interfaces: settings: convert to MVC

plist

@@ -379,6 +379,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/LoopbackSettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/NeighborSettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/OverviewController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/SettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/VipSettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/VlanSettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/VxlanSettingsController.php
@@ -389,6 +390,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/LoopbackController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/NeighborController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/OverviewController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/SettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/VipController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/VlanController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/VxlanController.php
@@ -398,6 +400,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogLagg.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogLoopback.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogNeighbor.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogSettings.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVip.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVlan.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVxlan.xml
@@ -801,6 +804,7 @@
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Bridge.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Bridge.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/BridgeMemberField.php
+/usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/DUIDField.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/LaggInterfaceField.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/LinkAddressField.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/NeighborField.php
@@ -817,9 +821,12 @@
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Loopback.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Loopback.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Menu/Menu.xml
+/usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Migrations/M1_0_0.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Neighbor.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Neighbor.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Neighbor/dhcpd.php
+/usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Settings.php
+/usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Settings.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Vip.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Vip.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Interfaces/Vlan.php
@@ -983,6 +990,7 @@
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/loopback.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/neighbor.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/overview.volt
+/usr/local/opnsense/mvc/app/views/OPNsense/Interface/settings.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vip.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vlan.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vxlan.volt
@@ -1233,6 +1241,7 @@
 /usr/local/opnsense/scripts/interfaces/carp_global_status.php
 /usr/local/opnsense/scripts/interfaces/carp_set_status.php
 /usr/local/opnsense/scripts/interfaces/dhclient-script
+/usr/local/opnsense/scripts/interfaces/gen_duid.php
 /usr/local/opnsense/scripts/interfaces/ifctl.sh
 /usr/local/opnsense/scripts/interfaces/lib/__init__.py
 /usr/local/opnsense/scripts/interfaces/list_arp.py
@@ -1254,6 +1263,7 @@
 /usr/local/opnsense/scripts/interfaces/reconfigure_gres.php
 /usr/local/opnsense/scripts/interfaces/reconfigure_laggs.php
 /usr/local/opnsense/scripts/interfaces/reconfigure_neighbors.php
+/usr/local/opnsense/scripts/interfaces/reconfigure_settings.php
 /usr/local/opnsense/scripts/interfaces/reconfigure_vips.php
 /usr/local/opnsense/scripts/interfaces/reconfigure_vlans.php
 /usr/local/opnsense/scripts/interfaces/rtsold_resolvconf.sh

src/etc/inc/filter.inc

@@ -43,7 +43,7 @@ function is_bogonsv6_used()
      */
     $usebogonsv6 = false;
 
-    if (isset($config['system']['ipv6allow']) && isset($config['interfaces'])) {
+    if (!empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']) && isset($config['interfaces'])) {
         foreach ($config['interfaces'] as $ifacedata) {
             if (isset($ifacedata['enable']) && isset($ifacedata['blockbogons'])) {
                 $usebogonsv6 = true;

src/etc/inc/filter.lib.inc

@@ -206,15 +206,15 @@ function filter_core_rules_system($fw, $defaults)
 {
     global $config;
 
-    $ipv6_disabled = !isset($config['system']['ipv6allow']);
+    $ipv6_disabled = empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']);
 
     $dhcrelay6_interfaces = plugins_run('dhcrelay_interfaces', ['inet6']);
     $dhcrelay6_interfaces = !empty($dhcrelay6_interfaces['dhcrelay']) ? $dhcrelay6_interfaces['dhcrelay'] : [];
 
     $fw->registerFilterRule(
         1,
         ['ipprotocol' => 'inet6','descr' => 'Block all IPv6', 'disabled' => !$ipv6_disabled,
-            '#ref' => 'system_advanced_network.php#ipv6allow'],
+            '#ref' => 'ui/interfaces/settings'],
         $defaults['block']
     );
 
@@ -376,7 +376,7 @@ function filter_core_rules_system($fw, $defaults)
         if (!$ipv6_disabled && in_array($intfinfo['ipaddrv6'], ['dhcp6', 'slaac'])) {
             $fw->registerFilterRule(1, [
                 'descr' => 'allow dhcpv6 client in ' . $intfinfo['descr'],
-                '#ref' => 'system_advanced_network.php#ipv6allow',
+                '#ref' => 'ui/interfaces/settings',
                 'interface' => $intf,
                 'protocol' => 'udp',
                 /* omit 'from' as the server may use a GUA instead */
@@ -386,7 +386,7 @@ function filter_core_rules_system($fw, $defaults)
             ], $defaults['pass']);
             $dhcpv6_opts = [
                 'descr' => 'allow dhcpv6 client out ' . $intfinfo['descr'],
-                '#ref' => 'system_advanced_network.php#ipv6allow',
+                '#ref' => 'ui/interfaces/settings',
                 'direction' => 'out',
                 'interface' => $intf,
                 'protocol' => 'udp',

src/etc/inc/interfaces.inc

@@ -2422,7 +2422,7 @@ function interface_configure($verbose = false, $interface = 'wan', $reload = fal
     /* we do not set "ifdisabled" to avoid clobbering assigned tunnel devices */
     mwexecf('/sbin/ifconfig %s inet6 -accept_rtadv -no_dad description %s up', [$device, $ifdescr]);
 
-    switch (isset($config['system']['ipv6allow']) ? ($wancfg['ipaddrv6'] ?? 'none') : 'none') {
+    switch (!empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']) ? ($wancfg['ipaddrv6'] ?? 'none') : 'none') {
         case 'slaac':
         case 'dhcp6':
             mwexecf('/sbin/ifconfig %s inet6 accept_rtadv -ifdisabled up', $device);
@@ -2770,10 +2770,11 @@ function interface_6to4_configure($interface, $wancfg, $update = false)
 function interface_dhcpv6_configure($interface, $wancfg)
 {
     $syscfg = config_read_array('system');
+    $hwsettings = config_read_array('OPNsense', 'Interfaces', 'settings');
 
     /* write DUID if override was set */
-    if (!empty($syscfg['ipv6duid'])) {
-        dhcp6c_duid_write($syscfg['ipv6duid']);
+    if (!empty($hwsettings['ipv6duid'])) {
+        dhcp6c_duid_write($hwsettings['ipv6duid']);
     /* clear DUID if it is faulty */
     } elseif (empty(dhcp6c_duid_read())) {
         dhcp6c_duid_clear();
@@ -2794,9 +2795,10 @@ function interface_dhcpv6_configure($interface, $wancfg)
         '/usr/local/opnsense/scripts/interfaces/rtsold_resolvconf.sh',
     ];
 
-    if (!empty($syscfg['dhcp6_debug'])) {
+    $dhcp6_debug = config_read_array('OPNsense', 'Interfaces', 'settings')['dhcp6_debug'];
+    if (!empty($dhcp6_debug)) {
         $mode = [ '1' => '-d', '2' => '-D' ];
-        $rtsold_frmt[] = $mode[$syscfg['dhcp6_debug']];
+        $rtsold_frmt[] = $mode[$dhcp6_debug];
     }
 
     /* fire up rtsold for IPv6 RAs first */
@@ -2807,7 +2809,7 @@ function interface_dhcpv6_configure($interface, $wancfg)
      * advertisements after timeout which can be necessary.
      * Can be adjusted to fit ISP timing or completely disabled.
      */
-    if (!empty($syscfg['dhcp6_ratimeout'] ?? '10')) {
+    if (!empty($hwsettings['dhcp6_ratimeout'] ?? '10')) {
         mwexecfb('/var/etc/rtsold_script.sh %s', [$wancfg['if']]);
     }
 }
@@ -2842,6 +2844,7 @@ function interface_dhcpv6_prepare($interface, $wancfg, $cleanup = false)
 
     $id = interface_dhcpv6_id($interface);
     $syscfg = config_read_array('system');
+    $hwsettings = config_read_array('OPNsense', 'Interfaces', 'settings');
     $device = $wancfg['if'];
 
     if (!empty($wancfg['adv_dhcp6_config_file_override'])) {
@@ -2925,17 +2928,19 @@ EOF;
             '/var/run/dhcp6c.pid',
     ]);
 
-    if (!empty($syscfg['dhcp6_debug'])) {
+    $hwsettings = config_read_array('OPNsense', 'Interfaces', 'settings');
+
+    if (!empty($hwsettings['dhcp6_debug'])) {
         $mode = [ '1' => ' -d', '2' => ' -D' ];
-        $dhcp6ccommand .= $mode[$syscfg['dhcp6_debug']];
+        $dhcp6ccommand .= $mode[$hwsettings['dhcp6_debug']];
     }
 
-    if (!empty($syscfg['dhcp6_norelease'])) {
+    if (!empty($hwsettings['dhcp6_norelease'])) {
         $dhcp6ccommand .= ' -n';
     }
 
-    /* XXX does not exist yet: integer in seconds from 0 to n, 0 actually disables it */
-    $ratimeout = $syscfg['dhcp6_ratimeout'] ?? '10';
+    /* integer in seconds from 0 to n, 0 actually disables it */
+    $ratimeout = $hwsettings['dhcp6_ratimeout'] ?? '10';
 
     $dhcp6cconf = '';
 

src/etc/inc/interfaces.lib.inc

@@ -562,7 +562,7 @@ function configure_interface_hardware($ifs, $intf_details = null)
 {
     global $config;
 
-    $hwsettings = $config['system'];
+    $hwsettings = $config['OPNsense']['Interfaces']['settings'];
 
     /* XXX this needs fixing, lots of devices are not capable */
     if (
@@ -584,7 +584,11 @@ function configure_interface_hardware($ifs, $intf_details = null)
     foreach ($config['interfaces'] as $iface => $ifconf) {
         if (!empty($ifconf['if']) && $ifconf['if'] == $ifs) {
             if (!empty($ifconf['hw_settings_overwrite'])) {
-                $hwsettings = $ifconf;
+                foreach ($ifconf as $key => $value) {
+                    if (isset($hwsettings[$key])) {
+                        $hwsettings[$key] = $value;
+                    }
+                }
             }
             break;
         }
@@ -598,33 +602,33 @@ function configure_interface_hardware($ifs, $intf_details = null)
         $lro_set = in_array('lro', $intf_details['options']);
 
         // hardware checksum offloading offloading
-        if (isset($hwsettings['disablechecksumoffloading']) && $csum_set) {
+        if (!empty($hwsettings['disablechecksumoffloading']) && $csum_set) {
             legacy_interface_flags($ifs, '-txcsum -rxcsum', false);
-        } elseif (!isset($hwsettings['disablechecksumoffloading']) && !$csum_set) {
+        } elseif (empty($hwsettings['disablechecksumoffloading']) && !$csum_set) {
             legacy_interface_flags($ifs, 'txcsum rxcsum', false);
         }
-        if (isset($hwsettings['disablechecksumoffloading']) && $csumv6_set) {
+        if (!empty($hwsettings['disablechecksumoffloading']) && $csumv6_set) {
             legacy_interface_flags($ifs, '-txcsum6 -rxcsum6', false);
-        } elseif (!isset($hwsettings['disablechecksumoffloading']) && !$csumv6_set) {
+        } elseif (empty($hwsettings['disablechecksumoffloading']) && !$csumv6_set) {
             legacy_interface_flags($ifs, 'txcsum6 rxcsum6', false);
         }
 
         // TCP segmentation offloading
-        if (isset($hwsettings['disablesegmentationoffloading']) && $tso_set) {
+        if (!empty($hwsettings['disablesegmentationoffloading']) && $tso_set) {
             legacy_interface_flags($ifs, '-tso', false);
-        } elseif (!isset($hwsettings['disablesegmentationoffloading']) && !$tso_set) {
+        } elseif (empty($hwsettings['disablesegmentationoffloading']) && !$tso_set) {
             legacy_interface_flags($ifs, 'tso', false);
         }
 
         // large receive offload
-        if (isset($hwsettings['disablelargereceiveoffloading']) && $lro_set) {
+        if (!empty($hwsettings['disablelargereceiveoffloading']) && $lro_set) {
             legacy_interface_flags($ifs, '-lro', false);
-        } elseif (!isset($hwsettings['disablelargereceiveoffloading']) && !$lro_set) {
+        } elseif (empty($hwsettings['disablelargereceiveoffloading']) && !$lro_set) {
             legacy_interface_flags($ifs, 'lro', false);
         }
 
         // disable/enable hardware VLAN tags, will be skipped when "Leave default" (option 2) is selected
-        if (!isset($hwsettings['disablevlanhwfilter']) || $hwsettings['disablevlanhwfilter'] == 1) {
+        if ($hwsettings['disablevlanhwfilter'] != 2) {
             // probe already selected options
             $selected_opts = [];
             foreach ($intf_details['options'] as $opt) {
@@ -636,9 +640,9 @@ function configure_interface_hardware($ifs, $intf_details = null)
             }
             // set one tag at a time to avoid driver issues
             foreach (array('vlanhwtag', 'vlanhwfilter', 'vlanhwtso', 'vlanhwcsum') as $tag) {
-                if (!isset($hwsettings['disablevlanhwfilter']) && !in_array($tag, $selected_opts)) {
+                if (empty($hwsettings['disablevlanhwfilter']) && !in_array($tag, $selected_opts)) {
                     legacy_interface_flags($ifs, $tag);
-                } elseif (isset($hwsettings['disablevlanhwfilter']) && in_array($tag, $selected_opts)) {
+                } elseif (!empty($hwsettings['disablevlanhwfilter']) && in_array($tag, $selected_opts)) {
                     legacy_interface_flags($ifs, '-' . $tag);
                 }
             }

src/etc/inc/plugins.inc.d/unbound.inc

@@ -285,7 +285,7 @@ function unbound_generate_config()
     $port = $general['port'];
 
     /* do not touch prefer-ip6 as it is defaulting to 'no' anyway */
-    $do_ip6 = isset($config['system']['ipv6allow']) ? 'yes' : 'no';
+    $do_ip6 = !empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']) ? 'yes' : 'no';
 
     if (!empty($general['regdhcp'])) {
         $include_dhcpleases = 'include: /var/unbound/dhcpleases.conf';

src/etc/inc/system.inc

@@ -117,14 +117,14 @@ function system_sysctl_defaults()
         'net.inet6.ip6.log_cannot_forward' => [ 'default' => '0' ],
         'net.inet6.ip6.prefer_tempaddr' => [ 'default' => '0' ],
         'net.inet6.ip6.redirect' => [ 'default' => '0' ],
-        'net.inet6.ip6.rfc6204w3' => [ 'default' => isset($config['system']['ipv6allow']) ? '1' : '0' ],
+        'net.inet6.ip6.rfc6204w3' => [ 'default' => !empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']) ? '1' : '0' ],
         'net.inet6.ip6.use_tempaddr' => [ 'default' => '0' ],
         'net.link.bridge.pfil_bridge' => [ 'default' => '0' ],
         'net.link.bridge.pfil_local_phys' => [ 'default' => '0' ],
         'net.link.bridge.pfil_member' => [ 'default' => '1' ],
         'net.link.bridge.pfil_onlyip' => [ 'default' => '0' ],
-        'net.link.ether.inet.log_arp_movements' => [ 'default' => isset($config['system']['sharednet']) ? '0' : '1' ],
-        'net.link.ether.inet.log_arp_wrong_iface' => [ 'default' => isset($config['system']['sharednet']) ? '0' : '1' ],
+        'net.link.ether.inet.log_arp_movements' => [ 'default' => !empty($config['OPNsense']['Interfaces']['settings']['sharednet']) ? '0' : '1' ],
+        'net.link.ether.inet.log_arp_wrong_iface' => [ 'default' => !empty($config['OPNsense']['Interfaces']['settings']['sharednet']) ? '0' : '1' ],
         'net.link.tap.user_open' => [ 'default' => '1' ],
         'net.link.vlan.mtag_pcp' => [ 'default' => '1' ],
         'net.local.dgram.maxdgram' => [ 'default' => '8192' ],

src/etc/rc.newwanip

@@ -95,7 +95,7 @@ foreach (link_interface_to_gif($interface, true, $family_int) as $linked) {
     $auxdevs[] = $linked;
 }
 
-switch (isset($config['system']['ipv6allow']) ? ($config['interfaces'][$interface]['ipaddrv6'] ?? 'none') : 'none') {
+switch (!empty($config['OPNsense']['Interfaces']['settings']['ipv6allow']) ? ($config['interfaces'][$interface]['ipaddrv6'] ?? 'none') : 'none') {
     case '6to4':
         interface_6to4_configure($interface, $config['interfaces'][$interface], true);
         system_routing_configure(false, $interface, true, 'inet6'); /* interface recreation breaks attached routes */

src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/SettingsController.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Interfaces\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+use OPNsense\Core\Backend;
+
+class SettingsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'settings';
+    protected static $internalModelClass = 'OPNsense\Interfaces\Settings';
+
+    public function getAction()
+    {
+        $duids = json_decode((new Backend())->configdRun('interface settings gen_duid'), true);
+        if (!$this->getModel()->ipv6duid->isValidDuid($duids['current'])) {
+            $duids['current'] = $duids['default'];
+        }
+        $result = parent::getAction();
+        $result['duids'] = $duids;
+        return $result;
+    }
+
+    public function reconfigureAction()
+    {
+        $result = ['status' => 'failed'];
+        if ($this->request->isPost()) {
+            $result['status'] = strtolower(trim((new Backend())->configdRun('interface settings configure')));
+        }
+        return $result;
+    }
+}