From fef578578b0ee1b391c3d3c1331f3876e9ee347e Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Mon, 15 Mar 2021 12:56:14 +0300
Subject: [PATCH 01/29] log.widget.php: allow mutliple select

---
 src/www/widgets/widgets/log.widget.php | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/src/www/widgets/widgets/log.widget.php b/src/www/widgets/widgets/log.widget.php
index 06c25850d..c32017591 100644
--- a/src/www/widgets/widgets/log.widget.php
+++ b/src/www/widgets/widgets/log.widget.php
@@ -58,7 +58,7 @@ if (is_numeric($pconfig['filterlogentries'])) {
     }
 
     if (!empty($pconfig['filterlogentriesinterfaces'])) {
-        $config['widgets']['filterlogentriesinterfaces'] = $pconfig['filterlogentriesinterfaces'];
+        $config['widgets']['filterlogentriesinterfaces'] = implode(',', $pconfig['filterlogentriesinterfaces']);
     } elseif (isset($config['widgets']['filterlogentriesinterfaces'])) {
         unset($config['widgets']['filterlogentriesinterfaces']);
     }
@@ -82,8 +82,14 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
         const field_type_icons = {'pass': 'fa-play', 'block': 'fa-ban', 'rdr': 'fa-exchange', 'nat': 'fa-exchange'};
 
         var interface_descriptions = {};
+        var nentriesinterfaces =  "<?= $nentriesinterfaces ?>".split(",");
         ajaxGet('/api/diagnostics/interface/getInterfaceNames', {}, function(data, status) {
             interface_descriptions = data;
+            $.each(interface_descriptions, function(i_d, i_name){
+                $('#filterlogentriesinterfaces').append($.inArray(i_d, nentriesinterfaces) > -1 ? $('<option>', {value:i_d, text:i_name, selected: "selected" }) : $('<option>', {value:i_d, text:i_name }));
+            });
+            $('#filterlogentriesinterfaces').selectpicker('refresh');
+            fetch_log();
         });
         function fetch_log(){
             var record_spec = [];
@@ -107,14 +113,10 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
                 }
 
                 let record;
+                let showinterfaces = $("#filterlogentriesinterfaces").val();
                 while ((record=data.pop()) != null) {
                     var intf = record['interface'];
-
-                    if (interface_descriptions[record['interface']] != undefined) {
-                        intf = interface_descriptions[record['interface']].toLowerCase();
-                    }
-
-                    if ($("#filterlogentriesinterfaces").val() == "" || $("#filterlogentriesinterfaces").val() == intf) {
+                    if (showinterfaces.length == 0 || $.inArray(intf, showinterfaces) > -1) {
                         if ((filtact.length == 0 || filtact.indexOf(record['action']) !== -1) && record['__digest__'] != last_digest) {
                             var log_tr = $("<tr>");
                             log_tr.hide();
@@ -177,7 +179,6 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
             setTimeout(fetch_log, update_interval_ms);
         }
 
-        fetch_log();
     });
 </script>
 
@@ -199,13 +200,7 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
 <?php endfor ?>
           </select><br/>
           <label for="filterlogentriesinterfaces"><?= gettext('Interfaces to display:'); ?></label><br/>
-          <select id="filterlogentriesinterfaces" name="filterlogentriesinterfaces" class="selectpicker_widget">
-            <option value=""><?= gettext('All') ?></option>
-<?php foreach (get_configured_interface_with_descr() as $iface => $ifacename): ?>
-            <option value="<?= html_safe($iface) ?>" <?= $nentriesinterfaces == $iface ? 'selected="selected"' : '' ?>>
-              <?= html_safe($ifacename) ?>
-            </option>
-<?php endforeach ?>
+          <select id="filterlogentriesinterfaces" name="filterlogentriesinterfaces[]" class="selectpicker_widget" multiple="multiple" title=<?= gettext('All'); ?>>
           </select><br/><br/>
           <table style="width:348px">
             <tr>

From 6591404783f8ff0b5d4c52022cf9688d4e35f061 Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Mon, 15 Mar 2021 16:42:33 +0300
Subject: [PATCH 02/29] FF consistency

---
 src/www/widgets/widgets/log.widget.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/www/widgets/widgets/log.widget.php b/src/www/widgets/widgets/log.widget.php
index c32017591..8ad1ae668 100644
--- a/src/www/widgets/widgets/log.widget.php
+++ b/src/www/widgets/widgets/log.widget.php
@@ -75,7 +75,7 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
 
 ?>
 <script>
-    $(window).on("load", function() {
+    $("#dashboard_container").on("WidgetsReady", function() {
         // needed to display the widget settings menu
         $("#log-configure").removeClass("disabled");
         // icons

From a3f4d71940eddfaeb6d3306b99c185ca40c55c7f Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Thu, 25 Mar 2021 13:04:06 +0300
Subject: [PATCH 03/29] log.widget.php: add bs.popover and live view link

---
 src/www/widgets/widgets/log.widget.php | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/www/widgets/widgets/log.widget.php b/src/www/widgets/widgets/log.widget.php
index 8ad1ae668..a02c4a3df 100644
--- a/src/www/widgets/widgets/log.widget.php
+++ b/src/www/widgets/widgets/log.widget.php
@@ -128,13 +128,17 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
                                     case 'icon':
                                         var icon = field_type_icons[record[column_name]];
                                         if (icon != undefined) {
-                                            log_td.html('<i class="fa '+icon+'" aria-hidden="true"></i>');
+                                            // prepare popover content
+                                            let popContent = "@" + record.rulenr;
+                                            popContent += record.label.length > 0 ? " Label: " + record.label : '';
+                                            popContent += "<br><sub><?= gettext('click the Act icon to track this rule in Live View') ?></sub>"
+                                            log_td.html('<a target="_blank" href="/ui/diagnostics/firewall/log?rid=' + record.rid + '" type="button" data-toggle="popover" data-trigger="hover" \
+                                                        data-html="true" data-title="<?= gettext('Matched rule') ?>" data-content="' + popContent + '"><i class="fa ' + icon + '" aria-hidden="true"></i></a>');
                                             if (record[column_name] == 'pass') {
-                                                log_td.addClass('text-success');
+                                                log_td.find('a').addClass('text-success');
                                             } else {
-                                                log_td.addClass('text-danger');
+                                                log_td.find('a').addClass('text-danger');
                                             }
-
                                         }
                                         break;
                                     case 'time':
@@ -169,8 +173,16 @@ $nentriesinterfaces = isset($config['widgets']['filterlogentriesinterfaces']) ?
                         }
                     }
                 }
+                //hide popover before elem remove
+                $('[data-toggle="popover"]').popover('hide');
                 $("#filter-log-entries > tbody > tr:gt("+(parseInt($("#filterlogentries").val() - 1))+")").remove();
                 $("#filter-log-entries > tbody > tr").show();
+                //enable popover with full width for long descriptions
+                $('[data-toggle="popover"]').popover({
+                    container: 'body'
+                }).on('show.bs.popover', function() {
+                    $(this).data("bs.popover").tip().css("max-width", "100%")
+                });
             });
 
             // schedule next fetch

From fa44c69b86d628e2168a509ae1625ec01070bb8b Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Thu, 25 Mar 2021 22:42:57 +0300
Subject: [PATCH 04/29] fw_log.volt: get filters from url

---
 .../mvc/app/views/OPNsense/Diagnostics/fw_log.volt    | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
index 4124bf53d..9746034ea 100644
--- a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
+++ b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
@@ -393,6 +393,17 @@
             });
         });
 
+        // get and apply url params. ie11 compat
+        let urlvars = window.location.search.substring(1).split("&");
+        if (urlvars.length >= 1 && urlvars[0] !== "") {
+            urlvars.forEach(function(value) {
+                $("#filter_tag").val(value.split("=")[0]);
+                $("#filter_condition").val("=");
+                $("#filter_value").val(value.split("=")[1]);
+                $("#add_filter_condition").click();
+            });
+        }
+
         // startup poller
         poller();
     });

From 554fd23236e62a4ad0e44bf23dbd5320c17feb05 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 15 Mar 2021 19:45:31 +0100
Subject: [PATCH 05/29] Generic log handling: ignore garbled data in log lines,
 closes https://github.com/opnsense/core/issues/4830

---
 src/opnsense/site-python/log_helper.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/opnsense/site-python/log_helper.py b/src/opnsense/site-python/log_helper.py
index cc4a674f7..644c99c03 100644
--- a/src/opnsense/site-python/log_helper.py
+++ b/src/opnsense/site-python/log_helper.py
@@ -38,7 +38,7 @@ def reverse_log_reader(filename, block_size=81920, start_pos=None):
     :return: generator
     """
     if hasattr(filename, 'read') is False:
-        input_stream = open(filename, 'rU')
+        input_stream = open(filename, 'r', errors='replace')
     else:
         input_stream = filename
 

From aebeeb303925f6672e739a73039541989473a7d2 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Wed, 17 Mar 2021 18:42:16 +0100
Subject: [PATCH 06/29] System/Diagnostics/Activity: "C" missing on a single
 core cpu, add default for https://github.com/opnsense/core/pull/4835

---
 src/opnsense/scripts/systemhealth/activity.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/opnsense/scripts/systemhealth/activity.py b/src/opnsense/scripts/systemhealth/activity.py
index f71d39a91..bf11f6688 100755
--- a/src/opnsense/scripts/systemhealth/activity.py
+++ b/src/opnsense/scripts/systemhealth/activity.py
@@ -55,7 +55,7 @@ if __name__ == '__main__':
                 fieldnames = line.split()
             else:
                 tmp = line.split()
-                record = dict()
+                record = {'C': 0}
                 for field_id in range(len(fieldnames)):
                     fieldname = fieldnames[field_id]
                     if field_id == len(fieldnames)-1:

From e711a2e2cc3cef4c69886a7cd79f974b4ca0318e Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Wed, 17 Mar 2021 18:47:13 +0100
Subject: [PATCH 07/29] System/Diagnostics/Activity: "C" missing on a single
 core cpu, add default for https://github.com/opnsense/core/pull/4835 (take 2)

---
 src/opnsense/scripts/systemhealth/activity.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/opnsense/scripts/systemhealth/activity.py b/src/opnsense/scripts/systemhealth/activity.py
index bf11f6688..d839bff4a 100755
--- a/src/opnsense/scripts/systemhealth/activity.py
+++ b/src/opnsense/scripts/systemhealth/activity.py
@@ -55,7 +55,7 @@ if __name__ == '__main__':
                 fieldnames = line.split()
             else:
                 tmp = line.split()
-                record = {'C': 0}
+                record = {'C': '0'}
                 for field_id in range(len(fieldnames)):
                     fieldname = fieldnames[field_id]
                     if field_id == len(fieldnames)-1:

From 074919e3f550c0a467922d7a41b138e9bd49126a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20Inge=20Bols=C3=B8?=
 <61788597+knan-md@users.noreply.github.com>
Date: Thu, 18 Mar 2021 14:19:53 +0100
Subject: [PATCH 08/29] firmware/health.sh: refine missing/invalid signature
 message (#4840)

---
 src/opnsense/scripts/firmware/health.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/opnsense/scripts/firmware/health.sh b/src/opnsense/scripts/firmware/health.sh
index a463ac873..11dd4ae31 100755
--- a/src/opnsense/scripts/firmware/health.sh
+++ b/src/opnsense/scripts/firmware/health.sh
@@ -85,9 +85,9 @@ set_check()
 	fi
 
 	if [ ! -f ${FILE}.sig ]; then
-		echo "Cannot verify ${SET}: missing ${FILE}.sig" | ${TEE} ${LOCKFILE}
+		echo "Unverified consistency check for ${SET}: missing ${FILE}.sig" | ${TEE} ${LOCKFILE}
 	elif ! opnsense-verify -q ${FILE}; then
-		echo "Cannot verify ${SET}: invalid ${FILE}.sig" | ${TEE} ${LOCKFILE}
+		echo "Unverified consistency check for ${SET}: invalid ${FILE}.sig" | ${TEE} ${LOCKFILE}
 	fi
 
 	echo ">>> Check for missing or altered ${SET} files" | ${TEE} ${LOCKFILE}

From e16d8896917831c38a6cd7764c3ad7afb08f938e Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 18 Mar 2021 18:43:33 +0100
Subject: [PATCH 09/29] IPSec: add legacy validation to prevent saving of
 route-based tunnels with "install policy" set, since it will drop all traffic
 unintended

closes https://github.com/opnsense/core/issues/4838
---
 src/www/vpn_ipsec_phase1.php | 13 +++++++++++++
 src/www/vpn_ipsec_phase2.php | 14 ++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/src/www/vpn_ipsec_phase1.php b/src/www/vpn_ipsec_phase1.php
index 14228e6a0..d97b15a59 100644
--- a/src/www/vpn_ipsec_phase1.php
+++ b/src/www/vpn_ipsec_phase1.php
@@ -380,6 +380,19 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         }
     }
 
+
+    if (!empty($pconfig['ikeid']) && !empty($pconfig['installpolicy'])) {
+        foreach ($config['ipsec']['phase2'] as $phase2ent) {
+            if ($phase2ent['ikeid'] == $pconfig['ikeid'] && $phase2ent['mode'] == 'route-based') {
+                $input_errors[] = gettext(
+                    "Install policy on phase1 is not a valid option when using Route-based phase 2 entries."
+                );
+                break;
+            }
+        }
+    }
+
+
     if (count($input_errors) == 0) {
         $copy_fields = "ikeid,iketype,interface,mode,protocol,myid_type,myid_data
         ,peerid_type,peerid_data,encryption-algorithm,margintime,rekeyfuzz,inactivity_timeout
diff --git a/src/www/vpn_ipsec_phase2.php b/src/www/vpn_ipsec_phase2.php
index d4fcbe318..51d8c6301 100644
--- a/src/www/vpn_ipsec_phase2.php
+++ b/src/www/vpn_ipsec_phase2.php
@@ -344,6 +344,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         }
     }
 
+    if (!empty($pconfig['ikeid'])) {
+        foreach ($config['ipsec']['phase1'] as $phase1ent) {
+            if ($phase1ent['ikeid'] == $pconfig['ikeid'] &&
+                $pconfig['mode'] == 'route-based' &&
+                empty($phase1ent['noinstallpolicy'])
+            ) {
+                $input_errors[] = gettext(
+                    "Install policy on phase1 is not a valid option when using Route-based phase 2 entries."
+                );
+                break;
+            }
+        }
+    }
+
     /* For ESP protocol, handle encryption algorithms */
     if ($pconfig['protocol'] == "esp") {
         $ealgos = pconfig_to_ealgos($pconfig);

From b2f6cf581f0e8d3d64f98c84ad9b034fb0145628 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 18 Mar 2021 20:20:37 +0100
Subject: [PATCH 10/29] Services / DHCPv4 - static entries: add "none" option
 to gateway setting. Although I really don't like how "none" is a valid
 option, it will be more consistent with the overal experience. closes
 https://github.com/opnsense/core/issues/4843

---
 src/etc/inc/plugins.inc.d/dhcpd.inc | 2 +-
 src/www/services_dhcp_edit.php      | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/etc/inc/plugins.inc.d/dhcpd.inc b/src/etc/inc/plugins.inc.d/dhcpd.inc
index 57485f6e2..abc5ab737 100644
--- a/src/etc/inc/plugins.inc.d/dhcpd.inc
+++ b/src/etc/inc/plugins.inc.d/dhcpd.inc
@@ -1107,7 +1107,7 @@ EOD;
                     $dhcpdconf .= "  option root-path \"{$sm['rootpath']}\";\n";
                 }
 
-                if (!empty($sm['gateway']) && ($sm['gateway'] != $dhcpifconf['gateway'])) {
+                if (!empty($sm['gateway']) && $sm['gateway'] != "none" && ($sm['gateway'] != $dhcpifconf['gateway'])) {
                     $dhcpdconf .= "  option routers {$sm['gateway']};\n";
                 }
 
diff --git a/src/www/services_dhcp_edit.php b/src/www/services_dhcp_edit.php
index d4a7a2228..63df46fd7 100644
--- a/src/www/services_dhcp_edit.php
+++ b/src/www/services_dhcp_edit.php
@@ -164,7 +164,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
       }
     }
 
-    if (!empty($pconfig['gateway']) && !is_ipaddrv4($pconfig['gateway'])) {
+    if (!empty($pconfig['gateway']) && $pconfig['gateway'] != "none" && !is_ipaddrv4($pconfig['gateway'])) {
         $input_errors[] = gettext("A valid IP address must be specified for the gateway.");
     }
 
@@ -173,7 +173,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         $input_errors[] = gettext("A valid IP address must be specified for the primary/secondary WINS servers.");
     }
 
-    if (is_subnetv4($parent_net) && !empty($pconfig['gateway'])) {
+    if (is_subnetv4($parent_net) && $pconfig['gateway'] != "none" &&  !empty($pconfig['gateway'])) {
         if (!ip_in_subnet($pconfig['gateway'], $parent_net) && !ip_in_interface_alias_subnet($if, $pconfig['gateway'])) {
             $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet."), $_POST['gateway']);
         }
@@ -420,7 +420,9 @@ include("head.inc");
                   <td>
                     <input name="gateway" type="text" value="<?=$pconfig['gateway'];?>" />
                     <div class="hidden" data-for="help_for_gateway">
-                      <?=gettext("The default is to use the IP on this interface of the firewall as the gateway. Specify an alternate gateway here if this is not the correct gateway for your network.");?>
+                      <?=gettext('The default is to use the IP on this interface of the firewall as the gateway. '.
+                                 'Specify an alternate gateway here if this is not the correct gateway for your network. ' .
+                                 'Type "none" for no gateway assignment.');?>
                     </div>
                   </td>
                 </tr>

From 77d562f559c970df788863f55737cb01f8ee646a Mon Sep 17 00:00:00 2001
From: Greelan <53196309+Greelan@users.noreply.github.com>
Date: Fri, 19 Mar 2021 18:42:59 +1100
Subject: [PATCH 11/29] webgui: lighttpd include directory for configuration
 (#4837)

---
 src/etc/inc/plugins.inc.d/webgui.inc          |  5 ++-
 src/etc/lighttpd_webgui/conf.d/README         | 28 +++++++++++++++
 .../conf.d/extforward.conf.example            | 35 +++++++++++++++++++
 3 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 src/etc/lighttpd_webgui/conf.d/README
 create mode 100644 src/etc/lighttpd_webgui/conf.d/extforward.conf.example

diff --git a/src/etc/inc/plugins.inc.d/webgui.inc b/src/etc/inc/plugins.inc.d/webgui.inc
index 23b1dfbe5..624ede9d5 100644
--- a/src/etc/inc/plugins.inc.d/webgui.inc
+++ b/src/etc/inc/plugins.inc.d/webgui.inc
@@ -261,9 +261,12 @@ EOD;
 ## modules to load
 server.modules              =   (
   "mod_access", "mod_expire", "mod_deflate", "mod_redirect", "mod_setenv",
-  "mod_cgi", "mod_fastcgi","mod_alias", "mod_rewrite", "mod_openssl" {$lighty_modules}
+  "mod_cgi", "mod_fastcgi", "mod_alias", "mod_rewrite", "mod_openssl" {$lighty_modules}
 )
 
+## additional optional modules to load or additional module configurations
+$lighty_config .= "include \"/usr/local/etc/lighttpd_webgui/conf.d/*.conf\"\n";
+
 server.max-keep-alive-requests = 15
 server.max-keep-alive-idle = 30
 
diff --git a/src/etc/lighttpd_webgui/conf.d/README b/src/etc/lighttpd_webgui/conf.d/README
new file mode 100644
index 000000000..75e7dfbec
--- /dev/null
+++ b/src/etc/lighttpd_webgui/conf.d/README
@@ -0,0 +1,28 @@
+This directory allows the user to enable and configure additional lighttpd modules for the OPNsense webgui, or
+specify additional configurations for modules that are enabled already in /usr/local/etc/inc/plugins.d/webgui.inc
+
+Relevant lighttpd modules available: https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs#Modules
+
+The user can create and configure their own configuration files in this directory, or copy, rename and adapt example
+configurations already included in this directory
+
+To use the functionality of this directory:
+
+- create a suitably named file with the extension .conf in this directory, either by copying and renaming an example already included,
+  or creating your own
+
+- if necessary, enable the applicable lighttpd module in that file by including:
+
+    server.modules += ( "mod_[NAME]" )
+  
+  (for example: server.modules += ( "mod_extforward" )
+
+- specify the relevant configurations for the module, according to the lighttpd documentation
+
+In some cases, the order in which modules are enabled by lighttpd is important. Modules which gate requests
+(eg mod_access, mod_auth) or modify requests (eg mod_alias, mod_setenv) should be listed before modules which
+complete requests (eg mod_redirect, mod_rewrite), and which, in turn, should be listed before dynamic handlers
+(eg mod_cgi, mod_fastcgi, mod_proxy, mod_scgi, ...)
+
+To address this, you will need to ensure that the relevant configuration files appear in this directory in the
+right order. Begin the files with appropriate numbering (such as 01- and 02-) to achieve that
diff --git a/src/etc/lighttpd_webgui/conf.d/extforward.conf.example b/src/etc/lighttpd_webgui/conf.d/extforward.conf.example
new file mode 100644
index 000000000..0f21d4627
--- /dev/null
+++ b/src/etc/lighttpd_webgui/conf.d/extforward.conf.example
@@ -0,0 +1,35 @@
+#######################################################################
+##
+## This is an example configuration file for enabling and configuring
+## the mod_extforward module
+##
+## This module will extract the client's "real" IP from the relevant
+## header which is added by Squid or other proxies. It is useful for
+## logging the "real" IP of clients connecting to the OPNsense webgui
+## behind reverse proxy servers
+##
+## Options: https://redmine.lighttpd.net/projects/1/wiki/Docs_ModExtForward
+##
+
+##
+## Enable the mod_extforward module
+##
+server.modules += ( "mod_extforward" )
+
+##
+## Specify the headers to check. Default if not specified are
+## Forwarded-For and X-Forwarded-For headers
+##
+extforward.headers = ( "X-Forwarded-For", "Forwarded-For", "X-Real-IP" )
+
+##
+## Specify the trusted IPs of the reverse proxy server, comma separated
+## For example, to trust the IPs 10.0.0.1 and fd00:1234:abcd:efgh::1
+##
+extforward.forwarder = (                                                                
+  "10.0.0.1" => "trust",                                                         
+  "fd00:1234:abcd:efgh::1" => "trust"                                 
+)
+
+##
+#######################################################################

From 24cca59e45ec37564280e1c788e3f17015d47b87 Mon Sep 17 00:00:00 2001
From: Greelan <53196309+Greelan@users.noreply.github.com>
Date: Fri, 19 Mar 2021 22:18:48 +1100
Subject: [PATCH 12/29] webgui.inc: fix syntax error (#4845)

---
 src/etc/inc/plugins.inc.d/webgui.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/etc/inc/plugins.inc.d/webgui.inc b/src/etc/inc/plugins.inc.d/webgui.inc
index 624ede9d5..c692ca149 100644
--- a/src/etc/inc/plugins.inc.d/webgui.inc
+++ b/src/etc/inc/plugins.inc.d/webgui.inc
@@ -264,8 +264,8 @@ server.modules              =   (
   "mod_cgi", "mod_fastcgi", "mod_alias", "mod_rewrite", "mod_openssl" {$lighty_modules}
 )
 
-## additional optional modules to load or additional module configurations
-$lighty_config .= "include \"/usr/local/etc/lighttpd_webgui/conf.d/*.conf\"\n";
+# additional optional modules to load or additional module configurations
+include "/usr/local/etc/lighttpd_webgui/conf.d/*.conf"
 
 server.max-keep-alive-requests = 15
 server.max-keep-alive-idle = 30

From 74109d6a8696a6dec4a426f72cadac0292ec2cbb Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Fri, 19 Mar 2021 20:58:59 +0300
Subject: [PATCH 13/29] opnsense_legacy.js: toString before split (#4846)

---
 src/www/javascript/opnsense_legacy.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/www/javascript/opnsense_legacy.js b/src/www/javascript/opnsense_legacy.js
index 5d67dc3f6..ef76c99c8 100644
--- a/src/www/javascript/opnsense_legacy.js
+++ b/src/www/javascript/opnsense_legacy.js
@@ -191,7 +191,7 @@ function hook_firewall_categories() {
             let category_count = {};
             $(".rule").each(function(){
                 let row = $(this);
-                $(this).data('category').split(',').forEach(function(item){
+                $(this).data('category').toString().split(',').forEach(function(item){
                     if (category_count[item] === undefined) {
                         category_count[item] = 0 ;
                     }
@@ -242,7 +242,7 @@ function hook_firewall_categories() {
             let no_cat = cat_select.find("option")[0].value;
             $(".rule").each(function(){
                 let is_selected = false;
-                $(this).data('category').split(',').forEach(function(item){
+                $(this).data('category').toString().split(',').forEach(function(item){
                     if (selected_values.indexOf(no_cat) > -1 && item === "") {
                         // No category for this rule
                         is_selected = true;

From 8fed972fafd5172aef2901bf292fb81141db8941 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Sat, 20 Mar 2021 14:18:00 +0100
Subject: [PATCH 14/29] system: whitespace sweep and plist fix

---
 plist                                                  | 2 ++
 src/etc/lighttpd_webgui/conf.d/README                  | 2 +-
 src/etc/lighttpd_webgui/conf.d/extforward.conf.example | 6 +++---
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/plist b/plist
index 7fc38f33d..d50c93539 100644
--- a/plist
+++ b/plist
@@ -59,6 +59,8 @@
 /usr/local/etc/inc/xmlrpc/test.inc
 /usr/local/etc/ipsec.opnsense.d/README
 /usr/local/etc/ipsec.secrets.opnsense.d/README
+/usr/local/etc/lighttpd_webgui/conf.d/README
+/usr/local/etc/lighttpd_webgui/conf.d/extforward.conf.example
 /usr/local/etc/netflow.conf.example
 /usr/local/etc/pkg/fingerprints/OPNsense/revoked/opnsense-update.deciso.com.20160725
 /usr/local/etc/pkg/fingerprints/OPNsense/revoked/opnsense-update.deciso.com.20170721
diff --git a/src/etc/lighttpd_webgui/conf.d/README b/src/etc/lighttpd_webgui/conf.d/README
index 75e7dfbec..fa8a7f8a8 100644
--- a/src/etc/lighttpd_webgui/conf.d/README
+++ b/src/etc/lighttpd_webgui/conf.d/README
@@ -14,7 +14,7 @@ To use the functionality of this directory:
 - if necessary, enable the applicable lighttpd module in that file by including:
 
     server.modules += ( "mod_[NAME]" )
-  
+
   (for example: server.modules += ( "mod_extforward" )
 
 - specify the relevant configurations for the module, according to the lighttpd documentation
diff --git a/src/etc/lighttpd_webgui/conf.d/extforward.conf.example b/src/etc/lighttpd_webgui/conf.d/extforward.conf.example
index 0f21d4627..ea28b7433 100644
--- a/src/etc/lighttpd_webgui/conf.d/extforward.conf.example
+++ b/src/etc/lighttpd_webgui/conf.d/extforward.conf.example
@@ -26,9 +26,9 @@ extforward.headers = ( "X-Forwarded-For", "Forwarded-For", "X-Real-IP" )
 ## Specify the trusted IPs of the reverse proxy server, comma separated
 ## For example, to trust the IPs 10.0.0.1 and fd00:1234:abcd:efgh::1
 ##
-extforward.forwarder = (                                                                
-  "10.0.0.1" => "trust",                                                         
-  "fd00:1234:abcd:efgh::1" => "trust"                                 
+extforward.forwarder = (
+  "10.0.0.1" => "trust",
+  "fd00:1234:abcd:efgh::1" => "trust"
 )
 
 ##

From 93326c718ac3df023a9d2fe43880419abe1e05a3 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Sun, 21 Mar 2021 15:30:49 +0100
Subject: [PATCH 15/29] system: USB serial may not work with onifconsole #4849

---
 src/etc/inc/system.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index 7dd7e8a41..dd522b675 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -1170,7 +1170,7 @@ function system_login_configure($verbose = false)
     /* setup /etc/ttys */
     $etc_ttys_lines = explode("\n", file_get_contents('/etc/ttys'));
     $fd = fopen('/etc/ttys', 'w');
-    $on_off_secure_u = $serial_enabled ? 'onifconsole secure' : 'off secure';
+    $on_off_secure_u = $serial_enabled ? (isset($config['system']['serialusb']) ? 'on' : 'onifconsole') . ' secure' : 'off secure';
     $on_off_secure_v = $virtual_enabled ? 'onifexists secure' : 'off secure';
     if (isset($config['system']['disableconsolemenu'])) {
         $console_type = 'Pc';

From 9fb53f5475a50fb48f90ffc6cd5cb3dcb38173e7 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Sun, 21 Mar 2021 20:10:45 +0100
Subject: [PATCH 16/29] IPSec: prepend keyid: to enforce type on
 rightid|leftid, ref https://forum.opnsense.org/index.php?topic=22197

---
 src/etc/inc/plugins.inc.d/ipsec.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/etc/inc/plugins.inc.d/ipsec.inc b/src/etc/inc/plugins.inc.d/ipsec.inc
index 86abaa91b..828365b0d 100644
--- a/src/etc/inc/plugins.inc.d/ipsec.inc
+++ b/src/etc/inc/plugins.inc.d/ipsec.inc
@@ -811,6 +811,9 @@ function ipsec_find_id(&$ph1ent, $side = 'local')
         case "peeraddress":
             $thisid_data = ipsec_resolve($ph1ent['remote-gateway']);
             break;
+        case "keyid tag":
+            $thisid_data = !empty($id_data) ? "keyid:{$id_data}" : null;
+            break;
         default:
             $thisid_data = !empty($id_data) ? "{$id_data}" : null;
             break;

From 7c3646b878c5fe1e13cfce99ff271181a9d31454 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 22 Mar 2021 10:34:35 +0100
Subject: [PATCH 17/29] Reporting / Traffic (+dashboard widget): format 24hour
 timestamps, closes https://github.com/opnsense/core/issues/4852

---
 .../views/OPNsense/Diagnostics/traffic.volt   | 36 +++++++++++++++----
 .../widgets/widgets/traffic_graphs.widget.php | 18 ++++++++--
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
index 3ee3d6bf4..7257f6601 100644
--- a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
+++ b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
@@ -99,6 +99,14 @@ POSSIBILITY OF SUCH DAMAGE.
                       scales: {
                           xAxes: [{
                               type: 'realtime',
+                              time: {
+                                  unit: 'second',
+                                  minUnit: 'seconds',
+                                  displayFormats: {
+                                      second: 'HH:mm:ss',
+                                      minute: 'HH:mm:ss'
+                                  }
+                              },
                               realtime: {
                                   duration: 20000,
                                   refresh: 2000,
@@ -119,7 +127,13 @@ POSSIBILITY OF SUCH DAMAGE.
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  return ds.label + " : " + format_field(ds.data[tooltipItem.index].y).toString();
+                                  if (ds.data[tooltipItem.index].y) {
+                                      return moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss') + " : " +
+                                             format_field(ds.data[tooltipItem.index].y).toString();
+                                  }
+                              },
+                              title: function(tooltipItem, data) {
+                                  return "";
                               }
                           }
                       },
@@ -182,6 +196,14 @@ POSSIBILITY OF SUCH DAMAGE.
                       scales: {
                           xAxes: [{
                               type: 'realtime',
+                              time: {
+                                  unit: 'second',
+                                  minUnit: 'seconds',
+                                  displayFormats: {
+                                      second: 'HH:mm:ss',
+                                      minute: 'HH:mm:ss'
+                                  }
+                              },
                               realtime: {
                                   duration: 40000,
                                   refresh: 3000,
@@ -202,11 +224,13 @@ POSSIBILITY OF SUCH DAMAGE.
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  return [
-                                    tooltipItem.xLabel,
-                                    ds.label + " : " + ds.data[tooltipItem.index].address,
-                                    "@ " + format_field(ds.data[tooltipItem.index].y).toString()
-                                  ];
+                                  if (ds.data[tooltipItem.index].y) {
+                                      return [
+                                        moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss'),
+                                        ds.label + " : " + ds.data[tooltipItem.index].address,
+                                        "@ " + format_field(ds.data[tooltipItem.index].y).toString()
+                                      ];
+                                  }
                               }
                           }
                       },
diff --git a/src/www/widgets/widgets/traffic_graphs.widget.php b/src/www/widgets/widgets/traffic_graphs.widget.php
index 0ef402528..17c9ffac8 100644
--- a/src/www/widgets/widgets/traffic_graphs.widget.php
+++ b/src/www/widgets/widgets/traffic_graphs.widget.php
@@ -118,6 +118,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                       scales: {
                           xAxes: [{
                               type: 'realtime',
+                              time: {
+                                  unit: 'second',
+                                  minUnit: 'seconds',
+                                  displayFormats: {
+                                      second: 'HH:mm:ss',
+                                      minute: 'HH:mm:ss'
+                                  }
+                              },
                               realtime: {
                                   duration: 50000,
                                   refresh: 5000,
@@ -138,8 +146,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  return ds.label + " : " + format_field(ds.data[tooltipItem.index].y).toString();
-                              }
+                                  if (ds.data[tooltipItem.index].y) {
+                                      return moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss') + " : " +
+                                             format_field(ds.data[tooltipItem.index].y).toString();
+                                  }
+                              },
+                              title: function(tooltipItem, data) {
+                                  return "";
+                              },
                           }
                       },
                       hover: {

From fedfee57d4af94175e1556776d3575326b227d88 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 22 Mar 2021 13:29:18 +0100
Subject: [PATCH 18/29] Services / DHCPv4: with the removal of a validation for
 static entries in https://github.com/opnsense/core/pull/4447 forgot to check
 the dhcp settings page for additional ones. closes
 https://github.com/opnsense/core/issues/4855

---
 src/www/services_dhcp.php | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/src/www/services_dhcp.php b/src/www/services_dhcp.php
index 88c0a79a6..577d107b4 100644
--- a/src/www/services_dhcp.php
+++ b/src/www/services_dhcp.php
@@ -383,19 +383,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                 $input_errors[] = sprintf(gettext("You must disable the DHCP relay on the %s interface before enabling the DHCP server."),
                                   !empty($config['interfaces'][$if]['descr']) ? htmlspecialchars($config['interfaces'][$if]['descr']) : strtoupper($if));
             }
-
-            $dynsubnet_start = ip2ulong($pconfig['range_from']);
-            $dynsubnet_end = ip2ulong($pconfig['range_to']);
-            foreach ($a_maps as $map) {
-                if (empty($map['ipaddr'])) {
-                    continue;
-                }
-                if ((ip2ulong($map['ipaddr']) > $dynsubnet_start) &&
-                  (ip2ulong($map['ipaddr']) < $dynsubnet_end)) {
-                    $input_errors[] = sprintf(gettext("The DHCP range cannot overlap any static DHCP mappings."));
-                    break;
-                }
-            }
         }
         // save data
         if (count($input_errors) == 0) {

From b3f1179863005e4b88b736b5b4b434e18bcf6ee2 Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Mon, 22 Mar 2021 19:13:57 +0300
Subject: [PATCH 19/29] Reporting / Traffic (+dashboard widget): 24H format
 alternative (#4857)

---
 .../views/OPNsense/Diagnostics/traffic.volt   | 30 ++++++++-----------
 .../widgets/widgets/traffic_graphs.widget.php | 16 ++++------
 2 files changed, 17 insertions(+), 29 deletions(-)

diff --git a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
index 7257f6601..78a0d996b 100644
--- a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
+++ b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/traffic.volt
@@ -98,15 +98,16 @@ POSSIBILITY OF SUCH DAMAGE.
                       maintainAspectRatio: false,
                       scales: {
                           xAxes: [{
-                              type: 'realtime',
                               time: {
+                                  tooltipFormat:'HH:mm:ss',
                                   unit: 'second',
-                                  minUnit: 'seconds',
+                                  minUnit: 'second',
                                   displayFormats: {
                                       second: 'HH:mm:ss',
                                       minute: 'HH:mm:ss'
                                   }
                               },
+                              type: 'realtime',
                               realtime: {
                                   duration: 20000,
                                   refresh: 2000,
@@ -127,13 +128,7 @@ POSSIBILITY OF SUCH DAMAGE.
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  if (ds.data[tooltipItem.index].y) {
-                                      return moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss') + " : " +
-                                             format_field(ds.data[tooltipItem.index].y).toString();
-                                  }
-                              },
-                              title: function(tooltipItem, data) {
-                                  return "";
+                                  return ds.label + " : " + format_field(ds.data[tooltipItem.index].y).toString();
                               }
                           }
                       },
@@ -195,15 +190,16 @@ POSSIBILITY OF SUCH DAMAGE.
                       maintainAspectRatio: false,
                       scales: {
                           xAxes: [{
-                              type: 'realtime',
                               time: {
+                                  tooltipFormat:'HH:mm:ss',
                                   unit: 'second',
-                                  minUnit: 'seconds',
+                                  minUnit: 'second',
                                   displayFormats: {
                                       second: 'HH:mm:ss',
                                       minute: 'HH:mm:ss'
                                   }
                               },
+                              type: 'realtime',
                               realtime: {
                                   duration: 40000,
                                   refresh: 3000,
@@ -224,13 +220,11 @@ POSSIBILITY OF SUCH DAMAGE.
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  if (ds.data[tooltipItem.index].y) {
-                                      return [
-                                        moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss'),
-                                        ds.label + " : " + ds.data[tooltipItem.index].address,
-                                        "@ " + format_field(ds.data[tooltipItem.index].y).toString()
-                                      ];
-                                  }
+                                  return [
+                                    tooltipItem.xLabel,
+                                    ds.label + " : " + ds.data[tooltipItem.index].address,
+                                    "@ " + format_field(ds.data[tooltipItem.index].y).toString()
+                                  ];
                               }
                           }
                       },
diff --git a/src/www/widgets/widgets/traffic_graphs.widget.php b/src/www/widgets/widgets/traffic_graphs.widget.php
index 17c9ffac8..5e57b2770 100644
--- a/src/www/widgets/widgets/traffic_graphs.widget.php
+++ b/src/www/widgets/widgets/traffic_graphs.widget.php
@@ -117,15 +117,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                       maintainAspectRatio: false,
                       scales: {
                           xAxes: [{
-                              type: 'realtime',
                               time: {
+                                  tooltipFormat:'HH:mm:ss',
                                   unit: 'second',
-                                  minUnit: 'seconds',
+                                  minUnit: 'second',
                                   displayFormats: {
                                       second: 'HH:mm:ss',
-                                      minute: 'HH:mm:ss'
                                   }
                               },
+                              type: 'realtime',
                               realtime: {
                                   duration: 50000,
                                   refresh: 5000,
@@ -146,14 +146,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                           callbacks: {
                               label: function(tooltipItem, data) {
                                   let ds = data.datasets[tooltipItem.datasetIndex];
-                                  if (ds.data[tooltipItem.index].y) {
-                                      return moment.unix(ds.data[tooltipItem.index].x/1000).format('HH:mm:ss') + " : " +
-                                             format_field(ds.data[tooltipItem.index].y).toString();
-                                  }
-                              },
-                              title: function(tooltipItem, data) {
-                                  return "";
-                              },
+                                  return ds.label + " : " + format_field(ds.data[tooltipItem.index].y).toString();
+                              }
                           }
                       },
                       hover: {

From fda1e024f223c9619f95ea7995ad7167d03cff85 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 22 Mar 2021 17:20:09 +0100
Subject: [PATCH 20/29] Reporting / Traffic (+dashboard widget): missed a spot
 in https://github.com/opnsense/core/pull/4857

---
 src/www/widgets/widgets/traffic_graphs.widget.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/www/widgets/widgets/traffic_graphs.widget.php b/src/www/widgets/widgets/traffic_graphs.widget.php
index 5e57b2770..93e63c2ce 100644
--- a/src/www/widgets/widgets/traffic_graphs.widget.php
+++ b/src/www/widgets/widgets/traffic_graphs.widget.php
@@ -123,6 +123,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                                   minUnit: 'second',
                                   displayFormats: {
                                       second: 'HH:mm:ss',
+                                      minute: 'HH:mm:ss'
                                   }
                               },
                               type: 'realtime',

From 3fe7b5f060d7a3bfd26475fd8ab78e47b0f0675b Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Tue, 23 Mar 2021 20:04:40 +0100
Subject: [PATCH 21/29] firewall: resolve IPs in kernel for force gw rule

PR: https://forum.opnsense.org/index.php?topic=22214.0
---
 src/etc/inc/filter.lib.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/etc/inc/filter.lib.inc b/src/etc/inc/filter.lib.inc
index 43c84587d..a7d0a6d68 100644
--- a/src/etc/inc/filter.lib.inc
+++ b/src/etc/inc/filter.lib.inc
@@ -607,7 +607,7 @@ function filter_core_rules_system($fw, $defaults)
                     if (($gwproto == 'inet' && $intf_has_v4) || ($gwproto == 'inet6' && $intf_has_v6)) {
                         $fw->registerFilterRule(
                             100000,
-                            array('from' => $ifcfg['if'], 'direction' => 'out', 'gateway' => $gwname,
+                            array('from' => "({$ifcfg['if']})", 'direction' => 'out', 'gateway' => $gwname,
                             'destination' => array('network' => $ifdescr, "not" => true),
                             'statetype' => 'keep',
                             'allowopts' => true,

From 6923424818a219571db3ff721cc857c1aba99555 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Wed, 24 Mar 2021 11:51:25 +0100
Subject: [PATCH 22/29] Service control: while working on
 https://github.com/opnsense/core/issues/4834 noticed that it's currently not
 possible to prevent "stop" actions from being displayed when fetrching the
 service stattus. Although the best option would probably be to enforce
 services from being specific on how they want to be stopped, currently there
 seem to be quite some services omitting a "stop" command.

This commit adds support for "locked" in service to signal the ui that a stop action is prohibited.
---
 src/www/guiconfig.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/www/guiconfig.inc b/src/www/guiconfig.inc
index 1c39affdc..db952e204 100644
--- a/src/www/guiconfig.inc
+++ b/src/www/guiconfig.inc
@@ -597,7 +597,7 @@ function service_control_links($service, $xs = false)
             gettext("restart service"),
             'fa fa-refresh fa-fw'
         );
-        if (empty($service['nocheck'])) {
+        if (empty($service['nocheck']) && empty($service['locked'])) {
             $output .= sprintf(
                 $template,
                 $service_id,

From 8af2147e9c8d26be26c8e5d2ffcd0a03686778ce Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Wed, 24 Mar 2021 13:41:21 +0100
Subject: [PATCH 23/29] XML-RPC (HA-Sync) - add missing configuration sections.
 closes https://github.com/opnsense/core/issues/4834

o while here add "services" attribute for future use, so we can track related services
o add missing service controls: routing, tunables, cron, webgui (so we can remove service callouts in filter_configure_xmlrpc() at a later stage)
---
 src/etc/inc/plugins.inc                |  5 ++
 src/etc/inc/plugins.inc.d/core.inc     | 94 ++++++++++++++++++++++++++
 src/etc/inc/plugins.inc.d/dnsmasq.inc  |  1 +
 src/etc/inc/plugins.inc.d/ipfw.inc     |  2 +
 src/etc/inc/plugins.inc.d/ipsec.inc    |  1 +
 src/etc/inc/plugins.inc.d/monit.inc    |  1 +
 src/etc/inc/plugins.inc.d/netflow.inc  | 17 +++++
 src/etc/inc/plugins.inc.d/openssh.inc  | 18 +++++
 src/etc/inc/plugins.inc.d/openvpn.inc  |  1 +
 src/etc/inc/plugins.inc.d/pf.inc       |  1 +
 src/etc/inc/plugins.inc.d/squid.inc    |  1 +
 src/etc/inc/plugins.inc.d/suricata.inc |  1 +
 src/etc/inc/plugins.inc.d/unbound.inc  |  1 +
 13 files changed, 144 insertions(+)

diff --git a/src/etc/inc/plugins.inc b/src/etc/inc/plugins.inc
index 7d1d93f7f..4aa5aed9e 100644
--- a/src/etc/inc/plugins.inc
+++ b/src/etc/inc/plugins.inc
@@ -336,6 +336,11 @@ function plugins_xmlrpc_sync()
                     if (empty($helper['help'])) {
                         $sync_settings[$helper['id']]['help'] = sprintf(gettext('Synchronize the %s configuration to the other HA host.'), $helper['description']);
                     }
+                    if (empty($helper['services'])) {
+                        $sync_settings[$helper['id']]['services'] = [];
+                    } elseif (!is_array($helper['services'])) {
+                        $sync_settings[$helper['id']]['services'] = [$helper['services']];
+                    }
                     unset($sync_settings[$helper['id']]['id']);
                 }
             }
diff --git a/src/etc/inc/plugins.inc.d/core.inc b/src/etc/inc/plugins.inc.d/core.inc
index 971483633..f99628cde 100644
--- a/src/etc/inc/plugins.inc.d/core.inc
+++ b/src/etc/inc/plugins.inc.d/core.inc
@@ -79,6 +79,32 @@ function core_services()
         'name' => 'login',
     );
 
+    $services[] = array(
+        'description' => gettext('System routing'),
+        'php' => array(
+            "restart" => array('system_routing_configure')
+        ),
+        'nocheck' => true,
+        'name' => 'routing',
+    );
+
+    $services[] = array(
+        'description' => gettext('System tunables'),
+        'php' => array(
+            "restart" => array('system_sysctl_configure')
+        ),
+        'nocheck' => true,
+        'name' => 'sysctl',
+    );
+
+    $services[] = array(
+        'description' => gettext('Cron'),
+        'php' => array(
+            "restart" => array('system_cron_configure')
+        ),
+        'name' => 'cron',
+    );
+
     if (empty($config['syslog']['disable_clog'])) {
         $services[] = array(
             'description' => gettext('Legacy Syslog Daemon'),
@@ -103,6 +129,16 @@ function core_services()
         'name' => 'syslog-ng',
     );
 
+    $services[] = array(
+        'pidfile' => '/var/run/lighty-webConfigurator.pid',
+        'description' => gettext('WebGui'),
+        'configd' => array(
+            'restart' => array('webgui restart')
+        ),
+        'locked' => true,
+        'name' => 'webgui',
+    );
+
     return $services;
 }
 
@@ -261,12 +297,14 @@ function core_xmlrpc_sync()
         'help' => gettext('Synchronize the users and groups over to the other HA host.'),
         'section' => 'system.user,system.group',
         'id' => 'users',
+        'services' => ["login"],
     );
     $result[] = array(
         'description' => gettext('Auth Servers'),
         'help' => gettext('Synchronize the authentication servers (e.g. LDAP, RADIUS) over to the other HA host.'),
         'section' => 'system.authserver',
         'id' => 'authservers',
+        'services' => ["login"],
     );
     $result[] = array(
         'description' => gettext('Certificates'),
@@ -279,30 +317,59 @@ function core_xmlrpc_sync()
         'help' => gettext('Synchronize the firewall rules to the other HA host.'),
         'section' => 'filter',
         'id' => 'rules',
+        'services' => ["pf"],
     );
     $result[] = array(
         'description' => gettext('Firewall Schedules'),
         'help' => gettext('Synchronize the firewall schedules to the other HA host.'),
         'section' => 'schedules',
         'id' => 'schedules',
+        'services' => ["pf"],
+    );
+    $result[] = array(
+        'description' => gettext('Firewall Categories'),
+        'section' => 'OPNsense.Firewall.Category',
+        'id' => 'categories'
     );
     $result[] = array(
         'description' => gettext('Aliases'),
         'help' => gettext('Synchronize the aliases over to the other HA host.'),
         'section' => 'OPNsense.Firewall.Alias',
         'id' => 'aliases',
+        'services' => ["pf"],
     );
     $result[] = array(
         'description' => gettext('NAT'),
         'help' => gettext('Synchronize the NAT rules over to the other HA host.'),
         'section' => 'nat',
         'id' => 'nat',
+        'services' => ["pf"],
     );
     $result[] = array(
         'description' => gettext('DHCPD'),
         'help' => gettext('Synchronize the DHCP Server settings over to the other HA host. This only applies to DHCP for IPv4.'),
         'section' => 'dhcpd',
         'id' => 'dhcpd',
+        'services' => ["dhcpd"],
+    );
+    $result[] = array(
+        'description' => gettext('DHCPv4: Relay'),
+        'section' => 'dhcrelay',
+        'id' => 'dhcrelay',
+        'services' => ["dhcrelay"],
+    );
+    $result[] = array(
+        'description' => gettext('DHCPDv6'),
+        'help' => gettext('Synchronize DHCPv6 including router advertisements.'),
+        'section' => 'dhcpdv6',
+        'id' => 'dhcpdv6',
+        'services' => ["dhcpdv6", "radvd"],
+    );
+    $result[] = array(
+        'description' => gettext('DHCPv6: Relay'),
+        'section' => 'dhcrelay6',
+        'id' => 'dhcrelay6',
+        'services' => ["dhcrelay6"],
     );
     $result[] = array(
         'description' => gettext('Virtual IPs'),
@@ -315,12 +382,39 @@ function core_xmlrpc_sync()
         'help' => gettext('Synchronize the Static Route configuration and Gateways to the other HA host.'),
         'section' => 'staticroutes,gateways',
         'id' => 'staticroutes',
+        'services' => ["routing"],
     );
     $result[] = array(
         'description' => gettext('Network Time'),
         'section' => 'ntpd,system.timeservers',
         'id' => 'ntpd',
+        'services' => ["ntpd"],
     );
+    $result[] = array(
+        'description' => gettext('Syslog'),
+        'section' => 'syslog,OPNsense.Syslog',
+        'id' => 'syslog',
+        'services' => ["syslogd"],
+    );
+    $result[] = array(
+        'description' => gettext('Cron'),
+        'section' => 'OPNsense.cron',
+        'id' => 'cron',
+        'services' => ["cron"],
+    );
+    $result[] = array(
+        'description' => gettext('System Tunables'),
+        'section' => 'sysctl',
+        'id' => 'sysctl',
+        'services' => ["sysctl"],
+    );
+    $result[] = array(
+        'description' => gettext('WebGui'),
+        'section' => 'system.webgui',
+        'id' => 'webgui',
+        'services' => ["webgui"],
+    );
+
     return $result;
 }
 
diff --git a/src/etc/inc/plugins.inc.d/dnsmasq.inc b/src/etc/inc/plugins.inc.d/dnsmasq.inc
index 5082ce352..69c90ee08 100644
--- a/src/etc/inc/plugins.inc.d/dnsmasq.inc
+++ b/src/etc/inc/plugins.inc.d/dnsmasq.inc
@@ -81,6 +81,7 @@ function dnsmasq_xmlrpc_sync()
         'description' => gettext('Dnsmasq DNS'),
         'section' => 'dnsmasq',
         'id' => 'dnsforwarder',
+        'services' => ["dnsmasq"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/ipfw.inc b/src/etc/inc/plugins.inc.d/ipfw.inc
index e406501e2..faa8dae6d 100644
--- a/src/etc/inc/plugins.inc.d/ipfw.inc
+++ b/src/etc/inc/plugins.inc.d/ipfw.inc
@@ -56,11 +56,13 @@ function ipfw_xmlrpc_sync()
         'description' => gettext('Shaper'),
         'section' => 'OPNsense.TrafficShaper',
         'id' => 'shaper',
+        'services' => ["ipfw"],
     );
     $result[] = array(
         'description' => gettext('Captive Portal'),
         'section' => 'OPNsense.captiveportal',
         'id' => 'captiveportal',
+        'services' => ["ipfw"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/ipsec.inc b/src/etc/inc/plugins.inc.d/ipsec.inc
index 828365b0d..f45c2d29e 100644
--- a/src/etc/inc/plugins.inc.d/ipsec.inc
+++ b/src/etc/inc/plugins.inc.d/ipsec.inc
@@ -333,6 +333,7 @@ function ipsec_xmlrpc_sync()
         'description' => gettext('IPsec'),
         'section' => 'ipsec',
         'id' => 'ipsec',
+        'services' => ["strongswan"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/monit.inc b/src/etc/inc/plugins.inc.d/monit.inc
index 508cacb48..7ee6f8787 100644
--- a/src/etc/inc/plugins.inc.d/monit.inc
+++ b/src/etc/inc/plugins.inc.d/monit.inc
@@ -65,6 +65,7 @@ function monit_xmlrpc_sync()
         'description' => gettext('Monit System Monitoring'),
         'section' => 'OPNsense.monit',
         'id' => 'monit',
+        'services' => ["monit"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/netflow.inc b/src/etc/inc/plugins.inc.d/netflow.inc
index a3ff3f534..d323f0a9b 100644
--- a/src/etc/inc/plugins.inc.d/netflow.inc
+++ b/src/etc/inc/plugins.inc.d/netflow.inc
@@ -73,3 +73,20 @@ function netflow_services()
 
     return $services;
 }
+
+/**
+ *  sync configuration via xmlrpc
+ * @return array
+ */
+function netflow_xmlrpc_sync()
+{
+    $result = [];
+    $result[] = array(
+        'description' => gettext('Netflow / Insight'),
+        'section' => 'OPNsense.Netflow',
+        'id' => 'syslog',
+        'services' => ["samplicate", "flowd_aggregate"],
+    );
+
+    return $result;
+}
diff --git a/src/etc/inc/plugins.inc.d/openssh.inc b/src/etc/inc/plugins.inc.d/openssh.inc
index 6a602ba5c..a6a52ee87 100644
--- a/src/etc/inc/plugins.inc.d/openssh.inc
+++ b/src/etc/inc/plugins.inc.d/openssh.inc
@@ -63,6 +63,24 @@ function openssh_services()
     return $services;
 }
 
+/**
+ *  sync configuration via xmlrpc
+ * @return array
+ */
+function openssh_xmlrpc_sync()
+{
+    $result = [];
+    $result[] = array(
+        'description' => gettext('OpenSSH'),
+        'section' => 'system.ssh',
+        'id' => 'ssh',
+        'services' => ["openssh"],
+    );
+
+    return $result;
+}
+
+
 function openssh_stop()
 {
     /* if run from a shell session, `-af' and the full path is needed */
diff --git a/src/etc/inc/plugins.inc.d/openvpn.inc b/src/etc/inc/plugins.inc.d/openvpn.inc
index 107f0e696..ca1ed0e2f 100644
--- a/src/etc/inc/plugins.inc.d/openvpn.inc
+++ b/src/etc/inc/plugins.inc.d/openvpn.inc
@@ -110,6 +110,7 @@ function openvpn_xmlrpc_sync()
         'description' => gettext('OpenVPN'),
         'section' => 'openvpn',
         'id' => 'openvpn',
+        'services' => ["openvpn"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/pf.inc b/src/etc/inc/plugins.inc.d/pf.inc
index 47b24ebb3..193f07cb3 100644
--- a/src/etc/inc/plugins.inc.d/pf.inc
+++ b/src/etc/inc/plugins.inc.d/pf.inc
@@ -178,6 +178,7 @@ function pf_xmlrpc_sync()
         'description' => gettext('Firewall Groups'),
         'section' => 'ifgroups.ifgroupentry',
         'id' => 'ifgroups',
+        'services' => ["pf"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/squid.inc b/src/etc/inc/plugins.inc.d/squid.inc
index fdb4fe1c5..cb6574362 100644
--- a/src/etc/inc/plugins.inc.d/squid.inc
+++ b/src/etc/inc/plugins.inc.d/squid.inc
@@ -59,6 +59,7 @@ function squid_xmlrpc_sync()
         'description' => gettext('Web Proxy'),
         'section' => 'OPNsense.proxy',
         'id' => 'squid',
+        'services' => ["squid"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/suricata.inc b/src/etc/inc/plugins.inc.d/suricata.inc
index ec3a676d7..714198c67 100644
--- a/src/etc/inc/plugins.inc.d/suricata.inc
+++ b/src/etc/inc/plugins.inc.d/suricata.inc
@@ -67,6 +67,7 @@ function suricata_xmlrpc_sync()
         'description' => gettext('Intrusion Detection'),
         'section' => 'OPNsense.IDS',
         'id' => 'suricata',
+        'services' => ["suricata"],
     );
 
     return $result;
diff --git a/src/etc/inc/plugins.inc.d/unbound.inc b/src/etc/inc/plugins.inc.d/unbound.inc
index 4bd558692..6407d5ebf 100644
--- a/src/etc/inc/plugins.inc.d/unbound.inc
+++ b/src/etc/inc/plugins.inc.d/unbound.inc
@@ -75,6 +75,7 @@ function unbound_xmlrpc_sync()
         'description' => gettext('Unbound DNS'),
         'section' => 'unbound,OPNsense.unboundplus',
         'id' => 'dnsresolver',
+        'services' => ["unbound"],
     );
 
     return $result;

From 9d099c71771481c01b11a860180cedecf1628bdd Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 25 Mar 2021 17:24:17 +0100
Subject: [PATCH 24/29] Services: WebGui, restart delayed to prevent session
 discconnect. (https://github.com/opnsense/core/issues/4834)

---
 src/etc/inc/plugins.inc.d/core.inc   | 4 ++--
 src/etc/inc/plugins.inc.d/webgui.inc | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/etc/inc/plugins.inc.d/core.inc b/src/etc/inc/plugins.inc.d/core.inc
index f99628cde..0c482d08e 100644
--- a/src/etc/inc/plugins.inc.d/core.inc
+++ b/src/etc/inc/plugins.inc.d/core.inc
@@ -132,8 +132,8 @@ function core_services()
     $services[] = array(
         'pidfile' => '/var/run/lighty-webConfigurator.pid',
         'description' => gettext('WebGui'),
-        'configd' => array(
-            'restart' => array('webgui restart')
+        'php' => array(
+            'restart' => array('webgui_configure_delayed')
         ),
         'locked' => true,
         'name' => 'webgui',
diff --git a/src/etc/inc/plugins.inc.d/webgui.inc b/src/etc/inc/plugins.inc.d/webgui.inc
index c692ca149..c327e4f9b 100644
--- a/src/etc/inc/plugins.inc.d/webgui.inc
+++ b/src/etc/inc/plugins.inc.d/webgui.inc
@@ -38,6 +38,11 @@ function webgui_configure()
     );
 }
 
+function webgui_configure_delayed()
+{
+    configd_run('webgui restart 3', true);
+}
+
 function webgui_configure_do($verbose = false, $interface = '')
 {
     global $config;

From eefb5301e6cf53ee8f2304bfbf9f8c1f2957da14 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Fri, 26 Mar 2021 08:39:54 +0100
Subject: [PATCH 25/29] make: when mfc aborts clear it and switch back

---
 Makefile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 1af274565..b0b8b2848 100644
--- a/Makefile
+++ b/Makefile
@@ -449,7 +449,9 @@ mfc: ensure-stable clean-mfcdir
 	fi
 .else
 	@git checkout stable/${CORE_ABI}
-	@git cherry-pick -x ${MFC}
+	@if ! git cherry-pick -x ${MFC}; then \
+		git cherry-pick --abort; \
+	fi
 .endif
 	@git checkout master
 .endfor

From 5698633306d8d27dc8a396a1265fc691fffdf8bf Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Fri, 26 Mar 2021 08:50:20 +0100
Subject: [PATCH 26/29] make: add rebase target for stable branch

---
 Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Makefile b/Makefile
index b0b8b2848..d4ede9f87 100644
--- a/Makefile
+++ b/Makefile
@@ -462,6 +462,11 @@ stable:
 master:
 	@git checkout master
 
+rebase:
+	@git checkout stable/${CORE_ABI}
+	@git rebase -i
+	@git checkout master
+
 test: want-phpunit7-php${CORE_PHP}
 	@if [ "$$(${PKG} query %n-%v ${CORE_NAME})" != "${CORE_NAME}-${CORE_PKGVERSION}" ]; then \
 		echo "Installed version does not match, expected ${CORE_NAME}-${CORE_PKGVERSION}"; \

From 428deb56508dde0682a2447f151a81407e472f20 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Fri, 26 Mar 2021 11:52:10 +0100
Subject: [PATCH 27/29] pkg: pin development version to suricata 6

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index d4ede9f87..57d1c3b68 100644
--- a/Makefile
+++ b/Makefile
@@ -102,7 +102,7 @@ CORE_COPYRIGHT_YEARS?=	2014-2021
 
 CORE_DEPENDS_amd64?=	beep \
 			bsdinstaller \
-			suricata
+			suricata-devel
 
 CORE_DEPENDS?=		${CORE_DEPENDS_${CORE_ARCH}} \
 			ca_root_nss \

From b0e9007b46a151da7eee4af78dc9c5f627c5ce56 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Fri, 26 Mar 2021 19:49:12 +0100
Subject: [PATCH 28/29] Firewall / Nat - portforward - sticky
 filter-rule-association settting for none/pass on copied items. closes
 https://github.com/opnsense/core/issues/4872

---
 src/www/firewall_nat_edit.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/www/firewall_nat_edit.php b/src/www/firewall_nat_edit.php
index 7a385cd9d..d85734616 100644
--- a/src/www/firewall_nat_edit.php
+++ b/src/www/firewall_nat_edit.php
@@ -1077,10 +1077,10 @@ $( document ).ready(function() {
                   <td><a id="help_for_fra" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Filter rule association"); ?></td>
                   <td>
                     <select name="filter-rule-association">
-                      <option value=""><?=gettext("None"); ?></option>
-                      <option value="add-associated" selected="selected"><?=gettext("Add associated filter rule"); ?></option>
+                      <option value="" <?= empty($pconfig['associated-rule-id']) ? " selected=\"selected\"" : ""; ?>><?=gettext("None"); ?></option>
+                      <option value="add-associated" <?= !empty($pconfig['associated-rule-id']) && $pconfig['associated-rule-id'] != "pass" ? " selected=\"selected\"" : ""; ?>><?=gettext("Add associated filter rule"); ?></option>
                       <option value="add-unassociated"><?=gettext("Add unassociated filter rule"); ?></option>
-                      <option value="pass"><?=gettext("Pass"); ?></option>
+                      <option value="pass" <?= $pconfig['associated-rule-id'] == "pass" ? " selected=\"selected\"" : ""; ?>><?=gettext("Pass"); ?></option>
                     </select>
                     <div class="hidden" data-for="help_for_fra">
                       <?=gettext("NOTE: The \"pass\" selection does not work properly with Multi-WAN. It will only work on an interface containing the default gateway.")?>

From 352d5de372cb0805ad631de67b0a238324472134 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Fri, 26 Mar 2021 21:20:49 +0100
Subject: [PATCH 29/29] Firewall / Log Files / Live view - refactor
 https://github.com/opnsense/core/pull/4825 a bit to support a bit wider
 lexical syntax.

---
 .../views/OPNsense/Diagnostics/fw_log.volt    | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
index 9746034ea..416e57d5f 100644
--- a/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
+++ b/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt
@@ -393,17 +393,33 @@
             });
         });
 
-        // get and apply url params. ie11 compat
-        let urlvars = window.location.search.substring(1).split("&");
-        if (urlvars.length >= 1 && urlvars[0] !== "") {
-            urlvars.forEach(function(value) {
-                $("#filter_tag").val(value.split("=")[0]);
-                $("#filter_condition").val("=");
-                $("#filter_value").val(value.split("=")[1]);
-                $("#add_filter_condition").click();
+        /**
+         * set new selection
+         * @param items list of lexical expressions
+         */
+        function set_selection(items)
+        {
+            // remove old selection
+            $("#filters > span.badge").click();
+            // collect valid condition types
+            let conditions = [];
+            $("#filter_condition > option").each(function(){
+                conditions.push($(this).val());
+            });
+            items.forEach(function(value) {
+                let parts = value.split(new RegExp("("+conditions.join("|")+")(.+)$"));
+                if (parts.length >= 3 && $("#filter_tag").val(parts[0]).val() === parts[0] ) {
+                    $("#filter_tag").val(parts[0]);
+                    $("#filter_condition").val(parts[1]);
+                    $("#filter_value").val(parts[2]);
+                    $("#add_filter_condition").click();
+                }
             });
         }
 
+        // get and apply url params. ie11 compat
+        set_selection(window.location.search.substring(1).split("&"));
+
         // startup poller
         poller();
     });