service: add reusable daemon(8) supervisor
Critical services can occasionally disappear after an OOM kill, crash or
unexpected signal. This is especially disruptive when Suricata runs in
divert-to mode: if it no longer consumes and reinjects packets, most traffic
can stop until the service is restarted manually. Other vital system
services have similar, albeit rare, failure modes.
Use daemon(8) as a small, reusable safety harness for supported services. A
shared rc.subr helper starts a foreground service below daemon(8), tracks the
supervisor and child independently, forwards stop and reload operations, and
removes stale service PID files before restart attempts. Configurable retry
limits and delays prevent a permanently failing service from looping without
bounds.
Add an opt-in System: Settings: Services page and a capability directory so
only explicitly adapted services can be selected. Existing service behavior
therefore remains unchanged until supervision is enabled and the service is
restarted.
[6 lines not shown]
Firewall: Rules - fix decoration magic in searchRuleAction(), partly reverts https://github.com/opnsense/core/commit/c96610594dc770023047441d3657989f6ea9b7ad
Initial the meta fields where added in https://github.com/opnsense/core/pull/9121 because of missing tooltips, but because the $filter_funct_rs method already parsed the data, it was a convenience to place it inside the block (so we only need to loop through the set once).
Given the loop is much cheaper than the filter action added later, we better move this out of there and only return that data to the user for the output he actually receives (after filtering).
src: gettext() first, then sprintf() (#11081)
Firewall: Settings: Advanced passed the value to gettext() as a second
argument. PHP 8 rejects that with a fatal ArgumentCountError, so an
unknown syncookie or debug type ended the page instead of showing the
input error.
System: Settings: Administration formatted the certificate name into
the string before the lookup, so the message never reached the
translation template.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
System: Routes: Configuration - initial work on collecting the expected routes based on our configuration, for https://github.com/opnsense/core/issues/10569
This should partly replace exiting dpinger calls as we need the same information here, for now we migrate what we need so we can refactor system_routing_configure() later when our strategy is complete.
The basic idea is to gather the set we plan to update and compare all with the existing routing table, so we can easily drop the ones we don't need and add the ones that we miss.
Initially its not the intention to offer multiple active default routes via gateways, but eventually we could consider hooking monitors to static routes as well.
Historically, considering a route is singular, it kind of made sense to have defaults managed via "gateways", but when multiple could exist at the same time, the route configuration might have been a more logical spot.
(work in progress)
Reporting: Health: Improve graph metadata and formatting (#11038)
Add improved metadata types in the xml definitions, adjust front-end as needed. Also add a "logarithmic" checkbox. Port this behavior to the health graph widget(s) as well.
