(cherry picked from commit b83fed8c)

(cherry picked from commit 056eb77f)

(cherry picked from commit bcaaff09)

(cherry picked from commit fe9c87a8)

(cherry picked from commit b333523b)

(cherry picked from commit 0a9ab5e2)

(cherry picked from commit 7a756614)

(cherry picked from commit c801a19b)

(cherry picked from commit e7f6619d)

(cherry picked from commit b7adcb6c)

(cherry picked from commit 7c0204bc)

(cherry picked from commit e508d11f)

(cherry picked from commit 86388566)

(cherry picked from commit 1f66fa6a)

(cherry picked from commit faaa90bd)

(cherry picked from commit a39f5592)

(cherry picked from commit a045532a)

(cherry picked from commit d1e5d32e)

(cherry picked from commit de008540)

(cherry picked from commit f9f75296)

(cherry picked from commit ef1a921b)

(cherry picked from commit 69830db4)

(legacy) fix tunnel identification when using ipsec nat, https://github.com/opnsense/core/issues/369

(cherry picked from commit c72484ec)

(ipfw) reverse behaviour for non captiveportal pass rules in ipfw, issue https://github.com/opnsense/core/issues/369

same issue could appear on otheri non physical interfaces as well in the previous version

(cherry picked from commit a6c6016f)

(ipfw) skip enc0 device when processing captiveportal rules, found issue when analyzing https://github.com/opnsense/core/issues/369

(cherry picked from commit e03a4ce7)

(cherry picked from commit 5f65d541)

(cherry picked from commit f5cedec5)

(cherry picked from commit 8d28488f)

(cherry picked from commit 5b67fa4a)

(cherry picked from commit b48122f9)

Backend can't call tainted code that may run configd again.  This needs
to be cleaned up.  Ideally, the backend should only call python code.

(cherry picked from commit 4f43181d)

(cherry picked from commit cc7aeef0)

Spotted by: @fabianfrz

(cherry picked from commit 14c63733)