Merge remote branch 'mainline/master'

58 files changed, 2677 insertions, 1001 deletions

diff --git a/etc/bogons b/etc/bogons
index 8156c1a..19aa054 100644
--- a/etc/bogons
+++ b/etc/bogons
@@ -1,28 +1,17 @@
 0.0.0.0/8
-5.0.0.0/8
-14.0.0.0/8
-23.0.0.0/8
-31.0.0.0/8
-36.0.0.0/8
-37.0.0.0/8
 39.0.0.0/8
-42.0.0.0/8
-49.0.0.0/8
-100.0.0.0/8
-101.0.0.0/8
 102.0.0.0/8
 103.0.0.0/8
 104.0.0.0/8
-105.0.0.0/8
 106.0.0.0/8
 127.0.0.0/8
 169.254.0.0/16
-176.0.0.0/8
-177.0.0.0/8
 179.0.0.0/8
-181.0.0.0/8
 185.0.0.0/8
+192.0.0.0/24
 192.0.2.0/24
 198.18.0.0/15
-223.0.0.0/8
-224.0.0.0/3
\ No newline at end of file
+198.51.100.0/24
+203.0.113.0/24
+224.0.0.0/4
+240.0.0.0/4
\ No newline at end of file
diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 60912f7..805ea44 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -130,6 +130,10 @@ if(function_exists("display_error_form") && !isset($config['system']['webgui']['
 						break;
 					}
 				}
+				if($referrer_host == "127.0.0.1" || $referrer_host == "localhost") {
+					// allow SSH port forwarded connections and links from localhost
+					$found_host = true;
+				}
 			}
 		}
 		if($found_host == false) {
@@ -406,7 +410,7 @@ function local_user_set(& $user) {
 	/* create user directory if required */
 	if (!is_dir($user_home)) {
 		mkdir($user_home, 0700);
-		mwexec("cp /root/.* {$home_base}/");
+		mwexec("/bin/cp /root/.* {$home_base}/", true);
 	}
 	chown($user_home, $user_name);
 	chgrp($user_home, $user_group);
@@ -1309,4 +1313,4 @@ function session_auth() {
 	return true;
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/basic_sasl_client.inc b/etc/inc/basic_sasl_client.inc
new file mode 100644
index 0000000..b2972b5
--- /dev/null
+++ b/etc/inc/basic_sasl_client.inc
@@ -0,0 +1,61 @@
+<?php
+/*
+ * basic_sasl_client.php
+ *
+ * @(#) $Id: basic_sasl_client.php,v 1.1 2004/11/17 08:01:23 mlemos Exp $
+ *
+ */
+
+define("SASL_BASIC_STATE_START",    0);
+define("SASL_BASIC_STATE_DONE",     1);
+
+class basic_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_BASIC_STATE_START;
+
+	Function Initialize(&$client)
+	{
+		return(1);
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_BASIC_STATE_START)
+		{
+			$client->error="Basic authentication state is not at the start";
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			"user"=>"",
+			"password"=>""
+		);
+		$defaults=array(
+		);
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+		{
+			$message=$this->credentials["user"].":".$this->credentials["password"];
+			$this->state=SASL_BASIC_STATE_DONE;
+		}
+		else
+			Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+			case SASL_BASIC_STATE_DONE:
+				$client->error="Basic authentication was finished without success";
+				return(SASL_FAIL);
+			default:
+				$client->error="invalid Basic authentication step state";
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index e36a626..3d4b61a 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -2,12 +2,11 @@
 /*
 	captiveportal.inc
 	part of pfSense (http://www.pfSense.org)
-
-	originally part of m0n0wall (http://m0n0.ch/wall)
-
-	Copyright (C) 2010 Scott Ullrich <sullrich@gmail.com>
+	Copyright (C) 2004-2011 Scott Ullrich <sullrich@gmail.com>
 	Copyright (C) 2009 Ermal Luçi <ermal.luci@gmail.com>
 	Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+
+	originally part of m0n0wall (http://m0n0.ch/wall)
 	All rights reserved.
 
 	Redistribution and use in source and binary forms, with or without
@@ -38,9 +37,9 @@
 	These changes are (c) 2004 Keycom PLC.
 	
 	pfSense_BUILDER_BINARIES:	/sbin/ipfw	/sbin/sysctl	/sbin/kldunload
-	pfSense_BUILDER_BINARIES:	/usr/local/sbin/lighttpd	/usr/local/bin/minicron	/sbin/pfctl
-	pfSense_BUILDER_BINARIES:	/bin/hostname	/bin/cp	
-	pfSense_MODULE:	captiveportal
+	pfSense_BUILDER_BINARIES:	/usr/local/sbin/lighttpd	/usr/local/bin/minicron /sbin/pfctl
+	pfSense_BUILDER_BINARIES:	/bin/hostname	/bin/cp 
+	pfSense_MODULE: captiveportal
 */
 
 /* include all configuration functions */
@@ -74,8 +73,8 @@ function get_default_captive_portal_html() {
 							<div id="mainlevel">
 								<center>
 									<table width="100%" border="0" cellpadding="5" cellspacing="0">
-								 		<tr>
-								    		<td>
+										<tr>
+											<td>
 												<center>
 													<div id="mainarea">
 														<center>
@@ -100,7 +99,7 @@ function get_default_captive_portal_html() {
 																				</div>
 																			</center>
 																		</div>
-										     						</td>
+																	</td>
 																</tr>
 															</table>
 														</center>
@@ -145,14 +144,14 @@ EOD;
 							<div id="mainlevel">
 								<center>
 									<table width="100%" border="0" cellpadding="5" cellspacing="0">
-								 		<tr>
-								    		<td>
+										<tr>
+											<td>
 												<center>
 													<div id="mainarea">
 														<center>
 															<table width="100%" border="0" cellpadding="5" cellspacing="5">
 																<tr>
-										     						<td>
+																	<td>
 																		<div id="maindivarea">
 																			<center>
 																				<div id='statusbox'>
@@ -171,15 +170,15 @@ EOD;
 																					   <tr><td align="right">Password:</td><td><input name="auth_pass" type="password" style="border: 1px dashed;"></td></tr>
 																					   <tr><td>&nbsp;</td></tr>
 																					   <tr>
-																					     <td colspan="2">
+																						 <td colspan="2">
 																							<center><input name="accept" type="submit" value="Continue"></center>
-																					     </td>
+																						 </td>
 																					   </tr>
 																					</table>
 																				</div>
 																			</center>
 																		</div>
-										     						</td>
+																	</td>
 																</tr>
 															</table>
 														</center>
@@ -206,7 +205,7 @@ EOD;
 function captiveportal_configure() {
 	global $config, $g;
 
-	$captiveportallck = lock('captiveportal');
+	$captiveportallck = lock('captiveportal', LOCK_EX);
 	
 	if (isset($config['captiveportal']['enable'])) {
 
@@ -233,13 +232,14 @@ function captiveportal_configure() {
 		captiveportal_init_rules(true);
 
 		/* stop accounting on all clients */
-		captiveportal_radius_stop_all(true);
+		captiveportal_radius_stop_all();
 
 		/* initialize minicron interval value */
 		$croninterval = $config['captiveportal']['croninterval'] ? $config['captiveportal']['croninterval'] : 60;
 
 		/* double check if the $croninterval is numeric and at least 10 seconds. If not we set it to 60 to avoid problems */
-		if ((!is_numeric($croninterval)) || ($croninterval < 10)) { $croninterval = 60; }
+		if ((!is_numeric($croninterval)) || ($croninterval < 10))
+			$croninterval = 60;
 
 		/* write portal page */
 		if ($config['captiveportal']['page']['htmltext'])
@@ -259,6 +259,10 @@ function captiveportal_configure() {
 			$htmltext = str_replace("\$CLIENT_IP\$", "#CLIENT_IP#", $htmltext);
 			$htmltext = str_replace("\$ORIGINAL_PORTAL_IP\$", "#ORIGINAL_PORTAL_IP#", $htmltext);
 			$htmltext = str_replace("\$PORTAL_ACTION\$", "#PORTAL_ACTION#", $htmltext);
+			if($config['captiveportal']['preauthurl']) {
+				$htmltext = str_replace("\$PORTAL_REDIRURL\$", "{$config['captiveportal']['preauthurl']}", $htmltext);
+				$htmltext = str_replace("#PORTAL_REDIRURL#", "{$config['captiveportal']['preauthurl']}", $htmltext);
+			}
 			fwrite($fd, $htmltext);
 			fclose($fd);
 		}
@@ -289,14 +293,14 @@ function captiveportal_configure() {
 							<div id="mainlevel">
 								<center>
 									<table width="100%" border="0" cellpadding="5" cellspacing="0">
-								 		<tr>
-								    		<td>
+										<tr>
+											<td>
 												<center>
 													<div id="mainarea">
 														<center>
 															<table width="100%" border="0" cellpadding="5" cellspacing="5">
 																<tr>
-										     						<td>
+																	<td>
 																		<div id="maindivarea">
 																			<center>
 																				<div id='statusbox'>
@@ -315,15 +319,15 @@ function captiveportal_configure() {
 																					   <tr><td align="right">Password:</td><td><input name="auth_pass" type="password" style="border: 1px dashed;"></td></tr>
 																					   <tr><td>&nbsp;</td></tr>
 																					   <tr>
-																					     <td colspan="2">
+																						 <td colspan="2">
 																							<center><input name="accept" type="submit" value="Continue"></center>
-																					     </td>
+																						 </td>
 																					   </tr>
 																					</table>
 																				</div>
 																			</center>
 																		</div>
-										     						</td>
+																	</td>
 																</tr>
 															</table>
 														</center>
@@ -355,6 +359,10 @@ EOD;
 			$errtext = str_replace("\$CLIENT_IP\$", "#CLIENT_IP#", $errtext);
 			$errtext = str_replace("\$ORIGINAL_PORTAL_IP\$", "#ORIGINAL_PORTAL_IP#", $errtext);
 			$errtext = str_replace("\$PORTAL_ACTION\$", "#PORTAL_ACTION#", $errtext);
+			if($config['captiveportal']['preauthurl']) {
+				$errtext = str_replace("\$PORTAL_REDIRURL\$", "{$config['captiveportal']['preauthurl']}", $errtext);
+				$errtext = str_replace("#PORTAL_REDIRURL#", "{$config['captiveportal']['preauthurl']}", $errtext);
+			}
 			fwrite($fd, $errtext);
 			fclose($fd);
 		}
@@ -375,18 +383,18 @@ EOD;
 <!--
 LogoutWin = window.open('', 'Logout', 'toolbar=0,scrollbars=0,location=0,statusbar=0,menubar=0,resizable=0,width=256,height=64');
 if (LogoutWin) {
-    LogoutWin.document.write('<HTML>');
-    LogoutWin.document.write('<HEAD><TITLE>Logout</TITLE></HEAD>') ;
-    LogoutWin.document.write('<BODY BGCOLOR="#435370">');
-    LogoutWin.document.write('<DIV ALIGN="center" STYLE="color: #ffffff; font-family: Tahoma, Verdana, Arial, Helvetica, sans-serif; font-size: 11px;">') ;
-    LogoutWin.document.write('<B>Click the button below to disconnect</B><P>');
-    LogoutWin.document.write('<FORM METHOD="POST" ACTION="<?=\$logouturl;?>">');
-    LogoutWin.document.write('<INPUT NAME="logout_id" TYPE="hidden" VALUE="<?=\$sessionid;?>">');
-    LogoutWin.document.write('<INPUT NAME="logout" TYPE="submit" VALUE="Logout">');
-    LogoutWin.document.write('</FORM>');
-    LogoutWin.document.write('</DIV></BODY>');
-    LogoutWin.document.write('</HTML>');
-    LogoutWin.document.close();
+	LogoutWin.document.write('<HTML>');
+	LogoutWin.document.write('<HEAD><TITLE>Logout</TITLE></HEAD>') ;
+	LogoutWin.document.write('<BODY BGCOLOR="#435370">');
+	LogoutWin.document.write('<DIV ALIGN="center" STYLE="color: #ffffff; font-family: Tahoma, Verdana, Arial, Helvetica, sans-serif; font-size: 11px;">') ;
+	LogoutWin.document.write('<B>Click the button below to disconnect</B><P>');
+	LogoutWin.document.write('<FORM METHOD="POST" ACTION="<?=\$logouturl;?>">');
+	LogoutWin.document.write('<INPUT NAME="logout_id" TYPE="hidden" VALUE="<?=\$sessionid;?>">');
+	LogoutWin.document.write('<INPUT NAME="logout" TYPE="submit" VALUE="Logout">');
+	LogoutWin.document.write('</FORM>');
+	LogoutWin.document.write('</DIV></BODY>');
+	LogoutWin.document.write('</HTML>');
+	LogoutWin.document.close();
 }
 
 document.location.href="<?=\$my_redirurl;?>";
@@ -414,41 +422,7 @@ EOD;
 			"/etc/rc.prunecaptiveportal");
 
 		/* generate radius server database */
-		if ($config['captiveportal']['radiusip'] && (!isset($config['captiveportal']['auth_method']) ||
-				($config['captiveportal']['auth_method'] == "radius"))) {
-			$radiusip = $config['captiveportal']['radiusip'];
-			$radiusip2 = ($config['captiveportal']['radiusip2']) ? $config['captiveportal']['radiusip2'] : null;
-
-			if ($config['captiveportal']['radiusport'])
-				$radiusport = $config['captiveportal']['radiusport'];
-			else
-				$radiusport = 1812;
-
-			if ($config['captiveportal']['radiusacctport'])
-				$radiusacctport = $config['captiveportal']['radiusacctport'];
-			else
-				$radiusacctport = 1813;
-
-			if ($config['captiveportal']['radiusport2'])
-				$radiusport2 = $config['captiveportal']['radiusport2'];
-			else
-				$radiusport2 = 1812;
-
-			$radiuskey = $config['captiveportal']['radiuskey'];
-			$radiuskey2 = ($config['captiveportal']['radiuskey2']) ? $config['captiveportal']['radiuskey2'] : null;
-
-			$fd = @fopen("{$g['vardb_path']}/captiveportal_radius.db", "w");
-			if (!$fd) {
-				printf("Error: cannot open radius DB file in captiveportal_configure().\n");
-				return 1;
-			} else if (isset($radiusip2, $radiuskey2)) {
-				fwrite($fd,$radiusip . "," . $radiusport . "," . $radiusacctport . "," . $radiuskey . "\n"
-					 . $radiusip2 . "," . $radiusport2 . "," . $radiusacctport . "," . $radiuskey2);
-			} else {
-				fwrite($fd,$radiusip . "," . $radiusport . "," . $radiusacctport . "," . $radiuskey);
-			}
-			fclose($fd);
-		}
+		captiveportal_init_radius_servers();
 
 		if ($g['booting'])
 			echo "done\n";
@@ -457,7 +431,7 @@ EOD;
 		killbypid("{$g['varrun_path']}/lighty-CaptivePortal.pid");
 		killbypid("{$g['varrun_path']}/minicron.pid");
 
-		captiveportal_radius_stop_all(true);
+		captiveportal_radius_stop_all();
 
 		mwexec("/sbin/sysctl net.link.ether.ipfw=0");
 
@@ -470,7 +444,7 @@ EOD;
 				if (does_interface_exist($listrealif)) {
 					pfSense_interface_flags($listrealif, -IFF_IPFW_FILTER);
 					$carpif = link_ip_to_carp_interface(find_interface_ip($listrealif));
-                        		if (!empty($carpif)) {
+					if (!empty($carpif)) {
 						$carpsif = explode(" ", $carpif);
 						foreach ($carpsif as $cpcarp)
 							pfSense_interface_flags($cpcarp, -IFF_IPFW_FILTER);
@@ -489,7 +463,7 @@ function captiveportal_init_webgui() {
 	global $g, $config;
 
 	 if (!isset($config['captiveportal']['enable']))
-                return;
+				return;
 
 	if ($config['captiveportal']['maxproc'])
 		$maxproc = $config['captiveportal']['maxproc'];
@@ -567,7 +541,7 @@ function captiveportal_init_rules($reinit = false) {
 	if (count($cpips) > 0) {
 		$cpactive = true;
 		$cpinterface = "{ {$cpinterface} } ";
-        } else
+		} else
 		return false;
 
 	if ($reinit == false)
@@ -583,7 +557,7 @@ function captiveportal_init_rules($reinit = false) {
 	if (!is_module_loaded("dummynet.ko"))
 		mwexec("/sbin/kldload dummynet");
 
-	$cprules =  "add 65291 set 1 allow pfsync from any to any\n";
+	$cprules =	"add 65291 set 1 allow pfsync from any to any\n";
 	$cprules .= "add 65292 set 1 allow carp from any to any\n";
 
 	$cprules .= <<<EOD
@@ -652,12 +626,12 @@ EOD;
 		$rulenum++;
 	} else {
 		$cprules .= "add {$rulenum} set 1 allow ip from table(1) to any in\n";
-                $rulenum++;
-                $cprules .= "add {$rulenum} set 1 allow ip from any to table(2) out\n";
-                $rulenum++;
+		$rulenum++;
+		$cprules .= "add {$rulenum} set 1 allow ip from any to table(2) out\n";
+		$rulenum++;
 	}
 	
-       $cprules .= <<<EOD
+	   $cprules .= <<<EOD
 
 # redirect non-authenticated clients to captive portal
 add 65531 set 1 fwd 127.0.0.1,8000 tcp from any to any in
@@ -673,9 +647,13 @@ EOD;
 	/* generate passthru mac database */
 	$cprules .= captiveportal_passthrumac_configure(true);
 	$cprules .= "\n";
+
 	/* allowed ipfw rules to make allowed ip work */
 	$cprules .= captiveportal_allowedip_configure();
 
+	/* allowed ipfw rules to make allowed hostnames work */
+	$cprules .= captiveportal_allowedhostname_configure();
+	
 	/* load rules */
 	if ($reinit == true)
 		$cprules = "table all flush\nflush\n{$cprules}";
@@ -694,179 +672,173 @@ EOD;
 
 	file_put_contents("{$g['tmp_path']}/ipfw.cp.rules", $cprules);
 	mwexec("/sbin/ipfw -q {$g['tmp_path']}/ipfw.cp.rules", true);
-	@unlink("{$g['tmp_path']}/ipfw.cp.rules");
+	//@unlink("{$g['tmp_path']}/ipfw.cp.rules");
 
 	if ($reinit == false)
 		unlock($captiveportallck);
 
-
 	/* filter on layer2 as well so we can check MAC addresses */
 	mwexec("/sbin/sysctl net.link.ether.ipfw=1");
 
 	return $cprules;
 }
 
-/* remove clients that have been around for longer than the specified amount of time */
-/* db file structure:
-timestamp,ipfw_rule_no,clientip,clientmac,username,sessionid,password,session_timeout,idle_timeout,session_terminate_time */
-
-/* (password is in Base64 and only saved when reauthentication is enabled) */
+/* remove clients that have been around for longer than the specified amount of time
+ * db file structure:
+ * timestamp,ipfw_rule_no,clientip,clientmac,username,sessionid,password,session_timeout,idle_timeout,session_terminate_time
+ * (password is in Base64 and only saved when reauthentication is enabled)
+ */
 function captiveportal_prune_old() {
+	global $g, $config;
+
+	/* check for expired entries */
+	if (empty($config['captiveportal']['timeout']) ||
+	!is_numeric($config['captiveportal']['timeout']))
+		$timeout = 0;
+	else
+		$timeout = $config['captiveportal']['timeout'] * 60;
+
+	if (empty($config['captiveportal']['idletimeout']) ||
+	!is_numeric($config['captiveportal']['idletimeout']))
+		$idletimeout = 0;
+	else
+		$idletimeout = $config['captiveportal']['idletimeout'] * 60;
+
+	if (!$timeout && !$idletimeout && !isset($config['captiveportal']['reauthenticate']) && 
+	!isset($config['captiveportal']['radiussession_timeout']) && !isset($config['voucher']['enable']))
+		return;
+
+	/* read database */
+	$cpdb = captiveportal_read_db();
 
-    global $g, $config;
-
-    /* check for expired entries */
-    if ($config['captiveportal']['timeout'])
-        $timeout = $config['captiveportal']['timeout'] * 60;
-    else
-        $timeout = 0;
-
-    if ($config['captiveportal']['idletimeout'])
-        $idletimeout = $config['captiveportal']['idletimeout'] * 60;
-    else
-        $idletimeout = 0;
-
-    if (!$timeout && !$idletimeout && !isset($config['captiveportal']['reauthenticate']) && 
-		!isset($config['captiveportal']['radiussession_timeout']) && !isset($config['voucher']['enable']))
-        return;
-
-    $captiveportallck = lock('captiveportal');
-
-    /* read database */
-    $cpdb = captiveportal_read_db();
-
-    $radiusservers = captiveportal_get_radius_servers();
-
-    /*  To make sure we iterate over ALL accounts on every run the count($cpdb) is moved
-     *  outside of the loop. Otherwise the loop would evaluate count() on every iteration
-     *  and since $i would increase and count() would decrement they would meet before we
-     *  had a chance to iterate over all accounts.
-     */
-    $unsetindexes = array();
-    $no_users = count($cpdb);
-    for ($i = 0; $i < $no_users; $i++) {
-
-        $timedout = false;
-        $term_cause = 1;
-
-        /* hard timeout? */
-        if ($timeout) {
-            if ((time() - $cpdb[$i][0]) >= $timeout) {
-                $timedout = true;
-                $term_cause = 5; // Session-Timeout
-            }
-        }
-
-        /* Session-Terminate-Time */
-        if (!$timedout && !empty($cpdb[$i][9])) {
-            if (time() >= $cpdb[$i][9]) {
-                $timedout = true;
-                $term_cause = 5; // Session-Timeout
-            }
-        }
-
-        /* check if the radius idle_timeout attribute has been set and if its set change the idletimeout to this value */
-        $idletimeout = (is_numeric($cpdb[$i][8])) ? $cpdb[$i][8] : $idletimeout;
-        /* if an idle timeout is specified, get last activity timestamp from ipfw */
-        if (!$timedout && $idletimeout) {
-            $lastact = captiveportal_get_last_activity($cpdb[$i][2]);
-			/*  If the user has logged on but not sent any traffic they will never be logged out.
-			 *  We "fix" this by setting lastact to the login timestamp. 
+	$radiusservers = captiveportal_get_radius_servers();
+
+	/*	To make sure we iterate over ALL accounts on every run the count($cpdb) is moved
+	 *	outside of the loop. Otherwise the loop would evaluate count() on every iteration
+	 *	and since $i would increase and count() would decrement they would meet before we
+	 *	had a chance to iterate over all accounts.
+	 */
+	$unsetindexes = array();
+	$no_users = count($cpdb);
+	for ($i = 0; $i < $no_users; $i++) {
+
+		$timedout = false;
+		$term_cause = 1;
+
+		/* hard timeout? */
+		if ($timeout) {
+			if ((time() - $cpdb[$i][0]) >= $timeout) {
+				$timedout = true;
+				$term_cause = 5; // Session-Timeout
+			}
+		}
+
+		/* Session-Terminate-Time */
+		if (!$timedout && !empty($cpdb[$i][9])) {
+			if (time() >= $cpdb[$i][9]) {
+				$timedout = true;
+				$term_cause = 5; // Session-Timeout
+			}
+		}
+
+		/* check if the radius idle_timeout attribute has been set and if its set change the idletimeout to this value */
+		$uidletimeout = (is_numeric($cpdb[$i][8])) ? $cpdb[$i][8] : $idletimeout;
+		/* if an idle timeout is specified, get last activity timestamp from ipfw */
+		if (!$timedout && $uidletimeout) {
+			$lastact = captiveportal_get_last_activity($cpdb[$i][2]);
+			/*	If the user has logged on but not sent any traffic they will never be logged out.
+			 *	We "fix" this by setting lastact to the login timestamp. 
 			 */
 			$lastact = $lastact ? $lastact : $cpdb[$i][0];
-            if ($lastact && ((time() - $lastact) >= $idletimeout)) {
-                $timedout = true;
-                $term_cause = 4; // Idle-Timeout
-                $stop_time = $lastact; // Entry added to comply with WISPr
-            }
-        }
-
-	/* if vouchers are configured, activate session timeouts */
-	if (!$timedout && isset($config['voucher']['enable']) && !empty($cpdb[$i][7])) {
-		if (time() >= ($cpdb[$i][0] + $cpdb[$i][7])) {
-			$timedout = true;
-			$term_cause = 5; // Session-Timeout
+			if ($lastact && ((time() - $lastact) >= $uidletimeout)) {
+				$timedout = true;
+				$term_cause = 4; // Idle-Timeout
+				$stop_time = $lastact; // Entry added to comply with WISPr
+			}
 		}
-	}
 
-        /* if radius session_timeout is enabled and the session_timeout is not null, then check if the user should be logged out */
-        if (!$timedout && isset($config['captiveportal']['radiussession_timeout']) && !empty($cpdb[$i][7])) {
-            if (time() >= ($cpdb[$i][0] + $cpdb[$i][7])) {
-                $timedout = true;
-                $term_cause = 5; // Session-Timeout
-            }
-        }
-
-        if ($timedout) {
-            captiveportal_disconnect($cpdb[$i], $radiusservers,$term_cause,$stop_time);
-            captiveportal_logportalauth($cpdb[$i][4], $cpdb[$i][3], $cpdb[$i][2], "TIMEOUT");
-	    $unsetindexes[$i] = $i;
-        }
-
-        /* do periodic RADIUS reauthentication? */
-        if (!$timedout && isset($config['captiveportal']['reauthenticate']) &&
-            !empty($radiusservers)) {
-
-            if (isset($config['captiveportal']['radacct_enable'])) {
-                if ($config['captiveportal']['reauthenticateacct'] == "stopstart") {
-                    /* stop and restart accounting */
-                    RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno
-                                           $cpdb[$i][4], // username
-                                           $cpdb[$i][5], // sessionid
-                                           $cpdb[$i][0], // start time
-                                           $radiusservers,
-                                           $cpdb[$i][2], // clientip
-                                           $cpdb[$i][3], // clientmac
-                                           10); // NAS Request
-                    exec("/sbin/ipfw table 1 entryzerostats {$cpdb[$i][2]}");
-                    exec("/sbin/ipfw table 2 entryzerostats {$cpdb[$i][2]}");
-                    RADIUS_ACCOUNTING_START($cpdb[$i][1], // ruleno
-                                            $cpdb[$i][4], // username
-                                            $cpdb[$i][5], // sessionid
-                                            $radiusservers,
-                                            $cpdb[$i][2], // clientip
-                                            $cpdb[$i][3]); // clientmac
-                } else if ($config['captiveportal']['reauthenticateacct'] == "interimupdate") {
-                    RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno
-                                           $cpdb[$i][4], // username
-                                           $cpdb[$i][5], // sessionid
-                                           $cpdb[$i][0], // start time
-                                           $radiusservers,
-                                           $cpdb[$i][2], // clientip
-                                           $cpdb[$i][3], // clientmac
-                                           10, // NAS Request
-                                           true); // Interim Updates
-                }
-            }
-
-            /* check this user against RADIUS again */
-            $auth_list = RADIUS_AUTHENTICATION($cpdb[$i][4], // username
-                                          base64_decode($cpdb[$i][6]), // password
-                                            $radiusservers,
-                                          $cpdb[$i][2], // clientip
-                                          $cpdb[$i][3], // clientmac
-                                          $cpdb[$i][1]); // ruleno
-
-            if ($auth_list['auth_val'] == 3) {
-                captiveportal_disconnect($cpdb[$i], $radiusservers, 17);
-                captiveportal_logportalauth($cpdb[$i][4], $cpdb[$i][3], $cpdb[$i][2], "RADIUS_DISCONNECT", $auth_list['reply_message']);
-	        $unsetindexes[$i] = $i;
-            }
-        }
-    }
-    /* This is a kludge to overcome some php weirdness */
-    foreach($unsetindexes as $unsetindex)
-	unset($cpdb[$unsetindex]);
+		/* if vouchers are configured, activate session timeouts */
+		if (!$timedout && isset($config['voucher']['enable']) && !empty($cpdb[$i][7])) {
+			if (time() >= ($cpdb[$i][0] + $cpdb[$i][7])) {
+				$timedout = true;
+				$term_cause = 5; // Session-Timeout
+			}
+		}
+
+		/* if radius session_timeout is enabled and the session_timeout is not null, then check if the user should be logged out */
+		if (!$timedout && isset($config['captiveportal']['radiussession_timeout']) && !empty($cpdb[$i][7])) {
+			if (time() >= ($cpdb[$i][0] + $cpdb[$i][7])) {
+				$timedout = true;
+				$term_cause = 5; // Session-Timeout
+			}
+		}
+
+		if ($timedout) {
+			captiveportal_disconnect($cpdb[$i], $radiusservers,$term_cause,$stop_time);
+			captiveportal_logportalauth($cpdb[$i][4], $cpdb[$i][3], $cpdb[$i][2], "TIMEOUT");
+			$unsetindexes[$i] = $i;
+		}
+
+		/* do periodic RADIUS reauthentication? */
+		if (!$timedout && !empty($radiusservers)) {
+			if (isset($config['captiveportal']['radacct_enable'])) {
+				if ($config['captiveportal']['reauthenticateacct'] == "stopstart") {
+					/* stop and restart accounting */
+					RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno
+						$cpdb[$i][4], // username
+						$cpdb[$i][5], // sessionid
+						$cpdb[$i][0], // start time
+						$radiusservers,
+						$cpdb[$i][2], // clientip
+						$cpdb[$i][3], // clientmac
+						10); // NAS Request
+					exec("/sbin/ipfw table 1 entryzerostats {$cpdb[$i][2]}");
+					exec("/sbin/ipfw table 2 entryzerostats {$cpdb[$i][2]}");
+					RADIUS_ACCOUNTING_START($cpdb[$i][1], // ruleno
+						$cpdb[$i][4], // username
+						$cpdb[$i][5], // sessionid
+						$radiusservers,
+						$cpdb[$i][2], // clientip
+						$cpdb[$i][3]); // clientmac
+				} else if ($config['captiveportal']['reauthenticateacct'] == "interimupdate") {
+					RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno
+						$cpdb[$i][4], // username
+						$cpdb[$i][5], // sessionid
+						$cpdb[$i][0], // start time
+						$radiusservers,
+						$cpdb[$i][2], // clientip
+						$cpdb[$i][3], // clientmac
+						10, // NAS Request
+						true); // Interim Updates
+				}
+			}
 
-    /* write database */
-    captiveportal_write_db($cpdb);
+			/* check this user against RADIUS again */
+			if (isset($config['captiveportal']['reauthenticate'])) {
+				$auth_list = RADIUS_AUTHENTICATION($cpdb[$i][4], // username
+					base64_decode($cpdb[$i][6]), // password
+					$radiusservers,
+					$cpdb[$i][2], // clientip
+					$cpdb[$i][3], // clientmac
+					$cpdb[$i][1]); // ruleno
+				if ($auth_list['auth_val'] == 3) {
+					captiveportal_disconnect($cpdb[$i], $radiusservers, 17);
+					captiveportal_logportalauth($cpdb[$i][4], $cpdb[$i][3], $cpdb[$i][2], "RADIUS_DISCONNECT", $auth_list['reply_message']);
+					$unsetindexes[$i] = $i;
+				}
+			}
+		}
+	}
+	/* This is a kludge to overcome some php weirdness */
+	foreach($unsetindexes as $unsetindex)
+	unset($cpdb[$unsetindex]);
 
-    unlock($captiveportallck);
+	/* write database */
+	captiveportal_write_db($cpdb);
 }
 
 /* remove a single client according to the DB entry */
 function captiveportal_disconnect($dbent, $radiusservers,$term_cause = 1,$stop_time = null) {
-
 	global $g, $config;
 
 	$stop_time = (empty($stop_time)) ? time() : $stop_time;
@@ -874,15 +846,15 @@ function captiveportal_disconnect($dbent, $radiusservers,$term_cause = 1,$stop_t
 	/* this client needs to be deleted - remove ipfw rules */
 	if (isset($config['captiveportal']['radacct_enable']) && !empty($radiusservers)) {
 		RADIUS_ACCOUNTING_STOP($dbent[1], // ruleno
-							   $dbent[4], // username
-							   $dbent[5], // sessionid
-							   $dbent[0], // start time
-							   $radiusservers,
-							   $dbent[2], // clientip
-							   $dbent[3], // clientmac
-							   $term_cause, // Acct-Terminate-Cause
-							   false,
-							   $stop_time);
+			$dbent[4], // username
+			$dbent[5], // sessionid
+			$dbent[0], // start time
+			$radiusservers,
+			$dbent[2], // clientip
+			$dbent[3], // clientmac
+			$term_cause, // Acct-Terminate-Cause
+			false,
+			$stop_time);
 	}
 	/* Delete client's ip entry from tables 3 and 4. */
 	mwexec("/sbin/ipfw table 1 delete {$dbent[2]}");
@@ -908,22 +880,17 @@ function captiveportal_disconnect($dbent, $radiusservers,$term_cause = 1,$stop_t
 
 /* remove a single client by ipfw rule number */
 function captiveportal_disconnect_client($id,$term_cause = 1) {
-
 	global $g, $config;
 
-	$captiveportallck = lock('captiveportal');
-
 	/* read database */
 	$cpdb = captiveportal_read_db();
 	$radiusservers = captiveportal_get_radius_servers();
 
 	/* find entry */
-	$tmpindex = 0;
-	$cpdbcount = count($cpdb);
-	for ($i = 0; $i < $cpdbcount; $i++) {
-		if ($cpdb[$i][1] == $id) {
-			captiveportal_disconnect($cpdb[$i], $radiusservers, $term_cause);
-			captiveportal_logportalauth($cpdb[$i][4], $cpdb[$i][3], $cpdb[$i][2], "DISCONNECT");
+	foreach ($cpdb as $i => $cpentry) {
+		if ($cpentry[1] == $id) {
+			captiveportal_disconnect($cpentry, $radiusservers, $term_cause);
+			captiveportal_logportalauth($cpentry[4], $cpentry[3], $cpentry[2], "DISCONNECT");
 			unset($cpdb[$i]);
 			break;
 		}
@@ -931,61 +898,53 @@ function captiveportal_disconnect_client($id,$term_cause = 1) {
 
 	/* write database */
 	captiveportal_write_db($cpdb);
-
-	unlock($captiveportallck);
 }
 
 /* send RADIUS acct stop for all current clients */
-function captiveportal_radius_stop_all($lock = false) {
-	global $g, $config;
+function captiveportal_radius_stop_all() {
+	global $config;
 
 	if (!isset($config['captiveportal']['radacct_enable']))
 		return;
 
-	if (!$lock)
-		$captiveportallck = lock('captiveportal');
-
-	$cpdb = captiveportal_read_db();
-
 	$radiusservers = captiveportal_get_radius_servers();
 	if (!empty($radiusservers)) {
-		for ($i = 0; $i < count($cpdb); $i++) {
-			RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno
-								   $cpdb[$i][4], // username
-								   $cpdb[$i][5], // sessionid
-								   $cpdb[$i][0], // start time
-								   $radiusservers,
-								   $cpdb[$i][2], // clientip
-								   $cpdb[$i][3], // clientmac
-								   7); // Admin Reboot
+		$cpdb = captiveportal_read_db();
+		foreach ($cpdb as $cpentry) {
+			RADIUS_ACCOUNTING_STOP($cpentry[1], // ruleno
+				$cpentry[4], // username
+				$cpentry[5], // sessionid
+				$cpentry[0], // start time
+				$radiusservers,
+				$cpentry[2], // clientip
+				$cpentry[3], // clientmac
+				7); // Admin Reboot
 		}
 	}
-	if (!$lock)
-		unlock($captiveportallck);
 }
 
 function captiveportal_passthrumac_configure_entry($macent) {
 	$rules = "";
-        $enBwup = isset($macent['bw_up']);
-        $enBwdown = isset($macent['bw_down']);
+	$enBwup = isset($macent['bw_up']);
+	$enBwdown = isset($macent['bw_down']);
 	$actionup = "allow";
 	$actiondown = "allow";
 
-        if ($enBwup && $enBwdown)
-                $ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, true);
-        else
-                $ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, false);
+	if ($enBwup && $enBwdown)
+		$ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, true);
+	else
+		$ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, false);
 
 	if ($enBwup) {
-                $bw_up = $ruleno + 20000;
-                $rules .= "pipe {$bw_up} config bw {$macent['bw_up']}Kbit/s queue 100\n";
+		$bw_up = $ruleno + 20000;
+		$rules .= "pipe {$bw_up} config bw {$macent['bw_up']}Kbit/s queue 100\n";
 		$actionup = "pipe {$bw_up}";
-        }
-        if ($enBwdown) {
+	}
+	if ($enBwdown) {
 		$bw_down = $ruleno + 20001;
 		$rules .= "pipe {$bw_down} config bw {$macent['bw_down']}Kbit/s queue 100\n";
 		$actiondown = "pipe {$bw_down}";
-        }
+	}
 	$rules .= "add {$ruleno} {$actiondown} ip from any to any MAC {$macent['mac']} any\n";
 	$ruleno++;
 	$rules .= "add {$ruleno} {$actionup} ip from any to any MAC any {$macent['mac']}\n";
@@ -1028,80 +987,126 @@ function captiveportal_passthrumac_findbyname($username) {
  */
 function captiveportal_allowedip_configure_entry($ipent) {
 
+	/* This function can deal with hostname or ipaddress */
+	if($ipent['ip']) 	
+		$ipaddress = $ipent['ip'];
+
+	/*  Instead of copying this entire function for something
+	 *  easy such as hostname vs ip address add this check
+	 */
+	if($ipent['hostname']) {
+		$ipaddress = gethostbyname($ipent['hostname']);
+		if(!is_ipaddr($ipaddress)) 
+			return;
+	}
+
 	$rules = "";
-	$enBwup = isset($ipent['bw_up']);
-	$enBwdown = isset($ipent['bw_down']);
+	$enBwup = intval($ipent['bw_up']);
+	$enBwdown = intval($ipent['bw_down']);
 	$bw_up = "";
-        $bw_down = "";
-        $tablein = array();
-        $tableout = array();
+	$bw_down = "";
+	$tablein = array();
+	$tableout = array();
 
-	if ($enBwup && $enBwdown)
+	if (intval($enBwup) > 0 or intval($enBwdown) > 0)
 		$ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, true);
 	else
 		$ruleno = captiveportal_get_next_ipfw_ruleno(2000, 49899, false);
 
-        if ($ipent['dir'] == "from") {
-        	if ($enBwup)
-                	$tablein[] = 5;
-                else
-                	$tablein[] = 3;
-                if ($enBwdown)
-                        $tableout[] = 6;
-                else
-                        $tableout[] = 4;
-        } else if ($ipent['dir'] == "to") {
-                if ($enBwup)
-                	$tablein[] = 9;
-                else
-                        $tablein[] = 7;
-                if ($enBwdown)
-                        $tableout[] = 10;
-                else
-                        $tableout[] = 8;
-        } else if ($ipent['dir'] == "both") {
-                if ($enBwup) {
-                        $tablein[] = 5;
-                        $tablein[] = 9;
-                } else {
-                        $tablein[] = 3;
-                        $tablein[] = 7;
-                }
-        	if ($enBwdown) {
-                        $tableout[] = 6;
-                        $tableout[] = 10;
-                } else {
-                        $tableout[] = 4;
-                	$tableout[] = 8;
-                }
-        }
-        if ($enBwup) {
-                $bw_up = $ruleno + 20000;
-        	$rules .= "pipe {$bw_up} config bw {$ipent['bw_up']}Kbit/s queue 100\n";
-        }
+	if ($ipent['dir'] == "from") {
+		if ($enBwup)
+			$tablein[] = 5;
+		else
+			$tablein[] = 3;
+		if ($enBwdown)
+			$tableout[] = 6;
+		else
+			$tableout[] = 4;
+	} else if ($ipent['dir'] == "to") {
+		if ($enBwup)
+			$tablein[] = 9;
+		else
+			$tablein[] = 7;
+		if ($enBwdown)
+			$tableout[] = 10;
+		else
+			$tableout[] = 8;
+	} else if ($ipent['dir'] == "both") {
+		if ($enBwup) {
+			$tablein[] = 5;
+			$tablein[] = 9;
+		} else {
+			$tablein[] = 3;
+			$tablein[] = 7;
+		}
+		if ($enBwdown) {
+			$tableout[] = 6;
+			$tableout[] = 10;
+		} else {
+			$tableout[] = 4;
+			$tableout[] = 8;
+		}
+	}
+	if ($enBwup) {
+		$bw_up = $ruleno + 20000;
+		$rules .= "pipe {$bw_up} config bw {$ipent['bw_up']}Kbit/s queue 100\n";
+	}
 	$subnet = "";
 	if (!empty($ipent['sn']))
 		$subnet = "/{$ipent['sn']}";
 	foreach ($tablein as $table)
-               $rules .= "table {$table} add {$ipent['ip']}{$subnet} {$bw_up}\n";
-        if ($enBwdown) {
-               $bw_down = $ruleno + 20001;
-               $rules .= "pipe {$bw_down} config bw {$ipent['bw_down']}Kbit/s queue 100\n";
-        }
-        foreach ($tableout as $table)
-        	$rules .= "table {$table} add {$ipent['ip']}{$subnet} {$bw_down}\n";
+		$rules .= "table {$table} add {$ipaddress}{$subnet} {$bw_up}\n";
+	if ($enBwdown) {
+		$bw_down = $ruleno + 20001;
+		$rules .= "pipe {$bw_down} config bw {$ipent['bw_down']}Kbit/s queue 100\n";
+	}
+	foreach ($tableout as $table)
+		$rules .= "table {$table} add {$ipaddress}{$subnet} {$bw_down}\n";
 
 	return $rules;
 }
 
+/* 
+	Adds a dnsfilter entry and watches for hostname changes.
+	A change results in reloading the ruleset.
+*/
+function setup_dnsfilter_entries() {
+	global $g, $config;
+
+	$cp_filterdns_filename = "{$g['varetc_path']}/filterdns-captiveportal.conf";
+	$cp_filterdns_conf = "";
+	if (is_array($config['captiveportal']['allowedhostname'])) {
+		foreach ($config['captiveportal']['allowedhostname'] as $hostnameent)  {
+			$cp_filterdns_conf .= "ipfw $hostnameent 3 '/etc/rc.captiveportal_configure'\n";
+			$cp_filterdns_conf .= "ipfw $hostnameent 4 '/etc/rc.captiveportal_configure'\n";
+			$cp_filterdns_conf .= "ipfw $hostnameent 7 '/etc/rc.captiveportal_configure'\n";
+			$cp_filterdns_conf .= "ipfw $hostnameent 8 '/etc/rc.captiveportal_configure'\n";
+		}
+	}
+	file_put_contents($cp_filterdns_filename, $cp_filterdns_conf);
+	killbypid("{$g['tmp_path']}/filterdns-cpah.pid");
+	mwexec("/usr/local/sbin/filterdns -p {$g['tmp_path']}/filterdns-cpah.pid -i 300 -c {$cp_filterdns_filename} -d 1");
+}
+
+function captiveportal_allowedhostname_configure() {
+	global $config, $g;
+
+	$rules = "\n# captiveportal_allowedhostname_configure()\n";
+	setup_dnsfilter_entries();
+	if (is_array($config['captiveportal']['allowedhostname'])) {
+		foreach ($config['captiveportal']['allowedhostname'] as $hostnameent) 
+			$rules .= captiveportal_allowedip_configure_entry($hostnameent);
+	}
+	return $rules;
+}
+
 function captiveportal_allowedip_configure() {
 	global $config, $g;
 
 	$rules = "";
 	if (is_array($config['captiveportal']['allowedip'])) {
-		foreach ($config['captiveportal']['allowedip'] as $ipent) {
+		foreach ($config['captiveportal']['allowedip'] as $ipent) 
 			$rules .= captiveportal_allowedip_configure_entry($ipent);
-		}
 	}
 
 	return $rules;
@@ -1123,42 +1128,84 @@ function captiveportal_get_last_activity($ip) {
 	return 0;
 }
 
+function captiveportal_init_radius_servers() {
+	global $config, $g;
+
+	/* generate radius server database */
+	if ($config['captiveportal']['radiusip'] && (!isset($config['captiveportal']['auth_method']) ||
+		($config['captiveportal']['auth_method'] == "radius"))) {
+		$radiusip = $config['captiveportal']['radiusip'];
+		$radiusip2 = ($config['captiveportal']['radiusip2']) ? $config['captiveportal']['radiusip2'] : null;
+
+		if ($config['captiveportal']['radiusport'])
+			$radiusport = $config['captiveportal']['radiusport'];
+		else
+			$radiusport = 1812;
+		if ($config['captiveportal']['radiusacctport'])
+			$radiusacctport = $config['captiveportal']['radiusacctport'];
+		else
+			$radiusacctport = 1813;
+		if ($config['captiveportal']['radiusport2'])
+			$radiusport2 = $config['captiveportal']['radiusport2'];
+		else
+			$radiusport2 = 1812;
+		$radiuskey = $config['captiveportal']['radiuskey'];
+		$radiuskey2 = ($config['captiveportal']['radiuskey2']) ? $config['captiveportal']['radiuskey2'] : null;
+
+		$cprdsrvlck = lock('captiveportalradius', LOCK_EX);
+		$fd = @fopen("{$g['vardb_path']}/captiveportal_radius.db", "w");
+		if (!$fd) {
+			captiveportal_syslog("Error: cannot open radius DB file in captiveportal_configure().\n");
+			unlock($cprdsrvlck);
+			return 1;
+		} else if (isset($radiusip2, $radiuskey2))
+			fwrite($fd,$radiusip . "," . $radiusport . "," . $radiusacctport . "," . $radiuskey . "\n"
+			. $radiusip2 . "," . $radiusport2 . "," . $radiusacctport . "," . $radiuskey2);
+		else
+			fwrite($fd,$radiusip . "," . $radiusport . "," . $radiusacctport . "," . $radiuskey);
+		fclose($fd);
+		unlock($cprdsrvlck);
+	}
+}
+
 /* read RADIUS servers into array */
 function captiveportal_get_radius_servers() {
+		global $g;
 
-        global $g;
-
-        if (file_exists("{$g['vardb_path']}/captiveportal_radius.db")) {
-                $radiusservers = array();
-		$cpradiusdb = file("{$g['vardb_path']}/captiveportal_radius.db", 
+		$cprdsrvlck = lock('captiveportalradius');
+		if (file_exists("{$g['vardb_path']}/captiveportal_radius.db")) {
+			$radiusservers = array();
+			$cpradiusdb = file("{$g['vardb_path']}/captiveportal_radius.db", 
 			FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
-		if ($cpradiusdb)
-		foreach($cpradiusdb as $cpradiusentry) {
-                	$line = trim($cpradiusentry);
-                        if ($line) {
-                        	$radsrv = array();
-                                list($radsrv['ipaddr'],$radsrv['port'],$radsrv['acctport'],$radsrv['key']) = explode(",",$line);
-                        	$radiusservers[] = $radsrv;
-                        }
+			if ($cpradiusdb) {
+				foreach($cpradiusdb as $cpradiusentry) {
+					$line = trim($cpradiusentry);
+					if ($line) {
+						$radsrv = array();
+						list($radsrv['ipaddr'],$radsrv['port'],$radsrv['acctport'],$radsrv['key']) = explode(",",$line);
+						$radiusservers[] = $radsrv;
+					}
+				}
+			}
+			unlock($cprdsrvlck);
+			return $radiusservers;
 		}
 
-		return $radiusservers;
-        }
-
-        return false;
+		unlock($cprdsrvlck);
+		return false;
 }
 
 /* log successful captive portal authentication to syslog */
 /* part of this code from php.net */
 function captiveportal_logportalauth($user,$mac,$ip,$status, $message = null) {
-	$message = trim($message);
 	// Log it
 	if (!$message)
 		$message = "$status: $user, $mac, $ip";
-	else
+	else {
+		$message = trim($message);
 		$message = "$status: $user, $mac, $ip, $message";
+	}
 	captiveportal_syslog($message);
-	closelog();
 }
 
 /* log simple messages to syslog */
@@ -1172,91 +1219,78 @@ function captiveportal_syslog($message) {
 }
 
 function radius($username,$password,$clientip,$clientmac,$type) {
-    global $g, $config;
-
-    /* Start locking from the beginning of an authentication session */
-    $captiveportallck = lock('captiveportal');
-
-    $ruleno = captiveportal_get_next_ipfw_ruleno();
-
-    /* If the pool is empty, return appropriate message and fail authentication */
-    if (is_null($ruleno)) {
-        $auth_list = array();
-        $auth_list['auth_val'] = 1;
-        $auth_list['error'] = "System reached maximum login capacity";
-        unlock($captiveportallck);
-        return $auth_list;
-    }
-
-    /*
-     * Drop the lock since radius takes some time to finish.
-     * The implementation is reentrant so we gain speed with this.
-     */
-    unlock($captiveportallck);
-
-    $radiusservers = captiveportal_get_radius_servers();
-
-    $auth_list = RADIUS_AUTHENTICATION($username,
-                    $password,
-                    $radiusservers,
-                    $clientip,
-                    $clientmac,
-                    $ruleno);
+	global $g, $config;
 
-    $captiveportallck = lock('captiveportal');
+	$ruleno = captiveportal_get_next_ipfw_ruleno();
 
-    if ($auth_list['auth_val'] == 2) {
-        captiveportal_logportalauth($username,$clientmac,$clientip,$type);
-        $sessionid = portal_allow($clientip,
-                    $clientmac,
-                    $username,
-                    $password,
-                    $auth_list,
-                    $ruleno);
-    }
+	/* If the pool is empty, return appropriate message and fail authentication */
+	if (is_null($ruleno)) {
+		$auth_list = array();
+		$auth_list['auth_val'] = 1;
+		$auth_list['error'] = "System reached maximum login capacity";
+		return $auth_list;
+	}
 
-    unlock($captiveportallck);
+	$radiusservers = captiveportal_get_radius_servers();
 
-    return $auth_list;
+	$auth_list = RADIUS_AUTHENTICATION($username,
+		$password,
+		$radiusservers,
+		$clientip,
+		$clientmac,
+		$ruleno);
+
+	if ($auth_list['auth_val'] == 2) {
+		captiveportal_logportalauth($username,$clientmac,$clientip,$type);
+		$sessionid = portal_allow($clientip,
+			$clientmac,
+			$username,
+			$password,
+			$auth_list,
+			$ruleno);
+	}
 
+	return $auth_list;
 }
 
 /* read captive portal DB into array */
 function captiveportal_read_db() {
+		global $g;
+
+		$cpdb = array();
 
-        global $g;
-
-        $cpdb = array();
-        $fd = @fopen("{$g['vardb_path']}/captiveportal.db", "r");
-        if ($fd) {
-                while (!feof($fd)) {
-                        $line = trim(fgets($fd));
-                        if ($line) {
-                                $cpdb[] = explode(",", $line);
-                        }
-                }
-                fclose($fd);
-        }
-        return $cpdb;
+		$cpdblck = lock('captiveportaldb');
+		$fd = @fopen("{$g['vardb_path']}/captiveportal.db", "r");
+		if ($fd) {
+			while (!feof($fd)) {
+				$line = trim(fgets($fd));
+				if ($line) 
+						$cpdb[] = explode(",", $line);
+			}
+			fclose($fd);
+		}
+		unlock($cpdblck);
+		return $cpdb;
 }
 
 /* write captive portal DB */
 function captiveportal_write_db($cpdb) {
-                 
-        global $g;
-                
-        $fd = @fopen("{$g['vardb_path']}/captiveportal.db", "w");
-        if ($fd) { 
-                foreach ($cpdb as $cpent) {
-                        fwrite($fd, join(",", $cpent) . "\n");
-                }       
-                fclose($fd);
-        }       
+		global $g;
+
+		$cpdblck = lock('captiveportaldb', LOCK_EX);
+		$fd = @fopen("{$g['vardb_path']}/captiveportal.db", "w");
+		if ($fd) {
+			foreach ($cpdb as $cpent) {
+					fwrite($fd, join(",", $cpent) . "\n");
+			}
+			fclose($fd);
+		}
+	unlock($cpdblck);
 }
 
 function captiveportal_write_elements() {
 	global $g, $config;
-    
+	
 	/* delete any existing elements */
 	if (is_dir($g['captiveportal_element_path'])) {
 		$dh = opendir($g['captiveportal_element_path']);
@@ -1265,8 +1299,9 @@ function captiveportal_write_elements() {
 				unlink($g['captiveportal_element_path'] . "/" . $file);
 		}
 		closedir($dh);
-	} else
+	} else {
 		@mkdir($g['captiveportal_element_path']);
+	}
 
 	if (is_array($config['captiveportal']['element'])) {
 		conf_mount_rw();
@@ -1285,7 +1320,7 @@ function captiveportal_write_elements() {
 		}
 		conf_mount_ro();
 	}
-    
+	
 	return 0;
 }
 
@@ -1308,16 +1343,17 @@ function captiveportal_get_next_ipfw_ruleno($rulenos_start = 2000, $rulenos_rang
 	if(!isset($config['captiveportal']['enable']))
 		return NULL;
 
+	$cpruleslck = lock('captiveportalrules', LOCK_EX);
 	$ruleno = 0;
 	if (file_exists("{$g['vardb_path']}/captiveportal.rules")) {
 		$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal.rules"));
 		for ($ridx = 2; $ridx < ($rulenos_range_max - $rulenos_start); $ridx++) {
 			if ($rules[$ridx]) {
 				/* 
-	 			 * This allows our traffic shaping pipes to be the in pipe the same as ruleno 
-	 			 * and the out pipe ruleno + 1. This removes limitation that where present in 
-	 			 * previous version of the peruserbw.
-	 			 */
+				 * This allows our traffic shaping pipes to be the in pipe the same as ruleno 
+				 * and the out pipe ruleno + 1. This removes limitation that where present in 
+				 * previous version of the peruserbw.
+				 */
 				if (isset($config['captiveportal']['peruserbw']))
 					$ridx++;
 				continue;
@@ -1334,6 +1370,7 @@ function captiveportal_get_next_ipfw_ruleno($rulenos_start = 2000, $rulenos_rang
 		$ruleno = 2;
 	}
 	file_put_contents("{$g['vardb_path']}/captiveportal.rules", serialize($rules));
+	unlock($cpruleslck);
 	return $ruleno;
 }
 
@@ -1343,6 +1380,7 @@ function captiveportal_free_ipfw_ruleno($ruleno, $usedbw = false) {
 	if(!isset($config['captiveportal']['enable']))
 		return NULL;
 
+	$cpruleslck = lock('captiveportalrules', LOCK_EX);
 	if (file_exists("{$g['vardb_path']}/captiveportal.rules")) {
 		$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal.rules"));
 		$rules[$ruleno] = false;
@@ -1350,21 +1388,26 @@ function captiveportal_free_ipfw_ruleno($ruleno, $usedbw = false) {
 			$rules[++$ruleno] = false;
 		file_put_contents("{$g['vardb_path']}/captiveportal.rules", serialize($rules));
 	}
+	unlock($cpruleslck);
 }
 
 function captiveportal_get_ipfw_passthru_ruleno($value) {
 	global $config, $g;
 
 	if(!isset($config['captiveportal']['enable']))
-                return NULL;
+				return NULL;
 
-        if (file_exists("{$g['vardb_path']}/captiveportal.rules")) {
-                $rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal.rules"));
+	$cpruleslck = lock('captiveportalrules', LOCK_EX);
+	if (file_exists("{$g['vardb_path']}/captiveportal.rules")) {
+		$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal.rules"));
 		$ruleno = intval(`/sbin/ipfw show | /usr/bin/grep {$value} |  /usr/bin/grep -v grep | /usr/bin/cut -d " " -f 1 | /usr/bin/head -n 1`);
-		if ($rules[$ruleno])
+		if ($rules[$ruleno]) {
+			unlock($cpruleslck);
 			return $ruleno;
-        }
+		}
+	}
 
+	unlock($cpruleslck);
 	return NULL;
 }
 
@@ -1381,31 +1424,31 @@ function captiveportal_get_ipfw_passthru_ruleno($value) {
 
 function getVolume($ip) {
 
-    $volume = array();
+	$volume = array();
 
-    // Initialize vars properly, since we don't want NULL vars
-    $volume['input_pkts'] = $volume['input_bytes'] = $volume['output_pkts'] = $volume['output_bytes'] = 0 ;
+	// Initialize vars properly, since we don't want NULL vars
+	$volume['input_pkts'] = $volume['input_bytes'] = $volume['output_pkts'] = $volume['output_bytes'] = 0 ;
 
-    // Ingress
-    $ipfwin = "";
-    $ipfwout = "";
-    $matchesin = "";
-    $matchesout = "";
-    exec("/sbin/ipfw table 1 entrystats {$ip}", $ipfwin);
-    if ($ipfwin[0]) {
+	// Ingress
+	$ipfwin = "";
+	$ipfwout = "";
+	$matchesin = "";
+	$matchesout = "";
+	exec("/sbin/ipfw table 1 entrystats {$ip}", $ipfwin);
+	if ($ipfwin[0]) {
 		$ipfwin = split(" ", $ipfwin[0]);
 		$volume['input_pkts'] = $ipfwin[2];
 		$volume['input_bytes'] = $ipfwin[3];
-    }
+	}
 
-    exec("/sbin/ipfw table 2 entrystats {$ip}", $ipfwout);
-    if ($ipfwout[0]) {
-        $ipfwout = split(" ", $ipfwout[0]);
-        $volume['output_pkts'] = $ipfwout[2];
-        $volume['output_bytes'] = $ipfwout[3];
-    }
+	exec("/sbin/ipfw table 2 entrystats {$ip}", $ipfwout);
+	if ($ipfwout[0]) {
+		$ipfwout = split(" ", $ipfwout[0]);
+		$volume['output_pkts'] = $ipfwout[2];
+		$volume['output_bytes'] = $ipfwout[3];
+	}
 
-    return $volume;
+	return $volume;
 }
 
 /**
@@ -1415,11 +1458,11 @@ function getVolume($ip) {
  */
 function getNasID()
 {
-    $nasId = "";
-    exec("/bin/hostname", $nasId);
-    if(!$nasId[0])
-        $nasId[0] = "{$g['product_name']}";
-    return $nasId[0];
+	$nasId = "";
+	exec("/bin/hostname", $nasId);
+	if(!$nasId[0])
+		$nasId[0] = "{$g['product_name']}";
+	return $nasId[0];
 }
 
 /**
@@ -1433,17 +1476,17 @@ function getNasIP()
 {
 	global $config;
 
-	if (empty($config['captiveportal']['radiussrcip_attribute']))
-    		$nasIp = get_interface_ip();
-	else {
+	if (empty($config['captiveportal']['radiussrcip_attribute'])) {
+			$nasIp = get_interface_ip();
+	} else {
 		if (is_ipaddr($config['captiveportal']['radiussrcip_attribute']))
-                        $nasIp = $config['captiveportal']['radiussrcip_attribute'];
-                else
-                        $nasIp = get_interface_ip($config['captiveportal']['radiussrcip_attribute']);
+			$nasIp = $config['captiveportal']['radiussrcip_attribute'];
+		else
+			$nasIp = get_interface_ip($config['captiveportal']['radiussrcip_attribute']);
 	}
 		
-    	if(!is_ipaddr($nasIp))
-        	$nasIp = "0.0.0.0";
+	if(!is_ipaddr($nasIp))
+		$nasIp = "0.0.0.0";
 
 	return $nasIp;
 }
diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index e82baba..7d19045 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -286,6 +286,7 @@ function csr_get_subject($str_crt, $decode = true) {
 	if (!is_array($components))
 		return "unknown";
 
+	ksort($components);
 	foreach ($components as $a => $v) {
 		if (!strlen($subject))
 			$subject = "{$a}={$v}";
@@ -307,13 +308,15 @@ function cert_get_subject($str_crt, $decode = true) {
 	if (!is_array($components))
 		return "unknown";
 
+	ksort($components);
 	foreach ($components as $a => $v) {
-		if (is_array($v))
+		if (is_array($v)) {
+			ksort($v);
 			foreach ($v as $w) {
 				$asubject = "{$a}={$w}";
 				$subject = (strlen($subject)) ? "{$asubject}, {$subject}" : $asubject;
 			}
-		else {
+		} else {
 			$asubject = "{$a}={$v}";
 			$subject = (strlen($subject)) ? "{$asubject}, {$subject}" : $asubject;
 		}
@@ -561,4 +564,4 @@ function is_crl_internal($crl) {
 	return !(!empty($crl['text']) && empty($crl['cert']));
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/config.console.inc b/etc/inc/config.console.inc
index 1514926..9005b79 100644
--- a/etc/inc/config.console.inc
+++ b/etc/inc/config.console.inc
@@ -319,6 +319,8 @@ EOD;
 
 	if (in_array($key, array('y', 'Y'))) {
 		if($lanif) {
+			if (!is_array($config['interfaces']['lan']))
+				$config['interfaces']['lan'] = array();
 			$config['interfaces']['lan']['if'] = $lanif;
 			$config['interfaces']['lan']['enable'] = true;
 		} elseif (!$g['booting'] && !$auto_assign) {
@@ -332,7 +334,7 @@ unload the interface now? [y|n]?
 EODD;
 
 				if (strcasecmp(chop(fgets($fp)), "y") == 0) {
-					if($config['interfaces']['lan']['if'])
+					if(isset($config['interfaces']['lan']) && $config['interfaces']['lan']['if'])
 						mwexec("/sbin/ifconfig " . $config['interfaces']['lan']['if'] . " delete");
 				}
 				if(isset($config['interfaces']['lan']))
@@ -372,9 +374,12 @@ EODD;
 				(!is_array($config['interfaces']['lan']['wireless'])))
 				$config['interfaces']['lan']['wireless'] = array();
 		} else {
-			unset($config['interfaces']['lan']['wireless']);
+			if (isset($config['interfaces']['lan']))
+				unset($config['interfaces']['lan']['wireless']);
 		}
 
+		if (!is_array($config['interfaces']['wan']))
+			$config['interfaces']['wan'] = array();
 		$config['interfaces']['wan']['if'] = $wanif;
 		$config['interfaces']['wan']['enable'] = true;
 		if (preg_match($g['wireless_regex'], $wanif)) {
@@ -382,7 +387,8 @@ EODD;
 				(!is_array($config['interfaces']['wan']['wireless'])))
 				$config['interfaces']['wan']['wireless'] = array();
 		} else {
-			unset($config['interfaces']['wan']['wireless']);
+			if (isset($config['interfaces']['wan']))
+				unset($config['interfaces']['wan']['wireless']);
 		}
 
 		for ($i = 0; $i < count($optif); $i++) {
@@ -420,12 +426,6 @@ EODD;
 
 		$g['booting'] = false;
 
-		/* XXX: ermal - disable it for now this is used during bootup at best so shouldn't be needed.
-		 * 		For now just comment it out and later remove it completely.
-		 * resync everything 
-			reload_all_sync();
-		 */
-
 		echo " done!\n";
 
 		touch("{$g['tmp_path']}/assign_complete");
@@ -535,4 +535,4 @@ EOD;
 	}
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/config.gui.inc b/etc/inc/config.gui.inc
index cd38049..1a7e397 100644
--- a/etc/inc/config.gui.inc
+++ b/etc/inc/config.gui.inc
@@ -54,11 +54,6 @@ if($config_parsed == true)
 else
 	$config_parsed = true;
 
-// Set the memory limit to 128M.  When someone has something like 500+ tunnels
-// the parser needs quite a bit of ram.   Do not remove this line unless you 
-// know what you are doing.  If in doubt, check with dev@ _/FIRST/_!
-ini_set("memory_limit","128M");
-
 /* include globals from notices.inc /utility/XML parser files */
 require_once('config.lib.inc');
 require_once("notices.inc");
diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc
index d456064..1e584f2 100644
--- a/etc/inc/config.lib.inc
+++ b/etc/inc/config.lib.inc
@@ -53,30 +53,33 @@
  ******/
 function encrypted_configxml() {
 	global $g, $config;
-	if(file_exists($g['conf_path'] . "/config.xml")) {
-		if($g['booting']) {
-			$configtxt = file_get_contents($g['conf_path'] . "/config.xml");			
-			if(tagfile_deformat($configtxt, $configtxt, "config.xml")) {
-				$fp = fopen('php://stdin', 'r');
+
+	if (!file_exists($g['conf_path'] . "/config.xml"))
+		return;
+
+	if (!$g['booting'])
+		return;
+
+	$configtxt = file_get_contents($g['conf_path'] . "/config.xml");			
+	if(tagfile_deformat($configtxt, $configtxt, "config.xml")) {
+		$fp = fopen('php://stdin', 'r');
+		$data = "";
+		echo "\n\n*** Encrypted config.xml detected ***\n";
+		while($data == "") {
+			echo "\nEnter the password to decrypt config.xml: ";
+			$decrypt_password = chop(fgets($fp));
+			$data = decrypt_data($configtxt, $decrypt_password);
+			if(!strstr($data, "<pfsense>"))
 				$data = "";
-				echo "\n\n*** Encrypted config.xml detected ***\n";
-				while($data == "") {
-					echo "\nEnter the password to decrypt config.xml: ";
-					$decrypt_password = chop(fgets($fp));
-					$data = decrypt_data($configtxt, $decrypt_password);
-					if(!strstr($data, "<pfsense>"))
-						$data = "";
-					if($data) {
-						$fd = fopen($g['conf_path'] . "/config.xml.tmp", "w");
-						fwrite($fd, $data);
-						fclose($fd);
-						exec("/bin/mv {$g['conf_path']}/config.xml.tmp {$g['conf_path']}/config.xml");
-						echo "\nConfig.xml unlocked.\n";
-						fclose($fp);
-					} else {
-						echo "\nInvalid password entered.  Please try again.\n";
-					}
-				}
+			if($data) {
+				$fd = fopen($g['conf_path'] . "/config.xml.tmp", "w");
+				fwrite($fd, $data);
+				fclose($fd);
+				exec("/bin/mv {$g['conf_path']}/config.xml.tmp {$g['conf_path']}/config.xml");
+				echo "\nConfig.xml unlocked.\n";
+				fclose($fp);
+			} else {
+				echo "\nInvalid password entered.  Please try again.\n";
 			}
 		}
 	}
@@ -92,9 +95,10 @@ function encrypted_configxml() {
  ******/
 function parse_config($parse = false) {
 	global $g, $config_parsed, $config_extra;
-	
+
 	$lockkey = lock('config');
 	$config_parsed = false;
+
 	if (!file_exists("{$g['conf_path']}/config.xml") || filesize("{$g['conf_path']}/config.xml") == 0) {
 		$last_backup = discover_last_backup();
 		if($last_backup) {
@@ -106,37 +110,25 @@ function parse_config($parse = false) {
 			die("Config.xml is corrupted and is 0 bytes.  Could not restore a previous backup.");
 		}
 	}
-	if($g['booting']) echo ".";
+
+	if($g['booting'])
+		echo ".";
+
 	// Check for encrypted config.xml
 	encrypted_configxml();
+
 	if(!$parse) {
-		if(file_exists($g['tmp_path'] . '/config.cache')) {
+		if (file_exists($g['tmp_path'] . '/config.cache')) {
 			$config = unserialize(file_get_contents($g['tmp_path'] . '/config.cache'));
-			if(is_null($config)) {
-				unlock($lockkey);
-				parse_config(true);
-				$lockkey = lock('config');
-			}
-		} else {
-			if(!file_exists($g['conf_path'] . "/config.xml")) {
-				log_error("No config.xml found, attempting last known config restore.");
-				file_notice("config.xml", "No config.xml found, attempting last known config restore.", "pfSenseConfigurator", "");
-				$last_backup = discover_last_backup();
-				if ($last_backup)
-					restore_backup("/cf/conf/backup/{$last_backup}");
-				else {
-					log_error("Could not restore config.xml.");
-					unlock($lockkey);
-					die("Config.xml is corrupted and is 0 bytes.  Could not restore a previous backup.");
-				}
-			}
-			unlock($lockkey);
-			$config = parse_config(true);
-			$lockkey = lock('config');
-		}
-	} else {
+			if (is_null($config))
+				$parse = true;
+		} else
+			$parse = true;
+	}
+	if ($parse == true) {
 		if(!file_exists($g['conf_path'] . "/config.xml")) {
-			if($g['booting']) echo ".";
+			if($g['booting'])
+				echo ".";
 			log_error("No config.xml found, attempting last known config restore.");
 			file_notice("config.xml", "No config.xml found, attempting last known config restore.", "pfSenseConfigurator", "");
 			$last_backup = discover_last_backup();
@@ -149,7 +141,7 @@ function parse_config($parse = false) {
 			}
 		}
 		$config = parse_xml_config($g['conf_path'] . '/config.xml', array($g['xml_rootobj'], 'pfsense'));
-		if($config == "-1") {
+		if($config == -1) {
 			$last_backup = discover_last_backup();
 			if ($last_backup)
 				restore_backup("/cf/conf/backup/{$last_backup}");
@@ -161,11 +153,15 @@ function parse_config($parse = false) {
 		}
 		generate_config_cache($config);
 	}
-	if($g['booting']) echo ".";
-	alias_make_table($config);
+
+	if($g['booting'])
+		echo ".";
+
 	$config_parsed = true;
 	unlock($lockkey);
 
+	alias_make_table($config);
+
 	return $config;
 }
 
@@ -226,7 +222,8 @@ function restore_backup($file) {
 function parse_config_bootup() {
 	global $config, $g;
 
-	if($g['booting']) echo ".";
+	if($g['booting'])
+		echo ".";
 
 	$lockkey = lock('config');
 	if (!file_exists("{$g['conf_path']}/config.xml")) {
@@ -250,6 +247,7 @@ function parse_config_bootup() {
 				}
 				if(!file_exists("{$g['conf_path']}/config.xml")) {
 					echo "XML configuration file not found.  {$g['product_name']} cannot continue booting.\n";
+					unlock($lockkey);
 					mwexec("/sbin/halt");
 					exit;
 				}
@@ -348,6 +346,9 @@ function conf_mount_ro() {
 	if($g['platform'] == "cdrom" or $g['platform'] == "pfSense")
 		return;
 
+	if($g['booting'])
+		return;
+
 	if (refcount_unreference(1000) > 0)
 		return;
 
@@ -412,9 +413,6 @@ function convert_config() {
 
 	if ($prev_version != $config['version'])
 		write_config("Upgraded config version level from {$prev_version} to {$config['version']}");
-
-	if($g['booting'])
-		echo "Loading new configuration...";
 }
 
 /****f* config/safe_write_file
@@ -481,12 +479,17 @@ function write_config($desc="Unknown", $backup = true) {
 	 *       for now, since it was preventing config saving. */
 	// $config = parse_config(true, false, false);
 	
-	if($g['bootup']) 
+	if($g['booting'])
 		log_error("WARNING! Configuration written on bootup.  This can cause stray openvpn and load balancing items in config.xml");
 
+	$username = empty($_SESSION["Username"]) ? "(system)" : $_SESSION['Username'];
+
 	if($backup)
 		backup_config();
 
+	if (!is_array($config['revision']))
+		$config['revision'] = array();
+
 	if (time() > mktime(0, 0, 0, 9, 1, 2004))       /* make sure the clock settings are plausible */
 		$config['revision']['time'] = time();
 
@@ -494,8 +497,8 @@ function write_config($desc="Unknown", $backup = true) {
 	if ($desc == "Unknown")
 		$desc = "{$_SERVER['SCRIPT_NAME']} made unknown change";
 
-	$config['revision']['description'] = "{$_SESSION['Username']}: " . $desc;
-	$config['revision']['username'] = $_SESSION["Username"];
+	$config['revision']['description'] = "{$username}: " . $desc;
+	$config['revision']['username'] = $username;
 
 	conf_mount_rw();
 	$lockkey = lock('config', LOCK_EX);
@@ -755,7 +758,7 @@ function cleanup_backupcache($revisions = 30, $lock = false) {
 		foreach($tocache as $version => $versioninfo) {
 			if(!in_array($version, array_keys($newcache))) {
 				unlink_if_exists($g['conf_path'] . '/backup/config-' . $version . '.xml');
-				if($g['booting']) print " " . $tocheck . "d";
+				//if($g['booting']) print " " . $tocheck . "d";
 			}
 		}
 		$tocache = $newcache;
@@ -840,4 +843,4 @@ function set_device_perms() {
 	}
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/cram_md5_sasl_client.inc b/etc/inc/cram_md5_sasl_client.inc
new file mode 100644
index 0000000..69bd625
--- /dev/null
+++ b/etc/inc/cram_md5_sasl_client.inc
@@ -0,0 +1,67 @@
+<?php
+/*
+ * cram_md5_sasl_client.php
+ *
+ * @(#) $Id: cram_md5_sasl_client.php,v 1.3 2004/11/17 08:00:37 mlemos Exp $
+ *
+ */
+
+define("SASL_CRAM_MD5_STATE_START",             0);
+define("SASL_CRAM_MD5_STATE_RESPOND_CHALLENGE", 1);
+define("SASL_CRAM_MD5_STATE_DONE",              2);
+
+class cram_md5_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_CRAM_MD5_STATE_START;
+
+	Function Initialize(&$client)
+	{
+		return(1);
+	}
+
+	Function HMACMD5($key,$text)
+	{
+		$key=(strlen($key)<64 ? str_pad($key,64,"\0") : substr($key,0,64));
+		return(md5((str_repeat("\x5c", 64)^$key).pack("H32", md5((str_repeat("\x36", 64)^$key).$text))));
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_CRAM_MD5_STATE_START)
+		{
+			$client->error="CRAM-MD5 authentication state is not at the start";
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			"user"=>"",
+			"password"=>""
+		);
+		$defaults=array();
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+			$this->state=SASL_CRAM_MD5_STATE_RESPOND_CHALLENGE;
+		Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+			case SASL_CRAM_MD5_STATE_RESPOND_CHALLENGE:
+				$message=$this->credentials["user"]." ".$this->HMACMD5($this->credentials["password"], $response);
+				$this->state=SASL_CRAM_MD5_STATE_DONE;
+				break;
+			case SASL_CRAM_MD5_STATE_DONE:
+				$client->error="CRAM-MD5 authentication was finished without success";
+				return(SASL_FAIL);
+			default:
+				$client->error="invalid CRAM-MD5 authentication step state";
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/crypt.inc b/etc/inc/crypt.inc
index dc40eb9..582a84c 100644
--- a/etc/inc/crypt.inc
+++ b/etc/inc/crypt.inc
@@ -85,12 +85,12 @@
 
 		$body_pos = $btag_pos + $btag_len;
 		$body_len = strlen($in);
-		$body_len -= strlen($btag_len);
-		$body_len -= strlen($etag_len);
+		$body_len -= $btag_len;
+		$body_len -= $etag_len + 1;
 
 		$out = substr($in, $body_pos, $body_len);
 
 		return true;
 	}
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/digest_sasl_client.inc b/etc/inc/digest_sasl_client.inc
new file mode 100644
index 0000000..924887d
--- /dev/null
+++ b/etc/inc/digest_sasl_client.inc
@@ -0,0 +1,135 @@
+<?php
+/*
+ * digest_sasl_client.php
+ *
+ * @(#) $Id: digest_sasl_client.php,v 1.1 2005/10/27 05:24:15 mlemos Exp $
+ *
+ */
+
+define('SASL_DIGEST_STATE_START',             0);
+define('SASL_DIGEST_STATE_RESPOND_CHALLENGE', 1);
+define('SASL_DIGEST_STATE_DONE',              2);
+
+class digest_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_DIGEST_STATE_START;
+
+	Function unq($string)
+	{
+		return(($string[0]=='"' && $string[strlen($string)-1]=='"') ? substr($string, 1, strlen($string)-2) : $string);
+	}
+
+	Function H($data)
+	{
+		return md5($data);
+	}
+
+	Function KD($secret, $data)
+	{
+		return $this->H($secret.':'.$data);
+	}
+
+	Function Initialize(&$client)
+	{
+		return(1);
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_DIGEST_STATE_START)
+		{
+			$client->error='Digest authentication state is not at the start';
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			'user'=>'',
+			'password'=>'',
+			'uri'=>'',
+			'method'=>'',
+			'session'=>''
+		);
+		$defaults=array();
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+			$this->state=SASL_DIGEST_STATE_RESPOND_CHALLENGE;
+		Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+			case SASL_DIGEST_STATE_RESPOND_CHALLENGE:
+				$values=explode(',',$response);
+				$parameters=array();
+				for($v=0; $v<count($values); $v++)
+					$parameters[strtok(trim($values[$v]), '=')]=strtok('');
+
+				$message='username="'.$this->credentials['user'].'"';
+				if(!IsSet($parameters[$p='realm'])
+				&& !IsSet($parameters[$p='nonce']))
+				{
+					$client->error='Digest authentication parameter '.$p.' is missing from the server response';
+					return(SASL_FAIL);
+				}
+				$message.=', realm='.$parameters['realm'];
+				$message.=', nonce='.$parameters['nonce'];
+				$message.=', uri="'.$this->credentials['uri'].'"';
+				if(IsSet($parameters['algorithm']))
+				{
+					$algorithm=$this->unq($parameters['algorithm']);
+					$message.=', algorithm='.$parameters['algorithm'];
+				}
+				else
+					$algorithm='';
+
+				$realm=$this->unq($parameters['realm']);
+				$nonce=$this->unq($parameters['nonce']);
+				if(IsSet($parameters['qop']))
+				{
+					switch($qop=$this->unq($parameters['qop']))
+					{
+						case "auth":
+							$cnonce=$this->credentials['session'];
+							break;
+						default:
+							$client->error='Digest authentication quality of protection '.$qop.' is not yet supported';
+							return(SASL_FAIL);
+					}
+				}
+				$nc_value='00000001';
+				if(IsSet($parameters['qop'])
+				&& !strcmp($algorithm, 'MD5-sess'))
+					$A1=$this->H($this->credentials['user'].':'. $realm.':'. $this->credentials['password']).':'.$nonce.':'.$cnonce;
+				else
+					$A1=$this->credentials['user'].':'. $realm.':'. $this->credentials['password'];
+				$A2=$this->credentials['method'].':'.$this->credentials['uri'];
+				if(IsSet($parameters['qop']))
+					$response=$this->KD($this->H($A1), $nonce.':'. $nc_value.':'. $cnonce.':'. $qop.':'. $this->H($A2));
+				else
+					$response=$this->KD($this->H($A1), $nonce.':'. $this->H($A2));
+				$message.=', response="'.$response.'"';
+				if(IsSet($parameters['opaque']))
+					$message.=', opaque='.$parameters['opaque'];
+				if(IsSet($parameters['qop']))
+					$message.=', qop="'.$qop.'"';
+				$message.=', nc='.$nc_value;
+				if(IsSet($parameters['qop']))
+					$message.=', cnonce="'.$cnonce.'"';
+				$client->encode_response=0;
+				$this->state=SASL_DIGEST_STATE_DONE;
+				break;
+			case SASL_DIGEST_STATE_DONE:
+				$client->error='Digest authentication was finished without success';
+				return(SASL_FAIL);
+			default:
+				$client->error='invalid Digest authentication step state';
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/dyndns.class b/etc/inc/dyndns.class
index 785c902..da8844e 100644
--- a/etc/inc/dyndns.class
+++ b/etc/inc/dyndns.class
@@ -827,10 +827,7 @@
 			log_error("DynDns: Current WAN IP: {$wan_ip}");
 
 			if (file_exists($this->_cacheFile)) {
-				if(file_exists($this->_cacheFile))
-					$contents = file_get_contents($this->_cacheFile);
-				else
-					$contents = "";
+				$contents = file_get_contents($this->_cacheFile);
 				list($cacheIP,$cacheTime) = split(':', $contents);
 				$this->_debug($cacheIP.'/'.$cacheTime);
 				$initial = false;
@@ -933,4 +930,4 @@
 
 	}
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/easyrule.inc b/etc/inc/easyrule.inc
index 0679060..c62f76b 100644
--- a/etc/inc/easyrule.inc
+++ b/etc/inc/easyrule.inc
@@ -166,7 +166,7 @@ function easyrule_block_alias_add($host, $int = 'wan') {
 		/* Create a new alias with all the proper information */
 	 	$alias['name']    = $blockaliasname . strtoupper($int);
 	 	$alias['type']    = 'network';
-	 	$alias['descr']   = mb_convert_encoding("Hosts blocked from Firewall Log view","HTML-ENTITIES","auto");
+		$alias['descr']   = "Hosts blocked from Firewall Log view";
 
 		$alias['address'] = $host . '/32';
 	 	$alias['detail']  = 'Entry added ' . date('r') . '||';
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 421df12..47b5cda 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -39,6 +39,7 @@
 */
 
 /* DISABLE_PHP_LINT_CHECKING */
+// vim: ts=4 sw=4 noexpandtab
 
 /* include all configuration functions */
 
@@ -184,9 +185,8 @@ function filter_configure_sync() {
 	global $config, $g, $after_filter_configure_run, $FilterIflist;
 	global $time_based_rules, $filterdns, $aliases;
 
-	/* Use filter lock to not allow recursion and config lock to prevent changes during this run. */
+	/* Use filter lock to not allow concurrent filter reloads during this run. */
 	$filterlck = lock('filter', LOCK_EX);
-	$configlck = lock('config');
 
 
 	filter_pflog_start();
@@ -241,7 +241,6 @@ function filter_configure_sync() {
 		update_filter_reload_status("Filter is disabled.  Not loading rules.");
 		if($g['booting'] == true)
 			echo "done.\n";
-		unlock($configlck);
 		unlock($filterlck);
 		return;
 	}
@@ -299,7 +298,6 @@ function filter_configure_sync() {
 
 	if(!file_put_contents("{$g['tmp_path']}/rules.debug", $rules, LOCK_EX)) {
 		log_error("WARNING: Could not write new rules!");
-		unlock($configlck);
 		unlock($filterlck);
 		return;
 	}
@@ -338,7 +336,6 @@ function filter_configure_sync() {
 			file_notice("filter_load", "There were error(s) loading the rules: {$rules_error} {$line_error}", "Filter Reload", "");
 			log_error("There were error(s) loading the rules: {$rules_error} - {$line_error}");
 			update_filter_reload_status("There were error(s) loading the rules: {$rules_error} - {$line_error}");
-			unlock($configlck);
 			unlock($filterlck);
 			return;
 		}
@@ -386,8 +383,6 @@ function filter_configure_sync() {
 		fclose($fda);
 	}
 
-	unlock($configlck);
-
 	if(file_exists("{$g['tmp_path']}/commands.txt")) {
 		mwexec("sh {$g['tmp_path']}/commands.txt &");
 		unlink("{$g['tmp_path']}/commands.txt");
@@ -477,7 +472,7 @@ function filter_generate_nested_alias($name, $alias, &$aliasnesting, &$aliasaddr
 				$tmpline = filter_generate_nested_alias($address, $aliastable[$address], $aliasnesting, $aliasaddrnesting);
 		} else if(!isset($aliasaddrnesting[$address])) {
 			if(!is_ipaddr($address) && !is_subnet($address) && !is_port($address)) {
-				$filterdns .= "{$address} = {$name}\n";
+				$filterdns .= "pf {$address} {$name}\n";
 				continue;
 			}
 			$aliasaddrnesting[$address] = $address;
@@ -1092,13 +1087,18 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 }
 
 /* Generate a 'nat on' or 'no nat on' rule for given interface */
-function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "any", $dstport = "", $natip = "", $natport = "", $nonat = false, $staticnatport = false, $proto = "") {
+function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "any", $dstport = "", $natip = "", $natport = "", $nonat = false, $staticnatport = false, $proto = "", $poolopts = "") {
 	global $config, $FilterIflist;
 	/* XXX: billm - any idea if this code is needed? */
 	if($src == "/32" || $src{0} == "/")
 		return "# src incorrectly specified\n";
 	if($natip != "") {
-		$tgt = "{$natip}/32";
+		if (is_subnet($natip))
+			$tgt = $natip;
+		elseif (is_alias($natip))
+			$tgt = "\${$natip}";
+		else
+			$tgt = "{$natip}/32";
 	} else {
 		$natip = get_interface_ip($if);
 		if(is_ipaddr($natip))
@@ -1130,18 +1130,17 @@ function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "
 	if($dstport != "")
 		$dst .= " port {$dstport}";
 	/* outgoing static-port option, hamachi, Grandstream, VOIP, etc */
+	$staticnatport_txt = "";
 	if($staticnatport)
-		$staticnatport_txt = " static-port";
-	else
-		if(!$natport)
-			$staticnatport_txt = " port 1024:65535"; // set source port range
-		else
-			$staticnatport_txt = "";
+		$staticnatport_txt = "static-port";
+	elseif(!$natport)
+		$tgt .= " port 1024:65535"; // set source port range
 	/* Allow for negating NAT entries */
 	if($nonat) {
 		$nat = "no nat";
 		$target = "";
 		$staticnatport_txt = "";
+		$poolopts = "";
 	} else {
 		$nat = "nat";
 		$target = "-> {$tgt}";
@@ -1149,7 +1148,7 @@ function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "
 	$if_friendly = $FilterIflist[$if]['descr'];
 	/* Put all the pieces together */
 	if($if_friendly)
-		$natrule = "{$nat} on \${$if_friendly} {$protocol} from {$src} to {$dst} {$target}{$staticnatport_txt}\n";
+		$natrule = "{$nat} on \${$if_friendly} {$protocol} from {$src} to {$dst} {$target} {$poolopts} {$staticnatport_txt}\n";
 	else
 		$natrule .= "# Could not convert {$if} to friendly name(alias)\n";
 	return $natrule;
@@ -1242,6 +1241,9 @@ function filter_nat_rules_generate() {
 				else
 					$natif = $obent['interface'];
 
+				$obtarget = ($obent['target'] == "other-subnet") ? $obent['targetip'] . '/' . $obent['targetip_subnet']: $obent['target'];
+				$poolopts = (is_subnet($obtarget) || is_alias($obtarget)) ? $obent['poolopts'] : "";
+
 				if (!isset($FilterIflist[$natif]))
 					continue;
 
@@ -1250,11 +1252,12 @@ function filter_nat_rules_generate() {
 					$obent['sourceport'],
 					$dst,
 					$obent['dstport'],
-					$obent['target'],
+					$obtarget,
 					$obent['natport'],
 					isset($obent['nonat']),
 					isset($obent['staticnatport']),
-					$obent['protocol']
+					$obent['protocol'],
+					$poolopts
 				);
 			}
 		}
@@ -1344,6 +1347,8 @@ function filter_nat_rules_generate() {
 		}
 		if($numberofnathosts > 0):
 			foreach ($FilterIflist as $if => $ifcfg) {
+				if (substr($ifcfg['if'], 0, 4) == "ovpn")
+					continue;
 				update_filter_reload_status("Creating outbound rules {$if} - ({$ifcfg['descr']})");
 				if(interface_has_gateway($if)) {
 					$target = $ifcfg['ip'];
@@ -1541,7 +1546,7 @@ function filter_generate_user_rule_arr($rule) {
 	$ret['rule'] = $line;
 	$ret['interface'] = $rule['interface'];
 	if($rule['descr'] != "" and $line != "")
-		$ret['descr'] = "label \"USER_RULE: " . str_replace('"', '', substr($rule['descr'], 0, 63)) . "\"";
+		$ret['descr'] = "label \"USER_RULE: " . str_replace('"', '', substr($rule['descr'], 0, 52)) . "\"";
 	else
 		$ret['descr'] = "label \"USER_RULE\"";
 
@@ -1970,42 +1975,6 @@ function filter_rules_generate() {
 	$ipfrules = "";
 	//$ipfrules .= discover_pkg_rules("filter");
 
-	/* if captive portal is enabled, ensure that access to this port
-	 * is allowed on a locked down interface
-	 */
-	if(isset($config['captiveportal']['enable'])) {
-		$cpinterfaces = explode(",", $config['captiveportal']['interface']);
-		$cpiflist = array();
-		$cpiplist = array();
-		foreach ($cpinterfaces as $cpifgrp) {
-			if(!isset($FilterIflist[$cpifgrp]))
-				continue;
-			$tmpif = get_real_interface($cpifgrp);
-			if(!empty($tmpif)) {
-				$cpiflist[] = "{$tmpif}";
-				$cpipm = get_interface_ip($cpifgrp);
-				if(is_ipaddr($cpipm)) {
-					$carpif = link_ip_to_carp_interface($cpipm);
-					if (!empty($carpif)) {
-						$cpiflist[] = $carpif;
-						$carpsif = explode(" ", $carpif);
-						foreach ($carpsif as $cpcarp) {
-							$carpip = find_interface_ip($cpcarp);
-							if (is_ipaddr($carpip))
-							$cpiplist[] = $carpip;
-						}
-					}
-					$cpiplist[] = $cpipm;
-				}
-			}
-		}
-		if (count($cpiplist) > 0 && count($cpiflist) > 0) {
-			$cpinterface = implode(" ", $cpiflist);
-			$cpaddresses = implode(" ", $cpiplist);
-			$ipfrules .= "pass in quick on { {$cpinterface} } proto tcp from any to { {$cpaddresses} } port { 8000 8001 } keep state(sloppy)\n";
-			$ipfrules .= "pass out quick on { {$cpinterface} } proto tcp from { {$cpaddresses} } port { 8000 8001 } to any keep state(sloppy)\n";
-		}
-	}
 	/* relayd */
 	$ipfrules .= "anchor \"relayd/*\"\n";
 	# BEGIN OF firewall rules
@@ -2076,6 +2045,43 @@ EOD;
 	 */
 	$ipfrules .= "block in quick from <virusprot> to any label \"virusprot overload table\"\n";
 
+	/* if captive portal is enabled, ensure that access to this port
+	 * is allowed on a locked down interface
+	 */
+	if(isset($config['captiveportal']['enable'])) {
+		$cpinterfaces = explode(",", $config['captiveportal']['interface']);
+		$cpiflist = array();
+		$cpiplist = array();
+		foreach ($cpinterfaces as $cpifgrp) {
+			if(!isset($FilterIflist[$cpifgrp]))
+				continue;
+			$tmpif = get_real_interface($cpifgrp);
+			if(!empty($tmpif)) {
+				$cpiflist[] = "{$tmpif}";
+				$cpipm = get_interface_ip($cpifgrp);
+				if(is_ipaddr($cpipm)) {
+					$carpif = link_ip_to_carp_interface($cpipm);
+					if (!empty($carpif)) {
+						$cpiflist[] = $carpif;
+						$carpsif = explode(" ", $carpif);
+						foreach ($carpsif as $cpcarp) {
+							$carpip = find_interface_ip($cpcarp);
+							if (is_ipaddr($carpip))
+							$cpiplist[] = $carpip;
+						}
+					}
+					$cpiplist[] = $cpipm;
+				}
+			}
+		}
+		if (count($cpiplist) > 0 && count($cpiflist) > 0) {
+			$cpinterface = implode(" ", $cpiflist);
+			$cpaddresses = implode(" ", $cpiplist);
+			$ipfrules .= "pass in {$log} quick on { {$cpinterface} } proto tcp from any to { {$cpaddresses} } port { 8000 8001 } keep state(sloppy)\n";
+			$ipfrules .= "pass out {$log} quick on { {$cpinterface} } proto tcp from any to any flags any keep state(sloppy)\n";
+		}
+	}
+
 	$bogontableinstalled = 0;
 	foreach ($FilterIflist as $on => $oc) {
 		/* block bogon networks */
@@ -2165,7 +2171,6 @@ EOD;
 pass in on \$loopback all label "pass loopback"
 pass out on \$loopback all label "pass loopback"
 
-
 EOD;
 
 	$ipfrules .= <<<EOD
@@ -2764,6 +2769,4 @@ function discover_pkg_rules($ruletype) {
 	return $rules;
 }
 
-// vim: ts=4 sw=4 noexpandtab
-
 ?>
diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc
index ba97ba0..6f64478 100644
--- a/etc/inc/globals.inc
+++ b/etc/inc/globals.inc
@@ -3,7 +3,7 @@
 /*
     globals.inc
     part of pfSense (www.pfsense.com)
-    Copyright (C) 2004-2006 Scott Ullrich
+    Copyright (C) 2004-2010 Scott Ullrich
 
     Originally Part of m0n0wall
     Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
@@ -80,7 +80,7 @@ $g = array(
 	"product_name" => "pfSense",
 	"product_copyright" => "BSD Perimeter LLC",
 	"product_copyright_url" => "http://www.bsdperimeter.com",
-	"product_copyright_years" => "2004 - 2010",
+	"product_copyright_years" => "2004 - 2011",
 	"product_website" => "www.pfsense.org",
 	"product_website_footer" => "http://www.pfsense.org/?gui20",
 	"product_email" => "coreteam@pfsense.org",
@@ -89,7 +89,7 @@ $g = array(
 	"disablehelpmenu" => false,
 	"disablehelpicon" => false,
 	"debug" => false,
-	"latest_config" => "7.5",
+	"latest_config" => "7.6",
 	"nopkg_platforms" => array("cdrom"),
 	"minimum_ram_warning" => "105",
 	"minimum_ram_warning_text" => "128 MB",
@@ -110,10 +110,7 @@ $g = array(
 
 // Loop through and set vlan_long_frame VLAN_MTU
 $vlan_native_supp = get_nics_with_capabilities("vlanmtu");
-if(count($vlan_native_supp) > 0)
-	$g['vlan_long_frame'] = $vlan_native_supp;
-else 
-	$g['vlan_long_frame'] = array("vge", "bfe",  "bge",  "dc",  "em",  "fxp",  "gem",  "hme",  "ixgb",  "le", "lem", "nge",  "re",  "rl",  "sis",  "sk",  "ste",  "ti",  "tl",  "tx",  "txp",  "vr", "xl", "lagg");
+$g['vlan_long_frame'] = array_merge(array("vge", "bfe",  "bge",  "dc",  "em",  "fxp",  "gem",  "hme",  "ixgb",  "le", "lem", "nge",  "re",  "rl",  "sis",  "sk",  "ste",  "ti",  "tl",  "tx",  "txp",  "vr", "xl", "lagg"), (array)$vlan_native_supp);
 
 /* IP TOS flags */
 $iptos = array("lowdelay", "throughput", "reliability");
@@ -162,7 +159,9 @@ $sysctls = array("net.inet.ip.portrange.first" => "1024",
 	"net.inet.tcp.log_debug" => "0", 
 	"net.inet.tcp.tso" => "1", 
 	"net.inet.icmp.icmplim" => "0",
-	"vfs.read_max" => "32"
+	"vfs.read_max" => "32",
+	"kern.ipc.maxsockbuf" => "4262144",
+	"debug.pfftpproxy" => "0"
 );
 
 $config_parsed = false;
diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc
index 4ea7c32..a192bd3 100644
--- a/etc/inc/gwlb.inc
+++ b/etc/inc/gwlb.inc
@@ -532,4 +532,4 @@ function get_interface_gateway($interface, &$dynamic = false) {
         return ($gw);
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index 4636c3e..3a309eb 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -84,6 +84,85 @@ function does_interface_exist($interface) {
 		return false;
 }
 
+function interface_netgraph_needed($interface = "wan") {
+	global $config;
+
+	$found = false;
+	if (!empty($config['pptpd']) &&
+		$config['pptpd']['mode'] == "server")
+		$found = true;
+	if ($found == false && !empty($config['l2tp']) &&
+		$config['l2tp']['mode'] == "server")
+		$found = true;
+	if ($found == false && is_array($config['pppoes']['pppoe'])) {
+		foreach ($config['pppoes']['pppoe'] as $pppoe) {
+			if ($pppoe['mode'] != "server")
+				continue;
+			if ($pppoe['interface'] == $interface)
+				$found = true;
+				break;
+		}
+	}
+	if ($found == false) {
+		if (!empty($config['interfaces'][$interface])) {
+			switch ($config['interfaces'][$interface]['ipaddr']) {
+			case "ppp":
+			case "pppoe":
+			case "l2tp":
+			case "pptp":
+				$found = true;
+				break;
+			default:
+				$found = false;
+				break;
+			}
+		}
+	}
+	if ($found == false) {
+		$realif = get_real_interface($interface);
+		if (is_array($config['ppps']['ppp']) && count($config['ppps']['ppp'])) {
+			foreach ($config['ppps']['ppp'] as $pppid => $ppp) {
+
+/* This if block doesn't do anything. It can be deleted.
+PPP interfaces are found above in the previous if ($found == false) block.
+This block of code is only entered for OPTx interfaces that are configured for PPPoE modem access, so $realif != $ppp['if']
+
+				if ($realif == $ppp['if']) {
+					$found = true;
+					break;
+				}
+*/			
+				$ports = explode(',',$ppp['ports']);
+				foreach($ports as $pid => $port){
+					$port = get_real_interface($port);
+					if ($realif == $port) {
+						$found = true;
+						break;
+					}
+					/* Find the parent interfaces of the vlans in the MLPPP configs 
+					* there should be only one element in the array here 
+					* -- this could be better . . . */
+					$parent_if = get_parent_interface($port);
+					if ($realif == $parent_if[0]) {
+						$found = true;
+						break;
+					}
+				}
+			}
+		}
+	}
+	
+	if ($found == false) {
+		$realif = get_real_interface($interface);
+		pfSense_ngctl_detach("{$realif}:", $realif);
+	}
+	/* NOTE: We make sure for this on interface_ppps_configure()
+	 *	no need to do it here agan.
+	 *	else
+	 *		pfSense_ngctl_attach(".", $realif);
+	 */
+}
+
 function interfaces_loopback_configure() {
 	if($g['booting'])
 		echo "Configuring loopback interface...";
@@ -873,13 +952,15 @@ function interface_bring_down($interface = "wan", $destroy = false) {
 		if (is_array($config['ppps']['ppp']) && count($config['ppps']['ppp'])) {
 			foreach ($config['ppps']['ppp'] as $pppid => $ppp) {
 				if ($realif == $ppp['if']) {
-					if (file_exists("{$g['varrun_path']}/{$ifcfg['ipaddr']}_{$interface}.pid")) {
-						killbypid("{$g['varrun_path']}/{$ifcfg['ipaddr']}_{$interface}.pid");
-						sleep(5);
+					if (isset($ppp['ondemand']) && !$destroy){
+						send_event("interface reconfigure {$interface}");
+						break;
+					}
+					if (file_exists("{$g['varrun_path']}/{$ppp['type']}_{$interface}.pid")) {
+						killbypid("{$g['varrun_path']}/{$ppp['type']}_{$interface}.pid");
+						sleep(2);
 					}
 					unlink_if_exists("{$g['varetc_path']}/mpd_{$interface}.conf");
-					if (isset($ppp['ondemand']) && !$destroy)
-						send_event("interface reconfigure {$interface}");
 					break;
 				}
 			}
@@ -893,7 +974,7 @@ function interface_bring_down($interface = "wan", $destroy = false) {
 	case "dhcp":
 		$pid = find_dhclient_process($realif);
 		if($pid)
-			mwexec("kill {$pid}");
+			mwexec("/bin/kill {$pid}");
 		sleep(1);
 		unlink_if_exists("{$g['varetc_path']}/dhclient_{$interface}.conf");
 		if(does_interface_exist("$realif")) {
@@ -1117,6 +1198,7 @@ function interface_ppps_configure($interface) {
 			case "pppoe": 
 				/* Bring the parent interface up */
 				interfaces_bring_up($port);
+				pfSense_ngctl_attach(".", $port);
 				break;
 			case "pptp":
 			case "l2tp":
@@ -1147,6 +1229,7 @@ function interface_ppps_configure($interface) {
 					log_error("Could not get a PPTP/L2TP Remote IP address from {$dhcp_gateway} for {$gway} in interfaces_ppps_configure.");
 					return 0;
 				}
+				pfSense_ngctl_attach(".", $port);
 				break;
 			case "ppp":
 				if (!file_exists("{$port}")) {
@@ -1442,7 +1525,7 @@ EOD;
 			conf_mount_ro();
 		}
 	}
-		
+
 	/* fire up mpd */
 	mwexec("/usr/local/sbin/mpd5 -b -k -d {$g['varetc_path']} -f mpd_{$interface}.conf -p {$g['varrun_path']}/{$ppp['type']}_{$interface}.pid -s ppp {$ppp['type']}client");
 
@@ -1749,7 +1832,10 @@ function interface_carp_configure(&$vip) {
 	get_interface_arr(true);
 
 	$broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']);
-	mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} advbase {$vip['advbase']} {$password}");
+	$advbase = "";
+	if (!empty($vip['advbase']))
+		$advbase = "advbase {$vip['advbase']}";
+	mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$advbase} {$password}");
 
 	interfaces_bring_up($vipif);
 	
@@ -2387,7 +2473,7 @@ function find_dhclient_process($interface) {
 	else
 		$pid = 0;
 
-	return $pid;
+	return intval($pid);
 }
 
 function interface_configure($interface = "wan", $reloadall = false, $linkupevent = false) {
@@ -2397,7 +2483,9 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven
 	$wancfg = $config['interfaces'][$interface];
 
 	$realif = get_real_interface($interface);
-	$realhwif = interface_translate_type_to_real($interface);
+	$realhwif_array = get_parent_interface($interface);
+	// Need code to handle MLPPP if we ever use $realhwif for MLPPP handling
+	$realhwif = $realhwif_array[0];
 
 	if (!$g['booting']) {
 		/* remove all IPv4 addresses */
@@ -2408,7 +2496,6 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven
 			case 'l2tp':
 			case 'pptp':
 			case 'ppp':
-				interface_bring_down($interface, true);
 				break;
 			default:
 				interface_bring_down($interface);
@@ -2554,6 +2641,8 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven
 
 	if(does_interface_exist($wancfg['if']))
 		interfaces_bring_up($wancfg['if']);
+
+	interface_netgraph_needed($interface);
  	
 	if (!$g['booting']) {
 		link_interface_to_vips($interface, "update");
@@ -2759,9 +2848,13 @@ function convert_real_interface_to_friendly_interface_name($interface = "wan") {
                 if (stristr($interface, "_wlan0") && $config['interfaces'][$if]['if'] == interface_get_wireless_base($interface))
                         return $if;
 
-                $int = interface_translate_type_to_real($if);
-                if ($int == $interface)
+		// XXX: This case doesn't work anymore (segfaults - recursion?) - should be replaced with something else or just removed.
+		//      Not to be replaced with get_real_interface - causes slow interface listings here because of recursion!
+		/*
+                $int = get_parent_interface($if);
+                if ($int[0] == $interface)
                         return $ifname;
+		*/
         }
         return NULL;
 }
@@ -2831,37 +2924,63 @@ function convert_real_interface_to_friendly_descr($interface) {
 }
 
 /*
- *  interface_translate_type_to_real($interface):
- *              returns the real hardware interface name for a friendly interface.  ie: wan
+ *  get_parent_interface($interface):
+ *			--returns the (real or virtual) parent interface(s) array for a given interface friendly name (i.e. wan)
+ *				or virtual interface (i.e. vlan)
+ *				(We need array because MLPPP and bridge interfaces have more than one parent.)
+ *			-- returns $interface passed in if $interface parent is not found
+ *			-- returns empty array if an invalid interface is passed
+ *	(Only handles ppps and vlans now.)
  */
-function interface_translate_type_to_real($interface) {
-        global $config;
+function get_parent_interface($interface) {
+	global $config;
 
-	if (empty($config['interfaces'][$interface]))
-		return $interface;
-	$tmpif = $config['interfaces'][$interface];
-	switch ($tmpif['type']) {
-	case "ppp":
-	case "pppoe":
-	case "pptp":
-	case "l2tp":
-		if (is_array($config['ppps']['ppp'])) {
-			foreach ($config['ppps']['ppp'] as $pppidx => $ppp) {
-				if ($tmpif['if'] == $ppp['if']) {
-					$interface = $ppp['ports'];
-					break;
-				}
-			}
+	$parents = array();
+	//Check that we got a valid interface passed
+	$realif = get_real_interface($interface);
+	if ($realif == NULL)
+		return $parents;
+
+	// If we got a real interface, find it's friendly assigned name
+	$interface = convert_real_interface_to_friendly_interface_name($interface);
+		
+	if (!empty($interface) && isset($config['interfaces'][$interface])) {
+		$ifcfg = $config['interfaces'][$interface];
+		switch ($ifcfg['ipaddr']) {
+			case "ppp":
+			case "pppoe":
+			case "pptp":
+			case "l2tp":
+				if (empty($parents))
+					if (is_array($config['ppps']['ppp']))
+						foreach ($config['ppps']['ppp'] as $pppidx => $ppp) {
+							if ($ppp_if == $ppp['if']) {
+								$ports = explode(',', $ppp['ports']);
+								foreach ($ports as $pid => $parent_if) 
+									$parents[$pid] = get_real_interface($parent_if);
+								break;
+							}
+						}
+				break;
+			case "dhcp":
+			case "static":
+			default:
+				// Handle _vlans
+				if (strstr($realif,"_vlan"))
+					if (is_array($config['vlans']['vlan'])) 
+						foreach ($config['vlans']['vlan'] as $vlanidx => $vlan)
+							if ($ifcfg['if'] == $vlan['vlanif']){
+								$parents[0] = $vlan['if'];
+								break;
+							}
+				break;
 		}
-		break;
-	case "dhcp":
-	case "static":
-	default:
-		$interface = $tmpif['if'];
-		break;
 	}
-
-	return $interface;
+	
+	if (empty($parents))
+		$parents[0] = $realif;
+	
+	return $parents;
 }
 
 function interface_is_wireless_clone($wlif) {
@@ -3406,10 +3525,9 @@ function get_wireless_modes($interface) {
 	/* return wireless modes and channels */
 	$wireless_modes = array();
 
-	$wlif = interface_translate_type_to_real($interface);
+	$cloned_interface = get_real_interface($interface);
 
-	if(is_interface_wireless($wlif)) {
-		$cloned_interface = get_real_interface($interface);
+	if($cloned_interface && is_interface_wireless($cloned_interface)) {
 		$chan_list = "/sbin/ifconfig {$cloned_interface} list chan";
 		$stack_list = "/usr/bin/awk -F\"Channel \" '{ gsub(/\\*/, \" \"); print \$2 \"\\\n\" \$3 }'";
 		$format_list = "/usr/bin/awk '{print \$5 \" \" \$6 \",\" \$1}'";
@@ -3452,10 +3570,9 @@ function get_wireless_modes($interface) {
 function get_wireless_channel_info($interface) {
 	$wireless_channels = array();
 
-	$wlif = interface_translate_type_to_real($interface);
+	$cloned_interface = get_real_interface($interface);
 
-	if(is_interface_wireless($wlif)) {
-		$cloned_interface = get_real_interface($interface);
+	if($cloned_interface && is_interface_wireless($cloned_interface)) {
 		$chan_list = "/sbin/ifconfig {$cloned_interface} list txpower";
 		$stack_list = "/usr/bin/awk -F\"Channel \" '{ gsub(/\\*/, \" \"); print \$2 \"\\\n\" \$3 }'";
 		$format_list = "/usr/bin/awk '{print \$1 \",\" \$3 \" \" \$4 \",\" \$5 \",\" \$7}'";
diff --git a/etc/inc/ipsec.inc b/etc/inc/ipsec.inc
index 332f300..2653297 100644
--- a/etc/inc/ipsec.inc
+++ b/etc/inc/ipsec.inc
@@ -469,4 +469,21 @@ function ipsec_mobilekey_sort() {
 	usort($config['ipsec']['mobilekey'], "mobilekeycmp");
 }
 
-?>
\ No newline at end of file
+function ipsec_get_number_of_phase2($ikeid) {
+	global $config;
+    	$a_phase2 = $config['ipsec']['phase2'];
+
+	$nbph2=0;
+
+    	if (is_array($a_phase2) && count($a_phase2)) {
+        	foreach ($a_phase2 as $ph2tmp) {
+            		if ($ph2tmp['ikeid'] == $ikeid) {
+				$nbph2++;
+			}
+		}
+	}
+
+	return $nbph2;
+}
+
+?>
diff --git a/etc/inc/login_sasl_client.inc b/etc/inc/login_sasl_client.inc
new file mode 100644
index 0000000..923d16e
--- /dev/null
+++ b/etc/inc/login_sasl_client.inc
@@ -0,0 +1,69 @@
+<?php
+/*
+ * login_sasl_client.php
+ *
+ * @(#) $Id: login_sasl_client.php,v 1.2 2004/11/17 08:00:37 mlemos Exp $
+ *
+ */
+
+define("SASL_LOGIN_STATE_START",             0);
+define("SASL_LOGIN_STATE_IDENTIFY_USER",     1);
+define("SASL_LOGIN_STATE_IDENTIFY_PASSWORD", 2);
+define("SASL_LOGIN_STATE_DONE",              3);
+
+class login_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_LOGIN_STATE_START;
+
+	Function Initialize(&$client)
+	{
+		return(1);
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_LOGIN_STATE_START)
+		{
+			$client->error="LOGIN authentication state is not at the start";
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			"user"=>"",
+			"password"=>"",
+			"realm"=>""
+		);
+		$defaults=array(
+			"realm"=>""
+		);
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+			$this->state=SASL_LOGIN_STATE_IDENTIFY_USER;
+		Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+			case SASL_LOGIN_STATE_IDENTIFY_USER:
+				$message=$this->credentials["user"].(strlen($this->credentials["realm"]) ? "@".$this->credentials["realm"] : "");
+				$this->state=SASL_LOGIN_STATE_IDENTIFY_PASSWORD;
+				break;
+			case SASL_LOGIN_STATE_IDENTIFY_PASSWORD:
+				$message=$this->credentials["password"];
+				$this->state=SASL_LOGIN_STATE_DONE;
+				break;
+			case SASL_LOGIN_STATE_DONE:
+				$client->error="LOGIN authentication was finished without success";
+				break;
+			default:
+				$client->error="invalid LOGIN authentication step state";
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/notices.inc b/etc/inc/notices.inc
index 34cbd82..0cbf5fd 100644
--- a/etc/inc/notices.inc
+++ b/etc/inc/notices.inc
@@ -283,6 +283,7 @@ function notify_via_smtp($message) {
 			return;
 	}
 
+	require_once("sasl.inc");
 	require_once("smtp.inc");
 
 	$smtp = new smtp_class;
@@ -306,7 +307,7 @@ function notify_via_smtp($message) {
 	if($config['notifications']['smtp']['username'] && 
 	   $config['notifications']['smtp']['password']) {
 		$smtp->authentication_mechanism = "PLAIN";
-		$smtp->username = $config['notifications']['smtp']['username'];
+		$smtp->user = $config['notifications']['smtp']['username'];
 		$smtp->password = $config['notifications']['smtp']['password'];
 	}
 
@@ -379,4 +380,4 @@ function register_via_growl() {
 	}
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/ntlm_sasl_client.inc b/etc/inc/ntlm_sasl_client.inc
new file mode 100644
index 0000000..406edf2
--- /dev/null
+++ b/etc/inc/ntlm_sasl_client.inc
@@ -0,0 +1,180 @@
+<?php
+/*
+ * ntlm_sasl_client.php
+ *
+ * @(#) $Id: ntlm_sasl_client.php,v 1.3 2004/11/17 08:00:37 mlemos Exp $
+ *
+ */
+
+define("SASL_NTLM_STATE_START",             0);
+define("SASL_NTLM_STATE_IDENTIFY_DOMAIN",   1);
+define("SASL_NTLM_STATE_RESPOND_CHALLENGE", 2);
+define("SASL_NTLM_STATE_DONE",              3);
+
+class ntlm_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_NTLM_STATE_START;
+
+	Function Initialize(&$client)
+	{
+		if(!function_exists($function="mcrypt_encrypt")
+		|| !function_exists($function="mhash"))
+		{
+			$extensions=array(
+				"mcrypt_encrypt"=>"mcrypt",
+				"mhash"=>"mhash"
+			);
+			$client->error="the extension ".$extensions[$function]." required by the NTLM SASL client class is not available in this PHP configuration";
+			return(0);
+		}
+		return(1);
+	}
+
+	Function ASCIIToUnicode($ascii)
+	{
+		for($unicode="",$a=0;$a<strlen($ascii);$a++)
+			$unicode.=substr($ascii,$a,1).chr(0);
+		return($unicode);
+	}
+
+	Function TypeMsg1($domain,$workstation)
+	{
+		$domain_length=strlen($domain);
+		$workstation_length=strlen($workstation);
+		$workstation_offset=32;
+		$domain_offset=$workstation_offset+$workstation_length;
+		return(
+			"NTLMSSP\0".
+			"\x01\x00\x00\x00".
+			"\x07\x32\x00\x00".
+			pack("v",$domain_length).
+			pack("v",$domain_length).
+			pack("V",$domain_offset).
+			pack("v",$workstation_length).
+			pack("v",$workstation_length).
+			pack("V",$workstation_offset).
+			$workstation.
+			$domain
+		);
+	}
+
+	Function NTLMResponse($challenge,$password)
+	{
+		$unicode=$this->ASCIIToUnicode($password);
+		$md4=mhash(MHASH_MD4,$unicode);
+		$padded=$md4.str_repeat(chr(0),21-strlen($md4));
+		$iv_size=mcrypt_get_iv_size(MCRYPT_DES,MCRYPT_MODE_ECB);
+		$iv=mcrypt_create_iv($iv_size,MCRYPT_RAND);
+		for($response="",$third=0;$third<21;$third+=7)
+		{
+			for($packed="",$p=$third;$p<$third+7;$p++)
+				$packed.=str_pad(decbin(ord(substr($padded,$p,1))),8,"0",STR_PAD_LEFT);
+			for($key="",$p=0;$p<strlen($packed);$p+=7)
+			{
+				$s=substr($packed,$p,7);
+				$b=$s.((substr_count($s,"1") % 2) ? "0" : "1");
+				$key.=chr(bindec($b));
+			}
+			$ciphertext=mcrypt_encrypt(MCRYPT_DES,$key,$challenge,MCRYPT_MODE_ECB,$iv);
+			$response.=$ciphertext;
+		}
+		return $response;
+	}
+
+	Function TypeMsg3($ntlm_response,$user,$domain,$workstation)
+	{
+		$domain_unicode=$this->ASCIIToUnicode($domain);
+		$domain_length=strlen($domain_unicode);
+		$domain_offset=64;
+		$user_unicode=$this->ASCIIToUnicode($user);
+		$user_length=strlen($user_unicode);
+		$user_offset=$domain_offset+$domain_length;
+		$workstation_unicode=$this->ASCIIToUnicode($workstation);
+		$workstation_length=strlen($workstation_unicode);
+		$workstation_offset=$user_offset+$user_length;
+		$lm="";
+		$lm_length=strlen($lm);
+		$lm_offset=$workstation_offset+$workstation_length;
+		$ntlm=$ntlm_response;
+		$ntlm_length=strlen($ntlm);
+		$ntlm_offset=$lm_offset+$lm_length;
+		$session="";
+		$session_length=strlen($session);
+		$session_offset=$ntlm_offset+$ntlm_length;
+		return(
+			"NTLMSSP\0".
+			"\x03\x00\x00\x00".
+			pack("v",$lm_length).
+			pack("v",$lm_length).
+			pack("V",$lm_offset).
+			pack("v",$ntlm_length).
+			pack("v",$ntlm_length).
+			pack("V",$ntlm_offset).
+			pack("v",$domain_length).
+			pack("v",$domain_length).
+			pack("V",$domain_offset).
+			pack("v",$user_length).
+			pack("v",$user_length).
+			pack("V",$user_offset).
+			pack("v",$workstation_length).
+			pack("v",$workstation_length).
+			pack("V",$workstation_offset).
+			pack("v",$session_length).
+			pack("v",$session_length).
+			pack("V",$session_offset).
+			"\x01\x02\x00\x00".
+			$domain_unicode.
+			$user_unicode.
+			$workstation_unicode.
+			$lm.
+			$ntlm
+		);
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_NTLM_STATE_START)
+		{
+			$client->error="NTLM authentication state is not at the start";
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			"user"=>"",
+			"password"=>"",
+			"realm"=>"",
+			"workstation"=>""
+		);
+		$defaults=array();
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+			$this->state=SASL_NTLM_STATE_IDENTIFY_DOMAIN;
+		Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+			case SASL_NTLM_STATE_IDENTIFY_DOMAIN:
+				$message=$this->TypeMsg1($this->credentials["realm"],$this->credentials["workstation"]);
+				$this->state=SASL_NTLM_STATE_RESPOND_CHALLENGE;
+				break;
+			case SASL_NTLM_STATE_RESPOND_CHALLENGE:
+				$ntlm_response=$this->NTLMResponse(substr($response,24,8),$this->credentials["password"]);
+				$message=$this->TypeMsg3($ntlm_response,$this->credentials["user"],$this->credentials["realm"],$this->credentials["workstation"]);
+				$this->state=SASL_NTLM_STATE_DONE;
+				break;
+			case SASL_NTLM_STATE_DONE:
+				$client->error="NTLM authentication was finished without success";
+				return(SASL_FAIL);
+			default:
+				$client->error="invalid NTLM authentication step state";
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/openvpn.auth-user.php b/etc/inc/openvpn.auth-user.php
index 9ca76cf..35d79cd 100755
--- a/etc/inc/openvpn.auth-user.php
+++ b/etc/inc/openvpn.auth-user.php
@@ -127,4 +127,4 @@ syslog(LOG_WARNING, "user {$username} authenticated\n");
 
 exit(0);
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 234f756..496b8bc 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -172,6 +172,23 @@ function openvpn_get_cipherlist() {
 	return $ciphers;
 }
 
+function openvpn_get_engines() {
+	$openssl_engines = array('none' => 'No Hardware Crypto Acceleration');
+	exec("/usr/bin/openssl engine", $openssl_engine_output);
+	foreach ($openssl_engine_output as $oeo) {
+		$linematch = array();
+		preg_match("/\((.*)\)\s(.*)/", $oeo, $linematch);
+		if ($linematch[1] != "dynamic")
+			$openssl_engines[$linematch[1]] = $linematch[2];
+	}
+	return $openssl_engines;
+}
+
+function openvpn_validate_engine($engine) {
+	$engines = openvpn_get_engines();
+	return array_key_exists($engine, $engines);
+}
+
 function openvpn_validate_host($value, $name) {
 	$value = trim($value);
 	if (empty($value) || (!is_domain($value) && !is_ipaddr($value)))
@@ -261,7 +278,7 @@ function openvpn_add_keyfile(& $data, & $conf, $mode_id, $directive, $opt = "")
 	$conf .= "{$directive} {$fpath} {$opt}\n";
 }
 
-function openvpn_reconfigure($mode,& $settings) {
+function openvpn_reconfigure($mode, $settings) {
 	global $g, $config;
 
 	if (empty($settings))
@@ -343,6 +360,9 @@ function openvpn_reconfigure($mode,& $settings) {
 		$conf .= "local {$iface_ip}\n";	
 	}
 
+	if (openvpn_validate_engine($settings['engine']) && ($settings['engine'] != "none"))
+		$conf .= "engine {$settings['engine']}\n";
+
 	// server specific settings
 	if ($mode == 'server') {
 
@@ -431,6 +451,8 @@ function openvpn_reconfigure($mode,& $settings) {
 					$conf .= "client-to-client\n";
 				break;
 		}
+		if (isset($settings['duplicate_cn']))
+			$conf .= "duplicate-cn\n";
 	}
 
 	// client specific settings
@@ -514,7 +536,7 @@ function openvpn_reconfigure($mode,& $settings) {
 				openvpn_add_keyfile($crl['text'], $conf, $mode_id, "crl-verify");
 			}
 			if ($settings['tls']) {
-				if (stristr($settings['mode'], "server"))
+				if ($mode == "server") 
 					$tlsopt = 0;
 				else
 					$tlsopt = 1;
@@ -549,7 +571,7 @@ function openvpn_reconfigure($mode,& $settings) {
 	@chmod("{$g['varetc_path']}/openvpn/{$mode_id}.conf", 0600);
 }
 
-function openvpn_restart($mode, & $settings) {
+function openvpn_restart($mode, $settings) {
 	global $g, $config;
 
 	$vpnid = $settings['vpnid'];
@@ -661,7 +683,7 @@ function openvpn_delete_csc(& $settings) {
 }
 
 // Resync the configuration and restart the VPN
-function openvpn_resync($mode, & $settings) {
+function openvpn_resync($mode, $settings) {
 	openvpn_reconfigure($mode, $settings);
 	openvpn_restart($mode, $settings);
 }
@@ -696,9 +718,9 @@ function openvpn_resync_all($interface = "") {
 	}
 */
 	if ($interface <> "")
-		log_error("Resyncing openvpn instances configurations for interface " . convert_friendly_interface_to_friendly_descr($interface) . ".");
+		log_error("Resyncing OpenVPN instances for interface " . convert_friendly_interface_to_friendly_descr($interface) . ".");
 	else
-		log_error("Resyncing openvpn instances configurations."); 
+		log_error("Resyncing OpenVPN instances."); 
 
 	if (is_array($config['openvpn']['openvpn-server'])) {
 		foreach ($config['openvpn']['openvpn-server'] as & $settings) {
diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 8501df1..5d948de 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -1458,17 +1458,35 @@ function read_header($ch, $string) {
 
 function read_body($ch, $string) {
         global $fout, $file_size, $downloaded, $sendto, $static_status, $static_output, $lastseen;
+		global $pkg_interface;
         $length = strlen($string);
         $downloaded += intval($length);
-        $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0);
-        $downloadProgress = 100 - $downloadProgress;
+        if($file_size > 0) {
+                $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0);
+                $downloadProgress = 100 - $downloadProgress;
+        } else
+                $downloadProgress = 0;
         if($lastseen <> $downloadProgress and $downloadProgress < 101) {
                 if($sendto == "status") {
+					if($pkg_interface == "console") {
+						if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) {
+                        	$tostatus = $static_status . $downloadProgress . "%";
+                        	update_status($tostatus);
+						}
+					} else {
                         $tostatus = $static_status . $downloadProgress . "%";
-                        update_status($tostatus);
+                        update_status($tostatus);						
+					}
                 } else {
+					if($pkg_interface == "console") {
+						if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) {
+                        	$tooutput = $static_output . $downloadProgress . "%";
+                        	update_output_window($tooutput);
+						}
+					} else {
                         $tooutput = $static_output . $downloadProgress . "%";
                         update_output_window($tooutput);
+					}
                 }
                 update_progress_bar($downloadProgress);
                 $lastseen = $downloadProgress;
@@ -1486,7 +1504,9 @@ function update_output_window($text) {
         global $pkg_interface;
         $log = ereg_replace("\n", "\\n", $text);
         if($pkg_interface != "console") {
-                echo "\n<script language=\"JavaScript\">this.document.forms[0].output.value = \"" . $log . "\";</script>";
+                echo "\n<script language=\"JavaScript\">\nthis.document.forms[0].output.value = \"" . $log . "\";\n";
+				echo "this.document.forms[0].output.scrollTop = this.document.forms[0].output.scrollHeight;\n";	
+				echo "</script>";
         }
         /* ensure that contents are written out */
         ob_flush();
@@ -2112,4 +2132,4 @@ function filter_rules_compare($a, $b) {
 		return compare_interface_friendly_names($a['interface'], $b['interface']);
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/pkg-utils.inc b/etc/inc/pkg-utils.inc
index 3c8ca98..3a2984a 100644
--- a/etc/inc/pkg-utils.inc
+++ b/etc/inc/pkg-utils.inc
@@ -98,7 +98,7 @@ conf_mount_ro();
  *   
  ******/
 function remove_freebsd_package($packagestring) {
-	exec("/usr/sbin/pkg_delete -x {$packagestring}");
+	exec("/usr/sbin/pkg_delete -x {$packagestring} 2>>/tmp/pkg_delete_errors.txt");
 }
 
 /****f* pkg-utils/is_package_installed
@@ -191,28 +191,34 @@ function get_pkg_sizes($pkgs = 'all') {
  * This function may also print output to the terminal indicating progress.
  */
 function resync_all_package_configs($show_message = false) {
-	global $config, $pkg_interface;
+	global $config, $pkg_interface, $g;
 
 	log_error("Resyncing configuration for all packages.");
+
 	if (!is_array($config['installedpackages']['package']))
 		return;
+
 	if($show_message == true)
 		echo "Syncing packages:";
 
 	conf_mount_rw();
+
 	foreach($config['installedpackages']['package'] as $idx => $package) {
 		if (empty($package['name']))
 			continue;
 		if($show_message == true)
 			echo " " . $package['name'];
 		get_pkg_depends($package['name'], "all");
-		stop_service($package['name']);
+		if($g['booting'] != true)
+			stop_service($package['name']);
 		sync_package($idx, true, true);
 		if($pkg_interface == "console") 
 			echo "\nSyncing packages:";
 	}
+
 	if($show_message == true)
 		echo " done.\n";
+
 	@unlink("/conf/needs_package_sync");
 	conf_mount_ro();
 }
@@ -222,6 +228,8 @@ function resync_all_package_configs($show_message = false) {
  *				package is installed.
  */
 function is_freebsd_pkg_installed($pkg) {
+	if(!$pkg) 
+		return;
 	$output = "";
 	exec("/usr/sbin/pkg_info -E \"{$pkg}*\"", $output, $retval);
 
@@ -303,6 +311,18 @@ function get_pkg_depends($pkg_name, $filetype = ".xml", $format = "files", $retu
 
 function uninstall_package($pkg_name) {
 	global $config, $static_output;
+	global $builder_package_install;
+
+	// Back up /usr/local/lib libraries first if
+	// not running from the builder code.
+	if(!$builder_package_install) {
+		if(!file_exists("/tmp/pkg_libs.tgz")) {
+			$static_output .= "Backing up libraries... ";
+			update_output_window($static_output);
+			exec("/usr/bin/tar czPf /tmp/pkg_libs.tgz `/bin/cat /etc/pfSense_md5.txt | /usr/bin/grep 'local/lib' | /usr/bin/awk '{ print $2 }' | /usr/bin/cut -d'(' -f2 | /usr/bin/cut -d')' -f1`");
+			$static_output .= "\n";
+		}
+	}
 
 	$id = get_pkg_id($pkg_name);
 	if ($id >= 0) {
@@ -315,6 +335,15 @@ function uninstall_package($pkg_name) {
 		}
 	}
 	delete_package_xml($pkg_name);
+
+	// Restore libraries that we backed up if not 
+	// running from the builder code.
+	if(!$builder_package_install) {
+		$static_output .= "Cleaning up... ";
+		update_output_window($static_output);
+		exec("/usr/bin/tar xzPfU /tmp/pkg_libs.tgz -C /");
+		@unlink("/tmp/pkg_libs.tgz");	
+	}
 }
 
 function force_remove_package($pkg_name) {
@@ -326,6 +355,12 @@ function force_remove_package($pkg_name) {
  */
 function sync_package($pkg_name, $sync_depends = true, $show_message = false) {
 	global $config, $config_parsed;
+	global $builder_package_install;
+	
+	// If this code is being called by pfspkg_installer 
+	// which the builder system uses then return (ignore).
+	if($builder_package_install)
+		return;
 	
 	if(empty($config['installedpackages']['package']))
 		return;
@@ -418,16 +453,16 @@ function pkg_fetch_recursive($pkgname, $filename, $dependlevel = 0, $base_url =
 
 	$osname = php_uname("s");
 	$arch =  php_uname("m");
-	$rel = php_uname("r");
-	$rel = substr($rel, 0, strrpos($rel, "-"));
-	$priv_url = "http://ftp2.{$osname}.org/pub/{$osname}/ports/{$arch}/packages-{$rel}/Latest";
+	$rel = strtolower(php_uname("r"));
+	if (substr_count($rel, '-') > 1)
+		$rel = substr($rel, 0, strrpos($rel, "-"));
+	$priv_url = "http://ftp2.{$osname}.org/pub/{$osname}/ports/{$arch}/packages-{$rel}/All";
 	if (empty($base_url))
 		$base_url = $priv_url;
 	if (substr($base_url, -1) == "/")
 		$base_url = substr($base_url, 0, -1);
-	$static_output .= "\n" . str_repeat(" ", $dependlevel * 2) . $pkgname . " ";
 	$fetchto = "{$g['tmp_path']}/apkg_{$filename}";
-	$static_output .= "\n" . str_repeat(" ", $dependlevel * 2 + 1) . "Trying to download {$base_url}/{$filename} ... ";
+	$static_output .= "\n" . str_repeat(" ", $dependlevel * 2 + 1) . "Downloading {$base_url}/{$filename} ... ";
 	if (download_file_with_progress_bar("{$base_url}/{$filename}", $fetchto) !== true) {
 		if ($base_url != $priv_url && download_file_with_progress_bar("{$priv_url}/{$filename}", $fetchto) !== true) {
 			$static_output .= " could not download from there or {$priv_url}/{$filename}.\n";
@@ -438,7 +473,7 @@ function pkg_fetch_recursive($pkgname, $filename, $dependlevel = 0, $base_url =
 			update_output_window($static_output);
 			return false;
 		} else {
-			$static_output .= " downloaded from {$osname} repository instead of provided one.\n";
+			$static_output .= " [{$osname} repository]\n";
 			update_output_window($static_output);
 		}
 	}
@@ -459,8 +494,6 @@ function pkg_fetch_recursive($pkgname, $filename, $dependlevel = 0, $base_url =
 				if (pkg_fetch_recursive($working_depend[1], $depend_filename, $dependlevel + 1, $base_url) == false)
 					return false;
 			} else {
-				//$dependlevel++;
-				$static_output .= "\n" . str_repeat(" ", $dependlevel * 2) . $working_depend[1] . " already installed.";
 				pkg_debug($working_depend[1] . "\n");
 			}
 		}
@@ -505,7 +538,7 @@ function install_package($package, $pkg_info = "") {
 			if($pkg_interface == "console")
 				print "\nERROR! Unable to fetch package configuration file. Aborting package installation.\n";
 			else {
-				$static_output .= "failed!\n\nInstallation aborted.";
+				$static_output .= "failed!\n\nInstallation aborted.\n";
 				update_output_window($static_output);
 				echo "<br>Show <a href=\"pkg_mgr_install.php?showlog=true\">install log</a></center>";
 			}
@@ -528,9 +561,10 @@ function install_package($package, $pkg_info = "") {
 		$changedesc = "Overwrote previous installation of {$pkg_info['name']}.";
 		$to_output = "overwrite!\n";
 	}
-	/* XXX: Fix inclusion of config.inc that causes data loss! */
+	if(file_exists('/conf/needs_package_sync'))
+		@unlink('/conf/needs_package_sync');
 	conf_mount_ro();
-	write_config();
+	write_config("Intermediate config write during package install for {$pkg_info['name']}.");
 	$static_output .= $to_output;
 	update_output_window($static_output);
 	/* install other package components */
@@ -620,18 +654,18 @@ function install_package_xml($pkg) {
 	}
 	$configfile = substr(strrchr($pkg_info['config_file'], '/'), 1);
 	if(file_exists("/usr/local/pkg/" . $configfile)) {
-		$static_output .= "\nLoading package configuration... ";
+		$static_output .= "Loading package configuration... ";
 		update_output_window($static_output);
 		$pkg_config = parse_xml_config_pkg("/usr/local/pkg/" . $configfile, "packagegui");
 		$static_output .= "done.\n";
 		update_output_window($static_output);
-		$static_output .= "\tConfiguring package components...\n";
+		$static_output .= "Configuring package components...\n";
 		if (!empty($pkg_config['filter_rules_needed']))
 			$config['installedpackages']['package'][$pkgid]['filter_rule_function'] = $pkg_config['filter_rules_needed'];
 		update_output_window($static_output);
 		/* modify system files */
 		if(is_array($pkg_config['modify_system']) && is_array($pkg_config['modify_system']['item'])) {
-			$static_output .= "\tSystem files... ";
+			$static_output .= "System files... ";
 			update_output_window($static_output);
 			foreach($pkg_config['modify_system']['item'] as $ms) {
 				if($ms['textneeded']) {
@@ -643,7 +677,7 @@ function install_package_xml($pkg) {
 		}
 		/* download additional files */
 		if(is_array($pkg_config['additional_files_needed'])) {
-			$static_output .= "\tAdditional files... ";
+			$static_output .= "Additional files... ";
 			$static_orig = $static_output;
 			update_output_window($static_output);
 			foreach($pkg_config['additional_files_needed'] as $afn) {
@@ -661,7 +695,7 @@ function install_package_xml($pkg) {
 				if(!is_dir($prefix)) 
 					safe_mkdir($prefix);
  				$static_output .= $filename . " ";
-                                update_output_window($static_output);
+				update_output_window($static_output);
 				if (download_file_with_progress_bar($afn['item'][0], $prefix . $filename) !== true) {
 					$static_output .= "failed.\n";
 					update_output_window($static_output);
@@ -697,7 +731,7 @@ function install_package_xml($pkg) {
 				require_once($pkg_config['include_file']);
 			else {
 				$missing_include = true;
-				$static_output .= "\tInclude " . basename($pkg_config['include_file']) . " is missing!\n";
+				$static_output .= "Include " . basename($pkg_config['include_file']) . " is missing!\n";
 				update_output_window($static_output);
 				/* XXX: Should undo the steps before this?! */
 				return false;
@@ -705,7 +739,7 @@ function install_package_xml($pkg) {
 		}
 		/* sidebar items */
 		if(is_array($pkg_config['menu'])) {
-			$static_output .= "\tMenu items... ";
+			$static_output .= "Menu items... ";
 			update_output_window($static_output);
 			foreach($pkg_config['menu'] as $menu) {
 				if(is_array($config['installedpackages']['menu']))
@@ -719,7 +753,7 @@ function install_package_xml($pkg) {
 		}
 		/* integrated tab items */
 		if(is_array($pkg_config['tabs']['tab'])) {
-			$static_output .= "\tIntegrated Tab items... ";
+			$static_output .= "Integrated Tab items... ";
 			update_output_window($static_output);
 			foreach($pkg_config['tabs']['tab'] as $tab) {
 				if(is_array($config['installedpackages']['tab']))
@@ -733,7 +767,7 @@ function install_package_xml($pkg) {
 		}
 		/* services */
 		if(is_array($pkg_config['service'])) {
-			$static_output .= "\tServices... ";
+			$static_output .= "Services... ";
 			update_output_window($static_output);
 			foreach($pkg_config['service'] as $service) {
 				if(is_array($config['installedpackages']['service']))
@@ -750,21 +784,21 @@ function install_package_xml($pkg) {
 		update_output_window($static_output);
 		if ($missing_include == false) {
 			if($pkg_config['custom_php_global_functions'] <> "") {
-				$static_output .= "\tExecuting custom_php_global_functions()...";
+				$static_output .= "Executing custom_php_global_functions()...";
 				update_output_window($static_output);
 				eval_once($pkg_config['custom_php_global_functions']);
 				$static_output .= "done.\n";
 				update_output_window($static_output);
 			}
 			if($pkg_config['custom_php_install_command']) {
-				$static_output .= "\tExecuting custom_php_install_command()...";
+				$static_output .= "Executing custom_php_install_command()...";
 				update_output_window($static_output);
 				eval_once($pkg_config['custom_php_install_command']);
 				$static_output .= "done.\n";
 				update_output_window($static_output);
 			}
 			if($pkg_config['custom_php_resync_config_command'] <> "") {
-				$static_output .= "\tExecuting custom_php_resync_config_command()...";
+				$static_output .= "Executing custom_php_resync_config_command()...";
 				update_output_window($static_output);
 				eval_once($pkg_config['custom_php_resync_config_command']);
 				$static_output .= "done.\n";
@@ -795,31 +829,54 @@ function install_package_xml($pkg) {
 	return true;
 }
 
+function does_package_depend($pkg) {
+	// Should not happen, but just in case.
+	if(!$pkg)
+		return;
+	$pkg_var_db_dir = glob("/var/db/pkg/{$pkg}*");
+	// If this package has dependency then return true
+	foreach($pkg_var_db_dir as $pvdd) {
+		if (file_exists("{$vardb}/{$pvdd}/+REQUIRED_BY") && count(file("{$vardb}/{$pvdd}/+REQUIRED_BY")) > 0) 
+			return true;
+	}	
+	// Did not find a record of dependencies, so return false.
+	return false;
+}
+
 function delete_package($pkg) {
 	global $config, $g, $static_output, $vardb;
 
-	$pkg = substr(reverse_strrchr($pkg, "."), 0, -1);
+	if(!$pkg) 
+		return;
 
+	$pkg = substr(reverse_strrchr($pkg, "."), 0, -1);
 
-	if (file_exists("{$vardb}/{$pkg}/+REQUIRED_BY") && count(file("{$vardb}/{$pkg}/+REQUIRED_BY")) > 0) {
-		$static_output .= "\tSkipping package deletion for {$pkg} because it is required by other packages.\n";
+	// If package has dependencies then skip it
+	if(does_package_depend($pkg)) {
+		$static_output .= "Skipping package deletion for {$pkg} because it is a dependency.\n";
 		update_output_window($static_output);
-		return;
+		return;		
 	} else {
 		if($pkg)
-			$static_output .= "\tStarting package deletion for {$pkg}...";
-		update_output_window($static_output);
+			$static_output .= "Starting package deletion for {$pkg}...";
+		update_output_window($static_output);		
 	}
+
 	$info = "";
 	exec("/usr/sbin/pkg_info -qrx {$pkg}", $info);
 	remove_freebsd_package($pkg);
 	$static_output .= "done.\n";
 	update_output_window($static_output);
 	foreach($info as $line) {
-		$depend = trim(str_replace("@pkgdep", "", $line), " \n");
-		delete_package($depend);
+		$depend = trim(str_replace("@pkgdep ", "", $line), " \n");
+		// If package has dependencies then skip it
+		if(!does_package_depend($depend)) 			
+			delete_package($depend);
 	}
 
+	/* Rescan directories for what has been left and avoid fooling other programs. */
+	mwexec("/sbin/ldconfig");
+
 	return;
 }
 
@@ -854,7 +911,7 @@ function delete_package_xml($pkg) {
 		$pkg_config = parse_xml_config_pkg("/usr/local/pkg/" . $packages[$pkgid]['configurationfile'], "packagegui");
 		/* remove tab items */
 		if(is_array($pkg_config['tabs'])) {
-			$static_output .= "\tTabs items... ";
+			$static_output .= "Tabs items... ";
 			update_output_window($static_output);
 			if(is_array($pkg_config['tabs']['tab']) && is_array($tabs)) {
 				foreach($pkg_config['tabs']['tab'] as $tab) {
@@ -871,7 +928,7 @@ function delete_package_xml($pkg) {
 		}
 		/* remove menu items */
 		if(is_array($pkg_config['menu'])) {
-			$static_output .= "\tMenu items... ";
+			$static_output .= "Menu items... ";
 			update_output_window($static_output);
 			if (is_array($pkg_config['menu']) && is_array($menus)) {
 				foreach($pkg_config['menu'] as $menu) {
@@ -888,13 +945,14 @@ function delete_package_xml($pkg) {
 		}
 		/* remove services */
 		if(is_array($pkg_config['service'])) {
-			$static_output .= "\tServices... ";
+			$static_output .= "Services... ";
 			update_output_window($static_output);
 			if (is_array($pkg_config['service']) && is_array($services)) {
 				foreach($pkg_config['service'] as $service) {
 					foreach($services as $key => $instservice) {
 						if($instservice['name'] == $service['name']) {
-							stop_service($service['name']);
+							if($g['booting'] != true)
+								stop_service($service['name']);
 							unset($services[$key]);
 						}
 					}
@@ -907,7 +965,7 @@ function delete_package_xml($pkg) {
 		 * XXX: Otherwise inclusion of config.inc again invalidates actions taken.
 		 * 	Same is done during installation.
 		 */
-		write_config();
+		write_config("Intermediate config write during package removal for {$pkg}.");
 
 		/*
 		 * If a require exists, include it.  this will
@@ -924,7 +982,7 @@ function delete_package_xml($pkg) {
 			else {
 				$missing_include = true;
 				update_output_window($static_output);
-				$static_output .= "\tInclude file " . basename($pkg_config['include_file']) . " could not be found for inclusion.\n";
+				$static_output .= "Include file " . basename($pkg_config['include_file']) . " could not be found for inclusion.\n";
 			}
 		}
 		/* ermal
@@ -940,7 +998,7 @@ function delete_package_xml($pkg) {
 		}
 		/* system files */
 		if(is_array($pkg_config['modify_system']) && is_array($pkg_config['modify_system']['item'])) {
-			$static_output .= "\tSystem files... ";
+			$static_output .= "System files... ";
 			update_output_window($static_output);
 			foreach($pkg_config['modify_system']['item'] as $ms)
 				if($ms['textneeded']) remove_text_from_file($ms['modifyfilename'], $ms['textneeded']);
@@ -950,27 +1008,26 @@ function delete_package_xml($pkg) {
 		}
 		/* deinstall commands */
 		if($pkg_config['custom_php_deinstall_command'] <> "") {
-			$static_output .= "\tDeinstall commands... ";
+			$static_output .= "Deinstall commands... ";
 			update_output_window($static_output);
 			if ($missing_include == false) {
 				eval_once($pkg_config['custom_php_deinstall_command']);
 				$static_output .= "done.\n";
 			} else
-				$static_output .= "\n\tNot executing custom deinstall hook because an include is missing.\n";
+				$static_output .= "\nNot executing custom deinstall hook because an include is missing.\n";
 			update_output_window($static_output);
 		}
 		if($pkg_config['include_file'] <> "") {
-                        $static_output .= "\tRemoving package instructions...";
-                        update_output_window($static_output);
-                        pkg_debug("Remove '{$pkg_config['include_file']}'\n");
-                        unlink_if_exists("/usr/local/pkg/" . $pkg_config['include_file']);
+			$static_output .= "Removing package instructions...";
+			update_output_window($static_output);
+			pkg_debug("Remove '{$pkg_config['include_file']}'\n");
+			unlink_if_exists("/usr/local/pkg/" . $pkg_config['include_file']);
 			$static_output .= "done.\n";
-                        update_output_window($static_output);
-			
-                }
+			update_output_window($static_output);
+		}
 		/* remove all additional files */
 		if(is_array($pkg_config['additional_files_needed'])) {
-			$static_output .= "\tAuxiliary files... ";
+			$static_output .= "Auxiliary files... ";
 			update_output_window($static_output);
 			foreach($pkg_config['additional_files_needed'] as $afn) {
 				$filename = get_filename_from_url($afn['item'][0]);
@@ -978,14 +1035,13 @@ function delete_package_xml($pkg) {
 					$prefix = $afn['prefix'];
 				else
 					$prefix = "/usr/local/pkg/";
-
 				unlink_if_exists($prefix . $filename);
 			}
 			$static_output .= "done.\n";
 			update_output_window($static_output);
 		}
 		/* package XML file */
-		$static_output .= "\tPackage XML... ";
+		$static_output .= "Package XML... ";
 		update_output_window($static_output);
 		unlink_if_exists("/usr/local/pkg/" . $packages[$pkgid]['configurationfile']);
 		$static_output .= "done.\n";
@@ -993,7 +1049,7 @@ function delete_package_xml($pkg) {
 	}
 	/* syslog */
 	if(is_array($pkg_info['logging']) && $pkg_info['logging']['logfile_name'] <> "") {
-		$static_output .= "\tSyslog entries... ";
+		$static_output .= "Syslog entries... ";
 		update_output_window($static_output);
 		remove_text_from_file("/etc/syslog.conf", $pkg_info['logging']['facilityname'] . "\t\t\t\t" . $pkg_info['logging']['logfilename']);
 		system_syslogd_start();
@@ -1001,9 +1057,10 @@ function delete_package_xml($pkg) {
 		$static_output .= "done.\n";
 		update_output_window($static_output);
 	}
+	
 	conf_mount_ro();
 	/* remove config.xml entries */
-	$static_output .= "\tConfiguration... ";
+	$static_output .= "Configuration... ";
 	update_output_window($static_output);
 	unset($config['installedpackages']['package'][$pkgid]);
 	$static_output .= "done.\n";
@@ -1081,4 +1138,33 @@ function squash_from_bytes($size, $round = "") {
 	return;
 }
 
+function pkg_reinstall_all() {
+	global $g, $config;
+	$pkg_id = 0;
+	$todo = array();
+	if (is_array($config['installedpackages']['package']))
+		foreach($config['installedpackages']['package'] as $package)
+			$todo[] = array('name' => $package['name'], 'version' => $package['version']);
+	echo "One moment please, reinstalling packages...\n";
+	echo " >>> Trying to fetch package info...";
+	$pkg_info = get_pkg_info();
+	if ($pkg_info) {
+		echo " Done.\n";
+	} else {
+		$xmlrpc_base_url = isset($config['system']['altpkgrepo']['enable']) ? $config['system']['altpkgrepo']['xmlrpcbaseurl'] : $g['xmlrpcbaseurl'];
+		echo "\n" . sprintf(gettext(' >>> Unable to communicate with %1$s. Please verify DNS and interface configuration, and that %2$s has functional Internet connectivity.'), $xmlrpc_base_url, $g['product_name']) . "\n";
+		return;
+	}
+	if(is_array($todo)) {
+		foreach($todo as $pkgtodo) {
+			$static_output = "";
+			if($pkgtodo['name']) {
+				uninstall_package($pkgtodo['name']);
+				install_package($pkgtodo['name']);
+				$pkg_id++;
+			}
+		}
+	}
+}
+
 ?>
diff --git a/etc/inc/plain_sasl_client.inc b/etc/inc/plain_sasl_client.inc
new file mode 100644
index 0000000..c7feed0
--- /dev/null
+++ b/etc/inc/plain_sasl_client.inc
@@ -0,0 +1,99 @@
+<?php
+/*
+ * plain_sasl_client.php
+ *
+ * @(#) $Id: plain_sasl_client.php,v 1.2 2004/11/17 08:00:37 mlemos Exp $
+ *
+ */
+
+define("SASL_PLAIN_STATE_START",    0);
+define("SASL_PLAIN_STATE_IDENTIFY", 1);
+define("SASL_PLAIN_STATE_DONE",     2);
+
+define("SASL_PLAIN_DEFAULT_MODE",            0);
+define("SASL_PLAIN_EXIM_MODE",               1);
+define("SASL_PLAIN_EXIM_DOCUMENTATION_MODE", 2);
+
+class plain_sasl_client_class
+{
+	var $credentials=array();
+	var $state=SASL_PLAIN_STATE_START;
+
+	Function Initialize(&$client)
+	{
+		return(1);
+	}
+
+	Function Start(&$client, &$message, &$interactions)
+	{
+		if($this->state!=SASL_PLAIN_STATE_START)
+		{
+			$client->error="PLAIN authentication state is not at the start";
+			return(SASL_FAIL);
+		}
+		$this->credentials=array(
+			"user"=>"",
+			"password"=>"",
+			"realm"=>"",
+			"mode"=>""
+		);
+		$defaults=array(
+			"realm"=>"",
+			"mode"=>""
+		);
+		$status=$client->GetCredentials($this->credentials,$defaults,$interactions);
+		if($status==SASL_CONTINUE)
+		{
+			switch($this->credentials["mode"])
+			{
+				case SASL_PLAIN_EXIM_MODE:
+					$message=$this->credentials["user"]."\0".$this->credentials["password"]."\0";
+					break;
+				case SASL_PLAIN_EXIM_DOCUMENTATION_MODE:
+					$message="\0".$this->credentials["user"]."\0".$this->credentials["password"];
+					break;
+				default:
+					$message=$this->credentials["user"]."\0".$this->credentials["user"].(strlen($this->credentials["realm"]) ? "@".$this->credentials["realm"] : "")."\0".$this->credentials["password"];
+					break;
+			}
+			$this->state=SASL_PLAIN_STATE_DONE;
+		}
+		else
+			Unset($message);
+		return($status);
+	}
+
+	Function Step(&$client, $response, &$message, &$interactions)
+	{
+		switch($this->state)
+		{
+/*
+			case SASL_PLAIN_STATE_IDENTIFY:
+				switch($this->credentials["mode"])
+				{
+					case SASL_PLAIN_EXIM_MODE:
+						$message=$this->credentials["user"]."\0".$this->credentials["password"]."\0";
+						break;
+					case SASL_PLAIN_EXIM_DOCUMENTATION_MODE:
+						$message="\0".$this->credentials["user"]."\0".$this->credentials["password"];
+						break;
+					default:
+						$message=$this->credentials["user"]."\0".$this->credentials["user"].(strlen($this->credentials["realm"]) ? "@".$this->credentials["realm"] : "")."\0".$this->credentials["password"];
+						break;
+				}
+				var_dump($message);
+				$this->state=SASL_PLAIN_STATE_DONE;
+				break;
+*/
+			case SASL_PLAIN_STATE_DONE:
+				$client->error="PLAIN authentication was finished without success";
+				return(SASL_FAIL);
+			default:
+				$client->error="invalid PLAIN authentication step state";
+				return(SASL_FAIL);
+		}
+		return(SASL_CONTINUE);
+	}
+};
+
+?>
\ No newline at end of file
diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc
index f8f027b..ce9797a 100644
--- a/etc/inc/rrd.inc
+++ b/etc/inc/rrd.inc
@@ -175,6 +175,8 @@ function enable_rrd_graphing() {
 	$mem = "-memory.rrd";
 	$cellular = "-cellular.rrd";
 	$vpnusers = "-vpnusers.rrd";
+	$captiveportalconcurrent = "-concurrent.rrd";
+	$captiveportalloggedin = "-loggedin.rrd";
 
 	$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
 	$netstat = "/usr/bin/netstat";
@@ -186,6 +188,7 @@ function enable_rrd_graphing() {
 	$top = "/usr/bin/top";
 	$spamd_gather = "/usr/local/bin/spamd_gather_stats.php";
 	$ifconfig = "/sbin/ifconfig";
+	$captiveportal_gather = "/usr/local/bin/captiveportal_gather_stats.php";
 
 	$rrdtrafficinterval = 60;
 	$rrdwirelessinterval = 60;
@@ -199,6 +202,7 @@ function enable_rrd_graphing() {
 	$rrdmeminterval = 60;
 	$rrdcellularinterval = 60;
 	$rrdvpninterval = 60;
+	$rrdcaptiveportalinterval = 60;
 
 	$trafficvalid = $rrdtrafficinterval * 2;
 	$wirelessvalid = $rrdwirelessinterval * 2;
@@ -212,6 +216,7 @@ function enable_rrd_graphing() {
 	$memvalid = $rrdmeminterval * 2;
 	$cellularvalid = $rrdcellularinterval * 2;
 	$vpnvalid = $rrdvpninterval * 2;
+	$captiveportalvalid = $rrdcaptiveportalinterval * 2;
 
 	/* Asume GigE for now */
 	$downstream = 125000000;
@@ -602,7 +607,7 @@ function enable_rrd_graphing() {
 
 		/* SPAMD, set up the spamd rrd file */
 		if (isset($config['installedpackages']['spamdsettings']) &&
-			 isset ($config['installedpackages']['spamdsettings']['config'][0]['enablerrd'])) {
+			 $config['installedpackages']['spamdsettings']['config'][0]['enablerrd']) {
 			/* set up the spamd rrd file */
 			if (!file_exists("$rrddbpath$ifname$spamd")) {
 				$rrdcreate = "$rrdtool create $rrddbpath$ifname$spamd --step $rrdspamdinterval ";
@@ -660,6 +665,78 @@ function enable_rrd_graphing() {
 			$rrdupdatesh .= "else $rrdtool update $rrddbpath$ifname$cellular N:U:U; fi\n";
 		}
 
+		/* Captive Portal statistics, set up the rrd file */
+		if(isset($config['captiveportal']['enable'])) {
+			$ifname= "captiveportal";
+			if (!file_exists("$rrddbpath$ifname$captiveportal")) {
+				$rrdcreate = "$rrdtool create $rrddbpath$ifname$captiveportalconcurrent --step $rrdcaptiveportalinterval ";
+				$rrdcreate .= "DS:concurrentusers:GAUGE:$captiveportalvalid:0:10000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:1:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:5:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:60:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:720:3000 ";
+				$rrdcreate .= "RRA:MIN:0.5:1:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:5:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:60:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:720:3000 ";
+				$rrdcreate .= "RRA:MAX:0.5:1:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:5:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:60:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:720:3000 ";
+				$rrdcreate .= "RRA:LAST:0.5:1:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:5:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:60:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:720:3000 ";
+
+				create_new_rrd($rrdcreate);
+			}
+
+			/* enter UNKNOWN values in the RRD so it knows we rebooted. */
+			if($g['booting']) {
+				mwexec("$rrdtool update $rrddbpath$ifname$captiveportalconcurrent N:U");
+			}
+			
+			/* the Captive Portal stats gathering function. */
+			$rrdupdatesh .= "\n";
+			$rrdupdatesh .= "# polling Captive Portal for number of concurrent users\n";
+			$rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalconcurrent \\\n";
+			$rrdupdatesh .= "`$php -q $captiveportal_gather concurrent`\n";
+			
+			$ifname= "captiveportal";
+			if (!file_exists("$rrddbpath$ifname$captiveportal")) {
+				$rrdcreate = "$rrdtool create $rrddbpath$ifname$captiveportalloggedin --step $rrdcaptiveportalinterval ";
+				$rrdcreate .= "DS:loggedinusers:GAUGE:$captiveportalvalid:0:10000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:1:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:5:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:60:1000 ";
+				$rrdcreate .= "RRA:AVERAGE:0.5:720:3000 ";
+				$rrdcreate .= "RRA:MIN:0.5:1:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:5:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:60:1000 ";
+				$rrdcreate .= "RRA:MIN:0.5:720:3000 ";
+				$rrdcreate .= "RRA:MAX:0.5:1:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:5:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:60:1000 ";
+				$rrdcreate .= "RRA:MAX:0.5:720:3000 ";
+				$rrdcreate .= "RRA:LAST:0.5:1:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:5:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:60:1000 ";
+				$rrdcreate .= "RRA:LAST:0.5:720:3000 ";
+
+				create_new_rrd($rrdcreate);
+			}
+
+			/* enter UNKNOWN values in the RRD so it knows we rebooted. */
+			if($g['booting']) {
+				mwexec("$rrdtool update $rrddbpath$ifname$captiveportalloggedin N:U");
+			}
+
+			/* the Captive Portal stats gathering function. */
+			$rrdupdatesh .= "\n";
+			$rrdupdatesh .= "# polling Captive Portal for number of logged in users and concurrent users\n";
+			$rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalloggedin \\\n";
+			$rrdupdatesh .= "`$php -q $captiveportal_gather loggedin`\n";
+		}
 
 		$rrdupdatesh .= "sleep 60\n";
 		$rrdupdatesh .= "done\n";
diff --git a/etc/inc/sasl.inc b/etc/inc/sasl.inc
new file mode 100644
index 0000000..d64442e
--- /dev/null
+++ b/etc/inc/sasl.inc
@@ -0,0 +1,422 @@
+<?php
+/*
+ * sasl.php
+ *
+ * @(#) $Id: sasl.php,v 1.11 2005/10/31 18:43:27 mlemos Exp $
+ *
+ */
+
+define("SASL_INTERACT", 2);
+define("SASL_CONTINUE", 1);
+define("SASL_OK",       0);
+define("SASL_FAIL",    -1);
+define("SASL_NOMECH",  -4);
+
+class sasl_interact_class
+{
+	var $id;
+	var $challenge;
+	var $prompt;
+	var $default_result;
+	var $result;
+};
+
+/*
+{metadocument}<?xml version="1.0" encoding="ISO-8859-1" ?>
+<class>
+
+	<package>net.manuellemos.sasl</package>
+
+	<version>@(#) $Id: sasl.php,v 1.11 2005/10/31 18:43:27 mlemos Exp $</version>
+	<copyright>Copyright © (C) Manuel Lemos 2004</copyright>
+	<title>Simple Authentication and Security Layer client</title>
+	<author>Manuel Lemos</author>
+	<authoraddress>mlemos-at-acm.org</authoraddress>
+
+	<documentation>
+		<idiom>en</idiom>
+		<purpose>Provide a common interface to plug-in driver classes that
+			implement different mechanisms for authentication used by clients of
+			standard protocols like SMTP, POP3, IMAP, HTTP, etc.. Currently the
+			supported authentication mechanisms are: <tt>PLAIN</tt>,
+			<tt>LOGIN</tt>, <tt>CRAM-MD5</tt>, <tt>Digest</tt> and <tt>NTML</tt>
+			(Windows or Samba).</purpose>
+		<usage>.</usage>
+	</documentation>
+
+{/metadocument}
+*/
+
+class sasl_client_class
+{
+	/* Public variables */
+
+/*
+{metadocument}
+	<variable>
+		<name>error</name>
+		<type>STRING</type>
+		<value></value>
+		<documentation>
+			<purpose>Store the message that is returned when an error
+				occurs.</purpose>
+			<usage>Check this variable to understand what happened when a call to
+				any of the class functions has failed.<paragraphbreak />
+				This class uses cumulative error handling. This means that if one
+				class functions that may fail is called and this variable was
+				already set to an error message due to a failure in a previous call
+				to the same or other function, the function will also fail and does
+				not do anything.<paragraphbreak />
+				This allows programs using this class to safely call several
+				functions that may fail and only check the failure condition after
+				the last function call.<paragraphbreak />
+				Just set this variable to an empty string to clear the error
+				condition.</usage>
+		</documentation>
+	</variable>
+{/metadocument}
+*/
+	var $error='';
+
+/*
+{metadocument}
+	<variable>
+		<name>mechanism</name>
+		<type>STRING</type>
+		<value></value>
+		<documentation>
+			<purpose>Store the name of the mechanism that was selected during the
+				call to the <functionlink>Start</functionlink> function.</purpose>
+			<usage>You can access this variable but do not change it.</usage>
+		</documentation>
+	</variable>
+{/metadocument}
+*/
+	var $mechanism='';
+
+/*
+{metadocument}
+	<variable>
+		<name>encode_response</name>
+		<type>BOOLEAN</type>
+		<value>1</value>
+		<documentation>
+			<purpose>Let the drivers inform the applications whether responses
+				need to be encoded.</purpose>
+			<usage>Applications should check this variable before sending
+				authentication responses to the server to determine if the
+				responses need to be encoded, eventually with base64 algorithm.</usage>
+		</documentation>
+	</variable>
+{/metadocument}
+*/
+	var $encode_response=1;
+
+	/* Private variables */
+
+	var $driver;
+	var $drivers=array(
+		"Digest"   => array("digest_sasl_client_class",   "digest_sasl_client.inc"   ),
+		"CRAM-MD5" => array("cram_md5_sasl_client_class", "cram_md5_sasl_client.inc" ),
+		"LOGIN"    => array("login_sasl_client_class",    "login_sasl_client.inc"    ),
+		"NTLM"     => array("ntlm_sasl_client_class",     "ntlm_sasl_client.inc"     ),
+		"PLAIN"    => array("plain_sasl_client_class",    "plain_sasl_client.inc"    ),
+		"Basic"    => array("basic_sasl_client_class",    "basic_sasl_client.inc"    )
+	);
+	var $credentials=array();
+
+	/* Public functions */
+
+/*
+{metadocument}
+	<function>
+		<name>SetCredential</name>
+		<type>VOID</type>
+		<documentation>
+			<purpose>Store the value of a credential that may be used by any of
+			 the supported mechanisms to process the authentication messages and
+			 responses.</purpose>
+			<usage>Call this function before starting the authentication dialog
+				to pass all the credential values that be needed to use the type
+				of authentication that the applications may need.</usage>
+			<returnvalue>.</returnvalue>
+		</documentation>
+		<argument>
+			<name>key</name>
+			<type>STRING</type>
+			<documentation>
+				<purpose>Specify the name of the credential key.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>value</name>
+			<type>STRING</type>
+			<documentation>
+				<purpose>Specify the value for the credential.</purpose>
+			</documentation>
+		</argument>
+		<do>
+{/metadocument}
+*/
+	Function SetCredential($key,$value)
+	{
+		$this->credentials[$key]=$value;
+	}
+/*
+{metadocument}
+		</do>
+	</function>
+{/metadocument}
+*/
+
+/*
+{metadocument}
+	<function>
+		<name>GetCredentials</name>
+		<type>INTEGER</type>
+		<documentation>
+			<purpose>Retrieve the values of one or more credentials to be used by
+				the authentication mechanism classes.</purpose>
+			<usage>This is meant to be used by authentication mechanism driver
+				classes to retrieve the credentials that may be neede.</usage>
+			<returnvalue>The function may return <tt>SASL_CONTINUE</tt> if it
+				succeeded, or <tt>SASL_NOMECH</tt> if it was not possible to
+				retrieve one of the requested credentials.</returnvalue>
+		</documentation>
+		<argument>
+			<name>credentials</name>
+			<type>HASH</type>
+			<documentation>
+				<purpose>Reference to an associative array variable with all the
+					credentials that are being requested. The function initializes
+					this associative array values.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>defaults</name>
+			<type>HASH</type>
+			<documentation>
+				<purpose>Associative arrays with default values for credentials
+					that may have not been defined.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>interactions</name>
+			<type>ARRAY</type>
+			<documentation>
+				<purpose>Not yet in use. It is meant to provide context
+					information to retrieve credentials that may be obtained
+					interacting with the user.</purpose>
+			</documentation>
+		</argument>
+		<do>
+{/metadocument}
+*/
+	Function GetCredentials(&$credentials,$defaults,&$interactions)
+	{
+		Reset($credentials);
+		$end=(GetType($key=Key($credentials))!="string");
+		for(;!$end;)
+		{
+			if(!IsSet($this->credentials[$key]))
+			{
+				if(IsSet($defaults[$key]))
+					$credentials[$key]=$defaults[$key];
+				else
+				{
+					$this->error="the requested credential ".$key." is not defined";
+					return(SASL_NOMECH);
+				}
+			}
+			else
+				$credentials[$key]=$this->credentials[$key];
+			Next($credentials);
+			$end=(GetType($key=Key($credentials))!="string");
+		}
+		return(SASL_CONTINUE);
+	}
+/*
+{metadocument}
+		</do>
+	</function>
+{/metadocument}
+*/
+
+/*
+{metadocument}
+	<function>
+		<name>Start</name>
+		<type>INTEGER</type>
+		<documentation>
+			<purpose>Process the initial authentication step initializing the
+				driver class that implements the first of the list of requested
+				mechanisms that is supported by this SASL client library
+				implementation.</purpose>
+			<usage>Call this function specifying a list of mechanisms that the
+				server supports. If the <argumentlink>
+					<argument>message</argument>
+					<function>Start</function>
+				</argumentlink> argument returns a string, it should be sent to
+				the server as initial message. Check the
+				<variablelink>encode_response</variablelink> variable to determine
+				whether the initial message needs to be encoded, eventually with
+				base64 algorithm, before it is sent to the server.</usage>
+			<returnvalue>The function may return <tt>SASL_CONTINUE</tt> if it
+				could start one of the requested authentication mechanisms. It
+				may return <tt>SASL_NOMECH</tt> if it was not possible to start
+				any of the requested mechanisms. It returns <tt>SASL_FAIL</tt> or
+				other value in case of error.</returnvalue>
+		</documentation>
+		<argument>
+			<name>mechanisms</name>
+			<type>ARRAY</type>
+			<inout />
+			<documentation>
+				<purpose>Define the list of names of authentication mechanisms
+					supported by the that should be tried.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>message</name>
+			<type>STRING</type>
+			<out />
+			<documentation>
+				<purpose>Return the initial message that should be sent to the
+					server to start the authentication dialog. If this value is
+					undefined, no message should be sent to the server.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>interactions</name>
+			<type>ARRAY</type>
+			<documentation>
+				<purpose>Not yet in use. It is meant to provide context
+					information to interact with the end user.</purpose>
+			</documentation>
+		</argument>
+		<do>
+{/metadocument}
+*/
+	Function Start($mechanisms, &$message, &$interactions)
+	{
+		if(strlen($this->error))
+			return(SASL_FAIL);
+		if(IsSet($this->driver))
+			return($this->driver->Start($this,$message,$interactions));
+		$no_mechanism_error="";
+		for($m=0;$m<count($mechanisms);$m++)
+		{
+			$mechanism=$mechanisms[$m];
+			if(IsSet($this->drivers[$mechanism]))
+			{
+				if(!class_exists($this->drivers[$mechanism][0]))
+					require(dirname(__FILE__)."/".$this->drivers[$mechanism][1]);
+				$this->driver=new $this->drivers[$mechanism][0];
+				if($this->driver->Initialize($this))
+				{
+					$this->encode_response=1;
+					$status=$this->driver->Start($this,$message,$interactions);
+					switch($status)
+					{
+						case SASL_NOMECH:
+							Unset($this->driver);
+							if(strlen($no_mechanism_error)==0)
+								$no_mechanism_error=$this->error;
+							$this->error="";
+							break;
+						case SASL_CONTINUE:
+							$this->mechanism=$mechanism;
+							return($status);
+						default:
+							Unset($this->driver);
+							$this->error="";
+							return($status);
+					}
+				}
+				else
+				{
+					Unset($this->driver);
+					if(strlen($no_mechanism_error)==0)
+						$no_mechanism_error=$this->error;
+					$this->error="";
+				}
+			}
+		}
+		$this->error=(strlen($no_mechanism_error) ? $no_mechanism_error : "it was not requested any of the authentication mechanisms that are supported");
+		return(SASL_NOMECH);
+	}
+/*
+{metadocument}
+		</do>
+	</function>
+{/metadocument}
+*/
+
+/*
+{metadocument}
+	<function>
+		<name>Step</name>
+		<type>INTEGER</type>
+		<documentation>
+			<purpose>Process the authentication steps after the initial step,
+				until the authetication iteration dialog is complete.</purpose>
+			<usage>Call this function iteratively after a successful initial
+				step calling the <functionlink>Start</functionlink> function.</usage>
+			<returnvalue>The function returns <tt>SASL_CONTINUE</tt> if step was
+				processed successfully, or returns <tt>SASL_FAIL</tt> in case of
+				error.</returnvalue>
+		</documentation>
+		<argument>
+			<name>response</name>
+			<type>STRING</type>
+			<in />
+			<documentation>
+				<purpose>Pass the response returned by the server to the previous
+					step.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>message</name>
+			<type>STRING</type>
+			<out />
+			<documentation>
+				<purpose>Return the message that should be sent to the server to
+					continue the authentication dialog. If this value is undefined,
+					no message should be sent to the server.</purpose>
+			</documentation>
+		</argument>
+		<argument>
+			<name>interactions</name>
+			<type>ARRAY</type>
+			<documentation>
+				<purpose>Not yet in use. It is meant to provide context
+					information to interact with the end user.</purpose>
+			</documentation>
+		</argument>
+		<do>
+{/metadocument}
+*/
+	Function Step($response, &$message, &$interactions)
+	{
+		if(strlen($this->error))
+			return(SASL_FAIL);
+		return($this->driver->Step($this,$response,$message,$interactions));
+	}
+/*
+{metadocument}
+		</do>
+	</function>
+{/metadocument}
+*/
+
+};
+
+/*
+
+{metadocument}
+</class>
+{/metadocument}
+
+*/
+
+?>
diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index 337bc46..74c923c 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -72,7 +72,7 @@ function services_dhcpd_configure() {
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/etc\n");
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/usr/local/sbin\n");
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/var/db\n");
-	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/var/run\n");	
+	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/var/run\n");
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/usr\n");
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/lib\n");
 	fwrite($fd, "mkdir -p {$g['dhcpd_chroot_path']}/run\n");
@@ -228,6 +228,9 @@ EOPP;
 		$subnet = gen_subnet($ifcfgip, $ifcfgsn);
 		$subnetmask = gen_subnet_mask($ifcfgsn);
 
+		if (!is_ipaddr($subnet))
+			continue;
+
 		if($is_olsr_enabled == true)
 			if($dhcpifconf['netmask'])
 				$subnetmask = gen_subnet_mask($dhcpifconf['netmask']);
@@ -257,7 +260,7 @@ EOPP;
 			$dnscfg .= "	option domain-name-servers " . join(",", $syscfg['dnsserver']) . ";";
 		}
 
-		$dhcpdconf .= "subnet $subnet netmask $subnetmask {\n";
+		$dhcpdconf .= "subnet {$subnet} netmask {$subnetmask} {\n";
 		$dhcpdconf .= "	pool {\n";
 
 		/* is failover dns setup? */
@@ -1378,4 +1381,4 @@ function install_cron_job($command, $active=false, $minute="0", $hour="*", $mont
 	configure_cron();
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc
index 7c61546..85bae2b 100644
--- a/etc/inc/shaper.inc
+++ b/etc/inc/shaper.inc
@@ -31,6 +31,8 @@
 /* XXX: needs some reducing on include. */
 /* include all configuration functions. */
 require_once("functions.inc");
+require_once("util.inc");
+require_once("notices.inc");
 
 /*
  * I admit :) this is derived from xmplparse.inc StartElement()
@@ -122,20 +124,20 @@ function get_bandwidthtype_scale($type)
 {
         switch ($type) {
         case "Gb":
-                $factor = 1000 * 1000 * 1000;
+                $factor = 1024 * 1024 * 1024;
         	break;
         case "Mb":
-                $factor = 1000 * 1000;
+                $factor = 1024 * 1024;
         	break;
         case "Kb":
-                $factor = 1000;
+                $factor = 1024;
         	break;
         case "b":
         default:
                 $factor = 1;
         	break;
         }
-        return floatval($factor);
+        return intval($factor);
 }
 
 function get_hfsc_bandwidth($object, $bw) 
@@ -418,6 +420,7 @@ class altq_root_queue {
 		$q->ReadConfig($queue);
 		$q->validate_input($queue, $input_errors);
 		if (count($input_errors)) {
+			log_error("SHAPER: could not create queue " . $q->GetQname() . " on interface {$interface} because: " . print_r($input_errors, true));
 			return $q;
 		}
 
@@ -514,8 +517,9 @@ class altq_root_queue {
 	 *      foreach ($queues as $qkey => $queue)
 	 *              this->queues[$qkey]->build_rule();
 	 */
-	function build_rules() {
+	function build_rules(&$default = false) {
 		if (count($this->queues) > 0 && $this->GetEnabled() == "on") {
+			$default = false;
 			$rules = " altq on  " . get_real_interface($this->GetInterface());
 			if ($this->GetScheduler())
 				$rules .= " ".strtolower($this->GetScheduler());
@@ -538,9 +542,16 @@ class altq_root_queue {
 				}
 				$rules .= " } \n";
 				foreach ($this->queues as $q) {
-					$rules .= $q->build_rules();
+					$rules .= $q->build_rules($default);
 				}
 			}
+			if ($default == false) {
+				$error = "SHAPER: no default queue specified for interface ". $this->GetInterface() . ". The interface queue will be enforced as default.";
+				file_notice("Shaper", $error, "Error occurred", "");
+				unset($error);
+				return "\n";
+			} 
+			$frule .= $rules;
 		}
 		$rules .= " \n";
 		return $rules;
@@ -1024,7 +1035,7 @@ class priq_queue {
 	/* Should return something like:
 	 * queue $qname on $qinterface bandwidth ....
 	 */
-	function build_rules() {
+	function build_rules(&$default = false) {
 		$pfq_rule = " queue ". $this->qname;
 		if ($this->GetInterface())
 			$pfq_rule .= " on ".get_real_interface($this->GetInterface());
@@ -1060,6 +1071,7 @@ class priq_queue {
 				if ($comma)
 					$pfq_rule .= " ,";
 				$pfq_rule .= " default ";
+				$default = true;
 			}
 			$pfq_rule .= " ) ";
 		}
@@ -1335,6 +1347,7 @@ class hfsc_queue extends priq_queue {
 		$q->ReadConfig($qname);
 		$q->validate_input($qname, $input_errors);
 		if (count($input_errors)) {
+			log_error("SHAPER: could not create queue " . $q->GetQname() . " on interface {$interface} because: " . print_r($input_errors, true));
 			return $q;
 		}
 
@@ -1672,7 +1685,7 @@ class hfsc_queue extends priq_queue {
 	}
 
 	/* Even this should take children into consideration */
-	function build_rules() {
+	function build_rules(&$default = false) {
 
 		$pfq_rule = " queue ". $this->qname;
 		if ($this->GetInterface())
@@ -1711,6 +1724,7 @@ class hfsc_queue extends priq_queue {
 					$pfq_rule .= " ,";
 				$comma = 1;
 				$pfq_rule .= " default ";
+				$default = true;
 			}
 
 			if ($this->GetRealtime() <> "")  {
@@ -1753,7 +1767,7 @@ class hfsc_queue extends priq_queue {
 			}
 			$pfq_rule .= " } \n";
 			foreach ($this->subqueues as $q)
-				$pfq_rule .= $q->build_rules();
+				$pfq_rule .= $q->build_rules(&$default);
 		}
 
 		 $pfq_rule .= " \n";
@@ -2038,6 +2052,7 @@ class cbq_queue extends priq_queue {
 		$q->ReadConfig($qname);
                 $q->validate_input($qname, $input_errors);
                 if (count($input_errors)) {
+			log_error("SHAPER: could not create queue " . $q->GetQname() . " on interface {$interface} because: " . print_r($input_errors, true));
                         return $q;
                 }
                 switch ($q->GetBwscale()) {
@@ -2212,7 +2227,7 @@ class cbq_queue extends priq_queue {
 	}
 		
 	/* Even this should take children into consideration */
-	function build_rules() {
+	function build_rules(&$default = false) {
 		$pfq_rule = "queue ". $this->qname;
 		if ($this->GetInterface())
 			$pfq_rule .= " on ".get_real_interface($this->GetInterface());
@@ -2251,6 +2266,7 @@ class cbq_queue extends priq_queue {
 					$pfq_rule .= " ,";
 				$comma = 1;
 				$pfq_rule .= " default ";
+				$default = true;
 			}
 			$tmpvalue = trim($this->GetBorrow());
 			if (!empty($tmpvalue)) {
@@ -2272,7 +2288,7 @@ class cbq_queue extends priq_queue {
 			}
 			$pfq_rule .= " } \n";
 			foreach ($this->subqueues as $q)
-				$pfq_rule .= $q->build_rules();
+				$pfq_rule .= $q->build_rules($default);
 		}
 
 		$pfq_rule .= " \n";
@@ -2486,7 +2502,7 @@ class fairq_queue extends priq_queue {
 	}
 		
 	/* Even this should take children into consideration */
-	function build_rules() {
+	function build_rules(&$default = false) {
 		$pfq_rule = "queue ". $this->qname;
 		if ($this->GetInterface())
 			$pfq_rule .= " on ".get_real_interface($this->GetInterface());
@@ -2526,6 +2542,7 @@ class fairq_queue extends priq_queue {
 					$pfq_rule .= " ,";
 				$comma = 1;
 				$pfq_rule .= " default ";
+				$default = true;
 			}
 			$tmpvalue = trim($this->GetBuckets());
 			if (!empty($tmpvalue)) {
@@ -2813,8 +2830,10 @@ class dnpipe_class extends dummynet_class {
 		$q->SetParent(&$this);
 		$q->ReadConfig($queue);
 		$q->validate_input($queue, $input_errors);
-		if (count($input_errors))
+		if (count($input_errors)) {
+			log_error("SHAPER: could not create queue " . $q->GetQname() . " on interface {$interface} because: " . print_r($input_errors, true));
 			return $q;
+		}
 		$this->subqueues[$q->GetQname()] = &$q;
             
 		return $q;
@@ -2867,16 +2886,28 @@ class dnpipe_class extends dummynet_class {
 		}
 		if (isset($q['qlimit']) && $q['qlimit'] <> "")
               		$this->SetQlimit($q['qlimit']);
+		else
+              		$this->SetQlimit("");
 		if (isset($q['mask']) && $q['mask'] <> "")
               		$this->SetMask($q['mask']);
+		else
+              		$this->SetMask("");
 		if (isset($q['buckets']) && $q['buckets'] <> "")
               		$this->SetBuckets($q['buckets']);
+		else
+              		$this->SetBuckets("");
             	if (isset($q['plr']) && $q['plr'] <> "")
             		$this->SetPlr($q['plr']);
+		else
+            		$this->SetPlr("");
 		if (isset($q['delay']) && $q['delay'] <> "")
             		$this->SetDelay($q['delay']);
+		else
+			$this->SetDelay(0);
             	if (isset($q['description']) && $q['description'] <> "")
 			$this->SetDescription($q['description']);
+		else
+			$this->SetDescription("");
 		$this->SetEnabled($q['enabled']);
 
         }
@@ -2943,12 +2974,12 @@ class dnpipe_class extends dummynet_class {
 
         function build_form() { 
 		$form = "<tr><td valign=\"center\" class=\"vncellreq\"><br>";
-                $form .= "Enable/Disable";
+                $form .= "Enable";
                 $form .= "</td><td class=\"vncellreq\">";
                 $form .= " <input type=\"checkbox\" id=\"enabled\" name=\"enabled\" value=\"on\"";
                 if ($this->GetEnabled() == "on")
                         $form .=  " CHECKED";
-                $form .= " ><span class=\"vexpl\"> Enable/Disable limiter and its children</span>";
+                $form .= " ><span class=\"vexpl\"> Enable limiter and its children</span>";
                 $form .= "</td></tr>";
 		$form .= "<tr><td valign=\"center\" class=\"vncellreq\"><br><span class=\"vexpl\">Name</span></td>";
 		$form .= "<td class=\"vncellreq\">";
@@ -3137,12 +3168,20 @@ class dnqueue_class extends dummynet_class {
 		$this->SetNumber($q['number']);
 		if (isset($q['qlimit']) && $q['qlimit'] <> "")
        		       	$this->SetQlimit($q['qlimit']);
+		else
+       		       	$this->SetQlimit("");
 		if (isset($q['mask']) && $q['mask'] <> "")
               		$this->SetMask($q['mask']);
+		else
+              		$this->SetMask("");
        		if (isset($q['weight']) && $q['weight'] <> "")
             		$this->SetWeight($q['weight']);
+		else
+            		$this->SetWeight("");
             	if (isset($q['description']) && $q['description'] <> "")
 			$this->SetDescription($q['description']);
+		else
+			$this->SetDescription("");
 		$this->SetEnabled($q['enabled']);
         }
 
@@ -4004,4 +4043,4 @@ $dn_default_shaper_msg .= "buttons at the bottom represent queue actions and are
 $dn_default_shaper_msg .= " </p></strong></span>";
 $dn_default_shaper_msg .= "</td></tr>";
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 430775e..4a8214d 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -86,12 +86,6 @@ function system_resolvconf_generate($dynupdate = false) {
 
 	$syscfg = $config['system'];
 
-	$fd = fopen("{$g['varetc_path']}/resolv.conf", "w");
-	if (!$fd) {
-		printf("Error: cannot open resolv.conf in system_resolvconf_generate().\n");
-		return 1;
-	}
-
 	$resolvconf = "domain {$syscfg['domain']}\n";
 
 	$havedns = false;
@@ -122,6 +116,12 @@ function system_resolvconf_generate($dynupdate = false) {
 		}
 	}
 
+	$fd = fopen("{$g['varetc_path']}/resolv.conf", "w");
+	if (!$fd) {
+		printf("Error: cannot open resolv.conf in system_resolvconf_generate().\n");
+		return 1;
+	}
+
 	fwrite($fd, $resolvconf);
 	fclose($fd);
 
@@ -158,11 +158,16 @@ function get_searchdomains() {
 	$master_list = array();
 	
 	// Read in dhclient nameservers
-	$search_list = split("\n", `/bin/cat /var/etc/searchdomain_* 2>/dev/null`);
+	$search_list = glob("/var/etc/searchdomain_*");
 	if (is_array($search_lists)) {
-		foreach($search_lists as $dns) {
-			if(is_hostname($dns)) 
-				$master_list[] = $dns;
+		foreach($search_lists as $fdns) {
+			$contents = file($fdns, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+			if (!is_array($contents))
+				continue;
+			foreach ($contents as $dns) {
+				if(is_hostname($dns)) 
+					$master_list[] = $dns;
+			}
 		}
 	}
 
@@ -174,21 +179,27 @@ function get_nameservers() {
 	$master_list = array();
 	
 	// Read in dhclient nameservers
-	$dns_lists = split("\n", `/bin/cat /var/etc/nameserver_* 2>/dev/null`);
+	$dns_lists = glob("/var/etc/nameserver_*");
 	if (is_array($dns_lists)) {
-		foreach($dns_lists as $dns) {
-			if(is_ipaddr($dns)) 
-				$master_list[] = $dns;
+		foreach($dns_lists as $fdns) {
+			$contents = file($fdns, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+			if (!is_array($contents))
+				continue;
+			foreach ($contents as $dns) {
+				if(is_ipaddr($dns)) 
+					$master_list[] = $dns;
+			}
 		}
 	}
 
 	// Read in any extra nameservers
 	if(file_exists("/var/etc/nameservers.conf")) {
-		$dns_lists = split("\n", `/bin/cat /var/etc/nameservers.conf`);
-		if(is_array($dns_s))
+		$dns_s = file("/var/etc/nameservers.conf", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+		if(is_array($dns_s)) {
 			foreach($dns_s as $dns)
 				if (is_ipaddr($dns))
 					$master_list[] = $dns;
+		}
 	}
 
 	return $master_list;
@@ -314,6 +325,8 @@ function system_routing_configure($interface = "") {
 		mwexec("/bin/rm {$g['tmp_path']}/*_defaultgw", true);
 		foreach	($config['gateways']['gateway_item'] as $gateway) {
 			if (isset($gateway['defaultgw'])) {
+				if(strstr($gateway['gateway'], ":"))
+					break;
 				if ($gateway['gateway'] == "dynamic")
 					$gateway['gateway'] = get_interface_gateway($gateway['interface']);
 				$gatewayip = $gateway['gateway'];
@@ -365,7 +378,7 @@ function system_routing_configure($interface = "") {
 				$action = "change";
 			}
 			log_error("ROUTING: $action default route to $gatewayip");
-			mwexec("/sbin/route {$action} default " . escapeshellarg($gatewayip));
+			mwexec("/sbin/route {$action} -inet default " . escapeshellarg($gatewayip));
 		}
 	}
 
@@ -379,7 +392,7 @@ function system_routing_configure($interface = "") {
 				continue;
 			}
 			$gateway = $gateways_arr[$rtent['gateway']];
-			if ($interface == $gateway['friendlyiface'])
+			if (!empty($interface) && $interface != $gateway['friendlyiface'])
 				continue;
 			$gatewayip = $gateway['gateway'];
 			$interfacegw = $gateway['interface'];
@@ -388,10 +401,10 @@ function system_routing_configure($interface = "") {
 				$action = "change";
 
 			if (is_ipaddr($gatewayip)) {
-				mwexec("/sbin/route {$action} " . escapeshellarg($rtent['network']) .
+				mwexec("/sbin/route {$action} -inet " . escapeshellarg($rtent['network']) .
 					" " . escapeshellarg($gatewayip));
 			} else if (!empty($interfacegw)) {
-				mwexec("/sbin/route {$action} " . escapeshellarg($rtent['network']) .
+				mwexec("/sbin/route {$action} -inet " . escapeshellarg($rtent['network']) .
 					" -iface " . escapeshellarg($interfacegw));
 			}
 		}
@@ -613,9 +626,14 @@ EOD;
 }
 		fwrite($fd, $syslogconf);
 		fclose($fd);
+
+		// Ensure that the log directory exists
+		if(!is_dir("{$g['dhcpd_chroot_path']}/var/run"))
+			exec("/bin/mkdir -p {$g['dhcpd_chroot_path']}/var/run");
+
 		// Are we logging to a least one remote server ?
 		if(strpos($syslogconf, "@") != false)
-			$retval = system("/usr/sbin/syslogd -c c -l /var/dhcpd/var/run/log -f {$g['varetc_path']}/syslog.conf");
+			$retval = system("/usr/sbin/syslogd -c -c -l /var/dhcpd/var/run/log -f {$g['varetc_path']}/syslog.conf");
 		else
 			$retval = system("/usr/sbin/syslogd -c -c -l /var/dhcpd/var/run/log -f {$g['varetc_path']}/syslog.conf");
 
@@ -689,7 +707,7 @@ function system_webgui_start() {
 			if (!is_array($config['cert']))
 				$config['cert'] = array();
 			$a_cert =& $config['cert'];
-			echo "Creating SSL Certificate... ";
+			log_error("Creating SSL Certificate for this host");
 			$cert = array();
 			$cert['refid'] = uniqid();
 			$cert['descr'] = "webConfigurator default";
@@ -765,7 +783,7 @@ function system_generate_lighty_config($filename,
 	if($captive_portal == true)  {
 		$captiveportal = ",\"mod_rewrite\"";
 		$captive_portal_rewrite = "url.rewrite-once = ( \"(.*captiveportal.*)\" => \"$1\", \"(.*)\" => \"/index.php?redirurl=$1\" )\n";
-		$captive_portal_module = "\"mod_accesslog\", ";
+		$captive_portal_module = "";
 		$maxprocperip = $config['captiveportal']['maxprocperip'];
 		if(!$maxprocperip and $maxprocperip > 0)
 			$captive_portal_mod_evasive = "evasive.max-conns-per-ip = {$maxprocperip}";
@@ -1054,7 +1072,7 @@ EOD;
 		fwrite($fd, "\n");
 		fwrite($fd, $key);
 		fclose($fd);
-		if($ca <> "") {
+		if(!(empty($ca) || (strlen(trim($ca)) == 0))) {
 			$fd = fopen("{$g['varetc_path']}/{$ca_location}", "w");
 			if (!$fd) {
 				printf("Error: cannot open ca.pem in system_webgui_start().\n");
@@ -1068,7 +1086,7 @@ EOD;
 		$lighty_config .= "## ssl configuration\n";
 		$lighty_config .= "ssl.engine = \"enable\"\n";
 		$lighty_config .= "ssl.pemfile = \"{$g['varetc_path']}/{$cert_location}\"\n\n";
-		if($ca <> "")
+		if(!(empty($ca) || (strlen(trim($ca)) == 0)))
 			$lighty_config .= "ssl.ca-file = \"{$g['varetc_path']}/{$ca_location}\"\n\n";
 	}
 
@@ -1472,4 +1490,4 @@ function system_get_dmesg_boot() {
 	return file_get_contents("{$g['varlog_path']}/dmesg.boot");
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index 9f7be86..0454475 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -709,10 +709,14 @@ function upgrade_040_to_041() {
 		$config['sysctl']['item'][19]['descr'] =    "Set the ephemeral port range starting port";
 		$config['sysctl']['item'][19]['value'] =   "default";
 
-		$config['sysctl']['item'][20]['tunable'] = "hw.syscons.kbd_reboot ";
+		$config['sysctl']['item'][20]['tunable'] = "hw.syscons.kbd_reboot";
 		$config['sysctl']['item'][20]['descr'] =    "Enables ctrl+alt+delete";
 		$config['sysctl']['item'][20]['value'] =   "default";
 
+		$config['sysctl']['item'][21]['tunable'] = "kern.ipc.maxsockbuf";
+		$config['sysctl']['item'][21]['descr'] =    "Maximum socket buffer size";
+		$config['sysctl']['item'][21]['value'] =   "default";
+
 	}
 }
 
@@ -817,8 +821,7 @@ function upgrade_044_to_045() {
 	$iflist = get_configured_interface_list(false, true);
 	if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) {
 		foreach ($config['vlans']['vlan'] as $id => $vlan) {
-			$vlan['vlanif'] = "{$vlan['if']}_vlan{$vlan['tag']}";
-			$config['vlans']['vlan'][$id] = $vlan;
+			$config['vlans']['vlan'][$id]['vlanif'] = "{$vlan['if']}_vlan{$vlan['tag']}";
 			/* Make sure to update the interfaces section with the right name */
 			foreach($iflist as $ifname) {
 				if($config['interfaces'][$ifname]['if'] == "vlan{$id}") {
@@ -1083,8 +1086,8 @@ function upgrade_047_to_048() {
 			$tempdyn['enable'] = isset($config['dyndns'][0]['enable']);
 			$tempdyn['type'] = $config['dyndns'][0]['type'];
 			$tempdyn['wildcard'] = isset($config['dyndns'][0]['wildcard']);
-			$tempdyn['usernamefld'] = $config['dyndns'][0]['username'];
-			$tempdyn['passwordfld'] = $config['dyndns'][0]['password'];
+			$tempdyn['username'] = $config['dyndns'][0]['username'];
+			$tempdyn['password'] = $config['dyndns'][0]['password'];
 			$tempdyn['host'] = $config['dyndns'][0]['host'];
 			$tempdyn['mx'] = $config['dyndns'][0]['mx'];		
 			$tempdyn['interface'] = "wan";
@@ -2282,4 +2285,17 @@ function upgrade_074_to_075() {
 		rename_field($config['crl'], 'name', 'descr');
 }
 
+function upgrade_075_to_076() {
+	global $config;
+	$cron_item = array();
+	$cron_item['minute'] = "30";
+	$cron_item['hour'] = "12";
+	$cron_item['mday'] = "*";
+	$cron_item['month'] = "*";
+	$cron_item['wday'] = "*";
+	$cron_item['who'] = "root";
+	$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.update_urltables";
+	$config['cron']['item'][] = $cron_item;
+}
+
 ?>
diff --git a/etc/inc/util.inc b/etc/inc/util.inc
index 3cc88e9..2dbf3ef 100644
--- a/etc/inc/util.inc
+++ b/etc/inc/util.inc
@@ -1237,6 +1237,19 @@ function start_devd() {
         sleep(1);
 }
 
+function is_interface_vlan_mismatch() {
+        global $config, $g;
+
+        if (is_array($config['vlans']['vlan'])) {
+                foreach ($config['vlans']['vlan'] as $vlan) {
+                        if (does_interface_exist($vlan['if']) == false)
+				return true;
+                }
+        }
+
+	return false;
+}
+
 function is_interface_mismatch() {
         global $config, $g;
 
@@ -1485,4 +1498,4 @@ function array_merge_recursive_unique($array0, $array1)
     return $result;
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc
index 3b8e1ac..febb0f7 100644
--- a/etc/inc/voucher.inc
+++ b/etc/inc/voucher.inc
@@ -1,6 +1,8 @@
 <?php
 /*
-    Copyright (C) 2007 Marcel Wiget <mwiget@mac.com>.
+	Copyright (C) 2010 Ermal Luci <ermal.luci@gmail.com>
+	Copyright (C) 2010 Scott Ullrich <sullrich@gmail.com>
+    Copyright (C) 2007 Marcel Wiget <mwiget@mac.com>
     All rights reserved.
     
     Redistribution and use in source and binary forms, with or without
@@ -32,6 +34,8 @@
 */
 
 /* include all configuration functions */
+if(!function_exists('captiveportal_syslog'))
+	require_once("captiveportal.inc");
 
 function xmlrpc_sync_used_voucher($voucher_received, $syncip, $port, $password, $username) {
 	global $g, $config;
@@ -63,14 +67,12 @@ EOF;
 	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
 	$cli->setCredentials($username, $password);
 	$resp = $cli->send($msg, "250");
-	if(!$resp) {
+	if(!is_object($resp)) {
 		$error = "A communications error occurred while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
 		log_error($error);
 		file_notice("CaptivePortalVoucherSync", $error, "Communications error occurred", "");
 		return array("timeleft" => "0");
 	} elseif($resp->faultCode()) {
-		$cli->setDebug(1);
-		$resp = $cli->send($msg, "250");
 		$error = "An error code was received while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
 		log_error($error);
 		file_notice("CaptivePortalVoucherSync", $error, "Error code received", "");
@@ -84,25 +86,24 @@ EOF;
 		write_config("Captive Portal Voucher database synchronized with {$url}");
 		voucher_configure();
 	}
-    return $toreturn['timeleft'];
+
+	return $toreturn['timeleft'];
 }
 
 /* 
- *Authenticate a voucher and return the remaining time credit in minutes
+ * Authenticate a voucher and return the remaining time credit in minutes
  * if $test is set, don't mark the voucher as used nor add it to the list
  * of active vouchers
+ * If $test is set, simply test the voucher. Don't change anything
+ * but return a more verbose error and result message back
  */
 function voucher_auth($voucher_received, $test = 0) {
-
     global $g, $config;
 
-    // if $test is set, simply test the voucher. Don't change anything
-    // but return a more verbose error and result message back
-
     $voucherlck = lock('voucher');
 
 	// XMLRPC Call over to the master Voucher node
-    $a_voucher = &$config['voucher'];
+	$a_voucher = &$config['voucher'];
 	if($a_voucher['vouchersyncdbip']) {
 		$syncip   = $a_voucher['vouchersyncdbip'];
 		$syncport = $a_voucher['vouchersyncport'];
@@ -111,12 +112,16 @@ function voucher_auth($voucher_received, $test = 0) {
 		$remote_time_used = xmlrpc_sync_used_voucher($voucher_received, $syncip, $syncport, $syncpass, $vouchersyncusername);
 	}
 
-    // read rolls into assoc array with rollid as key and minutes as value
-    $a_roll = &$config['voucher']['roll'];
-    foreach ($a_roll as $rollent) {
-        $tickets_per_roll[$rollent['number']] = $rollent['count'];
-        $minutes_per_roll[$rollent['number']] = $rollent['minutes'];
-    }
+	// read rolls into assoc array with rollid as key and minutes as value
+	$tickets_per_roll = array();
+	$minutes_per_roll = array();
+	if (is_array($config['voucher']['roll'])) {
+		$a_roll = &$config['voucher']['roll'];
+		foreach ($a_roll as $rollent) {
+			$tickets_per_roll[$rollent['number']] = $rollent['count'];
+			$minutes_per_roll[$rollent['number']] = $rollent['minutes'];
+		}
+	}
 
     // split into an array. Useful for multiple vouchers given
     $a_vouchers_received = split("[\t\n\r ]+",$voucher_received); 
@@ -138,9 +143,9 @@ function voucher_auth($voucher_received, $test = 0) {
         $result = exec("/usr/local/bin/voucher -c {$g['varetc_path']}/voucher.cfg -k {$g['varetc_path']}/voucher.public -- $v");
         list($status, $roll, $nr) = explode(" ", $result);
         if ($status == "OK") {
-            if (!$first_voucher) 
-            {
-                $first_voucher = $voucher;  // store first voucher. Thats the one we give the timecredit
+            if (!$first_voucher) {
+				// store first voucher. Thats the one we give the timecredit
+                $first_voucher = $voucher;
                 $first_voucher_roll = $roll;
             }
             // check if we have this ticket on a registered roll for this ticket 
@@ -165,6 +170,7 @@ function voucher_auth($voucher_received, $test = 0) {
                     $mask = 1 << ($nr % 8);
                     if (ord($bitstring[$roll][$pos]) & $mask) {
                         $test_result[] = "$voucher ($roll/$nr) already used and expired";
+						captiveportal_syslog("$voucher ($roll/$nr) already used and expired");
                         $total_minutes = -1;    // voucher expired
                         $error++;
                     } else {
@@ -176,10 +182,12 @@ function voucher_auth($voucher_received, $test = 0) {
                 }
             } else {
                 $test_result[] = "$voucher ($roll/$nr): not found on any registererd Roll";
+				captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll");
             }
         } else {
             // hmm, thats weird ... not what I expected
             $test_result[] = "$voucher invalid: $result !!";
+			captiveportal_syslog("$voucher invalid: $result !!");
             $error++;
         }
     }
@@ -240,9 +248,6 @@ function voucher_auth($voucher_received, $test = 0) {
     $active_vouchers[$first_voucher_roll][$first_voucher] = "$timestamp,$minutes";
     voucher_write_active_db($roll, $active_vouchers[$first_voucher_roll]);
 
-    // mark the DB's as dirty.
-    mark_subsystem_dirty('voucher');
-
     unlock($voucherlck);
 
     return $total_minutes;
@@ -250,15 +255,15 @@ function voucher_auth($voucher_received, $test = 0) {
 
 function voucher_configure() {
     global $config, $g;
-    
-    /* kill any running minicron */
-    killbypid("{$g['varrun_path']}/vouchercron.pid");
 
-    if (isset($config['voucher']['enable'])) {
+	/* kill any running minicron */
+	killbypid("{$g['varrun_path']}/vouchercron.pid");
+
+	if (!isset($config['voucher']['enable']))
+		return 0;
 
-        if ($g['booting']) {
+        if ($g['booting'])
             echo "Enabling voucher support... ";
-        }
 
         // start cron if we're asked to save runtime DB periodically
         // to XML config if it changed
@@ -269,18 +274,19 @@ function voucher_configure() {
                     "/etc/rc.savevoucher");
         }
 
-	$voucherlck = lock('voucher');
+	$voucherlck = lock('voucher', LOCK_EX);
+
         /* write public key used to verify vouchers */
         $pubkey = base64_decode($config['voucher']['publickey']);
         $fd = fopen("{$g['varetc_path']}/voucher.public", "w");
         if (!$fd) {
-            printf("Error: cannot write voucher.public\n");
-	    unlock($voucherlck);
+            captiveportal_syslog("Voucher error: cannot write voucher.public\n");
+	   		unlock($voucherlck);
             return 1;
         }
-        chmod("{$g['varetc_path']}/voucher.public", 0600);
         fwrite($fd, $pubkey);
         fclose($fd);
+        @chmod("{$g['varetc_path']}/voucher.public", 0600);
 
         /* write config file used by voucher binary to decode vouchers */
         $fd = fopen("{$g['varetc_path']}/voucher.cfg", "w");
@@ -289,16 +295,16 @@ function voucher_configure() {
 	    unlock($voucherlck);
             return 1;
         }
-        chmod("{$g['varetc_path']}/voucher.cfg", 0600);
         fwrite($fd, "{$config['voucher']['rollbits']},{$config['voucher']['ticketbits']},{$config['voucher']['checksumbits']},{$config['voucher']['magic']},{$config['voucher']['charset']}\n");
         fclose($fd);
-	unlock($voucherlck);
+        @chmod("{$g['varetc_path']}/voucher.cfg", 0600);
+		unlock($voucherlck);
 
-        if ($g['booting']) {
+        if ($g['booting'] && is_array($config['voucher']['roll'])) {
 
             // create active and used DB per roll on ramdisk from config
             $a_roll = &$config['voucher']['roll'];
-	    $voucherlck = lock('voucher');
+			$voucherlck = lock('voucher');
 
             foreach ($a_roll as $rollent) {
 
@@ -320,64 +326,59 @@ function voucher_configure() {
                 voucher_write_active_db($roll, $active_vouchers);
             }
 		
-	    unlock($voucherlck);
+			unlock($voucherlck);
             echo "done\n";
         }
-    }
-    return 0;
+
+	return 0;
 }
 
 /* write bitstring of used vouchers to ramdisk. 
  * Bitstring must already be base64_encoded!
  */
 function voucher_write_used_db($roll, $vdb) {
-
-    global $g;
-
-    $fd = fopen("{$g['vardb_path']}/voucher_used_$roll.db", "w");
-    if ($fd) {
-        fwrite($fd, $vdb . "\n");
-        fclose($fd);
-    } else {
-        voucher_log(LOG_ERR, "cant write {$g['vardb_path']}/voucher_used_$roll.db");
-    }
+	global $g;
+
+	$fd = fopen("{$g['vardb_path']}/voucher_used_$roll.db", "w");
+	if ($fd) {
+		fwrite($fd, $vdb . "\n");
+		fclose($fd);
+	} else
+		voucher_log(LOG_ERR, "cant write {$g['vardb_path']}/voucher_used_$roll.db");
 }
 
 /* return assoc array of active vouchers with activation timestamp
  * voucher is index. 
  */
 function voucher_read_active_db($roll) {
-
-    global $g;
-
-    $active = array();
-    $dirty = 0;
-    $file = "{$g['vardb_path']}/voucher_active_$roll.db";
-    if (file_exists($file)) {
-        $fd = fopen($file, "r");
-        if ($fd) {
-            while (!feof($fd)) {
-                $line = trim(fgets($fd));
-                if ($line) {
-                    list($voucher,$timestamp,$minutes) = explode(",", $line); // voucher,timestamp
-                    if ((($timestamp + 60*$minutes) - time()) > 0) {
-                        $active[$voucher] = "$timestamp,$minutes";
-                    } else {
-                        $dirty=1;
-                    }
-                }
-            }
-            fclose($fd);
-            if ($dirty) // if we found expired entries, lets save our snapshot
-                voucher_write_active_db($roll, $active);
-        }
-    }
-    return $active;
+	global $g;
+
+	$active = array();
+	$dirty = 0;
+	$file = "{$g['vardb_path']}/voucher_active_$roll.db";
+	if (file_exists($file)) {
+		$fd = fopen($file, "r");
+		if ($fd) {
+			while (!feof($fd)) {
+				$line = trim(fgets($fd));
+				if ($line) {
+					list($voucher,$timestamp,$minutes) = explode(",", $line); // voucher,timestamp
+					if ((($timestamp + 60*$minutes) - time()) > 0)
+						$active[$voucher] = "$timestamp,$minutes";
+					else
+						$dirty=1;
+				}
+			}
+			fclose($fd);
+			if ($dirty) // if we found expired entries, lets save our snapshot
+				voucher_write_active_db($roll, $active);
+		}
+	}
+	return $active;
 }
 
 /* store array of active vouchers back to DB */
 function voucher_write_active_db($roll, $active) {
-
     global $g;
 
     $fd = fopen("{$g['vardb_path']}/voucher_active_$roll.db", "w");
@@ -390,7 +391,6 @@ function voucher_write_active_db($roll, $active) {
 
 /* return how many vouchers are marked used on a roll */
 function voucher_used_count($roll) {
-
     global $g;
 
     $bitstring = voucher_read_used_db($roll);
@@ -407,7 +407,6 @@ function voucher_used_count($roll) {
 }
 
 function voucher_read_used_db($roll) {
-
     global $g;
 
     $vdb = "";
@@ -425,10 +424,9 @@ function voucher_read_used_db($roll) {
 }
 
 function voucher_unlink_db($roll) {
-
     global $g;
-    unlink("{$g['vardb_path']}/voucher_used_$roll.db");
-    unlink("{$g['vardb_path']}/voucher_active_$roll.db");
+    @unlink("{$g['vardb_path']}/voucher_used_$roll.db");
+    @unlink("{$g['vardb_path']}/voucher_active_$roll.db");
 }
 
 /* we share the log with captiveportal for now */
@@ -445,20 +443,15 @@ function voucher_log($priority, $message) {
  * Called during reboot -> system_reboot_cleanup() and minicron
  */
 function voucher_save_db_to_config() {
-
     global $config, $g;
     
     if (!isset($config['voucher']['enable']) || $config['voucher']['saveinterval'] == 0) 
         return;   // no vouchers or don't want to save DB's
 
-    if (!is_subsystem_dirty('voucher'))
-        return;     // nothing changed.
-
-    $voucherlck = lock('voucher');
+    $voucherlck = lock('voucher', LOCK_EX);
 
     // walk all active rolls and save runtime DB's to flash
     $a_roll = &$config['voucher']['roll'];
-//    foreach ($a_roll as $rollent) {
     while (list($key, $value) = each($a_roll)) {
         $rollent = &$a_roll[$key];
         $roll = $rollent['number'];
@@ -466,7 +459,7 @@ function voucher_save_db_to_config() {
         $rollent['used'] = base64_encode($bitmask);
         $active_vouchers = voucher_read_active_db($roll);
         $db = array();
-	$dbi = 1;
+		$dbi = 1;
         foreach($active_vouchers as $voucher => $line) {
             list($timestamp,$minutes) = explode(",", $line);
             $activent['voucher'] = $voucher;
@@ -477,8 +470,9 @@ function voucher_save_db_to_config() {
         }
         $rollent['active'] = $db;
     }
-    clear_subsystem_dirty('voucher');
+
     unlock($voucherlck);
+
     write_config();
     return;
 }
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 44c934c..8b4421a 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -37,7 +37,7 @@
 	pfSense_BUILDER_BINARIES:	/usr/bin/killall	/usr/local/sbin/sasyncd	/sbin/ifconfig	/sbin/sysctl
 	pfSense_BUILDER_BINARIES:	/usr/local/sbin/setkey	/usr/bin/netstat	/sbin/route	/bin/mkdir
 	pfSense_BUILDER_BINARIES:	/usr/local/sbin/racoonctl	/usr/local/sbin/racoon
-	pfSense_BUILDER_BINARIES:	/usr/local/sbin/dnswatch	/usr/local/sbin/mpd4	
+	pfSense_BUILDER_BINARIES:	/usr/local/sbin/filterdns	/usr/local/sbin/mpd4	
 	pfSense_MODULE:	vpn
 */
 
@@ -103,7 +103,7 @@ function vpn_ipsec_configure($ipchg = false)
 		/* kill racoon */
 		if(is_process_running("racoon"))
 			mwexec("/usr/bin/killall racoon", true);
-		killbypid("{$g['varrun_path']}/dnswatch-ipsec.pid");
+		killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
 
 		/* wait for racoon process to die */
 		sleep(2);
@@ -133,7 +133,7 @@ function vpn_ipsec_configure($ipchg = false)
 		/* resolve all local, peer addresses and setup pings */
 		$ipmap = array();
 		$rgmap = array();
-		$dnswatch_list = array();
+		$filterdns_list = array();
 		if (is_array($a_phase1) && count($a_phase1)) {
 
 			/* step through each phase1 entry */
@@ -149,7 +149,7 @@ function vpn_ipsec_configure($ipchg = false)
 					$ipmap[] = $ep;
 
 				/* see if this tunnel has a hostname for the remote-gateway. If so,
-				   try to resolve it now and add it to the list for dnswatch */
+				   try to resolve it now and add it to the list for filterdns */
 
 				if (isset ($ph1ent['mobile']))
 					continue;
@@ -157,7 +157,7 @@ function vpn_ipsec_configure($ipchg = false)
 				$rg = $ph1ent['remote-gateway'];
 
 				if (!is_ipaddr($rg)) {
-					$dnswatch_list[] = "{$rg}=value";
+					$filterdns_list[] = "{$rg}";
 					add_hostname_to_watch($rg);
 					$rg = resolve_retry($rg);
 					if (!$rg)
@@ -636,11 +636,12 @@ EOD;
 
 						$localid_type = $ph2ent['localid']['type'];
 						$localid_data = ipsec_idinfo_to_cidr($ph2ent['localid']);
-						/* Do not print localid in some cases, such as a pure-psk or psk/xauth mobile tunnel */
+						/* Do not print localid in some cases, such as a pure-psk or psk/xauth single phase2 mobile tunnel */
 						if (($localid_type == "none") ||
 							(($ph1ent['authentication_method'] == "xauth_psk_server") ||
 							($ph1ent['authentication_method'] == "pre_shared_key"))
-							&& isset($ph1ent['mobile']))
+							&& isset($ph1ent['mobile'])
+							&& (ipsec_get_number_of_phase2($ikeid)==1))
 							$localid_spec = " ";
 						else {
 							if ($localid_type != "address") {
@@ -879,7 +880,9 @@ EOD;
 		/* mange racoon process */
 		if (is_process_running("racoon")) {
 			sleep("0.1");
-			mwexec("/usr/local/sbin/racoonctl -s /var/db/racoon/racoon.sock reload-config", false);
+			/* XXX: This seems to not work in ipsec-tools 0.7.3 but a HUP signal is equivalent. */
+			//mwexec("/usr/local/sbin/racoonctl -s /var/db/racoon/racoon.sock reload-config", false);
+			sigkillbypid("{$g['varrun_path']}/racoon.pid", "HUP");
 			/* load SPD without flushing to be safe on config additions or changes. */
 			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
 		} else {
@@ -894,19 +897,20 @@ EOD;
  			/* load SPD */
 			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
 
-			/* start dnswatch, if necessary */
-			if (count($dnswatch_list) > 0) {
+			/* start filterdns, if necessary */
+			if (count($filterdns_list) > 0) {
 				$interval = 60;
 				if (!empty($ipseccfg['dns-interval']) && is_numeric($ipseccfg['dns-interval']))
 					$interval = $ipseccfg['dns-interval'];
 
 				$hostnames = "";
-				array_unique($dnswatch_list);
-				$hostnames = implode("\n", $dnswatch_list);
-				file_put_contents("{$g['varetc_path']}/dnswatch-ipsec.hosts", $hostnames);
+				array_unique($filterdns_list);
+				foreach ($hostname as $filterdns_list)
+					$hostnames .= "cmd {$hostname} '/etc/rc.newipsecdns'\n";
+				file_put_contents("{$g['varetc_path']}/filternds-ipsec.hosts", $hostnames);
 
-				killbypid("{$g['varrun_path']}/dnswatch-ipsec.pid");
-				mwexec("/usr/local/sbin/dnswatch {$g['varrun_path']}/dnswatch-ipsec.pid $interval /etc/rc.newipsecdns {$g['varetc_path']}/dnswatch-ipsec.hosts");
+				killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
+				mwexec("/usr/local/sbin/filterdns -p {$g['varrun_path']}/filterdns-ipsec.pid -i {$interval} -c {$g['varetc_path']}/filterdns_ipsec.hosts -d 1");
 			}
 		}
 	
@@ -963,6 +967,17 @@ function vpn_setup() {
 	vpn_l2tp_configure();
 }
 
+function vpn_netgraph_support() {
+	$iflist = get_configured_interface_list();
+	foreach ($iflist as $iface) {
+		$realif = get_real_interface($iface);
+		/* Get support for netgraph(4) from the nic */
+		$ifinfo = pfSense_get_interface_addresses($realif);
+		if (!empty($ifinfo) && in_array($ifinfo['iftype'], array("ether", "vlan", "bridge")))
+                	pfSense_ngctl_attach(".", $realif);
+	}
+}
+
 function vpn_pptpd_configure() {
 	global $config, $g;
 
@@ -1153,6 +1168,8 @@ EOD;
 			fclose($fd);
 			chmod("{$g['varetc_path']}/pptp-vpn/mpd.secret", 0600);
 
+			vpn_netgraph_support();
+
 			/* fire up mpd */
 			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/pptp-vpn -p {$g['varrun_path']}/pptp-vpn.pid -s pptps pptps");
 
@@ -1289,8 +1306,14 @@ EOD;
 			}
 
 			if (isset ($pppoecfg['radius']['server']['enable'])) {
+				$radiusport = "";
+				$radiusacctport = "";
+				if (isset($pppoecfg['radius']['server']['port']))
+					$radiusport = $pppoecfg['radius']['server']['port'];
+				if (isset($pppoecfg['radius']['server']['acctport']))
+					$radiusacctport = $pppoecfg['radius']['server']['acctport'];
 				$mpdconf .=<<<EOD
-	set radius server {$pppoecfg['radius']['server']['ip']} "{$pppoecfg['radius']['server']['secret']}"
+	set radius server {$pppoecfg['radius']['server']['ip']} "{$pppoecfg['radius']['server']['secret']} {$radiusport} {$radiusacctport}" 
 	set radius retries 3
 	set radius timeout 10
 	set auth enable radius-auth
@@ -1356,6 +1379,8 @@ EOD;
 				chmod("{$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn/mpd.secret", 0600);
 			}
 
+			/* Get support for netgraph(4) from the nic */
+			pfSense_ngctl_attach(".", $pppoe_interface);
 			/* fire up mpd */
 			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/pppoe{$pppoecfg['pppoeid']}-vpn -p {$g['varrun_path']}/pppoe{$pppoecfg['pppoeid']}-vpn.pid -s poes poes");
 
@@ -1537,6 +1562,8 @@ EOD;
 			fclose($fd);
 			chmod("{$g['varetc_path']}/l2tp-vpn/mpd.secret", 0600);
 
+			vpn_netgraph_support();
+
 			/* fire up mpd */
 			mwexec("/usr/local/sbin/mpd4 -b -d {$g['varetc_path']}/l2tp-vpn -p {$g['varrun_path']}/l2tp-vpn.pid -s l2tps l2tps");
 
@@ -1648,7 +1675,7 @@ function reload_tunnel_spd_policy($phase1, $phase2, $old_phase1, $old_phase2) {
 	$old_remote_subnet = ipsec_idinfo_to_cidr($old_phase2['remoteid']);
 
 	/* see if this tunnel has a hostname for the remote-gateway, and if so,
-	 * try to resolve it now and add it to the list for dnswatch */
+	 * try to resolve it now and add it to the list for filterdns */
 	if (!is_ipaddr($phase1['remote-gateway'])) {
 		$rgip = resolve_retry($phase1['remote-gateway']);
 		add_hostname_to_watch($phase1['remote-gateway']);
diff --git a/etc/inc/vslb.inc b/etc/inc/vslb.inc
index 3985337..2c3f0ca 100644
--- a/etc/inc/vslb.inc
+++ b/etc/inc/vslb.inc
@@ -206,7 +206,12 @@ function relayd_configure() {
   if(is_array($pool_a)) {
     for ($i = 0; isset($pool_a[$i]); $i++) {
       if(is_array($pool_a[$i]['servers'])) {
-        $srvtxt = implode(", ", $pool_a[$i]['servers']);
+	if (!empty($pool_a[$i]['retry'])) {
+		$retrytext = " retry {$pool_a[$i]['retry']}";
+		$srvtxt = implode("{$retrytext}, ", $pool_a[$i]['servers']) . "{$retrytext}";
+	} else {
+		$srvtxt = implode(", ", $pool_a[$i]['servers']);
+	}
         $conf .= "table <{$pool_a[$i]['name']}> { $srvtxt }\n";
         /* Index by name for easier fetching when we loop through the virtual servers */
         $pools[$pool_a[$i]['name']] = $pool_a[$i];
@@ -283,4 +288,70 @@ function relayd_configure() {
 
 }
 
+function get_lb_redirects() {
+/*
+# relayctl show summary
+Id   Type      Name                      Avlblty Status
+1    redirect  testvs2                           active
+5    table     test2:80                          active (3 hosts up)
+11   host      192.168.1.2               91.55%  up
+10   host      192.168.1.3               100.00% up
+9    host      192.168.1.4               88.73%  up
+3    table     test:80                           active (1 hosts up)
+7    host      192.168.1.2               66.20%  down
+6    host      192.168.1.3               97.18%  up
+0    redirect  testvs                            active
+3    table     test:80                           active (1 hosts up)
+7    host      192.168.1.2               66.20%  down
+6    host      192.168.1.3               97.18%  up
+4    table     testvs-sitedown:80                active (1 hosts up)
+8    host      192.168.1.4               84.51%  up
+# relayctl show redirects
+Id   Type      Name                      Avlblty Status
+1    redirect  testvs2                           active
+0    redirect  testvs                            active
+# relayctl show redirects
+Id   Type      Name                      Avlblty Status
+1    redirect  testvs2                           active
+           total: 2 sessions
+           last: 2/60s 2/h 2/d sessions
+           average: 1/60s 0/h 0/d sessions
+0    redirect  testvs                            active
+*/
+	$rdr_a = array();
+	exec('/usr/local/sbin/relayctl show redirects 2>&1', $rdr_a);
+	$vs = array();
+	for ($i = 0; isset($rdr_a[$i]); $i++) {
+		$line = $rdr_a[$i];
+		if (preg_match("/^[0-9]+/", $line)) {
+			$regs = array();
+			if($x = preg_match("/^[0-9]+\s+redirect\s+([^\s]+)\s+([^\s]+)/", $line, $regs)) {
+				$vs[trim($regs[1])] = array();
+				$vs[trim($regs[1])]['status'] = trim($regs[2]);
+			}
+		}
+	}
+	return $vs;
+}
+
+function get_lb_summary() {
+	$relayctl = array();
+	exec('/usr/local/sbin/relayctl show summary 2>&1', $relayctl);
+	$relay_hosts=Array();
+	foreach( (array) $relayctl as $line) {
+		$t=split("\t", $line);
+		switch (trim($t[1])) {
+			case "table":
+				$curpool=trim($t[2]);
+			break;
+			case "host":
+				$curhost=trim($t[2]);
+				$relay_hosts[$curpool][$curhost]['avail']=trim($t[3]);
+				$relay_hosts[$curpool][$curhost]['state']=trim($t[4]);
+			break;
+		}
+	}
+	return $relay_hosts;
+}
+
 ?>
\ No newline at end of file
diff --git a/etc/inc/xmlparse.inc b/etc/inc/xmlparse.inc
index 75871a9..5fa51c3 100644
--- a/etc/inc/xmlparse.inc
+++ b/etc/inc/xmlparse.inc
@@ -36,9 +36,9 @@ function listtags() {
    * I know it's a pain, but it's a pain to find stuff too if it's not
    */
 	$ret = explode(" ",
-		"alias aliasurl allowedip authserver bridged ca cacert cert crl clone config ".
-		"container columnitem build_port_path depends_on_package disk dnsserver dnsupdate ".
-		"domainoverrides dyndns earlyshellcmd element encryption-algorithm-option ".
+		"alias aliasurl allowedip allowedhostname authserver bridged ca cacert cert crl ".
+		"clone config container columnitem build_port_path depends_on_package disk dnsserver  ".
+		"dnsupdate domainoverrides dyndns earlyshellcmd element encryption-algorithm-option ".
 		"field fieldname hash-algorithm-option gateway_item gateway_group gif gre ".
 		"group hosts member ifgroupentry igmpentry interface_array item key lagg " .
 		"lbaction lbpool l7rules lbprotocol ".
@@ -47,7 +47,7 @@ function listtags() {
 		"option package passthrumac phase1 phase2 ppp pppoe priv proxyarpnet qinqentry queue ".
 		"pages pipe roll route row rrddatafile rule schedule service servernat servers ".
 		"serversdisabled earlyshellcmd shellcmd staticmap subqueue timerange ".
-		"tunnel user vip virtual_server vlan winsserver wolentry widget"
+		"tunnel user vip virtual_server vlan winsserver wolentry widget npt"
 		);
 	return $ret;
 }
@@ -229,7 +229,7 @@ function dump_xml_config_sub($arr, $indent) {
 						$xmlconfig .= str_repeat("\t", $indent);
 						if((is_bool($cval) && $cval == true) || ($cval === "")) {
 							$xmlconfig .= "<$ent/>\n";
-						} else if (substr($ent, 0, 5) == "descr") {
+						} else if ((substr($ent, 0, 5) == "descr") || (substr($ent, 0, 6) == "detail")) {
 							$xmlconfig .= "<$ent><![CDATA[" . htmlentities($cval) . "]]></$ent>\n";
 						} else {
 							$xmlconfig .= "<$ent>" . htmlentities($cval) . "</$ent>\n";
@@ -253,7 +253,7 @@ function dump_xml_config_sub($arr, $indent) {
 				$xmlconfig .= "<$ent/>\n";
 			} else if (!is_bool($val)) {
 				$xmlconfig .= str_repeat("\t", $indent);
-				if (substr($ent, 0, 5) == "descr")
+				if ((substr($ent, 0, 5) == "descr") || (substr($ent, 0, 6) == "detail"))
 					$xmlconfig .= "<$ent><![CDATA[" . htmlentities($val) . "]]></$ent>\n";
 				else
 					$xmlconfig .= "<$ent>" . htmlentities($val) . "</$ent>\n";
@@ -298,4 +298,4 @@ function dump_xml_config_raw($arr, $rootobj) {
 	return $xmlconfig;
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/xmlreader.inc b/etc/inc/xmlreader.inc
index 0beeb74..ce0289b 100644
--- a/etc/inc/xmlreader.inc
+++ b/etc/inc/xmlreader.inc
@@ -51,7 +51,7 @@ function listtags() {
                 "option package passthrumac phase1 phase2 ppp pppoe priv proxyarpnet qinqentry queue ".
                 "pages pipe roll route row rrddatafile rule schedule service servernat servers ".
                 "serversdisabled earlyshellcmd shellcmd staticmap subqueue timerange ".
-                "tunnel user vip virtual_server vlan winsserver wolentry widget"
+                "tunnel user vip virtual_server vlan winsserver wolentry widget npt"
                 );
 	return array_flip($ret);
 }
@@ -217,4 +217,4 @@ function dump_xml_config_raw($arr, $rootobj) {
         return $xmlconfig;
 }
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/xmlrpc.inc b/etc/inc/xmlrpc.inc
index ef4fc19..ae725e5 100644
--- a/etc/inc/xmlrpc.inc
+++ b/etc/inc/xmlrpc.inc
@@ -139,4 +139,4 @@ function xmlrpc_auth(&$params) {
 	return false;
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/xmlrpc_client.inc b/etc/inc/xmlrpc_client.inc
index bac5e1f..a3b9cad 100644
--- a/etc/inc/xmlrpc_client.inc
+++ b/etc/inc/xmlrpc_client.inc
@@ -228,7 +228,7 @@ if (function_exists('mb_ereg')) {
  * which can cause PHP's SAX-based XML parser to break?
  * @global boolean $GLOBALS['XML_RPC_auto_base64']
  */
-$GLOBALS['XML_RPC_auto_base64'] = false;
+$GLOBALS['XML_RPC_auto_base64'] = true;
 
 
 /**
diff --git a/etc/phpshellsessions/gitsync b/etc/phpshellsessions/gitsync
index 9fa7079..4b865c5 100644
--- a/etc/phpshellsessions/gitsync
+++ b/etc/phpshellsessions/gitsync
@@ -313,6 +313,8 @@ function post_cvssync_commands() {
 	fwrite($fd, "sleep 5\n");
 	fwrite($fd, "killall php\n");
 	fwrite($fd, "/usr/local/sbin/pfSctl -c 'service restart webgui'\n");
+	if(file_exists("/var/etc/lighty-CaptivePortal.conf"))
+		fwrite($fd, "/usr/local/sbin/lighttpd -f /var/etc/lighty-CaptivePortal.conf\n");
 	fclose($fd);
 	mwexec_bg("sh /tmp/restart_lighty");
 	echo "\n";
diff --git a/etc/rc b/etc/rc
index b8ced8b..887e9ec 100755
--- a/etc/rc
+++ b/etc/rc
@@ -25,6 +25,12 @@ PLATFORM=`/bin/cat /etc/platform`
 # Set our current version
 version=`/bin/cat /etc/version`
 
+# Setup dumpdev/ddb/savecore"
+echo "Configuring crash dumps..."
+if [ "$PLATFORM" = "pfSense" ]; then
+	/etc/rc.dumpon
+fi
+
 # Mount memory file system if it exists
 echo "Mounting filesystems..."
 
@@ -110,11 +116,13 @@ elif [ "$PLATFORM" = "nanobsd" ] ; then
 	/bin/rm -rf /var/db/pkg
 	/bin/ln -s /root/var/db/pkg/ /var/db/pkg
 else
-    SWAPDEVICE=`/bin/cat /etc/fstab | /usr/bin/grep swap | /usr/bin/cut -f1`
-    /sbin/swapon -a 2>/dev/null >/dev/null
+	SWAPDEVICE=`/bin/cat /etc/fstab | /usr/bin/grep swap | /usr/bin/cut -f1`
+	/sbin/swapon -a 2>/dev/null >/dev/null
+	/etc/rc.savecore
 fi
 
 if [ "$PLATFORM" = "cdrom" ] ; then
+	echo -n "Mounting unionfs directories..."
 	/bin/mkdir /tmp/unionfs
 	/bin/mkdir /tmp/unionfs/usr
 	/bin/mkdir /tmp/unionfs/root
@@ -122,21 +130,13 @@ if [ "$PLATFORM" = "cdrom" ] ; then
 	/bin/mkdir /tmp/unionfs/bin
 	/bin/mkdir /tmp/unionfs/boot
 	/bin/mkdir /tmp/unionfs/confdefault
-	echo -n "Mounting unionfs directories:"
-	echo -n " usr"
 	/sbin/mount_unionfs /tmp/unionfs/usr /usr/
-	echo -n " root"
 	/sbin/mount_unionfs /tmp/unionfs/root /root/
-	echo -n " bin"
 	/sbin/mount_unionfs /tmp/unionfs/bin /bin/		
-	echo -n " sbin"
 	/sbin/mount_unionfs /tmp/unionfs/sbin /sbin/	
-	echo -n " boot"
 	/sbin/mount_unionfs /tmp/unionfs/boot /boot/
-	echo -n " conf.default"
 	/sbin/mount_unionfs /tmp/unionfs/confdefault /conf.default/
-	echo -n " installer"
-	echo "... done."
+	echo "done."
 fi
 
 echo -n "Creating symlinks..."
diff --git a/etc/rc.banner b/etc/rc.banner
index 9b32334..6f81cb9 100755
--- a/etc/rc.banner
+++ b/etc/rc.banner
@@ -45,7 +45,7 @@
 	if(!$hideplatform) 
 		$platformbanner = "-{$platform}";
 	
-	print "\n*** Welcome to {$product} {$version}{$platformbanner} ({$machine}) on {$hostname} ***\n";
+	print "*** Welcome to {$product} {$version}{$platformbanner} ({$machine}) on {$hostname} ***\n";
 
 	$iflist = get_configured_interface_with_descr(false, true);
 	foreach($iflist as $ifname => $friendly) {
diff --git a/etc/rc.bootup b/etc/rc.bootup
index fe1faa3..3451c88 100755
--- a/etc/rc.bootup
+++ b/etc/rc.bootup
@@ -255,8 +255,7 @@ setup_gateways_monitor();
 echo "done.\n";
 
 echo "Synchronizing user settings...";
-if (empty($config['system']['webgui']['backend']))
-	local_sync_accounts();
+local_sync_accounts();
 echo "done.\n";
 
 if($avail > 0 and $avail < 65) {
@@ -381,6 +380,18 @@ activate_powerd();
 if (file_exists("/sbin/shutdown.old"))
 	@unlink("/sbin/shutdown.old");
 
+/* Resync / Reinstall packages if need be */
+if(file_exists('/conf/needs_package_sync')) {
+	if($config['installedpackages'] <> '' && is_array($config['installedpackages']['package'])) {
+		require_once("pkg-utils.inc");
+		if($g['platform'] == "pfSense" || $g['platform'] == "nanobsd") {
+			mark_subsystem_dirty('packagelock');
+			pkg_reinstall_all();
+			clear_subsystem_dirty('packagelock');
+		}
+	}
+}
+
 /* done */
 unset($g['booting']);
 
diff --git a/etc/rc.dumpon b/etc/rc.dumpon
new file mode 100755
index 0000000..fad1a82
--- /dev/null
+++ b/etc/rc.dumpon
@@ -0,0 +1,35 @@
+#!/bin/sh
+# Based on:
+# FreeBSD: src/etc/rc.d/dumpon,v 1.12.2.1.4.1 2010/06/14 02:09:06 kensmith Exp
+
+# dumpon
+
+dumpon_try()
+{
+	if /sbin/dumpon "${1}" ; then
+		# Make a symlink in devfs for savecore
+		echo "Using ${1} for dump device."
+		ln -fs "${1}" /dev/dumpdev
+		return 0
+	fi
+	echo "Unable to specify $1 as a dump device."
+	return 1
+}
+
+# Enable dumpdev so that savecore can see it. Enable it
+# early so a crash early in the boot process can be caught.
+#
+while read dev mp type more ; do
+	[ "${type}" = "swap" ] || continue
+	[ -c "${dev}" ] || continue
+	dumpon_try "${dev}" && works=true
+done </etc/fstab
+if [ "${works}" != "true" ]; then
+	echo "No suitable dump device was found." 1>&2
+	exit
+fi
+
+# ddb
+if [ ! -z "`sysctl -Nq debug.ddb.scripting.scripts`" ]; then
+	/sbin/ddb /etc/ddb.conf
+fi
diff --git a/etc/rc.filter_synchronize b/etc/rc.filter_synchronize
index 0a8316b..9e310f1 100755
--- a/etc/rc.filter_synchronize
+++ b/etc/rc.filter_synchronize
@@ -94,46 +94,45 @@ function carp_check_version($url, $password, $port = 80, $method = 'pfsense.host
 	if(file_exists("{$g['varrun_path']}/booting") || $g['booting'])
 		return;
 
-	$params = array(
-                XML_RPC_encode($password)
-        );
-
-        $numberofruns = 0;
-        while ($numberofruns < 2) {
-                $msg = new XML_RPC_Message($method, $params);
-                $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
-                $username = $config['system']['user'][0]['name'];
-                $cli->setCredentials($username, $password);
-                if($numberofruns > 1)
-                        $cli->setDebug(1);
-                /* send our XMLRPC message and timeout after 240 seconds */
-                $resp = $cli->send($msg, "240");
+		$params = array(
+			XML_RPC_encode($password)
+		);
+
+		$numberofruns = 0;
+		while ($numberofruns < 2) {
+		$msg = new XML_RPC_Message($method, $params);
+		$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+		$username = $config['system']['user'][0]['name'];
+		$cli->setCredentials($username, $password);
+		if($numberofruns > 1)
+			$cli->setDebug(1);
+		/* send our XMLRPC message and timeout after 240 seconds */
+		$resp = $cli->send($msg, "240");
 		if(!is_object($resp)) {
-                        $error = "A communications error occured while attempting XMLRPC sync with username {$username} {$url}:{$port}.";
-                } elseif($resp->faultCode()) {
-                        $error = "An error code was received while attempting XMLRPC sync with username {$username} {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
-                } else {
-			$parsed_response =  XML_RPC_decode($resp->value());
-			if(!is_array($parsed_response)) {
-				if (trim($parsed_response) == "Authentication failed") {
-					$error = "A authentication failure occurred while trying to access {$url}:{$port} ({$method}).";
-					log_error($error);
-					file_notice("sync_settings", $error, "Settings Sync", "");
-					exit;
+			$error = "A communications error occured while attempting XMLRPC sync with username {$username} {$url}:{$port}.";
+		} elseif($resp->faultCode()) {
+			$error = "An error code was received while attempting XMLRPC sync with username {$username} {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		} else {
+				$parsed_response =  XML_RPC_decode($resp->value());
+				if(!is_array($parsed_response)) {
+					if (trim($parsed_response) == "Authentication failed") {
+						$error = "A authentication failure occurred while trying to access {$url}:{$port} ({$method}).";
+						log_error($error);
+						file_notice("sync_settings", $error, "Settings Sync", "");
+						exit;
+					}
+				} else {
+					if (!isset($parsed_response['config_version']) ||
+					  $parsed_response['config_version'] < $config['version'])
+						return false;
+					else
+						return true;
 				}
-			} else {
-				if (!isset($parsed_response['config_version']) ||
-				    $parsed_response['config_version'] < $config['version'])
-					return false;
-				else
-					return true;
 			}
+			log_error($error);
+			file_notice("sync_settings", $error, "Settings Sync", "");
+			$numberofruns++;
 		}
-		log_error($error);
-		file_notice("sync_settings", $error, "Settings Sync", "");
-                $numberofruns++;
-        }
-
 	return false;
 }
 
@@ -382,8 +381,8 @@ if (is_array($config['installedpackages']['carpsettings']['config'])) {
 			$sections[] = 'vouchers';
 		if (count($sections) > 0) {
 			if (!carp_check_version($synchronizetoip, $carp['password'], $port)) {
-				update_filter_reload_status("The other member is on older version of {$g['product']}. Sync will not be done to prevent problems!");
-				log_error("The other member is on older version of {$g['product']}. Sync will not be done to prevent problems!");
+				update_filter_reload_status("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!");
+				log_error("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!");
 				break;
 			}
 				
@@ -418,4 +417,4 @@ if (is_array($config['installedpackages']['carpsettings']['config'])) {
 	}
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/etc/rc.firmware b/etc/rc.firmware
index b10737e..063e9a3 100755
--- a/etc/rc.firmware
+++ b/etc/rc.firmware
@@ -491,7 +491,6 @@ pfSenseupgrade)
 	if [ -f /tmp/no_upgrade_reboot_required ]; then
 		rm /tmp/no_upgrade_reboot_required
 	else
-		rm -f /var/run/config.lock
 		sh /etc/rc.reboot
 	fi
 
diff --git a/etc/rc.halt b/etc/rc.halt
index 4f3d1ef..fd6318b 100755
--- a/etc/rc.halt
+++ b/etc/rc.halt
@@ -2,8 +2,8 @@
 
 # $Id$
 
-if [ -f /var/run/config.lock ]; then
-	echo "Cannot reboot at this moment, a config write operation is in progress."
+if ! /usr/bin/lockf -s -t 30 /tmp/config.lock /usr/bin/true; then
+	echo "Cannot halt at this moment, a config write operation is in progress and 30 seconds have passed."
 	exit -1
 fi
 
diff --git a/etc/rc.initial b/etc/rc.initial
index 4d88bda..3d600f1 100755
--- a/etc/rc.initial
+++ b/etc/rc.initial
@@ -73,8 +73,12 @@ echo " 4) Reset to factory defaults         12) ${product} Developer Shell"
 echo " 5) Reboot system                     13) Upgrade from console"
 echo " 6) Halt system                       ${sshd_option}"
 echo " 7) Ping host                         ${option98}"
-/bin/echo "${option99}"
 
+if [ "${option99}" != "" ]; then
+	/bin/echo "${option99}"
+fi
+
+echo
 read -p "Enter an option: " opmode
 echo
 
diff --git a/etc/rc.initial.setlanip b/etc/rc.initial.setlanip
index 1aacfb1..c1f6ddc 100755
--- a/etc/rc.initial.setlanip
+++ b/etc/rc.initial.setlanip
@@ -139,6 +139,7 @@
 
 	$config['interfaces'][$interface]['ipaddr'] = $intip;
 	$config['interfaces'][$interface]['subnet'] = $intbits;
+	$config['interfaces'][$interface]['enable'] = true;
 	
 	if($g['services_dhcp_server_enable'])
 		$yn = prompt_for_enable_dhcp_server();
@@ -257,4 +258,4 @@
 	fgets($fp);
 	fclose($fp);
 		
-?>
\ No newline at end of file
+?>
diff --git a/etc/rc.linkup b/etc/rc.linkup
index 997228f..2e8bbcd 100755
--- a/etc/rc.linkup
+++ b/etc/rc.linkup
@@ -43,6 +43,7 @@ function handle_argument_group($iface, $argument2) {
 	if (is_ipaddr($ipaddr) || empty($ipaddr)) {
 		log_error("Hotplug event detected for {$iface} but ignoring since interface is configured with static IP ({$ipaddr})");
 		$iface = get_real_interface($iface);
+		interfaces_bring_up($iface);
 		exec("/usr/sbin/arp -d -i {$iface} -a");
 	} else {
 		switch ($argument2) {
diff --git a/etc/rc.newipsecdns b/etc/rc.newipsecdns
index 4bb247c..3061f16 100755
--- a/etc/rc.newipsecdns
+++ b/etc/rc.newipsecdns
@@ -36,6 +36,7 @@
 	require_once("shaper.inc");	
 	require_once("ipsec.inc");
 	require_once("vpn.inc");
+	require_once("util.inc");
 
 	/* make sure to wait until the boot scripts have finished */
 	while (file_exists("{$g['varrun_path']}/booting")) {
@@ -44,7 +45,7 @@
 	
 	log_error("IPSEC: One or more IPSEC tunnel endpoints has changed IP. Refreshing.");
 	/* We will walk the list of hostnames found in the ipsec tunnel
-	 * configuration. Since we are already triggered by dnswatch
+	 * configuration. Since we are already triggered by filterdns
 	 * that a hostname has changed we can proceed to compare the 
 	 * new IP address with the old address from the DNS cache.
 	 */
diff --git a/etc/rc.newwanip b/etc/rc.newwanip
index 4735994..b85d102 100755
--- a/etc/rc.newwanip
+++ b/etc/rc.newwanip
@@ -84,7 +84,6 @@ system_resolvconf_generate(true);
 
 /* write current WAN IP to file */
 file_put_contents("{$g['vardb_path']}/{$interface}_ip", $curwanip);
-file_put_contents("{$g['vardb_path']}/{$interface}_cacheip", $curwanip);
 
 /* reconfigure static routes (kernel may have deleted them) */
 system_routing_configure($interface);
@@ -95,8 +94,19 @@ setup_gateways_monitor();
 /* signal filter reload */
 filter_configure();
 
-if (is_ipaddr($oldip) && $curwanip == $oldip)
+if (is_ipaddr($oldip) && $curwanip == $oldip) {
+	// Still need to sync VPNs on PPPoE and such, as even with the same IP the VPN software is unhappy with the IP disappearing.
+	if (in_array($config['interfaces'][$interface]['ipaddr'], array('pppoe', 'pptp', 'ppp'))) {
+		/* reconfigure IPsec tunnels */
+		vpn_ipsec_force_reload();
+
+		/* start OpenVPN server & clients */
+		openvpn_resync_all($interface);
+	}
 	exit;
+}
+
+file_put_contents("{$g['vardb_path']}/{$interface}_cacheip", $curwanip);
 
 /* perform RFC 2136 DNS update */
 services_dnsupdate_process($interface);
@@ -108,7 +118,8 @@ services_dyndns_configure($interface);
 vpn_ipsec_force_reload();
 
 /* start OpenVPN server & clients */
-openvpn_resync_all($interface);
+if (substr($interface_real, 0, 4) != "ovpn")
+	openvpn_resync_all($interface);
 
 /* reload graphing functions */
 enable_rrd_graphing();
diff --git a/etc/rc.php_ini_setup b/etc/rc.php_ini_setup
index 6fc7589..67aceaf 100755
--- a/etc/rc.php_ini_setup
+++ b/etc/rc.php_ini_setup
@@ -44,28 +44,28 @@ fi
 # Calculate APC SHM size according 
 # to detected memory values
 if [ "$AVAILMEM" -lt "65" ]; then
-	APCSHMEMSIZE="1"
+	APCSHMEMSIZE="1M"
 fi
 if [ "$AVAILMEM" -lt "96" ]; then
-	APCSHMEMSIZE="5"
+	APCSHMEMSIZE="5M"
 fi
 if [ "$AVAILMEM" -lt "128" ]; then
-	APCSHMEMSIZE="10"
+	APCSHMEMSIZE="10M"
 fi
 if [ "$AVAILMEM" -gt "128" ]; then
-	APCSHMEMSIZE="15"
+	APCSHMEMSIZE="15M"
 fi
 if [ "$AVAILMEM" -gt "256" ]; then
-	APCSHMEMSIZE="20"
+	APCSHMEMSIZE="20M"
 fi
 if [ "$AVAILMEM" -gt "384" ]; then
-	APCSHMEMSIZE="25"
+	APCSHMEMSIZE="25M"
 fi
 if [ "$AVAILMEM" -gt "512" ]; then
-	APCSHMEMSIZE="30"
+	APCSHMEMSIZE="30M"
 fi
 if [ "$AVAILMEM" -gt "784" ]; then
-	APCSHMEMSIZE="35"
+	APCSHMEMSIZE="35M"
 fi
 
 # Set upload directory
diff --git a/etc/rc.reboot b/etc/rc.reboot
index 851f1a8..4bb28a1 100755
--- a/etc/rc.reboot
+++ b/etc/rc.reboot
@@ -2,9 +2,9 @@
 
 # $Id$
 
-if [ -f /var/run/config.lock ]; then
-	echo "Cannot reboot at this moment, a config write operation is in progress."
-	exit -1
+if ! /usr/bin/lockf -s -t 30 /tmp/config.lock /usr/bin/true; then
+	echo "Cannot reboot at this moment, a config write operation is in progress, and 30 seconds have passed."
+	exit 1
 fi
 
 sleep 1
diff --git a/etc/rc.savecore b/etc/rc.savecore
new file mode 100755
index 0000000..8685330
--- /dev/null
+++ b/etc/rc.savecore
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Based on:
+# FreeBSD: src/etc/rc.d/savecore,v 1.16.2.2.4.1 2010/06/14 02:09:06 kensmith Exp
+
+dumpdev=`/bin/realpath /dev/dumpdev`
+dumpdir='/var/crash'
+
+if [ ! -c "${dumpdev}" ]; then
+	echo "Dump device does not exist.  Savecore not run."
+	exit
+fi
+
+if [ ! -d "${dumpdir}" ]; then
+	echo "Dump directory does not exist.  Savecore not run."
+	exit
+fi
+
+if savecore -C "${dumpdir}" "${dumpdev}" >/dev/null; then
+	savecore ${dumpdir} ${dumpdev}
+else
+	echo 'No core dumps found.'
+fi
diff --git a/etc/rc.shutdown b/etc/rc.shutdown
index 257a577..9d46ad2 100755
--- a/etc/rc.shutdown
+++ b/etc/rc.shutdown
@@ -1,7 +1,7 @@
 #!/bin/sh
 
-if [ -f /var/run/config.lock ]; then
-	echo "Cannot reboot at this moment, a config write operation is in progress."
+if ! /usr/bin/lockf -s -t 30 /tmp/config.lock /usr/bin/true; then
+	echo "Cannot shutdown at this moment, a config write operation is in progress and 30 seconds have passed."
 	exit -1
 fi
 
diff --git a/etc/version b/etc/version
index 7c92322..813dcee 100644
--- a/etc/version
+++ b/etc/version
@@ -1 +1 @@
-2.0-BETA4
+2.0-BETA5