FreshBSD

    filter, rule generation. don't wrap aliases in curly brackets, it seems to crash when 
a to port is written like {$portalias}

    ipsec, add routed when SA is installed and routed, for 
https://github.com/opnsense/core/issues/1688

    ipsec/diag, list non routed connections, for 
https://github.com/opnsense/core/issues/1688

HBSD: Enable the stack guard by default

HardenedBSD has enabled the stack guard by default. The article Stack
Clash discusses FreeBSD having the stack guard disabled by default. ASLR
will help here, but is not a full mitigation against this kind of attack.

A follow-up commit from HardenedBSD will harden the stack guard page
even more so. Once that commit is tested and considered stable, it will
be merged over into OPNsense.

Signed-off-by:        Shawn Webb <shawn at opnsense.org>

security/sudo: sync with upstream

Taken from: HardenedBSD

*/*: sync with upstream

Taken from: HardenedBSD

opnsense: add USE_HARDENING for our own ports

net/tayga: better fix with sed in case this is updated

Hardening: fix config menu glitch in previous

Hardening: a hybrid approach to options

Having the non-default options in the config stage can help users,
so we model the visibility around the BATCH and PACKAGE_BUILDING
flags, which indicate that poudriere or some other automated tool
are used so the user will have to set his options through make.conf
or trust the defaults.

Discussed with: @lattera

Hardening: at least for OPNsense, make disabled options invisible

net/tayga: use USE_HARDENING instead of implicit/exception glue

Hardeining: bring this closer to latest HardenedBSD code

Advertise options as requested by @lattera, though we may have to
make "static" a hard off as compiler and linker flags are not
applicable to things that do not build at all.

Framework: partially sync with upstream

Taken from: HardenedBSD

sysutils/tmux: sync with upstream

Taken from: HardenedBSD

sysutils/nut: sync with upstream

Taken from: HardenedBSD

security/tor: sync with upstream

Taken from: HardenedBSD

dns/unbound: sync with upstream

Taken from: HardenedBSD

dns/bind911: sync with upstream

Taken from: HardenedBSD

devel/pear-PHP_CodeSniffer: sync with upstream

Taken from: HardenedBSD

devel/py-pytest: sync with upstream

Taken from: HardenedBSD

devel/libatomic_ops: sync with upstream

Taken from: HardenedBSD

security/vuxml: sync with upstream

Taken from: HardenedBSD

*/*: sync with upstream

Taken from: HardenedBSD

    rework "item in" for our Volt templates, closes 
https://github.com/opnsense/core/issues/1682
    
    (cherry picked from commit 203ba240470418aaf4e36c2a06fd00ff79e2c758)

    rework "item in" for our Volt templates, closes 
https://github.com/opnsense/core/issues/1682

sysutils/monit: set mailserver type to CSVListField, fix validation

Hardening: softcode pie and relro to rebuild EXPLICIT_* feature

Also fixes application of -fPIC to libraries when needed, but hardening
being completely disabled.

Hardening: proper arguments for pie and safestack "configure"

opnsense/opnsense-update: additions for opnsense-revert

Hardening: update cfi code

config: in HardenedBSD ports, CFIHARDEN option is new

Framework: partially sync with upstream

Taken from: HardenedBSD

*/*: sync with upstream

Taken from: HardenedBSD

Hardening: exclude linux category like HardenedBSD

Hardening: use static helper and limit safestack version

Hardening: add more USE_HARDENING helpers

Hardening: fix indent

Hardening: update style

security/suricata: revert REDIS option for now

system: remove duplicated hint

We added the former, but it basically says the same thing.  ;)

services: add background glue for interface handling speed-up

Framework: partially sync with upstream

Taken from: HardenedBSD

sysutils/nut: sync with upstream

Taken from: HardenedBSD

security/openvpn: partially sync with upstream

Taken from: HardenedBSD

net-mgmt/net-snmp: sync with upstream

Taken from: HardenedBSD

lang/ruby24: sync with upstream

Taken from: HardenedBSD

lang/php70: sync with upstream

Taken from: HardenedBSD

devel/py-twisted: sync with upstream

Taken from: HardenedBSD

*/*: sync with upstream

Taken from: HardenedBSD