Captive Portal: remove redirection on HTTPS, ditch non-functional pass statement as well
In theory, clients only use HTTP to detect the presence of a portal.
If they were to use HTTPS, the 302 redirect would in most cases
not be accessible, as the certificate presented is most likely not
valid, cutting off the communication before any redirect to a login
page can happen.
The portal itself can and should remain accessible on HTTPS, as this
is the URL the redirect is pointing to. This may be attached to a
valid certificate as well, but the key point is that access to
this URL doesn't strictly need redirection for everything on port
443.
This should prevent clients opening bogus connections to the
captive portal, which consumes a lot of TLS traffic on the network
stack, bogging down lighttpd in bigger setups and creating
a lot of established states in pf.
client-id is stored differently in the running configuration and the lease endpoint, it must be normalized here so we can return a correct match in is_reserved
interfaces: multi-dhcp6c support #7647
This splits off rtsold and dhcp6c into separate processes.
I'm not entirely sure why we settled for a single deamon of
dhcp6c back in the day, but there are certianly downsides to
it and I don't see something that wasn't fixed in the meantime
that makes this not work.
Captive Portal: re-introduce hash lookup for accounting purposes (#10275)
* Captive Portal: re-introduce hash lookup for accounting purposes
Table redirection allowed for constant time lookups, with the
migration to pf this was changed to a linear time lookup. This commit
changes this back, but retrofits it on top of the ipv6 compatibility change.
While here:
- fix a small edge case that kills states for ips
flipping primary IPs according to hostwatch.
- make sure only the most recent arp entry is considered
- make sure to clear empty addresses from the set
Cherry-picked from 1bf1c69
Cherry-picked from 3c2780e
Captive Portal: re-introduce hash lookup for accounting purposes (#10275)
* Captive Portal: re-introduce hash lookup for accounting purposes
Table redirection allowed for constant time lookups, with the
migration to pf this was changed to a linear time lookup. This commit
changes this back, but retrofits it on top of the ipv6 compatibility change.
While here:
- fix a small edge case that kills states for ips
flipping primary IPs according to hostwatch.
- make sure only the most recent arp entry is considered
- make sure to clear empty addresses from the set
Interfaces: add some missing config locks, reading the configuration requires it being locked first to ensure setBase() can't be raced with another caller.
(cherry picked from commit d81dcd37e223649c7a5d7bc3adbb61a4dd65e089)
Interfaces: Assignments - work in progress for https://github.com/opnsense/core/issues/9945
In order to migrate the interface assignments, we need to think of a way to use the differently named xml nodes for interfaces (wan, lan, ..) into something that closely resembles a standard model implementation.
Since we can't match these nodes in our statically defined model xmls, the main idea is to flush all via an in-memory model with a separate load [construct] and save hook.
Interfaces: add some missing config locks, reading the configuration requires it being locked first to ensure setBase() can't be raced with another caller.
Services: Kea DHCPv4/6: Build reservation status from control socket output, so it matches the scope of individual subnet (#10276)
* Services: Kea DHCPv4/6: Build reservation status from control socket output, so it matches the scope of individual subnets as well. Add client-id since it's relevant for IPv4 leases as well in default configuration.
We return an array now, change frontend detection if it's dynamic or static lease
Missed a closing bracket
Typo in client_id
Remove unused imports in LeasesController
Add comment to build_reserved_matches() to explain why the subnet-id logic exists now
* Add state as well, helpful for troubleshooting
* Add a state formatter to convert number status into their documented meaning
* Some data-width micro management
