pfSense » pfSense Packages

This code is part of a function added by Viktor Gurov in the recent past. The purpose of the function is to collect all the VPNs configured on the firewall so their address subnets can be added to both the automatic default pass list and to any user-configured custom pass list (when that box is checked on the edit custom Pass List tab).

I can look into the code and try to figure out a solution, but someone on the Netgate team familiar with the VPN configuration process might could find a solution faster.

P.S. - this exact function is included in the Snort package in file /usr/local/pkg/snort/snort.inc , so Snort will experience the same issue when OpenVPN connections are configured. never mind, checked and Snort package is fine. Suricata package was a typo that I failed to catch and correct in an earlier pass.

I honestly don't know how to cause it to happen... I don't know this stuff to even find out where in the config ovpnent gets its value from, but the code is clearly wrong. Unless the first parameter of config_path_enabled is NOT a string and somehow the RC messed that up.

But PHP will error on that line.
if ( is_array ($ovpnent) && !config_path_enabled( $ovpnent , 'disable'))

config_path_enabled requires the first parameter to be a string yet it ONLY gets called if $ovpnent is an Array. If that was an OR instead of an AND condition it would make much more sense.

That should probably be something like this instead:

        foreach (config_get_path('openvpn/openvpn-csc', []) as $idx => $ovpnent) {
                if (is_array($ovpnent) && !config_path_enabled("openvpn/openvpn-csc/{$idx}", 'disable')) {
                        if (!empty($ovpnent['tunnel_network'])) {

Jim Pingle wrote in #note-4:

That should probably be something like this instead:

[...]

Thanks Jim. I believe you are correct. There are likely other similar sections in that function. I will make the change at the point listed, and also check the remainder of the function for the same issue. Will get a pull request submitted today.

Edit: after looking at some of the other sub-sections in the function, I think this will also work. It is also how the other code sections handle a similar situation:

foreach (config_get_path('openvpn/openvpn-csc', []) as $idx => $ovpnent) {
                if (is_array($ovpnent) && !array_path_enabled($ovpnent, 'disable')) {
                        if (!empty($ovpnent['tunnel_network'])) {

Looking back jogged my memory, and this is probably a section I typo'd when making the PHP-8.1 updates back in October.

Pull Request submitted to correct this problem here: https://github.com/pfsense/FreeBSD-ports/pull/1214. This issue can be marked "resolved" when the pull request is merged.

Pull request https://github.com/pfsense/FreeBSD-ports/pull/1214 has been merged. This issue may be marked as "Resolved".