Merge remote branch 'upstream/master'

Conflicts:
	conf.default/config.xml
	etc/inc/filter.inc
	etc/inc/globals.inc
	etc/inc/pfsense-utils.inc
	etc/inc/upgrade_config.inc
	usr/local/www/interfaces.php

12 files changed, 421 insertions, 200 deletions

diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index a66c6cb..336b8e8 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -809,12 +809,11 @@ function captiveportal_disconnect($dbent, $radiusservers,$term_cause = 1,$stop_t
 	captiveportal_free_ipfw_ruleno($dbent[1]);
 
 	// XMLRPC Call over to the master Voucher node
-	$a_voucher = &$config['voucher'];
-	if(!empty($a_voucher['vouchersyncdbip'])) {
-		$syncip   = $a_voucher['vouchersyncdbip'];
-		$syncport = $a_voucher['vouchersyncport'];
-		$syncpass = $a_voucher['vouchersyncpass'];
-		$vouchersyncusername = $a_voucher['vouchersyncusername'];
+	if(!empty($config['voucher']['vouchersyncdbip'])) {
+		$syncip   = $config['voucher']['vouchersyncdbip'];
+		$syncport = $config['voucher']['vouchersyncport'];
+		$syncpass = $config['voucher']['vouchersyncpass'];
+		$vouchersyncusername = $config['voucher']['vouchersyncusername'];
 		$remote_status = xmlrpc_sync_voucher_disconnect($dben, $syncip, $syncport, $syncpass, $vouchersyncusername, $term_cause, $stop_time);
 	}
 
diff --git a/etc/inc/dyndns.class b/etc/inc/dyndns.class
index 150dedc..65defb2 100644
--- a/etc/inc/dyndns.class
+++ b/etc/inc/dyndns.class
@@ -98,7 +98,9 @@
 			$this->_debugFile = "{$g['varetc_path']}/dyndns_{$dnsIf}{$dnsService}" . escapeshellarg($dnsHost) . ".debug";
 
 			log_error("DynDns: updatedns() starting");
-			
+
+			$dyndnslck = lock($dnsHost, LOCK_EX);
+
 			if (!$dnsService) $this->_error(2);
 			switch ($dnsService) {
 			case 'freedns':
@@ -128,6 +130,7 @@
 			// Ensure that we where able to lookup the IP
 			if(!is_ipaddr($this->_ifIP)) {
 				log_error("There was an error trying to determine the IP for interface - {$dnsIf}({$this->_if}). Probably interface has no ip or is down. Dyndns update not possible for {$dnsService}.");
+				unlock($dyndnslck);
 				return;
 			}
 
@@ -162,6 +165,8 @@
 					break;
 				}
 			}
+
+			unlock($dyndnslck);
 		}
 			
 		/*
@@ -178,7 +183,7 @@
 				curl_setopt($ch, CURLOPT_USERAGENT, $this->_UserAgent);
 				curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
 				curl_setopt($ch, CURLOPT_INTERFACE, $this->_ifIP);
-				curl_setopt($ch, CURLOPT_TIMEOUT, 60); // Completely empirical
+				curl_setopt($ch, CURLOPT_TIMEOUT, 120); // Completely empirical
 			}
 
 			switch ($this->_dnsService) {
@@ -795,12 +800,13 @@
 			if($successful_update == true) {
 				/* Write WAN IP to cache file */
 				$wan_ip = $this->_checkIP();
-				$currentTime = time();				  
-				log_error("phpDynDNS: updating cache file {$this->_cacheFile}: {$wan_ip}");
 				conf_mount_rw();
-				$file = fopen($this->_cacheFile, 'w');
-				fwrite($file, $wan_ip.':'.$currentTime);
-				fclose($file);
+				if ($wan_ip > 0) {
+					$currentTime = time();				  
+					log_error("phpDynDNS: updating cache file {$this->_cacheFile}: {$wan_ip}");
+					@file_put_contents($this->_cacheFile, "{$wan_ip}:{$currentTime}");
+				} else
+					@unlink($this->_cacheFile);
 				conf_mount_ro();
 			}
 			$this->status = $status;
@@ -853,32 +859,37 @@
 		 *      | work with other systems. pfSense base is FreeBSD.
 		 */
 		function _detectChange() {
-			
-			log_error("DynDns: _detectChange() starting.");
+			global $debug;
+
+			if ($debug)
+				log_error("DynDns: _detectChange() starting.");
 		
 			$currentTime = time();
 
 			$wan_ip = $this->_checkIP();
+			if ($wan_ip == 0) {
+				log_error("DynDns: Current WAN IP could not be determined, skipping update process.");
+				return false;
+			}
 			$this->_dnsIP = $wan_ip;
-			log_error("DynDns: Current WAN IP: {$wan_ip}");
+			$log_error = "DynDns: Current WAN IP: {$wan_ip} ";
 
 			if (file_exists($this->_cacheFile)) {
 				$contents = file_get_contents($this->_cacheFile);
 				list($cacheIP,$cacheTime) = split(':', $contents);
 				$this->_debug($cacheIP.'/'.$cacheTime);
 				$initial = false;
-				log_error("DynDns: Cached IP: {$cacheIP}");
+				$log_error .= "Cached IP: {$cacheIP} ";
 			} else {
 				conf_mount_rw();
-				$file = fopen($this->_cacheFile, 'w');
-				fwrite($file, '0.0.0.0:'.$currentTime);
-				fclose($file);
-				conf_mount_ro();
 				$cacheIP = '0.0.0.0';
+				@file_put_contents($this->_cacheFile, "0.0.0.0:{$currentTime}");
+				conf_mount_ro();
 				$cacheTime = $currentTime;
 				$initial = true;
-				log_error("DynDns: No Cached IP found.");
+				$log_error .= "No Cached IP found.";
 			}
+			log_error($log_error);
 
 			/*   use 2419200 for dyndns, dhs, easydns, noip, hn
 			 *   zoneedit, dyns, ods
@@ -928,10 +939,14 @@
 			conf_mount_ro();
 		}
 		function _checkIP() {
+			global $debug;
 
-			log_error("DynDns: _checkIP() starting.");
+			if ($debug)
+				log_error("DynDns: _checkIP() starting.");
 
 			$ip_address = find_interface_ip($this->_if);
+			if (!is_ipaddr($ip_address))
+				return 0;
 			$this->_ifIP = $ip_address;
 			if (is_private_ip($ip_address)) {
 				$hosttocheck = "checkip.dyndns.org";
@@ -944,20 +959,25 @@
 				}
 				if ($try >= 3) {
 					log_error("Dyndns debug information: Could not resolve {$hosttocheck} to ip using interface ip {$ip_address}.");
-					return $ip_address; /* XXX: Might return private ip address! */
+					return 0;
 				}
 				$ip_ch = curl_init("http://{$checkip}");
 				curl_setopt($ip_ch, CURLOPT_RETURNTRANSFER, 1);
 				curl_setopt($ip_ch, CURLOPT_SSL_VERIFYPEER, FALSE);
 				curl_setopt($ip_ch, CURLOPT_INTERFACE, $ip_address);
 				curl_setopt($ip_ch, CURLOPT_CONNECTTIMEOUT, '30');
-				curl_setopt($ip_ch, CURLOPT_TIMEOUT, 60);
+				curl_setopt($ip_ch, CURLOPT_TIMEOUT, 120);
 				$ip_result_page = curl_exec($ip_ch);
 				curl_close($ip_ch);
 				$ip_result_decoded = urldecode($ip_result_page);
 				preg_match('/Current IP Address: (.*)<\/body>/', $ip_result_decoded, $matches);
 				$ip_address = trim($matches[1]);
-				log_error("DynDns debug information: {$ip_address} extracted from {$hosttocheck}");
+				if (is_ipaddr($ip_address))
+					log_error("DynDns debug information: {$ip_address} extracted from {$hosttocheck}");
+				else {
+					log_error("DynDns debug information: IP address could not be extracted from {$hosttocheck}");
+					return 0;
+				}
 			} else
 				log_error("DynDns debug information: {$ip_address} extracted from local system.");
 
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index f5907c1..a949128 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -429,7 +429,7 @@ function filter_generate_scrubing() {
 	}
 	/* disable scrub option */
 	foreach ($FilterIflist as $scrubif => $scrubcfg) {
-		if(isset($scrubcfg['virtual']))
+		if(isset($scrubcfg['virtual']) || empty($scrubcfg['descr']))
 			continue;
 		/* set up MSS clamping */
 		if($scrubcfg['mss'] <> "" && is_numeric($scrubcfg['mss']) && $scrubcfg['if'] != "pppoe" && $scrubcfg['if'] != "pptp" &&
@@ -513,8 +513,15 @@ function filter_generate_aliases() {
 	$aliases = "loopback = \"{ lo0 }\"\n";
 
 	foreach ($FilterIflist as $if => $ifcfg) {
-		$aliases .= "{$ifcfg['descr']} = \"{ {$ifcfg['if']}";
-		$aliases .= " }\"\n";
+		if (is_array($ifcfg[0])) {
+			if ($ifcfg[0]['if'] == 'pppoe') {
+				$aliases .= "{$ifcfg[0]['descr']} = \"{ {$ifcfg[0]['if']}";
+				$aliases .= " }\"\n";
+			}
+		} elseif (!empty($ifcfg['descr']) && !empty($ifcfg['if'])) {
+			$aliases .= "{$ifcfg['descr']} = \"{ {$ifcfg['if']}";
+			$aliases .= " }\"\n";
+		}
 	}
 
 	$aliases .= "\n#SSH Lockout Table\n";
@@ -695,9 +702,15 @@ function filter_get_vpns_list() {
 		}
 	}
 	/* pppoe */
-	if($config['pppoe']['remoteip']) {
-		if(is_subnet($tunnel['remote-subnet'])) {
-			$vpns_arr[] = $config['pppoe']['remoteip'] ."/". $config['pppoe']['pppoe_subnet'];
+	if (is_array($config['pppoes']['pppoe'])) {
+		foreach($config['pppoes']['pppoe'] as $pppoe) {
+			if ($pppoe['mode'] == "server") {
+				if(is_ipaddr($pppoe['remoteip'])) {
+					$pppoesub = gen_subnet($pppoe['remoteip'], $pppoe['pppoe_subnet']);
+					if (is_subnet($pppoesub))
+						$vpns_arr[] = $pppoesub;
+				}
+			}
 		}
 	}
 	if(!empty($vpns_arr)) {
@@ -792,19 +805,26 @@ function filter_generate_optcfg_array() {
 		$oic['virtual'] = true;
 		$FilterIflist['l2tp'] = $oic;
 	}
-	if($config['pppoe']['mode'] == "server") {
-		$oic = array();
-		$oic['if'] = 'pppoe';
-		$oic['descr'] = 'pppoe';
-		$oic['ip'] = $config['pppoe']['localip'];
-		$oic['sa'] = $config['pppoe']['remoteip'];
-		$oic['mode'] = $config['pppoe']['mode'];
-		$oic['virtual'] = true;
-		if($config['pppoe']['pppoe_subnet'] <> "")
-			$oic['sn'] = $config['pppoe']['pppoe_subnet'];
-		else
-			$oic['sn'] = "32";
-		$FilterIflist['pppoe'] = $oic;
+	if (is_array($config['pppoes']['pppoe']) && (count($config['pppoes']['pppoe']) > 0)) {
+		$pppoeifs = array();
+		foreach($config['pppoes']['pppoe'] as $pppoe) {
+			if ($pppoe['mode'] == "server") {
+				$oic = array();
+				$oic['if'] = 'pppoe';
+				$oic['descr'] = 'pppoe';
+				$oic['ip'] = $pppoe['localip'];
+				$oic['sa'] = $pppoe['remoteip'];
+				$oic['mode'] = $pppoe['mode'];
+				$oic['virtual'] = true;
+				if($pppoe['pppoe_subnet'] <> "")
+					$oic['sn'] = $pppoe['pppoe_subnet'];
+				else
+					$oic['sn'] = "32";
+				$pppoeifs[] = $oic;
+			}
+		}
+		if (count($pppoeifs))
+			$FilterIflist['pppoe'] = $pppoeifs;
 	}
 	/* add ipsec interfaces */
 	if(isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) {
@@ -1025,7 +1045,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 			$target = $FilterIflist[$rule['target']]['ip'];
 		else
 			return "";
-
 		$starting_localhost_port_tmp = $starting_localhost_port;
 		$toomanyports = false;
 		/* only install reflection rules for < 19991 items */
@@ -1074,7 +1093,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 				$toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta));
 
 				if(!empty($toadd_array)) {
-					$target = explode(" ", trim($target));
+					$rtarget = explode(" ", trim($target));
 					foreach($toadd_array as $tda) {
 						if (empty($tda))
 							continue;
@@ -1086,7 +1105,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 								$socktype = "stream";
 								$dash_u = "";
 							}
-							foreach ($target as $targip) {
+							foreach ($rtarget as $targip) {
 								if (empty($targip))
 									continue;
 								$reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$targip} {$tda}\n";
@@ -1359,19 +1378,18 @@ function filter_nat_rules_generate() {
 			}
 		}
 		/* PPTP subnet */
-		if(isset($FilterIflist['pptp']) && $FilterIflist['pptp']['mode'] == "server" ) {
-			$pptp_subnet = $FilterIflist['pptp']['sn'];
-			if(is_private_ip($FilterIflist['pptp']['sa']) && !empty($pptp_subnet)) {
-				$numberofnathosts++;
-				$tonathosts .= "{$FilterIflist['pptp']['sa']}/{$pptp_subnet} ";
-			}
+		if(($config['pptpd']['mode'] == "server" ) && is_private_ip($config['pptpd']['remoteip'])) {
+			$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+$config['pptpd']['n_pptp_units']));
+			$numberofnathosts += count($pptp_subnets);
+			$tonathosts .= implode(" ", $pptp_subnets) . " ";
 		}
 		/* PPPoE subnet */
-		if(isset($FilterIflist['pppoe']) && $FilterIflist['pppoe']['mode'] == "server") {
-			$pppoe_subnet = $FilterIflist['pppoe']['sn'];
-			if(is_private_ip($FilterIflist['pppoe']['sa']) && !empty($pppoe_subnet)) {
-				$numberofnathosts++;
-				$tonathosts .= "{$FilterIflist['pppoe']['sa']}/{$pppoe_subnet} ";
+		if (is_array($FilterIflist['pppoe'])) {
+			foreach ($FilterIflist['pppoe'] as $pppoe) {
+				if(is_private_ip($pppoe['ip'])) {
+					$numberofnathosts++;
+					$tonathosts .= "{$pppoe['sa']}/{$pppoe['sn']} ";
+				}
 			}
 		}
 		/* L2TP subnet */
@@ -1410,6 +1428,8 @@ function filter_nat_rules_generate() {
 		}
 		if($numberofnathosts > 0):
 			foreach ($FilterIflist as $if => $ifcfg) {
+				if (substr($ifcfg['if'], 0, 4) == "ovpn")
+					continue;
 				update_filter_reload_status("Creating outbound rules {$if} - ({$ifcfg['descr']})");
 				if(interface_has_gateway($if)) {
 					$target = $ifcfg['ip'];
@@ -1686,22 +1706,23 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) {
 						$src = "{$lansa}/{$lansn}";
 						break;
 					case 'pptp':
-						$pptpsa = gen_subnetv6($FilterIflist['pptp']['sav6'], $FilterIflist['pptp']['snv6']);
-						$pptpsn = $FilterIflist['pptp']['snv6'];
+						$pptpsav6 = gen_subnetv6($FilterIflist['pptp']['sav6'], $FilterIflist['pptp']['snv6']);
+						$pptpsnv6 = $FilterIflist['pptp']['snv6'];
 						$src = "{$pptpsav6}/{$pptpsnv6}";
 						break;
 					case 'pppoe':
-						$pppoesa = gen_subnetv6($FilterIflist['pppoe']['ipv6'], $FilterIflist['pppoe']['snv6']);
-						$pppoesn = $FilterIflist['pppoe']['snv6'];
-						$src = "{$pppoesav6}/{$pppoesnv6}";
-						break;
+						if (is_array($FilterIflist['pppoe'])) {
+							$pppoesav6 = gen_subnetv6($FilterIflist['pppoe'][0]['ipv6'], $FilterIflist['pppoe'][0]['snv6']);
+							$pppoesnv6 = $FilterIflist['pppoe'][0]['snv6'];
+							$src = "{$pppoesav6}/{$pppoesnv6}";
+						}
 					}
 			} else {
 				switch ($rule[$target]['network']) {
 					case 'wan':
 						$wansa = $FilterIflist['wan']['sa'];
 						$wansn = $FilterIflist['wan']['sn'];
-						$src = "{$wansa}/{$wansn}";					
+						$src = "{$wansa}/{$wansn}";
 						break;
 					case 'wanip':
 						$src = $FilterIflist["wan"]['ip'];
@@ -1720,10 +1741,13 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) {
 						$src = "{$pptpsa}/{$pptpsn}";
 						break;
 					case 'pppoe':
-						$pppoesa = gen_subnet($FilterIflist['pppoe']['ip'], $FilterIflist['pppoe']['sn']);
-						$pppoesn = $FilterIflist['pppoe']['sn'];
+						/* XXX: This needs to be fixed somehow! */
+						if (is_array($FilterIflist['pppoe'])) {
+							$pppoesa = gen_subnet($FilterIflist['pppoe'][0]['ip'], $FilterIflist['pppoe'][0]['sn']);
+							$pppoesn = $FilterIflist['pppoe'][0]['sn'];
 							$src = "{$pppoesa}/{$pppoesn}";
-							break;
+						}
+						break;
 				}
 			}
 		}
@@ -1780,7 +1804,6 @@ function filter_generate_user_rule($rule) {
 	}
 	update_filter_reload_status("Creating filter rules {$rule['descr']} ...");
 	$pptpdcfg = $config['pptpd'];
-	$pppoecfg = $config['pppoe'];
 	$int = "";
 	$aline = array();
 
@@ -2116,7 +2139,6 @@ function filter_rules_generate() {
 	}
 
 	$pptpdcfg = $config['pptpd'];
-	$pppoecfg = $config['pppoe'];
 
 	$ipfrules = "";
 	//$ipfrules .= discover_pkg_rules("filter");
diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc
index 3bd0de2..735ea52 100644
--- a/etc/inc/globals.inc
+++ b/etc/inc/globals.inc
@@ -91,7 +91,7 @@ $g = array(
 	"disablecrashreporter" => false,
 	"crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php",
 	"debug" => false,
-	"latest_config" => "8.0",
+	"latest_config" => "8.1",
 	"nopkg_platforms" => array("cdrom"),
 	"minimum_ram_warning" => "101",
 	"minimum_ram_warning_text" => "128 MB",
diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index d50c89a..480d1b6 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -955,9 +955,9 @@ function interfaces_configure() {
 	return 0;
 }
 
-function interface_reconfigure($interface = "wan") {
+function interface_reconfigure($interface = "wan", $reloadall = false) {
 	interface_bring_down($interface);
-	interface_configure($interface, true);
+	interface_configure($interface, $reloadall);
 }
 
 function interface_vip_bring_down($vip) {
@@ -4018,4 +4018,4 @@ function get_vip_descr($ipaddress) {
 	return "";
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 572333a..ddbecbb 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -2264,4 +2264,47 @@ function load_mac_manufacturer_table() {
 		return -1;
 
 }
+<<<<<<< HEAD
 ?>
+=======
+
+/****f* pfsense-utils/is_ipaddr_configured
+ * NAME
+ *   is_ipaddr_configured
+ * INPUTS
+ *   IP Address to check.
+ * RESULT
+ *   returns true if the IP Address is
+ *   configured and present on this device.
+*/
+function is_ipaddr_configured($ipaddr) {
+	$interface_list_ips = get_configured_ip_addresses();
+	foreach($interface_list_ips as $ilips) {
+		if(strcasecmp($ipaddr, $ilips) == 0) 
+				return true;
+	}	
+}
+
+/****f* pfsense-utils/pfSense_handle_custom_code
+ * NAME
+ *   pfSense_handle_custom_code
+ * INPUTS
+ *   directory name to process
+ * RESULT
+ *   globs the directory and includes the files
+ */
+function pfSense_handle_custom_code($src_dir) {
+	// Allow extending of the nat edit page and include custom input validation 
+	if(is_dir("$src_dir")) {
+		$cf = glob($src_dir . "/*.inc");
+		foreach($cf as $nf) {
+			if($nf == "." || $nf == "..") 
+				continue;
+			// Include the extra handler
+			include("$nf");
+		}
+	}
+}
+
+?>
+>>>>>>> upstream/master
diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc
index 72ea7b9..0475169 100644
--- a/etc/inc/rrd.inc
+++ b/etc/inc/rrd.inc
@@ -402,7 +402,7 @@ function enable_rrd_graphing() {
 				$rrdupdatesh .= " sleep 0.2\n";
 				$rrdupdatesh .= " echo \"quit\"\n";
 				$rrdupdatesh .= "}\n";
-				$rrdupdatesh .= "OVPN=`list_current_users | nc -U {$g['varetc_path']}/openvpn/server{$vpnid}.sock | awk -F\",\" '/^CLIENT_LIST/ {print \$2}' | wc -l | awk '{print $1}'` &\n";
+				$rrdupdatesh .= "OVPN=`list_current_users | nc -U {$g['varetc_path']}/openvpn/server{$vpnid}.sock | awk -F\",\" '/^CLIENT_LIST/ {print \$2}' | wc -l | awk '{print $1}'`\n";
 				$rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$vpnusers N:\${OVPN}\n";
 			}
 
diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index d18bfea..382e8dd 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -397,7 +397,7 @@ EOPP;
 			$dhcpdconf .= "		deny dynamic bootp clients;\n";
 
 		if (isset($dhcpifconf['denyunknown']))
-		   $dhcpdconf .= "		deny unknown clients;\n";
+		   $dhcpdconf .= "		deny unknown-clients;\n";
 
 		if ($dhcpifconf['gateway'])
 			$routers = $dhcpifconf['gateway'];
@@ -1067,8 +1067,6 @@ function services_dyndns_configure_client($conf) {
 	/* load up the dyndns.class */
 	require_once("dyndns.class");
 
-	log_error("DynDns: Running updatedns()");
-
 	$dns = new updatedns($dnsService = $conf['type'],
 		$dnsHost = $conf['host'],
 		$dnsUser = $conf['username'],
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index d88218f..a2f0598 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -116,9 +116,12 @@ function system_resolvconf_generate($dynupdate = false) {
 		}
 	}
 
+	$dnslock = lock('resolvconf', LOCK_EX);
+
 	$fd = fopen("{$g['varetc_path']}/resolv.conf", "w");
 	if (!$fd) {
 		printf("Error: cannot open resolv.conf in system_resolvconf_generate().\n");
+		unlock($dnslock);
 		return 1;
 	}
 
@@ -148,7 +151,9 @@ function system_resolvconf_generate($dynupdate = false) {
 			}
 		}
 	}
-	
+
+	unlock($dnslock);
+
 	return 0;
 }
 
@@ -1346,6 +1351,7 @@ function system_reboot_cleanup() {
 	captiveportal_radius_stop_all();
 	require_once("voucher.inc");
 	voucher_save_db_to_config();
+	mwexec("/etc/rc.stop_packages");
 }
 
 function system_do_shell_commands($early = 0) {
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index 1646292..ccd5629 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -2490,8 +2490,13 @@ function upgrade_077_to_078() {
 		$config['pptpd']['radius'] = $radarr;
 	}
 }
-
 function upgrade_078_to_079() {
+	global $g;
+	/* Delete old and unused RRD file */
+	unlink_if_exists("{$g['vardb_path']}/rrd/captiveportal-totalusers.rrd");
+}
+
+function upgrade_079_to_080() {
 	global $config;
 	global $g;
 
@@ -2577,7 +2582,7 @@ function upgrade_078_to_079() {
 	}
 }
 
-function upgrade_079_to_080() {
+function upgrade_080_to_081() {
 	global $config;
 	/* enable the allow IPv6 toggle */
 	$config['system']['ipv6allow'] = true;
diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc
index ec59716..e6a44c4 100644
--- a/etc/inc/voucher.inc
+++ b/etc/inc/voucher.inc
@@ -37,6 +37,53 @@
 if(!function_exists('captiveportal_syslog'))
 	require_once("captiveportal.inc");
 
+function xmlrpc_sync_voucher_expire($vouchers, $syncip, $port, $password, $username) {
+	global $g, $config;
+	require_once("xmlrpc.inc");
+	if($port == "443") 
+		$url = "https://{$syncip}";
+	else 
+		$url = "http://{$syncip}";
+
+	/* Construct code that is run on remote machine */
+	$method = 'pfsense.exec_php';
+	$execcmd  = <<<EOF
+	require_once('/etc/inc/captiveportal.inc');
+	require_once('/etc/inc/voucher.inc');
+	voucher_expire(\$vouchers);
+
+EOF;
+
+	/* assemble xmlrpc payload */
+	$params = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($execcmd)
+	);
+
+	log_error("Captive Portal Voucher XMLRPC sync data {$url}:{$port}.");
+	$msg = new XML_RPC_Message($method, $params);
+	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+	$cli->setCredentials($username, $password);
+	$resp = $cli->send($msg, "250");
+	if(!is_object($resp)) {
+		$error = "A communications error occurred while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
+		log_error($error);
+		file_notice("CaptivePortalVoucherSync", $error, "Communications error occurred", "");
+		return false;
+	} elseif($resp->faultCode()) {
+		$error = "An error code was received while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("CaptivePortalVoucherSync", $error, "Error code received", "");
+		return false;
+	} else {
+		log_error("CaptivePortalVoucherSync XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php).");
+	}
+
+	$toreturn =  XML_RPC_Decode($resp->value());
+
+	return $toreturn;
+}
+
 function xmlrpc_sync_voucher_disconnect($dbent, $syncip, $port, $password, $username, $term_cause = "1", $stop_time = null) {
 	global $g, $config;
 	require_once("xmlrpc.inc");
@@ -138,6 +185,93 @@ EOF;
 	return $toreturn['timeleft'];
 }
 
+function voucher_expire($voucher_received) {
+	global $g, $config;
+
+	$voucherlck = lock('voucher', LOCK_EX);
+
+	// XMLRPC Call over to the master Voucher node
+	if(!empty($config['voucher']['vouchersyncdbip'])) {
+		$syncip   = $config['voucher']['vouchersyncdbip'];
+		$syncport = $config['voucher']['vouchersyncport'];
+		$syncpass = $config['voucher']['vouchersyncpass'];
+		$vouchersyncusername = $config['voucher']['vouchersyncusername'];
+		xmlrpc_sync_voucher_expire($voucher_received, $syncip, $syncport, $syncpass, $vouchersyncusername);
+	}
+
+	// read rolls into assoc array with rollid as key and minutes as value
+	$tickets_per_roll = array();
+	$minutes_per_roll = array();
+	if (is_array($config['voucher']['roll'])) {
+		foreach ($config['voucher']['roll'] as $rollent) {
+			$tickets_per_roll[$rollent['number']] = $rollent['count'];
+			$minutes_per_roll[$rollent['number']] = $rollent['minutes'];
+		}
+	}
+
+	// split into an array. Useful for multiple vouchers given
+	$a_vouchers_received = split("[\t\n\r ]+",$voucher_received); 
+	$active_dirty = false;
+
+	// go through all received vouchers, check their valid and extract
+	// Roll# and Ticket# using the external readvoucher binary
+	foreach ($a_vouchers_received as $voucher) {
+		$v = escapeshellarg($voucher);
+		if (strlen($voucher) < 3)
+			continue;   // seems too short to be a voucher!
+
+		$result = exec("/usr/local/bin/voucher -c {$g['varetc_path']}/voucher.cfg -k {$g['varetc_path']}/voucher.public -- $v");
+		list($status, $roll, $nr) = explode(" ", $result);
+		if ($status == "OK") {
+			// check if we have this ticket on a registered roll for this ticket 
+			if ($tickets_per_roll[$roll] && ($nr <= $tickets_per_roll[$roll])) {
+				// voucher is from a registered roll. 
+				if (!isset($active_vouchers[$roll]))
+					$active_vouchers[$roll] = voucher_read_active_db($roll);
+				// valid voucher. Store roll# and ticket#
+				if (!empty($active_vouchers[$roll][$voucher])) {
+					$active_dirty = true;
+					unset($active_vouchers[$roll][$voucher]);
+				}
+				// check if voucher already marked as used
+				if (!isset($bitstring[$roll]))
+					$bitstring[$roll] = voucher_read_used_db($roll);
+				$pos = $nr >> 3; // divide by 8 -> octet
+				$mask = 1 << ($nr % 8);
+				// mark bit for this voucher as used
+				if (!(ord($bitstring[$roll][$pos]) & $mask))
+					$bitstring[$roll][$pos] = chr(ord($bitstring[$roll][$pos]) | $mask);
+				captiveportal_syslog("{$voucher} ({$roll}/{$nr}) forced to expire");
+			} else
+				captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll");
+		} else
+			// hmm, thats weird ... not what I expected
+			captiveportal_syslog("$voucher invalid: $result !!");
+	}
+
+	// Refresh active DBs
+	if ($active_dirty == true) {
+		foreach ($active_vouchers as $roll => $active)
+			voucher_write_active_db($roll, $active);
+	}
+
+	// Write back the used DB's
+	if (is_array($bitstring)) {
+		foreach ($bitstring as $roll => $used) {
+			if(is_array($used)) {
+				foreach($used as $u)
+					voucher_write_used_db($roll, base64_encode($u));
+			} else {
+				voucher_write_used_db($roll, base64_encode($used));
+			}
+		}
+	}
+
+	unlock($voucherlck);
+
+	return true;
+}
+
 /* 
  * Authenticate a voucher and return the remaining time credit in minutes
  * if $test is set, don't mark the voucher as used nor add it to the list
@@ -146,17 +280,16 @@ EOF;
  * but return a more verbose error and result message back
  */
 function voucher_auth($voucher_received, $test = 0) {
-    global $g, $config;
+	global $g, $config;
 
-    $voucherlck = lock('voucher', LOCK_EX);
+	$voucherlck = lock('voucher', LOCK_EX);
 
 	// XMLRPC Call over to the master Voucher node
-	$a_voucher = &$config['voucher'];
-	if(!empty($a_voucher['vouchersyncdbip'])) {
-		$syncip   = $a_voucher['vouchersyncdbip'];
-		$syncport = $a_voucher['vouchersyncport'];
-		$syncpass = $a_voucher['vouchersyncpass'];
-		$vouchersyncusername = $a_voucher['vouchersyncusername'];
+	if(!empty($config['voucher']['vouchersyncdbip'])) {
+		$syncip   = $config['voucher']['vouchersyncdbip'];
+		$syncport = $config['voucher']['vouchersyncport'];
+		$syncpass = $config['voucher']['vouchersyncpass'];
+		$vouchersyncusername = $config['voucher']['vouchersyncusername'];
 		$remote_time_used = xmlrpc_sync_used_voucher($voucher_received, $syncip, $syncport, $syncpass, $vouchersyncusername);
 	}
 
@@ -164,112 +297,108 @@ function voucher_auth($voucher_received, $test = 0) {
 	$tickets_per_roll = array();
 	$minutes_per_roll = array();
 	if (is_array($config['voucher']['roll'])) {
-		$a_roll = &$config['voucher']['roll'];
-		foreach ($a_roll as $rollent) {
+		foreach ($config['voucher']['roll'] as $rollent) {
 			$tickets_per_roll[$rollent['number']] = $rollent['count'];
 			$minutes_per_roll[$rollent['number']] = $rollent['minutes'];
 		}
 	}
 
-    // split into an array. Useful for multiple vouchers given
-    $a_vouchers_received = split("[\t\n\r ]+",$voucher_received); 
-    $error = 0;
-    $test_result = array();     // used to display for voucher test option in GUI
-    $total_minutes = 0;
-    $first_voucher = "";
-    $first_voucher_roll = 0;
-
-    // go through all received vouchers, check their valid and extract
-    // Roll# and Ticket# using the external readvoucher binary
-
-    foreach ($a_vouchers_received as $voucher) {
-
-        $v = escapeshellarg($voucher);
-        if (strlen($voucher) < 3)
-            continue;   // seems too short to be a voucher!
-
-        $result = exec("/usr/local/bin/voucher -c {$g['varetc_path']}/voucher.cfg -k {$g['varetc_path']}/voucher.public -- $v");
-        list($status, $roll, $nr) = explode(" ", $result);
-        if ($status == "OK") {
-            if (!$first_voucher) {
+	// split into an array. Useful for multiple vouchers given
+	$a_vouchers_received = split("[\t\n\r ]+",$voucher_received); 
+	$error = 0;
+	$test_result = array();     // used to display for voucher test option in GUI
+	$total_minutes = 0;
+	$first_voucher = "";
+	$first_voucher_roll = 0;
+
+	// go through all received vouchers, check their valid and extract
+	// Roll# and Ticket# using the external readvoucher binary
+	foreach ($a_vouchers_received as $voucher) {
+		$v = escapeshellarg($voucher);
+		if (strlen($voucher) < 3)
+			continue;   // seems too short to be a voucher!
+
+		$result = exec("/usr/local/bin/voucher -c {$g['varetc_path']}/voucher.cfg -k {$g['varetc_path']}/voucher.public -- $v");
+		list($status, $roll, $nr) = explode(" ", $result);
+		if ($status == "OK") {
+			if (!$first_voucher) {
 				// store first voucher. Thats the one we give the timecredit
-                $first_voucher = $voucher;
-                $first_voucher_roll = $roll;
-            }
-            // check if we have this ticket on a registered roll for this ticket 
-            if ($tickets_per_roll[$roll] && ($nr <= $tickets_per_roll[$roll])) {
-                // voucher is from a registered roll. 
-                if (!isset($active_vouchers[$roll]))
-                    $active_vouchers[$roll] = voucher_read_active_db($roll);
-                // valid voucher. Store roll# and ticket#
-                if (!empty($active_vouchers[$roll][$voucher])) {
-                    list($timestamp,$minutes) = explode(",", $active_vouchers[$roll][$voucher]);
-                    // we have an already active voucher here.
-                    $remaining = intval((($timestamp + (60*$minutes)) - time())/60);
-                    $test_result[] = "$voucher ($roll/$nr) active and good for $remaining Minutes";
-                    $total_minutes += $remaining;
-                } else {
-                    // voucher not used. Check if ticket Id is on the roll (not too high)
-                    // and if the ticket is marked used.
-                    // check if voucher already marked as used
-                    if (!isset($bitstring[$roll]))
-                        $bitstring[$roll] = voucher_read_used_db($roll);
-                    $pos = $nr >> 3; // divide by 8 -> octet
-                    $mask = 1 << ($nr % 8);
-                    if (ord($bitstring[$roll][$pos]) & $mask) {
-                        $test_result[] = "$voucher ($roll/$nr) already used and expired";
+				$first_voucher = $voucher;
+				$first_voucher_roll = $roll;
+			}
+			// check if we have this ticket on a registered roll for this ticket 
+			if ($tickets_per_roll[$roll] && ($nr <= $tickets_per_roll[$roll])) {
+				// voucher is from a registered roll. 
+				if (!isset($active_vouchers[$roll]))
+					$active_vouchers[$roll] = voucher_read_active_db($roll);
+				// valid voucher. Store roll# and ticket#
+				if (!empty($active_vouchers[$roll][$voucher])) {
+					list($timestamp,$minutes) = explode(",", $active_vouchers[$roll][$voucher]);
+					// we have an already active voucher here.
+					$remaining = intval((($timestamp + (60*$minutes)) - time())/60);
+					$test_result[] = "$voucher ($roll/$nr) active and good for $remaining Minutes";
+					$total_minutes += $remaining;
+				} else {
+					// voucher not used. Check if ticket Id is on the roll (not too high)
+					// and if the ticket is marked used.
+					// check if voucher already marked as used
+					if (!isset($bitstring[$roll]))
+						$bitstring[$roll] = voucher_read_used_db($roll);
+					$pos = $nr >> 3; // divide by 8 -> octet
+					$mask = 1 << ($nr % 8);
+					if (ord($bitstring[$roll][$pos]) & $mask) {
+						$test_result[] = "$voucher ($roll/$nr) already used and expired";
 						captiveportal_syslog("$voucher ($roll/$nr) already used and expired");
-                        $total_minutes = -1;    // voucher expired
-                        $error++;
-                    } else {
-                        // mark bit for this voucher as used
-                        $bitstring[$roll][$pos] = chr(ord($bitstring[$roll][$pos]) | $mask);
-                        $test_result[] = "$voucher ($roll/$nr) good for {$minutes_per_roll[$roll]} Minutes";
-                        $total_minutes += $minutes_per_roll[$roll];
-                    }
-                }
-            } else {
-                $test_result[] = "$voucher ($roll/$nr): not found on any registererd Roll";
-		captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll");
-            }
-        } else {
-            // hmm, thats weird ... not what I expected
-            $test_result[] = "$voucher invalid: $result !!";
-	    captiveportal_syslog("$voucher invalid: $result !!");
-            $error++;
-        }
-    }
+						$total_minutes = -1;    // voucher expired
+						$error++;
+					} else {
+						// mark bit for this voucher as used
+						$bitstring[$roll][$pos] = chr(ord($bitstring[$roll][$pos]) | $mask);
+						$test_result[] = "$voucher ($roll/$nr) good for {$minutes_per_roll[$roll]} Minutes";
+						$total_minutes += $minutes_per_roll[$roll];
+					}
+				}
+			} else {
+				$test_result[] = "$voucher ($roll/$nr): not found on any registererd Roll";
+				captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll");
+			}
+		} else {
+			// hmm, thats weird ... not what I expected
+			$test_result[] = "$voucher invalid: $result !!";
+			captiveportal_syslog("$voucher invalid: $result !!");
+			$error++;
+		}
+	}
 
-    // if this was a test call, we're done. Return the result.
-    if ($test) {
-        if ($error) {
-            $test_result[] = "Access denied!";
-        } else {
-            $test_result[] = "Access granted for $total_minutes Minutes in total.";
-        }
-	unlock($voucherlck);
-        return $test_result;
-    }
+	// if this was a test call, we're done. Return the result.
+	if ($test) {
+		if ($error) {
+			$test_result[] = "Access denied!";
+		} else {
+			$test_result[] = "Access granted for $total_minutes Minutes in total.";
+		}
+		unlock($voucherlck);
 
-    // if we had an error (one of the vouchers is invalid), return 0.
-    // Discussion: we could return the time remaining for good vouchers, but then
-    // the user wouldn't know that he used at least one invalid voucher.
+		return $test_result;
+	}
 
-    if ($error) {
+	// if we had an error (one of the vouchers is invalid), return 0.
+	// Discussion: we could return the time remaining for good vouchers, but then
+	// the user wouldn't know that he used at least one invalid voucher.
+	if ($error) {
 		unlock($voucherlck);
-        if ($total_minutes > 0)     // probably not needed, but want to make sure
-            $total_minutes = 0;     // we only report -1 (expired) or 0 (no access)
-        return $total_minutes;       // well, at least one voucher had errors. Say NO ACCESS
-    }
+		if ($total_minutes > 0)     // probably not needed, but want to make sure
+			$total_minutes = 0;     // we only report -1 (expired) or 0 (no access)
+		return $total_minutes;       // well, at least one voucher had errors. Say NO ACCESS
+	}
 
 	// If we did a XMLRPC sync earlier check the timeleft
-	if(!empty($a_voucher['vouchersyncdbip'])) 
+	if (!empty($config['voucher']['vouchersyncdbip'])) 
 		if($remote_time_used < $total_minutes) 
 			$total_minutes = $remote_time_used;
 
-    // All given vouchers were valid and this isn't simply a test.
-    // Write back the used DB's
-
+	// All given vouchers were valid and this isn't simply a test.
+	// Write back the used DB's
 	if (is_array($bitstring)) {
 		foreach ($bitstring as $roll => $used) {
 			if(is_array($used)) {
@@ -281,24 +410,23 @@ function voucher_auth($voucher_received, $test = 0) {
 		}
 	}
 
-    // Active DB: we only add the first voucher if multiple given
-    // and give that one all the time credit. This allows the user to logout and
-    // log in later using just the first voucher. It also keeps username limited
-    // to one voucher and that voucher shows the correct time credit in 'active vouchers'
-
-    if (!empty($active_vouchers[$first_voucher_roll][$first_voucher])) {
-        list($timestamp, $minutes) = explode(",", $active_vouchers[$first_voucher_roll][$first_voucher]);
-    } else {
-        $timestamp = time();    // new voucher
-        $minutes = $total_minutes;
-    }
+	// Active DB: we only add the first voucher if multiple given
+	// and give that one all the time credit. This allows the user to logout and
+	// log in later using just the first voucher. It also keeps username limited
+	// to one voucher and that voucher shows the correct time credit in 'active vouchers'
+	if (!empty($active_vouchers[$first_voucher_roll][$first_voucher])) {
+		list($timestamp, $minutes) = explode(",", $active_vouchers[$first_voucher_roll][$first_voucher]);
+	} else {
+		$timestamp = time();    // new voucher
+		$minutes = $total_minutes;
+	}
 
-    $active_vouchers[$first_voucher_roll][$first_voucher] = "$timestamp,$minutes";
-    voucher_write_active_db($roll, $active_vouchers[$first_voucher_roll]);
+	$active_vouchers[$first_voucher_roll][$first_voucher] = "$timestamp,$minutes";
+	voucher_write_active_db($roll, $active_vouchers[$first_voucher_roll]);
 
-    unlock($voucherlck);
+	unlock($voucherlck);
 
-    return $total_minutes;
+	return $total_minutes;
 }
 
 function voucher_configure($sync = false) {
@@ -352,11 +480,10 @@ function voucher_configure($sync = false) {
 
         if (($g['booting'] || $sync == true) && is_array($config['voucher']['roll'])) {
 
-            // create active and used DB per roll on ramdisk from config
-            $a_roll = &$config['voucher']['roll'];
 		$voucherlck = lock('voucher', LOCK_EX);
 
-            foreach ($a_roll as $rollent) {
+            // create active and used DB per roll on ramdisk from config
+            foreach ($config['voucher']['roll'] as $rollent) {
 
                 $roll = $rollent['number'];
                 voucher_write_used_db($roll, $rollent['used']);
@@ -432,6 +559,8 @@ function voucher_read_active_db($roll) {
 function voucher_write_active_db($roll, $active) {
     global $g;
 
+	if (!is_array($active))
+		return;
     $fd = fopen("{$g['vardb_path']}/voucher_active_$roll.db", "w");
     if ($fd) {
         foreach($active as $voucher => $value)
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 80e3a85..819d396 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -894,8 +894,7 @@ EOD;
 								/* FIXME: does adding route-to and reply-to on the in/outbound
 								 * rules fix this? smos@ 13-01-2009 */
 								// log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
-								mwexec("/sbin/route delete -host {$rgip}");
-								mwexec("/sbin/route add -host {$rgip} {$gatewayip}");
+								mwexec("/sbin/route delete -host {$rgip}; /sbin/route add -host {$rgip} {$gatewayip}", true);
 							}
 						}
 					}