From 3949c6b57a779dd11daa7f2479965c5709cee279 Mon Sep 17 00:00:00 2001
From: mkasper <mkasper@e36fee2c-cc09-0410-a7cc-ebac5c6737de>
Date: Sat, 7 Jan 2006 22:43:51 +0000
Subject: [PATCH] Import m0n0wall 1.2b1 files.

git-svn-id: https://svn.m0n0.ch/wall/trunk@6 e36fee2c-cc09-0410-a7cc-ebac5c6737de
---
 captiveportal/index.php             |  40 +++++++++++--
 captiveportal/radius_accounting.inc |   2 +-
 etc/rc                              |   2 +-
 phpconf/inc/captiveportal.inc       |  40 +++++++++++++
 phpconf/inc/config.inc              |   3 +
 phpconf/inc/filter.inc              |  15 +++--
 phpconf/inc/interfaces.inc          |   4 ++
 phpconf/inc/services.inc            |  23 ++++++--
 phpconf/inc/system.inc              |  42 +++++++++++++-
 phpconf/inc/vpn.inc                 |  17 +++++-
 phpconf/inc/xmlparse.inc            |   4 +-
 phpconf/rc.bootup                   |   3 +
 phpconf/rc.initial.ping             |  47 ++++++++++++++++
 phpconf/rc.initial.setlanip         |   5 ++
 webgui/bar_blue.gif                 | Bin 0 -> 92 bytes
 webgui/bar_gray.gif                 | Bin 0 -> 92 bytes
 webgui/bar_left.gif                 | Bin 0 -> 165 bytes
 webgui/bar_right.gif                | Bin 0 -> 114 bytes
 webgui/exec.php                     |   2 +-
 webgui/fbegin.inc                   |   2 +-
 webgui/firewall_rules.php           |   2 +-
 webgui/guiconfig.inc                |  12 +++-
 webgui/index.php                    |  54 ++++++++++++++++++
 webgui/interfaces_assign.php        |  19 +++++--
 webgui/license.php                  |   8 ++-
 webgui/services_captiveportal.php   |  84 ++++++++++++++++++++++++++--
 webgui/status_wireless.php          |   2 +-
 webgui/system_advanced.php          |  64 ++++++++++++++++++++-
 webgui/system_routes.php            |   2 +-
 webgui/system_routes_edit.php       |   2 +-
 webgui/vpn_ipsec_edit.php           |  18 ++++--
 webgui/vpn_ipsec_keys_edit.php      |   2 +-
 webgui/vpn_ipsec_mobile.php         |   7 +--
 33 files changed, 472 insertions(+), 55 deletions(-)
 create mode 100644 phpconf/rc.initial.ping
 create mode 100644 webgui/bar_blue.gif
 create mode 100644 webgui/bar_gray.gif
 create mode 100644 webgui/bar_left.gif
 create mode 100644 webgui/bar_right.gif

diff --git a/captiveportal/index.php b/captiveportal/index.php
index 4b14fb7..5094cc0 100644
--- a/captiveportal/index.php
+++ b/captiveportal/index.php
@@ -109,9 +109,26 @@ setTimeout('window.close();',5000) ;
 </HTML>
 
 EOD;
+} else if (($_ENV['SERVER_PORT'] != 8001) && isset($config['captiveportal']['httpslogin'])) {
+	/* redirect to HTTPS login page */
+	header("Location: https://{$config['captiveportal']['httpsname']}:8001/?redirurl=" . urlencode("http://{$orig_host}{$orig_request}"));
 } else {
 	/* display captive portal page */
-	readfile("{$g['varetc_path']}/captiveportal.html");
+	$htmltext = file_get_contents("{$g['varetc_path']}/captiveportal.html");
+	
+	/* substitute variables */
+	if (isset($config['captiveportal']['httpslogin']))
+		$htmltext = str_replace("\$PORTAL_ACTION\$", "https://{$config['captiveportal']['httpsname']}:8001/", $htmltext);
+	else
+		$htmltext = str_replace("\$PORTAL_ACTION\$", "", $htmltext);
+	
+	if (preg_match("/redirurl=(.*)/", $orig_request, $matches))
+		$redirurl = urldecode($matches[1]);
+	else
+		$redirurl = "http://{$orig_host}{$orig_request}";
+	$htmltext = str_replace("\$PORTAL_REDIRURL\$", htmlspecialchars($redirurl), $htmltext);
+	
+	echo $htmltext;
 }
 
 exit;
@@ -219,13 +236,26 @@ function portal_allow($clientip,$clientmac,$clientuser) {
 	portal_unlock();
 	
 	/* redirect user to desired destination */
+	if ($config['captiveportal']['redirurl'])
+		$redirurl = $config['captiveportal']['redirurl'];
+	else if ($_POST['redirurl'])
+		$redirurl = $_POST['redirurl'];
+	else
+		$redirurl = "http://{$orig_host}{$orig_request}";
+	
 	if(isset($config['captiveportal']['logoutwin_enable'])) {
+		
+		if (isset($config['captiveportal']['httpslogin']))
+			$logouturl = "https://{$config['captiveportal']['httpsname']}:8001/";
+		else
+			$logouturl = "http://{$config['interfaces'][$config['captiveportal']['interface']]['ipaddr']}:8000/";
+		
 		echo <<<EOD
 <HTML>
 <HEAD><TITLE>Redirecting...</TITLE></HEAD>
 <BODY>
 <SPAN STYLE="font-family: Tahoma, Verdana, Arial, Helvetica, sans-serif; font-size: 11px;">
-<B>Redirecting to <A HREF="http://{$orig_host}{$orig_request}">http://{$orig_host}{$orig_request}</A>...</B>
+<B>Redirecting to <A HREF="{$redirurl}">{$redirurl}</A>...</B>
 </SPAN>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
@@ -236,7 +266,7 @@ if (LogoutWin) {
 	LogoutWin.document.write('<BODY BGCOLOR="#435370">');
 	LogoutWin.document.write('<DIV ALIGN="center" STYLE="color: #ffffff; font-family: Tahoma, Verdana, Arial, Helvetica, sans-serif; font-size: 11px;">') ;
 	LogoutWin.document.write('<B>Click the button below to disconnect</B><P>');
-	LogoutWin.document.write('<FORM METHOD="POST" ACTION="http://{$config['interfaces']['lan']['ipaddr']}:8000/index.php">');
+	LogoutWin.document.write('<FORM METHOD="POST" ACTION="{$logouturl}">');
 	LogoutWin.document.write('<INPUT NAME="logout_id" TYPE="hidden" VALUE="{$clientmac}">');
 	LogoutWin.document.write('<INPUT NAME="logout" TYPE="submit" VALUE="Logout">');
 	LogoutWin.document.write('</FORM>');
@@ -245,7 +275,7 @@ if (LogoutWin) {
 	LogoutWin.document.close();
 }
 
-document.location.href="http://{$orig_host}{$orig_request}";
+document.location.href="{$redirurl}";
 -->
 </SCRIPT>
 </BODY>
@@ -253,7 +283,7 @@ document.location.href="http://{$orig_host}{$orig_request}";
 
 EOD;
 	} else {
-		header("Location: http://" . $orig_host . $orig_request); 
+		header("Location: " . $redirurl); 
 	}
 }
 
diff --git a/captiveportal/radius_accounting.inc b/captiveportal/radius_accounting.inc
index d7c9129..94922d4 100644
--- a/captiveportal/radius_accounting.inc
+++ b/captiveportal/radius_accounting.inc
@@ -37,7 +37,7 @@ function RADIUS_ACCOUNTING_START($username,$radiusip,$radiusport,$radiuskey) {
 
 	exec("/bin/hostname", $nasHostname) ;
 	if(!$nasHostname[0])
-		$nasHostname[0] = "quewall" ;
+		$nasHostname[0] = "m0n0wall" ;
 
 	$fd = @fsockopen("udp://$radiusip",$radiusport,$errno,$errstr,3) ;
 	if(!$fd) 
diff --git a/etc/rc b/etc/rc
index ced2cf7..0d26ae9 100644
--- a/etc/rc
+++ b/etc/rc
@@ -3,7 +3,7 @@
 # /etc/rc
 # part of m0n0wall (http://neon1.net/m0n0wall)
 #
-# Copyright (C) 2003 Manuel Kasper <mk@neon1.net>.
+# Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
 # All rights reserved.
 
 stty status '^T'
diff --git a/phpconf/inc/captiveportal.inc b/phpconf/inc/captiveportal.inc
index 344d432..83db7f8 100644
--- a/phpconf/inc/captiveportal.inc
+++ b/phpconf/inc/captiveportal.inc
@@ -44,6 +44,7 @@ function captiveportal_configure() {
 		
 		/* kill any running mini_httpd */
 		killbypid("{$g['varrun_path']}/mini_httpd.cp.pid");
+		killbypid("{$g['varrun_path']}/mini_httpd.cps.pid");
 		
 		/* kill any running minicron */
 		killbypid("{$g['varrun_path']}/minicron.pid");
@@ -149,6 +150,29 @@ EOD;
 		/* start web server */
 		mwexec("/usr/local/sbin/mini_httpd -a -M 0 -u root -maxproc 16" .
 			" -p 8000 -i {$g['varrun_path']}/mini_httpd.cp.pid");
+		
+		/* fire up another one for HTTPS if requested */
+		if (isset($config['captiveportal']['httpslogin']) &&
+			$config['captiveportal']['certificate'] && $config['captiveportal']['private-key']) {
+			
+			$cert = base64_decode($config['captiveportal']['certificate']);
+			$key = base64_decode($config['captiveportal']['private-key']);
+			
+			$fd = fopen("{$g['varetc_path']}/cert-portal.pem", "w");
+			if (!$fd) {
+				printf("Error: cannot open cert-portal.pem in system_webgui_start().\n");
+				return 1;
+			}
+			chmod("{$g['varetc_path']}/cert-portal.pem", 0600);
+			fwrite($fd, $cert);
+			fwrite($fd, "\n");
+			fwrite($fd, $key);
+			fclose($fd);
+			
+			mwexec("/usr/local/sbin/mini_httpd -S -a -M 0 -E {$g['varetc_path']}/cert-portal.pem" .
+				" -u root -maxproc 16 -p 8001" .
+				" -i {$g['varrun_path']}/mini_httpd.cps.pid");
+		}
 			
 		/* start pruning process (interval = 60 seconds) */
 		mwexec("/usr/local/bin/minicron 60 {$g['varrun_path']}/minicron.pid " .
@@ -248,6 +272,22 @@ add 1204 set 1 pass icmp from any to $cpip in icmptype 0
 add 1300 set 1 pass udp from any to $cpip 53 in
 add 1301 set 1 pass udp from $cpip 53 to any out
 
+# allow access to our web server
+add 1302 set 1 pass tcp from any to $cpip 8000 in
+add 1303 set 1 pass tcp from $cpip 8000 to any out
+
+EOD;
+
+	if (isset($config['captiveportal']['httpslogin'])) {
+		$cprules .= <<<EOD
+add 1304 set 1 pass tcp from any to $cpip 8001 in
+add 1305 set 1 pass tcp from $cpip 8001 to any out
+
+EOD;
+	}
+	
+	$cprules .= <<<EOD
+
 # ... 10000-19899: rules per authenticated client go here...
 
 # redirect non-authenticated clients to captive portal
diff --git a/phpconf/inc/config.inc b/phpconf/inc/config.inc
index 5dd98ee..18d443a 100644
--- a/phpconf/inc/config.inc
+++ b/phpconf/inc/config.inc
@@ -435,6 +435,9 @@ function write_config() {
 
 	conf_mount_rw();
 	
+	if (time() > mktime(0, 0, 0, 9, 1, 2004))	/* make sure the clock settings is plausible */
+		$config['lastchange'] = time();
+	
 	/* generate configuration XML */
 	$xmlconfig = dump_xml_config($config, $g['xml_rootobj']);
 	
diff --git a/phpconf/inc/filter.inc b/phpconf/inc/filter.inc
index 7150c7d..975a36a 100644
--- a/phpconf/inc/filter.inc
+++ b/phpconf/inc/filter.inc
@@ -203,8 +203,9 @@ function filter_nat_rules_generate() {
 		/* static routes */
 		if (is_array($config['staticroutes']['route'])) {
 			foreach ($config['staticroutes']['route'] as $route) {
-				$natrules .= filter_nat_rules_generate_if($wanif,
-					$route['network'], "", null);
+				if ($route['interface'] != "wan")
+					$natrules .= filter_nat_rules_generate_if($wanif,
+						$route['network'], "", null);
 			}
 		}
 	}
@@ -249,13 +250,15 @@ function filter_nat_rules_generate() {
 		}
 	}
 	
-	if ($pptpdcfg['mode']) {
+	if ($pptpdcfg['mode'] && $pptpdcfg['mode'] != "off") {
 	
 		if ($pptpdcfg['mode'] == "server")
 			$pptpdtarget = "127.0.0.1";
-		else
+		else if ($pptpdcfg['mode'] == "redir")
 			$pptpdtarget = $pptpdcfg['redir'];
 	
+		if ($pptpdtarget) {
+	
 		$natrules .= <<<EOD
 
 # PPTP
@@ -263,6 +266,7 @@ rdr $wanif 0/0 port 0 -> $pptpdtarget port 0 gre
 rdr $wanif 0/0 port 1723 -> $pptpdtarget port 1723 tcp
 
 EOD;
+		}
 	}
 	
 	return $natrules;
@@ -519,12 +523,15 @@ EOD;
 	
 	}
 	
+	if (!isset($config['system']['webgui']['noantilockout'])) {
+	
 	$ipfrules .= <<<EOD
 
 # make sure the user cannot lock himself out of the webGUI
 pass in quick from $lansa/$lansn to $lanip keep state group 100
 
 EOD;
+	}
 	
 	/* PPTPd enabled? */
 	if ($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) {
diff --git a/phpconf/inc/interfaces.inc b/phpconf/inc/interfaces.inc
index 0fda400..70eda73 100644
--- a/phpconf/inc/interfaces.inc
+++ b/phpconf/inc/interfaces.inc
@@ -74,6 +74,10 @@ function interfaces_vlan_configure() {
 				$cmd .= " mtu 1500";
 			
 			mwexec($cmd);
+			
+			/* make sure the parent interface is up */
+			mwexec("/sbin/ifconfig " . escapeshellarg($vlan['if']) . " up");
+			
 			$i++;
 		}
 	}
diff --git a/phpconf/inc/services.inc b/phpconf/inc/services.inc
index 2a570c6..4ca0d6e 100644
--- a/phpconf/inc/services.inc
+++ b/phpconf/inc/services.inc
@@ -89,10 +89,15 @@ EOD;
 		$subnetmask = gen_subnet_mask($ifcfg['subnet']);
 		
 		$dnscfg = "";
+		
+		if ($dhcpifconf['domain']) {
+			$dnscfg .= "	option domain-name \"{$dhcpifconf['domain']}\";\n";
+		}
+		
 		if (isset($config['dnsmasq']['enable'])) {
-			$dnscfg = "option domain-name-servers " . $ifcfg['ipaddr'] . ";";
+			$dnscfg .= "	option domain-name-servers " . $ifcfg['ipaddr'] . ";";
 		} else if (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) {
-			$dnscfg = "option domain-name-servers " . join(",", $syscfg['dnsserver']) . ";";
+			$dnscfg .= "	option domain-name-servers " . join(",", $syscfg['dnsserver']) . ";";
 		}
 
 		$dhcpdconf .= "subnet $subnet netmask $subnetmask {\n";
@@ -100,11 +105,16 @@ EOD;
 		if (isset($dhcpifconf['denyunknown'])) 
 		   $dhcpdconf .= "		deny unknown clients;\n";
 		
+		if ($dhcpifconf['gateway'])
+			$routers = $dhcpifconf['gateway'];
+		else
+			$routers = $ifcfg['ipaddr'];
+		
 		$dhcpdconf .= <<<EOD
 		range {$dhcpifconf['range']['from']} {$dhcpifconf['range']['to']};
 	}
-	option routers {$ifcfg['ipaddr']};
-	$dnscfg
+	option routers {$routers};
+$dnscfg
 
 EOD;
 
@@ -117,6 +127,11 @@ EOD;
 			$dhcpdconf .= "	option netbios-name-servers " . join(",", $dhcpifconf['winsserver']) . ";\n";
 			$dhcpdconf .= "	option netbios-node-type 8;\n";
 		}
+		
+		if ($dhcpifconf['next-server'])
+			$dhcpdconf .= "	next-server {$dhcpifconf['next-server']};\n";
+		if ($dhcpifconf['filename'])
+			$dhcpdconf .= "	filename \"{$dhcpifconf['filename']}\";\n";
 			
 		$dhcpdconf .= <<<EOD
 }
diff --git a/phpconf/inc/system.inc b/phpconf/inc/system.inc
index 57f6228..95d5b2e 100644
--- a/phpconf/inc/system.inc
+++ b/phpconf/inc/system.inc
@@ -450,12 +450,17 @@ function system_reboot_cleanup() {
 	captiveportal_radius_stop_all();
 }
 
-function system_do_shell_commands() {
+function system_do_shell_commands($early = 0) {
 	global $config, $g;
 	
-	if (is_array($config['system']['shellcmd'])) {
+	if ($early)
+		$cmdn = "earlyshellcmd";
+	else
+		$cmdn = "shellcmd";
+	
+	if (is_array($config['system'][$cmdn])) {
 		
-		foreach ($config['system']['shellcmd'] as $cmd) {
+		foreach ($config['system'][$cmdn] as $cmd) {
 			exec($cmd);
 		}
 	}
@@ -517,4 +522,35 @@ function system_dmesg_save() {
 	return 0;
 }
 
+function system_set_harddisk_standby() {
+	global $g, $config;
+
+	if ($g['platform'] != "generic-pc")
+		return;
+
+	if (isset($config['system']['harddiskstandby'])) {
+		if ($g['booting']) {
+			echo 'Setting harddisk standby time... ';
+		}
+
+		$standby = $config['system']['harddiskstandby'];
+		// Check for a numeric value
+		if (is_numeric($standby)) {
+			// Sync the disk(s)
+			mwexec('/bin/sync');
+			if (!mwexec('/sbin/sysctl hw.ata.standby=' . ((int)$standby))) {
+				// Reinitialize ATA-drives
+				mwexec('/usr/local/sbin/atareinit');
+				if ($g['booting']) {
+					echo "done\n";
+				}
+			} else if ($g['booting']) {
+				echo "failed\n";
+			}
+		} else if ($g['booting']) {
+			echo "failed\n";
+		}
+	}
+}
+
 ?>
diff --git a/phpconf/inc/vpn.inc b/phpconf/inc/vpn.inc
index 097b14b..2c58af2 100644
--- a/phpconf/inc/vpn.inc
+++ b/phpconf/inc/vpn.inc
@@ -77,6 +77,9 @@ function vpn_ipsec_configure($ipchg = false) {
 	mwexec("/usr/sbin/setkey -FP");
 	mwexec("/usr/sbin/setkey -F");
 	
+	/* prefer old SAs only for 30 seconds, then use the new one */
+	mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30");
+	
 	if (isset($ipseccfg['enable'])) {
 		
 		if (!$curwanip) {
@@ -174,7 +177,7 @@ remote {$tunnel['remote-gateway']} \{
 	peers_identifier address {$tunnel['remote-gateway']};
 	initial_contact on;
 	support_proxy on;
-	proposal_check obey;
+	proposal_check claim;
 
 	proposal \{
 		encryption_algorithm {$tunnel['p1']['encryption-algorithm']};
@@ -240,7 +243,7 @@ remote anonymous \{
 	passive on;
 	generate_policy on;
 	support_proxy on;
-	proposal_check obey;
+	proposal_check claim;
 
 	proposal \{
 		encryption_algorithm {$tunnel['p1']['encryption-algorithm']};
@@ -312,6 +315,15 @@ EOD;
 			
 			/* start racoon */
 			mwexec("/usr/local/sbin/racoon -d -f {$g['varetc_path']}/racoon.conf");
+			
+			foreach ($ipseccfg['tunnel'] as $tunnel) {
+				if (isset($tunnel['auto'])) {
+					$remotehost = substr($tunnel['remote-subnet'],0,strpos($tunnel['remote-subnet'],"/"));
+					$srchost = vpn_endpoint_determine($tunnel, $curwanip);
+					if ($srchost)
+						mwexec_bg("/sbin/ping -c 1 -S {$srchost} {$remotehost}");
+				}
+			}
 		}
 	}
 	
@@ -412,7 +424,6 @@ pts:
 	set link mtu 1460
 	set link keep-alive 10 60
 	set ipcp yes vjcomp
-	set ipcp dns {$dnsconf}
 	set bundle enable compression
 	set ccp yes mppc
 	set ccp yes mpp-e128
diff --git a/phpconf/inc/xmlparse.inc b/phpconf/inc/xmlparse.inc
index 9e5f0bd..2684d49 100644
--- a/phpconf/inc/xmlparse.inc
+++ b/phpconf/inc/xmlparse.inc
@@ -32,8 +32,8 @@
 /* tags that are always to be handled as lists */
 $listtags = explode(" ", "rule user key dnsserver winsserver " .
 	"encryption-algorithm-option hash-algorithm-option hosts tunnel onetoone " .
-	"staticmap route alias pipe queue shellcmd mobilekey servernat " .
-	"proxyarpnet passthrumac allowedip wolentry vlan");
+	"staticmap route alias pipe queue shellcmd earlyshellcmd mobilekey " .
+	"servernat proxyarpnet passthrumac allowedip wolentry vlan");
 
 function startElement($parser, $name, $attrs) {
 	global $depth, $curpath, $config, $havedata, $listtags;
diff --git a/phpconf/rc.bootup b/phpconf/rc.bootup
index 48bcd92..f8b92ac 100644
--- a/phpconf/rc.bootup
+++ b/phpconf/rc.bootup
@@ -42,6 +42,9 @@
 	/* convert configuration, if necessary */
 	convert_config();
 	
+	/* run any early shell commands specified in config.xml */
+	system_do_shell_commands(1);
+	
 	/* save dmesg output to file */
 	system_dmesg_save();
 	
diff --git a/phpconf/rc.initial.ping b/phpconf/rc.initial.ping
new file mode 100644
index 0000000..d069566
--- /dev/null
+++ b/phpconf/rc.initial.ping
@@ -0,0 +1,47 @@
+#!/usr/local/bin/php -f
+<?php
+/*
+	rc.initial.ping
+	part of m0n0wall (http://m0n0.ch/wall)
+	
+	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
+	All rights reserved.
+	
+	Redistribution and use in source and binary forms, with or without
+	modification, are permitted provided that the following conditions are met:
+	
+	1. Redistributions of source code must retain the above copyright notice,
+	   this list of conditions and the following disclaimer.
+	
+	2. Redistributions in binary form must reproduce the above copyright
+	   notice, this list of conditions and the following disclaimer in the
+	   documentation and/or other materials provided with the distribution.
+	
+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+	POSSIBILITY OF SUCH DAMAGE.
+*/
+
+	/* parse the configuration and include all functions used below */
+	require_once("config.inc");
+	require_once("functions.inc");
+	
+	$fp = fopen('php://stdin', 'r');
+	
+	echo "\nEnter a host name or IP address: ";
+
+	$pinghost = chop(fgets($fp));
+	if ($pinghost) {
+		echo "\n";
+		passthru("/sbin/ping -c 3 -n " . escapeshellarg($pinghost));
+		echo "\nPress ENTER to continue.\n";
+		fgets($fp);
+	}
+?>
diff --git a/phpconf/rc.initial.setlanip b/phpconf/rc.initial.setlanip
index 08ca3f8..99fd922 100644
--- a/phpconf/rc.initial.setlanip
+++ b/phpconf/rc.initial.setlanip
@@ -93,6 +93,11 @@
 			$config['system']['webgui']['protocol'] = "http";
 	}
 	
+	if (isset($config['system']['webgui']['noantilockout'])) {
+		echo "\nNote: the anti-lockout rule on LAN has been re-enabled.\n";
+		unset($config['system']['webgui']['noantilockout']);
+	}
+	
 	write_config();
 	interfaces_lan_configure();
 	
diff --git a/webgui/bar_blue.gif b/webgui/bar_blue.gif
new file mode 100644
index 0000000000000000000000000000000000000000..428a895052e39108bf8475f5ae2a505d52675198
GIT binary patch
literal 92
zcmZ?wbhEHbWMtrH*v!Ci`}XbQM~`-Qb$$Ex?c|9QZ{NP<RSTIpbEb1}0RuLm_>%=J
YtOFuJW-zdDe&|V>u(yqcQHjAC0Mm0B!2kdN

literal 0
HcmV?d00001

diff --git a/webgui/bar_gray.gif b/webgui/bar_gray.gif
new file mode 100644
index 0000000000000000000000000000000000000000..fb0baa0e0453582293df89be80a92c3752daf49d
GIT binary patch
literal 92
zcmZ?wbhEHbWMtrH*v!E2`t|GEw{IUmdbGQ%>)W?)Cr_N<RSTIpbLOK*j~K84#h)x-
YVI2?&GJ}DI^MgRbguTl;1eF-90WP{5kpKVy

literal 0
HcmV?d00001

diff --git a/webgui/bar_left.gif b/webgui/bar_left.gif
new file mode 100644
index 0000000000000000000000000000000000000000..1db1890c1eff986035115bfa1f3a87713056851e
GIT binary patch
literal 165
zcmZ?wbhEHbWMSZEIKsg2`t|F_j~~By@#6ja_YWUFJbB{8r%#_=y?XWb?b~P1o_+c9
z<@W8{PoF+Le)MQ}R~N5Z$p8QUzkT~QbLLD2;(+2$7O+Ac5DBuAfmKOCr8g*LT2~;S
ff9DoK2KfyP>ITg027w+uZp@D~oD{lUIT)+~%{M(M

literal 0
HcmV?d00001

diff --git a/webgui/bar_right.gif b/webgui/bar_right.gif
new file mode 100644
index 0000000000000000000000000000000000000000..330b52aaef8fef7131722cac4f4cc69bb85ab926
GIT binary patch
literal 114
zcmZ?wbhEHbWM$xI*v!E2^y$-+Cr*6(_U-ZG$GmDGj~+cbe)Q<=+qb*Bx@OLt`Tzfa
z22`N<lLaiG10q3YFtErQcrI;`@Mugl(!BezRavPit#Z<fEVi|Zvps4x-2Ge`tO1Rx
BDTe?6

literal 0
HcmV?d00001

diff --git a/webgui/exec.php b/webgui/exec.php
index 86c6f36..8f47fc5 100644
--- a/webgui/exec.php
+++ b/webgui/exec.php
@@ -12,7 +12,7 @@ if (($_POST['submit'] == "Download") && file_exists($_POST['dlPath'])) {
 	exit;
 } else if (($_POST['submit'] == "Upload") && is_uploaded_file($_FILES['ulfile']['tmp_name'])) {
 	move_uploaded_file($_FILES['ulfile']['tmp_name'], "/tmp/" . $_FILES['ulfile']['name']);
-	$ulmsg = "Uploaded file " . htmlentities($_FILES['ulfile']['name']) . " to /tmp.";
+	$ulmsg = "Uploaded file to /tmp/" . htmlentities($_FILES['ulfile']['name']);
 	unset($_POST['txtCommand']);
 }
 ?>
diff --git a/webgui/fbegin.inc b/webgui/fbegin.inc
index df453b7..4a0e533 100644
--- a/webgui/fbegin.inc
+++ b/webgui/fbegin.inc
@@ -104,7 +104,7 @@ if ($dh) {
 }
 endif;
 ?>
-			  <?php if (strstr($_SERVER['SCRIPT_FILENAME'], "diag_") || strstr($_SERVER['SCRIPT_FILENAME'], "reboot")): ?>
+			  <?php if (isset($config['system']['webgui']['expanddiags']) || strstr($_SERVER['SCRIPT_FILENAME'], "diag_") || strstr($_SERVER['SCRIPT_FILENAME'], "reboot")): ?>
 			  <a href="javascript:showhide('diag','tri_diag')"><img src="/tri_o.gif" id="tri_diag" width="14" height="10" border="0"></a><strong><a href="javascript:showhide('diag','tri_diag')" class="navlnk">Diagnostics</a></strong><br>
 			  <span id="diag">
 			  <?php else: ?>
diff --git a/webgui/firewall_rules.php b/webgui/firewall_rules.php
index 7e2bd2a..cf74e7e 100644
--- a/webgui/firewall_rules.php
+++ b/webgui/firewall_rules.php
@@ -168,7 +168,7 @@ if ($_GET['act'] == "del") {
 						if (isset($filterent['disabled']))
 							$iconfn .= "_d";
 				  	?>
-				  <br><a href="?act=toggle&id=<?=$i;?>"><img src="<?=$iconfn;?>.gif" width="11" height="15" border="0" title="click to toggle enabled/disabled status"></a>
+				  <br><img src="<?=$iconfn;?>.gif" width="11" height="15" border="0">
 				  <?php endif; ?>
 				  </td>
                   <td class="listlr"> 
diff --git a/webgui/guiconfig.inc b/webgui/guiconfig.inc
index 437fab3..9b4f212 100644
--- a/webgui/guiconfig.inc
+++ b/webgui/guiconfig.inc
@@ -97,12 +97,20 @@ $p1_ealgos = array('des' => 'DES', '3des' => '3DES', 'blowfish' => 'Blowfish',
 					'cast128' => 'CAST128');
 $p2_ealgos = array('des' => 'DES', '3des' => '3DES', 'blowfish' => 'Blowfish',
 					'cast128' => 'CAST128', 'rijndael' => 'Rijndael (AES)');
-$p1_halgos = array('md5' => 'MD5', 'sha1' => 'SHA1');
-$p2_halgos = array('hmac_md5' => 'MD5', 'hmac_sha1' => 'SHA1');
+$p1_halgos = array('sha1' => 'SHA1', 'md5' => 'MD5');
+$p2_halgos = array('hmac_sha1' => 'SHA1', 'hmac_md5' => 'MD5');
 $p2_protos = array('esp' => 'ESP', 'ah' => 'AH');
 $p2_pfskeygroups = array('0' => 'off', '1' => '1', '2' => '2', '5' => '5');
 
 function do_input_validation($postdata, $reqdfields, $reqdfieldsn, $input_errors) {
+	
+	/* check for bad control characters */	
+	foreach ($postdata as $pn => $pd) {
+		if (is_string($pd) && preg_match("/[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f]/", $pd)) {
+			$input_errors[] = "The field '" . $pn . "' contains invalid characters.";
+		}
+	}
+	
 	for ($i = 0; $i < count($reqdfields); $i++) {
 		if (!$_POST[$reqdfields[$i]]) {
 			$input_errors[] = "The field '" . $reqdfieldsn[$i] . "' is required.";
diff --git a/webgui/index.php b/webgui/index.php
index dddee31..731f54c 100644
--- a/webgui/index.php
+++ b/webgui/index.php
@@ -119,6 +119,60 @@ if ($fd) {
 					echo htmlspecialchars($uptimestr);
 				  ?>
                 </td>
+              </tr><?php if ($config['lastchange']): ?>
+              <tr> 
+                <td width="25%" class="vncellt">Last config change</td>
+                <td width="75%" class="listr"> 
+                  <?=htmlspecialchars(date("D M j G:i:s T Y", $config['lastchange']));?>
+                </td>
+              </tr><?php endif; ?>
+			  <tr> 
+                <td width="25%" class="vncellt">CPU usage</td>
+                <td width="75%" class="listr">
+<?php
+$cpuTicks = explode(" ", `/sbin/sysctl -n kern.cp_time`);
+sleep(1);
+$cpuTicks2 = explode(" ", `/sbin/sysctl -n kern.cp_time`);
+
+$diff = array();
+$diff['user'] = $cpuTicks2[0] - $cpuTicks[0];
+$diff['nice'] = $cpuTicks2[1] - $cpuTicks[1];
+$diff['sys'] = $cpuTicks2[2] - $cpuTicks[2];
+$diff['intr'] = $cpuTicks2[3] - $cpuTicks[3];
+$diff['idle'] = $cpuTicks2[4] - $cpuTicks[4];
+
+$totalDiff = $diff['user'] + $diff['nice'] + $diff['sys'] + $diff['intr'] + $diff['idle'];
+
+$cpuUsage = round(100 * (1 - $diff['idle'] / $totalDiff), 0);
+									
+echo "<img src='bar_left.gif' height='15' width='4' border='0' align='absmiddle'>";
+echo "<img src='bar_blue.gif' height='15' width='" . $cpuUsage . "' border='0' align='absmiddle'>";
+echo "<img src='bar_gray.gif' height='15' width='" . (100 - $cpuUsage) . "' border='0' align='absmiddle'>";
+echo "<img src='bar_right.gif' height='15' width='5' border='0' align='absmiddle'> ";
+echo $cpuUsage . "%";
+?>
+                </td>
+              </tr>
+			  <tr> 
+                <td width="25%" class="vncellt">Memory usage</td>
+                <td width="75%" class="listr">
+<?php
+
+exec("/sbin/sysctl -n vm.stats.vm.v_active_count vm.stats.vm.v_inactive_count " .
+	"vm.stats.vm.v_wire_count vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);
+
+$totalMem = $memory[0] + $memory[1] + $memory[2] + $memory[3] + $memory[4];
+$freeMem = $memory[4];
+$usedMem = $totalMem - $freeMem;
+$memUsage = round(($usedMem * 100) / $totalMem, 0);
+		  
+echo " <img src='bar_left.gif' height='15' width='4' border='0' align='absmiddle'>";
+echo "<img src='bar_blue.gif' height='15' width='" . $memUsage . "' border='0' align='absmiddle'>";
+echo "<img src='bar_gray.gif' height='15' width='" . (100 - $memUsage) . "' border='0' align='absmiddle'>";
+echo "<img src='bar_right.gif' height='15' width='5' border='0' align='absmiddle'> ";
+echo $memUsage . "%";
+?>
+                </td>
               </tr>
             </table>
             <?php include("fend.inc"); ?>
diff --git a/webgui/interfaces_assign.php b/webgui/interfaces_assign.php
index 8e79882..26a31de 100644
--- a/webgui/interfaces_assign.php
+++ b/webgui/interfaces_assign.php
@@ -205,9 +205,14 @@ if ($_GET['act'] == "add") {
 	<td class="listhdr">Network port</td>
 	<td class="list">&nbsp;</td>
   </tr>
-  <?php foreach ($config['interfaces'] as $ifname => $iface): ?>
+  <?php foreach ($config['interfaces'] as $ifname => $iface):
+  	if ($iface['descr'])
+		$ifdescr = $iface['descr'];
+	else
+		$ifdescr = strtoupper($ifname);
+	?>
   <tr> 
-	<td class="listlr" valign="middle"><strong><?=strtoupper($ifname);?></strong></td>
+	<td class="listlr" valign="middle"><strong><?=$ifdescr;?></strong></td>
 	  <td valign="middle" class="listr">
 		<select name="<?=$ifname;?>" class="formfld" id="<?=$ifname;?>">
 		  <?php foreach ($portlist as $portname => $portinfo): ?>
@@ -231,12 +236,18 @@ if ($_GET['act'] == "add") {
 		</td>
   </tr>
   <?php endforeach; ?>
+  <?php if (count($config['interfaces']) < count($portlist)): ?>
   <tr>
 	<td class="list" colspan="2"></td>
-	<td class="list" nowrap><?php if (count($config['interfaces']) < count($portlist)): ?> 
+	<td class="list" nowrap>
 	<a href="interfaces_assign.php?act=add"><img src="plus.gif" title="add interface" width="17" height="17" border="0"></a>
-	<?php endif; ?> </td>
+	</td>
   </tr>
+  <?php else: ?>
+  <tr>
+	<td class="list" colspan="3" height="10"></td>
+  </tr>
+  <?php endif; ?>
 </table>
                       <input name="Submit" type="submit" class="formbtn" value="Save">
                     <p><span class="vexpl"><strong><span class="red">Warning:</span><br>
diff --git a/webgui/license.php b/webgui/license.php
index a7cf2a4..e45dbdd 100644
--- a/webgui/license.php
+++ b/webgui/license.php
@@ -107,7 +107,13 @@
 			  &nbsp;&nbsp;&nbsp;&nbsp;IPsec user FQDNs</font></em><br>
 			  <br>
               Fred Wright (<a href="mailto:fw@well.com">fw@well.com</a>)<br>
-              &nbsp;&nbsp;&nbsp;&nbsp;<em><font color="#666666">ipfilter window scaling fix; ipnat ICMP checksum adjustment fix </font></em></p>
+              &nbsp;&nbsp;&nbsp;&nbsp;<em><font color="#666666">ipfilter window scaling fix; ipnat ICMP checksum adjustment fix; IPsec dead SA fixes</font></em><br>
+			  <br>
+              Michael Hanselmann (<a href="mailto:public@hansmi.ch">public@hansmi.ch</a>)<br>
+              &nbsp;&nbsp;&nbsp;&nbsp;<em><font color="#666666">IDE hard disk standby</font></em><br>
+			  <br>
+              Audun Larsen (<a href="mailto:larsen@xqus.com">larsen@xqus.com</a>)<br>
+              &nbsp;&nbsp;&nbsp;&nbsp;<em><font color="#666666">CPU/memory usage display</font></em></p>
             <hr size="1">
             <p>m0n0wall is based upon/includes various free software packages, 
               listed below.<br>
diff --git a/webgui/services_captiveportal.php b/webgui/services_captiveportal.php
index 8f9af28..0fb558f 100644
--- a/webgui/services_captiveportal.php
+++ b/webgui/services_captiveportal.php
@@ -50,7 +50,12 @@ $pconfig['timeout'] = $config['captiveportal']['timeout'];
 $pconfig['idletimeout'] = $config['captiveportal']['idletimeout'];
 $pconfig['enable'] = isset($config['captiveportal']['enable']);
 $pconfig['radacct_enable'] = isset($config['captiveportal']['radacct_enable']);
+$pconfig['httpslogin_enable'] = isset($config['captiveportal']['httpslogin']);
+$pconfig['httpsname'] = $config['captiveportal']['httpsname'];
+$pconfig['cert'] = base64_decode($config['captiveportal']['certificate']);
+$pconfig['key'] = base64_decode($config['captiveportal']['private-key']);
 $pconfig['logoutwin_enable'] = isset($config['captiveportal']['logoutwin_enable']);
+$pconfig['redirurl'] = $config['captiveportal']['redirurl'];
 $pconfig['radiusip'] = $config['captiveportal']['radiusip'];
 $pconfig['radiusport'] = $config['captiveportal']['radiusport'];
 $pconfig['radiuskey'] = $config['captiveportal']['radiuskey'];
@@ -75,6 +80,21 @@ if ($_POST) {
 				break;
 			}
 		}
+		
+		if ($_POST['httpslogin_enable']) {
+		 	if (!$_POST['cert'] || !$_POST['key']) {
+				$input_errors[] = "Certificate and key must be specified for HTTPS login.";
+			} else {
+				if (!strstr($_POST['cert'], "BEGIN CERTIFICATE") || !strstr($_POST['cert'], "END CERTIFICATE"))
+					$input_errors[] = "This certificate does not appear to be valid.";
+				if (!strstr($_POST['key'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['key'], "END RSA PRIVATE KEY"))
+					$input_errors[] = "This key does not appear to be valid.";
+			}
+			
+			if (!$_POST['httpsname'] || !is_domain($_POST['httpsname'])) {
+				$input_errors[] = "The HTTPS server name must be specified for HTTPS login.";
+			}
+		}
 	}
 	
 	if ($_POST['timeout'] && (!is_numeric($_POST['timeout']) || ($_POST['timeout'] < 1))) {
@@ -96,7 +116,12 @@ if ($_POST) {
 		$config['captiveportal']['idletimeout'] = $_POST['idletimeout'];
 		$config['captiveportal']['enable'] = $_POST['enable'] ? true : false;
 		$config['captiveportal']['radacct_enable'] = $_POST['radacct_enable'] ? true : false;
+		$config['captiveportal']['httpslogin'] = $_POST['httpslogin_enable'] ? true : false;
+		$config['captiveportal']['httpsname'] = $_POST['httpsname'];
+		$config['captiveportal']['certificate'] = base64_encode($_POST['cert']);
+		$config['captiveportal']['private-key'] = base64_encode($_POST['key']);
 		$config['captiveportal']['logoutwin_enable'] = $_POST['logoutwin_enable'] ? true : false;
+		$config['captiveportal']['redirurl'] = $_POST['redirurl'];
 		$config['captiveportal']['radiusip'] = $_POST['radiusip'];
 		$config['captiveportal']['radiusport'] = $_POST['radiusport'];
 		$config['captiveportal']['radiuskey'] = $_POST['radiuskey'];
@@ -138,10 +163,15 @@ function enable_change(enable_change) {
 		document.iform.cinterface.disabled = 0;
 		document.iform.idletimeout.disabled = 0;
 		document.iform.timeout.disabled = 0;
+		document.iform.redirurl.disabled = 0;
 		document.iform.radiusip.disabled = 0;
 		document.iform.radiusport.disabled = 0;
 		document.iform.radiuskey.disabled = 0;
 		document.iform.radacct_enable.disabled = 0;
+		document.iform.httpslogin_enable.disabled = 0;
+		document.iform.httpsname.disabled = 0;
+		document.iform.cert.disabled = 0;
+		document.iform.key.disabled = 0;
 		document.iform.logoutwin_enable.disabled = 0;
 		document.iform.htmlfile.disabled = 0;
 		document.iform.errfile.disabled = 0;
@@ -149,10 +179,15 @@ function enable_change(enable_change) {
 		document.iform.cinterface.disabled = 1;
 		document.iform.idletimeout.disabled = 1;
 		document.iform.timeout.disabled = 1;
+		document.iform.redirurl.disabled = 1;
 		document.iform.radiusip.disabled = 1;
 		document.iform.radiusport.disabled = 1;
 		document.iform.radiuskey.disabled = 1;
 		document.iform.radacct_enable.disabled = 1;
+		document.iform.httpslogin_enable.disabled = 1;
+		document.iform.httpsname.disabled = 1;
+		document.iform.cert.disabled = 1;
+		document.iform.key.disabled = 1;
 		document.iform.logoutwin_enable.disabled = 1;
 		document.iform.htmlfile.disabled = 1;
 		document.iform.errfile.disabled = 1;
@@ -223,9 +258,17 @@ Clients will be disconnected after this amount of inactivity. They may log in ag
 	  <td width="22%" valign="top" class="vncell">Logout popup window</td>
 	  <td width="78%" class="vtable"> 
 		<input name="logoutwin_enable" type="checkbox" class="formfld" id="logoutwin_enable" value="yes" <?php if($pconfig['logoutwin_enable']) echo "checked"; ?>>
-		<br>
+		<strong>Enable logout popup window</strong><br>
 	  If enabled, a popup window will appear when clients are allowed through the captive portal. This allows clients to explicitly disconnect themselves before the idle or hard timeout occurs. When RADIUS accounting is  enabled, this option is implied.</td>
 	</tr>
+	<tr>
+	  <td valign="top" class="vncell">Redirection URL</td>
+	  <td class="vtable">
+		<input name="redirurl" type="text" class="formfld" id="redirurl" size="60" value="<?=htmlspecialchars($pconfig['redirurl']);?>">
+		<br>
+If you provide a URL here, clients will be redirected to that URL instead of the one they initially tried
+to access after they've authenticated.</td>
+	</tr>
 	<tr> 
 	  <td width="22%" valign="top" class="vncell">RADIUS server</td>
 	  <td width="78%" class="vtable"> 
@@ -246,6 +289,33 @@ Clients will be disconnected after this amount of inactivity. They may log in ag
  		<br>
  	Enter the IP address and port of the RADIUS server which users of the captive portal have to authenticate against. Leave blank to disable RADIUS authentication. Leave port number blank to use the default port (1812). Leave the RADIUS shared secret blank to not use a RADIUS shared secret. RADIUS accounting packets will also be sent to port 1813 of the RADIUS server if RADIUS accounting is enabled.
 	</tr>
+	<tr>
+      <td valign="top" class="vncell">HTTPS login</td>
+      <td class="vtable">
+        <input name="httpslogin_enable" type="checkbox" class="formfld" id="httpslogin_enable" value="yes" <?php if($pconfig['httpslogin_enable']) echo "checked"; ?>>
+        <strong>Enable HTTPS login</strong><br>
+    If enabled, the username and password will be transmitted over an HTTPS connection to protect against eavesdroppers. This option only applies when RADIUS authentication is used. A server name, certificate and matching private key must also be specified below.</td>
+	  </tr>
+	<tr>
+      <td valign="top" class="vncell">HTTPS server name </td>
+      <td class="vtable">
+        <input name="httpsname" type="text" class="formfld" id="httpsname" size="30" value="<?=htmlspecialchars($pconfig['httpsname']);?>"><br>
+    This name will be used in the form action for the HTTPS POST and should match the Common Name (CN) in your certificate (otherwise, the client browser will most likely display a security warning). Make sure captive portal clients can resolve this name in DNS. </td>
+	  </tr>
+	<tr>
+      <td valign="top" class="vncell">HTTPS certificate</td>
+      <td class="vtable">
+        <textarea name="cert" cols="65" rows="7" id="cert" class="formpre"><?=htmlspecialchars($pconfig['cert']);?></textarea>
+        <br>
+    Paste a signed certificate in X.509 PEM format here.</td>
+	  </tr>
+	<tr>
+      <td valign="top" class="vncell">HTTPS private key</td>
+      <td class="vtable">
+        <textarea name="key" cols="65" rows="7" id="key" class="formpre"><?=htmlspecialchars($pconfig['key']);?></textarea>
+        <br>
+    Paste an RSA private key in PEM format here.</td>
+	  </tr>
 	<tr> 
 	  <td width="22%" valign="top" class="vncellreq">Portal page contents</td>
 	  <td width="78%" class="vtable">    
@@ -255,14 +325,16 @@ Clients will be disconnected after this amount of inactivity. They may log in ag
 		  <br>
 		  <br>
 		<?php endif; ?>
-		  Upload an HTML file for the portal page here (leave blank to keep the current one). Make sure to include a form (POST to the page itself)
+		  Upload an HTML file for the portal page here (leave blank to keep the current one). Make sure to include a form (POST to &quot;$PORTAL_ACTION$&quot;)
 with a submit button (name=&quot;accept&quot;). Include the &quot;auth_user&quot; and &quot;auth_pass&quot; input elements if RADIUS authentication is enabled. If RADIUS is enabled and no &quot;auth_user&quot; is present, authentication will always fail. If RADIUS is not enabled, you can omit both these input elements.
-Example code for the button:<br>
-		  <br><tt>&lt;form method=&quot;post&quot; action=&quot;&quot;&gt;<br>  
-		  &nbsp;&nbsp;&nbsp;&lt;input name=&quot;accept&quot; type=&quot;submit&quot; value=&quot;Continue&quot;&gt;<br>
+When using HTTPS login, a hidden field with name=&quot;redirurl&quot; and value=&quot;$PORTAL_REDIRURL$&quot; has to be included as well. Example code for the form:<br>
+		  <br>
+		  <tt>&lt;form method=&quot;post&quot; action=&quot;$PORTAL_ACTION$&quot;&gt;<br>
 		  &nbsp;&nbsp;&nbsp;&lt;input name=&quot;auth_user&quot; type=&quot;text&quot;&gt;<br>
 		  &nbsp;&nbsp;&nbsp;&lt;input name=&quot;auth_pass&quot; type=&quot;password&quot;&gt;<br>
-		  &lt;/form&gt;</tt>					</td>
+		  &nbsp;&nbsp;&nbsp;&lt;input name=&quot;redirurl&quot; type=&quot;hidden&quot; value=&quot;$PORTAL_REDIRURL$&quot;&gt;<br>
+&nbsp;&nbsp;&nbsp;&lt;input name=&quot;accept&quot; type=&quot;submit&quot; value=&quot;Continue&quot;&gt;<br>
+		  &lt;/form&gt;</tt></td>
 	</tr>
 	<tr>
 	  <td width="22%" valign="top" class="vncell">Authentication<br>
diff --git a/webgui/status_wireless.php b/webgui/status_wireless.php
index b020cd0..8abc57b 100644
--- a/webgui/status_wireless.php
+++ b/webgui/status_wireless.php
@@ -119,7 +119,7 @@ function get_wireless_info($ifdescr) {
               <?php endif; ?>
               <tr> 
                 <td colspan="2" class="listtopic"> 
-                  <?=htmlspecialchars($ifname);?> interface</td>
+                  <?=htmlspecialchars($ifname);?> interface (SSID &quot;<?=htmlspecialchars($config['interfaces'][$ifdescr]['wireless']['ssid']);?>&quot;)</td>
               </tr>
               <tr> 
                 <td width="22%" valign="top" class="listhdrr">Signal strength 
diff --git a/webgui/system_advanced.php b/webgui/system_advanced.php
index e43087d..ddf670c 100644
--- a/webgui/system_advanced.php
+++ b/webgui/system_advanced.php
@@ -38,6 +38,10 @@ $pconfig['cert'] = base64_decode($config['system']['webgui']['certificate']);
 $pconfig['key'] = base64_decode($config['system']['webgui']['private-key']);
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['disablefirmwarecheck'] = isset($config['system']['disablefirmwarecheck']);
+$pconfig['expanddiags'] = isset($config['system']['webgui']['expanddiags']);
+if ($g['platform'] == "generic-pc")
+	$pconfig['harddiskstandby'] = $config['system']['harddiskstandby'];
+$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 
 if ($_POST) {
 
@@ -67,12 +71,27 @@ if ($_POST) {
 		$config['system']['webgui']['private-key'] = base64_encode($_POST['key']);
 		$config['system']['disableconsolemenu'] = $_POST['disableconsolemenu'] ? true : false;
 		$config['system']['disablefirmwarecheck'] = $_POST['disablefirmwarecheck'] ? true : false;
+		$config['system']['webgui']['expanddiags'] = $_POST['expanddiags'] ? true : false;
+		if ($g['platform'] == "generic-pc") {
+			$oldharddiskstandby = $config['system']['harddiskstandby'];
+			$config['system']['harddiskstandby'] = $_POST['harddiskstandby'];
+		}
+		$config['system']['webgui']['noantilockout'] = $_POST['noantilockout'] ? true : false;
 			
 		write_config();
 		
 		if (($config['system']['webgui']['certificate'] != $oldcert)
 				|| ($config['system']['webgui']['private-key'] != $oldkey)) {
 			touch($d_sysrebootreqd_path);
+		} else if (($g['platform'] == "generic-pc") && ($config['system']['harddiskstandby'] != $oldharddiskstandby)) {
+			if (!$config['system']['harddiskstandby']) {
+				// Reboot needed to deactivate standby due to a stupid ATA-protocol
+				touch($d_sysrebootreqd_path);
+				unset($config['system']['harddiskstandby']);
+			} else {
+				// No need to set the standby-time if a reboot is needed anyway
+				system_set_harddisk_standby();
+			}
 		}
 		
 		$retval = 0;
@@ -195,12 +214,51 @@ function enable_change(enable_over) {
                     <strong>Disable console menu</strong><span class="vexpl"><br>
                     Changes to this option will take effect after a reboot.</span></td>
                 </tr>
+				<tr>
+                  <td valign="top" class="vtable">&nbsp;</td>
+                  <td class="vtable">
+                    <input name="disablefirmwarecheck" type="checkbox" id="disablefirmwarecheck" value="yes" <?php if ($pconfig['disablefirmwarecheck']) echo "checked"; ?>>
+                    <strong>Disable firmware version check</strong><span class="vexpl"><br>
+    This will cause m0n0wall not to check for newer firmware versions when the <a href="system_firmware.php">System: Firmware</a> page is viewed.</span></td>
+			    </tr>
+<?php if ($g['platform'] == "generic-pc"): ?>
 				<tr> 
                   <td width="22%" valign="top" class="vtable">&nbsp;</td>
                   <td width="78%" class="vtable"> 
-                    <input name="disablefirmwarecheck" type="checkbox" id="disablefirmwarecheck" value="yes" <?php if ($pconfig['disablefirmwarecheck']) echo "checked"; ?>>
-                    <strong>Disable firmware version check</strong><span class="vexpl"><br>
-                    This will cause m0n0wall not to check for newer firmware versions when the <a href="system_firmware.php">System: Firmware</a> page is viewed.</span></td>
+				  <strong>Hard disk standby time: </strong>
+                    <select name="harddiskstandby" class="formfld">
+					<?php
+                        /* Values from ATA-2
+                           http://www.t13.org/project/d0948r3-ATA-2.pdf
+                           Page 66 */
+						$sbvals = explode(" ", "0.5,6 1,12 2,24 3,36 4,48 5,60 7.5,90 10,120 15,180 20,240 30,241 60,242");
+					?>
+                      <option value="" <?php if(!$pconfig['harddiskstandby']) echo('selected');?>>Always on</option>
+					<?php
+					foreach ($sbvals as $sbval):
+						list($min,$val) = explode(",", $sbval); ?>
+                      <option value="<?=$val;?>" <?php if($pconfig['harddiskstandby'] == $val) echo('selected');?>><?=$min;?> minutes</option>
+					<?php endforeach; ?>
+                    </select>
+                    <br>
+                    Puts the hard disk into standby mode when the selected amount of time after the last
+                    access has elapsed. <em>Do not set this for CF cards.</em></td>
+				</tr>
+<?php endif; ?>
+				<tr> 
+                  <td width="22%" valign="top" class="vtable">&nbsp;</td>
+                  <td width="78%" class="vtable"> 
+                    <input name="expanddiags" type="checkbox" id="expanddiags" value="yes" <?php if ($pconfig['expanddiags']) echo "checked"; ?>>
+                    <strong>Keep diagnostics in navigation expanded </strong></td>
+                </tr>
+				<tr> 
+                  <td width="22%" valign="top" class="vtable">&nbsp;</td>
+                  <td width="78%" class="vtable"> 
+                    <input name="noantilockout" type="checkbox" id="noantilockout" value="yes" <?php if ($pconfig['noantilockout']) echo "checked"; ?>>
+                    <strong>Disable webGUI anti-lockout rule</strong><br>
+					By default, access to the webGUI on the LAN interface is always permitted, regardless of the user-defined filter rule set. Enable this feature to control webGUI access (make sure to have a filter rule in place that allows you in, or you will lock yourself out!).<br>
+					Hint: 
+					the &quot;set LAN IP address&quot; option in the console menu  resets this setting as well.</td>
                 </tr>
                 <tr> 
                   <td width="22%" valign="top">&nbsp;</td>
diff --git a/webgui/system_routes.php b/webgui/system_routes.php
index 438a74c..f5fb1c0 100644
--- a/webgui/system_routes.php
+++ b/webgui/system_routes.php
@@ -97,7 +97,7 @@ if ($_GET['act'] == "del") {
                 <tr>
                   <td class="listlr">
                     <?php
-				  $iflabels = array('lan' => 'LAN', 'pptp' => 'PPTP');
+				  $iflabels = array('lan' => 'LAN', 'wan' => 'WAN', 'pptp' => 'PPTP');
 				  for ($j = 1; isset($config['interfaces']['opt' . $j]); $j++)
 				  	$iflabels['opt' . $j] = $config['interfaces']['opt' . $j]['descr'];
 				  echo htmlspecialchars($iflabels[$route['interface']]); ?>
diff --git a/webgui/system_routes_edit.php b/webgui/system_routes_edit.php
index 6d092fa..092754e 100644
--- a/webgui/system_routes_edit.php
+++ b/webgui/system_routes_edit.php
@@ -121,7 +121,7 @@ if ($_POST) {
                   <td width="22%" valign="top" class="vncellreq">Interface</td>
                   <td width="78%" class="vtable">
 <select name="interface" class="formfld">
-                      <?php $interfaces = array('lan' => 'LAN', 'pptp' => 'PPTP');
+                      <?php $interfaces = array('lan' => 'LAN', 'wan' => 'WAN', 'pptp' => 'PPTP');
 					  for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) {
 					  	$interfaces['opt' . $i] = $config['interfaces']['opt' . $i]['descr'];
 					  }
diff --git a/webgui/vpn_ipsec_edit.php b/webgui/vpn_ipsec_edit.php
index 6f633d2..73b9f6f 100644
--- a/webgui/vpn_ipsec_edit.php
+++ b/webgui/vpn_ipsec_edit.php
@@ -77,6 +77,7 @@ function pconfig_to_address(&$adr, $padr, $pmask) {
 
 if (isset($id) && $a_ipsec[$id]) {
 	$pconfig['disabled'] = isset($a_ipsec[$id]['disabled']);
+	$pconfig['auto'] = isset($a_ipsec[$id]['auto']);
 
 	if (!isset($a_ipsec[$id]['local-subnet']))
 		$pconfig['localnet'] = "lan";
@@ -124,11 +125,11 @@ if (isset($id) && $a_ipsec[$id]) {
 	$pconfig['p1mode'] = "aggressive";
 	$pconfig['p1myidentt'] = "myaddress";
 	$pconfig['p1ealgo'] = "3des";
-	$pconfig['p1halgo'] = "md5";
+	$pconfig['p1halgo'] = "sha1";
 	$pconfig['p1dhgroup'] = "2";
 	$pconfig['p2proto'] = "esp";
 	$pconfig['p2ealgos'] = explode(",", "3des,blowfish,cast128,rijndael");
-	$pconfig['p2halgos'] = explode(",", "hmac_md5,hmac_sha1");
+	$pconfig['p2halgos'] = explode(",", "hmac_sha1,hmac_md5");
 	$pconfig['p2pfsgroup'] = "0";
 }
 
@@ -189,6 +190,7 @@ if ($_POST) {
 
 	if (!$input_errors) {
 		$ipsecent['disabled'] = $_POST['disabled'] ? true : false;
+		$ipsecent['auto'] = $_POST['auto'] ? true : false;
 		$ipsecent['interface'] = $pconfig['interface'];
 		pconfig_to_address($ipsecent['local-subnet'], $_POST['localnet'], $_POST['localnetmask']);
 		$ipsecent['remote-subnet'] = $_POST['remotenet'] . "/" . $_POST['remotebits'];
@@ -286,6 +288,13 @@ function typesel_change() {
 					removing it from the list.</span></td>
                 </tr>
 				<tr> 
+				  <td width="22%" valign="top" class="vncellreq">Auto-establish</td>
+				  <td width="78%" class="vtable"> 
+					<input name="auto" type="checkbox" id="auto" value="yes" <?php if ($pconfig['auto']) echo "checked"; ?>>
+					<strong>Automatically establish this tunnel</strong><br>
+					<span class="vexpl">Set this option to automatically re-establish this tunnel after reboots/reconfigures. If this is not set, the tunnel is established on demand.</span></td>
+				</tr>
+				<tr> 
                   <td width="22%" valign="top" class="vncellreq">Interface</td>
                   <td width="78%" class="vtable"> <select name="interface" class="formfld">
                       <?php $interfaces = array('wan' => 'WAN', 'lan' => 'LAN');
@@ -434,7 +443,7 @@ function typesel_change() {
                 <tr> 
                   <td width="22%" valign="top" class="vncellreq">Pre-Shared Key</td>
                   <td width="78%" class="vtable"> 
-                    <input name="p1pskey" type="text" class="formfld" id="p1pskey" size="40" value="<?=$pconfig['p1pskey'];?>"> 
+                    <input name="p1pskey" type="text" class="formfld" id="p1pskey" size="40" value="<?=htmlspecialchars($pconfig['p1pskey']);?>"> 
                   </td>
                 </tr>
                 <tr> 
@@ -477,8 +486,7 @@ function typesel_change() {
                     <?=htmlspecialchars($algoname);?>
                     <br> 
                     <?php endforeach; ?>
-                    <br>
-                    Hint: MD5 is slightly faster than SHA1.</td>
+				  </td>
                 </tr>
                 <tr> 
                   <td width="22%" valign="top" class="vncellreq">PFS key group</td>
diff --git a/webgui/vpn_ipsec_keys_edit.php b/webgui/vpn_ipsec_keys_edit.php
index 28baea2..f156f00 100644
--- a/webgui/vpn_ipsec_keys_edit.php
+++ b/webgui/vpn_ipsec_keys_edit.php
@@ -116,7 +116,7 @@ This can be either an IP address, fully qualified domain name or an e-mail addre
                 <tr> 
                   <td width="22%" valign="top" class="vncellreq">Pre-shared key</td>
                   <td width="78%" class="vtable"> 
-                    <input name="psk" type="text" class="formfld" id="psk" size="40" value="<?=$pconfig['psk'];?>">
+                    <input name="psk" type="text" class="formfld" id="psk" size="40" value="<?=htmlspecialchars($pconfig['psk']);?>">
                   </td>
                 </tr>
                 <tr> 
diff --git a/webgui/vpn_ipsec_mobile.php b/webgui/vpn_ipsec_mobile.php
index 05aa797..9d22371 100644
--- a/webgui/vpn_ipsec_mobile.php
+++ b/webgui/vpn_ipsec_mobile.php
@@ -41,11 +41,11 @@ if (count($a_ipsec) == 0) {
 	$pconfig['p1mode'] = "aggressive";
 	$pconfig['p1myidentt'] = "myaddress";
 	$pconfig['p1ealgo'] = "3des";
-	$pconfig['p1halgo'] = "md5";
+	$pconfig['p1halgo'] = "sha1";
 	$pconfig['p1dhgroup'] = "2";
 	$pconfig['p2proto'] = "esp";
 	$pconfig['p2ealgos'] = explode(",", "3des,blowfish,cast128,rijndael");
-	$pconfig['p2halgos'] = explode(",", "hmac_md5,hmac_sha1");
+	$pconfig['p2halgos'] = explode(",", "hmac_sha1,hmac_md5");
 	$pconfig['p2pfsgroup'] = "0";
 } else {
 	$pconfig['enable'] = isset($a_ipsec['enable']);
@@ -294,8 +294,7 @@ if ($_POST) {
                     <?=htmlspecialchars($algoname);?>
                     <br> 
                     <?php endforeach; ?>
-                    <br>
-                    Hint: MD5 is slightly faster than SHA1.</td>
+                  </td>
                 </tr>
                 <tr> 
                   <td width="22%" valign="top" class="vncellreq">PFS key group</td>
-- 
2.43.0