PR: https://forum.opnsense.org/index.php?topic=3979.0

PR: https://github.com/opnsense/core/issues/1275

PR: https://github.com/opnsense/core/issues/1277

o Mark interface used in case of interface tracking
o Don't inject local DNS server when there is no IP

PR: https://github.com/opnsense/core/issues/1273

This doesn't really matter in the current code as it is the
default and only 'one' makes the implementation change its
scope, but for the sake of consistency let this be fixed.

We're switching to PHP 7.0 (or 7.1 maybe), php-suhosin seems dead,
and maybe someone wants to work on a newer python base.

PR: https://forum.opnsense.org/index.php?topic=3976

Private functions get "_" prefix, easy to spot from elsewhere
if needed.  Yes, someone will try this eventually.  ;)

PR: https://github.com/opnsense/core/issues/1250

Discussed with: @adschellevis

o Respect the 'dnslocalhost' option, which wasn't previously possible
  because dhcpleases clobbered /etc/hosts directly anyway.
o Align the code with how unbound does it: use a private file for
  the hosts generation.
o HUP dnsmasq at the end of the hosts file regeneration.
o `--dhcp-hostsfile' was really really wrong as /etc/hosts is read
  automatically, and the file specified here should have been adhering
  to the dhcp leases format of on `--dhcp-host' argument per line.

(proxy) add ftp support again for remote acl download. We switched to python's requests library, which doesn't support ftp. Some people still use ftp though.

Getting crowded...

(ipsec) fix syslog output, eventually we should switch to the new style loggers, but for now it's better to make sure charondebug is respected.

From the docs:

Starting with version 4.2.9, strongSwan provides a much more flexible configuration of the loggers. Logger configurations in strongswan.conf have a higher priority than charondebug in ipsec.conf: If you define any loggers in strongswan.conf, charondebug does not have any effect at all.