18517 Commits

Author SHA1 Message Date
Ad Schellevis
913863a72e Services: Kea DHCP: Kea DHCPv6 - fix "Delegated length must be longer than or equal to prefix length" validation, closes https://github.com/opnsense/core/issues/10146
While here, also fix a prefix validation (when x::/64 is specified for example).
2026-04-12 20:23:13 +02:00
Franco Fichtner
c2dcb5ba2f mvc: sweep 2026-04-12 14:45:14 +02:00
Ad Schellevis
dad956e314 Firewall: Rules [new] - refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data.
The current implementation is applying our filter logic twice for MVC records, first it uses the default searchBase() construct, which it then needs to pipe through searchRecordsetBase() again. There are a couple of downsides here, it's more expensive (although the user likely won't notice), but also requires duplication of filter logic.

With the logic introduced in c81417f267 , we can extract the exact same content from our model so we can merge all at once and push it through our filtering and sorting logic.

The idea is to be able to "smarten" searchRecordsetBase() a bit so we can apply some additional logic based on types at some point in time, which requires all data to passthrough the same pipeline at least.

This commit should be backwards compatible with the previous code.
2026-04-12 11:02:57 +02:00
Franco Fichtner
f1a3150fa9 interfaces: minor whitespace change 2026-04-12 10:01:21 +02:00
Franco Fichtner
5e64948059 mvc: another style sweep 2026-04-12 09:47:04 +02:00
Franco Fichtner
dd226f32a1 mvc: style sweep 2026-04-12 09:40:05 +02:00
Ad Schellevis
c81417f267 mvc: minor cleanup in UIModelGrid, remove flatten() method as getFlatNodes() is almost the same. 2026-04-11 19:07:48 +02:00
Ad Schellevis
d739e53197 Auth/LDAP - move ldap_escape to caller for https://github.com/opnsense/core/issues/10129
Although this 016f66cb46 was the correct fix for the auth sequence, other callers which search the database
with a static set of expressions are influenced by this as well.

To some degree it might be better to have different callers for this, but this increases the impact if the otherwise limited change.
2026-04-11 18:30:59 +02:00
Ad Schellevis
95483e5048 System: Access: Servers - RADIUS, implement NAS-IP-Address attribute. closes https://github.com/opnsense/core/pull/10089
Refactor PR a bit and implement the requested attribute.
For existing setups, the send attributes should be unchanged.
2026-04-11 14:50:50 +02:00
Stephan de Wit
0460e24e29 firewall: live view: decode HTML where necessary to aid filtering. Closes https://github.com/opnsense/core/issues/10107 2026-04-10 14:20:39 +02:00
Franco Fichtner
c62ef330b1 system: more natural cron escaping for command #10075
Changes command output from

  /usr/local/sbin/configctl -d -- 'system remote backup'

to

  /usr/local/sbin/configctl -d -- system remote backup

which is actually correct and needed since c491376.

Not sure what "\n" had to do with it but in the case of the
command it should be a normal string and risk of injection
is lower than parameter (but still mitigated properly).
2026-04-10 10:39:06 +02:00
Stephan de Wit
7e000a9454 system: shorten static route collection code here 2026-04-10 09:37:36 +02:00
Ad Schellevis
1c2405e480 mvc: introduce JSON field type and refactor dashboard to use it, closes https://github.com/opnsense/core/issues/10064
We can use the same fieldtype for the favorites PR (https://github.com/opnsense/core/pull/10033)
2026-04-09 20:34:13 +02:00
Franco Fichtner
016f66cb46 system: escape LDAP username during search
Reported by: Matt Andreko
PR: GHSA-jpm7-f59c-mp54
2026-04-09 09:33:50 +02:00
Franco Fichtner
a663c3a651 radvd: fix PHP warning for previous 2026-04-08 16:53:10 +02:00
Franco Fichtner
cdf172056f hostwatch: restructure rc.conf to avoid mistakes
This adds one configurable command option per separate if-block.
2026-04-08 16:11:55 +02:00
Stephan de Wit
5a5350e29e dashboard: throw UserException when size limit reached on save. Closes https://github.com/opnsense/core/issues/10096 2026-04-08 09:21:49 +02:00
Greelan
8b5a768ec7 widgets: fix Traffic.js initialization race condition (#10099) 2026-04-08 09:11:34 +02:00
Franco Fichtner
477451d9b7 mvc: clear unused inputs in syslog controller 2026-04-08 08:35:39 +02:00
Greelan
7cfb03be5d mvc: MenuSystem - tweak JavaScript wrapper to match server-side breadcrumb format (#10101) 2026-04-08 08:32:41 +02:00
Franco Fichtner
d092f74bb1 mvc: remove Util imports where not needed 2026-04-08 08:19:01 +02:00
BPplays
267f5a41d9 radvd: allow user controlled hop limit
PR: #9688
2026-04-07 21:29:07 +02:00
Franco Fichtner
a7034c0ede src: whitespace sweep 2026-04-07 20:33:22 +02:00
Franco Fichtner
faa7dab419 system: audit staticroute' config access for #10027 2026-04-07 16:34:27 +02:00
Franco Fichtner
700d6a00d2 src: a few more samples for import linter 2026-04-07 16:14:00 +02:00
Franco Fichtner
acab676a08 mvc: obvious linter complaint 2026-04-07 16:07:03 +02:00
Franco Fichtner
bbf6ee6cc1 firewall: unused vars/imports 2026-04-07 15:51:28 +02:00
Monviech
aaf9a1c797 mvc: Remove UIModelGrid imports in IDS, Monit, Syslog SettingsController, unused 2026-04-07 15:29:15 +02:00
Franco Fichtner
fd780bb1dc radvd: make a note for dev/debug and closes #10048
Ideally this should be refactored a bit to flush the configuration
regardless of enabled state, but the legacy code has no separate
template flush so it is tied to service (re)start and we are going
to leave it at a note.
2026-04-07 14:59:43 +02:00
Franco Fichtner
79ba2da564 radvd: refactor and put eligible-test back #10048
Not super happy but make $radvdifs use simpler since $manuallist now
does exclusion and we don't use the values saved in the former anyway.
2026-04-07 14:48:02 +02:00
Franco Fichtner
7116a1f591 radvd: split lists, easier to read and less code #10048 2026-04-07 14:30:35 +02:00
Franco Fichtner
72ccc1e14e radvd: allow to start without primary IPv6 for #10048
Reshuffle the code a little to make it (a bit) more obvious this is
safe to assume and working confirmed by automatic mode already.

Since we have full control via MVC enable/disable this is fine now.
2026-04-07 14:24:41 +02:00
Stephan de Wit
7a6a581209 bootgrid: shorten previous 2026-04-07 11:12:34 +02:00
Stephan de Wit
e67ea61085 bootgrid: limit maintaining scroll position to inplace=true, continuation of 75e60e8
This shouldn't be the default behavior, as a "refresh" would also
maintain scrolling position.
2026-04-07 11:08:31 +02:00
Franco Fichtner
7c8bda9a0e wireguard: sprint clean related to #10094 2026-04-07 11:05:33 +02:00
Franco Fichtner
e54c919ea1 LICENSE: sync
(and fix email format for @sopex's amusement) :)
2026-04-07 09:38:15 +02:00
Ad Schellevis
26b9169d44 Interfaces: Neighbors: Automatic Discovery - core part for configurable cleanups, closes https://github.com/opnsense/core/issues/9953 2026-04-06 19:09:02 +02:00
Ad Schellevis
1216d603f9 mvc: MenuSystem - add JavaScript wrapper, POC code for https://github.com/opnsense/core/pull/10086
Although this isn't a full implementation yet, it can help callers that need to access the menu system.
In the long run it might be practical if this class would also construct the menu system, so we can add some flexibility there.
2026-04-06 12:37:22 +02:00
Franco Fichtner
a57e59d710 src: fix a few whitespace issues 2026-04-05 10:48:44 +02:00
Ad Schellevis
48eeef5b82 Firewall: NAT: Destination NAT - regression in e0f0cbf922, closes https://github.com/opnsense/core/issues/9702 2026-04-04 12:44:37 +02:00
Stephan de Wit
75e60e8519 bootgrid: maintain scrolling position for both datatree and command actions. Closes https://github.com/opnsense/core/issues/9151
The usage of scrollToRow has been considered, but this contains
too much magic causing all kinds of jumps in scroll position,
causing a user to lose track of the changes they made. The only
downside to this is that when a datatree is expanded at the bottom
of a grid, the associated rows aren't immediately visible until
manually scrolled to.
2026-04-03 13:47:26 +02:00
Stephan de Wit
da2c0bdab3 captive portal: disable lighttpd-zone syslog output. Closes https://github.com/opnsense/core/issues/10036 2026-04-03 12:43:43 +02:00
Stephan de Wit
e5effd403d captive portal / hostwatch: output safety when list_hosts.py or decoding fails
arp.py seems to throw an exception an unpredictable times. Since
the most likely culprit is list_hosts.py, capture both
stderr of list_hosts and the exception value of the caller.

In any case, we reuse the old known ARP state to not kill
the CP background process
2026-04-03 11:12:16 +02:00
Ad Schellevis
693ea2d9de VPN: OpenVPN: add tls-crypt-v2 support (#10069)
fix regression in export output, forgot to remove the base64decode
2026-04-02 18:42:13 +02:00
Monviech
84ec45409d VPN: OpenVPN: add tls-crypt-v2 support (#10069)
* VPN: OpenVPN: Add tls-crypt-v2 support, initial implementation

* Unify key generation into a single bash script that handles stdout parsing and always emits base64, consume that in the key generator

* plist fix

* Add comment that explains stuff a bit better

* VPN: OpenVPN: add tls-crypt-v2 support - refactor https://github.com/opnsense/core/pull/10069

---------

Co-authored-by: Ad Schellevis <ad@opnsense.org>
2026-04-02 18:10:12 +02:00
Stephan de Wit
45b3d35761 Services: Kea: DHCPv4/6: remove KeaCtrlAgent dependency on HA configuration (#10080) 2026-04-02 13:58:13 +02:00
Stephan de Wit
67495766e2 Services Kea: DHCPv4/6: add sockets max-retries and retry-wait-time options. (#10078) 2026-04-02 13:40:57 +02:00
Konstantinos Spartalis
eb8e1ff97d Fix typo in firmware: fetching changelog message (#10079) 2026-04-02 09:54:46 +01:00
Monviech
9f10ba9d9c Services: Kea: DHCPv4/6: Add delete lease command, use socket for up to date lease collection (#10019)
Co-authored-by: Stephan de Wit <stephan.de.wit@deciso.com>
2026-04-02 09:15:35 +02:00
Ad Schellevis
41f808613a Firewall: Rules [new] - change category sorting using names instead of counted rules to align with interface sorting now, for https://github.com/opnsense/core/issues/9719 2026-04-02 09:04:08 +02:00