13532 Commits

Author SHA1 Message Date
Franco Fichtner
d6494ab06e src: whitespace sweep 2021-12-28 11:15:49 +01:00
vnxme
aa20ccba4c
Firewall/Scrub: Display interface descriptions (#5433) 2021-12-28 09:07:41 +01:00
Christian Tramnitz
de3a021dd9 fix strict-order
Currently, when configured, "strict-order" adds the necessary "strict-order" argument. However, the hardcoded "all-servers" arguments overrides this, making "strict-order" pointless.

With this change, "all-servers" and "strict-order" are mutually exclusive.
2021-12-27 07:32:50 +01:00
Christian Tramnitz
b2bca01f9c fix copy-and-paste error in help div 2021-12-27 07:31:53 +01:00
kulikov-a
cece0d28de
MVC - handleFormValidation : improve item match (#5428) 2021-12-26 19:29:14 +01:00
Bryce Verdier
26df508f07
Services / Intrusion detection - downloader.py style fixes (#5413) 2021-12-23 19:41:05 +01:00
kulikov-a
2aeaca5ad2
Firewall/Live View: skip rid for nat (#5424) 2021-12-22 20:29:48 +01:00
Franco Fichtner
f83209cae3 captive portal: use -f when deleting files that may not be there
Originally looked into

    Starting API dispatcher
    2021-12-22 11:03:56: (configfile.c.426) Warning: mod_auth should be listed in server.modules before dynamic backends such as mod_cgi
    2021-12-22 11:03:56: (configfile.c.426) Warning: mod_auth should be listed in server.modules before dynamic backends such as mod_fastcgi

but it looks like this is a false positive since we don't have mod_auth in there.
2021-12-22 11:04:22 +01:00
Andrew
a719e43ae3
util: add support for terabytes, and petabytes to format_bytes (#5405)
This formatted number is used by the Interface Statistics widget,
and makes the columns go wider than necessary when going above a
terabyte of data. Add petabytes for good measure.
2021-12-22 08:00:02 +01:00
Franco Fichtner
eb786c95e8 firmware: although unlikely just patch this in then 2021-12-22 07:57:57 +01:00
Andrew
234fa8ba95
firmware/status: Update to support terabytes (#5417) 2021-12-22 07:56:27 +01:00
Ad Schellevis
94ed9756c9 fix plist 2021-12-21 19:02:30 +01:00
Ad Schellevis
834ef3b2e2 Monit - move logging to own log target. closes https://github.com/opnsense/core/issues/5422 2021-12-21 17:54:35 +01:00
Ad Schellevis
c281f1e573 Firewall / Alias - remove global $aliastable reference and use our shared \OPNsense\Firewall\Util::isAlias() instead. closes https://github.com/opnsense/core/issues/5423
Although a direct table lookup will be faster than using a lookup in isAlias(), it's likely not problematic to have a slightly slower lookup using is_alias(), but if performance is of the essence at some point we can easily cache results in isAlias() to reach the same target.
2021-12-21 16:59:24 +01:00
Franco Fichtner
e4d5478662 pkg: avoid upgrades if already done, use VERSIONBIN 2021-12-21 12:07:37 +01:00
Franco Fichtner
20cee8237b system: add backend handler for log rotation
... and use it in usual spot as well as on boot to ensure that
latest.log files always exist (hello /var MFS).  This makes
opnsense-log happier.
2021-12-21 09:17:26 +01:00
Franco Fichtner
9b8024ea85 system: do not mess with mount points in /var for /var MFS 2021-12-20 13:29:09 +01:00
Northguy
894e86c624
Patch traffic shaper texts (#5420) 2021-12-19 19:31:57 +01:00
kulikov-a
784ebd8d27
Logs: quick severity filter with "Warning" default (#5370) 2021-12-19 15:59:05 +01:00
Ad Schellevis
a984542d37 Firewall / Aliases - log resolve errors (ref https://forum.opnsense.org/index.php?topic=26034) 2021-12-17 19:48:03 +01:00
Ad Schellevis
7629c9aa87 Firewall: Diagnostics: States - handle IPv6 NAT, closes https://github.com/opnsense/core/pull/5414 2021-12-17 19:10:22 +01:00
Franco Fichtner
ea2349af06 firmware: apparently /etc/motd is gone on FreeBSD 13
Long live /var/run/motd then...
2021-12-17 10:13:42 +01:00
Franco Fichtner
353468a261 system: default to both IPv4 and IPv6 redirects to disable
Done for hardening as done in b424a2f9b3b7 plus now IPv6 can
leverage ip6_tryforward() with the new default.
2021-12-16 16:56:55 +01:00
Franco Fichtner
876604b392 pkg: fix plist 2021-12-16 15:23:04 +01:00
Ad Schellevis
9008f98a6a Interfaces / LTE - remove more or less dead cruft the 3gstats collects in some rare cases.
Although there probably are a couple of Huawei modems which do report status info as advertised in the script, there are also a lot who don't and maybe deadlocked when pulling for data on a "random" port.
For now we should remove this, if at some point in the future a sensible method would be supported to poll status in a more "vendor independent" manor, we can always revise.
2021-12-16 15:08:08 +01:00
Franco Fichtner
1eb25c2490 system: do not clobber mount points
In case of ZFS a move doesn't really work.  Remove links only
and move the directory contents over.
2021-12-16 10:51:14 +01:00
Franco Fichtner
50d3f5e738 system: mostly adjust -z mode to give size and identifier from ZFS pools 2021-12-15 08:42:54 +01:00
Franco Fichtner
d7e6dbde38 system: df -t zfs returns duplicated tmpfs entries; closes #5344
When not using -t the list is correct and since we have -T make
sure we filter for the ones we asked for before.  -a seems like
a good fit here too.
2021-12-14 22:19:48 +01:00
Franco Fichtner
1977e3539f Revert "firmware: work around FreeBSD 13 faulty validation"
This reverts commit d7d69895cd8672379a634488fb116e1a0bbbeaa6.
Was properly solved in stable/22.1.
2021-12-14 11:58:36 +01:00
Franco Fichtner
250ecd5bc4 system: opnsense-importer -m mode
Was in need of something like this to gain access to a ZFS pool without
having to run a command sequence from the top of my head.

Comes in pretty handy when being included from a recovery install stick.
2021-12-14 09:34:00 +01:00
Ad Schellevis
67910fbfea Services: Intrusion Detection - rule downloads : gently log when connectivity issues appear. 2021-12-10 17:23:37 +01:00
Franco Fichtner
d7d69895cd firmware: work around FreeBSD 13 faulty validation
ping6: -4 and -6 cannot be used simultaneously

No, that's not how argument parsing works...
2021-12-10 12:46:40 +01:00
Franco Fichtner
7767a6db9e firmware: for quick troubleshooting support -O like opnsense-update 2021-12-10 12:28:27 +01:00
Franco Fichtner
f122316ba5 firmware: next beta coming up 2021-12-10 10:29:37 +01:00
Ad Schellevis
03f7dbc431 VPN / OpenVPN / Connection Status - kill by common name when address doesn't seem to be possible. closes https://github.com/opnsense/core/issues/5038 2021-12-09 19:09:33 +01:00
Franco Fichtner
602d5c5912 firmware: be more chill about missing product_check and always return product info #5394 2021-12-09 09:47:24 +01:00
Franco Fichtner
7a68bab085 firmware: deleting the file under configd execution and copy...; closes #5396
... leaves us with permission 640 even though we have copied a
644 file.  Removing the unlink() makes this work without a
chmod but the unlink is there for the fact that /etc/ssl/cert.pem
used to be a symlink and could clobber the actual file linked
which was the original package provided.

Might be an umask issue, but better leave it where it is.
2021-12-08 14:33:14 +01:00
Franco Fichtner
5b42f2229f firmware: just for consistency 2021-12-08 08:48:06 +01:00
kulikov-a
e7bccd6824
change severity (#5395) 2021-12-08 08:38:05 +01:00
Franco Fichtner
76bb8b7d39 firmware: fix launcher invoke from shell menu 2021-12-08 08:28:18 +01:00
Franco Fichtner
b3ec15fe0c firmware: no need for this file anymore starting with 21.7.7
opnsense-update.conf will take over and firmware-upgrade doesn't
exist on stable/21.7 anyway.
2021-12-08 08:17:20 +01:00
Franco Fichtner
b6b092a0ea system: copy+paste fail 2021-12-07 17:10:46 +01:00
Franco Fichtner
45d5d42010 interfaces: avoid inline creation of GIF/GRE tunnels
Instead move the out-of-band configuration into the same area where
the ipaddr/ipaddrv6 configuration is taking place.  Should a tunnel
not come up we have clearer readings now of which part of the GUI
can force this...
2021-12-07 11:22:57 +01:00
Franco Fichtner
f2081d3778 interfaces: simplify to avoid $config access 2021-12-07 10:28:52 +01:00
Franco Fichtner
29bdf8cf74 interfaces: also add logging for GIF/GRE inline configuration 2021-12-07 09:39:02 +01:00
Franco Fichtner
5123a662d7 interfaces: safe to assume $realif exists, use it consistently
get_real_interface() is basically just a large wrap around $wancfg['if'] and
since it's used so much try to avoid touching the 'if' internal here.
2021-12-07 09:34:26 +01:00
Franco Fichtner
b62e045828 interfaces: log when we try to attempt inline virtual device creation
o The spot is already treated with suspicion that the situation cannot happen
o interfaces_addresses_flush() will ignore an empty realif(v6) so remove comment
2021-12-07 09:03:53 +01:00
Franco Fichtner
1211809c24 intefaces: avoid handling "hardware" settings for devices node path 2021-12-07 08:42:37 +01:00
Franco Fichtner
e12774a75b interfaces: drop get_parent_interface(); loosely refs #5338
Make a single-purpose function that can rely on the sanity checking
of its only two callers.
2021-12-06 17:25:37 +01:00
Franco Fichtner
6ff74b9511 interfaces: remove previously broken code
Since the code was only fixed in 024c7e1694 and the lookup is
questionable (especially on IPv4 real interface which is vanilla
as opposed to PPP IPv6 shifting).

The problem with e.g. a wan: pppoe0 -> em1 situation is that
if you assign em1 the answer to the query shifts from "wan" to
"opt1" so we would rather miss the situation to resolve "em1"
since the correct interface is "pppoe0" anyway.

Also looking at callers of convert_real_interface_to_friendly_interface_name()
there isn't a PPP-related call in there anyway that would require
this.
2021-12-06 17:10:51 +01:00