Largely these fill the same need: we run a daemon on that interface
(or a daemon that will create the software interface). Since WLAN
clones are created and reloaded earlier we are not bound to a random
place in the configure function and can eventually add a plugin hook
for this if it makes sense.
While here push the $linkup workaround down and add a comment on
why it is still needed. It would be nicer not having it but the
situation is pretty tough if the historic situation did not change.
This means we call it during device creation and reloading, which
means we can remove it from interafaces_wlan_configure() so it loses
another side effect. Just needs the reconfigure script to run the
full configuration loop then.
While here unify the function syntax to interfaces_wlan_*().
To make interfaces_configure() side effect free
we need to gather all information in the new
interfaces_dependencies() so we can debug and
simplify bootup.
We don't expose the device to the pluggable
device code, but in principle make it pluggable
as interfaces_dependencies() is a good point to
anchor it now.
Add two automatic migrations for the legacy normalization configuration.
The first converts supported scrub entries into non-quick match rules at
the start of the ruleset, and discards rules that only reference defunct interfaces.
The second copies the global scrub controls into model-owned firewall settings.
Introduce the new tabbed Firewall Settings page with filter scrubbing
options and generate modern reassembly, random ID, and interface MSS
rules from these settings. Remove the legacy normalization pages and
rendering code while retaining their configuration for optional cleanup via ConfigMaintenance.
Move the volatile SNAT mode into the shared settings model without
changing its current GUI. This establishes the settings structure for
additional tabs and allows the remaining legacy advanced firewall
settings to move there eventually.
interfaces_configure() would re-classify VLAN as "software" after
making in pluggable, but the actual intention of the queues build
was that trackers, bridges and dhcp6c interfaces were started up
last. This wasn't given in the loop since the more specific checks
were at the end instead of at the front. It also reduces the
complexity in the processing.
"FreeBSD" is now "FreeBSD-ports" and since we know we want
"OPNsense" we can make pin it this way much better.
One downside is the "unknown-repository" when installing
from ports but it's easy enough to circumvent this check
for testing.
The set is now modified to split out the private ranges from the
larger bogons block so we can remove this exclusion from the
alias to "make inversion better again". ;)
Firewall: Rules: Add match action and normalization options
Add `match` as a regular MVC firewall rule action and support `scrub (...)` options on both `pass` and `match` rules.
Switch global normalization to modern PF syntax by emitting `set reassembly` and generating random-ID and interface MSS handling as match rules. Legacy scrub rules and configuration paths remain unchanged, with no migration or compatibility handling introduced.
Normalize unsupported combinations when changing away from `pass` via js handler.
Add `match` support to the firewall live log and widget, expose the normalization controls in the rule dialog as advanced options, and include the related UI and formatter adjustments.
Franco Fichtner