From 5ead2472deae4303324048fef6252e9066df6eac Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 15:15:01 -0400
Subject: [PATCH 01/32] Do not allow dns rebinding

---
 etc/inc/services.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index 4f2f167cee..fb28c32e9e 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -617,7 +617,7 @@ function services_dnsmasq_configure() {
 		//}
 
 		/* run dnsmasq */
-		mwexec("/usr/local/sbin/dnsmasq --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
+		mwexec("/usr/local/sbin/dnsmasq --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
 
 		if ($g['booting'])
 			echo "done.\n";

From 88809d25da51ccd474f503681a5848a1a489d37c Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 16:48:13 -0400
Subject: [PATCH 02/32] Adding --rebind-localhost-ok Suggested-by: BillM

---
 etc/inc/services.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index fb28c32e9e..b8fc92b774 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -617,7 +617,7 @@ function services_dnsmasq_configure() {
 		//}
 
 		/* run dnsmasq */
-		mwexec("/usr/local/sbin/dnsmasq --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
+		mwexec("/usr/local/sbin/dnsmasq --rebind-localhost-ok --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
 
 		if ($g['booting'])
 			echo "done.\n";

From ce46b5da400edb5fcfb3f72afaa38a86459bf827 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 17:12:56 -0400
Subject: [PATCH 03/32] More dns-rebind checks.  Ticket #708

---
 etc/inc/auth.inc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 0af0594452..b2f3d91acd 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -49,6 +49,13 @@
 
 require_once("config.gui.inc");
 
+if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
+	$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
+	$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
+    display_error_form("501", "DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
+    exit;
+}
+
 $groupindex = index_groups();
 $userindex = index_users();
 
@@ -1181,4 +1188,4 @@ function session_auth() {
 	return true;
 }
 
-?>
+?>
\ No newline at end of file

From 1ba06f4465d3bbc42e6c05f9ebf380bf22574c36 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 17:25:17 -0400
Subject: [PATCH 04/32] Comment what we are doing here and add the ticket #.

---
 etc/inc/auth.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index b2f3d91acd..f295e8b3a3 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -49,6 +49,7 @@
 
 require_once("config.gui.inc");
 
+/* DNS Binding attack prevention.  http://redmine.pfsense.org/issues/708 */
 if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
 	$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
 	$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {

From 6266cf9949d7f722354382486a02401f3efbe1e1 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 17:25:51 -0400
Subject: [PATCH 05/32] Binding -> Rebinding

---
 etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index f295e8b3a3..e63316430d 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -49,7 +49,7 @@
 
 require_once("config.gui.inc");
 
-/* DNS Binding attack prevention.  http://redmine.pfsense.org/issues/708 */
+/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
 	$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
 	$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {

From cc89c9e5b0c6257f6f6c0d4cafb3b74c9c3a0dbd Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 17:35:06 -0400
Subject: [PATCH 06/32] ^ Potential

---
 etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index e63316430d..4793b3a3ad 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -53,7 +53,7 @@ require_once("config.gui.inc");
 if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
 	$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
 	$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
-    display_error_form("501", "DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
+    display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
     exit;
 }
 

From d999ba6c3ffca4e04a9d04efecb90c3cd1eacc9f Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Thu, 1 Jul 2010 19:13:09 -0600
Subject: [PATCH 07/32] This code returned the size in kilobytes, while the
 part usually used returns megabytes.

---
 etc/inc/util.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/etc/inc/util.inc b/etc/inc/util.inc
index 9d5872ebd7..da1b4963c1 100644
--- a/etc/inc/util.inc
+++ b/etc/inc/util.inc
@@ -1104,7 +1104,8 @@ function get_memory() {
 		if(!$real && !$avail) {
 			$real = trim(`sysctl hw.physmem | cut -d' ' -f2`);
 			$avail = trim(`sysctl hw.realmem | cut -d' ' -f2`);
-			return array(($real/1024),($avail/1024));
+			/* convert from bytes to megabytes */
+			return array(($real/1048576),($avail/1048576));
 		}
 }
 

From d39a0970eb8e542d276272c432211d6d405a614a Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 1 Jul 2010 23:19:25 -0400
Subject: [PATCH 08/32] Do not include --rebind-localhost-ok it appears to not
 be in our version.   Will re-add it once the binary is in place

---
 etc/inc/services.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index b8fc92b774..2e4d6978ae 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -617,7 +617,8 @@ function services_dnsmasq_configure() {
 		//}
 
 		/* run dnsmasq */
-		mwexec("/usr/local/sbin/dnsmasq --rebind-localhost-ok --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
+		//--rebind-localhost-ok
+		mwexec("/usr/local/sbin/dnsmasq  --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
 
 		if ($g['booting'])
 			echo "done.\n";

From 8b7ae9a3712e146d55a7c6bc9f9bec2d3bac718c Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 2 Jul 2010 10:08:06 -0400
Subject: [PATCH 09/32] Only unset if this is actually set. Ticket #710

---
 usr/local/www/interfaces.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php
index 4d6283b176..94fd82f8d1 100755
--- a/usr/local/www/interfaces.php
+++ b/usr/local/www/interfaces.php
@@ -492,7 +492,8 @@ if ($_POST) {
 		unset($wancfg['provider']);
 		unset($wancfg['ondemand']);
 		unset($wancfg['timeout']);
-		unset($wancfg['pppoe']['pppoe-reset-type']);
+		if (isset($wancfg['pppoe']['pppoe-reset-type']))
+			unset($wancfg['pppoe']['pppoe-reset-type']);
 		unset($wancfg['local']);
 		unset($wancfg['subnet']);
 		unset($wancfg['remote']);

From fc4d562bd390b1387574bb9bdb27ebdf1f933fd7 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Fri, 2 Jul 2010 11:11:09 -0400
Subject: [PATCH 10/32] Adding back --rebind-localhost-ok now that dnsmasq
 version is bumped.

---
 etc/inc/services.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index 2e4d6978ae..e0092637ad 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -618,7 +618,7 @@ function services_dnsmasq_configure() {
 
 		/* run dnsmasq */
 		//--rebind-localhost-ok
-		mwexec("/usr/local/sbin/dnsmasq  --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
+		mwexec("/usr/local/sbin/dnsmasq --rebind-localhost-ok --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
 
 		if ($g['booting'])
 			echo "done.\n";

From 6775c54e2aa571d76d2fc6dea58f5c5a677997f4 Mon Sep 17 00:00:00 2001
From: Ermal <eri@pfsense.org>
Date: Mon, 5 Jul 2010 16:28:45 +0000
Subject: [PATCH 11/32] Fixes #698. Always check if we are dealing with an ip
 value to then store the subnet in the config.

---
 usr/local/www/firewall_aliases_edit.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php
index dca3d1278f..5835bd2bf3 100755
--- a/usr/local/www/firewall_aliases_edit.php
+++ b/usr/local/www/firewall_aliases_edit.php
@@ -267,7 +267,7 @@ if ($_POST) {
 					$address = array_merge($address, $rangesubnets);
 				} else {
 					$tmpaddress = $_POST["address{$x}"];
-					if(($_POST['type'] == "network" || is_ipaddr($_POST["address{$x}"])) && $_POST["address_subnet{$x}"] <> "")
+					if(is_ipaddr($_POST["address{$x}"]) && $_POST["address_subnet{$x}"] <> "")
 						$tmpaddress .= "/" . $_POST["address_subnet{$x}"];
 					$address[] = $tmpaddress;
 				}

From f60181150d6a64b9bcfaa246311e60a6a546b768 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Mon, 5 Jul 2010 18:07:46 -0600
Subject: [PATCH 12/32] Add the missing VPN types to the interface list on port
 forwards and add the same VPNs to the list available on other types of NAT
 rules.

---
 usr/local/www/firewall_nat_1to1_edit.php | 27 +++++++++++++++++++++++-
 usr/local/www/firewall_nat_edit.php      |  8 +++++++
 usr/local/www/firewall_nat_out_edit.php  | 27 +++++++++++++++++++++++-
 3 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php
index d7ed094d4a..ac009c889f 100755
--- a/usr/local/www/firewall_nat_1to1_edit.php
+++ b/usr/local/www/firewall_nat_1to1_edit.php
@@ -156,7 +156,32 @@ include("head.inc");
 				  <td width="78%" class="vtable">
 					<select name="interface" class="formselect">
 						<?php
-						$interfaces = get_configured_interface_with_descr();
+						$iflist = get_configured_interface_with_descr();
+						foreach ($iflist as $if => $ifdesc)
+							if(have_ruleint_access($if))
+								$interfaces[$if] = $ifdesc;
+
+						if ($config['l2tp']['mode'] == "server")
+							if(have_ruleint_access("l2tp"))
+								$interfaces['l2tp'] = "L2TP VPN";
+
+						if ($config['pptpd']['mode'] == "server")
+							if(have_ruleint_access("pptp"))
+								$interfaces['pptp'] = "PPTP VPN";
+
+						if ($config['pppoe']['mode'] == "server")
+							if(have_ruleint_access("pppoe"))
+								$interfaces['pppoe'] = "PPPoE VPN";
+
+						/* add ipsec interfaces */
+						if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
+							if(have_ruleint_access("enc0"))
+								$interfaces["enc0"] = "IPsec";
+
+						/* add openvpn/tun interfaces */
+						if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
+							$interfaces["openvpn"] = "OpenVPN";
+
 						foreach ($interfaces as $iface => $ifacename): 
 						?>
 						<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index 719e32f454..c769878582 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -456,6 +456,10 @@ include("fbegin.inc"); ?>
 							if(have_ruleint_access($if))
 								$interfaces[$if] = $ifdesc;
 
+						if ($config['l2tp']['mode'] == "server")
+							if(have_ruleint_access("l2tp"))
+								$interfaces['l2tp'] = "L2TP VPN";
+
 						if ($config['pptpd']['mode'] == "server")
 							if(have_ruleint_access("pptp"))
 								$interfaces['pptp'] = "PPTP VPN";
@@ -469,6 +473,10 @@ include("fbegin.inc"); ?>
 							if(have_ruleint_access("enc0"))
 								$interfaces["enc0"] = "IPsec";
 
+						/* add openvpn/tun interfaces */
+						if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
+							$interfaces["openvpn"] = "OpenVPN";
+
 						foreach ($interfaces as $iface => $ifacename): ?>
 						<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
 						<?=htmlspecialchars($ifacename);?>
diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php
index df0487f9ba..b1e7a6455b 100755
--- a/usr/local/www/firewall_nat_out_edit.php
+++ b/usr/local/www/firewall_nat_out_edit.php
@@ -318,7 +318,32 @@ function sourcesel_change() {
                   <td width="78%" class="vtable">
 			<select name="interface" class="formselect">
 				<?php
-				$interfaces = get_configured_interface_with_descr(false, true);
+				$iflist = get_configured_interface_with_descr(false, true);
+				foreach ($iflist as $if => $ifdesc)
+					if(have_ruleint_access($if))
+						$interfaces[$if] = $ifdesc;
+
+				if ($config['l2tp']['mode'] == "server")
+					if(have_ruleint_access("l2tp"))
+						$interfaces['l2tp'] = "L2TP VPN";
+
+				if ($config['pptpd']['mode'] == "server")
+					if(have_ruleint_access("pptp"))
+						$interfaces['pptp'] = "PPTP VPN";
+
+				if ($config['pppoe']['mode'] == "server")
+					if(have_ruleint_access("pppoe"))
+						$interfaces['pppoe'] = "PPPoE VPN";
+
+				/* add ipsec interfaces */
+				if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
+					if(have_ruleint_access("enc0"))
+						$interfaces["enc0"] = "IPsec";
+
+				/* add openvpn/tun interfaces */
+				if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
+					$interfaces["openvpn"] = "OpenVPN";
+
 				foreach ($interfaces as $iface => $ifacename): ?>
 				<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
 				<?=htmlspecialchars($ifacename);?>

From 15409667f720dd1191219c5a32d01e6562f74e8f Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Mon, 5 Jul 2010 19:31:14 -0600
Subject: [PATCH 13/32] Add per-rule NAT reflection override.

---
 etc/inc/filter.inc                       | 25 ++++++++++++++----------
 usr/local/www/firewall_nat_1to1_edit.php | 16 +++++++++++++++
 usr/local/www/firewall_nat_edit.php      | 16 +++++++++++++++
 3 files changed, 47 insertions(+), 10 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index fe7c047905..adcb8d5fce 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1085,7 +1085,8 @@ function filter_nat_rules_generate() {
 			if($natif) {
 				/* If reflection is enabled, turn on extra redirections
 				 * for this rule by adding other interfaces to binat rule. */
-				if(isset($config['system']['enablebinatreflection'])) {
+				if((isset($config['system']['enablebinatreflection']) || $natent['natreflection'] == "enable")
+				   && $natent['natreflection'] != "disable") {
 					$nat_if_list = filter_get_reflection_interfaces($natif);
 				} else {
 					$nat_if_list = array();
@@ -1281,10 +1282,8 @@ function filter_nat_rules_generate() {
 	fwrite($inetd_fd, "tftp-proxy\tdgram\tudp\twait\t\troot\t/usr/libexec/tftp-proxy\ttftp-proxy -v\n");
 
 	if(isset($config['nat']['rule'])) {
-		if(!isset($config['system']['disablenatreflection'])) {
-			/* start redirects on port 19000 of localhost */
-			$starting_localhost_port = 19000;
-		}
+		/* start reflection redirects on port 19000 of localhost */
+		$starting_localhost_port = 19000;
 		$natrules .= "# NAT Inbound Redirects\n";
 		foreach ($config['nat']['rule'] as $rule) {
 			update_filter_reload_status("Creating NAT rule {$rule['descr']}");
@@ -1360,7 +1359,8 @@ function filter_nat_rules_generate() {
 			} else
 				$nordr = "";
 
-			if(!isset($config['system']['disablenatreflection'])) {
+			if((!isset($config['system']['disablenatreflection']) || $rule['natreflection'] == "enable")
+			   && $rule['natreflection'] != "disable") {
 				$nat_if_list = filter_get_reflection_interfaces($natif);
 			} else {
 				$nat_if_list = array();
@@ -2126,13 +2126,18 @@ EOD;
 		}
 	}
 
-	$ipfrules .= "# NAT Reflection rules\n";
-	if(isset($config['nat']['rule']) &&
-		(!isset($config['system']['disablenatreflection']))) {
-		$ipfrules .= <<<EOD
+	if(isset($config['nat']['rule']) && is_array($config['nat']['rule'])) {
+		foreach ($config['nat']['rule'] as $rule) {
+			if((!isset($config['system']['disablenatreflection']) || $rule['natreflection'] == "enable")
+			   && $rule['natreflection'] != "disable") {
+				$ipfrules .= "# NAT Reflection rules\n";
+				$ipfrules .= <<<EOD
 pass in inet tagged PFREFLECT keep state label "NAT REFLECT: Allow traffic to localhost"
 
 EOD;
+				break;
+			}
+		}
 	}
 
 	if(isset($config['filter']['rule'])) {
diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php
index ac009c889f..4966e141e2 100755
--- a/usr/local/www/firewall_nat_1to1_edit.php
+++ b/usr/local/www/firewall_nat_1to1_edit.php
@@ -77,6 +77,7 @@ if (isset($id) && $a_1to1[$id]) {
 	else
 		$pconfig['subnet'] = $a_1to1[$id]['subnet'];
 	$pconfig['descr'] = $a_1to1[$id]['descr'];
+	$pconfig['natreflection'] = $a_1to1[$id]['natreflection'];
 } else {
     $pconfig['subnet'] = 32;
 	$pconfig['interface'] = "wan";
@@ -123,6 +124,11 @@ if ($_POST) {
 		$natent['descr'] = $_POST['descr'];
 		$natent['interface'] = $_POST['interface'];
 
+		if ($_POST['natreflection'] == "enable" || $_POST['natreflection'] == "disable")
+			$natent['natreflection'] = $_POST['natreflection'];
+		else
+			unset($natent['natreflection']);
+
 		if (isset($id) && $a_1to1[$id])
 			$a_1to1[$id] = $natent;
 		else
@@ -220,6 +226,16 @@ include("head.inc");
                     <br> <span class="vexpl">You may enter a description here 
                     for your reference (not parsed).</span></td>
                 </tr>
+				<tr>
+					<td width="22%" valign="top" class="vncell">NAT reflection</td>
+					<td width="78%" class="vtable">
+						<select name="natreflection" class="formselect">
+						<option value="default" <?php if ($pconfig['natreflection'] != "enable" && $pconfig['natreflection'] != "disable") echo "selected"; ?>>use system default</option>
+						<option value="enable" <?php if ($pconfig['natreflection'] == "enable") echo "selected"; ?>>enable</option>
+						<option value="disable" <?php if ($pconfig['natreflection'] == "disable") echo "selected"; ?>>disable</option>
+						</select>
+					</td>
+				</tr>
                 <tr> 
                   <td width="22%" valign="top">&nbsp;</td>
                   <td width="78%"> 
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index c769878582..3f06928251 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -84,6 +84,7 @@ if (isset($id) && $a_nat[$id]) {
 	$pconfig['interface'] = $a_nat[$id]['interface'];
 	$pconfig['associated-rule-id'] = $a_nat[$id]['associated-rule-id'];
 	$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
+	$pconfig['natreflection'] = $a_nat[$id]['natreflection'];
 
 	if (!$pconfig['interface'])
 		$pconfig['interface'] = "wan";
@@ -315,6 +316,11 @@ if ($_POST) {
 		else
 			unset($natent['nosync']);
 
+		if ($_POST['natreflection'] == "enable" || $_POST['natreflection'] == "disable")
+			$natent['natreflection'] = $_POST['natreflection'];
+		else
+			unset($natent['natreflection']);
+
 		// If we used to have an associated filter rule, but no-longer should have one
 		if (!empty($a_nat[$id]) && ( empty($natent['associated-rule-id']) || $natent['associated-rule-id'] != $a_nat[$id]['associated-rule-id'] ) ) {
 			// Delete the previous rule
@@ -749,6 +755,16 @@ include("fbegin.inc"); ?>
 						HINT: This prevents the rule from automatically syncing to other CARP members.
 					</td>
 				</tr>
+				<tr>
+					<td width="22%" valign="top" class="vncell">NAT reflection</td>
+					<td width="78%" class="vtable">
+						<select name="natreflection" class="formselect">
+						<option value="default" <?php if ($pconfig['natreflection'] != "enable" && $pconfig['natreflection'] != "disable") echo "selected"; ?>>use system default</option>
+						<option value="enable" <?php if ($pconfig['natreflection'] == "enable") echo "selected"; ?>>enable</option>
+						<option value="disable" <?php if ($pconfig['natreflection'] == "disable") echo "selected"; ?>>disable</option>
+						</select>
+					</td>
+				</tr>
 				<?php if (isset($id) && $a_nat[$id] && !isset($_GET['dup'])): ?>
 				<tr>
 					<td width="22%" valign="top" class="vncell">Filter rule association</td>

From 9b13f84b4f71bbb4238492cf497c2e176c216154 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 11:51:47 -0400
Subject: [PATCH 14/32] Check dyndns hostnames as well for DNS Rebind issues

---
 etc/inc/auth.inc | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 4793b3a3ad..fd597ab02f 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -50,11 +50,18 @@
 require_once("config.gui.inc");
 
 /* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
-if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
-	$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
-	$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
-    display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
-    exit;
+$found_host = false;
+if($config['dyndns'])
+	foreach($config['dyndns'] as $dyndns) 
+		if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
+			$found_host = true;
+if($found_host == false) {
+	if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
+		$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
+		$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
+		display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
+		exit;
+	}
 }
 
 $groupindex = index_groups();

From 5a554f3085ef6c327b01941906d891163063d429 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 12:10:36 -0400
Subject: [PATCH 15/32] Slight fix to dyndns check

---
 etc/inc/auth.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index fd597ab02f..4ca7642461 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -51,8 +51,8 @@ require_once("config.gui.inc");
 
 /* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 $found_host = false;
-if($config['dyndns'])
-	foreach($config['dyndns'] as $dyndns) 
+if($config['dyndnses']['dyndns'])
+	foreach($config['dyndnses']['dyndns'] as $dyndns)
 		if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
 			$found_host = true;
 if($found_host == false) {

From 681f5f4e531993a86f3a44a11309518e151bff8c Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 12:47:26 -0400
Subject: [PATCH 16/32] Add ssh_tunnel_shell to /etc/shells

---
 etc/shells | 1 +
 1 file changed, 1 insertion(+)

diff --git a/etc/shells b/etc/shells
index 896cfa736e..3ccb4dc21e 100644
--- a/etc/shells
+++ b/etc/shells
@@ -8,4 +8,5 @@
 /bin/csh
 /bin/tcsh
 /etc/rc.initial
+/usr/local/sbin/ssh_tunnel_shell
 

From 4b49a8a91ec6a3ac26775644b0441ccd817d04ce Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 13:55:10 -0400
Subject: [PATCH 17/32] Move the skel dir to /etc/skel, where it's easier to
 manage from a build point of view.

---
 etc/inc/auth.inc                   | 2 +-
 {usr/share => etc}/skel/dot.tcshrc | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename {usr/share => etc}/skel/dot.tcshrc (100%)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 4ca7642461..6078158642 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -293,7 +293,7 @@ function local_user_set(& $user) {
 
 	/* determine add or mod */
 	if (!strncmp($pwread, "pw:", 3)) {
-		$user_op = "useradd -m -k /usr/share/skel -o";
+		$user_op = "useradd -m -k /etc/skel -o";
 	} else {
 		$user_op = "usermod";
 	}
diff --git a/usr/share/skel/dot.tcshrc b/etc/skel/dot.tcshrc
similarity index 100%
rename from usr/share/skel/dot.tcshrc
rename to etc/skel/dot.tcshrc

From 0321fa1ba49f41e672fe0836a399e03ed05d38d5 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 14:26:56 -0400
Subject: [PATCH 18/32] Wrap the dns rebind check in a test to see if our error
 function exists. If it doesn't, it's probably being called from captive
 portal, so skip the check. Fixes #721

---
 etc/inc/auth.inc | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 6078158642..2aca48fbfc 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -49,18 +49,22 @@
 
 require_once("config.gui.inc");
 
-/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
-$found_host = false;
-if($config['dyndnses']['dyndns'])
-	foreach($config['dyndnses']['dyndns'] as $dyndns)
-		if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
-			$found_host = true;
-if($found_host == false) {
-	if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
-		$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
-		$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
-		display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
-		exit;
+/* If this function doesn't exist, we're being called from Captive Portal or 
+   another internal subsystem which does not include authgui.inc */
+if (function_exists("display_error_form")) {
+	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
+	$found_host = false;
+	if($config['dyndnses']['dyndns'])
+		foreach($config['dyndnses']['dyndns'] as $dyndns)
+			if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
+				$found_host = true;
+	if($found_host == false) {
+		if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
+			$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
+			$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
+			display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
+			exit;
+		}
 	}
 }
 

From b6022a23920008186cb0e5e9206b43f4a84b3f37 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 14:35:11 -0400
Subject: [PATCH 19/32] Add localhost as a valid host for SSH forwarding cases

---
 etc/inc/auth.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 2aca48fbfc..462459feba 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -54,6 +54,8 @@ require_once("config.gui.inc");
 if (function_exists("display_error_form")) {
 	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 	$found_host = false;
+	if($dyndns['host'] == "localhost")
+		$found_host = true;
 	if($config['dyndnses']['dyndns'])
 		foreach($config['dyndnses']['dyndns'] as $dyndns)
 			if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])

From 3821f3daa8d44ce2138a580bd8d5d2a67835d2e9 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 14:36:02 -0400
Subject: [PATCH 20/32] Oops, correct check

---
 etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 462459feba..9610190da4 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -54,7 +54,7 @@ require_once("config.gui.inc");
 if (function_exists("display_error_form")) {
 	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 	$found_host = false;
-	if($dyndns['host'] == "localhost")
+	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['HTTP_HOST'] == "localhost")
 		$found_host = true;
 	if($config['dyndnses']['dyndns'])
 		foreach($config['dyndnses']['dyndns'] as $dyndns)

From 11ecbf135d1a3383af1868dcb9be8dc9143f619b Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 14:36:57 -0400
Subject: [PATCH 21/32] Check for 127.0.0.1 as well

---
 etc/inc/auth.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 9610190da4..a248a6a759 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -56,6 +56,8 @@ if (function_exists("display_error_form")) {
 	$found_host = false;
 	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['HTTP_HOST'] == "localhost")
 		$found_host = true;
+	if($_SERVER['HTTP_HOST'] == "127.0.0.1" or $_SERVER['HTTP_HOST'] == "127.0.0.1")
+		$found_host = true;
 	if($config['dyndnses']['dyndns'])
 		foreach($config['dyndnses']['dyndns'] as $dyndns)
 			if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])

From c371754a804e7a98edbfc3353c2e109a65ae3f8d Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 14:51:26 -0400
Subject: [PATCH 22/32] Correct check

---
 etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index a248a6a759..c5616ba13f 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -56,7 +56,7 @@ if (function_exists("display_error_form")) {
 	$found_host = false;
 	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['HTTP_HOST'] == "localhost")
 		$found_host = true;
-	if($_SERVER['HTTP_HOST'] == "127.0.0.1" or $_SERVER['HTTP_HOST'] == "127.0.0.1")
+	if($_SERVER['HTTP_HOST'] == "127.0.0.1" or $_SERVER['SERVER_ADDR'] == "127.0.0.1")
 		$found_host = true;
 	if($config['dyndnses']['dyndns'])
 		foreach($config['dyndnses']['dyndns'] as $dyndns)

From c8dc187cef7d38eec89f91867805c50d08d94089 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 14:55:16 -0400
Subject: [PATCH 23/32] Correct check

---
 etc/inc/auth.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index c5616ba13f..ad53553b22 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -54,7 +54,7 @@ require_once("config.gui.inc");
 if (function_exists("display_error_form")) {
 	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 	$found_host = false;
-	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['HTTP_HOST'] == "localhost")
+	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['SERVER_ADDR'] == "localhost")
 		$found_host = true;
 	if($_SERVER['HTTP_HOST'] == "127.0.0.1" or $_SERVER['SERVER_ADDR'] == "127.0.0.1")
 		$found_host = true;

From 89e7778f20edde6a958d15c789c01422d761c028 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Tue, 6 Jul 2010 13:14:20 -0600
Subject: [PATCH 24/32] Fix up checks for changing wireless regulatory
 settings.

---
 etc/inc/interfaces.inc | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index 004f2b37b9..cfa8e301c4 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -2127,21 +2127,17 @@ EOD;
 	unset($output);
 	$reg_changing = false;
 
-	if ($wlcfg['regdomain'] && !preg_match("/\sregdomain\s+{$wlcfg['regdomain']}\s/si", $ifconfig_str))
+	/* special case for the debug country code */
+	if ($wlcfg['regcountry'] == 'DEBUG' && !preg_match("/\sregdomain\s+DEBUG\s/si", $ifconfig_str))
+		$reg_changing = true;
+	else if ($wlcfg['regdomain'] && !preg_match("/\sregdomain\s+{$wlcfg['regdomain']}\s/si", $ifconfig_str))
 		$reg_changing = true;
 	else if ($wlcfg['regcountry'] && !preg_match("/\scountry\s+{$wlcfg['regcountry']}\s/si", $ifconfig_str))
 		$reg_changing = true;
-	/* anywhere needs a special case, since it is not included in the ifconfig output.
-	 * Do not combine this if with the one inside. */
-	else if ($wlcfg['reglocation'] == 'anywhere') {
-		if (preg_match("/\s(indoor|outdoor)\s/si", $ifconfig_str))
-			$reg_changing = true;
-	} else if ($wlcfg['reglocation'] && !preg_match("/\s{$wlcfg['reglocation']}\s/si", $ifconfig_str))
+	else if ($wlcfg['reglocation'] == 'anywhere' && preg_match("/\s(indoor|outdoor)\s/si", $ifconfig_str))
+		$reg_changing = true;
+	} else if ($wlcfg['reglocation'] && $wlcfg['reglocation'] != 'anywhere' && !preg_match("/\s{$wlcfg['reglocation']}\s/si", $ifconfig_str))
 		$reg_changing = true;
-
-	/* special case for the debug country code */
-	if ($wlcfg['regcountry'] == 'DEBUG' && preg_match("/\sregdomain\s+DEBUG\s/si", $ifconfig_str))
-		$reg_changing = false;
 
 	if ($reg_changing) {
 		/* set regulatory domain */

From 7319dc73098daba420018eb958439471d1d3e91c Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 15:26:52 -0400
Subject: [PATCH 25/32] More fixes for DNS rebinding checks (Most of this code
 is Scott's, with some minor fixes by me)

---
 etc/inc/auth.inc | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index ad53553b22..b41b81f355 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -54,21 +54,28 @@ require_once("config.gui.inc");
 if (function_exists("display_error_form")) {
 	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 	$found_host = false;
-	if($_SERVER['HTTP_HOST'] == "localhost" or $_SERVER['SERVER_ADDR'] == "localhost")
-		$found_host = true;
-	if($_SERVER['HTTP_HOST'] == "127.0.0.1" or $_SERVER['SERVER_ADDR'] == "127.0.0.1")
+	if(strstr($_SERVER['HTTP_HOST'], ":")) {
+		$http_host_port = explode(":", $_SERVER['HTTP_HOST']);
+		$http_host = $http_host_port[0];
+	} else {
+		$http_host = $_SERVER['HTTP_HOST'];
+	}
+	if(($http_host == "localhost" or $_SERVER['SERVER_ADDR'] == "localhost") or
+	   ($http_host == "127.0.0.1" or $_SERVER['SERVER_ADDR'] == "127.0.0.1"))
 		$found_host = true;
 	if($config['dyndnses']['dyndns'])
 		foreach($config['dyndnses']['dyndns'] as $dyndns)
-			if($dyndns['host'] == $_SERVER['HTTP_HOST'] or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
+			if($dyndns['host'] == $http_host or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
 				$found_host = true;
+
+	if($http_host == $config['system']['hostname'] . "." . $config['system']['domain'] or
+			$http_host == $_SERVER['SERVER_ADDR'] or
+			$http_host == $config['system']['hostname'])
+		$found_host = true;
+
 	if($found_host == false) {
-		if ($_SERVER['HTTP_HOST'] != $config['system']['hostname'] . "." . $config['system']['domain'] and
-			$_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'] and 
-			$_SERVER['HTTP_HOST'] != $config['system']['hostname']) {
-			display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
-			exit;
-		}
+		display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
+		exit;
 	}
 }
 

From 06cb265678b140cba68bba30ea97247c18068f46 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Tue, 6 Jul 2010 13:34:34 -0600
Subject: [PATCH 26/32] Remove extra }

---
 etc/inc/interfaces.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index cfa8e301c4..dc4cbdf2ce 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -2136,7 +2136,7 @@ EOD;
 		$reg_changing = true;
 	else if ($wlcfg['reglocation'] == 'anywhere' && preg_match("/\s(indoor|outdoor)\s/si", $ifconfig_str))
 		$reg_changing = true;
-	} else if ($wlcfg['reglocation'] && $wlcfg['reglocation'] != 'anywhere' && !preg_match("/\s{$wlcfg['reglocation']}\s/si", $ifconfig_str))
+	else if ($wlcfg['reglocation'] && $wlcfg['reglocation'] != 'anywhere' && !preg_match("/\s{$wlcfg['reglocation']}\s/si", $ifconfig_str))
 		$reg_changing = true;
 
 	if ($reg_changing) {

From 14eab6fb4d893a179c8e689769168968456e1c74 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 16:32:09 -0400
Subject: [PATCH 27/32] Add a checkbox to disable DNS rebinding checks if
 needed.

---
 etc/inc/auth.inc                        |  2 +-
 usr/local/www/system_advanced_admin.php | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index b41b81f355..ac1df6b156 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -51,7 +51,7 @@ require_once("config.gui.inc");
 
 /* If this function doesn't exist, we're being called from Captive Portal or 
    another internal subsystem which does not include authgui.inc */
-if (function_exists("display_error_form")) {
+if (function_exists("display_error_form") && !isset($config['system']['webgui']['nodnsrebindcheck'])) {
 	/* DNS ReBinding attack prevention.  http://redmine.pfsense.org/issues/708 */
 	$found_host = false;
 	if(strstr($_SERVER['HTTP_HOST'], ":")) {
diff --git a/usr/local/www/system_advanced_admin.php b/usr/local/www/system_advanced_admin.php
index 840d6bff78..6bdd411d56 100644
--- a/usr/local/www/system_advanced_admin.php
+++ b/usr/local/www/system_advanced_admin.php
@@ -55,6 +55,8 @@ $pconfig['ssl-certref'] = $config['system']['webgui']['ssl-certref'];
 $pconfig['disablehttpredirect'] = isset($config['system']['disablehttpredirect']);
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
+$pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
+$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 $pconfig['enableserial'] = $config['system']['enableserial'];
 $pconfig['enablesshd'] = $config['system']['enablesshd'];
 $pconfig['sshport'] = $config['system']['ssh']['port'];
@@ -126,6 +128,11 @@ if ($_POST) {
 		else
 			unset($config['system']['enableserial']);
 
+		if ($_POST['nodnsrebindcheck'] == "yes")
+			$config['system']['webgui']['nodnsrebindcheck'] = true;
+		else
+			unset($config['system']['webgui']['nodnsrebindcheck']);
+
 		$sshd_enabled = $config['system']['enablesshd'];
 		if($_POST['enablesshd'])
 			$config['system']['enablesshd'] = "enabled";
@@ -315,6 +322,18 @@ function prot_change() {
 									<em> <?=gettext("Hint: the &quot;Set interface(s) IP address&quot; option in the console menu resets this setting as well."); ?> </em>
 								</td>
 							</tr>
+							<tr>
+								<td width="22%" valign="top" class="vncell"><?=gettext("DNS Rebind Check"); ?></td>
+								<td width="78%" class="vtable">
+									<input name="nodnsrebindcheck" type="checkbox" id="nodnsrebindcheck" value="yes" <?php if ($pconfig['nodnsrebindcheck']) echo "checked"; ?> />
+									<strong><?=gettext("Disable webConfigurator DNS Rebinding Checks"); ?></strong>
+									<br/>
+									<?php echo gettext("When this is unchecked, access to the webConfigurator " .
+									"is protected against <a href=\"http://en.wikipedia.org/wiki/DNS_rebinding\">DNS Rebinding attacks</a>. " .
+									"Check this box to disable this protection if you find that it interferes with " .
+									"webConfigurator access in certain corner cases. "); ?>
+								</td>
+							</tr>
 							<tr>
 								<td colspan="2" class="list" height="12">&nbsp;</td>
 							</tr>

From 4a820558758458b67618076d0e1ef12c1c2217b9 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 16:39:16 -0400
Subject: [PATCH 28/32] Delete an accidentally duplicated line.

---
 usr/local/www/system_advanced_admin.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/usr/local/www/system_advanced_admin.php b/usr/local/www/system_advanced_admin.php
index 6bdd411d56..ec009ab901 100644
--- a/usr/local/www/system_advanced_admin.php
+++ b/usr/local/www/system_advanced_admin.php
@@ -56,7 +56,6 @@ $pconfig['disablehttpredirect'] = isset($config['system']['disablehttpredirect']
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 $pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
-$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 $pconfig['enableserial'] = $config['system']['enableserial'];
 $pconfig['enablesshd'] = $config['system']['enablesshd'];
 $pconfig['sshport'] = $config['system']['ssh']['port'];

From 86b21903616c360707aaf7cc31868eb2a22e238d Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 17:03:44 -0400
Subject: [PATCH 29/32] Add a text box where someone can enter in alternate
 hostnames for the system to bypass the DNS rebind checks.

---
 etc/inc/auth.inc                        |  7 +++++++
 usr/local/www/system_advanced_admin.php | 24 ++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index ac1df6b156..75bb08f529 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -68,6 +68,13 @@ if (function_exists("display_error_form") && !isset($config['system']['webgui'][
 			if($dyndns['host'] == $http_host or $dyndns['host'] == $_SERVER['SERVER_ADDR'])
 				$found_host = true;
 
+	if(!empty($config['system']['webgui']['althostnames'])) {
+		$althosts = explode(" ", $config['system']['webgui']['althostnames']);
+		foreach ($althosts as $ah)
+			if($ah == $http_host or $ah == $_SERVER['SERVER_ADDR'])
+				$found_host = true;
+	}
+
 	if($http_host == $config['system']['hostname'] . "." . $config['system']['domain'] or
 			$http_host == $_SERVER['SERVER_ADDR'] or
 			$http_host == $config['system']['hostname'])
diff --git a/usr/local/www/system_advanced_admin.php b/usr/local/www/system_advanced_admin.php
index ec009ab901..c853c91073 100644
--- a/usr/local/www/system_advanced_admin.php
+++ b/usr/local/www/system_advanced_admin.php
@@ -56,6 +56,7 @@ $pconfig['disablehttpredirect'] = isset($config['system']['disablehttpredirect']
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 $pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
+$pconfig['althostnames'] = $config['system']['webgui']['althostnames'];
 $pconfig['enableserial'] = $config['system']['enableserial'];
 $pconfig['enablesshd'] = $config['system']['enablesshd'];
 $pconfig['sshport'] = $config['system']['ssh']['port'];
@@ -80,6 +81,13 @@ if ($_POST) {
 		if(!is_port($_POST['webguiport']))
 			$input_errors[] = gettext("You must specify a valid webConfigurator port number");
 
+	if ($_POST['althostnames']) {
+		$althosts = explode(" ", $_POST['althostnames']);
+		foreach ($althosts as $ah)
+			if (!is_hostname($ah))
+				$input_errors[] = gettext("Alternate hostname " . htmlspecialchars($ah) . " is not a valid hostname.");
+	}
+
 	if ($_POST['sshport'])
 		if(!is_port($_POST['sshport']))
 			$input_errors[] = gettext("You must specify a valid port number");
@@ -132,6 +140,11 @@ if ($_POST) {
 		else
 			unset($config['system']['webgui']['nodnsrebindcheck']);
 
+		if ($_POST['althostnames'])
+			$config['system']['webgui']['althostnames'] = $_POST['althostnames'];
+		else
+			unset($config['system']['webgui']['althostnames']);
+
 		$sshd_enabled = $config['system']['enablesshd'];
 		if($_POST['enablesshd'])
 			$config['system']['enablesshd'] = "enabled";
@@ -333,6 +346,17 @@ function prot_change() {
 									"webConfigurator access in certain corner cases. "); ?>
 								</td>
 							</tr>
+							<tr>
+								<td width="22%" valign="top" class="vncell"><?=gettext("Alternate Hostnames"); ?></td>
+								<td width="78%" class="vtable">
+									<input name="althostnames" type="text" class="formfld unknown" id="althostnames" size="75" value="<?=htmlspecialchars($pconfig['althostnames']);?>"/>
+									<br/>
+									<strong><?=gettext("Alternate Hostnames for DNS Rebinding Checks"); ?></strong>
+									<br/>
+									<?php echo gettext("Here you can specify alternate hostnames by which the router may be queried, to " . 
+									"bypass the DNS Rebinding Attack checks. Separate hostnames with spaces."); ?>
+								</td>
+							</tr>
 							<tr>
 								<td colspan="2" class="list" height="12">&nbsp;</td>
 							</tr>

From f5e74456ce29cee80909a347170e82da6e2dad1e Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 6 Jul 2010 17:29:25 -0400
Subject: [PATCH 30/32] Check for locally configured IPs in DNS rebind checks,
 so people who port forward from WAN to the LAN IP can still work.

---
 etc/inc/auth.inc | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 75bb08f529..d0b261a430 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -80,6 +80,20 @@ if (function_exists("display_error_form") && !isset($config['system']['webgui'][
 			$http_host == $config['system']['hostname'])
 		$found_host = true;
 
+	/* Check against locally configured IP addresses, which will catch when someone 
+	   port forwards WebGUI access from WAN to an internal IP on the router. */
+	if ($found_host == false) {
+		global $FilterIflist;
+		if (empty($FilterIflist)) {
+			require_once('filter.inc');
+			require_once('shaper.inc');
+			filter_generate_optcfg_array();
+		}
+		foreach ($FilterIflist as $iflist)
+			if($iflist['ip'] == $http_host)
+				$found_host = true;
+	}
+
 	if($found_host == false) {
 		display_error_form("501", "Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding");
 		exit;

From 2c46f11f0a7676d1e8b7448a3952a8c7ab6a6cde Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 17:44:38 -0400
Subject: [PATCH 31/32] Allow forwarded domains to be queried.

---
 etc/inc/services.inc | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index e0092637ad..b9ef729800 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -603,21 +603,22 @@ function services_dnsmasq_configure() {
 		if (isset($config['dnsmasq']['regdhcp'])) {
 			$args .= " --dhcp-hostsfile={$g['varetc_path']}/hosts ";
 		}
-
+		
+		/* Setup forwarded domains */
 		if (isset($config['dnsmasq']['domainoverrides']) && is_array($config['dnsmasq']['domainoverrides'])) {
 			foreach($config['dnsmasq']['domainoverrides'] as $override) {
 			        $args .= ' --server=/' . $override['domain'] . '/' . $override['ip'];
 			}
 		}
 
-		/* suppose that dnsmasq handles our domain and don't send
-		requests for our local domain to upstream servers */
-		//if (!empty($config['system']['domain'])) {
-		//	$args .= sprintf(' --local=/%s/', $config['system']['domain']);
-		//}
+		/* Allow DNS Rebind for forwarded domains */
+		if($config['dnsmasq']['domainoverrides']) {
+			foreach($config['dnsmasq']['domainoverrides'] as $override) {
+				$args .= ' --rebind-domain-ok=/' . $override['domain'] . '/ ';
+			}
+		}
 
 		/* run dnsmasq */
-		//--rebind-localhost-ok
 		mwexec("/usr/local/sbin/dnsmasq --rebind-localhost-ok --stop-dns-rebind --local-ttl 1 --all-servers --dns-forward-max=5000 --cache-size=10000 {$args}");
 
 		if ($g['booting'])

From 29721fe6a60c1f772c601b1f43e54518e58b97f0 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Tue, 6 Jul 2010 17:47:05 -0400
Subject: [PATCH 32/32] duplicate logic

---
 etc/inc/services.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index b9ef729800..af0d0c260d 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -612,7 +612,7 @@ function services_dnsmasq_configure() {
 		}
 
 		/* Allow DNS Rebind for forwarded domains */
-		if($config['dnsmasq']['domainoverrides']) {
+		if (isset($config['dnsmasq']['domainoverrides']) && is_array($config['dnsmasq']['domainoverrides'])) {
 			foreach($config['dnsmasq']['domainoverrides'] as $override) {
 				$args .= ' --rebind-domain-ok=/' . $override['domain'] . '/ ';
 			}