unbound: blocklist improvements (#10149)
* Organizes DNSBLs by provider/category.
* Adds the Social Network blocklist by hegizi.
* The tester now gives you the DNSBL name and category instead of its shortcode.
mvc: OptionField: allow empty values in options
This falls back to the key which isn't going to be translated
since it's likely a technical term or keyword.
Also translate the $subvalue which appears to have been missed
before.
ui: improve form validation error append (#10333)
Since this iterates over a lot of irrelevant IDs and then mismatches
with the target change this by safeguarding against fields that are
likely not going to work without help_block_<id> and switch target
to a suffix match.
One spot where this matters: under kea v6 subnet add "DNS servers"
entry e.g. "::", click auto collect for check mark, click save. Interface
and subnet validation is red, the DNS server one shown is not.
ui: improve form validation error append
Since this iterates over a lot of irrelevant IDs and then mismatches
with the target change this by safeguarding against fields that are
likely not going to work without help_block_<id> and switch target
to a suffix match.
Services: Kea DHCPv6: Dynamic prefix delegation (#10252)
* Add a dynamic_prefix key to the user-context so we know which subnet6 should be enriched in a post apply hook later
* Also add dynamic_prefix to subnet6 dialog
* Add prefix source interface and resolve current prefix via Autoconf::getPrefix
* model bump not needed anymore
* Add validations that disallow users to configure subnet value, pool value and reservations for a dynamic prefix subnet. The subnet must be empty since it is auto configured, the pool is auto configured as ::1000-::2000 and seeded with initial prefix, reservations cannot be created because that would blow up as there is no concept like partial IPv6 addresses in KEA. We always want to bootstrap KEA with an initial working configuration.
* Since the prefix_source is verbatim to a subnet, we only allow its usage once per unique constraint
* Add a mvp for the dynamic pd_pool, the pool is auto generated from the largets possible prefix that does not include the IA_NA generated address pool. Validation ensures the user can only change the delegated prefix length, but not anything about the pool itself. KEA is very strict about validations, auto generation is required here to ensure the model stays sane.
* Make prefix pool validation stricter, if only a /64 prefix exists there is nothing we can do if we offer both IA_NA and IA_PD, at least /63 would be required for one IA_NA and one IA_PD pool.
* Remove config instantiation inside loops
[89 lines not shown]
Firewall: Rules [new]: Fix action, ipprotocol and protocol translations (legacy rules) (#10299)
* Firewall: Rules [new]: Fix action, ipprotocol and protocol translations. Fix Automatically generated rules category.
* Ensure translations are passed through all the way to icon formatter in view
* Ensure inet46 always shows as Any or *
* Update src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
Co-authored-by: Franco Fichtner <franco at opnsense.org>
* Update src/opnsense/scripts/filter/list_non_mvc_rules.php
Co-authored-by: Franco Fichtner <franco at opnsense.org>
---------
Co-authored-by: Franco Fichtner <franco at opnsense.org>
Captive Portal: remove redirection on HTTPS, ditch non-functional pass statement as well
In theory, clients only use HTTP to detect the presence of a portal.
If they were to use HTTPS, the 302 redirect would in most cases
not be accessible, as the certificate presented is most likely not
valid, cutting off the communication before any redirect to a login
page can happen.
The portal itself can and should remain accessible on HTTPS, as this
is the URL the redirect is pointing to. This may be attached to a
valid certificate as well, but the key point is that access to
this URL doesn't strictly need redirection for everything on port
443.
This should prevent clients opening bogus connections to the
captive portal, which consumes a lot of TLS traffic on the network
stack, bogging down lighttpd in bigger setups and creating
a lot of established states in pf.
[2 lines not shown]
