From bdf9379b22405946b281280796b39e75df6bc594 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 5 Jan 2025 23:23:24 +0100 Subject: [PATCH 01/50] security/acme-client: migrate cert+CA import/update to Trust MVC --- security/acme-client/pkg-descr | 2 + .../OPNsense/AcmeClient/LeCertificate.php | 171 ++++++++---------- .../library/OPNsense/AcmeClient/LeUtils.php | 82 +-------- .../scripts/OPNsense/AcmeClient/lecert.php | 3 +- .../OPNsense/AcmeClient/run_remote_ssh.php | 1 - .../OPNsense/AcmeClient/upload_sftp.php | 17 +- 6 files changed, 91 insertions(+), 185 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index ff97285f0..1536c9c9c 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -18,10 +18,12 @@ Added: Changed: * Convert Synology deploy hook variables to uppercase (#4286) +* Migrate to MVC Trust storage Fixed: * SFTP/SSH automation results in fatal PHP error (#4363) * Typo in INWX password field name +* Certs not fully functional after import into Trust storage (#4401) 4.6 diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php index 9df9e8808..9a5056fbe 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php @@ -1,7 +1,7 @@ cert_chain_file); if ($ca_content != false) { - $ca_subject = cert_get_subject($ca_content, false); - $ca_serial = cert_get_serial($ca_content, false); - $ca_cn = LeUtils::local_cert_get_cn($ca_content, false); - $ca_issuer = cert_get_issuer($ca_content, false); - $ca_purpose = cert_get_purpose($ca_content, false); + $ca_details = CertStore::parseX509($ca_content); + $ca_subject = $ca_details['name']; + $ca_serial = $ca_details['serialNumber']; + $ca_cn = $ca_details['commonname']; + $ca_issuer = implode(",", $ca_details['issuer']); } else { LeUtils::log_error('unable to read CA certificate content from file'); Config::getInstance()->unlock(); return false; } - // Prepare CA for import in Cert Manager + // Prepare CA + $caModel = new Ca(); $ca = array(); - $ca['crt'] = base64_encode($ca_content); $ca['refid'] = uniqid(); + $ca['descr'] = (string)$ca_cn . ' (ACME Client)'; $ca_found = false; // Check if CA was previously imported - foreach (Config::getInstance()->object()->ca as $cacrt) { - $cacrt_subject = cert_get_subject($cacrt->crt, true); - $cacrt_issuer = cert_get_issuer($cacrt->crt, true); + foreach ($caModel->ca->iterateItems() as $cacrt) { + $cacrt_content = base64_decode((string)$cacrt->crt); + $cacrt_details = CertStore::parseX509($cacrt_content); + $cacrt_subject = $cacrt_details['name']; + $cacrt_issuer = implode(",", $cacrt_details['issuer']); if (($ca_subject === $cacrt_subject) and ($ca_issuer === $cacrt_issuer)) { // Use old refid instead of generating a new one $ca['refid'] = (string)$cacrt->refid; + // Update existing CA + $cacrt->descr = $ca['descr']; $ca_found = true; break; } } - // Collect required CA information - $ca_cn = LeUtils::local_cert_get_cn($ca_content, false); - $ca['descr'] = (string)$ca_cn . ' (ACME Client)'; - - // Prepare CA for import - LeUtils::local_ca_import($ca, $ca_content); - - // Check if CA was found in config - if ($ca_found == true) { - // Update existing CA - foreach (Config::getInstance()->object()->ca as $cacrt) { - if ((string)$cacrt->refid == $ca['refid']) { - $cacrt->crt = $ca['crt']; - $cacrt->descr = $ca['descr']; - break; - } - } - } else { - // Create new CA - LeUtils::log("importing ACME CA: {$ca_cn}"); - $newca = Config::getInstance()->object()->addChild('ca'); + // Create new CA + if ($ca_found == false) { + LeUtils::log("imported ACME CA: {$ca_cn} ({$ca['refid']})"); + $newca = $caModel->ca->Add(); foreach (array_keys($ca) as $cacfg) { - $newca->addChild($cacfg, (string)$ca[$cacfg]); + $newca->$cacfg = (string)$ca[$cacfg]; } + $newca->crt = base64_encode($ca_content); } + // Serialize to config and save + $caModel->serializeToConfig(); + Config::getInstance()->save(); + /** * Step 2: import certificate */ @@ -205,11 +200,11 @@ class LeCertificate extends LeCommon // Read contents from certificate file $cert_content = @file_get_contents($this->cert_file); if ($cert_content != false) { - $cert_subject = cert_get_subject($cert_content, false); - $cert_serial = cert_get_serial($cert_content, false); - $cert_cn = LeUtils::local_cert_get_cn($cert_content, false); - $cert_issuer = cert_get_issuer($cert_content, false); - $cert_purpose = cert_get_purpose($cert_content, false); + $cert_details = CertStore::parseX509($cert_content); + $cert_subject = $cert_details['name']; + $cert_serial = $cert_details['serialNumber']; + $cert_cn = $cert_details['commonname']; + $cert_issuer = implode(",", $cert_details['issuer']); } else { LeUtils::log_error('unable to read certificate content from file'); Config::getInstance()->unlock(); @@ -217,34 +212,6 @@ class LeCertificate extends LeCommon return false; } - // Prepare certificate for import in Cert Manager - $cert = array(); - $cert_refid = uniqid(); - $cert['refid'] = $cert_refid; - $cert['caref'] = (string)$ca['refid']; - $import_log_message = 'imported'; - $cert_found = false; - - // Check if cert was previously imported - if (!empty((string)$this->config->certRefId)) { - // Check if the previously imported certificate can still be found - foreach (Config::getInstance()->object()->cert as $cfgCert) { - // Check if IDs match - if ((string)$this->config->certRefId == (string)$cfgCert->refid) { - $cert_found = true; - break; - } - } - // Existing cert? - if ($cert_found) { - // Use old refid instead of generating a new one - $cert_refid = (string)$this->config->certRefId; - $import_log_message = 'updated'; - } - } else { - // Not found. Just import as new cert. - } - // Read private key $key_content = @file_get_contents($this->cert_key_file); if ($key_content == false) { @@ -254,28 +221,39 @@ class LeCertificate extends LeCommon return false; } - // Collect required cert information - $cert_cn = LeUtils::local_cert_get_cn($cert_content, false); - $cert['descr'] = (string)$cert_cn . ' (ACME Client)'; - $cert['refid'] = $cert_refid; - - // Prepare certificate for import - cert_import($cert, $cert_content, $key_content); - - // Overwrite caref in order to use the correct CA (GH #2550). - // This is required because cert_import() uses lookup_ca_by_subject() - // to find a matching CA. If multiple CAs are using the same name, the - // first CA wins, but it may still be the wrong CA. + // Prepare certificate + $certModel = new Cert(); + $cert = array(); + $cert['refid'] = uniqid(); $cert['caref'] = (string)$ca['refid']; + $cert['descr'] = (string)$cert_cn . ' (ACME Client)'; + $import_log_message = 'imported'; + $cert_found = false; + + // Check if cert was previously imported. + // Otherwise just import as new cert. + if (!empty((string)$this->config->certRefId)) { + // Check if the previously imported certificate can still be found + foreach ($certModel->cert->iterateItems() as $cfgCert) { + // Check if IDs match + if ((string)$this->config->certRefId == (string)$cfgCert->refid) { + // Use old refid instead of generating a new one + $cert['refid'] = (string)$cfgCert->refid; + $import_log_message = 'updated'; + $cert_found = true; + break; + } + } + } // Check if cert was found in config if ($cert_found == true) { // Update existing cert - foreach (Config::getInstance()->object()->cert as $cfgCert) { + foreach ($certModel->cert->iterateItems() as $cfgCert) { if ((string)$cfgCert->refid == $cert['refid']) { - $cfgCert->crt = $cert['crt']; - $cfgCert->prv = $cert['prv']; $cfgCert->descr = $cert['descr']; + $cfgCert->crt = base64_encode($cert_content); + $cfgCert->prv = base64_encode($key_content); // Update CA ref, because it may be signed by a different CA. $cfgCert->caref = $cert['caref']; break; @@ -283,27 +261,32 @@ class LeCertificate extends LeCommon } } else { // Create new cert - $newcert = Config::getInstance()->object()->addChild('cert'); + $newcert = $certModel->cert->Add(); foreach (array_keys($cert) as $certcfg) { - $newcert->addChild($certcfg, (string)$cert[$certcfg]); + $newcert->$certcfg = (string)$cert[$certcfg]; } + $newcert->crt = base64_encode($cert_content); + $newcert->prv = base64_encode($key_content); } - LeUtils::log("{$import_log_message} ACME X.509 certificate: {$cert_cn}"); + LeUtils::log("{$import_log_message} ACME X.509 certificate: {$cert_cn} ({$cert['refid']})"); + + // Serialize to config and save + // Skip validation because the current in-memory model may not + // know about the CA item that was just created. + $certModel->serializeToConfig(false,true); + Config::getInstance()->save(); /** * Step 3: update configuration */ - // Add refid to certObj - $this->config->certRefId = $cert_refid; - // Set update/create time + // Update Acme cert config + $this->config->certRefId = $cert['refid']; $this->config->lastUpdate = time(); // Serialize to config and save $this->model->serializeToConfig(); Config::getInstance()->save(); - - // Reload to get most recent config Config::getInstance()->forceReload(); $this->loadConfig(self::CONFIG_PATH, $this->uuid); @@ -402,12 +385,12 @@ class LeCertificate extends LeCommon return false; } - // Run referenced automations. - $this->runAutomations(); - // Update cert status. $this->setStatus(200); + // Run referenced automations. + $this->runAutomations(); + return true; } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php index 7514ed656..6dfd33eff 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php @@ -1,7 +1,7 @@ * Copyright (C) 2008 Shrew Soft Inc. @@ -70,86 +70,6 @@ class LeUtils return vsprintf($format, $args); } - // Copied from system_camanager.php. - public static function local_ca_import(&$ca, $str, $key = "", $serial = 0) - { - // Get config object. - $config = Config::getInstance()->object(); - - $ca['crt'] = base64_encode($str); - if (!empty($key)) { - $ca['prv'] = base64_encode($key); - } - if (!empty($serial)) { - $ca['serial'] = $serial; - } - $subject = cert_get_subject($str, false); - $issuer = cert_get_issuer($str, false); - - // Find my issuer unless self-signed - if ($issuer != $subject) { - $issuer_crt =& lookup_ca_by_subject($issuer); - if ($issuer_crt) { - $ca['caref'] = $issuer_crt['refid']; - } - } - - /* Correct if child certificate was loaded first */ - if (is_array($config['ca'])) { - foreach ($config['ca'] as & $oca) { - $issuer = cert_get_issuer($oca['crt']); - if ($ca['refid'] != $oca['refid'] && $issuer == $subject) { - $oca['caref'] = $ca['refid']; - } - } - } - if (is_array($config['cert'])) { - foreach ($config['cert'] as & $cert) { - $issuer = cert_get_issuer($cert['crt']); - if ($issuer == $subject) { - $cert['caref'] = $ca['refid']; - } - } - } - return true; - } - - // copied from certs.inc - public static function local_cert_get_cn($crt, $decode = true) - { - $sub = self::local_cert_get_subject_array($crt, $decode); - if (is_array($sub)) { - foreach ($sub as $s) { - if (strtoupper($s['a']) == "CN") { - return $s['v']; - } - } - } - return ""; - } - - // copied from certs.inc - public static function local_cert_get_subject_array($str_crt, $decode = true) - { - if ($decode) { - $str_crt = base64_decode($str_crt); - } - $inf_crt = openssl_x509_parse($str_crt); - $components = $inf_crt['subject']; - - if (!is_array($components)) { - return; - } - - $subject_array = array(); - - foreach ($components as $a => $v) { - $subject_array[] = array('a' => $a, 'v' => $v); - } - - return $subject_array; - } - /** * log runtime information */ diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php index 73bb87ee2..0079a3a8f 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php @@ -2,7 +2,7 @@ object(); - foreach ($config->cert as $cert) { + $certModel = new Cert(); + foreach ($certModel->cert->iterateItems() as $cert) { $refid = (string)$cert->refid; $item = []; if (in_array($refid, $cert_refids)) { - $item["cert"] = str_replace(["\n\n", "\r"], ["\n", ""], base64_decode($cert->crt)); - $item["key"] = str_replace(["\n\n", "\r"], ["\n", ""], base64_decode($cert->prv)); + $_tmp = CertStore::getCertificate($refid); + $item["cert"] = $_tmp["crt"]; + $item["key"] = $_tmp["prv"]; // check if a CA is linked if (!empty((string)$cert->caref)) { - $cert = (array)$cert; - $item["ca"] = ca_chain($cert); + $item["ca"] = $_tmp["ca"];; // combine files to export a fullchain.pem $item["fullchain"] = $item["cert"] . $item["ca"]; } From 4f44f8337bf36b6247c48084f8460852d94126d2 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Tue, 7 Jan 2025 17:05:22 +0100 Subject: [PATCH 02/50] www/caddy: Some small UX tweaks (#4442) * www/caddy: Remove HTTP from terminology. It was added when Layer4 Proxy was still in the same tabs to distinguish the HTTP Proxy from the Layer4 Proxy. Now that everything has its own pages it improves readability and follows the caddy syntax more closely. * www/caddy: Do not auto hide the access settings, its annoying * www/caddy: Remove hints that are no real defaults or can change dynamically depending on configuration. --- .../OPNsense/Caddy/forms/dialogHandle.xml | 2 -- .../Caddy/forms/dialogReverseProxy.xml | 3 --- .../OPNsense/Caddy/forms/dialogSubdomain.xml | 1 - .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 2 +- .../views/OPNsense/Caddy/reverse_proxy.volt | 18 +++++++++--------- 5 files changed, 10 insertions(+), 16 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml index 3ada90d0b..7ece8310a 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml @@ -119,14 +119,12 @@ select_multiple true - 192.168.1.1 handle.ToPort text - 80 diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml index 522c916d4..014e1853e 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml @@ -25,14 +25,12 @@ reverse.FromDomain text - example.com reverse.FromPort text - 443 @@ -65,7 +63,6 @@ header - true reverse.accesslist diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml index 8711c4a96..8a515e2ca 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml @@ -44,7 +44,6 @@ header - true subdomain.accesslist diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index f7da86b03..920f2cac2 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -206,7 +206,7 @@ - ACME (HTTP-01, TLS-ALPN-01) + ACME diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index 42036d604..b77bf8618 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -226,7 +226,7 @@ toggleVisibility(currentTab); }); - // Add click event listener for "Add HTTP Handler" button + // Add click event listener for "Add Handler" button $("#addHandleBtn").on("click", function() { if ($('#maintabs .active a').attr('href') === "#handlesTab") { $("#addReverseHandleBtn").click(); @@ -317,9 +317,9 @@
@@ -328,7 +328,7 @@
- +
@@ -418,7 +418,7 @@
-

{{ lang._('HTTP Handlers') }}

+

{{ lang._('Handlers') }}

@@ -538,7 +538,7 @@
-

{{ lang._('HTTP Headers') }}

+

{{ lang._('Headers') }}

@@ -593,7 +593,7 @@ {{ partial("layout_partials/base_dialog",['fields':formDialogReverseProxy,'id':'DialogReverseProxy','label':lang._('Edit Domain')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogSubdomain,'id':'DialogSubdomain','label':lang._('Edit Subdomain')])}} -{{ partial("layout_partials/base_dialog",['fields':formDialogHandle,'id':'DialogHandle','label':lang._('Edit HTTP Handler')])}} +{{ partial("layout_partials/base_dialog",['fields':formDialogHandle,'id':'DialogHandle','label':lang._('Edit Handler')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogAccessList,'id':'DialogAccessList','label':lang._('Edit Access List')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogBasicAuth,'id':'DialogBasicAuth','label':lang._('Edit Basic Auth')])}} -{{ partial("layout_partials/base_dialog",['fields':formDialogHeader,'id':'DialogHeader','label':lang._('Edit HTTP Header')])}} +{{ partial("layout_partials/base_dialog",['fields':formDialogHeader,'id':'DialogHeader','label':lang._('Edit Header')])}} From d5b7c364c788d0638a56c367dce9f18ac1a1bfb0 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Tue, 7 Jan 2025 17:05:50 +0100 Subject: [PATCH 03/50] www/caddy: Mark DNS Providers optional that are not included per default (#4441) * www/caddy: Mark DNS Providers optional that are not included in the shipped binary per default. These modules must be added on demand on the command line with caddy add-package. This lowers maintainance burden and deflates the binary of big unused structs and sdks, since providers like route53 or googleclouddns alone pull around 16MB into the binary. Remove duplicate Netcup. * www/caddy: Make API Fields for DNS Providers clearer --- .../OPNsense/Caddy/forms/general.xml | 23 +++++++++---------- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 23 +++++++++---------- 2 files changed, 22 insertions(+), 24 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 10976f164..488c9aeb2 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -98,46 +98,45 @@ caddy.general.TlsDnsProviderdropdown - + + + + header + caddy.general.TlsDnsApiKey - + text - - header - - true - caddy.general.TlsDnsSecretApiKey - + text caddy.general.TlsDnsOptionalField1 - + text caddy.general.TlsDnsOptionalField2 - + text caddy.general.TlsDnsOptionalField3 - + text caddy.general.TlsDnsOptionalField4 - + text diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 920f2cac2..5fd4bf000 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -26,42 +26,41 @@ Cloudflare Duck DNS - DigitalOcean Gandi IONOS Desec Porkbun - Route53 ACME-DNS - Google Cloud DNS Azure OVH Namecheap - Netlify PowerDNS - DDNSS - Njalla Linode - Tencent Cloud - Dinahosting Hexonet Mail-in-a-Box - Netcup RFC2136 DNS Made Easy Bunny - Civo Scaleway ACME Proxy INWX Netcup Name.com - EasyDNS Infomaniak DirectAdmin - Hosttech Vultr Hetzner + DigitalOcean (optional) + Route53 (optional) + Google Cloud DNS (optional) + Netlify (optional) + DDNSS (optional) + Njalla (optional) + Tencent Cloud (optional) + Dinahosting (optional) + Civo (optional) + EasyDNS (optional) + Hosttech (optional) From ed4c9a345b8d933f2b4fb9983631b23d7f16b63b Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Tue, 7 Jan 2025 17:06:43 +0100 Subject: [PATCH 04/50] www/caddy: Add syslog function; change visible name to Caddy (#4439) * www/caddy: Add syslog function * www/caddy: Bump version * www/caddy: Add changelog, make sweep * www/caddy: Change visible name from Caddy Web Server to Caddy * www/caddy: Update changelog again * www/caddy: Reduce diff in caddy.inc --- www/caddy/Makefile | 2 +- www/caddy/pkg-descr | 10 ++++++++++ www/caddy/src/etc/inc/plugins.inc.d/caddy.inc | 11 ++++++++--- .../mvc/app/models/OPNsense/Caddy/Menu/Menu.xml | 2 +- 4 files changed, 20 insertions(+), 5 deletions(-) diff --git a/www/caddy/Makefile b/www/caddy/Makefile index f5a01d871..4264cd9b0 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.7.6 +PLUGIN_VERSION= 1.8.0 PLUGIN_DEPENDS= caddy-custom PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing PLUGIN_MAINTAINER= cedrik@pischem.com diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index 2ec24cd5e..f7217f7f6 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -13,6 +13,16 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html Plugin Changelog ================ +1.8.0 + +* Build: Update to caddy-v2.9.0 and update dependencies (opnsense/plugins/issues/4437) +* Build: Fix caddy-l4 timeout issue (opnsense/plugins/issues/4384) +* Build: Mark DNS Providers optional that are not included per default (opnsense/plugins/pull/4441) + digitalocean, route53, googleclouddns, netlify, ddnss, njalla, tencentcloud + dinahosting, civo, easydns, hosttech; must be added via https://caddyserver.com/docs/command-line#caddy-add-package +* Cleanup: Refactor caddy.inc and add syslog function, change name from Caddy Web Server to Caddy (opnsense/plugins/issues/4426) +* Cleanup: Some small UI tweaks (opnsense/plugins/pull/4442) + 1.7.6 * Fix: Web UI can still restart/stop Caddy when running as `www` user (opnsense/plugins/pull/4403) diff --git a/www/caddy/src/etc/inc/plugins.inc.d/caddy.inc b/www/caddy/src/etc/inc/plugins.inc.d/caddy.inc index 78da119b7..5e116933a 100644 --- a/www/caddy/src/etc/inc/plugins.inc.d/caddy.inc +++ b/www/caddy/src/etc/inc/plugins.inc.d/caddy.inc @@ -1,7 +1,7 @@ gettext('Caddy Web Server'), + 'description' => gettext('Caddy'), 'configd' => array( 'restart' => array('caddy restart'), 'start' => array('caddy start'), @@ -56,7 +56,7 @@ function caddy_xmlrpc_sync() $result = array(); $result[] = array( - 'description' => gettext('Caddy Web Server'), + 'description' => gettext('Caddy'), 'section' => 'Pischem.caddy', 'id' => 'caddy', 'services' => ["caddy"], @@ -64,3 +64,8 @@ function caddy_xmlrpc_sync() return $result; } + +function caddy_syslog() +{ + return ['caddy' => ['facility' => ['caddy']]]; +} diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Menu/Menu.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Menu/Menu.xml index 0a992a746..421560b53 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Menu/Menu.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Menu/Menu.xml @@ -1,6 +1,6 @@ - + From 5816a723324e344a6fdf1bdab2fc93f74763c92e Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 8 Jan 2025 08:08:11 +0100 Subject: [PATCH 05/50] security/acme-client: style sweep --- .../mvc/app/library/OPNsense/AcmeClient/LeCertificate.php | 2 +- .../src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php index 9a5056fbe..518a2c0f7 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php @@ -273,7 +273,7 @@ class LeCertificate extends LeCommon // Serialize to config and save // Skip validation because the current in-memory model may not // know about the CA item that was just created. - $certModel->serializeToConfig(false,true); + $certModel->serializeToConfig(false, true); Config::getInstance()->save(); /** diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php index 40db45dbe..f5e00cc85 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php @@ -532,7 +532,8 @@ function exportCertificates(array $cert_refids): array $item["key"] = $_tmp["prv"]; // check if a CA is linked if (!empty((string)$cert->caref)) { - $item["ca"] = $_tmp["ca"];; + $item['ca'] = $_tmp['ca']; + // combine files to export a fullchain.pem $item["fullchain"] = $item["cert"] . $item["ca"]; } From fc23b6a7003af8b525b640d9d64fa64426d88267 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Wed, 8 Jan 2025 09:18:03 +0100 Subject: [PATCH 06/50] net/frr - style cleanup and unify forms (#4450) * net/frr - style cleanup and unify forms Apply frontend / api changes to align more with current core patterns. * net/frr - change maintainer to core --- net/frr/Makefile | 2 +- .../OPNsense/Quagga/Api/BfdController.php | 10 +- .../OPNsense/Quagga/Api/GeneralController.php | 46 +--- .../Quagga/Api/OspfsettingsController.php | 13 +- .../OPNsense/Quagga/Api/ServiceController.php | 119 +-------- .../mvc/app/views/OPNsense/Quagga/bfd.volt | 108 ++++---- .../mvc/app/views/OPNsense/Quagga/bgp.volt | 235 ++++++++---------- .../app/views/OPNsense/Quagga/general.volt | 51 ++-- .../mvc/app/views/OPNsense/Quagga/ospf.volt | 210 ++++++++-------- .../mvc/app/views/OPNsense/Quagga/ospf6.volt | 59 ++--- .../mvc/app/views/OPNsense/Quagga/rip.volt | 62 +++-- 11 files changed, 367 insertions(+), 548 deletions(-) diff --git a/net/frr/Makefile b/net/frr/Makefile index 30b45d27b..d8e07f27a 100644 --- a/net/frr/Makefile +++ b/net/frr/Makefile @@ -2,7 +2,7 @@ PLUGIN_NAME= frr PLUGIN_VERSION= 1.42 PLUGIN_COMMENT= The FRRouting Protocol Suite PLUGIN_DEPENDS= frr8 -PLUGIN_MAINTAINER= franz.fabian.94@gmail.com +PLUGIN_MAINTAINER= ad@opnsense.org PLUGIN_TIER= 2 .include "../../Mk/plugins.mk" diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BfdController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BfdController.php index 4904f54c0..76fe62f70 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BfdController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/BfdController.php @@ -1,7 +1,7 @@ * All rights reserved. @@ -39,17 +39,11 @@ class BfdController extends ApiMutableModelControllerBase public function searchNeighborAction() { - return $this->searchBase( - 'neighbors.neighbor', - array("enabled", - "description", - "address") - ); + return $this->searchBase('neighbors.neighbor'); } public function getNeighborAction($uuid = null) { - $this->sessionClose(); return $this->getBase('neighbor', 'neighbors.neighbor', $uuid); } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/GeneralController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/GeneralController.php index e27efec61..d8e615d6a 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/GeneralController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/GeneralController.php @@ -1,7 +1,7 @@ request->isGet()) { - $mdlGeneral = new General(); - $result['general'] = $mdlGeneral->getNodes(); - } - return $result; - } - public function setAction() - { - $result = array("result" => "failed"); - if ($this->request->isPost()) { - // load model and update with provided data - $mdlGeneral = new General(); - $mdlGeneral->setNodes($this->request->getPost("general")); - - // perform validation - $valMsgs = $mdlGeneral->performValidation(); - foreach ($valMsgs as $field => $msg) { - if (!array_key_exists("validations", $result)) { - $result["validations"] = array(); - } - $result["validations"]["general." . $msg->getField()] = $msg->getMessage(); - } - - // serialize model to config and save - if ($valMsgs->count() == 0) { - $mdlGeneral->serializeToConfig(); - Config::getInstance()->save(); - $result["result"] = "saved"; - } - } - return $result; - } + protected static $internalModelName = 'general'; + protected static $internalModelClass = '\OPNsense\Quagga\General'; } diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php index ae4c6b128..cb495c1c2 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/OspfsettingsController.php @@ -1,6 +1,7 @@ * All rights reserved. @@ -38,38 +39,34 @@ class OspfsettingsController extends ApiMutableModelControllerBase public function searchNetworkAction() { - return $this->searchBase('networks.network', array("enabled", "ipaddr", "netmask", "area")); + return $this->searchBase('networks.network'); } public function searchInterfaceAction() { - return $this->searchBase('interfaces.interface', array("enabled", "interfacename", "networktype", "authtype", "area")); + return $this->searchBase('interfaces.interface'); } public function searchPrefixlistAction() { - return $this->searchBase('prefixlists.prefixlist', array("enabled", "name", "seqnumber", "action", "network" )); + return $this->searchBase('prefixlists.prefixlist'); } public function searchRoutemapAction() { - return $this->searchBase('routemaps.routemap', array("enabled", "name", "action", "id", "match2", "set")); + return $this->searchBase('routemaps.routemap'); } public function getNetworkAction($uuid = null) { - $this->sessionClose(); return $this->getBase('network', 'networks.network', $uuid); } public function getInterfaceAction($uuid = null) { - $this->sessionClose(); return $this->getBase('interface', 'interfaces.interface', $uuid); } public function getPrefixlistAction($uuid = null) { - $this->sessionClose(); return $this->getBase('prefixlist', 'prefixlists.prefixlist', $uuid); } public function getRoutemapAction($uuid = null) { - $this->sessionClose(); return $this->getBase('routemap', 'routemaps.routemap', $uuid); } public function addNetworkAction() diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php index a9935cfb5..c62632492 100644 --- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php +++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/Api/ServiceController.php @@ -1,7 +1,7 @@ request->isPost()) { - $backend = new Backend(); - $response = $backend->configdRun('quagga start'); - $backend->configdRun('filter reload'); - return array('response' => $response); - } else { - return array('response' => array()); - } - } - - /** - * stop quagga service - * @return array - */ - public function stopAction() - { - if ($this->request->isPost()) { - $backend = new Backend(); - $response = $backend->configdRun('quagga stop'); - return array('response' => $response); - } else { - return array('response' => array()); - } - } - - /** - * restart quagga service - * @return array - */ - public function restartAction() - { - if ($this->request->isPost()) { - $backend = new Backend(); - $response = $backend->configdRun('quagga restart'); - $backend->configdRun('filter reload'); - return array('response' => $response); - } else { - return array('response' => array()); - } - } - - /** - * retrieve status of quagga - * @return array - * @throws \Exception - */ - public function statusAction() - { - $backend = new Backend(); - $mdlGeneral = new General(); - $response = $backend->configdRun('quagga status'); - - if (strpos($response, 'not running') > 0) { - if ($mdlGeneral->enabled->__toString() == 1) { - $status = 'stopped'; - } else { - $status = 'disabled'; - } - } elseif (strpos($response, 'is running') > 0) { - $status = 'running'; - } elseif ($mdlGeneral->enabled->__toString() == 0) { - $status = 'disabled'; - } else { - $status = 'unknown'; - } - - - return array('status' => $status); - } - - /** - * reconfigure quagga, generate config and reload - */ - public function reconfigureAction() - { - if ($this->request->isPost()) { - // close session for long running action - $this->sessionClose(); - - $mdlGeneral = new General(); - $backend = new Backend(); - - $runStatus = $this->statusAction(); - - // stop quagga if it is running or not - $this->stopAction(); - - // generate template - $backend->configdRun('template reload OPNsense/Quagga'); - - // (res)start daemon - if ($mdlGeneral->enabled->__toString() == 1) { - $this->startAction(); - } - - return array('status' => 'ok'); - } else { - return array('status' => 'failed'); - } - } + protected static $internalServiceClass = '\OPNsense\Quagga\General'; + protected static $internalServiceTemplate = 'OPNsense/Quagga'; + protected static $internalServiceEnabled = 'enabled'; + protected static $internalServiceName = 'quagga'; } diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt index 3c56ad63e..4510e23ce 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bfd.volt @@ -1,6 +1,6 @@ {# -OPNsense® is Copyright © 2014 – 2017 by Deciso B.V. +OPNsense® is Copyright © 2014 – 2025 by Deciso B.V. Copyright (C) 2017 Fabian Franz Copyright (C) 2017 - 2021 Michael Muenz All rights reserved. @@ -27,20 +27,46 @@ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #} + + + +
-
- {{ partial("layout_partials/base_form",['fields':bfdForm,'id':'frm_bfd_settings'])}} -
-
- -
-
+ {{ partial("layout_partials/base_form",['fields':bfdForm,'id':'frm_bfd_settings'])}}
@@ -57,10 +83,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -68,51 +94,19 @@ POSSIBILITY OF SUCH DAMAGE. - +
+
+
+
+ +

+
+
+
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBFDNeighbor,'id':'DialogEditBFDNeighbor','label':lang._('Edit Neighbor')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt index 82e62cfe6..b8385d546 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/bgp.volt @@ -1,6 +1,6 @@ {# -OPNsense® is Copyright © 2014 – 2024 by Deciso B.V. +OPNsense® is Copyright © 2014 – 2025 by Deciso B.V. Copyright (C) 2017 Fabian Franz Copyright (C) 2017 - 2020 Michael Muenz All rights reserved. @@ -27,6 +27,77 @@ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #} + + + - - + @@ -94,11 +160,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -122,11 +187,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -150,11 +214,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -181,10 +244,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -210,10 +273,10 @@ POSSIBILITY OF SUCH DAMAGE. - - + @@ -221,102 +284,20 @@ POSSIBILITY OF SUCH DAMAGE. - +
+
+
+
+ +

+
+
+
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBGPNeighbor,'id':'DialogEditBGPNeighbor','label':lang._('Edit Neighbor')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditBGPASPaths,'id':'DialogEditBGPASPaths','label':lang._('Edit AS Paths')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt index 01e1746bd..aacb7d557 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/general.volt @@ -1,6 +1,6 @@ {# -OPNsense® is Copyright © 2014 – 2017 by Deciso B.V. +OPNsense® is Copyright © 2014 – 2025 by Deciso B.V. This file is Copyright © 2017 by Fabian Franz All rights reserved. @@ -26,32 +26,43 @@ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #} -
- {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_general_settings'])}} -
-
- -
-
+ +
+ {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_general_settings'])}} +
+ +
+
+
+
+ +

+
+
+
diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt index b68db50c8..9daaa0e14 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf.volt @@ -1,6 +1,6 @@ {# -OPNsense® is Copyright © 2014 – 2017 by Deciso B.V. +OPNsense® is Copyright © 2014 – 2025 by Deciso B.V. This file is Copyright © 2017 by Fabian Franz All rights reserved. @@ -27,25 +27,78 @@ POSSIBILITY OF SUCH DAMAGE. #} - - -
-
-
- {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_ospf_settings'])}} -
-
- -
-
-
+ + + + +
+ +
+ {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_ospf_settings'])}} +
+ - +
+ - - +
- - - + + +
- - - + + +
- - - + + +
- - + + +
+ - +
@@ -63,17 +116,15 @@ POSSIBILITY OF SUCH DAMAGE. - +
- - - + +
-
@@ -85,22 +136,22 @@ POSSIBILITY OF SUCH DAMAGE. - + - +
{{ lang._('Authentication Type') }} {{ lang._('ID') }} {{ lang._('Commands') }}
- - +
+
@@ -118,16 +169,16 @@ POSSIBILITY OF SUCH DAMAGE. - +
- - +
+
@@ -146,95 +197,30 @@ POSSIBILITY OF SUCH DAMAGE. - +
- +
+
+ +
+
+
+ +
- - +
{{ partial("layout_partials/base_dialog",['fields':formDialogEditNetwork,'id':'DialogEditNetwork','label':lang._('Edit Network')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogEditInterface,'id':'DialogEditInterface','label':lang._('Edit Interface')])}} diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt index 3a4774436..d0749ac7c 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/ospf6.volt @@ -1,5 +1,5 @@ {# - # Copyright (c) 2014-2024 Deciso B.V. + # Copyright (c) 2014-2025 Deciso B.V. # Copyright (c) 2017 Fabian Franz # Copyright (c) 2017 Michael Muenz # All rights reserved. @@ -32,18 +32,17 @@ mapDataToFormUI({'frm_ospf6_settings':"/api/quagga/ospf6settings/get"}).done(function(data){ formatTokenizersUI(); $('.selectpicker').selectpicker('refresh'); + updateServiceControlUI('quagga'); }); - updateServiceControlUI('quagga'); - - // link save button to API set action - $("#saveAct").SimpleActionButton({ + $("#reconfigureAct").SimpleActionButton({ onPreAction: function() { const dfObj = new $.Deferred(); - saveFormToEndpoint("/api/quagga/ospf6settings/set", 'frm_ospf6_settings', function(){ - dfObj.resolve(); - }); + saveFormToEndpoint("/api/quagga/ospf6settings/set", 'frm_ospf6_settings', function () { dfObj.resolve(); }, true, function () { dfObj.reject(); }); return dfObj; + }, + onAction: function(data, status) { + updateServiceControlUI('quagga'); } }); @@ -53,11 +52,7 @@ 'set':'/api/quagga/ospf6settings/setNetwork/', 'add':'/api/quagga/ospf6settings/addNetwork/', 'del':'/api/quagga/ospf6settings/delNetwork/', - 'toggle':'/api/quagga/ospf6settings/toggleNetwork/', - 'options':{ - selection:false, - multiSelect:false - } + 'toggle':'/api/quagga/ospf6settings/toggleNetwork/' }); $("#grid-interfaces").UIBootgrid({ 'search':'/api/quagga/ospf6settings/searchInterface', @@ -65,11 +60,7 @@ 'set':'/api/quagga/ospf6settings/setInterface/', 'add':'/api/quagga/ospf6settings/addInterface/', 'del':'/api/quagga/ospf6settings/delInterface/', - 'toggle':'/api/quagga/ospf6settings/toggleInterface/', - 'options':{ - selection:false, - multiSelect:false - } + 'toggle':'/api/quagga/ospf6settings/toggleInterface/' }); $("#grid-prefixlists").UIBootgrid({ 'search':'/api/quagga/ospf6settings/searchPrefixlist', @@ -77,11 +68,7 @@ 'set':'/api/quagga/ospf6settings/setPrefixlist/', 'add':'/api/quagga/ospf6settings/addPrefixlist/', 'del':'/api/quagga/ospf6settings/delPrefixlist/', - 'toggle':'/api/quagga/ospf6settings/togglePrefixlist/', - 'options':{ - selection:false, - multiSelect:false - } + 'toggle':'/api/quagga/ospf6settings/togglePrefixlist/' }); $("#grid-routemaps").UIBootgrid({ 'search':'/api/quagga/ospf6settings/searchRoutemap', @@ -89,11 +76,7 @@ 'set':'/api/quagga/ospf6settings/setRoutemap/', 'add':'/api/quagga/ospf6settings/addRoutemap/', 'del':'/api/quagga/ospf6settings/delRoutemap/', - 'toggle':'/api/quagga/ospf6settings/toggleRoutemap/', - 'options':{ - selection:false, - multiSelect:false - } + 'toggle':'/api/quagga/ospf6settings/toggleRoutemap/' }); // hook checkbox item with conditional options @@ -142,10 +125,11 @@ - - - - + + + + + @@ -168,9 +152,10 @@ - + + @@ -195,9 +180,10 @@ - + + @@ -223,9 +209,10 @@ - + + @@ -236,7 +223,7 @@
- -
- From a4b774a9e4cef178b91d901d5baf50eaee8118c4 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 8 Jan 2025 09:25:48 +0100 Subject: [PATCH 07/50] net/frr: glint and rev bump --- net/frr/Makefile | 1 + net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/net/frr/Makefile b/net/frr/Makefile index d8e07f27a..a3813aca2 100644 --- a/net/frr/Makefile +++ b/net/frr/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= frr PLUGIN_VERSION= 1.42 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= The FRRouting Protocol Suite PLUGIN_DEPENDS= frr8 PLUGIN_MAINTAINER= ad@opnsense.org diff --git a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt index b0b7effca..6e1c01c4c 100644 --- a/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt +++ b/net/frr/src/opnsense/mvc/app/views/OPNsense/Quagga/rip.volt @@ -66,4 +66,3 @@ POSSIBILITY OF SUCH DAMAGE.
- From 898100b9a60cd1a8bf8f64a4b35cc1056a14ea60 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 8 Jan 2025 09:29:42 +0100 Subject: [PATCH 08/50] www/c-icap: bump rev --- www/c-icap/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/c-icap/Makefile b/www/c-icap/Makefile index 575fb3e90..90a88fdf1 100644 --- a/www/c-icap/Makefile +++ b/www/c-icap/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= c-icap PLUGIN_VERSION= 1.7 -PLUGIN_REVISION= 4 +PLUGIN_REVISION= 5 PLUGIN_COMMENT= c-icap connects the web proxy with a virus scanner PLUGIN_DEPENDS= c-icap c-icap-modules PLUGIN_MAINTAINER= m.muenz@gmail.com From 04fb480492f1b33c2cf98a829dbce1b3aafab6df Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Wed, 8 Jan 2025 09:31:02 +0100 Subject: [PATCH 09/50] security/clamav: rev bump --- security/clamav/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/clamav/Makefile b/security/clamav/Makefile index afe24b92e..f4d90f209 100644 --- a/security/clamav/Makefile +++ b/security/clamav/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= clamav PLUGIN_VERSION= 1.8 -PLUGIN_REVISION= 1 +PLUGIN_REVISION= 2 PLUGIN_COMMENT= Antivirus engine for detecting malicious threats PLUGIN_DEPENDS= clamav PLUGIN_MAINTAINER= m.muenz@gmail.com From dbe43dc186578da25d441e2dc8cb1b410c5d1131 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Fri, 10 Jan 2025 09:30:22 +0100 Subject: [PATCH 10/50] www/caddy: Implement reusable grid template (#4454) See: https://github.com/opnsense/core/commit/a7a99fcdfe972dacc1a6beada7607e73a1689d05 --- .../OPNsense/Caddy/Layer4Controller.php | 10 +- .../OPNsense/Caddy/ReverseProxyController.php | 15 +- .../OPNsense/Caddy/forms/dialogAccessList.xml | 10 + .../OPNsense/Caddy/forms/dialogHandle.xml | 74 ++++++ .../OPNsense/Caddy/forms/dialogHeader.xml | 6 + .../OPNsense/Caddy/forms/dialogLayer4.xml | 42 ++++ .../Caddy/forms/dialogLayer4Openvpn.xml | 3 + .../Caddy/forms/dialogReverseProxy.xml | 32 +++ .../OPNsense/Caddy/forms/dialogSubdomain.xml | 19 ++ .../mvc/app/views/OPNsense/Caddy/layer4.volt | 72 +----- .../views/OPNsense/Caddy/reverse_proxy.volt | 228 +++--------------- 11 files changed, 243 insertions(+), 268 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Layer4Controller.php b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Layer4Controller.php index 1a085eff4..b1366ab72 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Layer4Controller.php +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Layer4Controller.php @@ -1,7 +1,7 @@ view->pick('OPNsense/Caddy/layer4'); - $this->view->formDialogLayer4 = $this->getForm("dialogLayer4"); - $this->view->formDialogLayer4Openvpn = $this->getForm("dialogLayer4Openvpn"); + + $this->view->formDialogLayer4 = $this->getForm('dialogLayer4'); + $this->view->formGridLayer4 = $this->getFormGrid('dialogLayer4', null, 'ConfChangeMessage'); + + $this->view->formDialogLayer4Openvpn = $this->getForm('dialogLayer4Openvpn'); + $this->view->formGridLayer4Openvpn = $this->getFormGrid('dialogLayer4Openvpn', null, 'ConfChangeMessage'); } } diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/ReverseProxyController.php b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/ReverseProxyController.php index fde12d63c..e30315299 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/ReverseProxyController.php +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/ReverseProxyController.php @@ -1,8 +1,7 @@ view->pick('OPNsense/Caddy/reverse_proxy'); + $this->view->formDialogReverseProxy = $this->getForm("dialogReverseProxy"); + $this->view->formGridReverseProxy = $this->getFormGrid('dialogReverseProxy', null, 'ConfChangeMessage'); + $this->view->formDialogSubdomain = $this->getForm("dialogSubdomain"); + $this->view->formGridSubdomain = $this->getFormGrid('dialogSubdomain', null, 'ConfChangeMessage'); + $this->view->formDialogHandle = $this->getForm("dialogHandle"); + $this->view->formGridHandle = $this->getFormGrid('dialogHandle', null, 'ConfChangeMessage'); + $this->view->formDialogAccessList = $this->getForm("dialogAccessList"); + $this->view->formGridAccessList = $this->getFormGrid('dialogAccessList', null, 'ConfChangeMessage'); + $this->view->formDialogBasicAuth = $this->getForm("dialogBasicAuth"); + $this->view->formGridBasicAuth = $this->getFormGrid('dialogBasicAuth', null, 'ConfChangeMessage'); + $this->view->formDialogHeader = $this->getForm("dialogHeader"); + $this->view->formGridHeader = $this->getFormGrid('dialogHeader', null, 'ConfChangeMessage'); } } diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogAccessList.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogAccessList.xml index 50c2718ab..774ebd997 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogAccessList.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogAccessList.xml @@ -18,6 +18,10 @@ checkbox + + boolean + boolean + accesslist.HttpResponseCode @@ -26,6 +30,9 @@ abort true + + false + accesslist.HttpResponseMessage @@ -33,6 +40,9 @@ text true + + false + accesslist.description diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml index 7ece8310a..3efcdb8dd 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml @@ -4,6 +4,11 @@ checkbox + + 6em + boolean + rowtoggle + handle.description @@ -38,6 +43,9 @@ dropdown true + + false + handle.HandlePath @@ -46,6 +54,9 @@ any true + + false + header @@ -58,6 +69,9 @@ dropdown true + + false + handle.ForwardAuth @@ -65,6 +79,11 @@ checkbox true + + false + boolean + boolean + header @@ -87,6 +106,9 @@ true + + false + handle.header @@ -97,6 +119,9 @@ true + + false + handle.HttpKeepalive @@ -106,6 +131,9 @@ true + + false + handle.HttpTls @@ -133,6 +161,9 @@ text true + + false + handle.HttpTlsInsecureSkipVerify @@ -140,6 +171,11 @@ checkbox + + false + boolean + boolean + handle.HttpTlsTrustedCaCerts @@ -147,6 +183,9 @@ dropdown + + false + handle.HttpTlsServerName @@ -154,6 +193,9 @@ text + + false + handle.HttpNtlm @@ -161,6 +203,11 @@ checkbox + + false + boolean + boolean + header @@ -174,6 +221,9 @@ true + + false + handle.lb_retries @@ -183,6 +233,9 @@ off true + + false + handle.lb_try_duration @@ -192,6 +245,9 @@ 0 true + + false + handle.lb_try_interval @@ -201,6 +257,9 @@ 250 true + + false + handle.PassiveHealthFailDuration @@ -210,6 +269,9 @@ off true + + false + handle.PassiveHealthMaxFails @@ -219,6 +281,9 @@ 1 true + + false + handle.PassiveHealthUnhealthyStatus @@ -228,6 +293,9 @@ off true + + false + handle.PassiveHealthUnhealthyLatency @@ -237,6 +305,9 @@ off true + + false + handle.PassiveHealthUnhealthyRequestCount @@ -246,5 +317,8 @@ off true + + false + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHeader.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHeader.xml index df19819f0..f7885bedd 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHeader.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHeader.xml @@ -16,12 +16,18 @@ text + + false + header.HeaderReplace text + + false + header.description diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml index 8fa4fdcae..9cabfaf42 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml @@ -4,6 +4,11 @@ checkbox + + 6em + boolean + rowtoggle + layer4.Sequence @@ -26,6 +31,9 @@ dropdown + + false + layer4.Protocol @@ -40,6 +48,9 @@ text + + false + header @@ -65,6 +76,9 @@ dropdown + + false + layer4.FromOpenvpnStaticKey @@ -74,6 +88,9 @@ Any 5 + + false + layer4.InvertMatchers @@ -81,6 +98,11 @@ checkbox true + + false + boolean + boolean + layer4.TerminateTls @@ -88,6 +110,11 @@ checkbox + + false + boolean + boolean + header @@ -113,6 +140,9 @@ dropdown true + + false + header @@ -126,6 +156,9 @@ true + + false + layer4.PassiveHealthFailDuration @@ -135,6 +168,9 @@ off true + + false + layer4.PassiveHealthMaxFails @@ -144,6 +180,9 @@ 1 true + + false + header @@ -156,5 +195,8 @@ true + + false + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4Openvpn.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4Openvpn.xml index ec225e85f..2ac852121 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4Openvpn.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4Openvpn.xml @@ -9,5 +9,8 @@ textbox Paste an OpenVPN Static key. + + true + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml index 014e1853e..a8163b33f 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml @@ -4,6 +4,11 @@ checkbox + + 6em + boolean + rowtoggle + reverse.description @@ -39,6 +44,9 @@ dropdown + + false + reverse.AcmePassthrough @@ -46,6 +54,9 @@ text true + + false + reverse.DnsChallenge @@ -53,12 +64,22 @@ checkbox + + false + boolean + boolean + reverse.DynDns checkbox + + false + boolean + boolean + header @@ -69,6 +90,9 @@ dropdown + + false + reverse.basicauth @@ -76,11 +100,19 @@ select_multiple 5 + + false + reverse.AccessLog checkbox + + false + boolean + boolean + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml index 8a515e2ca..5db43f6f2 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml @@ -4,6 +4,11 @@ checkbox + + 6em + boolean + rowtoggle + subdomain.description @@ -33,6 +38,11 @@ checkbox + + false + boolean + boolean + subdomain.AcmePassthrough @@ -40,6 +50,9 @@ text true + + false + header @@ -50,6 +63,9 @@ dropdown + + false + subdomain.basicauth @@ -57,5 +73,8 @@ select_multiple 5 + + false + diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt index f1c57229c..be371635c 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt @@ -1,5 +1,5 @@ {# - # Copyright (c) 2024 Cedrik Pischem + # Copyright (c) 2024-2025 Cedrik Pischem # All rights reserved. # # Redistribution and use in source and binary forms, with or without modification, @@ -27,7 +27,7 @@