16298 Commits

Author SHA1 Message Date
Franco Fichtner
c7d6f53797 interfaces: need this now #7202 2024-02-04 18:23:56 +01:00
Franco Fichtner
f1fbf811b2 interfaces: stop caching IPv6 address to decide if reload is required or not #7202
The metric is flawed, because there could be a prefix or not, it could shift
or the user specified a client setting the server did not accept.

This is an experimental change that will stay on the development version for
a while.
2024-02-04 18:06:38 +01:00
Ad Schellevis
0ab7a966b0 VPN: OpenVPN: Instances - add "various_push_flags" field for simple boolean server push options, while here also change output order a bit (so push rules are not at the top of the file, which is a bit easier on the eyes). closes https://github.com/opnsense/core/issues/7196 2024-02-04 15:07:55 +01:00
Stephan de Wit
ce87c2f68c intrusion detection: behaviour change in suricata 7 [3]
Along with midstream-policy causing issues,
livedev.use-for-tracking=true breaks IPS so disable it here.
ref: https://redmine.openinfosecfoundation.org/issues/6726
2024-02-02 15:31:48 +01:00
Franco Fichtner
c965e8d3f0 dhcp: set RemoveAdvOnExit to off in CARP mode #7194 2024-02-02 11:25:40 +01:00
Stephan de Wit
0168141566 dashboard: widgets: bring back interface statistics update interval 2024-02-01 17:09:55 +01:00
Ad Schellevis
b1685d8e46 Services: Kea DHCP [new]: Kea DHCPv4 - add optional automatic firewall rules for dhcpv4 access. closes https://github.com/opnsense/core/issues/7188 2024-02-01 14:05:12 +01:00
Ad Schellevis
46e0bc67bb VPN: WireGuard: Settings / Instances - allow instances to start their id at 0. closes https://github.com/opnsense/core/issues/7192 2024-02-01 09:27:14 +01:00
Franco Fichtner
c34427999b system: add a trust template reload hook in the... well.. trust function :) 2024-02-01 08:57:40 +01:00
Franco Fichtner
e68e7959ed pkg: fix plist 2024-02-01 08:55:23 +01:00
Ad Schellevis
d8ba131aad System/Trust - enable openssl legacy provider by default. closes https://github.com/opnsense/core/issues/7184
Since exising gdrive backups are in legacy mode, these can only be parsed when legacy is enabled.
For more information about openssl_pkcs12_read() and used configuration, see https://www.php.net/manual/en/function.openssl-pkcs12-read.php

In order for this to work, one need to generate the template (handled on bootup https://github.com/opnsense/core/blob/master/src/etc/rc.syshook.d/early/15-templates) and restart the webgui.

To validate in a console if legacy mode is available, use the command below:

Providers:
  default
    name: OpenSSL Default Provider
    version: 3.0.12
    status: active
  legacy
    name: OpenSSL Legacy Provider
    version: 3.0.12
    status: active
2024-01-31 18:12:02 +01:00
Ad Schellevis
7e994cab29 xmlrpc sync, on nat sync, all items in the OPNsense container are transfered. regression in 6ab8f8cf2d closes https://github.com/opnsense/core/issues/7173 2024-01-31 17:47:21 +01:00
Franco Fichtner
157a2d9f03 src: spurious whitespace (the other one is for the templating) 2024-01-31 15:43:15 +01:00
Franco Fichtner
fccaa2e548 pkg: avoid the problematic "suricata" package for now 2024-01-31 12:13:06 +01:00
Franco Fichtner
f28786db4a firmware: adjust wording 2024-01-31 11:23:29 +01:00
Ad Schellevis
4a5193900c Services: Kea DHCP [new]: Kea DHCPv4 - omit comma when control agent is disabled. should fix https://github.com/opnsense/core/issues/7183 2024-01-31 10:41:57 +01:00
Ad Schellevis
5667764034 Reporting: Unbound DNS - Omit export duckdb when stats are disabled. closes https://github.com/opnsense/core/issues/7149 2024-01-31 10:12:51 +01:00
Franco Fichtner
0c731017ad firmware: now at 24.7 development track 2024-01-31 07:58:32 +01:00
Ad Schellevis
0d676c7bf6 intrusion detection: behaviour change in suricata 7 [2] 2024-01-30 21:41:27 +01:00
Franco Fichtner
f5ae0c8448 intrusion detection: behaviour change in suricata 7 2024-01-30 21:26:06 +01:00
Franco Fichtner
890ca6435e firmware: fix a glitch taining the upgrade log while installing squid
Only callers of -u are changelog.sh and install.sh but changelog.sh
doesn't even support LOCKFILE so do a mininal fix.
2024-01-30 13:31:47 +01:00
Stephan de Wit
681006cd39 interfaces: overview: align buttons and remove assignment option 2024-01-29 09:18:30 +01:00
Ad Schellevis
6533aa951b Firewall: Aliases - align geoip file check with documentation, closes https://github.com/opnsense/core/issues/7174 2024-01-28 19:49:57 +01:00
Stephan de Wit
c17bc785e8 interfaces: overview: small usability improvements
- include VLAN (or QinQ) tag in main grid for easy sorting, tooltip will show parent device as well
- present table structure for data nested 1 level deeper in details overview
- include links to either the interface settings or firewall rules pages
2024-01-28 16:52:14 +01:00
Franco Fichtner
54d98085c2 system: do not fail on CMD_BANNER error; closes #7171 2024-01-26 14:16:13 +01:00
Franco Fichtner
73c12179eb firmware: almost time for 24.1 2024-01-26 10:02:16 +01:00
Franco Fichtner
83b7cd7213 src: style sweep 2024-01-26 09:37:26 +01:00
Ad Schellevis
9f8a23a1da configd - optimise stream_handler to exit and kill running process when there's no listener attached. While here cleanup some left over print statements introduced in 86c1087dd6 2024-01-25 20:30:08 +01:00
Ad Schellevis
528b7df875 Syslog / archive - add maxfilesize option to enforce a log rotate when files exceed their limit.
The combination of preserve logs and max file size help to guard the boundaries of the log storage being used, an archive action is already being performed hourly, which should be enough in normal situations (although that would be easy to change if needed).

In order to make room for the new additional files per day, we add a sequence to the file, for example the first rotate of a filter log exceeding its limit named /var/log/filter/filter_20231204.log  would be moved to /var/log/filter/filter_20231204.0001.log . The syslog-ng reload handles the flush to a new file, which automatically would result in a new filter_20231204.log file after rotate.
2024-01-25 17:14:11 +01:00
Ad Schellevis
042f71db12 configctl: with the support of our stream reader (42fd27df77), we didn't collect the results when used as an event handler, in which case the action is silently dropped. let's wait for configd's result and add it to the log message as well. closes https://github.com/opnsense/core/issues/7164 2024-01-25 14:07:56 +01:00
Stephan de Wit
d6a95767e3 IPsec: Connections: remove AEAD algorithms without a PRF for IKE proposals
Any AEAD algorithm selected for the IKE proposal requires a PRF function.
Internally strongSwan will prepend the selected hash algorithm with 'prf'.
Children do not require a hash algorithm to be selected, so the common
options are listed without one.
2024-01-25 11:27:51 +01:00
Franco Fichtner
ec8002cbb2 system: shuffle auth templates to the end
One of the main reasons of this function used to be writing
/boot/loader.conf so make sure it does that before going into
something else.  There is still account info writing but to
some degree rendering accounts before changing ttys appears to
be favourable.
2024-01-25 10:52:40 +01:00
Ad Schellevis
e1139109c8 System: Access: Tester - handle case insensitivty while reading groups. closes https://github.com/opnsense/core/issues/7140 2024-01-24 20:53:38 +01:00
Ad Schellevis
407be7c546 VPN: OpenVPN: Instances - add optional "route-metric" push option for server instances. closes https://github.com/opnsense/core/issues/7160 2024-01-24 15:46:26 +01:00
Ad Schellevis
9da29cfb9f Core/Backend - only parse stream results when configd socket could be opened. closes https://github.com/opnsense/core/issues/7142
Although this isn't the reason why configd wasn't running, it should not crash either when already sending messages to syslog about the startup issue.
2024-01-24 15:15:01 +01:00
Ad Schellevis
4530da743c Reporting: Unbound DNS - print upgrade message when db not found, closes https://github.com/opnsense/core/issues/7147 2024-01-24 15:00:44 +01:00
Ad Schellevis
41b3881a73 Services: Kea DHCP [new]: Leases DHCPv4 - deduplicate records. apparantly kea leases from memory can be duplicated (see also https://gitlab.isc.org/isc-projects/kea/-/issues/2293), use the first two fields (ip+mac) to deduplicate them. closes https://github.com/opnsense/core/issues/7136 2024-01-24 14:03:01 +01:00
Franco Fichtner
b407f5e81a mvc: style issue 2024-01-24 08:13:41 +01:00
Ad Schellevis
68d5b81cb3 Services: Kea DHCP [new]: Kea DHCPv4 - Reservations : allow less strict hostnames, closes https://github.com/opnsense/core/issues/7137 2024-01-23 20:38:20 +01:00
Ad Schellevis
fdc72727a8 MVC - HostnameField : add IsDNSName to support DNS names as specified by RFC2181. When the hostname field is used to specify a DNS name, less strict rules apply. needed for https://github.com/opnsense/core/issues/7137 2024-01-23 20:36:00 +01:00
Ad Schellevis
e21b1a8fe5 System: Gateways: Configuration - fix migration issue introduced in 7be65661f7. gateway container contains both "gateway_item" and "gateway_group" items, so we need to be explicit when removing old values. closes https://github.com/opnsense/core/issues/7150 2024-01-23 15:49:13 +01:00
Franco Fichtner
98878a9eb9 openvpn: trailing commas make life easier 2024-01-19 11:32:42 +01:00
Franco Fichtner
684c8c6bec mvc: update filter model 2024-01-19 11:28:45 +01:00
Franco Fichtner
70d6dc03b8 Framework: use LOCALBASE where possible 2024-01-17 09:00:15 +01:00
Stephan de Wit
4d383db1d2 IPsec: Connections: extend Proposals tooltip to children, fix tooltip style issue
It seems bootstrap-select is inserting a dropdown div before the <select> element
and copying the classes from said select element causing the tooltip to load twice
on two separate elements. Therefore restrict the tooltip activation to the
selectpicker class only. While here, since the ESP proposals field follows the same
pattern, activate the tooltip here as well.
2024-01-16 12:01:54 +01:00
Franco Fichtner
703d9938ce mvc: missing trailing comma makes me sad, also copyright header style 2024-01-16 09:20:36 +01:00
Franco Fichtner
5b5cf45846 mvc: copyright style update 2024-01-15 13:39:16 +01:00
Franco Fichtner
29eaa909d0 mvc: stray whitespace 2024-01-15 10:05:36 +01:00
Ad Schellevis
415f53cef7
Services: Kea - remove test remnant in get_kea_leases.py
should fix https://github.com/opnsense/core/issues/7135
2024-01-13 10:43:15 +01:00
Franco Fichtner
60ee4a4b9a src: style sweep, meh 2024-01-12 12:33:18 +01:00