pfSense

Add QinQ interfaces to the list of interfaces not to check (Bug #4669)

Remove dummy config_lock() and config_unlock() functions

Been no-op for ages (https://github.com/pfsense/pfsense/commit/0027de0a544438f146cfc94f005fd6f4ba9f94d7).

Remove useless config_lock()/config_unlock() calls

Redmine #7435 Fix edit problems due to POST id code

Refactor is_port_or functions

(cherry picked from commit fe108b671d09cf34a11270e286dcd4c4ce1c0597)

Add underscores to is_port* function names

(cherry picked from commit 593e9fe32d2959cd823fe5da55714ccfb9a0e958)

Merge pull request #3672 from phil-davis/handle-empty-port-alias-RELENG_2_3_3

Correct definition of ports for SMB used by the shaper wizard. Fixes #7434

Redmine #7428 Hanlde empty port alias

Refactor filter_generate_nested_alias

Provide functions for checking port range alias combinations

Fix handling of port ranges in this validation test. Ticket #7421

Show the button to reset CARP demotion status even when the value is negative, and change the reset code to accommodate. Also fixup text in that dialog. Fixes #7424

File a notice and omit rule(s) using a missing port alias. Fixes #7421

Fix display of BIOS only on Sytem Info widget

Show BIOS information in the system info widget, if it exists in kenv.

Merge pull request #3666 from phil-davis/sysinfo-widget-all-button-RELENG_2_3_3

System Info Widget enable All button when disable firmware check is set

If system firmware disablecheck is set, then the click event for the filter "All" button is also not included in the JS, so the "All" button is not effective.

The setTimeout for systemStatusGetUpdateStatus() can be moved up just below where it is declared and inside the existing "if" that conditionally includes that function - no need for it to be inside events.push...

Fix #7317 Widget Filter All button gateways widget RELENG_2_3

Reduce numeric precision in gateways widget to single decimal place (Feature #6841)

Further internationalization

Add missing internationalization

Revise gateway widget config form

Allow hiding of gateways in Gateways Widget

Sometimes there are gateways that I do not care about, so it is handy to
be able to save some space on the dashboard by hiding them.
This uses similar code structure taken from service_status widget. I
made the Save and Clear buttons and all that stuff use the same styles...

Don't process empty anchors as it could lead to flushing more than intended when cleaning up after relayd. Fixes #7396

Run custom deinstall commands during the deinstall phase instead of post-deinstall, otherwise they will never get run. Fixes #7401

Perform a filter reload after starting relayd so it does not leave the firewall without pf tables. Fixes #7396

Revert "C2758 is VGA only too"

This reverts commit e4324dcebd54bfc498bffd6d02b0afd7d8c674b9.

C2758 is VGA only too

Fix #7317 Widget Filter All button

(cherry picked from commit 7067e174c27a1fe9b23d13806f1e52ce9bc2aaee)

System Information widget filter gettext()

(cherry picked from commit f5d762f90924510c097a9065dff135dab01f46f0)

System Information Widget Filter

(cherry picked from commit 718b3b0b1b75de09a87866cb37b5a0752643283a)

Fix #7364 Console assigned VLAN disappears after reboot

(cherry picked from commit 75a1149e0104561446e6f90f98d98c6c13c52996)

Fix #7306 Correctly filter log widget entries by interface description
(cherry picked from commit 27bc5848cfea95f97f70a4fe0c30da6319794a9a)

Use the same cache filename pattern for RFC2136 IPv6 items as used by dyndns

Use | to separate dyndns IPv4 fields on cache file as done by rfc2136 items and for all IPv6 items

Setup XG-154x console to VGA only

Remove whirlpool from the list of CA/Cert digest algorithms as it does not work properly. OpenSSL claims it's not valid ("unknown signature algorithm"). Fixes #7370
While I'm here, stop needlessly repeating the algo list, it's a global in certs.inc, so use that single copy of the list.

Fix display of openssl errors when working with CA or certificate entries. Found this while looking into ticket #7370

Set new blog URL (https://www.netgate.com/blog/) as default for RSS widget

(cherry picked from commit 294f14f7897f973f1fa2a1506cfdd9117b5daf65)

Allow CloudFlare DDNS entries to use "" or "." for the hostname portion of the domain in the GUI to update the domain's @ record. Then in the backend code, remove that from the FQDN since CloudFlare doesn't like that to be sent explicitly. Fixes #7357

Fix is confirmed to work by two forum users: https://forum.pfsense.org/index.php?topic=122099.msg699763#msg699763

Do not enforce a max limit on state timeout when editing a firewall rule. Fixes #7356

While I'm here, fix the case when the admin account has been removed.

When resetting admin account via /etc/rc.initial.password, Check if the admin account is expired and reset if needed. Fixes #7354

Fix the pkg_call() and set the timeout to a sane value (Bug #6594)
(cherry picked from commit 9c91c7bd747074b8cdaa90e8810f0c2df081f72d)

Fix #7300 provide default value for ipprotocol for old rules

Fix #7299 and other stuff

As far as I can see, filter_generate_user_rule() is always supposed to be called with 'ipprotocol' set to 'inet' or 'inet6'. The cases of rules for both ('inet46') are handled by calling filter_generate_user_rule() twice, passing 'inet' then 'inet6'....

Fixes #7296
HTML tags not allowed in selector option values

(cherry picked from commit 57f4327a60c0cabf43161a6cfde98479b42a7092)
(cherry picked from commit 8dbde62f220234c8fcfe472b97cdba606779bc22)

Captive portal: fix "Disconnect All" button

Welcome 2.3.3-RELEASE

fix colspan background on dark theme

Add "required field" highlighting

Only save valid widget locations in config

Some widgets create extra panels, e.g. the widgets that now have the filter functionality. Those panels are processed in the ".each" at line 424. They do not have an id in the form "widget-*" and when the old code tries to find the "*" part it gets "undefined". This results in the layout being saved like:...

Allow 5 dashboard columns to work

Selecting 1,2,3,4 or 6 dashboards columns results in an exact integer result here and all is good. But 5 columns results in "2.4" and "col-sm-2.4" is not a thing in bootstrap.
We need just the best int we can choose here, which is one that is just the int part of the division. That ensures that the 5 columns extend over less than the standard bootstrap total of 12 "units" wide....

Fix #7257: Use pfSense-upgrade to look for new versions

Fix saving Hybrid RSA + Xauth. Fixes #7258

Revert "Add privs to control display of notices"

Fix #7051

This reverts commit 04665e78537906f7375668ca665cba17f95a4864.

Revert "Use cached groups in get_user_privileges"

This reverts commit c7c79905d3e0fd01172d373a15a1d0d77a5728e8.

Use cached groups in get_user_privileges

(cherry picked from commit 7abc3f992e5dd5bff53495844ce944163d6d1d9b)

Fix ldap_get_groups return value when down

In some places ldap_get_groups has:
```
return memberof;
```
It should have the "$" in front, so it will return the $memberof array (that is empty when this happens).

This causes issues for callers that expect to have a return value that is either false, an empty array, or an array of the groups....

IPv4 Tunnel Network is required for OpenVPN server

(cherry picked from commit e4488e51cf424907e06ef7cc73370aa0657e5e25)

Update version string at end of boot RELENG_2_3

When there is an upgrade, the echo here was outputting a stale value of the version. For example, on first upgrade from 2.3.3-DEVELOPMENT to 2.3.3-RC the console had:

pfSense (pfSense) 2.3.3-DEVELOPMENT amd6 Sat Feb 11 14:24:27 CST 2017...

Add foot.inc back to status.php

It's time to 2.3.3-RC

5th try
- change $do_ping default value to 'true' (which emulates the previous default behavior) to avoid any unexpected results

(cherry picked from commit 20cf8d8e20fa28c16e86ce0d91e57e4d78427d26)

4th attempt!
- Reworked based on recent comments from @rbgarga

(cherry picked from commit c516cb287a78f7b05459e7fcba410f443d8eb8af)

3rd try!
- incorporate suggestions from @rbgarga with slight modification

(cherry picked from commit 6c2f093000b05285546e81dd1a578fc9b573b72b)

2nd try. . .

/etc/inc/util.inc:
- arp_get_mac_by_ip() updated to support IPv6
- attempt at code streamline

/usr/local/www/services_dhcp_edit.php:
- streamline code, now just a simple call to arp_get_mac_by_ip()

(cherry picked from commit dd83f869b79a858bd74c7a8bb4adcd49217445b0)

enhancements to services_dhcp_edit.php
- added ndp call to get MAC addr if remote client is connected via IPv6
- automatically hide `Copy MAC` button if arp/ndp returns null
- switch to exec() instead of backticks for calls to arp
- uses builtin is_ipaddr() function from util.inc...

Sync up status.php with master, but keep the 2.3/10.3-specific parts. Fixes #7246

Do not output PHP shell starup message unless it is run interactively. Fixes #7045

Add a pfSense php shell playback script to show the gateway status. Ticket #7046

Add a function to format and return plain text output showing the gateway status, for use by a shell script and status.php. Ticket #7046

Add playback scripts to drill into pf tables and anchors to list their contents.

Fix for bug 6966 https://redmine.pfsense.org/issues/6966

Change-Id: I9471c2bbd8941e70965a86d369c8de87be9a4417
(cherry picked from commit 109a304e154a179bd340b06880ce95baec4dab03)

Revert "Fixed #6753"
User feedback suggests the sorted menu was better, despite the lack of consistency elsewhere.
This reverts commit 96ff627ff95e0fcadf8c15dbd6fe681309cb0fd8.

Mark missing parameter as required. It got lost during backport from master as spotted by @phil-davis

Required fields - Alias Type

should be a required field. And this 1-char change can also be backported to RELENG_2_3. I noticed this while looking at GUI pages in 2.3.3
(cherry picked from commit 8ea10c11441b5aed0b10eb14038aa8f8adbfb3de)

Fix #7157

trafficgraph: Don't update the on screen visual graph while invisible,
which avoids creating a large queue of pending timer objects waiting
for the next requestAnimationFrame to happen.

Submitted by: PiBa-NL at https://github.com/pfsense/pfsense/pull/3450

Ticket #7157: Backport upstream fix from https://github.com/novus/nvd3/commit/305cbad96e94f61a3c0bae02d16c28e09249fbc0

Example of setting required items

(cherry picked from commit 32a85c63c9411463c98a0605772b3e2c01702971)

Require Name field in Shaper

(cherry picked from commit 40dcb4b61a2c1213a0b3e213c78fddac845a0117)

Revise setHelpText to accommodate required fields

Provide Javascript set_Required function

Provide CSS for required fields

Add "Required field" capability to Groups.class.php

status_upnp remove nested getext()

I don't think this does anything useful.
(cherry picked from commit 3224663a3759935b47406c789b9f5cea3eb88136)

Part fix #7233 keep correct staticmap_array_index

The index needs to be incremented even for entries that were skipped for display because they (for whatever reason) have no MAC or CID set. So use the key directly from the array.
(cherry picked from commit 9aa3c5e84984958caa19ac76ecba849b94a8b360)

Part Fix #7233 Allow deletion of empty static map entries
(cherry picked from commit 2ea70e1a474fd871a007c76841f2a33f34082c58)

diag_backup do not use button text for comparisons

(cherry picked from commit 9a7e1c9580c5779c86bc97d6d82c43401c7a4b12)

Rather than setting the value directly, minimize exposure to eval() in update_config_field() from wizard.php by constructing a variable reference, then set the value using the reference rather than passing user input through eval(). Fixes #7230

Convert easyrule.php to use a confirmation landing page so that the parameters can be submitted via POST. Also, remove the JavaScript confirmation box since it is now redundant. Fixes #7228
The confirmation page displays the submitted parameters for an extra user sanity check. Also fixed a bunch of page formatting issues that were not apparent because users rarely if ever saw output from the page.

interfaces_ppps_edit fixes that will work on 2.3.3 also

1) Make "The MTU is too big" message actually come out. The code around line 300 was rubbish (maybe from before bootstrap?).
2) Show friendly description rather than 'wan' 'lan' opt1' in interface link list....

Fix #7226 Package installation message is incomplete

This makes it remember pkgname after the install finishes and the form is re-submitted.
(cherry picked from commit d12bc864ceb5d656fc094bde7cf5ec96e24bdde9)

pkg_mgr_install remove embedded HTML from result strings
(cherry picked from commit 682008ff758b942d85ed007b485e0b2fa8e3a11c)

Encode the contents of pkg_filter before output. Fixes #7227

Encode 'from' and 'to' before output on pkg_mgr_install.php. Fixes #7225

Revert "setHelp formatting for interfaces.php"

This reverts commit e6068596baf4307fe3eb9866072800e4c23b6840.

setHelp formatting for interfaces.php

There was a fair bit of it, so I have put this in its own pull request.
1) Gets HTML out of the strings that go for translation.
2) Line 3365 - the words here about "hexadecimal" now go in the text directly in the setHelp so the translators will get access to them....

fbegin.inc and fend.inc obsolete

(cherry picked from commit 5af0922d75724e1eac89017173457f57842387f8)