Firewall Alias import bug after upgrade to 23.05-RELEASE (amd64)

[danielbaird]

after upgrading to 23.05 (activated as pfSense plus) I encountered a bug in the Firewall Alias import feature.

navigating Firewall / Aliases / IP
then clicking Import brings up the form
I enter an alias name (that is checked to be valid e.g. NET_Google)
then paste in a set of IP subnets e.g.
34.116.0.0/14
142.250.66.0/24
172.217.24.0/24
142.250.0.0/16
then save, and it instantly shows a PHP error. SSH to the device shows the error above the menu. reboot fails to load the config
connect to serial console, drop to shell and copy over the last known good config backup over the top of config.xml, then reboot, and its back to normal.

i'm hesitant to try this again on a prod system. i can try to replicate on a test device later if i have time

[jimp]

I can reproduce that here on a completely fresh install. Which is odd since there was a different bug there in 23.01 that we fixed and multiple people tested it after that, and it had been working.

I created a new issue to address this:

https://redmine.pfsense.org/issues/14412

[jimp]

I committed a fix for this: https://github.com/pfsense/pfsense/commit/217f42ec30a4008907ac6fbb65b7b2e0ebf51eb9

You can install the System Patches package and then create an entry for 217f42ec30a4008907ac6fbb65b7b2e0ebf51eb9 to apply the fix.

To recover, however, you would need to edit the configuration (8 from the console, then viconfig, then remove the broken <aliases> section. Then you can use the config history function to restore a previous config with your aliases from before the import attempt.

[troysjanda]

@jimp should this be applied right away?

[SteveITS]

@troysjanda If you don't use the import feature on the alias page (I never have) then it doesn't really matter. You can apply if you want to.

[Bob.Dig]

@jimp said in Firewall Alias import bug after upgrade to 23.05-RELEASE (amd64):

I committed a fix for this: https://github.com/pfsense/pfsense/commit/217f42ec30a4008907ac6fbb65b7b2e0ebf51eb9

That is a nasty bug. Never thought I would use vim one day.