Merge Lean's source

config/Config-kernel.in

@@ -650,13 +650,13 @@ config KERNEL_POSIX_MQUEUE
 
 config KERNEL_SECCOMP_FILTER
 	bool
-	default y if !SMALL_FLASH
+	default n
 
 config KERNEL_SECCOMP
 	bool "Enable seccomp support"
 		depends on !(TARGET_uml)
 		select KERNEL_SECCOMP_FILTER
-		default y if !SMALL_FLASH
+		default n
 		help
 		  Build kernel with support for seccomp.
 

package/lean/luci-app-docker/Makefile

@@ -10,7 +10,7 @@ LUCI_TITLE:=Luci for Docker-CE
 LUCI_DEPENDS:=+docker-ce
 LUCI_PKGARCH:=all
 PKG_VERSION:=1
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 
 include $(TOPDIR)/feeds/luci/luci.mk
 

package/lean/luci-app-docker/luasrc/controller/docker.lua

@@ -1,7 +1,7 @@
 module("luci.controller.docker", package.seeall)
 
 function index()
-	if not nixio.fs.access("/etc/config/docker") then
+	if not nixio.fs.access("/etc/config/dockerd") then
 		return
 	end
 	

package/lean/luci-app-docker/luasrc/model/cbi/docker.lua

@@ -2,10 +2,10 @@ local running = (luci.sys.call("pidof portainer >/dev/null") == 0)
 local button = ""
 
 if running then
-	button = "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /><br /><input type=\"button\" value=\" " .. translate("Open Portainer Docker Admin") .. " \" onclick=\"window.open('http://'+window.location.hostname+':" .. 9999 .. "')\"/>"
+	button = "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /><br /><input type=\"button\" value=\" " .. translate("Open Portainer Docker Admin") .. " \" onclick=\"window.open('http://'+window.location.hostname+':" .. 9999 .. "')\"/><br />"
 end
 
-m = Map("docker", "Docker CE", translate("Docker is a set of platform-as-a-service (PaaS) products that use OS-level virtualization to deliver software in packages called containers."))
+m = Map("dockerd", "Docker CE", translate("Docker is a set of platform-as-a-service (PaaS) products that use OS-level virtualization to deliver software in packages called containers.") .. button)
 
 
 m:section(SimpleSection).template  = "docker/docker_status"
@@ -13,12 +13,12 @@ m:section(SimpleSection).template  = "docker/docker_status"
 s = m:section(TypedSection, "docker")
 s.anonymous = true
 
-wan_mode = s:option(Flag, "enabled", translate("Enable WAN access Dokcer"))
+wan_mode = s:option(Flag, "wan_mode", translate("Enable WAN access Dokcer"), translate("Enable WAN access docker mapped ports"))
 wan_mode.default = 0
 wan_mode.rmempty = false
-wan_mode.description = translate(("!") .. button)
 
-o = s:option(Button,"certificate",translate("Docker Readme First"))
+
+o = s:option(Button,"readme",translate("Docker Readme First"))
 o.inputtitle = translate("Download DockerReadme.pdf")
 o.description = translate("Please download DockerReadme.pdf to read when first-running")
 o.inputstyle = "reload"

package/lean/luci-app-docker/po/zh-cn/docker.po

@@ -4,7 +4,7 @@ msgstr ""
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2015-06-23 20:16+0800\n"
 "PO-Revision-Date: 2015-06-23 20:17+0800\n"
-"Last-Translator: 981213 <gch981213@gmail.com>\n"
+"Last-Translator: coolsnowwolf <coolsnowwolf@gmail.com>\n"
 "Language-Team: PandoraBox Team\n"
 "Language: zh_CN\n"
 "MIME-Version: 1.0\n"
@@ -27,7 +27,7 @@ msgid "Enable WAN access Dokcer"
 msgstr "允许 WAN 访问 Dokcer"
 
 msgid "Enable WAN access docker mapped ports"
-msgstr "允许 WAN 访问 Dokcer 映射后的端口（易受攻击，不推荐！）"
+msgstr "允许 WAN 访问 Dokcer 映射后的端口（易受攻击！）。<br /><br />推荐禁用该选项后，用系统防火墙选择性映射 172.17.0.X:XX 端口到 WAN"
 
 msgid "Docker Readme First"
 msgstr "Docker 初始化无脑配置教程"

package/lean/luci-app-docker/root/etc/config/docker

@@ -1,6 +0,0 @@
-
-config docker
-	option wan_mode '1'
-	option enable '1'
-	option enabled '0'
-

package/lean/luci-app-docker/root/etc/config/dockerd

@@ -0,0 +1,4 @@
+
+config docker
+	option wan_mode '0'
+

package/lean/luci-app-docker/root/etc/docker-pppoe

@@ -1,13 +0,0 @@
-#!/bin/sh
-
-sleep 10
-
-docker_ok=$(iptables -t filter -L FORWARD | grep DOCKER)
-
-while [ -z "$docker_ok" ]; do 
-  echo "DOCKER Chain not ready" && sleep 10
-  docker_ok=$(iptables -t filter -L FORWARD | grep DOCKER)
-done
-
-iptables -D FORWARD -i pppoe-wan -o docker0 -j DROP 2>/dev/null
-iptables -I FORWARD -i pppoe-wan -o docker0 -j DROP

package/lean/luci-app-docker/root/etc/init.d/dockerd

@@ -5,12 +5,18 @@ START=25
 
 start_service() {
 	local nofile=$(cat /proc/sys/fs/nr_open)
+	local wanmode=$(uci get dockerd.@docker[0].wan_mode)
+	
+	if [ $wanmode = "1" ] ;then
+	dockerwan=" "
+	else
+	dockerwan="--iptables=false"
+  fi
 
 	procd_open_instance
 	procd_set_param stderr 1
-	procd_set_param command /usr/bin/dockerd
+	procd_set_param command /usr/bin/dockerd $dockerwan
 	procd_set_param limits nofile="${nofile} ${nofile}"
 	procd_close_instance
 	
-	/etc/docker-pppoe &>/dev/null &
 }

package/lean/luci-app-docker/root/etc/uci-defaults/docker

@@ -1,4 +1,11 @@
 #!/bin/sh
 
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@dockerd[-1]
+	add ucitrack dockerd
+	set ucitrack.@dockerd[-1].init=dockerd
+	commit ucitrack
+EOF
+
 rm -f /tmp/luci-indexcache
 exit 0

package/lean/luci-app-ssr-plus/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=1
-PKG_RELEASE:=112
+PKG_RELEASE:=115
 
 PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks \
 	CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_V2ray \

package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po

@@ -514,3 +514,9 @@ msgstr "仅常用端口（不走P2P流量到代理）"
 
 msgid "Ping Latency"
 msgstr "Ping延迟"
+
+msgid "Bypass Domain List"
+msgstr "域名白名单"
+
+msgid "Black Domain List"
+msgstr "域名黑名单"

package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr

@@ -67,7 +67,7 @@ gen_config_file() {
          elif  [ "$host" != "${host#*:[0-9a-fA-F]}" ] ;then
          hostip=${host}
          else
-          hostip=`ping ${host} -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1`
+          hostip=`nslookup ${host} | grep 'Address 1' | sed 's/Address 1: //g'`
           if echo $hostip|grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$">/dev/null; then
           hostip=${hostip}
           else
@@ -143,7 +143,7 @@ start_rules() {
 	elif  [ "$server" != "${server#*:[0-9a-fA-F]}" ] ;then
 	server=${server}
 	else
-	server=`ping ${server} -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1`
+	server=`nslookup ${server} | grep 'Address 1' | sed 's/Address 1: //g'`
 	 if echo $server|grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$">/dev/null; then
 	  echo $server >/etc/ssr_ip
 	 else

package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.sh

@@ -69,14 +69,14 @@ do
 	echo_date "从 ${subscribe_url[o]} 获取订阅"
 	echo_date "开始更新在线订阅列表..."
 	echo_date "开始下载订阅链接到本地临时文件，请稍等..."
-	subscribe_data=$(wget-ssl --user-agent="User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" --no-check-certificate -T 3 -O- ${subscribe_url[o]})
+	subscribe_data=$(wget-ssl --user-agent="User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" --no-check-certificate -t 10 -T 10 -O- ${subscribe_url[o]})
 	curl_code=$?
 	# 计算group的hashkey
 	ssr_grouphashkey=$(echo "${subscribe_url[o]}" | md5sum | cut -d ' ' -f1)
 	if [ ! $curl_code -eq 0 ];then
 		echo_date "下载订阅成功..."
 		echo_date "开始解析节点信息..."
-		subscribe_data=$(wget-ssl --no-check-certificate -T 3 -O- ${subscribe_url[o]})
+		subscribe_data=$(wget-ssl --no-check-certificate -t 10 -T 10 -O- ${subscribe_url[o]})
 		curl_code=$?
 	fi
 	if [ $curl_code -eq 0 ];then

target/linux/x86/64/config-4.9

@@ -254,7 +254,7 @@ CONFIG_NR_CPUS=128
 # CONFIG_NUMA is not set
 CONFIG_OUTPUT_FORMAT="elf64-x86-64"
 CONFIG_PADATA=y
-CONFIG_PAGE_TABLE_ISOLATION=y
+CONFIG_PAGE_TABLE_ISOLATION=n
 CONFIG_PARAVIRT=y
 CONFIG_PARAVIRT_CLOCK=y
 # CONFIG_PARAVIRT_DEBUG is not set

target/linux/x86/Makefile

@@ -21,8 +21,8 @@ include $(INCLUDE_DIR)/target.mk
 
 DEFAULT_PACKAGES += partx-utils mkf2fs fdisk e2fsprogs wpad kmod-usb-hid \
 kmod-ath5k kmod-ath9k kmod-ath9k-htc kmod-ath10k kmod-rt2800-usb kmod-e1000e kmod-igb kmod-igbvf kmod-ixgbe kmod-pcnet32 kmod-tulip kmod-vmxnet3 kmod-i40e kmod-i40evf kmod-fs-f2fs \
-htop lm-sensors autocore automount autosamba luci-app-zerotier luci-app-ipsec-vpnd luci-app-pptp-server luci-proto-bonding luci-app-zerotier luci-app-unblockmusic luci-app-docker \
-ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie intel-microcode amd64-microcode\
+htop lm-sensors autocore automount autosamba luci-app-zerotier luci-app-ipsec-vpnd luci-app-pptp-server luci-proto-bonding luci-app-zerotier luci-app-unblockmusic luci-app-transmission luci-app-docker \
+ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie intel-microcode amd64-microcode kmod-crypto-misc \
 alsa-utils kmod-ac97 kmod-sound-hda-core kmod-sound-hda-codec-realtek kmod-sound-hda-codec-via kmod-sound-via82xx kmod-usb-audio \
 kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 \
 shadowsocks-libev-ss-redir v2ray shadowsocksr-libev-server shadowsocksr-libev-ssr-local dsmboot cfdisk

target/linux/x86/patches-4.9/900-x86-Enable-fast-strings-on-Intel-if-BIOS-hasn-t-already.patch

@@ -0,0 +1,57 @@
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 1905ce9..a4a3ef2 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -124,6 +124,7 @@
+ static void early_init_intel(struct cpuinfo_x86 *c)
+ {
+ 	u64 misc_enable;
++	bool allow_fast_string = true;
+ 
+ 	/* Unmask CPUID levels if masked: */
+ 	if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) {
+@@ -233,20 +234,39 @@
+ 	 * Ingo Molnar reported a Pentium D (model 6) and a Xeon
+ 	 * (model 2) with the same problem.
+ 	 */
+-	if (c->x86 == 15)
++	if (c->x86 == 15) {
++		allow_fast_string = false;
+ 		if (msr_clear_bit(MSR_IA32_MISC_ENABLE,
+ 				  MSR_IA32_MISC_ENABLE_FAST_STRING_BIT) > 0)
+ 			pr_info("kmemcheck: Disabling fast string operations\n");
++	}
+ #endif
+ 
+ 	/*
+-	 * If fast string is not enabled in IA32_MISC_ENABLE for any reason,
+-	 * clear the fast string and enhanced fast string CPU capabilities.
++	 * If BIOS didn't enable fast string operation, try to enable
++	 * it ourselves. If that fails, then clear the fast string
++	 * and enhanced fast string CPU capabilities.
+ 	 */
+ 	if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) {
+ 		rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
++		
++		if (allow_fast_string &&
++		    !(misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING)) {
++			misc_enable |= MSR_IA32_MISC_ENABLE_FAST_STRING;
++			wrmsrl_safe(MSR_IA32_MISC_ENABLE, misc_enable);
++
++			/* Re-read to make sure it stuck. */
++			rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
++
++			if (misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING)
++				printk_once(KERN_INFO "BIOS disabled fast string operation, re-enabled sucessfully.\n");
++		}
++		
+ 		if (!(misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING)) {
+-			pr_info("Disabled fast string operations\n");
++			if (allow_fast_string)
++				printk_once(KERN_INFO FW_WARN "BIOS disabled fast string operation, re-enable failed.\n");
++			else
++			        printk_once(KERN_INFO "Disabled fast string operations\n");
+ 			setup_clear_cpu_cap(X86_FEATURE_REP_GOOD);
+ 			setup_clear_cpu_cap(X86_FEATURE_ERMS);
+ 		}
+