(cherry picked from commit a39f5592)

(cherry picked from commit a045532a)

(cherry picked from commit d1e5d32e)

(cherry picked from commit de008540)

(cherry picked from commit f9f75296)

(cherry picked from commit ef1a921b)

(cherry picked from commit 69830db4)

(legacy) fix tunnel identification when using ipsec nat, https://github.com/opnsense/core/issues/369

(cherry picked from commit c72484ec)

(ipfw) reverse behaviour for non captiveportal pass rules in ipfw, issue https://github.com/opnsense/core/issues/369

same issue could appear on otheri non physical interfaces as well in the previous version

(cherry picked from commit a6c6016f)

(ipfw) skip enc0 device when processing captiveportal rules, found issue when analyzing https://github.com/opnsense/core/issues/369

(cherry picked from commit e03a4ce7)

(cherry picked from commit 5f65d541)

(cherry picked from commit f5cedec5)

(cherry picked from commit 8d28488f)

(cherry picked from commit 5b67fa4a)

(cherry picked from commit b48122f9)

Backend can't call tainted code that may run configd again.  This needs
to be cleaned up.  Ideally, the backend should only call python code.

(cherry picked from commit 4f43181d)

(cherry picked from commit cc7aeef0)

Spotted by: @fabianfrz

(cherry picked from commit 14c63733)

(cherry picked from commit 0a8876ed)

(cherry picked from commit 9fe4591d)

(cherry picked from commit 6eb68e2e)

(cherry picked from commit 03c31498)

(cherry picked from commit 4deca554)

Not sure we'll ever hit this, make it more vague, although
IKE is pretty much either this or that.

Spotted by: @fabianfrz

(cherry picked from commit c7e5c37a)

(cherry picked from commit 971c7831)

(cherry picked from commit af8f5ab0)

Spotted by: @fabianfrz

(cherry picked from commit 10a9a5e2)

(cherry picked from commit bc37482f)