MVC:UserException - add some exception types and handle them in the base template, closes https://github.com/opnsense/core/pull/10430
Although we can debate about the http status codes (kept the standard one at 500, warning and info as 200), the idea is to add some glue for the frontend so it knows what we mean and can represent the dialog based on its type.
mvc: create runInterfaceRegistation and use it from all required spots
1. Fix the stale cache after applying new interfaces/devices in existing paths
2. Allow to call it from controllers who do not use invokeInterfaceRegistration()
Needs to be patched into Device apply/reconfigures next.
interfaces: patch runInterfaceRegistration() into device applies
Note that configure should run before registration in order to pick up
additional runtime information in the assignment list cache (if applicable).
interfaces: permit a vlan device as bridge member, resolve VLAN devices indirectly via interfaces_configure() (#10584)
* interfaces: permit a vlan device as bridge member
* interfaces: resolve VLAN devices indirectly via interfaces_configure()
This also adds device creation for parents so that we ca naturally
resolve QinQ and VLANs on bridges.
---------
Co-authored-by: Franco Fichtner <franco at opnsense.org>
mvc: create runInterfaceRegistation and use it from all required spots
1. Fix the stale cache after applying new interfaces/devices in existing paths
2. Allow to call it from controllers who do not use invokeInterfaceRegistration()
Needs to be patched into Device apply/reconfigures next.
interfaces: resolve VLAN devices indirectly via interfaces_configure()
This also adds device creation for parents so that we ca naturally
resolve QinQ and VLANs on bridges.
firewall: pluginify filter_core_get_default_nat_outbound_networks() #10539
Bring a bit of structure into this legacy code: move the "plugin"
parts to its own "oubound_net" run target, collect it with the new
filter_auto_source_nat() and just iterate over it from the code
that needs this. We do all of this to provide a possible configd
target to expose the actual automatic rules skeleton to the MVC
source NAT GUI.
# pluginctl -r outbound_nat
{
"pf": {
"wan": {
"lan": "LAN networks",
"lo0": "Loopback networks",
"127.0.0.0/8": "127.0.0.0/8"
}
}
}
interfaces: defer vlan creation when dependant on bridge till after the bridge exists. This needs two separate vlan configuration runs to keep the old boot order unchanged.
safeguard some write operations with missing throwReadOnly() actions for custom actions.
PR: GHSA-vw8q-pqq7-2q7v
(cherry picked from commit f580358f9cf8219d3b4eb26262e5c1b3eaa4468d)
openvpn: client export can export private keys for unlisted certificate references
We extend getCertificate() a bit to include our own internal key, so we can match
that easily and throw an exception when the cert wasn't shown in the list. By no
means should one offer access to the export to non privileged users due to the
sensitive nature of the data and the fact that CA's might be used for mulitple
purposes (in which case all certs can be extracted here).
PR: GHSA-rw63-4hw9-p4v7
(cherry picked from commit fcf7309ae82d182b80ef26e4207030457f414301)
