
Source:  https://github.com/john9527/asuswrt-merlin : branch 374.43_2-update
NOTE: [*] Indicated fork unique change

Changelog
---------
374.43_2-26E4j9527  (5-August-2017)
* CHANGED: httpd: improve forced http authorization
* CHANGED: httpd: set default disconnect timeout to 60sec, change via nvram
* CHANGED: webui: change qos slider to be true On/Off; fix display of qos options
- CHANGED: ipset_arm: (backport) add new modules to modprobe.conf, for automagic module loading
- CHANGED: busybox: add hostname applet, required by some Entware packages
- FIXED: rc: (backport) always mark LAN/LAN packets, not just with Asus NAT loopback
- FIXED: networkmap: (backport) fixes CVE-2017-11344, CVE-2017-11345 and CVE-2017-11420
* FIXED: samba36: update guest account if http username has been changed
* FIXED: httpd: ensure restart ip address is properly cast as unsigned int
* FIXED: httpd: execute logout for any port


374.43_2-26E3j9527  (20-July-2017)
* CHANGED: ipset_arm: update rcu locking in delete for settype hash
* CHANGED: ipset_arm: update rcu locking in add for settype hash
* CHANGED: ipset_arm: take rcu lock when expiring entries from settype hash
* CHANGED: ipset_arm: update ip_set_comment.h to eliminate unneccessary use of kfree_rcu
* CHANGED: ipset_arm: update rcu functions in compat include
* CHANGED: webui: allow for 9999 hours of connect time in wireless log
* FIXED: openvpn: (upstream) undo cipher push in client options state if cipher is rejected


374.43_2-26E2j9527  (15-July-2017)
* FIXED: services: run services-stop during reboot, restore and upgrade prior to stopping usb
* FIXED: iptables: fix iptables-save for trigger rules
* FIXED: firewall: fix rule generation for trigger port ranges
* CHANGED: shared: add replace_char function to strings.c
* FIXED: ipset_arm: take rcu lock when flushing settype hash
* CHANGED: kernel: update include Kbuild for netfilter ipset_arm
* CHANGED: ipset_arm: update kernel to ipset 6.32 settypes
* CHANGED: expat: remove release 2.0.1 (replaced)
* CHANGED: make: update for expat 2.2.0
* CHANGED: expat: install version 2.2.0
* CHANGED: watchdog: change qos check to reduce frequency, use notify_rc
* FIXED: dnsmasq: (upstream) try other servers if first returns REFUSED when --strict-order active
* CHANGED: httpd: don't force re-auth after reboot or firmware upgrade
* CHANGED: others: change directory for saved https certs for Merlin consistency
* CHANGED: openvpn: revert lzo to pre-packaged library version
* CHANGED: httpd: cover case of orphan session on restart/reboot
* CHANGED: firewall: update default rules generation/apply
* FIXED: firewall: prevent duplicate openvpn firewall rules
* CHANGED: openvpn: add firewall rule for vpn client port
* CHANGED: openvpn: support 'always', 'only client active' options for block tunnel
* CHANGED: openvpn: add tunnel down blocking state to status page
* CHANGED: openvpn: reset client enabled status on reboot
* CHANGED: openvpn: block routed clients not enforced if vpn is manually disabled
* CHANGED: ssh: add dropbear inactivity timeout
- CHANGED: openvpn: (backport) better handle misconfigurations where we're missing a route_vpn_gateway
- FIXED: openvpn: (backport) put redirect-gateway def1 into the custom area if found in an imported ovpn
* FIXED: openvpn: add persist-tun if present in imported ovpn file
* CHANGED: httpd: set disconnect timeout to allow for gui operations
* CHANGED: httpd: replace isLogout with ip address aware re-authentication
* CHANGED: httpd: support multiple debug flags for httpd
* CHANGED: httpd: force authorization after auto/forced logout
* CHANGED: upnp: add gui option to clear existing leases
* CHANGED: httpd: add debug switch for httpd diagnostic logging
* CHANGED: others: also copy individual certs when moving https certs to jffs
- FIXED: firewall: (backport) fix upnp rules in dual wan mode
* CHANGED: firewall: add support for nat-loopback in dual wan mode
- CHANGED: curl: (backport) disable proxy, builtin manual and libcurl output options
- CHANGED: wol: (backport) remove since now using busybox ether-wake
* CHANGED: webui: add link to available beta release downloads
* CHANGED: make: update for generic curl; add symlink for curl-7.21.7
* CHANGED: curl: update to 7.54
* CHANGED: curl: remove release 7.21.7
- CHANGED: firewall: (backport) only restart upnpd if already active
- CHANGED: samba36: (backport) add lowercase/uppercase codepage support
- CHANGED: firewall: (backport) don't specify WAN interface for sshd accept rule
* CHANGED: webui: support select for individual openvpn clients
* CHANGED: avahi: update to 0.6.32
* CHANGED: ipset: update to 6.32 for arm
* CHANGED: protect_srv: (backport) update to 380.7627
* CHANGED: dropbear: missing update for protect-srv support after 380.7627 merge
- CHANGED: dropbear: (backport) update to 2017.75
- CHANGED: busybox: (backport) drop modules.dep path hack
- CHANGED: nano: (backport) updated to 2.8.4
* CHANGED: dnscrypt: update to 1.9.5
- CHANGED: samba: (backport) remove unused release 3.6.13
- FIXED: samba36: replace broken getifaddrs() function with a working one
- CHANGED: samba358: make the getifaddrs patch use Samba's own function replacement mechanism instead of patching the main code
* CHANGED: webui: add option for smb2 protocol enable
* FIXED: samba36: remove deprecated null password from config
* CHANGED: samba36: update smb.conf generation & start
- CHANGED: samba36: (backport) build support for samba36
- CHANGED: samba36: (backport) add libconv-1.14
- CHANGED: samba36: (backport) functional code for release 3.6.25
* CHANGED: webui: update port forwarding log page with time left and description
- CHANGED: firewall: restrict PUPNP chain to wan_if
* CHANGED: services: new parameters for miniupnpd 2.0
* CHANGED: firewall: add new chains for miniupnpd 2.0
* CHANGED: build: add upnpigd2 to configuration setup
* CHANGED: make: update for miniupnpd 2.0
- CHANGED: miniupnpd: update to 2.0


374.43_2-25E8j9527  (27-June-2017)
- CHANGED: openssl: update to 1.0.2l
* CHANGED: openvpn: update to 2.4.3
- CHANGED: entware: (backport) update entware-setup.sh
* FIXED: httpd-web: fix saving of jffs backup
- FIXED: services: fix miniupnpd allowed ports configuration


374.43_2-25E7j9527  (15-June-2017)
* CHANGED: webui: change IPTV action_script to restart_wan_if if ipv6 is enabled
* CHANGED: watchdog: changes to support httpd_check with CVE-2017-5892
* CHANGED: radvd: add lan domain advertisement
* CHANGED: kernel: suppress packet with own address log (expected in router environments)
* CHANGED: services: open invokelater to non-usb services and call for httpd start
* FIXED: dhcp6s: fix dhcp6s config errors when using stateful ipv6
* FIXED: webui: ipv6 radvd mtu option incorrectly hidden when disabled
* FIXED: network: bridge multicast snooping option is not valid on mips routers
* FIXED: httpd: additional changes for CVE-2017-5892 port
* FIXED: dnsmasq: remove unneccessary/incorrect ipv6 options
* FIXED: webui: fix QIS wizard to preserve http password
* FIXED: httpd: allow time in non-router mode for dhcp address to be set


374.43_2-25E6j9527  (6-June-2017)
* CHANGED: httpd: only add router.asus.com to cert if running in router mode
* CHANGED: watchdog: restrict extended httpd checks to ARM, router mode only
* CHANGED: kernel: only log suppressed messages warning on MIPS if count exceeds burst limit
* CHANGED: kernel: change packet with own address log from warning to debug
* CHANGED: openvpn: remove persist-tun from default client configuration
- FIXED: openvpn: (backport) if initialization completes, ignore any errno from a previous temp conn/auth failure
* FIXED: httpd: improve CVE-2017-5892 port
* FIXED: webui: fix banner ssid display when in mediabridge mode
* FIXED: wl: add default acs_dfs for all bcmwl6 routers
* FIXED: services: fix miniupnpd restart test 75e305f9
* FIXED: openvpn: clean up extra line after commit 23a68e3


374.43_2-25T5j9527  (3-June-2017)
* FIXED: Revert "samba36: work around bug in validating interfaces config"
* FIXED: samba: force samba to be invoked again later if lan is not yet up
* FIXED: samba: respect jffs2_scripts for samba
* FIXED: rstate: fix incorrect nvram var for checking lan_state

374.43_2-25T4j9527  (31-May-2017)
- FIXED: samba-3.5.8: patch against CVE-2017-7494 (Samba version used by AiDisk, unsure if it was vulnerable to this)
* FIXED: webui: only show wan uptime syslog when in router mode
* FIXED: samba36: work around bug in validating interfaces config
* FIXED: httpd: fix missing set_referer_host from CVE-2017-5892 port
* FIXED: webui: fix http/https options when no in router mode
* FIXED: samba36: work around bug in validating interfaces config


374.43_2-25T3j9527  (28-May-2017)
* CHANGED: Revert "dnsmasq: update to 2.77rc3"
* CHANGED: dnsmasq: mark as 2.76 forked version
* CHANGED: services: start dnscrypt before dnsmasq to allow for large host file processing
* FIXED: dnsmasq: (upstream) when forwarding a query to a non-DNSSEC nameserver, don't verify the lack of DNSSEC
* FIXED: dnsmasq: (upstream) improve connection handling when talking to TCP upsteam servers
* FIXED: dnsmasq: (upstream) fix rrfilter bug leading to malformed replies
* FIXED: dnsmasq: (upstream) Bump TCP connection backlog from 5 to 32
* FIXED: dnsmasq: (upstream) fix problem with --dnssec-timestamp whereby receipt of SIGHUP would erroneously engage timestamp checking
* FIXED: dnsmasq: (upstream) stop treating SERVFAIL as a successful response from upstream servers
* FIXED: dnsmasq: (upstream) fix getsockname error return check
* FIXED: dnsmasq: (upstream) log ipset errors
* FIXED: dnsmasq: (upstream) don't reset packet length on transmission, in case of retransmission


374.43_2-25E1j9527  (15-May-2017)
* NEW: haveged: add support version 1.9.1
* NEW: https: support moving https cert to jffs
* NEW: wl: (experimental) dfs channel support for ac66, ac56, including auto select dfs channels
* CHANGED: openvpn: update to 2.4.2
* CHANGED: dnsmasq: update to 2.77rc3
* CHANGED: libsodium: update to 1.0.12
* CHANGED: nano: update to 2.8.1
* CHANGED: haveged: optimize configs for mips vs arm
* CHANGED: webui: allow 5min for firware upgrade to complete
* CHANGED: init: extend default reboot time for ARM routers by 20sec
* CHANGED: webui: remove nvram warning from https save
* CHANGED: webui: update time in firmware upgrade message
* CHANGED: openvpn: set persist-tun for all dns configs if not dual-wan, do not set for dual-wan
* CHANGED: webui: add popup help for IPTV emf/igmp snooping
- CHANGED: openvpn: (backport) implement importing of reneg-sec parameter from ovpn file
- CHANGED: webui: (backport) ASUS xxs_blacklist checking
- CHANGED: network: (backport) disable bridge multicast_snooping by default
- CHANGED: webui: add bridge multicast option to IPTV page
- CHANGED: shared: (backport) add string function to escape special chars for use in webui
- CHANGED: webui: (backport) make cipher and digest checks non case-sensitive on OpenVPN client
- CHANGED: webui: add connecting state on vpn status page
- FIXED: webui: (backport) ASUS fix for CVE-2017-5891, CVE-2017-5892
- FIXED: webui: (backport) fix variable reuse which was breaking support for multi-partition USB disks
- FIXED: shared: (backport) ensure that get_parsed_crt() always initializes the buffer
- FIXED: openvpn: (backport) prevent potential out-of-bound buffer access on key/certs
- FIXED: webui: (backport) fix variable reuse which was breaking support for multi-partition USB disks
- FIXED: mssl: (backport) disable all 3DES ciphers
- FIXED: services: (backport) only restart upnpd with nasapps if already started
- FIXED: firewall: (backport) only restart upnpd if already active


374.43_2-24E4j9527  (24-April-2017)
* CHANGED: usb: remove old minidlna dbdir if set to new location
* CHANGED: usb: only use default of /tmp/mnt for media dir if no dirs specified
* FIXED: usb: fix potential buffer overruns in minidlna start
* FIXED: usb: fix dbdir discovery for minidlna


374.43_2-24E3j9527  (22-April-2017)
- CHANGED: httpd: update https cert to include SAN extensions for chrome 58


374.43_2-24E2j9527  (17-April-2017)
* NEW: utils: add utilities to move certs between jffs and nvram
* NEW: kernel: add exFAT support (Tomato backport)
* NEW: system: basic exfat support for ARM routers (no utilities)
* NEW: exfat: add utilities support
- CHANGED: kernel: (backport) properly support MSG_PEEK with truncated buffers, CVE-2016-10229
* CHANGED: usb: fsck exfat drives on mount with .asusrouter
* CHANGED: openvpn: call updown even with adns disabled to set ip6tables
* CHANGED: dnscrypt: support random option for resolver
* CHANGED: dsncrypt: update resolver csv to 17-April-2017
* CHANGED: webui: add filter for dnscrypt servers which do not maintain logs
* CHANGED: services: update dnscrypt to use config file and support merlin scripts/conf
* CHANGED: updown: improve check for use of local dns servers


374.43_2-24E1j9527  (15-April-2017)
* NEW: pppd: add support for user host_uniq
* NEW: openvpn: allow moving keys/certs to jffs by entering a path in the gui
* NEW: sshd: move all dropbear keys to jffs when moving authkey
- CHANGED: nano: update to 2.8.0
- CHANGED: firewall: (backport2) add support for protection server GPL 7378
- CHANGED: webdav: update client binaries to GPL 7378
- CHANGED: webstor: update webstorage binaries to GPL 7378
- CHANGED: webui: (backport) add asus db with web backup for oui lookups
- CHANGED: openvpn: upgrade bundled LZ4 library to 1.7.5
- CHANGED: openvpn: (backport) replace deprecated ns-cert-type with remote-cert-tls
- CHANGED: openvpn: mark vpn traffic to bypass CTF if CTF enabled
- CHANGED: pptp: (backport) encryption options for pptp client
- CHANGED: busybox: backport busybox 1.25.1/libdisk from merlin (thru commit 83547ae)
* CHANGED openvpn: update to 2.4.1
* CHANGED: lighttpd: add missing files to repo
* CHANGED: dnscrypt: add missing files to repo
* CHANGED: wget: add missing files to repo
* CHANGED: firewall: shorten name of SECURITY_PROTECT chain to fix formatting in iptables list
* CHANGED: openvpn: explicitly disable ncp when disabled in gui
* CHANGED: filesys: re-enable dosfstools for fat fs and move to /usr/sbin
* CHANGED: webui: update font for textarea tables
* CHANGED: allow moving openvpn server dh to jffs
* CHANGED: dnssec: add new trust-anchor
* CHANGED: wget: update to 1.18
* CHANGED: webui: change performance temp graph to show cooler temps
* CHANGED: webui: cleanup openvpn server stats client table
* CHANGED: busybox: respect syslogd -S option (log smaller)
* CHANGED: busybox: disable wget in favor of gnu version
* CHANGED: busybox: include mktemp (required for EasyRSA)
* CHANGED: webui: obscure pptp/l2tp passwords unless selected
* CHANGED: services: flush inode and dentry in addition to page cache on firmware upgrade
* CHANGED: busybox: 1.25.1 LTS fork compatibility updates
* CHANGED: busybox: update osname string for LTS fork
* CHANGED: wl: add dfs support for eu ac66
- FIXED: ddns: fix 'account name cannot be blank' error
* FIXED: webui: client connected status on openvpn server page
* FIXED: updown: check for existing ipv6 dns block rules before applying
* FIXED: services: fix pidfile cleanup for dnscrypt
* FIXED: dnscrypt: force restart when changing configuration on wan page
* FIXED: dms: do not create user dbdir if usb drive is not mounted


374.43_2-23E4j9527  (23-March-2017)
* FIX: webui: workaround bug in openvpn 2.4 stats dump
* FIX: webui: refactor ctf selection and status on switch control page
* FIX: webui: use minimum of default reboot time when submitting switch control form
* FIX: webui: fix lan registered domain check when lan_name length equals domain length


374.43_2-23E3j9527  (13-March-2017)
* NEW: ipv6: add v6hosts support to gui
* CHANGED: services: free kernel page caches on firmware upgrade
* FIXED: v6hosts: add delay before first ping check to allow client to connect


374.43_2-23E2j9527  (11-March-2017)
* CHANGED: info: update branding for LTS fork (uname, features, banner)
- FIXED: networkmap: fix CVE-2017-6548 - remote code execution
* FIXED: wanduck: always update wan uptime regardless of current wan unit


374.43_2-23E1j9527  (27-February-2017)
* NEW: openvpn: add nvram option to force reverse strict
- CHANGED: openvpn: (backport) allow disable DH usage by entering none in the DH field
- CHANGED: kernel: (backport) fix reuse-after-free in DCCP
- CHANGED: build: (backport) openssl now requires makedepend to be installed - pkg xutils-dev
- CHANGED: openssl: (backport) remove rc4 support
* CHANGED: vserver: add support for source ip on port forward rules
* CHANGED: dnscrypt: update to 1.9.4
* CHANGED: dnscrypt: update resolvers csv to 13 Feb 2017 version
* CHANGED: defaults: remove deprecated lan_invalid_enable
* CHANGED: v6hosts: prevent ping test fail during dnsmasq start
* CHANGED: openvpn: show dnsfilter message if active for WAN client option
* CHANGED: openvpn: increase wait time for time sync complete to accomodate dualwan
* CHANGED: wanduck: start_firewall instead of nat_rules when switching or restoring wan line
* CHANGED: wanduck: add additional diagnostic messages and capabilities
* CHANGED: wanduck: add global variable for dualwan status
* CHANGED: wanduck: add wan unit number to ping detect diagnostic log
* CHANGED: firewall: deprecate lan_invalid_enable option
* CHANGED: ddns: (backport) update url for google ddns
* CHANGED: services: only stop dnsmasq on start if already running
* CHANGED: wanduck: require two successive ping detect cycles for fail
* CHANGED: wanduck: change ping detect to use wan ifname instead of ipaddr
* CHANGED: common: change diagnostics print for killall_tk to show elapsed time
* CHANGED: wanduck: always restart wan interface on switch
* CHANGED: wanduck: revert 3baff67 and return to setting S_IDLE on switch
- FIXED: openvpn: fix cron job for openvpn polling
* FIXED: updown: check for local dns server and allow routing
* FIXED: wget: update .gitignore, tracked files
* FIXED: usb: fix manual disk scan w/usb hub
* FIXED: usb: increase wait time for rc restart_nasapps
* FIXED: samba-arm: security update for CVE-2015-5252; insufficient symlink verification in smbd
* FIXED: samba-arm: security update for CVE-2012-0870; remote code execution vulnerability in smbd
* FIXED: samba-mips: security update for CVE-2015-5252; insufficient symlink verification in smbd
* FIXED: samba-mips: security update for CVE-2012-0870; remote code execution vulnerability in smbd
* FIXED: vpnrouting: prevent vpn routes already in table main from being copied to vpn table
* FIXED: build: fix misc compiler warnings
* FIXED: dnsmasq: update failed query debug log to get correct reason code
* FIXED: wanduck: correctly show wandog_target in debug output
* FIXED: wanduck: revert d6394ac/5887523 to honor internet state change based on web_redirect


374.43_2-23B8j9527  (29-January-2017)
* NEW: ipv6: add scripts for ipv6 hosts auto update
* NEW: webui: add reset button to qos stats charts
- CHANGED:  openssl: update to 1.0.2k
- CHANGED: openvpn: update to 2.4.0 and support new options
- CHANGED: openvpn: (backport) default port for server 2 changed to 1195
- CHANGED: webui: (backport) improved layout of OpenVPN statistic display on the VPN Status page
* CHANGED: qos: update logmessages to show qos stage
* CHANGED: qos: add retries when applying bandwidth limiter rules
* CHANGED: webui: show igmp proxy option when no iptv profile selected
* CHANGED: webui: update for Chrome version 56 changes
* CHANGED: openvpn: do not set persist-tun if dual wan
* CHANGED: webui: add dnscrypt unavailable message if openvpn dns option is relaxed or strict
* CHANGED: wanduck: modify 46e43af to set S_COUNT instead of S_IDLE
* CHANGED: defaults: change wireless scheduler default to off
* CHANGED: webui: allow forcing progess count and apply to serveral pages
* CHANGED: webui: change low nvram threshold for N16 to 1.5K (no openvpn certs)
* CHANGED: debug: reduce debug messages for killall_tk
* CHANGED: webui: reorder openvpn client stats table entries
* CHANGED: build: expand jffs for ARM from 32MB to 64MB
* CHANGED: openvpn: add syslog for vpn client WAN address
* CHANGED: openvpn: support PIA specific options (remap to openvpn 2.4.x)
* CHANGED: openvpn: eliminate unecessary restart of dnsmasq when stopping client
* CHANGED: kernel: backport allow configuring ipv4 subnets as local addresses
* CHANGED: kernel: backport ipv6 AnyIP support from 2.6.37
- FIXED: kernel-arm: Fix access to unitialized pointer (ported from DD-WRT, Broadcom bug)
- FIXED: kernel-mips: Fix access to unitialized pointer (ported from DD-WRT, Broadcom bug)
- FIXED: avahi: (backport) reject access from secondary WAN
- FIXED: cstats/rstats: fix rollover calculation to handle 32/64 bit
- FIXED: samba: fix CVE-2013-4124 Denial of service - CPU loop and memory allocation
* FIXED: qos: handle case of qos starting before wan is up
* FIXED: dnsmasq: add openvpn client adns state change detection to update_resolvconf
* FIXED: openvpn: Openvpn bridge mode on r5638 #457 (backport from wl500g - ARM)
* FIXED: openvpn: Openvpn bridge mode on r5638 #457 (wl500g port - MIPS)
* FIXED: httpd: always allow router address login if specified address only option is selected
* FIXED: watchdog: add test for valid time before curl status check
* FIXED: wanduck: wan uptime timer only reflects primary wan when dual wan set to lb
* FIXED: wanduck: in dual wan fo/fb only set wan timer based on current wan
* FIXED: webui: update alert management for added alerts
* FIXED: webui: remove passwd entry length limit so check routine can detect too long passwd
* FIXED: wanduck: reset disconnect counter on failover/failback
* FIXED: wanduck: do not reset internet state based on web_redirect
* FIXED: wanduck: direct ping test to specified wan interface
* FIXED: wanduck: update dns check to support dnscrypt
* FIXED: build: fix openvpn make for MIPS
* FIXED: wan: update_resolvconf restarts dnsmasq if dnscrypt is active but not in use


374.43_2-22E4j9527  (13-January-2017)
- CHANGED: openvpn: (backport) improve DDNS usage when generating ovpn client config
- CHANGED: nano: update to 2.7.4
* CHANGED: webui: change wait time for WAN page changes to 50% of reboot time
* CHANGED: webui: add hints and popup help for dnssec and dnscrypt options
- FIXED: rc: (backport) fix compile warnings in rc/openvpn.c
* FIXED: qos: use actual wan_ifname for chart upload data retrieve (different from Merlin)


374.43_2-22E3j9527  (12-January-2017)
- NEW: ddns: (backport) add support for Google-DDNS
- CHANGED: services: (backport) improve start/stop of syslogd
- CHANGED: rc: (backport) add support for telnetd and sshd
- CHANGED: httpd: (backport) instruct browser to cache jquery and chart JS files
* CHANGED: dnssec: only enable strict mode after NTP sync completes
* CHANGED: dnssec: only one setting in dual-wan environments (reverts e2f3610a)
* CHANGED: ntp: set ntp_sync when setting ntp_ready in ntpclient
- FIXED: firewall: only add sshd rules if sshd is enabled
- FIXED: sshd: only start sshd and enable watchdog if ssh access is enabled
* FIXED: services: save syslogs to jffs on stop_logger
* FIXED: services: add copy force flag when saving and restoring syslog
* FIXED: sshd: fix df7a3b3 only bind to lan_ipaddr if wan access is not enabled
* FIXED: dnscrypt: add explicit paths to commands in update resolvers script
* FIXED: curl https broken on MIPS


374.43_2-22E2j9527  (6-January-2017)
* FIXED: httpd: fix error in buffer overflow prevention
* FIXED: watchdog: do not restart ntpd if detected as down during reboot
* FIXED: dnsmasq: stop dnsmasq on update_resolvconf if during reboot
* FIXED: dnscrypt: do not allow ARM WAN clients to use dnscrypt if primary resolver is ipv6


374.43_2-22E1j9527  (5-January-2017)
* NEW: qos: new traditional qos implementation
* NEW: dnscrypt: add dnscrypt support 1.9.0
* NEW: dnscrypt: add support for second dnscrypt resolver and ipv6
* NEW: dnscrypt: allow ARM based routers to use dnscrypt for non-VPN clients
* NEW: kernel-arm: backport support for route_localnet
* NEW: webui: add option for strict DNSSEC enforcement
* NEW: add dnscrypt resolvers updater script
- CHANGED: build: (backport) preserve datestamp of ca-bundle.crt
- CHANGED: curl: (backport) enable IPv6 support
- CHANGED: dnsmasq: (backport) add --dns-loop-detect support
- CHANGED: nano: (backport) update to 2.7.1
- CHANGED: openvpn: (backport) change the default OpenVPN server cipher to the more secure AES-128-CBC
- CHANGED: openvpn: update to 2.3.14
- CHANGED: rc: (backport) move dualwan static routes to a lower priority, so VPN policy rules will have priority
- CHANGED: webui: (backport) implement QoS classification statistics page
* CHANGED: defaults: change byte limits for default qos rules
* CHANGED: mtd: skip bad blocks during erase for ARM
* CHANGED: webui: add resolver and port checks for dnscrypt instances
* CHANGED: webui: alert options which will make DNSCrypt not be used
* CHANGED: webui: change syslog message level selection to standard syntax
* CHANGED: webui: convert qos rules with specified any byte count to rules with no byte count
* CHANGED: webui: don't explicity restart_dnsmasq if dnscrypt parms change
* CHANGED: webui: prevent use of registered domain names for router domain
- FIXED: httpd: (ASUS) fixed security vulnerabilities regarding XSS and CSRF
- FIXED: rc: (backport) merge host and domain names when building the OpenVPN exportable client config if using Namecheap as DDNS
- FIXED: webui: add chart.min.js to mime handler
- FIXED: webui: (backport) report error if importing an ovpn file with a missing/invalid key or certificate
- FIXED: dropbear: only listen on lan_ipaddr
- FIXED: httpd: fix potential buffer overruns
* FIXED: openvpn: do not force set status at end of start when not needed
* FIXED: openvpn: fix multiple issues in starting/stopping vpn services
* FIXED: openvpn: handle dnscrypt dns in update_resolvconf
* FIXED: openvpn: set up firewall before starting openvpn server and client
* FIXED: qos: fix qos_stats to not round bytes transferred
* FIXED: updown: block ipv6 dns queries with vpn active based on ipv6 dns mode
* FIXED: dropbear: upstream fixes for variable initialization


374.43_2-20ECj9527  (20-November-2016)
* CHANGED: iptables: support --set-mark mark[/mask] on MIPS routers


374.43_2-20EBj9527  (16-November-2016)
* CHANGED: ipv6: (MIPS) add debug logs for processes adding ipv6 routes
* CHANGED: ipv6: (ARM) add debug logs for processes adding ipv6 routes
* FIXED: webui: fix router address display in ipv6 log page
* FIXED: dnsmasq: only add dualwan nameservers if second wan active
* FIXED: qis: iptv options display during setup
* FIXED: qis: hang when setting internet type during setup


374.43_2-20EAj9527  (9-November-2016)
* CHANGED: dnssec: add separate settings for dual wan environments
* FIXED: ftp: add missing builddef files for ssl support


374.43_2-20E9j9527  (2-November-2016)
* CHANGED: ipv6: provide separate rapid-commit nvram options for client and server
* CHANGED: sys: add export TZ to spawned shell
* FIXED: usb: only remove usb3 modules at start of reboot if disabled
* FIXED: webui: fix option display for dual wan with ethernet


374.43_2-20E8j9527  (31-October-2016)
- CHANGED: usb: update ftp daemon start method
- CHANGED: vsftpd: (backport) add ssl support


374.43_2-20E7j9527  (28-October-2016)
- CHANGED: openvpn: (backport) add webui setting for the auth digest alg to OpenVPN client and server
* CHANGED: ipv6: change default for sending ia-na
* FIXED: webui: use epoch time instead of new_format systime in WAN uptime calcs
* FIXED: webui: filter transients in WAN current timer
* FIXED: wan: stop upnp when stopping wan interface
* FIXED: firewall: limit dropped packets logging if DoS protection is set


374.43_2-20E6j9527  (24-October-2016)
- CHANGED: dropbear: (backport) disable MD5 support, for security reasons
- CHANGED: vpn: (backport) sync policy rules priorities with Merlin
- FIXED: build: (backport) autoreconf nano on rebuild, to hopefully work with people using older build environments
- FIXED: rc: (backport) re-create passwd after the JFFS2 partition is mounted, in case we have custom configs stored there
- FIXED: kernel-mips: (backport) patch the 2.6.22.19 kernel against CVE-2016-5195


374.43_2-20E5j9527  (23-October-2016)
* CHANGED: dhcp6s: force separate entry for each name server
* CHANGED: ipv6: add nvram option to disable rapid-commit


374.43_2-20E4j9527  (23-October-2016)
* CHANGED: webui: resize data windows for log status pages
- FIXED: kernel-arm: (backport) Patch 2.6.36 kernel against CVE-2016-5195
- FIXED: ipset_arm: (backport) some build systems try to link against the wrong library, ensure we do link against our built libmnl.so
* FIXED: wan6: reset force address request flag on wan6 down


374.43_2-20E3j9527  (18-October-2016)
* CHANGED: networkmap: backport some additional ASUS optimizations
* FIXED: qos: use correct protocol ip for u32 matches
* FIXED: ctf: don't enable ctf if cstats is enabled (ASUS bug)
* FIXED: ipv6: change dhcp6c options for prefix lengths <64


374.43_2-20E2j9527  (11-October-2016)
- CHANGED: busybox: (backport) enable module alias support in modutils
- CHANGED: webui: (backport) implement option to reset an OpenVPN instance to its default settings
- CHANGED: openvpn: (backport) disable reverse-path filtering when enabling policy-based routing
* CHANGED: networkmap: improve debug messaging
* CHANGED: webui: force reboot when changing certain lan parameters with ipv6 active
* CHANGED: busybox: add getopt utility
* CHANGED: webui: add dual stack warning to openvpn client
* CHANGED: helper: added pc-delete() for postconf scripts
- FIXED: make: update autoreconf make for ipset for compatibility
- FIXED: ipset_arm: (backport) provide a modprobe.conf file with the list of module aliases used by ipset6 mapping modules
* FIXED: networkmap: set type as PC if unknown SMB found
* FIXED: usb: only run scheduled disk scans if system time has been set


374.43_2-20E1j9527  (5-October-2016)
- CHANGED: firewall: (backport) allow bogus DHCP REPLIES from broken ISPs on renewals, not just on initial lease
- CHANGED: init: (backport) improved detection for CTF FA mode
- CHANGED: nano: (backport) add support for all supported models
- CHANGED: openssl: update to 1.0.2j
- CHANGED: ssh: (backport) allow WAN access to SSH over IPv6 if WAN access is enabled
* CHANGED  iptv: re-add basic support for meo, vodafone and hinet profiles
* CHANGED: webui: add wan total uptime and current uptime to syslog general page
* CHANGED  updown: only enable ipv6 dns leak protection if not in dns exclusive mode
* CHANGED: networkmap: improve performance, revert added delays
* CHANGED: diskmon: add timestamp to autochk results
* CHANGED: webui: update ping options in network analysis
* CHANGED: firewall: support fixed Interface ID (EUI64) ipv6 destination addresses
* CHANGED: openssl: updated CA bundle to September 26th version
* CHANGED: webui: updated low nvram alert to less than 3K available
- FIXED: networkmap: (backport) fix leaked file descriptors
- FIXED: rtstate: (backport) set default for dual wan if not set
- FIXED: webui: (backport) hide forced refresh field if DDNS is disabled
- FIXED: rc: (backport) do not try to fill the remote field in the exported OpenVPN client config if DDNS type is set to Custom
- FIXED: nano: fix Makefile to generate/use ncurses pc files
- FIXED: rc: (backport) apply same DHCP workaround for broken DHCP servers to dualwan mode
- FIXED: networkmap: (backport) fix memory leak - missing free()
- FIXED: networkmap: (backport) fixed numerous leaked handles, missing socket close() calls on error cases
* FIXED: diskmon: get correct run frequency if scan schedule set for multiple drives (ASUS bug)
* FIXED: dhcp6c: try to recover if unable to release ifp
* FIXED: networkmap: abort arp scan if unable to create socket
* FIXED: iptv: always check VID and PRIO for valid values prior to submit (ASUS bug)
* FIXED: ntp: only perform dnsmasq check if running in router mode
* FIXED: webui: fix login_state_hook if using https login (ASUS bug)
* FIXED: ctf: additional backports to support fa_mode capability detection (fixes firmware update errors)
* FIXED: webui: correctly handle ctf_fa_mode selection
* FIXED: webui: change oui lookup from ieee.org to macvendorlookup.com


374.43_2-19E3j9527  (8-September-2016)
* FIXED: Revert support for added IPTV profiles (causing update issues)
* FIXED: defaults: set correct factory default for new dhcp6c release
* FIXED: webui: updated link to latest firmware


374.43_2-19E2j9527  (8-September-2016)
* CHANGED: iptv: disable multicast since not currently used
* CHANGED: init: explicity initialize some new nvram vars if no factory reset


374.43_2-19E1j9527  (8-September-2016)
- CHANGED: aicloud: (backport) update APP-IPK library
- CHANGED: aicloud: (backport) updated webdav configuration gen
- CHANGED: dnsmasq: (backport) move dnssec trust anchor to conf file
- CHANGED: iptv: (backport) updated predefined providers; add multicast_iptv support
- CHANGED: iptv: (backport) add updated profiles to quick setup
- CHANGED: nettle: (backport) increase optimization level to speed up dnssec validation
- CHANGED: nettle: update to 3.2
- CHANGED: openssl: (backport) update CA bundle to 20 April version
- CHANGED: openvpn: (backport) no longer dump stats to syslog when opening status page
- CHANGED: updhcpc: (backport) add support for vendor class dhcp option 60
- CHANGED: webui: (backport) add upnp secure mode option
- CHANGED: webui: format numbers in VPN Status page
- CHANGED: firewall: change default for ipv6 neighbor soliciation filter to off
* CHANGED: dhcp6c: add option to force address REQUEST for some ISPs
* CHANGED: dhcp6c: add option to not release addresses on exit
* CHANGED: dhcpv6: added additional dhcp6c logging/debug
* CHANGED: dhcpv6: redo logging levels to make LOG_NOTICE available for status entries
* CHANGED: dhcpv6: upstream fixes from debian 20080615-13
* CHANGED: dropbear: include dropbearconvert utility
* CHANGED: ipset: update to 6.29 for ARM routers (includes ipv6 support)
* CHANGED: ipv6: allow other than 64 prefix lengths for native ipv6
* CHANGED: jquery: update to 1.12.4
* CHANGED: minidlna: (upstream) special detection for Allshare/Windows clients
* CHANGED: minidlna: use odmpid for model name if available
* CHANGED: openvpn: misc script cleanup
* CHANGED: openvpn: update to 2.3.12
* CHANGED: webui: updated ipv6 gui to support the new options
- FIXED: system: custom script calls for igmpproxy
- FIXED: openvpn: (backport) do not show policy rules option for openvpn client tap mode
* FIXED: dhcpv6: add skip-ctlport patches
* FIXED: dhcpv6: fix MIPS builds with upstream fixes
* FIXED: disk: scheduled disk scans would run on wrong disk
* FIXED: dropbear: reapply patches dropped during last update (X11FWD and SFTP-SERVER)
* FIXED: firewall: fix bad rules when NSF and PControl are both active
* FIXED: iptv: always check VID/PRIO values prior to submit
* FIXED: ipv6: config file changes for prefix length support
* FIXED: minidlna: would use a new uuid on every restart
* FIXED: openvpn: nvram errno not being set
* FIXED: qos: add single mac rules to ipv6
* FIXED: qos: fix adding single hosts by mac to ipv6 mangle rules (pass 2)
* FIXED: webui: handle multiple selections with same value for qos_overhead
* FIXED: webui: remove obsolete help from NSF


374.43_2-18E3j9527  (13-August-2016)
* FIXED: should not allow qos_overhead option on MIPS routers
* FIXED: could not Apply settings in Administration>System on IE11


374.43_2-18E2j9527  (6-August-2016)
- CHANGED: dropbear: update to 2016-74
- CHANGED: webui: (backport) Convert MACs to uppercase when entered on the DHCP static lease form
* CHANGED: qos: update and clarify ATM overhead options for DSL
* CHANGED: webui: add percent utilized to nvram tools status
* CHANGED: ntp: make sure dnsmasq is up before attempting ntp update
- FIXED: timemachine: add missing include
* FIXED: webui: http logon dialogue shown on autologout


374.43_2-18E1j9527  (21-July-2016)
- CHANGED: openvpn: update to 2.3.11
- CHANGED: openssl: update to 1.0.2h
- CHANGED: dnsmasq: update to 2.76final
- CHANGED: lighttpd: update to 1.4.39
- CHANGED: mDNSResponder: update to latest ASUS release
- CHANGED: timemachine: update to latest ASUS release
- CHANGED: (multiple backports) support codel/fq_codel on ARM
- CHANGED: (backport) kernel-arm: patch mirred so it will preserve kernel marks
- CHANGED: (backport) kernel-arm: sync netfilter modules with fixes from kernel 4.0
- CHANGED: webui: only reboot on qos change when required - remove restart_firewall on other cases
- CHANGED: vts: (backport) no need to reboot vts/port forwards for ctf enabled
- CHANGED: kernel: (backport) activate 64M ROOTFS and TEMPROOTFS for ARM
- CHANGED: nat: change default NAT loopback method from Merlin to ASUS
- CHANGED: webui: add common password checking for router password
* CHANGED: wl: allow extended 5GHz channels to be enabled for EU N66 (wl_dfs_enable)
* CHANGED: improvements to traditional qos
  - traditional qos download class bandwidth changes
  - add quantum to download class
  - adjust mtu/quantum to account for hardware header length
  - restore all marks in PREROUTING instead of only from input eth0
  - backport r2q calculation (tomato)
  - update qos police filters
  - workaround for bug in restore-mark
  - allow up to 15 marks for traditional qos for custom rules
  - remove default from tc class since its controlled by iptables
  - change download filter protocol to all to cover ip and ipv6
  - add option to control ATM overhead (backport from Merlin/Tomato)
* CHANGED: openvpn: only set persist-tun if not DNS exclusive mode
* CHANGED: dnsmasq: add priority debug syslog for failed queries
* CHANGED: httpd: add port to login messages; add disconnect logout message
* CHANGED: webui: sort DHCP leases syslog by time remaining
* CHANGED: webui: add low nvram notification in banner
* CHANGED: webui: add firewall disabled notification in banner
* CHANGED: webui: add alert message when attempting to disable firewall
* CHANGED: qos: update start complete log message for tqos vs bwl
* CHANGED: kernel: r2q change message from priority WARNING to priority DEBUG
* CHANGED: busybox: include mktemp (required for EasyRSA)
* CHANGED: busybox: add time utility
* CHANGED: wget: replace busybox wget and add https support
* CHANGED: dnsfilter: prevent adding unneccessary rules which match the global filter mode
* CHANGED: dnsmasq: add priority debug syslog for failed queries
* CHANGED: wan: changed default DHCP query frequency from Aggressive to Normal
* CHANGED: dhcpc: (upstream) use client IP address as source address for DHCP renew/rebind messages
* FIXED: watchdog: don't repeatedly try and stop ntpd if not started
* FIXED: webui: fix typo in Wireless Log page
* FIXED: httpd: fix duplicate login syslog messages
* FIXED: qos: flush ebtables nat at start of bandwidth rules generation
* FIXED: qos: only add rule for Merlin NAT loopback when Merlin NAT loopback enabled
* FIXED: qos: open file after clearing for bandwidth_limiter rules generation
* FIXED: qos: properly clean up tc rules on bandwidth limiter qos stop
* FIXED: webui: fix priority level assignment on qos bandwidth limiter
* FIXED: webui: wrong rule deleted in traditional qos rules


374.43_2-17E8j9527  (9-April-2016)
* CHANGED: No longer flush the mangle table on QOS start, just delete any existing QOS rules
* CHANGED: Rewrite VPN exclusive mode/ISP DNS code
* CHANGED: Source address field added to Port Forwarding system log page
* CHANGED: default for radvd DecrementLifetimes changed to off
* FIXED: Dropbear: validates xauth input (security fix from upstream)
* FIXED: Dropbear: disable X11 forwarding support (security fix)
* FIXED: Enhanced httpd status watchdog could incorrectly shutdown on the first failure/recovery
* FIXED: Native DHCP addresses could sometimes fail to renew successfully
* FIXED: Traditional QOS gui issues in modifying or deleting user rules
* FIXED: Client names not shown in Parental Controls selection pulldown
* FIXED: add missing rule for ASUS NAT loopback with vts/dmz


374.43_2-17E5j9527  (20-March-2016)
* CHANGED: Default state for WPS is disabled after a reset to factory defaults
* FIXED: NAT Loopback not working if booting with QOS active
* FIXED: NAT Loopback not working on MIPS routers
* FIXED: Saved nvram CFG file could not be restored
* FIXED: Stop doing http/https response checks if restarting httpd does not prevent errors


374.43_2-17E2j9527  (15-March-2016)
* CHANGED: Change default for sfq limiting in traditional QOS to auto (1) during a factory reset.
* CHANGED: Improved dnsmasq resolv.conf handling (Merlin backport)
* CHANGED: Updated iproute2 to latest ASUS levels (ASUS backport)
* CHANGED: Updates to the Traditional QoS rules pages so that the client name is now shown in addition to the MAC address
* CHANGED: ntp time syncs now based on boot time instead of the top of every hour
* CHANGED: ntp sync retries adjusted to comply with time server tos
- CHANGED: Add HW acceleration FA status to the Tools page for 68P users
- CHANGED: Changed mark for NAT loopback from 0xb400 to 0x8000 (Merlin backport)
- CHANGED: Updated OpenSSL to 1.0.2g
* FIXED: A fix for the VPN client state nvram variables not being set correctly when the client is fully up
* FIXED: Added QoS rules status check to watchdog to handle case of slow to start IPv6
* FIXED: Autostart of OpenVPN servers/clients now waits up to 1 minute to obtain a valid system time before starting
* FIXED: Fix for gui hang if a different client has been logged on and is now displaying the logout page
* FIXED: Optimize native IPv6 boot process
* FIXED: Fixes for native IPv6 failing in the event of a modem reboot
* FIXED: Simple NTPD server will now not start until system time is valid (via watchdog)
* FIXED: Fix for ICMPv6 when QOS is enabled (Tomato backport)
- FIXED: Fixes for QoS and IPv6 accept RA (Tomato backport)
- FIXED: 20+ Memory leak fixes (backported from Shibby Tomato and Linux repository)
- FIXED: OpenVPN clients will now all run at the highest DNS security level (Merlin backport)
- FIXED: Selected updates for IPROUTE2, udhcpc and dhcp6c from later ASUS levels
* NEW: Ability to disable DNSSEC permissive mode (only accept signed responses)
* NEW: Ability to specify the number of threads for the NFS server (default is now 2 threads)
* NEW: Add NVRAM option to set number of threads for NFS server (default now set to 2)
* NEW: Added sshd process to watchdog
* NEW: Enhanced httpd watchdog that now checks the process is responding in addition to being loaded.
* NEW: Improved syslog messages for services start/stop
* NEW: Option to set MTU for native IPv6 - initially will be set to 1280 for maximum compatibility
* NEW: The manually assigned DHCP address list is now automatically sorted by IP (code by @aswild)
- NEW: Added ca certs to curl support (Merlin backport)
- NEW: Added JFFS backup function (Merlin backport) - access via Administration>Restore/Save/Upload Settings page
- NEW: Clients set to bypass OpenVPN in policy based routing may now use default DNS servers in exclusive mode (Merlin backport)
- NEW: DNSSEC support (Merlin backport)
- NEW: NVRAM option to use ASUS NAT loopback method instead of the default Merlin implementation (special cases only)
- NEW: Support for AUS QoS Bandwidth Limiter


374.43_2-16E1j9527  (12-January-2016)
- CHANGED: Updated OpenSSL to 1.0.2e
- CHANGED: Updated e2fsprogs to latest Merlin level
- CHANGED: Increased max Parental Controls to 32
- CHANGED: Updated entware install script to entware-ng
- CHANGED: Added support for igmpproxy customization
* CHANGED: Updated kernel Ethernet driver for ARM routers
* CHANGED: Updated packet matching netfilter for ARM routers with improved IPv6 support
- CHANGED: Updated usbmodeswitch to 2.2.3
- CHANGED: Updated AICloud to latest ASUS binaries
- CHANGED: Updated ASUS WebStorage to latest ASUS binaries
- CHANGED: Updated OpenVPN to 2.3.10
* CHANGED: Updated LZO to 2.09
* CHANGED: Remove TCP ALL selection from Network Filter protocols
* CHANGED: Show successful NTP syncs in syslog by default
* CHANGED: OpenVPN policy mode pass standard parameters if not specified
* NEW: Allow changing the alternate NTP server in the gui
* NEW: Allow changing the time between NTP syncs in the gui ('0' disables sync attempts)
* NEW: Support OpenVPN custom setup for Private Internet Access (PIA) users
* NEW: User QoS rules can now specify an address range
* NEW: User QoS rules can now specify addresses in CIDR format
* NEW: Add new option to System Log>Connections to display connection count summary
* FIX: Closed multiple buffer overflow exposures (via code review)
* FIX: Fixed numerous issues during boot when QoS is active with native IPv6
* FIX: IPv6 performance degredation when using QoS rules that specified an IP address
* FIX: Option to advertise router as IPv6 DNS server with native IPv6 (default)
* FIX: Smart Sync not syncing after start (ASUS binary updates)
* FIX: Router boot failure if NFS is active
- FIX: Vendor lookup from the networkmap client status
* FIX: Disk Utility disk scan unable to run or runs on wrong drive



374.43_2-15E5j9527  (16-November-2015)
* FIXED: missing crl definition for OpenVPN server


374.43_2-15E4j9527  (15-November-2015)
* FIXED: CIDR validator not available to all web pages


74.43_2-15E3j9527  (11-November-2015)
* CHANGED: Dropbear: Reverted to 2015.67 due to Chrome compatibility problems
* CHANGED: NTP update schedule option
* CHANGED: Harden buffer for QOS ipv6_prefix assignment
* FIXED: Fix potential collision with reboot scheduling and ntp updates


374.43_2-15E2j9527  (7-November-2015)
* CHANGED: Updated logging for NTP updates


374.43_2-15j9527  (4-November-2015)
* CHANGED: Add categories to Administration/System webui
* CHANGED: Improvements to syslog loglevel management
* CHANGED: Increase number of lines displayed in syslog
* CHANGED: Minor webui formatting changes
* CHANGED: Revert QOS policing change possibly causing Xbox slowdowns
- CHANGED: Add short password check for router password (ASUS-Security)
- CHANGED: Add support for OpenVPN CRL certificates
- CHANGED: Allow using a CIDR-formatted IP on the Firewall configuration page
- CHANGED: Allow using privileged ports 1-1023 for http/https
- CHANGED: Update avahi-daemon to 378 level
* FIXED: Issue alert if max SSH key length is exceeded
* FIXED: NTP client not working after initial boot timesync
* FIXED: Only reboot when necessary on Administration/System page
* FIXED: Prevent Chrome from autocompleting password fields
- FIXED: Ensure QOS ebtables flag is correctly initialized (ASUS)
- FIXED: Fix dhcp routes metric to avoid conflict with pptd
- FIXED: Fix resource leaks in lpd test
- FIXED: OpenVPN server subnet topology is only valid in TLS-TUN mode
- FIXED: Dropbear - SSH Tunnel drops when accessing invalid resource
- FIXED: Minidlna – Selected upstream server discovery fixes
- FIXED: SSH buffer overflow for keys greater then 2048 characters
- FIXED: Web server URL handler buffer overflow (ASUS-Security)
- FIXED: Web server accept language buffer overflow (ASUS-Security)
- FIXED: Web server host name buffer overflow (ASUS-Security)
* NEW: Networkmap can now recognize UNIX/Linux clients as a PC
* NEW: Router can now act as local SNTP server
- NEW: Add support for scheduled reboots


374.43_2-14E1j9527 (17-September-2015)
* FIXED: Cannot access gui after a factory reset
* FIXED: Logon may be blocked with changed http port
* FIXED: Auto logout not working if switch between http and https
* FIXED: Correctly update path in external command in dropbear
* FIXED: Networkmap sometimes cannot identify client
* NEW: add sfq limit and r2q options for QOS (experimental)


374.43_2-14j9527 (3-September-2015)
* CHANGED: Allow decimal entries in QOS Mb/s
* CHANGED: Allow paste into system password field
* CHANGED: Enable reflector for Avahi interfaces
* CHANGED: Improve readability of text input blocks
* CHANGED: QOS priorty selections to 5 percent steps
* CHANGED: Router HTTP port only bound to router IP address
* CHANGED: Update police filters for ARM QOS
* CHANGED: Validate password length during save
* CHANGED: dnsmasq (router) now default for IPv6 DNS server
- CHANGED: Added a watchdog for the watchdog
- CHANGED: Added watchdog for HTTPD
- CHANGED: Change NAT loopback mark value to avoid collision with QOS
- CHANGED: Change default for TCP_CONNTRACK_ESTABLISED to 40min (was 5 days)
- CHANGED: Preserve existing marks when updating ebtables rules
- CHANGED: Update OpenVPN to 2.3.8
- CHANGED: Update QOS rules mask value
- CHANGED: Update dnsmasq to 2.75 final
- CHANGED: Update dropbear to 2015.68
- CHANGED: Update miniupnpd to 1.9.20150723
* FIXED: Add broadcast flag to GUI generated WOL command
* FIXED: Display of special characters in SSID in Site Survey
* FIXED: Fixed setting of schedules for disk utility
* FIXED: GUI icon shift when access disk utility page
- FIXED: Memory leak in QOS rules setting
* FIXED: Remove redundant routes from policy based VPN routing table
* NEW: Ability to change router GUI HTTP port
* NEW: Add IPSET support in dnsmasq for IPv4 addresses
* NEW: Add user selection for setting QOS default priority
* NEW: LED Stealth option to only show power status/LED
* NEW: Add option to disable running of user scripts/configs


374.43_2-13E3j9527 (20-July-2015)
* CHANGED: Prevent troublesome characters from being used in SSIDs
* FIXED: Fixed typo in setting OpenVPN client autostart


374.43_2-13E2j9527 (17-July-2015)
* FIXED: Really fix setting TCP_MAX_CONNECTIONS after a factory reset


374.43_2-13E1j9527 (14-July-2015)
* CHANGED: MTU Advertisement defaults to enabled for all interfaces
- FIXED: DDNS periodic update checks runs continuously


374.43_2-13j9527 (11-July-2015)
* CHANGED: Additional error checking for PPPoE MTU/MRU values
* CHANGED: IPv6 log reformatted to put DNS servers on separate lines
- CHANGED: Cleanup of IPv6 start/stop/nvram management
- CHANGED: Delay refresh of gui when starting/stopping OpenVPN
- CHANGED: Support Init and Rules calls for qos-start script
- CHANGED: Updated OpenSSL to 1.0.2d
- CHANGED: Updated dnsmasq to 2.73rc9
* FIXED: IPv6 downloads throttled with QoS enabled
* FIXED: TCP max connections incorrect after factory reset
* FIXED: Unable to obtain IPV6 address in PPP connections
- FIXED: DH key length check would hang on MIPS routers
* NEW: New option to disable IPv6 MTU advertisement


374.43_2-12j9527 (19-June-2015)
- CHANGED: OpenSSL replace DH key gen with pre-gen 2048 bit key
- CHANGED: OpenSSL automatically updates DH key if < 1024 bits
* CHANGED: Increase gui refresh times for VPN Server/Client
* CHANGED: Clean up formatting of Route status log
* CHANGED: Put temporary addr on new line in IPv6 log


374.43_2-12c2j9527 (17-June-2015)
* CHANGED: Only flush pagecache (drop_caches) when required for ARM
* CHANGED: Fix memory leak in fscache (tomato backport)


374.43_2-12c1j9527 (17-June-2015)
- CHANGED: Update OpenSSL to 1.0.2c
* FIX: Increase gui refresh delay when starting VPN Server


374.43_2-12a1j9527 (16-June-2015)
- CHANGED: Update OpenSSL to 1.0.2a
- CHANGED: OpenVPN server generated DH key length to 1024bits
- CHANGED: OpenVPN updated to 2.3.7
- CHANGED: Updated Entware install scripts
- CHANGED: dnsmasq update to version 2.73rc1.patch
- CHANGED: miniupnpd update to version 1.9.20150430
- CHANGED: pppd backport update to version 2.4.7
- CHANGED: rp_pppoe backport sync with 378 codebase
* CHANGED: Upstream fixes for radvd
* CHANGED: Add DeprecatePrefix option to radvd.conf to force faster release of IPv6 addresses
* CHANGED: Changed INVALID packet rule to external interface only and make it the default
* CHANGED: Expand list of recognized files for album art in Media Server
* CHANGED: IPv6 tomato backport to add option to set default ipv6 routing for PPPoE/IPv6 connections
* CHANGED: Show correct model no in minidlna and miniupnpd
- CHANGED: Add support for new ciphers available in OpenSSL 1.0.2
- CHANGED: Check for only valid characters in client name fields
- CHANGED: Completely remove the run command page for security
- CHANGED: OpenVPN - Allow specifying the destination on policy routing rules to define routing exceptions
- CHANGED: OpenVPN - Apply rules at boot time to ensure blocking is respected
- CHANGED: OpenVPN - Only apply routing blocking on tunnel going down if policy based routing active
- CHANGED: OpenVPN - Separate policy rules for client 1 and 2
- CHANGED: Revert our old fix for Beeline as some people report better results with default code
- CHANGED: Turn off exclamation point warning for guest access modes
* FIXED: Filter client RSSI values if bad value returned
* FIXED: Include guest clients in wireless stats on tools page
* FIXED: Removed unneccessary scroll bars from log pages
* FIXED: radvd - add default value for ppp mtu
- FIXED: OpenVPN - Ensure that we restore previous DNS-settings
- FIXED: OpenVPN - Update routing tables if user switches modes when tunnel is down
- FIXED: OpenVPN - wait until NTP sync was complete before starting
- FIXED: Remove false syslog errors on loading nf_conntrack_ipv6 and proxyarp
* NEW: Add option to disable Media Server scan at every boot


374.43_2-11E1j9527 (01-May-2015)
* FIXED: Fix banner formatting for NL support, add ellipses to SSIDs


374.43_2-11j9527 (27-April-2015)
* CHANGED: ASUS save configuration now includes code level in the file name
* CHANGED: Added ability to disable Comcast IPv6 Neighbor Solicitation fix
* CHANGED: Added existing JFFS2 syslog copy option to gui
* CHANGED: Color coding of connections in the Wireless Log
* CHANGED: Improved stability during boot when processing NAT rules
* CHANGED: Update RADVD to version 1.15
* CHANGED: Updated DDNS info formatting on index page
* CHANGED: Updated banner formatting
* CHANGED: Updated timezone info for Chile and Moscow
- CHANGED: Allow use of client chain CA certificates
- CHANGED: Optimizations for supporting components such as the webui server, dropbear and SQLite
- CHANGED: Remove non-functional external firewall option from VPN Client page
- CHANGED: Removed obsolete 'Turbo' button dialogue for AC68
- CHANGED: Updated ciphers: remove RC4, include ECDHE
- CHANGED: mtd-erase options for additional partitions
* FIXED: Finally fix nvram status of OpenVPN server/client (multiple commits)
- FIXED: Avoid truncated printouts on USB printers
- FIXED: Fix corrupted username/password lists in VPN Server page
- FIXED: Fixed MSS clamping rules
- FIXED: Fixed segfault in Wireless Log
- FIXED: CTF patch for MIPS routers
- FIXED: Only generate httpd SSL keys when required
- FIXED: Resolved ARM routers requiring a second boot to format jffs
* NEW: Ability to specify cron logging level ( nvram set cron_loglevel=<number> )
* NEW: Added ability to save https generated certification (persistent across reboots)
* NEW: New option to allow local subnet forwarding (special case)
- NEW: Dual DNS servers, and ability to disable the router as a DNS server
- NEW: Periodic verify for DDNS WAN IP and hostname
- NEW: Policy based routing for VPN connections


374.43_2-10E1j9527 (23-March-2015)
* FIXED: VPN Details page corruption


374.43_2-09j9527 (16-March-2015)
- CHANGED: Revert to original ASUS web-redirect rules
* CHANGED: Check for dnsmasq status after start_lan
* CHANGED: Make Never the default setting for Web_Redirect
* CHANGED: Show NA instead of 0 if RSSI/SNR not available in Wireless Log
* FIXED: Options correctly initialized on Wireless/Professional in Repeater mode
* FIXED: DDNS selections could not be applied
* FIXED: Added retries during iptables-restore cmds


374.43_2-08j9527 (10-March-2015)
- CHANGED: Remove built-in DownloadMaster packages (will be downloaded at install time)
- CHANGED: Update entware-setup.sh (ARM)
- CHANGED: Update entware-setup.sh (MIPS)
- CHANGED: Updated OpenSSL to 1.0.0q (maintainance only)
- CHANGED: Wireless Log fix for Guest clients
- CHANGED: Wireless Log format
* CHANGED: busybox: include uniq and dos2unix coreutils
- CHANGED: init-broadcom: Allow reg_mode=strict_h for EU routers
- CHANGED: makefile: include curl for all builds
* CHANGED: radvd Add support for non 64 prefix size
- CHANGED: rc added custom config postconf support for Avahi afd and mt-daap
* FIXED: Map busybox-4609f4 CVE-2013-1803 (Security)
* FIXED: Move Extend_TTL_Value from WAN to Firewall page and save across reboots
* FIXED: Set delay before starting networkmap at boot based on reboot_time
- FIXED: Wireless-Log RSSI, Connected, Flags fields
- FIXED: XSS vulnerability in Main_Analysis_Content.asp (Security)
- FIXED: busybox: respect syslogd -S option
- FIXED: dnsmasq add delay after stop when restarting
- FIXED: dnsmasq: prevent multiple instances
- FIXED: firewall clean up INVALID state rules again
* FIXED: fw: do not reset beamforming options to default during firmware upgrade
* FIXED: kernel: add xt_hl module required for Extend_TTL option
- FIXED: networkmap: prevent multiple instances
- FIXED: networkmap: update nvram var for fullscan
- FIXED: only forward WAN interface to the router's httpd if the associated protocol is enabled
- FIXED: samba: Apply patch for CVE-2015-0240 to the Samba instance used by AiCloud (Security)
- FIXED: webui fix corrupted MAC filter list when removing then re-adding entry
- FIXED: webui: Don't offer the option of disabling regulation mode if in a DFS-enabled region
* NEW: Add modules required for webmon for MIPS and ARM
- NEW: Backported Custom DDNS scripting from Merlin master
- NEW: entware: Added ARM version of setup script, pointing to zyxmon's qnapware repository
* NEW: firewall: add forward rule for ipv6 dhcp - maybe fix Comcast connect?
* NEW: syslogd: add nvram var for -S small parameter
* NEW: syslogd: check/update valid hostname at startup
- NEW: wan: remap Extend_TTL_Value from Asus
* NEW: wifi: show country/regrev on wireless/professional page
* NEW: wifi: unlock Professional parameters in repeater mode


374.43_2-07j9527 (20-January-2015)
* NEW: Allow traffic monitor graphs to be displayed in Mb/s rather then
	KB/s (user request).  Option added to gui (Tools/Other Settings)
- NEW: AC68P supported with model specific radio settings for 5G
	wireless.  Custom settings for the 5G wireless for the 68P have been
	backported from 376 code.
* NEW: Implememnts an option to override incorrect DSCP settings seen
	on IPv4 Comcast connections (port from Shibby Tomato).  This may improve
	internet speeds for Comcast customers.  Option added to gui
	(Firewall/General).
- NEW: Added max users (connections) to SAMBA gui (backported from 376)
* CHANGE: Can now specify up to 4 address:port or port values for SSH
	listening (user request) This can allow different ports to be specified
	for local vs wan access This modifies a previous commit (was a single
	address only and now need to specify a port when specifying an address).
	Must be set using nvram variables.
* CHANGE: Only validate TxPower settings if changed in gui (user
	request to allow manual setting of power >200)
* CHANGE: The latest level link on the firmware upgrade page now will direct
	you to the fork download location
- CHANGE: OpenVPN upgraded to release 2.3.6, including an upstream fix
	for Cipher-None (fixes documented OpenVPN server exploit)
- CHANGE: OpenSSL updated to 1.0.0p
- CHANGE: Disable deprecated SSL2 and SSL3 protocols
- CHANGE: Hide minidlna database directory. After installing this code
	delete the visible minidlna directory in your media shares and reboot.
- FIXED: OpenVPN Server/Client now forced to alternate CPU in ARM routers.
	This provides a significant performance improvement for OpenVPN connections.
- FIXED: Vulnerability in infosvr (CVE-2014-9583) - this finalizes the
	same fix as was included in Update-06E
- FIXED: Replace memcpy() with the intended memcmp() call - this
	finalizes the same fix as was included in Update-06E
* FIXED: Reboot no longer required when changing TxPower setting
* FIXED: Wireless mode hint now correctly reflects [N Only] selection
* FIXED: Fix AdvLinkMTU entry in radvd.conf for PPP connections
	(Asus bug) - reported by Chrysalis
* FIXED: Implements RFC 6164 which prevents buffer overflow issues seen
	on Comcast (port from Shibby Tomato)
* FIXED: Cleanup nvram variables when changing IPv6 modes
* FIXED: Implements support for stateful DHCP pools when using DCHP-PD
	connections - reported by knighthawk
* FIXED: Implements support for specifying the IPv6 server address for
	6in4 tunnels (port from 376) - reported by il2
* FIXED: Clean up various nvram values when switching IPv6 modes
	(multiple commits)
- FIXED: Minidlna fix for parsing of AAC audio tracks (fix from upstream)
- FIXED: Fix AC66 DLNA icon
- FIXED: Allow 6 digits to be entered for the TCP Timeout Established
	field
* FIXED: Allow changing the number of TCP connections and report default
	value
* FIXED: Hint for [N Only] wireless mode now correct for AC mode routers
* FIXED: Filter bad data from traffic monitor reports (seen as graphs
	being scaled to unrealistic values)
- FIXED: Removed firewall default FORWARD/INVALID rule to prevent duplicates


374.43_2-06Ej9527 (9-January-2015)
- FIXED: Temporary fixes for ASUS infosvr LAN security vulnerability

374.43_2-06j9527 (23-November-2014)
* CHANGED: webui: standardize wireless modes across all radios
* FIXED: init-broadcom: allow guest macmode independent of base
* FIXED: webui: apply settings on guest network before branch to mac filtering
* FIXED: miniupnpd: Use merlin makefile for clean
* NEW: httpd: Add HTTP login/logout events to syslog (user request)

374.43_2-05j9527 (02-November-2014)
- CHANGED: OpenSSL: Upgraded to 1.0.0o
- CHANGED: SSL: disable SSLv2 and SSLv3 support - we now only support TLS 1.0 for
	https access (IE6 browser is no longer supported)
- CHANGED: Updated miniupnpd to 1.9 (plus upstream PCP fix)
- CHANGED: Updated dropbear to 2014.66
- FIXED: init-broadcom: fix typo preventing wireless mac filter from working on guest networks
* FIXED: Password obscured on Wireless/General tab unless has focus (user request)
* NEW: ssh: Add option to listen on single address (user request)

374.43_2-04j9527 (07-October-2014)
- CHANGE: Enable sha256 sha512 encryption for SSH
- CHANGE: Increase allowed max FTP connections limit to 10
- CHANGE: Move OpenVPN postconf execution right before client/server launch
- FIXED: Fix duplicate check on VPN Client page
- FIXED: Add missing mDNSResponder to MIPS builds
- FIXED: Wireless status incorrect after applying changes

374.43_2-03j9527 (06-September-2014)
- FIXED: miniupnpd:  Correct friendly name in Windows Network (from 376.44)
- CHANGED: Updated dnsmasq to 2.72 (ASUS master 376.44) - fixes DHCP leases display


374.43_2-02j9527 (03-September-2014)
- FIXED: Traffic monitor in mobile IE11
- FIXED: MSIE 10 detection
- FIXED: IPv6 firewall rules can be incomplete when using PPP
- FIXED: Minidlna issues with Philips smart TVs (reapplied after minidlna update)
- CHANGED: Updated dnsmasq to 2.71
- CHANGED: Updated minidlna to 1.1.3
- CHANGED: Updated lzo to 2.08
- NEW: banner description now reads 'Merlin fork'
- NEW: Warning msg on Site Survey with MAC filtering on
- NEWFIX: Correct 3rd grid line label in traffic monitor
- NEWFIX: Correct IE10 support for selected pages
- NEW: nvram variable to control syslog to jffs copy

374.43_2-01j9527 (13-August-2014)
- FIXED: System Log wouldn't properly be positioned at the bottom (Patch by John9527)
- FIXED: DNSFilter clients configured to bypass DNSFilter would still be prevented from using an IPv6 DNS.
- FIXED: Incorrect IPv6 prefix if not a multiple of 8 (patch by NickZ)
- FIXED: OpenVPN firewall cleanup was missing rules (patch by sinshiva)
- FIXED: Minidlna issues with Philips smart TVs
- FIXED: Miniupnpd error flood in Syslog when using a Plex server on your LAN (fix from upstream)
- FIXED: Miniupnpd NAT-PMP errors
- CHANGED: Updated openssl to 1.0.0n
