diff --git a/include/target.mk b/include/target.mk
index dfa46f462f..530e711fa5 100644
--- a/include/target.mk
+++ b/include/target.mk
@@ -209,9 +209,6 @@ ifeq ($(DUMP),1)
   endif
   ifeq ($(ARCH),aarch64)
     CPU_TYPE ?= generic
-    ifneq ($(filter $(FEATURES),fpu),)
-      CPU_CFLAGS += -march=armv8-a+crypto
-    endif
     CPU_CFLAGS_generic = -mcpu=generic
     CPU_CFLAGS_cortex-a53 = -mcpu=cortex-a53
   endif
diff --git a/package/ctcgfw/luci-app-appfilter/Makefile b/package/ctcgfw/luci-app-appfilter/Makefile
index dfc32579ae..4d0ecc5041 100644
--- a/package/ctcgfw/luci-app-appfilter/Makefile
+++ b/package/ctcgfw/luci-app-appfilter/Makefile
@@ -1,17 +1,17 @@
-
 #
 # This is free software, licensed under the Apache License, Version 2.0 .
 #
 
 include $(TOPDIR)/rules.mk
-include $(TOPDIR)/feeds/luci/luci.mk
 
 LUCI_TITLE:=Open App Filter Module
 LUCI_PKGARCH:=all
 LUCI_DEPENDS:=+appfilter
 
 PKG_NAME:=luci-app-appfilter
-PKG_VERSION:=5.0
+PKG_VERSION:=5.0.1
 PKG_RELEASE:=1
 
+include $(TOPDIR)/feeds/luci/luci.mk
+
 # call BuildPackage - OpenWrt buildroot signature
diff --git a/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua b/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
index e1c7a02347..3d9af1016d 100644
--- a/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
+++ b/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
@@ -36,6 +36,20 @@ s.anonymous = true
 
 um = s:option(DummyValue, "rule_data")
 
+s=m:section(TypedSection,"time",translate("时间控制")) s.anonymous = true
+hv = s:option(Value, "start_time", translate("开始时间")) hv.default="00:00"
+hv.optional=false
+hv = s:option(Value, "end_time", translate("结束时间")) hv.default="23:59"
+hv.optional=false days = s:option(MultiValue, "days", "", translate("")) 
+days.widget="checkbox" days.size=10 
+days:value("0", "周日");
+days:value("1", "周一"); 
+days:value("2", "周二");
+days:value("3", "周三"); 
+days:value("4", "周四"); 
+days:value("5", "周五"); 
+days:value("6", "周六"); 
+
 --um.value =rule_count .. " " .. translate("Records").. "  "..version
 s = m:section(TypedSection, "appfilter", translate("App Filter Rules"))
 s.anonymous = true
@@ -95,10 +109,7 @@ if class_fd then
 end
 
 
-s=m:section(TypedSection,"user",translate("Select users"))
-s.anonymous = true
-users = s:option(MultiValue, "users", "", translate("Select at least one user, otherwise it will take effect for all users"))
-users.widget="checkbox"
+
 
 function get_hostname_by_mac(dst_mac)
     leasefile="/tmp/dhcp.leases"
@@ -128,6 +139,10 @@ function get_cmd_result(command)
 	fd:close()                
 	return result  
 end
+
+s=m:section(TypedSection,"user",translate("Select users"))
+s.anonymous = true
+users = s:option(MultiValue, "users", "", translate("Select at least one user, otherwise it will take effect for all users"))
 users.widget="checkbox"
 --users.widget="select"
 users.size=1
diff --git a/package/ctcgfw/luci-app-openclash/Makefile b/package/ctcgfw/luci-app-openclash/Makefile
index 717afd564e..d083fb7a29 100644
--- a/package/ctcgfw/luci-app-openclash/Makefile
+++ b/package/ctcgfw/luci-app-openclash/Makefile
@@ -33,17 +33,17 @@ define Build/Prepare
 		po2lmo $(po) $(PKG_BUILD_DIR)/$(patsubst %.po,%.lmo,$(notdir $(po)));)
 	chmod 0755 $(PKG_BUILD_DIR)/root/etc/init.d/openclash
 	chmod -R 0755 $(PKG_BUILD_DIR)/root/usr/share/openclash/
-	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/config >/dev/null 2>&1
-	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/rule_provider >/dev/null 2>&1
-	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/backup >/dev/null 2>&1
-	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/core >/dev/null 2>&1
-	mkdir -p $(PKG_BUILD_DIR)/root/usr/share/openclash/backup >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/config/openclash" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash" >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_rules.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_rules.list" >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_rules_2.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_rules_2.list" >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_hosts.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_hosts.list" >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_fake_filter.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_fake_filter.list" >/dev/null 2>&1
-	cp "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_domain_dns.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_domain_dns.list" >/dev/null 2>&1
+	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/config
+	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/rule_provider
+	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/backup
+	mkdir -p $(PKG_BUILD_DIR)/root/etc/openclash/core
+	mkdir -p $(PKG_BUILD_DIR)/root/usr/share/openclash/backup
+	cp -f "$(PKG_BUILD_DIR)/root/etc/config/openclash" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash" >/dev/null 2>&1
+	cp -f "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_rules.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_rules.list" >/dev/null 2>&1
+	cp -f "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_rules_2.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_rules_2.list" >/dev/null 2>&1
+	cp -f "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_hosts.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_hosts.list" >/dev/null 2>&1
+	cp -f "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_fake_filter.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_fake_filter.list" >/dev/null 2>&1
+	cp -f "$(PKG_BUILD_DIR)/root/etc/openclash/custom/openclash_custom_domain_dns.list" "$(PKG_BUILD_DIR)/root/usr/share/openclash/backup/openclash_custom_domain_dns.list" >/dev/null 2>&1
 endef
 
 define Build/Configure
@@ -58,8 +58,8 @@ endef
 define Package/$(PKG_NAME)/preinst
 #!/bin/sh
 if [ -f "/etc/config/openclash" ]; then
-	cp "/etc/config/openclash" "/tmp/openclash.bak" >/dev/null 2>&1
-	cp -r "/etc/openclash" "/tmp/openclash" >/dev/null 2>&1
+	cp -f "/etc/config/openclash" "/tmp/openclash.bak" >/dev/null 2>&1
+	cp -rf "/etc/openclash" "/tmp/openclash" >/dev/null 2>&1
 fi
 endef
 
@@ -68,30 +68,30 @@ endef
 
 define Package/$(PKG_NAME)/prerm
 #!/bin/sh
-	uci set openclash.config.enable=0 >/dev/null 2>&1
-	uci commit openclash >/dev/null 2>&1
-	cp "/etc/config/openclash" "/tmp/openclash.bak" >/dev/null 2>&1
-	cp -r "/etc/openclash" "/tmp/openclash" >/dev/null 2>&1
+	uci -q set openclash.config.enable=0
+	uci -q commit openclash
+	cp -f "/etc/config/openclash" "/tmp/openclash.bak" >/dev/null 2>&1
+	cp -rf "/etc/openclash" "/tmp/openclash" >/dev/null 2>&1
 endef
 
 define Package/$(PKG_NAME)/postrm
 #!/bin/sh
-	rm -rf /etc/openclash >/dev/null 2>&1
-	rm -rf /tmp/openclash.log >/dev/null 2>&1
-	rm -rf /tmp/openclash_start.log >/dev/null 2>&1
-	rm -rf /tmp/openclash_last_version >/dev/null 2>&1
-	rm -rf /tmp/Proxy_Group >/dev/null 2>&1
-	rm -rf /tmp/rules_name >/dev/null 2>&1
-	rm -rf /tmp/rule_providers_name >/dev/null 2>&1
-	rm -rf /tmp/clash_last_version >/dev/null 2>&1
-	rm -rf /usr/share/openclash/backup >/dev/null 2>&1
-	rm -rf /tmp/openclash_fake_filter.list >/dev/null 2>&1
-	rm -rf /tmp/openclash_servers_fake_filter.conf >/dev/null 2>&1
-	uci delete firewall.openclash >/dev/null 2>&1
-	uci commit firewall >/dev/null 2>&1
-	uci delete ucitrack.@openclash[-1] >/dev/null 2>&1
-	uci commit ucitrack >/dev/null 2>&1
-	rm -rf /tmp/luci* >/dev/null 2>&1
+	rm -rf /etc/openclash
+	rm -rf /tmp/openclash.log
+	rm -rf /tmp/openclash_start.log
+	rm -rf /tmp/openclash_last_version
+	rm -rf /tmp/Proxy_Group
+	rm -rf /tmp/rules_name
+	rm -rf /tmp/rule_providers_name
+	rm -rf /tmp/clash_last_version
+	rm -rf /usr/share/openclash/backup
+	rm -rf /tmp/openclash_fake_filter.list
+	rm -rf /tmp/openclash_servers_fake_filter.conf
+	uci -q delete firewall.openclash
+	uci -q commit firewall
+	uci -q delete ucitrack.@openclash[-1]
+	uci -q commit ucitrack
+	rm -rf /tmp/luci-*
 endef
 
 define Package/$(PKG_NAME)/install
@@ -101,4 +101,4 @@ define Package/$(PKG_NAME)/install
 	$(CP) $(PKG_BUILD_DIR)/luasrc/* $(1)/usr/lib/lua/luci/
 endef
 
-$(eval $(call BuildPackage,$(PKG_NAME)))
\ No newline at end of file
+$(eval $(call BuildPackage,$(PKG_NAME)))
diff --git a/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash b/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
index e121dd3cd7..4a14a33d92 100755
--- a/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
+++ b/package/ctcgfw/luci-app-openclash/root/etc/init.d/openclash
@@ -10,11 +10,11 @@ LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
 CLASH="/etc/openclash/clash"
 CLASH_CONFIG="/etc/openclash"
 CRON_FILE="/etc/crontabs/root"
-RAW_CONFIG_FILE=$(uci get openclash.config.config_path 2>/dev/null)
-BACKUP_FILE="/etc/openclash/backup/$(uci get openclash.config.config_path 2>/dev/null |awk -F '/' '{print $5}' 2>/dev/null)"
+RAW_CONFIG_FILE=$(uci -q get openclash.config.config_path)
+BACKUP_FILE="/etc/openclash/backup/$(uci -q get openclash.config.config_path |awk -F '/' '{print $5}' 2>/dev/null)"
 LOG_FILE="/tmp/openclash.log"
 START_LOG="/tmp/openclash_start.log"
-CONFIG_FILE="/etc/openclash/$(uci get openclash.config.config_path 2>/dev/null |awk -F '/' '{print $5}' 2>/dev/null)"
+CONFIG_FILE="/etc/openclash/$(uci -q get openclash.config.config_path |awk -F '/' '{print $5}' 2>/dev/null)"
 RULE_PROVIDER_FILE="/tmp/yaml_rule_provider.yaml"
 DNS_FILE="/tmp/yaml_dns.yaml"
 GAME_RULE_FILE="/tmp/yaml_game_rule.yaml"
@@ -30,26 +30,26 @@ set_lock() {
 
 del_lock() {
    flock -u 888 2>/dev/null
-   rm -rf "$LOCK_FILE" 2>/dev/null
+   rm -rf "$LOCK_FILE"
 }
 
 add_cron()
 {
    [ "$(tail -n1 /etc/crontabs/root | wc -l)" -eq 0 ] && [ -n "$(cat /etc/crontabs/root 2>/dev/null)" ] && echo >> /etc/crontabs/root
    [ -z "$(grep "openclash.sh" "$CRON_FILE" 2>/dev/null)" ] && {
-      [ "$(uci get openclash.config.auto_update 2>/dev/null)" -eq 1 ] && [ "$(uci get openclash.config.config_auto_update_mode 2>/dev/null)" -ne 1 ] && echo "0 $(uci get openclash.config.auto_update_time 2>/dev/null) * * $(uci get openclash.config.config_update_week_time 2>/dev/null) /usr/share/openclash/openclash.sh" >> $CRON_FILE
+      [ "$(uci -q get openclash.config.auto_update)" -eq 1 ] && [ "$(uci -q get openclash.config.config_auto_update_mode)" -ne 1 ] && echo "0 $(uci -q get openclash.config.auto_update_time) * * $(uci -q get openclash.config.config_update_week_time) /usr/share/openclash/openclash.sh" >> $CRON_FILE
    }
    [ -z "$(grep "openclash_rule.sh" "$CRON_FILE" 2>/dev/null)" ] && {
-      [ "$(uci get openclash.config.other_rule_auto_update 2>/dev/null)" -eq 1 ] && echo "0 $(uci get openclash.config.other_rule_update_day_time 2>/dev/null) * * $(uci get openclash.config.other_rule_update_week_time 2>/dev/null) /usr/share/openclash/openclash_rule.sh" >> $CRON_FILE
+      [ "$(uci -q get openclash.config.other_rule_auto_update)" -eq 1 ] && echo "0 $(uci -q get openclash.config.other_rule_update_day_time) * * $(uci -q get openclash.config.other_rule_update_week_time) /usr/share/openclash/openclash_rule.sh" >> $CRON_FILE
    }
    [ -z "$(grep "openclash_ipdb.sh" "$CRON_FILE" 2>/dev/null)" ] && {
-      [ "$(uci get openclash.config.geo_auto_update 2>/dev/null)" -eq 1 ] && echo "0 $(uci get openclash.config.geo_update_day_time 2>/dev/null) * * $(uci get openclash.config.geo_update_week_time 2>/dev/null) /usr/share/openclash/openclash_ipdb.sh" >> $CRON_FILE
+      [ "$(uci -q get openclash.config.geo_auto_update)" -eq 1 ] && echo "0 $(uci -q get openclash.config.geo_update_day_time) * * $(uci -q get openclash.config.geo_update_week_time) /usr/share/openclash/openclash_ipdb.sh" >> $CRON_FILE
    }
    [ -z "$(grep "openclash_chnroute.sh" "$CRON_FILE" 2>/dev/null)" ] && {
-      [ "$(uci get openclash.config.chnr_auto_update 2>/dev/null)" -eq 1 ] && echo "0 $(uci get openclash.config.chnr_update_day_time 2>/dev/null) * * $(uci get openclash.config.chnr_update_week_time 2>/dev/null) /usr/share/openclash/openclash_chnroute.sh" >> $CRON_FILE
+      [ "$(uci -q get openclash.config.chnr_auto_update)" -eq 1 ] && echo "0 $(uci -q get openclash.config.chnr_update_day_time) * * $(uci -q get openclash.config.chnr_update_week_time) /usr/share/openclash/openclash_chnroute.sh" >> $CRON_FILE
    }
    [ -z "$(grep "/etc/init.d/openclash" "$CRON_FILE" 2>/dev/null)" ] && {
-      [ "$(uci get openclash.config.auto_restart 2>/dev/null)" -eq 1 ] && echo "0 $(uci get openclash.config.auto_restart_day_time 2>/dev/null) * * $(uci get openclash.config.auto_restart_week_time 2>/dev/null) /etc/init.d/openclash restart 2>/dev/null" >> $CRON_FILE
+      [ "$(uci -q get openclash.config.auto_restart)" -eq 1 ] && echo "0 $(uci -q get openclash.config.auto_restart_day_time) * * $(uci -q get openclash.config.auto_restart_week_time) /etc/init.d/openclash restart 2>/dev/null" >> $CRON_FILE
    }
    crontab $CRON_FILE
    nohup /usr/share/openclash/openclash_watchdog.sh &
@@ -66,20 +66,20 @@ del_cron()
 
 change_dns() {
    if [ "$1" -eq 1 ]; then
-      uci del dhcp.@dnsmasq[-1].server >/dev/null 2>&1
-      uci add_list dhcp.@dnsmasq[0].server=127.0.0.1#"$dns_port"
-      uci delete dhcp.@dnsmasq[0].resolvfile 2>/dev/null
-      uci set dhcp.@dnsmasq[0].noresolv=1 2>/dev/null
-      uci set openclash.config.redirect_dns=1
+      uci -q del dhcp.@dnsmasq[-1].server
+      uci -q add_list dhcp.@dnsmasq[0].server=127.0.0.1#"$dns_port"
+      uci -q delete dhcp.@dnsmasq[0].resolvfile
+      uci -q set dhcp.@dnsmasq[0].noresolv=1
+      uci -q set openclash.config.redirect_dns=1
    else
-      uci set openclash.config.redirect_dns=0 2>/dev/null
+      uci -q set openclash.config.redirect_dns=0
    fi
    if [ "$2" -eq 1 ]; then
-      uci set dhcp.@dnsmasq[0].cachesize=0 2>/dev/null
+      uci -q set dhcp.@dnsmasq[0].cachesize=0
    fi
    
-   uci commit dhcp
-   uci commit openclash
+   uci -q commit dhcp
+   uci -q commit openclash
    
    /usr/share/openclash/openclash_custom_domain_dns.sh >/dev/null 2>&1
 }
@@ -87,39 +87,39 @@ change_dns() {
 revert_dns() {
 
    [ "$1" -eq 1 ] && {
-      uci del_list dhcp.@dnsmasq[0].server=127.0.0.1#"$3" >/dev/null 2>&1
+      uci -q del_list dhcp.@dnsmasq[0].server=127.0.0.1#"$3"
    }
    
    [ "$1" -eq 1 ] && [ "$4" -eq 0 ] && {
-      uci set openclash.config.redirect_dns=0 2>/dev/nulls
+      uci -q set openclash.config.redirect_dns=0
    }
 
-   [ "$(uci get dhcp.@dnsmasq[0].cachesize 2>/dev/null)" = "0" ] && {
-      uci delete dhcp.@dnsmasq[0].cachesize >/dev/null 2>&1
+   [ "$(uci -q get dhcp.@dnsmasq[0].cachesize)" = "0" ] && {
+      uci -q delete dhcp.@dnsmasq[0].cachesize
    }
    
    [ "$1" -eq 1 ] && {
       if [ -s "/tmp/resolv.conf.d/resolv.conf.auto" ] && [ -n "$(grep "nameserver" /tmp/resolv.conf.d/resolv.conf.auto)" ]; then
-         uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.d/resolv.conf.auto >/dev/null 2>&1
+         uci -q set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.d/resolv.conf.auto
       elif [ -s "/tmp/resolv.conf.auto" ] && [ -n "$(grep "nameserver" /tmp/resolv.conf.auto)" ]; then
-         uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto >/dev/null 2>&1
+         uci -q set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto
       else
-         rm -rf /tmp/resolv.conf.auto 2>/dev/null
+         rm -rf /tmp/resolv.conf.auto
          touch /tmp/resolv.conf.auto 2>/dev/null
          cat >> "/tmp/resolv.conf.auto" <<-EOF
 # Interface lan
 nameserver 114.114.114.114
 nameserver 119.29.29.29
 EOF
-         uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto >/dev/null 2>&1
+         uci -q set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto
       fi
-      uci set dhcp.@dnsmasq[0].noresolv=0 >/dev/null 2>&1
+      uci -q set dhcp.@dnsmasq[0].noresolv=0
    }
    
-   uci commit dhcp
-   uci commit openclash
-   rm -rf /tmp/dnsmasq.d/dnsmasq_openclash.conf >/dev/null 2>&1
-   rm -rf /tmp/dnsmasq.d/dnsmasq_openclash_custom_domain.conf >/dev/null 2>&1
+   uci -q commit dhcp
+   uci -q commit openclash
+   rm -rf /tmp/dnsmasq.d/dnsmasq_openclash.conf
+   rm -rf /tmp/dnsmasq.d/dnsmasq_openclash_custom_domain.conf
 }
 
 kill_clash()
@@ -706,14 +706,49 @@ yml_custom_rule_provider()
    fi
 }
 
+#获取订阅配置
+sub_info_get()
+{
+   local section="$1" address enabled name
+   config_get_bool "enabled" "$section" "enabled" "1"
+   config_get "address" "$section" "address" ""
+   config_get "name" "$section" "name" ""
+   
+   if [ "$subscribe_enable" = "1" ]; then
+      return
+   fi
+
+   if [ "$enabled" -eq 0 ]; then
+      return
+   fi
+   
+   if [ -z "$address" ]; then
+      return
+   fi
+   
+   if [ -z "$name" ]; then
+   	  CONFIG_NAME="config"
+      RAW_CONFIG_FILE="/etc/openclash/config/config.yaml"
+      CONFIG_FILE="/etc/openclash/config.yaml"
+   else
+      CONFIG_NAME="$name"
+      RAW_CONFIG_FILE="/etc/openclash/config/$name.yaml"
+      CONFIG_FILE="/etc/openclash/$name.yaml"
+   fi
+   
+   uci -q set openclash.config.config_path="$RAW_CONFIG_FILE"
+   uci -q commit openclash
+   subscribe_enable=1
+}
+
 #配置文件选择
 config_choose()
 {
 if [ -z "$RAW_CONFIG_FILE" ] || [ ! -f "$RAW_CONFIG_FILE" ]; then
    CONFIG_NAME=$(ls -lt /etc/openclash/config/ | grep -E '.yaml|.yml' | head -n 1 |awk '{print $9}')
    if [ -n "$CONFIG_NAME" ]; then
-      uci set openclash.config.config_path="/etc/openclash/config/$CONFIG_NAME"
-      uci commit openclash
+      uci -q set openclash.config.config_path="/etc/openclash/config/$CONFIG_NAME"
+      uci -q commit openclash
       RAW_CONFIG_FILE="/etc/openclash/config/$CONFIG_NAME"
       CONFIG_FILE="/etc/openclash/$CONFIG_NAME"
    fi
@@ -721,8 +756,10 @@ fi 2>/dev/null
 CONFIG_NAME=$(echo "$RAW_CONFIG_FILE" |awk -F '/' '{print $5}' 2>/dev/null)
 
 if [ ! -f "$RAW_CONFIG_FILE" ]; then
-   subscribe_info=$(uci get openclash.@config_subscribe[0].address 2>/dev/null)
-   if [ -n "$subscribe_info" ]; then
+   config_load "openclash"
+   config_foreach sub_info_get "config_subscribe"
+   subscribe_auto_update=$(uci get openclash.config.auto_update 2>/dev/null)
+   if [ "$subscribe_enable" = "1" ] && [ "$subscribe_auto_update" -eq 1 ]; then
       echo "配置文件不存在，您已设置订阅信息，准备开始下载..." >$START_LOG
       sleep 3
       nohup /usr/share/openclash/openclash.sh &
@@ -745,7 +782,7 @@ begin
 YAML.load_file('$RAW_CONFIG_FILE');
 rescue Exception => e
 puts '${LOGTIME} Error: Unable To Parse Config File ' + e.message
-system 'rm -rf ${CONFIG_FILE} 2>/dev/null'
+system 'rm -rf ${CONFIG_FILE}'
 end
 " 2>/dev/null >> $LOG_FILE
 if [ $? -ne 0 ]; then
@@ -781,7 +818,7 @@ yml_other_rules_get()
 #运行模式处理
 do_run_mode()
 {
-   en_mode=$(uci get openclash.config.en_mode 2>/dev/null)
+   en_mode=$(uci -q get openclash.config.en_mode)
   
    if [ "$en_mode" = "fake-ip-tun" ]; then
       en_mode_tun="1"
@@ -823,16 +860,16 @@ do_run_file()
       game_core_path="/etc/openclash/core/clash_game"
       geoip_path="/etc/openclash/Country.mmdb"
       chnr_path="/etc/openclash/china_ip_route.ipset"
-      rm -rf "/tmp/etc/openclash" 2>/dev/null
+      rm -rf "/tmp/etc/openclash"
    else
       dev_core_path="/tmp/etc/openclash/core/clash"
       tun_core_path="/tmp/etc/openclash/core/clash_tun"
       game_core_path="/tmp/etc/openclash/core/clash_game"
       geoip_path="/tmp/etc/openclash/Country.mmdb"
       chnr_path="/tmp/etc/openclash/china_ip_route.ipset"
-      rm -rf "/etc/openclash/Country.mmdb" 2>/dev/null
-      rm -rf "/etc/openclash/china_ip_route.ipset" 2>/dev/null
-      rm -rf "/etc/openclash/core" 2>/dev/null
+      rm -rf "/etc/openclash/Country.mmdb"
+      rm -rf "/etc/openclash/china_ip_route.ipset"
+      rm -rf "/etc/openclash/core"
    fi
     
    rm -rf "/etc/openclash/clash" 2>/dev/null
@@ -856,7 +893,7 @@ do_run_file()
 
    if [ "$proxy_mode" = "script" ] || [ "$rule_name" = "ConnersHua" ] || [ "$rule_name" = "lhie1" ] || [ -n "$(ruby_read "$CONFIG_FILE" "['rules'].grep(/^RULE-SET,/)")" ]; then
       if [ "$en_mode_tun" != "2" ]; then
-         rm -rf "/etc/openclash/clash" 2>/dev/null
+         rm -rf "/etc/openclash/clash"
          ln -s "$tun_core_path" /etc/openclash/clash 2>/dev/null
          core_type="Tun"
          core_start_log="检测到配置了【Tun】内核专属功能，调用【Tun】内核启动..."
@@ -903,7 +940,7 @@ do_run_file()
    [ ! -f "$CLASH" ] && {
      echo "检测到内核文件不存在，准备开始下载..." >$START_LOG
      nofile=1
-     rm -rf "/tmp/clash_last_version" 2>/dev/null
+     rm -rf "/tmp/clash_last_version"
      nohup /usr/share/openclash/openclash_core.sh "$core_type" &
    }
    
@@ -969,8 +1006,8 @@ start_run_core()
       capabilties="cap_sys_resource,cap_dac_override,cap_net_raw,cap_net_bind_service,cap_net_admin"
       capsh --caps="${capabilties}+eip" -- -c "capsh --user=nobody --addamb='${capabilties}' -- -c 'nohup $CLASH -d $CLASH_CONFIG -f \"$CONFIG_FILE\" >> $LOG_FILE 2>&1 &'" >> $LOG_FILE 2>&1
    fi
-   uci set openclash.config.config_reload=1 2>/dev/null
-   uci commit openclash
+   uci -q set openclash.config.config_reload=1
+   uci -q commit openclash
 }
 
 check_core_status()
@@ -1023,41 +1060,41 @@ raw_config_start()
    if [ "$en_mode" = "redir-host" ]; then
       case $en_mode_tun in
       "1")
-         uci set openclash.config.en_mode=redir-host-tun
+         uci -q set openclash.config.en_mode=redir-host-tun
       ;;
       "2")
-         uci set openclash.config.en_mode=redir-host-vpn
+         uci -q set openclash.config.en_mode=redir-host-vpn
       ;;
       "3")
-         uci set openclash.config.en_mode=redir-host-mix
+         uci -q set openclash.config.en_mode=redir-host-mix
       ;;
       *)
-         uci set openclash.config.en_mode=redir-host
+         uci -q set openclash.config.en_mode=redir-host
       esac
    elif [ "$en_mode" = "fake-ip" ]; then
    	  case $en_mode_tun in
       "1")
-         uci set openclash.config.en_mode=fake-ip-tun
+         uci -q set openclash.config.en_mode=fake-ip-tun
       ;;
       "2")
-         uci set openclash.config.en_mode=fake-ip-vpn
+         uci -q set openclash.config.en_mode=fake-ip-vpn
       ;;
       "3")
-         uci set openclash.config.en_mode=fake-ip-mix
+         uci -q set openclash.config.en_mode=fake-ip-mix
       ;;
       *)
-         uci set openclash.config.en_mode=fake-ip
+         uci -q set openclash.config.en_mode=fake-ip
       esac
    fi
    
    dase=$(ruby_read "$CONFIG_FILE" "['secret']")
-   uci set openclash.config.dashboard_password="$dase" 2>/dev/null
+   uci -q set openclash.config.dashboard_password="$dase"
    
    cn_port=$(ruby_read "$CONFIG_FILE" "['external-controller'].split(':')[1]")
-   uci set openclash.config.cn_port="$cn_port" 2>/dev/null
+   uci -q set openclash.config.cn_port="$cn_port"
    
-   uci set openclash.config.proxy_port="$proxy_port"
-   uci set openclash.config.restricted_mode=1
+   uci -q set openclash.config.proxy_port="$proxy_port"
+   uci -q set openclash.config.restricted_mode=1
    
    uci commit openclash
 }
@@ -1202,21 +1239,21 @@ if [ "$(iptables -t nat -nL PREROUTING --line-number | grep "redir port $DNSPORT
    done
 fi
 
-if [ -z "$(uci get firewall.openclash 2>/dev/null)" ] || [ -z "$(uci get ucitrack.@openclash[-1].init 2>/dev/null)" ]; then
-   uci delete ucitrack.@openclash[-1] >/dev/null 2>&1
-   uci add ucitrack openclash >/dev/null 2>&1
-   uci set ucitrack.@openclash[-1].init=openclash >/dev/null 2>&1
-   uci commit ucitrack >/dev/null 2>&1
-   uci delete firewall.openclash >/dev/null 2>&1
-   uci set firewall.openclash=include >/dev/null 2>&1
-   uci set firewall.openclash.type=script >/dev/null 2>&1
-   uci set firewall.openclash.path=/var/etc/openclash.include >/dev/null 2>&1
-   uci set firewall.openclash.reload=1 >/dev/null 2>&1
+if [ -z "$(uci -q get firewall.openclash)" ] || [ -z "$(uci -q get ucitrack.@openclash[-1].init)" ]; then
+   uci -q delete ucitrack.@openclash[-1]
+   uci -q add ucitrack openclash
+   uci -q set ucitrack.@openclash[-1].init=openclash
+   uci -q commit ucitrack
+   uci -q delete firewall.openclash
+   uci -q set firewall.openclash=include
+   uci -q set firewall.openclash.type=script
+   uci -q set firewall.openclash.path=/var/etc/openclash.include
+   uci -q set firewall.openclash.reload=1
 fi
           
-if [ "$(uci get firewall.@defaults[0].forward)" != "ACCEPT" ]; then
-   uci set firewall.@defaults[0].forward=ACCEPT >/dev/null 2>&1
-   uci commit firewall >/dev/null 2>&1
+if [ "$(uci -q get firewall.@defaults[0].forward)" != "ACCEPT" ]; then
+   uci -q set firewall.@defaults[0].forward=ACCEPT
+   uci -q commit firewall
    /etc/init.d/firewall reload >/dev/null 2>&1
 fi
 
@@ -1233,23 +1270,23 @@ fi
 #lan_ac
 if [ "$operation_mode" = "redir-host" ] && [ "$en_mode" = "redir-host" ]; then
    if [ "$lan_ac_mode" = "0" ]; then
-      if [ -n "$(uci get openclash.config.lan_ac_black_ips 2>/dev/null)" ]; then
+      if [ -n "$(uci -q get openclash.config.lan_ac_black_ips)" ]; then
          ipset create lan_ac_black_ips hash:net
          config_load "openclash"
          config_list_foreach "config" "lan_ac_black_ips" ac_add "lan_ac_black_ips"
       fi
-      if [ -n "$(uci get openclash.config.lan_ac_black_macs 2>/dev/null)" ]; then
+      if [ -n "$(uci -q get openclash.config.lan_ac_black_macs)" ]; then
          ipset create lan_ac_black_macs hash:mac
          config_load "openclash"
          config_list_foreach "config" "lan_ac_black_macs" ac_add "lan_ac_black_macs"
       fi
    elif [ "$lan_ac_mode" = "1" ]; then
-      if [ -n "$(uci get openclash.config.lan_ac_white_ips 2>/dev/null)" ]; then
+      if [ -n "$(uci -q get openclash.config.lan_ac_white_ips)" ]; then
          ipset create lan_ac_white_ips hash:net
          config_load "openclash"
          config_list_foreach "config" "lan_ac_white_ips" ac_add "lan_ac_white_ips"
       fi
-      if [ -n "$(uci get openclash.config.lan_ac_white_macs 2>/dev/null)" ]; then
+      if [ -n "$(uci -q get openclash.config.lan_ac_white_macs)" ]; then
          ipset create lan_ac_white_macs hash:mac
          config_load "openclash"
          config_list_foreach "config" "lan_ac_white_macs" ac_add "lan_ac_white_macs"
@@ -1258,7 +1295,7 @@ if [ "$operation_mode" = "redir-host" ] && [ "$en_mode" = "redir-host" ]; then
 fi
 
 #wan ac
-if [ -n "$(uci get openclash.config.wan_ac_black_ips 2>/dev/null)" ]; then
+if [ -n "$(uci -q get openclash.config.wan_ac_black_ips)" ]; then
    ipset create wan_ac_black_ips hash:net
    config_load "openclash"
    config_list_foreach "config" "wan_ac_black_ips" ac_add "wan_ac_black_ips"
@@ -1472,7 +1509,7 @@ config_foreach firewall_rule_exclude "rule"
 
 revert_firewall()
 {
-   rm -rf /var/etc/openclash.include 2>/dev/null
+   rm -rf /var/etc/openclash.include
 
    #ipv4
 
@@ -1565,42 +1602,42 @@ revert_firewall()
 
 get_config()
 {
-   rule_source=$(uci get openclash.config.rule_source 2>/dev/null)
-   enable_custom_dns=$(uci get openclash.config.enable_custom_dns 2>/dev/null)
-   enable_custom_clash_rules=$(uci get openclash.config.enable_custom_clash_rules 2>/dev/null) 
-   da_password=$(uci get openclash.config.dashboard_password 2>/dev/null)
-   cn_port=$(uci get openclash.config.cn_port 2>/dev/null)
-   proxy_port=$(uci get openclash.config.proxy_port 2>/dev/null)
-   proxy_mode=$(uci get openclash.config.proxy_mode 2>/dev/null)
-   ipv6_enable=$(uci get openclash.config.ipv6_enable 2>/dev/null)
-   http_port=$(uci get openclash.config.http_port 2>/dev/null)
-   socks_port=$(uci get openclash.config.socks_port 2>/dev/null)
-   enable_redirect_dns=$(uci get openclash.config.enable_redirect_dns 2>/dev/null)
-   lan_ip=$(uci get network.lan.ipaddr 2>/dev/null |awk -F '/' '{print $1}' 2>/dev/null)
+   rule_source=$(uci -q get openclash.config.rule_source)
+   enable_custom_dns=$(uci -q get openclash.config.enable_custom_dns)
+   enable_custom_clash_rules=$(uci -q get openclash.config.enable_custom_clash_rules) 
+   da_password=$(uci -q get openclash.config.dashboard_password)
+   cn_port=$(uci -q get openclash.config.cn_port)
+   proxy_port=$(uci -q get openclash.config.proxy_port)
+   proxy_mode=$(uci -q get openclash.config.proxy_mode)
+   ipv6_enable=$(uci -q get openclash.config.ipv6_enable)
+   http_port=$(uci -q get openclash.config.http_port)
+   socks_port=$(uci -q get openclash.config.socks_port)
+   enable_redirect_dns=$(uci -q get openclash.config.enable_redirect_dns)
+   lan_ip=$(uci -q get network.lan.ipaddr |awk -F '/' '{print $1}' 2>/dev/null)
    wan_ip4=$(ifconfig | grep 'inet addr' | awk '{print $2}' | cut -d: -f2 2>/dev/null)
    lan_ip6=$(ifconfig | grep 'inet6 addr' | awk '{print $3}' 2>/dev/null)
-   disable_masq_cache=$(uci get openclash.config.disable_masq_cache 2>/dev/null)
-   log_level=$(uci get openclash.config.log_level 2>/dev/null)
-   intranet_allowed=$(uci get openclash.config.intranet_allowed 2>/dev/null)
-   enable_udp_proxy=$(uci get openclash.config.enable_udp_proxy 2>/dev/null)
-   operation_mode=$(uci get openclash.config.operation_mode 2>/dev/null)
-   lan_ac_mode=$(uci get openclash.config.lan_ac_mode 2>/dev/null)
-   enable_rule_proxy=$(uci get openclash.config.enable_rule_proxy 2>/dev/null)
-   stack_type=$(uci get openclash.config.stack_type 2>/dev/null)
-   china_ip_route=$(uci get openclash.config.china_ip_route 2>/dev/null)
-   small_flash_memory=$(uci get openclash.config.small_flash_memory 2>/dev/null)
-   mixed_port=$(uci get openclash.config.mixed_port 2>/dev/null)
-   interface_name=$(uci get openclash.config.interface_name 2>/dev/null)
-   common_ports=$(uci get openclash.config.common_ports 2>/dev/null)
-   dns_port=$(uci get openclash.config.dns_port 2>/dev/null)
-   [ -z "$dns_port" ] && dns_port=7874 && uci set openclash.config.dns_port=7874 2>/dev/null
-   uci set openclash.config.restricted_mode=0 && uci commit openclash
+   disable_masq_cache=$(uci -q get openclash.config.disable_masq_cache)
+   log_level=$(uci -q get openclash.config.log_level)
+   intranet_allowed=$(uci -q get openclash.config.intranet_allowed)
+   enable_udp_proxy=$(uci -q get openclash.config.enable_udp_proxy)
+   operation_mode=$(uci -q get openclash.config.operation_mode)
+   lan_ac_mode=$(uci -q get openclash.config.lan_ac_mode)
+   enable_rule_proxy=$(uci -q get openclash.config.enable_rule_proxy)
+   stack_type=$(uci -q get openclash.config.stack_type)
+   china_ip_route=$(uci -q get openclash.config.china_ip_route)
+   small_flash_memory=$(uci -q get openclash.config.small_flash_memory)
+   mixed_port=$(uci -q get openclash.config.mixed_port)
+   interface_name=$(uci -q get openclash.config.interface_name)
+   common_ports=$(uci -q get openclash.config.common_ports)
+   dns_port=$(uci -q get openclash.config.dns_port)
+   [ -z "$dns_port" ] && dns_port=7874 && uci -q set openclash.config.dns_port=7874
+   uci -q set openclash.config.restricted_mode=0 && uci -q commit openclash
 }
 
 start()
 {
 
-   enable=$(uci get openclash.config.enable 2>/dev/null)
+   enable=$(uci -q get openclash.config.enable)
    [ "$enable" != "1" ] && echo "${LOGTIME} Warning: OpenClash Now Disabled, Need Start From Luci Page, Exit..." >> $LOG_FILE && del_lock && exit 0
 
    config_choose
@@ -1655,29 +1692,29 @@ start()
    
    echo "第十一步: 添加计划任务,启动进程守护程序..." >$START_LOG
    add_cron
-   if [ -z "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ] && [ "$(uci get openclash.config.restricted_mode 2>/dev/null)" != "1" ]; then
+   if [ -z "$(uci -q get dhcp.lan.dhcpv6)" ] && [ "$(uci -q get openclash.config.restricted_mode)" != "1" ]; then
       echo "OpenClash 启动成功，请等待服务器上线！" >$START_LOG
       echo "${LOGTIME} OpenClash Start Successful" >> $LOG_FILE
       sleep 5
-   elif [ -n "$(uci get dhcp.lan.dhcpv6 2>/dev/null)" ]; then
+   elif [ -n "$(uci -q get dhcp.lan.dhcpv6)" ]; then
       echo "OpenClash 启动成功，检测到您启用了IPV6的DHCP服务，可能会造成连接异常！" >$START_LOG
       echo "${LOGTIME} Warning: OpenClash Start Successful, Please Note That Network May Abnormal With IPV6's DHCP Server" >> $LOG_FILE
       sleep 5
    fi
-   if [ "$(uci get openclash.config.restricted_mode 2>/dev/null)" = "1" ]; then
+   if [ "$(uci -q get openclash.config.restricted_mode)" = "1" ]; then
       echo "OpenClash 使用原始配置文件启动成功，部分设置可能未生效！" >$START_LOG
       echo "${LOGTIME} Warning: OpenClash Start Successful With Raw Config File, Please Note That It's Restricted Mode Now" >> $LOG_FILE
       sleep 5
    fi
    echo "OpenClash Already Start"
    echo "" >$START_LOG
-   rm -rf /tmp/yaml_* 2>/dev/null
+   rm -rf /tmp/yaml_*
 }
 
 stop()
 {
 
-   enable=$(uci get openclash.config.enable 2>/dev/null)
+   enable=$(uci -q get openclash.config.enable)
 
    echo "OpenClash 开始关闭..." >$START_LOG
    echo "第一步: 备份当前节点状态..." >$START_LOG
@@ -1698,32 +1735,32 @@ stop()
    fi
 
    echo "第五步: 重启 Dnsmasq 程序..." >$START_LOG
-   dns_port=$(uci get openclash.config.dns_port 2>/dev/null)
-   redirect_dns=$(uci get openclash.config.redirect_dns 2>/dev/null)
-   masq_cache=$(uci get openclash.config.masq_cache 2>/dev/null)
+   dns_port=$(uci -q get openclash.config.dns_port)
+   redirect_dns=$(uci -q get openclash.config.redirect_dns)
+   masq_cache=$(uci -q get openclash.config.masq_cache)
    revert_dns "$redirect_dns" "$masq_cache" "$dns_port" "$enable"
    /etc/init.d/dnsmasq restart >/dev/null 2>&1
 
    echo "第六步：删除 OpenClash 残留文件..." >$START_LOG
    if [ "$enable" != "1" ]; then
-      rm -rf $LOG_FILE 2>/dev/null
-      rm -rf /tmp/openclash_debug.log 2>/dev/null
-      rm -rf /www/luci-static/openclash 2>/dev/null
-      rm -rf /tmp/openclash_last_version 2>/dev/null
-      rm -rf /tmp/clash_last_version 2>/dev/null
-      rm -rf /tmp/Proxy_Group 2>/dev/null
-      rm -rf /tmp/rules_name 2>/dev/null
-      rm -rf /tmp/rule_providers_name 2>/dev/null
-      rm -rf /tmp/openclash_fake_filter.list 2>/dev/null
-      rm -rf /tmp/openclash_servers_fake_filter.conf 2>/dev/null
+      rm -rf $LOG_FILE
+      rm -rf /tmp/openclash_debug.log
+      rm -rf /www/luci-static/openclash
+      rm -rf /tmp/openclash_last_version
+      rm -rf /tmp/clash_last_version
+      rm -rf /tmp/Proxy_Group
+      rm -rf /tmp/rules_name
+      rm -rf /tmp/rule_providers_name
+      rm -rf /tmp/openclash_fake_filter.list
+      rm -rf /tmp/openclash_servers_fake_filter.conf
       del_lock
       echo "OpenClash 关闭成功！" >$START_LOG
       sleep 5
    fi
    
    del_cron
-   rm -rf /tmp/yaml_* 2>/dev/null
-   rm -rf $START_LOG 2>/dev/null
+   rm -rf /tmp/yaml_*
+   rm -rf $START_LOG
    echo "OpenClash Already Stop"
 }
 
diff --git a/package/ctcgfw/luci-app-openclash/root/etc/uci-defaults/luci-openclash b/package/ctcgfw/luci-app-openclash/root/etc/uci-defaults/luci-openclash
index 4652422556..30335dbc1b 100644
--- a/package/ctcgfw/luci-app-openclash/root/etc/uci-defaults/luci-openclash
+++ b/package/ctcgfw/luci-app-openclash/root/etc/uci-defaults/luci-openclash
@@ -1,37 +1,37 @@
 #!/bin/sh
 
-uci delete ucitrack.@openclash[-1] >/dev/null 2>&1
-uci add ucitrack openclash >/dev/null 2>&1
-uci set ucitrack.@openclash[-1].init=openclash >/dev/null 2>&1
-uci commit ucitrack >/dev/null 2>&1
-uci delete firewall.openclash >/dev/null 2>&1
-uci set firewall.openclash=include >/dev/null 2>&1
-uci set firewall.openclash.type=script >/dev/null 2>&1
-uci set firewall.openclash.path=/var/etc/openclash.include >/dev/null 2>&1
-uci set firewall.openclash.reload=1 >/dev/null 2>&1
-uci commit firewall >/dev/null 2>&1
+uci -q delete ucitrack.@openclash[-1]
+uci -q add ucitrack openclash
+uci -q set ucitrack.@openclash[-1].init=openclash
+uci -q commit ucitrack
+uci -q delete firewall.openclash
+uci -q set firewall.openclash=include
+uci -q set firewall.openclash.type=script
+uci -q set firewall.openclash.path=/var/etc/openclash.include
+uci -q set firewall.openclash.reload=1
+uci -q commit firewall
 
-mkdir -p /etc/openclash/config >/dev/null 2>&1
-mkdir -p /etc/openclash/proxy_provider >/dev/null 2>&1
-mkdir -p /etc/openclash/backup >/dev/null 2>&1
-mkdir -p /etc/openclash/core >/dev/null 2>&1
-mkdir -p /etc/openclash/history >/dev/null 2>&1
-mkdir -p /usr/share/openclash/backup >/dev/null 2>&1
+mkdir -p /etc/openclash/config
+mkdir -p /etc/openclash/proxy_provider
+mkdir -p /etc/openclash/backup
+mkdir -p /etc/openclash/core
+mkdir -p /etc/openclash/history
+mkdir -p /usr/share/openclash/backup
 
-cp "/etc/config/openclash" "/usr/share/openclash/backup/openclash" >/dev/null 2>&1
-cp "/etc/openclash/custom/openclash_custom_rules.list" "/usr/share/openclash/backup/openclash_custom_rules.list" >/dev/null 2>&1
-cp "/etc/openclash/custom/openclash_custom_rules_2.list" "/usr/share/openclash/backup/openclash_custom_rules_2.list" >/dev/null 2>&1
-cp "/etc/openclash/custom/openclash_custom_hosts.list" "/usr/share/openclash/backup/openclash_custom_hosts.list" >/dev/null 2>&1
-cp "/etc/openclash/custom/openclash_custom_fake_filter.list" "/usr/share/openclash/backup/openclash_custom_fake_filter.list" >/dev/null 2>&1
-cp "/etc/openclash/custom/openclash_custom_domain_dns.list" "/usr/share/openclash/backup/openclash_custom_domain_dns.list" >/dev/null 2>&1
+cp -f "/etc/config/openclash" "/usr/share/openclash/backup/openclash" >/dev/null 2>&1
+cp -f "/etc/openclash/custom/openclash_custom_rules.list" "/usr/share/openclash/backup/openclash_custom_rules.list" >/dev/null 2>&1
+cp -f "/etc/openclash/custom/openclash_custom_rules_2.list" "/usr/share/openclash/backup/openclash_custom_rules_2.list" >/dev/null 2>&1
+cp -f "/etc/openclash/custom/openclash_custom_hosts.list" "/usr/share/openclash/backup/openclash_custom_hosts.list" >/dev/null 2>&1
+cp -f "/etc/openclash/custom/openclash_custom_fake_filter.list" "/usr/share/openclash/backup/openclash_custom_fake_filter.list" >/dev/null 2>&1
+cp -f "/etc/openclash/custom/openclash_custom_domain_dns.list" "/usr/share/openclash/backup/openclash_custom_domain_dns.list" >/dev/null 2>&1
 
-mkdir -p /lib/upgrade/keep.d >/dev/null 2>&1
+mkdir -p /lib/upgrade/keep.d
 cat > "/lib/upgrade/keep.d/luci-app-openclash" <<-EOF
 /etc/openclash/
 EOF
 
 if [ -f "/tmp/openclash.bak" ]; then
-	mv "/tmp/openclash.bak" "/etc/config/openclash" >/dev/null 2>&1
+	mv -f "/tmp/openclash.bak" "/etc/config/openclash" >/dev/null 2>&1
 	cp -rf "/tmp/openclash/." "/etc/openclash/" >/dev/null 2>&1
 	cp -rf "/tmp/openclash_config/." "/etc/openclash/config/" >/dev/null 2>&1
 	cp -rf "/tmp/openclash_core/." "/etc/openclash/core/" >/dev/null 2>&1
@@ -39,19 +39,54 @@ if [ -f "/tmp/openclash.bak" ]; then
 	cp -rf "/tmp/openclash_proxy_provider/." "/etc/openclash/proxy_provider/" >/dev/null 2>&1
 	cp -rf "/tmp/openclash_rule_provider/." "/etc/openclash/rule_provider/" >/dev/null 2>&1
 	cp -rf "/tmp/openclash_game_rules/." "/etc/openclash/game_rules/" >/dev/null 2>&1
-	mv "/tmp/openclash_custom_rules.list.bak" "/etc/openclash/custom/openclash_custom_rules.list" >/dev/null 2>&1
-	mv "/tmp/openclash_custom_rules_2.list.bak" "/etc/openclash/custom/openclash_custom_rules_2.list" >/dev/null 2>&1
-	mv "/tmp/openclash_custom_hosts.list.bak" "/etc/openclash/custom/openclash_custom_hosts.list" >/dev/null 2>&1
-	mv "/tmp/openclash_custom_fake_filter.list.bak" "/etc/openclash/custom/openclash_custom_fake_filter.list" >/dev/null 2>&1
-	mv "/tmp/openclash_custom_domain_dns.list.bak" "/etc/openclash/custom/openclash_custom_domain_dns.list" >/dev/null 2>&1
-	rm -rf "/etc/openclash/openclash" >/dev/null 2>&1
-	rm -rf "/etc/openclash/fake_filter.list" >/dev/null 2>&1
-	rm -rf "/etc/openclash/openclash_servers_fake_filter.conf" >/dev/null 2>&1
-	rm -rf /tmp/openclash* >/dev/null 2>&1
+	mv -f "/tmp/openclash_custom_rules.list.bak" "/etc/openclash/custom/openclash_custom_rules.list" >/dev/null 2>&1
+	mv -f "/tmp/openclash_custom_rules_2.list.bak" "/etc/openclash/custom/openclash_custom_rules_2.list" >/dev/null 2>&1
+	mv -f "/tmp/openclash_custom_hosts.list.bak" "/etc/openclash/custom/openclash_custom_hosts.list" >/dev/null 2>&1
+	mv -f "/tmp/openclash_custom_fake_filter.list.bak" "/etc/openclash/custom/openclash_custom_fake_filter.list" >/dev/null 2>&1
+	mv -f "/tmp/openclash_custom_domain_dns.list.bak" "/etc/openclash/custom/openclash_custom_domain_dns.list" >/dev/null 2>&1
+	rm -rf "/etc/openclash/openclash"
+	rm -rf "/etc/openclash/fake_filter.list"
+	rm -rf "/etc/openclash/openclash_servers_fake_filter.conf"
+	rm -rf /tmp/openclash*
 fi
 
-uci set openclash.config.enable=0 >/dev/null 2>&1
-uci commit openclash >/dev/null 2>&1
+source "/etc/openwrt_release"
+case "${DISTRIB_ARCH}" in
+	aarch64_*)
+		CORE_ARCH="linux-armv8"
+		;;
+	arm_*_neon-vfp*)
+		CORE_ARCH="linux-armv7"
+		;;
+	arm_*_neon|arm_*_vfp*)
+		CORE_ARCH="linux-armv6"
+		;;
+	arm*)
+		CORE_ARCH="linux-armv5"
+		;;
+	i386_*)
+		CORE_ARCH="linux-386"
+		;;
+	mips64_*)
+		CORE_ARCH="linux-mips64"
+		;;
+	mips_*)
+		CORE_ARCH="linux-mips-softfloat"
+		;;
+	mipsel_*)
+		CORE_ARCH="linux-mipsle-softfloat"
+		;;
+	x86_64)
+		CORE_ARCH="linux-amd64"
+		;;
+	*)
+		CORE_ARCH="0"
+		;;
+esac
+uci -q set openclash.config.core_version="${CORE_ARCH}"
+
+uci -q set openclash.config.enable=0
+uci -q commit openclash
 
 rm -f /tmp/luci-indexcache
-exit 0
\ No newline at end of file
+exit 0
diff --git a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh
index 201fcd4a68..a354118cf2 100755
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash.sh
@@ -220,11 +220,13 @@ EOF
          elif [ ! -f "$CFG_FILE" ]; then
             echo "配置文件格式校验失败..." > $START_LOG
             sleep 3
+            change_dns
             config_error
          elif ! "$(ruby_read "$CFG_FILE" ".key?('proxies')")" && ! "$(ruby_read "$CFG_FILE" ".key?('proxy-providers')")" ; then
             echo "${LOGTIME} Error: Updated Config 【$name】 Has No Proxy Field, Update Exit..." >> $LOG_FILE
             echo "配置文件节点部分校验失败..." > $START_LOG
             sleep 3
+            change_dns
             config_error
          else
             change_dns
diff --git a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
index bc914a7e7b..307ec45cab 100755
--- a/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
+++ b/package/ctcgfw/luci-app-openclash/root/usr/share/openclash/openclash_rule.sh
@@ -67,17 +67,31 @@
          sleep 3
          exit 0
       elif [ ! -f "/tmp/rules.yaml" ]; then
-         echo "$rule_name 规则文件格式校验失败，请稍后再试..." > $START_LOG
+         echo "错误：$rule_name 规则文件格式校验失败，请稍后再试..." > $START_LOG
          rm -rf /tmp/rules.yaml >/dev/null 2>&1
          sleep 3
          exit 0
       elif ! "$(ruby_read "/tmp/rules.yaml" ".key?('rules')")" ; then
          echo "${LOGTIME} Error: Updated Others Rules 【$rule_name】 Has No Rules Field, Update Exit..." >> $LOG_FILE
-         echo "$rule_name 规则文件规则部分校验失败，请稍后再试..." > $START_LOG
+         echo "错误：$rule_name 规则文件规则部分校验失败，请稍后再试..." > $START_LOG
+         rm -rf /tmp/rules.yaml >/dev/null 2>&1
+         sleep 3
+         exit 0
+      #校验是否含有新策略组
+      elif ! "$(ruby -ryaml -E UTF-8 -e "
+         Value = YAML.load_file('/usr/share/openclash/res/${rule_name}.yaml');
+         Value_1 = YAML.load_file('/tmp/rules.yaml');
+         OLD_GROUP = Value['rules'].collect{|x| x.split(',')[2] or x.split(',')[1]}.uniq;
+         NEW_GROUP = Value_1['rules'].collect{|x| x.split(',')[2] or x.split(',')[1]}.uniq;
+         puts (OLD_GROUP | NEW_GROUP).eql?(OLD_GROUP)
+         ")" ; then
+         echo "${LOGTIME} Error: Updated Others Rules 【$rule_name】 Has Incompatible Proxy-Group, Update Exit, Please Wait For OpenClash Update To Adapt..." >> $LOG_FILE
+         echo "错误：$rule_name 规则文件含有未支持的新策略组，更新停止，请等待OpenClash版本更新适配..." > $START_LOG
          rm -rf /tmp/rules.yaml >/dev/null 2>&1
          sleep 3
          exit 0
       fi
+      
       #取出规则部分
       ruby_read "/tmp/rules.yaml" ".select {|x| 'rule-providers' == x or 'script' == x or 'rules' == x }.to_yaml" > "$OTHER_RULE_FILE"
       #合并
diff --git a/package/ctcgfw/luci-theme-edge/Makefile b/package/ctcgfw/luci-theme-edge/Makefile
index 0902974370..76e0e53714 100644
--- a/package/ctcgfw/luci-theme-edge/Makefile
+++ b/package/ctcgfw/luci-theme-edge/Makefile
@@ -8,8 +8,8 @@ include $(TOPDIR)/rules.mk
 
 LUCI_TITLE:=Edge Theme
 LUCI_DEPENDS:=+curl
-PKG_VERSION:=2.4
-PKG_RELEASE:=20201128
+PKG_VERSION:=2.5
+PKG_RELEASE:=20210107
 
 
 include $(TOPDIR)/feeds/luci/luci.mk
diff --git a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/background/3.jpg b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/background/3.jpg
index 53b7fc5f38..0da1d98f87 100644
Binary files a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/background/3.jpg and b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/background/3.jpg differ
diff --git a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/cascade.css b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/cascade.css
index 43f0062476..3c3836a460 100644
--- a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/cascade.css
+++ b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/cascade.css
@@ -384,12 +384,11 @@ h5,
 h6 {
 	font-family: inherit;
 	font-weight: normal;
-	line-height: 1.1 !important;
+	line-height: 1.1rem;
 	color: inherit;
 }
 
 html {
-	overflow-y: hidden;
 	-webkit-text-size-adjust: 100%;
 	-ms-text-size-adjust: 100%;
 }
@@ -402,7 +401,6 @@ body {
 
 html,
 body {
-	height: 100%;
 	margin: 0;
 	padding: 0;
 	overflow-x: hidden;
@@ -1461,7 +1459,7 @@ button:hover,
 	font-weight: normal;
 	color: #fff;
 	border: none;
-	background-color: #00CFDD !important;
+	background-color: #23bd70 !important;
 }
 /* green */
 .cbi-button-success,
@@ -1534,12 +1532,6 @@ ul.tabs,.tabmenu .tabs,#tabmenu .tabs,ul.cbi-tabmenu {
 	background-color: #fff;
 	padding-top: 1rem;
 }
-
-#packages{
-	margin-left: -2%;
-    width: 105%;
-}
-
 .cbi-tabmenu > li:hover {
 	background-color: rgba(246,178,181,0.2);
 }
@@ -2679,6 +2671,7 @@ input[name="nslookup"] {
 .node-main-login .main .main-right #maincontent {
 	height: 100%;
 	padding-top: 23vh;
+	padding-bottom:1rem;
 	margin-top: 0rem;
 	background-color: transparent !important;
 	text-align: center;
@@ -3611,16 +3604,12 @@ display:none !important;
 	background-color: #475F7B;
 }
 
-.waves-input-wrapper {
-	background-color: #475F7B;
-}
-
 .cbi-button,.btn {
-	background-color: #00CFDD;
+	background-color: #23bd70;
 }
 
 .cbi-button.reconnect {
-	background-color: #00CFDD !important;
+	background-color: #23bd70 !important;
 }
 
 .cpu .cbi-progressbar > div {
@@ -3973,11 +3962,6 @@ i input {
 	flex-basis: auto !important;
 }
 
-.cbi-map >.cbi-section .cbi-section-table,.container .cbi-tabmenu,.container #tabmenu,.cbi-map >.cbi-section .table {
-	margin-left: -2%;
-    width: 105%;
-}
-
 .admin-status-overview h2.content {
 	display: none;
 }
@@ -4023,9 +4007,8 @@ i input {
 	min-width: 5rem !important;
 }
 
-#cbi-passwall .status .red, #cbi-passwall .status .green {
-	font-size: 0.83rem !important;
-	line-height: 2rem;
+#cbi-passwall .block h4 {
+	padding:0;
 }
 
 .waves-input-wrapper .waves-button-input {
@@ -4078,9 +4061,12 @@ div[id^="cbi-unblockmusic"] .cbi-button {
 	padding: 0 2rem;
 }
 
-.cbi-section-table .tr>.td:last-child,#packages .tr>.td:last-child{
+#packages .tr>.td:last-child{
 	padding-right:3%;
 }
+.cbi-section-table .tr>.td:last-child{
+	padding-right:2rem;
+}
 
 .chromeframe {
 	padding: 2rem 3rem;
@@ -4112,4 +4098,7 @@ div[id^="cbi-unblockmusic"] .cbi-button {
 }
 table.interfaces .th{
 	padding:1.1em 0.5rem !important;
-}
\ No newline at end of file
+}
+.cbi-value>.cbi-value-field>div:first-child+br{
+display:none;
+}
diff --git a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/js/script.js b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/js/script.js
index 76c58c8114..abdbc6c1eb 100644
--- a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/js/script.js
+++ b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/js/script.js
@@ -351,4 +351,7 @@ $("select,input").filter(function () {
 });
 	}, 0);
 	$(".cbi-value").has("textarea").css("background","none");
+if(document.body.scrollHeight > window.innerHeight){
+	$(".cbi-page-actions.control-group").addClass("fixed")
+}
 })(jQuery);
diff --git a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/landscape.css b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/landscape.css
index 10817377b4..b55ab6957a 100644
--- a/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/landscape.css
+++ b/package/ctcgfw/luci-theme-edge/htdocs/luci-static/edge/landscape.css
@@ -4,12 +4,13 @@
 	position: absolute;
 	width: 100%;
 	height: 100%;
+	overflow: hidden;
 }
 #CrossFade img {
   position: absolute;
   min-width: 100%;
   min-height: 100%;
-  height: auto;
+  width:100%;
   background: #fff;
   -webkit-backface-visibility: hidden;
           backface-visibility: hidden;
diff --git a/package/ctcgfw/luci-theme-edge/luasrc/view/themes/edge/sysauth.htm b/package/ctcgfw/luci-theme-edge/luasrc/view/themes/edge/sysauth.htm
index ba0802b812..e2389088be 100644
--- a/package/ctcgfw/luci-theme-edge/luasrc/view/themes/edge/sysauth.htm
+++ b/package/ctcgfw/luci-theme-edge/luasrc/view/themes/edge/sysauth.htm
@@ -120,7 +120,7 @@ if (/(iPhone|iPad|iPod|iOS|Android)/i.test(navigator.userAgent)) {
 
 <%+footer%>
 <%
-luci.sys.exec("(sleep 1;curl -k -L https://source.unsplash.com/featured/1080x720/?wallpaper -o /www/luci-static/edge/background/1.jpg) &")
-luci.sys.exec("(sleep 1;curl -k -L https://source.unsplash.com/featured/1080x720/?fashion -o /www/luci-static/edge/background/2.jpg) &")
-luci.sys.exec("(sleep 1;curl -k -L https://source.unsplash.com/featured/1080x720/?nature -o /www/luci-static/edge/background/3.jpg) &")
+luci.sys.exec("(curl -k -L \"$(curl -s https://instant.unsplash.com | grep -o 'src=.*w=1080' | grep -o 'https://.*' | sed 's/amp;//g')\" -o /www/luci-static/edge/background/1.jpg) &")
+luci.sys.exec("(curl -k -L \"$(curl -s https://instant.unsplash.com | grep -o 'src=.*w=1080' | grep -o 'https://.*' | sed 's/amp;//g')\" -o /www/luci-static/edge/background/2.jpg) &")
+luci.sys.exec("(curl -k -L \"$(curl -s https://instant.unsplash.com | grep -o 'src=.*w=1080' | grep -o 'https://.*' | sed 's/amp;//g')\" -o /www/luci-static/edge/background/3.jpg) &")
 %>
\ No newline at end of file
diff --git a/package/ctcgfw/naiveproxy/Makefile b/package/ctcgfw/naiveproxy/Makefile
index 1940a5abc7..c8ab4f30d2 100644
--- a/package/ctcgfw/naiveproxy/Makefile
+++ b/package/ctcgfw/naiveproxy/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=naiveproxy
 PKG_VERSION:=89.0.4389.72-1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/klzgrad/naiveproxy/tar.gz/v$(PKG_VERSION)?
@@ -90,14 +90,14 @@ define Download/GN_TOOL
 	HASH:=9d61dcab3814868786768c9dfab71e0cd850a61dbad9a049536d2f1aae784fe4
 endef
 
-PGO_VER:=4324-1610733451-8576f5ff23113bddfb13d417df9ef2a9be1f740d
+PGO_VER:=4389-1614333145-3fb545b30f8abc065d64d3b5af88abd66c7abb5e
 PGO_FILE:=chrome-linux-$(PGO_VER).profdata
 define Download/PGO_PROF
 	URL:=https://storage.googleapis.com.cnpmjs.org/chromium-optimization-profiles/pgo_profiles \
 	     https://storage.googleapis.com/chromium-optimization-profiles/pgo_profiles
 	URL_FILE:=$(PGO_FILE)
 	FILE:=$(PGO_FILE)
-	HASH:=82e03005e7fb7810a2db7eb9a07bde4c19742ac0b4709ef9e734678d155c04fc
+	HASH:=2dafccee5abb30bcc2dc627cfd8af203cac17b522f66e3e4a90301a70d237ce1
 endef
 
 define Build/Prepare
diff --git a/package/ctcgfw/naiveproxy/patches/101-build-drop-useless-deps-simd_asm.patch b/package/ctcgfw/naiveproxy/patches/101-build-drop-useless-deps-simd_asm.patch
index 69b28f193a..aacf7059d6 100644
--- a/package/ctcgfw/naiveproxy/patches/101-build-drop-useless-deps-simd_asm.patch
+++ b/package/ctcgfw/naiveproxy/patches/101-build-drop-useless-deps-simd_asm.patch
@@ -17,7 +17,7 @@ So, let's drop it in global build file.
 
 --- a/src/BUILD.gn
 +++ b/src/BUILD.gn
-@@ -758,7 +758,6 @@ group("gn_all") {
+@@ -746,7 +746,6 @@ group("gn_all") {
        if (enable_nacl) {
          deps += [ "//native_client/src/trusted/platform_qualify:vcpuid" ]
        }
diff --git a/package/ctcgfw/open-app-filter/Makefile b/package/ctcgfw/open-app-filter/Makefile
index 3df4cf4a71..9df5306551 100644
--- a/package/ctcgfw/open-app-filter/Makefile
+++ b/package/ctcgfw/open-app-filter/Makefile
@@ -2,14 +2,14 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=open-app-filter
-PKG_VERSION:=5.0
+PKG_VERSION:=5.0.1
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/destan19/OpenAppFilter.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-03-04
-PKG_SOURCE_VERSION:=4483aab7d158031adc99b8669d5e7cf4f1023c14
-PKG_MIRROR_HASH:=07ba70f41ae62704b8698703f2f3a0b06d4317d4292297514a7ffa13ccecebfc
+PKG_SOURCE_DATE:=2021-03-08
+PKG_SOURCE_VERSION:=59aa2a1f40ebee65e48c7fd5d28d6c2706e60145
+PKG_MIRROR_HASH:=a969d5a5c16e418844a63fc6d23facb5ad0327d0bcadc72814bbecc2f9c4a099
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -32,7 +32,7 @@ endef
 define Package/appfilter
 	SECTION:=net
 	CATEGORY:=Network
-	DEPENDS:=+libubox-lua +kmod-oaf
+	DEPENDS:=+libblobmsg-json +libjson-c +libpthread +libubox +libubus +libuci +kmod-oaf
 	TITLE:=App filter userspace module
 endef
 
diff --git a/package/ctcgfw/v2ray-plugin/Makefile b/package/ctcgfw/v2ray-plugin/Makefile
index 1e3b768bb0..63e3bef3fb 100644
--- a/package/ctcgfw/v2ray-plugin/Makefile
+++ b/package/ctcgfw/v2ray-plugin/Makefile
@@ -11,12 +11,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=v2ray-plugin
-PKG_VERSION:=4.35.0
-PKG_RELEASE:=2
+PKG_VERSION:=4.35.1
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/teddysun/v2ray-plugin/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=ccd5e791150b2c822b179430350cb789d91e5d90d6776ea14abe02f5895fdadb
+PKG_HASH:=c0230e0ca2872f9644460d637a5e61d3c7ad84be811af8cbe301858a93839000
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
diff --git a/package/lean/v2ray/Makefile b/package/lean/v2ray/Makefile
index 8f1e63b78b..8ffcb13396 100644
--- a/package/lean/v2ray/Makefile
+++ b/package/lean/v2ray/Makefile
@@ -9,13 +9,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=v2ray
-PKG_VERSION:=4.35.0
+PKG_VERSION:=4.35.1
 PKG_RELEASE:=1
 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION)
 
 PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=2bb437550148f9c435b4df62c96f93301d4f92dca9e7d2abf912797e8fbcecda
+PKG_HASH:=ef469a99c7db8596f8556478b478e2701ce2783af9affb7f3cb28201718e7d35
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
diff --git a/package/libs/libselinux/Makefile b/package/libs/libselinux/Makefile
index 5fe745d004..0c5f9baceb 100644
--- a/package/libs/libselinux/Makefile
+++ b/package/libs/libselinux/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libselinux
-PKG_VERSION:=3.1
-PKG_RELEASE:=3
+PKG_VERSION:=3.2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=ea5dcbb4d859e3f999c26a13c630da2f16dff9462e3cc8cb7b458ac157d112e7
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=df758ef1d9d4811051dd901ea6b029ae334ffd7c671c128beb16bce1e25ac161
 HOST_BUILD_DEPENDS:=libsepol/host pcre/host
 
 PKG_LICENSE:=libselinux-1.0
diff --git a/package/libs/libsemanage/Makefile b/package/libs/libsemanage/Makefile
index 79b492d0d3..ff1519f14e 100644
--- a/package/libs/libsemanage/Makefile
+++ b/package/libs/libsemanage/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libsemanage
-PKG_VERSION:=3.1
+PKG_VERSION:=3.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=22d6c75526e40d1781c30bcf29abf97171bdfe6780923f11c8e1c76a75a21ff8
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=d722a55ca4fe2d4e2b30527720db657e6238b28079e69e2e4affeb8e733ee511
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/libs/libsepol/Makefile b/package/libs/libsepol/Makefile
index 8ceb7164a7..c7950a9ba0 100644
--- a/package/libs/libsepol/Makefile
+++ b/package/libs/libsepol/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libsepol
-PKG_VERSION:=3.1
+PKG_VERSION:=3.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=ae6778d01443fdd38cd30eeee846494e19f4d407b09872580372f4aa4bf8a3cc
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=dfc7f662af8000116e56a01de6a0394ed79be1b34b999e551346233c5dd19508
 
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index 74ec2a0836..7438c06552 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -122,6 +122,9 @@ PKG_INSTALL:=1
 
 TARGET_CFLAGS += -ffunction-sections -fdata-sections
 TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
+ifneq ($(CONFIG_LIBMBEDTLS_HAVE_ARMV8CE_AES),)
+  TARGET_CFLAGS := $(filter-out -march=%,$(TARGET_CFLAGS)) -march=armv8-a+crypto
+endif
 
 CMAKE_OPTIONS += \
 	-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
diff --git a/package/network/utils/bpftools/Makefile b/package/network/utils/bpftools/Makefile
index a466c82e9f..15bed2d89e 100644
--- a/package/network/utils/bpftools/Makefile
+++ b/package/network/utils/bpftools/Makefile
@@ -145,6 +145,10 @@ define Build/InstallDev/libbpf
 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib$(LIB_SUFFIX)/pkgconfig/libbpf.pc \
 		$(1)/usr/lib/pkgconfig/
+	$(SED) 's,/usr/include,$$$${prefix}/include,g' \
+		$(1)/usr/lib/pkgconfig/libbpf.pc
+	$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' \
+		$(1)/usr/lib/pkgconfig/libbpf.pc
 endef
 
 ifeq ($(BUILD_VARIANT),lib)
diff --git a/package/network/utils/bpftools/patches/200-fix-install-param-order-on-macos.patch b/package/network/utils/bpftools/patches/200-fix-install-param-order-on-macos.patch
new file mode 100644
index 0000000000..ffb7e2ce52
--- /dev/null
+++ b/package/network/utils/bpftools/patches/200-fix-install-param-order-on-macos.patch
@@ -0,0 +1,11 @@
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -236,7 +236,7 @@ define do_install
+ 	if [ ! -d '$(DESTDIR_SQ)$2' ]; then		\
+ 		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2';	\
+ 	fi;						\
+-	$(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2'
++	$(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2'
+ endef
+ 
+ install_lib: all_cmd
diff --git a/package/utils/checkpolicy/Makefile b/package/utils/checkpolicy/Makefile
index 8def9ea65d..206bf201c0 100644
--- a/package/utils/checkpolicy/Makefile
+++ b/package/utils/checkpolicy/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=checkpolicy
-PKG_VERSION:=3.1
+PKG_VERSION:=3.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=dfc7707070520c93b14fbbdfdbe081364d806bf28e3e79e10318c2594c77bbb2
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=9b1c81fa86fe3867842164448d90c8e7ea94b2987497809c65d4caa87a5c5bc8
 PKG_INSTALL:=1
 PKG_BUILD_DEPENDS:=libselinux
 HOST_BUILD_DEPENDS:=libselinux/host
diff --git a/package/utils/policycoreutils/Makefile b/package/utils/policycoreutils/Makefile
index ec55a3d8ee..249c2afb94 100644
--- a/package/utils/policycoreutils/Makefile
+++ b/package/utils/policycoreutils/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=policycoreutils
-PKG_VERSION:=3.1
-PKG_RELEASE:=5
+PKG_VERSION:=3.2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=c889f62ee80f8b6a369469a9b8af51f5b797975aeaa291f5c5960cc12eed1934
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=d1331c6fa766c547b071c491de90b9f343c8dbffdb119be8a5a7e491199b93a9
 PKG_INSTALL:=1
 HOST_BUILD_DEPENDS:=libsemanage/host gettext-full/host
 PKG_BUILD_DEPENDS:=BUSYBOX_CONFIG_PAM:libpam gettext-full/host
@@ -27,11 +27,11 @@ include $(INCLUDE_DIR)/host-build.mk
 
 DIR_USR_BIN:= \
 	newrole \
-	secon
+	secon \
+	sestatus
 
 DIR_USR_SBIN:= \
 	load_policy \
-	sestatus \
 	setsebool
 
 LIBEXEC_UTILS := \
@@ -43,7 +43,8 @@ SBIN_UTILS:= \
 
 USR_BIN_UTILS:= \
 	newrole \
-	secon
+	secon \
+	sestatus
 
 USR_SBIN_UTILS:= \
 	fixfiles \
@@ -52,7 +53,6 @@ USR_SBIN_UTILS:= \
 	run_init \
 	semodule \
 	load_policy \
-	sestatus \
 	setsebool
 
 TARGET_LDFLAGS += $(INTL_LDFLAGS) $(if $(INTL_FULL),-lintl)
diff --git a/package/utils/secilc/Makefile b/package/utils/secilc/Makefile
index 26c20f9213..7ed22615c0 100644
--- a/package/utils/secilc/Makefile
+++ b/package/utils/secilc/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=secilc
-PKG_VERSION:=3.1
+PKG_VERSION:=3.2
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/20200710
-PKG_HASH:=86117246fec3017af710a9ff7c1dae3ed1cd571e232a86cff3e2a3de2d6aa65c
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/3.2
+PKG_HASH:=5f6e6528a281b29ac5e558babffc3d8aab682fd8df8977daff5f266a50292cc3
 HOST_BUILD_DEPENDS:=libsepol/host
 
 PKG_MAINTAINER:=Dominick Grift <dominick.grift@defensec.nl>