(cherry picked from commit 9f883fd7)
(cherry picked from commit 5d93e8d7)

(cherry picked from commit 16ffbff9)

(cherry picked from commit d14bfe61)

(dhcpd/unbound) don't try to handle empty section, closes https://github.com/opnsense/core/issues/1320

(cherry picked from commit 151e633d)

(cherry picked from commit 041681ba)

This is a pretty good option for anybody with a lack of a viable
local mirror, sparked by talks of a South-East Asia region mirror.

(cherry picked from commit 5b4acfac)

FreeBSD added OpenVPN 2.4, but we're not ready yet.

(cherry picked from commit 1d694b2f)

(cherry picked from commit cb051070)

(cherry picked from commit d9387089)

(cherry picked from commit daaf3acd)

when ipfw isn't configured, the service won't (re)start throwing an error, use of onestart instead of start fixes this. closes https://github.com/opnsense/core/issues/1292

(cherry picked from commit 5ba5a918)

edns flag was added in 2014, but it could never be set.
Remove buffer size override along with it to further
simplify the situation.

See: https://github.com/pfsense/pfsense/commit/3b95d9e
(cherry picked from commit 493ee561)

(cherry picked from commit c7b1e462)

(cherry picked from commit 4ebccaa2)

This is an inplace config migration.  The mount still behaves
the same way and a config save from the page migrates the
options.  We're not in a rush here, but the reason is that
we should have clean options and the new 17.1 images for nano
will depend on the new style.

(cherry picked from commit e413994c)
(cherry picked from commit 3d802a0a)
(cherry picked from commit 393fadce)

(cherry picked from commit 20df3371)

(cherry picked from commit 3df93860)

(cherry picked from commit 52b95b80)

(cherry picked from commit 339f1301)

(cherry picked from commit feb11e59)

(cherry picked from commit 6124cdc4)

(ipsec) add clone phase 2 option to ease duplication/modification, closes https://github.com/opnsense/core/issues/1305

(cherry picked from commit 1d325312)

(cherry picked from commit 92d7bce2)

(cherry picked from commit 41b9d3fe)

(cherry picked from commit 81e205f7)

PR: https://forum.opnsense.org/index.php?topic=4094
(cherry picked from commit 26d9815d)

Way better fix for the squid file transition.  Does not require
a manual restart anymore.

(cherry picked from commit 101fc844)

The regdhcp conditional option never really worked in the first place.
Dhcplease registration is controlled by regdhcp and regdhcpstatic
elsewhere already and we always need to include this file.

PR: https://forum.opnsense.org/index.php?topic=4041
(cherry picked from commit f31e5560)

(cherry picked from commit cd6cdba1)

(cherry picked from commit 902b9431)

(cherry picked from commit 041702d2)

(cherry picked from commit 0f881bc4)
(cherry picked from commit 28ea1d73)
(cherry picked from commit b234d36f)
(cherry picked from commit ae4e38bc)
(cherry picked from commit d0f13284)
(cherry picked from commit f783f5c4)

(cherry picked from commit 5bfa41fd)

Console features:

o major upgrade support from the console (not enabled)

GUI features:

o pkg-audit to view current FreeBSD vulnerability report
o changelog viewer with all older and (possibly) newer releases
o intelligent plugin handling (release vs. development version)
o improved (simplified) update workflow and presentation
o license viewer for installed packages
o revamped tabs and menu navigation

(cherry picked from commit 052c9599)

We always set primaryconsole in our images, which is enough
for the code to figure out that serial was enabled.  If a
user changed this, he will have to reconfigure to get the
expected result: primaryconsole set to something different
other than serial and secondaryconsole not set will obviously
not be enogh of a hint for a system to use the serial one.

(cherry picked from commit ea2abc6b)

(cherry picked from commit a81aab89)
(cherry picked from commit 61626494)