Commit graph

19718 commits

Author SHA1 Message Date
Ad Schellevis
3316148d10 unbound: simplify getPoliciesAction() a bit for https://github.com/opnsense/core/issues/9814 2026-02-18 20:01:48 +01:00
Stephan de Wit
00b5984025 unbound: move policy fetch to the controller, clean up accordingly. Fixes https://github.com/opnsense/core/issues/9814 2026-02-18 16:45:32 +01:00
Franco Fichtner
ff41dee988 firewall: tweak comment 2026-02-18 12:38:53 +01:00
Franco Fichtner
104d5f02f8 mvc: CertificateField: same as 870692c154
It's time to create a ticket for generalisation because now
resetStaticOptionList() is declared in two places also hinting
at a shared functionality in BaseListField.
2026-02-18 11:59:02 +01:00
Franco Fichtner
18c3f1187f reporting: adapt config_read_array() in rrd_import()
Note to self: can find more of these using

    % git grep 'foreach..$config\['
2026-02-18 11:33:03 +01:00
Franco Fichtner
d97bebb0cc backend: rename to config_push_array() since "write" is confusing 2026-02-18 11:28:51 +01:00
Franco Fichtner
bbf4ec5eb0 monit: one config_read_array() candidate 2026-02-18 11:26:30 +01:00
Franco Fichtner
81a0db2b45 backend: typo in previous, let's avoid all $config if we can 2026-02-18 10:21:18 +01:00
Franco Fichtner
b7166dc7ae backend: last batch of audits for &config_read_array() use 2026-02-18 10:16:14 +01:00
Franco Fichtner
39dc18d580 interfaces: protect device reads against forcing empty "arrays" into $config 2026-02-18 10:00:39 +01:00
Franco Fichtner
0e7e4a5c46 backend: shift the ca/cert/crl code to the newer config_read/write_array 2026-02-18 09:48:54 +01:00
Franco Fichtner
8e8a707130 config: add config_write_array() magic
With this we can insert new entries without the need to grab the entry
beforehand using config_read_array().

    config_write_array('foo', 'bar', 'hello');

becomes

    <foo>
        <bar>hello</bar>
    </foo>
2026-02-18 09:41:30 +01:00
Franco Fichtner
808e46d6fa interfaces: safe to drop ip_in_interface_alias_subnet()
Only used by isc-dhcp plugin which has its own copy now.
2026-02-18 09:08:51 +01:00
Franco Fichtner
fdbd32be08 backend: use config_read_array() non-insert mode mode iteration of virtual IPs 2026-02-18 09:03:37 +01:00
Monviech
242fc74ccb
vpn/openvpn: Use tls-crypt and tls-auth aliases for generating the static key (#9810)
* vpn/openvpn: Even though openvpn --genkey secret generates the same static key for secret, tls-auth and tls-crypt, it is more explicit to use all modes verbatim. It's simpler to expand it in the future this way.
2026-02-17 16:15:33 +01:00
Stephan de Wit
ab102b588b dashboard: sync layout with configuration when adjusting column count
This prevents edge cases of widget deletion or additions in one layout mode
still showing up in others. This also handles privilege changes, where
users don't have access to specific widgets anymore, making sure
these persisted widget layouts are cleaned up when requested.
2026-02-17 14:50:02 +01:00
0nnyx
5ce6895e4a
Update et-open.xml (#9808)
Upgrade ET open ruleset to v7.0.3+ syntax
Update the rule files : removed 3coresec ; added dyn_dns, file_sharing, remote_access, retired, ta_abused_services
2026-02-17 14:14:15 +01:00
Franco Fichtner
60a8652aab unbound: minor style change 2026-02-17 14:01:36 +01:00
Stephan de Wit
1a1d2dff10 dashboard: store layout types based on column breakpoints
We currently define 3 breakpoints with 1, 3 and 12 columns respectively.
Previously, if a user loaded the dashboard on a phone or tablet
screen and subsequently saved the layout, this layout would be
ignored in order to prevent a hardcoded number of columns on
larger screens. With this commit, each breakpoint will have its
own associated layout and dynamically adjust the layout to one
of the available ones if the screen is resized and forced to reduce
the number of columns. Layouts on smaller screens are therefore
persisted as well.
2026-02-17 13:30:32 +01:00
Monviech
64e1a51d4a
Firewall: Schedule: Fix is_schedule_inuse so it works for legacy and new rules (#9807)
* Firewall: Schedule: Fix is_schedule_inuse so it works for legacy and new rules

* Use config_read_array instead
2026-02-17 11:27:32 +01:00
Franco Fichtner
c5cb86b6dd interfaces: multi-dhcp6c support and custom PD association #7647
This splits off rtsold and dhcp6c into separate processes
which frees us from the restrictions of faked iterative IDs
for PD associations.  For NA we simply default to 0 now.

I'm not entirely sure why we settled for a single deamon of
dhcp6c back in the day, but there are certianly downsides to
it and I don't see something that wasn't fixed in the meantime
that makes this not work.
2026-02-17 10:18:45 +01:00
Henry Reed
91fce10c59
Fix typo (#9803)
The installation wizard has a typo wherein Unbound is referred to as "Unboud" (missing the 'n' character). This commit fixes this typo.
2026-02-17 08:40:23 +01:00
Franco Fichtner
83f8b6b70c backend: two unused global $config references 2026-02-17 08:16:54 +01:00
Franco Fichtner
a01822d628 make: remove CORE_REPOSITORY
Looking at it again this was used for LibreSSL back in the day
but we do not need this and aux configuration is also hardcoded.
2026-02-17 08:05:43 +01:00
Franco Fichtner
dec48352f9
www: config read safety using feddc1f (#9787)
Increase coverage of the new feature in our legacy www files.
2026-02-17 08:00:51 +01:00
Ad Schellevis
df17f3ce81 Firewall: Aliases - better focus selected alias updates to in crease performance when either --aliases or --types is used. 2026-02-16 17:59:24 +01:00
Greelan
dfa65e1589
Services: Dnsmasq DNS & DHCP: add IP address validations for some of the DHCPv4 and DHCPv6 options (#9790)
---------

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>
Co-authored-by: Franco Fichtner <1915288+fichtner@users.noreply.github.com>
2026-02-16 13:14:15 +01:00
Franco Fichtner
a0eee0cbd6 captive portal: fix timeout calculation; closes #9794 2026-02-16 11:35:26 +01:00
Franco Fichtner
feddc1f280 backend: allow non-intrusive config_read_array(); closes #9786
When config keys are not found or are not arrays that should
be (especially for iterating with foreach) we do a trick here
by returning a detached empty array to avoid upper layer
errors, forcing empty arrays into $config yet reading and
removal still work fine.  The default stays the "insert" mode,
which can be triggered explicitly just for symmetry.  Bools
are not in the keys so this is perfectly fine.

The function itself was added in 4c179c23 in 2017 and hasn't
been modified since which is quite the achievement IMO.  It's
had a clear purpose but now we make it just a little bit
better.  :)

Look for more references at least in the legacy pages:

    # git grep 'foreach.($config\[' src/www
2026-02-16 11:00:04 +01:00
Franco Fichtner
6ae73e8406 mvc: adding a new gateway complains isUUID() wants a string not null 2026-02-16 10:44:21 +01:00
Monviech
d976ae7b6b
Firewall: Rules [new]: Reduce complexity in url hash handling and when using firewall_rule_lookup (#9773)
* Reduce complexity of firewall_rule_lookup, we have an all rules entrypoint now, so potentially we could just search for the UUID of the rule without concerning us with interfaces anymore

* Clean up URL hash logic, we only allow #search and #interface now and need no special handling

* Only get the hash once, use it everywhere, re-add missing null fallback and initialized interface variable

* The hash was consumed too early now, fix it by shifting to the new spot where the variable is used last
2026-02-16 09:30:40 +01:00
Monviech
7738d7e865
mvc: collect uuid field so it can be searched, but only if the searchPhrase contains a valid UUID (#9780)
Add UUID to the fields that can be searched, but only if the searchPhrase contains a valid UUID. That way it won't match on partial strings.

* Create new Type class in core library and add isUUID static, replace individual callers with the new static.

* Add a new static function containsUUID() to the new Type class.

* Move searchPhrase tokenization to ApiMutableControllerBase searchBase()
Determine if search_tokens contain a valid UUID, if yes collect the uuid field so it can be searched. Doing this prevents finding partial strings in UUIDs, but allows to find exact UUIDs.
Inside UIModelGrid fetchBindRequest(), use the search_tokens directly. A compatability case makes this backwards compatible for callers that do not know about search_tokens.
Pass the search_tokens directky into UIModelGrid fetch() instead of the raw searchPhrase.
2026-02-16 09:29:50 +01:00
Stephan de Wit
75e600a138 bootgrid: adjust function signature for the edit command per 8405980833 2026-02-16 09:22:40 +01:00
Ad Schellevis
f399b33df9 Services: Unbound DNS: Blocklists - split logic in update_blocklist() so we can reuse it easily in list_configuration().
Functionally this shouldn't change anything, but when building additional handlers, it's practical to show priorities of the ones that are registered.

To use the list action, simply call:

./blocklists.py list
2026-02-15 13:49:07 +01:00
Ad Schellevis
4a6094b001 Firewall: Rules [new] - missing implementation for disablereplyto, closes https://github.com/opnsense/core/issues/9785 2026-02-14 13:49:39 +01:00
Monviech
d5a50a98c2
Firewall: Rules [new]: Move download and upload commands out of partial into global commands (#9781) 2026-02-13 16:23:04 +01:00
Stephan de Wit
8405980833 interfaces: overview: clean up UI code and fix CARP badge alignment 2026-02-13 15:48:44 +01:00
Stephan de Wit
5b3b163ce0 bootgrid: swap order of custom commands placement making sure they participate in command binding 2026-02-13 11:32:16 +01:00
Franco Fichtner
22b36dcc4b firmware: restructure upgrade code
Goes over the previous change by calling the reboot only once
instead of three times:

Here we are told there are upgrades pending and the upgrade hooks
were returning successfully.  Apply the kernel immediately if
necessary to save a reboot.  Contrary to popular belief the kernel
can still apply during a reboot if something went wrong, but this
way we save a reboot.  After that don't question that a reboot is
necessary to avoid ever falling into the error case for no reason.
2026-02-13 09:52:32 +01:00
Franco Fichtner
0e31c27ef7 firmware: use portable -E supported by opnsense-update now for #9275 2026-02-13 09:43:37 +01:00
Franco Fichtner
6bd41d3e18 mvc: sweep 2026-02-13 09:11:32 +01:00
Franco Fichtner
ee040be318 menu: tweak this a little more
findNodeById() is not needed as findNodeByPath() does the same.
It's also not used anywhere else so just merge both.

On the system end make a getItem() which makes the code a little
cleaner and reduces callers of findNodeByPath() to one.  ;)
2026-02-13 09:07:22 +01:00
Ad Schellevis
beed8f1000 System: Snapshots - add note field to store comments. closes https://github.com/opnsense/core/issues/9764
One of the main issues with our previous bectl output was the variance of the (uuid) key, which we generated using the current name.
By using the create timestamp (acquired via zfs), we can keep our key stable on renames and offer access to simple json files on disk which contain additional notes.

Notes are stored in /conf/snapshots/ as json files, keyed by their generated uuid's.
2026-02-12 21:17:31 +01:00
Ad Schellevis
66261e1121 bootgrid: fix curRowCount type conversion issue when stored in localstorage. 2026-02-12 18:23:01 +01:00
Stephan de Wit
c0569f86d5
bootgrid: batch delete-selected by default (#9779)
* bootgrid: batch delete-selected by default

* ApiMutableModelControllerBase - simplify checkAndThrowSafeDelete in delBase a bit for https://github.com/opnsense/core/pull/9779

* use a descriptive name if available

---------

Co-authored-by: Ad Schellevis <ad@opnsense.org>
2026-02-12 15:50:36 +01:00
Monviech
63e0b92278
Firewall: Rules [new]: Add a command button to open the live log with prefilled rule ID (#9770)
fw_log.volt:
Uses a url hash inside fw_log.volt to set a filter when opening it through a link from filter_rule.volt
The url hash can set any type of a single filter, so it can be reused in other pages as well.
Combine entry point of addCombinedFilter and addFilter, decide via array in field what type it is.
Change init entrypoint to always go through the filterChange() pipeline, but have a fast path in there that initializes without a filter. This adds the filter immediately when loading with the page with the URL hash
Make sure we want for tableBuilt to prevent replaceData errors

filter_rule.volt
Only show the log search button when row.log is 1 or true
Change fa icon in the lookup rule reference button in dnat as well for consistency
Use URLSearchParams()

---------

Co-authored-by: Stephan de Wit <stephan.de.wit@deciso.com>
2026-02-12 14:31:04 +01:00
Franco Fichtner
c6db10f564 firmware: disable aux by default but enable when checked; closes #9275 2026-02-12 13:44:45 +01:00
Monviech
c145e5c30e
kea: Add scope ID to prefix watcher link local address to fix route add (#9778) 2026-02-12 13:42:55 +01:00
Franco Fichtner
1d06cf40eb firmware: opnsense-update does aux if found now 2026-02-12 12:40:19 +01:00
Franco Fichtner
31f6e89d38 firewall: override "Rules" name when we hide the old one 2026-02-12 12:09:38 +01:00