15483 Commits

Author SHA1 Message Date
Ad Schellevis
67addc6577 VPN: IPsec: Advanced Settings - passthrough networks should be added when specified to prevent overlapping "Connections" missing them when no legacy tunnels are used. 2023-07-20 16:25:47 +02:00
Franco Fichtner
4c6e3a1e08 unbound: better check both and investigate later 2023-07-20 13:38:39 +02:00
Franco Fichtner
bf0d6498fc unbound: fix migration when db not enabled 2023-07-20 13:27:34 +02:00
Franco Fichtner
a72c86466b system: spacing 2023-07-20 09:26:17 +02:00
Franco Fichtner
809da1e519 unbound: fix typo 2023-07-20 09:18:13 +02:00
Ad Schellevis
fc7e1ddddf Reporting: Unbound DNS - minor endpoint cleanups (error and input handling) 2023-07-19 16:14:55 +02:00
Franco Fichtner
5ac34a84d5 firmware: fix a small (and old) glitch in the JSON construction 2023-07-19 13:41:04 +02:00
Franco Fichtner
e2630a954c interfaces: style sweep 2023-07-19 11:35:38 +02:00
Ad Schellevis
57077b83f5 Interfaces: LAGG: migrate to MVC closes https://github.com/opnsense/core/issues/6384
Migrate ui to MVC, wrap model around existing configuration area to remain backward compatibility.
To avoid laggs configured via console not being reachable from the gui, add a uuid to it.
2023-07-19 11:27:21 +02:00
Franco Fichtner
1ccb2c9430 system: exclude deprecated until Phalcon is fixed
PHP Deprecated:  Creation of dynamic property OPNsense\Core\Api\MenuController::$request is deprecated in /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php on line 195
PHP Deprecated:  Creation of dynamic property OPNsense\Core\Api\MenuController::$session is deprecated in /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ControllerRoot.php on line 149
PHP Deprecated:  Creation of dynamic property OPNsense\Core\Api\MenuController::$security is deprecated in /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php on line 298
2023-07-19 11:22:45 +02:00
Franco Fichtner
8eaa7adfe6 src: fix deprecations on PHP 8.2 2023-07-19 11:04:33 +02:00
bugfixin
efefa10b18
Allow underscores in DNS names from DHCP leases (#6665) 2023-07-19 09:33:34 +02:00
Franco Fichtner
dd0506971a unbound: more style 2023-07-18 17:28:23 +02:00
Franco Fichtner
2e29bedb60 unbound: style 2023-07-18 17:27:23 +02:00
Franco Fichtner
0318581664 unbound: duckdb migration output tweak 2023-07-18 17:19:01 +02:00
Ad Schellevis
b533835f2b Reporting: Unbound DNS - duckdb version upgrade handling
o make sure DbConnection() throws a new StorageVersionException when storage versions mismatch
o add restore_database() function to overwrite an existing database with the contents of an earlier backup made by the  pre-upgrade hook
o the logger is responsible for the database, on startup, it should validate the version and initialise a restore when there's a mismatch

In case the storage version doesn't match, there are 3 options, the backup is locked (restore running), in which case we exit, the restore went fine and we can start the logger, or there is no backup available, in which case we have no other choice then to drop the unsupported database.

While here, also fix a small issue in stats.py leading to NaN values being returned due to https://github.com/duckdb/duckdb/issues/4066
2023-07-18 16:31:53 +02:00
Franco Fichtner
2be79db6f8 interfaces: introduce a lock and DAD timer into newwanip for IPv6 #6637
There seem to be two issues:

1. Tentative addresses could have always been ignored for the wrong reasons
and we can savely move the delay to this script even though a small delay
will be the result (2 seconds with the default sysctl).  Not sure why this
problem previously not mattered that much, but at least we can move the other
instance of the delay to here and avoid duplication since it will continue
to load this script anyway.

2. Due to overlaps and technical convolution these scripts can be run multile
times in a very short succession especially on a bootup.  Since we have a delay
here now we force a lock prior to "catch" stray invocations.  The only issue
I see is that we could lose the "force" flag in the process, but if that is
the case the log message will reveal and we can work around this sas well with
a two stage log perhaps.
2023-07-18 13:53:48 +02:00
Ad Schellevis
6f48712a7d Reporting: Unbound DNS - modify pre-upgrade export hook, output when skipped or processed and transfer ownership to unbound 2023-07-18 09:54:18 +02:00
Franco Fichtner
74b8f028f5 pkg: fix plist 2023-07-18 09:43:44 +02:00
Franco Fichtner
5d4b437b4e firmware: add 23.7 fingerprint 2023-07-18 08:48:29 +02:00
Franco Fichtner
2965f18e7c firmware: add hint for 23.7-RC1 2023-07-18 08:44:25 +02:00
Franco Fichtner
497e46956a pkg: fix plist 2023-07-18 07:38:28 +02:00
Ad Schellevis
607016502b Firewall: Groups: migrate to MVC ( https://github.com/opnsense/core/issues/6385 ), class name should start with a capital. 2023-07-17 20:05:43 +02:00
Ad Schellevis
97a919522b Reporting: Unbound DNS - add pre-upgrade hook to dump unbound's duckdb database in /var/cache/unbound.duckdb
The logger is responsible for database maintanance, when the storage version doesn't match on startup it should import the previous content from this directory so we are able to survive duckdb version upgrades.
For more information, see https://duckdb.org/internals/storage
2023-07-17 18:21:14 +02:00
Franco Fichtner
b1e270957c system: name unknown tunables as "environment"
They may exist for the boot loader but their existence is not
provable.  Keep them with "warning" colour in order to make
clear the subject is fuzzy.
2023-07-17 15:40:31 +02:00
Ad Schellevis
935e57756c Firewall: Groups: migrate to MVC (https://github.com/opnsense/core/issues/6385), fix regex 2023-07-17 10:25:27 +02:00
Franco Fichtner
7042de1c5b firewall: remove capture group from preg_split() 2023-07-17 09:25:19 +02:00
Franco Fichtner
4acc838e4d src: style sweep 2023-07-15 13:16:46 +02:00
Ad Schellevis
e5c2ac5909 Firewall: NAT: Port Forward - cleanup legacy NAT portforward pagea and only show the associated filter rule for this entry. closes https://github.com/opnsense/core/issues/6664
Although the code is still a bit convoluted due to the dropdown being used for multiple purposes, it should make sense to always show the option to add a new one if none can be found and only show the related rule when it can.
2023-07-13 09:51:36 +02:00
Stephan de Wit
0f3673b088 dhcp: hook up dhcp service to logcontroller 2023-07-12 14:28:32 +02:00
Stephan de Wit
4ea46ea21c
MVC: allow new services to hook into ApiMutableServiceController (#6663)
To allow legacy services without a model to hook into the `ApiMutableServiceController`, we define a protected `serviceEnabled` function that by default checks the given `internalServiceEnabled` property to see if a service is enabled, but allows derived classes to override the functionality. We loosen the property restrictions in `initialize()` by moving the checks to their runtime implementations.

DHCPv4/v6 is modified here to hook into this change, but since the `actions_services` requires the keyword `service`, which isn't used by the mutable service controller, we define start/stop/restart/status actions in the `actions_dhcpd.conf` and the new `actions_dhcpd6.conf` files.
2023-07-12 14:21:28 +02:00
Stephan de Wit
fc15a2e281 dhcp4: use argparse instead of params 2023-07-12 14:10:37 +02:00
Stephan de Wit
dba5d12324 dhcp4: adjust directory structure as with dhcpv6 2023-07-12 10:51:21 +02:00
Stephan de Wit
67c9c597e4 fix plist 2023-07-12 09:41:21 +02:00
Stephan de Wit
f782be9cbf
dhcp6: migrate leases page to MVC (#6653)
* dhcp6: add backend for listing dhcpv6 leases

* dhcp6: add leases view and controller

* dhcp6: lease deletion backend

* dhcp6: move to separate dhcpv6 directory to accomodate the service control UI
2023-07-12 09:39:55 +02:00
Stephan de Wit
8dc8d39d4b dhcp: remove multiselect deletions and cleanup page
The process simply fires off N requests, with each request restarting the dhcp server. Aggregating the addresses is likely not worth the effort, so just drop the feature.
2023-07-11 16:47:53 +02:00
Ad Schellevis
c5580da6c9 VPN/IPSEC/Key Pairs - fix RSA keypair generation, closes https://github.com/opnsense/core/issues/6638 2023-07-11 13:29:04 +02:00
Ad Schellevis
1a869f6cfd MVC/Core - properly support multi clause search phrases.
closes https://github.com/opnsense/core/issues/6658
2023-07-10 16:15:08 +02:00
Ad Schellevis
ebbc480ac2 configd: minor regrssion in deeper nested command structures. when the requested path doesn't exist it may run out of boundaries (returning an empty string).
error in question:
.. line 310, in find_action     while type(target) is dict and action[0] in target: IndexError: list index out of range ...
2023-07-08 14:28:46 +02:00
Ad Schellevis
1fa623cfd9 Firewall: Diagnostics: States - the "kill states in selection" button was hidden when selecting only a rule, which was unintentional. While here, also make sure our rule dropdown uses a searchable selectpicker. closes https://github.com/opnsense/core/issues/6635 2023-07-08 11:55:00 +02:00
Ad Schellevis
24d90deeb9 System: Configuration: Backups - improve configuration import when interfaces or console settings are not matched. closes https://github.com/opnsense/core/issues/6654
o Offer "Exclude console settings from import." option, enabled by default
o Make sure Interfaces->Assignments shows and validates non-existing configured interfaces to ease tracking down the changes
o use is_interface_mismatch() to signal probably incompatible change and signal the user in that case (postpone reboot)
2023-07-06 16:39:39 +02:00
Ad Schellevis
8fbf2dd7f9 Services: Captive Portal - minor improvments, make sure to initialize database if cp_clients table doesn't exist 2023-07-06 13:32:12 +02:00
Stephan de Wit
58387deddb fix plist 2023-07-06 10:01:55 +02:00
Ad Schellevis
8ca3d47c54 VPN: IPsec: Mobile Clients - add radius server selection for "Connections" when radius is not defined in legacy phase1's. closes https://github.com/opnsense/core/issues/6602 2023-07-06 09:53:47 +02:00
Ad Schellevis
9cd3ce7f5f Services: Unbound DNS - move unbound-blocklists.conf to configuration location. As configd will inherit the parents access rights, /tmp will be world writable. Moving this file to unbound's etc location will prevent this from happening. cc @swhite2 2023-07-05 17:45:36 +02:00
Stephan de Wit
4b7a1ce85b
dhcp: migrate leases page to MVC (#6643)
- reworks the get_leases.py script to accomodate the "last declaration is the current one" logic from dhcpd.leases(5). (neither core nor plugins is currently using this action)
- includes binding states for failover setups in dhcpd.py lease file parsing. These are included in the leases page if show inactive is selected.
- adds small utility function in Firewall/Utility to check wheter a given IP (4 or 6) is within the bounds of a given CIDR block. Needed to bind a lease declaration to an interface in the front end.
- remove dhcpleaseinlocaltime property from services_dhcp.php. dhcpd.py works with epochs, so we only need to convert to a sensible local date in the controller.
- implements multiselect lease deletion
- implements multiselect interface filtering
- does not yet hook into ApiMutableServiceControllerBase, since the legacy configuration makes it a bit tricky.
2023-07-05 10:02:13 +02:00
Ad Schellevis
6bc025af17 login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete
(bugfix 3c2f32ec8d)
2023-07-04 20:52:13 +02:00
Ad Schellevis
e60e4cd9c2 VPN/IPse/SPD - refactor/simplify SPDField type for manual SPD items 2023-07-03 21:59:03 +02:00
Ad Schellevis
c9ee110a7b VPN: IPsec: Virtual Tunnel Interfaces - cleanup/simplify VTIField type 2023-07-03 21:48:23 +02:00
Ad Schellevis
b8cef701e2 Firewall / Aliases - cleanup AliasField to use new getStaticChildren() 2023-07-03 21:38:31 +02:00