From version 60.0.3 we are using system certificates and there is
possibility that user doesn't have them (because for some stupid reason
did opkg install --force-reinstall or upgrade ca-certificates which at
first removes ca-certificates and then tries to download new version
which fails. This ensures that updater when it's updating to new version
also installs ca-certificates before it if they are missing.

iptables table mangle POSTROUTING/PREROUTING is not triggered for
traffic incoming to/outgoing from localhost, so CONNMARK was not set

this fix moves setting CONNMARK to filter:suricata table

CVE-2017-17434 - check for fnamecmp filenames in the daemon_filter_list data structure
and sanitize_paths protection mechanism to pathnames

This reverts commit bf348eb9.