firewall: pluginify filter_core_get_default_nat_outbound_networks()
With this we can collect all networks eligible for outbound/source
NAT. The issue, however, is two-fold:
1. On the one hand we need all the internal networks to NAT.
2. On the other hand we need all the external interfaces to NAT over.
The first part is relatively easy, but the second part overloads
the function output. It would probably be nicer to return a rule
structure, but that would imply moving the rules generation around
a bit, likely inside $fw and then we still have to offer it to
MVC and fix the legacy page to use the same data feed.
MVC:ui - form labels could be empty, make sure to add them to avoid warnings in forms.
spotted at Services: Unbound DNS: Query Forwarding
(cherry picked from commit 06936c6af5bfcd8e1248e478dd496b9988156f2e)
firewall: fix PHP warning when scrub yields no interfaces
While here decrease indent and safe config iteration and simplify.
(cherry picked from commit 206a646a9a32c2b68e1964de8c1ec9102810c30d)
trust: use serialNumberHex for CRL so high-bit serials aren't dropped (#10559)
CrlController::setAction() built the CRL from
openssl_x509_parse()['serialNumber'], a signed decimal that is unreliable
for serials with the high bit set (first byte >= 0x80). Those serials were
passed to phpseclib as an invalid/zero value and collapsed into a single
"Serial Number: 00" entry, so the affected certificates were effectively
not revoked (e.g. OpenVPN clients could still connect). With random 128-bit
serials this silently affects roughly half of all revocations.
Use the canonical unsigned serialNumberHex via a phpseclib BigInteger,
matching the index.txt export already present in the same controller.
(cherry picked from commit 6223abb249661b22b05087481205a164e666e4e1)
php8.5 - fix some warnings:
[16-Jul-2026 11:51:52 Europe/Amsterdam] PHP Warning: Undefined array key "dhcphostname" in /usr/local/etc/inc/interfaces.inc on line 3330
[16-Jul-2026 11:51:52 Europe/Amsterdam] PHP Warning: Undefined array key "dhcphostname" in /usr/local/etc/inc/interfaces.inc on line 3331
[16-Jul-2026 11:51:48 Europe/Amsterdam] PHP Deprecated: Using null as an array offset is deprecated, use an empty string instead in /usr/local/opnsense/mvc/app/library/OPNsense/Firewall/ForwardRule.php on line 168
[16-Jul-2026 11:52:05 Europe/Amsterdam] PHP Deprecated: Using null as an array offset is deprecated, use an empty string instead in /usr/local/etc/rc.newwanip on line 57
[16-Jul-2026 11:51:49 Europe/Amsterdam] PHP Deprecated: Using null as an array offset is deprecated, use an empty string instead in /usr/local/etc/inc/interfaces.inc on line 2292
(cherry picked from commit 3dc1759c8fc06edf68700b23bf543c21c59d1e3d)
system: use btn styles in services widget #10553
This damps the colors a bit and auto-decides on the
text color to use. Hover will still use the previous
color. People will not like this either, but this is
entirely in the scope of the theme to make it look
nice.
(cherry picked from commit ace8f12f51e35e9bdb60b7039381dfd4158aaf73)
trust: use serialNumberHex for CRL so high-bit serials aren't dropped (#10559)
CrlController::setAction() built the CRL from
openssl_x509_parse()['serialNumber'], a signed decimal that is unreliable
for serials with the high bit set (first byte >= 0x80). Those serials were
passed to phpseclib as an invalid/zero value and collapsed into a single
"Serial Number: 00" entry, so the affected certificates were effectively
not revoked (e.g. OpenVPN clients could still connect). With random 128-bit
serials this silently affects roughly half of all revocations.
Use the canonical unsigned serialNumberHex via a phpseclib BigInteger,
matching the index.txt export already present in the same controller.
system: use btn styles in services widget #10553
This damps the colors a bit and auto-decides on the
text color to use. Hover will still use the previous
color. People will not like this either, but this is
entirely in the scope of the theme to make it look
nice.
system: compact and align dashboard style for #10553
This started with the service widget but the current style is a
bit constrained in what we can show and what not. Divider layout
changes have consequences in gauge widgets too. CSS changes
are bit too intrusive but it's impossible to move out of them
without it.
Firewall: Rules and NAT: Group invalid rules to the end of the ruleset. These rules are skipped by PF processing because they do not have a valid interface.
mvc: tab/subtab form generation align with what base_form expects, closes https://github.com/opnsense/core/issues/10535
As these are hardly used, we missed these during our testing.
While here, cleanup the code a bit further and stop using index assignments to refer to content [0],[1],..
(cherry picked from commit 14710e7751870e2b4daed920b9ef3af5604dbc62)
