (Scripted) Disintegrate arch/powerpc/include/asm")
+
+Reported-by: Rosen Penev <rosenp@gmail.com>
+Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
+---
+ tools/arch/powerpc/include/uapi/asm/errno.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/arch/powerpc/include/uapi/asm/errno.h b/tools/arch/powerpc/include/uapi/asm/errno.h
+index cc79856896a1..4ba87de32be0 100644
+--- a/tools/arch/powerpc/include/uapi/asm/errno.h
++++ b/tools/arch/powerpc/include/uapi/asm/errno.h
+@@ -2,6 +2,7 @@
+ #ifndef _ASM_POWERPC_ERRNO_H
+ #define _ASM_POWERPC_ERRNO_H
+ 
++#undef	EDEADLOCK
+ #include <asm-generic/errno.h>
+ 
+ #undef	EDEADLOCK
+-- 
+2.25.1
+

package/ntlf9t/AdGuardHome/Makefile

@@ -54,7 +54,7 @@ config ADGUARDHOME_COMPRESS_GOPROXY
 
 config ADGUARDHOME_COMPRESS_UPX
 	bool "Compress executable files with UPX"
-	default y
+	default n
 endef
 
 ifeq ($(CONFIG_ADGUARDHOME_COMPRESS_GOPROXY),y)

tools/libressl/Makefile

@@ -8,8 +8,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libressl
-PKG_VERSION:=3.0.2
-PKG_HASH:=df7b172bf79b957dd27ef36dcaa1fb162562c0e8999e194aa8c1a3df2f15398e
+PKG_VERSION:=3.2.1
+PKG_HASH:=d28db224cfb6d18009b2a7e8cb213cd5c943bbec87550062fef6a38479250315
 PKG_RELEASE:=1
 
 PKG_CPE_ID:=cpe:/a:openbsd:libressl
@@ -23,7 +23,7 @@ HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
-HOST_CONFIGURE_ARGS += --disable-shared
+HOST_CONFIGURE_ARGS += --enable-static --disable-shared --disable-tests
 HOST_CFLAGS += $(FPIC)
 
 ifeq ($(GNU_HOST_NAME),x86_64-linux-gnux32)

tools/libressl/patches/001-dont-build-tests-man.patch

@@ -1,11 +0,0 @@
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -361,7 +361,7 @@ target_alias = @target_alias@
- top_build_prefix = @top_build_prefix@
- top_builddir = @top_builddir@
- top_srcdir = @top_srcdir@
--SUBDIRS = crypto ssl tls include apps tests man
-+SUBDIRS = crypto ssl tls include apps
- ACLOCAL_AMFLAGS = -I m4
- pkgconfigdir = $(libdir)/pkgconfig
- pkgconfig_DATA = libcrypto.pc libssl.pc libtls.pc openssl.pc