Skip to content

Commit

Permalink
system: handle stale "pfsyncinterfaces" and improve workflow
Browse files Browse the repository at this point in the history
  • Loading branch information
fichtner committed Sep 2, 2024
1 parent 4c07de7 commit 54ccb74
Show file tree
Hide file tree
Showing 6 changed files with 88 additions and 21 deletions.
1 change: 1 addition & 0 deletions plist
Original file line number Diff line number Diff line change
Expand Up @@ -638,6 +638,7 @@
/usr/local/opnsense/mvc/app/models/OPNsense/Core/Migrations/M1_0_0.php
/usr/local/opnsense/mvc/app/models/OPNsense/Core/Migrations/M1_0_1.php
/usr/local/opnsense/mvc/app/models/OPNsense/Core/Migrations/MHA1_0_0.php
/usr/local/opnsense/mvc/app/models/OPNsense/Core/Migrations/MHA1_0_1.php
/usr/local/opnsense/mvc/app/models/OPNsense/Core/repositories/opnsense.xml
/usr/local/opnsense/mvc/app/models/OPNsense/Cron/ACL/ACL.xml
/usr/local/opnsense/mvc/app/models/OPNsense/Cron/Cron.php
Expand Down
23 changes: 17 additions & 6 deletions src/etc/inc/interfaces.inc
Original file line number Diff line number Diff line change
Expand Up @@ -1379,10 +1379,21 @@ function interfaces_pfsync_configure()
global $config;

if (!empty($config['hasync']['pfsyncinterface'])) {
$carp_sync_int = get_real_interface($config['hasync']['pfsyncinterface']);
/*
* We are just checking the actual attached interface here as get_real_interface()
* was not dependable when the selected interface does not exist for any reason.
*
* What the current method tells us is that we are going to ignore whether this
* interface is currently enabled or not. To avoid breakage we will keep it so
* although in reality disabling your pfsync interface should cause it to stop
* syncing.
*/
if (!empty($config['interfaces'][$config['hasync']['pfsyncinterface']]['if'])) {
$syncdev = $config['interfaces'][$config['hasync']['pfsyncinterface']]['if'];
}
}

if (!empty($carp_sync_int) && !empty($config['hasync']['pfsyncenabled'])) {
if (!empty($syncdev)) {
if (!empty($config['hasync']['pfsyncpeerip']) && is_ipaddrv4($config['hasync']['pfsyncpeerip'])) {
$syncpeer = "syncpeer " . escapeshellarg($config['hasync']['pfsyncpeerip']);
} else {
Expand All @@ -1394,12 +1405,12 @@ function interfaces_pfsync_configure()
$version = 'version ' . escapeshellarg($config['hasync']['pfsyncversion']);
}

$intf_stats = legacy_interfaces_details();
$intf_stats = legacy_interfaces_details(); /* XXX could require passing this down */

mwexec("/sbin/ifconfig pfsync0 syncdev {$carp_sync_int} {$syncpeer} {$version} up");
mwexec("/sbin/ifconfig pfsync0 syncdev {$syncdev} {$syncpeer} {$version} up");

if (!empty($intf_stats[$carp_sync_int]['mtu'])) {
mwexec("/sbin/ifconfig pfsync0 mtu " . escapeshellarg($intf_stats[$carp_sync_int]['mtu']));
if (!empty($intf_stats[$syncdev]['mtu'])) {
mwexecf('/sbin/ifconfig pfsync0 mtu %s', [$intf_stats[$syncdev]['mtu']]);
}
} else {
mwexec('/sbin/ifconfig pfsync0 -syncdev -syncpeer down');
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,11 @@
<type>checkbox</type>
<help>When this device is configured as CARP backup it will disconnect all PPP type interfaces and try to reconnect them when becoming master again.</help>
</field>
<field>
<id>hasync.pfsyncenabled</id>
<label>Synchronize States</label>
<type>checkbox</type>
<help>pfsync transfers state insertion, update, and deletion messages between firewalls.</help>
</field>
<field>
<id>hasync.pfsyncinterface</id>
<label>Synchronize Interface</label>
<label>Synchronize all states via</label>
<type>dropdown</type>
<help>If Synchronize States is enabled, it will utilize this interface for communication. Best choose a dedicated interface for this type of communication to prevent manipulation of states causing security issues.</help>
<help>This enables state insertion, update, and deletion messages between firewalls by utilizing the selected interface for communication. Best choose a dedicated interface for this type of communication to prevent manipulation of states causing security issues.</help>
</field>
<field>
<id>hasync.pfsyncversion</id>
Expand Down
9 changes: 2 additions & 7 deletions src/opnsense/mvc/app/models/OPNsense/Core/Hasync.xml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<model>
<mount>//hasync</mount>
<migration_prefix>MHA</migration_prefix>
<version>1.0.0</version>
<version>1.0.1</version>
<description>HA sync</description>
<items>
<disablepreempt type="BooleanField">
Expand All @@ -12,14 +12,9 @@
<Default>0</Default>
<Required>Y</Required>
</disconnectppps>
<pfsyncenabled type="BooleanField">
<Default>0</Default>
<Required>Y</Required>
</pfsyncenabled>
<pfsyncinterface type="InterfaceField">
<Required>Y</Required>
<Default>lan</Default>
<AllowDynamic>Y</AllowDynamic>
<BlankDesc>Disabled</BlankDesc>
<filters>
<virtual>/^(?!1).*$/</virtual>
</filters>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,13 @@ public function run($model)
if (!empty((string)$model->pfsyncenabled)) {
$model->pfsyncversion = '1301'; // on upgrade keep legacy pfsync version
}
if (empty($src->pfsyncenabled)) {
/* disabe via pfsyncinterface if not set */
$model->pfsyncinterface = null;
} else {
/* may need to disable if previous value is no longer available */
$model->pfsyncinterface->normalizeValue();
}
} else {
throw new \Exception('Missing (configd) ha options list');
}
Expand Down
59 changes: 59 additions & 0 deletions src/opnsense/mvc/app/models/OPNsense/Core/Migrations/MHA1_0_1.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
<?php

/*
* Copyright (C) 2024 Deciso B.V.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

namespace OPNsense\Core\Migrations;

use OPNsense\Base\BaseModelMigration;
use OPNsense\Core\Hasync;
use OPNsense\Core\Backend;
use OPNsense\Core\Config;

class MHA1_0_1 extends BaseModelMigration
{
/**
* Remove pfsyncenabled by folding it into the pfsyncinterface setting
* @param $model
*/
public function run($model)
{
if (!($model instanceof Hasync)) {
return;
}

$src = Config::getInstance()->object()->hasync;

/* duplicated effort from 1.0.0 since that was functional on early 24.7.x */
if (empty($src->pfsyncenabled)) {
/* disabe via pfsyncinterface if not set */
$model->pfsyncinterface = null;
} else {
/* may need to disable if previous value is no longer available */
$model->pfsyncinterface->normalizeValue();
}
}
}

0 comments on commit 54ccb74

Please sign in to comment.