920 Commits

Author SHA1 Message Date
Franco Fichtner
0f1484b3a2 firmware: strict install policy using php version_compare() #4500
We have to see how this holds up in practice.  Reinstall was considered
as well for further protection but that might be even trickier depending
on what locking and version tricks the user did to their install to
retain a particular (working) state.
2021-02-16 15:08:26 +01:00
Franco Fichtner
e4392fb854 firmware: pin critical updates to our repo #4500
While testing pkg was snatched from FreeBSD mirror, which isn't
advisable (nevermind that FreeBSD mirror was enabled in the first
place).

Do the same for the release type shift to avoid pivoting towards
third party repos for any reason whatsoever.
2021-02-16 15:03:56 +01:00
Franco Fichtner
9a01e5399d firmware: UX and display tweaks 2021-02-16 10:31:04 +01:00
Franco Fichtner
31cefec61b firmware: when config.xml looks like a factory reset register plugins/release #4500
This way the build can do all sorts of funny things and we will end up
with a consistent config.xml after boot.  For people restoring other
config.xml that is not the case but in this scenario the user is likely
aware of what he or she is doing.
2021-02-16 10:05:27 +01:00
Franco Fichtner
4cf0720b66 firmware: merge updates and release type result parsing #4500
With this we get as much visibility as pkg can offer us.  Merge
some code in the process as the release type shift is nothing
special anymore.
2021-02-16 00:40:20 +01:00
Franco Fichtner
e283a5942d firmware: UX and JS changes #4500 2021-02-15 19:52:15 +01:00
Franco Fichtner
8d7ce38678 firmware: add upgrade sets to status if found and required #4500 2021-02-15 13:51:54 +01:00
Franco Fichtner
2ecd584c9a firmware: firmware-* files private to check.sh #4500
Remove unused JS while here.
2021-02-15 13:07:00 +01:00
Franco Fichtner
52594df3e3 firmware: simplify upgrade procedure #4500 2021-02-15 12:05:16 +01:00
Franco Fichtner
14416172b1 firmware: switch to new update procedure #4500 2021-02-15 11:33:44 +01:00
Franco Fichtner
9fb0b8d677 firmware: remove compat code from plugin register script #4500
We always assume metadata is present otherwise we end up
with undefined behaviour.
2021-02-15 09:15:45 +01:00
Franco Fichtner
88aa77ecda firmware: assorted changes for #4500
o Do not load the text changelog for the GUI as it is unused
o Rename product_name to product_id for consistency
o Always hint at product_target so correct changelog is displayed
o Rename type to target for consistency
o Add distinguishable labels to changelog view actions
o Return JSON when argument is given for easier debug
2021-02-14 13:50:14 +01:00
Ad Schellevis
a4f48f7a91 Services / Web proxy - possible ownership issue on template directory.
It's probably better to chown the error pages directory, just like we for other squid related directories, to prevent ownership issues. Although this doesn't seem to go wrong, the files are intended for squid.

closes https://github.com/opnsense/core/issues/4703
2021-02-12 21:11:26 +01:00
Franco Fichtner
64640958df firmware: for check also figure out release type shift #4500 2021-02-12 21:58:05 +01:00
Franco Fichtner
65f212b537 firmware: bubble this down, more to come #4500 2021-02-12 21:41:22 +01:00
Franco Fichtner
9679c969f6 firmware: remove type.install, bring code closer together #4500 2021-02-12 19:59:48 +01:00
Franco Fichtner
10eab0ae68 firmware: get rid of firmware type name #4500
From the user side no functional changes.  What this can do
now is decide whether to update or do a release type transition.
In most cases it is safer to get all updates first and then
do a release type transition afterwards.  This can follow when
firmware type install can be shelved.
2021-02-12 19:37:58 +01:00
Franco Fichtner
d00a9f3c16 firmware: correct install time and loop check_package #4500
The former is so we have the date of the install point, not the
date of the package build time.  And, secondly, if we loop the
argument for check through the JSON we know to put the result
into perspective later on.
2021-02-12 14:48:20 +01:00
Franco Fichtner
db87488b40 firmware: remove PIPEFILE #4500 2021-02-12 12:11:38 +01:00
Franco Fichtner
67e3da7600 firmware: no more PIPEFILE in security audit #4500 2021-02-12 11:54:09 +01:00
Franco Fichtner
37664543e1 firmware: extent connectivity script, add to shell #4500
We can actually get rid of PIPEFILE if we do not need the
return value of the command.  More simplification on the
way.
2021-02-12 11:53:04 +01:00
Franco Fichtner
f059f6cd59 firmware: bugs and tweaks #4500 2021-02-12 10:54:42 +01:00
Franco Fichtner
35d88e8da4 firmware: support repository info for updates #4500 2021-02-12 00:03:32 +01:00
Franco Fichtner
724167b44b firmware: remove cruft, show log during check #4500 2021-02-11 22:14:08 +01:00
Franco Fichtner
cc58fd6009 firmware: background the update check, funnel it back to GUI #4500 2021-02-11 20:38:34 +01:00
Franco Fichtner
84b086ec96 firmware: provide check data to caller for upcoming refactor #4500 2021-02-11 16:29:28 +01:00
Franco Fichtner
d8e0eb669a firmware: remove debug output 2021-02-11 15:34:44 +01:00
Franco Fichtner
6a2c0c4e72 firmware: report enabled repositories #4500 2021-02-11 13:26:10 +01:00
Ad Schellevis
b465a418a0 IDS policies not mnatching categories. since categories isn't a metadata field, our parser seems to miss the field content. In this case it should be safe to assume if a metadata field isn't found we can look in the rule properties if it's there. there likely aren't overlapping properties in this case. closes https://github.com/opnsense/core/issues/4695 2021-02-11 11:25:17 +01:00
Franco Fichtner
bfbc0bdccb firmware: warn on incomplete repository, change release type priority #4500 2021-02-10 16:06:49 +01:00
Franco Fichtner
831fcec40b firmware: add a functional stub for connectivity audit #4500
pkg update -f is a good starting point, but we also need to check
DNS etc. so that is still a subject to debate.
2021-02-10 13:39:22 +01:00
Franco Fichtner
2a860c841d firmware: business changelogs from separate mirror #4500 2021-02-10 13:14:37 +01:00
Ad Schellevis
f79c311abf IDS: prevent flowbits:noalert from being dropped. closes https://github.com/opnsense/core/issues/4687 2021-02-08 19:35:15 +01:00
Franco Fichtner
12637eb7f5 rc: let opnsense-version -c check package file existence 2021-02-05 13:26:43 +01:00
Franco Fichtner
b35843fdbc firmware: opnsense-version will do the trick 2021-02-05 10:22:55 +01:00
Franco Fichtner
024bb6a003 firmware: UX rework done now #4500
Removed more fluff, concepts anf functionality are there.
Plugin conflict labels could probably require improvement,
but the way they work is relatively complicated, but maybe
it is only getting late.

As soon as we have plugin JSON metadata we can ship the
plugin conflict rework as well as that seems to help a lot
when recovering from strange situations (mostly development
things, but we never know).
2021-02-05 00:09:58 +01:00
Franco Fichtner
8158ef8a6c firmware: deal with plugin to config syncs 2021-02-04 17:53:32 +01:00
Franco Fichtner
2573b7325a firmware: do not show subscription key on firmware status page #4500 2021-02-04 12:02:03 +01:00
Ad Schellevis
0101becd99 IDPS: make sure rule overwrites use unique config sections. closes https://github.com/opnsense/core/issues/4667
We might consider a unique constraint as well, but since duplicates themselves don't hurt that much, this might be good enough.
2021-02-03 16:25:47 +01:00
Franco Fichtner
c05df172aa firmware: add information page #4500 2021-02-03 14:21:20 +01:00
Franco Fichtner
1c8e3a3a47 firmware: update text and make notes for later #4500 2021-01-29 19:38:12 +01:00
Franco Fichtner
f2ca74384a firmware: fix fetch of changelogs on dvd images 2021-01-28 09:16:25 +01:00
kulikov-a
58a966bcd6
Diagnostics->pfTables: display zeros, sort columns (#4579) 2021-01-24 19:43:48 +01:00
Franco Fichtner
d91e308001 firmware: allow to run audits from firmware upgrade console option #4500
Type "s" for security audit, or "h" for health audit.

We don't add it to the option prompt to not clutter the menu flow.
This is mostly for debug and development purposes.
2021-01-16 16:25:33 +01:00
Franco Fichtner
7d5b8bc24e firmware: oops, to bring stderr into pipe move redirect here #4500 2021-01-16 13:37:56 +01:00
Franco Fichtner
62948343fe console: ignore first backup, same as current 2021-01-16 13:14:35 +01:00
Franco Fichtner
6a65666a1c firmware: support console-based audit output 2021-01-16 12:55:41 +01:00
Franco Fichtner
c5521fecac firmware: do not allow plugin install if remote repo version differs #4500
We need the matching mirror version for the plugins to install so
simply block the update and let the user update first (instead of
only checking for updates and then installing later versions of
plugins).

This was a larger problem in past years but it is good practice to
require an up-to-date system anyway.
2021-01-16 10:14:46 +01:00
kulikov-a
bc215cbc91
download_blacklists.py: fix broken lines in large files (#4606) 2021-01-15 16:14:26 +01:00
Franco Fichtner
93be19f402 firmware; show repository in overview; closes #4578 2021-01-12 11:20:14 +01:00