14833 Commits

Author SHA1 Message Date
Franco Fichtner
7fa6fbbc5d system: wording on previous 2023-01-20 14:43:02 +01:00
Stephan de Wit
83faa69d47 unbound: prevent a traceback in syslog on an intended interruptedError 2023-01-20 14:40:25 +01:00
Franco Fichtner
a230326d7f system: prevent removing host routes in edge case; closes #6244 2023-01-20 14:24:46 +01:00
Franco Fichtner
b2d9eb2e36 system: fix undefined var edge case 2023-01-20 14:24:46 +01:00
Stephan de Wit
cb510320fa unbound: fix deadlock by specifying a pidfile to daemon 2023-01-20 12:52:50 +01:00
Franco Fichtner
f60333622a interfaces: for now bring back duality of PPPoEv6 and other types
This doesn't invalidate the PPPoEv6 mode, but it does keep the race
between router files for different types.  In this case e.g. Telekom
ISP will require the IPv6 from PPPoE to be set in order to be able
to do DHCPv6 for whatever reason.

PR: https://forum.opnsense.org/index.php?topic=31955.0
2023-01-20 09:41:05 +01:00
Franco Fichtner
e27234b4cc firmware: almost there 2023-01-19 15:22:10 +01:00
Ad Schellevis
473b106081 VPN/IPsec : php 8 issue, fix : PHP Fatal error: Uncaught TypeError: in_array(): Argument #2 ($haystack) must be of type array, null given in /usr/local/www/vpn_ipsec_phase1.php:997 2023-01-19 13:50:30 +01:00
kulikov-a
b84170819f
fix regression in previous. typo (#6253)
fixes Updates tab behavior after checking for updates
2023-01-19 12:58:54 +01:00
Franco Fichtner
a1569e8938 intrusion detection: suricata_flags defaults to -D #6189
Since we overwrite the flags the daemon mode is not invoked
causing the system boot to hang when suricata starts.
2023-01-19 09:14:36 +01:00
Franco Fichtner
585311cedd system: support tier here in core as well #5983 2023-01-18 15:07:12 +01:00
Franco Fichtner
46965bfb66 intrusion detection: add verbose mode selector for suricata; closes #6189 2023-01-18 14:25:04 +01:00
kulikov-a
fd2be18809
firmware.volt: responsiveness fix (#6210)
make tables responsive (by moving .table-responsive to the parent div)
workaround bootstrap "dropdowns inside responsive table" issue
don't let the buttons fall apart
2023-01-17 10:48:46 +01:00
Franco Fichtner
86e1cb936f system: also add zpool-trim command
Background both commands to avoid spurious timeouts.
We do not process output anyway.

PR: https://forum.opnsense.org/index.php?topic=31143.0
2023-01-16 13:43:16 +01:00
Franco Fichtner
082b4b29f2 system: style sweep 2023-01-16 13:35:33 +01:00
Iain Henderson
8524775dd6 Add a cron task for scrubbing zfs pools 2023-01-16 13:34:26 +01:00
Franco Fichtner
3d73c42f5f mvc: another typo 2023-01-16 11:24:22 +01:00
Franco Fichtner
7ac205d7b4 system: this probably works better #6227 2023-01-16 11:03:55 +01:00
Franco Fichtner
b13232391e mvc: implement getRealInterface() variant related to #6227 2023-01-16 10:47:58 +01:00
Franco Fichtner
88e97fe7e1 interfaces: minor simplification 2023-01-16 10:00:38 +01:00
Frans J Elliott
1febdd9f88
Fixed route-to interface not being set correctly in firewall rules when using 6rd/6to4 IPv6 gateways with gateway groups. (#6227) 2023-01-16 09:45:37 +01:00
Franco Fichtner
c991075d95 interfaces: clean this up more
Explicit checks on IPv6 on PPP types, except the PPP itself
since it works on a device node instead and has no visible
parent device.
2023-01-16 09:37:47 +01:00
Franco Fichtner
f7dafda837 interfaces: simplify get_real_interface() a little relasted to #6245
The IPv6 case for PPP interfaces is a little convoluted and needs further
cleanup.  For now make sure that we only fiddle with $realif default if
there is need for it instead of changing and reverting back later.
2023-01-14 12:06:51 +01:00
Franco Fichtner
9934ef0935 interfaces: short road to PPPoEv6 interface #6245
There's a bit too much trickery involving get_ppp_parent() inside
get_real_interface() which internally calls get_real_interface()
again and produces the mismatch we see.

We can safely assume that PPPoE always has a PPPoE device like the
IPv4 case and be done with it.
2023-01-14 11:21:01 +01:00
Franco Fichtner
db2bcf716e interfaces: ifconfig doesn't like reordering, should have been tested 2023-01-12 10:00:14 +01:00
Franco Fichtner
369f212083 firmware: add hint for 23.1-RC1 2023-01-11 14:43:58 +01:00
Stephan de Wit
b4f20a4e41 Diagnostics: Packet Capture: Fix description
Closes https://github.com/opnsense/core/issues/6236
2023-01-11 14:35:58 +01:00
Stephan de Wit
1e07a736e5 Reporting Unbound DNS: add drill-down for client graph 2023-01-11 14:22:39 +01:00
Stephan de Wit
5c51182e21 Unbound: Logger: catch all exceptions (except for interrupts)
Turns out the are more exceptions hidden underneath so to be safe we catch all of them.
If we're unable to resolve a hostname for whatever reason, we'd like to continue on anyway.
2023-01-11 11:30:59 +01:00
Franco Fichtner
f5323689f3 src: style sweep 2023-01-10 16:43:00 +01:00
Stephan de Wit
329d94de23 Unbound: Logger: remove unused argument 2023-01-10 10:02:37 +01:00
Franco Fichtner
36c6b35314 plugins: avoid spurious updates due to OpenVPN group setup 2023-01-10 09:46:21 +01:00
Stephan de Wit
8a1215aeee Reporting: Unbound DNS: include resolved hostnames in detailed grid as well 2023-01-09 12:42:21 +01:00
Franco Fichtner
a6c4113508 system: syslog.LOG_DEAMON is a facility
Might have unintentional side effecs but bitmask use with wrong
numeric value is dangerous as well.

See: https://docs.python.org/3/library/syslog.html
2023-01-09 12:22:45 +01:00
Stephan de Wit
0c0380295a Unbound: redirect logger errors to syslog 2023-01-09 12:17:05 +01:00
Stephan de Wit
0d9c4fa625 Unbound: use daemon -f instead of nohup 2023-01-09 11:57:02 +01:00
Stephan de Wit
78e575b53f Unbound: catch socket.herror as well, make sure to catch bidirectional changes
in reverse DNS results
2023-01-09 11:44:07 +01:00
Franco Fichtner
e36d4903c0 pkg: happy new year! 2023-01-09 11:18:19 +01:00
Stephan de Wit
5a3765a0c1 Reporting: Unbound DNS: resolve hostnames for clients 2023-01-09 11:12:13 +01:00
Stephan de Wit
0474d2558f unbound: nohup and background logger instead of daemonizing it 2023-01-09 11:08:26 +01:00
Franco Fichtner
49c74024a7 system: repair regex for FreeBSD 13 #6234 2023-01-09 09:41:44 +01:00
Franco Fichtner
7a6a102913 ipsec: fix permission 2023-01-06 15:04:01 +01:00
Stephan de Wit
6ca0e5b58f Reporting: Settings: restructure to keep each setting category in a single table 2023-01-04 10:42:58 +01:00
Ad Schellevis
14f3a741dd Lobby/Dashboard - show size of ZFS ARC (Adaptive Replacement Cache) in memory usage at system information widget.
Although arc should keep enough memory free for normal operation, people can always tune the defaults as explained in https://docs.freebsd.org/en/books/handbook/zfs/#zfs-advanced , knowing the current amount helps tuning decisions.
2023-01-03 16:23:03 +01:00
Stephan de Wit
4a5406424f Reporting: Unbound DNS: Tweak UI and usability improvements
- Increase the reporting interval for 12 & 24 hours to 10 minutes.
- Always display a list for the top (blocked) domains
- Remove block/whitelist buttons when blocklists are disabled
2023-01-03 13:47:37 +01:00
Ad Schellevis
c3f4183171 Reporting: Unbound DNS - minor adjustments [2] 2023-01-03 10:36:13 +01:00
Ad Schellevis
4c89da2fa5 Reporting: Unbound DNS - minor adjustments
o select "Overview" tab by default
o start with empty graphs and load next, smoothens page load a bit.
2023-01-02 21:49:12 +01:00
Ad Schellevis
720ffdc561 Interfaces: Diagnostics: Packet Capture - support mac addresses in "Host Address" field. closes https://github.com/opnsense/core/issues/6159 2023-01-02 17:46:38 +01:00
Stephan de Wit
e5d6acd2eb
Unbound / Blocklists: add exact domain blocking and integrate into overview page (#6205)
This include the ability to whitelist it from the same page as well. Relevant to both
the top passed/blocked domains, as well as the detailed query grid.

blocklists.py has been modified in such a way that it will detect whether it needs to
start the download process or simply administrate locally. The latter currently only happens
when custom domains for blocking have been added/removed by a user. The reasoning is
that we can easily extend/shrink the current blocklist when it comes to blocking exact
domains as this is handled on the incoming side. However, while we can modify the current
list to accomodate a new whitelist entry (which can be regex), we (currently) cannot know which domains
were skipped in the process of retrieving them in the first place if a user explicitly removes
a whitelist entry. Therefore we decide to re-run the download on a whitelist action.

furthermore, the updateBlocklistAction in the controller administrates how the model is updated
(e.g. when a blocked item is whitelisted, it should be removed from the blocklist model entry and
added to the whitelist)

In the future we could optimize the whole process by checking if a remote file has changed in
date or size.
2023-01-02 14:06:53 +01:00
Ad Schellevis
7723ccaf86 VPN/IPsec - send up/down events to charon syslog 2022-12-29 10:10:29 +01:00