OPNSense/core 92c3096 — src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes ContainerField.php

model:ContainerField - exclude volatile fields in isFieldChanged()

Volatile fields are usually initialized during model setup, but when untouched (no setter being called), they are marked changed.

Found this one by accident while looking at https://github.com/opnsense/core/issues/11048 which triggers validations for unchanged records.
DeltaFile
+1-1src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/ContainerField.php
+1-11 files

OPNSense/core 31082fb — . plist, src/etc rc.routing_configure

System: Routes: Configuration - further refactor current static route updates for https://github.com/opnsense/core/issues/10569

This code should offer the same functionality as before, but starts with wrapping the "stashed updates" code into its own class, so we can extend that with the rest of the required logic.
In order to change system_routing_configure() to accept multiple targets for a single net, we likely should have a mechanism in place comparing our expected route configuration with the one configured, isolating that inside its own class is likely much easier for future maintenance.

In practice we always marked the networks touched by the UI in order to remove them before apply new ones, we call this action "claiming" now. Our primary issue is that given a running routing table, we can't really know which routes are inserted by us. Following the existing logic (which functioned for single targets), we could state that any network we manually configured (or are configuring) is ours to maintain.

At some point we may consider marking our routes with RTF_PROTO2 (Bird seems to be using RTF_PROTO1) to improve the filtering a bit further, but this is easy to implement later on given the plumning we need anyway.
DeltaFile
+84-0src/opnsense/mvc/app/library/OPNsense/System/StaticRoute.php
+2-20src/etc/rc.routing_configure
+4-18src/opnsense/mvc/app/controllers/OPNsense/Routes/Api/RoutesController.php
+1-0plist
+91-384 files

OPNSense/core b0da0c3 — src/etc rc.routing_configure

System: Routes: Configuration - forgot to remove the old cleanup in r.routing_configure for https://github.com/opnsense/core/issues/10569
DeltaFile
+0-8src/etc/rc.routing_configure
+0-81 files

OPNSense/core 125cc93 — src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php

System: Trust: Certificates - authorityInfoAccess missing in extns(), closes https://github.com/opnsense/core/issues/11046
DeltaFile
+4-0src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+4-01 files

OPNSense/core 5b9fc04 — src/opnsense/mvc/app/models/OPNsense/Interfaces NetworkInterface.xml

Interfaces: Assignments - minor cleanup in  "Prefix delegation size", make field required to avoid none and blank both being valid options. Since "none" was the previous default, let's keep it that way for now.
DeltaFile
+1-0src/opnsense/mvc/app/models/OPNsense/Interfaces/NetworkInterface.xml
+1-01 files

OPNSense/core b39a7a9 — src/opnsense/mvc/app/models/OPNsense/Interfaces NetworkInterface.php

Interfaces: Assignments - ignore dhcp6-ia-pd-len when not set, closes https://github.com/opnsense/core/issues/11043
DeltaFile
+1-1src/opnsense/mvc/app/models/OPNsense/Interfaces/NetworkInterface.php
+1-11 files

OPNSense/core 0669162 — src/opnsense/www/js opnsense_health.js

health: make use of byteFormat() here
DeltaFile
+2-5src/opnsense/www/js/opnsense_health.js
+2-51 files

OPNSense/core 907829d — src/opnsense/scripts/health/definitions system-mbuf.xml gateway-quality.xml, src/opnsense/www/js opnsense_health.js

health: update y-axis label based on state rather than report metadata
DeltaFile
+9-2src/opnsense/www/js/opnsense_health.js
+2-2src/opnsense/scripts/health/definitions/system-states.xml
+1-1src/opnsense/scripts/health/definitions/system-mbuf.xml
+1-1src/opnsense/scripts/health/definitions/gateway-quality.xml
+13-64 files

OPNSense/core d709224 — src/opnsense/mvc/app/views/OPNsense/Diagnostics health.volt, src/opnsense/www/js opnsense_health.js

health: default to logarithmic for some graphs, but make it optional in all cases
DeltaFile
+29-9src/opnsense/www/js/opnsense_health.js
+17-3src/opnsense/mvc/app/views/OPNsense/Diagnostics/health.volt
+46-122 files

OPNSense/core 3af5428 — src/opnsense/scripts/health/definitions interface-traffic.xml

health: proper tooltip formatter for Traffic
DeltaFile
+6-0src/opnsense/scripts/health/definitions/interface-traffic.xml
+6-01 files

OPNSense/core eb8976f — src/opnsense/scripts/health/definitions system-states.xml

health: use a logarithmic scale for states as well
DeltaFile
+32-0src/opnsense/scripts/health/definitions/system-states.xml
+32-01 files

OPNSense/core 062e352 — src/opnsense/scripts/health/definitions system-processor.xml

health: use a logarthmic chart and right-side axis for system-processor as well
DeltaFile
+20-5src/opnsense/scripts/health/definitions/system-processor.xml
+20-51 files

OPNSense/core d04084d — src/opnsense/scripts/health/definitions system-memory.xml

health: system-memory is percentage based
DeltaFile
+13-0src/opnsense/scripts/health/definitions/system-memory.xml
+13-01 files

OPNSense/core 3789c47 — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: use logarithmic mbuf reporting, separate formatting responsibilities

Let the y-axis use compact metric formatting such as 10K or 1M.
Since a tooltip should be able to contain more detailed information, allow
separation through a tooltip_formats structure.
DeltaFile
+21-7src/opnsense/www/js/opnsense_health.js
+15-0src/opnsense/scripts/health/definitions/system-mbuf.xml
+4-3src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+2-1src/opnsense/scripts/health/listReports.py
+3-0src/opnsense/scripts/health/definitions/interface-packets.xml
+45-115 files

OPNSense/core cdd7a38 — src/opnsense/mvc/app/models/OPNsense/Auth User.xml User.php, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes BaseField.php

system: fix scope change validation

Uses isDefault(), but also provides getDefault() which I think
could be of value in the future.  Easily added to a unit test
in any way.

Drop the note about /etc/passwd -- it was 2024 and we no longer
write any users to the OS.
DeltaFile
+19-1src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/BaseField.php
+2-6src/opnsense/mvc/app/models/OPNsense/Auth/User.php
+1-0src/opnsense/mvc/app/models/OPNsense/Auth/User.xml
+22-73 files

OPNSense/core 253d278 — src/opnsense/mvc/app/models/OPNsense/Auth User.php, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes BaseField.php

system: fix scope change validation

Uses isDefault(), but also provides getDefault() which I think
could be of value in the future.  Easily added to a unit test
in any way.

Drop the note about /etc/passwd -- it was 2024 and we no longer
write any users to the OS.
DeltaFile
+19-1src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/BaseField.php
+1-2src/opnsense/mvc/app/models/OPNsense/Auth/User.php
+20-32 files

OPNSense/core 5b6c5d2 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.

backported version
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+6-1src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+176-45 files

OPNSense/core 3976a2b — src/opnsense/mvc/app/models/OPNsense/Auth/FieldTypes MemberField.php, src/opnsense/mvc/app/models/OPNsense/Core ACL.php

system: multiple users with the same UID share the same groups

This would actually prevent root from logging into the web GUI
as the page lookup failed because looking for the installer user
did not yield any associated pages.

Fix MemberField as well to show all the users.
DeltaFile
+9-5src/opnsense/mvc/app/models/OPNsense/Core/ACL.php
+5-1src/opnsense/mvc/app/models/OPNsense/Auth/FieldTypes/MemberField.php
+14-62 files

OPNSense/core 433f8da — src/opnsense/mvc/app/models/OPNsense/Core ACL.php

system: multiple users with the same UID share the same groups

This would actually prevent root from logging into the web GUI
as the page lookup failed because looking for the installer user
did not yield any associated pages.
DeltaFile
+9-5src/opnsense/mvc/app/models/OPNsense/Core/ACL.php
+9-51 files

OPNSense/core c29922e — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: adjust Packets category to a metric formatter
DeltaFile
+16-3src/opnsense/www/js/opnsense_health.js
+10-6src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+3-3src/opnsense/scripts/health/listReports.py
+3-0src/opnsense/scripts/health/definitions/interface-packets.xml
+32-124 files

OPNSense/core dd9aede — src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api SystemhealthController.php, src/opnsense/scripts/health listReports.py

health: optimize quality graphs

Separate the percentages unit to a separate right-side axis, and
format the left-side axis logarithmically. Make sure the tooltips
contain the right units as well.
DeltaFile
+108-25src/opnsense/www/js/opnsense_health.js
+22-0src/opnsense/scripts/health/definitions/gateway-quality.xml
+12-2src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/SystemhealthController.php
+5-2src/opnsense/scripts/health/listReports.py
+147-294 files

OPNSense/core 9d0a3d4 — src/opnsense/mvc/app/models/OPNsense/Diagnostics Lvtemplate.xml

firewall: appease linter for live log template model

(cherry picked from commit 660c2bc028a20e0190f89a87781453d0ebd370e2)
DeltaFile
+3-1src/opnsense/mvc/app/models/OPNsense/Diagnostics/Lvtemplate.xml
+3-11 files

OPNSense/core 775c735 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+6-1src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+176-45 files

OPNSense/core 33f4a27 — src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet4.xml, src/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv4.xml KeaDhcpv4.php

Services: Kea DHCPv4: Add a simple shared_networks option to subnets

Subnets can now select an interface, subnets with the same interface will be put into a shared network.

This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.

This way, multiple subnets can be served from the same interface.
DeltaFile
+56-1src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+56-0src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+50-0src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+8-5src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
+8-2src/opnsense/scripts/kea/get_kea_leases.py
+178-85 files

OPNSense/core 3b3cbb9 — src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations M1_0_0.php

mvc: style in copyright header

(cherry picked from commit 2d6fde5a3610d3909d66838782c616c0d90d21d7)
DeltaFile
+20-22src/opnsense/mvc/app/models/OPNsense/Diagnostics/Migrations/M1_0_0.php
+20-221 files

OPNSense/core a5abb9c — src/opnsense/mvc/app/models/OPNsense/Interfaces NetworkInterface.xml

interfaces: blank description "None" is the default

(cherry picked from commit b742f957ed8c9a88729b9b55d28eafb0e797e295)
DeltaFile
+0-2src/opnsense/mvc/app/models/OPNsense/Interfaces/NetworkInterface.xml
+0-21 files

OPNSense/core 2101a2d — src/opnsense/mvc/app/models/OPNsense/IPsec IPsec.xml

ipsec: missing Required=Y

(cherry picked from commit c83a0d137f987bf6a90778b1a370ad975e5f6714)
DeltaFile
+1-0src/opnsense/mvc/app/models/OPNsense/IPsec/IPsec.xml
+1-01 files

OPNSense/core 2ce34f8 — . plist, src/opnsense/mvc/app/controllers/OPNsense/Monit/Api StatusController.php

monit: fetch status through configd for strict security mode (#11037)

(cherry picked from commit 188678814e05ecc90bf2befdd4db520551c072b8)
DeltaFile
+22-45src/opnsense/mvc/app/controllers/OPNsense/Monit/Api/StatusController.php
+66-0src/opnsense/scripts/monit/status.php
+6-0src/opnsense/service/conf/actions.d/actions_monit.conf
+1-0plist
+95-454 files

OPNSense/core 4232d35 — src/opnsense/mvc/app/controllers/OPNsense/Base ApiControllerBase.php, src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

mvc: avoid empty recordset searches

Ignore whitespace-only search terms and stop scanning fields once a clause matches. This avoids walking every field when the search phrase is empty.

(cherry picked from commit a49caffce607d57113e7d83f24035cdde274bf57)
DeltaFile
+2-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+2-1src/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php
+4-22 files

OPNSense/core 8e21453 — src/opnsense/mvc/app/controllers/OPNsense/Core/Api FirmwareController.php, src/opnsense/mvc/app/models/OPNsense/Core Firmware.xml

firmware: tighten validation for mirror URL

While here also use StrictTextField for all model fields and remove
FILTER_SANITIZE_URL since it does not do anything useful with the
stricter validation in place.

Reported by: Abraxas Labs

(cherry picked from commit 1cc41fc39da99d59818c789b3b561f1515126f47)
(cherry picked from commit 4c266a52253786295d9fc4fa61d8f286e8a988e6)
(cherry picked from commit ec598fd9615b37c2d27e9521749493957b6a3b7f)
DeltaFile
+8-5src/opnsense/mvc/app/models/OPNsense/Core/Firmware.xml
+2-8src/opnsense/mvc/app/controllers/OPNsense/Core/Api/FirmwareController.php
+10-132 files