pfSense

Add warning for OpenVPN client, server, and override privileges.

Since these can use OpenVPN advanced directives to call external
scripts, they can be used to run commands that the user may not
otherwise have access to run.

Issue #9510

(cherry picked from commit f75b0eb8e781570a84e8700b150e09e081ccacfe)

Encode download parameter before use. Fixes #9508

(cherry picked from commit ce77c104eee92cfbbc0d84980e60899295dadeac)

Encode descr in the WOL widget. Fixes #9507

(cherry picked from commit 5789a02eab9b2ebbcb1f28d1d037b408b436a853)

Encode output in status_filter_reload.php. Fixes #9499

(cherry picked from commit 1af9400d594cd183d011f22fa9b3a7630570a250)

Init array before use

(cherry picked from commit a8a0b1321d2a477772aac4d0034d819b61f2c9bf)

Do now show scheduler icon when scheduler tag is empty

Spotted by: Oliveira MaisSecurity <oliveira@maissecurity.com.br>

Create /var/crash after creating /var RAM disk. Fixes #9409

(cherry picked from commit b39d615394eabd2d19afef0936219c609ef602e3)

Add missing obsoleted files

Initialized entries variable before use. Fixes #9359

(cherry picked from commit 9146639e722b4d437d19b5ade1157ae01849a313)

Use only sshguard table for blocking ssh/gui attacks. Issue #9223

(cherry picked from commit 555a9ab5c01101ddab7daa41f35d379d1c39b26e)

Remove unnecessary expiretable cron jobs for ssh/gui lockout. Issue #9223

(cherry picked from commit 7a68df5efc35b6d1ee514bb87a2298f5180de001)

Remove unnecessary expiretable cron jobs for ssh/gui lockout. Issue #9223

(cherry picked from commit 397d9fff6df234d98ef2353b0b29912a14777442)

Fix output buffering when downloading config backups. Fixes #9390

(cherry picked from commit 4015b03d4b184e546cb3590430fee6f9953ce23e)

Update translation files

Regenerate pot

Update privileges

(cherry picked from commit 3b3e31c248b8185372251f8bd2fbc2a95652a7ec)

Merge pull request #4034 from kkr0kk/patch-2

Fix OU Name DN entry when creating a user cert. Fixes #9317

(cherry picked from commit 354b1c750d9eeb9ccf0dc22033c9c813ec88e6f3)

Correct syntax error in diag_backup.php. Fixes #9316

(cherry picked from commit e0b32eb9e6b040fd14025b5c32644959ba67250e)

Force the <enableserial> on when restoring a backup on a device with serial only console.

Affects multiple devices.

Ticket #1547

(cherry picked from commit c91af4ac6a6b501b59a542acb4ace05e2b10e3ea)

Fix limiter selection validation.

(cherry picked from commit d0e9c310708fe7be6de86fe082f57e1fc27ce143)

Test $sform before use, fixes #9313

(cherry picked from commit 069585172e6408195b16bbe3090aeba56699ee51)

Ticket #9308: Sort country codes

Fix #9308: Obsolete now unused /etc/ca_countries

Ticket #9308: Replace use of /etc/ca_countries by get_cert_country_codes()

Ticket #9308: Implement get_cert_country_codes() to get the list of country codes to be used by CAs and Certs

Make get_countr_code() parameter default to 'ALL'

Add validation and encoding to various firewall advanced values. Issue #9294

(cherry picked from commit 62baf0777924b2c21c832db3c0040988e7451c61)

Encode shaper queue name before printing. Issue #9294

Validation is already present and prevents bad values from being
entered.

(cherry picked from commit 1072b9333c47df593420937361349b09a9b73639)

Input validation and encoding of IGMP proxy addresses. Issue #9294

(cherry picked from commit 261916e5d3f833a58d5cef1afdadc7495ec2c74b)

Validate NTP GPS type, encode output. Issue #9294

(cherry picked from commit 938988609c306fcd44e25a053745c4b8332eeeb5)

Encode traceroute error message. Issue #9294

(cherry picked from commit 57ccd08bf7ee05b9a00750a1fd9cf8f148e0c9ac)

Validate submitted interfaces. Issue #9294

(cherry picked from commit 5cc7d21dc08be6c65a2bf7f8f4481dc13f4ae115)

Fix input validation of webguiproto. Issue #9294

(cherry picked from commit 56888f24ca2715e678a1324633a08d3a611b4136)

status.php optimizations. Implements #9290

• Rewrites the command output so it is first written to files, then read through line-by-line to PHP. Should be much more efficient and consume less memory, making the previously "too large" commands viable.
• Increase verboseness of ifconfig output, add supported media...

Fix desc of OpenVPN sync to show that it also syncs certs. Fixes #9283

(cherry picked from commit 9f3b87d898e1fa8a5bfa40758e5747515cc38ad4)

Fix handling of special swap cases. Fixes #9281

(cherry picked from commit 14d470377eab89d7c3f6f765a150ce737409af28)

Packet capture page fixes. Fixes #9239

• Add "None" output level
• Detect large files and refuse to print them in the GUI textarea
• Ensure output buffering is off before doing readfile to avoid PHP
  consuming memory while downloading a large capture.

(cherry picked from commit 36192f4a459ec5d5baf06819102ba783c1725ba1)

Init array for 6o4 tunneling Fixes #9264

(cherry picked from commit 5345b25405101eba3112c1d5daef99bd3b308533)

Allow a trailing dot in a hostname on diag_dns.php. Fixes #9276

(cherry picked from commit e56c473d7c4c2e7de71c43420c844e452dbcfa82)

Remove links to DNSStuf tools. Fixes #9275

(cherry picked from commit 08c49b4d74b87bf34dd46a37837147b857eb8859)

Update gwlb.inc

Update gwlb.inc

Correct BUG 9004 -> set the default gateway when system start and a gateway_group is default IPV4 gateway

Fix saving IPv6 over IPv4 tunneling NAT setting. Fixes #9264

(cherry picked from commit 3fcf5ad71216922921801d85d063d360fde5566f)

Change alias name/pf keyword check to be case insensitive. Fixes #9231

(cherry picked from commit 2c5d3b1e5002598cb799a182ccc1d6e66d3aac5d)

Init filter rules in firewall_nat.php. Fixes #9193

(cherry picked from commit 701728c0778cbb4ccf95ebfad30bf56339d1a7e3)

Ensure IPsec P1 entries have a 'protocol' value. Fixes #9207

(cherry picked from commit d188b7251a83b4a8a39ba50dfaf9a1cba35cad17)

Fix DigitalOcean DynDNS client

Fixes the check on the return value since it's been updated to use
HTTP/2 syntax. Also adds logic to allow using `@` to denote updating the
root domain A record as well.

(cherry picked from commit 5878d529949aafef165acdce8e7daae234c9d2c4)

Alternate swap device location tactics. Issue #9182

(cherry picked from commit d36e5a49e6104c52bca2153eba45709d5af99599)

Fix nginx resolver handling when a cert needs OCSP stapling. Fixes #9160

(cherry picked from commit 4c6e3de40f56a1bd8d978a9dd4677d0ab025b8cb)

Minor fixes related to #9121

(cherry picked from commit 6f9729c0a53be67ced6d52e6e33dba6b237083ab)

Fixed regression where calling station id was removed from openvpn

(cherry picked from commit 95f3d049bfead1c6faf04c8a626a7ce868f8b6f8)

Remove obsolete OLSRD code. Implements #9117

(cherry picked from commit 592bec817f152a7536572a675079776138827cc8)

Rework cert keylen/digest validation. Fixes #9180

(cherry picked from commit ed76624bf01c0d1718d427919145bf4e5f949264)

Fix array init in setup_wizard.xml. Fixes #9170

(cherry picked from commit f5f79fcc24241f0a76f6a7fe9b32917bee64e393)

Fix NPt validation to allow single addresses. Fixes #9163

(cherry picked from commit e9446f537051c7b536d0b3fbb5ebd00c3766001a)

Add Korean to the list of available languages

Update translation files

Regenerate pot

Do not call interfaces_vlan_configure() every time an interface is edited in GUI.

This is just necessary when a parent interface is changed and we have to propagate the changes to all clones (MTU, FLAGS and others).

Add a logic to detect when a parent interface is changed and only then call interfaces_vlan_configure()....

Make the WF2Q+ the default scheduler for the dummynet limiters.

The WF2Q+ was the default scheduler in previous versions, it is well tested and support dynamic queues.

Add a note for the FIFO scheduler to make clear that it does not support dynamic queues (by design) and as such, it is working as intended....

Allow no username for FreeDNS-v6

Also include that and Digital Ocean in the help text.

(cherry picked from commit 92c39e9b923792a58b56323a7e2fb46f608b447f)

Fix #9144: Init array before use

Fix #9121: Initialize arrays to prevent PHP 7 errors

Fix #8937: Show hwaddr for LAGG members

Fix #8465: Preserve default gw when switch to BACKUP

interfaces_carp_set_maintenancemode() calls interface_carp_configure()
to each configured CARP and it ends up reconfiguring completely the
interface when it's not necessary.

Add a new parameter $maintenancemode_only to interface_carp_configure()...

Break long lines

Fix few spelling issues
Ticket #9134

(cherry picked from commit 85a8f9b0ce0d0fac6f361bc5dfd09c67607020f1)

Send MAC address as username if radmac is used for connecting an user
Ticket #9131

(cherry picked from commit f790565a7514662b1fe97fc7c79b56838597965c)

Redirect Blocked MAC without requiring credentials if Blocked MAC URL has been entered.

Redmine #9114

(cherry picked from commit 83a6f504d6eb4d1925c4745a6457805fbbe308d9)

Update src/usr/local/www/vendor/d3/d3.min.js

Restored d3.min.js

(cherry picked from commit 2dd0ba04705396981dfc6d75ec6910799ba8846d)

Update src/usr/local/www/vendor/d3/d3.min.js

make sure to only pass valid options when supported by the browser

(cherry picked from commit 125ae17e59a54c2315c68336a02bf45a7820bf5b)

Removed js warnings

(cherry picked from commit 36742b464a1b4449e52cbd0b539fece507a3b23e)

Init various arrays in easyrule before use with references. Fixes #9119

(cherry picked from commit b55d94e80eeed57e39d33c643bf00be6565c1938)

Fix #9071: Make sure pkg metadata is updated when repo config changes

Remove unused variable

Simplify logic to remove packages section from backup

Always configure VTI routes when setting up the interface. Fixes #9116

(cherry picked from commit ed104a182a95f0ce4e6df76a8c3f0698ff7ce092)

Fix previous regex. Issue #9106

(cherry picked from commit 16b78f3879bdf658274caf750c9360ec97bb8f77)

Replace '.' in radius name for strongSwan. Fixes #9106

(cherry picked from commit cc955fe63ad44b5aac66721e54965d9bc13e990c)

Initialize QinQ arrays before use. Fixes #9109

(cherry picked from commit 439d9beba0213c96281d8ff6b09ccb8136b1a0aa)

Fix #9102: Suppress stream_select() undesired warnings

Fix change detection of GUI web server toggles. Fixes #9105

(cherry picked from commit 8207fac69158ad4a56deab4a4b4f6f4c3c361b81)

Add 0.0.0.0/0 to VTI left/rightsubnets. Fixes #8859

No negative feedback from testing, time for a wider push.

This helps with third party devices that require 0.0.0.0/0 to route
traffic on a VTI P2.

(cherry picked from commit 5c4aa94a90256b13b19209f11e4c75b2d0e85ece)

Add checkbox to disable SMTP SSL cert verification. Implements #9001

The default action is to validate the certificate. If the user knows the
server does not have a valid certificate (e.g. self-signed), this option
will allow encryption to be used without validating the identity of the...

If the cert date is negative, use DateTime instead of date. Fixes #9100

(cherry picked from commit 3fec247042a91642a22a8761d3c8a1f9df119817)

Prevent CRL from using too large a lifetime on ARM. Fixes #9098

(cherry picked from commit 9aa8f6a864905c0e3738c337a51f0772b0c5eb93)

Improve handling of empty cert tags. Fixes #9099

(cherry picked from commit ca4456b95c53e89cf6b428a999ae15367b753073)

Prevent log size from being too large, which breaks clog. Fixes #9081

(cherry picked from commit 8bd36425b4bc46e5bbcc940a4d20bfbb2a0011ba)

Prevent PHP error when saving log config. Fixes #9095

(cherry picked from commit 4c4e294b0f1523827fa21066521674a435c8f670)

Make MBT prefer video console. Fixes #9094

Avoids foot-shooting by restoring a config with serial enabled.

(cherry picked from commit 5e5df38fcd3116c4d0f3fc71622643e962f982a8)

Use EFI console when needed. Fixes #8978

(cherry picked from commit 2f73f2f9eca656c2de5b836f4d0292186147e788)

Fix 9086: Remove gettext() from all 'Local Databases' strings

Update translation files

Regenerate pot

Add help text to sshguard whitelist
Reduce delete button size
Change label text to "Add address"

(cherry picked from commit 5514e368421171482e3e5b945f4c999cc0153fa8)

Skip empty IPsec P1 during upgrade to 17.5. Fixes #9083

(cherry picked from commit 024e5de242661219bb8a62f183b1601cec44aa3c)

Fix #8864: Let users modify sshguard parameters and whitelist

Array initialization in NAT pages. Fixes #9080

(cherry picked from commit 42ad3b8b51e12b9e4c89b94e2a191495318f42dc)

Initialize package arrays before use. Fixes #9067

(cherry picked from commit bfd3334b4bc9ae0d3c43f69e8305c83b0da3aa58)