OPNSense

Recent Commits

• Ad Schellevis(23 Oct 26)

  System: Routes: Configuration - initial work on collecting the expected routes based on our configuration, for https://github.com/opnsense/core/issues/10569 This should partly replace exiting dpinger calls as we need the same information here, for now we migrate what we need so we can refactor system_routing_configure() later when our strategy is complete. The basic idea is to gather the set we plan to update and compare all with the existing routing table, so we can easily drop the ones we don't need and add the ones that we miss. Initially its not the intention to offer multiple active default routes via gateways, but eventually we could consider hooking monitors to static routes as well. Historically, considering a route is singular, it kind of made sense to have defaults managed via "gateways", but when multiple could exist at the same time, the route configuration might have been a more logical spot. (work in progress)

• Franco Fichtner(23 Oct 26)

  pkg: fix plist

• Stephan de Wit(23 Oct 26)

  Reporting: Health: Improve graph metadata and formatting (#11038) Add improved metadata types in the xml definitions, adjust front-end as needed. Also add a "logarithmic" checkbox. Port this behavior to the health graph widget(s) as well.

• Stephan de Wit(23 Oct 26)

  dashboard: lint endpoints from included widget sources (#11076)

• Franco Fichtner(23 Oct 26)

  mvc: style sweep

• Franco Fichtner(23 Oct 26)

  mvc: style sweep

• Franco Fichtner(23 Oct 26)

  mvc: style sweep

• Stephan de Wit(23 Oct 26)

  ipsec: refactor sessions page and retain phase 1 grid selection on tunnel start/stop

• Ad Schellevis(21 Oct 26)

  Firewall: Rules - fix query performance issue caused by earlier commit (#11061) * Firewall: Rules - fix query performance issue caused by https://github.com/opnsense/core/commit/18533b4c60c27253f8c2ebbdfd9bc11d6450da1d Always showing automatic rules has quite some performance impact, since we need to initialize the plugin system, we can't really speedup that part of the process. This commit changes the view to show the currently active rules instead of calculating how it would look like after apply, in order to reach that state, we flush the non-mvc rules to /tmp/rules_internal.json which the list_non_mvc_rules.php can use to render the automatic (and legacy) rules quickly. * Firewall: Rules - minor change in previous, move writing metadata to after successful apply * pass origin into two other spots, remove cache_ttl as the work has already been done --------- Co-authored-by: Monviech <[email protected]>

• Ad Schellevis(21 Oct 26)

  trust: fix typo presenting qrong filename for https://github.com/opnsense/core/issues/11062

• Ad Schellevis(20 Oct 26)

  trust: fix handling of untrust dir, closes https://github.com/opnsense/core/issues/11062

• Ad Schellevis(20 Oct 26)

  System: Routes: Configuration - add StaticRoute::installedRoutes to collect relevant routes for https://github.com/opnsense/core/issues/10569 Extracted "normalized" routes from our current routing table, ignoring link routes (work in progress)

• Ad Schellevis(20 Oct 26)

  mvc:model - ModelRelationField safeguard mdlStructure in case setModel() wasn't executed.

• Ad Schellevis(20 Oct 26)

  mvc:model - optimize OptionField, deduplicate equal setters

• Monviech(20 Oct 26)

  firewall: Increment the sequence when cloning a rule, Ref: https://github.com/opnsense/core/issues/10530

• Ad Schellevis(20 Oct 26)

  mvc:model - revert part of https://github.com/opnsense/core/commit/54aa99b2d0fda5ea836724f17963d04ba7e6a061 as later commits remove the need for it

• Ad Schellevis(19 Oct 26)

  Firewall: Aliases - squeeze some extra performance out of the dynamic captive portal aliases, the getConfigNode() works but still costs a bit more than I'm willing to spend. The downside from direct config access is that we need to keep track locations in multiple spots, but since it's highly unlikely these locations will change, it's probably better to save some cpu cycles.

• Ad Schellevis(19 Oct 26)

  Firewall: Aliases - fix performance regression introduced in https://github.com/opnsense/core/pull/8368 The captive portal model is quite expensive to construct and for our aliases we only require the data underneath. This commit organizes a couple of things, first implement an easier handle to load a random model from disk to test: ``` Config::getInstance()->forceReload('/path/to/test/config.xml'); $before = memory_get_usage(); $start = hrtime(true); $mdl = new \OPNsense\Firewall\Alias(true); printf( "Alias: %.2f ms, retained PHP memory: %.2f MiB\n", (hrtime(true) - $start) / 1e6, (memory_get_usage() - $before) / 1048576 ); ``` Next we need a uniform way to point to the config section of a model without instantiating it ( getConfigNode() ) Finally we refactor the CaptivePortalAliases class to traverse the simplexml tree instead of the model.

• Monviech(19 Oct 26)

  Services: Kea DHCPv6: Add setup.sh that creates /var/log/kea so kea_prefix_watcher.py doesn't fail to daemonize on RAM disks during boot (#11053)

• Stephan de Wit(19 Oct 26)

  unbound: CSV import for overrides and aliases. Closes https://github.com/opnsense/core/issues/8354 Since we added the "quick" alias add/delete options from the overrides, the data layout has been made flat enough to do this in bulk.

• Ad Schellevis(19 Oct 26)

  System: Configuration: Backups - trapp errors in remote_backup.php similar to how diag_backup.php handles them. closes https://github.com/opnsense/core/issues/11054

• Stephan de Wit(19 Oct 26)

  dashboard: refactor widget system and introduce cloneable widget types (#11015)

• Ad Schellevis(18 Oct 26)

  configd: fix simulate_mode, instantly return from configdStream() before trying to use a socket. required for https://github.com/opnsense/ui_devtools

• Ad Schellevis(18 Oct 26)

  Services: Monit - escape password double quotes with their hex interpretation, closes https://github.com/opnsense/core/issues/11051

• Ad Schellevis(18 Oct 26)

  model:ContainerField - exclude volatile fields in isFieldChanged() Volatile fields are usually initialized during model setup, but when untouched (no setter being called), they are marked changed. Found this one by accident while looking at https://github.com/opnsense/core/issues/11048 which triggers validations for unchanged records.

• Ad Schellevis(17 Oct 26)

  System: Routes: Configuration - further refactor current static route updates for https://github.com/opnsense/core/issues/10569 This code should offer the same functionality as before, but starts with wrapping the "stashed updates" code into its own class, so we can extend that with the rest of the required logic. In order to change system_routing_configure() to accept multiple targets for a single net, we likely should have a mechanism in place comparing our expected route configuration with the one configured, isolating that inside its own class is likely much easier for future maintenance. In practice we always marked the networks touched by the UI in order to remove them before apply new ones, we call this action "claiming" now. Our primary issue is that given a running routing table, we can't really know which routes are inserted by us. Following the existing logic (which functioned for single targets), we could state that any network we manually configured (or are configuring) is ours to maintain. At some point we may consider marking our routes with RTF_PROTO2 (Bird seems to be using RTF_PROTO1) to improve the filtering a bit further, but this is easy to implement later on given the plumning we need anyway.

• Ad Schellevis(17 Oct 26)

  System: Routes: Configuration - forgot to remove the old cleanup in r.routing_configure for https://github.com/opnsense/core/issues/10569

• Ad Schellevis(17 Oct 26)

  System: Trust: Certificates - authorityInfoAccess missing in extns(), closes https://github.com/opnsense/core/issues/11046

• Ad Schellevis(17 Oct 26)

  Interfaces: Assignments - minor cleanup in "Prefix delegation size", make field required to avoid none and blank both being valid options. Since "none" was the previous default, let's keep it that way for now.

• Ad Schellevis(17 Oct 26)

  Interfaces: Assignments - ignore dhcp6-ia-pd-len when not set, closes https://github.com/opnsense/core/issues/11043