This bundle file is here for general consumption and the time it
has already taken to debug this issue is not justifiable for
pursuing the matter any further. Other approaches regarding
chroot and directory sharing are likely going to be much more
code which would make another solution more fragile as well.
While here remove a strange directory in the chroot that is not
even used.
Time to ditch this. Leave a thin dialog for the ports display
and where to access the actual PPP settings.
page-getserviceproviders now folds into page-interfaces-ppps-edit
and remove only once use functions to edit page as well.
* System: Access: Groups - in preperation for https://github.com/opnsense/core/issues/7904, add support for comma separated member lists.
If we convert groups to a model, we will switch the nested <member> tags into comma separated fields, e.g.
<member>1</member>
<member>12</member>
will convert to:
<member>1,12</member>
using this commit we support both for areas where these are being read.
* System: Access: Users - refactor to MVC (https://github.com/opnsense/core/issues/7904)
* add initial boilerplate
* unpack `<priv/>` field on first access
* unpack '<apikeys/>' field on first access and implement key actions into ApiKeyField
* add apikey grid in user management view
* change isset() to !empty() for users disabled flag in backend code
* move user atributes into dialog
* hook PrivField type to \OPNsense\Core\ACL()
* refactor Auth/API to use new User class
* otp seed logic with simple api call to generate new seeds and some JS glue for the frontend
* uid autonumber field
* language selector using get_locale_list() via configd (cached)
* add StoreB64Field field for authorizedkeys so we can keep the field contents backwards compatible.
* ExpiresField for custom date parsing, supporting previous input formats as well.
* group membership using a volatile custom field type, controller is responisble for persisting the configuration data to avoid entanglement between models
* add button which links to most likely user certs (based on commonname), to avoid all sorts of magic to reflect certs back into the usermanager.
* add getUserPrivs() to model so we can fetch a full list of privs for a user
* show user icons, long this might be less relevant
* add addApiKeyAction() to create a new api key for a user (by name)
* download new api key from user view
* implement hashing when setting a new (or scrabled) password
* use new "auth sync user" event to trigger local user db changes
* in API authenticator keep createKey and dropKey as stubs to the new model implementation
* prevent removal of "system" users (root)
* hook ACL and Menu
* add Group administration using the same logic as users
* cleanup unused
* add System: Access: Privileges to manage and change user and group privileges
* System: Access: Users - refactor to MVC (https://github.com/opnsense/core/issues/7904)
review comments from @Monviech
* "Create and Download API Key for this user" refresh apikeys bootgrid
* "Users" bootgrid, add some columns
* rename "Username" to "Group Name" in group edit
* Disable sorting the bootgrid by "Users" and "Groups" as these are aggregated/formatted columns
* System: Access: Privileges - fix updating groups dropping privileges for https://github.com/opnsense/core/pull/8046
* System: Access: Users - hook group model for https://github.com/opnsense/core/issues/7904
* System: Access: Users - add some safety fences to prevent accidental removal of rights https://github.com/opnsense/core/issues/7904
* Update src/opnsense/service/conf/actions.d/actions_auth.conf
* Update src/opnsense/service/conf/actions.d/actions_auth.conf
* System: Access: Users - remove userDNmap support as it belonged to the import https://github.com/opnsense/core/issues/7904
* System: Access: migrate Users and Groups to MVC/API (https://github.com/opnsense/core/pull/8046), review comments
* System: Access: migrate Users and Groups to MVC/API (https://github.com/opnsense/core/pull/8046)
o align "policy change for %s unlink group" with master (unlink when duplicates exists)
* System: Access: migrate Users and Groups to MVC/API (https://github.com/opnsense/core/pull/8046)
refactor add user event so it utilizes our new model instead of direct config access, while performing the operation, also make sure we lock/unlock the config.xml
* System: Access: migrate Users and Groups to MVC/API (https://github.com/opnsense/core/pull/8046)
replace page-system-groupmanager-addprivs with page-system-usermanager-addprivs
* plist
---------
Co-authored-by: Franco Fichtner <franco@opnsense.org>
Running the grep below lights up a few spots still:
# git grep 'pkg[^/\[\.a-z'"'"',()_+"]'
Make a few decisions for the future:
* Use "pkg-static" outside the firmware code consistently
with a full path
* Modify ambiguous code or comments to not be found by the
grep above
* Firmware uses PKG now if we ever have to pivot to pkg-static
or when we need to overwise modify the call.
The goal of this excerise was to find all stray package manager
spots that may run their own embedded pkg-update without the
proper environment which should be gone for now.
Neither OpenSSL base (/etc/ssl) nor ports (/usr/local/openssl) need
the bundle file now that we use the directory trust store. The downside
is that as soon as the bundle exists OpenSSL library will read both the
directory and the bundle by default defeating the purpose of a single
location and the directory being faster.
Keep the fringe ca_root_nss location /usr/local/etc/ssl since that is
still seeded by the package but controlled and topped up by the user
configured authorities.
If we convert groups to a model, we will switch the nested <member> tags into comma separated fields, e.g.
<member>1</member>
<member>12</member>
will convert to:
<member>1,12</member>
using this commit we support both for areas where these are being read.
It's rebatable how careful we should be reading files from /etc/ssl/certs
but in practice garbage-in-garbage-out is the best approach and just match
a wider variety of files included in the directory.
The config.xml.sample also has a <enable/> node and saving RRD by
disabling it produces an empty <rrd/> node in the code so isset()
is still the right thing to do.
PR: https://forum.opnsense.org/index.php?topic=43641.0
Currently both users and groups store multiple <priv/> tags within the same container, but if we want to use MVC structures, we need to move to a single container to hold the access roles for them.
Our common seperator is a comma (,) which is not used in acl tags as these are not valid within xml tags anyway, by supporting both the future storage privA,privB and the current one we can feed this change easily in a future minor release without having to move all new mvc code already.
After this change, a config.xml may contain (combinations of):
<priv>page-X</priv>
<priv>page-Y</priv>
<priv>page-X,page-Y</priv>
The use of plugins_argument_map() makes it fully backwards
compatible now although external callers need to cope with
the new reality of handling arrays (maps) going forward with
25.1 to avoid having two events one of which slows down the
processing.
Not sure where this comes from but the concensus is that
closelog() is relatively useless and testing verifies that
it works as expected without it.
Now we just have to make sure that each component using
openlog() will reopen the actual GUI log so that it can
keep logging correctly.
According to rfc5280 an CRL update should be issued before "next update", but does not seem to define a validity. Various sources seem to indicate updates should be fetched at least every couple of hours, in which case an hourly update sounds reasonable.
To avoid excessive writes, we compare each CRL offered with the last one received before flushing it to disk and keep track of actual changes. When nothing changes, no rehash is neede, which the configd action takes care of.
Distribution points could either be HTTP or LDAP, LDAPS and HTTPS may not be used according to the RFC (CAs SHOULD NOT include URIs that specify https, ldaps, or similar schemes in extensions.)
We actually only want the vpn_map event in the stable branch
and move to a backwards compatible format for 25.1 but as a
new coalesced (mapped) caller.
