pfSense

PR https://github.com/pfsense/pfsense/pull/3452
The char set allowed should be the same as for Interfaces and Aliases.

To get this really fixed, it's needed to

1/ revert a bunch of other commits that allowed that stuff specifically for use with packages (the pkg- prefix).
2/ do something about the tinc package

How about pkg_ instead of pkg-? https://github.com/pfsense/FreeBSD-ports/pull/275

(Plus, can file a separate bug about the last remaining issue, i.e. that users shouldn't be allowed to mess with package-created interface groups, but that depends on 2/ above).

PR https://github.com/pfsense/pfsense/pull/3458
To fix validation of Interface, Interface Group and Alias names.

What other packages use the "pkg_" prefix to generate names in this namespace?

Heh, none that I'd know of ATM except tinc, but it simply needs to be something, so that some checking can be done for these cases (don't let use otherwise, don't let rename/delete while pkg is still installed, ...)

I guess the package should be responsible for deleting the Interface Group as it uninstalls itself.
So the Interface Groups display and edit pages can always prevent delete/edit of "pkg_*" Interface Groups. From core code there will be no need to try to work out which package made the Interface Group and if that package is installed or not.
True?

Yeah, I think it should behave like the IPsec/OpenVPN ones, they don't let you mess with those either. :) (Well, except that they are not listed as a group at all...)