OPNSense/core 0669162 — src/opnsense/www/js opnsense_health.js

health: make use of byteFormat() here
DeltaFile
+2-5src/opnsense/www/js/opnsense_health.js
+2-51 files

OPNSense/core 907829d — src/opnsense/scripts/health/definitions system-mbuf.xml gateway-quality.xml, src/opnsense/www/js opnsense_health.js

health: update y-axis label based on state rather than report metadata
DeltaFile
+9-2src/opnsense/www/js/opnsense_health.js
+2-2src/opnsense/scripts/health/definitions/system-states.xml
+1-1src/opnsense/scripts/health/definitions/system-mbuf.xml
+1-1src/opnsense/scripts/health/definitions/gateway-quality.xml
+13-64 files

OPNSense/core d709224 — src/opnsense/mvc/app/views/OPNsense/Diagnostics health.volt, src/opnsense/www/js opnsense_health.js

health: default to logarithmic for some graphs, but make it optional in all cases
DeltaFile
+29-9src/opnsense/www/js/opnsense_health.js
+17-3src/opnsense/mvc/app/views/OPNsense/Diagnostics/health.volt
+46-122 files

OPNSense/core 3af5428 — src/opnsense/scripts/health/definitions interface-traffic.xml

health: proper tooltip formatter for Traffic
DeltaFile
+6-0src/opnsense/scripts/health/definitions/interface-traffic.xml
+6-01 files

OPNSense/core eb8976f — src/opnsense/scripts/health/definitions system-states.xml

health: use a logarithmic scale for states as well
DeltaFile
+32-0src/opnsense/scripts/health/definitions/system-states.xml
+32-01 files

OPNSense/core 062e352 — src/opnsense/scripts/health/definitions system-processor.xml

health: use a logarthmic chart and right-side axis for system-processor as well
DeltaFile
+20-5src/opnsense/scripts/health/definitions/system-processor.xml
+20-51 files

OPNSense/core d04084d — src/opnsense/scripts/health/definitions system-memory.xml

health: system-memory is percentage based
DeltaFile
+13-0src/opnsense/scripts/health/definitions/system-memory.xml
+13-01 files

OPNSense/core 3789c47 — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: use logarithmic mbuf reporting, separate formatting responsibilities

Let the y-axis use compact metric formatting such as 10K or 1M.
Since a tooltip should be able to contain more detailed information, allow
separation through a tooltip_formats structure.
DeltaFile
+21-7src/opnsense/www/js/opnsense_health.js
+15-0src/opnsense/scripts/health/definitions/system-mbuf.xml
+4-3src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+2-1src/opnsense/scripts/health/listReports.py
+3-0src/opnsense/scripts/health/definitions/interface-packets.xml
+45-115 files

OPNSense/core cdd7a38 — src/opnsense/mvc/app/models/OPNsense/Auth User.xml User.php, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes BaseField.php

system: fix scope change validation

Uses isDefault(), but also provides getDefault() which I think
could be of value in the future.  Easily added to a unit test
in any way.

Drop the note about /etc/passwd -- it was 2024 and we no longer
write any users to the OS.
DeltaFile
+19-1src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/BaseField.php
+2-6src/opnsense/mvc/app/models/OPNsense/Auth/User.php
+1-0src/opnsense/mvc/app/models/OPNsense/Auth/User.xml
+22-73 files

OPNSense/core 253d278 — src/opnsense/mvc/app/models/OPNsense/Auth User.php, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes BaseField.php

system: fix scope change validation

Uses isDefault(), but also provides getDefault() which I think
could be of value in the future.  Easily added to a unit test
in any way.

Drop the note about /etc/passwd -- it was 2024 and we no longer
write any users to the OS.
DeltaFile
+19-1src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/BaseField.php
+1-2src/opnsense/mvc/app/models/OPNsense/Auth/User.php
+20-32 files

OPNSense/core 5b6c5d2 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.

backported version
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+6-1src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+176-45 files

OPNSense/core 3976a2b — src/opnsense/mvc/app/models/OPNsense/Auth/FieldTypes MemberField.php, src/opnsense/mvc/app/models/OPNsense/Core ACL.php

system: multiple users with the same UID share the same groups

This would actually prevent root from logging into the web GUI
as the page lookup failed because looking for the installer user
did not yield any associated pages.

Fix MemberField as well to show all the users.
DeltaFile
+9-5src/opnsense/mvc/app/models/OPNsense/Core/ACL.php
+5-1src/opnsense/mvc/app/models/OPNsense/Auth/FieldTypes/MemberField.php
+14-62 files

OPNSense/core 433f8da — src/opnsense/mvc/app/models/OPNsense/Core ACL.php

system: multiple users with the same UID share the same groups

This would actually prevent root from logging into the web GUI
as the page lookup failed because looking for the installer user
did not yield any associated pages.
DeltaFile
+9-5src/opnsense/mvc/app/models/OPNsense/Core/ACL.php
+9-51 files

OPNSense/core c29922e — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: adjust Packets category to a metric formatter
DeltaFile
+16-3src/opnsense/www/js/opnsense_health.js
+10-6src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+3-3src/opnsense/scripts/health/listReports.py
+3-0src/opnsense/scripts/health/definitions/interface-packets.xml
+32-124 files

OPNSense/core dd9aede — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: optimize quality graphs

Separate the percentages unit to a separate right-side axis, and
format the left-side axis logarithmically. Make sure the tooltips
contain the right units as well.
DeltaFile
+108-25src/opnsense/www/js/opnsense_health.js
+22-0src/opnsense/scripts/health/definitions/gateway-quality.xml
+12-2src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+5-2src/opnsense/scripts/health/listReports.py
+147-294 files

OPNSense/core 9d0a3d4 — src/opnsense/mvc/app/models/OPNsense/Diagnostics Lvtemplate.xml

firewall: appease linter for live log template model

(cherry picked from commit 660c2bc028a20e0190f89a87781453d0ebd370e2)
DeltaFile
+3-1src/opnsense/mvc/app/models/OPNsense/Diagnostics/Lvtemplate.xml
+3-11 files

OPNSense/core 775c735 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+6-1src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+176-45 files

OPNSense/core 33f4a27 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-5src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+178-85 files

OPNSense/core 3b3cbb9 — src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations M1_0_0.php

mvc: style in copyright header

(cherry picked from commit 2d6fde5a3610d3909d66838782c616c0d90d21d7)
DeltaFile
+20-22src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations/M1_0_0.php
+20-221 files

OPNSense/core a5abb9c — src/opnsense/mvc/app/models/OPNsense/Interfaces NetworkInterface.xml

interfaces: blank description "None" is the default

(cherry picked from commit b742f957ed8c9a88729b9b55d28eafb0e797e295)
DeltaFile
+0-2src/opnsense/mvc/app/models/OPNsense/Interfaces/NetworkInterface.xml
+0-21 files

OPNSense/core 2101a2d — src/opnsense/mvc/app/models/OPNsense/IPsec IPsec.xml

ipsec: missing Required=Y

(cherry picked from commit c83a0d137f987bf6a90778b1a370ad975e5f6714)
DeltaFile
+1-0src/opnsense/mvc/app/models/OPNsense/IPsec/IPsec.xml
+1-01 files

OPNSense/core 2ce34f8 — . plist, src/opnsense/mvc/app/controllers/OPNsense/Monit/Api StatusController.php

monit: fetch status through configd for strict security mode (#11037)

(cherry picked from commit 188678814e05ecc90bf2befdd4db520551c072b8)
DeltaFile
+22-45src/opnsense/mvc/app/controllers/OPNsense/Monit/Api/StatusController.php
+66-0src/opnsense/scripts/monit/status.php
+6-0src/opnsense/service/conf/actions.d/actions_monit.conf
+1-0plist
+95-454 files

OPNSense/core 4232d35 — src/opnsense/mvc/app/controllers/OPNsense/Base ApiControllerBase.php, src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

mvc: avoid empty recordset searches

Ignore whitespace-only search terms and stop scanning fields once a clause matches. This avoids walking every field when the search phrase is empty.

(cherry picked from commit a49caffce607d57113e7d83f24035cdde274bf57)
DeltaFile
+2-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+2-1src/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php
+4-22 files

OPNSense/core 8e21453 — src/opnsense/mvc/app/controllers/OPNsense/Core/Api FirmwareController.php, src/opnsense/mvc/app/models/OPNsense/Core Firmware.xml

firmware: tighten validation for mirror URL

While here also use StrictTextField for all model fields and remove
FILTER_SANITIZE_URL since it does not do anything useful with the
stricter validation in place.

Reported by: Abraxas Labs

(cherry picked from commit 1cc41fc39da99d59818c789b3b561f1515126f47)
(cherry picked from commit 4c266a52253786295d9fc4fa61d8f286e8a988e6)
(cherry picked from commit ec598fd9615b37c2d27e9521749493957b6a3b7f)
DeltaFile
+8-5src/opnsense/mvc/app/models/OPNsense/Core/Firmware.xml
+2-8src/opnsense/mvc/app/controllers/OPNsense/Core/Api/FirmwareController.php
+10-132 files

OPNSense/core 2d6fde5 — src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations M1_0_0.php

mvc: style in copyright header
DeltaFile
+20-22src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations/M1_0_0.php
+20-221 files

OPNSense/core 660c2bc — src/opnsense/mvc/app/models/OPNsense/Diagnostics Lvtemplate.xml

firewall: appease linter for live log template model
DeltaFile
+3-1src/opnsense/mvc/app/models/OPNsense/Diagnostics/Lvtemplate.xml
+3-11 files

OPNSense/core c83a0d1 — src/opnsense/mvc/app/models/OPNsense/IPsec IPsec.xml

ipsec: missing Required=Y
DeltaFile
+1-0src/opnsense/mvc/app/models/OPNsense/IPsec/IPsec.xml
+1-01 files

OPNSense/core b742f95 — src/opnsense/mvc/app/models/OPNsense/Interfaces NetworkInterface.xml

interfaces: blank description "None" is the default
DeltaFile
+0-2src/opnsense/mvc/app/models/OPNsense/Interfaces/NetworkInterface.xml
+0-21 files

OPNSense/core 43fc1ea — src/opnsense/mvc/app/models/OPNsense/Auth User.php

System: Access: Users - add small validation warning a user for scope changes including a note to explains its purpose and constraints.

(cherry picked from commit 5b9254a70fe236d010b7d4c9e4480b3b652af211)
DeltaFile
+9-0src/opnsense/mvc/app/models/OPNsense/Auth/User.php
+9-01 files

OPNSense/core 935f419 — src/etc/ssl opnsense.cnf

System: Trust: mark "X509v3 Key Usage" critical

PR: https://github.com/opnsense/core/issues/10999

(cherry picked from commit e6c5b7edf0ebf06248c5b091ee8382b83c29f0be)
(cherry picked from commit 9a9796feae52eae8c79a877a492db04172e0af3b)
DeltaFile
+3-3src/etc/ssl/opnsense.cnf
+3-31 files