15545 Commits

Author SHA1 Message Date
Franco Fichtner
112777fb75 src: style sweep 2024-06-04 17:33:51 +02:00
Ad Schellevis
930fa4e39f Firewall: Aliases / generic MVC - performance improvments, closes https://github.com/opnsense/core/issues/7509
This commit improves alias save/validate performance by fixing two main issues:

1) Faster unique constraint handling using caching, in order to prevent nested loops we should cache our results while still in the validation cycle.

This required an attribute to count validation cycles so we know the model could not have changed in between, getValidationSequence() helps to reach that goal

2) Alias::getByName() more optimistic caching, also prevening nested loops when locating aliases.

Although this is slighly more optimistic than the previous construction, in practice when validating data the set won't change, if there is a risk of mutations, we should flush the set using the "flush" parameter (same as before, but a bit more sensitive).
2024-06-04 16:23:11 +02:00
Franco Fichtner
e3856e03a3 system: address false positive scanner result by making the intention explicit
Discussed with: @adschellevis
2024-06-04 14:08:43 +02:00
Franco Fichtner
b5f8805aa3 mvc: style issue 2024-06-04 13:25:44 +02:00
Franco Fichtner
88d98c7674 monit: improve previous
Let the user decide on the password and use root as the default,
but then also allow these to be seen on the GUI and stop flapping
options when a header can do the same job now.
2024-06-04 12:39:13 +02:00
Franco Fichtner
d126302ac8 monit: only require user/pass if httpd is enabled #7503
Which is off by default and we're dealing with (s)rand() use that shouldn't
be here even.
2024-06-04 09:30:42 +02:00
Franco Fichtner
9d5b1e73d5 src: copyright style 2024-06-04 06:46:05 +02:00
Franco Fichtner
a021a95868 src: style update 2024-06-03 21:10:39 +02:00
Ad Schellevis
79312f47ea opendns - add xmlrpc sync hook 2024-06-03 16:13:16 +02:00
Ad Schellevis
abec7c49be mvc:request - allow mixed for $defaultValue so we can pass strings or arrays 2024-06-03 15:48:15 +02:00
Franco Fichtner
cad058ef24 system: do not create an interface route without an address #7452
Similar to what default route handling already does.  In this case
it's not logged as an error, because the condition is likely normal.
2024-06-03 13:53:36 +02:00
Franco Fichtner
e869d1aa4e src: style sweep 2024-06-02 21:39:15 +02:00
Ad Schellevis
cbd4f266df Interfaces: Virtual IPs: Settings - add peer/peer6 options (available as of FreeBSD 14.x) closes https://github.com/opnsense/core/issues/7486
Currently it doesn't seem to be possible to reliably set both peer and peer6, but since in the kernel these are organized as two fields on the same vhid we prevent both being set with a validation.
If we would only offer a "peer" field matching the ip protocol, we might have difficulties in the future when both can be provided at the same time.

This commit parses the ifconfig output and offers the result in the interfaces/overview page (tooltip like freq settings).
2024-06-01 18:34:38 +02:00
Ad Schellevis
575f9ccaab System: High Availability: Settings - fix version ignored due to selecting the wrong field (https://github.com/opnsense/core/issues/7485) 2024-06-01 16:40:13 +02:00
Ad Schellevis
c216e560b3 System: High Availability: Settings - escape shell arguments for consistency (https://github.com/opnsense/core/issues/7485) 2024-06-01 16:34:03 +02:00
H3Krn
65ab1fd638
Add next-server option to Kea (#7505)
---------

Co-authored-by: Harm Kroon <harm.kroon@tomtom.com>
2024-06-01 15:02:10 +02:00
Ad Schellevis
1e948bfc2f filter: safeguard direct config reads when processing the ruleset. If someone manages to add a rule tag which isn't an array, boot will fail and manual intervention is needed. Arrays feeded by a model skip these records or present them as default ones. 2024-05-31 19:08:40 +02:00
Franco Fichtner
f049be47bb src: replace mt_rand() with random_int()
Interface is the same so result is the same.  Less noise from scanners.
2024-05-31 14:53:21 +02:00
Franco Fichtner
0890669129 system: replace rand() with random_int()
The implementation is the same and no outside impact although
not cryptographically relevant either way.
2024-05-31 14:45:57 +02:00
Franco Fichtner
9d2ee6178b interfaces: experiment on SLAAC avoidance for #5630 2024-05-31 13:24:53 +02:00
Franco Fichtner
c48b126ece
system: restrict PHP further (#7501) 2024-05-31 13:23:59 +02:00
Stephan de Wit
c9182e23dc dashboard: handle error cases per widget
If any widget failed to import/instantiate/update in the previous logic,
this would halt execution for the entire dashboard. This commit takes
care of these cases, but it cannot account for asynchronous callbacks
executed in the widget logic itself, these should be caught there.
2024-05-31 12:51:36 +02:00
Franco Fichtner
44e3bafce2 interfaces: make SLAAC flush a feature of ifctl for incoming reuse 2024-05-31 11:07:34 +02:00
Ad Schellevis
466494914e lib/config - remove non existing variable from getRevisionContext((), closes https://github.com/opnsense/core/pull/7500 2024-05-31 11:01:43 +02:00
Stephan de Wit
2831bbaabd dashboard: interfaces: left align not necessary anymore after BaseTableWidget refactor 2024-05-31 10:49:39 +02:00
Franco Fichtner
0f73cf5463 firmware: and since all values are 30 elsewhere why not here too 2024-05-30 15:21:18 +02:00
Franco Fichtner
c48ac131d2 firmware: change default fetch to 15 seconds
The first resolve attempt ending in a failure ends in a
fetch failure.  (It's always DNS.)
2024-05-30 15:20:06 +02:00
Franco Fichtner
572ae8a665 interfaces: in SLAAC tracking prevent footshooting 2024-05-30 14:49:39 +02:00
Ad Schellevis
c1424c6425 System: High Availability: Settings - add Sync compatibility (version) option, defaulting to 1400 on new installs and 1301 when upgrading a firewall with pfsync enabled. add missing configure action in hasync.volt as well and remove tab header. closes https://github.com/opnsense/core/issues/7485 2024-05-30 14:27:32 +02:00
Franco Fichtner
9dad0b2123 interfaces: doing this prevents the router from being registered #5630
The situation is a bit complex involving rtsold, the accept_rtadv and
the system configuration for WAN and LAN.  Will see if we can find
another way to discourage the use of the SLAAC address.  I don't think
we really really need it.
2024-05-30 14:22:18 +02:00
Ad Schellevis
d114b0ca41 System: High Availability: Settings: remove legacy page and switch acl/menu for https://github.com/opnsense/core/issues/7485 2024-05-30 13:19:42 +02:00
Ad Schellevis
9816b30a94 System: High Availability: Settings - refactor to MVC before pulling in new settings for https://github.com/opnsense/core/issues/7485 2024-05-30 11:59:24 +02:00
Ad Schellevis
1a74380e99 mvc/forms - add "select all" to standard form selectors and remove dialog on "clear all", the select all is needed for https://github.com/opnsense/core/issues/7485 , but also practical elsewhere 2024-05-30 11:53:31 +02:00
Stephan de Wit
519c006f1f dashboard: inconsistency in previous 2024-05-30 11:37:05 +02:00
Stephan de Wit
0d53a88071 dashboard: refactor BaseTableWidget to allow upserts for non-top header tables and add Gateway widget 2024-05-30 11:20:49 +02:00
Franco Fichtner
f5b298ec6c interfaces: move sysctls to system requirements related to #5630
Tie them to the IPv6 allow setting which is used by more things
than just the filter, so also move the IPv6 allow to the general
settings for consistency.

There is not much point to tie these sysctls to their former
condition of something set in SLAAC or DHCPv6 connectivity mode
because "ifdisabled" is used and because prior you couldn't turn
it off without a reboot after having tried the IPv6 connetivity.

To make thus super effective refuse to configure IPv6 on interfaces
in these instances by forcing the individual IPv6 interface modes
to 'none'.
2024-05-30 09:54:50 +02:00
Franco Fichtner
35dc38c2fb interfaces: optional prefix tracking for WAN #5630
While here restructure and reword some of the options.  Also
add a possibility to disable the SLAAC address which complements
this nicely and has been known to be problematic for some users.
2024-05-30 09:40:26 +02:00
Franco Fichtner
149aed014a system: disable dynamic loading of PHP modules 2024-05-30 09:40:26 +02:00
Stephan de Wit
9b55214aaa dashboard: inherit text color in cpu chart as well 2024-05-30 08:50:05 +02:00
Franco Fichtner
e4401b420f mvc: for consistency 2024-05-29 09:17:49 +02:00
Stephan de Wit
877d38ad24 dashboard: invalid destructuring operation 2024-05-29 09:00:03 +02:00
Franco Fichtner
80bba99c74 system: replace single-script backend call with a plugin configure hook
Been pondering about this during reviews for a while now.
2024-05-29 07:57:34 +02:00
Franco Fichtner
7b002db5c2 system: tiny cleanup in previous 2024-05-29 07:52:42 +02:00
Ad Schellevis
3d254aea55 Services: Unbound DNS: Query Forwarding - allow rfc2181 compatible names, closes https://github.com/opnsense/core/issues/7492 2024-05-28 20:43:30 +02:00
Ad Schellevis
41b8edc102 System: High Availability: Settings - remove duplicate sync items (have been added to xmlrpc in earlier versions). 2024-05-28 19:54:02 +02:00
Ad Schellevis
d99760b9cc Firewall: Diagnostics: Sessions - backwards compatible changes for pf_print_state output. 2024-05-28 18:13:32 +02:00
Franco Fichtner
a9bdd34603 mvc: style sweep 2024-05-28 15:58:50 +02:00
Ad Schellevis
9929d4e9a1 Firewall: Diagnostics: Sessions - fix minor cosmetic issue, rule label empty rendered as "null" 2024-05-28 15:36:27 +02:00
Ad Schellevis
1a282d1184 mvc:Dispatcher - add missing getActionName for backwards compatibility with Phalcon. closes https://github.com/opnsense/core/issues/7490 2024-05-28 15:09:37 +02:00
Franco Fichtner
2bf308f328 Revert "dhcrelay: allow cron job reconfigure; closes #7482"
This reverts commit bd87ac92ac97ded2db0f4392de06d57d54a4bfe1.

Back this out since dhcrelay binaries have been fixed.
2024-05-28 07:27:38 +02:00