Merge branch 'master' into sysprvwarn2

2025-10-26 11:38:35 +00:00 · 2017-01-11 07:24:39 +05:45 · 2017-01-11 07:24:39 +05:45 · 753280bb6c
commit 753280bb6c
parent 9187d6f7ea 6a9a75958c
122 changed files with 1995 additions and 1076 deletions
--- a/src/etc/inc/captiveportal.inc
+++ b/src/etc/inc/captiveportal.inc
@ -347,15 +347,10 @@ EOD;
 		@unlink("{$g['varetc_path']}/captiveportal-{$cpzone}-error.html");
 		@unlink("{$g['varetc_path']}/captiveportal-{$cpzone}-logout.html");

-		captiveportal_radius_stop_all();
+		captiveportal_radius_stop_all(10); // NAS-Request

 		captiveportal_filterdns_configure();

-		/* send Accounting-Off to server */
-		if (!platform_booting()) {
-			captiveportal_send_server_accounting(true);
-		}
-
 		/* remove old information */
 		unlink_if_exists("{$g['vardb_path']}/captiveportal{$cpzone}.db");
 		unlink_if_exists("{$g['vardb_path']}/captiveportal_radius_{$cpzone}.db");
@ -1086,10 +1081,24 @@ function captiveportal_disconnect_client($sessionid, $term_cause = 1, $logoutRea
 function captiveportal_disconnect_all($term_cause = 6, $logoutReason = "DISCONNECT") {
 	global $g, $config, $cpzone, $cpzoneid;

+	/* check if we're pruning old entries and eventually wait */
+	$rcprunelock = try_lock("rcprunecaptiveportal{$cpzone}", 60);
+
+	/* if we still don't have the lock, unlock forcefully and take it */
+	if (!$rcprunelock) {
+		log_error("CP zone ${cpzone}: could not obtain the lock for more than 60 seconds, lock taken forcefully to disconnect all users");
+		unlock_force("rcprunecaptiveportal{$cpzone}");
+		$rcprunelock = lock("rcprunecaptiveportal{$cpzone}", LOCK_EX);
+	}
+
 	$radiussrvs = captiveportal_get_radius_servers();
 	$cpdb = captiveportal_read_db();

-	$unsetindexes = array();
+	/* remove immediately the active users from the database to avoid races */
+	$unsetindexes = array_column($cpdb,5);
+	if (!empty($unsetindexes)) {
+		captiveportal_remove_entries($unsetindexes);
+	}

 	foreach ($cpdb as $cpentry) {
 		if (empty($cpentry[11])) {
@ -1099,42 +1108,44 @@ function captiveportal_disconnect_all($term_cause = 6, $logoutReason = "DISCONNE

 		captiveportal_disconnect($cpentry, $radiusservers, $term_cause);
 		captiveportal_logportalauth($cpentry[4], $cpentry[3], $cpentry[2], $logoutReason);
-		$unsetindexes[] = $cpentry[5];
 	}
 	unset($cpdb);

-	if (!empty($unsetindexes)) {
-		captiveportal_remove_entries($unsetindexes);
-	}
+	unlock($rcprunelock);
 }

 /* send RADIUS acct stop for all current clients */
-function captiveportal_radius_stop_all() {
-	global $config, $cpzone;
+function captiveportal_radius_stop_all($term_cause = 6, $logoutReason = "DISCONNECT") {
+	global $g, $config, $cpzone, $cpzoneid;

-	if (!isset($config['captiveportal'][$cpzone]['radacct_enable'])) {
-		return;
+	$cpdb = captiveportal_read_db();
+
+	$radacct = isset($config['captiveportal'][$cpzone]['radacct_enable']) ? true : false;
+	if ($radacct) {
+		$radiusservers = captiveportal_get_radius_servers();
 	}

-	$radiusservers = captiveportal_get_radius_servers();
-	if (!empty($radiusservers)) {
-		$cpdb = captiveportal_read_db();
-		foreach ($cpdb as $cpentry) {
-			if (empty($cpentry[11])) {
-				$cpentry[11] = 'first';
-			}
-			if (!empty($radiusservers[$cpentry[11]])) {
-				RADIUS_ACCOUNTING_STOP($cpentry[1], // ruleno
-					$cpentry[4], // username
-					$cpentry[5], // sessionid
-					$cpentry[0], // start time
-					$radiusservers[$cpentry[11]],
-					$cpentry[2], // clientip
-					$cpentry[3], // clientmac
-					7); // Admin Reboot
+	foreach ($cpdb as $cpentry) {
+		if ($radacct) {
+			if (!empty($radiusservers)) {
+				if (empty($cpentry[11])) {
+					$cpentry[11] = 'first';
+				}
+				if (!empty($radiusservers[$cpentry[11]])) {
+					RADIUS_ACCOUNTING_STOP($cpentry[1], // ruleno
+						$cpentry[4], // username
+						$cpentry[5], // sessionid
+						$cpentry[0], // start time
+						$radiusservers[$cpentry[11]],
+						$cpentry[2], // clientip
+						$cpentry[3], // clientmac
+						$term_cause);
+				}
 			}
 		}
+		captiveportal_logportalauth($cpentry[4], $cpentry[3], $cpentry[2], $logoutReason);
 	}
+	unset($cpdb);
 }

 function captiveportal_passthrumac_configure_entry($macent, $pipeinrule = false) {
--- a/src/etc/inc/dyndns.class
+++ b/src/etc/inc/dyndns.class
@ -98,7 +98,7 @@
 	 *  SelfHost        - Last Tested: 26 December 2011
 	 *  Amazon Route 53 - Last Tested: 30 August 2016 
 	 *  DNS-O-Matic     - Last Tested: 9 September 2010
-	 *  CloudFlare      - Last Tested: 17 July 2016
+	 *  CloudFlare      - Last Tested: 05 September 2016
 	 *  CloudFlare IPv6 - Last Tested: 17 July 2016
 	 *  Eurodns         - Last Tested: 27 June 2013
 	 *  GratisDNS       - Last Tested: 15 August 2012
@ -139,6 +139,7 @@
 		var $_FQDN;
 		var $_dnsIP;
 		var $_dnsWildcard;
+		var $_dnsProxied;
 		var $_dnsMX;
 		var $_dnsBackMX;
 		var $_dnsServer;
@ -170,7 +171,7 @@
 		 *   - $For custom requests, $dnsUpdateURL is parsed for '%IP%', which is replaced with the new IP.
 		 */
 		function updatedns ($dnsService = '', $dnsHost = '', $dnsDomain = '', $dnsUser = '', $dnsPass = '',
-					$dnsWildcard = 'OFF', $dnsMX = '', $dnsIf = '', $dnsBackMX = '',
+					$dnsWildcard = 'OFF', $dnsProxied = false, $dnsMX = '', $dnsIf = '', $dnsBackMX = '',
 					$dnsServer = '', $dnsPort = '', $dnsUpdateURL = '', $forceUpdate = false,
 					$dnsZoneID ='', $dnsTTL='', $dnsResultMatch = '', $dnsRequestIf = '',
 					$dnsID = '', $dnsVerboseLog = false, $curlIpresolveV4 = false, $curlSslVerifypeer = true) {
@ -247,6 +248,7 @@
 			$this->_dnsServer = $dnsServer;
 			$this->_dnsPort = $dnsPort;
 			$this->_dnsWildcard = $dnsWildcard;
+			$this->_dnsProxied = $dnsProxied;
 			$this->_dnsMX = $dnsMX;
 			$this->_dnsZoneID = $dnsZoneID;
 			$this->_dnsTTL = $dnsTTL;
@ -359,8 +361,7 @@
 				curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
 			}

-			if ($this->_dnsService != 'ods' and $this->_dnsService != 'route53 ') {
-				curl_setopt($ch, CURLOPT_HEADER, 1);
+			if ($this->_dnsService != 'ods') {
 				curl_setopt($ch, CURLOPT_USERAGENT, $this->_UserAgent);
 				curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
 				curl_setopt($ch, CURLOPT_INTERFACE, 'if!' . $realparentif);
@ -713,6 +714,7 @@
 							$hostData = array(
 								"content" => "{$this->_dnsIP}",
 								"type" => "{$recordType}",
+								"proxied" => $this->_dnsProxied,
 								"name" => "{$this->_dnsHost}"
 							);
 							$data_json = json_encode($hostData);
@ -774,7 +776,6 @@
 					$server = 'https://api.dnsimple.com/v1/domains/';
 					$token = $this->_dnsUser . ':' . $this->_dnsPass;
 					$jsondata = '{"record":{"content":"' . $this->_dnsIP . '","ttl":"' . $this->_dnsTTL . '"}}';
-					curl_setopt($ch, CURLOPT_HEADER, 1);
 					curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PUT");
 					curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept: application/json', 'Content-Type: application/json', 'X-DNSimple-Token: ' . $token));
 					curl_setopt($ch, CURLOPT_URL, $server . $this->_dnsHost . '/records/' . $this->_dnsZoneID);
@ -821,6 +822,7 @@
 					break;
 			}
 			if ($this->_dnsService != 'ods') {
+				curl_setopt($ch, CURLOPT_HEADER, 1);
 				$response = curl_exec($ch);
 				$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
 				$header = substr($response, 0, $header_size);
@ -834,7 +836,7 @@
 		 * Private Function (added 12 July 2005) [beta]
 		 *   Retrieve Update Status
 		 */
-		function _checkStatus($ch, $data) {
+		function _checkStatus($ch, $data, $header) {
 			if ($this->_dnsVerboseLog) {
 				log_error(sprintf(gettext('Dynamic DNS %1$s (%2$s): _checkStatus() starting.'), $this->_dnsService, $this->_FQDN));
 			}
--- a/src/etc/inc/globals.inc
+++ b/src/etc/inc/globals.inc
@ -71,7 +71,7 @@ $g = array(
 	"disablecrashreporter" => false,
 	"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php",
 	"debug" => false,
-	"latest_config" => "16.0",
+	"latest_config" => "16.1",
 	"minimum_ram_warning" => "101",
 	"minimum_ram_warning_text" => "128 MB",
 	"wan_interface_name" => "wan",
--- a/src/etc/inc/gwlb.inc
+++ b/src/etc/inc/gwlb.inc
@ -466,6 +466,8 @@ function return_gateways_status($byname = false) {
 			$status[$target]['loss'] = "";
 			$status[$target]['status'] = "none";
 		}
+
+		$status[$target]['monitor_disable'] = true;
 	}
 	return($status);
 }
--- a/src/etc/inc/interfaces.inc
+++ b/src/etc/inc/interfaces.inc
@ -3868,6 +3868,13 @@ function interface_dhcpv6_configure($interface = "wan", $wancfg) {
 	$wanif = get_real_interface($interface, "inet6");
 	$dhcp6cconf = "";

+	if (!empty($config['system']['global-v6duid'])) {
+		// Write the DUID file
+		if(!write_dhcp6_duid($config['system']['global-v6duid'])) {
+		    log_error(gettext("Failed to write user DUID file!"));
+		}
+	}
+	
 	if ($wancfg['adv_dhcp6_config_file_override']) {
 		// DHCP6 Config File Override
 		$dhcp6cconf = DHCP6_Config_File_Override($wancfg, $wanif);
--- a/src/etc/inc/ipsec.inc
+++ b/src/etc/inc/ipsec.inc
@ -819,4 +819,21 @@ function ipsec_new_reqid() {
 	return $keyid;
 }

+function ipsec_get_loglevels() {
+	global $config, $ipsec_log_cats;
+	$def_loglevel = '1';
+
+	$levels = array();
+
+	foreach (array_keys($ipsec_log_cats) as $cat) {
+		if (isset($config['ipsec']['logging'][$cat])) {
+			$levels[$cat] = $config['ipsec']['logging'][$cat];
+		} elseif (in_array($cat, array('ike', 'chd', 'cfg'))) {
+			$levels[$cat] = "2";
+		} else {
+			$levels[$cat] = $def_loglevel;
+		}
+	}
+	return $levels;
+}
 ?>
--- a/src/etc/inc/openvpn.inc
+++ b/src/etc/inc/openvpn.inc
@ -43,7 +43,10 @@ $openvpn_prots = array(
 );

 global $openvpn_dev_mode;
-$openvpn_dev_mode = array("tun", "tap");
+$openvpn_dev_mode = array(
+	"tun" => "tun - Layer 3 Tunnel Mode",
+	"tap" => "tap - Layer 2 Tap Mode"
+);

 global $openvpn_verbosity_level;
 $openvpn_verbosity_level = array(
@ -119,11 +122,16 @@ $openvpn_client_modes = array(

 global $openvpn_compression_modes;
 $openvpn_compression_modes = array(
-	'' => gettext("No Preference"),
-	'noadapt' => gettext("No Preference and Adaptive Compression Disabled"),
-	'no' => gettext("Disabled - No Compression"),
-	'adaptive' => gettext("Enabled with Adaptive Compression"),
-	'yes' => gettext("Enabled without Adaptive Compression"));
+	'' => gettext("Omit Preference (Use OpenVPN Default)"),
+	'lz4' => gettext("LZ4 Compression [compress lz4]"),
+	'lz4-v2' => gettext("LZ4 Comression v2 [compress lz4-v2]"),
+	'lzo' => gettext("LZO Compression [compress lzo, equivalent to comp-lzo yes for compatibility]"),
+	'stub' => gettext("Enable Compression (stub) [compress]"),
+	'noadapt' => gettext("Omit Preference, + Disable Adaptive LZO Compression [Legacy style, comp-noadapt]"),
+	'adaptive' => gettext("Adaptive LZO Compression [Legacy style, comp-lzo adaptive]"),
+	'yes' => gettext("LZO Compression [Legacy style, comp-lzo yes]"),
+	'no' => gettext("No LZO Compression [Legacy style, comp-lzo no]"),
+);

 global $openvpn_topologies;
 $openvpn_topologies = array(
@ -132,6 +140,12 @@ $openvpn_topologies = array(
 //	'p2p => gettext("Peer to Peer -- One IP address per client peer-to-peer style. Does not work on Windows.")
 );

+global $openvpn_tls_modes;
+$openvpn_tls_modes = array(
+	'auth' => gettext("TLS Authentication"),
+	'crypt' => gettext("TLS Encryption and Authentication")
+);
+
 function openvpn_build_mode_list() {
 	global $openvpn_server_modes;

@ -335,37 +349,38 @@ function openvpn_vpnid_next() {
 function openvpn_port_used($prot, $interface, $port, $curvpnid = 0) {
 	global $config;

+	$ovpn_settings = array();
 	if (is_array($config['openvpn']['openvpn-server'])) {
-		foreach ($config['openvpn']['openvpn-server'] as & $settings) {
-			if (isset($settings['disable'])) {
-				continue;
-			}
-
-			if ($curvpnid != 0 && $curvpnid == $settings['vpnid']) {
-				continue;
-			}
-
-			if ($port == $settings['local_port'] && $prot == $settings['protocol'] &&
-			    ($interface == $settings['interface'] || $interface == "any" || $settings['interface'] == "any")) {
-				return $settings['vpnid'];
-			}
-		}
+		$ovpn_settings = $config['openvpn']['openvpn-server'];
+	}
+	if (is_array($config['openvpn']['openvpn-client'])) {
+		$ovpn_settings = array_merge($ovpn_settings,
+		    $config['openvpn']['openvpn-client']);
 	}

-	if (is_array($config['openvpn']['openvpn-client'])) {
-		foreach ($config['openvpn']['openvpn-client'] as & $settings) {
-			if (isset($settings['disable'])) {
-				continue;
-			}
+	foreach ($ovpn_settings as $settings) {
+		if (isset($settings['disable'])) {
+			continue;
+		}

-			if ($curvpnid != 0 && $curvpnid == $settings['vpnid']) {
-				continue;
-			}
+		if ($curvpnid != 0 && $curvpnid == $settings['vpnid']) {
+			continue;
+		}

-			if ($port == $settings['local_port'] && $prot == $settings['protocol'] &&
-			    ($interface == $settings['interface'] || $interface == "any" || $settings['interface'] == "any")) {
-				return $settings['vpnid'];
-			}
+		/* (TCP|UDP)(4|6) does not conflict unless interface is any */
+		if (($interface != "any" && $settings['interface'] != "any") &&
+		    (strlen($prot) == 4) &&
+		    (strlen($settings['protocol']) == 4) &&
+		    substr($prot,0,3) == substr($settings['protocol'],0,3) &&
+		    substr($prot,3,1) != substr($settings['protocol'],3,1)) {
+			continue;
+		}
+
+		if ($port == $settings['local_port'] &&
+		    substr($prot,0,3) == substr($settings['protocol'],0,3) &&
+		    ($interface == $settings['interface'] ||
+		    $interface == "any" || $settings['interface'] == "any")) {
+			return $settings['vpnid'];
 		}
 	}

@ -638,7 +653,7 @@ function openvpn_add_keyfile(& $data, & $conf, $mode_id, $directive, $opt = "")
 }

 function openvpn_reconfigure($mode, $settings) {
-	global $g, $config, $openvpn_tls_server_modes;
+	global $g, $config, $openvpn_tls_server_modes, $openvpn_dh_lengths;

 	if (empty($settings)) {
 		return;
@ -866,7 +881,7 @@ function openvpn_reconfigure($mode, $settings) {
 		// configure user auth modes
 		switch ($settings['mode']) {
 			case 'server_user':
-				$conf .= "client-cert-not-required\n";
+				$conf .= "verify-client-cert none\n";
 			case 'server_tls_user':
 				/* username-as-common-name is not compatible with server-bridge */
 				if (stristr($conf, "server-bridge") === false) {
@ -1072,21 +1087,58 @@ function openvpn_reconfigure($mode, $settings) {
 				openvpn_add_keyfile($crl['text'], $conf, $mode_id, "crl-verify");
 			}
 			if ($settings['tls']) {
-				if ($mode == "server") {
-					$tlsopt = 0;
+				if ($settings['tls_type'] == "crypt") {
+					$tls_directive = "tls-crypt";
+					$tlsopt = "";
 				} else {
-					$tlsopt = 1;
+					$tls_directive = "tls-auth";
+					if ($mode == "server") {
+						$tlsopt = 0;
+					} else {
+						$tlsopt = 1;
+					}
 				}
-				openvpn_add_keyfile($settings['tls'], $conf, $mode_id, "tls-auth", $tlsopt);
+				openvpn_add_keyfile($settings['tls'], $conf, $mode_id, $tls_directive, $tlsopt);
 			}
+
+			/* NCP support. If it is not set, assume enabled since that is OpenVPN's default. */
+			if ($settings['ncp_enable'] == "disabled") {
+				$conf .= "ncp-disable\n";
+			} else {
+				/* If the ncp-ciphers list is empty, don't specify a list so OpenVPN's default will be used. */
+				if (!empty($settings['ncp-ciphers'])) {
+					$conf .= "ncp-ciphers " . str_replace(',', ':', $settings['ncp-ciphers']) . "\n";
+				}
+			}
+
 			break;
 	}

-	if (!empty($settings['compression'])) {
-		if ($settings['compression'] == "noadapt") {
-			$conf .= "comp-noadapt\n";
-		} else {
-			$conf .= "comp-lzo {$settings['compression']}\n";
+	$compression = "";
+	switch ($settings['compression']) {
+		case 'lz4':
+		case 'lz4-v2':
+		case 'lzo':
+		case 'stub':
+			$compression .= "compress {$settings['compression']}";
+			break;
+		case 'noadapt':
+			$compression .= "comp-noadapt";
+			break;
+		case 'adaptive':
+		case 'yes':
+		case 'no':
+			$compression .= "comp-lzo {$settings['compression']}";
+			break;
+		default:
+			/* Add nothing to the configuration */
+			break;
+	}
+
+	if (!empty($compression)) {
+		$conf .= "{$compression}\n";
+		if ($settings['compression_push']) {
+			$conf .= "push \"{$compression}\"\n";
 		}
 	}

@ -1205,19 +1257,12 @@ function openvpn_restart($mode, $settings) {
 	unlock($lockhandle);
 }

-function openvpn_delete($mode, & $settings) {
+function openvpn_delete($mode, $settings) {
 	global $g, $config;

 	$vpnid = $settings['vpnid'];
 	$mode_id = $mode.$vpnid;

-	if (isset($settings['dev_mode'])) {
-		$tunname = "{$settings['dev_mode']}{$vpnid}";
-	} else {
-		/* defaults to tun */
-		$tunname = "tun{$vpnid}";
-	}
-
 	if ($mode == "server") {
 		$devname = "ovpns{$vpnid}";
 	} else {
@ -1236,11 +1281,8 @@ function openvpn_delete($mode, & $settings) {
 		posix_kill($pid, SIGTERM);
 	}

-	/* remove the device from the openvpn group */
-	mwexec("/sbin/ifconfig " . escapeshellarg($devname) . " -group openvpn");
-
-	/* restore the original adapter name */
-	mwexec("/sbin/ifconfig " . escapeshellarg($devname) . " name " . escapeshellarg($tunname));
+	/* destroy the device */
+	pfSense_interface_destroy($devname);

 	/* remove the configuration files */
 	@array_map('unlink', glob("{$g['varetc_path']}/openvpn/{$mode_id}.*"));
@ -1314,6 +1356,13 @@ function openvpn_resync_csc(& $settings) {
 							$csc_conf .= "ifconfig-push {$clientip} {$serverip}\n";
 						}
 					}
+
+					if (!empty($serversettings['tunnel_networkv6']) && !empty($settings['tunnel_networkv6'])) {
+						list($ipv6, $prefix) = explode('/', trim($serversettings['tunnel_networkv6']));
+						list($ipv6_1, $ipv6_2) = openvpn_get_interface_ipv6($ipv6, $prefix);
+						$csc_conf .= "ifconfig-ipv6-push {$settings['tunnel_networkv6']} {$ipv6_1}\n";
+					}
+
 					file_put_contents($csc_path, $csc_conf);
 					chown($csc_path, 'nobody');
 					chgrp($csc_path, 'nobody');
--- a/src/etc/inc/pfsense-utils.inc
+++ b/src/etc/inc/pfsense-utils.inc
@ -2395,13 +2395,12 @@ function process_alias_urltable($name, $type, $url, $freq, $forceupdate=false, $
 				touch($urltable_filename);
 			}

-			/* If this backup is still there on a full install, but we aren't going to use ram disks, remove the archive since this is a transition. */
-			if (!isset($config['system']['use_mfs_tmpvar'])) {
-				unlink_if_exists("{$g['cf_conf_path']}/RAM_Disk_Store{$urltable_filename}.tgz");
-			} else {
-				/* Update the RAM disk store with the new/updated table file. */
-				mwexec("cd / && /usr/bin/tar -czf \"{$g['cf_conf_path']}/RAM_Disk_Store{$urltable_filename}.tgz\" -C / \"{$urltable_filename}\"");
+			/* Remove existing archive and create an up to date archive if RAM disk is enabled. */
+			unlink_if_exists("{$g['cf_conf_path']}/RAM_Disk_Store/{$name}.txt.tgz");
+			if (isset($config['system']['use_mfs_tmpvar'])) {
+				mwexec("/usr/bin/tar -czf " . escapeshellarg("{$g['cf_conf_path']}/RAM_Disk_Store/{$name}.txt.tgz") . " -C / " . escapeshellarg($urltable_filename));
 			}
+
 			unlink_if_exists($tmp_urltable_filename);
 		} else {
 			if (!$validateonly) {
@ -3154,38 +3153,6 @@ function pkg_call_plugins($plugin_type, $plugin_params) {
 	return $results;
 }

-function restore_aliastables() {
-	global $g, $config;
-
-	$dbpath = "{$g['vardb_path']}/aliastables/";
-
-	/* restore the alias tables, if we have them */
-	$files = glob("{$g['cf_conf_path']}/RAM_Disk_Store{$dbpath}*.tgz");
-	if (count($files)) {
-		echo "Restoring alias tables...";
-		foreach ($files as $file) {
-			if (file_exists($file)) {
-				$aliastablesrestore = "";
-				$aliastablesreturn = "";
-				exec("cd /;LANG=C /usr/bin/tar -xzf {$file} 2>&1", $aliastablesrestore, $aliastablesreturn);
-				$aliastablesrestore = implode(" ", $aliastablesrestore);
-				if ($aliastablesreturn <> 0) {
-					log_error(sprintf(gettext('Alias table restore failed exited with %1$s, the error is: %2$s %3$s%4$s'), $aliastablesreturn, $aliastablesrestore, $file, "\n"));
-				} else {
-					log_error(sprintf(gettext('Alias table restore succeeded exited with %1$s, the result is: %2$s %3$s%4$s'), $aliastablesreturn, $aliastablesrestore, $dbpath.basename($file, ".tgz"), "\n"));
-				}
-			}
-			/* If this backup is still there on a full install, but we aren't going to use ram disks, remove the archive since this is a transition. */
-			if (!isset($config['system']['use_mfs_tmpvar'])) {
-				unlink_if_exists("{$file}");
-			}
-		}
-		echo "done.\n";
-		return true;
-	}
-	return false;
-}
-
 // Convert IPv6 addresses to lower case
 function addrtolower($ip) {
 	if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false) {
--- a/src/etc/inc/priv.inc
+++ b/src/etc/inc/priv.inc
@ -182,7 +182,7 @@ function get_user_privdesc(& $user) {
 	return $privs;
 }

-function isAllowed($username, $page) {
+function isAdminUID($username) {
 	global $_SESSION;

 	if (!isset($username)) {
@ -199,6 +199,20 @@ function isAllowed($username, $page) {
 		}
 	}

+	return false;
+}
+
+function isAllowed($username, $page) {
+	global $_SESSION;
+
+	if (!isset($username)) {
+		return false;
+	}
+
+	if (isAdminUID($username)) {
+		return true;
+	}
+
 	/* user privilege access check */
 	if (cmp_page_matches($page, $_SESSION['page-match'])) {
 		return true;
@ -207,7 +221,6 @@ function isAllowed($username, $page) {
 	return false;
 }

-
 function isAllowedPage($page) {
 	global $_SESSION;

@ -218,14 +231,8 @@ function isAllowedPage($page) {
 		return false;
 	}

-	/* admin/root access check */
-	$user = getUserEntry($username);
-	if (isset($user)) {
-		if (isset($user['uid'])) {
-			if ($user['uid'] == 0) {
-				return true;
-			}
-		}
+	if (isAdminUID($username)) {
+		return true;
 	}

 	/* user privilege access check */
@ -269,12 +276,33 @@ function getAllowedPages($username, &$attributes = array()) {

 	if ($_SESSION['remoteauth']) {
 		$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
+		// cache auth results for a short time to ease load on auth services & logs
+		if (isset($config['system']['webgui']['auth_refresh_time'])) {
+			$recheck_time = $config['system']['webgui']['auth_refresh_time'];
+		} else {
+			$recheck_time = 30;
+		}
 		// obtain ldap groups if we are in ldap mode
 		if ($authcfg['type'] == "ldap") {
-			$allowed_groups = @ldap_get_groups($username, $authcfg);
+			if  ( isset($_SESSION["ldap_allowed_groups"]) &&
+			    ( time() <= $_SESSION["auth_check_time"]+ $recheck_time) ) {
+				$allowed_groups = $_SESSION["ldap_allowed_groups"];
+			} else {
+				$allowed_groups = @ldap_get_groups($username, $authcfg);
+				$_SESSION["ldap_allowed_groups"] = $allowed_groups;
+				$_SESSION["auth_check_time"] = time();
+			}
 		} elseif ($authcfg['type'] == "radius") {
-			$allowed_groups = @radius_get_groups($attributes);
+			if  ( isset($_SESSION["radius_allowed_groups"]) &&
+			    (time() <= $_SESSION["auth_check_time"] + $recheck_time) ) {
+				$allowed_groups = $_SESSION["radius_allowed_groups"];
+			} else {
+				$allowed_groups = @radius_get_groups($attributes);
+				$_SESSION["radius_allowed_groups"] = $allowed_groups;
+				$_SESSION["auth_check_time"] = time();
+			}
 		}
+
 	}
 	if (!$allowed_groups) {
 		// search for a local user by name
--- a/src/etc/inc/rrd.inc
+++ b/src/etc/inc/rrd.inc
@ -34,54 +34,6 @@ function dump_rrd_to_xml($rrddatabase, $xmldumpfile) {
 	return($dumpret);
 }

-function restore_rrd() {
-	global $g, $config;
-
-	$rrddbpath = "{$g['vardb_path']}/rrd/";
-	$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
-
-	$rrdrestore = "";
-	$rrdreturn = "";
-	if (file_exists("{$g['cf_conf_path']}/rrd.tgz") && isset($config['system']['use_mfs_tmpvar'])) {
-		foreach (glob("{$rrddbpath}/*.xml") as $xml_file) {
-			@unlink($xml_file);
-		}
-		unset($rrdrestore);
-		$_gb = exec("cd /;LANG=C /usr/bin/tar -tf {$g['cf_conf_path']}/rrd.tgz", $rrdrestore, $rrdreturn);
-		if ($rrdreturn != 0) {
-			log_error(sprintf(gettext('RRD restore failed exited with %1$s, the error is: %2$s'), $rrdreturn, $rrdrestore));
-			return;
-		}
-		foreach ($rrdrestore as $xml_file) {
-			$rrd_file = '/' . substr($xml_file, 0, -4) . '.rrd';
-			if (file_exists("{$rrd_file}")) {
-				@unlink($rrd_file);
-			}
-			file_put_contents("{$g['tmp_path']}/rrd_restore", $xml_file);
-			$_gb = exec("cd /;LANG=C /usr/bin/tar -xf {$g['cf_conf_path']}/rrd.tgz -T {$g['tmp_path']}/rrd_restore");
-			if (!file_exists("/{$xml_file}")) {
-				log_error(sprintf(gettext("Could not extract %s RRD xml file from archive!"), $xml_file));
-				continue;
-			}
-			$_gb = exec("$rrdtool restore -f '/{$xml_file}' '{$rrd_file}'", $output, $status);
-			if ($status) {
-				log_error(sprintf(gettext("rrdtool restore -f '%1\$s' '%2\$s' failed returning %3\$s."), $xml_file, $rrd_file, $status));
-				continue;
-			}
-			unset($output);
-			@unlink("/{$xml_file}");
-		}
-		unset($rrdrestore);
-		@unlink("{$g['tmp_path']}/rrd_restore");
-		/* If this backup is still there on a full install, but we aren't going to use ram disks, remove the archive since this is a transition. */
-		if (!isset($config['system']['use_mfs_tmpvar'])) {
-			unlink_if_exists("{$g['cf_conf_path']}/rrd.tgz");
-		}
-		return true;
-	}
-	return false;
-}
-
 function create_new_rrd($rrdcreatecmd) {
 	$rrdcreateoutput = array();
 	$rrdcreatereturn = 0;
@ -281,10 +233,6 @@ function enable_rrd_graphing() {
 		}
 		chown($rrddbpath, "nobody");

-		if (platform_booting()) {
-			restore_rrd();
-		}
-
 		/* db update script */
 		$rrdupdatesh = "#!/bin/sh\n";
 		$rrdupdatesh .= "\n";
@ -309,14 +257,6 @@ function enable_rrd_graphing() {
 			}
 		}

-		if (platform_booting()) {
-			if (!is_dir($rrddbpath)) {
-				mkdir($rrddbpath, 0775);
-			}
-
-			@chown($rrddbpath, "nobody");
-		}
-
 		/* process all real and pseudo interfaces */
 		foreach ($ifdescrs as $ifname => $ifdescr) {
 			$temp = get_real_interface($ifname);
--- a/src/etc/inc/services.inc
+++ b/src/etc/inc/services.inc
@ -263,10 +263,22 @@ function services_radvd_configure($blacklist = array()) {
 				$radvdconf .= "\tRDNSS {$dnsstring} { };\n";
 			}
 		}
+
+		$searchlist = array();
+		$domainsearchlist = explode(';', $dhcpv6ifconf['radomainsearchlist']);
+		foreach ($domainsearchlist as $sd) {
+			$sd = trim($sd);
+			if (is_hostname($sd)) {
+				$searchlist[] = $sd;
+			}
+		}
+		if (count($searchlist) > 0) {
+			$searchliststring = trim(implode(" ", $searchlist));
+		}
 		if (!empty($dhcpv6ifconf['domain'])) {
-			$radvdconf .= "\tDNSSL {$dhcpv6ifconf['domain']} { };\n";
+			$radvdconf .= "\tDNSSL {$dhcpv6ifconf['domain']} {$searchliststring} { };\n";
 		} elseif (!empty($config['system']['domain'])) {
-			$radvdconf .= "\tDNSSL {$config['system']['domain']} { };\n";
+			$radvdconf .= "\tDNSSL {$config['system']['domain']} {$searchliststring} { };\n";
 		}
 		$radvdconf .= "};\n";
 	}
@ -468,23 +480,6 @@ function services_dhcpdv4_configure() {
 		}
 	}

-	if (platform_booting()) {
-		/* restore the leases, if we have them */
-		if (file_exists("{$g['cf_conf_path']}/dhcpleases.tgz")) {
-			$dhcprestore = "";
-			$dhcpreturn = "";
-			exec("cd /;LANG=C /usr/bin/tar -xzf {$g['cf_conf_path']}/dhcpleases.tgz 2>&1", $dhcprestore, $dhcpreturn);
-			$dhcprestore = implode(" ", $dhcprestore);
-			if ($dhcpreturn <> 0) {
-				log_error(sprintf(gettext('DHCP leases restore failed exited with %1$s, the error is: %2$s%3$s'), $dhcpreturn, $dhcprestore, "\n"));
-			}
-		}
-		/* If this backup is still there on a full install, but we aren't going to use ram disks, remove the archive since this is a transition. */
-		if (!isset($config['system']['use_mfs_tmpvar'])) {
-			unlink_if_exists("{$g['cf_conf_path']}/dhcpleases.tgz");
-		}
-	}
-
 	$syscfg = $config['system'];
 	if (!is_array($config['dhcpd'])) {
 		$config['dhcpd'] = array();
@ -1265,22 +1260,6 @@ function services_dhcpdv6_configure($blacklist = array()) {
 		return 0;
 	}

-	/* restore the leases, if we have them */
-	if (platform_booting() &&
-	    isset($config['system']['use_mfs_tmpvar']) &&
-	    file_exists("{$g['cf_conf_path']}/dhcp6leases.tgz")) {
-		$dhcprestore = "";
-		$dhcpreturn = "";
-		exec("cd /;LANG=C /usr/bin/tar -xzf {$g['cf_conf_path']}/dhcp6leases.tgz 2>&1",
-		    $dhcprestore, $dhcpreturn);
-		$dhcprestore = implode(" ", $dhcprestore);
-		if ($dhcpreturn <> 0) {
-			log_error(sprintf(gettext(
-			    'DHCP leases v6 restore failed exited with %1$s, the error is: %2$s'),
-			    $dhcpreturn, $dhcprestore));
-		}
-	}
-
 	$syscfg = $config['system'];
 	if (!is_array($config['dhcpdv6'])) {
 		$config['dhcpdv6'] = array();
@ -1961,6 +1940,7 @@ function services_dyndns_configure_client($conf) {
 		$dnsUser = $conf['username'],
 		$dnsPass = $conf['password'],
 		$dnsWildcard = $conf['wildcard'],
+		$dnsProxied = $conf['proxied'],
 		$dnsMX = $conf['mx'],
 		$dnsIf = "{$conf['interface']}",
 		$dnsBackMX = NULL,
@ -2457,7 +2437,8 @@ begemotSnmpdModulePath."pf"     = "/usr/lib/snmp_pf.so"
 EOD;
 			}

-			if (isset($config['snmpd']['modules']['hostres'])) {
+			if (isset($config['snmpd']['modules']['hostres'])
+			    && !(($specplatform['name'] == 'VMware') && (file_exists('/dev/cd0')))) {
 				$snmpdconf .= <<<EOD
 begemotSnmpdModulePath."hostres"     = "/usr/lib/snmp_hostres.so"

@ -2509,155 +2490,220 @@ function services_dnsupdate_process($int = "", $updatehost = "", $forced = false
 	}

 	/* Dynamic DNS updating active? */
-	if (is_array($config['dnsupdates']['dnsupdate'])) {
-		$notify_text = "";
-		$gwgroups = return_gateway_groups_array();
-		foreach ($config['dnsupdates']['dnsupdate'] as $i => $dnsupdate) {
-			if (!isset($dnsupdate['enable'])) {
-				continue;
-			}
-			/*
-			 * If it's using a gateway group, check if interface is
-			 * the active gateway for that group
-			 */
-			$group_int = '';
-			if (is_array($gwgroups[$dnsupdate['interface']])) {
-				if (!empty($gwgroups[$dnsupdate['interface']][0]['vip'])) {
-					$group_int = $gwgroups[$dnsupdate['interface']][0]['vip'];
-				} else {
-					$group_int = $gwgroups[$dnsupdate['interface']][0]['int'];
-				}
-			}
-			if (!empty($int) && ($int != $dnsupdate['interface']) && ($int != $group_int)) {
-				continue;
-			}
-			if (!empty($updatehost) && ($updatehost != $dnsupdate['host'])) {
-				continue;
-			}
+	if (!is_array($config['dnsupdates']['dnsupdate'])) {
+		return 0;
+	}

-			/* determine interface name */
-			$if = get_failover_interface($dnsupdate['interface']);
-
-			if (isset($dnsupdate['usepublicip'])) {
-				$wanip = dyndnsCheckIP($if);
+	$notify_text = "";
+	$gwgroups = return_gateway_groups_array();
+	foreach ($config['dnsupdates']['dnsupdate'] as $i => $dnsupdate) {
+		if (!isset($dnsupdate['enable'])) {
+			continue;
+		}
+		/*
+		 * If it's using a gateway group, check if interface is
+		 * the active gateway for that group
+		 */
+		$group_int = '';
+		if (is_array($gwgroups[$dnsupdate['interface']])) {
+			if (!empty($gwgroups[$dnsupdate['interface']][0]['vip'])) {
+				$group_int = $gwgroups[$dnsupdate['interface']][0]['vip'];
 			} else {
-				$wanip = get_interface_ip($if);
+				$group_int = $gwgroups[$dnsupdate['interface']][0]['int'];
 			}
+		}
+		if (!empty($int) && ($int != $dnsupdate['interface']) && ($int != $group_int)) {
+			continue;
+		}
+		if (!empty($updatehost) && ($updatehost != $dnsupdate['host'])) {
+			continue;
+		}

-			$wanipv6 = get_interface_ipv6($if);
-			$cacheFile = "{$g['conf_path']}/dyndns_{$dnsupdate['interface']}_rfc2136_" . escapeshellarg($dnsupdate['host']) . "_{$dnsupdate['server']}.cache";
-			$currentTime = time();
+		/* determine interface name */
+		$if = get_failover_interface($dnsupdate['interface']);

-			if ($wanip || $wanipv6) {
-				$keyname = $dnsupdate['keyname'];
-				/* trailing dot */
-				if (substr($keyname, -1) != ".") {
-					$keyname .= ".";
-				}
+		if (isset($dnsupdate['usepublicip'])) {
+			$wanip = dyndnsCheckIP($if);
+		} else {
+			$wanip = get_interface_ip($if);
+		}

-				$hostname = $dnsupdate['host'];
-				/* trailing dot */
-				if (substr($hostname, -1) != ".") {
-					$hostname .= ".";
-				}
+		$wanipv6 = get_interface_ipv6($if);
+		$cacheFile = $g['conf_path'] .
+		    "/dyndns_{$dnsupdate['interface']}_rfc2136_" .
+		    escapeshellarg($dnsupdate['host']) .
+		    "_{$dnsupdate['server']}.cache";
+		$cacheFilev6 = $cacheFile . ".ipv6";
+		$currentTime = time();

-				/* write private key file
-				   this is dumb - public and private keys are the same for HMAC-MD5,
-				   but nsupdate insists on having both */
-				$fd = fopen("{$g['varetc_path']}/K{$i}{$keyname}+157+00000.private", "w");
-				$privkey = <<<EOD
+		if (!$wanip && !$wanipv6) {
+			continue;
+		}
+
+		$keyname = $dnsupdate['keyname'];
+		/* trailing dot */
+		if (substr($keyname, -1) != ".") {
+			$keyname .= ".";
+		}
+
+		$hostname = $dnsupdate['host'];
+		/* trailing dot */
+		if (substr($hostname, -1) != ".") {
+			$hostname .= ".";
+		}
+
+		/*
+		 * write private key file
+		 * this is dumb - public and private keys are the same for
+		 * HMAC-MD5, but nsupdate insists on having both
+		 */
+		$fd = fopen($g['varetc_path'] .
+		    "/K{$i}{$keyname}+157+00000.private", "w");
+		$privkey = <<<EOD
 Private-key-format: v1.2
 Algorithm: 157 (HMAC)
 Key: {$dnsupdate['keydata']}

 EOD;
-				fwrite($fd, $privkey);
-				fclose($fd);
+		fwrite($fd, $privkey);
+		fclose($fd);

-				/* write public key file */
-				if ($dnsupdate['keytype'] == "zone") {
-					$flags = 257;
-					$proto = 3;
-				} else if ($dnsupdate['keytype'] == "host") {
-					$flags = 513;
-					$proto = 3;
-				} else if ($dnsupdate['keytype'] == "user") {
-					$flags = 0;
-					$proto = 2;
-				}
+		/* write public key file */
+		if ($dnsupdate['keytype'] == "zone") {
+			$flags = 257;
+			$proto = 3;
+		} else if ($dnsupdate['keytype'] == "host") {
+			$flags = 513;
+			$proto = 3;
+		} else if ($dnsupdate['keytype'] == "user") {
+			$flags = 0;
+			$proto = 2;
+		}

-				$fd = fopen("{$g['varetc_path']}/K{$i}{$keyname}+157+00000.key", "w");
-				fwrite($fd, "{$keyname} IN KEY {$flags} {$proto} 157 {$dnsupdate['keydata']}\n");
-				fclose($fd);
+		$fd = fopen($g['varetc_path'] .
+		    "/K{$i}{$keyname}+157+00000.key", "w");
+		fwrite($fd, "{$keyname} IN KEY {$flags} {$proto} 157 " .
+		    "{$dnsupdate['keydata']}\n");
+		fclose($fd);

-				/* generate update instructions */
-				$upinst = "";
-				if (!empty($dnsupdate['server'])) {
-					$upinst .= "server {$dnsupdate['server']}\n";
-				}
+		/* generate update instructions */
+		$upinst = "";
+		if (!empty($dnsupdate['server'])) {
+			$upinst .= "server {$dnsupdate['server']}\n";
+		}

-				if (file_exists($cacheFile)) {
-					list($cachedipv4, $cacheTimev4) = explode("|", file_get_contents($cacheFile));
-				}
-				if (file_exists("{$cacheFile}.ipv6")) {
-					list($cachedipv6, $cacheTimev6) = explode("|", file_get_contents("{$cacheFile}.ipv6"));
-				}
+		if (file_exists($cacheFile)) {
+			list($cachedipv4, $cacheTimev4) = explode("|",
+			    file_get_contents($cacheFile));
+		}
+		if (file_exists($cacheFilev6)) {
+			list($cachedipv6, $cacheTimev6) = explode("|",
+			    file_get_contents($cacheFilev6));
+		}

-				// 25 Days
-				$maxCacheAgeSecs = 25 * 24 * 60 * 60;
-				$need_update = false;
+		// 25 Days
+		$maxCacheAgeSecs = 25 * 24 * 60 * 60;
+		$need_update = false;

-				/* Update IPv4 if we have it. */
-				if (is_ipaddrv4($wanip) && $dnsupdate['recordtype'] != "AAAA") {
-					if (($wanip != $cachedipv4) || (($currentTime - $cacheTimev4) > $maxCacheAgeSecs) || $forced) {
-						$upinst .= "update delete {$dnsupdate['host']}. A\n";
-						$upinst .= "update add {$dnsupdate['host']}. {$dnsupdate['ttl']} A {$wanip}\n";
-						$notify_text .= sprintf(gettext('DynDNS updated IP Address (A) for %1$s on %2$s (%3$s) to %4$s'), $dnsupdate['host'], convert_real_interface_to_friendly_descr($if), $if, $wanip) . "\n";
-						@file_put_contents($cacheFile, "{$wanip}|{$currentTime}");
-						log_error(sprintf(gettext('phpDynDNS: updating cache file %1$s: %2$s'), $cacheFile, $wanip));
-						$need_update = true;
-					} else {
-						log_error(sprintf(gettext("phpDynDNS: Not updating %s A record because the IP address has not changed."), $dnsupdate['host']));
-					}
-				} else {
-					@unlink($cacheFile);
-				}
+		/* Update IPv4 if we have it. */
+		if (is_ipaddrv4($wanip) && $dnsupdate['recordtype'] != "AAAA") {
+			if (($wanip != $cachedipv4) || $forced ||
+			    (($currentTime - $cacheTimev4) > $maxCacheAgeSecs)) {
+				$upinst .= "update delete " .
+				    "{$dnsupdate['host']}. A\n";
+				$upinst .= "update add {$dnsupdate['host']}. " .
+				    "{$dnsupdate['ttl']} A {$wanip}\n";
+				$need_update = true;
+			} else {
+				log_error(sprintf(gettext(
+				    "phpDynDNS: Not updating %s A record because the IP address has not changed."),
+				    $dnsupdate['host']));
+			}
+		} else {
+			@unlink($cacheFile);
+			unset($cacheFile);
+		}

-				/* Update IPv6 if we have it. */
-				if (is_ipaddrv6($wanipv6) && $dnsupdate['recordtype'] != "A") {
-					if (($wanipv6 != $cachedipv6) || (($currentTime - $cacheTimev6) > $maxCacheAgeSecs) || $forced) {
-						$upinst .= "update delete {$dnsupdate['host']}. AAAA\n";
-						$upinst .= "update add {$dnsupdate['host']}. {$dnsupdate['ttl']} AAAA {$wanipv6}\n";
-						$notify_text .= sprintf(gettext('DynDNS updated IPv6 Address (AAAA) for %1$s on %2$s (%3$s) to %4$s'), $dnsupdate['host'], convert_real_interface_to_friendly_descr($if), $if, $wanipv6) . "\n";
-						@file_put_contents("{$cacheFile}.ipv6", "{$wanipv6}|{$currentTime}");
-						log_error(sprintf(gettext('phpDynDNS: updating cache file %1$s.ipv6: %2$s'), $cacheFile, $wanipv6));
-						$need_update = true;
-					} else {
-						log_error(sprintf(gettext("phpDynDNS: Not updating %s AAAA record because the IPv6 address has not changed."), $dnsupdate['host']));
-					}
-				} else {
-					@unlink("{$cacheFile}.ipv6");
-				}
+		/* Update IPv6 if we have it. */
+		if (is_ipaddrv6($wanipv6) && $dnsupdate['recordtype'] != "A") {
+			if (($wanipv6 != $cachedipv6) || $forced ||
+			    (($currentTime - $cacheTimev6) > $maxCacheAgeSecs)) {
+				$upinst .= "update delete " .
+				    "{$dnsupdate['host']}. AAAA\n";
+				$upinst .= "update add {$dnsupdate['host']}. " .
+				    "{$dnsupdate['ttl']} AAAA {$wanipv6}\n";
+				$need_update = true;
+			} else {
+				log_error(sprintf(gettext(
+				    "phpDynDNS: Not updating %s AAAA record because the IPv6 address has not changed."),
+				    $dnsupdate['host']));
+			}
+		} else {
+			@unlink($cacheFilev6);
+			unset($cacheFilev6);
+		}

-				$upinst .= "\n";	/* mind that trailing newline! */
+		$upinst .= "\n";	/* mind that trailing newline! */

-				if ($need_update) {
-					@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}", $upinst);
-					unset($upinst);
-					/* invoke nsupdate */
-					$cmd = "/usr/local/bin/nsupdate -k {$g['varetc_path']}/K{$i}{$keyname}+157+00000.key";
-					if (isset($dnsupdate['usetcp'])) {
-						$cmd .= " -v";
-					}
-					$cmd .= " {$g['varetc_path']}/nsupdatecmds{$i}";
-					mwexec_bg($cmd);
-					unset($cmd);
-				}
+		if (!$need_update) {
+			continue;
+		}
+
+		@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}",
+		    $upinst);
+		unset($upinst);
+		/* invoke nsupdate */
+		$cmd = "/usr/local/bin/nsupdate -k " .
+		    "{$g['varetc_path']}/K{$i}{$keyname}+157+00000.key";
+
+		if (isset($dnsupdate['usetcp'])) {
+			$cmd .= " -v";
+		}
+
+		$cmd .= " {$g['varetc_path']}/nsupdatecmds{$i}";
+
+		if (mwexec($cmd) == 0) {
+			if (!empty($cacheFile)) {
+				@file_put_contents($cacheFile,
+				    "{$wanip}|{$currentTime}");
+				log_error(sprintf(gettext(
+				    'phpDynDNS: updating cache file %1$s: %2$s'),
+				    $cacheFile, $wanip));
+				$notify_text .= sprintf(gettext(
+				    'DynDNS updated IP Address (A) for %1$s on %2$s (%3$s) to %4$s'),
+				    $dnsupdate['host'],
+				    convert_real_interface_to_friendly_descr($if),
+				    $if, $wanip) . "\n";
+			}
+			if (!empty($cacheFilev6)) {
+				@file_put_contents($cacheFilev6,
+				    "{$wanipv6}|{$currentTime}");
+				log_error(sprintf(gettext(
+				    'phpDynDNS: updating cache file %1$s: %2$s'),
+				    $cacheFilev6, $wanipv6));
+				$notify_text .= sprintf(gettext(
+				    'DynDNS updated IPv6 Address (AAAA) for %1$s on %2$s (%3$s) to %4$s'),
+				    $dnsupdate['host'],
+				    convert_real_interface_to_friendly_descr($if),
+				    $if, $wanipv6) . "\n";
+			}
+		} else {
+			if (!empty($cacheFile)) {
+				log_error(sprintf(gettext(
+				    'phpDynDNS: ERROR while updating IP Address (A) for %1$s (%2$s)'),
+				    $dnsupdate['host'], $wanip));
+			}
+			if (!empty($cacheFilev6)) {
+				log_error(sprintf(gettext(
+				    'phpDynDNS: ERROR while updating IP Address (AAAA) for %1$s (%2$s)'),
+				    $dnsupdate['host'], $wanipv6));
 			}
 		}
-		if (!empty($notify_text)) {
-			notify_all_remote($notify_text);
-		}
+		unset($cmd);
+	}
+
+	if (!empty($notify_text)) {
+		notify_all_remote($notify_text);
 	}

 	return 0;
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@ -1931,13 +1931,16 @@ function system_reboot_sync($reroot=false) {
 }

 function system_reboot_cleanup() {
-	global $config, $cpzone;
+	global $config, $cpzone, $cpzoneid;

 	mwexec("/usr/local/bin/beep.sh stop");
 	require_once("captiveportal.inc");
 	if (is_array($config['captiveportal'])) {
 		foreach ($config['captiveportal'] as $cpzone=>$cp) {
-			captiveportal_radius_stop_all();
+			/* send Accounting-Stop packet for all clients, termination cause 'Admin-Reboot' */
+			$cpzoneid = $cp[zoneid];
+			captiveportal_radius_stop_all(7); // Admin-Reboot
+			/* Send Accounting-Off packet to the RADIUS server */
 			captiveportal_send_server_accounting(true);
 		}
 	}
@ -2230,6 +2233,11 @@ function system_identify_specific_platform() {
 				return (array('name' => 'Hyper-V', 'descr' => 'Hyper-V Virtual Machine'));
 			}
 			break;
+		case 'VMware Virtual Platform':
+			if ($maker[0] == "VMware, Inc.") {
+				return (array('name' => 'VMware', 'descr' => 'VMware Virtual Machine'));
+			}
+			break;
 	}

 	if (strpos($hw_model, "PC Engines WRAP") !== false) {
--- a/src/etc/inc/upgrade_config.inc
+++ b/src/etc/inc/upgrade_config.inc
@ -5063,4 +5063,86 @@ function upgrade_159_to_160() {
 		}
 	}
 }
+
+/* RAM Disk Management */
+function upgrade_160_to_161() {
+	global $g, $config;
+
+	if (!isset($config['system']['use_mfs_tmpvar'])) {
+		return;
+	}
+
+	// Move existing RRD backup to the RAM Disk Store if it don't already exist there.
+	// Restore existing RRD XML dump backup.
+	if (file_exists("{$g['cf_conf_path']}/rrd.tgz") && !file_exists("{$g['cf_conf_path']}/RAM_Disk_Store/rrd.tgz")) {
+		$rrddbpath = "{$g['vardb_path']}/rrd/";
+		$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
+
+		$rrdrestore = "";
+		$rrdreturn = "";
+		unlink_if_exists("{$rrddbpath}/*.xml");
+
+		unset($rrdrestore);
+		$_gb = exec("LANG=C /usr/bin/tar -tf {$g['cf_conf_path']}/rrd.tgz", $rrdrestore, $rrdreturn);
+		if ($rrdreturn != 0) {
+			log_error(sprintf(gettext('RRD restore failed exited with %1$s, the error is: %2$s'), $rrdreturn, $rrdrestore));
+		} else {
+			foreach ($rrdrestore as $xml_file) {
+				$rrd_file = '/' . substr($xml_file, 0, -4) . '.rrd';
+				unlink_if_exists("{$rrd_file}"); 
+
+				file_put_contents("{$g['tmp_path']}/rrd_restore", $xml_file);
+				$_gb = exec("LANG=C /usr/bin/tar -xf {$g['cf_conf_path']}/rrd.tgz -C / -T {$g['tmp_path']}/rrd_restore");
+				if (!file_exists("/{$xml_file}")) {
+					log_error(sprintf(gettext("Could not extract %s RRD xml file from archive!"), $xml_file));
+					continue;
+				}
+				$_gb = exec("$rrdtool restore -f '/{$xml_file}' '{$rrd_file}'", $output, $status);
+				if ($status) {
+					log_error(sprintf(gettext("rrdtool restore -f '%1\$s' '%2\$s' failed returning %3\$s."), $xml_file, $rrd_file, $status));
+					continue;
+				}
+				unset($output);
+				@unlink("/{$xml_file}");
+			}
+			unset($rrdrestore);
+			@unlink("{$g['tmp_path']}/rrd_restore");
+
+			// Create a new RRD backup to the RAM Disk Store (without RRD XML dump).
+			exec("/etc/rc.backup_rrd.sh");
+			$ramds_updated = true;
+
+			// Rename previous RRD backup so it will not restore again.  Don't delete in case needed for recovery.
+			rename("{$g['cf_conf_path']}/rrd.tgz", "{$g['cf_conf_path']}/rrd.tgz.old");
+		}
+	}
+
+	// Move existing DHCP leases backup to the RAM Disk Store if it don't already exist there.
+	if (file_exists("{$g['cf_conf_path']}/dhcpleases.tgz") && ! file_exists("{$g['cf_conf_path']}/RAM_Disk_Store/dhcpleases.tgz")) {
+		rename("{$g['cf_conf_path']}/dhcpleases.tgz", "{$g['cf_conf_path']}/RAM_Disk_Store/dhcpleases.tgz");
+		$ramds_updated = true;
+	}
+
+	// Move existing alias table backups to the RAM Disk Store if they don't already exist there.
+	$dbpath = "{$g['vardb_path']}/aliastables/";
+	$files = glob("{$g['cf_conf_path']}/RAM_Disk_Store{$dbpath}*.tgz");
+	if (count($files)) {
+		foreach ($files as $file) {
+			if (! file_exists("{$g['cf_conf_path']}/RAM_Disk_Store/".basename($file))) {
+				rename($file, "{$g['cf_conf_path']}/RAM_Disk_Store/".basename($file));
+				$ramds_updated = true;
+			}
+		}
+		// Remove existing alias table backups directory if empty.
+		@rmdir("{$g['cf_conf_path']}/RAM_Disk_Store/var/db/aliastables");
+		@rmdir("{$g['cf_conf_path']}/RAM_Disk_Store/var/db/");
+		@rmdir("{$g['cf_conf_path']}/RAM_Disk_Store/var/");
+	}
+
+	// Restore RAM Disk Store if updated.
+	if ($ramds_updated) {
+		exec("/etc/rc.restore_ramdisk_store");
+	}
+}
+
 ?>
--- a/src/etc/inc/util.inc
+++ b/src/etc/inc/util.inc
@ -485,32 +485,32 @@ function ip_range_to_address_array($startip, $endip, $max_size = 5000) {
 	return $rangeaddresses;
 }

-/* 	Convert an IPv4 or IPv6 IP range to an array of subnets which can contain the range.
-	Algorithm and embodying code PD'ed by Stilez - enjoy as you like :-)
-
-	Documented on pfsense dev list 19-20 May 2013. Summary:
-
-	The algorithm looks at patterns of 0's and 1's in the least significant bit(s), whether IPv4 or IPv6.
-	These are all that needs checking to identify a _guaranteed_ correct, minimal and optimal subnet array.
-
-	As a result, string/binary pattern matching of the binary IP is very efficient. It uses just 2 pattern-matching rules
-	to chop off increasingly larger subnets at both ends that can't be part of larger subnets, until nothing's left.
-
-	(a) If any range has EITHER low bit 1 (in startip) or 0 (in endip), that end-point is _always guaranteed_ to be optimally
-	represented by its own 'single IP' CIDR; the remaining range then shrinks by one IP up or down, causing the new end-point's
-	low bit to change from 1->0 (startip) or 0->1 (endip). Only one edge case needs checking: if a range contains exactly 2
-	adjacent IPs of this format, then the two IPs themselves are required to span it, and we're done.
-	Once this rule is applied, the remaining range is _guaranteed_ to end in 0's and 1's so rule (b) can now be used, and its
-	low bits can now be ignored.
-
-	(b) If any range has BOTH startip and endip ending in some number of 0's and 1's respectively, these low bits can
-	*always* be ignored and "bit-shifted" for subnet spanning. So provided we remember the bits we've place-shifted, we can
-	_always_ right-shift and chop off those bits, leaving a smaller range that has EITHER startip ending in 1 or endip ending
-	in 0 (ie can now apply (a) again) or the entire range has vanished and we're done.
-	We then loop to redo (a) again on the remaining (place shifted) range until after a few loops, the remaining (place shifted)
-	range 'vanishes' by meeting the exit criteria of (a) or (b), and we're done.
-*/
-
+/*
+ * Convert an IPv4 or IPv6 IP range to an array of subnets which can contain the range.
+ * Algorithm and embodying code PD'ed by Stilez - enjoy as you like :-)
+ *
+ * Documented on pfsense dev list 19-20 May 2013. Summary:
+ *
+ * The algorithm looks at patterns of 0's and 1's in the least significant bit(s), whether IPv4 or IPv6.
+ * These are all that needs checking to identify a _guaranteed_ correct, minimal and optimal subnet array.
+ *
+ * As a result, string/binary pattern matching of the binary IP is very efficient. It uses just 2 pattern-matching rules
+ * to chop off increasingly larger subnets at both ends that can't be part of larger subnets, until nothing's left.
+ *
+ * (a) If any range has EITHER low bit 1 (in startip) or 0 (in endip), that end-point is _always guaranteed_ to be optimally
+ * represented by its own 'single IP' CIDR; the remaining range then shrinks by one IP up or down, causing the new end-point's
+ * low bit to change from 1->0 (startip) or 0->1 (endip). Only one edge case needs checking: if a range contains exactly 2
+ * adjacent IPs of this format, then the two IPs themselves are required to span it, and we're done.
+ * Once this rule is applied, the remaining range is _guaranteed_ to end in 0's and 1's so rule (b) can now be used, and its
+ * low bits can now be ignored.
+ *
+ * (b) If any range has BOTH startip and endip ending in some number of 0's and 1's respectively, these low bits can
+ * *always* be ignored and "bit-shifted" for subnet spanning. So provided we remember the bits we've place-shifted, we can
+ * _always_ right-shift and chop off those bits, leaving a smaller range that has EITHER startip ending in 1 or endip ending
+ * in 0 (ie can now apply (a) again) or the entire range has vanished and we're done.
+ * We then loop to redo (a) again on the remaining (place shifted) range until after a few loops, the remaining (place shifted)
+ * range 'vanishes' by meeting the exit criteria of (a) or (b), and we're done.
+ */
 function ip_range_to_subnet_array($ip1, $ip2) {

 	if (is_ipaddrv4($ip1) && is_ipaddrv4($ip2)) {
@ -986,12 +986,18 @@ function is_domain($domain, $allow_wildcard=false) {
 }

 /* returns true if $macaddr is a valid MAC address */
-function is_macaddr($macaddr) {
+function is_macaddr($macaddr, $partial=false) {
 	$values = explode(":", $macaddr);
-	if (count($values) != 6) {
+
+	/* Verify if the MAC address has a proper amount of parts for either a partial or full match. */
+	if ($partial) {
+		if ((count($values) < 1) || (count($values) > 6)) {
+			return false;
+		}
+	} elseif (count($values) != 6) {
 		return false;
 	}
-	for ($i = 0; $i < 6; $i++) {
+	for ($i = 0; $i < count($values); $i++) {
 		if (ctype_xdigit($values[$i]) == false)
 			return false;
 		if (hexdec($values[$i]) < 0 || hexdec($values[$i]) > 255)
@ -1784,10 +1790,11 @@ function arp_get_mac_by_ip($ip) {

 /* return a fieldname that is safe for xml usage */
 function xml_safe_fieldname($fieldname) {
-	$replace = array('/', '-', ' ', '!', '@', '#', '$', '%', '^', '&', '*', '(', ')',
-			 '_', '+', '=', '{', '}', '[', ']', '|', '/', '<', '>', '?',
-			 ':', ',', '.', '\'', '\\'
-		);
+	$replace = array(
+	    '/', '-', ' ', '!', '@', '#', '$', '%', '^', '&', '*', '(', ')',
+	    '_', '+', '=', '{', '}', '[', ']', '|', '/', '<', '>', '?',
+	    ':', ',', '.', '\'', '\\'
+	);
 	return strtolower(str_replace($replace, "", $fieldname));
 }

@ -2546,4 +2553,92 @@ function validateipaddr(&$addr, $type, $label, &$err_msg, $alias=false) {

 	return false;
 }
+
+/* format a string to look (more) like the expected DUID format:
+ * 1) Replace any "-" with ":"
+ * 2) If the user inputs 14 components, then add the expected "0e:00:" to the front.
+ *    This is convenience, because the actual DUID (which is reported in logs) is the last 14 components.
+ * 3) If any components are input with just a single char (hex digit hopefully), put a "0" in front.
+ *
+ * The final result should be closer to:
+ *
+ * "0e:00:00:01:00:01:nn:nn:nn:nn:nn:nn:nn:nn:nn:nn"
+ *
+ * This function does not validate the input. is_duid() will do validation.
+*/
+function format_duid($dhcp6duid) {
+	$values = explode(":", strtolower(str_replace("-", ":", $dhcp6duid)));
+	if (count($values) == 14) {
+		array_unshift($values, "0e", "00");
+	}
+
+	array_walk($values, function(&$value) {
+		$value = str_pad($value, 2, '0', STR_PAD_LEFT);
+	});
+
+	return implode(":", $values);
+}
+
+/* returns true if $dhcp6duid is a valid duid entry */
+function is_duid($dhcp6duid) {
+	$values = explode(":", $dhcp6duid);
+	if (count($values) != 16 || strlen($dhcp6duid) != 47) {
+		return false;
+	}
+	for ($i = 0; $i < 16; $i++) {
+		if (ctype_xdigit($values[$i]) == false)
+			return false;
+		if (hexdec($values[$i]) < 0 || hexdec($values[$i]) > 255)
+			return false;
+	}
+	return true;
+}
+
+/* Write the DHCP6 DUID file */
+function write_dhcp6_duid($duidstring) {
+	// Create the hex array from the dhcp6duid config entry and write to file
+	global $g;
+
+	if(!is_duid($duidstring)) {
+		log_error(gettext("Error: attempting to write DUID file - Invalid DUID detected"));
+		return false;
+	}
+	$temp = str_replace(":","",$duidstring);
+	$duid_binstring = pack("H*",$temp);
+	if ($fd = fopen("{$g['vardb_path']}/dhcp6c_duid", "wb")) {
+		fwrite($fd, $duid_binstring);
+		fclose($fd);
+		return true;
+	}
+	log_error(gettext("Error: attempting to write DUID file - File write error"));
+	return false;
+}
+
+/* returns duid string from 'vardb_path']}/dhcp6c_duid' */
+function get_duid_from_file() {
+	global $g;
+
+	$duid_ASCII = "";
+	$count = 0;
+
+	if (file_exists("{$g['vardb_path']}/dhcp6c_duid") &&
+	    ($fd = fopen("{$g['vardb_path']}/dhcp6c_duid", "r"))) {
+		if(filesize("{$g['vardb_path']}/dhcp6c_duid")==16) {
+			$buffer = fread($fd,16);
+			while($count < 16) {
+				$duid_ASCII .= bin2hex($buffer[$count]);
+				$count++;
+				if($count < 16) {
+					$duid_ASCII .= ":";
+				}
+			}
+		}
+		fclose($fd);
+	}
+	//if no file or error with read then the string returns blanked DUID string
+	if(!is_duid($duid_ASCII)) {
+		return "--:--:--:--:--:--:--:--:--:--:--:--:--:--:--:--";
+	}
+	return($duid_ASCII);
+}
 ?>
--- a/src/etc/inc/vpn.inc
+++ b/src/etc/inc/vpn.inc
@ -47,10 +47,11 @@ function vpn_logging_cfgtxt() {
 	global $config, $ipsec_log_cats, $ipsec_log_sevs;

 	$cfgtext = array();
+	$log_levels = ipsec_get_loglevels();
 	foreach (array_keys($ipsec_log_cats) as $cat) {
-		if (is_numeric($config['ipsec']['logging'][$cat]) &&
-		    in_array(intval($config['ipsec']['logging'][$cat]), array_keys($ipsec_log_sevs), true)) {
-			$cfgtext[] = "${cat} = {$config['ipsec']['logging'][$cat]}";
+		if (is_numeric($log_levels[$cat]) &&
+		    in_array(intval($log_levels[$cat]), array_keys($ipsec_log_sevs), true)) {
+			$cfgtext[] = "${cat} = {$log_levels[$cat]}";
 		}
 	}

--- a/src/etc/pfSense-rc
+++ b/src/etc/pfSense-rc
@ -105,6 +105,20 @@ while [ ${mount_rc} -ne 0 -a ${attempts} -lt 3 ]; do
 	attempts=$((attempts+1))
 done

+# Handle ZFS read-only case
+/sbin/kldstat -qm zfs
+if [ $? -eq 0 ]; then
+	ZFSFSAVAILABLE=$(/sbin/zfs mount 2>/dev/null | wc -l)
+	if [ $ZFSFSAVAILABLE -eq 0 ]; then
+		/sbin/kldunload zfs
+	elif [ -f /usr/bin/grep ]; then
+		ZFSROOT=`/sbin/zfs mount | /usr/bin/grep ' /$' | /usr/bin/cut -d ' ' -f 1`
+		if [ "$ZFSROOT" != "" ]; then
+			/sbin/zfs set readonly=off $ZFSROOT
+		fi
+	fi
+fi
+
 # If /conf is a directory, convert it to a symlink to /cf/conf
 if [ -d "/conf" ]; then
 	# If item is not a symlink then rm and recreate
@ -122,14 +136,16 @@ if [ "${USE_MFS_TMPVAR}" != "true" -a -f /root/var/db/pkg/local.sqlite ]; then
 	MOVE_PKG_DATA=1
 	rm -rf /var/db/pkg 2>/dev/null
 	rm -rf /var/cache/pkg 2>/dev/null
-	mv /root/var/db/pkg /var/db
-	mv /root/var/cache/pkg /var/cache
+	mv -f /root/var/db/pkg /var/db
+	mv -f /root/var/cache/pkg /var/cache
 # If use MFS var is enabled, move files to a safe place
 elif [ "${USE_MFS_TMPVAR}" = "true" -a -f /var/db/pkg/local.sqlite ]; then
 	MOVE_PKG_DATA=1
+	rm -rf /root/var/db/pkg 2>/dev/null
+	rm -rf /root/var/cache/pkg 2>/dev/null
 	/bin/mkdir -p /root/var/db /root/var/cache
-	mv /var/db/pkg /root/var/db
-	mv /var/cache/pkg /root/var/cache
+	mv -f /var/db/pkg /root/var/db
+	mv -f /var/cache/pkg /root/var/cache
 fi

 if [ "${USE_MFS_TMPVAR}" = "true" ]; then
@ -142,6 +158,9 @@ if [ -n "${MOVE_PKG_DATA}" -o "${USE_MFS_TMPVAR}" = "true" ]; then
 	ln -sf ../../root/var/cache/pkg /var/cache/pkg
 fi

+# Restore contents of the RAM disk store
+/etc/rc.restore_ramdisk_store
+
 # Make sure /home exists
 [ -d /home ] \
 	|| mkdir /home
@ -150,20 +169,6 @@ fi
 /bin/rm -f /root/TRIM_set
 /bin/rm -f /root/TRIM_unset

-# Handle ZFS read-only case
-/sbin/kldstat -qm zfs
-if [ $? -eq 0 ]; then
-	ZFSFSAVAILABLE=$(/sbin/zfs mount 2>/dev/null | wc -l)
-	if [ $ZFSFSAVAILABLE -eq 0 ]; then
-		/sbin/kldunload zfs
-	elif [ -f /usr/bin/grep ]; then
-		ZFSROOT=`/sbin/zfs mount | /usr/bin/grep ' /$' | /usr/bin/cut -d ' ' -f 1`
-		if [ "$ZFSROOT" != "" ]; then
-			/sbin/zfs set readonly=off $ZFSROOT
-		fi
-	fi
-fi
-
 # Disable APM on ATA drives. Leaving this on will kill drives long-term, especially laptop drives, by generating excessive Load Cycles.
 if [ -f /etc/rc.disable_hdd_apm ]; then
 	/etc/rc.disable_hdd_apm
--- a/src/etc/pfSense-rc.shutdown
+++ b/src/etc/pfSense-rc.shutdown
@ -50,4 +50,5 @@ if [ "${USE_MFS_TMPVAR}" = "true" ] || [ "${DISK_TYPE}" = "md" ]; then
 	/etc/rc.backup_aliastables.sh
 	/etc/rc.backup_rrd.sh
 	/etc/rc.backup_dhcpleases.sh
+	/etc/rc.backup_logs.sh
 fi
--- a/src/etc/rc.backup_aliastables.sh
+++ b/src/etc/rc.backup_aliastables.sh
@ -3,18 +3,23 @@
 : ${DBPATH:=/var/db/aliastables}
 : ${CF_CONF_PATH:=/cf/conf}

-: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store/${DBPATH}}
+: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store}

 # Save the alias tables database to the RAM disk store.
 if [ -d "${DBPATH}" ]; then
+	echo -n "Saving Alias Tables to RAM disk store...";
+
 	if [ ! -d "${RAM_Disk_Store}" ]; then
 		mkdir -p "${RAM_Disk_Store}"
 	fi

 	for aliastablefile in "${DBPATH}"/* ; do
 		filename="$(basename ${aliastablefile})"
-		if [ ! -f "${RAM_Disk_Store}/${filename}.tgz" ]; then
-			cd / && /usr/bin/tar -czf "${RAM_Disk_Store}/${filename}.tgz" -C / "${DBPATH}/${filename}"
+		if [ ! -f "${RAM_Disk_Store}/${filename}.tgz" -o "${RAM_Disk_Store}/${filename}.tgz" -ot "${DBPATH#/}/${filename}" ]; then
+			[ -f "${RAM_Disk_Store}/${filename}.tgz" ] && /bin/rm -f "${RAM_Disk_Store}/${filename}.tgz"
+			/usr/bin/tar -czf "${RAM_Disk_Store}/${filename}.tgz" -C / "${DBPATH#/}/${filename}"
 		fi
 	done
+
+	echo "done.";
 fi
--- a/src/etc/rc.backup_dhcpleases.sh
+++ b/src/etc/rc.backup_dhcpleases.sh
@ -1,6 +1,21 @@
 #!/bin/sh

-# Save the DHCP lease database to the config path.
-if [ -d "/var/dhcpd/var/db" ]; then
-	cd / && tar -czf /cf/conf/dhcpleases.tgz -C / var/dhcpd/var/db/
+: ${DBPATH:=/var/dhcpd/var/db}
+: ${CF_CONF_PATH:=/cf/conf}
+
+: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store}
+
+# Save the DHCP lease database to the RAM disk store.
+if [ -d "${DBPATH}" ]; then
+	echo -n "Saving DHCP Leases to RAM disk store...";
+
+	[ -f "${RAM_Disk_Store}/dhcpleases.tgz" ] && /bin/rm -f "${RAM_Disk_Store}/dhcpleases.tgz"
+
+	if [ ! -d "${RAM_Disk_Store}" ]; then
+		mkdir -p "${RAM_Disk_Store}"
+	fi
+
+	/usr/bin/tar -czf "${RAM_Disk_Store}/dhcpleases.tgz" -C / "${DBPATH#/}/"
+
+	echo "done.";
 fi
--- a/src/etc/rc.backup_logs.sh
+++ b/src/etc/rc.backup_logs.sh
@ -0,0 +1,41 @@
+#!/bin/sh
+#
+# rc.backup_logs.sh
+#
+# part of pfSense (https://www.pfsense.org)
+# Copyright (c) 2016 Rubicon Communications, LLC (Netgate)
+# All rights reserved.
+#
+# Based on src/etc/rc.d/savecore from FreeBSD
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+: ${DBPATH:=/var/log}
+: ${CF_CONF_PATH:=/cf/conf}
+
+: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store}
+
+# Save the logs database to the RAM disk store.
+if [ -d "${DBPATH}" ]; then
+	echo -n "Saving Logs to RAM disk store...";
+
+	[ -f "${RAM_Disk_Store}/logs.tgz" ] && /bin/rm -f "${RAM_Disk_Store}/logs.tgz"
+
+	if [ ! -d "${RAM_Disk_Store}" ]; then
+		mkdir -p "${RAM_Disk_Store}"
+	fi
+
+	/usr/bin/tar -czf "${RAM_Disk_Store}/logs.tgz" -C / "${DBPATH#/}/"
+
+	echo "done.";
+fi
--- a/src/etc/rc.backup_rrd.sh
+++ b/src/etc/rc.backup_rrd.sh
@ -1,25 +1,21 @@
 #!/bin/sh

-: ${RRDDBPATH:=/var/db/rrd}
+: ${DBPATH:=/var/db/rrd}
 : ${CF_CONF_PATH:=/cf/conf}

-# Save the rrd databases to the config path.
-if [ -d "${RRDDBPATH}" ]; then
-	[ -f "${CF_CONF_PATH}/rrd.tgz" ] && /bin/rm -f "${CF_CONF_PATH}"/rrd.tgz
+: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store}

-	tgzlist=""
+# Save the rrd databases to the RAM disk store.
+if [ -d "${DBPATH}" ]; then
+	echo -n "Saving RRD to RAM disk store...";

-	for rrdfile in "${RRDDBPATH}"/*.rrd ; do
-		xmlfile="${rrdfile%.rrd}.xml"
-		tgzfile="${rrdfile%.rrd}.tgz"
-		/usr/bin/nice -n20 /usr/local/bin/rrdtool dump "$rrdfile" "$xmlfile"
-		cd / && /usr/bin/tar -czf "${tgzfile}" -C / "${RRDDBPATH#/}"/*.xml
-		/bin/rm -f "${RRDDBPATH}"/*.xml
-		tgzlist="${tgzlist} @${tgzfile}"
-	done
-	if [ -n "${tgzlist}" ]; then
-		cd / && /usr/bin/tar -czf "${CF_CONF_PATH}/rrd.tgz" ${tgzlist}
-		/bin/rm -f "${RRDDBPATH}"/*.tgz
+	[ -f "${RAM_Disk_Store}/rrd.tgz" ] && /bin/rm -f "${RAM_Disk_Store}/rrd.tgz"
+
+	if [ ! -d "${RAM_Disk_Store}" ]; then
+		mkdir -p "${RAM_Disk_Store}"
 	fi
-fi

+	/usr/bin/tar -czf "${RAM_Disk_Store}/rrd.tgz" -C / "${DBPATH#/}/"
+
+	echo "done.";
+fi
--- a/src/etc/rc.bootup
+++ b/src/etc/rc.bootup
@ -176,8 +176,10 @@ interfaces_loopback_configure();
 /* start syslogd */
 system_syslogd_start();

-/* restore alias tables */
-restore_aliastables();
+/* Log the RAM disk restore messages. */
+if (file_exists("/var/log/restore_ramdisk_store.boot")) {
+	exec("logger -f /var/log/restore_ramdisk_store.boot");
+}

 echo "Starting Secure Shell Services...";
 send_event("service reload sshd");
--- a/src/etc/rc.prunecaptiveportal
+++ b/src/etc/rc.prunecaptiveportal
@ -43,18 +43,16 @@ if (!is_array($config['captiveportal'][$cpzone])) {
 }
 $cpzoneid = $config['captiveportal'][$cpzone]['zoneid'];

-if (file_exists("{$g['tmp_path']}/.rc.prunecaptiveportal.{$cpzone}.running")) {
-	$stat = stat("{$g['tmp_path']}/.rc.prunecaptiveportal.{$cpzone}.running");
-	if (time() - $stat['mtime'] >= 120) {
-		@unlink("{$g['tmp_path']}/.rc.prunecaptiveportal.{$cpzone}.running");
-	} else {
-		log_error("Skipping CP pruning process because previous/another instance is already running");
-		return;
-	}
+$rcprunelock = try_lock("rcprunecaptiveportal{$cpzone}", 3);
+
+if (!$rcprunelock) {
+	log_error("Skipping CP pruning process for zone {$cpzone} because previous/another instance is already running");
+	unlock_force("rcprunecaptiveportal{$cpzone}");
+	return;
 }

-@file_put_contents("{$g['tmp_path']}/.rc.prunecaptiveportal.{$cpzone}.running", "");
 captiveportal_prune_old();
-@unlink("{$g['tmp_path']}/.rc.prunecaptiveportal.{$cpzone}.running");
+
+unlock($rcprunelock);

 ?>
--- a/src/etc/rc.reboot
+++ b/src/etc/rc.reboot
@ -44,6 +44,7 @@ if [ "${USE_MFS_TMPVAR}" = "true" ] || [ "${DISK_TYPE}" = "md" ]; then
 	/etc/rc.backup_aliastables.sh
 	/etc/rc.backup_rrd.sh
 	/etc/rc.backup_dhcpleases.sh
+	/etc/rc.backup_logs.sh
 fi

 sleep 1
--- a/src/etc/rc.restore_ramdisk_store
+++ b/src/etc/rc.restore_ramdisk_store
@ -0,0 +1,82 @@
+#!/bin/sh
+#
+# rc.restore_ramdisk_store
+#
+# part of pfSense (https://www.pfsense.org)
+# Copyright (c) 2004-2016 Rubicon Communications, LLC (Netgate)
+# All rights reserved.
+#
+# Based on src/etc/rc.d/savecore from FreeBSD
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Wildcard file existence check function
+wildcard_file_exists() {
+	for file in "$1"; do
+		if [ -f "$file" ]; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+: ${DBPATH:=/var/dhcpd/var/db}
+: ${CF_CONF_PATH:=/cf/conf}
+
+: ${RAM_Disk_Store:=${CF_CONF_PATH}/RAM_Disk_Store}
+
+# See if there are any backup files (*.tgz) in the RAM disk store.  If so, restore them.
+if wildcard_file_exists "${RAM_Disk_Store}/"*".tgz"; then
+
+	mesg="Restoring contents of RAM disk store..."
+	echo -n "$mesg"
+
+	USE_MFS_TMPVAR=$(/usr/local/sbin/read_xml_tag.sh boolean system/use_mfs_tmpvar)
+
+	# Restore the ram disk
+	for backup_file in "${RAM_Disk_Store}/"*".tgz"; do
+		if [ -f "$backup_file" ]; then
+			/usr/bin/tar -xzf "${backup_file}" -C / 2>&1
+			exit_code=$?
+			if [ $exit_code -ne 0 ]; then
+				mesg="$mesg\nRAM disk restore failed: exit code $exit_code: $backup_file"
+				error=1;
+				continue
+			fi
+
+			mesg="$mesg\nRAM disk restore succeeded: $backup_file"
+
+			#If this backup is still there on a full install, but we aren't going to use ram disks, remove the archive since this is a transition.
+			if [ "${USE_MFS_TMPVAR}" != "true" ]; then
+				/bin/rm -f "${backup_file}"
+			fi
+		fi
+	done
+
+	if [ $error ]; then
+		mesg="$mesg\nRAM disk restore failed."
+		echo " error.";
+	else
+		mesg="$mesg\nRAM disk restore succeeded."
+		echo " done.";
+	fi
+
+	/bin/mkdir -p /var/log/
+	printf "$mesg" > /var/log/restore_ramdisk_store.boot
+
+	# See if there are any backup files (*.tgz) in the RAM disk store.  If not, and no error, clean up.
+	if ! wildcard_file_exists "${RAM_Disk_Store}/"*".tgz" && [ ! $error ]; then
+		/bin/rmdir "$RAM_Disk_Store" >/dev/null 2>&1
+		/bin/rm -f /var/log/restore_ramdisk_store.boot
+	fi
+fi
--- a/src/etc/skel/dot.shrc
+++ b/src/etc/skel/dot.shrc
@ -32,6 +32,12 @@ if [ "${HTTP_PROXY_AUTH_USER}" != "" ] && [ "${HTTP_PROXY_AUTH_PASS}" != "" ]; t
 	export HTTP_PROXY_AUTH
 fi

+USE_MFS_TMPVAR=$(/usr/local/sbin/read_xml_tag.sh boolean system/use_mfs_tmpvar)
+if [ "${USE_MFS_TMPVAR}" = "true" ]; then
+	export PKG_DBDIR='/root/var/db/pkg'
+	export PKG_CACHEDIR='/root/var/cache/pkg'
+fi
+
 # Detect interactive logins and display the shell
 unset _interactive
 if [ -n "${SSH_TTY}" ]; then
--- a/src/etc/skel/dot.tcshrc
+++ b/src/etc/skel/dot.tcshrc
@ -55,3 +55,9 @@ if ( ${http_proxy_auth_user} != "" && ${http_proxy_auth_pass} != "" ) then
 	set http_proxy_auth="basic:*:${http_proxy_auth_user}:${http_proxy_auth_pass}"
 	setenv HTTP_PROXY_AUTH "${http_proxy_auth}"
 endif
+
+set use_mfs_tmpvar=`/usr/local/sbin/read_xml_tag.sh boolean system/use_mfs_tmpvar`
+if ( $use_mfs_tmpvar == "true" ) then
+	setenv PKG_DBDIR '/root/var/db/pkg'
+	setenv PKG_CACHEDIR '/root/var/cache/pkg'
+endif
--- a/src/usr/local/www/crash_reporter.php
+++ b/src/usr/local/www/crash_reporter.php
@ -103,8 +103,10 @@ exec("/bin/cat /tmp/PHP_errors.log", $php_errors);
 		if (count($php_errors) > 0) {
 			$crash_reports .= "\nPHP Errors:\n";
 			$crash_reports .= implode("\n", $php_errors) . "\n\n";
+		} else {
+			$crash_reports .= "\nNo PHP errors found.\n";
 		}
-		if (is_array($crash_files))	{
+		if (count($crash_files) > 0) {
 			foreach ($crash_files as $cf) {
 				if (filesize($cf) < FILE_SIZE) {
 					$crash_reports .= "\nFilename: {$cf}\n";
@ -112,7 +114,7 @@ exec("/bin/cat /tmp/PHP_errors.log", $php_errors);
 				}
 			}
 		} else {
-			echo gettext("Could not locate any crash data.");
+			$crash_reports .= "\nNo FreeBSD crash data found.\n";
 		}
 ?>
 	<div class="panel panel-default">
--- a/src/usr/local/www/css/pfSense-BETA.css
+++ b/src/usr/local/www/css/pfSense-BETA.css
@ -86,3 +86,10 @@ a.fa, i.fa {
 .ui-widget {
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
 }
+
+/** This style adds a gray outline around unchecked checkboxes to
+make them more visible. Unfortunately the exact alignment of those
+outlines varies considerably with browser/OS **/
+input[type="checkbox"]:not(:checked) {
+  outline: 1px solid #888888;
+}
--- a/src/usr/local/www/css/pfSense.css
+++ b/src/usr/local/www/css/pfSense.css
@ -70,7 +70,7 @@ h1 a:hover, h1 a:active {
 }

 /* Zero-width optional linebreaks can help the browser to linebreak at 'good' places.
-   Unfortunately the two most compatible options aren't consistently supported. 
+   Unfortunately the two most compatible options aren't consistently supported.
   "\00200B" or #8203; is part of unicode and widely implemented; and <wbr> is widely
   supported even on old browsers but not IE<5.5 and IE>7.
   http://stackoverflow.com/a/23759279/2238378 suggests a neat "80%" solution for broad
--- a/src/usr/local/www/diag_reboot.php
+++ b/src/usr/local/www/diag_reboot.php
@ -43,8 +43,8 @@ $guiretry = 20;		// Seconds to try again if $guitimeout was not long enough
 $pgtitle = array(gettext("Diagnostics"), gettext("Reboot"));
 include("head.inc");

-
-if (($_SERVER['REQUEST_METHOD'] == 'POST') && ($_POST['override'] != "yes")) {
+if (($_SERVER['REQUEST_METHOD'] == 'POST') && (empty($_POST['override']) ||
+    ($_POST['override'] != "yes"))):
 	if (DEBUG) {
 		print_info_box(gettext("Not actually rebooting (DEBUG is set true)."), 'success');
 	} else {
@ -98,7 +98,7 @@ events.push(function() {
 //]]>
 </script>
 <?php
-} else {
+else:

 ?>

@ -135,6 +135,6 @@ events.push(function() {
 </script>
 <?php

-}
+endif;

 include("foot.inc");
--- a/src/usr/local/www/firewall_aliases.php
+++ b/src/usr/local/www/firewall_aliases.php
@ -48,15 +48,8 @@ if ($_POST) {
 		$retval = 0;

 		/* reload all components that use aliases */
-		$retval = filter_configure();
+		$retval |= filter_configure();

-		if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message($retval);
-			$class = "success";
-		} else {
-			$savemsg = $retval;
-			$class = "danger";
-		}
 		if ($retval == 0) {
 			clear_subsystem_dirty('aliases');
 		}
@ -99,8 +92,7 @@ if ($_GET['act'] == "del") {
 		// Static routes
 		find_alias_reference(array('staticroutes', 'route'), array('network'), $alias_name, $is_alias_referenced, $referenced_by);
 		if ($is_alias_referenced == true) {
-			$savemsg = sprintf(gettext("Cannot delete alias. Currently in use by %s."), htmlspecialchars($referenced_by));
-			$class = "danger";
+			$delete_error = sprintf(gettext("Cannot delete alias. Currently in use by %s."), htmlspecialchars($referenced_by));
 		} else {
 			if (preg_match("/urltable/i", $a_aliases[$_GET['id']]['type'])) {
 				// this is a URL table type alias, delete its file as well
@ -173,8 +165,11 @@ $shortcut_section = "aliases";

 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, $class);
+if ($delete_error) {
+	print_info_box($delete_error, 'danger');
+}
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('aliases')) {
--- a/src/usr/local/www/firewall_nat.php
+++ b/src/usr/local/www/firewall_nat.php
@ -86,7 +86,6 @@ if ($_POST) {
 		$retval = 0;

 		$retval |= filter_configure();
-		$savemsg = get_std_save_message($retval);

 		pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/apply");

@ -186,8 +185,8 @@ if (isset($_POST['del_x'])) {
 $pgtitle = array(gettext("Firewall"), gettext("NAT"), gettext("Port Forward"));
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('natconf')) {
--- a/src/usr/local/www/firewall_nat_1to1.php
+++ b/src/usr/local/www/firewall_nat_1to1.php
@ -68,7 +68,6 @@ if ($_POST) {
 	if ($_POST['apply']) {
 		$retval = 0;
 		$retval |= filter_configure();
-		$savemsg = get_std_save_message($retval);

 		if ($retval == 0) {
 			clear_subsystem_dirty('natconf');
@ -122,8 +121,8 @@ if (isset($_POST['del_x'])) {
 $pgtitle = array(gettext("Firewall"), gettext("NAT"), gettext("1:1"));
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('natconf')) {
--- a/src/usr/local/www/firewall_nat_npt.php
+++ b/src/usr/local/www/firewall_nat_npt.php
@ -69,7 +69,6 @@ if ($_POST) {
 	if ($_POST['apply']) {
 		$retval = 0;
 		$retval |= filter_configure();
-		$savemsg = get_std_save_message($retval);

 		if ($retval == 0) {
 			clear_subsystem_dirty('natconf');
@ -122,8 +121,8 @@ if (isset($_POST['del_x'])) {
 $pgtitle = array(gettext("Firewall"), gettext("NAT"), gettext("NPt"));
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('natconf')) {
--- a/src/usr/local/www/firewall_nat_out.php
+++ b/src/usr/local/www/firewall_nat_out.php
@ -82,12 +82,6 @@ if ($_POST['apply']) {
 	$retval = 0;
 	$retval |= filter_configure();

-	if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message($retval);
-	} else {
-		$savemsg = $retval;
-	}
-
 	if ($retval == 0) {
 		clear_subsystem_dirty('natconf');
 		clear_subsystem_dirty('filter');
@ -139,7 +133,7 @@ if ($_POST['save']) {
 				}
 			}
 		}
-		$savemsg = gettext("Default rules for each interface have been created.");
+		$default_rules_msg = gettext("Default rules for each interface have been created.");
 		unset($FilterIflist, $GatewaysList);
 	}

@ -206,8 +200,12 @@ if (isset($_POST['del_x'])) {
 $pgtitle = array(gettext("Firewall"), gettext("NAT"), gettext("Outbound"));
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($default_rules_msg) {
+	print_info_box($default_rules_msg, 'success');
+}
+
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('natconf')) {
--- a/src/usr/local/www/firewall_rules_edit.php
+++ b/src/usr/local/www/firewall_rules_edit.php
@ -1245,7 +1245,7 @@ if ($if == "FloatingRules" || isset($pconfig['floating'])) {
 		)
 	));

-	$section->addInput(new Form_Input(
+	$form->addGlobal(new Form_Input(
 		'floating',
 		'Floating',
 		'hidden',
--- a/src/usr/local/www/firewall_shaper.php
+++ b/src/usr/local/www/firewall_shaper.php
@ -121,19 +121,11 @@ if ($_GET) {
 			}

 			if (write_config()) {
+				$changes_applied = true;
 				$retval = 0;
 				$retval |= filter_configure();
-
-				if (stristr($retval, "error") <> true) {
-					$savemsg = get_std_save_message($retval);
-					$class = 'success';
-				} else {
-					$savemsg = $retval;
-					$class = 'warning';
-				}
 			} else {
-				$savemsg = gettext("Unable to write config.xml (Access Denied?).");
-				$class = 'warning';
+				$no_write_config_msg = gettext("Unable to write config.xml (Access Denied?).");
 			}

 			$dfltmsg = true;
@ -280,17 +272,9 @@ if ($_POST) {
 		}
 	} else if ($_POST['apply']) {
 		write_config();
-
+		$changes_applied = true;
 		$retval = 0;
-		$retval = filter_configure();
-
-		if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message($retval);
-			$class = 'success';
-		} else {
-			$savemsg = $retval;
-			$class = 'warning';
-		}
+		$retval |= filter_configure();

 		/* reset rrd queues */
 		system("rm -f /var/db/rrd/*queuedrops.rrd");
@ -369,8 +353,12 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, $class);
+if ($no_write_config_msg) {
+	print_info_box($no_write_config_msg, 'danger');
+}
+
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('shaper')) {
@ -452,7 +440,7 @@ if (!$dfltmsg && $sform)  {
 	</table>
 </div>

-<?php if (empty(get_interface_list_to_show())): ?>
+<?php if (empty(get_interface_list_to_show()) && (!is_array($altq_list_queues) || (count($altq_list_queues) == 0))): ?>
 <div>
 	<div class="infoblock blockopen">
 		<?php print_info_box(gettext("This firewall does not have any interfaces assigned that are capable of using ALTQ traffic shaping."), 'danger', false); ?>
--- a/src/usr/local/www/firewall_shaper_queues.php
+++ b/src/usr/local/www/firewall_shaper_queues.php
@ -167,15 +167,7 @@ if ($_POST['apply']) {

 	$retval = 0;
 	/* Setup pf rules since the user may have changed the optimization value */
-	$retval = filter_configure();
-	$savemsg = get_std_save_message($retval);
-	if (stristr($retval, "error") <> true) {
-		$savemsg = get_std_save_message($retval);
-		$class = 'alert-success';
-	} else {
-		$savemsg = $retval;
-		$class = 'alert-danger';
-	}
+	$retval |= filter_configure();

 	/* reset rrd queues */
 	system("rm -f /var/db/rrd/*queuedrops.rrd");
@ -198,8 +190,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, $class);
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('shaper')) {
@ -231,7 +223,7 @@ display_top_tabs($tab_array);
 	</div>
 </form>

-<?php if (empty(get_interface_list_to_show())): ?>
+<?php if (empty(get_interface_list_to_show()) && (!is_array($altq_list_queues) || (count($altq_list_queues) == 0))): ?>
 <div>
 	<div class="infoblock blockopen">
 		<?php print_info_box(gettext("This firewall does not have any interfaces assigned that are capable of using ALTQ traffic shaping."), 'danger', false); ?>
--- a/src/usr/local/www/firewall_shaper_vinterface.php
+++ b/src/usr/local/www/firewall_shaper_vinterface.php
@ -134,20 +134,11 @@ if ($_GET) {
 				}
 			}
 			if (write_config()) {
+				$changes_applied = true;
 				$retval = 0;
-				$retval = filter_configure();
-
-				if (stristr($retval, "error") != true) {
-					$savemsg = get_std_save_message($retval);
-					$class = 'success';
-				} else {
-					$savemsg = $retval;
-					$class = 'danger';
-				}
-
+				$retval |= filter_configure();
 			} else {
-				$savemsg = gettext("Unable to write config.xml (Access Denied?).");
-				$class = 'danger';
+				$no_write_config_msg = gettext("Unable to write config.xml (Access Denied?).");
 			}

 			$dfltmsg = true;
@ -271,16 +262,9 @@ if ($_POST) {
 	} else if ($_POST['apply']) {
 		write_config();

+		$changes_applied = true;
 		$retval = 0;
-		$retval = filter_configure();
-
-		if (stristr($retval, "error") != true) {
-			$savemsg = get_std_save_message($retval);
-			$class = 'success';
-		} else {
-			$savemsg = $retval;
-			$class = 'danger';
-		}
+		$retval |= filter_configure();

 		/* XXX: TODO Make dummynet pretty graphs */
 		//	enable_rrd_graphing();
@ -369,8 +353,12 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, $class);
+if ($no_write_config_msg) {
+	print_info_box($no_write_config_msg, 'danger');
+}
+
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('shaper')) {
--- a/src/usr/local/www/firewall_shaper_wizards.php
+++ b/src/usr/local/www/firewall_shaper_wizards.php
@ -42,14 +42,7 @@ if ($_POST['apply']) {

 	$retval = 0;
 	/* Setup pf rules since the user may have changed the optimization value */
-	$retval = filter_configure();
-	if (stristr($retval, "error") <> true) {
-		$savemsg = get_std_save_message($retval);
-		$class = 'success';
-	} else {
-		$savemsg = $retval;
-		$class = 'warning';
-	}
+	$retval |= filter_configure();

 	/* reset rrd queues */
 	unlink_if_exists("/var/db/rrd/*queuedrops.rrd");
@ -82,8 +75,8 @@ $tab_array[] = array(gettext("Limiters"), false, "firewall_shaper_vinterface.php
 $tab_array[] = array(gettext("Wizards"), true, "firewall_shaper_wizards.php");
 display_top_tabs($tab_array);

-if ($savemsg) {
-	print_info_box($savemsg, $class);
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('shaper')) {
--- a/src/usr/local/www/firewall_virtual_ip.php
+++ b/src/usr/local/www/firewall_virtual_ip.php
@ -79,7 +79,6 @@ if ($_POST) {

 		$retval = 0;
 		$retval |= filter_configure();
-		$savemsg = get_std_save_message($retval);

 		clear_subsystem_dirty('vip');
 	}
@ -240,8 +239,8 @@ include("head.inc");

 if ($input_errors) {
 	print_input_errors($input_errors);
-} else if ($savemsg) {
-	print_info_box($savemsg, 'success');
+} else if ($_POST['apply']) {
+	print_apply_result_box($retval);
 } else if (is_subsystem_dirty('vip')) {
 	print_apply_box(gettext("The VIP configuration has been changed.") . "<br />" . gettext("The changes must be applied for them to take effect."));
 }
--- a/src/usr/local/www/guiconfig.inc
+++ b/src/usr/local/www/guiconfig.inc
@ -323,6 +323,27 @@ function print_apply_box($msg) {
 	print_info_box($msg, "warning", "apply", gettext("Apply Changes"), 'fa-check', 'success');
 }

+// Format and print a box reporting that changes have been applied
+// $retval = status value from the functions called to apply the changes
+// 0 is good
+// non-zero is a problem
+// $extra_text = optional extra text to display after the standard message
+function print_apply_result_box($retval, $extra_text="") {
+	$result_msg = get_std_save_message($retval);
+	if ($retval === 0) {
+		// 0 is success
+		$severity = "success";
+	} else {
+		// non-zero means there was some problem
+		$severity = "warning";
+	}
+
+	if (strlen($extra_text) > 0) {
+		$result_msg .= " " . $extra_text;
+	}
+	print_info_box($result_msg, $severity);
+}
+
 /*
 * Print Bootstrap callout
 *
@ -350,10 +371,16 @@ function print_callout($msg, $class = 'info', $heading = '') {
 	echo $callout;
 }

-function get_std_save_message($ok) {
+function get_std_save_message($retval) {
 	$filter_related = false;
 	$filter_pages = array("nat", "filter");
-	$to_return = gettext("The changes have been applied successfully.");
+	if ($retval === 0) {
+		// 0 is success
+		$to_return = gettext("The changes have been applied successfully.");
+	} else {
+		// non-zero means there was some problem
+		$to_return = gettext("There was a problem applying the changes. See the <a href=\"status_logs.php\">System Logs</a>.");
+	}
 	foreach ($filter_pages as $fp) {
 		if (stristr($_SERVER['SCRIPT_FILENAME'], $fp)) {
 			$filter_related = true;
@ -508,7 +535,7 @@ function genhtmltitle($title) {
 		$bc = "";
 	}

-	return $heading . $bc;
+	return $bc;
 }

 /* update the changedesc and changecount(er) variables */
--- a/src/usr/local/www/head.inc
+++ b/src/usr/local/www/head.inc
@ -425,7 +425,7 @@ $allow_clear_notices = false;
 if (are_notices_pending()) {
 	// Evaluate user privs to determine if notices should be displayed, and if the user can clear them.
 	$user_entry = getUserEntry($_SESSION['Username']);
-	if (userHasPrivilege($user_entry, "user-view-clear-notices") || userHasPrivilege($user_entry, "page-all")) {
+	if (isAdminUID($_SESSION['Username']) || userHasPrivilege($user_entry, "user-view-clear-notices") || userHasPrivilege($user_entry, "page-all")) {
 		$display_notices = true;
 		$allow_clear_notices = true;
 	} elseif (userHasPrivilege($user_entry, "user-view-notices")) {
--- a/src/usr/local/www/interfaces.php
+++ b/src/usr/local/www/interfaces.php
@ -407,11 +407,14 @@ if (isset($wancfg['wireless'])) {

 }

+$changes_applied = false;
+
 if ($_POST['apply']) {
 	unset($input_errors);
 	if (!is_subsystem_dirty('interfaces')) {
 		$input_errors[] = gettext("The settings have already been applied!");
 	} else {
+		$retval = 0;
 		unlink_if_exists("{$g['tmp_path']}/config.cache");
 		clear_subsystem_dirty('interfaces');

@ -440,24 +443,24 @@ if ($_POST['apply']) {
 			}
 		}
 		/* restart snmp so that it binds to correct address */
-		services_snmpd_configure();
+		$retval |= services_snmpd_configure();

 		/* sync filter configuration */
 		setup_gateways_monitor();

 		clear_subsystem_dirty('interfaces');

-		filter_configure();
+		$retval |= filter_configure();

 		enable_rrd_graphing();

+		$changes_applied = true;
+
 		if (is_subsystem_dirty('staticroutes') && (system_routing_configure() == 0)) {
 			clear_subsystem_dirty('staticroutes');
 		}
 	}
 	@unlink("{$g['tmp_path']}/.interfaces.apply");
-	header("Location: interfaces.php?if={$if}");
-	exit;
 } else if ($_POST) {

 	unset($input_errors);
@ -1611,7 +1614,7 @@ function check_wireless_mode() {
 		if (!interface_wireless_clone("{$wlanif}_", $wancfg)) {
 			$input_errors[] = sprintf(gettext("Unable to change mode to %s. The maximum number of wireless clones supported in this mode may have been reached."), $wlan_modes[$wancfg['wireless']['mode']]);
 		} else {
-			mwexec("/sbin/ifconfig " . escapeshellarg($wlanif) . "_ destroy");
+			pfSense_interface_destroy("{$wlanif}_");
 		}
 		$wancfg['wireless']['mode'] = $old_wireless_mode;
 	}
@ -1695,11 +1698,10 @@ if (is_subsystem_dirty('interfaces')) {
 					gettext("Don't forget to adjust the DHCP Server range if needed after applying."));
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

-
 $form = new Form();

 $section = new Form_Section('General Configuration');
--- a/src/usr/local/www/interfaces_assign.php
+++ b/src/usr/local/www/interfaces_assign.php
@ -244,7 +244,7 @@ if (isset($_POST['add']) && isset($_POST['if_add'])) {

 		write_config();

-		$savemsg = gettext("Interface has been added.");
+		$action_msg = gettext("Interface has been added.");
 		$class = "success";
 	}

@ -255,15 +255,9 @@ if (isset($_POST['add']) && isset($_POST['if_add'])) {
 	} else {
 		write_config();

-		$retval = filter_configure();
-
-		if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message($retval);
-			$class = "success";
-		} else {
-			$savemsg = $retval;
-			$class = "danger";
-		}
+		$changes_applied = true;
+		$retval = 0;
+		$retval |= filter_configure();
 	}

 } else if (isset($_POST['Submit'])) {
@ -438,7 +432,7 @@ if (isset($_POST['add']) && isset($_POST['if_add'])) {

 			link_interface_to_vlans($realid, "update");

-			$savemsg = gettext("Interface has been deleted.");
+			$action_msg = gettext("Interface has been deleted.");
 			$class = "success";
 		}
 	}
@ -464,14 +458,14 @@ include("head.inc");
 if (file_exists("/var/run/interface_mismatch_reboot_needed")) {
 	if ($_POST) {
 		if ($rebootingnow) {
-			$savemsg = gettext("The system is now rebooting. Please wait.");
+			$action_msg = gettext("The system is now rebooting. Please wait.");
 			$class = "success";
 		} else {
 			$applymsg = gettext("Reboot is needed. Please apply the settings in order to reboot.");
 			$class = "warning";
 		}
 	} else {
-		$savemsg = gettext("Interface mismatch detected. Please resolve the mismatch, save and then click 'Apply Changes'. The firewall will reboot afterwards.");
+		$action_msg = gettext("Interface mismatch detected. Please resolve the mismatch, save and then click 'Apply Changes'. The firewall will reboot afterwards.");
 		$class = "warning";
 	}
 }
@ -482,8 +476,10 @@ if (file_exists("/tmp/reload_interfaces")) {
 	echo "<br /></p>\n";
 } elseif ($applymsg) {
 	print_apply_box($applymsg);
-} elseif ($savemsg) {
-	print_info_box($savemsg, $class);
+} elseif ($action_msg) {
+	print_info_box($action_msg, $class);
+} elseif ($changes_applied) {
+	print_apply_result_box($retval);
 }

 pfSense_handle_custom_code("/usr/local/pkg/interfaces_assign/pre_input_errors");
--- a/src/usr/local/www/interfaces_bridge.php
+++ b/src/usr/local/www/interfaces_bridge.php
@ -60,7 +60,7 @@ if ($_GET['act'] == "del") {
 		if (!does_interface_exist($a_bridges[$_GET['id']]['bridgeif'])) {
 			log_error("Bridge interface does not exist, skipping ifconfig destroy.");
 		} else {
-			mwexec("/sbin/ifconfig " . $a_bridges[$_GET['id']]['bridgeif'] . " destroy");
+			pfSense_interface_destroy($a_bridges[$_GET['id']]['bridgeif']);
 		}

 		unset($a_bridges[$_GET['id']]);
--- a/src/usr/local/www/interfaces_gif.php
+++ b/src/usr/local/www/interfaces_gif.php
@ -56,7 +56,7 @@ if ($_GET['act'] == "del") {
 	} else if (gif_inuse($_GET['id'])) {
 		$input_errors[] = gettext("This gif TUNNEL cannot be deleted because it is still being used as an interface.");
 	} else {
-		mwexec("/sbin/ifconfig " . $a_gifs[$_GET['id']]['gifif'] . " destroy");
+		pfSense_interface_destroy($a_gifs[$_GET['id']]['gifif']);
 		unset($a_gifs[$_GET['id']]);

 		write_config();
--- a/src/usr/local/www/interfaces_gre.php
+++ b/src/usr/local/www/interfaces_gre.php
@ -57,7 +57,7 @@ if ($_GET['act'] == "del") {
 	} else if (gre_inuse($_GET['id'])) {
 		$input_errors[] = gettext("This GRE tunnel cannot be deleted because it is still being used as an interface.");
 	} else {
-		mwexec("/sbin/ifconfig " . $a_gres[$_GET['id']]['greif'] . " destroy");
+		pfSense_interface_destroy($a_gres[$_GET['id']]['greif']);
 		unset($a_gres[$_GET['id']]);

 		write_config();
--- a/src/usr/local/www/interfaces_lagg.php
+++ b/src/usr/local/www/interfaces_lagg.php
@ -63,7 +63,7 @@ if ($_GET['act'] == "del") {
 	} else if (lagg_inuse($_GET['id'])) {
 		$input_errors[] = gettext("This LAGG interface cannot be deleted because it is still being used.");
 	} else {
-		mwexec_bg("/sbin/ifconfig " . $a_laggs[$_GET['id']]['laggif'] . " destroy");
+		pfSense_interface_destroy($a_laggs[$_GET['id']]['laggif']);
 		unset($a_laggs[$_GET['id']]);

 		write_config();
--- a/src/usr/local/www/interfaces_qinq.php
+++ b/src/usr/local/www/interfaces_qinq.php
@ -67,7 +67,7 @@ if ($_GET['act'] == "del") {
 		}
 		mwexec("/usr/sbin/ngctl shutdown {$qinq['vlanif']}qinq:");
 		mwexec("/usr/sbin/ngctl shutdown {$qinq['vlanif']}:");
-		mwexec("/sbin/ifconfig {$qinq['vlanif']} destroy");
+		pfSense_interface_destroy($qinq['vlanif']);
 		unset($a_qinqs[$id]);

 		write_config();
--- a/src/usr/local/www/interfaces_wireless.php
+++ b/src/usr/local/www/interfaces_wireless.php
@ -57,7 +57,7 @@ if ($_GET['act'] == "del") {
 	if (clone_inuse($_GET['id'])) {
 		$input_errors[] = gettext("This wireless clone cannot be deleted because it is assigned as an interface.");
 	} else {
-		mwexec("/sbin/ifconfig " . $a_clones[$_GET['id']]['cloneif'] . " destroy");
+		pfSense_interface_destroy($a_clones[$_GET['id']]['cloneif']);
 		unset($a_clones[$_GET['id']]);

 		write_config();
--- a/src/usr/local/www/interfaces_wireless_edit.php
+++ b/src/usr/local/www/interfaces_wireless_edit.php
@ -125,7 +125,7 @@ if ($_POST) {
 			} else {
 				if (isset($id) && $a_clones[$id]) {
 					if ($clone['if'] != $a_clones[$id]['if']) {
-						mwexec("/sbin/ifconfig " . $a_clones[$id]['cloneif'] . " destroy");
+						pfSense_interface_destroy($a_clones[$id]['cloneif']);
 					}
 					$input_errors[] = sprintf(gettext("Created with id %s"), $id);
 					$a_clones[$id] = $clone;
--- a/src/usr/local/www/js/pfSense.js
+++ b/src/usr/local/www/js/pfSense.js
@ -143,7 +143,7 @@ $(function() {
 	// Use element title in the confirmation message, or if not available
 	// the element value
 	$('.btn-danger, .fa-trash').on('click', function(e){
-		if (!($(this).hasClass('no-confirm'))) {
+		if (!($(this).hasClass('no-confirm')) && !($(this).hasClass('icon-embed-btn'))) {
 			var msg = $.trim(this.textContent).toLowerCase();

 			if (!msg)
@ -230,7 +230,7 @@ $(function() {
 	$('.table-rowdblclickedit>tbody>tr').dblclick(function () {
 		$(this).find(".fa-pencil")[0].click();
 	});
-	
+
 	// Focus first input
 	$(':input:enabled:visible:first').focus();

@ -238,7 +238,7 @@ $(function() {
 		$(this).css('height', 80).resizable({minHeight: 80, minWidth: 200}).parent().css('padding-bottom', 0);
 		$(this).css('height', 78);
 	});
-		
+
 	// Run in-page defined events
 	while (func = window.events.shift())
 		func();
--- a/src/usr/local/www/js/pfSenseHelpers.js
+++ b/src/usr/local/www/js/pfSenseHelpers.js
@ -353,9 +353,9 @@ function add_row() {
 	$('[id^=delete]').click(function(event) {
 		if ($('.repeatable').length > 1) {
 			if ((typeof retainhelp) == "undefined")
-				moveHelpText(event.target.id);
+				moveHelpText($(this).attr("id"));

-			delete_row(event.target.id);
+			delete_row($(this).attr("id"));
 		} else {
 			alert('The last row may not be deleted.');
 		}
@ -375,9 +375,9 @@ $('[id^=addrow]').click(function() {
 $('[id^=delete]').click(function(event) {
 	if ($('.repeatable').length > 1) {
 		if ((typeof retainhelp) == "undefined")
-			moveHelpText(event.target.id);
+			moveHelpText($(this).attr("id"));

-		delete_row(event.target.id);
+		delete_row($(this).attr("id"));
 	} else {
 		alert('The last row may not be deleted.');
 	}
--- a/src/usr/local/www/load_balancer_monitor.php
+++ b/src/usr/local/www/load_balancer_monitor.php
@ -43,7 +43,6 @@ if ($_POST) {
 		$retval |= filter_configure();
 		$retval |= relayd_configure();

-		$savemsg = get_std_save_message($retval);
 		clear_subsystem_dirty('loadbalancer');
 	}
 }
@ -79,8 +78,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('loadbalancer')) {
--- a/src/usr/local/www/load_balancer_pool.php
+++ b/src/usr/local/www/load_balancer_pool.php
@ -47,7 +47,6 @@ if ($_POST) {
 		$retval |= filter_configure();
 		$retval |= relayd_configure();

-		$savemsg = get_std_save_message($retval);
 		clear_subsystem_dirty('loadbalancer');
 	}
 }
@ -93,8 +92,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('loadbalancer')) {
--- a/src/usr/local/www/load_balancer_setting.php
+++ b/src/usr/local/www/load_balancer_setting.php
@ -46,7 +46,6 @@ if ($_POST) {
 		$retval |= filter_configure();
 		$retval |= relayd_configure();

-		$savemsg = get_std_save_message($retval);
 		clear_subsystem_dirty('loadbalancer');
 	} else {
 		unset($input_errors);
@ -92,8 +91,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('loadbalancer')) {
--- a/src/usr/local/www/load_balancer_virtual_server.php
+++ b/src/usr/local/www/load_balancer_virtual_server.php
@ -45,7 +45,6 @@ if ($_POST) {
 		$retval = 0;
 		$retval |= filter_configure();
 		$retval |= relayd_configure();
-		$savemsg = get_std_save_message($retval);
 		/* Wipe out old relayd anchors no longer in use. */
 		cleanup_lb_marked();
 		clear_subsystem_dirty('loadbalancer');
@ -113,8 +112,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('loadbalancer')) {
--- a/src/usr/local/www/pkg_edit.php
+++ b/src/usr/local/www/pkg_edit.php
@ -1500,6 +1500,10 @@ if ($pkg['custom_php_after_form_command']) {
 	eval($pkg['custom_php_after_form_command']);
 }

+
+$hidemsg = gettext("Show Advanced Options");
+$showmsg = gettext("Hide Advanced Options");
+
 if ($pkg['fields']['field'] != "") { ?>
 <script type="text/javascript">
 //<![CDATA[
@ -1520,10 +1524,10 @@ if ($pkg['fields']['field'] != "") { ?>

 		if (advanced_visible) {
 			$('.advancedoptions').show();
-			$("#showadv").prop('value', 'Hide advanced Options');
+			$("#showadv").html('<i class="fa fa-cog icon-embed-btn"></i>' + "<?=$showmsg?>");
 		} else {
 			$('.advancedoptions').hide();
-			$("#showadv").prop('value', 'Show advanced Options');
+			$("#showadv").html('<i class="fa fa-cog icon-embed-btn"></i>' + "<?=$hidemsg?>");
 		}
 	});

--- a/src/usr/local/www/services_captiveportal.php
+++ b/src/usr/local/www/services_captiveportal.php
@ -512,10 +512,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $tab_array = array();
 $tab_array[] = array(gettext("Configuration"), true, "services_captiveportal.php?zone={$cpzone}");
 $tab_array[] = array(gettext("MACs"), false, "services_captiveportal_mac.php?zone={$cpzone}");
--- a/src/usr/local/www/services_captiveportal_hostname.php
+++ b/src/usr/local/www/services_captiveportal_hostname.php
@ -98,10 +98,6 @@ if ($_GET['act'] == "del" && !empty($cpzone) && isset($cpzoneid)) {

 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $tab_array = array();
 $tab_array[] = array(gettext("Configuration"), false, "services_captiveportal.php?zone={$cpzone}");
 $tab_array[] = array(gettext("MACs"), false, "services_captiveportal_mac.php?zone={$cpzone}");
--- a/src/usr/local/www/services_captiveportal_ip.php
+++ b/src/usr/local/www/services_captiveportal_ip.php
@ -92,10 +92,6 @@ if ($_GET['act'] == "del" && !empty($cpzone) && isset($cpzoneid)) {

 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $tab_array = array();
 $tab_array[] = array(gettext("Configuration"), false, "services_captiveportal.php?zone={$cpzone}");
 $tab_array[] = array(gettext("MACs"), false, "services_captiveportal_mac.php?zone={$cpzone}");
--- a/src/usr/local/www/services_captiveportal_mac.php
+++ b/src/usr/local/www/services_captiveportal_mac.php
@ -76,7 +76,6 @@ if ($_POST) {
 				mwexec("/sbin/ipfw {$g['tmp_path']}/passthrumac_gui");
 				@unlink("{$g['tmp_path']}/passthrumac_gui");
 			}
-			$savemsg = get_std_save_message($retval);
 			if ($retval == 0) {
 				clear_subsystem_dirty('passthrumac');
 			}
@ -152,8 +151,8 @@ if ($_GET['act'] == "del") {

 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('passthrumac')) {
--- a/src/usr/local/www/services_captiveportal_vouchers_edit.php
+++ b/src/usr/local/www/services_captiveportal_vouchers_edit.php
@ -175,10 +175,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $form = new Form();

 $section = new Form_Section('Voucher Rolls');
--- a/src/usr/local/www/services_captiveportal_zones.php
+++ b/src/usr/local/www/services_captiveportal_zones.php
@ -60,10 +60,6 @@ $pgtitle = array(gettext("Services"), gettext("Captive Portal"));
 $shortcut_section = "captiveportal";
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 if (is_subsystem_dirty('captiveportal')) {
 	print_apply_box(gettext("The Captive Portal entry list has been changed.") . "<br />" . gettext("The changes must be applied for them to take effect."));
 }
--- a/src/usr/local/www/services_checkip_edit.php
+++ b/src/usr/local/www/services_checkip_edit.php
@ -110,10 +110,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $form = new Form;

 $section = new Form_Section('Check IP Service');
--- a/src/usr/local/www/services_dhcp.php
+++ b/src/usr/local/www/services_dhcp.php
@ -610,39 +610,38 @@ if (isset($_POST['save'])) {
 }

 if ((isset($_POST['save']) || isset($_POST['apply'])) && (!$input_errors)) {
+	$changes_applied = true;
 	$retval = 0;
 	$retvaldhcp = 0;
 	$retvaldns = 0;
 	/* dnsmasq_configure calls dhcpd_configure */
 	/* no need to restart dhcpd twice */
 	if (isset($config['dnsmasq']['enable']) && isset($config['dnsmasq']['regdhcpstatic']))	{
-		$retvaldns = services_dnsmasq_configure();
+		$retvaldns |= services_dnsmasq_configure();
 		if ($retvaldns == 0) {
 			clear_subsystem_dirty('hosts');
 			clear_subsystem_dirty('staticmaps');
 		}
 	} else if (isset($config['unbound']['enable']) && isset($config['unbound']['regdhcpstatic'])) {
-		$retvaldns = services_unbound_configure();
+		$retvaldns |= services_unbound_configure();
 		if ($retvaldns == 0) {
 			clear_subsystem_dirty('unbound');
 			clear_subsystem_dirty('hosts');
 			clear_subsystem_dirty('staticmaps');
 		}
 	} else {
-		$retvaldhcp = services_dhcpd_configure();
+		$retvaldhcp |= services_dhcpd_configure();
 		if ($retvaldhcp == 0) {
 			clear_subsystem_dirty('staticmaps');
 		}
 	}
 	if ($dhcpd_enable_changed) {
-		$retvalfc = filter_configure();
+		$retvalfc |= filter_configure();
 	}

 	if ($retvaldhcp == 1 || $retvaldns == 1 || $retvalfc == 1) {
 		$retval = 1;
 	}
-
-	$savemsg = get_std_save_message($retval);
 }

 if ($act == "delpool") {
@ -733,8 +732,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('staticmaps')) {
--- a/src/usr/local/www/services_dhcp_relay.php
+++ b/src/usr/local/www/services_dhcp_relay.php
@ -114,10 +114,10 @@ if ($_POST) {

 		write_config();

+		$changes_applied = true;
 		$retval = 0;
-		$retval = services_dhcrelay_configure();
-		$savemsg = get_std_save_message($retval);
-		filter_configure();
+		$retval |= services_dhcrelay_configure();
+		$retval |= filter_configure();
 	}
 }

@ -135,8 +135,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $form = new Form;
--- a/src/usr/local/www/services_dhcpv6.php
+++ b/src/usr/local/www/services_dhcpv6.php
@ -44,30 +44,30 @@ function dhcpv6_apply_changes($dhcpdv6_enable_changed) {
 	/* dnsmasq_configure calls dhcpd_configure */
 	/* no need to restart dhcpd twice */
 	if (isset($config['dnsmasq']['enable']) && isset($config['dnsmasq']['regdhcpstatic']))	{
-		$retvaldns = services_dnsmasq_configure();
+		$retvaldns |= services_dnsmasq_configure();
 		if ($retvaldns == 0) {
 			clear_subsystem_dirty('hosts');
 			clear_subsystem_dirty('staticmaps');
 		}
 	} else if (isset($config['unbound']['enable']) && isset($config['unbound']['regdhcpstatic'])) {
-		$retvaldns = services_unbound_configure();
+		$retvaldns |= services_unbound_configure();
 		if ($retvaldns == 0) {
 			clear_subsystem_dirty('unbound');
 			clear_subsystem_dirty('staticmaps');
 		}
 	} else {
-		$retvaldhcp = services_dhcpd_configure();
+		$retvaldhcp |= services_dhcpd_configure();
 		if ($retvaldhcp == 0) {
 			clear_subsystem_dirty('staticmaps');
 		}
 	}
 	if ($dhcpdv6_enable_changed) {
-		$retvalfc = filter_configure();
+		$retvalfc |= filter_configure();
 	}
 	if ($retvaldhcp == 1 || $retvaldns == 1 || $retvalfc == 1) {
 		$retval = 1;
 	}
-	return get_std_save_message($retval);
+	return $retval;
 }

 if (!$g['services_dhcp_server_enable']) {
@ -184,7 +184,8 @@ if (is_array($dhcrelaycfg) && isset($dhcrelaycfg['enable']) && isset($dhcrelaycf
 }

 if (isset($_POST['apply'])) {
-	$savemsg = dhcpv6_apply_changes(false);
+	$changes_applied = true;
+	$retval = dhcpv6_apply_changes(false);
 } elseif (isset($_POST['save'])) {
 	unset($input_errors);

@ -459,7 +460,8 @@ if (isset($_POST['apply'])) {

 		write_config();

-		$savemsg = dhcpv6_apply_changes($dhcpdv6_enable_changed);
+		$changes_applied = true;
+		$retval = dhcpv6_apply_changes($dhcpdv6_enable_changed);
 	}
 }

@ -492,8 +494,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('staticmaps')) {
--- a/src/usr/local/www/services_dhcpv6_relay.php
+++ b/src/usr/local/www/services_dhcpv6_relay.php
@ -115,9 +115,9 @@ if ($_POST) {

 		write_config();

+		$changes_applied = true;
 		$retval = 0;
-		$retval = services_dhcrelay6_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= services_dhcrelay6_configure();
 	}
 }

@ -135,8 +135,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $form = new Form;
--- a/src/usr/local/www/services_dnsmasq.php
+++ b/src/usr/local/www/services_dnsmasq.php
@ -113,8 +113,7 @@ domains_sort();
 if ($_POST) {
 	if ($_POST['apply']) {
 		$retval = 0;
-		$retval = services_dnsmasq_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= services_dnsmasq_configure();

 		// Reload filter (we might need to sync to CARP hosts)
 		filter_configure();
@ -232,8 +231,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('hosts')) {
--- a/src/usr/local/www/services_dyndns_edit.php
+++ b/src/usr/local/www/services_dyndns_edit.php
@ -64,6 +64,7 @@ if (isset($id) && isset($a_dyndns[$id])) {
 	$pconfig['enable'] = !isset($a_dyndns[$id]['enable']);
 	$pconfig['interface'] = $a_dyndns[$id]['interface'];
 	$pconfig['wildcard'] = isset($a_dyndns[$id]['wildcard']);
+	$pconfig['proxied'] = isset($a_dyndns[$id]['proxied']);
 	$pconfig['verboselog'] = isset($a_dyndns[$id]['verboselog']);
 	$pconfig['curl_ipresolve_v4'] = isset($a_dyndns[$id]['curl_ipresolve_v4']);
 	$pconfig['curl_ssl_verifypeer'] = isset($a_dyndns[$id]['curl_ssl_verifypeer']);
@ -158,6 +159,7 @@ if ($_POST) {
 		$dyndns['domainname'] = $_POST['domainname'];
 		$dyndns['mx'] = $_POST['mx'];
 		$dyndns['wildcard'] = $_POST['wildcard'] ? true : false;
+		$dyndns['proxied'] = $_POST['proxied'] ? true : false;
 		$dyndns['verboselog'] = $_POST['verboselog'] ? true : false;
 		$dyndns['curl_ipresolve_v4'] = $_POST['curl_ipresolve_v4'] ? true : false;
 		$dyndns['curl_ssl_verifypeer'] = $_POST['curl_ssl_verifypeer'] ? true : false;
@ -244,10 +246,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $form = new Form;

 $section = new Form_Section('Dynamic DNS Client');
@ -322,6 +320,15 @@ $section->addInput(new Form_Checkbox(
 	$pconfig['wildcard']
 ));

+$section->addInput(new Form_Checkbox(
+	'proxied',
+	'CloudFlare Proxy',
+	'Enable Proxy',
+	$pconfig['proxied']
+))->setHelp('Note: This enables CloudFlares Virtual DNS proxy.  When Enabled it will route all traffic '.
+			'through their servers. By Default this is disabled and your Real IP is exposed.'.
+			'More info: <a href="https://blog.cloudflare.com/announcing-virtual-dns-ddos-mitigation-and-global-distribution-for-dns-traffic/" target="_blank">CloudFlare Blog</a>');
+
 $section->addInput(new Form_Checkbox(
 	'verboselog',
 	'Verbose logging',
@ -441,6 +448,7 @@ events.push(function() {
 				hideInput('host', true);
 				hideInput('mx', true);
 				hideCheckbox('wildcard', true);
+				hideCheckbox('proxied', true);
 				hideInput('zoneid', true);
 				hideInput('ttl', true);
 				break;
@ -456,6 +464,7 @@ events.push(function() {
 				hideInput('host', false);
 				hideInput('mx', false);
 				hideCheckbox('wildcard', false);
+				hideCheckbox('proxied', true);
 				hideInput('zoneid', false);
 				hideInput('ttl', false);
 				break;
@ -472,9 +481,24 @@ events.push(function() {
 				hideInput('host', false);
 				hideInput('mx', false);
 				hideCheckbox('wildcard', false);
+				hideCheckbox('proxied', true);
 				hideInput('zoneid', true);
 				hideInput('ttl', true);
 				break;
+			case "cloudflare-v6":
+			case "cloudflare":
+				hideGroupInput('domainname', true);
+				hideInput('resultmatch', true);
+				hideInput('updateurl', true);
+				hideInput('requestif', true);
+				hideCheckbox('curl_ipresolve_v4', true);
+				hideCheckbox('curl_ssl_verifypeer', true);
+				hideInput('host', false);
+				hideInput('mx', false);
+				hideCheckbox('wildcard', false);
+				hideCheckbox('proxied', false);
+				hideInput('zoneid', true);
+				hideInput('ttl', true);
 			default:
 				hideGroupInput('domainname', true);
 				hideInput('resultmatch', true);
@ -485,6 +509,7 @@ events.push(function() {
 				hideInput('host', false);
 				hideInput('mx', false);
 				hideCheckbox('wildcard', false);
+				hideCheckbox('proxied', true);
 				hideInput('zoneid', true);
 				hideInput('ttl', true);
 		}
--- a/src/usr/local/www/services_igmpproxy.php
+++ b/src/usr/local/www/services_igmpproxy.php
@ -42,15 +42,10 @@ $a_igmpproxy = &$config['igmpproxy']['igmpentry'];
 if ($_POST) {
 	$pconfig = $_POST;

+	$changes_applied = true;
 	$retval = 0;
 	/* reload all components that use igmpproxy */
-	$retval = services_igmpproxy_configure();
-
-	if (stristr($retval, "error") <> true) {
-		$savemsg = get_std_save_message($retval);
-	} else {
-		$savemsg = $retval;
-	}
+	$retval |= services_igmpproxy_configure();

 	clear_subsystem_dirty('igmpproxy');
 }
@ -68,8 +63,8 @@ if ($_GET['act'] == "del") {
 $pgtitle = array(gettext("Services"), gettext("IGMP Proxy"));
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('igmpproxy')) {
--- a/src/usr/local/www/services_ntpd.php
+++ b/src/usr/local/www/services_ntpd.php
@ -53,6 +53,10 @@ if ($_POST) {
 	unset($input_errors);
 	$pconfig = $_POST;

+	if ((strlen($pconfig['ntporphan']) > 0) && (!is_numericint($pconfig['ntporphan']) || ($pconfig['ntporphan'] < 1) || ($pconfig['ntporphan'] > 15))) {
+		$input_errors[] = gettext("The supplied value for NTP Orphan Mode is invalid.");
+	}
+
 	if (!$input_errors) {
 		if (is_array($_POST['interface'])) {
 			$config['ntpd']['interface'] = implode(",", $_POST['interface']);
@ -91,11 +95,7 @@ if ($_POST) {
 		}
 		$config['system']['timeservers'] = trim($timeservers);

-		if (!empty($_POST['ntporphan']) && ($_POST['ntporphan'] < 17) && ($_POST['ntporphan'] != '12')) {
-			$config['ntpd']['orphan'] = $_POST['ntporphan'];
-		} elseif (isset($config['ntpd']['orphan'])) {
-			unset($config['ntpd']['orphan']);
-		}
+		$config['ntpd']['orphan'] = trim($pconfig['ntporphan']);

 		if (!empty($_POST['logpeer'])) {
 			$config['ntpd']['logpeer'] = $_POST['logpeer'];
@ -151,9 +151,9 @@ if ($_POST) {

 		write_config("Updated NTP Server Settings");

+		$changes_applied = true;
 		$retval = 0;
-		$retval = system_ntp_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= system_ntp_configure();
 	}
 }

@ -192,8 +192,9 @@ include("head.inc");
 if ($input_errors) {
 	print_input_errors($input_errors);
 }
-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $tab_array = array();
--- a/src/usr/local/www/services_ntpd_acls.php
+++ b/src/usr/local/www/services_ntpd_acls.php
@ -150,9 +150,9 @@ if ($_POST) {

 		write_config("Updated NTP ACL Settings");

+		$changes_applied = true;
 		$retval = 0;
-		$retval = system_ntp_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= system_ntp_configure();
 	}
 }

@ -165,8 +165,9 @@ include("head.inc");
 if ($input_errors) {
 	print_input_errors($input_errors);
 }
-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $tab_array = array();
--- a/src/usr/local/www/services_ntpd_gps.php
+++ b/src/usr/local/www/services_ntpd_gps.php
@ -154,8 +154,9 @@ if ($_POST) {

 	write_config(gettext("Updated NTP GPS Settings"));

-	$retval = system_ntp_configure();
-	$savemsg = get_std_save_message($retval);
+	$changes_applied = true;
+	$retval = 0;
+	$retval |= system_ntp_configure();
 } else {
 	/* set defaults if they do not already exist */
 	if (!is_array($config['ntpd']) || !is_array($config['ntpd']['gps']) || empty($config['ntpd']['gps']['type'])) {
@ -192,6 +193,10 @@ $pgtitle = array(gettext("Services"), gettext("NTP"), gettext("Serial GPS"));
 $shortcut_section = "ntp";
 include("head.inc");

+if ($changes_applied) {
+	print_apply_result_box($retval);
+}
+
 $tab_array = array();
 $tab_array[] = array(gettext("Settings"), false, "services_ntpd.php");
 $tab_array[] = array(gettext("ACLs"), false, "services_ntpd_acls.php");
--- a/src/usr/local/www/services_ntpd_pps.php
+++ b/src/usr/local/www/services_ntpd_pps.php
@ -91,9 +91,9 @@ if ($_POST) {

 		write_config("Updated NTP PPS Settings");

+		$changes_applied = true;
 		$retval = 0;
-		$retval = system_ntp_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= system_ntp_configure();
 	}
 }

@ -107,8 +107,8 @@ if ($input_errors) {
    print_input_errors($input_errors);
 }

-if ($savemsg) {
-    print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $tab_array = array();
--- a/src/usr/local/www/services_pppoe.php
+++ b/src/usr/local/www/services_pppoe.php
@ -59,7 +59,6 @@ if ($_POST) {
 		}
 		$retval = 0;
 		$retval |= filter_configure();
-		$savemsg = get_std_save_message($retval);
 		clear_subsystem_dirty('vpnpppoe');
 	}
 }
@ -83,8 +82,8 @@ $pgtitle = array(gettext("Services"), gettext("PPPoE Server"));
 $shortcut_section = "pppoes";
 include("head.inc");

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('vpnpppoe')) {
--- a/src/usr/local/www/services_pppoe_edit.php
+++ b/src/usr/local/www/services_pppoe_edit.php
@ -285,10 +285,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $form = new Form();

 $section = new Form_Section('PPPoE Server Configuration');
--- a/src/usr/local/www/services_rfc2136_edit.php
+++ b/src/usr/local/www/services_rfc2136_edit.php
@ -152,10 +152,6 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
-}
-
 $form = new Form;

 $section = new Form_Section('RFC 2136 Client');
--- a/src/usr/local/www/services_router_advertisements.php
+++ b/src/usr/local/www/services_router_advertisements.php
@ -54,7 +54,7 @@ if ($config['installedpackages']['olsrd']) {
 }

 if (!$_GET['if']) {
-	$savemsg = gettext("The DHCPv6 Server can only be enabled on interfaces configured with static, non unique local IP addresses.") . "<br />" .
+	$info_msg = gettext("The DHCPv6 Server can only be enabled on interfaces configured with static, non unique local IP addresses.") . "<br />" .
 	    gettext("Only interfaces configured with a static IP will be shown.");
 }

@ -243,8 +243,9 @@ if ($_POST) {
 		}

 		write_config();
-		$retval = services_radvd_configure();
-		$savemsg = get_std_save_message($retval);
+		$changes_applied = true;
+		$retval = 0;
+		$retval |= services_radvd_configure();
 	}
 }

@ -261,8 +262,12 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
+}
+
+if ($info_msg) {
+	print_info_box($info_msg, 'success');
 }

 /* active tabs */
--- a/src/usr/local/www/services_snmp.php
+++ b/src/usr/local/www/services_snmp.php
@ -33,6 +33,8 @@
 require_once("guiconfig.inc");
 require_once("functions.inc");

+$specplatform = system_identify_specific_platform();
+
 if (!is_array($config['snmpd'])) {
 	$config['snmpd'] = array();
 	$config['snmpd']['rocommunity'] = "public";
@ -161,9 +163,9 @@ if ($_POST) {

 		write_config();

+		$changes_applied = true;
 		$retval = 0;
-		$retval = services_snmpd_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval |= services_snmpd_configure();
 	}
 }

@ -200,8 +202,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $form = new Form();
@ -316,12 +318,14 @@ $group->add(new Form_MultiCheckbox(
 	$pconfig['pf']
 ));

-$group->add(new Form_MultiCheckbox(
-	'hostres',
-	null,
-	'Host Resources',
-	$pconfig['hostres']
-));
+if (!(($specplatform['name'] == 'VMware') && (file_exists('/dev/cd0')))) {
+	$group->add(new Form_MultiCheckbox(
+		'hostres',
+		null,
+		'Host Resources',
+		$pconfig['hostres']
+	));
+}

 $group->add(new Form_MultiCheckbox(
 	'ucd',
@ -338,6 +342,14 @@ $group->add(new Form_MultiCheckbox(
 ));

 $section->add($group);
+if ((($specplatform['name'] == 'VMware') && (file_exists('/dev/cd0')))) {
+	$section->addInput(new Form_StaticText(
+		NULL,
+		NULL
+	))->setHelp(sprint_info_box('The hostres module is not compatible with VMware virtual ' .
+		    'machines configured with a virtual CD/DVD Drive.', 'warning', false));
+}
+
 $form->add($section);

 $section = new Form_Section('Interface Binding');
--- a/src/usr/local/www/services_unbound.php
+++ b/src/usr/local/www/services_unbound.php
@ -88,8 +88,8 @@ if (empty($a_unboundcfg['system_domain_local_zone_type'])) {

 if ($_POST) {
 	if ($_POST['apply']) {
-		$retval = services_unbound_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval = 0;
+		$retval |= services_unbound_configure();
 		if ($retval == 0) {
 			clear_subsystem_dirty('unbound');
 		}
@ -128,7 +128,7 @@ if ($_POST) {
 				}
 			}
 			if ($founddns == false) {
-				$input_errors[] = gettext("At least one DNS server must be specified under System>General Setup to enable Forwarding mode.");
+				$input_errors[] = gettext("At least one DNS server must be specified under System &gt; General Setup to enable Forwarding mode.");
 			}
 		}

@ -244,8 +244,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('unbound')) {
@ -317,7 +317,9 @@ $section->addInput(new Form_Checkbox(
 	'DNS Query Forwarding',
 	'Enable Forwarding Mode',
 	$pconfig['forwarding']
-));
+))->setHelp(sprintf('If this option is set, DNS queries will be forwarded to the upstream DNS servers defined under'.
+					' %sSystem &gt; General Setup%s or those obtained via DHCP/PPP on WAN'.
+					' (if DNS Server Override is enabled there).','<a href="system.php">','</a>'));

 $section->addInput(new Form_Checkbox(
 	'regdhcp',
@ -326,7 +328,7 @@ $section->addInput(new Form_Checkbox(
 	$pconfig['regdhcp']
 ))->setHelp(sprintf('If this option is set, then machines that specify their hostname when requesting a DHCP lease will be registered'.
 					' in the DNS Resolver, so that their name can be resolved.'.
-					' The domain in %sSystem: General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));
+					' The domain in %sSystem &gt; General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));

 $section->addInput(new Form_Checkbox(
 	'regdhcpstatic',
@ -334,7 +336,7 @@ $section->addInput(new Form_Checkbox(
 	'Register DHCP static mappings in the DNS Resolver',
 	$pconfig['regdhcpstatic']
 ))->setHelp(sprintf('If this option is set, then DHCP static mappings will be registered in the DNS Resolver, so that their name can be resolved. '.
-					'The domain in %sSystem: General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));
+					'The domain in %sSystem &gt; General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));

 $btnadv = new Form_Button(
 	'btnadvcustom',
@ -555,7 +557,7 @@ endforeach;
 		" service (if enabled) will automatically serve the LAN IP".
 		" address as a DNS server to DHCP clients so they will use".
 		" the DNS Resolver. If Forwarding is enabled, the DNS Resolver will use the DNS servers".
-		" entered in %sSystem: General Setup%s".
+		" entered in %sSystem &gt; General Setup%s".
 		" or those obtained via DHCP or PPP on WAN if &quot;Allow".
 		" DNS server list to be overridden by DHCP/PPP on WAN&quot;".
 		" is checked."), '<a href="system.php">', '</a>'), 'info', false); ?>
--- a/src/usr/local/www/services_unbound_acls.php
+++ b/src/usr/local/www/services_unbound_acls.php
@ -99,8 +99,8 @@ if ($_POST) {
 	}

 	if ($_POST['apply']) {
-		$retval = services_unbound_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval = 0;
+		$retval |= services_unbound_configure();
 		if ($retval == 0) {
 			clear_subsystem_dirty('unbound');
 		}
@ -185,8 +185,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('unbound')) {
--- a/src/usr/local/www/services_unbound_advanced.php
+++ b/src/usr/local/www/services_unbound_advanced.php
@ -77,8 +77,8 @@ if (isset($config['unbound']['use_caps'])) {

 if ($_POST) {
 	if ($_POST['apply']) {
-		$retval = services_unbound_configure();
-		$savemsg = get_std_save_message($retval);
+		$retval = 0;
+		$retval |= services_unbound_configure();
 		if ($retval == 0) {
 			clear_subsystem_dirty('unbound');
 		}
@ -192,8 +192,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($_POST['apply']) {
+	print_apply_result_box($retval);
 }

 if (is_subsystem_dirty('unbound')) {
--- a/src/usr/local/www/status_gateways.php
+++ b/src/usr/local/www/status_gateways.php
@ -140,11 +140,17 @@ display_top_tabs($tab_array);
 						$online = gettext("Warning, Latency") . ': ' . $status['delay'];
 						$bgcolor = "bg-warning";
 					} elseif ($status['status'] == "none") {
-						$online = gettext("Online");
+						if ($status['monitor_disable'] || ($status['monitorip'] == "none")) {
+							$online = gettext("Online (unmonitored)");
+						} else {
+							$online = gettext("Online");
+						}
 						$bgcolor = "bg-success";
 					}
 				} else if (isset($gateway['monitor_disable'])) {
-						$online = gettext("Online");
+					// Note: return_gateways_status() always returns an array entry for all gateways,
+					//       so this "else if" never happens.
+						$online = gettext("Online (unmonitored)");
 						$bgcolor = "bg-success";
 				} else {
 					$online = gettext("Pending");
--- a/src/usr/local/www/status_lb_pool.php
+++ b/src/usr/local/www/status_lb_pool.php
@ -68,7 +68,6 @@ if ($_POST) {
 		$retval = 0;
 		$retval |= filter_configure();
 		$retval |= relayd_configure();
-		$savemsg = get_std_save_message($retval);
 		clear_subsystem_dirty('loadbalancer');
 	} else {
 		/* Keep a list of servers we find in POST variables */
@ -110,6 +109,10 @@ if (is_subsystem_dirty('loadbalancer')) {
 	print_apply_box(gettext("The load balancer configuration has been changed.") . "<br />" . gettext("The changes must be applied for them to take effect."));
 }

+if ($_POST['apply']) {
+	print_apply_result_box($retval);
+}
+
 /* active tabs */
 $tab_array = array();
 $tab_array[] = array(gettext("Pools"), true, "status_lb_pool.php");
--- a/src/usr/local/www/status_logs.php
+++ b/src/usr/local/www/status_logs.php
@ -99,8 +99,8 @@ if (in_array($logfile, array('system', 'gateways', 'routing', 'resolver', 'wirel
 }
 include("head.inc");

-if (!$input_errors && $savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 	$manage_log_active = false;
 }

--- a/src/usr/local/www/status_logs_common.inc
+++ b/src/usr/local/www/status_logs_common.inc
@ -584,8 +584,10 @@ function manage_log_code() {
 		return;
 	}

-	global $logfile, $specific_log, $config, $pconfig, $save_settings, $input_errors, $savemsg;
+	global $logfile, $specific_log, $config, $pconfig, $save_settings, $input_errors, $extra_save_msg, $retval, $changes_applied;

+	$changes_applied = false;
+	$extra_save_msg = "";
 	$specific_log = basename($logfile) . '_settings';

 	// Common to All Logs
@ -711,28 +713,27 @@ function manage_log_code() {
 				}
 			}

+			$retval = 0;
+			$changes_applied = true;

 		// If any of the logging settings were changed then backup and sync (standard write_config).  Otherwise only write config (don't backup, don't sync).
-		if ($logging_changed) {
-			write_config($desc = gettext("Log Display Settings Saved: ") . gettext($allowed_logs[$logfile]["name"]), $backup = true, $write_config_only = false);
-			$retval = 0;
-			$retval = system_syslogd_start();
-			$savemsg = gettext("The changes have been applied successfully.");
-		} else {
-			write_config($desc = gettext("Log Display Settings Saved (no backup, no sync): ") . gettext($allowed_logs[$logfile]["name"]), $backup = false, $write_config_only = true);
-			$savemsg = '';
-		}
+			if ($logging_changed) {
+				write_config($desc = gettext("Log Display Settings Saved: ") . gettext($allowed_logs[$logfile]["name"]), $backup = true, $write_config_only = false);
+				system_syslogd_start();
+			} else {
+				write_config($desc = gettext("Log Display Settings Saved (no backup, no sync): ") . gettext($allowed_logs[$logfile]["name"]), $backup = false, $write_config_only = true);
+			}

 		// Specific to System General (main) Log
-		if ($logfile == 'system') {
-			if ($nginx_logging_changed) {
-				ob_flush();
-				flush();
-				log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
-				send_event("service restart webgui");
-				$savemsg .= "<br />" . gettext("WebGUI process is restarting.");
+			if ($logfile == 'system') {
+				if ($nginx_logging_changed) {
+					ob_flush();
+					flush();
+					log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
+					send_event("service restart webgui");
+					$extra_save_msg = gettext("WebGUI process is restarting.");
+				}
 			}
-		}

 		// Specific to Firewall Log
 			if ($logfile == 'filter') {
@ -740,8 +741,6 @@ function manage_log_code() {
 					require_once("filter.inc");
 					$retval |= filter_configure();
 					filter_pflog_start(true);
-
-					$savemsg = get_std_save_message($retval);
 				}
 			}
 		}
--- a/src/usr/local/www/status_logs_filter.php
+++ b/src/usr/local/www/status_logs_filter.php
@ -102,12 +102,11 @@ status_logs_common_code();
 $pgtitle = array(gettext("Status"), gettext("System Logs"), gettext($allowed_logs[$logfile]["name"]), $view_title);
 include("head.inc");

-if (!$input_errors && $savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 	$manage_log_active = false;
 }

-
 // Tab Array
 tab_array_logs_common();

--- a/src/usr/local/www/status_logs_filter_dynamic.php
+++ b/src/usr/local/www/status_logs_filter_dynamic.php
@ -82,12 +82,11 @@ status_logs_common_code();
 $pgtitle = array(gettext("Status"), gettext("System Logs"), gettext($allowed_logs[$logfile]["name"]), $view_title);
 include("head.inc");

-if (!$input_errors && $savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 	$manage_log_active = false;
 }

-
 // Tab Array
 tab_array_logs_common();

--- a/src/usr/local/www/status_logs_filter_summary.php
+++ b/src/usr/local/www/status_logs_filter_summary.php
@ -67,12 +67,11 @@ status_logs_common_code();
 $pgtitle = array(gettext("Status"), gettext("System Logs"), gettext($allowed_logs[$logfile]["name"]), $view_title);
 include("head.inc");

-if (!$input_errors && $savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 	$manage_log_active = false;
 }

-
 // Tab Array
 tab_array_logs_common();

--- a/src/usr/local/www/status_logs_settings.php
+++ b/src/usr/local/www/status_logs_settings.php
@ -80,7 +80,7 @@ function is_valid_syslog_server($target) {

 if ($_POST['resetlogs'] == gettext("Reset Log Files")) {
 	clear_all_log_files(true);
-	$savemsg .= gettext("The log files have been reset.");
+	$reset_msg = gettext("The log files have been reset.");
 } elseif ($_POST) {
 	unset($input_errors);
 	$pconfig = $_POST;
@ -162,8 +162,9 @@ if ($_POST['resetlogs'] == gettext("Reset Log Files")) {

 		write_config();

+		$changes_applied = true;
 		$retval = 0;
-		$retval = system_syslogd_start();
+		system_syslogd_start();
 		if (($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock'])) ||
 		    ($oldnologdefaultpass !== isset($config['syslog']['nologdefaultpass'])) ||
 		    ($oldnologbogons !== isset($config['syslog']['nologbogons'])) ||
@ -171,14 +172,12 @@ if ($_POST['resetlogs'] == gettext("Reset Log Files")) {
 			$retval |= filter_configure();
 		}

-		$savemsg = get_std_save_message($retval);
-
 		if ($oldnolognginx !== isset($config['syslog']['nolognginx'])) {
 			ob_flush();
 			flush();
 			log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
 			send_event("service restart webgui");
-			$savemsg .= "<br />" . gettext("WebGUI process is restarting.");
+			$extra_save_msg = gettext("WebGUI process is restarting.");
 		}

 		filter_pflog_start(true);
@ -204,8 +203,12 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($reset_msg) {
+	print_info_box($reset_msg, 'success');
+}
+
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 }

 $tab_array = array();
--- a/src/usr/local/www/status_ntpd.php
+++ b/src/usr/local/www/status_ntpd.php
@ -110,6 +110,8 @@ if (!isset($config['ntpd']['noquery'])) {
 				$gps_lat = $gps_lat * (($gps_vars[4] == "N") ? 1 : -1);
 				$gps_lon = $gps_lon_deg + $gps_lon_min;
 				$gps_lon = $gps_lon * (($gps_vars[6] == "E") ? 1 : -1);
+				$gps_la = $gps_vars[4];
+				$gps_lo = $gps_vars[6];
 			} elseif (substr($tmp, 0, 6) == '$GPGGA') {
 				$gps_vars = explode(",", $tmp);
 				$gps_ok = $gps_vars[6];
@ -123,9 +125,11 @@ if (!isset($config['ntpd']['noquery'])) {
 				$gps_lon = $gps_lon * (($gps_vars[5] == "E") ? 1 : -1);
 				$gps_alt = $gps_vars[9];
 				$gps_alt_unit = $gps_vars[10];
-				$gps_sat = $gps_vars[7];
+				$gps_sat = (int)$gps_vars[7];
+				$gps_la = $gps_vars[3];
+				$gps_lo = $gps_vars[5];
 			} elseif (substr($tmp, 0, 6) == '$GPGLL') {
-				$gps_vars = explode(",", $tmp);
+				$gps_vars = preg_split('/[,\*]+/', $tmp);
 				$gps_ok = ($gps_vars[6] == "A");
 				$gps_lat_deg = substr($gps_vars[1], 0, 2);
 				$gps_lat_min = substr($gps_vars[1], 2) / 60.0;
@ -135,6 +139,8 @@ if (!isset($config['ntpd']['noquery'])) {
 				$gps_lat = $gps_lat * (($gps_vars[2] == "N") ? 1 : -1);
 				$gps_lon = $gps_lon_deg + $gps_lon_min;
 				$gps_lon = $gps_lon * (($gps_vars[4] == "E") ? 1 : -1);
+				$gps_la = $gps_vars[2];
+				$gps_lo = $gps_vars[4];
 			}
 		}
 	}
@ -205,7 +211,7 @@ function print_status() {
 }

 function print_gps() {
-	global 	$gps_lat, $gps_lon, $gps_lat_deg, $gps_lon_deg, $gps_lat_min, $gps_lon_min, $gps_vars,
+	global 	$gps_lat, $gps_lon, $gps_lat_deg, $gps_lon_deg, $gps_lat_min, $gps_lon_min, $gps_la, $gps_lo,
 			$gps_alt, $gps_alt_unit, $gps_sat, $gps_satview, $gps_goo_lnk;

 	print("<tr>\n");
@ -214,7 +220,7 @@ function print_gps() {
 	print(" (");
 	printf("%d%s", $gps_lat_deg, "&deg;");
 	printf("%.5f", $gps_lat_min*60);
-	print($gps_vars[4]);
+	print($gps_la);
 	print(")");
 	print("</td>\n");
 	print("<td>\n");
@ -222,7 +228,7 @@ function print_gps() {
 	print(" (");
 	printf("%d%s", $gps_lon_deg, "&deg;");
 	printf("%.5f", $gps_lon_min*60);
-	print($gps_vars[6]);
+	print($gps_lo);
 	print(")");
 	print("</td>\n");

@ -233,7 +239,7 @@ function print_gps() {
 	}

 	if (isset($gps_sat) || isset($gps_satview)) {
-		print('<td class="text-center">');
+		print('<td>');

 		if (isset($gps_satview)) {
 			print(gettext('in view ') . intval($gps_satview));
--- a/src/usr/local/www/status_openvpn.php
+++ b/src/usr/local/www/status_openvpn.php
@ -312,7 +312,13 @@ include("head.inc"); ?>
 						<td><?=htmlspecialchars($client['name']);?></td>
 						<td><?=$client['status'];?></td>
 						<td><?=$client['connect_time'];?></td>
-						<td><?=$client['local_host'];?>:<?=$client['local_port'];?></td>
+						<td>
+					<?php if (empty($client['local_host']) && empty($client['local_port'])): ?>
+							(pending)
+					<?php else: ?>
+							<?=$client['local_host'];?>:<?=$client['local_port'];?>
+					<?php endif; ?>
+						</td>
 						<td>
 							<?=$client['virtual_addr'];?>
 					<?php if (!empty($client['virtual_addr']) && !empty($client['virtual_addr6'])): ?>
@ -320,7 +326,13 @@ include("head.inc"); ?>
 					<?php endif; ?>
 							<?=$client['virtual_addr6'];?>
 						</td>
-						<td><?=$client['remote_host'];?>:<?=$client['remote_port'];?></td>
+						<td>
+					<?php if (empty($client['remote_host']) && empty($client['remote_port'])): ?>
+							(pending)
+					<?php else: ?>
+							<?=$client['remote_host'];?>:<?=$client['remote_port'];?>
+					<?php endif; ?>
+						</td>
 						<td><?=format_bytes($client['bytes_sent']);?> / <?=format_bytes($client['bytes_recv']);?></td>
 						<td>
 							<table>
--- a/src/usr/local/www/system.php
+++ b/src/usr/local/www/system.php
@ -93,6 +93,38 @@ if ($pconfig['timezone'] <> $_POST['timezone']) {
 }

 $timezonelist = system_get_timezone_list();
+$timezonedesc = $timezonelist;
+
+/*
+ * Etc/GMT entries work the opposite way to what people expect.
+ * Ref: https://github.com/eggert/tz/blob/master/etcetera and Redmine issue 7089
+ * Add explanatory text to entries like:
+ * Etc/GMT+1 and Etc/GMT-1
+ * but not:
+ * Etc/GMT or Etc/GMT+0
+ */
+foreach ($timezonedesc as $idx => $desc) {
+	if (substr($desc, 0, 7) != "Etc/GMT" || substr($desc, 8, 1) == "0") {
+		continue;
+	}
+
+	$direction = substr($desc, 7, 1);
+
+	switch ($direction) {
+	case '-':
+		$direction_str = gettext('AHEAD of');
+		break;
+	case '+':
+		$direction_str = gettext('BEHIND');
+		break;
+	default:
+		continue;
+	}
+
+	$hr_offset = substr($desc, 8);
+	$timezonedesc[$idx] = $desc . " " .
+	    sprintf(ngettext('(%1$s hour %2$s GMT)', '(%1$s hours %2$s GMT)', $hr_offset), $hr_offset, $direction_str);
+}

 $multiwan = false;
 $interfaces = get_configured_interface_list();
@ -314,8 +346,9 @@ if ($_POST) {
 			write_config($changedesc);
 		}

+		$changes_applied = true;
 		$retval = 0;
-		$retval = system_hostname_configure();
+		$retval |= system_hostname_configure();
 		$retval |= system_hosts_generate();
 		$retval |= system_resolvconf_generate();
 		if (isset($config['dnsmasq']['enable'])) {
@ -332,8 +365,6 @@ if ($_POST) {

 		// Reload the filter - plugins might need to be run.
 		$retval |= filter_configure();
-
-		$savemsg = get_std_save_message($retval);
 	}

 	unset($ignore_posted_dnsgw);
@ -346,8 +377,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }
 ?>
 <div id="container">
@ -391,7 +422,8 @@ for ($i=1; $i<5; $i++) {
 	))->setHelp(($i == 4) ? 'Address':null);

 	$help = "Enter IP addresses to be used by the system for DNS resolution. " .
-		"These are also used for the DHCP service, DNS forwarder and for PPTP VPN clients.";
+		"These are also used for the DHCP service, DNS Forwarder and DNS Resolver " .
+		"when it has DNS Query Forwarding enabled.";

 	if ($multiwan)	{
 		$options = array('none' => 'none');
@ -433,18 +465,18 @@ $section->addInput(new Form_Checkbox(
 	$pconfig['dnsallowoverride']
 ))->setHelp(sprintf(gettext('If this option is set, %s will use DNS servers '.
 	'assigned by a DHCP/PPP server on WAN for its own purposes (including '.
-	'the DNS forwarder). However, they will not be assigned to DHCP and PPTP '.
-	'VPN clients.'), $g['product_name']));
+	'the DNS Forwarder/DNS Resolver). However, they will not be assigned to DHCP '.
+	'clients.'), $g['product_name']));

 $section->addInput(new Form_Checkbox(
 	'dnslocalhost',
 	'Disable DNS Forwarder',
-	'Do not use the DNS Forwarder as a DNS server for the firewall',
+	'Do not use the DNS Forwarder/DNS Resolver as a DNS server for the firewall',
 	$pconfig['dnslocalhost']
 ))->setHelp('By default localhost (127.0.0.1) will be used as the first DNS '.
 	'server where the DNS Forwarder or DNS Resolver is enabled and set to '.
-	'listen on Localhost, so system can use the local DNS service to perform '.
-	'lookups. Checking this box omits localhost from the list of DNS servers.');
+	'listen on localhost, so system can use the local DNS service to perform '.
+	'lookups. Checking this box omits localhost from the list of DNS servers in resolv.conf.');

 $form->add($section);

@ -454,8 +486,9 @@ $section->addInput(new Form_Select(
 	'timezone',
 	'Timezone',
 	$pconfig['timezone'],
-	array_combine($timezonelist, $timezonelist)
-))->setHelp('Select the timezone or location within the timezone to be used by this system.');
+	array_combine($timezonelist, $timezonedesc)
+))->setHelp('Select a geographic region name (Continent/Location) to determine the timezone for the firewall. ' .
+	'<br/>Choose a special or "Etc" zone only in cases where the geographic zones do not properly handle the clock offset required for this firewall.');

 $section->addInput(new Form_Input(
 	'timeservers',
--- a/src/usr/local/www/system_advanced_admin.php
+++ b/src/usr/local/www/system_advanced_admin.php
@ -263,11 +263,12 @@ if ($_POST) {

 		write_config();

-		$retval = filter_configure();
-		$savemsg = get_std_save_message($retval);
+		$changes_applied = true;
+		$retval = 0;
+		$retval |= filter_configure();

 		if ($restart_webgui) {
-			$savemsg .= sprintf("<br />" . gettext("One moment...redirecting to %s in 20 seconds."), $url);
+			$extra_save_msg = sprintf("<br />" . gettext("One moment...redirecting to %s in 20 seconds."), $url);
 		}

 		setup_serial_port();
@ -287,8 +288,8 @@ if ($input_errors) {
 	print_input_errors($input_errors);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval, $extra_save_msg);
 }

 $tab_array = array();
--- a/src/usr/local/www/system_advanced_firewall.php
+++ b/src/usr/local/www/system_advanced_firewall.php
@ -356,15 +356,9 @@ if ($_POST) {
 			killbypid("{$g['varrun_path']}/filterdns.pid");
 		}

+		$changes_applied = true;
 		$retval = 0;
-		$retval = filter_configure();
-		if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message($retval);
-			$class = 'success';
-		} else {
-			$savemsg = $retval;
-			$class = 'warning';
-		}
+		$retval |= filter_configure();
 	}
 }

@ -374,8 +368,9 @@ include("head.inc");
 if ($input_errors) {
 	print_input_errors($input_errors);
 }
-if ($savemsg) {
-	print_info_box($savemsg, $class);
+
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $tab_array = array();
--- a/src/usr/local/www/system_advanced_misc.php
+++ b/src/usr/local/www/system_advanced_misc.php
@ -251,6 +251,13 @@ if ($_POST) {
 				unset($config['system']['dhcpbackup']);
 			}
 		}
+		if (isset($_POST['logsbackup'])) {
+			if (($_POST['logsbackup'] > 0) && ($_POST['logsbackup'] <= 24)) {
+				$config['system']['logsbackup'] = intval($_POST['logsbackup']);
+			} else {
+				unset($config['system']['logsbackup']);
+			}
+		}

 		// Add/Remove RAM disk periodic backup cron jobs according to settings and installation type.
 		// Remove the cron jobs on full install if not using RAM disk.
@ -258,21 +265,19 @@ if ($_POST) {
 		if (!isset($config['system']['use_mfs_tmpvar'])) {
 			install_cron_job("/etc/rc.backup_rrd.sh", false);
 			install_cron_job("/etc/rc.backup_dhcpleases.sh", false);
+			install_cron_job("/etc/rc.backup_logs.sh", false);
 		} else {
 			install_cron_job("/etc/rc.backup_rrd.sh", ($config['system']['rrdbackup'] > 0), $minute="0", "*/{$config['system']['rrdbackup']}");
 			install_cron_job("/etc/rc.backup_dhcpleases.sh", ($config['system']['dhcpbackup'] > 0), $minute="0", "*/{$config['system']['dhcpbackup']}");
+			install_cron_job("/etc/rc.backup_logs.sh", ($config['system']['logsbackup'] > 0), $minute="0", "*/{$config['system']['logsbackup']}");
 		}

 		write_config();

+		$changes_applied = true;
 		$retval = 0;
 		system_resolvconf_generate(true);
-		$retval = filter_configure();
-		if (stristr($retval, "error") <> true) {
-			$savemsg = get_std_save_message(gettext($retval));
-		} else {
-			$savemsg = gettext($retval);
-		}
+		$retval |= filter_configure();

 		activate_powerd();
 		load_crypto();
@ -291,8 +296,8 @@ if ($input_errors) {
 	unset($pconfig['doreboot']);
 }

-if ($savemsg) {
-	print_info_box($savemsg, 'success');
+if ($changes_applied) {
+	print_apply_result_box($retval);
 }

 $tab_array = array();
@ -541,6 +546,16 @@ $section->addInput(new Form_Input(
 	'it can be restored automatically on the next boot. Keep in mind that the more '.
 	'frequent the backup, the more writes will happen to the media.');

+$section->addInput(new Form_Input(
+	'logsbackup',
+	'Periodic Logs Backup',
+	'number',
+	$config['system']['logsbackup'],
+	['min' => 0, 'max' => 24, 'placeholder' => 'Period between 1 and 24 hours']
+))->setHelp('This will periodically backup the log directory so '.
+	'it can be restored automatically on the next boot. Keep in mind that the more '.
+	'frequent the backup, the more writes will happen to the media.');
+
 $form->add($section);

 $section = new Form_Section('Hardware Settings');
@ -590,7 +605,7 @@ events.push(function() {
 		}
 	});

-    drb = "<?=$pconfig['doreboot']?>";
+	drb = "<?=$pconfig['doreboot']?>";

 	if (drb == "yes") {
 		$('form').append("<input type=\"hidden\" name=\"override\" value=\"yes\" />");
--- a/Show More
+++ b/Show More