pfSense

Force the <enableserial> on when restoring a backup on a device with serial only console.

Affects multiple devices.

Ticket #1547

(cherry picked from commit c91af4ac6a6b501b59a542acb4ace05e2b10e3ea)

Fix limiter selection validation.

(cherry picked from commit d0e9c310708fe7be6de86fe082f57e1fc27ce143)

Test $sform before use, fixes #9313

(cherry picked from commit 069585172e6408195b16bbe3090aeba56699ee51)

Ticket #9308: Sort country codes

Fix #9308: Obsolete now unused /etc/ca_countries

Ticket #9308: Replace use of /etc/ca_countries by get_cert_country_codes()

Ticket #9308: Implement get_cert_country_codes() to get the list of country codes to be used by CAs and Certs

Make get_countr_code() parameter default to 'ALL'

Add validation and encoding to various firewall advanced values. Issue #9294

(cherry picked from commit 62baf0777924b2c21c832db3c0040988e7451c61)

Encode shaper queue name before printing. Issue #9294

Validation is already present and prevents bad values from being
entered.

(cherry picked from commit 1072b9333c47df593420937361349b09a9b73639)

Input validation and encoding of IGMP proxy addresses. Issue #9294

(cherry picked from commit 261916e5d3f833a58d5cef1afdadc7495ec2c74b)

Validate NTP GPS type, encode output. Issue #9294

(cherry picked from commit 938988609c306fcd44e25a053745c4b8332eeeb5)

Encode traceroute error message. Issue #9294

(cherry picked from commit 57ccd08bf7ee05b9a00750a1fd9cf8f148e0c9ac)

Validate submitted interfaces. Issue #9294

(cherry picked from commit 5cc7d21dc08be6c65a2bf7f8f4481dc13f4ae115)

Fix input validation of webguiproto. Issue #9294

(cherry picked from commit 56888f24ca2715e678a1324633a08d3a611b4136)

status.php optimizations. Implements #9290

• Rewrites the command output so it is first written to files, then read through line-by-line to PHP. Should be much more efficient and consume less memory, making the previously "too large" commands viable.
• Increase verboseness of ifconfig output, add supported media...

Don't use DISTFILES_CACHE

Remove unnecessary ports from dependency list

Fix desc of OpenVPN sync to show that it also syncs certs. Fixes #9283

(cherry picked from commit 9f3b87d898e1fa8a5bfa40758e5747515cc38ad4)

Fix handling of special swap cases. Fixes #9281

(cherry picked from commit 14d470377eab89d7c3f6f765a150ce737409af28)

Packet capture page fixes. Fixes #9239

• Add "None" output level
• Detect large files and refuse to print them in the GUI textarea
• Ensure output buffering is off before doing readfile to avoid PHP
  consuming memory while downloading a large capture.

(cherry picked from commit 36192f4a459ec5d5baf06819102ba783c1725ba1)

Init array for 6o4 tunneling Fixes #9264

(cherry picked from commit 5345b25405101eba3112c1d5daef99bd3b308533)

Allow a trailing dot in a hostname on diag_dns.php. Fixes #9276

(cherry picked from commit e56c473d7c4c2e7de71c43420c844e452dbcfa82)

Remove links to DNSStuf tools. Fixes #9275

(cherry picked from commit 08c49b4d74b87bf34dd46a37837147b857eb8859)

Fix saving IPv6 over IPv4 tunneling NAT setting. Fixes #9264

(cherry picked from commit 3fcf5ad71216922921801d85d063d360fde5566f)

Disable RUST option for aarch64 as well

Fix syntax

Re-enable suricata, without RUST, for armv6

Disable drm-kmod and suricata on ARMv6

Sort

Change alias name/pf keyword check to be case insensitive. Fixes #9231

(cherry picked from commit 2c5d3b1e5002598cb799a182ccc1d6e66d3aac5d)

Init filter rules in firewall_nat.php. Fixes #9193

(cherry picked from commit 701728c0778cbb4ccf95ebfad30bf56339d1a7e3)

Ensure IPsec P1 entries have a 'protocol' value. Fixes #9207

(cherry picked from commit d188b7251a83b4a8a39ba50dfaf9a1cba35cad17)

Welcome pfSense-2.4.4-p2

Fix DigitalOcean DynDNS client

Fixes the check on the return value since it's been updated to use
HTTP/2 syntax. Also adds logic to allow using `@` to denote updating the
root domain A record as well.

(cherry picked from commit 5878d529949aafef165acdce8e7daae234c9d2c4)

Alternate swap device location tactics. Issue #9182

(cherry picked from commit d36e5a49e6104c52bca2153eba45709d5af99599)

Fix nginx resolver handling when a cert needs OCSP stapling. Fixes #9160

(cherry picked from commit 4c6e3de40f56a1bd8d978a9dd4677d0ab025b8cb)

Minor fixes related to #9121

(cherry picked from commit 6f9729c0a53be67ced6d52e6e33dba6b237083ab)

Fixed regression where calling station id was removed from openvpn

(cherry picked from commit 95f3d049bfead1c6faf04c8a626a7ce868f8b6f8)

Remove obsolete OLSRD code. Implements #9117

(cherry picked from commit 592bec817f152a7536572a675079776138827cc8)

Rework cert keylen/digest validation. Fixes #9180

(cherry picked from commit ed76624bf01c0d1718d427919145bf4e5f949264)

Fix array init in setup_wizard.xml. Fixes #9170

(cherry picked from commit f5f79fcc24241f0a76f6a7fe9b32917bee64e393)

Fix NPt validation to allow single addresses. Fixes #9163

(cherry picked from commit e9446f537051c7b536d0b3fbb5ebd00c3766001a)

Add Korean to the list of available languages

Update translation files

Regenerate pot

Fix #6226: Add sysutils/usb_modeswitch to the list of packages

Do not call interfaces_vlan_configure() every time an interface is edited in GUI.

This is just necessary when a parent interface is changed and we have to propagate the changes to all clones (MTU, FLAGS and others).

Add a logic to detect when a parent interface is changed and only then call interfaces_vlan_configure()....

Make the WF2Q+ the default scheduler for the dummynet limiters.

The WF2Q+ was the default scheduler in previous versions, it is well tested and support dynamic queues.

Add a note for the FIFO scheduler to make clear that it does not support dynamic queues (by design) and as such, it is working as intended....

Welcome pfSense-2.4.4-p1

Allow no username for FreeDNS-v6

Also include that and Digital Ocean in the help text.

(cherry picked from commit 92c39e9b923792a58b56323a7e2fb46f608b447f)

Fix #9144: Init array before use

Fix #9121: Initialize arrays to prevent PHP 7 errors

Fix #8937: Show hwaddr for LAGG members

Fix #8465: Preserve default gw when switch to BACKUP

interfaces_carp_set_maintenancemode() calls interface_carp_configure()
to each configured CARP and it ends up reconfiguring completely the
interface when it's not necessary.

Add a new parameter $maintenancemode_only to interface_carp_configure()...

Break long lines

Fix few spelling issues
Ticket #9134

(cherry picked from commit 85a8f9b0ce0d0fac6f361bc5dfd09c67607020f1)

Send MAC address as username if radmac is used for connecting an user
Ticket #9131

(cherry picked from commit f790565a7514662b1fe97fc7c79b56838597965c)

Redirect Blocked MAC without requiring credentials if Blocked MAC URL has been entered.

Redmine #9114

(cherry picked from commit 83a6f504d6eb4d1925c4745a6457805fbbe308d9)

Update src/usr/local/www/vendor/d3/d3.min.js

Restored d3.min.js

(cherry picked from commit 2dd0ba04705396981dfc6d75ec6910799ba8846d)

Update src/usr/local/www/vendor/d3/d3.min.js

make sure to only pass valid options when supported by the browser

(cherry picked from commit 125ae17e59a54c2315c68336a02bf45a7820bf5b)

Removed js warnings

(cherry picked from commit 36742b464a1b4449e52cbd0b539fece507a3b23e)

Init various arrays in easyrule before use with references. Fixes #9119

(cherry picked from commit b55d94e80eeed57e39d33c643bf00be6565c1938)

Fix #9071: Make sure pkg metadata is updated when repo config changes

Remove unused variable

Simplify logic to remove packages section from backup

Always configure VTI routes when setting up the interface. Fixes #9116

(cherry picked from commit ed104a182a95f0ce4e6df76a8c3f0698ff7ce092)

Remove outdated 'Gold' reference from README.md

(cherry picked from commit 360737f6345e376f2de6d2810a1f345a018480e5)

Add README.txt for issue #9104

(cherry picked from commit eb6a022efaa19ce146990e0e4a57e421ddbad8bb)

Fix previous regex. Issue #9106

(cherry picked from commit 16b78f3879bdf658274caf750c9360ec97bb8f77)

Replace '.' in radius name for strongSwan. Fixes #9106

(cherry picked from commit cc955fe63ad44b5aac66721e54965d9bc13e990c)

Initialize QinQ arrays before use. Fixes #9109

(cherry picked from commit 439d9beba0213c96281d8ff6b09ccb8136b1a0aa)

Fix #9102: Suppress stream_select() undesired warnings

Fix change detection of GUI web server toggles. Fixes #9105

(cherry picked from commit 8207fac69158ad4a56deab4a4b4f6f4c3c361b81)

Add 0.0.0.0/0 to VTI left/rightsubnets. Fixes #8859

No negative feedback from testing, time for a wider push.

This helps with third party devices that require 0.0.0.0/0 to route
traffic on a VTI P2.

(cherry picked from commit 5c4aa94a90256b13b19209f11e4c75b2d0e85ece)

Add checkbox to disable SMTP SSL cert verification. Implements #9001

The default action is to validate the certificate. If the user knows the
server does not have a valid certificate (e.g. self-signed), this option
will allow encryption to be used without validating the identity of the...

If the cert date is negative, use DateTime instead of date. Fixes #9100

(cherry picked from commit 3fec247042a91642a22a8761d3c8a1f9df119817)

Prevent CRL from using too large a lifetime on ARM. Fixes #9098

(cherry picked from commit 9aa8f6a864905c0e3738c337a51f0772b0c5eb93)

Improve handling of empty cert tags. Fixes #9099

(cherry picked from commit ca4456b95c53e89cf6b428a999ae15367b753073)

Prevent log size from being too large, which breaks clog. Fixes #9081

(cherry picked from commit 8bd36425b4bc46e5bbcc940a4d20bfbb2a0011ba)

Prevent PHP error when saving log config. Fixes #9095

(cherry picked from commit 4c4e294b0f1523827fa21066521674a435c8f670)

Make MBT prefer video console. Fixes #9094

Avoids foot-shooting by restoring a config with serial enabled.

(cherry picked from commit 5e5df38fcd3116c4d0f3fc71622643e962f982a8)

Use EFI console when needed. Fixes #8978

(cherry picked from commit 2f73f2f9eca656c2de5b836f4d0292186147e788)

Fix 9086: Remove gettext() from all 'Local Databases' strings

Update translation files

Regenerate pot

Add help text to sshguard whitelist
Reduce delete button size
Change label text to "Add address"

(cherry picked from commit 5514e368421171482e3e5b945f4c999cc0153fa8)

Skip empty IPsec P1 during upgrade to 17.5. Fixes #9083

(cherry picked from commit 024e5de242661219bb8a62f183b1601cec44aa3c)

Fix #8864: Let users modify sshguard parameters and whitelist

Array initialization in NAT pages. Fixes #9080

(cherry picked from commit 42ad3b8b51e12b9e4c89b94e2a191495318f42dc)

Initialize package arrays before use. Fixes #9067

(cherry picked from commit bfd3334b4bc9ae0d3c43f69e8305c83b0da3aa58)

Add trailing slash to ECL check path for /config/. Fixes #9066

(cherry picked from commit c688c59b47a3ce138ffe094794d01f1e6fcc00df)

Fix processing of the 'all' group. Fixes #9051

All the 'all' group to the list of groups at the end, rather than the
start. This way it will be considered no matter how users login. This
also fixes issues some users had with the original changes.

(cherry picked from commit 4de15854384e28004b0dc571dc8a40fda7eae694)

Validate and protect powerd option values. Fixes #9061

(cherry picked from commit 3be699295e5cb7be24cc5361700be1a8b759e26c)

Use the fw domain for DNS search when no other choices exist. Fixes #9056

(cherry picked from commit 74a8a219d33c9b87ab4b6b4026d247f0f6bdcaa6)

gateway monitoring, wait for apinger to terminate or remove its pid file when restarting it.

(cherry picked from commit 66491555711182d9176f6292fd58397c65e4b2af)

generate a flag even if trying to perform RADIUS MAC authentication on a non-RADIUS server.

(cherry picked from commit 22e328743170b62b55d6e18b593c4005e8d6f892)

Implement login fallback for RADIUS MAC authentication

(cherry picked from commit 774ff51ba07f944a39fdc6859ec7d258b95315bf)

Strictly define the EAP Identifier for custom local client entries. Fixes #9055

(cherry picked from commit 2d7ed31e3227566d0474929a3aed84509247f91e)

Consider the "all" group when determining privileges. Fixes #9051

(cherry picked from commit fe1afbb7549907e0d1cdfbf85d5f36d075a6a916)