1301 Commits

Author SHA1 Message Date
Franco Fichtner
67e3da7600 firmware: no more PIPEFILE in security audit #4500 2021-02-12 11:54:09 +01:00
Franco Fichtner
37664543e1 firmware: extent connectivity script, add to shell #4500
We can actually get rid of PIPEFILE if we do not need the
return value of the command.  More simplification on the
way.
2021-02-12 11:53:04 +01:00
Franco Fichtner
f059f6cd59 firmware: bugs and tweaks #4500 2021-02-12 10:54:42 +01:00
Franco Fichtner
35d88e8da4 firmware: support repository info for updates #4500 2021-02-12 00:03:32 +01:00
Franco Fichtner
724167b44b firmware: remove cruft, show log during check #4500 2021-02-11 22:14:08 +01:00
Franco Fichtner
cc58fd6009 firmware: background the update check, funnel it back to GUI #4500 2021-02-11 20:38:34 +01:00
Franco Fichtner
84b086ec96 firmware: provide check data to caller for upcoming refactor #4500 2021-02-11 16:29:28 +01:00
Franco Fichtner
d8e0eb669a firmware: remove debug output 2021-02-11 15:34:44 +01:00
Franco Fichtner
6a2c0c4e72 firmware: report enabled repositories #4500 2021-02-11 13:26:10 +01:00
Ad Schellevis
b465a418a0 IDS policies not mnatching categories. since categories isn't a metadata field, our parser seems to miss the field content. In this case it should be safe to assume if a metadata field isn't found we can look in the rule properties if it's there. there likely aren't overlapping properties in this case. closes https://github.com/opnsense/core/issues/4695 2021-02-11 11:25:17 +01:00
Franco Fichtner
bfbc0bdccb firmware: warn on incomplete repository, change release type priority #4500 2021-02-10 16:06:49 +01:00
Franco Fichtner
831fcec40b firmware: add a functional stub for connectivity audit #4500
pkg update -f is a good starting point, but we also need to check
DNS etc. so that is still a subject to debate.
2021-02-10 13:39:22 +01:00
Franco Fichtner
2a860c841d firmware: business changelogs from separate mirror #4500 2021-02-10 13:14:37 +01:00
Ad Schellevis
f79c311abf IDS: prevent flowbits:noalert from being dropped. closes https://github.com/opnsense/core/issues/4687 2021-02-08 19:35:15 +01:00
Franco Fichtner
12637eb7f5 rc: let opnsense-version -c check package file existence 2021-02-05 13:26:43 +01:00
Franco Fichtner
b35843fdbc firmware: opnsense-version will do the trick 2021-02-05 10:22:55 +01:00
Franco Fichtner
024bb6a003 firmware: UX rework done now #4500
Removed more fluff, concepts anf functionality are there.
Plugin conflict labels could probably require improvement,
but the way they work is relatively complicated, but maybe
it is only getting late.

As soon as we have plugin JSON metadata we can ship the
plugin conflict rework as well as that seems to help a lot
when recovering from strange situations (mostly development
things, but we never know).
2021-02-05 00:09:58 +01:00
Franco Fichtner
8158ef8a6c firmware: deal with plugin to config syncs 2021-02-04 17:53:32 +01:00
Franco Fichtner
2573b7325a firmware: do not show subscription key on firmware status page #4500 2021-02-04 12:02:03 +01:00
Ad Schellevis
0101becd99 IDPS: make sure rule overwrites use unique config sections. closes https://github.com/opnsense/core/issues/4667
We might consider a unique constraint as well, but since duplicates themselves don't hurt that much, this might be good enough.
2021-02-03 16:25:47 +01:00
Franco Fichtner
c05df172aa firmware: add information page #4500 2021-02-03 14:21:20 +01:00
Franco Fichtner
1c8e3a3a47 firmware: update text and make notes for later #4500 2021-01-29 19:38:12 +01:00
Franco Fichtner
f2ca74384a firmware: fix fetch of changelogs on dvd images 2021-01-28 09:16:25 +01:00
kulikov-a
58a966bcd6
Diagnostics->pfTables: display zeros, sort columns (#4579) 2021-01-24 19:43:48 +01:00
Franco Fichtner
d91e308001 firmware: allow to run audits from firmware upgrade console option #4500
Type "s" for security audit, or "h" for health audit.

We don't add it to the option prompt to not clutter the menu flow.
This is mostly for debug and development purposes.
2021-01-16 16:25:33 +01:00
Franco Fichtner
7d5b8bc24e firmware: oops, to bring stderr into pipe move redirect here #4500 2021-01-16 13:37:56 +01:00
Franco Fichtner
62948343fe console: ignore first backup, same as current 2021-01-16 13:14:35 +01:00
Franco Fichtner
6a65666a1c firmware: support console-based audit output 2021-01-16 12:55:41 +01:00
Franco Fichtner
c5521fecac firmware: do not allow plugin install if remote repo version differs #4500
We need the matching mirror version for the plugins to install so
simply block the update and let the user update first (instead of
only checking for updates and then installing later versions of
plugins).

This was a larger problem in past years but it is good practice to
require an up-to-date system anyway.
2021-01-16 10:14:46 +01:00
kulikov-a
bc215cbc91
download_blacklists.py: fix broken lines in large files (#4606) 2021-01-15 16:14:26 +01:00
Franco Fichtner
93be19f402 firmware; show repository in overview; closes #4578 2021-01-12 11:20:14 +01:00
Franco Fichtner
3bb2b4eb14 firmware: print core package name, database checkup first or return 2021-01-09 21:29:17 +01:00
Franco Fichtner
952637011e console: makes more sense #4572 2021-01-08 09:54:47 +01:00
Franco Fichtner
fb49c70e10 console: more questions, more recovery #4572
I see no easy way to untangle this for now.  At least make sure
the user is asked for the defaults to be restored making this
a little better than before.
2021-01-08 09:50:34 +01:00
Ad Schellevis
41eefdd105 IDPS: revert content part of 09f74fe1ce7b4805c1bb8354e5d0c5b98955497b until ETPro telemetry ships new content. 2021-01-07 20:32:21 +01:00
Franco Fichtner
92c019b913 firmware: pretty sure parsing REMOVED was working in pkg 1.12 2021-01-05 17:02:31 +01:00
Ad Schellevis
d9891b1ff9 filter/aliases: minor regression in maintaining target alias file (/var/db/aliastables/%s.txt). when it's either changed, expired or simply not there, it should dump the contents before loading it with pfctl 2021-01-05 14:52:44 +01:00
Franco Fichtner
7216e3a241 system: allow self-signed renew for web GUI; closes #4567
The command to issue a reset is:

  # configctl webgui restart renew
2021-01-04 11:28:30 +01:00
Franco Fichtner
a69351722c firmware: proper path to pkg-static 2021-01-01 20:04:25 +01:00
Ad Schellevis
4186f2bbe5 Reporting / traffic: add "top talkers" tab which shows the current (and max) bandwith usage per ip address sorted by total (in+out).
some people seem to miss the numbers, since the top host graph uses the same information over time, it wouldn't hurt to add a tab containting the raw numbers for the selected interfaces.
The current version doesn't limit the number of results, we might need to add a limit at some point in time, depending on how many results iftop samples.

general remarks:

o total amount of traffic is not being displayed, although we could count the "cumulative" from iftop, the numbers would always be flawed (since sampled with an interval)
o no reverse lookups, maybe for a future version, let's first see if this helps.
o hosts not seen for 120 seconds will automatically be removed from the list (fixed ttl)
2020-12-25 15:14:13 +01:00
Franco Fichtner
d6f32818b9 firmware: add version output to audit logs; closes #4375 2020-12-17 10:57:35 +01:00
Franco Fichtner
b515105e12 firmware: -d will for install, but we just want to check 2020-12-16 10:20:21 +01:00
Franco Fichtner
b206ad8443 firmware: fix some issues with missing repository on server 2020-12-13 11:40:13 +01:00
Ad Schellevis
be13b6f9e3 IDPS: minor fixes and improvements for new policy feature (https://github.com/opnsense/core/issues/4445).
o feedback matched policy so we can easily find affective choice in the rule tab
o remove installed_action, installed_status since these values aren't valid anymore
o while here, set <pre/> tag width to a maximum to avoid overflow in alert page

Since values need to be persisted in order to return on query requests, single rule edits can lead to a bit odd behaviour (not toggling until after apply), since modifications are advised to be performed using policies, we will keep this for now.
(the alternative is to hook apply after these changes, which also isn't a great solution)
2020-12-08 17:20:06 +01:00
Ad Schellevis
0841c5a877 Logging: add "step into" icon on log lines. Since we always read the complete file, we can know the actual row number of a search result.
When investigating log files it's often practical to see the context of a message after searching for it. This feature offers the ability to go to the page in question by clicking on a filtered result.
2020-11-25 18:04:24 +01:00
Ad Schellevis
74a64ce187 IDPS: bug in policy parser preventing ruleset filter to function. for https://github.com/opnsense/core/issues/4445 2020-11-23 17:48:10 +01:00
Ad Schellevis
1221542a43 IDPS: deprecate filter option on file downloads in favour of new policy option. migrates exsting filters to policies while there. for https://github.com/opnsense/core/issues/4445 2020-11-23 16:42:41 +01:00
Franco Fichtner
6e2375b044 src: fix a couple of copyright header misalignments 2020-11-19 16:26:23 +01:00
Ad Schellevis
bb8c58a3a8 system/logging: simplify log format parsing 2020-11-13 22:28:37 +01:00
Ad Schellevis
a0c043e693 IDS: work in progress policy editor for https://github.com/opnsense/core/issues/4445
With this commit policies functionally work, but there's still some refactoring todo.
o migrate download filters to a policy
o remove download filter option
o point to policies in the download section
o (maybe) move single rule overwrites to policies as well.
2020-11-09 15:02:14 +01:00