15467 Commits

Author SHA1 Message Date
Franco Fichtner
2be79db6f8 interfaces: introduce a lock and DAD timer into newwanip for IPv6 #6637
There seem to be two issues:

1. Tentative addresses could have always been ignored for the wrong reasons
and we can savely move the delay to this script even though a small delay
will be the result (2 seconds with the default sysctl).  Not sure why this
problem previously not mattered that much, but at least we can move the other
instance of the delay to here and avoid duplication since it will continue
to load this script anyway.

2. Due to overlaps and technical convolution these scripts can be run multile
times in a very short succession especially on a bootup.  Since we have a delay
here now we force a lock prior to "catch" stray invocations.  The only issue
I see is that we could lose the "force" flag in the process, but if that is
the case the log message will reveal and we can work around this sas well with
a two stage log perhaps.
2023-07-18 13:53:48 +02:00
Ad Schellevis
6f48712a7d Reporting: Unbound DNS - modify pre-upgrade export hook, output when skipped or processed and transfer ownership to unbound 2023-07-18 09:54:18 +02:00
Franco Fichtner
74b8f028f5 pkg: fix plist 2023-07-18 09:43:44 +02:00
Franco Fichtner
5d4b437b4e firmware: add 23.7 fingerprint 2023-07-18 08:48:29 +02:00
Franco Fichtner
2965f18e7c firmware: add hint for 23.7-RC1 2023-07-18 08:44:25 +02:00
Franco Fichtner
497e46956a pkg: fix plist 2023-07-18 07:38:28 +02:00
Ad Schellevis
607016502b Firewall: Groups: migrate to MVC ( https://github.com/opnsense/core/issues/6385 ), class name should start with a capital. 2023-07-17 20:05:43 +02:00
Ad Schellevis
97a919522b Reporting: Unbound DNS - add pre-upgrade hook to dump unbound's duckdb database in /var/cache/unbound.duckdb
The logger is responsible for database maintanance, when the storage version doesn't match on startup it should import the previous content from this directory so we are able to survive duckdb version upgrades.
For more information, see https://duckdb.org/internals/storage
2023-07-17 18:21:14 +02:00
Franco Fichtner
b1e270957c system: name unknown tunables as "environment"
They may exist for the boot loader but their existence is not
provable.  Keep them with "warning" colour in order to make
clear the subject is fuzzy.
2023-07-17 15:40:31 +02:00
Ad Schellevis
935e57756c Firewall: Groups: migrate to MVC (https://github.com/opnsense/core/issues/6385), fix regex 2023-07-17 10:25:27 +02:00
Franco Fichtner
7042de1c5b firewall: remove capture group from preg_split() 2023-07-17 09:25:19 +02:00
Franco Fichtner
4acc838e4d src: style sweep 2023-07-15 13:16:46 +02:00
Ad Schellevis
e5c2ac5909 Firewall: NAT: Port Forward - cleanup legacy NAT portforward pagea and only show the associated filter rule for this entry. closes https://github.com/opnsense/core/issues/6664
Although the code is still a bit convoluted due to the dropdown being used for multiple purposes, it should make sense to always show the option to add a new one if none can be found and only show the related rule when it can.
2023-07-13 09:51:36 +02:00
Stephan de Wit
0f3673b088 dhcp: hook up dhcp service to logcontroller 2023-07-12 14:28:32 +02:00
Stephan de Wit
4ea46ea21c
MVC: allow new services to hook into ApiMutableServiceController (#6663)
To allow legacy services without a model to hook into the `ApiMutableServiceController`, we define a protected `serviceEnabled` function that by default checks the given `internalServiceEnabled` property to see if a service is enabled, but allows derived classes to override the functionality. We loosen the property restrictions in `initialize()` by moving the checks to their runtime implementations.

DHCPv4/v6 is modified here to hook into this change, but since the `actions_services` requires the keyword `service`, which isn't used by the mutable service controller, we define start/stop/restart/status actions in the `actions_dhcpd.conf` and the new `actions_dhcpd6.conf` files.
2023-07-12 14:21:28 +02:00
Stephan de Wit
fc15a2e281 dhcp4: use argparse instead of params 2023-07-12 14:10:37 +02:00
Stephan de Wit
dba5d12324 dhcp4: adjust directory structure as with dhcpv6 2023-07-12 10:51:21 +02:00
Stephan de Wit
67c9c597e4 fix plist 2023-07-12 09:41:21 +02:00
Stephan de Wit
f782be9cbf
dhcp6: migrate leases page to MVC (#6653)
* dhcp6: add backend for listing dhcpv6 leases

* dhcp6: add leases view and controller

* dhcp6: lease deletion backend

* dhcp6: move to separate dhcpv6 directory to accomodate the service control UI
2023-07-12 09:39:55 +02:00
Stephan de Wit
8dc8d39d4b dhcp: remove multiselect deletions and cleanup page
The process simply fires off N requests, with each request restarting the dhcp server. Aggregating the addresses is likely not worth the effort, so just drop the feature.
2023-07-11 16:47:53 +02:00
Ad Schellevis
c5580da6c9 VPN/IPSEC/Key Pairs - fix RSA keypair generation, closes https://github.com/opnsense/core/issues/6638 2023-07-11 13:29:04 +02:00
Ad Schellevis
1a869f6cfd MVC/Core - properly support multi clause search phrases.
closes https://github.com/opnsense/core/issues/6658
2023-07-10 16:15:08 +02:00
Ad Schellevis
ebbc480ac2 configd: minor regrssion in deeper nested command structures. when the requested path doesn't exist it may run out of boundaries (returning an empty string).
error in question:
.. line 310, in find_action     while type(target) is dict and action[0] in target: IndexError: list index out of range ...
2023-07-08 14:28:46 +02:00
Ad Schellevis
1fa623cfd9 Firewall: Diagnostics: States - the "kill states in selection" button was hidden when selecting only a rule, which was unintentional. While here, also make sure our rule dropdown uses a searchable selectpicker. closes https://github.com/opnsense/core/issues/6635 2023-07-08 11:55:00 +02:00
Ad Schellevis
24d90deeb9 System: Configuration: Backups - improve configuration import when interfaces or console settings are not matched. closes https://github.com/opnsense/core/issues/6654
o Offer "Exclude console settings from import." option, enabled by default
o Make sure Interfaces->Assignments shows and validates non-existing configured interfaces to ease tracking down the changes
o use is_interface_mismatch() to signal probably incompatible change and signal the user in that case (postpone reboot)
2023-07-06 16:39:39 +02:00
Ad Schellevis
8fbf2dd7f9 Services: Captive Portal - minor improvments, make sure to initialize database if cp_clients table doesn't exist 2023-07-06 13:32:12 +02:00
Stephan de Wit
58387deddb fix plist 2023-07-06 10:01:55 +02:00
Ad Schellevis
8ca3d47c54 VPN: IPsec: Mobile Clients - add radius server selection for "Connections" when radius is not defined in legacy phase1's. closes https://github.com/opnsense/core/issues/6602 2023-07-06 09:53:47 +02:00
Ad Schellevis
9cd3ce7f5f Services: Unbound DNS - move unbound-blocklists.conf to configuration location. As configd will inherit the parents access rights, /tmp will be world writable. Moving this file to unbound's etc location will prevent this from happening. cc @swhite2 2023-07-05 17:45:36 +02:00
Stephan de Wit
4b7a1ce85b
dhcp: migrate leases page to MVC (#6643)
- reworks the get_leases.py script to accomodate the "last declaration is the current one" logic from dhcpd.leases(5). (neither core nor plugins is currently using this action)
- includes binding states for failover setups in dhcpd.py lease file parsing. These are included in the leases page if show inactive is selected.
- adds small utility function in Firewall/Utility to check wheter a given IP (4 or 6) is within the bounds of a given CIDR block. Needed to bind a lease declaration to an interface in the front end.
- remove dhcpleaseinlocaltime property from services_dhcp.php. dhcpd.py works with epochs, so we only need to convert to a sensible local date in the controller.
- implements multiselect lease deletion
- implements multiselect interface filtering
- does not yet hook into ApiMutableServiceControllerBase, since the legacy configuration makes it a bit tricky.
2023-07-05 10:02:13 +02:00
Ad Schellevis
6bc025af17 login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete
(bugfix 3c2f32ec8d)
2023-07-04 20:52:13 +02:00
Ad Schellevis
e60e4cd9c2 VPN/IPse/SPD - refactor/simplify SPDField type for manual SPD items 2023-07-03 21:59:03 +02:00
Ad Schellevis
c9ee110a7b VPN: IPsec: Virtual Tunnel Interfaces - cleanup/simplify VTIField type 2023-07-03 21:48:23 +02:00
Ad Schellevis
b8cef701e2 Firewall / Aliases - cleanup AliasField to use new getStaticChildren() 2023-07-03 21:38:31 +02:00
Ad Schellevis
07524f0b73 Firewall: Groups: migrate to MVC fix model field scope issue (required for https://github.com/opnsense/core/issues/6385) 2023-07-03 20:58:53 +02:00
Ad Schellevis
2b8107b01f MVC/Model/ArrayField - fix scoping issue introduced in 3408cbf661 2023-07-03 20:58:10 +02:00
Ad Schellevis
8e197ff73e Firewall: Groups: migrate to MVC closes https://github.com/opnsense/core/issues/6385
o implement a sequence as sort order for https://github.com/opnsense/core/issues/6471
o support members split on spaces and on comma's in filter.lib.inc in case something goes wrong during migration.
2023-07-03 20:25:53 +02:00
Ad Schellevis
3408cbf661 MVC/Model/ArrayField - add generic static record definition.
While converting legacy code we do seem to have multiple static entries in different models, in which case we tend to overwrite ArrayField and extend the output with the static entries that are required for the model. These can either be defined in the legacy code (SPDField) or defined as static options (like the bogons in AliasField).

This commit adds a method getStaticChildren() which the derived class may overwrite in order to spawn new items to the list which can not be persisted. This should help avoid duplication of similar code constructs in various migrated areas. These items are constructed during the "post loading" event.
2023-07-03 17:21:26 +02:00
Ad Schellevis
1c05a19d9d System: Firmware: Reporter - escape reports 2023-07-03 10:19:23 +02:00
Ad Schellevis
3c2f32ec8d login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete 2023-07-03 09:59:27 +02:00
Ad Schellevis
5d68f43d1f Power - do not allow state modification on GET for halt and reboot 2023-07-03 09:34:59 +02:00
Ad Schellevis
e800097d0c System/Settings/Cron - improve escaping in /var/cron/tabs/nobody generation. 2023-07-03 09:27:48 +02:00
Ad Schellevis
e3f37c6a40 sqlite3 - DQS double quote usage. closes https://github.com/opnsense/core/issues/6433
skimmed through the sqlite queries and this seems to be the only one using a string literal with double quotes in stead of double quotes.
2023-07-02 18:53:23 +02:00
Ad Schellevis
a4f6a8f8d6 System: Trust: Authorities - Sanitize $act parameter 2023-06-29 22:06:31 +02:00
Ad Schellevis
d1f350ce70 System:Logging - Sanitize user input. An alfanum filter might be possible as well to strip module and scope, but might break some external plugins not on our radar. 2023-06-29 21:46:58 +02:00
Ad Schellevis
5edff49db1 System:Settings:Cron - cleanse user input in /ui/cron/item/open/... 2023-06-29 21:29:32 +02:00
Ad Schellevis
77aa58b046 Services: Unbound DNS: DNS over TLS - remove unused code 2023-06-29 21:28:21 +02:00
Ad Schellevis
53b2ce3aeb VPN: OpenVPN - minor regressions in MVC code, require certificate as we don't support peer fingerprint verification as an option. 2023-06-29 19:13:19 +02:00
Neil Greatorex
8e0637a46d
interfaces: Fix bug with reported number of flapping ports (#6641) 2023-06-29 18:08:26 +02:00
Ad Schellevis
fcb004461d VPN: OpenVPN: Instances - bugfix clone button (init vpnid to null) 2023-06-29 17:37:04 +02:00