Merge branch 'next_patch' of github.com:jaredhendrickson13/pfsense-api into next_minor

# Conflicts:
#	pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FirewallRule.inc

Author: jaredhendrickson13

package-lock.json

@@ -239,6 +239,13 @@ class Endpoint {
      */
     public array $delete_privileges = [];
 
+    /**
+     * @var bool $requires_page_all_privilege
+     * When enabled, this endpoint will always require the page-all privilege and will
+     * disable auto-generated/scoped REST API privileges for this endpoint.
+     */
+    public bool $requires_page_all_privilege = false;
+
     /**
      * @var string $get_help_text
      * Sets the GET request's OpenAPI documentation for this Endpoint. This will be
@@ -534,6 +541,17 @@ class Endpoint {
      */
     private function get_default_privs(): void {
         $page_all_priv = 'page-all';
+
+        # If this endpoint requires page-all, then only assign page-all to the privileges for each method
+        if ($this->requires_page_all_privilege) {
+            $this->get_privileges = [$page_all_priv];
+            $this->post_privileges = [$page_all_priv];
+            $this->patch_privileges = [$page_all_priv];
+            $this->put_privileges = [$page_all_priv];
+            $this->delete_privileges = [$page_all_priv];
+            return;
+        }
+
         $this->get_privileges = [$page_all_priv, $this->get_method_priv_name('GET')];
         $this->post_privileges = [$page_all_priv, $this->get_method_priv_name('POST')];
         $this->patch_privileges = [$page_all_priv, $this->get_method_priv_name('PATCH')];
@@ -564,6 +582,11 @@ class Endpoint {
      * @returns array The pfSense priv list entry array corresponding to the privileges of this Endpoint.
      */
     public function generate_pfsense_privs(): array {
+        # If this endpoint requires page-all, do not generate privileges
+        if ($this->requires_page_all_privilege) {
+            return [];
+        }
+
         # Set an array to populate pfSense priv entries for this Endpoint
         $privs = [];
 

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Endpoint.inc

@@ -22,6 +22,7 @@ class SystemRESTAPISettingsSyncEndpoint extends Endpoint {
         $this->ignore_interfaces = true;
         $this->ignore_read_only = true;
         $this->auth_methods = ['BasicAuth'];
+        $this->requires_page_all_privilege = true;
 
         # Construct the parent Endpoint object
         parent::__construct();

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Endpoints/SystemRESTAPISettingsSyncEndpoint.inc

@@ -35,6 +35,7 @@ class FirewallRule extends Model {
     public StringField $descr;
     public BooleanField $disabled;
     public BooleanField $log;
+    public StringField $dscp;
     public StringField $tag;
     public StringField $statetype;
     public BooleanField $tcp_flags_any;
@@ -138,8 +139,8 @@ class FirewallRule extends Model {
                 'unreach',
             ],
             many: true,
-            conditions: ['protocol' => 'icmp'],
             verbose_name: 'ICMP Types',
+            conditions: ['protocol' => 'icmp'],
             help_text: 'Th ICMP subtypes this rule applies to. This field is only applicable when ' .
                 '`ipprotocol` is `inet` and `protocol` is `icmp`.',
         );
@@ -153,10 +154,10 @@ class FirewallRule extends Model {
             allow_alias: true,
             allow_range: true,
             allow_null: true,
+            verbose_name: 'Source Port',
             internal_name: 'port',
             internal_namespace: 'source',
             conditions: ['protocol' => ['tcp', 'udp', 'tcp/udp']],
-            verbose_name: 'Source Port',
             help_text: 'The source port this rule applies to. Set to `null` to allow any source port.',
         );
         $this->destination = new FilterAddressField(
@@ -169,10 +170,10 @@ class FirewallRule extends Model {
             allow_alias: true,
             allow_range: true,
             allow_null: true,
+            verbose_name: 'Destination Port',
             internal_name: 'port',
             internal_namespace: 'destination',
             conditions: ['protocol' => ['tcp', 'udp', 'tcp/udp']],
-            verbose_name: 'Destination Port',
             help_text: 'The destination port this rule applies to. Set to `null` to allow any destination port.',
         );
         $this->descr = new StringField(
@@ -192,8 +193,9 @@ class FirewallRule extends Model {
             help_text: 'Enable or disable logging of traffic that matches this rule.',
         );
         $this->dscp = new StringField(
-            default: '',
+            default: null,
             choices: [
+                '',
                 'af11',
                 'af12',
                 'af13',
@@ -220,6 +222,7 @@ class FirewallRule extends Model {
                 '0x04',
             ],
             allow_empty: true,
+            allow_null: true,
             verbose_name: 'DSCP',
             help_text: 'The DSCP value this firewall rule should match.',
         );
@@ -237,28 +240,28 @@ class FirewallRule extends Model {
         );
         $this->tcp_flags_any = new BooleanField(
             default: false,
-            internal_name: 'tcpflags_any',
             verbose_name: 'TCP Flags Any',
+            internal_name: 'tcpflags_any',
             help_text: 'Allow any TCP flags.',
         );
         $this->tcp_flags_out_of = new StringField(
             default: null,
             choices: ['fin', 'syn', 'rst', 'psh', 'ack', 'urg', 'ece', 'cwr'],
             allow_null: true,
             many: true,
+            verbose_name: 'TCP Flags Out Of',
             internal_name: 'tcpflags2',
             conditions: ['tcp_flags_any' => false],
-            verbose_name: 'TCP Flags Out Of',
             help_text: 'The TCP flags that can be set for this rule to match.',
         );
         $this->tcp_flags_set = new StringField(
             default: null,
             choices: ['fin', 'syn', 'rst', 'psh', 'ack', 'urg', 'ece', 'cwr'],
             allow_null: true,
             many: true,
+            verbose_name: 'TCP Flags Set',
             internal_name: 'tcpflags1',
             conditions: ['tcp_flags_any' => false],
-            verbose_name: 'TCP Flags Set',
             help_text: 'The TCP flags that must be set for this rule to match.',
         );
         $this->gateway = new ForeignModelField(
@@ -317,16 +320,16 @@ class FirewallRule extends Model {
         $this->quick = new BooleanField(
             default: false,
             indicates_true: 'yes',
-            conditions: ['floating' => true],
             verbose_name: 'Quick',
+            conditions: ['floating' => true],
             help_text: 'Apply this action to traffic that matches this rule immediately. This field only applies ' .
                 'to floating firewall rules.',
         );
         $this->direction = new StringField(
             default: 'any',
             choices: ['any', 'in', 'out'],
-            conditions: ['floating' => true],
             verbose_name: 'Direction',
+            conditions: ['floating' => true],
             help_text: 'The direction of traffic this firewall rule applies to. This field only applies to ' .
                 'floating firewall rules.',
         );
@@ -343,43 +346,43 @@ class FirewallRule extends Model {
             allow_null: true,
             editable: false,
             read_only: true,
-            internal_name: 'associated-rule-id',
             verbose_name: 'Associated Rule ID',
+            internal_name: 'associated-rule-id',
             help_text: 'The internal rule ID for the NAT rule associated with this rule.',
         );
         $this->created_time = new UnixTimeField(
             editable: false,
             read_only: true,
             auto_add_now: true,
+            verbose_name: 'Created Time',
             internal_name: 'time',
             internal_namespace: 'created',
-            verbose_name: 'Created Time',
             help_text: 'The unix timestamp of when this firewall rule was original created.',
         );
         $this->created_by = new StringField(
             default: "{$this->client->username}@{$this->client->ip_address} (API)",
             editable: false,
             read_only: true,
+            verbose_name: 'Created By',
             internal_name: 'username',
             internal_namespace: 'created',
-            verbose_name: 'Created By',
             help_text: 'The username and IP of the user who originally created this firewall rule.',
         );
         $this->updated_time = new UnixTimeField(
             read_only: true,
             auto_add_now: true,
             auto_update_now: true,
+            verbose_name: 'Updated Time',
             internal_name: 'time',
             internal_namespace: 'updated',
-            verbose_name: 'Updated Time',
             help_text: 'The unix timestamp of when this firewall rule was original created.',
         );
         $this->updated_by = new StringField(
             default: "{$this->client->username}@{$this->client->ip_address} (API)",
             read_only: true,
+            verbose_name: 'Updated By',
             internal_name: 'username',
             internal_namespace: 'updated',
-            verbose_name: 'Updated By',
             help_text: 'The username and IP of the user who last updated this firewall rule.',
         );
 

pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FirewallRule.inc

@@ -62,8 +62,8 @@ class LogSettings extends Model {
         );
         $this->reverseorder = new BooleanField(
             default: false,
-            internal_name: 'reverse', # We can't use 'reverse' as the field name because it is a reserved field name
-            verbose_name: 'Reverse Order',
+            verbose_name: 'Reverse Order', # We can't use 'reverse' as the field name because it is a reserved field name
+            internal_name: 'reverse',
             help_text: 'Reverse the order of log entries.',
         );
         $this->nentries = new IntegerField(
@@ -123,7 +123,7 @@ class LogSettings extends Model {
         $this->logfilesize = new IntegerField(
             default: 512000,
             minimum: 100000,
-            maximum: 2147483648,
+            maximum: PHP_INT_MAX,
             verbose_name: 'Log File Size',
             help_text: 'The maximum size of the log file in kilobytes.',
         );
@@ -142,126 +142,126 @@ class LogSettings extends Model {
         );
         $this->enableremotelogging = new BooleanField(
             default: false,
-            internal_name: 'enable',
             verbose_name: 'Enable Remote Logging',
+            internal_name: 'enable',
             help_text: 'Enable remote logging.',
         );
         $this->ipprotocol = new StringField(
             default: 'ipv4',
             choices: ['ipv4', 'ipv6'],
-            conditions: ['enableremotelogging' => true],
             verbose_name: 'IP Protocol',
+            conditions: ['enableremotelogging' => true],
             help_text: 'The IP protocol to use for remote logging.',
         );
         $this->sourceip = new InterfaceField(
             default: '',
             allow_localhost_interface: true,
             allow_custom: [''],
             allow_empty: true,
-            conditions: ['enableremotelogging' => true],
             verbose_name: 'Source IP',
+            conditions: ['enableremotelogging' => true],
             help_text: 'The interface to use as the source IP address for remote logging.',
         );
         $this->remoteserver = new StringField(
             default: null,
             allow_null: true,
+            verbose_name: 'Remote Server',
             conditions: ['enableremotelogging' => true],
             validators: [new IPAddressValidator(allow_fqdn: true, allow_port: true)],
-            verbose_name: 'Remote Server',
             help_text: 'The first remote syslog server to send log entries to.',
         );
         $this->remoteserver2 = new StringField(
             default: null,
             allow_null: true,
+            verbose_name: 'Remote Server 2',
             conditions: ['enableremotelogging' => true, '!remoteserver' => null],
             validators: [new IPAddressValidator(allow_fqdn: true, allow_port: true)],
-            verbose_name: 'Remote Server 2',
             help_text: 'The second remote syslog server to send log entries to.',
         );
         $this->remoteserver3 = new StringField(
             default: null,
             allow_null: true,
+            verbose_name: 'Remote Server 3',
             conditions: ['enableremotelogging' => true, '!remoteserver' => null, '!remoteserver2' => null],
             validators: [new IPAddressValidator(allow_fqdn: true, allow_port: true)],
-            verbose_name: 'Remote Server 3',
             help_text: 'The third remote syslog server to send log entries to.',
         );
         $this->logall = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true],
             verbose_name: 'Log All',
+            conditions: ['enableremotelogging' => true],
             help_text: 'Log everything to the remote syslog server(s).',
         );
         $this->filter = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Filter',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log filter events to the remote syslog server(s).',
         );
         $this->dhcp = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'DHCP',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log DHCP events to the remote syslog server(s).',
         );
         $this->auth = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Auth',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log authentication events to the remote syslog server(s).',
         );
         $this->portalauth = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Portal Auth',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log captive portal authentication events to the remote syslog server(s).',
         );
         $this->vpn = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'VPN',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log VPN events to the remote syslog server(s).',
         );
         $this->dpinger = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Dpinger',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log gateway monitoring events to the remote syslog server(s).',
         );
         $this->hostapd = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Host APD',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log wireless authentication events to the remote syslog server(s).',
         );
         $this->system = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'System',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log system events to the remote syslog server(s).',
         );
         $this->resolver = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Resolver',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log DNS resolver events to the remote syslog server(s).',
         );
         $this->ppp = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'PPP',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log PPP events to the remote syslog server(s).',
         );
         $this->routing = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'Routing',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log routing events to the remote syslog server(s).',
         );
         $this->ntpd = new BooleanField(
             default: false,
-            conditions: ['enableremotelogging' => true, '!logall' => true],
             verbose_name: 'NTPd',
+            conditions: ['enableremotelogging' => true, '!logall' => true],
             help_text: 'Log NTP events to the remote syslog server(s).',
         );