Merge Mainline

2020-09-05 06:53:05 +08:00
parent 4afad7690d ea8a33ab70
commit a7bba40e46
31 changed files with 311 additions and 345 deletions
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -946,18 +946,10 @@ config KERNEL_SECURITY_SELINUX_DEVELOP
 	bool "NSA SELinux Development Support"
 	depends on KERNEL_SECURITY_SELINUX

-choice
-	prompt "First legacy 'major LSM' to be initialized"
+config KERNEL_LSM
+	string
+	default "lockdown,yama,loadpin,safesetid,integrity,selinux"
 	depends on KERNEL_SECURITY_SELINUX
-	default KERNEL_DEFAULT_SECURITY_SELINUX
-
-	config KERNEL_DEFAULT_SECURITY_SELINUX
-		bool "SELinux"
-
-	config KERNEL_DEFAULT_SECURITY_DAC
-		bool "Unix Discretionary Access Controls"
-
-endchoice

 config KERNEL_EXT4_FS_SECURITY
 	bool "Ext4 Security Labels"
--- a/package/ctcgfw/luci-app-naiveproxy/luasrc/model/cbi/naiveproxy.lua
+++ b/package/ctcgfw/luci-app-naiveproxy/luasrc/model/cbi/naiveproxy.lua
@@ -22,7 +22,7 @@ server_addr = s:option(Value, "server_addr", translate("Server Address"))
 server_addr.description = translate("proto://user:pass@hostname[:port]")
 server_addr.rmempty = false

-extra_command = s:option(Value, "extra_command", translate("Extra Argument"))
-extra_command.description = translate("Appends extra argument to NaiveProxy")
+extra_argument= s:option(Value, "extra_argument", translate("Extra Argument"))
+extra_argument.description = translate("Appends extra argument to NaiveProxy")

 return mp
--- a/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash
+++ b/package/ctcgfw/luci-app-openclash/files/etc/init.d/openclash
@@ -811,7 +811,7 @@ yml_get_rule_provider()
 	if [ -n "$config" ] && [ "$config" != "$CONFIG_NAME" ] && [ "$config" != "all" ]; then
 		return
 	fi
-   
+
 	if [ -z "$group" ]; then
 		return
 	fi
@@ -1061,6 +1061,14 @@ do_run_core()
    if [ ! -f "/etc/openclash/clash" ] && [ -f "/etc/openclash/core/clash" ] && [ -z "$core_type" ]; then
       ln -s /etc/openclash/core/clash /etc/openclash/clash 2>/dev/null
    fi
+    
+    if [ ! -f "/etc/openclash/clash" ] && [ -f "/etc/openclash/core/clash_tun" ] && [ "$core_type" != "Game" ]; then
+       ln -s /etc/openclash/core/clash_tun /etc/openclash/clash 2>/dev/null
+    fi
+    
+    if [ ! -f "/etc/openclash/clash" ] && [ -f "/etc/openclash/core/clash_game" ] && [ "$core_type" != "Tun" ]; then
+       ln -s /etc/openclash/core/clash_game /etc/openclash/clash 2>/dev/null
+    fi

 #权限检查
    [ ! -x "/etc/openclash/core/clash_tun" ] && chmod 4755 /etc/openclash/core/clash_tun 2>/dev/null
--- a/package/ctcgfw/luci-app-openclash/files/etc/openclash/Country.mmdb
+++ b/package/ctcgfw/luci-app-openclash/files/etc/openclash/Country.mmdb
--- a/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/rule-providers-settings.lua
+++ b/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/model/cbi/openclash/rule-providers-settings.lua
@@ -87,7 +87,7 @@ for t,f in ipairs(fs.glob("/etc/openclash/game_rules/*"))do
    e[t]={}
    e[t].filename=fs.basename(f)
    if IsRuleFile(e[t].filename) then
-       e[t].name=luci.sys.exec(string.format("grep -F '%s' /etc/openclash/game_rules.list |awk -F ',' '{print $1}' 2>/dev/null",e[t].filename))
+       e[t].name=string.gsub(luci.sys.exec(string.format("grep -F '%s' /etc/openclash/game_rules.list |awk -F ',' '{print $1}' 2>/dev/null",e[t].filename)), "[\r\n]", "")
       o:value(e[t].name)
    end
  end
@@ -147,7 +147,7 @@ for t,f in ipairs(fs.glob("/etc/openclash/rule_provider/*"))do
    e[t]={}
    e[t].filename=fs.basename(f)
    if IsYamlFile(e[t].filename) or IsYmlFile(e[t].filename) then
-       e[t].name=luci.sys.exec(string.format("grep -F ',%s' /etc/openclash/rule_providers.list |awk -F ',' '{print $1}' 2>/dev/null",e[t].filename))
+       e[t].name=string.gsub(luci.sys.exec(string.format("grep -F ',%s' /etc/openclash/rule_providers.list |awk -F ',' '{print $1}' 2>/dev/null",e[t].filename)), "[\r\n]", "")
       if e[t].name ~= "" and e[t].name ~= nil then
          o:value(e[t].name)
       end
--- a/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/view/openclash/developer.htm
+++ b/package/ctcgfw/luci-app-openclash/files/usr/lib/lua/luci/view/openclash/developer.htm
@@ -1,16 +1,17 @@
 <fieldset class="cbi-section">
 	<table>
 		<tr>
-		<td width="10%" align="center" id="_Dreamacro"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_vernesong"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_frainzy1477"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_SukkaW"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_lhie1_dev"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_ConnersHua_dev"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_haishanh"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_MaxMind"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_FQrabbit"><%:Collecting data...%></td>
-		<td width="10%" align="center" id="_Fndroid"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_Dreamacro"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_vernesong"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_frainzy1477"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_SukkaW"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_lhie1_dev"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_ConnersHua_dev"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_haishanh"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_MaxMind"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_FQrabbit"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_Fndroid"><%:Collecting data...%></td>
+		<td width="9%" align="center" id="_Alecthw"><%:Collecting data...%></td>
 		</tr>
 	</table>
 </fieldset>
@@ -26,6 +27,7 @@
 	var haishanh = document.getElementById('_haishanh');
 	var FQrabbit = document.getElementById('_FQrabbit');
 	var Fndroid = document.getElementById('_Fndroid');
+	var Alecthw = document.getElementById('_Alecthw');
  Dreamacro.innerHTML = '<img src="https://avatars3.githubusercontent.com/u/8615343?s=460&v=4" loading="lazy" style="border-radius:50%;" title="Dreamacro" alt="Dreamacro" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return Dreamacro_rediret()" />';
 	vernesong.innerHTML = '<img src="https://avatars2.githubusercontent.com/u/42875168?s=460&v=4" loading="lazy" style="border-radius:50%;" title="vernesong" alt="vernesong" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return vernesong_rediret()" />';
  frainzy1477.innerHTML = '<img src="https://avatars2.githubusercontent.com/u/49537471?s=460&v=4" loading="lazy" style="border-radius:50%;" title="frainzy1477" alt="frainzy1477" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return frainzy1477_rediret()" />';
@@ -36,6 +38,7 @@
  haishanh.innerHTML = '<img src="https://avatars1.githubusercontent.com/u/1166872?s=460&v=4" loading="lazy" style="border-radius:50%;" title="haishanh" alt="haishanh" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return haishanh_rediret()" />';
  FQrabbit.innerHTML = '<img src="https://avatars1.githubusercontent.com/u/29931248?s=460&v=4" loading="lazy" style="border-radius:50%;" title="FQrabbit" alt="FQrabbit" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return FQrabbit_rediret()" />';
  Fndroid.innerHTML = '<img src="https://avatars1.githubusercontent.com/u/16091562?s=400&v=4" loading="lazy" style="border-radius:50%;" title="Fndroid" alt="Fndroid" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return Fndroid_rediret()" />';
+  Alecthw.innerHTML = '<img src="https://avatars1.githubusercontent.com/u/22856212?s=460&u=c8b48950a87572e5887ef836cf7dc1a97be7a7fd&v=4" loading="lazy" style="border-radius:50%;" title="Alecthw" alt="Alecthw" width="50" onerror="return imgerrorfun(this,this.src)" onclick="return Alecthw_rediret()" />';

 	  function Dreamacro_rediret()
    {
@@ -87,6 +90,11 @@
        url12='https://github.com/FQrabbit';
        window.open(url12);
    };
+    function Alecthw_rediret()
+    {
+        url13='https://github.com/alecthw';
+        window.open(url13);
+    };
    
    function imgerrorfun(imgobj,imgSrc){
       setTimeout(function(){
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_core.sh
@@ -75,7 +75,7 @@ if [ "$CORE_CV" != "$CORE_LV" ] || [ -z "$CORE_CV" ]; then
 			case $CORE_TYPE in
      	"Tun")
 				[ -s "/tmp/clash_tun.gz" ] && {
-					gzip -d /tmp/clash_tun.gz >/dev/null 2>&1 && mv /tmp/clash /tmp/clash_tun >/dev/null 2>&1
+					gzip -d /tmp/clash_tun.gz >/dev/null 2>&1
 					rm -rf /tmp/clash_tun.gz >/dev/null 2>&1
 					rm -rf /etc/openclash/core/clash_tun >/dev/null 2>&1
 					chmod 4755 /tmp/clash_tun >/dev/null 2>&1
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_ipdb.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/openclash_ipdb.sh
@@ -12,9 +12,9 @@
   fi
   echo "开始下载 GEOIP 数据库..." >$START_LOG
   if pidof clash >/dev/null; then
-      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://geolite.clash.dev/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 -x http://$PROXY_ADDR:$HTTP_PORT -U "$PROXY_AUTH" https://raw.githubusercontent.com/alecthw/mmdb_china_ip_list/release/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
   else
-      curl -sL --connect-timeout 10 --retry 2 https://geolite.clash.dev/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
+      curl -sL --connect-timeout 10 --retry 2 https://raw.githubusercontent.com/alecthw/mmdb_china_ip_list/release/Country.mmdb -o /tmp/Country.mmdb >/dev/null 2>&1
   fi
   if [ "$?" -eq "0" ] && [ -s "/tmp/Country.mmdb" ]; then
      echo "GEOIP 数据库下载成功，检查数据库版本是否更新..." >$START_LOG
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/14.2b1ab3375a2b9a48edab.js
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/14.2b1ab3375a2b9a48edab.js
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/14.b009c101831cfb4d346c.js
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/14.b009c101831cfb4d346c.js
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.8bd641dadb8c0be21576.js
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.8bd641dadb8c0be21576.js
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.9446db28fec78551ca86.js
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.9446db28fec78551ca86.js
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.9446db28fec78551ca86.js.LICENSE.txt
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/app.9446db28fec78551ca86.js.LICENSE.txt
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/index.html
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/index.html
@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="UTF-8"><link rel="shortcut icon" href="yacd.ico"><link rel="icon" type="image/png" sizes="64x64" href="yacd-64.png"><link rel="icon" type="image/png" sizes="128x128" href="yacd-128.png"><link rel="preload" href="/open-sans-latin-400.woff2" as="font" type="font/woff2" crossorigin><link rel="preload" href="/open-sans-latin-700.woff2" as="font" type="font/woff2" crossorigin><link rel="preload" href="/roboto-mono-latin-400.woff2" as="font" type="font/woff2" crossorigin><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="application-name" content="yacd"><meta name="description" content="Yet Another Clash Dashboard"><meta name="theme-color" content="#202020"><title>yacd - Yet Another Clash Dashboard</title><meta property="og:image" content="https://user-images.githubusercontent.com/1166872/47304841-536f3d80-d65a-11e8-8908-1917127dafc5.png"><meta property="og:site_name" content="yacd"><meta property="og:type" content="object"><meta property="og:title" content="yacd"><meta property="og:url" content="http://yacd.haishan.me"><meta property="og:description" content="Yet Another Clash Dashboard"><script defer="defer" src="runtime.41c657849345d551b223.js"></script><script defer="defer" src="core-js~app.d6acbd497dd781bcb87a.js"></script><script defer="defer" src="react~app.85a6af7ab221658559e3.js"></script><script defer="defer" src="app.8bd641dadb8c0be21576.js"></script><link href="app.5f32612351603f3dc36a.css" rel="stylesheet"></head><body><div id="app"></div></body></html>
+<!doctype html><html lang="en"><head><meta charset="UTF-8"><link rel="shortcut icon" href="yacd.ico"><link rel="icon" type="image/png" sizes="64x64" href="yacd-64.png"><link rel="icon" type="image/png" sizes="128x128" href="yacd-128.png"><link rel="preload" href="/open-sans-latin-400.woff2" as="font" type="font/woff2" crossorigin><link rel="preload" href="/open-sans-latin-700.woff2" as="font" type="font/woff2" crossorigin><link rel="preload" href="/roboto-mono-latin-400.woff2" as="font" type="font/woff2" crossorigin><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="application-name" content="yacd"><meta name="description" content="Yet Another Clash Dashboard"><meta name="theme-color" content="#202020"><title>yacd - Yet Another Clash Dashboard</title><meta property="og:image" content="https://user-images.githubusercontent.com/1166872/47304841-536f3d80-d65a-11e8-8908-1917127dafc5.png"><meta property="og:site_name" content="yacd"><meta property="og:type" content="object"><meta property="og:title" content="yacd"><meta property="og:url" content="http://yacd.haishan.me"><meta property="og:description" content="Yet Another Clash Dashboard"><script defer="defer" src="runtime.184b22669d1e3f4e39e2.js"></script><script defer="defer" src="core-js~app.d6acbd497dd781bcb87a.js"></script><script defer="defer" src="react~app.85a6af7ab221658559e3.js"></script><script defer="defer" src="app.9446db28fec78551ca86.js"></script><link href="app.5f32612351603f3dc36a.css" rel="stylesheet"></head><body><div id="app"></div></body></html>
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/report.html
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/report.html
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/runtime.184b22669d1e3f4e39e2.js
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yacd/runtime.184b22669d1e3f4e39e2.js
@@ -1 +1 @@
-!function(e){function r(r){for(var n,o,s=r[0],u=r[1],f=r[2],i=r[3]||[],l=0,b=[];l<s.length;l++)o=s[l],Object.prototype.hasOwnProperty.call(a,o)&&a[o]&&b.push(a[o][0]),a[o]=0;for(n in u)Object.prototype.hasOwnProperty.call(u,n)&&(e[n]=u[n]);for(p&&p(r),d.push.apply(d,i);b.length;)b.shift()();return c.push.apply(c,f||[]),t()}function t(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1;o<t.length;o++){var f=t[o];0!==a[f]&&(n=!1)}n&&(c.splice(r--,1),e=u(u.s=t[0]))}return 0===c.length&&(d.forEach((function(e){if(void 0===a[e]){a[e]=null;var r=document.createElement("link");u.nc&&r.setAttribute("nonce",u.nc),r.rel="prefetch",r.as="script",r.href=s(e),document.head.appendChild(r)}})),d.length=0),e}var n={},o={10:0},a={10:0},c=[],d=[];function s(e){return u.p+""+({0:"vendors~conns~proxies~rules",1:"vendors~logs~rules",3:"config",4:"conns",6:"logs",7:"proxies",9:"rules",11:"vendors~chartjs",12:"vendors~conns",13:"vendors~proxies"}[e]||e)+"."+{0:"99b1a71b3d76d3035e41",1:"1b69c8ae2dc5929cac38",3:"185469682369eea7ed5e",4:"a55d943aa09565fccb1a",6:"367e6b30d27de1213a87",7:"fe3172e32076eb8749e4",9:"fe5dbfb2f26ad4211d1e",11:"c749992ca47ba67623b4",12:"2d8ba1925a9d128867eb",13:"8fcc0e726f340a602edf",14:"b009c101831cfb4d346c"}[e]+".js"}function u(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,u),t.l=!0,t.exports}u.e=function(e){var r=[];o[e]?r.push(o[e]):0!==o[e]&&{3:1,4:1,6:1,7:1,9:1}[e]&&r.push(o[e]=new Promise((function(r,t){for(var n=({0:"vendors~conns~proxies~rules",1:"vendors~logs~rules",3:"config",4:"conns",6:"logs",7:"proxies",9:"rules",11:"vendors~chartjs",12:"vendors~conns",13:"vendors~proxies"}[e]||e)+"."+{0:"31d6cfe0d16ae931b73c",1:"31d6cfe0d16ae931b73c",3:"683c5e4f78100df80abd",4:"a8987b95653cf010754d",6:"bf8d3190ebe74f5f5c12",7:"2054c162aeb581d56063",9:"ebacd344d22f80adb7f8",11:"31d6cfe0d16ae931b73c",12:"31d6cfe0d16ae931b73c",13:"31d6cfe0d16ae931b73c",14:"31d6cfe0d16ae931b73c"}[e]+".css",a=u.p+n,c=document.getElementsByTagName("link"),d=0;d<c.length;d++){var s=(i=c[d]).getAttribute("data-href")||i.getAttribute("href");if("stylesheet"===i.rel&&(s===n||s===a))return r()}var f=document.getElementsByTagName("style");for(d=0;d<f.length;d++){var i;if((s=(i=f[d]).getAttribute("data-href"))===n||s===a)return r()}var l=document.createElement("link");l.rel="stylesheet",l.type="text/css",l.onload=r,l.onerror=function(r){var n=r&&r.target&&r.target.src||a,c=new Error("Loading CSS chunk "+e+" failed.\n("+n+")");c.code="CSS_CHUNK_LOAD_FAILED",c.request=n,delete o[e],l.parentNode.removeChild(l),t(c)},l.href=a,document.getElementsByTagName("head")[0].appendChild(l)})).then((function(){o[e]=0})));var t=a[e];if(0!==t)if(t)r.push(t[2]);else{var n=new Promise((function(r,n){t=a[e]=[r,n]}));r.push(t[2]=n);var c,d=document.createElement("script");d.charset="utf-8",d.timeout=120,u.nc&&d.setAttribute("nonce",u.nc),d.src=s(e);var f=new Error;c=function(r){d.onerror=d.onload=null,clearTimeout(i);var t=a[e];if(0!==t){if(t){var n=r&&("load"===r.type?"missing":r.type),o=r&&r.target&&r.target.src;f.message="Loading chunk "+e+" failed.\n("+n+": "+o+")",f.name="ChunkLoadError",f.type=n,f.request=o,t[1](f)}a[e]=void 0}};var i=setTimeout((function(){c({type:"timeout",target:d})}),12e4);d.onerror=d.onload=c,document.head.appendChild(d)}return Promise.all(r)},u.m=e,u.c=n,u.d=function(e,r,t){u.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},u.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},u.t=function(e,r){if(1&r&&(e=u(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(u.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)u.d(t,n,function(r){return e[r]}.bind(null,n));return t},u.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return u.d(r,"a",r),r},u.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},u.p="",u.oe=function(e){throw console.error(e),e};var f=window.webpackJsonp=window.webpackJsonp||[],i=f.push.bind(f);f.push=r,f=f.slice();for(var l=0;l<f.length;l++)r(f[l]);var p=i;t()}([]);
+!function(e){function r(r){for(var n,o,s=r[0],u=r[1],i=r[2],f=r[3]||[],l=0,b=[];l<s.length;l++)o=s[l],Object.prototype.hasOwnProperty.call(a,o)&&a[o]&&b.push(a[o][0]),a[o]=0;for(n in u)Object.prototype.hasOwnProperty.call(u,n)&&(e[n]=u[n]);for(p&&p(r),d.push.apply(d,f);b.length;)b.shift()();return c.push.apply(c,i||[]),t()}function t(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1;o<t.length;o++){var i=t[o];0!==a[i]&&(n=!1)}n&&(c.splice(r--,1),e=u(u.s=t[0]))}return 0===c.length&&(d.forEach((function(e){if(void 0===a[e]){a[e]=null;var r=document.createElement("link");u.nc&&r.setAttribute("nonce",u.nc),r.rel="prefetch",r.as="script",r.href=s(e),document.head.appendChild(r)}})),d.length=0),e}var n={},o={10:0},a={10:0},c=[],d=[];function s(e){return u.p+""+({0:"vendors~conns~proxies~rules",1:"vendors~logs~rules",3:"config",4:"conns",6:"logs",7:"proxies",9:"rules",11:"vendors~chartjs",12:"vendors~conns",13:"vendors~proxies"}[e]||e)+"."+{0:"99b1a71b3d76d3035e41",1:"1b69c8ae2dc5929cac38",3:"185469682369eea7ed5e",4:"a55d943aa09565fccb1a",6:"367e6b30d27de1213a87",7:"fe3172e32076eb8749e4",9:"fe5dbfb2f26ad4211d1e",11:"c749992ca47ba67623b4",12:"2d8ba1925a9d128867eb",13:"8fcc0e726f340a602edf",14:"2b1ab3375a2b9a48edab"}[e]+".js"}function u(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,u),t.l=!0,t.exports}u.e=function(e){var r=[];o[e]?r.push(o[e]):0!==o[e]&&{3:1,4:1,6:1,7:1,9:1}[e]&&r.push(o[e]=new Promise((function(r,t){for(var n=({0:"vendors~conns~proxies~rules",1:"vendors~logs~rules",3:"config",4:"conns",6:"logs",7:"proxies",9:"rules",11:"vendors~chartjs",12:"vendors~conns",13:"vendors~proxies"}[e]||e)+"."+{0:"31d6cfe0d16ae931b73c",1:"31d6cfe0d16ae931b73c",3:"683c5e4f78100df80abd",4:"a8987b95653cf010754d",6:"bf8d3190ebe74f5f5c12",7:"2054c162aeb581d56063",9:"ebacd344d22f80adb7f8",11:"31d6cfe0d16ae931b73c",12:"31d6cfe0d16ae931b73c",13:"31d6cfe0d16ae931b73c",14:"31d6cfe0d16ae931b73c"}[e]+".css",a=u.p+n,c=document.getElementsByTagName("link"),d=0;d<c.length;d++){var s=(f=c[d]).getAttribute("data-href")||f.getAttribute("href");if("stylesheet"===f.rel&&(s===n||s===a))return r()}var i=document.getElementsByTagName("style");for(d=0;d<i.length;d++){var f;if((s=(f=i[d]).getAttribute("data-href"))===n||s===a)return r()}var l=document.createElement("link");l.rel="stylesheet",l.type="text/css",l.onload=r,l.onerror=function(r){var n=r&&r.target&&r.target.src||a,c=new Error("Loading CSS chunk "+e+" failed.\n("+n+")");c.code="CSS_CHUNK_LOAD_FAILED",c.request=n,delete o[e],l.parentNode.removeChild(l),t(c)},l.href=a,document.getElementsByTagName("head")[0].appendChild(l)})).then((function(){o[e]=0})));var t=a[e];if(0!==t)if(t)r.push(t[2]);else{var n=new Promise((function(r,n){t=a[e]=[r,n]}));r.push(t[2]=n);var c,d=document.createElement("script");d.charset="utf-8",d.timeout=120,u.nc&&d.setAttribute("nonce",u.nc),d.src=s(e);var i=new Error;c=function(r){d.onerror=d.onload=null,clearTimeout(f);var t=a[e];if(0!==t){if(t){var n=r&&("load"===r.type?"missing":r.type),o=r&&r.target&&r.target.src;i.message="Loading chunk "+e+" failed.\n("+n+": "+o+")",i.name="ChunkLoadError",i.type=n,i.request=o,t[1](i)}a[e]=void 0}};var f=setTimeout((function(){c({type:"timeout",target:d})}),12e4);d.onerror=d.onload=c,document.head.appendChild(d)}return Promise.all(r)},u.m=e,u.c=n,u.d=function(e,r,t){u.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},u.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},u.t=function(e,r){if(1&r&&(e=u(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(u.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)u.d(t,n,function(r){return e[r]}.bind(null,n));return t},u.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return u.d(r,"a",r),r},u.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},u.p="",u.oe=function(e){throw console.error(e),e};var i=window.webpackJsonp=window.webpackJsonp||[],f=i.push.bind(i);i.push=r,i=i.slice();for(var l=0;l<i.length;l++)r(i[l]);var p=f;t()}([]);
--- a/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_change.sh
+++ b/package/ctcgfw/luci-app-openclash/files/usr/share/openclash/yml_change.sh
@@ -202,8 +202,9 @@
 	           sed -i "/^ \{0,\}hosts:/c\hosts:" "$7"
 	        fi
 	     fi
-       sed -i '/^hosts:/a\##Custom HOSTS END##' "$7" 2>/dev/null
-       sed -i '/^hosts:/a\##Custom HOSTS##' "$7" 2>/dev/null
+	     sed -i "/^dns:/a\  use-hosts: true" "$7"
+	     sed -i '/^hosts:/a\##Custom HOSTS END##' "$7" 2>/dev/null
+	     sed -i '/^hosts:/a\##Custom HOSTS##' "$7" 2>/dev/null
 	     sed -i '/##Custom HOSTS##/r/etc/openclash/custom/openclash_custom_hosts.list' "$7" 2>/dev/null
 	     sed -i "/^hosts:/,/^dns:/ {s/^ \{0,\}'/  '/}" "$7" 2>/dev/null #修改参数空格
 	  fi
--- a/package/lean/default-settings/files/zzz-default-settings
+++ b/package/lean/default-settings/files/zzz-default-settings
@@ -29,7 +29,7 @@ sed -i 's/services/nas/g'  /usr/lib/lua/luci/view/minidlna_status.htm

 ln -sf /sbin/ip /usr/bin/ip

-sed -i 's#http://downloads.openwrt.org#https://mirrors.cloud.tencent.com/lede#g' /etc/opkg/distfeeds.conf
+sed -i 's#https://downloads.openwrt.org#https://mirrors.cloud.tencent.com/lede#g' /etc/opkg/distfeeds.conf
 sed -i '/openwrt_luci/ { s/snapshots/releases\/18.06.8/g; }'  /etc/opkg/distfeeds.conf
 sed -i '/openwrt_packages/ { s/snapshots/releases\/18.06.8/g; }'  /etc/opkg/distfeeds.conf
 sed -i "s/# //g" /etc/opkg/distfeeds.conf
--- a/package/libs/libselinux/Makefile
+++ b/package/libs/libselinux/Makefile
@@ -37,6 +37,13 @@ define Package/libselinux/description
 	older version supported by the kernel) when loading policy.
 endef

+define Package/libselinux-utils
+  SECTION:=utils
+  DEPENDS:=+libselinux
+  CATEGORY:=Utilities
+  TITLE:=Runtime SELinux utilities
+  URL:=http://selinuxproject.org/page/Main_Page
+endef

 # Needed to link libselinux utilities, which link against
 # libselinux.so, which indirectly depends on libpcre.so, installed in
@@ -76,5 +83,11 @@ define Package/libselinux/install
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libselinux.so.* $(1)/usr/lib/
 endef

+define Package/libselinux-utils/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/* $(1)/usr/sbin
+endef
+
 $(eval $(call HostBuild))
 $(eval $(call BuildPackage,libselinux))
+$(eval $(call BuildPackage,libselinux-utils))
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=mbedtls
-PKG_VERSION:=2.16.7
+PKG_VERSION:=2.16.8
 PKG_RELEASE:=1
 PKG_USE_MIPS16:=0

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=c95b11557ee97d2bdfd48cd57cf9b648a6cddd2ca879e3c35c4e7525f2871992
+PKG_HASH:=fe9e3b15c3375943bdfebbbb20dd6b4f1147b3b5d926248bd835d73247407430

 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0-or-later
--- a/package/libs/mbedtls/patches/200-config.patch
+++ b/package/libs/mbedtls/patches/200-config.patch
@@ -1,6 +1,6 @@
 --- a/include/mbedtls/config.h
 +++ b/include/mbedtls/config.h
-@@ -658,14 +658,14 @@
+@@ -692,14 +692,14 @@
  *
  * Enable Output Feedback mode (OFB) for symmetric ciphers.
  */
@@ -17,7 +17,7 @@
 
 /**
  * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -782,19 +782,19 @@
+@@ -816,19 +816,19 @@
  *
  * Comment macros to disable the curve and functions for it
  */
@@ -46,7 +46,7 @@
 
 /**
  * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -918,7 +918,7 @@
+@@ -952,7 +952,7 @@
  *             See dhm.h for more details.
  *
  */
@@ -55,7 +55,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -938,7 +938,7 @@
+@@ -972,7 +972,7 @@
  *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
  *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
  */
@@ -64,7 +64,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -963,7 +963,7 @@
+@@ -997,7 +997,7 @@
  *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
  *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
  */
@@ -73,7 +73,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1097,7 +1097,7 @@
+@@ -1131,7 +1131,7 @@
  *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
  */
@@ -82,7 +82,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1121,7 +1121,7 @@
+@@ -1155,7 +1155,7 @@
  *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
  */
@@ -91,7 +91,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1225,7 +1225,7 @@
+@@ -1259,7 +1259,7 @@
  * This option is only useful if both MBEDTLS_SHA256_C and
  * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
  */
@@ -100,7 +100,7 @@
 
 /**
  * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1320,14 +1320,14 @@
+@@ -1354,14 +1354,14 @@
  * Uncomment this macro to disable the use of CRT in RSA.
  *
  */
@@ -117,7 +117,7 @@
 
 /**
  * \def MBEDTLS_SHA256_SMALLER
-@@ -1481,7 +1481,7 @@
+@@ -1515,7 +1515,7 @@
  *          configuration of this extension).
  *
  */
@@ -126,7 +126,7 @@
 
 /**
  * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1656,7 +1656,7 @@
+@@ -1690,7 +1690,7 @@
  *
  * Comment this macro to disable support for SSL session tickets
  */
@@ -135,7 +135,7 @@
 
 /**
  * \def MBEDTLS_SSL_EXPORT_KEYS
-@@ -1686,7 +1686,7 @@
+@@ -1720,7 +1720,7 @@
  *
  * Comment this macro to disable support for truncated HMAC in SSL
  */
@@ -144,7 +144,7 @@
 
 /**
  * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -1745,7 +1745,7 @@
+@@ -1779,7 +1779,7 @@
  *
  * Comment this to disable run-time checking and save ROM space
  */
@@ -153,7 +153,7 @@
 
 /**
  * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2075,7 +2075,7 @@
+@@ -2109,7 +2109,7 @@
  *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
  */
@@ -162,7 +162,7 @@
 
 /**
  * \def MBEDTLS_ARIA_C
-@@ -2141,7 +2141,7 @@
+@@ -2175,7 +2175,7 @@
  * This module enables the AES-CCM ciphersuites, if other requisites are
  * enabled as well.
  */
@@ -171,7 +171,7 @@
 
 /**
  * \def MBEDTLS_CERTS_C
-@@ -2153,7 +2153,7 @@
+@@ -2187,7 +2187,7 @@
  *
  * This module is used for testing (ssl_client/server).
  */
@@ -180,7 +180,7 @@
 
 /**
  * \def MBEDTLS_CHACHA20_C
-@@ -2261,7 +2261,7 @@
+@@ -2295,7 +2295,7 @@
  * \warning   DES is considered a weak cipher and its use constitutes a
  *            security risk. We recommend considering stronger ciphers instead.
  */
@@ -189,7 +189,7 @@
 
 /**
  * \def MBEDTLS_DHM_C
-@@ -2424,7 +2424,7 @@
+@@ -2458,7 +2458,7 @@
  * This module adds support for the Hashed Message Authentication Code
  * (HMAC)-based key derivation function (HKDF).
  */
@@ -198,7 +198,7 @@
 
 /**
  * \def MBEDTLS_HMAC_DRBG_C
-@@ -2734,7 +2734,7 @@
+@@ -2768,7 +2768,7 @@
  *
  * This module enables abstraction of common (libc) functions.
  */
@@ -207,7 +207,7 @@
 
 /**
  * \def MBEDTLS_POLY1305_C
-@@ -2755,7 +2755,7 @@
+@@ -2789,7 +2789,7 @@
  * Caller:  library/md.c
  *
  */
@@ -216,7 +216,7 @@
 
 /**
  * \def MBEDTLS_RSA_C
-@@ -2862,7 +2862,7 @@
+@@ -2896,7 +2896,7 @@
  *
  * Requires: MBEDTLS_CIPHER_C
  */
@@ -225,7 +225,7 @@
 
 /**
  * \def MBEDTLS_SSL_CLI_C
-@@ -2962,7 +2962,7 @@
+@@ -2996,7 +2996,7 @@
  *
  * This module provides run-time version information.
  */
@@ -234,7 +234,7 @@
 
 /**
  * \def MBEDTLS_X509_USE_C
-@@ -3072,7 +3072,7 @@
+@@ -3106,7 +3106,7 @@
  * Module:  library/xtea.c
  * Caller:
  */
--- a/package/libs/nghttp2/Makefile
+++ b/package/libs/nghttp2/Makefile
@@ -1,44 +0,0 @@
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=nghttp2
-PKG_VERSION:=1.41.0
-PKG_RELEASE:=1
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_SOURCE_URL:=https://github.com/nghttp2/nghttp2/releases/download/v$(PKG_VERSION)
-PKG_HASH:=abc25b8dc601f5b3fefe084ce50fcbdc63e3385621bee0cbfa7b57f9ec3e67c2
-
-PKG_LICENSE:=MIT
-PKG_LICENSE_FILES:=COPYING
-CMAKE_INSTALL:=1
-
-include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/cmake.mk
-
-define Package/libnghttp2
-  SECTION:=libs
-  CATEGORY:=Libraries
-  TITLE:=Library implementing the framing layer of HTTP/2
-  MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
-  ABI_VERSION:=14
-endef
-
-define Package/libnghttp2/description
- C library implementing the framing layer of the HTTP/2 protocol. It can be used to build a HTTP/2-capable HTTP client or server
-endef
-
-CMAKE_OPTIONS += \
-        -DENABLE_LIB_ONLY=ON
-
-define Build/InstallDev
-	$(call Build/InstallDev/cmake,$(1))
-	$(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libnghttp2.pc
-	$(SED) 's,/usr/lib,$$$${prefix}/lib,g' $(1)/usr/lib/pkgconfig/libnghttp2.pc
-endef
-
-define Package/libnghttp2/install
-	$(INSTALL_DIR) $(1)/usr/lib
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libnghttp2.so.* $(1)/usr/lib
-endef
-
-$(eval $(call BuildPackage,libnghttp2))
--- a/package/lienol/luci-app-passwall/Makefile
+++ b/package/lienol/luci-app-passwall/Makefile
@@ -7,8 +7,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=3.9
-PKG_RELEASE:=51
-PKG_DATE:=20200903
+PKG_RELEASE:=52
+PKG_DATE:=20200905

 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

@@ -16,14 +16,10 @@ include $(INCLUDE_DIR)/package.mk

 define Package/$(PKG_NAME)/config
 menu "Configuration"
-
-config PACKAGE_$(PKG_NAME)_INCLUDE_ipt2socks
-	bool "Include ipt2socks"
-	default y
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks
 	bool "Include Shadowsocks"
-	default n
+	default y
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR
 	bool "Include ShadowsocksR"
@@ -35,7 +31,7 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_Server
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_V2ray
 	bool "Include V2ray"
-	default y
+	default y if i386||x86_64||arm||aarch64

 config PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus
 	bool "Include Trojan_Plus"
@@ -43,7 +39,7 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_Plus
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_Trojan_GO
 	bool "Include Trojan_GO"
-	default n
+	default y if i386||x86_64||arm||aarch64
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_Brook
 	bool "Include Brook"
@@ -59,11 +55,7 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_haproxy
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS_NG
 	bool "Include ChinaDNS-NG"
-	default y
-	
-config PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd
-	bool "Include pdnsd"
-	default y
+	default n
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_https_dns_proxy
 	bool "Include Https DNS Proxy(DoH)"
@@ -71,15 +63,15 @@ config PACKAGE_$(PKG_NAME)_INCLUDE_https_dns_proxy
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks
 	bool "Include dns2socks"
-	default y
+	default n
 	
 config PACKAGE_$(PKG_NAME)_INCLUDE_v2ray-plugin
 	bool "Include v2ray-plugin (Shadowsocks plugin)"
-	default n
+	default y if i386||x86_64||arm||aarch64

 config PACKAGE_$(PKG_NAME)_INCLUDE_simple-obfs
 	bool "Include simple-obfs (Shadowsocks plugin)"
-	default n
+	default y if i386||x86_64||arm||aarch64

 endmenu
 endef
@@ -91,7 +83,8 @@ define Package/$(PKG_NAME)
  PKGARCH:=all
  DEPENDS:=+libmbedtls +iptables-mod-tproxy +ip +ipset +coreutils +coreutils-base64 +coreutils-nohup +luci-lib-jsonc \
  +curl +ca-certificates +resolveip +unzip +dnsmasq-full +tcping +libuci-lua \
-  +PACKAGE_$(PKG_NAME)_INCLUDE_ipt2socks:ipt2socks \
+  +ipt2socks \
+  +pdnsd-alt \
  +PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks:shadowsocks-libev-ss-redir \
  +PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks:shadowsocks-libev-ss-local \
  +PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR:shadowsocksr-libev-alt \
@@ -104,7 +97,6 @@ define Package/$(PKG_NAME)
  +PACKAGE_$(PKG_NAME)_INCLUDE_kcptun:kcptun-client \
  +PACKAGE_$(PKG_NAME)_INCLUDE_haproxy:haproxy \
  +PACKAGE_$(PKG_NAME)_INCLUDE_ChinaDNS_NG:chinadns-ng \
-  +PACKAGE_$(PKG_NAME)_INCLUDE_pdnsd:pdnsd-alt \
  +PACKAGE_$(PKG_NAME)_INCLUDE_https_dns_proxy:https-dns-proxy \
  +PACKAGE_$(PKG_NAME)_INCLUDE_dns2socks:dns2socks \
  +PACKAGE_$(PKG_NAME)_INCLUDE_v2ray-plugin:v2ray-plugin \
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/client/global.lua
@@ -24,10 +24,6 @@ uci:foreach(appname, "nodes", function(e)
 end)

 local socks_table = {}
-socks_table[#socks_table + 1] = {
-    id = "",
-    remarks = "127.0.0.1:9050 - dns2sock" .. translate(" Default")
-}
 uci:foreach(appname, "socks", function(s)
    if s.enabled == "1" and s.node then
        local id, remarks
@@ -101,6 +97,15 @@ end

 s:tab("DNS", translate("DNS"))

+if api.is_finded("chinadns-ng") then
+    o = s:taboption("DNS", Flag, "chinadns_ng", translate("Use ChinaDNS-NG"), translate("When checked, forced to be set to dnsmasq upstream DNS."))
+    o.default = "0"
+
+    o = s:taboption("DNS", Flag, "fair_mode", translate("ChinaDNS-NG Fair Mode"))
+    o.default = "1"
+    o:depends("chinadns_ng", "1")
+end
+
 o = s:taboption("DNS", Value, "up_china_dns", translate("Resolver For Local/WhiteList Domains") .. "(UDP)")
 o.description = translate("IP:Port mode acceptable, multi value split with english comma.") .. "<br />" .. translate("When the selection is not the default, this DNS is forced to be set to dnsmasq upstream DNS.")
 o.default = "default"
@@ -118,24 +123,18 @@ o:value("1.2.4.8", "1.2.4.8 (CNNIC DNS)")
 o:value("210.2.4.8", "210.2.4.8 (CNNIC DNS)")
 o:value("180.76.76.76", "180.76.76.76 (" .. translate("Baidu") .. "DNS)")

---- DoH URL
-o = s:taboption("DNS", Value, "up_china_dns_doh_url", translate("DoH request address"))
-o.default = "https://dns.alidns.com/dns-query"
-o:depends("up_china_dns", "https-dns-proxy")
-
---- DoH Bootstrap
-o = s:taboption("DNS", Value, "up_china_dns_doh_bootstrap", translate("DoH bootstrap DNS"), translate("The Bootstrap DNS server is used to resolve the IP address of the DoH resolver you specify as the upstream."))
-o.default = "223.5.5.5,223.6.6.6"
+---- DoH
+o = s:taboption("DNS", Value, "up_china_dns_doh", translate("DoH request address"))
+o.description = translate("When custom, Please follow the format strictly:") .. "<br />" .. "https://dns.alidns.com/dns-query,223.5.5.5,223.6.6.6<br />" .. "https://doh.pub/dns-query,119.29.29.29"
+o:value("https://dns.alidns.com/dns-query,223.5.5.5,223.6.6.6", "AliDNS")
+o:value("https://doh.pub/dns-query,119.29.29.29,119.28.28.28", "DNSPod")
+o.default = "https://dns.alidns.com/dns-query,223.5.5.5,223.6.6.6"
 o:depends("up_china_dns", "https-dns-proxy")

 ---- DNS Forward Mode
-o = s:taboption("DNS", Value, "dns_mode", translate("Filter Mode"))
-o.description = translate("When the selection is chinadns-ng, forced to be set to dnsmasq upstream DNS.")
+o = s:taboption("DNS", ListValue, "dns_mode", translate("Filter Mode"))
 o.rmempty = false
 o:reset_values()
-if api.is_finded("chinadns-ng") then
-    o:value("chinadns-ng", "ChinaDNS-NG")
-end
 if api.is_finded("pdnsd") then
    o:value("pdnsd", "pdnsd")
 end
@@ -145,69 +144,45 @@ end
 if api.is_finded("https-dns-proxy") then
    o:value("https-dns-proxy", "https-dns-proxy(DoH)")
 end
+o:value("udp", translatef("Requery DNS By %s", translate("UDP Node")))
 o:value("nonuse", translate("No Filter"))
+o:value("custom", translate("Custom DNS"))
+
+---- Custom DNS
+o = s:taboption("DNS", Value, "custom_dns", translate("Custom DNS"))
+o.default = "127.0.0.1#5353"
+o:depends({dns_mode = "custom"})

 o = s:taboption("DNS", ListValue, "up_trust_pdnsd_dns", translate("Resolver For The List Proxied"))
 -- o.description = translate("You can use other resolving DNS services as trusted DNS, Example: dns2socks, dns-forwarder... 127.0.0.1#5353<br />Only use two at most, english comma separation, If you do not fill in the # and the following port, you are using port 53.")
-o.default = ""
-if api.is_finded("pdnsd") then
-    o:value("", "pdnsd + " .. translate("Access Filtered DNS By ") .. translate("TCP Node"))
-end
-o:value("udp", translate("Access Filtered DNS By ") .. translate("UDP Node"))
-if api.is_finded("dns2socks") then
-    o:value("dns2socks", "dns2socks")
-end
+o.default = "tcp"
+o:value("tcp", translatef("Requery DNS By %s", translate("TCP Node")))
+o:value("udp", translatef("Requery DNS By %s", translate("UDP Node")))
 o:depends("dns_mode", "pdnsd")

-o = s:taboption("DNS", ListValue, "up_trust_chinadns_ng_dns", translate("Resolver For The List Proxied") .. "(UDP)")
-o.default = "pdnsd"
-if api.is_finded("pdnsd") then
-    o:value("pdnsd", "pdnsd, " .. translate("Access Filtered DNS By ") .. translate("TCP Node"))
-end
-o:value("udp", translate("Access Filtered DNS By ") .. translate("UDP Node"))
-if api.is_finded("dns2socks") then
-    o:value("dns2socks", "dns2socks")
-end
-if api.is_finded("https-dns-proxy") then
-    o:value("https-dns-proxy", "https-dns-proxy(DoH)")
-end
-o:depends("dns_mode", "chinadns-ng")
-
 o = s:taboption("DNS", ListValue, "up_trust_doh_dns", translate("Resolver For The List Proxied"))
-o:value("tcp", translate("Access Filtered DNS By ") .. translate("TCP Node"))
-o:value("socks", translate("Access Filtered DNS By ") .. translate("Socks Node"))
+o:value("tcp", translatef("Requery DNS By %s", translate("TCP Node")))
+o:value("socks", translatef("Requery DNS By %s", translate("Socks Node")))
 o:depends("dns_mode", "https-dns-proxy")
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})

---- Upstream trust DNS Mode for ChinaDNS-NG
-o = s:taboption("DNS", Value, "socks_server", translate("Socks Server"), translate("Make sure socks service is available on this address if 'dns2socks' selected."))
-o.default = ""
+o = s:taboption("DNS", Value, "socks_server", translate("Socks Server"), translate("Make sure socks service is available on this address."))
 for k, v in pairs(socks_table) do o:value(v.id, v.remarks) end
-o:depends({dns_mode = "pdnsd", up_trust_pdnsd_dns = "dns2socks"})
 o:depends({dns_mode = "dns2socks"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})
 o:depends({dns_mode = "https-dns-proxy", up_trust_doh_dns = "socks"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy", up_trust_doh_dns = "socks"})

-o = s:taboption("DNS", Flag, "fair_mode", translate("ChinaDNS-NG Fair Mode"))
-o.default = "1"
-o:depends({dns_mode = "chinadns-ng"})
-
---- DoH URL
-o = s:taboption("DNS", Value, "doh_url", translate("DoH request address"))
-o.default = "https://dns.google/dns-query"
+---- DoH
+o = s:taboption("DNS", Value, "up_trust_doh", translate("DoH request address"))
+o.description = translate("When custom, Please follow the format strictly:") .. "<br />" .. "https://dns.google/dns-query,8.8.8.8,8.8.4.4<br />" .. "https://doh.opendns.com/dns-query,208.67.222.222"
+o:value("https://dns.adguard.com/dns-query,176.103.130.130,176.103.130.131", "AdGuard")
+o:value("https://cloudflare-dns.com/dns-query,1.1.1.1,1.0.0.1", "Cloudflare")
+o:value("https://security.cloudflare-dns.com/dns-query,1.1.1.2,1.0.0.2", "Cloudflare-Security")
+o:value("https://doh.opendns.com/dns-query,208.67.222.222,208.67.220.220", "OpenDNS")
+o:value("https://dns.google/dns-query,8.8.8.8,8.8.4.4", "Google")
+o:value("https://doh.libredns.gr/dns-query,116.202.176.26", "LibreDNS")
+o:value("https://doh.libredns.gr/ads,116.202.176.26", "LibreDNS (No Ads)")
+o:value("https://dns.quad9.net/dns-query,9.9.9.9,149.112.112.112", "Quad9-Recommended")
+o.default = "https://dns.google/dns-query,8.8.8.8,8.8.4.4"
 o:depends({dns_mode = "https-dns-proxy"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})
-
---- DoH Bootstrap
-o = s:taboption("DNS", Value, "doh_bootstrap", translate("DoH bootstrap DNS"), translate("The Bootstrap DNS server is used to resolve the IP address of the DoH resolver you specify as the upstream."))
-o.default = "8.8.4.4"
-o:value("8.8.4.4", "8.8.4.4 (Google DNS)")
-o:value("8.8.8.8", "8.8.8.8 (Google DNS)")
-o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
-o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
-o:depends({dns_mode = "https-dns-proxy"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "https-dns-proxy"})

 ---- DNS Forward
 o = s:taboption("DNS", Value, "dns_forward", translate("Filtered DNS(For Proxied Domains)"), translate("IP:Port mode acceptable, the 1st for 'dns2socks' if split with english comma."))
@@ -218,16 +193,14 @@ o:value("208.67.222.222", "208.67.222.222 (Open DNS)")
 o:value("208.67.220.220", "208.67.220.220 (Open DNS)")
 o:depends({dns_mode = "dns2socks"})
 o:depends({dns_mode = "pdnsd"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "pdnsd"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "udp"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})
+o:depends({dns_mode = "udp"})

+--[[
 o = s:taboption("DNS", Flag, "dns_cache", translate("Cache Resolved"))
 o.default = "1"
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "pdnsd"})
-o:depends({dns_mode = "chinadns-ng", up_trust_chinadns_ng_dns = "dns2socks"})
 o:depends({dns_mode = "dns2socks"})
 o:depends({dns_mode = "pdnsd"})
+]]--

 o = s:taboption("DNS", Flag, "use_chnlist", translate("Use ChinaList"), translate("Only useful in non-gfwlist mode.") .. "<br />" .. translate("When used, the domestic DNS will be used only when the chnlist rule is hit, and the domain name that misses the rule will be resolved by remote DNS."))
 o.default = "0"
--- a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
+++ b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
@@ -145,6 +145,9 @@ msgstr "过滤模式"
 msgid "No Filter"
 msgstr "不过滤"

+msgid "Custom DNS"
+msgstr "自定义DNS"
+
 msgid "IP:Port mode ecceptable for specify other filtered name services."
 msgstr "定义接受 IP:Port 形式的输入，以指定其它域名服务的过滤服务。"

@@ -157,8 +160,14 @@ msgstr "接受 IP:Port 形式的输入，多个以英文逗号分隔。"
 msgid "When the selection is not the default, this DNS is forced to be set to dnsmasq upstream DNS."
 msgstr "当选择的不是默认，则将此DNS强制设置为dnsmasq上游DNS。"

-msgid "When the selection is chinadns-ng, forced to be set to dnsmasq upstream DNS."
-msgstr "当选择的是ChinaDNS-NG，则将强制设置为dnsmasq上游DNS。"
+msgid "When custom, Please follow the format strictly:"
+msgstr "当自定义时，请严格遵循以下格式："
+
+msgid "Use ChinaDNS-NG"
+msgstr "使用ChinaDNS-NG"
+
+msgid "When checked, forced to be set to dnsmasq upstream DNS."
+msgstr "当勾选，则将强制设置为dnsmasq上游DNS。"

 msgid "Use ChinaList"
 msgstr "使用chnlist"
@@ -178,8 +187,8 @@ msgstr "百度"
 msgid "Resolver For The List Proxied"
 msgstr "解析被代理的域名列表"

-msgid "Access Filtered DNS By"
-msgstr "由过滤DNS解析，经过"
+msgid "Requery DNS By %s"
+msgstr "通过%s请求DNS"

 msgid "Forward To Socks Server"
 msgstr "转发至 Socks 服务器"
@@ -190,8 +199,8 @@ msgstr "Socks服务器"
 msgid "Misconfigured"
 msgstr "配置不当"

-msgid "Make sure socks service is available on this address if 'dns2socks' selected."
-msgstr "如启用了 'dns2socks' 请确保此Socks服务可用。"
+msgid "Make sure socks service is available on this address."
+msgstr "请确保此Socks服务可用。"

 msgid "ChinaDNS-NG Fair Mode"
 msgstr "ChinaDNS-NG 公平模式"
--- a/package/lienol/luci-app-passwall/root/etc/config/passwall
+++ b/package/lienol/luci-app-passwall/root/etc/config/passwall
@@ -6,7 +6,7 @@ config global
 	option dns_mode 'pdnsd'
 	option up_china_dns 'default'
 	option dns_forward '8.8.4.4'
-	option use_chnlist '1'
+	option use_chnlist '0'
 	option use_tcp_node_resolve_dns '1'
 	option tcp_proxy_mode 'chnroute'
 	option udp_proxy_mode 'chnroute'
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/app.sh
@@ -46,7 +46,7 @@ config_t_get() {
 }

 get_enabled_anonymous_secs() {
-	uci -q show "${CONFIG}" | grep "${1}\[.*\.enabled='1'" | cut -d'.' -sf2
+	uci -q show "${CONFIG}" | grep "${1}\[.*\.enabled='1'" | cut -d '.' -sf2
 }

 get_host_ip() {
@@ -282,6 +282,7 @@ load_config() {
 		NO_PROXY=1
 	}
 	
+	CHINADNS_NG=$(config_t_get global chinadns_ng 0)
 	DNS_MODE=$(config_t_get global dns_mode pdnsd)
 	DNS_FORWARD=$(config_t_get global dns_forward 8.8.4.4:53 | sed 's/:/#/g')
 	DNS_CACHE=$(config_t_get global dns_cache 1)
@@ -597,7 +598,7 @@ start_crontab() {
 	if [ "$autoupdate" = "1" ]; then
 		local t="0 $dayupdate * * $weekupdate"
 		[ "$weekupdate" = "7" ] && t="0 $dayupdate * * *"
-		echo "$t lua $APP_PATH/rule_update.lua nil log > /dev/null 2>&1 &" >>/etc/crontabs/root
+		echo "$t lua $APP_PATH/rule_update.lua log > /dev/null 2>&1 &" >>/etc/crontabs/root
 		echolog "配置定时任务：自动更新规则。"
 	fi

@@ -630,30 +631,78 @@ stop_crontab() {

 start_dns() {
 	if [ "${LOCAL_DNS}" = "https-dns-proxy" ]; then
-		up_china_dns_doh_url=$(config_t_get global up_china_dns_doh_url "https://dns.alidns.com/dns-query")
-		up_china_dns_doh_bootstrap=$(config_t_get global up_china_dns_doh_bootstrap "223.5.5.5,223.6.6.6")
-		ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${LOCAL_DOH_PORT}" -b "${up_china_dns_doh_bootstrap}" -r "${up_china_dns_doh_url}" -4
+		_doh=$(config_t_get global up_china_dns_doh "https://dns.alidns.com/dns-query,223.5.5.5,223.6.6.6,2400:3200::1,2400:3200:baba::1")
+		_doh_url=$(echo $_doh | awk -F ',' '{print $1}')
+		_doh_bootstrap=$(echo $_doh | cut -d ',' -sf 2-)
+		ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${LOCAL_DOH_PORT}" -b "${_doh_bootstrap}" -r "${_doh_url}" -4
 		LOCAL_DNS="127.0.0.1#${LOCAL_DOH_PORT}"
+		unset _doh _doh_url _doh_bootstrap
 	fi

-	local dns2socks_socks_server dns2socks_forward dns2sock_cache doh_port pdnsd_port pdnsd_forward other_port up_trust_pdnsd_dns msg
-	local global chnlist returnhome china_ng_chn china_ng_gfw chnlist_param gfwlist_param extra_mode up_trust_chinadns_ng_dns
-	dns2socks_socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:9050) | sed "s/#/:/g")
-	dns2socks_forward=$(get_first_dns DNS_FORWARD 53 | sed 's/#/:/g')
-	dns2socks_listen="127.0.0.1:${DNS_PORT}"
-	[ "$DNS_CACHE" == "0" ] && dns2sock_cache="/d"
-	doh_port=${DNS_PORT}
-	pdnsd_port=${DNS_PORT}
+	local pdnsd_forward other_port up_trust_pdnsd_dns msg
+	local global chnlist returnhome china_ng_chn china_ng_gfw chnlist_param gfwlist_param extra_mode
+	dns_listen_port=${DNS_PORT}
 	pdnsd_forward=${DNS_FORWARD}
-	china_ng_chn="${LOCAL_DNS}"
 	other_port=$(expr $DNS_PORT + 1)
 	china_ng_gfw="127.0.0.1#${other_port}"
+	china_ng_chn="${LOCAL_DNS}"
 	returnhome=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "returnhome")
 	global=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "global")
 	chnlist=$(echo "${TCP_PROXY_MODE}${LOCALHOST_TCP_PROXY_MODE}${UDP_PROXY_MODE}${LOCALHOST_UDP_PROXY_MODE}" | grep "chnroute")
 	[ -n "${returnhome}" ] && china_ng_chn="${china_ng_gfw}" && china_ng_gfw="${LOCAL_DNS}"
 	sed -n 's/^ipset=\/\.\?\([^/]*\).*$/\1/p' "${RULES_PATH}/gfwlist.conf" | sort -u > "${TMP_PATH}/gfwlist.txt"
 	echolog "过滤服务配置：准备接管域名解析[$?]..."
+	
+	[ "$CHINADNS_NG" = "1" ] && {
+		echolog "  | - (chinadns-ng) 只支持2~4级的域名过滤..."
+		[ -z "${global}${chnlist}" ] && echolog "  | - (chinadns-ng) 此模式下，列表外的域名查询会同时发送给本地DNS(可切换到Pdnsd + TCP节点模式解决)..."
+		[ -n "${returnhome}" ] && msg="本地" || msg="代理"
+		[ -z "${global}${chnlist}" ] && echolog "  | - (chinadns-ng) 列表外域名查询的结果，不在中国IP段内(chnroute/chnroute6)时，只采信${msg} DNS 的应答..."
+		echolog "  | - (chinadns-ng) 上游 DNS (${china_ng_gfw}) 有一定概率会比 DNS (${china_ng_chn}) 先返回的话(比如 DNS 的本地查询缓存)，启用 '公平模式' 可以优先接受${msg} DNS 的中国IP段内(chnroute/chnroute6)的应答..."
+		if [ "$DNS_MODE" = "pdnsd" ]; then
+			msg="pdnsd"
+		elif [ "$DNS_MODE" = "dns2socks" ]; then
+			#[ -n "${global}${chnlist}" ] && TUN_DNS=${china_ng_gfw}
+			msg="dns2socks"
+		elif [ "$DNS_MODE" = "https-dns-proxy" ]; then
+			msg="https-dns-proxy(DoH)"
+		elif [ "$DNS_MODE" = "udp" ]; then
+			use_udp_node_resolve_dns=1
+			if [ -z "${returnhome}" ]; then
+				china_ng_gfw="${DNS_FORWARD}"
+			else
+				china_ng_chn="${DNS_FORWARD}"
+			fi
+			msg="udp"
+		elif [ "$DNS_MODE" = "custom" ]; then
+			custom_dns=$(config_t_get global custom_dns)
+			china_ng_gfw="$(echo ${custom_dns} | sed 's/:/#/g')"
+			msg="自定义DNS"
+		fi
+		chnlist_param=
+		[ "$USE_CHNLIST" = "1" ] && {
+			cp -a "${RULES_PATH}/chnlist" "${TMP_PATH}/chnlist"
+			if [ -z "${returnhome}" ]; then
+				cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist"
+				echolog "  | - [$?](chinadns-ng) 域名白名单合并到中国域名表"
+				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt"
+				echolog "  | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表"
+				gfwlist_param="${TMP_PATH}/gfwlist.txt"
+			else
+				echolog "  | - (chinadns-ng) 白名单不与中国域名表合并"
+				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist"
+				echolog "  | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表"
+			fi
+			chnlist_param="${TMP_PATH}/chnlist"
+			chnlist_param=${chnlist_param:+-m "${chnlist_param}" -M}
+		}
+		[ "$(config_t_get global fair_mode 1)" = "1" ] && extra_mode="-f"
+		ln_start_bin "$(first_type chinadns-ng)" chinadns-ng -l "${dns_listen_port}" ${china_ng_chn:+-c "${china_ng_chn}"} ${chnlist_param} ${china_ng_gfw:+-t "${china_ng_gfw}"} ${gfwlist_param:+-g "${gfwlist_param}"} $extra_mode
+		echolog "  + 过滤服务：ChinaDNS-NG(:${dns_listen_port}${extra_mode}) + ${msg}：中国域名列表：${china_ng_chn:-D114.114.114.114}，防火墙域名列表：${china_ng_gfw:-D8.8.8.8}"
+		#[ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS="${china_ng_gfw}"
+		dns_listen_port=${other_port}
+	}
+	
 	case "$DNS_MODE" in
 	nonuse)
 		echolog "  - 被禁用，设置为非 '默认DNS' 并开启广告过滤可以按本插件内置的广告域名表进行过滤..."
@@ -675,11 +724,7 @@ start_dns() {
 	;;
 	pdnsd)
 		up_trust_pdnsd_dns=$(config_t_get global up_trust_pdnsd_dns "nil")
-		if [ "$up_trust_pdnsd_dns" = "dns2socks" ]; then
-			[ -n "${returnhome}" ] && pdnsd_forward=${china_ng_chn} || pdnsd_forward=${china_ng_gfw}
-			dns2socks_listen=${pdnsd_forward}
-			msg="dns2socks"
-		elif [ "$up_trust_pdnsd_dns" = "udp" ]; then
+		if [ "$up_trust_pdnsd_dns" = "udp" ]; then
 			use_udp_node_resolve_dns=1
 			msg="UDP节点"
 		elif [ "${up_trust_pdnsd_dns}" = "nil" ]; then
@@ -687,82 +732,50 @@ start_dns() {
 		fi
 		echolog "  - 域名解析：pdnsd + 使用(${msg})解析域名..."
 	;;
-	chinadns-ng)
-		up_trust_chinadns_ng_dns=$(config_t_get global up_trust_chinadns_ng_dns "pdnsd")
-		echolog "  | - (chinadns-ng) 只支持2~4级的域名过滤..."
-		[ -z "${global}${chnlist}" ] && echolog "  | - (chinadns-ng) 此模式下，列表外的域名查询会同时发送给本地DNS(可切换到Pdnsd + TCP节点模式解决)..."
-		[ -n "${returnhome}" ] && msg="本地" || msg="代理"
-		[ -z "${global}${chnlist}" ] && echolog "  | - (chinadns-ng) 列表外域名查询的结果，不在中国IP段内(chnroute/chnroute6)时，只采信${msg} DNS 的应答..."
-		echolog "  | - (chinadns-ng) 上游 DNS (${china_ng_gfw}) 有一定概率会比 DNS (${china_ng_chn}) 先返回的话(比如 DNS 的本地查询缓存)，启用 '公平模式' 可以优先接受${msg} DNS 的中国IP段内(chnroute/chnroute6)的应答..."
-		if [ "$up_trust_chinadns_ng_dns" = "pdnsd" ]; then
-			pdnsd_port=${other_port}
-			msg="pdnsd"
-		elif [ "$up_trust_chinadns_ng_dns" = "dns2socks" ]; then
-			dns2socks_listen=${china_ng_gfw}
-			#[ -n "${global}${chnlist}" ] && TUN_DNS="${dns2socks_listen}"
-			msg="dns2socks"
-		elif [ "$up_trust_chinadns_ng_dns" = "https-dns-proxy" ]; then
-			doh_port=${other_port}
-			msg="https-dns-proxy(DoH)"
-		elif [ "$up_trust_chinadns_ng_dns" = "udp" ]; then
-			use_udp_node_resolve_dns=1
-			if [ -z "${returnhome}" ]; then
-				china_ng_gfw=${DNS_FORWARD}
-			else
-				china_ng_chn="${DNS_FORWARD}"
-			fi
-			msg="udp"
-		fi
-		chnlist_param=
-		[ "$USE_CHNLIST" = "1" ] && {
-			cp -a "${RULES_PATH}/chnlist" "${TMP_PATH}/chnlist"
-			if [ -z "${returnhome}" ]; then
-				cat "${RULES_PATH}/direct_host" >> "${TMP_PATH}/chnlist"
-				echolog "  | - [$?](chinadns-ng) 域名白名单合并到中国域名表"
-				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/gfwlist.txt"
-				echolog "  | - [$?](chinadns-ng) 代理域名表合并到防火墙域名表"
-				gfwlist_param="${TMP_PATH}/gfwlist.txt"
-			else
-				echolog "  | - (chinadns-ng) 白名单不与中国域名表合并"
-				cat "${RULES_PATH}/proxy_host" >> "${TMP_PATH}/chnlist"
-				echolog "  | - [$?](chinadns-ng) 忽略防火墙域名表，代理域名表合并到中国域名表"
-			fi
-			chnlist_param="${TMP_PATH}/chnlist"
-			chnlist_param=${chnlist_param:+-m "${chnlist_param}" -M}
-		}
-		[ "$(config_t_get global fair_mode 1)" = "1" ] && extra_mode="-f"
-		ln_start_bin "$(first_type chinadns-ng)" chinadns-ng -l "${DNS_PORT}" ${china_ng_chn:+-c "${china_ng_chn}"} ${chnlist_param} ${china_ng_gfw:+-t "${china_ng_gfw}"} ${gfwlist_param:+-g "${gfwlist_param}"} $extra_mode
-		echolog "  + 过滤服务：ChinaDNS-NG(:${DNS_PORT}${extra_mode}) + ${msg}：中国域名列表：${china_ng_chn:-D114.114.114.114}，防火墙域名列表：${china_ng_gfw:-D8.8.8.8}"
-		#[ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS="${china_ng_gfw}"
+	udp)
+		use_udp_node_resolve_dns=1
+		msg="直接使用UDP节点请求DNS"
 	;;
-	*)
-		TUN_DNS="$(echo ${DNS_MODE} | sed 's/:/#/g')"
-		DNS_MODE="other_dns"
-		echolog "  - 域名解析：指定DNS服务器(支持UDP查询)解析域名：${TUN_DNS}"
+	custom)
+		[ "$CHINADNS_NG" != "1" ] && {
+			custom_dns=$(config_t_get global custom_dns)
+			TUN_DNS="$(echo ${custom_dns} | sed 's/:/#/g')"
+			echolog "  - 域名解析 直接使用UDP协议自定义DNS（$TUN_DNS）解析..."
+		}
 	;;
 	esac
-	if [ -n "$(echo ${DNS_MODE}${up_trust_chinadns_ng_dns} | grep pdnsd)" ]; then
-		gen_pdnsd_config "${pdnsd_port}" "${pdnsd_forward}"
+	if [ -n "$(echo ${DNS_MODE} | grep pdnsd)" ]; then
+		gen_pdnsd_config "${dns_listen_port}" "${pdnsd_forward}"
 		ln_start_bin "$(first_type pdnsd)" pdnsd --daemon -c "${TMP_PATH}/pdnsd/pdnsd.conf" -d
 	fi
-	if [ -n "$(echo ${DNS_MODE}${up_trust_chinadns_ng_dns} | grep 'https-dns-proxy')" ]; then
-		doh_url=$(config_t_get global doh_url "https://dns.google/dns-query")
-		doh_bootstrap=$(config_t_get global doh_bootstrap "8.8.4.4")
+	if [ -n "$(echo ${DNS_MODE} | grep 'https-dns-proxy')" ]; then
+		up_trust_doh=$(config_t_get global up_trust_doh "https://dns.google/dns-query,8.8.8.8,8.8.4.4")
+		_doh_url=$(echo $up_trust_doh | awk -F ',' '{print $1}')
+		_doh_bootstrap=$(echo $up_trust_doh | cut -d ',' -sf 2-)
 		
 		up_trust_doh_dns=$(config_t_get global up_trust_doh_dns "tcp")
 		if [ "$up_trust_doh_dns" = "socks" ]; then
 			socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:9050) | sed "s/#/:/g")
-			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${doh_port}" -b "${doh_bootstrap}" -r "${doh_url}" -4 -t socks5h://${socks_server}
+			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${dns_listen_port}" -b "${_doh_bootstrap}" -r "${_doh_url}" -4 -t socks5h://${socks_server}
 		elif [ "${up_trust_doh_dns}" = "tcp" ]; then
-			DNS_FORWARD=${doh_bootstrap}:443
-			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${doh_port}" -b "${doh_bootstrap}" -r "${doh_url}" -4
+			DNS_FORWARD=""
+			_doh_bootstrap_dns=$(echo $_doh_bootstrap | sed "s/,/ /g")
+			for _dns in $_doh_bootstrap_dns; do
+				_dns=$(echo $_dns | awk -F ':' '{print $1}'):443
+				[ -n "$DNS_FORWARD" ] && DNS_FORWARD=${DNS_FORWARD},${_dns} || DNS_FORWARD=${_dns}
+			done
+			ln_start_bin "$(first_type https-dns-proxy)" https-dns-proxy -a 127.0.0.1 -p "${dns_listen_port}" -b "${_doh_bootstrap}" -r "${_doh_url}" -4
+			unset _dns _doh_bootstrap_dns
 		fi
+		unset _doh_url _doh_bootstrap
 	fi
-	if [ -n "$(echo ${DNS_MODE}${up_trust_chinadns_ng_dns}${up_trust_pdnsd_dns} | grep dns2socks)" ]; then
-		dns2socks_listen=$(echo "${dns2socks_listen}" | sed 's/#/:/g')
-		ln_start_bin "$(first_type dns2socks)" dns2socks "$dns2socks_socks_server" "$dns2socks_forward" "$dns2socks_listen" $dns2sock_cache
-		echolog "  - dns2sock(${dns2socks_listen}${dns2sock_cache})，${dns2socks_socks_server:-127.0.0.1:9050} -> ${dns2socks_forward-D46.182.19.48:53}"
-		#[ "${DNS_MODE}" = "chinadns-ng" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS=$(echo "${dns2socks_listen}" | sed 's/:/#/g')
+	if [ -n "$(echo ${DNS_MODE}${up_trust_pdnsd_dns} | grep dns2socks)" ]; then
+		local dns2socks_socks_server=$(echo $(config_t_get global socks_server 127.0.0.1:9050) | sed "s/#/:/g")
+		local dns2socks_forward=$(get_first_dns DNS_FORWARD 53 | sed 's/#/:/g')
+		[ "$DNS_CACHE" == "0" ] && local dns2sock_cache="/d"
+		ln_start_bin "$(first_type dns2socks)" dns2socks "$dns2socks_socks_server" "$dns2socks_forward" "127.0.0.1:$dns_listen_port" $dns2sock_cache
+		echolog "  - dns2sock(127.0.0.1:${dns_listen_port}${dns2sock_cache})，${dns2socks_socks_server:-127.0.0.1:9050} -> ${dns2socks_forward-D46.182.19.48:53}"
+		#[ "$CHINADNS_NG" = "1" ] && [ -n "${global}${chnlist}" ] && [ -z "${returnhome}" ] && TUN_DNS=$(echo "${dns_listen_port}" | sed 's/:/#/g')
 	fi
 	[ "${use_udp_node_resolve_dns}" = "1" ] && echolog "  * 要求代理 DNS 请求，如上游 DNS 非直连地址，确保 UDP 代理打开，并且已经正确转发"
 	[ "${use_tcp_node_resolve_dns}" = "1" ] && echolog "  * 请确认上游 DNS 支持 TCP 查询，如非直连地址，确保 TCP 代理打开，并且已经正确转发"
@@ -798,7 +811,7 @@ add_dnsmasq() {
 		#始终用国内DNS解析直连（白名单）列表		
 		fwd_dns="${LOCAL_DNS}"
 		#如果使用Chinadns-NG直接交给Chinadns-NG处理
-		[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+		[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 		#如果没使用chnlist直接使用默认DNS
 		[ "${USE_CHNLIST}" = "0" ] && unset fwd_dns
 		sort -u "${RULES_PATH}/direct_host" | gen_dnsmasq_items "whitelist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/direct_host.conf"
@@ -810,7 +823,7 @@ add_dnsmasq() {
 			[ -n "${returnhome}" ] || [ -n "${chnlist}" ] && {
 				[ -n "${global}" ] && unset fwd_dns
 				#如果使用Chinadns-NG直接交给Chinadns-NG处理
-				[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+				[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 				#如果使用回国模式，设置dns为远程DNS。
 				[ -n "${returnhome}" ] && fwd_dns="${TUN_DNS}"
 				sort -u "${RULES_PATH}/chnlist" | gen_dnsmasq_items "chnroute" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/chinalist_host.conf"
@@ -821,7 +834,7 @@ add_dnsmasq() {
 		#始终使用远程DNS解析代理（黑名单）列表
 		fwd_dns="${TUN_DNS}"
 		#如果使用Chinadns-NG直接交给Chinadns-NG处理
-		[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+		[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 		#如果使用chnlist直接使用默认DNS
 		[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 		sort -u "${RULES_PATH}/proxy_host" | gen_dnsmasq_items "blacklist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/proxy_host.conf"
@@ -831,7 +844,7 @@ add_dnsmasq() {
 		[ -z "${returnhome}" ] && {
 			fwd_dns="${TUN_DNS}"
 			#如果使用Chinadns-NG直接交给Chinadns-NG处理
-			[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+			[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 			#如果使用chnlist直接使用默认DNS
 			[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 			sort -u "${TMP_PATH}/gfwlist.txt" | gen_dnsmasq_items "gfwlist" "${fwd_dns}" "${TMP_DNSMASQ_PATH}/gfwlist.conf"
@@ -843,7 +856,7 @@ add_dnsmasq() {
 		[ "$(config_t_get global_subscribe subscribe_proxy 0)" = "1" ] && {
 			fwd_dns="${TUN_DNS}"
 			#如果使用Chinadns-NG直接交给Chinadns-NG处理
-			[ "${DNS_MODE}" = "chinadns-ng" ] && unset fwd_dns
+			[ "$CHINADNS_NG" = "1" ] && unset fwd_dns
 			#如果使用chnlist直接使用默认DNS
 			[ "${USE_CHNLIST}" = "1" ] && unset fwd_dns
 			items=$(get_enabled_anonymous_secs "@subscribe_list")
@@ -865,7 +878,7 @@ add_dnsmasq() {
 		[ -n "${chnlist}" ] && msg="中国列表以外"
 		[ -n "${returnhome}" ] && msg="中国列表"
 		[ -n "${global}" ] && msg="全局"
-		if [ "${DNS_MODE}" = "chinadns-ng" ]; then
+		if [ "$CHINADNS_NG" = "1" ]; then
 			#直接交给Chinadns-ng处理
 			servers="${TUN_DNS}" && msg="chinadns-ng"
 		else
@@ -1009,7 +1022,7 @@ start_haproxy() {
 		sort_items="${sort_items}${IFS}${lport} ${item}"
 	done

-	items=$(echo "${sort_items}" | sort -n | cut -d' ' -sf 2)
+	items=$(echo "${sort_items}" | sort -n | cut -d ' ' -sf 2)

 	unset lport
 	local haproxy_port lbss lbort lbweight export backup
@@ -1017,7 +1030,7 @@ start_haproxy() {
 	for item in ${items}; do
 		unset haproxy_port lbort bbackup

-		eval $(uci -q show "${CONFIG}.${item}" | cut -d'.' -sf 3-)
+		eval $(uci -q show "${CONFIG}.${item}" | cut -d '.' -sf 3-)
 		get_ip_port_from "$lbss" bip bport

 		[ "$lbort" = "default" ] && lbort=$bport || bport=$lbort
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/monitor.sh
@@ -75,7 +75,7 @@ do
 	done

 	#dns
-	if [ "$dns_mode" != "nonuse" ]; then
+	if [ "$dns_mode" != "nonuse" ] && [ "$dns_mode" != "custom" ]; then
 		icount=$(netstat -apn | grep 7913 | wc -l)
 		if [ $icount = 0 ]; then
 			/etc/init.d/passwall restart
--- a/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.lua
+++ b/package/lienol/luci-app-passwall/root/usr/share/passwall/rule_update.lua
@@ -55,8 +55,7 @@ end

 local log = function(...)
    if arg1 then
-        local result = os.date("%Y-%m-%d %H:%M:%S: ") ..
-                           table.concat({...}, " ")
+        local result = os.date("%Y-%m-%d %H:%M:%S: ") .. table.concat({...}, " ")
        if arg1 == "log" then
            local f, err = io.open("/var/log/passwall.log", "a")
            if f and err == nil then
--- a/package/utils/policycoreutils/Makefile
+++ b/package/utils/policycoreutils/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=policycoreutils
 PKG_VERSION:=3.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
@@ -22,6 +22,7 @@ PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING

 include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk

 define Package/policycoreutils
  SECTION:=utils
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -21,65 +21,62 @@ ifneq ($(CONFIG_SDK)$(CONFIG_PACKAGE_kmod-b43)$(CONFIG_PACKAGE_b43legacy-firmwar
  BUILD_B43_TOOLS = y
 endif

-tools-$(BUILD_TOOLCHAIN) += gmp mpfr mpc libelf expat
-tools-y += m4 libtool autoconf autoconf-archive automake flex bison pkg-config mklibs zlib
-tools-y += sstrip make-ext4fs e2fsprogs mtd-utils mkimage
-tools-y += firmware-utils patch-image quilt padjffs2
-tools-y += mm-macros missing-macros cmake bc findutils gengetopt patchelf
-tools-y += mtools dosfstools libressl fakeroot
-tools-y += ucl upx
-tools-$(CONFIG_TARGET_orion_generic) += wrt350nv2-builder upslug2
-tools-$(CONFIG_TARGET_x86) += qemu
-tools-$(CONFIG_TARGET_mxs) += elftosb sdimage
-tools-$(CONFIG_TARGET_ar71xx) += lzma-old
-tools-$(CONFIG_TARGET_ar71xx)$(CONFIG_TARGET_ath79) += squashfs
-tools-$(CONFIG_USES_MINOR) += kernel2minor
-tools-y += lzma squashfskit4 zip zstd
+tools-y += autoconf autoconf-archive automake bc bison cmake dosfstools
+tools-y += e2fsprogs fakeroot findutils firmware-utils flex gengetopt
+tools-y += libressl libtool lzma m4 make-ext4fs missing-macros mkimage
+tools-y += mklibs mm-macros mtd-utils mtools padjffs2 patch-image patchelf
+tools-y += pkg-config quilt squashfskit4 sstrip ucl upx zip zlib zstd
 tools-$(BUILD_B43_TOOLS) += b43-tools
 tools-$(BUILD_ISL) += isl
-tools-$(CONFIG_USE_SPARSE) += sparse
+tools-$(BUILD_TOOLCHAIN) += expat gmp libelf mpc mpfr
 tools-$(CONFIG_TARGET_apm821xx)$(CONFIG_TARGET_gemini) += genext2fs
+tools-$(CONFIG_TARGET_ar71xx) += lzma-old
+tools-$(CONFIG_TARGET_ar71xx)$(CONFIG_TARGET_ath79) += squashfs
+tools-$(CONFIG_TARGET_mxs) += elftosb sdimage
+tools-$(CONFIG_TARGET_orion_generic) += wrt350nv2-builder upslug2
 tools-$(CONFIG_TARGET_tegra) += cbootimage cbootimage-configs
+tools-$(CONFIG_TARGET_x86) += qemu
+tools-$(CONFIG_USES_MINOR) += kernel2minor
+tools-$(CONFIG_USE_SPARSE) += sparse

 # builddir dependencies
-$(curdir)/upx/compile := $(curdir)/ucl/compile
-$(curdir)/bison/compile := $(curdir)/flex/compile
-$(curdir)/flex/compile := $(curdir)/libtool/compile
-$(curdir)/libtool/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/automake/compile $(curdir)/missing-macros/compile
-$(curdir)/squashfs/compile := $(curdir)/lzma-old/compile
-$(curdir)/squashfskit4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
-$(curdir)/quilt/compile := $(curdir)/autoconf/compile $(curdir)/findutils/compile
 $(curdir)/autoconf/compile := $(curdir)/m4/compile
 $(curdir)/automake/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/pkg-config/compile $(curdir)/xz/compile
+$(curdir)/b43-tools/compile := $(curdir)/bison/compile
+$(curdir)/bc/compile := $(curdir)/bison/compile
+$(curdir)/bison/compile := $(curdir)/flex/compile
+$(curdir)/cbootimage/compile += $(curdir)/automake/compile
+$(curdir)/cmake/compile += $(curdir)/libressl/compile
+$(curdir)/dosfstools/compile := $(curdir)/autoconf/compile $(curdir)/automake/compile
+$(curdir)/e2fsprogs/compile := $(curdir)/libtool/compile
+$(curdir)/findutils/compile := $(curdir)/bison/compile
+$(curdir)/firmware-utils/compile += $(curdir)/libressl/compile $(curdir)/zlib/compile
+$(curdir)/flex/compile := $(curdir)/libtool/compile
+$(curdir)/gengetopt/compile := $(curdir)/libtool/compile
 $(curdir)/gmp/compile := $(curdir)/libtool/compile
+$(curdir)/isl/compile := $(curdir)/gmp/compile
+$(curdir)/libelf/compile := $(curdir)/libtool/compile
+$(curdir)/libressl/compile := $(curdir)/pkg-config/compile
+$(curdir)/libtool/compile := $(curdir)/m4/compile $(curdir)/autoconf/compile $(curdir)/automake/compile $(curdir)/missing-macros/compile
+$(curdir)/lzma-old/compile := $(curdir)/zlib/compile
+$(curdir)/make-ext4fs/compile := $(curdir)/zlib/compile
+$(curdir)/missing-macros/compile := $(curdir)/autoconf/compile
+$(curdir)/mkimage/compile += $(curdir)/libressl/compile
+$(curdir)/mklibs/compile := $(curdir)/libtool/compile
+$(curdir)/mm-macros/compile := $(curdir)/libtool/compile
 $(curdir)/mpc/compile := $(curdir)/mpfr/compile $(curdir)/gmp/compile
 $(curdir)/mpfr/compile := $(curdir)/gmp/compile
 $(curdir)/mtd-utils/compile := $(curdir)/libtool/compile $(curdir)/e2fsprogs/compile $(curdir)/zlib/compile
-$(curdir)/mklibs/compile := $(curdir)/libtool/compile
-$(curdir)/qemu/compile := $(curdir)/e2fsprogs/compile $(curdir)/zlib/compile
-$(curdir)/upslug2/compile := $(curdir)/libtool/compile
-$(curdir)/mm-macros/compile := $(curdir)/libtool/compile
-$(curdir)/missing-macros/compile := $(curdir)/autoconf/compile
-$(curdir)/e2fsprogs/compile := $(curdir)/libtool/compile
-$(curdir)/libelf/compile := $(curdir)/libtool/compile
-$(curdir)/sdcc/compile := $(curdir)/bison/compile
-$(curdir)/b43-tools/compile := $(curdir)/bison/compile
 $(curdir)/padjffs2/compile := $(curdir)/findutils/compile
-$(curdir)/isl/compile := $(curdir)/gmp/compile
-$(curdir)/bc/compile := $(curdir)/bison/compile
-$(curdir)/findutils/compile := $(curdir)/bison/compile
-$(curdir)/gengetopt/compile := $(curdir)/libtool/compile
 $(curdir)/patchelf/compile := $(curdir)/libtool/compile
-$(curdir)/dosfstools/compile := $(curdir)/autoconf/compile $(curdir)/automake/compile
-$(curdir)/libressl/compile := $(curdir)/pkg-config/compile
-$(curdir)/mkimage/compile += $(curdir)/libressl/compile
-$(curdir)/firmware-utils/compile += $(curdir)/libressl/compile $(curdir)/zlib/compile
-$(curdir)/cmake/compile += $(curdir)/libressl/compile
-$(curdir)/zlib/compile := $(curdir)/cmake/compile
+$(curdir)/qemu/compile := $(curdir)/e2fsprogs/compile $(curdir)/zlib/compile
+$(curdir)/quilt/compile := $(curdir)/autoconf/compile $(curdir)/findutils/compile
+$(curdir)/sdcc/compile := $(curdir)/bison/compile
+$(curdir)/squashfs/compile := $(curdir)/lzma-old/compile
+$(curdir)/squashfskit4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
+$(curdir)/upx/compile := $(curdir)/ucl/compile
 $(curdir)/wrt350nv2-builder/compile := $(curdir)/zlib/compile
-$(curdir)/lzma-old/compile := $(curdir)/zlib/compile
-$(curdir)/make-ext4fs/compile := $(curdir)/zlib/compile
-$(curdir)/cbootimage/compile += $(curdir)/automake/compile
+$(curdir)/zlib/compile := $(curdir)/cmake/compile

 ifneq ($(HOST_OS),Linux)
  $(curdir)/squashfskit4/compile += $(curdir)/coreutils/compile
@@ -140,7 +137,11 @@ $(STAGING_DIR_HOST)/.prepared: $(TMP_DIR)/.build
 	mkdir -p $(BUILD_DIR_HOST)/stamp $(STAGING_DIR_HOST)/include/sys
 	$(INSTALL_DATA) $(TOPDIR)/tools/include/*.h $(STAGING_DIR_HOST)/include/
 	$(INSTALL_DATA) $(TOPDIR)/tools/include/sys/*.h $(STAGING_DIR_HOST)/include/sys/
-	ln -sf lib $(STAGING_DIR_HOST)/lib64
+ifneq ($(HOST_OS),Linux)
+	mkdir -p $(STAGING_DIR_HOST)/include/asm
+	$(INSTALL_DATA) $(TOPDIR)/tools/include/asm/*.h $(STAGING_DIR_HOST)/include/asm/
+endif
+	ln -snf lib $(STAGING_DIR_HOST)/lib64
 	touch $@

 endif