inex/IXP-Manager v7.4.0

v7.4.0 System Validation Feature, Security Fixes, Improvements and Bugfixes

on GitHub

INEX is pleased to announce the immediate availability of IXP Manager v7.4.0. This is a general release containing new core features, bug fixes and improvements, the removal of a legacy feature, and one security fix.

Release Summary

git --no-pager diff --shortstat v7.3.1
 308 files changed, 13795 insertions(+), 4465 deletions(-)

Upgrade Instructions

The official upgrade instructions can be found here. Follow these, including the database migrations.

NB: This release follows on from previous work towards deprecating the ability to provide API Keys via URL / GET Parameter. In this release, the setting which enabled this feature by default has now been turned off. You can find information on detecting software that relies on this legacy feature, as well as on enabling or disabling support in the documentation.

Installation/System Validation

We introduce a tool to assist operators in debugging issues in their system environment and installation configuration. It also highlights some optional features that are useful to IXP operators.

The aim of the validation utility is to perform a comprehensive check of the IXP Manager system, reporting only information relevant to the problem, along with links to the relevant documentation, settings in the Settings UI, and any other resources associated with the problem.

The types of issues checked range from basic system setup and suggested features to checking router and customer VLAN configurations to ensure best practices are implemented.

See the documentation here.

This is our first-pass at system validation, and feedback would be appreciated.

Sample CLI-based Validation

Sample Web-based Validation

Security

This release addresses 33 GitHub Dependabot alerts.

It also includes a fix for a reported moderate vulnerability (CVSS 5.4) - Broken Object Level Authorisation (BOLA) Allows Unauthorised Deletion of Other Users' API Keys, disclosed by @9Bakabaka. We again would like to thank them for their report and for following responsible disclosure practices.

Improvements

API Keys via GET Parameter disabled by default

Following on from work in v7.3.0, the ability to provide API keys via GET parameter is now disabled by default. This is in line with best practices as GET parameters are included in web server logs. If you do need to restore support for this practice, information on how to do so is documented here.

Removed Features

Legacy Route Server Prefix Analysis tool

This feature provided a means to analyse filtered prefixes when using Quagga as a route server, allowing members to see what routes they are advertising to the route servers, which are being accepted and which are being rejected. The feature UI, configuration, and database table have now been removed.

This has been deprecated for several years and has been replaced by the Filtered Prefixes tool.

Other Improvements

• Framework and frontend assets updated
• Alias update:max-prefixes-7.1.0 console command to customer:update-global-max-prefixes via #1032
• GitHub Issue Support Tool added via #1048
• Regenerate Model phpdoc, removing dead parameters and improving IDE integration via #1056
• Refactored RouteServerPolicy, and covered controller, policy, and aggregator with tests via #1054
• QA command: check Eloquent2Frontend column definitions (hasOne) links are defined and correct via #1053
• Increased code coverage for DotEnv util via #1047 and #1052
• Prevent 2FA setup enforcement & challenges when using switch user feature via #1042
• Additional test coverage for Virtual Interface Wizard via #1041
• Add QA command to check Settings UI field config via #1040
• Support PeeringDB AS-SET's which specify IRR, and auto-import IRR if we don't have it already via #1039
• Prevent using 'Login As' feature when already logged in as another user via #1038
• Add ModifiesEnv trait to make testing env changes less error-prone via #1037
• Setup Wizard: fix dead code. created_at/updated_at are not fillable, and are auto-set anyway via #1035
• Removed unused imports in CLI commands via #1034
• Extract 'last login at' code into reusable functions on Model, remove some "fillable" fields, and save created_by for CustomerToUser in setupwizard command via #1033
• Always copy address -> billing address fields even if blank via #1028 (@listerr)
• Add rate limit and auto-neg to Provision New Port wizard via #1027 (@listerr)
• Improvements to settings UI config parser. Display config if read-only. Show .env modification time. via #1025 (@listerr)
• Add option to disable editing per-VLAN-interface max prefix in UI via #1024 (@listerr)
• Make some fields on the Customer Create page required so users are immediately drawn to them via #1021
• Removed unsupported nested environment variables from Vagrant envfile via #1019
• Adds missing field to Settings UI, to control 'API Keys via GET Parameter' via #1018
• Remove legacy basic auth method from PeeringDB service via #1017
• Avoid deprecated use of null as an array key via #1012
• Use static::class when building controller routes to prevent typos via #1011
• Replace PDO constant deprecated in next version of PHP via #1010

Bug Fixes

• Fix psalm errors via #1055
• League Table was multiplying bits by 8 in error, fixed via #1051
• Setup Wizard: write billing contact to correct field via #1036
• Fix 500 server error during login if "Remember me" is ticked and AUTH_TOKEN_EXPIRE is set in .env via #1029 (@listerr)
• Don't select the first member in the member dropdown on editing XC / Patch Panel. Avoid AJAX errors on reset/update - via #1026 (@listerr)
• Fix Settings UI bug when a text field used a # character via #1025 (@listerr)
• Use the correct config_key for app-passwords in settings UI via #1023 (@listerr)
• Only run gitlab mirror on main repo (not forked copies) via #1022 (@listerr)
• Usage of the member auto-populate button results in a broken URL in the form, reported in #1015 and fixed via #1020 (@benjojo)
• Errors reported by PeeringDB API were not being displayed via #1017
• Fix example bird reconfiguration script - remove incorrect '/admin' from URLROOT - via #1016 (@listerr)
• Fix: it is not possible to install ixpmanager from the documentation reported in #1013 and fixed in #1030 (@benjojo)

Acknowledgements

We wish to thank everyone who contributed to this release: @9Bakabaka, @benjojo and @listerr, as well as Herve Rousseau and Daniele Pomponi of CERN, who reported via email.

CI Results for this Release

❯ ./vendor/bin/phpunit
PHPUnit 11.5.56 by Sebastian Bergmann and contributors.

Runtime:       PHP 8.4.23
Configuration: /Users/barryo/dev/ixpm-inex/phpunit.xml

...............................................................  63 / 673 (  9%)
............................................................... 126 / 673 ( 18%)
............................................................... 189 / 673 ( 28%)
............................................................... 252 / 673 ( 37%)
............................................................... 315 / 673 ( 46%)
............................................................... 378 / 673 ( 56%)
............................................................... 441 / 673 ( 65%)
............................................................... 504 / 673 ( 74%)
............................................................... 567 / 673 ( 84%)
............................................................... 630 / 673 ( 93%)
...........................................                     673 / 673 (100%)

Time: 04:59.594, Memory: 121.00 MB

OK (673 tests, 5150 assertions)```

vendor/bin/psalm --use-baseline=psalm-baseline.xml

Running on PHP 8.4.23, Psalm 6.16.1@f1f5de594dc76faf8784e02d3dc4716c91c6f6ac.

JIT acceleration: OFF
You can enable JIT acceleration (experimental) with --force-jit.

Target PHP version: 8.4 (inferred from composer.json).

Scanning files...

Analyzing files...

░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 60 / 614 (9%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 120 / 614 (19%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 180 / 614 (29%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 240 / 614 (39%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 300 / 614 (48%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 360 / 614 (58%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 420 / 614 (68%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 480 / 614 (78%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 540 / 614 (87%)
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 600 / 614 (97%)
░░░░░░░░░░░░░░

   No errors found!

Checks took 9.39 seconds and used 1,195.378MB of memory
Psalm was able to infer types for 90.6362% of the codebase