Merge remote-tracking branch 'mainline/master' into inc

Conflicts:
	etc/inc/voucher.inc
	usr/local/www/fbegin.inc

33 files changed, 701 insertions, 392 deletions

diff --git a/usr/local/www/diag_backup.php b/usr/local/www/diag_backup.php
index 598f4d6..9d28375 100755
--- a/usr/local/www/diag_backup.php
+++ b/usr/local/www/diag_backup.php
@@ -158,6 +158,8 @@ if ($_POST) {
 		$mode = "restore";
 	else if (stristr($_POST['Submit'], gettext("Reinstall")))
 		$mode = "reinstallpackages";
+	else if (stristr($_POST['Submit'], gettext("Clear Package Lock")))
+		$mode = "clearpackagelock";
 	else if (stristr($_POST['Submit'], gettext("Download")))
 		$mode = "download";
 	else if (stristr($_POST['Submit'], gettext("Restore version")))
@@ -470,6 +472,9 @@ if ($_POST) {
 
 			header("Location: pkg_mgr_install.php?mode=reinstallall");
 			exit;
+		} else if ($mode == "clearpackagelock") {
+			clear_subsystem_dirty('packagelock');
+			$savemsg = "Package Lock Cleared";
                 } else if ($mode == "restore_ver") {
 			$input_errors[] = gettext("XXX - this feature may hose your config (do NOT backrev configs!) - billm");
 			if ($ver2restore <> "") {
@@ -655,13 +660,17 @@ function backuparea_change(obj) {
 					<td colspan="2" class="list" height="12">&nbsp;</td>
 				</tr>
 				<tr>
-					<td colspan="2" class="listtopic"><?=gettext("Reinstall packages"); ?></td>
+					<td colspan="2" class="listtopic"><?=gettext("Package Functions"); ?></td>
 				</tr>
 				<tr>
 					<td width="22%" valign="baseline" class="vncell">&nbsp;</td>
 					<td width="78%" class="vtable">
 						<p><?=gettext("Click this button to reinstall all system packages.  This may take a while."); ?> <br /><br />
 		  				<input name="Submit" type="submit" class="formbtn" id="reinstallpackages" value="<?=gettext("Reinstall packages"); ?>">
+						<br/>
+						<br/>
+						<p><?=gettext("Click this button to clear the package lock if a package fails to reinstall properly after an upgrade."); ?> <br /><br />
+						<input name="Submit" type="submit" class="formbtn" id="clearpackagelock" value="<?=gettext("Clear Package Lock"); ?>">
 					</td>
 				</tr>
 				<?php } ?>
diff --git a/usr/local/www/diag_ipsec_sad.php b/usr/local/www/diag_ipsec_sad.php
index 7ee8b72..e08feba 100755
--- a/usr/local/www/diag_ipsec_sad.php
+++ b/usr/local/www/diag_ipsec_sad.php
@@ -90,6 +90,7 @@ if ($_GET['act'] == "del") {
 							<td nowrap class="listhdrr"><?=gettext("SPI");?></td>
 							<td nowrap class="listhdrr"><?=gettext("Enc. alg.");?></td>
 							<td nowrap class="listhdr"><?=gettext("Auth. alg.");?></td>
+							<td nowrap class="listhdr"><?=gettext("Data");?></td>
 							<td nowrap class="list"></td>
 						</tr>
 						<?php foreach ($sad as $sa): ?>
@@ -100,6 +101,7 @@ if ($_GET['act'] == "del") {
 							<td class="listr"><?=htmlspecialchars($sa['spi']);?></td>
 							<td class="listr"><?=htmlspecialchars($sa['ealgo']);?></td>
 							<td class="listr"><?=htmlspecialchars($sa['aalgo']);?></td>
+							<td class="listr"><?=htmlspecialchars($sa['data']);?></td>
 							<td class="list" nowrap>
 								<?php
 									$args = "src=" . rawurlencode($sa['src']);
diff --git a/usr/local/www/fbegin.inc b/usr/local/www/fbegin.inc
index 89d1555..e86035f 100755
--- a/usr/local/www/fbegin.inc
+++ b/usr/local/www/fbegin.inc
@@ -89,7 +89,10 @@ if ($g['platform'] == "pfSense" or $g['platform'] == "nanobsd")
 $system_menu[] = array(gettext("Setup Wizard"), "/wizard.php?xml=setup_wizard.xml");
 $system_menu[] = array(gettext("Routing"), "/system_gateways.php");
 $system_menu[] = array(gettext("Cert Manager"), "/system_camanager.php");
-$system_menu[] = array(gettext("User Manager"), "/system_usermanager.php");
+if (!isAllowedPage("system_usermanager.php*"))
+	$system_menu[] = array(gettext("User Manager"), "/system_usermanager_passwordmg.php");
+else
+	$system_menu[] = array(gettext("User Manager"), "/system_usermanager.php");
 $system_menu = msort(array_merge($system_menu, return_ext_menu("System")),0);
 
 // Interfaces
diff --git a/usr/local/www/firewall_aliases.php b/usr/local/www/firewall_aliases.php
index 4a16bac..575240c 100755
--- a/usr/local/www/firewall_aliases.php
+++ b/usr/local/www/firewall_aliases.php
@@ -160,7 +160,7 @@ include("head.inc");
 <?php print_info_box_np(gettext("The alias list has been changed.") . "<br>" . gettext("You must apply the changes in order for them to take effect."));?>
 <?php endif; ?>
 
-<table width="100%" border="0" cellpadding="0" cellspacing="0">
+<table width="100%" border="0" cellpadding="0" cellspacing="0" class="tabcont">
 <tr>
   <td width="25%" class="listhdrr"><?=gettext("Name"); ?></td>
   <td width="25%" class="listhdrr"><?=gettext("Values"); ?></td>
diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php
index e9f4577..135d0e9 100755
--- a/usr/local/www/firewall_nat_1to1_edit.php
+++ b/usr/local/www/firewall_nat_1to1_edit.php
@@ -99,6 +99,15 @@ if ($_POST) {
 	
 	unset($input_errors);
 	$pconfig = $_POST;
+        /*  run through $_POST items encoding HTML entties so that the user
+         *  cannot think he is slick and perform a XSS attack on the unwilling
+         */
+        foreach ($_POST as $key => $value) {
+                $temp = str_replace(">", "", $value);
+                $newpost = htmlentities($temp);
+                if($newpost <> $temp)
+                        $input_errors[] = sprintf(gettext("Invalid characters detected (%s).  Please remove invalid characters and save again."),$temp);
+        }
 
 	/* input validation */
 	$reqdfields = explode(" ", "interface external");
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index 3dc1d83..5aa069c 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -101,6 +101,7 @@ if (isset($_GET['dup']))
 /*  run through $_POST items encoding HTML entties so that the user
  *  cannot think he is slick and perform a XSS attack on the unwilling
  */
+unset($input_errors);
 foreach ($_POST as $key => $value) {
 	$temp = $value;
 	$newpost = htmlentities($temp);
@@ -173,7 +174,6 @@ if ($_POST) {
 		$_POST['dsttype'] = "single";
 	}
 
-	unset($input_errors);
 	$pconfig = $_POST;
 
 	/* input validation */
@@ -290,6 +290,9 @@ if ($_POST) {
 		}
 	}
 
+	// Allow extending of the firewall edit page and include custom input validation 
+	pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/input_validation");
+
 	if (!$input_errors) {
 		$natent = array();
 
@@ -410,6 +413,9 @@ if ($_POST) {
 			mark_subsystem_dirty('filter');
 		}
 
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/pre_write_config");
+
 		// Update the NAT entry now
 		if (isset($id) && $a_nat[$id])
 			$a_nat[$id] = $natent;
@@ -443,6 +449,10 @@ include("fbegin.inc"); ?>
 				<tr>
 					<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Redirect entry"); ?></td>
 				</tr>
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/htmlphpearly");
+?>
 		<tr>
 			<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled"); ?></td>
 			<td width="78%" class="vtable">
@@ -817,6 +827,10 @@ include("fbegin.inc"); ?>
 					</select>
 				  </td>
                 </tr><?php endif; ?>
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/htmlphplate");
+?>
 				<tr>
                   <td width="22%" valign="top">&nbsp;</td>
                   <td width="78%">&nbsp;</td>
diff --git a/usr/local/www/firewall_nat_out.php b/usr/local/www/firewall_nat_out.php
index e6b5900..b8506d8 100755
--- a/usr/local/www/firewall_nat_out.php
+++ b/usr/local/www/firewall_nat_out.php
@@ -125,6 +125,17 @@ if (isset($_POST['save']) && $_POST['save'] == "Save") {
                                         $natent['natport'] = "";
                                         $a_out[] = $natent;
 					
+                                        $natent = array();
+                                        $natent['source']['network'] = "127.0.0.0/8";
+                                        $natent['dstport'] = "";
+                                        $natent['descr'] = sprintf(gettext('Auto created rule for localhost to %1$s'),$ifdesc2);
+                                        $natent['target'] = "";
+                                        $natent['interface'] = $if2;
+                                        $natent['destination']['any'] = true;
+                                        $natent['staticnatport'] = false;
+                                        $natent['natport'] = "1024:65535";
+                                        $a_out[] = $natent;
+
 					/* PPTP subnet */
 					if (($config['pptpd']['mode'] == "server") && is_private_ip($config['pptpd']['remoteip'])) {
 						$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+$config['pptpd']['n_pptp_units']));
diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php
index 4d960f2..72bc556 100755
--- a/usr/local/www/firewall_nat_out_edit.php
+++ b/usr/local/www/firewall_nat_out_edit.php
@@ -46,7 +46,7 @@ require("filter.inc");
 require("shaper.inc");
 
 if (!is_array($config['nat']['advancedoutbound']))
-        $config['nat']['advancedoutbound'] = array();
+	$config['nat']['advancedoutbound'] = array();
 
 if (!is_array($config['nat']['advancedoutbound']['rule'])) {
 	$config['nat']['advancedoutbound']['rule'] = array();
@@ -115,6 +115,15 @@ if ($_POST) {
 
 	unset($input_errors);
 	$pconfig = $_POST;
+        /*  run through $_POST items encoding HTML entties so that the user
+         *  cannot think he is slick and perform a XSS attack on the unwilling
+         */
+        foreach ($_POST as $key => $value) {
+                $temp = str_replace(">", "", $value);
+                $newpost = htmlentities($temp);
+                if($newpost <> $temp)
+                        $input_errors[] = sprintf(gettext("Invalid characters detected (%s).  Please remove invalid characters and save again."),$temp);
+        }
 
 	/* input validation */
 	$reqdfields = explode(" ", "interface protocol source source_subnet destination destination_subnet");
@@ -209,6 +218,9 @@ if ($_POST) {
 		}
 	}
 
+	// Allow extending of the firewall edit page and include custom input validation 
+	pfSense_handle_custom_code("/usr/local/pkg/firewall_aon/input_validation");
+
 	if (!$input_errors) {
 	        $natent = array();
 		$natent['source']['network'] = $osn;
@@ -265,6 +277,9 @@ if ($_POST) {
 			$natent['destination']['not'] = true;
 		}
 
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_aon/pre_write_config");
+
 		if (isset($id) && $a_out[$id]) {
 			$a_out[$id] = $natent;
 		} else {
@@ -387,6 +402,10 @@ function poolopts_change() {
 				<tr>
 					<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Advanced Outbound NAT entry");?></td>
 				</tr>
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphpearly");
+?>
 	        <tr>
                   <td width="22%" valign="top" class="vncell"><?=gettext("Do not NAT");?></td>
                   <td width="78%" class="vtable">
@@ -620,6 +639,10 @@ any)");?></td>
                     <br> <span class="vexpl"><?=gettext("You may enter a description here " .
                     "for your reference (not parsed).");?></span></td>
           </tr>
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_aon/htmlphplate");
+?>
                 <tr>
                   <td width="22%" valign="top">&nbsp;</td>
                   <td width="78%">
diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php
index daf577a..82d0323 100755
--- a/usr/local/www/firewall_rules.php
+++ b/usr/local/www/firewall_rules.php
@@ -126,12 +126,12 @@ if($_REQUEST['dragdroporder']) {
 
 $icmptypes = array(
 	"" => gettext("any"),
+	"echoreq" => gettext("Echo request"),
 	"echorep" => gettext("Echo reply"),
 	"unreach" => gettext("Destination unreachable"),
 	"squench" => gettext("Source quench"),
 	"redir" => gettext("Redirect"),
 	"althost" => gettext("Alternate Host"),
-	"echoreq" => gettext("Echo"),
 	"routeradv" => gettext("Router advertisement"),
 	"routersol" => gettext("Router solicitation"),
 	"timex" => gettext("Time exceeded"),
diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php
index c051518..acebe3c 100755
--- a/usr/local/www/firewall_rules_edit.php
+++ b/usr/local/www/firewall_rules_edit.php
@@ -253,19 +253,6 @@ if ($_POST) {
 	unset($input_errors);
 	$pconfig = $_POST;
 
-	/*  run through $_POST items encoding HTML entties so that the user
-	 *  cannot think he is slick and perform a XSS attack on the unwilling 
-	 */
-	foreach ($_POST as $key => $value) {
-		$temp = str_replace(">", "", $value);
-			
-		if (isset($_POST['floating']) && $key == "interface")
-			continue;
-		$newpost = htmlentities($temp);
-		if($newpost <> $temp)   	 
-			$input_errors[] = sprintf(gettext("Invalid characters detected (%s).  Please remove invalid characters and save again."),$temp);		
-	}
-
 	/* input validation */
 	$reqdfields = explode(" ", "type proto");
 	if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
@@ -401,6 +388,9 @@ if ($_POST) {
 			$input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well.");
 	}
 
+	// Allow extending of the firewall edit page and include custom input validation 
+	pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/input_validation");
+
 	if (!$input_errors) {
 		$filterent = array();
 		$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
@@ -544,6 +534,9 @@ if ($_POST) {
 			$filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
 		}
 
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_write_config");
+
 		if (isset($id) && $a_filter[$id])
 			$a_filter[$id] = $filterent;
 		else {
@@ -554,6 +547,7 @@ if ($_POST) {
 		}
 
 		filter_rules_sort();
+
 		write_config();
 		mark_subsystem_dirty('filter');
 
@@ -596,6 +590,10 @@ include("head.inc");
 		<tr>
 			<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Firewall rule");?></td>
 		</tr>	
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphpearly");
+?>
     	<tr>
 			<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
 			<td width="78%" class="vtable">
@@ -748,12 +746,12 @@ include("head.inc");
 <?php
 				$icmptypes = array(
 				"" => gettext("any"),
+				"echoreq" => gettext("Echo request"),
 				"echorep" => gettext("Echo reply"),
 				"unreach" => gettext("Destination unreachable"),
 				"squench" => gettext("Source quench"),
 				"redir" => gettext("Redirect"),
 				"althost" => gettext("Alternate Host"),
-				"echoreq" => gettext("Echo"),
 				"routeradv" => gettext("Router advertisement"),
 				"routersol" => gettext("Router solicitation"),
 				"timex" => gettext("Time exceeded"),
@@ -1381,6 +1379,10 @@ include("head.inc");
 			  </div>
 			</td>
 		</tr>
+<?php
+		// Allow extending of the firewall edit page and include custom input validation 
+		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphplate");
+?>
 		<tr>
 			<td width="22%" valign="top">&nbsp;</td>
 			<td width="78%">
diff --git a/usr/local/www/guiconfig.inc b/usr/local/www/guiconfig.inc
index 6b3aefd..63fadab 100755
--- a/usr/local/www/guiconfig.inc
+++ b/usr/local/www/guiconfig.inc
@@ -249,6 +249,7 @@ function print_input_errors($input_errors) {
 	global $g;
 
 	print <<<EOF
+	<div id='inputerrorsdiv' name='inputerrorsdiv'>
 	<p>
 	<table border="0" cellspacing="0" cellpadding="4" width="100%">
 	<tr>
@@ -269,6 +270,7 @@ EOF;
 			</span>
 		</td></tr>
 	</table>
+	</div>
 	</p>&nbsp;<br>
 EOF2;
 	
diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php
index 899e209..b37b6cb 100755
--- a/usr/local/www/interfaces.php
+++ b/usr/local/www/interfaces.php
@@ -711,6 +711,15 @@ if ($_POST['apply']) {
 		} else {
 			$wancfg['mss'] = $_POST['mss'];
 		}
+		if (empty($_POST['mediaopt'])) {
+			unset($wancfg['media']);
+			unset($wancfg['mediaopt']);
+		} else {
+			$mediaopts = explode(' ', $_POST['mediaopt']);	
+			if ($mediaopts[0] != ''){ $wancfg['media'] = $mediaopts[0]; }
+			if ($mediaopts[1] != ''){ $wancfg['mediaopt'] = $mediaopts[1]; }
+			else { unset($wancfg['mediaopt']); }
+		}
 		if (isset($wancfg['wireless'])) {
 			handle_wireless_post();
 		}
@@ -897,6 +906,21 @@ function check_wireless_mode() {
 	}
 }
 
+// Find all possible media options for the interface
+$mediaopts_list = array();
+$intrealname = $config['interfaces'][$if]['if'];
+exec("/sbin/ifconfig -m $intrealname | grep \"media \"", $mediaopts);
+foreach ($mediaopts as $mediaopt){
+	preg_match("/media (.*)/", $mediaopt, $matches);
+ 	if (preg_match("/(.*) mediaopt (.*)/", $matches[1], $matches1)){
+		// there is media + mediaopt like "media 1000baseT mediaopt full-duplex"
+ 		array_push($mediaopts_list, $matches1[1] . " " . $matches1[2]);
+	}else{
+		// there is only media like "media 1000baseT"
+		array_push($mediaopts_list, $matches[1]);
+	}
+}
+
 $pgtitle = array(gettext("Interfaces"), $pconfig['descr']);
 $statusurl = "status_interfaces.php";
 
@@ -1128,7 +1152,7 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
 								<?php endif; ?>
 								<br>
 								<?=gettext("This field can be used to modify (\"spoof\") the MAC " .
-								"address of the WAN interface"); ?><br>
+								"address of this interface"); ?><br>
 								<?=gettext("(may be required with some cable connections)"); ?><br>
 								<?=gettext("Enter a MAC address in the following format: xx:xx:xx:xx:xx:xx " .
 								"or leave blank"); ?>
@@ -1153,6 +1177,36 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
 								"header size) will be in effect."); ?>
 							</td>
 						</tr>
+						<?php 
+						if (count($mediaopts_list) > 0){
+						$mediaopt_from_config = $config['interfaces'][$if]['media'] . ' ' . $config['interfaces'][$if]['mediaopt'];
+						echo "<tr>";
+							echo '<td valign="top" class="vncell">' . gettext("Speed and duplex") . '</td>';
+							echo '<td class="vtable">';
+                                			echo '<div id="showadvmediabox"';
+								if ($mediaopt_from_config != 'autoselect ' && $mediaopt_from_config != ' ') echo " style='display:none'>";
+								else echo '>';
+								echo '<input type="button" onClick="show_advanced_media()" value="' . gettext("Advanced") . '"></input> - ' . gettext("Show advanced option");
+							echo "</div>";
+							echo '<div id="showmediaadv" ';
+							if ($mediaopt_from_config == 'autoselect ' || $mediaopt_from_config == ' ') echo "style='display:none'>";
+							else echo '>';
+								echo '<select name="mediaopt" class="formselect" id="mediaopt">';
+								print "<option value=\"\">Default</option>";
+								foreach($mediaopts_list as $mediaopt){
+									if ($mediaopt != rtrim($mediaopt_from_config)){
+										print "<option value=\"$mediaopt\">" . gettext("$mediaopt") . "</option>";
+									} else {
+										print "<option value=\"$mediaopt\" selected>" . gettext("$mediaopt") . "</option>";
+									}
+								}
+								echo '</select><br>';
+								echo gettext("Here you can explicitly set speed and duplex mode for this interface. WARNING: You MUST leave this set to autonegotiate unless the port this interface connects to has its speed and duplex forced.");
+						echo '</div>';
+							echo '</td>';
+						echo '</tr>';
+						}
+						?>
 						<tr>
 							<td colspan="2" valign="top" height="16"></td>
 						</tr>
@@ -2157,6 +2211,11 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
 				report_failure();
 			}
 		}
+		function show_advanced_media() {
+			document.getElementById("showadvmediabox").innerHTML='';
+			aodiv = document.getElementById('showmediaadv');
+			aodiv.style.display = "block";
+		}
 		<?php
 		echo "show_allcfg(document.iform.enable);";
 		echo "updateType('{$pconfig['type']}');\n";
diff --git a/usr/local/www/interfaces_vlan_edit.php b/usr/local/www/interfaces_vlan_edit.php
index 145fe0a..08f1a53 100755
--- a/usr/local/www/interfaces_vlan_edit.php
+++ b/usr/local/www/interfaces_vlan_edit.php
@@ -97,9 +97,13 @@ if ($_POST) {
 
 	if (!$input_errors) {
 		if (isset($id) && $a_vlans[$id]) {
-			if ($a_vlans[$id]['if'] != $_POST['if'])
-				// Destroy previous vlan
-				pfSense_interface_destroy($a_vlans[$id]['if']);
+			if (($a_vlans[$id]['if'] != $_POST['if']) || ($a_vlans[$id]['tag'] != $_POST['tag'])) {
+				if (!empty($a_vlans[$id]['vlanif']))
+					// Destroy previous vlan
+					pfSense_interface_destroy($a_vlans[$id]['vlanif']);
+				else
+					pfSense_interface_destroy("{$a_vlans[$id]['if']}_vlan{$a_vlans[$id]['tag']}");
+			}
 		}
 		$vlan = array();
 		$vlan['if'] = $_POST['if'];
diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php
index 23e6cd9..4526028 100755
--- a/usr/local/www/services_captiveportal.php
+++ b/usr/local/www/services_captiveportal.php
@@ -474,7 +474,7 @@ value="<?=htmlspecialchars($pconfig['maxprocperip']);?>"> <?=gettext("per client
 		  </tr>
 		<tr>
 		  <td colspan="2"><input name="auth_method" type="radio" id="auth_method" value="local" onClick="enable_change(false)" <?php if($pconfig['auth_method']=="local") echo "checked"; ?>>
-  <?=gettext("Local"); ?> <a href="system_usermanager.php"><?=gettext("User Manager"); ?></a></td>
+  <?=gettext("Local"); ?> <a href="system_usermanager.php"><?=gettext("User Manager"); ?></a> / <?=gettext("Vouchers"); ?></td>
 		  </tr>
 		<tr>
 		  <td colspan="2"><input name="auth_method" type="radio" id="auth_method" value="radius" onClick="enable_change(false)" <?php if($pconfig['auth_method']=="radius") echo "checked"; ?>>
@@ -520,8 +520,7 @@ value="<?=htmlspecialchars($pconfig['maxprocperip']);?>"> <?=gettext("per client
 			</tr>
 			<tr>
 				<td class="vncell" valign="top"><?=gettext("Shared secret"); ?>&nbsp;&nbsp;</td>
-				<td class="vtable"><input name="radiuskey2" type="text" class="formfld unknown" id="radiuskey2" size="16" 
-value="<?=htmlspecialchars($pconfig['radiuskey2']);?>"></td>
+				<td class="vtable"><input name="radiuskey2" type="text" class="formfld unknown" id="radiuskey2" size="16" value="<?=htmlspecialchars($pconfig['radiuskey2']);?>"></td>
 			</tr>
 			<tr>
 			  <td colspan="2" class="list" height="12"></td>
diff --git a/usr/local/www/services_captiveportal_ip_edit.php b/usr/local/www/services_captiveportal_ip_edit.php
index fd87c5b..01d52a2 100755
--- a/usr/local/www/services_captiveportal_ip_edit.php
+++ b/usr/local/www/services_captiveportal_ip_edit.php
@@ -159,6 +159,9 @@ include("head.inc");
 		<form action="services_captiveportal_ip_edit.php" method="post" name="iform" id="iform">
 		<table width="100%" border="0" cellpadding="6" cellspacing="0">
 		<tr>
+                        <td colspan="2" valign="top" class="listtopic"><?=gettext("Edit allowed ip rule");?></td>
+                </tr>
+		<tr>
 			<td width="22%" valign="top" class="vncellreq"><?=gettext("Direction"); ?></td>
 			<td width="78%" class="vtable"> 
 			<select name="dir" class="formfld">
diff --git a/usr/local/www/services_captiveportal_mac.php b/usr/local/www/services_captiveportal_mac.php
index 25c250c..f42ac80 100755
--- a/usr/local/www/services_captiveportal_mac.php
+++ b/usr/local/www/services_captiveportal_mac.php
@@ -108,6 +108,7 @@ if ($_GET['act'] == "del") {
 	if ($a_passthrumacs[$_GET['id']]) {
 		$ruleno = captiveportal_get_ipfw_passthru_ruleno($a_passthrumacs[$_GET['id']]['mac']);
 		if ($ruleno) {
+			captiveportal_free_ipfw_ruleno($ruleno);
 			mwexec("/sbin/ipfw delete {$ruleno}; /sbin/ipfw delete " . ++$ruleno);
 		}
 		unset($a_passthrumacs[$_GET['id']]);
diff --git a/usr/local/www/services_captiveportal_mac_edit.php b/usr/local/www/services_captiveportal_mac_edit.php
index aabf4b3..07f6d8c 100755
--- a/usr/local/www/services_captiveportal_mac_edit.php
+++ b/usr/local/www/services_captiveportal_mac_edit.php
@@ -153,6 +153,9 @@ include("head.inc");
 <?php if ($input_errors) print_input_errors($input_errors); ?>
             <form action="services_captiveportal_mac_edit.php" method="post" name="iform" id="iform">
               <table width="100%" border="0" cellpadding="6" cellspacing="0">
+		<tr>
+                        <td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Pass-through MAC address");?></td>
+                </tr>
 				<tr>
                   <td width="22%" valign="top" class="vncellreq"><?=gettext("MAC address"); ?></td>
                   <td width="78%" class="vtable"> 
diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php
index 19171f4..f5af953 100644
--- a/usr/local/www/services_captiveportal_vouchers.php
+++ b/usr/local/www/services_captiveportal_vouchers.php
@@ -39,6 +39,8 @@
 $statusurl = "status_captiveportal_vouchers.php";
 $logurl = "diag_logs_auth.php";
 
+if ($_POST['postafterlogin'])
+	$nocsrf= true;
 require("guiconfig.inc");
 require("functions.inc");
 require("filter.inc");
@@ -163,6 +165,12 @@ $pconfig['vouchersyncusername'] = $config['voucher']['vouchersyncusername'];
 if ($_POST) {
 
 	unset($input_errors);
+
+	if ($_POST['postafterlogin']) {
+		voucher_expire($_POST['voucher_expire']);
+		exit;
+	}
+
 	$pconfig = $_POST;
 
 	/* input validation */
@@ -198,6 +206,8 @@ if ($_POST) {
 			$input_errors[] = gettext("This doesn't look like an RSA Public key.");
 		if ($_POST['privatekey'] && (!strstr($_POST['privatekey'],"BEGIN RSA PRIVATE KEY"))) 
 			$input_errors[] = gettext("This doesn't look like an RSA Private key.");
+		if ($_POST['vouchersyncdbip'] && (is_ipaddr_configured($_POST['vouchersyncdbip']))) 
+			$input_errors[] = gettext("You cannot sync the voucher database to this host (itself).");
 	}
 
 	if (!$input_errors) {
@@ -558,7 +568,8 @@ function enable_change(enable_change) {
 							<td width="22%" valign="top" class="vncellreq"><?=gettext("Synchronize Voucher Database IP"); ?></td>
 							<td width="78%" class="vtable">
 								<input name="vouchersyncdbip" type="text" class="formfld" id="vouchersyncdbip" size="17" value="<?=htmlspecialchars($pconfig['vouchersyncdbip']);?>">
-								<br><?=gettext("IP address of master nodes webConfigurator to synchronize voucher database and used vouchers from."); ?>
+								<br/><?=gettext("IP address of master nodes webConfigurator to synchronize voucher database and used vouchers from."); ?>
+								<br/><?=gettext("NOTE: this should be setup on the slave nodes and not the primary node!"); ?>
 							</td>
 						</tr>
 						<tr> 
diff --git a/usr/local/www/services_wol.php b/usr/local/www/services_wol.php
index cdc3e6a..37d4155 100755
--- a/usr/local/www/services_wol.php
+++ b/usr/local/www/services_wol.php
@@ -156,7 +156,7 @@ include("head.inc");
 			&nbsp;<br>
 			<?=gettext("Wake all clients at once: ");?><a href="services_wol.php?wakeall=true"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_wol_all.gif" width="17" height="17" border="0"></a><p/>
 			<?=gettext("Or Click the MAC address to wake up an individual device:");?>
-			<table width="100%" border="0" cellpadding="0" cellspacing="0">
+			<table width="100%" border="0" cellpadding="0" cellspacing="0" class="tabcont">
                 <tr>
                   <td width="15%" class="listhdrr"><?=gettext("Interface");?></td>
                   <td width="25%" class="listhdrr"><?=gettext("MAC address");?></td>
diff --git a/usr/local/www/status_interfaces.php b/usr/local/www/status_interfaces.php
index 6c98a34..db88536 100755
--- a/usr/local/www/status_interfaces.php
+++ b/usr/local/www/status_interfaces.php
@@ -180,7 +180,7 @@ include("head.inc");
 			<?php 
 			$mac=$ifinfo['macaddr']; 
 			$mac_hi = strtoupper($mac[0] . $mac[1] . $mac[3] . $mac[4] . $mac[6] . $mac[7]);
-			if(isset($mac_man[$mac_hi])){ print "<span title=\"$mac\">" . htmlspecialchars($mac_man[$mac_hi]); print "</span>"; }
+			if(isset($mac_man[$mac_hi])){ print "<span>" . $mac . " - " . htmlspecialchars($mac_man[$mac_hi]); print "</span>"; }
 			      else {print htmlspecialchars($mac);}
 			?>
 		</td>
diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php
index a2aa6d2..15a096b 100644
--- a/usr/local/www/status_rrd_graph_img.php
+++ b/usr/local/www/status_rrd_graph_img.php
@@ -940,8 +940,9 @@ elseif((strstr($curdatabase, "-loggedin.rrd")) && (file_exists("$rrddbpath$curda
 	$graphcmd .= "--height 200 --width 620 ";
 	$graphcmd .= "DEF:\"$curif-loggedinusers=$rrddbpath$curdatabase:loggedinusers:AVERAGE\" ";
 	$graphcmd .= "CDEF:\"$curif-totalusers_t=PREV,UN,0,PREV,IF,$curif-loggedinusers,+\" ";
-	$graphcmd .= "AREA:\"$curif-totalusers_t#{$colorcaptiveportalusers[0]}:Total logged in users\" ";
-	$graphcmd .= "GPRINT:\"$curif-totalusers_t:MAX:%8.0lf \\n\" ";
+	$graphcmd .= "CDEF:\"$curif-totalusers_d=$curif-totalusers_t,FLOOR\" ";
+	$graphcmd .= "AREA:\"$curif-totalusers_d#{$colorcaptiveportalusers[0]}:Total logged in users\" ";
+	$graphcmd .= "GPRINT:\"$curif-totalusers_d:MAX:%8.0lf \\n\" ";
 	$graphcmd .= "COMMENT:\"\\n\" ";
 	$graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" ";	
 }
diff --git a/usr/local/www/system_advanced_misc.php b/usr/local/www/system_advanced_misc.php
index 51857ab..2264365 100644
--- a/usr/local/www/system_advanced_misc.php
+++ b/usr/local/www/system_advanced_misc.php
@@ -56,6 +56,7 @@ $pconfig['proxyuser'] = $config['system']['proxyuser'];
 $pconfig['proxypass'] = $config['system']['proxypass'];
 $pconfig['harddiskstandby'] = $config['system']['harddiskstandby'];
 $pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']);
+$pconfig['gw_switch_default'] = isset($config['system']['gw_switch_default']);
 $pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']);
 $pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']);
 $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);
@@ -106,6 +107,11 @@ if ($_POST) {
 		else
 			unset($config['system']['lb_use_sticky']);
 
+		if($_POST['gw_switch_default'] == "yes")
+			$config['system']['gw_switch_default'] = true;
+		else
+			unset($config['system']['gw_switch_default']);
+
 		if($_POST['preferoldsa_enable'] == "yes")
 			$config['ipsec']['preferoldsa'] = true;
 		else
@@ -272,6 +278,15 @@ function maxmss_checked(obj) {
 								</td>
 							</tr>
 							<tr>
+								<td width="22%" valign="top" class="vncell"><?=gettext("Load Balancing"); ?></td>
+								<td width="78%" class="vtable">
+									<input name="gw_switch_default" type="checkbox" id="gw_switch_default" value="yes" <?php if ($pconfig['gw_switch_default']) echo "checked=\"checked\""; ?> />
+									<strong><?=gettext("Allow default gateway switching"); ?></strong><br/>
+									<?=gettext("If the link where the default gateway resides fails " .
+									"switch the default gateway to another available one."); ?>
+								</td>
+							</tr>
+							<tr>
 								<td colspan="2" class="list" height="12">&nbsp;</td>
 							</tr>
 							<tr>
diff --git a/usr/local/www/system_camanager.php b/usr/local/www/system_camanager.php
index e1b83f2..5541f83 100644
--- a/usr/local/www/system_camanager.php
+++ b/usr/local/www/system_camanager.php
@@ -92,6 +92,8 @@ if ($act == "del") {
 	unset($a_ca[$id]);
 	write_config();
 	$savemsg = sprintf(gettext("Certificate Authority %s and its CRLs (if any) successfully deleted"), $name) . "<br/>";
+	pfSenseHeader("system_camanager.php");
+	exit;
 }
 
 if ($act == "edit") {
diff --git a/usr/local/www/system_certmanager.php b/usr/local/www/system_certmanager.php
index cc1c65a..470f0cd 100644
--- a/usr/local/www/system_certmanager.php
+++ b/usr/local/www/system_certmanager.php
@@ -94,6 +94,8 @@ if ($act == "del") {
 	unset($a_cert[$id]);
 	write_config();
 	$savemsg = sprintf(gettext("Certificate %s successfully deleted"), $name) . "<br/>";
+	pfSenseHeader("system_certmanager.php");
+	exit;
 }
 
 if ($act == "new") {
diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php
index d810cb9..783eb0f 100644
--- a/usr/local/www/system_usermanager.php
+++ b/usr/local/www/system_usermanager.php
@@ -49,311 +49,304 @@
 require("certs.inc");
 require("guiconfig.inc");
 
-if (isAllowedPage("system_usermanager")) {
 
-	// start admin user code
-	$pgtitle = array(gettext("System"),gettext("User Manager"));
+// start admin user code
+$pgtitle = array(gettext("System"),gettext("User Manager"));
 
-	$id = $_GET['id'];
-	if (isset($_POST['id']))
-		$id = $_POST['id'];
+$id = $_GET['id'];
+if (isset($_POST['id']))
+	$id = $_POST['id'];
 
-	if (!is_array($config['system']['user'])) 
-		$config['system']['user'] = array();
+if (!is_array($config['system']['user'])) 
+	$config['system']['user'] = array();
 
-	$a_user = &$config['system']['user'];
+$a_user = &$config['system']['user'];
 
-	if ($_GET['act'] == "deluser") {
+if ($_GET['act'] == "deluser") {
 
-		if (!$a_user[$id]) {
-			pfSenseHeader("system_usermanager.php");
-			exit;
-		}
-
-		local_user_del($a_user[$id]);
-		$userdeleted = $a_user[$id]['name'];
-		unset($a_user[$id]);
-		write_config();
-		$savemsg = gettext("User")." {$userdeleted} ".
-					gettext("successfully deleted")."<br/>";
+	if (!$a_user[$id]) {
+		pfSenseHeader("system_usermanager.php");
+		exit;
 	}
 
-	if ($_GET['act'] == "delpriv") {
-
-		if (!$a_user[$id]) {
-			pfSenseHeader("system_usermanager.php");
-			exit;
-		}
+	local_user_del($a_user[$id]);
+	$userdeleted = $a_user[$id]['name'];
+	unset($a_user[$id]);
+	write_config();
+	$savemsg = gettext("User")." {$userdeleted} ".
+				gettext("successfully deleted")."<br/>";
+}
+else if ($_GET['act'] == "delpriv") {
 
-		$privdeleted = $priv_list[$a_user[$id]['priv'][$_GET['privid']]]['name'];
-		unset($a_user[$id]['priv'][$_GET['privid']]);
-		local_user_set($a_user[$id]);
-		write_config();
-		$_GET['act'] = "edit";
-		$savemsg = gettext("Privilege")." {$privdeleted} ".
-					gettext("successfully deleted")."<br/>";
+	if (!$a_user[$id]) {
+		pfSenseHeader("system_usermanager.php");
+		exit;
 	}
 
-	if ($_GET['act'] == "expcert") {
-
-		if (!$a_user[$id]) {
-			pfSenseHeader("system_usermanager.php");
-			exit;
-		}
-
-		$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
-
-		$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.crt");
-		$exp_data = base64_decode($cert['crt']);
-		$exp_size = strlen($exp_data);
+	$privdeleted = $priv_list[$a_user[$id]['priv'][$_GET['privid']]]['name'];
+	unset($a_user[$id]['priv'][$_GET['privid']]);
+	local_user_set($a_user[$id]);
+	write_config();
+	$_GET['act'] = "edit";
+	$savemsg = gettext("Privilege")." {$privdeleted} ".
+				gettext("successfully deleted")."<br/>";
+}
+else if ($_GET['act'] == "expcert") {
 
-		header("Content-Type: application/octet-stream");
-		header("Content-Disposition: attachment; filename={$exp_name}");
-		header("Content-Length: $exp_size");
-		echo $exp_data;
+	if (!$a_user[$id]) {
+		pfSenseHeader("system_usermanager.php");
 		exit;
 	}
 
-	if ($_GET['act'] == "expckey") {
-
-		if (!$a_user[$id]) {
-			pfSenseHeader("system_usermanager.php");
-			exit;
-		}
+	$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
 
-		$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
+	$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.crt");
+	$exp_data = base64_decode($cert['crt']);
+	$exp_size = strlen($exp_data);
 
-		$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.key");
-		$exp_data = base64_decode($cert['prv']);
-		$exp_size = strlen($exp_data);
+	header("Content-Type: application/octet-stream");
+	header("Content-Disposition: attachment; filename={$exp_name}");
+	header("Content-Length: $exp_size");
+	echo $exp_data;
+	exit;
+}
+else if ($_GET['act'] == "expckey") {
 
-		header("Content-Type: application/octet-stream");
-		header("Content-Disposition: attachment; filename={$exp_name}");
-		header("Content-Length: $exp_size");
-		echo $exp_data;
+	if (!$a_user[$id]) {
+		pfSenseHeader("system_usermanager.php");
 		exit;
 	}
 
-	if ($_GET['act'] == "delcert") {
+	$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
 
-		if (!$a_user[$id]) {
-			pfSenseHeader("system_usermanager.php");
-			exit;
-		}
+	$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.key");
+	$exp_data = base64_decode($cert['prv']);
+	$exp_size = strlen($exp_data);
 
-		$certdeleted = lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
-		$certdeleted = $certdeleted['descr'];
-		unset($a_user[$id]['cert'][$_GET['certid']]);
-		write_config();
-		$_GET['act'] = "edit";
-		$savemsg = gettext("Certificate")." {$certdeleted} ".
-					gettext("association removed.")."<br/>";
-	}
+	header("Content-Type: application/octet-stream");
+	header("Content-Disposition: attachment; filename={$exp_name}");
+	header("Content-Length: $exp_size");
+	echo $exp_data;
+	exit;
+}
+else if ($_GET['act'] == "delcert") {
 
-	if ($_GET['act'] == "edit") {
-		if (isset($id) && $a_user[$id]) {
-			$pconfig['usernamefld'] = $a_user[$id]['name'];
-			$pconfig['descr'] = $a_user[$id]['descr'];
-			$pconfig['expires'] = $a_user[$id]['expires'];
-			$pconfig['groups'] = local_user_get_groups($a_user[$id]);
-			$pconfig['utype'] = $a_user[$id]['scope'];
-			$pconfig['uid'] = $a_user[$id]['uid'];
-			$pconfig['authorizedkeys'] = base64_decode($a_user[$id]['authorizedkeys']);
-			$pconfig['priv'] = $a_user[$id]['priv'];
-			$pconfig['ipsecpsk'] = $a_user[$id]['ipsecpsk'];
-			$pconfig['disabled'] = isset($a_user[$id]['disabled']);
-		}
+	if (!$a_user[$id]) {
+		pfSenseHeader("system_usermanager.php");
+		exit;
 	}
 
-	if ($_GET['act'] == "new") {
-		/*
-		 * set this value cause the text field is read only
-		 * and the user should not be able to mess with this
-		 * setting.
-		 */
-		$pconfig['utype'] = "user";
-		$pconfig['lifetime'] = 3650;
+	$certdeleted = lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
+	$certdeleted = $certdeleted['descr'];
+	unset($a_user[$id]['cert'][$_GET['certid']]);
+	write_config();
+	$_GET['act'] = "edit";
+	$savemsg = gettext("Certificate")." {$certdeleted} ".
+				gettext("association removed.")."<br/>";
+}
+else if ($_GET['act'] == "edit") {
+	if (isset($id) && $a_user[$id]) {
+		$pconfig['usernamefld'] = $a_user[$id]['name'];
+		$pconfig['descr'] = $a_user[$id]['descr'];
+		$pconfig['expires'] = $a_user[$id]['expires'];
+		$pconfig['groups'] = local_user_get_groups($a_user[$id]);
+		$pconfig['utype'] = $a_user[$id]['scope'];
+		$pconfig['uid'] = $a_user[$id]['uid'];
+		$pconfig['authorizedkeys'] = base64_decode($a_user[$id]['authorizedkeys']);
+		$pconfig['priv'] = $a_user[$id]['priv'];
+		$pconfig['ipsecpsk'] = $a_user[$id]['ipsecpsk'];
+		$pconfig['disabled'] = isset($a_user[$id]['disabled']);
 	}
+}
+else if ($_GET['act'] == "new") {
+	/*
+	 * set this value cause the text field is read only
+	 * and the user should not be able to mess with this
+	 * setting.
+	 */
+	$pconfig['utype'] = "user";
+	$pconfig['lifetime'] = 3650;
+}
 
-	if ($_POST) {
-		unset($input_errors);
-		$pconfig = $_POST;
+if ($_POST) {
+	unset($input_errors);
+	$pconfig = $_POST;
 
-		/* input validation */
-		if (isset($id) && ($a_user[$id])) {
-			$reqdfields = explode(" ", "usernamefld");
-			$reqdfieldsn = array(gettext("Username"));
+	/* input validation */
+	if (isset($id) && ($a_user[$id])) {
+		$reqdfields = explode(" ", "usernamefld");
+		$reqdfieldsn = array(gettext("Username"));
+	} else {
+		if (empty($_POST['name'])) {
+			$reqdfields = explode(" ", "usernamefld passwordfld1");
+			$reqdfieldsn = array(
+				gettext("Username"),
+				gettext("Password"));
 		} else {
-			if (empty($_POST['name'])) {
-				$reqdfields = explode(" ", "usernamefld passwordfld1");
-				$reqdfieldsn = array(
-					gettext("Username"),
-					gettext("Password"));
-			} else {
-				$reqdfields = explode(" ", "usernamefld passwordfld1 name caref keylen lifetime");
-				$reqdfieldsn = array(
-					gettext("Username"),
-					gettext("Password"),
-					gettext("Descriptive name"),
-					gettext("Certificate authority"),
-					gettext("Key length"),
-					gettext("Lifetime"));
-			}
+			$reqdfields = explode(" ", "usernamefld passwordfld1 name caref keylen lifetime");
+			$reqdfieldsn = array(
+				gettext("Username"),
+				gettext("Password"),
+				gettext("Descriptive name"),
+				gettext("Certificate authority"),
+				gettext("Key length"),
+				gettext("Lifetime"));
 		}
+	}
 
-		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
+	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
 
-		if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['usernamefld']))
-			$input_errors[] = gettext("The username contains invalid characters.");
+	if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['usernamefld']))
+		$input_errors[] = gettext("The username contains invalid characters.");
 
-		if (strlen($_POST['usernamefld']) > 16)
-			$input_errors[] = gettext("The username is longer than 16 characters.");
+	if (strlen($_POST['usernamefld']) > 16)
+		$input_errors[] = gettext("The username is longer than 16 characters.");
 
-		if (($_POST['passwordfld1']) && ($_POST['passwordfld1'] != $_POST['passwordfld2']))
-			$input_errors[] = gettext("The passwords do not match.");
+	if (($_POST['passwordfld1']) && ($_POST['passwordfld1'] != $_POST['passwordfld2']))
+		$input_errors[] = gettext("The passwords do not match.");
 
-		if (isset($id) && $a_user[$id])
-			$oldusername = $a_user[$id]['name'];
-		else
-			$oldusername = "";
-		/* make sure this user name is unique */
-		if (!$input_errors) {
-			foreach ($a_user as $userent) {
-				if ($userent['name'] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
-					$input_errors[] = gettext("Another entry with the same username already exists.");
-					break;
-				}
+	if (isset($id) && $a_user[$id])
+		$oldusername = $a_user[$id]['name'];
+	else
+		$oldusername = "";
+	/* make sure this user name is unique */
+	if (!$input_errors) {
+		foreach ($a_user as $userent) {
+			if ($userent['name'] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
+				$input_errors[] = gettext("Another entry with the same username already exists.");
+				break;
 			}
 		}
-		/* also make sure it is not reserved */
-		if (!$input_errors) {
-			$system_users = explode("\n", file_get_contents("/etc/passwd"));
-			foreach ($system_users as $s_user) {
-				$ent = explode(":", $s_user);
-				if ($ent[0] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
-					$input_errors[] = gettext("That username is reserved by the system.");
-					break;
-				}
+	}
+	/* also make sure it is not reserved */
+	if (!$input_errors) {
+		$system_users = explode("\n", file_get_contents("/etc/passwd"));
+		foreach ($system_users as $s_user) {
+			$ent = explode(":", $s_user);
+			if ($ent[0] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
+				$input_errors[] = gettext("That username is reserved by the system.");
+				break;
 			}
 		}
+	}
 
-		/*
-		 * Check for a valid expirationdate if one is set at all (valid means,
-		 * strtotime() puts out a time stamp so any strtotime compatible time
-		 * format may be used. to keep it simple for the enduser, we only
-		 * claim to accept MM/DD/YYYY as inputs. Advanced users may use inputs
-		 * like "+1 day", which will be converted to MM/DD/YYYY based on "now".
-		 * Otherwhise such an entry would lead to an invalid expiration data.
-		 */
-		if ($_POST['expires']){
-			if(strtotime($_POST['expires']) > 0){
-				if (strtotime("-1 day") > strtotime(date("m/d/Y",strtotime($_POST['expires'])))) {
-					// Allow items to lie in the past which ends up disabling.
-				} else {
-					//convert from any strtotime compatible date to MM/DD/YYYY
-					$expdate = strtotime($_POST['expires']);
-					$_POST['expires'] = date("m/d/Y",$expdate);
-				}
+	/*
+	 * Check for a valid expirationdate if one is set at all (valid means,
+	 * strtotime() puts out a time stamp so any strtotime compatible time
+	 * format may be used. to keep it simple for the enduser, we only
+	 * claim to accept MM/DD/YYYY as inputs. Advanced users may use inputs
+	 * like "+1 day", which will be converted to MM/DD/YYYY based on "now".
+	 * Otherwhise such an entry would lead to an invalid expiration data.
+	 */
+	if ($_POST['expires']){
+		if(strtotime($_POST['expires']) > 0){
+			if (strtotime("-1 day") > strtotime(date("m/d/Y",strtotime($_POST['expires'])))) {
+				// Allow items to lie in the past which ends up disabling.
 			} else {
-				$input_errors[] = gettext("Invalid expiration date format; use MM/DD/YYYY instead.");
+				//convert from any strtotime compatible date to MM/DD/YYYY
+				$expdate = strtotime($_POST['expires']);
+				$_POST['expires'] = date("m/d/Y",$expdate);
 			}
+		} else {
+			$input_errors[] = gettext("Invalid expiration date format; use MM/DD/YYYY instead.");
 		}
+	}
 
-		if (!empty($_POST['name'])) {
-			$ca = lookup_ca($_POST['caref']);
-        		if (!$ca)
-                		$input_errors[] = gettext("Invalid internal Certificate Authority") . "\n";
-		}
+	if (!empty($_POST['name'])) {
+		$ca = lookup_ca($_POST['caref']);
+       		if (!$ca)
+               		$input_errors[] = gettext("Invalid internal Certificate Authority") . "\n";
+	}
 
-		/* if this is an AJAX caller then handle via JSON */
-		if (isAjax() && is_array($input_errors)) {
-			input_errors2Ajax($input_errors);
-			exit;
-		}
+	/* if this is an AJAX caller then handle via JSON */
+	if (isAjax() && is_array($input_errors)) {
+		input_errors2Ajax($input_errors);
+		exit;
+	}
 
-		if (!$input_errors) {
-			conf_mount_rw();
-			$userent = array();
-			if (isset($id) && $a_user[$id])
-				$userent = $a_user[$id];
-
-			isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system";
-
-			/* the user name was modified */
-			if ($_POST['usernamefld'] <> $_POST['oldusername'])
-				$_SERVER['REMOTE_USER'] = $_POST['usernamefld'];
-
-			/* the user password was mofified */
-			if ($_POST['passwordfld1'])
-				local_user_set_password($userent, $_POST['passwordfld1']);
-
-			$userent['name'] = $_POST['usernamefld'];
-			$userent['descr'] = $_POST['descr'];
-			$userent['expires'] = $_POST['expires'];
-			$userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']);
-			$userent['ipsecpsk'] = $_POST['ipsecpsk'];
-			
-			if($_POST['disabled'])
-				$userent['disabled'] = true;
-			else 
-				unset($userent['disabled']);
-
-			if (isset($id) && $a_user[$id])
-				$a_user[$id] = $userent;
-			else {
-				if (!empty($_POST['name'])) {
-					$cert = array();
-					$cert['refid'] = uniqid();
-                        		$userent['cert'] = array();
-
-					$cert['descr'] = $_POST['name'];
-
-                			$subject = cert_get_subject_array($ca['crt']);
-
-                			$dn = array(
-                        			'countryName' => $subject[0]['v'],
-                        			'stateOrProvinceName' => $subject[1]['v'],
-                        			'localityName' => $subject[2]['v'],
-                        			'organizationName' => $subject[3]['v'],
-                        			'emailAddress' => $subject[4]['v'],
-                        			'commonName' => $userent['name']);
-
-					cert_create($cert, $_POST['caref'], $_POST['keylen'],
-						(int)$_POST['lifetime'], $dn);
-
-					if (!is_array($config['cert']))
-						$config['cert'] = array();
-					$config['cert'][] = $cert;
-					$userent['cert'][] = $cert['refid'];
-				}
-				$userent['uid'] = $config['system']['nextuid']++;
-				/* Add the user to All Users group. */
-				foreach ($config['system']['group'] as $gidx => $group) {
-					if ($group['name'] == "all") {
-						if (!is_array($config['system']['group'][$gidx]['member']))
-							$config['system']['group'][$gidx]['member'] = array();
-						$config['system']['group'][$gidx]['member'][] = $userent['uid'];
-						break;
-					}
-				}
+	if (!$input_errors) {
+		conf_mount_rw();
+		$userent = array();
+		if (isset($id) && $a_user[$id])
+			$userent = $a_user[$id];
 
-				$a_user[] = $userent;
-			}
+		isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system";
+
+		/* the user name was modified */
+		if ($_POST['usernamefld'] <> $_POST['oldusername'])
+			$_SERVER['REMOTE_USER'] = $_POST['usernamefld'];
 
-			local_user_set_groups($userent,$_POST['groups']);
-			local_user_set($userent);
-			write_config();
+		/* the user password was mofified */
+		if ($_POST['passwordfld1'])
+			local_user_set_password($userent, $_POST['passwordfld1']);
 
-			if(is_dir("/etc/inc/privhooks"))
-				run_plugins("/etc/inc/privhooks");
+		$userent['name'] = $_POST['usernamefld'];
+		$userent['descr'] = $_POST['descr'];
+		$userent['expires'] = $_POST['expires'];
+		$userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']);
+		$userent['ipsecpsk'] = $_POST['ipsecpsk'];
+		
+		if($_POST['disabled'])
+			$userent['disabled'] = true;
+		else 
+			unset($userent['disabled']);
+
+		if (isset($id) && $a_user[$id])
+			$a_user[$id] = $userent;
+		else {
+			if (!empty($_POST['name'])) {
+				$cert = array();
+				$cert['refid'] = uniqid();
+                       		$userent['cert'] = array();
+
+				$cert['descr'] = $_POST['name'];
+
+               			$subject = cert_get_subject_array($ca['crt']);
+
+               			$dn = array(
+                       			'countryName' => $subject[0]['v'],
+                       			'stateOrProvinceName' => $subject[1]['v'],
+                       			'localityName' => $subject[2]['v'],
+                       			'organizationName' => $subject[3]['v'],
+                       			'emailAddress' => $subject[4]['v'],
+                       			'commonName' => $userent['name']);
+
+				cert_create($cert, $_POST['caref'], $_POST['keylen'],
+					(int)$_POST['lifetime'], $dn);
+
+				if (!is_array($config['cert']))
+					$config['cert'] = array();
+				$config['cert'][] = $cert;
+				$userent['cert'][] = $cert['refid'];
+			}
+			$userent['uid'] = $config['system']['nextuid']++;
+			/* Add the user to All Users group. */
+			foreach ($config['system']['group'] as $gidx => $group) {
+				if ($group['name'] == "all") {
+					if (!is_array($config['system']['group'][$gidx]['member']))
+						$config['system']['group'][$gidx]['member'] = array();
+					$config['system']['group'][$gidx]['member'][] = $userent['uid'];
+					break;
+				}
+			}
 
-			conf_mount_ro();
-			
-			pfSenseHeader("system_usermanager.php");
+			$a_user[] = $userent;
 		}
+
+		local_user_set_groups($userent,$_POST['groups']);
+		local_user_set($userent);
+		write_config();
+
+		if(is_dir("/etc/inc/privhooks"))
+			run_plugins("/etc/inc/privhooks");
+
+		conf_mount_ro();
+		
+		pfSenseHeader("system_usermanager.php");
 	}
+}
 
-	include("head.inc");
+include("head.inc");
 ?>
 
 <body link="#000000" vlink="#000000" alink="#000000" onload="<?= $jsevents["body"]["onload"] ?>">
@@ -871,98 +864,4 @@ function sshkeyClicked(obj) {
 </table>
 <?php include("fend.inc");?>
 </body>
-
-<?php
-
-	// end admin user code
-
-} else {
-
-	// start normal user code
-
-	$pgtitle = array(gettext("System"),gettext("User Password"));
-
-	if (isset($_POST['save'])) {
-		unset($input_errors);
-
-		/* input validation */
-		$reqdfields = explode(" ", "passwordfld1");
-		$reqdfieldsn = array(gettext("Password"));
-
-		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
-
-		if ($_POST['passwordfld1'] != $_POST['passwordfld2'])
-			$input_errors[] = gettext("The passwords do not match.");
-
-		if (!$input_errors) {
-			// all values are okay --> saving changes
-			$config['system']['user'][$userindex[$HTTP_SERVER_VARS['AUTH_USER']]]['password'] = crypt(trim($_POST['passwordfld1']));
-			local_user_set($config['system']['user'][$userindex[$HTTP_SERVER_VARS['AUTH_USER']]]);
-			write_config();
-			$savemsg = gettext("Password successfully changed") . "<br />";
-		}
-	}
-
-	/* determine if user is not local to system */
-	$islocal = false;
-	foreach($config['system']['user'] as $user) 
-		if($user['name'] == $_SESSION['Username'])
-			$islocal = true;
-?>
-
-<body link="#000000" vlink="#000000" alink="#000000" onload="<?= $jsevents["body"]["onload"] ?>">
-<?php
-    include("head.inc");
-	include("fbegin.inc");
-	if ($input_errors)
-		print_input_errors($input_errors);
-	if ($savemsg)
-		print_info_box($savemsg);
-
-	if($islocal == false) {
-		echo gettext("Sorry, you cannot change the password for a LDAP user.");
-		include("fend.inc");
-		exit;
-	}
-?>
-<div id="mainarea">
-	<div class="tabcont">
-		<form action="system_usermanager.php" method="post" name="iform" id="iform">
-			<table width="100%" border="0" cellpadding="6" cellspacing="0">
-				<tr>
-					<td colspan="2" valign="top" class="listtopic"><?=$HTTP_SERVER_VARS['AUTH_USER']?>'s <?=gettext("Password"); ?></td>
-				</tr>
-				<tr>
-					<td width="22%" valign="top" class="vncell" rowspan="2"><?=gettext("Password"); ?></td>
-					<td width="78%" class="vtable">
-						<input name="passwordfld1" type="password" class="formfld pwd" id="passwordfld1" size="20" />
-					</td>
-				</tr>
-				<tr>
-					<td width="78%" class="vtable">
-						<input name="passwordfld2" type="password" class="formfld pwd" id="passwordfld2" size="20" />
-						&nbsp;<?=gettext("(confirmation)");?>
-						<br/>
-						<span class="vexpl">
-							<?=gettext("Select a new password");?>
-						</span>
-					</td>
-				</tr>
-				<tr>
-					<td width="22%" valign="top">&nbsp;</td>
-					<td width="78%">
-						<input name="save" type="submit" class="formbtn" value="<?=gettext("Save");?>" />
-					</td>
-				</tr>
-			</table>
-		</form>
-	</div>
-</div>
-<?php include("fend.inc");?>
-</body>
-
-<?php
-
-} // end of normal user code
-
-?>
+</html>
diff --git a/usr/local/www/system_usermanager_passwordmg.php b/usr/local/www/system_usermanager_passwordmg.php
new file mode 100644
index 0000000..b8b3f76
--- /dev/null
+++ b/usr/local/www/system_usermanager_passwordmg.php
@@ -0,0 +1,128 @@
+<?php
+/* $Id$ */
+/*
+    Copyright (C) 2011 Ermal Luçi
+    system_usermanager.php
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+/*
+        pfSense_BUILDER_BINARIES:
+        pfSense_MODULE: auth
+*/
+
+##|+PRIV
+##|*IDENT=page-system-usermanager-passwordmg
+##|*NAME=System: User Password Manager page
+##|*DESCR=Allow access to the 'System: User Password Manager' page.
+##|*MATCH=system_usermanager_passwordmg.php*
+##|-PRIV
+
+require_once("certs.inc");
+require_once("guiconfig.inc");
+
+$pgtitle = array(gettext("System"),gettext("User Password"));
+
+if (isset($_POST['save'])) {
+	unset($input_errors);
+	/* input validation */
+
+	$reqdfields = explode(" ", "passwordfld1");
+	$reqdfieldsn = array(gettext("Password"));
+	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
+
+	if ($_POST['passwordfld1'] != $_POST['passwordfld2'])
+		$input_errors[] = gettext("The passwords do not match.");
+
+	if (!$input_errors) {
+		// all values are okay --> saving changes
+		$config['system']['user'][$userindex[$HTTP_SERVER_VARS['AUTH_USER']]]['password'] = crypt(trim($_POST['passwordfld1']));
+		local_user_set($config['system']['user'][$userindex[$HTTP_SERVER_VARS['AUTH_USER']]]);
+
+		write_config();
+
+		$savemsg = gettext("Password successfully changed") . "<br />";
+	}
+}
+
+/* determine if user is not local to system */
+$islocal = false;
+foreach($config['system']['user'] as $user)
+	if($user['name'] == $_SESSION['Username'])
+		$islocal = true;
+
+?>
+
+<body link="#000000" vlink="#000000" alink="#000000" onload="<?= $jsevents["body"]["onload"] ?>">
+<?php
+include("head.inc");
+include("fbegin.inc");
+
+if ($input_errors)
+	print_input_errors($input_errors);
+if ($savemsg)
+	print_info_box($savemsg);
+
+if ($islocal == false) {
+	echo gettext("Sorry, you cannot change the password for a non-local user.");
+	include("fend.inc");
+	exit;
+}
+
+?>
+
+<div id="mainarea">
+        <div class="tabcont">
+                <form action="system_usermanager_passwordmg.php" method="post" name="iform" id="iform">
+                        <table width="100%" border="0" cellpadding="6" cellspacing="0">
+                                <tr>
+                                        <td colspan="2" valign="top" class="listtopic"><?=$HTTP_SERVER_VARS['AUTH_USER']?>'s <?=gettext("Password"); ?></td>
+                                </tr>
+                                <tr>
+                                        <td width="22%" valign="top" class="vncell" rowspan="2"><?=gettext("Password"); ?></td>
+                                        <td width="78%" class="vtable">
+                                                <input name="passwordfld1" type="password" class="formfld pwd" id="passwordfld1" size="20" />
+                                        </td>
+                                </tr>
+                                <tr>
+                                        <td width="78%" class="vtable">
+                                                <input name="passwordfld2" type="password" class="formfld pwd" id="passwordfld2" size="20" />
+                                                &nbsp;<?=gettext("(confirmation)");?>
+                                                <br/>
+                                                <span class="vexpl">
+                                                        <?=gettext("Select a new password");?>
+                                                </span>
+                                        </td>
+                                </tr>
+                                <tr>
+                                        <td width="22%" valign="top">&nbsp;</td>
+                                        <td width="78%">
+                                                <input name="save" type="submit" class="formbtn" value="<?=gettext("Save");?>" />
+                                        </td>
+                                </tr>
+                        </table>
+                </form>
+        </div>
+</div>
+<?php include("fend.inc");?>
+</body>
+</html>
diff --git a/usr/local/www/themes/pfsense_ng/all.css b/usr/local/www/themes/pfsense_ng/all.css
index 650d52d..b89299d 100644
--- a/usr/local/www/themes/pfsense_ng/all.css
+++ b/usr/local/www/themes/pfsense_ng/all.css
@@ -1333,7 +1333,7 @@ div#log span.log-protocol-mini-header {
 /* Sortable tables */
 table.sortable thead {
     cursor: default;
-	background-color: #EEEEEE;
+<!--	background-color: #EEEEEE; this causing light gray rectangles to the right of many tables in gui -->
 	padding-right: 12px;
 	padding-left: 12px;
 	padding-top: 12px;
diff --git a/usr/local/www/vpn_ipsec.php b/usr/local/www/vpn_ipsec.php
index 465c607..54ed505 100755
--- a/usr/local/www/vpn_ipsec.php
+++ b/usr/local/www/vpn_ipsec.php
@@ -375,6 +375,9 @@ include("head.inc");
 										<a href="vpn_ipsec.php?act=delph2&p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
 											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0">
 										</a>
+										<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
+											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0">
+										</a>
 									</td>
 								</tr>
 
diff --git a/usr/local/www/vpn_ipsec_phase1.php b/usr/local/www/vpn_ipsec_phase1.php
index 7cc8ac0..b4890ad 100644
--- a/usr/local/www/vpn_ipsec_phase1.php
+++ b/usr/local/www/vpn_ipsec_phase1.php
@@ -89,6 +89,7 @@ if (isset($p1index) && $a_phase1[$p1index]) {
 	$pconfig['dhgroup'] = $a_phase1[$p1index]['dhgroup'];
 	$pconfig['lifetime'] = $a_phase1[$p1index]['lifetime'];
 	$pconfig['authentication_method'] = $a_phase1[$p1index]['authentication_method'];
+	$pconfig['generate_policy'] = $a_phase1[$p1index]['generate_policy'];
 	$pconfig['proposal_check'] = $a_phase1[$p1index]['proposal_check'];
 
 	if (($pconfig['authentication_method'] == "pre_shared_key") || 
@@ -307,6 +308,7 @@ if ($_POST) {
 		$ph1ent['certref'] = $pconfig['certref'];
 		$ph1ent['caref'] = $pconfig['caref'];
 		$ph1ent['authentication_method'] = $pconfig['authentication_method'];
+		$ph1ent['generate_policy'] = $pconfig['generate_policy'];
 		$ph1ent['proposal_check'] = $pconfig['proposal_check'];
 		$ph1ent['descr'] = $pconfig['descr'];
 		$ph1ent['nat_traversal'] = $pconfig['nat_traversal'];
@@ -644,6 +646,22 @@ function dpdchkbox_change() {
 							</span>
 						</td>
 					</tr>
+					<tr id="generate_policy">
+						<td width="22%" valign="top" class="vncellreq"><?=gettext("Policy Generation"); ?></td>
+						<td width="78%" class="vtable">
+							<select name="generate_policy" class="formselect">
+								<option value="" <?php if (empty($pconfig['generate_policy'])) echo "selected"; ?>>Default</option>
+								<option value="on" <?php if ($pconfig['generate_policy'] == "on") echo "selected"; ?>>On</option>
+								<option value="off" <?php if ($pconfig['generate_policy'] == "off") echo "selected"; ?>>Off</option>
+								<option value="require" <?php if ($pconfig['generate_policy'] == "require") echo "selected"; ?>>Require</option>
+								<option value="unique" <?php if ($pconfig['generate_policy'] == "unique") echo "selected"; ?>>Unique</option>
+							</select>
+							<br>
+							<span class="vexpl">
+								<?=gettext("When working as a responder (as with mobile clients), this controls how policies are generated based on SA proposals."); ?>
+							</span>
+						</td>
+					</tr>
 					<tr id="proposal_check">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Proposal Checking"); ?></td>
 						<td width="78%" class="vtable">
diff --git a/usr/local/www/vpn_ipsec_phase2.php b/usr/local/www/vpn_ipsec_phase2.php
index d45b0d6..395b81e 100644
--- a/usr/local/www/vpn_ipsec_phase2.php
+++ b/usr/local/www/vpn_ipsec_phase2.php
@@ -140,9 +140,64 @@ if ($_POST) {
 				break;
 		}
 	}
-
-	/* TODO : Validate enabled phase2's are not duplicates */
-
+	/* Validate enabled phase2's are not duplicates */
+	if (isset($pconfig['mobile'])){
+		/* User is adding phase 2 for mobile phase1 */
+		foreach($a_phase2 as $key => $name){
+			if (isset($name['mobile'])){
+				/* check duplicate localids only for mobile clents */
+				$localid_data = ipsec_idinfo_to_cidr($name['localid']);
+				$entered = array();
+				$entered['type'] = $pconfig['localid_type'];
+				if (isset($pconfig['localid_address'])) $entered['address'] = $pconfig['localid_address'];
+				if (isset($pconfig['localid_netbits'])) $entered['netbits'] = $pconfig['localid_netbits'];
+				$entered_localid_data = ipsec_idinfo_to_cidr($entered);
+				if ($localid_data == $entered_localid_data){
+					if (!isset($pconfig['p2index'])){
+						/* adding new p2 entry */
+						$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
+						break;
+					}else if ($pconfig['p2index'] != $key){
+						/* editing p2 and entered p2 networks match with different p2 for given p1 */
+						$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
+						break;
+					}
+				}
+			}
+		}
+	}else{
+		/* User is adding phase 2 for site-to-site phase1 */
+		$input_error = 0;
+		foreach($a_phase2 as $key => $name){
+			if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid']){
+				/* check duplicate subnets only for given phase1 */
+				$localid_data = ipsec_idinfo_to_cidr($name['localid']);
+				$remoteid_data = ipsec_idinfo_to_cidr($name['remoteid']);
+				$entered_local = array();
+				$entered_local['type'] = $pconfig['localid_type'];
+				if (isset($pconfig['localid_address'])) $entered_local['address'] = $pconfig['localid_address'];
+				if (isset($pconfig['localid_netbits'])) $entered_local['netbits'] = $pconfig['localid_netbits'];
+				$entered_localid_data = ipsec_idinfo_to_cidr($entered_local);
+				$entered_remote = array();
+				$entered_remote['type'] = $pconfig['remoteid_type'];
+				if (isset($pconfig['remoteid_address'])) $entered_remote['address'] = $pconfig['remoteid_address'];
+				if (isset($pconfig['remoteid_netbits'])) $entered_remote['netbits'] = $pconfig['remoteid_netbits'];
+				$entered_remoteid_data = ipsec_idinfo_to_cidr($entered_remote);
+				if ($localid_data == $entered_localid_data && $remoteid_data == $entered_remoteid_data) { 
+					if (!isset($pconfig['p2index'])){
+						/* adding new p2 entry */
+						$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
+						break;
+					}else if ($pconfig['p2index'] != $key){
+						/* editing p2 and entered p2 networks match with different p2 for given p1 */
+						$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
+						break;
+					}
+				}
+			}
+		}
+        }
+	
 	$ealgos = pconfig_to_ealgos($pconfig);
 
 	if (!count($ealgos)) {
diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php
index 4b9fc74..97b7769 100644
--- a/usr/local/www/vpn_openvpn_client.php
+++ b/usr/local/www/vpn_openvpn_client.php
@@ -350,10 +350,6 @@ function autotls_change() {
 <?php
 if (!$savemsg)
 	$savemsg = "";
-if (count($a_ca) == 0)
-	$savemsg .= "You have no Certificate Authorities defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
-if (count($a_cert) == 0)
-	$savemsg .= "<br/>You have no Certificates defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
 
 if ($input_errors)
 	print_input_errors($input_errors);
@@ -632,6 +628,7 @@ if ($savemsg)
 					<tr id="tls_ca">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Peer Certificate Authority"); ?></td>
 							<td width="78%" class="vtable">
+							<?php if (count($a_ca)): ?>
 							<select name='caref' class="formselect">
 							<?php
 								foreach ($a_ca as $ca):
@@ -642,11 +639,15 @@ if ($savemsg)
 								<option value="<?=$ca['refid'];?>" <?=$selected;?>><?=$ca['descr'];?></option>
 							<?php endforeach; ?>
 							</select>
+							<?php else: ?>
+								<b>No Certificate Authorities defined.</b> <br/>Create one under <a href="system_camanager.php">System &gt; Cert Manager</a>.
+							<?php endif; ?>
 							</td>
 					</tr>
 					<tr id="tls_cert">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Client Certificate"); ?></td>
 							<td width="78%" class="vtable">
+							<?php if (count($a_cert)): ?>
 							<select name='certref' class="formselect">
 							<?php
 							foreach ($a_cert as $cert):
@@ -667,6 +668,9 @@ if ($savemsg)
 								<option value="<?=$cert['refid'];?>" <?=$selected;?>><?=$cert['descr'] . $caname . $inuse . $revoked;?></option>
 							<?php endforeach; ?>
 							</select>
+							<?php else: ?>
+								<b>No Certificates defined.</b> <br/>Create one under <a href="system_certmanager.php">System &gt; Cert Manager</a>.
+							<?php endif; ?>
 						</td>
 					</tr>
 					<tr id="psk">
diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php
index 4a24e2e..b08c481 100644
--- a/usr/local/www/vpn_openvpn_server.php
+++ b/usr/local/www/vpn_openvpn_server.php
@@ -555,10 +555,6 @@ function netbios_change() {
 <?php
 if (!$savemsg)
 	$savemsg = "";
-if (count($a_ca) == 0)
-	$savemsg .= "You have no Certificate Authorities defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
-if (count($a_cert) == 0)
-	$savemsg .= "<br/>You have no Certificates defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
 
 if ($input_errors)
 	print_input_errors($input_errors);
@@ -768,6 +764,7 @@ if ($savemsg)
 					<tr id="tls_ca">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Peer Certificate Authority"); ?></td>
 							<td width="78%" class="vtable">
+							<?php if (count($a_ca)): ?>
 							<select name='caref' class="formselect">
 							<?php
 								foreach ($a_ca as $ca):
@@ -778,11 +775,15 @@ if ($savemsg)
 								<option value="<?=$ca['refid'];?>" <?=$selected;?>><?=$ca['descr'];?></option>
 							<?php endforeach; ?>
 							</select>
+							<?php else: ?>
+								<b>No Certificate Authorities defined.</b> <br/>Create one under <a href="system_camanager.php">System &gt; Cert Manager</a>.
+							<?php endif; ?>
 							</td>
 					</tr>
 					<tr id="tls_crl">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Peer Certificate Revocation List"); ?></td>
 							<td width="78%" class="vtable">
+							<?php if (count($a_crl)): ?>
 							<select name='crlref' class="formselect">
 								<option value="">None</option>
 							<?php
@@ -799,11 +800,15 @@ if ($savemsg)
 								<option value="<?=$crl['refid'];?>" <?=$selected;?>><?=$crl['descr'] . $caname;?></option>
 							<?php endforeach; ?>
 							</select>
+							<?php else: ?>
+								<b>No Certificate Revocation Lists (CRLs) defined.</b> <br/>Create one under <a href="system_crlmanager.php">System &gt; Cert Manager</a>.
+							<?php endif; ?>
 							</td>
 					</tr>
 					<tr id="tls_cert">
 						<td width="22%" valign="top" class="vncellreq"><?=gettext("Server Certificate"); ?></td>
 							<td width="78%" class="vtable">
+							<?php if (count($a_cert)): ?>
 							<select name='certref' class="formselect">
 							<?php
 							foreach ($a_cert as $cert):
@@ -824,6 +829,9 @@ if ($savemsg)
 								<option value="<?=$cert['refid'];?>" <?=$selected;?>><?=$cert['descr'] . $caname . $inuse . $revoked;?></option>
 							<?php endforeach; ?>
 							</select>
+							<?php else: ?>
+								<b>No Certificates defined.</b> <br/>Create one under <a href="system_certmanager.php">System &gt; Cert Manager</a>.
+							<?php endif; ?>
 						</td>
 					</tr>
 					<tr id="tls_dh">
diff --git a/usr/local/www/xmlrpc.php b/usr/local/www/xmlrpc.php
index 97fbc45..500700a 100755
--- a/usr/local/www/xmlrpc.php
+++ b/usr/local/www/xmlrpc.php
@@ -271,8 +271,14 @@ $merge_config_section_sig = array(
 
 function merge_config_section_xmlrpc($raw_params) {
 	global $config, $xmlrpc_g;
-
-	return restore_config_section_xmlrpc($raw_params);
+	$params = xmlrpc_params_to_php($raw_params);
+	if(!xmlrpc_auth($params))
+		return $xmlrpc_g['return']['authfail'];
+	$config_new = array_overlay($config, $params[0]);
+	$config = $config_new;
+	$mergedkeys = implode(",", array_keys($params[0]));
+	write_config(sprintf(gettext("Merged in config (%s sections) from XMLRPC client."), $mergedkeys));
+	return $xmlrpc_g['return']['true'];
 }
 
 /*****************************/
@@ -448,4 +454,17 @@ $server = new XML_RPC_Server(
 
 unlock($xmlrpclockkey);
 
+    function array_overlay($a1,$a2)
+    {
+        foreach($a1 as $k => $v) {
+            if(!array_key_exists($k,$a2)) continue;
+            if(is_array($v) && is_array($a2[$k])){
+                $a1[$k] = array_overlay($v,$a2[$k]);
+            }else{
+                $a1[$k] = $a2[$k];
+            }
+        }
+        return $a1;
+    }
+
 ?>