luci: add dns64 option

optware: fix optware init script issue
dns-client: fix tcp connect timeout issue.
2023-02-21 23:28:17 +08:00 · 2023-02-21 22:59:50 +08:00 · 2023-02-21 22:38:55 +08:00 · 2023-02-18 21:10:44 +08:00 · 2023-02-17 22:39:23 +08:00 · 2023-02-17 22:09:38 +08:00
89 changed files with 15506 additions and 3909 deletions
--- a/.clang-format
+++ b/.clang-format
--- a/.github/ISSUE_TEMPLATE/issue.md
+++ b/.github/ISSUE_TEMPLATE/issue.md
@@ -15,6 +15,11 @@ assignees: ''
 2. 运营商  
 3. smartdns来源以及版本
 4. 涉及的配置(注意去除个人相关信息)
 **重现步骤**
 1. 上游DNS配置。  
@@ -22,8 +27,8 @@ assignees: ''
 **信息收集**  
-1. 将/var/log/smrtdns.log日志作为附件上传。  
+1. 将/var/log/smrtdns.log日志作为附件上传(注意去除个人相关信息)。  
-2. 如进程异常，请将coredump功能开启，上传coredump信息文件。  
+2. 如进程异常，请将coredump功能开启，上传coredump信息文件，同时上传配套的smartdns进程文件。  
 在自定义界面，开启设置->自定义设置->生成coredump配置，重现问题后提交coredump文件
 coredump文件在/tmp目录下
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 *.o
 .DS_Store
 *.swp.
 systemd/smartdns.service
--- a/57
+++ b/57
@@ -1,18 +1,45 @@
- FROM debian:buster-slim
+FROM ubuntu:latest as smartdns-builder
 LABEL previous-stage=smartdns-builder
- RUN apt update && \
+# prepare builder
-     apt install -y git make gcc libssl-dev && \
+ARG OPENSSL_VER=1.1.1f
-     git clone https://github.com/pymumu/smartdns.git --depth 1 && \
+RUN apt update && \
-     cd smartdns && \
+    apt install -y perl curl make musl-tools musl-dev && \
-     sh ./package/build-pkg.sh --platform debian --arch `dpkg --print-architecture` && \
+    ln -s /usr/include/linux /usr/include/$(uname -m)-linux-musl && \
-     dpkg -i package/*.deb && \
+    ln -s /usr/include/asm-generic /usr/include/$(uname -m)-linux-musl && \
-     cd / && \
+    ln -s /usr/include/$(uname -m)-linux-gnu/asm /usr/include/$(uname -m)-linux-musl && \
-     rm -rf smartdns/ && \
+    \
-     apt autoremove -y git make gcc libssl-dev && \
+    mkdir -p /build/openssl && \
-     apt clean && \
+    cd /build/openssl && \
-     rm -rf /var/lib/apt/lists/*
+    curl -sSL http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_${OPENSSL_VER}.orig.tar.gz | tar --strip-components=1 -zxv && \
    \
    export CC=musl-gcc && \
    if [ "$(uname -m)" = "aarch64" ]; then \
        ./config --prefix=/opt/build no-tests -mno-outline-atomics ; \
    else \ 
        ./config --prefix=/opt/build no-tests ; \
    fi && \
    make all -j8 && make install_sw && \
    cd / && rm -rf /build
- EXPOSE 53/udp
+# do make
- VOLUME "/etc/smartdns/"
+COPY . /build/smartdns/
 RUN cd /build/smartdns && \
    export CC=musl-gcc && \
    export CFLAGS="-I /opt/build/include" && \
    export LDFLAGS="-L /opt/build/lib" && \
    sh ./package/build-pkg.sh --platform linux --arch `dpkg --print-architecture` --static && \
    \
    ( cd package && tar -xvf *.tar.gz && chmod a+x smartdns/etc/init.d/smartdns ) && \
    \
    mkdir -p /release/var/log /release/var/run && \
    cp package/smartdns/etc /release/ -a && \
    cp package/smartdns/usr /release/ -a && \
    cd / && rm -rf /build
- CMD ["/usr/sbin/smartdns", "-f"]
+FROM busybox:latest
 COPY --from=smartdns-builder /release/ /
 EXPOSE 53/udp
 VOLUME "/etc/smartdns/"
 CMD ["/usr/sbin/smartdns", "-f", "-x"]
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -4,7 +4,7 @@
 ![SmartDNS](doc/smartdns-banner.png)
 SmartDNS 是一个运行在本地的 DNS 服务器，它接受来自本地客户端的 DNS 查询请求，然后从多个上游 DNS 服务器获取 DNS 查询结果，并将访问速度最快的结果返回给客户端，以此提高网络访问速度。
-SmartDNS 同时支持指定特定域名 IP 地址，并高性匹配，可达到过滤广告的效果。  
+SmartDNS 同时支持指定特定域名 IP 地址，并高性匹配，可达到过滤广告的效果; 支持DOT(DNS over TLS)和DOH(DNS over HTTPS)，更好的保护隐私。
 与 DNSmasq 的 all-servers 不同，SmartDNS 返回的是访问速度最快的解析结果。详细差异请看[常见问题](#常见问题)。
 支持树莓派、OpenWrt、华硕路由器原生固件和 Windows 系统等。  
@@ -17,6 +17,8 @@ SmartDNS 同时支持指定特定域名 IP 地址，并高性匹配，可达到
  - [特性](#特性)
  - [架构](#架构)
  - [下载](#下载)
    - [使用官方安装源](#使用官方安装源)
    - [手工下载安装](#手工下载安装)
  - [安装和使用](#安装和使用)
    - [标准 Linux 系统 / 树莓派](#标准-linux-系统--树莓派)
    - [OpenWrt](#openwrt)
@@ -97,41 +99,60 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 1. **多 DNS 上游服务器**  
   支持配置多个上游 DNS 服务器，并同时进行查询，即使其中有 DNS 服务器异常，也不会影响查询。  
-2. **返回最快 IP 地址**  
+1. **返回最快 IP 地址**  
   支持从域名所属 IP 地址列表中查找到访问速度最快的 IP 地址，并返回给客户端，提高网络访问速度。
-3. **支持多种查询协议**  
+1. **支持多种查询协议**  
-   支持 UDP、TCP、TLS 和 HTTPS 查询，以及非 53 端口查询。
+   支持 UDP、TCP、DOT 和 DOH 查询，以及非 53 端口查询；支持通过socks5，HTTP代理查询。
-4. **特定域名 IP 地址指定**  
+1. **特定域名 IP 地址指定**  
   支持指定域名的 IP 地址，达到广告过滤效果、避免恶意网站的效果。
-5. **域名高性能后缀匹配**  
+1. **域名高性能后缀匹配**  
   支持域名后缀匹配模式，简化过滤配置，过滤 20 万条记录时间 < 1ms。
-6. **域名分流**  
+1. **域名分流**  
-   支持域名分流，不同类型的域名向不同的 DNS 服务器查询。
+   支持域名分流，不同类型的域名向不同的 DNS 服务器查询，支持iptable和nftable更好的分流；支持测速失败的情况下设置域名结果到对应ipset和nftset集合。
-7. **Windows / Linux 多平台支持**  
+1. **Windows / Linux 多平台支持**  
   支持标准 Linux 系统（树莓派）、OpenWrt 系统各种固件和华硕路由器原生固件。同时还支持 WSL（Windows Subsystem for Linux，适用于 Linux 的 Windows 子系统）。
-8. **支持 IPv4、IPv6 双栈**  
+1. **支持 IPv4、IPv6 双栈**  
   支持 IPv4 和 IPV 6网络，支持查询 A 和 AAAA 记录，支持双栈 IP 速度优化，并支持完全禁用 IPv6 AAAA 解析。
-9. **高性能、占用资源少**  
+1. **支持DNS64**  
   支持DNS64转换。
 1. **高性能、占用资源少**  
   多线程异步 IO 模式，cache 缓存查询结果。
 1. **主流系统官方支持**  
   主流路由系统官方软件源安装smartdns。
 ## 架构
 ![Architecture](https://github.com/pymumu/test/releases/download/blob/architecture.png)
 1. SmartDNS 接收本地网络设备的DNS 查询请求，如 PC、手机的查询请求；
-2. 然后将查询请求发送到多个上游 DNS 服务器，可支持 UDP 标准端口或非标准端口查询，以及 TCP 查询；
+1. 然后将查询请求发送到多个上游 DNS 服务器，可支持 UDP 标准端口或非标准端口查询，以及 TCP 查询；
-3. 上游 DNS 服务器返回域名对应的服务器 IP 地址列表，SmartDNS 则会检测从本地网络访问速度最快的服务器 IP；
+1. 上游 DNS 服务器返回域名对应的服务器 IP 地址列表，SmartDNS 则会检测从本地网络访问速度最快的服务器 IP；
-4. 最后将访问速度最快的服务器 IP 返回给本地客户端。
+1. 最后将访问速度最快的服务器 IP 返回给本地客户端。
 ## 下载
 ### 使用官方安装源
 smartdns已经合入主流系统的软件仓库，可以直接使用系统安装命令直接安装。
 系统|安装方式|说明|
 --|--|--
 openwrt|opkg update<br />opkg install luci-app-smartdns<br />opkg install smartdns|22.03之后的系统。软件源路径：<https://downloads.openwrt.org/releases/>
 ddwrt|官方最新固件service页面->SmartDNS Resolver->启用。|选择界面参考：<https://forum.dd-wrt.com/demo/Services.html>
 debian|apt-get install smartdns|
 entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.entware.net/>
 ### 手工下载安装
 --------------
 下载对应系统或固件版本的 SmartDNS 安装包，对应关系如下。
@@ -156,9 +177,11 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 **请注意：**
-* Release 释出的软件包采取静态编译，无外部依赖，但体积大。若需要小体积软件包，请自行编译或从 OpenWrt / Entware 仓库获取。
+- Release 释出的软件包采取静态编译，无外部依赖，但体积大。若需要小体积软件包，请自行编译或从 OpenWrt / Entware 仓库获取。
-* 静态编译的软件包未强制判断 CPU 架构，安装不正确的软件包将会导致服务无法启动，请确保正确安装对应的版本。
+- 静态编译的软件包未强制判断 CPU 架构，安装不正确的软件包将会导致服务无法启动，请确保正确安装对应的版本。
 - MacOS，Windows可获取Rust语言实现的Smartdns: [SmartDNS-rs](https://github.com/mokeyish/smartdns-rs)。 
 ## 安装和使用
@@ -168,60 +191,78 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 1. 安装
-   下载配套安装包，并上传到 Linux 系统中。 
+    下载配套安装包，并上传到 Linux 系统中。
-   标准 Linux 系统（X86 / X86_64）请执行如下命令安装：
+    标准 Linux 系统（X86 / X86_64）请执行如下命令安装：
-   ```shell
+    ```shell
-   $ tar zxf smartdns.1.yyyy.MM.dd-REL.x86_64-linux-all.tar.gz
+    tar zxf smartdns.1.yyyy.MM.dd-REL.x86_64-linux-all.tar.gz
-   $ cd smartdns
+    cd smartdns
-   $ chmod +x ./install
+    chmod +x ./install
-   $ ./install -i
+    ./install -i
-   ```
+    ```
-   树莓派或其他 Debian 系系统（ARM / ARM64）请执行如下命令安装：
+    树莓派或其他 Debian 系系统（ARM / ARM64）请执行如下命令安装：
-   ```shell
+    ```shell
-   # dpkg -i smartdns.1.yyyy.MM.dd-REL.arm-debian-all.deb
+    dpkg -i smartdns.1.yyyy.MM.dd-REL.arm-debian-all.deb
-   ```
+    ```
-2. 修改配置
+    **对于Ubuntu系统：**
    - `systemd-resolved`会占用TCP53和UDP53端口。你需要手动解决端口占用问题或者修改smartdns监听端口
    - 日志文件在`/var/log/smartdns/smartdns.log`
 1. 修改配置
    安装完成后，可配置 SmartDNS 的上游服务器信息。
-    一般情况下，只需要增加 `server `[`IP`]`:port` 和 `server-tcp `[`IP`]`:port` 配置项。
+    一般情况下，只需要增加 `server`[`IP`]`:port` 和 `server-tcp`[`IP`]`:port` 配置项。
    请尽可能配置多个上游 DNS 服务器，包括国内外的服务器。
    具体配置参数请参考[配置文件说明](#配置文件说明)。  
-   ```shell
+    ```shell
-   # vi /etc/smartdns/smartdns.conf
+    vi /etc/smartdns/smartdns.conf
-   ```
+    ```
-3. 启动服务
+    `/etc/smartdns/smartdns.conf`配置包含如下基本内容：
-   ```shell
+    ```shell
-   # systemctl enable smartdns
+    # 指定监听的端口号
-   # systemctl start smartdns
+    bind []:53 
-   ```
+    # 指定上游服务器
    server 1.1.1.1
    server-tls 8.8.8.8
    # 指定域名规则
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
-4. 将 DNS 请求转发到 SmartDNS 解析
+1. 启动服务
    ```shell
    systemctl enable smartdns
    systemctl start smartdns
    ```
 1. 将 DNS 请求转发到 SmartDNS 解析
    修改本地路由器的 DNS 服务器，将 DNS 服务器配置为 SmartDNS。
-   * 登录到本地网络的路由器中，配置树莓派，分配其静态 IP 地址。
+   - 登录到本地网络的路由器中，配置树莓派，分配其静态 IP 地址。
-   * 修改 WAN 口或者 DHCP DNS 为树莓派 IP 地址。
+   - 修改 WAN 口或者 DHCP DNS 为树莓派 IP 地址。
     **注意：**
      I. 每款路由器配置方法不尽相同，请在网络上搜索对应配置方法。
      II. 华为等路由器可能不支持配置 DNS 为本地 IP，可修改电脑端或手机端的 DNS 服务器为树莓派 IP。
-5. 检测服务是否配置成功
+1. 检测服务是否配置成功
    执行
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
@@ -244,115 +285,59 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    将软件包（使用 WinSCP 等）上传到路由器的 `/root` 目录，执行如下命令安装
   ```shell
-   # opkg install smartdns.1.yyyy.MM.dd-REL.xxxx.ipk
+   opkg install smartdns.1.yyyy.MM.dd-REL.xxxx.ipk
-   # opkg install luci-app-smartdns.1.yyyy.MM.dd-REL.all.ipk
+   opkg install luci-app-smartdns.1.yyyy.MM.dd-REL.all.ipk
   ```
-   * **注意：** 19.07 之前的版本，请务必安装 `luci-app-smartdns.1.yyyy.MM.dd-REL.all-luci-compat-all.ipk`。
+   - **注意：** 19.07 之前的版本，请务必安装 `luci-app-smartdns.1.yyyy.MM.dd-REL.all-luci-compat-all.ipk`。
-2. 修改配置
+1. 修改配置
    登录 OpenWrt 管理页面，打开 `Services` -> `SmartDNS` 进行配置。
-   * 在 `Upstream Servers` 增加上游 DNS 服务器配置，建议配置多个国内外 DNS 服务器。
+   - 在 `Upstream Servers` 增加上游 DNS 服务器配置，建议配置多个国内外 DNS 服务器。
-   * 在 `Domain Address` 指定特定域名的 IP 地址，可用于广告屏蔽。
+   - 在 `Domain Address` 指定特定域名的 IP 地址，可用于广告屏蔽。
-3. 启用服务
+1. 启用服务
-   SmartDNS 服务生效方法有两种，一种是**直接作为主 DNS 服务**，另一种是**作为 DNSmasq 的上游**。
+   - 替换默认Dnsmasq为主DNS。
   默认情况下，SmartDNS 采用第一种方式。如下两种方式根据需求选择即可。
-   - **方法一：作为主 DNS 服务（默认方案）**
+     登录 OpenWrt 管理界面，点击 `Services` -> `SmartDNS` -> `port`，设置端口号为`53`，smartdns会自动接管主DNS服务器。
-     * 启用 SmartDNS 的 53 端口重定向
+   - 检测转发服务是否配置成功
-       登录 OpenWrt 管理界面，点击 `Services` -> `SmartDNS` -> `redirect`，选择 `重定向 53 端口到 SmartDNS `启用 53 端口转发。
+     执行
-     * 检测转发服务是否配置成功
+     ```shell
     nslookup -querytype=ptr smartdns
     ```
-       执行
+     查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
-       ```shell
+     ```shell
-       $ nslookup -querytype=ptr smartdns
+     $ nslookup -querytype=ptr smartdns
-       ```
+     Server:         192.168.1.1
     Address:        192.168.1.1#53
-       查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
+     Non-authoritative answer:
     smartdns        name = smartdns.
     ```
-       ```shell
+1. 启动服务
       $ nslookup -querytype=ptr smartdns
       Server:         192.168.1.1
       Address:        192.168.1.1#53
       Non-authoritative answer:
       smartdns        name = smartdns.
       ```
     * 界面提示重定向失败
       * 检查 `iptables` 和/或 `ip6tables` 命令是否正确安装。
       * OpenWrt 15.01 系统不支持 IPv6 重定向，如网络需要支持 IPv6，请将 DNSmasq 上游改为 SmartDNS，或者将 SmartDNS 的端口改为53，并停用 DNSmasq。
       * LEDE 系统请安装 IPv6 的 NAT 转发驱动。点击 `System` -> `Software`，点击 `Update lists` 更新软件列表后，安装 `ip6tables-mod-nat`。
       * 使用如下命令检查路由规则是否生效
         ```shell
         iptables -t nat -L PREROUTING | grep REDIRECT
         ```
       * 如转发功能不正常，请使用**方法二：作为 DNSmasq 的上游**。
   - **方法二：作为 DNSmasq 的上游**
     * **将 DNSmasq 的请求发送到 SmartDNS**
       登录 OpenWrt 管理界面，点击 `Services` -> `SmartDNS` -> `Redirect`，选择`作为 DNSmasq 的上游服务器`，设置 DNSmasq 的上游服务器为 SmartDNS。
     * **检测上游服务是否配置成功**
       * 方法一
         执行
         ```shell
         $ nslookup -querytype=ptr smartdns
         ```
         查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
         ```shell
         $ nslookup -querytype=ptr smartdns
         Server:         192.168.1.1
         Address:        192.168.1.1#53
         Non-authoritative answer:
         smartdns        name = smartdns.
         ```
       * 方法二
         使用 `nslookup` 查询域名（例如 `www.baidu.com`），查看结果中 IP 地址是否**只有一个**，如有多个 IP 地址返回，则表示未生效，请多尝试几个域名检查。
         ```shell
         $ nslookup www.baidu.com 192.168.1.1
         Server:         192.168.1.1
         Address:        192.168.1.1#53
         Non-authoritative answer:
         www.baidu.com   canonical name = www.a.shifen.com.
         Name:   www.a.shifen.com
         Address: 14.215.177.38
         ```
 4. 启动服务
    勾选配置页面中的 `Enable（启用）`来启动 SmartDNS。
-5. **注意：**
+1. **注意：**
-   * 如已经安装 ChinaDNS，建议将 ChinaDNS 的上游配置为 SmartDNS。
+   - 如已经安装 ChinaDNS，建议将 ChinaDNS 的上游配置为 SmartDNS。
-   * SmartDNS 默认情况下将 53 端口的请求转发到 SmartDNS的 本地端口，此行为由 `Redirect` 配置选项控制。
+   - 当smartdns的端口为53时，将自动接管dnsmasq为主dns。配置其他端口时，会重新启用dnsmasq为主dns。
   - 若在此过程中发生异常，可使用如下命令还原dnsmasq为主DNS
   ```shell
   uci delete dhcp.@dnsmasq[0].port
   uci commit dhcp
   /etc/init.d/dnsmasq restart
   ```
 ### 华硕路由器原生固件 / 梅林固件
@@ -364,30 +349,30 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    在使用此软件时，需要确认路由器是否支持 U 盘，并准备好 U 盘一个。
-2. 启用 SSH 登录
+1. 启用 SSH 登录
    登录管理界面，点击 `系统管理` -> `系统设置`，配置 `Enable SSH` 为 `Lan Only`。  
    SSH 登录用户名密码与管理界面相同。
-3. 下载 `Download Master`
+1. 下载 `Download Master`
    在管理界面点击 `USB 相关应用` -> `Download Master` 下载。  
    下载完成后，启用 `Download Master`，如果不需要下载功能，此时可以卸载 `Download Master`，但要保证卸载前 `Download Master` 是启用的。  
-4. 安装 SmartDNS
+1. 安装 SmartDNS
    将软件包（使用 WinSCP 等）上传到路由器的 `/tmp/mnt/sda1` 目录（或网上邻居复制到 sda1 共享目录），执行如下命令安装
   ```shell
-   # ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
+   ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
   ```
-5. 重启路由器使服务生效
+1. 重启路由器使服务生效
    待路由器启动后， 执行
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
@@ -401,7 +386,7 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
   smartdns        name = smartdns.
   ```
-6. **额外说明**
+1. **额外说明**
    上述过程，SmartDNS 将安装到 U 盘根目录，采用 Optware 的模式运行。
    其目录结构如下（此处仅列出 SmartDNS 相关文件）：
@@ -426,9 +411,22 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    如要修改配置，可以 SSH 登录路由器，使用 vi 命令修改
   ```shell
-   # vi /opt/etc/smartdns/smartdns.conf
+   vi /opt/etc/smartdns/smartdns.conf
   ```
    `/opt/etc/smartdns/smartdns.conf`配置包含如下基本内容：
    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
    server 1.1.1.1
    server-tls 8.8.8.8
    # 指定域名规则
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
   也可以通过网上邻居修改，网上邻居共享目录 `sda1` 看不到 `asusware.mipsbig` 目录，但可以直接在`文件管理器`中输入 `asusware.mipsbig\etc\init.d` 访问
   ```shell
@@ -443,32 +441,45 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    在使用此软件时，需要确认路由器是否支持 U 盘，并准备好 U 盘一个。
-2. 安装 SmartDNS
+1. 安装 SmartDNS
    将软件（使用 WinSCP 等）上传到路由器的 `/tmp` 目录，执行如下命令安装
   ```shell
-   # ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
+   ipkg install smartdns.1.yyyy.MM.dd-REL.mipsbig.ipk
   ```
-3. 修改 SmartDNS 配置
+1. 修改 SmartDNS 配置
   ```shell
-   # vi /opt/etc/smartdns/smartdns.conf
+   vi /opt/etc/smartdns/smartdns.conf
   ```
   `/opt/etc/smartdns/smartdns.conf`配置包含如下基本内容：
    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
    server 1.1.1.1
    server-tls 8.8.8.8
    # 指定域名规则
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
    另外，如需支持 IPv6，可设置工作模式为 `2`，将 DNSmasq 的 DNS 服务禁用，设置 SmartDNS 为主用 DNS 服务器。将文件 `/opt/etc/smartdns/smartdns-opt.conf` 中的 `SMARTDNS_WORKMODE` 的值修改为 `2`
   ```shell
   SMARTDNS_WORKMODE="2"
   ```
-4. 重启路由器使服务生效
+1. 重启路由器使服务生效
    待路由器启动后， 执行
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
@@ -492,7 +503,7 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    安装 WSL 运行环境，发行版本选择 Ubuntu 系统为例。安装步骤请参考 [WSL 安装说明](https://docs.microsoft.com/zh-CN/windows/wsl/install)
-2. 安装 SmartDNS
+1. 安装 SmartDNS
    下载适用于 WSL 的安装包，并解压到如 D 盘根目录。解压后目录如下：
@@ -510,7 +521,7 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
     双击 `D:\smartdns\package\windows` 目录下的 `install.bat` 进行安装。要求输入密码时，请输入 `WLS ubuntu` 的密码。
-3. 修改配置
+1. 修改配置
    用记事本等打开 `D:\smartdns\etc\smartdns` 目录中的 `smartdns.conf` 配置文件配置 SmartDNS。
@@ -518,21 +529,33 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    尽可能配置多个上游DNS服务器，包括国内外的服务器。
    具体配置请参考[配置文件说明](#配置文件说明)。
     `smartdns.conf` 配置包含如下基本内容：
-4. 重新加载配置
+    ```shell
    # 指定监听的端口号
    bind []:53 
    # 指定上游服务器
    server 1.1.1.1
    server-tls 8.8.8.8
    # 指定域名规则
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
 1. 重新加载配置
    双击 `D:\smartdns\package\windows` 目录下的 `reload.bat` 进行重新加载。要求输入密码时，请输入 `WLS ubuntu` 的密码。
-5. 将 DNS 请求转发到 SmartDNS 解析
+1. 将 DNS 请求转发到 SmartDNS 解析
    将 Windows 的默认 DNS 服务器修改为 `127.0.0.1`，具体步骤参考 Windows [更改 TCP/IP 设置](https://support.microsoft.com/zh-cn/help/15089/windows-change-tcp-ip-settings)。
-6. 检测服务是否配置成功
+1. 检测服务是否配置成功
    执行
   ```shell
-   $ nslookup -querytype=ptr smartdns
+   nslookup -querytype=ptr smartdns
   ```
    查看命令结果中的 `name` 是否为 `smartdns` 或你的主机名，如果是则表示生效
@@ -548,51 +571,70 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
 ## 配置文件说明
 配置建议：**smartdns默认已设置为最优模式，适合大部分场景的DNS查询体验改善，一般情况只需要增加上游服务器地址即可，无需做其他配置修改；如有其他配置修改，请务必了解其用途，避免修改后起到反作用。**
 | 键名 | 功能说明 | 默认值 | 可用值/要求 | 举例 |
 | :--- | :--- | :--- | :--- | :--- |
-| `server-name` | DNS 服务器名称 | 操作系统主机名 / `smartdns` | 符合主机名规格的字符串 | `server-name smartdns` |
+| server-name | DNS 服务器名称 | 操作系统主机名 / smartdns | 符合主机名规格的字符串 | server-name smartdns |
-| `bind` | DNS 监听端口号  | `[::]:53` | 可绑定多个端口。<br>`IP:PORT`: 服务器 IP:端口号<br>[`-group`]: 请求时使用的 DNS 服务器组<br>[`-no-rule-addr`]：跳过 address 规则<br>[`-no-rule-nameserver`]：跳过 Nameserver 规则<br>[`-no-rule-ipset`]：跳过 ipset 规则<br>[`-no-rule-soa`]：跳过 SOA(#) 规则<br>[`-no-dualstack-selection`]：停用双栈测速<br>[`-no-speed-check`]：停用测速<br>[`-no-cache`]：停止缓存 | `bind :53` |
+| bind | DNS 监听端口号  | [::]:53 | 可绑定多个端口。<br />IP:PORT@DEVICE: 服务器 IP:端口号@设备名<br />[-group]: 请求时使用的 DNS 服务器组<br />[-no-rule-addr]：跳过 address 规则<br />[-no-rule-nameserver]：跳过 Nameserver 规则<br />[-no-rule-ipset]：跳过 ipset 和 nftset 规则<br />[-no-rule-soa]：跳过 SOA(#) 规则<br />[-no-dualstack-selection]：停用双栈测速<br />[-no-speed-check]：停用测速<br />[-no-cache]：停止缓存 | bind :53@eth0 |
-| `bind-tcp` | DNS TCP 监听端口号 | `[::]:53` | 可绑定多个端口。<br>`IP:PORT`: 服务器 IP:端口号<br>[`-group`]: 请求时使用的 DNS 服务器组<br>[`-no-rule-addr`]：跳过 address 规则<br>[`-no-rule-nameserver`]：跳过 `nameserver` 规则<br>[`-no-rule-ipset`]：跳过 `ipset` 规则。<br>[`-no-rule-soa`]：跳过 SOA(#) 规则<br>[`-no-dualstack-selection`]：停用双栈测速<br>[`-no-speed-check`]：停用测速<br>[`-no-cache`]：停止缓存 | `bind-tcp :53` |
+| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。<br />IP:PORT@DEVICE: 服务器 IP:端口号@设备名<br />[-group]: 请求时使用的 DNS 服务器组<br />[-no-rule-addr]：跳过 address 规则<br />[-no-rule-nameserver]：跳过 nameserver 规则<br />[-no-rule-ipset]：跳过 ipset 和 nftset 规则。<br />[-no-rule-soa]：跳过 SOA(#) 规则<br />[-no-dualstack-selection]：停用双栈测速<br />[-no-speed-check]：停用测速<br />[-no-cache]：停止缓存 | bind-tcp :53 |
-| `cache-size` | 域名结果缓存个数 | `512` | 大于等于 `0` 的数字 | `cache-size 512` |
+| cache-size | 域名结果缓存个数 | 512 | 大于等于 0 的数字 | cache-size 512 |
-| `cache-persist` | 是否持久化缓存 | 自动。<br>当 `cache-file` 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [`yes`\|`no`] | `cache-persist yes` |
+| cache-persist | 是否持久化缓存 | 自动。<br />当 cache-file 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [yes\|no] | cache-persist yes |
-| `cache-file` | 缓存持久化文件路径 | `/tmp/smartdns.cache` | 合法路径字符串 | `cache-file /tmp/smartdns.cache` |
+| cache-file | 缓存持久化文件路径 | /tmp/<br />smartdns.cache | 合法路径字符串 | cache-file /tmp/smartdns.cache |
-| `tcp-idle-time` | TCP 链接空闲超时时间 | `120` | 大于等于 `0` 的数字 | `tcp-idle-time 120` |
+| tcp-idle-time | TCP 链接空闲超时时间 | 120 | 大于等于 0 的数字 | tcp-idle-time 120 |
-| `rr-ttl` | 域名结果 TTL | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl 600` |
+| rr-ttl | 域名结果 TTL | 远程查询结果 | 大于 0 的数字 | rr-ttl 600 |
-| `rr-ttl-min` | 允许的最小 TTL 值 | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl-min 60` |
+| rr-ttl-min | 允许的最小 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-min 60 |
-| `rr-ttl-max` | 允许的最大 TTL 值 | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl-max 600` |
+| rr-ttl-max | 允许的最大 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-max 600 |
-| `log-level` | 设置日志级别 | `error` | `fatal`、`error`、`warn`、`notice`、`info` 或 `debug` | `log-level error` |
+| rr-ttl-reply-max | 允许返回给客户端的最大 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-reply-max 60 |
-| `log-file` | 日志文件路径 | `/var/log/smartdns.log` | 合法路径字符串 | `log-file /var/log/smartdns.log` |
+| local-ttl | 本地HOST，address的TTL值 | rr-ttl-min | 大于 0 的数字 | local-ttl  60 |
-| `log-size` | 日志大小 | `128K` | 数字 + `K`、`M` 或 `G` | `log-size 128K` |
+| max-reply-ip-num | 允许返回给客户的最大IP数量 | IP数量 | 大于 0 的数字 | max-reply-ip-num 1 |
-| `log-num` | 日志归档个数 | `2` | 大于等于 `0` 的数字 | `log-num 2` |
+| log-level | 设置日志级别 | error | fatal、error、warn、notice、info 或 debug | log-level error |
-| `audit-enable` | 设置审计启用 | `no` | [`yes`\|`no`] | `audit-enable yes` |
+| log-file | 日志文件路径 | /var/log/<br />smartdns/<br />smartdns.log | 合法路径字符串 | log-file /var/log/smartdns/smartdns.log |
-| `audit-file` | 审计文件路径 | `/var/log/smartdns-audit.log` | 合法路径字符串 | `audit-file /var/log/smartdns-audit.log` |
+| log-size | 日志大小 | 128K | 数字 + K、M 或 G | log-size 128K |
-| `audit-size` | 审计大小 | `128K` | 数字 + `K`、`M` 或 `G` | `audit-size 128K` |
+| log-num | 日志归档个数 | openwrt为2， 其他系统为8 | 大于等于 0 的数字，0表示禁用日志 | log-num 2 |
-| `audit-num` | 审计归档个数 | `2` | 大于等于 `0` 的数字 | `audit-num 2` |
+| log-file-mode | 日志归档文件权限 | 0640 | 文件权限 | log-file-mode 644 |
-| `conf-file` | 附加配置文件 | 无 | 合法路径字符串 | `conf-file /etc/smartdns/smartdns.more.conf` |
+| audit-enable | 设置审计启用 | no | [yes\|no] | audit-enable yes |
-| `server` | 上游 UDP DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选）<br>[`-blacklist-ip`]：配置 IP 过滤结果。<br>[`-whitelist-ip`]：指定仅接受参数中配置的 IP 范围<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server 8.8.8.8:53 -blacklist-ip -group g1` |
+| audit-file | 审计文件路径 | /var/log/<br />smartdns/<br />smartdns-audit.log | 合法路径字符串 | audit-file /var/log/smartdns/smartdns-audit.log |
-| `server-tcp` | 上游 TCP DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选）<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：指定仅接受参数中配置的 IP 范围。<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除  | `server-tcp 8.8.8.8:53` |
+| audit-size | 审计大小 | 128K | 数字 + K、M 或 G | audit-size 128K |
-| `server-tls` | 上游 TLS DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选)<br>[`-spki-pin` [`sha256-pin`]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[`-host-name`]：TLS SNI 名称<br>[`-tls-host-verify`]：TLS 证书主机名校验<br> [`-no-check-certificate`]：跳过证书校验<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：仅接受参数中配置的 IP 范围<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server-tls 8.8.8.8:853` |
+| audit-num | 审计归档个数 | 2 | 大于等于 0 的数字 | audit-num 2 |
-| `server-https` | 上游 HTTPS DNS | 无 | 可重复。<br>`https://`[`host`][`:port`]`/path`：服务器 IP:端口（可选）<br>[`-spki-pin` [`sha256-pin`]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[`-host-name`]：TLS SNI 名称<br>[`-http-host`]：http 协议头主机名<br>[`-tls-host-verify`]：TLS 证书主机名校验<br> [`-no-check-certificate`]：跳过证书校验<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：仅接受参数中配置的 IP 范围。<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server-https https://cloudflare-dns.com/dns-query` |
+| audit-file-mode | 审计归档文件权限 | 0640 | 文件权限 | log-file-mode 644 |
-| `speed-check-mode` | 测速模式选择 | 无 | [`ping`\|`tcp:`[`80`]\|`none`] | `speed-check-mode ping,tcp:80` |
+| conf-file | 附加配置文件 | 无 | 合法路径字符串 | conf-file /etc/smartdns/smartdns.more.conf |
-| `address` | 指定域名 IP 地址 | 无 | `address /domain/`[`ip`\|`-`\|`-4`\|`-6`\|`#`\|`#4`\|`#6`] <br>`-` 表示忽略 <br>`#` 表示返回 SOA <br>`4` 表示 IPv4 <br>`6` 表示 IPv6 | `address /www.example.com/1.2.3.4` |
+| server | 上游 UDP DNS | 无 | 可重复。<br />[ip][:port]\|URL：服务器 IP:端口（可选）或 URL <br />[-blacklist-ip]：配置 IP 过滤结果。<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server 8.8.8.8:53 -blacklist-ip -group g1 -proxy proxy<br /> server tls://8.8.8.8|
-| `nameserver` | 指定域名使用 `server` 组解析 | 无 | `nameserver /domain/`[`group`\|`-`], `group` 为组名，`-` 表示忽略此规则，配套 `server` 中的 `-group` 参数使用 | `nameserver /www.example.com/office` |
+| server-tcp | 上游 TCP DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选）<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tcp 8.8.8.8:53 |
-| `ipset` | 域名 ipset | 无 | `ipset /domain/`[`ipset`\|`-`\|`#`[`4`\|`6`]:[`ipset`\|`-`][`,#`[`4`\|`6`]`:`[`ipset`\|`-`]]]，`-`表示忽略 | `ipset /www.example.com/#4:dns4,#6:-` |
+| server-tls | 上游 TLS DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选)<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tls 8.8.8.8:853 |
-| `ipset-timeout` | 设置 `ipset` 超时功能启用  | 自动 | [`yes`] | `ipset-timeout yes` |
+| server-https | 上游 HTTPS DNS | 无 | 可重复。<br /><https://[host>][:port]/path：服务器 IP:端口（可选）<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称<br />[-http-host]：http 协议头主机名<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-https <https://cloudflare-dns.com/dns-query> |
-| `domain-rules` | 设置域名规则 | 无 | `domain-rules /domain/` [`-rules`...]<br>[`-c`\|`-speed-check-mode`]：测速模式，参考 `speed-check-mode` 配置<br>[`-a`\|`-address`]：参考 `address` 配置<br>[`-n`\|`-nameserver`]：参考 `nameserver` 配置<br>[`-p`\|`-ipset`]：参考`ipset`配置<br>[`-d`\|`-dualstack-ip-selection`]：参考 `dualstack-ip-selection`  | `domain-rules /www.example.com/ -speed-check-mode none` |
+| proxy-server | 代理服务器 | 无 | 可重复。<br />proxy-server URL <br />[URL]: [socks5\|http]://[username:password@]host:port<br />[-name]: 代理服务器名称。 |proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy|
-| `bogus-nxdomain` | 假冒 IP 地址过滤 | 无 | [`ip/subnet`]，可重复 | `bogus-nxdomain 1.2.3.4/16` |
+| speed-check-mode | 测速模式选择 | 无 | [ping\|tcp:[80]\|none] | speed-check-mode ping,tcp:80,tcp:443 |
-| `ignore-ip` | 忽略 IP 地址 | 无 | [`ip/subnet`]，可重复 | `ignore-ip 1.2.3.4/16` |
+| response-mode | 首次查询响应模式 | first-ping |模式：[first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: 最快ping响应地址模式，DNS上游最快查询时延+ping时延最短，查询等待与链接体验最佳;<br />[fastest-ip]: 最快IP地址模式，查询到的所有IP地址中ping最短的IP。需等待IP测速; <br />[fastest-response]: 最快响应的DNS结果，DNS查询等待时间最短，返回的IP地址可能不是最快。| response-mode first-ping |
-| `whitelist-ip` | 白名单 IP 地址 | 无 | [`ip/subnet`]，可重复 | `whitelist-ip 1.2.3.4/16` |
+| address | 指定域名 IP 地址 | 无 | address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6] <br />- 表示忽略 <br /># 表示返回 SOA <br />4 表示 IPv4 <br />6 表示 IPv6 | address /www.example.com/1.2.3.4 |
-| `blacklist-ip` | 黑名单 IP 地址 | 无 | [`ip/subnet`]，可重复 | `blacklist-ip 1.2.3.4/16` |
+| cname | 指定域名别名 | 无 | cname /domain/target <br />- 表示忽略 <br />指定对应域名的cname | cname /www.example.com/cdn.example.com |
-| `force-AAAA-SOA` | 强制 AAAA 地址返回 SOA | `no` | [`yes`\|`no`] | `force-AAAA-SOA yes` |
+| dns64 | DNS64转换 | 无 | dns64 ip-prefix/mask <br /> ipv6前缀和掩码 | dns64 64:ff9b::/96 |
-| `force-qtype-SOA` | 强制指定 qtype 返回 SOA | qtype id | [`<qtypeid>` \| ...] | `force-qtype-SOA 65 28`
+| nameserver | 指定域名使用 server 组解析 | 无 | nameserver /domain/[group\|-], group 为组名，- 表示忽略此规则，配套 server 中的 -group 参数使用 | nameserver /www.example.com/office |
-| `prefetch-domain` | 域名预先获取功能 | `no` | [`yes`\|`no`] | `prefetch-domain yes` |
+| ipset | 域名 ipset | 无 | ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略 | ipset /www.example.com/#4:dns4,#6:- <br />ipset /www.example.com/dns |
-| `serve-expired` | 过期缓存服务功能 | `no` | [`yes`\|`no`]，开启此功能后，如果有请求时尝试回应 TTL 为 0 的过期记录，并发查询记录，以避免查询等待 |
+| ipset-timeout | 设置 ipset 超时功能启用  | no | [yes\|no] | ipset-timeout yes |
-| `serve-expired-ttl` | 过期缓存服务最长超时时间 | `0` | 秒，`0` 表示停用超时，大于 `0` 表示指定的超时的秒数 | `serve-expired-ttl 0` |
+| ipset-no-speed | 当测速失败时，将域名结果设置到ipset集合中 | 无 | ipset \| #[4\|6]:ipset | ipset-no-speed #4:ipset4,#6:ipse6 <br /> ipset-no-speed ipset|
-| `serve-expired-reply-ttl` | 回应的过期缓存 TTL | `5` | 秒，`0` 表示停用超时，大于 `0` 表示指定的超时的秒数 | `serve-expired-reply-ttl 30` |
+| nftset | 域名 nftset | 无 | nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，<br />-表示忽略；<br />ipv4 地址的 family 只支持 inet 和 ip；<br />ipv6 地址的 family 只支持 inet 和 ip6；<br />由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#tab#dns4,#6:- |
-| `dualstack-ip-selection` | 双栈 IP 优选 | `no` | [`yes`\|`no`] | `dualstack-ip-selection yes` |
+| nftset-timeout | 设置 nftset 超时功能启用  | no | [yes\|no] | nftset-timeout yes |
-| `dualstack-ip-selection-threshold` | 双栈 IP 优选阈值 | `30ms` | 单位为毫秒（`ms`） | `dualstack-ip-selection-threshold [0-1000]` |
+| nftset-no-speed | 当测速失败时，将域名结果设置到nftset集合中 | 无 | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]] <br />ipv4 地址的 family 只支持 inet 和 ip <br />ipv6 地址的 family 只支持 inet 和 ip6 <br />由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset-no-speed #4:inet#tab#set4|
-| `ca-file` | 证书文件 | `/etc/ssl/certs/ca-certificates.crt` | 合法路径字符串 | `ca-file /etc/ssl/certs/ca-certificates.crt` |
+| nftset-debug | 设置 nftset 调试功能启用  | no | [yes\|no] | nftset-debug yes |
-| `ca-path` | 证书文件路径 | `/etc/ssl/certs` | 合法路径字符串 | `ca-path /etc/ssl/certs` |
+| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]<br />[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置<br />[-a\|-address]：参考 address 配置<br />[-n\|-nameserver]：参考 nameserver 配置<br />[-p\|-ipset]：参考ipset配置<br />[-t\|-nftset]：参考nftset配置<br />[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection<br /> [-no-serve-expired]：禁用过期缓存<br />[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: 参考配置rr-ttl, rr-ttl-min, rr-ttl-max<br />[-delete]：删除对应的规则 | domain-rules /www.example.com/ -speed-check-mode none |
 | domain-set | 设置域名集合 | 无 | domain-set [options...]<br />[-n\|-name]：域名集合名称 <br />[-t\|-type]：域名集合类型，当前仅支持list，格式为域名列表，一行一个域名。<br />[-f\|-file]：域名集合文件路径。<br /> 选项需要配合address, nameserver, ipset, nftset等需要指定域名的地方使用，使用方式为 /domain-set:[name]/| domain-set -name set -type list -file /path/to/list <br /> address /domain-set:set/1.2.4.8 |
 | bogus-nxdomain | 假冒 IP 地址过滤 | 无 | [ip/subnet]，可重复 | bogus-nxdomain 1.2.3.4/16 |
 | ignore-ip | 忽略 IP 地址 | 无 | [ip/subnet]，可重复 | ignore-ip 1.2.3.4/16 |
 | whitelist-ip | 白名单 IP 地址 | 无 | [ip/subnet]，可重复 | whitelist-ip 1.2.3.4/16 |
 | blacklist-ip | 黑名单 IP 地址 | 无 | [ip/subnet]，可重复 | blacklist-ip 1.2.3.4/16 |
 | force-AAAA-SOA | 强制 AAAA 地址返回 SOA | no | [yes\|no] | force-AAAA-SOA yes |
 | force-qtype-SOA | 强制指定 qtype 返回 SOA | qtype id | [qtypeid\|...] | force-qtype-SOA 65 28
 | prefetch-domain | 域名预先获取功能 | no | [yes\|no] | prefetch-domain yes |
 | dnsmasq-lease-file | 支持读取dnsmasq dhcp文件解析本地主机名功能 | 无 | dnsmasq dhcp lease文件路径 | dnsmasq-lease-file /var/lib/misc/dnsmasq.leases |
 | serve-expired | 过期缓存服务功能 | yes | [yes\|no]，开启此功能后，如果有请求时尝试回应 TTL 为 0 的过期记录，并发查询记录，以避免查询等待 |
 | serve-expired-ttl | 过期缓存服务最长超时时间 | 0 | 秒，0 表示停用超时，大于 0 表示指定的超时的秒数 | serve-expired-ttl 0 |
 | serve-expired-reply-ttl | 回应的过期缓存 TTL | 5 | 秒，0 表示停用超时，大于 0 表示指定的超时的秒数 | serve-expired-reply-ttl 30 |
 | dualstack-ip-selection | 双栈 IP 优选 | yes | [yes\|no] | dualstack-ip-selection yes |
 | dualstack-ip-selection-threshold | 双栈 IP 优选阈值 | 15ms | 单位为毫秒（ms） | dualstack-ip-selection-threshold [0-1000] |
 | user | 进程运行用户 | root | user [username] | user nobody |
 | ca-file | 证书文件 | /etc/ssl/<br />certs/ca-certificates.crt | 合法路径字符串 | ca-file /etc/ssl/certs/ca-certificates.crt |
 | ca-path | 证书文件路径 | /etc/ssl/certs | 合法路径字符串 | ca-path /etc/ssl/certs |
 ## 常见问题
@@ -600,60 +642,60 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    SmartDNS 在设计上并不是 DNSmasq 的替代品，它的主要功能集中在 DNS 解析增强上，增强部分有：
-   * 多上游服务器并发请求，对结果进行测速后，返回最佳结果；
+   - 多上游服务器并发请求，对结果进行测速后，返回最佳结果；
-   * address、ipset 域名匹配采用高效算法，查询匹配更加快速，即使是路由器设备也依然高效；
+   - address、ipset 域名匹配采用高效算法，查询匹配更加快速，即使是路由器设备也依然高效；
-   * 域名匹配支持忽略特定域名，可单独匹配 IPv4 和 IPv6，支持多样化定制；
+   - 域名匹配支持忽略特定域名，可单独匹配 IPv4 和 IPv6，支持多样化定制；
-   * 针对广告屏蔽功能做增强，返回 SOA，屏蔽广告效果更佳；
+   - 针对广告屏蔽功能做增强，返回 SOA，屏蔽广告效果更佳；
-   * IPv4、IPv6 双栈 IP 优选机制，在双网情况下，选择最快的网络通讯；
+   - IPv4、IPv6 双栈 IP 优选机制，在双网情况下，选择最快的网络通讯；
-   * 支持最新的 TLS 和 HTTPS 协议，提供安全的 DNS 查询能力；
+   - 支持最新的 TLS 和 HTTPS 协议，提供安全的 DNS 查询能力；
-   * ECS 支持，使查询结果更佳准确；
+   - ECS 支持，使查询结果更佳准确；
-   * IP 黑名单和忽略 IP 机制，使域名查询更佳准确；
+   - IP 黑名单和忽略 IP 机制，使域名查询更佳准确；
-   * 域名预查询，访问常用网站更加快速；
+   - 域名预查询，访问常用网站更加快速；
-   * 域名 TTL 可指定，使访问更快速；
+   - 域名 TTL 可指定，使访问更快速；
-   * 高速缓存机制，使访问更快速；
+   - 高速缓存机制，使访问更快速；
-   * 异步日志，审计机制，在记录信息的同时不影响 DNS 查询性能；
+   - 异步日志，审计机制，在记录信息的同时不影响 DNS 查询性能；
-   * 域名组（group）机制，特定域名使用特定上游服务器组查询，避免隐私泄漏；
+   - 域名组（group）机制，特定域名使用特定上游服务器组查询，避免隐私泄漏；
-   * 第二 DNS 支持自定义更多行为。
+   - 第二 DNS 支持自定义更多行为。
-2. 如何配置上游服务器最佳？
+1. 如何配置上游服务器最佳？
    SmartDNS 有测速机制，在配置上游服务器时，建议配置多个上游 DNS 服务器，包含多个不同区域的服务器，但总数建议在 10 个左右。推荐搭配
-   * 运营商 DNS。
+   - 运营商 DNS。
-   * 国内公共 DNS，如 `119.29.29.29`, `223.5.5.5`。
+   - 国内公共 DNS，如 `119.29.29.29`, `223.5.5.5`。
-   * 国外公共 DNS，如 `8.8.8.8`, `8.8.4.4`。
+   - 国外公共 DNS，如 `8.8.8.8`, `8.8.4.4`。
-3. 如何启用审计日志？
+1. 如何启用审计日志？
    审计日志记录客户端请求的域名，记录信息包括，请求时间，请求 IP，请求域名，请求类型，如果要启用审计日志，在配置界面配置 `audit-enable yes` 启用，`audit-size`、 `audit-file`、`audit-num` 分别配置审计日志文件大小，审计日志文件路径，和审计日志文件个数。审计日志文件将会压缩存储以节省空间。
-4. 如何避免隐私泄漏？
+1. 如何避免隐私泄漏？
    默认情况下，SmartDNS 会将请求发送到所有配置的DNS服务器，若上游 DNS 服务器使用DNS，或记录日志，将会导致隐私泄漏。为避免隐私泄漏，请尽量：  
-   * 配置使用可信的DNS服务器。
+   - 配置使用可信的DNS服务器。
-   * 优先使用 TLS 查询。
+   - 优先使用 TLS 查询。
-   * 设置上游 DNS 服务器组。
+   - 设置上游 DNS 服务器组。
-5. 如何屏蔽广告？
+1. 如何屏蔽广告？
    SmartDNS 具备高性能域名匹配算法，通过域名方式过滤广告非常高效，如要屏蔽广告，只需要配置类似如下记录即可，如，屏蔽 `*.ad.com`，则配置：
-   ```sh
+   ```shell
   address /ad.com/#
   ```
    域名的使后缀模式，过滤 `*.ad.com`，`#` 表示返回 SOA，使屏蔽广告更加高效，如果要单独屏蔽 IPv4 或 IPv6， 在 `#` 后面增加数字，如 `#4` 表示对 IPv4 生效。若想忽略特定子域名的屏蔽，如忽略 `pass.ad.com`，可配置如下：
-   ```sh
+   ```shell
   address /pass.ad.com/-
   ```
-6. 如何使用 DNS 查询分流？
+1. 如何使用 DNS 查询分流？
    某些情况下，需要将有些域名使用特定的 DNS 服务器来查询来做到 DNS 分流。比如
-   ```sh
+   ```shell
   .home -> 192.168.1.1 # .home 结尾的域名发送到 192.168.1.1 解析
   .office -> 10.0.0.1  # .office 结尾的域名发送到 10.0.0.1 解析
   ```
@@ -661,7 +703,7 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    其他域名采用默认的模式解析。
    这种情况的分流配置如下：
-   ```sh
+   ```shell
   # 配置上游，用 -group 指定组名，用 -exclude-default-group 将服务器从默认组中排除。
   server 192.168.1.1 -group home -exclude-default-group
   server 10.0.0.1 -group office -exclude-default-group
@@ -674,59 +716,190 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    通过上述配置即可实现 DNS 解析分流，如果需要实现按请求端端口分流，可以配置第二 DNS 服务器，`bind` 配置增加 `--group` 参数指定分流名称。
-   ```sh
+   ```shell
   bind :7053 -group office
   bind :8053 -group home
   ```
-7. IPv4、IPv6 双栈 IP 优选功能如何使用？
+1. IPv4、IPv6 双栈 IP 优选功能如何使用？
    目前 IPv6 已经开始普及，但 IPv6 网络在速度上，某些情况下还不如 IPv4。为在双栈网络下获得较好的体验，SmartDNS 提供来双栈IP优选机制，同一个域名，若 IPv4 的速度远快与 IPv6，那么 SmartDNS 就会阻止IPv6的解析、使用 IPv4 访问。可在配置文件中通过设置 `dualstack-ip-selection yes` 启用此功能，通过 `dualstack-ip-selection-threshold [time]` 来修改阈值。如果要完全禁止 IPv6 AAAA记录解析，可设置 `force-AAAA-SOA yes`。
-8. 如何提高缓存效率，加快访问速度？
+1. 如何提高缓存效率，加快访问速度？
    SmartDNS 提供了域名缓存机制，对查询的域名，进行缓存，缓存时间符合 DNS TTL 规范。为提高缓存命中率，可采用如下措施：  
-   * 适当增大缓存的记录数
+   - 适当增大缓存的记录数
     通过 `cache-size` 来设置缓存记录数。  
     查询压力大的环境下，并且有内存大的机器的情况下，可适当调大。  
-   * 适当设置最小 TTL 值
+   - 适当设置最小 TTL 值
     通过 `rr-ttl-min` 将最低 DNS TTL 时间设置为一个合理值，延长缓存时间。
     建议是超时时间设置在 10～30 分钟，避免服务器域名变化时，查询到失效域名。
-   * 开启域名预获取功能
+   - 开启域名预获取功能
     通过 `prefetch-domain yes` 来启用域名预先获取功能，提高查询命中率。
     配合上述 TTL 超时时间，SmartDNS 将在域名 TTL 即将超时时，再次发送查询请求，并缓存查询结果供后续使用。频繁访问的域名将会持续缓存。此功能将在空闲时消耗更多的 CPU。
-   * 过期缓存服务功能  
+   - 过期缓存服务功能  
     通过 `serve-expired` 来启用过期缓存服务功能，可提高缓存命中率的同时，降低CPU占用。
     此功能会在TTL超时后，将返回 TTL=0 给客户端，并且同时再次发送查询请求，并缓存新的结果给后续使用。
-9. 第二 DNS 如何自定义更多行为？
+1. 第二 DNS 如何自定义更多行为？
   第二 DNS 可以作为其他 DNS 服务器的上游，提供更多的查询行为，通过 bind 配置支持可以绑定多个端口，不同端口可设置不同的标志，实现不同的功能，如
-   ```sh
+   ```shell
   # 绑定 6053 端口，6053 端口的请求将采用配置 office 组的上游查询，且不对结果进行测速，忽略 address 的配置地址
   bind [::]:6053 -no-speed-check -group office -no-rule-addr
   ```
-10. DoT 的 SPKI 如何获取？
+1. DoT 的 SPKI 如何获取？
    SPKI 可以通过 DNS 服务商发布的页面获取，如果没有发布，可以通过如下命令获取，其中将对应IP地址更换为要获取 SPKI 的 IP 地址。
-    ```sh
+    ```shell
-    $ echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
+    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
    ```
 1. iOS系统解析缓慢问题怎么解决？  
    IOS14开始，苹果支持了DNS HTTPS(TYPE65)记录的解析，此功能用于快速DNS查询和解决HTTPS链接相关的问题，但当前还是草案，另外会导致广告屏蔽等功能失效，建议通过如下配置关闭TYPE65记录查询。
    ```shell
    force-qtype-SOA 65
    ```
 1. 如何解析本地主机名称？  
    smartdns可以配合DNSMASQ的dhcp lease文件支持本地主机名->IP地址的解析，可以配置smartdns读取dnsmasq的lease文件，并支持解析。具体配置参数如下，（注意，DNSMASQ lease文件每个系统可能不一样，需要按实际情况配置）
    ```shell
    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
    ```
    配置完成后，可以直接使用主机名连接对应的机器。但需要注意：
    - Windows系统默认使用mDNS解析地址，如需要在windows下用使用smartdns解析，则需要在主机名后面增加`.`，表示使用DNS解析。如`ping smartdns.`
 1. 域名集合如何使用？  
    为方便按集合配置域名，对于有/domain/的配置，可以指定域名集合，方便维护。具体方法为：
    - 使用`domain-set`配置集合文件，如
    ```shell
    domain-set -name ad -file /etc/smartdns/ad-list.conf
    ```
    ad-list.conf的格式为一个域名一行，如
    ```shell
    ad.com
    site.com
    ```
    - 在有/domain/配置的选项使用域名集合，只需要将`/domain/`配置为`/domain-set:[集合名称]/`即可，如：
    ```shell
    address /domain-set:ad/#
    domain-rules /domain-set:ad/ -a #
    nameserver /domain-set:ad/server
    ...
    ```
 1. 如何使用ipset和nftset  
    和Dnsmasq类似，smartdns支持ipset和nftset，可以将特定的域名通过TPROXY进行透明转发，透明转发涉工具模式对比如下：
    1. 工具：iptable，nftable
        iptable：成熟的路由规则配置工具。  
        nftable：更加强大的规则配置工具，正在成为主流。
    1. 模式：TPROXY，REDIRECT
        TPROXY：支持UDP，TCP的转发，配置稍复杂。  
        REDIRECT：仅支持TCP，配置简单。
    1. 配置REDIRECT或TPROXY转发规则
        - 在smartdns.conf中设置需要透明转发的域名列表，比如要将`example.com`进行透明转发。则使用ipset选项，设置`example.com`的ipset规则为`proxy`。
        ```shell
        # 设置规则
        # -ipset proxy: 匹配的域名设置到ipset:tproxy中。
        # -c none: 停用测速
        # -address #6: 停用IPV6解析。
        domain-rules /example.com/ -ipset proxy -c none -address #6
        ```
        1. 方式一: TCP REDIRECT转发
            - 此方式配置简单，仅支持TCP的转发。  
              执行shell命令，设置iptable规则，如果仅转发TCP则可以直接使用REDIRECT的规则，如果需要同时转发UDP和TCP，可以使用TPROXY的转发规则。如下规则按实际需求选择。具体配置如下：
            ```shell
            # 创建ipset集合
            ipset create proxy hash:net
            # 设置转发规则，将匹配的请求转发到本机的1081端口
            iptables -t nat -I PREROUTING -p tcp -m set --match-set proxy dst -j REDIRECT --to-ports 1081
            ```
            - 在本机1081端口开启REDIRECT模式的转发程序。
        1. 方式二：TCP/UDP TPROXY转发
            - 此方式可同时转发TCP和UDP。  
              执行shell命令，设置iptable规则，将匹配的域名TCP/UDP请求进行TPROXY方式透明转发，规则参考如下：
            ```shell
            # 设置路由规则
            ip rule add fwmark 1104 lookup 1104
            ip route add local 0.0.0.0/0 dev lo table 1104
            # 创建ipset集合
            ipset create proxy hash:net
            # 设置转发规则，UDP，TCP方式的TPROXY转发
            iptables -t mangle -N SMARTDNS
            iptables -t mangle -A SMARTDNS -p tcp -m set --match-set proxy dst -j TPROXY --on-ip 127.0.0.1 --on-port 1081 --tproxy-mark 1104
            iptables -t mangle -A SMARTDNS -p udp -m set --match-set proxy dst -j TPROXY --on-ip 127.0.0.1 --on-port 1081 --tproxy-mark 1104
            iptables -t mangle -A SMARTDNS -j ACCEPT
            iptables -t mangle -A PREROUTING -j SMARTDNS
            ```
            - 在本机的1081端口启动IP透明转发程序。
    1. 额外说明  
        - 为保证DNS查询结果的位置亲和性，可以使用smartdns的`server`代理参数，将对应域名的查询请求，通过代理查询，使结果位置更好。如：
        ```shell
        # 增加DNS上游，并设置通过名称为proxy的代理查询，查询组为pass
        server 1.2.3.4 -proxy proxy -group pass -exclude-default-group
        # 设置代理服务器信息，代理的名称为proxy
        proxy-server socks5://user:name@1.2.3.4 -name proxy
        # 设置域名规则，对匹配的域名使用代理查询结果，并将结果设置到ipset中。
        domain-rules /example.com/ -ipset proxy -c none -address #6 -nameserver pass
        ```
        - 如需要配合测速自动完成ipset的设置，可增加如下配置参数
        ```shell
        ipset-no-speed proxy
        ```
    如果使用openwrt的luci界面，可以直接在界面配置相关的域名分流规则。
 1. 更多问题  
    如有更多问题，请查阅或提交issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)
 ## 编译
  SmartDNS 提供了编译软件包的脚本（`package/build-pkg.sh`），支持编译 LuCI、Debian、OpenWrt 和 Optware 安装包。
--- a/ReadMe_en.md
+++ b/ReadMe_en.md
@@ -1,7 +1,7 @@
 # SmartDNS
 ![SmartDNS](doc/smartdns-banner.png)  
-SmartDNS is a local DNS server. SmartDNS accepts DNS query requests from local clients, obtains DNS query results from multiple upstream DNS servers, and returns the fastest access results to clients.  
+SmartDNS is a local DNS server. SmartDNS accepts DNS query requests from local clients, obtains DNS query results from multiple upstream DNS servers, and returns the fastest access results to clients. supports secure DNS protocols like DoT (DNS over TLS), DoH (DNS over HTTPS), better protect privacy,  
 Avoiding DNS pollution and improving network access speed, supports high-performance ad filtering.  
 Unlike dnsmasq's all-servers, smartdns returns the fastest access resolution. （[read more](#faq)）
@@ -9,19 +9,27 @@ Support Raspberry Pi, openwrt, ASUS router, Windows and other devices.
 ## Table Of Content
-1. [Software Show](#software-show)
+- [SmartDNS](#smartdns)
-1. [Features](#features)
+  - [Table Of Content](#table-of-content)
-1. [Architecture](#architecture)
+  - [Software Show](#software-show)
-1. [Usage](#usage)  
+  - [Features](#features)
-    1. [Download the package](#download-the-package)
+  - [Architecture](#architecture)
-    1. [Standard Linux system installation/Raspberry Pi, X86_64 system](#standard-linux-system-installation/raspberry-pi,-x86_64-system)
+  - [Usage](#usage)
-    1. [openwrt/LEDE](#openwrt/lede)
+    - [Use official installation source](#use-official-installation-source)
-    1. [ASUS router native firmware / Merlin firmware](#asus-router-native-firmware-/-merlin-firmware)
+    - [Download the package](#download-the-package)
-    1. [optware/entware](#optware/entware)
+    - [Standard Linux system installation/Raspberry Pi, X86\_64 system](#standard-linux-system-installationraspberry-pi-x86_64-system)
-    1. [Windows 10 WSL Installation/WSL ubuntu](#windows-10-wsl-installation/wsl-ubuntu)
+    - [openwrt](#openwrt)
-1. [Configuration parameter](#configuration-parameter)
+    - [ASUS router native firmware / Merlin firmware](#asus-router-native-firmware--merlin-firmware)
-1. [Donate](#Donate)
+    - [optware/entware](#optwareentware)
-1. [FAQ](#FAQ)
+    - [Windows 10 WSL Installation/WSL ubuntu](#windows-10-wsl-installationwsl-ubuntu)
  - [Configuration parameter](#configuration-parameter)
  - [FAQ](#faq)
  - [Compile](#compile)
  - [Donate](#donate)
    - [PayPal](#paypal)
    - [Alipay](#alipay)
    - [Wechat](#wechat)
  - [Open Source License](#open-source-license)
 ## Software Show
@@ -89,38 +97,55 @@ From the comparison, smartdns found the fastest IP address to visit www.baidu.co
 1. **Multiple upstream DNS servers**  
   Support configuring multiple upstream DNS servers and query at the same time.the query will not be affected, Even if there is a DNS server exception.  
-2. **Return the fastest IP address**  
+1. **Return the fastest IP address**  
   Supports finding the fastest access IP address from the IP address list of the domain name and returning it to the client to avoid DNS pollution and improve network access speed.
-3. **Support for multiple query protocols**  
+1. **Support for multiple query protocols**  
-   Support UDP, TCP, TLS, HTTPS queries, and non-53 port queries, effectively avoiding DNS pollution.
+   Support UDP, TCP, DOT(DNS over TLS), DOH(DNS over HTTPS) queries, and non-53 port queries, effectively avoiding DNS pollution and protect privacy, and support query DNS over socks5, http proxy.
-4. **Domain IP address specification**  
+1. **Domain IP address specification**  
   Support configuring IP address of specific domain to achieve the effect of advertising filtering, and avoid malicious websites.
-5. **Domain name high performance rule filtering**  
+1. **Domain name high performance rule filtering**  
   Support domain name suffix matching mode, simplify filtering configuration, filter 200,000 recording and take time <1ms.
-6. **Linux/Windows multi-platform support**  
+1. **Linux/Windows multi-platform support**  
   Support standard Linux system (Raspberry Pi), openwrt system various firmware, ASUS router native firmware. Support Windows 10 WSL (Windows Subsystem for Linux).
-7. **Support IPV4, IPV6 dual stack**  
+1. **Support IPV4, IPV6 dual stack**  
-   Support IPV4, IPV6 network, support query A, AAAA record, dual-stack IP selection, and disale IPV6 AAAA record.
+   Support IPV4, IPV6 network, support query A, AAAA record, dual-stack IP selection, and filter IPV6 AAAA record.
-8. **High performance, low resource consumption**  
+1. **DNS64**  
   Support DNS64 translation.
 1. **High performance, low resource consumption**  
   Multi-threaded asynchronous IO mode, cache cache query results.
 1. **DNS domain forwarding**  
   Support DNS forwarding, ipset and nftables. Support setting the domain result to ipset and nftset set when speed check fails.
 ## Architecture
 ![Architecture](doc/architecture.png)
 1. SmartDNS receives DNS query requests from local network devices, such as PCs and mobile phone query requests.
-2. SmartDNS sends query requests to multiple upstream DNS servers, using standard UDP queries, non-standard port UDP queries, and TCP queries.
+1. SmartDNS sends query requests to multiple upstream DNS servers, using standard UDP queries, non-standard port UDP queries, and TCP queries.
-3. The upstream DNS server returns a list of Server IP addresses corresponding to the domain name. SmartDNS detects the fastest Server IP with local network access.
+1. The upstream DNS server returns a list of Server IP addresses corresponding to the domain name. SmartDNS detects the fastest Server IP with local network access.
-4. Return the fastest accessed Server IP to the local client.
+1. Return the fastest accessed Server IP to the local client.
 ## Usage
 ### Use official installation source
 smartdns can already be installed using system package management tools.
 System|Installation|Instructions|
 --|--|--
 openwrt|opkg update<br />opkg install luci-app-smartdns<br />opkg install smartdns|systems after 22.03. Software source: <https://downloads.openwrt.org/releases/>
 ddwrt|latest firmware. goto services page abd enable SmartDNS Resolver. |Demo: <https://forum.dd-wrt.com/demo/Services.html>
 debian|apt-get install smartdns|
 entware|ipkg update<br />ipkg install smartdns|Software source: <https://bin.entware.net/>
 ### Download the package
 --------------
@@ -143,15 +168,17 @@ Download the matching version of the SmartDNS installation package. The correspo
 |openwrt LUCI|luci-app-smartdns.xxxxxxxxx.all.ipk|Openwrt management interface.
 |openwrt LUCI|luci-app-smartdns.xxxxxxxxx.all-luci-compat-all|Compat Openwrt management interface for early openwrt.
-* The released packages are statically compiled. If you need a small size package, please compile it yourself or obtain it from the openwrt / entware repository.
+- The released packages are statically compiled. If you need a small size package, please compile it yourself or obtain it from the openwrt / entware repository.
 - **Please download from the Release page: [Download here](https://github.com/pymumu/smartdns/releases)**   
 * **Please download from the Release page: [Download here](https://github.com/pymu/smartdns/releases)**
 ```shell
 https://github.com/pymumu/smartdns/releases
 ```
 - For MacOS, Windows, you can try rust version of smartdns: [SmartDNS-rs](https://github.com/mokeyish/smartdns-rs)
-* For the installation procedure, please refer to the following sections.
+- For the installation procedure, please refer to the following sections.
 ### Standard Linux system installation/Raspberry Pi, X86_64 system
@@ -174,6 +201,11 @@ https://github.com/pymumu/smartdns/releases
    ./install -i
    ```
    **For Ubuntu system:**
    - `systemd-resolved` occupies TCP53 and UDP53 ports. You need to manually resolve the port occupancy problem or modify the SmartDNS listening port
    - Log files in `/var/log/smartdns/smartdns.log`
 1. Configuration
    After the installation is complete, you can configure the upstream server to  smartdns. Refer to the `Configuration Parameters` for specific configuration parameters.  
@@ -184,6 +216,19 @@ https://github.com/pymumu/smartdns/releases
    vi /etc/smartdns/smartdns.conf
    ```
    `smartdns.conf` example:
    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
    server 1.1.1.1
    server-tls 8.8.8.8
    # set domain rules
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
 1. Start Service
    ```shell
@@ -194,8 +239,8 @@ https://github.com/pymumu/smartdns/releases
 1. Forwarding DNS request to SmartDNS
    Modify the DNS server of the local router and configure the DNS server as SmartDNS.
-    * Log in to the router on the local network and configure the Raspberry Pi to assign a static IP address.
+    - Log in to the router on the local network and configure the Raspberry Pi to assign a static IP address.
-    * Modify the WAN port or DHCP DNS to the Raspberry Pi IP address.
+    - Modify the WAN port or DHCP DNS to the Raspberry Pi IP address.
    Note:
    I. Each router configuration method is different. Please search Baidu for related configuration methods.
    II. some routers may not support configuring custom DNS server. in this case, please modify the PC's, mobile phone's DNS server to the ip of Raspberry Pi.
@@ -227,26 +272,26 @@ https://github.com/pymumu/smartdns/releases
    opkg install luci-app-smartdns.xxxxxxxx.xxxx.all.ipk
    ```
-    * Note: For versions before openwrt 19.07, please install `luci-app-smartdns.xxxxxxxxx.all-luci-compat-all` package.
+    - Note: For versions before openwrt 19.07, please install `luci-app-smartdns.xxxxxxxxx.all-luci-compat-all` package.
 1. Configuration
    Log in to the openwrt management page and open `Services`->`SmartDNS` to configure SmartDNS.
-    * Add upstream DNS server configuration to `Upstream Servers`. It is recommended to configure multiple DNS servers at home and abroad.
+    - Add upstream DNS server configuration to `Upstream Servers`. It is recommended to configure multiple DNS servers at home and abroad.
-    * Specify the IP address of a specific domain name in `Domain Address`, which can be used for ad blocking.
+    - Specify the IP address of a specific domain name in `Domain Address`, which can be used for ad blocking.
 1. Start Service
   There are two ways to use the SmartDNS service, `one is directly as the primary DNS service`, `the other is as the upstream of dnsmasq`.  
   By default, SmartDNS uses the first method. You can choose according to your needs in the following two ways.
-1. Method 1: SmartDNS as primary DNS Server (default scheme)
+1. Method 1: SmartDNS as primary DNS Server
-    * **Enable SmartDNS port 53 port redirection**
+    - **Enable SmartDNS as primary DNS Server**
-        Log in to the router, click on `Services`->`SmartDNS`->`redirect`, select `Redirect 53 port to SmartDNS` option to enable port 53 forwarding.
+        Log in to the router, click on `Services`->`SmartDNS`->`port`, input port `53`, smartdns will run as primary DNS Server.
-    * **Check if the service is configured successfully**
+    - **Check if the service is configured successfully**
        Query domain name with `nslookup -querytype=ptr smartdns`
        See if the `name` item in the command result is displayed as `smartdns` or `hostname`, such as `smartdns`
@@ -260,60 +305,20 @@ https://github.com/pymumu/smartdns/releases
        smartdns         name = smartdns.
        ```
    * **The interface prompts that the redirect failed**
        * Check if iptable, ip6table command is installed correctly.
        * The openwrt 15.01 system does not support IPV6 redirection. If the network needs to support IPV6, please change DNSMASQ upstream to smartdns, or change the smartdns port to 53, and disable dnsmasq.
        * After LEDE system, please install IPV6 nat forwarding driver. Click `system`->`Software`, click `update lists` to update the software list, install `ip6tables-mod-nat`
        * Use the following command to check whether the routing rule takes effect.
        ```shell
        iptables -t nat -L PREROUTING | grep REDIRECT
        ```
        * If the forwarding function is abnormal, please use Method 2: As the upstream of DNSMASQ.
 1. Method 2: SmartDNS as upstream DNS Server of DNSMASQ
    * **Forward dnsmasq's request to SmartDNS**
        Log in to the router, click on `Services`->`SmartDNS`->`redirect`, select `Run as dnsmasq upstream server` option to forwarding dnsmasq request to Smartdns.
    * **Check if the service is configured successfully**
        * Method 1: Query domain name with `nslookup -querytype=ptr 0.0.0.1`
        See if the `name` item in the command result is displayed as `smartdns` or `hostname`, such as `smartdns`
        ```shell
        pi@raspberrypi:~/code/smartdns_build $ nslookup -querytype=ptr smartdns
        Server:         192.168.1.1
        Address:        192.168.1.1#53
        Non-authoritative answer:
        smartdns         name = smartdns.
        ```
        * Method 2: Use `nslookup` to query the `www.baidu.com` domain name to see if the IP address of Baidu in the result is `only one. If there are multiple IP addresses returned, it means that it is not valid. Please try to check several domain names.
        ```shell
        pi@raspberrypi:~ $ nslookup www.baidu.com 192.168.1.1
        Server:         192.168.1.1
        Address:        192.168.1.1#53
        Non-authoritative answer:
        www.baidu.com   canonical name = www.a.shifen.com.
        Name:   www.a.shifen.com
        Address: 14.215.177.38
        ```
 1. Start Service
    Check the `Enable' in the configuration page to start SmartDNS server.
 1. Note
-    * If chinaDNS is already installed, it is recommended to configure the upstream of chinaDNS as SmartDNS.
+   - When the port of smartdns is 53, it will automatically take over dnsmasq as the primary dns. When configuring other ports, dnsmasq is re-enabled as primary dns.
-    * SmartDNS defaults to forwarding port 53 requests to the local port of SmartDNS, controlled by the `Redirect` configuration option.
+   - If an exception occurs during this process, you can use the following command to restore dnsmasq as the primary DNS
   ```shell
   uci delete dhcp.@dnsmasq[0].port
   uci commit dhcp
   /etc/init.d/dnsmasq restart
   ```
 ### ASUS router native firmware / Merlin firmware
@@ -330,7 +335,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Log in to the management interface, click `System Management`-> Click `System Settings` and configure `Enable SSH` to `Lan Only`.  
    The SSH login username and password are the same as the management interface.
-1. Insstall `Download Master`
+1. Install `Download Master`
    In the management interface, click `USB related application`-> click `Download Master` to download.  
    After the download is complete, enable `Download Master`. If you do not need the download function, you can uninstall `Download Master` here, but make sure that Download Master is enabled before uninstalling.  
@@ -385,6 +390,19 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    vi /opt/etc/smartdns/smartdns.conf
    ```
    `smartdns.conf` example:
    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
    server 1.1.1.1
    server-tls 8.8.8.8
    # set domain rules
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
    It can also be modified from Network Neighborhood. From the neighbor sharing directory `sda1` you can't see the `asusware.mipsbig` directory, but you can directly enter `asusware.mipsbig\etc\init.d` in `File Manager` to modify it.
    ```shell
@@ -401,7 +419,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. Install SmartDNS
-    Upload the software to `/tmp` directory of the router using winscp, and run the flollowing command to install.
+    Upload the software to `/tmp` directory of the router using winscp, and run the following command to install.
    ```shell
    ipkg install smartdns.xxxxxxx.mipsbig.ipk
@@ -413,7 +431,20 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Vi /opt/etc/smartdns/smartdns.conf
    ```
-    Note: if you need to support IPV6, you can set the worke-mode to `2`, this will disable the DNS service of dnsmasq, and smartdns run as the primary DNS server. Change `SMARTDNS_WORKMODE` in the file `/opt/etc/smartdns/smartdns-opt.conf` to 2.
+    `smartdns.conf` example:
    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
    server 1.1.1.1
    server-tls 8.8.8.8
    # set domain rules
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
    Note: if you need to support IPV6, you can set the work-mode to `2`, this will disable the DNS service of dnsmasq, and smartdns run as the primary DNS server. Change `SMARTDNS_WORKMODE` in the file `/opt/etc/smartdns/smartdns-opt.conf` to `2`.
    ```shell
    SMARTDNS_WORKMODE="2"
@@ -433,7 +464,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    smartdns        name = smartdns.
    ```
-    Note: If the service does not start automatically, you need to set optwre/entware to start automatically. For details, see the optware/entware documentation.
+    Note: If the service does not start automatically, you need to set optware/entware to start automatically. For details, see the optware/entware documentation.
 ### Windows 10 WSL Installation/WSL ubuntu
@@ -468,6 +499,19 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    In general, you only need to add `server [IP]:port`, `server-tcp [IP]:port` configuration items.  
    Configure as many upstream DNS servers as possible, including servers at home and abroad. Please refer to the `Configuration Parameters` section for configuration parameters.  
    `smartdns.conf` example:
    ```shell
    # set listen port
    bind []:53 
    # set upstream servers
    server 1.1.1.1
    server-tls 8.8.8.8
    # set domain rules
    address /example.com/1.2.3.4
    domain-rule /example.com/ -address 1.2.3.4
    ```
 1. Start Service
    Double-click `reload.bat` in the `D:\smartdns\package\windows` directory for reload.
@@ -494,74 +538,91 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |parameter|Parameter function|Default value|Value type|Example|
 |--|--|--|--|--|
-|server-name|DNS name|host name/smartdns|any string like hosname|server-name smartdns
+|server-name|DNS name|host name/smartdns|any string like hostname|server-name smartdns
-|bind|DNS listening port number|[::]:53|Support binding multiple ports<br>`IP:PORT`: server IP, port number. <br>`[-group]`: The DNS server group used when requesting. <br>`[-no-rule-addr]`: Skip the address rule. <br>`[-no-rule-nameserver]`: Skip the Nameserver rule. <br>`[-no-rule-ipset]`: Skip the Ipset rule. <br>`[-no-rule-soa]`: Skip address SOA(#) rules.<br>`[-no-dualstack-selection]`: Disable dualstack ip selection.<br>`[-no-speed-check]`: Disable speed measurement. <br>`[-no-cache]`: stop caching |bind :53
+|bind|DNS listening port number|[::]:53|Support binding multiple ports<br />`IP:PORT@DEVICE`: server IP, port number, and device. <br />`[-group]`: The DNS server group used when requesting. <br />`[-no-rule-addr]`: Skip the address rule. <br />`[-no-rule-nameserver]`: Skip the Nameserver rule. <br />`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br />`[-no-rule-soa]`: Skip address SOA(#) rules.<br />`[-no-dualstack-selection]`: Disable dualstack ip selection.<br />`[-no-speed-check]`: Disable speed measurement. <br />`[-no-cache]`: stop caching |bind :53@eth0
-|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports<br>`IP:PORT`: server IP, port number. <br>`[-group]`: The DNS server group used when requesting. <br>`[-no-rule-addr]`: Skip the address rule. <br>`[-no-rule-nameserver]`: Skip the Nameserver rule. <br>`[-no-rule-ipset]`: Skip the Ipset rule. <br>`[-no-rule-soa]`: Skip address SOA(#) rules.<br>`[-no-dualstack-selection]`: Disable dualstack ip selection.<br>`[-no-speed-check]`: Disable speed measurement. <br>`[-no-cache]`: stop caching |bind-tcp :53
+|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports<br />`IP:PORT@DEVICE`: server IP, port number and device. <br />`[-group]`: The DNS server group used when requesting. <br />`[-no-rule-addr]`: Skip the address rule. <br />`[-no-rule-nameserver]`: Skip the Nameserver rule. <br />`[-no-rule-ipset]`: Skip the Ipset or nftset rules. <br />`[-no-rule-soa]`: Skip address SOA(#) rules.<br />`[-no-dualstack-selection]`: Disable dualstack ip selection.<br />`[-no-speed-check]`: Disable speed measurement. <br />`[-no-cache]`: stop caching |bind-tcp :53
 |cache-size|Domain name result cache number|512|integer|cache-size 512
 |cache-persist|enable persist cache|Auto: Enabled if the location of `cache-file` has more than 128MB of free space.|[yes\|no]|cache-persist yes
-|cache-file|cache persist file|/tmp/smartdns.cache|路径|cache-file /tmp/smartdns.cache
+|cache-file|cache persist file|/tmp/<br />smartdns.cache|path|cache-file /tmp/smartdns.cache
 |tcp-idle-time|TCP connection idle timeout|120|integer|tcp-idle-time 120
 |rr-ttl|Domain name TTL|Remote query result|number greater than 0|rr-ttl 600
 |rr-ttl-min|Domain name Minimum TTL|Remote query result|number greater than 0|rr-ttl-min 60
 |local-ttl|ttl for address and host|rr-ttl-min|number greater than 0|local-ttl 600
 |rr-ttl-reply-max|Domain name Minimum Reply TTL|Remote query result|number greater than 0|rr-ttl-reply-max 60
 |rr-ttl-max|Domain name Maximum TTL|Remote query result|number greater than 0|rr-ttl-max 600
 |max-reply-ip-num|Maximum number of IPs returned to the client|8|number of IPs, 1~16 |max-reply-ip-num 1
 |log-level|log level|error|fatal,error,warn,notice,info,debug|log-level error
-|log-file|log path|/var/log/smartdns.log|File Pah|log-file /var/log/smartdns.log
+|log-file|log path|/var/log/<br />smartdns/<br />smartdns.log|File Pah|log-file /var/log/smartdns/smartdns.log
 |log-size|log size|128K|number+K,M,G|log-size 128K
-|log-num|archived log number|2|Integer|log-num 2
+|log-num|archived log number|2 for openwrt, 8 for other system|Integer, 0 means turn off the log|log-num 2
 |log-file-mode|archived log file mode|0640|Integer|log-file-mode 644
 |audit-enable|audit log enable|no|[yes\|no]|audit-enable yes
-|audit-file|audit log file|/var/log/smartdns-audit.log|File Path|audit-file /var/log/smartdns-audit.log
+|audit-file|audit log file|/var/log/<br />smartdns/<br />smartdns-audit.log|File Path|audit-file /var/log/smartdns/smartdns-audit.log
 |audit-size|audit log size|128K|number+K,M,G|audit-size 128K
-|audit-num|archived audit log number|2|Integer|audit-num 2
+|audit-num|archived audit log number|2|Integer, 0 means turn off the log|audit-num 2
 |audit-file-mode|archived audit log file mode|0640|Integer|audit-file-mode 644
 |conf-file|additional conf file|None|File path|conf-file /etc/smartdns/smartdns.more.conf
-|server|Upstream UDP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server 8.8.8.8:53 -blacklist-ip
+|server|Upstream UDP DNS server|None|Repeatable <br />`[ip][:port]\|URL`: Server IP, port optional OR URL. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group. <br />`[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server 8.8.8.8:53 -blacklist-ip<br />server tls://8.8.8.8
-|server-tcp|Upstream TCP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tcp 8.8.8.8:53
+|server-tcp|Upstream TCP DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br />`[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-tcp 8.8.8.8:53
-|server-tls|Upstream TLS DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tls 8.8.8.8:853
+|server-tls|Upstream TLS DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name. `-` to disable SNI name.<br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-tls 8.8.8.8:853
-|server-https|Upstream HTTPS DNS server|None|Repeatable <br>`https://[host][:port]/path`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name<br>`[-http-host]`：http header host. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-https https://cloudflare-dns.com/dns-query
+|server-https|Upstream HTTPS DNS server|None|Repeatable <br />`https://[host][:port]/path`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name<br />`[-http-host]`：http header host. <br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`：set mark on packets <br /> `[-proxy name]`: set proxy server| server-https <https://cloudflare-dns.com/dns-query>
-|speed-check-mode|Speed mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:443
+|proxy-server| proxy server | None | Repeatable. <br />`proxy-server URL` <br />[URL]: `[socks5\|http]://[username:password@]host:port`<br />[-name]:  proxy server name. |proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy|
 |speed-check-mode|Speed mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:80,tcp:443
 |response-mode|First query response mode|first-ping|Mode: [first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: The fastest dns + ping response mode, DNS query delay + ping delay is the shortest;<br />[fastest-ip]: The fastest IP address mode, return the fastest ip address, may take some time to test speed. <br />[fastest-response]: The fastest response DNS result mode, the DNS query waiting time is the shortest. | response-mode first-ping |
 |address|Domain IP address|None|address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6], `-` for ignore, `#` for return SOA, `4` for IPV4, `6` for IPV6| address /www.example.com/1.2.3.4
 |cname|set cname to domain| None | cname /domain/target <br />- for ignore <br />set cname to domain. | cname /www.example.com/cdn.example.com |
 |dns64|dns64 translation | None | dns64 ip-prefix/mask <br /> ipv6 prefix and mask. | dns64 64:ff9b::/96 |
 |nameserver|To query domain with specific server group|None|nameserver /domain/[group\|-], `group` is the group name, `-` means ignore this rule, use the `-group` parameter in the related server|nameserver /www.example.com/office
 |ipset|Domain IPSet|None|ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore|ipset /www.example.com/#4:dns4,#6:-
-|ipset-timeout|ipset timeout enable|auto|[yes]|ipset-timeout yes
+|ipset-timeout|ipset timeout enable|no|[yes\|no]|ipset-timeout yes
-|domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]<br>`[-c\|-speed-check-mode]`: set speed check mode，same as parameter `speed-check-mode`<br>`[-a\|-address]`: same as  parameter `address` <br>`[-n\|-nameserver]`: same as parameter `nameserver`<br>`[-p\|-ipset]`: same as parameter `ipset`<br>`[-d\|-dualstack-ip-selection]`: same as parameter `dualstack-ip-selection`|domain-rules /www.example.com/ -speed-check-mode none
+|ipset-no-speed|When speed check fails, set the ip address of the domain name to the ipset | None | ipset \| #[4\|6]:ipset | ipset-no-speed #4:ipset4,#6:ipse6 <br /> ipset-no-speed ipset|
 |nftset|Domain nftset|None|nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]<br /> `-` to ignore<br />the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses <br />due to the limitation of nftable <br />two types of addresses have to be stored in two sets|nftset /www.example.com/#4:inet#tab#dns4,#6:-
 |nftset-timeout|nftset timeout enable|no|[yes\|no]|nftset-timeout yes
 |nftset-no-speed|When speed check fails, set the ip address of the domain name to the nftset | None | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]] <br />the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses <br />due to the limitation of nftable <br />two types of addresses have to be stored in two sets| nftset-no-speed #4:inet#tab#set4|
 |nftset-debug|nftset debug enable|no|[yes\|no]|nftset-debug yes
 |domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]<br />[-c\|-speed-check-mode]: set speed check mode，same as parameter speed-check-mode<br />[-a\|-address]: same as  parameter `address` <br />[-n\|-nameserver]: same as parameter `nameserver`<br />[-p\|-ipset]: same as parameter `nftset`<br />[-t\|-nftset]: same as parameter `nftset`<br />[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`<br />  [-no-serve-expired]：disable serve expired<br />[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: same as parameter: rr-ttl, rr-ttl-min, rr-ttl-max<br />[-delete]：delete rule|domain-rules /www.example.com/ -speed-check-mode none
 | domain-set | collection of domains|None| domain-set [options...]<br />[-n\|-name]：name of set <br />[-t\|-type] [list]: set type, only support list, one domain per line <br />[-f\|-file]：file path of domain set<br /> used with address, nameserver, ipset, nftset, example: /domain-set:[name]/ | domain-set -name set -type list -file /path/to/list <br /> address /domain-set:set/1.2.4.8 |
 |bogus-nxdomain|bogus IP address|None|[IP/subnet], Repeatable| bogus-nxdomain 1.2.3.4/16
 |ignore-ip|ignore ip address|None|[ip/subnet], Repeatable| ignore-ip 1.2.3.4/16
 |whitelist-ip|ip whitelist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP whitelist, only result in whitelist will be accepted| whitelist-ip 1.2.3.4/16
 |blacklist-ip|ip blacklist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP blacklist, The result will be discarded directly| blacklist-ip 1.2.3.4/16
 |force-AAAA-SOA|force AAAA query return SOA|no|[yes\|no]|force-AAAA-SOA yes
-|force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid | ...]|force-qtype-SOA 65 28
+|force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid \| ...]|force-qtype-SOA 65 28
 |prefetch-domain|domain prefetch feature|no|[yes\|no]|prefetch-domain yes
-|serve-expired|Cache serve expired feature|no|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
+|dnsmasq-lease-file|Support reading dnsmasq dhcp file to resolve local hostname|None|dnsmasq dhcp lease file| dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
-|serve-expired-ttl|Cache serve expired limite TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
+|serve-expired|Cache serve expired feature|yes|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
 |serve-expired-ttl|Cache serve expired limit TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
 |serve-expired-reply-ttl|TTL value to use when replying with expired data|5|second，0：disable，> 0  seconds after expiration|serve-expired-reply-ttl 30
-|dualstack-ip-selection|Dualstack ip selection|no|[yes\|no]|dualstack-ip-selection yes
+|dualstack-ip-selection|Dualstack ip selection|yes|[yes\|no]|dualstack-ip-selection yes
-|dualstack-ip-selection-threshold|Dualstack ip select threadhold|30ms|millisecond|dualstack-ip-selection-threshold [0-1000]
+|dualstack-ip-selection-threshold|Dualstack ip select thresholds|15ms|millisecond|dualstack-ip-selection-threshold [0-1000]
-|ca-file|certificate file|/etc/ssl/certs/ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
+|user|run as user|root|user [username]|user nobody
 |ca-file|certificate file|/etc/ssl/certs/<br />ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
 |ca-path|certificates path|/etc/ssl/certs|path|ca-path /etc/ssl/certs
 ## FAQ
 1. What is the difference between SmartDNS and DNSMASQ?  
    Smartdns is not designed to replace DNSMASQ. The main function of Smartdns is focused on DNS resolution enhancement, the difference are:  
-    * Multiple upstream server concurrent requests, after the results are measured, return the best results;
+    - Multiple upstream server concurrent requests, after the results are measured, return the best results;
-    * `address`, `ipset` domain name matching uses efficient algorithms, query matching is faster and more efficient, and router devices are still efficient.
+    - `address`, `ipset` domain name matching uses efficient algorithms, query matching is faster and more efficient, and router devices are still efficient.
-    * Domain name matching supports ignoring specific domain names, and can be individually matched to IPv4, IPV6, and supports diversified customization.
+    - Domain name matching supports ignoring specific domain names, and can be individually matched to IPv4, IPV6, and supports diversified customization.
-    * Enhance the ad blocking feature, return SOA record, this block ads better;
+    - Enhance the ad blocking feature, return SOA record, this block ads better;
-    * IPV4, IPV6 dual stack IP optimization mechanism, in the case of dual network, choose the fastest network.
+    - IPV4, IPV6 dual stack IP optimization mechanism, in the case of dual network, choose the fastest network.
-    * Supports the latest TLS, HTTPS protocol and provides secure DNS query capabilities.
+    - Supports the latest TLS, HTTPS protocol and provides secure DNS query capabilities.
-    * DNS anti-poison mechanism, and a variety of mechanisms to avoid DNS pollution.
+    - DNS anti-poison mechanism, and a variety of mechanisms to avoid DNS pollution.
-    * ECS support, the query results are better and more accurate.
+    - ECS support, the query results are better and more accurate.
-    * IP blacklist support, ignoring the blacklist IP to make domain name queries better and more accurate.
+    - IP blacklist support, ignoring the blacklist IP to make domain name queries better and more accurate.
-    * Domain name pre-fetch, more faster to access popular websites.
+    - Domain name pre-fetch, more faster to access popular websites.
-    * Domain name TTL can be specified to make access faster.
+    - Domain name TTL can be specified to make access faster.
-    * Cache mechanism to make access faster.
+    - Cache mechanism to make access faster.
-    * Asynchronous log, audit log mechanism, does not affect DNS query performance while recording information.
+    - Asynchronous log, audit log mechanism, does not affect DNS query performance while recording information.
-    * Domain group mechanism, specific domain names use specific upstream server group queries to avoid privacy leakage.
+    - Domain group mechanism, specific domain names use specific upstream server group queries to avoid privacy leakage.
-    * The second DNS supports customizing more behavior.
+    - The second DNS supports customizing more behavior.
 1. What is the best practices for upstream server configuration?  
    Smartdns has a speed measurement mechanism. When configuring an upstream server, it is recommended to configure multiple upstream DNS servers, including servers in different regions, but the total number is recommended to be around 10. Recommended configuration
-    * Carrier DNS.
+    - Carrier DNS.
-    * Public DNS, such as `8.8.8.8`, `8.8.4.4`, `1.1.1.1`.
+    - Public DNS, such as `8.8.8.8`, `8.8.4.4`, `1.1.1.1`.
    For specific domain names, if there is a pollution, you can enable the anti-pollution mechanism.
@@ -570,27 +631,27 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to avoid DNS privacy leaks  
    By default, smartdns will send requests to all configured DNS servers. If the upstream DNS servers record DNS logs, it will result in a DNS privacy leak. To avoid privacy leaks, try the following steps:
-    * Use trusted DNS servers.
+    - Use trusted DNS servers.
-    * Use TLS servers.
+    - Use TLS servers.
-    * Set up an upstream DNS server group.
+    - Set up an upstream DNS server group.
 1. How to block ads  
    Smartdns has a high-performance domain name matching algorithm. It is very efficient to filter advertisements by domain name. To block ads, you only need to configure records like the following configure. For example, if you block `*.ad.com`, configure as follows:
-    ```sh
+    ```shell
    Address /ad.com/#
    ```
    The suffix mode of the domain name, filtering *.ad.com, `#` means returning SOA record. If you want to only block IPV4 or IPV6 separately, add a number after `#`, such as `#4` is for IPV4 blocking. If you want to ignore some specific subdomains, you can configure it as follows. e.g., if you ignore `pass.ad.com`, you can configure it as follows:
-    ```sh
+    ```shell
    Address /pass.ad.com/-
    ```
 1. DNS query diversion  
    In some cases, some domain names need to be queried using a specific DNS server to do DNS diversion. such as.
-    ```sh
+    ```shell
    .home -> 192.168.1.1
    .office -> 10.0.0.1
    ```
@@ -600,7 +661,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    Other domain names are resolved using the default mode.
    The diversion configuration for this case is as follows:
-    ```sh
+    ```shell
    # Upstream configuration, use -group to specify the group name, and -exclude-default-group to exclude the server from the default group.
    Server 192.168.1.1 -group home -exclude-default-group
    Server 10.0.0.1 -group office -exclude-default-group
@@ -613,7 +674,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
    You can use the above configuration to implement DNS resolution and offload. If you need to implement traffic distribution on the requesting port, you can configure the second DNS server. The bind configuration is added. The group parameter specifies the traffic distribution name.
-    ```sh
+    ```shell
    Bind :7053 -group office
    Bind :8053 -group home
    ```
@@ -621,28 +682,28 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to use the IPV4, IPV6 dual stack IP optimization feature  
    At present, IPV6 network is not as fast as IPV4 in some cases. In order to get a better experience in the dual-stack network, SmartDNS provides a dual-stack IP optimization mechanism, the same domain name, and the speed of IPV4. Far faster than IPV6, then SmartDNS will block the resolution of IPV6, let the PC use IPV4, the feature is enabled by `dualstack-ip-selection yes`, `dualstack-ip-selection-threshold [time]` is for threshold. if you want to disable IPV6 AAAA record complete, please try `force-AAAA-SOA yes`.
-1. How to improve cache performace  
+1. How to improve cache performance  
    Smartdns provides a domain name caching mechanism to cache the queried domain name, and the caching time is in accordance with the DNS TTL specification. To increase the cache hit rate, the following configuration can be taken:
-    * Increase the number of cache records appropriately  
+    - Increase the number of cache records appropriately  
    Set the number of cache records by `cache-size`.
    In the case of a query with a high pressure environment and a machine with a large memory, it can be appropriately adjusted.
-    * Set the minimum TTL value as appropriate  
+    - Set the minimum TTL value as appropriate  
    Set the minimum DNS TTL time to a appropriate value by `rr-ttl-min` to extend the cache time.
    It is recommended that the timeout period be set to 10 to 30 minutes to avoid then invalid domain names when domain ip changes.
-    * Enable domain pre-acquisition  
+    - Enable domain pre-acquisition  
    Enable pre-fetching of domain names with `prefetch-domain yes` to improve query hit rate.
    by default, Smartdns will send domain query request again before cache expire, and cache the result for the next query. Frequently accessed domain names will continue to be cached. This feature will consume more CPU when idle.
-    * Cache serve expired feature  
+    - Cache serve expired feature  
    Enable cache serve expired feature with `serve-expired yes` to improve the cache hit rate and reduce the CPU consumption.
    This feature will return TTL = 0 to the client after the TTL timeout, and send a new query request again at the same time, and cache the new results for later query.
 1. How does the second DNS customize more behavior?  
    The second DNS can be used as the upstream of other DNS servers to provide more query behaviors. Bind configuration support can bind multiple ports. Different ports can be set with different flags to implement different functions, such as
-    ```sh
+    ```shell
    # Binding 6053 port, request for port 6053 will be configured with the upstream query of the office group, and the result will not be measured. The address configuration address is ignored.
    bind [::]:6053 -no-speed-check -group office -no-rule-addr
    ```
@@ -650,15 +711,97 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to get SPKI of DOT  
    The SPKI can be obtained from the page published by the DNS service provider. If it is not published, it can be obtained by the following command, replace IP with your own IP.
-    ````sh
+    ```shell
    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
    ```
 1. How to solve the problem of slow DNS resolution in iOS system?
    Since iOS14, Apple has supported the resolution of DNS HTTPS (TYPE65) records. This function is used for solving problems related to HTTPS connections, but it is still a draft, and it will cause some functions such as adblocking fail. It is recommended to disable it through the following configuration.
    ```shell
    force-qtype-SOA 65
    ```
 1. How to resolve localhost ip by hostname?  
    smartdns can cooperate with the dhcp server of DNSMASQ to support the resolution of local host name to IP address. You can configure smartdns to read the lease file of dnsmasq and support the resolution. The specific configuration parameters are as follows, (note that the DNSMASQ lease file may be different for each system and needs to be configured according to the actual situation)
    ```shell
    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
    ```
    After the configuration is complete, you can directly use the host name to connect to the local machine. But need to pay attention:
    - Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`
 1. How to use the domain set?  
    To facilitate configuring domain names by set, for configurations with /domain/, you can specify a domain name set for easy maintenance. The specific method is:
    - Use `domain-set` configuration domain set file:
    ````shell
    domain-set -name ad -file /etc/smartdns/ad-list.conf
    ````
    The format of ad-list.conf is one domain per line:
    ```shell
    ad.com
    site.com
    ```
    - To use the domain set, you only need to configure `/domain/` to `/domain-set:[collection name]/`, such as:
    ````shell
    address /domain-set:ad/#
    domain-rules /domain-set:ad/ -a #
    nameserver /domain-set:ad/server
    ...
    ````
 1. How to use ipset and nftset?  
    Similar to Dnsmasq, smartdns supports ipset and nftset, and can transparently forward specific domain names through TPROXY. The comparison of transparent forwarding and tool modes is as follows:
    1. Tools: iptable, nftable
        iptable: a mature routing rule configuration tool.
        nftable: A more powerful rule configuration tool that is becoming mainstream.
    1. Mode: TPROXY, REDIRECT
        TPROXY: supports UDP and TCP forwarding, and the configuration is a little complicated.
        REDIRECT: only supports TCP, easy to configure.
    Here we only take the configuration of the most commonly used iptable/REDIRECT with ipset as an example. The specific forwarding configuration is as follows:
    - Set the list of domain names that need to be transparently forwarded in smartdns.conf, for example, `example.com` needs to be transparently forwarded. Then use the ipset option and set the ipset rule of `example.com` to `proxy`.
    ```shell
    # set rules
    # -ipset proxy: The matching domain name is set to ipset:proxy.
    # -c none: Disable speed check.
    # -address #6: Filter IPV6 record.
    domain-rules /example.com/ -ipset proxy -c none -address #6
    ```
    - Execute shell commands, set iptable rules, and transparently forward matching domain name requests. The rules are as follows:
    ```shell
    # create ipset
    ipset create proxy hash:net
    # Set forwarding rules to forward matching requests to port 1081 of this machine
    iptables -t nat -I PREROUTING -p tcp -m set --match-set proxy dst -j REDIRECT --to-ports 1081
    ```
    - Open the forwarding program of REDIRECT mode on port 1081 of this machine.
 1. More questions  
    More questions, please read issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)
 ## Compile
-smartdns contains scripts for compiling packages, supports compiling luci, debian, openwrt, opare installation packages, and can execute `package/build-pkg.sh` compilation.
+smartdns contains scripts for compiling packages, supports compiling luci, debian, openwrt, optware installation packages, and can execute `package/build-pkg.sh` compilation.
-## [Donate](#Donate)  
+## [Donate](#donate)  
 If you feel that this project is helpful to you, please donate to us so that the project can continue to develop and be more perfect.
--- a/etc/init.d/smartdns
+++ b/etc/init.d/smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -68,11 +68,23 @@ case $1 in
 			echo "Stop smartdns server failed."
 			exit 1;
 		fi
-		rm -f "$PIDFILE"
+		LOOP=1
 		while true; do
 			if [ ! -d "/proc/$PID" ]; then
 				break;
 			fi
 			if [ $LOOP -gt 12 ]; then
 				kill -9 "$PID"
 				break;
 			fi
 			LOOP=$((LOOP+1))
 			sleep .5
 		done
 		echo "Stop smartdns server success."
 		;;
 	restart)
-		"$0" stop && sleep 1 && "$0" start
+		"$0" stop && "$0" start
 		;;
 	status)
 		PID="$(cat "$PIDFILE" 2>/dev/null)"
@@ -81,7 +93,7 @@ case $1 in
 			exit 1
 		fi
 		echo "smartdns server is running."
-		status=$?
+		status=0
 		;;
 	*)
 		echo "Usage: $0 {start|stop|restart|status}"
--- a/etc/smartdns/smartdns.conf
+++ b/etc/smartdns/smartdns.conf
@@ -4,31 +4,43 @@
 #   server-name smartdns
 #
 # whether resolv local hostname to ip address
 # resolv-hostname yes
 # dns server run user
 # user [username]
 # example: run as nobody
 #   user nobody
 #
 # Include another configuration options
 # conf-file [file]
 # conf-file blacklist-ip.conf
 # dns server bind ip and port, default dns server port is 53, support binding multi ip and port
 # bind udp server
-#   bind [IP]:[port] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
+#   bind [IP]:[port][@device] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
 # bind tcp server
-#   bind-tcp [IP]:[port] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
+#   bind-tcp [IP]:[port][@device] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
 # option:
 #   -group: set domain request to use the appropriate server group.
 #   -no-rule-addr: skip address rule.
 #   -no-rule-nameserver: skip nameserver rule.
-#   -no-rule-ipset: skip ipset rule.
+#   -no-rule-ipset: skip ipset rule or nftset rule.
 #   -no-speed-check: do not check speed.
 #   -no-cache: skip cache.
 #   -no-rule-soa: Skip address SOA(#) rules.
 #   -no-dualstack-selection: Disable dualstack ip selection.
 #   -force-aaaa-soa: force AAAA query return SOA.
 #   -set-mark: set mark on packets.
 # example: 
 #  IPV4: 
 #    bind :53
 #    bind :53@eth0
 #    bind :6053 -group office -no-speed-check
 #  IPV6:
 #    bind [::]:53
 #    bind [::]:53@eth0
 #    bind-tcp [::]:53
 bind [::]:53
@@ -38,10 +50,10 @@ bind [::]:53
 # dns cache size
 # cache-size [number]
 #   0: for no cache
-cache-size 4096
+cache-size 32768
 # enable persist cache when restart
-# cache-persist yes
+# cache-persist no
 # cache persist file
 # cache-file /tmp/smartdns.cache
@@ -77,7 +89,7 @@ cache-size 4096
 # speed check mode
 # speed-check-mode [ping|tcp:port|none|,]
 # example:
-#   speed-check-mode ping,tcp:80
+#   speed-check-mode ping,tcp:80,tcp:443
 #   speed-check-mode tcp:443,ping
 #   speed-check-mode none
@@ -87,35 +99,49 @@ cache-size 4096
 # force specific qtype return soa
 # force-qtype-SOA [qtypeid |...]
 # force-qtype-SOA 65 28
 force-qtype-SOA 65
 # Enable IPV4, IPV6 dual stack IP optimization selection strategy
 # dualstack-ip-selection-threshold [num] (0~1000)
 # dualstack-ip-allow-force-AAAA [yes|no]
 # dualstack-ip-selection [yes|no]
-# dualstack-ip-selection yes
+# dualstack-ip-selection no
 # edns client subnet
 # edns-client-subnet [ip/subnet]
 # edns-client-subnet 192.168.1.1/24
-# edns-client-subnet [8::8]/56
+# edns-client-subnet 8::8/56
 # ttl for all resource record
 # rr-ttl: ttl for all record
 # rr-ttl-min: minimum ttl for resource record
 # rr-ttl-max: maximum ttl for resource record
 # rr-ttl-reply-max: maximum reply ttl for resource record
 # example:
 # rr-ttl 300
 # rr-ttl-min 60
 # rr-ttl-max 86400
 # rr-ttl-reply-max 60
 # Maximum number of IPs returned to the client|8|number of IPs, 1~16
 # example:
 # max-reply-ip-num 1
 # response mode
 # Experimental feature
 # response-mode [first-ping|fastest-ip|fastest-response]
 # set log level
 # log-level: [level], level=fatal, error, warn, notice, info, debug
 # log-file: file path of log file.
 # log-size: size of each log file, support k,m,g
-# log-num: number of logs
+# log-num: number of logs, 0 means disable log
 log-level info
-# log-file /var/log/smartdns.log
+
 # log-file /var/log/smartdns/smartdns.log
 # log-size 128k
 # log-num 2
 # log-file-mode [mode]: file mode of log file.
 # dns audit
 # audit-enable [yes|no]: enable or disable audit.
@@ -123,9 +149,13 @@ log-level info
 # audit-SOA [yes|no]: enable or disable log soa result.
 # audit-size size of each audit file, support k,m,g
 # audit-file /var/log/smartdns-audit.log
 # audit-file-mode [mode]: file mode of audit file.
 # audit-size 128k
 # audit-num 2
 # Support reading dnsmasq dhcp file to resolve local hostname
 # dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
 # certificate file
 # ca-file [file]
 # ca-file /etc/ssl/certs/ca-certificates.crt
@@ -135,14 +165,17 @@ log-level info
 # ca-path /etc/ss/certs
 # remote udp dns server list
-# server [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
+# server [IP]:[PORT]|URL [-blacklist-ip] [-whitelist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
 # default port is 53
 #   -blacklist-ip: filter result with blacklist ip
-#   -whitelist-ip: filter result whth whitelist ip,  result in whitelist-ip will be accepted.
+#   -whitelist-ip: filter result with whitelist ip,  result in whitelist-ip will be accepted.
 #   -check-edns: result must exist edns RR, or discard result.
 #   -group [group]: set server to group, use with nameserver /domain/group.
 #   -exclude-default-group: exclude this server from default group.
 #   -proxy [proxy-name]: use proxy to connect to server.
 # server 8.8.8.8 -blacklist-ip -check-edns -group g1 -group g2
 # server tls://dns.google:853 
 # server https://dns.google/dns-query
 # remote tcp dns server list
 # server-tcp [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-group [group] ...] [-exclude-default-group]
@@ -155,6 +188,7 @@ log-level info
 #   -tls-host-verify: cert hostname to verify.
 #   -host-name: TLS sni hostname.
 #   -no-check-certificate: no check certificate.
 #   -proxy [proxy-name]: use proxy to connect to server.
 # Get SPKI with this command:
 #    echo | openssl s_client -connect '[ip]:853' | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
 # default port is 853
@@ -168,9 +202,19 @@ log-level info
 #   -host-name: TLS sni hostname.
 #   -http-host: http host.
 #   -no-check-certificate: no check certificate.
 #   -proxy [proxy-name]: use proxy to connect to server.
 # default port is 443
 # server-https https://cloudflare-dns.com/dns-query
 # socks5 and http proxy list
 # proxy-server URL -name [proxy name]
 #   URL: socks5://[username:password@]host:port
 #        http://[username:password@]host:port
 #   -name: proxy name, use with server -proxy [proxy-name]
 # example:
 #   proxy-server socks5://user:pass@1.2.3.4:1080 -name proxy
 #   proxy-server http://user:pass@1.2.3.4:3128 -name proxy
 # specific nameserver to domain
 # nameserver /domain/[group|-]
 # nameserver /www.example.com/office, Set the domain name to use the appropriate server group.
@@ -182,6 +226,13 @@ log-level info
 # address /www.example.com/-, ignore address, query from upstream, suffix 4, for ipv4, 6 for ipv6, none for all
 # address /www.example.com/#, return SOA to client, suffix 4, for ipv4, 6 for ipv6, none for all
 # specific cname to domain
 # cname /domain/target
 # enalbe DNS64 feature
 # dns64 [ip/subnet]
 # dns64 64:ff9b::/96
 # enable ipset timeout by ttl feature
 # ipset-timeout [yes]
@@ -190,6 +241,28 @@ log-level info
 # ipset /www.example.com/block, set ipset with ipset name of block 
 # ipset /www.example.com/-, ignore this domain
 # add to ipset when ping is unreachable
 # ipset-no-speed ipsetname
 # ipset-no-speed pass
 # enable nftset timeout by ttl feature
 # nftset-timeout [yes|no]
 # nftset-timeout yes
 # add to nftset when ping is unreachable
 # nftset-no-speed [#4:ip#table#set,#6:ipv6#table#setv6]
 # nftset-no-speed #4:ip#table#set
 # enable nftset debug, check nftset setting result, output log when error.
 # nftset-debug [yes|no]
 # nftset-debug yes
 # specific nftset to domain
 # nftset /domain/[#4:ip#table#set,#6:ipv6#table#setv6]
 # nftset /www.example.com/ip#table#set, equivalent to 'nft add element ip table set { ... }'
 # nftset /www.example.com/-, ignore this domain
 # nftset /www.example.com/#6:-, ignore ipv6
 # set domain rules
 # domain-rules /domain/ [-speed-check-mode [...]]
 # rules:
@@ -198,4 +271,21 @@ log-level info
 #   [-a] -address [address|-]: same as address option
 #   [-n] -nameserver [group|-]: same as nameserver option
 #   [-p] -ipset [ipset|-]: same as ipset option
 #   [-t] -nftset [nftset|-]: same as nftset option
 #   [-d] -dualstack-ip-selection [yes|no]: same as dualstack-ip-selection option
 #   -no-serve-expired: ignore expired domain
 #   -delete: delete domain rule
 # collection of domains 
 # the domain-set can be used with /domain/ for address, nameserver, ipset, etc.
 # domain-set -name [set-name] -type list -file [/path/to/file]
 #   [-n] -name [set name]: domain set name
 #   [-t] -type [list]: domain set type, list only now
 #   [-f] -file [path/to/set]: file path of domain set
 # 
 # example:
 # domain-set -name domain-list -type list -file /etc/smartdns/domain-list.conf
 # address /domain-set:domain-list/1.2.3.4
 # nameserver /domain-set:domain-list/server-group
 # ipset /domain-set:domain-list/ipset
 # domain-rules /domain-set:domain-list/ -speed-check-mode ping
--- a/package/build-pkg.sh
+++ b/package/build-pkg.sh
@@ -81,7 +81,7 @@ build()
 main()
 {
-	OPTS=`getopt -o o:h --long arch:,filearch:,ver:,platform:,cross-tool:,static,only-package,outputdir: \
+	OPTS=`getopt -o o:h --long arch:,filearch:,ver:,platform:,cross-tool:,with-nftables,static,only-package,outputdir: \
 		-n  "" -- "$@"`
 	if [ "$#" -le "1" ]; then
--- a/package/debian/DEBIAN/changelog
+++ b/package/debian/DEBIAN/changelog
@@ -1,4 +1,4 @@
-smartdns (1.2018.7.9) stable; urgency=low
+smartdns (1:1.2022.04.05) stable; urgency=low
  * Initial build
--- a/package/debian/make.sh
+++ b/package/debian/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -43,7 +43,9 @@ build()
 	mkdir $ROOT/etc/default/ -p
 	mkdir $ROOT/lib/systemd/system/ -p
-	sed -i "s/Version:.*/Version: $VER/" $ROOT/DEBIAN/control
+
 	pkgver=$(echo ${VER}| sed 's/^1\.//g')
 	sed -i "s/Version:.*/Version: ${pkgver}/" $ROOT/DEBIAN/control
 	sed -i "s/Architecture:.*/Architecture: $ARCH/" $ROOT/DEBIAN/control
 	chmod 0755 $ROOT/DEBIAN/prerm
--- a/package/linux/install
+++ b/package/linux/install
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -65,9 +65,31 @@ clean_service()
 get_systemd_path()
 {
-	service="`systemctl --no-legend| grep '\.service' | head -n 1 | awk '{print $1}'`"
+	service="`systemctl --no-legend| grep '\.service' | head -n 1 | awk '{print $1}' 2>/dev/null`"
-	SERVICE_PATH="`systemctl show $service | grep FragmentPath | awk -F'=' '{print $2}'`"
+	SERVICE_PATH="`systemctl show $service | grep FragmentPath | awk -F'=' '{print $2}' 2>/dev/null`"
-	dirname $SERVICE_PATH
+	if [ ! -z "$SERVICE_PATH" ]; then
 		SERVICE_PATH="`dirname $SERVICE_PATH 2>/dev/null`"
 		if [ -d "$SERVICE_PATH" ]; then
 			echo "$SERVICE_PATH"
 			return 0
 		fi 
 	fi
 	SERVICE_PATH="`pkg-config systemd --variable=systemdsystemunitdir 2>/dev/null`"
 	if [ ! -z "$SERVICE_PATH" ]; then
 		if [ -d "$SERVICE_PATH" ]; then
 			echo "$SERVICE_PATH"
 			return 0
 		fi 
 	fi
 	SERVICE_PATH="/lib/systemd/system"
 	if [ -d "$SERVICE_PATH" ]; then
 		echo "$SERVICE_PATH"
 		return 0
 	fi
 	return 1
 }
 install_files()
@@ -106,6 +128,7 @@ install_files()
 	if [ $ISSYSTEMD -eq 0 ]; then
 		SYSTEM_UNIT_PATH="`get_systemd_path`"
 		if [ -z "$SYSTEM_UNIT_PATH" ]; then
 			echo "cannot find systemd path"
 			return 1
 		fi
 		install -v -m 0644 -t $PREFIX$SYSTEM_UNIT_PATH systemd/smartdns.service 
@@ -187,7 +210,7 @@ init_dir()
 	which systemctl >/dev/null 2>&1
 	ISSYSTEMD="$?"
 	# Running under WSL (Windows Subsystem for Linux)?
-	cat /proc/version | grep Microsoft >/dev/null 2>&1; 
+	cat /proc/version | grep -E '[Mm]icrosoft' >/dev/null 2>&1; 
 	if [ $? -eq 0 ]; then
 		ISSYSTEMD=1
 		ISWSL=0
--- a/package/luci-compat/control/control
+++ b/package/luci-compat/control/control
@@ -1,6 +1,6 @@
 Package: luci-app-smartdns
 Version: git-18.201.27126-7bf0367-1
-Depends: libc, smartdns
+Depends: libc, smartdns, luci-compat
 Source: feeds/luci/applications/luci-app-smartdns
 Section: luci
 Architecture: all
--- a/package/luci-compat/control/postinst
+++ b/package/luci-compat/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/control/prerm
+++ b/package/luci-compat/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/etc/uci-defaults/50_luci-smartdns
+++ b/package/luci-compat/files/etc/uci-defaults/50_luci-smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/luci/controller/smartdns.lua
+++ b/package/luci-compat/files/luci/controller/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -38,46 +38,20 @@ end
 function act_status()
 	local e={}
 	local ipv6_server;
-	local redirect_mode="none";
+	local dnsmasq_server = smartdns.get_config_option("dhcp", "dnsmasq", "server", {nil})[1]
-
+	local auto_set_dnsmasq = smartdns.get_config_option("smartdns", "smartdns", "auto_set_dnsmasq", nil);
 	e.ipv6_works = 2;
 	e.ipv4_works = 2;
 	e.ipv6_server = 1;
 	e.dnsmasq_forward = 0;
 	redirect_mode = smartdns.get_config_option("smartdns", "smartdns", "redirect", nil);
 	if redirect_mode == "redirect" then
 		e.redirect = 1
 	elseif redirect_mode == "dnsmasq-upstream" then
 		e.redirect = 2
 	else
 		e.redirect = 0
 	end
 	e.auto_set_dnsmasq = auto_set_dnsmasq
 	e.dnsmasq_server = dnsmasq_server
 	e.local_port = smartdns.get_config_option("smartdns", "smartdns", "port", nil);
-	ipv6_server = smartdns.get_config_option("smartdns", "smartdns", "ipv6_server", nil);
+	if e.local_port ~= nil and e.local_port ~= "53" and auto_set_dnsmasq ~= nil and auto_set_dnsmasq == "1" then
 	if e.redirect == 1 then 
 		if e.local_port ~= nil and e.local_port ~= "53" then
 			e.ipv4_works = luci.sys.call("iptables -t nat -nL PREROUTING 2>/dev/null | grep REDIRECT | grep dpt:53 | grep %q >/dev/null 2>&1" % e.local_port) == 0
 			if ipv6_server == "1" then
 				e.ipv6_works = luci.sys.call("ip6tables -t nat -nL PREROUTING 2>/dev/null| grep REDIRECT | grep dpt:53 | grep %q >/dev/null 2>&1" % e.local_port) == 0
 			else 
 				e.ipv6_works = 2
 			end
 		else
 			e.redirect = 0
 		end
 	elseif e.redirect == 2 then
 		local str;
-		local dnsmasq_server = luci.sys.exec("uci get dhcp.@dnsmasq[0].server")
+		str = "127.0.0.1#" .. e.local_port 
-		if e.local_port ~= nil then
+		if dnsmasq_server ~= str then
-			str = "127.0.0.1#" .. e.local_port 
+			e.dnsmasq_redirect_failure = 1
 			if  string.sub(dnsmasq_server,1,string.len(str)) == str then 
 				e.dnsmasq_forward = 1
 			end
 		end
 	end
 	e.running = is_running()
 	luci.http.prepare_content("application/json")
 	luci.http.write_json(e)
 end
--- a/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
@@ -1,299 +1,583 @@
 msgid ""
 msgstr "Content-Type: text/plain; charset=UTF-8\n"
-msgid "SmartDNS"
+msgid "Additional Args for upstream dns servers"
-msgstr "SmartDNS"
+msgstr "额外的上游 DNS 服务器参数"
-msgid "SmartDNS is a local high-performance DNS server"
+msgid "Additional Rule Flag"
-msgstr "SmartDNS是一个本地高性能DNS服务器"
+msgstr "额外规则标识"
-msgid "SmartDNS Server"
+msgid "Additional Flags for rules, read help on domain-rule for more information."
-msgstr "SmartDNS 服务器"
+msgstr "额外的规则标识，具体参考domain-rule的帮助说明。"
-msgid "SmartDNS is a local high-performance DNS server, supports finding fastest IP, supports ad filtering, and supports avoiding DNS poisoning."
+msgid "Additional Server Args"
-msgstr "SmartDNS是一个本地高性能DNS服务器，支持返回最快IP，支持广告过滤。"
+msgstr "额外的服务器参数"
 msgid "Custom Settings"
 msgstr "自定义设置"
 msgid "General Settings"
 msgstr "基本设置"
 msgid "Settings"
 msgstr "设置"
 msgid "Advanced Settings"
 msgstr "高级设置"
-msgid "Generate Coredump"
+msgid ""
-msgstr "生成coredump"
+"Attempts to serve old responses from cache with a TTL of 0 in the response "
-
+"without waiting for the actual resolution to finish."
 msgid "Generate Coredump file when smartdns crash, coredump file is located at /tmp/smartdns.xxx.core."
 msgstr "当smartdns异常时生成coredump文件，coredump文件在/tmp/smartdns.xxx.core."
 msgid "Server Name"
 msgstr "服务器名称"
 msgid "Smartdns server name"
 msgstr "SmartDNS的服务器名称，默认为smartdns，留空为主机名"
 msgid "SmartDNS is a local dns server to find fastest ip."
 msgstr "本地高性能服务器，优化网络访问性能。"
 msgid "Enable or disable smartdns server"
 msgstr "启用或禁用SmartDNS服务"
 msgid "Local Port"
 msgstr "本地端口"
 msgid "Smartdns local server port"
 msgstr "SmartDNS本地服务端口"
 msgid "IPV4 53 Port Redirect Failure"
 msgstr "IPV4 53端口重定向失败"
 msgid "IPV6 53 Port Redirect Failure"
 msgstr "IPV6 53端口重定向失败"
 msgid "Dnsmasq Forwared To Smartdns Failure"
 msgstr "重定向dnsmasq到smartdns失败"
 msgid "TCP Server"
 msgstr "TCP服务器"
 msgid "Enable TCP DNS Server"
 msgstr "启用TCP服务器"
 msgid "IPV6 Server"
 msgstr "IPV6服务器"
 msgid "Enable IPV6 DNS Server"
 msgstr "启用IPV6服务器"
 msgid "Dual-stack IP Selection"
 msgstr "双栈IP优选"
 msgid "Enable IP selection between IPV4 and IPV6"
 msgstr "启用或禁用IPV4，IPV6间的IP优选策略。"
 msgid "Domain prefetch"
 msgstr "域名预加载"
 msgid "Enable domain prefetch, accelerate domain response speed."
 msgstr "启用域名预加载，加速域名响应速度。"
 msgid "Serve expired"
 msgstr "过期缓存服务"
 msgid "Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."
 msgstr "查询性能优化，有请求时尝试回应TTL为0的过期记录，以避免查询等待。"
-msgid "Redirect"
+msgid "Automatically Set Dnsmasq"
-msgstr "重定向"
+msgstr "自动设置Dnsmasq"
-msgid "SmartDNS redirect mode"
+msgid "Automatically set as upstream of dnsmasq when port changes."
-msgstr "SmartDNS 重定向模式"
+msgstr "自动设置为Dnsmasq的上游服务器"
-msgid "Run as dnsmasq upstream server"
+msgid "Bind Device"
-msgstr "作为dnsmasq的上游服务器"
+msgstr "绑定到设备"
-msgid "Redirect 53 port to SmartDNS"
+msgid "Bind Device Name"
-msgstr "重定向53端口到SmartDNS"
+msgstr "绑定的设备名称"
 msgid "Cache Persist"
 msgstr "持久化缓存"
 msgid "Cache Size"
 msgstr "缓存大小"
 msgid "Collecting data..."
 msgstr "正在收集数据..."
 msgid ""
 "Configure IP blacklists that will be filtered from the results of specific "
 "DNS server."
 msgstr "配置需要从指定域名服务器结果过滤的IP黑名单。"
 msgid "Configure block domain list."
 msgstr "配置屏蔽域名列表"
 msgid "Configure forwarding domain name list."
 msgstr "配置分流域名列表"
 msgid "Custom Settings"
 msgstr "自定义设置"
 msgid "DNS Block Setting"
 msgstr "域名屏蔽设置"
 msgid "DNS Forwarding Setting"
 msgstr "域名分流设置"
 msgid "DNS Server Name"
 msgstr "DNS服务器名称"
 msgid "DNS Server group belongs to, such as office, home."
 msgstr "配置归属服务器组，例如office, home"
 msgid ""
 "DNS Server group belongs to, used with nameserver, such as office, home."
 msgstr "DNS服务器所属组， 配合nameserver使用，例如：office，home。"
 msgid "DNS Server ip"
 msgstr "DNS服务器IP"
 msgid "DNS Server port"
 msgstr "DNS服务器端口"
 msgid "DNS Server type"
 msgstr "协议类型"
 msgid "DNS domain result cache size"
-msgstr "缓存DNS的结果，缓存大小，配置零则不缓存（单位：条）"
+msgstr "缓存DNS的结果，缓存大小，配置零则不缓存"
-msgid "Domain TTL"
+msgid "DNS64 Server Settings"
-msgstr "域名TTL"
+msgstr "DNS64服务器配置"
-msgid "TTL for all domain result."
+msgid "Description"
-msgstr "设置所有域名的TTL值（单位：秒，下同）"
+msgstr "描述"
-msgid "Domain TTL Min"
+msgid "Do not check certificate."
-msgstr "域名TTL最小值"
+msgstr "不校验证书的合法性。"
 msgid "Minimum TTL for all domain result."
 msgstr "设置所有域名的TTL最小值"
 msgid "Domain TTL Max"
 msgstr "域名TTL最大值"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 msgid "Second Server Settings"
 msgstr "第二DNS服务器"
 msgid "Enable or disable second DNS server."
 msgstr "是否启用第二DNS服务器。"
 msgid "Skip Speed Check"
 msgstr "跳过测速"
 msgid "Do not check speed."
 msgstr "禁用测速。"
-msgid "Server Group"
+msgid "Domain Address"
-msgstr "服务器组"
+msgstr "域名地址"
 msgid "Domain List"
 msgstr "域名列表"
 msgid "Domain List File"
 msgstr "域名列表文件"
 msgid "Domain Rules"
 msgstr "域名规则"
 msgid "Domain Rules Settings"
 msgstr "域名规则设置"
 msgid "Domain TTL"
 msgstr "域名TTL"
 msgid "Domain TTL Max"
 msgstr "域名TTL最大值"
 msgid "Domain TTL Min"
 msgstr "域名TTL最小值"
 msgid "Domain prefetch"
 msgstr "域名预加载"
 msgid "Donate"
 msgstr "捐助"
 msgid "Donate to smartdns"
 msgstr "捐助smartdns项目"
 msgid "Download Files"
 msgstr "下载文件"
 msgid "Download Files Setting"
 msgstr "下载文件设置"
 msgid ""
 "Download domain list files for domain-rule and include config files, please "
 "refresh the page after download to take effect."
 msgstr "下载域名文件列表，下载后刷新页面生效"
 msgid "Dual-stack IP Selection"
 msgstr "双栈IP优选"
 msgid "Enable"
 msgstr "启用"
 msgid "Enable Auto Update"
 msgstr "启用自动更新"
 msgid "Enable IP selection between IPV4 and IPV6"
 msgstr "启用 IPV4 和 IPV6 间的 IP 优选策略"
 msgid "Enable IPV6 DNS Server"
 msgstr "启用IPV6服务器"
 msgid "Enable TCP DNS Server"
 msgstr "启用TCP服务器"
 msgid "Enable daily auto update."
 msgstr "启用每日自动更新。"
 msgid "Enable domain prefetch, accelerate domain response speed."
 msgstr "启用域名预加载，加速域名响应速度。"
 msgid "Enable or disable second DNS server."
 msgstr "是否启用第二DNS服务器。"
 msgid "Enable or disable smartdns server"
 msgstr "启用或禁用SmartDNS服务"
 msgid "Exclude DNS Server from default group."
 msgstr "从default默认服务器组中排除"
 msgid "Exclude Default Group"
 msgstr "从默认服务器组排除"
 msgid "File Name"
 msgstr "文件名"
 msgid "File Type"
 msgstr "文件类型"
 msgid "Filtering IP with blacklist"
 msgstr "使用IP黑名单过滤"
 msgid "First Ping"
 msgstr "最快PING"
 msgid "Fastest IP"
 msgstr "最快IP"
 msgid "Fastest Response"
 msgstr "最快响应"
 msgid "Force AAAA SOA"
 msgstr "停用IPV6地址解析"
 msgid "Force AAAA SOA."
 msgstr "停用IPV6地址解析。"
 msgid "Force HTTPS SOA"
 msgstr "停用HTTPS地址解析"
 msgid "Force HTTPS SOA."
 msgstr "停用HTTPS地址解析。"
 msgid "General Settings"
 msgstr "常规设置"
 msgid "Generate Coredump"
 msgstr "生成coredump"
 msgid ""
 "Generate Coredump file when smartdns crash, coredump file is located at /tmp/"
 "smartdns.xxx.core."
 msgstr ""
 "当smartdns异常时生成coredump文件，coredump文件在/tmp/smartdns.xxx.core."
 msgid "HTTP Host"
 msgstr "HTTP主机"
 msgid "IP Blacklist"
 msgstr "IP黑名单"
 msgid "IP Blacklist Filtering"
 msgstr "IP黑名单过滤"
 msgid "IPV6 Server"
 msgstr "IPV6服务器"
 msgid "IPset Name"
 msgstr "IPSet名称"
 msgid "IPset name."
 msgstr "IPSet名称。"
 msgid "Ipset name, Add domain result to ipset when speed check fails."
 msgstr "IPset名称，当测速失败时，将查询到的结果添加到对应的IPSet集合中。"
 msgid "ipset name format error, format: [#[4|6]:]ipsetname"
 msgstr "IPset名称格式错误，格式：[#[4|6]:]ipsetname"
 msgid "If you like this software, please buy me a cup of coffee."
 msgstr "如果本软件对你有帮助，请给作者加个蛋。"
 msgid "Include Config Files<br>/etc/smartdns/conf.d"
 msgstr "包含配置文件"
 msgid ""
 "Include other config files from /etc/smartdns/conf.d or custom path, can be "
 "downloaded from the download page."
 msgstr "包含配置文件，路径为/etc/smartdns/conf.d，或自定义配置文件路径，可以从下载页配置自动下载。"
 msgid "List of files to download."
 msgstr "下载的文件列表。"
 msgid "Listen only on the specified interfaces."
 msgstr "监听在指定的设备上，避免非本地网络的DNS查询请求。"
 msgid "Local Port"
 msgstr "本地端口"
 msgid "Marking Packets"
 msgstr "数据包标记"
 msgid "Set mark on packets."
 msgstr "设置数据包标记。"
 msgid "Maximum TTL for all domain result."
 msgstr "所有域名的最大 TTL 值。"
 msgid "Minimum TTL for all domain result."
 msgstr "所有域名的最小 TTL 值。"
 msgid "Name of device name listen on."
 msgstr "绑定的设备名称。"
 msgid "NFTset Name"
 msgstr "NFTSet名称"
 msgid "NFTset name format error, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTSet名称格式错误，格式：[#[4|6]:[family#table#set]]"
 msgid "NFTset name, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTSet名称，格式：[#[4|6]:[family#table#set]]"
 msgid "Nftset name, Add domain result to nftset when speed check fails, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTset名称，当测速失败时，将查询到的结果添加到对应的NFTSet集合中。"
 msgid "No Speed IPset Name"
 msgstr "无速度时IPSet名称"
 msgid "No Speed NFTset Name"
 msgstr "无速度时NFTSet名称"
 msgid "NOT RUNNING"
 msgstr "未运行"
 msgid "No check certificate"
 msgstr "停用证书校验"
 msgid "Please set proxy server first."
 msgstr "请先设置代理服务器。"
 msgid "Proxy Server"
 msgstr "代理服务器"
 msgid "Proxy Server URL, format: [socks5|http]://user:pass@ip:port."
 msgstr "代理服务器地址，格式：[socks5|http]://user:pass@ip:port。"
 msgid "Proxy server URL format error, format: [socks5|http]://user:pass@ip:port."
 msgstr "代理服务器地址格式错误，格式：[socks5|http]://user:pass@ip:port。"
 msgid "Proxy Server Settings"
 msgstr "代理服务器设置"
 msgid "Query DNS through specific dns server group, such as office, home."
 msgstr "使用指定服务器组查询，比如office, home。"
 msgid "RUNNING"
 msgstr "运行中"
 msgid "Reply Domain TTL Max"
 msgstr "回应的域名TTL最大值"
 msgid "Reply maximum TTL for all domain result."
 msgstr "设置返回给客户端的域名TTL最大值。"
 msgid "Resolve Local Hostnames"
 msgstr "解析本地主机名"
 msgid "Resolve local hostnames by reading Dnsmasq lease file."
 msgstr "读取Dnsmasq的租约文件解析本地主机名。"
 msgid "Restart"
 msgstr "重启"
 msgid "Restart smartdns"
 msgstr "重启服务"
 msgid "Response Mode"
 msgstr "响应模式"
 msgid "Second Server Settings"
 msgstr "第二DNS服务器"
 msgid "Serve expired"
 msgstr "缓存过期服务"
 msgid "Server Group"
 msgstr "服务器组"
 msgid "Server Group not exists"
 msgstr "服务器组不存在"
 msgid "Server Name"
 msgstr "服务器名称"
 msgid "Set Specific domain ip address."
 msgstr "设置指定域名的IP地址。"
 msgid "Set Specific ip blacklist."
 msgstr "设置指定的 IP 黑名单列表。"
 msgid "Set TLS hostname to verify."
 msgstr "设置校验TLS主机名。"
 msgid ""
 "Set the HTTP host used for the query. Use this parameter when the host of "
 "the URL address is an IP address."
 msgstr "设置查询时使用的HTTP主机，当URL地址的host是IP地址时，使用此参数。"
 msgid "Sets the server name indication for query."
 msgstr "设置查询时使用的服务器SNI名称。"
 msgid "Settings"
 msgstr "设置"
 msgid "Skip Address Rules"
 msgstr "跳过address规则"
 msgid "Skip address rules."
 msgstr "跳过address规则。"
 msgid "Skip Nameserver Rule"
 msgstr "跳过Nameserver规则"
 msgid "Skip nameserver rules."
 msgstr "跳过Nameserver规则。"
 msgid "Skip Ipset Rule"
 msgstr "跳过ipset规则"
 msgid "Skip ipset rules."
 msgstr "跳过ipset规则。"
 msgid "Skip SOA Address Rule"
 msgstr "跳过address SOA(#)规则"
 msgid "Skip SOA address rules."
 msgstr "跳过address SOA(#)规则。"
 msgid "Skip Dualstack Selection"
 msgstr "跳过双栈优选"
 msgid "Skip Dualstack Selection."
 msgstr "跳过双栈优选。"
 msgid "Skip Cache"
 msgstr "跳过cache"
 msgid "Skip Cache."
 msgstr "跳过cache。"
-msgid "Upstream Servers"
+msgid "Skip Dualstack Selection"
-msgstr "上游服务器"
+msgstr "跳过双栈优选"
-msgid "Upstream Servers, support UDP, TCP protocol. Please configure multiple DNS servers, including multiple foreign DNS servers."
+msgid "Skip Dualstack Selection."
-msgstr "上游DNS服务器列表，支持UDP，TCP协议，请配置多个上游DNS服务器，包括多个国内外服务器"
+msgstr "跳过双栈优选。"
-msgid "DNS Server Name"
+msgid "Skip Ipset Rule"
-msgstr "DNS服务器名称"
+msgstr "跳过ipset规则"
-msgid "port"
+msgid "Skip Nameserver Rule"
-msgstr "端口"
+msgstr "跳过Nameserver规则"
-msgid "DNS Server port"
+msgid "Skip SOA Address Rule"
-msgstr "DNS服务器端口"
+msgstr "跳过address SOA(#)规则"
-msgid "DNS Server ip"
+msgid "Skip SOA address rules."
-msgstr "DNS服务器IP"
+msgstr "跳过address SOA(#)规则。"
-msgid "type"
+msgid "Skip Speed Check"
-msgstr "类型"
+msgstr "跳过测速"
-msgid "DNS Server type"
+msgid "Skip address rules."
-msgstr "协议类型"
+msgstr "跳过address规则。"
-msgid "Domain Address"
+msgid "Skip ipset rules."
-msgstr "域名地址"
+msgstr "跳过ipset规则。"
-msgid "TLS Hostname Verify"
+msgid "Skip nameserver rules."
-msgstr "校验TLS主机名"
+msgstr "跳过Nameserver规则。"
-msgid "Set TLS hostname to verify."
+msgid "SmartDNS"
-msgstr "设置校验TLS主机名。"
+msgstr "SmartDNS"
-msgid "No check certificate"
+msgid "SmartDNS Server"
-msgstr "停用证书校验"
+msgstr "SmartDNS 服务器"
-msgid "Do not check certificate."
+msgid ""
-msgstr "不校验证书的合法性。"
+"SmartDNS is a local high-performance DNS server, supports finding fastest "
-
+"IP, supports ad filtering, and supports avoiding DNS poisoning."
-msgid "TLS SNI name"
+msgstr "SmartDNS是一个本地高性能DNS服务器，支持返回最快IP，支持广告过滤。"
 msgstr "TLS SNI名称"
 msgid "HTTP Host"
 msgstr "HTTP主机"
 msgid "Sets the server name indication for query."
 msgstr "设置查询时使用的服务器SNI名称。"
 msgid "Set the HTTP host used for the query. Use this parameter when the host of the URL address is an IP address."
 msgstr "设置查询时使用的HTTP主机，当URL地址的host是IP地址时，使用此参数。"
 msgid "Server Group"
 msgstr "服务器组"
 msgid "DNS Server group belongs to, used with nameserver, such as office, home."
 msgstr "DNS服务器所属组， 配合nameserver使用，例如：office，home。"
 msgid "IP Blacklist Filtering"
 msgstr "IP黑名单过滤"
 msgid "Anti Answer Forgery"
 msgstr "反回答伪造"
 msgid "Anti answer forgery, if DNS does not work properly after enabling, please turn off this feature"
 msgstr "反回答伪造，如果启用后DNS工作不正常，请关闭此功能。"
 msgid "Filtering IP with blacklist"
 msgstr "使用IP黑名单过滤"
 msgid "TLS SPKI Pinning"
 msgstr "TLS SPKI 指纹"
 msgid "Used to verify the validity of the TLS server, The value is Base64 encoded SPKI fingerprint, leaving blank to indicate that the validity of TLS is not verified."
 msgstr "用于校验TLS服务器的有效性，数值为Base64编码的SPKI指纹, 留空表示不验证TLS的合法性"
 msgid "Additional Server Args"
 msgstr "额外的服务器参数"
 msgid "Additional Args for upstream dns servers"
 msgstr "额外的上游DNS服务器参数"
 msgid "Upstream DNS Server Configuration"
 msgstr "上游DNS服务器配置"
 msgid "Set Specific domain ip address."
 msgstr "指定特定域名的IP地址"
 msgid "Specify an IP address to return for any host in the given domains, Queries in the domains are never forwarded and always replied to with the specified IP address which may be IPv4 or IPv6."
 msgstr "配置特定域名返回特定的IP地址，域名查询将不到上游服务器请求，直接返回配置的IP地址，可用于广告屏蔽。"
 msgid "IP Blacklist"
 msgstr "IP黑名单"
 msgid "Set Specific ip blacklist."
 msgstr "设置IP黑名单列表"
 msgid "Configure IP blacklists that will be filtered from the results of specific DNS server."
 msgstr "配置需要从指定域名服务器结果过滤的IP黑名单。"
 msgid "Technical Support"
 msgstr "技术支持"
 msgid "If you like this software, please buy me a cup of coffee."
 msgstr "如果本软件对你有帮助，请给作者加个蛋。"
 msgid "SmartDNS official website"
 msgstr "SmartDNS官方网站"
 msgid "Smartdns local server port"
 msgstr "SmartDNS本地服务端口"
 msgid ""
 "Smartdns local server port, smartdns will be automatically set as main dns "
 "when the port is 53."
 msgstr ""
 "SmartDNS本地服务端口，当端口号设置为53时，smartdns将会自动配置为主dns。"
 msgid "Smartdns server name"
 msgstr "SmartDNS的服务器名称，默认为smartdns，留空为主机名"
 msgid "Speed check mode is invalid."
 msgstr "测速模式无效。"
 msgid "Speed Check Mode"
 msgstr "测速模式"
 msgid "Smartdns speed check mode. "
 msgstr "SmartDns测速模式设置。"
 msgid ""
 "Smartdns response mode, First Ping: return the first ping IP, "
 "Fastest IP: return the fastest IP, Fastest Response: return the fastest "
 "DNS response."
 msgstr ""
 "SmartDNS响应模式，最快PING： 返回最早有ping结果的IP，速度适中；最快IP： "
 "返回最快IP，查询请求可能延长； 最快响应：返回最快响应的结果。查询请求时间短。"
 msgid ""
 "Specify an IP address to return for any host in the given domains, Queries "
 "in the domains are never forwarded and always replied to with the specified "
 "IP address which may be IPv4 or IPv6."
 msgstr ""
 "配置特定域名返回特定的IP地址，域名查询将不到上游服务器请求，直接返回配置的IP"
 "地址，可用于广告屏蔽。"
 msgid "Report bugs"
 msgstr "报告BUG"
 msgid "TCP Server"
 msgstr "TCP服务器"
 msgid "TLS Hostname Verify"
 msgstr "校验TLS主机名"
 msgid "TLS SNI name"
 msgstr "TLS SNI名称"
 msgid "TLS SPKI Pinning"
 msgstr "TLS SPKI 指纹"
 msgid "TTL for all domain result."
 msgstr "设置所有域名的 TTL 值。"
 msgid "Technical Support"
 msgstr "技术支持"
 msgid "Use Proxy"
 msgstr "使用代理"
 msgid "Use proxy to connect to upstream DNS server."
 msgstr "使用代理连接上游DNS服务器。"
 msgid "URL"
 msgstr "URL"
 msgid "URL format error, format: http:// or https://"
 msgstr "URL格式错误，格式：http://或https://"
 msgid "Update Files"
 msgstr "更新文件"
 msgid "Upload Config File"
 msgstr "上传配置文件"
 msgid "Upload Domain List File"
 msgstr "上传域名列表文件"
 msgid "Upload domain list file to /etc/smartdns/domain-set"
 msgstr "上传域名列表文件到/etc/smartdns/domain-set目录"
 msgid ""
 "Upload domain list file, or configure auto download from Download File "
 "Setting page."
 msgstr "上传域名列表文件，或在下载文件设置页面设置自动下载。"
 msgid "Upload domain list file."
 msgstr "上传域名列表文件。"
 msgid "Upload smartdns config file to /etc/smartdns/conf.d"
 msgstr "上传配置文件到/etc/smartdns/conf.d目录"
 msgid "Upstream DNS Server Configuration"
 msgstr "上游服务器配置"
 msgid "Upstream Servers"
 msgstr "上游服务器"
 msgid ""
 "Upstream Servers, support UDP, TCP protocol. Please configure multiple DNS "
 "servers, including multiple foreign DNS servers."
 msgstr ""
 "上游 DNS 服务器，支持 UDP，TCP 协议。请配置多个上游 DNS 服务器，包括多个国内"
 "外服务器。"
 msgid ""
 "Used to verify the validity of the TLS server, The value is Base64 encoded "
 "SPKI fingerprint, leaving blank to indicate that the validity of TLS is not "
 "verified."
 msgstr ""
 "用于校验 TLS 服务器的有效性，数值为 Base64 编码的 SPKI 指纹，留空表示不验证 "
 "TLS 的合法性。"
 msgid "Write cache to disk on exit and load on startup."
 msgstr "退出时保存cache到磁盘，启动时加载。"
 msgid "domain list (/etc/smartdns/domain-set)"
 msgstr "域名列表（/etc/smartdns/domain-set）"
 msgid "https"
 msgstr "https"
 msgid "ip"
 msgstr "ip"
 msgid "open website"
 msgstr "打开网站"
-msgid "Donate to smartdns"
+msgid "port"
-msgstr "捐助smartdns项目"
+msgstr "端口"
-msgid "Donate"
+msgid "smartdns config (/etc/smartdns/conf.d)"
-msgstr "捐助"
+msgstr "配置文件（/etc/smartdns/conf.d）"
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 msgid "tcp"
 msgstr "tcp"
 msgid "tls"
 msgstr "tls"
 msgid "type"
 msgstr "类型"
 msgid "udp"
 msgstr "udp"
 msgid "update domain list files"
 msgstr "更新列表文件"
--- a/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
+++ b/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -19,6 +19,8 @@ require ("luci.http")
 require ("luci.dispatcher")
 require ("nixio.fs")
 local uci = require "luci.model.uci".cursor()
 m = Map("smartdns")
 m.title	= translate("SmartDNS Server")
 m.description = translate("SmartDNS is a local high-performance DNS server, supports finding fastest IP, supports ad filtering, and supports avoiding DNS poisoning.")
@@ -30,7 +32,10 @@ s = m:section(TypedSection, "smartdns", translate("Settings"), translate("Genera
 s.anonymous = true
 s:tab("settings", translate("General Settings"))
 s:tab("advanced", translate('Advanced Settings'))
 s:tab("seconddns", translate("Second Server Settings"))
 s:tab("dns64", translate("DNS64 Server Settings"))
 s:tab("proxy", translate("Proxy Server Settings"))
 s:tab("custom", translate("Custom Settings"))
 ---- Eanble
@@ -45,14 +50,79 @@ o.datatype    = "hostname"
 o.rempty      = false
 ---- Port
-o = s:taboption("settings", Value, "port", translate("Local Port"), translate("Smartdns local server port"))
+o = s:taboption("settings", Value, "port", translate("Local Port"), 
-o.placeholder = 6053
+    translate("Smartdns local server port, smartdns will be automatically set as main dns when the port is 53."))
-o.default     = 6053
+o.placeholder = 53
 o.default     = 53
 o.datatype    = "port"
 o.rempty      = false
 -- Automatically Set Dnsmasq
 o = s:taboption("settings", Flag, "auto_set_dnsmasq", translate("Automatically Set Dnsmasq"), translate("Automatically set as upstream of dnsmasq when port changes."))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 ---- Speed check mode;
 o = s:taboption("advanced", Value, "speed_check_mode", translate("Speed Check Mode"), translate("Smartdns speed check mode."));
 o.rmempty = true;
 o.placeholder = "default";
 o.default = o.enabled;
 o:value("ping,tcp:80,tcp:443");
 o:value("ping,tcp:443,tcp:80");
 o:value("tcp:80,tcp:443,ping");
 o:value("tcp:443,tcp:80,ping");
 o:value("none", translate("None"));
 function o.validate (section_id, value) 
    if value == "" then
        return value
    end
    if value == nil then
        return nil, translate("Speed check mode is invalid.")
    end
    if value == "none" then
        return value
    end
    local mode = value:split(",");
    for _, v in ipairs(mode) do repeat
        if v == "ping" then
            break
        end
        if v == nil then
            return nil, translate("Speed check mode is invalid.")
        end
        local port = v:split(":");
        if "tcp" == port[1] then
            if tonumber(port[2]) then
                break
            end
        end
        return nil, translate("Speed check mode is invalid.")
    until true end
    return value
 end
 ---- response mode;
 o = s:taboption("advanced", ListValue, "response_mode", translate("Response Mode"), 
    translate("Smartdns response mode, First Ping: return the first ping IP, Fastest IP: return the fastest IP, Fastest Response: return the fastest DNS response."))
 o.rmempty     = true
 o.placeholder = "default"
 o:value("", translate("default"))
 o:value("first-ping", translate("First Ping"))
 o:value("fastest-ip", translate("Fastest IP"))
 o:value("fastest-response", translate("Fastest Response"))
 ---- Enable TCP server
-o = s:taboption("settings", Flag, "tcp_server", translate("TCP Server"), translate("Enable TCP DNS Server"))
+o = s:taboption("advanced", Flag, "tcp_server", translate("TCP Server"), translate("Enable TCP DNS Server"))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
@@ -60,23 +130,37 @@ o.cfgvalue    = function(...)
 end
 ---- Support IPV6
-o = s:taboption("settings", Flag, "ipv6_server", translate("IPV6 Server"), translate("Enable IPV6 DNS Server"))
+o = s:taboption("advanced", Flag, "ipv6_server", translate("IPV6 Server"), translate("Enable IPV6 DNS Server"))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end
---- Support DualStack ip selection
+---- bind to device;
-o = s:taboption("settings", Flag, "dualstack_ip_selection", translate("Dual-stack IP Selection"), translate("Enable IP selection between IPV4 and IPV6"))
+o = s:taboption("advanced", Flag, "bind_device", translate("Bind Device"), translate("Listen only on the specified interfaces."))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end
 ---- bind device name;
 o = s:taboption("advanced", Value, "bind_device_name", translate("Bind Device Name"), translate("Name of device name listen on."))
 o.placeholder = "default"
 o.rempty      = true
 o.datatype    = "string"
 ---- Support DualStack ip selection
 o = s:taboption("advanced", Flag, "dualstack_ip_selection", translate("Dual-stack IP Selection"), translate("Enable IP selection between IPV4 and IPV6"))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 ---- Domain prefetch load 
-o = s:taboption("settings", Flag, "prefetch_domain", translate("Domain prefetch"), translate("Enable domain prefetch, accelerate domain response speed."))
+o = s:taboption("advanced", Flag, "prefetch_domain", translate("Domain prefetch"), translate("Enable domain prefetch, accelerate domain response speed."))
 o.rmempty     = false
 o.default     = o.disabled
 o.cfgvalue    = function(...)
@@ -84,43 +168,106 @@ o.cfgvalue    = function(...)
 end
 ---- Domain Serve expired
-o = s:taboption("settings", Flag, "serve_expired", translate("Serve expired"), 
+o = s:taboption("advanced", Flag, "serve_expired", translate("Serve expired"), 
 	translate("Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 ---- Redirect
 o = s:taboption("settings", ListValue, "redirect", translate("Redirect"), translate("SmartDNS redirect mode"))
 o.placeholder = "none"
 o:value("none", translate("none"))
 o:value("dnsmasq-upstream", translate("Run as dnsmasq upstream server"))
 o:value("redirect", translate("Redirect 53 port to SmartDNS"))
 o.default     = "none"
 o.rempty      = false
 ---- cache-size
-o = s:taboption("settings", Value, "cache_size", translate("Cache Size"), translate("DNS domain result cache size"))
+o = s:taboption("advanced", Value, "cache_size", translate("Cache Size"), translate("DNS domain result cache size"))
 o.rempty      = true
 ---- cache-persist;
 o = s:taboption("advanced", Flag, "cache_persist", translate("Cache Persist"), translate("Write cache to disk on exit and load on startup."))
 o.rmempty      = false;
 o.default     = o.enabled;
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end
 -- cache-size
 o = s:taboption("advanced", Flag, "resolve_local_hostnames", translate("Resolve Local Hostnames"), translate("Resolve local hostnames by reading Dnsmasq lease file."))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end
 -- Force AAAA SOA
 o = s:taboption("advanced", Flag, "force_aaaa_soa", translate("Force AAAA SOA"), translate("Force AAAA SOA."))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 -- Force HTTPS SOA
 o = s:taboption("advanced", Flag, "force_https_soa", translate("Force HTTPS SOA"), translate("Force HTTPS SOA."))
 o.rmempty     = false
 o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "1"
 end
 ---- Ipset no speed.
 o = s:taboption("advanced", Value, "ipset_no_speed", translate("No Speed IPset Name"), 
    translate("Ipset name, Add domain result to ipset when speed check fails."));
 o.rmempty = true;
 o.datatype = "hostname";
 o.rempty = true;
 ---- NFTset no speed.
 o = s:taboption("advanced", Value, "nftset_no_speed", translate("No Speed NFTset Name"), 
    translate("Nftset name, Add domain result to nftset when speed check fails, format: [#[4|6]:[family#table#set]]"));
 o.rmempty    = true;
 o.datatype   = "string";
 o.rempty     = true;
 function o.validate(self, value) 
    if (value == "") then
        return value
    end
    if (value:match("#[4|6]:[a-zA-Z0-9%-_]+#[a-zA-Z0-9%-_]+#[a-zA-Z0-9%-_]+$")) then
        return value
    end
    return nil, translate("NFTset name format error, format: [#[4|6]:[family#table#set]]")
 end
 ---- rr-ttl
-o = s:taboption("settings", Value, "rr_ttl", translate("Domain TTL"), translate("TTL for all domain result."))
+o = s:taboption("advanced", Value, "rr_ttl", translate("Domain TTL"), translate("TTL for all domain result."))
 o.rempty      = true
 ---- rr-ttl-min
-o = s:taboption("settings", Value, "rr_ttl_min", translate("Domain TTL Min"), translate("Minimum TTL for all domain result."))
+o = s:taboption("advanced", Value, "rr_ttl_min", translate("Domain TTL Min"), translate("Minimum TTL for all domain result."))
 o.rempty      = true
-o.placeholder = "300"
+o.placeholder = "600"
-o.default     = 300
+o.default     = 600
 o.optional    = true
 ---- second dns server
 ---- rr-ttl-max
-o = s:taboption("settings", Value, "rr_ttl_max", translate("Domain TTL Max"), translate("Maximum TTL for all domain result."))
+o = s:taboption("advanced", Value, "rr_ttl_max", translate("Domain TTL Max"), translate("Maximum TTL for all domain result."))
 o.rempty      = true
 ---- rr-ttl-reply-max
 o = s:taboption("advanced", Value, "rr_ttl_reply_max", translate("Reply Domain TTL Max"), translate("Reply maximum TTL for all domain result."))
 o.rempty      = true
 o = s:taboption("advanced", DynamicList, "conf_files", translate("Include Config Files<br>/etc/smartdns/conf.d"),
    translate("Include other config files from /etc/smartdns/conf.d or custom path, can be downloaded from the download page."));
 uci:foreach("smartdns", "download-file", function(section)
    local filetype = section.type
    if (filetype ~= 'config') then
        return
    end
    o:value(section.name);
 end)
 ---- second dns server
 ---- Eanble
 o = s:taboption("seconddns", Flag, "seconddns_enabled", translate("Enable"), translate("Enable or disable second DNS server."))
 o.default     = o.disabled
@@ -203,13 +350,34 @@ o.cfgvalue    = function(...)
 end
 ---- Force AAAA SOA
-o = s:taboption("seconddns", Flag, "force_aaaa_soa", translate("Force AAAA SOA"), translate("Force AAAA SOA."))
+o = s:taboption("seconddns", Flag, "seconddns_force_aaaa_soa", translate("Force AAAA SOA"), translate("Force AAAA SOA."))
 o.rmempty     = false
 o.default     = o.disabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 ----- Proxy server settings
 o = s:taboption("proxy", Value, "proxy_server", translate("Proxy Server"), translate("Proxy Server URL, format: [socks5|http]://user:pass@ip:port."));
 o.datatype = 'string';
 function o.validate(self, value)
    if (value == "") then
        return true
    end
    if (not value:match("^http://") and not value:match("^socks5://")) then
        return nil, translate("Proxy server URL format error, format: [socks5|http]://user:pass@ip:port.")
    end
    return value
 end
 ----- dns64 server settings
 o = s:taboption("dns64", Value, "dns64", translate("DNS64"));
 o.placeholder = "64:ff9b::/96"
 o.datatype = 'ip6addr'
 o.rmempty = true
 ----- custom settings
 custom = s:taboption("custom", Value, "Custom Settings",
 	translate(""), 
@@ -277,11 +445,135 @@ o:value("https", translate("https"))
 o.default     = "udp"
 o.rempty      = false
-s = m:section(TypedSection, "smartdns", translate("Advanced Settings"), translate("Advanced Settings"));
+---- domain rules;
-s.anonymous = true;
+s = m:section(TypedSection, "domain-rule", translate("Domain Rules"), translate("Domain Rules Settings"))
 s.anonymous = true
 s.nodescriptions = true
-s:tab("domain-address", translate("Domain Address"), translate("Set Specific domain ip address."));
+s:tab("forwarding", translate('DNS Forwarding Setting'))
-s:tab("blackip-list", translate("IP Blacklist"), translate("Set Specific ip blacklist."));
+s:tab("block", translate("DNS Block Setting"))
 s:tab("domain-address", translate("Domain Address"), translate("Set Specific domain ip address."))
 s:tab("blackip-list", translate("IP Blacklist"), translate("Set Specific ip blacklist."))
 ---- domain forwarding;
 o = s:taboption("forwarding", Value, "server_group", translate("Server Group"), translate("DNS Server group belongs to, such as office, home."))
 o.rmempty = true
 o.placeholder = "default"
 o.datatype = "hostname"
 o.rempty = true
 uci:foreach("smartdns", "server", function(section)
    local server_group = section.server_group
    if server_group == nil then
        return
    end
    o:value(server_group);
 end)
 function o.validate (section_id, value) 
    if value == "" then
        return value
    end
    if value == nil then
        return nil, translate('Server Group not exists')
    end
    local exists = false
    uci:foreach("smartdns", "server", function(section)
        local server_group = section.server_group
        if (exists == true) then
            return
        end
        if (value == server_group) then
            exists = true
        end
    end)
    if exists == false then
        return nil, translate('Server Group not exists')
    end
    return value;
 end
 o = s:taboption("forwarding", Flag, "no_speed_check", translate("Skip Speed Check"),
    translate("Do not check speed."))
 o.rmempty = false
 o.default = o.disabled
 o = s:taboption("forwarding", Flag, "force_aaaa_soa", translate("Force AAAA SOA"), translate("Force AAAA SOA."))
 o.rmempty = false
 o.default = o.disabled
 o = s:taboption("forwarding", Value, "ipset_name", translate("IPset Name"), translate("IPset name."))
 o.rmempty = true
 o.datatype = "hostname"
 o.rempty = true
 o = s:taboption("forwarding", Value, "nftset_name", translate("NFTset Name"), translate("NFTset name, format: [#[4|6]:[family#table#set]]"))
 o.rmempty = true
 o.datatype = "string"
 o.rempty = true
 function o.validate(self, value) 
    if (value == "") then
        return value
    end
    if (value:match("#[4|6]:[a-zA-Z0-9%-_]+#[a-zA-Z0-9%-_]+#[a-zA-Z0-9%-_]+$")) then
        return value
    end
    return nil, translate("NFTset name format error, format: [#[4|6]:[family#table#set]]")
 end
 ---- other args
 o = s:taboption("forwarding", Value, "addition_flag", translate("Additional Rule Flag"), translate("Additional Flags for rules, read help on domain-rule for more information."))
 o.default = ""
 o.rempty = true
 o.modalonly = true;
 o = s:taboption("forwarding", FileUpload, "forwarding_domain_set_file", translate("Domain List File"),
    translate("Upload domain list file, or configure auto download from Download File Setting page."))
 o.rmempty = true
 o.datatype = "file"
 o.rempty = true
 o.editable = true
 o.root_directory = "/etc/smartdns/domain-set"
 o = s:taboption("forwarding", TextValue, "domain_forwarding_list",
    translate("Domain List"), translate("Configure forwarding domain name list."))
 o.rows = 10
 o.cols = 64
 o.monospace = true
 function o.cfgvalue(self, section)
 	return nixio.fs.readfile("/etc/smartdns/domain-forwarding.list")
 end
 function o.write(self, section, value)
 	value = value:gsub("\r\n?", "\n")
 	nixio.fs.writefile("/etc/smartdns/domain-forwarding.list", value)
 end
 ---- domain block;
 o = s:taboption("block", FileUpload, "block_domain_set_file", translate("Domain List File"), translate("Upload domain list file."))
 o.rmempty = true
 o.datatype = "file"
 o.rempty = true
 o.editable = true
 o.root_directory = "/etc/smartdns/domain-set"
 o = s:taboption("block", TextValue, "domain_block_list",
    translate("Domain List"), translate("Configure block domain list."))
 o.rows = 10
 o.cols = 64
 function o.cfgvalue(self, section)
 	return nixio.fs.readfile("/etc/smartdns/domain-block.list")
 end
 function o.write(self, section, value)
 	value = value:gsub("\r\n?", "\n")
 	nixio.fs.writefile("/etc/smartdns/domain-block.list", value)
 end
 -- Doman addresss
 addr = s:taboption("domain-address", Value, "address",
@@ -317,6 +609,81 @@ function addr.write(self, section, value)
 	nixio.fs.writefile("/etc/smartdns/blacklist-ip.conf", value)
 end
 s = m:section(TypedSection, "smartdns", translate("Download Files Setting"), translate("Download domain list files for domain-rule and include config files, please refresh the page after download to take effect."))
 s.anonymous = true
 ---- download Files Settings
 o = s:option(Flag, "enable_auto_update", translate("Enable Auto Update"), translate("Enable daily auto update."))
 o.rmempty = false
 o.default = o.disabled
 o.rempty = true
 o = s:option(FileUpload, "upload_conf_file", translate("Upload Config File"),
    translate("Upload smartdns config file to /etc/smartdns/conf.d"))
 o.rmempty = true
 o.datatype = "file"
 o.rempty = true
 o.editable = true
 o.root_directory = "/etc/smartdns/conf.d"
 o = s:option(FileUpload, "upload_list_file", translate("Upload Domain List File"),
    translate("Upload domain list file to /etc/smartdns/domain-set"))
 o.rmempty = true
 o.datatype = "file"
 o.rempty = true
 o.editable = true
 o.root_directory = "/etc/smartdns/domain-set"
 o = s:option(Button, "_updateate")
 o.title = translate("Update Files")
 o.inputtitle = translate("update domain list files")
 o.inputstyle = "apply"
 o.write = function()
 	luci.sys.call("/etc/init.d/smartdns updatefiles >/dev/null 2>&1")
 end
 s = m:section(TypedSection, "download-file", translate("Download Files"), translate("List of files to download."))
 s.anonymous = true
 s.addremove = true
 s.template = "cbi/tblsection"
 o = s:option(Value, 'name', translate('File Name'), translate('File Name'))
 o.rmempty = false
 o.datatype = 'string'
 o = s:option(Value, 'url', translate('URL'), translate('URL'))
 o.rmempty = false
 o.datatype = 'string'
 function o.validate(self, value, section)
    if value == "" then
        return nil, translate("URL format error, format: http:// or https://")
    end
    if value == nil then
        return nil, translate("URL format error, format: http:// or https://")
    end
    if value.find(value, "http://") then
        return value
    end
    if value.find(value, "https://") then
        return value
    end
    return nil, translate("URL format error, format: http:// or https://")
 end
 o = s:option(ListValue, "type", translate("type"), translate("File Type"))
 o:value("list", translate("domain list (/etc/smartdns/domain-set)"))
 o:value("config", translate("smartdns config (/etc/smartdns/conf.d)"))
 o.default = "list"
 o.rempty = false
 o = s:option(Value, 'desc', translate('Description'), translate('Description'))
 o.rmempty = true
 o.datatype = 'string'
 -- Technical Support
 s = m:section(TypedSection, "smartdns", translate("Technical Support"), 
 	translate("If you like this software, please buy me a cup of coffee."))
@@ -330,6 +697,14 @@ o.write = function()
 	luci.http.redirect("https://pymumu.github.io/smartdns")
 end
 o = s:option(Button, "report")
 o.title = translate("Report bugs")
 o.inputtitle = translate("Report bugs")
 o.inputstyle = "apply"
 o.write = function()
 	luci.http.redirect("https://github.com/pymumu/smartdns/issues")
 end
 o = s:option(Button, "Donate")
 o.title = translate("Donate to smartdns")
 o.inputtitle = translate("Donate")
@@ -338,5 +713,13 @@ o.write = function()
 	luci.http.redirect("https://pymumu.github.io/smartdns/#donate")
 end
 o = s:option(Button, "Restart")
 o.title = translate("Restart smartdns")
 o.inputtitle = translate("Restart")
 o.inputstyle = "apply"
 o.write = function()
 	luci.sys.call("/etc/init.d/smartdns restart >/dev/null 2>&1")
 end
 return m
--- a/package/luci-compat/files/luci/model/cbi/smartdns/upstream.lua
+++ b/package/luci-compat/files/luci/model/cbi/smartdns/upstream.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -62,6 +62,13 @@ o.placeholder = "default"
 o.datatype    = "hostname"
 o.rempty      = true
 ---- exclude default group
 o = s:option(Flag, "exclude_default_group", translate("Exclude Default Group"), translate("Exclude DNS Server from default group."))
 o.rmempty = false
 o.default = o.disabled
 o.editable = true
 o.modalonly = true
 ---- blacklist_ip
 o = s:option(Flag, "blacklist_ip", translate("IP Blacklist Filtering"), translate("Filtering IP with blacklist"))
 o.rmempty     = false
@@ -120,6 +127,29 @@ o.rempty      = true
 o:depends("type", "tls")
 o:depends("type", "https")
 ---- mark
 o = s:option(Value, "set_mark", translate("Marking Packets"), translate("Set mark on packets."))
 o.default     = ""
 o.rempty      = true
 o.datatype    = "uinteger"
 ---- use proxy
 o = s:option(Flag, "use_proxy", translate("Use Proxy"), translate("Use proxy to connect to upstream DNS server."))
 o.rmempty     = true
 o.default     = o.disabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
 function o.validate(self, value, section)
    if value == "1" then
        local proxy = m.uci:get_first("smartdns", "smartdns", "proxy_server")
        if proxy == nil or proxy == "" then
            return nil, translate("Please set proxy server first.")
        end
    end
    return value
 end
 ---- other args
 o = s:option(Value, "addition_arg", translate("Additional Server Args"), translate("Additional Args for upstream dns servers"))
 o.default     = ""
--- a/package/luci-compat/files/luci/model/smartdns.lua
+++ b/package/luci-compat/files/luci/model/smartdns.lua
@@ -1,5 +1,5 @@
 --
-- Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+-- Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 --
 -- smartdns is free software: you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
--- a/package/luci-compat/files/luci/view/smartdns/smartdns_status.htm
+++ b/package/luci-compat/files/luci/view/smartdns/smartdns_status.htm
@@ -6,22 +6,8 @@ XHR.poll(3, '<%=luci.dispatcher.build_url("admin", "services", "smartdns", "stat
 			var links = "";
 			if (data.running) {
 				links = '<b><font color=green>SmartDNS - <%:RUNNING%></font></b></em>';
-				if (data.redirect) {
+				if (data.dnsmasq_redirect_failure == 1) {
-					if (data.redirect == 1) {
+					links += "<br></br><b><font color=red><%:Dnsmasq Forwarded To Smartdns Failure%></font></b>"
 						if (data.ipv4_works == 0) {
 							links += "<br></br><b><font color=red><%:IPV4 53 Port Redirect Failure%></font></b>"
 						}
 						if (data.ipv6_works != 2) {
 							if (data.ipv6_works == 0) {
 								links += "<br></br><b><font color=red><%:IPV6 53 Port Redirect Failure%></font></b>"
 							}
 						}
 					} else if (data.redirect == 2) {
 						if (data.dnsmasq_forward == 0) {
 							links += "<br></br><b><font color=red><%:Dnsmasq Forwared To Smartdns Failure%></font></b>"
 						}
 					}
 				}
 			} else {
 				links = '<b><font color=red>SmartDNS - <%:NOT RUNNING%></font></b>';
--- a/package/luci-compat/files/usr/share/rpcd/acl.d/luci-app-smartdns.json
+++ b/package/luci-compat/files/usr/share/rpcd/acl.d/luci-app-smartdns.json
@@ -0,0 +1,22 @@
 {
 	"luci-app-smartdns": {
 		"description": "Grant access to LuCI app smartdns",
 		"read": {
 			"file": {
 				"/etc/smartdns/*": [ "read" ]
 			},
 			"ubus": {
 				"service": [ "list" ]
 			},
 			"uci": [ "smartdns" ]
 		},
 		"write": {
 			"file": {
 				"/etc/smartdns/*": [ "write" ],
 				"/etc/init.d/smartdns restart": [ "exec" ],
 				"/etc/init.d/smartdns updatefiles": [ "exec" ]
 			},
 			"uci": [ "smartdns" ]
 		}
 	}
 }
--- a/package/luci-compat/make.sh
+++ b/package/luci-compat/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -54,6 +54,7 @@ build()
 	build_tool
 	mkdir $ROOT/root/usr/lib/lua/ -p
 	cp $ROOT/files/luci $ROOT/root/usr/lib/lua/ -af
 	cp $ROOT/files/usr $ROOT/root/ -af
 	#Generate Language
 	$PO2LMO $ROOT/files/luci/i18n/smartdns.zh-cn.po $ROOT/root/usr/lib/lua/luci/i18n/smartdns.zh-cn.lmo
--- a/package/luci/control/postinst
+++ b/package/luci/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci/control/prerm
+++ b/package/luci/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/luci/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci/files/luci/i18n/smartdns.zh-cn.po
@@ -1,191 +1,217 @@
 msgid ""
 msgstr "Content-Type: text/plain; charset=UTF-8\n"
-msgid "SmartDNS"
+msgid "Additional Args for upstream dns servers"
-msgstr "SmartDNS"
+msgstr "额外的上游 DNS 服务器参数"
-msgid "SmartDNS is a local high-performance DNS server"
+msgid "Additional Rule Flag"
-msgstr "SmartDNS是一个本地高性能DNS服务器"
+msgstr "额外规则标识"
-msgid "SmartDNS Server"
+msgid "Additional Flags for rules, read help on domain-rule for more information."
-msgstr "SmartDNS 服务器"
+msgstr "额外的规则标识，具体参考domain-rule的帮助说明。"
-msgid "SmartDNS is a local high-performance DNS server, supports finding fastest IP, supports ad filtering, and supports avoiding DNS poisoning."
+msgid "Additional Server Args"
-msgstr "SmartDNS是一个本地高性能DNS服务器，支持返回最快IP，支持广告过滤。"
+msgstr "额外的服务器参数"
 msgid "Custom Settings"
 msgstr "自定义设置"
 msgid "General Settings"
 msgstr "基本设置"
 msgid "Settings"
 msgstr "设置"
 msgid "Advanced Settings"
 msgstr "高级设置"
-msgid "RUNNING"
+msgid ""
-msgstr "运行中"
+"Attempts to serve old responses from cache with a TTL of 0 in the response "
-
+"without waiting for the actual resolution to finish."
 msgid "NOT RUNNING"
 msgstr "未运行"
 msgid "Generate Coredump"
 msgstr "生成coredump"
 msgid "Generate Coredump file when smartdns crash, coredump file is located at /tmp/smartdns.xxx.core."
 msgstr "当smartdns异常时生成coredump文件，coredump文件在/tmp/smartdns.xxx.core."
 msgid "Server Name"
 msgstr "服务器名称"
 msgid "Smartdns server name"
 msgstr "SmartDNS的服务器名称，默认为smartdns，留空为主机名"
 msgid "SmartDNS is a local dns server to find fastest ip."
 msgstr "本地高性能服务器，优化网络访问性能。"
 msgid "Enable or disable smartdns server"
 msgstr "启用或禁用SmartDNS服务"
 msgid "Local Port"
 msgstr "本地端口"
 msgid "Smartdns local server port"
 msgstr "SmartDNS本地服务端口"
 msgid "IPV4 53 Port Redirect Failure"
 msgstr "IPV4 53端口重定向失败"
 msgid "IPV6 53 Port Redirect Failure"
 msgstr "IPV6 53端口重定向失败"
 msgid "Dnsmasq Forwared To Smartdns Failure"
 msgstr "重定向dnsmasq到smartdns失败"
 msgid "TCP Server"
 msgstr "TCP服务器"
 msgid "Enable TCP DNS Server"
 msgstr "启用TCP服务器"
 msgid "IPV6 Server"
 msgstr "IPV6服务器"
 msgid "Enable IPV6 DNS Server"
 msgstr "启用IPV6服务器"
 msgid "Dual-stack IP Selection"
 msgstr "双栈IP优选"
 msgid "Enable IP selection between IPV4 and IPV6"
 msgstr "启用或禁用IPV4，IPV6间的IP优选策略。"
 msgid "Domain prefetch"
 msgstr "域名预加载"
 msgid "Enable domain prefetch, accelerate domain response speed."
 msgstr "启用域名预加载，加速域名响应速度。"
 msgid "Serve expired"
 msgstr "缓存过期服务"
 msgid "Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."
 msgstr "查询性能优化，有请求时尝试回应TTL为0的过期记录，以避免查询等待。"
-msgid "Redirect"
+msgid "Automatically Set Dnsmasq"
-msgstr "重定向"
+msgstr "自动设置Dnsmasq"
-msgid "SmartDNS redirect mode"
+msgid "Automatically set as upstream of dnsmasq when port changes."
-msgstr "SmartDNS 重定向模式"
+msgstr "端口更改时自动设为 dnsmasq 的上游。"
-msgid "Run as dnsmasq upstream server"
+msgid "Bind Device"
-msgstr "作为dnsmasq的上游服务器"
+msgstr "绑定到设备"
-msgid "Redirect 53 port to SmartDNS"
+msgid "Bind Device Name"
-msgstr "重定向53端口到SmartDNS"
+msgstr "绑定的设备名称"
 msgid "Block domain"
 msgstr "屏蔽域名"
 msgid "Block domain."
 msgstr "屏蔽域名。"
 msgid "Cache Persist"
 msgstr "持久化缓存"
 msgid "Cache Size"
 msgstr "缓存大小"
 msgid "Collecting data ..."
 msgstr "正在收集数据..."
 msgid ""
 "Configure IP blacklists that will be filtered from the results of specific "
 "DNS server."
 msgstr "配置需要从指定域名服务器结果过滤的IP黑名单。"
 msgid "Configure block domain list."
 msgstr "配置屏蔽域名列表"
 msgid "Configure domain rule list."
 msgstr "配置域名规则列表"
 msgid "Configure forwarding domain name list."
 msgstr "配置分流域名列表"
 msgid "Custom Settings"
 msgstr "自定义设置"
 msgid "DNS Block Setting"
 msgstr "域名屏蔽设置"
 msgid "DNS Forwarding Setting"
 msgstr "域名分流设置"
 msgid "DNS Server Name"
 msgstr "DNS服务器名称"
 msgid "DNS Server group"
 msgstr "服务器组"
 msgid "DNS Server group belongs to, such as office, home."
 msgstr "设置服务器组，例如office，home"
 msgid "DNS Server ip"
 msgstr "DNS服务器IP"
 msgid "DNS Server port"
 msgstr "DNS服务器端口"
 msgid "DNS Server type"
 msgstr "协议类型"
 msgid "DNS domain result cache size"
-msgstr "缓存DNS的结果，缓存大小，配置零则不缓存（单位：条）"
+msgstr "缓存DNS的结果，缓存大小，配置零则不缓存"
-msgid "Domain TTL"
+msgid "DNS64 Server Settings"
-msgstr "域名TTL"
+msgstr "DNS64服务器配置"
-msgid "TTL for all domain result."
+msgid "default"
-msgstr "设置所有域名的TTL值（单位：秒，下同）"
+msgstr "默认"
-msgid "Domain TTL Min"
+msgid "Description"
-msgstr "域名TTL最小值"
+msgstr "描述"
-msgid "Minimum TTL for all domain result."
+msgid "Dnsmasq Forwarded To Smartdns Failure"
-msgstr "设置所有域名的TTL最小值"
+msgstr "重定向dnsmasq到smartdns失败"
-msgid "Domain TTL Max"
+msgid "Do not check certificate."
-msgstr "域名TTL最大值"
+msgstr "不校验证书的合法性。"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 msgid "Second Server Settings"
 msgstr "第二DNS服务器"
 msgid "Enable or disable second DNS server."
 msgstr "是否启用第二DNS服务器。"
 msgid "Skip Speed Check"
 msgstr "跳过测速"
 msgid "Do not check speed."
 msgstr "禁用测速。"
-msgid "Server Group"
+msgid "Domain Address"
-msgstr "服务器组"
+msgstr "域名地址"
-msgid "Query DNS through specific dns server group, such as office, home."
+msgid "Domain List"
-msgstr "使用指定服务器组查询，比如office, home。"
+msgstr "域名列表"
-msgid "Skip Address Rules"
+msgid "Domain List File"
-msgstr "跳过address规则"
+msgstr "域名列表文件"
-msgid "Skip address rules."
+msgid "Domain Rule List"
-msgstr "跳过address规则。"
+msgstr "域名规则列表"
-msgid "Skip Nameserver Rule"
+msgid "Domain Rule Name"
-msgstr "跳过Nameserver规则"
+msgstr "域名规则名称"
-msgid "Skip nameserver rules."
+msgid "Domain Rules"
-msgstr "跳过Nameserver规则。"
+msgstr "域名规则"
-msgid "Skip Ipset Rule"
+msgid "Domain Rules Settings"
-msgstr "跳过ipset规则"
+msgstr "域名规则设置"
-msgid "Skip ipset rules."
+msgid "Domain TTL"
-msgstr "跳过ipset规则。"
+msgstr "域名TTL"
-msgid "Skip SOA Address Rule"
+msgid "Domain TTL Max"
-msgstr "跳过address SOA(#)规则"
+msgstr "域名TTL最大值"
-msgid "Skip SOA address rules."
+msgid "Domain TTL Min"
-msgstr "跳过address SOA(#)规则。"
+msgstr "域名TTL最小值"
-msgid "Skip Dualstack Selection"
+msgid "Domain prefetch"
-msgstr "跳过双栈优选"
+msgstr "域名预加载"
-msgid "Skip Dualstack Selection."
+msgid "Donate"
-msgstr "跳过双栈优选。"
+msgstr "捐助"
-msgid "Skip Cache"
+msgid "Donate to smartdns"
-msgstr "跳过cache"
+msgstr "捐助smartdns项目"
-msgid "Skip Cache."
+msgid "Download Files"
-msgstr "跳过cache。"
+msgstr "下载文件"
 msgid "Download Files Setting"
 msgstr "下载文件设置"
 msgid ""
 "Download domain list files for domain-rule and include config files, please "
 "refresh the page after download to take effect."
 msgstr ""
 "下载域名规则所需要的域名列表文件和smartdns配置文件，下载完成后刷新页面。"
 msgid "Dual-stack IP Selection"
 msgstr "双栈IP优选"
 msgid "Enable"
 msgstr "启用"
 msgid "Enable Auto Update"
 msgstr "启用自动更新"
 msgid "Enable IP selection between IPV4 and IPV6"
 msgstr "启用 IPV4 和 IPV6 间的 IP 优选策略"
 msgid "Enable IPV6 DNS Server"
 msgstr "启用IPV6服务器"
 msgid "Enable TCP DNS Server"
 msgstr "启用TCP服务器"
 msgid "Enable daily auto update."
 msgstr "启用每日自动更新"
 msgid "Enable domain prefetch, accelerate domain response speed."
 msgstr "启用域名预加载，加速域名响应速度。"
 msgid "Enable or disable second DNS server."
 msgstr "是否启用第二DNS服务器。"
 msgid "Enable or disable smartdns server"
 msgstr "启用或禁用SmartDNS服务"
 msgid "Exclude DNS Server from default group."
 msgstr "从default默认服务器组中排除"
 msgid "Exclude Default Group"
 msgstr "从默认组中排除"
 msgid "File Name"
 msgstr "文件名"
 msgid "File Type"
 msgstr "文件类型"
 msgid "Filtering IP with blacklist"
 msgstr "使用IP黑名单过滤"
 msgid "First Ping"
 msgstr "最快PING"
 msgid "Fastest IP"
 msgstr "最快IP"
 msgid "Fastest Response"
 msgstr "最快响应"
 msgid "Force AAAA SOA"
 msgstr "停用IPV6地址解析"
@@ -193,119 +219,400 @@ msgstr "停用IPV6地址解析"
 msgid "Force AAAA SOA."
 msgstr "停用IPV6地址解析。"
-msgid "Upstream Servers"
+msgid "Force HTTPS SOA"
-msgstr "上游服务器"
+msgstr "停用HTTPS地址解析"
-msgid "Upstream Servers, support UDP, TCP protocol. Please configure multiple DNS servers, including multiple foreign DNS servers."
+msgid "Force HTTPS SOA."
-msgstr "上游DNS服务器列表，支持UDP，TCP协议，请配置多个上游DNS服务器，包括多个国内外服务器"
+msgstr "停用HTTPS地址解析。"
-msgid "DNS Server Name"
+msgid "General Settings"
-msgstr "DNS服务器名称"
+msgstr "常规设置"
-msgid "port"
+msgid "Generate Coredump"
-msgstr "端口"
+msgstr "生成coredump"
-msgid "DNS Server port"
+msgid ""
-msgstr "DNS服务器端口"
+"Generate Coredump file when smartdns crash, coredump file is located at /tmp/"
 "smartdns.xxx.core."
 msgstr ""
 "当smartdns异常时生成coredump文件，coredump文件在/tmp/smartdns.xxx.core."
-msgid "DNS Server ip"
+msgid "Grant access to LuCI app smartdns"
-msgstr "DNS服务器IP"
+msgstr "授予访问 LuCI 应用 smartdns 的权限"
 msgid "type"
 msgstr "类型"
 msgid "DNS Server type"
 msgstr "协议类型"
 msgid "Domain Address"
 msgstr "域名地址"
 msgid "TLS Hostname Verify"
 msgstr "校验TLS主机名"
 msgid "Set TLS hostname to verify."
 msgstr "设置校验TLS主机名。"
 msgid "No check certificate"
 msgstr "停用证书校验"
 msgid "Do not check certificate."
 msgstr "不校验证书的合法性。"
 msgid "TLS SNI name"
 msgstr "TLS SNI名称"
 msgid "HTTP Host"
 msgstr "HTTP主机"
-msgid "Sets the server name indication for query."
+msgid "IP Blacklist"
-msgstr "设置查询时使用的服务器SNI名称。"
+msgstr "IP黑名单"
 msgid "Set the HTTP host used for the query. Use this parameter when the host of the URL address is an IP address."
 msgstr "设置查询时使用的HTTP主机，当URL地址的host是IP地址时，使用此参数。"
 msgid "Server Group"
 msgstr "服务器组"
 msgid "DNS Server group belongs to, used with nameserver, such as office, home."
 msgstr "DNS服务器所属组， 配合nameserver使用，例如：office，home。"
 msgid "IP Blacklist Filtering"
 msgstr "IP黑名单过滤"
-msgid "Anti Answer Forgery"
+msgid "IPV6 Server"
-msgstr "反回答伪造"
+msgstr "IPV6服务器"
-msgid "Anti answer forgery, if DNS does not work properly after enabling, please turn off this feature"
+msgid "IPset Name"
-msgstr "反回答伪造，如果启用后DNS工作不正常，请关闭此功能。"
+msgstr "IPset名称"
-msgid "Filtering IP with blacklist"
+msgid "IPset name."
-msgstr "使用IP黑名单过滤"
+msgstr "IPSet名称。"
-msgid "TLS SPKI Pinning"
+msgid "Ipset name, Add domain result to ipset when speed check fails."
-msgstr "TLS SPKI 指纹"
+msgstr "IPset名称，当测速失败时，将查询到的结果添加到对应的IPSet集合中。"
-msgid "Used to verify the validity of the TLS server, The value is Base64 encoded SPKI fingerprint, leaving blank to indicate that the validity of TLS is not verified."
+msgid "ipset name format error, format: [#[4|6]:]ipsetname"
-msgstr "用于校验TLS服务器的有效性，数值为Base64编码的SPKI指纹, 留空表示不验证TLS的合法性"
+msgstr "IPset名称格式错误，格式：[#[4|6]:]ipsetname"
 msgid "Additional Server Args"
 msgstr "额外的服务器参数"
 msgid "Additional Args for upstream dns servers"
 msgstr "额外的上游DNS服务器参数"
 msgid "Upstream DNS Server Configuration"
 msgstr "上游DNS服务器配置"
 msgid "Set Specific domain ip address."
 msgstr "指定特定域名的IP地址"
 msgid "Specify an IP address to return for any host in the given domains, Queries in the domains are never forwarded and always replied to with the specified IP address which may be IPv4 or IPv6."
 msgstr "配置特定域名返回特定的IP地址，域名查询将不到上游服务器请求，直接返回配置的IP地址，可用于广告屏蔽。"
 msgid "IP Blacklist"
 msgstr "IP黑名单"
 msgid "Set Specific ip blacklist."
 msgstr "设置IP黑名单列表"
 msgid "Configure IP blacklists that will be filtered from the results of specific DNS server."
 msgstr "配置需要从指定域名服务器结果过滤的IP黑名单。"
 msgid "Technical Support"
 msgstr "技术支持"
 msgid "If you like this software, please buy me a cup of coffee."
 msgstr "如果本软件对你有帮助，请给作者加个蛋。"
 msgid "Include Config Files<br>/etc/smartdns/conf.d"
 msgstr "包含配置文件<br>/etc/smartdns/conf.d"
 msgid ""
 "Include other config files from /etc/smartdns/conf.d or custom path, can be "
 "downloaded from the download page."
 msgstr ""
 "包含配置文件，路径为/etc/smartdns/conf.d，或自定义配置文件路径，可以从下载页配置自动下载。"
 "面配置自动下载。"
 msgid "List of files to download."
 msgstr "下载文件列表"
 msgid "Listen only on the specified interfaces."
 msgstr "监听在指定的设备上，避免非本地网络的DNS查询请求。"
 msgid "Local Port"
 msgstr "本地端口"
 msgid "Marking Packets"
 msgstr "数据包标记"
 msgid "Set mark on packets."
 msgstr "设置数据包标记。"
 msgid "Maximum TTL for all domain result."
 msgstr "所有域名的最大 TTL 值。"
 msgid "Minimum TTL for all domain result."
 msgstr "所有域名的最小 TTL 值。"
 msgid "Name of device name listen on."
 msgstr "绑定的设备名称。"
 msgid "NFTset Name"
 msgstr "NFTSet名称"
 msgid "NFTset name format error, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTSet名称格式错误，格式：[#[4|6]:[family#table#set]]"
 msgid "NFTset name, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTSet名称，格式：[#[4|6]:[family#table#set]]"
 msgid "Nftset name, Add domain result to nftset when speed check fails, format: [#[4|6]:[family#table#set]]"
 msgstr "NFTset名称，当测速失败时，将查询到的结果添加到对应的NFTSet集合中。"
 msgid "No Speed IPset Name"
 msgstr "无速度时IPSet名称"
 msgid "No Speed NFTset Name"
 msgstr "无速度时NFTSet名称"
 msgid "NOT RUNNING"
 msgstr "未运行"
 msgid "No"
 msgstr "否"
 msgid "No check certificate"
 msgstr "停用证书校验"
 msgid "None"
 msgstr "无"
 msgid "Only socks5 proxy support udp server."
 msgstr "仅SOCKS5代理支持UDP服务器。"
 msgid "Please set proxy server first."
 msgstr "请先设置代理服务器。"
 msgid "Proxy Server"
 msgstr "代理服务器"
 msgid "Proxy Server URL, format: [socks5|http]://user:pass@ip:port."
 msgstr "代理服务器地址，格式：[socks5|http]://user:pass@ip:port。"
 msgid "Proxy server URL format error, format: [socks5|http]://user:pass@ip:port."
 msgstr "代理服务器地址格式错误，格式：[socks5|http]://user:pass@ip:port。"
 msgid "Proxy Server Settings"
 msgstr "代理服务器设置"
 msgid "Query DNS through specific dns server group, such as office, home."
 msgstr "使用指定服务器组查询，比如office, home。"
 msgid "RUNNING"
 msgstr "运行中"
 msgid "Reply Domain TTL Max"
 msgstr "回应的域名TTL最大值"
 msgid "Reply maximum TTL for all domain result."
 msgstr "设置返回给客户端的域名TTL最大值。"
 msgid "Report bugs"
 msgstr "报告BUG"
 msgid "Resolve Local Hostnames"
 msgstr "解析本地主机名"
 msgid "Resolve local hostnames by reading Dnsmasq lease file."
 msgstr "读取Dnsmasq的租约文件解析本地主机名。"
 msgid "Response Mode"
 msgstr "响应模式"
 msgid "Restart"
 msgstr "重启"
 msgid "Restart Service"
 msgstr "重启服务"
 msgid "Second Server Settings"
 msgstr "第二DNS服务器"
 msgid "Serve expired"
 msgstr "缓存过期服务"
 msgid "Server Group"
 msgstr "服务器组"
 msgid "Server Group %s not exists"
 msgstr "服务器组%s不存在"
 msgid "Server Name"
 msgstr "服务器名称"
 msgid "Set Specific domain ip address."
 msgstr "设置指定域名的IP地址。"
 msgid "Set Specific domain rule list."
 msgstr "设置指定域名的规则列表。"
 msgid "Set Specific ip blacklist."
 msgstr "设置指定的 IP 黑名单列表。"
 msgid "Set TLS hostname to verify."
 msgstr "设置校验TLS主机名。"
 msgid ""
 "Set the HTTP host used for the query. Use this parameter when the host of "
 "the URL address is an IP address."
 msgstr "设置查询时使用的HTTP主机，当URL地址的host是IP地址时，使用此参数。"
 msgid "Sets the server name indication for query. '-' for disable SNI name."
 msgstr "设置服务器SNI名称，‘-’表示禁用SNI名称。"
 msgid "Settings"
 msgstr "设置"
 msgid "Skip Address Rules"
 msgstr "跳过address规则"
 msgid "Skip Cache"
 msgstr "跳过cache"
 msgid "Skip Cache."
 msgstr "跳过cache。"
 msgid "Skip Dualstack Selection"
 msgstr "跳过双栈优选"
 msgid "Skip Dualstack Selection."
 msgstr "跳过双栈优选。"
 msgid "Skip Ipset Rule"
 msgstr "跳过ipset规则"
 msgid "Skip Nameserver Rule"
 msgstr "跳过Nameserver规则"
 msgid "Skip SOA Address Rule"
 msgstr "跳过address SOA(#)规则"
 msgid "Skip SOA address rules."
 msgstr "跳过address SOA(#)规则。"
 msgid "Skip Speed Check"
 msgstr "跳过测速"
 msgid "Skip address rules."
 msgstr "跳过address规则。"
 msgid "Skip ipset rules."
 msgstr "跳过ipset规则。"
 msgid "Skip nameserver rules."
 msgstr "跳过Nameserver规则。"
 msgid "SmartDNS"
 msgstr "SmartDNS"
 msgid "SmartDNS Server"
 msgstr "SmartDNS 服务器"
 msgid ""
 "SmartDNS is a local high-performance DNS server, supports finding fastest "
 "IP, supports ad filtering, and supports avoiding DNS poisoning."
 msgstr "SmartDNS是一个本地高性能DNS服务器，支持返回最快IP，支持广告过滤。"
 msgid "SmartDNS official website"
 msgstr "SmartDNS官方网站"
 msgid "Smartdns local server port"
 msgstr "SmartDNS本地服务端口"
 msgid ""
 "Smartdns local server port, smartdns will be automatically set as main dns "
 "when the port is 53."
 msgstr ""
 "SmartDNS本地服务端口，当端口号设置为53时，smartdns将会自动配置为主dns。"
 msgid "Smartdns server name"
 msgstr "SmartDNS的服务器名称，默认为smartdns，留空为主机名"
 msgid "Smartdns speed check mode."
 msgstr "SmartDNS测速模式。"
 msgid ""
 "Smartdns response mode, First Ping: return the first ping IP, "
 "Fastest IP: return the fastest IP, Fastest Response: return the fastest "
 "DNS response."
 msgstr ""
 "SmartDNS响应模式，最快PING： 返回最早有ping结果的IP，速度适中；最快IP： "
 "返回最快IP，查询请求可能延长； 最快响应：返回最快响应的结果。查询请求时间短。"
 msgid "Speed Check Mode"
 msgstr "测速模式"
 msgid ""
 "Specify an IP address to return for any host in the given domains, Queries "
 "in the domains are never forwarded and always replied to with the specified "
 "IP address which may be IPv4 or IPv6."
 msgstr ""
 "配置特定域名返回特定的IP地址，域名查询将不到上游服务器请求，直接返回配置的IP"
 "地址，可用于广告屏蔽。"
 msgid "TCP Server"
 msgstr "TCP服务器"
 msgid "TLS Hostname Verify"
 msgstr "校验TLS主机名"
 msgid "TLS SNI name"
 msgstr "TLS SNI名称"
 msgid "TLS SPKI Pinning"
 msgstr "TLS SPKI 指纹"
 msgid "TTL for all domain result."
 msgstr "设置所有域名的 TTL 值。"
 msgid "Technical Support"
 msgstr "技术支持"
 msgid "Use Proxy"
 msgstr "使用代理"
 msgid "Use proxy to connect to upstream DNS server."
 msgstr "使用代理连接上游DNS服务器。"
 msgid "URL"
 msgstr "URL"
 msgid "URL format error, format: http:// or https://"
 msgstr "URL格式错误，格式：http://或https://"
 msgid "Update"
 msgstr "更新"
 msgid "Update Files"
 msgstr "更新文件"
 msgid "Upload Config File"
 msgstr "上传配置文件"
 msgid "Upload Domain List File"
 msgstr "上传域名列表文件"
 msgid "Upload domain list file to /etc/smartdns/domain-set"
 msgstr "上传域名列表文件到/etc/smartdns/domain-set"
 msgid ""
 "Upload domain list file, or configure auto download from Download File "
 "Setting page."
 msgstr "上传域名列表文件，或在下载文件设置页面设置自动下载。"
 msgid "Upload domain list file."
 msgstr "上传域名列表文件"
 msgid "Upload smartdns config file to /etc/smartdns/conf.d"
 msgstr "上传配置文件到/etc/smartdns/conf.d"
 msgid "Upstream Servers"
 msgstr "上游服务器"
 msgid ""
 "Upstream Servers, support UDP, TCP protocol. Please configure multiple DNS "
 "servers, including multiple foreign DNS servers."
 msgstr ""
 "上游 DNS 服务器，支持 UDP，TCP 协议。请配置多个上游 DNS 服务器，包括多个国内"
 "外服务器。"
 msgid ""
 "Used to verify the validity of the TLS server, The value is Base64 encoded "
 "SPKI fingerprint, leaving blank to indicate that the validity of TLS is not "
 "verified."
 msgstr ""
 "用于校验 TLS 服务器的有效性，数值为 Base64 编码的 SPKI 指纹，留空表示不验证 "
 "TLS 的合法性。"
 msgid "Write cache to disk on exit and load on startup."
 msgstr "退出时保存cache到磁盘，启动时加载。"
 msgid "domain list (/etc/smartdns/domain-set)"
 msgstr "域名列表（/etc/smartdns/domain-set）"
 msgid "https"
 msgstr "https"
 msgid "ip"
 msgstr "ip"
 msgid "open website"
 msgstr "打开网站"
-msgid "Donate to smartdns"
+msgid "port"
-msgstr "捐助smartdns项目"
+msgstr "端口"
-msgid "Donate"
+msgid "smartdns config (/etc/smartdns/conf.d)"
-msgstr "捐助"
+msgstr "配置文件（/etc/smartdns/conf.d）"
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 msgid "tcp"
 msgstr "tcp"
 msgid "tls"
 msgstr "tls"
 msgid "type"
 msgstr "类型"
 msgid "udp"
 msgstr "udp"
 msgid "Yes"
 msgstr "是"
--- a/package/luci/files/root/usr/share/rpcd/acl.d/luci-app-smartdns.json
+++ b/package/luci/files/root/usr/share/rpcd/acl.d/luci-app-smartdns.json
@@ -3,10 +3,7 @@
 		"description": "Grant access to LuCI app smartdns",
 		"read": {
 			"file": {
-				"/etc/smartdns/*": [ "read" ],
+				"/etc/smartdns/*": [ "read" ]
 				"/usr/sbin/iptables -t nat -nL PREROUTING": [ "exec" ],
 				"/usr/sbin/ip6tables -t nat -nL PREROUTING": [ "exec" ],
 				"/usr/sbin/smartdns": [ "exec" ]
 			},
 			"ubus": {
 				"service": [ "list" ]
@@ -15,7 +12,9 @@
 		},
 		"write": {
 			"file": {
-				"/etc/smartdns/*": [ "write" ]
+				"/etc/smartdns/*": [ "write" ],
 				"/etc/init.d/smartdns restart": [ "exec" ],
 				"/etc/init.d/smartdns updatefiles": [ "exec" ]
 			},
 			"uci": [ "smartdns" ]
 		}
--- a/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
+++ b/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
--- a/package/luci/make.sh
+++ b/package/luci/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/openwrt/Makefile
+++ b/package/openwrt/Makefile
@@ -47,10 +47,13 @@ define Package/smartdns/conffiles
 /etc/smartdns/address.conf
 /etc/smartdns/blacklist-ip.conf
 /etc/smartdns/custom.conf
 /etc/smartdns/domain-block.list
 /etc/smartdns/domain-forwarding.list
 endef
 define Package/smartdns/install
 	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/config $(1)/etc/init.d $(1)/etc/smartdns
 	$(INSTALL_DIR) $(1)/etc/smartdns/conf.d $(1)/etc/smartdns/domain-set
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/smartdns $(1)/usr/sbin/smartdns
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/package/openwrt/files/etc/init.d/smartdns $(1)/etc/init.d/smartdns
 	$(INSTALL_CONF) $(PKG_BUILD_DIR)/package/openwrt/address.conf $(1)/etc/smartdns/address.conf
--- a/package/openwrt/control/conffiles
+++ b/package/openwrt/control/conffiles
@@ -2,3 +2,5 @@
 /etc/smartdns/address.conf
 /etc/smartdns/blacklist-ip.conf
 /etc/smartdns/custom.conf
 /etc/smartdns/domain-block.list
 /etc/smartdns/domain-forwarding.list
--- a/package/openwrt/control/postinst
+++ b/package/openwrt/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/openwrt/control/prerm
+++ b/package/openwrt/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -17,6 +17,9 @@
 . ${IPKG_INSTROOT}/lib/functions.sh
 default_prerm $0 $@
 /etc/init.d/smartdns disable
 rm /var/etc/smartdns.conf -f
 rm /var/etc/smartdns/smartdns.conf -f
 rm /var/log/smartdns/ -fr
 rm /etc/smartdns/smartdns.cache -f
 exit 0
--- a/package/openwrt/domain-block.list
+++ b/package/openwrt/domain-block.list
@@ -0,0 +1,4 @@
 # domain block list, one domain name per line.
 # example: block a.com, and b.com
 # a.com
 # b.com
--- a/package/openwrt/domain-forwarding.list
+++ b/package/openwrt/domain-forwarding.list
@@ -0,0 +1,4 @@
 # domain forwarding list, one domain name per line.
 # example: forwarding a.com, and b.com
 # a.com
 # b.com
--- a/package/openwrt/files/etc/config/smartdns
+++ b/package/openwrt/files/etc/config/smartdns
@@ -1,3 +1,4 @@
 config 'smartdns'
 	option 'enabled' '0'
 config 'domain-rule'
--- a/package/openwrt/files/etc/init.d/smartdns
+++ b/package/openwrt/files/etc/init.d/smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -15,7 +15,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-START=99
+START=19
 STOP=82
 NAME=smartdns
 USE_PROCD=1
 SERVICE_USE_PID=1
@@ -23,77 +24,96 @@ SERVICE_WRITE_PID=1
 SERVICE_DAEMONIZE=1
 SERVICE_PID_FILE="/var/run/smartdns.pid"
 SMARTDNS_CONF_DIR="/etc/smartdns"
 SMARTDNS_CONF_DOWNLOAD_DIR="$SMARTDNS_CONF_DIR/conf.d"
 SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR="$SMARTDNS_CONF_DIR/domain-set"
 SMARTDNS_VAR_CONF_DIR="/var/etc/smartdns"
 SMARTDNS_CONF="$SMARTDNS_VAR_CONF_DIR/smartdns.conf"
 ADDRESS_CONF="$SMARTDNS_CONF_DIR/address.conf"
 BLACKLIST_IP_CONF="$SMARTDNS_CONF_DIR/blacklist-ip.conf"
 CUSTOM_CONF="$SMARTDNS_CONF_DIR/custom.conf"
 SMARTDNS_CONF_TMP="${SMARTDNS_CONF}.tmp"
 EXTRA_COMMANDS="updatefiles"
 EXTRA_HELP="        updatefiles      Update files"
 COREDUMP="0"
 RESPAWN="1"
 DO_RELOAD="0"
 set_forward_dnsmasq()
 {
 	local PORT="$1"
 	addr="127.0.0.1#$PORT"
-	OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)"
+	# space in suffix is important
-	if echo "$OLD_SERVER" | grep "^$addr" >/dev/null 2>&1; then
+	OLD_SERVER="$(uci -q get dhcp.@dnsmasq[0].server) "
 	if echo "$OLD_SERVER" | grep "^$addr " >/dev/null 2>&1; then
 		return
 	fi
-	uci delete dhcp.@dnsmasq[0].server 2>/dev/null
+
-	uci add_list dhcp.@dnsmasq[0].server="$addr"
+	uci -q delete dhcp.@dnsmasq[0].server
-	for server in $OLD_SERVER; do
+	uci -q add_list dhcp.@dnsmasq[0].server="$addr"
-		[ "$server" = "$addr" ] && continue
+	uci -q set dhcp.@dnsmasq[0].noresolv=1
-		uci add_list dhcp.@dnsmasq[0].server="$server"
+	uci -q set dhcp.@dnsmasq[0].rebind_protection=0
-	done
+	uci -q set dhcp.@dnsmasq[0].domainneeded=0
 	uci set dhcp.@dnsmasq[0].noresolv=1
 	uci commit dhcp
-	/etc/init.d/dnsmasq restart
+	/etc/init.d/dnsmasq reload
 }
 stop_forward_dnsmasq()
 {
 	local OLD_PORT="$1"
 	local norestart="$2"
 	addr="127.0.0.1#$OLD_PORT"
-	OLD_SERVER="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)"
+	OLD_SERVER="$(uci -q get dhcp.@dnsmasq[0].server) "
-	if ! echo "$OLD_SERVER" | grep "^$addr" >/dev/null 2>&1; then
+	if ! echo "$OLD_SERVER" | grep "^$addr " >/dev/null 2>&1; then
 		return
 	fi
-	uci del_list dhcp.@dnsmasq[0].server="$addr" 2>/dev/null
+	uci -q delete dhcp.@dnsmasq[0].server
-	addrlist="$(uci get dhcp.@dnsmasq[0].server 2>/dev/null)"
+	uci -q delete dhcp.@dnsmasq[0].noresolv
-	[ -z "$addrlist" ] && {
+	uci -q set dhcp.@dnsmasq[0].rebind_protection=1
-		uci delete dhcp.@dnsmasq[0].noresolv 2>/dev/null
+	uci -q set dhcp.@dnsmasq[0].domainneeded=1
 	}
 	uci commit dhcp
-	/etc/init.d/dnsmasq restart
+	[ "$norestart" != "1" ] && /etc/init.d/dnsmasq reload
 }
-set_iptable()
+set_main_dns()
 {
-	local ipv6_server=$1
+	local hostip
-	local tcp_server=$2
+	hostip="$(uci -q get network.lan.ipaddr)"
 	dnsmasq_port="$(uci -q get dhcp.@dnsmasq[0].port)"
 	[ -z "$dnsmasq_port" ] && dnsmasq_port="53"
-	IPS="$(ifconfig | grep "inet addr" | grep -v ":127" | grep "Bcast" | awk '{print $2}' | awk -F : '{print $2}')"
+	[ -z "$hostip" ] && return
-	for IP in $IPS
+	[ "$dnsmasq_port" = "53" ] && {
-	do
+		uci -q set dhcp.@dnsmasq[0].port=0
-		if [ "$tcp_server" = "1" ]; then
+		uci -q add_list dhcp.lan.dhcp_option="6,$hostip"
-			iptables -t nat -A PREROUTING -p tcp -d "$IP" --dport 53 -j REDIRECT --to-ports "$SMARTDNS_PORT" >/dev/null 2>&1
+	}
 		fi
 		iptables -t nat -A PREROUTING -p udp -d "$IP" --dport 53 -j REDIRECT --to-ports "$SMARTDNS_PORT" >/dev/null 2>&1
 	done
-	[ "$ipv6_server" = 0 ] && return
+	# for some third-party firmware
 	redir_dns="$(uci -q get dhcp.@dnsmasq[0].dns_redirect)"
 	[ "$redir_dns" = "1" ] && {
 		uci -q set dhcp.@dnsmasq[0].dns_redirect=0
 		uci -q set dhcp.@dnsmasq[0].old_dns_redirect=1
 	}
-	IPS="$(ifconfig | grep "inet6 addr" | grep -v " fe80::" | grep -v " ::1" | grep "Global" | awk '{print $3}')"
+	uci commit dhcp
-	for IP in $IPS
+	/etc/init.d/dnsmasq reload
-	do
+}
 		if [ "$tcp_server" = "1" ]; then
 			ip6tables -t nat -A PREROUTING -p tcp -d "$IP" --dport 53 -j REDIRECT --to-ports "$SMARTDNS_PORT" >/dev/null 2>&1
 		fi
 		ip6tables -t nat -A PREROUTING -p udp -d "$IP" --dport 53 -j REDIRECT --to-ports "$SMARTDNS_PORT" >/dev/null 2>&1
 	done
 stop_main_dns()
 {
 	local norestart="$1"
 	hostip="$(uci -q get network.lan.ipaddr)"
 	dnsmasq_port="$(uci -q get dhcp.@dnsmasq[0].port)"
 	redir_dns="$(uci -q get dhcp.@dnsmasq[0].old_dns_redirect)"
 	[ "$dnsmasq_port" != "0" ] && return
 	[ "$redir_dns" = "1" ] && {
 		uci -q set dhcp.@dnsmasq[0].dns_redirect=1
 		uci -q delete dhcp.@dnsmasq[0].old_dns_redirect
 	}
 	uci -q delete dhcp.@dnsmasq[0].port
 	uci -q del_list dhcp.lan.dhcp_option="6,$hostip"
 	uci commit dhcp
 	[ "$norestart" != "1" ] && /etc/init.d/dnsmasq reload
 }
 clear_iptable()
@@ -115,7 +135,6 @@ clear_iptable()
 		ip6tables -t nat -D PREROUTING -p udp -d "$IP" --dport 53 -j REDIRECT --to-ports "$OLD_PORT" >/dev/null 2>&1
 		ip6tables -t nat -D PREROUTING -p tcp -d "$IP" --dport 53 -j REDIRECT --to-ports "$OLD_PORT" >/dev/null 2>&1
 	done
 }
 service_triggers() {
@@ -150,6 +169,7 @@ load_server()
 	local section="$1"
 	local ADDITIONAL_ARGS=""
 	local DNS_ADDRESS=""
 	local IS_URI="0"
 	config_get_bool enabled "$section" "enabled" "1"
 	config_get port "$section" "port" ""
@@ -160,10 +180,13 @@ load_server()
 	config_get host_name "$section" "host_name" ""
 	config_get http_host "$section" "http_host" ""
 	config_get server_group "$section" "server_group" ""
 	config_get_bool exclude_default_group "$section" "exclude_default_group" "0"
 	config_get blacklist_ip "$section" "blacklist_ip" "0"
 	config_get check_edns "$section" "check_edns" "0"
 	config_get spki_pin "$section" "spki_pin" ""
 	config_get addition_arg "$section" "addition_arg" ""
 	config_get set_mark "$section" "set_mark" ""
 	config_get_bool use_proxy "$section" "use_proxy" "0"
 	[ "$enabled" = "0" ] && return
@@ -180,7 +203,9 @@ load_server()
 		SERVER="server-https"
 	fi
-	if echo "$ip" | grep ":" | grep -q -v "https://" >/dev/null 2>&1; then
+	if echo "$ip" | grep "://" >/dev/null 2>&1; then
 		IS_URI="1"
 	elif echo "$ip" | grep ":"; then
 		if ! echo "$ip" | grep -q "\\[" >/dev/null 2>&1; then
 			ip="[$ip]"
 		fi
@@ -191,26 +216,182 @@ load_server()
 	[ -z "$host_name" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -host-name $host_name"
 	[ -z "$http_host" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -http-host $http_host"
 	[ -z "$server_group" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -group $server_group"
 	[ "$exclude_default_group" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -exclude-default-group"
 	[ "$blacklist_ip" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -blacklist-ip"
 	[ "$check_edns" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -check-edns"
 	[ -z "$spki_pin" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -spki-pin $spki_pin"
 	[ -z "$set_mark" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -set-mark $set_mark"
 	[ "$use_proxy" = "0" ] || ADDITIONAL_ARGS="$ADDITIONAL_ARGS -proxy default-proxy"
-	if [ -z "$port" ]; then
+	if [ -z "$port" ] || [ "$IS_URI" = "1" ]; then
 		DNS_ADDRESS="$ip"
 	else
 		DNS_ADDRESS="$ip:$port"
 	fi
 	[ "$type" = "https" ] && DNS_ADDRESS="$ip"
 	conf_append "$SERVER" "$DNS_ADDRESS $ADDITIONAL_ARGS $addition_arg"
 }
 restart_crond()
 {
 	/etc/init.d/cron restart >/dev/null 2>&1
 }
 disable_auto_update()
 {
 	local no_restart="$1"
 	grep "/etc/init.d/smartdns updatefiles" /etc/crontabs/root 1>/dev/null 2>&1
 	if [ $? -ne 0 ]; then
 		return 
 	fi
 	sed -i '\@/etc/init.d/smartdns updatefiles@d' /etc/crontabs/root
 	if [ "$no_restart" = "1" ]; then
 		return
 	fi
 	restart_crond
 }
 enable_auto_update()
 {
 	grep "0 5 * * * /etc/init.d/smartdns updatefiles" /etc/crontabs/root 2>/dev/null
 	if [ $? -eq 0 ]; then
 		return 
 	fi
 	disable_auto_update 1
 	echo "0 5 * * * /etc/init.d/smartdns updatefiles" >> /etc/crontabs/root
 	restart_crond
 }
 load_domain_rules()
 {
 	local section="$1"
 	local domain_set_args=""
 	local domain_set_name="domain"
 	config_get server_group "$section" "server_group" ""
 	[ ! -z "$server_group" ] && domain_set_args="$domain_set_args -nameserver $server_group"
 	config_get_bool no_speed_check "$section" "no_speed_check" "0"
 	[ "$no_speed_check" = "1" ] && domain_set_args="$domain_set_args -speed-check-mode none"
 	config_get_bool force_aaaa_soa "$section" "force_aaaa_soa" "0"
 	[ "$force_aaaa_soa" = "1" ] && domain_set_args="$domain_set_args -address #6"
 	config_get ipset_name "$section" "ipset_name" ""
 	[ ! -z "$ipset_name" ] && domain_set_args="$domain_set_args -ipset $ipset_name"
 	config_get nftset_name "$section" "nftset_name" ""
 	[ ! -z "$nftset_name" ] && domain_set_args="$domain_set_args -nftset '$nftset_name'"
 	config_get addition_flag "$section" "addition_flag" ""
 	[ ! -z "$addition_flag" ] && domain_set_args="$domain_set_args $addition_flag"
 	config_get forwarding_domain_set_file "$section" "forwarding_domain_set_file" ""
 	[ ! -z "$forwarding_domain_set_file" ] && {
 		conf_append "domain-set" "-name ${domain_set_name}-forwarding-file -file '$forwarding_domain_set_file'"
 		conf_append "domain-rules" "/domain-set:${domain_set_name}-forwarding-file/ $domain_set_args"
 	}
 	conf_append "domain-set" "-name ${domain_set_name}-forwarding-list -file /etc/smartdns/domain-forwarding.list"
 	conf_append "domain-rules" "/domain-set:${domain_set_name}-forwarding-list/ $domain_set_args"
 	config_get block_domain_set_file "$section" "block_domain_set_file"
 	[ ! -z "$block_domain_set_file" ] && {
 		conf_append "domain-set" "-name ${domain_set_name}-block-file -file '$block_domain_set_file'"
 		conf_append "domain-rules" "/domain-set:${domain_set_name}-block-file/ -group block"
 	}
 	conf_append "domain-set" "-name ${domain_set_name}-block-list -file /etc/smartdns/domain-block.list"
 	conf_append "domain-rules" "/domain-set:${domain_set_name}-block-list/ --address #"
 }
 load_domain_rule_list()
 {
 	local section="$1"
 	local domain_set_args=""
 	local domain_set_name="$section"
 	config_get_bool enabled "$section" "enabled" "0"
 	[ "$enabled" != "1" ] && return
 	config_get server_group "$section" "server_group" ""
 	[ ! -z "$server_group" ] && domain_set_args="$domain_set_args -nameserver $server_group"
 	config_get block_domain_type "$section" "block_domain_type" ""
 	[ "$block_domain_type" = "all" ] && domain_set_args="$domain_set_args -address #"
 	[ "$block_domain_type" = "ipv4" ] && domain_set_args="$domain_set_args -address #4"
 	[ "$block_domain_type" = "ipv6" ] && domain_set_args="$domain_set_args -address #6"
 	config_get speed_check_mode "$section" "speed_check_mode" ""
 	[ ! -z "$speed_check_mode" ] && domain_set_args="$domain_set_args -speed-check-mode $speed_check_mode"
 	config_get dualstack_ip_selection "$section" "dualstack_ip_selection" ""
 	[ "$dualstack_ip_selection" = "no" ] && domain_set_args="$domain_set_args -dualstack-ip-selection no"
 	[ "$dualstack_ip_selection" = "yes" ] && domain_set_args="$domain_set_args -dualstack-ip-selection yes"
 	config_get_bool force_aaaa_soa "$section" "force_aaaa_soa" "0"
 	[ "$force_aaaa_soa" = "1" ] && domain_set_args="$domain_set_args -address #6"
 	config_get ipset_name "$section" "ipset_name" ""
 	[ ! -z "$ipset_name" ] && domain_set_args="$domain_set_args -ipset $ipset_name"
 	config_get nftset_name "$section" "nftset_name" ""
 	[ ! -z "$nftset_name" ] && domain_set_args="$domain_set_args -nftset '$nftset_name'"
 	config_get domain_list_file "$section" "domain_list_file" ""
 	[ -z "$domain_list_file" ] && return
 	config_get addition_flag "$section" "addition_flag" ""
 	[ ! -z "$addition_flag" ] && domain_set_args="$domain_set_args $addition_flag"
 	conf_append "domain-set" "-name domain-rule-list-${domain_set_name} -file '$domain_list_file'"
 	conf_append "domain-rules" "/domain-set:domain-rule-list-${domain_set_name}/ $domain_set_args"	
 }
 conf_append_bind()
 {
 	local ADDR=""
 	local port="$1"
 	local devices="$2"
 	local tcp_server="$3"
 	local ipv6_server="$4"
 	local ARGS="$5"
 	if [ "$ipv6_server" = "1" ]; then
 		ADDR="[::]"
 	else
 		ADDR=""
 	fi
 	devices=$(echo "$devices" | sed 's/,/ /g')
 	[ ! -z "$devices" ] && devices="$devices lo"
 	[ -z "$devices" ] && devices="-"
 	for device in $devices; do
 		device="@$device"
 		[ "$device" = "@-" ] && device=""
 		conf_append "bind" "$ADDR:$port$device $ARGS"
 	done
 	[ "$tcp_server" = "1" ] && {
 		for device in $devices; do
 			device="@$device"
 			[ "$device" = "@-" ] && device=""
 			conf_append "bind-tcp" "$ADDR:$port$device $ARGS"
 		done
 	}
 }
 load_second_server()
 {
 	local section="$1"
 	local ARGS=""
 	local ADDR=""
 	local device=""
 	config_get_bool seconddns_enabled "$section" "seconddns_enabled" "0"
 	[ "$seconddns_enabled" = "0" ] && return
@@ -241,25 +422,49 @@ load_second_server()
 	config_get_bool seconddns_no_cache "$section" "seconddns_no_cache" "0"
 	[ "$seconddns_no_cache" = "1" ] && ARGS="$ARGS -no-cache"
-	config_get_bool force_aaaa_soa "$section" "force_aaaa_soa" "0"
+	config_get_bool seconddns_force_aaaa_soa "$section" "seconddns_force_aaaa_soa" "0"
-	[ "$force_aaaa_soa" = "1" ] && ARGS="$ARGS -force-aaaa-soa"
+	[ "$seconddns_force_aaaa_soa" = "1" ] && ARGS="$ARGS -force-aaaa-soa"
 	config_get_bool bind_device "$section" "bind_device" "0"
 	config_get bind_device_name "$section" "bind_device_name" "${lan_device}"
 	[ ! -z "$bind_device_name" ] && [ "$bind_device" = "1" ] && device="${bind_device_name}"
 	config_get_bool "seconddns_tcp_server" "$section" "seconddns_tcp_server" "1"
 	config_get ipv6_server "$section" "ipv6_server" "1"
-	if [ "$ipv6_server" = "1" ]; then
+
-		ADDR="[::]"
+	conf_append_bind "$seconddns_port" "$device" "$seconddns_tcp_server" "$ipv6_server" "$ARGS"
 }
 conf_append_conf_files()
 {
 	local conf_file="$1"
 	if [ "$1" != "${1#/}" ]; then
 		fullpath="$1"
 	else 
-		ADDR=""
+		fullpath="$SMARTDNS_CONF_DOWNLOAD_DIR/$conf_file"
 	fi
-	conf_append "bind" "$ADDR:$seconddns_port $ARGS"
+	[ -f "$fullpath" ] && {
-	config_get_bool "seconddns_tcp_server" "$section" "seconddns_tcp_server" "1"
+		conf_append "conf-file" "'$fullpath'"
-	[ "$seconddns_tcp_server" = "1" ] && conf_append "bind-tcp" "$ADDR:$seconddns_port $ARGS"
+	}
 }
 load_service()
 {
 	local section="$1"
 	args=""
 	local device=""
 	dnsmasq_lease_file="$(uci -q get dhcp.@dnsmasq[0].leasefile)"
 	dnsmasq_port="$(uci -q get dhcp.@dnsmasq[0].port)"
 	resolve_file="$(uci -q get dhcp.@dnsmasq[0].resolvfile)"
 	lan_device="$(uci -q get network.lan.device)"
 	[ -z "$dnsmasq_lease_file" ] && dnsmasq_lease_file="/tmp/dhcp.leases"
 	[ -z "$dnsmasq_port" ] && dnsmasq_port="53"
 	[ -z "$resolve_file" ] && resolve_file="/tmp/resolv.conf.d/resolv.conf.auto"
 	qtype_soa_list=""
 	mkdir -p $SMARTDNS_VAR_CONF_DIR
 	rm -f $SMARTDNS_CONF_TMP
@@ -272,24 +477,16 @@ load_service()
 	config_get coredump "$section" "coredump" "0"
 	[ "$coredump" = "1" ] && COREDUMP="1"
-	config_get port "$section" "port" "6053"
+	config_get port "$section" "port" "53"
 	config_get ipv6_server "$section" "ipv6_server" "1"
 	config_get tcp_server "$section" "tcp_server" "1"
-	if [ "$ipv6_server" = "1" ]; then
+	config_get server_flags "$section" "server_flags" ""
-		conf_append "bind" "[::]:$port"
+
-	else
+	config_get speed_check_mode "$section" "speed_check_mode" ""
-		conf_append "bind" ":$port"
+	[ ! -z "$speed_check_mode" ] && conf_append "speed-check-mode" "$speed_check_mode"
 	fi
 	[ "$tcp_server" = "1" ] && {
 		if [ "$ipv6_server" = "1" ]; then
 			conf_append "bind-tcp" "[::]:$port"
 		else
 			conf_append "bind-tcp" ":$port"
 		fi
 	}
 	config_get dualstack_ip_selection "$section" "dualstack_ip_selection" "0"
-	[ "$dualstack_ip_selection" = "1" ] && conf_append "dualstack-ip-selection" "yes"
+	[ "$dualstack_ip_selection" = "0" ] && conf_append "dualstack-ip-selection" "no"
 	config_get prefetch_domain "$section" "prefetch_domain" "0"
 	[ "$prefetch_domain" = "1" ] && conf_append "prefetch-domain" "yes"
@@ -297,11 +494,26 @@ load_service()
 	config_get serve_expired "$section" "serve_expired" "0"
 	[ "$serve_expired" = "1" ] && conf_append "serve-expired" "yes"
 	SMARTDNS_PORT="$port"
 	config_get cache_size "$section" "cache_size" ""
 	[ -z "$cache_size" ] || conf_append "cache-size" "$cache_size"
 	config_get resolve_local_hostnames "$section" "resolve_local_hostnames" "1"
 	[ "$resolve_local_hostnames" = "1" ] && conf_append "dnsmasq-lease-file" "$dnsmasq_lease_file"
 	config_get force_aaaa_soa "$section" "force_aaaa_soa" "0"
 	[ "$force_aaaa_soa" = "1" ] && qtype_soa_list="$qtype_soa_list 28"
 	config_get force_https_soa "$section" "force_https_soa" "1"
 	[ "$force_https_soa" = "1" ] && qtype_soa_list="$qtype_soa_list 65"
 	config_get auto_set_dnsmasq "$section" "auto_set_dnsmasq" "1"
 	config_get ipset_no_speed "$section" "ipset_no_speed" ""
 	[ -z "$ipset_no_speed" ] || conf_append "ipset-no-speed" "$ipset_no_speed"
 	config_get nftset_no_speed "$section" "nftset_no_speed" ""
 	[ -z "$nftset_no_speed" ] || conf_append "nftset-no-speed" "$nftset_no_speed"
 	config_get rr_ttl "$section" "rr_ttl" ""
 	[ -z "$rr_ttl" ] || conf_append "rr-ttl" "$rr_ttl"
@@ -311,6 +523,9 @@ load_service()
 	config_get rr_ttl_max "$section" "rr_ttl_max" ""
 	[ -z "$rr_ttl_max" ] || conf_append "rr-ttl-max" "$rr_ttl_max"
 	config_get rr_ttl_reply_max "$section" "rr_ttl_reply_max" ""
 	[ -z "$rr_ttl_reply_max" ] || conf_append "rr-ttl-reply-max" "$rr_ttl_reply_max"
 	config_get log_size "$section" "log_size" "64K"
 	[ -z "$log_size" ] || conf_append "log-size" "$log_size"
@@ -323,38 +538,113 @@ load_service()
 	config_get log_file "$section" "log_file" ""
 	[ -z "$log_file" ] || conf_append "log-file" "$log_file"
-	config_get redirect "$section" "redirect" "none"
+	config_get response_mode "$section" "response_mode" ""
-	config_get old_redirect "$section" "old_redirect" "none"
+	[ -z "$response_mode" ] || conf_append "response-mode" "$response_mode"
 	config_get_bool enable_auto_update "$section" "enable_auto_update" "0"
 	[ "$enable_auto_update" = "1" ] && enable_auto_update || disable_auto_update
 	config_get_bool bind_device "$section" "bind_device" "0"
 	config_get bind_device_name "$section" "bind_device_name" "${lan_device}"
 	[ ! -z "$bind_device_name" ] && [ "$bind_device" = "1" ] && device="${bind_device_name}"
 	config_get cache_file "$section" "cache_file" "$SMARTDNS_CONF_DIR/smartdns.cache"
 	config_get_bool cache_persist "$section" "cache_persist" "0"
 	[ "$cache_persist" = "1" ] && {
 		conf_append "cache-persist" "yes"
 		conf_append "cache-file" "$cache_file"
 	}
 	[ "$cache_persist" = "0" ] && {
 		conf_append "cache-persist" "no"
 		[ -f "$cache_file" ] && rm -f "$cache_file"
 	}
 	config_get proxy_server "$section" "proxy_server" ""
 	[ -z "$proxy_server" ] || conf_append "proxy-server" "$proxy_server -name default-proxy"
 	config_get dns64 "$section" "dns64" ""
 	[ -z "$dns64" ] || conf_append "dns64" "$dns64"
 	config_get redirect "$section" "redirect" ""
 	config_get old_port "$section" "old_port" "0"
 	config_get old_enabled "$section" "old_enabled" "0"
 	config_get old_auto_set_dnsmasq "$section" "old_auto_set_dnsmasq" "0"
-	if [ "$old_redirect" != "$redirect" ] || [ "$old_port" != "$SMARTDNS_PORT" ] || [ "$old_enabled" = "1" -a "$enabled" = "0" ]; then
+	[ -z "$qtype_soa_list" ] || conf_append "force-qtype-SOA" "$qtype_soa_list"
-		[ "$old_redirect" = "none" ] || {
+	[ -e "$resolve_file" ] && conf_append "resolv-file" "$resolve_file"
-			[ "$old_port" = "0" ] || clear_iptable "$old_port" "$ipv6_server"
+
-			[ "$old_redirect" = "dnsmasq-upstream" ] && stop_forward_dnsmasq "$old_port"
+	# upgrade old configuration
 	if [ "$redirect" = "redirect" ] || [ "$redirect" = "dnsmasq-upstream" ] || [ "$redirect" = "none" ]; then
 		[ "$redirect" = "redirect" ] && {
 			clear_iptable "$port"
 			clear_iptable "$old_port"
 			uci -q delete smartdns.@smartdns[0].port
 			port="53"
 		}
 		[ "$redirect" = "dnsmasq-upstream" ] && {
 			stop_forward_dnsmasq "$port"
 			stop_forward_dnsmasq "$old_port"
 			auto_set_dnsmasq="1"
 			uci -q set smartdns.@smartdns[0].auto_set_dnsmasq="1"
 		}
 		[ "$redirect" = "none" ] && {
 			auto_set_dnsmasq="0"
 			uci -q set smartdns.@smartdns[0].auto_set_dnsmasq="0"
 		}
 		uci -q delete smartdns.@smartdns[0].redirect
 		uci -q delete smartdns.@smartdns[0].old_redirect
 	fi
-	uci delete smartdns.@smartdns[0].old_redirect 2>/dev/null
+	uci -q delete smartdns.@smartdns[0].old_port
-	uci delete smartdns.@smartdns[0].old_port 2>/dev/null
+	uci -q delete smartdns.@smartdns[0].old_enabled
-	uci delete smartdns.@smartdns[0].old_enabled 2>/dev/null
+	uci -q delete smartdns.@smartdns[0].old_auto_set_dnsmasq
-	uci add_list smartdns.@smartdns[0].old_redirect="$redirect" 2>/dev/null
+	uci -q set smartdns.@smartdns[0].old_port="$port"
-	uci add_list smartdns.@smartdns[0].old_port="$SMARTDNS_PORT" 2>/dev/null
+	uci -q set smartdns.@smartdns[0].old_enabled="$enabled"
-	uci add_list smartdns.@smartdns[0].old_enabled="$enabled" 2>/dev/null
+	uci -q set smartdns.@smartdns[0].old_auto_set_dnsmasq="$auto_set_dnsmasq"
 	uci commit smartdns
-	[ "$enabled" -gt 0 ] || return 1
+	# disable service
 	[ "$enabled" = "0" ] && {
 		[ "$old_enabled" = "0" ] && return 1
 		[ "$old_port" = "53" ] && stop_main_dns "0"
 		[ "$old_port" != "53" ] && [ "$old_auto_set_dnsmasq" = "1" ] && stop_forward_dnsmasq "$old_port" "0"
 		disable_auto_update
 		return 1
 	}
-	if [ "$redirect" = "redirect" ]; then
+	# change port
-		set_iptable $ipv6_server $tcp_server
+	[ "$old_port" != "$port" ] && {
-	elif [ "$redirect" = "dnsmasq-upstream" ]; then
+		[ "$old_port" = "53" ] && {
-		set_forward_dnsmasq "$SMARTDNS_PORT"
+			no_restart_dnsmasq="1"
-	fi
+			[ "$auto_set_dnsmasq" = "0" ] && no_restart_dnsmasq="0"
 			stop_main_dns "$no_restart_dnsmasq"
 		}
 		[ "$old_port" != "53" ] && [ "$old_auto_set_dnsmasq" = "1" ] && stop_forward_dnsmasq "$old_port" "1"
 	}
-	load_second_server $section
+	# start service
 	[ "$port" = "53" ] && set_main_dns
 	[ "$port" != "53" ] && {
 		[ "$auto_set_dnsmasq" = "1" ] && set_forward_dnsmasq "$port"
 		[ "$auto_set_dnsmasq" = "0" ] && [ "$old_auto_set_dnsmasq" = "1" ] && stop_forward_dnsmasq "$old_port" "0"
 	}
 	conf_append_bind "$port" "$device" "$tcp_server" "$ipv6_server" "$server_flags"
 	load_second_server "$section"
 	config_foreach load_server "server"
 	config_list_foreach "$section" "conf_files" conf_append_conf_files
 	config_foreach load_domain_rules "domain-rule"
 	config_foreach load_domain_rule_list "domain-rule-list"
 	{
 		echo "conf-file $ADDRESS_CONF"
 		echo "conf-file $BLACKLIST_IP_CONF"
@@ -374,17 +664,108 @@ load_service()
 	procd_set_param command /usr/sbin/smartdns -f -c $SMARTDNS_CONF $args
 	[ "$RESPAWN" = "1" ] &&	procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
 	procd_set_param file "$SMARTDNS_CONF"
 	procd_set_param term_timeout 60
 	procd_close_instance
 }
 unload_service()
 {
 	local section="$1"
 	[ "$DO_RELOAD" = "1" ] && return 0
 	config_get_bool enabled "$section" "enabled" '0'
 	dnsmasq_port="$(uci -q get dhcp.@dnsmasq[0].port)"
 	config_get port "$section" "port" "53"
 	config_get auto_set_dnsmasq "$section" "auto_set_dnsmasq" "0"
 	config_get old_enabled "$section" "old_enabled" "0"
 	config_get old_port "$section" "old_port" "0"
 	config_get old_auto_set_dnsmasq "$section" "old_auto_set_dnsmasq" "0"
 	[ -z "${dnsmasq_port}" ] && dnsmasq_port="53"
 	[ "$enabled" = "1" ] && {
 		[ "$old_enabled" = "0" ] && return 1
 		[ "$old_port" = "53" ] && stop_main_dns "0"
 		[ "$old_port" != "53" ] && [ "$old_auto_set_dnsmasq" = "1" ] && stop_forward_dnsmasq "$old_port" "0"
 	}
 }
 download_file() {
 	local section="$1"
 	config_get url "$section" "url" ""
 	config_get name "$section" "name" ""
 	config_get filetype "$section" "type" ""
 	[ -z "$url" ] && return 0
 	[ -z "$name" ] && return 0
 	[ -z "$filetype" ] && return 0
 	echo "download $filetype file $name from $url"
 	wget --timeout 120 -q -O "/tmp/$name" "$url"
 	if [ $? -ne 0 ]; then
 		echo "download file $name failed"
 		return 1
 	fi
 	echo "download file $name success"
 	if [ "$filetype" = "list" ]; then
 		mv "/tmp/$name" "$SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR/$name"	
 	elif [ "$filetype" = "config" ]; then
 		mv "/tmp/$name" "$SMARTDNS_CONF_DOWNLOAD_DIR/$name"	
 	fi
 }
 check_and_add_entry() {
 	local docommit=0
 	uci -q get smartdns.@smartdns[0] >/dev/null
 	if [ $? -ne 0 ]; then
 		uci -q add smartdns smartdns >/dev/null
 		docommit=1
 	fi
 	uci -q get smartdns.@domain-rule[0] >/dev/null
 	if [ $? -ne 0 ]; then
 		uci -q add smartdns domain-rule >/dev/null
 		docommit=1
 	fi
 	if [ "$docommit" = "1" ]; then
 		uci -q commit smartdns >/dev/null
 	fi
 	if [ ! -d "$SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR" ]; then
 		mkdir -p "$SMARTDNS_DOMAIN_LIST_DOWNLOAD_DIR"
 	fi
 	if [ ! -d "$SMARTDNS_CONF_DOWNLOAD_DIR" ]; then
 		mkdir -p "$SMARTDNS_CONF_DOWNLOAD_DIR"
 	fi
 }
 updatefiles() {
 	config_load "smartdns"
 	config_foreach download_file "download-file"
 	reload_service
 }
 service_stopped()
 {
 	config_load "smartdns"
 	config_foreach unload_service "smartdns"
 }
 start_service()
 {
 	check_and_add_entry
 	config_load "smartdns"
 	config_foreach load_service "smartdns"
 }
 reload_service()
 {
 	DO_RELOAD="1"
 	stop
 	start
 	DO_RELOAD="0"
 }
--- a/package/openwrt/make.sh
+++ b/package/openwrt/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -23,6 +23,8 @@ SMARTDNS_CONF=$SMARTDNS_DIR/etc/smartdns/smartdns.conf
 ADDRESS_CONF=$CURR_DIR/address.conf
 BLACKLIST_IP_CONF=$CURR_DIR/blacklist-ip.conf
 CUSTOM_CONF=$CURR_DIR/custom.conf
 DOMAIN_BLOCK_LIST=$CURR_DIR/domain-block.list
 DOMAIN_FORWARDING_LIST=$CURR_DIR/domain-forwarding.list
 showhelp()
 {
@@ -45,11 +47,15 @@ build()
 	mkdir $ROOT/root/usr/sbin -p
 	mkdir $ROOT/root/etc/init.d -p
 	mkdir $ROOT/root/etc/smartdns/ -p
 	mkdir $ROOT/root/etc/smartdns/domain-set/ -p 
 	mkdir $ROOT/root/etc/smartdns/conf.d/ -p 
 	cp $SMARTDNS_CONF  $ROOT/root/etc/smartdns/
 	cp $ADDRESS_CONF $ROOT/root/etc/smartdns/
 	cp $BLACKLIST_IP_CONF $ROOT/root/etc/smartdns/
 	cp $CUSTOM_CONF $ROOT/root/etc/smartdns/
 	cp $DOMAIN_BLOCK_LIST $ROOT/root/etc/smartdns/
 	cp $DOMAIN_FORWARDING_LIST $ROOT/root/etc/smartdns/
 	cp $CURR_DIR/files/etc $ROOT/root/ -af
 	cp $SMARTDNS_BIN $ROOT/root/usr/sbin
 	if [ $? -ne 0 ]; then
--- a/package/optware/S50smartdns
+++ b/package/optware/S50smartdns
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -22,13 +22,14 @@ SMARTDNS_PID=/var/run/smartdns.pid
 SMARTDNS_PORT=535
 SMARTDNS_OPT=/opt/etc/smartdns/smartdns-opt.conf
 # workmode 
 # DO NOT CHANGE THIS, CHANGE MODE IN smartdns-opt.conf
 # 0: run as port only
 # 1: redirect port
 # 2: replace 
 SMARTDNS_WORKMODE="1"
 if [ -f "$SMARTDNS_OPT" ]; then
-. $SMARTDNS_OPT
+. "$SMARTDNS_OPT"
 fi
@@ -36,7 +37,7 @@ set_iptable()
 {
 	local redirect_tcp
-	redirect_tcp=0;
+	redirect_tcp=0
 	grep ^bind-tcp $SMARTDNS_CONF > /dev/null 2>&1
 	if [ $? -eq 0 ]; then
@@ -108,7 +109,24 @@ restart_dnsmasq()
 		return 1
 	fi
-	PID="$(echo "$CMD" | awk '{print $1}')"
+	# check multiple dnsmasq
 	linecount="$(echo "$CMD" | wc -l)"
 	if [ $linecount -eq 1 ]; then
 		PID="$(echo "$CMD" | awk '{print $1}')"
 	elif [ $linecount -gt 1 ]; then
 		PID1="$(echo "$CMD" | awk 'NR==1{print $1}')"
 		PID2="$(echo "$CMD" | awk 'NR==2{print $1}')"
 		PID2_PPID="$(grep 'PPid:' /proc/$PID2/status | awk '{print $2}' 2>/dev/null)"
 		if [ "$PID2_PPID" != "$PID1" ]; then
 			echo "find multiple dnsmasq, but not started by the same process"
 			return 1
 		fi
 		PID=$PID1
 	else
 		echo "find multiple dnsmasq, but not started by the same process"
 		return 1
 	fi
 	if [ ! -d "/proc/$PID" ]; then
 		echo "dnsmasq is not running"
 		return 1
@@ -116,29 +134,61 @@ restart_dnsmasq()
 	kill -9 "$PID"
 	# get dnsmasq command
 	CMD="$(echo "$CMD" | head -n 1)"
 	DNSMASQ_CMD="$(echo "$CMD" | awk '{for(i=5; i<=NF;i++)printf $i " "}')"
 	$DNSMASQ_CMD
 }
-get_server_ip()
+add_dhcp_options6()
 {
 	CONF_FILE=$1
 	IPS="$(ifconfig | grep "inet addr" | grep -v ":127" | grep "Bcast" | awk '{print $2}' | awk -F: '{print $2}')"
 	for IP in $IPS
 	do
-		N=3
+		DHCP_OPTION="$(grep "dhcp-option=" "$CONF_FILE" | grep "$IP" | head -n 1)"
-		while [ $N -gt 0 ]
+		if [ -z "$DHCP_OPTION" ]; then
-		do
+			continue
-			ADDR="$(echo "$IP" | awk -F. "{for(i=1;i<="$N";i++)printf \$i\".\"}")"
+		fi
-			grep "dhcp-range=" "$CONF_FILE" | grep "$ADDR" >/dev/null 2>&1
+
-			if [ $? -eq 0 ]; then
+		SERVER_TAG="$(echo "$DHCP_OPTION" | awk -F= '{print $2}' | awk -F, '{print $1}')"
-					SERVER_TAG="$(grep "^dhcp-range *=" "$CONF_FILE" | grep "$ADDR" | awk -F= '{print $2}' | awk -F, '{print $1}')"
+		LOCAL_SERVER_IP="$IP"
-					LOCAL_SERVER_IP="$IP"
+
-					return 1
+		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" "$CONF_FILE" 1>/dev/null 2>&1
-			fi
+		if [ $? -eq 0 ]; then
-			N=$((N-1))
+			continue
-		done
+		fi
 		DHCP_OPTION="dhcp-option=$SERVER_TAG,6,$LOCAL_SERVER_IP"
 		echo "$DHCP_OPTION" >> "$CONF_FILE"
 		RESTART_DNSMASQ=1
 	done
 	return 1
 }
 clear_dhcp_options6()
 {
 	CONF_FILE=$1
 	IPS="$(ifconfig | grep "inet addr" | grep -v ":127" | grep "Bcast" | awk '{print $2}' | awk -F: '{print $2}')"
 	for IP in $IPS
 	do
 		DHCP_OPTION="$(grep "dhcp-option=" "$CONF_FILE" | grep "$IP" | head -n 1)"
 		if [ -z "$DHCP_OPTION" ]; then
 			continue
 		fi
 		SERVER_TAG="$(echo "$DHCP_OPTION" | awk -F= '{print $2}' | awk -F, '{print $1}')"
 		LOCAL_SERVER_IP="$IP"
 		grep "dhcp-option *= *$SERVER_TAG, *6 *, *$LOCAL_SERVER_IP" "$CONF_FILE" 1>/dev/null 2>&1
 		if [ $? -ne 0 ]; then
 			continue
 		fi
 		sed -i "/^dhcp-option *=$SERVER_TAG,6,/d" "$CONF_FILE"
 		RESTART_DNSMASQ=1
 	done
 	return 1
@@ -149,17 +199,9 @@ set_dnsmasq_conf()
 	local LOCAL_SERVER_IP=""
 	local SERVER_TAG=""
 	local CONF_FILE=$1
 	local DHCP_OPTIONS=""
-	get_server_ip $CONF_FILE
+	add_dhcp_options6 "$CONF_FILE"
 	if [ "$LOCAL_SERVER_IP" ] && [ "$SERVER_TAG" ]; then
 		grep "dhcp-option *=" "$CONF_FILE" | grep "$SERVER_TAG,6,$LOCAL_SERVER_IP" > /dev/null 2>&1
 		if [ $? -ne 0 ]; then
 			sed -i "/^dhcp-option *=$SERVER_TAG,6,/d" "$CONF_FILE"
 			echo "dhcp-option=$SERVER_TAG,6,$LOCAL_SERVER_IP" >> "$CONF_FILE"
 			RESTART_DNSMASQ=1
 		fi
 	fi
 	grep "^port *=0" "$CONF_FILE" > /dev/null 2>&1
 	if [ $? -ne 0 ]; then
@@ -193,14 +235,7 @@ clear_dnsmasq_conf()
 	local SERVER_TAG=""
 	local CONF_FILE=$1
-	get_server_ip "$CONF_FILE"
+	clear_dhcp_options6 "$CONF_FILE"
 	if [ "$LOCAL_SERVER_IP" ] && [ "$SERVER_TAG" ]; then
 		grep "dhcp-option *=" "$CONF_FILE" | grep "$SERVER_TAG,6,$LOCAL_SERVER_IP" > /dev/null 2>&1
 		if [ $? -eq 0 ]; then
 			sed -i "/^dhcp-option *=$SERVER_TAG,6,/d" "$CONF_FILE"
 			RESTART_DNSMASQ=1
 		fi
 	fi
 	grep "^port *=" "$CONF_FILE" > /dev/null 2>&1
 	if [ $? -eq 0 ]; then
@@ -232,11 +267,11 @@ set_smartdns_port()
 	if [ "$SMARTDNS_WORKMODE" = "0" ]; then
 		return 0
 	elif [ "$SMARTDNS_WORKMODE" = "1" ]; then
-		sed -i "s/^\\(bind .*\\):53 *\\(.*\\)\$/\\1:$SMARTDNS_PORT \\2/g" $SMARTDNS_CONF
+		sed -i "s/^\(bind .*\):53\( .*\)\?$/\1:$SMARTDNS_PORT \2/g" $SMARTDNS_CONF
-		sed -i "s/^\\(bind-tcp .*\\):53 *\\(.*\\)\$/\\1:$SMARTDNS_PORT \\2/g" $SMARTDNS_CONF
+		sed -i "s/^\(bind-tcp .*\):53\( .*\)\?$/\1:$SMARTDNS_PORT \2/g" $SMARTDNS_CONF
 	elif [ "$SMARTDNS_WORKMODE" = "2" ]; then
-		sed -i "s/^\\(bind .*\\):$SMARTDNS_PORT *\\(.*\\)\$/\\1:53 \\2/g" $SMARTDNS_CONF
+		sed -i "s/^\(bind .*\):$SMARTDNS_PORT\( .*\)\?$/\1:53 \2/g" $SMARTDNS_CONF
-		sed -i "s/^\\(bind-tcp .*\\):$SMARTDNS_PORT *\\(.*\\)\$/\\1:53 \\2/g" $SMARTDNS_CONF
+		sed -i "s/^\(bind-tcp .*\):$SMARTDNS_PORT\( .*\)\?$/\1:53 \2/g" $SMARTDNS_CONF
 	else
 		return 1
 	fi	
@@ -305,50 +340,56 @@ case "$1" in
 	set_smartdns_port
 	get_tz
-	$SMARTDNS_BIN -c $SMARTDNS_CONF -p $SMARTDNS_PID
+	$SMARTDNS_BIN -c "$SMARTDNS_CONF" -p $SMARTDNS_PID
 	if [ $? -ne 0 ]; then
 		clear_rule
 		exit 1
 	fi
 	;;
 	status)
 	pid="$(cat $SMARTDNS_PID |head -n 1 2>/dev/null)"
 	if [ -z "$pid" ]; then
 		echo "smartdns not running."
-		return 0
+		exit 0
 	fi
 	if [ -d "/proc/$pid" ]; then
-		echo "smartdns running"
+		echo "smartdns is running"
-		return 0;
+		exit 0
 	fi
 	echo "smartdns not running."
-	return 0;
+	exit 0
 	;;
 	stop)
 	clear_rule
 	pid="$(cat "$SMARTDNS_PID" | head -n 1 2>/dev/null)"
 	if [ -z "$pid" ]; then
 		echo "smartdns not running."
-		return 0
+		exit 0
 	fi
 	kill -15 "$pid" 2>/dev/null
-	SLEEP=`which usleep`
+	SLEEP=$(which usleep 2>/dev/null)
 	SLEEPTIME=200000
 	if [ -z "$SLEEP" ]; then
 		SLEEP="sleep"
 		SLEEPTIME=0.2
 	fi
-	N=30
+	N=300
 	while [ $N -gt 0 ]
 	do
 		pid="$(cat "$SMARTDNS_PID" | head -n 1 2>/dev/null)"
 		if [ -z "$pid" ]; then
-			return 0
+			break
 		fi
 		if [ ! -d "/proc/$pid" ]; then
-			return 0;
+			break
 		fi
 		stat="$(cat /proc/${pid}/stat | awk '{print $3}' 2>/dev/null)"
 		if [ "$stat" = "Z" ]; then
 			$SLEEP $SLEEPTIME
 			break
 		fi
 		$SLEEP $SLEEPTIME 2>/dev/null
@@ -356,11 +397,15 @@ case "$1" in
 	done
 	kill -9 "$pid" 2>/dev/null
 	clear_rule
 	exit 0
 	;;
 	restart)
 	$0 stop
 	$0 start
 	;;
 	reload)
 	;;
 	enable)
 	nvram set apps_state_enable=2
 	nvram set apps_state_error=0
--- a/package/optware/control/postinst
+++ b/package/optware/control/postinst
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/optware/control/prerm
+++ b/package/optware/control/prerm
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/optware/make.sh
+++ b/package/optware/make.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
--- a/package/windows/install.bat
+++ b/package/windows/install.bat
@@ -12,7 +12,7 @@ IF NOT %ERRORLEVEL% == 0 (
 copy %CURR_PATH%\wsl-run.vbs "%STARTUP_PATH%/"
 IF NOT %ERRORLEVEL% == 0 (
-  echo Install startupt script failed.
+  echo Install startup script failed.
  pause
  exit 1
 )
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,5 +1,5 @@
-# Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+# Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 #
 # smartdns is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -15,17 +15,23 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 BIN=smartdns 
-OBJS_LIB=lib/rbtree.o lib/art.o lib/bitops.o lib/radix.o lib/conf.o
+OBJS_LIB=lib/rbtree.o lib/art.o lib/bitops.o lib/radix.o lib/conf.o lib/nftset.o
-OBJS=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o $(OBJS_LIB)
+OBJS=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o proxy.o $(OBJS_LIB)
 # cflags
 ifndef CFLAGS
-CFLAGS =-O2 -g -Wall -Wstrict-prototypes -fno-omit-frame-pointer -Wstrict-aliasing -funwind-tables
+ ifdef DEBUG
  CFLAGS = -g
 else
  CFLAGS = -O2 -g 
 endif
 CFLAGS +=-Wall -Wstrict-prototypes -fno-omit-frame-pointer -Wstrict-aliasing -funwind-tables -Wmissing-prototypes -Wshadow -Wextra -Wno-unused-parameter -Wno-implicit-fallthrough
 endif
 override CFLAGS +=-Iinclude
-override CFLAGS += -DBASE_FILE_NAME=\"$(notdir $<)\"
+override CFLAGS += -DBASE_FILE_NAME='"$(notdir $<)"'
 override CFLAGS += $(EXTRA_CFLAGS)
 ifdef VER
-override CFLAGS += -DSMARTDNS_VERION=\"$(VER)\"
+override CFLAGS += -DSMARTDNS_VERION='"$(VER)"'
 endif
 CXXFLAGS=-O2 -g -Wall -std=c++11 
@@ -33,9 +39,9 @@ override CXXFLAGS +=-Iinclude
 # ldflags
 ifeq ($(STATIC), yes)
-override LDFLAGS += -lssl -lcrypto -Wl,--whole-archive -lpthread -Wl,--no-whole-archive -ldl -static
+ override LDFLAGS += -lssl -lcrypto -Wl,--whole-archive -lpthread -Wl,--no-whole-archive -ldl -static
 else
-override LDFLAGS += -lssl -lcrypto -lpthread -ldl
+ override LDFLAGS += -lssl -lcrypto -lpthread -ldl
 endif
 .PHONY: all clean
--- a/src/dns.c
+++ b/src/dns.c
--- a/src/dns.h
+++ b/src/dns.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -23,13 +23,18 @@
 #define DNS_RR_AAAA_LEN 16
 #define DNS_MAX_CNAME_LEN 256
 #define DNS_MAX_OPT_LEN 256
-#define DNS_IN_PACKSIZE (512 * 4)
+#define DNS_IN_PACKSIZE (512 * 8)
-#define DNS_PACKSIZE (512 * 10)
+#define DNS_PACKSIZE (512 * 12)
 #define DNS_DEFAULT_PACKET_SIZE 512
 #define DNS_ADDR_FAMILY_IP 1
 #define DNS_ADDR_FAMILY_IPV6 2
 /*
 DNS parameters:
 https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
 */
 typedef enum dns_qr {
 	DNS_QR_QUERY = 0,
 	DNS_QR_ANSWER = 1,
@@ -61,18 +66,32 @@ typedef enum dns_type {
 	DNS_T_SRV = 33,
 	DNS_T_OPT = 41,
 	DNS_T_SSHFP = 44,
 	DNS_T_HTTPS = 65,
 	DNS_T_SPF = 99,
 	DNS_T_AXFR = 252,
 	DNS_T_ALL = 255
 } dns_type_t;
 typedef enum dns_opt_code {
-	DNS_OPT_T_ECS = 8, // OPT ECS
+	DNS_OPT_T_ECS = 8,     // OPT ECS
-	DNS_OPT_T_COOKIE = 10, //OPT Cookie
+	DNS_OPT_T_COOKIE = 10, // OPT Cookie
 	DNS_OPT_T_TCP_KEEPALIVE = 11,
 	DNS_OPT_T_PADDING = 12,
 	DNS_OPT_T_ALL = 255
 } dns_opt_code_t;
 /* https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/11/ */
 typedef enum dns_https_svcparam {
 	DNS_HTTPS_T_MANDATORY = 0,
 	DNS_HTTPS_T_ALPN = 1,
 	DNS_HTTPS_T_NO_DEFAULT_ALPN = 2,
 	DNS_HTTPS_T_PORT = 3,
 	DNS_HTTPS_T_IPV4HINT = 4,
 	DNS_HTTPS_T_ECH = 5,
 	DNS_HTTPS_T_IPV6HINT = 6,
 	DNS_HTTPS_T_ALL = 255
 } dns_https_svcparam_t;
 typedef enum dns_opcode {
 	DNS_OP_QUERY = 0,
 	DNS_OP_IQUERY = 1,
@@ -110,17 +129,21 @@ struct dns_head {
 	unsigned short qdcount; /* number of question entries */
 	unsigned short ancount; /* number of answer entries */
 	unsigned short nscount; /* number of authority entries */
-	unsigned short nrcount; /* number of addititional resource entries */
+	unsigned short nrcount; /* number of additional resource entries */
 } __attribute__((packed, aligned(2)));
-struct dns_rrs {
+#define DNS_PACKET_DICT_SIZE 16
-	unsigned short next;
+struct dns_packet_dict_item {
-	unsigned short len;
+	unsigned short pos;
-	dns_type_t type;
+	unsigned int hash;
 	unsigned char data[0];
 };
-/* packet haed */
+struct dns_packet_dict {
 	short dict_count;
 	struct dns_packet_dict_item names[DNS_PACKET_DICT_SIZE];
 };
 /* packet head */
 struct dns_packet {
 	struct dns_head head;
 	unsigned short questions;
@@ -130,23 +153,26 @@ struct dns_packet {
 	unsigned short optcount;
 	unsigned short optional;
 	unsigned short payloadsize;
 	struct dns_packet_dict namedict;
 	int size;
 	int len;
 	unsigned char data[0];
 };
-/* RRS encode/decode context */
+struct dns_rrs {
-struct dns_data_context {
+	struct dns_packet *packet;
-	unsigned char *data;
+	unsigned short next;
-	unsigned char *ptr;
+	unsigned short len;
-	unsigned int maxsize;
+	int type;
 	unsigned char data[0];
 };
 /* packet encode/decode context */
 struct dns_context {
 	struct dns_packet *packet;
 	struct dns_packet_dict *namedict;
 	unsigned char *data;
-	unsigned int maxsize;
+	int maxsize;
 	unsigned char *ptr;
 };
@@ -170,7 +196,7 @@ struct dns_opt_ecs {
 	unsigned char source_prefix;
 	unsigned char scope_prefix;
 	unsigned char addr[DNS_RR_AAAA_LEN];
-};
+} __attribute__((packed));
 /* OPT COOLIE */
 struct dns_opt_cookie {
@@ -186,35 +212,58 @@ struct dns_opt {
 	unsigned char data[0];
 } __attribute__((packed));
 struct dns_rr_nested {
 	struct dns_context context;
 	unsigned char *rr_start;
 	unsigned char *rr_len_ptr;
 	unsigned short rr_head_len;
 	dns_rr_type type;
 };
 struct dns_https_param {
 	unsigned short key;
 	unsigned short len;
 	unsigned char value[0];
 };
 struct dns_rrs *dns_get_rrs_next(struct dns_packet *packet, struct dns_rrs *rrs);
 struct dns_rrs *dns_get_rrs_start(struct dns_packet *packet, dns_rr_type type, int *count);
 struct dns_rr_nested *dns_add_rr_nested_start(struct dns_rr_nested *rr_nested_buffer, struct dns_packet *packet,
 											  dns_rr_type type, dns_type_t rtype, const char *domain, int ttl);
 int dns_add_rr_nested_end(struct dns_rr_nested *rr_nested, dns_type_t rtype);
 int dns_add_rr_nested_memcpy(struct dns_rr_nested *rr_nested, void *data, int data_len);
 void *dns_get_rr_nested_start(struct dns_rrs *rrs, char *domain, int maxsize, int *qtype, int *ttl, int *rr_len);
 void *dns_get_rr_nested_next(struct dns_rrs *rrs, void *rr_nested, int rr_nested_len);
 /*
 * Question
 */
-int dns_add_domain(struct dns_packet *packet, char *domain, int qtype, int qclass);
+int dns_add_domain(struct dns_packet *packet, const char *domain, int qtype, int qclass);
 int dns_get_domain(struct dns_rrs *rrs, char *domain, int maxsize, int *qtype, int *qclass);
 /*
 * Answers
 */
-int dns_add_CNAME(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl, char *cname);
+int dns_add_CNAME(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl, const char *cname);
 int dns_get_CNAME(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, char *cname, int cname_size);
-int dns_add_A(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl, unsigned char addr[DNS_RR_A_LEN]);
+int dns_add_A(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl,
 			  unsigned char addr[DNS_RR_A_LEN]);
 int dns_get_A(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, unsigned char addr[DNS_RR_A_LEN]);
-int dns_add_PTR(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl, char *cname);
+int dns_add_PTR(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl, char *cname);
 int dns_get_PTR(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, char *cname, int cname_size);
-int dns_add_AAAA(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl,
+int dns_add_AAAA(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl,
 				 unsigned char addr[DNS_RR_AAAA_LEN]);
 int dns_get_AAAA(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, unsigned char addr[DNS_RR_AAAA_LEN]);
-int dns_add_SOA(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl, struct dns_soa *soa);
+int dns_add_SOA(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl, struct dns_soa *soa);
 int dns_get_SOA(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, struct dns_soa *soa);
-int dns_add_NS(struct dns_packet *packet, dns_rr_type type, char *domain, int ttl, char *cname);
+int dns_add_NS(struct dns_packet *packet, dns_rr_type type, const char *domain, int ttl, const char *cname);
 int dns_get_NS(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl, char *cname, int cname_size);
 int dns_set_OPT_payload_size(struct dns_packet *packet, int payload_size);
@@ -223,9 +272,28 @@ int dns_get_OPT_payload_size(struct dns_packet *packet);
 int dns_add_OPT_ECS(struct dns_packet *packet, struct dns_opt_ecs *ecs);
 int dns_get_OPT_ECS(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len, struct dns_opt_ecs *ecs);
-int dns_add_OPT_TCP_KEEYALIVE(struct dns_packet *packet, unsigned short timeout);
+int dns_add_OPT_TCP_KEEPALIVE(struct dns_packet *packet, unsigned short timeout);
-int dns_get_OPT_TCP_KEEYALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
+int dns_get_OPT_TCP_KEEPALIVE(struct dns_rrs *rrs, unsigned short *opt_code, unsigned short *opt_len,
 							  unsigned short *timeout);
 int dns_add_HTTPS_start(struct dns_rr_nested *svcparam_buffer, struct dns_packet *packet,
 										  dns_rr_type type, const char *domain, int ttl, int priority,
 										  const char *target);
 int dns_HTTPS_add_raw(struct dns_rr_nested *svcparam, unsigned short key, unsigned char *value, unsigned short len);
 int dns_HTTPS_add_port(struct dns_rr_nested *svcparam, unsigned short port);
 int dns_HTTPS_add_alpn(struct dns_rr_nested *svcparam, const char *alpn);
 int dns_HTTPS_add_no_default_alpn(struct dns_rr_nested *svcparam);
 int dns_HTTPS_add_ipv4hint(struct dns_rr_nested *svcparam, unsigned char addr[][DNS_RR_A_LEN],
 											 int addr_num);
 int dns_HTTPS_add_ipv6hint(struct dns_rr_nested *svcparam, unsigned char addr[][DNS_RR_AAAA_LEN],
 											 int addr_num);
 int dns_HTTPS_add_ech(struct dns_rr_nested *svcparam, void *ech, int ech_len);
 int dns_add_HTTPS_end(struct dns_rr_nested *svcparam);
 struct dns_https_param *dns_get_HTTPS_svcparm_start(struct dns_rrs *rrs, char *domain, int maxsize, int *ttl,
 													int *priority, char *target, int target_size);
 struct dns_https_param *dns_get_HTTPS_svcparm_next(struct dns_rrs *rrs, struct dns_https_param *parm);
 /*
 * Packet operation
 */
@@ -234,4 +302,12 @@ int dns_encode(unsigned char *data, int size, struct dns_packet *packet);
 int dns_packet_init(struct dns_packet *packet, int size, struct dns_head *head);
 struct dns_update_param {
 	int id;
 	int ip_ttl;
 	int cname_ttl;
 };
 int dns_packet_update(unsigned char *data, int size, struct dns_update_param *param);
 #endif
--- a/src/dns_cache.c
+++ b/src/dns_cache.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -30,7 +30,7 @@
 #define DNS_CACHE_HITNUM_STEP_MAX 6
 struct dns_cache_head {
-	DECLARE_HASHTABLE(cache_hash, 10);
+	DECLARE_HASHTABLE(cache_hash, 16);
 	struct list_head cache_list;
 	struct list_head inactive_list;
 	atomic_t num;
@@ -128,9 +128,14 @@ enum CACHE_TYPE dns_cache_data_type(struct dns_cache_data *cache_data)
 	return cache_data->head.cache_type;
 }
-uint32_t dns_cache_get_cache_flag(struct dns_cache_data *cache_data)
+uint32_t dns_cache_get_query_flag(struct dns_cache *dns_cache)
 {
-	return cache_data->head.cache_flag;
+	return dns_cache->info.query_flag;
 }
 const char *dns_cache_get_dns_group_name(struct dns_cache *dns_cache)
 {
 	return dns_cache->info.dns_group_name;
 }
 void dns_cache_data_free(struct dns_cache_data *data)
@@ -156,12 +161,17 @@ struct dns_cache_data *dns_cache_new_data(void)
 	return (struct dns_cache_data *)cache_addr;
 }
-void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, int32_t cache_flag, char *cname, int cname_ttl)
+void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, char *cname, int cname_ttl)
 {
 	if (dns_cache == NULL) {
 		goto errout;
 	}
 	dns_cache->head.is_soa = 1;
 	if (dns_cache->head.cache_type == CACHE_TYPE_PACKET) {
 		return;
 	}
 	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache;
 	if (cache_addr == NULL) {
 		goto errout;
@@ -174,7 +184,6 @@ void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, int32_t cache_flag
 		cache_addr->addr_data.cname_ttl = cname_ttl;
 	}
 	cache_addr->head.cache_flag = cache_flag;
 	cache_addr->addr_data.soa = 1;
 	cache_addr->head.cache_type = CACHE_TYPE_ADDR;
 	cache_addr->head.size = sizeof(struct dns_cache_addr) - sizeof(struct dns_cache_data_head);
@@ -182,8 +191,8 @@ errout:
 	return;
 }
-void dns_cache_set_data_addr(struct dns_cache_data *dns_cache, uint32_t cache_flag, char *cname, int cname_ttl,
+void dns_cache_set_data_addr(struct dns_cache_data *dns_cache, char *cname, int cname_ttl, unsigned char *addr,
-							 unsigned char *addr, int addr_len)
+							 int addr_len)
 {
 	if (dns_cache == NULL) {
 		goto errout;
@@ -207,14 +216,13 @@ void dns_cache_set_data_addr(struct dns_cache_data *dns_cache, uint32_t cache_fl
 		cache_addr->addr_data.cname_ttl = cname_ttl;
 	}
 	cache_addr->head.cache_flag = cache_flag;
 	cache_addr->head.cache_type = CACHE_TYPE_ADDR;
 	cache_addr->head.size = sizeof(struct dns_cache_addr) - sizeof(struct dns_cache_data_head);
 errout:
 	return;
 }
-struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *packet, size_t packet_len)
+struct dns_cache_data *dns_cache_new_data_packet(void *packet, size_t packet_len)
 {
 	struct dns_cache_packet *cache_packet = NULL;
 	size_t data_size = 0;
@@ -229,15 +237,16 @@ struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *pack
 	}
 	memcpy(cache_packet->data, packet, packet_len);
 	memset(&cache_packet->head, 0, sizeof(cache_packet->head));
 	cache_packet->head.cache_flag = cache_flag;
 	cache_packet->head.cache_type = CACHE_TYPE_PACKET;
 	cache_packet->head.size = packet_len;
 	return (struct dns_cache_data *)cache_packet;
 }
-int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+static int _dns_cache_replace(struct dns_cache_key *cache_key, int ttl, int speed, int no_inactive, int inactive,
 							  struct dns_cache_data *cache_data)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache_data *old_cache_data = NULL;
@@ -247,9 +256,9 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	}
 	/* lookup existing cache */
-	dns_cache = dns_cache_lookup(domain, qtype);
+	dns_cache = dns_cache_lookup(cache_key);
 	if (dns_cache == NULL) {
-		return dns_cache_insert(domain, ttl, qtype, speed, cache_data);
+		return dns_cache_insert(cache_key, ttl, speed, no_inactive, cache_data);
 	}
 	if (ttl < DNS_CACHE_TTL_MIN) {
@@ -260,14 +269,24 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	pthread_mutex_lock(&dns_cache_head.lock);
 	dns_cache->del_pending = 0;
 	dns_cache->info.ttl = ttl;
-	dns_cache->info.qtype = qtype;
+	dns_cache->info.qtype = cache_key->qtype;
 	dns_cache->info.query_flag = cache_key->query_flag;
 	dns_cache->info.ttl = ttl;
 	dns_cache->info.speed = speed;
-	time(&dns_cache->info.insert_time);
+	dns_cache->info.no_inactive = no_inactive;
 	old_cache_data = dns_cache->cache_data;
 	dns_cache->cache_data = cache_data;
 	list_del_init(&dns_cache->list);
-	list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
+
 	if (inactive == 0) {
 		time(&dns_cache->info.insert_time);
 		time(&dns_cache->info.replace_time);
 		list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
 	} else {
 		time(&dns_cache->info.replace_time);
 		list_add_tail(&dns_cache->list, &dns_cache_head.inactive_list);
 	}
 	pthread_mutex_unlock(&dns_cache_head.lock);
 	dns_cache_data_free(old_cache_data);
@@ -275,18 +294,64 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	return 0;
 }
-int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_data, struct list_head *head)
+int dns_cache_replace(struct dns_cache_key *cache_key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data)
 {
 	return _dns_cache_replace(cache_key, ttl, speed, no_inactive, 0, cache_data);
 }
 int dns_cache_replace_inactive(struct dns_cache_key *cache_key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data)
 {
 	return _dns_cache_replace(cache_key, ttl, speed, no_inactive, 1, cache_data);
 }
 static void _dns_cache_remove_by_domain(struct dns_cache_key *cache_key)
 {
 	uint32_t key = 0;
 	struct dns_cache *dns_cache = NULL;
 	key = hash_string(cache_key->domain);
 	key = jhash(&cache_key->qtype, sizeof(cache_key->qtype), key);
 	key = hash_string_initval(cache_key->dns_group_name, key);
 	key = jhash(&cache_key->query_flag, sizeof(cache_key->query_flag), key);
 	pthread_mutex_lock(&dns_cache_head.lock);
 	hash_for_each_possible(dns_cache_head.cache_hash, dns_cache, node, key)
 	{
 		if (dns_cache->info.qtype != cache_key->qtype) {
 			continue;
 		}
 		if (dns_cache->info.query_flag != cache_key->query_flag) {
 			continue;
 		}
 		if (strncmp(cache_key->domain, dns_cache->info.domain, DNS_MAX_CNAME_LEN) != 0) {
 			continue;
 		}
 		if (strncmp(dns_cache->info.dns_group_name, cache_key->dns_group_name, DNS_GROUP_NAME_LEN) != 0) {
 			continue;
 		}
 		_dns_cache_remove(dns_cache);
 		break;
 	}
 	pthread_mutex_unlock(&dns_cache_head.lock);
 }
 static int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_data, struct list_head *head)
 {
 	uint32_t key = 0;
 	struct dns_cache *dns_cache = NULL;
 	/* if cache already exists, free */
-	dns_cache = dns_cache_lookup(info->domain, info->qtype);
+	struct dns_cache_key cache_key;
-	if (dns_cache) {
+	cache_key.qtype = info->qtype;
-		dns_cache_delete(dns_cache);
+	cache_key.query_flag = info->query_flag;
-		dns_cache_release(dns_cache);
+	cache_key.domain = info->domain;
-		dns_cache = NULL;
+	cache_key.dns_group_name = info->dns_group_name;
-	}
+	_dns_cache_remove_by_domain(&cache_key);
 	dns_cache = malloc(sizeof(*dns_cache));
 	if (dns_cache == NULL) {
@@ -296,6 +361,8 @@ int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_
 	memset(dns_cache, 0, sizeof(*dns_cache));
 	key = hash_string(info->domain);
 	key = jhash(&info->qtype, sizeof(info->qtype), key);
 	key = hash_string_initval(info->dns_group_name, key);
 	key = jhash(&info->query_flag, sizeof(info->query_flag), key);
 	atomic_set(&dns_cache->ref, 1);
 	memcpy(&dns_cache->info, info, sizeof(*info));
 	dns_cache->del_pending = 0;
@@ -307,7 +374,7 @@ int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_
 	/* Release extra cache, remove oldest cache record */
 	if (atomic_inc_return(&dns_cache_head.num) > dns_cache_head.size) {
-		struct dns_cache *del_cache;
+		struct dns_cache *del_cache = NULL;
 		del_cache = _dns_inactive_cache_first();
 		if (del_cache) {
 			_dns_cache_remove(del_cache);
@@ -324,11 +391,11 @@ errout:
 	return -1;
 }
-int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+int dns_cache_insert(struct dns_cache_key *cache_key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data)
 {
 	struct dns_cache_info info;
-	if (cache_data == NULL || domain == NULL) {
+	if (cache_data == NULL || cache_key == NULL || cache_key->dns_group_name == NULL || cache_key->domain == NULL) {
 		return -1;
 	}
@@ -341,41 +408,56 @@ int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct
 		ttl = DNS_CACHE_TTL_MIN;
 	}
 	memset(&info, 0, sizeof(info));
 	info.hitnum = 3;
-	safe_strncpy(info.domain, domain, DNS_MAX_CNAME_LEN);
+	safe_strncpy(info.domain, cache_key->domain, DNS_MAX_CNAME_LEN);
-	info.qtype = qtype;
+	info.qtype = cache_key->qtype;
 	safe_strncpy(info.dns_group_name, cache_key->dns_group_name, DNS_GROUP_NAME_LEN);
 	info.query_flag = cache_key->query_flag;
 	info.ttl = ttl;
 	info.hitnum_update_add = DNS_CACHE_HITNUM_STEP;
 	info.speed = speed;
 	info.no_inactive = no_inactive;
 	time(&info.insert_time);
 	time(&info.replace_time);
 	return _dns_cache_insert(&info, cache_data, &dns_cache_head.cache_list);
 }
-struct dns_cache *dns_cache_lookup(char *domain, dns_type_t qtype)
+struct dns_cache *dns_cache_lookup(struct dns_cache_key *cache_key)
 {
 	uint32_t key = 0;
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache *dns_cache_ret = NULL;
-	time_t now;
+	time_t now = 0;
 	if (dns_cache_head.size <= 0) {
 		return NULL;
 	}
-	key = hash_string(domain);
+	key = hash_string(cache_key->domain);
-	key = jhash(&qtype, sizeof(qtype), key);
+	key = jhash(&cache_key->qtype, sizeof(cache_key->qtype), key);
 	key = hash_string_initval(cache_key->dns_group_name, key);
 	key = jhash(&cache_key->query_flag, sizeof(cache_key->query_flag), key);
 	time(&now);
 	/* find cache */
 	pthread_mutex_lock(&dns_cache_head.lock);
 	hash_for_each_possible(dns_cache_head.cache_hash, dns_cache, node, key)
 	{
-		if (dns_cache->info.qtype != qtype) {
+		if (dns_cache->info.qtype != cache_key->qtype) {
 			continue;
 		}
-		if (strncmp(domain, dns_cache->info.domain, DNS_MAX_CNAME_LEN) != 0) {
+		if (strncmp(cache_key->domain, dns_cache->info.domain, DNS_MAX_CNAME_LEN) != 0) {
 			continue;
 		}
 		if (strncmp(cache_key->dns_group_name, dns_cache->info.dns_group_name, DNS_GROUP_NAME_LEN) != 0) {
 			continue;
 		}
 		if (cache_key->query_flag != dns_cache->info.query_flag) {
 			continue;
 		}
@@ -400,7 +482,7 @@ struct dns_cache *dns_cache_lookup(char *domain, dns_type_t qtype)
 int dns_cache_get_ttl(struct dns_cache *dns_cache)
 {
-	time_t now;
+	time_t now = 0;
 	int ttl = 0;
 	time(&now);
@@ -414,7 +496,7 @@ int dns_cache_get_ttl(struct dns_cache *dns_cache)
 int dns_cache_get_cname_ttl(struct dns_cache *dns_cache)
 {
-	time_t now;
+	time_t now = 0;
 	int ttl = 0;
 	time(&now);
@@ -447,10 +529,10 @@ int dns_cache_is_soa(struct dns_cache *dns_cache)
 		return 0;
 	}
-	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache_get_data(dns_cache);
+	if (dns_cache->cache_data->head.is_soa) {
 	if (cache_addr->head.cache_type == CACHE_TYPE_ADDR && cache_addr->addr_data.soa) {
 		return 1;
 	}
 	return 0;
 }
@@ -496,12 +578,16 @@ void dns_cache_update(struct dns_cache *dns_cache)
 	pthread_mutex_unlock(&dns_cache_head.lock);
 }
-void _dns_cache_remove_expired_ttl(time_t *now)
+static void _dns_cache_remove_expired_ttl(dns_cache_callback inactive_precallback, int ttl_inactive_pre,
 										  unsigned int max_callback_num, const time_t *now)
 {
 	struct dns_cache *dns_cache = NULL;
-	struct dns_cache *tmp;
+	struct dns_cache *tmp = NULL;
 	unsigned int callback_num = 0;
 	int ttl = 0;
 	LIST_HEAD(checklist);
 	pthread_mutex_lock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &dns_cache_head.inactive_list, list)
 	{
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - *now;
@@ -509,21 +595,55 @@ void _dns_cache_remove_expired_ttl(time_t *now)
 			continue;
 		}
-		if (dns_cache_head.inactive_list_expired + ttl > 0) {
+		if (dns_cache_head.inactive_list_expired + ttl < 0) {
 			_dns_cache_remove(dns_cache);
 			continue;
 		}
-		_dns_cache_remove(dns_cache);
+		ttl = *now - dns_cache->info.replace_time;
 		if (ttl < ttl_inactive_pre || inactive_precallback == NULL) {
 			continue;
 		}
 		if (callback_num >= max_callback_num) {
 			continue;
 		}
 		if (dns_cache->del_pending == 1) {
 			continue;
 		}
 		/* If the TTL time is in the pre-timeout range, call callback function */
 		dns_cache_get(dns_cache);
 		list_add_tail(&dns_cache->check_list, &checklist);
 		dns_cache->del_pending = 1;
 		callback_num++;
 	}
 	pthread_mutex_unlock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
 	{
 		/* run inactive_precallback */
 		if (inactive_precallback) {
 			inactive_precallback(dns_cache);
 		}
 		dns_cache_release(dns_cache);
 	}
 }
-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
 						  dns_cache_callback inactive_precallback, int ttl_inactive_pre)
 {
 	struct dns_cache *dns_cache = NULL;
-	struct dns_cache *tmp;
+	struct dns_cache *tmp = NULL;
-	time_t now;
+	time_t now = 0;
 	int ttl = 0;
 	LIST_HEAD(checklist);
 	unsigned int callback_num = 0;
 	if (max_callback_num <= 0) {
 		max_callback_num = -1;
 	}
 	if (dns_cache_head.size <= 0) {
 		return;
@@ -536,35 +656,36 @@ void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - now;
 		if (ttl > 0 && ttl < ttl_pre) {
 			/* If the TTL time is in the pre-timeout range, call callback function */
-			if (callback && dns_cache->del_pending == 0) {
+			if (precallback && dns_cache->del_pending == 0 && callback_num < max_callback_num) {
 				list_add_tail(&dns_cache->check_list, &checklist);
 				dns_cache_get(dns_cache);
 				dns_cache->del_pending = 1;
 				callback_num++;
 				continue;
 			}
 		}
 		if (ttl < 0) {
-			if (dns_cache_head.enable_inactive && (dns_cache_is_soa(dns_cache) == 0)) {
+			if (dns_cache_head.enable_inactive && dns_cache->info.no_inactive == 0) {
 				_dns_cache_move_inactive(dns_cache);
 			} else {
 				_dns_cache_remove(dns_cache);
 			}
 		}
 	}
 	pthread_mutex_unlock(&dns_cache_head.lock);
 	if (dns_cache_head.enable_inactive && dns_cache_head.inactive_list_expired != 0) {
-		_dns_cache_remove_expired_ttl(&now);
+		_dns_cache_remove_expired_ttl(inactive_precallback, ttl_inactive_pre, max_callback_num, &now);
 	}
 	pthread_mutex_unlock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
 	{
 		/* run callback */
-		if (callback) {
+		if (precallback) {
-			callback(dns_cache);
+			precallback(dns_cache);
 		}
 		list_del(&dns_cache->check_list);
 		dns_cache_release(dns_cache);
 	}
 }
@@ -572,8 +693,8 @@ void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
 static int _dns_cache_read_record(int fd, uint32_t cache_number)
 {
-	int i = 0;
+	unsigned int i = 0;
-	int ret = 0;
+	ssize_t ret = 0;
 	struct dns_cache_record cache_record;
 	struct dns_cache_data_head data_head;
 	struct dns_cache_data *cache_data = NULL;
@@ -641,12 +762,18 @@ errout:
 int dns_cache_load(const char *file)
 {
 	int fd = -1;
-	int ret = 0;
+	ssize_t ret = 0;
 	off_t filesize = 0;
 	fd = open(file, O_RDONLY);
 	if (fd < 0) {
 		return 0;
 	}
 	filesize = lseek(fd, 0, SEEK_END);
 	lseek(fd, 0, SEEK_SET);
 	posix_fadvise(fd, 0, filesize, POSIX_FADV_WILLNEED | POSIX_FADV_SEQUENTIAL);
 	struct dns_cache_file cache_file;
 	ret = read(fd, &cache_file, sizeof(cache_file));
 	if (ret != sizeof(cache_file)) {
@@ -659,11 +786,12 @@ int dns_cache_load(const char *file)
 		goto errout;
 	}
-	if (strncmp(cache_file.version, __TIMESTAMP__, DNS_CACHE_VERSION_LEN) != 0) {
+	if (strncmp(cache_file.version, __TIMESTAMP__, DNS_CACHE_VERSION_LEN - 1) != 0) {
 		tlog(TLOG_WARN, "cache version is different, skip load cache.");
 		goto errout;
 	}
 	tlog(TLOG_INFO, "load cache file %s, total %d records", file, cache_file.cache_number);
 	if (_dns_cache_read_record(fd, cache_file.cache_number) != 0) {
 		goto errout;
 	}
@@ -690,7 +818,7 @@ static int _dns_cache_write_record(int fd, uint32_t *cache_number, enum CACHE_RE
 		cache_record.magic = MAGIC_CACHE_DATA;
 		cache_record.type = type;
 		memcpy(&cache_record.info, &dns_cache->info, sizeof(struct dns_cache_info));
-		int ret = write(fd, &cache_record, sizeof(cache_record));
+		ssize_t ret = write(fd, &cache_record, sizeof(cache_record));
 		if (ret != sizeof(cache_record)) {
 			tlog(TLOG_ERROR, "write cache failed, %s", strerror(errno));
 			goto errout;
@@ -698,7 +826,7 @@ static int _dns_cache_write_record(int fd, uint32_t *cache_number, enum CACHE_RE
 		struct dns_cache_data *cache_data = dns_cache->cache_data;
 		ret = write(fd, cache_data, sizeof(*cache_data) + cache_data->head.size);
-		if (ret != sizeof(*cache_data) + cache_data->head.size) {
+		if (ret != (int)sizeof(*cache_data) + cache_data->head.size) {
 			tlog(TLOG_ERROR, "write cache data failed, %s", strerror(errno));
 			goto errout;
 		}
@@ -782,7 +910,8 @@ errout:
 void dns_cache_destroy(void)
 {
 	struct dns_cache *dns_cache = NULL;
-	struct dns_cache *tmp;
+	struct dns_cache *tmp = NULL;
 	pthread_mutex_lock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &dns_cache_head.inactive_list, list)
 	{
--- a/src/dns_cache.h
+++ b/src/dns_cache.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -21,6 +21,7 @@
 #include "atomic.h"
 #include "dns.h"
 #include "dns_conf.h"
 #include "hash.h"
 #include "hashtable.h"
 #include "list.h"
@@ -31,8 +32,9 @@
 extern "C" {
 #endif
-#define DNS_CACHE_TTL_MIN 30
+#define DNS_CACHE_TTL_MIN 1
 #define DNS_CACHE_VERSION_LEN 32
 #define DNS_CACHE_GROUP_NAME_LEN 32
 #define MAGIC_NUMBER 0x6548634163536e44
 #define MAGIC_CACHE_DATA 0x44615461
@@ -48,9 +50,9 @@ enum CACHE_RECORD_TYPE {
 };
 struct dns_cache_data_head {
 	uint32_t cache_flag;
 	enum CACHE_TYPE cache_type;
-	size_t size;
+	int is_soa;
 	ssize_t size;
 };
 struct dns_cache_data {
@@ -79,12 +81,16 @@ struct dns_cache_packet {
 struct dns_cache_info {
 	char domain[DNS_MAX_CNAME_LEN];
 	dns_type_t qtype;
 	char dns_group_name[DNS_GROUP_NAME_LEN];
 	uint32_t query_flag;
 	int ttl;
 	int hitnum;
 	int speed;
 	int no_inactive;
 	int hitnum_update_add;
 	time_t insert_time;
-	dns_type_t qtype;
+	time_t replace_time;
 };
 struct dns_cache_record {
@@ -111,21 +117,32 @@ struct dns_cache_file {
 	uint32_t cache_number;
 };
 struct dns_cache_key {
 	const char *domain;
 	dns_type_t qtype;
 	const char *dns_group_name;
 	uint32_t query_flag;
 };
 enum CACHE_TYPE dns_cache_data_type(struct dns_cache_data *cache_data);
-uint32_t dns_cache_get_cache_flag(struct dns_cache_data *cache_data);
+uint32_t dns_cache_get_query_flag(struct dns_cache *dns_cache);
 const char *dns_cache_get_dns_group_name(struct dns_cache *dns_cache);
 void dns_cache_data_free(struct dns_cache_data *data);
-struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *packet, size_t packet_len);
+struct dns_cache_data *dns_cache_new_data_packet(void *packet, size_t packet_len);
 int dns_cache_init(int size, int enable_inactive, int inactive_list_expired);
-int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
+int dns_cache_replace(struct dns_cache_key *key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data);
-int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
+int dns_cache_replace_inactive(struct dns_cache_key *key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data);
-struct dns_cache *dns_cache_lookup(char *domain, dns_type_t qtype);
+int dns_cache_insert(struct dns_cache_key *key, int ttl, int speed, int no_inactive, struct dns_cache_data *cache_data);
 struct dns_cache *dns_cache_lookup(struct dns_cache_key *key);
 void dns_cache_delete(struct dns_cache *dns_cache);
@@ -137,9 +154,10 @@ int dns_cache_hitnum_dec_get(struct dns_cache *dns_cache);
 void dns_cache_update(struct dns_cache *dns_cache);
-typedef void dns_cache_preinvalid_callback(struct dns_cache *dns_cache);
+typedef void dns_cache_callback(struct dns_cache *dns_cache);
-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre);
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
 						  dns_cache_callback inactive_precallback, int ttl_inactive_pre);
 int dns_cache_get_ttl(struct dns_cache *dns_cache);
@@ -151,10 +169,10 @@ struct dns_cache_data *dns_cache_new_data(void);
 struct dns_cache_data *dns_cache_get_data(struct dns_cache *dns_cache);
-void dns_cache_set_data_addr(struct dns_cache_data *dns_cache, uint32_t cache_flag, char *cname, int cname_ttl,
+void dns_cache_set_data_addr(struct dns_cache_data *dns_cache, char *cname, int cname_ttl, unsigned char *addr,
-							 unsigned char *addr, int addr_len);
+							 int addr_len);
-void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, int32_t cache_flag, char *cname, int cname_ttl);
+void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, char *cname, int cname_ttl);
 void dns_cache_destroy(void);
--- a/src/dns_client.c
+++ b/src/dns_client.c
--- a/src/dns_client.h
+++ b/src/dns_client.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -47,17 +47,41 @@ typedef enum dns_result_type {
 #define DNSSERVER_FLAG_CHECK_EDNS (0x1 << 2)
 #define DNSSERVER_FLAG_CHECK_TTL (0x1 << 3)
 #define DNS_QUEY_OPTION_ECS_DNS (1 << 0)
 #define DNS_QUEY_OPTION_ECS_IP (1 << 1)
 int dns_client_init(void);
 int dns_client_set_ecs(char *ip, int subnet);
 struct dns_server_info;
 /* query result notify function */
-typedef int (*dns_client_callback)(char *domain, dns_result_type rtype, unsigned int result_flag,
+typedef int (*dns_client_callback)(const char *domain, dns_result_type rtype, struct dns_server_info *server_info,
 								   struct dns_packet *packet, unsigned char *inpacket, int inpacket_len,
 								   void *user_ptr);
 unsigned int dns_client_server_result_flag(struct dns_server_info *server_info);
 const char *dns_client_get_server_ip(struct dns_server_info *server_info);
 int dns_client_get_server_port(struct dns_server_info *server_info);
 dns_server_type_t dns_client_get_server_type(struct dns_server_info *server_info);
 struct dns_query_ecs_ip {
 	char ip[DNS_MAX_CNAME_LEN];
 	int subnet;
 };
 struct dns_query_options {
 	unsigned long long enable_flag;
 	struct dns_opt_ecs ecs_dns;
 	struct dns_query_ecs_ip ecs_ip;
 };
 /* query domain */
-int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name);
+int dns_client_query(const char *domain, int qtype, dns_client_callback callback, void *user_ptr,
 					 const char *group_name, struct dns_query_options *options);
 void dns_client_exit(void);
@@ -78,6 +102,7 @@ struct client_dns_server_flag_https {
 	int spi_len;
 	char hostname[DNS_MAX_CNAME_LEN];
 	char httphost[DNS_MAX_CNAME_LEN];
 	char proxyname[DNS_MAX_CNAME_LEN];
 	char path[DNS_MAX_CNAME_LEN];
 	char tls_host_verify[DNS_MAX_CNAME_LEN];
 	char skip_check_cert;
@@ -87,7 +112,9 @@ struct client_dns_server_flags {
 	dns_server_type_t type;
 	unsigned int server_flag;
 	unsigned int result_flag;
-
+	long long set_mark;
 	int drop_packet_latency_ms;
 	char proxyname[DNS_MAX_CNAME_LEN];
 	union {
 		struct client_dns_server_flag_udp udp;
 		struct client_dns_server_flag_tls tls;
@@ -104,13 +131,13 @@ int dns_client_add_server(char *server_ip, int port, dns_server_type_t server_ty
 /* remove remote dns server */
 int dns_client_remove_server(char *server_ip, int port, dns_server_type_t server_type);
-int dns_client_add_group(char *group_name);
+int dns_client_add_group(const char *group_name);
-int dns_client_add_to_group(char *group_name, char *server_ip, int port, dns_server_type_t server_type);
+int dns_client_add_to_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type);
-int dns_client_remove_from_group(char *group_name, char *server_ip, int port, dns_server_type_t server_type);
+int dns_client_remove_from_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type);
-int dns_client_remove_group(char *group_name);
+int dns_client_remove_group(const char *group_name);
 int dns_server_num(void);
--- a/src/dns_conf.c
+++ b/src/dns_conf.c
--- a/src/dns_conf.h
+++ b/src/dns_conf.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -20,12 +20,14 @@
 #define _DNS_CONF
 #include "art.h"
 #include "atomic.h"
 #include "conf.h"
 #include "dns.h"
 #include "dns_client.h"
 #include "hash.h"
 #include "hashtable.h"
 #include "list.h"
 #include "proxy.h"
 #include "radix.h"
 #ifdef __cpluscplus
@@ -35,10 +37,19 @@ extern "C" {
 #define DNS_MAX_BIND_IP 16
 #define DNS_MAX_SERVERS 64
 #define DNS_MAX_SERVER_NAME_LEN 128
 #define DNS_MAX_PTR_LEN 128
 #define DNS_MAX_IPSET_NAMELEN 32
 #define DNS_MAX_NFTSET_FAMILYLEN 8
 #define DNS_MAX_NFTSET_NAMELEN 256
 #define DNS_GROUP_NAME_LEN 32
 #define PROXY_NAME_LEN 32
 #define PROXY_MAX_SERVERS 128
 #define DNS_NAX_GROUP_NUMBER 16
 #define DNS_MAX_IPLEN 64
 #define DNS_PROXY_MAX_LEN 128
 #define DNS_CONF_USERNAME_LEN 32
 #define DNS_MAX_SPKI_LEN 64
 #define DNS_MAX_URL_LEN 256
 #define DNS_MAX_PATH 1024
@@ -47,9 +58,10 @@ extern "C" {
 #define DEFAULT_DNS_HTTPS_PORT 443
 #define DNS_MAX_CONF_CNAME_LEN 256
 #define SMARTDNS_CONF_FILE "/etc/smartdns/smartdns.conf"
-#define SMARTDNS_LOG_FILE "/var/log/smartdns.log"
+#define SMARTDNS_LOG_FILE "/var/log/smartdns/smartdns.log"
-#define SMARTDNS_AUDIT_FILE "/var/log/smartdns-audit.log"
+#define SMARTDNS_AUDIT_FILE "/var/log/smartdns/smartdns-audit.log"
 #define SMARTDNS_CACHE_FILE "/tmp/smartdns.cache"
 #define SMARTDNS_DEBUG_DIR "/tmp/smartdns"
 enum domain_rule {
 	DOMAIN_RULE_FLAGS = 0,
@@ -58,8 +70,12 @@ enum domain_rule {
 	DOMAIN_RULE_IPSET,
 	DOMAIN_RULE_IPSET_IPV4,
 	DOMAIN_RULE_IPSET_IPV6,
 	DOMAIN_RULE_NFTSET_IP,
 	DOMAIN_RULE_NFTSET_IP6,
 	DOMAIN_RULE_NAMESERVER,
 	DOMAIN_RULE_CHECKSPEED,
 	DOMAIN_RULE_CNAME,
 	DOMAIN_RULE_TTL,
 	DOMAIN_RULE_MAX,
 };
@@ -72,7 +88,7 @@ typedef enum {
 #define DOMAIN_CHECK_NONE 0
 #define DOMAIN_CHECK_ICMP 1
 #define DOMAIN_CHECK_TCP 2
-#define DOMAIN_CHECK_NUM 2
+#define DOMAIN_CHECK_NUM 3
 #define DOMAIN_FLAG_ADDR_SOA (1 << 0)
 #define DOMAIN_FLAG_ADDR_IPV4_SOA (1 << 1)
@@ -85,6 +101,12 @@ typedef enum {
 #define DOMAIN_FLAG_IPSET_IPV6_IGN (1 << 8)
 #define DOMAIN_FLAG_NAMESERVER_IGNORE (1 << 9)
 #define DOMAIN_FLAG_DUALSTACK_SELECT (1 << 10)
 #define DOMAIN_FLAG_SMARTDNS_DOMAIN (1 << 11)
 #define DOMAIN_FLAG_NFTSET_INET_IGN (1 << 12)
 #define DOMAIN_FLAG_NFTSET_IP_IGN (1 << 13)
 #define DOMAIN_FLAG_NFTSET_IP6_IGN (1 << 14)
 #define DOMAIN_FLAG_NO_SERVE_EXPIRED (1 << 15)
 #define DOMAIN_FLAG_CNAME_IGN (1 << 16)
 #define SERVER_FLAG_EXCLUDE_DEFAULT (1 << 0)
@@ -97,17 +119,26 @@ typedef enum {
 #define BIND_FLAG_NO_CACHE (1 << 6)
 #define BIND_FLAG_NO_DUALSTACK_SELECTION (1 << 7)
 #define BIND_FLAG_FORCE_AAAA_SOA (1 << 8)
 #define BIND_FLAG_NO_RULE_CNAME (1 << 9)
 struct dns_rule {
 	atomic_t refcnt;
 	enum domain_rule rule;
 };
 struct dns_rule_flags {
 	struct dns_rule head;
 	unsigned int flags;
 	unsigned int is_flag_set;
 };
-struct dns_address_IPV4 {
+struct dns_rule_address_IPV4 {
 	struct dns_rule head;
 	unsigned char ipv4_addr[DNS_RR_A_LEN];
 };
-struct dns_address_IPV6 {
+struct dns_rule_address_IPV6 {
 	struct dns_rule head;
 	unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
 };
@@ -117,14 +148,62 @@ struct dns_ipset_name {
 };
 struct dns_ipset_rule {
 	struct dns_rule head;
 	const char *ipsetname;
 };
 struct dns_ipset_names {
 	char ipv4_enable;
 	char ipv6_enable;
 	struct dns_ipset_rule ipv4;
 	struct dns_ipset_rule ipv6;
 };
 extern struct dns_ipset_names dns_conf_ipset_no_speed;
 struct dns_cname_rule {
 	struct dns_rule head;
 	char cname[DNS_MAX_CNAME_LEN];
 };
 struct dns_ttl_rule {
 	struct dns_rule head;
 	int ttl;
 	int ttl_max;
 	int ttl_min;
 };
 struct dns_nftset_name {
 	struct hlist_node node;
 	char nftfamilyname[DNS_MAX_NFTSET_FAMILYLEN];
 	char nfttablename[DNS_MAX_NFTSET_NAMELEN];
 	char nftsetname[DNS_MAX_NFTSET_NAMELEN];
 };
 struct dns_nftset_rule {
 	struct dns_rule head;
 	const char *familyname;
 	const char *nfttablename;
 	const char *nftsetname;
 };
 struct dns_nftset_names {
 	char inet_enable;
 	char ip_enable;
 	char ip6_enable;
 	struct dns_nftset_rule inet;
 	struct dns_nftset_rule ip;
 	struct dns_nftset_rule ip6;
 };
 extern struct dns_nftset_names dns_conf_nftset_no_speed;
 struct dns_domain_rule {
-	void *rules[DOMAIN_RULE_MAX];
+	struct dns_rule head;
 	struct dns_rule *rules[DOMAIN_RULE_MAX];
 	int is_sub_rule[DOMAIN_RULE_MAX];
 };
 struct dns_nameserver_rule {
 	struct dns_rule head;
 	const char *group_name;
 };
@@ -136,15 +215,65 @@ struct dns_server_groups {
 };
 struct dns_domain_check_order {
-	char order[DOMAIN_CHECK_NUM];
+	char type;
 	unsigned short tcp_port;
 };
 struct dns_domain_check_orders {
 	struct dns_rule head;
 	struct dns_domain_check_order orders[DOMAIN_CHECK_NUM];
 };
 struct dns_group_table {
 	DECLARE_HASHTABLE(group, 8);
 };
 extern struct dns_group_table dns_group_table;
 struct dns_ptr {
 	struct hlist_node node;
 	char ptr_domain[DNS_MAX_PTR_LEN];
 	char hostname[DNS_MAX_CNAME_LEN];
 };
 struct dns_ptr_table {
 	DECLARE_HASHTABLE(ptr, 16);
 };
 extern struct dns_ptr_table dns_ptr_table;
 typedef enum dns_hosts_type {
 	DNS_HOST_TYPE_HOST = 0,
 	DNS_HOST_TYPE_DNSMASQ = 1,
 } dns_hosts_type;
 struct dns_hosts {
 	struct hlist_node node;
 	char domain[DNS_MAX_CNAME_LEN];
 	dns_hosts_type host_type;
 	int dns_type;
 	int is_soa;
 	union {
 		unsigned char ipv4_addr[DNS_RR_A_LEN];
 		unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
 	};
 };
 struct dns_hosts_table {
 	DECLARE_HASHTABLE(hosts, 16);
 };
 extern struct dns_hosts_table dns_hosts_table;
 extern int dns_hosts_record_num;
 struct dns_proxy_names {
 	struct hlist_node node;
 	char proxy_name[PROXY_NAME_LEN];
 	struct list_head server_list;
 };
 struct dns_proxy_table {
 	DECLARE_HASHTABLE(proxy, 4);
 };
 extern struct dns_proxy_table dns_proxy_table;
 struct dns_servers {
 	char server[DNS_MAX_IPLEN];
 	unsigned short port;
@@ -152,12 +281,25 @@ struct dns_servers {
 	unsigned int server_flag;
 	int ttl;
 	dns_server_type_t type;
 	long long set_mark;
 	unsigned int drop_packet_latency_ms;
 	char skip_check_cert;
 	char spki[DNS_MAX_SPKI_LEN];
 	char hostname[DNS_MAX_CNAME_LEN];
 	char httphost[DNS_MAX_CNAME_LEN];
 	char tls_host_verify[DNS_MAX_CNAME_LEN];
 	char path[DNS_MAX_URL_LEN];
 	char proxyname[PROXY_NAME_LEN];
 };
 struct dns_proxy_servers {
 	struct list_head list;
 	char server[DNS_MAX_IPLEN];
 	proxy_type_t type;
 	unsigned short port;
 	char username[DNS_PROXY_MAX_LEN];
 	char password[DNS_PROXY_MAX_LEN];
 	int use_domain;
 };
 /* ip address lists of domain */
@@ -213,6 +355,52 @@ struct dns_qtype_soa_table {
 };
 extern struct dns_qtype_soa_table dns_qtype_soa_table;
 struct dns_domain_set_rule {
 	struct list_head list;
 	enum domain_rule type;
 	void *rule;
 	unsigned int flags;
 	unsigned int is_clear_flag;
 };
 enum dns_domain_set_type {
 	DNS_DOMAIN_SET_LIST = 0,
 	DNS_DOMAIN_SET_GEOSITE = 1,
 };
 struct dns_domain_set_name {
 	struct list_head list;
 	enum dns_domain_set_type type;
 	char file[DNS_MAX_PATH];
 };
 struct dns_domain_set_name_list {
 	struct hlist_node node;
 	char name[DNS_MAX_CNAME_LEN];
 	struct list_head set_name_list;
 };
 struct dns_domain_set_name_table {
 	DECLARE_HASHTABLE(names, 4);
 };
 extern struct dns_domain_set_name_table dns_domain_set_name_table;
 struct dns_set_rule_add_callback_args {
 	enum domain_rule type;
 	void *rule;
 };
 struct dns_set_rule_flags_callback_args {
 	unsigned int flags;
 	int is_clear_flag;
 };
 struct dns_dns64 {
 	unsigned char prefix[DNS_RR_AAAA_LEN];
 	uint32_t prefix_len;
 };
 extern struct dns_dns64 dns_conf_dns_dns64;
 extern struct dns_bind_ip dns_conf_bind_ip[DNS_MAX_BIND_IP];
 extern int dns_conf_bind_ip_num;
@@ -221,14 +409,20 @@ extern int dns_conf_cachesize;
 extern int dns_conf_prefetch;
 extern int dns_conf_serve_expired;
 extern int dns_conf_serve_expired_ttl;
 extern int dns_conf_serve_expired_prefetch_time;
 extern int dns_conf_serve_expired_reply_ttl;
 extern struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 extern int dns_conf_server_num;
 /* proxy servers */
 extern struct dns_proxy_servers dns_conf_proxy_servers[PROXY_MAX_SERVERS];
 extern int dns_conf_proxy_server_num;
 extern int dns_conf_log_level;
 extern char dns_conf_log_file[DNS_MAX_PATH];
 extern size_t dns_conf_log_size;
 extern int dns_conf_log_num;
 extern int dns_conf_log_file_mode;
 extern char dns_conf_ca_file[DNS_MAX_PATH];
 extern char dns_conf_ca_path[DNS_MAX_PATH];
@@ -236,7 +430,7 @@ extern char dns_conf_ca_path[DNS_MAX_PATH];
 extern char dns_conf_cache_file[DNS_MAX_PATH];
 extern int dns_conf_cache_persist;
-extern struct dns_domain_check_order dns_conf_check_order;
+extern struct dns_domain_check_orders dns_conf_check_orders;
 extern struct dns_server_groups dns_conf_server_groups[DNS_NAX_GROUP_NUMBER];
 extern int dns_conf_server_group_num;
@@ -246,30 +440,56 @@ extern int dns_conf_audit_log_SOA;
 extern char dns_conf_audit_file[DNS_MAX_PATH];
 extern size_t dns_conf_audit_size;
 extern int dns_conf_audit_num;
 extern int dns_conf_audit_file_mode;
 extern char dns_conf_server_name[DNS_MAX_SERVER_NAME_LEN];
 extern art_tree dns_conf_domain_rule;
 extern struct dns_conf_address_rule dns_conf_address_rule;
 extern int dns_conf_dualstack_ip_selection;
 extern int dns_conf_dualstack_ip_allow_force_AAAA;
 extern int dns_conf_dualstack_ip_selection_threshold;
 extern int dns_conf_max_reply_ip_num;
 enum response_mode_type {
 	DNS_RESPONSE_MODE_FIRST_PING_IP = 0,
 	DNS_RESPONSE_MODE_FASTEST_IP,
 	DNS_RESPONSE_MODE_FASTEST_RESPONSE,
 };
 extern enum response_mode_type dns_conf_response_mode;
 extern int dns_conf_rr_ttl;
 extern int dns_conf_rr_ttl_reply_max;
 extern int dns_conf_rr_ttl_min;
 extern int dns_conf_rr_ttl_max;
 extern int dns_conf_force_AAAA_SOA;
 extern int dns_conf_ipset_timeout_enable;
 extern int dns_conf_nftset_timeout_enable;
 extern int dns_conf_nftset_debug_enable;
 extern int dns_conf_local_ttl;
 extern int dns_conf_force_no_cname;
 extern char dns_conf_user[DNS_CONF_USERNAME_LEN];
 extern struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 extern struct dns_edns_client_subnet dns_conf_ipv6_ecs;
 extern char dns_conf_sni_proxy_ip[DNS_MAX_IPLEN];
 extern int dns_save_fail_packet;
 extern char dns_save_fail_packet_dir[DNS_MAX_PATH];
 extern char dns_resolv_file[DNS_MAX_PATH];
 void dns_server_load_exit(void);
 int dns_server_load_conf(const char *file);
-extern int config_addtional_file(void *data, int argc, char *argv[]);
+int dns_server_check_update_hosts(void);
 struct dns_proxy_names *dns_server_get_proxy_nams(const char *proxyname);
 extern int config_additional_file(void *data, int argc, char *argv[]);
 #ifdef __cpluscplus
 }
 #endif
--- a/src/dns_server.c
+++ b/src/dns_server.c
--- a/src/dns_server.h
+++ b/src/dns_server.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -21,11 +21,20 @@
 #include "dns.h"
 #include <stdint.h>
 #include "dns_client.h"
 #ifdef __cpluscplus
 extern "C" {
 #endif
 struct dns_server_query_option {
 	uint32_t server_flags;
 	const char *dns_group_name;
 	unsigned long ecs_enable_flag;
 	struct dns_opt_ecs ecs_dns;
 	struct dns_query_ecs_ip ecs_ip;
 };
 int dns_server_init(void);
 int dns_server_run(void);
@@ -37,11 +46,12 @@ void dns_server_stop(void);
 void dns_server_exit(void);
 /* query result notify function */
-typedef int (*dns_result_callback)(char *domain, dns_rtcode_t rtcode, dns_type_t addr_type, char *ip,
+typedef int (*dns_result_callback)(const char *domain, dns_rtcode_t rtcode, dns_type_t addr_type, char *ip,
 								   unsigned int ping_time, void *user_ptr);
 /* query domain */
-int dns_server_query(char *domain, int qtype, uint32_t server_flags, dns_result_callback callback, void *user_ptr);
+int dns_server_query(const char *domain, int qtype, struct dns_server_query_option *server_query_option,
 					 dns_result_callback callback, void *user_ptr);
 #ifdef __cpluscplus
 }
--- a/src/fast_ping.c
+++ b/src/fast_ping.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -19,6 +19,7 @@
 #include "fast_ping.h"
 #include "atomic.h"
 #include "hashtable.h"
 #include "list.h"
 #include "tlog.h"
 #include "util.h"
 #include <arpa/inet.h>
@@ -36,6 +37,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/epoll.h>
 #include <sys/eventfd.h>
 #include <sys/resource.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ -60,8 +63,11 @@ struct ping_dns_head {
 	unsigned short flag;
 	unsigned short qdcount;
 	unsigned short ancount;
-	unsigned short aucount;
+	unsigned short nscount;
-	unsigned short adcount;
+	unsigned short nrcount;
 	char qd_name;
 	unsigned short q_qtype;
 	unsigned short q_qclass;
 } __attribute__((packed));
 typedef enum FAST_PING_TYPE {
@@ -97,6 +103,7 @@ struct ping_host_struct {
 	FAST_PING_TYPE type;
 	void *userptr;
 	int error;
 	fast_ping_result ping_callback;
 	char host[PING_MAX_HOSTLEN];
@@ -122,13 +129,23 @@ struct ping_host_struct {
 	struct fast_ping_packet packet;
 };
 struct fast_ping_notify_event {
 	struct list_head list;
 	struct ping_host_struct *ping_host;
 	FAST_PING_RESULT ping_result;
 	unsigned int seq;
 	int ttl;
 	struct timeval tvresult;
 };
 struct fast_ping_struct {
-	int run;
+	atomic_t run;
 	pthread_t tid;
 	pthread_mutex_t lock;
 	unsigned short ident;
 	int epoll_fd;
 	int no_unprivileged_ping;
 	int fd_icmp;
 	struct ping_host_struct icmp_host;
 	int fd_icmp6;
@@ -138,6 +155,12 @@ struct fast_ping_struct {
 	int fd_udp6;
 	struct ping_host_struct udp6_host;
 	int event_fd;
 	pthread_t notify_tid;
 	pthread_cond_t notify_cond;
 	pthread_mutex_t notify_lock;
 	struct list_head notify_event_list;
 	pthread_mutex_t map_lock;
 	DECLARE_HASHTABLE(addrmap, 6);
 };
@@ -146,10 +169,19 @@ static struct fast_ping_struct ping;
 static atomic_t ping_sid = ATOMIC_INIT(0);
 static int bool_print_log = 1;
 static void _fast_ping_host_put(struct ping_host_struct *ping_host);
 static void _fast_ping_wakeup_thread(void)
 {
 	uint64_t u = 1;
 	int unused __attribute__((unused));
 	unused = write(ping.event_fd, &u, sizeof(u));
 }
 static uint16_t _fast_ping_checksum(uint16_t *header, size_t len)
 {
 	uint32_t sum = 0;
-	int i;
+	unsigned int i = 0;
 	for (i = 0; i < len / sizeof(uint16_t); i++) {
 		sum += ntohs(header[i]);
@@ -260,13 +292,13 @@ static uint32_t _fast_ping_hash_key(unsigned int sid, struct sockaddr *addr)
 	switch (addr->sa_family) {
 	case AF_INET: {
-		struct sockaddr_in *addr_in;
+		struct sockaddr_in *addr_in = NULL;
 		addr_in = (struct sockaddr_in *)addr;
 		sin_addr = &addr_in->sin_addr.s_addr;
 		sin_addr_len = IPV4_ADDR_LEN;
 	} break;
 	case AF_INET6: {
-		struct sockaddr_in6 *addr_in6;
+		struct sockaddr_in6 *addr_in6 = NULL;
 		addr_in6 = (struct sockaddr_in6 *)addr;
 		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
 			sin_addr = addr_in6->sin6_addr.s6_addr + 12;
@@ -356,13 +388,60 @@ static void _fast_ping_close_host_sock(struct ping_host_struct *ping_host)
 	if (ping_host->fd < 0) {
 		return;
 	}
-	struct epoll_event *event;
+	struct epoll_event *event = NULL;
 	event = (struct epoll_event *)1;
 	epoll_ctl(ping.epoll_fd, EPOLL_CTL_DEL, ping_host->fd, event);
 	close(ping_host->fd);
 	ping_host->fd = -1;
 }
 static void _fast_ping_release_notify_event(struct fast_ping_notify_event *ping_notify_event)
 {
 	pthread_mutex_lock(&ping.notify_lock);
 	list_del_init(&ping_notify_event->list);
 	pthread_mutex_unlock(&ping.notify_lock);
 	if (ping_notify_event->ping_host) {
 		_fast_ping_host_put(ping_notify_event->ping_host);
 		ping_notify_event->ping_host = NULL;
 	}
 	free(ping_notify_event);
 }
 static int _fast_ping_send_notify_event(struct ping_host_struct *ping_host, FAST_PING_RESULT ping_result,
 										unsigned int seq, int ttl, struct timeval *tvresult)
 {
 	struct fast_ping_notify_event *notify_event = NULL;
 	notify_event = malloc(sizeof(struct fast_ping_notify_event));
 	if (notify_event == NULL) {
 		goto errout;
 	}
 	memset(notify_event, 0, sizeof(struct fast_ping_notify_event));
 	INIT_LIST_HEAD(&notify_event->list);
 	notify_event->seq = seq;
 	notify_event->ttl = ttl;
 	notify_event->ping_result = ping_result;
 	notify_event->tvresult = *tvresult;
 	pthread_mutex_lock(&ping.notify_lock);
 	if (list_empty(&ping.notify_event_list)) {
 		pthread_cond_signal(&ping.notify_cond);
 	}
 	list_add_tail(&notify_event->list, &ping.notify_event_list);
 	notify_event->ping_host = ping_host;
 	_fast_ping_host_get(ping_host);
 	pthread_mutex_unlock(&ping.notify_lock);
 	return 0;
 errout:
 	if (notify_event) {
 		_fast_ping_release_notify_event(notify_event);
 	}
 	return -1;
 }
 static void _fast_ping_host_put(struct ping_host_struct *ping_host)
 {
 	int ref_cnt = atomic_dec_and_test(&ping_host->ref);
@@ -385,12 +464,10 @@ static void _fast_ping_host_put(struct ping_host_struct *ping_host)
 		tv.tv_sec = 0;
 		tv.tv_usec = 0;
-		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
+		_fast_ping_send_notify_event(ping_host, PING_RESULT_END, ping_host->seq, ping_host->ttl, &tv);
 								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
 	}
-	tlog(TLOG_DEBUG, "ping end, id %d", ping_host->sid);
+	tlog(TLOG_DEBUG, "ping %s end, id %d", ping_host->host, ping_host->sid);
 	// memset(ping_host, 0, sizeof(*ping_host));
 	ping_host->type = FAST_PING_END;
 	free(ping_host);
 }
@@ -413,8 +490,7 @@ static void _fast_ping_host_remove(struct ping_host_struct *ping_host)
 		tv.tv_sec = 0;
 		tv.tv_usec = 0;
-		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
+		_fast_ping_send_notify_event(ping_host, PING_RESULT_END, ping_host->seq, ping_host->ttl, &tv);
 								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
 	}
 	_fast_ping_host_put(ping_host);
@@ -441,15 +517,15 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 	packet->msg.seq = ping_host->seq;
 	icmp6->icmp6_cksum = _fast_ping_checksum((void *)packet, sizeof(struct fast_ping_packet));
-	len = sendto(ping.fd_icmp6, &ping_host->packet, sizeof(struct fast_ping_packet), 0,
+	len = sendto(ping.fd_icmp6, &ping_host->packet, sizeof(struct fast_ping_packet), 0, &ping_host->addr,
-				 (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
+				 ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EHOSTUNREACH) {
 			goto errout;
 		}
-		if (errno == EACCES) {
+		if (errno == EACCES || errno == EPERM) {
 			if (bool_print_log == 0) {
 				goto errout;
 			}
@@ -458,7 +534,7 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -473,7 +549,7 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 {
 	struct fast_ping_packet *packet = &ping_host->packet;
 	struct icmp *icmp = &packet->icmp;
-	int len;
+	int len = 0;
 	ping_host->seq++;
 	memset(icmp, 0, sizeof(*icmp));
@@ -490,16 +566,15 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 	packet->msg.cookie = ping_host->cookie;
 	icmp->icmp_cksum = _fast_ping_checksum((void *)packet, sizeof(struct fast_ping_packet));
-	len = sendto(ping.fd_icmp, packet, sizeof(struct fast_ping_packet), 0, (struct sockaddr *)&ping_host->addr,
+	len = sendto(ping.fd_icmp, packet, sizeof(struct fast_ping_packet), 0, &ping_host->addr, ping_host->addr_len);
 				 ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -513,7 +588,7 @@ errout:
 static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 {
 	struct ping_dns_head dns_head;
-	int len;
+	int len = 0;
 	int flag = 0;
 	int fd = 0;
@@ -537,16 +612,21 @@ static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 	memset(&dns_head, 0, sizeof(dns_head));
 	dns_head.id = htons(ping_host->sid);
 	dns_head.flag = flag;
 	dns_head.qdcount = htons(1);
 	dns_head.qd_name = 0;
 	dns_head.q_qtype = htons(2); /* DNS_T_NS */
 	dns_head.q_qclass = htons(1);
 	gettimeofday(&ping_host->last, NULL);
-	len = sendto(fd, &dns_head, sizeof(dns_head), 0, (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
+	len = sendto(fd, &dns_head, sizeof(dns_head), 0, &ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(dns_head)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
 		tlog(TLOG_ERROR, "sendto %s, id %d, %s",
-			 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+			 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 			 ping_host->sid, strerror(err));
 		goto errout;
 	}
@@ -560,7 +640,7 @@ errout:
 static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 {
 	struct epoll_event event;
-	int flags;
+	int flags = 0;
 	int fd = -1;
 	int yes = 1;
 	const int priority = SOCKET_PRIORITY;
@@ -585,14 +665,14 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 	set_sock_lingertime(fd, 0);
 	ping_host->seq++;
-	if (connect(fd, (struct sockaddr *)&ping_host->addr, ping_host->addr_len) != 0) {
+	if (connect(fd, &ping_host->addr, ping_host->addr_len) != 0) {
 		if (errno != EINPROGRESS) {
 			char ping_host_name[PING_MAX_HOSTLEN];
-			if (errno == ENETUNREACH || errno == EINVAL) {
+			if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EHOSTUNREACH) {
 				goto errout;
 			}
-			if (errno == EACCES) {
+			if (errno == EACCES || errno == EPERM) {
 				if (bool_print_log == 0) {
 					goto errout;
 				}
@@ -600,7 +680,7 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 			}
 			tlog(TLOG_ERROR, "connect %s, id %d, %s",
-				 gethost_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
+				 get_host_by_addr(ping_host_name, sizeof(ping_host_name), (struct sockaddr *)&ping_host->addr),
 				 ping_host->sid, strerror(errno));
 			goto errout;
 		}
@@ -644,7 +724,10 @@ static int _fast_ping_sendping(struct ping_host_struct *ping_host)
 	ping_host->send = 1;
 	if (ret != 0) {
 		ping_host->error = errno;
 		return ret;
 	} else {
 		ping_host->error = 0;
 	}
 	return 0;
@@ -663,21 +746,46 @@ static int _fast_ping_create_icmp_sock(FAST_PING_TYPE type)
 	switch (type) {
 	case FAST_PING_ICMP:
-		fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+		if (ping.no_unprivileged_ping == 0) {
 			fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
 		} else {
 			fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
 			if (fd > 0) {
 				_fast_ping_install_filter_v4(fd);
 			}
 		}
 		if (fd < 0) {
 			if (errno == EACCES || errno == EAFNOSUPPORT) {
 				if (bool_print_log == 0) {
 					goto errout;
 				}
 				bool_print_log = 0;
 			}
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
 		_fast_ping_install_filter_v4(fd);
 		icmp_host = &ping.icmp_host;
 		break;
 	case FAST_PING_ICMP6:
-		fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+		if (ping.no_unprivileged_ping == 0) {
 			fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
 		} else {
 			fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
 			if (fd > 0) {
 				_fast_ping_install_filter_v6(fd);
 			}
 		}
 		if (fd < 0) {
 			if (errno == EACCES || errno == EAFNOSUPPORT) {
 				if (bool_print_log == 0) {
 					goto errout;
 				}
 				bool_print_log = 0;
 			}
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
 		_fast_ping_install_filter_v6(fd);
 		setsockopt(fd, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_2292HOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_HOPLIMIT, &on, sizeof(on));
@@ -696,6 +804,9 @@ static int _fast_ping_create_icmp_sock(FAST_PING_TYPE type)
 	setsockopt(fd, SOL_IP, IP_TTL, &val, sizeof(val));
 	setsockopt(fd, IPPROTO_IP, IP_TOS, &ip_tos, sizeof(ip_tos));
 	icmp_host->fd = fd;
 	icmp_host->type = type;
 	memset(&event, 0, sizeof(event));
 	event.events = EPOLLIN;
 	event.data.ptr = icmp_host;
@@ -703,12 +814,14 @@ static int _fast_ping_create_icmp_sock(FAST_PING_TYPE type)
 		goto errout;
 	}
 	icmp_host->fd = fd;
 	icmp_host->type = type;
 	return fd;
 errout:
 	close(fd);
 	if (icmp_host) {
 		icmp_host->fd = -1;
 		icmp_host->type = 0;
 	}
 	return -1;
 }
@@ -848,13 +961,15 @@ errout:
 static void _fast_ping_print_result(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 									struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-									void *userptr)
+									int error, void *userptr)
 {
 	if (result == PING_RESULT_RESPONSE) {
 		double rtt = tv->tv_sec * 1000.0 + tv->tv_usec / 1000.0;
 		tlog(TLOG_INFO, "from %15s: seq=%d ttl=%d time=%.3f\n", host, seqno, ttl, rtt);
 	} else if (result == PING_RESULT_TIMEOUT) {
 		tlog(TLOG_INFO, "from %15s: seq=%d timeout\n", host, seqno);
 	} else if (result == PING_RESULT_ERROR) {
 		tlog(TLOG_DEBUG, "from %15s: error is %s\n", host, strerror(error));
 	} else if (result == PING_RESULT_END) {
 		fast_ping_stop(ping_host);
 	}
@@ -866,7 +981,7 @@ static int _fast_ping_get_addr_by_icmp(const char *ip_str, int port, struct addr
 	struct addrinfo *gai = NULL;
 	int socktype = 0;
 	int domain = -1;
-	FAST_PING_TYPE ping_type;
+	FAST_PING_TYPE ping_type = 0;
 	int sockproto = 0;
 	char *service = NULL;
@@ -915,7 +1030,7 @@ static int _fast_ping_get_addr_by_tcp(const char *ip_str, int port, struct addri
 {
 	struct addrinfo *gai = NULL;
 	int socktype = 0;
-	FAST_PING_TYPE ping_type;
+	FAST_PING_TYPE ping_type = 0;
 	int sockproto = 0;
 	char *service = NULL;
 	char port_str[MAX_IP_LEN];
@@ -951,7 +1066,7 @@ static int _fast_ping_get_addr_by_dns(const char *ip_str, int port, struct addri
 {
 	struct addrinfo *gai = NULL;
 	int socktype = 0;
-	FAST_PING_TYPE ping_type;
+	FAST_PING_TYPE ping_type = 0;
 	int sockproto = 0;
 	char port_str[MAX_IP_LEN];
 	int domain = -1;
@@ -1028,11 +1143,11 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 {
 	struct ping_host_struct *ping_host = NULL;
 	struct addrinfo *gai = NULL;
-	uint32_t addrkey;
+	uint32_t addrkey = 0;
 	char ip_str[PING_MAX_HOSTLEN];
 	int port = -1;
 	FAST_PING_TYPE ping_type = FAST_PING_END;
-	unsigned int seed;
+	unsigned int seed = 0;
 	int ret = 0;
 	if (parse_ip(host, ip_str, &port) != 0) {
@@ -1041,7 +1156,6 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 	ret = _fast_ping_get_addr_by_type(type, ip_str, port, &gai, &ping_type);
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "get addr by type failed, host: %s", host);
 		goto errout;
 	}
@@ -1080,10 +1194,6 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 	tlog(TLOG_DEBUG, "ping %s, id = %d", host, ping_host->sid);
 	addrkey = _fast_ping_hash_key(ping_host->sid, &ping_host->addr);
 	pthread_mutex_lock(&ping.map_lock);
 	_fast_ping_host_get(ping_host);
 	hash_add(ping.addrmap, &ping_host->addr_node, addrkey);
 	pthread_mutex_unlock(&ping.map_lock);
 	_fast_ping_host_get(ping_host);
 	_fast_ping_host_get(ping_host);
@@ -1092,11 +1202,20 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 		goto errout_remove;
 	}
 	pthread_mutex_lock(&ping.map_lock);
 	_fast_ping_host_get(ping_host);
 	if (hash_empty(ping.addrmap)) {
 		_fast_ping_wakeup_thread();
 	}
 	hash_add(ping.addrmap, &ping_host->addr_node, addrkey);
 	ping_host->run = 1;
 	pthread_mutex_unlock(&ping.map_lock);
 	freeaddrinfo(gai);
 	_fast_ping_host_put(ping_host);
 	return ping_host;
 errout_remove:
 	ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_ERROR, &ping_host->addr, ping_host->addr_len,
 							 ping_host->seq, ping_host->ttl, NULL, ping_host->error, ping_host->userptr);
 	fast_ping_stop(ping_host);
 	_fast_ping_host_put(ping_host);
 	ping_host = NULL;
@@ -1136,29 +1255,31 @@ static void tv_sub(struct timeval *out, struct timeval *in)
 static struct fast_ping_packet *_fast_ping_icmp6_packet(struct ping_host_struct *ping_host, struct msghdr *msg,
 														u_char *packet_data, int data_len)
 {
-	int icmp_len;
+	int icmp_len = 0;
 	struct fast_ping_packet *packet = (struct fast_ping_packet *)packet_data;
 	struct icmp6_hdr *icmp6 = &packet->icmp6;
-	struct cmsghdr *c;
+	struct cmsghdr *c = NULL;
 	int hops = 0;
 	for (c = CMSG_FIRSTHDR(msg); c; c = CMSG_NXTHDR(msg, c)) {
-		if (c->cmsg_level != IPPROTO_IPV6)
+		if (c->cmsg_level != IPPROTO_IPV6) {
 			continue;
 		}
 		switch (c->cmsg_type) {
 		case IPV6_HOPLIMIT:
 #ifdef IPV6_2292HOPLIMIT
 		case IPV6_2292HOPLIMIT:
 #endif
-			if (c->cmsg_len < CMSG_LEN(sizeof(int)))
+			if (c->cmsg_len < CMSG_LEN(sizeof(int))) {
 				continue;
 			}
 			memcpy(&hops, CMSG_DATA(c), sizeof(hops));
 		}
 	}
 	packet->ttl = hops;
 	if (icmp6->icmp6_type != ICMP6_ECHO_REPLY) {
-		tlog(TLOG_DEBUG, "icmp6 type faild, %d:%d", icmp6->icmp6_type, ICMP6_ECHO_REPLY);
+		errno = ENETUNREACH;
 		return NULL;
 	}
@@ -1168,9 +1289,11 @@ static struct fast_ping_packet *_fast_ping_icmp6_packet(struct ping_host_struct
 		return NULL;
 	}
-	if (icmp6->icmp6_id != ping.ident) {
+	if (ping.no_unprivileged_ping) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
+		if (icmp6->icmp6_id != ping.ident) {
-		return NULL;
+			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
 			return NULL;
 		}
 	}
 	return packet;
@@ -1180,15 +1303,10 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 													   u_char *packet_data, int data_len)
 {
 	struct ip *ip = (struct ip *)packet_data;
-	struct fast_ping_packet *packet;
+	struct fast_ping_packet *packet = NULL;
-	struct icmp *icmp;
+	struct icmp *icmp = NULL;
-	int hlen;
+	int hlen = 0;
-	int icmp_len;
+	int icmp_len = 0;
 	if (ip->ip_p != IPPROTO_ICMP) {
 		tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
 		return NULL;
 	}
 	hlen = ip->ip_hl << 2;
 	packet = (struct fast_ping_packet *)(packet_data + hlen);
@@ -1202,13 +1320,20 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 	}
 	if (icmp->icmp_type != ICMP_ECHOREPLY) {
-		tlog(TLOG_DEBUG, "icmp type faild, %d:%d", icmp->icmp_type, ICMP_ECHOREPLY);
+		errno = ENETUNREACH;
 		return NULL;
 	}
-	if (icmp->icmp_id != ping.ident) {
+	if (ping.no_unprivileged_ping) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
+		if (ip->ip_p != IPPROTO_ICMP) {
-		return NULL;
+			tlog(TLOG_ERROR, "ip type failed, %d:%d", ip->ip_p, IPPROTO_ICMP);
 			return NULL;
 		}
 		if (icmp->icmp_id != ping.ident) {
 			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
 			return NULL;
 		}
 	}
 	return packet;
@@ -1241,18 +1366,18 @@ errout:
 static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct timeval *now)
 {
-	int len;
+	int len = 0;
 	u_char inpacket[ICMP_INPACKET_SIZE];
 	struct sockaddr_storage from;
-	struct ping_host_struct *recv_ping_host;
+	struct ping_host_struct *recv_ping_host = NULL;
 	struct fast_ping_packet *packet = NULL;
 	socklen_t from_len = sizeof(from);
-	uint32_t addrkey;
+	uint32_t addrkey = 0;
 	struct timeval tvresult = *now;
 	struct timeval *tvsend = NULL;
-	unsigned int sid;
+	unsigned int sid = 0;
-	unsigned int seq;
+	unsigned int seq = 0;
-	unsigned int cookie;
+	unsigned int cookie = 0;
 	struct msghdr msg;
 	struct iovec iov;
 	char ans_data[4096];
@@ -1277,8 +1402,12 @@ static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct ti
 	packet = _fast_ping_recv_packet(ping_host, &msg, inpacket, len, now);
 	if (packet == NULL) {
 		char name[PING_MAX_HOSTLEN];
 		if (errno == ENETUNREACH) {
 			goto errout;
 		}
 		tlog(TLOG_DEBUG, "recv ping packet from %s failed.",
-			 gethost_by_addr(name, sizeof(name), (struct sockaddr *)&from));
+			 get_host_by_addr(name, sizeof(name), (struct sockaddr *)&from));
 		goto errout;
 	}
@@ -1313,9 +1442,8 @@ static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct ti
 	recv_ping_host->ttl = packet->ttl;
 	tv_sub(&tvresult, tvsend);
 	if (recv_ping_host->ping_callback) {
-		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
+		_fast_ping_send_notify_event(recv_ping_host, PING_RESULT_RESPONSE, recv_ping_host->seq, recv_ping_host->ttl,
-									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
+									 &tvresult);
 									  recv_ping_host->userptr);
 	}
 	recv_ping_host->send = 0;
@@ -1348,8 +1476,7 @@ static int _fast_ping_process_tcp(struct ping_host_struct *ping_host, struct epo
 	}
 	tv_sub(&tvresult, tvsend);
 	if (ping_host->ping_callback) {
-		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_RESPONSE, &ping_host->addr,
+		_fast_ping_send_notify_event(ping_host, PING_RESULT_RESPONSE, ping_host->seq, ping_host->ttl, &tvresult);
 								 ping_host->addr_len, ping_host->seq, ping_host->ttl, &tvresult, ping_host->userptr);
 	}
 	ping_host->send = 0;
@@ -1368,20 +1495,20 @@ errout:
 static int _fast_ping_process_udp(struct ping_host_struct *ping_host, struct timeval *now)
 {
-	int len;
+	ssize_t len = 0;
 	u_char inpacket[ICMP_INPACKET_SIZE];
 	struct sockaddr_storage from;
-	struct ping_host_struct *recv_ping_host;
+	struct ping_host_struct *recv_ping_host = NULL;
 	struct ping_dns_head *dns_head = NULL;
 	socklen_t from_len = sizeof(from);
-	uint32_t addrkey;
+	uint32_t addrkey = 0;
 	struct timeval tvresult = *now;
 	struct timeval *tvsend = NULL;
-	unsigned int sid;
+	unsigned int sid = 0;
 	struct msghdr msg;
 	struct iovec iov;
 	char ans_data[4096];
-	struct cmsghdr *cmsg;
+	struct cmsghdr *cmsg = NULL;
 	int ttl = 0;
 	memset(&msg, 0, sizeof(msg));
@@ -1416,7 +1543,7 @@ static int _fast_ping_process_udp(struct ping_host_struct *ping_host, struct tim
 	from_len = msg.msg_namelen;
 	dns_head = (struct ping_dns_head *)inpacket;
-	if (len < sizeof(*dns_head)) {
+	if (len < (ssize_t)sizeof(*dns_head)) {
 		goto errout;
 	}
@@ -1443,9 +1570,8 @@ static int _fast_ping_process_udp(struct ping_host_struct *ping_host, struct tim
 	tvsend = &recv_ping_host->last;
 	tv_sub(&tvresult, tvsend);
 	if (recv_ping_host->ping_callback) {
-		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
+		_fast_ping_send_notify_event(recv_ping_host, PING_RESULT_RESPONSE, recv_ping_host->seq, recv_ping_host->ttl,
-									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
+									 &tvresult);
 									  recv_ping_host->userptr);
 	}
 	recv_ping_host->send = 0;
@@ -1491,7 +1617,7 @@ static void _fast_ping_remove_all(void)
 	struct ping_host_struct *ping_host = NULL;
 	struct ping_host_struct *ping_host_tmp = NULL;
 	struct hlist_node *tmp = NULL;
-	int i;
+	unsigned long i = 0;
 	LIST_HEAD(remove_list);
@@ -1513,11 +1639,11 @@ static void _fast_ping_period_run(void)
 	struct ping_host_struct *ping_host = NULL;
 	struct ping_host_struct *ping_host_tmp = NULL;
 	struct hlist_node *tmp = NULL;
-	int i = 0;
+	unsigned long i = 0;
 	struct timeval now;
 	struct timezone tz;
 	struct timeval interval;
-	int64_t millisecond;
+	int64_t millisecond = 0;
 	gettimeofday(&now, &tz);
 	LIST_HEAD(action);
@@ -1552,9 +1678,7 @@ static void _fast_ping_period_run(void)
 		tv_sub(&interval, &ping_host->last);
 		millisecond = interval.tv_sec * 1000 + interval.tv_usec / 1000;
 		if (millisecond >= ping_host->timeout && ping_host->send == 1) {
-			ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_TIMEOUT, &ping_host->addr,
+			_fast_ping_send_notify_event(ping_host, PING_RESULT_TIMEOUT, ping_host->seq, ping_host->ttl, &interval);
 									 ping_host->addr_len, ping_host->seq, ping_host->ttl, &interval,
 									 ping_host->userptr);
 			ping_host->send = 0;
 		}
@@ -1580,24 +1704,87 @@ static void _fast_ping_period_run(void)
 	}
 }
 static void _fast_ping_process_notify_event(struct fast_ping_notify_event *ping_notify_event)
 {
 	struct ping_host_struct *ping_host = ping_notify_event->ping_host;
 	if (ping_host == NULL) {
 		return;
 	}
 	ping_host->ping_callback(ping_host, ping_host->host, ping_notify_event->ping_result, &ping_host->addr,
 							 ping_host->addr_len, ping_notify_event->seq, ping_notify_event->ttl,
 							 &ping_notify_event->tvresult, ping_host->error, ping_host->userptr);
 }
 static void *_fast_ping_notify_worker(void *arg)
 {
 	struct fast_ping_notify_event *ping_notify_event = NULL;
 	while (atomic_read(&ping.run)) {
 		pthread_mutex_lock(&ping.notify_lock);
 		if (list_empty(&ping.notify_event_list)) {
 			pthread_cond_wait(&ping.notify_cond, &ping.notify_lock);
 		}
 		ping_notify_event = list_first_entry_or_null(&ping.notify_event_list, struct fast_ping_notify_event, list);
 		if (ping_notify_event) {
 			list_del_init(&ping_notify_event->list);
 		}
 		pthread_mutex_unlock(&ping.notify_lock);
 		if (ping_notify_event == NULL) {
 			continue;
 		}
 		_fast_ping_process_notify_event(ping_notify_event);
 		_fast_ping_release_notify_event(ping_notify_event);
 	}
 	return NULL;
 }
 static void _fast_ping_remove_all_notify_event(void)
 {
 	struct fast_ping_notify_event *notify_event = NULL;
 	struct fast_ping_notify_event *tmp = NULL;
 	list_for_each_entry_safe(notify_event, tmp, &ping.notify_event_list, list)
 	{
 		_fast_ping_process_notify_event(notify_event);
 		_fast_ping_release_notify_event(notify_event);
 	}
 }
 static void *_fast_ping_work(void *arg)
 {
 	struct epoll_event events[PING_MAX_EVENTS + 1];
-	int num;
+	int num = 0;
-	int i;
+	int i = 0;
 	unsigned long now = {0};
 	unsigned long last = {0};
 	struct timeval tvnow = {0};
 	int sleep = 100;
 	int sleep_time = 0;
 	unsigned long expect_time = 0;
 	setpriority(PRIO_PROCESS, 0, -5);
 	sleep_time = sleep;
 	now = get_tick_count() - sleep;
 	last = now;
 	expect_time = now + sleep;
-	while (ping.run) {
+	while (atomic_read(&ping.run)) {
 		now = get_tick_count();
 		if (sleep_time > 0) {
 			sleep_time -= now - last;
 			if (sleep_time <= 0) {
 				sleep_time = 0;
 			}
 		}
 		if (now >= expect_time) {
-			_fast_ping_period_run();
+			if (last != now) {
 				_fast_ping_period_run();
 			}
 			sleep_time = sleep - (now - expect_time);
 			if (sleep_time < 0) {
 				sleep_time = 0;
@@ -1605,6 +1792,13 @@ static void *_fast_ping_work(void *arg)
 			}
 			expect_time += sleep;
 		}
 		last = now;
 		pthread_mutex_lock(&ping.map_lock);
 		if (hash_empty(ping.addrmap)) {
 			sleep_time = -1;
 		}
 		pthread_mutex_unlock(&ping.map_lock);
 		num = epoll_wait(ping.epoll_fd, events, PING_MAX_EVENTS, sleep_time);
 		if (num < 0) {
@@ -1612,6 +1806,10 @@ static void *_fast_ping_work(void *arg)
 			continue;
 		}
 		if (sleep_time == -1) {
 			expect_time = get_tick_count();
 		}
 		if (num == 0) {
 			continue;
 		}
@@ -1619,6 +1817,14 @@ static void *_fast_ping_work(void *arg)
 		gettimeofday(&tvnow, NULL);
 		for (i = 0; i < num; i++) {
 			struct epoll_event *event = &events[i];
 			/* read event */
 			if (event->data.fd == ping.event_fd) {
 				uint64_t value;
 				int unused __attribute__((unused));
 				unused = read(ping.event_fd, &value, sizeof(uint64_t));
 				continue;
 			}
 			struct ping_host_struct *ping_host = (struct ping_host_struct *)event->data.ptr;
 			_fast_ping_process(ping_host, event, &tvnow);
 		}
@@ -1630,11 +1836,36 @@ static void *_fast_ping_work(void *arg)
 	return NULL;
 }
 static int _fast_ping_init_wakeup_event(void)
 {
 	int fdevent = -1;
 	fdevent = eventfd(0, EFD_CLOEXEC | EFD_NONBLOCK);
 	if (fdevent < 0) {
 		tlog(TLOG_ERROR, "create eventfd failed, %s\n", strerror(errno));
 		goto errout;
 	}
 	struct epoll_event event;
 	memset(&event, 0, sizeof(event));
 	event.events = EPOLLIN | EPOLLERR;
 	event.data.fd = fdevent;
 	if (epoll_ctl(ping.epoll_fd, EPOLL_CTL_ADD, fdevent, &event) != 0) {
 		tlog(TLOG_ERROR, "set eventfd failed, %s\n", strerror(errno));
 		goto errout;
 	}
 	ping.event_fd = fdevent;
 	return 0;
 errout:
 	return -1;
 }
 int fast_ping_init(void)
 {
 	pthread_attr_t attr;
 	int epollfd = -1;
-	int ret;
+	int ret = 0;
 	bool_print_log = 1;
 	if (ping.epoll_fd > 0) {
@@ -1652,30 +1883,67 @@ int fast_ping_init(void)
 	pthread_mutex_init(&ping.map_lock, NULL);
 	pthread_mutex_init(&ping.lock, NULL);
 	pthread_mutex_init(&ping.notify_lock, NULL);
 	pthread_cond_init(&ping.notify_cond, NULL);
 	INIT_LIST_HEAD(&ping.notify_event_list);
 	hash_init(ping.addrmap);
-	ping.epoll_fd = epollfd;
+	ping.no_unprivileged_ping = !has_unprivileged_ping();
 	ping.ident = (getpid() & 0XFFFF);
-	ping.run = 1;
+	atomic_set(&ping.run, 1);
 	ret = pthread_create(&ping.tid, &attr, _fast_ping_work, NULL);
 	if (ret != 0) {
-		tlog(TLOG_ERROR, "create ping work thread failed, %s\n", strerror(errno));
+		tlog(TLOG_ERROR, "create ping work thread failed, %s\n", strerror(ret));
 		goto errout;
 	}
 	ret = pthread_create(&ping.notify_tid, &attr, _fast_ping_notify_worker, NULL);
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "create ping notifier work thread failed, %s\n", strerror(ret));
 		goto errout;
 	}
 	ping.epoll_fd = epollfd;
 	ret = _fast_ping_init_wakeup_event();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "init wakeup event failed, %s\n", strerror(errno));
 		goto errout;
 	}
 	return 0;
 errout:
-	if (ping.tid > 0) {
+	if (ping.notify_tid) {
 		void *retval = NULL;
-		ping.run = 0;
+		atomic_set(&ping.run, 0);
-		pthread_join(ping.tid, &retval);
+		pthread_cond_signal(&ping.notify_cond);
 		pthread_join(ping.notify_tid, &retval);
 		ping.notify_tid = 0;
 	}
-	if (epollfd) {
+	if (ping.tid) {
 		void *retval = NULL;
 		atomic_set(&ping.run, 0);
 		_fast_ping_wakeup_thread();
 		pthread_join(ping.tid, &retval);
 		ping.tid = 0;
 	}
 	if (epollfd > 0) {
 		close(epollfd);
 	}
 	if (ping.event_fd) {
 		close(ping.event_fd);
 		ping.event_fd = -1;
 	}
 	pthread_cond_destroy(&ping.notify_cond);
 	pthread_mutex_destroy(&ping.notify_lock);
 	pthread_mutex_destroy(&ping.lock);
 	pthread_mutex_destroy(&ping.map_lock);
 	memset(&ping, 0, sizeof(ping));
 	return -1;
 }
@@ -1705,15 +1973,33 @@ static void _fast_ping_close_fds(void)
 void fast_ping_exit(void)
 {
-	if (ping.tid > 0) {
+	if (ping.notify_tid) {
 		void *retval = NULL;
 		atomic_set(&ping.run, 0);
 		pthread_cond_signal(&ping.notify_cond);
 		pthread_join(ping.notify_tid, &retval);
 		ping.notify_tid = 0;
 	}
 	if (ping.tid) {
 		void *ret = NULL;
-		ping.run = 0;
+		atomic_set(&ping.run, 0);
 		_fast_ping_wakeup_thread();
 		pthread_join(ping.tid, &ret);
 		ping.tid = 0;
 	}
 	if (ping.event_fd > 0) {
 		close(ping.event_fd);
 		ping.event_fd = -1;
 	}
 	_fast_ping_close_fds();
 	_fast_ping_remove_all();
 	_fast_ping_remove_all_notify_event();
 	pthread_cond_destroy(&ping.notify_cond);
 	pthread_mutex_destroy(&ping.notify_lock);
 	pthread_mutex_destroy(&ping.lock);
 	pthread_mutex_destroy(&ping.map_lock);
 }
--- a/src/fast_ping.h
+++ b/src/fast_ping.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -34,13 +34,14 @@ typedef enum {
 typedef enum {
 	PING_RESULT_RESPONSE = 1,
 	PING_RESULT_TIMEOUT = 2,
-	PING_RESULT_END = 3,
+	PING_RESULT_ERROR = 3,
 	PING_RESULT_END = 4,
 } FAST_PING_RESULT;
 struct ping_host_struct;
 typedef void (*fast_ping_result)(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 								 struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-								 void *userptr);
+								 int error, void *userptr);
 /* start ping */
 struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int count, int interval, int timeout,
--- a/src/http_parse.c
+++ b/src/http_parse.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -108,7 +108,7 @@ struct http_head_fields *http_head_first_fields(struct http_head *http_head)
 const char *http_head_get_fields_value(struct http_head *http_head, const char *name)
 {
-	unsigned long key;
+	uint32_t key;
 	struct http_head_fields *filed;
 	key = hash_string(name);
@@ -193,7 +193,7 @@ int http_head_get_data_len(struct http_head *http_head)
 static int _http_head_add_fields(struct http_head *http_head, char *name, char *value)
 {
-	unsigned long key = 0;
+	uint32_t key = 0;
 	struct http_head_fields *fields = NULL;
 	fields = malloc(sizeof(*fields));
 	if (fields == NULL) {
--- a/src/http_parse.h
+++ b/src/http_parse.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/art.h
+++ b/src/include/art.h
@@ -200,10 +200,11 @@ void *art_substring(const art_tree *t, const unsigned char *str, int str_len, un
 * @arg t The tree
 * @arg str The key
 * @arg str_len The length of the key
 * @arg is_subkey is sub key or not
 * @return NULL if the item was not found, otherwise
 * the value pointer is returned.
 */
-typedef int (*walk_func)(unsigned char *key, uint32_t key_len, void *value, void *arg);
+typedef int (*walk_func)(unsigned char *key, uint32_t key_len, int is_subkey, void *value, void *arg);
 void art_substring_walk(const art_tree *t, const unsigned char *str, int str_len, walk_func func, void *arg);
 /**
--- a/src/include/atomic.h
+++ b/src/include/atomic.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -20,6 +20,11 @@
 #ifndef _GENERIC_ATOMIC_H
 #define _GENERIC_ATOMIC_H
 #define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
 #define READ_ONCE(x) \
 ({ typeof(x) ___x = ACCESS_ONCE(x); ___x; })
 /**
 * Atomic type.
 */
@@ -35,14 +40,20 @@ typedef struct {
 *
 * Atomically reads the value of @v.
 */
-#define atomic_read(v) ((v)->counter)
+static inline int atomic_read(const atomic_t *v)
 {
 	return READ_ONCE((v)->counter);
 }
 /**
 * Set atomic variable
 * @param v pointer of type atomic_t
 * @param i required value
 */
-#define atomic_set(v,i) (((v)->counter) = (i))
+static inline void atomic_set(atomic_t *v, int i)
 {
    v->counter = i;
 }
 /**
 * Add to the atomic variable
--- a/src/include/bitmap.h
+++ b/src/include/bitmap.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/bitops.h
+++ b/src/include/bitops.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/conf.h
+++ b/src/include/conf.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -21,7 +21,7 @@
 #include <unistd.h>
-#define MAX_LINE_LEN 1024
+#define MAX_LINE_LEN 8192
 #define MAX_KEY_LEN 64
 #define CONF_INT_MAX (~(1 << 31))
 #define CONF_INT_MIN (1 << 31)
@@ -30,6 +30,7 @@
 #define CONF_RET_ERR -1
 #define CONF_RET_WARN -2
 #define CONF_RET_NOENT -3
 #define CONF_RET_BADCONF -4
 struct config_item {
 	const char *item;
@@ -48,6 +49,13 @@ struct config_item_int {
 	int max;
 };
 struct config_item_int_base {
 	int *data;
 	int min;
 	int max;
 	int base;
 };
 struct config_item_string {
 	char *data;
 	size_t size;
@@ -63,6 +71,16 @@ struct config_item_size {
 	size_t max;
 };
 struct config_enum_list {
 	char *name;
 	int id;
 };
 struct config_enum {
 	int *data;
 	struct config_enum_list *list;
 };
 #define CONF_INT(key, value, min_value, max_value)                                                                     \
 	{                                                                                                                  \
 		key, conf_int, &(struct config_item_int)                                                                       \
@@ -70,6 +88,13 @@ struct config_item_size {
 			.data = value, .min = min_value, .max = max_value                                                          \
 		}                                                                                                              \
 	}
 #define CONF_INT_BASE(key, value, min_value, max_value, base_value)                                                    \
 	{                                                                                                                  \
 		key, conf_int_base, &(struct config_item_int_base)                                                             \
 		{                                                                                                              \
 			.data = value, .min = min_value, .max = max_value, .base = base_value                                      \
 		}                                                                                                              \
 	}
 #define CONF_STRING(key, value, len_value)                                                                             \
 	{                                                                                                                  \
 		key, conf_string, &(struct config_item_string)                                                                 \
@@ -91,6 +116,15 @@ struct config_item_size {
 			.data = value, .min = min_value, .max = max_value                                                          \
 		}                                                                                                              \
 	}
 #define CONF_ENUM(key, value, enum)                                                                                    \
 	{                                                                                                                  \
 		key, conf_enum, &(struct config_enum)                                                                          \
 		{                                                                                                              \
 			.data = (int *)value, .list = (struct config_enum_list *)enum                                              \
 		}                                                                                                              \
 	}
 /*
 * func: int (*func)(void *data, int argc, char *argv[]);
 */
@@ -111,12 +145,16 @@ extern int conf_custom(const char *item, void *data, int argc, char *argv[]);
 extern int conf_int(const char *item, void *data, int argc, char *argv[]);
 extern int conf_int_base(const char *item, void *data, int argc, char *argv[]);
 extern int conf_string(const char *item, void *data, int argc, char *argv[]);
 extern int conf_yesno(const char *item, void *data, int argc, char *argv[]);
 extern int conf_size(const char *item, void *data, int argc, char *argv[]);
 extern int conf_enum(const char *item, void *data, int argc, char *argv[]);
 /*
 * Example:
 *  int num = 0;
@@ -138,4 +176,6 @@ void load_exit(void);
 const char *conf_get_conf_file(void);
 const char *conf_get_conf_fullpath(const char *path, char *fullpath, size_t path_len);
 #endif // !_GENERIC_CONF_H
--- a/src/include/findbit.h
+++ b/src/include/findbit.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/gcc_builtin.h
+++ b/src/include/gcc_builtin.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/hash.h
+++ b/src/include/hash.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -16,7 +16,6 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #ifndef _GENERIC_HASH_H
 #define _GENERIC_HASH_H
@@ -30,7 +29,7 @@
 #endif
 #ifndef BITS_PER_LONG
-# define BITS_PER_LONG __WORDSIZE
+#define BITS_PER_LONG __WORDSIZE
 #endif
 /*
@@ -39,14 +38,12 @@
 *   more efficiently than using fls() and fls64()
 * - the arch is not required to handle n==0 if implementing the fallback
 */
-static inline __attribute__((const))
+static inline __attribute__((const)) int __ilog2_u32(uint32_t n)
 int __ilog2_u32(uint32_t n)
 {
 	return fls(n) - 1;
 }
-static inline __attribute__((const))
+static inline __attribute__((const)) int __ilog2_u64(uint64_t n)
 int __ilog2_u64(uint64_t n)
 {
 	return fls64(n) - 1;
 }
@@ -61,78 +58,73 @@ int __ilog2_u64(uint64_t n)
 *
 * selects the appropriately-sized optimised version depending on sizeof(n)
 */
-#define ilog2(n)				\
+#define ilog2(n)                                                                                                       \
-(						\
+	(__builtin_constant_p(n) ? ((n) < 2              ? 0                                                               \
-	__builtin_constant_p(n) ? (		\
+								: (n) & (1ULL << 63) ? 63                                                              \
-		(n) < 2 ? 0 :			\
+								: (n) & (1ULL << 62) ? 62                                                              \
-		(n) & (1ULL << 63) ? 63 :	\
+								: (n) & (1ULL << 61) ? 61                                                              \
-		(n) & (1ULL << 62) ? 62 :	\
+								: (n) & (1ULL << 60) ? 60                                                              \
-		(n) & (1ULL << 61) ? 61 :	\
+								: (n) & (1ULL << 59) ? 59                                                              \
-		(n) & (1ULL << 60) ? 60 :	\
+								: (n) & (1ULL << 58) ? 58                                                              \
-		(n) & (1ULL << 59) ? 59 :	\
+								: (n) & (1ULL << 57) ? 57                                                              \
-		(n) & (1ULL << 58) ? 58 :	\
+								: (n) & (1ULL << 56) ? 56                                                              \
-		(n) & (1ULL << 57) ? 57 :	\
+								: (n) & (1ULL << 55) ? 55                                                              \
-		(n) & (1ULL << 56) ? 56 :	\
+								: (n) & (1ULL << 54) ? 54                                                              \
-		(n) & (1ULL << 55) ? 55 :	\
+								: (n) & (1ULL << 53) ? 53                                                              \
-		(n) & (1ULL << 54) ? 54 :	\
+								: (n) & (1ULL << 52) ? 52                                                              \
-		(n) & (1ULL << 53) ? 53 :	\
+								: (n) & (1ULL << 51) ? 51                                                              \
-		(n) & (1ULL << 52) ? 52 :	\
+								: (n) & (1ULL << 50) ? 50                                                              \
-		(n) & (1ULL << 51) ? 51 :	\
+								: (n) & (1ULL << 49) ? 49                                                              \
-		(n) & (1ULL << 50) ? 50 :	\
+								: (n) & (1ULL << 48) ? 48                                                              \
-		(n) & (1ULL << 49) ? 49 :	\
+								: (n) & (1ULL << 47) ? 47                                                              \
-		(n) & (1ULL << 48) ? 48 :	\
+								: (n) & (1ULL << 46) ? 46                                                              \
-		(n) & (1ULL << 47) ? 47 :	\
+								: (n) & (1ULL << 45) ? 45                                                              \
-		(n) & (1ULL << 46) ? 46 :	\
+								: (n) & (1ULL << 44) ? 44                                                              \
-		(n) & (1ULL << 45) ? 45 :	\
+								: (n) & (1ULL << 43) ? 43                                                              \
-		(n) & (1ULL << 44) ? 44 :	\
+								: (n) & (1ULL << 42) ? 42                                                              \
-		(n) & (1ULL << 43) ? 43 :	\
+								: (n) & (1ULL << 41) ? 41                                                              \
-		(n) & (1ULL << 42) ? 42 :	\
+								: (n) & (1ULL << 40) ? 40                                                              \
-		(n) & (1ULL << 41) ? 41 :	\
+								: (n) & (1ULL << 39) ? 39                                                              \
-		(n) & (1ULL << 40) ? 40 :	\
+								: (n) & (1ULL << 38) ? 38                                                              \
-		(n) & (1ULL << 39) ? 39 :	\
+								: (n) & (1ULL << 37) ? 37                                                              \
-		(n) & (1ULL << 38) ? 38 :	\
+								: (n) & (1ULL << 36) ? 36                                                              \
-		(n) & (1ULL << 37) ? 37 :	\
+								: (n) & (1ULL << 35) ? 35                                                              \
-		(n) & (1ULL << 36) ? 36 :	\
+								: (n) & (1ULL << 34) ? 34                                                              \
-		(n) & (1ULL << 35) ? 35 :	\
+								: (n) & (1ULL << 33) ? 33                                                              \
-		(n) & (1ULL << 34) ? 34 :	\
+								: (n) & (1ULL << 32) ? 32                                                              \
-		(n) & (1ULL << 33) ? 33 :	\
+								: (n) & (1ULL << 31) ? 31                                                              \
-		(n) & (1ULL << 32) ? 32 :	\
+								: (n) & (1ULL << 30) ? 30                                                              \
-		(n) & (1ULL << 31) ? 31 :	\
+								: (n) & (1ULL << 29) ? 29                                                              \
-		(n) & (1ULL << 30) ? 30 :	\
+								: (n) & (1ULL << 28) ? 28                                                              \
-		(n) & (1ULL << 29) ? 29 :	\
+								: (n) & (1ULL << 27) ? 27                                                              \
-		(n) & (1ULL << 28) ? 28 :	\
+								: (n) & (1ULL << 26) ? 26                                                              \
-		(n) & (1ULL << 27) ? 27 :	\
+								: (n) & (1ULL << 25) ? 25                                                              \
-		(n) & (1ULL << 26) ? 26 :	\
+								: (n) & (1ULL << 24) ? 24                                                              \
-		(n) & (1ULL << 25) ? 25 :	\
+								: (n) & (1ULL << 23) ? 23                                                              \
-		(n) & (1ULL << 24) ? 24 :	\
+								: (n) & (1ULL << 22) ? 22                                                              \
-		(n) & (1ULL << 23) ? 23 :	\
+								: (n) & (1ULL << 21) ? 21                                                              \
-		(n) & (1ULL << 22) ? 22 :	\
+								: (n) & (1ULL << 20) ? 20                                                              \
-		(n) & (1ULL << 21) ? 21 :	\
+								: (n) & (1ULL << 19) ? 19                                                              \
-		(n) & (1ULL << 20) ? 20 :	\
+								: (n) & (1ULL << 18) ? 18                                                              \
-		(n) & (1ULL << 19) ? 19 :	\
+								: (n) & (1ULL << 17) ? 17                                                              \
-		(n) & (1ULL << 18) ? 18 :	\
+								: (n) & (1ULL << 16) ? 16                                                              \
-		(n) & (1ULL << 17) ? 17 :	\
+								: (n) & (1ULL << 15) ? 15                                                              \
-		(n) & (1ULL << 16) ? 16 :	\
+								: (n) & (1ULL << 14) ? 14                                                              \
-		(n) & (1ULL << 15) ? 15 :	\
+								: (n) & (1ULL << 13) ? 13                                                              \
-		(n) & (1ULL << 14) ? 14 :	\
+								: (n) & (1ULL << 12) ? 12                                                              \
-		(n) & (1ULL << 13) ? 13 :	\
+								: (n) & (1ULL << 11) ? 11                                                              \
-		(n) & (1ULL << 12) ? 12 :	\
+								: (n) & (1ULL << 10) ? 10                                                              \
-		(n) & (1ULL << 11) ? 11 :	\
+								: (n) & (1ULL << 9)  ? 9                                                               \
-		(n) & (1ULL << 10) ? 10 :	\
+								: (n) & (1ULL << 8)  ? 8                                                               \
-		(n) & (1ULL <<  9) ?  9 :	\
+								: (n) & (1ULL << 7)  ? 7                                                               \
-		(n) & (1ULL <<  8) ?  8 :	\
+								: (n) & (1ULL << 6)  ? 6                                                               \
-		(n) & (1ULL <<  7) ?  7 :	\
+								: (n) & (1ULL << 5)  ? 5                                                               \
-		(n) & (1ULL <<  6) ?  6 :	\
+								: (n) & (1ULL << 4)  ? 4                                                               \
-		(n) & (1ULL <<  5) ?  5 :	\
+								: (n) & (1ULL << 3)  ? 3                                                               \
-		(n) & (1ULL <<  4) ?  4 :	\
+								: (n) & (1ULL << 2)  ? 2                                                               \
-		(n) & (1ULL <<  3) ?  3 :	\
+													 : 1)                                                               \
-		(n) & (1ULL <<  2) ?  2 :	\
+	 : (sizeof(n) <= 4)      ? __ilog2_u32(n)                                                                          \
-		1 ) :				\
+							 : __ilog2_u64(n))
 	(sizeof(n) <= 4) ?			\
 	__ilog2_u32(n) :			\
 	__ilog2_u64(n)				\
 )
 #if BITS_PER_LONG == 32
 #define GOLDEN_RATIO_PRIME GOLDEN_RATIO_32
@@ -219,14 +211,36 @@ static inline uint32_t hash32_ptr(const void *ptr)
 	return (uint32_t)val;
 }
-static inline unsigned long
+static inline uint32_t hash_string_initval(const char *s, uint32_t initval)
 hash_string(const char *str)
 {
-	unsigned long v = 0;
+	uint32_t h = initval;
-    const char *c;
+
-	for (c = str; *c; )
+	while (*s) {
-		v = (((v << 1) + (v >> 14)) ^ (*c++)) & 0x3fff;
+		h = h * 31 + *s;
-	return(v);
+		s++;
 	}
 	return h;
 }
 static inline uint32_t hash_string(const char *s)
 {
 	return hash_string_initval(s, 0);
 }
 static inline uint32_t hash_string_array(const char **a)
 {
 	uint32_t h = 0;
 	const char *s;
 	while ((s = *a++)) {
 		while (*s) {
 			h = h * 31 + *s;
 			s++;
 		}
 	}
 	return h;
 }
 #endif /* _GENERIC_HASH_H */
--- a/src/include/hashtable.h
+++ b/src/include/hashtable.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/jhash.h
+++ b/src/include/jhash.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/list.h
+++ b/src/include/list.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/nftset.h
+++ b/src/include/nftset.h
@@ -0,0 +1,36 @@
 /*************************************************************************
 *
 * Copyright (C) 2018-2022 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * smartdns is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #ifndef _NFTSET_H
 #define _NFTSET_H
 #ifdef __cpluscplus
 extern "C" {
 #endif
 int nftset_add(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len, unsigned long timeout);
 int nftset_del(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len);
 #ifdef __cpluscplus
 }
 #endif
 #endif // !_NFTSET_H
--- a/src/include/rbtree.h
+++ b/src/include/rbtree.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/include/stringutil.h
+++ b/src/include/stringutil.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -24,6 +24,15 @@
 static inline char *safe_strncpy(char *dest, const char *src, size_t n) 
 {
 	if (src == NULL) {
 		dest[0] = '\0';
 		return dest;
 	}
 	if (n <= 0) {
 		return NULL;
 	}
 #if __GNUC__  > 7
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wstringop-truncation"
--- a/src/lib/art.c
+++ b/src/lib/art.c
@@ -1016,7 +1016,7 @@ static void art_copy_key(art_leaf *leaf, unsigned char *key, int *key_len)
 		return;
 	}
-	len = leaf->key_len > *key_len ? *key_len : leaf->key_len;
+	len = (int)leaf->key_len > *key_len ? *key_len : (int)leaf->key_len;
 	memcpy(key, leaf->key, len);
 	*key_len = len;
 }
@@ -1090,7 +1090,7 @@ void art_substring_walk(const art_tree *t, const unsigned char *str, int str_len
            // Check if the expanded path matches
            if (!str_prefix_matches((art_leaf*)n, str, str_len)) {
                found = (art_leaf*)n;
-				stop_search = func(found->key, found->key_len, found->value, arg);
+				func(found->key, found->key_len, found->key_len != (uint32_t)str_len, found->value, arg);
 			}
            break;
        }
@@ -1103,7 +1103,7 @@ void art_substring_walk(const art_tree *t, const unsigned char *str, int str_len
            // Check if the expanded path matches
            if (!str_prefix_matches((art_leaf*)m, str, str_len)) {
                found = (art_leaf*)m;
-                stop_search = func(found->key, found->key_len, found->value, arg);
+                stop_search = func(found->key, found->key_len, found->key_len != (uint32_t)str_len, found->value, arg);
            }
    	}
--- a/src/lib/bitops.c
+++ b/src/lib/bitops.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@
 * find_next_and_bit. The differences are:
 *  - The "invert" argument, which is XORed with each fetched word before
 *    searching it for one bits.
- *  - The optional "addr2", which is anded with "addr1" if present.
+ *  - The optional "addr2", which is addr2 with "addr1" if present.
 */
 static inline unsigned long _find_next_bit(const unsigned long *addr1,
 		const unsigned long *addr2, unsigned long nbits,
--- a/src/lib/conf.c
+++ b/src/lib/conf.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -18,16 +18,56 @@
 #include "conf.h"
 #include <getopt.h>
 #include <libgen.h>
 #include <linux/limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-static const char *currrent_conf_file = NULL;
+static const char *current_conf_file = NULL;
 const char *conf_get_conf_file(void)
 {
-	return currrent_conf_file;
+	return current_conf_file;
 }
 static char *get_dir_name(char *path)
 {
 	if (strstr(path, "/") == NULL) {
 		strncpy(path, "./", PATH_MAX);
 		return path;
 	}
 	return dirname(path);
 }
 const char *conf_get_conf_fullpath(const char *path, char *fullpath, size_t path_len)
 {
 	char file_path_dir[PATH_MAX];
 	if (path_len < 1) {
 		return NULL;
 	}
 	if (path[0] == '/') {
 		strncpy(fullpath, path, path_len);
 		return fullpath;
 	}
 	strncpy(file_path_dir, conf_get_conf_file(), PATH_MAX - 1);
 	file_path_dir[PATH_MAX - 1] = 0;
 	get_dir_name(file_path_dir);
 	if (file_path_dir[0] == '\0') {
 		strncpy(fullpath, path, path_len);
 		return fullpath;
 	}
 	if (snprintf(fullpath, PATH_MAX, "%s/%s", file_path_dir, path) < 0) {
 		return NULL;
 	}
 	return fullpath;
 }
 int conf_custom(const char *item, void *data, int argc, char *argv[])
@@ -57,6 +97,27 @@ int conf_int(const char *item, void *data, int argc, char *argv[])
 	return 0;
 }
 int conf_int_base(const char *item, void *data, int argc, char *argv[])
 {
 	struct config_item_int_base *item_int = data;
 	int value = 0;
 	if (argc < 2) {
 		return -1;
 	}
 	value = strtol(argv[1], NULL, item_int->base);
 	if (value < item_int->min) {
 		value = item_int->min;
 	} else if (value > item_int->max) {
 		value = item_int->max;
 	}
 	*(item_int->data) = value;
 	return 0;
 }
 int conf_string(const char *item, void *data, int argc, char *argv[])
 {
 	struct config_item_string *item_string = data;
@@ -97,7 +158,6 @@ int conf_yesno(const char *item, void *data, int argc, char *argv[])
 int conf_size(const char *item, void *data, int argc, char *argv[])
 {
 	/* read dns cache size */
 	int base = 1;
 	size_t size = 0;
 	int num = 0;
@@ -129,7 +189,32 @@ int conf_size(const char *item, void *data, int argc, char *argv[])
 	return 0;
 }
-void conf_getopt_reset(void)
+int conf_enum(const char *item, void *data, int argc, char *argv[])
 {
 	struct config_enum *item_enum = data;
 	char *enum_name = argv[1];
 	int i = 0;
 	if (argc <= 0) {
 		return -1;
 	}
 	for (i = 0; item_enum->list[i].name != NULL; i++) {
 		if (strcmp(enum_name, item_enum->list[i].name) == 0) {
 			*(item_enum->data) = item_enum->list[i].id;
 			return 0;
 		}
 	}
 	printf("Not found config value '%s', valid value is:\n", enum_name);
 	for (i = 0; item_enum->list[i].name != NULL; i++) {
 		printf(" %s\n", item_enum->list[i].name);
 	}
 	return -1;
 }
 static void conf_getopt_reset(void)
 {
 	static struct option long_options[] = {{"-", 0, 0, 0}, {0, 0, 0, 0}};
 	int argc = 2;
@@ -144,7 +229,7 @@ void conf_getopt_reset(void)
 	optopt = 0;
 }
-int conf_parse_args(char *key, char *value, int *argc, char **argv)
+static int conf_parse_args(char *key, char *value, int *argc, char **argv)
 {
 	char *start = NULL;
 	char *ptr = value;
@@ -165,8 +250,8 @@ int conf_parse_args(char *key, char *value, int *argc, char **argv)
 			continue;
 		}
-		if (*ptr == '"' && start == NULL) {
+		if ((*ptr == '"' || *ptr == '\'') && start == NULL) {
-			sep_flag = '"';
+			sep_flag = *ptr;
 			start = NULL;
 		}
@@ -205,12 +290,9 @@ int conf_parse_args(char *key, char *value, int *argc, char **argv)
 	return 0;
 }
-void load_exit(void)
+void load_exit(void) {}
 {
 	return;
 }
-int load_conf_printf(const char *file, int lineno, int ret)
+static int load_conf_printf(const char *file, int lineno, int ret)
 {
 	if (ret != CONF_RET_OK) {
 		printf("process config file '%s' failed at line %d.", file, lineno);
@@ -224,19 +306,21 @@ int load_conf_printf(const char *file, int lineno, int ret)
 	return 0;
 }
-int load_conf_file(const char *file, struct config_item *items, conf_error_handler handler)
+static int load_conf_file(const char *file, struct config_item *items, conf_error_handler handler)
 {
 	FILE *fp = NULL;
-	char line[MAX_LINE_LEN];
+	char line[MAX_LINE_LEN + MAX_KEY_LEN];
 	char key[MAX_KEY_LEN];
 	char value[MAX_LINE_LEN];
 	int filed_num = 0;
-	int i;
+	int i = 0;
-	int argc;
+	int argc = 0;
 	char *argv[1024];
 	int ret = 0;
 	int call_ret = 0;
 	int line_no = 0;
 	int line_len = 0;
 	int read_len = 0;
 	if (handler == NULL) {
 		handler = load_conf_printf;
@@ -248,9 +332,17 @@ int load_conf_file(const char *file, struct config_item *items, conf_error_handl
 	}
 	line_no = 0;
-	while (fgets(line, MAX_LINE_LEN, fp)) {
+	while (fgets(line + line_len, MAX_LINE_LEN - line_len, fp)) {
 		line_no++;
-		filed_num = sscanf(line, "%63s %1023[^\r\n]s", key, value);
+		read_len = strnlen(line + line_len, sizeof(line));
 		if (read_len >= 2 && *(line + line_len + read_len - 2) == '\\') {
 			line_len += read_len - 2;
 			line[line_len] = '\0';
 			continue;
 		}
 		line_len = 0;
 		filed_num = sscanf(line, "%63s %8192[^\r\n]s", key, value);
 		if (filed_num <= 0) {
 			continue;
 		}
@@ -262,6 +354,7 @@ int load_conf_file(const char *file, struct config_item *items, conf_error_handl
 		/* if field format is not key = value, error */
 		if (filed_num != 2) {
 			handler(file, line_no, CONF_RET_BADCONF);
 			goto errout;
 		}
@@ -281,7 +374,7 @@ int load_conf_file(const char *file, struct config_item *items, conf_error_handl
 			conf_getopt_reset();
 			/* call item function */
-			currrent_conf_file = file;
+			current_conf_file = file;
 			call_ret = items[i].item_func(items[i].item, items[i].data, argc, argv);
 			ret = handler(file, line_no, call_ret);
 			if (ret != 0) {
--- a/src/lib/nftset.c
+++ b/src/lib/nftset.c
@@ -0,0 +1,612 @@
 /*************************************************************************
 *
 * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * smartdns is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #define _GNU_SOURCE /* See feature_test_macros(7) */
 #include "nftset.h"
 #include "../dns_conf.h"
 #include "../tlog.h"
 #include <errno.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 #include <memory.h>
 #include <poll.h>
 #include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 #ifdef NFNL_SUBSYS_NFTABLES
 #include <linux/netfilter/nf_tables.h>
 struct nlmsgreq {
 	struct nlmsghdr h;
 	struct nfgenmsg m;
 };
 enum { PAYLOAD_MAX = 2048 };
 static int nftset_fd;
 static int _nftset_get_nffamily_from_str(const char *family)
 {
 	if (strncmp(family, "inet", sizeof("inet")) == 0) {
 		return NFPROTO_INET;
 	} else if (strncmp(family, "ip", sizeof("ip")) == 0) {
 		return NFPROTO_IPV4;
 	} else if (strncmp(family, "ip6", sizeof("ip6")) == 0) {
 		return NFPROTO_IPV6;
 	} else if (strncmp(family, "arp", sizeof("arp")) == 0) {
 		return NFPROTO_ARP;
 	} else if (strncmp(family, "netdev", sizeof("netdev")) == 0) {
 		return NFPROTO_NETDEV;
 	} else if (strncmp(family, "bridge", sizeof("bridge")) == 0) {
 		return NFPROTO_BRIDGE;
 	} else if (strncmp(family, "decnet", sizeof("decnet")) == 0) {
 		return NFPROTO_DECNET;
 	} else {
 		return NFPROTO_UNSPEC;
 	}
 }
 static struct rtattr *_nftset_nlmsg_tail(struct nlmsghdr *n)
 {
 	return (struct rtattr *)((uint8_t *)n + NLMSG_ALIGN(n->nlmsg_len));
 }
 static int _nftset_addattr(struct nlmsghdr *n, int maxlen, __u16 type, const void *data, __u16 alen)
 {
 	const __u16 len = RTA_LENGTH(alen);
 	const ssize_t newlen = NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len);
 	if (newlen > maxlen) {
 		errno = ENOSPC;
 		return -1;
 	}
 	struct rtattr *attr = _nftset_nlmsg_tail(n);
 	attr->rta_len = len;
 	attr->rta_type = type;
 	void *rta_data = RTA_DATA(attr);
 	if ((data != NULL) && (alen > 0)) {
 		memcpy(rta_data, data, alen);
 	}
 	memset((uint8_t *)rta_data + alen, 0, RTA_ALIGN(len) - len);
 	n->nlmsg_len = newlen;
 	return 0;
 }
 static int _nftset_addattr_string(struct nlmsghdr *n, int maxlen, __u16 type, const char *s)
 {
 	return _nftset_addattr(n, maxlen, type, s, strlen(s) + 1);
 }
 static int __attribute__((unused)) _nftset_addattr_uint32(struct nlmsghdr *n, int maxlen, __u16 type, const uint32_t v)
 {
 	return _nftset_addattr(n, maxlen, type, &v, sizeof(uint32_t));
 }
 static int __attribute__((unused)) _nftset_addattr_uint16(struct nlmsghdr *n, int maxlen, __u16 type, const uint16_t v)
 {
 	return _nftset_addattr(n, maxlen, type, &v, sizeof(uint16_t));
 }
 static int __attribute__((unused)) _nftset_addattr_uint8(struct nlmsghdr *n, int maxlen, __u16 type, const uint8_t v)
 {
 	return _nftset_addattr(n, maxlen, type, &v, sizeof(uint8_t));
 }
 static struct rtattr *_nftset_addattr_nest(struct nlmsghdr *n, int maxlen, __u16 type)
 {
 	struct rtattr *attr = _nftset_nlmsg_tail(n);
 	if (-1 == _nftset_addattr(n, maxlen, type, NULL, 0)) {
 		return NULL;
 	}
 	return attr;
 }
 static void _nftset_addattr_nest_end(struct nlmsghdr *n, struct rtattr *nest)
 {
 	const void *tail = _nftset_nlmsg_tail(n);
 	nest->rta_len = (uint8_t *)tail - (uint8_t *)nest;
 }
 static int _nftset_start_batch(void *buf, void **nextbuf)
 {
 	struct nlmsgreq *req = (struct nlmsgreq *)buf;
 	memset(buf, 0, sizeof(struct nlmsgreq));
 	req->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 	req->h.nlmsg_flags = NLM_F_REQUEST;
 	req->h.nlmsg_type = NFNL_MSG_BATCH_BEGIN;
 	req->h.nlmsg_seq = time(NULL);
 	req->m.res_id = NFNL_SUBSYS_NFTABLES;
 	if (nextbuf) {
 		*nextbuf = (uint8_t *)buf + req->h.nlmsg_len;
 	}
 	return 0;
 }
 static int _nftset_end_batch(void *buf, void **nextbuf)
 {
 	struct nlmsgreq *req = (struct nlmsgreq *)buf;
 	memset(buf, 0, sizeof(struct nlmsgreq));
 	req->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 	req->h.nlmsg_flags = NLM_F_REQUEST;
 	req->h.nlmsg_type = NFNL_MSG_BATCH_END;
 	req->h.nlmsg_seq = time(NULL);
 	req->m.res_id = NFNL_SUBSYS_NFTABLES;
 	if (nextbuf) {
 		*nextbuf = (uint8_t *)buf + req->h.nlmsg_len;
 	}
 	return 0;
 }
 static int _nftset_socket_init(void)
 {
 	struct sockaddr_nl addr = {0};
 	addr.nl_family = AF_NETLINK;
 	addr.nl_pid = 0;
 	int fd = 0;
 	if (nftset_fd > 0) {
 		return 0;
 	}
 	fd = socket(AF_NETLINK, SOCK_DGRAM | SOCK_CLOEXEC | SOCK_NONBLOCK, NETLINK_NETFILTER);
 	if (fd < 0) {
 		return -1;
 	}
 	if (bind(fd, (struct sockaddr *)(&addr), sizeof(addr)) < 0) {
 		close(fd);
 		return -2;
 	}
 	nftset_fd = fd;
 	return 0;
 }
 static int _nftset_socket_request(void *msg, int msg_len, void *ret_msg, int ret_msg_len)
 {
 	int ret = -1;
 	struct pollfd pfds;
 	int do_recv = 0;
 	int len = 0;
 	if (_nftset_socket_init() != 0) {
 		return -1;
 	}
 	/* clear pending error message*/
 	for (;;) {
 		uint8_t buff[1024];
 		ret = recv(nftset_fd, buff, sizeof(buff), MSG_DONTWAIT);
 		if (ret < 0) {
 			break;
 		}
 	}
 	for (;;) {
 		len = send(nftset_fd, msg, msg_len, 0);
 		if (len == msg_len) {
 			break;
 		}
 		if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR) {
 			struct timespec waiter;
 			waiter.tv_sec = 0;
 			waiter.tv_nsec = 10000;
 			nanosleep(&waiter, NULL);
 			continue;
 		}
 		return -1;
 	}
 	if (ret_msg == NULL || ret_msg_len <= 0) {
 		return 0;
 	}
 	pfds.fd = nftset_fd;
 	pfds.events = POLLIN;
 	pfds.revents = 0;
 	ret = poll(&pfds, 1, 100);
 	if (ret <= 0) {
 		return -1;
 	}
 	if ((pfds.revents & POLLIN) == 0) {
 		return -1;
 	}
 	memset(ret_msg, 0, ret_msg_len);
 	len = 0;
 	for (;;) {
 		ret = recv(nftset_fd, ret_msg + len, ret_msg_len - len, 0);
 		if (ret < 0) {
 			if (errno == EAGAIN && do_recv == 1) {
 				break;
 			}
 			return -1;
 		}
 		do_recv = 1;
 		len += ret;
 		struct nlmsghdr *nlh = (struct nlmsghdr *)ret_msg;
 		if (nlh->nlmsg_type == NLMSG_ERROR) {
 			struct nlmsgerr *err = (struct nlmsgerr *)NLMSG_DATA(nlh);
 			if (err->error != 0) {
 				errno = -err->error;
 				return -1;
 			}
 			continue;
 		}
 		if (nlh->nlmsg_type & (NFNL_SUBSYS_NFTABLES << 8)) {
 			if (nlh->nlmsg_type & NLMSG_DONE) {
 				break;
 			}
 		}
 		errno = ENOTSUP;
 		return -1;
 	}
 	return 0;
 }
 static int _nftset_socket_send(void *msg, int msg_len)
 {
 	char recvbuff[1024];
 	if (dns_conf_nftset_debug_enable == 0) {
 		return _nftset_socket_request(msg, msg_len, NULL, 0);
 	}
 	return _nftset_socket_request(msg, msg_len, recvbuff, sizeof(recvbuff));
 }
 static int _nftset_get_nftset(int nffamily, const char *table_name, const char *setname, void *buf, void **nextbuf)
 {
 	struct nlmsgreq *req = (struct nlmsgreq *)buf;
 	memset(buf, 0, sizeof(struct nlmsgreq));
 	req->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 	req->h.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
 	req->h.nlmsg_type = NFNL_SUBSYS_NFTABLES << 8 | NFT_MSG_GETSET;
 	req->h.nlmsg_seq = time(NULL);
 	req->m.nfgen_family = nffamily;
 	req->m.res_id = NFNL_SUBSYS_NFTABLES;
 	req->m.version = 0;
 	struct nlmsghdr *n = &req->h;
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_SET, setname);
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_TABLE, table_name);
 	if (nextbuf) {
 		*nextbuf = (uint8_t *)buf + req->h.nlmsg_len;
 	}
 	return 0;
 }
 static int _nftset_get_flags(int nffamily, const char *tablename, const char *setname, uint32_t *flags)
 {
 	uint8_t buf[PAYLOAD_MAX];
 	uint8_t result[PAYLOAD_MAX];
 	void *next = buf;
 	int buffer_len = 0;
 	if (flags == NULL) {
 		return -1;
 	}
 	_nftset_get_nftset(nffamily, tablename, setname, next, &next);
 	buffer_len = (uint8_t *)next - buf;
 	int ret = _nftset_socket_request(buf, buffer_len, result, sizeof(result));
 	if (ret < 0) {
 		return -1;
 	}
 	struct nlmsghdr *nlh = (struct nlmsghdr *)result;
 	struct nfgenmsg *nfmsg = (struct nfgenmsg *)NLMSG_DATA(nlh);
 	struct nfattr *nfa = (struct nfattr *)NFM_NFA(nfmsg);
 	*flags = 0;
 	for (; NFA_OK(nfa, nlh->nlmsg_len); nfa = NFA_NEXT(nfa, nlh->nlmsg_len)) {
 		if (nfa->nfa_type == NFTA_SET_FLAGS) {
 			*flags = ntohl(*(uint32_t *)NFA_DATA(nfa));
 			break;
 		}
 	}
 	return 0;
 }
 static int _nftset_del_element(int nffamily, const char *table_name, const char *setname, const void *data,
 							   int data_len, const void *data_interval, int data_interval_len, void *buf,
 							   void **nextbuf)
 {
 	struct nlmsgreq *req = (struct nlmsgreq *)buf;
 	memset(buf, 0, sizeof(struct nlmsgreq));
 	req->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 	req->h.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE;
 	req->h.nlmsg_type = NFNL_SUBSYS_NFTABLES << 8 | NFT_MSG_DELSETELEM;
 	req->h.nlmsg_seq = time(NULL);
 	if (dns_conf_nftset_debug_enable) {
 		req->h.nlmsg_flags |= NLM_F_ACK;
 	}
 	req->m.nfgen_family = nffamily;
 	struct nlmsghdr *n = &req->h;
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_TABLE, table_name);
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_SET, setname);
 	struct rtattr *nest_list = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_LIST_ELEMENTS);
 	struct rtattr *nest_elem = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED);
 	struct rtattr *nest_elem_key = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_KEY);
 	_nftset_addattr(n, PAYLOAD_MAX, NFTA_DATA_VALUE, data, data_len);
 	_nftset_addattr_nest_end(n, nest_elem_key);
 	_nftset_addattr_nest_end(n, nest_elem);
 	/* interval attribute */
 	if (data_interval && data_interval_len > 0) {
 		struct rtattr *nest_interval_end = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_LIST_ELEM);
 		_nftset_addattr_uint32(n, PAYLOAD_MAX, NFTA_SET_ELEM_FLAGS, htonl(NFT_SET_ELEM_INTERVAL_END));
 		struct rtattr *nest_elem_interval_key = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_KEY);
 		_nftset_addattr(n, PAYLOAD_MAX, NFTA_DATA_VALUE, data_interval, data_interval_len);
 		_nftset_addattr_nest_end(n, nest_elem_interval_key);
 		_nftset_addattr_nest_end(n, nest_interval_end);
 	}
 	_nftset_addattr_nest_end(n, nest_list);
 	if (nextbuf) {
 		*nextbuf = (uint8_t *)buf + req->h.nlmsg_len;
 	}
 	return 0;
 }
 static int _nftset_add_element(int nffamily, const char *table_name, const char *setname, const void *data,
 							   int data_len, const void *data_interval, int data_interval_len, unsigned long timeout,
 							   void *buf, void **nextbuf)
 {
 	struct nlmsgreq *req = (struct nlmsgreq *)buf;
 	memset(buf, 0, sizeof(struct nlmsgreq));
 	req->h.nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
 	req->h.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE;
 	req->h.nlmsg_type = NFNL_SUBSYS_NFTABLES << 8 | NFT_MSG_NEWSETELEM;
 	req->h.nlmsg_seq = time(NULL);
 	if (dns_conf_nftset_debug_enable) {
 		req->h.nlmsg_flags |= NLM_F_ACK;
 	}
 	req->m.nfgen_family = nffamily;
 	struct nlmsghdr *n = &req->h;
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_TABLE, table_name);
 	_nftset_addattr_string(n, PAYLOAD_MAX, NFTA_SET_ELEM_LIST_SET, setname);
 	struct rtattr *nest_list = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_LIST_ELEMENTS);
 	struct rtattr *nest_elem = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_LIST_ELEM);
 	struct rtattr *nest_elem_key = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_KEY);
 	_nftset_addattr(n, PAYLOAD_MAX, NFTA_DATA_VALUE, data, data_len);
 	_nftset_addattr_nest_end(n, nest_elem_key);
 	if (timeout > 0) {
 		uint64_t timeout_value = htobe64(timeout * 1000);
 		_nftset_addattr(n, PAYLOAD_MAX, NFTA_SET_ELEM_TIMEOUT, &timeout_value, sizeof(timeout_value));
 	}
 	_nftset_addattr_nest_end(n, nest_elem);
 	/* interval attribute */
 	if (data_interval && data_interval_len > 0) {
 		struct rtattr *nest_interval_end = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_LIST_ELEM);
 		_nftset_addattr_uint32(n, PAYLOAD_MAX, NFTA_SET_ELEM_FLAGS, htonl(NFT_SET_ELEM_INTERVAL_END));
 		struct rtattr *nest_elem_interval_key = _nftset_addattr_nest(n, PAYLOAD_MAX, NLA_F_NESTED | NFTA_SET_ELEM_KEY);
 		_nftset_addattr(n, PAYLOAD_MAX, NFTA_DATA_VALUE, data_interval, data_interval_len);
 		_nftset_addattr_nest_end(n, nest_elem_interval_key);
 		_nftset_addattr_nest_end(n, nest_interval_end);
 	}
 	_nftset_addattr_nest_end(n, nest_list);
 	if (nextbuf) {
 		*nextbuf = (uint8_t *)buf + req->h.nlmsg_len;
 	}
 	return 0;
 }
 static int _nftset_process_setflags(uint32_t flags, const unsigned char addr[], int addr_len, unsigned long *timeout,
 									uint8_t **interval_addr, int *interval_addr_len)
 {
 	uint8_t *addr_end = *interval_addr;
 	if ((flags & NFT_SET_TIMEOUT) == 0 && timeout != NULL) {
 		*timeout = 0;
 	}
 	if ((flags & NFT_SET_INTERVAL) && addr_end != NULL) {
 		if (addr_len == 4) {
 			addr_end[0] = addr[0];
 			addr_end[1] = addr[1];
 			addr_end[2] = addr[2];
 			addr_end[3] = addr[3] + 1;
 			if (addr_end[3] == 0) {
 				return -1;
 			}
 			*interval_addr_len = 4;
 		} else if (addr_len == 16) {
 			memcpy(addr_end, addr, 16);
 			addr_end[15] = addr[15] + 1;
 			if (addr_end[15] == 0) {
 				return -1;
 			}
 			*interval_addr_len = 16;
 		}
 	} else {
 		*interval_addr = NULL;
 		*interval_addr_len = 0;
 	}
 	return 0;
 }
 static int _nftset_del(int nffamily, const char *tablename, const char *setname, const unsigned char addr[],
 					   int addr_len, const unsigned char addr_end[], int addr_end_len)
 {
 	uint8_t buf[PAYLOAD_MAX];
 	void *next = buf;
 	int buffer_len = 0;
 	_nftset_start_batch(next, &next);
 	_nftset_del_element(nffamily, tablename, setname, addr, addr_len, addr_end, addr_end_len, next, &next);
 	_nftset_end_batch(next, &next);
 	buffer_len = (uint8_t *)next - buf;
 	return _nftset_socket_send(buf, buffer_len);
 }
 int nftset_del(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len)
 {
 	int nffamily = _nftset_get_nffamily_from_str(familyname);
 	uint8_t addr_end_buff[16] = {0};
 	uint8_t *addr_end = addr_end_buff;
 	uint32_t flags = 0;
 	int addr_end_len = 0;
 	int ret = -1;
 	ret = _nftset_get_flags(nffamily, tablename, setname, &flags);
 	if (ret == 0) {
 		ret = _nftset_process_setflags(flags, addr, addr_len, 0, &addr_end, &addr_end_len);
 		if (ret != 0) {
 			return -1;
 		}
 	} else {
 		addr_end = NULL;
 		addr_end_len = 0;
 	}
 	ret = _nftset_del(nffamily, tablename, setname, addr, addr_len, addr_end, addr_end_len);
 	if (ret != 0 && errno != ENOENT) {
 		tlog(TLOG_ERROR, "nftset delete failed, family:%s, table:%s, set:%s, error:%s", familyname, tablename, setname,
 			 strerror(errno));
 	}
 	return ret;
 }
 int nftset_add(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len, unsigned long timeout)
 {
 	uint8_t buf[PAYLOAD_MAX];
 	uint8_t addr_end_buff[16] = {0};
 	uint8_t *addr_end = addr_end_buff;
 	uint32_t flags = 0;
 	int addr_end_len = 0;
 	void *next = buf;
 	int buffer_len = 0;
 	int ret = -1;
 	int nffamily = _nftset_get_nffamily_from_str(familyname);
 	if (dns_conf_nftset_timeout_enable == 0) {
 		timeout = 0;
 	}
 	ret = _nftset_get_flags(nffamily, tablename, setname, &flags);
 	if (ret == 0) {
 		ret = _nftset_process_setflags(flags, addr, addr_len, &timeout, &addr_end, &addr_end_len);
 		if (ret != 0) {
 			if (dns_conf_nftset_debug_enable) {
 				tlog(TLOG_ERROR, "nftset add failed, family:%s, table:%s, set:%s, error:%s", familyname, tablename,
 					 setname, "ip is invalid");
 			}
 			return -1;
 		}
 	} else {
 		addr_end = NULL;
 		addr_end_len = 0;
 	}
 	if (timeout > 0) {
 		_nftset_del(nffamily, tablename, setname, addr, addr_len, addr_end, addr_end_len);
 	}
 	_nftset_start_batch(next, &next);
 	_nftset_add_element(nffamily, tablename, setname, addr, addr_len, addr_end, addr_end_len, timeout, next, &next);
 	_nftset_end_batch(next, &next);
 	buffer_len = (uint8_t *)next - buf;
 	ret = _nftset_socket_send(buf, buffer_len);
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "nftset add failed, family:%s, table:%s, set:%s, error:%s", familyname, tablename, setname,
 			 strerror(errno));
 	}
 	return ret;
 }
 #else
 int nftset_add(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len, unsigned long timeout)
 {
 	return 0;
 }
 int nftset_del(const char *familyname, const char *tablename, const char *setname, const unsigned char addr[],
 			   int addr_len)
 {
 	return 0;
 }
 #endif
--- a/src/lib/radix.c
+++ b/src/lib/radix.c
@@ -87,7 +87,7 @@ comp_with_mask(unsigned char *addr, unsigned char *dest, unsigned int mask)
 {
 	if (memcmp(addr, dest, mask / 8) == 0) {
 		unsigned int n = mask / 8;
-		unsigned int m = ((~0) << (8 - (mask % 8)));
+		unsigned int m = ((unsigned int)(~0) << (8 - (mask % 8)));
 		if (mask % 8 == 0 || (addr[n] & m) == (dest[n] & m))
 			return (1);
@@ -436,8 +436,10 @@ radix_node_t
 		node->parent = new_node;
 	} else {
-		if ((glue = malloc(sizeof(*glue))) == NULL)
+		if ((glue = malloc(sizeof(*glue))) == NULL) {
 			free(new_node);
 			return (NULL);
 		}
 		memset(glue, '\0', sizeof(*glue));
 		glue->bit = differ_bit;
 		glue->prefix = NULL;
@@ -549,7 +551,7 @@ sanitise_mask(unsigned char *addr, unsigned int masklen, unsigned int maskbits)
 	unsigned int j = masklen % 8;
 	if (j != 0) {
-		addr[i] &= (~0) << (8 - j);
+		addr[i] &= (unsigned int)(~0) << (8 - j);
 		i++;
 	}
 	for (; i < maskbits / 8; i++)
--- a/src/lib/rbtree.c
+++ b/src/lib/rbtree.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/lib/stringutil.c
+++ b/src/lib/stringutil.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
--- a/src/proxy.c
+++ b/src/proxy.c
--- a/src/proxy.h
+++ b/src/proxy.h
@@ -0,0 +1,88 @@
 /*************************************************************************
 *
 * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * smartdns is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #ifndef SMART_DNS_PROXY_H
 #define SMART_DNS_PROXY_H
 #include <sys/socket.h>
 #include <sys/types.h>
 #define PROXY_MAX_IPLEN 256
 #define PROXY_MAX_NAMELEN 128
 #ifdef __cplusplus
 extern "C" {
 #endif /*__cplusplus */
 typedef enum {
 	PROXY_SOCKS5,
 	PROXY_HTTP,
 	PROXY_TYPE_END,
 } proxy_type_t;
 typedef enum {
 	PROXY_HANDSHAKE_ERR = -1,
 	PROXY_HANDSHAKE_OK = 0,
 	PROXY_HANDSHAKE_CONNECTED = 1,
 	PROXY_HANDSHAKE_WANT_READ = 2,
 	PROXY_HANDSHAKE_WANT_WRITE = 3,
 } proxy_handshake_state;
 struct proxy_info {
 	proxy_type_t type;
 	char server[PROXY_MAX_IPLEN];
 	unsigned short port;
 	int use_domain;
 	char username[PROXY_MAX_NAMELEN];
 	char password[PROXY_MAX_NAMELEN];
 };
 struct proxy_conn;
 int proxy_init(void);
 int proxy_exit(void);
 int proxy_add(const char *proxy_name, struct proxy_info *info);
 int proxy_remove(const char *proxy_name);
 struct proxy_conn *proxy_conn_new(const char *proxy_name, const char *host, int port, int is_udp);
 int proxy_conn_get_fd(struct proxy_conn *proxy_conn);
 int proxy_conn_get_udpfd(struct proxy_conn *proxy_conn);
 int proxy_conn_is_udp(struct proxy_conn *proxy_conn);
 void proxy_conn_free(struct proxy_conn *proxy_conn);
 int proxy_conn_connect(struct proxy_conn *proxy_conn);
 int proxy_conn_sendto(struct proxy_conn *proxy_conn, const void *buf, size_t len, int flags,
 					  const struct sockaddr *dest_addr, socklen_t addrlen);
 int proxy_conn_recvfrom(struct proxy_conn *proxy_conn, void *buf, size_t len, int flags, struct sockaddr *src_addr,
 						socklen_t *addrlen);
 proxy_handshake_state proxy_conn_handshake(struct proxy_conn *proxy_conn);
 #ifdef __cplusplus
 }
 #endif /*__cplusplus */
 #endif
--- a/src/smartdns.c
+++ b/src/smartdns.c
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -31,36 +31,123 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <linux/capability.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <ucontext.h>
 #define RESOLVE_FILE "/etc/resolv.conf"
 #define MAX_LINE_LEN 1024
 #define MAX_KEY_LEN 64
 #define SMARTDNS_PID_FILE "/var/run/smartdns.pid"
 #define TMP_BUFF_LEN_32 32
 static int verbose_screen;
 int capget(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
 int capset(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
 static int get_uid_gid(int *uid, int *gid)
 {
 	struct passwd *result = NULL;
 	struct passwd pwd;
 	char *buf = NULL;
 	ssize_t bufsize = 0;
 	int ret = -1;
 	if (dns_conf_user[0] == '\0') {
 		return -1;
 	}
 	bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
 	if (bufsize == -1) {
 		bufsize = 1024 * 16;
 	}
 	buf = malloc(bufsize);
 	if (buf == NULL) {
 		goto out;
 	}
 	ret = getpwnam_r(dns_conf_user, &pwd, buf, bufsize, &result);
 	if (ret != 0) {
 		goto out;
 	}
 	if (result == NULL) {
 		ret = -1;
 		goto out;
 	}
 	*uid = result->pw_uid;
 	*gid = result->pw_gid;
 out:
 	if (buf) {
 		free(buf);
 	}
 	return ret;
 }
 static int drop_root_privilege(void)
 {
 	struct __user_cap_data_struct cap[2];
 	struct __user_cap_header_struct header;
 #ifdef _LINUX_CAPABILITY_VERSION_3
 	header.version = _LINUX_CAPABILITY_VERSION_3;
 #else
 	header.version = _LINUX_CAPABILITY_VERSION;
 #endif
 	header.pid = 0;
 	int uid = 0;
 	int gid = 0;
 	int unused __attribute__((unused)) = 0;
 	if (get_uid_gid(&uid, &gid) != 0) {
 		return -1;
 	}
 	memset(cap, 0, sizeof(cap));
 	if (capget(&header, cap) < 0) {
 		return -1;
 	}
 	prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
 	for (int i = 0; i < 2; i++) {
 		cap[i].effective = (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN | 1 << CAP_NET_BIND_SERVICE);
 		cap[i].permitted = (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN | 1 << CAP_NET_BIND_SERVICE);
 	}
 	unused = setgid(gid);
 	unused = setuid(uid);
 	if (capset(&header, cap) < 0) {
 		return -1;
 	}
 	prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
 	return 0;
 }
 static void _help(void)
 {
 	/* clang-format off */
 	char *help = ""
 		"Usage: smartdns [OPTION]...\n"
 		"Start smartdns server.\n"
-		"  -f            run forground.\n"
+		"  -f            run foreground.\n"
 		"  -c [conf]     config file.\n"
-		"  -p [pid]      pid file path\n"
+		"  -p [pid]      pid file path, '-' means don't create pid file.\n"
 		"  -S            ignore segment fault signal.\n"
 		"  -x            verbose screen.\n"
-		"  -v            dispaly version.\n"
+		"  -v            display version.\n"
 		"  -h            show this help message.\n"
 		"Online help: http://pymumu.github.io/smartdns\n"
@@ -89,7 +176,7 @@ static int _smartdns_load_from_resolv(void)
 {
 	FILE *fp = NULL;
 	char line[MAX_LINE_LEN];
-	char key[MAX_KEY_LEN];
+	char key[MAX_KEY_LEN] = {0};
 	char value[MAX_LINE_LEN];
 	char ns_ip[DNS_MAX_IPLEN];
 	int port = PORT_NOT_DEFINED;
@@ -98,9 +185,9 @@ static int _smartdns_load_from_resolv(void)
 	int filed_num = 0;
 	int line_num = 0;
-	fp = fopen(RESOLVE_FILE, "r");
+	fp = fopen(dns_resolv_file, "r");
 	if (fp == NULL) {
-		tlog(TLOG_ERROR, "open %s failed, %s", RESOLVE_FILE, strerror(errno));
+		tlog(TLOG_ERROR, "open %s failed, %s", dns_resolv_file, strerror(errno));
 		return -1;
 	}
@@ -112,7 +199,7 @@ static int _smartdns_load_from_resolv(void)
 			continue;
 		}
-		if (strncmp(key, "nameserver", MAX_KEY_LEN) != 0) {
+		if (strncmp(key, "nameserver", MAX_KEY_LEN - 1) != 0) {
 			continue;
 		}
@@ -138,14 +225,14 @@ static int _smartdns_load_from_resolv(void)
 static int _smartdns_add_servers(void)
 {
-	int i = 0;
+	unsigned long i = 0;
 	int j = 0;
 	int ret = 0;
 	struct dns_server_groups *group = NULL;
 	struct dns_servers *server = NULL;
 	struct client_dns_server_flags flags;
-	for (i = 0; i < dns_conf_server_num; i++) {
+	for (i = 0; i < (unsigned int)dns_conf_server_num; i++) {
 		memset(&flags, 0, sizeof(flags));
 		switch (dns_conf_servers[i].type) {
 		case DNS_SERVER_UDP: {
@@ -181,6 +268,9 @@ static int _smartdns_add_servers(void)
 		flags.type = dns_conf_servers[i].type;
 		flags.server_flag = dns_conf_servers[i].server_flag;
 		flags.result_flag = dns_conf_servers[i].result_flag;
 		flags.set_mark = dns_conf_servers[i].set_mark;
 		flags.drop_packet_latency_ms = dns_conf_servers[i].drop_packet_latency_ms;
 		safe_strncpy(flags.proxyname, dns_conf_servers[i].proxyname, sizeof(flags.proxyname));
 		ret = dns_client_add_server(dns_conf_servers[i].server, dns_conf_servers[i].port, dns_conf_servers[i].type,
 									&flags);
 		if (ret != 0) {
@@ -213,6 +303,33 @@ static int _smartdns_add_servers(void)
 	return 0;
 }
 static int _proxy_add_servers(void)
 {
 	unsigned long i = 0;
 	struct hlist_node *tmp = NULL;
 	struct dns_proxy_names *proxy = NULL;
 	struct dns_proxy_servers *server = NULL;
 	struct dns_proxy_servers *server_tmp = NULL;
 	hash_for_each_safe(dns_proxy_table.proxy, i, tmp, proxy, node)
 	{
 		list_for_each_entry_safe(server, server_tmp, &proxy->server_list, list)
 		{
 			struct proxy_info info;
 			memset(&info, 0, sizeof(info));
 			info.type = server->type;
 			info.port = server->port;
 			safe_strncpy(info.server, server->server, PROXY_MAX_IPLEN);
 			safe_strncpy(info.username, server->username, PROXY_MAX_NAMELEN);
 			safe_strncpy(info.password, server->password, PROXY_MAX_NAMELEN);
 			info.use_domain = server->use_domain;
 			proxy_add(proxy->proxy_name, &info);
 		}
 	}
 	return 0;
 }
 static int _smartdns_set_ecs_ip(void)
 {
 	int ret = 0;
@@ -248,15 +365,23 @@ static int _smartdns_destroy_ssl(void)
 	return 0;
 }
-static int _smartdns_init(void)
+static const char *_smartdns_log_path(void)
 {
 	int ret;
 	char *logfile = SMARTDNS_LOG_FILE;
 	if (dns_conf_log_file[0] != 0) {
 		logfile = dns_conf_log_file;
 	}
 	return logfile;
 }
 static int _smartdns_init(void)
 {
 	int ret = 0;
 	const char *logfile = _smartdns_log_path();
 	int i = 0;
 	ret = tlog_init(logfile, dns_conf_log_size, dns_conf_log_num, 0, 0);
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "start tlog failed.\n");
@@ -265,8 +390,11 @@ static int _smartdns_init(void)
 	tlog_setlogscreen(verbose_screen);
 	tlog_setlevel(dns_conf_log_level);
 	if (dns_conf_log_file_mode > 0) {
 		tlog_set_permission(tlog_get_root(), dns_conf_log_file_mode, dns_conf_log_file_mode);
 	}
-	tlog(TLOG_NOTICE, "smartdns starting...(Copyright (C) Nick Peng <pymumu@gmail.com>, build:%s %s)", __DATE__,
+	tlog(TLOG_NOTICE, "smartdns starting...(Copyright (C) Nick Peng <pymumu@gmail.com>, build: %s %s)", __DATE__,
 		 __TIME__);
 	if (_smartdns_init_ssl() != 0) {
@@ -274,11 +402,19 @@ static int _smartdns_init(void)
 		goto errout;
 	}
-	if (dns_conf_server_num <= 0) {
+	for (i = 0; i < 60 && dns_conf_server_num <= 0; i++) {
-		if (_smartdns_load_from_resolv() != 0) {
+		ret = _smartdns_load_from_resolv();
-			tlog(TLOG_ERROR, "load dns from resolv failed.");
+		if (ret == 0) {
-			goto errout;
+			continue;
 		}
 		tlog(TLOG_DEBUG, "load dns from resolv failed, retry after 1s, retry times %d.", i + 1);
 		sleep(1);
 	}
 	if (dns_conf_server_num <= 0) {
 		tlog(TLOG_ERROR, "no dns server found, exit...");
 		goto errout;
 	}
 	ret = fast_ping_init();
@@ -287,6 +423,17 @@ static int _smartdns_init(void)
 		goto errout;
 	}
 	ret = proxy_init();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "start proxy failed.\n");
 		goto errout;
 	}
 	ret = _proxy_add_servers();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "add proxy servers failed.");
 	}
 	ret = dns_server_init();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "start dns server failed.\n");
@@ -298,6 +445,7 @@ static int _smartdns_init(void)
 		tlog(TLOG_ERROR, "start dns client failed.\n");
 		goto errout;
 	}
 	ret = _smartdns_add_servers();
 	if (ret != 0) {
 		tlog(TLOG_ERROR, "add servers failed.");
@@ -322,9 +470,11 @@ static int _smartdns_run(void)
 static void _smartdns_exit(void)
 {
-	dns_server_exit();
+	tlog(TLOG_INFO, "smartdns exit...");
 	dns_client_exit();
 	proxy_exit();
 	fast_ping_exit();
 	dns_server_exit();
 	_smartdns_destroy_ssl();
 	tlog_exit();
 	dns_server_load_exit();
@@ -332,6 +482,7 @@ static void _smartdns_exit(void)
 static void _sig_exit(int signo)
 {
 	tlog(TLOG_INFO, "stop smartdns by signal %d", signo);
 	dns_server_stop();
 }
@@ -374,7 +525,8 @@ static int sig_num = sizeof(sig_list) / sizeof(int);
 static void _reg_signal(void)
 {
-	struct sigaction act, old;
+	struct sigaction act;
 	struct sigaction old;
 	int i = 0;
 	act.sa_sigaction = _sig_error_exit;
 	sigemptyset(&act.sa_mask);
@@ -385,22 +537,75 @@ static void _reg_signal(void)
 	}
 }
 static int _smartdns_create_logdir(void)
 {
 	int uid = 0;
 	int gid = 0;
 	char logdir[PATH_MAX] = {0};
 	safe_strncpy(logdir, _smartdns_log_path(), PATH_MAX);
 	dir_name(logdir);
 	if (access(logdir, F_OK) == 0) {
 		return 0;
 	}
 	if (mkdir(logdir, 0750) != 0) {
 		if (errno == EEXIST) {
 			return 0;
 		}
 		return -1;
 	}
 	int unused __attribute__((unused)) = 0;
 	if (get_uid_gid(&uid, &gid) != 0) {
 		return -1;
 	}
 	unused = chown(logdir, uid, gid);
 	return 0;
 }
 static int _set_rlimit(void)
 {
 	struct rlimit value;
 	value.rlim_cur = 40;
 	value.rlim_max = 40;
 	setrlimit(RLIMIT_NICE, &value);
 	return 0;
 }
 static int _smartdns_init_pre(void)
 {
 	_smartdns_create_logdir();
 	_set_rlimit();
 	return 0;
 }
 int main(int argc, char *argv[])
 {
-	int ret;
+	int ret = 0;
-	int is_forground = 0;
+	int is_foreground = 0;
-	int opt;
+	int opt = 0;
 	char config_file[MAX_LINE_LEN];
 	char pid_file[MAX_LINE_LEN];
 	int signal_ignore = 0;
 	sigset_t empty_sigblock;
 	safe_strncpy(config_file, SMARTDNS_CONF_FILE, MAX_LINE_LEN);
 	safe_strncpy(pid_file, SMARTDNS_PID_FILE, MAX_LINE_LEN);
-	while ((opt = getopt(argc, argv, "fhc:p:Svx")) != -1) {
+	/* patch for Asus router:  unblock all signal*/
 	sigemptyset(&empty_sigblock);
 	sigprocmask(SIG_SETMASK, &empty_sigblock, NULL);
 	while ((opt = getopt(argc, argv, "fhc:p:SvxN:")) != -1) {
 		switch (opt) {
 		case 'f':
-			is_forground = 1;
+			is_foreground = 1;
 			break;
 		case 'c':
 			snprintf(config_file, sizeof(config_file), "%s", optarg);
@@ -418,13 +623,22 @@ int main(int argc, char *argv[])
 			_show_version();
 			return 0;
 			break;
 #ifdef DEBUG
 		case 'N':
 			return dns_packet_debug(optarg);
 #endif
 		case 'h':
 			_help();
 			return 1;
 		}
 	}
-	if (is_forground == 0) {
+	if (dns_server_load_conf(config_file) != 0) {
 		fprintf(stderr, "load config failed.\n");
 		goto errout;
 	}
 	if (is_foreground == 0) {
 		if (daemon(0, 0) < 0) {
 			fprintf(stderr, "run daemon process failed, %s\n", strerror(errno));
 			return 1;
@@ -435,24 +649,27 @@ int main(int argc, char *argv[])
 		_reg_signal();
 	}
-	if (create_pid_file(pid_file) != 0) {
+	if (strncmp(pid_file, "-", 2) != 0 && create_pid_file(pid_file) != 0) {
 		goto errout;
 	}
 	signal(SIGPIPE, SIG_IGN);
-	if (dns_server_load_conf(config_file) != 0) {
+	signal(SIGINT, _sig_exit);
-		fprintf(stderr, "load config failed.\n");
+	signal(SIGTERM, _sig_exit);
-		goto errout;
+
 	if (_smartdns_init_pre() != 0) {
 		fprintf(stderr, "init failed.\n");
 		return 1;
 	}
 	drop_root_privilege();
 	ret = _smartdns_init();
 	if (ret != 0) {
 		usleep(100000);
 		goto errout;
 	}
 	signal(SIGINT, _sig_exit);
 	signal(SIGTERM, _sig_exit);
 	atexit(_smartdns_exit);
 	return _smartdns_run();
--- a/src/tlog.c
+++ b/src/tlog.c
@@ -1,6 +1,6 @@
 /*
 * tinylog
- * Copyright (C) 2018-2020 Nick Peng <pymumu@gmail.com>
+ * Copyright (C) 2018-2023 Nick Peng <pymumu@gmail.com>
 * https://github.com/pymumu/tinylog
 */
 #ifndef _GNU_SOURCE
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -45,6 +46,14 @@
 #define TLOG_SEGMENT_MAGIC 0xFF446154
 struct linux_dirent64 {
    unsigned long long d_ino;
    long long d_off;
    unsigned short d_reclen;
    unsigned char d_type;
    char d_name[256];
 };
 struct tlog_log {
    char *buff;
    int buffsize;
@@ -71,7 +80,8 @@ struct tlog_log {
    int multi_log;
    int logscreen;
    int segment_log;
-    unsigned int max_line_size;
+    int max_line_size;
    int print_errmsg;
    tlog_output_func output_func;
    void *private_data;
@@ -80,6 +90,7 @@ struct tlog_log {
    time_t last_waitpid;
    mode_t file_perm;
    mode_t archive_perm;
    int mode_changed;
    int waiters;
    int is_exit;
@@ -99,6 +110,7 @@ struct tlog {
    tlog_log_output_func output_func;
    struct tlog_log *wait_on_log;
    int is_wait;
    char gzip_cmd[PATH_MAX];
 };
 struct tlog_segment_log_head {
@@ -207,7 +219,6 @@ static int _tlog_mkdir(const char *path)
        }
        if (mkdir(path_c, 0750) != 0) {
            fprintf(stderr, "create directory %s failed, %s\n", path_c, strerror(errno));
            return -1;
        }
@@ -306,10 +317,24 @@ void tlog_set_maxline_size(struct tlog_log *log, int size)
    log->max_line_size = size;
 }
 void tlog_logcount(struct tlog_log *log, int count)
 {
    if (log == NULL) {
        return;
    }
    if (count < 0) {
        count = 0;
    }
    log->logcount = count;
 }
 void tlog_set_permission(struct tlog_log *log, unsigned int file, unsigned int archive)
 {
    log->file_perm = file;
    log->archive_perm = archive;
    log->mode_changed = 1;
 }
 int tlog_localtime(struct tlog_time *tm)
@@ -418,7 +443,7 @@ static int _tlog_root_log_buffer(char *buff, int maxlen, void *userptr, const ch
        log_len++;
    }
-    if (tlog.root->segment_log) {
+    if (tlog.root->segment_log && log_head != NULL) {
        if (len + 1 < maxlen - 1) {
            *(buff + len) = '\0';
            len++;
@@ -496,6 +521,10 @@ static int _tlog_vprintf(struct tlog_log *log, vprint_callback print_callback, v
        return -1;
    }
    if (unlikely(log->logcount <= 0 && log->logscreen == 0)) {
        return 0;
    }
    if (_tlog_need_drop(log) == 0) {
        return -1;
    }
@@ -504,9 +533,12 @@ static int _tlog_vprintf(struct tlog_log *log, vprint_callback print_callback, v
    if (len <= 0) {
        return -1;
    } else if (len >= log->max_line_size) {
-        strncpy(buff, "[LOG TOO LONG, DISCARD]\n", sizeof(buff));
+        len = log->max_line_size;
-        buff[sizeof(buff) - 1] = '\0';
+        buff[len - 1] = '\0';
-        len = strnlen(buff, sizeof(buff));
+        buff[len - 2] = '\n';
        buff[len - 3] = '.';
        buff[len - 4] = '.';
        buff[len - 5] = '.';
    }
    pthread_mutex_lock(&tlog.lock);
@@ -889,14 +921,14 @@ static void _tlog_wait_pid(struct tlog_log *log, int wait_hang)
    log->zip_pid = -1;
    char gzip_file[PATH_MAX * 2];
-    /* rename ziped file */
+    /* rename zipped file */
    snprintf(gzip_file, sizeof(gzip_file), "%s/%s.pending.gz", log->logdir, log->logname);
    if (_tlog_rename_logfile(log, gzip_file) != 0) {
        _tlog_log_unlock(log);
        return;
    }
-    /* remove oldes file */
+    /* remove oldest file */
    _tlog_remove_oldlog(log);
    _tlog_log_unlock(log);
 }
@@ -919,47 +951,67 @@ static void _tlog_close_all_fd_by_res(void)
    }
 }
 static int _tlog_str_to_int(const char *str)
 {
    int num = 0;
    while (*str >= '0' && *str <= '9') {
        num = num * 10 + (*str - '0');
        ++str;
    }
    if (*str) {
        return -1;
    }
    return num;
 }
 static void _tlog_close_all_fd(void)
 {
-    char path_name[PATH_MAX];
+#if defined(__linux__)
    DIR *dir = NULL;
    struct dirent *ent;
    int dir_fd = -1;
-    snprintf(path_name, sizeof(path_name), "/proc/self/fd/");
+    dir_fd = open("/proc/self/fd/", O_RDONLY | O_DIRECTORY);
-    dir = opendir(path_name);
+    if (dir_fd < 0) {
    if (dir == NULL) {
        goto errout;
    }
-    dir_fd = dirfd(dir);
+    char buffer[sizeof(struct linux_dirent64)];
    int bytes;
    while ((bytes = syscall(SYS_getdents64, dir_fd,
                (struct linux_dirent64 *)buffer,
                sizeof(buffer)))
        > 0) {
        struct linux_dirent64 *entry;
        int offset;
-    while ((ent = readdir(dir)) != NULL) {
+        for (offset = 0; offset < bytes; offset += entry->d_reclen) {
-        int fd = atoi(ent->d_name);
+            int fd;
-        if (fd < 0 || dir_fd == fd) {
+            entry = (struct linux_dirent64 *)(buffer + offset);
-            continue;
+            if ((fd = _tlog_str_to_int(entry->d_name)) < 0) {
-        }
+                continue;
-        switch (fd) {
+            }
        case STDIN_FILENO:
        case STDOUT_FILENO:
        case STDERR_FILENO:
            continue;
            break;
        default:
            break;
        }
-        close(fd);
+            if (fd == dir_fd || fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO) {
                continue;
            }
            close(fd);
        }
    }
-    closedir(dir);
+    close(dir_fd);
    if (bytes < 0) {
        goto errout;
    }
    return;
 errout:
-    if (dir) {
+    if (dir_fd > 0) {
-        closedir(dir);
+        close(dir_fd);
    }
-
+#endif
    _tlog_close_all_fd_by_res();
    return;
 }
@@ -967,7 +1019,6 @@ errout:
 static int _tlog_archive_log_compressed(struct tlog_log *log)
 {
    char gzip_file[TLOG_BUFF_LEN];
    char gzip_cmd[PATH_MAX * 2];
    char log_file[TLOG_BUFF_LEN];
    char pending_file[TLOG_BUFF_LEN];
@@ -995,12 +1046,11 @@ static int _tlog_archive_log_compressed(struct tlog_log *log)
    }
    /* start gzip process to compress log file */
    snprintf(gzip_cmd, sizeof(gzip_cmd), "gzip -1 %s", pending_file);
    if (log->zip_pid <= 0) {
        int pid = vfork();
        if (pid == 0) {
            _tlog_close_all_fd();
-            execl("/bin/sh", "sh", "-c", gzip_cmd, NULL);
+            execl(tlog.gzip_cmd, "-1", pending_file, NULL);
            _exit(1);
        } else if (pid < 0) {
            goto errout;
@@ -1039,7 +1089,7 @@ static int _tlog_archive_log_nocompress(struct tlog_log *log)
        goto errout;
    }
-    /* remove oldes file */
+    /* remove oldest file */
    _tlog_remove_oldlog(log);
    _tlog_log_unlock(log);
@@ -1059,7 +1109,7 @@ static int _tlog_archive_log(struct tlog_log *log)
    }
 }
-void _tlog_get_log_name_dir(struct tlog_log *log)
+static void _tlog_get_log_name_dir(struct tlog_log *log)
 {
    char log_file[PATH_MAX];
    if (log->fd > 0) {
@@ -1098,6 +1148,10 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)
        unused = write(STDOUT_FILENO, buff, bufflen);
    }
    if (log->logcount <= 0) {
        return 0;
    }
    /* if log file size exceeds threshold, start to compress */
    if (log->multi_log && log->fd > 0) {
        log->filesize = lseek(log->fd, 0, SEEK_END);
@@ -1117,7 +1171,6 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)
    if (log->fd <= 0) {
        /* open a new log file to write */
        static int print_errmsg = 1;
        time_t now;
        time(&now);
@@ -1128,24 +1181,37 @@ static int _tlog_write(struct tlog_log *log, const char *buff, int bufflen)
        char logfile[PATH_MAX * 2];
        if (_tlog_mkdir(log->logdir) != 0) {
-            fprintf(stderr, "create log dir %s failed.\n", log->logdir);
+            if (log->print_errmsg == 0) {
                return -1;
            }
            log->print_errmsg = 0;
            fprintf(stderr, "create log dir %s failed, %s\n", log->logdir, strerror(errno));
            if (errno == EACCES && log->logscreen == 0) {
                fprintf(stderr, "no permission to write log file, output log to console\n");
                tlog_logscreen(log, 1);
                tlog_logcount(log, 0);
            }
            return -1;
        }
        snprintf(logfile, sizeof(logfile), "%s/%s", log->logdir, log->logname);
        log->filesize = 0;
        log->fd = open(logfile, O_APPEND | O_CREAT | O_WRONLY | O_CLOEXEC, log->file_perm);
        if (log->fd < 0) {
-            if (print_errmsg == 0) {
+            if (log->print_errmsg == 0) {
                return -1;
            }
            fprintf(stderr, "open log file %s failed, %s\n", logfile, strerror(errno));
-            print_errmsg = 0;
+            log->print_errmsg = 0;
            return -1;
        }
        if (log->mode_changed != 0) {
            fchmod(log->fd, log->file_perm);
        }
        log->last_try = 0;
-        print_errmsg = 1;
+        log->print_errmsg = 1;
        /* get log file size */
        log->filesize = lseek(log->fd, 0, SEEK_END);
    }
@@ -1296,12 +1362,26 @@ static struct tlog_log *_tlog_wait_log_locked(struct tlog_log *last_log)
    int ret = 0;
    struct timespec tm;
    struct tlog_log *log = NULL;
    struct tlog_log *next = NULL;
    int need_wait_pid = 0;
    for (next = tlog.log; next != NULL; next = next->next) {
        if (next->zip_pid > 0) {
            need_wait_pid = 1;
            break;
        }
    }
    clock_gettime(CLOCK_REALTIME, &tm);
    tm.tv_sec += 2;
    tlog.is_wait = 1;
    tlog.wait_on_log = last_log;
-    ret = pthread_cond_timedwait(&tlog.cond, &tlog.lock, &tm);
+    if (need_wait_pid != 0) {
        ret = pthread_cond_timedwait(&tlog.cond, &tlog.lock, &tm);
    } else {
        ret = pthread_cond_wait(&tlog.cond, &tlog.lock);
    }
    tlog.is_wait = 0;
    tlog.wait_on_log = NULL;
    errno = ret;
@@ -1370,7 +1450,7 @@ static void _tlog_work_write(struct tlog_log *log, int log_len, int log_extlen,
    if (log_dropped > 0) {
        /* if there is dropped log, record dropped log number */
        char dropmsg[TLOG_TMP_LEN];
-        snprintf(dropmsg, sizeof(dropmsg), "[Totoal Dropped %d Messages]\n", log_dropped);
+        snprintf(dropmsg, sizeof(dropmsg), "[Total Dropped %d Messages]\n", log_dropped);
        log->output_func(log, dropmsg, strnlen(dropmsg, sizeof(dropmsg)));
    }
 }
@@ -1533,6 +1613,11 @@ const char *tlog_get_level_string(tlog_level level)
    return tlog_level_str[level];
 }
 void tlog_set_maxlog_count(int count)
 {
    tlog_logcount(tlog.root, count);
 }
 static void _tlog_log_setlogscreen(struct tlog_log *log, int enable)
 {
    if (log == NULL) {
@@ -1604,6 +1689,15 @@ int tlog_setlevel(tlog_level level)
    return 0;
 }
 int tlog_log_enabled(tlog_level level)
 {
    if (level >= TLOG_END) {
        return 0;
    }
    return (tlog_set_level >= level) ? 1 : 0;
 }
 tlog_level tlog_getlevel(void)
 {
    return tlog_set_level;
@@ -1614,6 +1708,35 @@ void tlog_set_logfile(const char *logfile)
    tlog_rename_logfile(tlog.root, logfile);
 }
 static void _tlog_get_gzip_cmd_path(void)
 {
    char *copy_path = NULL;
    char gzip_cmd_path[PATH_MAX];
    const char *env_path = getenv("PATH");
    char *save_ptr = NULL;
    if (env_path == NULL) {
        env_path = "/bin:/usr/bin:/usr/local/bin";
    }
    copy_path = strdup(env_path);
    if (copy_path == NULL) {
        return;
    }
    for (char *tok = strtok_r(copy_path, ":", &save_ptr); tok; tok = strtok_r(NULL, ":", &save_ptr)) {
        snprintf(gzip_cmd_path, sizeof(gzip_cmd_path), "%s/gzip", tok);
        if (access(gzip_cmd_path, X_OK) != 0) {
            continue;
        }
        snprintf(tlog.gzip_cmd, sizeof(tlog.gzip_cmd), "%s", gzip_cmd_path);
        break;
    }
    free(copy_path);
 }
 tlog_log *tlog_open(const char *logfile, int maxlogsize, int maxlogcount, int buffsize, unsigned int flag)
 {
    struct tlog_log *log = NULL;
@@ -1636,12 +1759,13 @@ tlog_log *tlog_open(const char *logfile, int maxlogsize, int maxlogcount, int bu
    log->dropped = 0;
    log->buffsize = (buffsize > 0) ? buffsize : TLOG_BUFF_SIZE;
    log->logsize = (maxlogsize >= 0) ? maxlogsize : TLOG_LOG_SIZE;
-    log->logcount = (maxlogcount > 0) ? maxlogcount : TLOG_LOG_COUNT;
+    log->logcount = (maxlogcount <= 0) ? 0 : maxlogcount;
    log->fd = -1;
    log->filesize = 0;
    log->zip_pid = -1;
    log->is_exit = 0;
    log->fail = 0;
    log->print_errmsg = 1;
    log->waiters = 0;
    log->block = ((flag & TLOG_NONBLOCK) == 0) ? 1 : 0;
    log->nocompress = ((flag & TLOG_NOCOMPRESS) == 0) ? 0 : 1;
@@ -1653,6 +1777,10 @@ tlog_log *tlog_open(const char *logfile, int maxlogsize, int maxlogcount, int bu
    log->file_perm = S_IRUSR | S_IWUSR | S_IRGRP;
    log->archive_perm = S_IRUSR | S_IRGRP;
    if (log->nocompress == 0 && tlog.gzip_cmd[0] == '\0') {
        log->nocompress = 1;
    }
    tlog_rename_logfile(log, logfile);
    if (log->nocompress) {
        strncpy(log->suffix, TLOG_SUFFIX_LOG, sizeof(log->suffix));
@@ -1772,7 +1900,7 @@ int tlog_init(const char *logfile, int maxlogsize, int maxlogcount, int buffsize
    struct tlog_log *log = NULL;
    if (tlog_format != NULL) {
-        fprintf(stderr, "tlog already initilized.\n");
+        fprintf(stderr, "tlog already initialized.\n");
        return -1;
    }
@@ -1786,6 +1914,7 @@ int tlog_init(const char *logfile, int maxlogsize, int maxlogcount, int buffsize
    memset(&tlog, 0, sizeof(tlog));
    tlog.is_wait = 0;
    _tlog_get_gzip_cmd_path();
    pthread_attr_init(&attr);
    pthread_cond_init(&tlog.cond, NULL);
    pthread_mutex_init(&tlog.lock, NULL);
@@ -1798,27 +1927,33 @@ int tlog_init(const char *logfile, int maxlogsize, int maxlogcount, int buffsize
    }
    tlog_reg_output_func(log, _tlog_root_write_log);
    if ((flag & TLOG_NOCOMPRESS) == 0 && tlog.gzip_cmd[0] == '\0') {
        fprintf(stderr, "can not find gzip command, disable compress.\n");
    }
    tlog.root = log;
    ret = pthread_create(&tlog.tid, &attr, _tlog_work, NULL);
    if (ret != 0) {
        fprintf(stderr, "create tlog work thread failed, %s\n", strerror(errno));
        goto errout;
    }
    tlog.root = log;
    if (flag & TLOG_SUPPORT_FORK) {
        pthread_atfork(&tlog_fork_prepare, &tlog_fork_parent, &tlog_fork_child);
    }
    return 0;
 errout:
-    if (tlog.tid > 0) {
+    if (tlog.tid) {
        void *retval = NULL;
        tlog.run = 0;
        pthread_join(tlog.tid, &retval);
        tlog.tid = 0;
    }
    pthread_cond_destroy(&tlog.cond);
    pthread_mutex_destroy(&tlog.lock);
    tlog.run = 0;
    tlog.root = NULL;
    _tlog_close(log, 1);
@@ -1827,13 +1962,14 @@ errout:
 void tlog_exit(void)
 {
-    if (tlog.tid > 0) {
+    if (tlog.tid) {
        void *ret = NULL;
        tlog.run = 0;
        pthread_mutex_lock(&tlog.lock);
        pthread_cond_signal(&tlog.cond);
        pthread_mutex_unlock(&tlog.lock);
        pthread_join(tlog.tid, &ret);
        tlog.tid = 0;
    }
    tlog.root = NULL;
@@ -1843,4 +1979,7 @@ void tlog_exit(void)
    pthread_cond_destroy(&tlog.cond);
    pthread_mutex_destroy(&tlog.lock);
    tlog_format = NULL;
    tlog.is_wait = 0;
 }
--- a/src/tlog.h
+++ b/src/tlog.h
@@ -8,6 +8,7 @@
 #define TLOG_H
 #include <stdarg.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #ifdef __cplusplus
 #include <functional>
@@ -51,7 +52,7 @@ struct tlog_time {
 /*
 multiwrite: enable multi process write mode.
-            NOTICE: maxlogsize in all prcesses must be same when enable this mode.
+            NOTICE: maxlogsize in all processes must be same when enable this mode.
 */
 #define TLOG_MULTI_WRITE (1 << 2)
@@ -61,7 +62,7 @@ struct tlog_time {
 /* enable log to screen */
 #define TLOG_SCREEN (1 << 4)
-/* enable suppport fork process */
+/* enable support fork process */
 #define TLOG_SUPPORT_FORK (1 << 5)
 struct tlog_loginfo {
@@ -78,9 +79,9 @@ level: Current log Levels
 format: Log formats
 */
 #ifndef BASE_FILE_NAME
-#define BASE_FILE_NAME                                                     \
+#define BASE_FILE_NAME                                                       \
-  (__builtin_strrchr(__FILE__, '/') ? __builtin_strrchr(__FILE__, '/') + 1 \
+    (__builtin_strrchr(__FILE__, '/') ? __builtin_strrchr(__FILE__, '/') + 1 \
-                                    : __FILE__)
+                                      : __FILE__)
 #endif
 #define tlog(level, format, ...) tlog_ext(level, BASE_FILE_NAME, __LINE__, __func__, NULL, format, ##__VA_ARGS__)
@@ -94,21 +95,27 @@ extern int tlog_write_log(char *buff, int bufflen);
 /* set log level */
 extern int tlog_setlevel(tlog_level level);
 /* is log level enabled*/
 extern int tlog_log_enabled(tlog_level level);
 /* get log level */
 extern tlog_level tlog_getlevel(void);
 /* set log file */
 extern void tlog_set_logfile(const char *logfile);
-/* enalbe log to screen */
+/* enable log to screen */
 extern void tlog_setlogscreen(int enable);
-/* enalbe early log to screen */
+/* enable early log to screen */
 extern void tlog_set_early_printf(int enable);
 /* Get log level in string */
 extern const char *tlog_get_level_string(tlog_level level);
 /* set max log count */
 extern void tlog_set_maxlog_count(int count);
 /*
 Function: Initialize log module
 logfile: log file.
@@ -180,7 +187,7 @@ va_list: args list
 */
 extern int tlog_vprintf(tlog_log *log, const char *format, va_list ap);
-/* enalbe log to screen */
+/* enable log to screen */
 extern void tlog_logscreen(tlog_log *log, int enable);
 /* register output callback */
@@ -199,6 +206,9 @@ extern int tlog_localtime(struct tlog_time *tm);
 /* set max line size */
 extern void tlog_set_maxline_size(struct tlog_log *log, int size);
 /* set max log count */
 extern void tlog_logcount(struct tlog_log *log, int count);
 /*
 Function: set log file and archive permission
 log: log stream
@@ -206,7 +216,7 @@ file: log file permission, default is 640
 archive: archive file permission, default is 440
 */
-extern void tlog_set_permission(struct  tlog_log *log, mode_t file, mode_t archive);
+extern void tlog_set_permission(struct tlog_log *log, mode_t file, mode_t archive);
 #ifdef __cplusplus
 class Tlog {
--- a/src/util.c
+++ b/src/util.c
--- a/src/util.h
+++ b/src/util.h
@@ -1,6 +1,6 @@
 /*************************************************************************
 *
- * Copyright (C) 2018-2020 Ruilin Peng (Nick) <pymumu@gmail.com>.
+ * Copyright (C) 2018-2023 Ruilin Peng (Nick) <pymumu@gmail.com>.
 *
 * smartdns is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -45,13 +45,23 @@ extern "C" {
 #define PORT_NOT_DEFINED -1
 #define MAX_IP_LEN 64
 #ifndef BASE_FILE_NAME
 #define BASE_FILE_NAME (__builtin_strrchr(__FILE__, '/') ? __builtin_strrchr(__FILE__, '/') + 1 : __FILE__)
 #endif
 #define BUG(format, ...) bug_ext(BASE_FILE_NAME, __LINE__, __func__, format, ##__VA_ARGS__)
 void bug_ext(const char *file, int line, const char *func, const char *errfmt, ...)
 	__attribute__((format(printf, 4, 5))) __attribute__((nonnull(4)));
 unsigned long get_tick_count(void);
-char *gethost_by_addr(char *host, int maxsize, struct sockaddr *addr);
+char *dir_name(char *path);
-int getaddr_by_host(char *host, struct sockaddr *addr, socklen_t *addr_len);
+char *get_host_by_addr(char *host, int maxsize, struct sockaddr *addr);
-int getsocknet_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);
+int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len);
 int getsocket_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);
 int fill_sockaddr_by_ip(unsigned char *ip, int ip_len, int port, struct sockaddr *addr, socklen_t *addr_len);
@@ -61,15 +71,21 @@ int check_is_ipaddr(const char *ip);
 int parse_uri(char *value, char *scheme, char *host, int *port, char *path);
 int parse_uri_ext(char *value, char *scheme, char *user, char *password, char *host, int *port, char *path);
 void urldecode(char *dst, const char *src);
 int set_fd_nonblock(int fd, int nonblock);
 char *reverse_string(char *output, const char *input, int len, int to_lower_case);
 char *to_lower_case(char *output, const char *input, int len);
 void print_stack(void);
-int ipset_add(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout);
+int ipset_add(const char *ipset_name, const unsigned char addr[], int addr_len, unsigned long timeout);
-int ipset_del(const char *ipsetname, const unsigned char addr[], int addr_len);
+int ipset_del(const char *ipset_name, const unsigned char addr[], int addr_len);
 void SSL_CRYPTO_thread_setup(void);
@@ -79,10 +95,12 @@ unsigned char *SSL_SHA256(const unsigned char *d, size_t n, unsigned char *md);
 int SSL_base64_decode(const char *in, unsigned char *out);
 int SSL_base64_encode(const void *in, int in_len, char *out);
 int create_pid_file(const char *pid_file);
 /* Parse a TLS packet for the Server Name Indication extension in the client
- * hello handshake, returning the first servername found (pointer to static
+ * hello handshake, returning the first server name found (pointer to static
 * array)
 *
 * Returns:
@@ -102,6 +120,8 @@ int is_numeric(const char *str);
 int has_network_raw_cap(void);
 int has_unprivileged_ping(void);
 int set_sock_keepalive(int fd, int keepidle, int keepinterval, int keepcnt);
 int set_sock_lingertime(int fd, int time);
@@ -110,6 +130,12 @@ uint64_t get_free_space(const char *path);
 void print_stack(void);
 int write_file(const char *filename, void *data, int data_len);
 int dns_packet_save(const char *dir, const char *type, const char *from, const void *packet, int packet_len);
 int dns_packet_debug(const char *packet_file);
 #ifdef __cplusplus
 }
 #endif /*__cplusplus */
--- a/systemd/smartdns.service.in
+++ b/systemd/smartdns.service.in
@@ -9,10 +9,9 @@ Type=forking
 PIDFile=@RUNSTATEDIR@/smartdns.pid
 EnvironmentFile=@SYSCONFDIR@/default/smartdns
 ExecStart=@SBINDIR@/smartdns -p @RUNSTATEDIR@/smartdns.pid $SMART_DNS_OPTS 
 KillMode=process
 Restart=always
 RestartSec=2
-TimeoutStopSec=5
+TimeoutStopSec=15
 [Install]
 WantedBy=multi-user.target
Author	SHA1	Message	Date
Nick Peng	c5ca3ccf43	luci: add dns64 option	2023-02-21 23:28:17 +08:00
Nick Peng	a6cb6061ec	optware: fix optware init script issue	2023-02-21 22:59:50 +08:00
Nick Peng	995d5dce95	dns-client: fix tcp connect timeout issue.	2023-02-21 22:38:55 +08:00
Nick Peng	c21be04632	dns_server: update ttl issue for domain-rule	2023-02-18 21:10:44 +08:00
Nick Peng	d2d7dac7e9	dns_server: fix ttl issue.	2023-02-17 22:39:23 +08:00
Nick Peng	a62d716b10	smartdns: fix valgrind warnings.	2023-02-17 22:09:38 +08:00
Nick Peng	694d093fc4	smartdns: fix compile warnings for gcc 11.	2023-02-17 21:51:17 +08:00
Nick Peng	464bf28601	ReadMe: update rust version smartdns link	2023-02-17 21:06:40 +08:00
Nick Peng	24e1dac854	feature: Simple add dns64 support.	2023-02-17 20:51:48 +08:00
Nick Peng	e51580ea57	luci: move auto set dnsmasq option to basic settings	2023-02-16 23:09:37 +08:00
Nick Peng	499ab1b64f	feature: support set ttl, ttl-min, ttl-max to domain.	2023-02-14 22:46:15 +08:00
Nick Peng	db56472b84	luci: add ipset-no-speed and nftset-no-speed options.	2023-02-12 23:02:13 +08:00
Nick Peng	60e3a109e4	dns_client: fix bootstrap DNS soa host issue.	2023-02-12 16:00:19 +08:00
Nick Peng	7256f5af32	cname: fix cname recursive query issue	2023-02-12 12:29:21 +08:00
Nick Peng	1e6a5f3809	luci: simple fix server option URI parse issue	2023-02-11 23:26:48 +08:00
Nick Peng	4941594182	dns_client: bootstrap dns: fail when domain not found.	2023-02-11 15:15:06 +08:00
Nick Peng	a6d6781a2a	feature: add cname option	2023-02-11 14:34:23 +08:00
Nick Peng	be71e085ad	dns_conf: fix relative path issue	2023-02-09 21:37:35 +08:00
Nick Peng	69a2f3bb7f	feature: add new option: ipset-no-speed and nftset-no-speed	2023-02-09 21:31:02 +08:00
Nick Peng	d6f9b07f1c	dns_client: use RAND_bytes instead getrandom for compatibility	2023-02-03 22:34:57 +08:00
Nick Peng	03ba24480b	smartdns: support multiline config option and fix timer issue.	2023-02-02 20:23:53 +08:00
Nick Peng	108f514b83	readme: update readme.	2023-02-01 22:52:58 +08:00
Nick Peng	26d16eb9dc	dns_client: make DNS query ID random	2023-01-31 22:51:08 +08:00
Nick Peng	1e29f1fa63	dns_client: add retry when bootstrap from system DNS.	2023-01-30 23:26:08 +08:00
Nick Peng	3cb644d728	log: optimize proxy log	2023-01-29 23:26:16 +08:00
Nick Peng	c6ac69a8d8	domain-set: keep domain rules orders	2023-01-29 22:06:05 +08:00
Nick Peng	8bbbcd5e86	luci: add response mode option	2023-01-29 21:27:31 +08:00
Nick Peng	13d028df0d	smartdns: bump copyright to 2023, and fix some typo	2023-01-20 00:05:14 +08:00
Nick Peng	1f40577ef0	openwrt: save cache to disk when reboot system	2023-01-16 20:29:56 +08:00
Nick Peng	ee4816da5c	luci: support proxy server settings.	2023-01-08 22:33:54 +08:00
Nick Peng	5392857539	proxy: Configure proxy options using URI scheme	2023-01-08 03:18:01 +08:00
Nick Peng	e416a15684	dns_server: fix bind device issue	2023-01-08 01:58:18 +08:00
Nick Peng	3ed8150ac6	luci: support bind muti devices	2023-01-07 21:11:23 +08:00
Nick Peng	3b680f9455	luci: support bind device option	2023-01-05 23:36:17 +08:00
Nick Peng	5a3f53b487	server: support bind to device	2023-01-05 19:34:40 +08:00
Nick Peng	83c4901190	proxy: simple add socks5 and https proxy support	2023-01-05 00:27:28 +08:00
Nick Peng	d792e5f7f7	log: optimize log	2023-01-02 15:36:23 +08:00
Nick Peng	98ce7fd38c	luci: fix translate typo	2023-01-01 09:37:10 +08:00
PikuZheng	f571b8714b	fix Ubuntu service name (#1224 ) Author: PikuZheng <cba321123@gmail.com> Date: Sat Dec 31 18:00:57 2022 +0800	2022-12-31 21:17:47 +08:00
Nick Peng	fffe4caf08	log: optimize log	2022-12-31 09:38:27 +08:00
Nick Peng	98498bf444	luci: fix option description	2022-12-31 09:27:38 +08:00
Nick Peng	69ab9585d7	log: optimize log	2022-12-30 21:13:50 +08:00
Nick Peng	dd9cf62d10	luci: fix UI not display after upgrade issue.	2022-12-28 19:45:37 +08:00
Nick Peng	58aaaa5d5b	dns_server: use connect udp socket	2022-12-22 14:12:35 +08:00
孟古一	13a6892c17	Update ReadMe_en.md	2022-12-22 14:08:28 +08:00
孟古一	3099ef6ade	readme: update readme for ubuntu installation (#1212 )	2022-12-22 09:33:27 +08:00
Nick Peng	95524cab6b	makefile: add extra cflags	2022-12-22 00:20:22 +08:00
Nick Peng	f7f1f37faa	log: add option to set file permissions	2022-12-21 21:32:29 +08:00
Nick Peng	945653667f	feature: support marking packet on upstream server	2022-12-21 18:40:55 +08:00
Nick Peng	4c2b8847f0	readme_en: fix link	2022-12-21 18:40:55 +08:00
Nick Peng	70df7938f3	conf: support disable expired cache on specific domain.	2022-12-21 18:40:55 +08:00
Nick Peng	4b42e1ef85	readme: update readme	2022-12-21 18:40:55 +08:00
Nick Peng	5bc8b3ad62	luci: support config speed check mode	2022-12-21 18:40:55 +08:00
Nick Peng	f300d6ba82	luci: add domain rule list tab	2022-12-21 18:40:55 +08:00
Nick Peng	cdf12f3cb4	luci: add report bugs button	2022-12-21 18:40:55 +08:00
Nick Peng	53593ba5b6	conf: support space in filename	2022-12-21 18:40:55 +08:00
Nick Peng	52e036ac96	dns_server: support force no cname for A,AAAA records	2022-12-21 18:40:55 +08:00
Nick Peng	0b723168bb	luci-compat: support dns forwarding feature	2022-12-21 18:40:55 +08:00
Nick Peng	15427ffdf1	luci: support DNS forwarding and block	2022-12-21 18:40:55 +08:00
Nick Peng	3a1ba73386	log: support disable log	2022-12-14 22:26:45 +08:00
Nick Peng	1cde3f7335	nftset: fix domain-rule for nftset short option missing issue.	2022-12-09 21:59:05 +08:00
Nick Peng	5136fad8ec	dns_server: make the TTL value of SOA 30 seconds	2022-12-09 21:54:52 +08:00
Nick Peng	38a1782ec4	optware: fix init-script workmode 2 not working issue.	2022-12-08 22:49:47 +08:00
Nick Peng	bb39653f4a	log: reduce the number of Error logs and update readme	2022-12-06 23:14:04 +08:00
Nick Peng	9176bb9eb5	install-script: fix linux install script issue.	2022-12-05 21:42:32 +08:00
Nick Peng	f2593b62aa	dns-server: return NOTIMP when request opcode is not supported.	2022-12-04 13:55:24 +08:00
Nick Peng	f671c34e7c	Support specific domain names to query IPV6, when setting force-AAAA-SOA yes	2022-12-03 15:03:34 +08:00
Nick Peng	dad31179d2	DNS: support parser TYPE65 RR.	2022-12-03 14:28:45 +08:00
Nick Peng	410047822d	install-script: optimize linux install script	2022-12-01 22:19:34 +08:00
Nick Peng	f38d16a069	smartdns: reply NOTIMP when query is not supported.	2022-12-01 22:18:49 +08:00
Nick Peng	c8734d603b	nftset: disable nftset when os not support	2022-11-29 23:04:48 +08:00
Nick Peng	bd31cc0a36	conf: force TYPE65 SOA enable by default	2022-11-23 22:29:56 +08:00
Nick Peng	5a356e577d	nftset: Fix isssue of adding IP error when nftset has interval flag	2022-11-23 22:18:28 +08:00
Nick Peng	7d02843fea	dns_conf: fix domain-rule speed check option bug	2022-11-21 23:45:49 +08:00
Nick Peng	b9429e04d2	fast_ping: make debug log happy	2022-11-20 11:43:59 +08:00
Nick Peng	bea238e7ae	dns_conf: fix speed-check-mode option incorrect issue.	2022-11-20 00:33:05 +08:00
Nick Peng	ad4c2144da	nftset: fix nft option ignore flag not working issue	2022-11-19 19:28:27 +08:00
Nick Peng	04985216a8	dns_cache: separate DNS cache	2022-11-17 23:51:15 +08:00
Nick Peng	324aa2d77d	nftset: fix family option not working issue	2022-11-16 22:37:25 +08:00
Nick Peng	bc379a3c3e	ping: increase ping work thread priority	2022-11-16 22:11:18 +08:00
Nick Peng	f6b9a1b81a	dns-conf: support disable sni name by setting host-name name to '-'	2022-11-16 00:22:06 +08:00
Nick Peng	f619ca8f68	ping: Optimize the ping callback thread to reduce inaccurate results caused by blocking	2022-11-16 00:20:39 +08:00
Nick Peng	42a4fdebfd	smartdns: fix setcap crash issue.	2022-11-15 22:39:36 +08:00
Nick Peng	85d011eae8	nftset: Remove libnftable dependency	2022-11-15 22:31:34 +08:00
Nick Peng	934701941b	dns: skip padding record	2022-11-11 00:22:35 +08:00
Nick Peng	9974c50dbb	dns_server: fixed rcode error issue	2022-11-10 19:35:55 +08:00
Nick Peng	93af473e08	dns_cache: optimize cache for no result record.	2022-11-08 23:31:15 +08:00
Nick Peng	76d5322676	conf: Make hostnames match exactly	2022-11-08 23:31:15 +08:00
Nick Peng	facf672081	dns_client: fix crash issue when upstream response delay is lower than 1ms	2022-11-07 22:15:45 +08:00
Nick Peng	5558e38cb4	fast-ping: fix dns ping not working issue	2022-11-05 17:46:28 +08:00
Nick Peng	ffd3cb2db5	dns-client: Fix issue that bootstrap dns not working caused by reducing CPU usage	2022-11-05 16:23:19 +08:00
Nick Peng	91ee65231e	server: reply udp packet with original route path	2022-11-03 20:44:04 +08:00
Nick Peng	7b8ff57773	cpu-usage: reduce cpu usage when idle	2022-10-27 21:38:04 +08:00
LoveSy	391ef310b4	Simple support for nftables (#1117 ) * Simple support for nftables Co-authored-by: Chen Zhenge <Mr.ChenWithCapsule@outlook.com>	2022-10-23 19:17:33 +08:00
Nick Peng	51e1ba6897	update readme	2022-10-20 23:18:45 +08:00
Nick Peng	efc18996a8	luci: remove unnecessary permissions	2022-10-15 10:41:48 +08:00
soffchen	9bc857f628	smartdns: fix typo	2022-10-11 18:45:44 +08:00
YiiSh	8523f26c62	update smartdns start priority same with dnsmasq	2022-10-08 23:24:13 +08:00
Nick Peng	6c800ea12f	luci: Fix RPC error when config is empty and add restart button.	2022-10-08 21:59:35 +08:00
Nick Peng	eeaadcf313	openwrt: remove deprecated option and restore dnsmasq when stop	2022-09-29 23:53:51 +08:00
Nick Peng	ccb47ef327	conf: fix local domain handling issues	2022-09-28 20:28:01 +08:00
HiGarfield	a13433abac	Update smartdns.lua (#1092 ) luci-compat: fix dnsmasq redirect status	2022-09-28 09:22:51 +08:00
Nick Peng	799d19f233	conf: add option resolv-hostname to skip resolve local hostname	2022-09-28 00:53:39 +08:00
Nick Peng	0fa17063c0	luci: avoid unnecessary configuration writes	2022-09-27 21:50:08 +08:00
Nick Peng	fa0ab28bab	openwrt: restore dns redirect after disable smartdns	2022-09-25 11:08:26 +08:00
Nick Peng	9bca51beaf	openwrt: fix dnsmasq redirect issue	2022-09-24 23:51:06 +08:00
Nick Peng	1640e9e6a1	smartdns: fix kernel dmesg warnings	2022-09-24 20:14:00 +08:00
Nick Peng	33ead3afbd	luci: fix redirect error message issue	2022-09-15 23:17:58 +08:00
Nick Peng	1991a0b102	luci: add hint when set dnsmasq failure.	2022-09-14 23:45:39 +08:00
Nick Peng	1f1fd118de	Feature: add domain-set option, simplify domain name rule settings	2022-09-08 00:41:17 +08:00
zxlhhyccc	8532205844	luci: fix rr-ttl-reply-max translate	2022-09-02 22:28:14 +08:00
Nick Peng	822f02bab9	luci: auto disable dns redirect for some firmware	2022-09-01 20:00:31 +08:00
Nick Peng	d8c53a6215	luci: fix second dns force AAAA soa options not working issue.	2022-09-01 00:32:52 +08:00
Nick Peng	e13a8c0ec5	luci: disable auto set dnsmasq when update from redirect mode none	2022-09-01 00:22:13 +08:00
Nick Peng	7c4ce074a5	luci: fix auto setting issue	2022-08-31 22:05:26 +08:00
Nick Peng	e6d533e2c5	luci: remove redirect feature and set as main dns server automatically when port is 53	2022-08-31 00:58:31 +08:00
Nick Peng	7b3dcd31f9	openwrt: support set smartdns as main server when port is 53	2022-08-30 01:46:11 +08:00
Nick Peng	0eef67c119	luci: fix warning when save config	2022-08-30 00:18:11 +08:00
Nick Peng	455924befe	dns_client: fix default edns not working issue	2022-08-29 18:48:45 +08:00
Nick Peng	b75f7e14fe	conf: fix typo	2022-08-29 18:19:38 +08:00
Nick Peng	64e5b326cc	luci: fix status section not working issue and add some options	2022-08-28 17:30:24 +08:00
Nick Peng	f659cf3725	dns_conf: support relative path for dnsmasq-lease-file	2022-08-28 10:22:14 +08:00
Nick Peng	83c8105312	dns_server: fix only cache on ip address result issue	2022-08-24 20:05:35 +08:00
Nick Peng	fecc313e03	dns_server: fix SERVERFAIL when A is 127.0.0.1	2022-08-23 22:49:41 +08:00
Nick Peng	145f7cfa42	dns_server: make the TTL of the first request to 2s & fix hostname issue.	2022-08-21 18:29:44 +08:00
Nick Peng	464f2adaa7	fast_ping: fix race condition	2022-08-21 18:29:44 +08:00
Zhong Lufan	7c9288f887	Readme: Fix typo	2022-08-19 19:36:46 +08:00
Nick Peng	96d3deb595	conf: add local-ttl option	2022-08-15 21:35:08 +08:00
Nick Peng	584480dda1	fix: malformed packet crash issue	2022-08-12 20:47:27 +08:00
Nick Peng	2848aa0ac7	server_group: fix server group not working issue.	2022-08-11 23:57:33 +08:00
Nick Peng	c156595f61	optware-script: fix optware init script issue	2022-08-11 23:56:17 +08:00
Thiasap	9dfe51c5ed	wsl: Fix the problem of incorrect identification of WSL	2022-08-11 11:54:07 +08:00
Nick Peng	5a2559f064	Update readme	2022-08-06 16:24:33 +08:00
Nick Peng	3605e6ed71	smartdns: support no create pid file.	2022-08-05 22:13:26 +08:00
Nick Peng	6588c9822f	fast_ping: supress error log	2022-08-04 21:40:18 +08:00
honwen.chan	2f1d83cc2c	docker: refine Dockerfile, make cache happy.	2022-08-01 21:58:51 +08:00
Nick Peng	ac042e8bee	dns-debug: support record fail packet for debugging	2022-07-31 15:49:10 +08:00
Nick Peng	ab415f2ee9	feature: support response mode: first-ping, fastest-ip, fastest-response	2022-07-25 22:54:27 +08:00
Nick Peng	d3bbd8edd7	log: set default log path to /var/log/smartdns/ and auto create directory	2022-07-25 22:52:42 +08:00
Nick Peng	9390a49a72	dns_server: make log happy.	2022-07-21 21:45:14 +08:00
Felix Yan	798226ddb3	Correct typos in dns.c	2022-07-17 14:10:00 +08:00
Nick Peng	d223194eff	dns_server: fix crash issue	2022-07-14 22:55:50 +08:00
Nick Peng	a83818c094	code: cleanup lint and extra compile warnings	2022-07-10 10:32:01 +08:00
Nick Peng	4e2161c6fc	conf: optimize badconfig log	2022-07-07 22:49:30 +08:00
Nick Peng	7d62226995	server: some minor fixes	2022-07-05 23:32:22 +08:00
Nick Peng	092b4ede88	dns_server: fix ip number is only one when speed check is none	2022-07-05 00:18:28 +08:00
Nick Peng	301ab3ba10	server: fix server not exit issue on asus router	2022-07-02 13:26:58 +08:00
Nick Peng	362b7f978f	security: support dropping root, and no root privileges required for ping	2022-07-01 23:37:24 +08:00
Nick Peng	435b2905cf	iniscript: Make sure the cache has enough time to save to disk	2022-07-01 22:38:37 +08:00
Nick Peng	e3436263d9	conf: add config: dualstack-ip-allow-force-AAAA	2022-06-28 22:10:42 +08:00
Nick Peng	1f07a7ea97	log: make log happy when receiving malformd packet	2022-06-28 22:01:14 +08:00
Nick Peng	9fdf53baa5	Update tlog	2022-06-26 18:49:17 +08:00
Nick Peng	db328640c8	tlog: fix dead lock when forking	2022-06-25 20:25:20 +08:00
Nick Peng	5006059074	cache: fix dns cache prefetch issue	2022-06-25 20:24:27 +08:00
Nick Peng	883116708b	dualstack: fix speed check issue when there is only one ip record.	2022-06-19 10:02:34 +08:00
Nick Peng	cbc8c59125	dns_conf: add expired domain prefetch time	2022-06-18 14:11:39 +08:00
Nick Peng	b70feb112a	ipset: fix ipset missing issue	2022-06-18 10:17:25 +08:00
Nick Peng	ff0f42b87c	docker: reduce docker images size	2022-06-17 20:49:29 +08:00
Nick Peng	1873a0c336	cache: support expired domain prefetch	2022-06-12 23:39:42 +08:00
Nick Peng	995bee4088	dns_server: optimize code	2022-06-12 23:39:42 +08:00
Nick Peng	09dc2e9275	dns_server: fix discard issue.	2022-06-12 23:37:12 +08:00
Nick Peng	c0f4c72626	docker: make dockerfile build from local source	2022-06-12 00:51:19 +08:00
Nick Peng	d185b78836	dns_server: fix SRV query discard issue.	2022-06-11 23:11:25 +08:00
Nick Peng	7e985e7d11	dns_server: fix dualstack select issue.	2022-06-08 23:28:46 +08:00
Nick Peng	6cfaa639f6	speed-check: fix domain-rule speed check memleak issue	2022-06-05 16:08:19 +08:00
Nick Peng	c960f3f511	dns_server: refactoring dualstack selection code.	2022-06-05 10:10:28 +08:00
Nick Peng	848c9e6cf2	dns_server: fix dns cache issue & supress ping log	2022-05-30 23:22:03 +08:00
Nick Peng	c7db5b2667	dns_server: fix pending query callback fail issue.	2022-05-30 00:47:38 +08:00
Nick Peng	0a04b91763	Readme: add readme for DNS TYPE65 & DNSMASQ hostname	2022-05-29 23:04:10 +08:00
Nick Peng	c27040099b	dns_server: fix tcp ping config not working issue and add more ping mode.	2022-05-29 22:44:41 +08:00
Nick Peng	b6740f5aab	cache: cache special records	2022-05-28 16:09:06 +08:00
Nick Peng	6a7ce39727	dns_server: fix max reply ip number issue.	2022-05-28 12:52:25 +08:00
Nick Peng	2365a1a2b0	cache: cache NXDOMAIN records.	2022-05-28 09:33:49 +08:00
Nick Peng	b5a5311976	ecs: support pass client ecs to upstream	2022-05-26 19:59:22 +08:00
Nick Peng	b125d142bd	cache: cache cname record	2022-05-25 11:50:39 +08:00
Nick Peng	bc68d5979c	Support force not CNAME records	2022-05-22 10:09:58 +08:00
HalfLife	b6f9d7e7bc	修复openwrt中stop、restart时无法正确终止程序，导致第一端口被占用	2022-05-21 23:41:35 +08:00
Nick Peng	e6fe6771bf	conf: Supports setting the maximum number of IPs returned to the client	2022-05-21 14:18:28 +08:00
Nick Peng	94b84cd32c	dns_server: support query smartdns server ip	2022-05-21 11:32:31 +08:00
Nick Peng	dae263444f	Feature: support local host name & ptr resolve.	2022-05-21 11:23:54 +08:00
Nick Peng	dbfe9063e4	Update Readme	2022-05-19 19:14:41 +08:00
Nick Peng	ae3beb5fba	dns_client: ipv4, ipv6 ecs, use either	2022-05-19 19:14:19 +08:00
PikuZheng	7a55471ce3	luci: set dualstack-ip-selection to no when checkbox unselected.	2022-05-17 20:42:06 +08:00
Nick Peng	03478debe8	feature: auto detect ipv6 features.	2022-05-17 20:35:36 +08:00
Nick Peng	ee40591aed	dns_server: fix ipv6 not response issue	2022-05-17 01:15:14 +08:00
Nick Peng	bdc3a87d6d	debian: fake package version avoid auto upgrade	2022-05-16 14:25:53 +08:00
Nick Peng	68ce6b3f0f	dns_server: fix ipv6 multi ipaddress issue	2022-05-16 13:09:46 +08:00
Nick Peng	9dffec3fd3	dns_server: set max ip count to 10	2022-05-15 22:13:12 +08:00
Nick Peng	e64007f558	dns_server: fix issue for AAAA cache query	2022-05-15 21:42:36 +08:00
Nick Peng	87a400ebae	dns_server: fix bootstrap dns not working issue	2022-05-12 00:08:56 +08:00
Nick Peng	9804c305d0	update tlog	2022-05-12 00:08:56 +08:00
Nick Peng	e1755dadc1	Systemd: remove killmode	2022-05-12 00:08:56 +08:00
Mo Zhou	c7d54a2111	Different version scheme results in Debian package overwrite (Closes: https://github.com/pymumu/smartdns/issues/748 )	2022-05-08 12:17:41 +08:00
Nick Peng	34691154fb	passthrouth: fix passthrouth ttl	2022-05-03 10:25:33 +08:00
Nick Peng	29a5803860	Fix typo & ttl issue.	2022-05-03 09:00:30 +08:00
Nick Peng	ebd820bcbb	dns_server: make max ttl no countdown	2022-05-02 22:53:51 +08:00
Nick Peng	1de5557430	client: support ECS	2022-04-30 20:22:57 +08:00
Nick Peng	c92615e6cd	dual-stack: return soa when ipv4 exists in cache	2022-04-30 08:46:30 +08:00
Nick Peng	c561ae2fc5	Feature: Supports setting the maximum TTL value of the response to the client	2022-04-29 22:29:40 +08:00
Nick Peng	d30264ed08	script: force stop smartdns process	2022-04-29 10:09:40 +08:00
Nick Peng	22e13b40db	dns_server: fix passthrouth ipset issue	2022-04-26 20:43:11 +08:00
Nick Peng	75dda9340d	dns_conf: update default configuration.	2022-04-25 18:46:52 +08:00
Nick Peng	baf2be681d	dns-server: Parallel query performance optimization for the same domain name	2022-04-25 18:46:40 +08:00
Nick Peng	5bd521c36b	dns_server: Cache A record for AAAA query when dualstack select	2022-04-22 23:36:37 +08:00
Nick Peng	d0305f60f6	dns_server: make fastest ip first place & fix audit log and ipset for multi IPs.	2022-04-17 18:03:24 +08:00
Nick Peng	6e1363dca4	Feature: select all best ip	2022-04-10 19:47:00 +08:00
Nick Peng	23e9021d30	client: avoid retry query storm	2022-04-09 11:12:00 +08:00
Nick Peng	92af4c05c0	dns: support domain compress.	2022-04-05 21:21:33 +08:00
`@@ -1,4 +1,4 @@`
	`smartdns (1.2018.7.9) stable; urgency=low`	`smartdns (1:1.2022.04.05) stable; urgency=low`

	`* Initial build`	`* Initial build`