From e58da189b45242c57ba8b186c0209087cfa67c11 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 15 Mar 2011 21:30:35 +0000 Subject: [PATCH 01/34] Add code to allow custom upgrade code to run after the pfSense upgrade code for the same version switching(Just the custom upgrade functions should have _custom at the end of their name. --- etc/inc/config.lib.inc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 2edcea3d8c..11e1ec3beb 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -397,12 +397,17 @@ function convert_config() { include_once('auth.inc'); include_once('upgrade_config.inc'); + if (file_exists("/etc/inc/upgrade_config_custom.inc")) + include_once("upgrade_config_custom.inc"); /* Loop and run upgrade_VER_to_VER() until we're at current version */ while ($config['version'] < $g['latest_config']) { $cur = $config['version'] * 10; $next = $cur + 1; $migration_function = sprintf('upgrade_%03d_to_%03d', $cur, $next); $migration_function(); + $migration_function = "{$migration_function}_custom"; + if (function_exists($migration_function)) + $migration_function(); $config['version'] = sprintf('%.1f', $next / 10); if($g['booting']) echo "."; @@ -847,4 +852,4 @@ function set_device_perms() { } } -?> \ No newline at end of file +?> From 323f3f9c17d9307ab9eb820cbd05cc7629ce80b9 Mon Sep 17 00:00:00 2001 From: smos Date: Wed, 16 Mar 2011 08:46:42 +0100 Subject: [PATCH 02/34] Keep a table of gateways we added for static routes to prevent us from making multiple entries to the same IP address --- etc/inc/upgrade_config.inc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index f09b9bbb73..268f903d00 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -790,6 +790,7 @@ function upgrade_043_to_044() { $gateways = return_gateways_array(true); $i = 0; if (is_array($config['staticroutes']['route'])) { + $gwmap = array(); foreach ($config['staticroutes']['route'] as $idx => $sroute) { $found = false; foreach ($gateways as $gwname => $gw) { @@ -799,9 +800,15 @@ function upgrade_043_to_044() { break; } } + if($gwmap[$sroute['gateway']]) { + /* We already added a gateway name for this IP */ + $config['staticroutes']['route'][$idx]['gateway'] = "{$gwmap[$sroute['gateway']]}"; + $found = true; + } if ($found == false) { $gateway = array(); - $gateway['name'] = "SROUTE{$i}"; + $gateway['name'] = "SROUTE{$i}"; + $gwmap[$sroute['gateway']] = $gateway['name']; $gateway['gateway'] = $sroute['gateway']; $gateway['interface'] = $sroute['interface']; $gateway['descr'] = "Upgraded static route for {$sroute['network']}"; From ac463c006fa212ec1f784e4c29326cf47c7b02cd Mon Sep 17 00:00:00 2001 From: smos Date: Wed, 16 Mar 2011 12:16:03 +0100 Subject: [PATCH 03/34] Fix the IPsec ping hosts file generation. This only worked for the last tunnel --- etc/inc/vpn.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 6f48820bff..f0641b7ba9 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -136,6 +136,7 @@ function vpn_ipsec_configure($ipchg = false) $filterdns_list = array(); if (is_array($a_phase1) && count($a_phase1)) { + $ipsecpinghosts = ""; /* step through each phase1 entry */ foreach ($a_phase1 as $ph1ent) { if (isset($ph1ent['disabled'])) @@ -171,7 +172,6 @@ function vpn_ipsec_configure($ipchg = false) $rgmap[$ph1ent['remote-gateway']] = $rg; /* step through each phase2 entry */ - $ipsecpinghosts = ""; foreach ($a_phase2 as $ph2ent) { $ikeid = $ph2ent['ikeid']; From 505483ce74cbf8d673f88a4b575954944c11832d Mon Sep 17 00:00:00 2001 From: smos Date: Wed, 16 Mar 2011 12:27:01 +0100 Subject: [PATCH 04/34] Fix ticket #1354 --- usr/local/www/status_rrd_graph_img.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index 8af6e7d7b0..dccdecc283 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -545,7 +545,7 @@ elseif((strstr($curdatabase, "-packets.rrd")) && (file_exists("$rrddbpath$curdat $graphcmd .= "GPRINT:\"$curif-in_pps_block:LAST:%7.2lf %S pps\" "; $graphcmd .= "GPRINT:\"$curif-pps_in_t_block:AVERAGE:%7.2lf %s pkts\" "; $graphcmd .= "COMMENT:\"\\n\" "; - $graphcmd .= "COMMENT:\"out-pass\t\" "; + $graphcmd .= "COMMENT:\"out-block\t\" "; $graphcmd .= "GPRINT:\"$curif-out_pps_block:MAX:%7.2lf %s pps\" "; $graphcmd .= "GPRINT:\"$curif-out_pps_block:AVERAGE:%7.2lf %S pps\" "; $graphcmd .= "GPRINT:\"$curif-out_pps_block:LAST:%7.2lf %S pps\" "; From fe3801bf677e7e73bcdb0e4233790e920d37f6e2 Mon Sep 17 00:00:00 2001 From: smos Date: Wed, 16 Mar 2011 12:29:00 +0100 Subject: [PATCH 05/34] Hopefully improve the useless ipsec logs with highlighting --- usr/local/www/diag_logs_ipsec.php | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/usr/local/www/diag_logs_ipsec.php b/usr/local/www/diag_logs_ipsec.php index 560cd1aa43..87e1e50e88 100755 --- a/usr/local/www/diag_logs_ipsec.php +++ b/usr/local/www/diag_logs_ipsec.php @@ -56,16 +56,30 @@ if(is_array($config['ipsec']['phase1'])) $gateway = ipsec_get_phase1_dst($ph1ent); if(!is_ipaddr($gateway)) continue; - $search[] = "/(racoon: )([A-Z:].*?)({$gateway}\[[0-9].+\]|{$gateway})(.*)/i"; + $search[] = "/(racoon: )(INFO[:].*?)({$gateway}\[[0-9].+\]|{$gateway})(.*)/i"; + $search[] = "/(racoon: )(\[{$gateway}\]|{$gateway})(.*)/i"; + $replace[] = "$1[{$ph1ent['descr']}]: $2$3$4"; $replace[] = "$1[{$ph1ent['descr']}]: $2$3$4"; } /* collect all our own ip addresses */ exec("/sbin/ifconfig | /usr/bin/awk '/inet / {print $2}'", $ip_address_list); foreach($ip_address_list as $address) { - $search[] = "/(racoon: )([A-Z:].*?)({$address}\[[0-9].+\])(.*isakmp.*)/i"; + $search[] = "/(racoon: )(INFO[:].*?)({$address}\[[0-9].+\])/i"; + $search[] = "/(racoon: )(\[{$address}\]|{$address})(.*)/i"; + $replace[] = "$1[Self]: $2$3$4"; $replace[] = "$1[Self]: $2$3$4"; } +$search[] = "/(time up waiting for phase1)/i"; +$search[] = "/(failed to pre-process ph1 packet)/i"; +$search[] = "/(failed to pre-process ph2 packet)/i"; +$search[] = "/(no proposal chosen)/i"; +$replace[] = "$1 [Remote Side not responding]"; +$replace[] = "$1 [Check Phase 1 settings, lifetime, algorithm]"; +$replace[] = "$1 [Check Phase 2 settings, networks]"; +$replace[] = "$1 [Check Phase 2 settings, algorithm]"; + + $nentries = $config['syslog']['nentries']; if (!$nentries) $nentries = 50; From 7916acc3fbb0242ecfd55fbf720a14ea047b0c03 Mon Sep 17 00:00:00 2001 From: smos Date: Wed, 16 Mar 2011 12:36:35 +0100 Subject: [PATCH 06/34] Change wording --- etc/inc/config.console.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/config.console.inc b/etc/inc/config.console.inc index d1eb18aa42..77ef66b93a 100644 --- a/etc/inc/config.console.inc +++ b/etc/inc/config.console.inc @@ -190,10 +190,10 @@ EOD; echo << Date: Wed, 16 Mar 2011 12:54:45 +0100 Subject: [PATCH 07/34] Fix ticket #1126 --- etc/inc/priv.defs.inc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/etc/inc/priv.defs.inc b/etc/inc/priv.defs.inc index 287a2678be..74cd92fb72 100644 --- a/etc/inc/priv.defs.inc +++ b/etc/inc/priv.defs.inc @@ -186,11 +186,11 @@ $priv_list['page-diag-system-activity']['descr'] = "Allows access to the 'Diagno $priv_list['page-diag-system-activity']['match'] = array(); $priv_list['page-diag-system-activity']['match'][] = "diag_system_activity*"; -$priv_list['page-diag-system-activity'] = array(); -$priv_list['page-diag-system-activity']['name'] = "WebCfg - Diagnostics: System Activity"; -$priv_list['page-diag-system-activity']['descr'] = "Allows access to the 'Diagnostics: System Activity' page"; -$priv_list['page-diag-system-activity']['match'] = array(); -$priv_list['page-diag-system-activity']['match'][] = "diag_system_pftop*"; +$priv_list['page-diag-system-pftop'] = array(); +$priv_list['page-diag-system-pftop']['name'] = "WebCfg - Diagnostics: pfTop"; +$priv_list['page-diag-system-pftop']['descr'] = "Allows access to the 'Diagnostics: pfTop' page"; +$priv_list['page-diag-system-pftop']['match'] = array(); +$priv_list['page-diag-system-pftop']['match'][] = "diag_system_pftop*"; $priv_list['page-diagnostics-traceroute'] = array(); $priv_list['page-diagnostics-traceroute']['name'] = "WebCfg - Diagnostics: Traceroute page"; @@ -1112,7 +1112,7 @@ $priv_list['page-system-groupmanager']['match'] = array(); $priv_list['page-system-groupmanager']['match'][] = "system_groupmanager.php*"; $priv_list['page-diag-showbogons'] = array(); -$priv_list['page-diag-showbogons']['name'] = "WebCfg - Diagnostics: System Activity"; +$priv_list['page-diag-showbogons']['name'] = "WebCfg - Diagnostics: Show Bogonsity"; $priv_list['page-diag-showbogons']['descr'] = "Allows access to the 'Diagnostics: Show Bogons' page"; $priv_list['page-diag-showbogons']['match'] = array(); $priv_list['page-diag-showbogons']['match'][] = "diag_showbogons.php"; From af4c040e43f2c2e7bd2701b106fa7bf6aac288cd Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 16 Mar 2011 19:34:01 +0000 Subject: [PATCH 08/34] Ticket #1356 use locking here rather than ps to serialize execution. --- etc/rc.newipsecdns | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/etc/rc.newipsecdns b/etc/rc.newipsecdns index 141f04a892..2e53f99886 100755 --- a/etc/rc.newipsecdns +++ b/etc/rc.newipsecdns @@ -43,10 +43,7 @@ while (file_exists("{$g['varrun_path']}/booting")) { sleep(1); } - while(stristr(shell_exec("/bin/ps auxww"), "rc.newipsecdns")) { - // log_error("There is an existing rc.newipsecdns running, sleeping 1 second"); - sleep(1); - } + $ipseclck = lock('ipsecdns', LOCK_EX); log_error("IPSEC: One or more IPsec tunnel endpoints has changed its IP. Refreshing."); /* We will walk the list of hostnames found in the ipsec tunnel @@ -59,4 +56,6 @@ vpn_ipsec_configure(); filter_configure(); + + unlock($ipseclck); ?> From 7e5f3edbf67907370c280330855ccbfc00802fec Mon Sep 17 00:00:00 2001 From: Warren Baker Date: Thu, 17 Mar 2011 12:21:01 +0200 Subject: [PATCH 09/34] Add Total number of CP users graph --- etc/inc/rrd.inc | 43 ++++++++++++++++++++++++-- usr/local/www/status_rrd_graph_img.php | 22 +++++++++++++ 2 files changed, 62 insertions(+), 3 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 58c4df1aa2..c45e885a90 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -177,6 +177,7 @@ function enable_rrd_graphing() { $vpnusers = "-vpnusers.rrd"; $captiveportalconcurrent = "-concurrent.rrd"; $captiveportalloggedin = "-loggedin.rrd"; + $captiveportaltotalusers = "-totalusers.rrd"; $rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool"; $netstat = "/usr/bin/netstat"; @@ -673,7 +674,7 @@ function enable_rrd_graphing() { /* Captive Portal statistics, set up the rrd file */ if(isset($config['captiveportal']['enable'])) { $ifname= "captiveportal"; - if (!file_exists("$rrddbpath$ifname$captiveportal")) { + if (!file_exists("$rrddbpath$ifname$captiveportalconcurrent")) { $rrdcreate = "$rrdtool create $rrddbpath$ifname$captiveportalconcurrent --step $rrdcaptiveportalinterval "; $rrdcreate .= "DS:concurrentusers:GAUGE:$captiveportalvalid:0:10000 "; $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; @@ -708,7 +709,7 @@ function enable_rrd_graphing() { $rrdupdatesh .= "`$php -q $captiveportal_gather concurrent`\n"; $ifname= "captiveportal"; - if (!file_exists("$rrddbpath$ifname$captiveportal")) { + if (!file_exists("$rrddbpath$ifname$captiveportalloggedin")) { $rrdcreate = "$rrdtool create $rrddbpath$ifname$captiveportalloggedin --step $rrdcaptiveportalinterval "; $rrdcreate .= "DS:loggedinusers:GAUGE:$captiveportalvalid:0:10000 "; $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; @@ -738,9 +739,45 @@ function enable_rrd_graphing() { /* the Captive Portal stats gathering function. */ $rrdupdatesh .= "\n"; - $rrdupdatesh .= "# polling Captive Portal for number of logged in users and concurrent users\n"; + $rrdupdatesh .= "# polling Captive Portal for number of logged in users\n"; $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalloggedin \\\n"; $rrdupdatesh .= "`$php -q $captiveportal_gather loggedin`\n"; + + $ifname= "captiveportal"; + if (!file_exists("$rrddbpath$ifname$captiveportaltotalusers")) { + $rrdcreate = "$rrdtool create $rrddbpath$ifname$captiveportaltotalusers --step $rrdcaptiveportalinterval "; + $rrdcreate .= "DS:totalusers:GAUGE:$captiveportalvalid:0:10000 "; + $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; + $rrdcreate .= "RRA:AVERAGE:0.5:5:1100 "; + $rrdcreate .= "RRA:AVERAGE:0.5:60:1175 "; + $rrdcreate .= "RRA:AVERAGE:0.5:720:3000 "; + $rrdcreate .= "RRA:MIN:0.5:1:1000 "; + $rrdcreate .= "RRA:MIN:0.5:5:1100 "; + $rrdcreate .= "RRA:MIN:0.5:60:1175 "; + $rrdcreate .= "RRA:MIN:0.5:720:3000 "; + $rrdcreate .= "RRA:MAX:0.5:1:1000 "; + $rrdcreate .= "RRA:MAX:0.5:5:1100 "; + $rrdcreate .= "RRA:MAX:0.5:60:1175 "; + $rrdcreate .= "RRA:MAX:0.5:720:3000 "; + $rrdcreate .= "RRA:LAST:0.5:1:1000 "; + $rrdcreate .= "RRA:LAST:0.5:5:1100 "; + $rrdcreate .= "RRA:LAST:0.5:60:1175 "; + $rrdcreate .= "RRA:LAST:0.5:720:3000 "; + + create_new_rrd($rrdcreate); + } + + /* enter UNKNOWN values in the RRD so it knows we rebooted. */ + if($g['booting']) { + mwexec("$rrdtool update $rrddbpath$ifname$captiveportaltotalusers N:U"); + } + + /* the Captive Portal stats gathering function. */ + $rrdupdatesh .= "\n"; + $rrdupdatesh .= "# polling Captive Portal for number of concurrent users\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportaltotalusers \\\n"; + $rrdupdatesh .= "`$php -q $captiveportal_gather total`\n"; + } $rrdupdatesh .= "sleep 60\n"; diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index dccdecc283..2094a87b04 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -960,6 +960,28 @@ elseif((strstr($curdatabase, "-concurrent.rrd")) && (file_exists("$rrddbpath$cur $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; } +elseif((strstr($curdatabase, "-totalusers.rrd")) && (file_exists("$rrddbpath$curdatabase"))) { + /* define graphcmd for online Captive Portal users stats */ + $graphcmd = "$rrdtool graph $rrdtmppath$curdatabase-$curgraph.png "; + $graphcmd .= "--start $start --end $end "; + $graphcmd .= "--vertical-label \"Total Captive Portal Users\" "; + $graphcmd .= "--color SHADEA#eeeeee --color SHADEB#eeeeee "; + $graphcmd .= "--base=1000 "; + $graphcmd .= "--lower-limit=0 "; + $graphcmd .= "--slope-mode "; + $graphcmd .= "--title \"`hostname` - {$prettydb} - {$hperiod} - {$havg} average\" "; + $graphcmd .= "--height 200 --width 620 "; + $graphcmd .= "DEF:\"$curif-totalusers=$rrddbpath$curdatabase:totalusers:AVERAGE\" "; + $graphcmd .= "AREA:\"$curif-totalusers#{$colorcaptiveportalusers[0]}:$curif-totalusers\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"\t\t\t current\t\t average\t maximum\\n\" "; + $graphcmd .= "COMMENT:\"Users Online\t\" "; + $graphcmd .= "GPRINT:\"$curif-totalusers:LAST:%8.0lf \" "; + $graphcmd .= "GPRINT:\"$curif-totalusers:AVERAGE:%8.0lf \" "; + $graphcmd .= "GPRINT:\"$curif-totalusers:MAX:%8.0lf \" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; +} else { $data = false; log_error(sprintf(gettext("Sorry we do not have data to graph for %s"),$curdatabase)); From 3c69c52c1ce6953c3fa01f2ef2f957bd2c51ee64 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 17 Mar 2011 18:58:02 +0000 Subject: [PATCH 10/34] Log the configuration is not the same error message only when this is true. This message would have been shown even when a communication error would occur. --- etc/rc.filter_synchronize | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/etc/rc.filter_synchronize b/etc/rc.filter_synchronize index ed803066c3..1dd08183dc 100755 --- a/etc/rc.filter_synchronize +++ b/etc/rc.filter_synchronize @@ -99,19 +99,19 @@ function carp_check_version($url, $password, $port = 80, $method = 'pfsense.host $numberofruns = 0; while ($numberofruns < 2) { - $msg = new XML_RPC_Message($method, $params); - $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); - $username = $config['system']['user'][0]['name']; - $cli->setCredentials($username, $password); - if($numberofruns > 1) - $cli->setDebug(1); - /* send our XMLRPC message and timeout after 240 seconds */ - $resp = $cli->send($msg, "240"); - if(!is_object($resp)) { - $error = "A communications error occured while attempting XMLRPC sync with username {$username} {$url}:{$port}."; - } elseif($resp->faultCode()) { - $error = "An error code was received while attempting XMLRPC sync with username {$username} {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); - } else { + $msg = new XML_RPC_Message($method, $params); + $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); + $username = $config['system']['user'][0]['name']; + $cli->setCredentials($username, $password); + if($numberofruns > 1) + $cli->setDebug(1); + /* send our XMLRPC message and timeout after 240 seconds */ + $resp = $cli->send($msg, "240"); + if(!is_object($resp)) { + $error = "A communications error occured while attempting XMLRPC sync with username {$username} {$url}:{$port}."; + } elseif($resp->faultCode()) { + $error = "An error code was received while attempting XMLRPC sync with username {$username} {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + } else { $parsed_response = XML_RPC_decode($resp->value()); if(!is_array($parsed_response)) { if (trim($parsed_response) == "Authentication failed") { @@ -122,9 +122,11 @@ function carp_check_version($url, $password, $port = 80, $method = 'pfsense.host } } else { if (!isset($parsed_response['config_version']) || - $parsed_response['config_version'] < $config['version']) + $parsed_response['config_version'] < $config['version']) { + update_filter_reload_status("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!"); + log_error("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!"); return false; - else + } else return true; } } @@ -379,11 +381,8 @@ if (is_array($config['installedpackages']['carpsettings']['config'])) { if ($carp['synchronizecaptiveportal'] != "" and is_array($config['vouchers'])) $sections[] = 'vouchers'; if (count($sections) > 0) { - if (!carp_check_version($synchronizetoip, $carp['password'], $port)) { - update_filter_reload_status("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!"); - log_error("The other member is on older configuration version of {$g['product_name']}. Sync will not be done to prevent problems!"); + if (!carp_check_version($synchronizetoip, $carp['password'], $port)) break; - } update_filter_reload_status("Signaling CARP reload signal..."); carp_sync_xml($synchronizetoip, $carp['password'], $sections, $port); From 52bac9690d051596dfd8d9d672e093d18bef2ff5 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 17 Mar 2011 19:57:53 +0000 Subject: [PATCH 11/34] Up the number of packets that gets sent to divert consumers since this count includes for tcp even the 2way handshake count which might hurt the matching. This should possibly fix layer 7 Ticket #636. --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 36e7624ba5..8fd042f915 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1914,7 +1914,7 @@ function filter_generate_user_rule($rule) { $aline['flags'] .= "/" . $rule['max-src-conn-rates'] . ", overload flush global "; } if(!empty($aline['divert'])) - $aline['flags'] .= "max-packets 5 "; + $aline['flags'] .= "max-packets 10 "; $aline['flags'] .= " ) "; } From e9e295f7c0c2e8a3c156a79db1311cae107c884c Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 18 Mar 2011 11:17:01 -0400 Subject: [PATCH 12/34] Read data into variables before passing to rrdtool, so it's easier to extend this to store data elsewhere in addition to (or instead of) rrdtool. Also, switch to using cpustats for CPU statistics instead of top. --- etc/inc/rrd.inc | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index c45e885a90..7b7db6866c 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -186,7 +186,7 @@ function enable_rrd_graphing() { $pfctl = "/sbin/pfctl"; $sysctl = "/sbin/sysctl"; $php = "/usr/local/bin/php"; - $top = "/usr/bin/top"; + $cpustats = "/usr/local/sbin/cpustats"; $spamd_gather = "/usr/local/bin/spamd_gather_stats.php"; $ifconfig = "/sbin/ifconfig"; $captiveportal_gather = "/usr/local/bin/captiveportal_gather_stats.php"; @@ -356,8 +356,8 @@ function enable_rrd_graphing() { $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling wireless for interface $ifname $realif \n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$wireless N:\\\n"; - $rrdupdatesh .= "`$ifconfig {$realif} list sta| $awk 'gsub(\"M\", \"\") {getline 2;print substr(\$5, 0, length(\$5)-2) \":\" $4 \":\" $3}'`\n"; + $rrdupdatesh .= "WIFI=`$ifconfig {$realif} list sta| $awk 'gsub(\"M\", \"\") {getline 2;print substr(\$5, 0, length(\$5)-2) \":\" $4 \":\" $3}'`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$wireless N:${WIFI}\n"; } /* OpenVPN, set up the rrd file */ @@ -394,8 +394,8 @@ function enable_rrd_graphing() { $rrdupdatesh .= " sleep 0.2\n"; $rrdupdatesh .= " echo \"quit\"\n"; $rrdupdatesh .= "}\n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$vpnusers N:\\\n"; - $rrdupdatesh .= "`list_current_users | nc -U {$g['varetc_path']}/openvpn/server{$vpnid}.sock | awk -F\",\" '/^CLIENT_LIST/ {print \$2}' | wc -l | awk '{print $1}'` &\n"; + $rrdupdatesh .= "OVPN=`list_current_users | nc -U {$g['varetc_path']}/openvpn/server{$vpnid}.sock | awk -F\",\" '/^CLIENT_LIST/ {print \$2}' | wc -l | awk '{print $1}'` &\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$vpnusers N:\${OVPN}\n"; } /* QUEUES, set up the queues databases */ @@ -567,11 +567,10 @@ function enable_rrd_graphing() { } /* the CPU stats gathering function. */ - $rrdupdatesh .= "`$top -d 2 -s 1 0 | $awk '{gsub(/%/, \"\")} BEGIN { \\\n"; - $rrdupdatesh .= "printf \"$rrdtool update $rrddbpath$ifname$proc \" } \\\n"; - $rrdupdatesh .= "{ if ( \$2 == \"processes:\" ) { processes = \$1; } \\\n"; - $rrdupdatesh .= "else if ( \$1 == \"CPU:\" ) { user = \$2; nice = \$4; sys = \$6; interrupt = \$8; } \\\n"; - $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes }'`\n\n"; + $rrdupdatesh .= "CPU=`$cpustats | cut -f1-4 -d':'`\n"; + /* Using ps uxaH will count all processes including system threads. Top was undercounting. */ + $rrdupdatesh .= "PROCS=`ps uxaH | wc -l | awk '{print \$1;}'`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$proc N:\${CPU}:\${PROCS}\n"; /* End CPU statistics */ @@ -605,9 +604,10 @@ function enable_rrd_graphing() { } /* the Memory stats gathering function. */ - $rrdupdatesh .= "`$sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_active_count vm.stats.vm.v_inactive_count vm.stats.vm.v_free_count vm.stats.vm.v_cache_count vm.stats.vm.v_wire_count | "; - $rrdupdatesh .= " $awk '{getline active;getline inactive;getline free;getline cache;getline wire;printf \"$rrdtool update $rrddbpath$ifname$mem N:\""; - $rrdupdatesh .= "((active/$0) * 100)\":\"((inactive/$0) * 100)\":\"((free/$0) * 100)\":\"((cache/$0) * 100)\":\"(wire/$0 * 100)}'`\n\n"; + $rrdupdatesh .= "MEM=`$sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_active_count vm.stats.vm.v_inactive_count vm.stats.vm.v_free_count vm.stats.vm.v_cache_count vm.stats.vm.v_wire_count | "; + $rrdupdatesh .= " $awk '{getline active;getline inactive;getline free;getline cache;getline wire;printf "; + $rrdupdatesh .= "((active/$0) * 100)\":\"((inactive/$0) * 100)\":\"((free/$0) * 100)\":\"((cache/$0) * 100)\":\"(wire/$0 * 100)}'`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$mem N:\${MEM}\n"; /* End Memory statistics */ @@ -705,8 +705,8 @@ function enable_rrd_graphing() { /* the Captive Portal stats gathering function. */ $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling Captive Portal for number of concurrent users\n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalconcurrent \\\n"; - $rrdupdatesh .= "`$php -q $captiveportal_gather concurrent`\n"; + $rrdupdatesh .= "CP=`$php -q $captiveportal_gather concurrent`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalconcurrent \${CP}\n"; $ifname= "captiveportal"; if (!file_exists("$rrddbpath$ifname$captiveportalloggedin")) { @@ -740,8 +740,8 @@ function enable_rrd_graphing() { /* the Captive Portal stats gathering function. */ $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling Captive Portal for number of logged in users\n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalloggedin \\\n"; - $rrdupdatesh .= "`$php -q $captiveportal_gather loggedin`\n"; + $rrdupdatesh .= "CP=`$php -q $captiveportal_gather loggedin`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportalloggedin \${CP}\n"; $ifname= "captiveportal"; if (!file_exists("$rrddbpath$ifname$captiveportaltotalusers")) { @@ -775,8 +775,8 @@ function enable_rrd_graphing() { /* the Captive Portal stats gathering function. */ $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling Captive Portal for number of concurrent users\n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportaltotalusers \\\n"; - $rrdupdatesh .= "`$php -q $captiveportal_gather total`\n"; + $rrdupdatesh .= "CP=`$php -q $captiveportal_gather total`\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$captiveportaltotalusers \${CP}\n"; } From b2305621e59b330290d337e7855acb8e90b6dd65 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 18 Mar 2011 22:09:33 +0000 Subject: [PATCH 13/34] Generate the config file in a variable then write it as a whole to a file. --- etc/inc/filter.inc | 2 -- etc/inc/system.inc | 34 +++++++++++++++------------------- 2 files changed, 15 insertions(+), 21 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 8fd042f915..41e3708d22 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1913,8 +1913,6 @@ function filter_generate_user_rule($rule) { $aline['flags'] .= "max-src-conn-rate " . $rule['max-src-conn-rate'] . " "; $aline['flags'] .= "/" . $rule['max-src-conn-rates'] . ", overload flush global "; } - if(!empty($aline['divert'])) - $aline['flags'] .= "max-packets 10 "; $aline['flags'] .= " ) "; } diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 4a8214da29..4821a8ae7f 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1147,22 +1147,13 @@ function system_timezone_configure() { function system_ntp_configure() { global $config, $g; - $syscfg =& $config['system']; - - /* open configuration for wrting or bail */ - $fd = fopen("{$g['varetc_path']}/ntpd.conf","w"); - if(!$fd) { - log_error("Could not open {$g['varetc_path']}/ntpd.conf for writing"); - return; - } - - fwrite($fd, "# \n"); - fwrite($fd, "# pfSense OpenNTPD configuration file \n"); - fwrite($fd, "# \n\n"); + $ntpcfg = "# \n"; + $ntpcfg .= "# pfSense OpenNTPD configuration file \n"; + $ntpcfg .= "# \n\n"; /* foreach through servers and write out to ntpd.conf */ - foreach (explode(' ', $syscfg['timeservers']) as $ts) - fwrite($fd, "servers {$ts}\n"); + foreach (explode(' ', $config['system']['timeservers']) as $ts) + $ntpcfg .= "servers {$ts}\n"; /* Setup listener(s) if the user has configured one */ if ($config['installedpackages']['openntpd']) { @@ -1175,12 +1166,19 @@ function system_ntp_configure() { $ips = array_map('find_interface_ip', $ifaces); foreach ($ips as $ip) { if (is_ipaddr($ip)) - fwrite($fd, "listen on $ip\n"); + $ntpdcfg .= "listen on $ip\n"; } } } + $ntpdcfg .= "\n"; - fwrite($fd, "\n"); + /* open configuration for wrting or bail */ + $fd = fopen("{$g['varetc_path']}/ntpd.conf","w"); + if(!$fd) { + log_error("Could not open {$g['varetc_path']}/ntpd.conf for writing"); + return; + } + fwrite($fd, $ntpcfg); /* slurp! */ fclose($fd); @@ -1208,13 +1206,11 @@ function system_ntp_configure() { function sync_system_time() { global $config, $g; - $syscfg = $config['system']; - if ($g['booting']) echo "Syncing system time before startup..."; /* foreach through servers and write out to ntpd.conf */ - foreach (explode(' ', $syscfg['timeservers']) as $ts) { + foreach (explode(' ', $config['system']['timeservers']) as $ts) { mwexec("/usr/sbin/ntpdate -s $ts"); } From 375828d911b37e0e63a5e2530f8e8d88ee79e8e1 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sun, 20 Mar 2011 16:56:23 -0400 Subject: [PATCH 14/34] fix text --- usr/local/www/services_captiveportal.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index faaeb37212..24595da7c1 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -614,7 +614,7 @@ value=""> } ?>
- + From bf87b4d7d1e9c0064e59727afd7601c111f6f3da Mon Sep 17 00:00:00 2001 From: lgcosta Date: Mon, 21 Mar 2011 15:56:43 -0300 Subject: [PATCH 15/34] Added option to select the type of device for use in the tunnel openvpn --- etc/inc/openvpn.inc | 9 +++++---- usr/local/www/vpn_openvpn_server.php | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index 08e5f928fe..8d71fd2f41 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -295,11 +295,11 @@ function openvpn_reconfigure($mode, $settings) { $vpnid = $settings['vpnid']; $mode_id = $mode.$vpnid; - if (isset($settings['dev_mode'])) - $tunname = "{$settings['dev_mode']}{$vpnid}"; + if (isset($settings['device_mode'])) + $tunname = "{$settings['device_mode']}{$vpnid}"; else { /* defaults to tun */ $tunname = "tun{$vpnid}"; - $settings['dev_mode'] = "tun"; + $settings['device_mode'] = "tun"; } if ($mode == "server") @@ -323,6 +323,7 @@ function openvpn_reconfigure($mode, $settings) { $pfile = $g['varrun_path'] . "/openvpn_{$mode_id}.pid"; $proto = ($settings['protocol'] == 'UDP' ? 'udp' : "tcp-{$mode}"); + $device_mode = $settings['device_mode']; $cipher = $settings['crypto']; $interface = $settings['interface']; @@ -340,7 +341,7 @@ function openvpn_reconfigure($mode, $settings) { } $conf = "dev {$devname}\n"; - $conf .= "dev-type {$settings['dev_mode']}\n"; + $conf .= "dev-type {$settings['device_mode']}\n"; $conf .= "dev-node /dev/{$tunname}\n"; $conf .= "writepid {$pfile}\n"; $conf .= "#user nobody\n"; diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index 0f751e70b4..f15a9ae03c 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -91,6 +91,7 @@ if($_GET['act']=="new"){ $pconfig['tlsauth_enable'] = "yes"; $pconfig['autotls_enable'] = "yes"; $pconfig['dh_length'] = 1024; + $pconfig['device_mode'] = "tun"; $pconfig['interface'] = "wan"; $pconfig['local_port'] = openvpn_port_next('UDP'); $pconfig['pool_enable'] = "yes"; @@ -104,6 +105,7 @@ if($_GET['act']=="edit"){ $pconfig['mode'] = $a_server[$id]['mode']; $pconfig['protocol'] = $a_server[$id]['protocol']; $pconfig['authmode'] = $a_server[$id]['authmode']; + $pconfig['device_mode'] = $a_server[$id]['device_mode']; $pconfig['interface'] = $a_server[$id]['interface']; if (!empty($a_server[$id]['ipaddr'])) { $pconfig['interface'] = $pconfig['interface'] . '|' . $a_server[$id]['ipaddr']; @@ -304,6 +306,7 @@ if ($_POST) { if (!empty($pconfig['authmode'])) $server['authmode'] = implode(",", $pconfig['authmode']); $server['protocol'] = $pconfig['protocol']; + $server['device_mode'] = $pconfig['device_mode']; list($server['interface'], $server['ipaddr']) = explode ("|",$pconfig['interface']); $server['local_port'] = $pconfig['local_port']; $server['description'] = $pconfig['description']; @@ -662,6 +665,21 @@ if ($savemsg) + + + + + + From 71edee5e5780231dba9f2ec9290b0dff37d4be2f Mon Sep 17 00:00:00 2001 From: lgcosta Date: Mon, 21 Mar 2011 17:01:00 -0300 Subject: [PATCH 16/34] Select the device mode to tun if variable device_mode not exist in the configuration --- usr/local/www/vpn_openvpn_server.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index f15a9ae03c..ef82716a8b 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -671,9 +671,14 @@ if ($savemsg) " class="formbtns"> + + + " class="formbtns"> + + + + From e4d40f41aafe00353c0069b457a0b1b0d6c20987 Mon Sep 17 00:00:00 2001 From: gnhb Date: Tue, 22 Mar 2011 07:44:11 +0700 Subject: [PATCH 19/34] Update GUI to enable L2TP client configuration. --- usr/local/www/interfaces.php | 39 +++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php index d1fa6f7ebd..2469631d91 100755 --- a/usr/local/www/interfaces.php +++ b/usr/local/www/interfaces.php @@ -159,7 +159,7 @@ if ($wancfg['if'] == $a_ppps[$pppid]['if']) { } }// End force pppoe reset at specific time }// End if type == pppoe - else if ($a_ppps[$pppid]['type'] == "pptp"){ + else if ($a_ppps[$pppid]['type'] == "pptp" || $a_ppps[$pppid]['type'] == "l2tp"){ $pconfig['pptp_username'] = $a_ppps[$pppid]['username']; $pconfig['pptp_password'] = base64_decode($a_ppps[$pppid]['password']); $pconfig['pptp_local'] = explode(",",$a_ppps[$pppid]['localip']); @@ -175,6 +175,7 @@ if ($wancfg['if'] == $a_ppps[$pppid]['if']) { $pconfig['dhcphostname'] = $wancfg['dhcphostname']; $pconfig['alias-address'] = $wancfg['alias-address']; $pconfig['alias-subnet'] = $wancfg['alias-subnet']; +$pconfig['dhcp_plus'] = isset($wancfg['dhcp_plus']); $pconfig['descr'] = remove_bad_chars($wancfg['descr']); $pconfig['enable'] = isset($wancfg['enable']); @@ -196,6 +197,7 @@ switch($wancfg['ipaddr']) { break; case "pppoe": case "pptp": + case "l2tp": case "ppp": $pconfig['type'] = $wancfg['ipaddr']; break; @@ -415,6 +417,16 @@ if ($_POST['apply']) { } do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); break; + case "l2tp": + if ($_POST['pptp_dialondemand']) { + $reqdfields = explode(" ", "pptp_username pptp_password pptp_remote pptp_dialondemand pptp_idletimeout"); + $reqdfieldsn = array(gettext("L2TP username"),gettext("L2TP password"),gettext("L2TP remote IP address"),gettext("Dial on demand"),gettext("Idle timeout value")); + } else { + $reqdfields = explode(" ", "pptp_username pptp_password pptp_remote"); + $reqdfieldsn = array(gettext("L2TP username"),gettext("L2TP password"),gettext("L2TP remote IP address")); + } + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); + break; } /* normalize MAC addresses - lowercase and convert Windows-ized hyphenated MACs to colon delimited */ @@ -454,7 +466,7 @@ if ($_POST['apply']) { $input_errors[] = gettext("A valid PPTP local IP address must be specified."); if (($_POST['pptp_subnet'] && !is_numeric($_POST['pptp_subnet']))) $input_errors[] = gettext("A valid PPTP subnet bit count must be specified."); - if (($_POST['pptp_remote'] && !is_ipaddr($_POST['pptp_remote']))) + if (($_POST['pptp_remote'] && !is_ipaddr($_POST['pptp_remote']) && !is_hostname($_POST['gateway'][$iface]))) $input_errors[] = gettext("A valid PPTP remote IP address must be specified."); if (($_POST['pptp_idletimeout'] != "") && !is_numericint($_POST['pptp_idletimeout'])) $input_errors[] = gettext("The idle timeout value must be an integer."); @@ -588,6 +600,7 @@ if ($_POST['apply']) { $wancfg['dhcphostname'] = $_POST['dhcphostname']; $wancfg['alias-address'] = $_POST['alias-address']; $wancfg['alias-subnet'] = $_POST['alias-subnet']; + $wancfg['dhcp_plus'] = $_POST['dhcp_plus'] == "yes" ? true : false; if($gateway_item) { $a_gateways[] = $gateway_item; } @@ -648,6 +661,7 @@ if ($_POST['apply']) { break; case "pptp": + case "l2tp": $a_ppps[$pppid]['ptpid'] = $_POST['ptpid']; $a_ppps[$pppid]['type'] = $_POST['type']; $a_ppps[$pppid]['if'] = $_POST['type'].$_POST['ptpid']; @@ -888,7 +902,7 @@ $statusurl = "status_interfaces.php"; $closehead = false; include("head.inc"); -$types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" => gettext("DHCP"), "ppp" => gettext("PPP"), "pppoe" => gettext("PPPoE"), "pptp" => gettext("PPTP") /* , "carpdev-dhcp" => "CarpDev"*/); +$types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" => gettext("DHCP"), "ppp" => gettext("PPP"), "pppoe" => gettext("PPPoE"), "pptp" => gettext("PPTP"), "l2tp" => gettext("L2TP") /* , "carpdev-dhcp" => "CarpDev"*/); ?> @@ -921,12 +935,15 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" $('none','static','dhcp','pptp', 'ppp').invoke('hide'); break; } + case "l2tp": case "pptp": { $('none','static','dhcp','pppoe', 'ppp').invoke('hide'); + $('pptp').show(); break; } } - $(t).show(); + if (t != "l2tp" && t != "pptp") + $(t).show(); } function show_allcfg(obj) { @@ -1250,6 +1267,17 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" + @@ -1279,6 +1307,7 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" "DHCP client."); ?> + @@ -1489,7 +1518,7 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" - + From 548be1fd6697ab115cbb29d61bc5507744488094 Mon Sep 17 00:00:00 2001 From: Erik Fonnesbeck Date: Tue, 22 Mar 2011 01:28:23 -0600 Subject: [PATCH 20/34] Workaround for conf_mount_rw/ro during boot to only allow it to change at the start and end. Fixes #1279 --- etc/inc/config.lib.inc | 13 ++++++++----- etc/rc.bootup | 4 ++-- etc/sshd | 6 +++--- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 11e1ec3beb..586d6873b0 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -301,13 +301,16 @@ EOD; * null ******/ /* mount flash card read/write */ -function conf_mount_rw() { +function conf_mount_rw($nobootcheck = false) { global $g; /* do not mount on cdrom platform */ if($g['platform'] == "cdrom" or $g['platform'] == "pfSense") return; + if($g['booting'] && !$nobootcheck) + return; + if (refcount_reference(1000) > 1) return; @@ -321,7 +324,7 @@ function conf_mount_rw() { /* if the platform is soekris or wrap or pfSense, lets mount the * compact flash cards root. - */ + */ $status = mwexec("/sbin/mount -u -w -o sync,noatime /"); /* we could not mount this correctly. kick off fsck */ if($status <> 0) { @@ -339,14 +342,14 @@ function conf_mount_rw() { * RESULT * null ******/ -function conf_mount_ro() { +function conf_mount_ro($nobootcheck = false) { global $g; /* do not umount on cdrom or pfSense platforms */ if($g['platform'] == "cdrom" or $g['platform'] == "pfSense") return; - if($g['booting']) + if($g['booting'] && !$nobootcheck) return; if (refcount_unreference(1000) > 0) @@ -852,4 +855,4 @@ function set_device_perms() { } } -?> +?> \ No newline at end of file diff --git a/etc/rc.bootup b/etc/rc.bootup index 6cff6accd6..b7a632ea3c 100755 --- a/etc/rc.bootup +++ b/etc/rc.bootup @@ -129,7 +129,7 @@ $memory = get_memory(); $avail = $memory[0]; echo " done.\n"; -conf_mount_rw(); +conf_mount_rw(true); /* save dmesg output to file */ system_dmesg_save(); @@ -400,6 +400,6 @@ unset($g['booting']); led_normalize(); -conf_mount_ro(); +conf_mount_ro(true); ?> diff --git a/etc/sshd b/etc/sshd index 28c8e55932..67fbe00258 100755 --- a/etc/sshd +++ b/etc/sshd @@ -42,7 +42,7 @@ exit; } - conf_mount_rw(); + conf_mount_rw(true); function file_size($file) { $size = filesize($file); @@ -138,7 +138,7 @@ /* are we already running? if so exit */ if(is_subsystem_dirty('sshdkeys')) { - conf_mount_ro(); + conf_mount_ro(true); exit; } @@ -185,6 +185,6 @@ exec("mkdir /conf/sshd"); exec("/bin/cp -p /etc/ssh/ssh_host* /conf/sshd"); } - conf_mount_ro(); + conf_mount_ro(true); ?> From 66fc1f14ee447c8b31620e799b5fd2f54b4a583d Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Tue, 22 Mar 2011 10:21:03 -0400 Subject: [PATCH 21/34] Add all to the reserved keywords --- usr/local/www/firewall_aliases_edit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php index 33d124ebde..ce730e13d1 100755 --- a/usr/local/www/firewall_aliases_edit.php +++ b/usr/local/www/firewall_aliases_edit.php @@ -46,7 +46,7 @@ // Keywords not allowed in names -$reserved_keywords = array("pass", "out", "queue", "max", "min", "pptp", "pppoe", "L2TP", "OpenVPN", "IPsec"); +$reserved_keywords = array("all", "pass", "out", "queue", "max", "min", "pptp", "pppoe", "L2TP", "OpenVPN", "IPsec"); require("guiconfig.inc"); require_once("functions.inc"); From 6be14e38fdebf095e91845a92dae5374b90ef502 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 22 Mar 2011 18:19:49 +0000 Subject: [PATCH 22/34] Unbreak adding subqueues to limiters. Correct some text in the way. --- etc/inc/shaper.inc | 12 ++++++------ usr/local/www/firewall_shaper_vinterface.php | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc index 4b24f9b4c2..493e278f30 100644 --- a/etc/inc/shaper.inc +++ b/etc/inc/shaper.inc @@ -2770,10 +2770,8 @@ class dummynet_class { $reqdfieldsn[] = "Bandwidth"; $reqdfields[] = "bandwidthtype"; $reqdfieldsn[] = "Bandwidthtype"; - if (!empty($data['newname'])) { - $reqdfields[] = "newname"; - $reqdfieldsn[] = "Name"; - } + $reqdfields[] = "newname"; + $reqdfieldsn[] = "Name"; shaper_do_input_validation($data, $reqdfields, $reqdfieldsn, $input_errors); @@ -2785,7 +2783,9 @@ class dummynet_class { $input_errors[] = "Buckets must be an integer between 16 and 65535."; if ($data['qlimit'] && (!is_numeric($data['qlimit']))) $input_errors[] = "Queue limit must be an integer"; - if (!preg_match("/^[a-zA-Z0-9_-]+$/", $data['name'])) + if (!empty($data['newname']) && !preg_match("/^[a-zA-Z0-9_-]+$/", $data['newname'])) + $input_errors[] = "Queue names must be alphanumeric and _ or - only."; + if (!empty($data['name']) && !preg_match("/^[a-zA-Z0-9_-]+$/", $data['name'])) $input_errors[] = "Queue names must be alphanumeric and _ or - only."; } } @@ -3255,7 +3255,7 @@ class dnqueue_class extends dummynet_class { $form .= " GetEnabled() == "on") $form .= " CHECKED"; - $form .= " > Enable/Disable queue and its children"; + $form .= " > Enable/Disable queue"; $form .= ""; $form .= ""; $form .= " From 004cb7c584c2f50ebac3da3ee1c2f4c180de4ac0 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Tue, 22 Mar 2011 21:43:01 -0400 Subject: [PATCH 26/34] Merge 8b7d91267376d8b1e5e8d5748371430e2a601e23 https://rcs.pfsense.org/projects/pfsense/repos/mterron-clone/commits/8b7d91267376d8b1e5e8d5748371430e2a601e23 which fixes rc.shutdown issue --- etc/rc.shutdown | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/rc.shutdown b/etc/rc.shutdown index f8dd4a29f6..14faf805c0 100755 --- a/etc/rc.shutdown +++ b/etc/rc.shutdown @@ -28,7 +28,7 @@ export PATH # temporary files on shutdown from /tmp/ PLATFORM=`cat /etc/platform` if [ "$PLATFORM" = "pfSense" ]; then - find -x /tmp/ -type f -exec rm -f {} \; + find -x /tmp/* -type f -exec rm -f {} \; else /etc/rc.backup_rrd.sh /etc/rc.backup_dhcpleases.sh From d421e31930e8fc036b70eb0af4fc08872147fb75 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 23 Mar 2011 13:10:13 +0000 Subject: [PATCH 27/34] Do not error out for pptp/l2tp localip setting not set since its legitimate. --- etc/inc/interfaces.inc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index a77218cf17..079b8bcdcc 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1215,8 +1215,8 @@ function interface_ppps_configure($interface) { $localips[$pid] = get_interface_ip($port); // try to get the interface IP from the port if(!is_ipaddr($localips[$pid])){ - log_error("Could not get a Local IP address for PPTP/L2TP link on {$port} in interfaces_ppps_configure."); - return 0; + log_error("Could not get a Local IP address for PPTP/L2TP link on {$port} in interfaces_ppps_configure. Using 0.0.0.0 ip!"); + $localips[$pid] = "0.0.0.0"; } /* XXX: This needs to go away soon! [It's commented out!] */ /* Configure the gateway (remote IP ) */ @@ -1492,7 +1492,6 @@ EOD; $mpdconf .= << Date: Wed, 23 Mar 2011 19:14:28 -0400 Subject: [PATCH 28/34] Fix voucher disconnect sync issue --- etc/inc/captiveportal.inc | 11 +++++++++ etc/inc/voucher.inc | 48 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index ef59446a20..f8c0ccd87e 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -881,6 +881,17 @@ function captiveportal_disconnect($dbent, $radiusservers,$term_cause = 1,$stop_t /* Release the ruleno so it can be reallocated to new clients. */ captiveportal_free_ipfw_ruleno($dbent[1]); + + // XMLRPC Call over to the master Voucher node + $a_voucher = &$config['voucher']; + if(!empty($a_voucher['vouchersyncdbip'])) { + $syncip = $a_voucher['vouchersyncdbip']; + $syncport = $a_voucher['vouchersyncport']; + $syncpass = $a_voucher['vouchersyncpass']; + $vouchersyncusername = $a_voucher['vouchersyncusername']; + $remote_status = xmlrpc_sync_voucher_disconnect($dben, $syncip, $syncport, $syncpass, $vouchersyncusername, $term_cause, $stop_time); + } + } /* remove a single client by sessionid */ diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index 3b34e93c3d..f4b5e1ba1f 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -37,6 +37,54 @@ if(!function_exists('captiveportal_syslog')) require_once("captiveportal.inc"); +function xmlrpc_sync_voucher_disconnect($dbent, $syncip, $port, $password, $username, $term_cause = "1", $stop_time = null) { + global $g, $config; + require_once("xmlrpc.inc"); + if($port == "443") + $url = "https://{$syncip}:{$port}"; + else + $url = "http://{$syncip}:{$port}"; + + /* Construct code that is run on remote machine */ + $method = 'pfsense.exec_php'; + $execcmd = <<setCredentials($username, $password); + $resp = $cli->send($msg, "250"); + if(!is_object($resp)) { + $error = "A communications error occurred while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; + log_error($error); + file_notice("CaptivePortalVoucherSync", $error, "Communications error occurred", ""); + return false; + } elseif($resp->faultCode()) { + $error = "An error code was received while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + log_error($error); + file_notice("CaptivePortalVoucherSync", $error, "Error code received", ""); + return false; + } else { + log_error("CaptivePortalVoucherSync XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); + } + + $toreturn = XML_RPC_Decode($resp->value()); + + return $toreturn; +} + function xmlrpc_sync_used_voucher($voucher_received, $syncip, $port, $password, $username) { global $g, $config; require_once("xmlrpc.inc"); From 9634e95bc2e1f1509b46cfcdd5439f487ab8face Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 24 Mar 2011 12:59:20 +0000 Subject: [PATCH 29/34] Correct wrong comment. --- etc/inc/captiveportal.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index f8c0ccd87e..f19e2fb4a8 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -684,7 +684,7 @@ EOD; if ($reinit == false) unlock($captiveportallck); - /* filter on layer2 as well so we can check MAC addresses */ + /* activate ipfw(4) so CP can work */ mwexec("/sbin/sysctl net.link.ether.ipfw=1"); return $cprules; From 2279a5878279289f4d120e49e4b96a754f0a03bb Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 24 Mar 2011 15:27:52 +0000 Subject: [PATCH 30/34] Try to not stomp rule to each other. Reported-by: http://forum.pfsense.org/index.php/topic,34787.msg180186.html#msg180186 --- etc/inc/captiveportal.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index f19e2fb4a8..7e93f464eb 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -1389,7 +1389,7 @@ function captiveportal_get_next_ipfw_ruleno($rulenos_start = 2000, $rulenos_rang * and the out pipe ruleno + 1. This removes limitation that where present in * previous version of the peruserbw. */ - if (isset($config['captiveportal']['peruserbw'])) + if (isset($config['captiveportal']['peruserbw']) || $usebw == true) $ridx++; continue; } From c8703797e5c24e6619ad14819fc62b3cb8a6ae3d Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 24 Mar 2011 17:34:26 +0000 Subject: [PATCH 31/34] Do not write ont rules anymore max-packets. This apparently was done by me in a previous commit, it helps with Ticket #636. --- etc/inc/filter.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 41e3708d22..18f2d667e6 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1881,7 +1881,7 @@ function filter_generate_user_rule($rule) { } else $aline['flags'] .= "keep state "; - if($noadvoptions == false || $l7_present) + if($noadvoptions == false) if( (isset($rule['source-track']) and $rule['source-track'] <> "") or (isset($rule['max']) and $rule['max'] <> "") or (isset($rule['max-src-nodes']) and $rule['max-src-nodes'] <> "") or @@ -1890,7 +1890,7 @@ function filter_generate_user_rule($rule) { (isset($rule['max-src-conn-rates']) and $rule['max-src-conn-rates'] <> "") or (isset($rule['max-src-states']) and $rule['max-src-states'] <> "") or (isset($rule['statetimeout']) and $rule['statetimeout'] <> "") or - isset($rule['sloppy']) or $l7_present) { + isset($rule['sloppy'])) { $aline['flags'] .= "( "; if (isset($rule['sloppy'])) $aline['flags'] .= "sloppy "; From 24143605f1c1f5e578611b00f5193c564874b583 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 24 Mar 2011 18:34:19 -0400 Subject: [PATCH 32/34] Note that disabling does not survive a reboot --- usr/local/www/carp_status.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/carp_status.php b/usr/local/www/carp_status.php index 187736b880..12b8be9912 100755 --- a/usr/local/www/carp_status.php +++ b/usr/local/www/carp_status.php @@ -68,7 +68,7 @@ if($_POST['disablecarp'] <> "") { } } } - $savemsg = sprintf(gettext("%s IPs have been disabled."), $carp_counter); + $savemsg = sprintf(gettext("%s IPs have been disabled. Please note that disabling does not survive a reboot."), $carp_counter); } else { $savemsg = gettext("CARP has been enabled."); mwexec("/sbin/sysctl net.inet.carp.allow=1"); From 94aa3d215ab1290aab59549f709d69d83a8ff911 Mon Sep 17 00:00:00 2001 From: Warren Baker Date: Fri, 25 Mar 2011 10:58:08 +0200 Subject: [PATCH 33/34] Remove legacy Bogons Privileges page and add Tables to Privileges. --- etc/inc/priv.defs.inc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/etc/inc/priv.defs.inc b/etc/inc/priv.defs.inc index 74cd92fb72..c284f1f764 100644 --- a/etc/inc/priv.defs.inc +++ b/etc/inc/priv.defs.inc @@ -198,6 +198,12 @@ $priv_list['page-diagnostics-traceroute']['descr'] = "Allow access to the 'Diagn $priv_list['page-diagnostics-traceroute']['match'] = array(); $priv_list['page-diagnostics-traceroute']['match'][] = "diag_traceroute.php*"; +$priv_list['page-diagnostics-traceroute'] = array(); +$priv_list['page-diagnostics-traceroute']['name'] = "WebCfg - Diagnostics: Tables page"; +$priv_list['page-diagnostics-traceroute']['descr'] = "Allow access to the 'Diagnostics: Tables' page."; +$priv_list['page-diagnostics-traceroute']['match'] = array(); +$priv_list['page-diagnostics-traceroute']['match'][] = "diag_tables.php*"; + $priv_list['page-diagnostics-command'] = array(); $priv_list['page-diagnostics-command']['name'] = "WebCfg - Diagnostics: Command page"; $priv_list['page-diagnostics-command']['descr'] = "Allow access to the 'Diagnostics: Command' page."; @@ -1111,12 +1117,6 @@ $priv_list['page-system-groupmanager']['descr'] = "Allow access to the 'System: $priv_list['page-system-groupmanager']['match'] = array(); $priv_list['page-system-groupmanager']['match'][] = "system_groupmanager.php*"; -$priv_list['page-diag-showbogons'] = array(); -$priv_list['page-diag-showbogons']['name'] = "WebCfg - Diagnostics: Show Bogonsity"; -$priv_list['page-diag-showbogons']['descr'] = "Allows access to the 'Diagnostics: Show Bogons' page"; -$priv_list['page-diag-showbogons']['match'] = array(); -$priv_list['page-diag-showbogons']['match'][] = "diag_showbogons.php"; - $priv_list['page-status-trafficgraph'] = array(); $priv_list['page-status-trafficgraph']['name'] = "WebCfg - Status: Traffic Graph page"; $priv_list['page-status-trafficgraph']['descr'] = "Allow access to the 'Status: Traffic Graph' page."; From d93ee937f2305f06148d972be92224a2a52ba9e5 Mon Sep 17 00:00:00 2001 From: Warren Baker Date: Fri, 25 Mar 2011 11:00:50 +0200 Subject: [PATCH 34/34] Make sure to uses 'tables' in array. --- etc/inc/priv.defs.inc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/etc/inc/priv.defs.inc b/etc/inc/priv.defs.inc index c284f1f764..941120c3d4 100644 --- a/etc/inc/priv.defs.inc +++ b/etc/inc/priv.defs.inc @@ -198,11 +198,11 @@ $priv_list['page-diagnostics-traceroute']['descr'] = "Allow access to the 'Diagn $priv_list['page-diagnostics-traceroute']['match'] = array(); $priv_list['page-diagnostics-traceroute']['match'][] = "diag_traceroute.php*"; -$priv_list['page-diagnostics-traceroute'] = array(); -$priv_list['page-diagnostics-traceroute']['name'] = "WebCfg - Diagnostics: Tables page"; -$priv_list['page-diagnostics-traceroute']['descr'] = "Allow access to the 'Diagnostics: Tables' page."; -$priv_list['page-diagnostics-traceroute']['match'] = array(); -$priv_list['page-diagnostics-traceroute']['match'][] = "diag_tables.php*"; +$priv_list['page-diagnostics-tables'] = array(); +$priv_list['page-diagnostics-tables']['name'] = "WebCfg - Diagnostics: Tables page"; +$priv_list['page-diagnostics-tables']['descr'] = "Allow access to the 'Diagnostics: Tables' page."; +$priv_list['page-diagnostics-tables']['match'] = array(); +$priv_list['page-diagnostics-tables']['match'][] = "diag_tables.php*"; $priv_list['page-diagnostics-command'] = array(); $priv_list['page-diagnostics-command']['name'] = "WebCfg - Diagnostics: Command page";

Name		"; diff --git a/usr/local/www/firewall_shaper_vinterface.php b/usr/local/www/firewall_shaper_vinterface.php index 5222771bca..fae5429964 100644 --- a/usr/local/www/firewall_shaper_vinterface.php +++ b/usr/local/www/firewall_shaper_vinterface.php @@ -72,7 +72,7 @@ if ($_POST) { if ($_POST['name']) $qname = htmlspecialchars(trim($_POST['name'])); else if ($_POST['newname']) - $qname = htmlspecialchars(trim($_POST['name'])); + $qname = htmlspecialchars(trim($_POST['newname'])); if ($_POST['pipe']) $pipe = htmlspecialchars(trim($_POST['pipe'])); else From c46ee61fbce7146030318d21f3a6247edf8223ec Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 22 Mar 2011 19:10:21 +0000 Subject: [PATCH 23/34] Unbreak adding subqueues to queues also. This has happened after allowing renaming, oops. --- etc/inc/shaper.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc index 493e278f30..9c8618a862 100644 --- a/etc/inc/shaper.inc +++ b/etc/inc/shaper.inc @@ -961,7 +961,9 @@ class priq_queue { $input_errors[] = "Queue limit must be an integer"; if ($data['qlimit'] < 0) $input_errors[] = "Queue limit must be positive"; - if (!preg_match("/^[a-zA-Z0-9_-]*$/", $data['name'])) + if (!empty($data['newname']) && !preg_match("/^[a-zA-Z0-9_-]*$/", $data['newname'])) + $input_errors[] = "Queue names must be alphanumeric and _ or - only."; + if (!empty($data['name']) && !preg_match("/^[a-zA-Z0-9_-]*$/", $data['name'])) $input_errors[] = "Queue names must be alphanumeric and _ or - only."; } From c1ac2424d2be67d363c100120616f24e15f96a05 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 22 Mar 2011 20:19:16 +0000 Subject: [PATCH 24/34] Actually remove the pid file before starting a new miniupnpd since it seems to not like it. Log provided on:http://forum.pfsense.org/index.php/topic,33371.msg180084.html#msg180084 --- etc/inc/services.inc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 1a030216cc..314a891c74 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -1304,10 +1304,13 @@ function configure_cron() { function upnp_action ($action) { switch($action) { case "start": - if(file_exists('/var/etc/miniupnpd.conf')) - mwexec_bg('/usr/local/sbin/miniupnpd -f /var/etc/miniupnpd.conf'); + if (file_exists('/var/etc/miniupnpd.conf')) { + @unlink("{$g['varrun_path']}/miniupnpd.pid"); + mwexec_bg("/usr/local/sbin/miniupnpd -f /var/etc/miniupnpd.conf -P {$g['varrun_path']}/miniupnpd.pid"); + } break; case "stop": + killbypid("{$g['varrun_path']}/miniupnpd.pid"); while((int)exec("/bin/pgrep -a miniupnpd | wc -l") > 0) mwexec('killall miniupnpd 2>/dev/null', true); mwexec('/sbin/pfctl -aminiupnpd -Fr 2>&1 >/dev/null'); From 084e77e775bae15e92076297fbf7a8cf5c9b2b51 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Tue, 22 Mar 2011 20:36:10 -0400 Subject: [PATCH 25/34] fix text --- usr/local/www/vpn_pptp.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/vpn_pptp.php b/usr/local/www/vpn_pptp.php index 84f402037d..5be5e6e3d3 100755 --- a/usr/local/www/vpn_pptp.php +++ b/usr/local/www/vpn_pptp.php @@ -342,7 +342,7 @@ function enable_change(enable_over) { } ?> -
+