From c9a9f1c02786256c04bb4814553d52a98ee2dc82 Mon Sep 17 00:00:00 2001 From: Yann Bayart Date: Wed, 22 Jan 2025 12:05:12 +0100 Subject: [PATCH 001/389] Add support for Scaleway DNS challenge --- .../AcmeClient/forms/dialogValidation.xml | 10 +++++ .../AcmeClient/LeValidation/DnsScaleway.php | 44 +++++++++++++++++++ .../models/OPNsense/AcmeClient/AcmeClient.xml | 4 ++ 3 files changed, 58 insertions(+) create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsScaleway.php diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 702aa67c9..b0f4e09a2 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -1924,4 +1924,14 @@ password + + + header + + + + validation.dns_scaleway_token + + text + diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsScaleway.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsScaleway.php new file mode 100644 index 000000000..22f237ac9 --- /dev/null +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsScaleway.php @@ -0,0 +1,44 @@ +acme_env['SCALEWAY_API_TOKEN'] = (string)$this->config->dns_scaleway_token; + } +} diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index ab94015e5..571de00bc 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -513,6 +513,7 @@ Rackspace rage4 RegRu + Scaleway SchlundTech selectel.com / selectel.ru Selfhost @@ -1307,6 +1308,9 @@ N + + N + From e9fc7c7974047870002883fe843f5f5065af9f2a Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Mon, 3 Feb 2025 21:18:33 +0100 Subject: [PATCH 002/389] www/caddy: Fix addHandleBtn and addDomainBtn, change data-width of reverseFilter (#4525) --- .../app/views/OPNsense/Caddy/reverse_proxy.volt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index f95594d21..cf3010b4e 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -229,10 +229,10 @@ // Add click event listener for "Add Handler" button $("#addHandleBtn").on("click", function() { if ($('#maintabs .active a').attr('href') === "#handlesTab") { - $("#addReverseHandleBtn").click(); + $(`#{{formGridHandle['table_id']}} button[data-action="add"]`).click(); } else { - $('#maintabs a[href="#handlesTab"]').tab('show').one('shown.bs.tab', function(e) { - $("#addReverseHandleBtn").click(); + $('#maintabs a[href="#handlesTab"]').tab('show').one('shown.bs.tab', function() { + $(`#{{formGridHandle['table_id']}} button[data-action="add"]`).click(); }); } }); @@ -240,10 +240,10 @@ // Add click event listener for "Add Domain" button $("#addDomainBtn").on("click", function() { if ($('#maintabs .active a').attr('href') === "#domainsTab") { - $("#addReverseProxyBtn").click(); + $(`#{{formGridReverseProxy['table_id']}} button[data-action="add"]`).click(); } else { - $('#maintabs a[href="#domainsTab"]').tab('show').one('shown.bs.tab', function(e) { - $("#addReverseProxyBtn").click(); + $('#maintabs a[href="#domainsTab"]').tab('show').one('shown.bs.tab', function() { + $(`#{{formGridReverseProxy['table_id']}} button[data-action="add"]`).click(); }); } }); @@ -332,7 +332,7 @@
- Clear All From b6b0cf292a831ca161b7facc3bb342a519751665 Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Tue, 4 Feb 2025 17:44:51 +0100 Subject: [PATCH 003/389] Update crowdsec rule reference ($ -> <>); bump release (#4526) --- security/crowdsec/Makefile | 3 +-- security/crowdsec/pkg-descr | 4 ++++ security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc | 4 ++-- .../src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml | 2 +- 4 files changed, 8 insertions(+), 5 deletions(-) diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile index dad0bf60c..7218bfb38 100644 --- a/security/crowdsec/Makefile +++ b/security/crowdsec/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= crowdsec -PLUGIN_VERSION= 1.0.8 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.0.9 PLUGIN_DEPENDS= crowdsec PLUGIN_COMMENT= Lightweight and collaborative security engine PLUGIN_MAINTAINER= marco@crowdsec.net diff --git a/security/crowdsec/pkg-descr b/security/crowdsec/pkg-descr index cb1429cf4..f7889b32d 100644 --- a/security/crowdsec/pkg-descr +++ b/security/crowdsec/pkg-descr @@ -8,6 +8,10 @@ WWW: https://crowdsec.net/ Plugin Changelog ================ +1.0.9 + + * Update rule reference ($ -> <>) for opnsense 25.1 + 1.0.8 * Enable use_wal, remove warning diff --git a/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc b/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc index 386bc73ca..a1c149a1c 100644 --- a/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc +++ b/security/crowdsec/src/etc/inc/plugins.inc.d/crowdsec.inc @@ -52,7 +52,7 @@ function crowdsec_firewall(Plugin $fw) array( 'ipprotocol' => 'inet', 'descr' => 'CrowdSec (IPv4)', - 'from' => '$crowdsec_blacklists', # $ to reference an alias + 'from' => '', 'direction' => 'in', 'type' => 'block', 'log' => $rules_log_enabled, @@ -68,7 +68,7 @@ function crowdsec_firewall(Plugin $fw) array( 'ipprotocol' => 'inet6', 'descr' => 'CrowdSec (IPv6)', - 'from' => '$crowdsec6_blacklists', # $ to reference an alias + 'from' => '', 'direction' => 'in', 'type' => 'block', 'log' => $rules_log_enabled, diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml index f332b3b64..4208065f4 100644 --- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml +++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml @@ -1,7 +1,7 @@ //OPNsense/crowdsec/general CrowdSec general configuration - 1.0.8 + 1.0.9 From 6644d16b6b9def1c83f3d41b0462a0111136a439 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 5 Feb 2025 14:11:04 +0100 Subject: [PATCH 004/389] www/caddy: Add client_ip_headers (#4519) * www/caddy: Add client_ip_headers for https://github.com/opnsense/plugins/issues/4517 , Rewrite copy_headers logic for https://github.com/opnsense/plugins/issues/4488 . Since headers are used in multiple parts of the configuration this creates a single point of truth to ease maintenance burden. * www/caddy: Forgot to add general form options for https://github.com/opnsense/plugins/issues/4517 * www/caddy: Change directive name from AuthCopyHeaders to CopyHeaders since Field Type changed to empty it. The field was introduced in the prior version and optional, so impact low. Changelogs. * www/caddy: Improve helptext for client_ip_headers feature --- www/caddy/Makefile | 2 +- www/caddy/pkg-descr | 7 +++ .../OPNsense/Caddy/forms/general.xml | 16 ++++++- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 43 ++++++++++--------- .../templates/OPNsense/Caddy/Caddyfile | 8 ++++ .../OPNsense/Caddy/includeAuthProvider | 37 +++++++++++----- 6 files changed, 79 insertions(+), 34 deletions(-) diff --git a/www/caddy/Makefile b/www/caddy/Makefile index 0a03f1284..6c8288cf3 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.8.1 +PLUGIN_VERSION= 1.8.2 PLUGIN_DEPENDS= caddy-custom PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing PLUGIN_MAINTAINER= cedrik@pischem.com diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index c9583ba43..0dfa6ca70 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -13,6 +13,13 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html Plugin Changelog ================ +1.8.2 + +* Add: client_ip_headers (opnsense/plugins/issues/4517) +* Add: CloudDNS provider (opnsense/plugins/pull/4507) +* Change: Generalize forward_auth copy_headers directive. Existing configuration from (issues/4488) will be emptied. (opnsense/plugins/pull/4519) +* Fix: Shortcut buttons in reverse_proxy.volt (opnsense/plugins/pull/4525) + 1.8.1 * Add: Optional "Authorization" header to forward_auth (opnsense/plugins/issues/4488) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 9d70fcafa..573fbce1d 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -58,6 +58,16 @@ dropdown + + caddy.general.ClientIpHeaders + + dropdown + select_multiple + 5 + + X-Forwarded-For + + caddy.general.GracePeriod @@ -228,11 +238,13 @@ - caddy.general.AuthCopyHeaders + caddy.general.CopyHeaders + dropdown select_multiple + 5 - + general-settings diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 88b4853da..7a851ce70 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -1,7 +1,7 @@ //Pischem/caddy Caddy Reverse Proxy - 1.3.4 + 1.3.5 @@ -84,6 +84,17 @@ + + + + OPNsense.Caddy.Caddy + reverseproxy.header + HeaderType,description + %s %s + + + Y + Y 0 @@ -168,27 +179,17 @@ /^(\/.*)?$/u Please enter a valid 'URI' that starts with '/'. - + + + + OPNsense.Caddy.Caddy + reverseproxy.header + HeaderType,description + %s %s + + Y - - Authorization - Remote-User - Remote-Groups - Remote-Name - Remote-Email - X-Authentik-Username - X-Authentik-Groups - X-Authentik-Email - X-Authentik-Name - X-Authentik-Uid - X-Authentik-Jwt - X-Authentik-Meta-Jwks - X-Authentik-Meta-Outpost - X-Authentik-Meta-Provider - X-Authentik-Meta-App - X-Authentik-Meta-Version - - + diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index e81c23bc6..afe989808 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -85,6 +85,14 @@ {% if accessList %} trusted_proxies static {{ accessList.clientIps.split(',') | join(' ') }} {% endif %} + {% if generalSettings.ClientIpHeaders %} + {% for header_uuid in generalSettings.ClientIpHeaders.split(',') %} + {% set header = helpers.toList('Pischem.caddy.reverseproxy.header') | selectattr('@uuid', 'equalto', header_uuid) | first %} + {% if header and header.HeaderType %} + client_ip_headers {{ header.HeaderType }} + {% endif %} + {% endfor %} + {% endif %} {% if generalSettings.LogCredentials|default("0") == "1" %} log_credentials {% endif %} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider index f179fc845..1c6beb34b 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider @@ -7,16 +7,26 @@ {% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %} {% set auth_url = (generalSettings.AuthToTls|default("0") == "1" and 'https://' or 'http://') + (is_ipv6 and '[' or '') + generalSettings.AuthToDomain|default("") + (is_ipv6 and ']' or '') + (generalSettings.AuthToPort and ':' + generalSettings.AuthToPort or '') %} {% endif %} +{% macro generate_copy_headers() %} + {% if generalSettings.CopyHeaders %} + {% for header_uuid in generalSettings.CopyHeaders.split(',') %} + {% set header = helpers.toList('Pischem.caddy.reverseproxy.header') | selectattr('@uuid', 'equalto', header_uuid) | first %} + {% if header and header.HeaderType %} + copy_headers {{ header.HeaderType }} + {% endif %} + {% endfor %} + {% endif %} +{% endmacro %} {% if generalSettings.AuthProvider == 'authelia' %} forward_auth {{ auth_url }} { {% if generalSettings.AuthToUri %} uri {{ generalSettings.AuthToUri|default("") }} {% endif %} - {% if generalSettings.AuthCopyHeaders|default("") == "" %} - copy_headers Remote-User Remote-Groups Remote-Name Remote-Email - {% else %} - copy_headers {{ generalSettings.AuthCopyHeaders.split(',') | join(' ') }} - {% endif %} + copy_headers Remote-User + copy_headers Remote-Groups + copy_headers Remote-Name + copy_headers Remote-Email + {{ generate_copy_headers() }} } {% elif generalSettings.AuthProvider == 'authentik' %} reverse_proxy /outpost.goauthentik.io/* {{ auth_url }} { @@ -28,10 +38,17 @@ {% if generalSettings.AuthToUri %} uri {{ generalSettings.AuthToUri|default("") }} {% endif %} - {% if generalSettings.AuthCopyHeaders|default("") == "" %} - copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version - {% else %} - copy_headers {{ generalSettings.AuthCopyHeaders.split(',') | join(' ') }} - {% endif %} + copy_headers X-Authentik-Username + copy_headers X-Authentik-Groups + copy_headers X-Authentik-Email + copy_headers X-Authentik-Name + copy_headers X-Authentik-Uid + copy_headers X-Authentik-Jwt + copy_headers X-Authentik-Meta-Jwks + copy_headers X-Authentik-Meta-Outpost + copy_headers X-Authentik-Meta-Provider + copy_headers X-Authentik-Meta-App + copy_headers X-Authentik-Meta-Version + {{ generate_copy_headers() }} } {% endif %} From 44683ac25f9cedbd08f84e498d40c2337869af35 Mon Sep 17 00:00:00 2001 From: kulikov-a Date: Sun, 9 Feb 2025 21:29:27 +0300 Subject: [PATCH 005/389] security/intrusion-detection-content-pt-open: new ruleset plugin (#4462) --- .../LICENSE | 24 +++++++++++++++++++ .../Makefile | 6 +++++ .../pkg-descr | 12 ++++++++++ .../suricata/metadata/rules/pt-open.xml | 11 +++++++++ 4 files changed, 53 insertions(+) create mode 100644 security/intrusion-detection-content-pt-open/LICENSE create mode 100644 security/intrusion-detection-content-pt-open/Makefile create mode 100644 security/intrusion-detection-content-pt-open/pkg-descr create mode 100644 security/intrusion-detection-content-pt-open/src/opnsense/scripts/suricata/metadata/rules/pt-open.xml diff --git a/security/intrusion-detection-content-pt-open/LICENSE b/security/intrusion-detection-content-pt-open/LICENSE new file mode 100644 index 000000000..227437845 --- /dev/null +++ b/security/intrusion-detection-content-pt-open/LICENSE @@ -0,0 +1,24 @@ +(C) 2024 JSC Positive Technologies. All rights reserved. + +Definitions + +“Program” refers to any copyrightable work (including rule sets for open source network threat detection engine Suricata) and associated documentation files licensed under this License, accessible at: https://rules.ptsecurity.com “License” means the terms of this license agreement which apply to the Program. +“Licensee” refers to individuals or legal entities accessing and/or using the Program. +“Modify” a work (part of the work) means to make any change, including translation of the Program from one language into another, except for adaptation. +“Copyright holder” means JSС Positive Technologies as the holder of the exclusive right to the Program. + +Legal Usage + +The Licensee is hereby granted free of charge the rights to use, copy, publish, distribute, sublicense, and/or sell copies of the Program for non-commercial and commercial use subject to the following conditions: +· The above copyright notice shall be included in all copies or substantial portions of the Program. +· Neither the name of the Copyright holder nor the names of its contributors may be used to endorse or promote programs in which the Program was integrated without specific prior written permission. +· Redistributions of the Program must retain the above copyright notice and the full text of the License. +No permission is hereby granted to the Licensee to modify the Program and distribute the modified Program. However, for the avoidance of doubt, the Licensee is granted the right to integrate the original Program into other programs and distribute such programs. + +Applicable law + +This License is governed by the laws of the Russian Federation. The rules of the article 1286.1 of the Civil Code of the Russian Federation are applicable to this License. + +Disclaimer + +THIS PROGRAM IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS”. UNDER NO CIRCUMSTANCES THE COPYRIGHT HOLDER IS LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES RESULTING FROM (I) THE LICENSEE'S USE OF THE PROGRAM; (II) THE LICENSEE'S INTERPRETATION AND APPLICATION OF ANY FILES, METHODS, OR ANY OTHER INFORMATION PROVIDED ON OR THROUGH THE PROGRAM; (III) THE FAILURE OF THE PROGRAM TO MEET THE LICENSEE'S EXPECTATIONS. IF, NOTWITHSTANDING THE OTHER PROVISIONS OF THIS LISENCE, THE COPYRIGHT HOLDER IS FORCED TO BEAR RESPONSIBILITY TO THE LICENSEE FOR ANY LOSSES RELATED TO THE LICENSEE'S USE OF THE PROGRAM, THE COPYRIGHT HOLDER’S LIABILITY SHALL IN NO CASE EXCEED THE EQUIVALENT OF 10 (TEN) U.S. DOLLARS. diff --git a/security/intrusion-detection-content-pt-open/Makefile b/security/intrusion-detection-content-pt-open/Makefile new file mode 100644 index 000000000..6941de8be --- /dev/null +++ b/security/intrusion-detection-content-pt-open/Makefile @@ -0,0 +1,6 @@ +PLUGIN_NAME= intrusion-detection-content-ptopen +PLUGIN_VERSION= 1.0 +PLUGIN_COMMENT= IDS Positive Technologies ESC ruleset +PLUGIN_MAINTAINER= kulikov.a@gmail.com +PLUGIN_WWW= https://rules.ptsecurity.com +.include "../../Mk/plugins.mk" diff --git a/security/intrusion-detection-content-pt-open/pkg-descr b/security/intrusion-detection-content-pt-open/pkg-descr new file mode 100644 index 000000000..ee22fba6c --- /dev/null +++ b/security/intrusion-detection-content-pt-open/pkg-descr @@ -0,0 +1,12 @@ +IDS PT ESC open ruleset designed to detect a variety of network threats, +including those communicated under TLS. +PT Rules is an open-source project focused on enhancing network security +through proactive threat detection. As the PT Expert Security Center attack +detection team, we are a dedicated group of cybersecurity experts committed +to improve network security through open-source initiatives. + +Don't forget to define the $DC_SERVERS rule-variable if you want to use the +protection rules against DCShadow/DCSync attacks. + +LICENSE: https://rules.ptsecurity.com/view/LICENSE.txt +WWW: https://rules.ptsecurity.com/ diff --git a/security/intrusion-detection-content-pt-open/src/opnsense/scripts/suricata/metadata/rules/pt-open.xml b/security/intrusion-detection-content-pt-open/src/opnsense/scripts/suricata/metadata/rules/pt-open.xml new file mode 100644 index 000000000..632c0bdf1 --- /dev/null +++ b/security/intrusion-detection-content-pt-open/src/opnsense/scripts/suricata/metadata/rules/pt-open.xml @@ -0,0 +1,11 @@ + + + + + ptopen-attacks.rules + ptopen-info.rules + ptopen-malware.rules + ptopen-tools.rules + ptopen-windows.rules + + From 252e3ec84e51d47a7bb6cfe33dca52f1ae81bddf Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Tue, 11 Feb 2025 11:43:16 +0100 Subject: [PATCH 006/389] dns/ddclient: new version now --- dns/ddclient/Makefile | 3 +-- dns/ddclient/pkg-descr | 5 +++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/dns/ddclient/Makefile b/dns/ddclient/Makefile index f52ee87b0..1d004d558 100644 --- a/dns/ddclient/Makefile +++ b/dns/ddclient/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= ddclient -PLUGIN_VERSION= 1.26 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.27 PLUGIN_DEPENDS= ddclient py${PLUGIN_PYTHON}-boto3 PLUGIN_COMMENT= Dynamic DNS client PLUGIN_MAINTAINER= ad@opnsense.org diff --git a/dns/ddclient/pkg-descr b/dns/ddclient/pkg-descr index c4aad2a2e..3e91a0e2a 100644 --- a/dns/ddclient/pkg-descr +++ b/dns/ddclient/pkg-descr @@ -6,6 +6,11 @@ WWW: https://github.com/ddclient/ddclient Plugin Changelog ================ +1.27 + +* Add support for altering IPv6 addresses in native backend (contributed by SaarLAN-Pissbeutel) +* Fix Netcup host/domain recognition (contributed by SaarLAN-Pissbeutel) + 1.26 * Add ddclient TTL configuration in Gandi and GoDaddy (contributed by David PHAM-VAN) From f26a9c5ea839e61d9531e459777fe976270fccac Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 12 Feb 2025 09:01:30 +0100 Subject: [PATCH 007/389] README: sync --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index fcc3df8e3..de7ef1585 100644 --- a/README.md +++ b/README.md @@ -83,6 +83,7 @@ security/crowdsec -- Lightweight and collaborative security engine security/etpro-telemetry -- ET Pro Telemetry Edition security/intrusion-detection-content-et-open -- IDS Proofpoint full ET open ruleset complementary subset for ET Pro Telemetry edition security/intrusion-detection-content-et-pro -- IDS Proofpoint ET Pro ruleset (needs a valid subscription) +security/intrusion-detection-content-pt-open -- IDS Positive Technologies ESC ruleset security/intrusion-detection-content-snort-vrt -- IDS Snort VRT ruleset (needs registration or subscription) security/maltrail -- Malicious traffic detection system security/openconnect -- OpenConnect Client From 8fbddef87906a0114963d90503674ffc24ce1c48 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 13 Feb 2025 11:05:56 +0100 Subject: [PATCH 008/389] net/frr: Use frr-reload instead of restarting the service on configuration changes (#4535) * net/frr: Use frr-reload instead of restarting the service on configuration changes * Update net/frr/Makefile Co-authored-by: Franco Fichtner * net/frr: Add changelog --------- Co-authored-by: Franco Fichtner --- net/frr/Makefile | 5 ++--- net/frr/pkg-descr | 8 ++++++++ .../controllers/OPNsense/Quagga/Api/ServiceController.php | 6 ++++++ .../opnsense/service/conf/actions.d/actions_quagga.conf | 7 +++++++ 4 files changed, 23 insertions(+), 3 deletions(-) diff --git a/net/frr/Makefile b/net/frr/Makefile index a3813aca2..46155e8a8 100644 --- a/net/frr/Makefile +++ b/net/frr/Makefile @@ -1,8 +1,7 @@ PLUGIN_NAME= frr -PLUGIN_VERSION= 1.42 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.43 PLUGIN_COMMENT= The FRRouting Protocol Suite -PLUGIN_DEPENDS= frr8 +PLUGIN_DEPENDS= frr8-pythontools PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 diff --git a/net/frr/pkg-descr b/net/frr/pkg-descr index 529a3b2c4..3341c9126 100644 --- a/net/frr/pkg-descr +++ b/net/frr/pkg-descr @@ -12,6 +12,14 @@ WWW: https://frrouting.org/ Plugin Changelog ================ +1.43 + +* Use frr-reload instead of restarting the service on configuration changes (opnsense/plugins/issues/4529) +* Migrate separate daemon config files into single frr.conf file (opnsense/plugins/issues/4510) +* Add help texts to all options and expose them in grid as columns (opnsense/plugins/pull/4494) +* Replace deprecated passive-interface directive in ospf (opnsense/plugins/issues/4534) +* Style cleanup and unify forms (opnsense/plugins/pull/4450) + 1.42 * Fix updatesource not rendering when interface has been selected diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php index c62632492..9ddce0357 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php @@ -41,4 +41,10 @@ class ServiceController extends ApiMutableServiceControllerBase protected static $internalServiceTemplate = 'OPNsense/Quagga'; protected static $internalServiceEnabled = 'enabled'; protected static $internalServiceName = 'quagga'; + + protected function reconfigureForceRestart() + { + // frr can reload using frr-reload and frr8-pythontools + return 0; + } } diff --git a/net/frr/src/opnsense/service/conf/actions.d/actions_quagga.conf b/net/frr/src/opnsense/service/conf/actions.d/actions_quagga.conf index 4c5079caf..aa2e0b70b 100644 --- a/net/frr/src/opnsense/service/conf/actions.d/actions_quagga.conf +++ b/net/frr/src/opnsense/service/conf/actions.d/actions_quagga.conf @@ -17,6 +17,13 @@ type:script message:restarting frr description:Restart FRR +[reload] +command:service frr reload +parameters: +type:script +message:reloading frr +description:Reload FRR + [status] command:/usr/local/etc/rc.d/frr status; exit 0 parameters: From 7a72050636f37ba90547f0ff663df7608a008d69 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 13 Feb 2025 11:07:18 +0100 Subject: [PATCH 009/389] net/frr: Implement frr.conf file (#4528) * net/frr: Implement frr.conf file, Part 1 * net/frr: Implement frr.conf file, Part 2 * net/frr: Implement frr.conf file, Part 3 * net/frr: Fix sa_policies.conf generation, include fix for passive interfaces https://github.com/opnsense/plugins/pull/4536, adjust comments --- .../templates/OPNsense/Quagga/+TARGETS | 14 +-- .../templates/OPNsense/Quagga/bfdd.conf | 20 +---- .../templates/OPNsense/Quagga/bgpd.conf | 26 +----- .../templates/OPNsense/Quagga/frr.conf | 8 ++ .../templates/OPNsense/Quagga/ospf6d.conf | 22 +---- .../OPNsense/Quagga/ospf6d_carp.conf | 1 + .../templates/OPNsense/Quagga/ospfd.conf | 86 ++++++++----------- .../templates/OPNsense/Quagga/ospfd_carp.conf | 1 + .../templates/OPNsense/Quagga/ripd.conf | 17 +--- .../OPNsense/Quagga/sa_policies.conf | 1 + .../templates/OPNsense/Quagga/staticd.conf | 12 +-- .../templates/OPNsense/Quagga/vtysh.conf | 1 + .../templates/OPNsense/Quagga/zebra.conf | 16 +--- 13 files changed, 60 insertions(+), 165 deletions(-) create mode 100644 net/frr/src/opnsense/service/templates/OPNsense/Quagga/frr.conf diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/+TARGETS b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/+TARGETS index 430e87167..9ee342bb4 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/+TARGETS +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/+TARGETS @@ -1,13 +1,7 @@ -bfdd.conf:/usr/local/etc/frr/bfdd.conf -bgpd.conf:/usr/local/etc/frr/bgpd.conf -ospfd.conf:/usr/local/etc/frr/ospfd.conf -ospfd_carp.conf:/usr/local/etc/frr/ospfd_carp.conf -ospf6d.conf:/usr/local/etc/frr/ospf6d.conf -ospf6d_carp.conf:/usr/local/etc/frr/ospf6d_carp.conf -ripd.conf:/usr/local/etc/frr/ripd.conf -sa_policies.conf:/usr/local/etc/frr/sa_policies.conf -staticd.conf:/usr/local/etc/frr/staticd.conf frr:/etc/rc.conf.d/frr -zebra.conf:/usr/local/etc/frr/zebra.conf +frr.conf:/usr/local/etc/frr/frr.conf vtysh.conf:/usr/local/etc/frr/vtysh.conf +ospf6d_carp.conf:/usr/local/etc/frr/ospf6d_carp.conf +ospfd_carp.conf:/usr/local/etc/frr/ospfd_carp.conf +sa_policies.conf:/usr/local/etc/frr/sa_policies.conf syslog-ng-frr-events.conf:/usr/local/etc/syslog-ng.conf.d/frr-events.conf diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bfdd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bfdd.conf index 235d5d9b7..e4e3d832c 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bfdd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bfdd.conf @@ -1,22 +1,5 @@ +{# included in frr.conf #} {% if helpers.exists('OPNsense.quagga.bfd.enabled') and OPNsense.quagga.bfd.enabled == '1' %} -! -! Zebra configuration saved from vty -! 2017/03/03 20:21:04 -! -{% if helpers.exists('OPNsense.quagga.general') %} -{% if helpers.exists('OPNsense.quagga.general.enablesyslog') and OPNsense.quagga.general.enablesyslog == '1' %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if helpers.exists('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} -{% endif %} -! -! -! -line vty -! -! bfd {% if helpers.exists('OPNsense.quagga.bfd.neighbors.neighbor') %} {% for neighbor in helpers.toList('OPNsense.quagga.bfd.neighbors.neighbor') %} @@ -25,5 +8,4 @@ bfd {% endif %} {% endfor %} {% endif %} -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf index 4dbaaa487..e560f3c25 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf @@ -1,3 +1,4 @@ +{# included in frr.conf #} {% if helpers.exists('OPNsense.quagga.bgp.enabled') and OPNsense.quagga.bgp.enabled == '1' %} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} {% set addressFamilies = ['ipv4', 'ipv6' ] %} @@ -26,21 +27,6 @@ {% endif %} {% endfor %} {% endif %} -! -! Zebra configuration saved from vty -! 2017/03/03 20:21:04 -! -{% if helpers.exists('OPNsense.quagga.general') %} -{% if helpers.exists('OPNsense.quagga.general.enablesyslog') and OPNsense.quagga.general.enablesyslog == '1' %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if helpers.exists('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} -{% endif %} -! -! -! {% if helpers.exists('OPNsense.quagga.bgp.asnumber') and OPNsense.quagga.bgp.asnumber != '' %} router bgp {{ OPNsense.quagga.bgp.asnumber }} {% if not helpers.empty('OPNsense.quagga.bgp.logneighborchanges') %} @@ -220,7 +206,6 @@ router bgp {{ OPNsense.quagga.bgp.asnumber }} {% endif %} {% endfor %} exit-address-family -! {% endfor %} {% if helpers.exists('OPNsense.quagga.bgp.prefixlists.prefixlist') %} @@ -228,13 +213,11 @@ router bgp {{ OPNsense.quagga.bgp.asnumber }} {% if prefixlist.enabled == '1' and prefixlist.version == 'IPv4' %} ip prefix-list {{ prefixlist.name }} seq {{ prefixlist.seqnumber }} {{ prefixlist.action }} {{ prefixlist.network }} {% endif %} -! {% if prefixlist.enabled == '1' and prefixlist.version == 'IPv6' %} ipv6 prefix-list {{ prefixlist.name }} seq {{ prefixlist.seqnumber }} {{ prefixlist.action }} {{ prefixlist.network }} {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.bgp.aspaths.aspath') %} {% for aspath in helpers.sortDictList(OPNsense.quagga.bgp.aspaths.aspath, 'number' ) %} {% if aspath.enabled == '1' %} @@ -242,7 +225,6 @@ bgp as-path access-list {{ aspath.number }} {{ aspath.action }} {{ aspath.as }} {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.bgp.communitylists.communitylist') %} {% for communitylist in helpers.sortDictList(OPNsense.quagga.bgp.communitylists.communitylist, 'number' ) %} {% if communitylist.enabled == '1' %} @@ -250,7 +232,6 @@ bgp community-list {{ communitylist.number }} seq {{ communitylist.seqnumber }} {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.bgp.routemaps.routemap') %} {% for routemap in helpers.sortDictList(OPNsense.quagga.bgp.routemaps.routemap, 'name', 'id' ) %} {% if routemap.enabled == '1' %} @@ -290,13 +271,8 @@ route-map {{ routemap.name }} {{ routemap.action }} {{ routemap.id }} {% endif %} {% endfor %} {% endif %} -! {% endif %} -! {% if helpers.exists('OPNsense.quagga.bgpd.enabled') and OPNsense.quagga.general.enablesnmp == '1' %} agentx {% endif %} -! -line vty -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/frr.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/frr.conf new file mode 100644 index 000000000..b8da1a348 --- /dev/null +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/frr.conf @@ -0,0 +1,8 @@ +{# Main configuration file #} +{% include "OPNsense/Quagga/zebra.conf" %} +{% include "OPNsense/Quagga/ripd.conf" %} +{% include "OPNsense/Quagga/ospfd.conf" %} +{% include "OPNsense/Quagga/ospf6d.conf" %} +{% include "OPNsense/Quagga/bgpd.conf" %} +{% include "OPNsense/Quagga/bfdd.conf" %} +{% include "OPNsense/Quagga/staticd.conf" %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d.conf index 3c066333a..f581d001a 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d.conf @@ -1,26 +1,14 @@ +{# included in frr.conf #} {% macro cline(directive, modelname) -%}{% if modelname %} ipv6 ospf6 {{ directive }} {{ modelname }} {% endif %}{%- endmacro %} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} {% if not helpers.empty('OPNsense.quagga.ospf6.enabled') %} -! -! Zebra configuration saved from vty -! 2017/03/03 20:21:04 -! {% if helpers.exists('OPNsense.quagga.general') %} -{% if not helpers.empty('OPNsense.quagga.general.enablesyslog') %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if helpers.exists('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} {% if OPNsense.quagga.general.enablesnmp == '1' %} agentx {% endif %} {% endif %} -! -! -! {% for interface in helpers.toList('OPNsense.quagga.ospf6.interfaces.interface') %} {% if interface.enabled == '1' %} interface {{ physical_interface(interface.interfacename) }} @@ -38,10 +26,9 @@ interface {{ physical_interface(interface.interfacename) }} }}{{ cline("hello-interval",interface.hellointerval) }}{{ cline("priority",interface.priority) }}{{ cline("retransmit-interval",interface.retransmitinterval) -}}! +}} {% endif %} {% endfor %} -! router ospf6 {% if not helpers.empty('OPNsense.quagga.ospf6.routerid') %} ospf6 router-id {{ OPNsense.quagga.ospf6.routerid }} @@ -88,7 +75,6 @@ router ospf6 {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.ospf6.prefixlists.prefixlist') %} {% for prefixlist in helpers.sortDictList(OPNsense.quagga.ospf6.prefixlists.prefixlist, 'name', 'seqnumber' ) %} {% if prefixlist.enabled == '1' %} @@ -96,7 +82,6 @@ ipv6 prefix-list {{ prefixlist.name }} seq {{ prefixlist.seqnumber }} {{ prefixl {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.ospf6.routemaps.routemap') %} {% for routemap in helpers.sortDictList(OPNsense.quagga.ospf6.routemaps.routemap, 'name', 'id' ) %} {% if routemap.enabled == '1' %} @@ -115,7 +100,4 @@ route-map {{ routemap.name }} {{ routemap.action }} {{ routemap.id }} {% endif %} {% endfor %} {% endif %} -! -line vty -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d_carp.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d_carp.conf index af3400036..3d03df677 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d_carp.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospf6d_carp.conf @@ -1,3 +1,4 @@ +{# consumed by ospf6d.py #} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} {% if helpers.exists('OPNsense.quagga.ospf6.interfaces.interface') %} {% for interface in helpers.toList('OPNsense.quagga.ospf6.interfaces.interface') %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf index 03f648c2f..b937c735b 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf @@ -1,54 +1,51 @@ +{# included in frr.conf #} {% macro cline(directive, modelname) -%}{% if modelname %} ip ospf {{ directive }} {{ modelname }} {% endif %}{%- endmacro %} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} {% if helpers.exists('OPNsense.quagga.ospf.enabled') and OPNsense.quagga.ospf.enabled == '1' %} -! -! Zebra configuration saved from vty -! 2017/03/03 20:21:04 -! {% if helpers.exists('OPNsense.quagga.general') %} -{% if helpers.exists('OPNsense.quagga.general.enablesyslog') and OPNsense.quagga.general.enablesyslog == '1' %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if helpers.exists('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} {% if OPNsense.quagga.general.enablesnmp == '1' %} agentx {% endif %} {% endif %} -! -! -! -{% if helpers.exists('OPNsense.quagga.ospf.interfaces.interface') %} -{% for interface in helpers.toList('OPNsense.quagga.ospf.interfaces.interface') %} -{% if interface.enabled == '1' %} -interface {{ physical_interface(interface.interfacename) }} -{% if interface.bfd|default('') == '1' %} - ip ospf bfd -{% endif %} -{% if interface.networktype %} -{{ cline("network",interface.networktype) -}}{% endif %} -{% if interface.authtype and interface.authtype == 'message-digest' -%}{{ cline("authentication",interface.authtype) -}}{{ cline("message-digest-key " + interface.authkey_id + " md5",interface.authkey) -}}{% elif interface.authtype and interface.authtype == 'plain' -%}{{ cline("authentication",' ') -}}{{ cline("authentication-key",interface.authkey) -}}{% endif -%}{{ cline("area",interface.area) -}}{{ cline("cost",interface.cost) -}}{{ cline("dead-interval",interface.deadinterval) -}}{{ cline("hello-interval",interface.hellointerval) -}}{{ cline("priority",interface.priority) -}}{{ cline("retransmit-interval",interface.retransmitinterval) -}}! -{% endif %} -{% endfor %} +{% set passive_interfaces = [] %} +{% if helpers.exists('OPNsense.quagga.ospf.passiveinterfaces') and OPNsense.quagga.ospf.passiveinterfaces != '' %} +{% for line in OPNsense.quagga.ospf.passiveinterfaces.split(',') %} +{% set iface = physical_interface(line) %} +{% set _ = passive_interfaces.append(iface) %} +interface {{ iface }} + ip ospf passive +{% endfor %} +{% endif %} +{# Render only the enabled non-passive interfaces past this point #} +{% if helpers.exists('OPNsense.quagga.ospf.interfaces.interface') %} +{% for interface in helpers.toList('OPNsense.quagga.ospf.interfaces.interface') %} +{% set iface = physical_interface(interface.interfacename) %} +{% if interface.enabled == '1' and iface not in passive_interfaces %} +interface {{ iface }} +{% if interface.bfd|default('') == '1' %} + ip ospf bfd +{% endif %} +{% if interface.networktype %} + {{ cline("network", interface.networktype) }} +{% endif %} +{% if interface.authtype and interface.authtype == 'message-digest' %} + {{ cline("authentication", interface.authtype) }} + {{ cline("message-digest-key " + interface.authkey_id + " md5", interface.authkey) }} +{% elif interface.authtype and interface.authtype == 'plain' %} + {{ cline("authentication", ' ') }} + {{ cline("authentication-key", interface.authkey) }} +{% endif %} + {{ cline("area", interface.area) }} + {{ cline("cost", interface.cost) }} + {{ cline("dead-interval", interface.deadinterval) }} + {{ cline("hello-interval", interface.hellointerval) }} + {{ cline("priority", interface.priority) }} + {{ cline("retransmit-interval", interface.retransmitinterval) }} +{% endif %} +{% endfor %} {% endif %} -! router ospf {% if helpers.exists('OPNsense.quagga.ospf.logadjacencychanges') and OPNsense.quagga.ospf.logadjacencychanges == '1' %} log-adjacency-changes @@ -64,10 +61,6 @@ router ospf {% if helpers.exists('OPNsense.quagga.ospf.redistributemap') and OPNsense.quagga.ospf.redistributemap != '' %}{% set line = line + " route-map " + helpers.getUUID(OPNsense.quagga.ospf.redistributemap).name %}{% endif %} redistribute {{ line }} {% endfor %}{% endif %} -{% if helpers.exists('OPNsense.quagga.ospf.passiveinterfaces') and OPNsense.quagga.ospf.passiveinterfaces != '' %} -{% for line in OPNsense.quagga.ospf.passiveinterfaces.split(',') %} - passive-interface {{ physical_interface(line) }} -{% endfor %}{% endif %} {% if helpers.exists('OPNsense.quagga.ospf.networks.network') %} {% for network in helpers.toList('OPNsense.quagga.ospf.networks.network') %} {% if network.enabled == '1' %} @@ -98,7 +91,6 @@ router ospf default-information originate{% if helpers.exists('OPNsense.quagga.ospf.originatealways') and OPNsense.quagga.ospf.originatealways == '1' %} always {% endif %}{% if helpers.exists('OPNsense.quagga.ospf.originatemetric') and OPNsense.quagga.ospf.originatemetric != '' %} metric {{ OPNsense.quagga.ospf.originatemetric }}{% endif %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.ospf.prefixlists.prefixlist') %} {% for prefixlist in helpers.sortDictList(OPNsense.quagga.ospf.prefixlists.prefixlist, 'name', 'seqnumber' ) %} {% if prefixlist.enabled == '1' %} @@ -106,7 +98,6 @@ ip prefix-list {{ prefixlist.name }} seq {{ prefixlist.seqnumber }} {{ prefixlis {% endif %} {% endfor %} {% endif %} -! {% if helpers.exists('OPNsense.quagga.ospf.routemaps.routemap') %} {% for routemap in helpers.sortDictList(OPNsense.quagga.ospf.routemaps.routemap, 'name', 'id' ) %} {% if routemap.enabled == '1' %} @@ -125,7 +116,4 @@ route-map {{ routemap.name }} {{ routemap.action }} {{ routemap.id }} {% endif %} {% endfor %} {% endif %} -! -line vty -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd_carp.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd_carp.conf index 724d7cb3c..d67fdde4a 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd_carp.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd_carp.conf @@ -1,3 +1,4 @@ +{# consumed by ospfd.py #} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} {% if helpers.exists('OPNsense.quagga.ospf.interfaces.interface') %} {% for interface in helpers.toList('OPNsense.quagga.ospf.interfaces.interface') %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ripd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ripd.conf index 70532d4f1..70d29a835 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ripd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ripd.conf @@ -1,18 +1,6 @@ +{# included in frr.conf #} {% if helpers.exists('OPNsense.quagga.rip.enabled') and OPNsense.quagga.rip.enabled == '1' %} {% from 'OPNsense/Macros/interface.macro' import physical_interface %} -! -! Zebra configuration saved from vty -! 2017/03/26 22:40:16 -! -{% if helpers.exists('OPNsense.quagga.general') %} -{% if helpers.exists('OPNsense.quagga.general.enablesyslog') and OPNsense.quagga.general.enablesyslog == '1' %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if helpers.exists('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} -{% endif %} -! router rip version {{ OPNsense.quagga.rip.version }} {% if helpers.exists('OPNsense.quagga.rip.redistribute') and OPNsense.quagga.rip.redistribute != '' %} @@ -31,7 +19,4 @@ router rip {% if helpers.exists('OPNsense.quagga.rip.defaultmetric') and OPNsense.quagga.rip.defaultmetric != '' %} default-metric {{ OPNsense.quagga.rip.defaultmetric }} {% endif %} -! -line vty -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/sa_policies.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/sa_policies.conf index bb1587cf3..9f0df5422 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/sa_policies.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/sa_policies.conf @@ -1,3 +1,4 @@ +{# consumed by scripts/frr/register_sas #} {% if helpers.exists('OPNsense.quagga.bgp.enabled') and OPNsense.quagga.bgp.enabled == '1' %} {% if helpers.exists('OPNsense.quagga.bgp.neighbors.neighbor') %} {% for neighbor in helpers.toList('OPNsense.quagga.bgp.neighbors.neighbor') %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/staticd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/staticd.conf index 099a06ea7..fdff7d0f2 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/staticd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/staticd.conf @@ -1,18 +1,8 @@ -! -! staticd Zebra config autogenerated by OPNsense -! +{# included in frr.conf #} {% if not helpers.empty('OPNsense.quagga.static.enabled') %} -{% if not helpers.empty('OPNsense.quagga.general') %} -log syslog {{ OPNsense.quagga.general.sysloglevel }} -{% endif %} -{% if not helpers.empty('OPNsense.quagga.general.profile') %} -frr defaults {{ OPNsense.quagga.general.profile }} -{% endif %} -! {% for route in helpers.toList('OPNsense.quagga.static.routes.route') %} {% if route.enabled == '1' %} {% if ':' in route.network %}ipv6{% else %}ip{% endif %} route {{ route.network }} {{ route.gateway|default('')}} {{ helpers.physical_interface(route.interfacename) }} {% endif %} {% endfor %} -! {% endif %} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/vtysh.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/vtysh.conf index e69de29bb..57d0b081d 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/vtysh.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/vtysh.conf @@ -0,0 +1 @@ +{# file is empty on purpose since vtysh requires a configuration file to exist #} diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/zebra.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/zebra.conf index fbc685f72..1822f47f1 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/zebra.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/zebra.conf @@ -1,28 +1,14 @@ +{# included in frr.conf #} {% if helpers.exists('OPNsense.quagga.general') %} -! -! Zebra configuration saved from vty -! 2017/03/03 20:21:04 -! {% if helpers.exists('OPNsense.quagga.general.profile') %} frr defaults {{ OPNsense.quagga.general.profile }} {% endif %} {% if helpers.exists('OPNsense.quagga.general.enablesyslog') and OPNsense.quagga.general.enablesyslog == '1' %} log syslog {{ OPNsense.quagga.general.sysloglevel }} {% endif %} -! -! -! -! -! {% if OPNsense.quagga.general.enablesnmp == '1' %} agentx {% endif %} -! -! ip forwarding ipv6 forwarding -! -! -line vty -! {% endif %} From f9dbcde25ec8f079189915a9d42ba60a846c2350 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 13 Feb 2025 11:08:30 +0100 Subject: [PATCH 010/389] net/frr: Integrate layout_partials/base_apply_button (#4542) --- .../OPNsense/Quagga/BfdController.php | 2 +- .../OPNsense/Quagga/BgpController.php | 12 +++++------ .../OPNsense/Quagga/Ospf6Controller.php | 8 ++++---- .../OPNsense/Quagga/OspfController.php | 8 ++++---- .../OPNsense/Quagga/StaticController.php | 2 +- .../mvc/app/views/OPNsense/Quagga/bfd.volt | 20 +------------------ .../mvc/app/views/OPNsense/Quagga/bgp.volt | 20 +------------------ .../app/views/OPNsense/Quagga/general.volt | 16 +-------------- .../mvc/app/views/OPNsense/Quagga/ospf.volt | 19 +----------------- .../mvc/app/views/OPNsense/Quagga/ospf6.volt | 19 +----------------- .../mvc/app/views/OPNsense/Quagga/rip.volt | 16 +-------------- .../mvc/app/views/OPNsense/Quagga/static.volt | 20 +------------------ 12 files changed, 23 insertions(+), 139 deletions(-) diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BfdController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BfdController.php index 88d9582ba..ddec80fac 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BfdController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BfdController.php @@ -35,7 +35,7 @@ class BfdController extends \OPNsense\Base\IndexController $this->view->bfdForm = $this->getForm("bfd"); $this->view->formDialogEditBFDNeighbor = $this->getForm("dialogEditBFDNeighbor"); - $this->view->formGridEditBFDNeighbor = $this->getFormGrid("dialogEditBFDNeighbor", null, "BFDChangeMessage"); + $this->view->formGridEditBFDNeighbor = $this->getFormGrid("dialogEditBFDNeighbor"); $this->view->pick('OPNsense/Quagga/bfd'); } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php index b31579b66..1374be541 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php @@ -35,22 +35,22 @@ class BgpController extends \OPNsense\Base\IndexController $this->view->bgpForm = $this->getForm("bgp"); $this->view->formDialogEditBGPNeighbor = $this->getForm("dialogEditBGPNeighbor"); - $this->view->formGridEditBGPNeighbor = $this->getFormGrid("dialogEditBGPNeighbor", null, "BGPChangeMessage"); + $this->view->formGridEditBGPNeighbor = $this->getFormGrid("dialogEditBGPNeighbor"); $this->view->formDialogEditBGPASPaths = $this->getForm("dialogEditBGPASPath"); - $this->view->formGridEditBGPASPaths = $this->getFormGrid("dialogEditBGPASPath", null, "BGPChangeMessage"); + $this->view->formGridEditBGPASPaths = $this->getFormGrid("dialogEditBGPASPath"); $this->view->formDialogEditBGPPrefixLists = $this->getForm("dialogEditBGPPrefixLists"); - $this->view->formGridEditBGPPrefixLists = $this->getFormGrid("dialogEditBGPPrefixLists", null, "BGPChangeMessage"); + $this->view->formGridEditBGPPrefixLists = $this->getFormGrid("dialogEditBGPPrefixLists"); $this->view->formDialogEditBGPCommunityLists = $this->getForm("dialogEditBGPCommunityLists"); - $this->view->formGridEditBGPCommunityLists = $this->getFormGrid("dialogEditBGPCommunityLists", null, "BGPChangeMessage"); + $this->view->formGridEditBGPCommunityLists = $this->getFormGrid("dialogEditBGPCommunityLists"); $this->view->formDialogEditBGPRouteMaps = $this->getForm("dialogEditBGPRouteMaps"); - $this->view->formGridEditBGPRouteMaps = $this->getFormGrid("dialogEditBGPRouteMaps", null, "BGPChangeMessage"); + $this->view->formGridEditBGPRouteMaps = $this->getFormGrid("dialogEditBGPRouteMaps"); $this->view->formDialogEditBGPPeergroups = $this->getForm("dialogEditBGPPeergroups"); - $this->view->formGridEditBGPPeergroups = $this->getFormGrid("dialogEditBGPPeergroups", null, "BGPChangeMessage"); + $this->view->formGridEditBGPPeergroups = $this->getFormGrid("dialogEditBGPPeergroups"); $this->view->pick('OPNsense/Quagga/bgp'); } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php index 785c3c827..107cafa78 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php @@ -32,16 +32,16 @@ class Ospf6Controller extends \OPNsense\Base\IndexController $this->view->ospf6Form = $this->getForm("ospf6"); $this->view->formDialogEditNetwork = $this->getForm("dialogEditOSPF6Network"); - $this->view->formGridEditNetwork = $this->getFormGrid("dialogEditOSPF6Network", null, "OSPF6ChangeMessage"); + $this->view->formGridEditNetwork = $this->getFormGrid("dialogEditOSPF6Network"); $this->view->formDialogEditInterface = $this->getForm("dialogEditOSPF6Interface"); - $this->view->formGridEditInterface = $this->getFormGrid("dialogEditOSPF6Interface", null, "OSPF6ChangeMessage"); + $this->view->formGridEditInterface = $this->getFormGrid("dialogEditOSPF6Interface"); $this->view->formDialogEditPrefixLists = $this->getForm("dialogEditOSPF6PrefixLists"); - $this->view->formGridEditPrefixLists = $this->getFormGrid("dialogEditOSPF6PrefixLists", null, "OSPF6ChangeMessage"); + $this->view->formGridEditPrefixLists = $this->getFormGrid("dialogEditOSPF6PrefixLists"); $this->view->formDialogEditRouteMaps = $this->getForm("dialogEditOSPF6RouteMaps"); - $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPF6RouteMaps", null, "OSPF6ChangeMessage"); + $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPF6RouteMaps"); $this->view->pick('OPNsense/Quagga/ospf6'); } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php index 3cfb380e6..0ab2f1588 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php @@ -35,16 +35,16 @@ class OspfController extends \OPNsense\Base\IndexController $this->view->generalForm = $this->getForm("ospf"); $this->view->formDialogEditNetwork = $this->getForm("dialogEditOSPFNetwork"); - $this->view->formGridEditNetwork = $this->getFormGrid("dialogEditOSPFNetwork", null, "OSPFChangeMessage"); + $this->view->formGridEditNetwork = $this->getFormGrid("dialogEditOSPFNetwork"); $this->view->formDialogEditInterface = $this->getForm("dialogEditOSPFInterface"); - $this->view->formGridEditInterface = $this->getFormGrid("dialogEditOSPFInterface", null, "OSPFChangeMessage"); + $this->view->formGridEditInterface = $this->getFormGrid("dialogEditOSPFInterface"); $this->view->formDialogEditPrefixLists = $this->getForm("dialogEditOSPFPrefixLists"); - $this->view->formGridEditPrefixLists = $this->getFormGrid("dialogEditOSPFPrefixLists", null, "OSPFChangeMessage"); + $this->view->formGridEditPrefixLists = $this->getFormGrid("dialogEditOSPFPrefixLists"); $this->view->formDialogEditRouteMaps = $this->getForm("dialogEditOSPFRouteMaps"); - $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPFRouteMaps", null, "OSPFChangeMessage"); + $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPFRouteMaps"); $this->view->pick('OPNsense/Quagga/ospf'); } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/StaticController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/StaticController.php index 11990134d..07f3b796e 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/StaticController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/StaticController.php @@ -38,7 +38,7 @@ class StaticController extends \OPNsense\Base\IndexController $this->view->staticForm = $this->getForm("static"); $this->view->formDialogEditSTATICRoute = $this->getForm("dialogEditSTATICRoute"); - $this->view->formGridEditSTATICRoute = $this->getFormGrid("dialogEditSTATICRoute", null, "STATICChangeMessage"); + $this->view->formGridEditSTATICRoute = $this->getFormGrid("dialogEditSTATICRoute"); $this->view->pick('OPNsense/Quagga/static'); } diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt index 5657ef963..909fdaced 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt @@ -74,23 +74,5 @@ POSSIBILITY OF SUCH DAMAGE. {{ partial('layout_partials/base_bootgrid_table', formGridEditBFDNeighbor)}}
- -
-
-
-
- -

-
-
- -
- +{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} {{ partial("layout_partials/base_dialog",['fields':formDialogEditBFDNeighbor,'id':formGridEditBFDNeighbor['edit_dialog_id'],'label':lang._('Edit Neighbor')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt index b456e7de9..a1835c598 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt @@ -138,25 +138,7 @@ POSSIBILITY OF SUCH DAMAGE. {{ partial('layout_partials/base_bootgrid_table', formGridEditBGPPeergroups)}} - -
-
-
-
- -

-
-
- -
- +{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} {{ partial("layout_partials/base_dialog",['fields':formDialogEditBGPNeighbor,'id':formGridEditBGPNeighbor['edit_dialog_id'],'label':lang._('Edit Neighbor')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditBGPASPaths,'id':formGridEditBGPASPaths['edit_dialog_id'],'label':lang._('Edit AS Paths')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditBGPPrefixLists,'id':formGridEditBGPPrefixLists['edit_dialog_id'],'label':lang._('Edit Prefix Lists')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt index aacb7d557..d6113799a 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt @@ -51,18 +51,4 @@ POSSIBILITY OF SUCH DAMAGE.
{{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_general_settings'])}}
- -
-
-
-
- -

-
-
-
+{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt index 34c581cc0..fcdba3c81 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt @@ -116,24 +116,7 @@ POSSIBILITY OF SUCH DAMAGE. {{ partial('layout_partials/base_bootgrid_table', formGridEditRouteMaps)}} - -
-
-
- -
-
- -
- +{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} {{ partial("layout_partials/base_dialog",['fields':formDialogEditNetwork,'id':formGridEditNetwork['edit_dialog_id'],'label':lang._('Edit Network')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditInterface,'id':formGridEditInterface['edit_dialog_id'],'label':lang._('Edit Interface')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditPrefixLists,'id':formGridEditPrefixLists['edit_dialog_id'],'label':lang._('Edit Prefix Lists')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt index ecb170033..0f67ec632 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt @@ -122,24 +122,7 @@ {{ partial('layout_partials/base_bootgrid_table', formGridEditRouteMaps)}} - -
-
-
- -
-
- -
- +{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} {{ partial("layout_partials/base_dialog",['fields':formDialogEditNetwork,'id':formGridEditNetwork['edit_dialog_id'],'label':lang._('Edit Network')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditInterface,'id':formGridEditInterface['edit_dialog_id'],'label':lang._('Edit Interface')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditPrefixLists,'id':formGridEditPrefixLists['edit_dialog_id'],'label':lang._('Edit Prefix Lists')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt index 6e1c01c4c..443455020 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt @@ -51,18 +51,4 @@ POSSIBILITY OF SUCH DAMAGE.
{{ partial("layout_partials/base_form",['fields':ripForm,'id':'frm_rip_settings'])}}
- -
-
-
-
- -

-
-
-
+{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/static.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/static.volt index c6ae4303a..6227fed7e 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/static.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/static.volt @@ -71,23 +71,5 @@ {{ partial('layout_partials/base_bootgrid_table', formGridEditSTATICRoute)}} - -
-
-
-
- -

-
-
- -
- +{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/quagga/service/reconfigure', 'data_service_widget': 'quagga'}) }} {{ partial("layout_partials/base_dialog",['fields':formDialogEditSTATICRoute,'id':formGridEditSTATICRoute['edit_dialog_id'],'label':lang._('Edit Routes')])}} From 087d848c18dbd11f9f409f7237ac162a804fced8 Mon Sep 17 00:00:00 2001 From: Stephan de Wit Date: Mon, 17 Feb 2025 15:48:47 +0100 Subject: [PATCH 011/389] misc/themes: update css for chart.js v4 --- .../themes/advanced/assets/stylesheets/dashboard.scss | 9 +++++++++ .../www/themes/advanced/build/css/dashboard.css | 2 +- .../themes/cicada/assets/stylesheets/dashboard.scss | 10 ++++++++++ .../opnsense/www/themes/cicada/build/css/dashboard.css | 10 ++++++++++ .../www/themes/rebellion/build/css/dashboard.css | 10 ++++++++++ .../themes/vicuna/assets/stylesheets/dashboard.scss | 9 +++++++++ .../opnsense/www/themes/vicuna/build/css/dashboard.css | 10 ++++++++++ 7 files changed, 59 insertions(+), 1 deletion(-) diff --git a/misc/theme-advanced/src/opnsense/www/themes/advanced/assets/stylesheets/dashboard.scss b/misc/theme-advanced/src/opnsense/www/themes/advanced/assets/stylesheets/dashboard.scss index af78a80af..7a7d96579 100644 --- a/misc/theme-advanced/src/opnsense/www/themes/advanced/assets/stylesheets/dashboard.scss +++ b/misc/theme-advanced/src/opnsense/www/themes/advanced/assets/stylesheets/dashboard.scss @@ -128,11 +128,20 @@ td { word-break: break-all; } +.canvas-container-noaspectratio { + position: relative; +} .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} + .cpu-canvas-container { display: flex; flex-direction: column; diff --git a/misc/theme-advanced/src/opnsense/www/themes/advanced/build/css/dashboard.css b/misc/theme-advanced/src/opnsense/www/themes/advanced/build/css/dashboard.css index f140ce341..947ca2075 100644 --- a/misc/theme-advanced/src/opnsense/www/themes/advanced/build/css/dashboard.css +++ b/misc/theme-advanced/src/opnsense/www/themes/advanced/build/css/dashboard.css @@ -1 +1 @@ -:root{--chart-js-background-color: #f7e2d6;--chart-js-border-color: #f6f6f6;--chart-js-font-color: #4b4b64}.btn-pressed,.btn-pressed:hover{color:white;background-color:#0086d9}#save-grid{position:relative;display:inline-flex;align-items:center;justify-content:center;width:50px;height:33px;margin-right:10px;transition:opacity 0.3s ease}#save-btn-text,#icon-container{position:absolute}#icon-container{display:inline-flex;align-items:center;justify-content:center}#save-spinner,#save-check{transition:opacity 0.3s ease, transform 0.3s ease}.transition-spinner,transition-check{transition:opacity 0.3s ease, transform 0.3s ease}.grid-stack-item-content{text-align:center;border:none !important;border-radius:0.5em 0.5em 0.5em 0.5em;background-color:#fff;box-shadow:0 2px 4px rgba(40,40,50,0.15),0 0 1px rgba(40,40,50,0.35)}.widget-error{margin:50px;color:#721c24}.widget-content{position:relative;width:100%;height:100%;padding:1px;cursor:grab}.widget-header{font-size:14px;display:flex;align-items:center;justify-content:space-between;margin-top:0.5em;margin-right:1em;margin-left:1em}.widget-spinner{margin-top:20px}.fa-stack.small{font-size:0.5em}.close-handle,.edit-handle{padding:.2rem .5rem;cursor:pointer;text-align:right;vertical-align:middle}.close-handle>i,.edit-handle>i{font-size:1.2rem !important}.widget-header-left{display:flex;align-items:center;flex:1;justify-content:flex-start}.widget-command-container{display:flex;align-items:center;flex:1;justify-content:flex-end}.widget-title{display:flex;align-items:center;justify-content:center}.panel-divider{width:100%;height:8px;margin-bottom:10px;text-align:center}.panel-divider .line{display:none}td{word-break:break-all}.canvas-container{position:relative}.cpu-canvas-container{display:flex;flex-direction:column}.smoothie-container{width:100%}.smoothie-chart-tooltip{font-size:13px;z-index:1;padding-right:15px;padding-left:15px;pointer-events:none;color:white;border-radius:0.5em 0.5em 0.5em 0.5em;background:rgba(50,50,50,0.9)}.flex-container{display:flex;flex-wrap:nowrap;white-space:nowrap}.gateway-info{font-size:13px;margin:5px;padding:5px}.gateway-detail-container{display:none;margin:5px}.interface-info{display:flex;align-items:center;flex-wrap:wrap;height:100%}.nowrap{flex-wrap:nowrap}.gateway-graph{display:none}.flex-container>.gateway-graph{font-size:13px}.vertical-center-row{display:inline;height:100%}.interfaces-info{font-size:.8rem;margin:5px}.interface-descr{font-size:1em;margin-left:.8em;cursor:pointer;text-decoration:underline}.interfaces-detail-container{display:none;margin:5px}.d-flex{display:flex}.d-flex>.justify-content-start{justify-content:start}.d-flex>.justify-content-end{justify-content:end}#chartjs-toolip{z-index:20}.cpu-type{margin-top:10px;margin-bottom:10px}div{box-sizing:border-box}.flextable-container{display:block;width:95%;max-width:1200px;margin:2em auto}.flextable-header{display:flex;flex-flow:row wrap;padding:0.5em 0.5em;transition:0.5s;border-top:solid 1px rgba(0,119,217,0.15) !important}.flextable-row{display:flex;align-items:center;flex-flow:row wrap;padding:0.5em 0.5em;transition:0.5s;border-top:solid 1px #e8eaef !important}.flextable-header .flex-cell{font-weight:bold}.flextable-row:hover{transition:500ms;background:#f5f5f5}.flex-cell{padding:4px 0;text-align:left;word-break:break-word}.column{display:flex;flex-flow:column wrap;width:50%;padding:0}.column .flex-cell{display:flex;flex-flow:row wrap;width:100%;padding:4px 0;border:0;border-top:#e8eaef}.column .flex-cell:hover{transition:500ms;background:#f5f5f5}.flex-subcell{width:100%;text-align:left}.column .flex-cell:not(:last-child){border-bottom:solid 1px #e8eaef !important}.grid-header-container{display:grid;grid-template-columns:repeat(auto-fit, minmax(100px, 1fr))}.grid-row{display:grid;transition:0.5s;opacity:0.4;border-top:1px solid #eff3f8;background-color:#d6e5f7;grid-template-columns:repeat(auto-fit, minmax(100px, 1fr))}.grid-row:hover{transition:500ms;background:#f5f5f5 !important}.grid-header{font-weight:bold;border-top:1px solid #eff3f8}.grid-item{padding:4px;text-align:center}.ovpn-common-name{display:flex;align-items:center;justify-content:center} +:root{--chart-js-background-color: #f7e2d6;--chart-js-border-color: #f6f6f6;--chart-js-font-color: #4b4b64}.btn-pressed,.btn-pressed:hover{color:#fff;background-color:#0086d9}#save-grid{position:relative;display:inline-flex;align-items:center;justify-content:center;width:50px;height:33px;margin-right:10px;transition:opacity .3s ease}#save-btn-text,#icon-container{position:absolute}#icon-container{display:inline-flex;align-items:center;justify-content:center}#save-spinner,#save-check{transition:opacity .3s ease,transform .3s ease}.transition-spinner,transition-check{transition:opacity .3s ease,transform .3s ease}.grid-stack-item-content{text-align:center;border:none !important;border-radius:.5em .5em .5em .5em;background-color:#fff;box-shadow:0 2px 4px rgba(40,40,50,.15),0 0 1px rgba(40,40,50,.35)}.widget-error{margin:50px;color:#721c24}.widget-content{position:relative;width:100%;height:100%;padding:1px;cursor:grab}.widget-header{font-size:14px;display:flex;align-items:center;justify-content:space-between;margin-top:.5em;margin-right:1em;margin-left:1em}.widget-spinner{margin-top:20px}.fa-stack.small{font-size:.5em}.close-handle,.edit-handle{padding:.2rem .5rem;cursor:pointer;text-align:right;vertical-align:middle}.close-handle>i,.edit-handle>i{font-size:1.2rem !important}.widget-header-left{display:flex;align-items:center;flex:1;justify-content:flex-start}.widget-command-container{display:flex;align-items:center;flex:1;justify-content:flex-end}.widget-title{display:flex;align-items:center;justify-content:center}.panel-divider{width:100%;height:8px;margin-bottom:10px;text-align:center}.panel-divider .line{display:none}td{word-break:break-all}.canvas-container-noaspectratio{position:relative}.canvas-container{position:relative}.canvas-container>canvas{width:100% !important;height:100% !important}.cpu-canvas-container{display:flex;flex-direction:column}.smoothie-container{width:100%}.smoothie-chart-tooltip{font-size:13px;z-index:1;padding-right:15px;padding-left:15px;pointer-events:none;color:#fff;border-radius:.5em .5em .5em .5em;background:rgba(50,50,50,.9)}.flex-container{display:flex;flex-wrap:nowrap;white-space:nowrap}.gateway-info{font-size:13px;margin:5px;padding:5px}.gateway-detail-container{display:none;margin:5px}.interface-info{display:flex;align-items:center;flex-wrap:wrap;height:100%}.nowrap{flex-wrap:nowrap}.gateway-graph{display:none}.flex-container>.gateway-graph{font-size:13px}.vertical-center-row{display:inline;height:100%}.interfaces-info{font-size:.8rem;margin:5px}.interface-descr{font-size:1em;margin-left:.8em;cursor:pointer;text-decoration:underline}.interfaces-detail-container{display:none;margin:5px}.d-flex{display:flex}.d-flex>.justify-content-start{justify-content:start}.d-flex>.justify-content-end{justify-content:end}#chartjs-toolip{z-index:20}.cpu-type{margin-top:10px;margin-bottom:10px}div{box-sizing:border-box}.flextable-container{display:block;width:95%;max-width:1200px;margin:2em auto}.flextable-header{display:flex;flex-flow:row wrap;padding:.5em .5em;transition:.5s;border-top:solid 1px rgba(0,119,217,.15) !important}.flextable-row{display:flex;align-items:center;flex-flow:row wrap;padding:.5em .5em;transition:.5s;border-top:solid 1px #e8eaef !important}.flextable-header .flex-cell{font-weight:bold}.flextable-row:hover{transition:500ms;background:#f5f5f5}.flex-cell{padding:4px 0;text-align:left;word-break:break-word}.column{display:flex;flex-flow:column wrap;width:50%;padding:0}.column .flex-cell{display:flex;flex-flow:row wrap;width:100%;padding:4px 0;border:0;border-top:#e8eaef}.column .flex-cell:hover{transition:500ms;background:#f5f5f5}.flex-subcell{width:100%;text-align:left}.column .flex-cell:not(:last-child){border-bottom:solid 1px #e8eaef !important}.grid-header-container{display:grid;grid-template-columns:repeat(auto-fit, minmax(100px, 1fr))}.grid-row{display:grid;transition:.5s;opacity:.4;border-top:1px solid #eff3f8;background-color:#d6e5f7;grid-template-columns:repeat(auto-fit, minmax(100px, 1fr))}.grid-row:hover{transition:500ms;background:#f5f5f5 !important}.grid-header{font-weight:bold;border-top:1px solid #eff3f8}.grid-item{padding:4px;text-align:center}.ovpn-common-name{display:flex;align-items:center;justify-content:center}/*# sourceMappingURL=dashboard.css.map */ diff --git a/misc/theme-cicada/src/opnsense/www/themes/cicada/assets/stylesheets/dashboard.scss b/misc/theme-cicada/src/opnsense/www/themes/cicada/assets/stylesheets/dashboard.scss index 2eb8ea4d3..88e697987 100644 --- a/misc/theme-cicada/src/opnsense/www/themes/cicada/assets/stylesheets/dashboard.scss +++ b/misc/theme-cicada/src/opnsense/www/themes/cicada/assets/stylesheets/dashboard.scss @@ -84,10 +84,20 @@ td { margin: 5px; } +.canvas-container-noaspectratio { + position: relative; +} + .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} + .cpu-canvas-container { display: flex; flex-direction: column; diff --git a/misc/theme-cicada/src/opnsense/www/themes/cicada/build/css/dashboard.css b/misc/theme-cicada/src/opnsense/www/themes/cicada/build/css/dashboard.css index 4725d9e07..7d784bb26 100644 --- a/misc/theme-cicada/src/opnsense/www/themes/cicada/build/css/dashboard.css +++ b/misc/theme-cicada/src/opnsense/www/themes/cicada/build/css/dashboard.css @@ -79,10 +79,20 @@ td { margin: 5px; } +.canvas-container-noaspectratio { + position: relative; +} + .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} + .cpu-canvas-container { display: flex; flex-direction: column; diff --git a/misc/theme-rebellion/src/opnsense/www/themes/rebellion/build/css/dashboard.css b/misc/theme-rebellion/src/opnsense/www/themes/rebellion/build/css/dashboard.css index 9ada40835..d1b95c429 100644 --- a/misc/theme-rebellion/src/opnsense/www/themes/rebellion/build/css/dashboard.css +++ b/misc/theme-rebellion/src/opnsense/www/themes/rebellion/build/css/dashboard.css @@ -107,10 +107,20 @@ td { margin: 5px; } +.canvas-container-noaspectratio { + position: relative; +} + .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} + .cpu-canvas-container { display: flex; flex-direction: column; diff --git a/misc/theme-vicuna/src/opnsense/www/themes/vicuna/assets/stylesheets/dashboard.scss b/misc/theme-vicuna/src/opnsense/www/themes/vicuna/assets/stylesheets/dashboard.scss index 73c537421..4d4066e9b 100644 --- a/misc/theme-vicuna/src/opnsense/www/themes/vicuna/assets/stylesheets/dashboard.scss +++ b/misc/theme-vicuna/src/opnsense/www/themes/vicuna/assets/stylesheets/dashboard.scss @@ -84,10 +84,19 @@ td { margin: 5px; } +.canvas-container-noaspectratio { + position: relative; +} + .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} .cpu-canvas-container { display: flex; flex-direction: column; diff --git a/misc/theme-vicuna/src/opnsense/www/themes/vicuna/build/css/dashboard.css b/misc/theme-vicuna/src/opnsense/www/themes/vicuna/build/css/dashboard.css index 62bc03c5e..533397d12 100644 --- a/misc/theme-vicuna/src/opnsense/www/themes/vicuna/build/css/dashboard.css +++ b/misc/theme-vicuna/src/opnsense/www/themes/vicuna/build/css/dashboard.css @@ -79,10 +79,20 @@ td { margin: 5px; } +.canvas-container-noaspectratio { + position: relative; +} + .canvas-container { position: relative; } +.canvas-container > canvas { + /* ChartJS v4 workaround: https://github.com/chartjs/Chart.js/issues/11005 */ + width: 100% !important; + height: 100% !important; +} + .cpu-canvas-container { display: flex; flex-direction: column; From 7de5c626512d087a07bbae93df4438828b5e4a57 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Mon, 17 Feb 2025 17:03:17 +0100 Subject: [PATCH 012/389] net/frr: Delete per daemon and old watchfrr files (#4552) * net/frr: Delete per daemon and old watchfrr files, this cleans up remains after the frr.conf migration. Co-authored-by: Franco Fichtner --------- Co-authored-by: Franco Fichtner --- net/frr/pkg-descr | 2 ++ net/frr/src/opnsense/scripts/frr/setup.sh | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/net/frr/pkg-descr b/net/frr/pkg-descr index 3341c9126..6a19f7379 100644 --- a/net/frr/pkg-descr +++ b/net/frr/pkg-descr @@ -16,9 +16,11 @@ Plugin Changelog * Use frr-reload instead of restarting the service on configuration changes (opnsense/plugins/issues/4529) * Migrate separate daemon config files into single frr.conf file (opnsense/plugins/issues/4510) +* Delete per daemon and old watchfrr files (opnsense/plugins/issues/4551) * Add help texts to all options and expose them in grid as columns (opnsense/plugins/pull/4494) * Replace deprecated passive-interface directive in ospf (opnsense/plugins/issues/4534) * Style cleanup and unify forms (opnsense/plugins/pull/4450) +* Implement base_apply_button (opnsense/plugins/pull/4542) 1.42 diff --git a/net/frr/src/opnsense/scripts/frr/setup.sh b/net/frr/src/opnsense/scripts/frr/setup.sh index f91e271fd..bda37d2c3 100755 --- a/net/frr/src/opnsense/scripts/frr/setup.sh +++ b/net/frr/src/opnsense/scripts/frr/setup.sh @@ -21,3 +21,17 @@ chown $user:$group /var/log/frr.log # register Security Associations /usr/local/opnsense/scripts/frr/register_sas + +# delete stale configuration files from frr.conf migration +files_to_delete=" + /etc/rc.d/watchfrr + /usr/local/etc/frr/bfdd.conf + /usr/local/etc/frr/bgpd.conf + /usr/local/etc/frr/ospfd.conf + /usr/local/etc/frr/ospf6d.conf + /usr/local/etc/frr/ripd.conf + /usr/local/etc/frr/staticd.conf + /usr/local/etc/frr/zebra.conf +" + +rm -f $files_to_delete From c58ba1498e658872ec6e449f1d04c5d67d454bbf Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 19 Feb 2025 10:32:44 +0100 Subject: [PATCH 013/389] net/ndproxy: Adjust helptext of downlink interface (#4553) * net/ndproxy: Adjust helptext of downlink interface * Update net/ndproxy/src/opnsense/mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml Co-authored-by: Franco Fichtner * Update net/ndproxy/Makefile Co-authored-by: Franco Fichtner --------- Co-authored-by: Franco Fichtner --- .../mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ndproxy/src/opnsense/mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml b/net/ndproxy/src/opnsense/mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml index 09f6ed144..207546626 100644 --- a/net/ndproxy/src/opnsense/mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml +++ b/net/ndproxy/src/opnsense/mvc/app/controllers/OPNsense/Ndproxy/forms/general.xml @@ -19,7 +19,7 @@ ndproxy.general.ndproxy_downlink_mac_address text - + ndproxy.general.ndproxy_uplink_ipv6_addresses From c875ba91201bf06d2e0abecd03983655d3d29a89 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 19 Feb 2025 15:53:54 +0100 Subject: [PATCH 014/389] security/acme-client: bump version --- security/acme-client/Makefile | 2 +- security/acme-client/pkg-descr | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index f750997c0..809895dc0 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 4.8 +PLUGIN_VERSION= 4.9 PLUGIN_COMMENT= ACME Client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 5d07a9eae..9a3c8d013 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +4.9 + +Added: +* Add support for Scaleway DNS API (#4492) + 4.8 BREAKING CHANGE: Let's Encrypt ends support for the OCSP Must Staple From 58c646121f2babb6f66ac47e2fb63c869af9924f Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Fri, 21 Feb 2025 09:01:15 +0100 Subject: [PATCH 015/389] dns/rfc2136: drop last old code widget --- .../src/www/widgets/include/rfc2136.inc | 4 - .../www/widgets/widgets/rfc2136.widget.php | 156 ------------------ 2 files changed, 160 deletions(-) delete mode 100644 dns/rfc2136/src/www/widgets/include/rfc2136.inc delete mode 100644 dns/rfc2136/src/www/widgets/widgets/rfc2136.widget.php diff --git a/dns/rfc2136/src/www/widgets/include/rfc2136.inc b/dns/rfc2136/src/www/widgets/include/rfc2136.inc deleted file mode 100644 index c143db6dd..000000000 --- a/dns/rfc2136/src/www/widgets/include/rfc2136.inc +++ /dev/null @@ -1,4 +0,0 @@ - - * Copyright (C) 2014-2016 Deciso B.V. - * Copyright (C) 2008 Ermal Luçi - * Copyright (C) 2013 Stanley P. Miller \ stan-qaz - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * - * 1. Redistributions of source code must retain the above copyright notice, - * this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - * INClUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -require_once("guiconfig.inc"); -require_once("widgets/include/rfc2136.inc"); -require_once("interfaces.inc"); -require_once("plugins.inc.d/rfc2136.inc"); - -$a_rfc2136 = &config_read_array('dnsupdates', 'dnsupdate'); - -if (!empty($_REQUEST['getrfc2136status'])) { - $first_entry = true; - foreach ($a_rfc2136 as $rfc2136) { - if ($first_entry) { - $first_entry = false; - } else { - // Put a vertical bar delimiter between the echoed HTML for each entry processed. - echo '|'; - } - - $filename = rfc2136_cache_file($rfc2136, 4); - $fdata = ''; - if (!empty($rfc2136['enable']) && (empty($rfc2136['recordtype']) || $rfc2136['recordtype'] == 'A') && file_exists($filename)) { - $ipaddr = get_rfc2136_ip_address($rfc2136['interface'], 4); - $fdata = @file_get_contents($filename); - } - - $filename_v6 = rfc2136_cache_file($rfc2136, 6); - $fdata6 = ''; - if (!empty($rfc2136['enable']) && (empty($rfc2136['recordtype']) || $rfc2136['recordtype'] == 'AAAA') && file_exists($filename_v6)) { - $ipv6addr = get_rfc2136_ip_address($rfc2136['interface'], 6); - $fdata6 = @file_get_contents($filename_v6); - } - - if (!empty($fdata)) { - $cached_ip_s = explode('|', $fdata); - $cached_ip = $cached_ip_s[0]; - echo sprintf( - 'IPv4: %s', - $ipaddr != $cached_ip ? 'red' : 'green', - htmlspecialchars($cached_ip) - ); - } else { - echo 'IPv4: ' . gettext('N/A'); - } - - echo '
'; - - if (!empty($fdata6)) { - $cached_ipv6_s = explode('|', $fdata6); - $cached_ipv6 = $cached_ipv6_s[0]; - echo sprintf( - 'IPv6: %s', - $ipv6addr != $cached_ipv6 ? 'red' : 'green', - htmlspecialchars($cached_ipv6) - ); - } else { - echo 'IPv6: ' . gettext('N/A'); - } - } - exit; -} - -?> - - - - - - - - - - - - $rfc2136) :?> - - - - - - - - -
> - $ifdesc) { - if ($rfc2136['interface'] == $if) { - echo "{$ifdesc}"; - break; - } - }?> - > - - > - - > -
- -
-
- From 8dc6460052e1d229a7b83755b12c59b7ff526df4 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Tue, 25 Feb 2025 20:02:41 +0000 Subject: [PATCH 016/389] sysutils/sftp-backup : add sftp backup connector (#4563) Add a simple backup option using secure copy (sftp). Easy to use with any unix/linux target server offering ssh services. Just add a public key to `~/.ssh/authorized_keys` (`~` = users home directory), upload a matching private key and set the remote location (for example `sftp://root@192.168.1.1//root/test_backup`) [ssh-keygen](https://man.openbsd.org/ssh-keygen.1) can be used to generate a keypair. --- sysutils/sftp-backup/Makefile | 7 + sysutils/sftp-backup/pkg-descr | 3 + .../mvc/app/library/OPNsense/Backup/Sftp.php | 269 ++++++++++++++++++ .../models/OPNsense/Backup/SftpSettings.php | 39 +++ .../models/OPNsense/Backup/SftpSettings.xml | 52 ++++ 5 files changed, 370 insertions(+) create mode 100644 sysutils/sftp-backup/Makefile create mode 100644 sysutils/sftp-backup/pkg-descr create mode 100644 sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php create mode 100644 sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.php create mode 100644 sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.xml diff --git a/sysutils/sftp-backup/Makefile b/sysutils/sftp-backup/Makefile new file mode 100644 index 000000000..918b74903 --- /dev/null +++ b/sysutils/sftp-backup/Makefile @@ -0,0 +1,7 @@ +PLUGIN_NAME= sftp-backup +PLUGIN_VERSION= 1.0 +PLUGIN_COMMENT= Backup configurations using sftp +PLUGIN_MAINTAINER= ad@opnsense.org +PLUGIN_TIER= 2 + +.include "../../Mk/plugins.mk" diff --git a/sysutils/sftp-backup/pkg-descr b/sysutils/sftp-backup/pkg-descr new file mode 100644 index 000000000..f9dcd53e9 --- /dev/null +++ b/sysutils/sftp-backup/pkg-descr @@ -0,0 +1,3 @@ +This package adds a backup option using sftp (secure copy). + +Due to the sensitive nature of the data being send to the backup, we strongly advise to not use a public service to send backups to. diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php new file mode 100644 index 000000000..5c49ac008 --- /dev/null +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -0,0 +1,269 @@ +model = new SftpSettings(); + } + + /** + * @inheritdoc + */ + public function getConfigurationFields() + { + $fields = [ + [ + "name" => "enabled", + "type" => "checkbox", + "label" => gettext("Enable"), + "value" => null + ], + [ + "name" => "url", + "type" => "text", + "label" => gettext("URL"), + "help" => gettext( + "Target location, specified as uri, e.g. sftp://user@my.host.at.domain[:port]//path/to/backup" + ), + "value" => null + ], + [ + "name" => "privkey", + "type" => "passwordarea", + "label" => gettext("SSH private key"), + "help" => gettext("The private key used to setup the connection."), + "value" => null + ], + [ + "name" => "backupcount", + "type" => "text", + "label" => gettext("Backup Count"), + "value" => null + ], + [ + "name" => "password", + "type" => "password", + "label" => gettext("Encrypt Password"), + "value" => null + ], + [ + "name" => "passwordconfirm", + "type" => "password", + "label" => gettext("Confirm"), + "value" => null + ] + ]; + foreach ($fields as &$field) { + if ($field['name'] == 'passwordconfirm') { + $field['value'] = (string)$this->model->getNodeByReference('password'); + } else { + $field['value'] = (string)$this->model->getNodeByReference($field['name']); + } + } + return $fields; + } + + /** + * @inheritdoc + */ + public function getName() + { + return gettext("sftp"); + } + + /** + * @inheritdoc + */ + public function setConfiguration($conf) + { + $this->setModelProperties($this->model, $conf); + $validation_messages = $this->validateModel($this->model); + if ($conf['passwordconfirm'] != $conf['password']) { + $validation_messages[] = gettext("The supplied 'Password' and 'Confirm' field values must match."); + } + if (empty($validation_messages)) { + $this->model->serializeToConfig(); + Config::getInstance()->save(); + } + return $validation_messages; + } + + /** + * sftp command + * @param string $sftpcmd command to execute + * @return array [stdout|stderr|exit_status] + */ + private function sftpCmd($sftpcmd) + { + $cmd = [ + '/usr/local/bin/sftp', + '-o StrictHostKeyChecking=accept-new', + '-o PasswordAuthentication=no', + '-o ChallengeResponseAuthentication=no', + '-i ' . $this->getIdentity(), + escapeshellarg($this->model->url) + ]; + + $result = ['exit_status' => -1, 'stderr' => '', 'stdout' => '']; + $process = proc_open( + implode(' ', $cmd), + [["pipe", "r"], ["pipe", "w"], ["pipe", "w"]], + $pipes + ); + if (is_resource($process)) { + fwrite($pipes[0], $sftpcmd); + fclose($pipes[0]); + $result['stdout'] = stream_get_contents($pipes[1]); + fclose($pipes[1]); + $result['stderr'] = stream_get_contents($pipes[2]); + fclose($pipes[2]); + $result['exit_status'] = proc_close($process); + } + if ($result['exit_status'] !== 0) { + /* always throw on non zero exit status */ + syslog(LOG_ERR, "sftp-backup error (" . str_replace("\n", " ", $result['stderr']) . ")"); + throw new \Exception($result['stderr']); + } + return $result; + } + + /** + * @return identity file, create new when non existent + */ + private function getIdentity() + { + $confdir = "/conf/backup/sftp"; + $identfile = $confdir . '/identity'; + if (!is_dir($confdir)) { + mkdir($confdir); + } + if (!is_file($identfile) || file_get_contents($identfile) != $this->model->privkey) { + File::file_put_contents($identfile, $this->model->privkey, 0600); + } + return $identfile; + } + + /** + * @return list of files on remote location + */ + private function ls($pattern='') + { + $result = []; + foreach (explode("\n", $this->sftpCmd('ls -lnt '. $pattern)['stdout']) as $line) { + $parts = preg_split('/\s+/', $line, -1, PREG_SPLIT_NO_EMPTY); + if (count($parts) >= 7) { + $result[] = $parts[count($parts)-1]; + } + } + return $result; + } + + /** + * @param string $source filename + * @param string $destination filename + */ + private function put($source, $destination) + { + $this->sftpCmd(sprintf('put %s %s', $source, $destination)); + } + + /** + * @param string $filename + */ + private function del($filename) + { + $this->sftpCmd(sprintf('rm %s', $filename)); + } + + /** + * @return array filelist + */ + public function backup() + { + if ($this->model->enabled->isEmpty()) { + /* disabled */ + return; + } + /** + * Collect most recent backup, since /conf/backup/ always contains the latests, we can use the filename + * for easy comparison. + **/ + $all_backups = glob('/conf/backup/config-*.xml'); + $most_recent = $all_backups[count($all_backups) - 1]; + $confdata = file_get_contents($most_recent); + if (!$this->model->password->isEmpty()) { + $confdata = $this->encrypt($confdata, (string)$this->model->password); + } + /* backup filename when not already on remote location */ + $remote_backups = $this->ls('config-*.xml'); + $target_filename = basename($most_recent); + if (!in_array($target_filename, $remote_backups)) { + syslog(LOG_NOTICE, "backup configuration as " . $target_filename); + $tmpfilename = sprintf("/conf/backup/sftp/%s", $target_filename); + File::file_put_contents($tmpfilename, $confdata, 0600); + $this->put($tmpfilename, $target_filename); + unlink($tmpfilename); + $remote_backups = $this->ls('config-*.xml'); + } + /* cleanup */ + rsort($remote_backups); + if (count($remote_backups) > (int)$this->model->backupcount->getCurrentValue()) { + for ($i = $this->model->backupcount->getCurrentValue() ; $i < count($remote_backups); $i++) { + $this->del($remote_backups[$i]); + } + $remote_backups = $this->ls('config-*.xml'); + } + + return $remote_backups; + } + + /** + * @inheritdoc + */ + public function isEnabled() + { + return !$this->model->enabled->isEmpty(); + } +} diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.php b/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.php new file mode 100644 index 000000000..4cad4acf7 --- /dev/null +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.php @@ -0,0 +1,39 @@ + + //system/backup/sftp + 1.0.0 + OPNsense sftp Backup Settings + + + 0 + Y + + + privkey.check001 + + + url.check001 + + + + + N + /^((sftp))?:\/\/.*[^\/]$/ + A valid location must be provided. + + + A backup location (url) is required. + DependConstraint + + enabled + + + + + + N + + + A private key is required. + DependConstraint + + enabled + + + + + + + + 60 + Y + 1 + + + From 5453f4eaff8a8058cebd64b5f7eba10e7c6ea406 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 27 Feb 2025 10:32:30 +0100 Subject: [PATCH 017/389] misc/theme-advanced: bump revision --- misc/theme-advanced/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/misc/theme-advanced/Makefile b/misc/theme-advanced/Makefile index d8fabc971..a784ed7a5 100644 --- a/misc/theme-advanced/Makefile +++ b/misc/theme-advanced/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= theme-advanced PLUGIN_VERSION= 1.0 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= OPNsense theme based on AdvancedTomato GUI PLUGIN_MAINTAINER= jacky@prahec.com PLUGIN_WWW= https://prahec.com/ From 50a77335c8300de2e0dcc254f0c720cd18ff1919 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 27 Feb 2025 10:34:32 +0100 Subject: [PATCH 018/389] misc/theme-cicada: bump revision --- misc/theme-cicada/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/misc/theme-cicada/Makefile b/misc/theme-cicada/Makefile index 783548375..bb8639260 100644 --- a/misc/theme-cicada/Makefile +++ b/misc/theme-cicada/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= theme-cicada PLUGIN_VERSION= 1.38 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= The cicada theme - dark grey onyx PLUGIN_MAINTAINER= rene@team-rebellion.net PLUGIN_NO_ABI= yes From 1187c33b389b5676835f150023b18de70dd24482 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 27 Feb 2025 10:35:29 +0100 Subject: [PATCH 019/389] misc/theme-rebellion: bump revision --- misc/theme-rebellion/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/misc/theme-rebellion/Makefile b/misc/theme-rebellion/Makefile index c1628de98..4059bd27e 100644 --- a/misc/theme-rebellion/Makefile +++ b/misc/theme-rebellion/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= theme-rebellion PLUGIN_VERSION= 1.9.2 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= A suitably dark theme PLUGIN_MAINTAINER= martin@queens-park.com PLUGIN_NO_ABI= yes From a2a83a5b0d79061be58c8987d7faae2added100a Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 27 Feb 2025 10:36:16 +0100 Subject: [PATCH 020/389] misc/theme-vicuna: bump revision --- misc/theme-vicuna/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/misc/theme-vicuna/Makefile b/misc/theme-vicuna/Makefile index d05a70023..f5fa4eaf1 100644 --- a/misc/theme-vicuna/Makefile +++ b/misc/theme-vicuna/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= theme-vicuna PLUGIN_VERSION= 1.48 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= The vicuna theme - blue sapphire PLUGIN_MAINTAINER= rene@team-rebellion.net PLUGIN_NO_ABI= yes From 428d6b6822731acc42549ac5b5bb4752b5182bfa Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 22 Jan 2025 12:09:25 +0100 Subject: [PATCH 021/389] new plugin: net/turnserver, closes #4473 based on devel/helloworld plugin --- net/turnserver/Makefile | 7 + net/turnserver/pkg-descr | 4 + .../src/etc/inc/plugins.inc.d/turnserver.inc | 71 ++++++++++ .../Turnserver/Api/ServiceController.php | 42 ++++++ .../Turnserver/Api/SettingsController.php | 44 ++++++ .../OPNsense/Turnserver/IndexController.php | 47 +++++++ .../OPNsense/Turnserver/forms/settings.xml | 127 ++++++++++++++++++ .../models/OPNsense/Turnserver/ACL/ACL.xml | 9 ++ .../models/OPNsense/Turnserver/Menu/Menu.xml | 5 + .../models/OPNsense/Turnserver/Turnserver.php | 53 ++++++++ .../models/OPNsense/Turnserver/Turnserver.xml | 97 +++++++++++++ .../app/views/OPNsense/Turnserver/index.volt | 57 ++++++++ .../OPNsense/Turnserver/export_certs.php | 61 +++++++++ .../scripts/OPNsense/Turnserver/setup.sh | 3 + .../conf/actions.d/actions_turnserver.conf | 26 ++++ .../templates/OPNsense/Turnserver/+TARGETS | 2 + .../templates/OPNsense/Turnserver/rc.conf.d | 5 + .../OPNsense/Turnserver/turnserver.conf | 60 +++++++++ 18 files changed, 720 insertions(+) create mode 100644 net/turnserver/Makefile create mode 100644 net/turnserver/pkg-descr create mode 100644 net/turnserver/src/etc/inc/plugins.inc.d/turnserver.inc create mode 100644 net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/Api/ServiceController.php create mode 100644 net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/Api/SettingsController.php create mode 100644 net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/IndexController.php create mode 100644 net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/forms/settings.xml create mode 100644 net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/ACL/ACL.xml create mode 100644 net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Menu/Menu.xml create mode 100644 net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.php create mode 100644 net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.xml create mode 100644 net/turnserver/src/opnsense/mvc/app/views/OPNsense/Turnserver/index.volt create mode 100755 net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/export_certs.php create mode 100755 net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/setup.sh create mode 100644 net/turnserver/src/opnsense/service/conf/actions.d/actions_turnserver.conf create mode 100644 net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/+TARGETS create mode 100644 net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/rc.conf.d create mode 100644 net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/turnserver.conf diff --git a/net/turnserver/Makefile b/net/turnserver/Makefile new file mode 100644 index 000000000..dfe3b1ce6 --- /dev/null +++ b/net/turnserver/Makefile @@ -0,0 +1,7 @@ +PLUGIN_NAME= turnserver +PLUGIN_VERSION= 1.0 +PLUGIN_COMMENT= The coturn STUN/TURN Server +PLUGIN_DEPENDS= turnserver +PLUGIN_MAINTAINER= opnsense@moov.de + +.include "../../Mk/plugins.mk" diff --git a/net/turnserver/pkg-descr b/net/turnserver/pkg-descr new file mode 100644 index 000000000..f80121742 --- /dev/null +++ b/net/turnserver/pkg-descr @@ -0,0 +1,4 @@ +Coturn is a free open source implementation of TURN and STUN Server. +The TURN Server is a VoIP media traffic NAT traversal server and gateway. + +WWW: https://github.com/coturn/coturn diff --git a/net/turnserver/src/etc/inc/plugins.inc.d/turnserver.inc b/net/turnserver/src/etc/inc/plugins.inc.d/turnserver.inc new file mode 100644 index 000000000..26757713b --- /dev/null +++ b/net/turnserver/src/etc/inc/plugins.inc.d/turnserver.inc @@ -0,0 +1,71 @@ + gettext('coturn STUN/TURN Server'), + 'pidfile' => '/var/run/turnserver.pid', + 'configd' => array( + 'restart' => array('turnserver restart'), + 'start' => array('turnserver start'), + 'stop' => array('turnserver stop'), + ), + 'name' => 'turnserver', + ); + + return $services; +} + +function turnserver_xmlrpc_sync() +{ + $result = array(); + $result['id'] = 'turnserver'; + $result['section'] = 'OPNsense.turnserver'; + $result['description'] = gettext('coturn STUN/TURN Server'); + $result['services'] = ['turnserver']; + return array($result); +} diff --git a/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/Api/ServiceController.php b/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/Api/ServiceController.php new file mode 100644 index 000000000..3973ff2e6 --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/Api/ServiceController.php @@ -0,0 +1,42 @@ +view->pick('OPNsense/Turnserver/index'); + // fetch form data + $this->view->settingsForm = $this->getForm("settings"); + } +} diff --git a/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/forms/settings.xml b/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/forms/settings.xml new file mode 100644 index 000000000..37f6633cb --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/controllers/OPNsense/Turnserver/forms/settings.xml @@ -0,0 +1,127 @@ +
+ + + header + + + turnserver.settings.Enabled + + checkbox + Enable the Turnserver service + + + turnserver.settings.ListenIP + + + select_multiple + true + + + + turnserver.settings.ListenPort + + text + TURN listener port for UDP and TCP (Default: 3478). NOTE: Do NOT set this to 80 or 443 when listening on all IPs, this may block access to the OPNsense WebUI. + + + turnserver.settings.MinPort + + text + Lower bound of the UDP relay endpoints (Default: 49152). + + + turnserver.settings.MaxPort + + text + Upper bound of the UDP relay endpoints (Default: 65535). + + + + header + + + turnserver.settings.TlsEnabled + + checkbox + Enable TLS/DTLS support. This requires a valid TLS certificate. + + + turnserver.settings.TlsCertificate + + dropdown + + Select a valid TLS certificate. + + + turnserver.settings.TlsPort + + text + TURN listener port for TLS (Default: 5349). NOTE: Do NOT set this to 80 or 443 when listening on all IPs, this may block access to the OPNsense WebUI. + + + + header + + + turnserver.settings.UseAuthSecret + + checkbox + This sets a special authorization option that is based upon authentication secret. Enables TURN REST API. + + + turnserver.settings.StaticAuthSecret + + password + The authentication secret value for TURN REST API. It is recommended to use a long random string, at least 32 characters long. + + + + header + + + turnserver.settings.Realm + + text + The default realm to be used for the users. Must be used with TURN REST API. A good choice may be the domain name of the company. + + + turnserver.settings.FingerprintsEnabled + + checkbox + Use fingerprints in the TURN messages. + + + + header + + + turnserver.settings.UserQuota + + text + Per-user allocation quota. Default value is 0 (no quota, unlimited number of sessions per user). + + + turnserver.settings.TotalQuota + + text + Total allocation quota. Default value is 0 (no quota). + + + turnserver.settings.StaleNonce + + text + Limit the nonce lifetime (in seconds) for extra security. Default value is 600 secs (10 minutes). + + + turnserver.settings.ChannelLifetime + + text + The lifetime for the channel (in seconds). Default value is 600 secs (10 minutes). + + + turnserver.settings.PermissionLifetime + + text + The permission lifetime (in seconds). Default value is 300 secs (5 minutes). + +
diff --git a/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/ACL/ACL.xml b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/ACL/ACL.xml new file mode 100644 index 000000000..2fa8a37a6 --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/ACL/ACL.xml @@ -0,0 +1,9 @@ + + + Services: Turnserver + + ui/turnserver/* + api/turnserver/* + + + diff --git a/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Menu/Menu.xml b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Menu/Menu.xml new file mode 100644 index 000000000..8b40dc89a --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Menu/Menu.xml @@ -0,0 +1,5 @@ + + + + + diff --git a/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.php b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.php new file mode 100644 index 000000000..3d004cb77 --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.php @@ -0,0 +1,53 @@ +settings->enabled === "1") { + return true; + } + return false; + } +} diff --git a/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.xml b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.xml new file mode 100644 index 000000000..1acae266f --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/models/OPNsense/Turnserver/Turnserver.xml @@ -0,0 +1,97 @@ + + //OPNsense/turnserver + 1.0.0 + The coturn STUN/TURN Server + + + + 0 + Y + + + 127.0.0.1 + , + Y + Y + + + 3478 + Y + + + 49152 + Y + + + 65535 + Y + + + 0 + Y + + + N + N + Please select a valid certificate from the list. + + + 5349 + Y + + + 1 + Y + + + N + /^.{16,128}$/u + Should be a string between 16 and 128 characters. + + + N + /^.{1,128}$/u + Should be a string between 1 and 128 characters. + + + 1 + Y + + + 0 + 0 + 1000000000 + Please specify a value between 0 and 1000000000. + Y + + + 0 + 0 + 1000000000 + Please specify a value between 0 and 1000000000. + Y + + + 600 + 1 + 1000000000 + Please specify a value between 1 and 1000000000. + Y + + + 600 + 1 + 1000000000 + Please specify a value between 1 and 1000000000. + Y + + + 300 + 1 + 1000000000 + Please specify a value between 1 and 1000000000. + Y + + + + diff --git a/net/turnserver/src/opnsense/mvc/app/views/OPNsense/Turnserver/index.volt b/net/turnserver/src/opnsense/mvc/app/views/OPNsense/Turnserver/index.volt new file mode 100644 index 000000000..950b9d768 --- /dev/null +++ b/net/turnserver/src/opnsense/mvc/app/views/OPNsense/Turnserver/index.volt @@ -0,0 +1,57 @@ +{# + +Copyright (C) 2025 Frank Wall +OPNsense® is Copyright © 2014 – 2015 by Deciso B.V. +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, +this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, +this list of conditions and the following disclaimer in the documentation +and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, +OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +#} + + + + + +
+ {{ partial("layout_partials/base_form",['fields':settingsForm,'id':'frm_Settings'])}} +
+ +
+ +
diff --git a/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/export_certs.php b/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/export_certs.php new file mode 100755 index 000000000..247d301fe --- /dev/null +++ b/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/export_certs.php @@ -0,0 +1,61 @@ +#!/usr/local/bin/php +object(); +if (isset($configObj->OPNsense->turnserver->settings->TlsCertificate) and !empty((string)$configObj->OPNsense->turnserver->settings->TlsCertificate)) { + $cert_refid = (string)$configObj->OPNsense->turnserver->settings->TlsCertificate; + foreach ((new Cert())->cert->iterateItems() as $cert) { + $refid = (string)$cert->refid; + + if ($cert_refid == $refid) { + $cert_content = str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->crt))); + $pkey_content = str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->prv))); + + if (!empty((string)$cert->caref)) { + $ca = CertStore::getCaChain((string)$cert->caref); + if ($ca) { + $cert_content .= "\n" . $ca; + } + } + + file_put_contents($cert_filename, $cert_content); + file_put_contents($pkey_filename, $pkey_content); + chmod($pkey_filename, 0600); + } + } +} diff --git a/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/setup.sh b/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/setup.sh new file mode 100755 index 000000000..137843af5 --- /dev/null +++ b/net/turnserver/src/opnsense/scripts/OPNsense/Turnserver/setup.sh @@ -0,0 +1,3 @@ +#!/bin/sh +/usr/local/opnsense/scripts/OPNsense/Turnserver/export_certs.php > /dev/null 2>&1 +exit 0 diff --git a/net/turnserver/src/opnsense/service/conf/actions.d/actions_turnserver.conf b/net/turnserver/src/opnsense/service/conf/actions.d/actions_turnserver.conf new file mode 100644 index 000000000..372e02aa3 --- /dev/null +++ b/net/turnserver/src/opnsense/service/conf/actions.d/actions_turnserver.conf @@ -0,0 +1,26 @@ +[start] +command:/usr/local/opnsense/scripts/OPNsense/Turnserver/setup.sh; /usr/local/etc/rc.d/turnserver start +parameters: +type:script +description:Start Turnserver +message:starting turnserver + +[stop] +command:/usr/local/etc/rc.d/turnserver onestop +parameters: +type:script +description:Stop Turnserver +message:stopping turnserver + +[restart] +command:/usr/local/opnsense/scripts/OPNsense/Turnserver/setup.sh; /usr/local/etc/rc.d/turnserver restart +parameters: +type:script +description:Restart Turnserver +message:restarting turnserver + +[status] +command:/usr/local/etc/rc.d/turnserver status || exit 0 +parameters: +type:script_output +message:requesting turnserver status diff --git a/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/+TARGETS b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/+TARGETS new file mode 100644 index 000000000..52ca68950 --- /dev/null +++ b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/+TARGETS @@ -0,0 +1,2 @@ +turnserver.conf:/usr/local/etc/turnserver.conf +rc.conf.d:/etc/rc.conf.d/turnserver diff --git a/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/rc.conf.d b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/rc.conf.d new file mode 100644 index 000000000..f292a0486 --- /dev/null +++ b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/rc.conf.d @@ -0,0 +1,5 @@ +{% if helpers.exists('OPNsense.turnserver.settings.Enabled') and OPNsense.turnserver.settings.Enabled|default("0") == "1" %} +turnserver_enable=YES +{% else %} +turnserver_enable=NO +{% endif %} diff --git a/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/turnserver.conf b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/turnserver.conf new file mode 100644 index 000000000..67c96cbab --- /dev/null +++ b/net/turnserver/src/opnsense/service/templates/OPNsense/Turnserver/turnserver.conf @@ -0,0 +1,60 @@ +# General +{% if helpers.exists('OPNsense.turnserver.settings.ListenIP') and OPNsense.turnserver.settings.ListenIP|default("") != "" %} +{% for listenip in OPNsense.turnserver.settings.ListenIP.split(",") %} +listening-ip={{ listenip }} +{% endfor %} +{% endif %} +listening-port={{ OPNsense.turnserver.settings.ListenPort }} +min-port={{ OPNsense.turnserver.settings.MinPort }} +max-port={{ OPNsense.turnserver.settings.MaxPort }} + +# TLS +{% if helpers.exists('OPNsense.turnserver.settings.TlsEnabled') and OPNsense.turnserver.settings.TlsEnabled|default("") == "1" %} +{% if OPNsense.turnserver.settings.TlsCertificate|default("") != "" %} +tls-listening-port={{ OPNsense.turnserver.settings.TlsPort }} +cert=/usr/local/etc/turnserver_cert.pem +pkey=/usr/local/etc/turnserver_pkey.pem +{% else %} +# ERROR: Required TLS certificate was not specified. TLS support will be disabled. +no-tls +no-dtls +{% endif %} +{% else %} +no-tls +no-dtls +{% endif %} + +# Security +{% if helpers.exists('OPNsense.turnserver.settings.UseAuthSecret') and OPNsense.turnserver.settings.UseAuthSecret|default("") == "1" %} +{% if OPNsense.turnserver.settings.StaticAuthSecret|default("") != "" %} +use-auth-secret +static-auth-secret={{ OPNsense.turnserver.settings.StaticAuthSecret }} +{% else %} +# ERROR: Required Auth Secret was not specified; this feature will be disabled. +{% endif %} +{% endif %} + +# Features +{% if OPNsense.turnserver.settings.Realm|default("") != "" %} +realm={{ OPNsense.turnserver.settings.Realm }} +{% endif %} +{% if OPNsense.turnserver.settings.FingerprintsEnabled|default("") == "1" %} +fingerprint +{% endif %} + +# Tuning +user-quota={{ OPNsense.turnserver.settings.UserQuota }} +total-quota={{ OPNsense.turnserver.settings.TotalQuota }} +stale-nonce={{ OPNsense.turnserver.settings.StaleNonce }} +channel-lifetime={{ OPNsense.turnserver.settings.ChannelLifetime }} +permission-lifetime={{ OPNsense.turnserver.settings.PermissionLifetime }} + +# Defaults +no-cli +no-software-attribute +no-multicast-peers +no-tlsv1 +no-tlsv1_1 +no-rfc5780 +no-stun-backward-compatibility +response-origin-only-with-rfc5780 From 57d70c0ca187f55b0fb359f150d4f2b2a64b015a Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 5 Mar 2025 08:03:57 +0100 Subject: [PATCH 022/389] www/caddy: style --- .../app/library/OPNsense/System/Status/CaddyOverrideStatus.php | 1 + 1 file changed, 1 insertion(+) diff --git a/www/caddy/src/opnsense/mvc/app/library/OPNsense/System/Status/CaddyOverrideStatus.php b/www/caddy/src/opnsense/mvc/app/library/OPNsense/System/Status/CaddyOverrideStatus.php index 0acbacf7b..73b383cb0 100644 --- a/www/caddy/src/opnsense/mvc/app/library/OPNsense/System/Status/CaddyOverrideStatus.php +++ b/www/caddy/src/opnsense/mvc/app/library/OPNsense/System/Status/CaddyOverrideStatus.php @@ -1,4 +1,5 @@ Date: Wed, 5 Mar 2025 08:04:09 +0100 Subject: [PATCH 023/389] LICENSE: sync --- LICENSE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index baf0a1005..c838c25bb 100644 --- a/LICENSE +++ b/LICENSE @@ -67,13 +67,13 @@ Copyright (c) 2010 Seth Mos Copyright (c) 2024 Sheridan Computers Copyright (c) 2008 Shrew Soft Inc. Copyright (c) 2017-2019 Smart-Soft -Copyright (c) 2013 Stanley P. Miller \ stan-qaz Copyright (c) 2020 Starkstromkonsument Copyright (c) 2023-2024 Thomas Cekal Copyright (c) 2020 Tobias Boehnert Copyright (c) 2024 txr13 Copyright (c) 2024 W516 Copyright (c) 2022 Wouter Deurholt +Copyright (c) 2025 Yann Bayart Copyright (c) 2015 YoungJoo.Kim All rights reserved. From 9bd5e3df7a53247c023a46efaec510492ddc08be Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 5 Mar 2025 08:52:09 +0100 Subject: [PATCH 024/389] README: sync --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index de7ef1585..713b0e245 100644 --- a/README.md +++ b/README.md @@ -107,6 +107,7 @@ sysutils/nextcloud-backup -- Track config changes using NextCloud sysutils/node_exporter -- Prometheus exporter for machine metrics sysutils/nut -- Network UPS Tools sysutils/puppet-agent -- Manage Puppet Agent +sysutils/sftp-backup -- Backup configurations using sftp sysutils/smart -- SMART tools sysutils/virtualbox -- VirtualBox guest additions sysutils/vmware -- VMware tools From 0782d64db693250447d2143f4ddcdaeda45093c0 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 5 Mar 2025 09:00:47 +0100 Subject: [PATCH 025/389] sysutils/sftp-backup: prep for release --- README.md | 2 +- sysutils/sftp-backup/Makefile | 2 +- sysutils/sftp-backup/pkg-descr | 5 ++- .../mvc/app/library/OPNsense/Backup/Sftp.php | 42 +++++++++---------- .../models/OPNsense/Backup/SftpSettings.xml | 2 +- 5 files changed, 26 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 713b0e245..e195524f7 100644 --- a/README.md +++ b/README.md @@ -107,7 +107,7 @@ sysutils/nextcloud-backup -- Track config changes using NextCloud sysutils/node_exporter -- Prometheus exporter for machine metrics sysutils/nut -- Network UPS Tools sysutils/puppet-agent -- Manage Puppet Agent -sysutils/sftp-backup -- Backup configurations using sftp +sysutils/sftp-backup -- Backup configurations using SFTP sysutils/smart -- SMART tools sysutils/virtualbox -- VirtualBox guest additions sysutils/vmware -- VMware tools diff --git a/sysutils/sftp-backup/Makefile b/sysutils/sftp-backup/Makefile index 918b74903..680b17fe0 100644 --- a/sysutils/sftp-backup/Makefile +++ b/sysutils/sftp-backup/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= sftp-backup PLUGIN_VERSION= 1.0 -PLUGIN_COMMENT= Backup configurations using sftp +PLUGIN_COMMENT= Backup configurations using SFTP PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 diff --git a/sysutils/sftp-backup/pkg-descr b/sysutils/sftp-backup/pkg-descr index f9dcd53e9..372f032a0 100644 --- a/sysutils/sftp-backup/pkg-descr +++ b/sysutils/sftp-backup/pkg-descr @@ -1,3 +1,4 @@ -This package adds a backup option using sftp (secure copy). +This plugin adds a backup option using SFTP (secure copy). -Due to the sensitive nature of the data being send to the backup, we strongly advise to not use a public service to send backups to. +Due to the sensitive nature of the data being send to the backup, +we strongly advise to not use a public service to send backups to. diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php index 5c49ac008..052783eb7 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -1,31 +1,29 @@ 60 - Y + Y 1 From e2b1afe2cc821a51add1994279fc4c206ca3b9d1 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 5 Mar 2025 09:02:11 +0100 Subject: [PATCH 026/389] security/intrusion-detection-content-pt-open: prep for release --- security/intrusion-detection-content-pt-open/Makefile | 1 + security/intrusion-detection-content-pt-open/pkg-descr | 1 + 2 files changed, 2 insertions(+) diff --git a/security/intrusion-detection-content-pt-open/Makefile b/security/intrusion-detection-content-pt-open/Makefile index 6941de8be..5190a1fd9 100644 --- a/security/intrusion-detection-content-pt-open/Makefile +++ b/security/intrusion-detection-content-pt-open/Makefile @@ -3,4 +3,5 @@ PLUGIN_VERSION= 1.0 PLUGIN_COMMENT= IDS Positive Technologies ESC ruleset PLUGIN_MAINTAINER= kulikov.a@gmail.com PLUGIN_WWW= https://rules.ptsecurity.com + .include "../../Mk/plugins.mk" diff --git a/security/intrusion-detection-content-pt-open/pkg-descr b/security/intrusion-detection-content-pt-open/pkg-descr index ee22fba6c..ff3dc8920 100644 --- a/security/intrusion-detection-content-pt-open/pkg-descr +++ b/security/intrusion-detection-content-pt-open/pkg-descr @@ -1,5 +1,6 @@ IDS PT ESC open ruleset designed to detect a variety of network threats, including those communicated under TLS. + PT Rules is an open-source project focused on enhancing network security through proactive threat detection. As the PT Expert Security Center attack detection team, we are a dedicated group of cybersecurity experts committed From cbb54cb3d89aeb0f1a38775dd8c8bab92b3dbbb1 Mon Sep 17 00:00:00 2001 From: Ethazeriel <10165790+Ethazeriel@users.noreply.github.com> Date: Thu, 6 Mar 2025 03:03:08 -0800 Subject: [PATCH 027/389] sysutils/dmidecode: new dashboard widget (#4554) --- sysutils/dmidecode/Makefile | 3 +- .../DmiDecode/Api/ServiceController.php} | 36 +++----- .../app/models/OPNsense/DmiDecode/ACL/ACL.xml | 8 ++ .../src/opnsense/www/js/widgets/DmiDecode.js | 90 +++++++++++++++++++ .../www/js/widgets/Metadata/DmiDecode.xml | 20 +++++ .../src/www/widgets/include/dmidecode.inc | 3 - 6 files changed, 133 insertions(+), 27 deletions(-) rename sysutils/dmidecode/src/{www/widgets/widgets/dmidecode.widget.php => opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php} (60%) create mode 100644 sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml create mode 100644 sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js create mode 100644 sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml delete mode 100644 sysutils/dmidecode/src/www/widgets/include/dmidecode.inc diff --git a/sysutils/dmidecode/Makefile b/sysutils/dmidecode/Makefile index 428d1621a..590aef8fa 100644 --- a/sysutils/dmidecode/Makefile +++ b/sysutils/dmidecode/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= dmidecode -PLUGIN_VERSION= 1.1 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.2 PLUGIN_COMMENT= Display hardware information on the dashboard PLUGIN_DEPENDS= dmidecode PLUGIN_MAINTAINER= evbevz@gmail.com diff --git a/sysutils/dmidecode/src/www/widgets/widgets/dmidecode.widget.php b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php similarity index 60% rename from sysutils/dmidecode/src/www/widgets/widgets/dmidecode.widget.php rename to sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php index c1fc7723e..f586629bd 100644 --- a/sysutils/dmidecode/src/www/widgets/widgets/dmidecode.widget.php +++ b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php @@ -2,6 +2,7 @@ /* * Copyright (C) 2019 Smart-Soft + * Copyright (C) 2025 Neil Merchant * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -26,27 +27,18 @@ * POSSIBILITY OF SUCH DAMAGE. */ -require_once("widgets/include/dmidecode.inc"); +namespace OPNsense\DmiDecode\Api; -$hardwareData = parse_ini_string(configd_run("dmidecode system"), FALSE, INI_SCANNER_RAW); -$biosData = parse_ini_string(configd_run("dmidecode bios"), FALSE, INI_SCANNER_RAW); +use OPNsense\Base\ApiControllerBase; +use OPNsense\Core\Backend; -?> - - - - $val) { ?> - - - - - - - $val) { ?> - - - - - - -
+class ServiceController extends ApiControllerBase +{ + public function getAction() + { + $system = parse_ini_string(trim((new Backend())->configdRun('dmidecode system')), false, INI_SCANNER_RAW); + $bios = parse_ini_string(trim((new Backend())->configdRun('dmidecode bios')), false, INI_SCANNER_RAW); + $status = "ok"; + return ["status" => $status, "system" => $system, "bios" => $bios]; + } +} diff --git a/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml b/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml new file mode 100644 index 000000000..a9f605462 --- /dev/null +++ b/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml @@ -0,0 +1,8 @@ + + + Service: DMI Decoder Widget + + api/dmidecode/service/get + + + diff --git a/sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js b/sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js new file mode 100644 index 000000000..89b5da183 --- /dev/null +++ b/sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js @@ -0,0 +1,90 @@ +/* + * Copyright (C) 2025 Neil Merchant + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +export default class DmiDecode extends BaseTableWidget { + constructor() { + super(); + this.title = 'DmiDecode Data'; + } + + getMarkup() { + let $container = $('
'); + // make table for system output, add header + let $system_table = super.createTable('system-table', { headerPosition: 'left' }); + $container.append(`

${this.translations.system}

`) + $container.append($system_table); + // same for bios output + let $bios_table = super.createTable('bios-table', { headerPosition: 'left' }); + $container.append(`

${this.translations.bios}

`) + $container.append($bios_table); + return $container; + } + + async onMarkupRendered() { + const dmiData = await this.ajaxCall('/api/dmidecode/service/get'); + if (!dmiData || dmiData?.status !== 'ok') { + this.displayError('dmi lookup failed'); + return; + } + this.processDMIData(dmiData); + } + + processDMIData(data) { + const sysrows = []; + for (const [key, value] of Object.entries(data.system)) { + const row = []; + // try to find translation for key, fallback to output value + // have to split on spaces here because those aren't valid in xml tags + const translationIndex = key.split(" ")[0] + const dispKey = this.translations[translationIndex] || key + row.push(`
${dispKey}
`, `
${value}
`); + sysrows.push(row); + } + const biosrows = []; + for (const [key, value] of Object.entries(data.bios)) { + const row = []; + // try to find translation for key, fallback to output value + // have to split on spaces here because those aren't valid in xml tags + const translationIndex = key.split(" ")[0] + const dispKey = this.translations[translationIndex] || key + row.push(`
${dispKey}
`, `
${value}
`); + biosrows.push(row); + } + super.updateTable('system-table', sysrows); + super.updateTable('bios-table', biosrows); + } + + displayError(message) { + // if something went wrong, display error message in system table + const $error = $(` +
+ ${message} +
+ `); + $('#system-table').empty().append($error); +} + +} diff --git a/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml new file mode 100644 index 000000000..6fedccf82 --- /dev/null +++ b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml @@ -0,0 +1,20 @@ + + + DmiDecode.js + + /api/dmidecode/service/get + + + Hardware Information + Platform + BIOS + Manufacturer + Product Name + Version + Serial Number + Family + Vendor + Release Date + + + diff --git a/sysutils/dmidecode/src/www/widgets/include/dmidecode.inc b/sysutils/dmidecode/src/www/widgets/include/dmidecode.inc deleted file mode 100644 index 0fd5de9f6..000000000 --- a/sysutils/dmidecode/src/www/widgets/include/dmidecode.inc +++ /dev/null @@ -1,3 +0,0 @@ - Date: Thu, 6 Mar 2025 12:07:07 +0100 Subject: [PATCH 028/389] sysutils/dmidecode: adjust namespace --- .../{DmiDecode => Dmidecode}/Api/ServiceController.php | 2 +- .../app/models/OPNsense/{DmiDecode => Dmidecode}/ACL/ACL.xml | 2 +- .../opnsense/www/js/widgets/{DmiDecode.js => Dmidecode.js} | 4 ++-- .../www/js/widgets/Metadata/{DmiDecode.xml => Dmidecode.xml} | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) rename sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/{DmiDecode => Dmidecode}/Api/ServiceController.php (98%) rename sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/{DmiDecode => Dmidecode}/ACL/ACL.xml (77%) rename sysutils/dmidecode/src/opnsense/www/js/widgets/{DmiDecode.js => Dmidecode.js} (97%) rename sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/{DmiDecode.xml => Dmidecode.xml} (93%) diff --git a/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php similarity index 98% rename from sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php rename to sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php index f586629bd..4646bc8c3 100644 --- a/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/DmiDecode/Api/ServiceController.php +++ b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php @@ -27,7 +27,7 @@ * POSSIBILITY OF SUCH DAMAGE. */ -namespace OPNsense\DmiDecode\Api; +namespace OPNsense\Dmidecode\Api; use OPNsense\Base\ApiControllerBase; use OPNsense\Core\Backend; diff --git a/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml b/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/Dmidecode/ACL/ACL.xml similarity index 77% rename from sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml rename to sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/Dmidecode/ACL/ACL.xml index a9f605462..d5ef40eb1 100644 --- a/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/DmiDecode/ACL/ACL.xml +++ b/sysutils/dmidecode/src/opnsense/mvc/app/models/OPNsense/Dmidecode/ACL/ACL.xml @@ -1,6 +1,6 @@ - Service: DMI Decoder Widget + Service: DMI Data Widget api/dmidecode/service/get diff --git a/sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js b/sysutils/dmidecode/src/opnsense/www/js/widgets/Dmidecode.js similarity index 97% rename from sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js rename to sysutils/dmidecode/src/opnsense/www/js/widgets/Dmidecode.js index 89b5da183..32a7dbcd7 100644 --- a/sysutils/dmidecode/src/opnsense/www/js/widgets/DmiDecode.js +++ b/sysutils/dmidecode/src/opnsense/www/js/widgets/Dmidecode.js @@ -24,10 +24,10 @@ * POSSIBILITY OF SUCH DAMAGE. */ -export default class DmiDecode extends BaseTableWidget { +export default class Dmidecode extends BaseTableWidget { constructor() { super(); - this.title = 'DmiDecode Data'; + this.title = 'DMI Data'; } getMarkup() { diff --git a/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml similarity index 93% rename from sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml rename to sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml index 6fedccf82..33a8a8f02 100644 --- a/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/DmiDecode.xml +++ b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml @@ -1,6 +1,6 @@ - DmiDecode.js + Dmidecode.js /api/dmidecode/service/get From ec5990bd61bd09de40fdbf643b3f0fab48df4a9c Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 6 Mar 2025 12:21:40 +0100 Subject: [PATCH 029/389] system/dmidecode: missed this, also rename in list --- .../www/js/widgets/Metadata/Dmidecode.xml | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml index 33a8a8f02..8bc482bec 100644 --- a/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml +++ b/sysutils/dmidecode/src/opnsense/www/js/widgets/Metadata/Dmidecode.xml @@ -1,20 +1,20 @@ - - Dmidecode.js - - /api/dmidecode/service/get - - - Hardware Information - Platform - BIOS - Manufacturer - Product Name - Version - Serial Number - Family - Vendor - Release Date - - + + Dmidecode.js + + /api/dmidecode/service/get + + + DMI Data + Platform + BIOS + Manufacturer + Product Name + Version + Serial Number + Family + Vendor + Release Date + + From 51fd4b5bb4541c149658fdcfd5b641f5fef9948c Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 6 Mar 2025 18:03:41 +0100 Subject: [PATCH 030/389] www/caddy: add propagation_timeout and propagation_delay, cleanup macro definition, bump version and add changelog (#4557) --- www/caddy/Makefile | 2 +- www/caddy/pkg-descr | 5 +++ .../OPNsense/Caddy/forms/general.xml | 16 +++++++- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 8 ++++ .../templates/OPNsense/Caddy/Caddyfile | 39 +++++++++---------- 5 files changed, 47 insertions(+), 23 deletions(-) diff --git a/www/caddy/Makefile b/www/caddy/Makefile index 6c8288cf3..ed4434653 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.8.2 +PLUGIN_VERSION= 1.8.3 PLUGIN_DEPENDS= caddy-custom PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing PLUGIN_MAINTAINER= cedrik@pischem.com diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index 0dfa6ca70..640ead7ea 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -13,6 +13,11 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html Plugin Changelog ================ +1.8.3 + +* Add: Update DNS Providers with new optional choices (opnsense/plugins/issues/4543) +* Add: propagation_timeout and propagation_delay (opnsense/plugins/issues/4544) + 1.8.2 * Add: client_ip_headers (opnsense/plugins/issues/4517) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 573fbce1d..89796552d 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -164,7 +164,21 @@ caddy.general.TlsDnsPropagationTimeout checkbox - + + + + caddy.general.TlsDnsPropagationTimeoutPeriod + + text + 120 + + + + caddy.general.TlsDnsPropagationDelay + + text + 0 + diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 7a851ce70..4cbd45be7 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -71,6 +71,14 @@ + + 1 + Please enter a minimum number of 1 or leave empty for default. + + + 1 + Please enter a minimum number of 1 or leave empty for default. + N diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index afe989808..5e866607c 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -305,15 +305,6 @@ http://{{ domain }} { # Purpose: Configures TLS settings based on the DNS provider, API keys, and optional fields. # Sets up the Caddyfile to update TXT Records with the chosen DNS Provider and receive # certificates with the DNS-01 challenge. Refer to Dynamic DNS section for more details. -# Parameters: -# - @param dnsProvider (string): The DNS provider used for the DNS challenge. -# - @param dnsApiKey (string): API key for the DNS provider, essential for authentication. -# - @param customCert (string, optional): The config extracted name of a certificate. -# - @param dnsChallenge (boolean): Indicates if a DNS challenge is used for certificate authentication. -# - @param dnsSecretApiKey (string, optional): A secret API key or token for additional security, depending on the provider. -# - @param TlsDnsOptionalField1 to 4 (string, optional): Additional fields for specific DNS provider configurations. -# - @param TlsDnsPropagationTimeout (boolean, optional): Disables Propagation Timeout for DNS Challenge. -# - @param TlsDnsPropagationResolvers (string, optional): Set custom nameserver for DNS Challenge. #} {% macro tls_configuration( customCert, @@ -326,6 +317,8 @@ http://{{ domain }} { tlsDnsOptionalField3, tlsDnsOptionalField4, tlsDnsPropagationTimeout, + tlsDnsPropagationTimeoutPeriod, + tlsDnsPropagationDelay, tlsDnsPropagationResolvers ) %} {% if customCert or (dnsChallenge == "1" and dnsProvider) %} @@ -340,8 +333,12 @@ http://{{ domain }} { resolvers {{ tlsDnsPropagationResolvers }} {% endif %} {% if tlsDnsPropagationTimeout|default("0") == "1" %} - propagation_delay 30s propagation_timeout -1 + {% elif tlsDnsPropagationTimeoutPeriod %} + propagation_timeout {{ tlsDnsPropagationTimeoutPeriod }}s + {% endif %} + {% if tlsDnsPropagationDelay %} + propagation_delay {{ tlsDnsPropagationDelay }}s {% endif %} } }{% endif %} @@ -597,19 +594,19 @@ http://{{ domain }} { } {% endif %} {% endif %} - {% set customCert = reverse.CustomCertificate|default("") %} - {% set dnsChallenge = reverse.DnsChallenge|default("0") %} {{ tls_configuration( - customCert, - dnsChallenge, - dnsProvider, - dnsApiKey, - dnsSecretApiKey, - tlsDnsOptionalField1, - tlsDnsOptionalField2, - tlsDnsOptionalField3, - tlsDnsOptionalField4, + reverse.CustomCertificate|default(""), + reverse.DnsChallenge|default("0"), + generalSettings.TlsDnsProvider, + generalSettings.TlsDnsApiKey, + generalSettings.TlsDnsSecretApiKey, + generalSettings.TlsDnsOptionalField1, + generalSettings.TlsDnsOptionalField2, + generalSettings.TlsDnsOptionalField3, + generalSettings.TlsDnsOptionalField4, generalSettings.TlsDnsPropagationTimeout, + generalSettings.TlsDnsPropagationTimeoutPeriod, + generalSettings.TlsDnsPropagationDelay, generalSettings.TlsDnsPropagationResolvers ) }} From 5610d1a88e04559c155b4686df75cef46728beb4 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 6 Mar 2025 18:05:22 +0100 Subject: [PATCH 031/389] www/caddy: Update DNS Provider list and improve maintainability (#4556) * www/caddy: Consolidate all selective DNS Provider logic to includeDnsProvider * www/caddy: Update list of DNS providers with optional remaining or new ones from caddy-dns --- .../OPNsense/Caddy/forms/general.xml | 16 +-- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 27 ++++ .../templates/OPNsense/Caddy/Caddyfile | 10 +- .../OPNsense/Caddy/includeDnsProvider | 121 ++++++++++++++++++ 4 files changed, 160 insertions(+), 14 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 89796552d..87ee5a58f 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -108,7 +108,7 @@ caddy.general.TlsDnsProvider dropdown - + header @@ -118,37 +118,37 @@ caddy.general.TlsDnsApiKey text - + caddy.general.TlsDnsSecretApiKey text - + caddy.general.TlsDnsOptionalField1 text - + caddy.general.TlsDnsOptionalField2 text - + caddy.general.TlsDnsOptionalField3 text - + caddy.general.TlsDnsOptionalField4 text - + header @@ -262,4 +262,4 @@ general-settings - + \ No newline at end of file diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 4cbd45be7..bf5c3cbfe 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -62,6 +62,33 @@ EasyDNS (optional) Hosttech (optional) ClouDNS (optional) + Gcore (optional) + Huawei Cloud (optional) + DNSExit (optional) + Nanelo (optional) + Katapult (optional) + Regfish (optional) + Leaseweb (optional) + DreamHost (optional) + Exoscale (optional) + TransIP (optional) + Selectel (optional) + DNSimple (optional) + LuaDNS (optional) + Hurricane Electric (optional) + Namesilo (optional) + Dode (optional) + Dynu (optional) + Glesys (optional) + NFSN (optional) + GoDaddy (optional) + Vercel (optional) + Loopia (optional) + DNSPod (optional) + Mythic Beasts (optional) + Dynv6 (optional) + AliDNS (optional) + Metaname (optional) diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index 5e866607c..fe712251f 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -174,12 +174,8 @@ {% endfor %} {% endfor %} - {# - # Define special DNS Providers that have more than one API key, or special requirements that do not allow the use of the default. - # The same providers have to be added to "OPNsense/Caddy/includeDnsProvider", best in the same order as in this array for maintainability. - # For a new provider to work, it has to be compiled into the caddy binary. - #} - {% set dnsProviderSpecialConfig = ['duckdns', 'porkbun', 'desec', 'route53', 'acmedns', 'googleclouddns', 'azure', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox', 'netcup', 'rfc2136', 'dnsmadeeasy', 'civo', 'scaleway', 'acmeproxy', 'inwx', 'namedotcom', 'easydns', 'directadmin', 'cloudns'] %} + {% import "OPNsense/Caddy/includeDnsProvider" as dns_includes %} + {% set dnsProviderSpecialConfig = dns_includes.dnsProviderSpecialConfig() %} {# Conditionally add the dynamic_dns section, acmedns provider is special, it does not support dynamic_dns. #} {% if dnsProvider and dynDnsDomains|length > 0 and dnsProvider != "acmedns" %} @@ -187,6 +183,7 @@ {# duckdns provider is special, it has a different configuration for dynamic dns than for the dns-01 challenge. #} {% if dnsProvider in dnsProviderSpecialConfig and dnsProvider != "duckdns" %} provider {{ dnsProvider }} { + {% set context_var = 'dnsProviderSpecialLogic' %} {% include "OPNsense/Caddy/includeDnsProvider" %} } {% else %} @@ -325,6 +322,7 @@ http://{{ domain }} { tls {% if customCert %}/var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.pem /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.key{% endif %} {% if not customCert and dnsChallenge == "1" and dnsProvider %}{ issuer acme { dns {{ dnsProvider }} {% if dnsProvider not in dnsProviderSpecialConfig %}{{ dnsApiKey }}{% else %}{ + {% set context_var = 'dnsProviderSpecialLogic' %} {% include "OPNsense/Caddy/includeDnsProvider" %} } {% endif %} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeDnsProvider b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeDnsProvider index e771a66b7..aa76b2ef7 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeDnsProvider +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeDnsProvider @@ -6,6 +6,53 @@ # It only includes DNS Providers that need specific settings and do not default to # "dns {{ dnsProvider }} {{ dnsApiKey }}" #} +{% macro dnsProviderSpecialConfig() %} + [ + 'duckdns', + 'porkbun', + 'desec', + 'route53', + 'acmedns', + 'googleclouddns', + 'azure', + 'ovh', + 'namecheap', + 'powerdns', + 'ddnss', + 'linode', + 'tencentcloud', + 'dinahosting', + 'hexonet', + 'mailinabox', + 'netcup', + 'rfc2136', + 'dnsmadeeasy', + 'civo', + 'scaleway', + 'acmeproxy', + 'inwx', + 'namedotcom', + 'easydns', + 'directadmin', + 'cloudns', + 'huaweicloud', + 'regfish', + 'dreamhost', + 'exoscale', + 'transip', + 'selectel', + 'luadns', + 'he', + 'dynu', + 'glesys', + 'nfsn', + 'loopia', + 'mythicbeasts', + 'alidns', + 'metaname' + ] +{% endmacro %} +{% if context_var == 'dnsProviderSpecialLogic' %} {% if dnsProvider == 'duckdns' %} {% if dnsApiKey %}api_token {{ dnsApiKey }} {% endif %} @@ -190,4 +237,78 @@ {% endif %} {% if dnsOptionalField1 %}sub_auth_id {{ dnsOptionalField1 }} {% endif %} +{% elif dnsProvider == 'huaweicloud' %} + {% if dnsApiKey %}access_key_id {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}secret_access_key {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'regfish' %} + {% if dnsApiKey %}api_key {{ dnsApiKey }} + {% endif %} +{% elif dnsProvider == 'dreamhost' %} + {% if dnsApiKey %}api_key {{ dnsApiKey }} + {% endif %} +{% elif dnsProvider == 'exoscale' %} + {% if dnsApiKey %}api_key {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}api_secret {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'transip' %} + {% if dnsApiKey %}account_name {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}private_key_path {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'selectel' %} + {% if dnsApiKey %}user {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}password {{ dnsSecretApiKey }} + {% endif %} + {% if dnsOptionalField1 %}account_id {{ dnsOptionalField1 }} + {% endif %} + {% if dnsOptionalField2 %}project_name {{ dnsOptionalField2 }} + {% endif %} +{% elif dnsProvider == 'luadns' %} + {% if dnsApiKey %}email {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}api_key {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'he' %} + {% if dnsApiKey %}api_key {{ dnsApiKey }} + {% endif %} +{% elif dnsProvider == 'dynu' %} + {% if dnsApiKey %}api_token {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}own_domain {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'glesys' %} + {% if dnsApiKey %}project {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}api_key {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'nfsn' %} + {% if dnsApiKey %}login {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}api_key {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'loopia' %} + {% if dnsApiKey %}username {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}password {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'mythicbeasts' %} + {% if dnsApiKey %}key_id {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}secret {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'alidns' %} + {% if dnsApiKey %}access_key_id {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}access_key_secret {{ dnsSecretApiKey }} + {% endif %} +{% elif dnsProvider == 'metaname' %} + {% if dnsApiKey %}api_key {{ dnsApiKey }} + {% endif %} + {% if dnsSecretApiKey %}account_reference {{ dnsSecretApiKey }} + {% endif %} +{% endif %} {% endif %} From 6e5bef6fd4734c4d831a51d01f36d4f405ad547d Mon Sep 17 00:00:00 2001 From: Michael Date: Fri, 7 Mar 2025 21:26:39 +0100 Subject: [PATCH 032/389] net-mgmt/zabbix-agent: Add 7.2 (#4575) --- net-mgmt/zabbix-agent/Makefile | 7 +++++-- net-mgmt/zabbix-agent/pkg-descr | 4 ++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/net-mgmt/zabbix-agent/Makefile b/net-mgmt/zabbix-agent/Makefile index e778bc29a..1666be5f4 100644 --- a/net-mgmt/zabbix-agent/Makefile +++ b/net-mgmt/zabbix-agent/Makefile @@ -1,8 +1,11 @@ PLUGIN_NAME= zabbix-agent -PLUGIN_VERSION= 1.14 +PLUGIN_VERSION= 1.15 PLUGIN_COMMENT= Zabbix monitoring agent PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_VARIANTS= zabbix7 zabbix6 zabbix64 zabbix5 +PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix64 zabbix5 + +zabbix72_NAME= zabbix72-agent +zabbix72_DEPENDS= zabbix72-agent zabbix7_NAME= zabbix7-agent zabbix7_DEPENDS= zabbix7-agent diff --git a/net-mgmt/zabbix-agent/pkg-descr b/net-mgmt/zabbix-agent/pkg-descr index d8097f7c1..23e469356 100644 --- a/net-mgmt/zabbix-agent/pkg-descr +++ b/net-mgmt/zabbix-agent/pkg-descr @@ -12,6 +12,10 @@ WWW: https://www.zabbix.com/ Plugin Changelog ---------------- +1.15 + +* Plugin variant for Zabbix Agent 7.2 + 1.14 * Plugin variant for Zabbix Agent 7 From 1ac4769e9953523160cb90167c41c40c027ff964 Mon Sep 17 00:00:00 2001 From: Michael Date: Fri, 7 Mar 2025 21:27:16 +0100 Subject: [PATCH 033/389] net-mgmt/zabbix-proxy: Add 7.2 (#4576) --- net-mgmt/zabbix-proxy/Makefile | 7 +++++-- net-mgmt/zabbix-proxy/pkg-descr | 4 ++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/net-mgmt/zabbix-proxy/Makefile b/net-mgmt/zabbix-proxy/Makefile index 748d8a5f2..2f8bc9307 100644 --- a/net-mgmt/zabbix-proxy/Makefile +++ b/net-mgmt/zabbix-proxy/Makefile @@ -1,8 +1,11 @@ PLUGIN_NAME= zabbix-proxy -PLUGIN_VERSION= 1.11 +PLUGIN_VERSION= 1.12 PLUGIN_COMMENT= Zabbix monitoring proxy PLUGIN_MAINTAINER= m.muenz@gmail.com -PLUGIN_VARIANTS= zabbix7 zabbix6 zabbix64 zabbix5 +PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix64 zabbix5 + +zabbix72_NAME= zabbix72-proxy +zabbix72_DEPENDS= zabbix72-proxy zabbix7_NAME= zabbix7-proxy zabbix7_DEPENDS= zabbix7-proxy diff --git a/net-mgmt/zabbix-proxy/pkg-descr b/net-mgmt/zabbix-proxy/pkg-descr index 1aab6b36a..e8c6b4ded 100644 --- a/net-mgmt/zabbix-proxy/pkg-descr +++ b/net-mgmt/zabbix-proxy/pkg-descr @@ -12,6 +12,10 @@ WWW: https://www.zabbix.com/ Plugin Changelog ---------------- +1.12 + +* Add plugin variant for Zabbix Proxy 7.2 + 1.11 * Add plugin variant for Zabbix Proxy 7 From 7d885fdbce61b6606f13ab03abf75ed08d97f641 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Sun, 9 Mar 2025 08:23:09 +0100 Subject: [PATCH 034/389] net-mgmt/zabbix-*: 6.4 is EoL, style tweaks --- net-mgmt/zabbix-agent/Makefile | 9 +++------ net-mgmt/zabbix-agent/pkg-descr | 4 +++- net-mgmt/zabbix-proxy/Makefile | 9 +++------ net-mgmt/zabbix-proxy/pkg-descr | 2 +- 4 files changed, 10 insertions(+), 14 deletions(-) diff --git a/net-mgmt/zabbix-agent/Makefile b/net-mgmt/zabbix-agent/Makefile index 1666be5f4..0d855b112 100644 --- a/net-mgmt/zabbix-agent/Makefile +++ b/net-mgmt/zabbix-agent/Makefile @@ -2,16 +2,13 @@ PLUGIN_NAME= zabbix-agent PLUGIN_VERSION= 1.15 PLUGIN_COMMENT= Zabbix monitoring agent PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix64 zabbix5 - -zabbix72_NAME= zabbix72-agent -zabbix72_DEPENDS= zabbix72-agent +PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix5 zabbix7_NAME= zabbix7-agent zabbix7_DEPENDS= zabbix7-agent -zabbix64_NAME= zabbix64-agent -zabbix64_DEPENDS= zabbix64-agent +zabbix72_NAME= zabbix72-agent +zabbix72_DEPENDS= zabbix72-agent zabbix6_NAME= zabbix6-agent zabbix6_DEPENDS= zabbix6-agent diff --git a/net-mgmt/zabbix-agent/pkg-descr b/net-mgmt/zabbix-agent/pkg-descr index 23e469356..5b4ed6593 100644 --- a/net-mgmt/zabbix-agent/pkg-descr +++ b/net-mgmt/zabbix-agent/pkg-descr @@ -14,10 +14,12 @@ Plugin Changelog 1.15 -* Plugin variant for Zabbix Agent 7.2 +Added: +* Plugin variant for Zabbix Agent 7.2, 6.4 is EoL and was removed 1.14 +Added: * Plugin variant for Zabbix Agent 7 1.13 diff --git a/net-mgmt/zabbix-proxy/Makefile b/net-mgmt/zabbix-proxy/Makefile index 2f8bc9307..426d7aabd 100644 --- a/net-mgmt/zabbix-proxy/Makefile +++ b/net-mgmt/zabbix-proxy/Makefile @@ -2,16 +2,13 @@ PLUGIN_NAME= zabbix-proxy PLUGIN_VERSION= 1.12 PLUGIN_COMMENT= Zabbix monitoring proxy PLUGIN_MAINTAINER= m.muenz@gmail.com -PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix64 zabbix5 - -zabbix72_NAME= zabbix72-proxy -zabbix72_DEPENDS= zabbix72-proxy +PLUGIN_VARIANTS= zabbix7 zabbix72 zabbix6 zabbix5 zabbix7_NAME= zabbix7-proxy zabbix7_DEPENDS= zabbix7-proxy -zabbix64_NAME= zabbix64-proxy -zabbix64_DEPENDS= zabbix64-proxy +zabbix72_NAME= zabbix72-proxy +zabbix72_DEPENDS= zabbix72-proxy zabbix6_NAME= zabbix6-proxy zabbix6_DEPENDS= zabbix6-proxy diff --git a/net-mgmt/zabbix-proxy/pkg-descr b/net-mgmt/zabbix-proxy/pkg-descr index e8c6b4ded..49159ff30 100644 --- a/net-mgmt/zabbix-proxy/pkg-descr +++ b/net-mgmt/zabbix-proxy/pkg-descr @@ -14,7 +14,7 @@ Plugin Changelog 1.12 -* Add plugin variant for Zabbix Proxy 7.2 +* Add plugin variant for Zabbix Proxy 7.2, 6.4 is EoL and was removed 1.11 From e57f1ab9dcfac0b5dc4c1b9f0349c07a5cea9e6e Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Sun, 9 Mar 2025 08:24:50 +0100 Subject: [PATCH 035/389] LICENSE: sync --- LICENSE | 1 + 1 file changed, 1 insertion(+) diff --git a/LICENSE b/LICENSE index c838c25bb..d368fe7cb 100644 --- a/LICENSE +++ b/LICENSE @@ -54,6 +54,7 @@ Copyright (c) 2024 Mike Shuey Copyright (c) 2023-2024 Mikhail Kharisov Copyright (c) 2023 mleinart Copyright (c) 2024 MVZ Labor Ludwigsburg GbR +Copyright (c) 2025 Neil Merchant Copyright (c) 2021-2024 Nicola Pellegrini Copyright (c) 2022 Nikolaj Brinch Jørgensen Copyright (c) 2021 Nim G From 897ad8a807e442a03931e48d37edd387e27698e6 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Mon, 10 Mar 2025 08:35:51 +0100 Subject: [PATCH 036/389] sysutils/dmidecode: this file was new, remove spurious older copyright --- .../controllers/OPNsense/Dmidecode/Api/ServiceController.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php index 4646bc8c3..6dc1ed86e 100644 --- a/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php +++ b/sysutils/dmidecode/src/opnsense/mvc/app/controllers/OPNsense/Dmidecode/Api/ServiceController.php @@ -1,7 +1,6 @@ configdRun('dmidecode system')), false, INI_SCANNER_RAW); $bios = parse_ini_string(trim((new Backend())->configdRun('dmidecode bios')), false, INI_SCANNER_RAW); - $status = "ok"; - return ["status" => $status, "system" => $system, "bios" => $bios]; + return ['status' => 'ok', 'system' => $system, 'bios' => $bios]; } } From 11bb18d97dbd0058f67e0d4d4b7041829401399b Mon Sep 17 00:00:00 2001 From: Andy Binder Date: Tue, 11 Mar 2025 15:44:42 +0100 Subject: [PATCH 037/389] www/squid: change cache_dir from ufs to rock (#4487) --- .../controllers/OPNsense/Proxy/forms/main.xml | 19 ++++++++----- .../mvc/app/models/OPNsense/Proxy/Proxy.xml | 27 ++++++++++--------- .../templates/OPNsense/Proxy/squid.conf | 2 +- 3 files changed, 29 insertions(+), 19 deletions(-) diff --git a/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml b/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml index 998bd76b4..dca5a45f3 100644 --- a/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml +++ b/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml @@ -148,17 +148,24 @@ true - proxy.general.cache.local.l1 - + proxy.general.cache.local.swap_timeout + text - Enter the number of first-level subdirectories for the local cache (default is 16). + Prevents Squid from reading/writing to disk if the operation exceeds the specified timelimit in milliseconds (default 0 = disable when left empty). true - proxy.general.cache.local.l2 - + proxy.general.cache.local.max_swap_rate + text - Enter the number of second-level subdirectories for the local cache (default is 256). + Limits disk access by setting a maximum I/O rate in swaps per second (default 0 = disable when left empty). + true + + + proxy.general.cache.local.slot_size + + text + Defines the size of a database record used to store cached responses. Value should be a multiple of the OS I/O page size (default 16384 when left empty). true diff --git a/www/squid/src/opnsense/mvc/app/models/OPNsense/Proxy/Proxy.xml b/www/squid/src/opnsense/mvc/app/models/OPNsense/Proxy/Proxy.xml index 3d77eabfe..84dc90de7 100644 --- a/www/squid/src/opnsense/mvc/app/models/OPNsense/Proxy/Proxy.xml +++ b/www/squid/src/opnsense/mvc/app/models/OPNsense/Proxy/Proxy.xml @@ -124,18 +124,21 @@ Specify a positive cache size. (number of MB's) Y - - 16 - 1 - Specify a positive number of first-level subdirectories. - Y - - - 256 - 1 - Specify a positive number of second-level subdirectories. - Y - + + 0 + Specify a valid swap-timeout. + N + + + 0 + Specify a valid swap-rate. + N + + + 4096 + Specify a multiple of operating system I/O page size. + N + 0 Y diff --git a/www/squid/src/opnsense/service/templates/OPNsense/Proxy/squid.conf b/www/squid/src/opnsense/service/templates/OPNsense/Proxy/squid.conf index d42e8dfa7..f3ff38936 100644 --- a/www/squid/src/opnsense/service/templates/OPNsense/Proxy/squid.conf +++ b/www/squid/src/opnsense/service/templates/OPNsense/Proxy/squid.conf @@ -320,7 +320,7 @@ maximum_object_size_in_memory {{OPNsense.proxy.general.cache.local.maximum_objec memory_cache_mode {{OPNsense.proxy.general.cache.local.memory_cache_mode}} {% endif %} {% if OPNsense.proxy.general.cache.local.enabled == '1' %} -cache_dir ufs {{OPNsense.proxy.general.cache.local.directory}} {{OPNsense.proxy.general.cache.local.size}} {{OPNsense.proxy.general.cache.local.l1}} {{OPNsense.proxy.general.cache.local.l2}} +cache_dir rock {{OPNsense.proxy.general.cache.local.directory}} {{OPNsense.proxy.general.cache.local.size}}{% if not helpers.empty('OPNsense.proxy.general.cache.local.swap_timeout') %} swap-timeout={{OPNsense.proxy.general.cache.local.swap_timeout}}{% endif %}{% if not helpers.empty('OPNsense.proxy.general.cache.local.max_swap_rate') %} max-swap-rate={{OPNsense.proxy.general.cache.local.max_swap_rate}}{% endif %}{% if not helpers.empty('OPNsense.proxy.general.cache.local.slot_size') %} slot-size={{OPNsense.proxy.general.cache.local.slot_size}}{% endif %} {% endif %} {% endif %} {% endif %} From 00cb3e9dbeb3ebc35641738f09dee805fb48450c Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Tue, 11 Mar 2025 19:08:58 +0100 Subject: [PATCH 038/389] sysutils/sftp-backup : remove carriage return for windows users and possible excess line endings, closes https://github.com/opnsense/plugins/issues/4582 --- .../src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php index 052783eb7..90c2e5aba 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -178,7 +178,7 @@ class Sftp extends Base implements IBackupProvider mkdir($confdir); } if (!is_file($identfile) || file_get_contents($identfile) != $this->model->privkey) { - File::file_put_contents($identfile, $this->model->privkey, 0600); + File::file_put_contents($identfile, trim(str_replace("\r", "", $this->model->privkey)) . "\n", 0600); } return $identfile; } From 22bf308bdab8118756eef141592ebc91f62cfa5d Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 12 Mar 2025 07:45:33 +0100 Subject: [PATCH 039/389] sysutils/sftp-backup: bump revision after previous --- sysutils/sftp-backup/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/sysutils/sftp-backup/Makefile b/sysutils/sftp-backup/Makefile index 680b17fe0..ca782f04b 100644 --- a/sysutils/sftp-backup/Makefile +++ b/sysutils/sftp-backup/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= sftp-backup PLUGIN_VERSION= 1.0 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= Backup configurations using SFTP PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 From cfc1269ca7db3d7294578a1d4887f95ed93370a2 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 12 Mar 2025 08:05:18 +0100 Subject: [PATCH 040/389] LICENSE: sync --- LICENSE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index d368fe7cb..203218422 100644 --- a/LICENSE +++ b/LICENSE @@ -67,7 +67,7 @@ Copyright (c) 2004-2012 Scott Ullrich Copyright (c) 2010 Seth Mos Copyright (c) 2024 Sheridan Computers Copyright (c) 2008 Shrew Soft Inc. -Copyright (c) 2017-2019 Smart-Soft +Copyright (c) 2017-2018 Smart-Soft Copyright (c) 2020 Starkstromkonsument Copyright (c) 2023-2024 Thomas Cekal Copyright (c) 2020 Tobias Boehnert From 16c993aa1ae924500dfa01b8396897011950a7fc Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 12 Mar 2025 08:03:41 +0100 Subject: [PATCH 041/389] sysutils/gdrive-backup: moved here from core PR: https://github.com/opnsense/core/issues/8343 --- README.md | 1 + sysutils/gdrive-backup/Makefile | 8 + sysutils/gdrive-backup/pkg-descr | 4 + .../src/etc/inc/plugins.inc.d/gdrive.inc | 40 +++ .../mvc/app/library/Google/API/Drive.php | 148 +++++++++ .../app/library/OPNsense/Backup/GDrive.php | 306 ++++++++++++++++++ 6 files changed, 507 insertions(+) create mode 100644 sysutils/gdrive-backup/Makefile create mode 100644 sysutils/gdrive-backup/pkg-descr create mode 100644 sysutils/gdrive-backup/src/etc/inc/plugins.inc.d/gdrive.inc create mode 100644 sysutils/gdrive-backup/src/opnsense/mvc/app/library/Google/API/Drive.php create mode 100644 sysutils/gdrive-backup/src/opnsense/mvc/app/library/OPNsense/Backup/GDrive.php diff --git a/README.md b/README.md index e195524f7..c3b757df1 100644 --- a/README.md +++ b/README.md @@ -98,6 +98,7 @@ sysutils/apuled -- PC Engine APU LED control (development only) sysutils/cpu-microcode -- CPU microcode updates sysutils/dec-hw -- Deciso hardware specific information sysutils/dmidecode -- Display hardware information on the dashboard +sysutils/gdrive-backup -- Backup configurations using Google Drive sysutils/git-backup -- Track config changes using git sysutils/hw-probe -- Collect hardware diagnostics sysutils/lcdproc-sdeclcd -- LCDProc for SDEC LCD devices diff --git a/sysutils/gdrive-backup/Makefile b/sysutils/gdrive-backup/Makefile new file mode 100644 index 000000000..4372dbfc8 --- /dev/null +++ b/sysutils/gdrive-backup/Makefile @@ -0,0 +1,8 @@ +PLUGIN_NAME= gdrive-backup +PLUGIN_VERSION= 1.0 +PLUGIN_COMMENT= Backup configurations using Google Drive +PLUGIN_DEPENDS= php${PLUGIN_PHP}-google-api-php-client +PLUGIN_MAINTAINER= ad@opnsense.org +PLUGIN_TIER= 2 + +.include "../../Mk/plugins.mk" diff --git a/sysutils/gdrive-backup/pkg-descr b/sysutils/gdrive-backup/pkg-descr new file mode 100644 index 000000000..68fc6ad30 --- /dev/null +++ b/sysutils/gdrive-backup/pkg-descr @@ -0,0 +1,4 @@ +This plugin adds a backup option using Google Drive. + +Due to the sensitive nature of the data being send to the backup, +we strongly advise to not use a public service to send backups to. diff --git a/sysutils/gdrive-backup/src/etc/inc/plugins.inc.d/gdrive.inc b/sysutils/gdrive-backup/src/etc/inc/plugins.inc.d/gdrive.inc new file mode 100644 index 000000000..bad2cfa6b --- /dev/null +++ b/sysutils/gdrive-backup/src/etc/inc/plugins.inc.d/gdrive.inc @@ -0,0 +1,40 @@ + gettext('Backup - Google Drive'), + 'section' => 'system.remotebackup', + 'id' => 'remotebackup', + ]]; +} diff --git a/sysutils/gdrive-backup/src/opnsense/mvc/app/library/Google/API/Drive.php b/sysutils/gdrive-backup/src/opnsense/mvc/app/library/Google/API/Drive.php new file mode 100644 index 000000000..ef1ffb437 --- /dev/null +++ b/sysutils/gdrive-backup/src/opnsense/mvc/app/library/Google/API/Drive.php @@ -0,0 +1,148 @@ +client = new \Google_Client(); + + $service_account = [ + "type" => "service_account", + "private_key" => $certinfo['pkey'], + "client_email" => $client_id, + "client_id" => $client_id, + "auth_uri" => "https://accounts.google.com/o/oauth2/auth", + "token_uri" => "https://oauth2.googleapis.com/token", + "auth_provider_x509_cert_url" => "https://www.googleapis.com/oauth2/v1/certs" + ]; + + $this->client->setAuthConfig($service_account); + $this->client->addScope("https://www.googleapis.com/auth/drive"); + $this->client->setApplicationName("OPNsense"); + + $this->service = new \Google_Service_Drive($this->client); + } + + /** + * retrieve directory listing + * @param $directoryId parent directory id + * @param $filename title/filename of object + * @return mixed list of files + */ + public function listFiles($directoryId, $filename = null) + { + $query = "'" . $directoryId . "' in parents "; + if ($filename != null) { + $query .= " and title in '" . $filename . "'"; + } + return $this->service->files->listFiles(['q' => $query, 'supportsAllDrives' => true]); + } + + + /** + * download a file by given GDrive file handle + * @param $fileHandle (object from listFiles) + * @return null|string + */ + public function download($fileHandle) + { + $response = $this->service->files->get($fileHandle->id, ['alt' => 'media', 'supportsAllDrives' => true]); + return $response->getBody()->getContents(); + } + + /** + * Upload file + * @param string $directoryId (parent id) + * @param string $filename + * @param string $content + * @param string $mimetype + * @return \Google_Service_Drive_DriveFile handle + */ + public function upload($directoryId, $filename, $content, $mimetype = 'text/plain') + { + + $file = new \Google_Service_Drive_DriveFile(); + $file->setName($filename); + $file->setDescription($filename); + $file->setMimeType('text/plain'); + $file->setParents([$directoryId]); + + $createdFile = $this->service->files->create($file, [ + 'data' => $content, + 'mimeType' => $mimetype, + 'uploadType' => 'media', + 'supportsAllDrives' => true + ]); + + return $createdFile; + } + + /** + * delete file + * @param $fileHandle (object from listFiles) + */ + public function delete($fileHandle) + { + $this->service->files->delete($fileHandle['id'], ['supportsAllDrives' => true]); + } +} diff --git a/sysutils/gdrive-backup/src/opnsense/mvc/app/library/OPNsense/Backup/GDrive.php b/sysutils/gdrive-backup/src/opnsense/mvc/app/library/OPNsense/Backup/GDrive.php new file mode 100644 index 000000000..089ff08cd --- /dev/null +++ b/sysutils/gdrive-backup/src/opnsense/mvc/app/library/OPNsense/Backup/GDrive.php @@ -0,0 +1,306 @@ + "GDriveEnabled", + "type" => "checkbox", + "label" => gettext("Enable"), + "value" => null + ); + $fields[] = array( + "name" => "GDriveEmail", + "type" => "text", + "label" => gettext("Email Address"), + "help" => gettext("Client-ID in the Google cloud console"), + "value" => null + ); + $fields[] = array( + "name" => "GDriveP12key", + "type" => "file", + "label" => gettext("P12 key"), + "help" => sprintf( + gettext('You need a private key in p12 format to use Google Drive, ' . + 'instructions on how to acquire one can be found %shere%s.'), + '', + '' + ), + "value" => null + ); + $fields[] = array( + "name" => "GDriveFolderID", + "type" => "text", + "label" => gettext("Folder ID"), + "value" => null + ); + $fields[] = array( + "name" => "GDrivePrefixHostname", + "type" => "checkbox", + "label" => gettext("Prefix hostname to backupfile"), + "help" => gettext("Normally the config xml will be written as config-stamp.xml, with this option set " . + "the filename will use the systems host and domain name."), + "value" => null + ); + $fields[] = array( + "name" => "GDriveBackupCount", + "type" => "text", + "label" => gettext("Backup Count"), + "value" => 60 + ); + $fields[] = array( + "name" => "GDrivePassword", + "type" => "password", + "label" => gettext("Password"), + "value" => null + ); + $fields[] = array( + "name" => "GDrivePasswordConfirm", + "type" => "password", + "label" => gettext("Confirm"), + "value" => null + ); + $cnf = Config::getInstance(); + if ($cnf->isValid()) { + $config = $cnf->object(); + foreach ($fields as &$field) { + $fieldname = $field['name']; + if (isset($config->system->remotebackup->$fieldname)) { + $field['value'] = (string)$config->system->remotebackup->$fieldname; + } elseif ( + $fieldname == "GDrivePasswordConfirm" && + isset($config->system->remotebackup->GDrivePassword) + ) { + $field['value'] = (string)$config->system->remotebackup->GDrivePassword; + } + } + } + + return $fields; + } + + /** + * backup provider name + * @return string user friendly name + */ + public function getName() + { + return gettext("Google Drive"); + } + + /** + * validate and set configuration + * @param array $conf configuration array + * @return array of validation errors when not saved + */ + public function setConfiguration($conf) + { + $input_errors = array(); + if ($conf['GDrivePasswordConfirm'] != $conf['GDrivePassword']) { + $input_errors[] = gettext("The supplied 'Password' and 'Confirm' field values must match."); + } + if (count($input_errors) == 0) { + $config = Config::getInstance()->object(); + if (!isset($config->system->remotebackup)) { + $config->system->addChild('remotebackup'); + } + foreach ($this->getConfigurationFields() as $field) { + $fieldname = $field['name']; + if ($field['type'] == 'file') { + if (!empty($conf[$field['name']])) { + $config->system->remotebackup->$fieldname = base64_encode($conf[$field['name']]); + } + } elseif ($field['name'] == 'GDrivePasswordConfirm') { + /* skip password confirm field */ + } elseif (!empty($conf[$field['name']])) { + $config->system->remotebackup->$fieldname = $conf[$field['name']]; + } else { + unset($config->system->remotebackup->$fieldname); + } + } + // remove private key when disabled + if ( + empty($config->system->remotebackup->GDriveEnabled) && + isset($config->system->remotebackup->GDriveP12key) + ) { + unset($config->system->remotebackup->GDriveP12key); + } + Config::getInstance()->save(); + } + + return $input_errors; + } + + /** + * @return array filelist + */ + public function backup() + { + $cnf = Config::getInstance(); + if ($cnf->isValid()) { + $config = $cnf->object(); + if ( + isset($config->system->remotebackup) && isset($config->system->remotebackup->GDriveEnabled) + && !empty($config->system->remotebackup->GDriveEnabled) + ) { + if (!empty($config->system->remotebackup->GDrivePrefixHostname)) { + $fileprefix = (string)$config->system->hostname . "." . (string)$config->system->domain . "-"; + } else { + $fileprefix = "config-"; + } + try { + $client = new \Google\API\Drive(); + $client->login( + (string)$config->system->remotebackup->GDriveEmail, + (string)$config->system->remotebackup->GDriveP12key + ); + } catch (\Error | \Exception $e) { + syslog(LOG_ERR, "error connecting to Google Drive"); + return array(); + } + + // backup source data to local strings (plain/encrypted) + $confdata = file_get_contents('/conf/config.xml'); + $confdata_enc = $this->encrypt($confdata, (string)$config->system->remotebackup->GDrivePassword); + + // read filelist ({prefix}*.xml) + try { + $files = $client->listFiles((string)$config->system->remotebackup->GDriveFolderID); + } catch (\Error | \Exception $e) { + syslog(LOG_ERR, "error while fetching filelist from Google Drive"); + return array(); + } + + $configfiles = array(); + foreach ($files as $file) { + if (fnmatch("{$fileprefix}*.xml", $file['name'])) { + $configfiles[$file['name']] = $file; + } + } + krsort($configfiles); + + + // backup new file if changed (or if first in backup) + $target_filename = $fileprefix . time() . ".xml"; + if (count($configfiles) > 1) { + // compare last backup with current, only save new + try { + $bck_data_enc = $client->download($configfiles[array_keys($configfiles)[0]]); + if (strpos(substr($bck_data_enc, 0, 100), '---') !== false) { + // base64 string is wrapped into tags + $start_at = strpos($bck_data_enc, "---\n") + 4; + $end_at = strpos($bck_data_enc, "\n---"); + $bck_data_enc = substr($bck_data_enc, $start_at, ($end_at - $start_at)); + } + $bck_data = $this->decrypt( + $bck_data_enc, + (string)$config->system->remotebackup->GDrivePassword + ); + if ($bck_data == $confdata) { + $target_filename = null; + } + } catch (\Error | \Exception $e) { + syslog(LOG_ERR, "unable to download " . + $configfiles[array_keys($configfiles)[0]]->description . " from Google Drive (" . $e . ")"); + } + } + if (!is_null($target_filename)) { + syslog(LOG_NOTICE, "backup configuration as " . $target_filename); + try { + $configfiles[$target_filename] = $client->upload( + (string)$config->system->remotebackup->GDriveFolderID, + $target_filename, + $confdata_enc + ); + } catch (\Error | \Exception $e) { + syslog(LOG_ERR, "unable to upload " . $target_filename . " to Google Drive (" . $e . ")"); + return array(); + } + + krsort($configfiles); + } + + // cleanup old files + if ( + isset($config->system->remotebackup->GDriveBackupCount) + && is_numeric((string)$config->system->remotebackup->GDriveBackupCount) + ) { + $fcount = 0; + foreach ($configfiles as $filename => $file) { + if ($fcount >= (string)$config->system->remotebackup->GDriveBackupCount) { + syslog(LOG_NOTICE, "remove " . $filename . " from Google Drive"); + try { + $client->delete($file); + } catch (Google_Service_Exception $e) { + syslog(LOG_ERR, "unable to remove " . $filename . " from Google Drive"); + } + } + $fcount++; + } + } + + // return filelist + return array_keys($configfiles); + } + } + + // not configured / issue, return empty list + return array(); + } + + /** + * Is this provider enabled + * @return boolean enabled status + */ + public function isEnabled() + { + $cnf = Config::getInstance(); + if ($cnf->isValid()) { + $config = $cnf->object(); + return isset($config->system->remotebackup) && isset($config->system->remotebackup->GDriveEnabled) + && !empty($config->system->remotebackup->GDriveEnabled); + } + return false; + } +} From 931f2c5d7a73f4158748fdf14c1a1f8ba3c5d20e Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Wed, 12 Mar 2025 17:19:47 +0100 Subject: [PATCH 042/389] www/OPNProxy - compatibility fix for new member attribute, closes https://github.com/opnsense/plugins/issues/4589 --- .../src/opnsense/scripts/OPNProxy/redis_sync_users.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/www/OPNProxy/src/opnsense/scripts/OPNProxy/redis_sync_users.py b/www/OPNProxy/src/opnsense/scripts/OPNProxy/redis_sync_users.py index 3e22e0909..30098333e 100755 --- a/www/OPNProxy/src/opnsense/scripts/OPNProxy/redis_sync_users.py +++ b/www/OPNProxy/src/opnsense/scripts/OPNProxy/redis_sync_users.py @@ -60,9 +60,12 @@ if __name__ == '__main__': membership = dict() for group in xmlroot.findall('./system/group'): for member in group.findall('member'): - if member.text not in membership: - membership[member.text] = list() - membership[member.text].append(group.findtext('name')) + if member.text is None: + continue + for item in member.text.split(','): + if item not in membership: + membership[item] = list() + membership[item].append(group.findtext('name')) for user in xmlroot.findall('./system/user'): if args.username is None or args.username == user.findtext('name'): From 8e95b6ed461fc4dca2e2dbfeac4c2139013055b7 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Thu, 13 Mar 2025 19:33:00 +0100 Subject: [PATCH 043/389] net/frr: Fix passive interface generation in ospf (#4594) --- net/frr/Makefile | 1 + .../service/templates/OPNsense/Quagga/ospfd.conf | 13 +++++-------- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/net/frr/Makefile b/net/frr/Makefile index 46155e8a8..c7cbc732c 100644 --- a/net/frr/Makefile +++ b/net/frr/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= frr PLUGIN_VERSION= 1.43 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= The FRRouting Protocol Suite PLUGIN_DEPENDS= frr8-pythontools PLUGIN_MAINTAINER= ad@opnsense.org diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf index b937c735b..b6da96c22 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/ospfd.conf @@ -9,20 +9,17 @@ agentx {% endif %} {% endif %} -{% set passive_interfaces = [] %} -{% if helpers.exists('OPNsense.quagga.ospf.passiveinterfaces') and OPNsense.quagga.ospf.passiveinterfaces != '' %} -{% for line in OPNsense.quagga.ospf.passiveinterfaces.split(',') %} -{% set iface = physical_interface(line) %} -{% set _ = passive_interfaces.append(iface) %} -interface {{ iface }} +{% if OPNsense.quagga.ospf.passiveinterfaces %} +{% for iface in OPNsense.quagga.ospf.passiveinterfaces.split(',') %} +interface {{ helpers.physical_interface(iface) }} ip ospf passive {% endfor %} {% endif %} -{# Render only the enabled non-passive interfaces past this point #} +{# vtysh automatically merges passive interfaces with interfaces below #} {% if helpers.exists('OPNsense.quagga.ospf.interfaces.interface') %} {% for interface in helpers.toList('OPNsense.quagga.ospf.interfaces.interface') %} {% set iface = physical_interface(interface.interfacename) %} -{% if interface.enabled == '1' and iface not in passive_interfaces %} +{% if interface.enabled == '1' %} interface {{ iface }} {% if interface.bfd|default('') == '1' %} ip ospf bfd From 2b961b6d8c1a3aae92432e27c8bfa7b71155a759 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Fri, 14 Mar 2025 08:12:12 +0100 Subject: [PATCH 044/389] www/OPNProxy: bump revision --- www/OPNProxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/OPNProxy/Makefile b/www/OPNProxy/Makefile index 3c1b5d999..20aa92ff1 100644 --- a/www/OPNProxy/Makefile +++ b/www/OPNProxy/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= OPNProxy PLUGIN_VERSION= 1.0.5 -PLUGIN_REVISION= 1 +PLUGIN_REVISION= 2 PLUGIN_COMMENT= OPNsense proxy additions PLUGIN_DEPENDS= os-redis${PLUGIN_PKGSUFFIX} \ os-squid${PLUGIN_PKGSUFFIX} \ From 8d03cdfee3a16b5beb12ac409a6287b7bdb10f95 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Fri, 14 Mar 2025 10:01:07 +0100 Subject: [PATCH 045/389] sysutils/gdrive-backup: make this dev only for now --- README.md | 2 +- sysutils/gdrive-backup/Makefile | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c3b757df1..d19657ee9 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ sysutils/apuled -- PC Engine APU LED control (development only) sysutils/cpu-microcode -- CPU microcode updates sysutils/dec-hw -- Deciso hardware specific information sysutils/dmidecode -- Display hardware information on the dashboard -sysutils/gdrive-backup -- Backup configurations using Google Drive +sysutils/gdrive-backup -- Backup configurations using Google Drive (development only) sysutils/git-backup -- Track config changes using git sysutils/hw-probe -- Collect hardware diagnostics sysutils/lcdproc-sdeclcd -- LCDProc for SDEC LCD devices diff --git a/sysutils/gdrive-backup/Makefile b/sysutils/gdrive-backup/Makefile index 4372dbfc8..25d2ea24c 100644 --- a/sysutils/gdrive-backup/Makefile +++ b/sysutils/gdrive-backup/Makefile @@ -1,7 +1,8 @@ PLUGIN_NAME= gdrive-backup -PLUGIN_VERSION= 1.0 +PLUGIN_VERSION= 0.1 PLUGIN_COMMENT= Backup configurations using Google Drive PLUGIN_DEPENDS= php${PLUGIN_PHP}-google-api-php-client +PLUGIN_DEVEL= yes PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 From 99d22e1691aefd1848673ab44de0553afc133ef6 Mon Sep 17 00:00:00 2001 From: Andy Binder Date: Fri, 14 Mar 2025 11:14:42 +0100 Subject: [PATCH 046/389] Update squid workers helptext. (#4597) --- .../opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml b/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml index dca5a45f3..309053bf1 100644 --- a/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml +++ b/www/squid/src/opnsense/mvc/app/controllers/OPNsense/Proxy/forms/main.xml @@ -350,7 +350,7 @@ proxy.forward.workers text - Start N main Squid process daemons (i.e., SMP mode). Requires Restart. Do not enable when using local cache. + Start N main Squid process daemons (i.e., SMP mode). Requires Restart. 1 true From 50c9cb095a04c05f83367c2922ecdea0d79aa8d4 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Fri, 14 Mar 2025 13:23:25 +0100 Subject: [PATCH 047/389] sysutils/sftp-backup : fix identity comparison for https://github.com/opnsense/plugins/issues/4582 --- .../src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php index 90c2e5aba..75846a652 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -177,8 +177,9 @@ class Sftp extends Base implements IBackupProvider if (!is_dir($confdir)) { mkdir($confdir); } - if (!is_file($identfile) || file_get_contents($identfile) != $this->model->privkey) { - File::file_put_contents($identfile, trim(str_replace("\r", "", $this->model->privkey)) . "\n", 0600); + $this_key = trim(str_replace("\r", "", $this->model->privkey)) . "\n"; + if (!is_file($identfile) || file_get_contents($identfile) != $this_key) { + File::file_put_contents($identfile, $this_key, 0600); } return $identfile; } From 8b5dd05fd4e067bf368177888003f636de53508a Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Wed, 19 Mar 2025 08:59:47 +0100 Subject: [PATCH 048/389] ddclient: remove deprecated domains, closes https://github.com/opnsense/plugins/issues/4607 --- .../src/opnsense/mvc/app/models/OPNsense/DynDNS/DynDNS.xml | 2 -- dns/ddclient/src/opnsense/scripts/ddclient/lib/address.py | 2 -- 2 files changed, 4 deletions(-) diff --git a/dns/ddclient/src/opnsense/mvc/app/models/OPNsense/DynDNS/DynDNS.xml b/dns/ddclient/src/opnsense/mvc/app/models/OPNsense/DynDNS/DynDNS.xml index 600e17517..4554ff751 100644 --- a/dns/ddclient/src/opnsense/mvc/app/models/OPNsense/DynDNS/DynDNS.xml +++ b/dns/ddclient/src/opnsense/mvc/app/models/OPNsense/DynDNS/DynDNS.xml @@ -146,8 +146,6 @@ freedns he icanhazip - ip4only.me - ip6only.me ipify-ipv4 ipify-ipv6 loopia diff --git a/dns/ddclient/src/opnsense/scripts/ddclient/lib/address.py b/dns/ddclient/src/opnsense/scripts/ddclient/lib/address.py index d1dc1c6ab..fd444ac07 100755 --- a/dns/ddclient/src/opnsense/scripts/ddclient/lib/address.py +++ b/dns/ddclient/src/opnsense/scripts/ddclient/lib/address.py @@ -36,8 +36,6 @@ checkip_service_list = { 'freedns': '%s://freedns.afraid.org/dynamic/check.php', 'he': '%s://checkip.dns.he.net/', 'icanhazip': '%s://icanhazip.com/', - 'ip4only.me': '%s://ip4only.me/api/', - 'ip6only.me': '%s://ip6only.me/api/', 'ipify-ipv4': '%s://api.ipify.org/', 'ipify-ipv6': '%s://api6.ipify.org/', 'loopia': '%s://dns.loopia.se/checkip/checkip.php', From 8d5a15555320068dfd37f748c916da5164459f26 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 19 Mar 2025 14:13:22 +0100 Subject: [PATCH 049/389] www/caddy: Add client auth mtls to domains (#4601) --- www/caddy/Makefile | 2 +- www/caddy/pkg-descr | 4 ++++ .../Caddy/forms/dialogReverseProxy.xml | 19 +++++++++++++++ .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 12 ++++++++++ .../scripts/OPNsense/Caddy/caddy_certs.php | 16 +++++++++++-- .../templates/OPNsense/Caddy/Caddyfile | 23 ++++++++++++++++--- 6 files changed, 70 insertions(+), 6 deletions(-) diff --git a/www/caddy/Makefile b/www/caddy/Makefile index ed4434653..b8195f4da 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.8.3 +PLUGIN_VERSION= 1.8.4 PLUGIN_DEPENDS= caddy-custom PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing PLUGIN_MAINTAINER= cedrik@pischem.com diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index 640ead7ea..67443a08c 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -13,6 +13,10 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html Plugin Changelog ================ +1.8.4 + +* Add: Client Auth (mTLS) to domains (opnsense/plugins/issues/4089) + 1.8.3 * Add: Update DNS Providers with new optional choices (opnsense/plugins/issues/4543) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml index a8163b33f..86a0bd1bb 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml @@ -104,6 +104,25 @@ false + + reverse.ClientAuthTrustPool + + select_multiple + + + false + + + + reverse.ClientAuthMode + + dropdown + true + + + false + + reverse.AccessLog diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index bf5c3cbfe..0deb5239c 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -276,6 +276,18 @@ http:// + + require_and_verify + + request + require + verify_if_given + + + + ca + Y + diff --git a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php index 67618d75a..f4b43e0de 100755 --- a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php +++ b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php @@ -87,14 +87,26 @@ foreach ((new Caddy())->reverseproxy->handle->iterateItems() as $handleItem) { } } +foreach ((new Caddy())->reverseproxy->reverse->iterateItems() as $reverseItem) { + $caCertField = (string)$reverseItem->ClientAuthTrustPool; + + if (!empty($caCertField)) { + $refs = array_map('trim', explode(',', $caCertField)); + foreach ($refs as $ref) { + + if (!empty($ref)) { + $caCertRefs[] = $ref; + } + } + } +} + $caCertRefs = array_unique($caCertRefs); foreach ((new Ca())->ca->iterateItems() as $caItem) { $refid = (string)$caItem->refid; - if (in_array($refid, $caCertRefs, true)) { $caCert = base64_decode((string)$caItem->crt); - $writeFileIfChanged($tempDir . $refid . '.pem', $caCert); } } diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index fe712251f..d5bdb2b66 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -306,6 +306,8 @@ http://{{ domain }} { {% macro tls_configuration( customCert, dnsChallenge, + clientAuthTrustPool, + clientAuthMode, dnsProvider, dnsApiKey, dnsSecretApiKey, @@ -318,8 +320,9 @@ http://{{ domain }} { tlsDnsPropagationDelay, tlsDnsPropagationResolvers ) %} - {% if customCert or (dnsChallenge == "1" and dnsProvider) %} - tls {% if customCert %}/var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.pem /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.key{% endif %} {% if not customCert and dnsChallenge == "1" and dnsProvider %}{ + {% if customCert or (dnsChallenge == "1" and dnsProvider) or clientAuthTrustPool %} + tls {% if customCert %}/var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.pem /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.key{% endif %} { + {% if not customCert and (dnsChallenge == "1" and dnsProvider) %} issuer acme { dns {{ dnsProvider }} {% if dnsProvider not in dnsProviderSpecialConfig %}{{ dnsApiKey }}{% else %}{ {% set context_var = 'dnsProviderSpecialLogic' %} @@ -339,7 +342,19 @@ http://{{ domain }} { propagation_delay {{ tlsDnsPropagationDelay }}s {% endif %} } - }{% endif %} + {% endif %} + + {% if clientAuthTrustPool %} + client_auth { + {% for ca in clientAuthTrustPool.split(',') %} + trust_pool file /var/db/caddy/data/caddy/certificates/temp/{{ ca.strip() }}.pem + {% endfor %} + {% if clientAuthMode %} + mode {{ clientAuthMode }} + {% endif %} + } + {% endif %} + } {% endif %} {% endmacro %} @@ -595,6 +610,8 @@ http://{{ domain }} { {{ tls_configuration( reverse.CustomCertificate|default(""), reverse.DnsChallenge|default("0"), + reverse.ClientAuthTrustPool|default(""), + reverse.ClientAuthMode|default(""), generalSettings.TlsDnsProvider, generalSettings.TlsDnsApiKey, generalSettings.TlsDnsSecretApiKey, From ae6185094e5fe8873d3e3a6ee984e16987c35fce Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 19 Mar 2025 15:17:36 +0100 Subject: [PATCH 050/389] plugins: style sweep --- .../src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php | 8 ++++---- .../mvc/app/controllers/OPNsense/Caddy/forms/general.xml | 2 +- .../src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php | 1 - 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php index 75846a652..dc09fe342 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -187,13 +187,13 @@ class Sftp extends Base implements IBackupProvider /** * @return list of files on remote location */ - private function ls($pattern='') + private function ls($pattern = '') { $result = []; - foreach (explode("\n", $this->sftpCmd('ls -lnt '. $pattern)['stdout']) as $line) { + foreach (explode("\n", $this->sftpCmd('ls -lnt ' . $pattern)['stdout']) as $line) { $parts = preg_split('/\s+/', $line, -1, PREG_SPLIT_NO_EMPTY); if (count($parts) >= 7) { - $result[] = $parts[count($parts)-1]; + $result[] = $parts[count($parts) - 1]; } } return $result; @@ -249,7 +249,7 @@ class Sftp extends Base implements IBackupProvider /* cleanup */ rsort($remote_backups); if (count($remote_backups) > (int)$this->model->backupcount->getCurrentValue()) { - for ($i = $this->model->backupcount->getCurrentValue() ; $i < count($remote_backups); $i++) { + for ($i = $this->model->backupcount->getCurrentValue(); $i < count($remote_backups); $i++) { $this->del($remote_backups[$i]); } $remote_backups = $this->ls('config-*.xml'); diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 87ee5a58f..b6f0c86d1 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -262,4 +262,4 @@ general-settings - \ No newline at end of file + diff --git a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php index f4b43e0de..a6494eb97 100755 --- a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php +++ b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php @@ -93,7 +93,6 @@ foreach ((new Caddy())->reverseproxy->reverse->iterateItems() as $reverseItem) { if (!empty($caCertField)) { $refs = array_map('trim', explode(',', $caCertField)); foreach ($refs as $ref) { - if (!empty($ref)) { $caCertRefs[] = $ref; } From ef54f31c73465eba69427fdbe6af6439f75800fe Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 19 Mar 2025 15:19:11 +0100 Subject: [PATCH 051/389] plugins: add pull target --- Mk/defaults.mk | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Mk/defaults.mk b/Mk/defaults.mk index 9cf73ce3a..979555948 100644 --- a/Mk/defaults.mk +++ b/Mk/defaults.mk @@ -157,6 +157,11 @@ rebase: log: @git log --stat -p ${PLUGIN_STABLE} +pull: + @git checkout ${PLUGIN_STABLE} + @git pull + @git checkout ${PLUGIN_MAIN} + push: @git checkout ${PLUGIN_STABLE} @git push From 64c4272413d6af24a38f4d6683e21b78059967d3 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 19 Mar 2025 15:20:23 +0100 Subject: [PATCH 052/389] sysutils/sftp-backup: bump revision again --- sysutils/sftp-backup/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysutils/sftp-backup/Makefile b/sysutils/sftp-backup/Makefile index ca782f04b..d1ce65094 100644 --- a/sysutils/sftp-backup/Makefile +++ b/sysutils/sftp-backup/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= sftp-backup PLUGIN_VERSION= 1.0 -PLUGIN_REVISION= 1 +PLUGIN_REVISION= 2 PLUGIN_COMMENT= Backup configurations using SFTP PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 From 6dfe5ab003989ec96e9e9dabab2adc7d1400ca1d Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 19 Mar 2025 15:25:22 +0100 Subject: [PATCH 053/389] dns/ddclient: bump revision and document --- dns/ddclient/Makefile | 1 + dns/ddclient/pkg-descr | 1 + 2 files changed, 2 insertions(+) diff --git a/dns/ddclient/Makefile b/dns/ddclient/Makefile index 1d004d558..cb55c5f2c 100644 --- a/dns/ddclient/Makefile +++ b/dns/ddclient/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= ddclient PLUGIN_VERSION= 1.27 +PLUGIN_REVISION= 1 PLUGIN_DEPENDS= ddclient py${PLUGIN_PYTHON}-boto3 PLUGIN_COMMENT= Dynamic DNS client PLUGIN_MAINTAINER= ad@opnsense.org diff --git a/dns/ddclient/pkg-descr b/dns/ddclient/pkg-descr index 3e91a0e2a..0d3991e44 100644 --- a/dns/ddclient/pkg-descr +++ b/dns/ddclient/pkg-descr @@ -10,6 +10,7 @@ Plugin Changelog * Add support for altering IPv6 addresses in native backend (contributed by SaarLAN-Pissbeutel) * Fix Netcup host/domain recognition (contributed by SaarLAN-Pissbeutel) +* Removed defunct ip4only.me and ip6only.me 1.26 From 037cb532ea32241661f3d7ddb07c36f1dd49c536 Mon Sep 17 00:00:00 2001 From: beposec <46341010+beposec@users.noreply.github.com> Date: Wed, 19 Mar 2025 22:13:46 +0100 Subject: [PATCH 054/389] sftp-backup: Add hostname prefix and allow usage of filedrop sftp server (#4602) * Add possibility for hostname prefix for backups and allow usage of filedrop only sftp server * Move config variable into else block * Set value in case no backups where found on the server and housekeeping is disabled. --------- Co-authored-by: Ad Schellevis --- .../mvc/app/library/OPNsense/Backup/Sftp.php | 86 ++++++++++++------- .../models/OPNsense/Backup/SftpSettings.xml | 6 +- 2 files changed, 58 insertions(+), 34 deletions(-) diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php index dc09fe342..32f7b8a50 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/library/OPNsense/Backup/Sftp.php @@ -74,11 +74,20 @@ class Sftp extends Base implements IBackupProvider "help" => gettext("The private key used to setup the connection."), "value" => null ], + [ + "name" => "prefixhostname", + "type" => "checkbox", + "label" => gettext("Prefix hostname to backupfile"), + "help" => gettext("Normally the config xml will be written as config-stamp.xml, with this option set " . + "the filename will use the systems host and domain name."), + "value" => null + ], [ "name" => "backupcount", "type" => "text", "label" => gettext("Backup Count"), - "value" => null + "help" => gettext("Amount of backups to be kept at remote location. Set to 0 to upload latest only without housekeeping"), + "value" => 60 ], [ "name" => "password", @@ -221,41 +230,52 @@ class Sftp extends Base implements IBackupProvider */ public function backup() { - if ($this->model->enabled->isEmpty()) { + $cnf = Config::getInstance(); + if (!$this->model->enabled->isEmpty() && $cnf->isValid()) { + if ($this->model->prefixhostname->isEmpty()) { + $fileprefix = "config-"; + } else { + $config = $cnf->object(); + $fileprefix = sprintf('%s.%s-', (string)$config->system->hostname, (string)$config->system->domain); + } + /** + * Collect most recent backup, since /conf/backup/ always contains the latests, we can use the filename + * for easy comparison. + **/ + $all_backups = glob('/conf/backup/config-*.xml'); + $most_recent = $all_backups[count($all_backups) - 1]; + $confdata = file_get_contents($most_recent); + if (!$this->model->password->isEmpty()) { + $confdata = $this->encrypt($confdata, (string)$this->model->password); + } + $remote_backups = $this->ls(sprintf('%s*.xml', $fileprefix)); + $target_filename = strtolower(preg_replace('/^config-/', $fileprefix, basename($most_recent))); + + if (!in_array($target_filename, $remote_backups)) { + syslog(LOG_NOTICE, "backup configuration as " . $target_filename); + $tmpfilename = sprintf("/conf/backup/sftp/%s", $target_filename); + File::file_put_contents($tmpfilename, $confdata, 0600); + $this->put($tmpfilename, $target_filename); + unlink($tmpfilename); + $remote_backups = $this->ls(sprintf('%s*.xml', $fileprefix)); + } + /* cleanup only if backup count is > 0*/ + if ($this->model->backupcount->asFloat() > 0) { + rsort($remote_backups); + if (count($remote_backups) > (int)$this->model->backupcount->getCurrentValue()) { + for ($i = $this->model->backupcount->getCurrentValue() ; $i < count($remote_backups); $i++) { + $this->del($remote_backups[$i]); + } + $remote_backups = $this->ls(sprintf('%s*.xml', $fileprefix)); + } + return $remote_backups; + } else { + return $this->ls(sprintf('%s*.xml', $fileprefix)) ?: []; + } + } else { /* disabled */ return; } - /** - * Collect most recent backup, since /conf/backup/ always contains the latests, we can use the filename - * for easy comparison. - **/ - $all_backups = glob('/conf/backup/config-*.xml'); - $most_recent = $all_backups[count($all_backups) - 1]; - $confdata = file_get_contents($most_recent); - if (!$this->model->password->isEmpty()) { - $confdata = $this->encrypt($confdata, (string)$this->model->password); - } - /* backup filename when not already on remote location */ - $remote_backups = $this->ls('config-*.xml'); - $target_filename = basename($most_recent); - if (!in_array($target_filename, $remote_backups)) { - syslog(LOG_NOTICE, "backup configuration as " . $target_filename); - $tmpfilename = sprintf("/conf/backup/sftp/%s", $target_filename); - File::file_put_contents($tmpfilename, $confdata, 0600); - $this->put($tmpfilename, $target_filename); - unlink($tmpfilename); - $remote_backups = $this->ls('config-*.xml'); - } - /* cleanup */ - rsort($remote_backups); - if (count($remote_backups) > (int)$this->model->backupcount->getCurrentValue()) { - for ($i = $this->model->backupcount->getCurrentValue(); $i < count($remote_backups); $i++) { - $this->del($remote_backups[$i]); - } - $remote_backups = $this->ls('config-*.xml'); - } - - return $remote_backups; } /** diff --git a/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.xml b/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.xml index d5ba6c324..3756f971d 100644 --- a/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.xml +++ b/sysutils/sftp-backup/src/opnsense/mvc/app/models/OPNsense/Backup/SftpSettings.xml @@ -46,7 +46,11 @@ 60 Y - 1 + 0 + + 0 + N + From 4a202ebcd2d72c521121f61353b1e62cf88cff28 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Fri, 21 Mar 2025 07:54:37 +0100 Subject: [PATCH 055/389] net/frr: Add BGP remote-as internal and external to neighbors and peergroups (#4611) --- net/frr/Makefile | 3 +-- net/frr/pkg-descr | 4 ++++ .../Quagga/forms/dialogEditBGPNeighbor.xml | 9 +++++++++ .../Quagga/forms/dialogEditBGPPeergroups.xml | 9 +++++++++ .../mvc/app/models/OPNsense/Quagga/BGP.xml | 15 ++++++++++++++- .../service/templates/OPNsense/Quagga/bgpd.conf | 8 ++++++-- 6 files changed, 43 insertions(+), 5 deletions(-) diff --git a/net/frr/Makefile b/net/frr/Makefile index c7cbc732c..2b6b1acff 100644 --- a/net/frr/Makefile +++ b/net/frr/Makefile @@ -1,6 +1,5 @@ PLUGIN_NAME= frr -PLUGIN_VERSION= 1.43 -PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.44 PLUGIN_COMMENT= The FRRouting Protocol Suite PLUGIN_DEPENDS= frr8-pythontools PLUGIN_MAINTAINER= ad@opnsense.org diff --git a/net/frr/pkg-descr b/net/frr/pkg-descr index 6a19f7379..3ca685557 100644 --- a/net/frr/pkg-descr +++ b/net/frr/pkg-descr @@ -12,6 +12,10 @@ WWW: https://frrouting.org/ Plugin Changelog ================ +1.44 + +* Add BGP remote-as internal and external (opnsense/plugins/issues/4609) + 1.43 * Use frr-reload instead of restarting the service on configuration changes (opnsense/plugins/issues/4529) diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPNeighbor.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPNeighbor.xml index 9c2d176be..d2a91df99 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPNeighbor.xml +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPNeighbor.xml @@ -21,6 +21,15 @@ text Specify the IP address of the BGP neighbor. + + neighbor.remote_as_mode + + dropdown + "Use Remote AS Number" will use the number specified in the "Remote AS" field, while "External" or "Internal" will ignore it in favor of the alternative "remote-as internal" and "remote-as external" settings. + + false + + neighbor.remoteas diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPPeergroups.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPPeergroups.xml index a42ece762..4f29080fc 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPPeergroups.xml +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditBGPPeergroups.xml @@ -15,6 +15,15 @@ text Name of the peer group. + + peergroup.remote_as_mode + + dropdown + "Use Remote AS Number" will use the number specified in the "Remote AS" field, while "External" or "Internal" will ignore it in favor of the alternative "remote-as internal" and "remote-as external" settings. + + false + + peergroup.remoteas diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml index a7239218e..88f5e92bd 100644 --- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml +++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml @@ -63,6 +63,13 @@ Y + + Use Remote AS Number + + Internal + External + + 1 4294967295 @@ -418,8 +425,14 @@ Y + + Use Remote AS Number + + Internal + External + + - Y 1 4294967295 diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf index e560f3c25..55023713a 100644 --- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf +++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf @@ -51,8 +51,10 @@ router bgp {{ OPNsense.quagga.bgp.asnumber }} {% for peergroup in helpers.toList('OPNsense.quagga.bgp.peergroups.peergroup') %} {% if peergroup.enabled == '1' %} neighbor {{ peergroup.name }} peer-group -{% if 'remoteas' in peergroup and peergroup.remoteas != '' %} +{% if 'remoteas' in peergroup and peergroup.remoteas and not peergroup.remote_as_mode %} neighbor {{ peergroup.name }} remote-as {{ peergroup.remoteas }} +{% else %} + neighbor {{ peergroup.name }} remote-as {{ peergroup.remote_as_mode }} {% endif %} {% if peergroup.updatesource %} neighbor {{ peergroup.name }} update-source {{ physical_interface(peergroup.updatesource) }} @@ -101,8 +103,10 @@ router bgp {{ OPNsense.quagga.bgp.asnumber }} {% if helpers.exists('OPNsense.quagga.bgp.neighbors.neighbor') %} {% for neighbor in helpers.toList('OPNsense.quagga.bgp.neighbors.neighbor') %} {% if neighbor.enabled == '1' %} -{% if 'remoteas' in neighbor and neighbor.remoteas != '' %} +{% if 'remoteas' in neighbor and neighbor.remoteas and not neighbor.remote_as_mode %} neighbor {{ neighbor.address }} remote-as {{ neighbor.remoteas }} +{% else %} + neighbor {{ neighbor.address }} remote-as {{ neighbor.remote_as_mode }} {% endif %} {% if neighbor.bfd|default('') == '1' %} neighbor {{ neighbor.address }} bfd From 30c2b1a1ab54aa3a015ea684a101b86173e0cbd9 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Fri, 21 Mar 2025 07:55:33 +0100 Subject: [PATCH 056/389] net/frr: Add BGP/OSPF/OSPF6 route redistribution with route-map feature (#4578) * net/frr: Add BGP route redistribution with route-map feature. Add migration. * net/frr: Small template fix in redistribution since route-map is optional * net/frr: Add OSPF and OSPF6 route redistribution with route-map feature. Adjust migration to migrate OSPF, OSPF6 and BGP models. * net/frr: make sweep * net/frr: Fix wrong diff in ospf6 template * net/frr: Add a little css to make the redistribution grid look like its part of the base form, more seamless integration * net/frr: Show route-map in grid and hide description --- net/frr/pkg-descr | 2 + .../OPNsense/Quagga/Api/BgpController.php | 31 ++++++ .../Quagga/Api/Ospf6settingsController.php | 25 +++++ .../Quagga/Api/OspfsettingsController.php | 26 +++++ .../OPNsense/Quagga/BgpController.php | 3 + .../OPNsense/Quagga/Ospf6Controller.php | 3 + .../OPNsense/Quagga/OspfController.php | 3 + .../controllers/OPNsense/Quagga/forms/bgp.xml | 6 -- .../Quagga/forms/dialogEditRedistribution.xml | 33 +++++++ .../OPNsense/Quagga/forms/ospf.xml | 12 --- .../OPNsense/Quagga/forms/ospf6.xml | 12 --- .../mvc/app/models/OPNsense/Quagga/BGP.xml | 45 ++++++--- .../OPNsense/Quagga/Migrations/M1_1_0.php | 96 +++++++++++++++++++ .../mvc/app/models/OPNsense/Quagga/OSPF.xml | 58 ++++++----- .../mvc/app/models/OPNsense/Quagga/OSPF6.xml | 52 ++++++---- .../mvc/app/views/OPNsense/Quagga/bgp.volt | 35 +++++++ .../mvc/app/views/OPNsense/Quagga/ospf.volt | 35 +++++++ .../mvc/app/views/OPNsense/Quagga/ospf6.volt | 35 ++++++- .../templates/OPNsense/Quagga/bgpd.conf | 10 +- .../templates/OPNsense/Quagga/ospf6d.conf | 10 +- .../templates/OPNsense/Quagga/ospfd.conf | 10 +- 21 files changed, 437 insertions(+), 105 deletions(-) create mode 100644 net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditRedistribution.xml create mode 100644 net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/Migrations/M1_1_0.php diff --git a/net/frr/pkg-descr b/net/frr/pkg-descr index 3ca685557..aa57d45c4 100644 --- a/net/frr/pkg-descr +++ b/net/frr/pkg-descr @@ -14,6 +14,8 @@ Plugin Changelog 1.44 +* Add route-map functionality to route redistribution in bgp (opnsense/plugins/issues/4570) +* Add route-map functionality to route redistribution in ospf/ospf6 (opnsense/plugins/issues/4580) * Add BGP remote-as internal and external (opnsense/plugins/issues/4609) 1.43 diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BgpController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BgpController.php index 2d1759dce..3a4a93158 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BgpController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BgpController.php @@ -187,6 +187,31 @@ class BgpController extends ApiMutableModelControllerBase return $this->setBase('peergroup', 'peergroups.peergroup', $uuid); } + public function searchRedistributionAction() + { + return $this->searchBase('redistributions.redistribution'); + } + + public function getRedistributionAction($uuid = null) + { + return $this->getBase('redistribution', 'redistributions.redistribution', $uuid); + } + + public function addRedistributionAction() + { + return $this->addBase('redistribution', 'redistributions.redistribution'); + } + + public function delRedistributionAction($uuid) + { + return $this->delBase('redistributions.redistribution', $uuid); + } + + public function setRedistributionAction($uuid) + { + return $this->setBase('redistribution', 'redistributions.redistribution', $uuid); + } + public function toggleCommunitylistAction($uuid) { return $this->toggleBase('communitylists.communitylist', $uuid); @@ -216,4 +241,10 @@ class BgpController extends ApiMutableModelControllerBase { return $this->toggleBase('peergroups.peergroup', $uuid); } + + public function toggleRedistributionAction($uuid) + { + return $this->toggleBase('redistributions.redistribution', $uuid); + } + } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/Ospf6settingsController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/Ospf6settingsController.php index 5019e029b..65c2610b5 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/Ospf6settingsController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/Ospf6settingsController.php @@ -137,4 +137,29 @@ class Ospf6settingsController extends ApiMutableModelControllerBase { return $this->toggleBase('routemaps.routemap', $uuid); } + public function searchRedistributionAction() + { + return $this->searchBase('redistributions.redistribution'); + } + public function getRedistributionAction($uuid = null) + { + return $this->getBase('redistribution', 'redistributions.redistribution', $uuid); + } + public function addRedistributionAction() + { + return $this->addBase('redistribution', 'redistributions.redistribution'); + } + public function delRedistributionAction($uuid) + { + return $this->delBase('redistributions.redistribution', $uuid); + } + public function setRedistributionAction($uuid) + { + return $this->setBase('redistribution', 'redistributions.redistribution', $uuid); + } + public function toggleRedistributionAction($uuid) + { + return $this->toggleBase('redistributions.redistribution', $uuid); + } + } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php index cb495c1c2..763449420 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php @@ -133,4 +133,30 @@ class OspfsettingsController extends ApiMutableModelControllerBase { return $this->toggleBase('routemaps.routemap', $uuid); } + + public function searchRedistributionAction() + { + return $this->searchBase('redistributions.redistribution'); + } + public function getRedistributionAction($uuid = null) + { + return $this->getBase('redistribution', 'redistributions.redistribution', $uuid); + } + public function addRedistributionAction() + { + return $this->addBase('redistribution', 'redistributions.redistribution'); + } + public function delRedistributionAction($uuid) + { + return $this->delBase('redistributions.redistribution', $uuid); + } + public function setRedistributionAction($uuid) + { + return $this->setBase('redistribution', 'redistributions.redistribution', $uuid); + } + public function toggleRedistributionAction($uuid) + { + return $this->toggleBase('redistributions.redistribution', $uuid); + } + } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php index 1374be541..6949d12e3 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/BgpController.php @@ -52,6 +52,9 @@ class BgpController extends \OPNsense\Base\IndexController $this->view->formDialogEditBGPPeergroups = $this->getForm("dialogEditBGPPeergroups"); $this->view->formGridEditBGPPeergroups = $this->getFormGrid("dialogEditBGPPeergroups"); + $this->view->formDialogEditRedistribution = $this->getForm("dialogEditRedistribution"); + $this->view->formGridEditRedistribution = $this->getFormGrid("dialogEditRedistribution"); + $this->view->pick('OPNsense/Quagga/bgp'); } } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php index 107cafa78..e782096b9 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Ospf6Controller.php @@ -43,6 +43,9 @@ class Ospf6Controller extends \OPNsense\Base\IndexController $this->view->formDialogEditRouteMaps = $this->getForm("dialogEditOSPF6RouteMaps"); $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPF6RouteMaps"); + $this->view->formDialogEditRedistribution = $this->getForm("dialogEditRedistribution"); + $this->view->formGridEditRedistribution = $this->getFormGrid("dialogEditRedistribution"); + $this->view->pick('OPNsense/Quagga/ospf6'); } } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php index 0ab2f1588..584c5da00 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/OspfController.php @@ -46,6 +46,9 @@ class OspfController extends \OPNsense\Base\IndexController $this->view->formDialogEditRouteMaps = $this->getForm("dialogEditOSPFRouteMaps"); $this->view->formGridEditRouteMaps = $this->getFormGrid("dialogEditOSPFRouteMaps"); + $this->view->formDialogEditRedistribution = $this->getForm("dialogEditRedistribution"); + $this->view->formGridEditRedistribution = $this->getFormGrid("dialogEditRedistribution"); + $this->view->pick('OPNsense/Quagga/ospf'); } } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml index 85e104b23..f515a7b71 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml @@ -53,10 +53,4 @@ checkbox Enable extended logging of BGP neighbor changes. - - bgp.redistribute - - select_multiple - Select routing sources to redistribute to other nodes. - diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditRedistribution.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditRedistribution.xml new file mode 100644 index 000000000..cd3eb2a08 --- /dev/null +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/dialogEditRedistribution.xml @@ -0,0 +1,33 @@ +
+ + redistribution.enabled + + checkbox + + 6em + boolean + rowtoggle + + + + redistribution.redistribute + + dropdown + Select routing sources to redistribute to other nodes. + + + redistribution.linkedRoutemap + + dropdown + Optional Route-map to apply to this redistribution. + + + redistribution.description + + text + Optional description for this redistribution. + + false + + +
diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf.xml index 3600e8497..e6935b8a8 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf.xml +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf.xml @@ -31,18 +31,6 @@ select_multiple Select the interfaces where no OSPF packets should be sent. - - ospf.redistribute - - select_multiple - Select other routing sources to redistribute to other nodes. - - - ospf.redistributemap - - dropdown - Route Map to set for Redistribution, can be used to send a specific network as advertisement when it is defined in a Prefix List attached to a Route Map. - ospf.logadjacencychanges diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf6.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf6.xml index 5432da38f..8b4b01455 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf6.xml +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/ospf6.xml @@ -11,18 +11,6 @@ checkbox Register CARP status monitor. When no neighbors are found, consider this node less attractive. Requires syslog enabled with “Debugging” logging. Incompatible with “Enable CARP Failover”. - - ospf6.redistribute - - select_multiple - Select other routing sources to redistribute to other nodes. - - - ospf6.redistributemap - - dropdown - Route Map to set for Redistribution, can be used to send a specific network as advertisement when it is defined in a Prefix List attached to a Route Map. - ospf6.routerid diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml index 88f5e92bd..108c85714 100644 --- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml +++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml @@ -1,7 +1,7 @@ //OPNsense/quagga/bgp BGP Routing configuration - 1.0.9 + 1.1.0 0 @@ -37,18 +37,6 @@ N - - N - Y - - - Open Shortest Path First (OSPF) - Connected routes (directly attached subnet or host) - Kernel routes (not installed via the zebra RIB) - Routing Information Protocol (RIP) - Statically configured routes - - @@ -493,5 +481,36 @@ + + + + 1 + Y + + + + Y + connected + + Open Shortest Path First (OSPF) + Connected routes (directly attached subnet or host) + Kernel routes (not installed via the zebra RIB) + Routing Information Protocol (RIP) + Statically configured routes + + + + + + + Related Route-Map item not found + + + diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/Migrations/M1_1_0.php b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/Migrations/M1_1_0.php new file mode 100644 index 000000000..9bcb8a2b7 --- /dev/null +++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/Migrations/M1_1_0.php @@ -0,0 +1,96 @@ +object(); + + if ($model->getNodeByReference('redistributions') === null) { + $model->addChild('redistributions'); + } + $redistributions = $model->getNodeByReference('redistributions.redistribution'); + + // We migrate multiple models at the same time + $protocols = ['bgp', 'ospf', 'ospf6']; + + foreach ($protocols as $protocol) { + if (isset($config->OPNsense->quagga->{$protocol})) { + $this->migrateRedistribute( + $redistributions, + $config->OPNsense->quagga->{$protocol}, + $protocol + ); + } + } + } + + private function migrateRedistribute($redistributions, $configNode, $protocol) + { + if (!$configNode || empty($configNode->redistribute)) { + return; + } + + $redistributeValues = explode(',', (string)$configNode->redistribute); + $redistributemap = isset($configNode->redistributemap) ? (string)$configNode->redistributemap : ''; + + if ($redistributions === null) { + $redistributions = $model->addChild('redistributions'); + } + + // Collect existing redistribution values to prevent duplicates + $existingRedistributions = []; + foreach ($redistributions->iterateItems() as $existing) { + if (!empty((string)$existing->redistribute)) { + $existingRedistributions[] = (string)$existing->redistribute; + } + } + + foreach ($redistributeValues as $value) { + $value = trim($value); + if (empty($value) || in_array($value, $existingRedistributions, true)) { + continue; + } + + // Create a new redistribution entry + $redistributionNode = $redistributions->add(); + $redistributionNode->enabled = '1'; + $redistributionNode->description = "Migrated route redistribution ($protocol)"; + $redistributionNode->redistribute = $value; + $redistributionNode->linkedRoutemap = !empty($redistributemap) ? $redistributemap : ''; + } + } + + // Model is saved by 'run_migrations.php' +} diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF.xml index 755d553c7..1fa0885e6 100644 --- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF.xml +++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF.xml @@ -1,7 +1,7 @@ //OPNsense/quagga/ospf OSPF Routing configuration - 1.0.5 + 1.1.0 0 @@ -49,31 +49,6 @@ /^(?!0).*$/ - - N - Y - - - Border Gateway Protocol (BGP) - Connected routes (directly attached subnet or host) - Kernel routes (not installed via the zebra RIB) - Routing Information Protocol (RIP) - Statically configured routes - - - - - - - Related Route-Map item not found - N - N - @@ -311,5 +286,36 @@ + + + + 1 + Y + + + + Y + connected + + Open Shortest Path First (OSPF) + Connected routes (directly attached subnet or host) + Kernel routes (not installed via the zebra RIB) + Routing Information Protocol (RIP) + Statically configured routes + + + + + + + Related Route-Map item not found + + + diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF6.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF6.xml index 5bd6613ac..3e2675ece 100644 --- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF6.xml +++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/OSPF6.xml @@ -1,7 +1,7 @@ //OPNsense/quagga/ospf6 OSPFv3 Routing configuration - 1.0.4 + 1.1.0 0 @@ -11,25 +11,6 @@ 0 Y - - Y - - Connected routes (directly attached subnet or host) - Kernel routes (not installed via the zebra RIB) - Statically configured routes - - - - - - - Related Route-Map item not found - /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ @@ -224,5 +205,36 @@ + + + + 1 + Y + + + + Y + connected + + Open Shortest Path First (OSPF) + Connected routes (directly attached subnet or host) + Kernel routes (not installed via the zebra RIB) + Routing Information Protocol (RIP) + Statically configured routes + + + + + + + Related Route-Map item not found + + + diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt index a1835c598..04c561ca9 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt @@ -95,9 +95,42 @@ POSSIBILITY OF SUCH DAMAGE. 'del':'/api/quagga/bgp/delPeergroup/', 'toggle':'/api/quagga/bgp/togglePeergroup/' }); + $("#{{formGridEditRedistribution['table_id']}}").UIBootgrid({ + 'search':'/api/quagga/bgp/searchRedistribution', + 'get':'/api/quagga/bgp/getRedistribution/', + 'set':'/api/quagga/bgp/setRedistribution/', + 'add':'/api/quagga/bgp/addRedistribution/', + 'del':'/api/quagga/bgp/delRedistribution/', + 'toggle':'/api/quagga/bgp/toggleRedistribution/' + }); + + const $header = $(".bootgrid-header[id*='{{formGridEditRedistribution['table_id']}}']"); + if ($header.length) { + $header.find("div.actionBar").parent().prepend( + '' + + '' + + '{{ lang._("Route Redistribution") }}' + + '' + ); + } + }); + +