net/frr: Some options are in the rc file, some in zebra. Distinguish whats still possible to be changed in general options by hiding zebra relevant options
system: curl_close() is deprecated
This has been a no-op since 8.0.0, but deprecated since 8.5.0.
(cherry picked from commit 305741f06eeba35234a86a219194c24b3e3d8f4d)
Firewall: NAT: Source NAT: Allow empty target which means interface address (#10441)
* Firewall: NAT: Source NAT: Empty target means interface address, allow it in the model and add hints, fix legacy outbound rules exporter as well
* Firewall: NAT: Source NAT: Target cannot be any, pf refuses to load that
firewall: unify group names
The defaults in GroupField are still a bit weird as we are showing them
even though their mandatory path is from *_interfaces() plugin registration.
If we need the value 10 we should make it the implicit default and also
add the default to the group interface registration (or not at all).
GroupField could read them correctly from config.xml...
PR: https://www.reddit.com/r/opnsense/comments/1ucvh2y/is_there_a_way_to_change_the_openvpn_group/
mvc: give throwReadOnly() a sibling named throwNotFullAdmin() which validates if a user has full access rights and can be treated as "provides safe input".
Although there aren't a lot of cases where user input can't be validated strictly enough, there are still one or two edge cases which offer some sort of "advanced" input which we currently wouldn't accept and are thus hard to change for historic reasons. The most prominent one is Monit, which allows local commands being executed.
throwNotFullAdmin simply raises an exception and bails before persisting changes to the configuration, which can be set on a per action or controller (internalSaveRequiresAdmin).
dns/bind: add SVCB record type to BIND record model (#5508)
Adds SVCB to the Record model OptionValues so RFC 9460/9461 SVCB records
(e.g. _dns DDR records for encrypted-DNS discovery) can be created via the
plugin GUI/API. BIND 9.18+ supports SVCB natively; the plugin validation
rejected the type before it reached named. One-line change, complements the
HTTPS record type (#5425).
