13195 Commits

Author SHA1 Message Date
Franco Fichtner
b826ae3d5c src: whitespace sweep 2021-09-02 07:47:54 +02:00
Franco Fichtner
239a6e5dba firmware: masking vulnerability urls in FreeBSD due to UUID use 2021-09-01 14:36:49 +02:00
Franco Fichtner
6651a03a18 system: weirdness in port parsing that we don't use; closes #5182 2021-09-01 14:09:18 +02:00
Ad Schellevis
53cd1c7183 Squashed commit of the following:
commit 9da181580631e305cf194688479eb311d74dda9d
Author: Ad Schellevis <ad@opnsense.org>
Date:   Tue Aug 31 13:22:39 2021 +0200

    CARP: small cleanups after https://github.com/opnsense/core/pull/5184

commit 9875b53e98aeed173e1603182251b8e2165cabbb
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 22:28:03 2021 +0300

    CARP: Fix fetching VIP status

    Implement array safeguards after e44fd48

commit 9c6ff1717741ec7f21a1b88127c57ff3d849085d
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 22:23:25 2021 +0300

    CARP: Fix fetching VIP status

    Simplify code after e44fd48

commit 52ffd6ee3d471c09a69599a8fdd02f6e6ea6f2c6
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 22:19:26 2021 +0300

    CARP: Fix fetching VIP status

    Simplify code after e44fd48

commit d5ae42623e31138daa29debedc36088fa7ba4811
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 22:13:57 2021 +0300

    CARP: Fix fetching VIP status

    Simplify code after e44fd48

commit df99ba8106233a34732bb0cb39f6134d7697e4a4
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 16:39:57 2021 +0300

    CARP: Fix fetching VIP status

    Take into account translation issues

commit 45eddeb399b64e631e7d81be8ac29dc2cad97bf2
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 16:35:04 2021 +0300

    CARP: Fix fetching VIP status

    Take into account translation issues

commit a068f10cd0a4402e648a09027a6b48b90670e60a
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 15:08:51 2021 +0300

    CARP: Fix fetching VIP status

    Whitespace cleanup

commit aa958e1d04938b084a5582dd4080988aef240eaa
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 15:05:12 2021 +0300

    CARP: Fix fetching VIP status

    Remove unnecessary require_once call

    Co-authored-by: Franco Fichtner <franco@lastsummer.de>

commit 5966d1c834fe5c69845a675f0f829ec6efcabc2f
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 15:04:47 2021 +0300

    CARP: Fix fetching VIP status

    Remove unnecessary require_once call

    Co-authored-by: Franco Fichtner <franco@lastsummer.de>

commit 38d6d952084ed2db4ae2d81aa583850a38f2f7b2
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 15:03:57 2021 +0300

    CARP: Fix fetching VIP status

    Remove unnecessary require_once call

    Co-authored-by: Franco Fichtner <franco@lastsummer.de>

commit 3ae8a2f960310b4f373fbae3e77e2eea2b7ced8a
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 14:49:46 2021 +0300

    CARP: Fix fetching VIP status

    Eliminate calling get_carp_interface_status() by openvpn.inc

commit bf195f3a66ad6a1ec5c62ecb589e32681eeb86dc
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 14:04:16 2021 +0300

    CARP: Fix fetching VIP status

    Refactor the widget to call ifconfig once

commit 26bfe2036a846824b9d163d9c3c8aafd2be3ac36
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 13:58:20 2021 +0300

    CARP: Fix fetching VIP status

    Refactor the status page to call ifconfig once

commit 7cdc8eca63acfb9db8da9cf621780c30454df132
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Sun Aug 29 10:22:05 2021 +0300

    CARP: Fix fetching VIP status

    Add a space after vhid to make grep more precise
2021-08-31 13:25:03 +02:00
Franco Fichtner
e7fcd3e2bf interfaces: move two legacy functions to their only callers 2021-08-30 09:44:02 +02:00
Ad Schellevis
293fe8ab43 IPsec, regression in 7be00bc067, $right_spec translated to $ph1ent['remote-gateway'] for non-mobile in earlier versions. closes https://github.com/opnsense/core/issues/5187 2021-08-29 20:57:51 +02:00
Franco Fichtner
b9b8fd9614 src: style sweep 2021-08-29 21:16:28 +02:00
Franco Fichtner
d42dcaaa87 interfaces: function only used once 2021-08-29 20:53:54 +02:00
Ad Schellevis
e44fd48b6a interfaces - index carp entries by vhid's in legacy_interfaces_details() to ease referencing items.
since the indexes themselves aren't used, it should be safe to change the current list interpretation into a named one, this would ease operations like https://github.com/opnsense/core/pull/5184
2021-08-29 13:54:43 +02:00
Franco Fichtner
519311433d interfaces: two and a half cleanups
* Remove the unset-after-write-before-redirect logic of dhcpd on
  WAN that practically does nothing.
* At least since b6b3a5ad1d6c41 interface_bring_down() does not
  tamper with down flag of the interface avoiding the need to
  set the up flag to fix "VLAN" (multiple times).
* Remove debug output that I have never seen before.  The function
  call below will throw an error too if that is even possible.
2021-08-29 15:11:29 +02:00
Ad Schellevis
19a927ce2c firmware: a major upgrade logically also expects a reboot.
The other side could check if the action would be a major upgrade, but it feels more clear to always communicate the correct intention.
If this doesn't have side affects, we could change 1077e0a2a8/src/opnsense/mvc/app/views/OPNsense/Core/firmware.volt (L223) as well

cc @fichtner
2021-08-25 18:07:17 +02:00
Ad Schellevis
302e15ae0a Firewall / Aliases - don't try to fetch GeopIPAlias.zip from BE mirror when no license key is found 2021-08-24 17:22:21 +02:00
Alexander Shursha
b21272f499
Remove duplicate. (#5178) 2021-08-24 13:42:18 +02:00
Ad Schellevis
1656843a67 IPsec - VTI: regression in 7be00bc067 closes https://github.com/opnsense/core/pull/5179 2021-08-24 13:39:30 +02:00
Ad Schellevis
6cd8a97182 Squashed commit of the following:
commit 46e0383625acfa59e723c390d0b5b2feed8a53aa
Author: Ad Schellevis <ad@opnsense.org>
Date:   Mon Aug 23 11:05:53 2021 +0200

    Firewall / Log - Live log : support rfc5424 format for https://github.com/opnsense/core/pull/5175

commit 0cf3030724d02181991436b324fe5fc70118d4d5
Author: Ad Schellevis <ad@opnsense.org>
Date:   Sat Aug 21 09:36:56 2021 +0200

    System logging - switch local logging to rfc5424 format.

    Allow custom destinations to choose for rfc5424. closes https://github.com/opnsense/core/issues/4911

commit a46e39bcecca6dab1d5a68a0e7f481ea42c16034
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 20 18:23:22 2021 +0200

    System logging - switch local logging to rfc5424 format.

    add severity filter to api and log pages

commit b0f38003d7745a01202ffca5e7b5b697ff211f1e
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 20 15:42:58 2021 +0200

    System logging - switch local logging to rfc5424 format.

    Split BaseLogFormat into a generic LogFormat and a child NewBaseLogFormat to be able to support both property and method based parsers to keep (external) plugins compatible.

commit 264513f148185faf4a4509bc19aa35739c9844f9
Author: Ad Schellevis <ad@opnsense.org>
Date:   Thu Aug 19 19:56:19 2021 +0200

    System logging - switch local logging to rfc5424 format.

    Refactor log parser (BaseLogFormat), since the plugins use this as well we might have to undo a bit or refactor those as well.
2021-08-23 13:15:51 +02:00
Ad Schellevis
6ebeb54fd6 Firewall / Alias - remove unused variable in volt template 2021-08-23 13:13:06 +02:00
Alexander Shursha
4b60a9893e
Fix compare interfaces. (#5173) 2021-08-23 09:20:47 +02:00
Ad Schellevis
d0630be3b0 Firewall / Aliases - less excessive logging for async dns resolve (76b8ae4490) 2021-08-19 16:12:01 +02:00
Ad Schellevis
76b8ae4490 Firewall / Aliases - improve resolve performance by implementing async dns lookups. ref https://github.com/opnsense/core/issues/5117
This will need a new version of py-dnspython (py-dnspython2 in ports) for dns.asyncresolver support. Some additional log messages have been added to gain more insights into the resolving process via the general log.
Intermediate results aren't saved to disk anymore, which also simplifies the resolve() function in the Alias class. An address parser can queue hostname lookups for later retrieval (see _parse_address()) so we can batch process the list of hostnames to be collected.
2021-08-19 15:53:25 +02:00
Ad Schellevis
2872298658 OpenVPN validations - forgot to push a file for 1b9e263195 2021-08-19 15:53:25 +02:00
Franco Fichtner
d0cb843b07 console: bring interfaces up earlier, remove verbse text
Both done to make the interface listing more compact and to remove
spurious lines so that the listing can be seen longer.
2021-08-19 14:07:45 +02:00
Franco Fichtner
b91f9077f6 make: fix plist check on FreeBSD 13 2021-08-19 12:57:06 +02:00
Ad Schellevis
1b9e263195 OpenVPN - simplify cidr validation in openvpn_validate_cidr() and remove trim() to avoid illegal addresses being flushed to disk. closes https://github.com/opnsense/core/issues/5168 2021-08-18 15:11:11 +02:00
Ad Schellevis
4afaebf691 fix plist 2021-08-17 20:11:30 +02:00
Ad Schellevis
146166cc25 Authentication / LDAP (+TOTP), for consistency reasons keep ldap_sync_create_local_users on static system_authservers.php page, we currently don't have an option to manage dependancies in automatic fields. ref https://github.com/opnsense/core/issues/5116 2021-08-17 20:09:15 +02:00
Ad Schellevis
4414ffd81b Authentication / LDAP (+TOTP), allow automatic user creation when configured. closes https://github.com/opnsense/core/issues/5116
o add "Automatic user creation" option in System/Access/Servers (for ldap + derivatives)
o simple detached flow, updatePolicies() calculates differences between local and remote group membership, when there is something to sync (remote groups exists) and a local user doesn't exist a configd signal is send to create a new empty user without rights and a random password.

The user_dn field isn't populated, although this will cost additional queries to the remote host, it might be worth the flexibility of allowing to move users to different auth scopes.
2021-08-17 19:33:25 +02:00
Ad Schellevis
3bd36b5624 Interfaces - uniform test if interface is already assigned somewhere using new is_interface_assigned() funciton in utils.inc, implement check in openvpn client/server while here. closes https://github.com/opnsense/core/issues/5163 2021-08-17 12:30:42 +02:00
Franco Fichtner
588fbfbbc9 firmware: simplify repo file flush 2021-08-17 09:37:39 +02:00
Franco Fichtner
07d6658492 firmware: return ALTABI using -x #5144 2021-08-17 08:56:59 +02:00
Franco Fichtner
ac1cd84485 make: add a product_altabi setting if we want to split abis #5144
This way we can keep track of the underlying ABI in case a business
version needs to find its way back to community ABI.

In general ALTABI is just the derived ABI version, i.e. the one that
shares the same build settings/packages/OS version.
2021-08-17 08:53:22 +02:00
Franco Fichtner
b322ba9cf9 make: patch in business version numbers for CORE_NEXT #5144 2021-08-17 08:39:41 +02:00
James Golovich
f98f4e4f1e
Allow DNS resolver to skip entry on EmptyLabel (#4560)
* Allow DNS resolver to skip entry on EmptyLabel

A name like '.example.com' is not a valid name, but should be handled like a non existant name instead of throwing an exception
2021-08-16 19:10:07 +02:00
Ad Schellevis
cf489d1633 Interfaces - console setup. minor cleanups and fixes for https://github.com/opnsense/core/pull/4499 2021-08-16 18:23:57 +02:00
Simon
41a0a938f8
Add LAGG support to console (#4499) 2021-08-16 15:59:03 +02:00
Ad Schellevis
58186f8c4e Squashed commit of the following:
commit 83171f8b1791aae87fc4dacedb6cc921101d8399
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 13 21:44:49 2021 +0200

    whitespace

commit 11990f462eaed9bc9cf2051a377d508a916a3945
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 13 21:40:24 2021 +0200

    OpenVPN - cleanups for https://github.com/opnsense/core/pull/4592

    simplify flush tls keys.

commit 74db015f0c9963b53b1d3ea8923e1d89899d04a3
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 13 21:39:28 2021 +0200

    OpenVPN - cleanups for https://github.com/opnsense/core/pull/4592

    refactor vpn_openvpn_client.php a bit, fix jquery change events.

commit 48c77d600bd194a65fb996c2e767c3b3bc37f81b
Author: Ad Schellevis <ad@opnsense.org>
Date:   Fri Aug 13 21:15:00 2021 +0200

    OpenVPN - cleanups for https://github.com/opnsense/core/pull/4592

    refactor vpn_openvpn_server.php a bit, fix jquery change events.

commit 58f98abf4bddee349cc59a07266f7d9c1b5914d9
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Wed Feb 10 17:52:31 2021 +0300

    OpenVPN: Enhance configuration - TLS-Crypt

    Ensure backwards compatibility

commit 25a1c6ebf12971b1337a3ea65e31e61a38505c0f
Author: vnxme <46669194+vnxme@users.noreply.github.com>
Date:   Tue Jan 12 12:15:36 2021 +0300

    OpenVPN: Enhance configuration - TLS-Crypt

    Make available both --tls-auth and --tls-crypt configuration options
2021-08-13 21:50:23 +02:00
Franco Fichtner
14462382dc interfaces: correct indent in dhclient configuration 2021-08-13 13:27:23 +02:00
Gareth Owen
3ca57fae8b
DHCP: Update DNS with hostname only static entries (#4689)
DHCP static mappings that have a hostname configured but no IP address,
now update the Outbound DNS entry with the IP assigned from the pool
2021-08-12 16:52:45 +02:00
Nikolay Denev
a31ec3c1ec
Allow to specify port ranges for outgoing NAT. (#4748)
This allows to specify port ranges for NAT which is a valid pf configuration.
2021-08-12 16:43:33 +02:00
Alexander Shursha
62bebdf335
Translate widget Firewall Log. (#4965) 2021-08-12 16:31:42 +02:00
Robin Schneider
93902cc7d5
Traffic: Fix long comment preventing ipfw reload (#5023)
It seems that comments are limited in ipfw to 80 chars which is not
documented (at least not in the manpage `ipfw(8)`). If users
accidentally use long traffic shaper rule descriptions this limit could
be reached causing updates via the GUI apply button to be silently
ignored which will cause confusion.

`ipfw /usr/local/etc/ipfw.rules` shows the following error:

    Line 77: comment too long (max 80 chars)

and exists with edit code 65.

Interestingly, a slice of up to `0:83` still works. As this is
undocumented and the error says max 80 chars I go with something
slightly below this max to account for the whitespace.
2021-08-12 16:29:56 +02:00
a3be99d8dc
Adding additional memory cache options for squid webproxy (#5160) 2021-08-12 16:05:00 +02:00
Franco Fichtner
8904cae0ed interfaces: finally use -M now that we have a compat shim; closes #4850 2021-08-12 10:51:41 +02:00
Franco Fichtner
68d6d3ad50 system: accept a valid POST request please 2021-08-12 10:28:42 +02:00
Franco Fichtner
8fb15789aa system: change rss widget feed to forum annoucements 2021-08-12 10:18:02 +02:00
Franco Fichtner
20b1f87d88 interfaces: style sweep 2021-08-11 07:58:10 +02:00
Franco Fichtner
fb133e494f dhcp: another refactor fail 2021-08-11 07:55:50 +02:00
Ad Schellevis
25e0a639fa Interfaces / LAGG: improve configurability, closes https://github.com/opnsense/core/issues/5157
o add Use flowid and Use strict options
o extend interfaces overview with various lagg properties
o show unassigned interfaces in overview so lagg parents are always visible
o fix collapse event in overview to reference by internal name in stead of description.
2021-08-10 18:36:43 +02:00
Franco Fichtner
6abd2f2ac1 Framework: name and depends targets are no longer needed
use -v CORE_NAME and -v CORE_DEPENDS to read them...
2021-08-10 16:50:28 +02:00
Franco Fichtner
2534705523 dhcp: wrong file for IPv6 2021-08-10 11:22:59 +02:00
Franco Fichtner
c48244ecfa dhcp: lease removal needs a wrapper too 2021-08-10 11:21:34 +02:00