15534 Commits

Author SHA1 Message Date
Franco Fichtner
f5efffcf94 unbound: migration of empty nodes failed
PR: https://forum.opnsense.org/index.php?topic=35134.0
2023-08-02 09:49:38 +02:00
Franco Fichtner
84c7e49944 firewall: while here also fix most obvious warnings in edit page 2023-08-02 08:11:39 +02:00
Franco Fichtner
6256ea2e50 firewall: fix a couple of warnings on the rules page 2023-08-02 08:01:38 +02:00
Franco Fichtner
da64b4f944 openvpn: fix static key delete
PR: https://forum.opnsense.org/index.php?topic=35155.0
2023-08-02 07:06:57 +02:00
Ad Schellevis
bcabc30581 Firewall: Groups - hide row command buttons for internal groups, closes https://github.com/opnsense/core/issues/6691 2023-08-01 17:01:26 +02:00
Franco Fichtner
ad76fb312b firmware: revoke 23.1 fingerprint 2023-08-01 14:53:57 +02:00
Ad Schellevis
68ae7bd48f MVC/BaseListField - empty item selection issue, probably php 8.2 2023-08-01 14:48:12 +02:00
Franco Fichtner
f3ffcccf47 firewall: rename variable that is weird 2023-08-01 12:38:49 +02:00
Franco Fichtner
0e1aa4bcca firewall: two more group issues 2023-08-01 12:24:55 +02:00
Stephan de Wit
e27d37a23c dhcpv4: check if manufacturer exists 2023-08-01 12:09:50 +02:00
Stephan de Wit
4ec97df4c4 dhcpv6: revert previous, use base16 instead 2023-08-01 11:50:59 +02:00
Stephan de Wit
23318015b2 dhcpv6: iaid_duid might be in hex format 2023-08-01 11:03:28 +02:00
Franco Fichtner
b52bf63e9e firewall: groups were not correctly parsed for menu post-migration 2023-08-01 08:03:36 +02:00
Franco Fichtner
b5992b83ea unbound: actually report what breaks this 2023-08-01 07:42:00 +02:00
Ad Schellevis
c61ef7a287 Services: Unbound DNS - validate service is offering a properly typed "dns_ports" list. closes https://github.com/opnsense/core/issues/6690 2023-07-31 16:25:59 +02:00
Franco Fichtner
40d1569877 pkg: default to 23.7 now 2023-07-31 12:25:18 +02:00
Franco Fichtner
e6101f04b5 pkg: make a note about nickname changes 2023-07-28 14:03:51 +02:00
Franco Fichtner
c539c60146 firmware: fix typo 2023-07-28 10:17:48 +02:00
Franco Fichtner
73b2557049 firmware: fix typo in previous 2023-07-27 18:48:57 +02:00
Franco Fichtner
f35db24e61 firmware: fetch bogons/changelogs from amd64 ABI; closes #6688 2023-07-27 16:15:30 +02:00
Stephan de Wit
a18406fade dhcp: interface description might not exist 2023-07-27 10:49:05 +02:00
Franco Fichtner
b1d85fd398 system: give more context since we operate pid numbers only
PR: https://forum.opnsense.org/index.php?topic=35046.0
2023-07-27 09:57:40 +02:00
Stephan de Wit
2eca088bd5 dhcp4/6: cleanup LeasesControllers
a typecast was missing in the DHCPv6 LeasesController, interfaces were also not properly listed here due to variable renaming. While here, also clean up the DHCPv4 controller to be more symmetrical.
2023-07-27 09:37:23 +02:00
Franco Fichtner
4fc8865b8f pkg: shorten previous
I doubt we have much difference between supported architectures.
2023-07-26 17:43:25 +02:00
Christopher SHEN
7e8179f827 Makefile: add packages to CORE_DEPENDS_aarch64
The four packages including py${CORE_PYTHON}-duckdb,  py${CORE_PYTHON}-numpy, py${CORE_PYTHON}-pandas, and suricata-devel, can be built on aarch64.
2023-07-26 17:38:51 +02:00
Franco Fichtner
1130442142 firewall: move lock()/unlock() to their final resting place
Simplify the code a little while at it.
2023-07-26 13:09:31 +02:00
Franco Fichtner
0284cb4d34 system: fix unlock() inheriting the lock state 2023-07-26 13:02:08 +02:00
Franco Fichtner
e9a85c33e5 system: close boot file after probing to avoid lock inheritance 2023-07-26 12:42:02 +02:00
Franco Fichtner
77f9b43234 dhcp: forgot 'inet6' selector 2023-07-26 10:06:32 +02:00
Franco Fichtner
ace962a6ff dhcp: returning a "real" device only works if an address is attached
We could remove the change to the primary function but perhaps we will
need it later.  It doesn't hurt either way.
2023-07-26 10:02:55 +02:00
Franco Fichtner
9184457ab8 interfaces: fix locking that was missing CLOEXEC #6637
So the lock was inherited by all exec'd processes and thus was
never released when the script ended or was killed.
2023-07-25 21:41:38 +02:00
Franco Fichtner
015d9b5c7c interafces: logic error in previous #6637 2023-07-25 10:57:20 +02:00
Franco Fichtner
a23b0784c3 interfaces: on forceful IPv6 reload do not lose the event handling #6637
User log reveals that this does happen on bootup.  Actual flow:

    kernel - >>>> Invoking start script 'beep'
    opnsense 6735 /usr/local/etc/rc.newwanipv6: dhcpd_radvd_configure(auto) found no suitable IPv6 address on igb1_vlan10
    dhcp6c 25775 dhcp6c_script: REQUEST on pppoe0 executing
    dhcp6c 29279 dhcp6c_script: REQUEST on pppoe0 renewal
    opnsense 30070 /usr/local/etc/rc.newwanipv6: Lost a forceful reload on WAN[wan]) due to previous lock

Since the IPv6 has reloaded the addresses are back to tentative state.
This commit may create a chain of forceful reloads, but that's nothing
that the system didn't try to attempt previously.
2023-07-25 10:13:56 +02:00
Franco Fichtner
09fc810f66 dhcp: make "found no suitable address" errors a bit more usable #6637 2023-07-25 09:47:16 +02:00
Franco Fichtner
a0013701af interfaces: allow primary address function to emit device used #6637 2023-07-25 09:44:24 +02:00
Franco Fichtner
c9bd89752b wizard: restrict to validating IPv4; closes #6681
The system wizard is IPv4 only but doesn't use the correct
function.  It's debatable if we need to restrict DNS servers
but if all of this is only IPv4 we should stick to it in a
consistsent way.
2023-07-25 09:15:36 +02:00
Franco Fichtner
e5538188a2 firmware: not there yet but start prepping 2023-07-25 08:45:49 +02:00
Franco Fichtner
cb4d15c8bf interfaces: style in header 2023-07-24 10:09:08 +02:00
Franco Fichtner
83bbfbebda interfaces: sort menu in xml file 2023-07-24 10:04:20 +02:00
Franco Fichtner
42abe2e9d4 interfaces: typo and phrasing 2023-07-24 10:00:51 +02:00
Franco Fichtner
4eaaa0e8c1 interfaces: forgot to commit this apparently 2023-07-24 09:57:07 +02:00
Franco Fichtner
592c9a84df system: fix typo 2023-07-24 09:56:46 +02:00
Franco Fichtner
136e403537 system: call opnsense-crypt from opnsense-import; closes #6133
Make sure the man page covers this subject to point people to it
later on.  ;)
2023-07-24 09:53:36 +02:00
Franco Fichtner
dad8bd7543 system: add opnsense-crypt utility #6133 2023-07-24 09:38:13 +02:00
Franco Fichtner
8549485370 system: mute openssl errors pushed to stdout 2023-07-24 09:17:43 +02:00
Franco Fichtner
b7db4316fd src: legacy_bindings.inc already included by config.inc
client_connect.php also includes it but not config.inc.  Try to leave
it at that to not pollute it unnecessarily.  The other scripts might
be able to do it as well this way but don't fix something that is not
broken either.
2023-07-24 08:38:24 +02:00
Ad Schellevis
6487a9b62e Interfaces: Other Types: VLAN - allow manual proto selection, closes https://github.com/opnsense/core/issues/6679 2023-07-21 18:33:34 +02:00
Franco Fichtner
c3db32722d interfaces: remove null_service, empty service name works; closes #6568 2023-07-21 11:39:35 +02:00
Kevin Fason
7366d785a6 network time: support pool directive and maxclock; closes #5569
Added if then to determine if the GUI-provided server is part of the public NTP pool or not. If the hostname ends in 'pool.ntp.org', it will write the entry to ntpd.conf with 'pool' instead of 'server' for that network server. If not then it will write it as 'server'. The pool directive tells ntpd to treat it differently. a 'server'  host is only looked up at service startup whereas a 'pool' host is monitored and changed if it becomes unresponsive or is determined to be a falseticker among other things. ntpd will also pull several DNS entries for each pool entry so I have a followup change to allow configuration of this setting in the GUI, known as 'maxclock'. It sets how many servers to maintain with a default of 10.

This adds support in the GUI for the maxclock system setting. It is used to tell NTPd how many associations (time servers) to maintain. The default is 10 however an odd number is suggested by ntpd docs to make falseticker detection simpler. This change writes what is in the GUI to ntpd.conf.

With the use of the pool directive, ntpd will use more servers than what is listed on the general page. This setting allows the user to set the max number of associations (time servers) to be maintained. Ntpd will use multiple entries from each pool entry that it maintains. Default is 10 but ntpd docs say to use an odd number to make throwing out falsetickers easier. The used is calculated wierdly from the max with the pool entries. For example with a setting of 10 and using the four default X.opnsense.pool.ntp.org entries it will have 6 associations it maintains instead of the 4 listed in the GUI. I went into more detail in the issue itself.

You can use for example, only 'us.pool.ntp.org' and it will maintain 9 associations from this pool. This means the default install configuration could just be '0.opnsense.pool.ntp.org' or, if possible, setup a 'opnsense.pool.ntp.org' so perhaps some documentation changes are in order as well?

I duplicated how the orphan setting is addressed however I did not know how these settings are maintained in a configuration backup so someone smarter may need to address that if required?
2023-07-21 10:22:46 +02:00
Franco Fichtner
24f8eb6632 monit: fix alert script includes; closes #6677 2023-07-21 09:54:28 +02:00