15600 Commits

Author SHA1 Message Date
Franco Fichtner
74bf687034 intrusion detection: fix indent in previous 2023-08-17 08:02:32 +02:00
Monviech
119537dfc4
"bypass" keyword in suricata user defined rules (#6752) 2023-08-16 21:38:02 +02:00
Franco Fichtner
6095400258 interfaces: typo 2023-08-16 15:58:21 +02:00
Franco Fichtner
2935d13e45 interfaces: adjust MTU for VLAN parents
For a VLAN on top of HW this doesn't seem required (although it makes sense)
the VLAN on top of VLAN actually needs this so add it for both.

It should be said that this is simply trying to fix setting oversize MTU
values and therefore now backs off when the parent MTU fits the requirement.

Still try to set any bad MTU value configured by the user.
2023-08-16 15:29:50 +02:00
Franco Fichtner
c1411950d7 interfaces: typo in previous 2023-08-16 15:04:28 +02:00
Franco Fichtner
6f3d78ff80 interfaces: recurse MTU set in order to fix parent first
Oversize MTU will cause the required ifconfig call to fail if we do not.
2023-08-16 14:56:05 +02:00
Franco Fichtner
fac8f85a51 interfaces: refactor interface_parent_devices() to take device name instead
This simplifies the call a little and allows us to do better recursion
away from config-based interfaces.  We could just pass the device as
the interface and it would work but then we pass it down twice and it's
not very readable.
2023-08-16 14:45:31 +02:00
Franco Fichtner
faffad558a interfaces: the parent may not be an assigned interface 2023-08-16 14:00:47 +02:00
Franco Fichtner
b33dd0ae3f interfaces: style 2023-08-16 12:03:35 +02:00
Franco Fichtner
8c9c56f9b5 interfaces: PPPoE handling for MTU is weird
* Configure PPP MTU only via mpd.conf making sure a derived MTU
  either subtracts the header as shown in interface MTU config
  or as directly set by the PPP config.
* Only set MTU on $realhwif and when it's not a device node.
* Fixup the device lookup when looking for PPPoE parents.

There seems to be an issue with qinq based MTU fixups and the fact
that the VLAN header size is not substracted, but we might just
keep it that way and fix the recursion case eventually.
2023-08-16 12:02:16 +02:00
Franco Fichtner
6781a124e1 interfaces: typo in MRU handling for PPP 2023-08-16 11:33:23 +02:00
Franco Fichtner
608ee32f25 interfaces: remove decriptive name from logging; loosely closes #6740 2023-08-16 09:13:37 +02:00
Franco Fichtner
32a6a11e6c interfaces: switch rtsold to -A mode; closes #6747
Requires a base update (src.git) to make use of the new rtsold -A flag.
No longer use -O or -M since -A will make sure to always raise the script.
2023-08-15 08:20:43 +02:00
Ad Schellevis
bb4a31d0c8 Services: DHCPv4: Leases - Performance optimalisation, reuse of list_arp.py comes at a cost and we only seem to be using the output from /usr/sbin/arp -an --libxo json 2023-08-14 20:47:34 +02:00
Ad Schellevis
3f80ddbe9e Firewall: Groups - Missing group registration (dynamic interface) on apply, might be https://github.com/opnsense/core/issues/6745 2023-08-14 17:06:00 +02:00
Franco Fichtner
42e06c5daf openvpn: pro tip by @adschellevis 2023-08-14 13:37:18 +02:00
Franco Fichtner
ee4496702d openvpn: bring instances into server field
While here condense the input a little and show the default
port in case it was left empty.

PR: https://forum.opnsense.org/index.php?topic=35337.0
2023-08-14 12:11:22 +02:00
Franco Fichtner
0a4eacfb6a openvpn: add tun-mtu/fragment/mssfix combo for CSOs #6703 2023-08-14 11:33:37 +02:00
Ad Schellevis
d5c6cc24d3 Interfaces: Virtual IPs: Status - prevent IPv6 mismatches when using compressed format. closes https://github.com/opnsense/core/issues/6742 2023-08-14 09:29:53 +02:00
Franco Fichtner
a7c1facc09 src: style sweep 2023-08-11 09:01:36 +02:00
Ad Schellevis
0ab0bf3095 VPN: IPsec: Pre-Shared Keys - add colon to supported characterlist for id fields. closes https://github.com/opnsense/core/issues/6727 2023-08-10 19:58:27 +02:00
Ad Schellevis
8f51311423 VPN: OpenVPN: Instances - properly map user groups for authentication to align with legacy code. closes https://github.com/opnsense/core/issues/6732 2023-08-10 16:26:09 +02:00
Ad Schellevis
aa81bbdace Monit - update model version 2023-08-10 14:34:36 +02:00
Stephan de Wit
80e4bec768 dhcpd: staticmap output does not contain device names 2023-08-10 14:34:04 +02:00
Stephan de Wit
5c3235872a dhcpd: missing strtoupper() 2023-08-10 14:19:36 +02:00
Stephan de Wit
69ca6343b9 dhcpd6: UI: interfaces and IPs should also clip properly 2023-08-10 14:15:53 +02:00
Stephan de Wit
7c7e508497 dhcpd6: refactor LeasesController
like the ipv4 refactor, mapping an IP to an interface
is now done using ifconfig. For ipv6, the chances of an
interface being missed using only NDP and configuration
data are pretty high. This is largely due to most
setups not having a static IP configured, but are instead
set to track an interface with DHCP functionality enabled
under the hood by default. NDP data is also ephemeral by
nature
2023-08-10 14:07:47 +02:00
Stephan de Wit
39c4f05183 dhcp: leftover debug 2023-08-10 13:40:37 +02:00
Stephan de Wit
7870064a62 dhcp: refactor LeasesController
hopefully the last bit, this will drop parsing the config
for configured dhcp interfaces and will instead match
it on the output of ifconfig. While this would normally not
cause issues for ipv4, this is mostly done to be symmetrical
with the upcoming ipv6 leases change, where it is much more
likely for interfaces to be missed.
2023-08-10 13:29:17 +02:00
Franco Fichtner
93f8b70cbd system: sometimes dpinger starts without a socket
Which isn't ideal, because then we cannot get any more readings until
it is being restarted.
2023-08-10 12:53:23 +02:00
Franco Fichtner
77ac3f5c93 system: assume first status as 'down' to get initial alert #6728
In some scenarios this is needed to recover the system correctly,
e.g. when the default gateway selected during boot is not actually
plugged in.
2023-08-10 12:15:12 +02:00
Franco Fichtner
3844bc5014 system: previous was more correct, adjust dashboard too 2023-08-10 11:10:39 +02:00
Stephan de Wit
329ca62612 dhcpv4: prevent reverse lookups during arp fetch 2023-08-10 10:49:59 +02:00
Franco Fichtner
4ecbd9240d system: ok so we report up status for non-dpinger gateways here.. 2023-08-10 10:39:46 +02:00
Michael
f8572a1274
Update Monit.xml (#6731) 2023-08-10 10:31:29 +02:00
Franco Fichtner
457f6bedf5 system: switch to config-data, not runtime data #6728
While here clean up excessive rewrites of data we already have filled.
2023-08-10 10:12:23 +02:00
Franco Fichtner
1e74ff3b3d system: shorten previous then 2023-08-10 08:31:37 +02:00
Franco Fichtner
8967be64c5 system: remove unneeded changes as well 2023-08-10 08:25:42 +02:00
Franco Fichtner
cf61c3d1e9 system: fixup 2023-08-10 08:22:57 +02:00
Franco Fichtner
26ddbd1e75 system: ironically enough gatewaysIndexedByName(true) is unreliable
We get all the gateways, but there is and override which moves the
gateway into disabled state even though we need to know about the
configured state alone, not runtime state.  Use the service info
instead.
2023-08-10 08:20:56 +02:00
Franco Fichtner
15d993af50 system: run watcher as soon as a gateway is configured for monitoring #6728 2023-08-10 08:05:00 +02:00
Ad Schellevis
605042ada8 VPN: OpenVPN - fix seperator for redirect-gateway attribute in Instances and CSO. closes https://github.com/opnsense/core/issues/6726 2023-08-09 17:09:34 +02:00
Franco Fichtner
13389c823e interface: fix special device name chars used in shell variables 2023-08-09 13:24:25 +02:00
Allan Que
ad097da1be ntpd: fix 'Soliciting pool server'
From ntp.conf man page:
if you want to use servers from a pool directive and also want to use nopeer by
default, you'll want a restrict source ... line as well that does not include
the nopeer directive.
2023-08-09 06:42:30 +02:00
Stephan de Wit
f09d4e40f5 dhcpv6: missing string cast 2023-08-08 15:21:08 +02:00
Stephan de Wit
b842980bb4 dhcp: typo 2023-08-08 14:46:49 +02:00
Stephan de Wit
cab341129a dhcpv6: fix previous 2023-08-08 14:38:20 +02:00
Stephan de Wit
410049d5f5 dhcpv4/6: account for null values for static leases 2023-08-08 13:27:59 +02:00
Ad Schellevis
43aa7761c4 Firewall: NAT: Port Forward - do not clone 'associated-rule-id', closes https://github.com/opnsense/core/issues/6723 2023-08-08 13:15:58 +02:00
Stephan de Wit
a88fae84f6 dhcpv4/6: break on words to improve date positioning 2023-08-08 13:03:20 +02:00