pfSense

CF DDNS wants int for TTL. Issue #10196

(cherry picked from commit e9869c5abc70dc4aa7cd27d2a139696a1970903f)

Add TTL for CloudFlare DDNS. Fixes #10196

(cherry picked from commit 9404b54a44a820b9c0332149a6ea794eed54bdac)

XMLRPC: fix last shaper/limiter removing. Issue #9468-9469

(cherry picked from commit c9a96f16a4cb582884c8a09d42dd1a61c206b97d)

Revert "add fe80::1:1 as an alias. Issue #9998"

It's a 2.5.x only

This reverts commit a69c0e4e0f2337b956aa6dd2d0668d3c2b1a92b7.

add fe80::1:1 as an alias. Issue #9998

(cherry picked from commit 24da61c68c91ea1d1cb7214aeeddd6c9ae741ce5)

Update repository info before checking for updates

(cherry picked from commit ff90ae73c35f293f370104c18d386c08e9e813c7)

Link to the book, not old OpenBSD docs. Fixes #10184

(cherry picked from commit 1bcc6e56e51b8ac1e329c9c0dd2bfc0f40983ead)

Mount devfs for unbound when python is enabled. Fixes #9251

Update SSL refs to SSL/TLS. Fixes #10172

switch to resolve_host_addresses() func

(cherry picked from commit 6e658d8dd1a3e05b2b0153651a5060ff9225e415)

urltable can return >1 IPs

(cherry picked from commit 477d5b5f4d83ec01266d8db3a592192ca45efb5a)

Use central download function

Reduce duplicated/inconsistent code by using the new download function.

(cherry picked from commit ecb594d094ce0e11cacd9062ebd0aa0ba190444a)

Add central file download function for use throughout the GUI.

(cherry picked from commit 1342f80fb512cf2f6a5925f03e61930ac41445af)

Wait 0.2 seconds after stopping Nginx.
Redmine #10159

(cherry picked from commit 4ddcc5caa393c6478b62b76d7213c2af0c1dde7b)

Merge pull request #4155 from BBcan177/RELENG_2_4_5

Ticket #9612: Reboot early when needed

When fsck -z doesn't work on first attempt due to old binary, reboot
before configure the system to make it faster

Ticket #9612: Prevent infinite loop and skip zfs

• Detect when system does not contain any UFS partitions and skip it to
  run fsck -z
• On a system with a broken filesystem it could end up on an infinite
  loop since fsck -z call would always return != 0. Save a counter on...

Fix #9612: Reboot twice if needed and run fsck -z

After changing pfSense-rc to create /.fix_for_SA-19-10.ufs file to flag
system to run fsck -z during pre-install stage it started failing
because fsck binary, at that point while only kernel was upgraded, still...

Unbound python integration

Unbound python integration

Fix #6263: Deduplicate encryption options on ipsec.conf

On a configuration with multiple P2, all encryption options from all P2
are added to ipsec.conf. The list could have duplicated itens when
multiple P2 use the same options. Deduplicate this list.

Remove vestiges of legacy ACB system

(cherry picked from commit 8a6d9d7f82e7a992d2c48910fb4bb847b28f3f45)

Remove some outdated references. Issue #10156

(cherry picked from commit 26700efcdf3bbe62cc7893d0f7b765c1a70492fa)

Remove some outdated references. Issue #10156

(cherry picked from commit e48255d5b36fdb953af8afeb775686c619c52500)

Fix typo

Fix sshguard config/command. Fixes #9971

Also requires sshguard patch

This is 2020. Issue #9245

Fix copyright header on rc.package_reinstall_all. Issue #9245

Move igmpproxy logs to routing.log. Fixes #10139

Ignore the flash devices during the scan for config files at boot.

(cherry picked from commit 99a641df363bfc9c1e62474180598a770ff22385)

Fix #9285: Move ping-check option from global to per-subnet

(cherry picked from commit 5197e3e3a3b0ee048785e2ffb4222d7cba4e6c74)

use disablepingcheck as option name

(cherry picked from commit a0541b292d4cde76b9e95c1d8cbd99f5f26afee5)

add an option to the DHCP server to disable the ping check feature

(cherry picked from commit 7847e55fa2cd5813adb1ee4aa888b694957109b9)

Revert "Fix #9285: Move ping-check option from global to per-subnet"

This reverts commit 9133e01dc049920d716b045a86e78a9a05d98354.

Update copyright notice years. Issue #9245

Update copyright notice years. Issue #9245

Add Gandi LiveDNS DynDNS client.

(cherry picked from commit edfe22f8bae894eb678f3e7060cc91cea6f664da)

Prevent OpenVPN tunnel network reuse. Fixes #3244

Ensures that a submitted tunnel network is not already in use on other
OpenVPN client or server instances, to avoid conflicts.

(cherry picked from commit 19a0636d7c0e0178209406480cc383853f0d3f72)

Use full path for pkg-static

Add exit notify to OpenVPN servers/clients. Implements #9078

(cherry picked from commit 7591a72a5108a2ac28d28745cec43ea282869aae)

Correct jQuery include

(cherry picked from commit bb31e48e2c1eea6a7a3925f5398bce17c19f3af4)

Fixed #9407

(cherry picked from commit df4262d0e1d8d460ba93b9fcde16476306ee21f6)

Fix #9873: Use pkg-static

When pkg repo points to a new major version pkg is updated, use
pkg-static binary to check PHP version and make sure the command works

Don't dedup DNS from dyn sources if override is disabled. Fixes #9963

(cherry picked from commit f829d7e2967d170f09756937e9076e87d5f9e2d7)

simplify queue stats parser

(cherry picked from commit 5a0f6513bfe2ba1da87505dbb7b97c6b4479bf34)

support variable value length in queue stats parser

(cherry picked from commit e5deede539e4164256e5243b22f3ee963fc35ea7)

Add packages to version string to support composite update

(cherry picked from commit 725c8134d390eefb4bb258893a27a278176158ac)

Fix #6846: Properly detect Super Micro C2558/C2758

(cherry picked from commit 4de6f04d5f4eb69e9293dad6f47ce66f7d3baec1)

Add RFC 8031 Group 31 to IPsec. Implements #9531

(cherry picked from commit 4fc267484e604509b072b398642f19cb6797ef21)

Bump version to 2.4.5

Typo fix

(cherry picked from commit 463d5d11726084575b166dffe4b85164b2f5a5c3)

Enforce limiter delay 0<=x<=10000. Fixes #9921

(cherry picked from commit 8afa74bb099d75962a5efb8a603981c0249f91a0)

CDATA escape more auth-related fields. Fixes #9327

(cherry picked from commit 327ad811aa5f965ba805ea78f879c759ca0fdafa)

Correct VTI IPv6 test and syntax. Fixes #9801

(cherry picked from commit 1d9fbb716543110ac245e2749f8c06fc77480a77)

Fix #7791: strings binary can be useful for troubleshooting

Fix #3743: Allow OpenVPN keepalive configuration

- Remove hardcoded 'keepalive 10 60' configuration
- Added 'inactive seconds' option
- Let user configure 'keepalive interval timeout'. It defaults to 10 60
as it was hardcoded until now
- Let user define ping and chose between ping-exit or ping-restart...

Suppress errors from touch when marking GW down. Fixes #9851

(cherry picked from commit 83794361b7135aaef4e47b35bd27df7da6ce023c)

Fix #9612: Run fsck -z once during upgrade

(cherry picked from commit 7373049764f144b2ea7c891bd60760ab64b41160)

Fix OpenVPN keepalive default values. Fixes #3473

(cherry picked from commit 99d7e8c10e96e6f22ad47973d07258cd02426fe6)

Update privilege definitions

Reduce default GUI cert lifetime to 825 days. Issue #9825

Add root warning to HA node sync privilege.

(cherry picked from commit 03b8b94ed86ca85510e7d00e035d30eab7e3a43b)

Initialize array to avoid a PHP error in upgrade_144_to_145(). Fixes #9840

(cherry picked from commit 8e0d33ec48792e13839a0181031664261269c220)

Fixes #9362: proxied value must be a boolean

(cherry picked from commit 888635338d63e8b21297e3b25f0ff545fe9c4c41)

Image upload validation improvements. Fixes #9804

• Make functions for validating images against a pre-defined list of
  approved types
• Change the picture widget to use these functions
• Add validation for uploaded Captive Portal logo/background images

(cherry picked from commit 09d597434c9ccb456c8f207649dbe43fd5ff85db)

Fix #9674: Do not set duplicate-cn in p2p_shared_key mode

Fix #9285: Move ping-check option from global to per-subnet

(cherry picked from commit 5197e3e3a3b0ee048785e2ffb4222d7cba4e6c74)

Add IPsec DH/PFS groups 25/26/27. Implements #9757

(cherry picked from commit 21bee0287caf76bb7ab63ec29b0ecf7435940a06)

openvpn: cleaning default case handling in switch statements

(cherry picked from commit f93ec3853fc0c01760606994422e9e8fc0d645c9)

change after review

(cherry picked from commit f08369ec248f2733eb2b69db23aa042e27ec04de)

Update text

(cherry picked from commit cef01bcb95add6acc13edb16739e10d7ed8ba6e2)

Added tlsauth keydir options to openvpn client and server

(cherry picked from commit 8698f918d170d3836037d3a39b4e1f8aa6389f6d)

Deduplicate code in openvpn.inc

(cherry picked from commit f7335af377d41262654bdbd7d7cf0e2993fb71d1)

Remove unnecessary variable

(cherry picked from commit 1d13560cb36db0d5f7cec9fa9d6295445333ba95)

Improve efficiency of resync checks.

GW Group changes are checked iff the interface is not the empty string or the interface in question is not the same as the OpenVPN interface.

(cherry picked from commit 15f8062b42b3b2849d5dd7fdde9170d4785e84e4)

Add ability for OpenVPN instances to resync on IP changes and on boot.

OpenVPN instances resync if interface IP change occurs.
At boot, the interface is the empty string, so resync is mandatory to generate OpenVPN files in /var/etc/openvpn.

(cherry picked from commit 7071aab3b2c70bbed531e0f82bedab3273484843)

Add else clause for cases when OpenVPN interface file does not exist.

- Prevents potential race condition at startup resulting in failure to start OpenVPN instances.
- In cases where interface file is not present the openvpn_resync function handles a restart correctly....

Update openvpn.inc to allow OpenVPN instances to resync when running on a gateway group.

Implementation now checks if OpenVPN client/server running on gateway group should resync when IP changes occur or if cables are unplugged/replugged.

(cherry picked from commit c46d0b12d606b2249f4b5305994e8c3e750634eb)

Remove deprecated comments since username tag got CDATA

(cherry picked from commit 1dcaf2d816721704bfb05ae2587c09e37c873e71)

Ticket #6195: Use CDATA on username tag

After discuss with JimP we agreed it would be a better approach than
bdaa5235d4 if we add username tag to the list of tags that use CDATA

(cherry picked from commit ce76d1e41bf3673e74041c53c230e6880e890dfa)

Fix handing of DNSimple API response

It seems DNSimple started using HTTP/2, which broke the regex the dnsimple updater was using to check for success. I changed it to use the CURLINFO_HTTP_CODE instead.

I noticed several other providers are using the regex status match instead of HTTP_CODE, but I didn't touch those. I haven't written any PHP in 20 years, and I don't use those providers to test them. This change works for me for DNSimple now....

Do not use constructor with the same name of class, it's going to be deprecated

(cherry picked from commit d43154fee7d7c2a5a007f36da7d86a94bd197a85)

Fixed #8014

Fixed wildcard variable not being set correctly.
Updated CURLOPT_URL according to provider's documentation.
Added support for MX records.

(cherry picked from commit cedc8184606a4cfdf6cb7542e43d205205005865)

Make factory test case insensitive

(cherry picked from commit 552a41fbd37aa61f50e62f29876485c9775345cc)

Revise update check to provide a more consistent version string, and to provide it in JSON format

(cherry picked from commit 819165020041ee46f423a7ead5aca855dac28cdb)

IPsec ID type parsing changes. Fixes #9243

• Move code to function to avoid unnecessary duplication of code
• Clean up the logic to avoid further redundancies
• Set keyid type to be quoted and to have its type prefixed

(cherry picked from commit 3a73fc74ca54b1167fbecfb679d0e634f5f1ab2e)

Routing, actually show the "(default)" mark on the default route as it is present on the OS

Most obvious problem was when manually switching from WANGW1 to WANGW2 it showed both as (default) after saving the setting and before applying it. Also after applying it would require another page refresh to show the updated situation. Also add a little information box that shows what (Default) means for the user....

Bug #9218

(cherry picked from commit adc6ddbdbbb465fd3cb58d931465ac93b1fdedb6)

Fixed #9693
Allow ACB to be suppressed by including magic string in the backup description
Transmit max number of manual backups in the ACB

(cherry picked from commit 6f6299a3a6aca1b7baf5d80d6d24325100363939)

Instead of restarting pkgs, add an IPsec reload hook they can use instead. Fixes #9668

(cherry picked from commit a264f870479c36ac1599b936bbdd547f0f8a99ec)

Restart packages at the end of rc.newipsecdns. Fixes #9668

Not an ideal solution but it does ensure that FRR routes function after
an IPsec event.

(cherry picked from commit 15701e03e36051907a23ddbe5ab04f42c94c0944)

Update dyndns.class

(cherry picked from commit 0c43f8256edf08e473caae8c7dad0936ada2fd90)

Update services.inc

(cherry picked from commit 443a8b1beca07d1490f170c972c1c00ecb39baa7)

Azure DDNS whitespace only

(cherry picked from commit ed5b58a752a2241ce052851def2a7c846361146d)

Linode Dynamic DNS syntax fixes

(cherry picked from commit bd0a29ea21d0a5230b74410a7a4c1289fef38e89)

Add Dynamic DNS support for Linode #9268

(cherry picked from commit b923a8251ca4b899936156db48fb9253745c41e3)

Fix AzureV6 DynDNS client

`AAAARecords` in the Azure DNS API is case sensitive

Documentation: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
(cherry picked from commit 1ca156ea0875014b5175855c9fe8459950173d0b)

Add GUI option for IPsec tunnel closeaction. Fixes #9767

(cherry picked from commit 85c85e89ec7fad6974cd008d1f25676adf8e288d)

IPSec: Just destroy interface if it exists and it's not booting

Based on PR: https://github.com/pfsense/pfsense/pull/4076

Recognize more Netgate hardware automatically. Fixes #8051

(cherry picked from commit f301aa594787b4d44c6779df3c924fa724ffa3b8)