18164 Commits

Author SHA1 Message Date
Ad Schellevis
4f3db31351
System: Gateways - kill opposite states when a gateway "up" is triggered (#8548) 2025-04-16 09:40:36 +02:00
Ad Schellevis
6d579db491 VPN: IPsec: Mobile & Advanced Settings - copy "Split DNS name" to undocumented "25", closes https://github.com/opnsense/core/issues/8552
* https://docs.strongswan.org/docs/latest/plugins/attr.html
* https://lists.strongswan.org/pipermail/dev/2019-May/001994.html
2025-04-15 14:10:34 +02:00
Ad Schellevis
b87eba3085 Services: Intrusion Detection: Administration - template style cleanups 2025-04-15 13:31:04 +02:00
Franco Fichtner
f30c28ca79 mvc: allow referencing disabled interfaces in LinkAddressField
This prevents validation errors when interfaces are temporarily
disabled.  Other device components received similar fixes in the
past due to this "glitch" of not offering valid devices and selectpickers
would lose their correct value on save too (the field is a bit different
here but the same principle applies).
2025-04-15 12:36:04 +02:00
Franco Fichtner
25585eb6b9 interfaces: consider tracked interface's linked devices on reload #7713
When attaching a GIF tunnel to an IPv6 device it's more likely a LAN
device but that is being missed when WAN is reloaded here.  Much of the
other code still accounts for this so this merely goes with the flow
and since we only operate in IPv6 scope that is ok.
2025-04-15 11:00:54 +02:00
Ad Schellevis
6a89c8968b Services: Intrusion Detection: Administration - our fix in the reverse log reader (7446f8cbbf) caused a regression in the alert view. closes https://github.com/opnsense/core/issues/8550
It looks like this worked by accident, since we started with the wrong offset, we accidentally hit the right record.
2025-04-15 10:49:32 +02:00
Ad Schellevis
d0f745a70e Services: Captive Portal - fix display issue for pass rule when client not in zone
inverse rules unfortunately contain some mappings, which means we need to map them differently for legacy and mvc code.
2025-04-14 17:09:39 +02:00
Franco Fichtner
5ad41a236c system: typo 2025-04-14 12:39:07 +02:00
Ad Schellevis
0d6aa56527 Services: ISC DHCPv4: hide menu items when dnsmasq is enabled to improve "out of the box" experience. closes https://github.com/opnsense/core/issues/8329 2025-04-14 10:34:22 +02:00
Ad Schellevis
413f49c3ef Services: Captive Portal - configd actions should use long opts (fix regression in 7e838c6d92)
argparse needs long params too..
2025-04-14 09:47:50 +02:00
Alex Goodkind
02e511091d
DHCP6: use lease_type to key lease map in addition to iaid_duid (#8492)
* dhcp6: key lease map by type in addition to duid

* Update src/opnsense/scripts/dhcp/get_leases6.py

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>

---------

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>
2025-04-11 18:54:15 +02:00
Stephan de Wit
4567021437 captive portal: remove interfaces_inbound option (https://github.com/opnsense/core/issues/8326)
In the old situation, one would need explicit pf rules on top of
this feature to make this work. With the removal of IPFW,
those rules are now enough to make the same happen.
2025-04-11 09:25:06 +02:00
Franco Fichtner
d81b2eec9d dnsmasq: move default setting to where dhcp disappeared before 2025-04-11 09:15:07 +02:00
Franco Fichtner
5a2e399586 ipsec: settings page also unaccounted for
PR: https://forum.opnsense.org/index.php?topic=46595.0
2025-04-11 09:02:45 +02:00
Franco Fichtner
54fed30cf1 ipsec: fix more ACLs related to individual IPsec page use
PR: https://forum.opnsense.org/index.php?topic=46595.0
2025-04-11 08:43:31 +02:00
Franco Fichtner
d4ddc8def6 ipsec: add missing copyright header 2025-04-11 08:41:32 +02:00
Franco Fichtner
fb87f688f6 ipsec: fix auth server parsing regression
PR: https://forum.opnsense.org/index.php?topic=46774.0
2025-04-10 20:52:25 +02:00
Ad Schellevis
25b2716325 Services: Captive Portal - regression in https://github.com/opnsense/core/issues/8326 when reflection is enabled.
Captive portal installs redirects, but these should be excluded when calculating reflection rules.

ref: https://forum.opnsense.org/index.php?topic=46775.0
2025-04-10 20:34:32 +02:00
Ad Schellevis
7e838c6d92 Services: Captive Portal - configd actions should use long opts 2025-04-10 14:16:11 +02:00
Ad Schellevis
6d507b1dd9 Services: Captive Portal - fix regresssion in 8ba454ab04, argparse doesn't seem to like an argument starting with a minus (-) sign even when quoted.
making assignments explicit with an equal [=] sign seems to fix this.
2025-04-10 14:07:37 +02:00
Franco Fichtner
86ffbd88ad firmware: this broke too 2025-04-10 12:42:00 +02:00
Franco Fichtner
0e5a5c3ba2 system: fix gateway watcher backoff 2025-04-10 11:27:12 +02:00
Franco Fichtner
da6fab5bff backend: adjust for #8525 2025-04-10 09:44:03 +02:00
Ad Schellevis
7446f8cbbf logging: reverse_log_reader() - fix off by one error due to line ending at the end of the file
Usually log lines start with a line ending, which means the first hit is always an empty line with reading things backwards.
This empty line has no relevance, but only indicates we're at the end of the file.

This commits stores the file starting position in all cases and ignores the output when we trying to yield the end of the file.
2025-04-10 09:08:23 +02:00
Ad Schellevis
d0b1c8d369 Services: Intrusion Detection: Administration - example usage of configd errors:no property (https://github.com/opnsense/core/issues/8525) 2025-04-09 17:38:11 +02:00
Ad Schellevis
9f7a1fa062 configd: support "errors:no" clause on actions, closes https://github.com/opnsense/core/issues/8525 2025-04-09 17:36:13 +02:00
Stephan de Wit
8d3d392ae6 dashboard: traffic: use client time (https://github.com/opnsense/core/issues/8225) 2025-04-09 14:39:26 +02:00
Franco Fichtner
817e7fb11d LICENSE: sync 2025-04-09 13:17:18 +02:00
Franco Fichtner
7b2ad791ee src: syle sweep 2025-04-09 13:16:51 +02:00
Ad Schellevis
983a0663b0
Interfaces: Devices: Bridge - refactor to MVC closes https://github.com/opnsense/core/issues/8353 (#8534)
* Interfaces: Devices: Bridge - refactor to MVC for https://github.com/opnsense/core/issues/8353

* move existing properties to model which overlays existing config path
* add a simple wrapper script for [re]configuration which diffs and applies using the new _interfaces_bridge_configure() implementation

* Update src/opnsense/mvc/app/models/OPNsense/Interfaces/Bridge.xml

Co-authored-by: Franco Fichtner <franco@opnsense.org>

---------

Co-authored-by: Franco Fichtner <franco@opnsense.org>
2025-04-09 13:09:09 +02:00
Ad Schellevis
09bd2d96cc Interfaces: Devices: Bridge - refactor bridge (re)configuration, as with most new components, we should check what we have first before applying to prevent a lot of unuseful calls and possible service disruptions. pre work for https://github.com/opnsense/core/issues/8353
In order to plan->do->act we need the current settings of the existing bridge, which is where legacy_interfaces_details() comes into play, which needs some additional parsing.
Next we can diff per type of setting and apply when changed.
2025-04-09 11:16:42 +02:00
Ad Schellevis
5629911558 System: Trust: Authorities - prevent recusrion loop when ca's are cross referencing eachother.
Although this is highly uncommon, it's very annoying when the certificate path leads to an "Fatat error: Allowed memory size exhausted...".
If we do end in a loop (e.g. same ca already in the path), exit the calculation and return what we found sofar.
2025-04-08 11:45:21 +02:00
Franco Fichtner
d240c8b0fa firmware: fix page after f569ead1a5371 changed the defaults
Make it backwards-compatible but always store the new value now.

    # pluginctl -g firmware.reboot

will still return an empty string instead of "0".
2025-04-08 11:29:59 +02:00
Franco Fichtner
c1b1af2ac2 src: style sweep 2025-04-07 19:51:40 +02:00
Franco Fichtner
0a33697a90 interfaces: allow literal comma by escape sequence '\,'; closes #8503 2025-04-07 12:09:23 +02:00
Monviech
ce2abde150
dashboard: Certificates.js adjustments for f90e544 (#8526)
* dashboard: Use search link for certificates not in the trust model

* dashboard: Use toLocaleDateString to only display the expiry date but not the exact time.

* dashboard: Show the commonname of a certificate if it exists. Since certificates from external sources all have the same description, they would not be easily distinguished otherwise.

* Fix style

* dashboard: The value of hidden items must be changed to uuid to ensure uniqueness when hiding certificates

* dashboard: Simplify hiddenItemOptions value
2025-04-04 14:12:27 +02:00
Franco Fichtner
d3c5aa22a0 system: refactor vip access 2025-04-04 11:52:39 +02:00
Franco Fichtner
e6a4bde0bf system: cleanup unused since 945bd66a3dc8 2025-04-04 11:49:55 +02:00
Franco Fichtner
868a74e058 interfaces: cleanup spurious functions regarding VIP access
We do this for different reasons, but mainly for code maintenance
and simplicity.  It also fixes a few aquire/display bugs with
overlapping linl-local VIPs across interfaces, but not all.
2025-04-04 11:29:51 +02:00
Monviech
7210f016eb
dnsmasq: Implement a light validation for option6 values (#8520)
* dnsmasq: Implement a light validation for option6 values as they require to be wrapped inside square brackets if they contain an IPv6 address

* dnsmasq: Improve the IPv6 bracket check, also handle multiple ipv6 addresses that are comma separated, use isIpv6Address()

* dnsmasq: Put IPv6 value check inline since dhcp-match and dhcp-option have been unified in master.

* Update src/opnsense/mvc/app/models/OPNsense/Dnsmasq/Dnsmasq.php

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>

* Update src/opnsense/mvc/app/models/OPNsense/Dnsmasq/Dnsmasq.php

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>

* dnsmasq: trim value directly

---------

Co-authored-by: Ad Schellevis <AdSchellevis@users.noreply.github.com>
2025-04-04 08:42:13 +02:00
Ad Schellevis
905b990dea filter: replace update_params for argparse 2025-04-03 21:05:18 +02:00
Monviech
207bddcad5
TrafficShaper: Implement base_bootgrid_table and base_apply_button (#8524) 2025-04-03 16:08:04 +02:00
Ad Schellevis
368598eafc plist 2025-04-03 15:12:35 +02:00
Ad Schellevis
f90e5445db System: Trust: Certificates - offer config directory (/usr/local/etc/ssl/ext_sources/) to store locations for certificates not managed by us, but practical to know about their existence. closes https://github.com/opnsense/core/issues/8279
This is useful for services like OPNWAF and Caddy. This commit only adds the facility and changes the admin page, the widget is left unaltered.
2025-04-03 15:11:54 +02:00
Franco Fichtner
63b9f2e1aa system: allow multiple manual DNS search domains; closes #8522
The length and input isn't bound but when writing resolv.conf
we will adhere to the requirement mentioned in the man page:

    The search list is currently limited to six domains
    with a total of 256 characters.

We simply don't always know how many the system was being provided
with from the ISP so it is what it is.
2025-04-03 11:18:25 +02:00
Stephan de Wit
dbf37413b9 Revert "bootgrid: resizable columns (#8496)"
This reverts commit de5dd5f5278edbae14bfa1bc76751ae360b834e0.

table-layout: auto; seems to do more harm than good, while originally
intended to improve out-of-bounds table row situations, it proves
to cause the same issue for long cell content as it now
ignores overflow:ellipsis.
2025-04-03 08:37:26 +02:00
Monviech
732a393fb7
dnsmasq: Unify dhcp-option and dhcp-match in the same grid (#8516)
* dnsmasq: Unify dhcp-option and dhcp-match in the same grid

Both dhcp-option and dhcp-match use almost the same fields in the form and concern the same options.
Unifying them could make sense to remove some duplicate code and potentially improving the UX.

* make plist and remove console log debug statement
2025-04-03 08:10:48 +02:00
Ad Schellevis
7ec7e1d174 Firewall: Aliases - fix regression in alias table in json format (https://github.com/opnsense/core/issues/8277)
In order to support both formats, we should break with the first succesful compile().

A workaround in the current version is to omit the {.} in the path expression.
2025-04-02 18:05:01 +02:00
Franco Fichtner
97da2221d7 radvd: refactor use of get_configured_carp_interface_list() 2025-04-02 16:24:44 +02:00
Monviech
ef1c4e07c8
kea: Fix missing ACL privileges (#8519) 2025-04-02 14:13:58 +02:00