Merge Mainline

2020-08-07 19:44:17 +08:00 · 2020-08-07 19:44:17 +08:00 · b0e9557632
commit b0e9557632
parent 975b277c77 f76583a53a
40 changed files with 544 additions and 1787 deletions
--- a/config/Config-build.in
+++ b/config/Config-build.in
@ -93,6 +93,15 @@ menu "Global build settings"
 		help
 		  If enabled, config.seed will be stored in /etc/build.config of firmware.

+	config REPRODUCIBLE_DEBUG_INFO
+		bool "Make debug information reproducible"
+		default BUILDBOT
+		help
+		  This strips the local build path out of debug information. This has the
+		  advantage of making it reproducible, but the disadvantage of making local
+		  debugging using ./scripts/remote-gdb harder, since the debug data will
+		  no longer point to the full path on the build host.
+
 	config COLLECT_KERNEL_DEBUG
 		bool
 		prompt "Collect kernel debug information"
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@ -7,13 +7,13 @@ ifdef CONFIG_TESTING_KERNEL
 endif

 LINUX_VERSION-4.9 = .232
-LINUX_VERSION-4.14 = .192
-LINUX_VERSION-4.19 = .137
+LINUX_VERSION-4.14 = .193
+LINUX_VERSION-4.19 = .138
 LINUX_VERSION-5.4 = .57

 LINUX_KERNEL_HASH-4.9.232 = 58f472e82345dc719a1d6d7bae01e5aa73387cd83308acd2c92371f7d5bc4f60
-LINUX_KERNEL_HASH-4.14.192 = d2b5b0739f1559fc70146da50ff175b20a63e97e688a36dab16927d4ebd0f9d1
-LINUX_KERNEL_HASH-4.19.137 = 18f836dfe93fdfe267f07baaa7a239d3d6702fdad6b2866609c76e33c1486c59
+LINUX_KERNEL_HASH-4.14.193 = 0b0fb41d4430e1a42738b341cbfd2f41951aa5cd02acabbd53f076119c8b9f03
+LINUX_KERNEL_HASH-4.19.138 = d15c27d05f6c527269b75b30cc72972748e55720e7e00ad8abbaa4fe3b1d5e02
 LINUX_KERNEL_HASH-5.4.57 = 280d1bb8163c1f1c1a04e0ba2b85558cef2ab3c253c3fecd8fc680c3a6cd17ba

 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@ -114,6 +114,10 @@ $(eval $(call SetupHostCommand,grep,Please install GNU 'grep', \
 	ggrep --version 2>&1 | grep GNU, \
 	grep --version 2>&1 | grep GNU))

+$(eval $(call SetupHostCommand,egrep,Please install GNU 'grep', \
+	gegrep --version 2>&1 | grep GNU, \
+	egrep --version 2>&1 | grep GNU))
+
 $(eval $(call SetupHostCommand,getopt, \
 	Please install an extended getopt version that supports --long, \
 	gnugetopt -o t --long test -- --test | grep '^ *--test *--', \
--- a/package/ctcgfw/openwrt-v2ray-plugin/Makefile
+++ b/package/ctcgfw/openwrt-v2ray-plugin/Makefile
@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray-plugin
-PKG_VERSION:=1.3.4
+PKG_VERSION:=1.3.5
 PKG_RELEASE:=1

 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/teddysun/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=59f91575953e8289d0f6d007836eab169b8ee62e44b31b1a3eef61525db1e69c
+PKG_HASH:=46b3b9aec066df710f7ff27518c73c94ed63bbcdd6827e759da8627bf300a8d9

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/devel/binutils/Makefile
+++ b/package/devel/binutils/Makefile
@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=binutils
-PKG_VERSION:=2.27
+PKG_VERSION:=2.34
 PKG_RELEASE:=1

 PKG_SOURCE_URL:=@GNU/binutils
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_VERSION:=$(PKG_VERSION)
-PKG_HASH:=369737ce51587f92466041a97ab7d2358c6d9e1b6490b3940eb09fb0a9a6ac88
+PKG_HASH:=f00b0e8803dc9bab1e2165bd568528135be734df3fabf8d0161828cd56028952

 PKG_FIXUP:=autoreconf
 PKG_LIBTOOL_PATHS:=. gas bfd opcodes gprof binutils ld libiberty gold intl
@ -37,10 +37,17 @@ define Package/libbfd
  DEPENDS:=+zlib $(ICONV_DEPENDS) $(INTL_DEPENDS)
 endef

+define Package/libctf
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=libctf
+  DEPENDS:=+libbfd
+endef
+
 define Package/libopcodes
  SECTION:=libs
  CATEGORY:=Libraries
-  TITLE:=libbfd
+  TITLE:=libopcodes
  DEPENDS:=+libbfd
 endef

@ -56,7 +63,7 @@ define Package/objdump
  SECTION:=devel
  CATEGORY:=Development
  TITLE:=objdump
-  DEPENDS:=+libopcodes
+  DEPENDS:=+libopcodes +libctf
 endef

 define Package/ar
@ -94,7 +101,12 @@ endef

 define Package/libbfd/install
 	$(INSTALL_DIR) $(1)/usr/lib
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libbfd*.so $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libbfd*.so* $(1)/usr/lib/
+endef
+
+define Package/libctf/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libctf.so* $(1)/usr/lib/
 endef

 define Package/libopcodes/install
@ -121,6 +133,7 @@ define Package/binutils/install
 endef

 $(eval $(call BuildPackage,libbfd))
+$(eval $(call BuildPackage,libctf))
 $(eval $(call BuildPackage,libopcodes))
 $(eval $(call BuildPackage,binutils))
 $(eval $(call BuildPackage,objdump))
--- a/package/devel/binutils/patches/0001-Do-not-pass-host-compiler-sanitization-flags-on-to-l.patch
+++ b/package/devel/binutils/patches/0001-Do-not-pass-host-compiler-sanitization-flags-on-to-l.patch
@ -1,65 +0,0 @@
-From 183eb37e25d903ccd68cc2d8f8a37e75872c03d2 Mon Sep 17 00:00:00 2001
-From: Nick Clifton <nickc@redhat.com>
-Date: Tue, 6 Sep 2016 17:35:35 +0100
-Subject: [PATCH 1/2] Do not pass host compiler sanitization flags on to linker
- testsuite.
-
-	* Makefile.am (CFLAGS_FOR_TARGET): Define as a copy of CFLAGS but
-	without any sanitization options.
-	(CXXFLAGS_FOR_TARGET): Define as a copy of CXXFLAGS but	without
-	any sanitization options.
-	(check-DEJAGNU): Pass CFLAGS_FOR_TARGET and CXXFLAGS_FOR_TARGET
-	as CFLAGS and CXXFLAGS respectively.
---
- ld/Makefile.am | 8 ++++++--
- ld/Makefile.in | 8 ++++++--
- 2 files changed, 12 insertions(+), 4 deletions(-)
-
--- a/ld/Makefile.am
-+++ b/ld/Makefile.am
-@@ -136,6 +136,10 @@ CXX_FOR_TARGET = ` \
-     fi; \
-   fi`
- 
-+# Strip out sanitization options as we want to test building binaries without any extra paraphernalia
-+CFLAGS_FOR_TARGET = `echo $(CFLAGS) | sed -e 's/-fsanitize=address//g' -e 's/-fsanitize=undefined//g'`
-+CXXFLAGS_FOR_TARGET = `echo $(CXXFLAGS) | sed -e 's/-fsanitize=address//g' -e 's/-fsanitize=undefined//g'`
-+
- transform = s/^ld-new$$/$(installed_linker)/;@program_transform_name@
- bin_PROGRAMS = ld-new
- info_TEXINFOS = ld.texinfo
-@@ -2075,8 +2079,8 @@ check-DEJAGNU: site.exp
- 	runtest=$(RUNTEST); \
- 	if $(SHELL) -c "$$runtest --version" > /dev/null 2>&1; then \
- 	  $$runtest --tool $(DEJATOOL) --srcdir $${srcroot}/testsuite \
-		CC="$(CC_FOR_TARGET)" CFLAGS="$(CFLAGS)" \
-		CXX="$(CXX_FOR_TARGET)" CXXFLAGS="$(CXXFLAGS)" \
-+		CC="$(CC_FOR_TARGET)" CFLAGS="$(CFLAGS_FOR_TARGET)" \
-+		CXX="$(CXX_FOR_TARGET)" CXXFLAGS="$(CXXFLAGS_FOR_TARGET)" \
- 		CC_FOR_HOST="$(CC)" CFLAGS_FOR_HOST="$(CFLAGS)" \
- 		OFILES="$(OFILES)" BFDLIB="$(TESTBFDLIB)" \
- 		LIBIBERTY="$(LIBIBERTY) $(LIBINTL)" LIBS="$(LIBS)" \
--- a/ld/Makefile.in
-+++ b/ld/Makefile.in
-@@ -507,6 +507,10 @@ CXX_FOR_TARGET = ` \
-     fi; \
-   fi`
- 
-+
-+# Strip out sanitization options as they require special host libraries.
-+CFLAGS_FOR_TARGET = `echo $(CFLAGS) | sed -e 's/-fsanitize=address//g' -e 's/-fsanitize=undefined//g'`
-+CXXFLAGS_FOR_TARGET = `echo $(CXXFLAGS) | sed -e 's/-fsanitize=address//g' -e 's/-fsanitize=undefined//g'`
- info_TEXINFOS = ld.texinfo
- ld_TEXINFOS = configdoc.texi
- noinst_TEXINFOS = ldint.texinfo
-@@ -3644,8 +3648,8 @@ check-DEJAGNU: site.exp
- 	runtest=$(RUNTEST); \
- 	if $(SHELL) -c "$$runtest --version" > /dev/null 2>&1; then \
- 	  $$runtest --tool $(DEJATOOL) --srcdir $${srcroot}/testsuite \
-		CC="$(CC_FOR_TARGET)" CFLAGS="$(CFLAGS)" \
-		CXX="$(CXX_FOR_TARGET)" CXXFLAGS="$(CXXFLAGS)" \
-+		CC="$(CC_FOR_TARGET)" CFLAGS="$(CFLAGS_FOR_TARGET)" \
-+		CXX="$(CXX_FOR_TARGET)" CXXFLAGS="$(CXXFLAGS_FOR_TARGET)" \
- 		CC_FOR_HOST="$(CC)" CFLAGS_FOR_HOST="$(CFLAGS)" \
- 		OFILES="$(OFILES)" BFDLIB="$(TESTBFDLIB)" \
- 		LIBIBERTY="$(LIBIBERTY) $(LIBINTL)" LIBS="$(LIBS)" \
--- a/package/devel/binutils/patches/0002-When-building-target-binaries-ensure-that-the-warnin.patch
+++ b/package/devel/binutils/patches/0002-When-building-target-binaries-ensure-that-the-warnin.patch
--- a/package/lean/baidupcs-web/Makefile
+++ b/package/lean/baidupcs-web/Makefile
@ -30,7 +30,7 @@ endef
 STRIP:=true

 ifeq ($(ARCH),i386)
-	PKG_ARCH_BAIDUPCS-WEB:=86
+	PKG_ARCH_BAIDUPCS-WEB:=386
 endif

 ifeq ($(ARCH),x86_64)
--- a/package/lean/luci-app-ssr-plus/Makefile
+++ b/package/lean/luci-app-ssr-plus/Makefile
@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=180
-PKG_RELEASE:=2
+PKG_RELEASE:=3

 include $(INCLUDE_DIR)/package.mk

--- a/package/lean/luci-app-ssr-plus/root/etc/config/shadowsocksr
+++ b/package/lean/luci-app-ssr-plus/root/etc/config/shadowsocksr
@ -13,7 +13,7 @@ config global
 	option gfwlist_url 'https://cdn.jsdelivr.net/gh/Loukky/gfwlist-by-loukky/gfwlist.txt'
 	option chnroute_url 'https://ispip.clang.cn/all_cn.txt'
 	option nfip_url 'https://cdn.jsdelivr.net/gh/QiuSimons/Netflix_IP/getflix.txt'
-	option adblock_url 'https://gitee.com/privacy-protection-tools/anti-ad/raw/master/anti-ad-for-dnsmasq.conf'
+	option adblock_url 'https://anti-ad.net/anti-ad-for-dnsmasq.conf'
 	option threads '0'
 	option global_server 'disable'
 	option netflix_server 'nil'
--- a/package/lean/luci-app-ssr-plus/root/etc/ssr/china_ssr.txt
+++ b/package/lean/luci-app-ssr-plus/root/etc/ssr/china_ssr.txt
@ -3669,7 +3669,6 @@
 103.110.156.0/22
 103.110.188.0/22
 103.110.204.0/22
-103.111.38.0/23
 103.111.64.0/22
 103.111.172.0/22
 103.111.252.0/22
@ -4061,6 +4060,15 @@
 103.152.250.0/23
 103.153.4.0/23
 103.153.36.0/23
+103.153.98.0/23
+103.153.100.0/23
+103.153.114.0/23
+103.153.122.0/23
+103.153.128.0/23
+103.153.132.0/23
+103.153.138.0/23
+103.153.146.0/23
+103.153.160.0/23
 103.192.0.0/22
 103.192.4.0/22
 103.192.8.0/22
@ -4461,7 +4469,6 @@
 103.215.116.0/22
 103.215.120.0/22
 103.215.140.0/22
-103.215.184.0/22
 103.215.228.0/22
 103.216.4.0/22
 103.216.8.0/22
@ -5424,7 +5431,6 @@
 116.204.216.0/22
 116.204.232.0/22
 116.204.236.0/22
-116.204.244.0/22
 116.205.0.0/16
 116.206.92.0/22
 116.206.176.0/22
@ -6119,7 +6125,6 @@
 157.119.12.0/22
 157.119.16.0/22
 157.119.28.0/22
-157.119.68.0/22
 157.119.132.0/22
 157.119.136.0/22
 157.119.140.0/22
--- a/package/lean/luci-app-ssr-plus/root/etc/ssr/gfw_list.conf
+++ b/package/lean/luci-app-ssr-plus/root/etc/ssr/gfw_list.conf
@ -326,8 +326,6 @@ server=/airvpn.org/127.0.0.1#5335
 ipset=/airvpn.org/gfwlist
 server=/aisex.com/127.0.0.1#5335
 ipset=/aisex.com/gfwlist
-server=/aiss.anws.gov.tw/127.0.0.1#5335
-ipset=/aiss.anws.gov.tw/gfwlist
 server=/ait.org.tw/127.0.0.1#5335
 ipset=/ait.org.tw/gfwlist
 server=/aiweiwei.com/127.0.0.1#5335
@ -2064,8 +2062,6 @@ server=/data-vocabulary.org/127.0.0.1#5335
 ipset=/data-vocabulary.org/gfwlist
 server=/data.flurry.com/127.0.0.1#5335
 ipset=/data.flurry.com/gfwlist
-server=/data.gov.tw/127.0.0.1#5335
-ipset=/data.gov.tw/gfwlist
 server=/daum.net/127.0.0.1#5335
 ipset=/daum.net/gfwlist
 server=/david-kilgour.com/127.0.0.1#5335
@ -2560,8 +2556,6 @@ server=/entnt.com/127.0.0.1#5335
 ipset=/entnt.com/gfwlist
 server=/environment.google/127.0.0.1#5335
 ipset=/environment.google/gfwlist
-server=/epa.gov.tw/127.0.0.1#5335
-ipset=/epa.gov.tw/gfwlist
 server=/epac.to/127.0.0.1#5335
 ipset=/epac.to/gfwlist
 server=/episcopalchurch.org/127.0.0.1#5335
@ -2670,6 +2664,8 @@ server=/eurekavpt.com/127.0.0.1#5335
 ipset=/eurekavpt.com/gfwlist
 server=/euronews.com/127.0.0.1#5335
 ipset=/euronews.com/gfwlist
+server=/evchk.wikia.org/127.0.0.1#5335
+ipset=/evchk.wikia.org/gfwlist
 server=/evschool.net/127.0.0.1#5335
 ipset=/evschool.net/gfwlist
 server=/exblog.jp/127.0.0.1#5335
@ -2710,8 +2706,6 @@ server=/ezpeer.com/127.0.0.1#5335
 ipset=/ezpeer.com/gfwlist
 server=/ezua.com/127.0.0.1#5335
 ipset=/ezua.com/gfwlist
-server=/fa.gov.tw/127.0.0.1#5335
-ipset=/fa.gov.tw/gfwlist
 server=/facebook.br/127.0.0.1#5335
 ipset=/facebook.br/gfwlist
 server=/facebook.com/127.0.0.1#5335
@ -2876,8 +2870,6 @@ server=/fc2china.com/127.0.0.1#5335
 ipset=/fc2china.com/gfwlist
 server=/fc2cn.com/127.0.0.1#5335
 ipset=/fc2cn.com/gfwlist
-server=/fda.gov.tw/127.0.0.1#5335
-ipset=/fda.gov.tw/gfwlist
 server=/fdc64.de/127.0.0.1#5335
 ipset=/fdc64.de/gfwlist
 server=/fdc64.org/127.0.0.1#5335
@ -4186,6 +4178,8 @@ server=/hotshame.com/127.0.0.1#5335
 ipset=/hotshame.com/gfwlist
 server=/hotspotshield.com/127.0.0.1#5335
 ipset=/hotspotshield.com/gfwlist
+server=/hottg.com/127.0.0.1#5335
+ipset=/hottg.com/gfwlist
 server=/hotvpn.com/127.0.0.1#5335
 ipset=/hotvpn.com/gfwlist
 server=/hougaige.com/127.0.0.1#5335
@ -4194,8 +4188,6 @@ server=/howtoforge.com/127.0.0.1#5335
 ipset=/howtoforge.com/gfwlist
 server=/hoxx.com/127.0.0.1#5335
 ipset=/hoxx.com/gfwlist
-server=/hpa.gov.tw/127.0.0.1#5335
-ipset=/hpa.gov.tw/gfwlist
 server=/hqcdp.org/127.0.0.1#5335
 ipset=/hqcdp.org/gfwlist
 server=/hqjapanesesex.com/127.0.0.1#5335
@ -4464,8 +4456,6 @@ server=/imkev.com/127.0.0.1#5335
 ipset=/imkev.com/gfwlist
 server=/imlive.com/127.0.0.1#5335
 ipset=/imlive.com/gfwlist
-server=/immigration.gov.tw/127.0.0.1#5335
-ipset=/immigration.gov.tw/gfwlist
 server=/immoral.jp/127.0.0.1#5335
 ipset=/immoral.jp/gfwlist
 server=/impact.org.au/127.0.0.1#5335
@ -4610,8 +4600,6 @@ server=/isuntv.com/127.0.0.1#5335
 ipset=/isuntv.com/gfwlist
 server=/itaboo.info/127.0.0.1#5335
 ipset=/itaboo.info/gfwlist
-server=/itaiwan.gov.tw/127.0.0.1#5335
-ipset=/itaiwan.gov.tw/gfwlist
 server=/italiatibet.org/127.0.0.1#5335
 ipset=/italiatibet.org/gfwlist
 server=/itasoftware.com/127.0.0.1#5335
@ -5576,8 +5564,6 @@ server=/mixx.com/127.0.0.1#5335
 ipset=/mixx.com/gfwlist
 server=/mizzmona.com/127.0.0.1#5335
 ipset=/mizzmona.com/gfwlist
-server=/mjib.gov.tw/127.0.0.1#5335
-ipset=/mjib.gov.tw/gfwlist
 server=/mk5000.com/127.0.0.1#5335
 ipset=/mk5000.com/gfwlist
 server=/mlcool.com/127.0.0.1#5335
@ -5604,12 +5590,8 @@ server=/moby.to/127.0.0.1#5335
 ipset=/moby.to/gfwlist
 server=/mobypicture.com/127.0.0.1#5335
 ipset=/mobypicture.com/gfwlist
-server=/moeaic.gov.tw/127.0.0.1#5335
-ipset=/moeaic.gov.tw/gfwlist
 server=/moeerolibrary.com/127.0.0.1#5335
 ipset=/moeerolibrary.com/gfwlist
-server=/mofa.gov.tw/127.0.0.1#5335
-ipset=/mofa.gov.tw/gfwlist
 server=/mofaxiehui.com/127.0.0.1#5335
 ipset=/mofaxiehui.com/gfwlist
 server=/mofos.com/127.0.0.1#5335
@ -5622,8 +5604,6 @@ server=/mohu.ml/127.0.0.1#5335
 ipset=/mohu.ml/gfwlist
 server=/mojim.com/127.0.0.1#5335
 ipset=/mojim.com/gfwlist
-server=/mol.gov.tw/127.0.0.1#5335
-ipset=/mol.gov.tw/gfwlist
 server=/molihua.org/127.0.0.1#5335
 ipset=/molihua.org/gfwlist
 server=/mondex.org/127.0.0.1#5335
@ -5718,8 +5698,6 @@ server=/muzi.com/127.0.0.1#5335
 ipset=/muzi.com/gfwlist
 server=/muzi.net/127.0.0.1#5335
 ipset=/muzi.net/gfwlist
-server=/mvdis.gov.tw/127.0.0.1#5335
-ipset=/mvdis.gov.tw/gfwlist
 server=/mvg.jp/127.0.0.1#5335
 ipset=/mvg.jp/gfwlist
 server=/mx981.com/127.0.0.1#5335
@ -5852,8 +5830,6 @@ server=/naol.ca/127.0.0.1#5335
 ipset=/naol.ca/gfwlist
 server=/naol.cc/127.0.0.1#5335
 ipset=/naol.cc/gfwlist
-server=/nat.gov.tw/127.0.0.1#5335
-ipset=/nat.gov.tw/gfwlist
 server=/nat.moe/127.0.0.1#5335
 ipset=/nat.moe/gfwlist
 server=/national-lottery.co.uk/127.0.0.1#5335
@ -5994,8 +5970,6 @@ server=/ngensis.com/127.0.0.1#5335
 ipset=/ngensis.com/gfwlist
 server=/nhentai.net/127.0.0.1#5335
 ipset=/nhentai.net/gfwlist
-server=/nhi.gov.tw/127.0.0.1#5335
-ipset=/nhi.gov.tw/gfwlist
 server=/nhk-ondemand.jp/127.0.0.1#5335
 ipset=/nhk-ondemand.jp/gfwlist
 server=/nic.cz.cc/127.0.0.1#5335
@ -6070,8 +6044,6 @@ server=/noypf.com/127.0.0.1#5335
 ipset=/noypf.com/gfwlist
 server=/npa.go.jp/127.0.0.1#5335
 ipset=/npa.go.jp/gfwlist
-server=/npa.gov.tw/127.0.0.1#5335
-ipset=/npa.gov.tw/gfwlist
 server=/npnt.me/127.0.0.1#5335
 ipset=/npnt.me/gfwlist
 server=/nps.gov/127.0.0.1#5335
@ -6098,14 +6070,6 @@ server=/ns2.name/127.0.0.1#5335
 ipset=/ns2.name/gfwlist
 server=/ns3.name/127.0.0.1#5335
 ipset=/ns3.name/gfwlist
-server=/nsc.gov.tw/127.0.0.1#5335
-ipset=/nsc.gov.tw/gfwlist
-server=/ntbk.gov.tw/127.0.0.1#5335
-ipset=/ntbk.gov.tw/gfwlist
-server=/ntbna.gov.tw/127.0.0.1#5335
-ipset=/ntbna.gov.tw/gfwlist
-server=/ntbt.gov.tw/127.0.0.1#5335
-ipset=/ntbt.gov.tw/gfwlist
 server=/ntd.tv/127.0.0.1#5335
 ipset=/ntd.tv/gfwlist
 server=/ntdtv.ca/127.0.0.1#5335
@ -6122,8 +6086,6 @@ server=/ntdtvla.com/127.0.0.1#5335
 ipset=/ntdtvla.com/gfwlist
 server=/ntrfun.com/127.0.0.1#5335
 ipset=/ntrfun.com/gfwlist
-server=/ntsna.gov.tw/127.0.0.1#5335
-ipset=/ntsna.gov.tw/gfwlist
 server=/nubiles.net/127.0.0.1#5335
 ipset=/nubiles.net/gfwlist
 server=/nudezz.com/127.0.0.1#5335
@ -6434,8 +6396,6 @@ server=/pbxes.org/127.0.0.1#5335
 ipset=/pbxes.org/gfwlist
 server=/pcanywhere.net/127.0.0.1#5335
 ipset=/pcanywhere.net/gfwlist
-server=/pcc.gov.tw/127.0.0.1#5335
-ipset=/pcc.gov.tw/gfwlist
 server=/pcdvd.com.tw/127.0.0.1#5335
 ipset=/pcdvd.com.tw/gfwlist
 server=/pchome.com.tw/127.0.0.1#5335
@ -7744,8 +7704,6 @@ server=/startpage.com/127.0.0.1#5335
 ipset=/startpage.com/gfwlist
 server=/startuplivingchina.com/127.0.0.1#5335
 ipset=/startuplivingchina.com/gfwlist
-server=/stat.gov.tw/127.0.0.1#5335
-ipset=/stat.gov.tw/gfwlist
 server=/static-economist.com/127.0.0.1#5335
 ipset=/static-economist.com/gfwlist
 server=/static.shemalez.com/127.0.0.1#5335
@ -7922,8 +7880,6 @@ server=/taaze.tw/127.0.0.1#5335
 ipset=/taaze.tw/gfwlist
 server=/tabtter.jp/127.0.0.1#5335
 ipset=/tabtter.jp/gfwlist
-server=/tacc.cwb.gov.tw/127.0.0.1#5335
-ipset=/tacc.cwb.gov.tw/gfwlist
 server=/tacem.org/127.0.0.1#5335
 ipset=/tacem.org/gfwlist
 server=/taconet.com.tw/127.0.0.1#5335
@ -7938,8 +7894,6 @@ server=/tagwalk.com/127.0.0.1#5335
 ipset=/tagwalk.com/gfwlist
 server=/tahr.org.tw/127.0.0.1#5335
 ipset=/tahr.org.tw/gfwlist
-server=/taipei.gov.tw/127.0.0.1#5335
-ipset=/taipei.gov.tw/gfwlist
 server=/taipeisociety.org/127.0.0.1#5335
 ipset=/taipeisociety.org/gfwlist
 server=/taiwan-sex.com/127.0.0.1#5335
@ -7952,8 +7906,6 @@ server=/taiwandaily.net/127.0.0.1#5335
 ipset=/taiwandaily.net/gfwlist
 server=/taiwandc.org/127.0.0.1#5335
 ipset=/taiwandc.org/gfwlist
-server=/taiwanjobs.gov.tw/127.0.0.1#5335
-ipset=/taiwanjobs.gov.tw/gfwlist
 server=/taiwanjustice.com/127.0.0.1#5335
 ipset=/taiwanjustice.com/gfwlist
 server=/taiwanjustice.net/127.0.0.1#5335
@ -8064,10 +8016,6 @@ server=/techviz.net/127.0.0.1#5335
 ipset=/techviz.net/gfwlist
 server=/teck.in/127.0.0.1#5335
 ipset=/teck.in/gfwlist
-server=/teco-hk.org/127.0.0.1#5335
-ipset=/teco-hk.org/gfwlist
-server=/teco-mo.org/127.0.0.1#5335
-ipset=/teco-mo.org/gfwlist
 server=/teddysun.com/127.0.0.1#5335
 ipset=/teddysun.com/gfwlist
 server=/teeniefuck.net/127.0.0.1#5335
@ -8106,10 +8054,10 @@ server=/textnow.me/127.0.0.1#5335
 ipset=/textnow.me/gfwlist
 server=/tfhub.dev/127.0.0.1#5335
 ipset=/tfhub.dev/gfwlist
+server=/tgstat.com/127.0.0.1#5335
+ipset=/tgstat.com/gfwlist
 server=/thaicn.com/127.0.0.1#5335
 ipset=/thaicn.com/gfwlist
-server=/thb.gov.tw/127.0.0.1#5335
-ipset=/thb.gov.tw/gfwlist
 server=/theatrum-belli.com/127.0.0.1#5335
 ipset=/theatrum-belli.com/gfwlist
 server=/thebcomplex.com/127.0.0.1#5335
@ -8410,8 +8358,6 @@ server=/tinychat.com/127.0.0.1#5335
 ipset=/tinychat.com/gfwlist
 server=/tinypaste.com/127.0.0.1#5335
 ipset=/tinypaste.com/gfwlist
-server=/tipo.gov.tw/127.0.0.1#5335
-ipset=/tipo.gov.tw/gfwlist
 server=/tistory.com/127.0.0.1#5335
 ipset=/tistory.com/gfwlist
 server=/tkcs-collins.com/127.0.0.1#5335
@ -8534,6 +8480,8 @@ server=/traffichaus.com/127.0.0.1#5335
 ipset=/traffichaus.com/gfwlist
 server=/transparency.org/127.0.0.1#5335
 ipset=/transparency.org/gfwlist
+server=/travelinkcard.com/127.0.0.1#5335
+ipset=/travelinkcard.com/gfwlist
 server=/treemall.com.tw/127.0.0.1#5335
 ipset=/treemall.com.tw/gfwlist
 server=/trendsmap.com/127.0.0.1#5335
@ -9408,8 +9356,6 @@ server=/waveprotocol.org/127.0.0.1#5335
 ipset=/waveprotocol.org/gfwlist
 server=/waymo.com/127.0.0.1#5335
 ipset=/waymo.com/gfwlist
-server=/wda.gov.tw/127.0.0.1#5335
-ipset=/wda.gov.tw/gfwlist
 server=/wdf5.com/127.0.0.1#5335
 ipset=/wdf5.com/gfwlist
 server=/wearehairy.com/127.0.0.1#5335
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
@ -243,7 +243,9 @@ tp_rule() {
 		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -m set --match-set china dst \
 		-j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
 		;;
-	all) $ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01 ;;
+	all)
+		$ipt -A SS_SPEC_TPROXY -p udp $PROXY_PORTS -j TPROXY --on-port "$LOCAL_PORT" --tproxy-mark 0x01/0x01
+		;;
 	esac
 	$ipt -I PREROUTING 1 ${IFNAME:+-i $IFNAME} -p udp $EXT_ARGS $MATCH_SET \
 	-m comment --comment "$TAG" -j SS_SPEC_TPROXY
--- a/package/lean/v2ray/Makefile
+++ b/package/lean/v2ray/Makefile
@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray
-PKG_VERSION:=4.26.0
+PKG_VERSION:=4.27.0
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION)

 PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=233e5acaf69a612c130655fea21291ffcce81a52771310ef97871b641e5f29d6
+PKG_HASH:=5e1b0146953398a5422611b20f5e62c3a9c3efd62cd42295762f6f39d8eff31e

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/package/lienol/brook/Makefile
+++ b/package/lienol/brook/Makefile
@ -35,7 +35,7 @@ ifeq ($(ARCH),aarch64)
 endif

 PKG_NAME:=brook
-PKG_VERSION:=20200701
+PKG_VERSION:=20200801
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE:=brook$(PKG_ARCH_BROOK)
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=29
-PKG_DATE:=20200802
+PKG_RELEASE:=31
+PKG_DATE:=20200807

 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/api.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/api.lua
@ -43,6 +43,14 @@ function chmod_755(file)
    end
 end

+function get_customed_path(e)
+    return uci_get_type("global_app", e .. "_file")
+end
+
+function is_finded(e)
+    return luci.sys.exec('type -t -p "%s/%s" -p "/usr/bin/v2ray/%s" "%s"' % {get_customed_path(e), e, e, e}) ~= "" and true or false
+end
+
 function get_v2ray_path()
    local path = uci_get_type("global_app", "v2ray_file")
    return path .. "/v2ray"
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/global.lua
@ -1,18 +1,8 @@
 local o = require "luci.dispatcher"
-local sys = require "luci.sys"
-local ipkg = require("luci.model.ipkg")
 local uci = require"luci.model.uci".cursor()
-local _api = require "luci.model.cbi.passwall.api.api"
+local api = require "luci.model.cbi.passwall.api.api"
 local appname = "passwall"

-local function is_installed(e) return ipkg.installed(e) end
-
-local function is_finded(e)
-    return
-        sys.exec("find /usr/*bin -iname " .. e .. " -type f") ~= "" and true or
-            false
-end
-
 local nodes_table = {}
 uci:foreach(appname, "nodes", function(e)
    if e.type and e.remarks then
@ -127,20 +117,19 @@ o:value("210.2.4.8", "210.2.4.8 (CNNIC DNS)")
 o:value("180.76.76.76", "180.76.76.76 (" .. translate("Baidu") .. "DNS)")

 ---- DNS Forward Mode
-o = s:taboption("DNS", ListValue, "dns_mode", translate("DNS Mode"))
+o = s:taboption("DNS", Value, "dns_mode", translate("DNS Mode"))
 -- o.description = translate("if has problem, please try another mode.<br />if you use no patterns are used, DNS of wan will be used by default as upstream of dnsmasq.")
 o.rmempty = false
 o:reset_values()
-if is_finded("chinadns-ng") then
+if api.is_finded("chinadns-ng") then
    o:value("chinadns-ng", "ChinaDNS-NG")
 end
-if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then
+if api.is_finded("pdnsd") then
    o:value("pdnsd", "pdnsd")
 end
-if is_finded("dns2socks") then
+if api.is_finded("dns2socks") then
    o:value("dns2socks", "dns2socks")
 end
-o:value("local_7913", translate("Use local port 7913 as DNS"))
 o:value("nonuse", translate("No patterns are used"))

 ---- Upstream trust DNS Server for ChinaDNS-NG
@ -148,17 +137,17 @@ o = s:taboption("DNS", ListValue, "up_trust_chinadns_ng_dns",
             translate("Upstream trust DNS Server for ChinaDNS-NG") .. "(UDP)")
 -- o.description = translate("You can use other resolving DNS services as trusted DNS, Example: dns2socks, dns-forwarder... 127.0.0.1#5353<br />Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.")
 o.default = "pdnsd"
-if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then
+if api.is_finded("pdnsd") then
    o:value("pdnsd", "pdnsd + " .. translate("Use TCP Node Resolve DNS"))
 end
-if is_finded("dns2socks") then
+if api.is_finded("dns2socks") then
    o:value("dns2socks", "dns2socks")
 end
 o:value("udp", translate("Use UDP Node Resolve DNS"))
 o:depends("dns_mode", "chinadns-ng")

 ---- Use TCP Node Resolve DNS
--[[ if is_installed("pdnsd") or is_installed("pdnsd-alt") or is_finded("pdnsd") then
+--[[ if api.is_finded("pdnsd") then
    o = s:taboption("DNS", Flag, "use_tcp_node_resolve_dns", translate("Use TCP Node Resolve DNS"))
    o.description = translate("If checked, DNS is resolved using the TCP node.")
    o.default = 1
@ -247,7 +236,7 @@ s.anonymous = true
 s.addremove = true
 s.template = "cbi/tblsection"
 function s.create(e, t)
-    TypedSection.create(e, _api.gen_uuid())
+    TypedSection.create(e, api.gen_uuid())
 end

 o = s:option(DummyValue, "status", translate("Status"))
@ -266,6 +255,7 @@ end
 for k, v in pairs(nodes_table) do o:value(v.id, v.remarks) end

 o = s:option(Value, "port", translate("Listen Port"))
+o.default = 9050
 o.datatype = "port"
 o.rmempty = false

--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/node_config.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/node_config.lua
@ -1,20 +1,8 @@
 local d = require "luci.dispatcher"
-local ipkg = require("luci.model.ipkg")
 local uci = require"luci.model.uci".cursor()
 local api = require "luci.model.cbi.passwall.api.api"
-
 local appname = "passwall"

-local function get_customed_path(e)
-    return api.uci_get_type("global_app", e .. "_file")
-end
-
-local function is_finded(e)
-    return luci.sys.exec("find /usr/*bin %s -iname %s -type f" % {get_customed_path(e), e}) ~= "" and true or false
-end
-
-local function is_installed(e) return ipkg.installed(e) end
-
 local ss_encrypt_method_list = {
    "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr",
    "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb",
@ -82,25 +70,25 @@ remarks.default = translate("Remarks")
 remarks.rmempty = false

 type = s:option(ListValue, "type", translate("Type"))
-if is_installed("ipt2socks") or is_finded("ipt2socks") then
+if api.is_finded("ipt2socks") then
    type:value("Socks", translate("Socks"))
 end
-if is_finded("ss-redir") then
+if api.is_finded("ss-redir") then
    type:value("SS", translate("Shadowsocks"))
 end
-if is_finded("ssr-redir") then
+if api.is_finded("ssr-redir") then
    type:value("SSR", translate("ShadowsocksR"))
 end
-if is_installed("v2ray") or is_finded("v2ray") then
+if api.is_finded("v2ray") then
    type:value("V2ray", translate("V2ray"))
 end
-if is_installed("brook") or is_finded("brook") then
+if api.is_finded("brook") then
    type:value("Brook", translate("Brook"))
 end
-if is_installed("trojan-plus") or is_finded("trojan-plus") then
-    type:value("Trojan", translate("Trojan-Plus"))
+if api.is_finded("trojan-plus") or api.is_finded("trojan") then
+    type:value("Trojan-Plus", translate("Trojan-Plus"))
 end
-if is_installed("trojan-go") or is_finded("trojan-go") then
+if api.is_finded("trojan-go") then
    type:value("Trojan-Go", translate("Trojan-Go"))
 end

@ -166,7 +154,7 @@ address:depends({ type = "V2ray", protocol = "http" })
 address:depends({ type = "V2ray", protocol = "socks" })
 address:depends({ type = "V2ray", protocol = "shadowsocks" })
 address:depends("type", "Brook")
-address:depends("type", "Trojan")
+address:depends("type", "Trojan-Plus")
 address:depends("type", "Trojan-Go")

 --[[
@ -180,7 +168,7 @@ use_ipv6:depends({ type = "V2ray", protocol = "http" })
 use_ipv6:depends({ type = "V2ray", protocol = "socks" })
 use_ipv6:depends({ type = "V2ray", protocol = "shadowsocks" })
 use_ipv6:depends("type", "Brook")
-use_ipv6:depends("type", "Trojan")
+use_ipv6:depends("type", "Trojan-Plus")
 use_ipv6:depends("type", "Trojan-Go")
 --]]

@ -195,7 +183,7 @@ port:depends({ type = "V2ray", protocol = "http" })
 port:depends({ type = "V2ray", protocol = "socks" })
 port:depends({ type = "V2ray", protocol = "shadowsocks" })
 port:depends("type", "Brook")
-port:depends("type", "Trojan")
+port:depends("type", "Trojan-Plus")
 port:depends("type", "Trojan-Go")

 username = s:option(Value, "username", translate("Username"))
@ -209,7 +197,7 @@ password:depends("type", "Socks")
 password:depends("type", "SS")
 password:depends("type", "SSR")
 password:depends("type", "Brook")
-password:depends("type", "Trojan")
+password:depends("type", "Trojan-Plus")
 password:depends("type", "Trojan-Go")
 password:depends("protocol", "http")
 password:depends("protocol", "socks")
@ -260,13 +248,13 @@ tcp_fast_open:value("false")
 tcp_fast_open:value("true")
 tcp_fast_open:depends("type", "SS")
 tcp_fast_open:depends("type", "SSR")
-tcp_fast_open:depends("type", "Trojan")
+tcp_fast_open:depends("type", "Trojan-Plus")
 tcp_fast_open:depends("type", "Trojan-Go")

 ss_plugin = s:option(ListValue, "ss_plugin", translate("plugin"))
 ss_plugin:value("none", translate("none"))
-if is_finded("v2ray-plugin") then ss_plugin:value("v2ray-plugin") end
-if is_finded("obfs-local") then ss_plugin:value("obfs-local") end
+if api.is_finded("v2ray-plugin") then ss_plugin:value("v2ray-plugin") end
+if api.is_finded("obfs-local") then ss_plugin:value("obfs-local") end
 ss_plugin:depends("type", "SS")

 ss_plugin_opts = s:option(Value, "ss_plugin_opts", translate("opts"))
@ -310,7 +298,7 @@ stream_security.default = "tls"
 stream_security:depends("protocol", "vmess")
 stream_security:depends("protocol", "socks")
 stream_security:depends("protocol", "shadowsocks")
-stream_security:depends("type", "Trojan")
+stream_security:depends("type", "Trojan-Plus")
 stream_security:depends("type", "Trojan-Go")
 stream_security.validate = function(self, value)
    if value == "none" and type:formvalue(arg[1]) == "Trojan" then
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/app.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/app.lua
@ -79,7 +79,7 @@ local function start()
            elseif type == "V2ray" then
                config = require("luci.model.cbi.passwall.server.api.v2ray").gen_config(user)
                bin = ln_start(_api.get_v2ray_path(), "v2ray", "-config=" .. config_file)
-            elseif type == "Trojan" then
+            elseif type == "Trojan-Plus" then
                config = require("luci.model.cbi.passwall.server.api.trojan").gen_config(user)
                bin = ln_start("/usr/sbin/trojan-plus", "trojan-plus", "-c " .. config_file)
            elseif type == "Trojan-Go" then
@ -130,4 +130,4 @@ if action then
 	elseif action == "stop" then
        stop()
 	end
-end
+end
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua
@ -1,17 +1,7 @@
 local d = require "luci.dispatcher"
-local ipkg = require("luci.model.ipkg")
 local uci = require"luci.model.uci".cursor()
 local api = require "luci.model.cbi.passwall.api.api"

-local function is_finded(e)
-    local function get_customed_path(e)
-        return api.uci_get_type("global_app", e .. "_file")
-    end
-    return luci.sys.exec("find /usr/*bin %s -iname %s -type f" % {get_customed_path(e), e}) ~= "" and true or false
-end
-
-local function is_installed(e) return ipkg.installed(e) end
-
 local ssr_encrypt_method_list = {
    "none", "table", "rc2-cfb", "rc4", "rc4-md5", "rc4-md5-6", "aes-128-cfb",
    "aes-192-cfb", "aes-256-cfb", "aes-128-ctr", "aes-192-ctr", "aes-256-ctr",
@ -70,19 +60,19 @@ remarks.default = translate("Remarks")
 remarks.rmempty = false

 type = s:option(ListValue, "type", translate("Type"))
-if is_finded("ssr-server") then
+if api.is_finded("ssr-server") then
    type:value("SSR", translate("ShadowsocksR"))
 end
-if is_installed("v2ray") or is_finded("v2ray") then
+if api.is_finded("v2ray") then
    type:value("V2ray", translate("V2ray"))
 end
-if is_installed("brook") or is_finded("brook") then
+if api.is_finded("brook") then
    type:value("Brook", translate("Brook"))
 end
-if is_installed("trojan-plus") or is_finded("trojan-plus") then
-    type:value("Trojan", translate("Trojan-Plus"))
+if api.is_finded("trojan-plus") or api.is_finded("trojan") then
+    type:value("Trojan-Plus", translate("Trojan-Plus"))
 end
-if is_installed("trojan-go") or is_finded("trojan-go") then
+if api.is_finded("trojan-go") then
    type:value("Trojan-Go", translate("Trojan-Go"))
 end

@ -115,7 +105,7 @@ password = s:option(Value, "password", translate("Password"))
 password.password = true
 password:depends("type", "SSR")
 password:depends("type", "Brook")
-password:depends("type", "Trojan")
+password:depends("type", "Trojan-Plus")
 password:depends({ type = "V2ray", protocol = "http" })
 password:depends({ type = "V2ray", protocol = "socks" })
 password:depends({ type = "V2ray", protocol = "shadowsocks" })
@ -170,7 +160,7 @@ tcp_fast_open = s:option(ListValue, "tcp_fast_open", translate("TCP Fast Open"),
 tcp_fast_open:value("false")
 tcp_fast_open:value("true")
 tcp_fast_open:depends("type", "SSR")
-tcp_fast_open:depends("type", "Trojan")
+tcp_fast_open:depends("type", "Trojan-Plus")
 tcp_fast_open:depends("type", "Trojan-Go")

 udp_forward = s:option(Flag, "udp_forward", translate("UDP Forward"))
@ -203,7 +193,7 @@ stream_security:depends({ type = "V2ray", protocol = "vmess", transport = "ws" }
 stream_security:depends({ type = "V2ray", protocol = "vmess", transport = "h2" })
 stream_security:depends({ type = "V2ray", protocol = "socks" })
 stream_security:depends({ type = "V2ray", protocol = "shadowsocks" })
-stream_security:depends("type", "Trojan")
+stream_security:depends("type", "Trojan-Plus")
 stream_security:depends("type", "Trojan-Go")
 stream_security.validate = function(self, value)
    if value == "none" and type:formvalue(arg[1]) == "Trojan" then
@ -373,7 +363,7 @@ quic_guise:depends("transport", "quic")
 remote_enable = s:option(Flag, "remote_enable", translate("Enable Remote"), translate("You can forward to Nginx/Caddy/V2ray WebSocket and more."))
 remote_enable.default = "1"
 remote_enable.rmempty = false
-remote_enable:depends("type", "Trojan")
+remote_enable:depends("type", "Trojan-Plus")
 remote_enable:depends("type", "Trojan-Go")

 remote_address = s:option(Value, "remote_address", translate("Remote Address"))
--- a/package/lienol/luci-app-passwall/luasrc/view/passwall/global/status.htm
+++ b/package/lienol/luci-app-passwall/luasrc/view/passwall/global/status.htm
@ -1,15 +1,6 @@
 <%
-local api = require "luci.model.cbi.passwall.api.api"
 local dsp = require "luci.dispatcher"
-local ipkg = require "luci.model.ipkg"
-
-local function is_finded(e)
-	local result=luci.sys.exec("find /usr/*bin -iname "..e.." -type f")
-	if result~="" then
-		return true
-	end
-	return false
-end
+local api = require "luci.model.cbi.passwall.api.api"

 local tcp_node_num = api.uci_get_type("global_other", "tcp_node_num", 1)
 local udp_node_num = api.uci_get_type("global_other", "udp_node_num", 1)
--- a/package/lienol/luci-app-passwall/luasrc/view/passwall/global/status2.htm
+++ b/package/lienol/luci-app-passwall/luasrc/view/passwall/global/status2.htm
@ -1,15 +1,6 @@
 <%
-local api = require "luci.model.cbi.passwall.api.api"
 local dsp = require "luci.dispatcher"
-local ipkg = require "luci.model.ipkg"
-
-local function is_finded(e)
-	local result=luci.sys.exec("find /usr/*bin -iname "..e.." -type f")
-	if result~="" then
-		return true
-	end
-	return false
-end
+local api = require "luci.model.cbi.passwall.api.api"

 local tcp_node_num = api.uci_get_type("global_other", "tcp_node_num", 1)
 local udp_node_num = api.uci_get_type("global_other", "udp_node_num", 1)
@ -81,7 +72,7 @@ local status_show_ip111 = api.uci_get_type("global_other", "status_show_ip111",
 			</div>
 		</div>
 		
-		<% if ipkg.installed("kcptun") or is_finded("kcptun*") then %>
+		<% if api.is_finded("kcptun-client") then %>
 			<div class="cbi-value">
 				<label class="cbi-value-title">Kcptun
 					<%:Status%>
@ -92,7 +83,7 @@ local status_show_ip111 = api.uci_get_type("global_other", "status_show_ip111",
 			</div>
 		<% end %>
 		
-		<% if ipkg.installed("haproxy") or is_finded("haproxy*") then %>
+		<% if api.is_finded("haproxy") then %>
 		<div class="cbi-value">
 			<label class="cbi-value-title">
 				<%:Load Balancing%>
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@ -16,6 +16,10 @@ TMP_DNSMASQ_PATH=/var/etc/dnsmasq-passwall.d
 DNSMASQ_PATH=/etc/dnsmasq.d
 RESOLVFILE=/tmp/resolv.conf.d/resolv.conf.auto
 DNS_PORT=7913
+TUN_DNS="127.0.0.1#${DNS_PORT}"
+IS_DEFAULT_DNS=
+LOCAL_DNS=
+DEFAULT_DNS=
 NO_PROXY=
 LUA_API_PATH=/usr/lib/lua/luci/model/cbi/$CONFIG/api
 API_GEN_SS=$LUA_API_PATH/gen_shadowsocks.lua
@ -23,33 +27,22 @@ API_GEN_V2RAY=$LUA_API_PATH/gen_v2ray.lua
 API_GEN_TROJAN=$LUA_API_PATH/gen_trojan.lua
 echolog() {
 	local d="$(date "+%Y-%m-%d %H:%M:%S")"
-	echo -e "$d: $@" >>$LOG_FILE
-}
-
-find_bin() {
-	bin_name=$1
-	result=$(find /usr/*bin -iname "$bin_name" -type f)
-	if [ -z "$result" ]; then
-		echo "null"
-	else
-		echo "$result"
-	fi
+	echo -e "$d: $*" >>$LOG_FILE
 }

 config_n_get() {
-	local ret=$(uci -q get $CONFIG.$1.$2 2>/dev/null)
-	echo ${ret:=$3}
+	local ret=$(uci -q get "${CONFIG}.${1}.${2}" 2>/dev/null)
+	echo "${ret:=$3}"
 }

 config_t_get() {
-	local index=0
-	[ -n "$4" ] && index=$4
-	local ret=$(uci -q get $CONFIG.@$1[$index].$2 2>/dev/null)
-	echo ${ret:=$3}
+	local index=${4:-0}
+	local ret=$(uci -q get "${CONFIG}.@${1}[${index}].${2}" 2>/dev/null)
+	echo "${ret:=${3}}"
 }

 get_enabled_anonymous_secs() {
-	uci -q show $CONFIG | grep "${1}\[.*\.enabled='1'" | cut -d'.' -sf2
+	uci -q show "${CONFIG}" | grep "${1}\[.*\.enabled='1'" | cut -d'.' -sf2
 }

 get_host_ip() {
@ -100,6 +93,24 @@ get_ip_port_from() {
 	eval "${__ipv}=\"$val1\"; ${__portv}=\"$val2\""
 }

+host_from_url(){
+	local f=${1}
+
+	## Remove protocol part of url  ##
+	f="${f##http://}"
+	f="${f##https://}"
+	f="${f##ftp://}"
+	f="${f##sftp://}"
+
+	## Remove username and/or username:password part of URL  ##
+	f="${f##*:*@}"
+	f="${f##*@}"
+
+	## Remove rest of urls ##
+	f="${f%%/*}"
+	echo "${f%%:*}"
+}
+
 hosts_foreach() {
 	local __hosts
 	eval "__hosts=\$${1}"; shift 1
@ -139,6 +150,28 @@ get_last_dns() {
 	[ "${__first}" ==  "${__last}" ] || echo "${__last}"
 }

+gen_dnsmasq_items() {
+	local ipsetlist=${1}; shift 1
+	local fwd_dns=${1}; shift 1
+	local outf=${1}; shift 1
+
+	awk -v ipsetlist="${ipsetlist}" -v fwd_dns="${fwd_dns}" -v outf="${outf}" '
+		BEGIN {
+			if(outf == "") outf="/dev/stdout";
+			split(fwd_dns, dns, ","); setdns=length(dns)>0; setlist=length(ipsetlist)>0;
+			if(setdns) for(i in dns) if(length(dns[i])==0) delete dns[i];
+			fail=1;
+		}
+		! /^$/&&!/^#/ {
+			fail=0
+			if(! (setdns || setlist)) {printf("server=%s\n", $0) >>outf; next;}
+			if(setdns) for(i in dns) printf("server=/.%s/%s\n", $0, dns[i]) >>outf;
+			if(setlist) printf("ipset=/.%s/%s\n", $0, ipsetlist) >>outf;
+		}
+   END {fflush(outf); close(outf); exit(fail);}
+	'
+}
+
 check_port_exists() {
 	port=$1
 	protocol=$2
@ -173,22 +206,26 @@ get_new_port() {
 	fi
 }

+first_type() {
+	local path_name=${1}
+	type -t -p "/bin/${path_name}" -p "${TMP_BIN_PATH}/${path_name}" -p "${path_name}" -p "/usr/bin/v2ray/{path_name}" $@ | head -n1
+}
+
 ln_start_bin() {
-	local file=$1
-	[ "$file" != "null" ] && {
-		local bin=$2
-		shift 2
-		if [ -n "${TMP_BIN_PATH}/$bin" -a -f "${TMP_BIN_PATH}/$bin" ];then
-			${TMP_BIN_PATH}/$bin $@ >/dev/null 2>&1 &
-		else
-			if [ -n "$file" -a -f "$file" ];then
-				ln -s $file ${TMP_BIN_PATH}/$bin
-				${TMP_BIN_PATH}/$bin $@ >/dev/null 2>&1 &
-			else
-				echolog "找不到$bin主程序，无法启动！"
-			fi
-		fi
-	}
+	local file_func=${1}
+	local ln_name=${2}
+
+	shift 2;
+	if [  "${file_func%%/*}" != "${file_func}" ]; then
+		[ ! -L "${file_func}" ] && {
+			ln -s "${file_func}" "${TMP_BIN_PATH}/${ln_name}"
+			file_func="${TMP_BIN_PATH}/${ln_name}"
+		}
+		[ -x "${file_func}" ] || echolog "  - $(readlink ${file_func}) 没有执行权限，无法启动：${file_func} $@"
+	fi
+	echo "${file_func} $@" >&2
+	[ -n "${file_func}" ] || echolog "  - 找不到 ${ln_name}，无法启动..."
+	${file_func:-echolog "  - ${ln_name}"} $@ >/dev/null 2>&1 &
 }

 ENABLED=$(config_t_get global enabled 0)
@ -246,7 +283,7 @@ load_config() {
 	}
 	
 	DNS_MODE=$(config_t_get global dns_mode pdnsd)
-	DNS_FORWARD=$(config_t_get global dns_forward 8.8.4.4:53)
+	DNS_FORWARD=$(config_t_get global dns_forward 8.8.4.4:53 | sed 's/:/#/g')
 	DNS_CACHE=$(config_t_get global dns_cache 1)
 	use_tcp_node_resolve_dns=0
 	use_udp_node_resolve_dns=0
@ -256,25 +293,12 @@ load_config() {
 	else
 		process=$(config_t_get global_forwarding process)
 	fi
-	UP_CHINA_DNS=$(config_t_get global up_china_dns dnsbyisp)
-	[ "$UP_CHINA_DNS" == "default" ] && IS_DEFAULT_CHINA_DNS=1
-	[ ! -f "$RESOLVFILE" -o ! -s "$RESOLVFILE" ] && RESOLVFILE=/tmp/resolv.conf.auto
-	if [ "$UP_CHINA_DNS" == "dnsbyisp" -o "$UP_CHINA_DNS" == "default" ]; then
-		UP_CHINA_DNS1=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | grep -v 0.0.0.0 | grep -v 127.0.0.1 | sed -n '1P')
-		DEFAULT_DNS1="$UP_CHINA_DNS1"
-		[ -z "$UP_CHINA_DNS1" ] && UP_CHINA_DNS1="119.29.29.29"
-		UP_CHINA_DNS="$UP_CHINA_DNS1"
-		UP_CHINA_DNS2=$(cat $RESOLVFILE 2>/dev/null | grep -E -o "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | grep -v 0.0.0.0 | grep -v 127.0.0.1 | sed -n '2P')
-		[ -n "$UP_CHINA_DNS1" -a -n "$UP_CHINA_DNS2" ] && UP_CHINA_DNS="$UP_CHINA_DNS1,$UP_CHINA_DNS2"
-	else
-		UP_CHINA_DNS1=$(get_first_dns UP_CHINA_DNS 53)
-		if [ -n "$UP_CHINA_DNS1" ]; then
-			UP_CHINA_DNS2=$(get_last_dns UP_CHINA_DNS 53)
-			[ -n "$UP_CHINA_DNS2" ] && UP_CHINA_DNS="${UP_CHINA_DNS1},${UP_CHINA_DNS2}"
-		else
-			UP_CHINA_DNS1="119.29.29.29"
-			UP_CHINA_DNS=$UP_CHINA_DNS1
-		fi
+	LOCAL_DNS=$(config_t_get global up_china_dns dnsbyisp | sed 's/:/#/g')
+	[ -f "${RESOLVFILE}" ] && [ -s "${RESOLVFILE}" ] || RESOLVFILE=/tmp/resolv.conf.auto
+	DEFAULT_DNS=$(cat "${RESOLVFILE}" 2>/dev/null | sed -n 's/^nameserver[ \t]*\([^ ]*\)$/\1/p' | grep -v "0.0.0.0" | grep -v "127.0.0.1" | grep -v "^::$" | sed 's/\n/,/g')
+	if [ "${LOCAL_DNS}" = "default" ]; then
+		IS_DEFAULT_DNS=1
+		LOCAL_DNS="${DEFAULT_DNS:-119.29.29.29}"
 	fi
 	PROXY_IPV6=$(config_t_get global_forwarding proxy_ipv6 0)
 	mkdir -p /var/etc $TMP_PATH $TMP_BIN_PATH $TMP_ID_PATH $TMP_PORT_PATH
@ -294,7 +318,7 @@ run_socks() {

 	echolog "  - 启用 ${bind}:${local_port}"
 	if [ -n "$server_host" ] && [ -n "$port" ]; then
-		server_host=$(echo $server_host | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}')
+		server_host=$(host_from_url "$server_host")
 		[ -n "$(echo -n $server_host | awk '{print gensub(/[!-~]/,"","g",$0)}')" ] && msg="$remarks，非法的代理服务器地址，无法启动 ！"
 	else
 		msg="某种原因，此 Socks 服务的相关配置已失联，启动中止！"
@ -310,23 +334,26 @@ run_socks() {
 		echolog "  - 不能使用 Socks 类型的代理节点"
 	elif [ "$type" == "v2ray" ]; then
 		lua $API_GEN_V2RAY $node nil nil $local_port > $config_file
-		ln_start_bin $(config_t_get global_app v2ray_file $(find_bin v2ray))/v2ray v2ray "-config=$config_file"
+		ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray "-config=$config_file"
 	elif [ "$type" == "trojan" ]; then
 		lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
-		ln_start_bin $(find_bin trojan-plus) trojan-plus "-c $config_file"
+		ln_start_bin "$(first_type trojan)" trojan "-c $config_file"
+	elif [ "$type" == "trojan-plus" ]; then
+		lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
+		ln_start_bin "$(first_type trojan-plus trojan)" trojan-plus "-c $config_file"
 	elif [ "$type" == "trojan-go" ]; then
 		lua $API_GEN_TROJAN $node client $bind $local_port > $config_file
-		ln_start_bin $(config_t_get global_app trojan_go_file $(find_bin trojan-go)) trojan-go "-config $config_file"
+		ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go "-config $config_file"
 	elif [ "$type" == "brook" ]; then
 		local protocol=$(config_n_get $node brook_protocol client)
 		local brook_tls=$(config_n_get $node brook_tls 0)
 		[ "$protocol" == "wsclient" ] && {
 			[ "$brook_tls" == "1" ] && server_host="wss://${server_host}" || server_host="ws://${server_host}" 
 		}
-		ln_start_bin $(config_t_get global_app brook_file $(find_bin brook)) brook_socks_$5 "$protocol -l $bind:$local_port -i $$bind -s $server_host:$port -p $(config_n_get $node password)"
+		ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" brook_socks_$5 "$protocol -l $bind:$local_port -i $bind -s $server_host:$port -p $(config_n_get $node password)"
 	elif [ "$type" == "ssr" ] || [ "$type" == "ss" ]; then
 		lua $API_GEN_SS $node $local_port > $config_file
-		ln_start_bin $(find_bin ${type}-local) ${type}-local "-c $config_file -b $bind -u"
+		ln_start_bin "$(first_type ${type}-local)" ${type}-local "-c $config_file -b $bind -u"
 	fi
 }

@ -342,7 +369,7 @@ run_redir() {
 	local port=$(config_n_get $node port)
 	[ -n "$server_host" -a -n "$port" ] && {
 		# 判断节点服务器地址是否URL并去掉~
-		local server_host=$(echo $server_host | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}')
+		local server_host=$(host_from_url "$server_host")
 		# 判断节点服务器地址是否包含汉字~
 		local tmp=$(echo -n $server_host | awk '{print gensub(/[!-~]/,"","g",$0)}')
 		[ -n "$tmp" ] && {
@ -360,26 +387,29 @@ run_redir() {
 			local server_username=$(config_n_get $node username)
 			local server_password=$(config_n_get $node password)
 			eval port=\$UDP_REDIR_PORT$6
-			ln_start_bin $(find_bin ipt2socks) ipt2socks_udp_$6 "-U -l $port -b 0.0.0.0 -s $node_address -p $node_port -R"
+			ln_start_bin "$(first_type ipt2socks)" ipt2socks_udp_$6 "-U -l $port -b 0.0.0.0 -s $node_address -p $node_port -R"
 		elif [ "$type" == "v2ray" ]; then
 			lua $API_GEN_V2RAY $node udp $local_port nil > $config_file
-			ln_start_bin $(config_t_get global_app v2ray_file $(find_bin v2ray))/v2ray v2ray "-config=$config_file"
+			ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray "-config=$config_file"
 		elif [ "$type" == "trojan" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port >$config_file
-			ln_start_bin $(find_bin trojan-plus) trojan-plus "-c $config_file"
+			ln_start_bin "$(first_type trojan)" trojan "-c $config_file"
+		elif [ "$type" == "trojan-plus" ]; then
+			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port >$config_file
+			ln_start_bin "$(first_type trojan-plus trojan)" trojan-plus "-c $config_file"
 		elif [ "$type" == "trojan-go" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port >$config_file
-			ln_start_bin $(config_t_get global_app trojan_go_file $(find_bin trojan-go)) trojan-go "-config $config_file"
+			ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go "-config $config_file"
 		elif [ "$type" == "brook" ]; then
 			local protocol=$(config_n_get $node brook_protocol client)
 			if [ "$protocol" == "wsclient" ]; then
 				echolog "Brook的WebSocket不支持UDP转发！"
 			else
-				ln_start_bin $(config_t_get global_app brook_file $(find_bin brook)) brook_udp_$6 "tproxy -l 0.0.0.0:$local_port -s $server_host:$port -p $(config_n_get $node password)"
+				ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" brook_udp_$6 "tproxy -l 0.0.0.0:$local_port -s $server_host:$port -p $(config_n_get $node password)"
 			fi
 		elif [ "$type" == "ssr" ] || [ "$type" == "ss" ]; then
 			lua $API_GEN_SS $node $local_port > $config_file
-			ln_start_bin $(find_bin ${type}-redir) ${type}-redir "-c $config_file -U"
+			ln_start_bin "$(first_type ${type}-redir)" ${type}-redir "-c $config_file -U"
 		fi
 	fi

@ -392,20 +422,25 @@ run_redir() {
 			eval port=\$TCP_REDIR_PORT$6
 			local extra_param="-T"
 			[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && extra_param=""
-			ln_start_bin $(find_bin ipt2socks) ipt2socks_tcp_$6 "-l $port -b 0.0.0.0 -s $node_address -p $node_port -R $extra_param"
+			ln_start_bin "$(first_type ipt2socks)" ipt2socks_tcp_$6 "-l $port -b 0.0.0.0 -s $node_address -p $node_port -R $extra_param"
 		elif [ "$type" == "v2ray" ]; then
 			local extra_param="tcp"
 			[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && extra_param="tcp,udp"
 			lua $API_GEN_V2RAY $node $extra_param $local_port nil > $config_file
-			ln_start_bin $(config_t_get global_app v2ray_file $(find_bin v2ray))/v2ray v2ray "-config=$config_file"
+			ln_start_bin "$(first_type $(config_t_get global_app v2ray_file notset)/v2ray v2ray)" v2ray "-config=$config_file"
 		elif [ "$type" == "trojan" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port > $config_file
 			for k in $(seq 1 $process); do
-				ln_start_bin $(find_bin trojan-plus) trojan-plus "-c $config_file"
+				ln_start_bin "$(first_type trojan)" trojan "-c $config_file"
+			done
+		elif [ "$type" == "trojan-plus" ]; then
+			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port > $config_file
+			for k in $(seq 1 $process); do
+				ln_start_bin "$(first_type trojan-plus trojan)" trojan-plus "-c $config_file"
 			done
 		elif [ "$type" == "trojan-go" ]; then
 			lua $API_GEN_TROJAN $node nat "0.0.0.0" $local_port > $config_file
-			ln_start_bin $(config_t_get global_app trojan_go_file $(find_bin trojan-go)) trojan-go "-config $config_file"
+			ln_start_bin "$(first_type $(config_t_get global_app trojan_go_file notset) trojan-go)" trojan-go "-config $config_file"
 		else
 			local kcptun_use=$(config_n_get $node use_kcp 0)
 			if [ "$kcptun_use" == "1" ]; then
@ -421,7 +456,7 @@ run_redir() {
 					local run_kcptun_ip=$server_host
 					[ -n "$kcptun_server_host" ] && run_kcptun_ip=$(get_host_ip $network_type $kcptun_server_host)
 					KCPTUN_REDIR_PORT=$(get_new_port $KCPTUN_REDIR_PORT tcp)
-					ln_start_bin $(config_t_get global_app kcptun_client_file $(find_bin kcptun-client)) kcptun_tcp_$6 "-l 0.0.0.0:$KCPTUN_REDIR_PORT -r $run_kcptun_ip:$kcptun_port $kcptun_config"
+					ln_start_bin "$(first_type $(config_t_get global_app kcptun_client_file notset) kcptun-client)" kcptun_tcp_$6 "-l 0.0.0.0:$KCPTUN_REDIR_PORT -r $run_kcptun_ip:$kcptun_port $kcptun_config"
 				fi
 			fi
 			if [ "$type" == "ssr" ] || [ "$type" == "ss" ]; then
@ -433,7 +468,7 @@ run_redir() {
 					[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && extra_param="-u"
 				fi
 				for k in $(seq 1 $process); do
-					ln_start_bin $(find_bin ${type}-redir) ${type}-redir "-c $config_file $extra_param"
+					ln_start_bin "$(first_type ${type}-redir)" ${type}-redir "-c $config_file $extra_param"
 				done
 			elif [ "$type" == "brook" ]; then
 				local server_ip=$server_host
@ -442,9 +477,9 @@ run_redir() {
 				if [ "$protocol" == "wsclient" ]; then
 					[ "$brook_tls" == "1" ] && server_ip="wss://${server_ip}" || server_ip="ws://${server_ip}" 
 					socks_port=$(get_new_port 2081 tcp)
-					ln_start_bin $(config_t_get global_app brook_file $(find_bin brook)) brook_tcp_$6 "wsclient -l 127.0.0.1:$socks_port -i 127.0.0.1 -s $server_ip:$port -p $(config_n_get $node password)"
+					ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" brook_tcp_$6 "wsclient -l 127.0.0.1:$socks_port -i 127.0.0.1 -s $server_ip:$port -p $(config_n_get $node password)"
 					eval port=\$TCP_REDIR_PORT$6
-					ln_start_bin $(find_bin ipt2socks) ipt2socks_tcp_$6 "-T -l $port -b 0.0.0.0 -s 127.0.0.1 -p $socks_port -R"
+					ln_start_bin "$(first_type ipt2socks)" ipt2socks_tcp_$6 "-T -l $port -b 0.0.0.0 -s 127.0.0.1 -p $socks_port -R"
 					echolog "Brook的WebSocket不支持透明代理，将使用ipt2socks转换透明代理！"
 					[ "$6" == 1 ] && [ "$UDP_NODE1" == "tcp" ] && echolog "Brook的WebSocket不支持UDP转发！"
 				else
@ -452,7 +487,7 @@ run_redir() {
 						server_ip=127.0.0.1
 						port=$KCPTUN_REDIR_PORT
 					}
-					ln_start_bin $(config_t_get global_app brook_file $(find_bin brook)) brook_tcp_$6 "tproxy -l 0.0.0.0:$local_port -s $server_ip:$port -p $(config_n_get $node password)"
+					ln_start_bin "$(first_type $(config_t_get global_app brook_file notset) brook)" brook_tcp_$6 "tproxy -l 0.0.0.0:$local_port -s $server_ip:$port -p $(config_n_get $node password)"
 				fi
 			fi
 		fi
@ -592,12 +627,9 @@ start_dns() {
 	nonuse)
 		echolog "DNS：不使用，将会直接使用上级DNS！"
 	;;
-	local_7913)
-		echolog "DNS：使用本机7913端口DNS服务器解析域名..."
-	;;
 	dns2socks)
 		[ "$DNS_CACHE" == "0" ] && local _cache="/d"
-		ln_start_bin $(find_bin dns2socks) dns2socks "$DNS2SOCKS_SOCKS_SERVER $DNS2SOCKS_FORWARD 127.0.0.1:$DNS_PORT $_cache"
+		ln_start_bin "$(first_type dns2socks)" dns2socks "$DNS2SOCKS_SOCKS_SERVER $DNS2SOCKS_FORWARD 127.0.0.1:$DNS_PORT $_cache"
 		echolog "DNS：dns2socks，${DNS2SOCKS_FORWARD-D46.182.19.48:53}"
 	;;
 	pdnsd)
@ -606,13 +638,13 @@ start_dns() {
 			force_stop
 		else
 			gen_pdnsd_config $DNS_PORT
-			ln_start_bin $(find_bin pdnsd) pdnsd "--daemon -c $pdnsd_dir/pdnsd.conf -d"
+			ln_start_bin "$(first_type pdnsd)" pdnsd "--daemon -c $pdnsd_dir/pdnsd.conf -d"
 			echolog "DNS：pdnsd + 使用TCP节点解析DNS"
 		fi
 	;;
 	chinadns-ng)
-		local china_ng_chn=$(echo $UP_CHINA_DNS | sed 's/:/#/g')
-		local china_ng_gfw=$(echo $DNS_FORWARD | sed 's/:/#/g')
+		local china_ng_chn=${LOCAL_DNS}
+		local china_ng_gfw=${DNS_FORWARD}
 		other_port=$(expr $DNS_PORT + 1)
 		[ -f "$RULES_PATH/gfwlist.conf" ] && cat $RULES_PATH/gfwlist.conf | sort | uniq | sed -e '/127.0.0.1/d' | sed 's/ipset=\/.//g' | sed 's/\/gfwlist//g' > $TMP_PATH/gfwlist.txt
 		[ -f "$TMP_PATH/gfwlist.txt" ] && {
@ -639,88 +671,86 @@ start_dns() {
 				force_stop
 			else
 				gen_pdnsd_config $other_port
-				ln_start_bin $(find_bin pdnsd) pdnsd "--daemon -c $pdnsd_dir/pdnsd.conf -d"
-				ln_start_bin $(find_bin chinadns-ng) chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param $fair_mode"
+				ln_start_bin "$(first_type pdnsd)" pdnsd "--daemon -c $pdnsd_dir/pdnsd.conf -d"
+				ln_start_bin "$(first_type chinadns-ng)" chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param $fair_mode"
 				echolog "DNS：ChinaDNS-NG + pdnsd，$china_ng_gfw，国内DNS：$china_ng_chn"
 			fi
 		elif [ "$up_trust_chinadns_ng_dns" == "dns2socks" ]; then
 			[ "$DNS_CACHE" == "0" ] && local _cache="/d"
-			ln_start_bin $(find_bin dns2socks) dns2socks "$DNS2SOCKS_SOCKS_SERVER $DNS2SOCKS_FORWARD 127.0.0.1:$other_port $_cache"
-			ln_start_bin $(find_bin chinadns-ng) chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param $fair_mode"
+			ln_start_bin "$(first_type dns2socks)" dns2socks "$DNS2SOCKS_SOCKS_SERVER $DNS2SOCKS_FORWARD 127.0.0.1:$other_port $_cache"
+			ln_start_bin "$(first_type chinadns-ng)" chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t 127.0.0.1#$other_port $gfwlist_param $chnlist_param $fair_mode"
 			echolog "DNS：ChinaDNS-NG + dns2socks，${DNS2SOCKS_FORWARD:-D46.182.19.48:53}，国内DNS：$china_ng_chn"
 		elif [ "$up_trust_chinadns_ng_dns" == "udp" ]; then
 			use_udp_node_resolve_dns=1
-			ln_start_bin $(find_bin chinadns-ng) chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t $china_ng_gfw $gfwlist_param $chnlist_param $fair_mode"
+			ln_start_bin "$(first_type chinadns-ng)" chinadns-ng "-l $DNS_PORT -c $china_ng_chn -t $china_ng_gfw $gfwlist_param $chnlist_param $fair_mode"
 			echolog "DNS：ChinaDNS-NG，国内DNS：$china_ng_chn，可信DNS：$up_trust_chinadns_ng_dns，$china_ng_gfw"
 			echolog "  - 如非直连地址，请确保UDP节点已打开并且支持UDP转发。"
 		fi
 	;;
+	*)
+		TUN_DNS="$(echo ${DNS_MODE} | sed 's/:/#/g')"
+		DNS_MODE="other_dns"
+		echolog "可信DNS：指定DNS服务器(支持UDP查询)解析域名：${TUN_DNS}"
+	;;
 	esac
 }

 add_dnsmasq() {
-	local msg
+	local fwd_dns
 	echolog "准备 dnsmasq 配置文件..."
 	mkdir -p $TMP_DNSMASQ_PATH $DNSMASQ_PATH /var/dnsmasq.d
 	local adblock=$(config_t_get global_rules adblock 0)
 	local chinadns_mode=0
-	[ "$DNS_MODE" == "chinadns-ng" ] && [ "$IS_DEFAULT_CHINA_DNS" != 1 ] && chinadns_mode=1 && msg="chinadns-ng"
+	[ "$DNS_MODE" == "chinadns-ng" ] && [ "$IS_DEFAULT_DNS" != 1 ] && chinadns_mode=1
 	[ "$adblock" == "1" ] && {
-		msg="${msg}，adblock"
 		[ -f "$RULES_PATH/adblock.conf" -a -s "$RULES_PATH/adblock.conf" ] && ln -s $RULES_PATH/adblock.conf $TMP_DNSMASQ_PATH/adblock.conf
 	}
 	
 	[ "$DNS_MODE" != "nonuse" ] && {
-		msg="${msg}：$UP_CHINA_DNS1,$UP_CHINA_DNS2"
-		[ -f "$RULES_PATH/direct_host" -a -s "$RULES_PATH/direct_host" ] && cat $RULES_PATH/direct_host | sed -e "/^$/d" | sort -u | awk '{if (mode == 0 && dns1 != "") print "server=/."$1"/'$UP_CHINA_DNS1'"; if (mode == 0 && dns2 != "") print "server=/."$1"/'$UP_CHINA_DNS2'"; print "ipset=/."$1"/whitelist"}' mode=$chinadns_mode dns1=$UP_CHINA_DNS1 dns2=$UP_CHINA_DNS2 > $TMP_DNSMASQ_PATH/direct_host.conf
-		uci show $CONFIG | grep ".address=" | cut -d "'" -f 2 | sed 's/^\(https:\/\/\|http:\/\/\)//g' | awk -F '/' '{print $1}' | grep -v "google.c" | grep -E '.*\..*$' | grep '[a-zA-Z]$' | sort -u | awk '{if (dns1 != "") print "server=/."$1"/'$UP_CHINA_DNS1'"; if (dns2 != "") print "server=/."$1"/'$UP_CHINA_DNS2'"; print "ipset=/."$1"/vpsiplist"}' dns1=$UP_CHINA_DNS1 dns2=$UP_CHINA_DNS2 > $TMP_DNSMASQ_PATH/vpsiplist_host.conf
-		[ -f "$RULES_PATH/proxy_host" -a -s "$RULES_PATH/proxy_host" ] && cat $RULES_PATH/proxy_host | sed -e "/^$/d" | sort -u | awk '{if (mode == 0) print "server=/."$1"/127.0.0.1#'$DNS_PORT'"; print "ipset=/."$1"/blacklist"}' mode=$chinadns_mode > $TMP_DNSMASQ_PATH/proxy_host.conf
+		[ "${chinadns_mode}" = "0" ] && fwd_dns="${LOCAL_DNS}"
+		cat "${RULES_PATH}/direct_host" | sort -u | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf"
+		echolog "  - [$?]域名白名单(whitelist)：${fwd_dns:-默认}"
+
+		fwd_dns="${LOCAL_DNS}"
+		hosts_foreach "servers" host_from_url | grep -v "google.c" | grep '[a-zA-Z]$' | sort -u | gen_dnsmasq_items "vpsiplist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/vpsiplist_host.conf"
+		echolog "  - [$?]节点列表中的域名(vpsiplist)：${fwd_dns:-默认}"
+
+		unset fwd_dns
+		[ "${chinadns_mode}" = "0" ] && fwd_dns="127.0.0.1#${DNS_PORT}" && cat "${RULES_PATH}/proxy_host" | sort -u | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/proxy_host.conf"
+		echolog "  - [$?]代理域名表(blacklist)：${fwd_dns:-默认}"
+
 		if [ "$chinadns_mode" == 0 ]; then
 			[ -f "$RULES_PATH/gfwlist.conf" -a -s "$RULES_PATH/gfwlist.conf" ] && ln -s $RULES_PATH/gfwlist.conf $TMP_DNSMASQ_PATH/gfwlist.conf
 		else
 			cat $TMP_PATH/gfwlist.txt | sed -e "/^$/d" | sort -u | awk '{print "ipset=/."$1"/gfwlist"}' > $TMP_DNSMASQ_PATH/gfwlist.conf
 		fi
-		
-		subscribe_proxy=$(config_t_get global_subscribe subscribe_proxy 0)
-		[ "$subscribe_proxy" == "1" ] && {
+		echolog "  - [$?]防火墙域名表(gfwlist)：${fwd_dns:-默认}"
+
+		[ "$(config_t_get global_subscribe subscribe_proxy 0)" = "1" ] && {
 			local items=$(get_enabled_anonymous_secs "@subscribe_list")
-			[ -n "$items" ] && {
-				for item in ${items}; do
-					local url=$(config_n_get ${item} url)
-					[ -n "$url" ] && [ "$url" != "" ] && {
-						if [ -n "$(echo -n "$url" | grep "//")" ]; then
-							[ "$chinadns_mode" == 0 ] && echo -n "$url" | awk -F '/' '{print $3}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
-							echo -n "$url" | awk -F '/' '{print $3}' | sed "s/^/ipset=&\/./g" | sed "s/$/\/blacklist/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
-						else
-							[ "$chinadns_mode" == 0 ] && echo -n "$url" | awk -F '/' '{print $1}' | sed "s/^/server=&\/./g" | sed "s/$/\/127.0.0.1#$DNS_PORT/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
-							echo -n "$url" | awk -F '/' '{print $1}' | sed "s/^/ipset=&\/./g" | sed "s/$/\/blacklist/g" >>$TMP_DNSMASQ_PATH/subscribe.conf
-						fi
-					}
-				done
-			}
+			for item in ${items}; do
+				host_from_url "$(config_n_get ${item} url)" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/subscribe.conf"
+				echolog "  - [$?]节点订阅用域名，$(host_from_url $(config_n_get ${item} url))：${fwd_dns:-默认}"
+			done
 		}
 	}
-	echolog "  - ${msg}"
 	
-	if [ -z "$IS_DEFAULT_CHINA_DNS" ] || [ "$IS_DEFAULT_CHINA_DNS" == 0 ]; then
-		server="server=127.0.0.1#$DNS_PORT"
-		[ "$DNS_MODE" != "chinadns-ng" ] && {
-			[ -n "$UP_CHINA_DNS1" ] && server="server=$UP_CHINA_DNS1"
-			[ -n "$UP_CHINA_DNS2" ] && server="${server}\nserver=${UP_CHINA_DNS2}"
-		}
-		cat <<-EOF > /var/dnsmasq.d/dnsmasq-$CONFIG.conf
-			$(echo -e $server)
+	if [ "${IS_DEFAULT_DNS}" != "1" ]; then
+		servers="${TUN_DNS}"
+		[ "$DNS_MODE" != "chinadns-ng" ] && servers="${LOCAL_DNS}"
+		cat <<-EOF > "/var/dnsmasq.d/dnsmasq-${CONFIG}.conf"
+			$(echo "${servers}" | sed 's/,/\n/g' | gen_dnsmasq_items)
 			all-servers
 			no-poll
 			no-resolv
 		EOF
-		echolog "  - 默认DNS：${server}"
+		echolog "  - 默认DNS：${servers}"
 	else
-		[ -z "$DEFAULT_DNS1" ] && {
+		[ -z "${DEFAULT_DNS}" ] && {
 			local tmp=$(get_host_ip ipv4 www.baidu.com 1)
 			[ -z "$tmp" ] && {
 				cat <<-EOF > /var/dnsmasq.d/dnsmasq-$CONFIG.conf
-					server=$UP_CHINA_DNS1
+					server=$(get_first_dns LOCAL_DNS 53)
 					no-poll
 					no-resolv
 				EOF
@ -763,10 +793,10 @@ gen_pdnsd_config() {
 		}
 		
 	EOF
+		echolog "  - [$?]监听：127.0.0.1:${1}"

 	append_pdnsd_updns() {
 		[ -z "${2}" ] && echolog "  - 略过错误 : ${1}" && return 0
-		echolog "  - 上游DNS：${2}:${3}"
 		cat >> $pdnsd_dir/pdnsd.conf <<-EOF
 			server {
 				label = "node-${2}_${3}";
@ -781,6 +811,7 @@ gen_pdnsd_config() {
 				caching = $_cache;
 			}
 		EOF
+		echolog "  - [$?]上游DNS：${2}:${3}"
 	}
 	hosts_foreach DNS_FORWARD append_pdnsd_updns 53

@ -794,127 +825,124 @@ del_dnsmasq() {
 }

 start_haproxy() {
-	local haproxy_bin HAPROXY_PATH HAPROXY_FILE item lport sorted_items
-	[ "$(config_t_get global_haproxy balancing_enable 0)" == "1" ] && {
-		echolog "HAPROXY 负载均衡..."
-		haproxy_bin=$(find_bin haproxy)
-		[ -f "$haproxy_bin" ] && {
-			HAPROXY_PATH=$TMP_PATH/haproxy
-			mkdir -p $HAPROXY_PATH
-			HAPROXY_FILE=$HAPROXY_PATH/config.cfg
-			cat <<-EOF > $HAPROXY_FILE
-				global
-				    log         127.0.0.1 local2
-				    chroot      /usr/bin
-				    maxconn     60000
-				    stats socket  $HAPROXY_PATH/haproxy.sock
-				    user        root
-				    daemon
-					
-				defaults
-				    mode                    tcp
-				    log                     global
-				    option                  tcplog
-				    option                  dontlognull
-				    option http-server-close
-				    #option forwardfor       except 127.0.0.0/8
-				    option                  redispatch
-				    retries                 2
-				    timeout http-request    10s
-				    timeout queue           1m
-				    timeout connect         10s
-				    timeout client          1m
-				    timeout server          1m
-				    timeout http-keep-alive 10s
-				    timeout check           10s
-				    maxconn                 3000
-					
+	local haproxy_path haproxy_file item items lport sort_items
+
+	[ "$(config_t_get global_haproxy balancing_enable 0)" != "1" ] && return
+	echolog "HAPROXY 负载均衡..."
+
+	haproxy_path=${TMP_PATH}/haproxy
+	mkdir -p "${haproxy_path}"
+	haproxy_file=${haproxy_path}/config.cfg
+	cat <<-EOF > "${haproxy_file}"
+		global
+		    log         127.0.0.1 local2
+		    chroot      /usr/bin
+		    maxconn     60000
+		    stats socket  ${haproxy_path}/haproxy.sock
+		    user        root
+		    daemon
+
+		defaults
+		    mode                    tcp
+		    log                     global
+		    option                  tcplog
+		    option                  dontlognull
+		    option http-server-close
+		    #option forwardfor       except 127.0.0.0/8
+		    option                  redispatch
+		    retries                 2
+		    timeout http-request    10s
+		    timeout queue           1m
+		    timeout connect         10s
+		    timeout client          1m
+		    timeout server          1m
+		    timeout http-keep-alive 10s
+		    timeout check           10s
+		    maxconn                 3000
+
+	EOF
+			
+	items=$(get_enabled_anonymous_secs "@haproxy_config")
+	for item in $items; do
+		lport=$(config_n_get ${item} haproxy_port 0)
+		[ "${lport}" = "0" ] && echolog "  - 丢弃1个明显无效的节点" && continue
+		sort_items="${sort_items}${IFS}${lport} ${item}"
+	done
+
+	items=$(echo "${sort_items}" | sort -n | cut -d' ' -sf 2)
+
+	unset lport
+	local haproxy_port lbss lbort lbweight export backup
+	local msg bip bport bline bbackup failcount interface
+	for item in ${items}; do
+		unset haproxy_port lbort bbackup
+
+		eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
+		get_ip_port_from "$lbss" bip bport
+
+		[ "$lbort" = "default" ] && lbort=$bport || bport=$lbort
+		[ -z "$haproxy_port" ] || [ -z "$bip" ] || [ -z "$lbort" ] && echolog "  - 丢弃1个明显无效的节点" && continue
+		[ "$backup" = "1" ] && bbackup="backup"
+
+		[ "$lport" = "${haproxy_port}" ] || {
+			item="hasvalid"
+			lport=${haproxy_port}
+			echolog "  + 入口 0.0.0.0:${lport}..."
+			cat <<-EOF >> "${haproxy_file}"
+				listen $lport
+				    mode tcp
+				    bind 0.0.0.0:$lport
 			EOF
-			
-			items=$(get_enabled_anonymous_secs "@haproxy_config")
-			for item in $items; do
-				lport=$(config_n_get ${item} haproxy_port 0)
-				[ "${lport}" == "0" ] && echolog "  - 丢弃1个明显无效的节点" && continue
-				sorted_items="${sorted_items}${IFS}${lport} ${item}"
-			done
-
-			items=$(echo "${sorted_items}" | sort -n | cut -d' ' -sf 2)
-			
-			unset lport
-			[ -n "$items" ] && {
-				local haproxy_port lbss lbort lbweight export backup
-				local msg bip bport bline bbackup failcount interface
-				for item in ${items}; do
-					unset haproxy_port lbort bbackup
-
-					eval $(uci -q show $CONFIG.${item} | cut -d'.' -sf 3- | grep -v '^$')
-					get_ip_port_from "$lbss" bip bport
-					
-					[ "$lbort" == "default" ] && lbort=$bport || bport=$lbort
-					[ -z "$haproxy_port" ] || [ -z "$bip" ] || [ -z "$lbort" ] && echolog "  - 丢弃1个明显无效的节点" && continue
-					[ "$backup" = "1" ] && bbackup="backup"
-
-					[ "$lport" == "${haproxy_port}" ] || {
-						lport=${haproxy_port}
-						echolog "  - 入口 0.0.0.0:${lport}..."
-						cat <<-EOF >> $HAPROXY_FILE
-							listen $lport
-							    mode tcp
-							    bind 0.0.0.0:$lport
-						EOF
-					}
-					
-					cat <<-EOF >> $HAPROXY_FILE
-						    server $bip:$bport $bip:$bport weight $lbweight check inter 1500 rise 1 fall 3 $bbackup
-					EOF
-
-					if [ "$export" != "0" ]; then
-						unset msg
-						failcount=0
-						while [ "$failcount" -lt "3" ]; do
-							ubus list network.interface.${export} >/dev/null 2>&1
-							if [ $? -ne 0 ]; then
-								echolog "  - 找不到出口接口：$export，1分钟后再重试(${failcount}/3)，${bip}"
-								let "failcount++"
-								[ "$failcount" -ge 3 ] && exit 0
-								sleep 1m
-							else
-								route add -host ${bip} dev ${export}
-								msg="[$?] 从 ${export} 接口路由，"
-								echo "$bip" >>/tmp/balancing_ip
-								break
-							fi
-						done
-					fi
-					echolog "  - ${msg}出口节点：${bip}:${bport}，权重：${lbweight}"
-				done
-			}
-			
-			# 控制台配置
-			local console_port=$(config_t_get global_haproxy console_port)
-			local console_user=$(config_t_get global_haproxy console_user)
-			local console_password=$(config_t_get global_haproxy console_password)
-			local auth=""
-			[ -n "$console_user" -a -n "console_password" ] && auth="stats auth $console_user:$console_password"
-			cat <<-EOF >> $HAPROXY_FILE
-			
-				listen console
-				    bind 0.0.0.0:$console_port
-				    mode http                   
-				    stats refresh 30s
-				    stats uri /
-				    stats admin if TRUE
-				    $auth
-			EOF
-			
-			ln_start_bin $haproxy_bin haproxy "-f $HAPROXY_FILE"
-			echolog "  - 控制台端口：${console_port}/，${auth:-公开}"
 		}
-	}
+
+		cat <<-EOF >> "${haproxy_file}"
+			    server $bip:$bport $bip:$bport weight $lbweight check inter 1500 rise 1 fall 3 $bbackup
+		EOF
+
+		if [ "$export" != "0" ]; then
+			unset msg
+			failcount=0
+			while [ "$failcount" -lt "3" ]; do
+				ubus list network.interface.${export} >/dev/null 2>&1
+				if [ $? -ne 0 ]; then
+					let "failcount++"
+					echolog "  - 找不到出口接口：$export，1分钟后再重试(${failcount}/3)，${bip}"
+					[ "$failcount" -ge 3 ] && exit 0
+					sleep 1m
+				else
+					route add -host ${bip} dev ${export}
+					msg="[$?] 从 ${export} 接口路由，"
+					echo "$bip" >>/tmp/balancing_ip
+					break
+				fi
+			done
+		fi
+		echolog "  | - ${msg}出口节点：${bip}:${bport}，权重：${lbweight}"
+	done
+
+	# 控制台配置
+	local console_port=$(config_t_get global_haproxy console_port)
+	local console_user=$(config_t_get global_haproxy console_user)
+	local console_password=$(config_t_get global_haproxy console_password)
+	local auth=""
+	[ -n "$console_user" ] && [ -n "$console_password" ] && auth="stats auth $console_user:$console_password"
+	cat <<-EOF >> "${haproxy_file}"
+		listen console
+		    bind 0.0.0.0:$console_port
+		    mode http
+		    stats refresh 30s
+		    stats uri /
+		    stats admin if TRUE
+		    $auth
+	EOF
+
+	[ "${item}" == "hasvalid" ] && echolog "  - 没有发现任何有效节点信息..." && return 0
+	ln_start_bin "$(first_type haproxy)" haproxy -f "${haproxy_file}"
+	echolog "  * 控制台端口：${console_port}/，${auth:-公开}"
 }

 kill_all() {
-	kill -9 $(pidof $@) >/dev/null 2>&1 &
+	kill -9 $(pidof "$@") >/dev/null 2>&1 &
 }

 force_stop() {
@ -938,8 +966,8 @@ boot() {
 start() {
 	load_config
 	start_socks
+	start_haproxy
 	[ "$NO_PROXY" == 1 ] || {
-		start_haproxy
 		start_redir TCP tcp
 		start_redir UDP udp
 		start_dns
@ -991,4 +1019,4 @@ start)
 boot)
 	boot
 	;;
-esac
+esac
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=dnsmasq
 PKG_VERSION:=2.82
-PKG_RELEASE:=2
+PKG_RELEASE:=3

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@ -42,9 +42,13 @@ dnsmasq_ignore_opt() {
 		bootp-*|\
 		pxe-*)
 			[ -z "$dnsmasq_has_dhcp" ] ;;
-		dnssec-*|\
+		dnssec*|\
 		trust-anchor)
-			[ -z "$dnsmasq_has_dnssec" ] ;;
+			if [ -z "$dnsmasq_has_dnssec" ]; then
+				echo "dnsmasq: \"$opt\" requested, but dnssec support is not available" >&2
+				exit 1
+			fi
+			;;
 		tftp-*)
 			[ -z "$dnsmasq_has_tftp" ] ;;
 		ipset)
--- a/package/network/services/openvpn/Makefile
+++ b/package/network/services/openvpn/Makefile
@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=openvpn

 PKG_VERSION:=2.4.9
-PKG_RELEASE:=2
+PKG_RELEASE:=4

 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
@ -112,6 +112,7 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 		$(1)/etc/init.d \
 		$(1)/etc/config \
 		$(1)/etc/openvpn \
+		$(1)/lib/functions \
 		$(1)/lib/upgrade/keep.d \
 		$(1)/usr/libexec \
 		$(1)/etc/hotplug.d/openvpn
@ -128,6 +129,10 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 		files/usr/libexec/openvpn-hotplug \
 		$(1)/usr/libexec/openvpn-hotplug

+	$(INSTALL_DATA) \
+		files/lib/functions/openvpn.sh \
+		$(1)/lib/functions/openvpn.sh
+
 	$(INSTALL_DATA) \
 		files/etc/hotplug.d/openvpn/01-user \
 		$(1)/etc/hotplug.d/openvpn/01-user
--- a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
+++ b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
@ -1,17 +1,6 @@
 #!/bin/sh

-get_option() {
-	local variable="$1"
-	local option="$2"
-
-	local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
-	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
-	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
-	[ -n "$value" ] || return 1
-
-	export -n "$variable=$value"
-	return 0
-}
+. /lib/functions/openvpn.sh

 [ -e "/etc/openvpn.user" ] && {
 	env -i ACTION="$ACTION" INSTANCE="$INSTANCE" \
@ -23,8 +12,9 @@ get_option() {
 # Wrap user defined scripts on up/down events
 case "$ACTION" in
 	up|down)
-		if get_option command "$ACTION"; then
-			exec /bin/sh -c "$command $ACTION $INSTANCE $*"
+		if get_openvpn_option "$config" command "$ACTION"; then
+			shift
+			exec /bin/sh -c "$command $*"
 		fi
 	;;
 esac
--- a/package/network/services/openvpn/files/lib/functions/openvpn.sh
+++ b/package/network/services/openvpn/files/lib/functions/openvpn.sh
@ -0,0 +1,16 @@
+#!/bin/sh
+
+get_openvpn_option() {
+	local config="$1"
+	local variable="$2"
+	local option="$3"
+
+	local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || return 1
+
+	export -n "$variable=$value"
+	return 0
+}
+
--- a/package/network/services/openvpn/files/openvpn.config
+++ b/package/network/services/openvpn/files/openvpn.config
@ -77,10 +77,10 @@ config openvpn sample_server

 	# Diffie hellman parameters.
 	# Generate your own with:
-	#   openssl dhparam -out dh1024.pem 1024
+	#   openssl dhparam -out dh2048.pem 2048
 	# Substitute 2048 for 1024 if you are using
-	# 2048 bit keys.
-	option dh /etc/openvpn/dh1024.pem
+	# 1024 bit keys.
+	option dh /etc/openvpn/dh2048.pem

 	# Configure server mode and supply a VPN subnet
 	# for OpenVPN to draw client addresses from.
@ -228,10 +228,52 @@ config openvpn sample_server
 	# This file is secret:
 #	option tls_auth "/etc/openvpn/ta.key 0"

+	# For additional privacy, a shared secret key
+	# can be used for both authentication (as in tls_auth)
+	# and encryption of the TLS control channel.
+	#
+	# Generate a shared secret with:
+	# openvpn --genkey --secret ta.key
+	#
+	# The server and each client must have
+	# a copy of this key.
+	#
+	# tls_auth and tls_crypt should NOT
+	# be combined, as tls_crypt implies tls_auth.
+	# Use EITHER tls_crypt, tls_auth, or neither option.
+#	option tls_crypt "/etc/openvpn/ta.key"
+
+	# Set the minimum required TLS protocol version
+	# for all connections.
+	#
+	# Require at least TLS 1.1
+#	option tls_version_min "1.1"
+	# Require at least TLS 1.2
+#	option tls_version_min "1.2"
+	# Require TLS 1.2, or the highest version supported
+	# on the system
+#	option tls_version_min "1.2 'or-highest'"
+
+	# OpenVPN versions 2.4 and later will attempt to
+	# automatically negotiate the most secure cipher
+	# between the client and server, regardless of a
+	# configured "option cipher" (see below).
+	# Automatic negotiation is recommended.
+	#
+	# Uncomment this option to disable this behavior,
+	# and force all OpenVPN peers to use the configured
+	# cipher option instead (not recommended).
+#	option ncp_disable
+
 	# Select a cryptographic cipher.
 	# This config item must be copied to
 	# the client config file as well.
-	# Blowfish (default):
+	#
+	# To see all supported ciphers, run:
+	# openvpn --show-ciphers
+	#
+	# Blowfish (default for backwards compatibility,
+	# but not recommended due to weaknesses):
 #	option cipher BF-CBC
 	# AES:
 #	option cipher AES-128-CBC
@ -241,11 +283,16 @@ config openvpn sample_server
 	# Enable compression on the VPN link.
 	# If you enable it here, you must also
 	# enable it in the client config file.
+	#
+	# Compression is not recommended, as compression and
+	# encryption in combination can weaken the security
+	# of the connection.
+	#
 	# LZ4 requires OpenVPN 2.4+ client and server
 #	option compress lz4
 	# LZO is compatible with most OpenVPN versions
 	# (set "compress lzo" on 2.4+ clients, and "comp-lzo yes" on older clients)
-	option compress lzo
+#	option compress lzo

 	# The maximum number of concurrently connected
 	# clients we want to allow.
@ -371,7 +418,7 @@ config openvpn sample_client
 	option key /etc/openvpn/client.key

 	# Verify server certificate by checking
-	# that the certicate has the nsCertType
+	# that the certicate has the key usage
 	# field set to "server".  This is an
 	# important precaution to protect against
 	# a potential attack discussed here:
@ -381,12 +428,27 @@ config openvpn sample_client
 	# your server certificates with the nsCertType
 	# field set to "server".  The build_key_server
 	# script in the easy_rsa folder will do this.
-#	option ns_cert_type server
+#	option remote_cert_tls server

 	# If a tls_auth key is used on the server
 	# then every client must also have the key.
 #	option tls_auth "/etc/openvpn/ta.key 1"

+	# If a tls_crypt key is used on the server
+	# every client must also have the key.
+#	option tls_crypt "/etc/openvpn/ta.key"
+
+	# Set the minimum required TLS protocol version
+	# for all connections.
+	#
+	# Require at least TLS 1.1
+#	option tls_version_min "1.1"
+	# Require at least TLS 1.2
+#	option tls_version_min "1.2"
+	# Require TLS 1.2, or the highest version supported
+	# on the system
+#	option tls_version_min "1.2 'or-highest'"
+
 	# Select a cryptographic cipher.
 	# If the cipher option is used on the server
 	# then you must also specify it here.
@ -395,10 +457,15 @@ config openvpn sample_client
 	# Enable compression on the VPN link.
 	# Don't enable this unless it is also
 	# enabled in the server config file.
+	#
+	# Compression is not recommended, as compression and
+	# encryption in combination can weaken the security
+	# of the connection.
+	#
 	# LZ4 requires OpenVPN 2.4+ on server and client
 #	option compress lz4
 	# LZO is compatible with most OpenVPN versions
-	option compress lzo
+#	option compress lzo

 	# Set log file verbosity.
 	option verb 3
--- a/package/network/services/openvpn/files/openvpn.init
+++ b/package/network/services/openvpn/files/openvpn.init
@ -69,6 +69,40 @@ section_enabled() {
 	[ $enable -gt 0 ] || [ $enabled -gt 0 ]
 }

+openvpn_get_dev() {
+	local dev dev_type
+	local name="$1"
+	local conf="$2"
+
+	# Do override only for configurations with config_file
+	config_get config_file "$name" config
+	[ -n "$config_file" ] || return
+
+	# Check there is someething to override
+	config_get dev "$name" dev
+	config_get dev_type "$name" dev_type
+	[ -n "$dev" ] || return
+
+	# If there is a no dev_type, try to guess it
+	if [ -z "$dev_type" ]; then
+		. /lib/functions/openvpn.sh
+
+		local odev odev_type
+		get_openvpn_option "$conf" odev dev
+		get_openvpn_option "$conf" odev_type dev-type
+		[ -n "$odev_type" ] || odev_type="$odev"
+
+		case "$odev_type" in
+			tun*) dev_type="tun" ;;
+			tap*) dev_type="tap" ;;
+			*) return;;
+		esac
+	fi
+
+	# Return overrides
+	echo "--dev-type $dev_type --dev $dev"
+}
+
 openvpn_add_instance() {
 	local name="$1"
 	local dir="$2"
@ -83,7 +117,8 @@ openvpn_add_instance() {
 		--config "$conf" \
 		--up "/usr/libexec/openvpn-hotplug up $name" \
 		--down "/usr/libexec/openvpn-hotplug down $name" \
-		--script-security "${security:-2}"
+		--script-security "${security:-2}" \
+		$(openvpn_get_dev "$name" "$conf")
 	procd_set_param file "$dir/$conf"
 	procd_set_param term_timeout 15
 	procd_set_param respawn
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_SOURCE_DATE:=2020-07-30
-PKG_SOURCE_VERSION:=2ae5cbcf1d4509837a16eceafca374e9bf0ea850
-PKG_MIRROR_HASH:=479d4a4bfb71ef54300e7b669846e596db7792566302b4d29e3265643d89bce3
+PKG_SOURCE_DATE:=2020-08-06
+PKG_SOURCE_VERSION:=ab55357dfe5bd0edac0b9556a83e69814df791b1
+PKG_MIRROR_HASH:=38c882e105811bcd10b5ce55f91a16a647ed2ad436aec01cd03fda588b7bfca9
 CMAKE_INSTALL:=1

 PKG_LICENSE:=GPL-2.0
--- a/rules.mk
+++ b/rules.mk
@ -144,7 +144,7 @@ ifeq ($(or $(CONFIG_EXTERNAL_TOOLCHAIN),$(CONFIG_TARGET_uml)),)
  ifeq ($(CONFIG_GCC_USE_IREMAP),y)
    iremap = -iremap$(1):$(2)
  else
-    iremap = -ffile-prefix-map=$(1)=$(2)
+    iremap = -f$(if $(CONFIG_REPRODUCIBLE_DEBUG_INFO),file,macro)-prefix-map=$(1)=$(2)
  endif
 endif

--- a/target/linux/generic/pending-4.14/810-pci_disable_common_quirks.patch
+++ b/target/linux/generic/pending-4.14/810-pci_disable_common_quirks.patch
@ -32,7 +32,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 /* The Mellanox Tavor device gives false positive parity errors
  * Mark this device with a broken_parity_status, to allow
  * PCI scanning code to "skip" this now blacklisted device.
-@@ -3095,6 +3096,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+@@ -3108,6 +3109,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
 
@ -40,7 +40,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 /*
  * Ivytown NTB BAR sizes are misreported by the hardware due to an erratum.  To
-@@ -3151,6 +3153,8 @@ static void fixup_debug_report(struct pc
+@@ -3164,6 +3166,8 @@ static void fixup_debug_report(struct pc
 	}
 }
 
@ -49,7 +49,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 /*
  * Some BIOS implementations leave the Intel GPU interrupts enabled,
  * even though no one is handling them (f.e. i915 driver is never loaded).
-@@ -3189,6 +3193,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+@@ -3202,6 +3206,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
 
--- a/target/linux/ramips/dts/mt7628an_wiznet_wizfi630s.dts
+++ b/target/linux/ramips/dts/mt7628an_wiznet_wizfi630s.dts
@ -88,10 +88,6 @@
 	};
 };

-&wmac {
-	status = "okay";
-};
-
 &spi0 {
 	status = "okay";

@ -154,6 +150,7 @@

 &esw {
 	mediatek,portmap = <0x3e>;
+	mediatek,portdisable = <0x26>;
 };

 &sdhci {
--- a/target/linux/ramips/image/mt76x8.mk
+++ b/target/linux/ramips/image/mt76x8.mk
@ -539,6 +539,7 @@ define Device/wiznet_wizfi630s
  IMAGE_SIZE := 32448k
  DEVICE_VENDOR := WIZnet
  DEVICE_MODEL := WizFi630S
+  SUPPORTED_DEVICES += wizfi630s
 endef
 TARGET_DEVICES += wiznet_wizfi630s

--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@ -12,8 +12,8 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=6f3459f9859a7b506c64fa1823769ab631072c6e
-PKG_MIRROR_HASH:=01ed0c8131bdc32c9abd3aaaebc4fcffb2d496c2b8c363a0e845ac09d874a2ff
+PKG_SOURCE_VERSION:=6fdf971c9dbf7dac9bea552113fe4694015bbc4d
+PKG_MIRROR_HASH:=80998023c237bd0eaa38554e18536d8f66223e97fc5ade015a2d2aadf587d1f0
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz

--- a/tools/firmware-utils/Makefile
+++ b/tools/firmware-utils/Makefile
@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME := firmware-utils
-PKG_RELEASE := 1
+PKG_RELEASE := 2

 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/kernel.mk
--- a/tools/firmware-utils/src/addpattern.c
+++ b/tools/firmware-utils/src/addpattern.c
@ -296,7 +296,7 @@ int main(int argc, char **argv)
 		return EXIT_FAILURE;
 	}

-	ptm = localtime(&t);
+	ptm = gmtime(&t);

 	if (3 != sscanf(version, "v%d.%d.%d", &v0, &v1, &v2)) {
 		fprintf(stderr, "bad version string \"%s\"\n", version);
--- a/tools/firmware-utils/src/tplink-safeloader.c
+++ b/tools/firmware-utils/src/tplink-safeloader.c
@ -2035,7 +2035,7 @@ static struct image_partition_entry make_soft_version(uint32_t rev) {
 	else if (time(&t) == (time_t)(-1))
 		error(1, errno, "time");

-	struct tm *tm = localtime(&t);
+	struct tm *tm = gmtime(&t);

 	s->magic = htonl(0x0000000c);
 	s->zero = 0;