mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:bsdperimeter/pfsense

Browse Source
This commit is contained in:
Chris Buechler 2011-07-29 03:14:58 -04:00
commit 32363c2efd
26 changed files with 598 additions and 435 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
etc/inc/filter.inc
View File

@ -183,7 +183,7 @@ function filter_delete_states_for_down_gateways() {
}
/* reload filter sync */
function filter_configure_sync() {
function filter_configure_sync($delete_states_if_needed = true) {
global $config, $g, $after_filter_configure_run, $FilterIflist;
global $time_based_rules, $filterdns, $aliases;
@ -397,8 +397,10 @@ function filter_configure_sync() {
if($g['booting'] == true)
echo ".";
update_filter_reload_status(gettext("Processing down interface states"));
filter_delete_states_for_down_gateways();
if($delete_states_if_needed) {
update_filter_reload_status(gettext("Processing down interface states"));
filter_delete_states_for_down_gateways();
}
update_filter_reload_status(gettext("Running plugins"));
@ -1400,7 +1402,10 @@ function filter_nat_rules_generate() {
}
/* PPTP subnet */
if(($config['pptpd']['mode'] == "server" ) && is_private_ip($config['pptpd']['remoteip'])) {
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1)));
if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units']))
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1)));
else
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])));
$numberofnathosts += count($pptp_subnets);
$tonathosts .= implode(" ", $pptp_subnets) . " ";
}
@ -1763,9 +1768,13 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) {
$src = "{$lansa}/{$lansn}";
break;
case 'pptp':
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1)));
if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units']))
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1)));
else
$pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])));
if (empty($pptp_subnets))
return "";
$src = "{ " . implode(" ", $pptp_subnets) . " }";
$src = "{$pptpsa}/{$pptpsn}";
break;
case 'pppoe':
/* XXX: This needs to be fixed somehow! */
@ -1912,7 +1921,7 @@ function filter_generate_user_rule($rule) {
update_filter_reload_status(sprintf(gettext("Setting up pass/block rules %s"), $rule['descr']));
/* do not process reply-to for gateway'd rules */
if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto'])) {
if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto']) && $type != "match") {
if($rule['ipprotocol'] == "inet6") {
$rg = get_interface_gateway_v6($rule['interface']);
if(is_ipaddrv6($rg)) {

25
etc/inc/gwlb.inc
View File

@ -137,6 +137,9 @@ target default {
EOD;
foreach($gateways_arr as $name => $gateway) {
/* Do not monitor if such was requested */
if (isset($gateway['monitor_disable']))
continue;
if (empty($gateway['monitor']) || !is_ipaddr($gateway['monitor'])) {
if (is_ipaddr($gateway['gateway']))
$gateway['monitor'] = $gateway['gateway'];
@ -157,6 +160,8 @@ EOD;
$apingercfg = "target \"{$gateway['monitor']}\" {\n";
$apingercfg .= " description \"{$name}\"\n";
$apingercfg .= " srcip \"{$gwifip}\"\n";
if (!empty($gateway['interval']) && intval($gateway['interval']) > 1)
$apingercfg .= " interval " . intval($gateway['interval']) . "s\n";
$alarms = "";
$alarmscfg = "";
$override = false;
@ -216,8 +221,7 @@ EOD;
*/
if (is_ipaddr($gateway['gateway']) && $gateway['monitor'] != $gateway['gateway']) {
log_error(sprintf(gettext('Removing static route for monitor %1$s and adding a new route through %2$s'), $gateway['monitor'], $gateway['gateway']));
mwexec("/sbin/route delete -host " . escapeshellarg($gateway['monitor']), true);
mwexec("/sbin/route add -host " . escapeshellarg($gateway['monitor']) .
mwexec("/sbin/route change -host " . escapeshellarg($gateway['monitor']) .
" " . escapeshellarg($gateway['gateway']), true);
}
@ -288,7 +292,9 @@ function return_gateways_array($disabled = false) {
$gateway['gateway'] = "dynamic";
$gateway['dynamic'] = true;
}
if(empty($gateway['monitor']))
if (isset($gateway['monitor_disable']))
$gateway['monitor_disable'] = true;
else if (empty($gateway['monitor']))
$gateway['monitor'] = $gateway['gateway'];
$gateway['friendlyiface'] = $gateway['interface'];
@ -384,18 +390,18 @@ function return_gateway_groups_array() {
if (isset($gwsttng['defaultgw'])) {
$dfltgwfound = true;
$dfltgwname = $gwname;
if (stristr($gateways_status[$gwname]['status'], "down"))
if (!isset($gwsttng['monitor_disable']) && stristr($gateways_status[$gwname]['status'], "down"))
$dfltgwdown = true;
}
/* Keep a record of the last up gateway */
if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down"))
if (empty($upgw) && (isset($gwsttng['monitor_disable']) || !stristr($gateways_status[$gwname]['status'], "down")))
$upgw = $gwname;
if ($dfltgwdown == true && !empty($upgw))
break;
}
if ($dfltgwfound == false) {
$gwname = convert_friendly_interface_to_friendly_descr("wan");
if (stristr($gateways_status[$gwname]['status'], "down"))
if (!empty($gateways_status[$gwname]) && stristr($gateways_status[$gwname]['status'], "down"))
$dfltgwdown = true;
}
if ($dfltgwdown == true && !empty($upgw)) {
@ -403,12 +409,12 @@ function return_gateway_groups_array() {
$gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']);
if (is_ipaddr($gateways_arr[$upgw]['gateway'])) {
log_error("Default gateway down setting {$upgw} as default!");
mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}");
mwexec("/sbin/route change -inet default {$gateways_arr[$upgw]['gateway']}");
}
} else {
$defaultgw = trim(`/sbin/route -n get -inet default | /usr/bin/grep gateway | /usr/bin/sed 's/gateway://g'`, " \n");
if ($defaultgw != $gateways_arr[$dfltgwname]['gateway'])
mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$dfltgwname]['gateway']}");
mwexec("/sbin/route change -inet default {$gateways_arr[$dfltgwname]['gateway']}");
}
unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng);
@ -450,7 +456,8 @@ function return_gateway_groups_array() {
} else
/* Online add member */
$tiers[$tier][] = $gwname;
}
} else if (isset($gateways_arr[$gwname]['monitor_disable']))
$tiers[$tier][] = $gwname;
}
$tiers_count = count($tiers);
if($tiers_count == 0) {

290
etc/inc/openvpn.inc
View File

@ -774,18 +774,20 @@ function openvpn_resync_all($interface = "") {
}
function openvpn_get_active_servers() {
function openvpn_get_active_servers($type="ssl") {
global $config, $g;
$servers = array();
if (is_array($config['openvpn']['openvpn-server'])) {
foreach ($config['openvpn']['openvpn-server'] as & $settings) {
if (empty($settings) || isset($settings['disable']))
continue;
$prot = $settings['protocol'];
$port = $settings['local_port'];
$server = array();
$server['port'] = $settings['local_port'];
$server['port'] = ($settings['local_port']) ? $settings['local_port'] : 1194;
$server['mode'] = $settings['mode'];
if ($settings['description'])
$server['name'] = "{$settings['description']} {$prot}:{$port}";
@ -794,71 +796,75 @@ function openvpn_get_active_servers() {
$server['conns'] = array();
$vpnid = $settings['vpnid'];
$mode_id = "server{$vpnid}";
$mode_id = "server{$vpnid}";
$server['mgmt'] = $mode_id;
$tcpsrv = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock";
$errval;
$errstr;
/* open a tcp connection to the management port of each server */
$fp = @stream_socket_client($tcpsrv, $errval, $errstr, 1);
if ($fp) {
stream_set_timeout($fp, 1);
/* send our status request */
fputs($fp, "status 2\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
/* parse header list line */
if (strstr($line, "HEADER"))
continue;
/* parse end of output line */
if (strstr($line, "END") || strstr($line, "ERROR"))
break;
/* parse client list line */
if (strstr($line, "CLIENT_LIST")) {
$list = explode(",", $line);
$conn = array();
$conn['common_name'] = $list[1];
$conn['remote_host'] = $list[2];
$conn['virtual_addr'] = $list[3];
$conn['bytes_recv'] = $list[4];
$conn['bytes_sent'] = $list[5];
$conn['connect_time'] = $list[6];
$server['conns'][] = $conn;
}
}
/* cleanup */
fclose($fp);
} else {
$conn = array();
$conn['common_name'] = "[error]";
$conn['remote_host'] = "Management Daemon Unreachable";
$conn['virtual_addr'] = "";
$conn['bytes_recv'] = 0;
$conn['bytes_sent'] = 0;
$conn['connect_time'] = 0;
$server['conns'][] = $conn;
}
$servers[] = $server;
$socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock";
if (($server['mode'] == "p2p_shared_key") && ($type == "sharedkey"))
$servers[] = openvpn_get_client_status($server, $socket);
elseif (($server['mode'] != "p2p_shared_key") && ($type == "ssl"))
$servers[] = openvpn_get_server_status($server, $socket);
}
}
return $servers;
}
function openvpn_get_server_status($server, $socket) {
$errval;
$errstr;
$fp = @stream_socket_client($socket, $errval, $errstr, 1);
if ($fp) {
stream_set_timeout($fp, 1);
/* send our status request */
fputs($fp, "status 2\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
/* parse header list line */
if (strstr($line, "HEADER"))
continue;
/* parse end of output line */
if (strstr($line, "END") || strstr($line, "ERROR"))
break;
/* parse client list line */
if (strstr($line, "CLIENT_LIST")) {
$list = explode(",", $line);
$conn = array();
$conn['common_name'] = $list[1];
$conn['remote_host'] = $list[2];
$conn['virtual_addr'] = $list[3];
$conn['bytes_recv'] = $list[4];
$conn['bytes_sent'] = $list[5];
$conn['connect_time'] = $list[6];
$server['conns'][] = $conn;
}
}
/* cleanup */
fclose($fp);
} else {
$conn = array();
$conn['common_name'] = "[error]";
$conn['remote_host'] = "Management Daemon Unreachable";
$conn['virtual_addr'] = "";
$conn['bytes_recv'] = 0;
$conn['bytes_sent'] = 0;
$conn['connect_time'] = 0;
$server['conns'][] = $conn;
}
return $server;
}
function openvpn_get_active_clients() {
global $config, $g;
@ -866,100 +872,104 @@ function openvpn_get_active_clients() {
if (is_array($config['openvpn']['openvpn-client'])) {
foreach ($config['openvpn']['openvpn-client'] as & $settings) {
if (empty($settings) || isset($settings['disable']))
continue;
$prot = $settings['protocol'];
$port = $settings['local_port'];
$port = ($settings['local_port']) ? ":{$settings['local_port']}" : "";
$client = array();
$client['port'] = $settings['local_port'];
if ($settings['description'])
$client['name'] = "{$settings['description']} {$prot}:{$port}";
$client['name'] = "{$settings['description']} {$prot}{$port}";
else
$client['name'] = "Client {$prot}:{$port}";
$client['name'] = "Client {$prot}{$port}";
$vpnid = $settings['vpnid'];
$mode_id = "client{$vpnid}";
$mode_id = "client{$vpnid}";
$client['mgmt'] = $mode_id;
$tcpcli = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock";
$errval;
$errstr;
$socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock";
$client['status']="down";
/* open a tcp connection to the management port of each cli */
$fp = @stream_socket_client($tcpcli, $errval, $errstr, 1);
if ($fp) {
stream_set_timeout($fp, 1);
/* send our status request */
fputs($fp, "state 1\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
/* Get the client state */
if (strstr($line,"CONNECTED")) {
$client['status']="up";
$list = explode(",", $line);
$client['connect_time'] = date("D M j G:i:s Y", $list[0]);
$client['virtual_addr'] = $list[3];
$client['remote_host'] = $list[4];
}
/* parse end of output line */
if (strstr($line, "END") || strstr($line, "ERROR"))
break;
}
/* If up, get read/write stats */
if (strcmp($client['status'], "up") == 0) {
fputs($fp, "status 2\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
if (strstr($line,"TCP/UDP read bytes")) {
$list = explode(",", $line);
$client['bytes_recv'] = $list[1];
}
if (strstr($line,"TCP/UDP write bytes")) {
$list = explode(",", $line);
$client['bytes_sent'] = $list[1];
}
/* parse end of output line */
if (strstr($line, "END"))
break;
}
}
fclose($fp);
} else {
$DisplayNote=true;
$client['remote_host'] = "No Management Daemon";
$client['virtual_addr'] = "See Note Below";
$client['bytes_recv'] = 0;
$client['bytes_sent'] = 0;
$client['connect_time'] = 0;
}
$clients[] = $client;
$clients[] = openvpn_get_client_status($client, $socket);
}
}
return $clients;
}
function openvpn_get_client_status($client, $socket) {
$errval;
$errstr;
$fp = @stream_socket_client($socket, $errval, $errstr, 1);
if ($fp) {
stream_set_timeout($fp, 1);
/* send our status request */
fputs($fp, "state 1\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
/* Get the client state */
if (strstr($line,"CONNECTED")) {
$client['status']="up";
$list = explode(",", $line);
$client['connect_time'] = date("D M j G:i:s Y", $list[0]);
$client['virtual_addr'] = $list[3];
$client['remote_host'] = $list[4];
}
/* parse end of output line */
if (strstr($line, "END") || strstr($line, "ERROR"))
break;
}
/* If up, get read/write stats */
if (strcmp($client['status'], "up") == 0) {
fputs($fp, "status 2\n");
/* recv all response lines */
while (!feof($fp)) {
/* read the next line */
$line = fgets($fp, 1024);
$info = stream_get_meta_data($fp);
if ($info['timed_out'])
break;
if (strstr($line,"TCP/UDP read bytes")) {
$list = explode(",", $line);
$client['bytes_recv'] = $list[1];
}
if (strstr($line,"TCP/UDP write bytes")) {
$list = explode(",", $line);
$client['bytes_sent'] = $list[1];
}
/* parse end of output line */
if (strstr($line, "END"))
break;
}
}
fclose($fp);
} else {
$DisplayNote=true;
$client['remote_host'] = "No Management Daemon";
$client['virtual_addr'] = "See Note Below";
$client['bytes_recv'] = 0;
$client['bytes_sent'] = 0;
$client['connect_time'] = 0;
}
return $client;
}
function openvpn_refresh_crls() {
global $g, $config;

59
etc/inc/system.inc
View File

@ -31,7 +31,7 @@
/*
pfSense_BUILDER_BINARIES: /usr/sbin/powerd /usr/bin/killall /sbin/sysctl /sbin/route
pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/bin/netstat /usr/sbin/syslogd
pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/sbin/syslogd
pfSense_BUILDER_BINARIES: /usr/sbin/pccardd /usr/local/sbin/lighttpd /bin/chmod /bin/mkdir
pfSense_BUILDER_BINARIES: /usr/bin/tar /usr/local/sbin/ntpd /usr/sbin/ntpdate
pfSense_BUILDER_BINARIES: /usr/bin/nohup /sbin/dmesg /usr/local/sbin/atareinit /sbin/kldload
@ -144,11 +144,10 @@ function system_resolvconf_generate($dynupdate = false) {
$interface = $config['system'][$dnsgw];
if (($interface <> "") && ($interface <> "none")) {
$gatewayip = get_interface_gateway($interface);
if(is_ipaddr($gatewayip)) {
if (is_ipaddr($gatewayip)) {
/* dns server array starts at 0 */
$dnscountermo = $dnscounter - 1;
mwexec("route delete -host {$syscfg['dnsserver'][$dnscountermo]}", true);
mwexec("route add -host {$syscfg['dnsserver'][$dnscountermo]} {$gatewayip}");
mwexec("route change -host " . $syscfg['dnsserver'][$dnscountermo] . " {$gatewayip}");
}
}
}
@ -398,53 +397,20 @@ function system_routing_configure($interface = "") {
}
}
}
/* Create a array from the existing inet route table */
exec("/usr/bin/netstat -rnf inet", $route_str);
array_shift($route_str);
array_shift($route_str);
array_shift($route_str);
array_shift($route_str);
$route_arr = array();
foreach($route_str as $routeline) {
$items = preg_split("/[ ]+/i", $routeline);
$route_arr[$items[0]] = array($items[0], $items[1], $items[5]);
}
if ($dont_add_route == false ) {
if (!empty($interface) && $interface != $interfacegw)
;
else if (($interfacegw <> "bgpd") && (is_ipaddrv4($gatewayip))) {
$action = "add";
if(isset($route_arr['default'])) {
$action = "change";
}
log_error("ROUTING: $action default route to $gatewayip");
mwexec("/sbin/route {$action} -inet default " . escapeshellarg($gatewayip));
log_error("ROUTING: setting default route to $gatewayip");
mwexec("/sbin/route change -inet default " . escapeshellarg($gatewayip));
}
}
/* Create a array from the existing inet6 route table */
exec("/usr/bin/netstat -rnf inet6", $routev6_str);
array_shift($routev6_str);
array_shift($routev6_str);
array_shift($routev6_str);
array_shift($routev6_str);
$routev6_arr = array();
foreach($routev6_str as $routeline) {
$items = preg_split("/[ ]+/i", $routeline);
$routev6_arr[$items[0]] = array($items[0], $items[1], $items[5]);
}
if ($dont_add_route == false ) {
if (!empty($interface) && $interface != $interfacegwv6)
;
else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) {
$action = "add";
if(isset($routev6_arr['default'])) {
$action = "change";
}
log_error("ROUTING: $action IPv6 default route to $gatewayipv6");
mwexec("/sbin/route {$action} -inet6 default " . escapeshellarg($gatewayipv6));
log_error("ROUTING: setting IPv6 default route to $gatewayipv6");
mwexec("/sbin/route change -inet6 default " . escapeshellarg($gatewayipv6));
}
}
@ -463,9 +429,6 @@ function system_routing_configure($interface = "") {
$gatewayip = $gateway['gateway'];
$interfacegw = $gateway['interface'];
$action = "add";
if (isset($route_arr[$rtent['network']]))
$action = "change";
if(is_ipaddrv6($gatewayip)) {
$inetfamily = "-inet6";
@ -473,10 +436,10 @@ function system_routing_configure($interface = "") {
$inetfamily = "-inet";
}
if (is_ipaddr($gatewayip)) {
mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) .
mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) .
" " . escapeshellarg($gatewayip));
} else if (!empty($interfacegw)) {
mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) .
mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) .
" -iface " . escapeshellarg($interfacegw));
}
}
@ -867,7 +830,7 @@ function system_generate_lighty_config($filename,
$captive_portal_rewrite = "url.rewrite-once = ( \"(.*captiveportal.*)\" => \"$1\", \"(.*)\" => \"/index.php?redirurl=$1\" )\n";
$captive_portal_module = "";
$maxprocperip = $config['captiveportal']['maxprocperip'];
if(!$maxprocperip and $maxprocperip > 0)
if($maxprocperip and $maxprocperip > 0)
$captive_portal_mod_evasive = "evasive.max-conns-per-ip = {$maxprocperip}";
else
$captive_portal_mod_evasive = "";
@ -1376,7 +1339,7 @@ function system_reboot_cleanup() {
captiveportal_radius_stop_all();
require_once("voucher.inc");
voucher_save_db_to_config();
// mwexec("/etc/rc.stop_packages");
mwexec("/etc/rc.stop_packages");
}
function system_do_shell_commands($early = 0) {

52
etc/inc/vpn.inc
View File

@ -35,7 +35,7 @@
/*
pfSense_BUILDER_BINARIES: /usr/bin/killall /usr/local/sbin/sasyncd /sbin/ifconfig /sbin/sysctl
pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /usr/bin/netstat /sbin/route /bin/mkdir
pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /sbin/route /bin/mkdir
pfSense_BUILDER_BINARIES: /usr/local/sbin/racoonctl /usr/local/sbin/racoon
pfSense_BUILDER_BINARIES: /usr/local/sbin/filterdns /usr/local/sbin/mpd4
pfSense_MODULE: vpn
@ -126,10 +126,6 @@ function vpn_ipsec_configure($ipchg = false)
/* fastforwarding is not compatible with ipsec tunnels */
mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0");
/* this loads a route table which is used to determine if a route needs to be removed. */
exec("/usr/bin/netstat -rnf inet", $route_arr, $retval);
$route_str = implode("\n", $route_arr);
/* resolve all local, peer addresses and setup pings */
$ipmap = array();
$rgmap = array();
@ -419,6 +415,31 @@ function vpn_ipsec_configure($ipchg = false)
$racoonconf .= "}\n\n";
}
/* end mode_cfg section */
if ($a_client['user_source'] != "system") {
if (is_array($config['system']['authserver'])) {
foreach ($config['system']['authserver'] as $authcfg) {
if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source'])
$thisauthcfg = $authcfg;
}
/* begin ldapcfg */
$racoonconf .= "ldapcfg {\n";
$racoonconf .= "\tversion 3;\n";
$racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n";
$lport = "389";
if ($authcfg['port'] != "")
$lport = $authcfg['port'];
$racoonconf .= "\tport ".$lport.";\n";
$racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n";
$racoonconf .= "\tsubtree on;\n";
$racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n";
$racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n";
$racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n";
$racoonconf .= "}\n\n";
/* end ldapcfg */
}
}
/* begin remote sections */
if (is_array($a_phase1) && count($a_phase1)) {
@ -894,15 +915,12 @@ EOD;
/* FIXME: does adding route-to and reply-to on the in/outbound
* rules fix this? smos@ 13-01-2009 */
// log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
mwexec("/sbin/route delete -host {$rgip}; /sbin/route add -host {$rgip} {$gatewayip}", true);
mwexec("/sbin/route change -host {$rgip} {$gatewayip}", true);
}
}
}
} elseif(is_ipaddr($rgip)) {
if(stristr($route_str, "{$rgip}")) {
mwexec("/sbin/route delete -host {$rgip}", true);
}
}
} else if(is_ipaddr($rgip))
mwexec("/sbin/route delete -host {$rgip}", true);
}
fwrite($fd, $spdconf);
@ -1043,6 +1061,11 @@ function vpn_pptpd_configure() {
unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.secret");
}
if (empty($pptpdcfg['n_pptp_units'])) {
log_error("Something wrong in the PPTPd configuration. Preventing starting the daemon because issues would arise.");
return;
}
/* make sure pptp-vpn directory exists */
if (!file_exists("{$g['varetc_path']}/pptp-vpn"))
mkdir("{$g['varetc_path']}/pptp-vpn");
@ -1196,8 +1219,11 @@ EOD;
$mpdsecret = "";
if (is_array($pptpdcfg['user'])) {
foreach ($pptpdcfg['user'] as $user)
$mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n";
foreach ($pptpdcfg['user'] as $user) {
$pass = str_replace('\\', '\\\\', $user['password']);
$pass = str_replace('"', '\"', $pass);
$mpdsecret .= "{$user['name']} \"{$pass}\" {$user['ip']}\n";
}
}
fwrite($fd, $mpdsecret);

4
etc/rc
View File

@ -88,6 +88,10 @@ if grep -q cf /etc/fstab; then
(/sbin/umount /cf; /sbin/fsck -fy /cf; /sbin/mount -w /cf)
fi
# sync pw database after mount.
rm -f /etc/spwd.db.tmp
/usr/sbin/pwd_mkdb -d /etc/ /etc/master.passwd
product=`/usr/bin/grep product_name /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4`
hideplatform=`/usr/bin/grep hideplatform /etc/inc/globals.inc | /usr/bin/wc -l`
varrunpath=`/usr/bin/grep varrun_path /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4`

5
etc/rc.stop_packages
View File

@ -1,4 +1,6 @@
#!/usr/local/bin/php -f
#!/bin/sh
/usr/local/bin/php -q <<ENDPHP
<?php
/* $Id$ */
/*
@ -69,3 +71,4 @@ if ($shell) {
pclose($shell);
}
?>
ENDPHP

6
usr/local/sbin/ppp-linkup
View File

@ -10,14 +10,12 @@ if [ $ALLOWOVERRIDE -gt 0 ]; then
# write nameservers to file
if [ $6 = "dns1" ]; then
echo $7 > /var/etc/nameserver_$1
/sbin/route delete $7
/sbin/route add $7 $4
/sbin/route change $7 $4
fi
if [ $8 = "dns2" ]; then
echo $9 >> /var/etc/nameserver_$1
/sbin/route delete $9
/sbin/route add $9 $4
/sbin/route change $9 $4
fi
/usr/local/sbin/pfSctl -c 'service reload dns'
/bin/sleep 1

6
usr/local/sbin/vpn-linkdown
View File

@ -2,4 +2,8 @@
# record logout
/usr/bin/logger -p local3.info "logout,$1,$4,$5"
/sbin/pfctl -b $3/32 -b $4/32
/sbin/pfctl -b 0.0.0.0/32 -b $4/32
/sbin/pfctl -k $4/32
/sbin/pfctl -k 0.0.0.0/32 $4/32
/sbin/pfctl -K $4/32
/sbin/pfctl -K 0.0.0.0/32 -K $4/32

344
usr/local/www/diag_packet_capture.php
View File

@ -109,185 +109,183 @@ include("fbegin.inc");
?>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr><td>
<form action="diag_packet_capture.php" method="post" name="iform" id="iform">
<table width="100%" border="0" cellpadding="6" cellspacing="0">
<tr>
<td>
<form action="diag_packet_capture.php" method="post" name="iform" id="iform">
<table width="100%" border="0" cellpadding="6" cellspacing="0">
<tr>
<td colspan="2" valign="top" class="listtopic"><?=gettext("Packet capture");?></td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Interface");?></td>
<td width="83%" class="vtable">
<select name="interface">
<td colspan="2" valign="top" class="listtopic"><?=gettext("Packet capture");?></td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Interface");?></td>
<td width="83%" class="vtable">
<select name="interface">
<?php
$interfaces = get_configured_interface_with_descr();
if (isset($config['ipsec']['enable']))
$interfaces['ipsec'] = "IPsec";
foreach (array('server', 'client') as $mode) {
if (is_array($config['openvpn']["openvpn-{$mode}"])) {
foreach ($config['openvpn']["openvpn-{$mode}"] as $id => $setting) {
if (!isset($setting['disable'])) {
$interfaces['ovpn' . substr($mode, 0, 1) . $setting['vpnid']] = gettext("OpenVPN") . " ".$mode.": ".htmlspecialchars($setting['description']);
}
}
$interfaces = get_configured_interface_with_descr();
if (isset($config['ipsec']['enable']))
$interfaces['ipsec'] = "IPsec";
foreach (array('server', 'client') as $mode) {
if (is_array($config['openvpn']["openvpn-{$mode}"])) {
foreach ($config['openvpn']["openvpn-{$mode}"] as $id => $setting) {
if (!isset($setting['disable'])) {
$interfaces['ovpn' . substr($mode, 0, 1) . $setting['vpnid']] = gettext("OpenVPN") . " ".$mode.": ".htmlspecialchars($setting['description']);
}
}
foreach ($interfaces as $iface => $ifacename): ?>
<option value="<?=$iface;?>" <?php if ($selectedif == $iface) echo "selected"; ?>>
<?php echo $ifacename;?>
</option>
<?php endforeach;?>
</select>
<br/><?=gettext("Select the interface on which to capture traffic.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Address Family");?></td>
<td width="83%" class="vtable">
<select name="fam">
<option value="">Any</option>
<option value="ip" <?php if ($fam == "ip") echo "selected"; ?>>IPv4 Only</option>
<option value="ip6" <?php if ($fam == "ip6") echo "selected"; ?>>IPv6 Only</option>
</select>
<br/><?=gettext("Select the type of traffic to be captured, either Any, IPv4 only or IPv6 only.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Host Address");?></td>
<td width="83%" class="vtable">
<input name="host" type="text" class="formfld host" id="host" size="20" value="<?=htmlspecialchars($host);?>">
<br/><?=gettext("This value is either the Source or Destination IP address or subnet in CIDR notation. The packet capture will look for this address in either field.");?>
<br/><?=gettext("This value can be a domain name or IP address, or subnet in CIDR notation.");?>
<br/><?=gettext("If you leave this field blank, all packets on the specified interface will be captured.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Port");?></td>
<td width="83%" class="vtable">
<input name="port" type="text" class="formfld unknown" id="port" size="5" value="<?=$port;?>">
<br/><?=gettext("The port can be either the source or destination port. The packet capture will look for this port in either field.");?>
<br/><?=gettext("Leave blank if you do not want to filter by port.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Packet Length");?></td>
<td width="83%" class="vtable">
<input name="snaplen" type="text" class="formfld unknown" id="snaplen" size="5" value="<?=$snaplen;?>">
<br/><?=gettext("The Packet length is the number of bytes of each packet that will be captured. Default value is 0, which will capture the entire frame regardless of its size.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Count");?></td>
<td width="83%" class="vtable">
<input name="count" type="text" class="formfld unknown" id="count" size="5" value="<?=$count;?>">
<br/><?=gettext("This is the number of packets the packet capture will grab. Default value is 100.") . "<br/>" . gettext("Enter 0 (zero) for no count limit.");?>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Level of Detail");?></td>
<td width="83%" class="vtable">
<select name="detail" type="text" class="formselect" id="detail" size="1">
<option value="-q" <?php if ($detail == "-q") echo "selected"; ?>><?=gettext("Normal");?></option>
<option value="-v" <?php if ($detail == "-v") echo "selected"; ?>><?=gettext("Medium");?></option>
<option value="-vv" <?php if ($detail == "-vv") echo "selected"; ?>><?=gettext("High");?></option>
<option value="-vv -e" <?php if ($detail == "-vv -e") echo "selected"; ?>><?=gettext("Full");?></option>
</select>
<br/><?=gettext("This is the level of detail that will be displayed after hitting 'Stop' when the packets have been captured.") . "<br/><b>" .
gettext("Note:") . "</b> " .
gettext("This option does not affect the level of detail when downloading the packet capture.");?>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Reverse DNS Lookup");?></td>
<td width="83%" class="vtable">
<input name="dnsquery" type="checkbox"<?php if($_POST['dnsquery']) echo " CHECKED"; ?>>
<br/><?=gettext("This check box will cause the packet capture to perform a reverse DNS lookup associated with all IP addresses.");?>
<br/><b><?=gettext("Note");?>: </b><?=gettext("This option can cause delays for large packet captures.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top">&nbsp;</td>
<td width="83%">
<?php
/* check to see if packet capture tcpdump is already running */
$processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'")));
if ($processcheck != "")
$processisrunning = true;
else
$processisrunning = false;
if (($action == gettext("Stop") or $action == "") and $processisrunning != true)
echo "<input type=\"submit\" name=\"startbtn\" value=\"" . gettext("Start") . "\">&nbsp;";
else {
echo "<input type=\"submit\" name=\"stopbtn\" value=\"" . gettext("Stop") . "\">&nbsp;";
}
if (file_exists($fp.$fn) and $processisrunning != true) {
echo "<input type=\"submit\" name=\"downloadbtn\" value=\"" . gettext("Download Capture") . "\">";
echo "&nbsp;&nbsp;(" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")";
}
?>
</td>
</tr>
<tr>
<td valign="top" colspan="2">
<?php
echo "<font face='terminal' size='2'>";
if ($processisrunning == true)
echo("<strong>" . gettext("Packet Capture is running.") . "</strong><br/>");
if ($do_tcpdump) {
$matches = array();
if (($fam == "ip6") || ($fam == "ip"))
$matches[] = $fam;
if ($port != "")
$matches[] = "port ".$port;
if ($host != "") {
if (is_ipaddr($host))
$matches[] = "host " . $host;
elseif (is_subnet($host))
$matches[] = "net " . $host;
}
if ($count != "0" ) {
$searchcount = "-c " . $count;
} else {
$searchcount = "";
}
$selectedif = convert_friendly_interface_to_real_interface_name($selectedif);
if ($action == gettext("Start")) {
$matchstr = implode($matches, " and ");
echo("<strong>" . gettext("Packet Capture is running.") . "</strong><br/>");
mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr");
// echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr";
} else {
//action = stop
echo("<strong>" . gettext("Packet Capture stopped.") . "<br/><br/>" . gettext("Packets Captured:") . "</strong><br/>");
?>
<textarea style="width:98%" name="code" rows="15" cols="66" wrap="off" readonly="readonly">
<?php
system ("/usr/sbin/tcpdump $disabledns $detail -r $fp$fn");
conf_mount_ro();
?>
</textarea>
<?php
}
}
?>
</td>
</tr>
<tr>
}
foreach ($interfaces as $iface => $ifacename): ?>
<option value="<?=$iface;?>" <?php if ($selectedif == $iface) echo "selected"; ?>>
<?php echo $ifacename;?>
</option>
<?php endforeach;?>
</select>
<br/><?=gettext("Select the interface on which to capture traffic.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Address Family");?></td>
<td width="83%" class="vtable">
<select name="fam">
<option value="">Any</option>
<option value="ip" <?php if ($fam == "ip") echo "selected"; ?>>IPv4 Only</option>
<option value="ip6" <?php if ($fam == "ip6") echo "selected"; ?>>IPv6 Only</option>
</select>
<br/><?=gettext("Select the type of traffic to be captured, either Any, IPv4 only or IPv6 only.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Host Address");?></td>
<td width="83%" class="vtable">
<input name="host" type="text" class="formfld host" id="host" size="20" value="<?=htmlspecialchars($host);?>">
<br/><?=gettext("This value is either the Source or Destination IP address or subnet in CIDR notation. The packet capture will look for this address in either field.");?>
<br/><?=gettext("This value can be a domain name or IP address, or subnet in CIDR notation.");?>
<br/><?=gettext("If you leave this field blank, all packets on the specified interface will be captured.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Port");?></td>
<td width="83%" class="vtable">
<input name="port" type="text" class="formfld unknown" id="port" size="5" value="<?=$port;?>">
<br/><?=gettext("The port can be either the source or destination port. The packet capture will look for this port in either field.");?>
<br/><?=gettext("Leave blank if you do not want to filter by port.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Packet Length");?></td>
<td width="83%" class="vtable">
<input name="snaplen" type="text" class="formfld unknown" id="snaplen" size="5" value="<?=$snaplen;?>">
<br/><?=gettext("The Packet length is the number of bytes of each packet that will be captured. Default value is 0, which will capture the entire frame regardless of its size.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Count");?></td>
<td width="83%" class="vtable">
<input name="count" type="text" class="formfld unknown" id="count" size="5" value="<?=$count;?>">
<br/><?=gettext("This is the number of packets the packet capture will grab. Default value is 100.") . "<br/>" . gettext("Enter 0 (zero) for no count limit.");?>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Level of Detail");?></td>
<td width="83%" class="vtable">
<select name="detail" type="text" class="formselect" id="detail" size="1">
<option value="-q" <?php if ($detail == "-q") echo "selected"; ?>><?=gettext("Normal");?></option>
<option value="-v" <?php if ($detail == "-v") echo "selected"; ?>><?=gettext("Medium");?></option>
<option value="-vv" <?php if ($detail == "-vv") echo "selected"; ?>><?=gettext("High");?></option>
<option value="-vv -e" <?php if ($detail == "-vv -e") echo "selected"; ?>><?=gettext("Full");?></option>
</select>
<br/><?=gettext("This is the level of detail that will be displayed after hitting 'Stop' when the packets have been captured.") . "<br/><b>" .
gettext("Note:") . "</b> " .
gettext("This option does not affect the level of detail when downloading the packet capture.");?>
</tr>
<tr>
<td width="17%" valign="top" class="vncellreq"><?=gettext("Reverse DNS Lookup");?></td>
<td width="83%" class="vtable">
<input name="dnsquery" type="checkbox"<?php if($_POST['dnsquery']) echo " CHECKED"; ?>>
<br/><?=gettext("This check box will cause the packet capture to perform a reverse DNS lookup associated with all IP addresses.");?>
<br/><b><?=gettext("Note");?>: </b><?=gettext("This option can cause delays for large packet captures.");?>
</td>
</tr>
<tr>
<td width="17%" valign="top">&nbsp;</td>
<td width="83%">
<?php
</table>
</form>
</td>
</tr>
/* check to see if packet capture tcpdump is already running */
$processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'")));
if ($processcheck != "")
$processisrunning = true;
else
$processisrunning = false;
if (($action == gettext("Stop") or $action == "") and $processisrunning != true)
echo "<input type=\"submit\" name=\"startbtn\" value=\"" . gettext("Start") . "\">&nbsp;";
else {
echo "<input type=\"submit\" name=\"stopbtn\" value=\"" . gettext("Stop") . "\">&nbsp;";
}
if (file_exists($fp.$fn) and $processisrunning != true) {
echo "<input type=\"submit\" name=\"downloadbtn\" value=\"" . gettext("Download Capture") . "\">";
echo "&nbsp;&nbsp;(" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")";
}
?>
</td>
</tr>
</table>
</form>
<table width="100%" border="0" cellpadding="6" cellspacing="0">
<tr>
<td valign="top" colspan="2">
<?php
echo "<font face='terminal' size='2'>";
if ($processisrunning == true)
echo("<strong>" . gettext("Packet Capture is running.") . "</strong><br/>");
if ($do_tcpdump) {
$matches = array();
if (($fam == "ip6") || ($fam == "ip"))
$matches[] = $fam;
if ($port != "")
$matches[] = "port ".$port;
if ($host != "") {
if (is_ipaddr($host))
$matches[] = "host " . $host;
elseif (is_subnet($host))
$matches[] = "net " . $host;
}
if ($count != "0" ) {
$searchcount = "-c " . $count;
} else {
$searchcount = "";
}
$selectedif = convert_friendly_interface_to_real_interface_name($selectedif);
if ($action == gettext("Start")) {
$matchstr = implode($matches, " and ");
echo("<strong>" . gettext("Packet Capture is running.") . "</strong><br/>");
mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr");
// echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr";
} else {
//action = stop
echo("<strong>" . gettext("Packet Capture stopped.") . "<br/><br/>" . gettext("Packets Captured:") . "</strong><br/>");
?>
<textarea style="width:98%" name="code" rows="15" cols="66" wrap="off" readonly="readonly">
<?php
system ("/usr/sbin/tcpdump $disabledns $detail -r $fp$fn");
conf_mount_ro();
?>
</textarea>
<?php
}
}
?>
</td>
</tr>
</table>
</td></tr>
</table>
<?php

6
usr/local/www/firewall_aliases_edit.php
View File

@ -285,6 +285,9 @@ if ($_POST) {
$input_errors[] = sprintf(gettext('The alias(es): %s cannot be nested because they are not of the same type.'), $wrongaliases);
}
// Allow extending of the firewall edit page and include custom input validation
pfSense_handle_custom_code("/usr/local/pkg/firewall_aliases_edit/input_validation");
if (!$input_errors) {
$alias['address'] = is_array($address) ? implode(" ", $address) : $address;
$alias['descr'] = $_POST['descr'];
@ -321,6 +324,8 @@ if ($_POST) {
update_alias_names_upon_change(array('aliases', 'alias'), array('address'), $_POST['name'], $origname);
}
pfSense_handle_custom_code("/usr/local/pkg/firewall_aliases_edit/pre_write_config");
if (isset($id) && $a_aliases[$id]) {
if ($a_aliases[$id]['name'] <> $alias['name']) {
foreach ($a_aliases as $aliasid => $aliasd) {
@ -581,6 +586,7 @@ EOD;
</span>
</td>
</tr>
<?php pfSense_handle_custom_code("/usr/local/pkg/firewall_aliases_edit/after_first_tr"); ?>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
<td width="78%" class="vtable">

6
usr/local/www/firewall_rules.php
View File

@ -409,11 +409,9 @@ if($_REQUEST['undodrag']) {
$sshport = "";
if (isset($config['system']['enablesshd'])) {
$sshport = 22;
if($config['system']['ssh']['port'] <> "")
$sshport = $config['system']['ssh']['port'];
$sshport = ($config['system']['ssh']['port']) ? $config['system']['ssh']['port'] : 22;
}
$sshport = "22<br/>";
$sshport = "{$sshport}<br/>";
?>
<tr valign="top" id="antilockout">
<td class="list">&nbsp;</td>

4
usr/local/www/interfaces_groups.php
View File

@ -47,11 +47,11 @@ $a_ifgroups = &$config['ifgroups']['ifgroupentry'];
if ($_GET['act'] == "del") {
if ($a_ifgroups[$_GET['id']]) {
$members = explode(" ", $a_ifgroups[$_GET[$id]]['members']);
$members = explode(" ", $a_ifgroups[$_GET['id']]['members']);
foreach ($members as $ifs) {
$realif = get_real_interface($ifs);
if ($realif)
mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET[$id]]['ifname']);
mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET['id']]['ifname']);
}
unset($a_ifgroups[$_GET['id']]);
write_config();

3
usr/local/www/status_gateways.php
View File

@ -109,6 +109,9 @@ include("head.inc");
$online = gettext("Online");
$bgcolor = "lightgreen";
}
} else if (isset($gateway['monitor_disable'])) {
$online = gettext("Online");
$bgcolor = "lightgreen";
} else {
$online = gettext("Gathering data");
$bgcolor = "lightgray";

59
usr/local/www/status_openvpn.php
View File

@ -98,6 +98,7 @@ function kill_client($port, $remipp) {
}
$servers = openvpn_get_active_servers();
$sk_servers = openvpn_get_active_servers("sharedkey");
$clients = openvpn_get_active_clients();
include("head.inc"); ?>
@ -141,13 +142,10 @@ include("head.inc"); ?>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
<?=gettext("Client connections for"); ?> <?=$server['name'];?>
<?=$server['name'];?> <?=gettext("Client connections"); ?>
</td>
</tr>
<tr>
<?php if ($server['mode'] == "p2p_shared_key"): ?>
<td>Status data is not available for shared key servers.</td>
<?php else: ?>
<td>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" class="tabcont sortable" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
@ -194,19 +192,68 @@ include("head.inc"); ?>
</table>
</td>
<? endif; ?>
</tr>
</table>
<?php endforeach; ?>
<br>
<?php if (!empty($sk_servers)) { ?>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
<?=gettext("Shared Key Server Instance Statistics"); ?>
</td>
</tr>
<tr>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" class="tabcont sortable" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td class="listhdrr"><?=gettext("Name"); ?></td>
<td class="listhdrr"><?=gettext("Status"); ?></td>
<td class="listhdrr"><?=gettext("Connected Since"); ?></td>
<td class="listhdrr"><?=gettext("Virtual Addr"); ?></td>
<td class="listhdrr"><?=gettext("Remote Host"); ?></td>
<td class="listhdrr"><?=gettext("Bytes Sent"); ?></td>
<td class="listhdrr"><?=gettext("Bytes Received"); ?></td>
</tr>
<?php foreach ($sk_servers as $sk_server): ?>
<tr name='<?php echo "r:{$client['port']}:{$conn['remote_host']}"; ?>'>
<td class="listlr">
<?=$sk_server['name'];?>
</td>
<td class="listlr">
<?=$sk_server['status'];?>
</td>
<td class="listr">
<?=$sk_server['connect_time'];?>
</td>
<td class="listr">
<?=$sk_server['virtual_addr'];?>
</td>
<td class="listr">
<?=$sk_server['remote_host'];?>
</td>
<td class="listr">
<?=$sk_server['bytes_sent'];?>
</td>
<td class="listr">
<?=$sk_server['bytes_recv'];?>
</td>
</tr>
<?php endforeach; ?>
</table>
</tr>
</table>
<?php
} ?>
<br>
<?php if (!empty($clients)) { ?>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
<?=gettext("OpenVPN client instances statistics"); ?>
<?=gettext("Client Instance Statistics"); ?>
</td>
</tr>
<tr>

3
usr/local/www/system_crlmanager.php
View File

@ -39,6 +39,7 @@
require("guiconfig.inc");
require_once("certs.inc");
require_once('openvpn.inc');
global $openssl_crl_status;
@ -145,7 +146,6 @@ if ($act == "addcert") {
if (!$input_errors) {
$reason = (empty($pconfig['crlreason'])) ? OCSP_REVOKED_STATUS_UNSPECIFIED : $pconfig['crlreason'];
cert_revoke($cert, $crl, $reason);
require_once('openvpn.inc');
openvpn_refresh_crls();
write_config("Revoked cert {$cert['descr']} in CRL {$crl['descr']}.");
pfSenseHeader("system_crlmanager.php");
@ -173,7 +173,6 @@ if ($act == "delcert") {
$name = $thiscert['descr'];
if (cert_unrevoke($thiscert, $thiscrl)) {
$savemsg = sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr']) . "<br/>";
require_once('openvpn.inc');
openvpn_refresh_crls();
write_config(sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr']));
} else {

32
usr/local/www/system_gateways_edit.php
View File

@ -66,6 +66,7 @@ if (isset($id) && $a_gateways[$id]) {
$pconfig = array();
$pconfig['name'] = $a_gateways[$id]['name'];
$pconfig['weight'] = $a_gateways[$id]['weight'];
$pconfig['interval'] = $a_gateways[$id]['interval'];
$pconfig['interface'] = $a_gateways[$id]['interface'];
$pconfig['friendlyiface'] = $a_gateways[$id]['friendlyiface'];
if (isset($a_gateways[$id]['dynamic']))
@ -78,6 +79,7 @@ if (isset($id) && $a_gateways[$id]) {
$pconfig['losshigh'] = $a_gateway_item[$id]['losshigh'];
$pconfig['down'] = $a_gateway_item[$id]['down'];
$pconfig['monitor'] = $a_gateways[$id]['monitor'];
$pconfig['monitor_disable'] = isset($a_gateways[$id]['monitor_disable']);
$pconfig['descr'] = $a_gateways[$id]['descr'];
$pconfig['attribute'] = $a_gateways[$id]['attribute'];
}
@ -232,8 +234,11 @@ if ($_POST) {
$gateway['gateway'] = "dynamic";
$gateway['name'] = $_POST['name'];
$gateway['weight'] = $_POST['weight'];
$gateway['interval'] = $_POST['interval'];
$gateway['descr'] = $_POST['descr'];
if (is_ipaddr($_POST['monitor']))
if ($_POST['monitor_disable'] == "yes")
$gateway['monitor_disable'] = true;
else if (is_ipaddr($_POST['monitor']))
$gateway['monitor'] = $_POST['monitor'];
if ($_POST['defaultgw'] == "yes" || $_POST['defaultgw'] == "on") {
@ -307,6 +312,9 @@ function show_advanced_gateway() {
aodiv = document.getElementById('showgatewayadv');
aodiv.style.display = "block";
}
function monitor_change() {
document.iform.monitor.disabled = document.iform.monitor_disable.checked;
}
</script>
<?php if ($input_errors) print_input_errors($input_errors); ?>
<form action="system_gateways_edit.php" method="post" name="iform" id="iform">
@ -365,6 +373,14 @@ function show_advanced_gateway() {
<?=gettext("This will select the above gateway as the default gateway"); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Disable Gateway Monitoring"); ?></td>
<td width="78%" class="vtable">
<input name="monitor_disable" type="checkbox" id="monitor_disable" value="yes" <?php if ($pconfig['monitor_disable'] == true) echo "checked"; ?> onClick="monitor_change()" />
<strong><?=gettext("Disable Gateway Monitoring"); ?></strong><br />
<?=gettext("This will consider this gateway as always being up"); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Monitor IP"); ?></td>
<td width="78%" class="vtable">
@ -385,10 +401,10 @@ function show_advanced_gateway() {
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Advanced");?></td>
<td width="78%" class="vtable">
<div id="showadvgatewaybox" <? if (!empty($pconfig['latencylow']) || !empty($pconfig['latencyhigh']) || !empty($pconfig['losslow']) || !empty($pconfig['losshigh']) || (isset($pconfig['weight']) && $pconfig['weight'] > 1)) echo "style='display:none'"; ?>>
<div id="showadvgatewaybox" <? if (!empty($pconfig['latencylow']) || !empty($pconfig['latencyhigh']) || !empty($pconfig['losslow']) || !empty($pconfig['losshigh']) || (isset($pconfig['weight']) && $pconfig['weight'] > 1) || (isset($pconfig['interval']) && $pconfig['interval'])) echo "style='display:none'"; ?>>
<input type="button" onClick="show_advanced_gateway()" value="Advanced"></input> - Show advanced option</a>
</div>
<div id="showgatewayadv" <? if (empty($pconfig['latencylow']) && empty($pconfig['latencyhigh']) && empty($pconfig['losslow']) && empty($pconfig['losshigh']) && (empty($pconfig['weight']) || $pconfig['weight'] == 1)) echo "style='display:none'"; ?>>
<div id="showgatewayadv" <? if (empty($pconfig['latencylow']) && empty($pconfig['latencyhigh']) && empty($pconfig['losslow']) && empty($pconfig['losshigh']) && (empty($pconfig['weight']) || $pconfig['weight'] == 1) && (empty($pconfig['interval']) || $pconfig['interval'] == 1)) echo "style='display:none'"; ?>>
<table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="6">
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("Weight");?></td>
@ -438,6 +454,14 @@ function show_advanced_gateway() {
<br> <span class="vexpl"><?=gettext("This defines the down time for the alarm to fire, in seconds.");?></span></td>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("Frequency Probe");?></td>
<td width="78%" class="vtable">
<input name="interval" type="text" class="formfld unknown" id="interval" size="2"
value="<?=htmlspecialchars($pconfig['interval']);?>">
<br> <span class="vexpl"><?=gettext("This defines the frequency in seconds that an icmp probe will be sent. Default is 1 second.");?></span></td>
</td>
</tr>
</table>
</div>
</td>
@ -461,7 +485,7 @@ function show_advanced_gateway() {
</form>
<?php include("fend.inc"); ?>
<script language="JavaScript">
enable_change(document.iform.defaultgw);
monitor_change();
</script>
</body>
</html>

14
usr/local/www/vpn_ipsec_mobile.php
View File

@ -355,7 +355,19 @@ function login_banner_change() {
<td width="78%" class="vtable">
<?=gettext("Source"); ?>:&nbsp;&nbsp;
<select name="user_source" class="formselect" id="user_source">
<option value="system"><?=gettext("system"); ?></option>
<option value="system" <?php if ($pconfig['user_source'] == 'system') echo "selected"; ?>><?=gettext("system"); ?></option>
<?php
if (is_array($config['system']['authserver'])) {
foreach ($config['system']['authserver'] as $authcfg) {
if ($authcfg['type'] == 'ldap') {
$selected = "";
if ($pconfig['user_source'] == $authcfg['name'])
$selected = "selected";
echo "<option value='{$authcfg['name']}' {$selected} >{$authcfg['name']}</option>\n";
}
}
}
?>
</select>
</td>
</tr>

2
usr/local/www/vpn_openvpn_csc.php
View File

@ -61,7 +61,7 @@ if ($_GET['act'] == "del") {
exit;
}
openvpn_delete_csc($$a_csc[$id]);
openvpn_delete_csc($a_csc[$id]);
unset($a_csc[$id]);
write_config();
$savemsg = gettext("Client Specific Override successfully deleted")."<br/>";

10
usr/local/www/vpn_pptp.php
View File

@ -353,9 +353,13 @@ function enable_change(enable_over) {
<td width="22%" valign="top" class="vncellreq"><?=gettext("Server address"); ?></td>
<td width="78%" class="vtable">
<?=$mandfldhtml;?><input name="localip" type="text" class="formfld unknown" id="localip" size="20" value="<?=htmlspecialchars($pconfig['localip']);?>">
<br>
<?=gettext("Enter the IP address the PPTP server should use on its side " .
"for all clients"); ?>.</td>
<br/>
<?=gettext("Enter the IP address the PPTP server should give to clients for use as their \"gateway\""); ?>.
<br/>
<?=gettext("Typically this is set to an unused IP just outside of the client range"); ?>.
<br/>
<br/>
<?=gettext("NOTE: This should NOT be set to any IP address currently in use on this firewall"); ?>.
</tr>
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("Remote address " .

6
usr/local/www/vpn_pptp_users_edit.php
View File

@ -84,12 +84,12 @@ if ($_POST) {
if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['username']))
$input_errors[] = gettext("The username contains invalid characters.");
if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['password']))
$input_errors[] = gettext("The password contains invalid characters.");
if (preg_match("/^!/", $_POST['password']))
$input_errors[] = gettext("The password cannot start with '!'.");
if (!preg_match("/^[\x20-\x7E]*$/", $_POST['password']))
$input_errors[] = gettext("The password contains invalid characters.");
if (($_POST['password']) && ($_POST['password'] != $_POST['password2'])) {
$input_errors[] = gettext("The passwords do not match.");
}

58
usr/local/www/widgets/widgets/openvpn.widget.php
View File

@ -55,6 +55,7 @@ function kill_client($port, $remipp) {
}
$servers = openvpn_get_active_servers();
$sk_servers = openvpn_get_active_servers("sharedkey");
$clients = openvpn_get_active_clients();
?>
@ -95,7 +96,7 @@ $clients = openvpn_get_active_clients();
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
Client connections for <?=$server['name'];?>
<?=$server['name'];?> Client connections
</td>
</tr>
<tr>
@ -140,14 +141,61 @@ $clients = openvpn_get_active_clients();
</table>
<?php endforeach; ?>
<br/>
<?php if (!empty($sk_servers)) { ?>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
Shared Key Server Instance Statistics
</td>
</tr>
<tr>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" class="tabcont sortable" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td class="listhdrr">Name/Time</td>
<td class="listhdrr">Remote/Virtual IP</td>
</tr>
<?php foreach ($sk_servers as $sk_server): ?>
<tr name='<?php echo "r:{$sk_server['port']}:{$sk_server['remote_host']}"; ?>'>
<td class="listlr">
<?=$sk_server['name'];?>
</td>
<td class="listr">
<?=$sk_server['remote_host'];?>
</td>
<td rowspan="2" align="center">
<?php
if ($sk_server['status'] == "up") {
/* tunnel is up */
$iconfn = "interface_up";
} else {
/* tunnel is down */
$iconfn = "interface_down";
}
echo "<img src ='/themes/{$g['theme']}/images/icons/icon_{$iconfn}.gif'>";
?>
</td>
</tr>
<tr name='<?php echo "r:{$sk_server['port']}:{$sk_server['remote_host']}"; ?>'>
<td class="listlr">
<?=$sk_server['connect_time'];?>
</td>
<td class="listr">
<?=$sk_server['virtual_addr'];?>
</td>
</tr>
<?php endforeach; ?>
</table>
</tr>
</table>
<?php
} ?>
<?php if (!empty($clients)) { ?>
<table style="padding-top:0px; padding-bottom:0px; padding-left:0px; padding-right:0px" width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td colspan="6" class="listtopic">
OpenVPN client instances statistics
Client Instance Statistics
</td>
</tr>
<tr>
@ -158,7 +206,7 @@ $clients = openvpn_get_active_clients();
</tr>
<?php foreach ($clients as $client): ?>
<tr name='<?php echo "r:{$client['port']}:{$conn['remote_host']}"; ?>'>
<tr name='<?php echo "r:{$client['port']}:{$client['remote_host']}"; ?>'>
<td class="listlr">
<?=$client['name'];?>
</td>
@ -178,7 +226,7 @@ $clients = openvpn_get_active_clients();
?>
</td>
</tr>
<tr name='<?php echo "r:{$client['port']}:{$conn['remote_host']}"; ?>'>
<tr name='<?php echo "r:{$client['port']}:{$client['remote_host']}"; ?>'>
<td class="listlr">
<?=$client['connect_time'];?>
</td>

4
usr/local/www/wizards/traffic_shaper_wizard.inc
View File

@ -1056,7 +1056,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qLink";
$tmpcf['priority'] = 1;
$tmpcf['priority'] = 2;
$tmpcf['enabled'] = "on";
$tmpcf['default'] = "on";
$tmpcf['qlimit'] = 500;
@ -1295,7 +1295,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qOthersLow";
$tmpcf['priority'] = 2;
$tmpcf['priority'] = 3;
$tmpcf['ecn'] = "on";
$tmpcf['enabled'] = "on";
if ($sched == "CBQ") {

4
usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc
View File

@ -1119,7 +1119,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qLink";
$tmpcf['priority'] = 3;
$tmpcf['priority'] = 2;
$tmpcf['enabled'] = "on";
$tmpcf['default'] = "on";
$tmpcf['qlimit'] = 500;
@ -1359,7 +1359,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qOthersLow";
$tmpcf['priority'] = 2;
$tmpcf['priority'] = 3;
$tmpcf['ecn'] = "on";
$tmpcf['enabled'] = "on";
if ($sched == "CBQ") {

4
usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc
View File

@ -1167,7 +1167,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qLink";
$tmpcf['priority'] = 1;
$tmpcf['priority'] = 2;
$tmpcf['enabled'] = "on";
$tmpcf['default'] = "on";
$tmpcf['qlimit'] = 500;
@ -1409,7 +1409,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qOthersLow";
$tmpcf['priority'] = 2;
$tmpcf['priority'] = 3;
$tmpcf['ecn'] = "on";
$tmpcf['enabled'] = "on";
if ($sched == "CBQ") {

4
usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc
View File

@ -557,7 +557,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qLink";
$tmpcf['priority'] = 1;
$tmpcf['priority'] = 2;
$tmpcf['enabled'] = "on";
$tmpcf['default'] = "on";
$tmpcf['qlimit'] = 500;
@ -802,7 +802,7 @@ function apply_all_choosen_items() {
$q =& new hfsc_queue();
$tmpcf = array();
$tmpcf['name'] = "qOthersLow";
$tmpcf['priority'] = 2;
$tmpcf['priority'] = 3;
$tmpcf['ecn'] = "on";
$tmpcf['enabled'] = "on";
if ($sched == "CBQ") {