forked from RMerl/asuswrt-merlin.ng
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Changelog-NG.txt
1240 lines (1133 loc) · 59.5 KB
/
Changelog-NG.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Asuswrt-Merlin 384/NG Changelog
===============================
384.18 (xx-xxx-2020)
- UPDATED: Merged GPL 384_8563 for AX models.
- UPDATED: Merged GPL 384_81846 for mainline models (code is almost
identical to 385_20490)
- UPDATED: Merged SDK + binary blobs from 384_81846 for RT-AC86U.
- UPDATED: Merged SDK + binary blobs from 384_81844 for RT-AC5300.
- UPDATED: Merged SDK + binary blobs from 385_20490 for RT-AC68U
and RT-AC3100.
- UPDATED: Merged SDK + binary blobs 384_8563 for RT-AX58U.
- UPDATED: amtm to 3.1.7.
- FIXED: ssh/scp client would fail to connect while negotiating
a chacha20 connection (themiron)
384.13_9 (xx-xxx-2020)
This release is only available for the RT-AC87U and RT-AC3200.
- UPDATED: Wireless driver from 382_52230 for RT-AC87U (should
address Kr00k)
384.17 (26-Apr-2020)
Updating some models (like the RT-AC88U) from stock firmware
3.0.0.4.384_81790 and newer will require a factory default reset
after flashing Asuswrt-Merlin, due to a change in how Asus
stores the admin password starting with 384_81790.
- NEW: Add Chacha20-poly1305 support to dropbear (themiron)
- UPDATED: dnsmasq to 2.81-openssl (themiron)
- UPDATED: openvpn to 2.4.9.
- UPDATED: curl to 7.69.1.
- UPDATED: openssl-1.1 to 1.1.1g (themiron)
- UPDATED: nano to 4.9.2.
- FIXED: RT-AC88U/RT-AC3100/RT-AC5300 could fail to upgrade
from newer stock versions to Asuswrt-Merlin.
- FIXED: Various webui issues with sorting DHCP reservations.
384.13_8 (26-Apr-2020)
This release is only available for the RT-AC87U and RT-AC3200.
- UPDATED: dnsmasq to 2.81-openssl (themiron)
- UPDATED: openvpn to 2.4.9.
- UPDATED: openssl-1.1 to 1.1.1g (themiron)
384.16 (5-Apr-2020)
- NEW: Added support for the RT-AX58U and RT-AX3000 (same
firmware), based on GPL 384_8253 + binary blobs 384_8137.
- NEW: Added support for the RT-AX56U, based on GPL + binary
blobs from 384_8253.
- NOTE: The RT-AC87U and RT-AC3200 are now officially considered
to be on limited support. The future for these two
models will depend on Asus's own support in the
coming months.
- NEW: Added ed25519 support in Dropbear (themiron)
- UPDATED: Merged GPL 384_8253 for AX models.
- UPDATED: Merged SDK + binary blobs 384_7977 for RT-AX88U.
- UPDATED: Merged SDK + binary blobs 384_81352 for RT-AC86U.
- UPDATED: Tor to 0.4.2.6.
- UPDATED: curl to 7.68.0.
- UPDATED: nano to 4.8.
- UPDATED: dnsmasq to 2.81rc4-33-g7558f2b-openssl (themiron)
- UPDATED: inadyn to 2.7 (themiron, merlin)
- UPDATED: getdns to 1.6.0 (themiron)
- UPDATED: stubby to 0.3.0 (themiron)
- UPDATED: amtm to 3.1.6 (thelonelycoder)
- UPDATED: openssl-1.1 to 1.1.1f (themiron, merlin)
- UPDATED: Chart.js to 2.9.3
- CHANGED: Wireless Log page will now regroup Guest Network
clients together and identify which guest instance
they are connected to.
- CHANGED: Report temperature of second 5 GHz radio on Sysinfo page
for tri-band models.
- CHANGED: Added down/upload monitor to network status page, and
removed useless RAM chart to free some space.
- CHANGED: Security hardening in dropbear dropped CBC and 3DES
ciphers, removed version disclosure from ident
string (themiron)
- FIXED: DNS server was unreachable when connecting to an OpenVPN
server with Advertise DNS enabled, due to firewall rules.
- FIXED: Router Security Assessment would fail to recognize WPA3
as being secure.
- FIXED: miniupnpd would reject private WAN IPs - changed that
upstream behaviour to allow these.
- FIXED: Would require you to reset the DHCP scope if you
changed the LAN hostname.
- FIXED: Couldn't set http mode to http-only if you previously
had WAN access enabled but have since switched to
non-router mode.
- FIXED: Disks with a single quote in their name would fail to
properly list on various USB service pages.
- FIXED: CVE-2020-8597 security issue.
384.13_6 (5-Apr-2020)
This release is only available for the RT-AC87U and RT-AC3200.
These two models are now considered to be on limited support, and
their future will depend on Asus's future support for these two.
- UPDATED: openssl-1.1 to 1.1.1f (themiron, merlin)
- UPDATED: amtm to 3.1.6 (thelonelycoder)
- CHANGED: Security hardening in dropbear: dropped CBC and 3DES
ciphers, removed version disclosure from ident
string (themiron)
- FIXED: DNS server was unreachable when connecting to an OpenVPN
server with Advertise DNS enabled, due to firewall rules.
- FIXED: miniupnpd would reject private WAN IPs - changed that
upstream behaviour to allow these.
- FIXED: Would require you to reset the DHCP scope if you
changed the LAN hostname.
- FIXED: Couldn't set http mode to http-only if you previously
had WAN access enabled but have since switched to
non-router mode.
- FIXED: Disks with a single quote in their name would fail to
properly list on various USB service pages.
- FIXED: CVE-2020-8597.
384.15 (8-Feb-2020)
The RT-AC87U and RT-AC3200 are not supported by this release, see
the 384.13_4 release released separately for these two models.
- NEW: wan-event script. The first parameter will be the WAN unit
(0 for first WAN, 1 for secondary). The second parameter
will be a string describing the type of event (init,
connected, etc...). A wan-event of type "connected" will
be identical to when the original wan-start script was
being run (wan-start should be considered deprecated
and will be removed in a future release)
- NEW: Implemented an official API for addon developers to
better integrate with the router. This includes up
to ten different pages that can be added anywhere within
the webui, and a dedicated storage repository for your
settings, which can be interacted with through your
custom web page or through a shell script.
See the Wiki for more information:
https://github.com/RMerl/asuswrt-merlin/wiki/Addons-API
- NEW: amtm (Asuswrt-Merlin Terminal Menu) by thelonelycoder has
been added to the firmware. Running "amtm" over SSH will
give you a menu allowing you to select and install various
addons, such as Diversion (ad blocker) or SKynet (an
advanced firewall extension). The plugins for amtm are
still maintained by its original author (thelonelycoder).
https://github.com/RMerl/asuswrt-merlin/wiki/AMTM
- UPDATED: Backported some fixes from 384_81981, mostly related
to WAN, port bonding and mdns.
- UPDATED: Merged GPL 384_7756 for RT-AX88U, which adds OFDMA and
WPA3 support to that model.
- UPDATED: Merged with GPL 385_10002 for other models (from
RT-AC68U)
- UPDATED: odhcp6c to 1.1-97-ge199804 (themiron)
- UPDATED: curl to 7.67.0.
- UPDATED: openssl-1.0 to 1.0.2u
- UPDATED: dnsmasq to 2.80-114-ge40d8be (themiron)
- CHANGED: Replaced entware-setup.sh script with link to amtm, as
using the amtm Entware installer is now the supported
method.
- CHANGED: Improved connection handling in httpd (themiron)
- FIXED: Some of the newest DNSFilter servers weren't properly set
up with IPv6 (dave14305)
384.13_4 (8-Feb-2020)
This release is only available for the RT-AC87U and RT-AC3200.
- NEW: wan-event script. The first parameter will be the WAN unit
(0 for first WAN, 1 for secondary). The second parameter
will be a string describing the type of event (init,
connected, etc...). A wan-event of type "connected" will
be identical to when the original wan-start script was
being run (wan-start should be considered deprecated
and will be removed in a future release)
- NEW: Implemented an official API for addon developers to
better integrate with the router. This includes up
to ten different pages that can be added anywhere within
the webui, and a dedicated storage repository for your
settings, which can be interacted with through your
custom web page or through a shell script.
See the Wiki for more information:
https://github.com/RMerl/asuswrt-merlin/wiki/Addons-API
- NEW: amtm (Asuswrt-Merlin Terminal Menu) by thelonelycoder has
been added to the firmware. Running "amtm" over SSH will
give you a menu allowing you to select and install various
addons, such as Diversion (ad blocker) or SKynet (an
advanced firewall extension). The plugins for amtm are
still maintained by its original author (thelonelycoder).
https://github.com/RMerl/asuswrt-merlin/wiki/AMTM
- UPDATED: odhcp6c to 1.1-97-ge199804 (themiron)
- UPDATED: openssl-1.0 to 1.0.2u
- UPDATED: curl to 7.67.0.
- UPDATED: OpenVPN to 2.4.8.
- UPDATED: dnsmasq to 2.80-114-ge40d8be (themiron)
- CHANGED: Replaced entware-setup.sh script with link to amtm, as
using the amtm Entware installer is now the supported
method.
- CHANGED: Improved connection handling in httpd (themiron)
- FIXED: Some of the newest DNSFilter servers weren't properly set
up with IPv6 (dave14305)
384.14_2 (1-1-2020)
- FIXED: Missing cifs kernel module
- FIXED: stubby was linked with OpenSSL 1.0 instead of 1.1
- FIXED: some routers were reporting the Internet connection being
disconnected. If you were affected and you had flashed
a customized bootloader, then please reflash your original
bootloader, as your modded bootloader is invalid, and other
potential issues may appear over time.
- FIXED: Random traffic spikes logged in Traffic Monitor (regression
from 384_81351)
384.14 (14-Dec-2019)
- NEW: Implement option to prevent Firefox's automatic usage of DoH.
By default, this will only apply if you have DNSPrivacy
enabled, or if you have DNSFilter enabled with a global
filter, to ensure that Firefox will not bypass either of
these. You can also have this override applied all the
time, or completely disable it.
- NEW: Added "split" busybox applet.
- NEW: Added IPv6 support to Network Analysis webui
- NOTE: You might need to reconfigure your device hostname on the
LAN -> LAN IP page due to a GPL-level change (exclusing
the RT-AX88U)
- UPDATED: RT-AX88U to GPL 384_6436 (with Let's Encrypt fixes
backported from 384_81351)
- UPDATED: RT-AC68U, RT-AC86U to GPL 384_81351
- UPDATED: RT-AC88U, RT-AC3100 to GPL 384_81351 and binary
blobs from 384_81116
- UPDATED: RT-AC5300 to GPL 384_81351 and binary blobs from
384_81219.
- UPDATED: miniupnpd 20190824
- UPDATED: dnsmasq 2.80-95-g1aef66b (themiron)
- UPDATED: OpenSSL 1.0.2 to 1.0.2t (themiron)
- UPDATED: OpenSSL 1.1.1 to 1.1.1d (themiron)
- UPDATED: Curl 7.66.0
- UPDATED: nano 4.4
- UPDATED: OpenVPN 2.4.8
- UPDATED: OUI database to 2018-08-17 version
- UPDATED: CA root certificates to October 9th 2019
- CHANGED: Made webui SSL certificate generation compliant with
IOS 13 and MacOS 10.15 new requirements.
- CHANGED: Rewrote the faketc script used to inject Codel into
Adaptive QoS as a C program for improved performance.
- CHANGED: Moved /usr/bin/ip to /usr/sbin/ip on the RT-AC86U and
RT-AX88U to match other models.
- CHANGED: IPv6 firewall now accepts empty values for local IP
(which means any local IP).
- FIXED: Webui wouldn't notify when running dangerously low on
free nvram (feature was lost at some point in the past)
- FIXED: Non-working link to YandexDNS on the webui for
Russian models.
- FIXED: Backported various httpd fixes to RT-AX88 from other
models.
- FIXED: Custom clientlist would be wiped if stopping an
OpenVPN server instance.
- FIXED: Incorrect detection of EUI64 addresses on the IPv6
firewall (would prevent using ::/0 for instance).
- FIXED: EUI64 support missing while in Load Balancing or
using Multicast IPTV.
- FIXED: Asus DDNS failing to update due to an invalid
certificate on Asus's server.
- FIXED: Let's Encrypt support would sometime fail when using
Asus DDNS (fixed DNS publishing of validation record)
(in addition to general failure fixed by GPL 81351)
- FIXED: IPv6 neighbour solicitation drop toggle not working
for some models
- FIXED: openvpn-event scripts would be executed even if custom
scripts were globally disabled
384.13_2 (14-Dec-2019)
This release is only available for the RT-AC87U and RT-AC3200.
- NEW: Added "split" busybox applet.
- UPDATED: OpenSSL 1.0.2 to 1.0.2t (themiron)
- UPDATED: OpenSSL 1.1.1 to 1.1.1d (themiron)
- UPDATED: CA root certificates to October 9th 2019
- CHANGED: Rewrote the faketc script used to inject Codel into
Adaptive QoS as a C program for improved performance.
- CHANGED: Made webui SSL certificate generation compliant with
IOS 13 and MacOS 10.15 new requirements.
- CHANGED: IPv6 firewall now accepts empty values for local IP
(which means any local IP).
- FIXED: Non-working link to YandexDNS on the webui for
Russian models.
- FIXED: Webui wouldn't notify when running dangerously low on
free nvram (feature was lost at some point in the past)
- FIXED: Custom clientlist would be wiped if stopping an
OpenVPN server instance.
- FIXED: Incorrect detection of EUI64 addresses on the IPv6
firewall (would prevent using ::/0 for instance).
- FIXED: EUI64 support missing while in Load Balancing or
using Multicast IPTV.
- FIXED: Asus DDNS failing to update due to an invalid
certificate on Asus's server.
- FIXED: Let's Encrypt no longer working due to deprecated ACMEv1
protocol usage (backport from GPL 81351)
- FIXED: Let's Encrypt support would sometime fail when using
Asus DDNS (fixed DNS publishing of validation record)
- FIXED: IPv6 neighbour solicitation drop toggle not working
for some models
384.13_1 (12-Aug-2019)
- FIXED: RT-AC87U failing to boot when configuring in AP mode.
384.13 (31-July-2019)
- NEW: AiMesh Router and node support. Note that automatic live
update of Merlin-based nodes is not supported, you will have
to manually update any Merlin-based nodes when a new firmware
is available. Asus-based nodes (which is recommended) will be
able to make use of the automatic live update.
- NEW: ChaCha20-Poly1305 support in Strongswan (themiron)
- UPDATED: RT-AX88U to GPL 384_6210.
- UPDATED: Curl 7.65.3.
- CHANGED: dhcp_staticlist no longer contains hostnames, these
have been moved to dhcp_hostnames for better
compatibility with upstream and closed source
components, also allows more static leases to be
defined before reaching the size limit.
- CHANGED: Replace Nettle with OpenSSL for dnsmasq's DNSSEC
validation, which opens the door to supporting
more ciphers. (themiron)
- FIXED: Firmware Update check button would redirect to Asus
support site if scheduled checks are disabled.
- FIXED: Firefox was showing a no-op Uninstall button on the
AiCloud page
- FIXED: 5 GHz radio showing as disabled on the Sysinfo page for
the RT-AC87U
- FIXED: FTP would be accessible from the WAN even while disabled
if you had DualWAN load balancing enabled, or IPTV
configured.
- FIXED: IGMP Snooper daemon crashing when more than 32 hosts
are present (themiron)
- FIXED: External DDNS IP checker would fail for Chinese users,
as checkip.dyndns.org is blocked - switched to .com TLD.
- FIXED: Devices without a networkmap-defined alias wouldn't fallback
to their hostname on some webui pages like the IPTraffic
and QoS Classification pages.
- FIXED: Remote IP field filtering on Classification page wasn't
working.
- FIXED: Incorrect user permissions displayed on the FTP page.
- FIXED: Performance issues for some users, following the kernel
security fixes in 384.12. (gzenux)
384.12 (22-June-2019)
- NOTE: The project now has its own domain name. Official website
is now https://www.asuswrt-merlin.net/ and my email address
for anything related to the project is now
merlin@asuswrt-merlin.net.
- NEW: Added WS-Discovery support. This allows Windows clients
to detect the router's shared USB drives even if SMBv1
support is disabled.
- NEW: Re-added option to extend the WAN's TTL (from stock
firmware, was previously disabled as it used to
be broken)
- UPDATED: RT-AC3200 and RT-AC87U to 382_51640/51634 binary blobs
(with a few exceptions for 384_xxxx compatibility)
- UPDATED: Merged GPL 384_45717 (except for RT-AX88U)
- UPDATED: Nano 4.2.
- UPDATED: OpenSSL-11 to 1.1.1c.
- UPDATED: OpenSSL-10 to 1.0.2s.
- UPDATED: curl 7.65.1.
- UPDATED: miniupnpd 20190604.
- CHANGED: Local clients will be shown by their hostname
on the Classification page.
- CHANGED: Reworked handling of up/down events in OpenVPN.
Server instance will now also use its own
updown script, which will handle firing up
openvpn-event (if present).
- CHANGED: Inbound traffic sent to you through an OpenVPN client
will now be dropped by default. This can be changed
through the new "Inbound Firewall" parameter found
on the OpenVPN client page. You should only change
this to "Allow" if running a site2site tunnel with
a trusted remote server, or if you do expect
traffic to be forwarded to you through the tunnel.
- CHANGED: The router will now use ISP-provided resolvers
instead of local dnsmasq when attempting to
resolve addresses, for improved reliability.
This reproduces how stock firmware behaves.
This only affects name resolution done
by the router itself, not by the LAN clients.
The behaviour can still be changed on the
Tools -> Other Settings page.
- CHANGED: Randomize the serial number of certificates
generated by the router for its httpd. If
using a router-generated certificate, then
it's recommended to generate a new one.
- CHANGED: Allow USB idle values up to 9999.
- CHANGED: Replaced Network Analysis and Netstat pages (under
Network Tools) with new versions based on Asus's
Netool daemon for non-HND models, but based
around the more limited traceroute busybox applet.
RT-AC86U and RT-AX88U still use the newer
traceroute executable.
- CHANGED: Reworked how some services are started when the WAN
interface comes up to prevent deadlocks between
the WAN completing its initialisation, and the
clock getting set. These could result is fairly
long boot time for some ISPs.
- FIXED: openvpn-event script not launching if the
client was configured in Secret Key auth
mode.
- FIXED: IPv6 issues on RT-AX88U - backported accept_ra fix
from 45717 (themiron)
- FIXED: Memory leak in erp_monitor process.
- FIXED: Page redirection failing to apply at boot
time if WAN was down.
- FIXED: CVE-2019-11477, CVE-2019-11478 and
CVE-2019-11479 (themiron)
384.11_2 (18-May-2019)
- NEW: Implemented source/destination IP filtering
for the Netool version of Netstat web page.
- CHANGED: Backported multiple fixes and improvements
for ntpd from upstream, improving handling
of failed server hostname resolution, and better
clock sync discipline.
- FIXED: RT-AC88U/3100/5300 were accidentally compiled
with Netool enabled, which isn't compatible with
these model's kernel.
- FIXED: Movistar stopped working for some users. Re-disabled
udpxy on Movistar profile for now. A more complete
fix will have to come from Asus.
- FIXED: Re-disabled memaccess debugging tool, as it creates
a symlink called "sh" which is a pretty bad
idea from Broadcom. (RT-AC86U, RT-AX88U)
384.11 (8-May-2019)
- NEW: Added DNS Privacy feature, with support for
DNS-over-TLS (also known as DoT).
You can configure it on the WAN -> Internet Connection
page. You can manually add your own servers, or chose
one (or a few) from the preset list. (themiron)
- NEW: NTP daemon on the router, to allow your LAN clients to
synchronize their clocks with it.
- NEW: Option to intercept NTP requests from clients, and
redirect them to the router's own NTP daemon.
- NEW: Added service-event-end custom script, executed at the
end of an rc service call. Receives the same arguments
as service-event, but is a non-blocking script.
- NEW: Added sqlite3 CLI command, to allow script authors to
create/manage their own sqlite3 database
- UPDATED: RT-AX88U to 384_5951 GPL.
- UPDATED: Other models to 384_45713 GPL (RT-AC87U, RT-AC3200
and RT-AC5300 still using 384_45149 binary blobs)
- UPDATED: Nano 4.0.
- UPDATED: Curl 7.64.1.
- UPDATED: Dropbear 2019.78.
- CHANGED: Replaced the custom ntpclient with a proper ntpd
implementation, for reduced memory usage and
increased accuracy.
- CHANGED: Made the secondary NTP server configurable through the
webui. Note that ntpd will use both servers, so clear
the second server if there is one and you don't want
to use it.
- CHANGED: Re-designed firmware upgrade page, moving the schedule
option to that page, and removed support for the Beta
channel.
- CHANGED: Removed popup messages showing on the DDNS page when
a service state change was detected. Report it within
the page instead.
- CHANGED: Report firmware version within the new firmware
notification popup that appears at the top of the webui.
- CHANGED: Moved LED control (formerly known as Stealth Mode) to
the System page.
- CHANGED: Do not restart whole network whenever changing an IP
reservation on the Networkmap card.
- CHANGED: Allow URLs up to 64 chars long on the URL filter.
- CHANGED: pre-mount user script now receives the filesystem
as second argument.
- CHANGED: Moved various DNS-related settings from the DHCP page
to a more appropriate location on the WAN page.
- CHANGED: OpenSSL default dir moved to /etc/ssl/. Allows
programs to automatically locate the CA bundle
without requiring explicit configuration.
- CHANGED: Optimized service restarts generated by the
System page.
- CHANGED: Replaced Network Analysis and Netstat pages (under
Network Tools) with new versions based on Asus's
Netool daemon (RT-AC86U, RT-AX88U)
- FIXED: Reboot scheduler would sometime get stuck, or corrupt
plugged USB drives. Now doing a more thorough
shutdown of services, should hopefully make it
more reliable.
- FIXED: CVE-2019-1543 issue with Chacha20-poly1305 in
OpenSSL 1.1 (themiron)
- FIXED: Client count on the Sysinfo page was missing
Guest clients
- FIXED: Miniupnpd sometimes sending ssdp notifies to
the wrong interface (themiron)
- FIXED: udpxy not working when using the Movistar
IPTV profile on RT-AC86U and RT-AX88U.
384.10_2 (3-Apr-2019)
- CHANGED: Increased OpenVPN interface queue length from 100
to 1000 bytes, to reduce the amount of dropped
packets if router can't keep up.
- CHANGED: Updated CA bundle to January 23rd version
- FIXED: Moviestar VLAN routes weren't properly configured
(broken quagga configuration)
- FIXED: Layout issues on the Wireless Log page for some
models
- FIXED: Missing tooltip content for the new local DNS
resolution setting on the Tweak page
- FIXED: FAQ URL on Bandwidth Monitor points to a non-existing
page on Asus's servers (point to old page for now)
- FIXED: OpenVPN CA would be overwritten if there was no
server key or cert present - only generate them
if all three are missing.
- FIXED: Bandwidth Limiter not working properly in some
cases, as it failed to disable hardware acceleration
384.10 (24-March-2019)
- NEW: Added OpenSSL 1.1.1b in parallel to 1.0.2. Some services
like AiCloud are still linked against 1.0.2 because they
would require Asus to recompile them against 1.1.1.
Main services that currently use OpenSSL 1.1.1:
httpd (webui), OpenVPN, wget, net-snmp, Tor,
Strongswan (IPSEC server), inadyn, vsftpd, avahi.
Models that lack AES acceleration will prioritize the use
of CHACHA20 over AES-256-GCM, for a small performance
improvement (for instance with the webui).
Note that OpenVPN 2.4.7's support is still limited.
TLS 1.3 is supported, but CHACHA20 support is
only expected with OpenVPN 2.5.0.
The 1.0.2 userspace tool is still named "openssl", while
the 1.1.x version is named "openssl11".
- NEW: Updated RT-AX88U to GPL 384_5640.
- NEW: Implemented lcp-ident option in PPP (required by some ISPs)
(Themiron).
- NEW: Added NFSv2 support to HND models.
- NEW: You can now choose between having your router do internal
DNS queries locally (through dnsmasq) or with your WAN
configured DNS (like stock firmware). This does not
affect DNS lookups from your clients, only those made
by the router itself. The option is under Tools ->
Other Settings. (Themiron)
- CHANGED: Some firmware cleanups to regain flash space (for
use with the parallel OpenSSL 1.1.x install)
(RMerlin, Themiron)
- CHANGED: Updated curl to 7.64.0.
- CHANGED: Updated OpenVPN to 2.4.7.
- CHANGED: Updated Tor to 0.3.5.8.
- CHANGED: Updated strongswan to 5.7.2.
- CHANGED: Updated OpenSSL 1.0.x to 1.0.2r.
- CHANGED: Updated dnsmasq to 2.80-44-g608aa9f (Themiron)
- CHANGED: Re-worked the Classification page. New design
is much faster, allows filtering, and shows
additional info when hovering on a field. Thanks
to FreshJr for giving me the motivation to
spend more time on it.
- CHANGED: Strongswan is no longer compiled 64-bit
on HND, allowing it to use a shared openssl library
instead of a static one. This should significantly
reduce the memory and flash usage of Strongswan.
(Themiron)
- CHANGED: Reworked DNS WAN probe implementation (Themiron)
- FIXED: IPSEC log display wasn't properly formatted (showed
entirely on a single line)
- FIXED: Compatibility issues between recent Tuxera NTFS driver
and Samba
- FIXED: NFSv2 support
- FIXED: PPP host-uniq support (Themiron)
- FIXED: AiCloud not working on the RT-AX88U
- FIXED: OpenVPN key/certs would sometime end up in nvram in
addition to in /jffs
- FIXED: Couldn't remove an existing OpenVPN key/cert by
clearing the field on the webui
- FIXED: Resetting OpenVPN client to Default values wasn't
removing any existing Extra CA certificate
- REMOVED: Beceem Wimax driver. This is deprecated, and was
already removed from the HND models. This allows
to reclaim close to 2 MB of flash space.
- REMOVED: CFB and OFB ciphers from OpenVPN client
384.9 (2-Feb-2019)
- NEW: Temporarily reorganized code in separate branches, to handle
Asus's currently scattered firmware source code releases.
The GPL situation for this release is as follow:
o RT-AX88U: Merged GPL 384_5329
o Other models: Merged GPL 384_45149.
o Special binary blobs provided by Asus for the RT-AC87U
and RT-AC3200 (compatible with 384_45149).
- NEW: Added NFS client support (V2 and V3) to the
RT-AC86U and RT-AX88U (already present in older models)
- NEW: Report the number of spatial streams and the PHY type
used by wireless clients for models supporting it
- NEW: Display tracked connections on the QoS Stats page (now
relabeled "Classification").
Fields can be sorted by clicking on the column headers.
Thanks to FreshJr for his help in deciphering the packet
mark values.
- NEW: Implemented ipsec.postconf and strongswan.postconf scripts.
- KNOWN ISSUE: dcd process crashing on RT-AC86U (bug in Trend
Micro's code, outside of my control).
- KNOWN ISSUE: IPv6s on Tracked Connections have their last
two bytes set to 00 (bug in Trend Micro's
code truncating the last two bytes).
- KNOWN ISSUE: No IPS events logged (bug in Asus's code,
IPS should work, just fails to log hits)
- KNOWN ISSUE: Networkmap listing may be unreliable.
(Bug in Asus's code)
- KNOWN ISSUE: Users failing to read changelogs will
probably complain about the above issues.
(Outside of my control).
- CHANGED: Updated wget to 1.20.
- CHANGED: Updated nano to 3.2.
- CHANGED: Updated curl to 7.62.0.
- CHANGED: Updated Chart.js to 2.7.3.
- CHANGED: Updated dnsmasq to 2.80-32-g28cfe36 (themiron)
- CHANGED: Optimized some JS files to reduce their size
- CHANGED: OpenVPN clients can now accept CNs up to 255 chars
when using it to validate the certificate.
- CHANGED: No longer reset the OpenVPN client's description,
policy mode and existing rules when uploading an
.ovpn config file.
- CHANGED: No longer accept any server-provided route
when OpenVPN client set to Policy (Strict).
- CHANGED: Clients bound to DNSFilter rules will no longer
bypass it by using DoT. DNSFilter servers that
support DoT (like Quad9) will only allow filtered
clients to use that server
- FIXED: Firmware update checks would not run at boot time
on the RT-AX88U.
- FIXED: Name resolution issues for /etc/hosts entries on
HND models (themiron)
- FIXED: Syslog not properly copied to JFFS on reboot
(John Bacho)
- FIXED: Volumes not properly unmounted on HND platform
(John Bacho)
- FIXED: Added missing TEE Netfilter target on the RT-AC86U
- FIXED: SSH brute force protection didn't work in Dual WAN
load balancing mode.
- FIXED: httpd crashes on RT-AC86U (themiron)
- FIXED: DNSFilter clients could use a different nameserver
when using an IPv6 connection
- FIXED: USB disk idle config changes not applying without a
reboot.
- FIXED: "Strict" DNS mode wasn't working properly with OpenVPN
clients
- FIXED: Cannot upload JFFS backup on HND models
384.8_2 (8-Dec-2018)
- CHANGED: Updated miniupnpd to 20181205.
- CHANGED: Push LAN domain to OpenVPN clients as DNS suffix
for the connection.
- FIXED: Cannot save custom settings on OpenVPN server page
on non-HND models.
- FIXED: Some webui pages fail to load properly in French
- FIXED: dnsmasq fails to start when certain options are
configured (themiron)
- FIXED: Non-functionnal Show Password option on OpenVPN/PPTP
server page for RT-AX88U (removed)
- FIXED: Persistent SSL cert was wiped at boot time in
some specific scenarios.
384.8 (2-Dec-2018)
- NOTE: Asus has put the RT-AC56U on their End of Life
list, meaning no further firmware releases from
them. Since it's impossible for me to support
models without matching GPL releases from Asus,
I also have to retire the RT-AC56U. 384.6 is
the final release for that model.
- NOTE: The RT-AC3200 and RT-AC87U are not supported by this
release, Asus hasn't released any updated code yet for
these models.
- NEW: Added RT-AX88U support (based on GPL 384_4736).
- NEW: Merged with GPL + binary blobs from 384_32799 (all
supported models except RT-AX88U)
- NEW: Add LZ4 V2 option to OpenVPN compression
(more effective at handling already compressed
data)
- NEW: Added "extend" support to SNMP.
- NEW: Added CleanBrowsing to DNSFilter supported services.
- NEW: Webui HTTP LAN port can now be changed from the default 80.
- NEW: Added support for the Netfilter TEE target.
- CHANGED: Removed watchdog from OpenVPN clients, to avoid
conflicting with more advanced configurations.
- CHANGED: Vsftpd TLS mode will now reuse the web server
certificate (including any Let's Encrypt generated
one).
- CHANGED: SSL crypto/cipher hardening for httpd (themiron)
- CHANGED: Syslog will now ignore bwdpi debug output (themiron)
- CHANGED: Reworked Wireless Log page, adding a new button to
view low-level details (what stock firmware shows
on its Wireless Log page), and removed redundant
option to display DFS channel details.
- CHANGED: Update dnsmasq to 2.80-11-g59e4703 (themiron)
- CHANGED: Updated nettle to 3.4
- CHANGED: Updated net-snmp to 5.8
- CHANGED: Updated openssl to 1.0.2q
- CHANGED: Migrated /jffs/ssl/* content to /jffs/.cert (to
share the same folder used by Asus stock)
- CHANGED: Re-enabled WTFast on non-HND models (curl-related
crash has been fixed). This is still untested.
- CHANGED: Updated CA bundle to October 17th 2018 version.
- CHANGED: Support search domains pushed by a remote OpenVPN
server
- FIXED: UOPNP port forwarding not working in CGNAT/double NAT
scenario even if proper ports were forwarded upstream.
- FIXED: Pages based on table.js (like the port trigger one)
would fail to work properly under Firefox
(Michael Ziminsky)
- FIXED: Dnsmasq issues when running in non-router mode
(John Bacho)
- FIXED: Routing issues when in non-router mode (John Bacho)
- FIXED: Bug in curl that could cause some applications to
crash on non-HND models
- FIXED: IFTTT failing to start on non-HND models (caused by
curl issue).
- FIXED: Webui could complain about port 8080 being reserved for
http WAN port (which is no longer supported)
- FIXED: Cannot change image for device with a vendor name
containing an apostrophe (like Micro-Star int'l)
(Asus bug)
- FIXED: OpenVPN client download was capped by Adaptive QOS
upload limit (fix devised by FreshJR)
- FIXED: OpenVPN custom config might be lost after a reboot
on the RT-AC86U.
384.7_2 (21-Oct-2018)
- FIXED: Namecheap DDNS service not working
- FIXED: CVE-2018-15599 security issue in Dropbear
- FIXED: Potential buffer overrun in httpd
384.7 (7-Oct-2018)
- NOTE: The RT-AC3200 and RT-AC56U are not supported by this
release, Asus hasn't released any updated code yet for
these models.
- NOTE: Important changes to DDNS, please read below.
- NOTE: Important changes to DNSFilter, please read below.
- NEW: Merged with GPL 384_21152.
- NEW: Merged RT-AC87U binary blobs + SDK from 382_50702.
- NEW: Replaced old ez-ipupdate DDNS client with In-a-Dyn.
A plugin was developed to fully support Asus's DDNS
service.
Custom services can now be configured through ddns-start,
inadyn.conf, inadyn.conf.add or inadyn.postconf. See the
In-a-Dyn documentation as many custom services can be
defined for it.
- NEW: Added support for freedns.afraid.org DDNS service to webui.
- NEW: Added option to retrieve WAN IP from either the local
interface (like before) or through a remote server
(which works through double NAT) for DDNS.
- NEW: Display DFS channel info on Wireless Log page.
- NEW: Added option to disable checks on unsigned DNSSEC replies.
Disabling these will speed up lookups, but it will also
remove part of the security benefits of DNSSEC, so it
should not be used unless you have a very specific reason
to do so.
- NEW: Added Quad9 to DNSFilter supported services.
- CHANGED: Updated curl to 7.61.1.
- CHANGED: Updated wget to 1.19.5.
- CHANGED: Updated openssl to 1.0.2p.
- CHANGED: Updated dnsmasq to v2.80test8 (themiron).
- CHANGED: Updated nano to 3.1.
- CHANGED: All DDNS services now use HTTPS.
- CHANGED: Replaced Google Domains DDNS script with In-a-Dyn's own
plugin.
- CHANGED: Moved DNSFilter to the LAN section, to make it clear
that it's unrelated to Trend Micro's engine.
- CHANGED: Report hostname and IP on Wireless Log page if the
info is missing from dnsmasq but available from
networkmap.
- FIXED: Invalid dnsmasq config when setting DNSFilter to Router
mode and having IPv6 enabled (themiron).
- FIXED: dnsmasq crashing on RT-AC86U with IPv6 Stateful mode
(themiron).
- FIXED: client table would be shown twice on the VPN Status
page if the only connections to an OVPN server
were invalid clients (like a port scanner)
- FIXED: DDNS forced updates after "x" days wouldn't be
initiated.
- FIXED: CERT VU#598349 vulnerability (DHCP client could
claim the special "wpad" hostname)
- REMOVED: Ez-ipupdate DDNS client (replaced with In-a-Dyn).
Update your scripts if you were relying on it.
- REMOVED: Norton Safe DNSFilter services (being discontinued
by Symantec in November). Configured clients will
be automatically migrated to OpenDNS Family - make
sure to edit your DNSFIlter settings if you desire
to use a different service.
384.6 (25-July-2018)
- NOTE: The RT-AC87U is not supported in this release, as
Asus hasn't released any updated code for that model.
- NEW: Merged with GPL 384_21045/382_50624.
- NEW: Added support for the "-p" option to netstat.
- NEW: Added setting to enable DNS rebind protection, on the
DHCP page. This works by rejecting upstream server
responses that would point at a private IP.
- CHANGED: Updated nano to 2.9.8
- CHANGED: Updated curl to 7.60.0 (contains security fixes)
- CHANGED: Allow selecting text (for copy/paste operations)
on AiProtection pages.
- CHANGED: Added AES-*-GCM ciphers to the OpenVPN legacy
ciphers (so they can be explicitely used without
using NCP).
- CHANGED: Updated dnsmasq to 2.80test2-17-g51e4eee (themiron)
- CHANGED: Since dnsmasq 2.80, dnsmasq now ensures that unsigned
DNS replies received with DNSSEC enabled are legitimate.
If your upstream DNS doesn't support DNSSEC, this means
all replies from signed zones will be considered
invalid. Make sure you only enable DNSSEC if your
upstream DNS servers do support it. This behaviour is
a bit slower, but far more secure than the old default.
- CHANGED: Network Tools -> Netstat output also report program/PID
- CHANGED: Updated CA bundle to June 20th version.
- FIXED: IPv6-related issues on non-HND platform (themiron)
- FIXED: Couldn't log on WTFast if accessing the router
webui over https.
- FIXED: USB modem support code failing to properly pass
parameters to the kernel module (themiron)
- REMOVED: WTFast support for RT-AC88U/RT-AC3100/RT-AC5300,
as it's incompatible with recent versions of
curl (and has been broken for quite some time).
Not gonna revert back to a 7 years old curl
version just for wtfast.
384.5 (13-May-2018)
- NEW: Merged withh GPL 384_20648
- NEW: Merged RT-AC68U, RT-AC5300 binary blobs from 384_20648
- NEW: Merged RT-AC86U SDK and binary blobs from 384_20648
- NEW: service-event script, executed before any service
call is made. First argument is the event (typically
stop, start or restart), second argument is the target
(wireless, httpd, etc...).
Note that this script will block the execution of
the event until it returns.
- NEW: Added USB HID modules (for use with devices such
as UPS)
- NEW: Added ip6tables-save command.
- CHANGED: Updated OpenVPN to 2.4.6.
- CHANGED: Updated Dropbear to 2018.76.
- CHANGED: Updated Openssl to 1.0.2o.
- CHANGED: Updated miniupnpd to version 2.1 (20180508).
- CHANGED: Updated nano to 2.9.5.
- CHANGED: Moved RT-AC86U to the same Busybox version (1.25.1)
as other models.
- CHANGED: Revised OpenVPN server options:
o Removed "TLS Reneg time" (rarely used, can manually
be set as a custom option)
o Removed "Server Poll" (which didn't work
properly), and reimplemented watchdog service,
hardcoded to 2 mins frequency.
o Removed "Push LAN" and "Redirect Gateway",
replaced with new Client Access setting
o Removed Firewall setting (firewall rules are now
always created, and the broken External mode
was fixed and integrated into the new Client
Access setting). You can now use the postconf
script to override it.
o Removed option to respond to DNS queries - enabling
the option to Push DNS will also handle it
o Added new Client Access setting to select between
three types of access: LAN only, WAN only (will
block access to the LAN, including the router
itself) and LAN + WAN.
o Keys and certificates can now be up to 7999
characters long.
- CHANGED: Revised OpenVPN client options:
o Reorganized settings into groups
o Removed "Poll Interval" (which didn't work
properly), and reimplemented watchdog service,
with a hardcoded frequency of 2 mins.
o Removed Firewall setting (firewall rules are now
always created). You can now use the postconf
script to override it.
o Modified behaviour of Connection Retry. Instead
of taking a value in seconds that only affected
resolution failure, it now takes a number of
attempts, and affects connection failures.
Resolution failures will now retry for an infinite
period of time (the default OpenVPN value).
o Added "refresh" link which can be clicked to
re-query the public IP endpoint of the tunnel
o Keys and certificates can now be up to 7999
characters long.
- CHANGED: Removed option to resolve names on the
Log -> Connections page.
That functionality was added to the
Network Tools -> Netstat page instead.
- CHANGED: Re-designed Log -> Connections page into a table
with sortable fields - click on a column header to
sort on that field.
- CHANGED: From now on, setting the router to act as a master
browser or a WINS server will also require you to
enable sharing. This will ensure that users understand
that enabling either of these settings requires disk
sharing to also be enabled (which it was already
silently doing before).
- CHANGED: Moved "Beta firmware" option to the Tools -> Other
Settings page
- CHANGED: Improved layout of the Firmware Update page
- CHANGED: WPAD behaviour (sending a carriage return on
DHCP option 252) can now be controlled in the
Tweaks section.
- CHANGED: Blocking custom scripts such as service-event
and pre-mount will now wait a maximum of 120
seconds before resuming normal operations, to
prevent accidental lockouts.
- CHANGED: Autofill start/end time for DST when selecting
a timezone (LostFreq)
- FIXED: Some dnsmasq issues related to DNSSEC were fixed,
including CVE-2017-15107. (backported from
dnsmasq 2.79 by John Bacho)
- FIXED: Restoring an OpenVPN instance to default values
would fail to disable its Start with WAN setting.
- FIXED: Hardware authentication failure for the RT-AC3100
and RT-AC5300.
- FIXED: Minidlna web status page could no longer be enabled.
- FIXED: CVE-2017-9022, CVE-2017-9023 and CVE-2017-11185 in
Strongswan (odkrys)
- FIXED: Various issues with download traffic in Traditional
QoS (Cédric Dufour)
- FIXED: TCP timeout values couldn't be changed on the
Tools -> Other Settings page.
- FIXED: Security issue related to webui logging in (Asus bug)
384.4_2 (24-Mar-2018)
- CHANGED: Added visual warning when manually enabling webui
access on WAN. Doing so carries serious potential
security risks, as Asuswrt's web server code should
not be considered hardened enough for this.
- FIXED: Security issue in httpd (CVE-2018-8879).
- FIXED: Potential security issue in httpd related to QiS.
- FIXED: Minor webui issue in the QoS overhead menu.
384.4 (16-Mar-2018)
- NEW: Merged with GPL 384_20379 (with some binary components
from 382_50010 and 384_20308 depending on models)
- NEW: Added support for the RT-AC5300.
- NEW: Added support for the RT-AC87U.
- NEW: Added IPSEC support to the RT-AC86U.
- NEW: Support the new Entware 64-bit repo on the RT-AC86U.
To switch to the new repository, re-run the
entware-setup.sh script. You will need to reinstall
your apps (your old config files are backed up on
your USB disk).
- CHANGED: Tightened security around some config files.
- CHANGED: Allow guest networks settings for AP isolation
and SSID broadcast to be set separately from
their parent interface (John Bacho)
- CHANGED: Samba protocol support can now be set to
SMBv1, SMBv2, or SMBv1 + SMBv2 (the new default).
This will result in a performance drop on all
models but the RT-AC86U, but will be more secure.
Ideally, people should change it to SMBv2 only,
and then reboot all their client devices to start
using only the new protocol.
- CHANGED: Re-added some of the logging sd-idle used to do
in 380.xx.