OPNSense/core 03ac74b — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api InterfaceController.php, src/opnsense/mvc/app/views/OPNsense/Diagnostics routes.volt

System: Routes: Status - refactor configd call "interface routes list" to use libxo and add additional fields needed for ECMP, for https://github.com/opnsense/core/issues/10569

Change view to show child entries for duplicate destinations using _children property (which tabulator can use)
DeltaFile
+27-42src/opnsense/scripts/routes/show_routes.py
+37-29src/opnsense/mvc/app/views/OPNsense/Diagnostics/routes.volt
+18-5src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/InterfaceController.php
+1-1src/opnsense/service/conf/actions.d/actions_interface.conf
+83-774 files

OPNSense/core 948382f — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api InterfaceController.php, src/opnsense/scripts/routes show_routes.py

System: Configuration: Wizard - refactor configd call "interface routes list" to use libxo and add additional fields needed for ECMP, for https://github.com/opnsense/core/issues/10569
DeltaFile
+14-38src/opnsense/scripts/routes/show_routes.py
+2-2src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/InterfaceController.php
+16-402 files

OPNSense/core 3c8e843 — src/opnsense/mvc/app/models/OPNsense/Monit Monit.xml, src/opnsense/service/templates/OPNsense/Monit monitrc

Services: Monit - escape password double quotes with their hex interpretation

PR: https://github.com/opnsense/core/issues/11051

(cherry picked from commit d2b191ab08fa5284d984a2250698581064e8fa55)
(cherry picked from commit 7c90023df8688b3f61eb0ef8b6d6114763e22d35)
(cherry picked from commit ba30f977058562f6c9a74cde89ea04c77354b3fb)
DeltaFile
+3-1src/opnsense/mvc/app/models/OPNsense/Monit/Monit.xml
+1-1src/opnsense/service/templates/OPNsense/Monit/monitrc
+4-22 files

OPNSense/core 7f42fb7 — src/etc/inc/plugins.inc.d dpinger.inc, src/opnsense/mvc/app/library/OPNsense/System StaticRoute.php

src: style sweep
DeltaFile
+8-8src/opnsense/mvc/app/library/OPNsense/System/StaticRoute.php
+1-2src/etc/inc/plugins.inc.d/dpinger.inc
+9-102 files

OPNSense/core ba30f97 — src/opnsense/mvc/app/models/OPNsense/Monit Monit.xml

monit: allow spaces in password

Use is rare but not unthinkable
DeltaFile
+3-1src/opnsense/mvc/app/models/OPNsense/Monit/Monit.xml
+3-11 files

OPNSense/core b723077 — Scripts class-import.sh

Scripts: class import can also use "implements"

(cherry picked from commit 4d7866af71283145932f4fbff2ae4d3d9dda9a71)
DeltaFile
+1-0Scripts/class-import.sh
+1-01 files

OPNSense/core 4d7866a — Scripts class-import.sh

Scripts: class import can also use "implements"
DeltaFile
+1-0Scripts/class-import.sh
+1-01 files

OPNSense/core b525759 — src/opnsense/mvc/app/controllers/OPNsense/Core/forms wizard_deployment_type.xml, src/opnsense/mvc/app/models/OPNsense/Core InitialSetup.xml InitialSetup.php

System: Configuration: Wizard - add "net.route.multipath" (ECMP) option for https://github.com/opnsense/core/issues/10569
DeltaFile
+29-22src/opnsense/mvc/app/models/OPNsense/Core/InitialSetup.php
+6-0src/opnsense/mvc/app/controllers/OPNsense/Core/forms/wizard_deployment_type.xml
+1-0src/opnsense/mvc/app/models/OPNsense/Core/InitialSetup.xml
+36-223 files

OPNSense/core 9a1d036 — src/etc/inc/plugins.inc.d openssh.inc

system: style fix

(cherry picked from commit 2d6c4707fc1dc12d32f58d3000e4cb7cfd022b67)
DeltaFile
+2-1src/etc/inc/plugins.inc.d/openssh.inc
+2-11 files

OPNSense/core 2d6c470 — src/etc/inc/plugins.inc.d openssh.inc

system: style fix
DeltaFile
+2-1src/etc/inc/plugins.inc.d/openssh.inc
+2-11 files

OPNSense/core ec8d6dc — src/etc rc.routing_configure, src/etc/inc system.inc

System: Routes: Configuration - bold StaticRoute class into legacy code and plugins  for  https://github.com/opnsense/core/issues/10569 (#11104)

As a first step, it's easiest to refactor system_routing_configure() to use our new class and leave the callers alone.
We should likely double check the callers at some point too, but impact is easier to assess when the number of changes is slightly more limited.

With this change in place, you could now configure mulitple paths for the same destination.
DeltaFile
+11-113src/etc/inc/system.inc
+2-92src/etc/inc/plugins.inc.d/dpinger.inc
+4-2src/opnsense/mvc/app/library/OPNsense/System/StaticRoute.php
+0-4src/etc/rc.routing_configure
+17-2114 files

OPNSense/core 810afcd — src/opnsense/mvc/app/views/OPNsense/IPsec sessions.volt

ipsec: refactor sessions page and retain phase 1 grid selection on tunnel start/stop

(cherry picked from commit 783e1f15ec9e45fe11f7874cd281086599e4fdd6)
DeltaFile
+48-35src/opnsense/mvc/app/views/OPNsense/IPsec/sessions.volt
+48-351 files

OPNSense/core 2f987de — src/etc/rc.subr.d php

rc: handle /conf/snapshots here as well

for strict security mode, preventing an exception when adding a snapshot.

(cherry picked from commit 7058f5fc65e1e1175b1ad75f1a4495e0e90cbe7b)
DeltaFile
+1-1src/etc/rc.subr.d/php
+1-11 files

OPNSense/core 0287ace — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php, src/opnsense/mvc/app/views/OPNsense/Firewall nat_rule.volt filter_rule.volt

firewall: Add batched log commands to multi enable/disable logging for rules (#11035)

(cherry picked from commit 6fa1b5d9b080b8a715f26db2f7e65a24de50f60f)
DeltaFile
+24-0src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+24-0src/opnsense/mvc/app/views/OPNsense/Firewall/filter_rule.volt
+10-7src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+3-2src/opnsense/www/js/opnsense_bootgrid.js
+61-94 files

OPNSense/core 72e534f — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php

mvc: whitespace

(cherry picked from commit 87d91c2e6d6df811c04f40aa7f6119f30cf9df27)
DeltaFile
+0-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+0-11 files

OPNSense/core 3933010 — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api SourceNatController.php OneToOneController.php

firewall: Increment the sequence when cloning a rule, Ref: https://github.com/opnsense/core/issues/10530

(cherry picked from commit b1034efade9acfaedee95bc3e32990d21216abf0)
DeltaFile
+12-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SourceNatController.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/OneToOneController.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php
+17-56 files

OPNSense/core a4e4aa4 — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php FilterBaseController.php, src/opnsense/mvc/app/views/OPNsense/Firewall nat_rule.volt filter_rule.volt

firewall: support moving multiple rules in selection order (#11008)

Unify move-before handling in FilterBaseController so filter and NAT
controllers share the same validation and sequence allocation logic.

Accept up to 50 (current step count) comma-separated rule UUIDs, preserve their selection
order using consecutive sequence values, and only shift following rules
when the existing gap is insufficient. Keep filter moves within their
priority group.

Update the firewall rule grids to submit all selected UUIDs and display
their selection order. Add opt-in selection-order indicators and dynamic
command tooltips to UIBootgrid so the move action reflects the current
selection.

(cherry picked from commit c977efe76fa1ad5a0dd360d4c24839f6e9d08f4c)
DeltaFile
+75-34src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+2-90src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+14-28src/opnsense/mvc/app/views/OPNsense/Firewall/filter_rule.volt
+14-25src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+24-5src/opnsense/www/js/opnsense_bootgrid.js
+10-0src/opnsense/www/css/opnsense-bootgrid-layout.css
+139-1824 files not shown
+147-19010 files

OPNSense/core bf4b627 — src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogDNatRule.xml dialogSNatRule.xml

firewall: Remove advanced markers in SNAT and DNAT that were leftovers from the legacy GUIs logic

(cherry picked from commit cf8f078de523944d1b3c354ab84278ccb91345e1)
DeltaFile
+1-3src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogSNatRule.xml
+1-2src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogDNatRule.xml
+2-52 files

OPNSense/core c3246b7 — src/opnsense/mvc/app/controllers/OPNsense/IDS/Api SettingsController.php

suricata: add config locking during rule updates (#11101)

(cherry picked from commit 0eda48b05bcb7073921a9895fcc73280d2d30eef)
DeltaFile
+3-0src/opnsense/mvc/app/controllers/OPNsense/IDS/Api/SettingsController.php
+3-01 files

OPNSense/core 2076f2c — src/opnsense/mvc/app/library/OPNsense/Auth AuthenticationFactory.php

auth/AuthenticationFactory: if we know the remote address, append it to the log

(cherry picked from commit 14f8f7dd1d5f06522d60794a7beeac7adb9eca68)
(cherry picked from commit f6f676075accd0a4eb956a2ca198f3421e5b5687)
DeltaFile
+14-8src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php
+14-81 files

OPNSense/core eda87c7 — src/etc rc.routing_configure, src/etc/inc system.inc

System: Routes: Configuration - bold StaticRoute class into legacy code and plugins  for  https://github.com/opnsense/core/issues/10569

As a first step, it's easiest to refactor system_routing_configure() to use our new class and leave the callers alone.
We should likely double check the callers at some point too, but impact is easier to assess when the number of changes is slightly more limited.

With this change in place, you could now configure mulitple paths for the same destination.
DeltaFile
+11-113src/etc/inc/system.inc
+2-92src/etc/inc/plugins.inc.d/dpinger.inc
+4-2src/opnsense/mvc/app/library/OPNsense/System/StaticRoute.php
+0-4src/etc/rc.routing_configure
+17-2114 files

OPNSense/core 3d34f83 — src/opnsense/mvc/app/library/OPNsense/Auth Radius.php

Authentication/RADIUS: wrap around "time-loop" for consistency, even though the other end is responsible for preventing timing attacks

(cherry picked from commit b4af97e3d3b503d25e9673590632a46afc65a46e)
DeltaFile
+1-1src/opnsense/mvc/app/library/OPNsense/Auth/Radius.php
+1-11 files

OPNSense/core 1f623df — src/opnsense/mvc/app/library/OPNsense/Core Backend.php

configd: fix simulate_mode, instantly return from configdStream() before trying to use a socket. required for https://github.com/opnsense/ui_devtools

(cherry picked from commit 077a11ccf8819acce172214cf72625baa36712c5)
(cherry picked from commit 1062e76c0f85207de1869014f47ae0c15ae03a3f)
DeltaFile
+3-5src/opnsense/mvc/app/library/OPNsense/Core/Backend.php
+3-51 files

OPNSense/core 0844ec3 — src/opnsense/mvc/app/library/OPNsense/Firewall ForwardRule.php

Firewall: NAT: Destination NAT - cleanup some more

PR: https://github.com/opnsense/core/pull/10944

(cherry picked from commit 2174b3cbc379931909c8c71305b1aecbdfd5f5e7)
(cherry picked from commit b0504c9cf0eb121d17fb19c9e9a981a0ba2a0792)
DeltaFile
+11-12src/opnsense/mvc/app/library/OPNsense/Firewall/ForwardRule.php
+11-121 files

OPNSense/core 34c33a5 — src/opnsense/mvc/app/controllers/OPNsense/Trust/Api CaController.php CertController.php, src/opnsense/mvc/app/library/OPNsense/Trust Store.php

System: Trust - openssl_x509_parse() and friends only evaluate the first certificate found and ignores the rest, which means we should ensure only a single certificate is actually offered for certs and ca's.

PR: GHSA-7wvp-6m2q-953c

(cherry picked from commit b64be86839271b108e0c140fb53349303ddb6d5c)
(cherry picked from commit 0f641f77bc8107fa6c39b28985756403af75d548)
(cherry picked from commit fe5315d9c4302cfc55f572105e3a46f4925f8f4f)
(cherry picked from commit bde36f67c7cd37cdd36290f08850e65b38d8059d)
DeltaFile
+22-2src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CertController.php
+17-0src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CaController.php
+15-0src/opnsense/mvc/app/library/OPNsense/Trust/Store.php
+54-23 files

OPNSense/core 9557746 — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php, src/opnsense/mvc/app/library/OPNsense/Firewall Rule.php

Firewall: prefer aliases over well-known port names, closes https://github.com/opnsense/core/pull/10946

(cherry picked from commit 9ff4d818ae52ae1281cce7e5ce82c35a93f239ae)
DeltaFile
+23-17src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+2-7src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+6-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/PortField.php
+31-243 files

OPNSense/core 19ad7a8 — src/opnsense/mvc/app/models/OPNsense/Core Tunables.xml

System: Settings: Tunables - add some additional input constraints

(cherry picked from commit 5779ae80f5c5509f4e98b1126ded26feffb0b929)
DeltaFile
+4-2src/opnsense/mvc/app/models/OPNsense/Core/Tunables.xml
+4-21 files

OPNSense/core 3bbd714 — src/opnsense/mvc/app/models/OPNsense/Interfaces Wlan.xml

Interfaces: Wireless: Devices - stricten input a bit further, small cleanups for https://github.com/opnsense/core/pull/10796

(cherry picked from commit 9f1eac0f9bdf705766ab61f9d62b9d55757fd0da)
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml
+13-51 files

OPNSense/core 6842620 — src/opnsense/scripts/netflow get_timeseries.py

Reporting: Insight - require positive int values, closes https://github.com/opnsense/core/issues/11100

(cherry picked from commit 69247d0bfd6ea25242e1e9980e47d275f7c9cc0e)
DeltaFile
+10-3src/opnsense/scripts/netflow/get_timeseries.py
+10-31 files

OPNSense/core 9ccd88f — src/opnsense/scripts/suricata/lib rulecache.py

suricata: escape literal percent signs in rulecache.py query format (#11097)

(cherry picked from commit 4c8e7a62ec211222f7e10812858a129e701efacf)
DeltaFile
+1-1src/opnsense/scripts/suricata/lib/rulecache.py
+1-11 files