12749 Commits

Author SHA1 Message Date
Ad Schellevis
a4c482f66c Config: prevent config crashes when an attribute already exists, while here also make sure we report the error as it will now silently fail. SimpleXMLElement's addAttribute() is only valida when the it doesn't already exist.
Strangly enough, this doesn't seem to happen very often, but during ha sync we are able to crash without notice.
2022-05-02 16:38:30 +02:00
Ad Schellevis
00bd62fbdd Services / Unbound - change grid label when no results are returned (https://github.com/opnsense/core/issues/5752). Should make master/detail more explicit without complicating the world. 2022-05-01 19:16:30 +02:00
Franco Fichtner
ba2da34854 system: only restore missign or zero size ACL files #5746 2022-04-29 10:04:38 +02:00
Ad Schellevis
ba413ce7c5 MVC - API usage : destinct between 401 (Unauthorized) and 403 (Forbidden) when authorisation (or authentication) fails. closes https://github.com/opnsense/core/issues/5749 2022-04-28 20:28:06 +02:00
Ad Schellevis
14e210815b Services: Unbound DNS: Overrides - Restore duplicate domain behaviour to how it was before refactoring to MVC. Sort overrides per domain, suppress "forward-zone:" sections when the previous entry is the same. closes https://github.com/opnsense/core/issues/5748 2022-04-28 18:54:03 +02:00
Ad Schellevis
eb0eb519db Services: DHCPv4 : leases - Move delete action to separate script in configd and offer the ability there to cleanse leases file for duplicate static leases. Since remove a single address or a list of (mac) addresses are two sides of the same coin it seems to make sense to add a script responsible for dhcpdv4 lease cleanup.
Hooking this into dhcpd_dhcp_configure before startup also closes https://github.com/opnsense/core/issues/5724
2022-04-28 14:30:46 +02:00
Franco Fichtner
0cbb2514b6 interfaces: plug vxlan into device population mechanism #5411
Adds pluginctl -d mode to list device types supported, their device
names and finally allows calling a device reconfiguration by name.

This is only the beginning of vlxan refactor.
2022-04-28 10:45:22 +02:00
Franco Fichtner
6e69e7e5db mvc: style sweep 2022-04-28 10:42:15 +02:00
Franco Fichtner
4080345a59 interfaces: include VIPS for primary IPv4 detection #5742
This was surfaced in 22.1.1 when CARP was treated as an alias as well
leaving setups with "none" IPv4 configuration stranded when calling
get_interface_ip() if the service does not support any explicit listening
on a CARP address (which the function actually does support).  Caveats
apply as to which VIP will win as with the code before.  Best used with
just one CARP address.  IP alias doesn't as much sense since that would
be a static IPv4 configuration.

The latter is the reason why we cannot make a similar change to IPv6
where the primary concept is not equal to "first address in ifconfig"
for (sad) reasons.
2022-04-27 14:13:49 +02:00
Franco Fichtner
ab71380a07 interfaces: not sure why interface_ppps_configure()... #5637
... would be called a number of times during bootup.  Since it's
a WAN interface that is attached there seems little risk of it
having to be reconfigured multiple times during boot unless the
link is flapping but rc.linkup doesn't react to boot as well so
again not sure what the problem might have been.

Code was commented out in pfSense in 2014 shortly after forking
and eventually removed in 2019.
2022-04-27 10:14:16 +02:00
Franco Fichtner
656801803a interfaces: remove two /var/run/booting uses #5637
Going back to #2394 flipflop more of the reload stack to get to the
point of understanding the 6rd/6to4/slaac WAN situation and killing
two uses of /var/run/booting in the process.
2022-04-27 10:04:25 +02:00
Franco Fichtner
249afc5877 interfaces: revert futile parts of b34ba9a61f655 #5630 2022-04-27 08:38:06 +02:00
Ad Schellevis
9ff04d14b4 firewall: make rule parsing more consistent as x:any and any:y are valid options, accepting literal "any" seems to make sense. closes https://github.com/opnsense/plugins/issues/2957 2022-04-25 18:08:00 +02:00
Ad Schellevis
43958b00cc Services / Unbound DNS / Blocklist - add custom "Destination Address" as advanced option, closes https://github.com/opnsense/core/pull/5736 2022-04-22 21:25:11 +02:00
Stephan de Wit
fc8890851a MVC: fix two regressions and deprecate __items
Before the phalcon5 compatibility layer, the unit tests were broken due to __isset()
being triggered by an isset call on an __items attribute in getConstraintValidators().
Since __items is only used in BaseField itself, we choose to remove it for further use. Instead,
we rely on __isset() to verify if elements exist in internalChildNodes when a subnode is accessed directly.

The second regression lived in validate() in the custom Validation implementation. Instead
of relying on the incoming data as a key, we iterate through all validators active during the objects' lifetime since
these are set prior to validation. This regression affected all constraints.
2022-04-22 16:44:59 +02:00
Franco Fichtner
2606c471c5 importer: missing loop exit 2022-04-22 08:38:45 +02:00
Franco Fichtner
a507738bbd importer: add verbose mode 2022-04-22 08:30:40 +02:00
Franco Fichtner
206f0d2f12 importer: support cd9660 type for #5733 2022-04-22 08:23:39 +02:00
Ad Schellevis
7740f241a5 VPN: IPsec: Tunnel Settings - mark unsortable columns. 2022-04-21 19:13:12 +02:00
Ad Schellevis
4ec9ea3d1a MVC - ApiControllerBase : safeguard multi_sort in searchRecordsetBase() when non-existing column is passed
ref : https://forum.opnsense.org/index.php?topic=28043.msg136169#msg136169
2022-04-21 19:06:58 +02:00
Ad Schellevis
26f72adaf6 Reporting: NetFlow - fix validation, closes https://github.com/opnsense/core/issues/5729 2022-04-20 18:15:17 +02:00
Franco Fichtner
02781756f0 system: tunables without hierarchy are just "environment" variables; closes #5719
They may do something or they don't, but it's wrong to label them
as "unsupported".
2022-04-20 14:55:56 +02:00
Franco Fichtner
918ef316df firewall: add missing range validation to alias host type #5723 2022-04-20 12:40:11 +02:00
Franco Fichtner
948235bc1d mvc: style sweep et al 2022-04-20 10:13:46 +02:00
Stephan de Wit
cfd4b7635f
Phalcon5 migration: provide compatibility layer between v4 and v5 (#5711)
* phalcon5: update namespaces

* phalcon5 Autoload: rename registerDirs() to setDirectories()

* phalcon5: remove trailing slash

* phalcon5: default to php74-phalcon

* phalcon5: provide 4/5 compatibility layer except for AbstractValidator

* MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes.

Since Validation() in 5 moves to Filter\Validation (https://docs.phalcon.io/5.0/en/upgrade#general-notes) and the class is used in strict parameter passing,
it will be difficult to import a situation which works both on 4 and 5.

To prevent future issues, but keep the current situation functional with minimal changes, we wrapped Validation() into a class of our own. When validators inherit from BaseValidator, these are assumed to
be less strict and bound to our own handling. Phalcon validations will follow the old path for now.

Migrating existing validations on our end, should be as simple as changing the following lines:

-use Phalcon\Validation\AbstractValidator;
-use Phalcon\Validation\ValidatorInterface;
-use Phalcon\Validation;
+use OPNsense\Base\BaseValidator;

-class CallbackValidator extends AbstractValidator implements ValidatorInterface
+class CallbackValidator extends BaseValidator

-    public function validate(Validation $validator, $attribute): bool
+    public function validate($validator, $attribute): bool

Todo: choose the "correct" Validation() based on phalcon version.

* phalcon5: complete migration to compatibility layer.

uses bc881b9c11 to remove the need
for AbstractValidator and Validator(Interface).

This commit changes the relevant includes and provides some changes to make the unit tests
run correctly.

* MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes. part duex

Although our previous strategy should work according to how bind() and validation() are being implemented (https://github.com/phalcon/cphalcon/blob/4.2.x/phalcon/Validation.zep),
in reality it seems they aren't the same. Our previous attempt failed some validations (such as booleans) for no valid reasons.

Long term we should remove the phalcon dependency as these effects are highly unpredictable.

phalcon5: update Validation class to now pick the right Phalcon Validation based on version

* MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes.

Minor regression in previous commit, performValidation()'s return type didn't match. Ideally we would rather switch to plain array's, but since performValidation()
is used in multiple areas (including plugins) we better opt for compatiblity now.

ref  https://github.com/opnsense/core/pull/5711

* phalcon5: switch back to using count() on Messages object, adjust unit tests as needed

See 6814f32755 as to why
this is the case.

* phalcon5: remove PhalconGenerator and references, use checked-in files instead

* Update Makefile

Co-authored-by: Franco Fichtner <franco@opnsense.org>

Co-authored-by: Ad Schellevis <ad@opnsense.org>
Co-authored-by: Franco Fichtner <franco@opnsense.org>
2022-04-20 10:05:26 +02:00
Franco Fichtner
d236c7a1b9 mvc: style sweep 2022-04-19 08:27:22 +02:00
Ad Schellevis
3c59ca1269 Firewall / Aliases - change log level on geoip download to notice (it's message, not an error) 2022-04-16 02:56:57 +02:00
Ad Schellevis
fcef2d65d2 Firewall: Diagnostics: Aliases - simplify sort and add natural sorting. closes https://github.com/opnsense/core/pull/5716 2022-04-16 00:58:28 +02:00
Ad Schellevis
6814f32755 MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes.
Minor regression in previous commit, performValidation()'s return type didn't match. Ideally we would rather switch to plain array's, but since performValidation()
is used in multiple areas (including plugins) we better opt for compatiblity now.

ref  https://github.com/opnsense/core/pull/5711
2022-04-15 23:41:54 +02:00
Ad Schellevis
c67ca3fd87 MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes. part duex
Although our previous strategy should work according to how bind() and validation() are being implemented (https://github.com/phalcon/cphalcon/blob/4.2.x/phalcon/Validation.zep),
in reality it seems they aren't the same. Our previous attempt failed some validations (such as booleans) for no valid reasons.

Long term we should remove the phalcon dependency as these effects are highly unpredictable.
2022-04-15 17:53:25 +02:00
Luis Nachtigall
e23de4c457
Update blocklists.conf (#5710)
Changed no coin list as old one is inactive/archived
2022-04-15 08:36:28 +02:00
Ad Schellevis
ee3c05bc0b Firewall / Aliases - add markUnchanged() in BaseField type so we can avoid validation on virtual fields (issue introduced in https://github.com/opnsense/core/pull/5668) 2022-04-14 17:56:20 +02:00
Ad Schellevis
bc881b9c11 MVC - Phalcon 5 migration and options to lose dependency of phalcon validation classes.
Since Validation() in 5 moves to Filter\Validation (https://docs.phalcon.io/5.0/en/upgrade#general-notes) and the class is used in strict parameter passing,
it will be difficult to import a situation which works both on 4 and 5.

To prevent future issues, but keep the current situation functional with minimal changes, we wrapped Validation() into a class of our own. When validators inherit from BaseValidator, these are assumed to
be less strict and bound to our own handling. Phalcon validations will follow the old path for now.

Migrating existing validations on our end, should be as simple as changing the following lines:

-use Phalcon\Validation\AbstractValidator;
-use Phalcon\Validation\ValidatorInterface;
-use Phalcon\Validation;
+use OPNsense\Base\BaseValidator;

-class CallbackValidator extends AbstractValidator implements ValidatorInterface
+class CallbackValidator extends BaseValidator

-    public function validate(Validation $validator, $attribute): bool
+    public function validate($validator, $attribute): bool

Todo: choose the "correct" Validation() based on phalcon version.
2022-04-14 17:52:14 +02:00
Franco Fichtner
83779cd324 firmware: list locked packages in health audit
Might be relevant to update issues as reported via Reddit.
2022-04-14 12:57:00 +02:00
Ad Schellevis
f91d7f44e6 VPN / OpenVPN / Client Export - change filetype to test/ovpn, closes https://github.com/opnsense/core/issues/5687
While here, also validate if client_cn exits before usage.
2022-04-13 19:03:36 +02:00
Franco Fichtner
fa1511652d dpinger: allow up to three arguments passed
Required for RRD bootup change.  The default argument pass is 1
for historic reasons.
2022-04-13 09:02:16 +02:00
Franco Fichtner
c5fc553ecf firmware: force all should indicate base/kernel reinstall; closes #5701 2022-04-13 08:32:55 +02:00
devin122
6de64cf9d7
Services / Unbound - overrides: fix handling of wildcard aliases (#5707)
Wildcard functionality of HostnameField was refactored
See f110c988d4c5722308d0ec7a4ef5b86c0b3f767c
2022-04-12 21:33:07 +02:00
Ad Schellevis
9a913fd3ca Services / Captive portal - add extendedPreAuthData checkbox to support returning the client mac address when /api/captiveportal/access/status/<zone>/ is called for authentication. closes https://github.com/opnsense/core/issues/5684 2022-04-12 16:20:37 +02:00
Ad Schellevis
43777a5465 Firewall: Diagnostics: Sessions - fix ACL for used api's. closes https://github.com/opnsense/core/issues/5692 2022-04-12 15:33:17 +02:00
Ad Schellevis
833b0904c4 Service / Unbound - ACL mismatch for overrides closes https://github.com/opnsense/core/issues/5704 2022-04-12 15:27:30 +02:00
Stephan de Wit
b5b7670b48 Unbound: sort on host/domain name for overrides 2022-04-12 10:33:15 +02:00
Franco Fichtner
2a3f201d38 firmware: use isolated directory for database update check
Otherwise we end up trashing our main package database.

PR: https://forum.opnsense.org/index.php?topic=27875.0
2022-04-12 10:25:39 +02:00
NOYB
ef989b21d0 unbound: overrides: mvc: case sort order
Unbound host and domain sort order.

Host and domain names are case insensitive.  Should be handled case insensitively.  myHost comes before YourHost.  Always.

Sort order should be:
myHost
YourHost

Not:
YourHost
myHost
2022-04-12 10:25:22 +02:00
Franco Fichtner
38848023e8 src: style sweep 2022-04-12 08:10:28 +02:00
Stephan de Wit
0e3a02bfd2
Unbound overrides: fix validation message style issue (#5700) 2022-04-11 18:23:24 +02:00
Stephan de Wit
de9f860fdd Unbound / Domain overrides: accept _msdcs since legacy supported it. Closes #5697 2022-04-11 16:39:06 +02:00
Franco Fichtner
e378d0e0fc plugins: old plugins with missing functions may produce fatal errors
PR: https://forum.opnsense.org/index.php?topic=27901.0
2022-04-11 15:24:08 +02:00
Franco Fichtner
47bd7f4568 firewall: change "product" to "automatic" and sort both lists a bit 2022-04-11 14:57:39 +02:00
Franco Fichtner
2d84691768 firmware: cross-version check not using correct information 2022-04-11 12:14:07 +02:00