BSD Commit Log Search

Firewall: NAT: Source NAT: add pool options and source hash key (#10815)

rc: add watchdog to shutdown, reboot and reload_all cases (#10813)

This will prevent shutdown/reboot actions from getting stuck indefinitely if a process misbehaves by ignoring the term signal. The timeout is set to 30 seconds and relies on the rc status call to provide a valid pid to determine if a process is stuck.

rc: keep this as it was

rc: remove equality check, current_pid can be anything

Use values consistently

rc: log timeout case as well

Can be visible in grid

Firewall: NAT: Source NAT: add source hash key

Firewall: NAT: Source NAT: add pool options

rc: simplify further, switch to 30 seconds

rc: simplify by backgrounding watchdog first

Add comment about set tos behavior

ui: improve form matching for help/advanced

PR: https://forum.opnsense.org/index.php?topic=52828.0
(cherry picked from commit a4629593ee5c4c47649d2d82089ad161eda577ee)

ui: Fix _showMaximized() height calculation when mobile navigation triggers below 768px width

(cherry picked from commit a410dc4dde12de28918338ca3efe987124e42386)

system: normalize output if gateways aren't provided. Closes https://github.com/opnsense/core/issues/10800

(cherry picked from commit 3fc11b2451d6bd258eb165cd41781a3ad7d5f249)

interfaces: batch VIP post-reload for proxyarp/pfsync #10810

(cherry picked from commit 689b926d5b8960d0de9a5dbaba4cdaed4f8de153)

interfaces: prevent inline reloads of VLANs via rc.linkup #10810

Since the reload destroys and recreates the VLAN and this code
could not be triggered before provide a programmatic approach
via a reload flag in the device registration code.

  Notice        kernel   <6>[186] vlan3: changing name to 'igc0_vlan26'
  Notice        opnsense         /usr/local/etc/rc.linkup: ROUTING: entering configure using opt5
  Warning       rtsold   <rtsock_input_ifannounce> interface vlan3 removed
  Warning       rtsold   <rtsock_input_ifannounce> interface igc0_vlan26 removed
  Notice        opnsense         /usr/local/etc/rc.linkup: Device igc0_vlan26 requires reload for opt5, configuring now
  Notice        opnsense         /usr/local/etc/rc.linkup: DEVD: Ethernet attached event for opt5(igc0_vlan26)

(cherry picked from commit c2453458083d3e0e7915e42dad669a07278022be)

monit: use LIBXML_NOCDATA on xml fetch. Closes https://github.com/opnsense/core/issues/10808

(cherry picked from commit d678d9d4c36691b13deb769dd97b3939ac99086f)

text-success is better for the match action

rc: stop_result not used anymore

system: normalize output if gateways aren't provided. Closes https://github.com/opnsense/core/issues/10800

interfaces: batch VIP post-reload for proxyarp/pfsync #10810

ui: Fix _showMaximized() height calculation when mobile navigation triggers below 768px width

interfaces: revert passing $all_devices for now

This is so that the next patch can be backported cleanly.

rc: add watchdog to shutdown, reboot and reload_all cases

interfaces: prevent inline reloads of VLANs via rc.linkup #10810

Since the reload destroys and recreates the VLAN and this code
could not be triggered before provide a programmatic approach
via a reload flag in the device registration code.

  Notice        kernel   <6>[186] vlan3: changing name to 'igc0_vlan26'
  Notice        opnsense         /usr/local/etc/rc.linkup: ROUTING: entering configure using opt5
  Warning       rtsold   <rtsock_input_ifannounce> interface vlan3 removed
  Warning       rtsold   <rtsock_input_ifannounce> interface igc0_vlan26 removed
  Notice        opnsense         /usr/local/etc/rc.linkup: Device igc0_vlan26 requires reload for opt5, configuring now
  Notice        opnsense         /usr/local/etc/rc.linkup: DEVD: Ethernet attached event for opt5(igc0_vlan26)

Firewall: Rules: Reuse state option validation fields

Use one shared state field list for match rules and rules configured without state, keeping both validation paths consistent.

Firewall: Rules: Add missing formatter to the checkboxes

Firewall: Rules: Mark normalization options as advanced

Keep the normalization section and its scrub controls out of the default rule dialog while retaining them in the shared advanced settings view.

Firewall: Rules: Switch global scrubbing to modern PF syntax

As a second stage, emit fragment reassembly as a global option and generate random-ID and interface MSS handling as match scrub rules after NAT. Legacy custom scrub rules remain untouched and no compatibility mode or automatic transition is introduced.

Move the global normalization controls to Firewall Advanced while preserving their existing configuration locations.