Franco Fichtner
3ccd2f0bdf
interfaces: stop mdp5 before starting
...
An ancinet dragon was woken from its slumber while reworking the interface
configuration code. All things considered this is more than reasonable
although we do not yet know how this condition can be reached now as opposed
to 21.7 and if the inline termination of mdp5 will not invoke any sort of
deconfiguration (ppp-linkdown) that would harm the impending start of the
service.
PR: https://forum.opnsense.org/index.php?topic=26652.0
2022-02-02 11:39:48 +01:00
Franco Fichtner
e235082f9c
dhcp: avoid use of find_interface_network*() #4749
2022-02-02 11:16:13 +01:00
Franco Fichtner
1e992b161d
ipsec: avoid use of find_interface_network*() #4749
2022-02-02 11:07:50 +01:00
Franco Fichtner
624f0df355
openvpn: avoid use of find_interface_network() #4749
...
Given the opportunistic nature of the implementation this might
not make sense for anything but static configurations and that
excludes VIP use.
2022-02-02 11:07:50 +01:00
Franco Fichtner
9486473b2f
system: minimal approach to #5493
...
A little worried runtime configuration might not
be available making a set route not work.
2022-02-02 10:29:03 +01:00
Franco Fichtner
9cf2b221d8
system: detect far gateway situation for #5493
...
The far gateway flag has some benefits for configuration runs
and validation purposes on the GUI but in the end after lots
of reworks we are able to reliably get a network from the interface
to put the default route on so that we can detect if we are in
need of a far gateway or not. This is required for automatic
gateways on DHCP that hand out these situations while the
gateway code should not be in charge of flipping on the fargw
bit as it does pertain to runtime interface configuration.
Leave the fargw configuration flag in place for now to let people
test this, maybe backport it earlier and look at fargw more
closely in the remaining use case(s).
2022-02-02 10:12:24 +01:00
Franco Fichtner
a9a67b4255
firewall: default pass all loopback without state tracking; closes #5367
...
Idea by @kulikov-a. While arguably not addressing the issue with
unbound-control directly but we can't wait for upstream to do this.
2022-02-02 09:40:20 +01:00
Franco Fichtner
ef9a2e9330
dhcp: quick pass over prefixes.php to support non-clog finally
2022-02-02 09:07:50 +01:00
Franco Fichtner
ecaa9cfcaf
unboud: another migration fail discarded IP
...
Question is when unboudn doesn't start without an IP
why the model does not enforce it.
2022-02-02 08:46:19 +01:00
Franco Fichtner
b4b350ebca
interfaces: improve wording a bit more
2022-02-02 08:11:51 +01:00
Franco Fichtner
3499bbf9a5
src: put back whitespace in otherwise unchanged file
2022-02-02 08:07:19 +01:00
Franco Fichtner
b6ca1be13a
firmware: no need to hint at upgrades anymore
2022-02-01 14:22:58 +01:00
Franco Fichtner
add23ab496
firewall: err what, second part of prevous not staged #5517
2022-02-01 13:09:47 +01:00
Franco Fichtner
973dfb1cfd
interfaces: flip VIP bind default and enable CARP; closes #5517
2022-02-01 13:06:35 +01:00
Franco Fichtner
7d52700da2
system: forgot to scrub required => false
2022-02-01 12:42:12 +01:00
Franco Fichtner
41ab7fb9f5
system: several improvements to tunables; closes #5504
...
o Merge defaults and requirements.
o Get rid of get_default_sysctl_value().
o Manually set 'type' for e.g. boot enviroment tunables.
o Cache sysctl map once per boot.
o Edit system defaults for easier override.
While sysctls might change when (un)loading kernel modules the
risk of missing something vital is not given. We could always
flush the cache file in that case later.
2022-02-01 12:23:00 +01:00
Markus Reiter
2bf4f44c4a
Fix EmergingThreats documentation URL. ( #5530 )
2022-01-31 14:06:39 +01:00
Ad Schellevis
5278ee5ae3
Firewall: Settings: Advanced - remove ruleset-optimization as this is without function when labels are being used. closes https://github.com/opnsense/core/issues/5529
...
We have been using labels for a very long time, but since https://github.com/opnsense/core/issues/3312 back in 2019 we literally tag all rules we create, which renders ruleset-optimization completely useless as "label" is treated as a barrier (5b29254770/sbin/pfctl/pfctl_optimize.c (L112)
2022-01-31 10:33:15 +01:00
Ad Schellevis
68138c2973
Interfaces: Settings - improve mesage a bit for https://github.com/opnsense/core/issues/5521
2022-01-31 10:31:53 +01:00
Ad Schellevis
f041bb8ceb
Interfaces: Settings - add a note about where these settings apply, closes https://github.com/opnsense/core/issues/5521
2022-01-31 09:57:54 +01:00
Franco Fichtner
308b31dfa8
unbound: fix migration issues
...
* Domains without names seemed to be possible... just discard those.
* Iterating over empty item produes error.
* AAAA type missing.
2022-01-31 09:44:50 +01:00
Franco Fichtner
d2b9c6eebd
src: style sweep
2022-01-31 08:43:25 +01:00
kulikov-a
f530e4fb4b
Logs: add backward compatibility ( #5522 )
2022-01-30 14:05:28 +01:00
Ad Schellevis
52d3e7c676
system: routes: configuration - changing interface gateway will be ignored as the delete/add combination adds the new gateway in it's delete action.
...
Looks like a very old regression in ab1cadea90https://github.com/opnsense/core/issues/5304 ) and persist the requested state, but short term it probably makes more sense to fix the "route delete" action, so we can close https://github.com/opnsense/core/issues/5520
2022-01-28 21:02:23 +01:00
ppascher
130ef3a6e7
Fix typo causing error on IPv6 login
2022-01-28 19:38:17 +01:00
kulikov-a
317b3601d0
Firewall / Aliases - encode rules names ( #5507 )
...
encode firewall rules descriptions to prevent possible XSS
2022-01-27 19:37:31 +01:00
Ad Schellevis
eac975d7df
Firewall: Aliases - exclude external aliass for nesting as these will be empty according to our administration.
2022-01-27 13:53:57 +01:00
Franco Fichtner
d1dbeb3d5e
firmware: update upgrade hint
2022-01-27 11:44:15 +01:00
Franco Fichtner
602a5b416d
firmware: patch header in consistently
...
The information is relatively helpful so we might as well
complete the script use.
2022-01-26 08:06:06 +01:00
Franco Fichtner
546bfd41ba
src: one more whitespace issue in previous
2022-01-26 08:00:00 +01:00
Ad Schellevis
70d113db59
whitespace (^M)
2022-01-25 15:37:09 +01:00
Franco Fichtner
dd5f357f17
firmware: fix import listing for one ZFS pool
2022-01-25 10:28:08 +01:00
Ad Schellevis
b01da7a918
Fr5487 adaptive timeouts ( #5502 )
...
* per-rule adaptive timeouts
allow per-rule adaptive timeouts. 0 is possibe to disable adaptive timeouts
* Firewall / Rules - allow per-rule adaptive timeouts, small cleanups for https://github.com/opnsense/core/pull/5492
* Firewall / Rules - allow per-rule adaptive timeouts, values may be 0 as well, so "positive" should be "non-negative" for https://github.com/opnsense/core/pull/5492
Co-authored-by: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
2022-01-25 08:49:16 +01:00
Stephan de Wit
161d24650b
unbound: overrides: migrate to mvc model ( #5488 )
...
* unbound: overrides: migrate to mvc model
* unbound: overrides: generate host_entries via model, revert template generation
* unbound: overrides migration: fix missing include
* unbound: overrides: clean up
Co-authored-by: Stephan de Wit <stephan.de.wit@deciso.com>
2022-01-24 20:19:06 +01:00
Stephan de Wit
4ca55d9dc6
MVC - BaseField: Overload __isset() magic method ( #5499 )
2022-01-24 15:29:06 +01:00
Franco Fichtner
fd778ae210
firmware: to pull off previous we need to support -l
2022-01-24 10:05:22 +01:00
Franco Fichtner
910c1f2a7b
firmware: more changes here in the future
2022-01-24 09:49:09 +01:00
Franco Fichtner
a7007e08b0
firmware: almost there
2022-01-24 08:45:08 +01:00
Franco Fichtner
ff7a0a9d1b
interfaces: reduce diff
2022-01-24 08:24:57 +01:00
Franco Fichtner
28e4cf9172
system: try to take into account 522ba38061a91 here
2022-01-24 08:13:37 +01:00
kulikov-a
279de63e63
util/log_error: keep it clear. add a log_msg ( #5498 )
...
add log_msg() and keep log_error() as is.
2022-01-23 19:50:21 +01:00
kulikov-a
9225fc3b40
util/log_error: use severity levels ( #5497 )
...
* extend log_error to support levels
* mark auth messages as notice
2022-01-23 11:45:16 +01:00
Ad Schellevis
ad2a5758d9
Firewall: Settings: Normalization - support "no scrub" option so specific traffic can easily be excluded from scubbing.
2022-01-22 19:31:11 +01:00
Franco Fichtner
123808d9c3
dhcp: fix array access when no alias/carp was found
...
Simplify code while at it.
PR: https://forum.opnsense.org/index.php?topic=26456.0
2022-01-21 15:32:52 +01:00
Ad Schellevis
cebee292d2
Services / Captiveportal - prevent session removal crashing out when we there's no IP address registered
2022-01-20 18:22:51 +01:00
Franco Fichtner
6560bd9bbc
firmware: use new feature of opnsense-update
...
Remembers the last packages set upgraded to to avoid too
much spurious upgrade attempts.
2022-01-20 11:34:17 +01:00
Franco Fichtner
18b352b61e
system: spacing
2022-01-20 10:03:13 +01:00
Ad Schellevis
7869c116a7
Web application security measuers, explain where to disable rebind if needed ( https://github.com/opnsense/core/issues/5481 )
2022-01-20 09:52:27 +01:00
Franco Fichtner
f5964434e6
interfaces: remove link remnants from GRE
...
CC: @adschellevis
2022-01-20 07:46:19 +01:00
Ad Schellevis
15230c70f6
Interfaces: Other Types: GRE - remove non-existing link parameters inherited back in 2014.
...
Although "link1" does include some code, 22.1 should be safe to drop this hardly used feature (people can add static routes if needed).
2022-01-19 14:14:09 +01:00
