Commit graph

19672 commits

Author SHA1 Message Date
Franco Fichtner
c6db10f564 firmware: disable aux by default but enable when checked; closes #9275 2026-02-12 13:44:45 +01:00
Monviech
c145e5c30e
kea: Add scope ID to prefix watcher link local address to fix route add (#9778) 2026-02-12 13:42:55 +01:00
Franco Fichtner
1d06cf40eb firmware: opnsense-update does aux if found now 2026-02-12 12:40:19 +01:00
Franco Fichtner
31f6e89d38 firewall: override "Rules" name when we hide the old one 2026-02-12 12:09:38 +01:00
Franco Fichtner
a5c1076188 firmware: shorten this message, spinner now back to same line 2026-02-12 10:02:40 +01:00
Ad Schellevis
6cfd38c79b Firewall: Categories - add simple import/export function and missing lock on set action. 2026-02-12 10:02:17 +01:00
Franco Fichtner
bc6035e101 firmware: this cleanup also moves to opnsense-update 2026-02-12 09:11:59 +01:00
Franco Fichtner
f55124ab61 firmware: move this to opnsense-update 2026-02-12 09:02:42 +01:00
Franco Fichtner
2a90becd2e firmware: add aux repository for #9275
Not a toggle yet but also only on development for now.
2026-02-12 08:44:06 +01:00
Ad Schellevis
0b5f585113 Lobby: Dashboard / Firewall - fix encoding issue, closes https://github.com/opnsense/core/issues/9729
Minor adjustment to https://github.com/opnsense/core/pull/9776
2026-02-12 08:35:37 +01:00
Franco Fichtner
0ed6359197 firmware: fix this annoying UX bug not hiding advanced options 2026-02-12 08:30:48 +01:00
Franco Fichtner
8a52f03b37 firmware: put 99e4cd28b6 back where it belongs
Without backgrounding because this is important.
2026-02-11 15:53:00 +01:00
Franco Fichtner
a6f5203adb firmware: avoid update-hook background cleanups
Since ea75da8a this is no longer necessary although the introduction
in 039ae3c19 states that this was happening and allegedly helping.

Pre-upgrade runs this as well as the cleanup audit if it's needed
manually.
2026-02-11 15:28:39 +01:00
Franco Fichtner
07a5ec72f3 mvc: array_first() is PHP 8.5 2026-02-11 14:06:51 +01:00
Franco Fichtner
fcb6f76bd8 mvc: review feedback 2026-02-11 14:04:31 +01:00
Franco Fichtner
ed748aef15 mvc: catch empty data in CSV import
Catch empty lines.  A single "," will generate
an empty string instead of NULL so we are good
here.  It's safe to assume we have at least one
property in the line, otherwise the data is
useless to us anyway.

From the fgetcsv() manual:

A blank line in a CSV file will be returned as an array
comprising a single null field, and will not be treated
as an error.

See: https://www.php.net/manual/en/function.fgetcsv.php
2026-02-11 13:23:15 +01:00
Ad Schellevis
774a51d626 Firewall: Aliases - allow TTL usage on host entries, closes https://github.com/opnsense/core/issues/9767 2026-02-11 11:57:05 +01:00
Stephan de Wit
9271d08bf3
bootgrid: batch enable/disable-selected toggle by default, clean up IDS page (#9768)
The footer commands weren't taking into account the required properties, rendering unlinked buttons where they shouldn't be (e.g. in dnsmasq DHCP ranges etc.).

Take this opportunity to clean up and improve some front-end code, including batching of enable/disable-selected API calls. The arbitrary default limit of "40" has been set based on (40 * 36-character UUID + ~150-character URI out of a 2k URI character limit).

In the controller, change how rows are collected (use getNodeByReference only for rootnode) to save some cycles, throw an error if someone tries to swap multiple records at once as that is less likely intentional anyway (explicit on/off are acceptable values) and keep simplified result output.

Reference: https://forum.opnsense.org/index.php?topic=50806.0

---------

Co-authored-by: Ad Schellevis <ad@opnsense.org>
2026-02-11 09:32:57 +01:00
Franco Fichtner
57f148201b make: fix nightly build issues et al 2026-02-10 10:47:31 +01:00
Ad Schellevis
a92b472578
Firewall: Rules [new] - hide legacy option after migration (when there's at least a new rule and no legacy rules exist). (#9765) 2026-02-10 08:18:52 +01:00
Franco Fichtner
53d61b9d60 system: adjust gateway group priority(tier) wording
PR: https://forum.opnsense.org/index.php?topic=50814.0
2026-02-10 07:46:35 +01:00
Ad Schellevis
e1f7cf04e1 ApiControllerBase->exportCsv: add $separator as parameter and swtich the default to a semicolon (;), importCsv() already understands both, but semicolon seems to be more commonly used, which helps tools like Excel to open the file instantly as table. 2026-02-09 16:13:15 +01:00
Franco Fichtner
870692c154 tests: fix tests broken by #9744
The static option list caching mechanism is now invoked over a
nonexistant config.xm; caching no interfaces for the "*" static
options key.  In order to fix that add a reset for the list.

Would be nicer to move reset to BaseListField since a number
of fields use the static option list for caching but they all
define their own.
2026-02-09 09:09:09 +01:00
Franco Fichtner
49d573691f tests: one more for protocol replacements; closes #9744
The tests aren't complete but they do cover parseReplaceSimple()
in its latest form so that's good enough.

Just as a note the tests are designed to be render-agnostic so
that we always start with our rule input and produce pf.conf
compatible rulesets with the tests.  There are two purposes here:

1. Catch regressions when parsers are changed and that also includes
   switching the parser implementation completely in the future.

2. Make sure that the files are actually compilable by pf.conf and
   this should be covered later (the conf files are there on the
   disk for that purpose).

This is the right type of testing for the purpose since the pf.conf
syntax is virtually static and will require little maintenance.
Just needs a lot more coverage for the missing features/rule types.
2026-02-09 08:32:46 +01:00
Franco Fichtner
8e00d7b4dc Scripts: safeguard against missing directory 2026-02-09 07:24:30 +01:00
Ad Schellevis
e98e55ede5 Firewall: Rules [new] - missing reply-to when not specifically set, closes https://github.com/opnsense/core/issues/9761 2026-02-08 20:21:04 +01:00
Ad Schellevis
b2aae25d6a mvc:javascript:SimpleFileUploadDlg() - add download button for validation errors, closes https://github.com/opnsense/core/issues/9760
When uploading a file results in validation messages, add a download button to dump the results into a csv file as well.
Since our javascript code doesn't translate very well, only add an icon and skip the title text for simplicity.
2026-02-08 19:17:48 +01:00
Ad Schellevis
766c6ce8e7 Services: Unbound DNS: Overrides - persist PTR configuration and allow the user to deselect it, closes https://github.com/opnsense/core/pull/9753 2026-02-08 15:25:03 +01:00
Ad Schellevis
ccffd887d4 Services: Kea DHCP: Kea DHCPv4/6 / Subnets - missing root node, closes https://github.com/opnsense/core/issues/9762 2026-02-08 14:16:40 +01:00
Ad Schellevis
68ff0dc498 System: Gateways: Configuration - remove "upstream" from grid as priority already reflects the proper data, closes https://github.com/opnsense/core/issues/9751
The grid was added in 7f9d104663, but shouldn't have been due to type issues of the raw field, see also 8069d72bac
2026-02-08 14:06:15 +01:00
Ad Schellevis
c56f89b756 Firewall: NAT: Destination NAT - use "local-port" as target when specified, closes https://github.com/opnsense/core/issues/9750 2026-02-07 10:29:39 +01:00
Franco Fichtner
cd409c5729 firewall: fix the faulty "any" replacement of a09fab2c8
While here fix another warning lighting up in the test run.
2026-02-06 21:30:15 +01:00
Franco Fichtner
b50350a910 tests: add FilterRule testing for #9744
The test already revealed an issue with the refactor:

replacing "any" with "" and then "" with "in" is not in
the interest of the inventor.  Fix follows.
2026-02-06 21:28:06 +01:00
Stephan de Wit
72cea55c1a firewall: live view: combined filters stored as converted strings, adjust parsing (fixes https://github.com/opnsense/core/issues/9741) 2026-02-06 14:24:34 +01:00
Franco Fichtner
17310aea35 firewall: another ether rule leftover 2026-02-06 09:25:46 +01:00
Franco Fichtner
a09fab2c8d firewall: adjust for parseReplace() for icmp-type "skip"; closes #9738
Direction was a little tricky.  Would be nice to have tests for this.  ;)
2026-02-06 09:12:17 +01:00
Ad Schellevis
b84bd68b29 Services: Unbound DNS: Blocklists / Tester - safeguard config use, when there's none specified, don't crash out. 2026-02-05 21:46:12 +01:00
Ad Schellevis
c7650c6167 System: Access: Servers - add configurable "memberOf" attribute, simplified version of https://github.com/opnsense/core/pull/9675
closes https://github.com/opnsense/core/issues/9650
2026-02-05 20:29:09 +01:00
Ad Schellevis
96ceae0deb Firewall: NAT: Destination NAT - fix target mapping inconsistency leading to ip and network references not being processed (e.g. "lan ip", "wan network") 2026-02-05 16:12:55 +01:00
Franco Fichtner
25477039f6 mvc: style 2026-02-05 14:45:33 +01:00
Franco Fichtner
aef0172f55 tests: don't put errors into log during tests for previous 2026-02-05 13:34:40 +01:00
jakobsen-lrz
4534e73dd7
Firewall: Rules [new]: Implement missing ICMP types (#9731)
Signed-off-by: Bjoern Jakobsen <Bjoern.Jakobsen@lrz.de>
2026-02-05 13:32:49 +01:00
Franco Fichtner
b25bdee3b4 mvc: Shell: rewrite exec_safe() to avoid vsprintf() complications; closes #9703
Only support %s and %% using preg_replace_callback() and throw
3 distinct TypeError cases making sure the resulting command is
the dummy command then.

We're not overly interested in how well escapeshellarg() works,
but we ensure it's being called always.
2026-02-05 13:16:11 +01:00
Monviech
aa6a813617
Firewall: Rules [new]: Fix group rename in source_net, destination_net and SNAT/DNAT target fields (#9734)
* Firewall: Rules [new]: Fix group rename in source_net, destination_net and SNAT/DNAT target fields

* review comments @fichtner
2026-02-05 11:36:20 +01:00
Franco Fichtner
cbc09e7c5a firewall: well known ports added to filter rule selection; closes #9692 2026-02-05 09:12:17 +01:00
Franco Fichtner
700f590383 firewall: undefined is also "*" 2026-02-05 08:34:43 +01:00
Franco Fichtner
4912a671be interfaces: fix wlanmode usage part 2 #9727 2026-02-05 07:01:27 +01:00
Monviech
d4eb6235ae
Firewall: Rules [new]: Add tcpflags_any for parity with legacy rules (#9720) 2026-02-04 15:58:03 +01:00
Monviech
d43b14ef9b
Firewall: Rules [new]: Exclude loopback from interface selectpicker (#9723) 2026-02-04 14:13:25 +01:00
Monviech
6dce1de829
Firewall - Rules [new]: Add all rules option to interface selectpicker and make it default selection (#9713)
* Firewall - Rules [new]: Add all rules option to interface selectpicker and select it by default
* Interface select default only on null or no match, not on empty string
* To fix URL hash weirdness, it's best to special case __floating and __any in the frontend
* Lower diff in controller by folding null case into is_if
* firewall: tweak the interface selector

Show group name and description.  Could be inconvenient when
the description is long, but better for the auto-groups.
That also removes the hint at the end.  See note below.

Use fixed width logos for the interface groupings.

Remove muted from the any selection.

TODO/Remarks:

The groupings being shown as muted is a bit inconvenient also
as it muddies the perspective of what this does and how important
it is.  Would be nicer to not have it in this particular selector.

When an interface is selected it would be perfect if the grouping
icon would show so people see better what they selected.  Coloring
is nice so that would take it to the next level.

Badges with rule counts are not overly nice in front of the selection
and also don't update on rule delete.  While it's nice to have this
the question is if this is really needed.  A counter already exists
when clicking on them (Showing xxxx).

---------

Co-authored-by: Franco Fichtner <franco@opnsense.org>
2026-02-04 11:10:55 +01:00