net/frr: fix and complete automatic firewall rules (#5736)
* net/frr: fix and complete automatic firewall rules
Generate rules directly for every enabled routing protocol and remove the dependency on configured OSPF networks or interfaces.
* Tighten the OSPF rules a bit more
* Also guard creation of rules if frr is not enabled
net/frr: fix and complete automatic firewall rules
Generate rules directly for every enabled routing protocol and remove the dependency on configured OSPF networks or interfaces.
net/firewall-legacy: also add ACLs where possible
Menu registrations remain in core and can be deleted when the
plugin goes away. Same is true for the ACL pattern for the
page firewall_rules.php which is anchored in core because it
is being shared with the MVC framework.
security/openconnect: clean up stale tun interfaces on start (#5728)
A crashed instance leaves ocvpn0 behind, so the rename at the next
start fails and the fresh tunnel stays on tun30000 without the
ocvpn group. Destroy ocvpn0 right before the rename. A leftover
tun30000 is harmless: openconnect reopens /dev/tun30000 and reuses
it.
AI-assisted: Zed coding agent, model DeepSeek V4 Pro
www/caddy: fix authentik forward-auth Host header for #5712
Both the outpost passthrough (reverse_proxy) and forward_auth
directives sent the auth backend's own address as Host instead of
the original request's Host. authentik's shared outpost dispatches
by Host, so it could not tell which Provider/App a forward-auth
check was for and returned 404 instead of redirecting into the
login flow.
Hardcode header_up Host {http.request.host} on both directives,
unconditional of AuthToTls, since the original Host is always what
authentik needs regardless of how the auth backend itself is
reached.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
security/q-feeds-connector - add db_update action which indexes the additional feed information in sqlite, which will be executed during a regular update after fetch.
