14922 Commits

Author SHA1 Message Date
Ad Schellevis
69e424acec boot: offer template generation max 10 seconds to wait for configd socket, for some reason it still fails on some platforms (not yet available) 2023-02-09 14:54:22 +01:00
Ad Schellevis
6d33df1bb9 Interfaces: Other Types: VLAN - missing a config lock on delete, preventing multiple delete to function properly 2023-02-09 13:21:24 +01:00
Ad Schellevis
63bac3c6ca MVC/ApiControllerBase - cleanse $record input in searchRecordsetBase before usage, older php versions allowed to send null, which will crash out on later versions.
Although we do silently ignore the issue now, most callers likely are sending null when trapping into this issue and the user should receive an empty grid anyway in these cases.

```
/usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php:60: array_keys(): Argument #1 ($array) must be of type array, null given
```
2023-02-09 10:49:11 +01:00
Franco Fichtner
7609985e69 ipsec: some style and reduce indent since disable if returns anyway 2023-02-09 09:50:41 +01:00
Franco Fichtner
b73e5dd641 system: protect against more scripts on bootup
All of these could trigger routing or filter reconfiguration (in turn
also routing).
2023-02-09 09:39:05 +01:00
Franco Fichtner
f8a9e5b990 openvpn: minor adjustments 2023-02-09 08:22:10 +01:00
Franco Fichtner
0dfa6c44af ipsec: oops for #6309 2023-02-08 17:14:26 +01:00
Franco Fichtner
a9dcd3f825 ipsec: migrate duplicated cron job; closes #6309 2023-02-08 17:11:15 +01:00
Franco Fichtner
748b46b393 system: bring ZFS to front of cron job description 2023-02-08 16:28:07 +01:00
Franco Fichtner
d017169a7e system: configctl plugins configure %s %s is too broad and unused 2023-02-08 16:16:09 +01:00
Franco Fichtner
90495e946a system: remove stray fclose() 2023-02-08 10:29:11 +01:00
Franco Fichtner
85fe552d5f firewall: better fix for previous 2023-02-08 07:27:25 +01:00
Franco Fichtner
02a05a4d4c src: style et al 2023-02-08 07:07:15 +01:00
Ad Schellevis
1e28d5b352 VPN:OpenVPN: Servers - deferred authentication, work in progress for https://github.com/opnsense/core/issues/6293
This initial commit focusses on structuring the event flow around user and client registration, moving events to our new ovpn_event.py handler.
By supporting both deferred and direct authentication in user_pass_verify.php, we should be able to start with a cleanup patch for OpenVPN 2.5.x and work our way up to
a smaller fix for 2.6.x.

In preperation for 2.6, this commit also moves --cipher to --data-ciphers-fallback as suggested by the warning "DEPRECATED OPTION: --cipher set to '' but missing in --data-ciphers". Rename the option in the gui while there and add a note in the help text.
2023-02-07 19:26:29 +01:00
Franco Fichtner
f984b7af16 system: style sweep 2023-02-07 16:47:41 +01:00
Franco Fichtner
655c4024ff system: prevent local issues with gif route 2023-02-07 16:36:04 +01:00
Franco Fichtner
13583073bf system: prevent bad address like host route case 2023-02-07 15:59:41 +01:00
Franco Fichtner
2618c2b91b system: prevent spurious far gateway detect
Reported for DHCP in #5493 consider that all connectivity modes
that create a router file to be eligable for this only.  VIPs
do overcomplicate this but that is also where the gateway has
to be explicit instead of being provided at a later time, which
makes the validations fail which is why we end up here.

Also move the current route check to avoid some work.  The check
is not 100% when flipping the far behaviour but doing less work
and keeping the current behaviour is fine.
2023-02-07 15:59:41 +01:00
Franco Fichtner
3e749e1132 system: use singleton implementation everywhere 2023-02-07 15:42:31 +01:00
Franco Fichtner
0e286b3a34 firewall: do not switch gateway on bootup 2023-02-07 14:45:27 +01:00
Franco Fichtner
09b2bec389 pkg: remove CORE_FLAVOUR handling 2023-02-07 09:22:33 +01:00
Stephan de Wit
3170c77880 Unbound: small optimizations
No need to register callbacks when stats are not enabled and no need to use
a circular buffer on the logger side since we don't need to append left. This avoids
the need for converting it to a list.
2023-02-07 09:13:42 +01:00
Ad Schellevis
fa72225d8d Services: Unbound DNS: Advanced - extend logging, fix for 707779fbf4 (https://github.com/opnsense/core/issues/6296) 2023-02-06 15:22:46 +01:00
Stephan de Wit
27f4c6fa6f Firewall: Rules: spelling 2023-02-06 11:01:39 +01:00
Stephan de Wit
75807588ed Reporting: Unbound DNS: fix style issues 2023-02-06 10:43:43 +01:00
FingerlessGloves
0af31b474d
Interfaces: Virtual IPs: Settings / Make description field show for all types of VIP (#6304)
Currently description only shows for CARP type, but the description should show for all.
2023-02-05 11:53:30 +01:00
Franco Fichtner
eb1367cc57 dhcp: curious why #6263 happens 2023-02-04 15:09:36 +01:00
Stephan de Wit
0ff715f827 Reporting: Unbound: Remove debug msg 2023-02-03 10:16:34 +01:00
Stephan de Wit
dd720b45b4 Reporting: Unbound: save logarithmic setting in localstorage 2023-02-03 10:05:30 +01:00
Stephan de Wit
9966db9946 Unbound: Advanced: Add serve-expired settings 2023-02-03 09:22:21 +01:00
Stephan de Wit
e0469001a6 Unbound: dnsbl_module: add HTTPS record type 2023-02-03 09:11:18 +01:00
Ad Schellevis
7a434a6845 Reporting: Unbound DNS - minor logger cleanups and don't try to "delete" every 10 seconds. 2023-02-02 13:44:43 +01:00
Franco Fichtner
0c92ec5935 firewall: roll this back for now
The problem is htmlspecialchars() most likely and html_safe() is fixed now.
2023-02-02 12:20:57 +01:00
Franco Fichtner
a0e3b6865a ui: solve deprecation in PHP via html_safe() wrapper 2023-02-02 12:17:31 +01:00
Ad Schellevis
02f44d9024 Reporting: Unbound DNS - duckdb consuming a lot of time doing index maintenance, this should lower the cpu load significantly. 2023-02-02 12:02:59 +01:00
Ad Schellevis
958ff5b7ca Lobby: Dashboard / IPsec - refactor widget to use new data format. closes https://github.com/opnsense/core/issues/6297 2023-02-02 08:57:29 +01:00
Ad Schellevis
707779fbf4 Services: Unbound DNS: Advanced - extend logging , closes https://github.com/opnsense/core/issues/6296
Add log-servfail to identify why queries return SERVFAIL to clients, log-local-actions to debug local zone actions when enabled and val-log-level to log validation failures.
2023-02-01 21:27:38 +01:00
Ad Schellevis
3d6876ee1d VPN: IPsec: Lease Status - bugfix username parsing, closes https://github.com/opnsense/core/issues/6294 2023-02-01 18:13:36 +01:00
Ad Schellevis
484e89f8bd VPN: IPsec: Status Overview - change column sizing, hide local/remote auth by default. for https://github.com/opnsense/core/issues/6294 2023-02-01 15:16:28 +01:00
Stephan de Wit
977dd3194b Unbound: Logger: switch client update list to a set 2023-02-01 11:52:48 +01:00
NOYB
f4ea699d5b More concise alias name validation error message and help text. 2023-02-01 08:55:09 +01:00
Franco Fichtner
05cc292031 interfaces: fix rename after proto addition
'proto' was set on to be deleted VLANs preventing them to be
deleted and also causing the new VLAN not to gain the proper
settings.  Likely needs a reboot on systems where this bad
state was reached since the system will not delete stray VLAN
devices it does not know about anymore/failed to delete before.

PR: https://forum.opnsense.org/index.php?topic=32225.0
2023-02-01 08:28:44 +01:00
Ad Schellevis
af7f4bacca Firewall/Alias - safeguard download_geolite() and log error after fetching a corrupted geoip zipfile 2023-01-31 21:51:47 +01:00
kulikov-a
4ada25398e
MVC/Firewall/Util - prevent possible infinite loop (#6288)
Prevent possible infinite loop in getPortAlias if alias references itself somehow
2023-01-31 17:55:37 +01:00
kulikov-a
6bb7da4cbf
Firewall/NAT/Port Forward - dont calc local port range for alias (#6289)
if port alias is specified as a Redirect target port, range is not calculated for rdr rule (first port in alias is used)
2023-01-31 16:50:23 +01:00
Franco Fichtner
fdcd17cd57 src: style tweaks 2023-01-31 13:09:28 +01:00
Franco Fichtner
6b61295721 firewall: merge both alias name validations; closes #6287
Disallows number and __ as prefix as well as a singe underscore.
If we restrict this we better do it now in single batch.
2023-01-31 11:23:56 +01:00
Franco Fichtner
70ced4f262 system: let our functions deal with null == '' as they used to
There is no point in adding control flow to callers that lead
to the same result in edge cases anyway.

Some parts of the code seem to be abusing ip_in_subnet() but
we can just return false in that case as the IP is not in the
empty subnet.
2023-01-31 09:33:50 +01:00
Franco Fichtner
396fdee7cd firmware: shared get_crash_report() to local has_crash_report()
It is no longer used anywhere else.
2023-01-31 09:08:50 +01:00
Franco Fichtner
0b04cc5efc system: deal with shell_exec() vs. trim() by wrapping all into shell_safe() 2023-01-31 09:01:12 +01:00