Merge Lean's source

2020-03-22 19:07:54 +08:00 · 2020-03-22 19:07:54 +08:00 · a225a908b2
commit a225a908b2
parent bc58d06103 0197bc0fa8
16 changed files with 621 additions and 46 deletions
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk

 PKG_NAME:=base-files
-PKG_RELEASE:=199
+PKG_RELEASE:=200
 PKG_FLAGS:=nonshared

 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@ -2,6 +2,7 @@

 . /lib/functions.sh
 . /lib/functions/system.sh
+. /usr/share/libubox/jshn.sh

 # initialize defaults
 export MTD_CONFIG_ARGS=""
@ -368,9 +369,15 @@ if [ -n "$FAILSAFE" ]; then
 	printf '%s\x00%s\x00%s' "$RAM_ROOT" "$IMAGE" "$COMMAND" >/tmp/sysupgrade
 	lock -u /tmp/.failsafe
 else
-	ubus call system sysupgrade "{
-		\"prefix\": $(json_string "$RAM_ROOT"),
-		\"path\": $(json_string "$IMAGE"),
-		\"command\": $(json_string "$COMMAND")
-	}"
+	json_init
+	json_add_string prefix "$RAM_ROOT"
+	json_add_string path "$IMAGE"
+	[ $FORCE -eq 1 ] && json_add_boolean force 1
+	[ $SAVE_CONFIG -eq 1 ] && json_add_string backup "$CONF_TAR"
+	json_add_string command "$COMMAND"
+	json_add_object options
+	json_add_int save_partitions "$SAVE_PARTITIONS"
+	json_close_object
+
+	ubus call system sysupgrade "$(json_dump)"
 fi
--- a/package/base-files/files/usr/libexec/validate_firmware_image
+++ b/package/base-files/files/usr/libexec/validate_firmware_image
@ -0,0 +1,66 @@
+#!/bin/sh
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+. /usr/share/libubox/jshn.sh
+
+include /lib/upgrade
+
+VALID=1
+FORCEABLE=1
+ALLOW_BACKUP=1
+
+# Mark image as invalid but still possible to install
+notify_firmware_invalid() {
+	VALID=0
+}
+
+# Mark image as broken (impossible to install)
+notify_firmware_broken() {
+	VALID=0
+	FORCEABLE=0
+}
+
+# Mark image as incompatible with preserving a backup
+notify_firmware_no_backup() {
+	ALLOW_BACKUP=0
+}
+
+# Add result of validation test
+notify_firmware_test_result() {
+	local old_ns
+
+	json_set_namespace validate_firmware_image old_ns
+	json_add_boolean "$1" "$2"
+	json_set_namespace $old_ns
+}
+
+err_to_bool() {
+	[ "$1" -ne 0 ] && echo 0 || echo 1
+}
+
+fwtool_check_signature "$1" >&2
+FWTOOL_SIGNATURE=$?
+[ "$FWTOOL_SIGNATURE" -ne 0 ] && notify_firmware_invalid
+
+fwtool_check_image "$1" >&2
+FWTOOL_DEVICE_MATCH=$?
+[ "$FWTOOL_DEVICE_MATCH" -ne 0 ] && notify_firmware_invalid
+
+json_set_namespace validate_firmware_image old_ns
+json_init
+	json_add_object "tests"
+		json_add_boolean fwtool_signature "$(err_to_bool $FWTOOL_SIGNATURE)"
+		json_add_boolean fwtool_device_match "$(err_to_bool $FWTOOL_DEVICE_MATCH)"
+
+		# Call platform_check_image() here so it can add its test
+		# results and still mark image properly.
+		json_set_namespace $old_ns
+		platform_check_image "$1" >&2 || notify_firmware_invalid
+		json_set_namespace validate_firmware_image old_ns
+	json_close_object
+	json_add_boolean valid "$VALID"
+	json_add_boolean forceable "$FORCEABLE"
+	json_add_boolean allow_backup "$ALLOW_BACKUP"
+json_dump -i
+json_set_namespace $old_ns
--- a/package/lean/luci-app-adbyby-plus/Makefile
+++ b/package/lean/luci-app-adbyby-plus/Makefile
@ -10,7 +10,7 @@ LUCI_DEPENDS:=+adbyby +wget +ipset +dnsmasq-full
 LUCI_PKGARCH:=all
 PKG_NAME:=luci-app-adbyby-plus
 PKG_VERSION:=2.0
-PKG_RELEASE:=67
+PKG_RELEASE:=68

 include $(TOPDIR)/feeds/luci/luci.mk

--- a/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh
+++ b/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh
@ -43,6 +43,7 @@ if [ ! -f "/tmp/adbyby.updated" ];then
   
   rm -f /tmp/adbyby/data/*.bak
    
-   /etc/init.d/adbyby restart
+   kill -9 $(busybox ps -w | grep "/tmp/adbyby/adbyby" | grep -v grep | grep -v update | awk '{print $1}') >/dev/null 2>&1
+   /tmp/adbyby/adbyby >/dev/null 2>&1 &
 fi

--- a/package/lean/luci-app-ssr-plus/Makefile
+++ b/package/lean/luci-app-ssr-plus/Makefile
@ -1,22 +1,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-ssr-plus
-PKG_VERSION:=171
-PKG_RELEASE:=6
+PKG_VERSION:=172
+PKG_RELEASE:=1

 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

 include $(INCLUDE_DIR)/package.mk

 define Package/$(PKG_NAME)/config
-config PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks
-	bool "Include Shadowsocks New Version"
-	default y if x86||x86_64||arm||aarch64
-
-config PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs
-	bool "Include Shadowsocks Simple-obfs Plugin"
-	default y if x86||x86_64||arm||aarch64
-
 config PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_plugin
 	bool "Include Shadowsocks V2ray Plugin"
 	default y if x86||x86_64||arm||aarch64
@ -49,12 +41,11 @@ define Package/$(PKG_NAME)
 	TITLE:=SS/SSR/V2Ray/Trojan LuCI interface
 	PKGARCH:=all
 	DEPENDS:=+shadowsocksr-libev-alt +ipset +ip-full +iptables-mod-tproxy +dnsmasq-full +coreutils +coreutils-base64 +pdnsd-alt +wget +lua +libuci-lua \
-	+microsocks +ipt2socks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local \
-	+PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks:shadowsocks-libev-ss-redir \
-	+PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs:simple-obfs \
+	+microsocks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local +shadowsocks-libev-ss-redir +simple-obfs \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_plugin:v2ray-plugin \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:trojan \
+	+PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:ipt2socks \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Redsocks2:redsocks2 \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_Kcptun:kcptun-client \
 	+PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_Server:shadowsocksr-libev-server
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
@ -134,12 +134,14 @@ start() {
 				CURRENT_SERVER=$DEFAULT_SERVER
 				switch_proxy $CURRENT_SERVER
 				echo "$(date "+%Y-%m-%d %H:%M:%S") switch to default ["$(uci_get_by_name $CURRENT_SERVER server)"] proxy!" >>/tmp/ssrplus.log
-				continue
 			else
 				echo "$(date "+%Y-%m-%d %H:%M:%S") Main server is NOT avilable.Continue using current server." >>/tmp/ssrplus.log
 			fi
+		else 
+		   echo "$(date "+%Y-%m-%d %H:%M:%S") The current server is the default server." >>/tmp/ssrplus.log
 		fi
 		#判断当前代理是否正常
+		echo "$(date "+%Y-%m-%d %H:%M:%S") Start checking if the current server is available." >>/tmp/ssrplus.log
 		check_proxy
 		current_ret=$?
 		if [ "$current_ret" == "1" ]; then
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@ -12,6 +12,10 @@ PKG_BASE:=1.1.1
 PKG_BUGFIX:=e
 PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX)
 PKG_RELEASE:=1
+PKG_USE_MIPS16:=0
+ENGINES_DIR=engines-1.1
+
+PKG_BUILD_PARALLEL:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:= \
@ -22,10 +26,6 @@ PKG_SOURCE_URL:= \
 	ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/
 PKG_HASH:=694f61ac11cb51c9bf73f54e771ff6022b0327a43bbdfa1b2f19de1662a6dcbe

-PKG_USE_MIPS16:=0
-ENGINES_DIR=engines-1.1
-PKG_BUILD_PARALLEL:=1
-
 PKG_LICENSE:=OpenSSL
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@ -158,6 +158,8 @@ define Package/dropbear/install
 	$(INSTALL_BIN) ./files/dropbear.init $(1)/etc/init.d/dropbear
 	$(INSTALL_DIR) $(1)/usr/lib/opkg/info
 	$(INSTALL_DIR) $(1)/etc/dropbear
+	$(INSTALL_DIR) $(1)/lib/preinit
+	$(INSTALL_DATA) ./files/dropbear.failsafe $(1)/lib/preinit/99_10_failsafe_dropbear
 	$(if $(CONFIG_DROPBEAR_ECC),touch $(1)/etc/dropbear/dropbear_ecdsa_host_key)
 	touch $(1)/etc/dropbear/dropbear_rsa_host_key
 endef
--- a/package/network/services/dropbear/files/dropbear.failsafe
+++ b/package/network/services/dropbear/files/dropbear.failsafe
@ -0,0 +1,8 @@
+#!/bin/sh
+
+failsafe_dropbear () {
+	dropbearkey -t rsa -s 1024 -f /tmp/dropbear_failsafe_host_key
+	dropbear -r /tmp/dropbear_failsafe_host_key <> /dev/null 2>&1
+}
+
+boot_hook_add failsafe failsafe_dropbear
--- a/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch
+++ b/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch
@ -0,0 +1,459 @@
+From 74267bacce0c43e5038b0377cb7c08f1ad9d50a3 Mon Sep 17 00:00:00 2001
+From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Date: Sat, 23 Mar 2019 10:21:03 +0000
+Subject: [PATCH] iptables: connmark - add set-dscpmark option for openwrt
+
+Naive user space front end to xt_connmark 'setdscp' option.
+
+iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
+
+This version has a hack to support a backport to 4.14
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ extensions/libxt_CONNMARK.c           | 315 +++++++++++++++++++++++++-
+ include/linux/netfilter/xt_connmark.h |  10 +
+ 2 files changed, 324 insertions(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
+index 21e10913..c777b110 100644
+--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
+@@ -22,6 +22,7 @@
+ #include <stdbool.h>
+ #include <stdint.h>
+ #include <stdio.h>
+#include <strings.h>
+ #include <xtables.h>
+ #include <linux/netfilter/xt_CONNMARK.h>
+ 
+@@ -49,6 +50,7 @@ enum {
+ 	O_CTMASK,
+ 	O_NFMASK,
+ 	O_MASK,
+	O_DSCP_MARK,
+ 	F_SET_MARK         = 1 << O_SET_MARK,
+ 	F_SAVE_MARK        = 1 << O_SAVE_MARK,
+ 	F_RESTORE_MARK     = 1 << O_RESTORE_MARK,
+@@ -61,8 +63,10 @@ enum {
+ 	F_CTMASK           = 1 << O_CTMASK,
+ 	F_NFMASK           = 1 << O_NFMASK,
+ 	F_MASK             = 1 << O_MASK,
+	F_DSCP_MARK	   = 1 << O_DSCP_MARK,
+ 	F_OP_ANY           = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
+-	                     F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+	                     F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
+			     F_DSCP_MARK,
+ };
+ 
+ static const char *const xt_connmark_shift_ops[] = {
+@@ -114,6 +118,8 @@ static const struct xt_option_entry connmark_tg_opts[] = {
+ 	 .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
+ 	{.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
+ 	 .excl = F_CTMASK | F_NFMASK},
+	{.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
+	 .excl = F_OP_ANY},
+ 	XTOPT_TABLEEND,
+ };
+ #undef s
+@@ -148,6 +154,38 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = {
+ };
+ #undef s
+ 
+#define s struct xt_connmark_tginfo3
+static const struct xt_option_entry connmark_tg_opts_v3[] = {
+	{.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
+	 .excl = F_OP_ANY},
+	{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+	 .excl = F_OP_ANY},
+	{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+	 .excl = F_OP_ANY},
+	{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+	 .excl = F_OP_ANY},
+	{.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
+	 .excl = F_OP_ANY},
+	{.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
+	 .excl = F_OP_ANY},
+	{.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
+	 .excl = F_OP_ANY},
+	{.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8,
+	 .min = 0, .max = 32},
+	{.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8,
+	 .min = 0, .max = 32},
+	{.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
+	 .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
+	{.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
+	 .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
+	{.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
+	 .excl = F_CTMASK | F_NFMASK},
+	{.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
+	 .excl = F_OP_ANY},
+	XTOPT_TABLEEND,
+};
+#undef s
+
+ static void connmark_tg_help(void)
+ {
+ 	printf(
+@@ -175,6 +213,15 @@ static void connmark_tg_help_v2(void)
+ );
+ }
+ 
+static void connmark_tg_help_v3(void)
+{
+	connmark_tg_help_v2();
+	printf(
+"  --set-dscpmark value/mask        Save DSCP to conntrack mark value\n"
+);
+}
+
+
+ static void connmark_tg_init(struct xt_entry_target *target)
+ {
+ 	struct xt_connmark_tginfo1 *info = (void *)target->data;
+@@ -199,6 +246,16 @@ static void connmark_tg_init_v2(struct xt_entry_target *target)
+ 	info->shift_bits = 0;
+ }
+ 
+static void connmark_tg_init_v3(struct xt_entry_target *target)
+{
+	struct xt_connmark_tginfo3 *info;
+
+	connmark_tg_init_v2(target);
+	info = (void *)target->data;
+
+	info->func = 0;
+}
+
+ static void CONNMARK_parse(struct xt_option_call *cb)
+ {
+ 	struct xt_connmark_target_info *markinfo = cb->data;
+@@ -253,6 +310,23 @@ static void connmark_tg_parse(struct xt_option_call *cb)
+ 		info->ctmark = cb->val.u32;
+ 		info->ctmask = 0;
+ 		break;
+	case O_DSCP_MARK:
+/* we sneaky sneaky this.  nfmask isn't used by the set mark functionality
+ * and by default is set to uint32max.  We can use the top bit as a flag
+ * that we're in DSCP_MARK submode of SET_MARK, if set then it's normal
+ * if unset then we're in DSCP_MARK
+ */
+		info->mode   = XT_CONNMARK_SET;
+		info->ctmark = cb->val.mark;
+		info->ctmask = cb->val.mask;
+		info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+		/* need 6 contiguous bits */
+		if ((~0 & (info->ctmark >> info->nfmask)) != 0x3f)
+			xtables_error(PARAMETER_PROBLEM,
+				"CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
+		if (info->ctmark & info->ctmask)
+			xtables_error(PARAMETER_PROBLEM,
+				"CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
+ 	case O_SAVE_MARK:
+ 		info->mode = XT_CONNMARK_SAVE;
+ 		break;
+@@ -320,6 +394,78 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb)
+ 	}
+ }
+ 
+static void connmark_tg_parse_v3(struct xt_option_call *cb)
+{
+	struct xt_connmark_tginfo3 *info = cb->data;
+
+	xtables_option_parse(cb);
+	switch (cb->entry->id) {
+	case O_SET_XMARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_VALUE;
+		info->ctmark = cb->val.mark;
+		info->ctmask = cb->val.mask;
+		break;
+	case O_SET_MARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_VALUE;
+		info->ctmark = cb->val.mark;
+		info->ctmask = cb->val.mark | cb->val.mask;
+		break;
+	case O_AND_MARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_VALUE;
+		info->ctmark = 0;
+		info->ctmask = ~cb->val.u32;
+		break;
+	case O_OR_MARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_VALUE;
+		info->ctmark = cb->val.u32;
+		info->ctmask = cb->val.u32;
+		break;
+	case O_XOR_MARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_VALUE;
+		info->ctmark = cb->val.u32;
+		info->ctmask = 0;
+		break;
+	case O_DSCP_MARK:
+		info->mode   = XT_CONNMARK_SET;
+		info->func   = XT_CONNMARK_DSCP;
+		info->ctmark = cb->val.mark;
+		info->ctmask = cb->val.mask;
+		info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+		/* need 6 contiguous bits */
+		if ((~0 & (info->ctmark >> info->shift_bits)) != 0x3f)
+			xtables_error(PARAMETER_PROBLEM,
+				"CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
+		if (info->ctmark & info->ctmask)
+			xtables_error(PARAMETER_PROBLEM,
+				"CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
+		break;
+	case O_SAVE_MARK:
+		info->mode = XT_CONNMARK_SAVE;
+		break;
+	case O_RESTORE_MARK:
+		info->mode = XT_CONNMARK_RESTORE;
+		break;
+	case O_MASK:
+		info->nfmask = info->ctmask = cb->val.u32;
+		break;
+	case O_LEFT_SHIFT_MARK:
+		info->shift_dir = D_SHIFT_LEFT;
+		info->shift_bits = cb->val.u8;
+		break;
+	case O_RIGHT_SHIFT_MARK:
+		info->shift_dir = D_SHIFT_RIGHT;
+		info->shift_bits = cb->val.u8;
+		break;
+	default:
+		break;
+	}
+}
+
+ static void connmark_tg_check(struct xt_fcheck_call *cb)
+ {
+ 	if (!(cb->xflags & F_OP_ANY))
+@@ -463,6 +609,65 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target,
+ 	}
+ }
+ 
+static void
+connmark_tg_print_v3(const void *ip, const struct xt_entry_target *target,
+                  int numeric)
+{
+	const struct xt_connmark_tginfo3 *info = (const void *)target->data;
+	const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+	switch (info->mode) {
+	case XT_CONNMARK_SET:
+		if (info->func & XT_CONNMARK_DSCP) {
+			printf(" CONNMARK DSCP 0x%x/0x%x",
+			       info->ctmark, info->ctmask);
+		}
+		if (info->func & XT_CONNMARK_VALUE) {
+			if (info->ctmark == 0)
+				printf(" CONNMARK and 0x%x",
+				       (unsigned int)(uint32_t)~info->ctmask);
+			else if (info->ctmark == info->ctmask)
+				printf(" CONNMARK or 0x%x", info->ctmark);
+			else if (info->ctmask == 0)
+				printf(" CONNMARK xor 0x%x", info->ctmark);
+			else if (info->ctmask == 0xFFFFFFFFU)
+				printf(" CONNMARK set 0x%x", info->ctmark);
+			else
+				printf(" CONNMARK xset 0x%x/0x%x",
+				       info->ctmark, info->ctmask);
+		}
+		break;
+	case XT_CONNMARK_SAVE:
+		if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
+			printf(" CONNMARK save");
+		else if (info->nfmask == info->ctmask)
+			printf(" CONNMARK save mask 0x%x", info->nfmask);
+		else
+			printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x",
+			       info->nfmask, info->ctmask);
+		break;
+	case XT_CONNMARK_RESTORE:
+		if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX)
+			printf(" CONNMARK restore");
+		else if (info->ctmask == info->nfmask)
+			printf(" CONNMARK restore mask 0x%x", info->ctmask);
+		else
+			printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x",
+			       info->ctmask, info->nfmask);
+		break;
+
+	default:
+		printf(" ERROR: UNKNOWN CONNMARK MODE");
+		break;
+	}
+
+	if (info->mode <= XT_CONNMARK_RESTORE &&
+	    !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+	    info->shift_bits != 0) {
+		printf(" %s %u", shift_op, info->shift_bits);
+	}
+}
+
+ static void CONNMARK_save(const void *ip, const struct xt_entry_target *target)
+ {
+ 	const struct xt_connmark_target_info *markinfo =
+@@ -548,6 +753,38 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target)
+ 	}
+ }
+ 
+static void
+connmark_tg_save_v3(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_connmark_tginfo3 *info = (const void *)target->data;
+	const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+	switch (info->mode) {
+	case XT_CONNMARK_SET:
+		if (info->func & XT_CONNMARK_VALUE)
+			printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
+		if (info->func & XT_CONNMARK_DSCP)
+			printf(" --set-dscpmark 0x%x/0x%x", info->ctmark, info->ctmask);
+		break;
+	case XT_CONNMARK_SAVE:
+		printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
+		       info->nfmask, info->ctmask);
+		break;
+	case XT_CONNMARK_RESTORE:
+		printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x",
+		       info->nfmask, info->ctmask);
+		break;
+	default:
+		printf(" ERROR: UNKNOWN CONNMARK MODE");
+		break;
+	}
+	if (info->mode <= XT_CONNMARK_RESTORE &&
+	    !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+	    info->shift_bits != 0) {
+		printf(" --%s %u", shift_op, info->shift_bits);
+	}
+}
+
+ static int connmark_tg_xlate(struct xt_xlate *xl,
+ 			     const struct xt_xlate_tg_params *params)
+ {
+@@ -639,6 +876,66 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl,
+ 
+ 	return 1;
+ }
+
+static int connmark_tg_xlate_v3(struct xt_xlate *xl,
+			     const struct xt_xlate_tg_params *params)
+{
+	const struct xt_connmark_tginfo3 *info =
+		(const void *)params->target->data;
+	const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+	switch (info->mode) {
+	case XT_CONNMARK_SET:
+		xt_xlate_add(xl, "ct mark set ");
+		if (info->func & XT_CONNMARK_VALUE) {
+			if (info->ctmask == 0xFFFFFFFFU)
+				xt_xlate_add(xl, "0x%x ", info->ctmark);
+			else if (info->ctmark == 0)
+				xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
+			else if (info->ctmark == info->ctmask)
+				xt_xlate_add(xl, "ct mark or 0x%x",
+					     info->ctmark);
+			else if (info->ctmask == 0)
+				xt_xlate_add(xl, "ct mark xor 0x%x",
+					     info->ctmark);
+			else
+				xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
+					     info->ctmark, ~info->ctmask);
+		}
+		if (info->func & XT_CONNMARK_DSCP) {
+/* FIXME the nftables syntax would go here if only we knew what it was */
+			xt_xlate_add(xl, "ct mark set typeof(ct mark) ip dscp "
+					 "<< %u or 0x%x", info->shift_bits,
+					     info->ctmask);
+		}
+		break;
+	case XT_CONNMARK_SAVE:
+		xt_xlate_add(xl, "ct mark set mark");
+		if (!(info->nfmask == UINT32_MAX &&
+		    info->ctmask == UINT32_MAX)) {
+			if (info->nfmask == info->ctmask)
+				xt_xlate_add(xl, " and 0x%x", info->nfmask);
+		}
+		break;
+	case XT_CONNMARK_RESTORE:
+		xt_xlate_add(xl, "meta mark set ct mark");
+		if (!(info->nfmask == UINT32_MAX &&
+		    info->ctmask == UINT32_MAX)) {
+			if (info->nfmask == info->ctmask)
+				xt_xlate_add(xl, " and 0x%x", info->nfmask);
+		}
+		break;
+	}
+
+	if (info->mode <= XT_CONNMARK_RESTORE &&
+	    !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+	    info->shift_bits != 0) {
+		xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits);
+	}
+
+	return 1;
+}
+
+ static struct xtables_target connmark_tg_reg[] = {
+ 	{
+ 		.family        = NFPROTO_UNSPEC,
+@@ -687,6 +984,22 @@ static struct xtables_target connmark_tg_reg[] = {
+ 		.x6_options    = connmark_tg_opts_v2,
+ 		.xlate         = connmark_tg_xlate_v2,
+ 	},
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "CONNMARK",
+		.revision      = 3,
+		.family        = NFPROTO_UNSPEC,
+		.size          = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
+		.help          = connmark_tg_help_v3,
+		.init          = connmark_tg_init_v3,
+		.print         = connmark_tg_print_v3,
+		.save          = connmark_tg_save_v3,
+		.x6_parse      = connmark_tg_parse_v3,
+		.x6_fcheck     = connmark_tg_check,
+		.x6_options    = connmark_tg_opts_v3,
+		.xlate         = connmark_tg_xlate_v3,
+	},
+ };
+ 
+ void _init(void)
+diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h
+index bbf2acc9..1d8e721c 100644
+--- a/include/linux/netfilter/xt_connmark.h
+++ b/include/linux/netfilter/xt_connmark.h
+@@ -18,6 +18,11 @@ enum {
+ 	XT_CONNMARK_RESTORE
+ };
+ 
+enum {
+	XT_CONNMARK_VALUE	= (1 << 0),
+	XT_CONNMARK_DSCP	= (1 << 1)
+};
+
+ struct xt_connmark_tginfo1 {
+ 	__u32 ctmark, ctmask, nfmask;
+ 	__u8 mode;
+@@ -28,6 +33,11 @@ struct xt_connmark_tginfo2 {
+ 	__u8 shift_dir, shift_bits, mode;
+ };
+ 
+struct xt_connmark_tginfo3 {
+	__u32 ctmark, ctmask, nfmask;
+	__u8 shift_dir, shift_bits, mode, func;
+};
+
+ struct xt_connmark_mtinfo1 {
+ 	__u32 mark, mask;
+ 	__u8 invert;
+-- 
+2.21.0 (Apple Git-122.2)
+
--- a/package/network/utils/iwinfo/Makefile
+++ b/package/network/utils/iwinfo/Makefile
@ -11,9 +11,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/iwinfo.git
-PKG_SOURCE_DATE:=2019-09-22
-PKG_SOURCE_VERSION:=313e82709ba90f3a966f0dd348bcad007ca316be
-PKG_MIRROR_HASH:=9d81fbc867eadb91ae6045aef334146c3928c0d353e4aa271f83b55bfa37999d
+PKG_SOURCE_DATE:=2020-03-22
+PKG_SOURCE_VERSION:=9f5a7c4f9b78cb2de8fe5dd7af55bf0221706402
+PKG_MIRROR_HASH:=d62cae4b3d2f65c189f179c3dabf1c8c244c5de801439c483ea87dcf8e85b476
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0

@ -33,7 +33,7 @@ define Package/libiwinfo
  CATEGORY:=Libraries
  TITLE:=Generalized Wireless Information Library (iwinfo)
  DEPENDS:=+PACKAGE_kmod-cfg80211:libnl-tiny +libuci +libubus
-  ABI_VERSION:=20181126
+  ABI_VERSION:=20200105
 endef

 define Package/libiwinfo/description
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_SOURCE_DATE:=2019-05-30
-PKG_SOURCE_VERSION:=ade00ca585a49c8478bf60eb24ce385676be37a4
-PKG_MIRROR_HASH:=1417727ae6fcda01017e1bec3ec66e3e78116f9343cfe0256e40af54c52f2acc
+PKG_SOURCE_DATE:=2020-03-13
+PKG_SOURCE_VERSION:=77a6782d6e4eba2c49e642672de134aff443ef72
+PKG_MIRROR_HASH:=bb7e98a6b6f997a4fa2fb924be248febe5a7633601df2e97e7a7513c57b63870
 CMAKE_INSTALL:=1

 PKG_LICENSE:=GPL-2.0
@ -44,7 +44,7 @@ TARGET_LDFLAGS += -flto
 define Package/procd
  SECTION:=base
  CATEGORY:=Base system
-  DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus
+  DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus +libblobmsg-json +libjson-c
  TITLE:=OpenWrt system process manager
  USERID:=:dialout=20 :audio=29
 endef
@ -52,7 +52,7 @@ endef
 define Package/procd-ujail
  SECTION:=base
  CATEGORY:=Base system
-  DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libblobmsg-json
+  DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libubus +libblobmsg-json
  TITLE:=OpenWrt process jail helper
 endef

--- a/package/system/procd/files/hotplug.json
+++ b/package/system/procd/files/hotplug.json
@ -37,6 +37,10 @@
 					[ "load-firmware", "/lib/firmware" ],
 					[ "return" ]
 				]
+			],
+			[ "if",
+				[ "regex", "DEVNAME", "^ttyGS" ],
+				[ "start-console", "%DEVNAME%" ]
 			]
 		],
 		"remove" : [
--- a/package/system/procd/files/procd.sh
+++ b/package/system/procd/files/procd.sh
@ -49,6 +49,14 @@ procd_lock() {
 	local basescript=$(readlink "$initscript")
 	local service_name="$(basename ${basescript:-$initscript})"

+	flock -n 1000 &> /dev/null
+	if [ "$?" != "0" ]; then
+		exec 1000>"$IPKG_INSTROOT/var/lock/procd_${service_name}.lock"
+		flock 1000
+		if [ "$?" != "0" ]; then
+			logger "warning: procd flock for $service_name failed"
+		fi
+	fi
 }

 _procd_call() {
@ -186,6 +194,8 @@ _procd_add_jail() {
 		procfs)	json_add_boolean "procfs" "1";;
 		sysfs)	json_add_boolean "sysfs" "1";;
 		ronly)	json_add_boolean "ronly" "1";;
+		requirejail)	json_add_boolean "requirejail" "1";;
+		netns)	json_add_boolean "netns" "1";;
 		esac
 	done
 	json_add_object "mount"
@ -399,12 +409,12 @@ _procd_add_instance() {

 procd_running() {
 	local service="$1"
-	local instance="${2:-instance1}"
-	local running
+	local instance="${2:-*}"
+	[ "$instance" = "*" ] || instance="'$instance'"

 	json_init
 	json_add_string name "$service"
-	running=$(_procd_ubus_call list | jsonfilter -e "@.$service.instances.${instance}.running")
+	local running=$(_procd_ubus_call list | jsonfilter -l 1 -e "@['$service'].instances[$instance].running")

 	[ "$running" = "true" ]
 }
@ -435,6 +445,31 @@ _procd_send_signal() {
 	_procd_ubus_call signal
 }

+_procd_status() {
+	local service="$1"
+	local instance="$2"
+	local data
+
+	json_init
+	[ -n "$service" ] && json_add_string name "$service"
+
+	data=$(_procd_ubus_call list | jsonfilter -e '@["'"$service"'"]')
+	[ -z "$data" ] && { echo "inactive"; return 3; }
+
+	data=$(echo "$data" | jsonfilter -e '$.instances')
+	if [ -z "$data" ]; then
+		[ -z "$instance" ] && { echo "active with no instances"; return 0; }
+		data="[]"
+	fi
+
+	[ -n "$instance" ] && instance="\"$instance\"" || instance='*'
+	if [ -z "$(echo "$data" | jsonfilter -e '$['"$instance"']')" ]; then
+		echo "unknown instance $instance"; return 4
+	else
+		echo "running"; return 0
+	fi
+}
+
 procd_open_data() {
 	local name="$1"
 	json_set_namespace procd __procd_old_cb
--- a/target/linux/x86/image/Makefile
+++ b/target/linux/x86/image/Makefile
@ -227,7 +227,7 @@ endef
 ifneq ($(CONFIG_VDI_IMAGES),)
  define Image/Build/vdi
 	rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vdi || true
-	qemu-img convert -f raw -O vdi \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vdi \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vdi
 	# XXX: VBoxManage insists on setting perms to 0600
@ -235,7 +235,7 @@ ifneq ($(CONFIG_VDI_IMAGES),)
  endef
  define Image/Build/vdi_efi
 	rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vdi || true
-	qemu-img convert -f raw -O vdi \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vdi \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vdi
 	# XXX: VBoxManage insists on setting perms to 0600
@ -246,7 +246,7 @@ endif
 ifneq ($(CONFIG_VMDK_IMAGES),)
  define Image/Build/vmdk
 	rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vmdk || true
-	/usr/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vmdk
 	#build the ESXI VMDK with
@ -258,7 +258,7 @@ ifneq ($(CONFIG_VMDK_IMAGES),)
  endef
  define Image/Build/vmdk_efi
 	rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vmdk || true
-	/usr/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vmdk
  endef
@ -267,13 +267,13 @@ endif
 ifneq ($(CONFIG_VHD_IMAGES),)
  define Image/Build/vhd
 	rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vhdx || true
-	/usr/bin/qemu-img convert -O vhdx \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -O vhdx \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vhdx
  endef
  define Image/Build/vhd_efi
 	rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vhdx || true
-	/usr/bin/qemu-img convert -O vhdx \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -O vhdx \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vhdx
  endef
@ -282,13 +282,13 @@ endif
 ifneq ($(CONFIG_QCOW2_IMAGES),)
  define Image/Build/qcow2
 	rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2 || true
-	/usr/bin/qemu-img convert -f raw -O qcow2 \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O qcow2 \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2
  endef
  define Image/Build/qcow2_efi
 	rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2 || true
-	/usr/bin/qemu-img convert -f raw -O qcow2 \
+	$(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O qcow2 \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \
 		$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2
  endef