From be140e0f3ab95f35cb107948266b9abe55bb8a32 Mon Sep 17 00:00:00 2001
From: BlacK201 <31283228+BlacK201@users.noreply.github.com>
Date: Sun, 15 Nov 2020 09:10:37 +0800
Subject: [PATCH 01/30] vsftpd: use localtime by default

---
 package/lean/vsftpd-alt/files/vsftpd_prepare | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/lean/vsftpd-alt/files/vsftpd_prepare b/package/lean/vsftpd-alt/files/vsftpd_prepare
index 29169ab33c..612e90b5aa 100755
--- a/package/lean/vsftpd-alt/files/vsftpd_prepare
+++ b/package/lean/vsftpd-alt/files/vsftpd_prepare
@@ -253,5 +253,6 @@ else
 fi
 
 output_const "seccomp_sandbox" NO
+output_const "use_localtime" YES
 
 exit 0

From f00092526d222cac6e154cbd197173b876ec467a Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 14 Nov 2020 14:09:10 +0800
Subject: [PATCH 02/30] r8152: add package

---
 package/ctcgfw/r8152/Makefile                 | 52 +++++++++++++
 .../100-add-LED-configuration-from-OF.patch   | 74 +++++++++++++++++++
 2 files changed, 126 insertions(+)
 create mode 100644 package/ctcgfw/r8152/Makefile
 create mode 100644 package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch

diff --git a/package/ctcgfw/r8152/Makefile b/package/ctcgfw/r8152/Makefile
new file mode 100644
index 0000000000..396bfa526e
--- /dev/null
+++ b/package/ctcgfw/r8152/Makefile
@@ -0,0 +1,52 @@
+#Download realtek r8152 linux driver from official site [https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-usb-3-0-software]
+#Unpack source file
+#Replace orginal Makefile with this file
+#Put this source to 'package' folder of OpenWRT/LEDE SDK
+#Build(make menuconfig, make defconfig, make)
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=r8152
+PKG_VERSION:=2.14
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/wget/realtek-r8152-linux/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=617c159eb72355c240be3f78971e5a01c9dffe5545a7ae76bb2bd87bb7a346ed
+
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/realtek-$(PKG_NAME)-linux-$(PKG_VERSION)
+
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/usb-net-rtl8152-vendor
+  TITLE:=Kernel module for USB-to-Ethernet Realtek convertors
+  SUBMENU:=USB Support
+  VERSION:=$(LINUX_VERSION)+$(PKG_VERSION)-$(BOARD)-$(PKG_RELEASE)
+  DEPENDS:=+kmod-usb-net
+  CONFLICTS:=kmod-usb-net-rtl8152
+  FILES:= $(PKG_BUILD_DIR)/r8152.ko
+  AUTOLOAD:=$(call AutoProbe,r8152)
+endef
+
+define KernelPackage/usb-net-rtl8152-vendor/description
+ Kernel module for Realtek RTL8152/RTL8153 Based USB Ethernet Adapters
+endef
+
+R8152_MAKEOPTS= -C $(PKG_BUILD_DIR) \
+		PATH="$(TARGET_PATH)" \
+		ARCH="$(LINUX_KARCH)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		TARGET="$(HAL_TARGET)" \
+		TOOLPREFIX="$(KERNEL_CROSS)" \
+		TOOLPATH="$(KERNEL_CROSS)" \
+		KERNELPATH="$(LINUX_DIR)" \
+		KERNELDIR="$(LINUX_DIR)" \
+		LDOPTS=" " \
+		DOMULTI=1
+
+define Build/Compile
+	+$(MAKE) $(PKG_JOBS) $(R8152_MAKEOPTS) modules
+endef
+
+$(eval $(call KernelPackage,usb-net-rtl8152-vendor))
diff --git a/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch b/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch
new file mode 100644
index 0000000000..415a42a093
--- /dev/null
+++ b/package/ctcgfw/r8152/patches/100-add-LED-configuration-from-OF.patch
@@ -0,0 +1,74 @@
+From 82985725e071f2a5735052f18e109a32aeac3a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sun, 26 Jul 2020 02:38:31 +0200
+Subject: [PATCH] add LED configuration from OF
+
+This adds the ability to configure the LED configuration register using
+OF. This way, the correct value for board specific LED configuration can
+be determined.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ r8152.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/r8152.c
++++ b/r8152.c
+@@ -17,6 +17,7 @@
+ #include <linux/mii.h>
+ #include <linux/ethtool.h>
+ #include <linux/usb.h>
++#include <linux/of.h>
+ #include <linux/crc32.h>
+ #include <linux/if_vlan.h>
+ #include <linux/uaccess.h>
+@@ -9736,6 +9737,22 @@ static void rtl_tally_reset(struct r8152
+ 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
+ }
+ 
++static int r8152_led_configuration(struct r8152 *tp)
++{
++	u32 led_data;
++	int ret;
++
++	ret = of_property_read_u32(tp->udev->dev.of_node, "realtek,led-data",
++								&led_data);
++
++	if (ret)
++		return ret;
++	
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_LEDSEL, led_data);
++
++	return 0;
++}
++
+ static void r8152b_init(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+@@ -9797,6 +9814,8 @@ static void r8152b_init(struct r8152 *tp
+ 	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
+ 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153_init(struct r8152 *tp)
+@@ -9937,6 +9956,8 @@ static void r8153_init(struct r8152 *tp)
+ 		tp->coalesce = COALESCE_SLOW;
+ 		break;
+ 	}
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153b_init(struct r8152 *tp)
+@@ -10026,6 +10047,8 @@ static void r8153b_init(struct r8152 *tp
+ 	rtl_tally_reset(tp);
+ 
+ 	tp->coalesce = 15000;	/* 15 us */
++
++	r8152_led_configuration(tp);
+ }
+ 
+ static void r8153c_init(struct r8152 *tp)

From f073c03ff132f0144126be27bab3857447dea126 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 07:35:11 +0100
Subject: [PATCH 03/30] build: try to find getopt in macOS homebrew's standard
 location

It is not symlinked to /usr/local/bin by default

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 include/prereq-build.mk | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/prereq-build.mk b/include/prereq-build.mk
index f67a01299e..8181812599 100644
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@@ -125,7 +125,8 @@ $(eval $(call SetupHostCommand,egrep,Please install GNU 'grep', \
 $(eval $(call SetupHostCommand,getopt, \
 	Please install an extended getopt version that supports --long, \
 	gnugetopt -o t --long test -- --test | grep '^ *--test *--', \
-	getopt -o t --long test -- --test | grep '^ *--test *--'))
+	getopt -o t --long test -- --test | grep '^ *--test *--', \
+	/usr/local/opt/gnu-getopt/bin/getopt -o t --long test -- --test | grep '^ *--test *--'))
 
 $(eval $(call SetupHostCommand,stat,Cannot find a file stat utility, \
 	gnustat -c%s $(TOPDIR)/Makefile, \

From 3568c65a038cf45b7fc360509cf9e1bfdbe455f7 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 11:57:23 +0100
Subject: [PATCH 04/30] tools/fakeroot: fix build on macOS with recent Xcode
 versions

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 tools/fakeroot/patches/100-portability.patch | 22 +++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/tools/fakeroot/patches/100-portability.patch b/tools/fakeroot/patches/100-portability.patch
index 3835a7792b..5713c9e3fe 100644
--- a/tools/fakeroot/patches/100-portability.patch
+++ b/tools/fakeroot/patches/100-portability.patch
@@ -25,7 +25,7 @@
  #ifdef HAVE_SYS_ACL_H
  #include <sys/acl.h>
  #endif /* HAVE_SYS_ACL_H */
-@@ -1894,7 +1901,7 @@ ssize_t fremovexattr(int fd, const char
+@@ -1894,7 +1901,7 @@ ssize_t fremovexattr(int fd, const char 
  }
  #endif /* HAVE_FREMOVEXATTR */
  
@@ -110,3 +110,23 @@
      if(argname){
          print "static __inline__ " ret " next_" name, argtype " __attribute__((always_inline));" > tmpffile;
          print "static __inline__ " ret " next_" name, argtype " {" > tmpffile;
+--- a/configure.ac
++++ b/configure.ac
+@@ -110,6 +110,7 @@ for first in size_t int; do
+ #include <sys/types.h>
+ #endif
+ #include <unistd.h>
++#include <stdio.h>
+ #ifdef HAVE_GRP_H
+ #include <grp.h>
+ #endif
+--- a/configure
++++ b/configure
+@@ -12847,6 +12847,7 @@ for first in size_t int; do
+ #include <sys/types.h>
+ #endif
+ #include <unistd.h>
++#include <stdio.h>
+ #ifdef HAVE_GRP_H
+ #include <grp.h>
+ #endif

From de36f67e723eb030dee50809a2e98aa9cffd18eb Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 12:37:39 +0100
Subject: [PATCH 05/30] build: detect broken make version on macOS

Apple ships a broken make version with the Xcode command line tools.
Homebrew installs make as gmake by default in order to not collide with
Apple's version.
Exit with an error if the broken one is used accidentally

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 include/toplevel.mk | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/toplevel.mk b/include/toplevel.mk
index 84b5b6526c..6b51b51bf7 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -29,6 +29,12 @@ export GNU_HOST_NAME:=$(shell $(TOPDIR)/scripts/config.guess)
 export HOST_OS:=$(shell uname)
 export HOST_ARCH:=$(shell uname -m)
 
+ifeq ($(HOST_OS),Darwin)
+  ifneq ($(filter /Applications/Xcode.app/% /Library/Developer/%,$(MAKE)),)
+    $(error Please use a newer version of GNU make. The version shipped by Apple is not supported)
+  endif
+endif
+
 # prevent perforce from messing with the patch utility
 unexport P4PORT P4USER P4CONFIG P4CLIENT
 

From db08f106e21d3ab34256e5a0faf27f0ac8d4c6fe Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 12:47:39 +0100
Subject: [PATCH 06/30] tools/libelf: use autoreconf to fix build failure on
 macOS with recent Xcode versions

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 tools/libelf/Makefile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/libelf/Makefile b/tools/libelf/Makefile
index 9fec8308b5..726c4776bf 100644
--- a/tools/libelf/Makefile
+++ b/tools/libelf/Makefile
@@ -18,8 +18,12 @@ PKG_SOURCE_URL:= \
 	http://distcache.freebsd.org/ports-distfiles/
 HOST_BUILD_PARALLEL:=1
 
+HOST_FIXUP:=autoreconf
+
 include $(INCLUDE_DIR)/host-build.mk
 
+PKG_REMOVE_FILES :=
+
 HOST_CONFIGURE_ARGS += \
 	--disable-shared \
 	--enable-elf64

From 50f369c26d72c64f97c4e5f109842561e7839b62 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 12:52:58 +0100
Subject: [PATCH 07/30] tools/bc: use autoreconf to fix build failure on macOS
 with recent Xcode versions

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 tools/Makefile    | 2 +-
 tools/bc/Makefile | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/Makefile b/tools/Makefile
index 435161182e..f58de68dfd 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -43,7 +43,7 @@ tools-$(CONFIG_USE_SPARSE) += sparse
 $(curdir)/autoconf/compile := $(curdir)/m4/compile
 $(curdir)/automake/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/pkg-config/compile $(curdir)/xz/compile
 $(curdir)/b43-tools/compile := $(curdir)/bison/compile
-$(curdir)/bc/compile := $(curdir)/bison/compile
+$(curdir)/bc/compile := $(curdir)/bison/compile $(curdir)/libtool/compile
 $(curdir)/bison/compile := $(curdir)/flex/compile
 $(curdir)/cbootimage/compile += $(curdir)/automake/compile
 $(curdir)/cmake/compile += $(curdir)/libressl/compile
diff --git a/tools/bc/Makefile b/tools/bc/Makefile
index 3d505d6032..e5af713cf0 100644
--- a/tools/bc/Makefile
+++ b/tools/bc/Makefile
@@ -16,6 +16,8 @@ PKG_SOURCE_URL:=http://alpha.gnu.org/gnu/bc \
 	http://www.nic.funet.fi/pub/gnu/alpha/gnu/bc/
 PKG_HASH:=7ee4abbcfac03d8a6e1a8a3440558a3d239d6b858585063e745c760957725ecc
 
+PKG_FIXUP := autoreconf
+
 include $(INCLUDE_DIR)/host-build.mk
 
 $(eval $(call HostBuild))

From c1b5d6aa4d175785ee53a903686447eabf607887 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 14:33:23 +0100
Subject: [PATCH 08/30] libjson-c: enable rpath for host builds to fix errors
 on recent macOS

Same approach as on libubox

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 package/libs/libjson-c/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/package/libs/libjson-c/Makefile b/package/libs/libjson-c/Makefile
index c8a514a147..13cf955960 100644
--- a/package/libs/libjson-c/Makefile
+++ b/package/libs/libjson-c/Makefile
@@ -27,6 +27,11 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
 
+CMAKE_HOST_OPTIONS += \
+	-DCMAKE_SKIP_RPATH=FALSE \
+	-DCMAKE_MACOSX_RPATH=1 \
+	-DCMAKE_INSTALL_RPATH="${STAGING_DIR_HOST}/lib"
+
 define Package/libjson-c
   SECTION:=libs
   CATEGORY:=Libraries

From 3f1de692a3189abb9ae0fa742f8520247b031d54 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 14 Nov 2020 14:34:30 +0100
Subject: [PATCH 09/30] build: support cmake verbose for host builds

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 include/cmake.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/cmake.mk b/include/cmake.mk
index 12855982f6..77d85af1fa 100644
--- a/include/cmake.mk
+++ b/include/cmake.mk
@@ -4,6 +4,7 @@ PKG_INSTALL:=1
 
 ifneq ($(findstring c,$(OPENWRT_VERBOSE)),)
   MAKE_FLAGS+=VERBOSE=1
+  HOST_MAKE_FLAGS+=VERBOSE=1
 endif
 
 CMAKE_BINARY_DIR = $(PKG_BUILD_DIR)$(if $(CMAKE_BINARY_SUBDIR),/$(CMAKE_BINARY_SUBDIR))

From 2ba658832ff4f3f2424db4238aadeb63ce00ebc9 Mon Sep 17 00:00:00 2001
From: Rui Salvaterra <rsalvaterra@gmail.com>
Date: Thu, 5 Nov 2020 11:37:16 +0000
Subject: [PATCH 10/30] wireguard-tools: drop the dependency on ip-{tiny,full}

BusyBox ip already provides the required functionality and is enabled by default
in OpenWrt. This patch drops the ip dependency and makes the BusyBox ip required
dependencies explicit, allowing for a significant image size reduction.

openwrt-ath79-generic-ubnt_nanostation-loco-m-squashfs-sysupgrade.bin size:
4588354 bytes (with ip-tiny)
4457282 bytes (with BusyBox ip)

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
---
 package/network/utils/wireguard-tools/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile
index a5264a50b4..07258fde98 100644
--- a/package/network/utils/wireguard-tools/Makefile
+++ b/package/network/utils/wireguard-tools/Makefile
@@ -32,7 +32,7 @@ MAKE_VARS += PLATFORM=linux
 define Package/wireguard-tools
   $(call Package/wireguard/Default)
   TITLE:=WireGuard userspace control program (wg)
-  DEPENDS:=+ip
+  DEPENDS:=+@BUSYBOX_CONFIG_IP +@BUSYBOX_CONFIG_FEATURE_IP_LINK
 endef
 
 define Package/wireguard-tools/description

From 98e05d40bd2b94d4092eed075206ec193c2c2d32 Mon Sep 17 00:00:00 2001
From: Paul Spooren <mail@aparcar.org>
Date: Fri, 6 Nov 2020 09:54:20 -1000
Subject: [PATCH 11/30] bcm27xx: add bit variant to redundant RaspberryPi

Both bcm2709 and bcm2710 firmware can run on the same RaspberryPi
models, varying however in 32 and 64 Bit architectures. The model name
alone does not include the architecture information, which becomes
problematic if looking at a overview that only contains the names. By
adding a variant it is possible to tell the architecture.

Signed-off-by: Paul Spooren <mail@aparcar.org>
---
 target/linux/bcm27xx/image/Makefile | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/target/linux/bcm27xx/image/Makefile b/target/linux/bcm27xx/image/Makefile
index 421a89263d..a87392512b 100644
--- a/target/linux/bcm27xx/image/Makefile
+++ b/target/linux/bcm27xx/image/Makefile
@@ -86,7 +86,14 @@ ifeq ($(SUBTARGET),bcm2708)
 endif
 
 define Device/rpi-2
-  DEVICE_MODEL := 2B/3B/3B+/3CM/4B
+  DEVICE_MODEL := 2B/2B 1.2
+  DEVICE_VARIANT := (32bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 3B/3B+/3CM
+  DEVICE_ALT0_VARIANT := (32bit)
+  DEVICE_ALT1_VENDOR := Raspberry Pi
+  DEVICE_ALT1_MODEL := 4B
+  DEVICE_ALT1_VARIANT := (32bit)
   DEVICE_DTS := \
 	bcm2709-rpi-2-b bcm2710-rpi-2-b \
 	bcm2710-rpi-3-b bcm2710-rpi-3-b-plus \
@@ -112,7 +119,11 @@ ifeq ($(SUBTARGET),bcm2709)
 endif
 
 define Device/rpi-3
-  DEVICE_MODEL := 2B-1.2/3B/3B+/3CM
+  DEVICE_MODEL := 3B/3B+/3CM
+  DEVICE_VARIANT := (64bit)
+  DEVICE_ALT0_VENDOR := Raspberry Pi
+  DEVICE_ALT0_MODEL := 2B-1.2
+  DEVICE_ALT0_VARIANT := (64bit)
   KERNEL_IMG := kernel8.img
   DEVICE_DTS := \
 	broadcom/bcm2710-rpi-2-b \
@@ -136,6 +147,7 @@ endif
 
 define Device/rpi-4
   DEVICE_MODEL := 4B
+  DEVICE_VARIANT := (64bit)
   KERNEL_IMG := kernel8.img
   DEVICE_DTS := broadcom/bcm2711-rpi-4-b
   SUPPORTED_DEVICES := \

From 7014d885545161d1533c820241ef94c724cbb24d Mon Sep 17 00:00:00 2001
From: Hans Dedecker <dedeckeh@gmail.com>
Date: Sat, 14 Nov 2020 13:04:43 +0100
Subject: [PATCH 12/30] dropbear: update to 2.81

Update dropbear to latest stable 2.81; for the changes see https://matt.ucc.asn.au/dropbear/CHANGES

Refresh patches

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
---
 package/network/services/dropbear/Makefile                  | 6 +++---
 .../network/services/dropbear/patches/110-change_user.patch | 2 +-
 .../services/dropbear/patches/160-lto-jobserver.patch       | 4 ++--
 .../910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch       | 4 +---
 4 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 1ecca2feb1..8520426382 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2020.80
-PKG_RELEASE:=4
+PKG_VERSION:=2020.81
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	http://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_HASH:=d927941b91f2da150b2033f1a88b6a47999bf0afb1493a73e9216cffdb5d7949
+PKG_HASH:=48235d10b37775dbda59341ac0c4b239b82ad6318c31568b985730c788aac53b
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
index f66b319100..1dd67948af 100644
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@@ -1,6 +1,6 @@
 --- a/svr-chansession.c
 +++ b/svr-chansession.c
-@@ -950,12 +950,12 @@ static void execchild(const void *user_d
+@@ -954,12 +954,12 @@ static void execchild(const void *user_d
  	/* We can only change uid/gid as root ... */
  	if (getuid() == 0) {
  
diff --git a/package/network/services/dropbear/patches/160-lto-jobserver.patch b/package/network/services/dropbear/patches/160-lto-jobserver.patch
index dbba613ac3..1ba7dd6f44 100644
--- a/package/network/services/dropbear/patches/160-lto-jobserver.patch
+++ b/package/network/services/dropbear/patches/160-lto-jobserver.patch
@@ -1,6 +1,6 @@
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -199,17 +199,17 @@ dropbearkey: $(dropbearkeyobjs)
+@@ -198,17 +198,17 @@ dropbearkey: $(dropbearkeyobjs)
  dropbearconvert: $(dropbearconvertobjs)
  
  dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
@@ -22,7 +22,7 @@
  
  
  # multi-binary compilation.
-@@ -220,7 +220,7 @@ ifeq ($(MULTI),1)
+@@ -219,7 +219,7 @@ ifeq ($(MULTI),1)
  endif
  
  dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile
diff --git a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
index afa0ebb310..b774a38b1a 100644
--- a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
+++ b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch
@@ -19,11 +19,9 @@ Signed-off-by: Petr Štetiar <ynezz@true.cz>
  signkey.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
-diff --git a/signkey.c b/signkey.c
-index 92fe6a242cd0..d16ab174d83a 100644
 --- a/signkey.c
 +++ b/signkey.c
-@@ -657,8 +657,12 @@ int buf_verify(buffer * buf, sign_key *key, enum signature_type expect_sigtype,
+@@ -657,8 +657,12 @@ int buf_verify(buffer * buf, sign_key *k
  	sigtype = signature_type_from_name(type_name, type_name_len);
  	m_free(type_name);
  

From 9814880b1060c2164dbaebddf0c13731a876f10c Mon Sep 17 00:00:00 2001
From: Hans Dedecker <dedeckeh@gmail.com>
Date: Sun, 15 Nov 2020 18:44:40 +0100
Subject: [PATCH 13/30] odhcpd: update to latest git HEAD

fb55e80 dhcpv6-ia : write statefile atomically

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
---
 package/network/services/odhcpd/Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/network/services/odhcpd/Makefile b/package/network/services/odhcpd/Makefile
index 3f73141c44..9a4cd19bef 100644
--- a/package/network/services/odhcpd/Makefile
+++ b/package/network/services/odhcpd/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=odhcpd
-PKG_RELEASE:=4
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_SOURCE_DATE:=2020-11-01
-PKG_SOURCE_VERSION:=735c7836bfcc08f3ecd8cdaf1368665b8a241b94
-PKG_MIRROR_HASH:=887a2c07375dc5127b31edd71c281f48962d8a40e64995401baf648ed4c94b95
+PKG_SOURCE_DATE:=2020-11-15
+PKG_SOURCE_VERSION:=fb55e80394c51d7502bb278f57520dec15a11355
+PKG_MIRROR_HASH:=631d15fd7c93529fa33433380c4811dbacca9665864e5836c6daca0c7165f25a
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0

From e483a7a348bfaf9f38f6b51fd3d12abe94c91b8c Mon Sep 17 00:00:00 2001
From: Alberto Bursi <bobafetthotmail@gmail.com>
Date: Tue, 17 Nov 2020 08:58:40 +0100
Subject: [PATCH 14/30] wireguard-tools: fix category/description in menuconfig

wireguard-tools is trying to import the menuconfig section
from the wireguard package, but since it's not anymore in
the same makefile this seems to fail and wireguard-tools
ends up in "extra packages" category instead with other
odds and ends.

Same for the description, it's trying to import it from the
wireguard package but it fails so it only shows the line
written in this makefile.

remove the broken imports and add manually the entries
and description they were supposed to load

Fixes: ea980fb9c6de ("wireguard: bump to 20191226")

Signed-off-by: Alberto Bursi <bobafetthotmail@gmail.com>
[fix trailing whitespaces, add Fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
---
 package/network/utils/wireguard-tools/Makefile | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile
index 07258fde98..3cdbaa785c 100644
--- a/package/network/utils/wireguard-tools/Makefile
+++ b/package/network/utils/wireguard-tools/Makefile
@@ -30,13 +30,22 @@ MAKE_PATH:=src
 MAKE_VARS += PLATFORM=linux
 
 define Package/wireguard-tools
-  $(call Package/wireguard/Default)
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=VPN
+  URL:=https://www.wireguard.com
+  MAINTAINER:=Jason A. Donenfeld <Jason@zx2c4.com>
   TITLE:=WireGuard userspace control program (wg)
   DEPENDS:=+@BUSYBOX_CONFIG_IP +@BUSYBOX_CONFIG_FEATURE_IP_LINK
 endef
 
 define Package/wireguard-tools/description
-  $(call Package/wireguard/Default/description)
+  WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes
+  state-of-the-art cryptography. It aims to be faster, simpler, leaner, and
+  more useful than IPSec, while avoiding the massive headache. It intends to
+  be considerably more performant than OpenVPN.  WireGuard is designed as a
+  general purpose VPN for running on embedded interfaces and super computers
+  alike, fit for many different circumstances. It uses UDP.
 
   This package provides the userspace control program for WireGuard,
   `wg(8)`, a netifd protocol helper, and a re-resolve watchdog script.

From 9e1844bcb436101f3109f6085521b25d265ba189 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Mon, 16 Nov 2020 17:30:43 +0100
Subject: [PATCH 15/30] base-files: fix backwards compatiblity of rc.common
 EXTRA_COMMANDS

Avoid needlessly breaking old initscripts that set EXTRA_COMMANDS. This
will aid in debugging (as it simplifies reverting to an older version of
a package) and unbreaks third-party feeds (and packages that maintain
their OpenWrt initscripts as part of the software's repo instead of the
OpenWrt feed like fastd).

Without this, initscripts that set EXTRA_COMMANDS become completely
unusable, as all default commands like start/stop cease working.

Fixes: 1a69f50dc627 ("base-files: fix rc.common help alignment")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
---
 package/base-files/Makefile            |  2 +-
 package/base-files/files/etc/rc.common | 13 +++++++------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index b212b4cdeb..00efbea29f 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=211
+PKG_RELEASE:=212
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
diff --git a/package/base-files/files/etc/rc.common b/package/base-files/files/etc/rc.common
index d3d91ef250..f39b69464e 100755
--- a/package/base-files/files/etc/rc.common
+++ b/package/base-files/files/etc/rc.common
@@ -62,15 +62,15 @@ depends() {
 	return 0
 }
 
-EXTRA_HELP=""
-EXTRA_COMMANDS="boot shutdown depends"
+ALL_HELP=""
+ALL_COMMANDS="boot shutdown depends"
 extra_command() {
 	local cmd="$1"
 	local help="$2"
 
 	local extra="$(printf "%-16s%s" "${cmd}" "${help}")"
-	EXTRA_HELP="${EXTRA_HELP}\t${extra}\n"
-	EXTRA_COMMANDS="${EXTRA_COMMANDS} ${cmd}"
+	ALL_HELP="${ALL_HELP}\t${extra}\n"
+	ALL_COMMANDS="${ALL_COMMANDS} ${cmd}"
 }
 
 help() {
@@ -79,7 +79,7 @@ Syntax: $initscript [command]
 
 Available commands:
 EOF
-	echo -e "$EXTRA_HELP"
+	echo -e "$ALL_HELP"
 }
 
 # for procd
@@ -175,6 +175,7 @@ extra_command "enabled" "Check if service is started on boot"
 	}
 }
 
-ALL_COMMANDS="${EXTRA_COMMANDS}"
+ALL_COMMANDS="${ALL_COMMANDS} ${EXTRA_COMMANDS}"
+ALL_HELP="${ALL_HELP}${EXTRA_HELP}"
 list_contains ALL_COMMANDS "$action" || action=help
 $action "$@"

From 92b5d5dde1be62015148f84e38f9c8820d807f11 Mon Sep 17 00:00:00 2001
From: Hans Dedecker <dedeckeh@gmail.com>
Date: Sun, 15 Nov 2020 20:43:49 +0100
Subject: [PATCH 16/30] ethtool: update to version 5.9

The ipkg sizes changes as follows for mips 24kc :
	5.8 : ethtool_5.8-1_mips_24kc.ipk 34930
	5.9 : ethtool_5.9-1_mips_24kc.ipk 35241

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
---
 package/network/utils/ethtool/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/network/utils/ethtool/Makefile b/package/network/utils/ethtool/Makefile
index 6547eee9a5..df8d7ce119 100644
--- a/package/network/utils/ethtool/Makefile
+++ b/package/network/utils/ethtool/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ethtool
-PKG_VERSION:=5.8
+PKG_VERSION:=5.9
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
-PKG_HASH:=2f3b54d08d048f5977b80cb6cb4744994370def7553ee634d39dbbb6ccf87546
+PKG_HASH:=512932010af87bc3e09773c89baea44bca96c1da1151bbcf109fa0e055a88a6f
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING

From 69918175bb829c7525eb7b227d50d2705812191a Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 1 Nov 2020 00:17:36 +0100
Subject: [PATCH 17/30] iperf3: Update to version 3.9

No special changes, just get in sync with recent code.
See here for the changelog:
http://software.es.net/iperf/news.html#iperf-3-9-released

The ipkg sizes changes as follows for mips 24kc :
	3.7 : iperf3_3.7-1_mips_24kc.ipk 39675
	3.9 : iperf3_3.9-1_mips_24kc.ipk 41586

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/network/utils/iperf3/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/network/utils/iperf3/Makefile b/package/network/utils/iperf3/Makefile
index ab946c2590..6f90bc9221 100644
--- a/package/network/utils/iperf3/Makefile
+++ b/package/network/utils/iperf3/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iperf
-PKG_VERSION:=3.7
+PKG_VERSION:=3.9
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://downloads.es.net/pub/iperf
-PKG_HASH:=d846040224317caf2f75c843d309a950a7db23f9b44b94688ccbe557d6d1710c
+PKG_HASH:=24b63a26382325f759f11d421779a937b63ca1bc17c44587d2fcfedab60ac038
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause

From 1cd05a35396af042dea924f426da3f776804537c Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 1 Nov 2020 00:17:51 +0100
Subject: [PATCH 18/30] strace: Update to version 5.9

No special changes, just get in sync with recent code.
See here for the changelog:
https://github.com/strace/strace/releases/tag/v5.9

The ipkg sizes changes as follows for mips 24kc :
	5.8 : strace_5.8-1_mips_24kc.ipk 271195
	5.9 : strace_5.9-1_mips_24kc.ipk 278352

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/devel/strace/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/devel/strace/Makefile b/package/devel/strace/Makefile
index 1a0c0f442f..9ea28735a1 100644
--- a/package/devel/strace/Makefile
+++ b/package/devel/strace/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=strace
-PKG_VERSION:=5.8
+PKG_VERSION:=5.9
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://strace.io/files/$(PKG_VERSION)
-PKG_HASH:=df4a669f7fff9cc302784085bd4b72fab216a426a3f72c892b28a537b71e7aa9
+PKG_HASH:=39473eb8465546c3e940fb663cb381eba5613160c7302794699d194a4d5d66d9
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=LGPL-2.1-or-later

From e934fbcdbe6fb00ed213df966c88bf4e8c7beac9 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 1 Nov 2020 00:17:58 +0100
Subject: [PATCH 19/30] valgrind: Update to version 3.16.1

No special changes, just get in sync with recent code.
See here for the changelog:
https://valgrind.org/docs/manual/dist.news.html

The ipkg sizes changes as follows for mips 24kc :
	3.15   : valgrind_3.15.0-2_mips_24kc.ipk 1450680
	3.16.1 : valgrind_3.16.1-1_mips_24kc.ipk 1491954

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/devel/valgrind/Makefile                             | 6 +++---
 .../devel/valgrind/patches/100-fix_configure_check.patch    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/devel/valgrind/Makefile b/package/devel/valgrind/Makefile
index ecb4af8b35..829f37569e 100644
--- a/package/devel/valgrind/Makefile
+++ b/package/devel/valgrind/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=valgrind
-PKG_VERSION:=3.15.0
-PKG_RELEASE:=2
+PKG_VERSION:=3.16.1
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://sourceware.org/pub/valgrind/
-PKG_HASH:=417c7a9da8f60dd05698b3a7bc6002e4ef996f14c13f0ff96679a16873e78ab1
+PKG_HASH:=c91f3a2f7b02db0f3bc99479861656154d241d2fdb265614ba918cc6720a33ca
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0+
diff --git a/package/devel/valgrind/patches/100-fix_configure_check.patch b/package/devel/valgrind/patches/100-fix_configure_check.patch
index 270181ae37..6e9384ff88 100644
--- a/package/devel/valgrind/patches/100-fix_configure_check.patch
+++ b/package/devel/valgrind/patches/100-fix_configure_check.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -341,7 +341,7 @@ case "${host_os}" in
+@@ -345,7 +345,7 @@ case "${host_os}" in
          # Ok, this is linux. Check the kernel version
          AC_MSG_CHECKING([for the kernel version])
  

From e7234618b89e5d2be8de4a76bb48e52e0911a4bb Mon Sep 17 00:00:00 2001
From: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Date: Wed, 18 Nov 2020 21:38:59 +0100
Subject: [PATCH 20/30] scripts: checkpatch.pl: suppress warnings about
 MAINTAINERS

The kernel expects changes to MAINTAINERS for all removed or added
files, printing warnings like:

  WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
  #828:
  deleted file mode 100644

Since this does not apply to "our" files in OpenWrt repo, this
warning should be disabled.

This can be achieved easiest by setting $reported_maintainer_file
to 1. While this is a hack that tricks the script into believing
the proper MAINTAINERS changes have been made, it's the easiest
solution as it does not require to touch any other code.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 9da28baf35..8ffc093548 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2355,7 +2355,7 @@ sub process {
 	my $commit_log_possible_stack_dump = 0;
 	my $commit_log_long_line = 0;
 	my $commit_log_has_diff = 0;
-	my $reported_maintainer_file = 0;
+	my $reported_maintainer_file = 1;
 	my $non_utf8_charset = 0;
 
 	my $last_blank_line = 0;

From 94a8439922c3ea4be5dacdbe4a5aad6216618525 Mon Sep 17 00:00:00 2001
From: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Date: Wed, 18 Nov 2020 21:45:38 +0100
Subject: [PATCH 21/30] scripts: add const_structs.checkpatch for checkpatch.pl

Kernel has separated the structs that are reported to be const in
checkpatch.pl into a file of its own, const_structs.checkpatch.

This file has been missing after the recent update of checkpatch.pl,
leading to the following message:

  No structs that should be const will be found - file
  '/data/openwrt/scripts/const_structs.checkpatch': No such file
  or directory

This commit adds the relevant file from v5.10-rc4.

Fixes: 086ee09bbcac ("scripts: Update checkpatch.pl to 2020-06-11")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
---
 scripts/const_structs.checkpatch | 68 ++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 scripts/const_structs.checkpatch

diff --git a/scripts/const_structs.checkpatch b/scripts/const_structs.checkpatch
new file mode 100644
index 0000000000..1aae4f4fda
--- /dev/null
+++ b/scripts/const_structs.checkpatch
@@ -0,0 +1,68 @@
+acpi_dock_ops
+address_space_operations
+backlight_ops
+block_device_operations
+clk_ops
+comedi_lrange
+component_ops
+dentry_operations
+dev_pm_ops
+dma_map_ops
+driver_info
+drm_connector_funcs
+drm_encoder_funcs
+drm_encoder_helper_funcs
+ethtool_ops
+extent_io_ops
+file_lock_operations
+file_operations
+hv_ops
+ide_dma_ops
+ide_port_ops
+inode_operations
+intel_dvo_dev_ops
+irq_domain_ops
+item_operations
+iwl_cfg
+iwl_ops
+kgdb_arch
+kgdb_io
+kset_uevent_ops
+lock_manager_operations
+machine_desc
+microcode_ops
+mlxsw_reg_info
+mtrr_ops
+neigh_ops
+net_device_ops
+nlmsvc_binding
+nvkm_device_chip
+of_device_id
+pci_raw_ops
+phy_ops
+pinctrl_ops
+pinmux_ops
+pipe_buf_operations
+platform_hibernation_ops
+platform_suspend_ops
+proto_ops
+regmap_access_table
+regulator_ops
+rpc_pipe_ops
+rtc_class_ops
+sd_desc
+seq_operations
+sirfsoc_padmux
+snd_ac97_build_ops
+snd_soc_component_driver
+soc_pcmcia_socket_ops
+stacktrace_ops
+sysfs_ops
+tty_operations
+uart_ops
+usb_mon_operations
+v4l2_ctrl_ops
+v4l2_ioctl_ops
+vm_operations_struct
+wacom_features
+wd_ops

From e0b91dde06b736b187e6aa89d8b56ce0182a5106 Mon Sep 17 00:00:00 2001
From: Paul Spooren <mail@aparcar.org>
Date: Mon, 2 Nov 2020 12:15:05 -1000
Subject: [PATCH 22/30] imagebuilder: add package signature verification

The ImageBuilder downloads pre-built packages and adds them to images.
This process uses `opkg` which has the capability to verify package list
signatures via `usign`, as enabled per default on running OpenWrt
devices.

Until now this was disabled for ImageBuilders because neither the `opkg`
keys nor the `opkg-add` script was present during first packagelist
update.

To harden the ImageBuilder against *drive-by-download-attacks* both keys
and verification script are added to the ImageBuilder allowing `opkg` to
verify downloaded package indices.

This commit adds `opkg-add` to the ImageBuilder scripts folder. The keys
folder is added to ImageBuilder $TOPDIR to have an obvious place for users to
store their own keys. The `option check_signature` is appended to the
repositories.conf file. All of the above only happens if the Buildbot
runs with the SIGNATURE_CHECK option.

The keys stored in the ImageBuilder keys/ are the same as included in
the openwrt-keyring package. To avoid the chicken-egg problem of
downloading and verifying a package, containing signing keys, the keys
are added during the ImageBuilder generation. They are same as in
shipped images (stored at `/etc/opkg/keys/`).

To allow a local package feed in which the user can add additional
packages, a local set of `usign` and `ucert` keys is generated, same as
building OpenWrt from source. The private key signs the local repository
inside the packages/ folder. The local public key is added to the keys/
folder to be considered by `opkg` when updating repositories. This way a
local package feed can be modified while requiring `opkg` to check
signatures for remote feed, making HTTPS optional.

The new option `ADD_LOCAL_KEY` allows to add the local key inside the
created images, adding the advantage that sysupgrades can validate the
ImageBuilders local key.

Signed-off-by: Paul Spooren <mail@aparcar.org>
---
 target/imagebuilder/Makefile       |  8 ++++++++
 target/imagebuilder/files/Makefile | 33 ++++++++++++++++++++++++++++--
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index 5a4790ba5a..de8a67ef99 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -61,6 +61,14 @@ else
 		-exec $(CP) -t $(IB_LDIR)/ {} +
 endif
 
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+	echo ''                                                        >> $(PKG_BUILD_DIR)/repositories.conf
+	echo 'option check_signature'                                  >> $(PKG_BUILD_DIR)/repositories.conf
+	$(INSTALL_DIR) $(PKG_BUILD_DIR)/keys
+	$(CP) -L $(STAGING_DIR_ROOT)/etc/opkg/keys/ $(PKG_BUILD_DIR)/
+	$(CP) -L $(STAGING_DIR_ROOT)/usr/sbin/opkg-key $(PKG_BUILD_DIR)/scripts/
+endif
+
 	$(CP) $(TOPDIR)/target/linux $(PKG_BUILD_DIR)/target/
 	if [ -d $(TOPDIR)/staging_dir/host/lib/grub ]; then \
 		$(CP) $(TOPDIR)/staging_dir/host/lib/grub/ $(PKG_BUILD_DIR)/staging_dir/host/lib; \
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index fd7aa9190f..b3edf5bc9d 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -45,6 +45,7 @@ Building images:
 	make image FILES="<path>" # include extra files from <path>
 	make image BIN_DIR="<path>" # alternative output directory for the images
 	make image EXTRA_IMAGE_NAME="<string>" # Add this to the output image filename (sanitized)
+	make image ADD_LOCAL_KEY=1 # store locally generated signing key in built images
 
 Print manifest:
 	List "all" packages which get installed into the image.
@@ -63,8 +64,10 @@ help: FORCE
 # override variables from rules.mk
 PACKAGE_DIR:=$(TOPDIR)/packages
 LISTS_DIR:=$(subst $(space),/,$(patsubst %,..,$(subst /,$(space),$(TARGET_DIR))))$(DL_DIR)
+export OPKG_KEYS:=$(TOPDIR)/keys
 OPKG:=$(call opkg,$(TARGET_DIR)) \
 	-f $(TOPDIR)/repositories.conf \
+	--verify-program $(SCRIPT_DIR)/opkg-key \
 	--cache $(DL_DIR) \
 	--lists-dir $(LISTS_DIR)
 
@@ -129,7 +132,9 @@ package_index: FORCE
 	@echo Building package index... >&2
 	@mkdir -p $(TMP_DIR) $(TARGET_DIR)/tmp
 	(cd $(PACKAGE_DIR); $(SCRIPT_DIR)/ipkg-make-index.sh . > Packages && \
-		gzip -9nc Packages > Packages.gz \
+		gzip -9nc Packages > Packages.gz; \
+		$(if $(CONFIG_SIGNATURE_CHECK), \
+			$(STAGING_DIR_HOST)/bin/usign -S -m Packages -s $(BUILD_KEY)); \
 	) >/dev/null 2>/dev/null
 	$(OPKG) update >&2 || true
 
@@ -161,9 +166,14 @@ prepare_rootfs: FORCE
 	@echo Finalizing root filesystem...
 
 	$(CP) $(TARGET_DIR) $(TARGET_DIR_ORIG)
+	$(if $(CONFIG_SIGNATURE_CHECK), \
+		$(if $(ADD_LOCAL_KEY), \
+			OPKG_KEYS=$(TARGET_DIR)/etc/opkg/keys/ \
+			$(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub \
+		) \
+	)
 	$(call prepare_rootfs,$(TARGET_DIR),$(USER_FILES))
 
-
 build_image: FORCE
 	@echo
 	@echo Building images...
@@ -202,8 +212,26 @@ ifneq ($(PROFILE),)
   endif
 endif
 
+_check_keys: FORCE
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+	@if [ ! -s $(BUILD_KEY) -o ! -s $(BUILD_KEY).pub ]; then \
+		echo Generate local signing keys... >&2; \
+		$(STAGING_DIR_HOST)/bin/usign -G \
+			-s $(BUILD_KEY) -p $(BUILD_KEY).pub -c "Local build key"; \
+		$(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub; \
+	fi
+	if [ ! -s $(BUILD_KEY).ucert ]; then \
+		echo Generate local certificate... >&2; \
+		$(STAGING_DIR_HOST)/bin/ucert -I \
+			-c $(BUILD_KEY).ucert \
+			-p $(BUILD_KEY).pub \
+			-s $(BUILD_KEY); \
+	fi
+endif
+
 image:
 	$(MAKE) -s _check_profile
+	$(MAKE) -s _check_keys
 	(unset PROFILE FILES PACKAGES MAKEFLAGS; \
 	$(MAKE) -s _call_image \
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
@@ -213,6 +241,7 @@ image:
 
 manifest: FORCE
 	$(MAKE) -s _check_profile
+	$(MAKE) -s _check_keys
 	(unset PROFILE FILES PACKAGES MAKEFLAGS; \
 	$(MAKE) -s _call_manifest \
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \

From 506fdee1eddd6ecf362b74767219991e84f4e3eb Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Wed, 18 Nov 2020 16:02:23 +0100
Subject: [PATCH 23/30] scripts: download.pl: retry download using filename

With this commit, the download script will try downloading source files
using the filename instead of the url-filename in case the previous
download attempt using the url-filename failed.

This is required, as the OpenWrt sources mirrors serve files using the
filename files might be renamed to after downloading. If the original
mirror for a file where url-filename and filename do not match goes
down, the download failed prior to this patch.

Further improvement can be done by performing this only for the
OpenWrt sources mirrors.

Signed-off-by: David Bauer <mail@david-bauer.net>
---
 scripts/download.pl | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/download.pl b/scripts/download.pl
index 02ef7de4da..910e1e3a94 100755
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -93,6 +93,7 @@ $hash_cmd or ($file_hash eq "skip") or die "Cannot find appropriate hash command
 sub download
 {
 	my $mirror = shift;
+	my $download_filename = shift;
 
 	$mirror =~ s!/$!!;
 
@@ -139,7 +140,7 @@ sub download
 			}
 		};
 	} else {
-		my @cmd = download_cmd("$mirror/$url_filename");
+		my @cmd = download_cmd("$mirror/$download_filename");
 		print STDERR "+ ".join(" ",@cmd)."\n";
 		open(FETCH_FD, '-|', @cmd) or die "Cannot launch curl or wget.\n";
 		$hash_cmd and do {
@@ -280,7 +281,10 @@ while (!-f "$target/$filename") {
 	my $mirror = shift @mirrors;
 	$mirror or die "No more mirrors to try - giving up.\n";
 
-	download($mirror);
+	download($mirror, $url_filename);
+	if (!-f "$target/$filename" && $url_filename ne $filename) {
+		download($mirror, $filename);
+	}
 }
 
 $SIG{INT} = \&cleanup;

From 65888bf7c524836b185b23c97a3234902296d09b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Fri, 20 Nov 2020 13:13:27 +0100
Subject: [PATCH 24/30] musl: handle wcsnrtombs destination buffer overflow
 (CVE-2020-28928)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The wcsnrtombs function in all musl libc versions up through 1.2.1 has
been found to have multiple bugs in handling of destination buffer
size when limiting the input character count, which can lead to
infinite loop with no forward progress (no overflow) or writing past
the end of the destination buffera.

This function is not used internally in musl and is not widely used,
but does appear in some applications. The non-input-limiting form
wcsrtombs is not affected.

All users of musl 1.2.1 and prior versions should apply the attached
patch, which replaces the overly complex and erroneous implementation.
The upcoming 1.2.2 release will adopt this new implementation.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 toolchain/musl/common.mk                      |  2 +-
 .../700-wcsnrtombs-cve-2020-28928.diff        | 65 +++++++++++++++++++
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff

diff --git a/toolchain/musl/common.mk b/toolchain/musl/common.mk
index 8c8eddc855..68098f5c6a 100644
--- a/toolchain/musl/common.mk
+++ b/toolchain/musl/common.mk
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=musl
 PKG_VERSION:=1.1.24
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://musl.libc.org/releases/
diff --git a/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff b/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff
new file mode 100644
index 0000000000..8465f9422a
--- /dev/null
+++ b/toolchain/musl/patches/700-wcsnrtombs-cve-2020-28928.diff
@@ -0,0 +1,65 @@
+diff --git a/src/multibyte/wcsnrtombs.c b/src/multibyte/wcsnrtombs.c
+index 676932b5..95e25e70 100644
+--- a/src/multibyte/wcsnrtombs.c
++++ b/src/multibyte/wcsnrtombs.c
+@@ -1,41 +1,33 @@
+ #include <wchar.h>
++#include <limits.h>
++#include <string.h>
+ 
+ size_t wcsnrtombs(char *restrict dst, const wchar_t **restrict wcs, size_t wn, size_t n, mbstate_t *restrict st)
+ {
+-	size_t l, cnt=0, n2;
+-	char *s, buf[256];
+ 	const wchar_t *ws = *wcs;
+-	const wchar_t *tmp_ws;
+-
+-	if (!dst) s = buf, n = sizeof buf;
+-	else s = dst;
+-
+-	while ( ws && n && ( (n2=wn)>=n || n2>32 ) ) {
+-		if (n2>=n) n2=n;
+-		tmp_ws = ws;
+-		l = wcsrtombs(s, &ws, n2, 0);
+-		if (!(l+1)) {
+-			cnt = l;
+-			n = 0;
++	size_t cnt = 0;
++	if (!dst) n=0;
++	while (ws && wn) {
++		char tmp[MB_LEN_MAX];
++		size_t l = wcrtomb(n<MB_LEN_MAX ? tmp : dst, *ws, 0);
++		if (l==-1) {
++			cnt = -1;
+ 			break;
+ 		}
+-		if (s != buf) {
+-			s += l;
++		if (dst) {
++			if (n<MB_LEN_MAX) {
++				if (l>n) break;
++				memcpy(dst, tmp, l);
++			}
++			dst += l;
+ 			n -= l;
+ 		}
+-		wn = ws ? wn - (ws - tmp_ws) : 0;
+-		cnt += l;
+-	}
+-	if (ws) while (n && wn) {
+-		l = wcrtomb(s, *ws, 0);
+-		if ((l+1)<=1) {
+-			if (!l) ws = 0;
+-			else cnt = l;
++		if (!*ws) {
++			ws = 0;
+ 			break;
+ 		}
+-		ws++; wn--;
+-		/* safe - this loop runs fewer than sizeof(buf) times */
+-		s+=l; n-=l;
++		ws++;
++		wn--;
+ 		cnt += l;
+ 	}
+ 	if (dst) *wcs = ws;

From 7ec35748791cd33dce6b91bf7d955bd9dd6b82f2 Mon Sep 17 00:00:00 2001
From: tjuyy <yuyang1991@tju.edu.cn>
Date: Tue, 17 Nov 2020 19:18:47 +0800
Subject: [PATCH 25/30] frp: bump to v0.34.2

---
 package/lean/frp/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/lean/frp/Makefile b/package/lean/frp/Makefile
index 8bc5e54ba3..d571ae34ff 100644
--- a/package/lean/frp/Makefile
+++ b/package/lean/frp/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=frp
-PKG_VERSION:=0.34.1
+PKG_VERSION:=0.34.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=a47f952cc491a1d5d6f838306f221d6a8635db7cf626453df72fe6531613d560
+PKG_HASH:=53d8c29ef627e544cf8970b0a05570589d5270398068eb162957bdddb36de9ac
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE

From 6132eb9e960a101f4b1510084e6590ef8cd44b01 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 21 Nov 2020 18:27:15 +0800
Subject: [PATCH 26/30] luci-app-serverchan: sync with upstream source

---
 .../luci-app-serverchan/root/usr/bin/serverchan/serverchan       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan b/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
index 19b62f7382..99273b7be1 100755
--- a/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
+++ b/package/ctcgfw/luci-app-serverchan/root/usr/bin/serverchan/serverchan
@@ -907,6 +907,7 @@ function send(){
 	[ -z "$send_content" ] && local send_content="${markdown_splitline}#### 我遇到了一个难题${markdown_linefeed}${markdown_tab}定时发送选项错误，你没有选择需要发送的项目，该怎么办呢${markdown_splitline}"
 	local nowtime=`date "+%Y-%m-%d %H:%M:%S"`
 	[ "$send_disturb" -eq "0" ] && [ -z "$send_tg" ] && curl -s "http://sc.ftqq.com/${sckey}.send?text=${send_title}" -d "&desp=${nowtime}${markdown_linefeed}${send_content}" >/dev/null 2>&1
+	[ "$send_disturb" -eq "0" ] && [ ! -z "$send_tg" ] && [ "$send_tg" -eq "2" ] && curl -s "http://sctapi.ftqq.com/${sctkey}.send?text=${send_title}" -d "desp=${nowtime}${markdown_linefeed}${send_content}" >/dev/null 2>&1
 	[ "$send_disturb" -eq "0" ] && [ ! -z "$send_tg" ] && [ "$send_tg" -eq "1" ] && curl -d "text=${send_title}${markdown_linefeed}${nowtime}${markdown_linefeed}${send_content}" -X POST "${tgtoken}" >/dev/null 2>&1
 	deltemp
 	echo "`date "+%Y-%m-%d %H:%M:%S"` ${disturb_text}定时推送任务完成" >> ${logfile}

From b8ad67623674333edcd6e89c1023baaf3b6272c9 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 21 Nov 2020 18:30:32 +0800
Subject: [PATCH 27/30] luci-app-diskman: sync with upstream source

---
 package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua b/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
index 27698cf28d..dd10876585 100644
--- a/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
+++ b/package/ctcgfw/luci-app-diskman/luasrc/model/diskman.lua
@@ -412,8 +412,8 @@ d.list_devices = function()
   for i, bname in pairs(target_devnames) do
     local device_info = {}
     local device = "/dev/" .. bname
-    local size = tonumber(fs.readfile(string.format("/sys/class/block/%s/size", bname)))
-    local ss = tonumber(fs.readfile(string.format("/sys/class/block/%s/queue/logical_block_size", bname)))
+    local size = tonumber(fs.readfile(string.format("/sys/class/block/%s/size", bname)) or "0")
+    local ss = tonumber(fs.readfile(string.format("/sys/class/block/%s/queue/logical_block_size", bname)) or "0")
     local model = fs.readfile(string.format("/sys/class/block/%s/device/model", bname))
     local partitions = {}
     for part in nixio.fs.glob("/sys/block/" .. bname .."/" .. bname .. "*") do

From c695bfb4a2287cd4e160c95c42c7be6b429ab04e Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 21 Nov 2020 18:31:40 +0800
Subject: [PATCH 28/30] OpenAppFilter: sync with upstream source

---
 package/ctcgfw/open-app-filter/Makefile       |   2 +
 .../open-app-filter/files/appfilter.init      |   1 +
 .../open-app-filter/files/appfilter.lua       | 262 ++++++++++++++++++
 3 files changed, 265 insertions(+)
 create mode 100644 package/ctcgfw/open-app-filter/files/appfilter.lua

diff --git a/package/ctcgfw/open-app-filter/Makefile b/package/ctcgfw/open-app-filter/Makefile
index 55cc07b96a..7da4cad0f0 100755
--- a/package/ctcgfw/open-app-filter/Makefile
+++ b/package/ctcgfw/open-app-filter/Makefile
@@ -14,6 +14,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/appfilter
   SECTION:=net
   CATEGORY:=Network
+  DEPENDS:=+libubox-lua
   TITLE:=App filter userspace module
 endef
 
@@ -39,6 +40,7 @@ define Package/appfilter/install
 	$(INSTALL_BIN) ./files/appfilter.init $(1)/etc/init.d/appfilter
 	$(INSTALL_BIN) ./files/appfilter.sh $(1)/usr/bin
 	$(INSTALL_BIN) ./files/gen_class.sh $(1)/usr/bin
+	$(INSTALL_BIN) ./files/appfilter.lua $(1)/usr/bin/appfilter
 	$(INSTALL_BIN) ./files/appfilter.config $(1)/etc/config/appfilter
 endef
 
diff --git a/package/ctcgfw/open-app-filter/files/appfilter.init b/package/ctcgfw/open-app-filter/files/appfilter.init
index a7fa773b20..089e72ec9a 100755
--- a/package/ctcgfw/open-app-filter/files/appfilter.init
+++ b/package/ctcgfw/open-app-filter/files/appfilter.init
@@ -5,6 +5,7 @@ start() {
 	lsmod | grep -q oaf 2>/dev/null || modprobe oaf
 	gen_class.sh /etc/appfilter/feature.cfg
 	appfilter.sh
+	/usr/bin/appfilter &
 }
 
 stop() {
diff --git a/package/ctcgfw/open-app-filter/files/appfilter.lua b/package/ctcgfw/open-app-filter/files/appfilter.lua
new file mode 100644
index 0000000000..8cea8966f0
--- /dev/null
+++ b/package/ctcgfw/open-app-filter/files/appfilter.lua
@@ -0,0 +1,262 @@
+#!/usr/bin/lua
+
+local libubus = require "ubus"
+local uloop = require "uloop"
+
+local UBUS_STATUS_OK = 0
+local UBUS_STATUS_INVALID_COMMAND = 1
+local UBUS_STATUS_INVALID_ARGUMENT = 2
+local UBUS_STATUS_METHOD_NOT_FOUND = 3
+local UBUS_STATUS_NOT_FOUND = 4
+local UBUS_STATUS_NO_DATA = 5
+local UBUS_STATUS_PERMISSION_DENIED = 6
+local UBUS_STATUS_TIMEOUT = 7
+local UBUS_STATUS_NOT_SUPPORTED = 8
+local UBUS_STATUS_UNKNOWN_ERROR = 9
+local UBUS_STATUS_CONNECTION_FAILED = 10
+local UBUS_STATUS_ALREADY_EXISTS = 11
+
+local cfg_file = "/etc/appfilter/feature.cfg"
+
+local cfg = {}
+local class = {}
+local ubus
+
+cfg.__index = cfg
+class.__index = class
+function cfg:init(file)
+    local f = io.open(file, "r")
+    local t = {}
+    local t2 = {}
+    if f then
+        for line in f:lines() do
+            table.insert(t, line)
+            local tt = line:match("#class (%S+)")
+            if tt then 
+                table.insert(t2, tt)
+            end
+        end
+        setmetatable(t, self)
+        setmetatable(t2, self)
+        return t,t2
+    end
+    return nil
+end
+
+function cfg:lookup(o)
+    if not o then return UBUS_STATUS_INVALID_ARGUMENT end
+	local tab = self
+    for _, v in ipairs(tab) do
+        if v:match(o) then
+            if v:match("#class") then
+                local tt = {}
+                local t2 = {}
+                local found
+                for _, t in ipairs(tab) do
+                    repeat
+                        if t:match(o) then
+                            found = true
+                            table.insert(tt, t)
+                            break
+                        end
+
+                        if t:match("#class") then
+                            found = false
+                            table.insert(t2, t)
+                            break
+                        end
+
+                        if found then
+                            table.insert(tt, t)
+                        else
+                            table.insert(t2, t)
+                        end
+                    until true
+                end
+                setmetatable(tt,  self)
+                setmetatable(t2, self)
+                return tt, t2
+            else
+                return v
+            end
+        end
+    end
+    return nil
+end
+
+function cfg:lookup_class(m)
+    if not m then return UBUS_STATUS_INVALID_ARGUMENT end
+	local t1, t2 = self:lookup(m)
+	if type(t1) ~= "table" then return nil end
+	return t1, t2
+end
+
+function cfg:add_class(m)
+    if not m then return UBUS_STATUS_INVALID_ARGUMENT end
+    local f = io.open(cfg_file, "r+")
+    local tab = self
+    if f then
+        io.output(f)
+        for _, v in ipairs(tab) do
+            io.write(v)
+            io.write("\n")
+        end
+        io.write("#class "..m)
+        f:flush()
+        f:close()
+        return UBUS_STATUS_OK
+    else
+        return UBUS_STATUS_NOT_FOUND
+    end
+end
+
+function cfg:add_app(m, name, proto, sport, dport, url, request, dict)
+    if not name then return UBUS_STATUS_INVALID_ARGUMENT end
+	local id
+	local offset
+    local f = io.open(cfg_file, "r+")
+    io.output(f)
+    local t1,t2 = self:lookup_class(m)
+    if t1[#t1] == nil or "" then
+    	offset = 0
+    	id = math.modf(string.match(t1[#t1-1], "(%d+) %S+:") +1)
+    else
+		offset = 1
+		id = math.modf(string.match(t1[#t1], "(%d+) %S+:") +1)
+    end
+     
+    local str = string.format("%d %s:[%s;%s;%s;%s;%s;%s]", id, name, proto, sport or "", dport or "", url or "", request or "", dict or "")
+    table.insert(t1, #t1+offset, str)
+    if f then
+        for _, v in ipairs(t2) do
+			if v then
+				io.write(v)
+				io.write("\n")
+            end
+        end
+        for _, v in ipairs(t1) do
+			if v then
+				io.write(v)
+				io.write("\n")
+            end
+        end
+        f:flush()
+        f:close()
+    end
+    return id
+end
+
+function cfg:del_app(id, name)
+    local t = self
+    local f = io.open(cfg_file, "r+")
+    local ret
+    if id then
+        for i, v in ipairs(t) do
+            if v:match(id) then
+                table.remove(t, i)
+                ret = i
+            end
+        end
+
+    end
+
+    if name then
+        for i, v in ipairs(t) do
+            if v:match(name) then
+                table.remove(t, i)
+                ret = i
+            end
+        end
+    end
+
+    if f then
+        io.output(f)
+        for _, v in ipairs(t) do
+            io.write(v)
+            io.write("\n")
+        end
+        f:flush()
+        f:close()
+    end
+    return ret
+end
+
+local methods = {
+	["appfilter"] = {
+		add_class = {
+            function(req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t = cfg:init(cfg_file)
+                local ret
+                if t:lookup_class(msg.class) then return ubus.reply(req, {ret = UBUS_STATUS_ALREADY_EXISTS}) end
+                ret = t:add_class(msg.class)
+				ubus.reply(req, {msg = ret})
+			end, {class = libubus.STRING}
+        },
+        add_app = {
+            function (req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                if not msg.name then return UBUS_STATUS_INVALID_ARGUMENT end
+				if not msg.proto then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t = cfg:init(cfg_file)
+                local ret
+                if t:lookup(msg.name) then return ubus.reply(req, {ret = UBUS_STATUS_ALREADY_EXISTS}) end
+                ret = t:add_app(msg.class, msg.name, msg.proto, msg.sport, msg.dport, msg.url, msg.request, msg.dict)
+                ubus.reply(req, {ret = ret})
+            end,{class = libubus.STRING, name = libubus.STRING, proto = libubus.STRING, sport = libubus.INT32, dport = libubus.INT32, url = libubus.STRING, request = libubus.STRING, dict = libubus.STRING}
+        },
+        del_app = {
+            function(req, msg)
+                local t = cfg:init(cfg_file)
+                local ret = t:del_app(msg.id, msg.name)
+                ubus.reply(req, {ret = ret})
+            end,{id = libubus.INT32, name = libubus.STRING}
+        },
+        list_class = {
+            function (req, msg)
+                local _, c = cfg:init(cfg_file)
+                ubus.reply(req, {result = c})
+            end,{}
+        },
+        list_app = {
+            function (req, msg)
+                if not msg.class then return UBUS_STATUS_INVALID_ARGUMENT end
+                local t  = cfg:init(cfg_file)
+                local ret = {}
+                for i, v in ipairs(t:lookup_class(msg.class)) do
+					if not v:match("#class") then
+						local id, name = v:match("(%d+) (%S+):%[")
+						ret[i-1] = {id = id,  name = name}
+					end
+                end
+                ubus.reply(req, {result = ret})
+            end,{class = libubus.STRING}
+        }
+	}
+}
+
+function ubus_init()
+    local conn = libubus.connect()
+    if not conn then
+        error("Failed to connect to ubus")
+    end
+
+    conn:add(methods)
+
+    return {
+        call = function(object, method, params)
+            return conn:call(object, method, params or {})
+        end,
+        reply = function(req, msg)
+            conn:reply(req, msg)
+        end
+    }
+end
+
+local function main()
+    uloop.init()
+    ubus = ubus_init()
+    uloop.run()
+end
+
+main()
\ No newline at end of file

From 988f8d96df9467928f519fe904cc12e577e914b5 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 21 Nov 2020 18:44:24 +0800
Subject: [PATCH 29/30] AdGuardHome: bump to 0.104.1

---
 package/ntlf9t/AdGuardHome/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/ntlf9t/AdGuardHome/Makefile b/package/ntlf9t/AdGuardHome/Makefile
index fdb68b7787..80e23ec0a1 100644
--- a/package/ntlf9t/AdGuardHome/Makefile
+++ b/package/ntlf9t/AdGuardHome/Makefile
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=AdGuardHome
-PKG_VERSION:=0.104.0
+PKG_VERSION:=0.104.1
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_SOURCE_URL:=https://github.com/AdguardTeam/AdGuardHome
-PKG_MIRROR_HASH:=852861f83c3788a3913cb953b2eb0e2a94c27e2e158feae8c7485480c1481257
+PKG_MIRROR_HASH:=007082d40cc184ebb4efcdeb22608af8a63ba929654861f10205ec3d23591e4c
 
 PKG_LICENSE:=GPL-3.0-only
 PKG_LICENSE_FILES:=LICENSE.txt

From abf359df01e54ca4b8d235631e6c611e62ed6725 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@project-openwrt.eu.org>
Date: Sat, 21 Nov 2020 18:46:19 +0800
Subject: [PATCH 30/30] AdGuardHome: bump to 0.104.3

---
 package/ntlf9t/AdGuardHome/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/ntlf9t/AdGuardHome/Makefile b/package/ntlf9t/AdGuardHome/Makefile
index 80e23ec0a1..fcf996292d 100644
--- a/package/ntlf9t/AdGuardHome/Makefile
+++ b/package/ntlf9t/AdGuardHome/Makefile
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=AdGuardHome
-PKG_VERSION:=0.104.1
+PKG_VERSION:=0.104.3
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_SOURCE_URL:=https://github.com/AdguardTeam/AdGuardHome
-PKG_MIRROR_HASH:=007082d40cc184ebb4efcdeb22608af8a63ba929654861f10205ec3d23591e4c
+PKG_MIRROR_HASH:=ec0d48413778267f4ac81091e58a88e5b5ee2f3c1ab48256ded3438bf171d311
 
 PKG_LICENSE:=GPL-3.0-only
 PKG_LICENSE_FILES:=LICENSE.txt