$Lang::tr{'flag'}	$Lang::tr{'countrycode'}	$Lang::tr{'country'}	$Lang::tr{'flag'}	$Lang::tr{'countrycode'}	$Lang::tr{'country'}
$Lang::tr{'flag'}	$Lang::tr{'countrycode'}	$Lang::tr{'country'}	$Lang::tr{'flag'}	$Lang::tr{'countrycode'}	$Lang::tr{'country'}
	$flagcode	$country
	$country_uc	$name
	$flagcode	$country	$country_uc	$name
$Lang::tr{'flag'}
$Lang::tr{'countrycode'}
$Lang::tr{'country'}
$Lang::tr{'flag'}
$Lang::tr{'countrycode'}
$Lang::tr{'country'}
$Lang::tr{'flag'}
$Lang::tr{'countrycode'}
$Lang::tr{'country'}
$Lang::tr{'flag'}
$Lang::tr{'countrycode'}
$Lang::tr{'country'}
$flagcode
$country
$country_uc
$name
$flagcode
$country
$country_uc
$name
$Lang::tr{'mac address'}
$Lang::tr{'dnsforward zone'}:
$Lang::tr{'enabled'}
$Lang::tr{'dnsforward forward_server'}:
$Lang::tr{'required field'}
END ; diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi new file mode 100755 index 0000000000..be663a62e0 --- /dev/null +++ b/html/cgi-bin/mail.cgi @@ -0,0 +1,345 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2015 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +use MIME::Lite; + +#enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +#Initialize variables and hashes +my $dmafile="${General::swroot}/dma/dma.conf"; +my $authfile="${General::swroot}/dma/auth.conf"; +my $mailfile="${General::swroot}/dma/mail.conf"; +my %dma=(); +my %auth=(); +my %mail=(); +my %mainsettings=(); +my %cgiparams=(); +my $errormessage=''; + +#Read all parameters for site +&Header::getcgihash(\%cgiparams); +&General::readhash("${General::swroot}/main/settings", \%mainsettings); +&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); + +#Show Headers +&Header::showhttpheaders(); + +#Check configfiles +if ( -f $dmafile){ + open (FILE, "<", $dmafile) or die $!; + foreach my $line () { + $line =~ m/^([A-Z]+)\s+?(.*)?$/; + my $key = $1; + my $val = $2; + $dma{$key}=$val; + } +}else{ + open(FILE, ">$dmafile") or die $!; +} +close FILE; + +if (exists $dma{'AUTHPATH'}){ + open (FILE, "<", $dma{'AUTHPATH'}) or die "$dma{'AUTHPATH'} nicht gefunden $! "; + my $authline; + foreach my $line () { + $authline = $line; + } + my @part1 = split(/\|/,$authline); + my @part2 = split(/\:/,$part1[1]); + $auth{'AUTHNAME'} = $part1[0]; + $auth{'AUTHHOST'} = $part2[0]; + $auth{'AUTHPASS'} = $part2[1]; +} + +if ( -f $mailfile){ + &General::readhash($mailfile, \%mail); +} + +#ACTIONS +if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite + #Check fields + if ($cgiparams{'USEMAIL'} eq 'on'){ + $errormessage=&checkmailsettings; + }else{ + $cgiparams{'txt_mailserver'}=''; + $cgiparams{'txt_mailport'}=''; + $cgiparams{'txt_mailuser'}=''; + $cgiparams{'txt_mailpass'}=''; + $cgiparams{'mail_tls'}=''; + $cgiparams{'txt_mailsender'}=''; + $cgiparams{'txt_recipient'}=''; + } + if(!$errormessage){ + #clear hashes + %auth=(); + %dma=(); + %mail=(); + + #clear configfiles + open (TXT, ">$dmafile") or die("Could not open /var/ipfire/dma/dma.conf: $!\n"); + open (TXT1, ">$authfile") or die("Could not open /var/ipfire/dma/auth.conf: $!\n"); + open (TXT2, ">$mailfile") or die("Could not open /var/ipfire/dma/mail.conf: $!\n"); + close TXT2; + + #Fill hashes with actual values + $mail{'USEMAIL'} = $cgiparams{'USEMAIL'}; + $mail{'SENDER'} = $cgiparams{'txt_mailsender'}; + $mail{'RECIPIENT'} = $cgiparams{'txt_recipient'}; + + $auth{'AUTHNAME'} = $cgiparams{'txt_mailuser'}; + $auth{'AUTHPASS'} = $cgiparams{'txt_mailpass'}; + $auth{'AUTHHOST'} = $cgiparams{'txt_mailserver'}; + + $dma{'SMARTHOST'} = $cgiparams{'txt_mailserver'}; + $dma{'PORT'} = $cgiparams{'txt_mailport'}; + $dma{'STARTTLS'} = '' if ($cgiparams{'mail_tls'}); + $dma{'SECURETRANSFER'} = '' if exists $dma{'STARTTLS'}; + $dma{'SPOOLDIR'} = "/var/spool/dma"; + $dma{'FULLBOUNCE'} = ''; + $dma{'MAILNAME'} = "$mainsettings{'HOSTNAME'}.$mainsettings{DOMAINNAME}"; + $dma{'AUTHPATH'} = "$authfile" if exists $auth{'AUTHNAME'}; + + #Create new configfiles + &General::writehash("$mailfile", \%mail); + while ( ($k,$v) = each %dma ) { + print TXT "$k $v\n"; + } + close TXT; + print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n"; + close TXT2; + + }else{ + $cgiparams{'update'}='on'; + &configsite; + } +} +if ($cgiparams{'ACTION'} eq "$Lang::tr{'email testmail'}"){ #Testmail button on configsite + &testmail; +} + +#Show site +&configsite; + +#FUNCTIONS +sub configsite{ + + + #If update set fieldvalues new + if($cgiparams{'update'} eq 'on'){ + $dma{'USEMAIL'}= 'on'; + $dma{'SMARTHOST'} = $cgiparams{'txt_mailserver'}; + $dma{'PORT'} = $cgiparams{'txt_mailport'}; + $auth{'AUTHUSER'} = $cgiparams{'txt_mailuser'}; + $auth{'AUTHHOST'} = $cgiparams{'txt_mailserver'}; + $auth{'AUTHPASS'} = $cgiparams{'txt_mailpass'}; + } + #find preselections + $checked{'usemail'}{$mail{'USEMAIL'}} = 'CHECKED'; + $checked{'mail_tls'}{'on'} = 'CHECKED' if exists $dma{'STARTTLS'}; + + #Open site + &Header::openpage($Lang::tr{'email settings'}, 1, ''); + &Header::openbigbox('100%', 'center'); + &error; + &info; + &Header::openbox('100%', 'left', $Lang::tr{'email config'}); + + #### JAVA SCRIPT #### + print< + \$(document).ready(function() { + // Show/Hide elements when USEMAIL checkbox is checked. + if (\$("#MAIL").attr("checked")) { + \$(".MAILSRV").show(); + } else { + \$(".MAILSRV").hide(); + } + + // Toggle MAIL elements when "USEMAIL" checkbox is clicked + \$("#MAIL").change(function() { + \$(".MAILSRV").toggle(); + }); + }); + +END + ##### JAVA SCRIPT END #### + my $col="style='background-color:$color{'color22'}'"; + print< + + + + + + + + + +

$Lang::tr{'email usemail'}
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +END + if (! -z $dmafile && $mail{'USEMAIL'} eq 'on'){ + print ""; + print ""; + print ""; + print ""; + } + print< + + +
$Lang::tr{'email mailsender'}
$Lang::tr{'email mailrcpt'}
$Lang::tr{'email mailaddr'}
$Lang::tr{'email mailport'}
$Lang::tr{'email mailuser'}
$Lang::tr{'email mailpass'}
$Lang::tr{'email tls'}
+ + + + + +
+
+ +END + &Header::closebox(); + &Header::closebigbox(); + &Header::closepage(); + exit 0; +} + +sub checkmailsettings { + #Check if mailserver is an ip address or a domain + if ($cgiparams{'txt_mailserver'} =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/){ + if (! &General::validip($cgiparams{'txt_mailserver'})){ + $errormessage.="$Lang::tr{'email invalid mailip'} $cgiparams{'txt_mailserver'}
"; + } + }elsif(! &General::validfqdn($cgiparams{'txt_mailserver'})){ + $errormessage.="$Lang::tr{'email invalid mailfqdn'} $cgiparams{'txt_mailserver'}
"; + } + #Check valid mailserverport + if($cgiparams{'txt_mailport'} < 1 || $cgiparams{'txt_mailport'} > 65535){ + $errormessage.="$Lang::tr{'email invalid mailport'} $cgiparams{'txt_mailport'}
"; + } + #Check valid sender + if(! $cgiparams{'txt_mailsender'}){ + $errormessage.="$Lang::tr{'email empty field'} $Lang::tr{'email mailsender'}
"; + }else{ + if (! &General::validemail($cgiparams{'txt_mailsender'})){ + $errormessage.="
$Lang::tr{'email invalid'} $Lang::tr{'email mailsender'}
"; + } + } + return $errormessage; +} + +sub testmail { + ### Create a new multipart message: + $msg = MIME::Lite->new( + From => $mail{'SENDER'}, + To => $mail{'RECIPIENT'}, + #Cc => 'some@other.com, some@more.com', + Subject => 'IPFire Testmail', + Type => 'multipart/mixed' + ); + + ### Add parts (each "attach" has same arguments as "new"): + $msg->attach( + Type => 'TEXT', + Data => "This is the IPFire test mail." + ); + + ### Add attachment for testing + #$msg->attach( + # Type => 'application/txt', + # Encoding => 'base64', + # Path => '/var/ipfire/dma/dma.conf', + # Filename => 'dma.conf', + # Disposition => 'attachment' + #); + + $msg->send_by_sendmail; +} + +sub info { + if ($infomessage) { + &Header::openbox('100%', 'left', $Lang::tr{'info messages'}); + print "$infomessage\n"; + print " \n"; + &Header::closebox(); + } +} + +sub error { + if ($errormessage) { + &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); + print "$errormessage\n"; + print " \n"; + &Header::closebox(); + } +} + + + + + + + + + + + + + + + diff --git a/html/cgi-bin/modem.cgi b/html/cgi-bin/modem.cgi index 48d1260e88..a13f8b2654 100644 --- a/html/cgi-bin/modem.cgi +++ b/html/cgi-bin/modem.cgi @@ -78,25 +78,25 @@ print "
\n"; print < - $Lang::tr{'init string'}
+ $Lang::tr{'init string'} - $Lang::tr{'hangup string'}
+ $Lang::tr{'hangup string'} - $Lang::tr{'speaker on'}
+ $Lang::tr{'speaker on'} - $Lang::tr{'speaker off'}
+ $Lang::tr{'speaker off'} - $Lang::tr{'tone dial'}
+ $Lang::tr{'tone dial'} - $Lang::tr{'pulse dial'}
+ $Lang::tr{'pulse dial'} - $Lang::tr{'connect timeout'} + $Lang::tr{'connect timeout'}
@@ -107,8 +107,7 @@ print < -
- $Lang::tr{'this field may be blank'} +
$Lang::tr{'required field'} diff --git a/html/cgi-bin/netovpnrw.cgi b/html/cgi-bin/netovpnrw.cgi index f775b23dcc..cae7770bb0 100755 --- a/html/cgi-bin/netovpnrw.cgi +++ b/html/cgi-bin/netovpnrw.cgi @@ -20,7 +20,7 @@ ############################################################################### use strict; - +use URI::Escape; # enable only the following on debugging purpose #use warnings; #use CGI::Carp 'fatalsToBrowser'; @@ -37,7 +37,7 @@ my %mainsettings = (); my @vpns=(); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); +my @querry = split(/\?/,uri_unescape($ENV{'QUERY_STRING'})); $querry[0] = '' unless defined $querry[0]; $querry[1] = 'week' unless defined $querry[1]; @@ -47,10 +47,10 @@ if ( $querry[0] ne "" && $querry[0] ne "UNDEF"){ &Graphs::updatevpngraph($querry[0],$querry[1]); }else{ &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'host to net vpn'}, 1, ''); + &Header::openpage($Lang::tr{'vpn statistic rw'}, 1, ''); &Header::openbigbox('100%', 'left'); - my @vpngraphs = `find /var/log/rrd/collectd/localhost/openvpn-*/ -not -path *openvpn-UNDEF* -not -path *openvpn-*n2n* -name *.rrd|sort`; + my @vpngraphs = `find /var/log/rrd/collectd/localhost/openvpn-*/ -not -path *openvpn-UNDEF* -not -path *openvpn-*n2n* -name *.rrd 2>/dev/null|sort`; foreach (@vpngraphs){ if($_ =~ /(.*)\/openvpn-(.*)\/if_octets_derive.rrd/){ push(@vpns,$2); @@ -59,7 +59,7 @@ if ( $querry[0] ne "" && $querry[0] ne "UNDEF"){ if(@vpns){ foreach (@vpns) { &Header::openbox('100%', 'center', "$_ $Lang::tr{'graph'}"); - &Graphs::makegraphbox("netovpnrw.cgi",$_,"week"); + &Graphs::makegraphbox("netovpnrw.cgi",$_, "day"); &Header::closebox(); } }else{ diff --git a/html/cgi-bin/netovpnsrv.cgi b/html/cgi-bin/netovpnsrv.cgi index 0ec9c679d5..15a95b6b9f 100755 --- a/html/cgi-bin/netovpnsrv.cgi +++ b/html/cgi-bin/netovpnsrv.cgi @@ -47,10 +47,10 @@ if ( $querry[0] ne ""){ &Graphs::updatevpnn2ngraph($querry[0],$querry[1]); }else{ &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'openvpn server'}, 1, ''); + &Header::openpage($Lang::tr{'vpn statistic n2n'}, 1, ''); &Header::openbigbox('100%', 'left'); - my @vpngraphs = `find /var/log/rrd/collectd/localhost/openvpn-*-n2n/ -not -path *openvpn-UNDEF* -name *traffic.rrd|sort`; + my @vpngraphs = `find /var/log/rrd/collectd/localhost/openvpn-*-n2n/ -not -path *openvpn-UNDEF* -name *traffic.rrd 2>/dev/null|sort`; foreach (@vpngraphs){ if($_ =~ /(.*)\/openvpn-(.*)\/if_octets_derive-traffic.rrd/){ push(@vpns,$2); @@ -59,7 +59,7 @@ if ( $querry[0] ne ""){ if (@vpns){ foreach (@vpns) { &Header::openbox('100%', 'center', "$_ $Lang::tr{'graph'}"); - &Graphs::makegraphbox("netovpnsrv.cgi",$_,"week"); + &Graphs::makegraphbox("netovpnsrv.cgi",$_, "day",320); &Header::closebox(); } }else{ diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 1e074928f2..9e252a9977 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -213,7 +213,7 @@ sub writeserverconf { print CONF "writepid /var/run/openvpn.pid\n"; print CONF "#DAN prepare OpenVPN for listening on blue and orange\n"; print CONF ";local $sovpnsettings{'VPN_IP'}\n"; - print CONF "dev $sovpnsettings{'DDEVICE'}\n"; + print CONF "dev tun\n"; print CONF "proto $sovpnsettings{'DPROTOCOL'}\n"; print CONF "port $sovpnsettings{'DDEST_PORT'}\n"; print CONF "script-security 3 system\n"; @@ -231,15 +231,15 @@ sub writeserverconf { # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500. # If we doesn't use one of them, we can use the configured mtu value. if ($sovpnsettings{'MSSFIX'} eq 'on') - { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + { print CONF "tun-mtu 1500\n"; } elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') - { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + { print CONF "tun-mtu 1500\n"; } elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') || ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) - { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + { print CONF "tun-mtu 1500\n"; } else - { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; } + { print CONF "tun-mtu $sovpnsettings{'DMTU'}\n"; } if ($vpnsettings{'ROUTES_PUSH'} ne '') { @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'}); @@ -668,6 +668,29 @@ sub read_routepushfile } } +sub writecollectdconf { + my $vpncollectd; + my %ccdhash=(); + + open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!"; + print COLLECTDVPN "Loadplugin openvpn\n"; + print COLLECTDVPN "\n"; + print COLLECTDVPN "\n"; + print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n"; + + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + foreach my $key (keys %ccdhash) { + if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') { + print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n"; + } + } + + print COLLECTDVPN "\n"; + close(COLLECTDVPN); + + # Reload collectd afterwards + system("/usr/local/bin/collectdctrl restart &>/dev/null"); +} #hier die refresh page if ( -e "${General::swroot}/ovpn/gencanow") { @@ -1144,7 +1167,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'}; #new settings for daemon $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'}; - $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'}; $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'}; $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'}; $vpnsettings{'DMTU'} = $cgiparams{'DMTU'}; @@ -1166,10 +1188,17 @@ SETTINGS_ERROR: my $file = ''; &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + # Kill all N2N connections + system("/usr/local/bin/openvpnctrl -kn2n &>/dev/null"); + foreach my $key (keys %confighash) { + my $name = $confighash{$cgiparams{'$key'}}[1]; + if ($confighash{$key}[4] eq 'cert') { delete $confighash{$cgiparams{'$key'}}; } + + system ("/usr/local/bin/openvpnctrl -drrd $name"); } while ($file = glob("${General::swroot}/ovpn/ca/*")) { unlink $file; @@ -1196,11 +1225,6 @@ SETTINGS_ERROR: while ($file = glob("${General::swroot}/ovpn/ccd/*")) { unlink $file } -# Delete all RRD files for Roadwarrior connections - chdir('/var/ipfire/ovpn/ccd'); - while ($file = glob("*")) { - system ("/usr/local/bin/openvpnctrl -drrd $file"); - } while ($file = glob("${General::swroot}/ovpn/ccd/*")) { unlink $file } @@ -1216,6 +1240,9 @@ SETTINGS_ERROR: system ("rm -rf $file"); } + # Remove everything from the collectd configuration + &writecollectdconf(); + #&writeserverconf(); ### ### Reset all step 1 @@ -1929,22 +1956,22 @@ END print < - + - + - + - + - + - + @@ -1975,7 +2002,7 @@ END +
$Lang::tr{'required field'}
$Lang::tr{'organization name'}:
$Lang::tr{'organization name'}:
$Lang::tr{'ipfires hostname'}:
$Lang::tr{'ipfires hostname'}:
$Lang::tr{'your e-mail'}:
$Lang::tr{'your e-mail'}:
$Lang::tr{'your department'}:
$Lang::tr{'your department'}:
$Lang::tr{'city'}:
$Lang::tr{'city'}:
$Lang::tr{'state or province'}:
$Lang::tr{'state or province'}:
$Lang::tr{'country'}:
- $Lang::tr{'this field may be blank'}
@@ -1991,17 +2018,17 @@ END
- + - + +
$Lang::tr{'required field'}

$Lang::tr{'upload p12 file'}:
$Lang::tr{'upload p12 file'}:
$Lang::tr{'pkcs12 file password'}:
$Lang::tr{'pkcs12 file password'}:

- $Lang::tr{'this field may be blank'}
END @@ -2041,7 +2068,8 @@ END &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ - system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]); + system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]); + &writecollectdconf(); } } else { @@ -2049,14 +2077,15 @@ END &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ - if ($n2nactive ne ''){ - system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]); - } + if ($n2nactive ne '') { + system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]); + &writecollectdconf(); + } } else { - $errormessage = $Lang::tr{'invalid key'}; + $errormessage = $Lang::tr{'invalid key'}; } - } + } } ### @@ -2108,7 +2137,7 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ print CLIENTCONF "# Server Gateway Network\n"; print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n"; print CLIENTCONF "# tun Device\n"; - print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n"; + print CLIENTCONF "dev tun\n"; print CLIENTCONF "# Port and Protokoll\n"; print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n"; @@ -2200,21 +2229,21 @@ else print CLIENTCONF "tls-client\r\n"; print CLIENTCONF "client\r\n"; print CLIENTCONF "nobind\r\n"; - print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n"; + print CLIENTCONF "dev tun\r\n"; print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n"; # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500 # or use configured value. if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) - { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; } + { print CLIENTCONF "tun-mtu 1500\r\n"; } elsif ($vpnsettings{MSSFIX} eq 'on') - { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; } + { print CLIENTCONF "tun-mtu 1500\r\n"; } elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') || ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) - { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; } + { print CLIENTCONF "tun-mtu 1500\r\n"; } else - { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; } + { print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n"; } if ( $vpnsettings{'ENABLED'} eq 'on'){ print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n"; @@ -2313,75 +2342,71 @@ else } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) { - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); - &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - if ($confighash{$cgiparams{'KEY'}}) { -# if ($vpnsettings{'ENABLED'} eq 'on' || -# $vpnsettings{'ENABLED_BLUE'} eq 'on') { -# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}); -# } -# - my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; + if ($confighash{$cgiparams{'KEY'}}) { + # Revoke certificate if certificate was deleted and rewrite the CRL + my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; + my $tempA = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; ### # m.a.d net2net ### -if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { - my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf"); - my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); - unlink ($certfile); - unlink ($conffile); + if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { + # Stop the N2N connection before it is removed + system("/usr/local/bin/openvpnctrl -kn2n $confighash{$cgiparams{'KEY'}}[1] &>/dev/null"); - if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") { - rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!"; - } -} + my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf"); + my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); + unlink ($certfile); + unlink ($conffile); + + if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") { + rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!"; + } + } - unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); - unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); + unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); + unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); # A.Marx CCD delete ccd files and routes - - if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]") - { - unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]"; - } - - &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); - foreach my $key (keys %ccdroutehash) { - if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ - delete $ccdroutehash{$key}; + if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]") + { + unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]"; } - } - &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); - &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); - foreach my $key (keys %ccdroute2hash) { - if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ - delete $ccdroute2hash{$key}; + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ + delete $ccdroutehash{$key}; + } } - } - &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); - &writeserverconf; - + &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); -# CCD end + &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + foreach my $key (keys %ccdroute2hash) { + if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ + delete $ccdroute2hash{$key}; + } + } + &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + &writeserverconf; -### -### Delete all RRD's for client -### - system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); - delete $confighash{$cgiparams{'KEY'}}; - my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; - &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); +# CCD end + # Update collectd configuration and delete all RRD files of the removed connection + &writecollectdconf(); + system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); - #&writeserverconf(); - } else { - $errormessage = $Lang::tr{'invalid key'}; - } + delete $confighash{$cgiparams{'KEY'}}; + my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + + } else { + $errormessage = $Lang::tr{'invalid key'}; + } &General::firewall_reload(); ### @@ -3053,32 +3078,6 @@ END $errormessage = $Lang::tr{'invalid key'}; } -### -### Remove connection -### -} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) { - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); - &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - - if ($confighash{$cgiparams{'KEY'}}) { -# if ($vpnsettings{'ENABLED'} eq 'on' || -# $vpnsettings{'ENABLED_BLUE'} eq 'on') { -# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}); -# } - unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); - unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); - delete $confighash{$cgiparams{'KEY'}}; - &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - #&writeserverconf(); - } else { - $errormessage = $Lang::tr{'invalid key'}; - } -#test33 - -### -### Choose between adding a host-net or net-net connection -### - ### # m.a.d net2net ### @@ -3102,11 +3101,10 @@ if ( -s "${General::swroot}/ovpn/settings") { $Lang::tr{'net to net vpn'} (Upload Client Package) - Import Connection Name
+ Import Connection Name $Lang::tr{'openvpn default'}: Client Packagename
$Lang::tr{'this field may be blank'} END ; @@ -3200,7 +3198,6 @@ END @firen2nconf = ; close (FILE); chomp(@firen2nconf); - } else { $errormessage = "Filecount does not match only 2 files are allowed\n"; @@ -3241,6 +3238,13 @@ END unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";} unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";} + #Add collectd settings to configfile + open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.'; + print FILE "# Logfile\n"; + print FILE "status-version 1\n"; + print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n"; + close FILE; + move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2"); if ($? ne 0) { @@ -4482,7 +4486,7 @@ if ($cgiparams{'TYPE'} eq 'net') { &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:"); print "\n"; - print ""; + print ""; if ($cgiparams{'TYPE'} eq 'host') { if ($cgiparams{'KEY'}) { @@ -4521,14 +4525,14 @@ if ($cgiparams{'TYPE'} eq 'net') { - + - + - + @@ -4538,10 +4542,10 @@ if ($cgiparams{'TYPE'} eq 'net') { - + - + @@ -4551,22 +4555,22 @@ if ($cgiparams{'TYPE'} eq 'net') { - + - + - + - @@ -4617,7 +4621,7 @@ END ; } #jumper - print ""; + print ""; print "
$Lang::tr{'name'}:
$Lang::tr{'name'}:
$Lang::tr{'local subnet'}
$Lang::tr{'local subnet'}		$Lang::tr{'remote subnet'}	$Lang::tr{'remote subnet'}
$Lang::tr{'ovpn subnet'}
$Lang::tr{'ovpn subnet'}		$Lang::tr{'protocol'}
$Lang::tr{'destination port'}:	$Lang::tr{'destination port'}:		Management Port ($Lang::tr{'openvpn default'}: $Lang::tr{'destination port'}):	Management Port ($Lang::tr{'openvpn default'}: $Lang::tr{'destination port'}):
$Lang::tr{'MTU settings'}
$Lang::tr{'MTU'}
$Lang::tr{'MTU'}		$Lang::tr{'openvpn default'}: udp/tcp 1500/1400
fragment
fragment:		$Lang::tr{'openvpn default'}: 1300
mssfix
mssfix:		$Lang::tr{'openvpn default'}: on
$Lang::tr{'comp-lzo'} +
$Lang::tr{'comp-lzo'}
$Lang::tr{'remark title'}
$Lang::tr{'remark title'}
"; if ($cgiparams{'TYPE'} eq 'host') { @@ -4684,12 +4688,12 @@ if ($cgiparams{'TYPE'} eq 'host') {
$Lang::tr{'generate a certificate'} - $Lang::tr{'users fullname or system hostname'}: - $Lang::tr{'users email'}:
- $Lang::tr{'users department'}:
- $Lang::tr{'organization name'}:
- $Lang::tr{'city'}:
- $Lang::tr{'state or province'}:
+ $Lang::tr{'users fullname or system hostname'}:
+ $Lang::tr{'users email'}: + $Lang::tr{'users department'}: + $Lang::tr{'organization name'}: + $Lang::tr{'city'}: + $Lang::tr{'state or province'}: $Lang::tr{'country'}:$Lang::tr{'generate a certificate'} - $Lang::tr{'users fullname or system hostname'}: - $Lang::tr{'users email'}:
- $Lang::tr{'users department'}:
- $Lang::tr{'organization name'}:
- $Lang::tr{'city'}:
- $Lang::tr{'state or province'}:
+ $Lang::tr{'users fullname or system hostname'}:
+ $Lang::tr{'users email'}: + $Lang::tr{'users department'}: + $Lang::tr{'organization name'}: + $Lang::tr{'city'}: + $Lang::tr{'state or province'}: $Lang::tr{'country'}:
$Lang::tr{'this field may be blank'} +
$Lang::tr{'required field'} END }else{ @@ -4756,7 +4760,7 @@ END
$Lang::tr{'this field may be blank'} +
$Lang::tr{'required field'} END @@ -4953,9 +4957,6 @@ END $checked{'ENABLED_ORANGE'}{'off'} = ''; $checked{'ENABLED_ORANGE'}{'on'} = ''; $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED'; - $selected{'DDEVICE'}{'tun'} = ''; - $selected{'DDEVICE'}{'tap'} = ''; - $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED'; $selected{'DPROTOCOL'}{'udp'} = ''; $selected{'DPROTOCOL'}{'tcp'} = ''; @@ -5047,10 +5048,6 @@ END print <$Lang::tr{'local vpn hostname/ip'}:
$Lang::tr{'ovpn subnet'}
- $Lang::tr{'ovpn device'} - @@ -5551,42 +5548,49 @@ END } print < + +
- - - - - - - - - +
$Lang::tr{'upload ca certificate'}
$Lang::tr{'ca name'}:		-
+ + + - - - + + + + + - - - - + + + + +
$Lang::tr{'upload ca certificate'}

$Lang::tr{'ca name'}:		+

$Lang::tr{'ovpn dh parameters'}
- - $Lang::tr{'ovpn dh upload'}: - - - - - - $Lang::tr{'ovpn dh new key'}: - - - - +
+ + + + + + + + + + + + + + + +
$Lang::tr{'ovpn dh parameters'}
$Lang::tr{'ovpn dh upload'}:	+
$Lang::tr{'ovpn dh new key'}:
+ -
END ; diff --git a/html/cgi-bin/pakfire.cgi b/html/cgi-bin/pakfire.cgi index 2a7ca8407f..143f123b7f 100644 --- a/html/cgi-bin/pakfire.cgi +++ b/html/cgi-bin/pakfire.cgi @@ -191,14 +191,14 @@ if ($return) { -
+		
 END
 	my @output = `grep pakfire /var/log/messages | tail -20`;
 	foreach (@output) {
-		print "$_";
+		print "$_
";
 	}
 	print <
+			
 		
 END
 	&Header::closebox();
diff --git a/html/cgi-bin/pppsetup.cgi b/html/cgi-bin/pppsetup.cgi
index 33f521e756..36d0ced90d 100644
--- a/html/cgi-bin/pppsetup.cgi
+++ b/html/cgi-bin/pppsetup.cgi
@@ -693,7 +693,7 @@ END
 ;
                 }
                 if ($pppsettings{'TYPE'} =~ /^(modem)$/ ) {
-                        print "$Lang::tr{'number'}\n";
+                        print "$Lang::tr{'number'} \n";
                         print "\n";
                         if ($pppsettings{'TYPE'} eq 'modem' ) {
                                 print "$Lang::tr{'modem speaker on'}\n";
@@ -711,15 +711,15 @@ END
         
 
 
-        $Lang::tr{'optional at cmd'} 1 
+        $Lang::tr{'optional at cmd'} 1
         
 
 
-        $Lang::tr{'optional at cmd'} 2 
+        $Lang::tr{'optional at cmd'} 2
         
 
 
-        $Lang::tr{'optional at cmd'} 3 
+        $Lang::tr{'optional at cmd'} 3
         
 
 
@@ -732,7 +732,7 @@ END
 
 print <
-        $Lang::tr{'idle timeout'}
+        $Lang::tr{'idle timeout'} 
         
 
  
@@ -774,11 +774,11 @@ print <
 
 
-        $Lang::tr{'holdoff'}:
+        $Lang::tr{'holdoff'}: 
         
 
 
-        $Lang::tr{'maximum retries'}
+        $Lang::tr{'maximum retries'} 
         
 
 END
@@ -793,15 +793,15 @@ print <$Lang::tr{'pptp settings'}
 
 
-        Peer
+        $Lang::tr{'pptp peer'}: 
         
 
 
-        My Netconfig
+        $Lang::tr{'pptp netconfig'}: 
         
 
 
-        PPTP Route 
+        $Lang::tr{'pptp route'}:
         
 
 
@@ -889,12 +889,12 @@ print <$Lang::tr{'pppoe settings'}
 
 
-        $Lang::tr{'service name'} 
+        $Lang::tr{'service name'}
         
         
 
 
-        $Lang::tr{'concentrator name'} 
+        $Lang::tr{'concentrator name'}
         
         
 
@@ -909,11 +909,11 @@ print <
 
 
-        MTU 
+        MTU:
         
 
 
-        MRU 
+        MRU:
         
 
 END
@@ -925,9 +925,9 @@ print <$Lang::tr{'authentication'}
 
 
-        $Lang::tr{'username'}
+        $Lang::tr{'username'} 
         
-        $Lang::tr{'password'}
+        $Lang::tr{'password'} 
         
 
 
@@ -948,7 +948,7 @@ END
 }
 print <
-        $Lang::tr{'script name'} 
+        $Lang::tr{'script name'}
         
 
 


@@ -969,7 +969,7 @@ print <
 




 
-        $Lang::tr{'profile name'}
+        $Lang::tr{'profile name'} 
         
         
 
@@ -978,14 +978,16 @@ print <
 
         $Lang::tr{'legend'}:
-         $Lang::tr{'this field may be blank'}
+         $Lang::tr{'required field'}
 
-
 END
 ;
-&Header::closebox();
 }
 
+print "";
+
+&Header::closebox();
+
 print "\n";
 
 &Header::closebigbox();
diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index ba2455a96c..6c4e2b05d1 100644
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -969,13 +969,13 @@ print <
 	$Lang::tr{'advproxy enabled on'} Green:
 	
-	$Lang::tr{'advproxy proxy port'}:
+	$Lang::tr{'advproxy proxy port'}: 
 	
 
 
 	$Lang::tr{'advproxy transparent on'} Green:
 	
-	$Lang::tr{'advproxy proxy port transparent'}:
+	$Lang::tr{'advproxy proxy port transparent'}: 
 	
 
 
@@ -988,7 +988,7 @@ if ($netsettings{'BLUE_DEV'}) {
 	print " ";
 }
 print <$Lang::tr{'advproxy visible hostname'}: 
+	$Lang::tr{'advproxy visible hostname'}:
 	
 
 
@@ -1035,7 +1035,7 @@ print <
 
-
+
 END
 ;
 my $count = `ip n| wc -l`;
@@ -1071,19 +1071,19 @@ print <
 	
-	
+	
-	
+	
-	
+	
@@ -1119,28 +1119,28 @@ print <
 	
-	
+	
-	
+	
-	
+	
-	
+	
-	
+	
-	
+	
-	
+	
@@ -1158,7 +1158,7 @@ print <
 			
-			
+			
@@ -1218,8 +1218,8 @@ print < 
-	
-	
+	
+	
+END
+
+if ($mail{'USEMAIL'} eq 'on'){
+	if (!$settings{'MAILSENDER'}){
+		$settings{'MAILSENDER'} = $mail{'SENDER'};
+	}
+print <
 		
-	
 $Lang::tr{'advproxy redirector children'}
$Lang::tr{'processes'}
$Lang::tr{'processes'}:  $Lang::tr{'advproxy via forwarding'}:
 	 $Lang::tr{'advproxy upstream proxy host:port'}  $Lang::tr{'advproxy upstream proxy host:port'}:
 	
 
 
 	$Lang::tr{'advproxy client IP forwarding'}:
 	 $Lang::tr{'advproxy upstream username'}:  $Lang::tr{'advproxy upstream username'}:
 	
 
 
 	$Lang::tr{'advproxy username forwarding'}:
 	 $Lang::tr{'advproxy upstream password'}:  $Lang::tr{'advproxy upstream password'}:
 	
 
 $Lang::tr{'proxy cachemgr'}:
 	 $Lang::tr{'advproxy admin mail'}:  $Lang::tr{'advproxy admin mail'}:
 	
 
 $Lang::tr{'proxy filedescriptors'}: $Lang::tr{'proxy filedescriptors'}: 
 	 $Lang::tr{'proxy admin password'}:  $Lang::tr{'proxy admin password'}:
 	
 
 
 	    
 
 $Lang::tr{'advproxy ram cache size'}: $Lang::tr{'advproxy ram cache size'}: 
 	 $Lang::tr{'advproxy hdd cache size'}: $Lang::tr{'advproxy hdd cache size'}: 
 	
 
 $Lang::tr{'advproxy min size'}: $Lang::tr{'advproxy min size'}: 
 	 $Lang::tr{'advproxy max size'}: $Lang::tr{'advproxy max size'}: 
 	
 
 
 			$Lang::tr{'advproxy no cache sites'}:  $Lang::tr{'advproxy no cache sites'}:
 			
 			
 				 
 
 $Lang::tr{'advproxy standard ports'}: $Lang::tr{'advproxy ssl ports'}: $Lang::tr{'advproxy standard ports'}:  $Lang::tr{'advproxy ssl ports'}: 
 
 
 	@@ -1247,7 +1247,7 @@ print <<END
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
 </tr>
 <tr>
-	<td colspan='4' class='base'>$Lang::tr{'advproxy allowed subnets'}:</td>
+	<td colspan='4' class='base'>$Lang::tr{'advproxy allowed subnets'}: <img src='/blob.gif' alt='*' /></td>
 </tr>
 <tr>
 	<td colspan='2' rowspan='4'><textarea name='SRC_SUBNETS' cols='32' rows='3' wrap='off'>
@@ -1300,8 +1300,8 @@ print <<END
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
 </tr>
 <tr>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted ip clients'}: <img src='/blob.gif' alt='*' /></td>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted mac clients'}: <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted ip clients'}:</td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted mac clients'}:</td>
 </tr>
 <tr>
 	<td colspan='2'><textarea name='SRC_UNRESTRICTED_IP' cols='32' rows='3' wrap='off'>
@@ -1327,8 +1327,8 @@ print <<END
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
 </tr>
 <tr>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy banned ip clients'}: <img src='/blob.gif' alt='*' /></td>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy banned mac clients'}: <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy banned ip clients'}:</td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy banned mac clients'}:</td>
 </tr>
 <tr>
 	<td colspan='2'><textarea name='SRC_BANNED_IP' cols='32' rows='3' wrap='off'>
@@ -1373,12 +1373,12 @@ END
 ;
 if ($proxysettings{'CLASSROOM_EXT'} eq 'on'){
 print <<END
-	<td class='base'>$Lang::tr{'advproxy supervisor password'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'advproxy supervisor password'}:</td>
 	<td><input type='password' name='SUPERVISOR_PASSWORD' value='$proxysettings{'SUPERVISOR_PASSWORD'}' size='12' /></td>
 </tr>
 <tr>
 	<td colspan='2' class='base'>$Lang::tr{'advproxy cre group definitions'}:</td>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy cre supervisors'}: <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy cre supervisors'}:</td>
 END
 ;
 }
@@ -1512,9 +1512,9 @@ print <<END
 	<td colspan='4'><b>$Lang::tr{'advproxy transfer limits'}</b></td>
 </tr>
 <tr>
-	<td width='25%' class='base'>$Lang::tr{'advproxy max download size'}:</td>
+	<td width='25%' class='base'>$Lang::tr{'advproxy max download size'}: <img src='/blob.gif' alt='*' /></td>
 	<td width='20%'><input type='text' name='MAX_INCOMING_SIZE' value='$proxysettings{'MAX_INCOMING_SIZE'}' size='5' /></td>
-	<td width='25%' class='base'>$Lang::tr{'advproxy max upload size'}:</td>
+	<td width='25%' class='base'>$Lang::tr{'advproxy max upload size'}: <img src='/blob.gif' alt='*' /></td>
 	<td width='30%'><input type='text' name='MAX_OUTGOING_SIZE' value='$proxysettings{'MAX_OUTGOING_SIZE'}' size='5' /></td>
 </tr>
 </table>
@@ -1619,7 +1619,7 @@ END
 if ( $proxysettings{'ENABLE_MIME_FILTER'} eq 'on' ){
 print <<END
 <tr>
-	<td  colspan='2' class='base'>$Lang::tr{'advproxy MIME block types'}: <img src='/blob.gif' alt='*' /></td>
+	<td  colspan='2' class='base'>$Lang::tr{'advproxy MIME block types'}:</td>
 	<td> </td>
 	<td> </td>
 </tr>
@@ -1683,8 +1683,8 @@ print <<END
 	<td><b>$Lang::tr{'advproxy privacy'}</b></td>
 </tr>
 <tr>
-	<td class='base'>$Lang::tr{'advproxy fake useragent'}: <img src='/blob.gif' alt='*' /></td>
-	<td class='base'>$Lang::tr{'advproxy fake referer'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'advproxy fake useragent'}:</td>
+	<td class='base'>$Lang::tr{'advproxy fake referer'}:</td>
 </tr>
 <tr>
 	<td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='40%' /></td>
@@ -1742,7 +1742,7 @@ if (!($proxysettings{'AUTH_METHOD'} eq 'none')) { if (!($proxysettings{'AUTH_MET
 	<td colspan='2' rowspan= '6' valign='top' class='base'>
 		<table cellpadding='0' cellspacing='0'>
 			<tr>
-			<td class='base'>$Lang::tr{'advproxy AUTH realm'}: <img src='/blob.gif' alt='*' /></td>
+			<td class='base'>$Lang::tr{'advproxy AUTH realm'}:</td>
 			</tr>
 			<tr>
 				<!-- intentionally left empty -->
@@ -1760,7 +1760,7 @@ if (!($proxysettings{'AUTH_METHOD'} eq 'none')) { if (!($proxysettings{'AUTH_MET
 				<!-- intentionally left empty -->
 			</tr>
 			<tr>
-			<td>$Lang::tr{'advproxy AUTH no auth'}: <img src='/blob.gif' alt='*' /></td>
+			<td>$Lang::tr{'advproxy AUTH no auth'}:</td>
 			</tr>
 			<tr>
 				<!-- intentionally left empty -->
@@ -1786,7 +1786,7 @@ print <<END
 	<td><input type='text' name='AUTH_CACHE_TTL' value='$proxysettings{'AUTH_CACHE_TTL'}' size='5' /></td>
 </tr>
 <tr>
-	<td class='base'>$Lang::tr{'advproxy AUTH limit of IP addresses'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'advproxy AUTH limit of IP addresses'}:</td>
 	<td><input type='text' name='AUTH_MAX_USERIP' value='$proxysettings{'AUTH_MAX_USERIP'}' size='5' /></td>
 </tr>
 <tr>
@@ -1856,7 +1856,7 @@ print <<END
 </tr>
 <tr>
 	<td colspan='2' class='base'>$Lang::tr{'advproxy IDENT aware hosts'}:</td>
-	<td colspan='2' class='base'>$Lang::tr{'advproxy AUTH no auth'}: <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2' class='base'>$Lang::tr{'advproxy AUTH no auth'}:</td>
 </tr>
 <tr>
 	<td colspan='2'><textarea name='IDENT_HOSTS' cols='32' rows='6' wrap='off'>
@@ -1942,7 +1942,7 @@ print <<END
 	<td><input type='text' name='NTLM_DOMAIN' value='$proxysettings{'NTLM_DOMAIN'}' size='15' /></td>
 	<td class='base'>$Lang::tr{'advproxy NTLM PDC hostname'}:</td>
 	<td><input type='text' name='NTLM_PDC' value='$proxysettings{'NTLM_PDC'}' size='14' /></td>
-	<td class='base'>$Lang::tr{'advproxy NTLM BDC hostname'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'advproxy NTLM BDC hostname'}:</td>
 	<td><input type='text' name='NTLM_BDC' value='$proxysettings{'NTLM_BDC'}' size='14' /></td>
 </tr>
 </table>
@@ -2020,7 +2020,7 @@ if ($proxysettings{'AUTH_METHOD'} eq 'ntlm-auth') {
 				<td colspan='4'><b>$Lang::tr{'advproxy group access control'}</b></td>
 			</tr>
 			<tr>
-				<td width='20%' class='base'>$Lang::tr{'advproxy group required'}: <img src='/blob.gif' alt='*' /></td>
+				<td width='20%' class='base'>$Lang::tr{'advproxy group required'}:</td>
 				<td width='40%'><input type='text' name='NTLM_AUTH_GROUP' value='$proxysettings{'NTLM_AUTH_GROUP'}' size='37' /></td>
 				<td> </td>
 				<td> </td>
@@ -2076,7 +2076,7 @@ print <<END
 	<td colspan='4'><b>$Lang::tr{'advproxy LDAP group access control'}</b></td>
 </tr>
 <tr>
-	<td width='20%' class='base'>$Lang::tr{'advproxy LDAP group required'}: <img src='/blob.gif' alt='*' /></td>
+	<td width='20%' class='base'>$Lang::tr{'advproxy LDAP group required'}:</td>
 	<td width='40%'><input type='text' name='LDAP_GROUP' value='$proxysettings{'LDAP_GROUP'}' size='37' /></td>
 	<td> </td>
 	<td> </td>
@@ -2103,7 +2103,7 @@ print <<END
 	<td width='30%'><input type='text' name='RADIUS_PORT' value='$proxysettings{'RADIUS_PORT'}' size='3' /></td>
 </tr>
 <tr>
-	<td class='base'>$Lang::tr{'advproxy RADIUS identifier'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'advproxy RADIUS identifier'}:</td>
 	<td><input type='text' name='RADIUS_IDENTIFIER' value='$proxysettings{'RADIUS_IDENTIFIER'}' size='14' /></td>
 	<td class='base'>$Lang::tr{'advproxy RADIUS secret'}:</td>
 	<td><input type='password' name='RADIUS_SECRET' value='$proxysettings{'RADIUS_SECRET'}' size='14' /></td>
@@ -2259,9 +2259,7 @@ print <<END
 <br />
 <table width='100%'>
 <tr>
-	<td><img src='/blob.gif' align='top' alt='*' /> 
-	<font class='base'>$Lang::tr{'this field may be blank'}</font>
-	</td>
+	<td><img src='/blob.gif' align='top' alt='*' /> <font class='base'>$Lang::tr{'required field'}</font></td>
 	<td align='right'> </td>
 </tr>
 </table>
diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi
index 5542f65309..39c3ed8431 100644
--- a/html/cgi-bin/qos.cgi
+++ b/html/cgi-bin/qos.cgi
@@ -938,7 +938,7 @@ END
 		<tr><td width='33%' align='right'>$Lang::tr{'guaranteed bandwith'}:
 		    <td width='33%' align='left'><input type='text' size='20' name='MINBWDTH' maxlength='8' required='1' value="$qossettings{'MINBWDTH'}" />
 		    <td width='33%' align='center'> 
-		<tr><td width='33%' align='right'>$Lang::tr{'max bandwith'}:
+		<tr><td width='33%' align='right'>$Lang::tr{'max bandwith'} <img src='/blob.gif' alt='*' />:
 		    <td width='33%' align='left'><input type='text' size='20' name='MAXBWDTH' maxlength='8' required='1' value="$qossettings{'MAXBWDTH'}" />
 		    <td width='33%' align='center'> 
 		<tr><td width='33%' align='right'>Burst:
@@ -960,8 +960,8 @@ print <<END
 				<option value='1' $selected{'TOS'}{'1'}>$Lang::tr{'min costs'} (1)</option></select>
 		    <td width='33%' align='center'> 
 		<tr><td width='33%' align='right'>$Lang::tr{'remark'}:
-		    <td width='66%' colspan='2' align='left'><input type='text' name='REMARK' size='40' maxlength='40' value="$qossettings{'REMARK'}" /> <img alt="" alt='blob' src='/blob.gif' />
-		<tr><td width='33%' align='right'> 
+		    <td width='66%' colspan='2' align='left'><input type='text' name='REMARK' size='40' maxlength='40' value="$qossettings{'REMARK'}" />
+		<tr><td width='33%' align='right'><img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}
 		    <td width='33%' align='left'> 
 		    <td width='33%' align='center'><input type='submit' name='DOCLASS' value='$Lang::tr{'save'}' /> <input type='reset' value='$Lang::tr{'reset'}' />
 		</table></form>
diff --git a/html/cgi-bin/routing.cgi b/html/cgi-bin/routing.cgi
index c460a74e7c..2c60f67cdf 100644
--- a/html/cgi-bin/routing.cgi
+++ b/html/cgi-bin/routing.cgi
@@ -118,12 +118,16 @@ if ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
 }
 
 if ($settings{'ACTION'} eq $Lang::tr{'add'}) {
-	# Convert subnet masks to CIDR notation.
-	$settings{'IP'} = &General::iporsubtocidr($settings{'IP'});
 
-# Validate inputs
-	if (( !&General::validip($settings{'IP'})) and ( !&General::validipandmask($settings{'IP'}))){
+	# Validate inputs
+	if (!&General::validipandmask($settings{'IP'}))){
 	$errormessage = $Lang::tr{'invalid ip'}." / ".$Lang::tr{'invalid netmask'};
+	}else{
+		#set networkip if not already correctly defined
+		my($ip,$cidr) = split(/\//,$settings{'IP'});
+		$cidr = &General::iporsubtocidr($cidr);
+		my $netip=&General::getnetworkip($ip,$cidr);
+		$settings{'IP'} = "$netip/$cidr";
 	}
 
 	if ($settings{'IP'} =~ /^0\.0\.0\.0/){
diff --git a/html/cgi-bin/services.cgi b/html/cgi-bin/services.cgi
index 6bfa5bbbe8..76bd9edebc 100644
--- a/html/cgi-bin/services.cgi
+++ b/html/cgi-bin/services.cgi
@@ -188,6 +188,9 @@ END
 			# mdadm should not stopped with webif because this could crash the system
 			#
 			chomp($_);
+			if ( $_ eq 'squid' ) {
+				next;
+			}
 			if ( ($_ ne "alsa") && ($_ ne "mdadm") ) {
 				$lines++;
 				if ($lines % 2){
diff --git a/html/cgi-bin/time.cgi b/html/cgi-bin/time.cgi
index 39d71f8425..8363b99512 100644
--- a/html/cgi-bin/time.cgi
+++ b/html/cgi-bin/time.cgi
@@ -263,9 +263,9 @@ print <<END
 </td></tr>
 <tr>
 	<td> </td>
-	<td width='25%' class='base'>$Lang::tr{'primary ntp server'}:</td>
+	<td width='25%' class='base'>$Lang::tr{'primary ntp server'}: <img src='/blob.gif' alt='*' /></td>
 	<td width='25%'><input type='text' name='NTP_ADDR_1' value='$timesettings{'NTP_ADDR_1'}' /></td>
-	<td width='25%' class='base'>$Lang::tr{'secondary ntp server'}:  <img src='/blob.gif' align='top' alt='*' /></td>
+	<td width='25%' class='base'>$Lang::tr{'secondary ntp server'}:</td>
 	<td width='25%'><input type='text' name='NTP_ADDR_2' value='$timesettings{'NTP_ADDR_2'}' /></td>
 </tr>
 <tr>
@@ -319,7 +319,7 @@ print <<END
 <hr />
 <table width='100%'>
 <tr>
-	<td width='30%'><img src='/blob.gif' alt='*' /> $Lang::tr{'this field may be blank'}</td>
+	<td width='30%'><img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}</td>
 	<td width='65%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'set time now'}' /></td>
 	<td width='5%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 </tr>
diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi
index 228b5d48c2..193e4059f6 100644
--- a/html/cgi-bin/tor.cgi
+++ b/html/cgi-bin/tor.cgi
@@ -20,13 +20,14 @@
 ###############################################################################
 
 use strict;
-use Locale::Country;
+use Locale::Codes::Country;
 
 # enable only the following on debugging purpose
 use warnings;
 use CGI::Carp 'fatalsToBrowser';
 
 require '/var/ipfire/general-functions.pl';
+require "${General::swroot}/geoip-functions.pl";
 require "${General::swroot}/lang.pl";
 require "${General::swroot}/header.pl";
 
@@ -266,7 +267,7 @@ if ( ($memory != 0) && (@pid[0] ne "///") ){
 			<tr>
 				<td width='25%' class='base'>$Lang::tr{'tor enabled'}:</td>
 				<td width='30%'><input type='checkbox' name='TOR_ENABLED' $checked{'TOR_ENABLED'}{'on'} /></td>
-				<td width='25%' class='base'>$Lang::tr{'tor socks port'}:</td>
+				<td width='25%' class='base'>$Lang::tr{'tor socks port'}: <img src='/blob.gif' alt='*' /></td>
 				<td width='20%'><input type='text' name='TOR_SOCKS_PORT' value='$settings{'TOR_SOCKS_PORT'}' size='5' /></td>
 			</tr>
 			<tr>
@@ -323,9 +324,9 @@ END
 						<option value=''>- $Lang::tr{'tor exit country any'} -</option>
 END
 
-		my @country_names = Locale::Country::all_country_names();
+		my @country_names = Locale::Codes::Country::all_country_names();
 		foreach my $country_name (sort @country_names) {
-			my $country_code = Locale::Country::country2code($country_name);
+			my $country_code = Locale::Codes::Country::country2code($country_name);
 			$country_code = uc($country_code);
 			print "<option value='$country_code'";
 
@@ -386,17 +387,17 @@ END
 						<option value='private-bridge' $selected{'TOR_RELAY_MODE'}{'private-bridge'}>$Lang::tr{'tor relay mode private bridge'}</option>
 					</select>
 				</td>
-				<td width='25%' class='base'>$Lang::tr{'tor relay nickname'}: <img src='/blob.gif' alt='*' /></td>
+				<td width='25%' class='base'>$Lang::tr{'tor relay nickname'}:</td>
 				<td width='20%'>
 					<input type='text' name='TOR_RELAY_NICKNAME' value='$settings{'TOR_RELAY_NICKNAME'}' maxlength='19' />
 				</td>
 			</tr>
 			<tr>
-				<td width='25%' class='base'>$Lang::tr{'tor relay address'}: <img src='/blob.gif' alt='*' /></td>
+				<td width='25%' class='base'>$Lang::tr{'tor relay address'}:</td>
 				<td width='30%'>
 					<input type='text' name='TOR_RELAY_ADDRESS' value='$settings{'TOR_RELAY_ADDRESS'}' />
 				</td>
-				<td width='25%' class='base'>$Lang::tr{'tor relay port'}:</td>
+				<td width='25%' class='base'>$Lang::tr{'tor relay port'}: <img src='/blob.gif' alt='*' /></td>
 				<td width='20%'>
 					<input type='text' name='TOR_RELAY_PORT' value='$settings{'TOR_RELAY_PORT'}' size='5' />
 				</td>
@@ -404,13 +405,13 @@ END
 			<tr>
 				<td width='25%'> </td>
 				<td width='30%'> </td>
-				<td width='25%' class='base'>$Lang::tr{'tor directory port'}:</td>
+				<td width='25%' class='base'>$Lang::tr{'tor directory port'}: <img src='/blob.gif' alt='*' /></td>
 				<td width='20%'>
 					<input type='text' name='TOR_RELAY_DIRPORT' value='$settings{'TOR_RELAY_DIRPORT'}' size='5' /> $Lang::tr{'tor 0 = disabled'}
 				</td>
 			</tr>
 			<tr>
-				<td width='25%' class='base'>$Lang::tr{'tor contact info'}: <img src='/blob.gif' alt='*' /></td>
+				<td width='25%' class='base'>$Lang::tr{'tor contact info'}:</td>
 				<td width='75%' colspan='3'>
 					<input type='text' name='TOR_RELAY_CONTACT_INFO' value='$settings{'TOR_RELAY_CONTACT_INFO'}' style='width: 98%;' />
 				</td>
@@ -441,7 +442,7 @@ END
 						<option value='0' $selected{'TOR_RELAY_BANDWIDTH_RATE'}{'0'}>$Lang::tr{'tor bandwidth unlimited'}</option>
 					</select>
 				</td>
-				<td width='25%' class='base'>$Lang::tr{'tor accounting limit'}:</td>
+				<td width='25%' class='base'>$Lang::tr{'tor accounting limit'}: <img src='/blob.gif' alt='*' /></td>
 				<td width='20%'>
 					<input type='text' name='TOR_RELAY_ACCOUNTING_LIMIT' value='$settings{'TOR_RELAY_ACCOUNTING_LIMIT'}' size='12' />
 				</td>
@@ -484,9 +485,7 @@ END
 	print <<END;
 		<table width='95%'>
 			<tr>
-				<td>
-					<img src='/blob.gif' align='top' alt='*' /> <font class='base'>$Lang::tr{'this field may be blank'}</font>
-				</td>
+				<td><img src='/blob.gif' align='top' alt='*' /> <font class='base'>$Lang::tr{'required field'}</font></td>
 				<td align='right'> </td>
 			</tr>
 		</table>
@@ -621,10 +620,14 @@ END
 END
 
 				if (exists($node->{'country_code'})) {
-					if (!$node->{'country_code'} or $node->{'country_code'} eq '??') {
-						print "<img src='/images/flags/blank.png' border='0' align='absmiddle'/>";
+					# Get the flag icon of the country.
+					my $flag_icon = &GeoIP::get_flag_icon($node->{'country_code'});
+
+					# Check if a flag for the given country is available.
+					if ($flag_icon) {
+						print "<a href='country.cgi#$node->{'country_code'}'><img src='$flag_icon' border='0' align='absmiddle' alt='$node->{'country_code'}'></a>";
 					} else {
-						print "<a href='country.cgi#$node->{'country_code'}'><img src='/images/flags/$node->{'country_code'}.png' border='0' align='absmiddle' alt='$node->{'country_code'}'></a>";
+						print "<img src='/images/flags/blank.png' border='0' align='absmiddle'/>";
 					}
 				}
 
diff --git a/html/cgi-bin/updatexlrator.cgi b/html/cgi-bin/updatexlrator.cgi
index 6cd9668db8..c94c34ec1e 100644
--- a/html/cgi-bin/updatexlrator.cgi
+++ b/html/cgi-bin/updatexlrator.cgi
@@ -397,7 +397,7 @@ print <<END
 <tr>
 	<td class='base'>$Lang::tr{'updxlrtr passive mode'}:</td>
 	<td class='base'><input type='checkbox' name='PASSIVE_MODE' $checked{'PASSIVE_MODE'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'updxlrtr max disk usage'}:</td>
+	<td class='base'>$Lang::tr{'updxlrtr max disk usage'}: <img src='/blob.gif' alt='*' /></td>
 	<td class='base'><input type='text' name='MAX_DISK_USAGE' value='$xlratorsettings{'MAX_DISK_USAGE'}' size='1' /> %</td>
 </tr>
 </table>
@@ -409,7 +409,7 @@ print <<END
 <tr>
 	<td class='base' width='25%'>$Lang::tr{'updxlrtr low download priority'}:</td>
 	<td class='base' width='20%'><input type='checkbox' name='LOW_DOWNLOAD_PRIORITY' $checked{'LOW_DOWNLOAD_PRIORITY'}{'on'} /></td>
-	<td class='base' width='25%'>$Lang::tr{'updxlrtr max download rate'}: <img src='/blob.gif' alt='*' </td>
+	<td class='base' width='25%'>$Lang::tr{'updxlrtr max download rate'}:</td>
 	<td class='base' width='30%'><input type='text' name='MAX_DOWNLOAD_RATE' value='$xlratorsettings{'MAX_DOWNLOAD_RATE'}' size='5' /></td>
 </tr>
 </table>
diff --git a/html/cgi-bin/urlfilter.cgi b/html/cgi-bin/urlfilter.cgi
index 1e50de9287..c3c327eec2 100644
--- a/html/cgi-bin/urlfilter.cgi
+++ b/html/cgi-bin/urlfilter.cgi
@@ -1214,8 +1214,8 @@ print <<END
         <td> </td>
 </tr>
 <tr>
-	<td colspan='2'>$Lang::tr{'urlfilter blocked domains'} <img src='/blob.gif' alt='*' /></td>
-	<td colspan='2'>$Lang::tr{'urlfilter blocked urls'} <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2'>$Lang::tr{'urlfilter blocked domains'}</td>
+	<td colspan='2'>$Lang::tr{'urlfilter blocked urls'}</td>
 </tr>
 <tr>
 	<td colspan='2'>$Lang::tr{'urlfilter example'}</td>
@@ -1257,8 +1257,8 @@ print <<END
         <td> </td>
 </tr>
 <tr>
-	<td colspan='2'>$Lang::tr{'urlfilter allowed domains'} <img src='/blob.gif' alt='*' /></td>
-	<td colspan='2'>$Lang::tr{'urlfilter allowed urls'} <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2'>$Lang::tr{'urlfilter allowed domains'}</td>
+	<td colspan='2'>$Lang::tr{'urlfilter allowed urls'}</td>
 </tr>
 <tr>
 	<td colspan='2'>$Lang::tr{'urlfilter example'}</td>
@@ -1297,7 +1297,7 @@ print <<END
         <td colspan='4'><b>$Lang::tr{'urlfilter custom expression list'}</b></td>
 </tr>
 <tr>
-	<td colspan='4'>$Lang::tr{'urlfilter blocked expressions'} <img src='/blob.gif' alt='*' /></td>
+	<td colspan='4'>$Lang::tr{'urlfilter blocked expressions'}</td>
 </tr>
 <tr>
 	<td colspan='4'><textarea name='CUSTOM_EXPRESSIONS' cols='70' rows='3' wrap='off'>
@@ -1360,8 +1360,8 @@ print <<END
         <td> </td>
 </tr>
 <tr>
-	<td colspan='2'>$Lang::tr{'urlfilter unfiltered clients'} <img src='/blob.gif' alt='*' /></td>
-	<td colspan='2'>$Lang::tr{'urlfilter banned clients'} <img src='/blob.gif' alt='*' /></td>
+	<td colspan='2'>$Lang::tr{'urlfilter unfiltered clients'}</td>
+	<td colspan='2'>$Lang::tr{'urlfilter banned clients'}</td>
 </tr>
 <tr>
 	<td colspan='2' width='50%'><textarea name='UNFILTERED_CLIENTS' cols='32' rows='6' wrap='off'>
@@ -1440,25 +1440,25 @@ print <<END
 <tr>
 	<td width='25%' class='base'>$Lang::tr{'urlfilter show category'}:</td>
 	<td width='12%'><input type='checkbox' name='SHOW_CATEGORY' $checked{'SHOW_CATEGORY'}{'on'} /></td>
-	<td width='25%' class='base'>$Lang::tr{'urlfilter redirectpage'}: <img src='/blob.gif' alt='*' /></td>
+	<td width='25%' class='base'>$Lang::tr{'urlfilter redirectpage'}:</td>
 	<td><input type='text' name='REDIRECT_PAGE' value='$filtersettings{'REDIRECT_PAGE'}' size='40' /></td>
 </tr>
 <tr>
 	<td class='base'>$Lang::tr{'urlfilter show url'}:</td>
 	<td><input type='checkbox' name='SHOW_URL' $checked{'SHOW_URL'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'urlfilter msg text 1'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'urlfilter msg text 1'}:</td>
 	<td><input type='text' name='MSG_TEXT_1' value='$filtersettings{'MSG_TEXT_1'}' size='40' /></td>
 </tr>
 <tr>
 	<td class='base'>$Lang::tr{'urlfilter show ip'}:</td>
 	<td><input type='checkbox' name='SHOW_IP' $checked{'SHOW_IP'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'urlfilter msg text 2'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'urlfilter msg text 2'}:</td>
 	<td><input type='text' name='MSG_TEXT_2' value='$filtersettings{'MSG_TEXT_2'}' size='40' /></td>
 </tr>
 <tr>
 	<td class='base'>$Lang::tr{'urlfilter show dnserror'}:</td>
 	<td><input type='checkbox' name='ENABLE_DNSERROR' $checked{'ENABLE_DNSERROR'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'urlfilter msg text 3'}: <img src='/blob.gif' alt='*' /></td>
+	<td class='base'>$Lang::tr{'urlfilter msg text 3'}:</td>
 	<td><input type='text' name='MSG_TEXT_3' value='$filtersettings{'MSG_TEXT_3'}' size='40' /></td>
 </tr>
 </table>
@@ -1499,12 +1499,8 @@ print <<END
 <hr size='1'>
 <table width='100%'>
 <tr>
-	<td>
-	<img src='/blob.gif' align='top' alt='*' /> 
-	<font class='base'>$Lang::tr{'this field may be blank'}</font>
-	</td>
-	<td align='right'> 
-	</td>
+	<td><img src='/blob.gif' align='top' alt='*' /> <font class='base'>$Lang::tr{'required field'}</font></td>
+	<td align='right'> </td>
 </tr>
 </table>
 <table width='100%'>
@@ -1880,9 +1876,9 @@ print <<END
 
 <table width='100%'>
 	<tr>
-		<td width='5%'>$Lang::tr{'urlfilter source'}</td>
+		<td width='5%'>$Lang::tr{'urlfilter source'} <img src='/blob.gif' alt='*' /></td>
 		<td width='1%'>  </td>
-		<td width='5%'>$Lang::tr{'urlfilter dst'} <img src='/blob.gif' alt='*'><img src='/blob.gif' alt='*'></td>
+		<td width='5%'>$Lang::tr{'urlfilter dst'} <img src='/blob.gif' alt='*' /></td>
 		<td width='1%'>  </td>
 		<td width='5%'>$Lang::tr{'urlfilter access'}</td>
 		<td> </td>
@@ -1943,7 +1939,7 @@ print <<END
 		<td> </td>
 	</tr>
 	<tr>
-		<td>$Lang::tr{'remark'} <img src='/blob.gif' alt='*'></td>
+		<td>$Lang::tr{'remark'}</td>
 		<td> </td>
 		<td> </td>
 		<td> </td>
@@ -1982,10 +1978,10 @@ print <<END
 <table width='100%'>
 	<tr>
 		<td width='1%' align='right'> <img src='/blob.gif' align='top' alt='*' /> </td>
-		<td><font class='base'>$Lang::tr{'this field may be blank'}</font></td>
+		<td><font class='base'>$Lang::tr{'required field'}</font></td>
 	</tr>
 	<tr>
-		<td width='1%' align='right'><img src='/blob.gif' align='top' alt='*' /><img src='/blob.gif' align='top' alt='*' /> </td>
+		<td width='1%' align='right'> </td>
 		<td><font class='base'>$Lang::tr{'urlfilter select multi'}</font></td>
 	</tr>
 </table>
@@ -2168,7 +2164,7 @@ print <<END
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
 </tr>
 <tr>
-        <td class='base'>$Lang::tr{'urlfilter user time quota'}:</td>
+        <td class='base'>$Lang::tr{'urlfilter user time quota'}: <img src='/blob.gif' alt='*' /></td>
         <td><input type='text' name='TIME_QUOTA' value='$uqsettings{'TIME_QUOTA'}' size='5' /></td>
 	<td colspan='2' rowspan= '5' valign='top' class='base'>
 		<table cellpadding='0' cellspacing='0'>
@@ -2176,7 +2172,7 @@ print <<END
 				<!-- intentionally left empty -->
 			</tr>
 			<tr>
-			<td>$Lang::tr{'urlfilter assigned quota users'}:</td>
+			<td>$Lang::tr{'urlfilter assigned quota users'}: <img src='/blob.gif' alt='*' /></td>
 			</tr>
 			<tr>
 				<!-- intentionally left empty -->
@@ -2374,7 +2370,7 @@ print <<END
        	<td class='base'><b>$Lang::tr{'urlfilter blacklist name'}</b></td>
 </tr>
 <tr>
-       	<td class='base'>$Lang::tr{'urlfilter blacklist category name'}:</td>
+       	<td class='base'>$Lang::tr{'urlfilter blacklist category name'}: <img src='/blob.gif' alt='*' /></td>
 	<td><input type='text' name='BE_NAME' value='$besettings{'BE_NAME'}' size='12' /></td>
 </tr>
 </table>
@@ -2384,7 +2380,7 @@ print <<END
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='20%'></td>
 </tr>
 <tr>
-       	<td class='base' colspan='4'><b>$Lang::tr{'urlfilter edit domains urls expressions'}</b></td>
+       	<td class='base' colspan='4'><b>$Lang::tr{'urlfilter edit domains urls expressions'}</b> <img src='/blob.gif' alt='*' /></td>
 </tr>
 <tr>
 	<td colspan='2'>$Lang::tr{'urlfilter domains'}</td>
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index a6d7056191..f1cffb8844 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -40,8 +40,7 @@ undef (@dummy);
 ###
 ### Initialize variables
 ###
-my $sleepDelay = 4;	# after a call to ipsecctrl S or R, wait this delay (seconds) before reading status
-			# (let the ipsec do its job)
+my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status (let the ipsec do its job)
 my %netsettings=();
 our %cgiparams=();
 our %vpnsettings=();
@@ -108,6 +107,7 @@ $cgiparams{'ROOTCERT_STATE'} = '';
 $cgiparams{'RW_NET'} = '';
 $cgiparams{'DPD_DELAY'} = '30';
 $cgiparams{'DPD_TIMEOUT'} = '120';
+$cgiparams{'FORCE_MOBIKE'} = 'off';
 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 
 ###
@@ -131,323 +131,300 @@ sub valid_dns_host {
 ### Just return true is one interface is vpn enabled
 ###
 sub vpnenabled {
-    return ($vpnsettings{'ENABLED'} eq 'on');
+	return ($vpnsettings{'ENABLED'} eq 'on');
 }
 ###
-### old version: maintain serial number to one, without explication. 
-### this	     : let the counter go, so that each cert is numbered.
+### old version: maintain serial number to one, without explication.
+### this: let the counter go, so that each cert is numbered.
 ###
-sub cleanssldatabase
-{
-    if (open(FILE, ">${General::swroot}/certs/serial")) {
-	print FILE "01";
-	close FILE;
-    }
-    if (open(FILE, ">${General::swroot}/certs/index.txt")) {
-	print FILE "";
-	close FILE;
-    }
-    unlink ("${General::swroot}/certs/index.txt.old");
-    unlink ("${General::swroot}/certs/serial.old");
-    unlink ("${General::swroot}/certs/01.pem");
+sub cleanssldatabase {
+	if (open(FILE, ">${General::swroot}/certs/serial")) {
+		print FILE "01";
+		close FILE;
+	}
+	if (open(FILE, ">${General::swroot}/certs/index.txt")) {
+		print FILE "";
+		close FILE;
+	}
+	unlink ("${General::swroot}/certs/index.txt.old");
+	unlink ("${General::swroot}/certs/serial.old");
+	unlink ("${General::swroot}/certs/01.pem");
 }
-sub newcleanssldatabase
-{
-    if (! -s "${General::swroot}/certs/serial" )  {
-        open(FILE, ">${General::swroot}/certs/serial");
-	print FILE "01";
-	close FILE;
-    }
-    if (! -s ">${General::swroot}/certs/index.txt") {
-	system ("touch ${General::swroot}/certs/index.txt");
-    }
-    unlink ("${General::swroot}/certs/index.txt.old");
-    unlink ("${General::swroot}/certs/serial.old");
-#   unlink ("${General::swroot}/certs/01.pem");		numbering evolves. Wrong place to delete
+sub newcleanssldatabase {
+	if (! -s "${General::swroot}/certs/serial" ) {
+		open(FILE, ">${General::swroot}/certs/serial");
+		print FILE "01";
+		close FILE;
+	}
+	if (! -s ">${General::swroot}/certs/index.txt") {
+		system ("touch ${General::swroot}/certs/index.txt");
+	}
+	unlink ("${General::swroot}/certs/index.txt.old");
+	unlink ("${General::swroot}/certs/serial.old");
+#	unlink ("${General::swroot}/certs/01.pem");		numbering evolves. Wrong place to delete
 }
 
 ###
 ### Call openssl and return errormessage if any
 ###
 sub callssl ($) {
-    my $opt = shift;
-    my $retssl =  `/usr/bin/openssl $opt 2>&1`;	#redirect stderr
-    my $ret = '';
-    foreach my $line (split (/\n/, $retssl)) {
-	&General::log("ipsec", "$line") if (0);		# 1 for verbose logging
-	$ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
-    }
-    if ($ret) {
-        $ret= &Header::cleanhtml($ret);
-    }
-    return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ;
+	my $opt = shift;
+	my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr
+	my $ret = '';
+	foreach my $line (split (/\n/, $retssl)) {
+		&General::log("ipsec", "$line") if (0); # 1 for verbose logging
+		$ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
+	}
+	if ($ret) {
+		$ret= &Header::cleanhtml($ret);
+	}
+	return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ;
 }
 ###
 ### Obtain a CN from given cert
 ###
 sub getCNfromcert ($) {
-    #&General::log("ipsec", "Extracting name from $_[0]...");
-    my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
-    $temp =~ /Subject:.*CN=(.*)[\n]/;
-    $temp = $1;
-    $temp =~ s+/Email+, E+;
-    $temp =~ s/ ST=/ S=/;
-    $temp =~ s/,//g;
-    $temp =~ s/\'//g;
-    return $temp;
+	#&General::log("ipsec", "Extracting name from $_[0]...");
+	my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
+	$temp =~ /Subject:.*CN=(.*)[\n]/;
+	$temp = $1;
+	$temp =~ s+/Email+, E+;
+	$temp =~ s/ ST=/ S=/;
+	$temp =~ s/,//g;
+	$temp =~ s/\'//g;
+	return $temp;
 }
 ###
 ### Obtain Subject from given cert
 ###
 sub getsubjectfromcert ($) {
-    #&General::log("ipsec", "Extracting subject from $_[0]...");
-    my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
-    $temp =~ /Subject: (.*)[\n]/;
-    $temp = $1;
-    $temp =~ s+/Email+, E+;
-    $temp =~ s/ ST=/ S=/;
-    return $temp;
+	#&General::log("ipsec", "Extracting subject from $_[0]...");
+	my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
+	$temp =~ /Subject: (.*)[\n]/;
+	$temp = $1;
+	$temp =~ s+/Email+, E+;
+	$temp =~ s/ ST=/ S=/;
+	return $temp;
 }
 ###
-### Combine local subnet and connection name to make a unique name for each connection section 
+### Combine local subnet and connection name to make a unique name for each connection section
 ### (this sub is not used now)
 ###
 sub makeconnname ($) {
-    my $conn = shift;
-    my $subnet = shift;
-
-    $subnet =~ /^(.*?)\/(.*?)$/;	# $1=IP $2=mask
-    my $ip = unpack('N', &Socket::inet_aton($1));
-    if (length ($2) > 2) {
-	my $mm =  unpack('N', &Socket::inet_aton($2));
-	while ( ($mm & 1)==0 ) {
-	    $ip >>= 1; 
-	    $mm >>= 1;
-	};
-    } else {
-	$ip >>=  (32 - $2);
-    }
-    return sprintf ("%s-%X", $conn, $ip);
+	my $conn = shift;
+	my $subnet = shift;
+
+	$subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask
+	my $ip = unpack('N', &Socket::inet_aton($1));
+	if (length ($2) > 2) {
+		my $mm = unpack('N', &Socket::inet_aton($2));
+		while ( ($mm & 1)==0 ) {
+			$ip >>= 1;
+			$mm >>= 1;
+		};
+	} else {
+		$ip >>= (32 - $2);
+	}
+	return sprintf ("%s-%X", $conn, $ip);
 }
 ###
 ### Write a config file.
 ###
 ###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and
 ###		the side is always defined as 'left'.
-###		configihash[14]: 'VHOST' is allowed
 ###
 
 sub writeipsecfiles {
-    my %lconfighash = ();
-    my %lvpnsettings = ();
-    &General::readhasharray("${General::swroot}/vpn/config", \%lconfighash);
-    &General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings);
-
-    open(CONF,    ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!";
-    open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!";
-    flock CONF, 2;
-    flock SECRETS, 2;
-    print CONF "version 2\n\n";
-    print CONF "conn %default\n";
-    print CONF "\tkeyingtries=%forever\n";
-    print CONF "\n";
-
-    # Add user includes to config file
-    print CONF "include /etc/ipsec.user.conf\n";
-    print CONF "\n";
-
-    print SECRETS "include /etc/ipsec.user.secrets\n";
-
-    if (-f "${General::swroot}/certs/hostkey.pem") {
-        print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
-    }
-    my $last_secrets = ''; # old the less specifics connections
-    
-    foreach my $key (keys %lconfighash) {
-	next if ($lconfighash{$key}[0] ne 'on');
-
-	#remote peer is not set? => use '%any'
-	$lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq '');
-
-	my $localside;
-	if ($lconfighash{$key}[26] eq 'BLUE') {
-		$localside = $netsettings{'BLUE_ADDRESS'};
-	} elsif ($lconfighash{$key}[26] eq 'GREEN') {
-		$localside = $netsettings{'GREEN_ADDRESS'};
-	} elsif ($lconfighash{$key}[26] eq 'ORANGE') {
-		$localside = $netsettings{'ORANGE_ADDRESS'};
-	} else {	# it is RED
-		$localside = $lvpnsettings{'VPN_IP'};
-	}
-
-	print CONF "conn $lconfighash{$key}[1]\n";
-	print CONF "\tleft=$localside\n";
-	my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
-	print CONF "\tleftsubnet=$cidr_net\n";
-	print CONF "\tleftfirewall=yes\n";
-	print CONF "\tlefthostaccess=yes\n";
-
-	print CONF "\tright=$lconfighash{$key}[10]\n";
-	if ($lconfighash{$key}[3] eq 'net') {
-	    my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
-	    print CONF "\trightsubnet=$cidr_net\n";
-	} elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
-	    print CONF "\trightsubnet=vhost:%no,%priv\n";
-	}
-
-	# Local Cert and Remote Cert (unless auth is DN dn-auth)
-	if ($lconfighash{$key}[4] eq 'cert') {
-	    print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n";
-	    print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn');
-	}
-
-	# Local and Remote IDs
-	print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]);
-	print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]);
-
-	# Is PFS enabled?
-	my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
-
-	# Algorithms
-	if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
-	    print CONF "\tike=";
-	    my @encs   = split('\|', $lconfighash{$key}[18]);
-	    my @ints   = split('\|', $lconfighash{$key}[19]);
-	    my @groups = split('\|', $lconfighash{$key}[20]);
-	    my $comma = 0;
-	    foreach my $i (@encs) {
-	        foreach my $j (@ints) {
-	    	    foreach my $k (@groups) {
-		        if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-
-		        my @l = split("", $k);
-		        if ($l[0] eq "e") {
-		            shift @l;
-		            print CONF "$i-$j-ecp".join("", @l);
-		        } else {
-		            print CONF "$i-$j-modp$k";
-		        }
-		    }
-	        }
-	    }
-	    if ($lconfighash{$key}[24] eq 'on') {	#only proposed algorythms?
-		print CONF "!\n";
-	    } else {
-	        print CONF "\n";
-	    }
-	}
-	if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
-	    print CONF "\tesp=";
-	    my @encs   = split('\|', $lconfighash{$key}[21]);
-	    my @ints   = split('\|', $lconfighash{$key}[22]);
-	    my @groups = split('\|', $lconfighash{$key}[20]);
-	    my $comma = 0;
-	    foreach my $i (@encs) {
-		foreach my $j (@ints) {
-			my $modp = "";
-			if ($pfs eq "on") {
-				foreach my $k (@groups) {
-				    if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-				    if ($pfs eq "on") {
-					my @l = split("", $k);
-					if ($l[0] eq "e") {
-						$modp = "";
-					} else {
-						$modp = "-modp$k";
-					}
-				    } else {
-				        $modp = "";
-				    }
-				    print CONF "$i-$j$modp";
-				}
-			} else {
-				if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-				print CONF "$i-$j";
-			}
-		}
-	    }
-	    if ($lconfighash{$key}[24] eq 'on') {	#only proposed algorythms?
-		print CONF "!\n";
-	    } else {
+	my %lconfighash = ();
+	my %lvpnsettings = ();
+	&General::readhasharray("${General::swroot}/vpn/config", \%lconfighash);
+	&General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings);
+
+	open(CONF, ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!";
+	open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!";
+	flock CONF, 2;
+	flock SECRETS, 2;
+	print CONF "version 2\n\n";
+	print CONF "conn %default\n";
+	print CONF "\tkeyingtries=%forever\n";
+	print CONF "\n";
+
+	# Add user includes to config file
+	if (-e "/etc/ipsec.user.conf") {
+		print CONF "include /etc/ipsec.user.conf\n";
 		print CONF "\n";
-	    }
 	}
 
-	# IKE V1 or V2
-	if (! $lconfighash{$key}[29]) {
-	   $lconfighash{$key}[29] = "ikev1";
+	print SECRETS "include /etc/ipsec.user.secrets\n";
+
+	if (-f "${General::swroot}/certs/hostkey.pem") {
+		print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
 	}
-	print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
+	my $last_secrets = ''; # old the less specifics connections
+
+	foreach my $key (keys %lconfighash) {
+		next if ($lconfighash{$key}[0] ne 'on');
 
-	# Lifetimes
-	print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
-	print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
+		#remote peer is not set? => use '%any'
+		$lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq '');
 
-	# Compression
-	print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
+		my $localside;
+		if ($lconfighash{$key}[26] eq 'BLUE') {
+			$localside = $netsettings{'BLUE_ADDRESS'};
+		} elsif ($lconfighash{$key}[26] eq 'GREEN') {
+			$localside = $netsettings{'GREEN_ADDRESS'};
+		} elsif ($lconfighash{$key}[26] eq 'ORANGE') {
+			$localside = $netsettings{'ORANGE_ADDRESS'};
+		} else { # it is RED
+			$localside = $lvpnsettings{'VPN_IP'};
+		}
 
-	# Dead Peer Detection
-	my $dpdaction = $lconfighash{$key}[27];
-	print CONF "\tdpdaction=$dpdaction\n";
+		print CONF "conn $lconfighash{$key}[1]\n";
+		print CONF "\tleft=$localside\n";
+		print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+		print CONF "\tleftfirewall=yes\n";
+		print CONF "\tlefthostaccess=yes\n";
+		print CONF "\tright=$lconfighash{$key}[10]\n";
 
-	# If the dead peer detection is disabled and IKEv2 is used,
-	# dpddelay must be set to zero, too.
-	if ($dpdaction eq "none") {
-		if ($lconfighash{$key}[29] eq "ikev2") {
-			print CONF "\tdpddelay=0\n";
+		if ($lconfighash{$key}[3] eq 'net') {
+			print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
 		}
-	} else {
-		my $dpddelay = $lconfighash{$key}[30];
-		if (!$dpddelay) {
-			$dpddelay = 30;
-		}
-		print CONF "\tdpddelay=$dpddelay\n";
-		my $dpdtimeout = $lconfighash{$key}[31];
-		if (!$dpdtimeout) {
-			$dpdtimeout = 120;
-		}
-		print CONF "\tdpdtimeout=$dpdtimeout\n";
-	}
-
-	# Build Authentication details:  LEFTid RIGHTid : PSK psk
-	my $psk_line;
-	if ($lconfighash{$key}[4] eq 'psk') {
-	    $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ;
-	    $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10];  #remoteid or remote address?
-	    $psk_line .= " : PSK '$lconfighash{$key}[5]'\n";
-	    # if the line contains %any, it is less specific than two IP or ID, so move it at end of file.
-	    if ($psk_line =~ /%any/) {
-	        $last_secrets .= $psk_line;
-	    } else {
-	        print SECRETS $psk_line;
-	    }
-	    print CONF "\tauthby=secret\n";
-	} else {
-	    print CONF "\tauthby=rsasig\n";
-	    print CONF "\tleftrsasigkey=%cert\n";
-	    print CONF "\trightrsasigkey=%cert\n";
-	}
 
-	# Automatically start only if a net-to-net connection
-	if ($lconfighash{$key}[3] eq 'host') {
-	    print CONF "\tauto=add\n";
-	    print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
-	} else {
-	    print CONF "\tauto=start\n";
+		# Local Cert and Remote Cert (unless auth is DN dn-auth)
+		if ($lconfighash{$key}[4] eq 'cert') {
+			print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n";
+			print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn');
+		}
+
+		# Local and Remote IDs
+		print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]);
+		print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]);
+
+		# Is PFS enabled?
+		my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
+
+		# Algorithms
+		if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
+			my @encs	= split('\|', $lconfighash{$key}[18]);
+			my @ints	= split('\|', $lconfighash{$key}[19]);
+			my @groups	= split('\|', $lconfighash{$key}[20]);
+
+			my @algos = &make_algos("ike", \@encs, \@ints, \@groups, 1);
+			print CONF "\tike=" . join(",", @algos);
+
+			if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
+				print CONF "!\n";
+			} else {
+				print CONF "\n";
+			}
+		}
+
+		if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
+			my @encs	= split('\|', $lconfighash{$key}[21]);
+			my @ints	= split('\|', $lconfighash{$key}[22]);
+			my @groups	= split('\|', $lconfighash{$key}[23]);
+
+			# Use IKE grouptype if no ESP group type has been selected
+			# (for backwards compatibility)
+			if ($lconfighash{$key}[23] eq "") {
+				@groups = split('\|', $lconfighash{$key}[20]);
+			}
+
+			my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on"));
+			print CONF "\tesp=" . join(",", @algos);
+
+			if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
+				print CONF "!\n";
+			} else {
+				print CONF "\n";
+			}
+		}
+
+		# IKE V1 or V2
+		if (! $lconfighash{$key}[29]) {
+			$lconfighash{$key}[29] = "ikev1";
+		}
+
+		print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
+
+		# Lifetimes
+		print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
+		print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
+
+		# Compression
+		print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
+
+		# Force MOBIKE?
+		if (($lconfighash{$key}[29] eq "ikev2") && ($lconfighash{$key}[32] eq 'on')) {
+			print CONF "\tmobike=yes\n";
+		}
+
+		# Dead Peer Detection
+		my $dpdaction = $lconfighash{$key}[27];
+		print CONF "\tdpdaction=$dpdaction\n";
+
+		# If the dead peer detection is disabled and IKEv2 is used,
+		# dpddelay must be set to zero, too.
+		if ($dpdaction eq "none") {
+			if ($lconfighash{$key}[29] eq "ikev2") {
+				print CONF "\tdpddelay=0\n";
+			}
+		} else {
+			my $dpddelay = $lconfighash{$key}[31];
+			if (!$dpddelay) {
+				$dpddelay = 30;
+			}
+			print CONF "\tdpddelay=$dpddelay\n";
+			my $dpdtimeout = $lconfighash{$key}[30];
+			if (!$dpdtimeout) {
+				$dpdtimeout = 120;
+			}
+			print CONF "\tdpdtimeout=$dpdtimeout\n";
+		}
+
+		# Build Authentication details: LEFTid RIGHTid : PSK psk
+		my $psk_line;
+		if ($lconfighash{$key}[4] eq 'psk') {
+			$psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ;
+			$psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address?
+			$psk_line .= " : PSK '$lconfighash{$key}[5]'\n";
+			# if the line contains %any, it is less specific than two IP or ID, so move it at end of file.
+			if ($psk_line =~ /%any/) {
+				$last_secrets .= $psk_line;
+			} else {
+				print SECRETS $psk_line;
+			}
+			print CONF "\tauthby=secret\n";
+		} else {
+			print CONF "\tauthby=rsasig\n";
+			print CONF "\tleftrsasigkey=%cert\n";
+			print CONF "\trightrsasigkey=%cert\n";
+		}
+
+		# Automatically start only if a net-to-net connection
+		if ($lconfighash{$key}[3] eq 'host') {
+			print CONF "\tauto=add\n";
+			print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
+		} else {
+			print CONF "\tauto=start\n";
+		}
+
+		# Fragmentation
+		print CONF "\tfragmentation=yes\n";
+
+		print CONF "\n";
+	} #foreach key
+
+	# Add post user includes to config file
+	# After the GUI-connections allows to patch connections.
+	if (-e "/etc/ipsec.user-post.conf") {
+		print CONF "include /etc/ipsec.user-post.conf\n";
+		print CONF "\n";
 	}
-	print CONF "\n";
-    }#foreach key
-
-    # Add post user includes to config file
-    # After the GUI-connections allows to patch connections.
-    if (-e "/etc/ipsec.user-post.conf") {
-        print CONF "include /etc/ipsec.user-post.conf\n";
-        print CONF "\n";
-    }
-
-    print SECRETS $last_secrets if ($last_secrets);
-    close(CONF);
-    close(SECRETS);
+
+	print SECRETS $last_secrets if ($last_secrets);
+	close(CONF);
+	close(SECRETS);
 }
 
 # Hook to regenerate the configuration files.
@@ -460,779 +437,779 @@ if ($ENV{"REMOTE_ADDR"} eq "") {
 ### Save main settings
 ###
 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
-	    || $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
-	$errormessage = $Lang::tr{'invalid input for hostname'};
-	goto SAVE_ERROR;
-    }
-
-    unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds !
-	$errormessage = $Lang::tr{'invalid time period'};
-	goto SAVE_ERROR;
-    }
-
-    if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) {
-	$errormessage = $Lang::tr{'urlfilter invalid ip or mask error'};
-	goto SAVE_ERROR;
-    }
-
-    $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
-    $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
-    $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
-    $vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'};
-    &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &writeipsecfiles();
-    if (&vpnenabled) {
-	system('/usr/local/bin/ipsecctrl', 'S');
-    } else {
-	system('/usr/local/bin/ipsecctrl', 'D');
-    }
-    sleep $sleepDelay;
-    SAVE_ERROR:
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+
+	unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
+	|| $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
+		$errormessage = $Lang::tr{'invalid input for hostname'};
+		goto SAVE_ERROR;
+	}
+
+	unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds !
+		$errormessage = $Lang::tr{'invalid time period'};
+		goto SAVE_ERROR;
+	}
+
+	if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) {
+		$errormessage = $Lang::tr{'urlfilter invalid ip or mask error'};
+		goto SAVE_ERROR;
+	}
+
+	$vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
+	$vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
+	$vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
+	$vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'};
+	&General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&writeipsecfiles();
+	if (&vpnenabled) {
+		system('/usr/local/bin/ipsecctrl', 'S');
+	} else {
+		system('/usr/local/bin/ipsecctrl', 'D');
+	}
+	sleep $sleepDelay;
+	SAVE_ERROR:
 ###
 ### Reset all step 2
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-
-    foreach my $key (keys %confighash) {
-	if ($confighash{$key}[4] eq 'cert') {
-	    delete $confighash{$key};
-	}
-    }
-    while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) {
-	unlink $file
-    }
-    &cleanssldatabase();
-    if (open(FILE, ">${General::swroot}/vpn/caconfig")) {
-        print FILE "";
-        close FILE;
-    }
-    &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-    &writeipsecfiles();
-    system('/usr/local/bin/ipsecctrl', 'R');
-    sleep $sleepDelay;
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+
+	foreach my $key (keys %confighash) {
+		if ($confighash{$key}[4] eq 'cert') {
+			delete $confighash{$key};
+		}
+	}
+	while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) {
+		unlink $file
+	}
+	&cleanssldatabase();
+	if (open(FILE, ">${General::swroot}/vpn/caconfig")) {
+		print FILE "";
+		close FILE;
+	}
+	&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+	&writeipsecfiles();
+	system('/usr/local/bin/ipsecctrl', 'R');
+	sleep $sleepDelay;
 
 ###
 ### Reset all step 1
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', '');
-    &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
-    print <<END
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', '');
+	&Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
+	print <<END
 	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	<table width='100%'>
-	    <tr>
-		<td align='center'>
-		<input type='hidden' name='AREUSURE' value='yes' />
-		<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
-		$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
-	    </tr><tr>
-		<td align='center'>
-		<input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
+		<table width='100%'>
+			<tr>
+				<td align='center'>
+					<input type='hidden' name='AREUSURE' value='yes' />
+					<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
+				</td>
+			</tr><tr>
+				<td align='center'>
+					<input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
 		<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
-	    </tr>
-	</table>
+			</tr>
+		</table>
 	</form>
 END
-    ;
-    &Header::closebox();
-    &Header::closebigbox();
-    &Header::closepage();
-    exit (0);
+;
+	&Header::closebox();
+	&Header::closebigbox();
+	&Header::closepage();
+	exit (0);
 
 ###
 ### Upload CA Certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
-	$errormessage = $Lang::tr{'name must only contain characters'};
-	goto UPLOADCA_ERROR;
-    }
-
-    if (length($cgiparams{'CA_NAME'}) >60) {
-	$errormessage = $Lang::tr{'name too long'};
-	goto VPNCONF_ERROR;
-    }
-
-    if ($cgiparams{'CA_NAME'} eq 'ca') {
-	$errormessage = $Lang::tr{'name is invalid'};
-	goto UPLOAD_CA_ERROR;
-    }
-
-    # Check if there is no other entry with this name
-    foreach my $key (keys %cahash) {
-	if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
-	    $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
-	    goto UPLOADCA_ERROR;
-	}
-    }
-
-    if (ref ($cgiparams{'FH'}) ne 'Fh') {
-	$errormessage = $Lang::tr{'there was no file upload'};
-	goto UPLOADCA_ERROR;
-    }
-    # Move uploaded ca to a temporary file
-    (my $fh, my $filename) = tempfile( );
-    if (copy ($cgiparams{'FH'}, $fh) != 1) {
-	$errormessage = $!;
-	goto UPLOADCA_ERROR;
-    }
-    my $temp = `/usr/bin/openssl x509 -text -in $filename`;
-    if ($temp !~ /CA:TRUE/i) {
-	$errormessage = $Lang::tr{'not a valid ca certificate'};
-	unlink ($filename);
-	goto UPLOADCA_ERROR;
-    } else {
-	move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
-	if ($? ne 0) {
-	    $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
-	    unlink ($filename);
-	    goto UPLOADCA_ERROR;
-	}
-    }
-
-    my $key = &General::findhasharraykey (\%cahash);
-    $cahash{$key}[0] = $cgiparams{'CA_NAME'};
-    $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
-    &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    system('/usr/local/bin/ipsecctrl', 'R');
-    sleep $sleepDelay;
-
-    UPLOADCA_ERROR:
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
+		$errormessage = $Lang::tr{'name must only contain characters'};
+		goto UPLOADCA_ERROR;
+	}
+
+	if (length($cgiparams{'CA_NAME'}) >60) {
+		$errormessage = $Lang::tr{'name too long'};
+		goto VPNCONF_ERROR;
+	}
+
+	if ($cgiparams{'CA_NAME'} eq 'ca') {
+		$errormessage = $Lang::tr{'name is invalid'};
+		goto UPLOAD_CA_ERROR;
+	}
+
+	# Check if there is no other entry with this name
+	foreach my $key (keys %cahash) {
+		if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
+			$errormessage = $Lang::tr{'a ca certificate with this name already exists'};
+			goto UPLOADCA_ERROR;
+		}
+	}
+
+	if (ref ($cgiparams{'FH'}) ne 'Fh') {
+		$errormessage = $Lang::tr{'there was no file upload'};
+		goto UPLOADCA_ERROR;
+	}
+	# Move uploaded ca to a temporary file
+	(my $fh, my $filename) = tempfile( );
+	if (copy ($cgiparams{'FH'}, $fh) != 1) {
+		$errormessage = $!;
+		goto UPLOADCA_ERROR;
+	}
+	my $temp = `/usr/bin/openssl x509 -text -in $filename`;
+	if ($temp !~ /CA:TRUE/i) {
+		$errormessage = $Lang::tr{'not a valid ca certificate'};
+		unlink ($filename);
+		goto UPLOADCA_ERROR;
+	} else {
+		move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
+		if ($? ne 0) {
+			$errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+			unlink ($filename);
+			goto UPLOADCA_ERROR;
+		}
+	}
+
+	my $key = &General::findhasharraykey (\%cahash);
+	$cahash{$key}[0] = $cgiparams{'CA_NAME'};
+	$cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
+	&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	system('/usr/local/bin/ipsecctrl', 'R');
+	sleep $sleepDelay;
+
+	UPLOADCA_ERROR:
 
 ###
 ### Display ca certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
-	&Header::showhttpheaders();
-	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
-	&Header::openbigbox('100%', 'left', '', '');
-	&Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
-	my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
-	$output = &Header::cleanhtml($output,"y");
-	print "<pre>$output</pre>\n";
-	&Header::closebox();
-	print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
-	&Header::closebigbox();
-	&Header::closepage();
-	exit(0);
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
+		&Header::showhttpheaders();
+		&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+		&Header::openbigbox('100%', 'left', '', '');
+		&Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
+		my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
+		$output = &Header::cleanhtml($output,"y");
+		print "<pre>$output</pre>\n";
+		&Header::closebox();
+		print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
+		&Header::closebigbox();
+		&Header::closepage();
+		exit(0);
+	} else {
+		$errormessage = $Lang::tr{'invalid key'};
+	}
 
 ###
 ### Export ca certificate to browser
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
-	print "Content-Type: application/force-download\n";
-	print "Content-Type: application/octet-stream\r\n";
-	print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
-	print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
-	exit(0);
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
+		print "Content-Type: application/force-download\n";
+		print "Content-Type: application/octet-stream\r\n";
+		print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
+		print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
+		exit(0);
+	} else {
+		$errormessage = $Lang::tr{'invalid key'};
+	}
 
 ###
 ### Remove ca certificate (step 2)
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
-	foreach my $key (keys %confighash) {
-	    my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-	    if ($test =~ /: OK/) {
-		# Delete connection
-		system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
-		unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
-		unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
-		delete $confighash{$key};
-		&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-		&writeipsecfiles();
-	    }
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
+		foreach my $key (keys %confighash) {
+			my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
+			if ($test =~ /: OK/) {
+				# Delete connection
+				system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
+				unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
+				unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
+				delete $confighash{$key};
+				&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+				&writeipsecfiles();
+			}
+		}
+		unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+		delete $cahash{$cgiparams{'KEY'}};
+		&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
+		system('/usr/local/bin/ipsecctrl', 'R');
+		sleep $sleepDelay;
+	} else {
+		$errormessage = $Lang::tr{'invalid key'};
 	}
-	unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
-	delete $cahash{$cgiparams{'KEY'}};
-	&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-	system('/usr/local/bin/ipsecctrl', 'R');
-	sleep $sleepDelay;
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
 ###
 ### Remove ca certificate (step 1)
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-
-    my $assignedcerts = 0;
-    if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
-	foreach my $key (keys %confighash) {
-	    my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-	    if ($test =~ /: OK/) {
-		$assignedcerts++;
-	    }
-	}
-	if ($assignedcerts) {
-	    &Header::showhttpheaders();
-	    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-	    &Header::openbigbox('100%', 'left', '', '');
-	    &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
-	    print <<END
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <table width='100%'>
-	        <tr>
-		    <td align='center'>
-		    <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
-		    <input type='hidden' name='AREUSURE' value='yes' /></td>
-		</tr><tr>
-		    <td align='center'>
-		    <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>
-		    $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}</td>
-		</tr><tr>
-		    <td align='center'>
-		    <input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
-		    <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
-		</tr>
-	    </table>
-	    </form>
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
+	my $assignedcerts = 0;
+	if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
+		foreach my $key (keys %confighash) {
+			my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
+			if ($test =~ /: OK/) {
+				$assignedcerts++;
+			}
+		}
+		if ($assignedcerts) {
+			&Header::showhttpheaders();
+			&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+			&Header::openbigbox('100%', 'left', '', '');
+			&Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
+			print <<END
+			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+				<table width='100%'>
+					<tr>
+						<td align='center'>
+							<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
+			<input type='hidden' name='AREUSURE' value='yes' /></td>
+					</tr><tr>
+						<td align='center'>
+							<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b> $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}</td>
+					</tr><tr>
+						<td align='center'>
+							<input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
+			<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
+					</tr>
+				</table>
+			</form>
 END
-	    ;
-	    &Header::closebox();
-	    &Header::closebigbox();
-	    &Header::closepage();
-	    exit (0);
+;
+			&Header::closebox();
+			&Header::closebigbox();
+			&Header::closepage();
+			exit (0);
+		} else {
+			unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+			delete $cahash{$cgiparams{'KEY'}};
+			&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
+			system('/usr/local/bin/ipsecctrl', 'R');
+			sleep $sleepDelay;
+		}
 	} else {
-	    unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
-	    delete $cahash{$cgiparams{'KEY'}};
-	    &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-	    system('/usr/local/bin/ipsecctrl', 'R');
-	    sleep $sleepDelay;
+		$errormessage = $Lang::tr{'invalid key'};
 	}
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
 
 ###
 ### Display root certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
 	$cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
-    my $output;
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', '');
-    if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
-	&Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
-	$output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
-    } else {
-	&Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
-	$output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
-    }
-    $output = &Header::cleanhtml($output,"y");
-    print "<pre>$output</pre>\n";
-    &Header::closebox();
-    print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
-    &Header::closebigbox();
-    &Header::closepage();
-    exit(0);
+	my $output;
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', '');
+	if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
+		&Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
+		$output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
+	} else {
+		&Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
+		$output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
+	}
+	$output = &Header::cleanhtml($output,"y");
+	print "<pre>$output</pre>\n";
+	&Header::closebox();
+	print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
+	&Header::closebigbox();
+	&Header::closepage();
+	exit(0);
 
 ###
 ### Export root certificate to browser
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
-    if ( -f "${General::swroot}/ca/cacert.pem" ) {
-	print "Content-Type: application/force-download\n";
-	print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
-	print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
-	exit(0);
-    }
+	if ( -f "${General::swroot}/ca/cacert.pem" ) {
+		print "Content-Type: application/force-download\n";
+		print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
+		print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
+		exit(0);
+	}
 ###
 ### Export host certificate to browser
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
-    if ( -f "${General::swroot}/certs/hostcert.pem" ) {
-	print "Content-Type: application/force-download\n";
-	print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
-	print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
-	exit(0);
-    }
+	if ( -f "${General::swroot}/certs/hostcert.pem" ) {
+		print "Content-Type: application/force-download\n";
+		print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
+		print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
+		exit(0);
+	}
 ###
 ### Form for generating/importing the caroot+host certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
-	 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
-
-    if (-f "${General::swroot}/ca/cacert.pem") {
-	$errormessage = $Lang::tr{'valid root certificate already exists'};
-	goto ROOTCERT_SKIP;
-    }
-
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    # fill in initial values
-    if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
-	if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
-	    my $ipaddr = <IPADDR>;
-	    close IPADDR;
-	    chomp ($ipaddr);
-	    $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
-	    if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
-		$cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
-	    }
-	}
-	$cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
-    } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
-	&General::log("ipsec", "Importing from p12...");
+	$cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
+
+	if (-f "${General::swroot}/ca/cacert.pem") {
+		$errormessage = $Lang::tr{'valid root certificate already exists'};
+		goto ROOTCERT_SKIP;
+	}
+
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	# fill in initial values
+	if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
+		if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
+			my $ipaddr = <IPADDR>;
+			close IPADDR;
+			chomp ($ipaddr);
+			$cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
+			if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
+				$cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
+			}
+		}
+		$cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
+	} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
+		&General::log("ipsec", "Importing from p12...");
 
-	if (ref ($cgiparams{'FH'}) ne 'Fh') {
-	    $errormessage = $Lang::tr{'there was no file upload'};
-	    goto ROOTCERT_ERROR;
-	}
+		if (ref ($cgiparams{'FH'}) ne 'Fh') {
+			$errormessage = $Lang::tr{'there was no file upload'};
+			goto ROOTCERT_ERROR;
+		}
 
-	# Move uploaded certificate request to a temporary file
-	(my $fh, my $filename) = tempfile( );
-	if (copy ($cgiparams{'FH'}, $fh) != 1) {
-	    $errormessage = $!;
-	    goto ROOTCERT_ERROR;
-	}
+		# Move uploaded certificate request to a temporary file
+		(my $fh, my $filename) = tempfile( );
+		if (copy ($cgiparams{'FH'}, $fh) != 1) {
+			$errormessage = $!;
+			goto ROOTCERT_ERROR;
+		}
 
-	# Extract the CA certificate from the file
-	&General::log("ipsec", "Extracting caroot from p12...");
-	if (open(STDIN, "-|")) {
-    	    my	$opt  = " pkcs12 -cacerts -nokeys";
-		$opt .= " -in $filename";
-		$opt .= " -out /tmp/newcacert";
-	    $errormessage = &callssl ($opt);
-	} else {	#child
-	    print "$cgiparams{'P12_PASS'}\n";
-	    exit (0);
-	}
-
-    	# Extract the Host certificate from the file
-	if (!$errormessage) {
-	    &General::log("ipsec", "Extracting host cert from p12...");
-	    if (open(STDIN, "-|")) {
-    		my  $opt  = " pkcs12 -clcerts -nokeys";
-		    $opt .= " -in $filename";
-		    $opt .= " -out /tmp/newhostcert";
-		$errormessage = &callssl ($opt);
-	    } else {	#child
-		print "$cgiparams{'P12_PASS'}\n";
-		exit (0);
-	    }
-	}
-
-	# Extract the Host key from the file
-	if (!$errormessage) {
-	    &General::log("ipsec", "Extracting private key from p12...");
-	    if (open(STDIN, "-|")) {
-    		my  $opt  = " pkcs12 -nocerts -nodes";
-		    $opt .= " -in $filename";
-		    $opt .= " -out /tmp/newhostkey";
-		$errormessage = &callssl ($opt);
-	    } else {	#child
-		print "$cgiparams{'P12_PASS'}\n";
-		exit (0);
-	    }
-	}
-
-	if (!$errormessage) {
-	    &General::log("ipsec", "Moving cacert...");
-	    move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
-	    $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
-    	}
-
-	if (!$errormessage) {
-	    &General::log("ipsec", "Moving host cert...");
-	    move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
-	    $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
-        }
-
-	if (!$errormessage) {
-	    &General::log("ipsec", "Moving private key...");
-	    move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
-	    $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
-        }
-	
-	#cleanup temp files
-	unlink ($filename);
-	unlink ('/tmp/newcacert');
-	unlink ('/tmp/newhostcert');
-	unlink ('/tmp/newhostkey');
-	if ($errormessage) {
-	    unlink ("${General::swroot}/ca/cacert.pem");
-	    unlink ("${General::swroot}/certs/hostcert.pem");
-	    unlink ("${General::swroot}/certs/hostkey.pem");
-	    goto ROOTCERT_ERROR;
-	}
+		# Extract the CA certificate from the file
+		&General::log("ipsec", "Extracting caroot from p12...");
+		if (open(STDIN, "-|")) {
+			my $opt = " pkcs12 -cacerts -nokeys";
+			$opt .= " -in $filename";
+			$opt .= " -out /tmp/newcacert";
+			$errormessage = &callssl ($opt);
+		} else { #child
+			print "$cgiparams{'P12_PASS'}\n";
+			exit (0);
+		}
 
-	# Create empty CRL cannot be done because we don't have
-	# the private key for this CAROOT
-	# IPFire can only import certificates
+		# Extract the Host certificate from the file
+		if (!$errormessage) {
+			&General::log("ipsec", "Extracting host cert from p12...");
+			if (open(STDIN, "-|")) {
+				my $opt = " pkcs12 -clcerts -nokeys";
+				$opt .= " -in $filename";
+				$opt .= " -out /tmp/newhostcert";
+				$errormessage = &callssl ($opt);
+			} else { #child
+				print "$cgiparams{'P12_PASS'}\n";
+				exit (0);
+			}
+		}
 
-	&General::log("ipsec", "p12 import completed!");
-	&cleanssldatabase();
-	goto ROOTCERT_SUCCESS;
-
-    } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
-
-	# Validate input since the form was submitted
-	if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
-	    $errormessage = $Lang::tr{'organization cant be empty'};
-	    goto ROOTCERT_ERROR;
-	}
-	if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
-	    $errormessage = $Lang::tr{'organization too long'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-	    $errormessage = $Lang::tr{'invalid input for organization'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
-	    $errormessage = $Lang::tr{'hostname cant be empty'};
-	    goto ROOTCERT_ERROR;
-	}
-	unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
-	    $errormessage = $Lang::tr{'invalid input for hostname'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
-	    $errormessage = $Lang::tr{'invalid input for e-mail address'};
-	    goto ROOTCERT_ERROR;
-	}
-	if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
-	    $errormessage = $Lang::tr{'e-mail address too long'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-	    $errormessage = $Lang::tr{'invalid input for department'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-	    $errormessage = $Lang::tr{'invalid input for city'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-	    $errormessage = $Lang::tr{'invalid input for state or province'};
-	    goto ROOTCERT_ERROR;
-	}
-	if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
-	    $errormessage = $Lang::tr{'invalid input for country'};
-	    goto ROOTCERT_ERROR;
-	}
-	#the exact syntax is a list comma separated of 
-	#  email:any-validemail
-	#	URI: a uniform resource indicator
-	#   DNS: a DNS domain name
-	#   RID: a registered OBJECT IDENTIFIER
-	#   IP: an IP address
-	# example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
-
-	if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
-	    $errormessage = $Lang::tr{'vpn altname syntax'};
-	    goto VPNCONF_ERROR;
-	}
-
-	# Copy the cgisettings to vpnsettings and save the configfile
-	$vpnsettings{'ROOTCERT_ORGANIZATION'}	= $cgiparams{'ROOTCERT_ORGANIZATION'};
-	$vpnsettings{'ROOTCERT_HOSTNAME'}	= $cgiparams{'ROOTCERT_HOSTNAME'};
-	$vpnsettings{'ROOTCERT_EMAIL'}	 	= $cgiparams{'ROOTCERT_EMAIL'};
-	$vpnsettings{'ROOTCERT_OU'}		= $cgiparams{'ROOTCERT_OU'};
-	$vpnsettings{'ROOTCERT_CITY'}		= $cgiparams{'ROOTCERT_CITY'};
-	$vpnsettings{'ROOTCERT_STATE'}		= $cgiparams{'ROOTCERT_STATE'};
-	$vpnsettings{'ROOTCERT_COUNTRY'}	= $cgiparams{'ROOTCERT_COUNTRY'};
-	&General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
+		# Extract the Host key from the file
+		if (!$errormessage) {
+			&General::log("ipsec", "Extracting private key from p12...");
+			if (open(STDIN, "-|")) {
+				my $opt = " pkcs12 -nocerts -nodes";
+				$opt .= " -in $filename";
+				$opt .= " -out /tmp/newhostkey";
+				$errormessage = &callssl ($opt);
+			} else { #child
+				print "$cgiparams{'P12_PASS'}\n";
+				exit (0);
+			}
+		}
 
-	# Replace empty strings with a .
-	(my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
-	(my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
-	(my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
-
-	# Create the CA certificate
-	if (!$errormessage) {
-	    &General::log("ipsec", "Creating cacert...");
-	    if (open(STDIN, "-|")) {
-    		my $opt  = " req -x509 -nodes -rand /proc/interrupts:/proc/net/rt_cache";
-		   $opt .= " -days 999999";
-		   $opt .= " -newkey rsa:2048";
-		   $opt .= " -keyout ${General::swroot}/private/cakey.pem";
-		   $opt .= " -out ${General::swroot}/ca/cacert.pem";
-
-		$errormessage = &callssl ($opt);
-	    } else {	#child
-		print  "$cgiparams{'ROOTCERT_COUNTRY'}\n";
-		print  "$state\n";
-		print  "$city\n";
-		print  "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
-	        print  "$ou\n";
-		print  "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
-		print  "$cgiparams{'ROOTCERT_EMAIL'}\n";
-		exit (0);
-	    }
-	}
-
-	# Create the Host certificate request
-	if (!$errormessage) {
-	    &General::log("ipsec", "Creating host cert...");
-	    if (open(STDIN, "-|")) {
-    		my $opt  = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
-		   $opt .= " -newkey rsa:1024";
-		   $opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
-		   $opt .= " -out ${General::swroot}/certs/hostreq.pem";
-		$errormessage = &callssl ($opt);
-	    } else {	#child
-		print  "$cgiparams{'ROOTCERT_COUNTRY'}\n";
-		print  "$state\n";
-		print  "$city\n";
-		print  "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
-	        print  "$ou\n";
-	        print  "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
-	        print  "$cgiparams{'ROOTCERT_EMAIL'}\n";
-	        print  ".\n";
-	        print  ".\n";
-		exit (0);
-	    }
-	}
+		if (!$errormessage) {
+			&General::log("ipsec", "Moving cacert...");
+			move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
+			$errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+		}
+
+		if (!$errormessage) {
+			&General::log("ipsec", "Moving host cert...");
+			move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
+			$errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+		}
+
+		if (!$errormessage) {
+			&General::log("ipsec", "Moving private key...");
+			move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
+			$errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+		}
+
+		#cleanup temp files
+		unlink ($filename);
+		unlink ('/tmp/newcacert');
+		unlink ('/tmp/newhostcert');
+		unlink ('/tmp/newhostkey');
+		if ($errormessage) {
+			unlink ("${General::swroot}/ca/cacert.pem");
+			unlink ("${General::swroot}/certs/hostcert.pem");
+			unlink ("${General::swroot}/certs/hostkey.pem");
+			goto ROOTCERT_ERROR;
+		}
+
+		# Create empty CRL cannot be done because we don't have
+		# the private key for this CAROOT
+		# IPFire can only import certificates
+
+		&General::log("ipsec", "p12 import completed!");
+		&cleanssldatabase();
+		goto ROOTCERT_SUCCESS;
+
+	} elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
+
+		# Validate input since the form was submitted
+		if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
+			$errormessage = $Lang::tr{'organization cant be empty'};
+			goto ROOTCERT_ERROR;
+		}
+		if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
+			$errormessage = $Lang::tr{'organization too long'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for organization'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
+			$errormessage = $Lang::tr{'hostname cant be empty'};
+			goto ROOTCERT_ERROR;
+		}
+		unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
+			$errormessage = $Lang::tr{'invalid input for hostname'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
+			$errormessage = $Lang::tr{'invalid input for e-mail address'};
+			goto ROOTCERT_ERROR;
+		}
+		if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
+			$errormessage = $Lang::tr{'e-mail address too long'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for department'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for city'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for state or province'};
+			goto ROOTCERT_ERROR;
+		}
+		if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
+			$errormessage = $Lang::tr{'invalid input for country'};
+			goto ROOTCERT_ERROR;
+		}
+		#the exact syntax is a list comma separated of
+		#	email:any-validemail
+		#	URI: a uniform resource indicator
+		#	DNS: a DNS domain name
+		#	RID: a registered OBJECT IDENTIFIER
+		#	IP: an IP address
+		# example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
+
+		if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
+			$errormessage = $Lang::tr{'vpn altname syntax'};
+			goto VPNCONF_ERROR;
+		}
 
-	# Sign the host certificate request
-	if (!$errormessage) {
-	    &General::log("ipsec", "Self signing host cert...");
+		# Copy the cgisettings to vpnsettings and save the configfile
+		$vpnsettings{'ROOTCERT_ORGANIZATION'}	= $cgiparams{'ROOTCERT_ORGANIZATION'};
+		$vpnsettings{'ROOTCERT_HOSTNAME'}		= $cgiparams{'ROOTCERT_HOSTNAME'};
+		$vpnsettings{'ROOTCERT_EMAIL'}			= $cgiparams{'ROOTCERT_EMAIL'};
+		$vpnsettings{'ROOTCERT_OU'}				= $cgiparams{'ROOTCERT_OU'};
+		$vpnsettings{'ROOTCERT_CITY'}			= $cgiparams{'ROOTCERT_CITY'};
+		$vpnsettings{'ROOTCERT_STATE'}			= $cgiparams{'ROOTCERT_STATE'};
+		$vpnsettings{'ROOTCERT_COUNTRY'}		= $cgiparams{'ROOTCERT_COUNTRY'};
+		&General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
+
+		# Replace empty strings with a .
+		(my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
+		(my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
+		(my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
+
+		# Create the CA certificate
+		if (!$errormessage) {
+			&General::log("ipsec", "Creating cacert...");
+			if (open(STDIN, "-|")) {
+				my $opt = " req -x509 -sha256 -nodes";
+				$opt .= " -days 999999";
+				$opt .= " -newkey rsa:4096";
+				$opt .= " -keyout ${General::swroot}/private/cakey.pem";
+				$opt .= " -out ${General::swroot}/ca/cacert.pem";
+
+				$errormessage = &callssl ($opt);
+			} else { #child
+				print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
+				print "$state\n";
+				print "$city\n";
+				print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
+				print "$ou\n";
+				print "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
+				print "$cgiparams{'ROOTCERT_EMAIL'}\n";
+				exit (0);
+			}
+		}
 
-	    #No easy way for specifying the contain of subjectAltName without writing a config file...
-	    my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
-	    print $fh <<END
-	    basicConstraints=CA:FALSE
-	    nsComment="OpenSSL Generated Certificate"
-	    subjectKeyIdentifier=hash
-	    authorityKeyIdentifier=keyid,issuer:always
-	    extendedKeyUsage = serverAuth
+		# Create the Host certificate request
+		if (!$errormessage) {
+			&General::log("ipsec", "Creating host cert...");
+			if (open(STDIN, "-|")) {
+				my $opt = " req -sha256 -nodes";
+				$opt .= " -newkey rsa:2048";
+				$opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
+				$opt .= " -out ${General::swroot}/certs/hostreq.pem";
+				$errormessage = &callssl ($opt);
+			} else { #child
+				print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
+				print "$state\n";
+				print "$city\n";
+				print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
+				print "$ou\n";
+				print "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
+				print "$cgiparams{'ROOTCERT_EMAIL'}\n";
+				print ".\n";
+				print ".\n";
+				exit (0);
+			}
+		}
+
+		# Sign the host certificate request
+		if (!$errormessage) {
+			&General::log("ipsec", "Self signing host cert...");
+
+			#No easy way for specifying the contain of subjectAltName without writing a config file...
+			my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
+			print $fh <<END
+			basicConstraints=CA:FALSE
+			nsComment="OpenSSL Generated Certificate"
+			subjectKeyIdentifier=hash
+			authorityKeyIdentifier=keyid,issuer:always
+			extendedKeyUsage = serverAuth
 END
 ;
-	    print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
-	    close ($fh);
-	    
-	    my  $opt  = " ca -days 999999";
-		$opt .= " -batch -notext";
-		$opt .= " -in ${General::swroot}/certs/hostreq.pem";
-		$opt .= " -out ${General::swroot}/certs/hostcert.pem";
-		$opt .= " -extfile $v3extname";
-	    $errormessage = &callssl ($opt);
-	    unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
-	    unlink ($v3extname);
-	}
-
-	# Create an empty CRL
-	if (!$errormessage) {
-	    &General::log("ipsec", "Creating emptycrl...");
-	    my  $opt  = " ca -gencrl";
-		$opt .= " -out ${General::swroot}/crls/cacrl.pem";
-	    $errormessage = &callssl ($opt);
-	}
-	
-	# Successfully build CA / CERT!
-	if (!$errormessage) {
-	    &cleanssldatabase();
-	    goto ROOTCERT_SUCCESS;
-	}
-	
-	#Cleanup
-	unlink ("${General::swroot}/ca/cacert.pem");
-	unlink ("${General::swroot}/certs/hostkey.pem");
-	unlink ("${General::swroot}/certs/hostcert.pem");
-	unlink ("${General::swroot}/crls/cacrl.pem");
-	&cleanssldatabase();
-    }
-
-    ROOTCERT_ERROR:
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', $errormessage);
-    if ($errormessage) {
-        &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
-        print "<class name='base'>$errormessage";
-        print " </class>";
-        &Header::closebox();
-    }
-    &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
-    print <<END
-    <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
-    <table width='100%' border='0' cellspacing='1' cellpadding='0'>
-    <tr><td width='40%' class='base'>$Lang::tr{'organization name'}:</td>
-        <td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
-        <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'your e-mail'}: <img src='/blob.gif' alt='*' /></td>
-        <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'your department'}: <img src='/blob.gif' alt='*' /></td>
-        <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'city'}: <img src='/blob.gif' alt='*' /></td>
-        <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'state or province'}: <img src='/blob.gif' alt='*' /></td>
-        <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'country'}:</td>
-        <td class='base'><select name='ROOTCERT_COUNTRY'>
+			print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
+			close ($fh);
+
+			my $opt = " ca -md sha256 -days 999999";
+			$opt .= " -batch -notext";
+			$opt .= " -in ${General::swroot}/certs/hostreq.pem";
+			$opt .= " -out ${General::swroot}/certs/hostcert.pem";
+			$opt .= " -extfile $v3extname";
+			$errormessage = &callssl ($opt);
+			unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
+			unlink ($v3extname);
+		}
+
+		# Create an empty CRL
+		if (!$errormessage) {
+			&General::log("ipsec", "Creating emptycrl...");
+			my $opt = " ca -gencrl";
+			$opt .= " -out ${General::swroot}/crls/cacrl.pem";
+			$errormessage = &callssl ($opt);
+		}
+
+		# Successfully build CA / CERT!
+		if (!$errormessage) {
+			&cleanssldatabase();
+			goto ROOTCERT_SUCCESS;
+		}
+
+		#Cleanup
+		unlink ("${General::swroot}/ca/cacert.pem");
+		unlink ("${General::swroot}/certs/hostkey.pem");
+		unlink ("${General::swroot}/certs/hostcert.pem");
+		unlink ("${General::swroot}/crls/cacrl.pem");
+		&cleanssldatabase();
+	}
+
+	ROOTCERT_ERROR:
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', $errormessage);
+	if ($errormessage) {
+		&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
+		print "<class name='base'>$errormessage";
+		print " </class>";
+		&Header::closebox();
+	}
+	&Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
+	print <<END
+	<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
+		<table width='100%' border='0' cellspacing='1' cellpadding='0'>
+	<tr><td width='40%' class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td>
+		<td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'ipfires hostname'}: <img src='/blob.gif' alt='*' /></td>
+		<td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
+		<td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'your department'}:</td>
+		<td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'city'}:</td>
+		<td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'state or province'}:</td>
+		<td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'country'}:</td>
+		<td class='base'><select name='ROOTCERT_COUNTRY'>
 END
-    ;
-    foreach my $country (sort keys %{Countries::countries}) {
-        print "<option value='$Countries::countries{$country}'";
-        if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
-            print " selected='selected'";
-        }
-        print ">$country</option>";
-    }
-    print <<END
-        </select></td></tr>
-    <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*) <img src='/blob.gif' alt='*' /></td>
+;
+	foreach my $country (sort keys %{Countries::countries}) {
+		print "<option value='$Countries::countries{$country}'";
+		if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
+			print " selected='selected'";
+		}
+		print ">$country</option>";
+	}
+	print <<END
+		</select></td></tr>
+	<tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td>
 	<td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
-    <tr><td> </td>
-        <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
-    <tr><td class='base' colspan='2' align='left'>
-        <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: 
-        $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
-    </td></tr>
-    <tr><td colspan='2'><hr></td></tr>
-    <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
-        <td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr>
-    <tr><td class='base'>$Lang::tr{'pkcs12 file password'}: <img src='/blob.gif' alt='*' /></td>
-        <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr>
-    <tr><td> </td>
-        <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr>
-    <tr><td class='base' colspan='2' align='left'>
-        <img src='/blob.gif' alt='*' /> $Lang::tr{'this field may be blank'}</td></tr>
-    </table></form>
+	<tr><td> </td>
+		<td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
+	<tr><td class='base' colspan='2' align='left'>
+		<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
+		$Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
+	</td></tr>
+	<tr><td colspan='2'><hr></td></tr>
+	<tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
+		<td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr>
+	<tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
+		<td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr>
+	<tr><td> </td>
+		<td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr>
+	<tr><td class='base' colspan='2' align='left'>
+		<img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}</td></tr>
+	</table></form>
 END
-    ;
-    &Header::closebox();
-    &Header::closebigbox();
-    &Header::closepage();
-    exit(0);
-
-    ROOTCERT_SUCCESS:
-    if (&vpnenabled) {
-	system('/usr/local/bin/ipsecctrl', 'S');
-	sleep $sleepDelay;
-    }
-    ROOTCERT_SKIP:
+;
+	&Header::closebox();
+	&Header::closebigbox();
+	&Header::closepage();
+	exit(0);
+
+	ROOTCERT_SUCCESS:
+	if (&vpnenabled) {
+		system('/usr/local/bin/ipsecctrl', 'S');
+		sleep $sleepDelay;
+	}
+	ROOTCERT_SKIP:
 ###
 ### Export PKCS12 file to browser
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-    print "Content-Type: application/force-download\n";
-    print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
-    print "Content-Type: application/octet-stream\r\n\r\n";
-    print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
-    exit (0);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	print "Content-Type: application/force-download\n";
+	print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
+	print "Content-Type: application/octet-stream\r\n\r\n";
+	print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
+	exit (0);
 
 ###
 ### Display certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-
-    if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
-	&Header::showhttpheaders();
-	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
-	&Header::openbigbox('100%', 'left', '', '');
-	&Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
-	my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
-	$output = &Header::cleanhtml($output,"y");
-	print "<pre>$output</pre>\n";
-	&Header::closebox();
-	print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
-	&Header::closebigbox();
-	&Header::closepage();
-	exit(0);
-    }
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+
+	if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
+		&Header::showhttpheaders();
+		&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+		&Header::openbigbox('100%', 'left', '', '');
+		&Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
+		my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
+		$output = &Header::cleanhtml($output,"y");
+		print "<pre>$output</pre>\n";
+		&Header::closebox();
+		print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
+		&Header::closebigbox();
+		&Header::closepage();
+		exit(0);
+	}
 
 ###
 ### Export Certificate to browser
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
 
-    if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
-	print "Content-Type: application/force-download\n";
-	print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
-	print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
-	exit (0);
-    }
+	if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
+		print "Content-Type: application/force-download\n";
+		print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
+		print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
+		exit (0);
+	}
 
 ###
 ### Enable/Disable connection
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
-    
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-
-    if ($confighash{$cgiparams{'KEY'}}) {
-	if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
-	    $confighash{$cgiparams{'KEY'}}[0] = 'on';
-	    &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-	    &writeipsecfiles();
-	    system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
+
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+
+	if ($confighash{$cgiparams{'KEY'}}) {
+		if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
+			$confighash{$cgiparams{'KEY'}}[0] = 'on';
+			&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+			&writeipsecfiles();
+			system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
+		} else {
+			system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+			$confighash{$cgiparams{'KEY'}}[0] = 'off';
+			&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+			&writeipsecfiles();
+		}
+		sleep $sleepDelay;
 	} else {
-	    system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
-	    $confighash{$cgiparams{'KEY'}}[0] = 'off';
-	    &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-	    &writeipsecfiles();
+		$errormessage = $Lang::tr{'invalid key'};
 	}
-	sleep $sleepDelay;
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
 
 ###
 ### Restart connection
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
 
-    if ($confighash{$cgiparams{'KEY'}}) {
-	if (&vpnenabled) {
-	    system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
-	    sleep $sleepDelay;
+	if ($confighash{$cgiparams{'KEY'}}) {
+		if (&vpnenabled) {
+			system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+			sleep $sleepDelay;
+		}
+	} else {
+		$errormessage = $Lang::tr{'invalid key'};
 	}
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
 
 ###
 ### Remove connection
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-
-    if ($confighash{$cgiparams{'KEY'}}) {
-	system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
-	unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
-	unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
-	delete $confighash{$cgiparams{'KEY'}};
-	&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-	&writeipsecfiles();
-    } else {
-	$errormessage = $Lang::tr{'invalid key'};
-    }
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+
+	if ($confighash{$cgiparams{'KEY'}}) {
+		system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+		unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+		unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
+		delete $confighash{$cgiparams{'KEY'}};
+		&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+		&writeipsecfiles();
+	} else {
+		$errormessage = $Lang::tr{'invalid key'};
+	}
 	&General::firewall_reload();
 ###
 ### Choose between adding a host-net or net-net connection
@@ -1243,530 +1220,545 @@ END
 	&Header::openbigbox('100%', 'left', '', '');
 	&Header::openbox('100%', 'left', $Lang::tr{'connection type'});
 	print <<END
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <b>$Lang::tr{'connection type'}:</b><br />
-	    <table>
-	    <tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		<b>$Lang::tr{'connection type'}:</b><br />
+		<table>
+		<tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td>
 		<td class='base'>$Lang::tr{'host to net vpn'}</td>
-	    </tr><tr>
+		</tr><tr>
 		<td><input type='radio' name='TYPE' value='net' /></td>
 		<td class='base'>$Lang::tr{'net to net vpn'}</td>
-	    </tr><tr>
+		</tr><tr>
 		<td align='center' colspan='2'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
-	    </tr>
-	    </table></form>
+		</tr>
+		</table></form>
 END
-	;
+;
 	&Header::closebox();
 	&Header::closebigbox();
 	&Header::closepage();
 	exit (0);
 ###
-### Adding/Editing/Saving a  connection
+### Adding/Editing/Saving a connection
 ###
 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
-	 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
-	 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
-
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-
-    if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
-	if (! $confighash{$cgiparams{'KEY'}}[0]) {
-	    $errormessage = $Lang::tr{'invalid key'};
-	    goto VPNCONF_END;
-	}
-	$cgiparams{'ENABLED'}		= $confighash{$cgiparams{'KEY'}}[0];
-	$cgiparams{'NAME'}		= $confighash{$cgiparams{'KEY'}}[1];
-	$cgiparams{'TYPE'}		= $confighash{$cgiparams{'KEY'}}[3];
-	$cgiparams{'AUTH'} 		= $confighash{$cgiparams{'KEY'}}[4];
-	$cgiparams{'PSK'}		= $confighash{$cgiparams{'KEY'}}[5];
-	#$cgiparams{'free'}		= $confighash{$cgiparams{'KEY'}}[6];
-	$cgiparams{'LOCAL_ID'}		= $confighash{$cgiparams{'KEY'}}[7];
-	$cgiparams{'LOCAL_SUBNET'} 	= $confighash{$cgiparams{'KEY'}}[8];
-	$cgiparams{'REMOTE_ID'}		= $confighash{$cgiparams{'KEY'}}[9];
-	$cgiparams{'REMOTE'}		= $confighash{$cgiparams{'KEY'}}[10];
-	$cgiparams{'REMOTE_SUBNET'} 	= $confighash{$cgiparams{'KEY'}}[11];
-	$cgiparams{'REMARK'}		= $confighash{$cgiparams{'KEY'}}[25];
-	$cgiparams{'DPD_ACTION'}	= $confighash{$cgiparams{'KEY'}}[27];
-	$cgiparams{'IKE_VERSION'}	= $confighash{$cgiparams{'KEY'}}[29];
-	$cgiparams{'IKE_ENCRYPTION'} 	= $confighash{$cgiparams{'KEY'}}[18];
-	$cgiparams{'IKE_INTEGRITY'}  	= $confighash{$cgiparams{'KEY'}}[19];
-	$cgiparams{'IKE_GROUPTYPE'}  	= $confighash{$cgiparams{'KEY'}}[20];
-	$cgiparams{'IKE_LIFETIME'}   	= $confighash{$cgiparams{'KEY'}}[16];
-	$cgiparams{'ESP_ENCRYPTION'} 	= $confighash{$cgiparams{'KEY'}}[21];
-	$cgiparams{'ESP_INTEGRITY'}  	= $confighash{$cgiparams{'KEY'}}[22];
-	$cgiparams{'ESP_GROUPTYPE'}  	= $confighash{$cgiparams{'KEY'}}[23];
-	$cgiparams{'ESP_KEYLIFE'}    	= $confighash{$cgiparams{'KEY'}}[17];
-	$cgiparams{'COMPRESSION'}    	= $confighash{$cgiparams{'KEY'}}[13];
-	$cgiparams{'ONLY_PROPOSED'}  	= $confighash{$cgiparams{'KEY'}}[24];
-	$cgiparams{'PFS'}		= $confighash{$cgiparams{'KEY'}}[28];
-	$cgiparams{'VHOST'}            	= $confighash{$cgiparams{'KEY'}}[14];
-	$cgiparams{'DPD_TIMEOUT'}		= $confighash{$cgiparams{'KEY'}}[30];
-	$cgiparams{'DPD_DELAY'}		= $confighash{$cgiparams{'KEY'}}[31];
+	($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
+	($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
 
-	if (!$cgiparams{'DPD_DELAY'}) {
-		$cgiparams{'DPD_DELAY'} = 30;
-	}
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
 
-	if (!$cgiparams{'DPD_TIMEOUT'}) {
-		$cgiparams{'DPD_TIMEOUT'} = 120;
-	}
+	if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
+		if (! $confighash{$cgiparams{'KEY'}}[0]) {
+			$errormessage = $Lang::tr{'invalid key'};
+			goto VPNCONF_END;
+		}
+		$cgiparams{'ENABLED'}			= $confighash{$cgiparams{'KEY'}}[0];
+		$cgiparams{'NAME'}				= $confighash{$cgiparams{'KEY'}}[1];
+		$cgiparams{'TYPE'}				= $confighash{$cgiparams{'KEY'}}[3];
+		$cgiparams{'AUTH'}				= $confighash{$cgiparams{'KEY'}}[4];
+		$cgiparams{'PSK'}				= $confighash{$cgiparams{'KEY'}}[5];
+		#$cgiparams{'free'}				= $confighash{$cgiparams{'KEY'}}[6];
+		$cgiparams{'LOCAL_ID'}			= $confighash{$cgiparams{'KEY'}}[7];
+		my @local_subnets = split(",", $confighash{$cgiparams{'KEY'}}[8]);
+		$cgiparams{'LOCAL_SUBNET'} 		= join(/\|/, @local_subnets);
+		$cgiparams{'REMOTE_ID'}			= $confighash{$cgiparams{'KEY'}}[9];
+		$cgiparams{'REMOTE'}			= $confighash{$cgiparams{'KEY'}}[10];
+		my @remote_subnets = split(",", $confighash{$cgiparams{'KEY'}}[11]);
+		$cgiparams{'REMOTE_SUBNET'}		= join(/\|/, @remote_subnets);
+		$cgiparams{'REMARK'}			= $confighash{$cgiparams{'KEY'}}[25];
+		$cgiparams{'DPD_ACTION'}		= $confighash{$cgiparams{'KEY'}}[27];
+		$cgiparams{'IKE_VERSION'}		= $confighash{$cgiparams{'KEY'}}[29];
+		$cgiparams{'IKE_ENCRYPTION'}	= $confighash{$cgiparams{'KEY'}}[18];
+		$cgiparams{'IKE_INTEGRITY'}		= $confighash{$cgiparams{'KEY'}}[19];
+		$cgiparams{'IKE_GROUPTYPE'}		= $confighash{$cgiparams{'KEY'}}[20];
+		$cgiparams{'IKE_LIFETIME'}		= $confighash{$cgiparams{'KEY'}}[16];
+		$cgiparams{'ESP_ENCRYPTION'}	= $confighash{$cgiparams{'KEY'}}[21];
+		$cgiparams{'ESP_INTEGRITY'}		= $confighash{$cgiparams{'KEY'}}[22];
+		$cgiparams{'ESP_GROUPTYPE'}		= $confighash{$cgiparams{'KEY'}}[23];
+		if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
+			$cgiparams{'ESP_GROUPTYPE'}	= $cgiparams{'IKE_GROUPTYPE'};
+		}
+		$cgiparams{'ESP_KEYLIFE'}		= $confighash{$cgiparams{'KEY'}}[17];
+		$cgiparams{'COMPRESSION'}		= $confighash{$cgiparams{'KEY'}}[13];
+		$cgiparams{'ONLY_PROPOSED'}		= $confighash{$cgiparams{'KEY'}}[24];
+		$cgiparams{'PFS'}				= $confighash{$cgiparams{'KEY'}}[28];
+		$cgiparams{'DPD_TIMEOUT'}		= $confighash{$cgiparams{'KEY'}}[30];
+		$cgiparams{'DPD_DELAY'}			= $confighash{$cgiparams{'KEY'}}[31];
+		$cgiparams{'FORCE_MOBIKE'}		= $confighash{$cgiparams{'KEY'}}[32];
+
+		if (!$cgiparams{'DPD_DELAY'}) {
+			$cgiparams{'DPD_DELAY'} = 30;
+		}
 
-    } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
-	$cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
-	if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
-	    $errormessage = $Lang::tr{'connection type is invalid'};
-	    goto VPNCONF_ERROR;
-	}
+		if (!$cgiparams{'DPD_TIMEOUT'}) {
+			$cgiparams{'DPD_TIMEOUT'} = 120;
+		}
+
+	} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
+		$cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
+		if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
+			$errormessage = $Lang::tr{'connection type is invalid'};
+			goto VPNCONF_ERROR;
+		}
+
+		if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
+			$errormessage = $Lang::tr{'name must only contain characters'};
+			goto VPNCONF_ERROR;
+		}
+
+		if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
+			$errormessage = $Lang::tr{'name is invalid'};
+			goto VPNCONF_ERROR;
+		}
 
-	if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
-	    $errormessage = $Lang::tr{'name must only contain characters'};
-	    goto VPNCONF_ERROR;
-	}
+		if (length($cgiparams{'NAME'}) >60) {
+			$errormessage = $Lang::tr{'name too long'};
+			goto VPNCONF_ERROR;
+		}
 
-	if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
-	    $errormessage = $Lang::tr{'name is invalid'};
-	    goto VPNCONF_ERROR;
-	}
+		# Check if there is no other entry with this name
+		if (! $cgiparams{'KEY'}) { #only for add
+			foreach my $key (keys %confighash) {
+				if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
+					$errormessage = $Lang::tr{'a connection with this name already exists'};
+					goto VPNCONF_ERROR;
+				}
+			}
+		}
 
-	if (length($cgiparams{'NAME'}) >60) {
-	    $errormessage = $Lang::tr{'name too long'};
-	    goto VPNCONF_ERROR;
-	}
+		if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
+			$errormessage = $Lang::tr{'invalid input for remote host/ip'};
+			goto VPNCONF_ERROR;
+		}
 
-	# Check if there is no other entry with this name
-	if (! $cgiparams{'KEY'}) {  #only for add
-	    foreach my $key (keys %confighash) {
-		if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
-		    $errormessage = $Lang::tr{'a connection with this name already exists'};
-		    goto VPNCONF_ERROR;
+		if ($cgiparams{'REMOTE'}) {
+			if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) {
+				if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
+					$errormessage = $Lang::tr{'invalid input for remote host/ip'};
+					goto VPNCONF_ERROR;
+				} else {
+					if (&valid_dns_host($cgiparams{'REMOTE'})) {
+						$warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
+					}
+				}
+			}
 		}
-	    }
-	}
 
-	if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
-	    $errormessage = $Lang::tr{'invalid input for remote host/ip'};
-	    goto VPNCONF_ERROR;
-	}
+		my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'});
+		foreach my $subnet (@local_subnets) {
+			unless (&Network::check_subnet($subnet)) {
+				$errormessage = $Lang::tr{'local subnet is invalid'};
+				goto VPNCONF_ERROR;
+			}
+		}
 
-	if ($cgiparams{'REMOTE'}) {
-	    if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) {
-		if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
-		    $errormessage = $Lang::tr{'invalid input for remote host/ip'};
-		    goto VPNCONF_ERROR;
-		} else {
-		    if (&valid_dns_host($cgiparams{'REMOTE'})) {
-			$warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
-		    }
+		# Allow only one roadwarrior/psk without remote IP-address
+		if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
+			foreach my $key (keys %confighash) {
+				if ( ($cgiparams{'KEY'} ne $key) &&
+					($confighash{$key}[4] eq 'psk') &&
+					($confighash{$key}[10] eq '') ) {
+					$errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
+					goto VPNCONF_ERROR;
+				}
+			}
 		}
-	    }
-	}
 
-        unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
-            $errormessage = $Lang::tr{'local subnet is invalid'};
-	    goto VPNCONF_ERROR;
-	}
+		if ($cgiparams{'TYPE'} eq 'net') {
+			my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'});
+			foreach my $subnet (@remote_subnets) {
+				unless (&Network::check_subnet($subnet)) {
+					$errormessage = $Lang::tr{'remote subnet is invalid'};
+					goto VPNCONF_ERROR;
+				}
+			}
+		}
 
-	# Allow only one roadwarrior/psk without remote IP-address
-	if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
-	    foreach my $key (keys %confighash) {
-		if ( ($cgiparams{'KEY'} ne $key) && 
-		      ($confighash{$key}[4] eq 'psk') && 
-		      ($confighash{$key}[10] eq '') ) {
-			$errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
+		if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
+			$errormessage = $Lang::tr{'invalid input'};
 			goto VPNCONF_ERROR;
 		}
-	    }
-	}
-	if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
-            $errormessage = $Lang::tr{'remote subnet is invalid'};
-	    goto VPNCONF_ERROR;
-	}
-
-	if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto VPNCONF_ERROR;
-	}
-	if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto VPNCONF_ERROR;
-	}
 
-	# Allow nothing or a string (DN,FDQN,) beginning with @
-	# with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
-	if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
-	    ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
-	    (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
-	   ) {
-	    $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
-	    'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
-	    'FQDN: @ipfire.org<br />' .
-	    'USER_FQDN: info@ipfire.org<br />' .
-	    'IPV4_ADDR: 123.123.123.123';
-	    goto VPNCONF_ERROR;
-	}
-	# If Auth is DN, verify existance of Remote ID.
-	if ( $cgiparams{'REMOTE_ID'} eq '' && (
-		$cgiparams{'AUTH'} eq 'auth-dn'|| 		   # while creation
-		$confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing
-	    $errormessage = $Lang::tr{'vpn missing remote id'};
-	    goto VPNCONF_ERROR;
-	}
+		# Allow nothing or a string (DN,FDQN,) beginning with @
+		# with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
+		if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
+			($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
+			(($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
+		) {
+			$errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
+			'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
+			'FQDN: @ipfire.org<br />' .
+			'USER_FQDN: info@ipfire.org<br />' .
+			'IPV4_ADDR: 123.123.123.123';
+			goto VPNCONF_ERROR;
+		}
+		# If Auth is DN, verify existance of Remote ID.
+		if ( $cgiparams{'REMOTE_ID'} eq '' && (
+			$cgiparams{'AUTH'} eq 'auth-dn'|| # while creation
+			$confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing
+				$errormessage = $Lang::tr{'vpn missing remote id'};
+				goto VPNCONF_ERROR;
+		}
 
-	if ($cgiparams{'TYPE'} eq 'net'){
-		$warnmessage=&General::checksubnets('',$cgiparams{'REMOTE_SUBNET'},'ipsec');
-		if ($warnmessage ne ''){
-			$warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
+		if ($cgiparams{'TYPE'} eq 'net'){
+			$warnmessage=&General::checksubnets('',$cgiparams{'REMOTE_SUBNET'},'ipsec');
+			if ($warnmessage ne ''){
+				$warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
+			}
 		}
-	}
 
-	if ($cgiparams{'AUTH'} eq 'psk') {
-	    if (! length($cgiparams{'PSK'}) ) {
-		$errormessage = $Lang::tr{'pre-shared key is too short'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'PSK'} =~ /'/) {
-                $cgiparams{'PSK'} =~ tr/'/ /;
-		$errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
-		goto VPNCONF_ERROR;
-	    }
+		if ($cgiparams{'AUTH'} eq 'psk') {
+			if (! length($cgiparams{'PSK'}) ) {
+				$errormessage = $Lang::tr{'pre-shared key is too short'};
+				goto VPNCONF_ERROR;
+			}
+			if ($cgiparams{'PSK'} =~ /'/) {
+				$cgiparams{'PSK'} =~ tr/'/ /;
+				$errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
+				goto VPNCONF_ERROR;
+			}
 	} elsif ($cgiparams{'AUTH'} eq 'certreq') {
-	    if ($cgiparams{'KEY'}) {
-		$errormessage = $Lang::tr{'cant change certificates'};
-		goto VPNCONF_ERROR;
-	    }
-	    if (ref ($cgiparams{'FH'}) ne 'Fh') {
-		$errormessage = $Lang::tr{'there was no file upload'};
-		goto VPNCONF_ERROR;
-	    }
+		if ($cgiparams{'KEY'}) {
+			$errormessage = $Lang::tr{'cant change certificates'};
+			goto VPNCONF_ERROR;
+		}
+		if (ref ($cgiparams{'FH'}) ne 'Fh') {
+			$errormessage = $Lang::tr{'there was no file upload'};
+			goto VPNCONF_ERROR;
+		}
 
-	    # Move uploaded certificate request to a temporary file
-	    (my $fh, my $filename) = tempfile( );
-	    if (copy ($cgiparams{'FH'}, $fh) != 1) {
-		$errormessage = $!;
-		goto VPNCONF_ERROR;
-	    }
+		# Move uploaded certificate request to a temporary file
+		(my $fh, my $filename) = tempfile( );
+		if (copy ($cgiparams{'FH'}, $fh) != 1) {
+			$errormessage = $!;
+			goto VPNCONF_ERROR;
+		}
 
-	    # Sign the certificate request
-	    &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
-    	    my 	$opt  = " ca -days 999999";
+		# Sign the certificate request
+		&General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
+		my $opt = " ca -md sha256 -days 999999";
 		$opt .= " -batch -notext";
 		$opt .= " -in $filename";
 		$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
 
-	    if ( $errormessage = &callssl ($opt) ) {
-		unlink ($filename);
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		&cleanssldatabase();
-		goto VPNCONF_ERROR;
-	    } else {
-	        unlink ($filename);
-	        &cleanssldatabase();
-	    }
-
-	    $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-	    if ($cgiparams{'CERT_NAME'} eq '') {
-		$errormessage = $Lang::tr{'could not retrieve common name from certificate'};
-		goto VPNCONF_ERROR;
-	    }
+		if ( $errormessage = &callssl ($opt) ) {
+			unlink ($filename);
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			&cleanssldatabase();
+			goto VPNCONF_ERROR;
+		} else {
+			unlink ($filename);
+			&cleanssldatabase();
+		}
+
+		$cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+		if ($cgiparams{'CERT_NAME'} eq '') {
+			$errormessage = $Lang::tr{'could not retrieve common name from certificate'};
+			goto VPNCONF_ERROR;
+		}
 	} elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
 		&General::log("ipsec", "Importing from p12...");
 
 		if (ref ($cgiparams{'FH'}) ne 'Fh') {
-		    $errormessage = $Lang::tr{'there was no file upload'};
-	    	    goto ROOTCERT_ERROR;
+			$errormessage = $Lang::tr{'there was no file upload'};
+			goto ROOTCERT_ERROR;
 		}
 
 		# Move uploaded certificate request to a temporary file
 		(my $fh, my $filename) = tempfile( );
 		if (copy ($cgiparams{'FH'}, $fh) != 1) {
-		    $errormessage = $!;
-		    goto ROOTCERT_ERROR;
+			$errormessage = $!;
+			goto ROOTCERT_ERROR;
 		}
 
 		# Extract the CA certificate from the file
 		&General::log("ipsec", "Extracting caroot from p12...");
 		if (open(STDIN, "-|")) {
-    		    my	$opt  = " pkcs12 -cacerts -nokeys";
+			my $opt = " pkcs12 -cacerts -nokeys";
 			$opt .= " -in $filename";
 			$opt .= " -out /tmp/newcacert";
-		    $errormessage = &callssl ($opt);
-		} else {	#child
-		    print "$cgiparams{'P12_PASS'}\n";
-		    exit (0);
-		}
-
-    		# Extract the Host certificate from the file
-		if (!$errormessage) {
-		    &General::log("ipsec", "Extracting host cert from p12...");
-		    if (open(STDIN, "-|")) {
-    			my  $opt  = " pkcs12 -clcerts -nokeys";
-			$opt .= " -in $filename";
-			$opt .= " -out /tmp/newhostcert";
 			$errormessage = &callssl ($opt);
-		    } else {	#child
+		} else { #child
 			print "$cgiparams{'P12_PASS'}\n";
 			exit (0);
-		    }
-		}
-
-		if (!$errormessage) {		
-		    &General::log("ipsec", "Moving cacert...");
-		    #If CA have new subject, add it to our list of CA
-		    my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert'));
-		    my @names;
-		    foreach my $x (keys %cahash) {
-			$casubject='' if ($cahash{$x}[1] eq $casubject);
-			unshift (@names,$cahash{$x}[0]);
-		    }
-		    if ($casubject) { # a new one!
-			my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
-			if ($temp !~ /CA:TRUE/i) {
-			    $errormessage = $Lang::tr{'not a valid ca certificate'};
-			} else {
-			    #compute a name for it
-			    my $idx=0;
-			    while (grep(/Imported-$idx/, @names) ) {$idx++};
-			    $cgiparams{'CA_NAME'}="Imported-$idx";
-			    $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
-			    move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
-			    $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
-			    if (!$errormessage) {
-				my $key = &General::findhasharraykey (\%cahash);
-				$cahash{$key}[0] = $cgiparams{'CA_NAME'};
-				$cahash{$key}[1] = $casubject;
-				&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-				system('/usr/local/bin/ipsecctrl', 'R');
-			    }
-    			}
-		    }	
+		}
+
+		# Extract the Host certificate from the file
+		if (!$errormessage) {
+			&General::log("ipsec", "Extracting host cert from p12...");
+			if (open(STDIN, "-|")) {
+				my $opt = " pkcs12 -clcerts -nokeys";
+				$opt .= " -in $filename";
+				$opt .= " -out /tmp/newhostcert";
+				$errormessage = &callssl ($opt);
+			} else { #child
+				print "$cgiparams{'P12_PASS'}\n";
+				exit (0);
+			}
+		}
+
+		if (!$errormessage) {
+			&General::log("ipsec", "Moving cacert...");
+			#If CA have new subject, add it to our list of CA
+			my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert'));
+			my @names;
+			foreach my $x (keys %cahash) {
+				$casubject='' if ($cahash{$x}[1] eq $casubject);
+				unshift (@names,$cahash{$x}[0]);
+			}
+			if ($casubject) { # a new one!
+				my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
+				if ($temp !~ /CA:TRUE/i) {
+					$errormessage = $Lang::tr{'not a valid ca certificate'};
+				} else {
+					#compute a name for it
+					my $idx=0;
+					while (grep(/Imported-$idx/, @names) ) {$idx++};
+					$cgiparams{'CA_NAME'}="Imported-$idx";
+					$cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
+					move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
+					$errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+					if (!$errormessage) {
+						my $key = &General::findhasharraykey (\%cahash);
+						$cahash{$key}[0] = $cgiparams{'CA_NAME'};
+						$cahash{$key}[1] = $casubject;
+						&General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
+						system('/usr/local/bin/ipsecctrl', 'R');
+					}
+				}
+			}
 		}
 		if (!$errormessage) {
-		    &General::log("ipsec", "Moving host cert...");
-		    move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		    $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
-    		}
+			&General::log("ipsec", "Moving host cert...");
+			move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			$errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+		}
 
 		#cleanup temp files
 		unlink ($filename);
 		unlink ('/tmp/newcacert');
 		unlink ('/tmp/newhostcert');
 		if ($errormessage) {
-		    unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
-		    unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		    goto VPNCONF_ERROR;
+			unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			goto VPNCONF_ERROR;
 		}
 		&General::log("ipsec", "p12 import completed!");
 	} elsif ($cgiparams{'AUTH'} eq 'certfile') {
-	    if ($cgiparams{'KEY'}) {
-		$errormessage = $Lang::tr{'cant change certificates'};
-		goto VPNCONF_ERROR;
-	    }
-	    if (ref ($cgiparams{'FH'}) ne 'Fh') {
-		$errormessage = $Lang::tr{'there was no file upload'};
-		goto VPNCONF_ERROR;
-	    }
-	    # Move uploaded certificate to a temporary file
-	    (my $fh, my $filename) = tempfile( );
-	    if (copy ($cgiparams{'FH'}, $fh) != 1) {
-		$errormessage = $!;
-		goto VPNCONF_ERROR;
-	    }
-
-	    # Verify the certificate has a valid CA and move it
-	    &General::log("ipsec", "Validating imported cert against our known CA...");
-	    my $validca = 1;  #assume ok
-	    my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
-	    if ($test !~ /: OK/) {
-		my $validca = 0;
-		foreach my $key (keys %cahash) {
-		    $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
-		    if ($test =~ /: OK/) {
-			$validca = 1;
-			last;
-		    }
-		}
-	    }
-	    if (! $validca) {
-		$errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
-		unlink ($filename);
-		goto VPNCONF_ERROR;
-	    } else {
-		move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		if ($? ne 0) {
-		    $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
-		    unlink ($filename);
-		    goto VPNCONF_ERROR;
+		if ($cgiparams{'KEY'}) {
+			$errormessage = $Lang::tr{'cant change certificates'};
+			goto VPNCONF_ERROR;
+		}
+		if (ref ($cgiparams{'FH'}) ne 'Fh') {
+			$errormessage = $Lang::tr{'there was no file upload'};
+			goto VPNCONF_ERROR;
+		}
+		# Move uploaded certificate to a temporary file
+		(my $fh, my $filename) = tempfile( );
+		if (copy ($cgiparams{'FH'}, $fh) != 1) {
+			$errormessage = $!;
+			goto VPNCONF_ERROR;
 		}
-	    }
 
-	    $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-	    if ($cgiparams{'CERT_NAME'} eq '') {
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		$errormessage = $Lang::tr{'could not retrieve common name from certificate'};
-		goto VPNCONF_ERROR;
-	    }
+		# Verify the certificate has a valid CA and move it
+		&General::log("ipsec", "Validating imported cert against our known CA...");
+		my $validca = 1; #assume ok
+		my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
+		if ($test !~ /: OK/) {
+			my $validca = 0;
+			foreach my $key (keys %cahash) {
+				$test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
+				if ($test =~ /: OK/) {
+					$validca = 1;
+					last;
+				}
+			}
+		}
+		if (! $validca) {
+			$errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
+			unlink ($filename);
+			goto VPNCONF_ERROR;
+		} else {
+			move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			if ($? ne 0) {
+				$errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+				unlink ($filename);
+				goto VPNCONF_ERROR;
+			}
+		}
+
+		$cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+		if ($cgiparams{'CERT_NAME'} eq '') {
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			$errormessage = $Lang::tr{'could not retrieve common name from certificate'};
+			goto VPNCONF_ERROR;
+		}
 	} elsif ($cgiparams{'AUTH'} eq 'certgen') {
-	    if ($cgiparams{'KEY'}) {
-		$errormessage = $Lang::tr{'cant change certificates'};
-		goto VPNCONF_ERROR;
-	    }
-	    # Validate input since the form was submitted
-	    if (length($cgiparams{'CERT_NAME'}) >60) {
-		$errormessage = $Lang::tr{'name too long'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
-		$errormessage = $Lang::tr{'invalid input for name'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
-		$errormessage = $Lang::tr{'invalid input for e-mail address'};
-		goto VPNCONF_ERROR;
-	    }
-	    if (length($cgiparams{'CERT_EMAIL'}) > 40) {
-		$errormessage = $Lang::tr{'e-mail address too long'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-		$errormessage = $Lang::tr{'invalid input for department'};
-		goto VPNCONF_ERROR;
-	    }
-	    if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
-		$errormessage = $Lang::tr{'organization too long'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
-		$errormessage = $Lang::tr{'invalid input for organization'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-		$errormessage = $Lang::tr{'invalid input for city'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
-		$errormessage = $Lang::tr{'invalid input for state or province'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
-		$errormessage = $Lang::tr{'invalid input for country'};
-		goto VPNCONF_ERROR;
-	    }
-	    #the exact syntax is a list comma separated of 
-	    #  email:any-validemail
-	    #	URI: a uniform resource indicator
-	    #   DNS: a DNS domain name
-	    #   RID: a registered OBJECT IDENTIFIER
-	    #   IP: an IP address
-	    # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
-
-	    if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
-		$errormessage = $Lang::tr{'vpn altname syntax'};
-		goto VPNCONF_ERROR;
-	    }
+		if ($cgiparams{'KEY'}) {
+			$errormessage = $Lang::tr{'cant change certificates'};
+			goto VPNCONF_ERROR;
+		}
+		# Validate input since the form was submitted
+		if (length($cgiparams{'CERT_NAME'}) >60) {
+			$errormessage = $Lang::tr{'name too long'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
+			$errormessage = $Lang::tr{'invalid input for name'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
+			$errormessage = $Lang::tr{'invalid input for e-mail address'};
+			goto VPNCONF_ERROR;
+		}
+		if (length($cgiparams{'CERT_EMAIL'}) > 40) {
+			$errormessage = $Lang::tr{'e-mail address too long'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for department'};
+			goto VPNCONF_ERROR;
+		}
+		if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
+			$errormessage = $Lang::tr{'organization too long'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
+			$errormessage = $Lang::tr{'invalid input for organization'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for city'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
+			$errormessage = $Lang::tr{'invalid input for state or province'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
+			$errormessage = $Lang::tr{'invalid input for country'};
+			goto VPNCONF_ERROR;
+		}
+		#the exact syntax is a list comma separated of
+		#	email:any-validemail
+		#	URI: a uniform resource indicator
+		#	DNS: a DNS domain name
+		#	RID: a registered OBJECT IDENTIFIER
+		#	IP: an IP address
+		# example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
+
+		if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
+			$errormessage = $Lang::tr{'vpn altname syntax'};
+			goto VPNCONF_ERROR;
+		}
 
-	    if (length($cgiparams{'CERT_PASS1'}) < 5) {
-		$errormessage = $Lang::tr{'password too short'};
-		goto VPNCONF_ERROR;
-	    }
-	    if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
-		$errormessage = $Lang::tr{'passwords do not match'};
-		goto VPNCONF_ERROR;
-	    }
+		if (length($cgiparams{'CERT_PASS1'}) < 5) {
+			$errormessage = $Lang::tr{'password too short'};
+			goto VPNCONF_ERROR;
+		}
+		if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
+			$errormessage = $Lang::tr{'passwords do not match'};
+			goto VPNCONF_ERROR;
+		}
 
-	    # Replace empty strings with a .
-	    (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
-	    (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
-	    (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
+		# Replace empty strings with a .
+		(my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
+		(my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
+		(my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
 
-	    # Create the Host certificate request
-	    &General::log("ipsec", "Creating a cert...");
+		# Create the Client certificate request
+		&General::log("ipsec", "Creating a cert...");
 
-	    if (open(STDIN, "-|")) {
-    		my $opt  = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
-		   $opt .= " -newkey rsa:1024";
-		   $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
-		   $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
+		if (open(STDIN, "-|")) {
+			my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
+			$opt .= " -newkey rsa:2048";
+			$opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
+			$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
+
+			if ( $errormessage = &callssl ($opt) ) {
+				unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
+				unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
+				goto VPNCONF_ERROR;
+			}
+		} else { #child
+			print "$cgiparams{'CERT_COUNTRY'}\n";
+			print "$state\n";
+			print "$city\n";
+			print "$cgiparams{'CERT_ORGANIZATION'}\n";
+			print "$ou\n";
+			print "$cgiparams{'CERT_NAME'}\n";
+			print "$cgiparams{'CERT_EMAIL'}\n";
+			print ".\n";
+			print ".\n";
+			exit (0);
+		}
 
-		if ( $errormessage = &callssl ($opt) ) {
-		    unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
-		    unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
-		    goto VPNCONF_ERROR;
-	        }
-	    } else {	#child
-		print  "$cgiparams{'CERT_COUNTRY'}\n";
-		print  "$state\n";
-		print  "$city\n";
-		print  "$cgiparams{'CERT_ORGANIZATION'}\n";
-	        print  "$ou\n";
-	        print  "$cgiparams{'CERT_NAME'}\n";
-	        print  "$cgiparams{'CERT_EMAIL'}\n";
-	        print  ".\n";
-	        print  ".\n";
-		exit (0);
-	    }
-	    
-	    # Sign the host certificate request
-	    &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
-
-	    #No easy way for specifying the contain of subjectAltName without writing a config file...
-	    my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
-	    print $fh <<END
-	    basicConstraints=CA:FALSE
-	    nsComment="OpenSSL Generated Certificate"
-	    subjectKeyIdentifier=hash
-	    authorityKeyIdentifier=keyid,issuer:always
+		# Sign the client certificate request
+		&General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
+
+		#No easy way for specifying the contain of subjectAltName without writing a config file...
+		my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
+		print $fh <<END
+		basicConstraints=CA:FALSE
+		nsComment="OpenSSL Generated Certificate"
+		subjectKeyIdentifier=hash
+		extendedKeyUsage=clientAuth
+		authorityKeyIdentifier=keyid,issuer:always
 END
 ;
-	    print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
-	    close ($fh);
-
-	    my $opt  = " ca -days 999999 -batch -notext";
-	       $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
-	       $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
-	       $opt .= " -extfile $v3extname";
-
-	    if ( $errormessage = &callssl ($opt) ) {
-		unlink ($v3extname);
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		&cleanssldatabase();
-		goto VPNCONF_ERROR;
-	    } else {
-		unlink ($v3extname);
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
-		&cleanssldatabase();
-	    }
-
-	    # Create the pkcs12 file
-	    &General::log("ipsec", "Packing a pkcs12 file...");
-	       $opt  = " pkcs12 -export"; 
-	       $opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
-	       $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
-	       $opt .= " -name \"$cgiparams{'NAME'}\"";
-	       $opt .= " -passout pass:$cgiparams{'CERT_PASS1'}";
-	       $opt .= " -certfile ${General::swroot}/ca/cacert.pem";
-	       $opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\"";
-	       $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12";
-
-	    if ( $errormessage = &callssl ($opt) ) {
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12");
-		goto VPNCONF_ERROR;
-	    } else {
-		unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
-	    }
+		print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
+		close ($fh);
+
+		my $opt = " ca -md sha256 -days 999999 -batch -notext";
+		$opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
+		$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
+		$opt .= " -extfile $v3extname";
+
+		if ( $errormessage = &callssl ($opt) ) {
+			unlink ($v3extname);
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			&cleanssldatabase();
+			goto VPNCONF_ERROR;
+		} else {
+			unlink ($v3extname);
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
+			&cleanssldatabase();
+		}
+
+		# Create the pkcs12 file
+		&General::log("ipsec", "Packing a pkcs12 file...");
+		$opt = " pkcs12 -export";
+		$opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
+		$opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
+		$opt .= " -name \"$cgiparams{'NAME'}\"";
+		$opt .= " -passout pass:$cgiparams{'CERT_PASS1'}";
+		$opt .= " -certfile ${General::swroot}/ca/cacert.pem";
+		$opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\"";
+		$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12";
+
+		if ( $errormessage = &callssl ($opt) ) {
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12");
+			goto VPNCONF_ERROR;
+		} else {
+			unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
+		}
 	} elsif ($cgiparams{'AUTH'} eq 'cert') {
-	    ;# Nothing, just editing
+		;# Nothing, just editing
 	} elsif ($cgiparams{'AUTH'} eq 'auth-dn') {
-	    $cgiparams{'CERT_NAME'} = '%auth-dn';	# a special value saying 'no cert file'	    
+		$cgiparams{'CERT_NAME'} = '%auth-dn'; # a special value saying 'no cert file'
 	} else {
-	    $errormessage = $Lang::tr{'invalid input for authentication method'};
-	    goto VPNCONF_ERROR;
+		$errormessage = $Lang::tr{'invalid input for authentication method'};
+		goto VPNCONF_ERROR;
 	}
 
 	# 1)Error message here is not accurate.
@@ -1774,37 +1766,39 @@ END
 	# 3)Present since initial version (1.3.2.11), it isn't a bug correction
 	# Check if there is no other entry with this certificate name
 	#if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk') && ($cgiparams{'AUTH'} ne 'auth-dn')) {
-	#    foreach my $key (keys %confighash) {
+	#	foreach my $key (keys %confighash) {
 	#	if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
-	#	    $errormessage = $Lang::tr{'a connection with this common name already exists'};
-	#	    goto VPNCONF_ERROR;
+	#		$errormessage = $Lang::tr{'a connection with this common name already exists'};
+	#		goto VPNCONF_ERROR;
+	#	}
 	#	}
-	#    }
 	#}
-        # Save the config
+		# Save the config
 
 	my $key = $cgiparams{'KEY'};
 	if (! $key) {
-	    $key = &General::findhasharraykey (\%confighash);
-	    foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
+		$key = &General::findhasharraykey (\%confighash);
+		foreach my $i (0 .. 32) { $confighash{$key}[$i] = "";}
 	}
 	$confighash{$key}[0] = $cgiparams{'ENABLED'};
 	$confighash{$key}[1] = $cgiparams{'NAME'};
 	if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
-	    $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
+		$confighash{$key}[2] = $cgiparams{'CERT_NAME'};
 	}
 	$confighash{$key}[3] = $cgiparams{'TYPE'};
 	if ($cgiparams{'AUTH'} eq 'psk') {
-	    $confighash{$key}[4] = 'psk';
-	    $confighash{$key}[5] = $cgiparams{'PSK'};
+		$confighash{$key}[4] = 'psk';
+		$confighash{$key}[5] = $cgiparams{'PSK'};
 	} else {
-	    $confighash{$key}[4] = 'cert';
+		$confighash{$key}[4] = 'cert';
 	}
 	if ($cgiparams{'TYPE'} eq 'net') {
-	    $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
+		my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'});
+		$confighash{$key}[11] = join('|', @remote_subnets);
 	}
 	$confighash{$key}[7] = $cgiparams{'LOCAL_ID'};
-	$confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
+	my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'});
+	$confighash{$key}[8] = join('|', @local_subnets);
 	$confighash{$key}[9] = $cgiparams{'REMOTE_ID'};
 	$confighash{$key}[10] = $cgiparams{'REMOTE'};
 	$confighash{$key}[25] = $cgiparams{'REMARK'};
@@ -1812,7 +1806,7 @@ END
 	$confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
 	$confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
 
-	#dont forget advanced value
+	# don't forget advanced value
 	$confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
 	$confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'};
 	$confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'};
@@ -1825,43 +1819,43 @@ END
 	$confighash{$key}[13] = $cgiparams{'COMPRESSION'};
 	$confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
 	$confighash{$key}[28] = $cgiparams{'PFS'};
-	$confighash{$key}[14] = $cgiparams{'VHOST'};
 	$confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
 	$confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
+	$confighash{$key}[32] = $cgiparams{'FORCE_MOBIKE'};
 
-	#free unused fields!
+	# free unused fields!
 	$confighash{$key}[6] = 'off';
 	$confighash{$key}[15] = 'off';
 
 	&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
 	&writeipsecfiles();
 	if (&vpnenabled) {
-	    system('/usr/local/bin/ipsecctrl', 'S', $key);
-	    sleep $sleepDelay;
+		system('/usr/local/bin/ipsecctrl', 'S', $key);
+		sleep $sleepDelay;
 	}
 	if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
-	    $cgiparams{'KEY'} = $key;
-	    $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
+		$cgiparams{'KEY'} = $key;
+		$cgiparams{'ACTION'} = $Lang::tr{'advanced'};
 	}
 	goto VPNCONF_END;
-    } else { # add new connection
-        $cgiparams{'ENABLED'} = 'on';
+} else { # add new connection
+	$cgiparams{'ENABLED'} = 'on';
 	if ( ! -f "${General::swroot}/private/cakey.pem" ) {
-	    $cgiparams{'AUTH'} = 'psk';
+		$cgiparams{'AUTH'} = 'psk';
 	} elsif ( ! -f "${General::swroot}/ca/cacert.pem") {
-	    $cgiparams{'AUTH'} = 'certfile';
+		$cgiparams{'AUTH'} = 'certfile';
 	} else {
-            $cgiparams{'AUTH'} = 'certgen';
+		$cgiparams{'AUTH'} = 'certgen';
 	}
-	$cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
-	$cgiparams{'CERT_EMAIL'} 	= $vpnsettings{'ROOTCERT_EMAIL'};
-	$cgiparams{'CERT_OU'} 		= $vpnsettings{'ROOTCERT_OU'};
-	$cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
-	$cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
-	$cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
-	$cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
+	$cgiparams{'LOCAL_SUBNET'}		= "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
+	$cgiparams{'CERT_EMAIL'}		= $vpnsettings{'ROOTCERT_EMAIL'};
+	$cgiparams{'CERT_OU'}			= $vpnsettings{'ROOTCERT_OU'};
+	$cgiparams{'CERT_ORGANIZATION'}	= $vpnsettings{'ROOTCERT_ORGANIZATION'};
+	$cgiparams{'CERT_CITY'}			= $vpnsettings{'ROOTCERT_CITY'};
+	$cgiparams{'CERT_STATE'}		= $vpnsettings{'ROOTCERT_STATE'};
+	$cgiparams{'CERT_COUNTRY'}		= $vpnsettings{'ROOTCERT_COUNTRY'};
 
-	# choose appropriate dpd action	
+	# choose appropriate dpd action
 	if ($cgiparams{'TYPE'} eq 'host') {
 		$cgiparams{'DPD_ACTION'} = 'clear';
 	} else {
@@ -1876,66 +1870,69 @@ END
 		$cgiparams{'DPD_TIMEOUT'} = 120;
 	}
 
+	if (!$cgiparams{'FORCE_MOBIKE'}) {
+		$cgiparams{'FORCE_MOBIKE'} = 'no';
+	}
+
 	# Default IKE Version to v2
 	if (!$cgiparams{'IKE_VERSION'}) {
-	    $cgiparams{'IKE_VERSION'} = 'ikev2';
+		$cgiparams{'IKE_VERSION'} = 'ikev2';
 	}
 
 	# ID are empty
-	$cgiparams{'LOCAL_ID'}  = '';
+	$cgiparams{'LOCAL_ID'} = '';
 	$cgiparams{'REMOTE_ID'} = '';
 
 	#use default advanced value
-	$cgiparams{'IKE_ENCRYPTION'} = 'aes256|aes192|aes128|3des';	#[18];
-	$cgiparams{'IKE_INTEGRITY'}  = 'sha2_256|sha|md5';	#[19];
-	$cgiparams{'IKE_GROUPTYPE'}  = '4096|3072|2048|1536|1024';		#[20];
-	$cgiparams{'IKE_LIFETIME'}   = '3';		#[16];
-	$cgiparams{'ESP_ENCRYPTION'} = 'aes256|aes192|aes128|3des';	#[21];
-	$cgiparams{'ESP_INTEGRITY'}  = 'sha2_256|sha1|md5';	#[22];
-	$cgiparams{'ESP_GROUPTYPE'}  = '';		#[23];
-	$cgiparams{'ESP_KEYLIFE'}    = '1';		#[17];
-	$cgiparams{'COMPRESSION'}    = 'on';		#[13];
-	$cgiparams{'ONLY_PROPOSED'}  = 'off';		#[24];
-	$cgiparams{'PFS'}	     = 'on';		#[28];
-	$cgiparams{'VHOST'}          = 'on'; 		#[14];
-    }
-
-    VPNCONF_ERROR:
-    $checked{'ENABLED'}{'off'} = '';
-    $checked{'ENABLED'}{'on'} = '';
-    $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
-
-    $checked{'EDIT_ADVANCED'}{'off'} = '';
-    $checked{'EDIT_ADVANCED'}{'on'} = '';
-    $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'";
-
-    $checked{'AUTH'}{'psk'} = '';
-    $checked{'AUTH'}{'certreq'} = '';
-    $checked{'AUTH'}{'certgen'} = '';
-    $checked{'AUTH'}{'certfile'} = '';
-    $checked{'AUTH'}{'pkcs12'} = '';
-    $checked{'AUTH'}{'auth-dn'} = '';
-    $checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'";
-
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', $errormessage);
-    if ($errormessage) {
-	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
-	print "<class name='base'>$errormessage";
-	print " </class>";
-	&Header::closebox();
-    }
+	$cgiparams{'IKE_ENCRYPTION'}	= 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
+	$cgiparams{'IKE_INTEGRITY'}		= 'sha2_512|sha2_256|sha'; #[19];
+	$cgiparams{'IKE_GROUPTYPE'}		= '4096|3072|2048|1536|1024'; #[20];
+	$cgiparams{'IKE_LIFETIME'}		= '3'; #[16];
+	$cgiparams{'ESP_ENCRYPTION'}	= 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
+	$cgiparams{'ESP_INTEGRITY'}		= 'sha2_512|sha2_256|sha1'; #[22];
+	$cgiparams{'ESP_GROUPTYPE'}		= '4096|3072|2048|1536|1024'; #[23];
+	$cgiparams{'ESP_KEYLIFE'}		= '1'; #[17];
+	$cgiparams{'COMPRESSION'}		= 'on'; #[13];
+	$cgiparams{'ONLY_PROPOSED'}		= 'off'; #[24];
+	$cgiparams{'PFS'}				= 'on'; #[28];
+}
 
-    if ($warnmessage) {
-	&Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:");
-	print "<class name='base'>$warnmessage";
-	print " </class>";
-	&Header::closebox();
-    }
+VPNCONF_ERROR:
+	$checked{'ENABLED'}{'off'} = '';
+	$checked{'ENABLED'}{'on'} = '';
+	$checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
+
+	$checked{'EDIT_ADVANCED'}{'off'} = '';
+	$checked{'EDIT_ADVANCED'}{'on'} = '';
+	$checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'";
+
+	$checked{'AUTH'}{'psk'} = '';
+	$checked{'AUTH'}{'certreq'} = '';
+	$checked{'AUTH'}{'certgen'} = '';
+	$checked{'AUTH'}{'certfile'} = '';
+	$checked{'AUTH'}{'pkcs12'} = '';
+	$checked{'AUTH'}{'auth-dn'} = '';
+	$checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'";
+
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', $errormessage);
+	if ($errormessage) {
+		&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
+		print "<class name='base'>$errormessage";
+		print " </class>";
+		&Header::closebox();
+	}
+
+	if ($warnmessage) {
+		&Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:");
+		print "<class name='base'>$warnmessage";
+		print " </class>";
+		&Header::closebox();
+	}
 
-    print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>";
-    print<<END
+	print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>";
+	print<<END
 	<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />
 	<input type='hidden' name='IKE_VERSION' value='$cgiparams{'IKE_VERSION'}' />
 	<input type='hidden' name='IKE_ENCRYPTION' value='$cgiparams{'IKE_ENCRYPTION'}' />
@@ -1949,176 +1946,183 @@ END
 	<input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
 	<input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
 	<input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
-	<input type='hidden' name='VHOST' value='$cgiparams{'VHOST'}' />
 	<input type='hidden' name='DPD_ACTION' value='$cgiparams{'DPD_ACTION'}' />
 	<input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
 	<input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
+	<input type='hidden' name='FORCE_MOBIKE' value='$cgiparams{'FORCE_MOBIKE'}' />
 END
-    ;
-    if ($cgiparams{'KEY'}) {
-	print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
-	print "<input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />";
-	print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
-    }
-
-    &Header::openbox('100%', 'left', "$Lang::tr{'connection'}: $cgiparams{'NAME'}");
-    print "<table width='100%'>";
-    if (!$cgiparams{'KEY'}) {
-    	print <<EOF;
-    		<tr>
-    			<td width='20%'>$Lang::tr{'name'}:</td>
-    			<td width='30%'>
-    				<input type='text' name='NAME' value='$cgiparams{'NAME'}' size='25' />
-    			</td>
-    			<td colspan="2"></td>
-    		</tr>
+;
+	if ($cgiparams{'KEY'}) {
+		print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
+		print "<input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />";
+		print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
+	}
+
+	&Header::openbox('100%', 'left', "$Lang::tr{'connection'}: $cgiparams{'NAME'}");
+	print "<table width='100%'>";
+	if (!$cgiparams{'KEY'}) {
+		print <<EOF;
+			<tr>
+				<td width='20%'>$Lang::tr{'name'}: <img src='/blob.gif' alt='*' /></td>
+				<td width='30%'>
+					<input type='text' name='NAME' value='$cgiparams{'NAME'}' size='25' />
+				</td>
+				<td colspan="2"></td>
+			</tr>
 EOF
-    }
+	}
+
+	my $disabled;
+	my $blob;
+	if ($cgiparams{'TYPE'} eq 'host') {
+		$disabled = "disabled='disabled'";
+	} elsif ($cgiparams{'TYPE'} eq 'net') {
+		$blob = "<img src='/blob.gif' alt='*' />";
+	};
 
-    my $disabled;
-    my $blob;
-    if ($cgiparams{'TYPE'} eq 'host') {
-	$disabled = "disabled='disabled'";
-	$blob = "<img src='/blob.gif' alt='*' />";
-    };
+	my @local_subnets = split(/\|/, $cgiparams{'LOCAL_SUBNET'});
+	my $local_subnets = join(",", @local_subnets);
 
-    print <<END
+	my @remote_subnets = split(/\|/, $cgiparams{'REMOTE_SUBNET'});
+	my $remote_subnets = join(",", @remote_subnets);
+
+	print <<END
 	<tr>
 		<td width='20%'>$Lang::tr{'enabled'}</td>
 		<td width='30%'>
 			<input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} />
 		</td>
-	    <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'local subnet'}</td>
-	    <td width='30%'>
-	        <input type='text' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' size="25" />
-	    </td>
+		<td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'local subnet'} <img src='/blob.gif' alt='*' /></td>
+		<td width='30%'>
+			<input type='text' name='LOCAL_SUBNET' value='$local_subnets' />
+		</td>
 	</tr>
 	<tr>
-	    <td class='boldbase' width='20%'>$Lang::tr{'remote host/ip'}: $blob</td>
-	    <td width='30%'>
-	        <input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size="25" />
-	    </td>
-	    <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'remote subnet'}</td>
-	    <td width='30%'>
-	        <input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size="25" />
-	    </td>
+		<td class='boldbase' width='20%'>$Lang::tr{'remote host/ip'}: $blob</td>
+		<td width='30%'>
+			<input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size="25" />
+		</td>
+		<td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'remote subnet'} $blob</td>
+		<td width='30%'>
+			<input $disabled type='text' name='REMOTE_SUBNET' value='$remote_subnets' />
+		</td>
 	</tr>
 	<tr>
-	    <td class='boldbase' width='20%'>$Lang::tr{'vpn local id'}:</td>
-	    <td width='30%'>
-	    	<input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' size="25" />
-	    </td>
-	    <td class='boldbase' width='20%'>$Lang::tr{'vpn remote id'}:</td>
-	    <td width='30%'>
-	    	<input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' size="25" />
-	    </td>
+		<td class='boldbase' width='20%'>$Lang::tr{'vpn local id'}:</td>
+		<td width='30%'>
+			<input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' size="25" />
+		</td>
+		<td class='boldbase' width='20%'>$Lang::tr{'vpn remote id'}:</td>
+		<td width='30%'>
+			<input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' size="25" />
+		</td>
 	</tr>
 	<tr><td colspan="4"><br /></td></tr>
 	<tr>
-	    <td class='boldbase' width='20%'>$Lang::tr{'remark title'} <img src='/blob.gif' alt='*' /></td>
-	    <td colspan='3'>
-	    	<input type='text' name='REMARK' value='$cgiparams{'REMARK'}' maxlength='50' size="73" />
-	    </td>
-	</tr>
-END
-    ;
-    if (!$cgiparams{'KEY'}) {
-        print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>";
-    }
-    print "</table>";
-    &Header::closebox();
-	
-    if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
-	&Header::openbox('100%', 'left', $Lang::tr{'authentication'});
-	print <<END
-	<table width='100%' cellpadding='0' cellspacing='5' border='0'>
-	<tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
-	    <td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td>
+		<td class='boldbase' width='20%'>$Lang::tr{'remark title'}</td>
+		<td colspan='3'>
+			<input type='text' name='REMARK' value='$cgiparams{'REMARK'}' maxlength='50' size="73" />
+		</td>
 	</tr>
-	</table>
 END
-	;
+;
+	if (!$cgiparams{'KEY'}) {
+		print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>";
+	}
+	print "</table>";
 	&Header::closebox();
-    } elsif (! $cgiparams{'KEY'}) {
-	my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : '';
-        $cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled);
-	my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : '';
 
-	&Header::openbox('100%', 'left', $Lang::tr{'authentication'});
-	print <<END
-	<table width='100%' cellpadding='0' cellspacing='5' border='0'>
-	<tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td>
-	    <td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td>
-	    <td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
-	<tr><td colspan='3' bgcolor='#000000'></td></tr>
-	<tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td>
-	    <td class='base'><hr />$Lang::tr{'upload a certificate request'}</td>
-	    <td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr>
-	<tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td>
-	    <td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
-	<tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td>
-	    <td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr>
-	<tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td>
-	    <td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr>
-	<tr><td colspan='3' bgcolor='#000000'></td></tr>
-	<tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td>
-	    <td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td> </td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'users fullname or system hostname'}:</td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'users email'}: <img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'users department'}: <img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'city'}: <img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'state or province'}: <img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'country'}:</td>
-	    <td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
+	if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
+		&Header::openbox('100%', 'left', $Lang::tr{'authentication'});
+		print <<END
+		<table width='100%' cellpadding='0' cellspacing='5' border='0'>
+		<tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
+			<td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td>
+		</tr>
+		</table>
 END
-	;
-	foreach my $country (sort keys %{Countries::countries}) {
-	    print "\t\t\t<option value='$Countries::countries{$country}'";
-	    if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
-		print " selected='selected'";
-	    }
-	    print ">$country</option>\n";
+;
+		&Header::closebox();
+	} elsif (! $cgiparams{'KEY'}) {
+		my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : '';
+		$cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled);
+		my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : '';
+
+		&Header::openbox('100%', 'left', $Lang::tr{'authentication'});
+		print <<END
+		<table width='100%' cellpadding='0' cellspacing='5' border='0'>
+		<tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td>
+			<td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td>
+			<td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
+		<tr><td colspan='3' bgcolor='#000000'></td></tr>
+		<tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td>
+			<td class='base'><hr />$Lang::tr{'upload a certificate request'}</td>
+			<td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr>
+		<tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td>
+			<td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
+		<tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td>
+			<td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr>
+		<tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td>
+			<td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr>
+		<tr><td colspan='3' bgcolor='#000000'></td></tr>
+		<tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td>
+			<td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td> </td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'users fullname or system hostname'}: <img src='/blob.gif' alt='*' /></td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'users email'}:</td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'users department'}:</td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'city'}:</td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'state or province'}:</td>
+			<td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'country'}:</td>
+			<td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
+END
+;
+		foreach my $country (sort keys %{Countries::countries}) {
+			print "\t\t\t<option value='$Countries::countries{$country}'";
+			if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
+				print " selected='selected'";
+			}
+			print ">$country</option>\n";
+		}
+		print <<END
+			</select></td></tr>
+
+		<tr><td> </td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td>
+			<td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td>
+			<td class='base'>$Lang::tr{'pkcs12 file password'}: <img src='/blob.gif' alt='*' /></td>
+			<td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
+		<tr><td> </td><td class='base'>$Lang::tr{'pkcs12 file password'} ($Lang::tr{'confirmation'}): <img src='/blob.gif' alt='*' /></td>
+			<td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
+		</table>
+END
+;
+		&Header::closebox();
 	}
-	print <<END
-	    </select></td></tr>
 
-	<tr><td> </td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)<img src='/blob.gif' alt='*' /></td>
-	    <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td>
-	    <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
-	    <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
-	<tr><td> </td><td class='base'>$Lang::tr{'pkcs12 file password'}:($Lang::tr{'confirmation'})</td>
-	    <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
-	</table>
-END
-	;
-	&Header::closebox();
-    }
-
-    print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
-    if ($cgiparams{'KEY'}) {
-        print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
-    }
-    print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
-    &Header::closebigbox();
-    &Header::closepage();
-    exit (0);
-    
-    VPNCONF_END:
+	print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
+	if ($cgiparams{'KEY'}) {
+		print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
+	}
+	print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
+	&Header::closebigbox();
+	&Header::closepage();
+	exit (0);
+
+	VPNCONF_END:
 }
 
 ###
@@ -2126,264 +2130,288 @@ END
 ###
 if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 	($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq 'yes')) {
-    &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-    if (! $confighash{$cgiparams{'KEY'}}) {
-	$errormessage = $Lang::tr{'invalid key'};
-	goto ADVANCED_END;
-    }
-
-    if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
-	# I didn't read any incompatibilities here....
-	#if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
-	#    $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
-	#    goto ADVANCED_ERROR;
-	#}
-	my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
-	if ($#temp < 0) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-	foreach my $val (@temp) {
-	    if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
-		$errormessage = $Lang::tr{'invalid input'};
-		goto ADVANCED_ERROR;
-	    }
+	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	if (! $confighash{$cgiparams{'KEY'}}) {
+		$errormessage = $Lang::tr{'invalid key'};
+		goto ADVANCED_END;
+	}
+
+	if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
+		my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		@temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(sha2_(512|384|256)|sha|md5|aesxcbc)$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		@temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) {
+			$errormessage = $Lang::tr{'invalid input for ike lifetime'};
+			goto ADVANCED_ERROR;
+		}
+		if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
+			$errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
+			goto ADVANCED_ERROR;
+		}
+		@temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		@temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(sha2_(512|384|256)|sha1|md5|aesxcbc)$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		@temp = split('\|', $cgiparams{'ESP_GROUPTYPE'});
+		if ($#temp < 0) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+		foreach my $val (@temp) {
+			if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) {
+				$errormessage = $Lang::tr{'invalid input'};
+				goto ADVANCED_ERROR;
+			}
+		}
+		if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
+			$errormessage = $Lang::tr{'invalid input for esp keylife'};
+			goto ADVANCED_ERROR;
+		}
+		if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) {
+			$errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
+			goto ADVANCED_ERROR;
+		}
+
+		if (($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
+			($cgiparams{'FORCE_MOBIKE'} !~ /^(|on|off)$/) ||
+			($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
+			($cgiparams{'PFS'} !~ /^(|on|off)$/)) {
+			$errormessage = $Lang::tr{'invalid input'};
+			goto ADVANCED_ERROR;
+		}
+
+		if ($cgiparams{'DPD_DELAY'} !~ /^\d+$/) {
+			$errormessage = $Lang::tr{'invalid input for dpd delay'};
+			goto ADVANCED_ERROR;
+		}
+
+		if ($cgiparams{'DPD_TIMEOUT'} !~ /^\d+$/) {
+			$errormessage = $Lang::tr{'invalid input for dpd timeout'};
+			goto ADVANCED_ERROR;
+		}
+
+		$confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'};
+		$confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
+		$confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
+		$confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
+		$confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'};
+		$confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'};
+		$confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
+		$confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
+		$confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
+		$confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
+		$confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
+		$confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
+		$confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
+		$confighash{$cgiparams{'KEY'}}[27] = $cgiparams{'DPD_ACTION'};
+		$confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
+		$confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
+		$confighash{$cgiparams{'KEY'}}[32] = $cgiparams{'FORCE_MOBIKE'};
+		&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
+		&writeipsecfiles();
+		if (&vpnenabled) {
+			system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+			sleep $sleepDelay;
+		}
+		goto ADVANCED_END;
+	} else {
+		$cgiparams{'IKE_VERSION'}		= $confighash{$cgiparams{'KEY'}}[29];
+		$cgiparams{'IKE_ENCRYPTION'}	= $confighash{$cgiparams{'KEY'}}[18];
+		$cgiparams{'IKE_INTEGRITY'}		= $confighash{$cgiparams{'KEY'}}[19];
+		$cgiparams{'IKE_GROUPTYPE'}		= $confighash{$cgiparams{'KEY'}}[20];
+		$cgiparams{'IKE_LIFETIME'}		= $confighash{$cgiparams{'KEY'}}[16];
+		$cgiparams{'ESP_ENCRYPTION'}	= $confighash{$cgiparams{'KEY'}}[21];
+		$cgiparams{'ESP_INTEGRITY'}		= $confighash{$cgiparams{'KEY'}}[22];
+		$cgiparams{'ESP_GROUPTYPE'}		= $confighash{$cgiparams{'KEY'}}[23];
+		if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
+			$cgiparams{'ESP_GROUPTYPE'}	= $cgiparams{'IKE_GROUPTYPE'};
+		}
+		$cgiparams{'ESP_KEYLIFE'}		= $confighash{$cgiparams{'KEY'}}[17];
+		$cgiparams{'COMPRESSION'}		= $confighash{$cgiparams{'KEY'}}[13];
+		$cgiparams{'ONLY_PROPOSED'}		= $confighash{$cgiparams{'KEY'}}[24];
+		$cgiparams{'PFS'}				= $confighash{$cgiparams{'KEY'}}[28];
+		$cgiparams{'DPD_ACTION'}		= $confighash{$cgiparams{'KEY'}}[27];
+		$cgiparams{'DPD_TIMEOUT'}		= $confighash{$cgiparams{'KEY'}}[30];
+		$cgiparams{'DPD_DELAY'}			= $confighash{$cgiparams{'KEY'}}[31];
+		$cgiparams{'FORCE_MOBIKE'}		= $confighash{$cgiparams{'KEY'}}[32];
+
+		if (!$cgiparams{'DPD_DELAY'}) {
+			$cgiparams{'DPD_DELAY'} = 30;
+		}
+
+		if (!$cgiparams{'DPD_TIMEOUT'}) {
+			$cgiparams{'DPD_TIMEOUT'} = 120;
+		}
 	}
+
+	ADVANCED_ERROR:
+	$checked{'IKE_ENCRYPTION'}{'aes256'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes192'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes128'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes256gcm128'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes192gcm128'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes128gcm128'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes256gcm96'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes192gcm96'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes128gcm96'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes256gcm64'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes192gcm64'} = '';
+	$checked{'IKE_ENCRYPTION'}{'aes128gcm64'} = '';
+	$checked{'IKE_ENCRYPTION'}{'3des'} = '';
+	$checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
+	$checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
+	$checked{'IKE_ENCRYPTION'}{'camellia128'} = '';
+	my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
+	foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
+	$checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
+	$checked{'IKE_INTEGRITY'}{'sha2_384'} = '';
+	$checked{'IKE_INTEGRITY'}{'sha2_256'} = '';
+	$checked{'IKE_INTEGRITY'}{'sha'} = '';
+	$checked{'IKE_INTEGRITY'}{'md5'} = '';
+	$checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
 	@temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
-	if ($#temp < 0) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-	foreach my $val (@temp) {
-	    if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha|md5|aesxcbc)$/) {
-		$errormessage = $Lang::tr{'invalid input'};
-		goto ADVANCED_ERROR;
-	    }
-	}
+	foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
+	$checked{'IKE_GROUPTYPE'}{'768'} = '';
+	$checked{'IKE_GROUPTYPE'}{'1024'} = '';
+	$checked{'IKE_GROUPTYPE'}{'1536'} = '';
+	$checked{'IKE_GROUPTYPE'}{'2048'} = '';
+	$checked{'IKE_GROUPTYPE'}{'3072'} = '';
+	$checked{'IKE_GROUPTYPE'}{'4096'} = '';
+	$checked{'IKE_GROUPTYPE'}{'6144'} = '';
+	$checked{'IKE_GROUPTYPE'}{'8192'} = '';
 	@temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
-	if ($#temp < 0) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-	foreach my $val (@temp) {
-	    if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
-		$errormessage = $Lang::tr{'invalid input'};
-		goto ADVANCED_ERROR;
-	    }
-	}
-	if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) {
-	    $errormessage = $Lang::tr{'invalid input for ike lifetime'};
-	    goto ADVANCED_ERROR;
-	}
-	if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) {
-	    $errormessage = $Lang::tr{'ike lifetime should be between 1 and 24 hours'};
-	    goto ADVANCED_ERROR;
-	}
+	foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
+
+	# 768 is not supported by strongswan
+	$checked{'IKE_GROUPTYPE'}{'768'} = '';
+
+	$checked{'ESP_ENCRYPTION'}{'aes256'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes192'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes128'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes256gcm128'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes192gcm128'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes128gcm128'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes256gcm96'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes192gcm96'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes128gcm96'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes256gcm64'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes192gcm64'} = '';
+	$checked{'ESP_ENCRYPTION'}{'aes128gcm64'} = '';
+	$checked{'ESP_ENCRYPTION'}{'3des'} = '';
+	$checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
+	$checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
+	$checked{'ESP_ENCRYPTION'}{'camellia128'} = '';
 	@temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
-	if ($#temp < 0) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-	foreach my $val (@temp) {
-	    if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
-		$errormessage = $Lang::tr{'invalid input'};
-		goto ADVANCED_ERROR;
-	    }
-	}
+	foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
+	$checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
+	$checked{'ESP_INTEGRITY'}{'sha2_384'} = '';
+	$checked{'ESP_INTEGRITY'}{'sha2_256'} = '';
+	$checked{'ESP_INTEGRITY'}{'sha1'} = '';
+	$checked{'ESP_INTEGRITY'}{'md5'} = '';
+	$checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
 	@temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
-	if ($#temp < 0) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-	foreach my $val (@temp) {
-	    if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha1|md5|aesxcbc)$/) {
-		$errormessage = $Lang::tr{'invalid input'};
-		goto ADVANCED_ERROR;
-	    }
-	}
-	if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
-	    $cgiparams{'ESP_GROUPTYPE'} !~  /^ecp(192|224|256|384|512)(bp)?$/ &&
-	    $cgiparams{'ESP_GROUPTYPE'} !~  /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) {
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-
-	if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
-	    $errormessage = $Lang::tr{'invalid input for esp keylife'};
-	    goto ADVANCED_ERROR;
-	}
-	if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) {
-	    $errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
-	    goto ADVANCED_ERROR;
-	}
-
-	if (
-	    ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
-	    ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
-	    ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
-	    ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
-	){
-	    $errormessage = $Lang::tr{'invalid input'};
-	    goto ADVANCED_ERROR;
-	}
-
-	if ($cgiparams{'DPD_DELAY'} !~ /^\d+$/) {
-	    $errormessage = $Lang::tr{'invalid input for dpd delay'};
-	    goto ADVANCED_ERROR;
-	}
-
-	if ($cgiparams{'DPD_TIMEOUT'} !~ /^\d+$/) {
-	    $errormessage = $Lang::tr{'invalid input for dpd timeout'};
-	    goto ADVANCED_ERROR;
-	}
-
-	$confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'};
-	$confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
-	$confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
-	$confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
-	$confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'};
-	$confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'};
-	$confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
-	$confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
-	$confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
-	$confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
-	$confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
-	$confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
-	$confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
-	$confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
-	$confighash{$cgiparams{'KEY'}}[27] = $cgiparams{'DPD_ACTION'};
-	$confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
-	$confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
-	&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
-	&writeipsecfiles();
-	if (&vpnenabled) {
-	    system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
-	    sleep $sleepDelay;
-	}
-	goto ADVANCED_END;
-    } else {
-    $cgiparams{'IKE_VERSION'}    = $confighash{$cgiparams{'KEY'}}[29];
-	$cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
-	$cgiparams{'IKE_INTEGRITY'}  = $confighash{$cgiparams{'KEY'}}[19];
-	$cgiparams{'IKE_GROUPTYPE'}  = $confighash{$cgiparams{'KEY'}}[20];
-	$cgiparams{'IKE_LIFETIME'}   = $confighash{$cgiparams{'KEY'}}[16];
-	$cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
-	$cgiparams{'ESP_INTEGRITY'}  = $confighash{$cgiparams{'KEY'}}[22];
-	$cgiparams{'ESP_GROUPTYPE'}  = $confighash{$cgiparams{'KEY'}}[23];
-	$cgiparams{'ESP_KEYLIFE'}    = $confighash{$cgiparams{'KEY'}}[17];
-	$cgiparams{'COMPRESSION'}    = $confighash{$cgiparams{'KEY'}}[13];
-	$cgiparams{'ONLY_PROPOSED'}  = $confighash{$cgiparams{'KEY'}}[24];
-	$cgiparams{'PFS'}  	     = $confighash{$cgiparams{'KEY'}}[28];
-	$cgiparams{'VHOST'}          = $confighash{$cgiparams{'KEY'}}[14];
-	$cgiparams{'DPD_ACTION'}     = $confighash{$cgiparams{'KEY'}}[27];
-	$cgiparams{'DPD_TIMEOUT'}    = $confighash{$cgiparams{'KEY'}}[30];
-	$cgiparams{'DPD_DELAY'}      = $confighash{$cgiparams{'KEY'}}[31];
+	foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
+	$checked{'ESP_GROUPTYPE'}{'768'} = '';
+	$checked{'ESP_GROUPTYPE'}{'1024'} = '';
+	$checked{'ESP_GROUPTYPE'}{'1536'} = '';
+	$checked{'ESP_GROUPTYPE'}{'2048'} = '';
+	$checked{'ESP_GROUPTYPE'}{'3072'} = '';
+	$checked{'ESP_GROUPTYPE'}{'4096'} = '';
+	$checked{'ESP_GROUPTYPE'}{'6144'} = '';
+	$checked{'ESP_GROUPTYPE'}{'8192'} = '';
+	$checked{'ESP_GROUPTYPE'}{'none'} = '';
+	@temp = split('\|', $cgiparams{'ESP_GROUPTYPE'});
+	foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} = "selected='selected'"; }
+
+	$checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
+	$checked{'FORCE_MOBIKE'} = $cgiparams{'FORCE_MOBIKE'} eq 'on' ? "checked='checked'" : '' ;
+	$checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
+	$checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
+
+	$selected{'IKE_VERSION'}{'ikev1'} = '';
+	$selected{'IKE_VERSION'}{'ikev2'} = '';
+	$selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
+
+	$selected{'DPD_ACTION'}{'clear'} = '';
+	$selected{'DPD_ACTION'}{'hold'} = '';
+	$selected{'DPD_ACTION'}{'restart'} = '';
+	$selected{'DPD_ACTION'}{'none'} = '';
+	$selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
 
-	if (!$cgiparams{'DPD_DELAY'}) {
-		$cgiparams{'DPD_DELAY'} = 30;
-	}
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', $errormessage);
 
-	if (!$cgiparams{'DPD_TIMEOUT'}) {
-		$cgiparams{'DPD_TIMEOUT'} = 120;
+	if ($errormessage) {
+		&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
+		print "<class name='base'>$errormessage";
+		print " </class>";
+		&Header::closebox();
 	}
 
-	if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
-	    $cgiparams{'VHOST'}            = 'off';
-	}
-    }
-
-    ADVANCED_ERROR:
-    $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
-    $checked{'IKE_ENCRYPTION'}{'aes192'} = '';
-    $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
-    $checked{'IKE_ENCRYPTION'}{'3des'} = '';
-    $checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
-    $checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
-    $checked{'IKE_ENCRYPTION'}{'camellia128'} = '';
-    my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
-    foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
-    $checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
-    $checked{'IKE_INTEGRITY'}{'sha2_384'} = '';
-    $checked{'IKE_INTEGRITY'}{'sha2_256'} = '';
-    $checked{'IKE_INTEGRITY'}{'sha'} = '';
-    $checked{'IKE_INTEGRITY'}{'md5'} = '';
-    $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
-    @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
-    foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
-    $checked{'IKE_GROUPTYPE'}{'768'} = '';
-    $checked{'IKE_GROUPTYPE'}{'1024'} = '';
-    $checked{'IKE_GROUPTYPE'}{'1536'} = '';
-    $checked{'IKE_GROUPTYPE'}{'2048'} = '';
-    $checked{'IKE_GROUPTYPE'}{'3072'} = '';
-    $checked{'IKE_GROUPTYPE'}{'4096'} = '';
-    $checked{'IKE_GROUPTYPE'}{'6144'} = '';
-    $checked{'IKE_GROUPTYPE'}{'8192'} = '';
-    @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
-    foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
-
-    # 768 is not supported by strongswan
-    $checked{'IKE_GROUPTYPE'}{'768'} = '';
-
-    $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
-    $checked{'ESP_ENCRYPTION'}{'aes192'} = '';
-    $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
-    $checked{'ESP_ENCRYPTION'}{'3des'} = '';
-    $checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
-    $checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
-    $checked{'ESP_ENCRYPTION'}{'camellia128'} = '';
-    @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
-    foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
-    $checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
-    $checked{'ESP_INTEGRITY'}{'sha2_384'} = '';
-    $checked{'ESP_INTEGRITY'}{'sha2_256'} = '';
-    $checked{'ESP_INTEGRITY'}{'sha1'} = '';
-    $checked{'ESP_INTEGRITY'}{'md5'} = '';
-    $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
-    @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
-    foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
-    $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
-
-    $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
-    $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
-    $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
-    $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
-
-    $selected{'IKE_VERSION'}{'ikev1'} = '';
-    $selected{'IKE_VERSION'}{'ikev2'} = '';
-    $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
-
-    $selected{'DPD_ACTION'}{'clear'} = '';
-    $selected{'DPD_ACTION'}{'hold'} = '';
-    $selected{'DPD_ACTION'}{'restart'} = '';
-    $selected{'DPD_ACTION'}{'none'} = '';
-    $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
-
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', $errormessage);
-
-    if ($errormessage) {
-	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
-	print "<class name='base'>$errormessage";
-	print " </class>";
-	&Header::closebox();
-    }
-
-    if ($warnmessage) {
-	&Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
-	print "<class name='base'>$warnmessage";
-	print " </class>";
-	&Header::closebox();
-    }
+	if ($warnmessage) {
+		&Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
+		print "<class name='base'>$warnmessage";
+		print " </class>";
+		&Header::closebox();
+	}
 
-    &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
-    print <<EOF
-    <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
-    <input type='hidden' name='ADVANCED' value='yes' />
-    <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
+	&Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
+	print <<EOF
+	<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
+	<input type='hidden' name='ADVANCED' value='yes' />
+	<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
 
-    <table width='100%'>
+	<table width='100%'>
 	<thead>
 		<tr>
 			<th width="15%"></th>
@@ -2406,24 +2434,42 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 			<td class='boldbase' width="15%">$Lang::tr{'encryption'}</td>
 			<td class='boldbase'>
 				<select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
-					<option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
-					<option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
-					<option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
-					<option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>3DES</option>
-					<option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
-					<option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
-					<option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
+					<option value='aes256gcm128' $checked{'IKE_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
+					<option value='aes256gcm96' $checked{'IKE_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
+					<option value='aes256gcm64' $checked{'IKE_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
+					<option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
+					<option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
+					<option value='aes192gcm128' $checked{'IKE_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
+					<option value='aes192gcm96' $checked{'IKE_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
+					<option value='aes192gcm64' $checked{'IKE_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
+					<option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
+					<option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
+					<option value='aes128gcm128' $checked{'IKE_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
+					<option value='aes128gcm96' $checked{'IKE_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
+					<option value='aes128gcm64' $checked{'IKE_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
+					<option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
+					<option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
+					<option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
 				</select>
 			</td>
 			<td class='boldbase'>
 				<select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
-					<option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
-					<option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
-					<option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
-					<option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>3DES</option>
-					<option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
-					<option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
-					<option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
+					<option value='aes256gcm128' $checked{'ESP_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
+					<option value='aes256gcm96' $checked{'ESP_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
+					<option value='aes256gcm64' $checked{'ESP_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
+					<option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
+					<option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
+					<option value='aes192gcm128' $checked{'ESP_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
+					<option value='aes192gcm96' $checked{'ESP_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
+					<option value='aes192gcm64' $checked{'ESP_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
+					<option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
+					<option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
+					<option value='aes128gcm128' $checked{'ESP_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
+					<option value='aes128gcm96' $checked{'ESP_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
+					<option value='aes128gcm64' $checked{'ESP_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
+					<option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
+					<option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
+					<option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
 				</select>
 			</td>
 		</tr>
@@ -2435,9 +2481,9 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 					<option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
 					<option value='sha2_384' $checked{'IKE_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
 					<option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
+					<option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
 					<option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA1</option>
 					<option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5</option>
-					<option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
 				</select>
 			</td>
 			<td class='boldbase'>
@@ -2445,14 +2491,14 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 					<option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
 					<option value='sha2_384' $checked{'ESP_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
 					<option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
+					<option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
 					<option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1</option>
 					<option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5</option>
-					<option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
 				</select>
 			</td>
 		</tr>
 		<tr>
-			<td class='boldbase' width="15%">$Lang::tr{'lifetime'}</td>
+			<td class='boldbase' width="15%">$Lang::tr{'lifetime'} <img src='/blob.gif' alt='*' /></td>
 			<td class='boldbase'>
 				<input type='text' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' size='5' /> $Lang::tr{'hours'}
 			</td>
@@ -2465,14 +2511,14 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 			<td class='boldbase'>
 				<select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
 					<option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
-					<option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
-					<option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
-					<option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
-					<option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
 					<option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
+					<option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
 					<option value='e384bp' $checked{'IKE_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
+					<option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
 					<option value='e256bp' $checked{'IKE_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
+					<option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
 					<option value='e224bp' $checked{'IKE_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
+					<option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
 					<option value='8192' $checked{'IKE_GROUPTYPE'}{'8192'}>MODP-8192</option>
 					<option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
 					<option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
@@ -2485,17 +2531,40 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 					<option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
 				</select>
 			</td>
-			<td></td>
+			<td class='boldbase'>
+				<select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
+					<option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
+					<option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
+					<option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
+					<option value='e384bp' $checked{'ESP_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
+					<option value='e256' $checked{'ESP_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
+					<option value='e256bp' $checked{'ESP_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
+					<option value='e224' $checked{'ESP_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
+					<option value='e224bp' $checked{'ESP_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
+					<option value='e192' $checked{'ESP_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
+					<option value='8192' $checked{'ESP_GROUPTYPE'}{'8192'}>MODP-8192</option>
+					<option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option>
+					<option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option>
+					<option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option>
+					<option value='2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
+					<option value='2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
+					<option value='2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>
+					<option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option>
+					<option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option>
+					<option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024</option>
+					<option value='none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{'none'} -</option>
+				</select>
+			</td>
 		</tr>
 	</tbody>
-    </table>
+	</table>
 
 	<br><br>
 
 	<h2>$Lang::tr{'dead peer detection'}</h2>
 
-    <table width="100%">
-    <tr>
+	<table width="100%">
+	<tr>
 		<td width="15%">$Lang::tr{'dpd action'}:</td>
 		<td>
 			<select name='DPD_ACTION'>
@@ -2507,22 +2576,22 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 		</td>
 	</tr>
 	<tr>
-		<td width="15%">$Lang::tr{'dpd timeout'}:</td>
+		<td width="15%">$Lang::tr{'dpd timeout'}: <img src='/blob.gif' alt='*' /></td>
 		<td>
 			<input type='text' name='DPD_TIMEOUT' size='5' value='$cgiparams{'DPD_TIMEOUT'}' />
 		</td>
 	</tr>
 	<tr>
-		<td width="15%">$Lang::tr{'dpd delay'}:</td>
+		<td width="15%">$Lang::tr{'dpd delay'}: <img src='/blob.gif' alt='*' /></td>
 		<td>
 			<input type='text' name='DPD_DELAY' size='5' value='$cgiparams{'DPD_DELAY'}' />
 		</td>
 	</tr>
-    </table>
+	</table>
 
-    <hr>
+	<hr>
 
-    <table width="100%">
+	<table width="100%">
 	<tr>
 		<td>
 			<label>
@@ -2547,77 +2616,77 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 			</label>
 		</td>
 	</tr>
+	<tr>
+		<td>
+			<label>
+				<input type='checkbox' name='FORCE_MOBIKE' $checked{'FORCE_MOBIKE'} />
+				$Lang::tr{'vpn force mobike'}
+			</label>
+		</td>
+	</tr>
 EOF
-    ;
-    if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
-	print "<tr><td><input type='hidden' name='VHOST' value='off' /></td></tr>";
-    } elsif ($confighash{$cgiparams{'KEY'}}[10]) {
-	print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} disabled='disabled' />";
-	print " $Lang::tr{'vpn vhost'}</label></td></tr>";
-    } else {
-	print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} />";
-	print " $Lang::tr{'vpn vhost'}</label></td></tr>";
-    }
-
-    print <<EOF;
+;
+
+	print <<EOF;
 	<tr>
+		<td align='left' colspan='1'><img src='/blob.gif' align='top' alt='*' /> $Lang::tr{'required field'}</td>
 		<td align='right' colspan='2'>
 			<input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
 			<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' />
 		</td>
 	</tr>
-    </table></form>
+	</table></form>
 EOF
 
-    &Header::closebox();
-    &Header::closebigbox();
-    &Header::closepage();
-    exit(0);
+	&Header::closebox();
+	&Header::closebigbox();
+	&Header::closepage();
+	exit(0);
 
-    ADVANCED_END:
+	ADVANCED_END:
 }
 
 ###
 ### Default status page
 ###
-    %cgiparams = ();
-    %cahash = ();
-    %confighash = ();
-    &General::readhash("${General::swroot}/vpn/settings", \%cgiparams);
-    &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
-    &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
-    $cgiparams{'CA_NAME'} = '';
-
-    my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
-
-    # suggest a default name for this side
-    if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
-	if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
-	    my $ipaddr = <IPADDR>;
-	    close IPADDR;
-	    chomp ($ipaddr);
-	    $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
-	    if ($cgiparams{'VPN_IP'} eq '') {
-		$cgiparams{'VPN_IP'} = $ipaddr;
-	    }
-	}
-    }
-    # no IP found, use %defaultroute
-    $cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq '');
-    
-    $cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'}));
-    $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
-
-    &Header::showhttpheaders();
-    &Header::openpage($Lang::tr{'ipsec'}, 1, '');
-    &Header::openbigbox('100%', 'left', '', $errormessage);
-
-    if ($errormessage) {
-	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
-	print "<class name='base'>$errormessage\n";
-	print " </class>\n";
-	&Header::closebox();
-    }
+	%cgiparams = ();
+	%cahash = ();
+	%confighash = ();
+	&General::readhash("${General::swroot}/vpn/settings", \%cgiparams);
+	&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
+	&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+	$cgiparams{'CA_NAME'} = '';
+
+	my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
+
+	# suggest a default name for this side
+	if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
+		if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
+			my $ipaddr = <IPADDR>;
+			close IPADDR;
+			chomp ($ipaddr);
+			$cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
+			if ($cgiparams{'VPN_IP'} eq '') {
+				$cgiparams{'VPN_IP'} = $ipaddr;
+			}
+		}
+	}
+	# no IP found, use %defaultroute
+	$cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq '');
+
+	$cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'}));
+	$checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
+
+	&Header::showhttpheaders();
+	&Header::openpage($Lang::tr{'ipsec'}, 1, '');
+	&Header::openbigbox('100%', 'left', '', $errormessage);
+
+	if ($errormessage) {
+		&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
+		print "<class name='base'>$errormessage\n";
+		print " </class>\n";
+		&Header::closebox();
+	}
 
 	if ($warnmessage) {
 		&Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
@@ -2629,61 +2698,61 @@ EOF
 		exit 0;
 	}
 
-    &Header::openbox('100%', 'left', $Lang::tr{'global settings'});
-    print <<END
-    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-    <table width='100%'>
-    <tr>
-	<td width='20%' class='base' nowrap='nowrap'>$Lang::tr{'vpn red name'}:</td>
+	&Header::openbox('100%', 'left', $Lang::tr{'global settings'});
+	print <<END
+	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+	<table width='100%'>
+	<tr>
+	<td width='20%' class='base' nowrap='nowrap'>$Lang::tr{'vpn red name'}: <img src='/blob.gif' alt='*' /></td>
 	<td width='20%'><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' /></td>
 	<td width='20%' class='base'>$Lang::tr{'enabled'}<input type='checkbox' name='ENABLED' $checked{'ENABLED'} /></td>
-    </tr>
+	</tr>
 END
-    ;
+;
 print <<END
-    <tr>
-	<td  class='base' nowrap='nowrap'>$Lang::tr{'vpn delayed start'}: <img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /></td>
+	<tr>
+	<td class='base' nowrap='nowrap'>$Lang::tr{'vpn delayed start'}: <img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /></td>
 	<td ><input type='text' name='VPN_DELAYED_START' value='$cgiparams{'VPN_DELAYED_START'}' /></td>
-    </tr>
-    <tr>
-	<td  class='base' nowrap='nowrap'>$Lang::tr{'host to net vpn'}: <img src='/blob.gif' alt='*' /></td>
+	</tr>
+	<tr>
+	<td class='base' nowrap='nowrap'>$Lang::tr{'host to net vpn'}:</td>
 	<td ><input type='text' name='RW_NET' value='$cgiparams{'RW_NET'}' /></td>
-    </tr>
+	</tr>
 </table>
 <br>
 <hr />
 <table width='100%'>
 <tr>
-    <td class='base' valign='top'><img src='/blob.gif' alt='*' /></td>
-    <td width='70%' class='base' valign='top'>$Lang::tr{'this field may be blank'}</td><td width='30%' align='right' class='base'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
+	<td class='base' valign='top'><img src='/blob.gif' alt='*' /></td>
+	<td width='70%' class='base' valign='top'>$Lang::tr{'required field'}</td><td width='30%' align='right' class='base'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 </tr>
 <tr>
-    <td class='base' valign='top' nowrap='nowrap'><img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /> </td>
-    <td class='base'>	<font class='base'>$Lang::tr{'vpn delayed start help'}</font></td>
-    <td></td>
+	<td class='base' valign='top' nowrap='nowrap'><img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /> </td>
+	<td class='base'>	<font class='base'>$Lang::tr{'vpn delayed start help'}</font></td>
+	<td></td>
 </tr>
 </table>
 END
-;	        
-    print "</form>";
-    &Header::closebox();
-
-    &Header::openbox('100%', 'left', $Lang::tr{'connection status and controlc'});
-    print <<END
-    <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
-    <tr>
+;
+	print "</form>";
+	&Header::closebox();
+
+	&Header::openbox('100%', 'left', $Lang::tr{'connection status and controlc'});
+	print <<END
+	<table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
+	<tr>
 	<th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
 	<th width='22%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
 	<th width='23%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></th>
 	<th width='30%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
 	<th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
 	<th class='boldbase' align='center' colspan='6'><b>$Lang::tr{'action'}</b></th>
-    </tr>
+	</tr>
 END
-    ;
-    my $id = 0;
-    my $gif;
-    foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
+;
+	my $id = 0;
+	my $gif;
+	foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
 	if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
 
 	if ($id % 2) {
@@ -2696,299 +2765,369 @@ END
 	print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
 	print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ") $confighash{$key}[29]</td>";
 	if ($confighash{$key}[2] eq '%auth-dn') {
-	    print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>";
+		print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>";
 	} elsif ($confighash{$key}[4] eq 'cert') {
-	    print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>";
+		print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>";
 	} else {
-	    print "<td align='left' $col> </td>";
+		print "<td align='left' $col> </td>";
 	}
 	print "<td align='center' $col>$confighash{$key}[25]</td>";
 	my $col1="bgcolor='${Header::colourred}'";
 	# get real state
 	my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
 	foreach my $line (@status) {
-	    if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
-	       ($line =~ /$confighash{$key}[1]\{.*INSTALLED/))
-	    {
-		$col1="bgcolor='${Header::colourgreen}'";
-		$active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
-	    }
-	}
-	# move to blueif really down
+		if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
+		($line =~ /$confighash{$key}[1]\{.*INSTALLED/)) {
+			$col1="bgcolor='${Header::colourgreen}'";
+			$active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
+		}
+	}
+	# move to blue if really down
 	if ($confighash{$key}[0] eq 'off' && $col1 =~ /${Header::colourred}/ ) {
 		$col1="bgcolor='${Header::colourblue}'";
-	    $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
+		$active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
 	}
 	print <<END
 	<td align='center' $col1>$active</td>
 	<td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='image'  name='$Lang::tr{'restart'}' src='/images/reload.gif' alt='$Lang::tr{'restart'}' title='$Lang::tr{'restart'}' />
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'restart'}' />
-	    <input type='hidden' name='KEY' value='$key' />
-	    </form>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		<input type='image' name='$Lang::tr{'restart'}' src='/images/reload.gif' alt='$Lang::tr{'restart'}' title='$Lang::tr{'restart'}' />
+		<input type='hidden' name='ACTION' value='$Lang::tr{'restart'}' />
+		<input type='hidden' name='KEY' value='$key' />
+		</form>
 	</td>
 END
-	;
+;
 	if (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
-	    print <<END
-	    <td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		print <<END
+		<td align='center' $col>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
 		<input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' />
 		<input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
 		<input type='hidden' name='KEY' value='$key' />
-	    </form>
-	    </td>
+		</form>
+		</td>
 END
-	; } else {
-	    print "<td width='2%' $col> </td>";
+;
+	} else {
+		print "<td width='2%' $col> </td>";
 	}
-	if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") { 
-	    print <<END
-	    <td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+	if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") {
+		print <<END
+		<td align='center' $col>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
 		<input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/floppy.gif' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' />
 		<input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
 		<input type='hidden' name='KEY' value='$key' />
-	    </form>
+		</form>
 	</td>
 END
-	; } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
-	    print <<END
-	    <td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+;
+	} elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
+		print <<END
+		<td align='center' $col>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
 		<input type='image' name='$Lang::tr{'download certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' />
 		<input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
 		<input type='hidden' name='KEY' value='$key' />
-	    </form>
+		</form>
 	</td>
 END
-	; } else {
-	    print "<td width='2%' $col> </td>";
+;
+	} else {
+		print "<td width='2%' $col> </td>";
 	}
 	print <<END
 	<td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' />
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
-	    <input type='hidden' name='KEY' value='$key' />
-	    </form>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		<input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' />
+		<input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
+		<input type='hidden' name='KEY' value='$key' />
+		</form>
 	</td>
 
 	<td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
-	    <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
-	    <input type='hidden' name='KEY' value='$key' />
-	    </form>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		<input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
+		<input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
+		<input type='hidden' name='KEY' value='$key' />
+		</form>
 	</td>
 	<td align='center' $col>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
-	    <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' />
-	    <input type='hidden' name='KEY' value='$key' />
-	    </form>
+		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+		<input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
+		<input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' />
+		<input type='hidden' name='KEY' value='$key' />
+		</form>
 	</td>
 	</tr>
 END
-	;
+;
 	$id++;
-    }
-    print "</table>";
-
-    # If the config file contains entries, print Key to action icons
-    if ( $id ) {
-    print <<END
-    <table>
-    <tr>
-	<td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td>
-	<td>  <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
-	<td class='base'>$Lang::tr{'click to disable'}</td>
-	<td>    <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
-	<td class='base'>$Lang::tr{'show certificate'}</td>
-	<td>    <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
-	<td class='base'>$Lang::tr{'edit'}</td>
-	<td>    <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
-	<td class='base'>$Lang::tr{'remove'}</td>
-    </tr>
-    <tr>
-	<td>  </td>
-	<td>  <img src='/images/off.gif' alt='?OFF' /></td>
-	<td class='base'>$Lang::tr{'click to enable'}</td>
-	<td>    <img src='/images/floppy.gif' alt='?FLOPPY' /></td>
-	<td class='base'>$Lang::tr{'download certificate'}</td>
-	<td>    <img src='/images/reload.gif' alt='?RELOAD'/></td>
-	<td class='base'>$Lang::tr{'restart'}</td>
-    </tr>
-    </table>
+	}
+	print "</table>";
+
+	# If the config file contains entries, print Key to action icons
+	if ( $id ) {
+		print <<END
+		<table>
+		<tr>
+		<td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td>
+		<td>  <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
+		<td class='base'>$Lang::tr{'click to disable'}</td>
+		<td>    <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
+		<td class='base'>$Lang::tr{'show certificate'}</td>
+		<td>    <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
+		<td class='base'>$Lang::tr{'edit'}</td>
+		<td>    <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
+		<td class='base'>$Lang::tr{'remove'}</td>
+		</tr>
+		<tr>
+		<td>  </td>
+		<td>  <img src='/images/off.gif' alt='?OFF' /></td>
+		<td class='base'>$Lang::tr{'click to enable'}</td>
+		<td>    <img src='/images/floppy.gif' alt='?FLOPPY' /></td>
+		<td class='base'>$Lang::tr{'download certificate'}</td>
+		<td>    <img src='/images/reload.gif' alt='?RELOAD'/></td>
+		<td class='base'>$Lang::tr{'restart'}</td>
+		</tr>
+		</table>
 END
-    ;
-    }
+;
+	}
 
-    print <<END
-    <table width='100%'>
-    <tr><td align='right' colspan='9'>
+	print <<END
+	<table width='100%'>
+	<tr><td align='right' colspan='9'>
 	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
 	<input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
 	</form>
-    </td></tr>
-    </table>
+	</td></tr>
+	</table>
 END
-    ;
-    &Header::closebox();
+;
+	&Header::closebox();
 
-    &Header::openbox('100%', 'left', "$Lang::tr{'certificate authorities'}");
-    print <<EOF
-    <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
-    <tr>
+	&Header::openbox('100%', 'left', "$Lang::tr{'certificate authorities'}");
+	print <<EOF
+	<table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
+	<tr>
 	<th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
 	<th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
 	<th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
-    </tr>
+	</tr>
 EOF
-    ;
-    my $col1="bgcolor='$color{'color22'}'";
+;
+	my $col1="bgcolor='$color{'color22'}'";
 	my $col2="bgcolor='$color{'color20'}'";
-    if (-f "${General::swroot}/ca/cacert.pem") {
-	my $casubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/cacert.pem"));
-	print <<END
-	<tr>
-	<td class='base' $col1>$Lang::tr{'root certificate'}</td>
-	<td class='base' $col1>$casubject</td>
-	<td width='3%' align='center' $col1>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
-	    <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' />
-	    </form>
-	</td>
-	<td width='3%' align='center' $col1>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' />
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
-	    </form>
-	</td>
-	<td width='4%' $col1> </td></tr>
+	if (-f "${General::swroot}/ca/cacert.pem") {
+		my $casubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/cacert.pem"));
+		print <<END
+		<tr>
+		<td class='base' $col1>$Lang::tr{'root certificate'}</td>
+		<td class='base' $col1>$casubject</td>
+		<td width='3%' align='center' $col1>
+			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
+			<input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' />
+			</form>
+		</td>
+		<td width='3%' align='center' $col1>
+			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='image' name='$Lang::tr{'download root certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' />
+			<input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
+			</form>
+		</td>
+		<td width='4%' $col1> </td></tr>
 END
-	;
-    } else {
-	# display rootcert generation buttons
-	print <<END
-	<tr>
-	<td class='base' $col1>$Lang::tr{'root certificate'}:</td>
-	<td class='base' $col1>$Lang::tr{'not present'}</td>
-	<td colspan='3' $col1> </td></tr>
+;
+	} else {
+		# display rootcert generation buttons
+		print <<END
+		<tr>
+		<td class='base' $col1>$Lang::tr{'root certificate'}:</td>
+		<td class='base' $col1>$Lang::tr{'not present'}</td>
+		<td colspan='3' $col1> </td></tr>
 END
-	;
-    }
+;
+	}
 
-    if (-f "${General::swroot}/certs/hostcert.pem") {
-	my $hostsubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/certs/hostcert.pem"));
+	if (-f "${General::swroot}/certs/hostcert.pem") {
+		my $hostsubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/certs/hostcert.pem"));
 
-	print <<END
-	<tr>
-	<td class='base' $col2>$Lang::tr{'host certificate'}</td>
-	<td class='base' $col2>$hostsubject</td>
-	<td width='3%' align='center' $col2>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
-	    <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' />
-	    </form>
-	</td>
-	<td width='3%' align='center' $col2>
-	    <form method='post' action='$ENV{'SCRIPT_NAME'}'>
-	    <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/floppy.gif' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" />
-	    <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
-	    </form>
-	</td>
-	<td width='4%' $col2> </td></tr>
+		print <<END
+		<tr>
+		<td class='base' $col2>$Lang::tr{'host certificate'}</td>
+		<td class='base' $col2>$hostsubject</td>
+		<td width='3%' align='center' $col2>
+			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
+			<input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' />
+			</form>
+		</td>
+		<td width='3%' align='center' $col2>
+			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='image' name="$Lang::tr{'download host certificate'}" src='/images/floppy.gif' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" />
+			<input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
+			</form>
+		</td>
+		<td width='4%' $col2> </td></tr>
 END
-	;
-    } else {
-	# Nothing
-	print <<END
-	<tr>
-	<td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
-	<td class='base' $col2>$Lang::tr{'not present'}</td>
-	<td colspan='3' $col2> </td></tr>
+;
+	} else {
+		# Nothing
+		print <<END
+		<tr>
+		<td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
+		<td class='base' $col2>$Lang::tr{'not present'}</td>
+		<td colspan='3' $col2> </td></tr>
 END
-	;
-    }
- 
+;
+	}
+
 	my $rowcolor = 0;
 	if (keys %cahash > 0) {
 		foreach my $key (keys %cahash) {
-			if ($rowcolor++ % 2) {
-				print "<tr>";
-				$col="bgcolor='$color{'color20'}'";
-			} else {
-				print "<tr>";
-				$col="bgcolor='$color{'color22'}'";
-			}
-	    print "<td class='base' $col>$cahash{$key}[0]</td>\n";
-	    print "<td class='base' $col>$cahash{$key}[1]</td>\n";
-	    print <<END
-	    <td align='center' $col>
-		<form method='post' name='cafrm${key}a' action='$ENV{'SCRIPT_NAME'}'>
-		<input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' />
-		<input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
-		<input type='hidden' name='KEY' value='$key' />
-		</form>
-	    </td>
-	    <td align='center' $col>
-		<form method='post' name='cafrm${key}b' action='$ENV{'SCRIPT_NAME'}'>
-		<input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' />
-		<input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
-		<input type='hidden' name='KEY' value='$key' />
-		</form>
-	    </td>
-	    <td align='center' $col>
-		<form method='post' name='cafrm${key}c' action='$ENV{'SCRIPT_NAME'}'>
-		<input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
-		<input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' />
-		<input type='hidden' name='KEY' value='$key' />
-		</form>
-	    </td>
-	    </tr>
+				if ($rowcolor++ % 2) {
+					print "<tr>";
+					$col="bgcolor='$color{'color20'}'";
+				} else {
+					print "<tr>";
+					$col="bgcolor='$color{'color22'}'";
+				}
+			print "<td class='base' $col>$cahash{$key}[0]</td>\n";
+			print "<td class='base' $col>$cahash{$key}[1]</td>\n";
+			print <<END
+			<td align='center' $col>
+			<form method='post' name='cafrm${key}a' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' />
+			<input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
+			<input type='hidden' name='KEY' value='$key' />
+			</form>
+			</td>
+			<td align='center' $col>
+			<form method='post' name='cafrm${key}b' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' />
+			<input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
+			<input type='hidden' name='KEY' value='$key' />
+			</form>
+			</td>
+			<td align='center' $col>
+			<form method='post' name='cafrm${key}c' action='$ENV{'SCRIPT_NAME'}'>
+			<input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
+			<input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' />
+			<input type='hidden' name='KEY' value='$key' />
+			</form>
+			</td>
+			</tr>
 END
-	    ;
+;
+		}
 	}
-    }
-    print "</table>";
-
-    # If the file contains entries, print Key to action icons
-    if ( -f "${General::swroot}/ca/cacert.pem") {
-	print <<END
-	<table><tr>
-	<td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td>
-	<td>    <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
-	<td class='base'>$Lang::tr{'show certificate'}</td>
-	<td>    <img src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' /></td>
-	<td class='base'>$Lang::tr{'download certificate'}</td>
-	</tr></table>
+	print "</table>";
+
+	# If the file contains entries, print Key to action icons
+	if ( -f "${General::swroot}/ca/cacert.pem") {
+		print <<END
+		<table><tr>
+		<td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td>
+		<td>    <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
+		<td class='base'>$Lang::tr{'show certificate'}</td>
+		<td>    <img src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' /></td>
+		<td class='base'>$Lang::tr{'download certificate'}</td>
+		</tr></table>
 END
-	;
-    }
-    my $createCA = -f "${General::swroot}/ca/cacert.pem" ? '' : "<tr><td colspan='3'></td><td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td></tr>";
-    print <<END
-    <br>
-    <hr />
-    <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
-    <table width='100%' border='0' cellspacing='1' cellpadding='0'>
-    $createCA
-    <tr>
-	<td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
+;
+	}
+	my $createCA = -f "${General::swroot}/ca/cacert.pem" ? '' : "<tr><td colspan='3'></td><td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td></tr>";
+	print <<END
+	<br>
+	<hr />
+	<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
+	<table width='100%' border='0' cellspacing='1' cellpadding='0'>
+	$createCA
+	<tr>
+	<td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}: <img src='/blob.gif' alt='*' /></td>
 	<td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' /> </td>
 	<td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
 	<td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td>
-    </tr>
-    <tr>
+	</tr>
+	<tr>
 	<td colspan='3'>$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}:</td>
 	<td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></td>
-    </tr>
-    </table>
-    </form>
+	</tr>
+	</table>
+	</form>
 END
-    ;
-    &Header::closebox();
-    &Header::closebigbox();
-    &Header::closepage();
+;
+	&Header::closebox();
+	&Header::closebigbox();
+	&Header::closepage();
+
+sub array_unique($) {
+	my $array = shift;
+	my @unique = ();
+
+	my %seen = ();
+	foreach my $e (@$array) {
+		next if $seen{$e}++;
+		push(@unique, $e);
+	}
+
+	return @unique;
+}
+
+sub make_algos($$$$$) {
+	my ($mode, $encs, $ints, $grps, $pfs) = @_;
+	my @algos = ();
+
+	foreach my $enc (@$encs) {
+		foreach my $int (@$ints) {
+			foreach my $grp (@$grps) {
+				my @algo = ($enc);
+
+				if ($mode eq "ike") {
+					push(@algo, $int);
+
+					if ($grp =~ m/^e(.*)$/) {
+						push(@algo, "ecp$1");
+					} else {
+						push(@algo, "modp$grp");
+					}
+
+				} elsif ($mode eq "esp" && $pfs) {
+					my $is_aead = ($enc =~ m/[cg]cm/);
+
+					if (!$is_aead) {
+						push(@algo, $int);
+					}
+
+					if ($grp eq "none") {
+						# noop
+					} elsif ($grp =~ m/^e(.*)$/) {
+						push(@algo, "ecp$1");
+					} else {
+						push(@algo, "modp$grp");
+					}
+				}
+
+				push(@algos, join("-", @algo));
+			}
+		}
+	}
+
+	return &array_unique(\@algos);
+}
+
+sub make_subnets($) {
+	my $subnets = shift;
+
+	my @nets = split(/\|/, $subnets);
+	my @cidr_nets = ();
+	foreach my $net (@nets) {
+		my $cidr_net = &General::ipcidr($net);
+		push(@cidr_nets, $cidr_net);
+	}
+
+	return join(",", @cidr_nets);
+}
diff --git a/html/cgi-bin/wakeonlan.cgi b/html/cgi-bin/wakeonlan.cgi
index 4a7fc84f0d..bb55add70f 100644
--- a/html/cgi-bin/wakeonlan.cgi
+++ b/html/cgi-bin/wakeonlan.cgi
@@ -232,7 +232,7 @@ else
 print <<END
 <table width='100%'>
 <tr>
-  <td width='15%' class='base'>$Lang::tr{'mac address'}: </td>
+  <td width='15%' class='base'>$Lang::tr{'mac address'}: <img src='/blob.gif' alt='*' /></td>
   <td width='40%'><input type='text' name='CLIENT_MAC' value='$cgiparams{'CLIENT_MAC'}' size='25' /></td>
   <td width='10%' class='base'>$Lang::tr{'interface'}: </td>
   <td align='left'>
@@ -256,7 +256,7 @@ print <<END
   </td>
 </tr>
 <tr>
-  <td width='15%' class='base'>$Lang::tr{'remark'}: <img src='/blob.gif' alt='*' /></td>
+  <td width='15%' class='base'>$Lang::tr{'remark'}:</td>
   <td colspan='4' align='left'><input type='text' name='CLIENT_COMMENT' value='$cgiparams{'CLIENT_COMMENT'}' size='40' /></td>
 </tr>
 </table>
@@ -264,7 +264,7 @@ print <<END
 <hr />
 <table width='100%'>
 <tr>
-  <td class='base' valign='top'><img src='/blob.gif' alt='*' />$Lang::tr{'this field may be blank'}</td>
+  <td class='base' valign='top'><img src='/blob.gif' alt='*' />$Lang::tr{'required field'}</td>
   <td width='40%' align='right'>
 END
 ;
diff --git a/html/cgi-bin/webaccess.cgi b/html/cgi-bin/webaccess.cgi
index b38171762d..afa3770cf9 100644
--- a/html/cgi-bin/webaccess.cgi
+++ b/html/cgi-bin/webaccess.cgi
@@ -30,7 +30,6 @@ my $acl_src_noaccess_mac = "$apdir/acls/src_noaccess_mac.acl";
 
 my $banner = "A D V A N C E D   P R O X Y   -   W E B   A C C E S S   M A N A G E R";
 my %cgiparams;
-my %mainsettings;
 my %proxysettings;
 
 my %acl=();
@@ -38,18 +37,10 @@ my @group_defs=();
 my @groups=();
 
 ### Initialize environment
-&readhash("${swroot}/main/settings", \%mainsettings);
 &readhash("${swroot}/proxy/advanced/settings", \%proxysettings);
-$language = $mainsettings{'LANGUAGE'};
 
 ### Initialize language
-if ($language =~ /^(\w+)$/) {$language = $1;}
- #
- # Uncomment this to force a certain language:
- # $language='en';
- #
-require "${swroot}/langs/en.pl";
-require "${swroot}/langs/${language}.pl";
+require "${swroot}/lang.pl";
 
 &getcgihash(\%cgiparams);
 
diff --git a/html/cgi-bin/wireless.cgi b/html/cgi-bin/wireless.cgi
index 358f318df0..d4592a2a47 100644
--- a/html/cgi-bin/wireless.cgi
+++ b/html/cgi-bin/wireless.cgi
@@ -211,17 +211,17 @@ if ($cgiparams{'ACTION'} eq 'edit') {
 print <<END
 <table width='100%'>
 <tr>
-<td width='25%' class='base'>$Lang::tr{'source ip'}: </td>
+<td width='25%' class='base'>$Lang::tr{'source ip'}: <img src='/blob.gif' alt='*' /></td>
 <td width='25%' ><input type='text' name='SOURCE_IP' value='$cgiparams{'SOURCE_IP'}' size='25' /></td>
 <td width='25%' class='base' align='right'>$Lang::tr{'enabled'} </td>
 <td width='25%'><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
 </tr>
 <tr>
-<td width='25%' class='base'>$Lang::tr{'source'} $Lang::tr{'mac address'}: </td>
+<td width='25%' class='base'>$Lang::tr{'source'} $Lang::tr{'mac address'}: <img src='/blob.gif' alt='*' /></td>
 <td colspan='3'><input type='text' name='SOURCE_MAC' value='$cgiparams{'SOURCE_MAC'}' size='25' /></td>
 </tr>
 <tr>
-<td width='25%' class='base'>$Lang::tr{'remark'}: <img src='/blob.gif' alt='*' /></td>
+<td width='25%' class='base'>$Lang::tr{'remark'}:</td>
 <td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='40' /></td>
 </tr>
 </table>
@@ -229,7 +229,7 @@ print <<END
 <hr>
 <table width='100%'>
 <tr>
-    <td class='base' valign='top'><img src='/blob.gif' alt='*' /> $Lang::tr{'this field may be blank'}</td>
+    <td class='base' valign='top'><img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}</td>
     <td width='40%' align='right'>
       <input type='hidden' name='ACTION' value='add' />
       <input type='submit' name='SUBMIT' value='$buttontext' />
diff --git a/html/cgi-bin/wlanap.cgi b/html/cgi-bin/wlanap.cgi
index ec9022ddfa..844c395e2f 100644
--- a/html/cgi-bin/wlanap.cgi
+++ b/html/cgi-bin/wlanap.cgi
@@ -71,7 +71,7 @@ $wlanapsettings{'HW_MODE'} = 'g';
 $wlanapsettings{'PWD'} = 'IPFire-2.x';
 $wlanapsettings{'SYSLOGLEVEL'} = '0';
 $wlanapsettings{'DEBUG'} = '4';
-$wlanapsettings{'DRIVER'} = 'MADWIFI';
+$wlanapsettings{'DRIVER'} = 'NL80211';
 $wlanapsettings{'HTCAPS'} = '';
 
 &General::readhash("/var/ipfire/wlanap/settings", \%wlanapsettings);
@@ -265,7 +265,7 @@ if ( $wlanapsettings{'DRIVER'} eq 'NL80211' ){
 my $wiphy = `iw dev $wlanapsettings{'INTERFACE'} info | grep wiphy | cut -d" " -f2`;
 chomp $wiphy;
 
-@channellist_cmd = `iw phy phy$wiphy info | grep " MHz \\\[" | grep -v "(disabled)" | grep -v "no IBSS" | grep -v "passive scanning" 2>/dev/null`;
+@channellist_cmd = `iw phy phy$wiphy info | grep " MHz \\\[" | grep -v "(disabled)" | grep -v "no IBSS" | grep -v "no IR" | grep -v "passive scanning" 2>/dev/null`;
 # get available channels
 
 my @temp;
@@ -306,15 +306,6 @@ if ( $wlanapsettings{'DRIVER'} eq 'NL80211' ){
 }
 # get available power
 
-my @temp;
-foreach (@txpower_cmd){
-$_ =~ /(\s)(\d+)(\s)dBm(\s)(.*)(\W)(\d+)(.*)/;
-$txpower = $7;chomp $txpower;
-if ( $txpower =~ /\d+/ ){push(@temp,$txpower."mW");}
-}
-my @txpower = @temp;
-push(@txpower,"auto");
-
 $selected{'SYSLOGLEVEL'}{$wlanapsettings{'SYSLOGLEVEL'}} = "selected='selected'";
 $selected{'DEBUG'}{$wlanapsettings{'DEBUG'}} = "selected='selected'";
 
@@ -437,20 +428,7 @@ END
 ;
 print <<END
 <tr><td width='25%' class='base'>HT Caps: </td><td class='base' colspan='3'><input type='text' name='HTCAPS' size='30' value='$wlanapsettings{'HTCAPS'}' /></td></tr>
-<tr><td width='25%' class='base'>Tx Power: </td><td class='base' colspan='3'>
-END
-;
-
-if ( $wlanapsettings{'DRIVER'} eq 'MADWIFI' ){
-	print "<select name='TXPOWER'>";
-	foreach $txpower (@txpower){
-		print "<option $selected{'TXPOWER'}{$txpower}>$txpower</option> dBm";
-	}
-	print "	</select></td></tr>";
-} else {
-	print "<input type='text' name='TXPOWER' size='10' value='$wlanapsettings{'TXPOWER'}' /></td></tr>"
-}
-print <<END
+<tr><td width='25%' class='base'>Tx Power: </td><td class='base' colspan='3'><input type='text' name='TXPOWER' size='10' value='$wlanapsettings{'TXPOWER'}' /></td></tr>
 <tr><td width='25%' class='base'>Loglevel (hostapd): </td><td class='base' width='25%'>
 	<select name='SYSLOGLEVEL'>
 		<option value='0' $selected{'SYSLOGLEVEL'}{'0'}>0 ($Lang::tr{'wlanap verbose'})</option>
@@ -508,9 +486,6 @@ print <<END
 END
 ;
 my @status;
-if ( $wlanapsettings{'DRIVER'} eq 'MADWIFI' ){
-	 @status =  `wlanconfig $wlanapsettings{'INTERFACE'} list`;
-}
 if ( $wlanapsettings{'DRIVER'} eq 'NL80211' ){
 	 @status =  `iw dev $wlanapsettings{'INTERFACE'} info && iw dev $wlanapsettings{'INTERFACE'} station dump && echo ""`;
 }
diff --git a/html/html/images/flags/ad.png b/html/html/images/flags/ad.png
deleted file mode 100644
index ffbe26a9c7..0000000000
Binary files a/html/html/images/flags/ad.png and /dev/null differ
diff --git a/html/html/images/flags/ae.png b/html/html/images/flags/ae.png
deleted file mode 100644
index 0ee169b3b7..0000000000
Binary files a/html/html/images/flags/ae.png and /dev/null differ
diff --git a/html/html/images/flags/af.png b/html/html/images/flags/af.png
deleted file mode 100644
index f6d8f25f5d..0000000000
Binary files a/html/html/images/flags/af.png and /dev/null differ
diff --git a/html/html/images/flags/ag.png b/html/html/images/flags/ag.png
deleted file mode 100644
index 1c731bae87..0000000000
Binary files a/html/html/images/flags/ag.png and /dev/null differ
diff --git a/html/html/images/flags/ai.png b/html/html/images/flags/ai.png
deleted file mode 100644
index afc38d9f14..0000000000
Binary files a/html/html/images/flags/ai.png and /dev/null differ
diff --git a/html/html/images/flags/al.png b/html/html/images/flags/al.png
deleted file mode 100644
index 79d6bac07e..0000000000
Binary files a/html/html/images/flags/al.png and /dev/null differ
diff --git a/html/html/images/flags/am.png b/html/html/images/flags/am.png
deleted file mode 100644
index 7d57f50553..0000000000
Binary files a/html/html/images/flags/am.png and /dev/null differ
diff --git a/html/html/images/flags/an.png b/html/html/images/flags/an.png
deleted file mode 100644
index bf9d2336b1..0000000000
Binary files a/html/html/images/flags/an.png and /dev/null differ
diff --git a/html/html/images/flags/ao.png b/html/html/images/flags/ao.png
deleted file mode 100644
index c97184085c..0000000000
Binary files a/html/html/images/flags/ao.png and /dev/null differ
diff --git a/html/html/images/flags/aq.png b/html/html/images/flags/aq.png
deleted file mode 100644
index a4f9700e0e..0000000000
Binary files a/html/html/images/flags/aq.png and /dev/null differ
diff --git a/html/html/images/flags/ar.png b/html/html/images/flags/ar.png
deleted file mode 100644
index d3a0d9dfc6..0000000000
Binary files a/html/html/images/flags/ar.png and /dev/null differ
diff --git a/html/html/images/flags/as.png b/html/html/images/flags/as.png
deleted file mode 100644
index d881283f81..0000000000
Binary files a/html/html/images/flags/as.png and /dev/null differ
diff --git a/html/html/images/flags/at.png b/html/html/images/flags/at.png
deleted file mode 100644
index bd0cbe1a73..0000000000
Binary files a/html/html/images/flags/at.png and /dev/null differ
diff --git a/html/html/images/flags/au.png b/html/html/images/flags/au.png
deleted file mode 100644
index 65fd911f2c..0000000000
Binary files a/html/html/images/flags/au.png and /dev/null differ
diff --git a/html/html/images/flags/aw.png b/html/html/images/flags/aw.png
deleted file mode 100644
index 1e5aff9e88..0000000000
Binary files a/html/html/images/flags/aw.png and /dev/null differ
diff --git a/html/html/images/flags/az.png b/html/html/images/flags/az.png
deleted file mode 100644
index f2137c2d81..0000000000
Binary files a/html/html/images/flags/az.png and /dev/null differ
diff --git a/html/html/images/flags/ba.png b/html/html/images/flags/ba.png
deleted file mode 100644
index 39dbca828e..0000000000
Binary files a/html/html/images/flags/ba.png and /dev/null differ
diff --git a/html/html/images/flags/bb.png b/html/html/images/flags/bb.png
deleted file mode 100644
index 726ab5aa6e..0000000000
Binary files a/html/html/images/flags/bb.png and /dev/null differ
diff --git a/html/html/images/flags/bd.png b/html/html/images/flags/bd.png
deleted file mode 100644
index e68816fb8e..0000000000
Binary files a/html/html/images/flags/bd.png and /dev/null differ
diff --git a/html/html/images/flags/be.png b/html/html/images/flags/be.png
deleted file mode 100644
index 2f92d5f817..0000000000
Binary files a/html/html/images/flags/be.png and /dev/null differ
diff --git a/html/html/images/flags/bf.png b/html/html/images/flags/bf.png
deleted file mode 100644
index 618fd041df..0000000000
Binary files a/html/html/images/flags/bf.png and /dev/null differ
diff --git a/html/html/images/flags/bg.png b/html/html/images/flags/bg.png
deleted file mode 100644
index 70d4b20974..0000000000
Binary files a/html/html/images/flags/bg.png and /dev/null differ
diff --git a/html/html/images/flags/bh.png b/html/html/images/flags/bh.png
deleted file mode 100644
index e92bd20cbf..0000000000
Binary files a/html/html/images/flags/bh.png and /dev/null differ
diff --git a/html/html/images/flags/bi.png b/html/html/images/flags/bi.png
deleted file mode 100644
index 3b4ebca278..0000000000
Binary files a/html/html/images/flags/bi.png and /dev/null differ
diff --git a/html/html/images/flags/bj.png b/html/html/images/flags/bj.png
deleted file mode 100644
index f6b89d9392..0000000000
Binary files a/html/html/images/flags/bj.png and /dev/null differ
diff --git a/html/html/images/flags/bm.png b/html/html/images/flags/bm.png
deleted file mode 100644
index 092852d1a9..0000000000
Binary files a/html/html/images/flags/bm.png and /dev/null differ
diff --git a/html/html/images/flags/bn.png b/html/html/images/flags/bn.png
deleted file mode 100644
index 2cf8b8e5b5..0000000000
Binary files a/html/html/images/flags/bn.png and /dev/null differ
diff --git a/html/html/images/flags/bo.png b/html/html/images/flags/bo.png
deleted file mode 100644
index bcf79862d7..0000000000
Binary files a/html/html/images/flags/bo.png and /dev/null differ
diff --git a/html/html/images/flags/br.png b/html/html/images/flags/br.png
deleted file mode 100644
index 73e9370071..0000000000
Binary files a/html/html/images/flags/br.png and /dev/null differ
diff --git a/html/html/images/flags/bs.png b/html/html/images/flags/bs.png
deleted file mode 100644
index 799df4d829..0000000000
Binary files a/html/html/images/flags/bs.png and /dev/null differ
diff --git a/html/html/images/flags/bt.png b/html/html/images/flags/bt.png
deleted file mode 100644
index 796a07333e..0000000000
Binary files a/html/html/images/flags/bt.png and /dev/null differ
diff --git a/html/html/images/flags/bv.png b/html/html/images/flags/bv.png
deleted file mode 100644
index 90661b4f09..0000000000
Binary files a/html/html/images/flags/bv.png and /dev/null differ
diff --git a/html/html/images/flags/bw.png b/html/html/images/flags/bw.png
deleted file mode 100644
index 913580dfe2..0000000000
Binary files a/html/html/images/flags/bw.png and /dev/null differ
diff --git a/html/html/images/flags/by.png b/html/html/images/flags/by.png
deleted file mode 100644
index 80cd890c9d..0000000000
Binary files a/html/html/images/flags/by.png and /dev/null differ
diff --git a/html/html/images/flags/bz.png b/html/html/images/flags/bz.png
deleted file mode 100644
index bcfd37e32b..0000000000
Binary files a/html/html/images/flags/bz.png and /dev/null differ
diff --git a/html/html/images/flags/ca.png b/html/html/images/flags/ca.png
deleted file mode 100644
index 0a5003452e..0000000000
Binary files a/html/html/images/flags/ca.png and /dev/null differ
diff --git a/html/html/images/flags/cc.png b/html/html/images/flags/cc.png
deleted file mode 100644
index 6e29f453e5..0000000000
Binary files a/html/html/images/flags/cc.png and /dev/null differ
diff --git a/html/html/images/flags/cd.png b/html/html/images/flags/cd.png
deleted file mode 100644
index daa30a3c39..0000000000
Binary files a/html/html/images/flags/cd.png and /dev/null differ
diff --git a/html/html/images/flags/cf.png b/html/html/images/flags/cf.png
deleted file mode 100644
index d31de15408..0000000000
Binary files a/html/html/images/flags/cf.png and /dev/null differ
diff --git a/html/html/images/flags/cg.png b/html/html/images/flags/cg.png
deleted file mode 100644
index 1d712ffa20..0000000000
Binary files a/html/html/images/flags/cg.png and /dev/null differ
diff --git a/html/html/images/flags/ch.png b/html/html/images/flags/ch.png
deleted file mode 100644
index b5b590266e..0000000000
Binary files a/html/html/images/flags/ch.png and /dev/null differ
diff --git a/html/html/images/flags/ci.png b/html/html/images/flags/ci.png
deleted file mode 100644
index 3f34f51ac2..0000000000
Binary files a/html/html/images/flags/ci.png and /dev/null differ
diff --git a/html/html/images/flags/ck.png b/html/html/images/flags/ck.png
deleted file mode 100644
index c86af2c1b0..0000000000
Binary files a/html/html/images/flags/ck.png and /dev/null differ
diff --git a/html/html/images/flags/cl.png b/html/html/images/flags/cl.png
deleted file mode 100644
index 194fd91b94..0000000000
Binary files a/html/html/images/flags/cl.png and /dev/null differ
diff --git a/html/html/images/flags/cm.png b/html/html/images/flags/cm.png
deleted file mode 100644
index 00fc99100a..0000000000
Binary files a/html/html/images/flags/cm.png and /dev/null differ
diff --git a/html/html/images/flags/cn.png b/html/html/images/flags/cn.png
deleted file mode 100644
index e9e826182c..0000000000
Binary files a/html/html/images/flags/cn.png and /dev/null differ
diff --git a/html/html/images/flags/co.png b/html/html/images/flags/co.png
deleted file mode 100644
index cba9e49db6..0000000000
Binary files a/html/html/images/flags/co.png and /dev/null differ
diff --git a/html/html/images/flags/cr.png b/html/html/images/flags/cr.png
deleted file mode 100644
index 9088a35e33..0000000000
Binary files a/html/html/images/flags/cr.png and /dev/null differ
diff --git a/html/html/images/flags/cs.png b/html/html/images/flags/cs.png
deleted file mode 100644
index bbd5acad75..0000000000
Binary files a/html/html/images/flags/cs.png and /dev/null differ
diff --git a/html/html/images/flags/cu.png b/html/html/images/flags/cu.png
deleted file mode 100644
index ff1b7ea999..0000000000
Binary files a/html/html/images/flags/cu.png and /dev/null differ
diff --git a/html/html/images/flags/cv.png b/html/html/images/flags/cv.png
deleted file mode 100644
index 49e7738703..0000000000
Binary files a/html/html/images/flags/cv.png and /dev/null differ
diff --git a/html/html/images/flags/cx.png b/html/html/images/flags/cx.png
deleted file mode 100644
index a64c13f228..0000000000
Binary files a/html/html/images/flags/cx.png and /dev/null differ
diff --git a/html/html/images/flags/cy.png b/html/html/images/flags/cy.png
deleted file mode 100644
index c3a559c6ea..0000000000
Binary files a/html/html/images/flags/cy.png and /dev/null differ
diff --git a/html/html/images/flags/cz.png b/html/html/images/flags/cz.png
deleted file mode 100644
index 5caf0ec1c8..0000000000
Binary files a/html/html/images/flags/cz.png and /dev/null differ
diff --git a/html/html/images/flags/de.png b/html/html/images/flags/de.png
deleted file mode 100644
index b142f7ba74..0000000000
Binary files a/html/html/images/flags/de.png and /dev/null differ
diff --git a/html/html/images/flags/dj.png b/html/html/images/flags/dj.png
deleted file mode 100644
index c71b38f745..0000000000
Binary files a/html/html/images/flags/dj.png and /dev/null differ
diff --git a/html/html/images/flags/dk.png b/html/html/images/flags/dk.png
deleted file mode 100644
index b2b9b12c2b..0000000000
Binary files a/html/html/images/flags/dk.png and /dev/null differ
diff --git a/html/html/images/flags/dm.png b/html/html/images/flags/dm.png
deleted file mode 100644
index 0b1aab629c..0000000000
Binary files a/html/html/images/flags/dm.png and /dev/null differ
diff --git a/html/html/images/flags/do.png b/html/html/images/flags/do.png
deleted file mode 100644
index 5afc6d03fb..0000000000
Binary files a/html/html/images/flags/do.png and /dev/null differ
diff --git a/html/html/images/flags/dz.png b/html/html/images/flags/dz.png
deleted file mode 100644
index 9132046f39..0000000000
Binary files a/html/html/images/flags/dz.png and /dev/null differ
diff --git a/html/html/images/flags/ec.png b/html/html/images/flags/ec.png
deleted file mode 100644
index bdae8d245c..0000000000
Binary files a/html/html/images/flags/ec.png and /dev/null differ
diff --git a/html/html/images/flags/ee.png b/html/html/images/flags/ee.png
deleted file mode 100644
index 516e5a3afd..0000000000
Binary files a/html/html/images/flags/ee.png and /dev/null differ
diff --git a/html/html/images/flags/eg.png b/html/html/images/flags/eg.png
deleted file mode 100644
index 0f47afc95f..0000000000
Binary files a/html/html/images/flags/eg.png and /dev/null differ
diff --git a/html/html/images/flags/eh.png b/html/html/images/flags/eh.png
deleted file mode 100644
index 927b3cba16..0000000000
Binary files a/html/html/images/flags/eh.png and /dev/null differ
diff --git a/html/html/images/flags/er.png b/html/html/images/flags/er.png
deleted file mode 100644
index 10ded538fb..0000000000
Binary files a/html/html/images/flags/er.png and /dev/null differ
diff --git a/html/html/images/flags/es.png b/html/html/images/flags/es.png
deleted file mode 100644
index 40cbfa6318..0000000000
Binary files a/html/html/images/flags/es.png and /dev/null differ
diff --git a/html/html/images/flags/et.png b/html/html/images/flags/et.png
deleted file mode 100644
index 17a252e7db..0000000000
Binary files a/html/html/images/flags/et.png and /dev/null differ
diff --git a/html/html/images/flags/eu.png b/html/html/images/flags/eu.png
deleted file mode 100644
index 4c09a5ad32..0000000000
Binary files a/html/html/images/flags/eu.png and /dev/null differ
diff --git a/html/html/images/flags/fi.png b/html/html/images/flags/fi.png
deleted file mode 100644
index 78b9ab6311..0000000000
Binary files a/html/html/images/flags/fi.png and /dev/null differ
diff --git a/html/html/images/flags/fj.png b/html/html/images/flags/fj.png
deleted file mode 100644
index a02aaa3582..0000000000
Binary files a/html/html/images/flags/fj.png and /dev/null differ
diff --git a/html/html/images/flags/fk.png b/html/html/images/flags/fk.png
deleted file mode 100644
index b6189f921d..0000000000
Binary files a/html/html/images/flags/fk.png and /dev/null differ
diff --git a/html/html/images/flags/fm.png b/html/html/images/flags/fm.png
deleted file mode 100644
index 7302d22f9e..0000000000
Binary files a/html/html/images/flags/fm.png and /dev/null differ
diff --git a/html/html/images/flags/fo.png b/html/html/images/flags/fo.png
deleted file mode 100644
index 6bb5557e8c..0000000000
Binary files a/html/html/images/flags/fo.png and /dev/null differ
diff --git a/html/html/images/flags/fr.png b/html/html/images/flags/fr.png
deleted file mode 100644
index bfd4a21486..0000000000
Binary files a/html/html/images/flags/fr.png and /dev/null differ
diff --git a/html/html/images/flags/ga.png b/html/html/images/flags/ga.png
deleted file mode 100644
index 18eed1acae..0000000000
Binary files a/html/html/images/flags/ga.png and /dev/null differ
diff --git a/html/html/images/flags/gb.png b/html/html/images/flags/gb.png
deleted file mode 100644
index db134f14b2..0000000000
Binary files a/html/html/images/flags/gb.png and /dev/null differ
diff --git a/html/html/images/flags/gd.png b/html/html/images/flags/gd.png
deleted file mode 100644
index bde8e2e8bd..0000000000
Binary files a/html/html/images/flags/gd.png and /dev/null differ
diff --git a/html/html/images/flags/ge.png b/html/html/images/flags/ge.png
deleted file mode 100644
index cf5a612acf..0000000000
Binary files a/html/html/images/flags/ge.png and /dev/null differ
diff --git a/html/html/images/flags/gf.png b/html/html/images/flags/gf.png
deleted file mode 100644
index df12fb49f5..0000000000
Binary files a/html/html/images/flags/gf.png and /dev/null differ
diff --git a/html/html/images/flags/gh.png b/html/html/images/flags/gh.png
deleted file mode 100644
index e47b266ea0..0000000000
Binary files a/html/html/images/flags/gh.png and /dev/null differ
diff --git a/html/html/images/flags/gi.png b/html/html/images/flags/gi.png
deleted file mode 100644
index d3f23b3bd8..0000000000
Binary files a/html/html/images/flags/gi.png and /dev/null differ
diff --git a/html/html/images/flags/gl.png b/html/html/images/flags/gl.png
deleted file mode 100644
index 565c7a1704..0000000000
Binary files a/html/html/images/flags/gl.png and /dev/null differ
diff --git a/html/html/images/flags/gm.png b/html/html/images/flags/gm.png
deleted file mode 100644
index cdecab3e8f..0000000000
Binary files a/html/html/images/flags/gm.png and /dev/null differ
diff --git a/html/html/images/flags/gn.png b/html/html/images/flags/gn.png
deleted file mode 100644
index 56db38e908..0000000000
Binary files a/html/html/images/flags/gn.png and /dev/null differ
diff --git a/html/html/images/flags/gp.png b/html/html/images/flags/gp.png
deleted file mode 100644
index d7fbdfc6d3..0000000000
Binary files a/html/html/images/flags/gp.png and /dev/null differ
diff --git a/html/html/images/flags/gq.png b/html/html/images/flags/gq.png
deleted file mode 100644
index 71496cdbfa..0000000000
Binary files a/html/html/images/flags/gq.png and /dev/null differ
diff --git a/html/html/images/flags/gr.png b/html/html/images/flags/gr.png
deleted file mode 100644
index cf10a25963..0000000000
Binary files a/html/html/images/flags/gr.png and /dev/null differ
diff --git a/html/html/images/flags/gs.png b/html/html/images/flags/gs.png
deleted file mode 100644
index 6fd7edf038..0000000000
Binary files a/html/html/images/flags/gs.png and /dev/null differ
diff --git a/html/html/images/flags/gt.png b/html/html/images/flags/gt.png
deleted file mode 100644
index 2be4460bec..0000000000
Binary files a/html/html/images/flags/gt.png and /dev/null differ
diff --git a/html/html/images/flags/gu.png b/html/html/images/flags/gu.png
deleted file mode 100644
index 2e6f0e0206..0000000000
Binary files a/html/html/images/flags/gu.png and /dev/null differ
diff --git a/html/html/images/flags/gw.png b/html/html/images/flags/gw.png
deleted file mode 100644
index ae52ec3aed..0000000000
Binary files a/html/html/images/flags/gw.png and /dev/null differ
diff --git a/html/html/images/flags/gy.png b/html/html/images/flags/gy.png
deleted file mode 100644
index 1b20de4785..0000000000
Binary files a/html/html/images/flags/gy.png and /dev/null differ
diff --git a/html/html/images/flags/hk.png b/html/html/images/flags/hk.png
deleted file mode 100644
index d5435b6e74..0000000000
Binary files a/html/html/images/flags/hk.png and /dev/null differ
diff --git a/html/html/images/flags/hm.png b/html/html/images/flags/hm.png
deleted file mode 100644
index ec0d223d91..0000000000
Binary files a/html/html/images/flags/hm.png and /dev/null differ
diff --git a/html/html/images/flags/hn.png b/html/html/images/flags/hn.png
deleted file mode 100644
index 56e0b0248a..0000000000
Binary files a/html/html/images/flags/hn.png and /dev/null differ
diff --git a/html/html/images/flags/hr.png b/html/html/images/flags/hr.png
deleted file mode 100644
index bd133ba62c..0000000000
Binary files a/html/html/images/flags/hr.png and /dev/null differ
diff --git a/html/html/images/flags/ht.png b/html/html/images/flags/ht.png
deleted file mode 100644
index a98294028d..0000000000
Binary files a/html/html/images/flags/ht.png and /dev/null differ
diff --git a/html/html/images/flags/hu.png b/html/html/images/flags/hu.png
deleted file mode 100644
index fd76de3961..0000000000
Binary files a/html/html/images/flags/hu.png and /dev/null differ
diff --git a/html/html/images/flags/id.png b/html/html/images/flags/id.png
deleted file mode 100644
index cf72330b34..0000000000
Binary files a/html/html/images/flags/id.png and /dev/null differ
diff --git a/html/html/images/flags/ie.png b/html/html/images/flags/ie.png
deleted file mode 100644
index ddbbc747ef..0000000000
Binary files a/html/html/images/flags/ie.png and /dev/null differ
diff --git a/html/html/images/flags/il.png b/html/html/images/flags/il.png
deleted file mode 100644
index 52dc8d3852..0000000000
Binary files a/html/html/images/flags/il.png and /dev/null differ
diff --git a/html/html/images/flags/in.png b/html/html/images/flags/in.png
deleted file mode 100644
index 771f21709e..0000000000
Binary files a/html/html/images/flags/in.png and /dev/null differ
diff --git a/html/html/images/flags/io.png b/html/html/images/flags/io.png
deleted file mode 100644
index 96bc118090..0000000000
Binary files a/html/html/images/flags/io.png and /dev/null differ
diff --git a/html/html/images/flags/iq.png b/html/html/images/flags/iq.png
deleted file mode 100644
index 3097303905..0000000000
Binary files a/html/html/images/flags/iq.png and /dev/null differ
diff --git a/html/html/images/flags/ir.png b/html/html/images/flags/ir.png
deleted file mode 100644
index 395b28a082..0000000000
Binary files a/html/html/images/flags/ir.png and /dev/null differ
diff --git a/html/html/images/flags/is.png b/html/html/images/flags/is.png
deleted file mode 100644
index ea1c49370f..0000000000
Binary files a/html/html/images/flags/is.png and /dev/null differ
diff --git a/html/html/images/flags/it.png b/html/html/images/flags/it.png
deleted file mode 100644
index de7427b156..0000000000
Binary files a/html/html/images/flags/it.png and /dev/null differ
diff --git a/html/html/images/flags/jm.png b/html/html/images/flags/jm.png
deleted file mode 100644
index 2a8a899931..0000000000
Binary files a/html/html/images/flags/jm.png and /dev/null differ
diff --git a/html/html/images/flags/jo.png b/html/html/images/flags/jo.png
deleted file mode 100644
index dbdca50da4..0000000000
Binary files a/html/html/images/flags/jo.png and /dev/null differ
diff --git a/html/html/images/flags/jp.png b/html/html/images/flags/jp.png
deleted file mode 100644
index 5e342fdf21..0000000000
Binary files a/html/html/images/flags/jp.png and /dev/null differ
diff --git a/html/html/images/flags/ke.png b/html/html/images/flags/ke.png
deleted file mode 100644
index d55331ae8a..0000000000
Binary files a/html/html/images/flags/ke.png and /dev/null differ
diff --git a/html/html/images/flags/kg.png b/html/html/images/flags/kg.png
deleted file mode 100644
index 230b1f6f35..0000000000
Binary files a/html/html/images/flags/kg.png and /dev/null differ
diff --git a/html/html/images/flags/kh.png b/html/html/images/flags/kh.png
deleted file mode 100644
index 2ad8e35a96..0000000000
Binary files a/html/html/images/flags/kh.png and /dev/null differ
diff --git a/html/html/images/flags/ki.png b/html/html/images/flags/ki.png
deleted file mode 100644
index 244104ad48..0000000000
Binary files a/html/html/images/flags/ki.png and /dev/null differ
diff --git a/html/html/images/flags/km.png b/html/html/images/flags/km.png
deleted file mode 100644
index eb6954469d..0000000000
Binary files a/html/html/images/flags/km.png and /dev/null differ
diff --git a/html/html/images/flags/kn.png b/html/html/images/flags/kn.png
deleted file mode 100644
index 3ce40183fa..0000000000
Binary files a/html/html/images/flags/kn.png and /dev/null differ
diff --git a/html/html/images/flags/kp.png b/html/html/images/flags/kp.png
deleted file mode 100644
index f53c71a028..0000000000
Binary files a/html/html/images/flags/kp.png and /dev/null differ
diff --git a/html/html/images/flags/kr.png b/html/html/images/flags/kr.png
deleted file mode 100644
index 2b4e7b9918..0000000000
Binary files a/html/html/images/flags/kr.png and /dev/null differ
diff --git a/html/html/images/flags/kw.png b/html/html/images/flags/kw.png
deleted file mode 100644
index 19c8dc2152..0000000000
Binary files a/html/html/images/flags/kw.png and /dev/null differ
diff --git a/html/html/images/flags/ky.png b/html/html/images/flags/ky.png
deleted file mode 100644
index fa5ba07353..0000000000
Binary files a/html/html/images/flags/ky.png and /dev/null differ
diff --git a/html/html/images/flags/kz.png b/html/html/images/flags/kz.png
deleted file mode 100644
index f90f0ef540..0000000000
Binary files a/html/html/images/flags/kz.png and /dev/null differ
diff --git a/html/html/images/flags/la.png b/html/html/images/flags/la.png
deleted file mode 100644
index c3e9154bce..0000000000
Binary files a/html/html/images/flags/la.png and /dev/null differ
diff --git a/html/html/images/flags/lb.png b/html/html/images/flags/lb.png
deleted file mode 100644
index e18a57750d..0000000000
Binary files a/html/html/images/flags/lb.png and /dev/null differ
diff --git a/html/html/images/flags/lc.png b/html/html/images/flags/lc.png
deleted file mode 100644
index 78c606f7ea..0000000000
Binary files a/html/html/images/flags/lc.png and /dev/null differ
diff --git a/html/html/images/flags/li.png b/html/html/images/flags/li.png
deleted file mode 100644
index e991d1fd30..0000000000
Binary files a/html/html/images/flags/li.png and /dev/null differ
diff --git a/html/html/images/flags/lk.png b/html/html/images/flags/lk.png
deleted file mode 100644
index f9e227fbf0..0000000000
Binary files a/html/html/images/flags/lk.png and /dev/null differ
diff --git a/html/html/images/flags/lr.png b/html/html/images/flags/lr.png
deleted file mode 100644
index 1c826c85a6..0000000000
Binary files a/html/html/images/flags/lr.png and /dev/null differ
diff --git a/html/html/images/flags/ls.png b/html/html/images/flags/ls.png
deleted file mode 100644
index bd78c5bced..0000000000
Binary files a/html/html/images/flags/ls.png and /dev/null differ
diff --git a/html/html/images/flags/lt.png b/html/html/images/flags/lt.png
deleted file mode 100644
index 212d16b95a..0000000000
Binary files a/html/html/images/flags/lt.png and /dev/null differ
diff --git a/html/html/images/flags/lu.png b/html/html/images/flags/lu.png
deleted file mode 100644
index 7182373f53..0000000000
Binary files a/html/html/images/flags/lu.png and /dev/null differ
diff --git a/html/html/images/flags/lv.png b/html/html/images/flags/lv.png
deleted file mode 100644
index fa94bb2783..0000000000
Binary files a/html/html/images/flags/lv.png and /dev/null differ
diff --git a/html/html/images/flags/ly.png b/html/html/images/flags/ly.png
deleted file mode 100644
index 7afd8a643c..0000000000
Binary files a/html/html/images/flags/ly.png and /dev/null differ
diff --git a/html/html/images/flags/ma.png b/html/html/images/flags/ma.png
deleted file mode 100644
index 05448bf182..0000000000
Binary files a/html/html/images/flags/ma.png and /dev/null differ
diff --git a/html/html/images/flags/mc.png b/html/html/images/flags/mc.png
deleted file mode 100644
index c6f5809fc0..0000000000
Binary files a/html/html/images/flags/mc.png and /dev/null differ
diff --git a/html/html/images/flags/md.png b/html/html/images/flags/md.png
deleted file mode 100644
index e100650f67..0000000000
Binary files a/html/html/images/flags/md.png and /dev/null differ
diff --git a/html/html/images/flags/mg.png b/html/html/images/flags/mg.png
deleted file mode 100644
index 080b0d4d10..0000000000
Binary files a/html/html/images/flags/mg.png and /dev/null differ
diff --git a/html/html/images/flags/mh.png b/html/html/images/flags/mh.png
deleted file mode 100644
index 132ad606bd..0000000000
Binary files a/html/html/images/flags/mh.png and /dev/null differ
diff --git a/html/html/images/flags/mk.png b/html/html/images/flags/mk.png
deleted file mode 100644
index acf5e44fce..0000000000
Binary files a/html/html/images/flags/mk.png and /dev/null differ
diff --git a/html/html/images/flags/ml.png b/html/html/images/flags/ml.png
deleted file mode 100644
index cf0412fb33..0000000000
Binary files a/html/html/images/flags/ml.png and /dev/null differ
diff --git a/html/html/images/flags/mm.png b/html/html/images/flags/mm.png
deleted file mode 100644
index 646783160e..0000000000
Binary files a/html/html/images/flags/mm.png and /dev/null differ
diff --git a/html/html/images/flags/mn.png b/html/html/images/flags/mn.png
deleted file mode 100644
index 81f355b4e5..0000000000
Binary files a/html/html/images/flags/mn.png and /dev/null differ
diff --git a/html/html/images/flags/mo.png b/html/html/images/flags/mo.png
deleted file mode 100644
index 8a033f363a..0000000000
Binary files a/html/html/images/flags/mo.png and /dev/null differ
diff --git a/html/html/images/flags/mp.png b/html/html/images/flags/mp.png
deleted file mode 100644
index 1bf89752c3..0000000000
Binary files a/html/html/images/flags/mp.png and /dev/null differ
diff --git a/html/html/images/flags/mq.png b/html/html/images/flags/mq.png
deleted file mode 100644
index 00a8cc418a..0000000000
Binary files a/html/html/images/flags/mq.png and /dev/null differ
diff --git a/html/html/images/flags/mr.png b/html/html/images/flags/mr.png
deleted file mode 100644
index 5c40c89f8c..0000000000
Binary files a/html/html/images/flags/mr.png and /dev/null differ
diff --git a/html/html/images/flags/ms.png b/html/html/images/flags/ms.png
deleted file mode 100644
index 82dfd87af5..0000000000
Binary files a/html/html/images/flags/ms.png and /dev/null differ
diff --git a/html/html/images/flags/mt.png b/html/html/images/flags/mt.png
deleted file mode 100644
index df86154653..0000000000
Binary files a/html/html/images/flags/mt.png and /dev/null differ
diff --git a/html/html/images/flags/mu.png b/html/html/images/flags/mu.png
deleted file mode 100644
index b146f3877a..0000000000
Binary files a/html/html/images/flags/mu.png and /dev/null differ
diff --git a/html/html/images/flags/mv.png b/html/html/images/flags/mv.png
deleted file mode 100644
index 9d8704bb4e..0000000000
Binary files a/html/html/images/flags/mv.png and /dev/null differ
diff --git a/html/html/images/flags/mw.png b/html/html/images/flags/mw.png
deleted file mode 100644
index ddbe257557..0000000000
Binary files a/html/html/images/flags/mw.png and /dev/null differ
diff --git a/html/html/images/flags/mx.png b/html/html/images/flags/mx.png
deleted file mode 100644
index d69e87f880..0000000000
Binary files a/html/html/images/flags/mx.png and /dev/null differ
diff --git a/html/html/images/flags/my.png b/html/html/images/flags/my.png
deleted file mode 100644
index 54534e9117..0000000000
Binary files a/html/html/images/flags/my.png and /dev/null differ
diff --git a/html/html/images/flags/mz.png b/html/html/images/flags/mz.png
deleted file mode 100644
index bc3cf9bfc5..0000000000
Binary files a/html/html/images/flags/mz.png and /dev/null differ
diff --git a/html/html/images/flags/na.png b/html/html/images/flags/na.png
deleted file mode 100644
index f44ed282d5..0000000000
Binary files a/html/html/images/flags/na.png and /dev/null differ
diff --git a/html/html/images/flags/nc.png b/html/html/images/flags/nc.png
deleted file mode 100644
index ee025d7f32..0000000000
Binary files a/html/html/images/flags/nc.png and /dev/null differ
diff --git a/html/html/images/flags/ne.png b/html/html/images/flags/ne.png
deleted file mode 100644
index aeb771d29a..0000000000
Binary files a/html/html/images/flags/ne.png and /dev/null differ
diff --git a/html/html/images/flags/nf.png b/html/html/images/flags/nf.png
deleted file mode 100644
index 2f9ae9475d..0000000000
Binary files a/html/html/images/flags/nf.png and /dev/null differ
diff --git a/html/html/images/flags/ng.png b/html/html/images/flags/ng.png
deleted file mode 100644
index cc4dcd1055..0000000000
Binary files a/html/html/images/flags/ng.png and /dev/null differ
diff --git a/html/html/images/flags/ni.png b/html/html/images/flags/ni.png
deleted file mode 100644
index f679bf2065..0000000000
Binary files a/html/html/images/flags/ni.png and /dev/null differ
diff --git a/html/html/images/flags/nl.png b/html/html/images/flags/nl.png
deleted file mode 100644
index b0e12c2f36..0000000000
Binary files a/html/html/images/flags/nl.png and /dev/null differ
diff --git a/html/html/images/flags/no.png b/html/html/images/flags/no.png
deleted file mode 100644
index de11ab7767..0000000000
Binary files a/html/html/images/flags/no.png and /dev/null differ
diff --git a/html/html/images/flags/np.png b/html/html/images/flags/np.png
deleted file mode 100644
index eb365c93b8..0000000000
Binary files a/html/html/images/flags/np.png and /dev/null differ
diff --git a/html/html/images/flags/nr.png b/html/html/images/flags/nr.png
deleted file mode 100644
index 12f0cfeb8d..0000000000
Binary files a/html/html/images/flags/nr.png and /dev/null differ
diff --git a/html/html/images/flags/nu.png b/html/html/images/flags/nu.png
deleted file mode 100644
index 99ce198cf4..0000000000
Binary files a/html/html/images/flags/nu.png and /dev/null differ
diff --git a/html/html/images/flags/nz.png b/html/html/images/flags/nz.png
deleted file mode 100644
index c50ae5fa47..0000000000
Binary files a/html/html/images/flags/nz.png and /dev/null differ
diff --git a/html/html/images/flags/om.png b/html/html/images/flags/om.png
deleted file mode 100644
index 0076b1130e..0000000000
Binary files a/html/html/images/flags/om.png and /dev/null differ
diff --git a/html/html/images/flags/pa.png b/html/html/images/flags/pa.png
deleted file mode 100644
index ea4adb2266..0000000000
Binary files a/html/html/images/flags/pa.png and /dev/null differ
diff --git a/html/html/images/flags/pe.png b/html/html/images/flags/pe.png
deleted file mode 100644
index 38563b81f0..0000000000
Binary files a/html/html/images/flags/pe.png and /dev/null differ
diff --git a/html/html/images/flags/pf.png b/html/html/images/flags/pf.png
deleted file mode 100644
index 832a5da41b..0000000000
Binary files a/html/html/images/flags/pf.png and /dev/null differ
diff --git a/html/html/images/flags/pg.png b/html/html/images/flags/pg.png
deleted file mode 100644
index 96da94f807..0000000000
Binary files a/html/html/images/flags/pg.png and /dev/null differ
diff --git a/html/html/images/flags/ph.png b/html/html/images/flags/ph.png
deleted file mode 100644
index c8868b6d92..0000000000
Binary files a/html/html/images/flags/ph.png and /dev/null differ
diff --git a/html/html/images/flags/pk.png b/html/html/images/flags/pk.png
deleted file mode 100644
index d86edf1cd1..0000000000
Binary files a/html/html/images/flags/pk.png and /dev/null differ
diff --git a/html/html/images/flags/pl.png b/html/html/images/flags/pl.png
deleted file mode 100644
index 251ee0a4df..0000000000
Binary files a/html/html/images/flags/pl.png and /dev/null differ
diff --git a/html/html/images/flags/pm.png b/html/html/images/flags/pm.png
deleted file mode 100644
index 3d23d0e487..0000000000
Binary files a/html/html/images/flags/pm.png and /dev/null differ
diff --git a/html/html/images/flags/pn.png b/html/html/images/flags/pn.png
deleted file mode 100644
index b39911c4cb..0000000000
Binary files a/html/html/images/flags/pn.png and /dev/null differ
diff --git a/html/html/images/flags/pr.png b/html/html/images/flags/pr.png
deleted file mode 100644
index 2877e34fcf..0000000000
Binary files a/html/html/images/flags/pr.png and /dev/null differ
diff --git a/html/html/images/flags/ps.png b/html/html/images/flags/ps.png
deleted file mode 100644
index 7080b8510a..0000000000
Binary files a/html/html/images/flags/ps.png and /dev/null differ
diff --git a/html/html/images/flags/pt.png b/html/html/images/flags/pt.png
deleted file mode 100644
index c61d7ca09e..0000000000
Binary files a/html/html/images/flags/pt.png and /dev/null differ
diff --git a/html/html/images/flags/pw.png b/html/html/images/flags/pw.png
deleted file mode 100644
index 063d17fcd1..0000000000
Binary files a/html/html/images/flags/pw.png and /dev/null differ
diff --git a/html/html/images/flags/py.png b/html/html/images/flags/py.png
deleted file mode 100644
index 7bc1c878d1..0000000000
Binary files a/html/html/images/flags/py.png and /dev/null differ
diff --git a/html/html/images/flags/qa.png b/html/html/images/flags/qa.png
deleted file mode 100644
index 9619da62d6..0000000000
Binary files a/html/html/images/flags/qa.png and /dev/null differ
diff --git a/html/html/images/flags/re.png b/html/html/images/flags/re.png
deleted file mode 100644
index 422ee9d159..0000000000
Binary files a/html/html/images/flags/re.png and /dev/null differ
diff --git a/html/html/images/flags/ro.png b/html/html/images/flags/ro.png
deleted file mode 100644
index 7f72dd811e..0000000000
Binary files a/html/html/images/flags/ro.png and /dev/null differ
diff --git a/html/html/images/flags/ru.png b/html/html/images/flags/ru.png
deleted file mode 100644
index c76f64637a..0000000000
Binary files a/html/html/images/flags/ru.png and /dev/null differ
diff --git a/html/html/images/flags/rw.png b/html/html/images/flags/rw.png
deleted file mode 100644
index b05833ba95..0000000000
Binary files a/html/html/images/flags/rw.png and /dev/null differ
diff --git a/html/html/images/flags/sa.png b/html/html/images/flags/sa.png
deleted file mode 100644
index 177143012a..0000000000
Binary files a/html/html/images/flags/sa.png and /dev/null differ
diff --git a/html/html/images/flags/sb.png b/html/html/images/flags/sb.png
deleted file mode 100644
index e1ca39b5d7..0000000000
Binary files a/html/html/images/flags/sb.png and /dev/null differ
diff --git a/html/html/images/flags/sc.png b/html/html/images/flags/sc.png
deleted file mode 100644
index 0d42691b70..0000000000
Binary files a/html/html/images/flags/sc.png and /dev/null differ
diff --git a/html/html/images/flags/sd.png b/html/html/images/flags/sd.png
deleted file mode 100644
index d9a8e943c0..0000000000
Binary files a/html/html/images/flags/sd.png and /dev/null differ
diff --git a/html/html/images/flags/se.png b/html/html/images/flags/se.png
deleted file mode 100644
index 56f85793f5..0000000000
Binary files a/html/html/images/flags/se.png and /dev/null differ
diff --git a/html/html/images/flags/sg.png b/html/html/images/flags/sg.png
deleted file mode 100644
index debeda7804..0000000000
Binary files a/html/html/images/flags/sg.png and /dev/null differ
diff --git a/html/html/images/flags/sh.png b/html/html/images/flags/sh.png
deleted file mode 100644
index 070cd3bb88..0000000000
Binary files a/html/html/images/flags/sh.png and /dev/null differ
diff --git a/html/html/images/flags/si.png b/html/html/images/flags/si.png
deleted file mode 100644
index a8525d41fa..0000000000
Binary files a/html/html/images/flags/si.png and /dev/null differ
diff --git a/html/html/images/flags/sj.png b/html/html/images/flags/sj.png
deleted file mode 100644
index 2b44b90e49..0000000000
Binary files a/html/html/images/flags/sj.png and /dev/null differ
diff --git a/html/html/images/flags/sk.png b/html/html/images/flags/sk.png
deleted file mode 100644
index 9477a5855c..0000000000
Binary files a/html/html/images/flags/sk.png and /dev/null differ
diff --git a/html/html/images/flags/sl.png b/html/html/images/flags/sl.png
deleted file mode 100644
index 9178f63f65..0000000000
Binary files a/html/html/images/flags/sl.png and /dev/null differ
diff --git a/html/html/images/flags/sm.png b/html/html/images/flags/sm.png
deleted file mode 100644
index 9dc99fa253..0000000000
Binary files a/html/html/images/flags/sm.png and /dev/null differ
diff --git a/html/html/images/flags/sn.png b/html/html/images/flags/sn.png
deleted file mode 100644
index 0f0e66ced6..0000000000
Binary files a/html/html/images/flags/sn.png and /dev/null differ
diff --git a/html/html/images/flags/so.png b/html/html/images/flags/so.png
deleted file mode 100644
index 680bfc28b0..0000000000
Binary files a/html/html/images/flags/so.png and /dev/null differ
diff --git a/html/html/images/flags/sr.png b/html/html/images/flags/sr.png
deleted file mode 100644
index 339bbb65ea..0000000000
Binary files a/html/html/images/flags/sr.png and /dev/null differ
diff --git a/html/html/images/flags/st.png b/html/html/images/flags/st.png
deleted file mode 100644
index 3b6db16271..0000000000
Binary files a/html/html/images/flags/st.png and /dev/null differ
diff --git a/html/html/images/flags/sv.png b/html/html/images/flags/sv.png
deleted file mode 100644
index d71be3e659..0000000000
Binary files a/html/html/images/flags/sv.png and /dev/null differ
diff --git a/html/html/images/flags/sy.png b/html/html/images/flags/sy.png
deleted file mode 100644
index 5b350b780c..0000000000
Binary files a/html/html/images/flags/sy.png and /dev/null differ
diff --git a/html/html/images/flags/sz.png b/html/html/images/flags/sz.png
deleted file mode 100644
index 48deaaf371..0000000000
Binary files a/html/html/images/flags/sz.png and /dev/null differ
diff --git a/html/html/images/flags/tc.png b/html/html/images/flags/tc.png
deleted file mode 100644
index 6e164c3488..0000000000
Binary files a/html/html/images/flags/tc.png and /dev/null differ
diff --git a/html/html/images/flags/td.png b/html/html/images/flags/td.png
deleted file mode 100644
index 0fb0e321ba..0000000000
Binary files a/html/html/images/flags/td.png and /dev/null differ
diff --git a/html/html/images/flags/tf.png b/html/html/images/flags/tf.png
deleted file mode 100644
index d986c06171..0000000000
Binary files a/html/html/images/flags/tf.png and /dev/null differ
diff --git a/html/html/images/flags/tg.png b/html/html/images/flags/tg.png
deleted file mode 100644
index 354772f188..0000000000
Binary files a/html/html/images/flags/tg.png and /dev/null differ
diff --git a/html/html/images/flags/th.png b/html/html/images/flags/th.png
deleted file mode 100644
index 88e94a01de..0000000000
Binary files a/html/html/images/flags/th.png and /dev/null differ
diff --git a/html/html/images/flags/tj.png b/html/html/images/flags/tj.png
deleted file mode 100644
index dd802f02eb..0000000000
Binary files a/html/html/images/flags/tj.png and /dev/null differ
diff --git a/html/html/images/flags/tk.png b/html/html/images/flags/tk.png
deleted file mode 100644
index 233a7af8c2..0000000000
Binary files a/html/html/images/flags/tk.png and /dev/null differ
diff --git a/html/html/images/flags/tl.png b/html/html/images/flags/tl.png
deleted file mode 100644
index 22169214cf..0000000000
Binary files a/html/html/images/flags/tl.png and /dev/null differ
diff --git a/html/html/images/flags/tm.png b/html/html/images/flags/tm.png
deleted file mode 100644
index efc4867d33..0000000000
Binary files a/html/html/images/flags/tm.png and /dev/null differ
diff --git a/html/html/images/flags/tn.png b/html/html/images/flags/tn.png
deleted file mode 100644
index 7dc6df9692..0000000000
Binary files a/html/html/images/flags/tn.png and /dev/null differ
diff --git a/html/html/images/flags/to.png b/html/html/images/flags/to.png
deleted file mode 100644
index 27df6fdafc..0000000000
Binary files a/html/html/images/flags/to.png and /dev/null differ
diff --git a/html/html/images/flags/tp.png b/html/html/images/flags/tp.png
deleted file mode 100644
index f612ed837c..0000000000
Binary files a/html/html/images/flags/tp.png and /dev/null differ
diff --git a/html/html/images/flags/tr.png b/html/html/images/flags/tr.png
deleted file mode 100644
index ca88f97d5f..0000000000
Binary files a/html/html/images/flags/tr.png and /dev/null differ
diff --git a/html/html/images/flags/tt.png b/html/html/images/flags/tt.png
deleted file mode 100644
index 37d38fe4ba..0000000000
Binary files a/html/html/images/flags/tt.png and /dev/null differ
diff --git a/html/html/images/flags/tv.png b/html/html/images/flags/tv.png
deleted file mode 100644
index b86f1bc547..0000000000
Binary files a/html/html/images/flags/tv.png and /dev/null differ
diff --git a/html/html/images/flags/tw.png b/html/html/images/flags/tw.png
deleted file mode 100644
index 85eb1ffa4e..0000000000
Binary files a/html/html/images/flags/tw.png and /dev/null differ
diff --git a/html/html/images/flags/tz.png b/html/html/images/flags/tz.png
deleted file mode 100644
index 2b0880afb8..0000000000
Binary files a/html/html/images/flags/tz.png and /dev/null differ
diff --git a/html/html/images/flags/ua.png b/html/html/images/flags/ua.png
deleted file mode 100644
index 46b0aaf5d1..0000000000
Binary files a/html/html/images/flags/ua.png and /dev/null differ
diff --git a/html/html/images/flags/ug.png b/html/html/images/flags/ug.png
deleted file mode 100644
index 22dd07f28c..0000000000
Binary files a/html/html/images/flags/ug.png and /dev/null differ
diff --git a/html/html/images/flags/um.png b/html/html/images/flags/um.png
deleted file mode 100644
index e959d31265..0000000000
Binary files a/html/html/images/flags/um.png and /dev/null differ
diff --git a/html/html/images/flags/us.png b/html/html/images/flags/us.png
deleted file mode 100644
index cebf562600..0000000000
Binary files a/html/html/images/flags/us.png and /dev/null differ
diff --git a/html/html/images/flags/uy.png b/html/html/images/flags/uy.png
deleted file mode 100644
index 3aed8f7eb9..0000000000
Binary files a/html/html/images/flags/uy.png and /dev/null differ
diff --git a/html/html/images/flags/uz.png b/html/html/images/flags/uz.png
deleted file mode 100644
index 1c9ca15380..0000000000
Binary files a/html/html/images/flags/uz.png and /dev/null differ
diff --git a/html/html/images/flags/va.png b/html/html/images/flags/va.png
deleted file mode 100644
index fd3984bf01..0000000000
Binary files a/html/html/images/flags/va.png and /dev/null differ
diff --git a/html/html/images/flags/vc.png b/html/html/images/flags/vc.png
deleted file mode 100644
index 230ef4c22c..0000000000
Binary files a/html/html/images/flags/vc.png and /dev/null differ
diff --git a/html/html/images/flags/ve.png b/html/html/images/flags/ve.png
deleted file mode 100644
index 292db90c92..0000000000
Binary files a/html/html/images/flags/ve.png and /dev/null differ
diff --git a/html/html/images/flags/vg.png b/html/html/images/flags/vg.png
deleted file mode 100644
index 5c0acd3f2f..0000000000
Binary files a/html/html/images/flags/vg.png and /dev/null differ
diff --git a/html/html/images/flags/vi.png b/html/html/images/flags/vi.png
deleted file mode 100644
index a9a9c6bf08..0000000000
Binary files a/html/html/images/flags/vi.png and /dev/null differ
diff --git a/html/html/images/flags/vn.png b/html/html/images/flags/vn.png
deleted file mode 100644
index 20ef1c2683..0000000000
Binary files a/html/html/images/flags/vn.png and /dev/null differ
diff --git a/html/html/images/flags/vu.png b/html/html/images/flags/vu.png
deleted file mode 100644
index 0ce47d09af..0000000000
Binary files a/html/html/images/flags/vu.png and /dev/null differ
diff --git a/html/html/images/flags/wf.png b/html/html/images/flags/wf.png
deleted file mode 100644
index 98cf4f577b..0000000000
Binary files a/html/html/images/flags/wf.png and /dev/null differ
diff --git a/html/html/images/flags/ws.png b/html/html/images/flags/ws.png
deleted file mode 100644
index 9d8cc2ca83..0000000000
Binary files a/html/html/images/flags/ws.png and /dev/null differ
diff --git a/html/html/images/flags/ye.png b/html/html/images/flags/ye.png
deleted file mode 100644
index 09199ca033..0000000000
Binary files a/html/html/images/flags/ye.png and /dev/null differ
diff --git a/html/html/images/flags/yt.png b/html/html/images/flags/yt.png
deleted file mode 100644
index 2fdd8d4fe9..0000000000
Binary files a/html/html/images/flags/yt.png and /dev/null differ
diff --git a/html/html/images/flags/yu.png b/html/html/images/flags/yu.png
deleted file mode 100644
index 0560483218..0000000000
Binary files a/html/html/images/flags/yu.png and /dev/null differ
diff --git a/html/html/images/flags/za.png b/html/html/images/flags/za.png
deleted file mode 100644
index 77f4aa5fec..0000000000
Binary files a/html/html/images/flags/za.png and /dev/null differ
diff --git a/html/html/images/flags/zm.png b/html/html/images/flags/zm.png
deleted file mode 100644
index b053a8d301..0000000000
Binary files a/html/html/images/flags/zm.png and /dev/null differ
diff --git a/html/html/images/flags/zw.png b/html/html/images/flags/zw.png
deleted file mode 100644
index 98095dfead..0000000000
Binary files a/html/html/images/flags/zw.png and /dev/null differ
diff --git a/html/html/themes/darkdos/include/functions.pl b/html/html/themes/darkdos/include/functions.pl
index 737e051e7a..7d803b6ad3 100644
--- a/html/html/themes/darkdos/include/functions.pl
+++ b/html/html/themes/darkdos/include/functions.pl
@@ -227,7 +227,7 @@ END
     if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') {
         print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; 
     } else {
-				print "<h1><span>-= IPFire =-</span></h1><br />";
+				print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />";
 		}
 		print <<END
 			<h2>+ $h2 +</h2>
diff --git a/html/html/themes/darkdos/include/style.css b/html/html/themes/darkdos/include/style.css
index e7140cde88..cc4b3c9653 100644
--- a/html/html/themes/darkdos/include/style.css
+++ b/html/html/themes/darkdos/include/style.css
@@ -366,6 +366,10 @@ min-width: 2.0em;
 max-width: 2.5em;
 }
 
+table.fw-nat tbody tr td {
+	height: 2.25em;
+}
+
 /* LAYOUT - 3 COLUMNS */
 
 	/* Primary content */
diff --git a/html/html/themes/ipfire-legacy/include/functions.pl b/html/html/themes/ipfire-legacy/include/functions.pl
index 14010306bd..528825329f 100644
--- a/html/html/themes/ipfire-legacy/include/functions.pl
+++ b/html/html/themes/ipfire-legacy/include/functions.pl
@@ -227,7 +227,7 @@ END
     if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') {
         print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; 
     } else {
-                                print "<h1><span>IPFire</span></h1><br />";
+                                print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>IPFire</a></span></h1><br />";
                 }
                 print <<END
                         <h2>$h2</h2>
diff --git a/html/html/themes/ipfire-legacy/include/style.css b/html/html/themes/ipfire-legacy/include/style.css
index d2c458e510..288a0feeb3 100644
--- a/html/html/themes/ipfire-legacy/include/style.css
+++ b/html/html/themes/ipfire-legacy/include/style.css
@@ -343,6 +343,10 @@ min-width: 2.0em;
 max-width: 2.5em;
 }
 
+table.fw-nat tbody tr td {
+	height: 2.25em;
+}
+
 /* LAYOUT - 3 COLUMNS */
 
 	/* Primary content */
diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css
index 0e990d6811..1cc18f8978 100644
--- a/html/html/themes/ipfire/include/css/style.css
+++ b/html/html/themes/ipfire/include/css/style.css
@@ -115,7 +115,6 @@ iframe {
 #logo {
 	height: 65px;
 	margin-top: 1em;
-	background: url('../../images/tux2.png') no-repeat;
 }
 
 #logo h1 {
@@ -324,3 +323,7 @@ table {
 .tbl tr:last-child td {
 	border-bottom: 1px solid lightgrey;
 }
+
+table.fw-nat tbody tr td {
+	height: 2.25em;
+}
diff --git a/html/html/themes/ipfire/include/functions.pl b/html/html/themes/ipfire/include/functions.pl
index 63740d42d8..eedf069dda 100644
--- a/html/html/themes/ipfire/include/functions.pl
+++ b/html/html/themes/ipfire/include/functions.pl
@@ -152,12 +152,14 @@ print <<END
 	<body>
 		<div id="header" class="fixed">
 			<div id="logo">
+				<a href="http://www.ipfire.org" style="text-decoration: none;">
+					<img src="/themes/ipfire/images/tux2.png" style="float:left; margin-left: -3px; margin-top: -3px;"/>
 END
 ;
 	if ($settings{'WINDOWWITHHOSTNAME'} ne 'off') {
-		print "<h1>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</h1>";
+		print "</a><h1>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</h1>";
 	} else {
-		print "<h1>IPFire</h1>";
+		print "<h1>IPFire</h1></a>";
 	}
 
 print <<END
diff --git a/html/html/themes/maniac/images/Thumbs.db b/html/html/themes/maniac/images/Thumbs.db
deleted file mode 100644
index 37ec790fdd..0000000000
Binary files a/html/html/themes/maniac/images/Thumbs.db and /dev/null differ
diff --git a/html/html/themes/maniac/include/functions.pl b/html/html/themes/maniac/include/functions.pl
index e8514adfbf..4866fcd0c7 100644
--- a/html/html/themes/maniac/include/functions.pl
+++ b/html/html/themes/maniac/include/functions.pl
@@ -227,7 +227,7 @@ END
     if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') {
         print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; 
     } else {
-				print "<h1><span>-= IPFire =-</span></h1><br />";
+				print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />";
 		}
 		print <<END
 			<h2>+ $h2 +</h2>
diff --git a/html/html/themes/maniac/include/style.css b/html/html/themes/maniac/include/style.css
index eca34cb850..3cb2741301 100644
--- a/html/html/themes/maniac/include/style.css
+++ b/html/html/themes/maniac/include/style.css
@@ -372,6 +372,10 @@ min-width: 2.0em;
 max-width: 2.5em;
 }
 
+table.fw-nat tbody tr td {
+	height: 2.25em;
+}
+
 /* LAYOUT - 3 COLUMNS */
 
 	/* Primary content */
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index ea92d806cb..cf04d3d5a8 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -416,6 +416,7 @@
 'bit' => 'Bit',
 'bitrate' => 'Bitrate',
 'bleeding rules' => 'Bleeding Edge Snort Rules',
+'block' => 'Blocken',
 'blue' => 'BLAU',
 'blue access' => 'Zugriff auf Blau',
 'blue access use hint' => 'Sie mÃ¼ssen mindestens die MAC- oder die IP-Adresse fÃ¼r ein GerÃ¤t angeben. Optional kÃ¶nnen Sie sowohl MAC- als auch IP-Adresse angeben.',
@@ -532,6 +533,7 @@
 'chain' => 'VerknÃ¼pfung',
 'change passwords' => 'PasswÃ¶rter Ã¤ndern',
 'change share' => 'Freigabeeinstellungen Ã¤ndern',
+'check all' => 'Alle auswÃ¤hlen',
 'check for net traffic update' => 'PrÃ¼fe auf Net-Traffic-Updates',
 'check vpn lr' => 'ÃberprÃ¼fen',
 'choose config' => 'Konfiguration auswÃ¤hlen',
@@ -689,7 +691,7 @@
 'dhcp advopt removed' => 'DHCP Option entfernt',
 'dhcp advopt scope' => 'Options-Wertebereich',
 'dhcp advopt scope global' => 'Global',
-'dhcp advopt scope help' => 'Globaler Bereich oder begenze Bereich auf Ã¼berprÃ¼fte Schnittstellen',
+'dhcp advopt scope help' => 'Globaler Bereich oder begrenze Bereich auf Ã¼berprÃ¼fte Schnittstellen',
 'dhcp advopt unknown' => 'Name der DHCP Option wurde nicht erkannt',
 'dhcp advopt value' => 'Optionswert',
 'dhcp allow bootp' => 'BOOTP Clients zulassen',
@@ -836,7 +838,27 @@
 'edit share' => 'Freigabe bearbeiten',
 'editor' => 'Editor',
 'eg' => 'z.B.:',
+'email config' => 'Konfiguration',
+'email empty field' => 'Leeres Feld',
+'email error' => 'ERROR: Testmail konnte nicht versendet werden',
+'email invalid' => 'UngÃ¼ltiges Feld',
+'email invalid mailfqdn' => 'UngÃ¼ltiger FQDN fÃ¼r Mailserver',
+'email invalid mailip' => 'UngÃ¼ltige IP-Adresse fÃ¼r Mailserver',
+'email invalid mailport' => 'UngÃ¼ltiger Port fÃ¼r Mailserver',
+'email mailaddr' => 'Mailserver-Adresse',
+'email mailpass' => 'Passwort',
+'email mailport' => 'Mailserver-Port',
+'email mailrcpt' => 'E-Mail-EmpfÃ¤nger',
+'email mailsender' => 'E-Mail Absender',
+'email mailuser' => 'Benutzername',
 'email server can not be empty' => 'Email-Server darf nicht leer sein',
+'email settings' => 'Mailversand',
+'email subject' => 'IPFire Testmail',
+'email success' => 'Testmail erfolgreich versendet',
+'email testmail' => 'Testnachricht senden',
+'email text' => 'Testnachricht vom IPFire Mailversand.',
+'email tls' => 'TLS aktivieren',
+'email usemail' => 'Mailversand aktivieren',
 'emailreportlevel' => 'Email-Reportlevel',
 'empty' => 'Dieses Feld kann leer bleiben',
 'empty profile' => 'Unbenannt',
@@ -1072,6 +1094,7 @@
 'fwhost OpenVPN static host' => 'OpenVPN statischer Host',
 'fwhost OpenVPN static network' => 'OpenVPN statisches Netzwerk',
 'fwhost Standard Network' => 'Standard-Netzwerk',
+'fwhost addgeoipgrp' => 'Neue GeoIP-Gruppe hinzufÃ¼gen',
 'fwhost addgrp' => 'Neue Gruppe hinzufÃ¼gen',
 'fwhost addgrpname' => 'Gruppenname:',
 'fwhost addhost' => 'Neuen Host hinzufÃ¼gen',
@@ -1087,6 +1110,9 @@
 'fwhost change' => 'Ãndern',
 'fwhost changeremark' => 'Es wurde nur die Bemerkung angepasst.',
 'fwhost cust addr' => 'Hosts',
+'fwhost cust geoip' => 'GeoIP-Gruppen',
+'fwhost cust geoipgroup' => 'GeoIP-Gruppen',
+'fwhost cust geoiplocation' => 'GeoIP LÃ¤ndercodes',
 'fwhost cust grp' => 'Gruppen',
 'fwhost cust net' => 'Netzwerke',
 'fwhost cust service' => 'Dienste',
@@ -1133,6 +1159,7 @@
 'fwhost ipsec net' => 'IPsec-Netzwerke:',
 'fwhost menu' => 'Firewallgruppen',
 'fwhost netaddress' => 'Netzwerkadresse',
+'fwhost newgeoipgrp' => 'GeoIP-Gruppen',
 'fwhost newgrp' => 'Netzwerk-/Hostgruppen',
 'fwhost newhost' => 'Hosts',
 'fwhost newnet' => 'Netzwerke',
@@ -1167,6 +1194,16 @@
 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Die Erzeugung der Root- und Host-Zertifikate kann lange Zeit dauern.  Auf Ã¤lterer Hardware kann es mehrere Minuten lang dauern. Bitte haben Sie etwas Geduld.',
 'genkey' => 'PSK erzeugen',
 'genre' => 'Genre',
+'geoip' => 'GeoIP',
+'geoipblock' => 'GeoIP Block',
+'geoipblock block countries' => 'LÃ¤nderfilter',
+'geoipblock configuration' => 'GeoIP Konfiguration',
+'geoipblock country code' => 'LÃ¤ndercode',
+'geoipblock country is allowed' => 'Eingehende Verbindungen aus diesem Land sind erlaubt.',
+'geoipblock country is blocked' => 'Eingehende Verbindungen aus diesem Land werden blockiert.',
+'geoipblock country name' => 'LÃ¤ndername',
+'geoipblock enable feature' => 'GeoIP basierte Filterung aktivieren:',
+'geoipblock flag' => 'Flagge',
 'global settings' => 'Globale Einstellungen',
 'gpl i accept these terms and conditions' => 'Ich akzeptiere diese Bedingungen und Konditionen',
 'gpl license agreement' => 'Lizenz-Vereinbarung',
@@ -1810,6 +1847,9 @@
 'ppp setup' => 'PPP-Einstellungen',
 'pppoe' => 'PPPoE',
 'pppoe settings' => 'ZusÃ¤tzliche PPPoE-Einstellungen:',
+'pptp netconfig' => 'Eigene Netzkonfiguration',
+'pptp peer' => 'Gegenstelle',
+'pptp route' => 'PPTP-Route',
 'pptp settings' => 'ZusÃ¤tzliche PPTP-Einstellungen:',
 'pre-shared key is too short' => 'Pre-shared SchlÃ¼sel ist zu kurz',
 'prefered master' => 'Prefered Master',
@@ -1900,6 +1940,7 @@
 'reportlevel' => 'Report Level',
 'request' => 'Abfrage',
 'requested data' => '1. Verbindungs-Einstellungen',
+'required field' => 'Pflichtfeld',
 'reserved dst port' => 'Dieser Zielport ist fÃ¼r die ausschlieÃliche Benutzung durch IPFire reserviert:',
 'reserved src port' => 'Dieser Quellport ist fÃ¼r die ausschlieÃliche Benutzung durch IPFire reserviert:',
 'reset' => 'ZurÃ¼cksetzen',
@@ -1938,6 +1979,7 @@
 'save settings' => 'Einstellungen speichern',
 'save-adv-options' => 'Erweiterte Optionen speichern',
 'script name' => 'Skriptname:',
+'search' => 'Suchen',
 'secondary dns' => 'SekundÃ¤rer DNS:',
 'secondary ntp server' => 'SekundÃ¤rer NTP-Server',
 'secondary wins server address' => 'SekundÃ¤re WINS-Server Adresse',
@@ -2109,7 +2151,6 @@
 'there are updates available' => 'FÃ¼r Ihr System sind Programm-Updates verfÃ¼gbar. Es wird dringend empfohlen, daÃ Sie Ihr System baldmÃ¶glichst aktualisieren.',
 'there was no file upload' => 'Es wurde keine Datei hochgeladen',
 'this feature has been sponsored by' => 'Diese Funktion wurde gesponsort von',
-'this field may be blank' => 'Dieses Feld kann leer bleiben.',
 'this is not a valid archive' => 'Dies ist kein gÃ¼ltiges Archiv.',
 'this is not an authorised update' => 'Dies ist kein autorisiertes Update.',
 'this months volume' => 'Diesen Monat',
@@ -2221,6 +2262,9 @@
 'umount removable media before to unplug' => 'Wechselmedien vor dem Entfernen unbedingt abmelden',
 'unable to alter profiles while red is active' => 'Profile kÃ¶nnen nicht geÃ¤ndert werden, solange ROT aktiv ist.',
 'unable to contact' => 'Kann nicht erreicht werden',
+'unblock' => 'Entblocken',
+'unblock all' => 'Alle entblocken',
+'uncheck all' => 'Alle abwÃ¤hlen',
 'unencrypted' => 'Nicht verschlÃ¼sselt',
 'uninstall' => 'Deinstallieren',
 'unix charset' => 'UNIX-Charset',
@@ -2530,11 +2574,11 @@
 'urlfilter whitelist always allowed' => 'Erlaube angepasste Whitelist fÃ¼r gesperrte Clients',
 'urlfilter wrong filetype' => 'Die Datei hat nicht die Erweiterung .tar.gz',
 'use' => 'Einsatz',
-'use a pre-shared key' => 'Verwenden Sie einen Pre-Shared SchlÃ¼ssel:',
+'use a pre-shared key' => 'Pre-Shared-Key verwenden:',
 'use dov' => 'DOV (Data Over Voice) benutzen:',
 'use ibod' => 'Bandwidth on Demand (iBOD) benutzen:',
 'use ipfire red ip' => 'Die klassische ROTE IP, welche von IPFire wÃ¤hrend der Verbindung verwendet wird',
-'use only proposed settings' => 'Verwenden Sie nur die vorgeschlagenen Einstellungen.',
+'use only proposed settings' => 'Nur die vorgeschlagenen Einstellungen verwenden',
 'used' => 'Benutzt',
 'used memory' => 'Genutzter Speicher',
 'used swap' => 'Genutzter Swap',
@@ -2578,8 +2622,9 @@
 'vpn payload compression' => 'Datennutzlast-Kompression aushandeln',
 'vpn red name' => 'Ãffentliche IP oder FQDN fÃ¼r das rote Interface oder <%defaultroute>',
 'vpn remote id' => 'Remote ID',
+'vpn statistic n2n' => 'OpenVPN-Netz-zu-Netz-Statistik',
+'vpn statistic rw' => 'OpenVPN-Roadwarrior-Statistik',
 'vpn subjectaltname' => 'Subjekt Alternativer Name',
-'vpn vhost' => 'Roadwarrior virtuelle IP (manchmal auch Inner-IP genannt)',
 'vpn watch' => 'Netz-zu-Netz VPN neu starten, wenn sich Remote-IP Ã¤ndert (DynDNS).',
 'waiting to synchronize clock' => 'Bitte warten, die Uhr wird synchronisiert',
 'warn when traffic reaches' => 'Warnen wenn Traffic x % erreicht',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index c788866450..56238ed3e1 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -435,6 +435,7 @@
 'bit' => 'bit',
 'bitrate' => 'Bitrate',
 'bleeding rules' => 'Bleeding Edge Snort Rules',
+'block' => 'Block',
 'blue' => 'BLUE',
 'blue access' => 'Blue Access',
 'blue access use hint' => 'You have to enter the MAC or the IP Address for a device. To enter both is also possible',
@@ -550,6 +551,7 @@
 'chain' => 'Chain',
 'change passwords' => 'Change passwords',
 'change share' => 'edit share options',
+'check all' => 'Check all',
 'check for net traffic update' => 'Check for Net-Traffic updates',
 'check vpn lr' => 'Check',
 'choose config' => 'Choose config',
@@ -862,7 +864,27 @@
 'edit share' => 'Edit share',
 'editor' => 'Editor',
 'eg' => 'e.g.:',
+'email config' => 'Configuration',
+'email empty field' => 'Empty field',
+'email error' => 'ERROR: Testmail could not be sent',
+'email invalid' => 'Invalid field',
+'email invalid mailfqdn' => 'Invalid mailserver fqdn',
+'email invalid mailip' => 'Invalid mailserver IP address',
+'email invalid mailport' => 'Invalid mailserver port',
+'email mailaddr' => 'Mailserver address',
+'email mailpass' => 'Password',
+'email mailport' => 'Mailserver port',
+'email mailrcpt' => 'Mail recipient',
+'email mailsender' => 'Mail sender',
+'email mailuser' => 'Username',
 'email server can not be empty' => 'E-mail server can not be empty',
+'email settings' => 'Mailservice',
+'email subject' => 'IPFire Testmail',
+'email success' => 'Testmail successfully sent',
+'email testmail' => 'Send testmail',
+'email text' => 'Testmail from IPFire Mailservice.',
+'email tls' => 'Use TLS',
+'email usemail' => 'Activate Mailservice',
 'emailreportlevel' => 'E-mailreportlevel',
 'emerging rules' => 'Emergingthreats.net Community Rules',
 'empty' => 'This field may be left blank',
@@ -1099,6 +1121,7 @@
 'fwhost OpenVPN static host' => 'OpenVPN static host',
 'fwhost OpenVPN static network' => 'OpenVPN static network',
 'fwhost Standard Network' => 'Standard network',
+'fwhost addgeoipgrp' => 'Add new GeoIP group',
 'fwhost addgrp' => 'Add new network/host group',
 'fwhost addgrpname' => 'Group name:',
 'fwhost addhost' => 'Add new host',
@@ -1114,6 +1137,9 @@
 'fwhost change' => 'Modify',
 'fwhost changeremark' => 'You modified just the remark',
 'fwhost cust addr' => 'Hosts',
+'fwhost cust geoip' => 'GeoIP Groups',
+'fwhost cust geoipgroup' => 'GeoIP Groups',
+'fwhost cust geoiplocation' => 'GeoIP Locations',
 'fwhost cust grp' => 'Network/Host Groups',
 'fwhost cust net' => 'Networks',
 'fwhost cust service' => 'Services',
@@ -1160,6 +1186,7 @@
 'fwhost ipsec net' => 'IPsec networks:',
 'fwhost menu' => 'Firewall Groups',
 'fwhost netaddress' => 'Network address',
+'fwhost newgeoipgrp' => 'GeoIP Groups',
 'fwhost newgrp' => 'Network/Host Groups',
 'fwhost newhost' => 'Hosts',
 'fwhost newnet' => 'Networks',
@@ -1196,6 +1223,16 @@
 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Generating the root and host certificates may take a long time.  It can take up to several minutes on older hardware. Please be patient.',
 'genkey' => 'Generate PSK',
 'genre' => 'Genre',
+'geoip' => 'GeoIP',
+'geoipblock' => 'GeoIP Block',
+'geoipblock block countries' => 'Block countries',
+'geoipblock configuration' => 'GeoIP Configuration',
+'geoipblock country code' => 'Country Code',
+'geoipblock country is allowed' => 'Incoming traffic from this country is allowed',
+'geoipblock country is blocked' => 'Incoming traffic from this country will be blocked',
+'geoipblock country name' => 'Country Name',
+'geoipblock enable feature' => 'Enable GeoIP based blocking:',
+'geoipblock flag' => 'Flag',
 'global settings' => 'Global Settings',
 'gpl i accept these terms and conditions' => 'I accept these terms and conditions',
 'gpl license agreement' => 'License Agreement',
@@ -1633,6 +1670,7 @@
 'no modem selected' => 'No modem selected',
 'no set selected' => 'No set was selected',
 'no time limit' => 'unlimited time',
+'none' => 'none',
 'none found' => 'none found',
 'nonetworkname' => 'No Network Name entered',
 'noservicename' => 'No Service Name entered',
@@ -1840,6 +1878,9 @@
 'ppp setup' => 'PPP setup',
 'pppoe' => 'PPPoE',
 'pppoe settings' => 'Additional PPPoE settings:',
+'pptp netconfig' => 'My Net Config',
+'pptp peer' => 'Peer',
+'pptp route' => 'PPTP Route',
 'pptp settings' => 'Additional PPTP settings:',
 'pre-shared key is too short' => 'Pre-shared key is too short.',
 'prefered master' => 'Prefered Master',
@@ -1932,6 +1973,7 @@
 'reportlevel' => 'Reportlevel',
 'request' => 'Request',
 'requested data' => '1. Connection Settings:',
+'required field' => 'Required field',
 'reserved dst port' => 'Destination port is reserved for IPFire use only:',
 'reserved src port' => 'Source port is reserved for IPFire use only:',
 'reset' => 'Reset',
@@ -1970,6 +2012,7 @@
 'save settings' => 'Save settings',
 'save-adv-options' => 'Save advanced options',
 'script name' => 'Script name:',
+'search' => 'Search',
 'secondary dns' => 'Secondary DNS:',
 'secondary ntp server' => 'Secondary NTP server',
 'secondary wins server address' => 'Secondary WINS server address',
@@ -2146,7 +2189,6 @@
 'there are updates available' => 'There are updates available for your system. It is strongly urged that you install them as soon as possible.',
 'there was no file upload' => 'There was no file upload.',
 'this feature has been sponsored by' => 'This feature has been sponsored by',
-'this field may be blank' => 'This field may be blank.',
 'this is not a valid archive' => 'This is not a valid archive.',
 'this is not an authorised update' => 'This is not an authorised update.',
 'this months volume' => 'This months volume',
@@ -2260,6 +2302,9 @@
 'umount removable media before to unplug' => 'Umount removable media before unplugging the device',
 'unable to alter profiles while red is active' => 'Unable to alter profiles while RED is active.',
 'unable to contact' => 'Unable to contact',
+'unblock' => 'Unblock',
+'unblock all' => 'Unblock all',
+'uncheck all' => 'Uncheck all',
 'unencrypted' => 'Unencrypted',
 'uninstall' => 'Uninstall',
 'unix charset' => 'UNIX Charset',
@@ -2608,6 +2653,7 @@
 'vpn configuration main' => 'VPN Configuration',
 'vpn delayed start' => 'Delay before launching VPN (seconds)',
 'vpn delayed start help' => 'If required, this delay can be used to allow dynamic DNS updates to propagate properly. 60 is a common value when RED is a dynamic IP.',
+'vpn force mobike' => 'Force using MOBIKE (only IKEv2)',
 'vpn incompatible use of defaultroute' => 'hostname=%defaultroute not allowed',
 'vpn keyexchange' => 'Keyexchange',
 'vpn local id' => 'Local ID',
@@ -2620,8 +2666,9 @@
 'vpn payload compression' => 'Negotiate payload compression',
 'vpn red name' => 'Public IP or FQDN for RED interface or <%defaultroute>',
 'vpn remote id' => 'Remote ID',
+'vpn statistic n2n' => 'OpenVPN Net-to-Net Statistics',
+'vpn statistic rw' => 'OpenVPN Roadwarrior Statistics',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',
diff --git a/langs/es/cgi-bin/es.pl b/langs/es/cgi-bin/es.pl
index b7c50ff108..e24e75e56b 100644
--- a/langs/es/cgi-bin/es.pl
+++ b/langs/es/cgi-bin/es.pl
@@ -866,6 +866,16 @@
 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Generar los certificador root y host puede tomar mucho tiempo. Puede durar varios minutos en equipos antiguos. Por favor sea paciente.',
 'genkey' => 'Generar PSK',
 'genre' => 'GÃ©nero',
+'geoip' => 'GeoIP',
+'geoipblock' => 'GeoIP Block',
+'geoipblock block countries' => 'PaÃses bloqueados',
+'geoipblock configuration' => 'ConfiguraciÃ³n GeoIP',
+'geoipblock country code' => 'CÃ³digo del PaÃs',
+'geoipblock country is allowed' => 'Se permite el trÃ¡fico procedente de este PaÃs',
+'geoipblock country is blocked' => 'Se deniega el trÃ¡fico procedente de este PaÃs',
+'geoipblock country name' => 'Nombre del PaÃs',
+'geoipblock enable feature' => 'Habilitar bloqueo basado GeoIP:',
+'geoipblock flag' => 'Bandera',
 'global settings' => 'Configuraciones globales',
 'gpl i accept these terms and conditions' => 'I accept these terms and conditions',
 'gpl license agreement' => 'License Agreement',
@@ -1689,7 +1699,6 @@
 'there are updates available' => 'Existen actualizaciones disponibles para su sistema. Se recomienda encarecidamente que las instala a la brevedad posible.',
 'there was no file upload' => 'No habÃa archivo para cargar.',
 'this feature has been sponsored by' => 'Esta caracterÃstica ha sido patrocinada por',
-'this field may be blank' => 'Este campo se puede dejar en blanco',
 'this is not a valid archive' => 'No es un archivo vÃ¡lido.',
 'this is not an authorised update' => 'No es una actualizaciÃ³n autorizada.',
 'this months volume' => 'VolÃºmen de este mes',
@@ -2098,7 +2107,6 @@
 'vpn red name' => 'DirecciÃ³n IP pÃºblica o FQDN para la interfaz RED o<%defaultroute>',
 'vpn remote id' => 'ID Remoto',
 'vpn subjectaltname' => 'Nombre alternativo en Asunto',
-'vpn vhost' => 'IP virtual Roadwarris (tambiÃ©n referida como ip-interior)',
 'vpn watch' => 'Reinciar vpn net-to-net cuando la ip remota cambie (dyndns)',
 'waiting to synchronize clock' => 'Esperando sincronizaciÃ³n con el reloj',
 'warn when traffic reaches' => 'Advertir cuando el trÃ¡fico alcance x %',
diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl
index 40053a061f..0d173aef34 100644
--- a/langs/fr/cgi-bin/fr.pl
+++ b/langs/fr/cgi-bin/fr.pl
@@ -1704,7 +1704,6 @@
 'there are updates available' => 'Plusieurs mises Ã  jour sont disponibles pour votre systÃ¨me. Il est recommandÃ© de les installer aussi vite que possible.',
 'there was no file upload' => 'Il n\'y a pas eu de fichier envoyÃ©.',
 'this feature has been sponsored by' => 'Cette fonctionnalitÃ© a Ã©tÃ© sponsorisÃ©e par',
-'this field may be blank' => 'Ce champ peut Ãªtre vide.',
 'this is not a valid archive' => 'Ceci n\'est pas une archive valide.',
 'this is not an authorised update' => 'Ce n\'est pas une mise Ã  jour autorisÃ©e.',
 'this months volume' => 'Le volume mensuel',
@@ -2112,7 +2111,6 @@
 'vpn red name' => 'IP publique ou nom de domaine complet pour l\'interface ROUGE ou <%defaultroute>',
 'vpn remote id' => 'ID Distant',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'IP Virtuelle Roadwarrior (parfois appelÃ©e Inner-IP)',
 'vpn watch' => 'RedÃ©marrer net-to-net VPN si IP hÃ´te distant change (dyndns).',
 'waiting to synchronize clock' => 'Attendre la synchronisation de l\'horloge',
 'warn when traffic reaches' => 'Avertir lorsque le trafic atteint x %',
diff --git a/langs/it/cgi-bin/it.pl b/langs/it/cgi-bin/it.pl
index 4fde313762..950f700267 100644
--- a/langs/it/cgi-bin/it.pl
+++ b/langs/it/cgi-bin/it.pl
@@ -2112,7 +2112,6 @@
 'there are updates available' => 'There are updates available for your system. It is strongly urged that you install them as soon as possible.',
 'there was no file upload' => 'There was no file upload.',
 'this feature has been sponsored by' => 'This feature has been sponsored by',
-'this field may be blank' => 'Questo campo può essere vuoto.',
 'this is not a valid archive' => 'This is not a valid archive.',
 'this is not an authorised update' => 'This is not an authorised update.',
 'this months volume' => 'This months volume',
@@ -2587,7 +2586,6 @@
 'vpn red name' => 'IP pubblico o il nome di dominio completo per l\'interfaccia RED o <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',
diff --git a/langs/nl/cgi-bin/nl.pl b/langs/nl/cgi-bin/nl.pl
index 7468eb9162..9d90a0815c 100644
--- a/langs/nl/cgi-bin/nl.pl
+++ b/langs/nl/cgi-bin/nl.pl
@@ -2057,7 +2057,6 @@
 'there are updates available' => 'Er zijn updates beschikbaar voor uw systeem. Het wordt aangeraden om deze zo snel mogelijk te installeren.',
 'there was no file upload' => 'Er is geen bestand geÃ¼pload.',
 'this feature has been sponsored by' => 'Deze feature wordt gesponsord door',
-'this field may be blank' => 'Dit veld mag leeg blijven.',
 'this is not a valid archive' => 'Dit is geen geldig archief.',
 'this is not an authorised update' => 'Dit is geen geautoriseerde update.',
 'this months volume' => 'Volume van deze maand',
@@ -2530,7 +2529,6 @@
 'vpn red name' => 'Publiek IP of FQDN voor RODE interface of <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Onderwerp Alt Naam',
-'vpn vhost' => 'Roadwarrior virtual IP (Ook wel Inner-IP genoemd)',
 'vpn watch' => 'Herstart net-to-net vpn wanneer remote peer IP verandert (dyndns).',
 'waiting to synchronize clock' => 'Wachten op synchronisatie van klok',
 'warn when traffic reaches' => 'Waarschuw wanneer verkeer x % bereikt',
diff --git a/langs/pl/cgi-bin/pl.pl b/langs/pl/cgi-bin/pl.pl
index 02fb531cf4..47abf2c5f4 100644
--- a/langs/pl/cgi-bin/pl.pl
+++ b/langs/pl/cgi-bin/pl.pl
@@ -1712,7 +1712,6 @@
 'there are updates available' => 'DostÄpne sÄ nowe aktualizacje dla twojego systemu. Zalecane jest wykonanie aktualizacji tak szybko jak to moÅ¼liwe',
 'there was no file upload' => 'Nie wgrano Å¼adnego pliku.',
 'this feature has been sponsored by' => 'Ta funkcjonalnoÅÄ jest sponsorowana przez',
-'this field may be blank' => 'To pole moÅ¼e byÄ puste.',
 'this is not a valid archive' => 'Nie odnaleziono poprawnego archiwum.',
 'this is not an authorised update' => 'To nie jest autoryzowana aktualizacja.',
 'this months volume' => 'IloÅÄ w tym miesiÄcu',
@@ -2121,7 +2120,6 @@
 'vpn red name' => 'Publiczne IP lub FQDN interfejsu RED lub <%defaultroute>',
 'vpn remote id' => 'Zdalne ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Uruchom ponownie vpn net-to-net kiedy zmieni siÄ IP zdalnej koÅcÃ³wki (dyndns).',
 'waiting to synchronize clock' => 'Oczekiwanie na synchronizacjÄ zegara',
 'warn when traffic reaches' => 'Ostrzegaj kiedy ruch osiÄgnie x %',
diff --git a/langs/ru/cgi-bin/ru.pl b/langs/ru/cgi-bin/ru.pl
index a2a3693884..6840f81207 100644
--- a/langs/ru/cgi-bin/ru.pl
+++ b/langs/ru/cgi-bin/ru.pl
@@ -1707,7 +1707,6 @@
 'there are updates available' => 'There are updates available for your system. It is strongly urged that you install them as soon as possible.',
 'there was no file upload' => 'There was no file upload.',
 'this feature has been sponsored by' => 'This feature has been sponsored by',
-'this field may be blank' => 'ÐÑÐ¸ Ð¿Ð¾Ð»Ñ Ð¼Ð¾Ð³ÑÑ Ð¾ÑÑÐ°ÑÑÑÑ Ð¿ÑÑÑÑÐ¼Ð¸.',
 'this is not a valid archive' => 'This is not a valid archive.',
 'this is not an authorised update' => 'This is not an authorised update.',
 'this months volume' => 'This months volume',
@@ -2116,7 +2115,6 @@
 'vpn red name' => 'ÐÐ½ÐµÑÐ½Ð¸Ð¹ IP Ð¸Ð»Ð¸ FQDN Ð´Ð»Ñ RED Ð¸Ð½ÑÐµÑÑÐµÐ¹ÑÐ° Ð¸Ð»Ð¸ <%defaultroute>',
 'vpn remote id' => 'Ð£Ð´Ð°Ð»ÑÐ½Ð½ÑÐ¹ ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'ÐÐµÑÐµÐ·Ð°Ð¿ÑÑÐºÐ°ÑÑ net-to-net vpn ÐºÐ¾Ð³Ð´Ð° ÑÐ´Ð°Ð»ÑÐ½Ð½ÑÐ¹ IP Ð¼ÐµÐ½ÑÐµÑÑÑ (dyndns).',
 'waiting to synchronize clock' => 'ÐÐ¶Ð¸Ð´Ð°ÐµÑÑÑ ÑÐ¸Ð½ÑÑÐ¾Ð½Ð¸Ð·Ð°ÑÐ¸Ñ',
 'warn when traffic reaches' => 'ÐÑÐµÐ´ÑÐ¿ÑÐµÐ¶Ð´Ð°ÑÑ ÐºÐ¾Ð³Ð´Ð° ÑÑÐ°ÑÐ¸Ðº Ð²Ð¾Ð·ÑÐ°ÑÑÐ°ÐµÑ Ð´Ð¾ x %',
diff --git a/langs/tr/cgi-bin/tr.pl b/langs/tr/cgi-bin/tr.pl
index 89f753ed6d..782bc007e8 100644
--- a/langs/tr/cgi-bin/tr.pl
+++ b/langs/tr/cgi-bin/tr.pl
@@ -2135,7 +2135,6 @@
 'there are updates available' => 'Sisteminiz iÃ§in kullanÄ±labilir gÃ¼ncelleÅtirmeler var. Kesinlikle en kÄ±sa zamanda bunlarÄ± yÃ¼klemeniz gerekir.',
 'there was no file upload' => 'HiÃ§bir dosya yÃ¼klenemedi.',
 'this feature has been sponsored by' => 'Bu Ã¶zelliklerin destekÃ§isi',
-'this field may be blank' => 'Bu alan boÅ kalabilir.',
 'this is not a valid archive' => 'Bu, geÃ§erli bir arÅiv deÄil.',
 'this is not an authorised update' => 'Bu yetkili bir gÃ¼ncelleÅtirme deÄil.',
 'this months volume' => 'Bu ayki hacim',
@@ -2610,7 +2609,6 @@
 'vpn red name' => 'KIRMIZI arabirim veya <%defaultroute> iÃ§in gerÃ§ek IP veya FQDN',
 'vpn remote id' => 'Uzak kimlik (ID)',
 'vpn subjectaltname' => 'Alternatif konu adÄ±',
-'vpn vhost' => 'Roadwarrior sanal IP (bazen iÃ§ IP olarakta adlandÄ±rÄ±lÄ±r)',
 'vpn watch' => 'KarÅÄ± eÅ IP deÄiÅtirdiÄinde (dyndns) aÄdan-aÄa VPN baÄlantÄ±sÄ±nÄ± yeniden baÅlat. Bu DPD ye yardÄ±mcÄ± olur.',
 'waiting to synchronize clock' => 'Saat eÅleÅtirmesi bekleniyor',
 'warn when traffic reaches' => 'Trafik x % deÄere ulaÅtÄ±ÄÄ±nda uyar',
diff --git a/lfs/7zip b/lfs/7zip
index c007371fab..f8ac672c53 100644
--- a/lfs/7zip
+++ b/lfs/7zip
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,15 +24,15 @@
 
 include Config
 
-VER        = 4.65
+VER        = 9.38.1
 
 THISAPP    = p7zip_$(VER)
-DL_FILE    = $(THISAPP).tar.bz2
+DL_FILE    = $(THISAPP)_src_all.tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = 7zip
-PAK_VER    = 3
+PAK_VER    = 4
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = f78ed232436dc8f8be25a2f95d4e5f9a
+$(DL_FILE)_MD5 = 6cba8402ccab2370d3b70c5e28b3d651
 
 install : $(TARGET)
 
diff --git a/lfs/Locale-Country b/lfs/Locale-Country
index b2c1455efe..02bf7a026e 100644
--- a/lfs/Locale-Country
+++ b/lfs/Locale-Country
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.07
+VER        = 3.33
 
 THISAPP    = Locale-Codes-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = af0537cc4a882096d0320612c440df6d
+$(DL_FILE)_MD5 = bc7496f97889de8504e80addaa0ee40c
 
 install : $(TARGET)
 
diff --git a/lfs/acpid b/lfs/acpid
index ff85e1cb5d..476c9a8b63 100644
--- a/lfs/acpid
+++ b/lfs/acpid
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,14 +24,14 @@
 
 include Config
 
-VER        = 2.0.16
+VER        = 2.0.23
 
 THISAPP    = acpid-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = x86_64 i586
 
 ###############################################################################
 # Top-level Rules
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = d59fc02c9c34f0d5c137495302e2c074
+$(DL_FILE)_MD5 = d7bcdcdefcd53b03730e50ba842554ea
 
 install : $(TARGET)
 
diff --git a/lfs/apache2 b/lfs/apache2
index 5e88625469..57c344718a 100644
--- a/lfs/apache2
+++ b/lfs/apache2
@@ -25,17 +25,14 @@
 
 include Config
 
-VER        = 2.2.27
+VER        = 2.2.29
 
 THISAPP    = httpd-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
-ifeq "$(PASS)" "C"
-	TARGET     = $(DIR_INFO)/$(THISAPP)-config
-else
-	TARGET     = $(DIR_INFO)/$(THISAPP)
-endif
+
+TARGET     = $(DIR_INFO)/$(THISAPP)
 
 ###############################################################################
 # Top-level Rules
@@ -47,7 +44,7 @@ objects = $(DL_FILE) \
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 httpd-2.2.2-config-1.patch = $(DL_FROM)/httpd-2.2.2-config-1.patch
 
-$(DL_FILE)_MD5 = 8faef0decf3fa7e69b2568eb2105a3d8
+$(DL_FILE)_MD5 = 579342fdeaa7b8b68d17fee91f8fab6e
 httpd-2.2.2-config-1.patch_MD5 = e02a3ec5925eb9e111400b9aa229f822
 
 install : $(TARGET)
@@ -77,32 +74,6 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-ifeq "$(PASS)" "C"
-	# DO THIS IN AN EXTRA STEP BECAUSE PHP AND SUBVERSION WILL FAIL.
-
-	cp -rf $(DIR_CONF)/httpd/* /etc/httpd/conf
-	ln -sf $(CONFIG_ROOT)/main/hostname.conf /etc/httpd/conf/
-
-	# Copy all html/cgi-bin files
-	mkdir -p /srv/web/ipfire/{cgi-bin,html}
-	mkdir -p /var/updatecache/{download,metadata}
-	cp -aR $(DIR_SRC)/html/* /srv/web/ipfire
-
-	# Change CONFIG_ROOT in cgi-scripts
-	for i in /srv/web/ipfire/cgi-bin/{*,logs.cgi/*,vpn.cgi/*}; do \
-	    if [ -f $$i ]; then \
-	        sed -i "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" $$i; \
-	    fi; \
-	done
-	chown -R root:root /srv/web/ipfire
-	chmod -R 755 /srv/web/ipfire/cgi-bin
-	chmod -R 644 /srv/web/ipfire/html
-	chmod 755 /srv/web/ipfire/html /srv/web/ipfire/html/{index.cgi,redirect.cgi,dial.cgi,images,include,themes,themes/*,themes/*/*}
-	ln -svf ipfire /srv/web/ipfire/html/themes/ipfire-rounded
-
-	# Reset permissions of redirect templates and theme directories
-	find /srv/web/ipfire/html/{redirect-templates,themes} -type d | xargs chmod -v 755
-else
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_DL)/httpd-2.2.2-config-1.patch
 
@@ -140,6 +111,10 @@ else
 	    /usr/share/man/man1/{dbmmanage,ht{dbm,digest,passwd,txt2dbm}}.1 \
 	    /usr/share/man/man8/{ab,apachectl,apxs,htcacheclean,httpd}.8 \
 	    /usr/share/man/man8/{logresolve,rotatelogs,suexec}.8
+
+	# Install apache config
+	cp -rf $(DIR_CONF)/httpd/* /etc/httpd/conf
+	ln -sf $(CONFIG_ROOT)/main/hostname.conf /etc/httpd/conf/
+
 	@rm -rf $(DIR_APP)
-endif
 	@$(POSTBUILD)
diff --git a/lfs/asterisk b/lfs/asterisk
index f886225257..91dc4fd881 100755
--- a/lfs/asterisk
+++ b/lfs/asterisk
@@ -20,7 +20,7 @@
 
 include Config
 
-VER        = 11.15.0
+VER        = 11.20.0
 
 THISAPP    = asterisk-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -28,7 +28,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = asterisk
-PAK_VER    = 14
+PAK_VER    = 18
 
 DEPS       = "libsrtp"
 
@@ -46,7 +46,7 @@ asterisk-extra-sounds-en-gsm-1.4.15.tar.gz = $(URL_IPFIRE)/asterisk-extra-sounds
 asterisk-moh-opsound-gsm-2.03.tar.gz = $(URL_IPFIRE)/asterisk-moh-opsound-gsm-2.03.tar.gz
 asterisk-1.4-de-prompts.tar.gz = $(URL_IPFIRE)/asterisk-1.4-de-prompts.tar.gz
 
-$(DL_FILE)_MD5 = 71e8c2e207255f7ef12b81b7f0da30ea
+$(DL_FILE)_MD5 = d15759b05862250073e2708394ad2f4c
 asterisk-extra-sounds-en-gsm-1.4.15.tar.gz_MD5 = 5099fc65f49008e33ba7fb043a4ec995
 asterisk-moh-opsound-gsm-2.03.tar.gz_MD5 = 09066f55f1358f298bc1a6e4678a3ddf
 asterisk-1.4-de-prompts.tar.gz_MD5 = 626a2b95071a5505851e43874dfbfd5c
diff --git a/lfs/backports b/lfs/backports
index 0eebe818db..ab6fbdccd9 100644
--- a/lfs/backports
+++ b/lfs/backports
@@ -82,14 +82,19 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1-ipfire-build.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1-grsecurity.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1-add_usbnet_modules.patch
+ifeq "$(MACHINE)" "x86_64"
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1_no_dma_sgtable_on_x86_64.patch
+endif
 
 	# DVB patches
 	cd $(DIR_APP) && patch -Np2 < $(DIR_SRC)/src/patches/v4l-dvb_fix_tua6034_pll.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10-dvb_tevi_s482.patch
 
 	# Wlan patches
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/compat-drivers-3.8.3-ath_ignore_eeprom_regdomain.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.22-iwlwifi-noibss_only_on_radar_chan.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10.37-rt2800usb_add_dlink_dwa137_usbid.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1_rt2x00usb_suppress_queue_warnings.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1_add_libertas_uap.patch
 
 	# smsc mac address patch for pandaboard and raspberry pi
@@ -112,6 +117,10 @@ endif
 	cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_DEFAULT_PS=y/# CPTCFG_CFG80211_DEFAULT_PS is not set/g" .config
 	cd $(DIR_APP) && sed -i -e "s/CPTCFG_NFC=m/# CPTCFG_NFC is not set/g" .config
 
+ifeq "$(MACHINE)" "x86_64"
+	cd $(DIR_APP) && sed -i -e "s/CPTCFG_LIBERTAS_UAP=m/# CPTCFG_LIBERTAS_UAP is not set/g" .config
+endif
+
 	# Disable some modules (build fail)
 	cd $(DIR_APP) && sed -i -e "s/CPTCFG_VIDEO_VIA_CAMERA=m/# CPTCFG_VIDEO_VIA_CAMERA is not set/g" .config
 
diff --git a/lfs/bind b/lfs/bind
index 36b234058f..0814cde188 100644
--- a/lfs/bind
+++ b/lfs/bind
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 9.9.5
+VER        = 9.10.2-P4
 
 THISAPP    = bind-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = e676c65cad5234617ee22f48e328c24e
+$(DL_FILE)_MD5 = 8b1f5064837756c938eadc1537dec5c7
 
 install : $(TARGET)
 
diff --git a/lfs/binutils b/lfs/binutils
index 08bc7c9b69..27c83fb45b 100644
--- a/lfs/binutils
+++ b/lfs/binutils
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -76,6 +76,9 @@ ifeq "$(MACHINE_TYPE)" "arm"
 		--with-float=soft
 endif
 
+EXTRA_CONFIG += \
+	--enable-64-bit-bfd
+
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -126,8 +129,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && sed -i 's%\(^MULTIOSDIR = \).*%\1 ../lib%' libiberty/Makefile.in
 
 	cd $(DIR_SRC)/binutils-build && $(EXTRA_ENV) MACHINE= $(DIR_APP)/configure $(EXTRA_CONFIG)
-	cd $(DIR_SRC)/binutils-build && make $(EXTRA_MAKE) $(MAKETUNING) MACHINE=
-	cd $(DIR_SRC)/binutils-build && make $(EXTRA_INSTALL) install MACHINE=
+	cd $(DIR_SRC)/binutils-build && make $(EXTRA_MAKE) $(MAKETUNING) MACHINE= 
+	cd $(DIR_SRC)/binutils-build && make $(EXTRA_INSTALL) install MACHINE= 
 ifeq "$(ROOT)" ""
 	cp -v $(DIR_APP)/include/libiberty.h /usr/include
 else
diff --git a/lfs/ca-certificates b/lfs/ca-certificates
new file mode 100644
index 0000000000..d21cbd534f
--- /dev/null
+++ b/lfs/ca-certificates
@@ -0,0 +1,61 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.de>                           #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 20150710
+
+THISAPP    = ca-certificates
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+install : $(TARGET)
+
+check : 
+
+download : 
+
+md5 : 
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cp -av $(DIR_CONF)/$(THISAPP) $(DIR_APP)
+
+	cd $(DIR_APP) && sh ./build.sh
+
+	-mkdir -pv /etc/ssl/certs
+	cd $(DIR_APP) && install -p -m 644 ca-bundle.crt ca-bundle.trust.crt \
+		/etc/ssl/certs
+	ln -svf certs/ca-bundle.crt /etc/ssl/cert.pem
+
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/ccache b/lfs/ccache
index 44010f9622..64b09d1fa3 100644
--- a/lfs/ccache
+++ b/lfs/ccache
@@ -24,10 +24,10 @@
 
 include Config
 
-VER        = 3.1.8
+VER        = 3.2.3
 
 THISAPP    = ccache-$(VER)
-DL_FILE    = $(THISAPP).tar.bz2
+DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)-pass$(PASS)
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 0e0f25fb342dcb1196d9c2986a7323cf
+$(DL_FILE)_MD5 = 608c78632086a4a051514722d6067a7b
 
 install : $(TARGET)
 
@@ -77,7 +77,7 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure --prefix=/tools
 	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
 	cd $(DIR_APP) && make install
diff --git a/lfs/chkconfig b/lfs/chkconfig
new file mode 100644
index 0000000000..afec4542c1
--- /dev/null
+++ b/lfs/chkconfig
@@ -0,0 +1,78 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2010  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.5
+
+THISAPP    = chkconfig-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 0e59a43ef588a7bba5528b10bb59bef2
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && make alternatives
+	cd $(DIR_APP) && install -v -m 755 alternatives /usr/sbin
+	ln -svf alternatives /usr/sbin/update-alternatives
+	-mkdir -pv /etc/alternatives /var/lib/alternatives
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/clamav b/lfs/clamav
index 2e07ed0344..5fd8426e3b 100644
--- a/lfs/clamav
+++ b/lfs/clamav
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.98.6
+VER        = 0.98.7
 
 THISAPP    = clamav-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = clamav
-PAK_VER    = 28
+PAK_VER    = 29
 
 DEPS       = ""
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 7f4f7e82a09e42c4ebf153d6d452d9d8
+$(DL_FILE)_MD5 = 157c601161da1c2d5a0e48ea1b49e067
 
 install : $(TARGET)
 
diff --git a/lfs/cmake b/lfs/cmake
index 085d2bf238..e3d211910c 100644
--- a/lfs/cmake
+++ b/lfs/cmake
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.6.4
+VER        = 3.2.3
 
 THISAPP    = cmake-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 50f387d0436696c4a68b5512a72c9cde
+$(DL_FILE)_MD5 = d51c92bf66b1e9d4fe2b7aaedd51377c
 
 install : $(TARGET)
 
@@ -74,8 +74,15 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./bootstrap --prefix=/usr
+	cd $(DIR_APP) && ./bootstrap \
+			--prefix=/usr \
+			--system-libs \
+			--mandir=/share/man \
+			--no-system-jsoncpp \
+			--docdir=/share/doc/cmake-2.8.12.2
+
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/collectd b/lfs/collectd
index f01c92a8a9..1573e3874d 100644
--- a/lfs/collectd
+++ b/lfs/collectd
@@ -101,6 +101,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/collectd/0020-openvpn-Make-read-functions-robust-like-in-8516f9abb.patch
 	cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/collectd/0021-openvpn-Fix-copy-and-paste-error.patch
 	cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/collectd/0022-openvpn-Change-data-type-from-COUNTER-to-DERIVE.patch
+	cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/collectd/silence-openvpn-errors.patch
 	cd $(DIR_APP) && ./configure --prefix=/usr --localstatedir=/var \
 		--disable-{apple_sensors,csv,ipvs,mbmon,memcached,mysql} \
 		--disable-{netlink,nginx,nut,perl,serial,snmp,tape,vserver,xmms} \
@@ -112,6 +113,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--with-librrd=/usr/share/rrdtool-1.2.30
 	cd $(DIR_APP) && make install
 	cp -vf $(DIR_SRC)/config/collectd/collectd.* /etc/
+	mv /etc/collectd.vpn /var/ipfire/ovpn/collectd.vpn
+	chown nobody.nobody /var/ipfire/ovpn/collectd.vpn
+	ln -f -s ../var/ipfire/ovpn/collectd.vpn /etc/collectd.vpn
 	ln -f -s ../init.d/collectd /etc/rc.d/rc0.d/K50collectd 
 	ln -f -s ../init.d/collectd /etc/rc.d/rc3.d/S29collectd
 	ln -f -s ../init.d/collectd /etc/rc.d/rc6.d/K50collectd 
diff --git a/lfs/configroot b/lfs/configroot
index e0bb346d0f..601cdf6d38 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -64,8 +64,8 @@ $(TARGET) :
 	for i in auth/users backup/include.user backup/exclude.user \
 	    certs/index.txt ddns/config ddns/noipsettings ddns/settings ddns/ipcache dhcp/settings \
 	    dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
-	    ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/input firewall/outgoing \
-	    fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwlogs/ipsettings fwlogs/portsettings \
+	    ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
+	    fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \
 	    isdn/settings mac/settings main/disable_nf_sip main/hosts main/routing main/settings net-traffic/settings optionsfw/settings \
 	    ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
 	    ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
@@ -78,6 +78,7 @@ $(TARGET) :
 	cp $(DIR_SRC)/config/cfgroot/header.pl			$(CONFIG_ROOT)/
 	cp $(DIR_SRC)/config/cfgroot/general-functions.pl	$(CONFIG_ROOT)/
 	cp $(DIR_SRC)/config/cfgroot/network-functions.pl	$(CONFIG_ROOT)/
+	cp $(DIR_SRC)/config/cfgroot/geoip-functions.pl		$(CONFIG_ROOT)/
 	cp $(DIR_SRC)/config/cfgroot/lang.pl			$(CONFIG_ROOT)/
 	cp $(DIR_SRC)/config/cfgroot/countries.pl		$(CONFIG_ROOT)/
 	cp $(DIR_SRC)/config/cfgroot/graphs.pl			$(CONFIG_ROOT)/
diff --git a/lfs/conntrack-tools b/lfs/conntrack-tools
index f5ea3157bc..d9a60bcfc0 100644
--- a/lfs/conntrack-tools
+++ b/lfs/conntrack-tools
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.2.2
+VER        = 1.4.2
 
 THISAPP    = conntrack-tools-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = a8afc813e16265655f83991fc0df35b6
+$(DL_FILE)_MD5 = b1f9d006e7bf000a77395ff7cd3fac16
 
 install : $(TARGET)
 
diff --git a/lfs/coreutils b/lfs/coreutils
index 63d0a88982..ede0493916 100644
--- a/lfs/coreutils
+++ b/lfs/coreutils
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 8.23
+VER        = 8.24
 
 THISAPP    = coreutils-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -60,7 +60,7 @@ objects =$(DL_FILE)
 
 $(DL_FILE)                      = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5                  = abed135279f87ad6762ce57ff6d89c41
+$(DL_FILE)_MD5                  = 40efdbce865d2458d8da0a9dcee7c16c
 
 install : $(TARGET)
 
@@ -100,8 +100,6 @@ ifeq "$(ROOT)" ""
 	mv -v /usr/bin/{rmdir,stty,sync,true,uname} /bin
 	mv -v /usr/bin/chroot /usr/sbin
 	mv -v /usr/bin/{head,sleep,nice} /bin
-	ln -sf test /bin/[
-	#ln -sf ../../bin/install /usr/bin
 	dircolors -p > /etc/DIR_COLORS
 endif
 
diff --git a/lfs/cpufrequtils b/lfs/cpufrequtils
index f07e49df3e..c0eb002fa9 100644
--- a/lfs/cpufrequtils
+++ b/lfs/cpufrequtils
@@ -31,7 +31,7 @@ DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = x86_64 i586
 PROG       = cpufrequtils
 PAK_VER    = 6
 
diff --git a/lfs/cups b/lfs/cups
index 60f7e214e4..49b275a655 100644
--- a/lfs/cups
+++ b/lfs/cups
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2012  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.7.0
+VER        = 2.0.4
 
 THISAPP    = cups-$(VER)
 DL_FILE    = $(THISAPP)-source.tar.bz2
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/cups-$(VER)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = cups
-PAK_VER    = 10
+PAK_VER    = 13
 
 DEPS       = "ghostscript"
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 5ab496a2ce27017fcdb3d7ec4818a75a
+$(DL_FILE)_MD5 = f5c847d9a4fac6c4c66fb0526a7afaae
 
 install : $(TARGET)
 
diff --git a/lfs/curl b/lfs/curl
index 715d79d07c..7de9aa31f9 100644
--- a/lfs/curl
+++ b/lfs/curl
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 7.31.0
+VER        = 7.43.0
 
 THISAPP    = curl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 6f26843f7e3a2fb06e02f68a55efe8c7
+$(DL_FILE)_MD5 = 3037f0b6ce03d434618e9db5506ae6be
 
 install : $(TARGET)
 
diff --git a/lfs/cyrus-imapd b/lfs/cyrus-imapd
index 2a826cd703..f4c855c760 100644
--- a/lfs/cyrus-imapd
+++ b/lfs/cyrus-imapd
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2011  IPFire Team  <info@ipfire.org>                          #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -31,11 +31,14 @@ DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
+SUP_ARCH   = armv5tel i586
 PROG       = cyrus-imapd
-PAK_VER    = 3
+PAK_VER    = 5
 
 DEPS       = ""
 
+CFLAGS    += -I/usr/include/et
+
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -100,5 +103,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cp -f $(DIR_APP)/tools/mkimap /usr/bin
 	sudo -u cyrus /usr/bin/mkimap /var/ipfire/cyrusimap/imapd.conf
 	chown cyrus.mail /var/imap/socket
+	install -v -m 644 $(DIR_SRC)/config/backup/includes/cyrus-imapd \
+		/var/ipfire/backup/addons/includes/cyrus-imapd
 	@rm -rf $(DIR_APP) /usr/include/com_err.h
 	@$(POSTBUILD)
diff --git a/lfs/cyrus-sasl b/lfs/cyrus-sasl
index af2b148893..84f49d9355 100644
--- a/lfs/cyrus-sasl
+++ b/lfs/cyrus-sasl
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.1.21
+VER        = 2.1.26
 
 THISAPP    = cyrus-sasl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -49,7 +49,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = dde02db234dea892bee298390890502e
+$(DL_FILE)_MD5 = a7f4e5e559a0e37b3ffc438c9456e425
 
 install : $(TARGET)
 
@@ -82,7 +82,6 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cyrus-sasl-2.1.22-bad-elif.patch
 	cd $(DIR_APP) && sed -i '/sasl_global/s/^static //' lib/client.c
 	cd $(DIR_APP) && sed -i 's/cat8/man8/' saslauthd/Makefile.am
 	cd $(DIR_APP) && autoconf
@@ -90,7 +89,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 ifeq "$(PASS)" ""
 	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc \
 		            --with-dbpath=/var/lib/sasl/sasldb2 \
-		            --with-saslauthd=/var/run/saslauthd
+		            --with-saslauthd=/var/run/saslauthd \
+		            --with-des=no --with-rc4=no
 	cd $(DIR_APP) && make
 	cd $(DIR_APP) && make install
 	install -v -m700 -d /var/lib/sasl
diff --git a/lfs/daq b/lfs/daq
index c58995d575..35f8241aa9 100644
--- a/lfs/daq
+++ b/lfs/daq
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.0.4
+VER        = 2.0.6
 
 THISAPP    = daq-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 65e51d72e9d5d8b397e192e4e5857eff
+$(DL_FILE)_MD5 = 2cd6da422a72c129c685fc4bb848c24c
 
 install : $(TARGET)
 
diff --git a/lfs/ddns b/lfs/ddns
index e736e101ce..750c728c5a 100644
--- a/lfs/ddns
+++ b/lfs/ddns
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 007
+VER        = 009
 
 THISAPP    = ddns-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 44f63cecc36db0d9ffddfa4bca7983ae
+$(DL_FILE)_MD5 = 31f949d9f417ee7f801cf8aac849a92e
 
 install : $(TARGET)
 
diff --git a/lfs/dhcp b/lfs/dhcp
index 083c31fa11..9a89d40bf0 100644
--- a/lfs/dhcp
+++ b/lfs/dhcp
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2012  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 4.2.2
+VER        = 4.3.1
 
 THISAPP    = dhcp-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = bb0f0434cd796f76aa7cead391d71f31
+$(DL_FILE)_MD5 = b3a42ece3c7f2cd2e74a3e12ca881d20
 
 install : $(TARGET)
 
@@ -71,38 +71,33 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-remove-bind.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-errwarn-message.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-options.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-release-by-ifup.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-unicast-bootp.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-dhclient-usage.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-default-requested-options.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-xen-checksum.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-manpages.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-paths.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-CLOEXEC.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-inherit-leases.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-garbage-chars.patch
-	# ???
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-capability.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-logpid.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-UseMulticast.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-sendDecline.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-retransmission.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-honor-expired.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-noprefixavail.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-sharedlib.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-PPP.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-lpf-ib.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-improved-xid.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-gpxe-cid.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-remove-bind.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-errwarn-message.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-options.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-release-by-ifup.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-unicast-bootp.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-default-requested-options.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-xen-checksum.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-manpages.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paths.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-CLOEXEC.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-garbage-chars.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-capability.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-logpid.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-UseMulticast.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sendDecline.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-honor-expired.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sharedlib.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-PPP.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paranoia.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-lpf-ib.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-improved-xid.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-gpxe-cid.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
 
 	# Remove bundled BIND stuff.
 	# (requires newer autoconf)
diff --git a/lfs/dhcpcd b/lfs/dhcpcd
index f7a8c361c6..e73d99c653 100644
--- a/lfs/dhcpcd
+++ b/lfs/dhcpcd
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2012  IPFire Team  <info@ipfire.org>                          #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.2.9
+VER        = 6.7.1
 
 THISAPP    = dhcpcd-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = aabe4a3c1f23c55f2c99a416c9085de9
+$(DL_FILE)_MD5 = ffb716b0e9327968e7200d519e1d4c0d
 
 install : $(TARGET)
 
diff --git a/lfs/openssl-compat b/lfs/dma
similarity index 74%
rename from lfs/openssl-compat
rename to lfs/dma
index 8e22a348ab..977efc8d0c 100644
--- a/lfs/openssl-compat
+++ b/lfs/dma
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2011  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,9 +24,9 @@
 
 include Config
 
-VER        = 0.9.8zd
+VER        = 0.9.1
 
-THISAPP    = openssl-$(VER)
+THISAPP    = dma-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = e9b9ee12f2911e1a378e2458d9bfff77
+$(DL_FILE)_MD5 = 56afaf438ba34d4ff9c8879dc29a16b1
 
 install : $(TARGET)
 
@@ -50,6 +50,7 @@ download :$(patsubst %,$(DIR_DL)/%,$(objects))
 
 md5 : $(subst %,%_MD5,$(objects))
 
+
 ###############################################################################
 # Downloading, checking, md5sum
 ###############################################################################
@@ -70,32 +71,16 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-0.9.8u-cryptodev.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-disable-sslv2-sslv3.patch
-
-	cd $(DIR_APP) && sed -i -e 's/mcpu/march/' config
-	cd $(DIR_APP) && sed -i -e 's/-O3/-O2/' -e 's/-march=i486/-march=i586/' Configure
-
-	# Support for engines is disabled, because the shared objects from the
-	# new version of openssl cannot be loaded by the old one.
-
-	cd $(DIR_APP) && ./Configure \
-		--prefix=/usr \
-		--openssldir=/etc/ssl \
-		shared linux-elf \
-		zlib-dynamic \
-		no-engines \
-		no-asm 386 \
-		-DSSL_FORBID_ENULL \
-		-DHAVE_CRYPTODEV \
-		-DUSE_CRYPTODEV_DIGEST
-
-	cd $(DIR_APP) && make depend
+	mkdir -pv /var/ipfire/dma
+	touch /var/ipfire/dma/mail.conf
+	cd $(DIR_APP) && sed -i '/PREFIX/s/usr\/local/usr/g' Makefile
+	cd $(DIR_APP) && sed -i '/CONFDIR/s/etc\/dma/var\/ipfire\/dma/g' Makefile
 	cd $(DIR_APP) && make
-
-	cd $(DIR_APP) && install -v -m 755 libcrypto.so.0.9.8 /usr/lib
-	cd $(DIR_APP) && install -v -m 755 libssl.so.0.9.8 /usr/lib
-
+	cd $(DIR_APP) && make install mailq-link install-spool-dirs install-etc
+	install -v -m 755 $(DIR_SRC)/config/dma/dma-cleanup-spool /usr/sbin
+	chown -R nobody.nobody /var/ipfire/dma
+	chown nobody.root /var/ipfire/dma/auth.conf
+	ln -svf dma /usr/sbin/sendmail.dma
+	/usr/sbin/alternatives --install /usr/sbin/sendmail sendmail /usr/sbin/sendmail.dma 20
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/dnsmasq b/lfs/dnsmasq
index 4bb7f9f0d1..db56091025 100644
--- a/lfs/dnsmasq
+++ b/lfs/dnsmasq
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.72
+VER        = 2.75
 
 THISAPP    = dnsmasq-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 0256e0a71e27c8d8a5c89a0d18f3cfe2
+$(DL_FILE)_MD5 = 887236f1ddde6eb57cdb9d01916c9f72
 
 install : $(TARGET)
 
@@ -73,64 +73,17 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0020-Initialise-return-value.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0021-Add-ignore-address-option.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0022-Bad-packet-protection.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0035-Update-German-translation.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0040-inotify-documentation-updates.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0042-BSD-make-support.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0044-Manpage-typo-fix.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0047-man-page-typo.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0049-Typos.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/001-include_0_0_0_0_8_in_DNS_rebind_checks.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/002-enhance_add_subnet_to_allow_arbitary_subnet_addresses.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/003-dont_answer_non_auth_queries_for_auth_zones_locally_when_localise_queries_set.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/004-fix_behaviour_of_empty_dhcp-option.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/005-suggest_solution_to_ENOMEM_error_with_IPv6_multicast.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/006-clarify_man_page_on_RDNSS_set_in_router_advertisement.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/007-handle_signed_dangling_CNAME_replies_to_DS_queries.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/008-DHCPv6_option_56_does_not_hold_an_address_list.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/009-Respect_the_--no_resolv_flag_in_inotify_code.patch
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch
+
 	cd $(DIR_APP) && sed -i src/config.h \
 		-e 's|/\* #define HAVE_IDN \*/|#define HAVE_IDN|g' \
 		-e 's|/\* #define HAVE_DNSSEC \*/|#define HAVE_DNSSEC|g' \
diff --git a/lfs/dracut b/lfs/dracut
index fef3ad77d3..97d12f3f55 100644
--- a/lfs/dracut
+++ b/lfs/dracut
@@ -71,6 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dracut-038-always-enable-mdraid.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dracut-038_add_sdhci-pci.patch
 
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install sbindir=/sbin sysconfdir=/etc
diff --git a/lfs/e1000e b/lfs/e1000e
index d23369c569..095ab312e3 100644
--- a/lfs/e1000e
+++ b/lfs/e1000e
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team <info@ipfire.org>                      #
+# Copyright (C) 2007-2015  IPFire Team <info@ipfire.org>                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -27,7 +27,7 @@ include Config
 VERSUFIX = ipfire$(KCFG)
 MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/kernel/drivers/net/ethernet/intel/e1000e
 
-VER        = 3.1.0.2
+VER        = 3.2.4.2
 
 THISAPP    = e1000e-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = b8d770160691edd247a90070f45642ce
+$(DL_FILE)_MD5 = da331c268e1b928e896dfa4c71fbe4d9
 
 install : $(TARGET)
 
diff --git a/lfs/elinks b/lfs/elinks
index 59f1426ead..2727423f02 100644
--- a/lfs/elinks
+++ b/lfs/elinks
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = elinks
-PAK_VER    = 4
+PAK_VER    = 5
 
 DEPS       = ""
 
diff --git a/lfs/expat b/lfs/expat
index 8e4db75595..99e458d15e 100644
--- a/lfs/expat
+++ b/lfs/expat
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.0.0
+VER        = 2.1.0
 
 THISAPP    = expat-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = d945df7f1c0868c5c73cf66ba9596f3f
+$(DL_FILE)_MD5 = dd7dab7a5fea97d2a6a43f511449b7cd
 
 install : $(TARGET)
 
@@ -73,7 +73,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && ./configure --prefix=/usr --disable-nls
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
-	cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/expat-2.0.0
-	cd $(DIR_APP) && install -v -m644 doc/*.{html,png,css} /usr/share/doc/expat-2.0.0
+	cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/expat-2.1.0
+	cd $(DIR_APP) && install -v -m644 doc/*.{html,png,css} /usr/share/doc/expat-2.1.0
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/file b/lfs/file
index bfd7552867..49829d0c5e 100644
--- a/lfs/file
+++ b/lfs/file
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.20
+VER        = 5.24
 
 THISAPP    = file-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 5d5e13eb3e0e13839da869a31790faf2
+$(DL_FILE)_MD5 = ec161b5a0d2aef147fb046e5630b1408
 
 install : $(TARGET)
 
diff --git a/lfs/fireinfo b/lfs/fireinfo
index 32953881e8..55a78455c0 100644
--- a/lfs/fireinfo
+++ b/lfs/fireinfo
@@ -70,6 +70,11 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo/0001-Add-an-other-forbidden-string-Serial.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo/0002-Escape-any-non-printable-ascii-characters.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo/0003-Skip-search-for-hypervisor-name-when-the-CPU-string-.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo/0004-Filter-all-IDs-that-only-consist-of-0xff.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo/0005-Fix-crash-if-there-is-id-has-already-been-reset-to-N.patch
 
 	cd $(DIR_APP) && [ -x "configure" ] || sh ./autogen.sh
 	cd $(DIR_APP) && ./configure --prefix=/usr
diff --git a/lfs/flag-icons b/lfs/flag-icons
new file mode 100644
index 0000000000..8f3364cdc9
--- /dev/null
+++ b/lfs/flag-icons
@@ -0,0 +1,90 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 2.6
+
+THISAPP    = flag-icons-$(VER)
+DL_FILE    = $(THISAPP).zip
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 992db1bc950dfdd436699b7d2ad33c2d
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	# Create DIR_APP and move the source tarball to its location.
+	@rm -rf $(DIR_APP) && mkdir -pv $(DIR_APP) && cd $(DIR_SRC) && cp -avf $(DIR_DL)/$(DL_FILE) $(DIR_APP)
+
+	# Extract the source tarball.
+	cd $(DIR_APP) && unzip $(DL_FILE)
+
+	# Create flage image folder.
+	cd $(DIR_APP) && mkdir -pv /srv/web/ipfire/html/images/flags/
+
+	# Only copy the country flags.
+	cd $(DIR_APP) && cp -avf flags-iso/shiny/16/??.png \
+		/srv/web/ipfire/html/images/flags/
+
+	# Copy flag icon for unknown countries.
+	cd $(DIR_APP) && cp -avf flags-iso/shiny/16/_unknown.png \
+		/srv/web/ipfire/html/images/flags/unknown.png
+
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/flash-images b/lfs/flash-images
index 6c88180598..530bf339b8 100644
--- a/lfs/flash-images
+++ b/lfs/flash-images
@@ -211,6 +211,7 @@ endif
 	-fsck.ext4 -f -y $(PART_ROOT)
 	fsck.ext4 -f -y $(PART_ROOT)
 
+	sleep 10     #Ubuntu compiling: allow time to automount/dismount
 	kpartx -d -v $(DEVICE)
 	losetup -d $(DEVICE)
 
diff --git a/lfs/gcc b/lfs/gcc
index 0264d37f83..ff8723a1e8 100644
--- a/lfs/gcc
+++ b/lfs/gcc
@@ -38,6 +38,9 @@ CFLAGS    := $(patsubst -march=%,,$(CFLAGS))
 CFLAGS    := $(patsubst -mtune=%,,$(CFLAGS))
 CFLAGS    := $(patsubst -mfloat-abi=%,,$(CFLAGS))
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=476370
+CFLAGS += -fgnu89-inline
+
 # Normal build or /tools build.
 #
 ifeq "$(ROOT)" ""
@@ -114,6 +117,11 @@ ifeq "$(MACHINE)" "i586"
 		--with-tune=generic
 endif
 
+ifeq "$(MACHINE)" "x86_64"
+	EXTRA_CONFIG += \
+		--disable-multilib
+endif
+
 EXTRA_CONFIG += \
 	--with-bugurl=http://bugtracker.ipfire.org \
 	--disable-libunwind-exceptions \
diff --git a/lfs/git b/lfs/git
index 23838e4e54..bbec140f4e 100644
--- a/lfs/git
+++ b/lfs/git
@@ -24,17 +24,17 @@
 
 include Config
 
-VER        = 1.8.5.2
+VER        = 2.4.4
 
 THISAPP    = git-$(VER)
-DL_FILE    = $(THISAPP).tar.gz
+DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = git
-PAK_VER    = 10
+PAK_VER    = 12
 
-DEPS       = ""
+DEPS       = "perl-Authen-SASL perl-MIME-Base64 perl-Net-SMTP-SSL"
 
 ###############################################################################
 # Top-level Rules
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = df8519044f9880f3687d863d99245282
+$(DL_FILE)_MD5 = 847787cd0616d38b0e429ea85f558c31
 
 install : $(TARGET)
 
@@ -78,7 +78,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure \
-		--prefix=/usr
+		--prefix=/usr \
+		--with-libpcre \
+		--with-curl \
+		--with-expat
 
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
diff --git a/lfs/glibc b/lfs/glibc
index 11d374e3b8..d7d51cf8cb 100644
--- a/lfs/glibc
+++ b/lfs/glibc
@@ -283,11 +283,15 @@ endif
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1154563.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1170121.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1183533.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1207995.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1209375.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc/glibc-rh1217186.patch
 
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-resolv-stack_chk_fail.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-remove-ctors-dtors-output-sections.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-test-installation.pl-nss_test1.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-test-installation.pl-libgcc_s.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.12-accept-make-versions-4.0-and-greater.patch
 
 	# Fixes:
 	#   Makefile:235: *** mixed implicit and normal rules.  Stop.
@@ -302,10 +306,15 @@ ifeq "$(ROOT)" ""
 ifeq "$(MACHINE_TYPE)" "arm"
 	cd $(DIR_APP) && sed -i 's|libs -o|libs -L/usr/lib -Wl,-dynamic-linker=/lib/ld-linux.so.3 -o|' \
 		scripts/test-installation.pl
+else
+ifeq "$(MACHINE)" "x86_64"
+	cd $(DIR_APP) && sed -i 's|libs -o|libs -L/usr/lib64 -Wl,-dynamic-linker=/lib64/ld-linux-x86-64.so.2 -o|' \
+		scripts/test-installation.pl
 else
 	cd $(DIR_APP) && sed -i 's|libs -o|libs -L/usr/lib -Wl,-dynamic-linker=/lib/ld-linux.so.2 -o|' \
 		scripts/test-installation.pl
 endif
+endif
 endif
 
 	cd $(DIR_SRC)/glibc-build && \
@@ -335,6 +344,8 @@ ifeq "$(ROOT)" ""
 
 	# Timezone data will be shipped by tzdata.
 	rm -rfv /usr/share/zoneinfo
+else
+	ln -svf lib /tools/lib64
 endif
 	@rm -rf $(DIR_APP) $(DIR_SRC)/glibc-build
 	@$(POSTBUILD)
diff --git a/lfs/groff b/lfs/groff
index 1739fee23b..a0bb0bd3f9 100644
--- a/lfs/groff
+++ b/lfs/groff
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.21
+VER        = 1.22.3
 
 THISAPP    = groff-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 8b8cd29385b97616a0f0d96d0951c5bf
+$(DL_FILE)_MD5 = cc825fa64bc7306a885f2fb2268d3ec5
 
 install : $(TARGET)
 
diff --git a/lfs/grub b/lfs/grub
index 04aaa0b254..bcbcbd06ec 100644
--- a/lfs/grub
+++ b/lfs/grub
@@ -31,7 +31,7 @@ DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = x86_64 i586
 
 CFLAGS     =
 CXXFLAGS   =
diff --git a/lfs/haproxy b/lfs/haproxy
index febb65a5d3..4af2273077 100644
--- a/lfs/haproxy
+++ b/lfs/haproxy
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = haproxy
-PAK_VER    = 1
+PAK_VER    = 2
 
 DEPS       = ""
 
diff --git a/lfs/hdparm b/lfs/hdparm
index e4e2e535bd..e4e9ac1a0a 100644
--- a/lfs/hdparm
+++ b/lfs/hdparm
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 9.45
+VER        = 9.48
 
 THISAPP    = hdparm-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 1c75d0751a44928b6c4bc81fb16d7fe8
+$(DL_FILE)_MD5 = 213efdbe7471fad3408198918e164354
 
 install : $(TARGET)
 
diff --git a/lfs/hostapd b/lfs/hostapd
index 74c2ae86ef..e9286684bf 100644
--- a/lfs/hostapd
+++ b/lfs/hostapd
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.3
+VER        = 2.4
 
 THISAPP    = hostapd-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = hostapd
-PAK_VER    = 33
+PAK_VER    = 34
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 40b89c61036add0c2dd1fc10767d3b5f
+$(DL_FILE)_MD5 = 04578f3f2c3eb1bec1adf30473813912
 
 install : $(TARGET)
 
@@ -77,6 +77,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch
 	cd $(DIR_APP)/hostapd && cp $(DIR_SRC)/config/hostapd/config ./.config
 	cd $(DIR_APP)/hostapd && sed -e "s@/usr/local@/usr@g" -i Makefile
 	cd $(DIR_APP)/hostapd && make $(MAKETUNING) $(EXTRA_MAKE)
diff --git a/lfs/igb b/lfs/igb
index fa762e093f..85d228c40c 100644
--- a/lfs/igb
+++ b/lfs/igb
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team <info@ipfire.org>                      #
+# Copyright (C) 2007-2015  IPFire Team <info@ipfire.org>                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -27,7 +27,7 @@ include Config
 VERSUFIX   = ipfire$(KCFG)
 MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/kernel/drivers/net/ethernet/intel/igb/
 
-VER        = 5.2.9.3
+VER        = 5.3.3.2
 
 THISAPP    = igb-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 814395d3b76090f378002bddecfd2dfc
+$(DL_FILE)_MD5 = 2d753a0bd03c949ec08d68c27540044d
 
 install : $(TARGET)
 
diff --git a/lfs/initscripts b/lfs/initscripts
index f656c72a74..141fd66d8d 100755
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -176,7 +176,7 @@ $(TARGET) :
 	ln -sf ../init.d/firstsetup  /etc/rc.d/rcsysinit.d/S75firstsetup
 	ln -sf ../init.d/localnet    /etc/rc.d/rcsysinit.d/S80localnet
 	ln -sf ../init.d/firewall    /etc/rc.d/rcsysinit.d/S85firewall
-	ln -sf ../init.d/network-vlans /etc/rc.d/rcsysinit.d/S91network-vlans
+	ln -sf ../init.d/network-trigger /etc/rc.d/rcsysinit.d/S90network-trigger
 	ln -sf ../init.d/rngd        /etc/rc.d/rcsysinit.d/S92rngd
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc0.d/K82wlanclient
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc3.d/S19wlanclient
diff --git a/lfs/ipfire-netboot b/lfs/ipfire-netboot
index 0590d9b5bf..18159292ad 100644
--- a/lfs/ipfire-netboot
+++ b/lfs/ipfire-netboot
@@ -32,7 +32,7 @@ DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = http://source.ipfire.org/releases/ipfire-netboot/
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = x86_64 i586
 
 ###############################################################################
 # Top-level Rules
diff --git a/lfs/iproute2 b/lfs/iproute2
index 42a8184d6b..51f1f3d318 100644
--- a/lfs/iproute2
+++ b/lfs/iproute2
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.5.1
+VER        = 4.2.0
 
 THISAPP    = iproute2-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE)             = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5         = d4425b44edd5eacd6099e672e4baacbf
+$(DL_FILE)_MD5         = 51c54cc3245eff451154938fbc0f64f5
 
 install : $(TARGET)
 
diff --git a/lfs/iptables b/lfs/iptables
index d3c8402b07..b7ce9289a1 100644
--- a/lfs/iptables
+++ b/lfs/iptables
@@ -35,26 +35,14 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
 ###############################################################################
 # Top-level Rules
 ###############################################################################
-objects = 	$(DL_FILE) \
-			netfilter-layer7-v2.22.tar.gz \
-			libnfnetlink-1.0.0.tar.bz2 \
-			libnetfilter_queue-1.0.1.tar.bz2 \
-			libnetfilter_conntrack-1.0.2.tar.bz2 \
-			libnetfilter_cttimeout-1.0.0.tar.bz2
+objects = $(DL_FILE) \
+	netfilter-layer7-v2.22.tar.gz
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-netfilter-layer7-v2.22.tar.gz 		= $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz
-libnfnetlink-1.0.0.tar.bz2		= $(URL_IPFIRE)/libnfnetlink-1.0.0.tar.bz2
-libnetfilter_queue-1.0.1.tar.bz2	= $(URL_IPFIRE)/libnetfilter_queue-1.0.1.tar.bz2
-libnetfilter_conntrack-1.0.2.tar.bz2	= $(URL_IPFIRE)/libnetfilter_conntrack-1.0.2.tar.bz2
-libnetfilter_cttimeout-1.0.0.tar.bz2	= $(URL_IPFIRE)/libnetfilter_cttimeout-1.0.0.tar.bz2
+netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz
 
 $(DL_FILE)_MD5 = 536d048c8e8eeebcd9757d0863ebb0c0
 netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f
-libnfnetlink-1.0.0.tar.bz2_MD5 = 016fdec8389242615024c529acc1adb8
-libnetfilter_queue-1.0.1.tar.bz2_MD5 = 08b968cb2d36c24deb7f26a69f5d8602
-libnetfilter_conntrack-1.0.2.tar.bz2_MD5 = 447114b5d61bb9a9617ead3217c3d3ff
-libnetfilter_cttimeout-1.0.0.tar.bz2_MD5 = 7697437fc9ebb6f6b83df56a633db7f9
 
 install : $(TARGET)
 
@@ -83,60 +71,31 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) $(DIR_SRC)/libnfnetlink-* $(DIR_SRC)/netfilter-layer7* $(DIR_SRC)/libnetfilter_queue-*
-
+	@rm -rf $(DIR_APP) $(DIR_SRC)/netfilter-layer7*
 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
-#	cp -rf /usr/src/linux/include/linux/netfilter /usr/include/linux
 
 	# Layer7
 	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz
 	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
 	                 ./extensions/
 
-	# ipp2p 0.8.2-pomng
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/iptables-1.4.14-ipp2p-0.8.2-ipfire.patch
-
 	# imq
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/iptables-1.4.12-IMQ-test4.diff
 
-	cd $(DIR_APP) && ./configure  --prefix=/usr --with-ksource=/usr/src/linux \
-				    --libdir=/lib --includedir=/usr/include --enable-libipq \
-				    --libexecdir=/lib --bindir=/sbin \
-				    --sbindir=/sbin --mandir=/usr/share/man \
-				    --with-pkgconfigdir=/usr/lib/pkgconfig
+	cd $(DIR_APP) && ./configure \
+		--prefix=/usr \
+		--with-ksource=/usr/src/linux \
+		--libdir=/lib \
+		--includedir=/usr/include \
+		--enable-libipq \
+		--libexecdir=/lib \
+		--bindir=/sbin \
+		--sbindir=/sbin \
+		--mandir=/usr/share/man \
+		--with-pkgconfigdir=/usr/lib/pkgconfig
+
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
-	# Iptables doesn't install all headers
-#	mkdir -p /usr/include/net/netfilter
-#	cp -f $(DIR_APP)/include/net/netfilter/*.h /usr/include/net/netfilter/
-#	mkdir -p /usr/include/iptables
-#	cp -f $(DIR_APP)/include/iptables/*.h /usr/include/iptables/
-#	cp -f $(DIR_APP)/include/iptables.h /usr/include/
-#	mkdir -p /usr/include/libipulog
-#	cp -f $(DIR_APP)/include/libipulog/*.h /usr/include/libipulog/
-#	mkdir -p /usr/include/libiptc
-#	cp -f $(DIR_APP)/include/libiptc/*.h /usr/include/libiptc/
-
-	cd $(DIR_SRC) && tar xfj $(DIR_DL)/libnfnetlink-1.0.0.tar.bz2
-	cd $(DIR_SRC)/libnfnetlink-1.0.0 && ./configure --prefix=/usr
-	cd $(DIR_SRC)/libnfnetlink-1.0.0 && make $(MAKETUNING) $(EXTRA_MAKE)
-	cd $(DIR_SRC)/libnfnetlink-1.0.0 && make install
-
-	cd $(DIR_SRC) && tar xfj $(DIR_DL)/libnetfilter_queue-1.0.1.tar.bz2
-	cd $(DIR_SRC)/libnetfilter_queue-1.0.1 && ./configure --prefix=/usr
-	cd $(DIR_SRC)/libnetfilter_queue-1.0.1 && make $(MAKETUNING) $(EXTRA_MAKE)
-	cd $(DIR_SRC)/libnetfilter_queue-1.0.1 && make install
-
-	cd $(DIR_SRC) && tar xfj $(DIR_DL)/libnetfilter_conntrack-1.0.2.tar.bz2
-	cd $(DIR_SRC)/libnetfilter_conntrack-1.0.2 && ./configure --prefix=/usr
-	cd $(DIR_SRC)/libnetfilter_conntrack-1.0.2 && make $(MAKETUNING) $(EXTRA_MAKE)
-	cd $(DIR_SRC)/libnetfilter_conntrack-1.0.2 && make install
-
-	cd $(DIR_SRC) && tar xfj $(DIR_DL)/libnetfilter_cttimeout-1.0.0.tar.bz2
-	cd $(DIR_SRC)/libnetfilter_cttimeout-1.0.0 && ./configure --prefix=/usr
-	cd $(DIR_SRC)/libnetfilter_cttimeout-1.0.0 && make $(MAKETUNING) $(EXTRA_MAKE)
-	cd $(DIR_SRC)/libnetfilter_cttimeout-1.0.0 && make install
-
-	@rm -rf $(DIR_APP) $(DIR_SRC)/libnfnetlink-* $(DIR_SRC)/netfilter-layer7* $(DIR_SRC)/libnetfilter_queue-*
+	@rm -rf $(DIR_APP) $(DIR_SRC)/netfilter-layer7*
 	@$(POSTBUILD)
diff --git a/lfs/iputils b/lfs/iputils
index 7741c0ed0d..bb08793695 100644
--- a/lfs/iputils
+++ b/lfs/iputils
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,12 +24,12 @@
 
 include Config
 
-VER        = ss020927
+VER        = s20121221
 
 THISAPP    = iputils-$(VER)
-DL_FILE    = $(THISAPP).tar.gz
+DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
-DIR_APP    = $(DIR_SRC)/iputils
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 
 ###############################################################################
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = b5493f7a2997130a4f86c486c9993b86
+$(DL_FILE)_MD5 = 6072aef64205720dd1893b375e184171
 
 install : $(TARGET)
 
@@ -69,10 +69,7 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-20020927-headers.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-20020927-rh.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-glibckernheaders.patch
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && make ping tracepath
 	cd $(DIR_APP) && install -m 4755 ping /usr/bin
 	cd $(DIR_APP) && install -m 0755 tracepath /usr/bin
diff --git a/lfs/keepalived b/lfs/keepalived
index 28b7ed8da2..2054a54219 100644
--- a/lfs/keepalived
+++ b/lfs/keepalived
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.2.7
+VER        = 1.2.17
 
 THISAPP    = keepalived-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = keepalived
-PAK_VER    = 1
+PAK_VER    = 2
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 8551a34ee048895dbe5350a031ff29c1
+$(DL_FILE)_MD5 = 8d6400e1be43fc303175164d69125dce
 
 install : $(TARGET)
 
diff --git a/lfs/krb5 b/lfs/krb5
index 68be46c805..3011982396 100644
--- a/lfs/krb5
+++ b/lfs/krb5
@@ -93,8 +93,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--enable-dns-for-realm \
 		CPPFLAGS="-I/usr/include/et"
 
-	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
-	cd $(DIR_APP) && make $(EXTRA_INSTALL) install
+	cd $(DIR_APP) && make #$(MAKETUNING)
+	cd $(DIR_APP) && make install
 
 	for LIB in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
         		kdb5 kdb_ldap krad krb5 krb5support verto; do \
diff --git a/lfs/libarchive b/lfs/libarchive
new file mode 100644
index 0000000000..43365eeef6
--- /dev/null
+++ b/lfs/libarchive
@@ -0,0 +1,85 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 3.1.2
+
+THISAPP    = libarchive-$(VER)
+DL_FILE    = $(THISAPP).tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+PROG       = libarchive
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = efad5a503f66329bb9d2f4308b5de98a
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+dist: 
+	@$(PAK)
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && ./configure \
+		--prefix=/usr \
+		--disable-static
+
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libassuan b/lfs/libassuan
index 9670b7bc11..0137d14b2d 100644
--- a/lfs/libassuan
+++ b/lfs/libassuan
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.1.3
+VER        = 2.2.0
 
 THISAPP    = libassuan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = libassuan
-PAK_VER    = 2
+PAK_VER    = 3
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = b5373485419a7e2c23457d20811caabe
+$(DL_FILE)_MD5 = a104faed3e97b9c302c5d67cc22b1d60
 
 install : $(TARGET)
 
diff --git a/lfs/libevent2 b/lfs/libevent2
index e2ad69fd5e..2482dda179 100644
--- a/lfs/libevent2
+++ b/lfs/libevent2
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team  <info@ipfire.de>                      #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.de>                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.0.21-stable
+VER        = 2.0.22-stable
 
 THISAPP    = libevent-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,11 +32,6 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 
-PROG       = libevent2
-PAK_VER    = 2
-
-DEPS       = ""
-
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -45,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = b2405cc9ebf264aa47ff615d9de527a2
+$(DL_FILE)_MD5 = c4c56f986aa985677ca1db89630a2e11
 
 install : $(TARGET)
 
@@ -68,8 +63,6 @@ $(patsubst %,$(DIR_DL)/%,$(objects)) :
 $(subst %,%_MD5,$(objects)) :
 	@$(MD5)
 
-dist: 
-	@$(PAK)
 ###############################################################################
 # Installation Details
 ###############################################################################
@@ -77,8 +70,12 @@ dist:
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && ./configure \
+		--prefix=/usr \
+		--disable-static
+
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/libgcrypt b/lfs/libgcrypt
index 76ee3d0af5..98cf7871ea 100644
--- a/lfs/libgcrypt
+++ b/lfs/libgcrypt
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.6.1
+VER        = 1.6.4
 
 THISAPP    = libgcrypt-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = a5a5060dc2f80bcac700ab0236ea47dc
+$(DL_FILE)_MD5 = 4c13c5fa43147866f993d73ee62af176
 
 install : $(TARGET)
 
diff --git a/lfs/libgpg-error b/lfs/libgpg-error
index 7faf289bc1..ab9499e11d 100644
--- a/lfs/libgpg-error
+++ b/lfs/libgpg-error
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.13
+VER        = 1.20
 
 THISAPP    = libgpg-error-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = fe0cfa7e15262ef8fdeee366109e9ff6
+$(DL_FILE)_MD5 = 9997d9203b672402a04760176811589d
 
 install : $(TARGET)
 
diff --git a/lfs/libjpeg b/lfs/libjpeg
index 5e0785926e..8b4c0778c9 100644
--- a/lfs/libjpeg
+++ b/lfs/libjpeg
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.3.0
+VER        = 1.3.1
 
 THISAPP    = libjpeg-turbo-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = e1e65cc711a1ade1322c06ad4a647741
+$(DL_FILE)_MD5 = 2c3a68129dac443a72815ff5bb374b05
 
 install : $(TARGET)
 
diff --git a/lfs/libmpeg2 b/lfs/libmpeg2
index 2bf1c6c6af..6d664c9f0c 100644
--- a/lfs/libmpeg2
+++ b/lfs/libmpeg2
@@ -77,7 +77,8 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure --prefix=/usr --enable-shared 
+	cd $(DIR_APP) && ./configure --prefix=/usr --enable-shared \
+		--disable-accel-detect
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
diff --git a/lfs/libnet b/lfs/libnet
index 0547589805..a9efd99b3c 100644
--- a/lfs/libnet
+++ b/lfs/libnet
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,12 +24,12 @@
 
 include Config
 
-VER        = 1.1.2.1
+VER        = 1.1.6
 
 THISAPP    = libnet-$(VER)
-DL_FILE    = libnet.tar.gz
+DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
-DIR_APP    = $(DIR_SRC)/libnet
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 
 ###############################################################################
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = be845c41170d72c7db524f3411b50256
+$(DL_FILE)_MD5 = 710296fe424a49344e5fcc0d09e53317
 
 install : $(TARGET)
 
diff --git a/lfs/libusbx b/lfs/libnetfilter_conntrack
similarity index 94%
rename from lfs/libusbx
rename to lfs/libnetfilter_conntrack
index 167b9450db..3a0dc1f8ac 100644
--- a/lfs/libusbx
+++ b/lfs/libnetfilter_conntrack
@@ -24,9 +24,9 @@
 
 include Config
 
-VER        = 1.0.11
+VER        = 1.0.4
 
-THISAPP    = libusbx-$(VER)
+THISAPP    = libnetfilter_conntrack-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 9aaab6aee72f65900cc731ecbffb4cf4
+$(DL_FILE)_MD5 = 18cf80c4b339a3285e78822dbd4f08d7
 
 install : $(TARGET)
 
@@ -70,8 +70,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure --prefix=/usr \
-		--enable-examples-build
+	cd $(DIR_APP) && ./configure --prefix=/usr
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
diff --git a/lfs/libnetfilter_cthelper b/lfs/libnetfilter_cthelper
new file mode 100644
index 0000000000..3b469e6ae5
--- /dev/null
+++ b/lfs/libnetfilter_cthelper
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.0.0
+
+THISAPP    = libnetfilter_cthelper-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = b2efab1a3a198a5add448960ba011acd
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libnetfilter_cttimeout b/lfs/libnetfilter_cttimeout
new file mode 100644
index 0000000000..a2184b29ba
--- /dev/null
+++ b/lfs/libnetfilter_cttimeout
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.0.0
+
+THISAPP    = libnetfilter_cttimeout-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 7697437fc9ebb6f6b83df56a633db7f9
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libnetfilter_queue b/lfs/libnetfilter_queue
new file mode 100644
index 0000000000..19fe6a2c6e
--- /dev/null
+++ b/lfs/libnetfilter_queue
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.0.2
+
+THISAPP    = libnetfilter_queue-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = df09befac35cb215865b39a36c96a3fa
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libnfnetlink b/lfs/libnfnetlink
new file mode 100644
index 0000000000..62350ea07d
--- /dev/null
+++ b/lfs/libnfnetlink
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.0.1
+
+THISAPP    = libnfnetlink-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 98927583d2016a9fb1936fed992e2c5e
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && ./configure --prefix=/usr
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libpcap b/lfs/libpcap
index fa2aae8f34..10fbcd4ddc 100644
--- a/lfs/libpcap
+++ b/lfs/libpcap
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.6.2
+VER        = 1.7.4
 
 THISAPP    = libpcap-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 5f14191c1a684a75532c739c2c4059fa
+$(DL_FILE)_MD5 = b2e13142bbaba857ab1c6894aedaf547
 
 install : $(TARGET)
 
diff --git a/lfs/libsrtp b/lfs/libsrtp
index 6dfef3b197..47c0cad57c 100644
--- a/lfs/libsrtp
+++ b/lfs/libsrtp
@@ -24,14 +24,14 @@
 
 include Config
 
-VER        = 1.5.0
+VER        = 1.5.2
 THISAPP    = libsrtp-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = libsrtp
-PAK_VER    = 1
+PAK_VER    = 2
 
 DEPS       = ""
 
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = ec49ba558b4fd056114df2c76935aa8e
+$(DL_FILE)_MD5 = 2309aa6027992810a4285b042c71e644
 
 install : $(TARGET)
 
@@ -78,7 +78,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 
 	cd $(DIR_APP) && ./configure --prefix=/usr 
-	cd $(DIR_APP) && make uninstall && make $(MAKETUNING) libsrtp.so
+	cd $(DIR_APP) && make uninstall && make $(MAKETUNING) shared_library
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/libtool b/lfs/libtool
index e6bcd4060c..0172145055 100644
--- a/lfs/libtool
+++ b/lfs/libtool
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2012  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.4.2
+VER        = 2.4.4
 
 THISAPP    = libtool-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 2ec8997e0c07249eb4cbd072417d70fe
+$(DL_FILE)_MD5 = 51bf400de3354687d68dfa2392506b7e
 
 install : $(TARGET)
 
diff --git a/lfs/libusb b/lfs/libusb
index b35c90cefb..f557bd8be7 100644
--- a/lfs/libusb
+++ b/lfs/libusb
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,10 +24,10 @@
 
 include Config
 
-VER        = 0.1.12
+VER        = 1.0.19
 
 THISAPP    = libusb-$(VER)
-DL_FILE    = $(THISAPP).tar.gz
+DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = caf182cbc7565dac0fd72155919672e6
+$(DL_FILE)_MD5 = f9e2bb5879968467e5ca756cb4e1fa7e
 
 install : $(TARGET)
 
@@ -69,7 +69,7 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure --prefix=/usr --disable-build-docs --disable-nls
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
diff --git a/lfs/libusb-compat b/lfs/libusb-compat
new file mode 100644
index 0000000000..6d63843ebc
--- /dev/null
+++ b/lfs/libusb-compat
@@ -0,0 +1,80 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 0.1.5
+
+THISAPP    = libusb-compat-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 2780b6a758a1e2c2943bdbf7faf740e4
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
+
+	cd $(DIR_APP) && ./configure --prefix=/usr --disable-static
+	cd $(DIR_APP) && make -j $(PARALLELISM)
+	cd $(DIR_APP) && make install
+
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/libxml2 b/lfs/libxml2
index 4a25c4ca5f..ae2621b032 100644
--- a/lfs/libxml2
+++ b/lfs/libxml2
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.6.32
+VER        = 2.9.2
 
 THISAPP    = libxml2-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 2621d322c16f0257e30f0ff2b13384de
+$(DL_FILE)_MD5 = 9e6a9aca9d155737868b3dc5fd82f788
 
 install : $(TARGET)
 
diff --git a/lfs/libxslt b/lfs/libxslt
index 47ee4f8cd9..1339f42f95 100644
--- a/lfs/libxslt
+++ b/lfs/libxslt
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.1.17
+VER        = 1.1.28
 
 THISAPP    = libxslt-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = fde6a7a93c0eb14cba628692fa3a1000
+$(DL_FILE)_MD5 = 9667bf6f9310b957254fdcf6596600b7
 
 install : $(TARGET)
 
diff --git a/lfs/linux b/lfs/linux
index ef30fa673c..fe74ad1e11 100644
--- a/lfs/linux
+++ b/lfs/linux
@@ -24,11 +24,11 @@
 
 include Config
 
-VER        = 3.14.33
+VER         = 3.14.53
+RPI_PATCHES = 3.14.53-grsec-ipfire1
+A7M_PATCHES = 3.14.53-grsec-ipfire1
+GRS_PATCHES = grsecurity-3.1ipfire-3.14.53-v1.patch.xz
 
-RPI_PATCHES = 3.14.33-grsec-ipfire1
-A7M_PATCHES = 3.14.33-grsec-ipfire1
-GRS_PATCHES = grsecurity-3.0-3.14.33-201502180832.patch.xz
 
 THISAPP    = linux-$(VER)
 DL_FILE    = linux-$(VER).tar.xz
@@ -37,9 +37,15 @@ DIR_APP    = $(DIR_SRC)/$(THISAPP)
 CFLAGS     =
 CXXFLAGS   =
 
-PAK_VER    = 58
+PAK_VER    = 63
 DEPS	   = ""
 
+KERNEL_ARCH = $(MACHINE)
+
+ifeq "$(MACHINE)" "i586"
+	KERNEL_ARCH = i386
+endif
+
 VERSUFIX=ipfire$(KCFG)
 
 ifeq "$(TOOLS)" "1"
@@ -77,10 +83,10 @@ rpi-patches-$(RPI_PATCHES).patch.xz		= $(URL_IPFIRE)/rpi-patches-$(RPI_PATCHES).
 arm7-multi-patches-$(A7M_PATCHES).patch.xz	= $(URL_IPFIRE)/arm7-multi-patches-$(A7M_PATCHES).patch.xz
 $(GRS_PATCHES)					= $(URL_IPFIRE)/$(GRS_PATCHES)
 
-$(DL_FILE)_MD5					= c19feb0646fde7e96602ac313fb7e5d6
-rpi-patches-$(RPI_PATCHES).patch.xz_MD5		= e423c8b3a408f23b9a26f8f0f4384c50
-arm7-multi-patches-$(A7M_PATCHES).patch.xz_MD5	= f147ce7c81889d2c5134304f3a6e60e3
-$(GRS_PATCHES)_MD5				= 119943451628ff5a62437637d60a585d
+$(DL_FILE)_MD5					= 5c5d18ddcc80b008826c2f43b322a34a
+rpi-patches-$(RPI_PATCHES).patch.xz_MD5		= de5350ee7c3e4aa82289916963796fd9
+arm7-multi-patches-$(A7M_PATCHES).patch.xz_MD5	= 25fc733bb657a84eea338104f88bcf70
+$(GRS_PATCHES)_MD5				= 4c1f6e73f04bfc92b105afff24d0308c
 
 install : $(TARGET)
 
@@ -118,9 +124,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	# Linux Intermediate Queueing Device
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.22-imq.patch
 
-	# ipp2p 0.8.2-ipfire
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10-ipp2p-0.8.2-ipfire.patch
-
 	# Layer7-patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14-layer7-filter.patch
 
@@ -155,7 +158,7 @@ endif
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10.30_cs5535audio_fix_logspam_on_geos.patch
 
 	# Add PC Engines APU led support
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10-apu_leds.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14-apu_leds.patch
 
 	# Fix uevent PHYSDEVDRIVER
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.2.33_ipg-fix-driver-name.patch
@@ -164,6 +167,12 @@ endif
 	# r8169 L23 patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.32-r8169_disable_L23.patch
 
+	# update the queued trim blacklist from kernel 4.2rc1
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.43_new_qtrim_blacklist.patch
+
+	# HyperV 2008 patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.x-hyperv-2008-fix.patch
+
 ifeq "$(KCFG)" "-kirkwood"
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10.10-mv_cesa_disable_failing_hmac_sha1.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.22-kirkwood_legacy_boot.patch
@@ -178,8 +187,6 @@ ifeq "$(KCFG)" "-multi"
 	# Install switch api userspace header
 	cd $(DIR_APP) && install -v -m644 include/uapi/linux/switch.h /usr/include/linux/
 
-	# Fix Lamobo-R1 SATA Power
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.x-lamobo-r1-fix-sata-pwr.patch
 endif
 
 ifeq "$(KCFG)" "-rpi"
@@ -221,7 +228,7 @@ ifeq "$(KCFG)" "-rpi"
 	cd $(DIR_APP) && cp -v arch/arm/boot/zImage /boot/kernel.img
 else
 	cd $(DIR_APP) && make $(MAKETUNING) bzImage modules
-	cd $(DIR_APP) && cp -v arch/i386/boot/bzImage /boot/vmlinuz-$(VER)-$(VERSUFIX)
+	cd $(DIR_APP) && cp -v arch/$(KERNEL_ARCH)/boot/bzImage /boot/vmlinuz-$(VER)-$(VERSUFIX)
 endif
 endif
 endif
diff --git a/lfs/logrotate b/lfs/logrotate
index 8f81b2df54..0904074ba9 100644
--- a/lfs/logrotate
+++ b/lfs/logrotate
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2014  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.7.1
+VER        = 3.8.1
 
 THISAPP    = logrotate-$(VER)
 DL_FILE    = logrotate_$(VER).orig.tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 552639142e163745f6bcd4f1f3816d8a
+$(DL_FILE)_MD5 = bd2e20d8dc644291b08f9215397d28a5
 
 install : $(TARGET)
 
diff --git a/lfs/logwatch b/lfs/logwatch
index 755557a0b9..7144d07f3b 100644
--- a/lfs/logwatch
+++ b/lfs/logwatch
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 7.3.6
+VER        = 7.4.1
 
 THISAPP    = logwatch-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 937d982006b2a76a83edfcfd2e5a9d7d
+$(DL_FILE)_MD5 = a0c3d8721f877bdcd4a9089eb1b4691b
 
 install : $(TARGET)
 
@@ -99,7 +99,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	-mkdir -p /var/log/logwatch
 	chmod -v 755 /var/log/logwatch
 	-rm -rf /etc/logwatch/conf
-	ln -vsf /usr/share/logwatch/default.config /etc/logwatch/conf
+	ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf
 	
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/make b/lfs/make
index 5650230f93..c8c2cb0097 100644
--- a/lfs/make
+++ b/lfs/make
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,14 +24,14 @@
 
 include Config
 
-VER        = 3.81
+VER        = 4.1
 
 THISAPP    = make-$(VER)
-DL_FILE    = $(THISAPP).tar.bz2
+DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 PROG       = make
-PAK_VER    = 2
+PAK_VER    = 3
 
 DEPS       = ""
 
@@ -61,7 +61,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 354853e0b2da90c527e35aabb8d6f1e6
+$(DL_FILE)_MD5 = 654f9117957e6fa6a1c49a8f08270ec9
 
 install : $(TARGET)
 
@@ -93,7 +93,7 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure $(EXTRA_CONFIG)
 	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
 	cd $(DIR_APP) && make $(EXTRA_INSTALL) install
diff --git a/lfs/memtest b/lfs/memtest
index d98ea872bd..cef29d69e8 100644
--- a/lfs/memtest
+++ b/lfs/memtest
@@ -31,7 +31,7 @@ DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = i586 x86_64
 
 ###############################################################################
 # Top-level Rules
@@ -71,11 +71,19 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	-mkdir -p /usr/lib/memtest86+
+
+ifeq "$(MACHINE)" "i586"
 	# Enable SMP as default
 	cd $(DIR_APP) && sed -i -e "s|CONSERVATIVE_SMP 1|CONSERVATIVE_SMP 0|g" config.h
 	cd $(DIR_APP) && sed -i -e "s|scp |echo |g" Makefile
 	cd $(DIR_APP) && make $(EXTRA_MAKE)
-	-mkdir -p /usr/lib/memtest86+
 	cd $(DIR_APP) && cp -f memtest.bin /usr/lib/memtest86+
+else
+	# 64bit only systems cannot link mentest without 32bit gcc libs
+	# so we use the precompiled binary from memtest author
+	cd $(DIR_APP) && cp -f precomp.bin /usr/lib/memtest86+/memtest.bin
+endif
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/monit b/lfs/monit
index 6c35c6ced9..453ad0376a 100644
--- a/lfs/monit
+++ b/lfs/monit
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.11
+VER        = 5.14
 
 THISAPP    = monit-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = monit
-PAK_VER    = 3
+PAK_VER    = 7
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = ff00f39d248ed7068932ed82211da9e6
+$(DL_FILE)_MD5 = 1b3ae1eb08a0914402a8764e5689c1c5
 
 install : $(TARGET)
 
@@ -81,6 +81,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
+	mkdir -p /var/lib/monit
+
 	install -v -m 644 $(DIR_SRC)/config/backup/includes/monit \
 			 /var/ipfire/backup/addons/includes/monit
 
diff --git a/lfs/nano b/lfs/nano
index b0346770fa..bf80810e34 100644
--- a/lfs/nano
+++ b/lfs/nano
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.2.6
+VER        = 2.4.2
 
 THISAPP    = nano-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = nano
-PAK_VER    = 3
+PAK_VER    = 6
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 03233ae480689a008eb98feb1b599807
+$(DL_FILE)_MD5 = ce6968992fec4283c17984b53554168b
 
 install : $(TARGET)
 
diff --git a/lfs/nasm b/lfs/nasm
index f6aeac7a8f..b77e7cbfd6 100644
--- a/lfs/nasm
+++ b/lfs/nasm
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.10.03
+VER        = 2.11.06
 
 THISAPP    = nasm-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = a5d0ed070476a7c5b4f0893dc4a4ea4b
+$(DL_FILE)_MD5 = 2b958e9f5d200641e6fc9564977aecc5
 
 install : $(TARGET)
 
diff --git a/lfs/netpbm b/lfs/netpbm
index 5af5e47c71..ab5e4f874f 100644
--- a/lfs/netpbm
+++ b/lfs/netpbm
@@ -36,6 +36,8 @@ PAK_VER    = 1
 
 DEPS       = ""
 
+CFLAGS    += -flax-vector-conversions
+
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -79,7 +81,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP)/converter && patch -Np1 < $(DIR_SRC)/src/patches/netpbm-10.26.46-getline.patch
 	cp $(DIR_SRC)/config/netpbm/Makefile.config $(DIR_APP)
-	cd $(DIR_APP) && make
+	cd $(DIR_APP) && make CFLAGS="$(CFLAGS)"
 	cd $(DIR_APP) && make package PKGDIR=/usr/local/netpbm
 	cp /usr/local/netpbm/lib/lib* /usr/lib
 	@rm -rf $(DIR_APP)
diff --git a/lfs/netsnmpd b/lfs/netsnmpd
index 388b20b120..b51367855f 100644
--- a/lfs/netsnmpd
+++ b/lfs/netsnmpd
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2011  IPFire Team  <info@ipfire.org>                          #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,15 +24,15 @@
 
 include Config
 
-VER        = 5.4.2.1
+VER        = 5.7.3
 
 THISAPP    = net-snmp-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-PROG 	   = netsnmpd
-PAK_VER	   = 2
+PROG       = netsnmpd
+PAK_VER    = 4
 DEPS       = ""
 
 ###############################################################################
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 984932520143f0c8bf7b7ce1fc9e1da1
+$(DL_FILE)_MD5 = d4a3459e1577d0efa8d96ca70a885e53
 
 install : $(TARGET)
 
@@ -77,21 +77,22 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure \
-				    --prefix=/usr \
-				    --with-default-snmp-version="2" \
-				    --with-sys-contact="root@" \
-				    --with-sys-location="localhost" \
-				    --with-logfile="/var/log/snmpd.log" \
-				    --with-persistent-directory="/var/net-snmp" \
-				    --libdir=/usr/lib \
-				    --sysconfdir="/etc"
+		--prefix=/usr \
+		--with-default-snmp-version="2" \
+		--with-sys-contact="root@" \
+		--with-sys-location="localhost" \
+		--with-logfile="/var/log/snmpd.log" \
+		--with-persistent-directory="/var/net-snmp" \
+		--libdir=/usr/lib \
+		--sysconfdir="/etc"
 	cd $(DIR_APP) && make 
 	cd $(DIR_APP) && make install
 	install -v -m644 $(DIR_SRC)/config/netsnmpd/snmpd.conf /etc/snmpd.conf
+	install -v -m 644 $(DIR_SRC)/config/backup/includes/netsnmpd \
+		/var/ipfire/backup/addons/includes/netsnmpd
 	install -v -m755 $(DIR_SRC)/src/initscripts/init.d/netsnmpd /etc/init.d/netsnmpd
 	ln -sf ../init.d/netsnmpd /etc/rc.d/rc3.d/S65netsnmpd
 	ln -sf ../init.d/netsnmpd /etc/rc.d/rc0.d/K02netsnmpd
 	ln -sf ../init.d/netsnmpd /etc/rc.d/rc6.d/K02netsnmpd
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
-	
diff --git a/lfs/nettle b/lfs/nettle
index 0ea42f343f..b48b405e37 100644
--- a/lfs/nettle
+++ b/lfs/nettle
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.0
+VER        = 3.1.1
 
 THISAPP    = nettle-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = f64b1bf1e774b7ae6e507318e340250e
+$(DL_FILE)_MD5 = b40fa88dc32f37a182b6b42092ebb144
 
 install : $(TARGET)
 
@@ -73,7 +73,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && ./configure \
 		--prefix=/usr \
 		--enable-shared
+
 	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && sed -i '/^install-here/ s/ install-static//' Makefile
 	cd $(DIR_APP) && make install
+
+	chmod -v 755 /usr/lib/lib{hogweed,nettle}.so
+	install -v -m755 -d /usr/share/doc/nettle-3.1.1
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/newt b/lfs/newt
index daad9dce91..ed535620c7 100644
--- a/lfs/newt
+++ b/lfs/newt
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.52.17
+VER        = 0.52.18
 
 THISAPP    = newt-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = f36d4d908965a0c89fd6fd8b61a6118b
+$(DL_FILE)_MD5 = 685721bee1a318570704b19dcf31d268
 
 install : $(TARGET)
 
diff --git a/lfs/nfs b/lfs/nfs
index d18487baa8..417f155fd2 100644
--- a/lfs/nfs
+++ b/lfs/nfs
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = nfs
-PAK_VER    = 5
+PAK_VER    = 6
 
 DEPS       = "portmap"
 
diff --git a/lfs/openssh b/lfs/openssh
index bc6fa3cade..22d1de5bfd 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 6.6p1
+VER        = 7.1p1
 
 THISAPP    = openssh-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 3e9800e6bca1fbac0eea4d41baa7f239
+$(DL_FILE)_MD5 = 8709736bc8a8c253bc4eeb4829888ca5
 
 install : $(TARGET)
 
@@ -70,9 +70,6 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-ifeq "$(PADLOCK)" "1"
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssh-4.7p1-padlock.patch
-endif
 	cd $(DIR_APP) && sed -i "s/lkrb5 -ldes/lkrb5/" configure
 	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc/ssh \
 		    --libexecdir=/usr/lib/openssh --with-md5-passwords \
@@ -93,6 +90,7 @@ endif
 	    -e 's/^#\?SyslogFacility AUTH .*$$/SyslogFacility AUTH/' \
 	    -e 's/^#\?LogLevel INFO .*$$/LogLevel INFO/' \
 	    -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \
+	    -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \
 	    /etc/ssh/sshd_config
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/openssl b/lfs/openssl
index df068f3a78..153a6b9ea6 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2014  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,25 +24,60 @@
 
 include Config
 
-VER        = 1.0.1k
+VER        = 1.0.2d
 
 THISAPP    = openssl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
-TARGET     = $(DIR_INFO)/$(THISAPP)
+
+TARGET = $(DIR_INFO)/$(THISAPP)$(KCFG)
+
+ifneq "$(KCFG)" "-sse2"
+CFLAGS += -DPURIFY
+else
+CFLAGS =-O2 -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fPIC
+CFLAGS+= -fstack-protector-all --param=ssp-buffer-size=4
+CFLAGS+= -march=i686 -mmmx -msse -msse2 -mfpmath=sse
+CFLAGS+= -fomit-frame-pointer -DPURIFY
+CXXFLAGS="${CFLAGS}"
+endif
+
+export RPM_OPT_FLAGS = $(CFLAGS)
+
+CONFIGURE_OPTIONS = \
+	--prefix=/usr \
+	--openssldir=/etc/ssl \
+	--enginesdir=/usr/lib/openssl/engines \
+	shared \
+	zlib-dynamic \
+	enable-camellia \
+	enable-md2 \
+	enable-seed \
+	enable-tlsext \
+	enable-rfc3779 \
+	no-idea \
+	no-mdc2 \
+	no-rc5 \
+	no-srp \
+	-DSSL_FORBID_ENULL
+
+ifeq "$(MACHINE)" "x86_64"
+	CONFIGURE_OPTIONS += linux-x86_64
+endif
 
 ifeq "$(MACHINE)" "i586"
-	CONFIGURE_ARGS = linux-elf no-asm 386
+	CONFIGURE_OPTIONS += linux-elf
+
+ifneq "$(KCFG)" "-sse2"
+	CONFIGURE_OPTIONS += no-sse2
+endif
 endif
 
 ifeq "$(MACHINE)" "armv5tel"
-	CONFIGURE_ARGS = linux-generic32
+	CONFIGURE_OPTIONS += linux-generic32
 endif
 
-CFLAGS += -DPURIFY
-export RPM_OPT_FLAGS = $(CFLAGS)
-
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -51,7 +86,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = d4f002bd22a56881340105028842ae1f
+$(DL_FILE)_MD5 = 38dd619b2e77cbac69b99f52a053d25a
 
 install : $(TARGET)
 
@@ -82,38 +117,33 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.0-beta5-enginesdir.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1-beta2-build.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-cryptodev.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-weak-ciphers.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2a-rpmbuild.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1m-weak-ciphers.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-disable-sslv2-sslv3.patch
 
+	# i586 specific patches
+ifeq "$(MACHINE)" "i586"
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2a_auto_enable_padlock.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2a_disable_ssse3_for_amd.patch
+endif
+
+	# Apply our CFLAGS
+	cd $(DIR_APP) && sed -i Configure \
+		-e "s/-O3 -fomit-frame-pointer/$(CFLAGS)/g"
+
 	cd $(DIR_APP) && find crypto/ -name Makefile -exec \
 		sed 's/^ASFLAGS=/&-Wa,--noexecstack /' -i {} \;
 
-	cd $(DIR_APP) && ./Configure \
-		--prefix=/usr \
-		--openssldir=/etc/ssl \
-		--enginesdir=/usr/lib/openssl/engines \
-		shared \
-		zlib-dynamic \
-		enable-camellia \
-		enable-md2 \
-		enable-seed \
-		enable-tlsext \
-		enable-rfc3779 \
-		no-idea \
-		no-mdc2 \
-		no-rc5 \
-		no-srp \
-		$(CONFIGURE_ARGS) \
-		-DSSL_FORBID_ENULL \
-		-DHAVE_CRYPTODEV \
-		-DUSE_CRYPTODEV_DIGEST
+	cd $(DIR_APP) && ./Configure $(CONFIGURE_OPTIONS)
 
 	cd $(DIR_APP) && make depend
 	cd $(DIR_APP) && make
 
+ifeq "$(KCFG)" "-sse2"
+	-mkdir -pv /usr/lib/sse2
+	cd $(DIR_APP) && install -m 755 \
+		libcrypto.so.10 /usr/lib/sse2
+else
 	# Install everything.
 	cd $(DIR_APP) && make install
 	install -m 0644 $(DIR_SRC)/config/ssl/openssl.cnf /etc/ssl
@@ -125,6 +155,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	-mkdir -pv /usr/lib/openssl
 	rm -vfr /usr/lib/openssl/engines
 	mv -v /usr/lib/engines /usr/lib/openssl
+endif
 
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/pakfire b/lfs/pakfire
index 6f90f89bb1..00d1bb1c0d 100644
--- a/lfs/pakfire
+++ b/lfs/pakfire
@@ -30,10 +30,10 @@ THISAPP    = pakfire
 DIR_APP    = /opt/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 
-ifeq "$(MACHINE_TYPE)" "arm"
-	PAKFIRE_VERSION = $(VERSION)-$(MACHINE)
-else
+ifeq "$(MACHINE)" "i586"
 	PAKFIRE_VERSION = $(VERSION)
+else
+	PAKFIRE_VERSION = $(VERSION)-$(MACHINE)
 endif
 
 ###############################################################################
diff --git a/lfs/pcre b/lfs/pcre
index f5c771ca81..fd66350043 100644
--- a/lfs/pcre
+++ b/lfs/pcre
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 8.36
+VER        = 8.37
 
 THISAPP    = pcre-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = ff7b4bb14e355f04885cf18ff4125c98
+$(DL_FILE)_MD5 = 6e0cc6d1bdac7a4308151f9b3571b86e
 
 install : $(TARGET)
 
@@ -70,6 +70,11 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pcre-8.37-Fix-another-buffer-overflow.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-references-in-situatio.patch
 	cd $(DIR_APP) && ./configure \
 		--prefix=/usr \
 		--disable-static \
diff --git a/lfs/perl-Authen-SASL b/lfs/perl-Authen-SASL
new file mode 100644
index 0000000000..4052c44aed
--- /dev/null
+++ b/lfs/perl-Authen-SASL
@@ -0,0 +1,83 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 2.16
+
+THISAPP    = Authen-SASL-$(VER)
+DL_FILE    = ${THISAPP}.tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+PROG       = perl-Authen-SASL
+DEPS       = ""
+PAK_VER    = 1
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 7c03a689d4c689e5a9e2f18a1c586b2f
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+dist: 
+	@$(PAK)
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/perl-Email-Date-Format b/lfs/perl-Email-Date-Format
new file mode 100644
index 0000000000..ce55d14143
--- /dev/null
+++ b/lfs/perl-Email-Date-Format
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.005
+
+THISAPP    = Email-Date-Format-$(VER)
+DL_FILE    = $(THISAPP).tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 030dcee3bc1a44674900b0132925bd03
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/perl-MIME-Base64 b/lfs/perl-MIME-Base64
new file mode 100644
index 0000000000..f406ae9e7f
--- /dev/null
+++ b/lfs/perl-MIME-Base64
@@ -0,0 +1,83 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 3.15
+
+THISAPP    = MIME-Base64-$(VER)
+DL_FILE    = ${THISAPP}.tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+PROG       = perl-MIME-Base64
+DEPS       = ""
+PAK_VER    = 1
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = ef958dc2bf96be5f759391c6ac1debd4
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+dist: 
+	@$(PAK)
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/perl-MIME-Lite b/lfs/perl-MIME-Lite
new file mode 100644
index 0000000000..c6f53e627d
--- /dev/null
+++ b/lfs/perl-MIME-Lite
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 3.030
+
+THISAPP    = MIME-Lite-$(VER)
+DL_FILE    = $(THISAPP).tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 5a6d90329e049eee77248d667343acc7
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && yes |perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/perl-Net-SMTP-SSL b/lfs/perl-Net-SMTP-SSL
new file mode 100644
index 0000000000..2e2ec578fa
--- /dev/null
+++ b/lfs/perl-Net-SMTP-SSL
@@ -0,0 +1,83 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = 1.02
+
+THISAPP    = Net-SMTP-SSL-$(VER)
+DL_FILE    = ${THISAPP}.tar.gz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+PROG       = perl-Net-SMTP-SSL
+DEPS       = ""
+PAK_VER    = 1
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = e67b4d842a51b9a453aeeaeed45fb8e1
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+dist: 
+	@$(PAK)
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/perl-Text-CSV_XS b/lfs/perl-Text-CSV_XS
new file mode 100644
index 0000000000..f94593f983
--- /dev/null
+++ b/lfs/perl-Text-CSV_XS
@@ -0,0 +1,77 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2014  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+VER        = 1.12
+
+THISAPP    = Text-CSV_XS-$(VER)
+DL_FILE    = ${THISAPP}.tgz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = b91f2d806054b68c2a29d3da5821fe87
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && perl Makefile.PL
+	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+	cd $(DIR_APP) && make install
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/postfix b/lfs/postfix
index 77c6dd0e4a..b8029f7634 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -32,11 +32,11 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = postfix
-PAK_VER    = 7
+PAK_VER    = 9
 
 DEPS       = "amavisd mysql"
 
-CCARGS     = -DNO_IPV6 `getconf LFS_CFLAGS` \
+CCARGS     = `getconf LFS_CFLAGS` \
 	-DDEF_DAEMON_DIR="'\"/usr/lib/postfix\"'" \
 	-DDEF_MANPAGE_DIR="'\"/usr/share/man\"'"
 AUXLIBS    =
@@ -115,5 +115,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 
 	install -v -m 644 $(DIR_SRC)/config/backup/includes/postfix \
 			 /var/ipfire/backup/addons/includes/postfix
+	mv /usr/sbin/sendmail /usr/sbin/sendmail.postfix
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/pound b/lfs/pound
index a0f6f29065..3860122a9f 100644
--- a/lfs/pound
+++ b/lfs/pound
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = pound
-PAK_VER    = 7
+PAK_VER    = 8
 
 DEPS       = ""
 
@@ -77,7 +77,8 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc
+	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc \
+		--with-dh=1024
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 	install -v -m 644 $(DIR_SRC)/config/backup/includes/pound \
diff --git a/lfs/powertop b/lfs/powertop
index f10dca9618..8520f94386 100644
--- a/lfs/powertop
+++ b/lfs/powertop
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2010  IPFire Team  <info@ipfire.org>                          #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.13
+VER        = 2.7
 
 THISAPP    = powertop-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = powertop
-PAK_VER    = 0
+PAK_VER    = 1
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 78aa17c8f55178004223bf236654298e
+$(DL_FILE)_MD5 = e0d686e47daaf7e9d89031f7763432ef
 
 install : $(TARGET)
 
@@ -77,7 +77,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	
+	cd $(DIR_APP) && ./configure --prefix=/usr
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
diff --git a/lfs/procps b/lfs/procps
index 51c66a9c43..ae30f2f129 100644
--- a/lfs/procps
+++ b/lfs/procps
@@ -71,7 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/$(THISAPP)-fix_unknown_HZ_value.patch
-	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make $(MAKETUNING) LIBPROC=proc/libproc-$(VER).so
 	cd $(DIR_APP) && make install
 	install -m 0644 $(DIR_SRC)/config/etc/sysctl.conf /etc
 	@rm -rf $(DIR_APP)
diff --git a/lfs/python b/lfs/python
index 6095e5ed02..013f9c1a8a 100644
--- a/lfs/python
+++ b/lfs/python
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.7.3
+VER        = 2.7.10
 
 THISAPP    = Python-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 62c4c1699170078c469f79ddfed21bc0
+$(DL_FILE)_MD5 = c685ef0b8e9f27b5e3db5db12b268ac6
 
 install : $(TARGET)
 
@@ -70,8 +70,9 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/$(THISAPP)-gdbm-1.patch
-	cd $(DIR_APP) && OPT="$(CFLAGS)" ./configure --prefix=/usr --enable-shared
+	rm -rf $(DIR_APP)/Modules/_ctypes/{darwin,libffi,libffi_arm_wince,libffi_msvc,libffi_osx}
+	cd $(DIR_APP) && OPT="$(CFLAGS)" ./configure \
+		--prefix=/usr --enable-shared --with-system-ffi
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
diff --git a/lfs/python-optional-src b/lfs/python-optional-src
index 7b9e0c7c86..9ad1d5e85d 100644
--- a/lfs/python-optional-src
+++ b/lfs/python-optional-src
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team <info@ipfire.org>                      #
+# Copyright (C) 2007-2015  IPFire Team <info@ipfire.org>                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,12 +24,12 @@
 
 include Config
 
-VER	   = 2.7.1
+VER	   = 2.7.10
 
 include python
 
 PROG	   = python-optional-src
-PAK_VER    = 2
+PAK_VER    = 4
 DEPS       =
 
 dist: 
diff --git a/lfs/qemu b/lfs/qemu
index 2fc0476b0a..a15dccdbe9 100644
--- a/lfs/qemu
+++ b/lfs/qemu
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2009  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,16 +24,16 @@
 
 include Config
 
-VER        = 0.15.0
+VER        = 2.4.0
 
-THISAPP    = qemu-kvm-$(VER)
-DL_FILE    = $(THISAPP).tar.gz
+THISAPP    = qemu-$(VER)
+DL_FILE    = $(THISAPP).tar.bz2
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = i586 x86_64
 PROG       = qemu
-PAK_VER    = 14
+PAK_VER    = 17
 
 DEPS       = "sdl"
 
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = b45b0deebba4ce47dcaaab3807f6ed47
+$(DL_FILE)_MD5 = 186ee8194140a484a455f8e3c74589f4
 
 install : $(TARGET)
 
@@ -77,12 +77,24 @@ $(subst %,%_MD5,$(objects)) :
 
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
-	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/qemu-0.15.0_missing_definitions_hack.patch
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc \
-		--target-list="i386-linux-user i386-softmmu arm-softmmu" \
+		--enable-kvm --disable-attr \
+		--target-list="i386-linux-user x86_64-linux-user arm-linux-user i386-softmmu x86_64-softmmu arm-softmmu" \
 		--extra-cflags="$(CFLAGS)"
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
+
+	# install wrapper for old kvm parameter handling
+	install -m 755 $(DIR_SRC)/config/qemu/qemu /usr/bin/qemu
+
+	# disable PaX MPROTECT and RANDMMAP
+	paxctl -m -r /usr/bin/qemu-system-arm
+	paxctl -m -r /usr/bin/qemu-system-i386
+	paxctl -m -r /usr/bin/qemu-system-x86_64
+	paxctl -m -r /usr/bin/qemu-arm
+	paxctl -m -r /usr/bin/qemu-i386
+	paxctl -m -r /usr/bin/qemu-x86_64
+
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/rrdtool b/lfs/rrdtool
index 0237b89f2e..f156400283 100644
--- a/lfs/rrdtool
+++ b/lfs/rrdtool
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.4.7
+VER        = 1.5.4
 
 THISAPP    = rrdtool-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = ffe369d8921b4dfdeaaf43812100c38f
+$(DL_FILE)_MD5 = 4daea1e628e1c70d91800d6a06427dc1
 
 install : $(TARGET)
 
diff --git a/lfs/sarg b/lfs/sarg
index c8794fe7e0..ce309a12bb 100644
--- a/lfs/sarg
+++ b/lfs/sarg
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - An Open Source Firewall Solution                               #
-# Copyright (C) 2012 Michael Tremer                                           #
+# Copyright (C) 2014 Michael Tremer                                           #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.3.3
+VER        = 2.3.9
 
 THISAPP    = sarg-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = sarg
-PAK_VER    = 1
+PAK_VER    = 2
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 09dba9a960d500acd7f17802de62512c
+$(DL_FILE)_MD5 = d6e8b854950f1bebb953e0ea2ca13428
 
 install : $(TARGET)
 
diff --git a/lfs/slang b/lfs/slang
index 55590f7cb2..d913cdf254 100644
--- a/lfs/slang
+++ b/lfs/slang
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.2.4
+VER        = 2.3.0
 
 THISAPP    = slang-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 86cd8689cd71e281b4720fef8453ceeb
+$(DL_FILE)_MD5 = 80f4e64189b6f28fd420b829b44a6723
 
 install : $(TARGET)
 
diff --git a/lfs/sox b/lfs/sox
index 378429d4d1..de60c90369 100644
--- a/lfs/sox
+++ b/lfs/sox
@@ -79,7 +79,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && ./configure --prefix=/usr --disable-alsa-dsp --disable-oss-dsp \
 				--disable-sun-audio --disable-mad
-	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+	cd $(DIR_APP) && make $(EXTRA_MAKE)
 	cd $(DIR_APP) && make install
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/squid b/lfs/squid
index 67e4a7db15..de6c87d46e 100644
--- a/lfs/squid
+++ b/lfs/squid
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2012  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2015  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.4.9
+VER        = 3.4.14
 
 THISAPP    = squid-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 497e5be7b3430d12667628296760beca
+$(DL_FILE)_MD5 = 4e7d7d062159484563ef11f69a0df50a
 
 install : $(TARGET)
 
@@ -70,6 +70,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE)
+	cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid-3.4-13228.patch
 	cd $(DIR_APP) && ./configure \
 		--prefix=/usr \
 		--sysconfdir=/etc/squid \
@@ -78,12 +79,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--libexecdir=/usr/lib/squid \
 		--localstatedir=/var \
 		--disable-ipv6 \
+		--disable-ssl \
 		--enable-poll \
 		--disable-icmp \
 		--disable-wccp \
 		--enable-ident-lookups \
 		--enable-storeio="aufs,diskd,ufs" \
-		--enable-ssl \
 		--enable-underscores \
 		--enable-http-violations \
 		--enable-removal-policies="heap,lru" \
@@ -113,7 +114,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--enable-cache-digests \
 		--enable-forw-via-db \
 		--enable-htcp \
-		--enable-linux-netfilter \
 		--enable-kill-parent-hack \
 		--disable-wccpv2 \
 		--enable-icap-client \
diff --git a/lfs/squid-accounting b/lfs/squid-accounting
index 7eae4fbb62..2e45c24b2b 100644
--- a/lfs/squid-accounting
+++ b/lfs/squid-accounting
@@ -9,15 +9,15 @@
 
 include Config
 
-VER        = 1.0.2
+VER        = 1.0.4
 
 THISAPP    = squid-accounting-$(VER)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = squid-accounting
-PAK_VER    = 4
+PAK_VER    = 8
 
-DEPS       = "perl-DBI perl-DBD-SQLite perl-File-ReadBackwards perl-PDF-API2 sendEmail"
+DEPS       = "perl-DBI perl-DBD-SQLite perl-File-ReadBackwards perl-PDF-API2"
 
 ###############################################################################
 # Top-level Rules
@@ -50,8 +50,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	chmod 777 /var/log/accounting.log
 #Set permissions for logo and graphs
 	chmod -R 777 /srv/web/ipfire/html/accounting
-		
-	
+
 	install -v -m 755 $(DIR_APP)/squid-accounting/accounting.cgi /srv/web/ipfire/cgi-bin/
 	install -v -m 755 $(DIR_APP)/squid-accounting/acct.pl /usr/local/bin/
 	install -v -m 644 $(DIR_APP)/squid-accounting/acct-lib.pl /var/ipfire/accounting/
@@ -61,10 +60,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	install -v -m 755 $(DIR_APP)/squid-accounting/dbinstall.pl /var/ipfire/accounting/
 	install -v -m 644 $(DIR_APP)/squid-accounting/config/backup/includes/squid-accounting  \
 			/var/ipfire/backup/addons/includes/squid-accounting
-			
+
 #activate hourly logging of proxy logfile
 	ln -sf /usr/local/bin/acct.pl /etc/fcron.hourly/squid-accounting
-		
 	chown -R nobody.nobody /var/ipfire/accounting
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)
diff --git a/lfs/stage2 b/lfs/stage2
index 895ee153bc..ec5d1170d9 100644
--- a/lfs/stage2
+++ b/lfs/stage2
@@ -55,7 +55,7 @@ $(TARGET) :
 	-install -dv -m 1777 /tmp /var/tmp
 	-mkdir -pv /usr/{,local/}{bin,include,lib{,/sse2},sbin,src}
 	-mkdir -pv /usr/{,local/}share/{doc,info,locale,man}
-	-mkdir -v  /usr/{,local/}share/{misc,terminfo,zoneinfo}
+	-mkdir -v  /usr/{,local/}share/{misc,terminfo,xt_geoip,zoneinfo}
 	-mkdir -pv /usr/{,local/}share/man/man{1..8}
 	#-for dir in /usr /usr/local; do \
 	#  ln -sv share/{man,doc,info} $$dir; \
@@ -63,7 +63,12 @@ $(TARGET) :
 
 	# Symlink /var/run -> /run.
 	ln -svf ../run /var/run
-	
+
+ifeq "$(MACHINE)" "x86_64"
+	ln -svf lib /lib64
+	ln -svf lib /usr/lib64
+endif
+
 	# Symlinks
 	# for this reason, stage2 rebuild will broke the iso:perl, grubbatch
 	-ln -sv /tools/bin/{bash,cat,echo,pwd,stty} /bin
@@ -101,13 +106,16 @@ $(TARGET) :
 
 	# Move script to correct place.
 	mv -vf /usr/local/bin/ovpn-ccd-convert /usr/sbin/
-
+	mv -vf /usr/local/bin/ovpn-collectd-convert /usr/sbin/
+	
 	# Install firewall scripts.
 	mkdir -pv /usr/lib/firewall
 	install -m 755 $(DIR_SRC)/config/firewall/rules.pl \
 		/usr/lib/firewall/rules.pl
 	install -m 644 $(DIR_SRC)/config/firewall/firewall-lib.pl \
 		/usr/lib/firewall/firewall-lib.pl
+	install -m 755 $(DIR_SRC)/config/firewall/ipsec-block \
+		/usr/lib/firewall/ipsec-block
 
 	# Nobody user
 	-mkdir -p /home/nobody
diff --git a/lfs/strongswan b/lfs/strongswan
index 43995b5a11..2a181a3304 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.2.2
+VER        = 5.3.3
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 7ee1a33060b2bde35be0f6d78a1d26d0
+$(DL_FILE)_MD5 = 5a25f3d1c31a77ef44d14a2e7b3eaad0
 
 install : $(TARGET)
 
@@ -78,13 +78,8 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.0.2_ipfire.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.2.2-issue-816-eb25190.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.2.2-issue-816-650a3ad.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.2.2-issue-816-dd0ebb.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.2.2-issue-819-cd2c30a.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch
 
-	cd $(DIR_APP) && [ -x "configure" ] || ./autogen.sh
 	cd $(DIR_APP) && ./configure \
 		--prefix="/usr" \
 		--sysconfdir="/etc" \
@@ -93,6 +88,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--enable-farp \
 		--enable-openssl \
 		--enable-gcrypt \
+		--enable-ccm \
+		--enable-ctr \
+		--enable-gcm \
 		--enable-xauth-eap \
 		--enable-xauth-noauth \
 		--enable-eap-radius \
@@ -101,6 +99,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--enable-eap-peap \
 		--enable-eap-mschapv2 \
 		--enable-eap-identity \
+		--disable-chapoly \
 		$(CONFIGURE_OPTIONS)
 
 	cd $(DIR_APP) && make $(MAKETUNING)
diff --git a/lfs/syslinux b/lfs/syslinux
index 43bcde9b62..00a8415d0f 100644
--- a/lfs/syslinux
+++ b/lfs/syslinux
@@ -31,7 +31,7 @@ DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-SUP_ARCH   = i586
+SUP_ARCH   = x86_64 i586
 
 ###############################################################################
 # Top-level Rules
diff --git a/lfs/tar b/lfs/tar
index 5919b04746..d701dd0e97 100644
--- a/lfs/tar
+++ b/lfs/tar
@@ -36,7 +36,7 @@ DIR_APP    = $(DIR_SRC)/$(THISAPP)
 ifeq "$(ROOT)" ""
   TARGET = $(DIR_INFO)/$(THISAPP)
   EXTRA_CONFIG = --prefix=/usr --bindir=/bin \
-	--libexecdir=/usr/sbin --disable-nls FORCE_UNSAFE_CONFIGURE=1
+	--libexecdir=/usr/sbin --disable-nls
   EXTRA_MAKE =
   EXTRA_INSTALL =
 else
@@ -84,7 +84,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && ./configure $(EXTRA_CONFIG)
+	cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) FORCE_UNSAFE_CONFIGURE=1
 	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
 	cd $(DIR_APP) && make $(EXTRA_INSTALL) install
 	@rm -rf $(DIR_APP)
diff --git a/lfs/tcpdump b/lfs/tcpdump
index 6fe6f98ecf..646250d2df 100644
--- a/lfs/tcpdump
+++ b/lfs/tcpdump
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2015  Michael Tremer & Christian Schmidt                      #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 4.6.2
+VER        = 4.7.4
 
 THISAPP    = tcpdump-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = tcpdump
-PAK_VER    = 4
+PAK_VER    = 6
 
 DEPS       = ""
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 74d0d3728b3cdc60db872d842e7f1598
+$(DL_FILE)_MD5 = 58af728de36f499341918fc4b8e827c3
 
 install : $(TARGET)
 
diff --git a/lfs/tmux b/lfs/tmux
index ddd53847d2..2223d13308 100644
--- a/lfs/tmux
+++ b/lfs/tmux
@@ -32,9 +32,9 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = tmux
-PAK_VER    = 2
+PAK_VER    = 3
 
-DEPS       = "libevent2"
+DEPS       = ""
 
 ###############################################################################
 # Top-level Rules
diff --git a/lfs/tor b/lfs/tor
index 0cc2957ed9..91eab09b9f 100644
--- a/lfs/tor
+++ b/lfs/tor
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.2.4.23
+VER        = 0.2.6.9
 
 THISAPP    = tor-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -32,9 +32,9 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = tor
-PAK_VER    = 8
+PAK_VER    = 15
 
-DEPS       = "libevent2"
+DEPS       = ""
 
 ###############################################################################
 # Top-level Rules
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 9e39928e310612c3bffee727f554c63f
+$(DL_FILE)_MD5 = 4a1b334c30d7b37ea72fa33425220d5d
 
 install : $(TARGET)
 
diff --git a/lfs/transmission b/lfs/transmission
index 3a1cbddba6..13b5723456 100644
--- a/lfs/transmission
+++ b/lfs/transmission
@@ -32,9 +32,9 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = transmission
-PAK_VER    = 11
+PAK_VER    = 12
 
-DEPS       = "libevent2"
+DEPS       = ""
 
 CXXFLAGS  += -fno-exceptions
 
diff --git a/lfs/tzdata b/lfs/tzdata
index 11dc03f3d0..dfb54e6639 100644
--- a/lfs/tzdata
+++ b/lfs/tzdata
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2015a
+VER        = 2015d
 TZDATA_VER = $(VER)
 TZCODE_VER = $(VER)
 
@@ -45,8 +45,8 @@ objects = tzdata$(TZDATA_VER).tar.gz tzcode$(TZCODE_VER).tar.gz
 tzdata$(TZDATA_VER).tar.gz = $(DL_FROM)/tzdata$(TZDATA_VER).tar.gz
 tzcode$(TZCODE_VER).tar.gz = $(DL_FROM)/tzcode$(TZCODE_VER).tar.gz
 
-tzdata$(TZDATA_VER).tar.gz_MD5 = 4ed11c894a74a5ea64201b1c6dbb8831
-tzcode$(TZCODE_VER).tar.gz_MD5 = 8f375ede46ae137fbac047ac431bda37
+tzdata$(TZDATA_VER).tar.gz_MD5 = b595bdc4474b8fc1a15cffc67c66025b
+tzcode$(TZCODE_VER).tar.gz_MD5 = 4008a3abc025a398697b2587c48258b9
 
 install : $(TARGET)
 
diff --git a/lfs/udev b/lfs/udev
index 15dae817b2..7d5bdbca19 100644
--- a/lfs/udev
+++ b/lfs/udev
@@ -93,9 +93,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	rm -f /lib/udev/rules.d/75-persistent-net-generator.rules
 	rm -f /lib/udev/rules.d/80-net-name-slot.rules
 
-	# Create rule file for the setup
-	touch /etc/udev/rules.d/30-persistent-network.rules
-
 	# Blacklist some modules
 	cp -vf $(DIR_SRC)/config/udev/blacklist.conf /etc/modprobe.d/blacklist.conf
 
@@ -107,6 +104,14 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	install -v -m 644 $(DIR_SRC)/config/udev/25-alsa.rules \
 		/lib/udev/rules.d
 
+	# Install network rules.
+	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-rename \
+		/lib/udev/network-hotplug-rename
+	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-vlan \
+		/lib/udev/network-hotplug-vlan
+	install -v -m 644 $(DIR_SRC)/config/udev/60-net.rules \
+		/lib/udev/rules.d
+
 	# Install hwrng rules.
 	install -v -m 644 $(DIR_SRC)/config/udev/90-hwrng.rules \
 		/lib/udev/rules.d
diff --git a/lfs/unzip b/lfs/unzip
index 2013cc1327..f479d7e9f9 100644
--- a/lfs/unzip
+++ b/lfs/unzip
@@ -70,11 +70,11 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
-ifeq "$(MACHINE_TYPE)" "arm"
-	# ARM cannot use the x86 assembly code.
-	cd $(DIR_APP) && make -f unix/Makefile LOCAL_UNZIP=-D_FILE_OFFSET_BITS=64 linux_noasm
-else
+ifeq "$(MACHINE)" "i586"
 	cd $(DIR_APP) && make -f unix/Makefile LOCAL_UNZIP=-D_FILE_OFFSET_BITS=64 linux
+else
+	# ARM/x86_64 cannot use the x86 32 bit assembly code.
+	cd $(DIR_APP) && make -f unix/Makefile LOCAL_UNZIP=-D_FILE_OFFSET_BITS=64 linux_noasm
 endif
 	cd $(DIR_APP) && make prefix=/usr install
 	@rm -rf $(DIR_APP)
diff --git a/lfs/vdr_epgsearch b/lfs/vdr_epgsearch
index 509efb1bcc..e621670497 100644
--- a/lfs/vdr_epgsearch
+++ b/lfs/vdr_epgsearch
@@ -38,6 +38,10 @@ DEPS       = ""
 
 VDRPLUGVER = 2.0.0
 
+EXTRA_FLAGS= -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
+CFLAGS    += $(EXTRA_FLAGS)
+CXXFLAGS  += $(EXTRA_FLAGS)
+
 ###############################################################################
 # Top-level Rules
 ###############################################################################
@@ -82,6 +86,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && patch -p1 < $(DIR_SRC)/src/patches/vdr-epgsearch-1.0.1.beta3-paths.patch
 
 	cd $(DIR_APP) && make $(MAKE_TUNING) LIBDIR=. VDRDIR=/usr/lib/vdr \
+		CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)" \
 		LOCALEDIR=$$(pwd)/locale all
 
 	cd $(DIR_APP) && install -m 755 libvdr-conflictcheckonly.so \
diff --git a/lfs/vsftpd b/lfs/vsftpd
index f3e74a00e1..7284be9615 100644
--- a/lfs/vsftpd
+++ b/lfs/vsftpd
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = vsftpd
-PAK_VER    = 7
+PAK_VER    = 8
 
 DEPS       = ""
 
diff --git a/lfs/web-user-interface b/lfs/web-user-interface
new file mode 100644
index 0000000000..919acbe76d
--- /dev/null
+++ b/lfs/web-user-interface
@@ -0,0 +1,72 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2015   IPFire Team  <info@ipfire.org>                    #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VER        = ipfire
+
+THISAPP    = web-user-interface-$(VER)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+TARGET     = $(DIR_INFO)/$(THISAPP)
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+install: $(TARGET)
+
+check: 
+
+download:
+
+md5: 
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+
+	# Copy all html/cgi-bin files
+	mkdir -p /srv/web/ipfire/{cgi-bin,html}
+	mkdir -p /var/updatecache/{download,metadata}
+	cp -aR $(DIR_SRC)/html/* /srv/web/ipfire
+
+	# Change CONFIG_ROOT in cgi-scripts
+	for i in /srv/web/ipfire/cgi-bin/{*,logs.cgi/*,vpn.cgi/*}; do \
+	    if [ -f $$i ]; then \
+	        sed -i "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" $$i; \
+	    fi; \
+	done
+	chown -R root:root /srv/web/ipfire
+	chmod -R 755 /srv/web/ipfire/cgi-bin
+	chmod -R 644 /srv/web/ipfire/html
+	chmod 755 /srv/web/ipfire/html /srv/web/ipfire/html/{index.cgi,redirect.cgi,dial.cgi,images,include,themes,themes/*,themes/*/*}
+	ln -svf ipfire /srv/web/ipfire/html/themes/ipfire-rounded
+
+	# Reset permissions of redirect templates and theme directories
+	find /srv/web/ipfire/html/{redirect-templates,themes} -type d | xargs chmod -v 755
+	@$(POSTBUILD)
diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant
index 1cebaabb3a..e7f46de9aa 100644
--- a/lfs/wpa_supplicant
+++ b/lfs/wpa_supplicant
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.3
+VER        = 2.4
 
 THISAPP    = wpa_supplicant-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = f2ed8fef72cf63d8d446a2d0a6da630a
+$(DL_FILE)_MD5 = f0037dbe03897dcaf2ad2722e659095d
 
 install : $(TARGET)
 
diff --git a/lfs/xtables-addons b/lfs/xtables-addons
new file mode 100644
index 0000000000..1848dc9088
--- /dev/null
+++ b/lfs/xtables-addons
@@ -0,0 +1,110 @@
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007-2014  IPFire Team <info@ipfire.org>                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+VERSUFIX = ipfire$(KCFG)
+MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/extra/
+
+VER        = 2.6
+
+THISAPP    = xtables-addons-$(VER)
+DL_FILE    = $(THISAPP).tar.xz
+DL_FROM    = $(URL_IPFIRE)
+DIR_APP    = $(DIR_SRC)/$(THISAPP)
+
+ifeq "$(USPACE)" "1"
+  TARGET = $(DIR_INFO)/$(THISAPP)
+else
+  TARGET = $(DIR_INFO)/$(THISAPP)-kmod-$(KVER)-$(VERSUFIX)
+endif
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_MD5 = 087835ba7e564481b6fd398692268340
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+md5 : $(subst %,%_MD5,$(objects))
+
+dist: 
+	$(PAK)
+
+###############################################################################
+# Downloading, checking, md5sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+	@$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+	@$(LOAD)
+
+$(subst %,%_MD5,$(objects)) :
+	@$(MD5)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+	@$(PREBUILD)
+	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+
+	# Only build the specified modules.
+	cp -avf $(DIR_SRC)/config/xtables-addons/mconfig \
+		$(DIR_APP)/mconfig
+
+# Check if we build the modules for a kernel or the userspace parts.
+ifeq "$(USPACE)" "1"
+	cd $(DIR_APP) && ./configure \
+		--prefix=/usr \
+		--without-kbuild
+
+	cd $(DIR_APP) && make $(MAKETUNING)
+	cd $(DIR_APP) && make install
+else
+	cd $(DIR_APP) && ./configure \
+		--with-kbuild=/usr/src/linux-$(KVER)/
+
+	cd $(DIR_APP) && make $(MAKETUNING)
+
+	# Install the built kernel modules.
+	cd $(DIR_APP) && for f in $$(ls extensions/*.ko); do \
+		install -m 644 $$f $(MODPATH); \
+	done
+endif
+
+	@rm -rf $(DIR_APP)
+	@$(POSTBUILD)
diff --git a/lfs/xz b/lfs/xz
index fce71598b3..c1d3ef7890 100644
--- a/lfs/xz
+++ b/lfs/xz
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.0.5
+VER        = 5.2.1
 
 THISAPP    = xz-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = aa17280f4521dbeebed0fbd11cd7fa30
+$(DL_FILE)_MD5 = b5e2dd95dc8498cea5354377ed89aa65
 
 install : $(TARGET)
 
diff --git a/make.sh b/make.sh
index d049888155..ed902c9cc5 100755
--- a/make.sh
+++ b/make.sh
@@ -17,7 +17,7 @@
 # along with IPFire; if not, write to the Free Software                    #
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
 #                                                                          #
-# Copyright (C) 2007-2014 IPFire Team <info@ipfire.org>.                   #
+# Copyright (C) 2007-2015 IPFire Team <info@ipfire.org>.                   #
 #                                                                          #
 ############################################################################
 #
@@ -25,8 +25,8 @@
 NAME="IPFire"							# Software name
 SNAME="ipfire"							# Short name
 VERSION="2.17"							# Version number
-CORE="88"							# Core Level (Filename)
-PAKFIRE_CORE="88"						# Core Level (PAKFIRE)
+CORE="95"							# Core Level (Filename)
+PAKFIRE_CORE="94"						# Core Level (PAKFIRE)
 GIT_BRANCH=`git rev-parse --abbrev-ref HEAD`			# Git Branch
 SLOGAN="www.ipfire.org"						# Software slogan
 CONFIG_ROOT=/var/ipfire						# Configuration rootdir
@@ -36,7 +36,7 @@ BUILD_IMAGES=1							# Flash and Xen Downloader
 KVER=`grep --max-count=1 VER lfs/linux | awk '{ print $3 }'`
 GIT_TAG=$(git tag | tail -1)					# Git Tag
 GIT_LASTCOMMIT=$(git log | head -n1 | cut -d" " -f2 |head -c8)	# Last commit
-TOOLCHAINVER=8
+TOOLCHAINVER=10
 
 # New architecture variables
 BUILD_ARCH="$(uname -m)"
@@ -86,21 +86,6 @@ if [ -z $EDITOR ]; then
 	[ -z $EDITOR ] && exiterror "You should have installed an editor."
 fi
 
-# Prepare string for /etc/system-release.
-SYSTEM_RELEASE="${NAME} ${VERSION} (${MACHINE})"
-if [ "$(git status -s | wc -l)" == "0" ]; then
-	GIT_STATUS=""
-else
-	GIT_STATUS="-dirty"
-fi
-case "$GIT_BRANCH" in
-	core*|beta?|rc?)
-		SYSTEM_RELEASE="${SYSTEM_RELEASE} - $GIT_BRANCH$GIT_STATUS"
-		;;
-	*)
-		SYSTEM_RELEASE="${SYSTEM_RELEASE} - Development Build: $GIT_BRANCH/$GIT_LASTCOMMIT$GIT_STATUS"
-		;;
-esac
 
 prepareenv() {
     ############################################################################
@@ -236,15 +221,36 @@ prepareenv() {
     # Run LFS static binary creation scripts one by one
     export CCACHE_DIR=$BASEDIR/ccache
     export CCACHE_COMPRESS=1
-    export CCACHE_COMPILERCHECK="none"
+    export CCACHE_COMPILERCHECK="string:toolchain-${TOOLCHAINVER}:${TARGET_ARCH}"
 
     # Remove pre-install list of installed files in case user erase some files before rebuild
     rm -f $BASEDIR/build/usr/src/lsalr 2>/dev/null
+
+    # Prepare string for /etc/system-release.
+    SYSTEM_RELEASE="${NAME} ${VERSION} (${MACHINE})"
+    if [ "$(git status -s | wc -l)" == "0" ]; then
+	GIT_STATUS=""
+    else
+	GIT_STATUS="-dirty"
+    fi
+    case "$GIT_BRANCH" in
+	core*|beta?|rc?)
+		SYSTEM_RELEASE="${SYSTEM_RELEASE} - $GIT_BRANCH$GIT_STATUS"
+		;;
+	*)
+		SYSTEM_RELEASE="${SYSTEM_RELEASE} - Development Build: $GIT_BRANCH/$GIT_LASTCOMMIT$GIT_STATUS"
+		;;
+    esac
 }
 
 buildtoolchain() {
     local error=false
     case "${TARGET_ARCH}:${BUILD_ARCH}" in
+        # x86_64
+        x86_64:x86_64)
+             # This is working.
+             ;;
+
         # x86
         i586:i586|i586:i686|i586:x86_64)
             # These are working.
@@ -383,8 +389,9 @@ buildipfire() {
   export LOGFILE
   ipfiremake configroot
   ipfiremake backup
+  ipfiremake pkg-config
   ipfiremake libusb
-  ipfiremake libusbx
+  ipfiremake libusb-compat
   ipfiremake libpcap
   ipfiremake ppp
   ipfiremake pptp
@@ -403,8 +410,25 @@ buildipfire() {
   ipfiremake multipath-tools
   ipfiremake freetype
   ipfiremake grub
+  ipfiremake libmnl
+  ipfiremake libnfnetlink
+  ipfiremake libnetfilter_queue
+  ipfiremake libnetfilter_conntrack
+  ipfiremake libnetfilter_cthelper
+  ipfiremake libnetfilter_cttimeout
+  ipfiremake iptables
 
   case "${TARGET_ARCH}" in
+	x86_64)
+		ipfiremake linux			KCFG=""
+		ipfiremake backports			KCFG=""
+		ipfiremake cryptodev			KCFG=""
+		ipfiremake e1000e			KCFG=""
+		ipfiremake igb				KCFG=""
+		ipfiremake ixgbe			KCFG=""
+		ipfiremake xtables-addons		KCFG=""
+		ipfiremake linux-initrd			KCFG=""
+		;;
 	i586)
 		# x86-pae (Native and new XEN) kernel build
 		ipfiremake linux			KCFG="-pae"
@@ -413,6 +437,7 @@ buildipfire() {
 		ipfiremake e1000e			KCFG="-pae"
 		ipfiremake igb				KCFG="-pae"
 		ipfiremake ixgbe			KCFG="-pae"
+		ipfiremake xtables-addons		KCFG="-pae"
 		ipfiremake linux-initrd			KCFG="-pae"
 
 		# x86 kernel build
@@ -422,6 +447,7 @@ buildipfire() {
 		ipfiremake e1000e			KCFG=""
 		ipfiremake igb				KCFG=""
 		ipfiremake ixgbe			KCFG=""
+		ipfiremake xtables-addons		KCFG=""
 		ipfiremake linux-initrd			KCFG=""
 		;;
 
@@ -430,6 +456,7 @@ buildipfire() {
 		ipfiremake linux			KCFG="-rpi"
 		ipfiremake backports			KCFG="-rpi"
 		ipfiremake cryptodev			KCFG="-rpi"
+		ipfiremake xtables-addons		KCFG="-rpi"
 		ipfiremake linux-initrd			KCFG="-rpi"
 
 		# arm multi platform (Panda, Wandboard ...) kernel build
@@ -439,6 +466,7 @@ buildipfire() {
 		ipfiremake e1000e			KCFG="-multi"
 		ipfiremake igb				KCFG="-multi"
 		ipfiremake ixgbe			KCFG="-multi"
+		ipfiremake xtables-addons		KCFG="-multi"
 		ipfiremake linux-initrd			KCFG="-multi"
 
 		# arm-kirkwood (Dreamplug, ICY-Box ...) kernel build
@@ -448,12 +476,13 @@ buildipfire() {
 		ipfiremake e1000e			KCFG="-kirkwood"
 		ipfiremake igb				KCFG="-kirkwood"
 		ipfiremake ixgbe			KCFG="-kirkwood"
+		ipfiremake xtables-addons		KCFG="-kirkwood"
 		ipfiremake linux-initrd			KCFG="-kirkwood"
 		;;
   esac
-  ipfiremake pkg-config
+  ipfiremake xtables-addons			USPACE="1"
   ipfiremake openssl
-  ipfiremake openssl-compat
+  [ "${TARGET_ARCH}" = "i586" ] && ipfiremake openssl KCFG='-sse2'
   ipfiremake libgpg-error
   ipfiremake libgcrypt
   ipfiremake libassuan
@@ -468,7 +497,9 @@ buildipfire() {
   ipfiremake curl
   ipfiremake tcl
   ipfiremake sqlite
+  ipfiremake libffi
   ipfiremake python
+  ipfiremake ca-certificates
   ipfiremake fireinfo
   ipfiremake libnet
   ipfiremake libnl
@@ -499,7 +530,8 @@ buildipfire() {
   ipfiremake openldap
   ipfiremake apache2
   ipfiremake php
-  ipfiremake apache2			PASS=C
+  ipfiremake web-user-interface
+  ipfiremake flag-icons
   ipfiremake jquery
   ipfiremake arping
   ipfiremake beep
@@ -526,8 +558,6 @@ buildipfire() {
   ipfiremake mtools
   ipfiremake initscripts
   ipfiremake whatmask
-  ipfiremake libmnl
-  ipfiremake iptables
   ipfiremake conntrack-tools
   ipfiremake libupnp
   ipfiremake ipaddr
@@ -572,7 +602,6 @@ buildipfire() {
   ipfiremake python-mechanize
   ipfiremake python-feedparser
   ipfiremake python-rssdler
-  ipfiremake libffi
   ipfiremake glib
   ipfiremake GeoIP
   ipfiremake fwhits
@@ -620,6 +649,7 @@ buildipfire() {
   ipfiremake screen
   ipfiremake smartmontools
   ipfiremake htop
+  ipfiremake chkconfig
   ipfiremake postfix
   ipfiremake fetchmail
   ipfiremake cyrus-imapd
@@ -627,6 +657,7 @@ buildipfire() {
   ipfiremake clamav
   ipfiremake spamassassin
   ipfiremake amavisd
+  ipfiremake dma
   ipfiremake alsa
   ipfiremake mpfire
   ipfiremake guardian
@@ -641,6 +672,7 @@ buildipfire() {
   ipfiremake libshout
   ipfiremake xvid
   ipfiremake libmpeg2
+  ipfiremake libarchive
   ipfiremake cmake
   ipfiremake gnump3d
   ipfiremake rsync
@@ -695,6 +727,11 @@ buildipfire() {
   ipfiremake mpd
   ipfiremake libmpdclient
   ipfiremake mpc
+  ipfiremake perl-Net-SMTP-SSL
+  ipfiremake perl-MIME-Base64
+  ipfiremake perl-Authen-SASL
+  ipfiremake perl-MIME-Lite
+  ipfiremake perl-Email-Date-Format
   ipfiremake git
   ipfiremake squidclamav
   ipfiremake vnstat
@@ -810,6 +847,7 @@ buildipfire() {
   ipfiremake squid-accounting
   ipfiremake pigz
   ipfiremake tmux
+  ipfiremake perl-Text-CSV_XS
   ipfiremake swconfig
   ipfiremake haproxy
 }
@@ -868,6 +906,10 @@ buildpackages() {
   mv $LFS/install/images/*.bz2 $BASEDIR >> $LOGFILE 2>&1
 
   cd $BASEDIR
+
+  # remove not useable iso on armv5tel (needed to build flash images)
+  [ "${TARGET_ARCH}" = "armv5tel" ] && rm -rf *.iso
+
   for i in `ls *.bz2 *.img.gz *.iso`; do
 	md5sum $i > $i.md5
   done
@@ -971,7 +1013,7 @@ build)
 
 	cd $BASEDIR
 	tools/checknewlog.pl
-	tools/checkwronginitlinks
+	tools/checkrootfiles
 	cd $PWD
 
 	beautify build_end
diff --git a/src/initscripts/init.d/dnsmasq b/src/initscripts/init.d/dnsmasq
index b033e2b4c8..059ffacdd8 100644
--- a/src/initscripts/init.d/dnsmasq
+++ b/src/initscripts/init.d/dnsmasq
@@ -15,18 +15,19 @@
 . /etc/sysconfig/rc
 . ${rc_functions}
 
-# Pull custom configuration file
-if [ -e "/etc/sysconfig/dnsmasq" ]; then
-	. /etc/sysconfig/dnsmasq
-fi
-
 CACHE_SIZE=2500
 ENABLE_DNSSEC=1
 SHOW_SRV=1
 TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
+TIMESTAMP_FILE="/var/ipfire/dns/dnssec-timestamp"
+
+# Pull custom configuration file
+if [ -e "/etc/sysconfig/dnsmasq" ]; then
+	. /etc/sysconfig/dnsmasq
+fi
 
 function dnssec_args() {
-	local cmdline="--dnssec --dnssec-timestamp"
+	local cmdline="--dnssec --dnssec-timestamp ${TIMESTAMP_FILE}"
 
 	if [ -n "${TRUST_ANCHOR}" ]; then
 		cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}"
diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index c383652e0b..2d462d786d 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -115,6 +115,11 @@ iptables_init() {
 	iptables -A INPUT -j GUARDIAN
 	iptables -A FORWARD -j GUARDIAN
 
+	# Block non-established IPsec networks
+	iptables -N IPSECBLOCK
+	iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK
+	iptables -A OUTPUT  -m policy --dir out --pol none -j IPSECBLOCK
+
 	# Block OpenVPN transfer networks
 	iptables -N OVPNBLOCK
 	iptables -A INPUT   -i tun+ -j OVPNBLOCK
@@ -179,6 +184,11 @@ iptables_init() {
 		iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
 	fi
 
+	# GeoIP block
+	iptables -N GEOIPBLOCK
+	iptables -A INPUT -j GEOIPBLOCK
+	iptables -A FORWARD -j GEOIPBLOCK
+
 	# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 	iptables -N IPSECINPUT
 	iptables -N IPSECFORWARD
@@ -265,6 +275,9 @@ iptables_init() {
 	iptables -t nat -N REDNAT
 	iptables -t nat -A POSTROUTING -j REDNAT
 
+	# Populate IPsec block chain
+	/usr/lib/firewall/ipsec-block
+
 	# Apply OpenVPN firewall rules
 	/usr/local/bin/openvpnctrl --firewall-rules
 
diff --git a/src/initscripts/init.d/firstsetup b/src/initscripts/init.d/firstsetup
index dca3e40163..70c30b4e23 100644
--- a/src/initscripts/init.d/firstsetup
+++ b/src/initscripts/init.d/firstsetup
@@ -40,9 +40,6 @@ if [ ! "$(grep "^flags.* pae " /proc/cpuinfo)" == "" ]; then
 		echo "Name: linux-pae" > /opt/pakfire/db/installed/meta-linux-pae
 		echo "ProgVersion: 0" >> /opt/pakfire/db/installed/meta-linux-pae
 		echo "Release: 0"     >> /opt/pakfire/db/installed/meta-linux-pae
-		echo "Name: linux-pae" > /opt/pakfire/db/meta/meta-linux-pae
-		echo "ProgVersion: 0" >> /opt/pakfire/db/meta/meta-linux-pae
-		echo "Release: 0"     >> /opt/pakfire/db/meta/meta-linux-pae
 	fi
 fi
 
diff --git a/src/initscripts/init.d/hostapd b/src/initscripts/init.d/hostapd
index 1e7cec4809..209f969def 100644
--- a/src/initscripts/init.d/hostapd
+++ b/src/initscripts/init.d/hostapd
@@ -2,7 +2,7 @@
 . /etc/sysconfig/rc
 . ${rc_functions}
 
-CHANNEL="05"
+CHANNEL="6"
 COUNTRY="00"
 TXPOWER="auto"
 INTERFACE="blue0"
@@ -38,9 +38,6 @@ case "${1}" in
 		if [ -e "/sys/class/net/$INTERFACE/phy80211" ]; then
 			DRIVER="NL80211"
 			driver="nl80211"
-		elif [ -e "/sys/class/net/$INTERFACE/madwifi_name_type" ]; then
-			DRIVER="MADWIFI"
-			driver="madwifi"
 		elif [ "$(/bin/grep hostap /sys/class/net/$INTERFACE/uevent)" != "" ]; then
 			DRIVER="HOSTAP"
 			driver="hostap"
@@ -60,14 +57,7 @@ case "${1}" in
 		chmod 644 /var/ipfire/wlanap/settings.tmp
 		mv /var/ipfire/wlanap/settings.tmp /var/ipfire/wlanap/settings
 
-		if [ "$DRIVER" == "MADWIFI" ]; then
-			if [ "$(/usr/sbin/iwconfig $INTERFACE | /bin/grep "Mode:Master")" == "" ]; then
-				boot_mesg "Setting MADWIFI wlan $INTERFACE to Master mode... "
-				# Set Atheros Cards to master mode
-				/usr/bin/wlanconfig $INTERFACE destroy > /dev/null
-				/usr/bin/wlanconfig $INTERFACE create wlandev wifi0 wlanmode ap > /dev/null
-			fi
-		elif [ "$DRIVER" == "HOSTAP" ]; then
+		if [ "$DRIVER" == "HOSTAP" ]; then
 			if [ "$(/usr/sbin/iwconfig $INTERFACE | /bin/grep "Mode:Master")" == "" ]; then
 				boot_mesg "Setting HOSTAP wlan $INTERFACE to Master mode... "
 				# Set Prism Cards to master mode
@@ -87,23 +77,7 @@ case "${1}" in
 
 		/usr/bin/hostapd -P /var/run/hostapd /etc/hostapd.conf >/dev/null 2>&1 &
 
-		sleep 2
-
-		if [ $DRIVER == "MADWIFI" ]; then
-			iwpriv $INTERFACE maccmd 3
-			if [ $MACMODE != 0 ]; then
-				FILE="/var/ipfire/wlanap/macfile"
-				exec < $FILE
-				while read LINE
-				do
-					iwpriv $INTERFACE addmac $LINE
-				done
-
-				iwpriv $INTERFACE maccmd $MACMODE
-			fi
-		fi
-
-		sleep 2
+		sleep 3
 
 		if [ "$(/usr/sbin/iwconfig $INTERFACE | /bin/grep "Mode:Master")" == "" ]; then
 			killproc /usr/bin/hostapd > /dev/null 2>&1
diff --git a/src/initscripts/init.d/network-trigger b/src/initscripts/init.d/network-trigger
new file mode 100644
index 0000000000..0d9de45c6b
--- /dev/null
+++ b/src/initscripts/init.d/network-trigger
@@ -0,0 +1,22 @@
+#!/bin/sh
+########################################################################
+# Begin $rc_base/init.d/network-trigger
+########################################################################
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+case "${1}" in
+	start)
+		boot_mesg "Triggering network devices..."
+		udevadm trigger --action="add" --subsystem-match="net"
+		evaluate_retval
+		;;
+
+	*)
+		echo "Usage: ${0} {start}"
+		exit 1
+		;;
+esac
+
+# End $rc_base/init.d/network-trigger
diff --git a/src/initscripts/init.d/networking/functions.network b/src/initscripts/init.d/networking/functions.network
index f459b77759..1af3482df4 100644
--- a/src/initscripts/init.d/networking/functions.network
+++ b/src/initscripts/init.d/networking/functions.network
@@ -75,7 +75,7 @@ dhcpcd_start() {
 	fi
 
 	# Start dhcpcd.
-	/sbin/dhcpcd "${device}" "${dhcp_start}" >/dev/null 2>&1
+	/sbin/dhcpcd ${dhcp_start} ${device} >/dev/null 2>&1
 	ret="$?"
 
 	if [ "${ret}" -eq 0 ]; then
@@ -124,7 +124,7 @@ dhcpcd_stop() {
 	fi
 
 	# Stop dhcpcd.
-	/sbin/dhcpcd "${device}" "${dhcp_stop}" &> /dev/null
+	/sbin/dhcpcd ${dhcp_stop} ${device} &> /dev/null
 	ret="$?"
 
 	# Wait until dhcpd has stopped.
diff --git a/src/initscripts/init.d/networking/red b/src/initscripts/init.d/networking/red
index e0c66b6724..9dfbad65ed 100644
--- a/src/initscripts/init.d/networking/red
+++ b/src/initscripts/init.d/networking/red
@@ -173,7 +173,7 @@ case "${1}" in
 			if [ "$TYPE" == "pppoeatm" ] || [ "$TYPE" == "pptpatm" ]; then
 				PPP_NIC=nas${ATM_DEV}
 				DEVICE=nas${ATM_DEV}
-				boot_mesg "Createing ATM-Bridge as $PPP_NIC ..."
+				boot_mesg "Creating ATM-Bridge as $PPP_NIC ..."
 				br2684ctl -c${ATM_DEV} -e${ENCAP} -a${ATM_DEV}.${VPI}.${VCI} >/dev/null 2>&1 &
 				sleep 1
 
@@ -193,7 +193,7 @@ case "${1}" in
 			fi
 
 			if [ "$TYPE" == "vdsl" ]; then
-				boot_mesg "Createing VLAN Interface ${DEVICE}.${INET_VLAN} ..."
+				boot_mesg "Creating VLAN Interface ${DEVICE}.${INET_VLAN} ..."
 				modprobe 8021q
 				vconfig add ${DEVICE} ${INET_VLAN}
 				if [ -n "$MAC1" ]; then
@@ -218,7 +218,7 @@ case "${1}" in
 				fi
 
 				if [ ! -f "$PIDFILE" ]; then
-					boot_mesg "Createing VLAN Interface ${DEVICE}.${IPTV_VLAN} ..."
+					boot_mesg "Creating VLAN Interface ${DEVICE}.${IPTV_VLAN} ..."
 					modprobe 8021q
 					vconfig add ${DEVICE} ${IPTV_VLAN}
 					if [ -n "$MAC2" ]; then
diff --git a/src/initscripts/init.d/networking/red.up/99-geoip-database b/src/initscripts/init.d/networking/red.up/99-geoip-database
new file mode 100644
index 0000000000..4bd3ee2ab7
--- /dev/null
+++ b/src/initscripts/init.d/networking/red.up/99-geoip-database
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# Get the GeoIP database if no one exists yet.
+
+DIR="/usr/share/xt_geoip/*"
+
+found=false
+
+# Check if the directory contains any data.
+for i in $DIR; do
+	# Ignore "." and ".."
+	if [ -d "$i" ]; then
+        	found=true
+        	break
+	fi
+done
+
+# Download ruleset if none has been found.
+if ! ${found}; then
+	/usr/local/bin/xt_geoip_update >/dev/null 2>&1
+fi
+
+exit 0
diff --git a/src/initscripts/init.d/nfs-server b/src/initscripts/init.d/nfs-server
index 397722c1c2..15284e88a3 100644
--- a/src/initscripts/init.d/nfs-server
+++ b/src/initscripts/init.d/nfs-server
@@ -27,13 +27,9 @@ case "$1" in
 			loadproc /usr/sbin/rpc.rquotad
 		fi
 
-		# NFSD support only in 2.6 kernel
-		/bin/uname -r | /bin/grep "2.6" 2>&1 > /dev/null
-		if [ $? = 0 ]; then
-			boot_mesg "Mounting nfsd virtual filesystem..."
-			/bin/mount -t nfsd none /proc/fs/nfsd 2>&1 > /dev/null
-			evaluate_retval
-		fi
+		boot_mesg "Mounting nfsd virtual filesystem..."
+		/bin/mount -t nfsd none /proc/fs/nfsd 2>&1 > /dev/null
+		evaluate_retval
 
 		# Make ceratin that the list is refreshed on
 		# a restart.
@@ -62,13 +58,9 @@ case "$1" in
 		/usr/sbin/exportfs -au 2>&1 > /dev/null
 		evaluate_retval
 
-		# NFSD support only in 2.6 kernel
-                /bin/uname -r | /bin/grep "2.6" 2>&1 > /dev/null
-                if [ $? = 0 ]; then
-			boot_mesg "Unmounting NFS Virtual Filesystem..."
-			/bin/umount /proc/fs/nfsd 2>&1 > /dev/null
-			evaluate_retval
-		fi
+		boot_mesg "Unmounting NFS Virtual Filesystem..."
+		/bin/umount /proc/fs/nfsd 2>&1 > /dev/null
+		evaluate_retval
 
 		# Remove a pid file that isn't done automatically
 		boot_mesg "Removing the rpc.statd pid file if it exists"
diff --git a/src/initscripts/init.d/snort b/src/initscripts/init.d/snort
index 42968d8da1..e03c80fea9 100644
--- a/src/initscripts/init.d/snort
+++ b/src/initscripts/init.d/snort
@@ -74,7 +74,7 @@ case "$1" in
 
                 for DEVICE in $DEVICES; do
                         boot_mesg "Starting Intrusion Detection System on $DEVICE..."
-                        /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run/
+                        /usr/sbin/snort -c /etc/snort/snort.conf -i $DEVICE -D -l /var/log/snort --create-pidfile --nolock-pidfile --pid-path /var/run
                         evaluate_retval
 			sleep 1
                         chmod 644 /var/run/snort_$DEVICE.pid
diff --git a/src/initscripts/init.d/sshd b/src/initscripts/init.d/sshd
index 0ed8661653..7b4092d38d 100644
--- a/src/initscripts/init.d/sshd
+++ b/src/initscripts/init.d/sshd
@@ -12,24 +12,12 @@
 
 case "$1" in
     start)
-	if [ ! -e "/etc/ssh/ssh_host_key" ]; then
-		boot_mesg "Generating SSH host key..."
-		ssh-keygen -qf /etc/ssh/ssh_host_key -N '' -t rsa1
-		evaluate_retval
-	fi
-
-	for algo in rsa dsa ecdsa ed25519; do
+	for algo in rsa ecdsa ed25519; do
 		keyfile="/etc/ssh/ssh_host_${algo}_key"
 
 		# If the key already exists, there is nothing to do.
 		[ -e "${keyfile}" ] && continue
 
-		case "${algo}" in
-			rsa)
-				algo="rsa1"
-				;;
-		esac
-
 		boot_mesg "Generating SSH key (${algo})..."
 		ssh-keygen -qf "${keyfile}" -N '' -t ${algo}
 		evaluate_retval
diff --git a/src/initscripts/sysconfig/createfiles b/src/initscripts/sysconfig/createfiles
index 8d1f89dc65..cf7d6e1469 100644
--- a/src/initscripts/sysconfig/createfiles
+++ b/src/initscripts/sysconfig/createfiles
@@ -25,4 +25,7 @@
 # 		<major> and <minor> are the major and minor numbers used for the device.
 ########################################################################
 
+/var/run/ovpnserver.log	file	644	nobody	nobody
+/var/run/openvpn	dir	644	nobody	nobody
+
 # End /etc/sysconfig/createfiles
diff --git a/src/installer/main.c b/src/installer/main.c
index 358b2c46ff..c420de3a18 100644
--- a/src/installer/main.c
+++ b/src/installer/main.c
@@ -271,6 +271,7 @@ static struct lang {
 static struct config {
 	int unattended;
 	int serial_console;
+	int novga;
 	int require_networking;
 	int perform_download;
 	int disable_swap;
@@ -280,6 +281,7 @@ static struct config {
 } config = {
 	.unattended = 0,
 	.serial_console = 0,
+	.novga = 0,
 	.require_networking = 0,
 	.perform_download = 0,
 	.disable_swap = 0,
@@ -309,6 +311,10 @@ static void parse_command_line(struct config* c) {
 			if ((strcmp(key, "console") == 0) && (strncmp(val, "ttyS", 4) == 0))
 				c->serial_console = 1;
 
+			// novga
+			else if (strcmp(key, "novga") == 0)
+				c->novga = 1;
+
 			// enable networking?
 			else if (strcmp(token, "installer.net") == 0)
 				c->require_networking = 1;
@@ -825,6 +831,19 @@ int main(int argc, char *argv[]) {
 		replace("/harddisk/etc/inittab", "#7:2345:respawn:", "7:2345:respawn:");
 	}
 
+	/* novga */
+	if (config.novga) {
+		/* grub */
+		FILE* f = fopen(DESTINATION_MOUNT_PATH "/etc/default/grub", "a");
+		if (!f) {
+			errorbox(_("Unable to open /etc/default/grub for writing."));
+			goto EXIT;
+		}
+
+		fprintf(f, "GRUB_GFXMODE=\"none\"\n");
+		fclose(f);
+	}
+
 	rc = hw_install_bootloader(destination, logfile);
 	if (rc) {
 		errorbox(_("Unable to install the bootloader."));
@@ -833,8 +852,11 @@ int main(int argc, char *argv[]) {
 
 	newtPopWindow();
 
-	/* Set marker that the user has already accepted the gpl */
-	mysystem(logfile, "/usr/bin/touch /harddisk/var/ipfire/main/gpl_accepted");
+	/* Set marker that the user has already accepted the GPL if the license has been shown
+	 * in the installation process. In unatteded mode, the user will be presented the
+	 * license when he or she logs on to the web user interface for the first time. */
+	if (!config.unattended)
+		mysystem(logfile, "/usr/bin/touch /harddisk/var/ipfire/main/gpl_accepted");
 
 	/* Copy restore file from cdrom */
 	char* backup_file = hw_find_backup_file(logfile, SOURCE_MOUNT_PATH);
diff --git a/src/installer/po/pt_BR.po b/src/installer/po/pt_BR.po
index 4a5d137a6e..e78c1b4521 100644
--- a/src/installer/po/pt_BR.po
+++ b/src/installer/po/pt_BR.po
@@ -6,13 +6,14 @@
 # AndrÃ© Felipe Morro <andre@andremorro.com>, 2014
 # Evertton de Lima <e.everttonlima@gmail.com>, 2015
 # Leandro Luquetti Basilio da Silva <leandroluquetti@gmail.com>, 2014
+# MoisÃ©s Bites Borges de Castro <moisesbites@gmail.com>, 2015
 msgid ""
 msgstr ""
 "Project-Id-Version: IPFire Project\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2014-11-05 01:29+0000\n"
-"PO-Revision-Date: 2015-02-16 23:04+0000\n"
-"Last-Translator: Evertton de Lima <e.everttonlima@gmail.com>\n"
+"PO-Revision-Date: 2015-03-24 21:30+0000\n"
+"Last-Translator: MoisÃ©s Bites Borges de Castro <moisesbites@gmail.com>\n"
 "Language-Team: Portuguese (Brazil) (http://www.transifex.com/projects/p/ipfire/language/pt_BR/)\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -76,13 +77,13 @@ msgid ""
 "No source drive could be found.\n"
 "\n"
 "You can try downloading the required installation image."
-msgstr ""
+msgstr "Nenhum Drive de origem foi encontrado.\n\nVocÃª pode tentar baixar a imagem da instalaÃ§Ã£o solicitada. "
 
 #: main.c:456
 msgid ""
 "Please make sure to connect your machine to a network and the installer will"
 " try connect to acquire an IP address."
-msgstr ""
+msgstr "Por favor certifique que sua mÃ¡quina estÃ¡ conectada com uma rede e o instalador irÃ¡ tentar conectar para pegar um endereÃ§o IP;"
 
 #: main.c:460
 msgid "Download installation image"
@@ -110,7 +111,7 @@ msgstr "Baixando imagem de instalaÃ§Ã£o..."
 #: main.c:510
 #, c-format
 msgid "MD5 checksum mismatch"
-msgstr ""
+msgstr "Assinatura MD5 incompatÃvel"
 
 #: main.c:513
 #, c-format
@@ -301,15 +302,15 @@ msgstr "NÃ£o"
 
 #: main.c:834
 msgid "An error occured when the backup file was restored."
-msgstr "Um erro ocorreu enquanto a cÃ³pia de seguranÃ§a foi restaurada."
+msgstr "Um erro ocorreu enquanto a cÃ³pia de seguranÃ§a era restaurada."
 
 #: main.c:869
 msgid "Running post-install script..."
-msgstr "Executando post-install script..."
+msgstr "Executando script pÃ³s instalaÃ§Ã£o..."
 
 #: main.c:870
 msgid "Post-install script failed."
-msgstr "Post-install script falhou."
+msgstr "Script de pÃ³s instalaÃ§Ã£o falhou."
 
 #: main.c:877
 #, c-format
@@ -317,7 +318,7 @@ msgid ""
 "%s was successfully installed!\n"
 "\n"
 "Please remove any installation mediums from this system and hit the reboot button. Once the system has restarted you will be asked to setup networking and system passwords. After that, you should point your web browser at https://%s:444 (or what ever you name your %s) for the web configuration console."
-msgstr ""
+msgstr "%s estÃ¡ instalado com sucesso!\n\nPor favor, remova qualquer mÃdia de instalaÃ§Ã£o desse sistema e o reinicie. Assim que o sistema for reiniciado vocÃª serÃ¡ solicitado a configurar a rede e especificar as senhas de sistema. ApÃ³s isso, vocÃª deve  apontar seu navegador para https://%s:444 (ou use nome de %s) para a pÃ¡gina de configuraÃ§Ã£o web."
 
 #: main.c:882
 msgid "Congratulations!"
diff --git a/src/misc-progs/Makefile b/src/misc-progs/Makefile
index f5802d26ac..e4bf049728 100644
--- a/src/misc-progs/Makefile
+++ b/src/misc-progs/Makefile
@@ -25,13 +25,13 @@ LIBS    = -lsmooth -lnewt
 PROGS = iowrap
 SUID_PROGS = squidctrl sshctrl ipfirereboot \
 	ipsecctrl timectrl dhcpctrl snortctrl \
-	applejuicectrl rebuildhosts backupctrl \
+	applejuicectrl rebuildhosts backupctrl collectdctrl \
 	logwatch openvpnctrl firewallctrl \
 	wirelessctrl getipstat qosctrl launch-ether-wake \
 	redctrl syslogdctrl extrahdctrl sambactrl upnpctrl tripwirectrl \
 	smartctrl clamavctrl addonctrl pakfire mpfirectrl wlanapctrl \
 	setaliases urlfilterctrl updxlratorctrl fireinfoctrl rebuildroutes \
-	getconntracktable wirelessclient dnsmasqctrl torctrl
+	getconntracktable wirelessclient dnsmasqctrl torctrl ddnsctrl
 SUID_UPDX = updxsetperms
 
 OBJS = $(patsubst %,%.o,$(PROGS) $(SUID_PROGS))
diff --git a/src/misc-progs/collectdctrl.c b/src/misc-progs/collectdctrl.c
new file mode 100644
index 0000000000..86e4b2a99b
--- /dev/null
+++ b/src/misc-progs/collectdctrl.c
@@ -0,0 +1,39 @@
+/* This file is part of the IPFire Firewall.
+ *
+ * This program is distributed under the terms of the GNU General Public
+ * Licence.  See the file COPYING for details.
+ *
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include "setuid.h"
+
+int main(int argc, char *argv[]) {
+	if (!(initsetuid()))
+		exit(1);
+
+	if (argc < 2) {
+		fprintf(stderr, "\nNo argument given.\n\ncollectdctrl (start|stop|restart)\n\n");
+		exit(1);
+	}
+
+	if (strcmp(argv[1], "restart") == 0) {
+		safe_system("/etc/rc.d/init.d/collectd restart");
+
+	} else if (strcmp(argv[1], "stop") == 0) {
+		safe_system("/etc/rc.d/init.d/collectd stop");
+
+	} else if (strcmp(argv[1], "start") == 0) {
+		safe_system("/etc/rc.d/init.d/collectd start");
+
+	} else {
+		fprintf(stderr, "\nBad argument given.\n\ncollectdctrl (start|stop|restart)\n\n");
+		exit(1);
+	}
+
+	return 0;
+}
diff --git a/src/misc-progs/ddnsctrl.c b/src/misc-progs/ddnsctrl.c
new file mode 100644
index 0000000000..7c41033222
--- /dev/null
+++ b/src/misc-progs/ddnsctrl.c
@@ -0,0 +1,37 @@
+/* This file is part of the IPFire Firewall.
+*
+* This program is distributed under the terms of the GNU General Public
+* Licence.  See the file COPYING for details.
+*
+*/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "setuid.h"
+
+const char *conffile = "/var/ipfire/ddns/ddns.conf";
+
+int main(int argc, char *argv[]) {
+	char cmd[STRING_SIZE];
+
+        if (!(initsetuid()))
+                exit(1);
+
+        if (argc < 2) {
+                fprintf(stderr, "\nNo argument given.\n\nddnsctrl (update-all)\n\n");
+                exit(1);
+        }
+
+	if (strcmp(argv[1], "update-all") == 0) {
+		snprintf(cmd, sizeof(cmd), "/usr/bin/ddns --config %s update-all >/dev/null 2>&1", conffile);
+		safe_system(cmd);
+	} else {
+                fprintf(stderr, "\nBad argument given.\n\nddnsctrl (update-all)\n\n");
+                exit(1);
+        }
+
+        return 0;
+}
diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c
index eb3fc4984f..7499e94c9a 100644
--- a/src/misc-progs/ipsecctrl.c
+++ b/src/misc-progs/ipsecctrl.c
@@ -58,36 +58,26 @@ static void ipsec_reload() {
 void open_physical (char *interface, int nat_traversal_port) {
         char str[STRING_SIZE];
 
-        // GRE ???
-//        sprintf(str, "/sbin/iptables -A " phystable " -p 47  -i %s -j ACCEPT", interface);
-//        safe_system(str);
-        // ESP
-//        sprintf(str, "/sbin/iptables -A " phystable " -p 50  -i %s -j ACCEPT", interface);
-//        safe_system(str);
-        // AH
-//        sprintf(str, "/sbin/iptables -A " phystable " -p 51  -i %s -j ACCEPT", interface);
-//        safe_system(str);
         // IKE
-
-        sprintf(str, "/sbin/iptables -D IPSECINPUT -p udp -i %s --dport 500 -j ACCEPT >/dev/null 2>&1", interface);
+        sprintf(str, "/sbin/iptables --wait -D IPSECINPUT -p udp -i %s --dport 500 -j ACCEPT >/dev/null 2>&1", interface);
         safe_system(str);
-        sprintf(str, "/sbin/iptables -A IPSECINPUT -p udp -i %s --dport 500 -j ACCEPT", interface);
+        sprintf(str, "/sbin/iptables --wait -A IPSECINPUT -p udp -i %s --dport 500 -j ACCEPT", interface);
         safe_system(str);
 
         if (! nat_traversal_port) 
             return;
 
-        sprintf(str, "/sbin/iptables -D IPSECINPUT -p udp -i %s --dport %i -j ACCEPT >/dev/null 2>&1", interface, nat_traversal_port);
+        sprintf(str, "/sbin/iptables --wait -D IPSECINPUT -p udp -i %s --dport %i -j ACCEPT >/dev/null 2>&1", interface, nat_traversal_port);
         safe_system(str);
-        sprintf(str, "/sbin/iptables -A IPSECINPUT -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port);
+        sprintf(str, "/sbin/iptables --wait -A IPSECINPUT -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port);
         safe_system(str);
 }
 
 void ipsec_norules() {
         /* clear input rules */
-        safe_system("/sbin/iptables -F IPSECINPUT");
-        safe_system("/sbin/iptables -F IPSECFORWARD");
-        safe_system("/sbin/iptables -F IPSECOUTPUT");
+        safe_system("/sbin/iptables --wait -F IPSECINPUT");
+        safe_system("/sbin/iptables --wait -F IPSECFORWARD");
+        safe_system("/sbin/iptables --wait -F IPSECOUTPUT");
 }
 
 /*
@@ -154,6 +144,9 @@ void turn_connection_on(char *name, char *type) {
                 "/usr/sbin/ipsec down %s >/dev/null", name);
         safe_system(command);
 
+	// Reload the IPsec block chain
+	safe_system("/usr/lib/firewall/ipsec-block >/dev/null");
+
 	// Reload the configuration into the daemon (#10339).
 	ipsec_reload();
 
@@ -312,6 +305,7 @@ int main(int argc, char *argv[]) {
 
         // start the system
         if ((argc == 2) && strcmp(argv[1], "S") == 0) {
+		safe_system("/usr/lib/firewall/ipsec-block >/dev/null");
 		safe_system("/usr/sbin/ipsec restart >/dev/null");
                 exit(0);
         }
diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c
index d20cced774..20967e471c 100644
--- a/src/misc-progs/openvpnctrl.c
+++ b/src/misc-progs/openvpnctrl.c
@@ -1,3 +1,4 @@
+#define _XOPEN_SOURCE 500
 #include <signal.h>
 #include <stdio.h>
 #include <string.h>
@@ -7,6 +8,7 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <fcntl.h>
+#include <ftw.h>
 #include "setuid.h"
 #include "netutil.h"
 #include "libsmooth.h"
@@ -44,6 +46,18 @@ struct connection_struct {
 
 typedef struct connection_struct connection;
 
+static int recursive_remove_callback(const char* fpath, const struct stat* sb, int typeflag, struct FTW* ftwbuf) {
+	int rv = remove(fpath);
+	if (rv)
+		perror(fpath);
+
+	return rv;
+}
+
+static int recursive_remove(const char* path) {
+	return nftw(path, recursive_remove_callback, 64, FTW_DEPTH | FTW_PHYS);
+}
+
 void exithandler(void)
 {
 	if(kv)
@@ -537,6 +551,7 @@ int startNet2Net(char *name) {
 int killNet2Net(char *name) {
 	connection *conn = NULL;
 	connection *conn_iter;
+	int rc = 0;
 
 	conn_iter = getConnections();
 
@@ -569,26 +584,40 @@ int killNet2Net(char *name) {
 	snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
 	executeCommand(command);
 
+	char runfile[STRING_SIZE];
+	snprintf(runfile, STRING_SIZE - 1, "/var/run/openvpn/%s-n2n", conn->name);
+	rc = recursive_remove(runfile);
+	if (rc)
+		perror(runfile);
+
 	return 0;
 }
 
 int deleterrd(char *name) {
+	char rrd_dir[STRING_SIZE];
+
 	connection *conn = getConnections();
+	while(conn) {
+		if (strcmp(conn->name, name) != 0) {
+			conn = conn->next;
+			continue;
+		}
 
-	char rrd_file[STRING_SIZE];
-	snprintf(rrd_file, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s/if_octets.rrd", name);
+		// Handle RW connections
+		if (strcmp(conn->type, "host") == 0) {
+			snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s/", name);
 
-	char rrd_dir[STRING_SIZE];
-	snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s", name);
+		// Handle N2N connections
+		} else if (strcmp(conn->type, "net") == 0) {
+			snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s-n2n/", name);
 
-	while(conn) {
-		/* Find only RW-Connections with the given name. */
-		if (((strcmp(conn->type, "host") == 0) && (strcmp(conn->name, name) == 0))) {
-			remove(rrd_file);
-			remove(rrd_dir);
-			return 0;
+		// Unhandled connection type
+		} else {
+			conn = conn->next;
+			continue;
 		}
-		conn = conn->next;
+
+		return recursive_remove(rrd_dir);
 	}
 
 	return 1;
diff --git a/src/misc-progs/rebuildhosts.c b/src/misc-progs/rebuildhosts.c
index 21c523600c..f77c2dfb53 100644
--- a/src/misc-progs/rebuildhosts.c
+++ b/src/misc-progs/rebuildhosts.c
@@ -79,18 +79,13 @@ int main(int argc, char *argv[])
 	freekeyvalues(kv);
 	kv = NULL;
 
-	if (!(gw = fopen(CONFIG_ROOT "/red/remote-ipaddress", "r")))
-	{
+	if ((gw = fopen(CONFIG_ROOT "/red/remote-ipaddress", "r"))) {
+		if (fgets(gateway, STRING_SIZE, gw) == NULL) {
+			fprintf(stderr, "Couldn't read remote-ipaddress\n");
+			exit(1);
+		}
+	} else {
 		fprintf(stderr, "Couldn't open remote-ipaddress file\n");
-		fclose(gw);
-		gw = NULL;
-		exit(1);
-	}
-
-	if (fgets(gateway, STRING_SIZE, gw) == NULL)
-	{
-		fprintf(stderr, "Couldn't read remote-ipaddress\n");
-		exit(1);
 	}
 
 	if (!(fd = fopen(CONFIG_ROOT "/main/hosts", "r")))
@@ -112,7 +107,8 @@ int main(int argc, char *argv[])
 	else
 		fprintf(hosts, "%s\t%s\n",address,hostname);
 
-	fprintf(hosts, "%s\tgateway\n",gateway);
+	if (strlen(gateway) > 0)
+		fprintf(hosts, "%s\tgateway\n", gateway);
 
 	while (fgets(buffer, STRING_SIZE, fd))
 	{
diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl
index d14e0314da..96f8d144a9 100644
--- a/src/pakfire/lib/functions.pl
+++ b/src/pakfire/lib/functions.pl
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2007-2015   IPFire Team   <info@ipfire.org>                   #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -393,6 +393,7 @@ sub dbgetlist {
 	foreach $file (@files) {
 		next if ( $file eq "." );
 		next if ( $file eq ".." );
+		next if ( $file eq "meta-" );
 		next if ( $file =~ /^old/ );
 		open(FILE, "<$Conf::dbdir/meta/$file");
 		@meta = <FILE>;
@@ -589,6 +590,25 @@ sub resolvedeps {
 	return @all;
 }
 
+sub resolvedeps_recursive {
+	my @packages = @_;
+	my @result = ();
+
+	foreach my $pkg (@packages) {
+		my @deps = &Pakfire::resolvedeps($pkg);
+
+		foreach my $dep (@deps) {
+			push(@result, $dep);
+		}
+	}
+
+	# Sort the result array and remove dupes
+	my %sort = map{ $_, 1 } @result;
+	@result = keys %sort;
+
+	return @result;
+}
+
 sub cleanup {
 	my $dir = shift;
 	my $path;
@@ -695,7 +715,7 @@ sub getpak {
 	}
 	
 	unless ($file) {
-		message("No filename given in meta-file. Please phone the developers.");
+		message("No filename given in meta-file.");
 		exit 1;
 	}
 	
@@ -870,6 +890,7 @@ sub checkcryptodb {
 	unless ( "$ret" eq "0" ) {
 		message("CRYPTO WARN: The GnuPG isn't configured corectly. Trying now to fix this.");
 		message("CRYPTO WARN: It's normal to see this on first execution.");
+		message("CRYPTO WARN: If this message is being shown repeatedly, check if time and date are set correctly, and if IPFire can connect via port 11371 TCP.");
 		my $command = "gpg --keyserver pgp.ipfire.org --always-trust --status-fd 2";
 		system("$command --recv-key $myid >> $Conf::logdir/gnupg-database.log 2>&1");
 		system("$command --recv-key $trustid >> $Conf::logdir/gnupg-database.log 2>&1");
diff --git a/src/pakfire/pakfire b/src/pakfire/pakfire
index 3d0270aa41..da68454dc6 100644
--- a/src/pakfire/pakfire
+++ b/src/pakfire/pakfire
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2007-2015   IPFire Team   <info@ipfire.org>                   #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -255,14 +255,12 @@
 	} elsif ("$ARGV[0]" eq "upgrade") {
 		&Pakfire::upgradecore();
 		my @upgradepaks = &Pakfire::dblist("upgrade", "noweb");
-		my @temp, $pak;
-		
-		foreach (@upgradepaks) {
-			@temp = &Pakfire::resolvedeps("$_");
-			foreach (@temp) { push(@upgradepaks,$_) if $_; }
-		}
-		
+		my @deps = ();
+
 		if (@upgradepaks) {
+			# Resolve the dependencies of the to be upgraded packages
+			@deps = &Pakfire::resolvedeps_recursive(@upgradepaks);
+
 			&Pakfire::message("");
 			&Pakfire::message("PAKFIRE UPGR: We are going to install all packages listed above.");
 			if ($interactive) {
@@ -277,16 +275,24 @@
 			}
 		}
 		
-		### Download first
+		# Download packages
 		foreach $pak (@upgradepaks) {
-			#system("mv $Conf::dbdir/meta/meta-$pak $Conf::dbdir/meta/old-meta-$pak");
 			&Pakfire::getpak("$pak", "");
 		}
-		
+
+		# Download dependencies
+		foreach $pak (@deps) {
+			&Pakfire::getpak("$pak", "");
+		}
+
+		# Install dependencies first
+		foreach $pak (@deps) {
+			&Pakfire::setuppak("$pak");
+		}
+
+		# Install all upgrades
 		foreach $pak (@upgradepaks) {
-			if (&Pakfire::upgradepak("$pak")) {
-				#system("mv $Conf::dbdir/meta/old-meta-$pak $Conf::dbdir/meta/meta-$pak");
-			}
+			&Pakfire::upgradepak("$pak");
 		}
 		
 	} elsif ("$ARGV[0]" eq "list") {
diff --git a/src/paks/cyrus-imapd/uninstall.sh b/src/paks/cyrus-imapd/uninstall.sh
index 0d2109eb9e..e34fa5698f 100644
--- a/src/paks/cyrus-imapd/uninstall.sh
+++ b/src/paks/cyrus-imapd/uninstall.sh
@@ -22,6 +22,7 @@
 ############################################################################
 #
 . /opt/pakfire/lib/functions.sh
+extract_backup_includes
 stop_service ${NAME}
 make_backup ${NAME}
 remove_files
diff --git a/src/paks/haproxy/install.sh b/src/paks/haproxy/install.sh
new file mode 100644
index 0000000000..45b2161b18
--- /dev/null
+++ b/src/paks/haproxy/install.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 2 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2007 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+extract_files
+
+# Enable autostart
+ln -sf  ../init.d/haproxy /etc/rc.d/rc0.d/K25haproxy
+ln -sf  ../init.d/haproxy /etc/rc.d/rc3.d/S35haproxy
+ln -sf  ../init.d/haproxy /etc/rc.d/rc6.d/K25haproxy
diff --git a/src/paks/haproxy/uninstall.sh b/src/paks/haproxy/uninstall.sh
new file mode 100644
index 0000000000..b01ee1147e
--- /dev/null
+++ b/src/paks/haproxy/uninstall.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 2 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2007 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+remove_files
+rm -rfv /etc/rc.d/rc*.d/*haproxy
diff --git a/src/paks/net-snmp/update.sh b/src/paks/haproxy/update.sh
similarity index 100%
rename from src/paks/net-snmp/update.sh
rename to src/paks/haproxy/update.sh
diff --git a/src/paks/linux-pae/install.sh b/src/paks/linux-pae/install.sh
index c980a0136b..4ebb38bf2a 100644
--- a/src/paks/linux-pae/install.sh
+++ b/src/paks/linux-pae/install.sh
@@ -45,7 +45,7 @@ function find_partition() {
 extract_files
 #
 KVER=xxxKVERxxx
-
+ROOT=`find_partition /`
 #
 # Create new module depency
 #
@@ -55,29 +55,24 @@ depmod -a $KVER-ipfire-pae
 #
 /usr/bin/dracut --force --xz /boot/initramfs-$KVER-ipfire-pae.img $KVER-ipfire-pae  
 
-
-ROOT="$(find_partition "/")"
-case $ROOT in
-	xvd* )
-		#
-		# We are on XEN so create new grub.conf / menu.lst for pygrub
-		#
-		echo "timeout 10"                          > /boot/grub/grub.conf
-		echo "default 0"                          >> /boot/grub/grub.conf
-		echo "title IPFire (pae-kernel)"          >> /boot/grub/grub.conf
-		echo "  kernel /vmlinuz-$KVER-ipfire-pae root=/dev/$ROOT rootdelay=10 panic=10 console=hvc0" \
-							  >> /boot/grub/grub.conf
-		echo "  initrd /initramfs-$KVER-ipfire-pae.img" >> /boot/grub/grub.conf
-		echo "# savedefault 0"			  >> /boot/grub/grub.conf
-		ln -s grub.conf $MNThdd/boot/grub/menu.lst
-		;;
-	* )
-		#
-		# Update grub2 config
-		#
-		grub-mkconfig > /boot/grub/grub.cfg
-		;;
-esac
+if [ -e /boot/grub/grub.cfg ]; then
+	#
+	# Update grub2 config
+	#
+	grub-mkconfig > /boot/grub/grub.cfg
+else
+	#
+	# xen pv with pygrub need grub.conf / menu.lst
+	#
+	echo "timeout 10"                          > /boot/grub/grub.conf
+	echo "default 0"                          >> /boot/grub/grub.conf
+	echo "title IPFire (pae-kernel)"          >> /boot/grub/grub.conf
+	echo "  kernel /vmlinuz-$KVER-ipfire-pae root=/dev/$ROOT rootdelay=10 panic=10 console=hvc0" \
+						  >> /boot/grub/grub.conf
+	echo "  initrd /initramfs-$KVER-ipfire-pae.img" >> /boot/grub/grub.conf
+	echo "# savedefault 0"			  >> /boot/grub/grub.conf
+	ln -s grub.conf $MNThdd/boot/grub/menu.lst
+fi
 
 # request a reboot if pae is supported
 if [ ! "$(grep "^flags.* pae " /proc/cpuinfo)" == "" ]; then
diff --git a/src/paks/net-snmp/install.sh b/src/paks/netsnmpd/install.sh
similarity index 100%
rename from src/paks/net-snmp/install.sh
rename to src/paks/netsnmpd/install.sh
diff --git a/src/paks/net-snmp/uninstall.sh b/src/paks/netsnmpd/uninstall.sh
similarity index 98%
rename from src/paks/net-snmp/uninstall.sh
rename to src/paks/netsnmpd/uninstall.sh
index a7b8a5370f..278218b260 100644
--- a/src/paks/net-snmp/uninstall.sh
+++ b/src/paks/netsnmpd/uninstall.sh
@@ -22,6 +22,7 @@
 ############################################################################
 #
 . /opt/pakfire/lib/functions.sh
+extract_backup_includes
 stop_service ${NAME}
 make_backup ${NAME}
 remove_files
diff --git a/src/paks/netsnmpd/update.sh b/src/paks/netsnmpd/update.sh
new file mode 100644
index 0000000000..89c40d0d7c
--- /dev/null
+++ b/src/paks/netsnmpd/update.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 2 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2007 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+./uninstall.sh
+./install.sh
diff --git a/src/paks/postfix/install.sh b/src/paks/postfix/install.sh
index 56c23e2c26..1629d21c18 100644
--- a/src/paks/postfix/install.sh
+++ b/src/paks/postfix/install.sh
@@ -23,12 +23,17 @@
 #
 . /opt/pakfire/lib/functions.sh
 extract_files
+restore_backup ${NAME}
 postalias /etc/aliases
 # Set postfix's hostname
 postconf -e "myhostname=$(hostname -f)"
-/etc/init.d/postfix start
+
+start_service ${NAME}
 
 # Enable autostart for postfix
 ln -sf  ../init.d/postfix /etc/rc.d/rc0.d/K25postfix
 ln -sf  ../init.d/postfix /etc/rc.d/rc3.d/S35postfix
 ln -sf  ../init.d/postfix /etc/rc.d/rc6.d/K25postfix
+
+# Update alternatives
+/usr/sbin/alternatives --install /usr/sbin/sendmail sendmail /usr/sbin/sendmail.postfix 15
diff --git a/src/paks/postfix/uninstall.sh b/src/paks/postfix/uninstall.sh
index 39f1ef969c..bff411a91d 100644
--- a/src/paks/postfix/uninstall.sh
+++ b/src/paks/postfix/uninstall.sh
@@ -22,5 +22,9 @@
 ############################################################################
 #
 . /opt/pakfire/lib/functions.sh
+extract_backup_includes
+stop_service ${NAME}
+make_backup ${NAME}
+/usr/sbin/alternatives --remove sendmail /usr/sbin/sendmail.postfix
 remove_files
 rm -rfv /etc/rc.d/rc*.d/*postfix
diff --git a/src/patches/Python-2.7.9-gdbm-1.patch b/src/patches/Python-2.7.9-gdbm-1.patch
new file mode 100644
index 0000000000..c72b452776
--- /dev/null
+++ b/src/patches/Python-2.7.9-gdbm-1.patch
@@ -0,0 +1,21 @@
+diff -Naur Python-2.7-org/setup.py Python-2.7/setup.py
+--- Python-2.7-org/setup.py	2010-06-27 14:36:16.000000000 +0200
++++ Python-2.7/setup.py	2010-07-13 22:23:04.000000000 +0200
+@@ -1125,7 +1125,7 @@
+                                                                'ndbm'):
+                             ndbm_libs = ['ndbm']
+                         else:
+-                            ndbm_libs = []
++                            ndbm_libs = ['gdbm', 'gdbm_compat' ]
+                         print "building dbm using ndbm"
+                         dbmext = Extension('dbm', ['dbmmodule.c'],
+                                            define_macros=[
+@@ -1140,7 +1140,7 @@
+                         if self.compiler.find_library_file(lib_dirs,
+                                                                'gdbm_compat'):
+                             gdbm_libs.append('gdbm_compat')
+-                        if find_file("gdbm/ndbm.h", inc_dirs, []) is not None:
++                        if find_file("ndbm.h", inc_dirs, []) is not None:
+                             print "building dbm using gdbm"
+                             dbmext = Extension(
+                                 'dbm', ['dbmmodule.c'],
diff --git a/src/patches/backports-3.18.1-1_no_dma_sgtable_on_x86_64.patch b/src/patches/backports-3.18.1-1_no_dma_sgtable_on_x86_64.patch
new file mode 100644
index 0000000000..5a2d04e7ce
--- /dev/null
+++ b/src/patches/backports-3.18.1-1_no_dma_sgtable_on_x86_64.patch
@@ -0,0 +1,26 @@
+diff -Naur backports-4.1.1-1.org/compat/dma-shared-helpers.c backports-4.1.1-1/compat/dma-shared-helpers.c
+--- backports-4.1.1-1.org/compat/dma-shared-helpers.c	2015-07-01 23:10:37.000000000 +0200
++++ backports-4.1.1-1/compat/dma-shared-helpers.c	2015-09-25 13:29:14.006762269 +0200
+@@ -20,22 +20,3 @@
+ #endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(3,6,0) */
+ #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0) */
+ 
+-#if RHEL_RELEASE_CODE < RHEL_RELEASE_VERSION(7,0)
+-/*
+- * Create scatter-list for the already allocated DMA buffer.
+- */
+-int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+-		 void *cpu_addr, dma_addr_t handle, size_t size)
+-{
+-	struct page *page = virt_to_page(cpu_addr);
+-	int ret;
+-
+-	ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
+-	if (unlikely(ret))
+-		return ret;
+-
+-	sg_set_page(sgt->sgl, page, PAGE_ALIGN(size), 0);
+-	return 0;
+-}
+-EXPORT_SYMBOL_GPL(dma_common_get_sgtable);
+-#endif /* RHEL_RELEASE_CODE < RHEL_RELEASE_VERSION(7,0) */
diff --git a/src/patches/backports-3.18.1-1_rt2x00usb_suppress_queue_warnings.patch b/src/patches/backports-3.18.1-1_rt2x00usb_suppress_queue_warnings.patch
new file mode 100644
index 0000000000..3f9308e38f
--- /dev/null
+++ b/src/patches/backports-3.18.1-1_rt2x00usb_suppress_queue_warnings.patch
@@ -0,0 +1,42 @@
+diff -Naur backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2800usb.c backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2800usb.c
+--- backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2800usb.c	2014-12-21 22:37:14.000000000 +0100
++++ backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2800usb.c	2015-04-07 11:44:16.647963570 +0200
+@@ -444,7 +444,7 @@
+ 
+ 	rt2x00usb_register_read(rt2x00dev, TXRXQ_PCNT, ®);
+ 	if (rt2x00_get_field32(reg, TXRXQ_PCNT_TX0Q)) {
+-		rt2x00_warn(rt2x00dev, "TX HW queue 0 timed out, invoke forced kick\n");
++		rt2x00_dbg(rt2x00dev, "TX HW queue 0 timed out, invoke forced kick\n");
+ 
+ 		rt2x00usb_register_write(rt2x00dev, PBF_CFG, 0xf40012);
+ 
+@@ -459,7 +459,7 @@
+ 
+ 	rt2x00usb_register_read(rt2x00dev, TXRXQ_PCNT, ®);
+ 	if (rt2x00_get_field32(reg, TXRXQ_PCNT_TX1Q)) {
+-		rt2x00_warn(rt2x00dev, "TX HW queue 1 timed out, invoke forced kick\n");
++		rt2x00_dbg(rt2x00dev, "TX HW queue 1 timed out, invoke forced kick\n");
+ 
+ 		rt2x00usb_register_write(rt2x00dev, PBF_CFG, 0xf4000a);
+ 
+@@ -609,7 +609,7 @@
+ 
+ 		if (unlikely(test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+ 			     !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))) {
+-			rt2x00_warn(rt2x00dev, "Data pending for entry %u in queue %u\n",
++			rt2x00_dbg(rt2x00dev, "Data pending for entry %u in queue %u\n",
+ 				    entry->entry_idx, qid);
+ 			break;
+ 		}
+diff -Naur backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00usb.c backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00usb.c
+--- backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00usb.c	2014-12-21 22:37:14.000000000 +0100
++++ backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00usb.c	2015-04-07 11:42:41.723492892 +0200
+@@ -524,7 +524,7 @@
+ 
+ static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
+ {
+-	rt2x00_warn(queue->rt2x00dev, "TX queue %d DMA timed out, invoke forced forced reset\n",
++	rt2x00_dbg(queue->rt2x00dev, "TX queue %d DMA timed out, invoke forced reset\n",
+ 		    queue->qid);
+ 
+ 	rt2x00queue_stop_queue(queue);
diff --git a/src/patches/collectd/0022-openvpn-Change-data-type-from-COUNTER-to-DERIVE.patch b/src/patches/collectd/0022-openvpn-Change-data-type-from-COUNTER-to-DERIVE.patch
index ec6819c9fa..0704a6b7f0 100644
--- a/src/patches/collectd/0022-openvpn-Change-data-type-from-COUNTER-to-DERIVE.patch
+++ b/src/patches/collectd/0022-openvpn-Change-data-type-from-COUNTER-to-DERIVE.patch
@@ -61,7 +61,7 @@ index 2db3677..d446e99 100644
  		sstrncpy (vl.plugin_instance, pinst,
  				sizeof (vl.plugin_instance));
 -	sstrncpy (vl.type, "compression", sizeof (vl.type));
-+	sstrncpy (vl.type, "compression_dervice", sizeof (vl.type));
++	sstrncpy (vl.type, "compression_derive", sizeof (vl.type));
  	if (tinst != NULL)
  		sstrncpy (vl.type_instance, tinst, sizeof (vl.type_instance));
  
diff --git a/src/patches/collectd/silence-openvpn-errors.patch b/src/patches/collectd/silence-openvpn-errors.patch
new file mode 100644
index 0000000000..c2584864af
--- /dev/null
+++ b/src/patches/collectd/silence-openvpn-errors.patch
@@ -0,0 +1,64 @@
+diff --git a/src/openvpn.c b/src/openvpn.c
+index d446e9957b68..ef5bf1078285 100644
+--- a/src/openvpn.c
++++ b/src/openvpn.c
+@@ -70,6 +70,7 @@ static const char *config_keys[] =
+ };
+ static int config_keys_num = STATIC_ARRAY_SIZE (config_keys);
+ 
++static int version_detect (const char *filename);
+ 
+ /* Helper function
+  * copy-n-pasted from common.c - changed delim to ","  */
+@@ -540,6 +541,11 @@ static int openvpn_read (void)
+ 			continue;
+ 		}
+ 
++		// If the version was not detected yet, we try to guess again
++		if (vpn_list[i]->version == 0) {
++			vpn_list[i]->version = version_detect(vpn_list[i]->file);
++		}
++
+ 		switch (vpn_list[i]->version)
+ 		{
+ 			case SINGLE:
+@@ -567,7 +573,7 @@ static int openvpn_read (void)
+ 		read += vpn_read;
+ 	}
+ 
+-	return (read ? 0 : -1);
++	return 0;
+ } /* int openvpn_read */
+ 
+ static int version_detect (const char *filename)
+@@ -630,16 +636,6 @@ static int version_detect (const char *filename)
+ 		}
+ 	}
+ 
+-	if (version == 0)
+-	{
+-		/* This is only reached during configuration, so complaining to
+-		 * the user is in order. */
+-		NOTICE ("openvpn plugin: %s: Unknown file format, please "
+-				"report this as bug. Make sure to include "
+-				"your status file, so the plugin can "
+-				"be adapted.", filename);
+-	}
+-
+ 	fclose (fh);
+ 
+ 	return version;
+@@ -656,13 +652,6 @@ static int openvpn_config (const char *key, const char *value)
+ 		/* try to detect the status file format */
+ 		status_version = version_detect (value);
+ 
+-		if (status_version == 0)
+-		{
+-			WARNING ("openvpn plugin: unable to detect status version, \
+-					discarding status file \"%s\".", value);
+-			return (1);
+-		}
+-
+ 		status_file = sstrdup (value);
+ 		if (status_file == NULL)
+ 		{
diff --git a/src/patches/cups-str4609.patch b/src/patches/cups-str4609.patch
new file mode 100644
index 0000000000..2a9761b208
--- /dev/null
+++ b/src/patches/cups-str4609.patch
@@ -0,0 +1,423 @@
+diff -up cups-1.7.5/cgi-bin/ipp-var.c.str4609 cups-1.7.5/cgi-bin/ipp-var.c
+--- cups-1.7.5/cgi-bin/ipp-var.c.str4609	2014-05-22 15:59:21.000000000 +0200
++++ cups-1.7.5/cgi-bin/ipp-var.c	2015-06-10 10:31:45.297965345 +0200
+@@ -1206,21 +1206,7 @@ cgiSetIPPObjectVars(
+ 	      * Rewrite URIs...
+ 	      */
+ 
+-              if (!strcmp(name, "member_uris"))
+-	      {
+-		char	url[1024];	/* URL for class member... */
+-
+-
+-		cgiRewriteURL(attr->values[i].string.text, url,
+-		              sizeof(url), NULL);
+-
+-                snprintf(valptr, sizeof(value) - (valptr - value),
+-		         "<A HREF=\"%s\">%s</A>", url,
+-			 strrchr(attr->values[i].string.text, '/') + 1);
+-	      }
+-	      else
+-		cgiRewriteURL(attr->values[i].string.text, valptr,
+-		              sizeof(value) - (valptr - value), NULL);
++	      cgiRewriteURL(attr->values[i].string.text, valptr, sizeof(value) - (valptr - value), NULL);
+               break;
+             }
+ 
+diff -up cups-1.7.5/cgi-bin/template.c.str4609 cups-1.7.5/cgi-bin/template.c
+--- cups-1.7.5/cgi-bin/template.c.str4609	2014-03-05 22:11:32.000000000 +0100
++++ cups-1.7.5/cgi-bin/template.c	2015-06-10 10:31:45.297965345 +0200
+@@ -659,39 +659,7 @@ cgi_puts(const char *s,			/* I - String
+   while (*s)
+   {
+     if (*s == '<')
+-    {
+-     /*
+-      * Pass <A HREF="url"> and </A>, otherwise quote it...
+-      */
+-
+-      if (!_cups_strncasecmp(s, "<A HREF=\"", 9))
+-      {
+-        fputs("<A HREF=\"", out);
+-	s += 9;
+-
+-	while (*s && *s != '\"')
+-	{
+-          if (*s == '&')
+-            fputs("&", out);
+-	  else
+-	    putc(*s, out);
+-
+-	  s ++;
+-	}
+-
+-        if (*s)
+-	  s ++;
+-
+-	fputs("\">", out);
+-      }
+-      else if (!_cups_strncasecmp(s, "</A>", 4))
+-      {
+-        fputs("</A>", out);
+-	s += 3;
+-      }
+-      else
+-        fputs("<", out);
+-    }
++      fputs("<", out);
+     else if (*s == '>')
+       fputs(">", out);
+     else if (*s == '\"')
+diff -up cups-1.7.5/scheduler/client.c.str4609 cups-1.7.5/scheduler/client.c
+--- cups-1.7.5/scheduler/client.c.str4609	2015-06-10 10:31:45.280965399 +0200
++++ cups-1.7.5/scheduler/client.c	2015-06-10 10:31:45.300965335 +0200
+@@ -598,7 +598,12 @@ cupsdCloseClient(cupsd_client_t *con)	/*
+     httpClearCookie(HTTP(con));
+     httpClearFields(HTTP(con));
+ 
+-    cupsdClearString(&con->filename);
++    if (con->filename)
++    {
++      unlink(con->filename);
++      cupsdClearString(&con->filename);
++    }
++
+     cupsdClearString(&con->command);
+     cupsdClearString(&con->options);
+     cupsdClearString(&con->query_string);
+diff -up cups-1.7.5/scheduler/env.c.str4609 cups-1.7.5/scheduler/env.c
+--- cups-1.7.5/scheduler/env.c.str4609	2015-06-10 10:31:45.208965629 +0200
++++ cups-1.7.5/scheduler/env.c	2015-06-10 10:31:45.300965335 +0200
+@@ -131,6 +131,13 @@ cupsdSetEnv(const char *name,		/* I - Na
+     return;
+ 
+  /*
++  * Do not allow dynamic linker variables when running as root...
++  */
++
++  if (!RunUser && (!strncmp(name, "DYLD_", 5) || !strncmp(name, "LD_", 3)))
++    return;
++
++ /*
+   * See if this variable has already been defined...
+   */
+ 
+diff -up cups-1.7.5/scheduler/ipp.c.str4609 cups-1.7.5/scheduler/ipp.c
+--- cups-1.7.5/scheduler/ipp.c.str4609	2015-06-10 10:31:45.287965377 +0200
++++ cups-1.7.5/scheduler/ipp.c	2015-06-10 10:31:45.299965339 +0200
+@@ -412,8 +412,7 @@ cupsdProcessIPPRequest(
+ 	    * Remote unauthenticated user masquerading as local root...
+ 	    */
+ 
+-	    _cupsStrFree(username->values[0].string.text);
+-	    username->values[0].string.text = _cupsStrAlloc(RemoteRoot);
++            ippSetString(con->request, &username, 0, RemoteRoot);
+ 	  }
+ 	}
+ 
+@@ -1576,7 +1575,7 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+     cupsdSetString(&job->username, con->username);
+ 
+     if (attr)
+-      cupsdSetString(&attr->values[0].string.text, con->username);
++      ippSetString(job->attrs, &attr, 0, con->username);
+   }
+   else if (attr)
+   {
+@@ -1594,9 +1593,8 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+                  "job-originating-user-name", NULL, job->username);
+   else
+   {
+-    attr->group_tag = IPP_TAG_JOB;
+-    _cupsStrFree(attr->name);
+-    attr->name = _cupsStrAlloc("job-originating-user-name");
++    ippSetGroupTag(job->attrs, &attr, IPP_TAG_JOB);
++    ippSetName(job->attrs, &attr, "job-originating-user-name");
+   }
+ 
+   if (con->username[0] || auth_info)
+@@ -1630,48 +1628,11 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+       * Also, we can only have 1 value and it must be a name value.
+       */
+ 
+-      switch (attr->value_tag)
+-      {
+-        case IPP_TAG_STRING :
+-	case IPP_TAG_TEXTLANG :
+-	case IPP_TAG_NAMELANG :
+-	case IPP_TAG_TEXT :
+-	case IPP_TAG_NAME :
+-	case IPP_TAG_KEYWORD :
+-	case IPP_TAG_URI :
+-	case IPP_TAG_URISCHEME :
+-	case IPP_TAG_CHARSET :
+-	case IPP_TAG_LANGUAGE :
+-	case IPP_TAG_MIMETYPE :
+-	   /*
+-	    * Free old strings...
+-	    */
+-
+-	    for (i = 0; i < attr->num_values; i ++)
+-	    {
+-	      _cupsStrFree(attr->values[i].string.text);
+-	      attr->values[i].string.text = NULL;
+-	      if (attr->values[i].string.language)
+-	      {
+-		_cupsStrFree(attr->values[i].string.language);
+-		attr->values[i].string.language = NULL;
+-	      }
+-            }
+-
+-	default :
+-            break;
+-      }
+-
+-     /*
+-      * Use the default connection hostname instead...
+-      */
+-
+-      attr->value_tag             = IPP_TAG_NAME;
+-      attr->num_values            = 1;
+-      attr->values[0].string.text = _cupsStrAlloc(con->http.hostname);
++      ippDeleteAttribute(job->attrs, attr);
++      ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME, "job-originating-host-name", NULL, con->http.hostname);
+     }
+-
+-    attr->group_tag = IPP_TAG_JOB;
++    else
++      ippSetGroupTag(job->attrs, &attr, IPP_TAG_JOB);
+   }
+   else
+   {
+@@ -1767,8 +1728,8 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+ 
+       attr = ippAddStrings(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME, "job-sheets",
+                            2, NULL, NULL);
+-      attr->values[0].string.text = _cupsStrRetain(printer->job_sheets[0]);
+-      attr->values[1].string.text = _cupsStrRetain(printer->job_sheets[1]);
++      ippSetString(job->attrs, &attr, 0, printer->job_sheets[0]);
++      ippSetString(job->attrs, &attr, 1, printer->job_sheets[1]);
+     }
+ 
+     job->job_sheets = attr;
+@@ -1794,7 +1755,7 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+           * Force the leading banner to have the classification on it...
+ 	  */
+ 
+-          cupsdSetString(&attr->values[0].string.text, Classification);
++          ippSetString(job->attrs, &attr, 0, Classification);
+ 
+ 	  cupsdLogJob(job, CUPSD_LOG_NOTICE, "CLASSIFICATION FORCED "
+ 	                		     "job-sheets=\"%s,none\", "
+@@ -1811,7 +1772,7 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+ 	  * Can't put two different security markings on the same document!
+ 	  */
+ 
+-          cupsdSetString(&attr->values[1].string.text, attr->values[0].string.text);
++          ippSetString(job->attrs, &attr, 1, attr->values[0].string.text);
+ 
+ 	  cupsdLogJob(job, CUPSD_LOG_NOTICE, "CLASSIFICATION FORCED "
+ 	                		     "job-sheets=\"%s,%s\", "
+@@ -1851,18 +1812,18 @@ add_job(cupsd_client_t  *con,		/* I - Cl
+         if (attr->num_values > 1 &&
+ 	    !strcmp(attr->values[0].string.text, attr->values[1].string.text))
+ 	{
+-          cupsdSetString(&(attr->values[0].string.text), Classification);
+-          cupsdSetString(&(attr->values[1].string.text), Classification);
++          ippSetString(job->attrs, &attr, 0, Classification);
++          ippSetString(job->attrs, &attr, 1, Classification);
+ 	}
+         else
+ 	{
+           if (attr->num_values == 1 ||
+ 	      strcmp(attr->values[0].string.text, "none"))
+-            cupsdSetString(&(attr->values[0].string.text), Classification);
++            ippSetString(job->attrs, &attr, 0, Classification);
+ 
+           if (attr->num_values > 1 &&
+ 	      strcmp(attr->values[1].string.text, "none"))
+-            cupsdSetString(&(attr->values[1].string.text), Classification);
++	    ippSetString(job->attrs, &attr, 1, Classification);
+         }
+ 
+         if (attr->num_values > 1)
+@@ -3098,8 +3059,8 @@ authenticate_job(cupsd_client_t  *con,	/
+ 
+   if (attr)
+   {
+-    attr->value_tag = IPP_TAG_KEYWORD;
+-    cupsdSetString(&(attr->values[0].string.text), "no-hold");
++    ippSetValueTag(job->attrs, &attr, IPP_TAG_KEYWORD);
++    ippSetString(job->attrs, &attr, 0, "no-hold");
+   }
+ 
+  /*
+@@ -8224,11 +8185,7 @@ print_job(cupsd_client_t  *con,		/* I -
+              filetype->type);
+ 
+     if (format)
+-    {
+-      _cupsStrFree(format->values[0].string.text);
+-
+-      format->values[0].string.text = _cupsStrAlloc(mimetype);
+-    }
++      ippSetString(con->request, &format, 0, mimetype);
+     else
+       ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
+ 	           "document-format", NULL, mimetype);
+@@ -8765,10 +8722,8 @@ release_job(cupsd_client_t  *con,	/* I -
+ 
+   if (attr)
+   {
+-    _cupsStrFree(attr->values[0].string.text);
+-
+-    attr->value_tag = IPP_TAG_KEYWORD;
+-    attr->values[0].string.text = _cupsStrAlloc("no-hold");
++    ippSetValueTag(job->attrs, &attr, IPP_TAG_KEYWORD);
++    ippSetString(job->attrs, &attr, 0, "no-hold");
+ 
+     cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, cupsdFindDest(job->dest), job,
+                   "Job job-hold-until value changed by user.");
+@@ -9461,11 +9416,7 @@ send_document(cupsd_client_t  *con,	/* I
+ 
+     if ((jformat = ippFindAttribute(job->attrs, "document-format",
+                                     IPP_TAG_MIMETYPE)) != NULL)
+-    {
+-      _cupsStrFree(jformat->values[0].string.text);
+-
+-      jformat->values[0].string.text = _cupsStrAlloc(mimetype);
+-    }
++      ippSetString(job->attrs, &jformat, 0, mimetype);
+     else
+       ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
+ 	           "document-format", NULL, mimetype);
+diff -up cups-1.7.5/scheduler/job.c.str4609 cups-1.7.5/scheduler/job.c
+--- cups-1.7.5/scheduler/job.c.str4609	2015-06-10 10:31:45.288965374 +0200
++++ cups-1.7.5/scheduler/job.c	2015-06-10 10:31:45.299965339 +0200
+@@ -375,7 +375,7 @@ cupsdCheckJobs(void)
+ 
+           if ((attr = ippFindAttribute(job->attrs, "job-actual-printer-uri",
+ 	                               IPP_TAG_URI)) != NULL)
+-            cupsdSetString(&attr->values[0].string.text, printer->uri);
++            ippSetString(job->attrs, &attr, 0, printer->uri);
+ 	  else
+ 	    ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_URI,
+ 	                 "job-actual-printer-uri", NULL, printer->uri);
+@@ -2109,7 +2109,7 @@ cupsdMoveJob(cupsd_job_t     *job,	/* I
+ 
+   if ((attr = ippFindAttribute(job->attrs, "job-printer-uri",
+                                IPP_TAG_URI)) != NULL)
+-    cupsdSetString(&(attr->values[0].string.text), p->uri);
++    ippSetString(job->attrs, &attr, 0, p->uri);
+ 
+   cupsdAddEvent(CUPSD_EVENT_JOB_STOPPED, p, job,
+                 "Job #%d moved from %s to %s.", job->id, olddest,
+@@ -2306,7 +2306,7 @@ cupsdSetJobHoldUntil(cupsd_job_t *job,	/
+       attr = ippFindAttribute(job->attrs, "job-hold-until", IPP_TAG_NAME);
+ 
+     if (attr)
+-      cupsdSetString(&(attr->values[0].string.text), when);
++      ippSetString(job->attrs, &attr, 0, when);
+     else
+       attr = ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_KEYWORD,
+                           "job-hold-until", NULL, when);
+@@ -2560,8 +2560,8 @@ cupsdSetJobState(
+ 
+ 	if (attr)
+ 	{
+-	  attr->value_tag = IPP_TAG_KEYWORD;
+-	  cupsdSetString(&(attr->values[0].string.text), "no-hold");
++	  ippSetValueTag(job->attrs, &attr, IPP_TAG_KEYWORD);
++	  ippSetString(job->attrs, &attr, 0, "no-hold");
+ 	}
+ 
+     default :
+@@ -4598,7 +4598,7 @@ start_job(cupsd_job_t     *job,		/* I -
+                                             "job-printer-state-message",
+                                             IPP_TAG_TEXT);
+   if (job->printer_message)
+-    cupsdSetString(&(job->printer_message->values[0].string.text), "");
++    ippSetString(job->attrs, &job->printer_message, 0, "");
+ 
+   ippSetString(job->attrs, &job->reasons, 0, "job-printing");
+   cupsdSetJobState(job, IPP_JOB_PROCESSING, CUPSD_JOB_DEFAULT, NULL);
+@@ -5216,15 +5216,14 @@ update_job_attrs(cupsd_job_t *job,	/* I
+   if (job->state_value != IPP_JOB_PROCESSING &&
+       job->status_level == CUPSD_LOG_INFO)
+   {
+-    cupsdSetString(&(job->printer_message->values[0].string.text), "");
++    ippSetString(job->attrs, &job->printer_message, 0, "");
+ 
+     job->dirty = 1;
+     cupsdMarkDirty(CUPSD_DIRTY_JOBS);
+   }
+   else if (job->printer->state_message[0] && do_message)
+   {
+-    cupsdSetString(&(job->printer_message->values[0].string.text),
+-		   job->printer->state_message);
++    ippSetString(job->attrs, &job->printer_message, 0, job->printer->state_message);
+ 
+     job->dirty = 1;
+     cupsdMarkDirty(CUPSD_DIRTY_JOBS);
+diff -up cups-1.7.5/scheduler/main.c.str4609 cups-1.7.5/scheduler/main.c
+--- cups-1.7.5/scheduler/main.c.str4609	2015-06-10 10:31:45.265965447 +0200
++++ cups-1.7.5/scheduler/main.c	2015-06-10 10:31:45.300965335 +0200
+@@ -1205,8 +1205,8 @@ cupsdAddString(cups_array_t **a,	/* IO -
+   if (!*a)
+     *a = cupsArrayNew3((cups_array_func_t)strcmp, NULL,
+ 		       (cups_ahash_func_t)NULL, 0,
+-		       (cups_acopy_func_t)_cupsStrAlloc,
+-		       (cups_afree_func_t)_cupsStrFree);
++		       (cups_acopy_func_t)strdup,
++		       (cups_afree_func_t)free);
+ 
+   return (cupsArrayAdd(*a, (char *)s));
+ }
+@@ -1236,7 +1236,7 @@ cupsdClearString(char **s)		/* O - Strin
+ {
+   if (s && *s)
+   {
+-    _cupsStrFree(*s);
++    free(*s);
+     *s = NULL;
+   }
+ }
+@@ -1317,10 +1317,10 @@ cupsdSetString(char       **s,		/* O - N
+     return;
+ 
+   if (*s)
+-    _cupsStrFree(*s);
++    free(*s);
+ 
+   if (v)
+-    *s = _cupsStrAlloc(v);
++    *s = strdup(v);
+   else
+     *s = NULL;
+ }
+@@ -1351,13 +1351,13 @@ cupsdSetStringf(char       **s,		/* O -
+     vsnprintf(v, sizeof(v), f, ap);
+     va_end(ap);
+ 
+-    *s = _cupsStrAlloc(v);
++    *s = strdup(v);
+   }
+   else
+     *s = NULL;
+ 
+   if (olds)
+-    _cupsStrFree(olds);
++    free(olds);
+ }
+ 
+ 
+@@ -1804,8 +1804,7 @@ process_children(void)
+ 	    }
+ 
+ 	    if (job->printer_message)
+-	      cupsdSetString(&(job->printer_message->values[0].string.text),
+-			     message);
++	      ippSetString(job->attrs, &job->printer_message, 0, message);
+ 	  }
+ 	}
+ 
diff --git a/src/patches/cyrus-sasl-2.1.22-bad-elif.patch b/src/patches/cyrus-sasl-2.1.22-bad-elif.patch
deleted file mode 100644
index 33550c428d..0000000000
--- a/src/patches/cyrus-sasl-2.1.22-bad-elif.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -up cyrus-sasl-2.1.22/plugins/digestmd5.c.elif cyrus-sasl-2.1.22/plugins/digestmd5.c
---- cyrus-sasl-2.1.22/plugins/digestmd5.c.elif	2009-01-23 09:40:31.000000000 +0100
-+++ cyrus-sasl-2.1.22/plugins/digestmd5.c	2009-02-06 15:20:15.000000000 +0100
-@@ -2743,7 +2743,7 @@ static sasl_server_plug_t digestmd5_serv
- 	"DIGEST-MD5",			/* mech_name */
- #ifdef WITH_RC4
- 	128,				/* max_ssf */
--#elif WITH_DES
-+#elif defined(WITH_DES)
- 	112,
- #else 
- 	1,
-@@ -4071,7 +4071,7 @@ static sasl_client_plug_t digestmd5_clie
- 	"DIGEST-MD5",
- #ifdef WITH_RC4				/* mech_name */
- 	128,				/* max ssf */
--#elif WITH_DES
-+#elif defined(WITH_DES)
- 	112,
- #else
- 	1,
diff --git a/src/patches/ddns/ddns-005-Add-changeip-com.patch b/src/patches/ddns/ddns-005-Add-changeip-com.patch
deleted file mode 100644
index 15bcd468f6..0000000000
--- a/src/patches/ddns/ddns-005-Add-changeip-com.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-commit 78046ffe2187d91c61d6c2f910249b8a5be71b08
-Author: Stefan Schantl <stefan.schantl@ipfire.org>
-Date:   Wed Oct 22 21:39:09 2014 +0200
-
-    Add changeip.com as new provider.
-    
-    Fixes #10639.
-
-diff --git a/README b/README
-index 5944102..6a06f4b 100644
---- a/README
-+++ b/README
-@@ -49,6 +49,7 @@ INSTALLATION:
- 
- SUPPORTED PROVIDERS:
- 	all-inkl.com
-+	changeip.com
- 	dhs.org
- 	dns.lightningwirelabs.com
- 	dnspark.com
-diff --git a/ddns.conf.sample b/ddns.conf.sample
-index d3ac53f..0048a46 100644
---- a/ddns.conf.sample
-+++ b/ddns.conf.sample
-@@ -30,6 +30,11 @@
- # secret = XYZ
- # ttl = 60
- 
-+# [test.changeip.com]
-+# provider = changeip.com
-+# username = user
-+# password = pass
-+
- # [test.dhs.org]
- # provider = dhs.org
- # username = user
-diff --git a/src/ddns/providers.py b/src/ddns/providers.py
-index 1e88995..587d5ff 100644
---- a/src/ddns/providers.py
-+++ b/src/ddns/providers.py
-@@ -539,6 +539,44 @@ class DDNSProviderBindNsupdate(DDNSProvider):
- 		return "\n".join(scriptlet)
- 
- 
-+class DDNSProviderChangeIP(DDNSProvider):
-+	handle    = "changeip.com"
-+	name      = "ChangeIP.com"
-+	website   = "https://changeip.com"
-+	protocols = ("ipv4",)
-+
-+	# Detailed information about the update api can be found here.
-+	# http://www.changeip.com/accounts/knowledgebase.php?action=displayarticle&id=34
-+
-+	url = "https://nic.changeip.com/nic/update"
-+	can_remove_records = False
-+
-+	def update_protocol(self, proto):
-+		data = {
-+			"hostname" : self.hostname,
-+			"myip"     : self.get_address(proto),
-+		}
-+
-+		# Send update to the server.
-+		try:
-+			response = self.send_request(self.url, username=self.username, password=self.password,
-+				data=data)
-+
-+		# Handle error codes.
-+		except urllib2.HTTPError, e:
-+			if e.code == 422:
-+				raise DDNSRequestError(_("Domain not found."))
-+
-+			raise
-+
-+		# Handle success message.
-+		if response.code == 200:
-+			return
-+
-+		# If we got here, some other update error happened.
-+		raise DDNSUpdateError(_("Server response: %s") % output)
-+
-+
- class DDNSProviderDHS(DDNSProvider):
- 	handle    = "dhs.org"
- 	name      = "DHS International"
diff --git a/src/patches/ddns/ddns-005-SPDNS-fix-auth.patch b/src/patches/ddns/ddns-005-SPDNS-fix-auth.patch
deleted file mode 100644
index 1d91baa59c..0000000000
--- a/src/patches/ddns/ddns-005-SPDNS-fix-auth.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-commit 25f39b4e437627bd1a49393280271d59ad28b86e
-Author: Stefan Schantl <stefan.schantl@ipfire.org>
-Date:   Mon Jan 5 21:37:55 2015 +0100
-
-    spdns.de: Fix authentication.
-    
-    There was a simple copy and paste issue which prevents a
-    correct authentication with username and password against the
-    providers API.
-
-diff --git a/src/ddns/providers.py b/src/ddns/providers.py
-index 587d5ff..bcfb088 100644
---- a/src/ddns/providers.py
-+++ b/src/ddns/providers.py
-@@ -1271,7 +1271,7 @@ class DDNSProviderSPDNS(DDNSProtocolDynDNS2, DDNSProvider):
- 
- 	@property
- 	def password(self):
--		return self.get("username") or self.token
-+		return self.get("password") or self.token
- 
- 
- class DDNSProviderStrato(DDNSProtocolDynDNS2, DDNSProvider):
diff --git a/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch b/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
deleted file mode 100644
index 4784d5a684..0000000000
--- a/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -up dhcp-4.2.0/common/dispatch.c.dracut dhcp-4.2.0/common/dispatch.c
---- dhcp-4.2.0/common/dispatch.c.dracut	2010-06-01 19:29:59.000000000 +0200
-+++ dhcp-4.2.0/common/dispatch.c	2010-07-21 16:10:09.000000000 +0200
-@@ -189,6 +189,10 @@ void add_timeout (when, where, what, ref
- 	isc_interval_t interval;
- 	isc_time_t expires;
- 
-+	if (when == NULL) {
-+		return;
-+	}
-+
- 	/* See if this timeout supersedes an existing timeout. */
- 	t = (struct timeout *)0;
- 	for (q = timeouts; q; q = q->next) {
diff --git a/src/patches/dhcp-4.2.0-errwarn-message.patch b/src/patches/dhcp-4.2.0-errwarn-message.patch
deleted file mode 100644
index a0f70cd042..0000000000
--- a/src/patches/dhcp-4.2.0-errwarn-message.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -up dhcp-4.2.0/omapip/errwarn.c.errwarn dhcp-4.2.0/omapip/errwarn.c
---- dhcp-4.2.0/omapip/errwarn.c.errwarn	2009-07-23 20:52:21.000000000 +0200
-+++ dhcp-4.2.0/omapip/errwarn.c	2010-07-21 13:23:47.000000000 +0200
-@@ -76,20 +76,13 @@ void log_fatal (const char * fmt, ... )
- 
- #if !defined (NOMINUM)
-   log_error ("%s", "");
--  log_error ("If you did not get this software from ftp.isc.org, please");
--  log_error ("get the latest from ftp.isc.org and install that before");
--  log_error ("requesting help.");
-+  log_error ("This version of ISC DHCP is based on the release available");
-+  log_error ("on ftp.isc.org.  Features have been added and other changes");
-+  log_error ("have been made to the base software release in order to make");
-+  log_error ("it work better with this distribution.");
-   log_error ("%s", "");
--  log_error ("If you did get this software from ftp.isc.org and have not");
--  log_error ("yet read the README, please read it before requesting help.");
--  log_error ("If you intend to request help from the dhcp-server@isc.org");
--  log_error ("mailing list, please read the section on the README about");
--  log_error ("submitting bug reports and requests for help.");
--  log_error ("%s", "");
--  log_error ("Please do not under any circumstances send requests for");
--  log_error ("help directly to the authors of this software - please");
--  log_error ("send them to the appropriate mailing list as described in");
--  log_error ("the README file.");
-+  log_error ("Please report for this software via the Red Hat Bugzilla site:");
-+  log_error ("    http://bugzilla.redhat.com");
-   log_error ("%s", "");
-   log_error ("exiting.");
- #endif
diff --git a/src/patches/dhcp-4.2.0-garbage-chars.patch b/src/patches/dhcp-4.2.0-garbage-chars.patch
deleted file mode 100644
index 118ff3fc1a..0000000000
--- a/src/patches/dhcp-4.2.0-garbage-chars.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.0/common/tables.c.garbage dhcp-4.2.0/common/tables.c
---- dhcp-4.2.0/common/tables.c.garbage	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.0/common/tables.c	2010-07-21 14:40:56.000000000 +0200
-@@ -207,7 +207,7 @@ static struct option dhcp_options[] = {
- 	{ "netinfo-server-tag", "t",		&dhcp_universe, 113, 1 },
- 	{ "default-url", "t",			&dhcp_universe, 114, 1 },
- 	{ "subnet-selection", "I",		&dhcp_universe, 118, 1 },
--	{ "domain-search", "Dc",		&dhcp_universe, 119, 1 },
-+	{ "domain-search", "D",		&dhcp_universe, 119, 1 },
- 	{ "vivco", "Evendor-class.",		&dhcp_universe, 124, 1 },
- 	{ "vivso", "Evendor.",			&dhcp_universe, 125, 1 },
- #if 0
diff --git a/src/patches/dhcp-4.2.0-inherit-leases.patch b/src/patches/dhcp-4.2.0-inherit-leases.patch
deleted file mode 100644
index 052f642594..0000000000
--- a/src/patches/dhcp-4.2.0-inherit-leases.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.inherit dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.inherit	2010-07-21 14:33:44.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c	2010-07-21 14:40:05.000000000 +0200
-@@ -2322,6 +2322,7 @@ void send_request (cpp)
- {
- 	struct client_state *client = cpp;
- 
-+	int i;
- 	int result;
- 	int interval;
- 	struct sockaddr_in destination;
-@@ -2381,6 +2382,22 @@ void send_request (cpp)
- 		/* Now do a preinit on the interface so that we can
- 		   discover a new address. */
- 		script_init (client, "PREINIT", (struct string_list *)0);
-+
-+		/* Has an active lease */
-+		if (client -> interface -> addresses != NULL) {
-+			for (i = 0; i < client -> interface -> address_count; i++) {
-+				if (client -> active &&
-+				    client -> active -> is_bootp &&
-+				    client -> active -> expiry > cur_time &&
-+				    client -> interface -> addresses[i].s_addr != 0 &&
-+				    client -> active -> address.len == 4 &&
-+				    memcpy (client -> active -> address.iabuf, &(client -> interface -> addresses[i]), 4) == 0) {
-+					client_envadd (client, "", "keep_old_ip", "%s", "yes");
-+					break;
-+				}
-+			}
-+		}
-+
- 		if (client -> alias)
- 			script_write_params (client, "alias_",
- 					     client -> alias);
diff --git a/src/patches/dhcp-4.2.0-logpid.patch b/src/patches/dhcp-4.2.0-logpid.patch
deleted file mode 100644
index c24adb14a9..0000000000
--- a/src/patches/dhcp-4.2.0-logpid.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.logpid dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.logpid	2010-07-21 16:13:52.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c	2010-07-21 16:16:51.000000000 +0200
-@@ -154,7 +154,7 @@ main(int argc, char **argv) {
- 	else if (fd != -1)
- 		close(fd);
- 
--	openlog("dhclient", LOG_NDELAY, LOG_DAEMON);
-+	openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON);
- 
- #if !(defined(DEBUG) || defined(__CYGWIN32__))
- 	setlogmask(LOG_UPTO(LOG_INFO));
diff --git a/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch b/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
deleted file mode 100644
index b604115451..0000000000
--- a/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up dhcp-4.2.0/common/discover.c.noipv6 dhcp-4.2.0/common/discover.c
---- dhcp-4.2.0/common/discover.c.noipv6	2010-07-21 14:31:13.000000000 +0200
-+++ dhcp-4.2.0/common/discover.c	2010-07-21 16:04:57.000000000 +0200
-@@ -443,7 +443,7 @@ begin_iface_scan(struct iface_conf_list 
- 	}
- 
- #ifdef DHCPv6
--	if (local_family == AF_INET6) {
-+	if ((local_family == AF_INET6) && !access("/proc/net/if_inet6", R_OK)) {
- 		ifaces->fp6 = fopen("/proc/net/if_inet6", "re");
- 		if (ifaces->fp6 == NULL) {
- 			log_error("Error opening '/proc/net/if_inet6' to "
-@@ -454,6 +454,8 @@ begin_iface_scan(struct iface_conf_list 
- 			ifaces->fp = NULL;
- 			return 0;
- 		}
-+	} else {
-+		ifaces->fp6 = NULL;
- 	}
- #endif
- 
-@@ -721,7 +723,7 @@ next_iface(struct iface_info *info, int 
- 		return 1;
- 	}
- #ifdef DHCPv6
--	if (!(*err)) {
-+	if (!(*err) && ifaces->fp6) {
- 		if (local_family == AF_INET6)
- 			return next_iface6(info, err, ifaces);
- 	}
-@@ -740,7 +742,8 @@ end_iface_scan(struct iface_conf_list *i
- 	ifaces->sock = -1;
- #ifdef DHCPv6
- 	if (local_family == AF_INET6) {
--		fclose(ifaces->fp6);
-+		if (ifaces->fp6)
-+			fclose(ifaces->fp6);
- 		ifaces->fp6 = NULL;
- 	}
- #endif
diff --git a/src/patches/dhcp-4.2.0-noprefixavail.patch b/src/patches/dhcp-4.2.0-noprefixavail.patch
deleted file mode 100644
index 729a1726a7..0000000000
--- a/src/patches/dhcp-4.2.0-noprefixavail.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-diff -up dhcp-4.2.0/server/dhcpv6.c.noprefixavail dhcp-4.2.0/server/dhcpv6.c
---- dhcp-4.2.0/server/dhcpv6.c.noprefixavail	2010-10-07 13:48:45.000000000 +0200
-+++ dhcp-4.2.0/server/dhcpv6.c	2010-10-13 11:00:25.000000000 +0200
-@@ -1134,7 +1134,7 @@ try_client_v6_prefix(struct iasubopt **p
- 		return DHCP_R_INVALIDARG;
- 	}
- 	tmp_plen = (int) requested_pref->data[0];
--	if ((tmp_plen < 3) || (tmp_plen > 128)) {
-+	if ((tmp_plen < 3) || (tmp_plen > 128) ||((int)tmp_plen != pool->units)) {
- 		return ISC_R_FAILURE;
- 	}
- 	memcpy(&tmp_pref, requested_pref->data + 1, sizeof(tmp_pref));
-@@ -1147,9 +1147,8 @@ try_client_v6_prefix(struct iasubopt **p
- 		return ISC_R_FAILURE;
- 	}
- 
--	if (((int)tmp_plen != pool->units) ||
--	    !ipv6_in_pool(&tmp_pref, pool)) {
--		return ISC_R_FAILURE;
-+	if (!ipv6_in_pool(&tmp_pref, pool)) {
-+		return ISC_R_ADDRNOTAVAIL;
- 	}
- 
- 	if (prefix6_exists(pool, &tmp_pref, tmp_plen)) {
-@@ -1409,13 +1408,6 @@ lease_to_client(struct data_string *repl
- 		if ((status != ISC_R_SUCCESS) &&
- 		    (status != ISC_R_NORESOURCES))
- 			goto exit;
--
--		/*
--		 * If any prefix cannot be given to any IA_PD, then
--		 * set the NoPrefixAvail status code.
--		 */
--		if (reply.client_resources == 0)
--			no_resources_avail = ISC_TRUE;
- 	}
- 
- 	/*
-@@ -1549,36 +1541,6 @@ lease_to_client(struct data_string *repl
- 					       reply.opt_state, reply.packet,
- 					       required_opts_NAA,
- 					       NULL);
--	} else if (no_resources_avail && (reply.ia_count == 0) &&
--		   (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
--	{
--		/* Set the NoPrefixAvail status code. */
--		if (!set_status_code(STATUS_NoPrefixAvail,
--				     "No prefixes available for this "
--				     "interface.", reply.opt_state)) {
--			log_error("lease_to_client: Unable to set "
--				  "NoPrefixAvail status code.");
--			goto exit;
--		}
--
--		/* Rewind the cursor to the start. */
--		reply.cursor = REPLY_OPTIONS_INDEX;
--
--		/*
--		 * Produce an advertise that includes only:
--		 *
--		 * Status code.
--		 * Server DUID.
--		 * Client DUID.
--		 */
--		reply.buf.reply.msg_type = DHCPV6_ADVERTISE;
--		reply.cursor += store_options6((char *)reply.buf.data +
--							reply.cursor,
--					       sizeof(reply.buf) -
--					       		reply.cursor,
--					       reply.opt_state, reply.packet,
--					       required_opts_NAA,
--					       NULL);
- 	} else {
- 		/*
- 		 * Having stored the client's IA's, store any options that
-@@ -2793,16 +2755,18 @@ find_client_temporaries(struct reply_sta
-  */
- static isc_result_t
- reply_process_try_addr(struct reply_state *reply, struct iaddr *addr) {
--	isc_result_t status = ISC_R_NORESOURCES;
-+	isc_result_t status = ISC_R_ADDRNOTAVAIL;
- 	struct ipv6_pool *pool;
- 	int i;
- 	struct data_string data_addr;
- 
- 	if ((reply == NULL) || (reply->shared == NULL) ||
--	    (reply->shared->ipv6_pools == NULL) || (addr == NULL) ||
--	    (reply->lease != NULL))
-+	    (addr == NULL) || (reply->lease != NULL))
- 		return DHCP_R_INVALIDARG;
- 
-+	if (reply->shared->ipv6_pools == NULL)
-+		return ISC_R_ADDRNOTAVAIL;
-+
- 	memset(&data_addr, 0, sizeof(data_addr));
- 	data_addr.len = addr->len;
- 	data_addr.data = addr->iabuf;
-@@ -3314,7 +3278,9 @@ reply_process_ia_pd(struct reply_state *
- 		if (status == ISC_R_CANCELED)
- 			break;
- 
--		if ((status != ISC_R_SUCCESS) && (status != ISC_R_ADDRINUSE))
-+		if ((status != ISC_R_SUCCESS) &&
-+		    (status != ISC_R_ADDRINUSE) &&
-+		    (status != ISC_R_ADDRNOTAVAIL))
- 			goto cleanup;
- 	}
- 
-@@ -3594,7 +3560,8 @@ reply_process_prefix(struct reply_state 
- 
- 			/* Either error out or skip this prefix. */
- 			if ((status != ISC_R_SUCCESS) && 
--			    (status != ISC_R_ADDRINUSE)) 
-+			    (status != ISC_R_ADDRINUSE) &&
-+			    (status != ISC_R_ADDRNOTAVAIL))
- 				goto cleanup;
- 
- 			if (reply->lease == NULL) {
-@@ -3773,16 +3740,18 @@ prefix_is_owned(struct reply_state *repl
- static isc_result_t
- reply_process_try_prefix(struct reply_state *reply,
- 			 struct iaddrcidrnet *pref) {
--	isc_result_t status = ISC_R_NORESOURCES;
-+	isc_result_t status = ISC_R_ADDRNOTAVAIL;
- 	struct ipv6_pool *pool;
- 	int i;
- 	struct data_string data_pref;
- 
- 	if ((reply == NULL) || (reply->shared == NULL) ||
--	    (reply->shared->ipv6_pools == NULL) || (pref == NULL) ||
--	    (reply->lease != NULL))
-+	    (pref == NULL) || (reply->lease != NULL))
- 		return DHCP_R_INVALIDARG;
- 
-+	if (reply->shared->ipv6_pools == NULL)
-+		return ISC_R_ADDRNOTAVAIL;
-+
- 	memset(&data_pref, 0, sizeof(data_pref));
- 	data_pref.len = 17;
- 	if (!buffer_allocate(&data_pref.buffer, data_pref.len, MDL)) {
diff --git a/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch b/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
deleted file mode 100644
index a540bc19f1..0000000000
--- a/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-diff -up dhcp-4.2.1b1/common/dispatch.c.64-bit_lease_parse dhcp-4.2.1b1/common/dispatch.c
-diff -up dhcp-4.2.1b1/common/parse.c.64-bit_lease_parse dhcp-4.2.1b1/common/parse.c
---- dhcp-4.2.1b1/common/parse.c.64-bit_lease_parse	2010-12-30 00:01:42.000000000 +0100
-+++ dhcp-4.2.1b1/common/parse.c	2011-01-28 08:01:10.000000000 +0100
-@@ -909,8 +909,8 @@ TIME 
- parse_date_core(cfile)
- 	struct parse *cfile;
- {
--	int guess;
--	int tzoff, wday, year, mon, mday, hour, min, sec;
-+	TIME guess;
-+	long int tzoff, wday, year, mon, mday, hour, min, sec;
- 	const char *val;
- 	enum dhcp_token token;
- 	static int months[11] = { 31, 59, 90, 120, 151, 181,
-@@ -936,7 +936,7 @@ parse_date_core(cfile)
- 		}
- 
- 		token = next_token(&val, NULL, cfile); /* consume number */
--		guess = atoi(val);
-+		guess = atol(val);
- 
- 		return((TIME)guess);
- 	}
-@@ -948,7 +948,7 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume day of week */
--	wday = atoi(val);
-+	wday = atol(val);
- 
- 	/* Year... */
- 	token = peek_token(&val, NULL, cfile);
-@@ -964,7 +964,7 @@ parse_date_core(cfile)
- 	   somebody invents a time machine, I think we can safely disregard
- 	   it.   This actually works around a stupid Y2K bug that was present
- 	   in a very early beta release of dhcpd. */
--	year = atoi(val);
-+	year = atol(val);
- 	if (year > 1900)
- 		year -= 1900;
- 
-@@ -988,7 +988,7 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume month */	
--	mon = atoi(val) - 1;
-+	mon = atol(val) - 1;
- 
- 	/* Slash separating month from day... */
- 	token = peek_token(&val, NULL, cfile);
-@@ -1010,7 +1010,7 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume day of month */
--	mday = atoi(val);
-+	mday = atol(val);
- 
- 	/* Hour... */
- 	token = peek_token(&val, NULL, cfile);
-@@ -1021,7 +1021,7 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume hour */
--	hour = atoi(val);
-+	hour = atol(val);
- 
- 	/* Colon separating hour from minute... */
- 	token = peek_token(&val, NULL, cfile);
-@@ -1043,7 +1043,7 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume minute */
--	min = atoi(val);
-+	min = atol(val);
- 
- 	/* Colon separating minute from second... */
- 	token = peek_token(&val, NULL, cfile);
-@@ -1065,13 +1065,13 @@ parse_date_core(cfile)
- 		return((TIME)0);
- 	}
- 	token = next_token(&val, NULL, cfile); /* consume second */
--	sec = atoi(val);
-+	sec = atol(val);
- 
- 	tzoff = 0;
- 	token = peek_token(&val, NULL, cfile);
- 	if (token == NUMBER) {
- 		token = next_token(&val, NULL, cfile); /* consume tzoff */
--		tzoff = atoi(val);
-+		tzoff = atol(val);
- 	} else if (token != SEMI) {
- 		token = next_token(&val, NULL, cfile);
- 		parse_warn(cfile,
diff --git a/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch b/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
deleted file mode 100644
index eeeea84fde..0000000000
--- a/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.1b1/client/dhclient.conf.supersede dhcp-4.2.1b1/client/dhclient.conf
---- dhcp-4.2.1b1/client/dhclient.conf.supersede	2010-09-15 01:03:56.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.conf	2011-01-27 18:38:28.000000000 +0100
-@@ -4,7 +4,7 @@ send dhcp-lease-time 3600;
- supersede domain-search "fugue.com", "home.vix.com";
- prepend domain-name-servers 127.0.0.1;
- request subnet-mask, broadcast-address, time-offset, routers,
--	domain-name, domain-name-servers, host-name;
-+	domain-search, domain-name-servers, host-name;
- require subnet-mask, domain-name-servers;
- timeout 60;
- retry 60;
diff --git a/src/patches/dhcp-4.2.1-retransmission.patch b/src/patches/dhcp-4.2.1-retransmission.patch
deleted file mode 100644
index 18e447f6a3..0000000000
--- a/src/patches/dhcp-4.2.1-retransmission.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -up dhcp-4.2.1b1/client/dhc6.c.retransmission dhcp-4.2.1b1/client/dhc6.c
---- dhcp-4.2.1b1/client/dhc6.c.retransmission	2011-01-28 08:40:56.000000000 +0100
-+++ dhcp-4.2.1b1/client/dhc6.c	2011-01-28 08:39:22.000000000 +0100
-@@ -361,7 +361,7 @@ dhc6_retrans_init(struct client_state *c
- static void
- dhc6_retrans_advance(struct client_state *client)
- {
--	struct timeval elapsed;
-+	struct timeval elapsed, elapsed_after_RT;
- 
- 	/* elapsed = cur - start */
- 	elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec;
-@@ -378,6 +378,8 @@ dhc6_retrans_advance(struct client_state
- 		elapsed.tv_sec += 1;
- 		elapsed.tv_usec -= 1000000;
- 	}
-+	elapsed_after_RT.tv_sec = elapsed.tv_sec;
-+	elapsed_after_RT.tv_usec = elapsed.tv_usec;
- 
- 	/*
- 	 * RT for each subsequent message transmission is based on the previous
-@@ -415,13 +417,10 @@ dhc6_retrans_advance(struct client_state
- 		elapsed.tv_usec -= 1000000;
- 	}
- 	if (elapsed.tv_sec >= client->MRD) {
--		/*
--		 * wake at RT + cur = start + MRD
--		 */
--		client->RT = client->MRD +
--			(client->start_time.tv_sec - cur_tv.tv_sec);
--		client->RT = client->RT * 100 +
--			(client->start_time.tv_usec - cur_tv.tv_usec) / 10000;
-+		client->RT = client->MRD - elapsed_after_RT.tv_sec;
-+		client->RT = client->RT * 100 - elapsed_after_RT.tv_usec / 10000;
-+		if (client->RT < 0)
-+			client->RT = 0;
- 	}
- 	client->txcount++;
- }
-@@ -1497,7 +1496,7 @@ check_timing6 (struct client_state *clie
- 	}
- 
- 	/* Check if finished (-1 argument). */
--	if ((client->MRD != 0) && (elapsed.tv_sec > client->MRD)) {
-+	if ((client->MRD != 0) && (elapsed.tv_sec >= client->MRD)) {
- 		log_info("Max retransmission duration exceeded.");
- 		return(CHK_TIM_MRD_EXCEEDED);
- 	}
diff --git a/src/patches/dhcp-4.2.2-dhclient-usage.patch b/src/patches/dhcp-4.2.2-dhclient-usage.patch
deleted file mode 100644
index 0d4194396a..0000000000
--- a/src/patches/dhcp-4.2.2-dhclient-usage.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -up dhcp-4.2.2b1/client/dhclient.c.usage dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.usage	2011-07-01 13:55:16.000000000 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c	2011-07-01 13:58:55.243800602 +0200
-@@ -1047,6 +1047,10 @@ static void usage()
- 		  "                [-s server-addr] [-cf config-file] "
- 		  "[-lf lease-file]\n"
- 		  "                [-pf pid-file] [--no-pid] [-e VAR=val]\n"
-+		  "                [-I <dhcp-client-identifier>] [-B]\n"
-+		  "                [-H <host-name> | -F <fqdn.fqdn>] [-timeout <timeout>]\n"
-+		  "                [-V <vendor-class-identifier>]\n"
-+		  "                [-R <request option list>]\n"
- 		  "                [-sf script-file] [interface]");
- }
- 
diff --git a/src/patches/dhcp-4.2.2-remove-bind.patch b/src/patches/dhcp-4.2.2-remove-bind.patch
deleted file mode 100644
index 6297772277..0000000000
--- a/src/patches/dhcp-4.2.2-remove-bind.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-diff -up dhcp-4.2.2/client/Makefile.am.rh637017 dhcp-4.2.2/client/Makefile.am
---- dhcp-4.2.2/client/Makefile.am.rh637017	2010-09-15 00:32:36.000000000 +0200
-+++ dhcp-4.2.2/client/Makefile.am	2011-08-11 17:28:58.923897561 +0200
-@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c 
- 		   scripts/netbsd scripts/nextstep scripts/openbsd \
- 		   scripts/solaris scripts/openwrt
- dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--		 ../bind/lib/libdns.a ../bind/lib/libisc.a
-+		 $(BIND9_LIBDIR) -ldns-export -lisc-export
- man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
- EXTRA_DIST = $(man_MANS)
- 
-diff -up dhcp-4.2.2/common/tests/Makefile.am.rh637017 dhcp-4.2.2/common/tests/Makefile.am
---- dhcp-4.2.2/common/tests/Makefile.am.rh637017	2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/common/tests/Makefile.am	2011-08-11 17:33:45.258637236 +0200
-@@ -6,6 +6,5 @@ TESTS = test_alloc
- 
- test_alloc_SOURCES = test_alloc.c
- test_alloc_LDADD = ../libdhcp.a ../../tests/libt_api.a \
--	../../omapip/libomapi.a ../../bind/lib/libdns.a \
--        ../../bind/lib/libisc.a
--
-+	../../omapip/libomapi.a \
-+	 $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/configure.ac.rh637017 dhcp-4.2.2/configure.ac
---- dhcp-4.2.2/configure.ac.rh637017	2011-07-20 02:32:18.000000000 +0200
-+++ dhcp-4.2.2/configure.ac	2011-08-11 17:28:58.924897535 +0200
-@@ -512,20 +512,37 @@ AC_CHECK_MEMBER(struct msghdr.msg_contro
- libbind=
- AC_ARG_WITH(libbind,
- 	AC_HELP_STRING([--with-libbind=PATH],
--		       [bind includes and libraries are in PATH 
--		        (default is ./bind)]),
-+		       [bind includes are in PATH 
-+		        (default is ./bind/includes)]),
- 	use_libbind="$withval", use_libbind="no")
- case "$use_libbind" in 
-+yes|no)
-+	libbind="\${top_srcdir}/bind/include"
-+	;;
-+*)
-+	libbind="$use_libbind"
-+	;;
-+esac
-+
-+BIND9_LIBDIR='-L$(top_builddir)/bind/lib'
-+AC_ARG_WITH(libbind-libs,
-+	AC_HELP_STRING([--with-libbind-libs=PATH],
-+		       [bind9 export libraries are in PATH]),
-+		       [libbind_libs="$withval"], [libbind_libs='no'])
-+case "$libbind_libs" in
- yes)
--	libbind="\${top_srcdir}/bind"
-+	AC_MSG_ERROR([Specify path to bind9 libraries])
- 	;;
- no)
--	libbind="\${top_srcdir}/bind"
-+	BUNDLED_BIND=yes
- 	;;
- *)
--	libbind="$use_libbind"
-+	BIND9_LIBDIR="-L$libbind_libs"
-+	BUNDLED_BIND=no
- 	;;
- esac
-+AM_CONDITIONAL([BUNDLED_BIND], [test "$BUNDLED_BIND" = yes])
-+AC_SUBST([BIND9_LIBDIR])
- 
- # OpenLDAP support.
- AC_ARG_WITH(ldap,
-@@ -562,7 +579,7 @@ fi
- CFLAGS="$CFLAGS $STD_CWARNINGS"
- 
- # Try to add the bind include directory
--CFLAGS="$CFLAGS -I$libbind/include"
-+CFLAGS="$CFLAGS -I$libbind"
- 
- AC_C_FLEXIBLE_ARRAY_MEMBER
- 
-diff -up dhcp-4.2.2/dhcpctl/Makefile.am.rh637017 dhcp-4.2.2/dhcpctl/Makefile.am
---- dhcp-4.2.2/dhcpctl/Makefile.am.rh637017	2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/dhcpctl/Makefile.am	2011-08-11 17:28:58.924897535 +0200
-@@ -6,10 +6,10 @@ EXTRA_DIST = $(man_MANS)
- 
- omshell_SOURCES = omshell.c
- omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
--	        ../bind/lib/libdns.a ../bind/lib/libisc.a
-+	        $(BIND9_LIBDIR) -ldns-export -lisc-export
- 
- libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
- 
- cltest_SOURCES = cltest.c
- cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
--	       ../bind/lib/libdns.a ../bind/lib/libisc.a
-\ No newline at end of file
-+	       $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/Makefile.am.rh637017 dhcp-4.2.2/Makefile.am
---- dhcp-4.2.2/Makefile.am.rh637017	2010-03-25 00:30:38.000000000 +0100
-+++ dhcp-4.2.2/Makefile.am	2011-08-11 17:28:58.925897509 +0200
-@@ -21,7 +21,13 @@ EXTRA_DIST = RELNOTES LICENSE \
- 	     util/bindvar.sh \
- 	     bind/Makefile bind/bind.tar.gz bind/version.tmp 
- 
--SUBDIRS = bind includes tests common dst omapip client dhcpctl relay server
-+if BUNDLED_BIND
-+SUBDIRS = bind
-+else
-+SUBDIRS = 
-+endif
-+
-+SUBDIRS += includes tests common dst omapip client dhcpctl relay server
- 
- nobase_include_HEADERS = dhcpctl/dhcpctl.h
- 
-diff -up dhcp-4.2.2/omapip/Makefile.am.rh637017 dhcp-4.2.2/omapip/Makefile.am
---- dhcp-4.2.2/omapip/Makefile.am.rh637017	2010-02-12 01:13:54.000000000 +0100
-+++ dhcp-4.2.2/omapip/Makefile.am	2011-08-11 17:28:58.939897149 +0200
-@@ -10,5 +10,5 @@ man_MANS = omapi.3
- EXTRA_DIST = $(man_MANS)
- 
- svtest_SOURCES = test.c
--svtest_LDADD = libomapi.a ../bind/lib/libdns.a ../bind/lib/libisc.a
-+svtest_LDADD = libomapi.a $(BIND9_LIBDIR) -ldns-export -lisc-export
- 
-diff -up dhcp-4.2.2/relay/Makefile.am.rh637017 dhcp-4.2.2/relay/Makefile.am
---- dhcp-4.2.2/relay/Makefile.am.rh637017	2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/relay/Makefile.am	2011-08-11 17:28:58.940897123 +0200
-@@ -3,7 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
- sbin_PROGRAMS = dhcrelay
- dhcrelay_SOURCES = dhcrelay.c
- dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--		 ../bind/lib/libdns.a ../bind/lib/libisc.a
-+		 $(BIND9_LIBDIR) -ldns-export -lisc-export
- man_MANS = dhcrelay.8
- EXTRA_DIST = $(man_MANS)
- 
-diff -up dhcp-4.2.2/server/Makefile.am.rh637017 dhcp-4.2.2/server/Makefile.am
---- dhcp-4.2.2/server/Makefile.am.rh637017	2010-03-24 22:49:47.000000000 +0100
-+++ dhcp-4.2.2/server/Makefile.am	2011-08-11 17:28:58.944897021 +0200
-@@ -8,8 +8,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
- 
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
- dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--	      ../dhcpctl/libdhcpctl.a ../bind/lib/libdns.a \
--	      ../bind/lib/libisc.a
-+	      ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export
- 
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
- EXTRA_DIST = $(man_MANS)
diff --git a/src/patches/dhcp-4.2.2-sharedlib.patch b/src/patches/dhcp-4.2.2-sharedlib.patch
deleted file mode 100644
index 74fe9f1c07..0000000000
--- a/src/patches/dhcp-4.2.2-sharedlib.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-diff -up dhcp-4.2.2/client/Makefile.am.sharedlib dhcp-4.2.2/client/Makefile.am
---- dhcp-4.2.2/client/Makefile.am.sharedlib	2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/client/Makefile.am	2011-09-09 16:36:29.849007951 +0200
-@@ -4,7 +4,7 @@ dhclient_SOURCES = clparse.c dhclient.c
- 		   scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
- 		   scripts/netbsd scripts/nextstep scripts/openbsd \
- 		   scripts/solaris scripts/openwrt
--dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-+dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
- 		 $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
- EXTRA_DIST = $(man_MANS)
-diff -up dhcp-4.2.2/configure.ac.sharedlib dhcp-4.2.2/configure.ac
---- dhcp-4.2.2/configure.ac.sharedlib	2011-09-09 16:35:56.097000001 +0200
-+++ dhcp-4.2.2/configure.ac	2011-09-09 16:35:56.383000000 +0200
-@@ -30,7 +30,8 @@ fi
- # Use this to define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
- AC_USE_SYSTEM_EXTENSIONS
- 
--AC_PROG_RANLIB
-+# Use libtool to simplify building of shared libraries
-+AC_PROG_LIBTOOL
- AC_CONFIG_HEADERS([includes/config.h])
- 
- # we sometimes need to know byte order for building packets
-diff -up dhcp-4.2.2/dhcpctl/Makefile.am.sharedlib dhcp-4.2.2/dhcpctl/Makefile.am
---- dhcp-4.2.2/dhcpctl/Makefile.am.sharedlib	2011-09-09 16:35:55.459000001 +0200
-+++ dhcp-4.2.2/dhcpctl/Makefile.am	2011-09-09 16:35:56.384000000 +0200
-@@ -1,15 +1,15 @@
- bin_PROGRAMS = omshell
--lib_LIBRARIES = libdhcpctl.a
-+lib_LTLIBRARIES = libdhcpctl.la
- noinst_PROGRAMS = cltest
- man_MANS = omshell.1 dhcpctl.3
- EXTRA_DIST = $(man_MANS)
- 
- omshell_SOURCES = omshell.c
--omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-+omshell_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
- 	        $(BIND9_LIBDIR) -ldns-export -lisc-export
- 
--libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
-+libdhcpctl_la_SOURCES = dhcpctl.c callback.c remote.c
- 
- cltest_SOURCES = cltest.c
--cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-+cltest_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
- 	       $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/dst/base64.c.sharedlib dhcp-4.2.2/dst/base64.c
---- dhcp-4.2.2/dst/base64.c.sharedlib	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2/dst/base64.c	2011-09-09 16:35:56.385000000 +0200
-@@ -64,6 +64,7 @@ static const char rcsid[] = "$Id: base64
- 
- #include <sys/socket.h>
- 
-+#include "dst_internal.h"
- #include "cdefs.h"
- #include "osdep.h"
- #include "arpa/nameser.h"
-diff -up dhcp-4.2.2/dst/Makefile.am.sharedlib dhcp-4.2.2/dst/Makefile.am
---- dhcp-4.2.2/dst/Makefile.am.sharedlib	2007-05-29 18:32:10.000000000 +0200
-+++ dhcp-4.2.2/dst/Makefile.am	2011-09-09 16:35:56.386000000 +0200
-@@ -1,8 +1,8 @@
- AM_CPPFLAGS = -DMINIRES_LIB -DHMAC_MD5
- 
--lib_LIBRARIES = libdst.a
-+lib_LTLIBRARIES = libdst.la
- 
--libdst_a_SOURCES = dst_support.c dst_api.c hmac_link.c md5_dgst.c \
-+libdst_la_SOURCES = dst_support.c dst_api.c hmac_link.c md5_dgst.c \
- 		   base64.c prandom.c
- 
- EXTRA_DIST = dst_internal.h md5.h md5_locl.h
-diff -up dhcp-4.2.2/omapip/Makefile.am.sharedlib dhcp-4.2.2/omapip/Makefile.am
---- dhcp-4.2.2/omapip/Makefile.am.sharedlib	2011-09-09 16:35:55.000000000 +0200
-+++ dhcp-4.2.2/omapip/Makefile.am	2011-09-09 16:37:36.734000324 +0200
-@@ -1,7 +1,7 @@
--lib_LIBRARIES = libomapi.a
-+lib_LTLIBRARIES = libomapi.la
- noinst_PROGRAMS = svtest
- 
--libomapi_a_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
-+libomapi_la_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
- 		     errwarn.c listener.c dispatch.c generic.c support.c \
- 		     handle.c message.c convert.c hash.c auth.c inet_addr.c \
- 		     array.c trace.c toisc.c iscprint.c isclib.c
-@@ -10,5 +10,5 @@ man_MANS = omapi.3
- EXTRA_DIST = $(man_MANS)
- 
- svtest_SOURCES = test.c
--svtest_LDADD = libomapi.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-+svtest_LDADD = libomapi.la $(BIND9_LIBDIR) -ldns-export -lisc-export
- 
-diff -up dhcp-4.2.2/relay/Makefile.am.sharedlib dhcp-4.2.2/relay/Makefile.am
---- dhcp-4.2.2/relay/Makefile.am.sharedlib	2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/relay/Makefile.am	2011-09-09 16:37:57.058019749 +0200
-@@ -2,7 +2,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
- 
- sbin_PROGRAMS = dhcrelay
- dhcrelay_SOURCES = dhcrelay.c
--dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-+dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
- 		 $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhcrelay.8
- EXTRA_DIST = $(man_MANS)
-diff -up dhcp-4.2.2/server/Makefile.am.sharedlib dhcp-4.2.2/server/Makefile.am
---- dhcp-4.2.2/server/Makefile.am.sharedlib	2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/server/Makefile.am	2011-09-09 16:38:56.291004599 +0200
-@@ -7,8 +7,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
- 		dhcpv6.c mdb6.c ldap.c ldap_casa.c
- 
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
--dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--	      ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export \
-+dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
-+	      ../dhcpctl/libdhcpctl.la $(BIND9_LIBDIR) -ldns-export -lisc-export \
- 	      $(CAPNG_LDADD)
- 
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
diff --git a/src/patches/dhcp/dhcp-64_bit_lease_parse.patch b/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
new file mode 100644
index 0000000000..a07b5b032a
--- /dev/null
+++ b/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
@@ -0,0 +1,75 @@
+diff -up dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse dhcp-4.3.0a1/common/parse.c
+--- dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/parse.c	2013-12-19 15:45:25.990771814 +0100
+@@ -938,8 +938,8 @@ TIME
+ parse_date_core(cfile)
+ 	struct parse *cfile;
+ {
+-	int guess;
+-	int tzoff, year, mon, mday, hour, min, sec;
++	TIME guess;
++	long int tzoff, year, mon, mday, hour, min, sec;
+ 	const char *val;
+ 	enum dhcp_token token;
+ 	static int months[11] = { 31, 59, 90, 120, 151, 181,
+@@ -965,7 +965,7 @@ parse_date_core(cfile)
+ 		}
+ 
+ 		skip_token(&val, NULL, cfile); /* consume number */
+-		guess = atoi(val);
++		guess = atol(val);
+ 
+ 		return((TIME)guess);
+ 	}
+@@ -993,7 +993,7 @@ parse_date_core(cfile)
+ 	   somebody invents a time machine, I think we can safely disregard
+ 	   it.   This actually works around a stupid Y2K bug that was present
+ 	   in a very early beta release of dhcpd. */
+-	year = atoi(val);
++	year = atol(val);
+ 	if (year > 1900)
+ 		year -= 1900;
+ 
+@@ -1039,7 +1039,7 @@ parse_date_core(cfile)
+ 		return((TIME)0);
+ 	}
+ 	skip_token(&val, NULL, cfile); /* consume day of month */
+-	mday = atoi(val);
++	mday = atol(val);
+ 
+ 	/* Hour... */
+ 	token = peek_token(&val, NULL, cfile);
+@@ -1050,7 +1050,7 @@ parse_date_core(cfile)
+ 		return((TIME)0);
+ 	}
+ 	skip_token(&val, NULL, cfile); /* consume hour */
+-	hour = atoi(val);
++	hour = atol(val);
+ 
+ 	/* Colon separating hour from minute... */
+ 	token = peek_token(&val, NULL, cfile);
+@@ -1072,7 +1072,7 @@ parse_date_core(cfile)
+ 		return((TIME)0);
+ 	}
+ 	skip_token(&val, NULL, cfile); /* consume minute */
+-	min = atoi(val);
++	min = atol(val);
+ 
+ 	/* Colon separating minute from second... */
+ 	token = peek_token(&val, NULL, cfile);
+@@ -1094,13 +1094,13 @@ parse_date_core(cfile)
+ 		return((TIME)0);
+ 	}
+ 	skip_token(&val, NULL, cfile); /* consume second */
+-	sec = atoi(val);
++	sec = atol(val);
+ 
+ 	tzoff = 0;
+ 	token = peek_token(&val, NULL, cfile);
+ 	if (token == NUMBER) {
+ 		skip_token(&val, NULL, cfile); /* consume tzoff */
+-		tzoff = atoi(val);
++		tzoff = atol(val);
+ 	} else if (token != SEMI) {
+ 		skip_token(&val, NULL, cfile);
+ 		parse_warn(cfile,
diff --git a/src/patches/dhcp-4.2.2-CLOEXEC.patch b/src/patches/dhcp/dhcp-CLOEXEC.patch
similarity index 52%
rename from src/patches/dhcp-4.2.2-CLOEXEC.patch
rename to src/patches/dhcp/dhcp-CLOEXEC.patch
index b07e2ff061..722865e4f6 100644
--- a/src/patches/dhcp-4.2.2-CLOEXEC.patch
+++ b/src/patches/dhcp/dhcp-CLOEXEC.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.cloexec dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.cloexec	2011-07-01 14:13:30.973887714 +0200
-+++ dhcp-4.2.2b1/client/clparse.c	2011-07-01 14:15:15.021580693 +0200
-@@ -246,7 +246,7 @@ int read_client_conf_file (const char *n
+diff -up dhcp-4.3.0a1/client/clparse.c.cloexec dhcp-4.3.0a1/client/clparse.c
+--- dhcp-4.3.0a1/client/clparse.c.cloexec	2013-12-19 15:34:41.638886256 +0100
++++ dhcp-4.3.0a1/client/clparse.c	2013-12-19 15:34:41.657885985 +0100
+@@ -253,7 +253,7 @@ int read_client_conf_file (const char *n
  	int token;
  	isc_result_t status;
  
@@ -10,7 +10,7 @@ diff -up dhcp-4.2.2b1/client/clparse.c.cloexec dhcp-4.2.2b1/client/clparse.c
  		return uerr2isc (errno);
  
  	cfile = NULL;
-@@ -283,7 +283,7 @@ void read_client_leases ()
+@@ -290,7 +290,7 @@ void read_client_leases ()
  
  	/* Open the lease file.   If we can't open it, just return -
  	   we can safely trust the server to remember our state. */
@@ -19,9 +19,9 @@ diff -up dhcp-4.2.2b1/client/clparse.c.cloexec dhcp-4.2.2b1/client/clparse.c
  		return;
  
  	cfile = NULL;
-diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.cloexec	2011-07-01 14:13:30.970887717 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c	2011-07-01 14:16:51.485930388 +0200
+diff -up dhcp-4.3.0a1/client/dhclient.c.cloexec dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.cloexec	2013-12-19 15:34:41.629886384 +0100
++++ dhcp-4.3.0a1/client/dhclient.c	2013-12-19 15:36:41.608180467 +0100
 @@ -148,11 +148,11 @@ main(int argc, char **argv) {
  	/* Make sure that file descriptors 0 (stdin), 1, (stdout), and
  	   2 (stderr) are open. To do this, we assume that when we
@@ -37,16 +37,16 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  	if (fd == 2)
  		log_perror = 0; /* No sense logging to /dev/null. */
  	else if (fd != -1)
-@@ -506,7 +506,7 @@ main(int argc, char **argv) {
+@@ -504,7 +504,7 @@ main(int argc, char **argv) {
+ 		long temp;
  		int e;
  
- 		oldpid = 0;
 -		if ((pidfd = fopen(path_dhclient_pid, "r")) != NULL) {
 +		if ((pidfd = fopen(path_dhclient_pid, "re")) != NULL) {
  			e = fscanf(pidfd, "%ld\n", &temp);
  			oldpid = (pid_t)temp;
  
-@@ -548,7 +548,7 @@ main(int argc, char **argv) {
+@@ -554,7 +554,7 @@ main(int argc, char **argv) {
  					strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx);
  					sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name);
  
@@ -55,7 +55,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  						e = fscanf(pidfd, "%ld\n", &temp);
  						oldpid = (pid_t)temp;
  
-@@ -573,7 +573,7 @@ main(int argc, char **argv) {
+@@ -579,7 +579,7 @@ main(int argc, char **argv) {
  		int dhc_running = 0;
  		char procfn[256] = "";
  
@@ -64,7 +64,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  			if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) {
  				snprintf(procfn,256,"/proc/%u",dhcpid);
  				dhc_running = (access(procfn, F_OK) == 0);
-@@ -2995,7 +2995,7 @@ void rewrite_client_leases ()
+@@ -3077,7 +3077,7 @@ void rewrite_client_leases ()
  
  	if (leaseFile != NULL)
  		fclose (leaseFile);
@@ -73,7 +73,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  	if (leaseFile == NULL) {
  		log_error ("can't create %s: %m", path_dhclient_db);
  		return;
-@@ -3105,7 +3105,7 @@ write_duid(struct data_string *duid)
+@@ -3261,7 +3261,7 @@ write_duid(struct data_string *duid)
  		return DHCP_R_INVALIDARG;
  
  	if (leaseFile == NULL) {	/* XXX? */
@@ -82,7 +82,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  		if (leaseFile == NULL) {
  			log_error("can't create %s: %m", path_dhclient_db);
  			return ISC_R_IOERROR;
-@@ -3285,7 +3285,7 @@ int write_client_lease (client, lease, r
+@@ -3441,7 +3441,7 @@ int write_client_lease (client, lease, r
  		return 1;
  
  	if (leaseFile == NULL) {	/* XXX */
@@ -91,20 +91,20 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  		if (leaseFile == NULL) {
  			log_error ("can't create %s: %m", path_dhclient_db);
  			return 0;
-@@ -3772,9 +3772,9 @@ void go_daemon ()
- 	close(2);
+@@ -3952,9 +3952,9 @@ void go_daemon ()
+ 	(void) close(2);
  
  	/* Reopen them on /dev/null. */
--	open("/dev/null", O_RDWR);
--	open("/dev/null", O_RDWR);
--	open("/dev/null", O_RDWR);
-+	open("/dev/null", O_RDWR | O_CLOEXEC);
-+	open("/dev/null", O_RDWR | O_CLOEXEC);
-+	open("/dev/null", O_RDWR | O_CLOEXEC);
+-	(void) open("/dev/null", O_RDWR);
+-	(void) open("/dev/null", O_RDWR);
+-	(void) open("/dev/null", O_RDWR);
++	(void) open("/dev/null", O_RDWR | O_CLOEXEC);
++	(void) open("/dev/null", O_RDWR | O_CLOEXEC);
++	(void) open("/dev/null", O_RDWR | O_CLOEXEC);
  
  	write_client_pid_file ();
  
-@@ -3791,14 +3791,14 @@ void write_client_pid_file ()
+@@ -3971,14 +3971,14 @@ void write_client_pid_file ()
  		return;
  	}
  
@@ -121,10 +121,10 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
  	if (!pf) {
  		close(pfdesc);
  		log_error ("Can't fdopen %s: %m", path_dhclient_pid);
-diff -up dhcp-4.2.2b1/common/bpf.c.cloexec dhcp-4.2.2b1/common/bpf.c
---- dhcp-4.2.2b1/common/bpf.c.cloexec	2011-07-01 14:13:30.976887712 +0200
-+++ dhcp-4.2.2b1/common/bpf.c	2011-07-01 14:13:31.030887673 +0200
-@@ -94,7 +94,7 @@ int if_register_bpf (info)
+diff -up dhcp-4.3.0a1/common/bpf.c.cloexec dhcp-4.3.0a1/common/bpf.c
+--- dhcp-4.3.0a1/common/bpf.c.cloexec	2013-12-19 15:34:41.640886227 +0100
++++ dhcp-4.3.0a1/common/bpf.c	2013-12-19 15:34:41.661885928 +0100
+@@ -95,7 +95,7 @@ int if_register_bpf (info)
  	for (b = 0; 1; b++) {
  		/* %Audit% 31 bytes max. %2004.06.17,Safe% */
  		sprintf(filename, BPF_FORMAT, b);
@@ -133,31 +133,10 @@ diff -up dhcp-4.2.2b1/common/bpf.c.cloexec dhcp-4.2.2b1/common/bpf.c
  		if (sock < 0) {
  			if (errno == EBUSY) {
  				continue;
-diff -up dhcp-4.2.2b1/common/discover.c.cloexec dhcp-4.2.2b1/common/discover.c
---- dhcp-4.2.2b1/common/discover.c.cloexec	2011-06-27 18:18:20.000000000 +0200
-+++ dhcp-4.2.2b1/common/discover.c	2011-07-01 14:13:31.031887673 +0200
-@@ -421,7 +421,7 @@ begin_iface_scan(struct iface_conf_list 
- 	int len;
- 	int i;
- 
--	ifaces->fp = fopen("/proc/net/dev", "r");
-+	ifaces->fp = fopen("/proc/net/dev", "re");
- 	if (ifaces->fp == NULL) {
- 		log_error("Error opening '/proc/net/dev' to list interfaces");
- 		return 0;
-@@ -456,7 +456,7 @@ begin_iface_scan(struct iface_conf_list 
- 
- #ifdef DHCPv6
- 	if (local_family == AF_INET6) {
--		ifaces->fp6 = fopen("/proc/net/if_inet6", "r");
-+		ifaces->fp6 = fopen("/proc/net/if_inet6", "re");
- 		if (ifaces->fp6 == NULL) {
- 			log_error("Error opening '/proc/net/if_inet6' to "
- 				  "list IPv6 interfaces; %m");
-diff -up dhcp-4.2.2b1/common/dlpi.c.cloexec dhcp-4.2.2b1/common/dlpi.c
---- dhcp-4.2.2b1/common/dlpi.c.cloexec	2011-07-01 14:13:30.977887712 +0200
-+++ dhcp-4.2.2b1/common/dlpi.c	2011-07-01 14:13:31.032887673 +0200
-@@ -806,7 +806,7 @@ dlpiopen(const char *ifname) {
+diff -up dhcp-4.3.0a1/common/dlpi.c.cloexec dhcp-4.3.0a1/common/dlpi.c
+--- dhcp-4.3.0a1/common/dlpi.c.cloexec	2013-12-19 15:34:41.641886213 +0100
++++ dhcp-4.3.0a1/common/dlpi.c	2013-12-19 15:34:41.662885914 +0100
+@@ -804,7 +804,7 @@ dlpiopen(const char *ifname) {
  	}
  	*dp = '\0';
  	
@@ -166,9 +145,9 @@ diff -up dhcp-4.2.2b1/common/dlpi.c.cloexec dhcp-4.2.2b1/common/dlpi.c
  }
  
  /*
-diff -up dhcp-4.2.2b1/common/nit.c.cloexec dhcp-4.2.2b1/common/nit.c
---- dhcp-4.2.2b1/common/nit.c.cloexec	2011-07-01 14:13:30.978887712 +0200
-+++ dhcp-4.2.2b1/common/nit.c	2011-07-01 14:13:31.033887672 +0200
+diff -up dhcp-4.3.0a1/common/nit.c.cloexec dhcp-4.3.0a1/common/nit.c
+--- dhcp-4.3.0a1/common/nit.c.cloexec	2013-12-19 15:34:41.642886199 +0100
++++ dhcp-4.3.0a1/common/nit.c	2013-12-19 15:34:41.662885914 +0100
 @@ -81,7 +81,7 @@ int if_register_nit (info)
  	struct strioctl sio;
  
@@ -178,10 +157,10 @@ diff -up dhcp-4.2.2b1/common/nit.c.cloexec dhcp-4.2.2b1/common/nit.c
  	if (sock < 0)
  		log_fatal ("Can't open NIT device for %s: %m", info -> name);
  
-diff -up dhcp-4.2.2b1/common/resolv.c.cloexec dhcp-4.2.2b1/common/resolv.c
---- dhcp-4.2.2b1/common/resolv.c.cloexec	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/resolv.c	2011-07-01 14:13:31.033887672 +0200
-@@ -49,7 +49,7 @@ void read_resolv_conf (parse_time)
+diff -up dhcp-4.3.0a1/common/resolv.c.cloexec dhcp-4.3.0a1/common/resolv.c
+--- dhcp-4.3.0a1/common/resolv.c.cloexec	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/resolv.c	2013-12-19 15:34:41.663885900 +0100
+@@ -50,7 +50,7 @@ void read_resolv_conf (parse_time)
  	struct domain_search_list *dp, *dl, *nd;
  	isc_result_t status;
  
@@ -190,9 +169,9 @@ diff -up dhcp-4.2.2b1/common/resolv.c.cloexec dhcp-4.2.2b1/common/resolv.c
  		log_error ("Can't open %s: %m", path_resolv_conf);
  		return;
  	}
-diff -up dhcp-4.2.2b1/common/upf.c.cloexec dhcp-4.2.2b1/common/upf.c
---- dhcp-4.2.2b1/common/upf.c.cloexec	2011-07-01 14:13:30.979887712 +0200
-+++ dhcp-4.2.2b1/common/upf.c	2011-07-01 14:13:31.034887671 +0200
+diff -up dhcp-4.3.0a1/common/upf.c.cloexec dhcp-4.3.0a1/common/upf.c
+--- dhcp-4.3.0a1/common/upf.c.cloexec	2013-12-19 15:34:41.642886199 +0100
++++ dhcp-4.3.0a1/common/upf.c	2013-12-19 15:34:41.663885900 +0100
 @@ -77,7 +77,7 @@ int if_register_upf (info)
  		/* %Audit% Cannot exceed 36 bytes. %2004.06.17,Safe% */
  		sprintf(filename, "/dev/pf/pfilt%d", b);
@@ -202,70 +181,10 @@ diff -up dhcp-4.2.2b1/common/upf.c.cloexec dhcp-4.2.2b1/common/upf.c
  		if (sock < 0) {
  			if (errno == EBUSY) {
  				continue;
-diff -up dhcp-4.2.2b1/dst/dst_api.c.cloexec dhcp-4.2.2b1/dst/dst_api.c
---- dhcp-4.2.2b1/dst/dst_api.c.cloexec	2009-10-29 01:46:48.000000000 +0100
-+++ dhcp-4.2.2b1/dst/dst_api.c	2011-07-01 14:13:31.035887670 +0200
-@@ -437,7 +437,7 @@ dst_s_write_private_key(const DST_KEY *k
- 			     PRIVATE_KEY, PATH_MAX);
- 
- 	/* Do not overwrite an existing file */
--	if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
-+	if ((fp = dst_s_fopen(file, "we", 0600)) != NULL) {
- 		int nn;
- 		if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
- 			EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
-@@ -494,7 +494,7 @@ dst_s_read_public_key(const char *in_nam
- 	 * flags, proto, alg stored as decimal (or hex numbers FIXME).
- 	 * (FIXME: handle parentheses for line continuation.)
- 	 */
--	if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
-+	if ((fp = dst_s_fopen(name, "re", 0)) == NULL) {
- 		EREPORT(("dst_read_public_key(): Public Key not found %s\n",
- 			 name));
- 		return (NULL);
-@@ -620,7 +620,7 @@ dst_s_write_public_key(const DST_KEY *ke
- 		return (0);
- 	}
- 	/* create public key file */
--	if ((fp = dst_s_fopen(filename, "w+", 0644)) == NULL) {
-+	if ((fp = dst_s_fopen(filename, "w+e", 0644)) == NULL) {
- 		EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
- 			 filename, errno));
- 		return (0);
-@@ -854,7 +854,7 @@ dst_s_read_private_key_file(char *name, 
- 		return (0);
- 	}
- 	/* first check if we can find the key file */
--	if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
-+	if ((fp = dst_s_fopen(filename, "re", 0)) == NULL) {
- 		EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
- 			 filename, dst_path[0] ? dst_path :
- 			 (char *) getcwd(NULL, PATH_MAX - 1)));
-diff -up dhcp-4.2.2b1/dst/prandom.c.cloexec dhcp-4.2.2b1/dst/prandom.c
---- dhcp-4.2.2b1/dst/prandom.c.cloexec	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/dst/prandom.c	2011-07-01 14:13:31.035887670 +0200
-@@ -269,7 +269,7 @@ get_dev_random(u_char *output, unsigned 
- 
- 	s = stat("/dev/random", &st);
- 	if (s == 0 && S_ISCHR(st.st_mode)) {
--		if ((fd = open("/dev/random", O_RDONLY | O_NONBLOCK)) != -1) {
-+		if ((fd = open("/dev/random", O_RDONLY | O_NONBLOCK | O_CLOEXEC)) != -1) {
- 			if ((n = read(fd, output, size)) < 0)
- 				n = 0;
- 			close(fd);
-@@ -480,7 +480,7 @@ digest_file(dst_work *work) 
- 		work->file_digest = dst_free_key(work->file_digest);
- 		return (0);
- 	}
--	if ((fp = fopen(name, "r")) == NULL) 
-+	if ((fp = fopen(name, "re")) == NULL) 
- 		return (0);
- 	for (no = 0; (i = fread(buf, sizeof(*buf), sizeof(buf), fp)) > 0; 
- 	     no += i) 
-diff -up dhcp-4.2.2b1/omapip/trace.c.cloexec dhcp-4.2.2b1/omapip/trace.c
---- dhcp-4.2.2b1/omapip/trace.c.cloexec	2010-05-27 02:34:57.000000000 +0200
-+++ dhcp-4.2.2b1/omapip/trace.c	2011-07-01 14:13:31.036887669 +0200
-@@ -141,10 +141,10 @@ isc_result_t trace_begin (const char *fi
+diff -up dhcp-4.3.0a1/omapip/trace.c.cloexec dhcp-4.3.0a1/omapip/trace.c
+--- dhcp-4.3.0a1/omapip/trace.c.cloexec	2013-12-11 01:01:03.000000000 +0100
++++ dhcp-4.3.0a1/omapip/trace.c	2013-12-19 15:34:41.663885900 +0100
+@@ -142,10 +142,10 @@ isc_result_t trace_begin (const char *fi
  		return DHCP_R_INVALIDARG;
  	}
  
@@ -278,7 +197,7 @@ diff -up dhcp-4.2.2b1/omapip/trace.c.cloexec dhcp-4.2.2b1/omapip/trace.c
  				     0600);
  	}
  
-@@ -431,7 +431,7 @@ void trace_file_replay (const char *file
+@@ -433,7 +433,7 @@ void trace_file_replay (const char *file
  	isc_result_t result;
  	int len;
  
@@ -287,10 +206,10 @@ diff -up dhcp-4.2.2b1/omapip/trace.c.cloexec dhcp-4.2.2b1/omapip/trace.c
  	if (!traceinfile) {
  		log_error("Can't open tracefile %s: %m", filename);
  		return;
-diff -up dhcp-4.2.2b1/relay/dhcrelay.c.cloexec dhcp-4.2.2b1/relay/dhcrelay.c
---- dhcp-4.2.2b1/relay/dhcrelay.c.cloexec	2011-05-10 15:07:37.000000000 +0200
-+++ dhcp-4.2.2b1/relay/dhcrelay.c	2011-07-01 14:18:07.630209767 +0200
-@@ -183,11 +183,11 @@ main(int argc, char **argv) {
+diff -up dhcp-4.3.0a1/relay/dhcrelay.c.cloexec dhcp-4.3.0a1/relay/dhcrelay.c
+--- dhcp-4.3.0a1/relay/dhcrelay.c.cloexec	2013-12-13 22:26:21.000000000 +0100
++++ dhcp-4.3.0a1/relay/dhcrelay.c	2013-12-19 15:34:41.664885886 +0100
+@@ -193,11 +193,11 @@ main(int argc, char **argv) {
  	/* Make sure that file descriptors 0(stdin), 1,(stdout), and
  	   2(stderr) are open. To do this, we assume that when we
  	   open a file the lowest available file descriptor is used. */
@@ -305,7 +224,7 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.cloexec dhcp-4.2.2b1/relay/dhcrelay.c
  	if (fd == 2)
  		log_perror = 0; /* No sense logging to /dev/null. */
  	else if (fd != -1)
-@@ -540,13 +540,13 @@ main(int argc, char **argv) {
+@@ -564,13 +564,13 @@ main(int argc, char **argv) {
  
  		if (no_pid_file == ISC_FALSE) {
  			pfdesc = open(path_dhcrelay_pid,
@@ -321,10 +240,10 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.cloexec dhcp-4.2.2b1/relay/dhcrelay.c
  				if (!pf)
  					log_error("Can't fdopen %s: %m",
  						  path_dhcrelay_pid);
-diff -up dhcp-4.2.2b1/server/confpars.c.cloexec dhcp-4.2.2b1/server/confpars.c
---- dhcp-4.2.2b1/server/confpars.c.cloexec	2010-10-14 00:34:45.000000000 +0200
-+++ dhcp-4.2.2b1/server/confpars.c	2011-07-01 14:13:31.039887666 +0200
-@@ -116,7 +116,7 @@ isc_result_t read_conf_file (const char 
+diff -up dhcp-4.3.0a1/server/confpars.c.cloexec dhcp-4.3.0a1/server/confpars.c
+--- dhcp-4.3.0a1/server/confpars.c.cloexec	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/confpars.c	2013-12-19 15:34:41.665885871 +0100
+@@ -117,7 +117,7 @@ isc_result_t read_conf_file (const char
  	}
  #endif
  
@@ -333,10 +252,10 @@ diff -up dhcp-4.2.2b1/server/confpars.c.cloexec dhcp-4.2.2b1/server/confpars.c
  		if (leasep) {
  			log_error ("Can't open lease database %s: %m --",
  				   path_dhcpd_db);
-diff -up dhcp-4.2.2b1/server/db.c.cloexec dhcp-4.2.2b1/server/db.c
---- dhcp-4.2.2b1/server/db.c.cloexec	2010-09-14 00:15:26.000000000 +0200
-+++ dhcp-4.2.2b1/server/db.c	2011-07-01 14:13:31.040887665 +0200
-@@ -1035,7 +1035,7 @@ void db_startup (testp)
+diff -up dhcp-4.3.0a1/server/db.c.cloexec dhcp-4.3.0a1/server/db.c
+--- dhcp-4.3.0a1/server/db.c.cloexec	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/db.c	2013-12-19 15:34:41.666885857 +0100
+@@ -1081,7 +1081,7 @@ void db_startup (testp)
  	}
  #endif
  	if (!testp) {
@@ -345,7 +264,7 @@ diff -up dhcp-4.2.2b1/server/db.c.cloexec dhcp-4.2.2b1/server/db.c
  		if (!db_file)
  			log_fatal ("Can't open %s for append.", path_dhcpd_db);
  		expire_all_pools ();
-@@ -1083,12 +1083,12 @@ int new_lease_file ()
+@@ -1129,12 +1129,12 @@ int new_lease_file ()
  		     path_dhcpd_db, (int)t) >= sizeof newfname)
  		log_fatal("new_lease_file: lease file path too long");
  
@@ -360,10 +279,10 @@ diff -up dhcp-4.2.2b1/server/db.c.cloexec dhcp-4.2.2b1/server/db.c
  		log_error("Can't fdopen new lease file: %m");
  		close(db_fd);
  		goto fdfail;
-diff -up dhcp-4.2.2b1/server/dhcpd.c.cloexec dhcp-4.2.2b1/server/dhcpd.c
---- dhcp-4.2.2b1/server/dhcpd.c.cloexec	2011-04-21 16:08:15.000000000 +0200
-+++ dhcp-4.2.2b1/server/dhcpd.c	2011-07-01 14:19:40.354124505 +0200
-@@ -270,11 +270,11 @@ main(int argc, char **argv) {
+diff -up dhcp-4.3.0a1/server/dhcpd.c.cloexec dhcp-4.3.0a1/server/dhcpd.c
+--- dhcp-4.3.0a1/server/dhcpd.c.cloexec	2013-12-13 22:26:01.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcpd.c	2013-12-19 15:37:17.258674472 +0100
+@@ -193,11 +193,11 @@ main(int argc, char **argv) {
          /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
             2 (stderr) are open. To do this, we assume that when we
             open a file the lowest available file descriptor is used. */
@@ -378,7 +297,7 @@ diff -up dhcp-4.2.2b1/server/dhcpd.c.cloexec dhcp-4.2.2b1/server/dhcpd.c
          if (fd == 2)
                  log_perror = 0; /* No sense logging to /dev/null. */
          else if (fd != -1)
-@@ -793,7 +793,7 @@ main(int argc, char **argv) {
+@@ -716,7 +716,7 @@ main(int argc, char **argv) {
  	 */
  	if (no_pid_file == ISC_FALSE) {
  		/*Read previous pid file. */
@@ -387,7 +306,7 @@ diff -up dhcp-4.2.2b1/server/dhcpd.c.cloexec dhcp-4.2.2b1/server/dhcpd.c
  			status = read(i, pbuf, (sizeof pbuf) - 1);
  			close (i);
  			if (status > 0) {
-@@ -812,7 +812,7 @@ main(int argc, char **argv) {
+@@ -735,7 +735,7 @@ main(int argc, char **argv) {
  		}
  
  		/* Write new pid file. */
@@ -396,23 +315,23 @@ diff -up dhcp-4.2.2b1/server/dhcpd.c.cloexec dhcp-4.2.2b1/server/dhcpd.c
  		if (i >= 0) {
  			sprintf(pbuf, "%d\n", (int) getpid());
  			IGNORE_RET (write(i, pbuf, strlen(pbuf)));
-@@ -840,9 +840,9 @@ main(int argc, char **argv) {
-                 close(2);
+@@ -763,9 +763,9 @@ main(int argc, char **argv) {
+                 (void) close(2);
  
                  /* Reopen them on /dev/null. */
--                open("/dev/null", O_RDWR);
--                open("/dev/null", O_RDWR);
--                open("/dev/null", O_RDWR);
-+                open("/dev/null", O_RDWR | O_CLOEXEC);
-+                open("/dev/null", O_RDWR | O_CLOEXEC);
-+                open("/dev/null", O_RDWR | O_CLOEXEC);
+-                (void) open("/dev/null", O_RDWR);
+-                (void) open("/dev/null", O_RDWR);
+-                (void) open("/dev/null", O_RDWR);
++                (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++                (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++                (void) open("/dev/null", O_RDWR | O_CLOEXEC);
                  log_perror = 0; /* No sense logging to /dev/null. */
  
         		IGNORE_RET (chdir("/"));
-diff -up dhcp-4.2.2b1/server/ldap.c.cloexec dhcp-4.2.2b1/server/ldap.c
---- dhcp-4.2.2b1/server/ldap.c.cloexec	2010-03-25 16:26:58.000000000 +0100
-+++ dhcp-4.2.2b1/server/ldap.c	2011-07-01 14:13:31.043887665 +0200
-@@ -685,7 +685,7 @@ ldap_start (void)
+diff -up dhcp-4.3.0a1/server/ldap.c.cloexec dhcp-4.3.0a1/server/ldap.c
+--- dhcp-4.3.0a1/server/ldap.c.cloexec	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/ldap.c	2013-12-19 15:34:41.667885843 +0100
+@@ -684,7 +684,7 @@ ldap_start (void)
  
    if (ldap_debug_file != NULL && ldap_debug_fd == -1)
      {
diff --git a/src/patches/dhcp-4.2.0-PPP.patch b/src/patches/dhcp/dhcp-PPP.patch
similarity index 59%
rename from src/patches/dhcp-4.2.0-PPP.patch
rename to src/patches/dhcp/dhcp-PPP.patch
index bef2be7f08..5d022e4320 100644
--- a/src/patches/dhcp-4.2.0-PPP.patch
+++ b/src/patches/dhcp/dhcp-PPP.patch
@@ -1,7 +1,31 @@
-diff -up dhcp-4.2.0-P1/client/dhc6.c.PPP dhcp-4.2.0-P1/client/dhc6.c
---- dhcp-4.2.0-P1/client/dhc6.c.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/client/dhc6.c	2010-11-09 15:54:12.000000000 +0100
-@@ -129,7 +129,7 @@ extern int stateless;
+diff -up dhcp-4.3.1b1/client/dhc6.c.mRfpsB dhcp-4.3.1b1/client/dhc6.c
+--- dhcp-4.3.1b1/client/dhc6.c.mRfpsB	2014-07-10 17:48:03.779424870 +0200
++++ dhcp-4.3.1b1/client/dhc6.c	2014-07-10 17:48:03.795424644 +0200
+@@ -5088,7 +5088,8 @@ make_client6_options(struct client_state
+ 	 */
+ 	if ((oc = lookup_option(&dhcpv6_universe, *op,
+ 				D6O_CLIENTID)) == NULL) {
+-		if (!option_cache(&oc, &default_duid, NULL, clientid_option,
++		if (default_duid.len == 0 ||
++		    !option_cache(&oc, &default_duid, NULL, clientid_option,
+ 				  MDL))
+ 			log_fatal("Failure assembling a DUID.");
+ 
+diff -up dhcp-4.3.1b1/client/dhclient.c.mRfpsB dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.mRfpsB	2014-07-10 17:39:25.853763858 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:49:49.882925843 +0200
+@@ -948,8 +948,8 @@ main(int argc, char **argv) {
+ 			if (default_duid.buffer != NULL)
+ 				data_string_forget(&default_duid, MDL);
+ 
+-			form_duid(&default_duid, MDL);
+-			write_duid(&default_duid);
++			if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS)
++				write_duid(&default_duid);
+ 		}
+ 	}
+ 
+@@ -3267,7 +3267,7 @@ write_options(struct client_state *clien
   * is not how it is intended.  Upcoming rearchitecting the client should
   * address this "one daemon model."
   */
@@ -10,7 +34,7 @@ diff -up dhcp-4.2.0-P1/client/dhc6.c.PPP dhcp-4.2.0-P1/client/dhc6.c
  form_duid(struct data_string *duid, const char *file, int line)
  {
  	struct interface_info *ip;
-@@ -141,6 +141,15 @@ form_duid(struct data_string *duid, cons
+@@ -3280,6 +3280,15 @@ form_duid(struct data_string *duid, cons
  	if (ip == NULL)
  		log_fatal("Impossible condition at %s:%d.", MDL);
  
@@ -26,43 +50,19 @@ diff -up dhcp-4.2.0-P1/client/dhc6.c.PPP dhcp-4.2.0-P1/client/dhc6.c
  	if ((ip->hw_address.hlen == 0) ||
  	    (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf)))
  		log_fatal("Impossible hardware address length at %s:%d.", MDL);
-@@ -176,6 +185,8 @@ form_duid(struct data_string *duid, cons
- 		memcpy(duid->buffer->data + 4, ip->hw_address.hbuf + 1,
- 		       ip->hw_address.hlen - 1);
+@@ -3323,6 +3332,8 @@ form_duid(struct data_string *duid, cons
+ 		log_info("Created duid %s.", str);
+ 		dfree(str, MDL);
  	}
-+
++	
 +	return ISC_R_SUCCESS;
  }
  
- /*
-@@ -5289,7 +5300,8 @@ make_client6_options(struct client_state
- 	 */
- 	if ((oc = lookup_option(&dhcpv6_universe, *op,
- 				D6O_CLIENTID)) == NULL) {
--		if (!option_cache(&oc, &default_duid, NULL, clientid_option,
-+		if (default_duid.len == 0 ||
-+		    !option_cache(&oc, &default_duid, NULL, clientid_option,
- 				  MDL))
- 			log_fatal("Failure assembling a DUID.");
- 
-diff -up dhcp-4.2.0-P1/client/dhclient.c.PPP dhcp-4.2.0-P1/client/dhclient.c
---- dhcp-4.2.0-P1/client/dhclient.c.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/client/dhclient.c	2010-11-09 15:37:26.000000000 +0100
-@@ -911,8 +911,8 @@ main(int argc, char **argv) {
- 			if (default_duid.buffer != NULL)
- 				data_string_forget(&default_duid, MDL);
- 
--			form_duid(&default_duid, MDL);
--			write_duid(&default_duid);
-+			if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS)
-+				write_duid(&default_duid);
- 		}
- 
- 		for (ip = interfaces ; ip != NULL ; ip = ip->next) {
-diff -up dhcp-4.2.0-P1/common/bpf.c.PPP dhcp-4.2.0-P1/common/bpf.c
---- dhcp-4.2.0-P1/common/bpf.c.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/common/bpf.c	2010-11-09 15:42:42.000000000 +0100
-@@ -599,6 +599,22 @@ get_hw_addr(const char *name, struct har
+ /* Write the default DUID to the lease store. */
+diff -up dhcp-4.3.1b1/common/bpf.c.mRfpsB dhcp-4.3.1b1/common/bpf.c
+--- dhcp-4.3.1b1/common/bpf.c.mRfpsB	2014-07-10 17:39:25.797764653 +0200
++++ dhcp-4.3.1b1/common/bpf.c	2014-07-10 17:48:03.797424616 +0200
+@@ -600,6 +600,22 @@ get_hw_addr(const char *name, struct har
                          memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen);
                          break;
  #endif /* IFT_FDDI */
@@ -85,12 +85,12 @@ diff -up dhcp-4.2.0-P1/common/bpf.c.PPP dhcp-4.2.0-P1/common/bpf.c
                  default:
                          log_fatal("Unsupported device type %d for \"%s\"",
                                    sa->sdl_type, name);
-diff -up dhcp-4.2.0-P1/common/lpf.c.PPP dhcp-4.2.0-P1/common/lpf.c
---- dhcp-4.2.0-P1/common/lpf.c.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/common/lpf.c	2010-11-09 15:45:40.000000000 +0100
-@@ -502,6 +502,22 @@ get_hw_addr(const char *name, struct har
+diff -up dhcp-4.3.1b1/common/lpf.c.mRfpsB dhcp-4.3.1b1/common/lpf.c
+--- dhcp-4.3.1b1/common/lpf.c.mRfpsB	2014-07-10 17:39:25.744765404 +0200
++++ dhcp-4.3.1b1/common/lpf.c	2014-07-10 17:48:03.797424616 +0200
+@@ -511,6 +511,22 @@ get_hw_addr(const char *name, struct har
  			hw->hbuf[0] = HTYPE_FDDI;
- 			memcpy(&hw->hbuf[1], sa->sa_data, 16);
+ 			memcpy(&hw->hbuf[1], sa->sa_data, 6);
  			break;
 +#if defined(ARPHRD_PPP)
 +		case ARPHRD_PPP:
@@ -111,34 +111,34 @@ diff -up dhcp-4.2.0-P1/common/lpf.c.PPP dhcp-4.2.0-P1/common/lpf.c
  		default:
  			log_fatal("Unsupported device type %ld for \"%s\"",
  				  (long int)sa->sa_family, name);
-diff -up dhcp-4.2.0-P1/includes/dhcpd.h.PPP dhcp-4.2.0-P1/includes/dhcpd.h
---- dhcp-4.2.0-P1/includes/dhcpd.h.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/includes/dhcpd.h	2010-11-09 15:46:58.000000000 +0100
-@@ -2733,7 +2733,7 @@ void dhcpv4_client_assignments(void);
- void dhcpv6_client_assignments(void);
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB	2014-07-10 17:48:03.761425124 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h	2014-07-10 17:48:03.798424601 +0200
+@@ -2839,7 +2839,7 @@ void client_dns_remove(struct client_sta
  
- /* dhc6.c */
+ void dhcpv4_client_assignments(void);
+ void dhcpv6_client_assignments(void);
 -void form_duid(struct data_string *duid, const char *file, int line);
 +isc_result_t form_duid(struct data_string *duid, const char *file, int line);
+ 
+ /* dhc6.c */
  void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line);
- void start_init6(struct client_state *client);
- void start_info_request6(struct client_state *client);
-diff -up dhcp-4.2.0-P1/includes/dhcp.h.PPP dhcp-4.2.0-P1/includes/dhcp.h
---- dhcp-4.2.0-P1/includes/dhcp.h.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/includes/dhcp.h	2010-11-09 15:48:53.000000000 +0100
-@@ -80,6 +80,8 @@ struct dhcp_packet {
- #define HTYPE_IEEE802	6               /* IEEE 802.2 Token Ring...	*/
- #define HTYPE_FDDI	8		/* FDDI...			*/
+diff -up dhcp-4.3.1b1/includes/dhcp.h.mRfpsB dhcp-4.3.1b1/includes/dhcp.h
+--- dhcp-4.3.1b1/includes/dhcp.h.mRfpsB	2014-07-10 17:48:03.761425124 +0200
++++ dhcp-4.3.1b1/includes/dhcp.h	2014-07-10 17:48:03.798424601 +0200
+@@ -81,6 +81,8 @@ struct dhcp_packet {
+ 					 * is no standard for this so we
+ 					 * just steal a type            */
  
-+#define HTYPE_RESERVED  0               /* RFC 5494 */
++#define HTYPE_RESERVED	0		/* RFC 5494 */
 +
  /* Magic cookie validating dhcp options field (and bootp vendor
     extensions field). */
  #define DHCP_OPTIONS_COOKIE	"\143\202\123\143"
-diff -up dhcp-4.2.0-P1/server/dhcpv6.c.PPP dhcp-4.2.0-P1/server/dhcpv6.c
---- dhcp-4.2.0-P1/server/dhcpv6.c.PPP	2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/server/dhcpv6.c	2010-11-09 15:50:17.000000000 +0100
-@@ -300,6 +300,9 @@ generate_new_server_duid(void) {
+diff -up dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB dhcp-4.3.1b1/server/dhcpv6.c
+--- dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB	2014-07-10 17:47:31.464881409 +0200
++++ dhcp-4.3.1b1/server/dhcpv6.c	2014-07-10 17:48:03.800424573 +0200
+@@ -330,6 +330,9 @@ generate_new_server_duid(void) {
  		if (p->hw_address.hlen > 0) {
  			break;
  		}
diff --git a/src/patches/dhcp-4.2.0-UseMulticast.patch b/src/patches/dhcp/dhcp-UseMulticast.patch
similarity index 83%
rename from src/patches/dhcp-4.2.0-UseMulticast.patch
rename to src/patches/dhcp/dhcp-UseMulticast.patch
index 319344aa5d..ee0ea6b9af 100644
--- a/src/patches/dhcp-4.2.0-UseMulticast.patch
+++ b/src/patches/dhcp/dhcp-UseMulticast.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
---- dhcp-4.2.0/server/dhcpv6.c.UseMulticast	2010-06-01 19:30:00.000000000 +0200
-+++ dhcp-4.2.0/server/dhcpv6.c	2010-07-21 16:17:30.000000000 +0200
-@@ -346,6 +346,48 @@ generate_new_server_duid(void) {
+diff -up dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast dhcp-4.3.1b1/server/dhcpv6.c
+--- dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast	2014-07-02 19:58:40.000000000 +0200
++++ dhcp-4.3.1b1/server/dhcpv6.c	2014-07-10 18:20:03.066256219 +0200
+@@ -376,6 +376,48 @@ generate_new_server_duid(void) {
  }
  
  /*
@@ -35,7 +35,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
 +		}
 +
 +		execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL,
-+				opt_state, &global_scope, root_group, NULL);
++			     opt_state, &global_scope, root_group, NULL, NULL);
 +
 +		oc = lookup_option(&dhcpv6_universe, opt_state, D6O_UNICAST);
 +		unicast_option_defined = (oc != NULL);
@@ -50,8 +50,21 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
   * Get the client identifier from the packet.
   */
  isc_result_t
-@@ -1405,6 +1447,56 @@ lease_to_client(struct data_string *repl
- 						    reply.shared->group);
+@@ -706,6 +748,12 @@ static const int required_opts[] = {
+ 	D6O_PREFERENCE,
+ 	0
+ };
++static const int required_opts_NAA[] = {
++	D6O_CLIENTID,
++	D6O_SERVERID,
++	D6O_STATUS_CODE,
++	0
++};
+ static const int required_opts_solicit[] = {
+ 	D6O_CLIENTID,
+ 	D6O_SERVERID,
+@@ -1587,6 +1635,56 @@ lease_to_client(struct data_string *repl
+ 						    reply.shared->group, NULL);
  	}
  
 +	/* reject unicast message, unless we set unicast option */
@@ -102,21 +115,20 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
 +					reply.opt_state, reply.packet,
 +					required_opts_NAA,
 +					NULL);
-+	} else if (no_resources_avail && (reply.ia_count != 0) &&
-+	    (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
++	}
++
  	/*
  	 * RFC3315 section 17.2.2 (Solicit):
  	 *
-@@ -1429,8 +1521,6 @@ lease_to_client(struct data_string *repl
- 	 * the server.
- 	 * Sends a Renew/Rebind if the IA is not in the Reply message.
+@@ -1619,6 +1717,7 @@ lease_to_client(struct data_string *repl
+ 	 * Having stored the client's IA's, store any options that
+ 	 * will fit in the remaining space.
  	 */
--	if (no_resources_avail && (reply.ia_count != 0) &&
--	    (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
- 	{
- 		/* Set the NoAddrsAvail status code. */
- 		if (!set_status_code(STATUS_NoAddrsAvail,
-@@ -4128,7 +4218,6 @@ dhcpv6_solicit(struct data_string *reply
++	else 
+ 	reply.cursor += store_options6((char *)reply.buf.data + reply.cursor,
+ 				       sizeof(reply.buf) - reply.cursor,
+ 				       reply.opt_state, reply.packet,
+@@ -4748,7 +4847,6 @@ dhcpv6_solicit(struct data_string *reply
   * Very similar to Solicit handling, except the server DUID is required.
   */
  
@@ -124,7 +136,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
  static void
  dhcpv6_request(struct data_string *reply_ret, struct packet *packet) {
  	struct data_string client_id;
-@@ -4443,7 +4532,6 @@ exit:
+@@ -5078,7 +5176,6 @@ exit:
   * except for the error code of when addresses don't match.
   */
  
@@ -132,7 +144,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
  static void
  dhcpv6_renew(struct data_string *reply, struct packet *packet) {
  	struct data_string client_id;
-@@ -4688,18 +4776,60 @@ iterate_over_ia_na(struct data_string *r
+@@ -5322,18 +5419,60 @@ iterate_over_ia_na(struct data_string *r
  		goto exit;
  	}
  
@@ -203,7 +215,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
  
  	/*
  	 * Loop through the IA_NA reported by the client, and deal with
-@@ -4838,6 +4968,7 @@ iterate_over_ia_na(struct data_string *r
+@@ -5471,6 +5610,7 @@ iterate_over_ia_na(struct data_string *r
  	/* 
  	 * Return our reply to the caller.
  	 */
@@ -211,7 +223,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
  	reply_ret->len = reply_ofs;
  	reply_ret->buffer = NULL;
  	if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) {
-@@ -4883,7 +5014,6 @@ exit:
+@@ -5516,7 +5656,6 @@ exit:
   * we still need to be aware of this possibility.
   */
  
@@ -219,7 +231,7 @@ diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
  /* TODO: IA_TA */
  static void
  dhcpv6_decline(struct data_string *reply, struct packet *packet) {
-@@ -5355,7 +5485,6 @@ exit:
+@@ -5986,7 +6125,6 @@ exit:
   * Release means a client is done with the leases.
   */
  
diff --git a/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch b/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
new file mode 100644
index 0000000000..103824c384
--- /dev/null
+++ b/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
@@ -0,0 +1,14 @@
+diff -up dhcp-4.3.0a1/common/dispatch.c.dracut dhcp-4.3.0a1/common/dispatch.c
+--- dhcp-4.3.0a1/common/dispatch.c.dracut	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/dispatch.c	2013-12-19 15:39:50.350505860 +0100
+@@ -210,6 +210,10 @@ void add_timeout (when, where, what, ref
+ 	isc_interval_t interval;
+ 	isc_time_t expires;
+ 
++	if (when == NULL) {
++		return;
++	}
++
+ 	/* See if this timeout supersedes an existing timeout. */
+ 	t = (struct timeout *)0;
+ 	for (q = timeouts; q; q = q->next) {
diff --git a/src/patches/dhcp-4.2.2-capability.patch b/src/patches/dhcp/dhcp-capability.patch
similarity index 51%
rename from src/patches/dhcp-4.2.2-capability.patch
rename to src/patches/dhcp/dhcp-capability.patch
index 79af036f2a..91a1baef52 100644
--- a/src/patches/dhcp-4.2.2-capability.patch
+++ b/src/patches/dhcp/dhcp-capability.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.2b1/client/dhclient.8.capability dhcp-4.2.2b1/client/dhclient.8
---- dhcp-4.2.2b1/client/dhclient.8.capability	2011-07-01 15:09:06.603784531 +0200
-+++ dhcp-4.2.2b1/client/dhclient.8	2011-07-01 15:09:06.663783913 +0200
-@@ -118,6 +118,9 @@ dhclient - Dynamic Host Configuration Pr
+diff -up dhcp-4.3.1b1/client/dhclient.8.zzftXp dhcp-4.3.1b1/client/dhclient.8
+--- dhcp-4.3.1b1/client/dhclient.8.zzftXp	2014-07-10 17:38:26.938599402 +0200
++++ dhcp-4.3.1b1/client/dhclient.8	2014-07-10 17:39:25.852763873 +0200
+@@ -128,6 +128,9 @@ dhclient - Dynamic Host Configuration Pr
  .B -w
  ]
  [
@@ -11,7 +11,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.8.capability dhcp-4.2.2b1/client/dhclient.
  .B -B
  ]
  [
-@@ -296,6 +299,32 @@ has been added or removed, so that the c
+@@ -304,6 +307,32 @@ has been added or removed, so that the c
  address on that interface.
  
  .TP
@@ -44,9 +44,9 @@ diff -up dhcp-4.2.2b1/client/dhclient.8.capability dhcp-4.2.2b1/client/dhclient.
  .BI \-B
  Set the BOOTP broadcast flag in request packets so servers will always
  broadcast replies.
-diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.capability	2011-07-01 15:09:06.644784107 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c	2011-07-01 15:09:06.664783903 +0200
+diff -up dhcp-4.3.1b1/client/dhclient.c.zzftXp dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.zzftXp	2014-07-10 17:39:25.797764653 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:39:25.853763858 +0200
 @@ -39,6 +39,10 @@
  #include <limits.h>
  #include <dns/result.h>
@@ -58,7 +58,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.
  /*
   * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
   * that when building ISC code.
-@@ -141,6 +145,9 @@ main(int argc, char **argv) {
+@@ -143,6 +147,9 @@ main(int argc, char **argv) {
  	int timeout_arg = 0;
  	char *arg_conf = NULL;
  	int arg_conf_len = 0;
@@ -68,7 +68,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.
  
  	/* Initialize client globals. */
  	memset(&default_duid, 0, sizeof(default_duid));
-@@ -410,6 +417,10 @@ main(int argc, char **argv) {
+@@ -425,6 +432,10 @@ main(int argc, char **argv) {
  			}
  
  			dhclient_request_options = argv[i];
@@ -79,7 +79,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.
  		} else if (argv[i][0] == '-') {
  		    usage();
  		} else if (interfaces_requested < 0) {
-@@ -458,6 +469,19 @@ main(int argc, char **argv) {
+@@ -473,6 +484,19 @@ main(int argc, char **argv) {
  		path_dhclient_script = s;
  	}
  
@@ -99,10 +99,10 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.
  	/* Set up the initial dhcp option universe. */
  	initialize_common_option_spaces();
  
-diff -up dhcp-4.2.2b1/client/dhclient-script.8.capability dhcp-4.2.2b1/client/dhclient-script.8
---- dhcp-4.2.2b1/client/dhclient-script.8.capability	2011-07-01 15:09:06.604784521 +0200
-+++ dhcp-4.2.2b1/client/dhclient-script.8	2011-07-01 15:09:06.666783883 +0200
-@@ -239,6 +239,16 @@ repeatedly initialized to the values pro
+diff -up dhcp-4.3.1b1/client/dhclient-script.8.zzftXp dhcp-4.3.1b1/client/dhclient-script.8
+--- dhcp-4.3.1b1/client/dhclient-script.8.zzftXp	2014-07-10 17:39:25.761765163 +0200
++++ dhcp-4.3.1b1/client/dhclient-script.8	2014-07-10 17:39:25.851763887 +0200
+@@ -243,6 +243,16 @@ repeatedly initialized to the values pro
  the other.   Assuming the information provided by both servers is
  valid, this shouldn't cause any real problems, but it could be
  confusing.
@@ -119,22 +119,22 @@ diff -up dhcp-4.2.2b1/client/dhclient-script.8.capability dhcp-4.2.2b1/client/dh
  .SH SEE ALSO
  dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and
  dhclient.leases(5).
-diff -up dhcp-4.2.2b1/client/Makefile.am.capability dhcp-4.2.2b1/client/Makefile.am
---- dhcp-4.2.2b1/client/Makefile.am.capability	2011-07-01 15:09:06.526785327 +0200
-+++ dhcp-4.2.2b1/client/Makefile.am	2011-07-01 15:09:06.667783873 +0200
-@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c 
+diff -up dhcp-4.3.1b1/client/Makefile.am.zzftXp dhcp-4.3.1b1/client/Makefile.am
+--- dhcp-4.3.1b1/client/Makefile.am.zzftXp	2014-07-10 17:38:10.778828583 +0200
++++ dhcp-4.3.1b1/client/Makefile.am	2014-07-10 17:39:25.851763887 +0200
+@@ -10,7 +10,7 @@ dhclient_SOURCES = clparse.c dhclient.c
+ 		   scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
  		   scripts/netbsd scripts/nextstep scripts/openbsd \
  		   scripts/solaris scripts/openwrt
- dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--		 $(BIND9_LIBDIR) -ldns-export -lisc-export
-+		 $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
+-dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \
+ 		 $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
  man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
  EXTRA_DIST = $(man_MANS)
- 
-diff -up dhcp-4.2.2b1/configure.ac.capability dhcp-4.2.2b1/configure.ac
---- dhcp-4.2.2b1/configure.ac.capability	2011-07-01 15:09:06.527785317 +0200
-+++ dhcp-4.2.2b1/configure.ac	2011-07-01 15:09:06.667783873 +0200
-@@ -449,6 +449,41 @@ AC_TRY_LINK(
+diff -up dhcp-4.3.1b1/configure.ac.zzftXp dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.zzftXp	2014-07-10 17:38:10.779828569 +0200
++++ dhcp-4.3.1b1/configure.ac	2014-07-10 17:39:25.854763844 +0200
+@@ -499,6 +499,41 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]],
  # Look for optional headers.
  AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
  
@@ -176,11 +176,11 @@ diff -up dhcp-4.2.2b1/configure.ac.capability dhcp-4.2.2b1/configure.ac
  # Solaris needs some libraries for functions
  AC_SEARCH_LIBS(socket, [socket])
  AC_SEARCH_LIBS(inet_ntoa, [nsl])
-diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
---- dhcp-4.2.2b1/relay/dhcrelay.c.capability	2011-07-01 15:09:06.626784295 +0200
-+++ dhcp-4.2.2b1/relay/dhcrelay.c	2011-07-01 15:12:05.362223794 +0200
-@@ -36,6 +36,11 @@
- #include <syslog.h>
+diff -up dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp dhcp-4.3.1b1/relay/dhcrelay.c
+--- dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp	2014-07-10 17:39:25.799764624 +0200
++++ dhcp-4.3.1b1/relay/dhcrelay.c	2014-07-10 17:40:19.191007421 +0200
+@@ -31,6 +31,11 @@
+ #include <signal.h>
  #include <sys/time.h>
  
 +#ifdef HAVE_LIBCAP_NG
@@ -191,9 +191,9 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
  TIME default_lease_time = 43200; /* 12 hours... */
  TIME max_lease_time = 86400; /* 24 hours... */
  struct tree_cache *global_options[256];
-@@ -356,6 +361,10 @@ main(int argc, char **argv) {
- 			sl->next = upstreams;
- 			upstreams = sl;
+@@ -376,6 +381,10 @@ main(int argc, char **argv) {
+ 				usage();
+ 			dhcrelay_sub_id = argv[i];
  #endif
 +		} else if (!strcmp(argv[i], "-nc")) {
 +#ifdef HAVE_LIBCAP_NG
@@ -202,7 +202,7 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
  		} else if (!strcmp(argv[i], "-pf")) {
  			if (++i == argc)
  				usage();
-@@ -426,6 +435,17 @@ main(int argc, char **argv) {
+@@ -446,6 +455,17 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -220,8 +220,8 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
  	if (!quiet) {
  		log_info("%s %s", message, PACKAGE_VERSION);
  		log_info(copyright);
-@@ -573,6 +593,15 @@ main(int argc, char **argv) {
- 		dhcpv6_packet_handler = do_packet6;
+@@ -598,6 +618,15 @@ main(int argc, char **argv) {
+ 	signal(SIGTERM, dhcp_signal_handler);  /* kill */
  #endif
  
 +#ifdef HAVE_LIBCAP_NG
@@ -236,88 +236,15 @@ diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
  	/* Start dispatching packets and timeouts... */
  	dispatch();
  
-diff -up dhcp-4.2.2b1/relay/Makefile.am.capability dhcp-4.2.2b1/relay/Makefile.am
---- dhcp-4.2.2b1/relay/Makefile.am.capability	2011-07-01 15:09:06.546785121 +0200
-+++ dhcp-4.2.2b1/relay/Makefile.am	2011-07-01 15:09:06.670783841 +0200
-@@ -3,7 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+diff -up dhcp-4.3.1b1/relay/Makefile.am.zzftXp dhcp-4.3.1b1/relay/Makefile.am
+--- dhcp-4.3.1b1/relay/Makefile.am.zzftXp	2014-07-10 17:38:10.780828554 +0200
++++ dhcp-4.3.1b1/relay/Makefile.am	2014-07-10 17:39:25.854763844 +0200
+@@ -2,7 +2,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+ 
  sbin_PROGRAMS = dhcrelay
  dhcrelay_SOURCES = dhcrelay.c
- dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--		 $(BIND9_LIBDIR) -ldns-export -lisc-export
-+		 $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
+-dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \
+ 		 $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
  man_MANS = dhcrelay.8
  EXTRA_DIST = $(man_MANS)
- 
-diff -up dhcp-4.2.2b1/server/dhcpd.c.capability dhcp-4.2.2b1/server/dhcpd.c
---- dhcp-4.2.2b1/server/dhcpd.c.capability	2011-07-01 15:09:06.636784192 +0200
-+++ dhcp-4.2.2b1/server/dhcpd.c	2011-07-01 15:09:06.670783841 +0200
-@@ -58,6 +58,11 @@ static const char url [] =
- #  undef group
- #endif /* PARANOIA */
- 
-+#ifdef HAVE_LIBCAP_NG
-+#  include <cap-ng.h>
-+   int keep_capabilities = 0;
-+#endif
-+
- static void usage(void);
- 
- struct iaddr server_identifier;
-@@ -403,6 +408,10 @@ main(int argc, char **argv) {
- 			traceinfile = argv [i];
- 			trace_replay_init ();
- #endif /* TRACING */
-+		} else if (!strcmp(argv[i], "-nc")) {
-+#ifdef HAVE_LIBCAP_NG
-+			keep_capabilities = 1;
-+#endif
- 		} else if (argv [i][0] == '-') {
- 			usage ();
- 		} else {
-@@ -459,6 +468,17 @@ main(int argc, char **argv) {
-         }
- #endif /* DHCPv6 */
- 
-+#ifdef HAVE_LIBCAP_NG
-+	/* Drop capabilities */
-+	if (!keep_capabilities) {
-+		capng_clear(CAPNG_SELECT_BOTH);
-+		capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+				CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT, CAP_SETUID, CAP_SETGID, -1);
-+		capng_apply(CAPNG_SELECT_BOTH);
-+		log_info ("Dropped all unnecessary capabilities.");
-+	}
-+#endif
-+
-         /*
-          * convert relative path names to absolute, for files that need
-          * to be reopened after chdir() has been called
-@@ -859,6 +879,15 @@ main(int argc, char **argv) {
- 	omapi_set_int_value ((omapi_object_t *)dhcp_control_object,
- 			     (omapi_object_t *)0, "state", server_running);
- 
-+#ifdef HAVE_LIBCAP_NG
-+	/* Drop all capabilities */
-+	if (!keep_capabilities) {
-+		capng_clear(CAPNG_SELECT_BOTH);
-+		capng_apply(CAPNG_SELECT_BOTH);
-+		log_info ("Dropped all capabilities.");
-+	}
-+#endif
-+
- 	/* Receive packets and dispatch them... */
- 	dispatch ();
- 
-diff -up dhcp-4.2.2b1/server/Makefile.am.capability dhcp-4.2.2b1/server/Makefile.am
---- dhcp-4.2.2b1/server/Makefile.am.capability	2011-07-01 15:09:06.546785121 +0200
-+++ dhcp-4.2.2b1/server/Makefile.am	2011-07-01 15:09:06.671783830 +0200
-@@ -8,7 +8,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
- 
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
- dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
--	      ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-+	      ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export \
-+	      $(CAPNG_LDADD)
- 
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
- EXTRA_DIST = $(man_MANS)
diff --git a/src/patches/dhcp-4.2.0-default-requested-options.patch b/src/patches/dhcp/dhcp-default-requested-options.patch
similarity index 81%
rename from src/patches/dhcp-4.2.0-default-requested-options.patch
rename to src/patches/dhcp/dhcp-default-requested-options.patch
index fea8a4b99c..afda222e65 100644
--- a/src/patches/dhcp-4.2.0-default-requested-options.patch
+++ b/src/patches/dhcp/dhcp-default-requested-options.patch
@@ -1,6 +1,6 @@
-diff -up dhcp-4.2.0/client/clparse.c.requested dhcp-4.2.0/client/clparse.c
---- dhcp-4.2.0/client/clparse.c.requested	2010-07-21 13:29:05.000000000 +0200
-+++ dhcp-4.2.0/client/clparse.c	2010-07-21 13:50:29.000000000 +0200
+diff -up dhcp-4.3.0a1/client/clparse.c.requested dhcp-4.3.0a1/client/clparse.c
+--- dhcp-4.3.0a1/client/clparse.c.requested	2013-12-19 15:13:27.276631307 +0100
++++ dhcp-4.3.0a1/client/clparse.c	2013-12-19 15:13:27.313630789 +0100
 @@ -37,7 +37,7 @@
  
  struct client_config top_level_config;
@@ -10,7 +10,7 @@ diff -up dhcp-4.2.0/client/clparse.c.requested dhcp-4.2.0/client/clparse.c
  struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
  
  static void parse_client_default_duid(struct parse *cfile);
-@@ -111,6 +111,31 @@ isc_result_t read_client_conf ()
+@@ -119,6 +119,31 @@ isc_result_t read_client_conf ()
  	option_code_hash_lookup(&default_requested_options[8],
  				dhcpv6_universe.code_hash, &code, 0, MDL);
  
diff --git a/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch b/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
similarity index 58%
rename from src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
rename to src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
index 81bec7bd47..3e52e6400e 100644
--- a/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
+++ b/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.backoff	2010-07-21 13:37:03.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c	2010-07-21 13:38:31.000000000 +0200
-@@ -1208,6 +1208,8 @@ void state_init (cpp)
+diff -up dhcp-4.3.1b1/client/dhclient.c.JwFUZj dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.JwFUZj	2014-07-10 17:38:50.511265091 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:39:16.164901267 +0200
+@@ -1281,6 +1281,8 @@ void state_init (cpp)
  	void *cpp;
  {
  	struct client_state *client = cpp;
@@ -10,7 +10,7 @@ diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c
  
  	ASSERT_STATE(state, S_INIT);
  
-@@ -1220,9 +1222,18 @@ void state_init (cpp)
+@@ -1293,9 +1295,18 @@ void state_init (cpp)
  	client -> first_sending = cur_time;
  	client -> interval = client -> config -> initial_interval;
  
@@ -32,15 +32,15 @@ diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c
  }
  
  /*
-@@ -1501,6 +1512,7 @@ void bind_lease (client)
- 		send_decline (client);
- 		destroy_client_lease (client -> new);
- 		client -> new = (struct client_lease *)0;
-+		client -> state = S_DECLINED;
- 		state_init (client);
- 		return;
- 	}
-@@ -3711,6 +3723,7 @@ void client_location_changed ()
+@@ -1592,6 +1603,7 @@ void bind_lease (client)
+ 					 "try (declined).  Exiting.");
+ 			exit(2);
+ 		} else {
++			client -> state = S_DECLINED;
+ 			state_init(client);
+ 			return;
+ 		}
+@@ -4059,6 +4071,7 @@ void client_location_changed ()
  			      case S_INIT:
  			      case S_REBINDING:
  			      case S_STOPPED:
@@ -48,10 +48,10 @@ diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c
  				break;
  			}
  			client -> state = S_INIT;
-diff -up dhcp-4.2.0/includes/dhcpd.h.backoff dhcp-4.2.0/includes/dhcpd.h
---- dhcp-4.2.0/includes/dhcpd.h.backoff	2010-07-21 13:29:05.000000000 +0200
-+++ dhcp-4.2.0/includes/dhcpd.h	2010-07-21 13:38:31.000000000 +0200
-@@ -1056,7 +1056,8 @@ enum dhcp_state {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj	2014-07-10 17:38:26.941599360 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h	2014-07-10 17:38:50.526264878 +0200
+@@ -1087,7 +1087,8 @@ enum dhcp_state {
  	S_BOUND = 5,
  	S_RENEWING = 6,
  	S_REBINDING = 7,
diff --git a/src/patches/dhcp-4.2.2-options.patch b/src/patches/dhcp/dhcp-dhclient-options.patch
similarity index 65%
rename from src/patches/dhcp-4.2.2-options.patch
rename to src/patches/dhcp/dhcp-dhclient-options.patch
index 32e2add776..67f144ecb7 100644
--- a/src/patches/dhcp-4.2.2-options.patch
+++ b/src/patches/dhcp/dhcp-dhclient-options.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.options dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.options	2011-04-21 16:08:14.000000000 +0200
-+++ dhcp-4.2.2b1/client/clparse.c	2011-07-01 13:51:52.935755570 +0200
-@@ -146,6 +146,7 @@ isc_result_t read_client_conf ()
+diff -up dhcp-4.3.1b1/client/clparse.c.fLPqYB dhcp-4.3.1b1/client/clparse.c
+--- dhcp-4.3.1b1/client/clparse.c.fLPqYB	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/clparse.c	2014-07-10 17:38:26.938599402 +0200
+@@ -148,6 +148,7 @@ isc_result_t read_client_conf ()
  	/* Requested lease time, used by DHCPv6 (DHCPv4 uses the option cache)
  	 */
  	top_level_config.requested_lease = 7200;
@@ -9,7 +9,7 @@ diff -up dhcp-4.2.2b1/client/clparse.c.options dhcp-4.2.2b1/client/clparse.c
  
  	group_allocate (&top_level_config.on_receipt, MDL);
  	if (!top_level_config.on_receipt)
-@@ -313,7 +314,8 @@ void read_client_leases ()
+@@ -353,7 +354,8 @@ void read_client_leases ()
  	interface-declaration |
  	LEASE client-lease-statement |
  	ALIAS client-lease-statement |
@@ -19,7 +19,7 @@ diff -up dhcp-4.2.2b1/client/clparse.c.options dhcp-4.2.2b1/client/clparse.c
  
  void parse_client_statement (cfile, ip, config)
  	struct parse *cfile;
-@@ -732,6 +734,12 @@ void parse_client_statement (cfile, ip, 
+@@ -771,6 +773,12 @@ void parse_client_statement (cfile, ip,
  		parse_reject_statement (cfile, config);
  		return;
  
@@ -32,9 +32,116 @@ diff -up dhcp-4.2.2b1/client/clparse.c.options dhcp-4.2.2b1/client/clparse.c
  	      default:
  		lose = 0;
  		stmt = (struct executable_statement *)0;
-diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.options	2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c	2011-07-01 13:51:52.936755545 +0200
+diff -up dhcp-4.3.1b1/client/dhclient.8.fLPqYB dhcp-4.3.1b1/client/dhclient.8
+--- dhcp-4.3.1b1/client/dhclient.8.fLPqYB	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/dhclient.8	2014-07-10 17:38:26.938599402 +0200
+@@ -128,6 +128,33 @@ dhclient - Dynamic Host Configuration Pr
+ .B -w
+ ]
+ [
++.B -B
++]
++[
++.B -C
++.I dhcp-client-identifier
++]
++[
++.B -H
++.I host-name
++]
++[
++.B -F
++.I fqdn.fqdn
++]
++[
++.B -V
++.I vendor-class-identifier
++]
++[
++.B -R
++.I request-option-list
++]
++[
++.B -timeout
++.I timeout
++]
++[
+ .B -v
+ ]
+ [
+@@ -275,6 +302,69 @@ not to exit when it doesn't find any suc
+ program can then be used to notify the client when a network interface
+ has been added or removed, so that the client can attempt to configure an IP
+ address on that interface.
++
++.TP
++.BI \-B
++Set the BOOTP broadcast flag in request packets so servers will always
++broadcast replies.
++
++.TP
++.BI \-C\ <dhcp-client-identifier>
++Specify the dhcp-client-identifier option to send to the DHCP server.
++
++.TP
++.BI \-H\ <host-name>
++Specify the host-name option to send to the DHCP server.  The host-name
++string only contains the client's hostname prefix, to which the server will
++append the ddns-domainname or domain-name options, if any, to derive the
++fully qualified domain name of the client.  The
++.B -H
++option cannot be used with the
++.B -F
++option.
++
++.TP
++.BI \-F\ <fqdn.fqdn>
++Specify the fqdn.fqdn option to send to the DHCP server.  This option cannot
++be used with the
++.B -H
++option.  The fqdn.fqdn option must specify the complete domain name of the
++client host, which the server may use for dynamic DNS updates.
++
++.TP
++.BI \-V\ <vendor-class-identifier>
++Specify the vendor-class-identifier option to send to the DHCP server.
++
++.TP
++.BI \-R\ <option>[,<option>...]
++Specify the list of options the client is to request from the server.  The
++option list must be a single string consisting of option names separated
++by at least one command and optional space characters.  The default option
++list is:
++
++.BR
++    subnet-mask, broadcast-address, time-offset, routers,
++.BR
++    domain-search, domain-name, domain-name-servers, host-name, 
++.BR
++    nis-domain, nis-servers, ntp-servers, interface-mtu
++
++.TP
++.B -R
++option does not append options to the default request, it overrides the
++default request list.  Keep this in mind if you want to request an
++additional option besides the default request list.  You will have to
++specify all option names for the
++.B -R
++parameter.
++
++.TP
++.BI \-timeout\ <timeout>
++Specify the time after which
++.B dhclient
++will decide that no DHCP servers can be contacted when no responses have been
++received.
++
+ .TP
+ .BI \-n
+ Do not configure any interfaces.  This is most likely to be useful in
+diff -up dhcp-4.3.1b1/client/dhclient.c.fLPqYB dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.fLPqYB	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:38:44.520350055 +0200
 @@ -39,6 +39,12 @@
  #include <limits.h>
  #include <dns/result.h>
@@ -48,17 +155,17 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  TIME default_lease_time = 43200; /* 12 hours... */
  TIME max_lease_time = 86400; /* 24 hours... */
  
-@@ -87,6 +93,9 @@ int wanted_ia_na = -1;		/* the absolute 
+@@ -88,6 +94,9 @@ int wanted_ia_na = -1;		/* the absolute
  int wanted_ia_ta = 0;
  int wanted_ia_pd = 0;
  char *mockup_relay = NULL;
 +int bootp_broadcast_always = 0;
 +
-+extern u_int32_t default_requested_options[];
++extern struct option *default_requested_options[];
  
  void run_stateless(int exit_mode);
  
-@@ -123,6 +132,15 @@ main(int argc, char **argv) {
+@@ -125,6 +134,15 @@ main(int argc, char **argv) {
  	int local_family_set = 0;
  #endif /* DHCPv6 */
  	char *s;
@@ -74,18 +181,18 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  
  	/* Initialize client globals. */
  	memset(&default_duid, 0, sizeof(default_duid));
-@@ -310,6 +328,88 @@ main(int argc, char **argv) {
- 		} else if (!strcmp(argv[i], "--version")) {
- 			log_info("isc-dhclient-%s", PACKAGE_VERSION);
+@@ -325,6 +343,88 @@ main(int argc, char **argv) {
+ 					 strlen(PACKAGE_VERSION)));
+ 			IGNORE_RET(write(STDERR_FILENO, "\n", 1));
  			exit(0);
-+		} else if (!strcmp(argv[i], "-I")) {
++		} else if (!strcmp(argv[i], "-C")) {
 +			if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
 +				usage();
 +				exit(1);
 +			}
 +
 +			if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
-+				log_error("-I option dhcp-client-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
++				log_error("-C option dhcp-client-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
 +				exit(1);
 +			}
 +
@@ -138,7 +245,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
 +			}
 +
 +			if ((timeout_arg = atoi(argv[i])) <= 0) {
-+				log_error("-T timeout option must be > 0 - bad value: %s",argv[i]);
++				log_error("timeout option must be > 0 - bad value: %s",argv[i]);
 +				exit(1);
 +			}
 +		} else if (!strcmp(argv[i], "-V")) {
@@ -163,7 +270,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  		} else if (argv[i][0] == '-') {
  		    usage();
  		} else if (interfaces_requested < 0) {
-@@ -484,6 +584,166 @@ main(int argc, char **argv) {
+@@ -507,6 +607,156 @@ main(int argc, char **argv) {
  	/* Parse the dhclient.conf file. */
  	read_client_conf();
  
@@ -172,7 +279,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
 +		arg_conf_len = asprintf(&arg_conf, "send dhcp-client-identifier \"%s\";", dhcp_client_identifier_arg);
 +
 +		if ((arg_conf == 0) || (arg_conf_len <= 0))
-+			log_fatal("Unable to send -I option dhcp-client-identifier");
++			log_fatal("Unable to send -C option dhcp-client-identifier");
 +	}
 +
 +	if ((dhcp_host_name_arg != NULL) && (*dhcp_host_name_arg != '\0')) {
@@ -269,7 +376,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
 +		if (arg_conf_len == 0)
 +			if ((arg_conf_len = strlen(arg_conf)) == 0)
 +				/* huh ? cannot happen ! */
-+				log_fatal("Unable to process -I/-H/-F/-timeout/-V/-R configuration arguments");
++				log_fatal("Unable to process -C/-H/-F/-timeout/-V/-R configuration arguments");
 +
 +		/* parse the extra dhclient.conf configuration arguments
 +		 * into top level config: */
@@ -277,10 +384,10 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
 +		const char *val = NULL;
 +		int token;
 +
-+		status = new_parse(&cfile, -1, arg_conf, arg_conf_len, "extra dhclient -I/-H/-F/-timeout/-V/-R configuration arguments", 0);
++		status = new_parse(&cfile, -1, arg_conf, arg_conf_len, "extra dhclient -C/-H/-F/-timeout/-V/-R configuration arguments", 0);
 +
 +		if ((status != ISC_R_SUCCESS) || (cfile -> warnings_occurred))
-+			log_fatal("Cannot parse -I/-H/-F/-timeout/-V/-R configuration arguments !");
++			log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !");
 +		/* more detailed parse failures will be logged */
 +
 +		do {
@@ -292,26 +399,16 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
 +		} while (1);
 +
 +		if (cfile -> warnings_occurred)
-+			log_fatal("Cannot parse -I/-H/-F/-timeout/-V/-R configuration arguments !");
++			log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !");
 +		end_parse(&cfile);
 +
 +		if (timeout_arg) {
 +			/* we just set the toplevel timeout, but per-client
-+			 * timeouts may still be at defaults. Also, it makes no
-+			 * sense having the reboot_timeout or backoff_cutoff
-+			 * greater than the timeout:
++			 * timeouts may still be at defaults.
 +			 */
-+			if ((top_level_config.backoff_cutoff == 15) && (top_level_config.backoff_cutoff > (timeout_arg / 2)))
-+				top_level_config.backoff_cutoff = (((unsigned long)(timeout_arg / 2)) == 0) ? timeout_arg : (unsigned long)(timeout_arg / 2);
-+
 +			for (ip=interfaces; ip; ip = ip->next) {
 +				if (ip->client->config->timeout == 60)
 +					ip->client->config->timeout = timeout_arg;
-+
-+				if ((ip->client->config->reboot_timeout == 10) && (ip->client->config->reboot_timeout > ip->client->config->timeout))
-+					ip->client->config->reboot_timeout = ip->client->config->timeout;
-+				if ((ip->client->config->backoff_cutoff == 15) && (ip->client->config->backoff_cutoff > top_level_config.backoff_cutoff))
-+					ip->client->config->backoff_cutoff = top_level_config.backoff_cutoff;
 +			}
 +		}
 +
@@ -330,7 +427,18 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  	/* Parse the lease database. */
  	read_client_leases();
  
-@@ -2397,7 +2657,8 @@ void make_discover (client, lease)
+@@ -756,6 +1006,10 @@ static void usage()
+ 		  "                [-s server-addr] [-cf config-file]\n"
+ 		  "                [-df duid-file] [-lf lease-file]\n"
+ 		  "                [-pf pid-file] [--no-pid] [-e VAR=val]\n"
++		  "                [-C <dhcp-client-identifier>] [-B]\n"
++		  "                [-H <host-name> | -F <fqdn.fqdn>] [-timeout <timeout>]\n"
++		  "                [-V <vendor-class-identifier>]\n"
++		  "                [-R <request option list>]\n"
+ 		  "                [-sf script-file] [interface]");
+ }
+ 
+@@ -2531,7 +2785,8 @@ void make_discover (client, lease)
  	client -> packet.xid = random ();
  	client -> packet.secs = 0; /* filled in by send_discover. */
  
@@ -340,7 +448,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  		client -> packet.flags = 0;
  	else
  		client -> packet.flags = htons (BOOTP_BROADCAST);
-@@ -2481,7 +2742,9 @@ void make_request (client, lease)
+@@ -2615,7 +2870,9 @@ void make_request (client, lease)
  	} else {
  		memset (&client -> packet.ciaddr, 0,
  			sizeof client -> packet.ciaddr);
@@ -351,7 +459,7 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  			client -> packet.flags = 0;
  		else
  			client -> packet.flags = htons (BOOTP_BROADCAST);
-@@ -2543,7 +2806,8 @@ void make_decline (client, lease)
+@@ -2677,7 +2934,8 @@ void make_decline (client, lease)
  	client -> packet.hops = 0;
  	client -> packet.xid = client -> xid;
  	client -> packet.secs = 0; /* Filled in by send_request. */
@@ -361,10 +469,10 @@ diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
  		client -> packet.flags = 0;
  	else
  		client -> packet.flags = htons (BOOTP_BROADCAST);
-diff -up dhcp-4.2.2b1/common/conflex.c.options dhcp-4.2.2b1/common/conflex.c
---- dhcp-4.2.2b1/common/conflex.c.options	2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/common/conflex.c	2011-07-01 13:51:52.938755494 +0200
-@@ -808,6 +808,8 @@ intern(char *atom, enum dhcp_token dfv) 
+diff -up dhcp-4.3.1b1/common/conflex.c.fLPqYB dhcp-4.3.1b1/common/conflex.c
+--- dhcp-4.3.1b1/common/conflex.c.fLPqYB	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/common/conflex.c	2014-07-10 17:38:26.940599374 +0200
+@@ -811,6 +811,8 @@ intern(char *atom, enum dhcp_token dfv)
  			return BALANCE;
  		if (!strcasecmp (atom + 1, "ound"))
  			return BOUND;
@@ -373,10 +481,10 @@ diff -up dhcp-4.2.2b1/common/conflex.c.options dhcp-4.2.2b1/common/conflex.c
  		break;
  	      case 'c':
  		if (!strcasecmp(atom + 1, "ase"))
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.options dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.options	2011-05-20 16:21:11.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h	2011-07-01 13:51:52.940755442 +0200
-@@ -1147,6 +1147,9 @@ struct client_config {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h	2014-07-10 17:38:26.941599360 +0200
+@@ -1152,6 +1152,9 @@ struct client_config {
  	int do_forward_update;		/* If nonzero, and if we have the
  					   information we need, update the
  					   A record for the address we get. */
@@ -386,16 +494,16 @@ diff -up dhcp-4.2.2b1/includes/dhcpd.h.options dhcp-4.2.2b1/includes/dhcpd.h
  };
  
  /* Per-interface state used in the dhcp client... */
-diff -up dhcp-4.2.2b1/includes/dhctoken.h.options dhcp-4.2.2b1/includes/dhctoken.h
---- dhcp-4.2.2b1/includes/dhctoken.h.options	2011-05-12 14:02:47.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhctoken.h	2011-07-01 13:53:43.316861637 +0200
-@@ -361,7 +361,8 @@ enum dhcp_token {
- 	GETHOSTNAME = 662,
- 	REWIND = 663,
- 	INITIAL_DELAY = 664,
--	GETHOSTBYNAME = 665
-+	GETHOSTBYNAME = 665,
-+	BOOTP_BROADCAST_ALWAYS = 666
+diff -up dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB dhcp-4.3.1b1/includes/dhctoken.h
+--- dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/includes/dhctoken.h	2014-07-10 17:38:26.942599346 +0200
+@@ -367,7 +367,8 @@ enum dhcp_token {
+ 	TOKEN_INFINIBAND = 668,
+ 	POOL6 = 669,
+ 	V6RELAY = 670,
+-	V6RELOPT = 671
++	V6RELOPT = 671,
++	BOOTP_BROADCAST_ALWAYS = 672
  };
  
  #define is_identifier(x)	((x) >= FIRST_TOKEN &&	\
diff --git a/src/patches/dhcp/dhcp-errwarn-message.patch b/src/patches/dhcp/dhcp-errwarn-message.patch
new file mode 100644
index 0000000000..a65c2c2ed7
--- /dev/null
+++ b/src/patches/dhcp/dhcp-errwarn-message.patch
@@ -0,0 +1,22 @@
+diff -up dhcp-4.3.0b1/omapip/errwarn.c.errwarn dhcp-4.3.0b1/omapip/errwarn.c
+--- dhcp-4.3.0b1/omapip/errwarn.c.errwarn	2014-01-21 09:31:47.301334249 +0100
++++ dhcp-4.3.0b1/omapip/errwarn.c	2014-01-21 09:33:20.569039072 +0100
+@@ -76,11 +76,13 @@ void log_fatal (const char * fmt, ... )
+   }
+ 
+   log_error ("%s", "");
+-  log_error ("If you think you have received this message due to a bug rather");
+-  log_error ("than a configuration issue please read the section on submitting");
+-  log_error ("bugs on either our web page at www.isc.org or in the README file");
+-  log_error ("before submitting a bug.  These pages explain the proper");
+-  log_error ("process and the information we find helpful for debugging..");
++  log_error ("This version of ISC DHCP is based on the release available");
++  log_error ("on ftp.isc.org.  Features have been added and other changes");
++  log_error ("have been made to the base software release in order to make");
++  log_error ("it work better with this distribution.");
++  log_error ("%s", "");
++  log_error ("Please report for this software via the Red Hat Bugzilla site:");
++  log_error ("    http://bugzilla.redhat.com");
+   log_error ("%s", "");
+   log_error ("exiting.");
+ 
diff --git a/src/patches/dhcp/dhcp-garbage-chars.patch b/src/patches/dhcp/dhcp-garbage-chars.patch
new file mode 100644
index 0000000000..131360be62
--- /dev/null
+++ b/src/patches/dhcp/dhcp-garbage-chars.patch
@@ -0,0 +1,12 @@
+diff -up dhcp-4.3.0rc1/common/tables.c.garbage dhcp-4.3.0rc1/common/tables.c
+--- dhcp-4.3.0rc1/common/tables.c.garbage	2014-01-29 10:03:52.132624677 +0100
++++ dhcp-4.3.0rc1/common/tables.c	2014-01-29 10:04:51.413875343 +0100
+@@ -213,7 +213,7 @@ static struct option dhcp_options[] = {
+ 	{ "name-service-search", "Sa",		&dhcp_universe, 117, 1 },
+ #endif
+ 	{ "subnet-selection", "I",		&dhcp_universe, 118, 1 },
+-	{ "domain-search", "Dc",		&dhcp_universe, 119, 1 },
++	{ "domain-search", "D",			&dhcp_universe, 119, 1 },
+ 	{ "vivco", "Evendor-class.",		&dhcp_universe, 124, 1 },
+ 	{ "vivso", "Evendor.",			&dhcp_universe, 125, 1 },
+ #if 0
diff --git a/src/patches/dhcp-4.2.2-gpxe-cid.patch b/src/patches/dhcp/dhcp-gpxe-cid.patch
similarity index 50%
rename from src/patches/dhcp-4.2.2-gpxe-cid.patch
rename to src/patches/dhcp/dhcp-gpxe-cid.patch
index c0be4c2396..c8c2b84f97 100644
--- a/src/patches/dhcp-4.2.2-gpxe-cid.patch
+++ b/src/patches/dhcp/dhcp-gpxe-cid.patch
@@ -1,10 +1,11 @@
-diff -up dhcp-4.2.2/client/dhclient.c.gpxe-cid dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.gpxe-cid	2011-09-16 18:23:20.190453902 +0200
-+++ dhcp-4.2.2/client/dhclient.c	2011-09-16 18:27:15.568463599 +0200
-@@ -58,6 +58,13 @@ const char *path_dhclient_pid = NULL;
+diff -up dhcp-4.3.0a1/client/dhclient.c.gpxe-cid dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.gpxe-cid	2013-12-20 13:28:45.105048317 +0100
++++ dhcp-4.3.0a1/client/dhclient.c	2013-12-20 13:28:45.109048261 +0100
+@@ -47,6 +47,14 @@
+ const char *path_dhclient_pid = NULL;
  static char path_dhclient_script_array[] = _PATH_DHCLIENT_SCRIPT;
  char *path_dhclient_script = path_dhclient_script_array;
- 
++
 +/* Default Prefix */
 +static unsigned char default_prefix[12] = {
 +	0xff, 0x00, 0x00, 0x00,
@@ -12,10 +13,10 @@ diff -up dhcp-4.2.2/client/dhclient.c.gpxe-cid dhcp-4.2.2/client/dhclient.c
 +	0x00, 0x02, 0xc9, 0x00
 +};
 +
- /* False (default) => we write and use a pid file */
- isc_boolean_t no_pid_file = ISC_FALSE;
+ const char *path_dhclient_duid = NULL;
  
-@@ -1250,6 +1257,12 @@ int find_subnet (struct subnet **sp,
+ /* False (default) => we write and use a pid file */
+@@ -1253,6 +1260,12 @@ int find_subnet (struct subnet **sp,
  static void setup_ib_interface(struct interface_info *ip)
  {
  	struct group *g;
@@ -28,7 +29,7 @@ diff -up dhcp-4.2.2/client/dhclient.c.gpxe-cid dhcp-4.2.2/client/dhclient.c
  
  	/* Set the broadcast flag */
  	ip->client->config->bootp_broadcast_always = 1;
-@@ -1266,8 +1279,39 @@ static void setup_ib_interface(struct in
+@@ -1269,8 +1282,39 @@ static void setup_ib_interface(struct in
  		}
  	}
  
@@ -70,63 +71,3 @@ diff -up dhcp-4.2.2/client/dhclient.c.gpxe-cid dhcp-4.2.2/client/dhclient.c
  }
  
  /* Individual States:
-diff -up dhcp-4.2.2/common/lpf.c.gpxe-cid dhcp-4.2.2/common/lpf.c
---- dhcp-4.2.2/common/lpf.c.gpxe-cid	2011-09-16 18:23:20.183453996 +0200
-+++ dhcp-4.2.2/common/lpf.c	2011-09-16 18:25:28.235804421 +0200
-@@ -591,6 +591,37 @@ void maybe_setup_fallback ()
- 	}
- }
- 
-+static unsigned char * get_ib_hw_addr(char * name)
-+{
-+	struct ifaddrs *ifaddrs;
-+	struct ifaddrs *ifa;
-+	struct sockaddr_ll *sll = NULL;
-+	static unsigned char hw_addr[8];
-+
-+	if (getifaddrs(&ifaddrs) == -1)
-+		return NULL;
-+
-+	for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
-+		if (ifa->ifa_addr == NULL)
-+			continue;
-+		if (ifa->ifa_addr->sa_family != AF_PACKET)
-+			continue;
-+		if (ifa->ifa_flags & IFF_LOOPBACK)
-+			continue;
-+		if (strcmp(ifa->ifa_name, name) == 0) {
-+			sll = (struct sockaddr_ll *)(void *)ifa->ifa_addr;
-+			break;
-+		}
-+	}
-+	if (sll == NULL) {
-+		freeifaddrs(ifaddrs);
-+		return NULL;
-+	}
-+	memcpy(hw_addr, &sll->sll_addr[sll->sll_halen - 8], 8);
-+	freeifaddrs(ifaddrs);
-+	return (unsigned char *)&hw_addr;
-+}
-+
- void
- get_hw_addr(struct interface_info *info)
- {
-@@ -599,6 +630,7 @@ get_hw_addr(struct interface_info *info)
- 	struct ifaddrs *ifaddrs;
- 	struct ifaddrs *ifa;
- 	struct sockaddr_ll *sll = NULL;
-+	unsigned char *hw_addr;
- 
- 	if (getifaddrs(&ifaddrs) == -1)
- 		log_fatal("Failed to get interfaces");
-@@ -660,6 +692,10 @@ get_hw_addr(struct interface_info *info)
- 
- 			hw->hlen = 1;
- 			hw->hbuf[0] = HTYPE_INFINIBAND;
-+			hw_addr = get_ib_hw_addr(name);
-+			if (!hw_addr)
-+				log_fatal("Failed getting %s hw addr", name);
-+			memcpy (&hw->hbuf [1], hw_addr, 8);
- 			break;
- #if defined(ARPHRD_PPP)
- 		case ARPHRD_PPP:
diff --git a/src/patches/dhcp-4.2.0-honor-expired.patch b/src/patches/dhcp/dhcp-honor-expired.patch
similarity index 77%
rename from src/patches/dhcp-4.2.0-honor-expired.patch
rename to src/patches/dhcp/dhcp-honor-expired.patch
index 0ae9128481..bd892975be 100644
--- a/src/patches/dhcp-4.2.0-honor-expired.patch
+++ b/src/patches/dhcp/dhcp-honor-expired.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.0/client/dhc6.c.honor-expired dhcp-4.2.0/client/dhc6.c
---- dhcp-4.2.0/client/dhc6.c.honor-expired	2010-10-07 12:55:37.000000000 +0200
-+++ dhcp-4.2.0/client/dhc6.c	2010-10-07 12:56:43.000000000 +0200
-@@ -1405,6 +1405,32 @@ start_info_request6(struct client_state 
+diff -up dhcp-4.3.0a1/client/dhc6.c.honor-expired dhcp-4.3.0a1/client/dhc6.c
+--- dhcp-4.3.0a1/client/dhc6.c.honor-expired	2013-12-19 16:00:28.062183037 +0100
++++ dhcp-4.3.0a1/client/dhc6.c	2013-12-19 16:00:28.076182842 +0100
+@@ -1351,6 +1351,32 @@ start_info_request6(struct client_state
  		go_daemon();
  }
  
@@ -34,7 +34,7 @@ diff -up dhcp-4.2.0/client/dhc6.c.honor-expired dhcp-4.2.0/client/dhc6.c
  /*
   * start_confirm6() kicks off an "init-reboot" version of the process, at
   * startup to find out if old bindings are 'fair' and at runtime whenever
-@@ -1417,8 +1446,10 @@ start_confirm6(struct client_state *clie
+@@ -1363,8 +1389,10 @@ start_confirm6(struct client_state *clie
  
  	/* If there is no active lease, there is nothing to check. */
  	if ((client->active_lease == NULL) ||
diff --git a/src/patches/dhcp-4.2.2-improved-xid.patch b/src/patches/dhcp/dhcp-improved-xid.patch
similarity index 78%
rename from src/patches/dhcp-4.2.2-improved-xid.patch
rename to src/patches/dhcp/dhcp-improved-xid.patch
index f49fc78459..eccff49875 100644
--- a/src/patches/dhcp-4.2.2-improved-xid.patch
+++ b/src/patches/dhcp/dhcp-improved-xid.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.improved-xid	2011-09-16 18:18:00.649730661 +0200
-+++ dhcp-4.2.2/client/dhclient.c	2011-09-16 18:22:36.815035513 +0200
-@@ -898,6 +898,26 @@ main(int argc, char **argv) {
+diff -up dhcp-4.3.0a1/client/dhclient.c.improved-xid dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.improved-xid	2013-12-20 13:29:41.836260810 +0100
++++ dhcp-4.3.0a1/client/dhclient.c	2013-12-20 13:29:41.843260713 +0100
+@@ -894,6 +894,26 @@ main(int argc, char **argv) {
  		}
  	}
  
@@ -28,7 +28,7 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
  	/* At this point, all the interfaces that the script thinks
  	   are relevant should be running, so now we once again call
  	   discover_interfaces(), and this time ask it to actually set
-@@ -912,14 +932,36 @@ main(int argc, char **argv) {
+@@ -908,14 +928,36 @@ main(int argc, char **argv) {
  	   Not much entropy, but we're booting, so we're not likely to
  	   find anything better. */
  	seed = 0;
@@ -66,7 +66,7 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
  
  	/* Setup specific Infiniband options */
  	for (ip = interfaces; ip; ip = ip->next) {
-@@ -1457,7 +1499,7 @@ void dhcpack (packet)
+@@ -1460,7 +1502,7 @@ void dhcpack (packet)
  		return;
  	}
  
@@ -75,7 +75,7 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
  
  	lease = packet_to_lease (packet, client);
  	if (!lease) {
-@@ -2174,7 +2216,7 @@ void dhcpnak (packet)
+@@ -2171,7 +2213,7 @@ void dhcpnak (packet)
  		return;
  	}
  
@@ -84,7 +84,7 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
  
  	if (!client -> active) {
  #if defined (DEBUG)
-@@ -2300,10 +2342,10 @@ void send_discover (cpp)
+@@ -2298,10 +2340,10 @@ void send_discover (cpp)
  		client -> packet.secs = htons (65535);
  	client -> secs = client -> packet.secs;
  
@@ -96,8 +96,8 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
 +	      ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval), client -> xid);
  
  	/* Send out a packet. */
- 	result = send_packet (client -> interface, (struct packet *)0,
-@@ -2584,10 +2626,10 @@ void send_request (cpp)
+ 	result = send_packet(client->interface, NULL, &client->packet,
+@@ -2570,10 +2612,10 @@ void send_request (cpp)
  			client -> packet.secs = htons (65535);
  	}
  
@@ -109,21 +109,21 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
 +	      ntohs (destination.sin_port), client -> xid);
  
  	if (destination.sin_addr.s_addr != INADDR_BROADCAST &&
- 	    fallback_interface)
-@@ -2618,10 +2660,10 @@ void send_decline (cpp)
+ 	    fallback_interface) {
+@@ -2613,10 +2655,10 @@ void send_decline (cpp)
  
  	int result;
  
 -	log_info ("DHCPDECLINE on %s to %s port %d",
 +	log_info ("DHCPDECLINE on %s to %s port %d (xid=0x%x)",
- 	      client -> name ? client -> name : client -> interface -> name,
- 	      inet_ntoa (sockaddr_broadcast.sin_addr),
--	      ntohs (sockaddr_broadcast.sin_port));
-+	      ntohs (sockaddr_broadcast.sin_port), client -> xid);
+ 	      client->name ? client->name : client->interface->name,
+ 	      inet_ntoa(sockaddr_broadcast.sin_addr),
+-	      ntohs(sockaddr_broadcast.sin_port));
++	      ntohs(sockaddr_broadcast.sin_port), client -> xid);
  
  	/* Send out a packet. */
- 	result = send_packet (client -> interface, (struct packet *)0,
-@@ -2661,10 +2703,10 @@ void send_release (cpp)
+ 	result = send_packet(client->interface, NULL, &client->packet,
+@@ -2659,10 +2701,10 @@ void send_release (cpp)
  		return;
  	}
  
@@ -134,5 +134,5 @@ diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
 -	      ntohs (destination.sin_port));
 +	      ntohs (destination.sin_port), client -> xid);
  
- 	if (fallback_interface)
- 		result = send_packet (fallback_interface,
+ 	if (fallback_interface) {
+ 		result = send_packet(fallback_interface, NULL, &client->packet,
diff --git a/src/patches/dhcp/dhcp-logpid.patch b/src/patches/dhcp/dhcp-logpid.patch
new file mode 100644
index 0000000000..e1a6ebdb52
--- /dev/null
+++ b/src/patches/dhcp/dhcp-logpid.patch
@@ -0,0 +1,11 @@
+--- expanded_org/client/dhclient.c	Wed Aug 06 23:35:00 2014
++++ expanded_logpid/client/dhclient.c	Mon Feb 16 13:35:31 2015
+@@ -142,7 +142,7 @@
+ 	else if (fd != -1)
+ 		close(fd);
+ 
+-	openlog("dhclient", DHCP_LOG_OPTIONS, LOG_DAEMON);
++	openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON);
+ 
+ #if !(defined(DEBUG) || defined(__CYGWIN32__))
+ 	setlogmask(LOG_UPTO(LOG_INFO));
diff --git a/src/patches/dhcp-4.2.2-lpf-ib.patch b/src/patches/dhcp/dhcp-lpf-ib.patch
similarity index 67%
rename from src/patches/dhcp-4.2.2-lpf-ib.patch
rename to src/patches/dhcp/dhcp-lpf-ib.patch
index 4034028b83..8e094d6497 100644
--- a/src/patches/dhcp-4.2.2-lpf-ib.patch
+++ b/src/patches/dhcp/dhcp-lpf-ib.patch
@@ -1,16 +1,16 @@
-diff -up dhcp-4.2.2/client/dhclient.c.lpf-ib dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.lpf-ib	2011-09-19 11:24:08.693775799 +0200
-+++ dhcp-4.2.2/client/dhclient.c	2011-09-19 11:24:08.703775541 +0200
-@@ -113,6 +113,8 @@ static int check_domain_name_list(const 
+diff -up dhcp-4.3.1b1/client/dhclient.c.bmgpWV dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.bmgpWV	2014-07-10 17:50:26.922402550 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:53:43.629623477 +0200
+@@ -114,6 +114,8 @@ static int check_domain_name_list(const
  static int check_option_values(struct universe *universe, unsigned int opt,
  			       const char *ptr, size_t len);
  
 +static void setup_ib_interface(struct interface_info *ip);
 +
+ #ifndef UNIT_TEST
  int
  main(int argc, char **argv) {
- 	int fd;
-@@ -919,6 +921,14 @@ main(int argc, char **argv) {
+@@ -937,6 +939,13 @@ main(int argc, char **argv) {
  	}
  	srandom(seed + cur_time + (unsigned)getpid());
  
@@ -21,11 +21,10 @@ diff -up dhcp-4.2.2/client/dhclient.c.lpf-ib dhcp-4.2.2/client/dhclient.c
 +			setup_ib_interface(ip);
 +		}
 +	}
-+
- 	/* Start a configuration state machine for each interface. */
- #ifdef DHCPv6
- 	if (local_family == AF_INET6) {
-@@ -1195,6 +1205,29 @@ int find_subnet (struct subnet **sp,
+ 
+ 	/*
+ 	 * Establish a default DUID.  We always do so for v6 and
+@@ -1230,6 +1239,29 @@ int find_subnet (struct subnet **sp,
  	return 0;
  }
  
@@ -55,10 +54,10 @@ diff -up dhcp-4.2.2/client/dhclient.c.lpf-ib dhcp-4.2.2/client/dhclient.c
  /* Individual States:
   *
   * Each routine is called from the dhclient_state_machine() in one of
-diff -up dhcp-4.2.2/common/bpf.c.lpf-ib dhcp-4.2.2/common/bpf.c
---- dhcp-4.2.2/common/bpf.c.lpf-ib	2011-09-19 11:24:08.694775773 +0200
-+++ dhcp-4.2.2/common/bpf.c	2011-09-19 11:24:08.704775516 +0200
-@@ -198,11 +198,44 @@ struct bpf_insn dhcp_bpf_filter [] = {
+diff -up dhcp-4.3.1b1/common/bpf.c.bmgpWV dhcp-4.3.1b1/common/bpf.c
+--- dhcp-4.3.1b1/common/bpf.c.bmgpWV	2014-07-10 17:48:03.797424616 +0200
++++ dhcp-4.3.1b1/common/bpf.c	2014-07-10 17:52:57.705272295 +0200
+@@ -199,11 +199,44 @@ struct bpf_insn dhcp_bpf_filter [] = {
  	BPF_STMT(BPF_RET+BPF_K, 0),
  };
  
@@ -103,21 +102,15 @@ diff -up dhcp-4.2.2/common/bpf.c.lpf-ib dhcp-4.2.2/common/bpf.c
  #if defined (HAVE_TR_SUPPORT)
  struct bpf_insn dhcp_bpf_tr_filter [] = {
          /* accept all token ring packets due to variable length header */
-diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
---- dhcp-4.2.2/common/lpf.c.lpf-ib	2011-09-19 11:24:08.694775773 +0200
-+++ dhcp-4.2.2/common/lpf.c	2011-09-19 11:26:15.107109935 +0200
-@@ -42,6 +42,7 @@
- #include "includes/netinet/udp.h"
- #include "includes/netinet/if_ether.h"
+diff -up dhcp-4.3.1b1/common/lpf.c.bmgpWV dhcp-4.3.1b1/common/lpf.c
+--- dhcp-4.3.1b1/common/lpf.c.bmgpWV	2014-07-10 17:48:03.797424616 +0200
++++ dhcp-4.3.1b1/common/lpf.c	2014-07-10 17:52:57.706272281 +0200
+@@ -46,6 +46,17 @@
+ #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR)
+ #include <sys/ioctl.h>
  #include <net/if.h>
 +#include <ifaddrs.h>
- 
- #ifndef PACKET_AUXDATA
- #define PACKET_AUXDATA 8
-@@ -59,6 +60,15 @@ struct tpacket_auxdata
- /* Reinitializes the specified interface after an address change.   This
-    is not required for packet-filter APIs. */
- 
++
 +/* Default broadcast address for IPoIB */
 +static unsigned char default_ib_bcast_addr[20] = {
 + 	0x00, 0xff, 0xff, 0xff,
@@ -127,10 +120,10 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
 +	0xff, 0xff, 0xff, 0xff
 +};
 +
- #ifdef USE_LPF_SEND
- void if_reinitialize_send (info)
- 	struct interface_info *info;
-@@ -86,10 +96,21 @@ int if_register_lpf (info)
+ #endif
+ 
+ #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE)
+@@ -92,10 +103,21 @@ int if_register_lpf (info)
  		struct sockaddr common;
  	} sa;
  	struct ifreq ifr;
@@ -154,7 +147,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
  		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
  		    errno == EAFNOSUPPORT || errno == EINVAL) {
-@@ -112,6 +133,7 @@ int if_register_lpf (info)
+@@ -118,6 +140,7 @@ int if_register_lpf (info)
  	/* Bind to the interface name */
  	memset (&sa, 0, sizeof sa);
  	sa.ll.sll_family = AF_PACKET;
@@ -162,7 +155,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  	sa.ll.sll_ifindex = ifr.ifr_ifindex;
  	if (bind (sock, &sa.common, sizeof sa)) {
  		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
-@@ -127,8 +149,6 @@ int if_register_lpf (info)
+@@ -133,8 +156,6 @@ int if_register_lpf (info)
  		log_fatal ("Bind socket to interface: %m");
  	}
  
@@ -171,7 +164,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  	return sock;
  }
  #endif /* USE_LPF_SEND || USE_LPF_RECEIVE */
-@@ -183,6 +203,8 @@ void if_deregister_send (info)
+@@ -189,6 +210,8 @@ void if_deregister_send (info)
     in bpf includes... */
  extern struct sock_filter dhcp_bpf_filter [];
  extern int dhcp_bpf_filter_len;
@@ -180,7 +173,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  
  #if defined (HAVE_TR_SUPPORT)
  extern struct sock_filter dhcp_bpf_tr_filter [];
-@@ -200,11 +222,13 @@ void if_register_receive (info)
+@@ -206,11 +229,13 @@ void if_register_receive (info)
  	/* Open a LPF device and hang it on this interface... */
  	info -> rfdesc = if_register_lpf (info);
  
@@ -199,7 +192,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  	}
  
  #if defined (HAVE_TR_SUPPORT)
-@@ -250,15 +274,28 @@ static void lpf_gen_filter_setup (info)
+@@ -256,15 +281,28 @@ static void lpf_gen_filter_setup (info)
  
  	memset(&p, 0, sizeof(p));
  
@@ -237,7 +230,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  
  	if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p,
  			sizeof p) < 0) {
-@@ -315,6 +352,54 @@ static void lpf_tr_filter_setup (info)
+@@ -321,6 +359,54 @@ static void lpf_tr_filter_setup (info)
  #endif /* USE_LPF_RECEIVE */
  
  #ifdef USE_LPF_SEND
@@ -292,7 +285,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  ssize_t send_packet (interface, packet, raw, len, from, to, hto)
  	struct interface_info *interface;
  	struct packet *packet;
-@@ -335,6 +420,11 @@ ssize_t send_packet (interface, packet, 
+@@ -341,6 +427,11 @@ ssize_t send_packet (interface, packet,
  		return send_fallback (interface, packet, raw,
  				      len, from, to, hto);
  
@@ -304,7 +297,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  	if (hto == NULL && interface->anycast_mac_addr.hlen)
  		hto = &interface->anycast_mac_addr;
  
-@@ -356,6 +446,42 @@ ssize_t send_packet (interface, packet, 
+@@ -362,6 +453,42 @@ ssize_t send_packet (interface, packet,
  #endif /* USE_LPF_SEND */
  
  #ifdef USE_LPF_RECEIVE
@@ -347,7 +340,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  ssize_t receive_packet (interface, buf, len, from, hfrom)
  	struct interface_info *interface;
  	unsigned char *buf;
-@@ -382,6 +508,10 @@ ssize_t receive_packet (interface, buf, 
+@@ -388,6 +515,10 @@ ssize_t receive_packet (interface, buf,
  	};
  	struct cmsghdr *cmsg;
  
@@ -358,60 +351,100 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  	length = recvmsg (interface -> rfdesc, &msg, 0);
  	if (length <= 0)
  		return length;
-@@ -462,33 +592,44 @@ void maybe_setup_fallback ()
- }
+@@ -469,11 +600,33 @@ void maybe_setup_fallback ()
+ #endif
  
- void
+ #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR)
+-void
 -get_hw_addr(const char *name, struct hardware *hw) {
--	int sock;
--	struct ifreq tmp;
--	struct sockaddr *sa;
-+get_hw_addr(struct interface_info *info)
++struct sockaddr_ll *
++get_ll (struct ifaddrs *ifaddrs, struct ifaddrs **ifa, char *name)
 +{
-+	struct hardware *hw = &info->hw_address;
-+	char *name = info->name;
-+	struct ifaddrs *ifaddrs;
-+	struct ifaddrs *ifa;
-+	struct sockaddr_ll *sll = NULL;
- 
--	if (strlen(name) >= sizeof(tmp.ifr_name)) {
--		log_fatal("Device name too long: \"%s\"", name);
--	}
-+	if (getifaddrs(&ifaddrs) == -1)
-+		log_fatal("Failed to get interfaces");
- 
--	sock = socket(AF_INET, SOCK_DGRAM, 0);
--	if (sock < 0) {
--		log_fatal("Can't create socket for \"%s\": %m", name);
-+	for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
-+
-+		if (ifa->ifa_addr == NULL)
++	for (*ifa = ifaddrs; *ifa != NULL; *ifa = (*ifa)->ifa_next) {
++		if ((*ifa)->ifa_addr == NULL)
 +			continue;
 +
-+		if (ifa->ifa_addr->sa_family != AF_PACKET)
++		if ((*ifa)->ifa_addr->sa_family != AF_PACKET)
 +			continue;
 +
-+		if (ifa->ifa_flags & IFF_LOOPBACK)
++		if ((*ifa)->ifa_flags & IFF_LOOPBACK)
 +			continue;
 +
-+		if (strcmp(ifa->ifa_name, name) == 0) {
-+			sll = (struct sockaddr_ll *)(void *)ifa->ifa_addr;
-+			break;
-+		}
- 	}
++		if (strcmp((*ifa)->ifa_name, name) == 0)
++			return (struct sockaddr_ll *)(void *)(*ifa)->ifa_addr;
++	}
++	*ifa = NULL;
++	return NULL;
++}
++
++struct sockaddr_ll *
++ioctl_get_ll(char *name)
++{
+ 	int sock;
+ 	struct ifreq tmp;
+-	struct sockaddr *sa;
++	struct sockaddr *sa = NULL;
++	struct sockaddr_ll *sll = NULL;
  
--	memset(&tmp, 0, sizeof(tmp));
--	strcpy(tmp.ifr_name, name);
--	if (ioctl(sock, SIOCGIFHWADDR, &tmp) < 0) {
+ 	if (strlen(name) >= sizeof(tmp.ifr_name)) {
+ 		log_fatal("Device name too long: \"%s\"", name);
+@@ -487,16 +640,62 @@ get_hw_addr(const char *name, struct har
+ 	memset(&tmp, 0, sizeof(tmp));
+ 	strcpy(tmp.ifr_name, name);
+ 	if (ioctl(sock, SIOCGIFHWADDR, &tmp) < 0) {
 -		log_fatal("Error getting hardware address for \"%s\": %m", 
--			  name);
-+	if (sll == NULL) {
-+		freeifaddrs(ifaddrs);
-+		log_fatal("Failed to get HW address for %s\n", name);
++		log_fatal("Error getting hardware address for \"%s\": %m",
+ 			  name);
  	}
++	close(sock);
  
--	sa = &tmp.ifr_hwaddr;
+ 	sa = &tmp.ifr_hwaddr;
 -	switch (sa->sa_family) {
++	// needs to be freed outside this function
++	sll = dmalloc (sizeof (struct sockaddr_ll), MDL);
++	if (!sll)
++		log_fatal("Unable to allocate memory for link layer address");
++	memcpy(&sll->sll_hatype, &sa->sa_family, sizeof (sll->sll_hatype));
++	memcpy(sll->sll_addr, sa->sa_data, sizeof (sll->sll_addr));
++	switch (sll->sll_hatype) {
++		case ARPHRD_INFINIBAND:
++			/* ioctl limits hardware addresses to 8 bytes */
++			sll->sll_halen = 8;
++			break;
++		default:
++			break;
++	}
++	return sll;
++}
++
++void
++get_hw_addr(struct interface_info *info)
++{
++	struct hardware *hw = &info->hw_address;
++	char *name = info->name;
++	struct ifaddrs *ifaddrs = NULL;
++	struct ifaddrs *ifa = NULL;
++	struct sockaddr_ll *sll = NULL;
++	int sll_allocated = 0;
++	char *dup = NULL;
++	char *colon = NULL;
++
++	if (getifaddrs(&ifaddrs) == -1)
++		log_fatal("Failed to get interfaces");
++
++	if ((sll = get_ll(ifaddrs, &ifa, name)) == NULL) {
++		/*
++		 * We were unable to get link-layer address for name.
++		 * Fall back to ioctl(SIOCGIFHWADDR).
++		 */
++		sll = ioctl_get_ll(name);
++		if (sll != NULL)
++			sll_allocated = 1;
++		else
++			// shouldn't happen
++			log_fatal("Unexpected internal error");
++	}
++
 +	switch (sll->sll_hatype) {
  		case ARPHRD_ETHER:
  			hw->hlen = 7;
@@ -421,7 +454,7 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
  			break;
  		case ARPHRD_IEEE802:
  #ifdef ARPHRD_IEEE802_TR
-@@ -496,18 +637,35 @@ get_hw_addr(const char *name, struct har
+@@ -504,18 +703,48 @@ get_hw_addr(const char *name, struct har
  #endif /* ARPHRD_IEEE802_TR */
  			hw->hlen = 7;
  			hw->hbuf[0] = HTYPE_IEEE802;
@@ -429,16 +462,28 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
 +			memcpy(&hw->hbuf[1], sll->sll_addr, 6);
  			break;
  		case ARPHRD_FDDI:
- 			hw->hlen = 17;
+ 			hw->hlen = 7;
  			hw->hbuf[0] = HTYPE_FDDI;
--			memcpy(&hw->hbuf[1], sa->sa_data, 16);
-+			memcpy(&hw->hbuf[1], sll->sll_addr, 16);
+-			memcpy(&hw->hbuf[1], sa->sa_data, 6);
++			memcpy(&hw->hbuf[1], sll->sll_addr, 6);
 +			break;
 +		case ARPHRD_INFINIBAND:
++			dup = strdup(name);
++			/* Aliased infiniband interface is special case where
++			 * neither get_ll() nor ioctl_get_ll() get's correct hw
++			 * address, so we have to truncate the :0 and run
++			 * get_ll() again for the rest.
++			*/
++			if ((colon = strchr(dup, ':')) != NULL) {
++				*colon = '\0';
++				if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL)
++					log_fatal("Error getting hardware address for \"%s\": %m", name);
++			}
++			free (dup);
 +			/* For Infiniband, save the broadcast address and store
 +			 * the port GUID into the hardware address.
 +			 */
-+			if (ifa->ifa_flags & IFF_BROADCAST) {
++			if (ifa && (ifa->ifa_flags & IFF_BROADCAST)) {
 +				struct sockaddr_ll *bll;
 +
 +				bll = (struct sockaddr_ll *)ifa->ifa_broadaddr;
@@ -450,36 +495,40 @@ diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
 +
 +			hw->hlen = 1;
 +			hw->hbuf[0] = HTYPE_INFINIBAND;
++			memcpy(&hw->hbuf[1], &sll->sll_addr[sll->sll_halen - 8], 8);
  			break;
  #if defined(ARPHRD_PPP)
  		case ARPHRD_PPP:
  			if (local_family != AF_INET6)
 -				log_fatal("Unsupported device type %d for \"%s\"",
 -				           sa->sa_family, name);
-+				log_fatal("Unsupported device type %ld for \"%s\"",
-+					  (long int)sll->sll_family, name);
++				log_fatal("local_family != AF_INET6 for \"%s\"",
++					  name);
  			hw->hlen = 0;
  			hw->hbuf[0] = HTYPE_RESERVED;
  			/* 0xdeadbeef should never occur on the wire,
-@@ -520,10 +678,11 @@ get_hw_addr(const char *name, struct har
+@@ -528,10 +757,13 @@ get_hw_addr(const char *name, struct har
  			break;
  #endif
  		default:
-+			freeifaddrs(ifaddrs);
- 			log_fatal("Unsupported device type %ld for \"%s\"",
+-			log_fatal("Unsupported device type %ld for \"%s\"",
 -				  (long int)sa->sa_family, name);
-+				  (long int)sll->sll_family, name);
++			freeifaddrs(ifaddrs);
++			log_fatal("Unsupported device type %hu for \"%s\"",
++				  sll->sll_hatype, name);
  	}
  
 -	close(sock);
++	if (sll_allocated)
++		dfree(sll, MDL);
 +	freeifaddrs(ifaddrs);
  }
  #endif
-diff -up dhcp-4.2.2/common/socket.c.lpf-ib dhcp-4.2.2/common/socket.c
---- dhcp-4.2.2/common/socket.c.lpf-ib	2011-06-27 18:18:20.000000000 +0200
-+++ dhcp-4.2.2/common/socket.c	2011-09-19 11:24:08.705775490 +0200
-@@ -324,7 +324,7 @@ void if_register_send (info)
- 	info->wfdesc = if_register_socket(info, AF_INET, 0);
+diff -up dhcp-4.3.1b1/common/socket.c.bmgpWV dhcp-4.3.1b1/common/socket.c
+--- dhcp-4.3.1b1/common/socket.c.bmgpWV	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/common/socket.c	2014-07-10 17:52:57.706272281 +0200
+@@ -322,7 +322,7 @@ void if_register_send (info)
+ 	info->wfdesc = if_register_socket(info, AF_INET, 0, NULL);
  	/* If this is a normal IPv4 address, get the hardware address. */
  	if (strcmp(info->name, "fallback") != 0)
 -		get_hw_addr(info->name, &info->hw_address);
@@ -487,7 +536,7 @@ diff -up dhcp-4.2.2/common/socket.c.lpf-ib dhcp-4.2.2/common/socket.c
  #if defined (USE_SOCKET_FALLBACK)
  	/* Fallback only registers for send, but may need to receive as
  	   well. */
-@@ -387,7 +387,7 @@ void if_register_receive (info)
+@@ -385,7 +385,7 @@ void if_register_receive (info)
  #endif /* IP_PKTINFO... */
  	/* If this is a normal IPv4 address, get the hardware address. */
  	if (strcmp(info->name, "fallback") != 0)
@@ -496,7 +545,7 @@ diff -up dhcp-4.2.2/common/socket.c.lpf-ib dhcp-4.2.2/common/socket.c
  
  	if (!quiet_interface_discovery)
  		log_info ("Listening on Socket/%s%s%s",
-@@ -497,7 +497,7 @@ if_register6(struct interface_info *info
+@@ -499,7 +499,7 @@ if_register6(struct interface_info *info
  	if (req_multi)
  		if_register_multicast(info);
  
@@ -505,10 +554,19 @@ diff -up dhcp-4.2.2/common/socket.c.lpf-ib dhcp-4.2.2/common/socket.c
  
  	if (!quiet_interface_discovery) {
  		if (info->shared_network != NULL) {
-diff -up dhcp-4.2.2/includes/dhcpd.h.lpf-ib dhcp-4.2.2/includes/dhcpd.h
---- dhcp-4.2.2/includes/dhcpd.h.lpf-ib	2011-09-19 11:24:08.696775721 +0200
-+++ dhcp-4.2.2/includes/dhcpd.h	2011-09-19 11:24:08.707775438 +0200
-@@ -1243,6 +1243,7 @@ struct interface_info {
+@@ -555,7 +555,7 @@ if_register_linklocal6(struct interface_
+ 	info->rfdesc = sock;
+ 	info->wfdesc = sock;
+ 
+-	get_hw_addr(info->name, &info->hw_address);
++	get_hw_addr(info);
+ 
+ 	if (!quiet_interface_discovery) {
+ 		if (info->shared_network != NULL) {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV	2014-07-10 17:50:26.923402536 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h	2014-07-10 17:52:57.707272266 +0200
+@@ -1248,6 +1248,7 @@ struct interface_info {
  	struct shared_network *shared_network;
  				/* Networks connected to this interface. */
  	struct hardware hw_address;	/* Its physical address. */
@@ -516,7 +574,7 @@ diff -up dhcp-4.2.2/includes/dhcpd.h.lpf-ib dhcp-4.2.2/includes/dhcpd.h
  	struct in_addr *addresses;	/* Addresses associated with this
  					 * interface.
  					 */
-@@ -2356,7 +2357,7 @@ void print_dns_status (int, struct dhcp_
+@@ -2439,7 +2440,7 @@ void print_dns_status (int, struct dhcp_
  #endif
  const char *print_time(TIME);
  
@@ -525,14 +583,3 @@ diff -up dhcp-4.2.2/includes/dhcpd.h.lpf-ib dhcp-4.2.2/includes/dhcpd.h
  
  /* socket.c */
  #if defined (USE_SOCKET_SEND) || defined (USE_SOCKET_RECEIVE) \
-diff -up dhcp-4.2.2/includes/dhcp.h.lpf-ib dhcp-4.2.2/includes/dhcp.h
---- dhcp-4.2.2/includes/dhcp.h.lpf-ib	2011-09-19 11:24:08.696775721 +0200
-+++ dhcp-4.2.2/includes/dhcp.h	2011-09-19 11:24:08.707775438 +0200
-@@ -79,6 +79,7 @@ struct dhcp_packet {
- #define HTYPE_ETHER	1               /* Ethernet 10Mbps              */
- #define HTYPE_IEEE802	6               /* IEEE 802.2 Token Ring...	*/
- #define HTYPE_FDDI	8		/* FDDI...			*/
-+#define HTYPE_INFINIBAND 32		/* Infiniband IPoIB		*/
- 
- #define HTYPE_RESERVED  0               /* RFC 5494 */
- 
diff --git a/src/patches/dhcp-4.2.1-manpages.patch b/src/patches/dhcp/dhcp-manpages.patch
similarity index 53%
rename from src/patches/dhcp-4.2.1-manpages.patch
rename to src/patches/dhcp/dhcp-manpages.patch
index 9a42b7fc72..dde16c7352 100644
--- a/src/patches/dhcp-4.2.1-manpages.patch
+++ b/src/patches/dhcp/dhcp-manpages.patch
@@ -1,154 +1,7 @@
-diff -up dhcp-4.2.1b1/client/dhclient.8.man dhcp-4.2.1b1/client/dhclient.8
---- dhcp-4.2.1b1/client/dhclient.8.man	2010-07-14 22:09:34.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.8	2011-01-27 18:19:07.000000000 +0100
-@@ -115,6 +115,33 @@ dhclient - Dynamic Host Configuration Pr
- .B -w
- ]
- [
-+.B -B
-+]
-+[
-+.B -I
-+.I dhcp-client-identifier
-+]
-+[
-+.B -H
-+.I host-name
-+]
-+[
-+.B -F
-+.I fqdn.fqdn
-+]
-+[
-+.B -V
-+.I vendor-class-identifier
-+]
-+[
-+.B -R
-+.I request-option-list
-+]
-+[
-+.B -timeout
-+.I timeout
-+]
-+[
- .B -v
- ]
- [
-@@ -264,6 +291,69 @@ not to exit when it doesn't find any suc
- program can then be used to notify the client when a network interface
- has been added or removed, so that the client can attempt to configure an IP
- address on that interface.
-+
-+.TP
-+.BI \-B
-+Set the BOOTP broadcast flag in request packets so servers will always
-+broadcast replies.
-+
-+.TP
-+.BI \-I\ <dhcp-client-identifier>
-+Specify the dhcp-client-identifier option to send to the DHCP server.
-+
-+.TP
-+.BI \-H\ <host-name>
-+Specify the host-name option to send to the DHCP server.  The host-name
-+string only contains the client's hostname prefix, to which the server will
-+append the ddns-domainname or domain-name options, if any, to derive the
-+fully qualified domain name of the client.  The
-+.B -H
-+option cannot be used with the
-+.B -F
-+option.
-+
-+.TP
-+.BI \-F\ <fqdn.fqdn>
-+Specify the fqdn.fqdn option to send to the DHCP server.  This option cannot
-+be used with the
-+.B -H
-+option.  The fqdn.fqdn option must specify the complete domain name of the
-+client host, which the server may use for dynamic DNS updates.
-+
-+.TP
-+.BI \-V\ <vendor-class-identifier>
-+Specify the vendor-class-identifier option to send to the DHCP server.
-+
-+.TP
-+.BI \-R\ <option>[,<option>...]
-+Specify the list of options the client is to request from the server.  The
-+option list must be a single string consisting of option names separated
-+by at least one command and optional space characters.  The default option
-+list is:
-+
-+.BR
-+    subnet-mask, broadcast-address, time-offset, routers,
-+.BR
-+    domain-search, domain-name, domain-name-servers, host-name, 
-+.BR
-+    nis-domain, nis-servers, ntp-servers, interface-mtu
-+
-+.TP
-+.B -R
-+option does not append options to the default request, it overrides the
-+default request list.  Keep this in mind if you want to request an
-+additional option besides the default request list.  You will have to
-+specify all option names for the
-+.B -R
-+parameter.
-+
-+.TP
-+.BI \-timeout\ <timeout>
-+Specify the time after which
-+.B dhclient
-+will decide that no DHCP servers can be contacted when no responses have been
-+received.
-+
- .TP
- .BI \-n
- Do not configure any interfaces.  This is most likely to be useful in
-diff -up dhcp-4.2.1b1/client/dhclient.conf.5.man dhcp-4.2.1b1/client/dhclient.conf.5
---- dhcp-4.2.1b1/client/dhclient.conf.5.man	2010-09-15 01:03:56.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.conf.5	2011-01-27 18:22:56.000000000 +0100
-@@ -186,7 +186,8 @@ responding to the client send the client
- options.   Only the option names should be specified in the request
- statement - not option parameters.   By default, the DHCPv4 client
- requests the subnet-mask, broadcast-address, time-offset, routers,
--domain-name, domain-name-servers and host-name options while the DHCPv6
-+domain-search, domain-name, domain-name-servers, host-name, nis-domain,
-+nis-servers, ntp-servers and interface-mtu options while the DHCPv6
- client requests the dhcp6 name-servers and domain-search options.  Note
- that if you enter a \'request\' statement, you over-ride these defaults
- and these options will not be requested.
-@@ -672,6 +673,17 @@ know the DHCP service(s) anycast MAC add
- client.  The \fIlink-type\fR and \fImac-address\fR parameters are configured
- in a similar manner to the \fBhardware\fR statement.
- .PP
-+ \fBbootp-broadcast-always;\fR
-+.PP
-+The
-+.B bootp-broadcast-always
-+statement instructs dhclient to always set the bootp broadcast flag in
-+request packets, so that servers will always broadcast replies.
-+This is equivalent to supplying the dhclient -B argument, and has
-+the same effect as specifying 'always-broadcast' in the server's dhcpd.conf.
-+This option is provided as an extension to enable dhclient to work
-+on IBM s390 Linux guests.
-+.PP
- .SH SAMPLE
- The following configuration file is used on a laptop running NetBSD
- 1.3.   The laptop has an IP alias of 192.5.5.213, and has one
-@@ -697,7 +709,7 @@ interface "ep0" {
-     supersede domain-search "fugue.com", "rc.vix.com", "home.vix.com";
-     prepend domain-name-servers 127.0.0.1;
-     request subnet-mask, broadcast-address, time-offset, routers,
--	    domain-name, domain-name-servers, host-name;
-+	    domain-search, domain-name, domain-name-servers, host-name;
-     require subnet-mask, domain-name-servers;
-     script "CLIENTBINDIR/dhclient-script";
-     media "media 10baseT/UTP", "media 10base2/BNC";
-diff -up dhcp-4.2.1b1/client/dhclient-script.8.man dhcp-4.2.1b1/client/dhclient-script.8
---- dhcp-4.2.1b1/client/dhclient-script.8.man	2010-07-06 21:03:11.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient-script.8	2011-01-27 18:24:44.000000000 +0100
-@@ -47,7 +47,7 @@ customizations are needed, they should b
+diff -up dhcp-4.3.0a1/client/dhclient-script.8.man dhcp-4.3.0a1/client/dhclient-script.8
+--- dhcp-4.3.0a1/client/dhclient-script.8.man	2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0a1/client/dhclient-script.8	2013-12-19 15:27:17.617118805 +0100
+@@ -48,7 +48,7 @@ customizations are needed, they should b
  exit hooks provided (see HOOKS for details).   These hooks will allow the
  user to override the default behaviour of the client in creating a
  .B /etc/resolv.conf
@@ -157,7 +10,7 @@ diff -up dhcp-4.2.1b1/client/dhclient-script.8.man dhcp-4.2.1b1/client/dhclient-
  .PP
  No standard client script exists for some operating systems, even though
  the actual client may work, so a pioneering user may well need to create
-@@ -91,6 +91,26 @@ present.   The
+@@ -92,6 +92,26 @@ present.   The
  .B ETCDIR/dhclient-exit-hooks
  script can modify the valid of exit_status to change the exit status
  of dhclient-script.
@@ -184,10 +37,50 @@ diff -up dhcp-4.2.1b1/client/dhclient-script.8.man dhcp-4.2.1b1/client/dhclient-
  .SH OPERATION
  When dhclient needs to invoke the client configuration script, it
  defines a set of variables in the environment, and then invokes
-diff -up dhcp-4.2.1b1/common/dhcp-options.5.man dhcp-4.2.1b1/common/dhcp-options.5
---- dhcp-4.2.1b1/common/dhcp-options.5.man	2010-07-13 22:56:56.000000000 +0200
-+++ dhcp-4.2.1b1/common/dhcp-options.5	2011-01-27 18:25:57.000000000 +0100
-@@ -913,6 +913,21 @@ classless IP routing - it does not inclu
+diff -up dhcp-4.3.0a1/client/dhclient.conf.5.man dhcp-4.3.0a1/client/dhclient.conf.5
+--- dhcp-4.3.0a1/client/dhclient.conf.5.man	2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0a1/client/dhclient.conf.5	2013-12-19 15:27:17.617118805 +0100
+@@ -202,7 +202,8 @@ responding to the client send the client
+ options.  Only the option names should be specified in the request
+ statement - not option parameters.  By default, the DHCPv4 client
+ requests the subnet-mask, broadcast-address, time-offset, routers,
+-domain-name, domain-name-servers and host-name options while the DHCPv6
++domain-search, domain-name, domain-name-servers, host-name, nis-domain,
++nis-servers, ntp-servers and interface-mtu options while the DHCPv6
+ client requests the dhcp6 name-servers and domain-search options.  Note
+ that if you enter a \'request\' statement, you over-ride these defaults
+ and these options will not be requested.
+@@ -688,6 +689,17 @@ know the DHCP service(s) anycast MAC add
+ client.  The \fIlink-type\fR and \fImac-address\fR parameters are configured
+ in a similar manner to the \fBhardware\fR statement.
+ .PP
++ \fBbootp-broadcast-always;\fR
++.PP
++The
++.B bootp-broadcast-always
++statement instructs dhclient to always set the bootp broadcast flag in
++request packets, so that servers will always broadcast replies.
++This is equivalent to supplying the dhclient -B argument, and has
++the same effect as specifying 'always-broadcast' in the server's dhcpd.conf.
++This option is provided as an extension to enable dhclient to work
++on IBM s390 Linux guests.
++.PP
+ .SH SAMPLE
+ The following configuration file is used on a laptop running NetBSD
+ 1.3.  The laptop has an IP alias of 192.5.5.213, and has one
+@@ -713,7 +725,7 @@ interface "ep0" {
+     supersede domain-search "fugue.com", "rc.vix.com", "home.vix.com";
+     prepend domain-name-servers 127.0.0.1;
+     request subnet-mask, broadcast-address, time-offset, routers,
+-	    domain-name, domain-name-servers, host-name;
++	    domain-search, domain-name, domain-name-servers, host-name;
+     require subnet-mask, domain-name-servers;
+     script "CLIENTBINDIR/dhclient-script";
+     media "media 10baseT/UTP", "media 10base2/BNC";
+diff -up dhcp-4.3.0a1/common/dhcp-options.5.man dhcp-4.3.0a1/common/dhcp-options.5
+--- dhcp-4.3.0a1/common/dhcp-options.5.man	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/dhcp-options.5	2013-12-19 15:27:17.618118791 +0100
+@@ -914,6 +914,21 @@ classless IP routing - it does not inclu
  classless IP routing is now the most widely deployed routing standard,
  this option is virtually useless, and is not implemented by any of the
  popular DHCP clients, for example the Microsoft DHCP client.
@@ -209,10 +102,10 @@ diff -up dhcp-4.2.1b1/common/dhcp-options.5.man dhcp-4.2.1b1/common/dhcp-options
  .RE
  .PP
  .nf
-diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
---- dhcp-4.2.1b1/server/dhcpd.conf.5.man	2010-07-06 21:03:12.000000000 +0200
-+++ dhcp-4.2.1b1/server/dhcpd.conf.5	2011-01-27 18:29:12.000000000 +0100
-@@ -519,6 +519,9 @@ pool {
+diff -up dhcp-4.3.0a1/server/dhcpd.conf.5.man dhcp-4.3.0a1/server/dhcpd.conf.5
+--- dhcp-4.3.0a1/server/dhcpd.conf.5.man	2013-12-13 21:49:44.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcpd.conf.5	2013-12-19 15:30:14.266670962 +0100
+@@ -527,6 +527,9 @@ pool {
  };
  .fi
  .PP
@@ -222,7 +115,7 @@ diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
  The  server currently  does very  little  sanity checking,  so if  you
  configure it wrong, it will just  fail in odd ways.  I would recommend
  therefore that you either do  failover or don't do failover, but don't
-@@ -533,9 +536,9 @@ primary server might look like this:
+@@ -541,9 +544,9 @@ primary server might look like this:
  failover peer "foo" {
    primary;
    address anthrax.rc.vix.com;
@@ -234,7 +127,7 @@ diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
    max-response-delay 60;
    max-unacked-updates 10;
    mclt 3600;
-@@ -1305,7 +1308,7 @@ the zone containing PTR records - for IS
+@@ -1241,7 +1244,7 @@ the zone containing PTR records - for IS
  .PP
  .nf
  key DHCP_UPDATER {
@@ -243,7 +136,7 @@ diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
    secret pRP5FapFoJ95JEL06sv4PQ==;
  };
  
-@@ -1328,7 +1331,7 @@ dhcpd.conf file:
+@@ -1264,7 +1267,7 @@ dhcpd.conf file:
  .PP
  .nf
  key DHCP_UPDATER {
@@ -252,10 +145,10 @@ diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
    secret pRP5FapFoJ95JEL06sv4PQ==;
  };
  
-@@ -2540,7 +2543,8 @@ statement
+@@ -2539,7 +2542,8 @@ statement
  The \fInext-server\fR statement is used to specify the host address of
  the server from which the initial boot file (specified in the
- \fIfilename\fR statement) is to be loaded.   \fIServer-name\fR should
+ \fIfilename\fR statement) is to be loaded.  \fIServer-name\fR should
 -be a numeric IP address or a domain name.
 +be a numeric IP address or a domain name.  If no \fInext-server\fR statement
 +applies to a given client, the address 0.0.0.0 is used.
diff --git a/src/patches/dhcp/dhcp-paranoia.patch b/src/patches/dhcp/dhcp-paranoia.patch
new file mode 100644
index 0000000000..0f2db8c18a
--- /dev/null
+++ b/src/patches/dhcp/dhcp-paranoia.patch
@@ -0,0 +1,156 @@
+diff -up dhcp-4.3.1b1/client/dhclient.c.dlTsyN dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.dlTsyN	2014-07-10 17:49:49.882925843 +0200
++++ dhcp-4.3.1b1/client/dhclient.c	2014-07-10 17:50:26.922402550 +0200
+@@ -1748,11 +1748,6 @@ int write_host (host)
+ 	return 0;
+ }
+ 
+-void db_startup (testp)
+-	int testp;
+-{
+-}
+-
+ void bootp (packet)
+ 	struct packet *packet;
+ {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN	2014-07-10 17:48:03.798424601 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h	2014-07-10 17:50:26.923402536 +0200
+@@ -2866,7 +2866,11 @@ void commit_leases_timeout (void *);
+ void commit_leases_readerdry(void *);
+ int commit_leases (void);
+ int commit_leases_timed (void);
++#if defined (PARANOIA)
++void db_startup (int, uid_t, gid_t);
++#else
+ void db_startup (int);
++#endif /* PARANOIA */
+ int new_lease_file (void);
+ int group_writer (struct group_object *);
+ int write_ia(const struct ia_xx *);
+diff -up dhcp-4.3.1b1/server/confpars.c.dlTsyN dhcp-4.3.1b1/server/confpars.c
+--- dhcp-4.3.1b1/server/confpars.c.dlTsyN	2014-07-10 17:39:25.801764596 +0200
++++ dhcp-4.3.1b1/server/confpars.c	2014-07-10 17:50:26.924402522 +0200
+@@ -219,7 +219,11 @@ void trace_conf_input (trace_type_t *tty
+ 	}
+ 
+ 	if (!leaseconf_initialized && ttype == trace_readleases_type) {
++#if defined (PARANOIA)
++		db_startup (0, 0, 0);
++#else
+ 		db_startup (0);
++#endif /* PARANOIA */
+ 		leaseconf_initialized = 1;
+ 		postdb_startup ();
+ 	}
+diff -up dhcp-4.3.1b1/server/db.c.dlTsyN dhcp-4.3.1b1/server/db.c
+--- dhcp-4.3.1b1/server/db.c.dlTsyN	2014-07-10 17:39:25.801764596 +0200
++++ dhcp-4.3.1b1/server/db.c	2014-07-10 17:50:26.925402508 +0200
+@@ -42,6 +42,10 @@ static int counting = 0;
+ static int count = 0;
+ TIME write_time;
+ int lease_file_is_corrupt = 0;
++#if defined (PARANOIA)
++uid_t global_set_uid = 0;
++gid_t global_set_gid = 0;
++#endif /* PARANOIA */
+ 
+ /* Write a single binding scope value in parsable format.
+  */
+@@ -1046,8 +1050,11 @@ int commit_leases_timed()
+ 	return (1);
+ }
+ 
+-void db_startup (testp)
+-	int testp;
++#if defined (PARANOIA)
++void db_startup (int testp, uid_t set_uid, gid_t set_gid)
++#else
++void db_startup (int testp)
++#endif /* PARANOIA */
+ {
+ 	isc_result_t status;
+ 
+@@ -1066,6 +1073,11 @@ void db_startup (testp)
+ 	}
+ #endif
+ 
++#if defined (PARANOIA)
++	global_set_uid = set_uid;
++	global_set_gid = set_gid;
++#endif /* PARANOIA */
++
+ #if defined (TRACING)
+ 	/* If we're playing back, there is no lease file, so we can't
+ 	   append it, so we create one immediately (maybe this isn't
+@@ -1128,6 +1140,17 @@ int new_lease_file ()
+ 		log_error ("Can't create new lease file: %m");
+ 		return 0;
+ 	}
++
++#if defined (PARANOIA)
++	if (global_set_uid && !geteuid() &&
++	    global_set_gid && !getegid())
++		if (fchown(db_fd, global_set_uid, global_set_gid)) {
++			log_fatal ("Can't chown new lease file: %m");
++			close(db_fd);
++			goto fdfail;
++	}
++#endif /* PARANOIA */
++
+ 	if ((new_db_file = fdopen(db_fd, "we")) == NULL) {
+ 		log_error("Can't fdopen new lease file: %m");
+ 		close(db_fd);
+diff -up dhcp-4.3.1b1/server/dhcpd.8.dlTsyN dhcp-4.3.1b1/server/dhcpd.8
+--- dhcp-4.3.1b1/server/dhcpd.8.dlTsyN	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/server/dhcpd.8	2014-07-10 17:50:26.925402508 +0200
+@@ -82,6 +82,18 @@ dhcpd - Dynamic Host Configuration Proto
+ .I trace-output-file
+ ]
+ [
++.B -user
++.I user
++]
++[
++.B -group
++.I group
++]
++[
++.B -chroot
++.I dir
++]
++[
+ .B -play
+ .I trace-playback-file
+ ]
+@@ -269,6 +281,15 @@ lease file.
+ .TP
+ .BI --version
+ Print version number and exit.
++.TP
++.BI \-user \ user
++Setuid to user after completing privileged operations, such as creating sockets that listen on privileged ports.
++.TP
++.BI \-group \ group
++Setgid to group after completing privileged operations, such as creating sockets that listen on privileged ports.
++.TP
++.BI \-chroot \ dir
++Chroot to directory after processing the command line arguments, but before reading the configuration file.
+ .PP
+ .I Modifying default file locations:
+ The following options can be used to modify the locations 
+diff -up dhcp-4.3.1b1/server/dhcpd.c.dlTsyN dhcp-4.3.1b1/server/dhcpd.c
+--- dhcp-4.3.1b1/server/dhcpd.c.dlTsyN	2014-07-10 17:39:25.802764582 +0200
++++ dhcp-4.3.1b1/server/dhcpd.c	2014-07-10 17:52:35.341588248 +0200
+@@ -628,7 +628,11 @@ main(int argc, char **argv) {
+ 	group_write_hook = group_writer;
+ 
+ 	/* Start up the database... */
++#if defined (PARANOIA)
++	db_startup (lftest, set_uid, set_gid);
++#else
+ 	db_startup (lftest);
++#endif /* PARANOIA */
+ 
+ 	if (lftest)
+ 		exit (0);
diff --git a/src/patches/dhcp-4.2.0-paths.patch b/src/patches/dhcp/dhcp-paths.patch
similarity index 72%
rename from src/patches/dhcp-4.2.0-paths.patch
rename to src/patches/dhcp/dhcp-paths.patch
index 54c7aba8e6..2f43e51fec 100644
--- a/src/patches/dhcp-4.2.0-paths.patch
+++ b/src/patches/dhcp/dhcp-paths.patch
@@ -1,7 +1,6 @@
-diff -up dhcp-4.2.0/includes/dhcpd.h.paths dhcp-4.2.0/includes/dhcpd.h
---- dhcp-4.2.0/includes/dhcpd.h.paths	2010-07-21 13:55:42.000000000 +0200
-+++ dhcp-4.2.0/includes/dhcpd.h	2010-07-21 14:29:57.000000000 +0200
-@@ -1390,15 +1390,15 @@ typedef unsigned char option_mask [16];
+--- expanded_org/includes/dhcpd.h	Wed Aug 06 23:35:02 2014
++++ expanded_patched_51_4_2_0_paths_patch/includes/dhcpd.h	Mon Feb 16 13:22:11 2015
+@@ -1424,15 +1424,15 @@
  #else /* !DEBUG */
  
  #ifndef _PATH_DHCPD_CONF
@@ -20,7 +19,7 @@ diff -up dhcp-4.2.0/includes/dhcpd.h.paths dhcp-4.2.0/includes/dhcpd.h
  #endif
  
  #ifndef _PATH_DHCPD_PID
-@@ -1412,7 +1412,7 @@ typedef unsigned char option_mask [16];
+@@ -1446,7 +1446,7 @@
  #endif /* DEBUG */
  
  #ifndef _PATH_DHCLIENT_CONF
@@ -29,7 +28,7 @@ diff -up dhcp-4.2.0/includes/dhcpd.h.paths dhcp-4.2.0/includes/dhcpd.h
  #endif
  
  #ifndef _PATH_DHCLIENT_SCRIPT
-@@ -1428,11 +1428,11 @@ typedef unsigned char option_mask [16];
+@@ -1462,11 +1462,11 @@
  #endif
  
  #ifndef _PATH_DHCLIENT_DB
diff --git a/src/patches/dhcp-4.2.0-release-by-ifup.patch b/src/patches/dhcp/dhcp-release-by-ifup.patch
similarity index 88%
rename from src/patches/dhcp-4.2.0-release-by-ifup.patch
rename to src/patches/dhcp/dhcp-release-by-ifup.patch
index 300c5f334b..677eb5c752 100644
--- a/src/patches/dhcp-4.2.0-release-by-ifup.patch
+++ b/src/patches/dhcp/dhcp-release-by-ifup.patch
@@ -1,8 +1,8 @@
-diff -up dhcp-4.2.0/client/dhclient.c.ifup dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.ifup	2010-07-21 13:30:10.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c	2010-07-21 13:37:03.000000000 +0200
-@@ -497,9 +497,81 @@ main(int argc, char **argv) {
- 					kill(oldpid, SIGTERM);
+diff -up dhcp-4.3.0a1/client/dhclient.c.ifup dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.ifup	2013-12-19 14:53:08.817760677 +0100
++++ dhcp-4.3.0a1/client/dhclient.c	2013-12-19 15:05:16.290518574 +0100
+@@ -521,9 +521,81 @@ main(int argc, char **argv) {
+ 				}
  			}
  			fclose(pidfd);
 +		} else {
diff --git a/src/patches/dhcp/dhcp-remove-bind.patch b/src/patches/dhcp/dhcp-remove-bind.patch
new file mode 100644
index 0000000000..5ab0338b30
--- /dev/null
+++ b/src/patches/dhcp/dhcp-remove-bind.patch
@@ -0,0 +1,192 @@
+diff -up dhcp-4.3.1b1/client/Makefile.am.brGmwh dhcp-4.3.1b1/client/Makefile.am
+--- dhcp-4.3.1b1/client/Makefile.am.brGmwh	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/Makefile.am	2014-07-10 17:36:30.484250976 +0200
+@@ -10,8 +10,8 @@ dhclient_SOURCES = clparse.c dhclient.c
+ 		   scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
+ 		   scripts/netbsd scripts/nextstep scripts/openbsd \
+ 		   scripts/solaris scripts/openwrt
+-dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../bind/lib/libirs.a \
+-		 ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++		 $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
+ EXTRA_DIST = $(man_MANS)
+ 
+diff -up dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh dhcp-4.3.1b1/common/tests/Makefile.am
+--- dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh	2014-07-10 17:36:30.485250962 +0200
++++ dhcp-4.3.1b1/common/tests/Makefile.am	2014-07-10 17:38:04.010924566 +0200
+@@ -13,21 +13,20 @@ ATF_TESTS += alloc_unittest dns_unittest
+ alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c
+ alloc_unittest_LDADD = $(ATF_LDFLAGS)
+ alloc_unittest_LDADD += ../libdhcp.a  \
+-	../../omapip/libomapi.a ../../bind/lib/libirs.a \
+-	../../bind/lib/libdns.a ../../bind/lib/libisccfg.a  ../../bind/lib/libisc.a
++	../../omapip/libomapi.a \
++	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ dns_unittest_LDADD = $(ATF_LDFLAGS)
+ dns_unittest_LDADD += ../libdhcp.a  \
+-	../../omapip/libomapi.a ../../bind/lib/libirs.a \
+-	../../bind/lib/libdns.a ../../bind/lib/libisccfg.a  ../../bind/lib/libisc.a
++	../../omapip/libomapi.a \
++	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ misc_unittest_LDADD = $(ATF_LDFLAGS)
+ misc_unittest_LDADD += ../libdhcp.a  \
+-	../../omapip/libomapi.a ../../bind/lib/libirs.a \
+-	../../bind/lib/libdns.a ../../bind/lib/libisccfg.a  ../../bind/lib/libisc.a
+-
++	../../omapip/libomapi.a \
++	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ check: $(ATF_TESTS)
+ 	atf-run | atf-report
+ 
+diff -up dhcp-4.3.1b1/configure.ac.brGmwh dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.brGmwh	2014-07-02 20:01:26.000000000 +0200
++++ dhcp-4.3.1b1/configure.ac	2014-07-10 17:36:30.485250962 +0200
+@@ -562,20 +562,37 @@ AC_CHECK_MEMBER(struct msghdr.msg_contro
+ 
+ libbind=
+ AC_ARG_WITH(libbind,
+-	AS_HELP_STRING([--with-libbind=PATH],[bind includes and libraries are in PATH 
+-		        (default is ./bind)]),
++	AS_HELP_STRING([--with-libbind=PATH],[bind includes are in PATH 
++		        (default is ./bind/includes)]),
+ 	use_libbind="$withval", use_libbind="no")
+ case "$use_libbind" in 
++yes|no)
++	libbind="\${top_srcdir}/bind/include"
++	;;
++*)
++	libbind="$use_libbind"
++	;;
++esac
++
++BIND9_LIBDIR='-L$(top_builddir)/bind/lib'
++AC_ARG_WITH(libbind-libs,
++	AC_HELP_STRING([--with-libbind-libs=PATH],
++		       [bind9 export libraries are in PATH]),
++		       [libbind_libs="$withval"], [libbind_libs='no'])
++case "$libbind_libs" in
+ yes)
+-	libbind="\${top_srcdir}/bind"
++	AC_MSG_ERROR([Specify path to bind9 libraries])
+ 	;;
+ no)
+-	libbind="\${top_srcdir}/bind"
++	BUNDLED_BIND=yes
+ 	;;
+ *)
+-	libbind="$use_libbind"
++	BIND9_LIBDIR="-L$libbind_libs"
++	BUNDLED_BIND=no
+ 	;;
+ esac
++AM_CONDITIONAL([BUNDLED_BIND], [test "$BUNDLED_BIND" = yes])
++AC_SUBST([BIND9_LIBDIR])
+ 
+ # OpenLDAP support.
+ AC_ARG_WITH(ldap,
+@@ -610,7 +627,7 @@ fi
+ CFLAGS="$CFLAGS $STD_CWARNINGS"
+ 
+ # Try to add the bind include directory
+-CFLAGS="$CFLAGS -I$libbind/include"
++CFLAGS="$CFLAGS -I$libbind"
+ 
+ case "$host" in
+ *-darwin*)
+diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh dhcp-4.3.1b1/dhcpctl/Makefile.am
+--- dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/dhcpctl/Makefile.am	2014-07-10 17:36:30.485250962 +0200
+@@ -6,12 +6,9 @@ EXTRA_DIST = $(man_MANS)
+ 
+ omshell_SOURCES = omshell.c
+ omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
+-	        ../bind/lib/libirs.a ../bind/lib/libdns.a \
+-	        ../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++	        $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
+ 
+ cltest_SOURCES = cltest.c
+ cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
+-	       ../bind/lib/libirs.a ../bind/lib/libdns.a \
+-               ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++	       $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/Makefile.am.brGmwh dhcp-4.3.1b1/Makefile.am
+--- dhcp-4.3.1b1/Makefile.am.brGmwh	2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/Makefile.am	2014-07-10 17:36:30.484250976 +0200
+@@ -25,7 +25,13 @@ EXTRA_DIST = RELNOTES LICENSE \
+ 	     bind/Makefile bind/bind.tar.gz bind/version.tmp \
+ 	     common/tests/Atffile server/tests/Atffile
+ 
+-SUBDIRS = bind includes tests common dst omapip client dhcpctl relay server
++if BUNDLED_BIND
++SUBDIRS = bind
++else
++SUBDIRS = 
++endif
++
++SUBDIRS += includes tests common dst omapip client dhcpctl relay server
+ 
+ nobase_include_HEADERS = dhcpctl/dhcpctl.h
+ 
+diff -up dhcp-4.3.1b1/omapip/Makefile.am.brGmwh dhcp-4.3.1b1/omapip/Makefile.am
+--- dhcp-4.3.1b1/omapip/Makefile.am.brGmwh	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/omapip/Makefile.am	2014-07-10 17:36:30.486250948 +0200
+@@ -10,6 +10,5 @@ man_MANS = omapi.3
+ EXTRA_DIST = $(man_MANS)
+ 
+ svtest_SOURCES = test.c
+-svtest_LDADD = libomapi.a ../bind/lib/libirs.a ../bind/lib/libdns.a \
+-		../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++svtest_LDADD = libomapi.a \
++	       $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/relay/Makefile.am.brGmwh dhcp-4.3.1b1/relay/Makefile.am
+--- dhcp-4.3.1b1/relay/Makefile.am.brGmwh	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/relay/Makefile.am	2014-07-10 17:36:30.486250948 +0200
+@@ -3,8 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+ sbin_PROGRAMS = dhcrelay
+ dhcrelay_SOURCES = dhcrelay.c
+ dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
+-		 ../bind/lib/libirs.a ../bind/lib/libdns.a \
+-		 ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++		 $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcrelay.8
+ EXTRA_DIST = $(man_MANS)
+ 
+diff -up dhcp-4.3.1b1/server/Makefile.am.brGmwh dhcp-4.3.1b1/server/Makefile.am
+--- dhcp-4.3.1b1/server/Makefile.am.brGmwh	2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/server/Makefile.am	2014-07-10 17:36:30.486250948 +0200
+@@ -13,10 +13,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
+ 		dhcpv6.c mdb6.c ldap.c ldap_casa.c
+ 
+ dhcpd_CFLAGS = $(LDAP_CFLAGS)
+-dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
+-	      ../dhcpctl/libdhcpctl.a ../bind/lib/libirs.a \
+-	      ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \
++	      $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
+ EXTRA_DIST = $(man_MANS)
+ 
+diff -up dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh dhcp-4.3.1b1/server/tests/Makefile.am
+--- dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh	2014-07-02 19:58:40.000000000 +0200
++++ dhcp-4.3.1b1/server/tests/Makefile.am	2014-07-10 17:36:30.486250948 +0200
+@@ -18,9 +18,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa
+           ../ldap.c ../ldap_casa.c ../dhcpd.c
+ 
+ DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a    \
+-          $(top_builddir)/dhcpctl/libdhcpctl.a $(top_builddir)/bind/lib/libirs.a \
+-	  $(top_builddir)/bind/lib/libdns.a $(top_builddir)/bind/lib/libisccfg.a \
+-	  $(top_builddir)/bind/lib/libisc.a
++          $(top_builddir)/dhcpctl/libdhcpctl.a \
++          $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ ATF_TESTS =
+ TESTS = 
diff --git a/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch b/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
similarity index 74%
rename from src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
rename to src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
index 0a0bfcb66d..94ed5ba24e 100644
--- a/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
+++ b/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.rfc3442 dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.rfc3442	2011-07-01 14:22:38.031534508 +0200
-+++ dhcp-4.2.2b1/client/clparse.c	2011-07-01 14:22:38.128532940 +0200
-@@ -37,7 +37,7 @@
+diff -up dhcp-4.3.0rc1/client/clparse.c.rfc3442 dhcp-4.3.0rc1/client/clparse.c
+--- dhcp-4.3.0rc1/client/clparse.c.rfc3442	2014-01-29 10:05:48.474400352 +0100
++++ dhcp-4.3.0rc1/client/clparse.c	2014-01-29 10:05:48.517399955 +0100
+@@ -31,7 +31,7 @@
  
  struct client_config top_level_config;
  
@@ -10,7 +10,7 @@ diff -up dhcp-4.2.2b1/client/clparse.c.rfc3442 dhcp-4.2.2b1/client/clparse.c
  struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
  
  static void parse_client_default_duid(struct parse *cfile);
-@@ -82,7 +82,11 @@ isc_result_t read_client_conf ()
+@@ -84,7 +84,11 @@ isc_result_t read_client_conf ()
  				dhcp_universe.code_hash, &code, 0, MDL);
  
  	/* 4 */
@@ -23,7 +23,7 @@ diff -up dhcp-4.2.2b1/client/clparse.c.rfc3442 dhcp-4.2.2b1/client/clparse.c
  	option_code_hash_lookup(&default_requested_options[3],
  				dhcp_universe.code_hash, &code, 0, MDL);
  
-@@ -136,6 +140,11 @@ isc_result_t read_client_conf ()
+@@ -138,6 +142,11 @@ isc_result_t read_client_conf ()
  	option_code_hash_lookup(&default_requested_options[13],
  				dhcp_universe.code_hash, &code, 0, MDL);
  
@@ -35,10 +35,10 @@ diff -up dhcp-4.2.2b1/client/clparse.c.rfc3442 dhcp-4.2.2b1/client/clparse.c
  	for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) {
  		if (default_requested_options[code] == NULL)
  			log_fatal("Unable to find option definition for "
-diff -up dhcp-4.2.2b1/common/dhcp-options.5.rfc3442 dhcp-4.2.2b1/common/dhcp-options.5
---- dhcp-4.2.2b1/common/dhcp-options.5.rfc3442	2011-07-01 14:22:38.020534686 +0200
-+++ dhcp-4.2.2b1/common/dhcp-options.5	2011-07-01 14:22:38.129532924 +0200
-@@ -115,6 +115,26 @@ hexadecimal, separated by colons.   For 
+diff -up dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442 dhcp-4.3.0rc1/common/dhcp-options.5
+--- dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442	2014-01-29 10:05:48.466400426 +0100
++++ dhcp-4.3.0rc1/common/dhcp-options.5	2014-01-29 10:05:48.518399945 +0100
+@@ -111,6 +111,26 @@ hexadecimal, separated by colons.  For e
  or
    option dhcp-client-identifier 43:4c:49:45:54:2d:46:4f:4f;
  .fi
@@ -64,8 +64,8 @@ diff -up dhcp-4.2.2b1/common/dhcp-options.5.rfc3442 dhcp-4.2.2b1/common/dhcp-opt
 +.fi
  .SH SETTING OPTION VALUES USING EXPRESSIONS
  Sometimes it's helpful to be able to set the value of a DHCP option
- based on some value that the client has sent.   To do this, you can
-@@ -931,6 +951,29 @@ dhclient-script will create routes:
+ based on some value that the client has sent.  To do this, you can
+@@ -972,6 +992,29 @@ dhclient-script will create routes:
  .RE
  .PP
  .nf
@@ -95,10 +95,10 @@ diff -up dhcp-4.2.2b1/common/dhcp-options.5.rfc3442 dhcp-4.2.2b1/common/dhcp-opt
  .B option \fBstreettalk-directory-assistance-server\fR \fIip-address\fR
                                             [\fB,\fR \fIip-address\fR...]\fB;\fR
  .fi
-diff -up dhcp-4.2.2b1/common/inet.c.rfc3442 dhcp-4.2.2b1/common/inet.c
---- dhcp-4.2.2b1/common/inet.c.rfc3442	2011-05-11 02:47:22.000000000 +0200
-+++ dhcp-4.2.2b1/common/inet.c	2011-07-01 14:22:38.130532908 +0200
-@@ -528,6 +528,60 @@ free_iaddrcidrnetlist(struct iaddrcidrne
+diff -up dhcp-4.3.0rc1/common/inet.c.rfc3442 dhcp-4.3.0rc1/common/inet.c
+--- dhcp-4.3.0rc1/common/inet.c.rfc3442	2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/inet.c	2014-01-29 10:05:48.519399936 +0100
+@@ -521,6 +521,60 @@ free_iaddrcidrnetlist(struct iaddrcidrne
  	return ISC_R_SUCCESS;
  }
  
@@ -159,10 +159,10 @@ diff -up dhcp-4.2.2b1/common/inet.c.rfc3442 dhcp-4.2.2b1/common/inet.c
  /* piaddr() turns an iaddr structure into a printable address. */
  /* XXX: should use a const pointer rather than passing the structure */
  const char *
-diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
---- dhcp-4.2.2b1/common/options.c.rfc3442	2011-03-24 22:57:13.000000000 +0100
-+++ dhcp-4.2.2b1/common/options.c	2011-07-01 14:22:38.132532876 +0200
-@@ -706,7 +706,11 @@ cons_options(struct packet *inpacket, st
+diff -up dhcp-4.3.0rc1/common/options.c.rfc3442 dhcp-4.3.0rc1/common/options.c
+--- dhcp-4.3.0rc1/common/options.c.rfc3442	2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/options.c	2014-01-29 10:05:48.520399927 +0100
+@@ -707,7 +707,11 @@ cons_options(struct packet *inpacket, st
  		 * packet.
  		 */
  		priority_list[priority_len++] = DHO_SUBNET_MASK;
@@ -175,15 +175,15 @@ diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
  		priority_list[priority_len++] = DHO_DOMAIN_NAME_SERVERS;
  		priority_list[priority_len++] = DHO_HOST_NAME;
  		priority_list[priority_len++] = DHO_FQDN;
-@@ -1683,6 +1687,7 @@ const char *pretty_print_option (option,
- 	const unsigned char *dp = data;
- 	char comma;
+@@ -1688,6 +1692,7 @@ const char *pretty_print_option (option,
  	unsigned long tval;
-+        unsigned int octets = 0;
+ 	isc_boolean_t a_array = ISC_FALSE;
+ 	int len_used;
++	unsigned int octets = 0;
  
  	if (emit_commas)
  		comma = ',';
-@@ -1691,6 +1696,7 @@ const char *pretty_print_option (option,
+@@ -1696,6 +1701,7 @@ const char *pretty_print_option (option,
  
  	memset (enumbuf, 0, sizeof enumbuf);
  
@@ -191,7 +191,7 @@ diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
  	/* Figure out the size of the data. */
  	for (l = i = 0; option -> format [i]; i++, l++) {
  		if (l >= sizeof(fmtbuf) - 1)
-@@ -1840,6 +1846,33 @@ const char *pretty_print_option (option,
+@@ -1870,6 +1876,33 @@ const char *pretty_print_option (option,
  	if (numhunk < 0)
  		numhunk = 1;
  
@@ -224,8 +224,8 @@ diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
 +
  	/* Cycle through the array (or hunk) printing the data. */
  	for (i = 0; i < numhunk; i++) {
- 		for (j = 0; j < numelem; j++) {
-@@ -1978,6 +2011,20 @@ const char *pretty_print_option (option,
+ 		if ((a_array == ISC_TRUE) && (i != 0) && (numelem > 0)) {
+@@ -2025,6 +2058,20 @@ const char *pretty_print_option (option,
  				strcpy(op, piaddr(iaddr));
  				dp += 4;
  				break;
@@ -246,10 +246,10 @@ diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
  			      case '6':
  				iaddr.len = 16;
  				memcpy(iaddr.iabuf, dp, 16);
-diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
---- dhcp-4.2.2b1/common/parse.c.rfc3442	2011-07-01 14:22:38.097533441 +0200
-+++ dhcp-4.2.2b1/common/parse.c	2011-07-01 14:22:38.135532828 +0200
-@@ -341,6 +341,39 @@ int parse_ip_addr (cfile, addr)
+diff -up dhcp-4.3.0rc1/common/parse.c.rfc3442 dhcp-4.3.0rc1/common/parse.c
+--- dhcp-4.3.0rc1/common/parse.c.rfc3442	2014-01-29 10:05:48.491400195 +0100
++++ dhcp-4.3.0rc1/common/parse.c	2014-01-29 10:05:48.522399908 +0100
+@@ -335,6 +335,39 @@ int parse_ip_addr (cfile, addr)
  }	
  
  /*
@@ -289,7 +289,7 @@ diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
   * Return true if every character in the string is hexadecimal.
   */
  static int
-@@ -700,8 +733,10 @@ unsigned char *parse_numeric_aggregate (
+@@ -713,8 +746,10 @@ unsigned char *parse_numeric_aggregate (
  		if (count) {
  			token = peek_token (&val, (unsigned *)0, cfile);
  			if (token != separator) {
@@ -301,7 +301,7 @@ diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
  				if (token != RBRACE && token != LBRACE)
  					token = next_token (&val,
  							    (unsigned *)0,
-@@ -1624,6 +1659,9 @@ int parse_option_code_definition (cfile,
+@@ -1654,6 +1689,9 @@ int parse_option_code_definition (cfile,
  	      case IP_ADDRESS:
  		type = 'I';
  		break;
@@ -311,7 +311,7 @@ diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
  	      case IP6_ADDRESS:
  		type = '6';
  		break;
-@@ -5288,6 +5326,15 @@ int parse_option_token (rv, cfile, fmt, 
+@@ -5071,6 +5109,15 @@ int parse_option_token (rv, cfile, fmt,
  		}
  		break;
  
@@ -327,7 +327,7 @@ diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
  	      case '6': /* IPv6 address. */
  		if (!parse_ip6_addr(cfile, &addr)) {
  			return 0;
-@@ -5548,6 +5595,13 @@ int parse_option_decl (oc, cfile)
+@@ -5348,6 +5395,13 @@ int parse_option_decl (oc, cfile)
  					goto exit;
  				len = ip_addr.len;
  				dp = ip_addr.iabuf;
@@ -341,10 +341,10 @@ diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
  
  			      alloc:
  				if (hunkix + len > sizeof hunkbuf) {
-diff -up dhcp-4.2.2b1/common/tables.c.rfc3442 dhcp-4.2.2b1/common/tables.c
---- dhcp-4.2.2b1/common/tables.c.rfc3442	2011-07-01 14:22:38.087533601 +0200
-+++ dhcp-4.2.2b1/common/tables.c	2011-07-01 14:22:38.137532796 +0200
-@@ -51,6 +51,7 @@ HASH_FUNCTIONS (option_code, const unsig
+diff -up dhcp-4.3.0rc1/common/tables.c.rfc3442 dhcp-4.3.0rc1/common/tables.c
+--- dhcp-4.3.0rc1/common/tables.c.rfc3442	2014-01-29 10:05:48.485400250 +0100
++++ dhcp-4.3.0rc1/common/tables.c	2014-01-29 10:06:25.724038563 +0100
+@@ -46,6 +46,7 @@ HASH_FUNCTIONS (option_code, const unsig
     Format codes:
  
     I - IPv4 address
@@ -352,18 +352,18 @@ diff -up dhcp-4.2.2b1/common/tables.c.rfc3442 dhcp-4.2.2b1/common/tables.c
     6 - IPv6 address
     l - 32-bit signed integer
     L - 32-bit unsigned integer
-@@ -208,6 +209,7 @@ static struct option dhcp_options[] = {
- 	{ "default-url", "t",			&dhcp_universe, 114, 1 },
+@@ -214,6 +215,7 @@ static struct option dhcp_options[] = {
+ #endif
  	{ "subnet-selection", "I",		&dhcp_universe, 118, 1 },
- 	{ "domain-search", "D",		&dhcp_universe, 119, 1 },
+ 	{ "domain-search", "D",			&dhcp_universe, 119, 1 },
 +	{ "classless-static-routes", "RIA",	&dhcp_universe, 121, 1 },
  	{ "vivco", "Evendor-class.",		&dhcp_universe, 124, 1 },
  	{ "vivso", "Evendor.",			&dhcp_universe, 125, 1 },
  #if 0
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.rfc3442 dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.rfc3442	2011-07-01 14:22:38.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h	2011-07-01 14:24:19.999810333 +0200
-@@ -2662,6 +2662,7 @@ isc_result_t range2cidr(struct iaddrcidr
+diff -up dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442 dhcp-4.3.0rc1/includes/dhcpd.h
+--- dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442	2014-01-29 10:05:48.470400389 +0100
++++ dhcp-4.3.0rc1/includes/dhcpd.h	2014-01-29 10:05:48.525399881 +0100
+@@ -2725,6 +2725,7 @@ isc_result_t range2cidr(struct iaddrcidr
  			const struct iaddr *lo, const struct iaddr *hi);
  isc_result_t free_iaddrcidrnetlist(struct iaddrcidrnetlist **result);
  const char *piaddr (struct iaddr);
@@ -371,7 +371,7 @@ diff -up dhcp-4.2.2b1/includes/dhcpd.h.rfc3442 dhcp-4.2.2b1/includes/dhcpd.h
  char *piaddrmask(struct iaddr *, struct iaddr *);
  char *piaddrcidr(const struct iaddr *, unsigned int);
  u_int16_t validate_port(char *);
-@@ -2869,6 +2870,7 @@ void parse_client_lease_declaration (str
+@@ -2934,6 +2935,7 @@ void parse_client_lease_declaration (str
  int parse_option_decl (struct option_cache **, struct parse *);
  void parse_string_list (struct parse *, struct string_list **, int);
  int parse_ip_addr (struct parse *, struct iaddr *);
@@ -379,10 +379,10 @@ diff -up dhcp-4.2.2b1/includes/dhcpd.h.rfc3442 dhcp-4.2.2b1/includes/dhcpd.h
  int parse_ip_addr_with_subnet(struct parse *, struct iaddrmatch *);
  void parse_reject_statement (struct parse *, struct client_config *);
  
-diff -up dhcp-4.2.2b1/includes/dhcp.h.rfc3442 dhcp-4.2.2b1/includes/dhcp.h
---- dhcp-4.2.2b1/includes/dhcp.h.rfc3442	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/includes/dhcp.h	2011-07-01 14:22:38.145532665 +0200
-@@ -158,6 +158,7 @@ struct dhcp_packet {
+diff -up dhcp-4.3.0rc1/includes/dhcp.h.rfc3442 dhcp-4.3.0rc1/includes/dhcp.h
+--- dhcp-4.3.0rc1/includes/dhcp.h.rfc3442	2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/includes/dhcp.h	2014-01-29 10:05:48.524399890 +0100
+@@ -159,6 +159,7 @@ struct dhcp_packet {
  #define DHO_ASSOCIATED_IP			92
  #define DHO_SUBNET_SELECTION			118 /* RFC3011! */
  #define DHO_DOMAIN_SEARCH			119 /* RFC3397 */
@@ -390,16 +390,16 @@ diff -up dhcp-4.2.2b1/includes/dhcp.h.rfc3442 dhcp-4.2.2b1/includes/dhcp.h
  #define DHO_VIVCO_SUBOPTIONS			124
  #define DHO_VIVSO_SUBOPTIONS			125
  
-diff -up dhcp-4.2.2b1/includes/dhctoken.h.rfc3442 dhcp-4.2.2b1/includes/dhctoken.h
---- dhcp-4.2.2b1/includes/dhctoken.h.rfc3442	2011-07-01 14:22:37.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhctoken.h	2011-07-01 14:25:12.541867623 +0200
-@@ -362,7 +362,8 @@ enum dhcp_token {
- 	REWIND = 663,
- 	INITIAL_DELAY = 664,
- 	GETHOSTBYNAME = 665,
--	BOOTP_BROADCAST_ALWAYS = 666
-+	BOOTP_BROADCAST_ALWAYS = 666,
-+	DESTINATION_DESCRIPTOR = 667
+diff -up dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442 dhcp-4.3.0rc1/includes/dhctoken.h
+--- dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442	2014-01-29 10:05:48.435400713 +0100
++++ dhcp-4.3.0rc1/includes/dhctoken.h	2014-01-29 10:05:48.526399871 +0100
+@@ -368,7 +368,8 @@ enum dhcp_token {
+ 	POOL6 = 669,
+ 	V6RELAY = 670,
+ 	V6RELOPT = 671,
+-	BOOTP_BROADCAST_ALWAYS = 672
++	BOOTP_BROADCAST_ALWAYS = 672,
++	DESTINATION_DESCRIPTOR = 673
  };
  
  #define is_identifier(x)	((x) >= FIRST_TOKEN &&	\
diff --git a/src/patches/dhcp-4.2.1-sendDecline.patch b/src/patches/dhcp/dhcp-sendDecline.patch
similarity index 89%
rename from src/patches/dhcp-4.2.1-sendDecline.patch
rename to src/patches/dhcp/dhcp-sendDecline.patch
index b2fa4affbd..e683366345 100644
--- a/src/patches/dhcp-4.2.1-sendDecline.patch
+++ b/src/patches/dhcp/dhcp-sendDecline.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
---- dhcp-4.2.1-P1/client/dhc6.c.sendDecline	2010-09-10 22:27:11.000000000 +0200
-+++ dhcp-4.2.1-P1/client/dhc6.c	2011-06-17 14:19:48.992099868 +0200
-@@ -95,6 +95,8 @@ void do_select6(void *input);
+diff -up dhcp-4.3.0a1/client/dhc6.c.sendDecline dhcp-4.3.0a1/client/dhc6.c
+--- dhcp-4.3.0a1/client/dhc6.c.sendDecline	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/client/dhc6.c	2013-12-19 15:56:18.297660118 +0100
+@@ -96,6 +96,8 @@ void do_select6(void *input);
  void do_refresh6(void *input);
  static void do_release6(void *input);
  static void start_bound(struct client_state *client);
@@ -10,7 +10,7 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  static void start_informed(struct client_state *client);
  void informed_handler(struct packet *packet, struct client_state *client);
  void bound_handler(struct packet *packet, struct client_state *client);
-@@ -2075,6 +2077,7 @@ start_release6(struct client_state *clie
+@@ -2017,6 +2019,7 @@ start_release6(struct client_state *clie
  	cancel_timeout(do_select6, client);
  	cancel_timeout(do_refresh6, client);
  	cancel_timeout(do_release6, client);
@@ -18,7 +18,7 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  	client->state = S_STOPPED;
  
  	/*
-@@ -2708,6 +2711,7 @@ dhc6_check_reply(struct client_state *cl
+@@ -2650,6 +2653,7 @@ dhc6_check_reply(struct client_state *cl
  		break;
  
  	      case S_STOPPED:
@@ -26,7 +26,7 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  		action = dhc6_stop_action;
  		break;
  
-@@ -2809,6 +2813,7 @@ dhc6_check_reply(struct client_state *cl
+@@ -2751,6 +2755,7 @@ dhc6_check_reply(struct client_state *cl
  		break;
  
  	      case S_STOPPED:
@@ -34,7 +34,7 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  		/* Nothing critical to do at this stage. */
  		break;
  
-@@ -3799,17 +3804,23 @@ reply_handler(struct packet *packet, str
+@@ -3741,17 +3746,23 @@ reply_handler(struct packet *packet, str
  	cancel_timeout(do_select6, client);
  	cancel_timeout(do_refresh6, client);
  	cancel_timeout(do_release6, client);
@@ -66,9 +66,9 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  		return;
  	}
  
-@@ -4336,7 +4347,11 @@ start_bound(struct client_state *client)
- 						     oldia, oldaddr);
+@@ -4279,7 +4290,11 @@ start_bound(struct client_state *client)
  			dhc6_marshall_values("new_", client, lease, ia, addr);
+ 			script_write_requested6(client);
  
 -			script_go(client);
 +			// when script returns 3, DAD failed
@@ -79,7 +79,7 @@ diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
  		}
  
  		/* XXX: maybe we should loop on the old values instead? */
-@@ -4382,6 +4397,149 @@ start_bound(struct client_state *client)
+@@ -4327,6 +4342,149 @@ start_bound(struct client_state *client)
  	dhc6_check_times(client);
  }
  
diff --git a/src/patches/dhcp/dhcp-sharedlib.patch b/src/patches/dhcp/dhcp-sharedlib.patch
new file mode 100644
index 0000000000..abb2acc19d
--- /dev/null
+++ b/src/patches/dhcp/dhcp-sharedlib.patch
@@ -0,0 +1,107 @@
+diff -up dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/common/tests/Makefile.am
+--- dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl	2014-07-10 17:38:10.779828569 +0200
++++ dhcp-4.3.1b1/common/tests/Makefile.am	2014-07-10 17:38:21.355678580 +0200
+@@ -13,19 +13,19 @@ ATF_TESTS += alloc_unittest dns_unittest
+ alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c
+ alloc_unittest_LDADD = $(ATF_LDFLAGS)
+ alloc_unittest_LDADD += ../libdhcp.a  \
+-	../../omapip/libomapi.a \
++	../../omapip/libomapi.la \
+ 	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ dns_unittest_LDADD = $(ATF_LDFLAGS)
+-dns_unittest_LDADD += ../libdhcp.a  \
++dns_unittest_LDADD += ../libdhcp.la  \
+ 	../../omapip/libomapi.a \
+ 	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ misc_unittest_LDADD = $(ATF_LDFLAGS)
+ misc_unittest_LDADD += ../libdhcp.a  \
+-	../../omapip/libomapi.a \
++	../../omapip/libomapi.la \
+ 	$(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ check: $(ATF_TESTS)
+ 	atf-run | atf-report
+diff -up dhcp-4.3.1b1/configure.ac.uCWMBl dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.uCWMBl	2014-07-10 17:38:10.766828753 +0200
++++ dhcp-4.3.1b1/configure.ac	2014-07-10 17:38:10.779828569 +0200
+@@ -39,7 +39,8 @@ fi
+ # Use this to define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
+ AC_USE_SYSTEM_EXTENSIONS
+ 
+-AC_PROG_RANLIB
++# Use libtool to simplify building of shared libraries
++AC_PROG_LIBTOOL
+ AC_CONFIG_HEADERS([includes/config.h])
+ 
+ # we sometimes need to know byte order for building packets
+diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl dhcp-4.3.1b1/dhcpctl/Makefile.am
+--- dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl	2014-07-10 17:36:30.485250962 +0200
++++ dhcp-4.3.1b1/dhcpctl/Makefile.am	2014-07-10 17:38:10.780828554 +0200
+@@ -1,14 +1,14 @@
+ bin_PROGRAMS = omshell
+-lib_LIBRARIES = libdhcpctl.a
++lib_LTLIBRARIES = libdhcpctl.la
+ noinst_PROGRAMS = cltest
+ man_MANS = omshell.1 dhcpctl.3
+ EXTRA_DIST = $(man_MANS)
+ 
+ omshell_SOURCES = omshell.c
+-omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
++omshell_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
+ 	        $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+-libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
++libdhcpctl_la_SOURCES = dhcpctl.c callback.c remote.c
+ 
+ cltest_SOURCES = cltest.c
+-cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
++cltest_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
+ 	       $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl dhcp-4.3.1b1/omapip/Makefile.am
+--- dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl	2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/omapip/Makefile.am	2014-07-10 17:38:10.780828554 +0200
+@@ -1,7 +1,7 @@
+-lib_LIBRARIES = libomapi.a
++lib_LTLIBRARIES = libomapi.la
+ noinst_PROGRAMS = svtest
+ 
+-libomapi_a_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
++libomapi_la_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
+ 		     errwarn.c listener.c dispatch.c generic.c support.c \
+ 		     handle.c message.c convert.c hash.c auth.c inet_addr.c \
+ 		     array.c trace.c toisc.c iscprint.c isclib.c
+@@ -10,5 +10,5 @@ man_MANS = omapi.3
+ EXTRA_DIST = $(man_MANS)
+ 
+ svtest_SOURCES = test.c
+-svtest_LDADD = libomapi.a \
++svtest_LDADD = libomapi.la \
+ 	       $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/server/Makefile.am.uCWMBl dhcp-4.3.1b1/server/Makefile.am
+--- dhcp-4.3.1b1/server/Makefile.am.uCWMBl	2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/server/Makefile.am	2014-07-10 17:38:10.780828554 +0200
+@@ -13,7 +13,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
+ 		dhcpv6.c mdb6.c ldap.c ldap_casa.c
+ 
+ dhcpd_CFLAGS = $(LDAP_CFLAGS)
+-dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \
++dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.la ../dhcpctl/libdhcpctl.la \
+ 	      $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
+ EXTRA_DIST = $(man_MANS)
+diff -up dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/server/tests/Makefile.am
+--- dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl	2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/server/tests/Makefile.am	2014-07-10 17:38:10.780828554 +0200
+@@ -17,8 +17,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa
+           ../ddns.c ../dhcpleasequery.c ../dhcpv6.c ../mdb6.c        \
+           ../ldap.c ../ldap_casa.c ../dhcpd.c
+ 
+-DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a    \
+-          $(top_builddir)/dhcpctl/libdhcpctl.a \
++DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.la \
++          $(top_builddir)/dhcpctl/libdhcpctl.la \
+           $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ 
+ ATF_TESTS =
diff --git a/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch b/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
new file mode 100644
index 0000000000..a7f22b5395
--- /dev/null
+++ b/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
@@ -0,0 +1,48 @@
+From 61fa3dd9e789997f66e848c7e3fb2f554ee374e2 Mon Sep 17 00:00:00 2001
+From: Jiri Popelka <jpopelka@redhat.com>
+Date: Thu, 18 Dec 2014 11:53:26 +0100
+Subject: [PATCH] Write DUID_LLT even in stateless mode.
+
+By default, DHCPv6 dhclient creates DUID-LL
+if it is running in stateless mode (-6 -S) and
+doesn't write it into leases file, most likely
+because the DUID-LL is always generated the same.
+
+It's however possible to specify DUID to be of type LLT instead of LL
+with '-D LLT'. Rfc 3315 says that:
+'Clients and servers using this type of DUID MUST
+store the DUID-LLT in stable storage.'
+That's not fulfiled in this case (-6 -S -D LLT),
+because it's generated each time again.
+
+It's not a big deal because the server doesn't store any
+info about 'stateless' clients, so it doesn't matter
+that the DUID-LLT is different each time.
+But there's a TAHI test which tests this, i.e. that
+DUID-LLT is still the same even in stateless mode.
+It's a test DHCP_CONF.7.1.9, part B.
+https://www.ipv6ready.org/docs/Phase2_DHCPv6_Conformance_Latest.pdf
+
+Signed-off-by: Jiri Popelka <jpopelka@redhat.com>
+---
+ client/dhclient.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/client/dhclient.c b/client/dhclient.c
+index 5ef59cd..026e3fe 100644
+--- a/client/dhclient.c
++++ b/client/dhclient.c
+@@ -788,7 +788,9 @@ void run_stateless(int exit_mode)
+ 		if (default_duid.buffer != NULL)
+ 			data_string_forget(&default_duid, MDL);
+ 
+-		form_duid(&default_duid, MDL);
++		if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS &&
++		    duid_type == DUID_LLT)
++			write_duid(&default_duid);
+ 	}
+ 
+ 	/* Start a configuration state machine. */
+-- 
+2.1.0
+
diff --git a/src/patches/dhcp-4.2.0-unicast-bootp.patch b/src/patches/dhcp/dhcp-unicast-bootp.patch
similarity index 72%
rename from src/patches/dhcp-4.2.0-unicast-bootp.patch
rename to src/patches/dhcp/dhcp-unicast-bootp.patch
index 78bc078dcf..a0db9de692 100644
--- a/src/patches/dhcp-4.2.0-unicast-bootp.patch
+++ b/src/patches/dhcp/dhcp-unicast-bootp.patch
@@ -1,7 +1,7 @@
-diff -up dhcp-4.2.0/server/bootp.c.unicast dhcp-4.2.0/server/bootp.c
---- dhcp-4.2.0/server/bootp.c.unicast	2009-11-20 02:49:03.000000000 +0100
-+++ dhcp-4.2.0/server/bootp.c	2010-07-21 13:40:25.000000000 +0200
-@@ -58,6 +58,7 @@ void bootp (packet)
+diff -up dhcp-4.3.0a1/server/bootp.c.unicast dhcp-4.3.0a1/server/bootp.c
+--- dhcp-4.3.0a1/server/bootp.c.unicast	2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/bootp.c	2013-12-19 15:12:12.974671154 +0100
+@@ -59,6 +59,7 @@ void bootp (packet)
  	char msgbuf [1024];
  	int ignorep;
  	int peer_has_leases = 0;
@@ -9,7 +9,7 @@ diff -up dhcp-4.2.0/server/bootp.c.unicast dhcp-4.2.0/server/bootp.c
  
  	if (packet -> raw -> op != BOOTREQUEST)
  		return;
-@@ -73,7 +74,7 @@ void bootp (packet)
+@@ -74,7 +75,7 @@ void bootp (packet)
  		 ? inet_ntoa (packet -> raw -> giaddr)
  		 : packet -> interface -> name);
  
@@ -18,24 +18,26 @@ diff -up dhcp-4.2.0/server/bootp.c.unicast dhcp-4.2.0/server/bootp.c
  		log_info ("%s: network unknown", msgbuf);
  		return;
  	}
-@@ -390,6 +391,13 @@ void bootp (packet)
- 					      from, &to, &hto);
+@@ -396,6 +397,15 @@ void bootp (packet)
+ 
  			goto out;
  		}
 +	} else if (norelay == 2) {
 +		to.sin_addr = raw.ciaddr;
 +		to.sin_port = remote_port;
 +		if (fallback_interface) {
-+			result = send_packet (fallback_interface, (struct packet *)0, &raw, outgoing.packet_length, from, &to, &hto);
++			result = send_packet (fallback_interface, NULL, &raw,
++					      outgoing.packet_length, from,
++					      &to, &hto);
 +			goto out;
 +		}
  
  	/* If it comes from a client that already knows its address
  	   and is not requesting a broadcast response, and we can
-diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c
---- dhcp-4.2.0/server/dhcp.c.unicast	2010-06-01 19:29:59.000000000 +0200
-+++ dhcp-4.2.0/server/dhcp.c	2010-07-21 13:40:25.000000000 +0200
-@@ -4185,6 +4185,7 @@ int locate_network (packet)
+diff -up dhcp-4.3.0a1/server/dhcp.c.unicast dhcp-4.3.0a1/server/dhcp.c
+--- dhcp-4.3.0a1/server/dhcp.c.unicast	2013-12-13 21:50:38.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcp.c	2013-12-19 15:12:12.975671140 +0100
+@@ -4627,6 +4627,7 @@ int locate_network (packet)
  	struct data_string data;
  	struct subnet *subnet = (struct subnet *)0;
  	struct option_cache *oc;
@@ -43,7 +45,7 @@ diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c
  
  	/* See if there's a Relay Agent Link Selection Option, or a
  	 * Subnet Selection Option.  The Link-Select and Subnet-Select
-@@ -4200,12 +4201,24 @@ int locate_network (packet)
+@@ -4642,12 +4643,24 @@ int locate_network (packet)
  	   from the interface, if there is one.   If not, fail. */
  	if (!oc && !packet -> raw -> giaddr.s_addr) {
  		if (packet -> interface -> shared_network) {
@@ -73,7 +75,7 @@ diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c
  	}
  
  	/* If there's an option indicating link connection, and it's valid,
-@@ -4228,7 +4241,10 @@ int locate_network (packet)
+@@ -4670,7 +4683,10 @@ int locate_network (packet)
  		data_string_forget (&data, MDL);
  	} else {
  		ia.len = 4;
@@ -85,7 +87,7 @@ diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c
  	}
  
  	/* If we know the subnet on which the IP address lives, use it. */
-@@ -4236,7 +4252,10 @@ int locate_network (packet)
+@@ -4678,7 +4694,10 @@ int locate_network (packet)
  		shared_network_reference (&packet -> shared_network,
  					  subnet -> shared_network, MDL);
  		subnet_dereference (&subnet, MDL);
diff --git a/src/patches/dhcp-4.2.2-xen-checksum.patch b/src/patches/dhcp/dhcp-xen-checksum.patch
similarity index 71%
rename from src/patches/dhcp-4.2.2-xen-checksum.patch
rename to src/patches/dhcp/dhcp-xen-checksum.patch
index 038d346d72..eabc3c1271 100644
--- a/src/patches/dhcp-4.2.2-xen-checksum.patch
+++ b/src/patches/dhcp/dhcp-xen-checksum.patch
@@ -1,19 +1,19 @@
-diff -up dhcp-4.2.2b1/common/bpf.c.xen dhcp-4.2.2b1/common/bpf.c
---- dhcp-4.2.2b1/common/bpf.c.xen	2009-11-20 02:48:59.000000000 +0100
-+++ dhcp-4.2.2b1/common/bpf.c	2011-07-01 14:00:16.936959001 +0200
-@@ -485,7 +485,7 @@ ssize_t receive_packet (interface, buf, 
- 		offset = decode_udp_ip_header (interface,
- 					       interface -> rbuf,
- 					       interface -> rbuf_offset,
+diff -up dhcp-4.3.0rc1/common/bpf.c.xen dhcp-4.3.0rc1/common/bpf.c
+--- dhcp-4.3.0rc1/common/bpf.c.xen	2014-01-29 10:03:27.503941664 +0100
++++ dhcp-4.3.0rc1/common/bpf.c	2014-01-29 10:03:37.564812175 +0100
+@@ -481,7 +481,7 @@ ssize_t receive_packet (interface, buf,
+ 		/* Decode the IP and UDP headers... */
+ 		offset = decode_udp_ip_header(interface, interface->rbuf,
+ 					       interface->rbuf_offset,
 -  					       from, hdr.bh_caplen, &paylen);
 +  					       from, hdr.bh_caplen, &paylen, 0);
  
  		/* If the IP or UDP checksum was bad, skip the packet... */
  		if (offset < 0) {
-diff -up dhcp-4.2.2b1/common/dlpi.c.xen dhcp-4.2.2b1/common/dlpi.c
---- dhcp-4.2.2b1/common/dlpi.c.xen	2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/common/dlpi.c	2011-07-01 14:00:16.937958997 +0200
-@@ -693,7 +693,7 @@ ssize_t receive_packet (interface, buf, 
+diff -up dhcp-4.3.0rc1/common/dlpi.c.xen dhcp-4.3.0rc1/common/dlpi.c
+--- dhcp-4.3.0rc1/common/dlpi.c.xen	2014-01-25 05:18:03.000000000 +0100
++++ dhcp-4.3.0rc1/common/dlpi.c	2014-01-29 10:03:27.503941664 +0100
+@@ -691,7 +691,7 @@ ssize_t receive_packet (interface, buf,
  	length -= offset;
  #endif
  	offset = decode_udp_ip_header (interface, dbuf, bufix,
@@ -22,13 +22,13 @@ diff -up dhcp-4.2.2b1/common/dlpi.c.xen dhcp-4.2.2b1/common/dlpi.c
  
  	/*
  	 * If the IP or UDP checksum was bad, skip the packet...
-diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
---- dhcp-4.2.2b1/common/lpf.c.xen	2011-05-10 16:38:58.000000000 +0200
-+++ dhcp-4.2.2b1/common/lpf.c	2011-07-01 14:11:24.725748028 +0200
-@@ -29,19 +29,33 @@
+diff -up dhcp-4.3.0rc1/common/lpf.c.xen dhcp-4.3.0rc1/common/lpf.c
+--- dhcp-4.3.0rc1/common/lpf.c.xen	2014-01-25 05:18:03.000000000 +0100
++++ dhcp-4.3.0rc1/common/lpf.c	2014-01-29 10:03:27.504941651 +0100
+@@ -29,14 +29,15 @@
+ 
  #include "dhcpd.h"
  #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE)
- #include <sys/ioctl.h>
 +#include <sys/socket.h>
  #include <sys/uio.h>
  #include <errno.h>
@@ -42,7 +42,9 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  #include "includes/netinet/ip.h"
  #include "includes/netinet/udp.h"
  #include "includes/netinet/if_ether.h"
- #include <net/if.h>
+@@ -51,6 +52,19 @@
+ /* Reinitializes the specified interface after an address change.   This
+    is not required for packet-filter APIs. */
  
 +#ifndef PACKET_AUXDATA
 +#define PACKET_AUXDATA 8
@@ -57,10 +59,10 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
 +};
 +#endif
 +
- /* Reinitializes the specified interface after an address change.   This
-    is not required for packet-filter APIs. */
- 
-@@ -67,10 +81,14 @@ int if_register_lpf (info)
+ #ifdef USE_LPF_SEND
+ void if_reinitialize_send (info)
+ 	struct interface_info *info;
+@@ -73,10 +87,14 @@ int if_register_lpf (info)
  	struct interface_info *info;
  {
  	int sock;
@@ -77,7 +79,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  			   htons((short)ETH_P_ALL))) < 0) {
  		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
  		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-@@ -85,11 +103,17 @@ int if_register_lpf (info)
+@@ -91,11 +109,17 @@ int if_register_lpf (info)
  		log_fatal ("Open a socket for LPF: %m");
  	}
  
@@ -98,7 +100,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  		if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
  		    errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
  		    errno == EAFNOSUPPORT || errno == EINVAL) {
-@@ -171,9 +195,18 @@ static void lpf_gen_filter_setup (struct
+@@ -177,9 +201,18 @@ static void lpf_gen_filter_setup (struct
  void if_register_receive (info)
  	struct interface_info *info;
  {
@@ -117,7 +119,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  #if defined (HAVE_TR_SUPPORT)
  	if (info -> hw_address.hbuf [0] == HTYPE_IEEE802)
  		lpf_tr_filter_setup (info);
-@@ -295,7 +328,6 @@ ssize_t send_packet (interface, packet, 
+@@ -301,7 +334,6 @@ ssize_t send_packet (interface, packet,
  	double hh [16];
  	double ih [1536 / sizeof (double)];
  	unsigned char *buf = (unsigned char *)ih;
@@ -125,7 +127,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  	int result;
  	int fudge;
  
-@@ -316,17 +348,7 @@ ssize_t send_packet (interface, packet, 
+@@ -322,17 +354,7 @@ ssize_t send_packet (interface, packet,
  				(unsigned char *)raw, len);
  	memcpy (buf + ibufp, raw, len);
  
@@ -144,7 +146,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  	if (result < 0)
  		log_error ("send_packet: %m");
  	return result;
-@@ -343,14 +365,35 @@ ssize_t receive_packet (interface, buf, 
+@@ -349,14 +371,35 @@ ssize_t receive_packet (interface, buf,
  {
  	int length = 0;
  	int offset = 0;
@@ -181,7 +183,7 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  	bufix = 0;
  	/* Decode the physical header... */
  	offset = decode_hw_header (interface, ibuf, bufix, hfrom);
-@@ -367,7 +410,7 @@ ssize_t receive_packet (interface, buf, 
+@@ -373,7 +416,7 @@ ssize_t receive_packet (interface, buf,
  
  	/* Decode the IP and UDP headers... */
  	offset = decode_udp_ip_header (interface, ibuf, bufix, from,
@@ -190,10 +192,10 @@ diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
  
  	/* If the IP or UDP checksum was bad, skip the packet... */
  	if (offset < 0)
-diff -up dhcp-4.2.2b1/common/nit.c.xen dhcp-4.2.2b1/common/nit.c
---- dhcp-4.2.2b1/common/nit.c.xen	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/nit.c	2011-07-01 14:00:16.939958989 +0200
-@@ -369,7 +369,7 @@ ssize_t receive_packet (interface, buf, 
+diff -up dhcp-4.3.0rc1/common/nit.c.xen dhcp-4.3.0rc1/common/nit.c
+--- dhcp-4.3.0rc1/common/nit.c.xen	2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/nit.c	2014-01-29 10:03:27.504941651 +0100
+@@ -363,7 +363,7 @@ ssize_t receive_packet (interface, buf,
  
  	/* Decode the IP and UDP headers... */
  	offset = decode_udp_ip_header (interface, ibuf, bufix,
@@ -202,10 +204,10 @@ diff -up dhcp-4.2.2b1/common/nit.c.xen dhcp-4.2.2b1/common/nit.c
  
  	/* If the IP or UDP checksum was bad, skip the packet... */
  	if (offset < 0)
-diff -up dhcp-4.2.2b1/common/packet.c.xen dhcp-4.2.2b1/common/packet.c
---- dhcp-4.2.2b1/common/packet.c.xen	2009-07-23 20:52:20.000000000 +0200
-+++ dhcp-4.2.2b1/common/packet.c	2011-07-01 14:00:16.939958989 +0200
-@@ -211,7 +211,7 @@ ssize_t
+diff -up dhcp-4.3.0rc1/common/packet.c.xen dhcp-4.3.0rc1/common/packet.c
+--- dhcp-4.3.0rc1/common/packet.c.xen	2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0rc1/common/packet.c	2014-01-29 10:03:27.504941651 +0100
+@@ -226,7 +226,7 @@ ssize_t
  decode_udp_ip_header(struct interface_info *interface,
  		     unsigned char *buf, unsigned bufix,
  		     struct sockaddr_in *from, unsigned buflen,
@@ -214,7 +216,7 @@ diff -up dhcp-4.2.2b1/common/packet.c.xen dhcp-4.2.2b1/common/packet.c
  {
    unsigned char *data;
    struct ip ip;
-@@ -322,7 +322,7 @@ decode_udp_ip_header(struct interface_in
+@@ -337,7 +337,7 @@ decode_udp_ip_header(struct interface_in
  					   8, IPPROTO_UDP + ulen))));
  
    udp_packets_seen++;
@@ -223,10 +225,10 @@ diff -up dhcp-4.2.2b1/common/packet.c.xen dhcp-4.2.2b1/common/packet.c
  	  udp_packets_bad_checksum++;
  	  if (udp_packets_seen > 4 &&
  	      (udp_packets_seen / udp_packets_bad_checksum) < 2) {
-diff -up dhcp-4.2.2b1/common/upf.c.xen dhcp-4.2.2b1/common/upf.c
---- dhcp-4.2.2b1/common/upf.c.xen	2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/upf.c	2011-07-01 14:00:16.940958986 +0200
-@@ -320,7 +320,7 @@ ssize_t receive_packet (interface, buf, 
+diff -up dhcp-4.3.0rc1/common/upf.c.xen dhcp-4.3.0rc1/common/upf.c
+--- dhcp-4.3.0rc1/common/upf.c.xen	2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/upf.c	2014-01-29 10:03:27.505941638 +0100
+@@ -314,7 +314,7 @@ ssize_t receive_packet (interface, buf,
  
  	/* Decode the IP and UDP headers... */
  	offset = decode_udp_ip_header (interface, ibuf, bufix,
@@ -235,10 +237,10 @@ diff -up dhcp-4.2.2b1/common/upf.c.xen dhcp-4.2.2b1/common/upf.c
  
  	/* If the IP or UDP checksum was bad, skip the packet... */
  	if (offset < 0)
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.xen dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.xen	2011-07-01 14:00:16.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h	2011-07-01 14:12:18.069642470 +0200
-@@ -2796,7 +2796,7 @@ ssize_t decode_hw_header (struct interfa
+diff -up dhcp-4.3.0rc1/includes/dhcpd.h.xen dhcp-4.3.0rc1/includes/dhcpd.h
+--- dhcp-4.3.0rc1/includes/dhcpd.h.xen	2014-01-29 10:03:27.489941844 +0100
++++ dhcp-4.3.0rc1/includes/dhcpd.h	2014-01-29 10:03:27.506941626 +0100
+@@ -2861,7 +2861,7 @@ ssize_t decode_hw_header (struct interfa
  			  unsigned, struct hardware *);
  ssize_t decode_udp_ip_header (struct interface_info *, unsigned char *,
  			      unsigned, struct sockaddr_in *,
diff --git a/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch b/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch
index 1a89b36d36..0482c4b1cf 100644
--- a/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch
+++ b/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch
@@ -1,18 +1,19 @@
 diff --git a/Makefile b/Makefile
-index 2910320b6452..0a76ce3c5154 100644
+index 4c87ea9..4e0ea10 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -73,7 +73,7 @@ objs = cache.o rfc1035.o util.o option.o forward.o network.o \
+@@ -73,7 +73,8 @@ objs = cache.o rfc1035.o util.o option.o forward.o network.o \
         dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
         helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
         dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \
--       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o
-+       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o isc.o
+-       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o poll.o
++       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o poll.o \
++       isc.o
  
  hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
         dns-protocol.h radv-protocol.h ip6addr.h
 diff --git a/src/cache.c b/src/cache.c
-index 117ae279fd4e..6ee7ee362e6c 100644
+index 178d654..6d0b131 100644
 --- a/src/cache.c
 +++ b/src/cache.c
 @@ -17,7 +17,7 @@
@@ -65,10 +66,10 @@ index 117ae279fd4e..6ee7ee362e6c 100644
        cache_hash(crec);
  
 diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index e903a24c8105..eefc7f939933 100644
+index 81254f6..ce2d1a7 100644
 --- a/src/dnsmasq.c
 +++ b/src/dnsmasq.c
-@@ -970,6 +970,11 @@ int main (int argc, char **argv)
+@@ -982,6 +982,11 @@ int main (int argc, char **argv)
  
  	  poll_resolv(0, daemon->last_resolv != 0, now); 	  
  	  daemon->last_resolv = now;
@@ -81,21 +82,20 @@ index e903a24c8105..eefc7f939933 100644
  #endif
  
 diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 89e758b56a0a..c5edd6fdf7f5 100644
+index cf1a782..30437aa 100644
 --- a/src/dnsmasq.h
 +++ b/src/dnsmasq.h
-@@ -1502,3 +1502,8 @@ void inotify_dnsmasq_init();
- int inotify_check(time_t now);
- void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revhashsz);
- #endif
-+
+@@ -1519,3 +1519,7 @@ int poll_check(int fd, short event);
+ void poll_listen(int fd, short event);
+ int do_poll(int timeout);
+ 
 +/* isc.c */
 +#ifdef HAVE_ISC_READER
 +void load_dhcp(time_t now);
 +#endif
 diff --git a/src/isc.c b/src/isc.c
 new file mode 100644
-index 000000000000..51064426f17f
+index 0000000..5106442
 --- /dev/null
 +++ b/src/isc.c
 @@ -0,0 +1,251 @@
@@ -351,10 +351,10 @@ index 000000000000..51064426f17f
 +
 +#endif
 diff --git a/src/option.c b/src/option.c
-index cb4e76ba0aa2..f6420fcbb7ab 100644
+index ecc2619..527c5aa 100644
 --- a/src/option.c
 +++ b/src/option.c
-@@ -1693,7 +1693,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+@@ -1699,7 +1699,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
  	ret_err(_("bad MX target"));
        break;
  
diff --git a/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch b/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch
deleted file mode 100644
index adcb44fff7..0000000000
--- a/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From f2658275b25ebfe691cdcb9fede85a3088cca168 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 25 Sep 2014 21:51:25 +0100
-Subject: [PATCH 01/55] Add newline at the end of example config file.
-
----
- dnsmasq.conf.example | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example
-index 83924fc4a9b4..6b00bd34fbb5 100644
---- a/dnsmasq.conf.example
-+++ b/dnsmasq.conf.example
-@@ -645,4 +645,4 @@
- #conf-dir=/etc/dnsmasq.d,.bak
- 
- # Include all files in a directory which end in .conf
--#conf-dir=/etc/dnsmasq.d/*.conf
-\ No newline at end of file
-+#conf-dir=/etc/dnsmasq.d/*.conf
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch b/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch
deleted file mode 100644
index b84440baf1..0000000000
--- a/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 00cd9d551998307225312fd21f761cfa8868bd2c Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 2 Oct 2014 21:44:21 +0100
-Subject: [PATCH 02/55] crash at startup when an empty suffix is supplied to
- --conf-dir
-
----
- CHANGELOG    |  6 ++++++
- src/option.c | 38 +++++++++++++++++++++++---------------
- 2 files changed, 29 insertions(+), 15 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 768e2aaca42a..13ab41c05fc3 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -1,3 +1,9 @@
-+version 2.73
-+            Fix crash at startup when an empty suffix is supplied to
-+	    --conf-dir, also trivial memory leak. Thanks to 
-+	    Tomas Hozza for spotting this.
-+	
-+
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
- 
-diff --git a/src/option.c b/src/option.c
-index 45d8875fb7f9..b08e98e16f84 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -1474,22 +1474,25 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	for (arg = comma; arg; arg = comma) 
- 	  {
- 	    comma = split(arg);
--	    li = opt_malloc(sizeof(struct list));
--	    if (*arg == '*')
-+	    if (strlen(arg) != 0)
- 	      {
--		li->next = match_suffix;
--		match_suffix = li;
--		/* Have to copy: buffer is overwritten */
--		li->suffix = opt_string_alloc(arg+1);
--	      }
--	    else
--	      {
--		li->next = ignore_suffix;
--		ignore_suffix = li;
--		/* Have to copy: buffer is overwritten */
--		li->suffix = opt_string_alloc(arg);
-+		li = opt_malloc(sizeof(struct list));
-+		if (*arg == '*')
-+		  {
-+		    li->next = match_suffix;
-+		    match_suffix = li;
-+		    /* Have to copy: buffer is overwritten */
-+		    li->suffix = opt_string_alloc(arg+1);
-+		  }
-+		else
-+		  {
-+		    li->next = ignore_suffix;
-+		    ignore_suffix = li;
-+		    /* Have to copy: buffer is overwritten */
-+		    li->suffix = opt_string_alloc(arg);
-+		  }
- 	      }
--	  };
-+	  }
- 	
- 	if (!(dir_stream = opendir(directory)))
- 	  die(_("cannot access directory %s: %s"), directory, EC_FILE);
-@@ -1555,7 +1558,12 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	    free(ignore_suffix->suffix);
- 	    free(ignore_suffix);
- 	  }
--	      
-+	for(; match_suffix; match_suffix = li)
-+	  {
-+	    li = match_suffix->next;
-+	    free(match_suffix->suffix);
-+	    free(match_suffix);
-+	  }    
- 	break;
-       }
- 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch b/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch
deleted file mode 100644
index fe73acd641..0000000000
--- a/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 6ac3bc0452a74e16e3d620a0757b0f8caab182ec Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Fri, 3 Oct 2014 08:48:11 +0100
-Subject: [PATCH 03/55] Debian build fixes for kFreeBSD
-
----
- src/tables.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/tables.c b/src/tables.c
-index 834f11944cd0..dcdef794c4d2 100644
---- a/src/tables.c
-+++ b/src/tables.c
-@@ -20,6 +20,10 @@
- 
- #if defined(HAVE_IPSET) && defined(HAVE_BSD_NETWORK)
- 
-+#ifndef __FreeBSD__
-+#include <bsd/string.h>
-+#endif
-+
- #include <sys/types.h>
- #include <sys/ioctl.h>
- 
-@@ -136,7 +140,7 @@ int add_to_ipset(const char *setname, const struct all_addr *ipaddr,
-       return -1;
-     }
-   
--  if (rc = pfr_add_tables(&table, 1, &n, 0)) 
-+  if ((rc = pfr_add_tables(&table, 1, &n, 0))) 
-     {
-       my_syslog(LOG_WARNING, _("warning: pfr_add_tables: %s(%d)"),
- 		pfr_strerror(errno),rc);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch b/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch
deleted file mode 100644
index 5d7c3c4e88..0000000000
--- a/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From e9828b6f66b22ce8873f8d30a773137d1aef1b92 Mon Sep 17 00:00:00 2001
-From: Karl Vogel <karl.vogel@gmail.com>
-Date: Fri, 3 Oct 2014 21:45:15 +0100
-Subject: [PATCH 04/55] Set conntrack mark before connect() call.
-
-SO_MARK has to be done before issuing the connect() call on the
-TCP socket.
----
- src/forward.c | 36 ++++++++++++++++++------------------
- 1 file changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/src/forward.c b/src/forward.c
-index 4895efeba89a..2cf29eba6e26 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1796,6 +1796,24 @@ unsigned char *tcp_request(int confd, time_t now,
- 			  if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
- 			    continue;
- 			  
-+#ifdef HAVE_CONNTRACK
-+			  /* Copy connection mark of incoming query to outgoing connection. */
-+			  if (option_bool(OPT_CONNTRACK))
-+			    {
-+			      unsigned int mark;
-+			      struct all_addr local;
-+#ifdef HAVE_IPV6		      
-+			      if (local_addr->sa.sa_family == AF_INET6)
-+				local.addr.addr6 = local_addr->in6.sin6_addr;
-+			      else
-+#endif
-+				local.addr.addr4 = local_addr->in.sin_addr;
-+			      
-+			      if (get_incoming_mark(&peer_addr, &local, 1, &mark))
-+				setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
-+			    }
-+#endif	
-+		      
- 			  if ((!local_bind(last_server->tcpfd,  &last_server->source_addr, last_server->interface, 1) ||
- 			       connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
- 			    {
-@@ -1820,24 +1838,6 @@ unsigned char *tcp_request(int confd, time_t now,
- 			      size = new_size;
- 			    }
- #endif
--			  
--#ifdef HAVE_CONNTRACK
--			  /* Copy connection mark of incoming query to outgoing connection. */
--			  if (option_bool(OPT_CONNTRACK))
--			    {
--			      unsigned int mark;
--			      struct all_addr local;
--#ifdef HAVE_IPV6		      
--			      if (local_addr->sa.sa_family == AF_INET6)
--				local.addr.addr6 = local_addr->in6.sin6_addr;
--			      else
--#endif
--				local.addr.addr4 = local_addr->in.sin_addr;
--			      
--			      if (get_incoming_mark(&peer_addr, &local, 1, &mark))
--				setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
--			    }
--#endif	
- 			}
- 		      
- 		      *length = htons(size);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch b/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch
deleted file mode 100644
index 80c55f6849..0000000000
--- a/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 17b475912f6a4e72797a543dad59d4d5dde6bb1b Mon Sep 17 00:00:00 2001
-From: Daniel Collins <daniel.collins@smoothwall.net>
-Date: Fri, 3 Oct 2014 21:58:43 +0100
-Subject: [PATCH 05/55] Fix typo in new Dbus code.
-
-Simon's fault.
----
- src/dbus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/dbus.c b/src/dbus.c
-index 15fed906bd90..a2a94dc85dac 100644
---- a/src/dbus.c
-+++ b/src/dbus.c
-@@ -426,7 +426,7 @@ static DBusMessage *dbus_set_bool(DBusMessage *message, int flag, char *name)
-     }
-   else
-     {
--      my_syslog(LOG_INFO, "Disabling --$s option from D-Bus", name);
-+      my_syslog(LOG_INFO, "Disabling --%s option from D-Bus", name);
-       reset_option_bool(flag);
-     }
- 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch b/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch
deleted file mode 100644
index 5f9f572765..0000000000
--- a/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 3d9d2dd0018603a2ae4b9cd65ac6ff959f4fd8c7 Mon Sep 17 00:00:00 2001
-From: Tomas Hozza <thozza@redhat.com>
-Date: Mon, 6 Oct 2014 10:46:48 +0100
-Subject: [PATCH 06/55] Fit example conf file typo.
-
----
- dnsmasq.conf.example | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example
-index 6b00bd34fbb5..1bd305dbdbad 100644
---- a/dnsmasq.conf.example
-+++ b/dnsmasq.conf.example
-@@ -645,4 +645,4 @@
- #conf-dir=/etc/dnsmasq.d,.bak
- 
- # Include all files in a directory which end in .conf
--#conf-dir=/etc/dnsmasq.d/*.conf
-+#conf-dir=/etc/dnsmasq.d/,*.conf
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch b/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch
deleted file mode 100644
index 370d1065c0..0000000000
--- a/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From b9ff5c8f435173cfa616e3c398bdc089ef690a07 Mon Sep 17 00:00:00 2001
-From: Vladislav Grishenko <themiron@mail.ru>
-Date: Mon, 6 Oct 2014 14:34:24 +0100
-Subject: [PATCH 07/55] Improve RFC-compliance when unable to supply addresses
- in DHCPv6
-
-While testing https://github.com/sbyx/odhcp6c client I have noticed it
-permanently crashes after startup.
-
-The reason was it (odhcp6c) doesn't expect empty IA options in ADVERTISE
-message without any suboptions.
-
-Despite this validation bug of odhcp6c, dnsmasq should not generate
-ADVERTISE messages with IA if there's nothing to advert per  RFC 3315
-17.2.2:
-
-   If the server will not assign any addresses to any IAs in a
-
-   subsequent Request from the client, the server MUST send an Advertise
-
-   message to the client that includes only a Status Code option with
-
-   code NoAddrsAvail and a status message for the user, a Server
-
-   Identifier option with the server's DUID, and a Client Identifier
-
-   option with the client's DUID.
-
-Meanwhile it's need to add status code for every IA in REPLY message per
-RFC3315 18.2.1:
-
-   If the server cannot assign any addresses to an IA in the message
-   from the client, the server MUST include the IA in the Reply message
-   with no addresses in the IA and a Status Code option in the IA
-   containing status code NoAddrsAvail.
-
-So, I've changed the logic to skip IA completely from ADVERTISE messages and
-to add NoAddrsAvail subcode into IA of REPLY messages.
-
-As for overhead, yes, I believe it's ok to return NoAddrsAvail twice in IA
-and in global section for compatibility with all old and new clients.
----
- src/rfc3315.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index 5ebf09d50ac1..ddb390bf1136 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -691,6 +691,8 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- #endif
- 
- 	    o = build_ia(state, &t1cntr);
-+	    if (address_assigned)
-+		address_assigned = 2;
- 
- 	    for (ia_counter = 0; ia_option; ia_counter++, ia_option = opt6_find(opt6_next(ia_option, ia_end), ia_end, OPTION6_IAADDR, 24))
- 	      {
-@@ -781,6 +783,27 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- 		address_assigned = 1;
- 	      }
- 	    
-+	    if (address_assigned != 1)
-+	      {
-+		/* If the server will not assign any addresses to any IAs in a
-+		   subsequent Request from the client, the server MUST send an Advertise
-+		   message to the client that doesn't include any IA options. */
-+		if (!state->lease_allocate)
-+		  {
-+		    save_counter(o);
-+		    continue;
-+		  }
-+		
-+		/* If the server cannot assign any addresses to an IA in the message
-+		   from the client, the server MUST include the IA in the Reply message
-+		   with no addresses in the IA and a Status Code option in the IA
-+		   containing status code NoAddrsAvail. */
-+		o1 = new_opt6(OPTION6_STATUS_CODE);
-+		put_opt6_short(DHCP6NOADDRS);
-+		put_opt6_string(_("address unavailable"));
-+		end_opt6(o1);
-+	      }
-+	    
- 	    end_ia(t1cntr, min_time, 0);
- 	    end_opt6(o);	
- 	  }
-@@ -806,7 +829,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- 	    put_opt6_short(DHCP6NOADDRS);
- 	    put_opt6_string(_("no addresses available"));
- 	    end_opt6(o1);
--	    log6_packet(state, "DHCPADVERTISE", NULL, _("no addresses available"));
-+	    log6_packet(state, state->lease_allocate ? "DHCPREPLY" : "DHCPADVERTISE", NULL, _("no addresses available"));
- 	  }
- 
- 	break;
-@@ -862,7 +885,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- 		      {
- 			/* Static range, not configured. */
- 			o1 = new_opt6(OPTION6_STATUS_CODE);
--			put_opt6_short(DHCP6UNSPEC);
-+			put_opt6_short(DHCP6NOADDRS);
- 			put_opt6_string(_("address unavailable"));
- 			end_opt6(o1);
- 		      }
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch b/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch
deleted file mode 100644
index 3f8bad331b..0000000000
--- a/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 98906275a02ae260fe3f82133bd79054f8315f06 Mon Sep 17 00:00:00 2001
-From: Hans Dedecker <dedeckeh@gmail.com>
-Date: Tue, 9 Dec 2014 22:22:53 +0000
-Subject: [PATCH 08/55] Fix conntrack with --bind-interfaces
-
-Make sure dst_addr is assigned the correct address in receive_query when OPTNOWILD is
-enabled so the assigned mark can be correctly retrieved and set in forward_query when
-conntrack is enabled.
-
-Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
----
- src/forward.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/forward.c b/src/forward.c
-index 2cf29eba6e26..408a179a20f4 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1048,7 +1048,7 @@ void receive_query(struct listener *listen, time_t now)
-   /* packet buffer overwritten */
-   daemon->srv_save = NULL;
-   
--  dst_addr_4.s_addr = 0;
-+  dst_addr_4.s_addr = dst_addr.addr.addr4.s_addr = 0;
-   netmask.s_addr = 0;
-   
-   if (option_bool(OPT_NOWILD) && listen->iface)
-@@ -1057,7 +1057,7 @@ void receive_query(struct listener *listen, time_t now)
-      
-       if (listen->family == AF_INET)
- 	{
--	  dst_addr_4 = listen->iface->addr.in.sin_addr;
-+	  dst_addr_4 = dst_addr.addr.addr4 = listen->iface->addr.in.sin_addr;
- 	  netmask = listen->iface->netmask;
- 	}
-     }
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch b/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch
deleted file mode 100644
index 81939202b9..0000000000
--- a/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From 193de4abf59e49c6b70d54cfe9720fcb95ca2f71 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 10 Dec 2014 17:32:16 +0000
-Subject: [PATCH 09/55] Use inotify instead of polling on Linux.
-
-This should solve problems people are seeing when a file changes
-twice within a second and thus is missed for polling.
----
- Makefile       |   2 +-
- bld/Android.mk |   2 +-
- src/dnsmasq.c  |  25 ++++++++++++--
- src/dnsmasq.h  |  11 ++++++-
- src/inotify.c  | 102 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 5 files changed, 137 insertions(+), 5 deletions(-)
- create mode 100644 src/inotify.c
-
-diff --git a/Makefile b/Makefile
-index 58a7975f60b5..c340f1c7b59a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -69,7 +69,7 @@ objs = cache.o rfc1035.o util.o option.o forward.o network.o \
-        dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
-        helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o \
-        dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o \
--       domain.o dnssec.o blockdata.o tables.o loop.o
-+       domain.o dnssec.o blockdata.o tables.o loop.o inotify.o
- 
- hdrs = dnsmasq.h config.h dhcp-protocol.h dhcp6-protocol.h \
-        dns-protocol.h radv-protocol.h ip6addr.h
-diff --git a/bld/Android.mk b/bld/Android.mk
-index d855094eb264..d627796e8edc 100644
---- a/bld/Android.mk
-+++ b/bld/Android.mk
-@@ -10,7 +10,7 @@ LOCAL_SRC_FILES :=  bpf.c cache.c dbus.c dhcp.c dnsmasq.c \
- 		    dhcp6.c rfc3315.c dhcp-common.c outpacket.c \
- 		    radv.c slaac.c auth.c ipset.c domain.c \
- 	            dnssec.c dnssec-openssl.c blockdata.c tables.c \
--		    loop.c
-+		    loop.c inotify.c
- 
- LOCAL_MODULE := dnsmasq
- 
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index f4a89fc38183..bf2e25a55780 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -315,9 +315,15 @@ int main (int argc, char **argv)
-   if (daemon->port != 0)
-     {
-       cache_init();
-+
- #ifdef HAVE_DNSSEC
-       blockdata_init();
- #endif
-+
-+#ifdef HAVE_LINUX_NETWORK
-+      if (!option_bool(OPT_NO_POLL))
-+	inotify_dnsmasq_init();
-+#endif
-     }
-     
-   if (option_bool(OPT_DBUS))
-@@ -793,6 +799,11 @@ int main (int argc, char **argv)
-   
-   pid = getpid();
-   
-+#ifdef HAVE_LINUX_NETWORK
-+  /* Using inotify, have to select a resolv file at startup */
-+  poll_resolv(1, 0, now);
-+#endif
-+  
-   while (1)
-     {
-       int maxfd = -1;
-@@ -862,11 +873,16 @@ int main (int argc, char **argv)
- #if defined(HAVE_LINUX_NETWORK)
-       FD_SET(daemon->netlinkfd, &rset);
-       bump_maxfd(daemon->netlinkfd, &maxfd);
-+      if (daemon->port != 0 && !option_bool(OPT_NO_POLL))
-+	{
-+	  FD_SET(daemon->inotifyfd, &rset);
-+	  bump_maxfd(daemon->inotifyfd, &maxfd);
-+	}
- #elif defined(HAVE_BSD_NETWORK)
-       FD_SET(daemon->routefd, &rset);
-       bump_maxfd(daemon->routefd, &maxfd);
- #endif
--
-+      
-       FD_SET(piperead, &rset);
-       bump_maxfd(piperead, &maxfd);
- 
-@@ -929,6 +945,10 @@ int main (int argc, char **argv)
- 	route_sock();
- #endif
- 
-+#ifdef HAVE_LINUX_NETWORK
-+      if (daemon->port != 0 && !option_bool(OPT_NO_POLL) && FD_ISSET(daemon->inotifyfd, &rset) && inotify_check())
-+	poll_resolv(1, 1, now); 	  
-+#else
-       /* Check for changes to resolv files once per second max. */
-       /* Don't go silent for long periods if the clock goes backwards. */
-       if (daemon->last_resolv == 0 || 
-@@ -941,7 +961,8 @@ int main (int argc, char **argv)
- 	  poll_resolv(0, daemon->last_resolv != 0, now); 	  
- 	  daemon->last_resolv = now;
- 	}
--      
-+#endif
-+
-       if (FD_ISSET(piperead, &rset))
- 	async_event(piperead, now);
-       
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index e74b15a5459a..ebb6b957812f 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -541,6 +541,10 @@ struct resolvc {
-   int is_default, logged;
-   time_t mtime;
-   char *name;
-+#ifdef HAVE_LINUX_NETWORK
-+  int wd; /* inotify watch descriptor */
-+  char *file; /* pointer to file part if path */
-+#endif
- };
- 
- /* adn-hosts parms from command-line (also dhcp-hostsfile and dhcp-optsfile */
-@@ -998,7 +1002,7 @@ extern struct daemon {
-   /* DHCP state */
-   int dhcpfd, helperfd, pxefd; 
- #if defined(HAVE_LINUX_NETWORK)
--  int netlinkfd;
-+  int netlinkfd, inotifyfd;
- #elif defined(HAVE_BSD_NETWORK)
-   int dhcp_raw_fd, dhcp_icmp_fd, routefd;
- #endif
-@@ -1469,3 +1473,8 @@ void loop_send_probes();
- int detect_loop(char *query, int type);
- #endif
- 
-+/* inotify.c */
-+#ifdef HAVE_LINUX_NETWORK
-+void inotify_dnsmasq_init();
-+int inotify_check(void);
-+#endif
-diff --git a/src/inotify.c b/src/inotify.c
-new file mode 100644
-index 000000000000..a0223443d6b6
---- /dev/null
-+++ b/src/inotify.c
-@@ -0,0 +1,102 @@
-+/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+ 
-+   This program is free software; you can redistribute it and/or modify
-+   it under the terms of the GNU General Public License as published by
-+   the Free Software Foundation; version 2 dated June, 1991, or
-+   (at your option) version 3 dated 29 June, 2007.
-+ 
-+   This program is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU General Public License for more details.
-+     
-+   You should have received a copy of the GNU General Public License
-+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+*/
-+
-+#include "dnsmasq.h"
-+#include <sys/inotify.h>
-+
-+#ifdef HAVE_LINUX_NETWORK
-+
-+/* the strategy is to set a inotify on the directories containing
-+   resolv files, for any files in the directory which are close-write 
-+   or moved into the directory.
-+   
-+   When either of those happen, we look to see if the file involved
-+   is actually a resolv-file, and if so, call poll-resolv with
-+   the "force" argument, to ensure it's read.
-+
-+   This adds one new error condition: the directories containing
-+   all specified resolv-files must exist at start-up, even if the actual
-+   files don't. 
-+*/
-+
-+static char *inotify_buffer;
-+#define INOTIFY_SZ (sizeof(struct inotify_event) + NAME_MAX + 1)
-+
-+void inotify_dnsmasq_init()
-+{
-+  struct resolvc *res;
-+
-+  inotify_buffer = safe_malloc(INOTIFY_SZ);
-+
-+  daemon->inotifyfd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
-+
-+  if (daemon->inotifyfd == -1)
-+    die(_("failed to create inotify: %s"), NULL, EC_MISC);
-+
-+  for (res = daemon->resolv_files; res; res = res->next)
-+    {
-+      char *d = strrchr(res->name, '/');
-+      
-+      if (!d)
-+	die(_("resolv-file %s not an absolute path"), res->name, EC_MISC);
-+       
-+      *d = 0; /* make ->name just directory */
-+      res->wd = inotify_add_watch(daemon->inotifyfd, res->name, IN_CLOSE_WRITE | IN_MOVED_TO);
-+      res->file = d+1; /* pointer to filename */
-+      
-+      if (res->wd == -1 && errno == ENOENT)
-+	die(_("directory %s for resolv-file is missing, cannot poll"), res->name, EC_MISC);
-+      
-+      *d = '/'; /* restore name */
-+      
-+      if (res->wd == -1)
-+	die(_("failed to create inotify for %s: %s"), res->name, EC_MISC);
-+    }
-+}
-+
-+int inotify_check(void)
-+{
-+  int hit = 0;
-+  
-+  while (1)
-+    {
-+      int rc;
-+      char *p;
-+      struct resolvc *res;
-+      struct inotify_event *in;
-+
-+      while ((rc = read(daemon->inotifyfd, inotify_buffer, INOTIFY_SZ)) == -1 && errno == EINTR);
-+      
-+      if (rc <= 0)
-+	break;
-+      
-+      for (p = inotify_buffer; rc - (p - inotify_buffer) >= (int)sizeof(struct inotify_event); p += sizeof(struct inotify_event) + in->len) 
-+	{
-+	  in = (struct inotify_event*)p;
-+	  
-+	  for (res = daemon->resolv_files; res; res = res->next)
-+	    if (res->wd == in->wd && in->len != 0 && strcmp(res->file, in->name) == 0)
-+	      hit = 1;
-+	}
-+    }
-+
-+  return hit;
-+}
-+
-+#endif
-+
-+  
-+  
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/001-include_0_0_0_0_8_in_DNS_rebind_checks.patch b/src/patches/dnsmasq/001-include_0_0_0_0_8_in_DNS_rebind_checks.patch
new file mode 100644
index 0000000000..8a2557acaf
--- /dev/null
+++ b/src/patches/dnsmasq/001-include_0_0_0_0_8_in_DNS_rebind_checks.patch
@@ -0,0 +1,41 @@
+From d2aa7dfbb6d1088dcbea9fecc61b9293b320eb95 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Mon, 3 Aug 2015 21:52:12 +0100
+Subject: [PATCH] Include 0.0.0.0/8 in DNS rebind checks.
+
+---
+ CHANGELOG     |    7 +++++++
+ src/rfc1035.c |    3 ++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 901da47..3f4026d 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -1,3 +1,10 @@
++version 2.76
++            Include 0.0.0.0/8 in DNS rebind checks. This range 
++	    translates to hosts on  the local network, or, at 
++	    least, 0.0.0.0 accesses the local host, so could
++	    be targets for DNS rebinding. See RFC 5735 section 3 
++	    for details. Thanks to Stephen RÃÂ¶ttger for the bug report.
++	    
+ version 2.75
+             Fix reversion on 2.74 which caused 100% CPU use when a 
+ 	    dhcp-script is configured. Thanks to Adrian Davey for
+diff --git a/src/rfc1035.c b/src/rfc1035.c
+index 56647b0..29e9e65 100644
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -728,7 +728,8 @@ int private_net(struct in_addr addr, int ban_localhost)
+   in_addr_t ip_addr = ntohl(addr.s_addr);
+ 
+   return
+-    (((ip_addr & 0xFF000000) == 0x7F000000) && ban_localhost)  /* 127.0.0.0/8    (loopback) */ || 
++    (((ip_addr & 0xFF000000) == 0x7F000000) && ban_localhost)  /* 127.0.0.0/8    (loopback) */ ||
++    ((ip_addr & 0xFF000000) == 0x00000000)  /* RFC 5735 section 3. "here" network */ ||
+     ((ip_addr & 0xFFFF0000) == 0xC0A80000)  /* 192.168.0.0/16 (private)  */ ||
+     ((ip_addr & 0xFF000000) == 0x0A000000)  /* 10.0.0.0/8     (private)  */ ||
+     ((ip_addr & 0xFFF00000) == 0xAC100000)  /* 172.16.0.0/12  (private)  */ ||
+-- 
+1.7.10.4
diff --git a/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch b/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch
deleted file mode 100644
index 70fc5c3f85..0000000000
--- a/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 857973e6f7e0a3d03535a9df7f9373fd7a0b65cc Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 15 Dec 2014 15:58:13 +0000
-Subject: [PATCH 10/55] Teach the new inotify code about symlinks.
-
----
- src/inotify.c | 43 +++++++++++++++++++++++++++----------------
- 1 file changed, 27 insertions(+), 16 deletions(-)
-
-diff --git a/src/inotify.c b/src/inotify.c
-index a0223443d6b6..960bf5efb41f 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -41,29 +41,40 @@ void inotify_dnsmasq_init()
- 
-   inotify_buffer = safe_malloc(INOTIFY_SZ);
- 
--  daemon->inotifyfd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
- 
-+  daemon->inotifyfd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
-+  
-   if (daemon->inotifyfd == -1)
-     die(_("failed to create inotify: %s"), NULL, EC_MISC);
--
-+  
-   for (res = daemon->resolv_files; res; res = res->next)
-     {
--      char *d = strrchr(res->name, '/');
--      
--      if (!d)
--	die(_("resolv-file %s not an absolute path"), res->name, EC_MISC);
--       
--      *d = 0; /* make ->name just directory */
--      res->wd = inotify_add_watch(daemon->inotifyfd, res->name, IN_CLOSE_WRITE | IN_MOVED_TO);
--      res->file = d+1; /* pointer to filename */
--      
--      if (res->wd == -1 && errno == ENOENT)
--	die(_("directory %s for resolv-file is missing, cannot poll"), res->name, EC_MISC);
-+      char *d = NULL, *path;
-       
--      *d = '/'; /* restore name */
-+      if (!(path = realpath(res->name, NULL)))
-+	{
-+	  /* realpath will fail if the file doesn't exist, but
-+	     dnsmasq copes with missing files, so fall back 
-+	     and assume that symlinks are not in use in that case. */
-+	  if (errno == ENOENT)
-+	    path = res->name;
-+	  else
-+	    die(_("cannot cannonicalise resolv-file %s: %s"), res->name, EC_MISC); 
-+	}
-       
--      if (res->wd == -1)
--	die(_("failed to create inotify for %s: %s"), res->name, EC_MISC);
-+      if ((d = strrchr(path, '/')))
-+	{
-+	  *d = 0; /* make path just directory */
-+	  res->wd = inotify_add_watch(daemon->inotifyfd, path, IN_CLOSE_WRITE | IN_MOVED_TO);
-+	  res->file = d+1; /* pointer to filename */
-+	  *d = '/';
-+	  
-+	  if (res->wd == -1 && errno == ENOENT)
-+	    die(_("directory %s for resolv-file is missing, cannot poll"), res->name, EC_MISC);
-+	  
-+	  if (res->wd == -1)
-+	    die(_("failed to create inotify for %s: %s"), res->name, EC_MISC);
-+	}
-     }
- }
- 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch b/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch
deleted file mode 100644
index 095253b184..0000000000
--- a/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 800c5cc1e7438818fd80f08c2d472df249a6942d Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 15 Dec 2014 17:50:15 +0000
-Subject: [PATCH 11/55] Remove floor on EDNS0 packet size with DNSSEC.
-
----
- CHANGELOG     | 6 +++++-
- src/dnsmasq.c | 5 -----
- 2 files changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 13ab41c05fc3..68252924e743 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -2,7 +2,11 @@ version 2.73
-             Fix crash at startup when an empty suffix is supplied to
- 	    --conf-dir, also trivial memory leak. Thanks to 
- 	    Tomas Hozza for spotting this.
--	
-+
-+	    Remove floor of 4096 on advertised EDNS0 packet size when 
-+	    DNSSEC in use, the original rationale for this has long gone.
-+	    Thanks to Anders Kaseorg for spotting this.
-+
- 
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index bf2e25a55780..5c7750d365fa 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -87,11 +87,6 @@ int main (int argc, char **argv)
-  
-   if (daemon->edns_pktsz < PACKETSZ)
-     daemon->edns_pktsz = PACKETSZ;
--#ifdef HAVE_DNSSEC
--  /* Enforce min packet big enough for DNSSEC */
--  if (option_bool(OPT_DNSSEC_VALID) && daemon->edns_pktsz < EDNS_PKTSZ)
--    daemon->edns_pktsz = EDNS_PKTSZ;
--#endif
- 
-   daemon->packet_buff_sz = daemon->edns_pktsz > DNSMASQ_PACKETSZ ? 
-     daemon->edns_pktsz : DNSMASQ_PACKETSZ;
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch b/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch
deleted file mode 100644
index b71e58b75b..0000000000
--- a/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From ad946d555dce44eb690c7699933b6ff40ab85bb6 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 15 Dec 2014 17:52:22 +0000
-Subject: [PATCH 12/55] CHANGELOG re. inotify.
-
----
- CHANGELOG | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 68252924e743..9174b0bd75dc 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -7,6 +7,10 @@ version 2.73
- 	    DNSSEC in use, the original rationale for this has long gone.
- 	    Thanks to Anders Kaseorg for spotting this.
- 
-+	    Use inotify for checking on updates to /etc/resolv.conf and
-+	    friends under Linux. This fixes race conditions when the files are 
-+	    updated rapidly and saves CPU by noy polling.
-+	
- 
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch b/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch
deleted file mode 100644
index 2ff5acd14a..0000000000
--- a/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 3ad3f3bbd4ee716a7d2fb1e115cf89bd1b1a5de9 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 16 Dec 2014 18:25:17 +0000
-Subject: [PATCH 13/55] Fix breakage of --domain=<domain>,<subnet>,local
-
----
- CHANGELOG    |  4 ++++
- src/option.c | 18 ++++++++++++++++--
- 2 files changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 9174b0bd75dc..9e6c7aa4fd68 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -10,6 +10,10 @@ version 2.73
- 	    Use inotify for checking on updates to /etc/resolv.conf and
- 	    friends under Linux. This fixes race conditions when the files are 
- 	    updated rapidly and saves CPU by noy polling.
-+
-+	    Fix breakage of --domain=<domain>,<subnet>,local - only reverse
-+	    queries were intercepted. THis appears to have been broken 
-+	    since 2.69. Thanks to Josh Stone for finding the bug.
- 	
- 
- version 2.72
-diff --git a/src/option.c b/src/option.c
-index b08e98e16f84..209fa6976609 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -1941,10 +1941,17 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 			      else
- 				{
- 				   /* generate the equivalent of
--				      local=/<domain>/
- 				      local=/xxx.yyy.zzz.in-addr.arpa/ */
- 				  struct server *serv = add_rev4(new->start, msize);
- 				  serv->flags |= SERV_NO_ADDR;
-+
-+				  /* local=/<domain>/ */
-+				  serv = opt_malloc(sizeof(struct server));
-+				  memset(serv, 0, sizeof(struct server));
-+				  serv->domain = d;
-+				  serv->flags = SERV_HAS_DOMAIN | SERV_NO_ADDR;
-+				  serv->next = daemon->servers;
-+				  daemon->servers = serv;
- 				}
- 			    }
- 			}
-@@ -1978,10 +1985,17 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 			      else 
- 				{
- 				  /* generate the equivalent of
--				     local=/<domain>/
- 				     local=/xxx.yyy.zzz.ip6.arpa/ */
- 				  struct server *serv = add_rev6(&new->start6, msize);
- 				  serv->flags |= SERV_NO_ADDR;
-+				  
-+				  /* local=/<domain>/ */
-+				  serv = opt_malloc(sizeof(struct server));
-+				  memset(serv, 0, sizeof(struct server));
-+				  serv->domain = d;
-+				  serv->flags = SERV_HAS_DOMAIN | SERV_NO_ADDR;
-+				  serv->next = daemon->servers;
-+				  daemon->servers = serv;
- 				}
- 			    }
- 			}
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch b/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch
deleted file mode 100644
index a0e647f8af..0000000000
--- a/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From bd9520b7ade7098ee423acc38965376aa57feb07 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 16 Dec 2014 20:41:29 +0000
-Subject: [PATCH 14/55] Remove redundant IN6_IS_ADDR_ULA(a) macro defn.
-
----
- src/network.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/src/network.c b/src/network.c
-index 5067007c5cbc..99419f57951e 100644
---- a/src/network.c
-+++ b/src/network.c
-@@ -16,10 +16,6 @@
- 
- #include "dnsmasq.h"
- 
--#ifndef IN6_IS_ADDR_ULA
--#define IN6_IS_ADDR_ULA(a) ((((__const uint32_t *) (a))[0] & htonl (0xfe00000)) == htonl (0xfc000000))
--#endif
--
- #ifdef HAVE_LINUX_NETWORK
- 
- int indextoname(int fd, int index, char *name)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch b/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch
deleted file mode 100644
index 114a4f371c..0000000000
--- a/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From 476693678e778886b64d0b56e27eb7695cbcca99 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 17 Dec 2014 12:41:56 +0000
-Subject: [PATCH 15/55] Eliminate IPv6 privacy addresses from --interface-name
- answers.
-
----
- CHANGELOG     |  5 +++++
- src/auth.c    |  4 ++++
- src/dnsmasq.h |  1 +
- src/network.c | 12 ++++++++----
- src/rfc1035.c | 17 ++++++++++-------
- 5 files changed, 28 insertions(+), 11 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 9e6c7aa4fd68..01f5208ec006 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -14,6 +14,11 @@ version 2.73
- 	    Fix breakage of --domain=<domain>,<subnet>,local - only reverse
- 	    queries were intercepted. THis appears to have been broken 
- 	    since 2.69. Thanks to Josh Stone for finding the bug.
-+
-+	    Eliminate IPv6 privacy addresses and deprecated addresses from
-+	    the answers given by --interface-name. Note that reverse queries
-+	    (ie looking for names, given addresses) are not affected. 
-+	    Thanks to Michael Gorbach for the suggestion.
- 	
- 
- version 2.72
-diff --git a/src/auth.c b/src/auth.c
-index dd46566ec2cc..a327f16d8c0b 100644
---- a/src/auth.c
-+++ b/src/auth.c
-@@ -363,6 +363,10 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
- 		 if (((addrlist->flags & ADDRLIST_IPV6)  ? T_AAAA : T_A) == qtype &&
- 		     (local_query || filter_zone(zone, flag, &addrlist->addr)))
- 		   {
-+#ifdef HAVE_IPV6
-+		     if (addrlist->flags & ADDRLIST_REVONLY)
-+		       continue;
-+#endif
- 		     found = 1;
- 		     log_query(F_FORWARD | F_CONFIG | flag, name, &addrlist->addr, NULL);
- 		     if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, 
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index ebb6b957812f..1dd61c5edba3 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -318,6 +318,7 @@ struct ds_config {
- 
- #define ADDRLIST_LITERAL 1
- #define ADDRLIST_IPV6    2
-+#define ADDRLIST_REVONLY 4
- 
- struct addrlist {
-   struct all_addr addr;
-diff --git a/src/network.c b/src/network.c
-index 99419f57951e..14d2af2ce313 100644
---- a/src/network.c
-+++ b/src/network.c
-@@ -236,7 +236,7 @@ struct iface_param {
- };
- 
- static int iface_allowed(struct iface_param *param, int if_index, char *label,
--			 union mysockaddr *addr, struct in_addr netmask, int prefixlen, int dad) 
-+			 union mysockaddr *addr, struct in_addr netmask, int prefixlen, int iface_flags) 
- {
-   struct irec *iface;
-   int mtu = 0, loopback;
-@@ -388,6 +388,10 @@ static int iface_allowed(struct iface_param *param, int if_index, char *label,
- 		 {
- 		    al->addr.addr.addr6 = addr->in6.sin6_addr;
- 		    al->flags = ADDRLIST_IPV6;
-+		    /* Privacy addresses and addresses still undergoing DAD and deprecated addresses
-+		       don't appear in forward queries, but will in reverse ones. */
-+		    if (!(iface_flags & IFACE_PERMANENT) || (iface_flags & (IFACE_DEPRECATED | IFACE_TENTATIVE)))
-+		      al->flags |= ADDRLIST_REVONLY;
- 		 } 
- #endif
- 	      }
-@@ -399,7 +403,7 @@ static int iface_allowed(struct iface_param *param, int if_index, char *label,
-   for (iface = daemon->interfaces; iface; iface = iface->next) 
-     if (sockaddr_isequal(&iface->addr, addr))
-       {
--	iface->dad = dad;
-+	iface->dad = !!(iface_flags & IFACE_TENTATIVE);
- 	iface->found = 1; /* for garbage collection */
- 	return 1;
-       }
-@@ -474,7 +478,7 @@ static int iface_allowed(struct iface_param *param, int if_index, char *label,
-       iface->dhcp_ok = dhcp_ok;
-       iface->dns_auth = auth_dns;
-       iface->mtu = mtu;
--      iface->dad = dad;
-+      iface->dad = !!(iface_flags & IFACE_TENTATIVE);
-       iface->found = 1;
-       iface->done = iface->multicast_done = iface->warned = 0;
-       iface->index = if_index;
-@@ -519,7 +523,7 @@ static int iface_allowed_v6(struct in6_addr *local, int prefix,
-   else
-     addr.in6.sin6_scope_id = 0;
-   
--  return iface_allowed((struct iface_param *)vparam, if_index, NULL, &addr, netmask, prefix, !!(flags & IFACE_TENTATIVE));
-+  return iface_allowed((struct iface_param *)vparam, if_index, NULL, &addr, netmask, prefix, flags);
- }
- #endif
- 
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 8a7d2608dac5..bdeb3fb10e68 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1923,14 +1923,17 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
- 		  for (intr = daemon->int_names; intr; intr = intr->next)
- 		    if (hostname_isequal(name, intr->name))
- 		      {
--			ans = 1;
--			if (!dryrun)
--			  {
--			    
--			    for (addrlist = intr->addr; addrlist; addrlist = addrlist->next)
-+			for (addrlist = intr->addr; addrlist; addrlist = addrlist->next)
- #ifdef HAVE_IPV6
--			      if (((addrlist->flags & ADDRLIST_IPV6) ? T_AAAA : T_A) == type)
-+			  if (((addrlist->flags & ADDRLIST_IPV6) ? T_AAAA : T_A) == type)
- #endif
-+			    {
-+#ifdef HAVE_IPV6
-+			      if (addrlist->flags & ADDRLIST_REVONLY)
-+				continue;
-+#endif	
-+			      ans = 1;	
-+			      if (!dryrun)
- 				{
- 				  gotit = 1;
- 				  log_query(F_FORWARD | F_CONFIG | flag, name, &addrlist->addr, NULL);
-@@ -1939,7 +1942,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
- 							  type == T_A ? "4" : "6", &addrlist->addr))
- 				    anscount++;
- 				}
--			  }
-+			    }
- 		      }
- 		  
- 		  if (!dryrun && !gotit)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch b/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch
deleted file mode 100644
index d072c0379d..0000000000
--- a/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 3267804598047bd1781cab91508d1bc516e5ddbb Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 17 Dec 2014 20:38:20 +0000
-Subject: [PATCH 16/55] Tweak field width in cache dump to avoid truncating
- IPv6 addresses.
-
----
- src/cache.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index 2c3a49887053..f9e1d31e8c99 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1411,7 +1411,7 @@ void dump_cache(time_t now)
- 	    *a = 0;
- 	    if (strlen(n) == 0 && !(cache->flags & F_REVERSE))
- 	      n = "<Root>";
--	    p += sprintf(p, "%-40.40s ", n);
-+	    p += sprintf(p, "%-30.30s ", n);
- 	    if ((cache->flags & F_CNAME) && !is_outdated_cname_pointer(cache))
- 	      a = cache_get_cname_target(cache);
- #ifdef HAVE_DNSSEC
-@@ -1454,7 +1454,7 @@ void dump_cache(time_t now)
- 	    else if (cache->flags & F_DNSKEY)
- 	      t = "K";
- #endif
--	    p += sprintf(p, "%-30.30s %s%s%s%s%s%s%s%s%s  ", a, t,
-+	    p += sprintf(p, "%-40.40s %s%s%s%s%s%s%s%s%s  ", a, t,
- 			 cache->flags & F_FORWARD ? "F" : " ",
- 			 cache->flags & F_REVERSE ? "R" : " ",
- 			 cache->flags & F_IMMORTAL ? "I" : " ",
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch b/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch
deleted file mode 100644
index 944afaf15d..0000000000
--- a/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 094b5c3d904bae9aeb3206d9f3b8348926b84975 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 21 Dec 2014 16:11:52 +0000
-Subject: [PATCH 17/55] Fix crash in DNSSEC code when attempting to verify
- large RRs.
-
----
- CHANGELOG    |  3 +++
- src/dnssec.c | 27 +++++++++++++++++++--------
- 2 files changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 01f5208ec006..956b71a151db 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -19,6 +19,9 @@ version 2.73
- 	    the answers given by --interface-name. Note that reverse queries
- 	    (ie looking for names, given addresses) are not affected. 
- 	    Thanks to Michael Gorbach for the suggestion.
-+
-+	    Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
-+	    for the bug report.
- 	
- 
- version 2.72
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 69bfc29e355f..3208ac701149 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -456,16 +456,27 @@ static u16 *get_desc(int type)
- 
- /* Return bytes of canonicalised rdata, when the return value is zero, the remaining 
-    data, pointed to by *p, should be used raw. */
--static int get_rdata(struct dns_header *header, size_t plen, unsigned char *end, char *buff, 
-+static int get_rdata(struct dns_header *header, size_t plen, unsigned char *end, char *buff, int bufflen,
- 		     unsigned char **p, u16 **desc)
- {
-   int d = **desc;
-   
--  (*desc)++;
--  
-   /* No more data needs mangling */
-   if (d == (u16)-1)
--    return 0;
-+    {
-+      /* If there's more data than we have space for, just return what fits,
-+	 we'll get called again for more chunks */
-+      if (end - *p > bufflen)
-+	{
-+	  memcpy(buff, *p, bufflen);
-+	  *p += bufflen;
-+	  return bufflen;
-+	}
-+      
-+      return 0;
-+    }
-+ 
-+  (*desc)++;
-   
-   if (d == 0 && extract_name(header, plen, p, buff, 1, 0))
-     /* domain-name, canonicalise */
-@@ -560,7 +571,7 @@ static void sort_rrset(struct dns_header *header, size_t plen, u16 *rr_desc, int
- 	      if (left1 != 0)
- 		memmove(buff1, buff1 + len1 - left1, left1);
- 	      
--	      if ((len1 = get_rdata(header, plen, end1, buff1 + left1, &p1, &dp1)) == 0)
-+	      if ((len1 = get_rdata(header, plen, end1, buff1 + left1, MAXDNAME - left1, &p1, &dp1)) == 0)
- 		{
- 		  quit = 1;
- 		  len1 = end1 - p1;
-@@ -571,7 +582,7 @@ static void sort_rrset(struct dns_header *header, size_t plen, u16 *rr_desc, int
- 	      if (left2 != 0)
- 		memmove(buff2, buff2 + len2 - left2, left2);
- 	      
--	      if ((len2 = get_rdata(header, plen, end2, buff2 + left2, &p2, &dp2)) == 0)
-+	      if ((len2 = get_rdata(header, plen, end2, buff2 + left2, MAXDNAME - left2, &p2, &dp2)) == 0)
- 		{
- 		  quit = 1;
- 		  len2 = end2 - p2;
-@@ -808,7 +819,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
- 	  /* canonicalise rdata and calculate length of same, use name buffer as workspace */
- 	  cp = p;
- 	  dp = rr_desc;
--	  for (len = 0; (seg = get_rdata(header, plen, end, name, &cp, &dp)) != 0; len += seg);
-+	  for (len = 0; (seg = get_rdata(header, plen, end, name, MAXDNAME, &cp, &dp)) != 0; len += seg);
- 	  len += end - cp;
- 	  len = htons(len);
- 	  hash->update(ctx, 2, (unsigned char *)&len); 
-@@ -816,7 +827,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
- 	  /* Now canonicalise again and digest. */
- 	  cp = p;
- 	  dp = rr_desc;
--	  while ((seg = get_rdata(header, plen, end, name, &cp, &dp)))
-+	  while ((seg = get_rdata(header, plen, end, name, MAXDNAME, &cp, &dp)))
- 	    hash->update(ctx, seg, (unsigned char *)name);
- 	  if (cp != end)
- 	    hash->update(ctx, end - cp, cp);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch b/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch
deleted file mode 100644
index de66adb9bc..0000000000
--- a/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From cbc652423403e3cef00e00240f6beef713142246 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 21 Dec 2014 21:21:53 +0000
-Subject: [PATCH 18/55] Make caching work for CNAMEs pointing to A/AAAA records
- shadowed in /etc/hosts
-
-If the answer to an upstream query is a CNAME which points to an
-A/AAAA record which also exists in /etc/hosts and friends, then
-caching is suppressed, to avoid inconsistent answers. This is
-now modified to allow caching when the upstream and local A/AAAA
-records have the same value.
----
- src/cache.c | 34 +++++++++++++++++++++++++---------
- 1 file changed, 25 insertions(+), 9 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index f9e1d31e8c99..ff1ca6f1c352 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -322,7 +322,7 @@ static int is_expired(time_t now, struct crec *crecp)
-   return 1;
- }
- 
--static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsigned short flags)
-+static struct crec *cache_scan_free(char *name, struct all_addr *addr, time_t now, unsigned short flags)
- {
-   /* Scan and remove old entries.
-      If (flags & F_FORWARD) then remove any forward entries for name and any expired
-@@ -331,8 +331,8 @@ static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsign
-      entries in the whole cache.
-      If (flags == 0) remove any expired entries in the whole cache. 
- 
--     In the flags & F_FORWARD case, the return code is valid, and returns zero if the
--     name exists in the cache as a HOSTS or DHCP entry (these are never deleted)
-+     In the flags & F_FORWARD case, the return code is valid, and returns a non-NULL pointer
-+     to a cache entry if the name exists in the cache as a HOSTS or DHCP entry (these are never deleted)
- 
-      We take advantage of the fact that hash chains have stuff in the order <reverse>,<other>,<immortal>
-      so that when we hit an entry which isn't reverse and is immortal, we're done. */
-@@ -361,7 +361,7 @@ static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsign
- 		  (((crecp->flags | flags) & F_CNAME) && !(crecp->flags & (F_DNSKEY | F_DS))))
- 		{
- 		  if (crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG))
--		    return 0;
-+		    return crecp;
- 		  *up = crecp->hash_next;
- 		  cache_unlink(crecp);
- 		  cache_free(crecp);
-@@ -378,7 +378,7 @@ static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsign
- 		   crecp->addr.sig.type_covered == addr->addr.dnssec.type))
- 		{
- 		  if (crecp->flags & F_CONFIG)
--		    return 0;
-+		    return crecp;
- 		  *up = crecp->hash_next;
- 		  cache_unlink(crecp);
- 		  cache_free(crecp);
-@@ -423,7 +423,7 @@ static int cache_scan_free(char *name, struct all_addr *addr, time_t now, unsign
- 	    up = &crecp->hash_next;
-     }
-   
--  return 1;
-+  return NULL;
- }
- 
- /* Note: The normal calling sequence is
-@@ -471,10 +471,26 @@ struct crec *cache_insert(char *name, struct all_addr *addr,
-     return NULL;
-   
-   /* First remove any expired entries and entries for the name/address we
--     are currently inserting. Fail if we attempt to delete a name from
--     /etc/hosts or DHCP. */
--  if (!cache_scan_free(name, addr, now, flags))
-+     are currently inserting. */
-+  if ((new = cache_scan_free(name, addr, now, flags)))
-     {
-+      /* We're trying to insert a record over one from 
-+	 /etc/hosts or DHCP, or other config. If the 
-+	 existing record is for an A or AAAA and
-+	 the record we're trying to insert is the same, 
-+	 just drop the insert, but don't error the whole process. */
-+      if ((flags & (F_IPV4 | F_IPV6)) && (flags & F_FORWARD))
-+	{
-+	  if ((flags & F_IPV4) && (new->flags & F_IPV4) &&
-+	      new->addr.addr.addr.addr4.s_addr == addr->addr.addr4.s_addr)
-+	    return new;
-+#ifdef HAVE_IPV6
-+	  else if ((flags & F_IPV6) && (new->flags & F_IPV6) &&
-+		   IN6_ARE_ADDR_EQUAL(&new->addr.addr.addr.addr6, &addr->addr.addr6))
-+	    return new;
-+#endif
-+	}
-+      
-       insert_error = 1;
-       return NULL;
-     }
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch b/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch
deleted file mode 100644
index 0ee2e657b7..0000000000
--- a/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch
+++ /dev/null
@@ -1,365 +0,0 @@
-From fbc5205702c7f6f431d9f1043c553d7fb62ddfdb Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 23 Dec 2014 15:46:08 +0000
-Subject: [PATCH 19/55] Fix problems validating NSEC3 and wildcards.
-
----
- src/dnssec.c | 253 ++++++++++++++++++++++++++++++-----------------------------
- 1 file changed, 128 insertions(+), 125 deletions(-)
-
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 3208ac701149..9350d3e8c963 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -615,6 +615,7 @@ static void sort_rrset(struct dns_header *header, size_t plen, u16 *rr_desc, int
-    Return code:
-    STAT_SECURE   if it validates.
-    STAT_SECURE_WILDCARD if it validates and is the result of wildcard expansion.
-+   (In this case *wildcard_out points to the "body" of the wildcard within name.) 
-    STAT_NO_SIG no RRsigs found.
-    STAT_INSECURE RRset empty.
-    STAT_BOGUS    signature is wrong, bad packet.
-@@ -625,8 +626,8 @@ static void sort_rrset(struct dns_header *header, size_t plen, u16 *rr_desc, int
- 
-    name is unchanged on exit. keyname is used as workspace and trashed.
- */
--static int validate_rrset(time_t now, struct dns_header *header, size_t plen, int class, 
--			  int type, char *name, char *keyname, struct blockdata *key, int keylen, int algo_in, int keytag_in)
-+static int validate_rrset(time_t now, struct dns_header *header, size_t plen, int class, int type, 
-+			  char *name, char *keyname, char **wildcard_out, struct blockdata *key, int keylen, int algo_in, int keytag_in)
- {
-   static unsigned char **rrset = NULL, **sigs = NULL;
-   static int rrset_sz = 0, sig_sz = 0;
-@@ -798,8 +799,16 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
- 	    {
- 	      int k;
- 	      for (k = name_labels - labels; k != 0; k--)
--		while (*name_start != '.' && *name_start != 0)
--		  name_start++;
-+		{
-+		  while (*name_start != '.' && *name_start != 0)
-+		    name_start++;
-+		  if (k != 1)
-+		    name_start++;
-+		}
-+	      
-+	      if (wildcard_out)
-+		*wildcard_out = name_start+1;
-+
- 	      name_start--;
- 	      *name_start = '*';
- 	    }
-@@ -974,7 +983,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
- 	      if (recp1->addr.ds.keylen == (int)hash->digest_size &&
- 		  (ds_digest = blockdata_retrieve(recp1->addr.key.keydata, recp1->addr.ds.keylen, NULL)) &&
- 		  memcmp(ds_digest, digest, recp1->addr.ds.keylen) == 0 &&
--		  validate_rrset(now, header, plen, class, T_DNSKEY, name, keyname, key, rdlen - 4, algo, keytag) == STAT_SECURE)
-+		  validate_rrset(now, header, plen, class, T_DNSKEY, name, keyname, NULL, key, rdlen - 4, algo, keytag) == STAT_SECURE)
- 		{
- 		  valid = 1;
- 		  break;
-@@ -1443,11 +1452,88 @@ static int base32_decode(char *in, unsigned char *out)
-   return p - out;
- }
- 
-+static int check_nsec3_coverage(struct dns_header *header, size_t plen, int digest_len, unsigned char *digest, int type,
-+				char *workspace1, char *workspace2, unsigned char **nsecs, int nsec_count)
-+{
-+  int i, hash_len, salt_len, base32_len, rdlen;
-+  unsigned char *p, *psave;
-+
-+  for (i = 0; i < nsec_count; i++)
-+    if ((p = nsecs[i]))
-+      {
-+       	if (!extract_name(header, plen, &p, workspace1, 1, 0) ||
-+	    !(base32_len = base32_decode(workspace1, (unsigned char *)workspace2)))
-+	  return 0;
-+	
-+	p += 8; /* class, type, TTL */
-+	GETSHORT(rdlen, p);
-+	psave = p;
-+	p += 4; /* algo, flags, iterations */
-+	salt_len = *p++; /* salt_len */
-+	p += salt_len; /* salt */
-+	hash_len = *p++; /* p now points to next hashed name */
-+	
-+	if (!CHECK_LEN(header, p, plen, hash_len))
-+	  return 0;
-+	
-+	if (digest_len == base32_len && hash_len == base32_len)
-+	  {
-+	    int rc = memcmp(workspace2, digest, digest_len);
-+
-+	    if (rc == 0)
-+	      {
-+		/* We found an NSEC3 whose hashed name exactly matches the query, so
-+		   we just need to check the type map. p points to the RR data for the record. */
-+		
-+		int offset = (type & 0xff) >> 3;
-+		int mask = 0x80 >> (type & 0x07);
-+		
-+		p += hash_len; /* skip next-domain hash */
-+		rdlen -= p - psave;
-+
-+		if (!CHECK_LEN(header, p, plen, rdlen))
-+		  return 0;
-+		
-+		while (rdlen >= 2)
-+		  {
-+		    if (p[0] == type >> 8)
-+		      {
-+			/* Does the NSEC3 say our type exists? */
-+			if (offset < p[1] && (p[offset+2] & mask) != 0)
-+			  return STAT_BOGUS;
-+			
-+			break; /* finshed checking */
-+		      }
-+		    
-+		    rdlen -= p[1];
-+		    p +=  p[1];
-+		  }
-+
-+		return 1;
-+	      }
-+	    else if (rc <= 0)
-+	      {
-+		/* Normal case, hash falls between NSEC3 name-hash and next domain name-hash,
-+		   wrap around case, name-hash falls between NSEC3 name-hash and end */
-+		if (memcmp(p, digest, digest_len) > 0 || memcmp(workspace2, p, digest_len) > 0)
-+		  return 1;
-+	      }
-+	    else 
-+	      {
-+		/* wrap around case, name falls between start and next domain name */
-+		if (memcmp(workspace2, p, digest_len) > 0 && memcmp(p, digest, digest_len) > 0)
-+		  return 1;
-+	      }
-+	  }
-+      }
-+  return 0;
-+}
-+
- static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, unsigned char **nsecs, int nsec_count,
--				     char *workspace1, char *workspace2, char *name, int type)
-+				     char *workspace1, char *workspace2, char *name, int type, char *wildname)
- {
-   unsigned char *salt, *p, *digest;
--  int digest_len, i, iterations, salt_len, hash_len, base32_len, algo = 0;
-+  int digest_len, i, iterations, salt_len, base32_len, algo = 0;
-   struct nettle_hash const *hash;
-   char *closest_encloser, *next_closest, *wildcard;
-  
-@@ -1520,7 +1606,14 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-   if (!(hash = hash_find("sha1")))
-     return STAT_BOGUS;
- 
--  /* Now, we need the "closest encloser NSEC3" */
-+  if ((digest_len = hash_name(name, &digest, hash, salt, salt_len, iterations)) == 0)
-+    return STAT_BOGUS;
-+  
-+  if (check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-+    return STAT_SECURE;
-+
-+  /* Can't find an NSEC3 which covers the name directly, we need the "closest encloser NSEC3" 
-+     or an answer inferred from a wildcard record. */
-   closest_encloser = name;
-   next_closest = NULL;
- 
-@@ -1529,6 +1622,9 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-       if (*closest_encloser == '.')
- 	closest_encloser++;
- 
-+      if (wildname && hostname_isequal(closest_encloser, wildname))
-+	break;
-+
-       if ((digest_len = hash_name(closest_encloser, &digest, hash, salt, salt_len, iterations)) == 0)
- 	return STAT_BOGUS;
-       
-@@ -1551,127 +1647,33 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-     }
-   while ((closest_encloser = strchr(closest_encloser, '.')));
-   
--  /* No usable NSEC3s */
--  if (i == nsec_count)
-+  if (!closest_encloser)
-     return STAT_BOGUS;
-   
--  if (!next_closest)
--    {
--      /* We found an NSEC3 whose hashed name exactly matches the query, so
--	 Now we just need to check the type map. p points to the RR data for the record. */
--      int rdlen;
--      unsigned char *psave;
--      int offset = (type & 0xff) >> 3;
--      int mask = 0x80 >> (type & 0x07);
--      
--      p += 8; /* class, type, TTL */
--      GETSHORT(rdlen, p);
--      psave = p;
--      p += 5 + salt_len; /* algo, flags, iterations, salt_len, salt */
--      hash_len = *p++;
--      if (!CHECK_LEN(header, p, plen, hash_len))
--	return STAT_BOGUS; /* bad packet */
--      p += hash_len;
--      rdlen -= p - psave;
--      
--      while (rdlen >= 2)
--	{
--	  if (!CHECK_LEN(header, p, plen, rdlen))
--	    return STAT_BOGUS;
--	  
--	  if (p[0] == type >> 8)
--	    {
--	      /* Does the NSEC3 say our type exists? */
--	      if (offset < p[1] && (p[offset+2] & mask) != 0)
--		return STAT_BOGUS;
--	      
--	      break; /* finshed checking */
--	    }
--	  
--	  rdlen -= p[1];
--	  p +=  p[1];
--	}
--      
--      return STAT_SECURE;
--    }
--
-   /* Look for NSEC3 that proves the non-existence of the next-closest encloser */
-   if ((digest_len = hash_name(next_closest, &digest, hash, salt, salt_len, iterations)) == 0)
-     return STAT_BOGUS;
- 
--  for (i = 0; i < nsec_count; i++)
--    if ((p = nsecs[i]))
--      {
--       	if (!extract_name(header, plen, &p, workspace1, 1, 0) ||
--	    !(base32_len = base32_decode(workspace1, (unsigned char *)workspace2)))
--	  return STAT_BOGUS;
--	   
--	p += 15 + salt_len; /* class, type, TTL, rdlen, algo, flags, iterations, salt_len, salt */
--	hash_len = *p++; /* p now points to next hashed name */
-- 
--	if (!CHECK_LEN(header, p, plen, hash_len))
--	  return STAT_BOGUS;
--	
--	if (digest_len == base32_len && hash_len == base32_len)
--	  {
--	    if (memcmp(workspace2, digest, digest_len) <= 0)
--	      {
--		/* Normal case, hash falls between NSEC3 name-hash and next domain name-hash,
--		   wrap around case, name-hash falls between NSEC3 name-hash and end */
--		if (memcmp(p, digest, digest_len) > 0 || memcmp(workspace2, p, digest_len) > 0)
--		  return STAT_SECURE;
--	      }
--	    else 
--	      {
--		/* wrap around case, name falls between start and next domain name */
--		if (memcmp(workspace2, p, digest_len) > 0 && memcmp(p, digest, digest_len) > 0)
--		  return STAT_SECURE;
--	      }
--	  }
--      }
--  
--  /* Finally, check that there's no seat of wildcard synthesis */
--  if (!(wildcard = strchr(next_closest, '.')) || wildcard == next_closest)
--    return STAT_BOGUS;
--  
--  wildcard--;
--  *wildcard = '*';
--  
--  if ((digest_len = hash_name(wildcard, &digest, hash, salt, salt_len, iterations)) == 0)
-+  if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-     return STAT_BOGUS;
-   
--  for (i = 0; i < nsec_count; i++)
--    if ((p = nsecs[i]))
--      {
--	if (!extract_name(header, plen, &p, workspace1, 1, 0) ||
--	    !(base32_len = base32_decode(workspace1, (unsigned char *)workspace2)))
--	  return STAT_BOGUS;
--	   
--	p += 15 + salt_len; /* class, type, TTL, rdlen, algo, flags, iterations, salt_len, salt */
--	hash_len = *p++; /* p now points to next hashed name */
-- 
--	if (!CHECK_LEN(header, p, plen, hash_len))
--	  return STAT_BOGUS;
--	
--	if (digest_len == base32_len && hash_len == base32_len)
--	  {
--	    if (memcmp(workspace2, digest, digest_len) <= 0)
--	      {
--		/* Normal case, hash falls between NSEC3 name-hash and next domain name-hash,
--		   wrap around case, name-hash falls between NSEC3 name-hash and end */
--		if (memcmp(p, digest, digest_len) > 0 || memcmp(workspace2, p, digest_len) > 0)
--		  return STAT_SECURE;
--	      }
--	    else 
--	      {
--		/* wrap around case, name falls between start and next domain name */
--		if (memcmp(workspace2, p, digest_len) > 0 && memcmp(p, digest, digest_len) > 0)
--		  return STAT_SECURE;
--	      }
--	  }
--      }
-+  /* Finally, check that there's no seat of wildcard synthesis */
-+  if (!wildname)
-+    {
-+      if (!(wildcard = strchr(next_closest, '.')) || wildcard == next_closest)
-+	return STAT_BOGUS;
-+      
-+      wildcard--;
-+      *wildcard = '*';
-+      
-+      if ((digest_len = hash_name(wildcard, &digest, hash, salt, salt_len, iterations)) == 0)
-+	return STAT_BOGUS;
-+      
-+      if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-+	return STAT_BOGUS;
-+    }
-   
--  return STAT_BOGUS;
-+  return STAT_SECURE;
- }
-     
- /* Validate all the RRsets in the answer and authority sections of the reply (4035:3.2.3) */
-@@ -1792,8 +1794,9 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 	      struct all_addr a;
- 	      struct blockdata *key;
- 	      struct crec *crecp;
--	      
--	      rc = validate_rrset(now, header, plen, class1, type1, name, keyname, NULL, 0, 0, 0);
-+	      char *wildname;
-+
-+	      rc = validate_rrset(now, header, plen, class1, type1, name, keyname, &wildname, NULL, 0, 0, 0);
- 	      
- 	      if (rc == STAT_SECURE_WILDCARD)
- 		{
-@@ -1807,7 +1810,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 		  if (nsec_type == T_NSEC)
- 		    rc = prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1);
- 		  else
--		    rc = prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1);
-+		    rc = prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1, wildname);
- 
- 		  if (rc != STAT_SECURE)
- 		    return rc;
-@@ -1933,7 +1936,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
-   if (nsec_type == T_NSEC)
-     return prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype);
-   else
--    return prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype);
-+    return prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype, NULL);
- }
- 
- /* Chase the CNAME chain in the packet until the first record which _doesn't validate.
-@@ -1980,7 +1983,7 @@ int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char
- 	    return STAT_INSECURE;
- 	  
- 	  /* validate CNAME chain, return if insecure or need more data */
--	  rc = validate_rrset(now, header, plen, class, type, name, keyname, NULL, 0, 0, 0);
-+	  rc = validate_rrset(now, header, plen, class, type, name, keyname, NULL, NULL, 0, 0, 0);
- 	  if (rc != STAT_SECURE)
- 	    {
- 	      if (rc == STAT_NO_SIG)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/002-enhance_add_subnet_to_allow_arbitary_subnet_addresses.patch b/src/patches/dnsmasq/002-enhance_add_subnet_to_allow_arbitary_subnet_addresses.patch
new file mode 100644
index 0000000000..2d3d6e46d2
--- /dev/null
+++ b/src/patches/dnsmasq/002-enhance_add_subnet_to_allow_arbitary_subnet_addresses.patch
@@ -0,0 +1,271 @@
+From a7369bef8abd241c3d85633fa9c870943f091e76 Mon Sep 17 00:00:00 2001
+From: Ed Bardsley <ebardsley@google.com>
+Date: Wed, 5 Aug 2015 21:17:18 +0100
+Subject: [PATCH] Enhance --add-subnet to allow arbitary subnet addresses.
+
+---
+ CHANGELOG     |    4 ++++
+ man/dnsmasq.8 |   32 ++++++++++++++++++++-----------
+ src/dnsmasq.h |   13 ++++++++++---
+ src/option.c  |   59 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
+ src/rfc1035.c |   39 +++++++++++++++++++++++++++++++-------
+ 5 files changed, 121 insertions(+), 26 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 3f4026d..bbc2834 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -4,6 +4,10 @@ version 2.76
+ 	    least, 0.0.0.0 accesses the local host, so could
+ 	    be targets for DNS rebinding. See RFC 5735 section 3 
+ 	    for details. Thanks to Stephen RÃÂ¶ttger for the bug report.
++
++	    Enhance --add-subnet to allow arbitrary subnet addresses.
++            Thanks to Ed Barsley for the patch.
++	
+ 	    
+ version 2.75
+             Fix reversion on 2.74 which caused 100% CPU use when a 
+diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
+index c8913b5..a23c898 100644
+--- a/man/dnsmasq.8
++++ b/man/dnsmasq.8
+@@ -604,17 +604,27 @@ experimental. Also note that exposing MAC addresses in this way may
+ have security and privacy implications. The warning about caching
+ given for --add-subnet applies to --add-mac too.
+ .TP 
+-.B --add-subnet[[=<IPv4 prefix length>],<IPv6 prefix length>]
+-Add the subnet address of the requestor to the DNS queries which are
+-forwarded upstream. The amount of the address forwarded depends on the
+-prefix length parameter: 32 (128 for IPv6) forwards the whole address,
+-zero forwards none of it but still marks the request so that no
+-upstream nameserver will add client address information either. The
+-default is zero for both IPv4 and IPv6. Note that upstream nameservers
+-may be configured to return different results based on this
+-information, but the dnsmasq cache does not take account. If a dnsmasq
+-instance is configured such that different results may be encountered,
+-caching should be disabled.
++.B --add-subnet[[=[<IPv4 address>/]<IPv4 prefix length>][,[<IPv6 address>/]<IPv6 prefix length>]]
++Add a subnet address to the DNS queries which are forwarded
++upstream. If an address is specified in the flag, it will be used,
++otherwise, the address of the requestor will be used. The amount of
++the address forwarded depends on the prefix length parameter: 32 (128
++for IPv6) forwards the whole address, zero forwards none of it but
++still marks the request so that no upstream nameserver will add client
++address information either. The default is zero for both IPv4 and
++IPv6. Note that upstream nameservers may be configured to return
++different results based on this information, but the dnsmasq cache
++does not take account. If a dnsmasq instance is configured such that
++different results may be encountered, caching should be disabled.
++
++For example,
++.B --add-subnet=24,96
++will add the /24 and /96 subnets of the requestor for IPv4 and IPv6 requestors, respectively.
++.B --add-subnet=1.2.3.4/24
++will add 1.2.3.0/24 for IPv4 requestors and ::/0 for IPv6 requestors.
++.B --add-subnet=1.2.3.4/24,1.2.3.4/24
++will add 1.2.3.0/24 for both IPv4 and IPv6 requestors.
++
+ .TP
+ .B \-c, --cache-size=<cachesize>
+ Set the size of dnsmasq's cache. The default is 150 names. Setting the cache size to zero disables caching.
+diff --git a/src/dnsmasq.h b/src/dnsmasq.h
+index cf1a782..f42acdb 100644
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -541,6 +541,13 @@ struct iname {
+   struct iname *next;
+ };
+ 
++/* subnet parameters from command line */
++struct mysubnet {
++  union mysockaddr addr;
++  int addr_used;
++  int mask;
++};
++
+ /* resolv-file parms from command-line */
+ struct resolvc {
+   struct resolvc *next;
+@@ -935,9 +942,9 @@ extern struct daemon {
+   struct auth_zone *auth_zones;
+   struct interface_name *int_names;
+   char *mxtarget;
+-  int addr4_netmask;
+-  int addr6_netmask;
+-  char *lease_file; 
++  struct mysubnet *add_subnet4;
++  struct mysubnet *add_subnet6;
++  char *lease_file;
+   char *username, *groupname, *scriptuser;
+   char *luascript;
+   char *authserver, *hostmaster;
+diff --git a/src/option.c b/src/option.c
+index ecc2619..746cd11 100644
+--- a/src/option.c
++++ b/src/option.c
+@@ -445,7 +445,7 @@ static struct {
+   { LOPT_PXE_SERV, ARG_DUP, "<service>", gettext_noop("Boot service for PXE menu."), NULL },
+   { LOPT_TEST, 0, NULL, gettext_noop("Check configuration syntax."), NULL },
+   { LOPT_ADD_MAC, OPT_ADD_MAC, NULL, gettext_noop("Add requestor's MAC address to forwarded DNS queries."), NULL },
+-  { LOPT_ADD_SBNET, ARG_ONE, "<v4 pref>[,<v6 pref>]", gettext_noop("Add requestor's IP subnet to forwarded DNS queries."), NULL },
++  { LOPT_ADD_SBNET, ARG_ONE, "<v4 pref>[,<v6 pref>]", gettext_noop("Add specified IP subnet to forwarded DNS queries."), NULL },
+   { LOPT_DNSSEC, OPT_DNSSEC_PROXY, NULL, gettext_noop("Proxy DNSSEC validation results from upstream nameservers."), NULL },
+   { LOPT_INCR_ADDR, OPT_CONSEC_ADDR, NULL, gettext_noop("Attempt to allocate sequential IP addresses to DHCP clients."), NULL },
+   { LOPT_CONNTRACK, OPT_CONNTRACK, NULL, gettext_noop("Copy connection-track mark from queries to upstream connections."), NULL },
+@@ -722,6 +722,20 @@ static void do_usage(void)
+ 
+ #define ret_err(x) do { strcpy(errstr, (x)); return 0; } while (0)
+ 
++static char *parse_mysockaddr(char *arg, union mysockaddr *addr) 
++{
++  if (inet_pton(AF_INET, arg, &addr->in.sin_addr) > 0)
++    addr->sa.sa_family = AF_INET;
++#ifdef HAVE_IPV6
++  else if (inet_pton(AF_INET6, arg, &addr->in6.sin6_addr) > 0)
++    addr->sa.sa_family = AF_INET6;
++#endif
++  else
++    return _("bad address");
++   
++  return NULL;
++}
++
+ char *parse_server(char *arg, union mysockaddr *addr, union mysockaddr *source_addr, char *interface, int *flags)
+ {
+   int source_port = 0, serv_port = NAMESERVER_PORT;
+@@ -1585,7 +1599,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+ 	    li = match_suffix->next;
+ 	    free(match_suffix->suffix);
+ 	    free(match_suffix);
+-	  }    
++	  }
+ 	break;
+       }
+ 
+@@ -1593,10 +1607,45 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+       set_option_bool(OPT_CLIENT_SUBNET);
+       if (arg)
+ 	{
++          char *err, *end;
+ 	  comma = split(arg);
+-	  if (!atoi_check(arg, &daemon->addr4_netmask) || 
+-	      (comma && !atoi_check(comma, &daemon->addr6_netmask)))
+-	     ret_err(gen_err);
++
++          struct mysubnet* new = opt_malloc(sizeof(struct mysubnet));
++          if ((end = split_chr(arg, '/')))
++	    {
++	      /* has subnet+len */
++	      err = parse_mysockaddr(arg, &new->addr);
++	      if (err)
++		ret_err(err);
++	      if (!atoi_check(end, &new->mask))
++		ret_err(gen_err);
++	      new->addr_used = 1;
++	    } 
++	  else if (!atoi_check(arg, &new->mask))
++	    ret_err(gen_err);
++	    
++          daemon->add_subnet4 = new;
++
++          new = opt_malloc(sizeof(struct mysubnet));
++          if (comma)
++            {
++              if ((end = split_chr(comma, '/')))
++                {
++                  /* has subnet+len */
++                  err = parse_mysockaddr(comma, &new->addr);
++                  if (err)
++                    ret_err(err);
++                  if (!atoi_check(end, &new->mask))
++                    ret_err(gen_err);
++                  new->addr_used = 1;
++                }
++              else
++                {
++                  if (!atoi_check(comma, &new->mask))
++                    ret_err(gen_err);
++                }
++            }
++          daemon->add_subnet6 = new;
+ 	}
+       break;
+ 
+diff --git a/src/rfc1035.c b/src/rfc1035.c
+index 29e9e65..6a51b30 100644
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -629,26 +629,47 @@ struct subnet_opt {
+ #endif
+ };
+ 
++static void *get_addrp(union mysockaddr *addr, const short family) 
++{
++#ifdef HAVE_IPV6
++  if (family == AF_INET6)
++    return &addr->in6.sin6_addr;
++#endif
++
++  return &addr->in.sin_addr;
++}
++
+ static size_t calc_subnet_opt(struct subnet_opt *opt, union mysockaddr *source)
+ {
+   /* http://tools.ietf.org/html/draft-vandergaast-edns-client-subnet-02 */
+   
+   int len;
+   void *addrp;
++  int sa_family = source->sa.sa_family;
+ 
+ #ifdef HAVE_IPV6
+   if (source->sa.sa_family == AF_INET6)
+     {
+-      opt->family = htons(2);
+-      opt->source_netmask = daemon->addr6_netmask;
+-      addrp = &source->in6.sin6_addr;
++      opt->source_netmask = daemon->add_subnet6->mask;
++      if (daemon->add_subnet6->addr_used) 
++	{
++	  sa_family = daemon->add_subnet6->addr.sa.sa_family;
++	  addrp = get_addrp(&daemon->add_subnet6->addr, sa_family);
++	} 
++      else 
++	addrp = &source->in6.sin6_addr;
+     }
+   else
+ #endif
+     {
+-      opt->family = htons(1);
+-      opt->source_netmask = daemon->addr4_netmask;
+-      addrp = &source->in.sin_addr;
++      opt->source_netmask = daemon->add_subnet4->mask;
++      if (daemon->add_subnet4->addr_used)
++	{
++	  sa_family = daemon->add_subnet4->addr.sa.sa_family;
++	  addrp = get_addrp(&daemon->add_subnet4->addr, sa_family);
++	} 
++      else 
++	addrp = &source->in.sin_addr;
+     }
+   
+   opt->scope_netmask = 0;
+@@ -656,6 +677,11 @@ static size_t calc_subnet_opt(struct subnet_opt *opt, union mysockaddr *source)
+   
+   if (opt->source_netmask != 0)
+     {
++#ifdef HAVE_IPV6
++      opt->family = htons(sa_family == AF_INET6 ? 2 : 1);
++#else
++      opt->family = htons(1);
++#endif
+       len = ((opt->source_netmask - 1) >> 3) + 1;
+       memcpy(opt->addr, addrp, len);
+       if (opt->source_netmask & 7)
+@@ -2335,4 +2361,3 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
+   
+   return len;
+ }
+-
+-- 
+1.7.10.4
diff --git a/src/patches/dnsmasq/0020-Initialise-return-value.patch b/src/patches/dnsmasq/0020-Initialise-return-value.patch
deleted file mode 100644
index 2f70ee5873..0000000000
--- a/src/patches/dnsmasq/0020-Initialise-return-value.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 83d2ed09fc0216b567d7fb2197e4ff3eae150b0d Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 23 Dec 2014 18:42:38 +0000
-Subject: [PATCH 20/55] Initialise return value.
-
----
- src/dnssec.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 9350d3e8c963..ed8cf893bad2 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -637,10 +637,13 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
-   struct crec *crecp = NULL;
-   int type_covered, algo, labels, orig_ttl, sig_expiration, sig_inception, key_tag;
-   u16 *rr_desc = get_desc(type);
--
-+ 
-+  if (wildcard_out)
-+    *wildcard_out = NULL;
-+  
-   if (!(p = skip_questions(header, plen)))
-     return STAT_BOGUS;
--
-+  
-   name_labels = count_labels(name); /* For 4035 5.3.2 check */
- 
-   /* look for RRSIGs for this RRset and get pointers to each RR in the set. */
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0021-Add-ignore-address-option.patch b/src/patches/dnsmasq/0021-Add-ignore-address-option.patch
deleted file mode 100644
index 6c88f2d188..0000000000
--- a/src/patches/dnsmasq/0021-Add-ignore-address-option.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-From 32fc6dbe03569d70dd394420ceb73532cf303c33 Mon Sep 17 00:00:00 2001
-From: Glen Huang <curvedmark@gmail.com>
-Date: Sat, 27 Dec 2014 15:28:12 +0000
-Subject: [PATCH 21/55] Add --ignore-address option.
-
----
- CHANGELOG     |  8 ++++++++
- man/dnsmasq.8 |  6 ++++++
- src/dnsmasq.h |  3 ++-
- src/forward.c |  4 ++++
- src/option.c  | 18 +++++++++++++++---
- src/rfc1035.c | 37 +++++++++++++++++++++++++++++++++++++
- 6 files changed, 72 insertions(+), 4 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 956b71a151db..2b6356bcfb02 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -22,6 +22,14 @@ version 2.73
- 
- 	    Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
- 	    for the bug report.
-+	    
-+	    Add --ignore-address option. Ignore replies to A-record 
-+	    queries which include the specified address. No error is
-+	    generated, dnsmasq simply continues to listen for another 
-+	    reply. This is useful to defeat blocking strategies which
-+	    rely on quickly supplying a forged answer to a DNS 
-+	    request for certain domains, before the correct answer can
-+            arrive. Thanks to Glen Huang for the patch.
- 	
- 
- version 2.72
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 0b8e04f0a897..4236ba307df3 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -293,6 +293,12 @@ an advertising web page in response to queries for unregistered names,
- instead of the correct NXDOMAIN response. This option tells dnsmasq to
- fake the correct response when it sees this behaviour. As at Sept 2003
- the IP address being returned by Verisign is 64.94.110.11
-+.TP 
-+.B \-B, --ignore-address=<ipaddr>
-+Ignore replies to A-record queries which include the specified address. 
-+No error is generated, dnsmasq simply continues to listen for another reply. 
-+This is useful to defeat blocking strategies which rely on quickly supplying a
-+forged answer to a DNS request for certain domain, before the correct answer can arrive.
- .TP
- .B \-f, --filterwin2k
- Later versions of windows make periodic DNS requests which don't get sensible answers from
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 1dd61c5edba3..7bc982ddf73c 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -930,7 +930,7 @@ extern struct daemon {
-   char *runfile; 
-   char *lease_change_command;
-   struct iname *if_names, *if_addrs, *if_except, *dhcp_except, *auth_peers, *tftp_interfaces;
--  struct bogus_addr *bogus_addr;
-+  struct bogus_addr *bogus_addr, *ignore_addr;
-   struct server *servers;
-   struct ipsets *ipsets;
-   int log_fac; /* log facility */
-@@ -1093,6 +1093,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
- 		      time_t now, int *ad_reqd, int *do_bit);
- int check_for_bogus_wildcard(struct dns_header *header, size_t qlen, char *name, 
- 			     struct bogus_addr *addr, time_t now);
-+int check_for_ignored_address(struct dns_header *header, size_t qlen, struct bogus_addr *baddr);
- unsigned char *find_pseudoheader(struct dns_header *header, size_t plen,
- 				 size_t *len, unsigned char **p, int *is_sign);
- int check_for_local_domain(char *name, time_t now);
-diff --git a/src/forward.c b/src/forward.c
-index 408a179a20f4..f28c7d51f708 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -724,6 +724,10 @@ void reply_query(int fd, int family, time_t now)
-   if (!(forward = lookup_frec(ntohs(header->id), hash)))
-     return;
-   
-+  if (daemon->ignore_addr && RCODE(header) == NOERROR &&
-+      check_for_ignored_address(header, n, daemon->ignore_addr))
-+    return;
-+
-   if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
-       !option_bool(OPT_ORDER) &&
-       forward->forwardall == 0)
-diff --git a/src/option.c b/src/option.c
-index 209fa6976609..907d0cf88de9 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -147,6 +147,7 @@ struct myoption {
- #define LOPT_LOCAL_SERVICE 335
- #define LOPT_DNSSEC_TIME   336
- #define LOPT_LOOP_DETECT   337
-+#define LOPT_IGNORE_ADDR   338
- 
- #ifdef HAVE_GETOPT_LONG
- static const struct option opts[] =  
-@@ -181,6 +182,7 @@ static const struct myoption opts[] =
-     { "local-service", 0, 0, LOPT_LOCAL_SERVICE },
-     { "bogus-priv", 0, 0, 'b' },
-     { "bogus-nxdomain", 1, 0, 'B' },
-+    { "ignore-address", 1, 0, LOPT_IGNORE_ADDR },
-     { "selfmx", 0, 0, 'e' },
-     { "filterwin2k", 0, 0, 'f' },
-     { "pid-file", 2, 0, 'x' },
-@@ -457,6 +459,7 @@ static struct {
-   { LOPT_QUIET_RA, OPT_QUIET_RA, NULL, gettext_noop("Do not log RA."), NULL },
-   { LOPT_LOCAL_SERVICE, OPT_LOCAL_SERVICE, NULL, gettext_noop("Accept queries only from directly-connected networks"), NULL },
-   { LOPT_LOOP_DETECT, OPT_LOOP_DETECT, NULL, gettext_noop("Detect and remove DNS forwarding loops"), NULL },
-+  { LOPT_IGNORE_ADDR, ARG_DUP, "<ipaddr>", gettext_noop("Ignore DNS responses containing ipaddr."), NULL }, 
-   { 0, 0, NULL, NULL, NULL }
- }; 
- 
-@@ -2119,14 +2122,23 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
-       break;
-       
-     case 'B':  /* --bogus-nxdomain */
--      {
-+    case LOPT_IGNORE_ADDR: /* --ignore-address */
-+     {
- 	struct in_addr addr;
- 	unhide_metas(arg);
- 	if (arg && (inet_pton(AF_INET, arg, &addr) > 0))
- 	  {
- 	    struct bogus_addr *baddr = opt_malloc(sizeof(struct bogus_addr));
--	    baddr->next = daemon->bogus_addr;
--	    daemon->bogus_addr = baddr;
-+	    if (option == 'B')
-+	      {
-+		baddr->next = daemon->bogus_addr;
-+		daemon->bogus_addr = baddr;
-+	      }
-+	    else
-+	      {
-+		baddr->next = daemon->ignore_addr;
-+		daemon->ignore_addr = baddr;
-+	      }
- 	    baddr->addr = addr;
- 	  }
- 	else
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index bdeb3fb10e68..75c4266b47dd 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1328,6 +1328,43 @@ int check_for_bogus_wildcard(struct dns_header *header, size_t qlen, char *name,
-   return 0;
- }
- 
-+int check_for_ignored_address(struct dns_header *header, size_t qlen, struct bogus_addr *baddr)
-+{
-+  unsigned char *p;
-+  int i, qtype, qclass, rdlen;
-+  struct bogus_addr *baddrp;
-+
-+  /* skip over questions */
-+  if (!(p = skip_questions(header, qlen)))
-+    return 0; /* bad packet */
-+
-+  for (i = ntohs(header->ancount); i != 0; i--)
-+    {
-+      if (!(p = skip_name(p, header, qlen, 10)))
-+	return 0; /* bad packet */
-+      
-+      GETSHORT(qtype, p); 
-+      GETSHORT(qclass, p);
-+      p += 4; /* TTL */
-+      GETSHORT(rdlen, p);
-+      
-+      if (qclass == C_IN && qtype == T_A)
-+	{
-+	  if (!CHECK_LEN(header, p, qlen, INADDRSZ))
-+	    return 0;
-+	  
-+	  for (baddrp = baddr; baddrp; baddrp = baddrp->next)
-+	    if (memcmp(&baddrp->addr, p, INADDRSZ) == 0)
-+	      return 1;
-+	}
-+      
-+      if (!ADD_RDLEN(header, p, qlen, rdlen))
-+	return 0;
-+    }
-+  
-+  return 0;
-+}
-+
- int add_resource_record(struct dns_header *header, char *limit, int *truncp, int nameoffset, unsigned char **pp, 
- 			unsigned long ttl, int *offset, unsigned short type, unsigned short class, char *format, ...)
- {
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0022-Bad-packet-protection.patch b/src/patches/dnsmasq/0022-Bad-packet-protection.patch
deleted file mode 100644
index 1b37202c46..0000000000
--- a/src/patches/dnsmasq/0022-Bad-packet-protection.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 0b1008d367d44e77352134a4c5178f896f0db3e7 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 27 Dec 2014 15:33:32 +0000
-Subject: [PATCH 22/55] Bad packet protection.
-
----
- src/dnssec.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/dnssec.c b/src/dnssec.c
-index ed8cf893bad2..026794b077e5 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -805,7 +805,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
- 		{
- 		  while (*name_start != '.' && *name_start != 0)
- 		    name_start++;
--		  if (k != 1)
-+		  if (k != 1 && *name_start == '.')
- 		    name_start++;
- 		}
- 	      
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch b/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch
deleted file mode 100644
index 3bc3f79267..0000000000
--- a/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From d310ab7ecbffce79d3d90debba621e0222f9bced Mon Sep 17 00:00:00 2001
-From: Matthias Andree <matthias.andree@gmx.de>
-Date: Sat, 27 Dec 2014 15:36:38 +0000
-Subject: [PATCH 23/55] Fix build failure in new inotify code on BSD.
-
----
- src/inotify.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/inotify.c b/src/inotify.c
-index 960bf5efb41f..83730008c11b 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -15,10 +15,10 @@
- */
- 
- #include "dnsmasq.h"
--#include <sys/inotify.h>
--
- #ifdef HAVE_LINUX_NETWORK
- 
-+#include <sys/inotify.h>
-+
- /* the strategy is to set a inotify on the directories containing
-    resolv files, for any files in the directory which are close-write 
-    or moved into the directory.
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch b/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch
deleted file mode 100644
index e3074fa3e1..0000000000
--- a/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 81c538efcebfce2ce4a1d3a420b6c885b8f08df9 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Sat, 3 Jan 2015 16:36:14 +0000
-Subject: [PATCH 24/55] Implement makefile dependencies on COPTS variable.
-
----
- .gitignore |  2 +-
- Makefile   | 10 ++++++----
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/.gitignore b/.gitignore
-index fcdbcbd135ae..23f11488ab4c 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -3,7 +3,7 @@ src/*.mo
- src/dnsmasq.pot
- src/dnsmasq
- src/dnsmasq_baseline
--src/.configured
-+src/.copts_*
- contrib/wrt/dhcp_lease_time
- contrib/wrt/dhcp_release
- debian/base/
-diff --git a/Makefile b/Makefile
-index c340f1c7b59a..5675f60c2036 100644
---- a/Makefile
-+++ b/Makefile
-@@ -64,6 +64,8 @@ nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG
- gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
- sunos_libs =    `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi`
- version =     -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
-+copts_conf = .copts_$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | \
-+			( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ')
- 
- objs = cache.o rfc1035.o util.o option.o forward.o network.o \
-        dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
-@@ -83,7 +85,7 @@ all : $(BUILDDIR)
- 
- mostly_clean :
- 	rm -f $(BUILDDIR)/*.mo $(BUILDDIR)/*.pot 
--	rm -f $(BUILDDIR)/.configured $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq 
-+	rm -f $(BUILDDIR)/.copts_* $(BUILDDIR)/*.o $(BUILDDIR)/dnsmasq.a $(BUILDDIR)/dnsmasq
- 
- clean : mostly_clean
- 	rm -f $(BUILDDIR)/dnsmasq_baseline
-@@ -139,8 +141,8 @@ bloatcheck : $(BUILDDIR)/dnsmasq_baseline mostly_clean all
- 
- # rules below are targets in recusive makes with cwd=$(BUILDDIR)
- 
--.configured: $(hdrs)
--	@rm -f *.o
-+$(copts_conf): $(hdrs)
-+	@rm -f *.o .copts_*
- 	@touch $@
- 
- $(objs:.o=.c) $(hdrs):
-@@ -149,7 +151,7 @@ $(objs:.o=.c) $(hdrs):
- .c.o:
- 	$(CC) $(CFLAGS) $(COPTS) $(i18n) $(build_cflags) $(RPM_OPT_FLAGS) -c $<	
- 
--dnsmasq : .configured $(hdrs) $(objs)
-+dnsmasq : $(copts_conf) $(hdrs) $(objs)
- 	$(CC) $(LDFLAGS) -o $@ $(objs) $(build_libs) $(LIBS) 
- 
- dnsmasq.pot : $(objs:.o=.c) $(hdrs)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch b/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch
deleted file mode 100644
index b1c42aef41..0000000000
--- a/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From d8dbd903d024f84a149dac2f8a674a68dfed47a3 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Mon, 5 Jan 2015 17:03:35 +0000
-Subject: [PATCH 25/55] Fix race condition issue in makefile.
-
----
- Makefile | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile b/Makefile
-index 5675f60c2036..bcbd5571671d 100644
---- a/Makefile
-+++ b/Makefile
-@@ -148,10 +148,12 @@ $(copts_conf): $(hdrs)
- $(objs:.o=.c) $(hdrs):
- 	ln -s $(top)/$(SRC)/$@ .
- 
-+$(objs): $(copts_conf) $(hdrs)
-+
- .c.o:
- 	$(CC) $(CFLAGS) $(COPTS) $(i18n) $(build_cflags) $(RPM_OPT_FLAGS) -c $<	
- 
--dnsmasq : $(copts_conf) $(hdrs) $(objs)
-+dnsmasq : $(objs)
- 	$(CC) $(LDFLAGS) -o $@ $(objs) $(build_libs) $(LIBS) 
- 
- dnsmasq.pot : $(objs:.o=.c) $(hdrs)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch b/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch
deleted file mode 100644
index 7f01ee73e9..0000000000
--- a/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch
+++ /dev/null
@@ -1,792 +0,0 @@
-From 97e618a0e3f29465acc689d87288596b006f197e Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 7 Jan 2015 21:55:43 +0000
-Subject: [PATCH 26/55] DNSSEC: do top-down search for limit of secure
- delegation.
-
----
- CHANGELOG     |   9 ++
- src/dnsmasq.h |  11 +-
- src/dnssec.c  |  91 +++++++++-------
- src/forward.c | 327 +++++++++++++++++++++++++++++++++-------------------------
- 4 files changed, 260 insertions(+), 178 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 2b6356bcfb02..e8bf80f81baa 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -31,7 +31,16 @@ version 2.73
- 	    request for certain domains, before the correct answer can
-             arrive. Thanks to Glen Huang for the patch.
- 	
-+	    Revisit the part of DNSSEC validation which determines if an 
-+	    unsigned answer is legit, or is in some part of the DNS 
-+	    tree which should be signed. Dnsmasq now works from the 
-+	    DNS root downward looking for the limit of signed 
-+	    delegations, rather than working bottom up. This is 
-+	    both more correct, and less likely to trip over broken 
-+	    nameservers in the unsigned parts of the DNS tree 
-+	    which don't respond well to DNSSEC queries.
- 
-+	
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
- 
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 7bc982ddf73c..2f4597294a56 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -569,8 +569,9 @@ struct hostsfile {
- #define STAT_SECURE_WILDCARD    7
- #define STAT_NO_SIG             8
- #define STAT_NO_DS              9
--#define STAT_NEED_DS_NEG       10
--#define STAT_CHASE_CNAME       11
-+#define STAT_NO_NS             10
-+#define STAT_NEED_DS_NEG       11
-+#define STAT_CHASE_CNAME       12
- 
- #define FREC_NOREBIND           1
- #define FREC_CHECKING_DISABLED  2
-@@ -604,7 +605,9 @@ struct frec {
- #ifdef HAVE_DNSSEC 
-   int class, work_counter;
-   struct blockdata *stash; /* Saved reply, whilst we validate */
--  size_t stash_len;
-+  struct blockdata *orig_domain; /* domain of original query, whilst
-+				    we're seeing is if in unsigned domain */
-+  size_t stash_len, name_start, name_len;
-   struct frec *dependent; /* Query awaiting internally-generated DNSKEY or DS query */
-   struct frec *blocking_query; /* Query which is blocking us. */
- #endif
-@@ -1126,7 +1129,7 @@ int in_zone(struct auth_zone *zone, char *name, char **cut);
- size_t dnssec_generate_query(struct dns_header *header, char *end, char *name, int class, int type, union mysockaddr *addr);
- int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t n, char *name, char *keyname, int class);
- int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
--int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class, int *neganswer);
-+int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class, int *neganswer, int *nons);
- int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
- int dnskey_keytag(int alg, int flags, unsigned char *rdata, int rdlen);
- size_t filter_rrsigs(struct dns_header *header, size_t plen);
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 026794b077e5..8f27677628b2 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -875,8 +875,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
- /* The DNS packet is expected to contain the answer to a DNSKEY query.
-    Put all DNSKEYs in the answer which are valid into the cache.
-    return codes:
--         STAT_INSECURE No DNSKEYs in reply.
--	 STAT_SECURE   At least one valid DNSKEY found and in cache.
-+         STAT_SECURE   At least one valid DNSKEY found and in cache.
- 	 STAT_BOGUS    No DNSKEYs found, which  can be validated with DS,
- 	               or self-sign for DNSKEY RRset is not valid, bad packet.
- 	 STAT_NEED_DS  DS records to validate a key not found, name in keyname 
-@@ -896,11 +895,8 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
-   GETSHORT(qtype, p);
-   GETSHORT(qclass, p);
-   
--  if (qtype != T_DNSKEY || qclass != class)
-+  if (qtype != T_DNSKEY || qclass != class || ntohs(header->ancount) == 0)
-     return STAT_BOGUS;
--  
--  if (ntohs(header->ancount) == 0)
--    return STAT_INSECURE;
- 
-   /* See if we have cached a DS record which validates this key */
-   if (!(crecp = cache_find_by_name(NULL, name, now, F_DS)))
-@@ -1103,17 +1099,17 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
- /* The DNS packet is expected to contain the answer to a DS query
-    Put all DSs in the answer which are valid into the cache.
-    return codes:
--   STAT_INSECURE    no DS in reply or not signed.
-    STAT_SECURE      At least one valid DS found and in cache.
-    STAT_NO_DS       It's proved there's no DS here.
--   STAT_BOGUS       At least one DS found, which fails validation, bad packet.
-+   STAT_NO_NS       It's proved there's no DS _or_ NS here.
-+   STAT_BOGUS       no DS in reply or not signed, fails validation, bad packet.
-    STAT_NEED_DNSKEY DNSKEY records to validate a DS not found, name in keyname
- */
- 
- int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
- {
-   unsigned char *p = (unsigned char *)(header+1);
--  int qtype, qclass, val, i, neganswer;
-+  int qtype, qclass, val, i, neganswer, nons;
- 
-   if (ntohs(header->qdcount) != 1 ||
-       !(p = skip_name(p, header, plen, 4)))
-@@ -1125,32 +1121,39 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
-   if (qtype != T_DS || qclass != class)
-     val = STAT_BOGUS;
-   else
--    val = dnssec_validate_reply(now, header, plen, name, keyname, NULL, &neganswer);
--
--  if (val == STAT_NO_SIG)
--    val = STAT_INSECURE;
-+    val = dnssec_validate_reply(now, header, plen, name, keyname, NULL, &neganswer, &nons);
-+  /* Note dnssec_validate_reply() will have cached positive answers */
-+  
-+  if (val == STAT_NO_SIG || val == STAT_INSECURE)
-+    val = STAT_BOGUS;
-   
-   p = (unsigned char *)(header+1);
-   extract_name(header, plen, &p, name, 1, 4);
-   p += 4; /* qtype, qclass */
-   
-   if (!(p = skip_section(p, ntohs(header->ancount), header, plen)))
--    return STAT_BOGUS;
-+    val = STAT_BOGUS;
-   
-   if (val == STAT_BOGUS)
--    log_query(F_UPSTREAM, name, NULL, "BOGUS DS");
--  
--  if ((val == STAT_SECURE || val == STAT_INSECURE) && neganswer)
-     {
--      int rdlen, flags = F_FORWARD | F_DS | F_NEG;
-+      log_query(F_UPSTREAM, name, NULL, "BOGUS DS");
-+      return STAT_BOGUS;
-+    }
-+
-+  /* By here, the answer is proved secure, and a positive answer has been cached. */
-+  if (val == STAT_SECURE && neganswer)
-+    {
-+      int rdlen, flags = F_FORWARD | F_DS | F_NEG | F_DNSSECOK;
-       unsigned long ttl, minttl = ULONG_MAX;
-       struct all_addr a;
- 
-       if (RCODE(header) == NXDOMAIN)
- 	flags |= F_NXDOMAIN;
-       
--      if (val == STAT_SECURE)
--	flags |= F_DNSSECOK;
-+      /* We only cache validated DS records, DNSSECOK flag hijacked 
-+	 to store presence/absence of NS. */
-+      if (nons)
-+	flags &= ~F_DNSSECOK;
-       
-       for (i = ntohs(header->nscount); i != 0; i--)
- 	{
-@@ -1196,10 +1199,12 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
- 	  a.addr.dnssec.class = class;
- 	  cache_insert(name, &a, now, ttl, flags);
- 	  
--	  cache_end_insert(); 
-+	  cache_end_insert();  
-+	  
-+	  log_query(F_UPSTREAM, name, NULL, nons ? "no delegation" : "no DS");
- 	}
- 
--      return (val == STAT_SECURE) ? STAT_NO_DS : STAT_INSECURE; 
-+      return nons ? STAT_NO_NS : STAT_NO_DS; 
-     }
- 
-   return val;
-@@ -1323,12 +1328,15 @@ static int find_nsec_records(struct dns_header *header, size_t plen, unsigned ch
- }
- 
- static int prove_non_existence_nsec(struct dns_header *header, size_t plen, unsigned char **nsecs, int nsec_count,
--				    char *workspace1, char *workspace2, char *name, int type)
-+				    char *workspace1, char *workspace2, char *name, int type, int *nons)
- {
-   int i, rc, rdlen;
-   unsigned char *p, *psave;
-   int offset = (type & 0xff) >> 3;
-   int mask = 0x80 >> (type & 0x07);
-+
-+  if (nons)
-+    *nons = 0;
-   
-   /* Find NSEC record that proves name doesn't exist */
-   for (i = 0; i < nsec_count; i++)
-@@ -1355,6 +1363,10 @@ static int prove_non_existence_nsec(struct dns_header *header, size_t plen, unsi
- 	  rdlen -= p - psave;
- 	  /* rdlen is now length of type map, and p points to it */
- 	  
-+	  /* If we can prove that there's no NS record, return that information. */
-+	  if (nons && rdlen >= 2 && p[0] == 0 && (p[2] & (0x80 >> T_NS)) == 0)
-+	    *nons = 1;
-+	  
- 	  while (rdlen >= 2)
- 	    {
- 	      if (!CHECK_LEN(header, p, plen, rdlen))
-@@ -1456,7 +1468,7 @@ static int base32_decode(char *in, unsigned char *out)
- }
- 
- static int check_nsec3_coverage(struct dns_header *header, size_t plen, int digest_len, unsigned char *digest, int type,
--				char *workspace1, char *workspace2, unsigned char **nsecs, int nsec_count)
-+				char *workspace1, char *workspace2, unsigned char **nsecs, int nsec_count, int *nons)
- {
-   int i, hash_len, salt_len, base32_len, rdlen;
-   unsigned char *p, *psave;
-@@ -1497,6 +1509,10 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige
- 		if (!CHECK_LEN(header, p, plen, rdlen))
- 		  return 0;
- 		
-+		/* If we can prove that there's no NS record, return that information. */
-+		if (nons && rdlen >= 2 && p[0] == 0 && (p[2] & (0x80 >> T_NS)) == 0)
-+		  *nons = 1;
-+		
- 		while (rdlen >= 2)
- 		  {
- 		    if (p[0] == type >> 8)
-@@ -1533,13 +1549,16 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige
- }
- 
- static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, unsigned char **nsecs, int nsec_count,
--				     char *workspace1, char *workspace2, char *name, int type, char *wildname)
-+				     char *workspace1, char *workspace2, char *name, int type, char *wildname, int *nons)
- {
-   unsigned char *salt, *p, *digest;
-   int digest_len, i, iterations, salt_len, base32_len, algo = 0;
-   struct nettle_hash const *hash;
-   char *closest_encloser, *next_closest, *wildcard;
-- 
-+  
-+  if (nons)
-+    *nons = 0;
-+  
-   /* Look though the NSEC3 records to find the first one with 
-      an algorithm we support (currently only algo == 1).
- 
-@@ -1612,7 +1631,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-   if ((digest_len = hash_name(name, &digest, hash, salt, salt_len, iterations)) == 0)
-     return STAT_BOGUS;
-   
--  if (check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-+  if (check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count, nons))
-     return STAT_SECURE;
- 
-   /* Can't find an NSEC3 which covers the name directly, we need the "closest encloser NSEC3" 
-@@ -1657,7 +1676,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-   if ((digest_len = hash_name(next_closest, &digest, hash, salt, salt_len, iterations)) == 0)
-     return STAT_BOGUS;
- 
--  if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-+  if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count, NULL))
-     return STAT_BOGUS;
-   
-   /* Finally, check that there's no seat of wildcard synthesis */
-@@ -1672,7 +1691,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-       if ((digest_len = hash_name(wildcard, &digest, hash, salt, salt_len, iterations)) == 0)
- 	return STAT_BOGUS;
-       
--      if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count))
-+      if (!check_nsec3_coverage(header, plen, digest_len, digest, type, workspace1, workspace2, nsecs, nsec_count, NULL))
- 	return STAT_BOGUS;
-     }
-   
-@@ -1681,7 +1700,8 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
-     
- /* Validate all the RRsets in the answer and authority sections of the reply (4035:3.2.3) */
- /* Returns are the same as validate_rrset, plus the class if the missing key is in *class */
--int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class, int *neganswer)
-+int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, 
-+			  int *class, int *neganswer, int *nons)
- {
-   unsigned char *ans_start, *qname, *p1, *p2, **nsecs;
-   int type1, class1, rdlen1, type2, class2, rdlen2, qclass, qtype;
-@@ -1811,10 +1831,11 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 		    return STAT_BOGUS; /* No NSECs or bad packet */
- 		  
- 		  if (nsec_type == T_NSEC)
--		    rc = prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1);
-+		    rc = prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1, NULL);
- 		  else
--		    rc = prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, type1, wildname);
--
-+		    rc = prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, 
-+						   keyname, name, type1, wildname, NULL);
-+		  
- 		  if (rc != STAT_SECURE)
- 		    return rc;
- 		} 
-@@ -1937,9 +1958,9 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
-     return STAT_BOGUS;
-   
-   if (nsec_type == T_NSEC)
--    return prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype);
-+    return prove_non_existence_nsec(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype, nons);
-   else
--    return prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype, NULL);
-+    return prove_non_existence_nsec3(header, plen, nsecs, nsec_count, daemon->workspacename, keyname, name, qtype, NULL, nons);
- }
- 
- /* Chase the CNAME chain in the packet until the first record which _doesn't validate.
-diff --git a/src/forward.c b/src/forward.c
-index f28c7d51f708..ee8d7b52d5e5 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -26,8 +26,9 @@ static void free_frec(struct frec *f);
- #ifdef HAVE_DNSSEC
- static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n, 
- 			   int class, char *name, char *keyname, struct server *server, int *keycount);
--static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
--static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
-+static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname);
-+static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen, 
-+			   char *name, char *keyname);
- #endif
- 
- 
-@@ -815,18 +816,22 @@ void reply_query(int fd, int family, time_t now)
- 	  else if (forward->flags & FREC_DS_QUERY)
- 	    {
- 	      status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
--	      if (status == STAT_NO_DS)
--		status = STAT_INSECURE;
-+	      if (status == STAT_NO_DS || status == STAT_NO_NS)
-+		status = STAT_BOGUS;
- 	    }
- 	  else if (forward->flags & FREC_CHECK_NOSIGN)
--	    status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
-+	    {
-+	      status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
-+	      if (status != STAT_NEED_KEY)
-+		status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
-+	    }
- 	  else
- 	    {
--	      status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
-+	      status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
- 	      if (status == STAT_NO_SIG)
- 		{
- 		  if (option_bool(OPT_DNSSEC_NO_SIGN))
--		    status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
-+		    status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
- 		  else
- 		    status = STAT_INSECURE;
- 		}
-@@ -861,6 +866,7 @@ void reply_query(int fd, int family, time_t now)
- 		  new->blocking_query = NULL;
- 		  new->sentto = server;
- 		  new->rfd4 = NULL;
-+		  new->orig_domain = NULL;
- #ifdef HAVE_IPV6
- 		  new->rfd6 = NULL;
- #endif
-@@ -889,7 +895,9 @@ void reply_query(int fd, int family, time_t now)
- 		  new->new_id = get_id();
- 		  header->id = htons(new->new_id);
- 		  /* Save query for retransmission */
--		  new->stash = blockdata_alloc((char *)header, nn);
-+		  if (!(new->stash = blockdata_alloc((char *)header, nn)))
-+		    return;
-+		      
- 		  new->stash_len = nn;
- 		  
- 		  /* Don't resend this. */
-@@ -946,18 +954,22 @@ void reply_query(int fd, int family, time_t now)
- 		  else if (forward->flags & FREC_DS_QUERY)
- 		    {
- 		      status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
--		      if (status == STAT_NO_DS)
--			status = STAT_INSECURE;
-+		      if (status == STAT_NO_DS || status == STAT_NO_NS)
-+			status = STAT_BOGUS;
- 		    }
- 		  else if (forward->flags & FREC_CHECK_NOSIGN)
--		    status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
-+		    {
-+		      status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
-+		      if (status != STAT_NEED_KEY)
-+			status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
-+		    }
- 		  else
- 		    {
--		      status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);	
-+		      status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);	
- 		      if (status == STAT_NO_SIG)
- 			{
- 			  if (option_bool(OPT_DNSSEC_NO_SIGN))
--			    status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
-+			    status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
- 			  else
- 			    status = STAT_INSECURE;
- 			}
-@@ -1319,70 +1331,80 @@ void receive_query(struct listener *listen, time_t now)
- /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
-    and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or 
-    STAT_NEED_DS_NEG and keyname if we need to do the query. */
--static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
-+static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen, 
-+			   char *name, char *keyname)
- {
--  struct crec *crecp;
--  char *name_start = name;
-   int status = dnssec_chase_cname(now, header, plen, name, keyname);
-   
-   if (status != STAT_INSECURE)
-     return status;
- 
-+  /* Store the domain we're trying to check. */
-+  forward->name_start = strlen(name);
-+  forward->name_len = forward->name_start + 1;
-+  if (!(forward->orig_domain = blockdata_alloc(name, forward->name_len)))
-+    return STAT_BOGUS;
-+  
-+  return do_check_sign(forward, 0, now, name, keyname);
-+}
-+ 
-+/* We either have a a reply (header non-NULL, or we need to start by looking in the cache */ 
-+static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname)
-+{
-+  /* get domain we're checking back from blockdata store, it's stored on the original query. */
-+  while (forward->dependent)
-+    forward = forward->dependent;
-+
-+  blockdata_retrieve(forward->orig_domain, forward->name_len, name);
-+  
-   while (1)
-     {
--      crecp = cache_find_by_name(NULL, name_start, now, F_DS);
--      
--      if (crecp && (crecp->flags & F_DNSSECOK))
--	return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
--       
--      if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
-+      char *p; 
-+
-+      if (status == 0)
- 	{
--	  name_start++; /* chop a label off and try again */
--	  continue;
-+	  struct crec *crecp;
-+
-+	  /* Haven't received answer, see if in cache */
-+	  if (!(crecp = cache_find_by_name(NULL, &name[forward->name_start], now, F_DS)))
-+	    {
-+	      /* put name of DS record we're missing into keyname */
-+	      strcpy(keyname, &name[forward->name_start]);
-+	      /* and wait for reply to arrive */
-+	      return STAT_NEED_DS_NEG;
-+	    }
-+
-+	  /* F_DNSSECOK misused in DS cache records to non-existance of NS record */ 
-+	  if (!(crecp->flags & F_NEG))
-+	    status = STAT_SECURE;
-+	  else if (crecp->flags & F_DNSSECOK)
-+	    status = STAT_NO_DS;
-+	  else
-+	    status = STAT_NO_NS;
- 	}
-+      
-+      /* Have entered non-signed part of DNS tree. */ 
-+      if (status == STAT_NO_DS)
-+	return STAT_INSECURE;
- 
--      /* Reached the root */
--      if (!name_start)
-+      if (status == STAT_BOGUS)
- 	return STAT_BOGUS;
- 
--      strcpy(keyname, name_start);
--      return STAT_NEED_DS_NEG;
--    }
--}
--
--/* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
--static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
--  
--{ 
--  char *name_start;
--  unsigned char *p;
--  int status;
-+      /* There's a proven DS record, or we're within a zone, where there doesn't need
-+	 to be a DS record. Add a name and try again. 
-+	 If we've already tried the whole name, then fail */
- 
--  /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a 
--     suitable NSEC reply to DS queries. */
--  if (RCODE(header) != SERVFAIL)
--    { 
--      status = dnssec_validate_ds(now, header, plen, name, keyname, class);
-+      if (forward->name_start == 0)
-+	return STAT_BOGUS;
-       
--      if (status != STAT_INSECURE)
--	{
--	  if (status == STAT_NO_DS)
--	    status = STAT_INSECURE;
--	  return status;
--	}
--    }
--  
--  p = (unsigned char *)(header+1);
--  
--  if (extract_name(header, plen, &p, name, 1, 4) &&
--      (name_start = strchr(name, '.')))
--    {
--      name_start++; /* chop a label off and try again */
--      strcpy(keyname, name_start);
--      return STAT_NEED_DS_NEG;
-+      for (p = &name[forward->name_start-2]; (*p != '.') && (p != name); p--);
-+      
-+      if (p != name)
-+	p++;
-+      
-+      forward->name_start = p - name;
-+      status = 0; /* force to cache when we iterate. */
-     }
--  
--  return STAT_BOGUS;
- }
- 
- /* Move toward the root, until we find a signed non-existance of a DS, in which case
-@@ -1395,8 +1417,10 @@ static int  tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, s
-   unsigned char *packet, *payload;
-   u16 *length;
-   unsigned char *p = (unsigned char *)(header+1);
--  int status;
--  char *name_start = name;
-+  int status, name_len;
-+  struct blockdata *block;
-+
-+  char *name_start;
- 
-   /* Get first insecure entry in CNAME chain */
-   status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
-@@ -1409,95 +1433,113 @@ static int  tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, s
-   payload = &packet[2];
-   header = (struct dns_header *)payload;
-   length = (u16 *)packet;
-+
-+  /* Stash the name away, since the buffer will be trashed when we recurse */
-+  name_len = strlen(name) + 1;
-+  name_start = name + name_len - 1;
-   
-+  if (!(block = blockdata_alloc(name, name_len)))
-+    {
-+      free(packet);
-+      return STAT_BOGUS;
-+    }
-+
-   while (1)
-     {
--      unsigned char *newhash, hash[HASH_SIZE];
-       unsigned char c1, c2;
--      struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
-- 
-+      struct crec *crecp;
-+
-       if (--(*keycount) == 0)
- 	{
- 	  free(packet);
-+	  blockdata_free(block);
- 	  return STAT_BOGUS;    
- 	}
--
--      if (crecp && (crecp->flags & F_DNSSECOK))
--	{
--	  free(packet);
--	  return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
--	}
-       
--      /* If we have cached insecurely that a DS doesn't exist, 
--	 ise that is a hit for where to start looking for the secure one */
--      if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
--	{
--	  name_start++; /* chop a label off and try again */
--	  continue;
--	}
--
--      /* reached the root */
--      if (!name_start)
--	{
--	  free(packet);
--	  return STAT_BOGUS;
-+      while (crecp = cache_find_by_name(NULL, name_start, now, F_DS))
-+	{      
-+	  if ((crecp->flags & F_NEG) && (crecp->flags & F_DNSSECOK))
-+	    {
-+	      /* Found a secure denial of DS - delegation is indeed insecure */
-+	      free(packet);
-+	      blockdata_free(block);
-+	      return STAT_INSECURE;
-+	    }
-+      
-+	  /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
-+	     Add another label and continue. */
-+ 
-+	  if (name_start == name)
-+	    {
-+	      free(packet);
-+	      blockdata_free(block);
-+	      return STAT_BOGUS; /* run out of labels */
-+	    }
-+	  
-+	  name_start -= 2;
-+	  while (*name_start != '.' && name_start != name) 
-+	    name_start--;
-+	  if (name_start != name)
-+	    name_start++;
- 	}
-+      
-+      /* Can't find it in the cache, have to send a query */
- 
-       m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
-       
--      /* We rely on the question section coming back unchanged, ensure it is with the hash. */
--      if ((newhash = hash_questions(header, (unsigned int)m, name)))
--	{
--	  memcpy(hash, newhash, HASH_SIZE);
-+      *length = htons(m);
-       
--	  *length = htons(m);
-+      if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
-+	  read_write(server->tcpfd, &c1, 1, 1) &&
-+	  read_write(server->tcpfd, &c2, 1, 1) &&
-+	  read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
-+	{
-+	  m = (c1 << 8) | c2;
-+	  
-+	  /* Note this trashes all three name workspaces */
-+	  status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
- 	  
--	  if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
--	      read_write(server->tcpfd, &c1, 1, 1) &&
--	      read_write(server->tcpfd, &c2, 1, 1) &&
--	      read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
-+	  if (status == STAT_NO_DS)
- 	    {
--	      m = (c1 << 8) | c2;
--	      
--	      newhash = hash_questions(header, (unsigned int)m, name);
--	      if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
--		{
--		   /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a 
--		      suitable NSEC reply to DS queries. */
--		  if (RCODE(header) == SERVFAIL)
--		    status = STAT_INSECURE;
--		  else
--		    /* Note this trashes all three name workspaces */
--		    status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
--		  
--		  /* We've found a DS which proves the bit of the DNS where the
--		     original query is, is unsigned, so the answer is OK, 
--		     if unvalidated. */
--		  if (status == STAT_NO_DS)
--		    {
--		      free(packet);
--		      return STAT_INSECURE;
--		    }
--	      
--		  /* No DS, not got to DNSSEC-land yet, go up. */
--		  if (status == STAT_INSECURE)
--		    {
--		      p = (unsigned char *)(header+1);
--		      
--		      if (extract_name(header, plen, &p, name, 1, 4) &&
--			  (name_start = strchr(name, '.')))
--			{
--			  name_start++; /* chop a label off and try again */
--			  continue;
--			}
--		    }
--		}
-+	      /* Found a secure denial of DS - delegation is indeed insecure */
-+	      free(packet);
-+	      blockdata_free(block);
-+	      return STAT_INSECURE;
-+	    }
-+	  
-+	  if (status == STAT_BOGUS)
-+	    {
-+	      free(packet);
-+	      blockdata_free(block);
-+	      return STAT_BOGUS;
-+	    }
-+	  
-+	  /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
-+	     Add another label and continue. */
-+	  
-+	  /* Get name we're checking back. */
-+	  blockdata_retrieve(block, name_len, name);
-+	  
-+	  if (name_start == name)
-+	    {
-+	      free(packet);
-+	      blockdata_free(block);
-+	      return STAT_BOGUS; /* run out of labels */
- 	    }
-+	  
-+	  name_start -= 2;
-+	  while (*name_start != '.' && name_start != name) 
-+	    name_start--;
-+	  if (name_start != name)
-+	    name_start++;
-+	}
-+      else
-+	{
-+	  /* IO failure */
-+	  free(packet);
-+	  blockdata_free(block);
-+	  return STAT_BOGUS; /* run out of labels */
- 	}
--      
--      free(packet);
--
--      return STAT_BOGUS;
-     }
- }
- 
-@@ -1516,14 +1558,14 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
-   else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
-     {
-       new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
--      if (status == STAT_NEED_DS  && new_status == STAT_NO_DS)
--	new_status = STAT_INSECURE;
-+      if (status == STAT_NEED_DS && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
-+	new_status = STAT_BOGUS;
-     }
-   else if (status == STAT_CHASE_CNAME)
-     new_status = dnssec_chase_cname(now, header, n, name, keyname);
-   else 
-     {
--      new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
-+      new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
-       
-       if (new_status == STAT_NO_SIG)
- 	{
-@@ -1576,14 +1618,14 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
- 	      else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
- 		{
- 		  new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
--		  if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
--		    new_status = STAT_INSECURE; /* Validated no DS */
-+		  if (status == STAT_NEED_DS  && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
-+		    new_status = STAT_BOGUS; /* Validated no DS */
- 		}
- 	      else if (status == STAT_CHASE_CNAME)
- 		new_status = dnssec_chase_cname(now, header, n, name, keyname);
- 	      else 
- 		{
--		  new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
-+		  new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
- 		  
- 		  if (new_status == STAT_NO_SIG)
- 		    {
-@@ -1961,6 +2003,7 @@ static struct frec *allocate_frec(time_t now)
-       f->dependent = NULL;
-       f->blocking_query = NULL;
-       f->stash = NULL;
-+      f->orig_domain = NULL;
- #endif
-       daemon->frec_list = f;
-     }
-@@ -2029,6 +2072,12 @@ static void free_frec(struct frec *f)
-       f->stash = NULL;
-     }
- 
-+  if (f->orig_domain)
-+    {
-+      blockdata_free(f->orig_domain);
-+      f->orig_domain = NULL;
-+    }
-+
-   /* Anything we're waiting on is pointless now, too */
-   if (f->blocking_query)
-     free_frec(f->blocking_query);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch b/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch
deleted file mode 100644
index e258d56da0..0000000000
--- a/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch
+++ /dev/null
@@ -1,346 +0,0 @@
-From 25cf5e373eb41c088d4ee5e625209c4cf6a5659e Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Fri, 9 Jan 2015 15:53:03 +0000
-Subject: [PATCH 27/55] Add --log-queries=extra option for more complete
- logging.
-
----
- CHANGELOG     |  3 +++
- man/dnsmasq.8 |  5 ++++-
- src/cache.c   | 11 ++++++++++-
- src/config.h  |  1 +
- src/dnsmasq.c |  5 +++++
- src/dnsmasq.h |  9 +++++++--
- src/dnssec.c  | 14 +++++++-------
- src/forward.c | 30 ++++++++++++++++++++++++++----
- src/option.c  | 11 +++++++++--
- 9 files changed, 72 insertions(+), 17 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index e8bf80f81baa..0bbb7835df4f 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -40,6 +40,9 @@ version 2.73
- 	    nameservers in the unsigned parts of the DNS tree 
- 	    which don't respond well to DNSSEC queries.
- 
-+	    Add --log-queries=extra option, which makes logs easier
-+	    to search automatically.
-+
- 	
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 4236ba307df3..227d74bd80e7 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -98,7 +98,10 @@ only, to stop dnsmasq daemonising in production, use
- .B -k.
- .TP
- .B \-q, --log-queries
--Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on receipt of SIGUSR1.
-+Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on receipt of SIGUSR1. If the argument "extra" is supplied, ie
-+.B --log-queries=extra
-+then the log has extra information at the start of each line.
-+This consists of a serial number which ties together the log lines associated with an individual query, and the IP address of the requestor.
- .TP
- .B \-8, --log-facility=<facility>
- Set the facility to which dnsmasq will send syslog entries, this
-diff --git a/src/cache.c b/src/cache.c
-index ff1ca6f1c352..960bb7938778 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1638,7 +1638,16 @@ void log_query(unsigned int flags, char *name, struct all_addr *addr, char *arg)
-   if (strlen(name) == 0)
-     name = ".";
- 
--  my_syslog(LOG_INFO, "%s %s %s %s", source, name, verb, dest);
-+  if (option_bool(OPT_EXTRALOG))
-+    {
-+      prettyprint_addr(daemon->log_source_addr, daemon->addrbuff2);
-+      if (flags & F_NOEXTRA)
-+	my_syslog(LOG_INFO, "* %s %s %s %s %s", daemon->addrbuff2, source, name, verb, dest);
-+      else
-+	my_syslog(LOG_INFO, "%u %s %s %s %s %s", daemon->log_display_id, daemon->addrbuff2, source, name, verb, dest);
-+    }
-+  else
-+    my_syslog(LOG_INFO, "%s %s %s %s", source, name, verb, dest);
- }
- 
-  
-diff --git a/src/config.h b/src/config.h
-index 145820ad2510..3b88d8193dca 100644
---- a/src/config.h
-+++ b/src/config.h
-@@ -17,6 +17,7 @@
- #define FTABSIZ 150 /* max number of outstanding requests (default) */
- #define MAX_PROCS 20 /* max no children for TCP requests */
- #define CHILD_LIFETIME 150 /* secs 'till terminated (RFC1035 suggests > 120s) */
-+#define TCP_MAX_QUERIES 100 /* Maximum number of queries per incoming TCP connection */
- #define EDNS_PKTSZ 4096 /* default max EDNS.0 UDP packet from RFC5625 */
- #define KEYBLOCK_LEN 40 /* choose to mininise fragmentation when storing DNSSEC keys */
- #define DNSSEC_WORK 50 /* Max number of queries to validate one question */
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index 5c7750d365fa..c0c0589d4ce1 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -93,6 +93,8 @@ int main (int argc, char **argv)
-   daemon->packet = safe_malloc(daemon->packet_buff_sz);
-   
-   daemon->addrbuff = safe_malloc(ADDRSTRLEN);
-+  if (option_bool(OPT_EXTRALOG))
-+    daemon->addrbuff2 = safe_malloc(ADDRSTRLEN);
-   
- #ifdef HAVE_DNSSEC
-   if (option_bool(OPT_DNSSEC_VALID))
-@@ -1587,6 +1589,9 @@ static void check_dns_listeners(fd_set *set, time_t now)
- 		      }
- 		}
- 	      close(confd);
-+
-+	      /* The child can use up to TCP_MAX_QUERIES ids, so skip that many. */
-+	      daemon->log_id += TCP_MAX_QUERIES;
- 	    }
- #endif
- 	  else
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 2f4597294a56..4e9aea401b75 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -238,7 +238,8 @@ struct event_desc {
- #define OPT_DNSSEC_NO_SIGN 48 
- #define OPT_LOCAL_SERVICE  49
- #define OPT_LOOP_DETECT    50
--#define OPT_LAST           51
-+#define OPT_EXTRALOG       51
-+#define OPT_LAST           52
- 
- /* extra flags for my_syslog, we use a couple of facilities since they are known 
-    not to occupy the same bits as priorities, no matter how syslog.h is set up. */
-@@ -442,6 +443,7 @@ struct crec {
- #define F_NO_RR     (1u<<25)
- #define F_IPSET     (1u<<26)
- #define F_NSIGMATCH (1u<<27)
-+#define F_NOEXTRA   (1u<<28)
- 
- /* Values of uid in crecs with F_CONFIG bit set. */
- #define SRC_INTERFACE 0
-@@ -599,7 +601,7 @@ struct frec {
- #endif
-   unsigned int iface;
-   unsigned short orig_id, new_id;
--  int fd, forwardall, flags;
-+  int log_id, fd, forwardall, flags;
-   time_t time;
-   unsigned char *hash[HASH_SIZE];
- #ifdef HAVE_DNSSEC 
-@@ -1002,6 +1004,8 @@ extern struct daemon {
-   struct randfd randomsocks[RANDOM_SOCKS];
-   int v6pktinfo; 
-   struct addrlist *interface_addrs; /* list of all addresses/prefix lengths associated with all local interfaces */
-+  int log_id, log_display_id; /* ids of transactions for logging */
-+  union mysockaddr *log_source_addr;
- 
-   /* DHCP state */
-   int dhcpfd, helperfd, pxefd; 
-@@ -1033,6 +1037,7 @@ extern struct daemon {
- 
-   /* utility string buffer, hold max sized IP address as string */
-   char *addrbuff;
-+  char *addrbuff2; /* only allocated when OPT_EXTRALOG */
- 
- } *daemon;
- 
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 8f27677628b2..afb3dca38cb1 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -1038,7 +1038,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
- 		      else
- 			{
- 			  a.addr.keytag = keytag;
--			  log_query(F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %u");
-+			  log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %u");
- 			  
- 			  recp1->addr.key.keylen = rdlen - 4;
- 			  recp1->addr.key.keydata = key;
-@@ -1092,7 +1092,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
-       return STAT_SECURE;
-     }
- 
--  log_query(F_UPSTREAM, name, NULL, "BOGUS DNSKEY");
-+  log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DNSKEY");
-   return STAT_BOGUS;
- }
- 
-@@ -1136,7 +1136,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
-   
-   if (val == STAT_BOGUS)
-     {
--      log_query(F_UPSTREAM, name, NULL, "BOGUS DS");
-+      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS");
-       return STAT_BOGUS;
-     }
- 
-@@ -1201,7 +1201,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
- 	  
- 	  cache_end_insert();  
- 	  
--	  log_query(F_UPSTREAM, name, NULL, nons ? "no delegation" : "no DS");
-+	  log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, nons ? "no delegation" : "no DS");
- 	}
- 
-       return nons ? STAT_NO_NS : STAT_NO_DS; 
-@@ -1885,7 +1885,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 			      else
- 				{
- 				  a.addr.keytag = keytag;
--				  log_query(F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %u");
-+				  log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %u");
- 				  crecp->addr.ds.digest = digest;
- 				  crecp->addr.ds.keydata = key;
- 				  crecp->addr.ds.algo = algo;
-@@ -2058,10 +2058,10 @@ size_t dnssec_generate_query(struct dns_header *header, char *end, char *name, i
-   char *types = querystr("dnssec-query", type);
- 
-   if (addr->sa.sa_family == AF_INET) 
--    log_query(F_DNSSEC | F_IPV4, name, (struct all_addr *)&addr->in.sin_addr, types);
-+    log_query(F_NOEXTRA | F_DNSSEC | F_IPV4, name, (struct all_addr *)&addr->in.sin_addr, types);
- #ifdef HAVE_IPV6
-   else
--    log_query(F_DNSSEC | F_IPV6, name, (struct all_addr *)&addr->in6.sin6_addr, types);
-+    log_query(F_NOEXTRA | F_DNSSEC | F_IPV6, name, (struct all_addr *)&addr->in6.sin6_addr, types);
- #endif
-   
-   header->qdcount = htons(1);
-diff --git a/src/forward.c b/src/forward.c
-index 55f583383bc6..713a64c0fa58 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -279,10 +279,10 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
- 	  plen = forward->stash_len;
- 	  
- 	  if (forward->sentto->addr.sa.sa_family == AF_INET) 
--	    log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
-+	    log_query(F_NOEXTRA | F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
- #ifdef HAVE_IPV6
- 	  else
--	    log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
-+	    log_query(F_NOEXTRA | F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
- #endif
-   
- 	  if (forward->sentto->sfd)
-@@ -389,6 +389,9 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr,
-       struct server *firstsentto = start;
-       int forwarded = 0;
-       
-+      /* If a query is retried, use the log_id for the retry when logging the answer. */
-+      forward->log_id = daemon->log_id;
-+      
-       if (option_bool(OPT_ADD_MAC))
- 	plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
-       
-@@ -725,6 +728,11 @@ void reply_query(int fd, int family, time_t now)
-   if (!(forward = lookup_frec(ntohs(header->id), hash)))
-     return;
-   
-+  /* log_query gets called indirectly all over the place, so 
-+     pass these in global variables - sorry. */
-+  daemon->log_display_id = forward->log_id;
-+  daemon->log_source_addr = &forward->source;
-+  
-   if (daemon->ignore_addr && RCODE(header) == NOERROR &&
-       check_for_ignored_address(header, n, daemon->ignore_addr))
-     return;
-@@ -1258,6 +1266,11 @@ void receive_query(struct listener *listen, time_t now)
- 	    dst_addr_4.s_addr = 0;
- 	}
-     }
-+   
-+  /* log_query gets called indirectly all over the place, so 
-+     pass these in global variables - sorry. */
-+  daemon->log_display_id = ++daemon->log_id;
-+  daemon->log_source_addr = &source_addr;
-   
-   if (extract_request(header, (size_t)n, daemon->namebuff, &type))
-     {
-@@ -1675,7 +1688,8 @@ unsigned char *tcp_request(int confd, time_t now,
-   struct in_addr dst_addr_4;
-   union mysockaddr peer_addr;
-   socklen_t peer_len = sizeof(union mysockaddr);
--  
-+  int query_count = 0;
-+
-   if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
-     return packet;
-   
-@@ -1712,7 +1726,8 @@ unsigned char *tcp_request(int confd, time_t now,
- 
-   while (1)
-     {
--      if (!packet ||
-+      if (query_count == TCP_MAX_QUERIES ||
-+	  !packet ||
- 	  !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
- 	  !(size = c1 << 8 | c2) ||
- 	  !read_write(confd, payload, size, 1))
-@@ -1721,6 +1736,13 @@ unsigned char *tcp_request(int confd, time_t now,
-       if (size < (int)sizeof(struct dns_header))
- 	continue;
-       
-+      query_count++;
-+
-+      /* log_query gets called indirectly all over the place, so 
-+	 pass these in global variables - sorry. */
-+      daemon->log_display_id = ++daemon->log_id;
-+      daemon->log_source_addr = &peer_addr;
-+      
-       check_subnet = 0;
- 
-       /* save state of "cd" flag in query */
-diff --git a/src/option.c b/src/option.c
-index 907d0cf88de9..b7372be0a090 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -149,6 +149,7 @@ struct myoption {
- #define LOPT_LOOP_DETECT   337
- #define LOPT_IGNORE_ADDR   338
- 
-+
- #ifdef HAVE_GETOPT_LONG
- static const struct option opts[] =  
- #else
-@@ -160,7 +161,7 @@ static const struct myoption opts[] =
-     { "no-poll", 0, 0, 'n' },
-     { "help", 0, 0, 'w' },
-     { "no-daemon", 0, 0, 'd' },
--    { "log-queries", 0, 0, 'q' },
-+    { "log-queries", 2, 0, 'q' },
-     { "user", 2, 0, 'u' },
-     { "group", 2, 0, 'g' },
-     { "resolv-file", 2, 0, 'r' },
-@@ -357,7 +358,7 @@ static struct {
-   { LOPT_FORCE, ARG_DUP, "<optspec>", gettext_noop("DHCP option sent even if the client does not request it."), NULL},
-   { 'p', ARG_ONE, "<integer>", gettext_noop("Specify port to listen for DNS requests on (defaults to 53)."), NULL },
-   { 'P', ARG_ONE, "<integer>", gettext_noop("Maximum supported UDP packet size for EDNS.0 (defaults to %s)."), "*" },
--  { 'q', OPT_LOG, NULL, gettext_noop("Log DNS queries."), NULL },
-+  { 'q', ARG_DUP, NULL, gettext_noop("Log DNS queries."), NULL },
-   { 'Q', ARG_ONE, "<integer>", gettext_noop("Force the originating port for upstream DNS queries."), NULL },
-   { 'R', OPT_NO_RESOLV, NULL, gettext_noop("Do NOT read resolv.conf."), NULL },
-   { 'r', ARG_DUP, "<path>", gettext_noop("Specify path to resolv.conf (defaults to %s)."), RESOLVFILE }, 
-@@ -2421,6 +2422,12 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	ret_err(gen_err);
-       break;  
-     
-+    case 'q': /* --log-queries */
-+      set_option_bool(OPT_LOG);
-+      if (arg && strcmp(arg, "extra") == 0)
-+	set_option_bool(OPT_EXTRALOG);
-+      break;
-+
-     case LOPT_MAX_LOGS:  /* --log-async */
-       daemon->max_logs = LOG_MAX; /* default */
-       if (arg && !atoi_check(arg, &daemon->max_logs))
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch b/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch
deleted file mode 100644
index e8a61b7c15..0000000000
--- a/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From 28de38768e2c7d763b9aa5b7a4d251d5e56bab0b Mon Sep 17 00:00:00 2001
-From: RinSatsuki <aa65535@live.com>
-Date: Sat, 10 Jan 2015 15:22:21 +0000
-Subject: [PATCH 28/55] Add --min-cache-ttl option.
-
----
- CHANGELOG     |  7 +++++++
- man/dnsmasq.8 |  6 ++++++
- src/cache.c   |  4 +++-
- src/config.h  |  1 +
- src/dnsmasq.h |  2 +-
- src/option.c  | 11 +++++++++++
- 6 files changed, 29 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 0bbb7835df4f..23fc6d0530cf 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -43,6 +43,13 @@ version 2.73
- 	    Add --log-queries=extra option, which makes logs easier
- 	    to search automatically.
- 
-+	    Add --min-cache-ttl option. I've resisted this for a long 
-+	    time, on the grounds that disbelieving TTLs is never a 
-+	    good idea, but I've been persuaded that there are 
-+	    sometimes reasons to do it. (Step forward, GFW).
-+	    To avoid misuse, there's a hard limit on the TTL 
-+	    floor of one hour. Thansk to RinSatsuki for the patch.
-+	
- 	
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 227d74bd80e7..5cfa355dea4a 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -81,6 +81,12 @@ the upstream DNS servers.
- .B --max-cache-ttl=<time>
- Set a maximum TTL value for entries in the cache.
- .TP
-+.B --min-cache-ttl=<time>
-+Extend short TTL values to the time given when caching them. Note that
-+artificially extending TTL values is in general a bad idea, do not do it 
-+unless you have a good reason, and understand what you are doing. 
-+Dnsmasq limits the value of this option to one hour, unless recompiled.
-+.TP
- .B --auth-ttl=<time>
- Set the TTL value returned in answers from the authoritative server.
- .TP
-diff --git a/src/cache.c b/src/cache.c
-index 960bb7938778..945be071a0b6 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -461,9 +461,11 @@ struct crec *cache_insert(char *name, struct all_addr *addr,
-   if (flags & (F_IPV4 | F_IPV6 | F_CNAME))
-     {
-       log_query(flags | F_UPSTREAM, name, addr, NULL);
--      /* Don;t mess with TTL for DNSSEC records. */
-+      /* Don't mess with TTL for DNSSEC records. */
-       if (daemon->max_cache_ttl != 0 && daemon->max_cache_ttl < ttl)
- 	ttl = daemon->max_cache_ttl;
-+      if (daemon->min_cache_ttl != 0 && daemon->min_cache_ttl > ttl)
-+	ttl = daemon->min_cache_ttl;
-     }
- 
-   /* if previous insertion failed give up now. */
-diff --git a/src/config.h b/src/config.h
-index 3b88d8193dca..cdca231b4079 100644
---- a/src/config.h
-+++ b/src/config.h
-@@ -27,6 +27,7 @@
- #define RANDOM_SOCKS 64 /* max simultaneous random ports */
- #define LEASE_RETRY 60 /* on error, retry writing leasefile after LEASE_RETRY seconds */
- #define CACHESIZ 150 /* default cache size */
-+#define TTL_FLOOR_LIMIT 3600 /* don't allow --min-cache-ttl to raise TTL above this under any circumstances */
- #define MAXLEASES 1000 /* maximum number of DHCP leases */
- #define PING_WAIT 3 /* wait for ping address-in-use test */
- #define PING_CACHE_TIME 30 /* Ping test assumed to be valid this long. */
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 4e9aea401b75..f8275e3ac479 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -943,7 +943,7 @@ extern struct daemon {
-   int max_logs;  /* queue limit */
-   int cachesize, ftabsize;
-   int port, query_port, min_port;
--  unsigned long local_ttl, neg_ttl, max_ttl, max_cache_ttl, auth_ttl;
-+  unsigned long local_ttl, neg_ttl, max_ttl, min_cache_ttl, max_cache_ttl, auth_ttl;
-   struct hostsfile *addn_hosts;
-   struct dhcp_context *dhcp, *dhcp6;
-   struct ra_interface *ra_interfaces;
-diff --git a/src/option.c b/src/option.c
-index b7372be0a090..8b994098cc9f 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -148,6 +148,7 @@ struct myoption {
- #define LOPT_DNSSEC_TIME   336
- #define LOPT_LOOP_DETECT   337
- #define LOPT_IGNORE_ADDR   338
-+#define LOPT_MINCTTL       339
- 
- 
- #ifdef HAVE_GETOPT_LONG
-@@ -256,6 +257,7 @@ static const struct myoption opts[] =
-     { "dhcp-broadcast", 2, 0, LOPT_BROADCAST },
-     { "neg-ttl", 1, 0, LOPT_NEGTTL },
-     { "max-ttl", 1, 0, LOPT_MAXTTL },
-+    { "min-cache-ttl", 1, 0, LOPT_MINCTTL },
-     { "max-cache-ttl", 1, 0, LOPT_MAXCTTL },
-     { "dhcp-alternate-port", 2, 0, LOPT_ALTPORT },
-     { "dhcp-scriptuser", 1, 0, LOPT_SCRIPTUSR },
-@@ -371,6 +373,8 @@ static struct {
-   { 'T', ARG_ONE, "<integer>", gettext_noop("Specify time-to-live in seconds for replies from /etc/hosts."), NULL },
-   { LOPT_NEGTTL, ARG_ONE, "<integer>", gettext_noop("Specify time-to-live in seconds for negative caching."), NULL },
-   { LOPT_MAXTTL, ARG_ONE, "<integer>", gettext_noop("Specify time-to-live in seconds for maximum TTL to send to clients."), NULL },
-+  { LOPT_MAXCTTL, ARG_ONE, "<integer>", gettext_noop("Specify time-to-live ceiling for cache."), NULL },
-+  { LOPT_MINCTTL, ARG_ONE, "<integer>", gettext_noop("Specify time-to-live floor for cache."), NULL },
-   { 'u', ARG_ONE, "<username>", gettext_noop("Change to this user after startup. (defaults to %s)."), CHUSER }, 
-   { 'U', ARG_DUP, "set:<tag>,<class>", gettext_noop("Map DHCP vendor class to tag."), NULL },
-   { 'v', 0, NULL, gettext_noop("Display dnsmasq version and copyright information."), NULL },
-@@ -2457,6 +2461,7 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
-     case 'T':         /* --local-ttl */
-     case LOPT_NEGTTL: /* --neg-ttl */
-     case LOPT_MAXTTL: /* --max-ttl */
-+    case LOPT_MINCTTL: /* --min-cache-ttl */
-     case LOPT_MAXCTTL: /* --max-cache-ttl */
-     case LOPT_AUTHTTL: /* --auth-ttl */
-       {
-@@ -2467,6 +2472,12 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	  daemon->neg_ttl = (unsigned long)ttl;
- 	else if (option == LOPT_MAXTTL)
- 	  daemon->max_ttl = (unsigned long)ttl;
-+	else if (option == LOPT_MINCTTL)
-+	  {
-+	    if (ttl > TTL_FLOOR_LIMIT)
-+	      ttl = TTL_FLOOR_LIMIT;
-+	    daemon->min_cache_ttl = (unsigned long)ttl;
-+	  }
- 	else if (option == LOPT_MAXCTTL)
- 	  daemon->max_cache_ttl = (unsigned long)ttl;
- 	else if (option == LOPT_AUTHTTL)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch b/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch
deleted file mode 100644
index d3c484727e..0000000000
--- a/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 9f79ee4ae34886c0319f06d8f162b81ef79d62fb Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 12 Jan 2015 20:18:18 +0000
-Subject: [PATCH 29/55] Log port of requestor when doing extra logging.
-
----
- src/cache.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index 945be071a0b6..09b6dbf8087a 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1642,11 +1642,11 @@ void log_query(unsigned int flags, char *name, struct all_addr *addr, char *arg)
- 
-   if (option_bool(OPT_EXTRALOG))
-     {
--      prettyprint_addr(daemon->log_source_addr, daemon->addrbuff2);
-+      int port = prettyprint_addr(daemon->log_source_addr, daemon->addrbuff2);
-       if (flags & F_NOEXTRA)
--	my_syslog(LOG_INFO, "* %s %s %s %s %s", daemon->addrbuff2, source, name, verb, dest);
-+	my_syslog(LOG_INFO, "* %s/%u %s %s %s %s", daemon->addrbuff2, port, source, name, verb, dest);
-       else
--	my_syslog(LOG_INFO, "%u %s %s %s %s %s", daemon->log_display_id, daemon->addrbuff2, source, name, verb, dest);
-+	my_syslog(LOG_INFO, "%u %s/%u %s %s %s %s", daemon->log_display_id, daemon->addrbuff2, port, source, name, verb, dest);
-     }
-   else
-     my_syslog(LOG_INFO, "%s %s %s %s", source, name, verb, dest);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/003-dont_answer_non_auth_queries_for_auth_zones_locally_when_localise_queries_set.patch b/src/patches/dnsmasq/003-dont_answer_non_auth_queries_for_auth_zones_locally_when_localise_queries_set.patch
new file mode 100644
index 0000000000..cfbcdfbc9f
--- /dev/null
+++ b/src/patches/dnsmasq/003-dont_answer_non_auth_queries_for_auth_zones_locally_when_localise_queries_set.patch
@@ -0,0 +1,34 @@
+From 3a3965ac21b1b759eab8799b6edb09195b671306 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Sun, 9 Aug 2015 17:45:06 +0100
+Subject: [PATCH] Don't answer non-auth queries for auth zones locally when
+ --localise-queries set.
+
+---
+ src/forward.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/forward.c b/src/forward.c
+index 2731b90..b76a974 100644
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -1365,7 +1365,7 @@ void receive_query(struct listener *listen, time_t now)
+ 
+ #ifdef HAVE_AUTH
+       /* find queries for zones we're authoritative for, and answer them directly */
+-      if (!auth_dns)
++      if (!auth_dns && !option_bool(OPT_LOCALISE))
+ 	for (zone = daemon->auth_zones; zone; zone = zone->next)
+ 	  if (in_zone(zone, daemon->namebuff, NULL))
+ 	    {
+@@ -1904,7 +1904,7 @@ unsigned char *tcp_request(int confd, time_t now,
+ 	  
+ #ifdef HAVE_AUTH
+ 	  /* find queries for zones we're authoritative for, and answer them directly */
+-	  if (!auth_dns)
++	  if (!auth_dns && !option_bool(OPT_LOCALISE))
+ 	    for (zone = daemon->auth_zones; zone; zone = zone->next)
+ 	      if (in_zone(zone, daemon->namebuff, NULL))
+ 		{
+-- 
+1.7.10.4
diff --git a/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch b/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch
deleted file mode 100644
index 5f489e2146..0000000000
--- a/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 5e321739db381a1d7b5964d76e9c81471d2564c9 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 12 Jan 2015 23:16:56 +0000
-Subject: [PATCH 30/55] Don't answer from cache RRsets from wildcards, as we
- don't have NSECs.
-
----
- src/dnssec.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/src/dnssec.c b/src/dnssec.c
-index afb3dca38cb1..d39ab85ed966 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -1818,11 +1818,14 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 	      struct blockdata *key;
- 	      struct crec *crecp;
- 	      char *wildname;
-+	      int have_wildcard = 0;
- 
- 	      rc = validate_rrset(now, header, plen, class1, type1, name, keyname, &wildname, NULL, 0, 0, 0);
- 	      
- 	      if (rc == STAT_SECURE_WILDCARD)
- 		{
-+		  have_wildcard = 1;
-+
- 		  /* An attacker replay a wildcard answer with a different
- 		     answer and overlay a genuine RR. To prove this
- 		     hasn't happened, the answer must prove that
-@@ -1913,7 +1916,11 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
- 			      p2 += 13; /* labels, orig_ttl, expiration, inception */
- 			      GETSHORT(keytag, p2);
- 			      
--			      if ((key = blockdata_alloc((char*)psave, rdlen2)))
-+			      /* We don't cache sigs for wildcard answers, because to reproduce the
-+				 answer from the cache will require one or more NSEC/NSEC3 records 
-+				 which we don't cache. The lack of the RRSIG ensures that a query for
-+				 this RRset asking for a secure answer will always be forwarded. */
-+			      if (!have_wildcard && (key = blockdata_alloc((char*)psave, rdlen2)))
- 				{
- 				  if (!(crecp = cache_insert(name, &a, now, ttl,  F_FORWARD | F_DNSKEY | F_DS)))
- 				    blockdata_free(key);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch b/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch
deleted file mode 100644
index 1a2d3e4645..0000000000
--- a/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ae4624bf46b5e37ff1a9a2ba3c927e0dede95adb Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 12 Jan 2015 23:22:08 +0000
-Subject: [PATCH 31/55] Logs for DS records consistent.
-
----
- src/rfc1035.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 75c4266b47dd..262274fc5b80 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1643,7 +1643,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
- 			      {
- 				if (crecp->flags & F_NXDOMAIN)
- 				  nxdomain = 1;
--				log_query(F_UPSTREAM, name, NULL, "secure no DS");	
-+				log_query(F_UPSTREAM, name, NULL, "no DS");	
- 			      }
- 			    else if ((keydata = blockdata_retrieve(crecp->addr.ds.keydata, crecp->addr.ds.keylen, NULL)))
- 			      {			     			      
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch b/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch
deleted file mode 100644
index 81b02cc477..0000000000
--- a/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 393415597c8b5b09558b789ab9ac238dbe3db65d Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 18 Jan 2015 22:11:10 +0000
-Subject: [PATCH 32/55] Cope with multiple interfaces with the same LL address.
-
----
- CHANGELOG  | 4 ++++
- src/auth.c | 5 ++++-
- src/util.c | 1 +
- 3 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 23fc6d0530cf..bbd7e6619689 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -49,6 +49,10 @@ version 2.73
- 	    sometimes reasons to do it. (Step forward, GFW).
- 	    To avoid misuse, there's a hard limit on the TTL 
- 	    floor of one hour. Thansk to RinSatsuki for the patch.
-+
-+	    Cope with multiple interfaces with the same link-local 
-+	    address. (IPv6 addresses are scoped, so this is allowed.)
-+	    Thanks to Cory Benfield for help with this.
- 	
- 	
- version 2.72
-diff --git a/src/auth.c b/src/auth.c
-index a327f16d8c0b..59e05d3da38e 100644
---- a/src/auth.c
-+++ b/src/auth.c
-@@ -413,7 +413,10 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
- 		peer_addr->in.sin_port = 0;
- #ifdef HAVE_IPV6
- 	      else
--		peer_addr->in6.sin6_port = 0; 
-+		{
-+		  peer_addr->in6.sin6_port = 0; 
-+		  peer_addr->in6.sin6_scope_id = 0;
-+		}
- #endif
- 	      
- 	      for (peers = daemon->auth_peers; peers; peers = peers->next)
-diff --git a/src/util.c b/src/util.c
-index a729f339e219..d532444da207 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -274,6 +274,7 @@ int sockaddr_isequal(union mysockaddr *s1, union mysockaddr *s2)
- #ifdef HAVE_IPV6      
-       if (s1->sa.sa_family == AF_INET6 &&
- 	  s1->in6.sin6_port == s2->in6.sin6_port &&
-+	  s1->in6.sin6_scope_id == s2->in6.sin6_scope_id &&
- 	  IN6_ARE_ADDR_EQUAL(&s1->in6.sin6_addr, &s2->in6.sin6_addr))
- 	return 1;
- #endif
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch b/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch
deleted file mode 100644
index e88a94b965..0000000000
--- a/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 2ae195f5a71f7c5a75717845de1bd72fc7dd67f3 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 18 Jan 2015 22:20:48 +0000
-Subject: [PATCH 33/55] Don't treat SERVFAIL as a recoverable error.....
-
----
- src/forward.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/forward.c b/src/forward.c
-index 713a64c0fa58..b17bc34f865f 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -737,7 +737,7 @@ void reply_query(int fd, int family, time_t now)
-       check_for_ignored_address(header, n, daemon->ignore_addr))
-     return;
- 
--  if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
-+  if (RCODE(header) == REFUSED &&
-       !option_bool(OPT_ORDER) &&
-       forward->forwardall == 0)
-     /* for broken servers, attempt to send to another one. */
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch b/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch
deleted file mode 100644
index c6b6703b09..0000000000
--- a/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch
+++ /dev/null
@@ -1,419 +0,0 @@
-From 5f4dc5c6ca50655ab14f572c7e30815ed74cd51a Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 20 Jan 2015 20:51:02 +0000
-Subject: [PATCH 34/55] Add --dhcp-hostsdir config option.
-
----
- CHANGELOG     |   5 +++
- man/dnsmasq.8 |   9 +++++
- src/dnsmasq.c |  28 ++++++++++----
- src/dnsmasq.h |  15 ++++++--
- src/inotify.c | 119 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---
- src/option.c  |  22 +++++++++--
- 6 files changed, 177 insertions(+), 21 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index bbd7e6619689..0076b557e95e 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -53,6 +53,11 @@ version 2.73
- 	    Cope with multiple interfaces with the same link-local 
- 	    address. (IPv6 addresses are scoped, so this is allowed.)
- 	    Thanks to Cory Benfield for help with this.
-+
-+	    Add --dhcp-hostsdir. This allows addition of new host
-+	    configurations to a running dnsmasq instance much more 
-+	    cheaply than having dnsmasq re-read all its existing
-+	    configuration each time. 
- 	
- 	
- version 2.72
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 5cfa355dea4a..005b5cca8d1f 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -977,6 +977,15 @@ is given, then read all the files contained in that directory. The advantage of
- using this option is the same as for --dhcp-hostsfile: the
- dhcp-optsfile will be re-read when dnsmasq receives SIGHUP. Note that
- it is possible to encode the information in a
-+.TP
-+.B --dhcp-hostsdir=<path>
-+This is exactly equivalent to dhcp-hostfile, except for the following. The path MUST be a
-+directory, and not an individual file. Changed or new files within
-+the directory are read automatically, without the need to send SIGHUP.
-+If a file is deleted for changed after it has been read by dnsmasq, then the
-+host record it contained will remain until dnsmasq recieves a SIGHUP, or 
-+is restarted; ie host records are only added dynamically.
-+.TP
- .B --dhcp-boot
- flag as DHCP options, using the options names bootfile-name,
- server-ip-address and tftp-server. This allows these to be included
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index c0c0589d4ce1..04cc98278f62 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -142,6 +142,9 @@ int main (int argc, char **argv)
-       set_option_bool(OPT_NOWILD);
-       reset_option_bool(OPT_CLEVERBIND);
-     }
-+
-+  if (daemon->inotify_hosts)
-+    die(_("dhcp-hostsdir not supported on this platform"), NULL, EC_BADCONF);
- #endif
-   
-   if (option_bool(OPT_DNSSEC_VALID))
-@@ -316,13 +319,16 @@ int main (int argc, char **argv)
- #ifdef HAVE_DNSSEC
-       blockdata_init();
- #endif
-+    }
- 
- #ifdef HAVE_LINUX_NETWORK
--      if (!option_bool(OPT_NO_POLL))
--	inotify_dnsmasq_init();
-+  if ((!option_bool(OPT_NO_POLL) && daemon->port != 0) ||
-+      daemon->dhcp || daemon->doing_dhcp6)
-+    inotify_dnsmasq_init();
-+  else
-+    daemon->inotifyfd = -1;
- #endif
--    }
--    
-+       
-   if (option_bool(OPT_DBUS))
- #ifdef HAVE_DBUS
-     {
-@@ -745,7 +751,7 @@ int main (int argc, char **argv)
- #endif
- 
- #ifdef HAVE_TFTP
--	if (option_bool(OPT_TFTP))
-+  if (option_bool(OPT_TFTP))
-     {
- #ifdef FD_SETSIZE
-       if (FD_SETSIZE < (unsigned)max_fd)
-@@ -870,7 +876,7 @@ int main (int argc, char **argv)
- #if defined(HAVE_LINUX_NETWORK)
-       FD_SET(daemon->netlinkfd, &rset);
-       bump_maxfd(daemon->netlinkfd, &maxfd);
--      if (daemon->port != 0 && !option_bool(OPT_NO_POLL))
-+      if (daemon->inotifyfd != -1)
- 	{
- 	  FD_SET(daemon->inotifyfd, &rset);
- 	  bump_maxfd(daemon->inotifyfd, &maxfd);
-@@ -943,8 +949,11 @@ int main (int argc, char **argv)
- #endif
- 
- #ifdef HAVE_LINUX_NETWORK
--      if (daemon->port != 0 && !option_bool(OPT_NO_POLL) && FD_ISSET(daemon->inotifyfd, &rset) && inotify_check())
--	poll_resolv(1, 1, now); 	  
-+      if  (daemon->inotifyfd != -1 && FD_ISSET(daemon->inotifyfd, &rset) && inotify_check(now))
-+	{
-+	  if (daemon->port != 0 && !option_bool(OPT_NO_POLL))
-+	    poll_resolv(1, 1, now);
-+	} 	  
- #else
-       /* Check for changes to resolv files once per second max. */
-       /* Don't go silent for long periods if the clock goes backwards. */
-@@ -1385,6 +1394,9 @@ void clear_cache_and_reload(time_t now)
-       if (option_bool(OPT_ETHERS))
- 	dhcp_read_ethers();
-       reread_dhcp();
-+#ifdef HAVE_LINUX_NETWORK
-+      set_dhcp_inotify();
-+#endif
-       dhcp_update_configs(daemon->dhcp_conf);
-       lease_update_from_configs(); 
-       lease_update_file(now); 
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index f8275e3ac479..d841fdc064ad 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -550,13 +550,17 @@ struct resolvc {
- #endif
- };
- 
--/* adn-hosts parms from command-line (also dhcp-hostsfile and dhcp-optsfile */
-+/* adn-hosts parms from command-line (also dhcp-hostsfile and dhcp-optsfile and dhcp-hostsdir*/
- #define AH_DIR      1
- #define AH_INACTIVE 2
-+#define AH_WD_DONE  4
- struct hostsfile {
-   struct hostsfile *next;
-   int flags;
-   char *fname;
-+#ifdef HAVE_LINUX_NETWORK
-+  int wd; /* inotify watch descriptor */
-+#endif
-   unsigned int index; /* matches to cache entries for logging */
- };
- 
-@@ -961,7 +965,7 @@ extern struct daemon {
-   int doing_ra, doing_dhcp6;
-   struct dhcp_netid_list *dhcp_ignore, *dhcp_ignore_names, *dhcp_gen_names; 
-   struct dhcp_netid_list *force_broadcast, *bootp_dynamic;
--  struct hostsfile *dhcp_hosts_file, *dhcp_opts_file;
-+  struct hostsfile *dhcp_hosts_file, *dhcp_opts_file, *inotify_hosts;
-   int dhcp_max, tftp_max;
-   int dhcp_server_port, dhcp_client_port;
-   int start_tftp_port, end_tftp_port; 
-@@ -1197,7 +1201,7 @@ void reset_option_bool(unsigned int opt);
- struct hostsfile *expand_filelist(struct hostsfile *list);
- char *parse_server(char *arg, union mysockaddr *addr, 
- 		   union mysockaddr *source_addr, char *interface, int *flags);
--
-+int option_read_hostsfile(char *file);
- /* forward.c */
- void reply_query(int fd, int family, time_t now);
- void receive_query(struct listener *listen, time_t now);
-@@ -1486,5 +1490,8 @@ int detect_loop(char *query, int type);
- /* inotify.c */
- #ifdef HAVE_LINUX_NETWORK
- void inotify_dnsmasq_init();
--int inotify_check(void);
-+int inotify_check(time_t now);
-+#  ifdef HAVE_DHCP
-+void set_dhcp_inotify(void);
-+#  endif
- #endif
-diff --git a/src/inotify.c b/src/inotify.c
-index 83730008c11b..52a30d7f44db 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -19,6 +19,11 @@
- 
- #include <sys/inotify.h>
- 
-+#ifdef HAVE_DHCP
-+static void check_for_dhcp_inotify(struct inotify_event *in, time_t now);
-+#endif
-+
-+
- /* the strategy is to set a inotify on the directories containing
-    resolv files, for any files in the directory which are close-write 
-    or moved into the directory.
-@@ -40,8 +45,6 @@ void inotify_dnsmasq_init()
-   struct resolvc *res;
- 
-   inotify_buffer = safe_malloc(INOTIFY_SZ);
--
--
-   daemon->inotifyfd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
-   
-   if (daemon->inotifyfd == -1)
-@@ -66,6 +69,7 @@ void inotify_dnsmasq_init()
- 	{
- 	  *d = 0; /* make path just directory */
- 	  res->wd = inotify_add_watch(daemon->inotifyfd, path, IN_CLOSE_WRITE | IN_MOVED_TO);
-+
- 	  res->file = d+1; /* pointer to filename */
- 	  *d = '/';
- 	  
-@@ -78,7 +82,7 @@ void inotify_dnsmasq_init()
-     }
- }
- 
--int inotify_check(void)
-+int inotify_check(time_t now)
- {
-   int hit = 0;
-   
-@@ -101,13 +105,116 @@ int inotify_check(void)
- 	  for (res = daemon->resolv_files; res; res = res->next)
- 	    if (res->wd == in->wd && in->len != 0 && strcmp(res->file, in->name) == 0)
- 	      hit = 1;
-+
-+#ifdef HAVE_DHCP
-+	  if (daemon->dhcp || daemon->doing_dhcp6)
-+	    check_for_dhcp_inotify(in, now);
-+#endif
- 	}
-     }
--
-   return hit;
- }
- 
--#endif
-+#ifdef HAVE_DHCP 
-+/* initialisation for dhcp-hostdir. Set inotify watch for each directory, and read pre-existing files */
-+void set_dhcp_inotify(void)
-+{
-+  struct hostsfile *ah;
- 
--  
-+  for (ah = daemon->inotify_hosts; ah; ah = ah->next)
-+    {
-+       DIR *dir_stream = NULL;
-+       struct dirent *ent;
-+       struct stat buf;
-+
-+       if (stat(ah->fname, &buf) == -1 || !(S_ISDIR(buf.st_mode)))
-+	 {
-+	   my_syslog(LOG_ERR, _("bad directory in dhcp-hostsdir %s"), ah->fname);
-+	   continue;
-+	 }
-+
-+       if (!(ah->flags & AH_WD_DONE))
-+	 {
-+	   ah->wd = inotify_add_watch(daemon->inotifyfd, ah->fname, IN_CLOSE_WRITE | IN_MOVED_TO);
-+	   ah->flags |= AH_WD_DONE;
-+	 }
-+       /* Read contents of dir _after_ calling add_watch, in the ho[e of avoiding
-+	  a race which misses files being added as we start */
-+       if (ah->wd == -1 || !(dir_stream = opendir(ah->fname)))
-+	 {
-+	   my_syslog(LOG_ERR, _("failed to create inotify for %s"), ah->fname);
-+	   continue;
-+	 }
-+
-+       while ((ent = readdir(dir_stream)))
-+	 {
-+	   size_t lendir = strlen(ah->fname);
-+	   size_t lenfile = strlen(ent->d_name);
-+	   char *path;
-+	   
-+	   /* ignore emacs backups and dotfiles */
-+	   if (lenfile == 0 || 
-+	       ent->d_name[lenfile - 1] == '~' ||
-+	       (ent->d_name[0] == '#' && ent->d_name[lenfile - 1] == '#') ||
-+	       ent->d_name[0] == '.')
-+	     continue;
-+	   
-+	   if ((path = whine_malloc(lendir + lenfile + 2)))
-+	     {
-+	       strcpy(path, ah->fname);
-+	       strcat(path, "/");
-+	       strcat(path, ent->d_name);
-+	       
-+	       /* ignore non-regular files */
-+	       if (stat(path, &buf) != -1 && S_ISREG(buf.st_mode))
-+		 option_read_hostsfile(path);
-+	       
-+	       free(path);
-+	     }
-+	 }
-+    }
-+}
-+
-+static void check_for_dhcp_inotify(struct inotify_event *in, time_t now)
-+{
-+  struct hostsfile *ah;
-+
-+  /* ignore emacs backups and dotfiles */
-+  if (in->len == 0 || 
-+      in->name[in->len - 1] == '~' ||
-+      (in->name[0] == '#' && in->name[in->len - 1] == '#') ||
-+      in->name[0] == '.')
-+    return;
-+
-+  for (ah = daemon->inotify_hosts; ah; ah = ah->next)
-+    if (ah->wd == in->wd)
-+      {
-+	size_t lendir = strlen(ah->fname);
-+	char *path;
-+	   
-+	if ((path = whine_malloc(lendir + in->len + 2)))
-+	  {
-+	    strcpy(path, ah->fname);
-+	    strcat(path, "/");
-+	    strcat(path, in->name);
-+	    
-+	    if (option_read_hostsfile(path))
-+	      {
-+		/* Propogate the consequences of loading a new dhcp-host */
-+		dhcp_update_configs(daemon->dhcp_conf);
-+		lease_update_from_configs(); 
-+		lease_update_file(now); 
-+		lease_update_dns(1);
-+	      }
-+	    
-+	    free(path);
-+	  }
-+	
-+	return;
-+      }
-+}
-+
-+#endif /* DHCP */
-+
-+#endif  /* LINUX_NETWORK */
-   
-diff --git a/src/option.c b/src/option.c
-index 8b994098cc9f..22e11c37d374 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -149,7 +149,7 @@ struct myoption {
- #define LOPT_LOOP_DETECT   337
- #define LOPT_IGNORE_ADDR   338
- #define LOPT_MINCTTL       339
--
-+#define LOPT_DHCP_INOTIFY  340
- 
- #ifdef HAVE_GETOPT_LONG
- static const struct option opts[] =  
-@@ -248,6 +248,7 @@ static const struct myoption opts[] =
-     { "interface-name", 1, 0, LOPT_INTNAME },
-     { "dhcp-hostsfile", 1, 0, LOPT_DHCP_HOST },
-     { "dhcp-optsfile", 1, 0, LOPT_DHCP_OPTS },
-+    { "dhcp-hostsdir", 1, 0, LOPT_DHCP_INOTIFY },
-     { "dhcp-no-override", 0, 0, LOPT_OVERRIDE },
-     { "tftp-port-range", 1, 0, LOPT_TFTPPORTS },
-     { "stop-dns-rebind", 0, 0, LOPT_REBIND },
-@@ -336,6 +337,7 @@ static struct {
-   { 'G', ARG_DUP, "<hostspec>", gettext_noop("Set address or hostname for a specified machine."), NULL },
-   { LOPT_DHCP_HOST, ARG_DUP, "<path>", gettext_noop("Read DHCP host specs from file."), NULL },
-   { LOPT_DHCP_OPTS, ARG_DUP, "<path>", gettext_noop("Read DHCP option specs from file."), NULL },
-+  { LOPT_DHCP_INOTIFY, ARG_DUP, "<path>", gettext_noop("Read DHCP host specs from a directory."), NULL }, 
-   { LOPT_TAG_IF, ARG_DUP, "tag-expression", gettext_noop("Evaluate conditional tag expression."), NULL },
-   { 'h', OPT_NO_HOSTS, NULL, gettext_noop("Do NOT load %s file."), HOSTSFILE },
-   { 'H', ARG_DUP, "<path>", gettext_noop("Specify a hosts file to be read in addition to %s."), HOSTSFILE },
-@@ -1710,8 +1712,9 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
-       break;
- #endif /* HAVE_DHCP */
- 
--    case LOPT_DHCP_HOST: /* --dhcp-hostfile */
-+    case LOPT_DHCP_HOST: /* --dhcp-hostsfile */
-     case LOPT_DHCP_OPTS: /* --dhcp-optsfile */
-+    case LOPT_DHCP_INOTIFY: /* dhcp-hostsdir */
-     case 'H': /* --addn-hosts */
-       {
- 	struct hostsfile *new = opt_malloc(sizeof(struct hostsfile));
-@@ -1734,6 +1737,12 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	    new->next = daemon->dhcp_opts_file;
- 	    daemon->dhcp_opts_file = new;
- 	  } 	  
-+	else if (option == LOPT_DHCP_INOTIFY)
-+	  {
-+	    new->next = daemon->inotify_hosts;
-+	    daemon->inotify_hosts = new;
-+	  }
-+	
- 	break;
-       }
-       
-@@ -4042,6 +4051,13 @@ static void read_file(char *file, FILE *f, int hard_opt)
-   fclose(f);
- }
- 
-+#ifdef HAVE_DHCP
-+int option_read_hostsfile(char *file)
-+{
-+  return one_file(file, LOPT_BANK);
-+}
-+#endif
-+
- static int one_file(char *file, int hard_opt)
- {
-   FILE *f;
-@@ -4139,7 +4155,7 @@ struct hostsfile *expand_filelist(struct hostsfile *list)
- 	    
- 	    /* don't read this as a file */
- 	    ah->flags |= AH_INACTIVE;
--
-+	    
- 	    if (!(dir_stream = opendir(ah->fname)))
- 	      my_syslog(LOG_ERR, _("cannot access directory %s: %s"), 
- 			ah->fname, strerror(errno));
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0035-Update-German-translation.patch b/src/patches/dnsmasq/0035-Update-German-translation.patch
deleted file mode 100644
index af45a1c3e6..0000000000
--- a/src/patches/dnsmasq/0035-Update-German-translation.patch
+++ /dev/null
@@ -1,327 +0,0 @@
-From fbf01f7046e75f9aa73fd4aab2a94e43386d9052 Mon Sep 17 00:00:00 2001
-From: Conrad Kostecki <ck@conrad-kostecki.de>
-Date: Tue, 20 Jan 2015 21:07:56 +0000
-Subject: [PATCH 35/55] Update German translation.
-
----
- po/de.po | 101 +++++++++++++++++++++++++++++----------------------------------
- 1 file changed, 47 insertions(+), 54 deletions(-)
-
-diff --git a/po/de.po b/po/de.po
-index e2317376d8a9..4c93c5b28ef2 100644
---- a/po/de.po
-+++ b/po/de.po
-@@ -9,10 +9,10 @@
- # Simon Kelley <simon@thekelleys.org.uk>, 2005.
- msgid ""
- msgstr ""
--"Project-Id-Version: dnsmasq 2.70\n"
-+"Project-Id-Version: dnsmasq 2.73\n"
- "Report-Msgid-Bugs-To: \n"
- "POT-Creation-Date: 2009-06-18 12:24+0100\n"
--"PO-Revision-Date: 2014-05-01 22:51+0100\n"
-+"PO-Revision-Date: 2015-01-19 15:43+0100\n"
- "Last-Translator: Conrad Kostecki <ck@conrad-kostecki.de>\n"
- "Language-Team: German <de@li.org>\n"
- "Language: de\n"
-@@ -20,12 +20,12 @@ msgstr ""
- "Content-Type: text/plain; charset=UTF-8\n"
- "Content-Transfer-Encoding: 8bit\n"
- "Plural-Forms: nplurals=2; plural=(n != 1);\n"
--"X-Generator: Poedit 1.6.5\n"
-+"X-Generator: Poedit 1.7.3\n"
- "X-Poedit-SourceCharset: UTF-8\n"
- 
- #: cache.c:505
- msgid "Internal error in cache."
--msgstr ""
-+msgstr "Interner Fehler im Cache."
- 
- #: cache.c:908
- #, c-format
-@@ -126,7 +126,7 @@ msgstr "Lokale abzuhÃ¶rende Adresse(n) angeben."
- 
- #: option.c:319
- msgid "Return ipaddr for all hosts in specified domains."
--msgstr "IP-Adresse fÃ¼r alle Hosts in angebenen DomÃ¤nen festlegen."
-+msgstr "IP-Adresse fÃ¼r alle Hosts in angegebenen DomÃ¤nen festlegen."
- 
- # FIXME: the English test is not to the point. Just use a shortened description
- # from the manpage instead. -- MA
-@@ -310,18 +310,16 @@ msgid "Specify path to resolv.conf (defaults to %s)."
- msgstr "Pfad zu resolv.conf festlegen (%s voreingestellt)."
- 
- #: option.c:362
--#, fuzzy
- msgid "Specify path to file with server= options"
--msgstr "Dateipfad fÃ¼r Prozesskennung (PID) festlegen (Voreinstellung: %s)."
-+msgstr " Dateipfad mit der Option server= angeben"
- 
- #: option.c:363
- msgid "Specify address(es) of upstream servers with optional domains."
- msgstr "Adresse(n) vorgelagerter Server festlegen, optional mit DomÃ¤nen."
- 
- #: option.c:364
--#, fuzzy
- msgid "Specify address of upstream servers for reverse address queries"
--msgstr "Adresse(n) vorgelagerter Server festlegen, optional mit DomÃ¤nen."
-+msgstr "Adresse(n) vorgelagerter Server festlegen, fÃ¼r reverse Adressanfragen"
- 
- #: option.c:365
- msgid "Never forward queries to specified domains."
-@@ -657,23 +655,23 @@ msgstr "Spezifiziere eine Domain und Adressbereich fÃ¼r synthetisierte Namen"
- 
- #: option.c:446
- msgid "Activate DNSSEC validation"
--msgstr ""
-+msgstr "Aktiviere DNSSEC-Validierung"
- 
- #: option.c:447
- msgid "Specify trust anchor key digest."
--msgstr ""
-+msgstr "Spezifiziere Vertrauensursprung (Trust Anchor) der SchlÃ¼ssel-PrÃ¼fdaten (Key Digest)."
- 
- #: option.c:448
- msgid "Disable upstream checking for DNSSEC debugging."
--msgstr ""
-+msgstr "Deaktiviere die ÃberprÃ¼fung vorgelagerter Server fÃ¼r DNSSEC-Debugging"
- 
- #: option.c:449
- msgid "Ensure answers without DNSSEC are in unsigned zones."
--msgstr ""
-+msgstr "Stellt sicher, dass Antworten ohne DNSSEC sich in einer unsignierten Zone befinden."
- 
- #: option.c:450
- msgid "Don't check DNSSEC signature timestamps until first cache-reload"
--msgstr ""
-+msgstr "DNSSEC Signatur-Zeitstempel nicht prÃ¼fen, bis erstmalig der Cache neugeladen wird"
- 
- #: option.c:452
- msgid "Specify DHCPv6 prefix class"
-@@ -697,11 +695,11 @@ msgstr "RA nicht protokollieren."
- 
- #: option.c:458
- msgid "Accept queries only from directly-connected networks"
--msgstr ""
-+msgstr "Akzeptiere nur Anfragen von direkt verbundenen Netzwerken"
- 
- #: option.c:459
- msgid "Detect and remove DNS forwarding loops"
--msgstr ""
-+msgstr "Erkennen und Entfernen von DNS-Weiterleitungsschleifen"
- 
- #: option.c:661
- #, c-format
-@@ -958,18 +956,16 @@ msgid "Bad name in host-record"
- msgstr "UnzulÃ¤ssiger Name in host-record"
- 
- #: option.c:3826
--#, fuzzy
- msgid "bad trust anchor"
--msgstr "unzulÃ¤ssiger Portbereich"
-+msgstr "unzulÃ¤ssiger Vertrauensursprung (Trust Anchor)"
- 
- #: option.c:3840
- msgid "bad HEX in trust anchor"
--msgstr ""
-+msgstr "unzulÃ¤ssiger Hexwert in Vertrauensursprung (Trust Anchor)"
- 
- #: option.c:3850
--#, fuzzy
- msgid "unsupported option (check that dnsmasq was compiled with DHCP/TFTP/DNSSEC/DBus support)"
--msgstr "unzulÃ¤ssige Option (prÃ¼fen Sie, ob dnsmasq mit DHCP/TFTP/DBus-UnterstÃ¼tzt Ã¼bersetzt wurde)"
-+msgstr "Nicht unterstÃ¼tzte Option (prÃ¼fen Sie, ob DNSMasq mit DHCP/TFTP/DNSSEC/DBus-UnterstÃ¼tzung Ã¼bersetzt wurde)"
- 
- #: option.c:3909
- msgid "missing \""
-@@ -988,7 +984,6 @@ msgid "missing parameter"
- msgstr "fehler Parameter"
- 
- #: option.c:3972
--#, fuzzy
- msgid "illegal option"
- msgstr "unzulÃ¤ssige Option"
- 
-@@ -1110,7 +1105,7 @@ msgstr "mÃ¶glichen DNS-Rebind-Angriff entdeckt: %s"
- 
- #: forward.c:1132 forward.c:1663
- msgid "Ignoring query from non-local network"
--msgstr ""
-+msgstr "Ignoriere Anfragen vom nicht lokalen Netzwerk"
- 
- #: forward.c:2101
- #, c-format
-@@ -1189,9 +1184,9 @@ msgid "using nameserver %s#%d for %s %s"
- msgstr "Benutze Namensserver %s#%d fÃ¼r %s %s"
- 
- #: network.c:1483
--#, fuzzy, c-format
-+#, c-format
- msgid "NOT using nameserver %s#%d - query loop detected"
--msgstr "Benutze Namensserver %s#%d fÃ¼r %s %s"
-+msgstr "Benutze Namensserver %s#%d NICHT - Anfragenschleife festgetellt"
- 
- #: network.c:1486
- #, c-format
-@@ -1205,16 +1200,15 @@ msgstr "Benutze Namensserver %s#%d"
- 
- #: dnsmasq.c:154
- msgid "No trust anchors provided for DNSSEC"
--msgstr ""
-+msgstr "Keine VertrauensursprÃ¼nge (Trust Anchor) fÃ¼r DNSSEC verfÃ¼gbar"
- 
- #: dnsmasq.c:157
- msgid "Cannot reduce cache size from default when DNSSEC enabled"
--msgstr ""
-+msgstr "Kann die Standard CachegrÃ¶Ãe nicht verkleinern, wenn DNSSEC aktiviert ist"
- 
- #: dnsmasq.c:159
--#, fuzzy
- msgid "DNSSEC not available: set HAVE_DNSSEC in src/config.h"
--msgstr "DBus nicht verfÃ¼gbar: setzen Sie HAVE_DBUS in src/config.h"
-+msgstr "DNSSEC nicht verfÃ¼gbar: setzen Sie HAVE_DNSSEC in src/config.h"
- 
- #: dnsmasq.c:165
- msgid "TFTP server not available: set HAVE_TFTP in src/config.h"
-@@ -1241,9 +1235,8 @@ msgid "authoritative DNS not available: set HAVE_AUTH in src/config.h"
- msgstr "Authoritatives DNS nicht verfÃ¼gbar: Es muss HAVE_AUTH in src/config.h gesetzt sein"
- 
- #: dnsmasq.c:193
--#, fuzzy
- msgid "Loop detection not available: set HAVE_LOOP in src/config.h"
--msgstr "TFTP-Server nicht verfÃ¼gbar, setzen Sie HAVE_TFTP in src/config.h"
-+msgstr "Loop-Erkennung nicht verfÃ¼gbar, setzen Sie HAVE_LOOP in src/config.h"
- 
- #: dnsmasq.c:201
- msgid "zone serial must be configured in --auth-soa"
-@@ -1317,15 +1310,15 @@ msgstr "DBus-UnterstÃ¼tzung eingeschaltet: warte auf Systembus-Verbindung"
- 
- #: dnsmasq.c:672
- msgid "DNS service limited to local subnets"
--msgstr ""
-+msgstr "DNS-Dienst auf lokale Subnetze eingeschrÃ¤nkt"
- 
- #: dnsmasq.c:677
- msgid "DNSSEC validation enabled"
--msgstr ""
-+msgstr "DNSSEC-Validierung aktiviert"
- 
- #: dnsmasq.c:679
- msgid "DNSSEC signature timestamps not checked until first cache reload"
--msgstr ""
-+msgstr "DNSSEC Signatur-Zeitstempel werden erst ab dem ersten Neuladen des Caches Ã¼berprÃ¼ft"
- 
- #: dnsmasq.c:684
- #, c-format
-@@ -1366,7 +1359,7 @@ msgstr "DHCP, Sockets exklusiv an das Interface %s gebunden"
- # FIXME: this and the next few must be full strings to be translatable - do not assemble in code"
- #: dnsmasq.c:753
- msgid "root is "
--msgstr "Wurzel ist"
-+msgstr "Wurzel ist "
- 
- #: dnsmasq.c:753
- msgid "enabled"
-@@ -1432,7 +1425,7 @@ msgstr "Das TFTP-Verzeichnis %s ist nicht zugreifbar: %s"
- 
- #: dnsmasq.c:1151
- msgid "now checking DNSSEC signature timestamps"
--msgstr ""
-+msgstr "PrÃ¼fe jetzt DNSSEC Signatur-Zeitstempel"
- 
- #: dnsmasq.c:1218
- #, c-format
-@@ -1506,7 +1499,7 @@ msgstr "DHCP-Paket ohne Adresse an Schnittstelle %s empfangen"
- #: dhcp.c:408
- #, c-format
- msgid "ARP-cache injection failed: %s"
--msgstr ""
-+msgstr "APR-Cache Injektion fehlgeschlagen: %s"
- 
- #: dhcp.c:506
- #, c-format
-@@ -1763,13 +1756,13 @@ msgid "DHCP request for unsupported hardware type (%d) received on %s"
- msgstr "DHCP-Anfrage fÃ¼r nicht unterstÃ¼tzen Hardwaretyp (%d) auf %s empfangen"
- 
- #: bpf.c:376
--#, fuzzy, c-format
-+#, c-format
- msgid "cannot create PF_ROUTE socket: %s"
--msgstr "kann DHCP-Socket nicht erzeugen: %s"
-+msgstr "Kann PF_ROUTE socket nicht erzeugen: %s"
- 
- #: bpf.c:397
- msgid "Unknown protocol version from route socket"
--msgstr ""
-+msgstr "Unbekannte Protokollversion vom Route Socket"
- 
- #: helper.c:153
- msgid "lease() function missing in Lua script"
-@@ -2020,50 +2013,50 @@ msgstr "konnte IPset-Kontroll-Socket nicht erzeugen: %s"
- #: blockdata.c:58
- #, c-format
- msgid "DNSSEC memory in use %u, max %u, allocated %u"
--msgstr ""
-+msgstr "DNSSEC Speicher in Benutzung %u, Max %u, zugewiesen %u"
- 
- #: tables.c:76
- msgid "error: fill_addr missused"
--msgstr ""
-+msgstr "Fehler: fill_addr falsch verwendet"
- 
- #: tables.c:105
--#, fuzzy, c-format
-+#, c-format
- msgid "failed to access pf devices: %s"
--msgstr "konnte auf %s nicht zugreifen: %s"
-+msgstr "konnte auf pf GerÃ¤te nicht zugreifen: %s"
- 
- #: tables.c:119
--#, fuzzy, c-format
-+#, c-format
- msgid "warning: no opened pf devices %s"
--msgstr "Warnung: Keine Adresse fÃ¼r die Schnittstelle %s gefunden"
-+msgstr "Warnung: Keine geÃ¶ffneten pf GerÃ¤te %s"
- 
- #: tables.c:127
--#, fuzzy, c-format
-+#, c-format
- msgid "error: cannot use table name %s"
--msgstr "kann Hostnamen nicht ermitteln: %s"
-+msgstr "Fehler: Kann Tabellenname %s nicht benutzen"
- 
- #: tables.c:135
- #, c-format
- msgid "error: cannot strlcpy table name %s"
--msgstr ""
-+msgstr "Fehler: Kann den Tabellennamen %s nicht strlcpy"
- 
- #: tables.c:141
- #, c-format
- msgid "warning: pfr_add_tables: %s(%d)"
--msgstr ""
-+msgstr "Warnung: pfr_add_tables: %s(%d)"
- 
- #: tables.c:147
- msgid "info: table created"
--msgstr ""
-+msgstr "Info: Tabelle erstellt"
- 
- #: tables.c:158
- #, c-format
- msgid "warning: DIOCR%sADDRS: %s"
--msgstr ""
-+msgstr "Warnung: DIOCR%sADDRS: %s"
- 
- #: tables.c:162
--#, fuzzy, c-format
-+#, c-format
- msgid "%d addresses %s"
--msgstr "Fehlerhafte Adresse"
-+msgstr "%d Adressen %s"
- 
- #~ msgid "no interface with address %s"
- #~ msgstr "keine Schnittstelle mit Adresse %s"
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch b/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch
deleted file mode 100644
index 25007de58b..0000000000
--- a/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 61b838dd574c51d96fef100285a0d225824534f9 Mon Sep 17 00:00:00 2001
-From: Win King Wan <pinwing+dnsmasq@gmail.com>
-Date: Wed, 21 Jan 2015 20:41:48 +0000
-Subject: [PATCH 36/55] Don't reply to DHCPv6 SOLICIT messages when not
- configured for statefull DHCPv6.
-
----
- CHANGELOG     |  4 ++++
- src/rfc3315.c | 13 +++++++++++++
- 2 files changed, 17 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 0076b557e95e..a4cb901e83ae 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -59,6 +59,10 @@ version 2.73
- 	    cheaply than having dnsmasq re-read all its existing
- 	    configuration each time. 
- 	
-+	    Don't reply to DHCPv6 SOLICIT messages if we're not 
-+	    configured to do stateful DHCPv6. Thanks to Win King Wan 
-+	    for the patch.
-+
- 	
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index ddb390bf1136..e593ec9c362c 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -824,6 +824,19 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- 	  }
- 	else
- 	  { 
-+	    /* Windows 8 always requests an address even if the Managed bit
-+	       in RA is 0 and it keeps retrying if it receives a reply
-+	       stating that no addresses are available. We solve this 
-+	       by not replying at all if we're not configured to give any 
-+	       addresses by DHCPv6. RFC 3315 17.2.1. appears to allow this. */
-+	    
-+	    for (c = state->context; c; c = c->current)
-+	      if (!(c->flags & CONTEXT_RA_STATELESS))
-+		break;
-+	    
-+	    if (!c)
-+	      return 0;
-+	    
- 	    /* no address, return error */
- 	    o1 = new_opt6(OPTION6_STATUS_CODE);
- 	    put_opt6_short(DHCP6NOADDRS);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch b/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch
deleted file mode 100644
index 7318688716..0000000000
--- a/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch
+++ /dev/null
@@ -1,213 +0,0 @@
-From 0491805d2ff6e7727f0272c94fd97d9897d1e22c Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 26 Jan 2015 11:23:43 +0000
-Subject: [PATCH 37/55] Allow inotify to be disabled at compile time on Linux.
-
----
- CHANGELOG     |  4 +++-
- src/config.h  | 13 ++++++++++++-
- src/dnsmasq.c | 21 +++++++++++++--------
- src/dnsmasq.h | 11 +++++++----
- src/inotify.c |  4 ++--
- 5 files changed, 37 insertions(+), 16 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index a4cb901e83ae..c05dec63c587 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -9,7 +9,9 @@ version 2.73
- 
- 	    Use inotify for checking on updates to /etc/resolv.conf and
- 	    friends under Linux. This fixes race conditions when the files are 
--	    updated rapidly and saves CPU by noy polling.
-+	    updated rapidly and saves CPU by noy polling. To build
-+	    a binary that runs on old Linux kernels without inotify,
-+	    use make COPTS=-DNO_INOTIFY
- 
- 	    Fix breakage of --domain=<domain>,<subnet>,local - only reverse
- 	    queries were intercepted. THis appears to have been broken 
-diff --git a/src/config.h b/src/config.h
-index cdca231b4079..5e5009271eba 100644
---- a/src/config.h
-+++ b/src/config.h
-@@ -115,6 +115,8 @@ HAVE_DNSSEC
- HAVE_LOOP
-    include functionality to probe for and remove DNS forwarding loops.
- 
-+HAVE_INOTIFY
-+   use the Linux inotify facility to efficiently re-read configuration files.
- 
- NO_IPV6
- NO_TFTP
-@@ -123,6 +125,7 @@ NO_DHCP6
- NO_SCRIPT
- NO_LARGEFILE
- NO_AUTH
-+NO_INOTIFY
-    these are avilable to explictly disable compile time options which would 
-    otherwise be enabled automatically (HAVE_IPV6, >2Gb file sizes) or 
-    which are enabled  by default in the distributed source tree. Building dnsmasq
-@@ -355,6 +358,10 @@ HAVE_SOCKADDR_SA_LEN
- #undef HAVE_LOOP
- #endif
- 
-+#if defined (HAVE_LINUX_NETWORK) && !defined(NO_INOTIFY)
-+#define HAVE_INOTIFY
-+#endif
-+
- /* Define a string indicating which options are in use.
-    DNSMASQP_COMPILE_OPTS is only defined in dnsmasq.c */
- 
-@@ -428,7 +435,11 @@ static char *compile_opts =
- #ifndef HAVE_LOOP
- "no-"
- #endif
--"loop-detect";
-+"loop-detect "
-+#ifndef HAVE_INOTIFY
-+"no-"
-+#endif
-+"inotify";
- 
- 
- #endif
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index 04cc98278f62..bc4f47170705 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -142,7 +142,9 @@ int main (int argc, char **argv)
-       set_option_bool(OPT_NOWILD);
-       reset_option_bool(OPT_CLEVERBIND);
-     }
-+#endif
- 
-+#ifndef HAVE_INOTIFY
-   if (daemon->inotify_hosts)
-     die(_("dhcp-hostsdir not supported on this platform"), NULL, EC_BADCONF);
- #endif
-@@ -321,7 +323,7 @@ int main (int argc, char **argv)
- #endif
-     }
- 
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-   if ((!option_bool(OPT_NO_POLL) && daemon->port != 0) ||
-       daemon->dhcp || daemon->doing_dhcp6)
-     inotify_dnsmasq_init();
-@@ -802,7 +804,7 @@ int main (int argc, char **argv)
-   
-   pid = getpid();
-   
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-   /* Using inotify, have to select a resolv file at startup */
-   poll_resolv(1, 0, now);
- #endif
-@@ -872,15 +874,18 @@ int main (int argc, char **argv)
- 	  bump_maxfd(daemon->icmp6fd, &maxfd); 
- 	}
- #endif
--
--#if defined(HAVE_LINUX_NETWORK)
--      FD_SET(daemon->netlinkfd, &rset);
--      bump_maxfd(daemon->netlinkfd, &maxfd);
-+    
-+#ifdef HAVE_INOTIFY
-       if (daemon->inotifyfd != -1)
- 	{
- 	  FD_SET(daemon->inotifyfd, &rset);
- 	  bump_maxfd(daemon->inotifyfd, &maxfd);
- 	}
-+#endif
-+
-+#if defined(HAVE_LINUX_NETWORK)
-+      FD_SET(daemon->netlinkfd, &rset);
-+      bump_maxfd(daemon->netlinkfd, &maxfd);
- #elif defined(HAVE_BSD_NETWORK)
-       FD_SET(daemon->routefd, &rset);
-       bump_maxfd(daemon->routefd, &maxfd);
-@@ -948,7 +953,7 @@ int main (int argc, char **argv)
- 	route_sock();
- #endif
- 
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-       if  (daemon->inotifyfd != -1 && FD_ISSET(daemon->inotifyfd, &rset) && inotify_check(now))
- 	{
- 	  if (daemon->port != 0 && !option_bool(OPT_NO_POLL))
-@@ -1394,7 +1399,7 @@ void clear_cache_and_reload(time_t now)
-       if (option_bool(OPT_ETHERS))
- 	dhcp_read_ethers();
-       reread_dhcp();
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-       set_dhcp_inotify();
- #endif
-       dhcp_update_configs(daemon->dhcp_conf);
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index d841fdc064ad..8091634f69db 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -544,7 +544,7 @@ struct resolvc {
-   int is_default, logged;
-   time_t mtime;
-   char *name;
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-   int wd; /* inotify watch descriptor */
-   char *file; /* pointer to file part if path */
- #endif
-@@ -558,7 +558,7 @@ struct hostsfile {
-   struct hostsfile *next;
-   int flags;
-   char *fname;
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
-   int wd; /* inotify watch descriptor */
- #endif
-   unsigned int index; /* matches to cache entries for logging */
-@@ -1013,8 +1013,11 @@ extern struct daemon {
- 
-   /* DHCP state */
-   int dhcpfd, helperfd, pxefd; 
-+#ifdef HAVE_INOTIFY
-+  int inotifyfd;
-+#endif
- #if defined(HAVE_LINUX_NETWORK)
--  int netlinkfd, inotifyfd;
-+  int netlinkfd;
- #elif defined(HAVE_BSD_NETWORK)
-   int dhcp_raw_fd, dhcp_icmp_fd, routefd;
- #endif
-@@ -1488,7 +1491,7 @@ int detect_loop(char *query, int type);
- #endif
- 
- /* inotify.c */
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
- void inotify_dnsmasq_init();
- int inotify_check(time_t now);
- #  ifdef HAVE_DHCP
-diff --git a/src/inotify.c b/src/inotify.c
-index 52a30d7f44db..818fe8eddda4 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -15,7 +15,7 @@
- */
- 
- #include "dnsmasq.h"
--#ifdef HAVE_LINUX_NETWORK
-+#ifdef HAVE_INOTIFY
- 
- #include <sys/inotify.h>
- 
-@@ -216,5 +216,5 @@ static void check_for_dhcp_inotify(struct inotify_event *in, time_t now)
- 
- #endif /* DHCP */
- 
--#endif  /* LINUX_NETWORK */
-+#endif  /* INOTIFY */
-   
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch b/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch
deleted file mode 100644
index 75140347bd..0000000000
--- a/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch
+++ /dev/null
@@ -1,562 +0,0 @@
-From 70d1873dd9e70041ed4bb88c69d5b886b7cc634c Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 31 Jan 2015 19:59:29 +0000
-Subject: [PATCH 38/55] Expand inotify code to dhcp-hostsdir, dhcp-optsdir and
- hostsdir.
-
----
- src/cache.c   |  81 +++++++++++++++++---------
- src/dnsmasq.c |   9 ++-
- src/dnsmasq.h |  14 +++--
- src/inotify.c | 179 +++++++++++++++++++++++++++++-----------------------------
- src/option.c  |  37 +++++++++---
- 5 files changed, 187 insertions(+), 133 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index 09b6dbf8087a..abaf25ec0f18 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -835,27 +835,42 @@ static void add_hosts_entry(struct crec *cache, struct all_addr *addr, int addrl
-      Only insert each unique address once into this hashing structure.
- 
-      This complexity avoids O(n^2) divergent CPU use whilst reading
--     large (10000 entry) hosts files. */
--  
--  /* hash address */
--  for (j = 0, i = 0; i < addrlen; i++)
--    j = (j*2 +((unsigned char *)addr)[i]) % hashsz;
--  
--  for (lookup = rhash[j]; lookup; lookup = lookup->next)
--    if ((lookup->flags & cache->flags & (F_IPV4 | F_IPV6)) &&
--	memcmp(&lookup->addr.addr, addr, addrlen) == 0)
--      {
--	cache->flags &= ~F_REVERSE;
--	break;
--      }
-+     large (10000 entry) hosts files. 
-+
-+     Note that we only do this process when bulk-reading hosts files, 
-+     for incremental reads, rhash is NULL, and we use cache lookups
-+     instead.
-+  */
-   
--  /* maintain address hash chain, insert new unique address */
--  if (!lookup)
-+  if (rhash)
-     {
--      cache->next = rhash[j];
--      rhash[j] = cache;
-+      /* hash address */
-+      for (j = 0, i = 0; i < addrlen; i++)
-+	j = (j*2 +((unsigned char *)addr)[i]) % hashsz;
-+      
-+      for (lookup = rhash[j]; lookup; lookup = lookup->next)
-+	if ((lookup->flags & cache->flags & (F_IPV4 | F_IPV6)) &&
-+	    memcmp(&lookup->addr.addr, addr, addrlen) == 0)
-+	  {
-+	    cache->flags &= ~F_REVERSE;
-+	    break;
-+	  }
-+      
-+      /* maintain address hash chain, insert new unique address */
-+      if (!lookup)
-+	{
-+	  cache->next = rhash[j];
-+	  rhash[j] = cache;
-+	}
-     }
--  
-+  else
-+    {
-+      /* incremental read, lookup in cache */
-+      lookup = cache_find_by_addr(NULL, addr, 0, cache->flags & (F_IPV4 | F_IPV6));
-+      if (lookup && lookup->flags & F_HOSTS)
-+	cache->flags &= ~F_REVERSE;
-+    }
-+
-   cache->uid = index;
-   memcpy(&cache->addr.addr, addr, addrlen);  
-   cache_hash(cache);
-@@ -912,7 +927,7 @@ static int gettok(FILE *f, char *token)
-     }
- }
- 
--static int read_hostsfile(char *filename, unsigned int index, int cache_size, struct crec **rhash, int hashsz)
-+int read_hostsfile(char *filename, unsigned int index, int cache_size, struct crec **rhash, int hashsz)
- {  
-   FILE *f = fopen(filename, "r");
-   char *token = daemon->namebuff, *domain_suffix = NULL;
-@@ -958,7 +973,7 @@ static int read_hostsfile(char *filename, unsigned int index, int cache_size, st
-       addr_count++;
-       
-       /* rehash every 1000 names. */
--      if ((name_count - cache_size) > 1000)
-+      if (rhash && ((name_count - cache_size) > 1000))
- 	{
- 	  rehash(name_count);
- 	  cache_size = name_count;
-@@ -1005,10 +1020,13 @@ static int read_hostsfile(char *filename, unsigned int index, int cache_size, st
-     } 
- 
-   fclose(f);
--  rehash(name_count);
--  
--  my_syslog(LOG_INFO, _("read %s - %d addresses"), filename, addr_count);
-   
-+  if (rhash)
-+    {
-+      rehash(name_count); 
-+      my_syslog(LOG_INFO, _("read %s - %d addresses"), filename, addr_count);
-+    }
-+
-   return name_count;
- }
- 	    
-@@ -1118,14 +1136,19 @@ void cache_reload(void)
- 	my_syslog(LOG_INFO, _("cleared cache"));
-       return;
-     }
--    
-+  
-   if (!option_bool(OPT_NO_HOSTS))
-     total_size = read_hostsfile(HOSTSFILE, SRC_HOSTS, total_size, (struct crec **)daemon->packet, revhashsz);
--  	   
-+  
-   daemon->addn_hosts = expand_filelist(daemon->addn_hosts);
-   for (ah = daemon->addn_hosts; ah; ah = ah->next)
-     if (!(ah->flags & AH_INACTIVE))
-       total_size = read_hostsfile(ah->fname, ah->index, total_size, (struct crec **)daemon->packet, revhashsz);
-+  
-+#ifdef HAVE_INOTIFY
-+  set_dynamic_inotify(AH_HOSTS, total_size, (struct crec **)daemon->packet, revhashsz);
-+#endif
-+  
- } 
- 
- #ifdef HAVE_DHCP
-@@ -1505,7 +1528,13 @@ char *record_source(unsigned int index)
-   for (ah = daemon->addn_hosts; ah; ah = ah->next)
-     if (ah->index == index)
-       return ah->fname;
--  
-+
-+#ifdef HAVE_INOTIFY
-+  for (ah = daemon->dynamic_dirs; ah; ah = ah->next)
-+     if (ah->index == index)
-+       return ah->fname;
-+#endif
-+
-   return "<unknown>";
- }
- 
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index bc4f47170705..2c629fe422aa 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -145,8 +145,8 @@ int main (int argc, char **argv)
- #endif
- 
- #ifndef HAVE_INOTIFY
--  if (daemon->inotify_hosts)
--    die(_("dhcp-hostsdir not supported on this platform"), NULL, EC_BADCONF);
-+  if (daemon->dynamic_dirs)
-+    die(_("dhcp-hostsdir, dhcp-optsdir and hostsdir are not supported on this platform"), NULL, EC_BADCONF);
- #endif
-   
-   if (option_bool(OPT_DNSSEC_VALID))
-@@ -324,8 +324,7 @@ int main (int argc, char **argv)
-     }
- 
- #ifdef HAVE_INOTIFY
--  if ((!option_bool(OPT_NO_POLL) && daemon->port != 0) ||
--      daemon->dhcp || daemon->doing_dhcp6)
-+  if (daemon->port != 0 || daemon->dhcp || daemon->doing_dhcp6)
-     inotify_dnsmasq_init();
-   else
-     daemon->inotifyfd = -1;
-@@ -1400,7 +1399,7 @@ void clear_cache_and_reload(time_t now)
- 	dhcp_read_ethers();
-       reread_dhcp();
- #ifdef HAVE_INOTIFY
--      set_dhcp_inotify();
-+      set_dynamic_inotify(AH_DHCP_HST | AH_DHCP_OPT, 0, NULL, 0);
- #endif
-       dhcp_update_configs(daemon->dhcp_conf);
-       lease_update_from_configs(); 
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 8091634f69db..0c322a93993e 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -554,6 +554,9 @@ struct resolvc {
- #define AH_DIR      1
- #define AH_INACTIVE 2
- #define AH_WD_DONE  4
-+#define AH_HOSTS    8
-+#define AH_DHCP_HST 16
-+#define AH_DHCP_OPT 32
- struct hostsfile {
-   struct hostsfile *next;
-   int flags;
-@@ -965,7 +968,7 @@ extern struct daemon {
-   int doing_ra, doing_dhcp6;
-   struct dhcp_netid_list *dhcp_ignore, *dhcp_ignore_names, *dhcp_gen_names; 
-   struct dhcp_netid_list *force_broadcast, *bootp_dynamic;
--  struct hostsfile *dhcp_hosts_file, *dhcp_opts_file, *inotify_hosts;
-+  struct hostsfile *dhcp_hosts_file, *dhcp_opts_file, *dynamic_dirs;
-   int dhcp_max, tftp_max;
-   int dhcp_server_port, dhcp_client_port;
-   int start_tftp_port, end_tftp_port; 
-@@ -1071,6 +1074,8 @@ int cache_make_stat(struct txt_record *t);
- char *cache_get_name(struct crec *crecp);
- char *cache_get_cname_target(struct crec *crecp);
- struct crec *cache_enumerate(int init);
-+int read_hostsfile(char *filename, unsigned int index, int cache_size, 
-+		   struct crec **rhash, int hashsz);
- 
- /* blockdata.c */
- #ifdef HAVE_DNSSEC
-@@ -1204,7 +1209,8 @@ void reset_option_bool(unsigned int opt);
- struct hostsfile *expand_filelist(struct hostsfile *list);
- char *parse_server(char *arg, union mysockaddr *addr, 
- 		   union mysockaddr *source_addr, char *interface, int *flags);
--int option_read_hostsfile(char *file);
-+int option_read_dynfile(char *file, int flags);
-+
- /* forward.c */
- void reply_query(int fd, int family, time_t now);
- void receive_query(struct listener *listen, time_t now);
-@@ -1494,7 +1500,5 @@ int detect_loop(char *query, int type);
- #ifdef HAVE_INOTIFY
- void inotify_dnsmasq_init();
- int inotify_check(time_t now);
--#  ifdef HAVE_DHCP
--void set_dhcp_inotify(void);
--#  endif
-+void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revhashsz);
- #endif
-diff --git a/src/inotify.c b/src/inotify.c
-index 818fe8eddda4..c537f4c1562a 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -19,11 +19,6 @@
- 
- #include <sys/inotify.h>
- 
--#ifdef HAVE_DHCP
--static void check_for_dhcp_inotify(struct inotify_event *in, time_t now);
--#endif
--
--
- /* the strategy is to set a inotify on the directories containing
-    resolv files, for any files in the directory which are close-write 
-    or moved into the directory.
-@@ -82,57 +77,28 @@ void inotify_dnsmasq_init()
-     }
- }
- 
--int inotify_check(time_t now)
-+
-+/* initialisation for dynamic-dir. Set inotify watch for each directory, and read pre-existing files */
-+void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revhashsz)
- {
--  int hit = 0;
-+  struct hostsfile *ah;
-   
--  while (1)
-+  for (ah = daemon->dynamic_dirs; ah; ah = ah->next)
-     {
--      int rc;
--      char *p;
--      struct resolvc *res;
--      struct inotify_event *in;
--
--      while ((rc = read(daemon->inotifyfd, inotify_buffer, INOTIFY_SZ)) == -1 && errno == EINTR);
--      
--      if (rc <= 0)
--	break;
--      
--      for (p = inotify_buffer; rc - (p - inotify_buffer) >= (int)sizeof(struct inotify_event); p += sizeof(struct inotify_event) + in->len) 
-+      DIR *dir_stream = NULL;
-+      struct dirent *ent;
-+      struct stat buf;
-+     
-+      if (!(ah->flags & flag))
-+	continue;
-+ 
-+      if (stat(ah->fname, &buf) == -1 || !(S_ISDIR(buf.st_mode)))
- 	{
--	  in = (struct inotify_event*)p;
--	  
--	  for (res = daemon->resolv_files; res; res = res->next)
--	    if (res->wd == in->wd && in->len != 0 && strcmp(res->file, in->name) == 0)
--	      hit = 1;
--
--#ifdef HAVE_DHCP
--	  if (daemon->dhcp || daemon->doing_dhcp6)
--	    check_for_dhcp_inotify(in, now);
--#endif
-+	  my_syslog(LOG_ERR, _("bad dynamic directory %s: %s"), 
-+		    ah->fname, strerror(errno));
-+	  continue;
- 	}
--    }
--  return hit;
--}
--
--#ifdef HAVE_DHCP 
--/* initialisation for dhcp-hostdir. Set inotify watch for each directory, and read pre-existing files */
--void set_dhcp_inotify(void)
--{
--  struct hostsfile *ah;
--
--  for (ah = daemon->inotify_hosts; ah; ah = ah->next)
--    {
--       DIR *dir_stream = NULL;
--       struct dirent *ent;
--       struct stat buf;
--
--       if (stat(ah->fname, &buf) == -1 || !(S_ISDIR(buf.st_mode)))
--	 {
--	   my_syslog(LOG_ERR, _("bad directory in dhcp-hostsdir %s"), ah->fname);
--	   continue;
--	 }
--
-+      
-        if (!(ah->flags & AH_WD_DONE))
- 	 {
- 	   ah->wd = inotify_add_watch(daemon->inotifyfd, ah->fname, IN_CLOSE_WRITE | IN_MOVED_TO);
-@@ -142,7 +108,8 @@ void set_dhcp_inotify(void)
- 	  a race which misses files being added as we start */
-        if (ah->wd == -1 || !(dir_stream = opendir(ah->fname)))
- 	 {
--	   my_syslog(LOG_ERR, _("failed to create inotify for %s"), ah->fname);
-+	   my_syslog(LOG_ERR, _("failed to create inotify for %s: %s"),
-+		     ah->fname, strerror(errno));
- 	   continue;
- 	 }
- 
-@@ -167,54 +134,90 @@ void set_dhcp_inotify(void)
- 	       
- 	       /* ignore non-regular files */
- 	       if (stat(path, &buf) != -1 && S_ISREG(buf.st_mode))
--		 option_read_hostsfile(path);
--	       
-+		 {
-+		   if (ah->flags & AH_HOSTS)
-+		     total_size = read_hostsfile(path, ah->index, total_size, rhash, revhashsz);
-+#ifdef HAVE_DHCP
-+		   else if (ah->flags & (AH_DHCP_HST | AH_DHCP_OPT))
-+		     option_read_dynfile(path, ah->flags);
-+#endif		   
-+		 }
-+
- 	       free(path);
- 	     }
- 	 }
-     }
- }
- 
--static void check_for_dhcp_inotify(struct inotify_event *in, time_t now)
-+int inotify_check(time_t now)
- {
-+  int hit = 0;
-   struct hostsfile *ah;
- 
--  /* ignore emacs backups and dotfiles */
--  if (in->len == 0 || 
--      in->name[in->len - 1] == '~' ||
--      (in->name[0] == '#' && in->name[in->len - 1] == '#') ||
--      in->name[0] == '.')
--    return;
--
--  for (ah = daemon->inotify_hosts; ah; ah = ah->next)
--    if (ah->wd == in->wd)
--      {
--	size_t lendir = strlen(ah->fname);
--	char *path;
--	   
--	if ((path = whine_malloc(lendir + in->len + 2)))
--	  {
--	    strcpy(path, ah->fname);
--	    strcat(path, "/");
--	    strcat(path, in->name);
--	    
--	    if (option_read_hostsfile(path))
-+  while (1)
-+    {
-+      int rc;
-+      char *p;
-+      struct resolvc *res;
-+      struct inotify_event *in;
-+
-+      while ((rc = read(daemon->inotifyfd, inotify_buffer, INOTIFY_SZ)) == -1 && errno == EINTR);
-+      
-+      if (rc <= 0)
-+	break;
-+      
-+      for (p = inotify_buffer; rc - (p - inotify_buffer) >= (int)sizeof(struct inotify_event); p += sizeof(struct inotify_event) + in->len) 
-+	{
-+	  in = (struct inotify_event*)p;
-+	  
-+	  for (res = daemon->resolv_files; res; res = res->next)
-+	    if (res->wd == in->wd && in->len != 0 && strcmp(res->file, in->name) == 0)
-+	      hit = 1;
-+
-+	  /* ignore emacs backups and dotfiles */
-+	  if (in->len == 0 || 
-+	      in->name[in->len - 1] == '~' ||
-+	      (in->name[0] == '#' && in->name[in->len - 1] == '#') ||
-+	      in->name[0] == '.')
-+	    continue;
-+	  
-+	  for (ah = daemon->dynamic_dirs; ah; ah = ah->next)
-+	    if (ah->wd == in->wd)
- 	      {
--		/* Propogate the consequences of loading a new dhcp-host */
--		dhcp_update_configs(daemon->dhcp_conf);
--		lease_update_from_configs(); 
--		lease_update_file(now); 
--		lease_update_dns(1);
-+		size_t lendir = strlen(ah->fname);
-+		char *path;
-+		
-+		if ((path = whine_malloc(lendir + in->len + 2)))
-+		  {
-+		    strcpy(path, ah->fname);
-+		    strcat(path, "/");
-+		    strcat(path, in->name);
-+		    
-+		    if (ah->flags & AH_HOSTS)
-+		      read_hostsfile(path, ah->index, 0, NULL, 0);
-+#ifdef HAVE_DHCP
-+		    else if (ah->flags & AH_DHCP_HST)
-+		      {
-+			if (option_read_dynfile(path, AH_DHCP_HST))
-+			  {
-+			    /* Propogate the consequences of loading a new dhcp-host */
-+			    dhcp_update_configs(daemon->dhcp_conf);
-+			    lease_update_from_configs(); 
-+			    lease_update_file(now); 
-+			    lease_update_dns(1);
-+			  }
-+		      }
-+		    else if (ah->flags & AH_DHCP_OPT)
-+		      option_read_dynfile(path, AH_DHCP_OPT);
-+#endif
-+		    
-+		    free(path);
-+		  }
- 	      }
--	    
--	    free(path);
--	  }
--	
--	return;
--      }
-+	}
-+    }
-+  return hit;
- }
- 
--#endif /* DHCP */
--
- #endif  /* INOTIFY */
-   
-diff --git a/src/option.c b/src/option.c
-index 22e11c37d374..6ef80117cc8c 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -150,6 +150,8 @@ struct myoption {
- #define LOPT_IGNORE_ADDR   338
- #define LOPT_MINCTTL       339
- #define LOPT_DHCP_INOTIFY  340
-+#define LOPT_DHOPT_INOTIFY 341
-+#define LOPT_HOST_INOTIFY  342
- 
- #ifdef HAVE_GETOPT_LONG
- static const struct option opts[] =  
-@@ -200,6 +202,7 @@ static const struct myoption opts[] =
-     { "local-ttl", 1, 0, 'T' },
-     { "no-negcache", 0, 0, 'N' },
-     { "addn-hosts", 1, 0, 'H' },
-+    { "hostsdir", 1, 0, LOPT_HOST_INOTIFY },
-     { "query-port", 1, 0, 'Q' },
-     { "except-interface", 1, 0, 'I' },
-     { "no-dhcp-interface", 1, 0, '2' },
-@@ -249,6 +252,7 @@ static const struct myoption opts[] =
-     { "dhcp-hostsfile", 1, 0, LOPT_DHCP_HOST },
-     { "dhcp-optsfile", 1, 0, LOPT_DHCP_OPTS },
-     { "dhcp-hostsdir", 1, 0, LOPT_DHCP_INOTIFY },
-+    { "dhcp-optsdir", 1, 0, LOPT_DHOPT_INOTIFY },
-     { "dhcp-no-override", 0, 0, LOPT_OVERRIDE },
-     { "tftp-port-range", 1, 0, LOPT_TFTPPORTS },
-     { "stop-dns-rebind", 0, 0, LOPT_REBIND },
-@@ -338,9 +342,11 @@ static struct {
-   { LOPT_DHCP_HOST, ARG_DUP, "<path>", gettext_noop("Read DHCP host specs from file."), NULL },
-   { LOPT_DHCP_OPTS, ARG_DUP, "<path>", gettext_noop("Read DHCP option specs from file."), NULL },
-   { LOPT_DHCP_INOTIFY, ARG_DUP, "<path>", gettext_noop("Read DHCP host specs from a directory."), NULL }, 
-+  { LOPT_DHOPT_INOTIFY, ARG_DUP, "<path>", gettext_noop("Read DHCP options from a directory."), NULL }, 
-   { LOPT_TAG_IF, ARG_DUP, "tag-expression", gettext_noop("Evaluate conditional tag expression."), NULL },
-   { 'h', OPT_NO_HOSTS, NULL, gettext_noop("Do NOT load %s file."), HOSTSFILE },
-   { 'H', ARG_DUP, "<path>", gettext_noop("Specify a hosts file to be read in addition to %s."), HOSTSFILE },
-+  { LOPT_HOST_INOTIFY, ARG_DUP, "<path>", gettext_noop("Read hosts files from a directory."), NULL },
-   { 'i', ARG_DUP, "<interface>", gettext_noop("Specify interface(s) to listen on."), NULL },
-   { 'I', ARG_DUP, "<interface>", gettext_noop("Specify interface(s) NOT to listen on.") , NULL },
-   { 'j', ARG_DUP, "set:<tag>,<class>", gettext_noop("Map DHCP user class to tag."), NULL },
-@@ -1712,10 +1718,12 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
-       break;
- #endif /* HAVE_DHCP */
- 
--    case LOPT_DHCP_HOST: /* --dhcp-hostsfile */
--    case LOPT_DHCP_OPTS: /* --dhcp-optsfile */
--    case LOPT_DHCP_INOTIFY: /* dhcp-hostsdir */
--    case 'H': /* --addn-hosts */
-+    case LOPT_DHCP_HOST:     /* --dhcp-hostsfile */
-+    case LOPT_DHCP_OPTS:     /* --dhcp-optsfile */
-+    case LOPT_DHCP_INOTIFY:  /* --dhcp-hostsdir */
-+    case LOPT_DHOPT_INOTIFY: /* --dhcp-optsdir */
-+    case LOPT_HOST_INOTIFY:  /* --hostsdir */
-+    case 'H':                /* --addn-hosts */
-       {
- 	struct hostsfile *new = opt_malloc(sizeof(struct hostsfile));
- 	static unsigned int hosts_index = SRC_AH;
-@@ -1737,10 +1745,16 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
- 	    new->next = daemon->dhcp_opts_file;
- 	    daemon->dhcp_opts_file = new;
- 	  } 	  
--	else if (option == LOPT_DHCP_INOTIFY)
-+	else 
- 	  {
--	    new->next = daemon->inotify_hosts;
--	    daemon->inotify_hosts = new;
-+	    new->next = daemon->dynamic_dirs;
-+	    daemon->dynamic_dirs = new; 
-+	    if (option == LOPT_DHCP_INOTIFY)
-+	      new->flags |= AH_DHCP_HST;
-+	    else if (option == LOPT_DHOPT_INOTIFY)
-+	      new->flags |= AH_DHCP_OPT;
-+	    else if (option == LOPT_HOST_INOTIFY)
-+	      new->flags |= AH_HOSTS;
- 	  }
- 	
- 	break;
-@@ -4052,9 +4066,14 @@ static void read_file(char *file, FILE *f, int hard_opt)
- }
- 
- #ifdef HAVE_DHCP
--int option_read_hostsfile(char *file)
-+int option_read_dynfile(char *file, int flags)
- {
--  return one_file(file, LOPT_BANK);
-+  if (flags & AH_DHCP_HST)
-+    return one_file(file, LOPT_BANK);
-+  else if (flags & AH_DHCP_OPT)
-+    return one_file(file, LOPT_OPTS);
-+
-+  return 0;
- }
- #endif
- 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch b/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch
deleted file mode 100644
index 11bde00b06..0000000000
--- a/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch
+++ /dev/null
@@ -1,428 +0,0 @@
-From aff3396280e944833f0e23d834aa6acd5fe2605a Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 31 Jan 2015 20:13:40 +0000
-Subject: [PATCH 39/55] Update copyrights for dawn of 2015.
-
----
- Makefile             | 2 +-
- src/auth.c           | 2 +-
- src/blockdata.c      | 2 +-
- src/bpf.c            | 2 +-
- src/cache.c          | 2 +-
- src/config.h         | 2 +-
- src/conntrack.c      | 2 +-
- src/dbus.c           | 2 +-
- src/dhcp-common.c    | 2 +-
- src/dhcp-protocol.h  | 2 +-
- src/dhcp.c           | 2 +-
- src/dhcp6-protocol.h | 2 +-
- src/dhcp6.c          | 2 +-
- src/dns-protocol.h   | 2 +-
- src/dnsmasq.c        | 2 +-
- src/dnsmasq.h        | 4 ++--
- src/dnssec.c         | 2 +-
- src/domain.c         | 2 +-
- src/forward.c        | 2 +-
- src/helper.c         | 2 +-
- src/inotify.c        | 2 +-
- src/ip6addr.h        | 2 +-
- src/lease.c          | 2 +-
- src/log.c            | 2 +-
- src/loop.c           | 2 +-
- src/netlink.c        | 2 +-
- src/network.c        | 2 +-
- src/option.c         | 2 +-
- src/outpacket.c      | 2 +-
- src/radv-protocol.h  | 2 +-
- src/radv.c           | 2 +-
- src/rfc1035.c        | 2 +-
- src/rfc2131.c        | 2 +-
- src/rfc3315.c        | 2 +-
- src/slaac.c          | 2 +-
- src/tftp.c           | 2 +-
- src/util.c           | 2 +-
- 37 files changed, 38 insertions(+), 38 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index bcbd5571671d..21e4a5c4101c 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,4 +1,4 @@
--# dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+# dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- #
- #  This program is free software; you can redistribute it and/or modify
- #  it under the terms of the GNU General Public License as published by
-diff --git a/src/auth.c b/src/auth.c
-index 59e05d3da38e..15721e52793f 100644
---- a/src/auth.c
-+++ b/src/auth.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/blockdata.c b/src/blockdata.c
-index 5a70a7967fa3..c8f5eae811eb 100644
---- a/src/blockdata.c
-+++ b/src/blockdata.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/bpf.c b/src/bpf.c
-index 4416b1c07287..997d87421bed 100644
---- a/src/bpf.c
-+++ b/src/bpf.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/cache.c b/src/cache.c
-index abaf25ec0f18..117ae279fd4e 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/config.h b/src/config.h
-index 5e5009271eba..8def6f200461 100644
---- a/src/config.h
-+++ b/src/config.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/conntrack.c b/src/conntrack.c
-index 6a5133ab93af..0fa2da903b03 100644
---- a/src/conntrack.c
-+++ b/src/conntrack.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dbus.c b/src/dbus.c
-index a2a94dc85dac..5b69de518beb 100644
---- a/src/dbus.c
-+++ b/src/dbus.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dhcp-common.c b/src/dhcp-common.c
-index 9d13ac8df6f1..ce115202a646 100644
---- a/src/dhcp-common.c
-+++ b/src/dhcp-common.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dhcp-protocol.h b/src/dhcp-protocol.h
-index 4c0961472482..701b6cb3346e 100644
---- a/src/dhcp-protocol.h
-+++ b/src/dhcp-protocol.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dhcp.c b/src/dhcp.c
-index 7acf2c4311a9..f29be9b489a7 100644
---- a/src/dhcp.c
-+++ b/src/dhcp.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dhcp6-protocol.h b/src/dhcp6-protocol.h
-index 5927dc32f6af..928a2fa162ed 100644
---- a/src/dhcp6-protocol.h
-+++ b/src/dhcp6-protocol.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dhcp6.c b/src/dhcp6.c
-index bc48fdddd3de..3c56e77c6085 100644
---- a/src/dhcp6.c
-+++ b/src/dhcp6.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dns-protocol.h b/src/dns-protocol.h
-index 0aced3ce6952..16fade33d98c 100644
---- a/src/dns-protocol.h
-+++ b/src/dns-protocol.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index 2c629fe422aa..e903a24c8105 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 0c322a93993e..89e758b56a0a 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
-  
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-@@ -14,7 +14,7 @@
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
- 
--#define COPYRIGHT "Copyright (c) 2000-2014 Simon Kelley" 
-+#define COPYRIGHT "Copyright (c) 2000-2015 Simon Kelley" 
- 
- #ifndef NO_LARGEFILE
- /* Ensure we can use files >2GB (log files may grow this big) */
-diff --git a/src/dnssec.c b/src/dnssec.c
-index d39ab85ed966..a8dfe3871c85 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -1,5 +1,5 @@
- /* dnssec.c is Copyright (c) 2012 Giovanni Bajo <rasky@develer.com>
--           and Copyright (c) 2012-2014 Simon Kelley
-+           and Copyright (c) 2012-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/domain.c b/src/domain.c
-index fdd5e4f0838f..278698ca04b3 100644
---- a/src/domain.c
-+++ b/src/domain.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/forward.c b/src/forward.c
-index b17bc34f865f..438e9fa490b8 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/helper.c b/src/helper.c
-index 4be53c361ee1..1fee72dead8c 100644
---- a/src/helper.c
-+++ b/src/helper.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/inotify.c b/src/inotify.c
-index c537f4c1562a..470d6ed99213 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
-  
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/ip6addr.h b/src/ip6addr.h
-index c7dcb39c33fa..f0b7e820e227 100644
---- a/src/ip6addr.h
-+++ b/src/ip6addr.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/lease.c b/src/lease.c
-index 5d56b1b9147e..545bbb7fd09c 100644
---- a/src/lease.c
-+++ b/src/lease.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/log.c b/src/log.c
-index 8083a8697323..a5ac605c7c5d 100644
---- a/src/log.c
-+++ b/src/log.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/loop.c b/src/loop.c
-index bb377ad12644..565f7d8e58e0 100644
---- a/src/loop.c
-+++ b/src/loop.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/netlink.c b/src/netlink.c
-index b39328376389..10f94db25a14 100644
---- a/src/netlink.c
-+++ b/src/netlink.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/network.c b/src/network.c
-index 14d2af2ce313..7045253d467b 100644
---- a/src/network.c
-+++ b/src/network.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/option.c b/src/option.c
-index 6ef80117cc8c..cb4e76ba0aa2 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/outpacket.c b/src/outpacket.c
-index dce68f7cb09f..5b1ff9318bbd 100644
---- a/src/outpacket.c
-+++ b/src/outpacket.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/radv-protocol.h b/src/radv-protocol.h
-index 72ccda49d7fe..4cc1ea426e69 100644
---- a/src/radv-protocol.h
-+++ b/src/radv-protocol.h
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/radv.c b/src/radv.c
-index 3c8b162dbd8e..6da125b864ae 100644
---- a/src/radv.c
-+++ b/src/radv.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 262274fc5b80..5ef5ddb7485e 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/rfc2131.c b/src/rfc2131.c
-index 5c9040892f1d..55526443dc84 100644
---- a/src/rfc2131.c
-+++ b/src/rfc2131.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index e593ec9c362c..c1ddc805988d 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/slaac.c b/src/slaac.c
-index 351d6802f85e..abaad537e25a 100644
---- a/src/slaac.c
-+++ b/src/slaac.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/tftp.c b/src/tftp.c
-index a527911fc0df..a57a31514f44 100644
---- a/src/tftp.c
-+++ b/src/tftp.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-diff --git a/src/util.c b/src/util.c
-index d532444da207..91d02410b13f 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1,4 +1,4 @@
--/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
-+/* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
- 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/004-fix_behaviour_of_empty_dhcp-option.patch b/src/patches/dnsmasq/004-fix_behaviour_of_empty_dhcp-option.patch
new file mode 100644
index 0000000000..492ada9c89
--- /dev/null
+++ b/src/patches/dnsmasq/004-fix_behaviour_of_empty_dhcp-option.patch
@@ -0,0 +1,38 @@
+From 5e3e464ac4022ee0b3794513abe510817e2cf3ca Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Tue, 25 Aug 2015 23:08:39 +0100
+Subject: [PATCH] Fix behaviour of empty dhcp-option=option6:dns-server, which
+ should inhibit sending option.
+
+---
+ src/rfc3315.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/rfc3315.c b/src/rfc3315.c
+index 2665d0d..3f1f9ee 100644
+--- a/src/rfc3315.c
++++ b/src/rfc3315.c
+@@ -1320,15 +1320,16 @@ static struct dhcp_netid *add_options(struct state *state, int do_refresh)
+       
+       if (opt_cfg->opt == OPTION6_REFRESH_TIME)
+ 	done_refresh = 1;
++       
++      if (opt_cfg->opt == OPTION6_DNS_SERVER)
++	done_dns = 1;
+       
+-      if (opt_cfg->flags & DHOPT_ADDR6)
++      /* Empty DNS_SERVER option will not set DHOPT_ADDR6 */
++      if ((opt_cfg->flags & DHOPT_ADDR6) || opt_cfg->opt == OPTION6_DNS_SERVER)
+ 	{
+ 	  int len, j;
+ 	  struct in6_addr *a;
+ 	  
+-	  if (opt_cfg->opt == OPTION6_DNS_SERVER)
+-	    done_dns = 1;
+-	  
+ 	  for (a = (struct in6_addr *)opt_cfg->val, len = opt_cfg->len, j = 0; 
+ 	       j < opt_cfg->len; j += IN6ADDRSZ, a++)
+ 	    if ((IN6_IS_ADDR_ULA_ZERO(a) && IN6_IS_ADDR_UNSPECIFIED(state->ula_addr)) ||
+-- 
+1.7.10.4
+
diff --git a/src/patches/dnsmasq/0040-inotify-documentation-updates.patch b/src/patches/dnsmasq/0040-inotify-documentation-updates.patch
deleted file mode 100644
index 981e553e98..0000000000
--- a/src/patches/dnsmasq/0040-inotify-documentation-updates.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 3d04f46334d0e345f589eda1372e638b946fe637 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 31 Jan 2015 21:59:13 +0000
-Subject: [PATCH 40/55] inotify documentation updates.
-
----
- man/dnsmasq.8 | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 005b5cca8d1f..c858323d78bd 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -50,6 +50,10 @@ Additional hosts file. Read the specified file as well as /etc/hosts. If -h is g
- only the specified file. This option may be repeated for more than one
- additional hosts file. If a directory is given, then read all the files contained in that directory. 
- .TP
-+.B --hostsdir=<path>
-+Read all the hosts files contained in the directory. New or changed files
-+are read automatically. See --dhcp-hostsdir for details.
-+.TP
- .B \-E, --expand-hosts
- Add the domain to simple names (without a period) in /etc/hosts
- in the same way as for DHCP-derived names. Note that this does not
-@@ -979,12 +983,14 @@ dhcp-optsfile will be re-read when dnsmasq receives SIGHUP. Note that
- it is possible to encode the information in a
- .TP
- .B --dhcp-hostsdir=<path>
--This is exactly equivalent to dhcp-hostfile, except for the following. The path MUST be a
-+This is equivalent to dhcp-hostsfile, except for the following. The path MUST be a
- directory, and not an individual file. Changed or new files within
- the directory are read automatically, without the need to send SIGHUP.
- If a file is deleted for changed after it has been read by dnsmasq, then the
- host record it contained will remain until dnsmasq recieves a SIGHUP, or 
- is restarted; ie host records are only added dynamically.
-+.B --dhcp-optsdir=<path>
-+This is equivalent to dhcp-optsfile, with the differences noted for --dhcp-hostsdir.
- .TP
- .B --dhcp-boot
- flag as DHCP options, using the options names bootfile-name,
-@@ -1791,7 +1797,8 @@ clears its cache and then re-loads
- .I /etc/hosts
- and 
- .I /etc/ethers 
--and any file given by --dhcp-hostsfile, --dhcp-optsfile or --addn-hosts.
-+and any file given by --dhcp-hostsfile, --dhcp-hostsdir, --dhcp-optsfile, 
-+--dhcp-optsdir, --addn-hosts or --hostsdir.
- The dhcp lease change script is called for all
- existing DHCP leases. If 
- .B
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch b/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch
deleted file mode 100644
index 0c8aa9be30..0000000000
--- a/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 6ef15b34ca83c62a939f69356d5c3f7a6bfef3d0 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 31 Jan 2015 22:44:26 +0000
-Subject: [PATCH 41/55] Fix broken ECDSA DNSSEC signatures.
-
----
- CHANGELOG    | 2 ++
- src/dnssec.c | 2 +-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c05dec63c587..c80dc0fdbe9e 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -65,6 +65,8 @@ version 2.73
- 	    configured to do stateful DHCPv6. Thanks to Win King Wan 
- 	    for the patch.
- 
-+	    Fix broken DNSSEC validation of ECDSA signatures.
-+	
- 	
- version 2.72
-             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.
-diff --git a/src/dnssec.c b/src/dnssec.c
-index a8dfe3871c85..26932373cd3e 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -275,7 +275,7 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len
-     }
-   
-   if (sig_len != 2*t || key_len != 2*t ||
--      (p = blockdata_retrieve(key_data, key_len, NULL)))
-+      !(p = blockdata_retrieve(key_data, key_len, NULL)))
-     return 0;
-   
-   mpz_import(x, t , 1, 1, 0, 0, p);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0042-BSD-make-support.patch b/src/patches/dnsmasq/0042-BSD-make-support.patch
deleted file mode 100644
index 76f76ef757..0000000000
--- a/src/patches/dnsmasq/0042-BSD-make-support.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 106266761828a0acb006346ae47bf031dee46a5d Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 1 Feb 2015 00:15:16 +0000
-Subject: [PATCH 42/55] BSD make support
-
----
- Makefile | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 21e4a5c4101c..2910320b6452 100644
---- a/Makefile
-+++ b/Makefile
-@@ -64,8 +64,10 @@ nettle_libs =   `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC $(PKG_CONFIG
- gmp_libs =      `echo $(COPTS) | $(top)/bld/pkg-wrapper HAVE_DNSSEC NO_GMP --copy -lgmp`
- sunos_libs =    `if uname | grep SunOS >/dev/null 2>&1; then echo -lsocket -lnsl -lposix4; fi`
- version =     -DVERSION='\"`$(top)/bld/get-version $(top)`\"'
--copts_conf = .copts_$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | \
--			( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ')
-+
-+sum?=$(shell $(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' ')
-+sum!=$(CC) -DDNSMASQ_COMPILE_OPTS $(COPTS) -E $(top)/$(SRC)/dnsmasq.h | ( md5sum 2>/dev/null || md5 ) | cut -f 1 -d ' '
-+copts_conf = .copts_$(sum)
- 
- objs = cache.o rfc1035.o util.o option.o forward.o network.o \
-        dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o \
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch b/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch
deleted file mode 100644
index a3df61b89c..0000000000
--- a/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 8d8a54ec79d9f96979fabbd97b1dd2ddebc7d78f Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 1 Feb 2015 21:48:46 +0000
-Subject: [PATCH 43/55] Fix build failure on openBSD.
-
----
- src/tables.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/tables.c b/src/tables.c
-index dcdef794c4d2..aae1252708db 100644
---- a/src/tables.c
-+++ b/src/tables.c
-@@ -21,7 +21,7 @@
- #if defined(HAVE_IPSET) && defined(HAVE_BSD_NETWORK)
- 
- #ifndef __FreeBSD__
--#include <bsd/string.h>
-+#include <string.h>
- #endif
- 
- #include <sys/types.h>
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0044-Manpage-typo-fix.patch b/src/patches/dnsmasq/0044-Manpage-typo-fix.patch
deleted file mode 100644
index e0e384f546..0000000000
--- a/src/patches/dnsmasq/0044-Manpage-typo-fix.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From d36b732c4cfa91ea09af64b5dc0f3a85a075e5bc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= <thiebaud@weksteen.fr>
-Date: Mon, 2 Feb 2015 21:37:27 +0000
-Subject: [PATCH 44/55] Manpage typo fix.
-
----
- man/dnsmasq.8 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index c858323d78bd..27f85d40fbbb 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -516,7 +516,7 @@ zone files: the port, weight and priority numbers are in a different
- order. More than one SRV record for a given service/domain is allowed,
- all that match are returned.
- .TP
--.B --host-record=<name>[,<name>....][<IPv4-address>],[<IPv6-address>]
-+.B --host-record=<name>[,<name>....],[<IPv4-address>],[<IPv6-address>]
- Add A, AAAA and PTR records to the DNS. This adds one or more names to
- the DNS with associated IPv4 (A) and IPv6 (AAAA) records. A name may
- appear in more than one 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch b/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch
deleted file mode 100644
index fc1b98a705..0000000000
--- a/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 2941d3ac898cf84b544e47c9735c5e4111711db1 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 2 Feb 2015 22:36:42 +0000
-Subject: [PATCH 45/55] Fixup dhcp-configs after reading extra hostfiles with
- inotify.
-
----
- src/inotify.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/src/inotify.c b/src/inotify.c
-index 470d6ed99213..6f4cd79e0030 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -194,7 +194,19 @@ int inotify_check(time_t now)
- 		    strcat(path, in->name);
- 		    
- 		    if (ah->flags & AH_HOSTS)
--		      read_hostsfile(path, ah->index, 0, NULL, 0);
-+		      {
-+			read_hostsfile(path, ah->index, 0, NULL, 0);
-+#ifdef HAVE_DHCP
-+			if (daemon->dhcp || daemon->doing_dhcp6) 
-+			  {
-+			    /* Propogate the consequences of loading a new dhcp-host */
-+			    dhcp_update_configs(daemon->dhcp_conf);
-+			    lease_update_from_configs(); 
-+			    lease_update_file(now); 
-+			    lease_update_dns(1);
-+			  }
-+#endif
-+		      }
- #ifdef HAVE_DHCP
- 		    else if (ah->flags & AH_DHCP_HST)
- 		      {
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch b/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch
deleted file mode 100644
index 803174af05..0000000000
--- a/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From f9c863708c6b0aea31ff7a466647685dc739de50 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 3 Feb 2015 21:52:48 +0000
-Subject: [PATCH 46/55] Extra logging for inotify code.
-
----
- src/cache.c   | 9 ++++-----
- src/inotify.c | 4 +++-
- src/option.c  | 4 +++-
- 3 files changed, 10 insertions(+), 7 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index 117ae279fd4e..43245b771b53 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1022,11 +1022,10 @@ int read_hostsfile(char *filename, unsigned int index, int cache_size, struct cr
-   fclose(f);
-   
-   if (rhash)
--    {
--      rehash(name_count); 
--      my_syslog(LOG_INFO, _("read %s - %d addresses"), filename, addr_count);
--    }
--
-+    rehash(name_count); 
-+  
-+  my_syslog(LOG_INFO, _("read %s - %d addresses"), filename, addr_count);
-+  
-   return name_count;
- }
- 	    
-diff --git a/src/inotify.c b/src/inotify.c
-index 6f4cd79e0030..44ce0c9af051 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -192,7 +192,9 @@ int inotify_check(time_t now)
- 		    strcpy(path, ah->fname);
- 		    strcat(path, "/");
- 		    strcat(path, in->name);
--		    
-+		     
-+		    my_syslog(LOG_INFO, _("inotify, new or changed file %s"), path);
-+
- 		    if (ah->flags & AH_HOSTS)
- 		      {
- 			read_hostsfile(path, ah->index, 0, NULL, 0);
-diff --git a/src/option.c b/src/option.c
-index cb4e76ba0aa2..e4b4865d07a5 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -4068,11 +4068,13 @@ static void read_file(char *file, FILE *f, int hard_opt)
- #ifdef HAVE_DHCP
- int option_read_dynfile(char *file, int flags)
- {
-+  my_syslog(MS_DHCP | LOG_INFO, _("read %s"), file);
-+  
-   if (flags & AH_DHCP_HST)
-     return one_file(file, LOPT_BANK);
-   else if (flags & AH_DHCP_OPT)
-     return one_file(file, LOPT_OPTS);
--
-+  
-   return 0;
- }
- #endif
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0047-man-page-typo.patch b/src/patches/dnsmasq/0047-man-page-typo.patch
deleted file mode 100644
index 6606a7ac41..0000000000
--- a/src/patches/dnsmasq/0047-man-page-typo.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From efb8b5566aafc1f3ce18514a2df93af5a2e4998c Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 7 Feb 2015 22:36:34 +0000
-Subject: [PATCH 47/55] man page typo.
-
----
- man/dnsmasq.8 | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 27f85d40fbbb..5cdd186afaa0 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -989,6 +989,7 @@ the directory are read automatically, without the need to send SIGHUP.
- If a file is deleted for changed after it has been read by dnsmasq, then the
- host record it contained will remain until dnsmasq recieves a SIGHUP, or 
- is restarted; ie host records are only added dynamically.
-+.TP
- .B --dhcp-optsdir=<path>
- This is equivalent to dhcp-optsfile, with the differences noted for --dhcp-hostsdir.
- .TP
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch b/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch
deleted file mode 100644
index 5633d9d00b..0000000000
--- a/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From f4f400776b3c1aa303d1a0fcd500f0ab5bc970f2 Mon Sep 17 00:00:00 2001
-From: Shantanu Gadgil <shantanugadgil@yahoo.com>
-Date: Wed, 11 Feb 2015 20:16:59 +0000
-Subject: [PATCH 48/55] Fix get-version script which returned wrong tag in some
- situations.
-
----
- bld/get-version | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bld/get-version b/bld/get-version
-index c246a3cc6a47..7ab75db729ac 100755
---- a/bld/get-version
-+++ b/bld/get-version
-@@ -20,7 +20,7 @@ else
-      vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]`
- 
-      if [ $? -eq 0 ]; then
--         echo "${vers}" | sort | head -n 1 | sed 's/^v//'
-+         echo "${vers}" | sort -r | head -n 1 | sed 's/^v//'
-      else
-          cat $1/VERSION
-      fi
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0049-Typos.patch b/src/patches/dnsmasq/0049-Typos.patch
deleted file mode 100644
index 8f64b39d5a..0000000000
--- a/src/patches/dnsmasq/0049-Typos.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 8ff70de618eb7de9147dbfbd4deca4a2dd62f0cb Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 14 Feb 2015 20:02:37 +0000
-Subject: [PATCH 49/55] Typos.
-
----
- src/inotify.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/inotify.c b/src/inotify.c
-index 44ce0c9af051..9422066257f5 100644
---- a/src/inotify.c
-+++ b/src/inotify.c
-@@ -104,7 +104,8 @@ void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revh
- 	   ah->wd = inotify_add_watch(daemon->inotifyfd, ah->fname, IN_CLOSE_WRITE | IN_MOVED_TO);
- 	   ah->flags |= AH_WD_DONE;
- 	 }
--       /* Read contents of dir _after_ calling add_watch, in the ho[e of avoiding
-+
-+       /* Read contents of dir _after_ calling add_watch, in the hope of avoiding
- 	  a race which misses files being added as we start */
-        if (ah->wd == -1 || !(dir_stream = opendir(ah->fname)))
- 	 {
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/005-suggest_solution_to_ENOMEM_error_with_IPv6_multicast.patch b/src/patches/dnsmasq/005-suggest_solution_to_ENOMEM_error_with_IPv6_multicast.patch
new file mode 100644
index 0000000000..c7cee6042e
--- /dev/null
+++ b/src/patches/dnsmasq/005-suggest_solution_to_ENOMEM_error_with_IPv6_multicast.patch
@@ -0,0 +1,50 @@
+From 9cdcfe9f19ffd45bac4e5b459879bf7c50a287ed Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 26 Aug 2015 22:38:08 +0100
+Subject: [PATCH] Suggest solution to ENOMEM error with IPv6 multicast.
+
+---
+ src/network.c |   13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/src/network.c b/src/network.c
+index a1d90c8..819302f 100644
+--- a/src/network.c
++++ b/src/network.c
+@@ -1076,23 +1076,30 @@ void join_multicast(int dienow)
+ 	    
+ 	    if ((daemon->doing_dhcp6 || daemon->relay6) &&
+ 		setsockopt(daemon->dhcp6fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &mreq, sizeof(mreq)) == -1)
+-	      err = 1;
++	      err = errno;
+ 	    
+ 	    inet_pton(AF_INET6, ALL_SERVERS, &mreq.ipv6mr_multiaddr);
+ 	    
+ 	    if (daemon->doing_dhcp6 && 
+ 		setsockopt(daemon->dhcp6fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &mreq, sizeof(mreq)) == -1)
+-	      err = 1;
++	      err = errno;
+ 	    
+ 	    inet_pton(AF_INET6, ALL_ROUTERS, &mreq.ipv6mr_multiaddr);
+ 	    
+ 	    if (daemon->doing_ra &&
+ 		setsockopt(daemon->icmp6fd, IPPROTO_IPV6, IPV6_JOIN_GROUP, &mreq, sizeof(mreq)) == -1)
+-	      err = 1;
++	      err = errno;
+ 	    
+ 	    if (err)
+ 	      {
+ 		char *s = _("interface %s failed to join DHCPv6 multicast group: %s");
++		errno = err;
++
++#ifdef HAVE_LINUX_NETWORK
++		if (errno == ENOMEM)
++		  my_syslog(LOG_ERR, _("try increasing /proc/sys/net/core/optmem_max"));
++#endif
++
+ 		if (dienow)
+ 		  die(s, iface->name, EC_BADNET);
+ 		else
+-- 
+1.7.10.4
+
diff --git a/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch b/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch
deleted file mode 100644
index af79802025..0000000000
--- a/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From caeea190f12efd20139f694aac4942d1ac00019f Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 14 Feb 2015 20:08:56 +0000
-Subject: [PATCH 50/55] Make dynamic hosts files work when --no-hosts set.
-
----
- src/cache.c | 21 +++++++++++----------
- 1 file changed, 11 insertions(+), 10 deletions(-)
-
-diff --git a/src/cache.c b/src/cache.c
-index 43245b771b53..c95624c42b1c 100644
---- a/src/cache.c
-+++ b/src/cache.c
-@@ -1133,17 +1133,18 @@ void cache_reload(void)
-     {
-       if (daemon->cachesize > 0)
- 	my_syslog(LOG_INFO, _("cleared cache"));
--      return;
-     }
--  
--  if (!option_bool(OPT_NO_HOSTS))
--    total_size = read_hostsfile(HOSTSFILE, SRC_HOSTS, total_size, (struct crec **)daemon->packet, revhashsz);
--  
--  daemon->addn_hosts = expand_filelist(daemon->addn_hosts);
--  for (ah = daemon->addn_hosts; ah; ah = ah->next)
--    if (!(ah->flags & AH_INACTIVE))
--      total_size = read_hostsfile(ah->fname, ah->index, total_size, (struct crec **)daemon->packet, revhashsz);
--  
-+  else
-+    {
-+      if (!option_bool(OPT_NO_HOSTS))
-+	total_size = read_hostsfile(HOSTSFILE, SRC_HOSTS, total_size, (struct crec **)daemon->packet, revhashsz);
-+      
-+      daemon->addn_hosts = expand_filelist(daemon->addn_hosts);
-+      for (ah = daemon->addn_hosts; ah; ah = ah->next)
-+	if (!(ah->flags & AH_INACTIVE))
-+	  total_size = read_hostsfile(ah->fname, ah->index, total_size, (struct crec **)daemon->packet, revhashsz);
-+    }
-+
- #ifdef HAVE_INOTIFY
-   set_dynamic_inotify(AH_HOSTS, total_size, (struct crec **)daemon->packet, revhashsz);
- #endif
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch b/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch
deleted file mode 100644
index 2c38cfc1a8..0000000000
--- a/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 28b879ac47b872af6e8c5e86d76806c69338434d Mon Sep 17 00:00:00 2001
-From: Chen Wei <weichen302@icloud.com>
-Date: Tue, 17 Feb 2015 22:07:35 +0000
-Subject: [PATCH 51/55] Fix trivial memory leaks to quieten valgrind.
-
----
- src/dnsmasq.c |  2 ++
- src/option.c  | 11 +++++++++--
- 2 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index e903a24c8105..e6dabbf556f7 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -627,6 +627,8 @@ int main (int argc, char **argv)
-     }
-   
- #ifdef HAVE_LINUX_NETWORK
-+  free(hdr);
-+  free(data);
-   if (option_bool(OPT_DEBUG)) 
-     prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
- #endif
-diff --git a/src/option.c b/src/option.c
-index e4b4865d07a5..ae0ad002d8b8 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -4361,7 +4361,7 @@ void read_opts(int argc, char **argv, char *compile_opts)
- {
-   char *buff = opt_malloc(MAXDNAME);
-   int option, conffile_opt = '7', testmode = 0;
--  char *arg, *conffile = CONFFILE;
-+  char *arg, *conffile = NULL;
-       
-   opterr = 0;
- 
-@@ -4476,7 +4476,14 @@ void read_opts(int argc, char **argv, char *compile_opts)
-     }
- 
-   if (conffile)
--    one_file(conffile, conffile_opt);
-+    {
-+      one_file(conffile, conffile_opt);
-+      free(conffile);
-+    }
-+  else
-+    {
-+      one_file(CONFFILE, conffile_opt);
-+    }
- 
-   /* port might not be known when the address is parsed - fill in here */
-   if (daemon->servers)
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch b/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch
deleted file mode 100644
index 46277fb4a6..0000000000
--- a/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 0705a7e2d57654b27c7e14f35ca77241c1821f4d Mon Sep 17 00:00:00 2001
-From: Tomas Hozza <thozza@redhat.com>
-Date: Mon, 23 Feb 2015 21:26:26 +0000
-Subject: [PATCH 52/55] Fix uninitialized value used in get_client_mac()
-
----
- src/dhcp6.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/dhcp6.c b/src/dhcp6.c
-index 3c56e77c6085..c7144f5fee7c 100644
---- a/src/dhcp6.c
-+++ b/src/dhcp6.c
-@@ -246,7 +246,9 @@ void get_client_mac(struct in6_addr *client, int iface, unsigned char *mac, unsi
-   neigh.code = 0;
-   neigh.reserved = 0;
-   neigh.target = *client;
--  
-+  /* RFC4443 section-2.3: checksum has to be zero to be calculated */
-+  neigh.checksum = 0;
-+   
-   memset(&addr, 0, sizeof(addr));
- #ifdef HAVE_SOCKADDR_SA_LEN
-   addr.sin6_len = sizeof(struct sockaddr_in6);
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch b/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch
deleted file mode 100644
index 95270301fc..0000000000
--- a/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 47b9ac59c715827252ae6e6732903c3dabb697fb Mon Sep 17 00:00:00 2001
-From: Joachim Zobel <jz-2014@heute-morgen.de>
-Date: Mon, 23 Feb 2015 21:38:11 +0000
-Subject: [PATCH 53/55] Log parsing utils in contrib/reverse-dns
-
----
- contrib/reverse-dns/README             | 18 ++++++++++++++++++
- contrib/reverse-dns/reverse_dns.sh     | 29 +++++++++++++++++++++++++++++
- contrib/reverse-dns/reverse_replace.sh | 28 ++++++++++++++++++++++++++++
- 3 files changed, 75 insertions(+)
- create mode 100644 contrib/reverse-dns/README
- create mode 100644 contrib/reverse-dns/reverse_dns.sh
- create mode 100644 contrib/reverse-dns/reverse_replace.sh
-
-diff --git a/contrib/reverse-dns/README b/contrib/reverse-dns/README
-new file mode 100644
-index 000000000000..f87eb77c4c22
---- /dev/null
-+++ b/contrib/reverse-dns/README
-@@ -0,0 +1,18 @@
-+Hi.
-+
-+To translate my routers netstat-nat output into names that actually talk
-+to me I have started writing to simple shell scripts. They require 
-+
-+log-queries
-+log-facility=/var/log/dnsmasq.log
-+
-+to be set. With
-+
-+netstat-nat -n -4 | reverse_replace.sh 
-+
-+I get retranslated output.
-+
-+Sincerely,
-+Joachim
-+
-+
-diff --git a/contrib/reverse-dns/reverse_dns.sh b/contrib/reverse-dns/reverse_dns.sh
-new file mode 100644
-index 000000000000..c0fff300a947
---- /dev/null
-+++ b/contrib/reverse-dns/reverse_dns.sh
-@@ -0,0 +1,29 @@
-+#!/bin/bash
-+# $Id: reverse_dns.sh 4 2015-02-17 20:14:59Z jo $
-+#
-+# Usage: reverse_dns.sh IP
-+# Uses the dnsmasq query log to lookup the name 
-+# that was last queried to return the given IP.
-+#
-+
-+IP=$1
-+qmIP=`echo $IP | sed 's#\.#\\.#g'`
-+LOG=/var/log/dnsmasq.log
-+
-+IP_regex='^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
-+
-+if ! [[ $IP =~ $IP_regex ]]; then
-+  echo -n $IP
-+  exit
-+fi
-+
-+NAME=`tac $LOG | \
-+  grep " is $IP" | head -1 | \
-+  sed "s#.* \([^ ]*\) is $qmIP.*#\1#" `
-+
-+if [ -z "$NAME" ]; then
-+  echo -n $IP
-+else
-+  echo -n $NAME
-+fi
-+
-diff --git a/contrib/reverse-dns/reverse_replace.sh b/contrib/reverse-dns/reverse_replace.sh
-new file mode 100644
-index 000000000000..a11c164b7f19
---- /dev/null
-+++ b/contrib/reverse-dns/reverse_replace.sh
-@@ -0,0 +1,28 @@
-+#!/bin/bash
-+# $Id: reverse_replace.sh 4 2015-02-17 20:14:59Z jo $
-+#
-+# Usage e.g.: netstat -n -4 | reverse_replace.sh 
-+# Parses stdin for IP4 addresses and replaces them 
-+# with names retrieved by reverse_dns.sh
-+#
-+
-+DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
-+DNS=$DIR/reverse_dns.sh
-+
-+# sed regex
-+IP_regex='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'
-+
-+while read LINE; do
-+  if grep --quiet $IP_regex <<< "$LINE"; then
-+    IPs=`sed "s#.*\b\($IP_regex\)\b.*#\1 #g" <<< "$LINE"`
-+    IPs=($IPs)
-+    for IP in "${IPs[@]}"
-+    do
-+      NAME=`$DNS $IP`
-+      # echo "$NAME is $IP";
-+      LINE="${LINE/$IP/$NAME}" 
-+    done
-+  fi
-+  echo $LINE
-+done < /dev/stdin
-+
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch b/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch
deleted file mode 100644
index 2ff79d526b..0000000000
--- a/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch
+++ /dev/null
@@ -1,252 +0,0 @@
-From f6e62e2af96f5fa0d1e3d93167a93a8f09bf6e61 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sun, 1 Mar 2015 18:17:54 +0000
-Subject: [PATCH 54/55] Add --dnssec-timestamp option and facility.
-
----
- CHANGELOG     |  6 +++++
- man/dnsmasq.8 |  6 +++++
- src/dnsmasq.c | 11 +++++++-
- src/dnsmasq.h |  2 ++
- src/dnssec.c  | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++++++----
- src/option.c  |  7 +++++
- 6 files changed, 108 insertions(+), 6 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c80dc0fdbe9e..4f4fa305deaa 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -66,6 +66,12 @@ version 2.73
- 	    for the patch.
- 
- 	    Fix broken DNSSEC validation of ECDSA signatures.
-+
-+	    Add --dnssec-timestamp option, which provides an automatic
-+	    way to detect when the system time becomes valid after boot
-+	    on systems without an RTC, whilst allowing DNS queries before the
-+	    clock is valid so that NTP can run. Thanks to
-+	    Kevin Darbyshire-Bryant for developing this idea.
- 	
- 	
- version 2.72
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 5cdd186afaa0..097e7d75145c 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -674,6 +674,12 @@ that dnsmasq should be started with this flag when the platform determines that
- reliable time is established, a SIGHUP should be sent to dnsmasq, which enables time checking, and purges the cache of DNS records
- which have not been throughly checked.
- .TP
-+.B --dnssec-timestamp=<path>
-+Enables an alternative way of checking the validity of the system time for DNSSEC (see --dnssec-no-timecheck). In this case, the 
-+system time is considered to be valid once it becomes later than the timestamp on the specified file. The file is created and 
-+its timestamp set automatically by dnsmasq. The file must be stored on a persistent filesystem, so that it and its mtime are carried 
-+over system restarts. 
-+.TP
- .B --proxy-dnssec
- Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients and cache it.  This is an 
- alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between 
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index e6dabbf556f7..769a19afe6c5 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -58,6 +58,9 @@ int main (int argc, char **argv)
-   struct dhcp_context *context;
-   struct dhcp_relay *relay;
- #endif
-+#ifdef HAVE_DNSSEC
-+  int badtime;
-+#endif
- 
- #ifdef LOCALEDIR
-   setlocale(LC_ALL, "");
-@@ -369,7 +372,11 @@ int main (int argc, char **argv)
- 
-   if (baduser)
-     die(_("unknown user or group: %s"), baduser, EC_BADCONF);
--   
-+
-+#ifdef HAVE_DNSSEC  
-+  badtime = setup_timestamp(ent_pw->pw_uid);
-+#endif
-+
-   /* implement group defaults, "dip" if available, or group associated with uid */
-   if (!daemon->group_set && !gp)
-     {
-@@ -689,6 +696,8 @@ int main (int argc, char **argv)
-       my_syslog(LOG_INFO, _("DNSSEC validation enabled"));
-       if (option_bool(OPT_DNSSEC_TIME))
- 	my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until first cache reload"));
-+      if (badtime)
-+	my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until system time valid"));
-     }
- #endif
- 
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index 89e758b56a0a..b2f02dda63f0 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -986,6 +986,7 @@ extern struct daemon {
- #endif
- #ifdef HAVE_DNSSEC
-   struct ds_config *ds;
-+  char *timestamp_file;
- #endif
- 
-   /* globally used stuff for DNS */
-@@ -1151,6 +1152,7 @@ int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char
- int dnskey_keytag(int alg, int flags, unsigned char *rdata, int rdlen);
- size_t filter_rrsigs(struct dns_header *header, size_t plen);
- unsigned char* hash_questions(struct dns_header *header, size_t plen, char *name);
-+int setup_timestamp(uid_t uid);
- 
- /* util.c */
- void rand_init(void);
-diff --git a/src/dnssec.c b/src/dnssec.c
-index 26932373cd3e..bf4406469de0 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -34,6 +34,7 @@
- #include <nettle/dsa-compat.h>
- #endif
- 
-+#include <utime.h>
- 
- #define SERIAL_UNDEF  -100
- #define SERIAL_EQ        0
-@@ -394,17 +395,88 @@ static int serial_compare_32(unsigned long s1, unsigned long s2)
-   return SERIAL_UNDEF;
- }
- 
-+/* Called at startup. If the timestamp file is configured and exists, put its mtime on
-+   timestamp_time. If it doesn't exist, create it, and set the mtime to 1-1-2015.
-+   Change the ownership to the user we'll be running as, so that we can update the mtime.
-+*/
-+static time_t timestamp_time;
-+static int back_to_the_future;
-+
-+int setup_timestamp(uid_t uid)
-+{
-+  struct stat statbuf;
-+  
-+  back_to_the_future = 0;
-+  
-+  if (!option_bool(OPT_DNSSEC_VALID) || !daemon->timestamp_file)
-+    return 0;
-+  
-+  if (stat(daemon->timestamp_file, &statbuf) != -1)
-+    {
-+      timestamp_time = statbuf.st_mtime;
-+    check_and_exit:
-+      if (difftime(timestamp_time, time(0)) <=  0)
-+	{
-+	  /* time already OK, update timestamp, and do key checking from the start. */
-+	  if (utime(daemon->timestamp_file, NULL) == -1)
-+	    my_syslog(LOG_ERR, _("failed to update mtime on %s: %s"), daemon->timestamp_file, strerror(errno));
-+	  back_to_the_future = 1;
-+	  return 0;
-+	}
-+      return 1;
-+    }
-+  
-+  if (errno == ENOENT)
-+    {
-+      int fd = open(daemon->timestamp_file, O_WRONLY | O_CREAT | O_NONBLOCK, 0666);
-+      if (fd != -1)
-+	{
-+	  struct utimbuf timbuf;
-+
-+	  close(fd);
-+	  
-+	  timestamp_time = timbuf.actime = timbuf.modtime = 1420070400; /* 1-1-2015 */
-+	  if (utime(daemon->timestamp_file, &timbuf) == 0 &&
-+	      (getuid() != 0 || chown(daemon->timestamp_file, uid, -1) == 0))
-+	    goto check_and_exit;
-+	}
-+    }
-+
-+  die(_("Cannot create timestamp file %s: %s" ), daemon->timestamp_file, EC_BADCONF);
-+  return 0;
-+}
-+
- /* Check whether today/now is between date_start and date_end */
- static int check_date_range(unsigned long date_start, unsigned long date_end)
- {
--  unsigned long curtime;
--
-+  unsigned long curtime = time(0);
-+ 
-   /* Checking timestamps may be temporarily disabled */
--  if (option_bool(OPT_DNSSEC_TIME))
-+    
-+  /* If the current time if _before_ the timestamp
-+     on our persistent timestamp file, then assume the
-+     time if not yet correct, and don't check the
-+     key timestamps. As soon as the current time is
-+     later then the timestamp, update the timestamp
-+     and start checking keys */
-+  if (daemon->timestamp_file)
-+    {
-+      if (back_to_the_future == 0 && difftime(timestamp_time, curtime) <= 0)
-+	{
-+	  if (utime(daemon->timestamp_file, NULL) != 0)
-+	    my_syslog(LOG_ERR, _("failed to update mtime on %s: %s"), daemon->timestamp_file, strerror(errno));
-+	  
-+	  back_to_the_future = 1;	
-+	  set_option_bool(OPT_DNSSEC_TIME);
-+	  queue_event(EVENT_RELOAD); /* purge cache */
-+	} 
-+
-+      if (back_to_the_future == 0)
-+	return 1;
-+    }
-+  else if (option_bool(OPT_DNSSEC_TIME))
-     return 1;
-   
--  curtime = time(0);
--  
-   /* We must explicitly check against wanted values, because of SERIAL_UNDEF */
-   return serial_compare_32(curtime, date_start) == SERIAL_GT
-     && serial_compare_32(curtime, date_end) == SERIAL_LT;
-diff --git a/src/option.c b/src/option.c
-index ae0ad002d8b8..eace40bb566c 100644
---- a/src/option.c
-+++ b/src/option.c
-@@ -152,6 +152,7 @@ struct myoption {
- #define LOPT_DHCP_INOTIFY  340
- #define LOPT_DHOPT_INOTIFY 341
- #define LOPT_HOST_INOTIFY  342
-+#define LOPT_DNSSEC_STAMP  343
- 
- #ifdef HAVE_GETOPT_LONG
- static const struct option opts[] =  
-@@ -300,6 +301,7 @@ static const struct myoption opts[] =
-     { "dnssec-debug", 0, 0, LOPT_DNSSEC_DEBUG },
-     { "dnssec-check-unsigned", 0, 0, LOPT_DNSSEC_CHECK },
-     { "dnssec-no-timecheck", 0, 0, LOPT_DNSSEC_TIME },
-+    { "dnssec-timestamp", 1, 0, LOPT_DNSSEC_STAMP },
- #ifdef OPTION6_PREFIX_CLASS 
-     { "dhcp-prefix-class", 1, 0, LOPT_PREF_CLSS },
- #endif
-@@ -463,6 +465,7 @@ static struct {
-   { LOPT_DNSSEC_DEBUG, OPT_DNSSEC_DEBUG, NULL, gettext_noop("Disable upstream checking for DNSSEC debugging."), NULL },
-   { LOPT_DNSSEC_CHECK, OPT_DNSSEC_NO_SIGN, NULL, gettext_noop("Ensure answers without DNSSEC are in unsigned zones."), NULL },
-   { LOPT_DNSSEC_TIME, OPT_DNSSEC_TIME, NULL, gettext_noop("Don't check DNSSEC signature timestamps until first cache-reload"), NULL },
-+  { LOPT_DNSSEC_STAMP, ARG_ONE, "<path>", gettext_noop("Timestamp file to verify system clock for DNSSEC"), NULL },
- #ifdef OPTION6_PREFIX_CLASS 
-   { LOPT_PREF_CLSS, ARG_DUP, "set:tag,<class>", gettext_noop("Specify DHCPv6 prefix class"), NULL },
- #endif
-@@ -3867,6 +3870,10 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
-       }
- 
- #ifdef HAVE_DNSSEC
-+    case LOPT_DNSSEC_STAMP:
-+      daemon->timestamp_file = opt_string_alloc(arg); 
-+      break;
-+
-     case LOPT_TRUST_ANCHOR:
-       {
- 	struct ds_config *new = opt_malloc(sizeof(struct ds_config));
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch b/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch
deleted file mode 100644
index 54bb5d597c..0000000000
--- a/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 9003b50b13da624ca45f3e0cf99abb623b8d026b Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 2 Mar 2015 22:47:23 +0000
-Subject: [PATCH 55/55] Fix last commit to not crash if uid changing not
- configured.
-
----
- src/dnsmasq.c | 2 +-
- src/dnsmasq.h | 2 +-
- src/dnssec.c  | 4 ++--
- 3 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index 769a19afe6c5..9e05c0e31569 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -374,7 +374,7 @@ int main (int argc, char **argv)
-     die(_("unknown user or group: %s"), baduser, EC_BADCONF);
- 
- #ifdef HAVE_DNSSEC  
--  badtime = setup_timestamp(ent_pw->pw_uid);
-+  badtime = setup_timestamp(ent_pw);
- #endif
- 
-   /* implement group defaults, "dip" if available, or group associated with uid */
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index b2f02dda63f0..a451cb4dd03c 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -1152,7 +1152,7 @@ int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char
- int dnskey_keytag(int alg, int flags, unsigned char *rdata, int rdlen);
- size_t filter_rrsigs(struct dns_header *header, size_t plen);
- unsigned char* hash_questions(struct dns_header *header, size_t plen, char *name);
--int setup_timestamp(uid_t uid);
-+int setup_timestamp(struct passwd *ent_pw);
- 
- /* util.c */
- void rand_init(void);
-diff --git a/src/dnssec.c b/src/dnssec.c
-index bf4406469de0..c60eacf73c6b 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -402,7 +402,7 @@ static int serial_compare_32(unsigned long s1, unsigned long s2)
- static time_t timestamp_time;
- static int back_to_the_future;
- 
--int setup_timestamp(uid_t uid)
-+int setup_timestamp(struct passwd *ent_pw)
- {
-   struct stat statbuf;
-   
-@@ -437,7 +437,7 @@ int setup_timestamp(uid_t uid)
- 	  
- 	  timestamp_time = timbuf.actime = timbuf.modtime = 1420070400; /* 1-1-2015 */
- 	  if (utime(daemon->timestamp_file, &timbuf) == 0 &&
--	      (getuid() != 0 || chown(daemon->timestamp_file, uid, -1) == 0))
-+	      (!ent_pw || getuid() != 0 || chown(daemon->timestamp_file, ent_pw->pw_uid, -1) == 0))
- 	    goto check_and_exit;
- 	}
-     }
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch b/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch
deleted file mode 100644
index 9a052152c2..0000000000
--- a/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch
+++ /dev/null
@@ -1,194 +0,0 @@
-From 4c960fa90a975d20f75a1ecabd217247f1922c8f Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 4 Mar 2015 20:32:26 +0000
-Subject: [PATCH 56/57] New version of contrib/reverse-dns
-
----
- contrib/reverse-dns/README             |  22 +++---
- contrib/reverse-dns/reverse_replace.sh | 131 ++++++++++++++++++++++++++++-----
- 2 files changed, 125 insertions(+), 28 deletions(-)
-
-diff --git a/contrib/reverse-dns/README b/contrib/reverse-dns/README
-index f87eb77c4c22..2ec4df1f957e 100644
---- a/contrib/reverse-dns/README
-+++ b/contrib/reverse-dns/README
-@@ -1,18 +1,18 @@
--Hi.
-+The script reads stdin and replaces all IP addresses with names before
-+outputting it again. IPs from private networks are reverse looked  up
-+via dns. Other IP adresses are searched for in the dnsmasq query log.
-+This gives names (CNAMEs if I understand DNS correctly) that are closer
-+to the name the client originally asked for then the names obtained by
-+reverse lookup. Just run
- 
--To translate my routers netstat-nat output into names that actually talk
--to me I have started writing to simple shell scripts. They require 
-+netstat -n -4 | ./reverse_replace.sh 
-+
-+to see what it does. It needs 
- 
- log-queries
- log-facility=/var/log/dnsmasq.log
- 
--to be set. With
--
--netstat-nat -n -4 | reverse_replace.sh 
--
--I get retranslated output.
--
--Sincerely,
--Joachim
-+in the dnsmasq configuration.
- 
-+The script runs on debian (with ash installed) and on busybox.
- 
-diff --git a/contrib/reverse-dns/reverse_replace.sh b/contrib/reverse-dns/reverse_replace.sh
-index a11c164b7f19..5b4aebd71456 100644
---- a/contrib/reverse-dns/reverse_replace.sh
-+++ b/contrib/reverse-dns/reverse_replace.sh
-@@ -1,28 +1,125 @@
--#!/bin/bash
--# $Id: reverse_replace.sh 4 2015-02-17 20:14:59Z jo $
-+#!/bin/ash
-+# $Id: reverse_replace.sh 18 2015-03-01 16:12:35Z jo $
- #
- # Usage e.g.: netstat -n -4 | reverse_replace.sh 
- # Parses stdin for IP4 addresses and replaces them 
--# with names retrieved by reverse_dns.sh
-+# with names retrieved by parsing the dnsmasq log.
-+# This currently only gives CNAMEs. But these 
-+# usually tell ou more than the mones from reverse 
-+# lookups. 
-+#
-+# This has been tested on debian and asuswrt. Plese
-+# report successful tests on other platforms.
-+#
-+# Author: Joachim Zobel <jz-2014@heute-morgen.de>
-+# License: Consider this MIT style licensed. You can 
-+#   do as you ike, but you must not remove my name.
- #
- 
--DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
--DNS=$DIR/reverse_dns.sh
-+LOG=/var/log/dnsmasq.log
-+MAX_LINES=15000
- 
--# sed regex
-+# sed regex do match IPs
- IP_regex='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'
-+# private IP ranges
-+IP_private='\(^127\.\)\|\(^192\.168\.\)\|\(^10\.\)\|\(^172\.1[6-9]\.\)\|\(^172\.2[0-9]\.\)\|\(^172\.3[0-1]\.\)'
- 
--while read LINE; do
--  if grep --quiet $IP_regex <<< "$LINE"; then
--    IPs=`sed "s#.*\b\($IP_regex\)\b.*#\1 #g" <<< "$LINE"`
--    IPs=($IPs)
--    for IP in "${IPs[@]}"
--    do
--      NAME=`$DNS $IP`
--      # echo "$NAME is $IP";
--      LINE="${LINE/$IP/$NAME}" 
--    done
-+#######################################################################
-+# Find Commands
-+  
-+HOST=nslookup
-+if type host > /dev/null 2>&1; then
-+  # echo "No need for nslookup, host is there"
-+  HOST=host
-+fi
-+
-+#######################################################################
-+# Functions
-+
-+# Use shell variables for an (IP) lookup table
-+create_lookup_table()
-+{
-+  # Parse log into lookup table
-+  local CMDS="$( tail -"$MAX_LINES" "$LOG" | \
-+    grep " is $IP_regex" | \
-+    sed "s#.* \([^ ]*\) is \($IP_regex\).*#set_val \2 \1;#" )"
-+
-+  local IFS='
-+'
-+  for CMD in $CMDS
-+  do
-+    eval $CMD
-+  done
-+}
-+
-+set_val()
-+{
-+  local _IP=$(echo $1 | tr . _)
-+  local KEY="__IP__$_IP"
-+  eval "$KEY"=$2
-+}
-+
-+get_val()
-+{
-+  local _IP=$(echo $1 | tr . _)
-+  local KEY="__IP__$_IP"
-+  eval echo -n '${'"$KEY"'}'
-+}
-+
-+dns_lookup()
-+{
-+  local IP=$1
-+
-+  local RTN="$($HOST $IP | \
-+        sed 's#\s\+#\n#g' | \
-+        grep -v '^$' | \
-+        tail -1 | tr -d '\n' | \
-+        sed 's#\.$##')"
-+  if echo $RTN | grep -q NXDOMAIN; then
-+    echo -n $IP
-+  else
-+    echo -n "$RTN"
-+  fi     
-+}
-+
-+reverse_dns()
-+{
-+  local IP=$1
-+
-+  # Skip if it is not an IP
-+  if ! echo $IP | grep -q "^$IP_regex$"; then
-+    echo -n $IP
-+    return 
-+  fi
-+    
-+  # Do a dns lookup, if it is a local IP
-+  if echo $IP | grep -q $IP_private; then
-+    dns_lookup $IP
-+    return
-   fi
-+    
-+  local NAME="$(get_val $IP)"
-+  
-+  if [ -z "$NAME" ]; then
-+    echo -n $IP
-+  else
-+    echo -n $NAME
-+  fi
-+}
-+
-+#######################################################################
-+# Main
-+create_lookup_table
-+
-+while read LINE; do
-+  for IP in $(echo "$LINE" | \
-+              sed "s#\b\($IP_regex\)\b#\n\1\n#g" | \
-+              grep $IP_regex) 
-+  do
-+    NAME=`reverse_dns $IP `
-+    # echo "$NAME $IP"
-+    LINE=`echo "$LINE" | sed "s#$IP#$NAME#" ` 
-+  done
-   echo $LINE
--done < /dev/stdin
-+done
- 
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch b/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch
deleted file mode 100644
index df47cd0e3a..0000000000
--- a/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-From 360f2513ab12a9bf1e262d388dd2ea8a566590a3 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 7 Mar 2015 18:28:06 +0000
-Subject: [PATCH 57/57] Tweak DNSSEC timestamp code to create file later,
- removing need to chown it.
-
----
- man/dnsmasq.8 |  3 ++-
- src/dnsmasq.c | 35 ++++++++++++++++++++++-------------
- src/dnsmasq.h |  3 ++-
- src/dnssec.c  | 18 ++++++++++--------
- 4 files changed, 36 insertions(+), 23 deletions(-)
-
-diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
-index 097e7d75145c..2db780d90987 100644
---- a/man/dnsmasq.8
-+++ b/man/dnsmasq.8
-@@ -678,7 +678,8 @@ which have not been throughly checked.
- Enables an alternative way of checking the validity of the system time for DNSSEC (see --dnssec-no-timecheck). In this case, the 
- system time is considered to be valid once it becomes later than the timestamp on the specified file. The file is created and 
- its timestamp set automatically by dnsmasq. The file must be stored on a persistent filesystem, so that it and its mtime are carried 
--over system restarts. 
-+over system restarts. The timestamp file is created after dnsmasq has dropped root, so it must be in a location writable by the 
-+unprivileged user that dnsmasq runs as.
- .TP
- .B --proxy-dnssec
- Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients and cache it.  This is an 
-diff --git a/src/dnsmasq.c b/src/dnsmasq.c
-index 9e05c0e31569..f3e5bcffec4f 100644
---- a/src/dnsmasq.c
-+++ b/src/dnsmasq.c
-@@ -58,9 +58,6 @@ int main (int argc, char **argv)
-   struct dhcp_context *context;
-   struct dhcp_relay *relay;
- #endif
--#ifdef HAVE_DNSSEC
--  int badtime;
--#endif
- 
- #ifdef LOCALEDIR
-   setlocale(LC_ALL, "");
-@@ -156,10 +153,10 @@ int main (int argc, char **argv)
-     {
- #ifdef HAVE_DNSSEC
-       if (!daemon->ds)
--	die(_("No trust anchors provided for DNSSEC"), NULL, EC_BADCONF);
-+	die(_("no trust anchors provided for DNSSEC"), NULL, EC_BADCONF);
-       
-       if (daemon->cachesize < CACHESIZ)
--	die(_("Cannot reduce cache size from default when DNSSEC enabled"), NULL, EC_BADCONF);
-+	die(_("cannot reduce cache size from default when DNSSEC enabled"), NULL, EC_BADCONF);
- #else 
-       die(_("DNSSEC not available: set HAVE_DNSSEC in src/config.h"), NULL, EC_BADCONF);
- #endif
-@@ -172,10 +169,10 @@ int main (int argc, char **argv)
- 
- #ifdef HAVE_CONNTRACK
-   if (option_bool(OPT_CONNTRACK) && (daemon->query_port != 0 || daemon->osport))
--    die (_("Cannot use --conntrack AND --query-port"), NULL, EC_BADCONF); 
-+    die (_("cannot use --conntrack AND --query-port"), NULL, EC_BADCONF); 
- #else
-   if (option_bool(OPT_CONNTRACK))
--    die(_("Conntrack support not available: set HAVE_CONNTRACK in src/config.h"), NULL, EC_BADCONF);
-+    die(_("conntrack support not available: set HAVE_CONNTRACK in src/config.h"), NULL, EC_BADCONF);
- #endif
- 
- #ifdef HAVE_SOLARIS_NETWORK
-@@ -195,7 +192,7 @@ int main (int argc, char **argv)
- 
- #ifndef HAVE_LOOP
-   if (option_bool(OPT_LOOP_DETECT))
--    die(_("Loop detection not available: set HAVE_LOOP in src/config.h"), NULL, EC_BADCONF);
-+    die(_("loop detection not available: set HAVE_LOOP in src/config.h"), NULL, EC_BADCONF);
- #endif
-   
-   now = dnsmasq_time();
-@@ -373,10 +370,6 @@ int main (int argc, char **argv)
-   if (baduser)
-     die(_("unknown user or group: %s"), baduser, EC_BADCONF);
- 
--#ifdef HAVE_DNSSEC  
--  badtime = setup_timestamp(ent_pw);
--#endif
--
-   /* implement group defaults, "dip" if available, or group associated with uid */
-   if (!daemon->group_set && !gp)
-     {
-@@ -693,10 +686,23 @@ int main (int argc, char **argv)
- #ifdef HAVE_DNSSEC
-   if (option_bool(OPT_DNSSEC_VALID))
-     {
-+      int rc;
-+
-+      /* Delay creating the timestamp file until here, after we've changed user, so that
-+	 it has the correct owner to allow updating the mtime later. 
-+	 This means we have to report fatal errors via the pipe. */
-+      if ((rc = setup_timestamp()) == -1)
-+	{
-+	  send_event(err_pipe[1], EVENT_TIME_ERR, errno, daemon->timestamp_file);
-+	  _exit(0);
-+	}
-+      
-       my_syslog(LOG_INFO, _("DNSSEC validation enabled"));
-+      
-       if (option_bool(OPT_DNSSEC_TIME))
- 	my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until first cache reload"));
--      if (badtime)
-+      
-+      if (rc == 1)
- 	my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until system time valid"));
-     }
- #endif
-@@ -1170,6 +1176,9 @@ static void fatal_event(struct event_desc *ev, char *msg)
- 
-     case EVENT_TFTP_ERR:
-       die(_("TFTP directory %s inaccessible: %s"), msg, EC_FILE);
-+    
-+    case EVENT_TIME_ERR:
-+      die(_("cannot create timestamp file %s: %s" ), msg, EC_BADCONF);
-     }
- }	
-       
-diff --git a/src/dnsmasq.h b/src/dnsmasq.h
-index a451cb4dd03c..fc7259881358 100644
---- a/src/dnsmasq.h
-+++ b/src/dnsmasq.h
-@@ -167,6 +167,7 @@ struct event_desc {
- #define EVENT_INIT      21
- #define EVENT_NEWADDR   22
- #define EVENT_NEWROUTE  23
-+#define EVENT_TIME_ERR  24
- 
- /* Exit codes. */
- #define EC_GOOD        0
-@@ -1152,7 +1153,7 @@ int dnssec_chase_cname(time_t now, struct dns_header *header, size_t plen, char
- int dnskey_keytag(int alg, int flags, unsigned char *rdata, int rdlen);
- size_t filter_rrsigs(struct dns_header *header, size_t plen);
- unsigned char* hash_questions(struct dns_header *header, size_t plen, char *name);
--int setup_timestamp(struct passwd *ent_pw);
-+int setup_timestamp(void);
- 
- /* util.c */
- void rand_init(void);
-diff --git a/src/dnssec.c b/src/dnssec.c
-index c60eacf73c6b..ad0d6f072ba2 100644
---- a/src/dnssec.c
-+++ b/src/dnssec.c
-@@ -397,18 +397,21 @@ static int serial_compare_32(unsigned long s1, unsigned long s2)
- 
- /* Called at startup. If the timestamp file is configured and exists, put its mtime on
-    timestamp_time. If it doesn't exist, create it, and set the mtime to 1-1-2015.
--   Change the ownership to the user we'll be running as, so that we can update the mtime.
-+   return -1 -> Cannot create file.
-+           0 -> not using timestamp, or timestamp exists and is in past.
-+           1 -> timestamp exists and is in future.
- */
-+
- static time_t timestamp_time;
- static int back_to_the_future;
- 
--int setup_timestamp(struct passwd *ent_pw)
-+int setup_timestamp(void)
- {
-   struct stat statbuf;
-   
-   back_to_the_future = 0;
-   
--  if (!option_bool(OPT_DNSSEC_VALID) || !daemon->timestamp_file)
-+  if (!daemon->timestamp_file)
-     return 0;
-   
-   if (stat(daemon->timestamp_file, &statbuf) != -1)
-@@ -428,7 +431,8 @@ int setup_timestamp(struct passwd *ent_pw)
-   
-   if (errno == ENOENT)
-     {
--      int fd = open(daemon->timestamp_file, O_WRONLY | O_CREAT | O_NONBLOCK, 0666);
-+      /* NB. for explanation of O_EXCL flag, see comment on pidfile in dnsmasq.c */ 
-+      int fd = open(daemon->timestamp_file, O_WRONLY | O_CREAT | O_NONBLOCK | O_EXCL, 0666);
-       if (fd != -1)
- 	{
- 	  struct utimbuf timbuf;
-@@ -436,14 +440,12 @@ int setup_timestamp(struct passwd *ent_pw)
- 	  close(fd);
- 	  
- 	  timestamp_time = timbuf.actime = timbuf.modtime = 1420070400; /* 1-1-2015 */
--	  if (utime(daemon->timestamp_file, &timbuf) == 0 &&
--	      (!ent_pw || getuid() != 0 || chown(daemon->timestamp_file, ent_pw->pw_uid, -1) == 0))
-+	  if (utime(daemon->timestamp_file, &timbuf) == 0)
- 	    goto check_and_exit;
- 	}
-     }
- 
--  die(_("Cannot create timestamp file %s: %s" ), daemon->timestamp_file, EC_BADCONF);
--  return 0;
-+  return -1;
- }
- 
- /* Check whether today/now is between date_start and date_end */
--- 
-2.1.0
-
diff --git a/src/patches/dnsmasq/006-clarify_man_page_on_RDNSS_set_in_router_advertisement.patch b/src/patches/dnsmasq/006-clarify_man_page_on_RDNSS_set_in_router_advertisement.patch
new file mode 100644
index 0000000000..19c76e630a
--- /dev/null
+++ b/src/patches/dnsmasq/006-clarify_man_page_on_RDNSS_set_in_router_advertisement.patch
@@ -0,0 +1,35 @@
+From 20fd11e11a9d09edcea94de135396ae1541fbbab Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 26 Aug 2015 22:48:13 +0100
+Subject: [PATCH] Clarify man page on RDNSS set in router advertisement.
+
+---
+ man/dnsmasq.8 |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
+index a23c898..d51b10f 100644
+--- a/man/dnsmasq.8
++++ b/man/dnsmasq.8
+@@ -1687,15 +1687,15 @@ creation are handled by a different protocol. When DHCP is in use,
+ only a subset of this is needed, and dnsmasq can handle it, using
+ existing DHCP configuration to provide most data. When RA is enabled,
+ dnsmasq will advertise a prefix for each dhcp-range, with default
+-router and recursive DNS server as the relevant link-local address on 
+-the machine running dnsmasq. By default, he "managed address" bits are set, and
++router  as the relevant link-local address on 
++the machine running dnsmasq. By default, the "managed address" bits are set, and
+ the "use SLAAC" bit is reset. This can be changed for individual
+ subnets with the mode keywords described in
+ .B --dhcp-range.
+ RFC6106 DNS parameters are included in the advertisements. By default,
+ the relevant link-local address of the machine running dnsmasq is sent
+ as recursive DNS server. If provided, the DHCPv6 options dns-server and
+-domain-search are used for RDNSS and DNSSL.
++domain-search are used for the DNS server (RDNSS) and the domain serach list (DNSSL).
+ .TP
+ .B --ra-param=<interface>,[high|low],[[<ra-interval>],<router lifetime>]
+ Set non-default values for router advertisements sent via an
+-- 
+1.7.10.4
+
diff --git a/src/patches/dnsmasq/007-handle_signed_dangling_CNAME_replies_to_DS_queries.patch b/src/patches/dnsmasq/007-handle_signed_dangling_CNAME_replies_to_DS_queries.patch
new file mode 100644
index 0000000000..832a22e02d
--- /dev/null
+++ b/src/patches/dnsmasq/007-handle_signed_dangling_CNAME_replies_to_DS_queries.patch
@@ -0,0 +1,30 @@
+From 6de81f1250fd323c9155de065d5a9dc200a6f20b Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 9 Sep 2015 22:51:13 +0100
+Subject: [PATCH] Handle signed dangling CNAME replies to DS queries.
+
+---
+ src/dnssec.c |    7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/src/dnssec.c b/src/dnssec.c
+index 4deda24..67ce486 100644
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -1232,11 +1232,8 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
+    
+   /* If we return STAT_NO_SIG, name contains the name of the DS query */
+   if (val == STAT_NO_SIG)
+-    {
+-      *keyname = 0;
+-      return val;
+-    }  
+-
++    return val;
++  
+   /* If the key needed to validate the DS is on the same domain as the DS, we'll
+      loop getting nowhere. Stop that now. This can happen of the DS answer comes
+      from the DS's zone, and not the parent zone. */
+-- 
+1.7.10.4
+
diff --git a/src/patches/dnsmasq/008-DHCPv6_option_56_does_not_hold_an_address_list.patch b/src/patches/dnsmasq/008-DHCPv6_option_56_does_not_hold_an_address_list.patch
new file mode 100644
index 0000000000..fdccd0ebc5
--- /dev/null
+++ b/src/patches/dnsmasq/008-DHCPv6_option_56_does_not_hold_an_address_list.patch
@@ -0,0 +1,25 @@
+From 102208df695e886a3086754d32bf7f8c541fbe46 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Thu, 10 Sep 2015 21:50:00 +0100
+Subject: [PATCH] DHCPv6 option 56 does not hold an address list. (RFC 5908).
+
+---
+ src/dhcp-common.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/dhcp-common.c b/src/dhcp-common.c
+index bc48f41..8fc171a 100644
+--- a/src/dhcp-common.c
++++ b/src/dhcp-common.c
+@@ -599,7 +599,7 @@ static const struct opttab_t opttab6[] = {
+   { "sntp-server", 31,  OT_ADDR_LIST },
+   { "information-refresh-time", 32, OT_TIME },
+   { "FQDN", 39, OT_INTERNAL | OT_RFC1035_NAME },
+-  { "ntp-server", 56,  OT_ADDR_LIST },
++  { "ntp-server", 56,  0 },
+   { "bootfile-url", 59, OT_NAME },
+   { "bootfile-param", 60, OT_CSTRING },
+   { NULL, 0, 0 }
+-- 
+1.7.10.4
+
diff --git a/src/patches/dnsmasq/009-Respect_the_--no_resolv_flag_in_inotify_code.patch b/src/patches/dnsmasq/009-Respect_the_--no_resolv_flag_in_inotify_code.patch
new file mode 100644
index 0000000000..2014fdb21f
--- /dev/null
+++ b/src/patches/dnsmasq/009-Respect_the_--no_resolv_flag_in_inotify_code.patch
@@ -0,0 +1,47 @@
+From 77607cbea0ad0f876dfb79c8b2c121ee400d57d0 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Thu, 10 Sep 2015 23:08:43 +0100
+Subject: [PATCH] Respect the --no-resolv flag in inotify code.
+
+---
+ CHANGELOG        |    7 ++++++-
+ debian/changelog |    6 ++++++
+ src/inotify.c    |    3 +++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index bbc2834..d6e309f 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -7,8 +7,13 @@ version 2.76
+ 
+ 	    Enhance --add-subnet to allow arbitrary subnet addresses.
+             Thanks to Ed Barsley for the patch.
++
++	    Respect the --no-resolv flag in inotify code. Fixes bug
++	    which caused dnsmasq to fail to start if a resolv-file 
++	    was a dangling symbolic link, even of --no-resolv set.
++	    Thanks to Alexander Kurtz for spotting the problem.
++
+ 	
+-	    
+ version 2.75
+             Fix reversion on 2.74 which caused 100% CPU use when a 
+ 	    dhcp-script is configured. Thanks to Adrian Davey for
+diff --git a/src/inotify.c b/src/inotify.c
+index 52d412f..ef05c58 100644
+--- a/src/inotify.c
++++ b/src/inotify.c
+@@ -90,6 +90,9 @@ void inotify_dnsmasq_init()
+   
+   if (daemon->inotifyfd == -1)
+     die(_("failed to create inotify: %s"), NULL, EC_MISC);
++
++  if (option_bool(OPT_NO_RESOLV))
++    return;
+   
+   for (res = daemon->resolv_files; res; res = res->next)
+     {
+-- 
+1.7.10.4
+
diff --git a/src/patches/dracut-038_add_sdhci-pci.patch b/src/patches/dracut-038_add_sdhci-pci.patch
new file mode 100644
index 0000000000..b002246d45
--- /dev/null
+++ b/src/patches/dracut-038_add_sdhci-pci.patch
@@ -0,0 +1,12 @@
+diff -Naur dracut-038.org/modules.d/90kernel-modules/module-setup.sh dracut-038/modules.d/90kernel-modules/module-setup.sh
+--- dracut-038.org/modules.d/90kernel-modules/module-setup.sh	2014-06-30 12:03:12.000000000 +0200
++++ dracut-038/modules.d/90kernel-modules/module-setup.sh	2015-05-05 14:58:56.820197839 +0200
+@@ -47,7 +47,7 @@
+             atkbd i8042 usbhid hid-apple hid-sunplus hid-cherry hid-logitech \
+             hid-logitech-dj hid-microsoft firewire-ohci \
+             pcmcia usb_storage nvme hid-hyperv hv-vmbus \
+-            sdhci_acpi
++            sdhci_acpi sdhci_pci
+ 
+         if [[ "$(uname -p)" == arm* ]]; then
+             # arm specific modules
diff --git a/src/patches/fireinfo/0001-Add-an-other-forbidden-string-Serial.patch b/src/patches/fireinfo/0001-Add-an-other-forbidden-string-Serial.patch
new file mode 100644
index 0000000000..00c983809f
--- /dev/null
+++ b/src/patches/fireinfo/0001-Add-an-other-forbidden-string-Serial.patch
@@ -0,0 +1,25 @@
+From edacae4b2cdc41f1c0bfc93e041532ff6c49f60c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer@ipfire.org>
+Date: Tue, 17 Mar 2015 22:19:17 +0100
+Subject: [PATCH 1/5] Add an other forbidden string: "Serial"
+
+---
+ src/fireinfo/system.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fireinfo/system.py b/src/fireinfo/system.py
+index daf77b399d20..9d7872822b85 100644
+--- a/src/fireinfo/system.py
++++ b/src/fireinfo/system.py
+@@ -45,7 +45,7 @@ INVALID_ID_STRINGS = (
+ 	"EVAL",
+ 	"Not Applicable",
+ 	"None", "empty",
+-	"System Serial Number",
++	"Serial", "System Serial Number",
+ 	"XXXXX",
+ 	"01010101-0101-0101-0101-010101010101",
+ 	"00020003-0004-0005-0006-000700080009",
+-- 
+2.4.3
+
diff --git a/src/patches/fireinfo/0002-Escape-any-non-printable-ascii-characters.patch b/src/patches/fireinfo/0002-Escape-any-non-printable-ascii-characters.patch
new file mode 100644
index 0000000000..576154b7d2
--- /dev/null
+++ b/src/patches/fireinfo/0002-Escape-any-non-printable-ascii-characters.patch
@@ -0,0 +1,69 @@
+From 4468fb2eb49e21d2350f6619584e6816f5159d29 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer@ipfire.org>
+Date: Sat, 28 Mar 2015 13:17:57 +0100
+Subject: [PATCH 2/5] Escape any non-printable ascii characters
+
+http://forum.ipfire.org/viewtopic.php?f=5&t=12970
+---
+ src/fireinfo/system.py | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/src/fireinfo/system.py b/src/fireinfo/system.py
+index 9d7872822b85..4148c66eded7 100644
+--- a/src/fireinfo/system.py
++++ b/src/fireinfo/system.py
+@@ -325,6 +325,16 @@ class System(object):
+ 
+ 		return v, m
+ 
++	@staticmethod
++	def escape_string(s):
++		"""
++			Will remove all non-printable characters from the given string
++		"""
++		if s is None:
++			return
++
++		return filter(lambda x: x in string.printable, s)
++
+ 	@property
+ 	def vendor(self):
+ 		"""
+@@ -334,14 +344,14 @@ class System(object):
+ 		for file in ("sys_vendor", "board_vendor", "chassis_vendor",):
+ 			ret = read_from_file(os.path.join(SYS_CLASS_DMI, file))
+ 			if ret:
+-				return ret
++				return self.escape_string(ret)
+ 
+ 		if os.path.exists("/proc/device-tree"):
+ 			ret = self.__cpuinfo.get("Hardware", None)
+ 		else:
+ 			ret, m = self.vendor_model_tuple()
+ 
+-		return ret
++		return self.escape_string(ret)
+ 
+ 	@property
+ 	def model(self):
+@@ -352,7 +362,7 @@ class System(object):
+ 		for file in ("product_name", "board_model", "chassis_model",):
+ 			ret = read_from_file(os.path.join(SYS_CLASS_DMI, file))
+ 			if ret:
+-				return ret
++				return self.escape_string(ret)
+ 
+ 		# Read device-tree model if available
+ 		ret = read_from_file("/proc/device-tree/model")
+@@ -364,7 +374,7 @@ class System(object):
+ 		if not ret:
+ 			v, ret = self.vendor_model_tuple()
+ 
+-		return ret
++		return self.escape_string(ret)
+ 
+ 	@property
+ 	def memory(self):
+-- 
+2.4.3
+
diff --git a/src/patches/fireinfo/0003-Skip-search-for-hypervisor-name-when-the-CPU-string-.patch b/src/patches/fireinfo/0003-Skip-search-for-hypervisor-name-when-the-CPU-string-.patch
new file mode 100644
index 0000000000..f64325117a
--- /dev/null
+++ b/src/patches/fireinfo/0003-Skip-search-for-hypervisor-name-when-the-CPU-string-.patch
@@ -0,0 +1,35 @@
+From c667589410912ca980a78f417e86dd6585d58f9a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer@ipfire.org>
+Date: Mon, 4 May 2015 16:00:31 +0200
+Subject: [PATCH 3/5] Skip search for hypervisor name when the CPU string is
+ empty
+
+---
+ src/_fireinfo/fireinfo.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/src/_fireinfo/fireinfo.c b/src/_fireinfo/fireinfo.c
+index fc639d9d4cd9..6601c21a733f 100644
+--- a/src/_fireinfo/fireinfo.c
++++ b/src/_fireinfo/fireinfo.c
+@@ -156,11 +156,12 @@ int detect_hypervisor(int *hypervisor) {
+ 
+ 		*hypervisor = HYPER_OTHER;
+ 
+-		int id;
+-		for (id = HYPER_NONE + 1; id < HYPER_LAST; id++) {
+-			if (strcmp(hypervisor_ids[id], sig.text) == 0) {
+-				*hypervisor = id;
+-				break;
++		if (*sig.text) {
++			for (int id = HYPER_NONE + 1; id < HYPER_LAST; id++) {
++				if (strcmp(hypervisor_ids[id], sig.text) == 0) {
++					*hypervisor = id;
++					break;
++				}
+ 			}
+ 		}
+ 
+-- 
+2.4.3
+
diff --git a/src/patches/fireinfo/0004-Filter-all-IDs-that-only-consist-of-0xff.patch b/src/patches/fireinfo/0004-Filter-all-IDs-that-only-consist-of-0xff.patch
new file mode 100644
index 0000000000..737a319c59
--- /dev/null
+++ b/src/patches/fireinfo/0004-Filter-all-IDs-that-only-consist-of-0xff.patch
@@ -0,0 +1,28 @@
+From d58f8ef75a29dd6f8968084b5383ce0f39c75666 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer@ipfire.org>
+Date: Wed, 12 Aug 2015 10:50:42 +0100
+Subject: [PATCH 4/5] Filter all IDs that only consist of 0xff
+
+Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
+---
+ src/fireinfo/system.py | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/fireinfo/system.py b/src/fireinfo/system.py
+index 4148c66eded7..edf7359a17e6 100644
+--- a/src/fireinfo/system.py
++++ b/src/fireinfo/system.py
+@@ -255,6 +255,10 @@ class System(object):
+ 						id = None
+ 						break
+ 
++			# Check if the string only contains 0xff
++			if all((e == "\xff" for e in id)):
++				id = None
++
+ 			if id:
+ 				_ids.append(id)
+ 
+-- 
+2.4.3
+
diff --git a/src/patches/fireinfo/0005-Fix-crash-if-there-is-id-has-already-been-reset-to-N.patch b/src/patches/fireinfo/0005-Fix-crash-if-there-is-id-has-already-been-reset-to-N.patch
new file mode 100644
index 0000000000..dcc552da17
--- /dev/null
+++ b/src/patches/fireinfo/0005-Fix-crash-if-there-is-id-has-already-been-reset-to-N.patch
@@ -0,0 +1,26 @@
+From deafec982e4c8f2e6ffa3bf70b0a94fa30158e9a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer@ipfire.org>
+Date: Wed, 9 Sep 2015 15:04:43 +0100
+Subject: [PATCH 5/5] Fix crash if there is id has already been reset to None
+
+Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
+---
+ src/fireinfo/system.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fireinfo/system.py b/src/fireinfo/system.py
+index edf7359a17e6..c2ba12e818f0 100644
+--- a/src/fireinfo/system.py
++++ b/src/fireinfo/system.py
+@@ -256,7 +256,7 @@ class System(object):
+ 						break
+ 
+ 			# Check if the string only contains 0xff
+-			if all((e == "\xff" for e in id)):
++			if id and all((e == "\xff" for e in id)):
+ 				id = None
+ 
+ 			if id:
+-- 
+2.4.3
+
diff --git a/src/patches/glibc-2.12-accept-make-versions-4.0-and-greater.patch b/src/patches/glibc-2.12-accept-make-versions-4.0-and-greater.patch
new file mode 100644
index 0000000000..7faf857faf
--- /dev/null
+++ b/src/patches/glibc-2.12-accept-make-versions-4.0-and-greater.patch
@@ -0,0 +1,35 @@
+From 28d708c44bc47b56f6551ff285f78edcf61c208a Mon Sep 17 00:00:00 2001
+From: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
+Date: Thu, 31 Oct 2013 12:37:50 +1000
+Subject: Accept make versions 4.0 and greater
+
+
+diff --git a/configure b/configure
+index f382138..5e61abd 100755
+--- a/configure
++++ b/configure
+@@ -4761,7 +4761,7 @@ $as_echo_n "checking version of $MAKE... " >&6; }
+   ac_prog_version=`$MAKE --version 2>&1 | sed -n 's/^.*GNU Make[^0-9]*\([0-9][0-9.]*\).*$/\1/p'`
+   case $ac_prog_version in
+     '') ac_prog_version="v. ?.??, bad"; ac_verc_fail=yes;;
+-    3.79* | 3.[89]*)
++    3.79* | 3.[89]* | [4-9].* | [1-9][0-9]*)
+        ac_prog_version="$ac_prog_version, ok"; ac_verc_fail=no;;
+     *) ac_prog_version="$ac_prog_version, bad"; ac_verc_fail=yes;;
+ 
+diff --git a/configure.in b/configure.in
+index 49b70fd..6da8efd 100644
+--- a/configure.in
++++ b/configure.in
+@@ -984,7 +984,7 @@ AC_CHECK_PROG_VER(CC, ${ac_tool_prefix}gcc ${ac_tool_prefix}cc, -v,
+   critic_missing="$critic_missing gcc")
+ AC_CHECK_PROG_VER(MAKE, gnumake gmake make, --version,
+   [GNU Make[^0-9]*\([0-9][0-9.]*\)],
+-  [3.79* | 3.[89]*], critic_missing="$critic_missing make")
++  [3.79* | 3.[89]* | [4-9].* | [1-9][0-9]*], critic_missing="$critic_missing make")
+ 
+ AC_CHECK_PROG_VER(MSGFMT, gnumsgfmt gmsgfmt msgfmt, --version,
+   [GNU gettext.* \([0-9]*\.[0-9.]*\)],
+-- 
+cgit v0.10.2
+
diff --git a/src/patches/glibc/glibc-rh1207995.patch b/src/patches/glibc/glibc-rh1207995.patch
new file mode 100644
index 0000000000..1732de6492
--- /dev/null
+++ b/src/patches/glibc/glibc-rh1207995.patch
@@ -0,0 +1,27 @@
+#
+# Based on the following commit:
+#
+# commit f9d2d03254a58d92635a311a42253eeed5a40a47
+# Author: Andreas Schwab <schwab@suse.de>
+# Date:   Mon May 26 18:01:31 2014 +0200
+# 
+#     Fix invalid file descriptor reuse while sending DNS query (BZ #15946)
+# 
+# 2014-06-03  Andreas Schwab  <schwab@suse.de>
+# 
+# 	[BZ #15946]
+# 	* resolv/res_send.c (send_dg): Reload file descriptor after
+# 	calling reopen.
+# 
+diff --git a/resolv/res_send.c b/resolv/res_send.c
+index 3273d55..af42b8a 100644
+--- a/resolv/res_send.c
++++ b/resolv/res_send.c
+@@ -1410,6 +1410,7 @@ send_dg(res_state statp,
+ 					retval = reopen (statp, terrno, ns);
+ 					if (retval <= 0)
+ 						return retval;
++					pfd[0].fd = EXT(statp).nssocks[ns];
+ 				}
+ 			}
+ 			goto wait;
diff --git a/src/patches/glibc/glibc-rh1209375.patch b/src/patches/glibc/glibc-rh1209375.patch
new file mode 100644
index 0000000000..74393f0395
--- /dev/null
+++ b/src/patches/glibc/glibc-rh1209375.patch
@@ -0,0 +1,18 @@
+@@ -, +, @@
+ resolv/nss_dns/dns-host.c:getanswer_r.
+---
+ resolv/nss_dns/dns-host.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+--- a/resolv/nss_dns/dns-host.c
++++ a/resolv/nss_dns/dns-host.c
+@@ -615,7 +615,8 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
+   int have_to_map = 0;
+   uintptr_t pad = -(uintptr_t) buffer % __alignof__ (struct host_data);
+   buffer += pad;
+-  if (__builtin_expect (buflen < sizeof (struct host_data) + pad, 0))
++  buflen = buflen > pad ? buflen - pad : 0;
++  if (__builtin_expect (buflen < sizeof (struct host_data), 0))
+     {
+       /* The buffer is too small.  */
+     too_small:
+--
diff --git a/src/patches/glibc/glibc-rh1217186.patch b/src/patches/glibc/glibc-rh1217186.patch
new file mode 100644
index 0000000000..6c6c3934ef
--- /dev/null
+++ b/src/patches/glibc/glibc-rh1217186.patch
@@ -0,0 +1,65 @@
+#
+# Author: Carlos O'Donell
+# Upstream status: Needs to go upstream (2015-05-07)
+#
+diff --git a/inet/rcmd.c b/inet/rcmd.c
+index acacaa0..9f2443b 100644
+--- a/inet/rcmd.c
++++ b/inet/rcmd.c
+@@ -803,29 +803,38 @@ __validuser2_sa(hostf, ra, ralen, luser, ruser, rhost)
+ 	*p = '\0';              /* <nul> terminate username (+host?) */
+ 
+ 	/* buf -> host(?) ; user -> username(?) */
++	if (*buf == '\0')
++	  break;
++	if (*user == '\0')
++	  user = luser;
++
++	/* First check the user part.  This is an optimization, since
++	   one should always check the host first in order to detect
++	   negative host checks (which we check for later).  */
++	ucheck = __icheckuser (user, ruser);
++
++	/* Either we found the user, or we didn't and this is a
++	   negative host check.  We must do the negative host lookup
++	   in order to preserve the semantics of stopping on this line
++	   before processing others.  */
++	if (ucheck != 0 || *buf == '-') {
++
++	    /* Next check host part */
++	    hcheck = __checkhost_sa (ra, ralen, buf, rhost);
++
++	    /* Negative '-host user(?)' match?  */
++	    if (hcheck < 0)
++		break;
+ 
+-	/* First check host part */
+-	hcheck = __checkhost_sa (ra, ralen, buf, rhost);
+-
+-	if (hcheck < 0)
+-	    break;
+-
+-	if (hcheck) {
+-	    /* Then check user part */
+-	    if (! (*user))
+-		user = luser;
+-
+-	    ucheck = __icheckuser (user, ruser);
+-
+-	    /* Positive 'host user' match? */
+-	    if (ucheck > 0) {
++	    /* Positive 'host user' match?  */
++	    if (hcheck > 0 && ucheck > 0) {
+ 		retval = 0;
+ 		break;
+ 	    }
+ 
+-	    /* Negative 'host -user' match? */
+-	    if (ucheck < 0)
+-		break;
++	    /* Negative 'host -user' match?  */
++	    if (hcheck > 0 && ucheck < 0)
++	      break;
+ 
+ 	    /* Neither, go on looking for match */
+ 	}
diff --git a/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch b/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch
new file mode 100644
index 0000000000..bbda55a632
--- /dev/null
+++ b/src/patches/hostapd-2.3_increase_EAPOL-timeouts.patch
@@ -0,0 +1,16 @@
+diff -Naur hostapd-2.3.org/src/ap/wpa_auth.c hostapd-2.3/src/ap/wpa_auth.c
+--- hostapd-2.3.org/src/ap/wpa_auth.c	2014-10-09 16:41:31.000000000 +0200
++++ hostapd-2.3/src/ap/wpa_auth.c	2015-04-07 16:32:10.671422975 +0200
+@@ -45,9 +45,9 @@
+ 
+ static const u32 dot11RSNAConfigGroupUpdateCount = 4;
+ static const u32 dot11RSNAConfigPairwiseUpdateCount = 4;
+-static const u32 eapol_key_timeout_first = 100; /* ms */
+-static const u32 eapol_key_timeout_subseq = 1000; /* ms */
+-static const u32 eapol_key_timeout_first_group = 500; /* ms */
++static const u32 eapol_key_timeout_first = 300; /* ms */
++static const u32 eapol_key_timeout_subseq = 3000; /* ms */
++static const u32 eapol_key_timeout_first_group = 1500; /* ms */
+ 
+ /* TODO: make these configurable */
+ static const int dot11RSNAConfigPMKLifetime = 43200;
diff --git a/src/patches/linux-3.10-dvb_tevi_s482.patch b/src/patches/linux-3.10-dvb_tevi_s482.patch
new file mode 100644
index 0000000000..fed875da80
--- /dev/null
+++ b/src/patches/linux-3.10-dvb_tevi_s482.patch
@@ -0,0 +1,240 @@
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index 1a3df10..82d35c6 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -31,6 +31,9 @@
+ #include "m88rs2000.h"
+ #include "tda18271.h"
+ #include "cxd2820r.h"
++#include "m88ds3103.h"
++#include "m88ts2022.h"
++
+ 
+ /* Max transfer size done by I2C transfer functions */
+ #define MAX_XFER_SIZE  64
+@@ -71,6 +74,14 @@
+ #define USB_PID_TEVII_S480_2 0xd482
+ #endif
+ 
++#ifndef USB_PID_TEVII_S482_1
++#define USB_PID_TEVII_S482_1 0xd483
++#endif
++
++#ifndef USB_PID_TEVII_S482_2
++#define USB_PID_TEVII_S482_2 0xd484
++#endif
++
+ #ifndef USB_PID_PROF_1100
+ #define USB_PID_PROF_1100 0xb012
+ #endif
+@@ -1117,6 +1128,19 @@ static struct tda18271_config tda18271_config = {
+ 	.gate = TDA18271_GATE_DIGITAL,
+ };
+ 
++static const struct m88ds3103_config s482_m88ds3103_config = {
++	.i2c_addr = 0x68,
++	.clock = 27000000,
++	.i2c_wr_max = 33,
++	.clock_out = 0,
++	.ts_mode = M88DS3103_TS_CI,
++	.ts_clk = 16000,
++	.ts_clk_pol = 0,
++	.agc = 0x99,
++	.lnb_hv_pol = 1,
++	.lnb_en_pol = 1,
++	 };
++
+ static u8 m88rs2000_inittab[] = {
+ 	DEMOD_WRITE, 0x9a, 0x30,
+ 	DEMOD_WRITE, 0x00, 0x01,
+@@ -1386,6 +1410,83 @@ static int su3000_frontend_attach(struct dvb_usb_adapter *d)
+ 	return -EIO;
+ }
+ 
++static int m88ds3103_frontend_attach(struct dvb_usb_adapter *d)
++{
++	u8 obuf[3] = { 0xe, 0x80, 0 };
++	u8 ibuf[] = { 0 };
++
++	/* demod I2C adapter */
++	struct i2c_adapter *i2c_adapter;
++	struct i2c_client *client;
++	struct i2c_board_info info;
++	struct m88ts2022_config m88ts2022_config = {
++		.clock = 27000000,
++		 };
++	memset(&info, 0, sizeof(struct i2c_board_info));
++	if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
++		err("command 0x0e transfer failed.");
++
++	obuf[0] = 0xe;
++	obuf[1] = 0x02;
++	obuf[2] = 1;
++
++	if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
++		err("command 0x0e transfer failed.");
++	msleep(300);
++
++	obuf[0] = 0xe;
++	obuf[1] = 0x83;
++	obuf[2] = 0;
++
++	if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
++		err("command 0x0e transfer failed.");
++
++	obuf[0] = 0xe;
++	obuf[1] = 0x83;
++	obuf[2] = 1;
++
++	if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
++		err("command 0x0e transfer failed.");
++
++	obuf[0] = 0x51;
++
++	if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
++		err("command 0x51 transfer failed.");
++	d->fe_adap[0].fe = dvb_attach(m88ds3103_attach,
++		&s482_m88ds3103_config,
++		&d->dev->i2c_adap,
++		&i2c_adapter);
++	if (d->fe_adap[0].fe == NULL)
++		return -EIO;
++	/* attach tuner */
++	m88ts2022_config.fe = d->fe_adap[0].fe;
++	strlcpy(info.type, "m88ts2022", I2C_NAME_SIZE);
++	info.addr = 0x60;
++	info.platform_data = &m88ts2022_config;
++	request_module("m88ts2022");
++	client = i2c_new_device(i2c_adapter, &info);
++	if (client == NULL || client->dev.driver == NULL) {
++		dvb_frontend_detach(d->fe_adap[0].fe);
++		goto fail_attach;
++	}
++	if (!try_module_get(client->dev.driver->owner)) {
++		        i2c_unregister_device(client);
++				dvb_frontend_detach(d->fe_adap[0].fe);
++		        goto fail_attach;
++	}
++	info("attached m88ds3103/m88ts2022!\n");
++
++	/* delegate signal strength measurement to tuner */
++
++	d->fe_adap[0].fe->ops.read_signal_strength =
++		d->fe_adap[0].fe->ops.tuner_ops.get_rf_strength;
++
++	return 0;
++fail_attach:
++	info("Failed to attach m88ds3103/m88ts2022!\n");
++	return -EIO;
++}
++
+ static int t220_frontend_attach(struct dvb_usb_adapter *d)
+ {
+ 	u8 obuf[3] = { 0xe, 0x87, 0 };
+@@ -1557,6 +1658,8 @@ enum dw2102_table_entry {
+ 	TEVII_S480_2,
+ 	X3M_SPC1400HD,
+ 	TEVII_S421,
++	TEVII_S482_1,
++	TEVII_S482_2,
+ 	TEVII_S632,
+ 	TERRATEC_CINERGY_S2_R2,
+ 	GOTVIEW_SAT_HD,
+@@ -1580,7 +1683,9 @@ static struct usb_device_id dw2102_table[] = {
+ 	[TEVII_S480_2] = {USB_DEVICE(0x9022, USB_PID_TEVII_S480_2)},
+ 	[X3M_SPC1400HD] = {USB_DEVICE(0x1f4d, 0x3100)},
+ 	[TEVII_S421] = {USB_DEVICE(0x9022, USB_PID_TEVII_S421)},
+-	[TEVII_S632] = {USB_DEVICE(0x9022, USB_PID_TEVII_S632)},
++	[TEVII_S482_1] = { USB_DEVICE(0x9022, USB_PID_TEVII_S482_1) },
++	[TEVII_S482_2] = { USB_DEVICE(0x9022, USB_PID_TEVII_S482_2) },
++	[TEVII_S632] = { USB_DEVICE(0x9022, USB_PID_TEVII_S632) },
+ 	[TERRATEC_CINERGY_S2_R2] = {USB_DEVICE(USB_VID_TERRATEC, 0x00b0)},
+ 	[GOTVIEW_SAT_HD] = {USB_DEVICE(0x1FE1, USB_PID_GOTVIEW_SAT_HD)},
+ 	[GENIATECH_T220] = {USB_DEVICE(0x1f4d, 0xD220)},
+@@ -2012,6 +2117,59 @@ static struct dvb_usb_device_properties su3000_properties = {
+ 	}
+ };
+ 
++static struct dvb_usb_device_properties m88ds3103_properties = {
++	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
++	.usb_ctrl = DEVICE_SPECIFIC,
++	.size_of_priv = sizeof(struct su3000_state),
++	.power_ctrl = su3000_power_ctrl,
++	.num_adapters = 1,
++	.identify_state = su3000_identify_state,
++	.i2c_algo = &su3000_i2c_algo,
++
++	.rc.core = {
++		.rc_interval = 150,
++		.rc_codes = RC_MAP_TEVII_NEC,
++		.module_name = "dw2102",
++		.allowed_protos = RC_BIT_NEC,
++		.rc_query = dw2102_rc_query,
++	},
++
++	.read_mac_address = su3000_read_mac_address,
++
++	.generic_bulk_ctrl_endpoint = 0x01,
++
++	.adapter = {
++		{
++			.num_frontends = 1,
++			.fe = { {
++					.streaming_ctrl = su3000_streaming_ctrl,
++					.frontend_attach = m88ds3103_frontend_attach,
++					.stream = {
++						.type = USB_BULK,
++						.count = 8,
++						.endpoint = 0x82,
++						.u = {
++							.bulk = {
++								.buffersize = 4096,
++							}
++						}
++					}
++				} },
++		}
++		},
++		.num_device_descs = 2,
++		.devices = {
++			{ "TeVii S482.1 USB",
++			{ &dw2102_table[TEVII_S482_1], NULL },
++			{ NULL },
++			},
++			{ "TeVii S482.2 USB",
++			{ &dw2102_table[TEVII_S482_2], NULL },
++			{ NULL },
++			},
++			}
++};
++
+ static struct dvb_usb_device_properties t220_properties = {
+ 	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
+ 	.usb_ctrl = DEVICE_SPECIFIC,
+@@ -2131,11 +2289,13 @@ static int dw2102_probe(struct usb_interface *intf,
+ 	    0 == dvb_usb_device_init(intf, p7500,
+ 			THIS_MODULE, NULL, adapter_nr) ||
+ 	    0 == dvb_usb_device_init(intf, s421,
+-			THIS_MODULE, NULL, adapter_nr) ||
+-	    0 == dvb_usb_device_init(intf, &su3000_properties,
+-			 THIS_MODULE, NULL, adapter_nr) ||
++			THIS_MODULE, NULL, adapter_nr)  ||
+ 	    0 == dvb_usb_device_init(intf, &t220_properties,
+-			 THIS_MODULE, NULL, adapter_nr))
++			THIS_MODULE, NULL, adapter_nr) ||
++		0 == dvb_usb_device_init(intf, &m88ds3103_properties,
++			THIS_MODULE, NULL, adapter_nr) ||
++		0 == dvb_usb_device_init(intf, &su3000_properties,
++			THIS_MODULE, NULL, adapter_nr))
+ 		return 0;
+ 
+ 	return -ENODEV;
+@@ -2153,7 +2313,7 @@ module_usb_driver(dw2102_driver);
+ MODULE_AUTHOR("Igor M. Liplianin (c) liplianin@me.by");
+ MODULE_DESCRIPTION("Driver for DVBWorld DVB-S 2101, 2102, DVB-S2 2104,"
+ 			" DVB-C 3101 USB2.0,"
+-			" TeVii S600, S630, S650, S660, S480, S421, S632"
++			" TeVii S600, S630, S650, S660, S480, S482, S421, S632"
+ 			" Prof 1100, 7500 USB2.0,"
+ 			" Geniatech SU3000, T220 devices");
+ MODULE_VERSION("0.1");
diff --git a/src/patches/linux-3.10-apu_leds.patch b/src/patches/linux-3.14-apu_leds.patch
similarity index 80%
rename from src/patches/linux-3.10-apu_leds.patch
rename to src/patches/linux-3.14-apu_leds.patch
index 53d389af1a..13d7c76101 100644
--- a/src/patches/linux-3.10-apu_leds.patch
+++ b/src/patches/linux-3.14-apu_leds.patch
@@ -1,22 +1,30 @@
-diff -Naur linux-3.10.33.org/arch/x86/Kconfig linux-3.10.33/arch/x86/Kconfig
---- linux-3.10.33.org/arch/x86/Kconfig	2014-03-07 06:58:45.000000000 +0100
-+++ linux-3.10.33/arch/x86/Kconfig	2014-03-17 17:02:46.703135023 +0100
-@@ -2199,6 +2199,12 @@
+diff -Naur linux-3.14.43.org/arch/x86/Kconfig linux-3.14.43/arch/x86/Kconfig
+--- linux-3.14.43.org/arch/x86/Kconfig	2015-05-17 18:54:01.000000000 +0200
++++ linux-3.14.43/arch/x86/Kconfig	2015-09-19 20:14:52.436654988 +0200
+@@ -2287,6 +2287,7 @@
  	   - AC adapter status updates
  	   - Battery status updates
  
++
+ config ALIX
+ 	bool "PCEngines ALIX System Support (LED setup)"
+ 	select GPIOLIB
+@@ -2325,6 +2326,12 @@
+ 
+ endif # X86_32
+ 
 +config APULED
 +	bool "PCEngines APU Led Support"
 +	depends on DMI
 +	---help---
 +	  This option enables system support for the PCEngines APU.
 +
- config ALIX
- 	bool "PCEngines ALIX System Support (LED setup)"
- 	select GPIOLIB
-diff -Naur linux-3.10.33.org/arch/x86/platform/apu/apu-led.c linux-3.10.33/arch/x86/platform/apu/apu-led.c
---- linux-3.10.33.org/arch/x86/platform/apu/apu-led.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-3.10.33/arch/x86/platform/apu/apu-led.c	2014-03-17 17:00:36.187188456 +0100
+ config AMD_NB
+ 	def_bool y
+ 	depends on CPU_SUP_AMD && PCI
+diff -Naur linux-3.14.43.org/arch/x86/platform/apu/apu-led.c linux-3.14.43/arch/x86/platform/apu/apu-led.c
+--- linux-3.14.43.org/arch/x86/platform/apu/apu-led.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-3.14.43/arch/x86/platform/apu/apu-led.c	2015-09-19 20:12:20.520647636 +0200
 @@ -0,0 +1,181 @@
 +/*
 + * LEDs driver for PCEngines apu
@@ -199,14 +207,14 @@ diff -Naur linux-3.10.33.org/arch/x86/platform/apu/apu-led.c linux-3.10.33/arch/
 +MODULE_AUTHOR("Christian Herzog");
 +MODULE_DESCRIPTION("PCEngines apu LED driver");
 +MODULE_LICENSE("GPL");
-diff -Naur linux-3.10.33.org/arch/x86/platform/apu/Makefile linux-3.10.33/arch/x86/platform/apu/Makefile
---- linux-3.10.33.org/arch/x86/platform/apu/Makefile	1970-01-01 01:00:00.000000000 +0100
-+++ linux-3.10.33/arch/x86/platform/apu/Makefile	2014-03-17 17:05:19.245651480 +0100
+diff -Naur linux-3.14.43.org/arch/x86/platform/apu/Makefile linux-3.14.43/arch/x86/platform/apu/Makefile
+--- linux-3.14.43.org/arch/x86/platform/apu/Makefile	1970-01-01 01:00:00.000000000 +0100
++++ linux-3.14.43/arch/x86/platform/apu/Makefile	2015-09-19 20:12:20.520647636 +0200
 @@ -0,0 +1 @@
 +obj-$(CONFIG_APULED)		+= apu-led.o
-diff -Naur linux-3.10.33.org/arch/x86/platform/Makefile linux-3.10.33/arch/x86/platform/Makefile
---- linux-3.10.33.org/arch/x86/platform/Makefile	2014-03-07 06:58:45.000000000 +0100
-+++ linux-3.10.33/arch/x86/platform/Makefile	2014-03-17 14:53:15.078571307 +0100
+diff -Naur linux-3.14.43.org/arch/x86/platform/Makefile linux-3.14.43/arch/x86/platform/Makefile
+--- linux-3.14.43.org/arch/x86/platform/Makefile	2015-05-17 18:54:01.000000000 +0200
++++ linux-3.14.43/arch/x86/platform/Makefile	2015-09-19 20:12:20.520647636 +0200
 @@ -1,4 +1,5 @@
  # Platform specific code goes here
 +obj-y	+= apu/
diff --git a/src/patches/linux-3.14.43_SuperSSpeed_NOTRIM.patch b/src/patches/linux-3.14.43_SuperSSpeed_NOTRIM.patch
new file mode 100644
index 0000000000..1745bbcbe2
--- /dev/null
+++ b/src/patches/linux-3.14.43_SuperSSpeed_NOTRIM.patch
@@ -0,0 +1,47 @@
+diff -Naur linux-3.14.43.org/drivers/ata/libata-core.c linux-3.14.43/drivers/ata/libata-core.c
+--- linux-3.14.43.org/drivers/ata/libata-core.c	2015-05-17 18:54:01.000000000 +0200
++++ linux-3.14.43/drivers/ata/libata-core.c	2015-07-11 19:15:01.450041507 +0200
+@@ -4229,6 +4229,9 @@
+ 	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 	{ "Crucial_CT*M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 
++	/* devices that don't properly handle TRIM commands */
++	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
++
+ 	/*
+ 	 * Some WD SATA-I drives spin up and down erratically when the link
+ 	 * is put into the slumber mode.  We don't have full list of the
+diff -Naur linux-3.14.43.org/drivers/ata/libata-scsi.c linux-3.14.43/drivers/ata/libata-scsi.c
+--- linux-3.14.43.org/drivers/ata/libata-scsi.c	2015-05-17 18:54:01.000000000 +0200
++++ linux-3.14.43/drivers/ata/libata-scsi.c	2015-07-11 20:47:22.570021716 +0200
+@@ -2510,11 +2513,15 @@
+ 		rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+ 		rbuf[15] = lowest_aligned;
+ 
+-		if (ata_id_has_trim(args->id)) {
+-			rbuf[14] |= 0x80; /* TPE */
+ 
+-			if (ata_id_has_zero_after_trim(args->id))
+-				rbuf[14] |= 0x40; /* TPRZ */
++
++		if (!(dev->horkage & ATA_HORKAGE_NOTRIM)) { 
++			if (ata_id_has_trim(args->id)) {
++				rbuf[14] |= 0x80; /* TPE */
++
++				if (ata_id_has_zero_after_trim(args->id))
++					rbuf[14] |= 0x40; /* TPRZ */
++			}
+ 		}
+ 	}
+ 
+diff -Naur linux-3.14.43.org/include/linux/libata.h linux-3.14.43/include/linux/libata.h
+--- linux-3.14.43.org/include/linux/libata.h	2015-05-17 18:54:01.000000000 +0200
++++ linux-3.14.43/include/linux/libata.h	2015-07-11 19:13:03.190682173 +0200
+@@ -421,6 +421,7 @@
+ 	ATA_HORKAGE_NO_NCQ_TRIM	= (1 << 19),	/* don't use queued TRIM */
+ 	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
+ 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
++	ATA_HORKAGE_NOTRIM	= (1 << 22),	/* don't use TRIM */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
diff --git a/src/patches/linux-3.14.43_new_qtrim_blacklist.patch b/src/patches/linux-3.14.43_new_qtrim_blacklist.patch
new file mode 100644
index 0000000000..f497070a06
--- /dev/null
+++ b/src/patches/linux-3.14.43_new_qtrim_blacklist.patch
@@ -0,0 +1,18 @@
+diff -Naur linux-3.14.43.org/drivers/ata/libata-core.c linux-3.14.43/drivers/ata/libata-core.c
+--- linux-3.14.43.org/drivers/ata/libata-core.c	2015-07-13 17:58:28.126607225 +0200
++++ linux-3.14.43/drivers/ata/libata-core.c	2015-07-13 18:06:07.430782102 +0200
+@@ -4225,9 +4225,11 @@
+ 
+ 	/* devices that don't properly handle queued TRIM commands */
+ 	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+-	{ "Crucial_CT???M500SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+-	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+-	{ "Crucial_CT*M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Crucial_CT*M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Micron_M5[15]0*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Crucial_CT*M550*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Crucial_CT*MX100*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
++	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 
+ 	/* devices that don't properly handle TRIM commands */
+ 	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
diff --git a/src/patches/linux-3.14.x-hyperv-2008-fix.patch b/src/patches/linux-3.14.x-hyperv-2008-fix.patch
new file mode 100644
index 0000000000..e538e08e5c
--- /dev/null
+++ b/src/patches/linux-3.14.x-hyperv-2008-fix.patch
@@ -0,0 +1,50 @@
+From 99d3016de4f2a29635f5382b0e9bd0e5f2151487 Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Sun, 9 Mar 2014 16:10:59 -0700
+Subject: hyperv: Change the receive buffer size for legacy hosts
+
+Due to a bug in the Hyper-V host verion 2008R2, we need to use a slightly smaller
+receive buffer size, otherwise the buffer will not be accepted by the legacy hosts.
+
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index 7d06b49..13010b4 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -513,6 +513,7 @@ struct nvsp_message {
+ #define NETVSC_MTU 65536
+ 
+ #define NETVSC_RECEIVE_BUFFER_SIZE		(1024*1024*16)	/* 16MB */
++#define NETVSC_RECEIVE_BUFFER_SIZE_LEGACY	(1024*1024*15)  /* 15MB */
+ 
+ #define NETVSC_RECEIVE_BUFFER_ID		0xcafe
+ 
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 1a0280d..daddea2 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -365,6 +365,11 @@ static int netvsc_connect_vsp(struct hv_device *device)
+ 		goto cleanup;
+ 
+ 	/* Post the big receive buffer to NetVSP */
++	if (net_device->nvsp_version <= NVSP_PROTOCOL_VERSION_2)
++		net_device->recv_buf_size = NETVSC_RECEIVE_BUFFER_SIZE_LEGACY;
++	else
++		net_device->recv_buf_size = NETVSC_RECEIVE_BUFFER_SIZE;
++
+ 	ret = netvsc_init_recv_buf(device);
+ 
+ cleanup:
+@@ -898,7 +903,6 @@ int netvsc_device_add(struct hv_device *device, void *additional_info)
+ 	ndev = net_device->ndev;
+ 
+ 	/* Initialize the NetVSC channel extension */
+-	net_device->recv_buf_size = NETVSC_RECEIVE_BUFFER_SIZE;
+ 	spin_lock_init(&net_device->recv_pkt_list_lock);
+ 
+ 	INIT_LIST_HEAD(&net_device->recv_pkt_list);
+-- 
+cgit v0.10.2
+
diff --git a/src/patches/linux-3.14.x-lamobo-r1-fix-sata-pwr.patch b/src/patches/linux-3.14.x-lamobo-r1-fix-sata-pwr.patch
deleted file mode 100644
index 1c0f994b20..0000000000
--- a/src/patches/linux-3.14.x-lamobo-r1-fix-sata-pwr.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 7f558e6e8abee42cc966e2cb64be0de875797e07 Mon Sep 17 00:00:00 2001
-From: Arne Fitzenreiter <arne_f@ipfire.org>
-Date: Fri, 20 Feb 2015 10:01:26 +0100
-Subject: [PATCH] sun7i: dts: lamobo-r1: fix sata pwr regulator pin.
-
-Lamobo-R1 use PB3 instead of PB8 for controlling the SATA power regulator.
----
- arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
-index 1eb6c9b..d634d2f 100644
---- a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
-+++ b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
-@@ -166,6 +166,16 @@
- 				reg = <1>;
- 			};
- 		};
-+
-+		pio: pinctrl@01c20800 {
-+			ahci_pwr_pin_a: ahci_pwr_pin@0 {
-+				allwinner,pins = "PB3";
-+				allwinner,function = "gpio_out";
-+				allwinner,drive = <0>;
-+				allwinner,pull = <0>;
-+			};
-+		};
-+
- 	};
- 
- 	leds {
-@@ -181,6 +191,14 @@
- 	};
- 
-         reg_ahci_5v: ahci-5v {
-+		compatible = "regulator-fixed";
-+		pinctrl-names = "default";
-+		pinctrl-0 = <&ahci_pwr_pin_a>;
-+		regulator-name = "ahci-5v";
-+		regulator-min-microvolt = <5000000>;
-+		regulator-max-microvolt = <5000000>;
-+		enable-active-high;
-+		gpio = <&pio 1 3 0>;
-                 status = "okay";
-         };
- 
--- 
-1.8.5.2
-
diff --git a/src/patches/openssl-0.9.8u-cryptodev.patch b/src/patches/openssl-0.9.8u-cryptodev.patch
deleted file mode 100644
index 920648df65..0000000000
--- a/src/patches/openssl-0.9.8u-cryptodev.patch
+++ /dev/null
@@ -1,882 +0,0 @@
-diff -Naur openssl-0.9.8u.org/crypto/engine/eng_all.c openssl-0.9.8u/crypto/engine/eng_all.c
---- openssl-0.9.8u.org/crypto/engine/eng_all.c	2010-03-01 01:30:11.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/eng_all.c	2012-03-27 14:07:11.000000000 +0200
-@@ -113,7 +113,6 @@
- #endif
- 	}
- 
--#if defined(__OpenBSD__) || defined(__FreeBSD__)
- void ENGINE_setup_bsd_cryptodev(void) {
- 	static int bsd_cryptodev_default_loaded = 0;
- 	if (!bsd_cryptodev_default_loaded) {
-@@ -122,4 +121,3 @@
- 	}
- 	bsd_cryptodev_default_loaded=1;
- }
--#endif
-diff -Naur openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c openssl-0.9.8u/crypto/engine/eng_cryptodev.c
---- openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c	2012-03-06 14:22:32.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/eng_cryptodev.c	2012-03-27 14:02:59.000000000 +0200
-@@ -2,6 +2,7 @@
-  * Copyright (c) 2002 Bob Beck <beck@openbsd.org>
-  * Copyright (c) 2002 Theo de Raadt
-  * Copyright (c) 2002 Markus Friedl
-+ * Copyright (c) 2012 Nikos Mavrogiannopoulos
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-@@ -30,10 +31,6 @@
- #include <openssl/engine.h>
- #include <openssl/evp.h>
- #include <openssl/bn.h>
--#include <openssl/dsa.h>
--#include <openssl/rsa.h>
--#include <openssl/dh.h>
--#include <openssl/err.h>
- 
- #if (defined(__unix__) || defined(unix)) && !defined(USG) && \
- 	(defined(OpenBSD) || defined(__FreeBSD__))
-@@ -59,6 +56,10 @@
-  
- #include <sys/types.h>
- #include <crypto/cryptodev.h>
-+#include <crypto/dh/dh.h>
-+#include <crypto/dsa/dsa.h>
-+#include <crypto/err/err.h>
-+#include <crypto/rsa/rsa.h>
- #include <sys/ioctl.h>
- #include <errno.h>
- #include <stdio.h>
-@@ -72,6 +73,12 @@
- struct dev_crypto_state {
- 	struct session_op d_sess;
- 	int d_fd;
-+
-+#ifdef USE_CRYPTODEV_DIGESTS
-+	unsigned char digest_res[HASH_MAX_LEN];
-+	char *mac_data;
-+	int mac_len;
-+#endif
- };
- 
- static u_int32_t cryptodev_asymfeat = 0;
-@@ -79,15 +86,14 @@
- static int get_asym_dev_crypto(void);
- static int open_dev_crypto(void);
- static int get_dev_crypto(void);
--static int cryptodev_max_iv(int cipher);
--static int cryptodev_key_length_valid(int cipher, int len);
--static int cipher_nid_to_cryptodev(int nid);
- static int get_cryptodev_ciphers(const int **cnids);
--/*static int get_cryptodev_digests(const int **cnids);*/
-+#ifdef USE_CRYPTODEV_DIGESTS
-+static int get_cryptodev_digests(const int **cnids);
-+#endif
- static int cryptodev_usable_ciphers(const int **nids);
- static int cryptodev_usable_digests(const int **nids);
- static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
--    const unsigned char *in, unsigned int inl);
-+    const unsigned char *in, size_t inl);
- static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-     const unsigned char *iv, int enc);
- static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx);
-@@ -121,7 +127,7 @@
- static int cryptodev_dh_compute_key(unsigned char *key,
-     const BIGNUM *pub_key, DH *dh);
- static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p,
--    void (*f)());
-+    void (*f)(void));
- void ENGINE_load_cryptodev(void);
- 
- static const ENGINE_CMD_DEFN cryptodev_defns[] = {
-@@ -134,27 +140,38 @@
- 	int	ivmax;
- 	int	keylen;
- } ciphers[] = {
-+	{ CRYPTO_ARC4,			NID_rc4,		0,	16, },
- 	{ CRYPTO_DES_CBC,		NID_des_cbc,		8,	 8, },
- 	{ CRYPTO_3DES_CBC,		NID_des_ede3_cbc,	8,	24, },
- 	{ CRYPTO_AES_CBC,		NID_aes_128_cbc,	16,	16, },
-+	{ CRYPTO_AES_CBC,		NID_aes_192_cbc,	16,	24, },
-+	{ CRYPTO_AES_CBC,		NID_aes_256_cbc,	16,	32, },
- 	{ CRYPTO_BLF_CBC,		NID_bf_cbc,		8,	16, },
- 	{ CRYPTO_CAST_CBC,		NID_cast5_cbc,		8,	16, },
- 	{ CRYPTO_SKIPJACK_CBC,		NID_undef,		0,	 0, },
- 	{ 0,				NID_undef,		0,	 0, },
- };
- 
--#if 0
-+#ifdef USE_CRYPTODEV_DIGESTS
- static struct {
- 	int	id;
- 	int	nid;
-+	int 	digestlen;
- } digests[] = {
--	{ CRYPTO_SHA1_HMAC,		NID_hmacWithSHA1,	},
--	{ CRYPTO_RIPEMD160_HMAC,	NID_ripemd160,		},
--	{ CRYPTO_MD5_KPDK,		NID_undef,		},
--	{ CRYPTO_SHA1_KPDK,		NID_undef,		},
--	{ CRYPTO_MD5,			NID_md5,		},
--	{ CRYPTO_SHA1,			NID_undef,		},
--	{ 0,				NID_undef,		},
-+#if 0
-+        /* HMAC is not supported */
-+	{ CRYPTO_MD5_HMAC,		NID_hmacWithMD5,	16},
-+	{ CRYPTO_SHA1_HMAC,		NID_hmacWithSHA1,	20},
-+	{ CRYPTO_SHA2_256_HMAC,		NID_hmacWithSHA256,	32},
-+	{ CRYPTO_SHA2_384_HMAC,		NID_hmacWithSHA384,	48},
-+	{ CRYPTO_SHA2_512_HMAC,		NID_hmacWithSHA512,	64},
-+#endif
-+	{ CRYPTO_MD5,			NID_md5,		16},
-+	{ CRYPTO_SHA1,			NID_sha1,		20},
-+	{ CRYPTO_SHA2_256,		NID_sha256,		32},
-+	{ CRYPTO_SHA2_384,		NID_sha384,		48},
-+	{ CRYPTO_SHA2_512,		NID_sha512,		64},
-+	{ 0,				NID_undef,		0},
- };
- #endif
- 
-@@ -186,6 +203,7 @@
- 
- 	if ((fd = open_dev_crypto()) == -1)
- 		return (-1);
-+#ifndef CRIOGET_NOT_NEEDED
- 	if (ioctl(fd, CRIOGET, &retfd) == -1)
- 		return (-1);
- 
-@@ -194,9 +212,19 @@
- 		close(retfd);
- 		return (-1);
- 	}
-+#else
-+        retfd = fd;
-+#endif
- 	return (retfd);
- }
- 
-+static void put_dev_crypto(int fd)
-+{
-+#ifndef CRIOGET_NOT_NEEDED
-+	close(fd);
-+#endif
-+}
-+
- /* Caching version for asym operations */
- static int
- get_asym_dev_crypto(void)
-@@ -209,50 +237,6 @@
- }
- 
- /*
-- * XXXX this needs to be set for each alg - and determined from
-- * a running card.
-- */
--static int
--cryptodev_max_iv(int cipher)
--{
--	int i;
--
--	for (i = 0; ciphers[i].id; i++)
--		if (ciphers[i].id == cipher)
--			return (ciphers[i].ivmax);
--	return (0);
--}
--
--/*
-- * XXXX this needs to be set for each alg - and determined from
-- * a running card. For now, fake it out - but most of these
-- * for real devices should return 1 for the supported key
-- * sizes the device can handle.
-- */
--static int
--cryptodev_key_length_valid(int cipher, int len)
--{
--	int i;
--
--	for (i = 0; ciphers[i].id; i++)
--		if (ciphers[i].id == cipher)
--			return (ciphers[i].keylen == len);
--	return (0);
--}
--
--/* convert libcrypto nids to cryptodev */
--static int
--cipher_nid_to_cryptodev(int nid)
--{
--	int i;
--
--	for (i = 0; ciphers[i].id; i++)
--		if (ciphers[i].nid == nid)
--			return (ciphers[i].id);
--	return (0);
--}
--
--/*
-  * Find out what ciphers /dev/crypto will let us have a session for.
-  * XXX note, that some of these openssl doesn't deal with yet!
-  * returning them here is harmless, as long as we return NULL
-@@ -264,13 +248,14 @@
- 	static int nids[CRYPTO_ALGORITHM_MAX];
- 	struct session_op sess;
- 	int fd, i, count = 0;
-+	unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- 
- 	if ((fd = get_dev_crypto()) < 0) {
- 		*cnids = NULL;
- 		return (0);
- 	}
- 	memset(&sess, 0, sizeof(sess));
--	sess.key = (caddr_t)"123456781234567812345678";
-+	sess.key = (void*)fake_key;
- 
- 	for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- 		if (ciphers[i].nid == NID_undef)
-@@ -282,7 +267,7 @@
- 		    ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
- 			nids[count++] = ciphers[i].nid;
- 	}
--	close(fd);
-+	put_dev_crypto(fd);
- 
- 	if (count > 0)
- 		*cnids = nids;
-@@ -291,7 +276,7 @@
- 	return (count);
- }
- 
--#if 0  /* unused */
-+#ifdef USE_CRYPTODEV_DIGESTS
- /*
-  * Find out what digests /dev/crypto will let us have a session for.
-  * XXX note, that some of these openssl doesn't deal with yet!
-@@ -302,6 +287,7 @@
- get_cryptodev_digests(const int **cnids)
- {
- 	static int nids[CRYPTO_ALGORITHM_MAX];
-+	unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- 	struct session_op sess;
- 	int fd, i, count = 0;
- 
-@@ -310,16 +296,18 @@
- 		return (0);
- 	}
- 	memset(&sess, 0, sizeof(sess));
-+	sess.mackey = fake_key;
- 	for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- 		if (digests[i].nid == NID_undef)
- 			continue;
- 		sess.mac = digests[i].id;
-+		sess.mackeylen = 8;
- 		sess.cipher = 0;
- 		if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
- 		    ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
- 			nids[count++] = digests[i].nid;
- 	}
--	close(fd);
-+	put_dev_crypto(fd);
- 
- 	if (count > 0)
- 		*cnids = nids;
-@@ -327,8 +315,7 @@
- 		*cnids = NULL;
- 	return (count);
- }
--
--#endif
-+#endif  /* 0 */
- 
- /*
-  * Find the useable ciphers|digests from dev/crypto - this is the first
-@@ -360,6 +347,9 @@
- static int
- cryptodev_usable_digests(const int **nids)
- {
-+#ifdef USE_CRYPTODEV_DIGESTS
-+	return (get_cryptodev_digests(nids));
-+#else
- 	/*
- 	 * XXXX just disable all digests for now, because it sucks.
- 	 * we need a better way to decide this - i.e. I may not
-@@ -374,11 +364,12 @@
- 	 */
- 	*nids = NULL;
- 	return (0);
-+#endif
- }
- 
- static int
- cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
--    const unsigned char *in, unsigned int inl)
-+    const unsigned char *in, size_t inl)
- {
- 	struct crypt_op cryp;
- 	struct dev_crypto_state *state = ctx->cipher_data;
-@@ -398,14 +389,14 @@
- 	cryp.ses = sess->ses;
- 	cryp.flags = 0;
- 	cryp.len = inl;
--	cryp.src = (caddr_t) in;
--	cryp.dst = (caddr_t) out;
-+	cryp.src = (void*) in;
-+	cryp.dst = (void*) out;
- 	cryp.mac = 0;
- 
- 	cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
- 
- 	if (ctx->cipher->iv_len) {
--		cryp.iv = (caddr_t) ctx->iv;
-+		cryp.iv = (void*) ctx->iv;
- 		if (!ctx->encrypt) {
- 			iiv = in + inl - ctx->cipher->iv_len;
- 			memcpy(save_iv, iiv, ctx->cipher->iv_len);
-@@ -436,28 +427,32 @@
- {
- 	struct dev_crypto_state *state = ctx->cipher_data;
- 	struct session_op *sess = &state->d_sess;
--	int cipher;
-+	int cipher = -1, i;
- 
--	if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
--		return (0);
--
--	if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
--		return (0);
-+	for (i = 0; ciphers[i].id; i++)
-+		if (ctx->cipher->nid == ciphers[i].nid &&
-+		    ctx->cipher->iv_len <= ciphers[i].ivmax &&
-+		    ctx->key_len == ciphers[i].keylen) {
-+			cipher = ciphers[i].id;
-+			break;
-+		}
- 
--	if (!cryptodev_key_length_valid(cipher, ctx->key_len))
-+	if (!ciphers[i].id) {
-+		state->d_fd = -1;
- 		return (0);
-+	}
- 
- 	memset(sess, 0, sizeof(struct session_op));
- 
- 	if ((state->d_fd = get_dev_crypto()) < 0)
- 		return (0);
- 
--	sess->key = (char *)key;
-+	sess->key = (void*)key;
- 	sess->keylen = ctx->key_len;
- 	sess->cipher = cipher;
- 
- 	if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
--		close(state->d_fd);
-+		put_dev_crypto(state->d_fd);
- 		state->d_fd = -1;
- 		return (0);
- 	}
-@@ -494,7 +489,7 @@
- 	} else {
- 		ret = 1;
- 	}
--	close(state->d_fd);
-+	put_dev_crypto(state->d_fd);
- 	state->d_fd = -1;
- 
- 	return (ret);
-@@ -505,6 +500,20 @@
-  * gets called when libcrypto requests a cipher NID.
-  */
- 
-+/* RC4 */
-+const EVP_CIPHER cryptodev_rc4 = {
-+	NID_rc4,
-+	1, 16, 0,
-+	EVP_CIPH_VARIABLE_LENGTH,
-+	cryptodev_init_key,
-+	cryptodev_cipher,
-+	cryptodev_cleanup,
-+	sizeof(struct dev_crypto_state),
-+	NULL,
-+	NULL,
-+	NULL
-+};
-+
- /* DES CBC EVP */
- const EVP_CIPHER cryptodev_des_cbc = {
- 	NID_des_cbc,
-@@ -572,6 +581,32 @@
- 	NULL
- };
- 
-+const EVP_CIPHER cryptodev_aes_192_cbc = {
-+	NID_aes_192_cbc,
-+	16, 24, 16,
-+	EVP_CIPH_CBC_MODE,
-+	cryptodev_init_key,
-+	cryptodev_cipher,
-+	cryptodev_cleanup,
-+	sizeof(struct dev_crypto_state),
-+	EVP_CIPHER_set_asn1_iv,
-+	EVP_CIPHER_get_asn1_iv,
-+	NULL
-+};
-+
-+const EVP_CIPHER cryptodev_aes_256_cbc = {
-+	NID_aes_256_cbc,
-+	16, 32, 16,
-+	EVP_CIPH_CBC_MODE,
-+	cryptodev_init_key,
-+	cryptodev_cipher,
-+	cryptodev_cleanup,
-+	sizeof(struct dev_crypto_state),
-+	EVP_CIPHER_set_asn1_iv,
-+	EVP_CIPHER_get_asn1_iv,
-+	NULL
-+};
-+
- /*
-  * Registered by the ENGINE when used to find out how to deal with
-  * a particular NID in the ENGINE. this says what we'll do at the
-@@ -585,6 +620,9 @@
- 		return (cryptodev_usable_ciphers(nids));
- 
- 	switch (nid) {
-+	case NID_rc4:
-+		*cipher = &cryptodev_rc4;
-+		break;
- 	case NID_des_ede3_cbc:
- 		*cipher = &cryptodev_3des_cbc;
- 		break;
-@@ -600,6 +638,12 @@
- 	case NID_aes_128_cbc:
- 		*cipher = &cryptodev_aes_cbc;
- 		break;
-+	case NID_aes_192_cbc:
-+		*cipher = &cryptodev_aes_192_cbc;
-+		break;
-+	case NID_aes_256_cbc:
-+		*cipher = &cryptodev_aes_256_cbc;
-+		break;
- 	default:
- 		*cipher = NULL;
- 		break;
-@@ -607,6 +651,286 @@
- 	return (*cipher != NULL);
- }
- 
-+
-+#ifdef USE_CRYPTODEV_DIGESTS
-+
-+/* convert digest type to cryptodev */
-+static int
-+digest_nid_to_cryptodev(int nid)
-+{
-+	int i;
-+
-+	for (i = 0; digests[i].id; i++)
-+		if (digests[i].nid == nid)
-+			return (digests[i].id);
-+	return (0);
-+}
-+
-+
-+static int cryptodev_digest_init(EVP_MD_CTX *ctx)
-+{
-+	struct dev_crypto_state *state = ctx->md_data;
-+	struct session_op *sess = &state->d_sess;
-+	int digest;
-+
-+	if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
-+		printf("cryptodev_digest_init: Can't get digest \n");
-+		return (0);
-+	}
-+	memset(state, 0, sizeof(struct dev_crypto_state));
-+
-+	if ((state->d_fd = get_dev_crypto()) < 0) {
-+		printf("cryptodev_digest_init: Can't get Dev \n");
-+		return (0);
-+	}
-+
-+	sess->mackey = NULL;
-+	sess->mackeylen = 0;
-+	sess->mac = digest;
-+
-+	if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-+		put_dev_crypto(state->d_fd);
-+		state->d_fd = -1;
-+		printf("cryptodev_digest_init: Open session failed\n");
-+		return (0);
-+	}
-+
-+	return (1);
-+}
-+
-+static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
-+		size_t count)
-+{
-+	struct dev_crypto_state *state = ctx->md_data;
-+	struct crypt_op cryp;
-+	struct session_op *sess = &state->d_sess;
-+
-+	if (!data || state->d_fd < 0) {
-+		printf("cryptodev_digest_update: illegal inputs \n");
-+		return (0);
-+	}
-+
-+	if (!count) {
-+		return (1);
-+	}
-+
-+	if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
-+		/* if application doesn't support one buffer */
-+		state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
-+
-+		if (!state->mac_data) {
-+			printf("cryptodev_digest_update: realloc failed\n");
-+			return (0);
-+		}
-+
-+		memcpy(state->mac_data + state->mac_len, data, count);
-+   		state->mac_len += count;
-+	
-+		return (1);
-+	}
-+
-+	memset(&cryp, 0, sizeof(cryp));
-+
-+	cryp.ses = sess->ses;
-+	cryp.flags = 0;
-+	cryp.len = count;
-+	cryp.src = (void*) data;
-+	cryp.dst = NULL;
-+	cryp.mac = (void*) state->digest_res;
-+	if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
-+		printf("cryptodev_digest_update: digest failed\n");
-+		return (0);
-+	}
-+	return (1);
-+}
-+
-+
-+static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
-+{
-+	struct crypt_op cryp;
-+	struct dev_crypto_state *state = ctx->md_data;
-+	struct session_op *sess = &state->d_sess;
-+
-+	if (!md || state->d_fd < 0) {
-+		printf("cryptodev_digest_final: illegal input\n");
-+		return(0);
-+	}
-+
-+	if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
-+		/* if application doesn't support one buffer */
-+		memset(&cryp, 0, sizeof(cryp));
-+		cryp.ses = sess->ses;
-+		cryp.flags = 0;
-+		cryp.len = state->mac_len;
-+		cryp.src = state->mac_data;
-+		cryp.dst = NULL;
-+		cryp.mac = (void*)md;
-+		if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
-+			printf("cryptodev_digest_final: digest failed\n");
-+			return (0);
-+		}
-+
-+		return 1;
-+	}
-+
-+	memcpy(md, state->digest_res, ctx->digest->md_size);
-+
-+	return 1;
-+}
-+
-+
-+static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
-+{
-+	int ret = 1;
-+	struct dev_crypto_state *state = ctx->md_data;
-+	struct session_op *sess = &state->d_sess;
-+
-+	if (state == NULL)
-+	  return 0;
-+
-+	if (state->d_fd < 0) {
-+		printf("cryptodev_digest_cleanup: illegal input\n");
-+		return (0);
-+	}
-+
-+	if (state->mac_data) {
-+		OPENSSL_free(state->mac_data);
-+		state->mac_data = NULL;
-+		state->mac_len = 0;
-+	}
-+
-+	if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
-+		printf("cryptodev_digest_cleanup: failed to close session\n");
-+		ret = 0;
-+	} else {
-+		ret = 1;
-+	}
-+	put_dev_crypto(state->d_fd);	
-+	state->d_fd = -1;
-+
-+	return (ret);
-+}
-+
-+static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
-+{
-+	struct dev_crypto_state *fstate = from->md_data;
-+	struct dev_crypto_state *dstate = to->md_data;
-+	struct session_op *sess;
-+	int digest;
-+
-+	if (dstate == NULL || fstate == NULL)
-+	  return 1;
-+
-+       	memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
-+
-+	sess = &dstate->d_sess;
-+
-+	digest = digest_nid_to_cryptodev(to->digest->type);
-+
-+	sess->mackey = NULL;
-+	sess->mackeylen = 0;
-+	sess->mac = digest;
-+
-+	dstate->d_fd = get_dev_crypto();
-+
-+	if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) {
-+		put_dev_crypto(dstate->d_fd);
-+		dstate->d_fd = -1;
-+		printf("cryptodev_digest_init: Open session failed\n");
-+		return (0);
-+	}
-+
-+	if (fstate->mac_len != 0) {
-+	        if (fstate->mac_data != NULL)
-+	                {
-+        		dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-+	        	memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
-+           		dstate->mac_len = fstate->mac_len;
-+	        	}
-+	}
-+
-+	return 1;
-+}
-+
-+
-+static const EVP_MD cryptodev_sha1 = {
-+	NID_sha1,
-+	NID_sha1WithRSAEncryption,
-+	SHA_DIGEST_LENGTH, 
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha256 = {
-+	NID_sha256,
-+	NID_sha256WithRSAEncryption,
-+	SHA256_DIGEST_LENGTH, 
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA256_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha384 = {
-+	NID_sha384,
-+	NID_sha384WithRSAEncryption, 
-+	SHA384_DIGEST_LENGTH, 
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA512_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha512 = {
-+	NID_sha512,
-+	NID_sha512WithRSAEncryption, 
-+	SHA512_DIGEST_LENGTH, 
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA512_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_md5 = {
-+	NID_md5,
-+	NID_md5WithRSAEncryption, 
-+	16 /* MD5_DIGEST_LENGTH */, 
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	64 /* MD5_CBLOCK */,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+#endif /* USE_CRYPTODEV_DIGESTS */
-+
-+
- static int
- cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
-     const int **nids, int nid)
-@@ -615,10 +939,24 @@
- 		return (cryptodev_usable_digests(nids));
- 
- 	switch (nid) {
-+#ifdef USE_CRYPTODEV_DIGESTS
- 	case NID_md5:
--		*digest = NULL; /* need to make a clean md5 critter */
-+		*digest = &cryptodev_md5; 
- 		break;
-+	case NID_sha1:
-+		*digest = &cryptodev_sha1;
-+ 		break;
-+	case NID_sha256:
-+		*digest = &cryptodev_sha256;
-+ 		break;
-+	case NID_sha384:
-+		*digest = &cryptodev_sha384;
-+ 		break;
-+	case NID_sha512:
-+		*digest = &cryptodev_sha512;
-+ 		break;
- 	default:
-+#endif /* USE_CRYPTODEV_DIGESTS */
- 		*digest = NULL;
- 		break;
- 	}
-@@ -646,8 +984,9 @@
- 	b = malloc(bytes);
- 	if (b == NULL)
- 		return (1);
-+	memset(b, 0, bytes);
- 
--	crp->crp_p = (char *)b;
-+	crp->crp_p = (void*) b;
- 	crp->crp_nbits = bits;
- 
- 	for (i = 0, j = 0; i < a->top; i++) {
-@@ -690,7 +1029,7 @@
- {
- 	int i;
- 
--	for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
-+	for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
- 		if (kop->crk_param[i].crp_p)
- 			free(kop->crk_param[i].crp_p);
- 		kop->crk_param[i].crp_p = NULL;
-@@ -776,8 +1115,9 @@
- cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
- {
- 	int r;
--
-+	ctx = BN_CTX_new();
- 	r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
-+	BN_CTX_free(ctx);
- 	return (r);
- }
- 
-@@ -899,7 +1239,7 @@
- 	kop.crk_op = CRK_DSA_SIGN;
- 
- 	/* inputs: dgst dsa->p dsa->q dsa->g dsa->priv_key */
--	kop.crk_param[0].crp_p = (caddr_t)dgst;
-+	kop.crk_param[0].crp_p = (void*)dgst;
- 	kop.crk_param[0].crp_nbits = dlen * 8;
- 	if (bn2crparam(dsa->p, &kop.crk_param[1]))
- 		goto err;
-@@ -939,7 +1279,7 @@
- 	kop.crk_op = CRK_DSA_VERIFY;
- 
- 	/* inputs: dgst dsa->p dsa->q dsa->g dsa->pub_key sig->r sig->s */
--	kop.crk_param[0].crp_p = (caddr_t)dgst;
-+	kop.crk_param[0].crp_p = (void*)dgst;
- 	kop.crk_param[0].crp_nbits = dlen * 8;
- 	if (bn2crparam(dsa->p, &kop.crk_param[1]))
- 		goto err;
-@@ -1017,7 +1357,7 @@
- 		goto err;
- 	kop.crk_iparams = 3;
- 
--	kop.crk_param[3].crp_p = (char *)key;
-+	kop.crk_param[3].crp_p = (void*) key;
- 	kop.crk_param[3].crp_nbits = keylen * 8;
- 	kop.crk_oparams = 1;
- 
-@@ -1048,7 +1388,7 @@
-  * but I expect we'll want some options soon.
-  */
- static int
--cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-+cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
- {
- #ifdef HAVE_SYSLOG_R
- 	struct syslog_data sd = SYSLOG_DATA_INIT;
-@@ -1084,14 +1424,14 @@
- 	 * find out what asymmetric crypto algorithms we support
- 	 */
- 	if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
--		close(fd);
-+		put_dev_crypto(fd);
- 		ENGINE_free(engine);
- 		return;
- 	}
--	close(fd);
-+	put_dev_crypto(fd);
- 
- 	if (!ENGINE_set_id(engine, "cryptodev") ||
--	    !ENGINE_set_name(engine, "BSD cryptodev engine") ||
-+	    !ENGINE_set_name(engine, "cryptodev engine") ||
- 	    !ENGINE_set_ciphers(engine, cryptodev_engine_ciphers) ||
- 	    !ENGINE_set_digests(engine, cryptodev_engine_digests) ||
- 	    !ENGINE_set_ctrl_function(engine, cryptodev_ctrl) ||
-diff -Naur openssl-0.9.8u.org/crypto/engine/engine.h openssl-0.9.8u/crypto/engine/engine.h
---- openssl-0.9.8u.org/crypto/engine/engine.h	2010-02-09 15:18:15.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/engine.h	2012-03-27 14:05:15.000000000 +0200
-@@ -705,9 +705,7 @@
-  * values. */
- void *ENGINE_get_static_state(void);
- 
--#if defined(__OpenBSD__) || defined(__FreeBSD__)
- void ENGINE_setup_bsd_cryptodev(void);
--#endif
- 
- /* BEGIN ERROR CODES */
- /* The following lines are auto generated by the script mkerr.pl. Any changes
-diff -Naur openssl-0.9.8u.org/crypto/evp/c_all.c openssl-0.9.8u/crypto/evp/c_all.c
---- openssl-0.9.8u.org/crypto/evp/c_all.c	2004-08-29 18:36:04.000000000 +0200
-+++ openssl-0.9.8u/crypto/evp/c_all.c	2012-03-27 14:05:15.000000000 +0200
-@@ -83,8 +83,6 @@
- 	OpenSSL_add_all_ciphers();
- 	OpenSSL_add_all_digests();
- #ifndef OPENSSL_NO_ENGINE
--# if defined(__OpenBSD__) || defined(__FreeBSD__)
- 	ENGINE_setup_bsd_cryptodev();
--# endif
- #endif
- 	}
diff --git a/src/patches/openssl-1.0.1-beta2-build.patch b/src/patches/openssl-1.0.1-beta2-build.patch
deleted file mode 100644
index 0a5cef12c1..0000000000
--- a/src/patches/openssl-1.0.1-beta2-build.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-diff -up openssl-1.0.1-beta2/Configure.rpmbuild openssl-1.0.1-beta2/Configure
---- openssl-1.0.1-beta2/Configure.rpmbuild	2012-01-05 01:07:34.000000000 +0100
-+++ openssl-1.0.1-beta2/Configure	2012-02-02 12:43:56.547409325 +0100
-@@ -343,23 +343,23 @@ my %table=(
- ####
- # *-generic* is endian-neutral target, but ./config is free to
- # throw in -D[BL]_ENDIAN, whichever appropriate...
--"linux-generic32","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-ppc",	"gcc:-DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-generic32","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-ppc",	"gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # It's believed that majority of ARM toolchains predefine appropriate -march.
- # If you compiler does not, do complement config command line with one!
--"linux-armv4",	"gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-armv4",	"gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- #### IA-32 targets...
- "linux-ia32-icc",	"icc:-DL_ENDIAN -DTERMIO -O2 -no_cpprt::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-elf",	"gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-elf",	"gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-aout",	"gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
- ####
--"linux-generic64","gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-ppc64",	"gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
--"linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-generic64","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-ppc64",	"gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
-+"linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-ia64-ecc","ecc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "linux-ia64-icc","icc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
--"linux64-s390x",	"gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
-+"linux64-s390x",	"gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
- #### So called "highgprs" target for z/Architecture CPUs
- # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see
- # /proc/cpuinfo. The idea is to preserve most significant bits of
-@@ -373,16 +373,16 @@ my %table=(
- # ldconfig and run-time linker to autodiscover. Unfortunately it
- # doesn't work just yet, because of couple of bugs in glibc
- # sysdeps/s390/dl-procinfo.c affecting ldconfig and ld.so.1...
--"linux32-s390x",	"gcc:-m31 -Wa,-mzarch -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$s390x_asm;$asm=~s/bn\-s390x\.o/bn_asm.o/;$asm}.":31:dlfcn:linux-shared:-fPIC:-m31:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/highgprs",
-+"linux32-s390x",	"gcc:-m31 -Wa,-mzarch -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$s390x_asm;$asm=~s/bn\-s390x\.o/bn_asm.o/;$asm}.":31:dlfcn:linux-shared:-fPIC:-m31 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::/highgprs",
- #### SPARC Linux setups
- # Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
- # assisted with debugging of following two configs.
--"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv8","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # it's a real mess with -mcpu=ultrasparc option under Linux, but
- # -Wa,-Av8plus should do the trick no matter what.
--"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # GCC 3.1 is a requirement
--"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux64-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
- #### Alpha Linux with GNU C and Compaq C setups
- # Special notes:
- # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
-@@ -396,8 +396,8 @@ my %table=(
- #
- #					<appro@fy.chalmers.se>
- #
--"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-alpha-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-alpha+bwx-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
- "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
- 
-@@ -1678,7 +1678,7 @@ while (<IN>)
- 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
- 		{
- 		my $sotmp = $1;
--		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
-+		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/;
- 		}
- 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
- 		{
-diff -up openssl-1.0.1-beta2/Makefile.org.rpmbuild openssl-1.0.1-beta2/Makefile.org
---- openssl-1.0.1-beta2/Makefile.org.rpmbuild	2011-12-27 16:17:50.000000000 +0100
-+++ openssl-1.0.1-beta2/Makefile.org	2012-02-02 12:30:23.652495435 +0100
-@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY=
- SHLIB_MAJOR=
- SHLIB_MINOR=
- SHLIB_EXT=
-+SHLIB_SONAMEVER=10
- PLATFORM=dist
- OPTIONS=
- CONFIGURE_ARGS=
-@@ -333,10 +334,9 @@ clean-shared:
- link-shared:
- 	@ set -e; for i in $(SHLIBDIRS); do \
- 		$(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
--			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
-+			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
- 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
- 			symlink.$(SHLIB_TARGET); \
--		libs="$$libs -l$$i"; \
- 	done
- 
- build-shared: do_$(SHLIB_TARGET) link-shared
-@@ -347,7 +347,7 @@ do_$(SHLIB_TARGET):
- 			libs="$(LIBKRB5) $$libs"; \
- 		fi; \
- 		$(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
--			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
-+			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
- 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
- 			LIBDEPS="$$libs $(EX_LIBS)" \
- 			link_a.$(SHLIB_TARGET); \
diff --git a/src/patches/openssl-1.0.1e-cryptodev.patch b/src/patches/openssl-1.0.1e-cryptodev.patch
deleted file mode 100644
index 29b6f77b5c..0000000000
--- a/src/patches/openssl-1.0.1e-cryptodev.patch
+++ /dev/null
@@ -1,712 +0,0 @@
-Patch created by Michael Tremer <michael.tremer@ipfire.org> from
-  http://download.gna.org/cryptodev-linux/cryptodev-linux-1.6.tar.gz
-
-diff -Nur openssl-1.0.1e-vanilla/crypto/cryptodev.h openssl-1.0.1e/crypto/cryptodev.h
---- openssl-1.0.1e-vanilla/crypto/cryptodev.h	1970-01-01 00:00:00.000000000 +0000
-+++ openssl-1.0.1e/crypto/cryptodev.h	2013-12-25 14:27:20.907326820 +0000
-@@ -0,0 +1,292 @@
-+/* This is a source compatible implementation with the original API of
-+ * cryptodev by Angelos D. Keromytis, found at openbsd cryptodev.h.
-+ * Placed under public domain */
-+
-+#ifndef L_CRYPTODEV_H
-+#define L_CRYPTODEV_H
-+
-+#include <linux/types.h>
-+#ifndef __KERNEL__
-+#define __user
-+#endif
-+
-+/* API extensions for linux */
-+#define CRYPTO_HMAC_MAX_KEY_LEN		512
-+#define CRYPTO_CIPHER_MAX_KEY_LEN	64
-+
-+/* All the supported algorithms
-+ */
-+enum cryptodev_crypto_op_t {
-+	CRYPTO_DES_CBC = 1,
-+	CRYPTO_3DES_CBC = 2,
-+	CRYPTO_BLF_CBC = 3,
-+	CRYPTO_CAST_CBC = 4,
-+	CRYPTO_SKIPJACK_CBC = 5,
-+	CRYPTO_MD5_HMAC = 6,
-+	CRYPTO_SHA1_HMAC = 7,
-+	CRYPTO_RIPEMD160_HMAC = 8,
-+	CRYPTO_MD5_KPDK = 9,
-+	CRYPTO_SHA1_KPDK = 10,
-+	CRYPTO_RIJNDAEL128_CBC = 11,
-+	CRYPTO_AES_CBC = CRYPTO_RIJNDAEL128_CBC,
-+	CRYPTO_ARC4 = 12,
-+	CRYPTO_MD5 = 13,
-+	CRYPTO_SHA1 = 14,
-+	CRYPTO_DEFLATE_COMP = 15,
-+	CRYPTO_NULL = 16,
-+	CRYPTO_LZS_COMP = 17,
-+	CRYPTO_SHA2_256_HMAC = 18,
-+	CRYPTO_SHA2_384_HMAC = 19,
-+	CRYPTO_SHA2_512_HMAC = 20,
-+	CRYPTO_AES_CTR = 21,
-+	CRYPTO_AES_XTS = 22,
-+	CRYPTO_AES_ECB = 23,
-+	CRYPTO_AES_GCM = 50,
-+
-+	CRYPTO_CAMELLIA_CBC = 101,
-+	CRYPTO_RIPEMD160,
-+	CRYPTO_SHA2_224,
-+	CRYPTO_SHA2_256,
-+	CRYPTO_SHA2_384,
-+	CRYPTO_SHA2_512,
-+	CRYPTO_SHA2_224_HMAC,
-+	CRYPTO_ALGORITHM_ALL, /* Keep updated - see below */
-+};
-+
-+#define	CRYPTO_ALGORITHM_MAX	(CRYPTO_ALGORITHM_ALL - 1)
-+
-+/* Values for ciphers */
-+#define DES_BLOCK_LEN		8
-+#define DES3_BLOCK_LEN		8
-+#define RIJNDAEL128_BLOCK_LEN	16
-+#define AES_BLOCK_LEN		RIJNDAEL128_BLOCK_LEN
-+#define CAMELLIA_BLOCK_LEN      16
-+#define BLOWFISH_BLOCK_LEN	8
-+#define SKIPJACK_BLOCK_LEN	8
-+#define CAST128_BLOCK_LEN	8
-+
-+/* the maximum of the above */
-+#define EALG_MAX_BLOCK_LEN	16
-+
-+/* Values for hashes/MAC */
-+#define AALG_MAX_RESULT_LEN		64
-+
-+/* maximum length of verbose alg names (depends on CRYPTO_MAX_ALG_NAME) */
-+#define CRYPTODEV_MAX_ALG_NAME		64
-+
-+#define HASH_MAX_LEN 64
-+
-+/* input of CIOCGSESSION */
-+struct session_op {
-+	/* Specify either cipher or mac
-+	 */
-+	__u32	cipher;		/* cryptodev_crypto_op_t */
-+	__u32	mac;		/* cryptodev_crypto_op_t */
-+
-+	__u32	keylen;
-+	__u8	__user *key;
-+	__u32	mackeylen;
-+	__u8	__user *mackey;
-+
-+	__u32	ses;		/* session identifier */
-+};
-+
-+struct session_info_op {
-+	__u32 ses;		/* session identifier */
-+
-+	/* verbose names for the requested ciphers */
-+	struct alg_info {
-+		char cra_name[CRYPTODEV_MAX_ALG_NAME];
-+		char cra_driver_name[CRYPTODEV_MAX_ALG_NAME];
-+	} cipher_info, hash_info;
-+
-+	__u16	alignmask;	/* alignment constraints */
-+	__u32   flags;          /* SIOP_FLAGS_* */
-+};
-+
-+/* If this flag is set then this algorithm uses
-+ * a driver only available in kernel (software drivers,
-+ * or drivers based on instruction sets do not set this flag).
-+ *
-+ * If multiple algorithms are involved (as in AEAD case), then
-+ * if one of them is kernel-driver-only this flag will be set.
-+ */
-+#define SIOP_FLAG_KERNEL_DRIVER_ONLY 1
-+
-+#define	COP_ENCRYPT	0
-+#define COP_DECRYPT	1
-+
-+/* input of CIOCCRYPT */
-+struct crypt_op {
-+	__u32	ses;		/* session identifier */
-+	__u16	op;		/* COP_ENCRYPT or COP_DECRYPT */
-+	__u16	flags;		/* see COP_FLAG_* */
-+	__u32	len;		/* length of source data */
-+	__u8	__user *src;	/* source data */
-+	__u8	__user *dst;	/* pointer to output data */
-+	/* pointer to output data for hash/MAC operations */
-+	__u8	__user *mac;
-+	/* initialization vector for encryption operations */
-+	__u8	__user *iv;
-+};
-+
-+/* input of CIOCAUTHCRYPT */
-+struct crypt_auth_op {
-+	__u32	ses;		/* session identifier */
-+	__u16	op;		/* COP_ENCRYPT or COP_DECRYPT */
-+	__u16	flags;		/* see COP_FLAG_AEAD_* */
-+	__u32	len;		/* length of source data */
-+	__u32	auth_len;	/* length of auth data */
-+	__u8	__user *auth_src;	/* authenticated-only data */
-+
-+	/* The current implementation is more efficient if data are
-+	 * encrypted in-place (src==dst). */
-+	__u8	__user *src;	/* data to be encrypted and authenticated */
-+	__u8	__user *dst;	/* pointer to output data. Must have
-+	                         * space for tag. For TLS this should be at least 
-+	                         * len + tag_size + block_size for padding */
-+
-+	__u8    __user *tag;    /* where the tag will be copied to. TLS mode
-+                                 * doesn't use that as tag is copied to dst.
-+                                 * SRTP mode copies tag there. */
-+	__u32	tag_len;	/* the length of the tag. Use zero for digest size or max tag. */
-+
-+	/* initialization vector for encryption operations */
-+	__u8	__user *iv;
-+	__u32   iv_len;
-+};
-+
-+/* In plain AEAD mode the following are required:
-+ *  flags   : 0
-+ *  iv      : the initialization vector (12 bytes)
-+ *  auth_len: the length of the data to be authenticated
-+ *  auth_src: the data to be authenticated
-+ *  len     : length of data to be encrypted
-+ *  src     : the data to be encrypted
-+ *  dst     : space to hold encrypted data. It must have
-+ *            at least a size of len + tag_size.
-+ *  tag_size: the size of the desired authentication tag or zero to use
-+ *            the maximum tag output.
-+ *
-+ * Note tag isn't being used because the Linux AEAD interface
-+ * copies the tag just after data.
-+ */
-+
-+/* In TLS mode (used for CBC ciphers that required padding) 
-+ * the following are required:
-+ *  flags   : COP_FLAG_AEAD_TLS_TYPE
-+ *  iv      : the initialization vector
-+ *  auth_len: the length of the data to be authenticated only
-+ *  len     : length of data to be encrypted
-+ *  auth_src: the data to be authenticated
-+ *  src     : the data to be encrypted
-+ *  dst     : space to hold encrypted data (preferably in-place). It must have
-+ *            at least a size of len + tag_size + blocksize.
-+ *  tag_size: the size of the desired authentication tag or zero to use
-+ *            the default mac output.
-+ *
-+ * Note that the padding used is the minimum padding.
-+ */
-+
-+/* In SRTP mode the following are required:
-+ *  flags   : COP_FLAG_AEAD_SRTP_TYPE
-+ *  iv      : the initialization vector
-+ *  auth_len: the length of the data to be authenticated. This must
-+ *            include the SRTP header + SRTP payload (data to be encrypted) + rest
-+ *            
-+ *  len     : length of data to be encrypted
-+ *  auth_src: pointer the data to be authenticated. Should point at the same buffer as src.
-+ *  src     : pointer to the data to be encrypted.
-+ *  dst     : This is mandatory to be the same as src (in-place only).
-+ *  tag_size: the size of the desired authentication tag or zero to use
-+ *            the default mac output.
-+ *  tag     : Pointer to an address where the authentication tag will be copied.
-+ */
-+
-+
-+/* struct crypt_op flags */
-+
-+#define COP_FLAG_NONE		(0 << 0) /* totally no flag */
-+#define COP_FLAG_UPDATE		(1 << 0) /* multi-update hash mode */
-+#define COP_FLAG_FINAL		(1 << 1) /* multi-update final hash mode */
-+#define COP_FLAG_WRITE_IV	(1 << 2) /* update the IV during operation */
-+#define COP_FLAG_NO_ZC		(1 << 3) /* do not zero-copy */
-+#define COP_FLAG_AEAD_TLS_TYPE  (1 << 4) /* authenticate and encrypt using the 
-+                                          * TLS protocol rules */
-+#define COP_FLAG_AEAD_SRTP_TYPE  (1 << 5) /* authenticate and encrypt using the 
-+                                           * SRTP protocol rules */
-+#define COP_FLAG_RESET		(1 << 6) /* multi-update reset the state.
-+                                          * should be used in combination
-+                                          * with COP_FLAG_UPDATE */
-+
-+
-+/* Stuff for bignum arithmetic and public key
-+ * cryptography - not supported yet by linux
-+ * cryptodev.
-+ */
-+
-+#define	CRYPTO_ALG_FLAG_SUPPORTED	1
-+#define	CRYPTO_ALG_FLAG_RNG_ENABLE	2
-+#define	CRYPTO_ALG_FLAG_DSA_SHA		4
-+
-+struct crparam {
-+	__u8	*crp_p;
-+	__u32	crp_nbits;
-+};
-+
-+#define CRK_MAXPARAM	8
-+
-+/* input of CIOCKEY */
-+struct crypt_kop {
-+	__u32	crk_op;		/* cryptodev_crk_ot_t */
-+	__u32	crk_status;
-+	__u16	crk_iparams;
-+	__u16	crk_oparams;
-+	__u32	crk_pad1;
-+	struct crparam	crk_param[CRK_MAXPARAM];
-+};
-+
-+enum cryptodev_crk_op_t {
-+	CRK_MOD_EXP = 0,
-+	CRK_MOD_EXP_CRT = 1,
-+	CRK_DSA_SIGN = 2,
-+	CRK_DSA_VERIFY = 3,
-+	CRK_DH_COMPUTE_KEY = 4,
-+	CRK_ALGORITHM_ALL
-+};
-+
-+#define CRK_ALGORITHM_MAX	(CRK_ALGORITHM_ALL-1)
-+
-+/* features to be queried with CIOCASYMFEAT ioctl
-+ */
-+#define CRF_MOD_EXP		(1 << CRK_MOD_EXP)
-+#define CRF_MOD_EXP_CRT		(1 << CRK_MOD_EXP_CRT)
-+#define CRF_DSA_SIGN		(1 << CRK_DSA_SIGN)
-+#define CRF_DSA_VERIFY		(1 << CRK_DSA_VERIFY)
-+#define CRF_DH_COMPUTE_KEY	(1 << CRK_DH_COMPUTE_KEY)
-+
-+
-+/* ioctl's. Compatible with old linux cryptodev.h
-+ */
-+#define CRIOGET         _IOWR('c', 101, __u32)
-+#define CIOCGSESSION    _IOWR('c', 102, struct session_op)
-+#define CIOCFSESSION    _IOW('c', 103, __u32)
-+#define CIOCCRYPT       _IOWR('c', 104, struct crypt_op)
-+#define CIOCKEY         _IOWR('c', 105, struct crypt_kop)
-+#define CIOCASYMFEAT    _IOR('c', 106, __u32)
-+#define CIOCGSESSINFO	_IOWR('c', 107, struct session_info_op)
-+
-+/* to indicate that CRIOGET is not required in linux
-+ */
-+#define CRIOGET_NOT_NEEDED 1
-+
-+/* additional ioctls for AEAD */
-+#define CIOCAUTHCRYPT   _IOWR('c', 109, struct crypt_auth_op)
-+
-+/* additional ioctls for asynchronous operation.
-+ * These are conditionally enabled since version 1.6.
-+ */
-+#define CIOCASYNCCRYPT    _IOW('c', 110, struct crypt_op)
-+#define CIOCASYNCFETCH    _IOR('c', 111, struct crypt_op)
-+
-+#endif /* L_CRYPTODEV_H */
-diff -Nur openssl-1.0.1e-vanilla/crypto/engine/eng_cryptodev.c openssl-1.0.1e/crypto/engine/eng_cryptodev.c
---- openssl-1.0.1e-vanilla/crypto/engine/eng_cryptodev.c	2013-02-11 15:26:04.000000000 +0000
-+++ openssl-1.0.1e/crypto/engine/eng_cryptodev.c	2013-12-25 14:27:06.968877039 +0000
-@@ -2,6 +2,7 @@
-  * Copyright (c) 2002 Bob Beck <beck@openbsd.org>
-  * Copyright (c) 2002 Theo de Raadt
-  * Copyright (c) 2002 Markus Friedl
-+ * Copyright (c) 2012 Nikos Mavrogiannopoulos
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-@@ -74,8 +75,6 @@
- 	int d_fd;
- 
- #ifdef USE_CRYPTODEV_DIGESTS
--	char dummy_mac_key[HASH_MAX_LEN];
--
- 	unsigned char digest_res[HASH_MAX_LEN];
- 	char *mac_data;
- 	int mac_len;
-@@ -157,15 +156,21 @@
- static struct {
- 	int	id;
- 	int	nid;
--	int 	keylen;
-+	int 	digestlen;
- } digests[] = {
-+#if 0
-+        /* HMAC is not supported */
- 	{ CRYPTO_MD5_HMAC,		NID_hmacWithMD5,	16},
- 	{ CRYPTO_SHA1_HMAC,		NID_hmacWithSHA1,	20},
--	{ CRYPTO_RIPEMD160_HMAC,	NID_ripemd160,		16/*?*/},
--	{ CRYPTO_MD5_KPDK,		NID_undef,		0},
--	{ CRYPTO_SHA1_KPDK,		NID_undef,		0},
-+	{ CRYPTO_SHA2_256_HMAC,		NID_hmacWithSHA256,	32},
-+	{ CRYPTO_SHA2_384_HMAC,		NID_hmacWithSHA384,	48},
-+	{ CRYPTO_SHA2_512_HMAC,		NID_hmacWithSHA512,	64},
-+#endif
- 	{ CRYPTO_MD5,			NID_md5,		16},
- 	{ CRYPTO_SHA1,			NID_sha1,		20},
-+	{ CRYPTO_SHA2_256,		NID_sha256,		32},
-+	{ CRYPTO_SHA2_384,		NID_sha384,		48},
-+	{ CRYPTO_SHA2_512,		NID_sha512,		64},
- 	{ 0,				NID_undef,		0},
- };
- #endif
-@@ -243,13 +248,14 @@
- 	static int nids[CRYPTO_ALGORITHM_MAX];
- 	struct session_op sess;
- 	int fd, i, count = 0;
-+	unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- 
- 	if ((fd = get_dev_crypto()) < 0) {
- 		*cnids = NULL;
- 		return (0);
- 	}
- 	memset(&sess, 0, sizeof(sess));
--	sess.key = (caddr_t)"123456789abcdefghijklmno";
-+	sess.key = (void*)fake_key;
- 
- 	for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- 		if (ciphers[i].nid == NID_undef)
-@@ -281,6 +287,7 @@
- get_cryptodev_digests(const int **cnids)
- {
- 	static int nids[CRYPTO_ALGORITHM_MAX];
-+	unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- 	struct session_op sess;
- 	int fd, i, count = 0;
- 
-@@ -289,12 +296,12 @@
- 		return (0);
- 	}
- 	memset(&sess, 0, sizeof(sess));
--	sess.mackey = (caddr_t)"123456789abcdefghijklmno";
-+	sess.mackey = fake_key;
- 	for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- 		if (digests[i].nid == NID_undef)
- 			continue;
- 		sess.mac = digests[i].id;
--		sess.mackeylen = digests[i].keylen;
-+		sess.mackeylen = 8;
- 		sess.cipher = 0;
- 		if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
- 		    ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
-@@ -382,14 +389,14 @@
- 	cryp.ses = sess->ses;
- 	cryp.flags = 0;
- 	cryp.len = inl;
--	cryp.src = (caddr_t) in;
--	cryp.dst = (caddr_t) out;
-+	cryp.src = (void*) in;
-+	cryp.dst = (void*) out;
- 	cryp.mac = 0;
- 
- 	cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
- 
- 	if (ctx->cipher->iv_len) {
--		cryp.iv = (caddr_t) ctx->iv;
-+		cryp.iv = (void*) ctx->iv;
- 		if (!ctx->encrypt) {
- 			iiv = in + inl - ctx->cipher->iv_len;
- 			memcpy(save_iv, iiv, ctx->cipher->iv_len);
-@@ -440,7 +447,7 @@
- 	if ((state->d_fd = get_dev_crypto()) < 0)
- 		return (0);
- 
--	sess->key = (caddr_t)key;
-+	sess->key = (void*)key;
- 	sess->keylen = ctx->key_len;
- 	sess->cipher = cipher;
- 
-@@ -660,18 +667,6 @@
- }
- 
- 
--static int
--digest_key_length(int nid)
--{
--	int i;
--
--	for (i = 0; digests[i].id; i++)
--		if (digests[i].nid == nid)
--			return digests[i].keylen;
--	return (0);
--}
--
--
- static int cryptodev_digest_init(EVP_MD_CTX *ctx)
- {
- 	struct dev_crypto_state *state = ctx->md_data;
-@@ -682,7 +677,6 @@
- 		printf("cryptodev_digest_init: Can't get digest \n");
- 		return (0);
- 	}
--
- 	memset(state, 0, sizeof(struct dev_crypto_state));
- 
- 	if ((state->d_fd = get_dev_crypto()) < 0) {
-@@ -690,8 +684,8 @@
- 		return (0);
- 	}
- 
--	sess->mackey = state->dummy_mac_key;
--	sess->mackeylen = digest_key_length(ctx->digest->type);
-+	sess->mackey = NULL;
-+	sess->mackeylen = 0;
- 	sess->mac = digest;
- 
- 	if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-@@ -707,8 +701,8 @@
- static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
- 		size_t count)
- {
--	struct crypt_op cryp;
- 	struct dev_crypto_state *state = ctx->md_data;
-+	struct crypt_op cryp;
- 	struct session_op *sess = &state->d_sess;
- 
- 	if (!data || state->d_fd < 0) {
-@@ -717,7 +711,7 @@
- 	}
- 
- 	if (!count) {
--		return (0);
-+		return (1);
- 	}
- 
- 	if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
-@@ -740,9 +734,9 @@
- 	cryp.ses = sess->ses;
- 	cryp.flags = 0;
- 	cryp.len = count;
--	cryp.src = (caddr_t) data;
-+	cryp.src = (void*) data;
- 	cryp.dst = NULL;
--	cryp.mac = (caddr_t) state->digest_res;
-+	cryp.mac = (void*) state->digest_res;
- 	if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
- 		printf("cryptodev_digest_update: digest failed\n");
- 		return (0);
-@@ -757,8 +751,6 @@
- 	struct dev_crypto_state *state = ctx->md_data;
- 	struct session_op *sess = &state->d_sess;
- 
--	int ret = 1;
--
- 	if (!md || state->d_fd < 0) {
- 		printf("cryptodev_digest_final: illegal input\n");
- 		return(0);
-@@ -772,7 +764,7 @@
- 		cryp.len = state->mac_len;
- 		cryp.src = state->mac_data;
- 		cryp.dst = NULL;
--		cryp.mac = (caddr_t)md;
-+		cryp.mac = (void*)md;
- 		if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
- 			printf("cryptodev_digest_final: digest failed\n");
- 			return (0);
-@@ -783,7 +775,7 @@
- 
- 	memcpy(md, state->digest_res, ctx->digest->md_size);
- 
--	return (ret);
-+	return 1;
- }
- 
- 
-@@ -835,8 +827,8 @@
- 
- 	digest = digest_nid_to_cryptodev(to->digest->type);
- 
--	sess->mackey = dstate->dummy_mac_key;
--	sess->mackeylen = digest_key_length(to->digest->type);
-+	sess->mackey = NULL;
-+	sess->mackeylen = 0;
- 	sess->mac = digest;
- 
- 	dstate->d_fd = get_dev_crypto();
-@@ -861,34 +853,117 @@
- }
- 
- 
--const EVP_MD cryptodev_sha1 = {
-+static const EVP_MD cryptodev_sha1 = {
- 	NID_sha1,
--	NID_undef, 
-+	NID_sha1WithRSAEncryption,
- 	SHA_DIGEST_LENGTH, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
- 	EVP_MD_FLAG_ONESHOT,
- 	cryptodev_digest_init,
- 	cryptodev_digest_update,
- 	cryptodev_digest_final,
- 	cryptodev_digest_copy,
- 	cryptodev_digest_cleanup,
--	EVP_PKEY_NULL_method,
-+	EVP_PKEY_RSA_method,
- 	SHA_CBLOCK,
--	sizeof(struct dev_crypto_state),
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha256 = {
-+	NID_sha256,
-+	NID_sha256WithRSAEncryption,
-+	SHA256_DIGEST_LENGTH, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+	EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA256_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+static const EVP_MD cryptodev_sha224 = {
-+	NID_sha224,
-+	NID_sha224WithRSAEncryption, 
-+	SHA224_DIGEST_LENGTH, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+	EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA256_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha384 = {
-+	NID_sha384,
-+	NID_sha384WithRSAEncryption, 
-+	SHA384_DIGEST_LENGTH, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+	EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA512_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha512 = {
-+	NID_sha512,
-+	NID_sha512WithRSAEncryption, 
-+	SHA512_DIGEST_LENGTH, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+	EVP_MD_FLAG_ONESHOT,
-+	cryptodev_digest_init,
-+	cryptodev_digest_update,
-+	cryptodev_digest_final,
-+	cryptodev_digest_copy,
-+	cryptodev_digest_cleanup,
-+	EVP_PKEY_RSA_method,
-+	SHA512_CBLOCK,
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
- };
- 
--const EVP_MD cryptodev_md5 = {
-+static const EVP_MD cryptodev_md5 = {
- 	NID_md5,
--	NID_undef, 
-+	NID_md5WithRSAEncryption, 
- 	16 /* MD5_DIGEST_LENGTH */, 
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+	EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+	EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
- 	EVP_MD_FLAG_ONESHOT,
- 	cryptodev_digest_init,
- 	cryptodev_digest_update,
- 	cryptodev_digest_final,
- 	cryptodev_digest_copy,
- 	cryptodev_digest_cleanup,
--	EVP_PKEY_NULL_method,
-+	EVP_PKEY_RSA_method,
- 	64 /* MD5_CBLOCK */,
--	sizeof(struct dev_crypto_state),
-+	sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
- };
- 
- #endif /* USE_CRYPTODEV_DIGESTS */
-@@ -909,6 +984,18 @@
- 	case NID_sha1:
- 		*digest = &cryptodev_sha1;
-  		break;
-+	case NID_sha224:
-+		*digest = &cryptodev_sha224;
-+ 		break;
-+	case NID_sha256:
-+		*digest = &cryptodev_sha256;
-+ 		break;
-+	case NID_sha384:
-+		*digest = &cryptodev_sha384;
-+ 		break;
-+	case NID_sha512:
-+		*digest = &cryptodev_sha512;
-+ 		break;
- 	default:
- #endif /* USE_CRYPTODEV_DIGESTS */
- 		*digest = NULL;
-@@ -940,7 +1027,7 @@
- 		return (1);
- 	memset(b, 0, bytes);
- 
--	crp->crp_p = (caddr_t) b;
-+	crp->crp_p = (void*) b;
- 	crp->crp_nbits = bits;
- 
- 	for (i = 0, j = 0; i < a->top; i++) {
-@@ -1193,7 +1280,7 @@
- 	kop.crk_op = CRK_DSA_SIGN;
- 
- 	/* inputs: dgst dsa->p dsa->q dsa->g dsa->priv_key */
--	kop.crk_param[0].crp_p = (caddr_t)dgst;
-+	kop.crk_param[0].crp_p = (void*)dgst;
- 	kop.crk_param[0].crp_nbits = dlen * 8;
- 	if (bn2crparam(dsa->p, &kop.crk_param[1]))
- 		goto err;
-@@ -1233,7 +1320,7 @@
- 	kop.crk_op = CRK_DSA_VERIFY;
- 
- 	/* inputs: dgst dsa->p dsa->q dsa->g dsa->pub_key sig->r sig->s */
--	kop.crk_param[0].crp_p = (caddr_t)dgst;
-+	kop.crk_param[0].crp_p = (void*)dgst;
- 	kop.crk_param[0].crp_nbits = dlen * 8;
- 	if (bn2crparam(dsa->p, &kop.crk_param[1]))
- 		goto err;
-@@ -1311,9 +1398,10 @@
- 		goto err;
- 	kop.crk_iparams = 3;
- 
--	kop.crk_param[3].crp_p = (caddr_t) key;
--	kop.crk_param[3].crp_nbits = keylen * 8;
-+	kop.crk_param[3].crp_p = (void*) key;
-+	kop.crk_param[3].crp_nbits = keylen;
- 	kop.crk_oparams = 1;
-+	dhret = keylen/8;
- 
- 	if (ioctl(fd, CIOCKEY, &kop) == -1) {
- 		const DH_METHOD *meth = DH_OpenSSL();
-@@ -1385,7 +1473,7 @@
- 	put_dev_crypto(fd);
- 
- 	if (!ENGINE_set_id(engine, "cryptodev") ||
--	    !ENGINE_set_name(engine, "BSD cryptodev engine") ||
-+	    !ENGINE_set_name(engine, "cryptodev engine") ||
- 	    !ENGINE_set_ciphers(engine, cryptodev_engine_ciphers) ||
- 	    !ENGINE_set_digests(engine, cryptodev_engine_digests) ||
- 	    !ENGINE_set_ctrl_function(engine, cryptodev_ctrl) ||
diff --git a/src/patches/openssl-1.0.1e-weak-ciphers.patch b/src/patches/openssl-1.0.1e-weak-ciphers.patch
deleted file mode 100644
index 8657345387..0000000000
--- a/src/patches/openssl-1.0.1e-weak-ciphers.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up openssl-1.0.1e/ssl/ssl.h.weak-ciphers openssl-1.0.1e/ssl/ssl.h
---- openssl-1.0.1e/ssl/ssl.h.weak-ciphers	2013-12-18 15:50:40.881620314 +0100
-+++ openssl-1.0.1e/ssl/ssl.h	2013-12-18 14:25:25.596566704 +0100
-@@ -331,7 +331,7 @@ extern "C" {
- /* The following cipher list is used by default.
-  * It also is substituted when an application-defined cipher list string
-  * starts with 'DEFAULT'. */
--#define SSL_DEFAULT_CIPHER_LIST	"ALL:!aNULL:!eNULL:!SSLv2"
-+#define SSL_DEFAULT_CIPHER_LIST	"ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!RC2:!DES"
- /* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
-  * starts with a reasonable order, and all we have to do for DEFAULT is
-  * throwing out anonymous and unencrypted ciphersuites!
diff --git a/src/patches/openssl-1.0.1m-weak-ciphers.patch b/src/patches/openssl-1.0.1m-weak-ciphers.patch
new file mode 100644
index 0000000000..f57b97811d
--- /dev/null
+++ b/src/patches/openssl-1.0.1m-weak-ciphers.patch
@@ -0,0 +1,11 @@
+--- openssl-1.0.1m/ssl/ssl.h.old	2015-03-19 15:25:20.646533583 +0100
++++ openssl-1.0.1m/ssl/ssl.h	2015-03-19 15:25:31.229875691 +0100
+@@ -334,7 +334,7 @@
+  * The following cipher list is used by default. It also is substituted when
+  * an application-defined cipher list string starts with 'DEFAULT'.
+  */
+-# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2"
++# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2:!RC2:!DES"
+ /*
+  * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
+  * starts with a reasonable order, and all we have to do for DEFAULT is
diff --git a/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch b/src/patches/openssl-1.0.2-fix_parallel_build-1.patch
similarity index 88%
rename from src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
rename to src/patches/openssl-1.0.2-fix_parallel_build-1.patch
index 855e4fe0c9..acfaa72cb2 100644
--- a/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
+++ b/src/patches/openssl-1.0.2-fix_parallel_build-1.patch
@@ -1,13 +1,13 @@
 Submitted By:            Armin K. <krejzi at email dot com>
-Date:                    2013-05-05
+Date:                    2015-01-23
 Initial Package Version: 1.0.1e
 Upstream Status:         Unknown
 Origin:                  https://github.com/Alexpux/Qt-builds/tree/master/patches/openssl
-Description:             Fixes build with make -jx, where x is greater than 1.
+Description:             Fixes build when using more than one make job to build the package.
 
---- a/crypto/Makefile	2013-02-11 16:26:04.000000000 +0100
-+++ b/crypto/Makefile	2013-05-05 20:06:34.872208113 +0200
-@@ -86,11 +86,11 @@
+--- a/crypto/Makefile	2015-01-22 17:12:09.000000000 +0100
++++ b/crypto/Makefile	2015-01-23 16:42:13.460175569 +0100
+@@ -85,11 +85,11 @@
  	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
  
  subdirs:
@@ -15,22 +15,22 @@ Description:             Fixes build with make -jx, where x is greater than 1.
 +	+@target=all; $(RECURSIVE_MAKE)
  
  files:
- 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+ 	$(PERL) $(TOP)/util/files.pl "CPUID_OBJ=$(CPUID_OBJ)" Makefile >> $(TOP)/MINFO
 -	@target=files; $(RECURSIVE_MAKE)
 +	+@target=files; $(RECURSIVE_MAKE)
  
  links:
  	@$(PERL) $(TOP)/util/mklink.pl ../include/openssl $(EXHEADER)
-@@ -101,7 +101,7 @@
+@@ -100,7 +100,7 @@
  # lib: $(LIB): are splitted to avoid end-less loop
  lib:	$(LIB)
  	@touch lib
 -$(LIB):	$(LIBOBJ)
 +$(LIB):	$(LIBOBJ) | subdirs
  	$(AR) $(LIB) $(LIBOBJ)
- 	[ -z "$(FIPSLIBDIR)" ] || $(AR) $(LIB) $(FIPSLIBDIR)fipscanister.o
+ 	test -z "$(FIPSLIBDIR)" || $(AR) $(LIB) $(FIPSLIBDIR)fipscanister.o
  	$(RANLIB) $(LIB) || echo Never mind.
-@@ -112,7 +112,7 @@
+@@ -111,7 +111,7 @@
  	fi
  
  libs:
@@ -39,7 +39,7 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  
  install:
  	@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
-@@ -121,7 +121,7 @@
+@@ -120,7 +120,7 @@
  	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
  	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
  	done;
@@ -48,8 +48,8 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  
  lint:
  	@target=lint; $(RECURSIVE_MAKE)
---- a/engines/Makefile	2013-02-11 16:26:04.000000000 +0100
-+++ b/engines/Makefile	2013-05-05 20:06:34.872208113 +0200
+--- a/engines/Makefile	2015-01-22 17:12:24.000000000 +0100
++++ b/engines/Makefile	2015-01-23 16:42:13.461175596 +0100
 @@ -72,7 +72,7 @@
  
  all:	lib subdirs
@@ -77,9 +77,9 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  
  tags:
  	ctags $(SRC)
---- a/Makefile.org	2013-02-11 16:26:04.000000000 +0100
-+++ b/Makefile.org	2013-05-05 20:06:34.862207917 +0200
-@@ -273,17 +273,17 @@
+--- a/Makefile.org	2015-01-22 15:58:06.000000000 +0100
++++ b/Makefile.org	2015-01-23 16:42:13.461175596 +0100
+@@ -274,17 +274,17 @@
  build_libs: build_crypto build_ssl build_engines
  
  build_crypto:
@@ -108,7 +108,7 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  
  all_testapps: build_libs build_testapps
  build_testapps:
-@@ -537,9 +537,9 @@
+@@ -536,9 +536,9 @@
  dist_pem_h:
  	(cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
  
@@ -120,7 +120,7 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
  		$(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR) \
  		$(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines \
-@@ -548,12 +548,19 @@
+@@ -547,12 +547,19 @@
  		$(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
  		$(INSTALL_PREFIX)$(OPENSSLDIR)/certs \
  		$(INSTALL_PREFIX)$(OPENSSLDIR)/private
@@ -141,7 +141,7 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  	@set -e; liblist="$(LIBS)"; for i in $$liblist ;\
  	do \
  		if [ -f "$$i" ]; then \
-@@ -633,12 +640,7 @@
+@@ -636,12 +643,7 @@
  		done; \
  	done
  
@@ -155,8 +155,8 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  	@pod2man="`cd ./util; ./pod2mantest $(PERL)`"; \
  	here="`pwd`"; \
  	filecase=; \
---- a/Makefile.shared	2013-02-11 16:26:04.000000000 +0100
-+++ b/Makefile.shared	2013-05-05 20:06:34.872208113 +0200
+--- a/Makefile.shared	2015-01-20 13:33:36.000000000 +0100
++++ b/Makefile.shared	2015-01-23 16:42:13.461175596 +0100
 @@ -105,6 +105,7 @@
      SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
      LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
@@ -173,9 +173,9 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  			( $(SET_X); rm -f $$SHLIB$$SHLIB_SUFFIX; \
  			  ln -s $$prev $$SHLIB$$SHLIB_SUFFIX ); \
  		fi; \
---- a/test/Makefile	2013-02-11 16:26:04.000000000 +0100
-+++ b/test/Makefile	2013-05-05 20:06:34.872208113 +0200
-@@ -124,7 +124,7 @@
+--- a/test/Makefile	2015-01-22 17:12:26.000000000 +0100
++++ b/test/Makefile	2015-01-23 16:42:13.461175596 +0100
+@@ -132,7 +132,7 @@
  tags:
  	ctags $(SRC)
  
@@ -184,7 +184,7 @@ Description:             Fixes build with make -jx, where x is greater than 1.
  
  apps:
  	@(cd ..; $(MAKE) DIRS=apps all)
-@@ -365,109 +365,109 @@
+@@ -398,109 +398,109 @@
  		link_app.$${shlib_target}
  
  $(RSATEST)$(EXE_EXT): $(RSATEST).o $(DLIBCRYPTO)
@@ -327,9 +327,9 @@ Description:             Fixes build with make -jx, where x is greater than 1.
 -	@target=$(SRPTEST); $(BUILD_CMD)
 +	+@target=$(SRPTEST); $(BUILD_CMD)
  
- #$(AESTEST).o: $(AESTEST).c
- #	$(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
-@@ -480,7 +480,7 @@
+ $(V3NAMETEST)$(EXE_EXT): $(V3NAMETEST).o $(DLIBCRYPTO)
+ 	@target=$(V3NAMETEST); $(BUILD_CMD)
+@@ -522,7 +522,7 @@
  #	fi
  
  dummytest$(EXE_EXT): dummytest.o $(DLIBCRYPTO)
diff --git a/src/patches/openssl-1.0.2a-rpmbuild.patch b/src/patches/openssl-1.0.2a-rpmbuild.patch
new file mode 100644
index 0000000000..2f71f1d485
--- /dev/null
+++ b/src/patches/openssl-1.0.2a-rpmbuild.patch
@@ -0,0 +1,71 @@
+diff -Nur openssl-1.0.2d/Configure openssl-1.0.2d.patched/Configure
+--- openssl-1.0.2d/Configure	2015-07-09 11:57:15.000000000 +0000
++++ openssl-1.0.2d.patched/Configure	2015-08-22 20:44:19.487000000 +0000
+@@ -365,7 +365,7 @@
+ ####
+ # *-generic* is endian-neutral target, but ./config is free to
+ # throw in -D[BL]_ENDIAN, whichever appropriate...
+-"linux-generic32","gcc:-O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-generic32","gcc:\$(CFLAGS) -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(CFLAGS):.so.\$(SHLIB_SONAMEVER)",
+ "linux-ppc",	"gcc:-DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
+ #######################################################################
+@@ -406,7 +406,7 @@
+ "linux64-mips64",   "gcc:-mabi=64 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ #### IA-32 targets...
+ "linux-ia32-icc",	"icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-elf",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-elf",	"gcc:-DL_ENDIAN \$(CFLAGS) -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_SONAMEVER)",
+ "linux-aout",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
+ ####
+ "linux-generic64","gcc:-O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -414,7 +414,7 @@
+ "linux-ppc64le","gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:$ppc64_asm:linux64le:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::",
+ "linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "linux-ia64-icc","icc:-DL_ENDIAN -O2 -Wall::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux-x86_64",	"gcc:-m64 -DL_ENDIAN \$(CFLAGS) -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_SONAMEVER):::64",
+ "linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN -O3 -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ "linux-x86_64-icc", "icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ "linux-x32",	"gcc:-mx32 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-mx32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::x32",
+@@ -1764,7 +1764,7 @@
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
+ 		{
+ 		my $sotmp = $1;
+-		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
++		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/;
+ 		}
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
+ 		{
+
+diff -Nur openssl-1.0.2d/Makefile.org openssl-1.0.2d.patched/Makefile.org
+--- openssl-1.0.2d/Makefile.org	2015-07-09 11:57:15.000000000 +0000
++++ openssl-1.0.2d.patched/Makefile.org	2015-08-22 20:41:49.921000000 +0000
+@@ -10,6 +10,7 @@
+ SHLIB_MAJOR=
+ SHLIB_MINOR=
+ SHLIB_EXT=
++SHLIB_SONAMEVER=10
+ PLATFORM=dist
+ OPTIONS=
+ CONFIGURE_ARGS=
+@@ -339,10 +340,9 @@
+ link-shared:
+ 	@ set -e; for i in $(SHLIBDIRS); do \
+ 		$(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
+-			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ 			symlink.$(SHLIB_TARGET); \
+-		libs="$$libs -l$$i"; \
+ 	done
+ 
+ build-shared: do_$(SHLIB_TARGET) link-shared
+@@ -353,7 +353,7 @@
+ 			libs="$(LIBKRB5) $$libs"; \
+ 		fi; \
+ 		$(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
+-			LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++			LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ 			LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ 			LIBDEPS="$$libs $(EX_LIBS)" \
diff --git a/src/patches/openssl-1.0.2a_auto_enable_padlock.patch b/src/patches/openssl-1.0.2a_auto_enable_padlock.patch
new file mode 100644
index 0000000000..b5c0e95a2e
--- /dev/null
+++ b/src/patches/openssl-1.0.2a_auto_enable_padlock.patch
@@ -0,0 +1,34 @@
+diff -Naur openssl-1.0.2a.org/crypto/engine/eng_all.c openssl-1.0.2a/crypto/engine/eng_all.c
+--- openssl-1.0.2a.org/crypto/engine/eng_all.c	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/crypto/engine/eng_all.c	2015-04-27 12:27:05.063569969 +0200
+@@ -120,6 +120,14 @@
+     ENGINE_load_capi();
+ # endif
+ #endif
++#ifdef OPENSSL_NO_STATIC_ENGINE
++	ENGINE *e;
++	e = ENGINE_by_id("padlock");
++	if (e != NULL) {
++		ENGINE_add(e);
++		ENGINE_free(e);
++	}
++#endif
+     ENGINE_register_all_complete();
+ }
+ 
+diff -Naur openssl-1.0.2a.org/ssl/ssl_algs.c openssl-1.0.2a/ssl/ssl_algs.c
+--- openssl-1.0.2a.org/ssl/ssl_algs.c	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/ssl/ssl_algs.c	2015-04-27 11:04:27.893399695 +0200
+@@ -151,5 +151,12 @@
+ #endif
+     /* initialize cipher/digest methods table */
+     ssl_load_ciphers();
++
++    /* Init available hardware crypto engines */
++    ENGINE_load_builtin_engines();
++    ENGINE_register_all_complete();
++    ENGINE * padlock = ENGINE_by_id("padlock");
++    if (padlock) ENGINE_set_default_ciphers(padlock);
++
+     return (1);
+ }
diff --git a/src/patches/openssl-1.0.2a_disable_ssse3_for_amd.patch b/src/patches/openssl-1.0.2a_disable_ssse3_for_amd.patch
new file mode 100644
index 0000000000..097cc80713
--- /dev/null
+++ b/src/patches/openssl-1.0.2a_disable_ssse3_for_amd.patch
@@ -0,0 +1,11 @@
+diff -Naur openssl-1.0.2a.org/crypto/x86cpuid.pl openssl-1.0.2a/crypto/x86cpuid.pl
+--- openssl-1.0.2a.org/crypto/x86cpuid.pl	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/crypto/x86cpuid.pl	2015-04-28 13:47:57.853521020 +0200
+@@ -71,6 +71,7 @@
+ 	&mov	("eax",1);
+ 	&xor	("ecx","ecx");
+ 	&cpuid	();
++	&and	("ecx",0xfffffdff);	# clear SSSE3 because it is incredible slow on AMD's
+ 	&bt	("edx",28);
+ 	&jnc	(&label("generic"));
+ 	&shr	("ebx",16);
diff --git a/src/patches/openssl-disable-sslv2-sslv3.patch b/src/patches/openssl-disable-sslv2-sslv3.patch
index ebf542907d..e42dfac69b 100644
--- a/src/patches/openssl-disable-sslv2-sslv3.patch
+++ b/src/patches/openssl-disable-sslv2-sslv3.patch
@@ -1,13 +1,12 @@
-diff -up openssl-1.0.1h/ssl/ssl_lib.c.v2v3 openssl-1.0.1h/ssl/ssl_lib.c
---- openssl-1.0.1h/ssl/ssl_lib.c.v2v3	2014-06-11 16:02:52.000000000 +0200
-+++ openssl-1.0.1h/ssl/ssl_lib.c	2014-06-30 14:18:04.290248080 +0200
-@@ -1875,6 +1875,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
- 	 */
- 	ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
- 
-+	/* Disable SSLv2 and SSLv3 by default (affects the SSLv23_method() only) */
-+	ret->options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
-+
- 	return(ret);
- err:
- 	SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
+--- openssl-1.0.1m/ssl/ssl_lib.c.old	2015-03-19 15:56:40.966287977 +0100
++++ openssl-1.0.1m/ssl/ssl_lib.c	2015-03-19 15:57:07.976160846 +0100
+@@ -1892,6 +1892,9 @@
+      */
+     ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
+ 
++    /* Disable SSLv2 and SSLv3 by default (affects the SSLv23_method() only) */
++    ret->options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
++
+     return (ret);
+  err:
+     SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
diff --git a/src/patches/pcre-8.37-Fix-another-buffer-overflow.patch b/src/patches/pcre-8.37-Fix-another-buffer-overflow.patch
new file mode 100644
index 0000000000..20ead09231
--- /dev/null
+++ b/src/patches/pcre-8.37-Fix-another-buffer-overflow.patch
@@ -0,0 +1,110 @@
+From f6efcf125123199d446c5561266c3c3846ed9f30 Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Wed, 3 Jun 2015 16:51:59 +0000
+Subject: [PATCH] Fix another buffer overflow.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Ported to 8.37:
+
+commit 225f0d5eb16c7a26591a1e3f286c7476907b5a6a
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Wed Jun 3 16:51:59 2015 +0000
+
+    Fix another buffer overflow.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1562 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
+---
+ pcre_compile.c           | 7 ++++++-
+ testdata/testinput2      | 2 ++
+ testdata/testoutput11-16 | 2 +-
+ testdata/testoutput11-32 | 2 +-
+ testdata/testoutput11-8  | 2 +-
+ testdata/testoutput2     | 2 ++
+ 6 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index 8b4aaef..f5d2384 100644
+--- a/pcre_compile.c
++++ b/pcre_compile.c
+@@ -7210,7 +7210,12 @@ for (;; ptr++)
+           real compile this will be picked up and the reference wrapped with
+           OP_ONCE to make it atomic, so we must space in case this occurs. */
+ 
+-          if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
++          /* In fact, this can happen for a non-forward reference because
++          another group with the same number might be created later. This
++          issue is fixed "properly" in PCRE2. As PCRE1 is now in maintenance
++          only mode, we finesse the bug by allowing more memory always. */
++
++          /* if (recno == 0) */ *lengthptr += 2 + 2*LINK_SIZE;
+           }
+ 
+         /* In the real compile, search the name table. We check the name
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 5cc9ce6..e12de3a 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4156,4 +4156,6 @@ backtracking verbs. --/
+ 
+ /(?=di(?<=(?1))|(?=(.))))/
+ 
++"(?J:(?|(?'R')(\k'R')|((?'R'))))"
++
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput11-16 b/testdata/testoutput11-16
+index 422f2ad..e222e7c 100644
+--- a/testdata/testoutput11-16
++++ b/testdata/testoutput11-16
+@@ -231,7 +231,7 @@ Memory allocation (code space): 73
+ ------------------------------------------------------------------
+ 
+ /(?P<a>a)...(?P=a)bbb(?P>a)d/BM
+-Memory allocation (code space): 61
++Memory allocation (code space): 77
+ ------------------------------------------------------------------
+   0  24 Bra
+   2   5 CBra 1
+diff --git a/testdata/testoutput11-32 b/testdata/testoutput11-32
+index d953ec8..9a80ec9 100644
+--- a/testdata/testoutput11-32
++++ b/testdata/testoutput11-32
+@@ -231,7 +231,7 @@ Memory allocation (code space): 155
+ ------------------------------------------------------------------
+ 
+ /(?P<a>a)...(?P=a)bbb(?P>a)d/BM
+-Memory allocation (code space): 125
++Memory allocation (code space): 157
+ ------------------------------------------------------------------
+   0  24 Bra
+   2   5 CBra 1
+diff --git a/testdata/testoutput11-8 b/testdata/testoutput11-8
+index 6ec18ec..3adaca2 100644
+--- a/testdata/testoutput11-8
++++ b/testdata/testoutput11-8
+@@ -231,7 +231,7 @@ Memory allocation (code space): 45
+ ------------------------------------------------------------------
+ 
+ /(?P<a>a)...(?P=a)bbb(?P>a)d/BM
+-Memory allocation (code space): 38
++Memory allocation (code space): 50
+ ------------------------------------------------------------------
+   0  30 Bra
+   3   7 CBra 1
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 4decb8d..5bad26c 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -14428,4 +14428,6 @@ Failed: lookbehind assertion is not fixed length at offset 17
+ /(?=di(?<=(?1))|(?=(.))))/
+ Failed: unmatched parentheses at offset 23
+ 
++"(?J:(?|(?'R')(\k'R')|((?'R'))))"
++
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
diff --git a/src/patches/pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch b/src/patches/pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch
new file mode 100644
index 0000000000..16fd45c87b
--- /dev/null
+++ b/src/patches/pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch
@@ -0,0 +1,68 @@
+From 354e1f8e921dcb9cf2f3a5eac93cd826d01a7d8a Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Tue, 23 Jun 2015 16:34:53 +0000
+Subject: [PATCH] Fix buffer overflow for forward reference within backward
+ assertion with excess closing parenthesis. Bugzilla 1651.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is upstream commit ported to 8.37:
+
+commit 764692f9aea9eab50fdba6cb537441d8b34c6c37
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Tue Jun 23 16:34:53 2015 +0000
+
+    Fix buffer overflow for forward reference within backward assertion with excess
+    closing parenthesis. Bugzilla 1651.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+It fixes CVE-2015-5073.
+
+Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
+---
+ pcre_compile.c       | 2 +-
+ testdata/testinput2  | 2 ++
+ testdata/testoutput2 | 3 +++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index 6f06912..b66b1f6 100644
+--- a/pcre_compile.c
++++ b/pcre_compile.c
+@@ -9392,7 +9392,7 @@ OP_RECURSE that are not fixed length get a diagnosic with a useful offset. The
+ exceptional ones forgo this. We scan the pattern to check that they are fixed
+ length, and set their lengths. */
+ 
+-if (cd->check_lookbehind)
++if (errorcode == 0 && cd->check_lookbehind)
+   {
+   pcre_uchar *cc = (pcre_uchar *)codestart;
+ 
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 83bb471..5cc9ce6 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4154,4 +4154,6 @@ backtracking verbs. --/
+ 
+ "(?J)(?'d'(?'d'\g{d}))"
+ 
++/(?=di(?<=(?1))|(?=(.))))/
++
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 7dff52a..4decb8d 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -14425,4 +14425,7 @@ Failed: lookbehind assertion is not fixed length at offset 17
+ 
+ "(?J)(?'d'(?'d'\g{d}))"
+ 
++/(?=di(?<=(?1))|(?=(.))))/
++Failed: unmatched parentheses at offset 23
++
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
diff --git a/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch b/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch
new file mode 100644
index 0000000000..c97849fb70
--- /dev/null
+++ b/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch
@@ -0,0 +1,87 @@
+From 68ff1beb43bb3d4d8838f3285c97023d1e50513a Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Fri, 15 May 2015 17:17:03 +0000
+Subject: [PATCH] Fix buffer overflow for named recursive back reference when
+ the name is duplicated.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream commit ported to pcre-8.37:
+
+commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Fri May 15 17:17:03 2015 +0000
+
+    Fix buffer overflow for named recursive back reference when the name is
+    duplicated.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1558 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+This fixes CVE-2015-3210.
+
+Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
+---
+ pcre_compile.c       | 16 ++++++++++++++--
+ testdata/testinput2  |  2 ++
+ testdata/testoutput2 |  2 ++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index 0efad26..6f06912 100644
+--- a/pcre_compile.c
++++ b/pcre_compile.c
+@@ -7173,14 +7173,26 @@ for (;; ptr++)
+           number. If the name is not found, set the value to 0 for a forward
+           reference. */
+ 
++          recno = 0;
+           ng = cd->named_groups;
+           for (i = 0; i < cd->names_found; i++, ng++)
+             {
+             if (namelen == ng->length &&
+                 STRNCMP_UC_UC(name, ng->name, namelen) == 0)
+-              break;
++              {
++              open_capitem *oc;
++              recno = ng->number;
++              if (is_recurse) break;
++              for (oc = cd->open_caps; oc != NULL; oc = oc->next)         
++                {          
++                if (oc->number == recno)                                     
++                  {               
++                  oc->flag = TRUE;                                      
++                  break;
++                  }                                                         
++                }                          
++              }    
+             }
+-          recno = (i < cd->names_found)? ng->number : 0;
+ 
+           /* Count named back references. */
+ 
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 58fe53b..83bb471 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4152,4 +4152,6 @@ backtracking verbs. --/
+ 
+ /((?2){73}(?2))((?1))/
+ 
++"(?J)(?'d'(?'d'\g{d}))"
++
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index b718df0..7dff52a 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -14423,4 +14423,6 @@ Failed: lookbehind assertion is not fixed length at offset 17
+ 
+ /((?2){73}(?2))((?1))/
+ 
++"(?J)(?'d'(?'d'\g{d}))"
++
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
diff --git a/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-references-in-situatio.patch b/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-references-in-situatio.patch
new file mode 100644
index 0000000000..ab1b96213a
--- /dev/null
+++ b/src/patches/pcre-8.37-Fix-buffer-overflow-for-named-references-in-situatio.patch
@@ -0,0 +1,190 @@
+From b3f0b0dd971314df8f865e221aa1a88e75d6d1a6 Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Wed, 5 Aug 2015 15:38:32 +0000
+Subject: [PATCH] Fix buffer overflow for named references in (?| situations.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Ported for 8.37:
+
+commit 7af8e8717def179fd7b69e173abd347c1a3547cb
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Wed Aug 5 15:38:32 2015 +0000
+
+    Fix buffer overflow for named references in (?| situations.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1585 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
+---
+ pcre_compile.c       | 74 ++++++++++++++++++++++++++++++----------------------
+ pcre_internal.h      |  1 +
+ testdata/testinput2  |  2 ++
+ testdata/testoutput2 |  2 ++
+ 4 files changed, 48 insertions(+), 31 deletions(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index f5d2384..5fe5c1d 100644
+--- a/pcre_compile.c
++++ b/pcre_compile.c
+@@ -6641,6 +6641,7 @@ for (;; ptr++)
+         /* ------------------------------------------------------------ */
+         case CHAR_VERTICAL_LINE:  /* Reset capture count for each branch */
+         reset_bracount = TRUE;
++        cd->dupgroups = TRUE;     /* Record (?| encountered */ 
+         /* Fall through */
+ 
+         /* ------------------------------------------------------------ */
+@@ -7151,7 +7152,8 @@ for (;; ptr++)
+         if (lengthptr != NULL)
+           {
+           named_group *ng;
+-
++          recno = 0;
++           
+           if (namelen == 0)
+             {
+             *errorcodeptr = ERR62;
+@@ -7168,32 +7170,6 @@ for (;; ptr++)
+             goto FAILED;
+             }
+ 
+-          /* The name table does not exist in the first pass; instead we must
+-          scan the list of names encountered so far in order to get the
+-          number. If the name is not found, set the value to 0 for a forward
+-          reference. */
+-
+-          recno = 0;
+-          ng = cd->named_groups;
+-          for (i = 0; i < cd->names_found; i++, ng++)
+-            {
+-            if (namelen == ng->length &&
+-                STRNCMP_UC_UC(name, ng->name, namelen) == 0)
+-              {
+-              open_capitem *oc;
+-              recno = ng->number;
+-              if (is_recurse) break;
+-              for (oc = cd->open_caps; oc != NULL; oc = oc->next)
+-                {
+-                if (oc->number == recno)
+-                  {
+-                  oc->flag = TRUE;
+-                  break;
+-                  }
+-                }
+-              }
+-            }
+-
+           /* Count named back references. */
+ 
+           if (!is_recurse) cd->namedrefcount++;
+@@ -7215,7 +7191,44 @@ for (;; ptr++)
+           issue is fixed "properly" in PCRE2. As PCRE1 is now in maintenance
+           only mode, we finesse the bug by allowing more memory always. */
+ 
+-          /* if (recno == 0) */ *lengthptr += 2 + 2*LINK_SIZE;
++          *lengthptr += 2 + 2*LINK_SIZE;
++          
++          /* It is even worse than that. The current reference may be to an
++          existing named group with a different number (so apparently not
++          recursive) but which later on is also attached to a group with the
++          current number. This can only happen if $(| has been previous 
++          encountered. In that case, we allow yet more memory, just in case. 
++          (Again, this is fixed "properly" in PCRE2. */
++          
++          if (cd->dupgroups) *lengthptr += 2 + 2*LINK_SIZE;
++
++          /* Otherwise, check for recursion here. The name table does not exist
++          in the first pass; instead we must scan the list of names encountered
++          so far in order to get the number. If the name is not found, leave
++          the value of recno as 0 for a forward reference. */
++           
++          else
++            { 
++            ng = cd->named_groups;
++            for (i = 0; i < cd->names_found; i++, ng++)
++              {
++              if (namelen == ng->length &&
++                  STRNCMP_UC_UC(name, ng->name, namelen) == 0)
++                {
++                open_capitem *oc;
++                recno = ng->number;
++                if (is_recurse) break;
++                for (oc = cd->open_caps; oc != NULL; oc = oc->next)
++                  {
++                  if (oc->number == recno)
++                    {
++                    oc->flag = TRUE;
++                    break;
++                    }
++                  }
++                }
++              }
++            }   
+           }
+ 
+         /* In the real compile, search the name table. We check the name
+@@ -7262,8 +7275,6 @@ for (;; ptr++)
+           for (i++; i < cd->names_found; i++)
+             {
+             if (STRCMP_UC_UC(slot + IMM2_SIZE, cslot + IMM2_SIZE) != 0) break;
+-
+-
+             count++;
+             cslot += cd->name_entry_size;
+             }
+@@ -9189,6 +9200,7 @@ cd->names_found = 0;
+ cd->name_entry_size = 0;
+ cd->name_table = NULL;
+ cd->dupnames = FALSE;
++cd->dupgroups = FALSE;
+ cd->namedrefcount = 0;
+ cd->start_code = cworkspace;
+ cd->hwm = cworkspace;
+@@ -9223,7 +9235,7 @@ if (errorcode != 0) goto PCRE_EARLY_ERROR_RETURN;
+ 
+ DPRINTF(("end pre-compile: length=%d workspace=%d\n", length,
+   (int)(cd->hwm - cworkspace)));
+-
++  
+ if (length > MAX_PATTERN_SIZE)
+   {
+   errorcode = ERR20;
+diff --git a/pcre_internal.h b/pcre_internal.h
+index dd0ac7f..7ca6020 100644
+--- a/pcre_internal.h
++++ b/pcre_internal.h
+@@ -2446,6 +2446,7 @@ typedef struct compile_data {
+   BOOL had_pruneorskip;             /* (*PRUNE) or (*SKIP) encountered */
+   BOOL check_lookbehind;            /* Lookbehinds need later checking */
+   BOOL dupnames;                    /* Duplicate names exist */
++  BOOL dupgroups;                   /* Duplicate groups exist: (?| found */ 
+   BOOL iscondassert;                /* Next assert is a condition */
+   int  nltype;                      /* Newline type */
+   int  nllen;                       /* Newline string length */
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index e12de3a..8e044f8 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4158,4 +4158,6 @@ backtracking verbs. --/
+ 
+ "(?J:(?|(?'R')(\k'R')|((?'R'))))"
+ 
++/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R')))/
++
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 5bad26c..6019425 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -14430,4 +14430,6 @@ Failed: unmatched parentheses at offset 23
+ 
+ "(?J:(?|(?'R')(\k'R')|((?'R'))))"
+ 
++/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R')))/
++
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
diff --git a/src/patches/pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch b/src/patches/pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch
new file mode 100644
index 0000000000..837e86f348
--- /dev/null
+++ b/src/patches/pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch
@@ -0,0 +1,98 @@
+From 83ed574998fe7b844b98ab7cd56291068feb9e31 Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Sat, 16 May 2015 11:05:40 +0000
+Subject: [PATCH] Fix named forward reference to duplicate group number
+ overflow bug.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Port to 8.37:
+
+commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Sat May 16 11:05:40 2015 +0000
+
+    Fix named forward reference to duplicate group number overflow bug.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
+---
+ pcre_compile.c       | 24 ++++++++++++++++--------
+ testdata/testinput1  |  3 +++
+ testdata/testoutput1 |  5 +++++
+ 3 files changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index b66b1f6..8b4aaef 100644
+--- a/pcre_compile.c
++++ b/pcre_compile.c
+@@ -7183,15 +7183,15 @@ for (;; ptr++)
+               open_capitem *oc;
+               recno = ng->number;
+               if (is_recurse) break;
+-              for (oc = cd->open_caps; oc != NULL; oc = oc->next)         
+-                {          
+-                if (oc->number == recno)                                     
+-                  {               
+-                  oc->flag = TRUE;                                      
++              for (oc = cd->open_caps; oc != NULL; oc = oc->next)
++                {
++                if (oc->number == recno)
++                  {
++                  oc->flag = TRUE;
+                   break;
+-                  }                                                         
+-                }                          
+-              }    
++                  }
++                }
++              }
+             }
+ 
+           /* Count named back references. */
+@@ -7203,6 +7203,14 @@ for (;; ptr++)
+           16-bit data item. */
+ 
+           *lengthptr += IMM2_SIZE;
++
++          /* If this is a forward reference and we are within a (?|...) group,
++          the reference may end up as the number of a group which we are
++          currently inside, that is, it could be a recursive reference. In the
++          real compile this will be picked up and the reference wrapped with
++          OP_ONCE to make it atomic, so we must space in case this occurs. */
++
++          if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
+           }
+ 
+         /* In the real compile, search the name table. We check the name
+diff --git a/testdata/testinput1 b/testdata/testinput1
+index 73c2f4d..8379ce0 100644
+--- a/testdata/testinput1
++++ b/testdata/testinput1
+@@ -5730,4 +5730,7 @@ AbcdCBefgBhiBqz
+ "(?1)(?#?'){8}(a)"
+     baaaaaaaaac
+ 
++"(?|(\k'Pm')|(?'Pm'))"
++    abcd
++
+ /-- End of testinput1 --/
+diff --git a/testdata/testoutput1 b/testdata/testoutput1
+index 0a53fd0..e852ab9 100644
+--- a/testdata/testoutput1
++++ b/testdata/testoutput1
+@@ -9429,4 +9429,9 @@ No match
+  0: aaaaaaaaa
+  1: a
+ 
++"(?|(\k'Pm')|(?'Pm'))"
++    abcd
++ 0: 
++ 1: 
++
+ /-- End of testinput1 --/
+-- 
+2.4.3
+
diff --git a/src/patches/qemu-0.15.0_missing_definitions_hack.patch b/src/patches/qemu-0.15.0_missing_definitions_hack.patch
deleted file mode 100644
index 4ff2c08472..0000000000
--- a/src/patches/qemu-0.15.0_missing_definitions_hack.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -Naur qemu-kvm-0.15.0.org/hw/9pfs/virtio-9p-local.c qemu-kvm-0.15.0/hw/9pfs/virtio-9p-local.c
---- qemu-kvm-0.15.0.org/hw/9pfs/virtio-9p-local.c	2011-08-09 14:40:29.000000000 +0200
-+++ qemu-kvm-0.15.0/hw/9pfs/virtio-9p-local.c	2011-08-14 10:31:22.711480316 +0200
-@@ -21,6 +21,16 @@
- #include <sys/un.h>
- #include <attr/xattr.h>
- 
-+#ifndef AT_FDCWD
-+/* Copied from linux/include/linux/fcntl.h * because direct include fails */
-+#define AT_FDCWD		-100    /* Special value used to indicate
-+                                           openat should use the current
-+                                           working directory. */
-+#define AT_SYMLINK_NOFOLLOW	0x100   /* Do not follow symbolic links.  */
-+#define AT_REMOVEDIR		0x200   /* Remove directory instead of
-+                                           unlinking file.  */
-+#define AT_SYMLINK_FOLLOW	0x400   /* Follow symbolic links.  */
-+#endif
- 
- static int local_lstat(FsContext *fs_ctx, const char *path, struct stat *stbuf)
- {
-diff -Naur qemu-kvm-0.15.0.org/linux-user/syscall.c qemu-kvm-0.15.0/linux-user/syscall.c
---- qemu-kvm-0.15.0.org/linux-user/syscall.c	2011-08-09 14:40:29.000000000 +0200
-+++ qemu-kvm-0.15.0/linux-user/syscall.c	2011-08-14 12:43:43.190231600 +0200
-@@ -971,6 +971,16 @@
-     return result;
- }
- 
-+/* Copied from linux/include/asm/resource.h * because direct include fails */
-+
-+#ifndef RLIMIT_NICE
-+#define RLIMIT_NICE		13	/* max nice prio allowed to raise to
-+					   0-39 for nice level 19 .. -20 */
-+#endif
-+#ifndef RLIMIT_RTPRIO
-+#define RLIMIT_RTPRIO		14	/* maximum realtime priority */
-+#endif
-+
- static inline int target_to_host_resource(int code)
- {
-     switch (code) {
diff --git a/src/patches/squid-3.4-13228.patch b/src/patches/squid-3.4-13228.patch
new file mode 100644
index 0000000000..7f7d16f5bd
--- /dev/null
+++ b/src/patches/squid-3.4-13228.patch
@@ -0,0 +1,35 @@
+------------------------------------------------------------
+revno: 13228
+revision-id: squid3@treenet.co.nz-20150828132334-3r7v4kh1lrqprrqg
+parent: squid3@treenet.co.nz-20150801072237-5tzh2dczozz1e8sq
+fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=3696
+committer: Amos Jeffries <squid3@treenet.co.nz>
+branch nick: 3.4
+timestamp: Fri 2015-08-28 06:23:34 -0700
+message:
+  Bug 3696: crash when client delay pools are activated
+------------------------------------------------------------
+# Bazaar merge directive format 2 (Bazaar 0.90)
+# revision_id: squid3@treenet.co.nz-20150828132334-3r7v4kh1lrqprrqg
+# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
+# testament_sha1: d193928c4656282187f2a31bf66d43fd4c247177
+# timestamp: 2015-08-28 13:33:44 +0000
+# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
+# base_revision_id: squid3@treenet.co.nz-20150801072237-\
+#   5tzh2dczozz1e8sq
+# 
+# Begin patch
+=== modified file 'src/client_side.cc'
+--- src/client_side.cc	2014-06-21 04:24:37 +0000
++++ src/client_side.cc	2015-08-28 13:23:34 +0000
+@@ -3447,7 +3447,8 @@
+ 
+             /* pools require explicit 'allow' to assign a client into them */
+             if (pools[pool].access) {
+-                ch.accessList = pools[pool].access;
++                cbdataReferenceDone(ch.accessList);
++                ch.accessList = cbdataReference(pools[pool].access);
+                 allow_t answer = ch.fastCheck();
+                 if (answer == ACCESS_ALLOWED) {
+ 
+
diff --git a/src/patches/strongswan-5.2.2-issue-816-650a3ad.patch b/src/patches/strongswan-5.2.2-issue-816-650a3ad.patch
deleted file mode 100644
index 44b247e6d8..0000000000
--- a/src/patches/strongswan-5.2.2-issue-816-650a3ad.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-commit 650a3ad5151958b99a95836fb8b84b8aa18da1be
-Author: Tobias Brunner <tobias@strongswan.org>
-Date:   Wed Feb 25 08:09:11 2015 +0100
-
-    ike-sa-manager: Make sure the message ID of initial messages is 0
-    
-    It is mandated by the RFCs and it is expected by the task managers.
-    
-    Initial messages with invalid MID will be treated like regular messages,
-    so no IKE_SA will be created for them.  Instead, if the responder SPI is 0
-    no SA will be found and the message is rejected with ALERT_INVALID_IKE_SPI.
-    If an SPI is set and we do find an SA, then we either ignore the message
-    because the MID is unexpected, or because we don't allow initial messages
-    on established connections.
-    
-    There is one exception, though, if an attacker can slip in an IKE_SA_INIT
-    with both SPIs set before the client's IKE_AUTH is handled by the server,
-    it does get processed (see next commit).
-    
-    References #816.
-
-diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index d0cbd47..5e2b925 100644
---- a/src/libcharon/sa/ike_sa_manager.c
-+++ b/src/libcharon/sa/ike_sa_manager.c
-@@ -1184,7 +1184,8 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
- 
- 	DBG2(DBG_MGR, "checkout IKE_SA by message");
- 
--	if (id->get_responder_spi(id) == 0)
-+	if (id->get_responder_spi(id) == 0 &&
-+		message->get_message_id(message) == 0)
- 	{
- 		if (message->get_major_version(message) == IKEV2_MAJOR_VERSION)
- 		{
diff --git a/src/patches/strongswan-5.2.2-issue-816-dd0ebb.patch b/src/patches/strongswan-5.2.2-issue-816-dd0ebb.patch
deleted file mode 100644
index 4d76e7c240..0000000000
--- a/src/patches/strongswan-5.2.2-issue-816-dd0ebb.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-commit dd0ebb54837298c869389d36a0b42eefdb893dd6
-Author: Tobias Brunner <tobias@strongswan.org>
-Date:   Wed Feb 25 08:30:33 2015 +0100
-
-    ikev2: Only accept initial messages in specific states
-    
-    The previous code allowed an attacker to slip in an IKE_SA_INIT with
-    both SPIs and MID 1 set when an IKE_AUTH would be expected instead.
-    
-    References #816.
-
-diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c
-index be84e71..540d4dc 100644
---- a/src/libcharon/sa/ikev2/task_manager_v2.c
-+++ b/src/libcharon/sa/ikev2/task_manager_v2.c
-@@ -1304,17 +1304,16 @@ METHOD(task_manager_t, process_message, status_t,
- 	{
- 		if (mid == this->responding.mid)
- 		{
--			/* reject initial messages once established */
--			if (msg->get_exchange_type(msg) == IKE_SA_INIT ||
--				msg->get_exchange_type(msg) == IKE_AUTH)
-+			/* reject initial messages if not received in specific states */
-+			if ((msg->get_exchange_type(msg) == IKE_SA_INIT &&
-+				 this->ike_sa->get_state(this->ike_sa) != IKE_CREATED) ||
-+				(msg->get_exchange_type(msg) == IKE_AUTH &&
-+				 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING))
- 			{
--				if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
--					this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
--				{
--					DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
--						 exchange_type_names, msg->get_exchange_type(msg));
--					return FAILED;
--				}
-+				DBG1(DBG_IKE, "ignoring %N in IKE_SA state %N",
-+					 exchange_type_names, msg->get_exchange_type(msg),
-+					 ike_sa_state_names, this->ike_sa->get_state(this->ike_sa));
-+				return FAILED;
- 			}
- 			if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
- 			{	/* with MOBIKE, we do no implicit updates */
diff --git a/src/patches/strongswan-5.2.2-issue-816-eb25190.patch b/src/patches/strongswan-5.2.2-issue-816-eb25190.patch
deleted file mode 100644
index 8dcb32b0b4..0000000000
--- a/src/patches/strongswan-5.2.2-issue-816-eb25190.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-commit eb251906298b529fa53b8a99746a9a7a9f318dd5
-Author: Tobias Brunner <tobias@strongswan.org>
-Date:   Wed Feb 25 08:18:58 2015 +0100
-
-    ikev2: Don't destroy the SA if an IKE_SA_INIT with unexpected MID is received
-    
-    This reverts 8f727d800751 ("Clean up IKE_SA state if IKE_SA_INIT request
-    does not have message ID 0") because it allowed to close any IKE_SA by
-    sending an IKE_SA_INIT with an unexpected MID and both SPIs set to those
-    of that SA.
-    
-    The next commit will prevent SAs from getting created for IKE_SA_INIT messages
-    with invalid MID.
-    
-    Fixes #816.
-
-diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c
-index 48266aa..be84e71 100644
---- a/src/libcharon/sa/ikev2/task_manager_v2.c
-+++ b/src/libcharon/sa/ikev2/task_manager_v2.c
-@@ -1355,10 +1355,6 @@ METHOD(task_manager_t, process_message, status_t,
- 		{
- 			DBG1(DBG_IKE, "received message ID %d, expected %d. Ignored",
- 				 mid, this->responding.mid);
--			if (msg->get_exchange_type(msg) == IKE_SA_INIT)
--			{	/* clean up IKE_SA state if IKE_SA_INIT has invalid msg ID */
--				return DESTROY_ME;
--			}
- 		}
- 	}
- 	else
diff --git a/src/patches/strongswan-5.2.2-issue-819-cd2c30a.patch b/src/patches/strongswan-5.2.2-issue-819-cd2c30a.patch
deleted file mode 100644
index 0c54812fe3..0000000000
--- a/src/patches/strongswan-5.2.2-issue-819-cd2c30a.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From cd2c30a56ec9bdab8b3923851509f27a4fd6f537 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 10 Feb 2015 19:03:44 +0100
-Subject: [PATCH] ikev1: Set protocol ID and SPIs in INITIAL-CONTACT
- notification payloads
-
-The payload we sent before is not compliant with RFC 2407 and thus some
-peers might abort negotiation (e.g. with an INVALID-PROTOCOL-ID error).
-
- #819
----
- src/libcharon/sa/ikev1/tasks/main_mode.c |   15 +++++++++++++--
- 1 file changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
-index 5065e70..3ea4a2a 100644
---- a/src/libcharon/sa/ikev1/tasks/main_mode.c
-+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
-@@ -213,6 +213,10 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
- {
- 	identification_t *idr;
- 	host_t *host;
-+	notify_payload_t *notify;
-+	ike_sa_id_t *ike_sa_id;
-+	u_int64_t spi_i, spi_r;
-+	chunk_t spi;
- 
- 	idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
- 	if (idr && !idr->contains_wildcards(idr))
-@@ -224,8 +228,15 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
- 			if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,
- 										idi, idr, host->get_family(host)))
- 			{
--				message->add_notify(message, FALSE, INITIAL_CONTACT_IKEV1,
--									chunk_empty);
-+				notify = notify_payload_create_from_protocol_and_type(
-+								PLV1_NOTIFY, PROTO_IKE, INITIAL_CONTACT_IKEV1);
-+				ike_sa_id = this->ike_sa->get_id(this->ike_sa);
-+				spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
-+				spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
-+				spi = chunk_cata("cc", chunk_from_thing(spi_i),
-+								 chunk_from_thing(spi_r));
-+				notify->set_spi_data(notify, spi);
-+				message->add_payload(message, (payload_t*)notify);
- 			}
- 		}
- 	}
--- 
-1.7.9.5
-
diff --git a/src/patches/strongswan-5.0.2_ipfire.patch b/src/patches/strongswan-ipfire.patch
similarity index 78%
rename from src/patches/strongswan-5.0.2_ipfire.patch
rename to src/patches/strongswan-ipfire.patch
index 71eb24e481..7071983b8c 100644
--- a/src/patches/strongswan-5.0.2_ipfire.patch
+++ b/src/patches/strongswan-ipfire.patch
@@ -1,8 +1,8 @@
---- a/src/_updown/_updown.in
-+++ b/src/_updown/_updown.in
-@@ -178,6 +178,29 @@
- 	;;
- esac
+--- strongswan-5.3.0/src/_updown/_updown.in.old	2015-03-17 18:17:43.000000000 +0000
++++ strongswan-5.3.0/src/_updown/_updown.in	2015-03-30 22:48:27.084030719 +0000
+@@ -122,6 +122,29 @@
+ #              address family.
+ #
  
 +function ip_encode() {
 +	local IFS=.
@@ -27,26 +27,26 @@
 +	[ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) ))
 +}
 +
- # utility functions for route manipulation
- # Meddling with this stuff should not be necessary and requires great care.
- uproute() {
-@@ -407,12 +430,12 @@
+ # define a minimum PATH environment in case it is not set
+ PATH="/sbin:/bin:/usr/sbin:/usr/bin:@sbindir@"
+ export PATH
+@@ -232,12 +255,12 @@
  	# connection to me, with (left/right)firewall=yes, coming up
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
 -	iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 -	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
 +	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
  	#
  	# allow IPIP traffic because of the implicit SA created by the kernel if
  	# IPComp is used (for small inbound packets that are not compressed)
-@@ -428,10 +451,10 @@
+@@ -253,10 +276,10 @@
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO \
@@ -59,23 +59,23 @@
  	  fi
  	fi
  	;;
-@@ -439,12 +462,12 @@
+@@ -264,12 +287,12 @@
  	# connection to me, with (left/right)firewall=yes, going down
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
 -	iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 -	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
 +	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
  	#
  	# IPIP exception teardown
  	if [ -n "$PLUTO_IPCOMP" ]
-@@ -459,10 +482,10 @@
+@@ -284,10 +307,10 @@
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO -- \
@@ -88,17 +88,17 @@
  	  fi
  	fi
  	;;
-@@ -472,24 +495,24 @@
+@@ -297,24 +320,24 @@
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
  	then
 -	  iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables --wait -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
 -	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
 -	  iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 +	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
-+	  iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
 -	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 +	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN
@@ -109,28 +109,28 @@
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then
 -	  iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
 -	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	  iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 +	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN
-+	  iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
 -	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
 +	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
  	fi
  	#
  	# allow IPIP traffic because of the implicit SA created by the kernel if
-@@ -497,7 +520,7 @@
+@@ -322,7 +345,7 @@
  	# INPUT is correct here even for forwarded traffic.
  	if [ -n "$PLUTO_IPCOMP" ]
  	then
 -	  iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p 4 \
++	  iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p 4 \
  	      -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
  	fi
  	#
-@@ -507,12 +530,51 @@
+@@ -332,12 +355,51 @@
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO \
@@ -145,13 +145,13 @@
 +
 +	#
 +	# Open Firewall for IPinIP + AH + ESP Traffic
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IP \
++	  iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IP \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
++	  iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
++	  iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
 +	if [ $VPN_LOGGING ]
@@ -171,7 +171,7 @@
 +	done
 +
 +	if [ -n "${src}" ]; then
-+		iptables -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
++		iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
 +		logger -t $TAG -p $FAC_PRIO \
 +			"snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
 +	else
@@ -184,18 +184,18 @@
  	;;
  down-client:iptables)
  	# connection to client subnet, with (left/right)firewall=yes, going down
-@@ -520,34 +582,34 @@
+@@ -345,34 +407,34 @@
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
  	then
 -	  iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables --wait -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
 -	         $IPSEC_POLICY_OUT -j ACCEPT
 -	  iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 +	         $IPSEC_POLICY_OUT -j MARK --set-mark 50
-+	  iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
 -	         $IPSEC_POLICY_IN -j ACCEPT
@@ -207,13 +207,13 @@
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then
 -	  iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
 -	         $IPSEC_POLICY_IN -j ACCEPT
 -	  iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 +	         $IPSEC_POLICY_IN -j RETURN
-+	  iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
 -	         $IPSEC_POLICY_OUT -j ACCEPT
@@ -224,11 +224,11 @@
  	if [ -n "$PLUTO_IPCOMP" ]
  	then
 -	  iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p 4 \
++	  iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p 4 \
  	      -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
  	fi
  	#
-@@ -557,12 +619,51 @@
+@@ -382,12 +444,51 @@
  	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
  	  then
  	    logger -t $TAG -p $FAC_PRIO -- \
@@ -243,13 +243,13 @@
 +
 +	#
 +	# Close Firewall for IPinIP + AH + ESP Traffic
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p IP \
++	  iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p IP \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
++	  iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
++	  iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
 +	      -s $PLUTO_PEER $S_PEER_PORT \
 +	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
 +	if [ $VPN_LOGGING ]
@@ -269,7 +269,7 @@
 +	done
 +
 +	if [ -n "${src}" ]; then
-+		iptables -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
++		iptables --wait -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
 +		logger -t $TAG -p $FAC_PRIO \
 +			"snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
 +	else
@@ -282,83 +282,83 @@
  	;;
  #
  # IPv6
-@@ -597,10 +698,10 @@
+@@ -412,10 +513,10 @@
  	# connection to me, with (left/right)firewall=yes, coming up
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
 -	ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	ip6tables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	ip6tables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
  	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
  	#
-@@ -621,10 +722,10 @@
+@@ -436,10 +537,10 @@
  	# connection to me, with (left/right)firewall=yes, going down
  	# This is used only by the default updown script, not by your custom
  	# ones, so do not mess with it; see CAUTION comment up at top.
 -	ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	ip6tables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	ip6tables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
  	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
  	#
-@@ -647,10 +748,10 @@
+@@ -462,10 +563,10 @@
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
  	then
 -	  ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables --wait -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
 -	  ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
  	fi
-@@ -659,10 +760,10 @@
+@@ -474,10 +575,10 @@
  	# or sometimes host access via the internal IP is needed
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then
 -	  ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -	  ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
  	fi
-@@ -686,11 +787,11 @@
+@@ -501,11 +602,11 @@
  	# ones, so do not mess with it; see CAUTION comment up at top.
  	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
  	then
 -	  ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables --wait -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
  	         $IPSEC_POLICY_OUT -j ACCEPT
 -	  ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
  	         $IPSEC_POLICY_IN -j ACCEPT
-@@ -700,11 +801,11 @@
+@@ -515,11 +616,11 @@
  	# or sometimes host access via the internal IP is needed
  	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
  	then
 -	  ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
  	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
  	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
  	         $IPSEC_POLICY_IN -j ACCEPT
 -	  ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
  	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
  	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
  	         $IPSEC_POLICY_OUT -j ACCEPT
diff --git a/src/scripts/ovpn-ccd-convert b/src/scripts/ovpn-ccd-convert
index 7aa8cf13ea..f496706562 100644
--- a/src/scripts/ovpn-ccd-convert
+++ b/src/scripts/ovpn-ccd-convert
@@ -42,7 +42,7 @@ foreach my $key (keys %ovpnconfig){
 	}else{
 		print "Client $ovpnconfig{$key}[2] NOT converted!\n";
 	}
-	$ovpnconfig{$key}[32] = 'dynamic';
+	$ovpnconfig{$key}[32] = 'dynamic' if ($ovpnconfig{$key}[32] eq '');
 }
 &General::writehasharray("/var/ipfire/ovpn/ovpnconfig", \%ovpnconfig);
 if ($running eq 'on')
diff --git a/src/scripts/ovpn-collectd-convert b/src/scripts/ovpn-collectd-convert
new file mode 100644
index 0000000000..59d67b9b0a
--- /dev/null
+++ b/src/scripts/ovpn-collectd-convert
@@ -0,0 +1,26 @@
+#!/usr/bin/perl
+# Converter script for adding existing OpenVPN N2N connections to collectd
+# Used for core update 89
+
+my %ovpnconfig=();
+
+require '/var/ipfire/general-functions.pl';
+
+open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
+print COLLECTDVPN "Loadplugin openvpn\n";
+print COLLECTDVPN "\n";
+print COLLECTDVPN "<Plugin openvpn>\n";
+print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
+
+&General::readhasharray("/var/ipfire/ovpn/ovpnconfig", \%ovpnconfig);
+foreach my $key (keys %ovpnconfig) {
+	if ($ovpnconfig{$key}[0] eq 'on' && $ovpnconfig{$key}[3] eq 'net') {
+		print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ovpnconfig{$key}[1]-n2n\"\n";
+	}
+}
+
+print COLLECTDVPN "</Plugin>\n";
+close(COLLECTDVPN);
+
+# Reload collectd afterwards
+system("/usr/local/bin/collectdctrl restart &>/dev/null");
diff --git a/src/scripts/xt_geoip_build b/src/scripts/xt_geoip_build
new file mode 100644
index 0000000000..202156f130
--- /dev/null
+++ b/src/scripts/xt_geoip_build
@@ -0,0 +1,89 @@
+#!/usr/bin/perl
+#
+#	Converter for MaxMind CSV database to binary, for xt_geoip
+#	Copyright Â© Jan Engelhardt, 2008-2011
+#
+use Getopt::Long;
+use IO::Handle;
+use Text::CSV_XS; # or trade for Text::CSV
+use strict;
+
+my $csv = Text::CSV_XS->new({
+	allow_whitespace => 1,
+	binary => 1,
+	eol => $/,
+}); # or Text::CSV
+my $target_dir = ".";
+
+&Getopt::Long::Configure(qw(bundling));
+&GetOptions(
+	"D=s" => \$target_dir,
+);
+
+if (!-d $target_dir) {
+	print STDERR "Target directory $target_dir does not exist.\n";
+	exit 1;
+}
+
+my $dir = "$target_dir/LE";
+if (!-e $dir && !mkdir($dir)) {
+	print STDERR "Could not mkdir $dir: $!\n";
+	exit 1;
+}
+
+&dump(&collect());
+
+sub collect
+{
+	my %country;
+
+	while (my $row = $csv->getline(*ARGV)) {
+		if (!defined($country{$row->[4]})) {
+			$country{$row->[4]} = {
+				name => $row->[5],
+				pool_v4 => [],
+				pool_v6 => [],
+			};
+		}
+		my $c = $country{$row->[4]};
+
+		push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]);
+
+		if ($. % 4096 == 0) {
+			print STDERR "\r\e[2K$. entries";
+		}
+	}
+
+	print STDERR "\r\e[2K$. entries total\n";
+	return \%country;
+}
+
+sub dump
+{
+	my $country = shift @_;
+
+	foreach my $iso_code (sort keys %$country) {
+		&dump_one($iso_code, $country->{$iso_code});
+	}
+}
+
+sub dump_one
+{
+	my($iso_code, $country) = @_;
+	my($file, $fh_le, $fh_be);
+
+	printf "%5u IPv4 ranges for %s %s\n",
+		scalar(@{$country->{pool_v4}}),
+		$iso_code, $country->{name};
+
+	$file = "$target_dir/LE/".uc($iso_code).".iv4";
+	if (!open($fh_le, "> $file")) {
+		print STDERR "Error opening $file: $!\n";
+		exit 1;
+	}
+	foreach my $range (@{$country->{pool_v4}}) {
+		print $fh_le pack("VV", $range->[0], $range->[1]);
+		#print $fh_be pack("NN", $range->[0], $range->[1]);
+	}
+	close $fh_le;
+}
diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update
new file mode 100644
index 0000000000..0ee774470a
--- /dev/null
+++ b/src/scripts/xt_geoip_update
@@ -0,0 +1,137 @@
+#!/bin/bash
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2014 IPFire Development Team <info@ipfire.org>                #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+TMP_PATH=$(mktemp -d)
+TMP_FILE=$(mktemp -p $TMP_PATH)
+
+SCRIPT_PATH=/usr/local/bin
+DEST_PATH=/usr/share/xt_geoip
+
+DL_URL=http://geolite.maxmind.com/download/geoip/database
+DL_FILE=GeoIPCountryCSV.zip
+
+CSV_FILE=GeoIPCountryWhois.csv
+
+ARCH=LE
+
+eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings)
+
+function download() {
+	echo "Downloading latest GeoIP ruleset..."
+
+	# Create temporary directory.
+	mkdir -pv $TMP_PATH
+
+	# Proxy settings.
+	# Check if a proxy should be used.
+	if [[ $UPSTREAM_PROXY ]]; then
+		PROXYSETTINGS="-e http_proxy=http://"
+
+		# Check if authentication against the proxy is configured.
+		if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then
+			PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@"
+		fi
+
+		# Add proxy server.
+		PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY"
+	fi
+
+	# Get the latest GeoIP database from server.
+	wget $DL_URL/$DL_FILE $PROXYSETTINGS -O $TMP_FILE
+
+	# Extract files.
+	unzip $TMP_FILE -d $TMP_PATH
+
+	return 0
+}
+
+function build() {
+	echo "Convert database..."
+
+	# Check if the csv file exists.
+	if [ ! -e $TMP_PATH/$CSV_FILE ]; then
+		echo "$TMP_PATH/$CSV_FILE not found. Exiting."
+		return 1
+	fi
+
+	# Run script to convert the CSV file into several xtables
+	# compatible binary files.
+	if ! $SCRIPT_PATH/xt_geoip_build $TMP_PATH/$CSV_FILE -D $TMP_PATH; then
+		echo "Could not convert ruleset. Aborting." >&2
+		return 1
+	fi
+
+	return 0
+}
+
+function install() {
+	echo "Install databases..."
+
+	# Check if our destination exist.
+	if [ ! -e "$DEST_PATH" ]; then
+		mkdir -p $DEST_PATH &>/dev/null
+	fi
+
+	# Install databases.
+	if ! cp -af $TMP_PATH/$ARCH $DEST_PATH &>/dev/null; then
+		echo "Could not copy files. Aborting." >&2
+		return 1
+	fi
+
+	return 0
+}
+
+function cleanup() {
+	echo "Cleaning up temporary files..."
+	if ! rm -rf $TMP_PATH &>/dev/null; then
+		echo "Could not remove files. Aborting." >&2
+		return 1
+	fi
+
+	return 0
+}
+
+function main() {
+	# Download ruleset.
+	download || exit $?
+
+	# Convert the ruleset.
+	if ! build; then
+		# Do cleanup.
+		cleanup || exit $?
+		exit 1
+	fi
+
+	# Install the converted ruleset.
+	if ! install; then
+		# Do cleanup.
+		cleanup || exit $?
+		exit 1
+	fi
+
+	# Finaly remove temporary files.
+	cleanup || exit $?
+
+	return 0
+}
+
+# Run the main function.
+main
diff --git a/src/setup/netstuff.c b/src/setup/netstuff.c
index a656e9f910..f5b3849893 100644
--- a/src/setup/netstuff.c
+++ b/src/setup/netstuff.c
@@ -527,27 +527,6 @@ int rename_nics(void) {
 				}
 }
 
-int create_udev(void)
-{
-	#define UDEV_NET_CONF "/etc/udev/rules.d/30-persistent-network.rules"
-	FILE *fp;
-	int i;
-
-	if ( (fp = fopen(UDEV_NET_CONF, "w")) == NULL ) {
-		fprintf(stderr,"Couldn't open" UDEV_NET_CONF);
-		return 1;
-	}
-
-	for (i = 0 ; i < 4 ; i++)
-	{
-		if (strcmp(knics[i].macaddr, "")) {
-			fprintf(fp,"\n# %s\nACTION==\"add\", SUBSYSTEM==\"net\", ATTR{type}==\"1\", ATTR{address}==\"%s\", NAME=\"%s0\"\n", knics[i].description, knics[i].macaddr, lcolourcard[i]);
-		}
-	}
-	fclose(fp);
-	return 0;
-}
-
 int write_configs_netudev(int card , int colour)
 {	
 	char commandstring[STRING_SIZE];
diff --git a/src/setup/networking.c b/src/setup/networking.c
index df4f00f0b1..b840ec127a 100644
--- a/src/setup/networking.c
+++ b/src/setup/networking.c
@@ -117,7 +117,6 @@ int handlenetworking(void)
 	} else {
 		rename_nics();
 	}
-	create_udev();
 	return 1;
 }
 
@@ -214,7 +213,7 @@ int oktoleave(void)
 		strcpy(temp, ""); findkey(kv, "DNS1", temp);
 		if (!(strlen(temp)))
 		{
-			errorbox(_("Misssing DNS."));
+                       errorbox(_("Missing DNS."));
 			freekeyvalues(kv);
 			return 0;
 		}
diff --git a/src/setup/po/pt_BR.po b/src/setup/po/pt_BR.po
index b1ea09c51a..eb408edc55 100644
--- a/src/setup/po/pt_BR.po
+++ b/src/setup/po/pt_BR.po
@@ -5,14 +5,15 @@
 # Translators:
 # douglasdiasn <douglasdiasn@gmail.com>, 2015
 # Evertton de Lima <e.everttonlima@gmail.com>, 2015
+# MoisÃ©s Bites Borges de Castro <moisesbites@gmail.com>, 2015
 # Rafael Tavares <rafael@ibinetwork.com.br>, 2015
 msgid ""
 msgstr ""
 "Project-Id-Version: IPFire Project\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2014-08-21 15:12+0000\n"
-"PO-Revision-Date: 2015-02-16 23:15+0000\n"
-"Last-Translator: Evertton de Lima <e.everttonlima@gmail.com>\n"
+"PO-Revision-Date: 2015-03-24 21:31+0000\n"
+"Last-Translator: MoisÃ©s Bites Borges de Castro <moisesbites@gmail.com>\n"
 "Language-Team: Portuguese (Brazil) (http://www.transifex.com/projects/p/ipfire/language/pt_BR/)\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -22,7 +23,7 @@ msgstr ""
 
 #: dhcp.c:50
 msgid "Start address:"
-msgstr "EndereÃ§o de Inicial:"
+msgstr "EndereÃ§o inicial:"
 
 #: dhcp.c:51
 msgid "End address:"
@@ -38,15 +39,15 @@ msgstr "DNS SecundÃ¡rio:"
 
 #: dhcp.c:54
 msgid "Default lease (mins):"
-msgstr "Tempo padrÃ£o (mins):"
+msgstr "ConcessÃ£o padrÃ£o (min):"
 
 #: dhcp.c:55
 msgid "Max lease (mins):"
-msgstr "Tempo mÃ¡ximo (mins)"
+msgstr "ConcessÃ£o mÃ¡xima (min)"
 
 #: dhcp.c:56
 msgid "Domain name suffix:"
-msgstr ""
+msgstr "Sufixo do nome de DomÃnio:"
 
 #: dhcp.c:86 dhcp.c:93 dhcp.c:101 domainname.c:34 hostname.c:37 keymap.c:70
 #: misc.c:40 misc.c:52 netstuff.c:377 netstuff.c:566 netstuff.c:704
@@ -58,7 +59,7 @@ msgstr "NÃ£o foi possÃvel abrir o arquivo de configuraÃ§Ãµes"
 
 #: dhcp.c:111
 msgid "DHCP server configuration"
-msgstr "Configurar servidor DHCP"
+msgstr "ConfiguraÃ§Ã£o do servidor DHCP"
 
 #: dhcp.c:116
 msgid "Configure the DHCP server by entering the settings information."
@@ -87,11 +88,11 @@ msgstr "Cancelar"
 msgid ""
 "The following fields are invalid:\n"
 "\n"
-msgstr "Os campos a seguir sÃ£o invÃ¡lidos: \n"
+msgstr "Os campos a seguir sÃ£o invÃ¡lidos: \n\n"
 
 #: dhcp.c:159
 msgid "Start address"
-msgstr "EndereÃ§o de Inicial"
+msgstr "EndereÃ§o inicial"
 
 #: dhcp.c:165
 msgid "End address"
@@ -107,19 +108,19 @@ msgstr "DNS SecundÃ¡rio"
 
 #: dhcp.c:189
 msgid "Default lease time"
-msgstr "Tempo padrÃ£o"
+msgstr "Tempo de concessÃ£o padrÃ£o"
 
 #: dhcp.c:195
 msgid "Max. lease time"
-msgstr "Tempo mÃ¡ximo padrÃ£o"
+msgstr "Tempo de concessÃ£o mÃ¡ximo"
 
 #: domainname.c:42 main.c:70
 msgid "Domain name"
-msgstr "DomÃnio "
+msgstr "Nome de DomÃnio "
 
 #: domainname.c:42
 msgid "Enter Domain name"
-msgstr "Entre com o nome do DomÃnio"
+msgstr "Digite o nome do DomÃnio"
 
 #: domainname.c:48
 msgid "Domain name cannot be empty."
@@ -135,11 +136,11 @@ msgstr "O nome de DomÃnio pode conter somente letras, nÃºmeros, hÃfens e ponto
 
 #: hostname.c:46 main.c:69
 msgid "Hostname"
-msgstr "Hostname"
+msgstr "Nome do Host"
 
 #: hostname.c:46
 msgid "Enter the machine's hostname."
-msgstr "Entre com o nome do host."
+msgstr "Entre com o nome de Host da mÃ¡quina."
 
 #: hostname.c:53
 msgid "Hostname cannot be empty."
@@ -260,7 +261,7 @@ msgstr "EstÃ¡tico "
 
 #: netstuff.c:104
 msgid "DHCP"
-msgstr "AutomÃ¡tico "
+msgstr "DHCP"
 
 #: netstuff.c:105
 msgid "PPP DIALUP (PPPoE, modem, ATM ...)"
@@ -300,7 +301,7 @@ msgstr "Nome do Host DHCP:"
 
 #: netstuff.c:396 netstuff.c:709
 msgid "Unset"
-msgstr ""
+msgstr "Desativado"
 
 #: netstuff.c:669
 #, c-format
@@ -342,11 +343,11 @@ msgstr "VocÃª realmente quer remover a interface %s associada?"
 
 #: netstuff.c:755
 msgid "Select network driver"
-msgstr "Selecionar driver de rede"
+msgstr "Selecionar o driver de rede"
 
 #: netstuff.c:755
 msgid "Set additional module parameters"
-msgstr ""
+msgstr "Especifique os parÃ¢metros adicionais"
 
 #: netstuff.c:762
 msgid "Loading module..."
@@ -354,11 +355,11 @@ msgstr "Carregando modulo..."
 
 #: netstuff.c:777
 msgid "Unable to load driver module."
-msgstr ""
+msgstr "NÃ£o foi possÃvel carregar o driver."
 
 #: netstuff.c:780
 msgid "Module name cannot be blank."
-msgstr ""
+msgstr "O nome do mÃ³dulo nÃ£o pode ficar vazio."
 
 #: networking.c:110
 msgid "Stopping network..."
@@ -459,7 +460,7 @@ msgid ""
 "list those interfaces which have ethernet attached. If you change this "
 "setting, a network restart will be required, and you will have to "
 "reconfigure the network driver assignments."
-msgstr ""
+msgstr "Selecione a configuraÃ§Ã£o de rede para %s. Os tipos de configuraÃ§Ã£o seguintes lista as interfaces cabo Ethernet. Se vocÃª alterar estas configuraÃ§Ãµes, uma reinicializaÃ§Ã£o de rede serÃ¡ exigida, e vocÃª terÃ¡ que reconfigurar os drivers de rede especificados."
 
 #: networking.c:307
 #, c-format
@@ -467,13 +468,13 @@ msgid ""
 "Not enough netcards for your choice.\n"
 "\n"
 "Needed: %d - Available: %d\n"
-msgstr ""
+msgstr "NÃ£o hÃ¡ dispositivos de rede suficientes para sua escolha.\n\nNecessÃ¡rias: %d - DisponÃveis: %d\n"
 
 #: networking.c:359
 msgid ""
 "Configure network drivers, and which interface each card is assigned to. The current configuration is as follows:\n"
 "\n"
-msgstr ""
+msgstr "Configure os drivers de rede, e a placa de rede que a interface estÃ¡ relacionada. A configuraÃ§Ã£o atual Ã© a seguinte:\n\n"
 
 #: networking.c:408
 msgid "Do you wish to change these settings?"
@@ -487,7 +488,7 @@ msgstr "Reiniciando rede non-local..."
 msgid ""
 "Please choose the interface you wish to change.\n"
 "\n"
-msgstr ""
+msgstr "Por favor, escolha a interface de rede que quer alterar.\n\n"
 
 #: networking.c:519
 msgid "Assigned Cards"
@@ -504,11 +505,11 @@ msgid ""
 "connection to the %s machine will be broken, and you will have to reconnect "
 "on the new IP. This is a risky operation, and should only be attempted if "
 "you have physical access to the machine, should something go wrong."
-msgstr ""
+msgstr "Se vocÃª alterar o endereÃ§o IP, e vocÃª estiver logado remotamente, sua conexÃ£o com a mÃ¡quina %s cairÃ¡, e vocÃª terÃ¡ que reconectar atravÃ©s do novo IP. Esta Ã© uma operaÃ§Ã£o arriscada, e somente deve ser feita se vocÃª tem acesso fÃsico Ã  mÃ¡quina, caso algo errado aconteÃ§a."
 
 #: networking.c:641
 msgid "Select the interface you wish to reconfigure."
-msgstr ""
+msgstr "Selecione a interface que deseja reconfigurar."
 
 #: networking.c:729
 msgid "Default gateway:"
@@ -518,7 +519,7 @@ msgstr "Gateway padrÃ£o:"
 msgid ""
 "Enter the DNS and gateway information. These settings are used only with "
 "Static IP (and DHCP if DNS set) on the RED interface."
-msgstr ""
+msgstr "Digite as informaÃ§Ãµes de DNS e roteador. Estas configuraÃ§Ãµes sÃ£o usada somente com IP estÃ¡tico (e DHCP se o DNS estÃ¡ habilitado) para a inerface VERMELHA."
 
 #: networking.c:773
 msgid "Default gateway"
@@ -531,7 +532,7 @@ msgstr "DNS secundÃ¡rio especificado sem um DNS primÃ¡rio"
 #: passwords.c:33
 msgid ""
 "Enter the 'root' user password. Login as this user for commandline access."
-msgstr ""
+msgstr "Digite a senha do usuÃ¡rio 'root'. Autentique com este usuÃ¡rio para acesso Ã  linha de comando."
 
 #: passwords.c:38 passwords.c:61
 msgid "Setting password"
@@ -550,17 +551,17 @@ msgstr "Problema ao configurar senha 'root'"
 msgid ""
 "Enter %s 'admin' user password. This is the user to use for logging into the"
 " %s web administration pages."
-msgstr ""
+msgstr "Digite a senha do usuÃ¡rio 'admin' do %s. Este Ã© o usuÃ¡rio para autenticaÃ§Ã£o na interface web de administraÃ§Ã£o do %s."
 
 #: passwords.c:60
 #, c-format
 msgid "Setting %s 'admin' user password..."
-msgstr ""
+msgstr "Especificando a senha do usuÃ¡rio 'admin' do %s..."
 
 #: passwords.c:62
 #, c-format
 msgid "Problem setting %s 'admin' user password."
-msgstr ""
+msgstr "Tem um problema ao gravar senha do usuÃ¡rio 'admin' do %s."
 
 #: passwords.c:76
 msgid "Password:"
diff --git a/src/setup/po/tr.po b/src/setup/po/tr.po
index 4e684182d1..9e52d072c2 100644
--- a/src/setup/po/tr.po
+++ b/src/setup/po/tr.po
@@ -10,7 +10,7 @@ msgstr ""
 "Project-Id-Version: IPFire Project\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2014-08-21 15:12+0000\n"
-"PO-Revision-Date: 2015-02-28 22:59+0000\n"
+"PO-Revision-Date: 2015-03-20 15:05+0000\n"
 "Last-Translator: Ersan YILDIRIM <ersan73@gmail.com>\n"
 "Language-Team: Turkish (http://www.transifex.com/projects/p/ipfire/language/tr/)\n"
 "MIME-Version: 1.0\n"
@@ -503,7 +503,7 @@ msgid ""
 "connection to the %s machine will be broken, and you will have to reconnect "
 "on the new IP. This is a risky operation, and should only be attempted if "
 "you have physical access to the machine, should something go wrong."
-msgstr "EÄer bu IP adresini deÄiÅtirirseniz, ve uzaktan oturum aÃ§mÄ±ÅsanÄ±z, %s makinesine olan baÄlantÄ±nÄ±z kopacaktÄ±r ve yeni IP adresine tekrar baÄlanmanÄ±z gerekecektir. Bu riskli bir iÅlemdir ve bir Åeylerin ters gitmesi durumunda makineye fiziksel eriÅiminiz varsa kullanmalÄ±sÄ±nÄ±z."
+msgstr "Uzaktan oturum aÃ§tÄ±ÄÄ±nÄ±zda bu IP adresini deÄiÅtirirseniz %s makinesine olan baÄlantÄ±nÄ±z kopacaktÄ±r ve yeni IP adresine tekrar baÄlanmanÄ±z gerekecektir. Bu riskli bir iÅlemdir ve bir Åeylerin ters gitmesi durumunda makineye fiziksel eriÅiminiz varsa kullanmalÄ±sÄ±nÄ±z."
 
 #: networking.c:641
 msgid "Select the interface you wish to reconfigure."
diff --git a/src/setup/setup.h b/src/setup/setup.h
index 388d2edcfe..14fd64634b 100644
--- a/src/setup/setup.h
+++ b/src/setup/setup.h
@@ -79,7 +79,6 @@ void networkdialogcallbacktype(newtComponent cm, void *data);
 int interfacecheck(struct keyvalue *kv, char *colour);
 int rename_nics(void);
 int init_knics(void);
-int create_udev(void);
 int scan_network_cards(void);
 int nicmenu(int colour);
 int clear_card_entry(int cards);
diff --git a/src/squid-accounting/accounting.cgi b/src/squid-accounting/accounting.cgi
index eabb0c2956..0fe5ff6b34 100755
--- a/src/squid-accounting/accounting.cgi
+++ b/src/squid-accounting/accounting.cgi
@@ -56,12 +56,17 @@ my $count=0;
 my $col;
 my $proxlog=$Lang::tr{'stopped'};
 my $proxsrv=$Lang::tr{'stopped'};
+my $mailfile="${General::swroot}/dma/mail.conf";
 
 &Header::getcgihash(\%cgiparams);
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
 &General::readhash("$settingsfile", \%settings) if(-f $settingsfile);
 
+if ( -f $mailfile){
+	&General::readhash($mailfile, \%mail);
+}
+
 #Find out which lang is set (used later to set decimal separator correctly)
 my $uplang=uc($mainsettings{'LANGUAGE'});
 setlocale LC_NUMERIC,"$mainsettings{'LANGUAGE'}_$uplang";
@@ -136,11 +141,6 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite
 	if ($cgiparams{'USEMAIL'} eq 'on'){
 		$errormessage=&checkmailsettings;
 	}elsif($cgiparams{'USEMAIL'} ne 'on'){
-		$cgiparams{'txt_mailserver'}='';
-		$cgiparams{'txt_mailport'}='';
-		$cgiparams{'txt_mailuser'}='';
-		$cgiparams{'txt_mailpass'}='';
-		$cgiparams{'mail_tls'}='';
 		$cgiparams{'txt_mailsender'}='';
 		$cgiparams{'txt_mailsubject'}='';
 		$mailtxt='';
@@ -155,11 +155,6 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite
 		$settings{'CURRENCY'}	= $cgiparams{'txt_currency'};
 		$settings{'SKIPURLS'}	= $skipurls;
 		$settings{'USEMAIL'}	= $cgiparams{'USEMAIL'};
-		$settings{'MAILSRV'}	= $cgiparams{'txt_mailserver'};
-		$settings{'MAILPORT'}	= $cgiparams{'txt_mailport'};
-		$settings{'MAILUSER'}	= $cgiparams{'txt_mailuser'};
-		$settings{'MAILPASS'}	= $cgiparams{'txt_mailpass'};
-		$settings{'TLS'}		= $cgiparams{'mail_tls'};
 		$settings{'MAILSENDER'}	= $cgiparams{'txt_mailsender'};
 		$settings{'MAILSUB'}	= $cgiparams{'txt_mailsubject'};
 		$settings{'MAILTXT'}	= $mailtxt;
@@ -568,10 +563,6 @@ sub configsite{
 	#If update set fieldvalues new
 	if($cgiparams{'update'} eq 'on'){
 		$settings{'USEMAIL'} = 'on';
-		$settings{'MAILSRV'} = $cgiparams{'txt_mailserver'};
-		$settings{'MAILPORT'} = $cgiparams{'txt_mailport'};
-		$settings{'MAILUSER'} = $cgiparams{'txt_mailuser'};
-		$settings{'MAILPASS'} = $cgiparams{'txt_mailpass'};
 		$settings{'MAILSUB'} = $cgiparams{'txt_mailsubject'};
 		$settings{'MAILTXT'} = $cgiparams{'txt_mailtxt'};
 	}
@@ -580,14 +571,13 @@ sub configsite{
 	$checked{'logging'}{$settings{'LOG'}}					= 'CHECKED';
 	$checked{'multiuser'}{$settings{'MULTIUSER'}}			= 'CHECKED';
 	$checked{'usemail'}{$settings{'USEMAIL'}}				= 'CHECKED';
-	$checked{'mail_tls'}{$settings{'TLS'}}					= 'CHECKED';
-	
+
 	#Open site
 	&Header::openpage($Lang::tr{'acct settings'}, 1, '');
 	&Header::openbigbox('100%', 'center');
 	&error;
 	&Header::openbox('100%', 'left', $Lang::tr{'acct config'});
-	
+
 	#### JAVA SCRIPT ####
 	print<<END;
 <script>
@@ -631,57 +621,45 @@ END
 		<td>$Lang::tr{'acct multiuser'}</td>
 		<td><input type='checkbox' name='multiuser' $checked{'multiuser'}{'on'}></td>
 		<td></td>
-	<tr>
+	</tr>
 	<tr>
 		<td>$Lang::tr{'acct mwst'}</td>
 		<td><input type='text' name='txt_mwst' value='$settings{'MWST'}' style='width:22em;'></td>
 		<td></td>
+	</tr>
 	<tr>
 		<td>$Lang::tr{'acct currency'}</td>
 		<td><input type='text' name='txt_currency' value='$settings{'CURRENCY'}' style='width:22em;'></td>
 		<td></td>
-	
+	</tr>
 	<tr>
 		<td valign='top'>$Lang::tr{'acct skipurl'}</td>
 		<td style='padding-left:0.2em;'><textarea name="txt_skipurls" cols="20" rows="6" style='width:22em;'>$settings{'SKIPURLS'}
 		
 	
$Lang::tr{'acct usemail'}
 		
 		
 	


+END
+}
 
+print <

 	
 		
-			
-			
-		
-		
-			
-			
-		
-		
-			
-			
-		
-		
-			
-			
-		
-		
-			
-			
-		
-		
-			
+			
-		
-			
-		
@@ -693,7 +671,6 @@ END
 		
 		$Lang::tr{'acct mailaddr'} 
$Lang::tr{'acct mailport'} 
$Lang::tr{'acct mailuser'} 
$Lang::tr{'acct mailpass'} 
$Lang::tr{'acct tls'} 
$Lang::tr{'acct mailsender'} $Lang::tr{'acct mailsender'}
 			
 		
 
 		
 			$Lang::tr{'acct subject'}
 			
 	
 
-
 	
@@ -907,7 +884,7 @@ sub generatemonthgraph{
 	my $sth;
 	my $cnt=0;
 	#If we want to show Data from within last 2 months, get DATA from ACCT
-	if ( ! $grmon < ($mon+1) && $gryear == ($year+1900)){
+	if ( $grmon == ($mon)+1 && $gryear == ($year+1900)){
 		$sth=&ACCT::getmonthgraphdata("ACCT",$from,$till,$grhost);
 	}else{
 		#If we want to show data from a date older than last two months, use ACCT_HIST
@@ -1116,64 +1093,89 @@ print<
 			
+
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
-				
+				
@@ -1186,19 +1188,19 @@ print<
 				
-				
+				
-				
+				
-				
+				
 END
@@ -1715,14 +1717,14 @@ if ($host && $cust){
 	
 	
 		

 				$Lang::tr{'acct companytype'} 
 				
 					$Lang::tr{'acct customer'}  
 					$Lang::tr{'acct hoster'} $Lang::tr{'acct bank'} $Lang::tr{'acct bank'}
+END
+
+if ($cgiparams{'rdo_companytype'} eq 'HOST'){
+	print " ";
+}
+
+print <
 				 
 					
 			
 			$Lang::tr{'acct company'} $Lang::tr{'acct company'} 
 				
 					 $Lang::tr{'acct iban'} $Lang::tr{'acct iban'}
 				
 					
 			
 			$Lang::tr{'acct name1'} $Lang::tr{'acct name1'}
 				
 					 $Lang::tr{'acct bic'} $Lang::tr{'acct bic'}
 				
 					
 			
 			$Lang::tr{'acct str'} $Lang::tr{'acct str'} 
 				
 					 $Lang::tr{'acct blz'} $Lang::tr{'acct blz'}
+END
+
+if ($cgiparams{'rdo_companytype'} eq 'HOST'){
+	print " ";
+}
+
+print <
 				 
 					
 			
 			$Lang::tr{'acct str_nr'} $Lang::tr{'acct str_nr'} 
 				 $Lang::tr{'acct kto'} $Lang::tr{'acct kto'}
+END
+
+if ($cgiparams{'rdo_companytype'} eq 'HOST'){
+	print " ";
+}
+
+print <
 				 
 					
 			
 
 			
 			$Lang::tr{'acct plz'} $Lang::tr{'acct plz'} 
 				
 					 $Lang::tr{'acct email'} $Lang::tr{'acct email'} 
 				
 			
 			$Lang::tr{'acct city'} $Lang::tr{'acct city'} 
 				 $Lang::tr{'acct inet'} $Lang::tr{'acct inet'}
 				
 					
 			
 			
 				
 				 $Lang::tr{'acct hrb'} $Lang::tr{'acct hrb'}
 				
 					
 			

 				 $Lang::tr{'acct tel'} $Lang::tr{'acct tel'}
 				
 					
 			
 			
 				
 				 $Lang::tr{'acct fax'} $Lang::tr{'acct fax'}
 				
 					
 			
 			$Lang::tr{'acct optional'}  $Lang::tr{'acct not optional'}
 			
 			
 		
-				
+				
-				
+				
@@ -1782,7 +1784,7 @@ END
 	my $val=sprintf"%.3f",$cgiparams{'txt_cent'};
 	print"";
 	#Optional note
-	print"";
+	print"";
 	print"
 			$Lang::tr{'name'} $Lang::tr{'name'} 
 				
 			
 			
 				

 			
 			$Lang::tr{'acct billtext1'} $Lang::tr{'acct billtext1'}
 				$cgiparams{'txt_billtext1'}
 			
 			
$Lang::tr{'acct cent'} $settings{'CURRENCY'} 
$Lang::tr{'acct optional'}
$Lang::tr{'required field'}


";
 	print"";
 
@@ -1959,9 +1961,9 @@ END
 sub viewtablehosts{
 	$dbh=&ACCT::connectdb;
 	&Header::openbox('100%', 'left', $Lang::tr{'acct hosts'});
-	my $mon=$_[0];
-	my $year=$_[1];
-	my ($from,$till)=&ACCT::getmonth($mon,$year);
+	my $mon1=$_[0];
+	my $year1=$_[1];
+	my ($from,$till)=&ACCT::getmonth($mon1,$year1);
 	$count=0;
 	#Menu to display another month
 	print<
 		
 					
 					
-					
-					
+					
+					
 					
 					
 					
@@ -2170,18 +2177,6 @@ END
 }
 
 sub checkmailsettings{
-	#Check if mailserver is an ip address or a domain
-	if ($cgiparams{'txt_mailserver'} =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/){
-		if (! &General::validip($cgiparams{'txt_mailserver'})){
-			$errormessage.="$Lang::tr{'acct invalid mailip'} $cgiparams{'txt_mailserver'}
";
-		}
-	}elsif(! &General::validfqdn($cgiparams{'txt_mailserver'})){
-			$errormessage.="$Lang::tr{'acct invalid mailfqdn'} $cgiparams{'txt_mailserver'}
";
-	}
-	#Check valid mailserverport
-	if($cgiparams{'txt_mailport'} < 1 || $cgiparams{'txt_mailport'} > 65535){
-		$errormessage.="$Lang::tr{'acct invalid mailport'} $cgiparams{'txt_mailport'}
";
-	}
 	#Check valid sender
 	if(! $cgiparams{'txt_mailsender'}){
 		$errormessage.="$Lang::tr{'acct empty field'} $Lang::tr{'acct mailsender'}
";
diff --git a/src/squid-accounting/acct-lib.pl b/src/squid-accounting/acct-lib.pl
index 7969a50239..58b154a345 100644
--- a/src/squid-accounting/acct-lib.pl
+++ b/src/squid-accounting/acct-lib.pl
@@ -93,8 +93,10 @@ sub delbefore {
 }
 
 sub movedbdata {
-	$dbh->do("insert into ACCT_HIST select datetime(TIME_RUN,'unixepoch'),NAME,SUM(BYTES) from ACCT where  date(TIME_RUN,'unixepoch') < date('now','-2 months') group by NAME,date(TIME_RUN,'unixepoch');");
-	$dbh->do("DELETE FROM ACCT WHERE datetime(TIME_RUN,'unixepoch') < date('now','-2 months');");
+	&connectdb;
+	$dbh->do("insert into ACCT_HIST select datetime(TIME_RUN,'unixepoch'),NAME,SUM(BYTES) from ACCT where datetime(TIME_RUN,'unixepoch') < datetime('now','start of month') group by NAME,datetime(TIME_RUN,'unixepoch');");
+	$dbh->do("DELETE FROM ACCT WHERE datetime(TIME_RUN,'unixepoch') < date('now','start of month');");
+	&closedb;
 }
 
 sub gethourgraphdata {
@@ -119,10 +121,10 @@ sub getmonthgraphdata {
 	my $name=$_[3];
 	my $res;
 	$dbh=connectdb;
-	if ($table eq 'ACCT'){
-		$res = $dbh->selectall_arrayref( "SELECT  strftime('%d.%m.%Y',xx.tag),(SELECT SUM(BYTES)/1024/1024 FROM ACCT WHERE date(TIME_RUN,'unixepoch') <= xx.tag and NAME = '".$name."') kum_bytes FROM (SELECT date(TIME_RUN,'unixepoch') tag,SUM(BYTES)/1024/1024 sbytes FROM ACCT WHERE NAME='".$name."' and TIME_RUN between ".$from." and ".$till." GROUP by date(TIME_RUN,'unixepoch')) xx;");
+	if ($table eq 'ACCT_HIST'){
+		$res = $dbh->selectall_arrayref( "SELECT strftime('%d.%m.%Y',TIME_RUN),(SELECT SUM(BYTES)/1024/1024 FROM ACCT_HIST WHERE TIME_RUN <= ah.TIME_RUN and TIME_RUN > date($from,'unixepoch') and NAME = '".$name."') kum_bytes FROM ACCT_HIST ah WHERE date(TIME_RUN) > date(".$from.",'unixepoch') AND date(TIME_RUN) < date(".$till.",'unixepoch') AND NAME = '".$name."' group by date(TIME_RUN);");
 	}else{
-		$res = $dbh->selectall_arrayref( "SELECT TIME_RUN, (SELECT SUM(BYTES)/1024/1024 FROM ACCT_HIST WHERE TIME_RUN <= ah.TIME_RUN and NAME = '".$name."') kum_bytes FROM ACCT_HIST ah WHERE TIME_RUN BETWEEN date(".$from.",'unixepoch') AND date(".$till.",'unixepoch') AND NAME = '".$name."' group by TIME_RUN;");
+		$res = $dbh->selectall_arrayref( "SELECT strftime('%d.%m.%Y',xx.tag),(SELECT SUM(BYTES)/1024/1024 FROM ACCT WHERE date(TIME_RUN,'unixepoch') <= xx.tag and TIME_RUN > ".$from." and NAME = '".$name."') kum_bytes FROM (SELECT NAME,date(TIME_RUN,'unixepoch') tag,SUM(BYTES)/1024/1024 sbytes FROM ACCT WHERE NAME='".$name."' and TIME_RUN between ".$from." and ".$till." GROUP by NAME,date(TIME_RUN,'unixepoch')) xx;");
 	}
 	$dbh=closedb;
 	return $res;
diff --git a/src/squid-accounting/acct.de.pl b/src/squid-accounting/acct.de.pl
index 2110cf7014..0291a9d250 100644
--- a/src/squid-accounting/acct.de.pl
+++ b/src/squid-accounting/acct.de.pl
@@ -88,9 +88,9 @@
 'acct mwst' => 'Mehrwertsteuer in %',
 'acct name1' => 'Name 1',
 'acct name2' => 'Name 2',
+'acct not optional' => 'Diese Felder sind Pflichtfelder',
 'acct nr' => 'RG-Nr.',
 'acct oldestdb' => 'Erster DB-Eintrag',
-'acct optional' => 'Diese Felder sind optional',
 'acct parameter' => 'Parameter',
 'acct path' => 'Pfad',
 'acct pdf billtxt' => 'Rechnung',
diff --git a/src/squid-accounting/acct.en.pl b/src/squid-accounting/acct.en.pl
index bdbf5b2ac6..913f2a79fa 100644
--- a/src/squid-accounting/acct.en.pl
+++ b/src/squid-accounting/acct.en.pl
@@ -90,7 +90,7 @@
 'acct name2' => 'Name 2',
 'acct nr' => 'RG-No.',
 'acct oldestdb' => 'Fist DB Entry',
-'acct optional' => 'These fields are optional',
+'acct not optional' => 'These fields are required',
 'acct parameter' => 'Parameter',
 'acct path' => 'Path',
 'acct pdf billtxt' => 'Bill',
@@ -104,7 +104,7 @@
 'acct plz' => 'Postcode',
 'acct preview' => 'Bill preview',
 'acct price pp' => 'Unit price',
-'acct proxy_enable' => 'Please actiavte proxy first',
+'acct proxy_enable' => 'Please activate proxy first',
 'acct pos' => 'Pos.',
 'acct sum total' => 'Total',
 'acct name' => 'Description',
@@ -113,7 +113,7 @@
 'acct settings' => 'Accounting settings',
 'acct skipurl' => 'Skip these URLs (Intranet)',
 'acct status' => 'Status',
-'acct str' => 'Steet',
+'acct str' => 'Street',
 'acct str_nr' => 'No.',
 'acct subject' => 'Subject',
 'acct sum' => 'Sum',
diff --git a/src/squid-accounting/acct.pl b/src/squid-accounting/acct.pl
index 79fc7bae43..68eb63c75e 100755
--- a/src/squid-accounting/acct.pl
+++ b/src/squid-accounting/acct.pl
@@ -27,6 +27,8 @@
 use Time::Local;
 use File::ReadBackwards;
 use strict;
+use MIME::Lite;
+
 #use warnings;
 
 require '/var/ipfire/general-functions.pl';
@@ -62,6 +64,11 @@ my ($mini,$max)=&ACCT::getminmax;
 my $now = localtime;
 my $proxylog;
 my $proxysrv;
+my $dmafile="${General::swroot}/dma/dma.conf";
+my $authfile="${General::swroot}/dma/auth.conf";
+my $mailfile="${General::swroot}/dma/mail.conf";
+my %mail=();
+my %dma=();
 
 ########
 # Main #
@@ -69,6 +76,7 @@ my $proxysrv;
 
 &checkproxy;
 
+
 #If we have a disabled file and the proxy is off, we don't need to check anything, exit!
 if((! -f $proxyenabled || $proxylog eq $Lang::tr{'stopped'}) && -f "${General::swroot}/accounting/disabled"){
 	&ACCT::logger($settings{'LOG'}," Proxy or proxylogging disabled - exiting with no data collection\n");
@@ -92,7 +100,7 @@ if (-f $proxyenabled && $proxylog eq $Lang::tr{'running'}){
 	$dbh=&ACCT::connectdb;
 	my $m=sprintf("%d",(localtime((time-3600)))[4]+1);
 	&ACCT::logger($settings{'LOG'},"month before one hour $m, now is ".($mon+1)."\n");
-	if ($m < ($mon+1) || $m == '12' && ($mon+1) == '1'){
+	if ($m = ($mon+1) || $m == '12' && ($mon+1) == '1'){
 		#Logrotate
 		my $year1=$year+1900;
 		system ("tar", "cfz", "/var/log/accounting-$m-$year1.tar.gz", "/var/log/accounting.log");
@@ -100,14 +108,25 @@ if (-f $proxyenabled && $proxylog eq $Lang::tr{'running'}){
 		open (FH,">/var/log/accounting.log");
 		close (FH);
 		chmod 0755, "/var/log/accounting.log";
-		#move all db entries older than 2 months to second table and cumulate them hourly
+		#move all db entries older than this month to second table and cumulate them daily
 		&ACCT::movedbdata;
 		&ACCT::logger($settings{'LOG'},"New Month. Old trafficvalues moved to ACCT_HIST Table\n");
-		if ($settings{'USEMAIL'} eq 'on'){
+		#check if mail is enabled
+		if ( -f $mailfile){
+			&General::readhash($mailfile, \%mail);
+		}
+		if ($mail{'USEMAIL'} eq 'on'){
 			&ACCT::logger($settings{'LOG'},"Mailserver is activated - Now sending bills via mail...\n");
 			my $res=&ACCT::getbillgroups;
 			foreach my $line (@$res){
 				my ($grp) = @$line;
+				open (FILE, "<", $dmafile) or die $!;
+				foreach my $line () {
+					$line =~ m/^([A-Z]+)\s+?(.*)?$/;
+					my $key = $1;
+					my $val = $2;
+					$dma{$key}=$val;
+				}
 				&sendbill($grp,$settings{'MWST'},$settings{'CURRENCY'});
 			}
 		}else{
@@ -214,7 +233,7 @@ sub sendbill {
 	$month = '0'.$actmonth if $actmonth < 10;
 	$month = '12' if $actmonth == 0;
 	my $actyear  = $now[5];
-	my ($from,$till)=&ACCT::getmonth($actmonth,$actyear);					#FIXME month and year as variables!
+	my ($from,$till)=&ACCT::getmonth($actmonth,$actyear);
 	my @billar = &ACCT::GetTaValues($from,$till,$rggrp);
 	my $address_cust = &ACCT::getTaAddress($rggrp,'CUST');
 	my $address_host = &ACCT::getTaAddress($rggrp,'HOST');
@@ -229,23 +248,34 @@ sub sendbill {
 
 	if ($back eq '0'){
 		&ACCT::logger($settings{'LOG'},"Bill for $company_cust successfully created.\n");
-		my $file="'/var/ipfire/accounting/bill/$rggrp/$month-$actyear-$no.pdf'";
+		my $file="/var/ipfire/accounting/bill/$rggrp/$month-$actyear-$no.pdf";
 		$settings{'MAILTXT'} =~ tr/\|/\r\n/ ;
-		my $cmd = "/usr/local/bin/sendEmail ";
-		$cmd .= " -f $settings{'MAILSENDER'}";							#Sender
-		$cmd .= " -t $email";											#Recipient
-		if ($ccmail){
-			$cmd .= " -cc $ccmail";
-		}
-		#Send Mail via TLS?
-		if ($settings{'TLS'} eq 'on'){
-			$cmd .= " -o tls=yes";										#TLS
-		}
-		$cmd .= " -u '$settings{'MAILSUB'}'";							#Subject
-		$cmd .= " -m '$settings{'MAILTXT'}'";							#Mailtext
-		$cmd .= " -s $settings{'MAILSRV'}:$settings{'MAILPORT'}";		#Mailserver:port
-		$cmd .= " -a $file";
-		my $res=system ($cmd);
+
+		#extract filename from path
+		my ($filename) = $file =~ m{([^/]+)$};
+
+		my $msg = MIME::Lite->new(
+			From	=> $mail{'SENDER'},
+			To		=> $email,
+			Cc		=> $ccmail,
+			Subject	=> $settings{'MAILSUB'},
+			Type	=> 'multipart/mixed'
+		);
+
+		$msg->attach(
+			Type	=> 'TEXT',
+			Data	=> $settings{'MAILTXT'}
+		);
+
+		$msg->attach(
+			Type		=> 'application/pdf',
+			Path		=> $file,
+			Filename	=> $filename,
+			Disposition	=> 'attachment'
+		);
+
+		my $res=$msg->send_by_sendmail;
+
 		if ($res == 0){
 			&ACCT::logger($settings{'LOG'},"Bill for $company_cust successfully sent.\n");
 		}elsif ($res > 0){
@@ -255,13 +285,19 @@ sub sendbill {
 		
 	}else{
 		&ACCT::logger($settings{'LOG'},"ERROR Bill for $company_cust could not be created.\n");
-		my $cmd = "/usr/local/bin/sendEmail ";
-		$cmd .= " -f $settings{'MAILSENDER'}";
-		$cmd .= " -t $settings{'MAILSENDER'}";
-		$cmd .= " -u Fehler Squid Accounting";
-		$cmd .= " -m 'Die Rechnung konnte nicht erzeugt und per Mail versendet werden' $company_cust";
-		$cmd .= " -s $settings{'MAILSRV'}:$settings{'MAILPORT'}";
-		my $res=system ($cmd);
+		my $msg = MIME::Lite->new(
+			From	=> $mail{'SENDER'},
+			To		=> $mail{'RECIPIENT'},
+			Subject	=> "ERROR Squid Accounting",
+			Type	=> 'multipart/mixed'
+		);
+
+		$msg->attach(
+			Type	=> 'TEXT',
+			Data	=> "The bill could not be created for customer $company_cust"
+		);
+
+		$msg->send_by_sendmail;
 		return 0;
 	}
 }
diff --git a/tools/checkwronginitlinks b/tools/checkrootfiles
similarity index 76%
rename from tools/checkwronginitlinks
rename to tools/checkrootfiles
index 65fc946b68..74fab3e023 100755
--- a/tools/checkwronginitlinks
+++ b/tools/checkrootfiles
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2015  IPFire Team  info@ipfire.org                       #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -32,3 +32,17 @@ if [ "${?}" == "0" ]; then
 	grep -r "^var/run//*" ./config/rootfiles/
 	echo "Comment this and create it at initskript if needed !"
 fi
+
+grep -r "/i586" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore >/dev/null 2>&1
+if [ "${?}" == "0" ]; then
+	echo "Error! '/i586' in rootfiles files found!"
+	grep -r "/i586" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore
+	echo "Replace by MACHINE !"
+fi
+
+grep -r "/armv5tel" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore >/dev/null 2>&1
+if [ "${?}" == "0" ]; then
+	echo "Error! '/armv5tel' in rootfiles files found!"
+	grep -r "/armv5tel" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore
+	echo "Replace by MACHINE !"
+fi
diff --git a/tools/make-functions b/tools/make-functions
index 4fbb530f45..e297c50cef 100644
--- a/tools/make-functions
+++ b/tools/make-functions
@@ -68,6 +68,12 @@ configure_target() {
 	fi
 
 	case "${target_arch}" in
+		x86_64)
+			BUILDTARGET="${target_arch}-unknown-linux-gnu"
+			CROSSTARGET="${BUILD_ARCH}-cross-linux-gnu"
+			CFLAGS_ARCH="-m64 -mtune=generic"
+			;;
+
 		i586)
 			BUILDTARGET="${target_arch}-pc-linux-gnu"
 			CROSSTARGET="${BUILD_ARCH}-cross-linux-gnu"
@@ -355,7 +361,7 @@ qemu_is_required() {
 	fi
 
 	case "${BUILD_ARCH},${target_arch}" in
-		x86_64,arm*|i?86,arm*)
+		x86_64,arm*|i?86,arm*|i?86,x86_64)
 			return 0
 			;;
 		*)
@@ -370,6 +376,15 @@ qemu_install_helper() {
 		return 0
 	fi
 
+	if [ ! -e /proc/sys/fs/binfmt_misc/status ]; then
+		exiterror "binfmt_misc not mounted. QEMU_TARGET_HELPER not useable."
+	fi
+
+	if [ ! $(cat /proc/sys/fs/binfmt_misc/status) = 'enabled' ]; then
+		exiterror "binfmt_misc not enabled. QEMU_TARGET_HELPER not useable."
+	fi
+
+
 	if [ -z "${QEMU_TARGET_HELPER}" ]; then
 		exiterror "QEMU_TARGET_HELPER not set"
 	fi
@@ -407,12 +422,17 @@ qemu_find_target_helper_name() {
 		arm*)
 			magic="7f454c4601010100000000000000000002002800"
 			;;
+		x86_64)
+			magic="7f454c4602010100000000000000000002003e00"
+			;;
 	esac
 
 	[ -z "${magic}" ] && return 1
 
 	local file
 	for file in /proc/sys/fs/binfmt_misc/*; do
+		# skip write only register entry
+		[ $(basename "${file}") = "register" ] && continue
 		# Search for the file with the correct magic value.
 		grep -qE "^magic ${magic}$" "${file}" || continue
 
@@ -450,8 +470,8 @@ entershell() {
 		NAME="$NAME" SNAME="$SNAME" SLOGAN="$SLOGAN" \
 		CFLAGS="${CFLAGS}" CXXFLAGS="${CXXFLAGS}" \
 		CCACHE_DIR=/usr/src/ccache \
-		CCACHE_COMPRESS=1 \
-		CCACHE_COMPILERCHECK="none" \
+		CCACHE_COMPRESS="${CCACHE_COMPRESS}" \
+		CCACHE_COMPILERCHECK="${CCACHE_COMPILERCHECK}" \
 		KVER=$KVER \
 		BUILDTARGET="$BUILDTARGET" \
 		CROSSTARGET="${CROSSTARGET}" \
@@ -573,8 +593,9 @@ lfsmake2() {
 						CONFIG_ROOT=$CONFIG_ROOT \
 						NAME="$NAME" SNAME="$SNAME" SLOGAN="$SLOGAN" \
 						CFLAGS="${CFLAGS}" CXXFLAGS="${CXXFLAGS}" \
-						CCACHE_DIR=/usr/src/ccache CCACHE_COMPRESS=1 \
-						CCACHE_COMPILERCHECK="none" \
+						CCACHE_DIR=/usr/src/ccache \
+						CCACHE_COMPRESS="${CCACHE_COMPRESS}" \
+						CCACHE_COMPILERCHECK="${CCACHE_COMPILERCHECK}" \
 						KVER=$KVER MAKETUNING=$MAKETUNING \
 						BUILDTARGET="$BUILDTARGET" \
 						CROSSTARGET="${CROSSTARGET}" \
@@ -614,8 +635,9 @@ ipfiremake() {
 						NAME="$NAME" SNAME="$SNAME" SLOGAN="$SLOGAN" \
 						SYSTEM_RELEASE="$SYSTEM_RELEASE" \
 						CFLAGS="${CFLAGS}" CXXFLAGS="${CXXFLAGS}" \
-						CCACHE_DIR=/usr/src/ccache CCACHE_COMPRESS=1 \
-						CCACHE_COMPILERCHECK="none" \
+						CCACHE_DIR=/usr/src/ccache \
+						CCACHE_COMPRESS="${CCACHE_COMPRESS}" \
+						CCACHE_COMPILERCHECK="${CCACHE_COMPILERCHECK}" \
 						KVER=$KVER MAKETUNING=$MAKETUNING \
 						BUILDTARGET="$BUILDTARGET" \
 						CROSSTARGET="${CROSSTARGET}" \
@@ -653,8 +675,9 @@ ipfiredist() {
 					CONFIG_ROOT=$CONFIG_ROOT \
 					NAME="$NAME" SNAME="$SNAME" SLOGAN="$SLOGAN" \
 					CFLAGS="${CFLAGS}" CXXFLAGS="${CXXFLAGS}" \
-					CCACHE_DIR=/usr/src/ccache CCACHE_COMPRESS=1 \
-					CCACHE_COMPILERCHECK="none" \
+					CCACHE_DIR=/usr/src/ccache \
+					CCACHE_COMPRESS="${CCACHE_COMPRESS}" \
+					CCACHE_COMPILERCHECK="${CCACHE_COMPILERCHECK}" \
 					KVER=$KVER \
 					BUILDTARGET="$BUILDTARGET" \
 					CROSSTARGET="${CROSSTARGET}" \
$Lang::tr{'ConnSched time'}	$Lang::tr{'ConnSched time'}

$Lang::tr{'ConnSched action'}	+
$Lang::tr{'ConnSched action'}

$Lang::tr{'ConnSched days'}
$Lang::tr{'ConnSched days'}

$Lang::tr{'remark title'}
$Lang::tr{'remark title'}
$Lang::tr{'dhcp advopt scope help'}	$Lang::tr{'dhcp advopt scope help'}	@@ -905,29 +908,29 @@ if ($dhcpsettings{'KEY2'} ne '') { } print < -	$Lang::tr{'mac address'}:	$Lang::tr{'mac address'}:	$Lang::tr{'ip address'}:	$Lang::tr{'ip address'}:	$Lang::tr{'remark'}:	$Lang::tr{'remark'}:
$Lang::tr{'enabled'}
$Lang::tr{'dhcp bootp pxe data'}
next-server:	next-server:		filename:	filename:	root path:	root path:
+ $Lang::tr{'flag'} +	+ $Lang::tr{'countrycode'} +	+ $Lang::tr{'country'} +
$Lang::tr{'fwhost err emptytable'}
$col_content	$customgeoipgrp{$key}[2]	$country_name	\n"; + + if ($delflag > 0){ + print"\n"; + + # Check if this group only has a single entry. + foreach my $key2 (keys %hash) { + if ($hash{$key2}<2 && $key2 eq $customgeoipgrp{$key}[0]){ + print "" ; + } + } + } + + print "\n"; + print "\n"; + print "\n"; + print " \n"; + print "
+ $Lang::tr{'flag'} +	+ $Lang::tr{'countrycode'} +	+ $Lang::tr{'country'} +	+ $Lang::tr{'flag'} +	+ $Lang::tr{'countrycode'} +	+ $Lang::tr{'country'} +

$flag	$ccode_uc	$cname
$Lang::tr{'host ip'}:	$Lang::tr{'host ip'}:		$Lang::tr{'hostname'}:	$Lang::tr{'hostname'}:
$Lang::tr{'domain name'}:	$Lang::tr{'domain name'}:		$Lang::tr{'enabled'}
$Lang::tr{'acct mailaddr'}
$Lang::tr{'acct mailport'}
$Lang::tr{'acct mailuser'}
$Lang::tr{'acct mailpass'}
$Lang::tr{'acct tls'}
$Lang::tr{'acct mailsender'}	$Lang::tr{'acct mailsender'}

$Lang::tr{'acct subject'}

$Lang::tr{'acct companytype'}	$Lang::tr{'acct customer'} $Lang::tr{'acct hoster'}	$Lang::tr{'acct bank'}	$Lang::tr{'acct bank'} +END + +if ($cgiparams{'rdo_companytype'} eq 'HOST'){ + print " "; +} + +print <
$Lang::tr{'acct company'}	$Lang::tr{'acct company'}		$Lang::tr{'acct iban'}	$Lang::tr{'acct iban'}
$Lang::tr{'acct name1'}	$Lang::tr{'acct name1'}		$Lang::tr{'acct bic'}	$Lang::tr{'acct bic'}
$Lang::tr{'acct str'}	$Lang::tr{'acct str'}		$Lang::tr{'acct blz'}	$Lang::tr{'acct blz'} +END + +if ($cgiparams{'rdo_companytype'} eq 'HOST'){ + print " "; +} + +print <
$Lang::tr{'acct str_nr'}	$Lang::tr{'acct str_nr'}		$Lang::tr{'acct kto'}	$Lang::tr{'acct kto'} +END + +if ($cgiparams{'rdo_companytype'} eq 'HOST'){ + print " "; +} + +print <
$Lang::tr{'acct plz'}	$Lang::tr{'acct plz'}		$Lang::tr{'acct email'}	$Lang::tr{'acct email'}
$Lang::tr{'acct city'}	$Lang::tr{'acct city'}		$Lang::tr{'acct inet'}	$Lang::tr{'acct inet'}
		$Lang::tr{'acct hrb'}	$Lang::tr{'acct hrb'}
		$Lang::tr{'acct tel'}	$Lang::tr{'acct tel'}
		$Lang::tr{'acct fax'}	$Lang::tr{'acct fax'}
$Lang::tr{'acct optional'}					$Lang::tr{'acct not optional'}
$Lang::tr{'name'}	$Lang::tr{'name'}

$Lang::tr{'acct billtext1'}	$Lang::tr{'acct billtext1'}	$cgiparams{'txt_billtext1'}

$Lang::tr{'acct cent'}	$settings{'CURRENCY'}
$Lang::tr{'acct optional'}
$Lang::tr{'required field'}
"; print"