Commit Graph
20834 Commits
Author SHA1 Message Date
Ad Schellevis c353e1a231 System: Gateways - reverted logic in previous, which should complete https://github.com/opnsense/core/issues/10978 2026-10-09 07:41:19 +02:00
Franco Fichtner 16dfcafee7 interfaces: set promisc mode to advanced 2026-10-08 20:31:47 +02:00
Ad Schellevis a0e544cfb8 System: Gateways - fix protocol selection for dynamic interfaces without ipprotocol set and make sure policy based routing rules can use these for both protocols. closes https://github.com/opnsense/core/issues/10978
When using "Dynamic gateway policy" on an interface, a route-to rule will omit the (unknown) address.
This logically means both protocols could be served by the same gateway entry.
2026-10-08 20:26:26 +02:00
Ad Schellevis 6553188c27 Firewall: Diagnostics: Aliases - array_search() should check for boolean false, closes https://github.com/opnsense/core/issues/10981 2026-10-08 15:41:59 +02:00
Konstantinos Spartalis 8837a247fc VPN: IPsec: Deprecate IKEv1 (#10925) 2026-10-07 16:05:03 +02:00
Ad Schellevis 86cae77e4e Firewall: NAT: Destination NAT - fix "Warning: Undefined variable $port in .." 2026-10-07 14:52:23 +02:00
Franco Fichtner 2cf8272b54 interfaces: remove direct $config access and improve device handover in legacy apply 2026-10-07 14:16:33 +02:00
Franco Fichtner b89172f346 interfaces: remove PPTP support; closes #10973
To ease future migrations from PPP to MVC/API and reduce the
config field "localip" misuse we want to phase out PPTP and
reduce complexity of the implementation.

While L2TP may be still around the PPTP tunneling is very likely
not used anymore.  A bit of a message to everyone still using this.
Only one way to find out.
2026-10-07 13:56:34 +02:00
Stephan de Wit 403435e687 Revert "interfaces: fallback here to prevent php warnings"
This reverts commit cda3b2f717.

these are stored by default now after save
2026-10-07 11:12:28 +02:00
Stephan de Wit cda3b2f717 interfaces: fallback here to prevent php warnings
PHP Warning:  Undefined array key "localip" in /usr/local/etc/inc/interfaces.inc on line 1192
PHP Warning:  Undefined array key "gateway" in /usr/local/etc/inc/interfaces.inc on line 1196
2026-10-07 11:06:04 +02:00
Stephan de Wit 384bd74f60 reporting: unbound: capitalize DNSSEC status column header 2026-10-07 09:07:27 +02:00
Franco Fichtner 1177021c22 interfaces: backend call for interfaces_ppps_configure(); closes #9352 2026-10-06 15:29:45 +02:00
Stephan de Wit d7cc8e1c0f gateways: null is not going to be a UUID either
ErrorException: Using null as an array offset is deprecated, use an empty string instead in /usr/local/opnsense/mvc/app/controllers/OPNsense/Routing/Api/SettingsController.php:162
Stack trace:
2026-10-06 15:11:16 +02:00
Franco Fichtner dfc07590e9 interfaces: priv-sep script for interface apply the legacy way #9352 2026-10-06 14:57:48 +02:00
Franco Fichtner 530ee0cee0 interfaces: remove system_routing_configure() #9352
The function is called via $reload hook so adding another
hook makes no sense.  This may have changed since the original
commit below and since we need to priv-sep these calls the
easiest way is to remove it.  ;)

See also: https://github.com/pfsense/pfsense/commit/8e11b23f541d
2026-10-06 14:35:31 +02:00
Franco Fichtner f76beb8ff0 system: $config is unused in core.inc 2026-10-06 14:23:30 +02:00
Franco Fichtner 1f96bd4f6f interfaces: move legacy apply to /var/lib/php/tmp for #9352 2026-10-06 14:20:03 +02:00
JorioandStephan de Wit c6318dfbbd reporting: unbound: add dnssec status column in details grid (#10940)
Fixes https://github.com/opnsense/core/issues/10704

---------

Co-authored-by: Stephan de Wit <[email protected]>
2026-10-06 13:36:26 +02:00
Franco Fichtner 6dcc04a243 firewall: less parenthesis for previous 2026-10-06 13:07:07 +02:00
Ad Schellevis d43a1c16d8 Firewall: Aliases - deny invalid port ranges, closes https://github.com/opnsense/core/issues/10954 2026-10-06 10:26:30 +02:00
Ad Schellevis 43dc040cfb VPN: OpenVPN: Instances - improve keepalive validation, mentioned in https://github.com/opnsense/core/pull/10174 2026-10-06 09:54:49 +02:00
Ad Schellevis 89a74ce83f VPN: OpenVPN: Instances - default keepalive to 10 60 in server mode and explain in the help text. closes https://github.com/opnsense/core/pull/10174 2026-10-06 09:42:38 +02:00
Franco Fichtner 1a9e4794a0 src: style sweep 2026-10-06 09:09:56 +02:00
Franco Fichtner ff90e9c9ec system: refactor route deletion and use priv-sep in general settings page #9352 (#10962) 2026-10-06 09:01:13 +02:00
Franco Fichtner 63c8df0337 system: make "noroot" the standard option with 27.1 #9352
As discussed internally, we want to aim for this to be the new standard,
but we will not migrate any existing setups just yet.  This may need more
documentation/annotation for components (mostly legacy plugins) where this
won't work, but it's a very good start to root these out via user reports.
2026-10-06 08:46:40 +02:00
ExpRam 8148bec9cf interfaces: remove stale VIP address after update (#10883) 2026-10-06 08:45:17 +02:00
Franco Fichtner 609cc79992 mvc: also fix overrides of reconfigureForceRestart() regarding return type 2026-10-06 08:37:27 +02:00
Ad Schellevis 859c529186 Firewall: NAT: Destination NAT - fix destination for no-rdr rules, related to https://github.com/opnsense/core/pull/10945
Reported by: @fa1k3
2026-10-05 18:30:15 +02:00
Ad Schellevis 2320a83064 lockout: type safety fix. 2026-10-05 18:06:56 +02:00
Franco Fichtner 7a4294f20f interfaces: add proper local/remote IP support to PPPoE IPCP; closes #10966
I added the remotenet field specifically so that we can do a remote IP /32
selection for people with HA issues getting the wrong gateway from the ISP.
2026-10-05 17:20:47 +02:00
IvanTheGeek 681a0fd644 monit: log from the first line, reconfigure through the base class
The local reconfigureAction() only started or reloaded monit when the
whole output of "monit -t" was exactly "Control file syntax OK", so the
first Apply on a new install ("New Monit id: ...") and any deprecation
warning left monit stopped or not reloaded while reporting "ok".

Drop it, and checkAction(), in favor of ApiMutableServiceControllerBase.
Move "set log" to the top of monitrc: monit only logs a parse error
after it has parsed "set log", so an invalid control file now leaves
its reason in the monit log, whether rc refused the reload or monit
refused to start.

Fixes https://github.com/opnsense/core/issues/10928
2026-10-05 11:34:59 +02:00
Ad Schellevis 196cb9ab84 Config: missing chown in backup call to prevent backend processes leaving unaccessible files for the frontend. closes https://github.com/opnsense/core/pull/10963 2026-10-04 15:22:58 +02:00
Franco Fichtner 92974f0802 mvc: trailing commas are cool so let's keep them 2026-10-03 15:32:49 +02:00
Franco Fichtner ebed60e243 mvc: PortField: always return a string for normalizedPort() 2026-10-03 15:18:53 +02:00
Franco Fichtner 0405ed0f2e mvc: do not force strict compare on any 2026-10-03 15:10:49 +02:00
Franco Fichtner 7647838324 system: reword previous 2026-10-03 15:05:20 +02:00
Greelan a57f3cc39b diagnostics: disable nginx reverse proxy buffering on configd streams (#10818)
* Disable buffering for all streams
2026-10-03 08:59:49 +02:00
Franco Fichtner 6c03b3170d make: sorting found files makes more sense 2026-10-03 07:38:15 +02:00
Greelan 6cedecf83c system: tighten language 2026-10-03 07:29:01 +02:00
Franco Fichtner fa31068e35 interfaces: clean up after previous 2026-10-01 21:16:35 +02:00
Franco Fichtner ea58b68b8e interfaces: be more conservative with -no_dad #10951
In e0e1401f87 we're enabling it always which also affects
assigned tunnels such as WireGuard which tend to avoid wanting
DAD so make room for leaving the flag unchanged and change it
everywhere else explicitly per type.
2026-10-01 21:06:25 +02:00
Franco Fichtner 256d2784d4 interfaces: spurious return statement in interfaces_wlan_configure() 2026-10-01 13:31:50 +02:00
Ad Schellevis f770a88b11 Firewall: NAT: Destination NAT - minor cleanup in previous preventing int's causing deprecation warnings in development mode 2026-10-01 11:32:48 +02:00
Ad Schellevis 9da4d852a7 Firewall: NAT: Destination NAT - add safety guards for calculated port ranges, closes https://github.com/opnsense/core/pull/10945
Minor cleanup ensuring proper handling of ranges for empty targets.

Reported by: @fa1k3
2026-10-01 11:22:00 +02:00
Franco Fichtner c3100684f8 interfaces: add a new 'updateip' hook
'newwanip' is misused sometimes and never called in static configurations.
The only consumer is the RFC2136 plugin but maybe that changes in the
future.  The plugin also listens on "bootup" and "local" so simply making
a global event for use at the spots where it exists is enough.
2026-10-01 11:06:23 +02:00
Ad Schellevis 57bc18fec9 Firewall: NAT: Destination NAT - add safety guards for calculated port ranges, closes https://github.com/opnsense/core/pull/10945
As normalizedPort() is only used to pass values in nat rules, it's more consistent to replace 'any' with empty as that's what the firewall parser would also do.
Next we need to make sure only numeric values are being used in calculations and the upper bound [65535] is respected in all cases.
2026-10-01 11:05:39 +02:00
fa1k3 a37badb156 MVC: PortField - keep the first well-known service in the option list (#10947) 2026-10-01 10:23:08 +02:00
Franco Fichtner 397ee8a9b2 make: repair full file matching introduced a while back 2026-10-01 09:53:31 +02:00
Franco Fichtner d7d7076afe mvc: dispatch failed message during reconfiguredAction()
We lose the stop result in start/reload case but it's not
missing critical.

Suggested by: @Monviech
2026-09-30 15:29:40 +02:00
Monviech debc632f12 ui: do not add the spinner again when it fails 2026-09-30 15:27:59 +02:00