search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.36k stars 753 forks source link

system_advanced_admin.php crashes after switching the protocol #6760

Closed DimasDSF closed 9 months ago

DimasDSF commented 1 year ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

This is the same bug that was reported by another person in #6356 but their issue is not correctly formatted/does not provide necessary information and is solved for them by restoring from a backup(that is not a universal solution), it was marked as a low priority.

After changing the protocol in the web gui > System: Settings: Administration to https and back to http the section of config.xml in /conf/config.xml ends up incorrectly formatted:

<webgui>
  <protocol>http</protocol>
  <ssl-certref>64e...</ssl-certref>
  <port/>
  <ssl-ciphers/>
  <interfaces/>
  <compression/>
</webgui>

this causes any attempt to access the system_advanced_admin.php page to end in a timeout after being auto redirected to the https version

Rebooting, reconfiguring the interface address etc. did not fix this issue for me.

Changing the config file to properly have opening tags fixed this for me.

<webgui>
  <protocol>http</protocol>
  <ssl-certref>64e...</ssl-certref>
  <port>80<port/>
  <ssl-ciphers><ssl-ciphers/>
  <interfaces><interfaces/>
  <compression><compression/>
</webgui>

To Reproduce

I believe this issue might have appeared due to a hang in the gui when I was changing the protocol and closed the page before it was ready, still I think it is an issue because it is not detected by the system nor fixed by rebooting, or resetting the gui port through the shell utility

Expected behavior

The system_advanced_admin.php page works, using the currently set gui port, does not redirect to https when the gui uses http, does not timeout. In cases where the config.xml is misformatted an error message is displayed with an option to regenerate, or the config is regenerated with a log input stating the reason for the regeneration.

Describe alternatives you considered

Changing the config file to properly have opening tags fixed this for me.

Relevant log files

The logs available in the Web Interface did not seem to indicate any issues, I'm not entirely sure where else to look.

Environment

OPNsense 23.7.1_3-amd64 FreeBSD 13.2-RELEASE-p2 OpenSSL 1.1.1v 1 Aug 2023

Virtualized in ProxMox. Host CPU Intel Celeron N5105 1 Intel Ethernet Controller I225-V Passed in directly via IOMMU 1 vmbr0 Bridge added as a network device

AdSchellevis commented 1 year ago

At a first glance the empty port shouldn't make much of a difference: https://github.com/opnsense/core/blob/ca5dd11447c6092ea42fb429e54d848d04619583/src/etc/inc/plugins.inc.d/webgui.inc#L107-L109

can you try to grep the port number on your broken state from the console?

grep port /var/etc/lighty-webConfigurator.conf
DimasDSF commented 1 year ago

Unfortunately I don't have a snapshot of the broken state, right now when I open the config.xml file again it seems to look the same as when the administration page would crash with a timeout except there's an additional entry from me changing the Disable HTTP_REFERER enforcement check and saving after I got the page to load, everything works fine now, it's possible that the edits I made just caused it to regenerate or some other config file was influenced by that.

Having barely ever worked with xml I didn't quite realize those were self-closing tags, so those should not be the issue.

Is there anything special about the System: Settings: Administration page that could cause that? It was the only page that was crashing in that way with the address changing to https.

Right now grep returns server.port = 80

AdSchellevis commented 1 year ago

well, I only noticed browsers not liking a switch in protocols, but a clean private browser usually fixes that.

OPNsense-bot commented 9 months ago

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.