OPNSense

Recent Commits

• Franco Fichtner (12 Jul 26)

  firewall: invalidate rule stats cache for legacy rules page Since 5baba39831dff added the TTL but the page should fetch per inspect push this restores the old behaviour. We could move the controller to the legacy plugin so that it is not forgotten on final removal but that's not for now.

• Franco Fichtner (12 Jul 26)

  src: sweep

• Monviech (11 Jul 26)

  Firewall: Rules: Adapt getAdvancedIds() to the sectioned form structure introduced in 3d9cccfe (#10521)

• Konstantinos Spartalis (11 Jul 26)

  statistics: when interfaces disabled

• Franco Fichtner (10 Jul 26)

  interfaces: explicitly make explicit loopback network an actual loopback network PR: https://forum.opnsense.org/index.php?topic=52341.0

• Ad Schellevis (10 Jul 26)

  configd/templates - swap "strict" logic as it was reversed

• Monviech (09 Jul 26)

  Services: Kea DHCPv4/6: Switch custom DHCP option config generation to libdhcp_flex_option.so (#10514) * Services: Kea DHCPv4: emit custom DHCPv4 options via flex-option hook Route custom DHCPv4 option rows through libdhcp_flex_option instead of regular option-data. The custom option framework (KeaOptionDataField) already serializes values to final wire-format hex, but Kea's native option-data path still applies built-in option definitions and may reinterpret or drop payloads for standard or container options (e.g. 43 and 125). Use flex-option supersede expressions to inject the serialized bytes directly during response construction. Preserve the existing scoping model by translating subnet scope to an additional class, and reservation scope to either MAC address or client-id matching. Existing option match rules are kept as client-class membership checks inside the same expression. Built-in option_data fields remain unchanged and continue to use native Kea option-data generation. * Services: Kea DHCPv6: Add same flex option hook library support as in DHCPv4, with the limitation that it reservations need to be DUID based here.

• Franco Fichtner (09 Jul 26)

  firewall: revisit previous Well, apply needs to be pushed to render interfaces. Make sure that we render before reloading filter which actually calls ifgroup_setup() to rename groups.

• Franco Fichtner (09 Jul 26)

  Revert "firewall: properly render groups on apply" This reverts commit 6183fbe205f7df44fd249c8c19b554b871e4698a.

• Franco Fichtner (09 Jul 26)

  firewall: adjust alias rename according to address_to_pconfig(); closes #10024 Looking at stable/25.7 where all three components where still in the tree they all use the function which could potentially write 'address'. It's better than not having those and strive for consistency although in practice this will die with the removal of legacy rules support.

• Franco Fichtner (09 Jul 26)

  firewall: fix one-to-one part of #10024

• Franco Fichtner (09 Jul 26)

  firewall: properly render groups on apply

• Stephan de Wit (09 Jul 26)

  dashboard: include interfaces widget in dashboard default. Closes https://github.com/opnsense/core/issues/10456 This is the only one that makes sense from a functional perspective. While here, adjust the resize/style logic a bit such that updates are also propagated on first load, which makes sure the interfaces table renders the correct amount of columns to prevent wasted space.

• Franco Fichtner (09 Jul 26)

  firewall: avoid emitting reply-to on block rules as well (#10513) Remove reply-to the same way that 20070de did it for route-to.

• Monviech (09 Jul 26)

  git: create AGENTS.md with agent guidelines (#10507) Added guidelines for coding agents working on the OPNsense core repository, including mission, core principles, architecture, code style, security expectations, and review checklist.

• Franco Fichtner (09 Jul 26)

  github: add AI disclosure to issue templates As the growing conclusions on bug reports look to be AI suggestions that can make oblivious claims according to how the user steeres the scope to the core repo it's better to (try to) make this visible.

• Franco Fichtner (08 Jul 26)

  firmware: cleansing using output_cmd is futile Move the code back to where it was in early 26.1. A number of regressions could have been avoided. The last straw was buffering of "." characters for fetching. The read-guard is still effective. As it reads the file it does not need to run unbuffered. GUI reads are still properly filtered.

• Ad Schellevis (08 Jul 26)

  Firewall: NAT: Source NAT - constraint getAction to only general page and align setAction to do the same, closes https://github.com/opnsense/core/issues/10502

• Stephan de Wit (08 Jul 26)

  captive portal: adjust accounting interval to Acct-Interim-Interval (#10474) This changes the default interval to 600, which is the recommended value according to RFC 2869.

• Franco Fichtner (08 Jul 26)

  monit: fix mail-format and poll-time validation; closes #10498

• Franco Fichtner (07 Jul 26)

  contrib: Non-canonical cast (boolean) is deprecated, use the (bool) cast instead

• Franco Fichtner (07 Jul 26)

  src: two whitespace changes

• Franco Fichtner (07 Jul 26)

  wizard: annotate that gateways are cleared to prevent lingering misconfiguration #8976 The old code tried to update always based on the WAN_GW name, but there could be associated side effects, see old code for comparison: https://github.com/opnsense/core/blob/stable/25.1/src/wizard/system.xml#L603-L627

• Franco Fichtner (07 Jul 26)

  firmware: allow upgrade to 26.7-RC1

• Ad Schellevis (07 Jul 26)

  Services: Unbound DNS: Overrides - missing NetMaskAllowed=N on override address, closes https://github.com/opnsense/core/issues/10499

• Ad Schellevis (06 Jul 26)

  mvc: add file type to forms, including required javascript initialisation code. File type input serializes offered payload in base64 and returns both the field and the filename of the offered file. This easy to use wrapper can be used to upload files of reasonable size (a couple of megabytes max) via either a select file or drag and drop option. Collected output exists of the offered <id> combined with a field named <id>__name which contains the offered filename

• Franco Fichtner (06 Jul 26)

  firewall: fix reference when plugin not installed #9947 Just hint at the migration assistant. :)

• Franco Fichtner (06 Jul 26)

  ui: fix menu registration not setting "active" It's a bit complicated: we need to ignore all invisible pages. The menu registration isn't really a value that does something but it successfully hides the registration from the menu code rendering the active flag.

• Franco Fichtner (06 Jul 26)

  system: change comment to existing page

• Monviech (06 Jul 26)

  Firewall: Group: change link to new firewall rules (#10497)