diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 1b1afa2d39..7bd9cfe86b 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -183,7 +183,7 @@ function filter_delete_states_for_down_gateways() { } /* reload filter sync */ -function filter_configure_sync() { +function filter_configure_sync($delete_states_if_needed = true) { global $config, $g, $after_filter_configure_run, $FilterIflist; global $time_based_rules, $filterdns, $aliases; @@ -397,8 +397,10 @@ function filter_configure_sync() { if($g['booting'] == true) echo "."; - update_filter_reload_status(gettext("Processing down interface states")); - filter_delete_states_for_down_gateways(); + if($delete_states_if_needed) { + update_filter_reload_status(gettext("Processing down interface states")); + filter_delete_states_for_down_gateways(); + } update_filter_reload_status(gettext("Running plugins")); @@ -1400,7 +1402,10 @@ function filter_nat_rules_generate() { } /* PPTP subnet */ if(($config['pptpd']['mode'] == "server" ) && is_private_ip($config['pptpd']['remoteip'])) { - $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units'])) + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + else + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip']))); $numberofnathosts += count($pptp_subnets); $tonathosts .= implode(" ", $pptp_subnets) . " "; } @@ -1763,9 +1768,13 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { $src = "{$lansa}/{$lansn}"; break; case 'pptp': - $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units'])) + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + else + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip']))); + if (empty($pptp_subnets)) + return ""; $src = "{ " . implode(" ", $pptp_subnets) . " }"; - $src = "{$pptpsa}/{$pptpsn}"; break; case 'pppoe': /* XXX: This needs to be fixed somehow! */ @@ -1912,7 +1921,7 @@ function filter_generate_user_rule($rule) { update_filter_reload_status(sprintf(gettext("Setting up pass/block rules %s"), $rule['descr'])); /* do not process reply-to for gateway'd rules */ - if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto'])) { + if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto']) && $type != "match") { if($rule['ipprotocol'] == "inet6") { $rg = get_interface_gateway_v6($rule['interface']); if(is_ipaddrv6($rg)) { diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 0caa84061d..e26adb1455 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -137,6 +137,9 @@ target default { EOD; foreach($gateways_arr as $name => $gateway) { + /* Do not monitor if such was requested */ + if (isset($gateway['monitor_disable'])) + continue; if (empty($gateway['monitor']) || !is_ipaddr($gateway['monitor'])) { if (is_ipaddr($gateway['gateway'])) $gateway['monitor'] = $gateway['gateway']; @@ -157,6 +160,8 @@ EOD; $apingercfg = "target \"{$gateway['monitor']}\" {\n"; $apingercfg .= " description \"{$name}\"\n"; $apingercfg .= " srcip \"{$gwifip}\"\n"; + if (!empty($gateway['interval']) && intval($gateway['interval']) > 1) + $apingercfg .= " interval " . intval($gateway['interval']) . "s\n"; $alarms = ""; $alarmscfg = ""; $override = false; @@ -216,8 +221,7 @@ EOD; */ if (is_ipaddr($gateway['gateway']) && $gateway['monitor'] != $gateway['gateway']) { log_error(sprintf(gettext('Removing static route for monitor %1$s and adding a new route through %2$s'), $gateway['monitor'], $gateway['gateway'])); - mwexec("/sbin/route delete -host " . escapeshellarg($gateway['monitor']), true); - mwexec("/sbin/route add -host " . escapeshellarg($gateway['monitor']) . + mwexec("/sbin/route change -host " . escapeshellarg($gateway['monitor']) . " " . escapeshellarg($gateway['gateway']), true); } @@ -288,7 +292,9 @@ function return_gateways_array($disabled = false) { $gateway['gateway'] = "dynamic"; $gateway['dynamic'] = true; } - if(empty($gateway['monitor'])) + if (isset($gateway['monitor_disable'])) + $gateway['monitor_disable'] = true; + else if (empty($gateway['monitor'])) $gateway['monitor'] = $gateway['gateway']; $gateway['friendlyiface'] = $gateway['interface']; @@ -384,18 +390,18 @@ function return_gateway_groups_array() { if (isset($gwsttng['defaultgw'])) { $dfltgwfound = true; $dfltgwname = $gwname; - if (stristr($gateways_status[$gwname]['status'], "down")) + if (!isset($gwsttng['monitor_disable']) && stristr($gateways_status[$gwname]['status'], "down")) $dfltgwdown = true; } /* Keep a record of the last up gateway */ - if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) + if (empty($upgw) && (isset($gwsttng['monitor_disable']) || !stristr($gateways_status[$gwname]['status'], "down"))) $upgw = $gwname; if ($dfltgwdown == true && !empty($upgw)) break; } if ($dfltgwfound == false) { $gwname = convert_friendly_interface_to_friendly_descr("wan"); - if (stristr($gateways_status[$gwname]['status'], "down")) + if (!empty($gateways_status[$gwname]) && stristr($gateways_status[$gwname]['status'], "down")) $dfltgwdown = true; } if ($dfltgwdown == true && !empty($upgw)) { @@ -403,12 +409,12 @@ function return_gateway_groups_array() { $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { log_error("Default gateway down setting {$upgw} as default!"); - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); + mwexec("/sbin/route change -inet default {$gateways_arr[$upgw]['gateway']}"); } } else { $defaultgw = trim(`/sbin/route -n get -inet default | /usr/bin/grep gateway | /usr/bin/sed 's/gateway://g'`, " \n"); if ($defaultgw != $gateways_arr[$dfltgwname]['gateway']) - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$dfltgwname]['gateway']}"); + mwexec("/sbin/route change -inet default {$gateways_arr[$dfltgwname]['gateway']}"); } unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng); @@ -450,7 +456,8 @@ function return_gateway_groups_array() { } else /* Online add member */ $tiers[$tier][] = $gwname; - } + } else if (isset($gateways_arr[$gwname]['monitor_disable'])) + $tiers[$tier][] = $gwname; } $tiers_count = count($tiers); if($tiers_count == 0) { diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index eb6ed738c9..53f4a741e6 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -774,18 +774,20 @@ function openvpn_resync_all($interface = "") { } -function openvpn_get_active_servers() { +function openvpn_get_active_servers($type="ssl") { global $config, $g; $servers = array(); if (is_array($config['openvpn']['openvpn-server'])) { foreach ($config['openvpn']['openvpn-server'] as & $settings) { - + if (empty($settings) || isset($settings['disable'])) + continue; + $prot = $settings['protocol']; $port = $settings['local_port']; $server = array(); - $server['port'] = $settings['local_port']; + $server['port'] = ($settings['local_port']) ? $settings['local_port'] : 1194; $server['mode'] = $settings['mode']; if ($settings['description']) $server['name'] = "{$settings['description']} {$prot}:{$port}"; @@ -794,71 +796,75 @@ function openvpn_get_active_servers() { $server['conns'] = array(); $vpnid = $settings['vpnid']; - $mode_id = "server{$vpnid}"; + $mode_id = "server{$vpnid}"; $server['mgmt'] = $mode_id; - $tcpsrv = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; - $errval; - $errstr; - - /* open a tcp connection to the management port of each server */ - $fp = @stream_socket_client($tcpsrv, $errval, $errstr, 1); - if ($fp) { - stream_set_timeout($fp, 1); - - /* send our status request */ - fputs($fp, "status 2\n"); - - /* recv all response lines */ - while (!feof($fp)) { - - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - - /* parse header list line */ - if (strstr($line, "HEADER")) - continue; - - /* parse end of output line */ - if (strstr($line, "END") || strstr($line, "ERROR")) - break; - - /* parse client list line */ - if (strstr($line, "CLIENT_LIST")) { - $list = explode(",", $line); - $conn = array(); - $conn['common_name'] = $list[1]; - $conn['remote_host'] = $list[2]; - $conn['virtual_addr'] = $list[3]; - $conn['bytes_recv'] = $list[4]; - $conn['bytes_sent'] = $list[5]; - $conn['connect_time'] = $list[6]; - $server['conns'][] = $conn; - } - } - - /* cleanup */ - fclose($fp); - } else { - $conn = array(); - $conn['common_name'] = "[error]"; - $conn['remote_host'] = "Management Daemon Unreachable"; - $conn['virtual_addr'] = ""; - $conn['bytes_recv'] = 0; - $conn['bytes_sent'] = 0; - $conn['connect_time'] = 0; - $server['conns'][] = $conn; - } - - $servers[] = $server; + $socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; + if (($server['mode'] == "p2p_shared_key") && ($type == "sharedkey")) + $servers[] = openvpn_get_client_status($server, $socket); + elseif (($server['mode'] != "p2p_shared_key") && ($type == "ssl")) + $servers[] = openvpn_get_server_status($server, $socket); } } return $servers; } +function openvpn_get_server_status($server, $socket) { + $errval; + $errstr; + $fp = @stream_socket_client($socket, $errval, $errstr, 1); + if ($fp) { + stream_set_timeout($fp, 1); + + /* send our status request */ + fputs($fp, "status 2\n"); + + /* recv all response lines */ + while (!feof($fp)) { + + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + /* parse header list line */ + if (strstr($line, "HEADER")) + continue; + + /* parse end of output line */ + if (strstr($line, "END") || strstr($line, "ERROR")) + break; + + /* parse client list line */ + if (strstr($line, "CLIENT_LIST")) { + $list = explode(",", $line); + $conn = array(); + $conn['common_name'] = $list[1]; + $conn['remote_host'] = $list[2]; + $conn['virtual_addr'] = $list[3]; + $conn['bytes_recv'] = $list[4]; + $conn['bytes_sent'] = $list[5]; + $conn['connect_time'] = $list[6]; + $server['conns'][] = $conn; + } + } + + /* cleanup */ + fclose($fp); + } else { + $conn = array(); + $conn['common_name'] = "[error]"; + $conn['remote_host'] = "Management Daemon Unreachable"; + $conn['virtual_addr'] = ""; + $conn['bytes_recv'] = 0; + $conn['bytes_sent'] = 0; + $conn['connect_time'] = 0; + $server['conns'][] = $conn; + } + return $server; +} + function openvpn_get_active_clients() { global $config, $g; @@ -866,100 +872,104 @@ function openvpn_get_active_clients() { if (is_array($config['openvpn']['openvpn-client'])) { foreach ($config['openvpn']['openvpn-client'] as & $settings) { + if (empty($settings) || isset($settings['disable'])) + continue; + $prot = $settings['protocol']; - $port = $settings['local_port']; + $port = ($settings['local_port']) ? ":{$settings['local_port']}" : ""; $client = array(); $client['port'] = $settings['local_port']; if ($settings['description']) - $client['name'] = "{$settings['description']} {$prot}:{$port}"; + $client['name'] = "{$settings['description']} {$prot}{$port}"; else - $client['name'] = "Client {$prot}:{$port}"; + $client['name'] = "Client {$prot}{$port}"; $vpnid = $settings['vpnid']; - $mode_id = "client{$vpnid}"; + $mode_id = "client{$vpnid}"; $client['mgmt'] = $mode_id; - $tcpcli = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; - $errval; - $errstr; - + $socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; $client['status']="down"; - - /* open a tcp connection to the management port of each cli */ - $fp = @stream_socket_client($tcpcli, $errval, $errstr, 1); - if ($fp) { - stream_set_timeout($fp, 1); - /* send our status request */ - fputs($fp, "state 1\n"); - - /* recv all response lines */ - while (!feof($fp)) { - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - /* Get the client state */ - if (strstr($line,"CONNECTED")) { - $client['status']="up"; - $list = explode(",", $line); - - $client['connect_time'] = date("D M j G:i:s Y", $list[0]); - $client['virtual_addr'] = $list[3]; - $client['remote_host'] = $list[4]; - } - /* parse end of output line */ - if (strstr($line, "END") || strstr($line, "ERROR")) - break; - } - - /* If up, get read/write stats */ - if (strcmp($client['status'], "up") == 0) { - fputs($fp, "status 2\n"); - /* recv all response lines */ - while (!feof($fp)) { - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - - if (strstr($line,"TCP/UDP read bytes")) { - $list = explode(",", $line); - $client['bytes_recv'] = $list[1]; - } - - if (strstr($line,"TCP/UDP write bytes")) { - $list = explode(",", $line); - $client['bytes_sent'] = $list[1]; - } - - /* parse end of output line */ - if (strstr($line, "END")) - break; - } - } - - fclose($fp); - - } else { - $DisplayNote=true; - $client['remote_host'] = "No Management Daemon"; - $client['virtual_addr'] = "See Note Below"; - $client['bytes_recv'] = 0; - $client['bytes_sent'] = 0; - $client['connect_time'] = 0; - } - - $clients[] = $client; + $clients[] = openvpn_get_client_status($client, $socket); } } return $clients; } +function openvpn_get_client_status($client, $socket) { + $errval; + $errstr; + $fp = @stream_socket_client($socket, $errval, $errstr, 1); + if ($fp) { + stream_set_timeout($fp, 1); + /* send our status request */ + fputs($fp, "state 1\n"); + + /* recv all response lines */ + while (!feof($fp)) { + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + /* Get the client state */ + if (strstr($line,"CONNECTED")) { + $client['status']="up"; + $list = explode(",", $line); + + $client['connect_time'] = date("D M j G:i:s Y", $list[0]); + $client['virtual_addr'] = $list[3]; + $client['remote_host'] = $list[4]; + } + /* parse end of output line */ + if (strstr($line, "END") || strstr($line, "ERROR")) + break; + } + + /* If up, get read/write stats */ + if (strcmp($client['status'], "up") == 0) { + fputs($fp, "status 2\n"); + /* recv all response lines */ + while (!feof($fp)) { + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + if (strstr($line,"TCP/UDP read bytes")) { + $list = explode(",", $line); + $client['bytes_recv'] = $list[1]; + } + + if (strstr($line,"TCP/UDP write bytes")) { + $list = explode(",", $line); + $client['bytes_sent'] = $list[1]; + } + + /* parse end of output line */ + if (strstr($line, "END")) + break; + } + } + + fclose($fp); + + } else { + $DisplayNote=true; + $client['remote_host'] = "No Management Daemon"; + $client['virtual_addr'] = "See Note Below"; + $client['bytes_recv'] = 0; + $client['bytes_sent'] = 0; + $client['connect_time'] = 0; + } + return $client; +} + function openvpn_refresh_crls() { global $g, $config; diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 15d38e5185..3b5e108b50 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -31,7 +31,7 @@ /* pfSense_BUILDER_BINARIES: /usr/sbin/powerd /usr/bin/killall /sbin/sysctl /sbin/route - pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/bin/netstat /usr/sbin/syslogd + pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/sbin/syslogd pfSense_BUILDER_BINARIES: /usr/sbin/pccardd /usr/local/sbin/lighttpd /bin/chmod /bin/mkdir pfSense_BUILDER_BINARIES: /usr/bin/tar /usr/local/sbin/ntpd /usr/sbin/ntpdate pfSense_BUILDER_BINARIES: /usr/bin/nohup /sbin/dmesg /usr/local/sbin/atareinit /sbin/kldload @@ -144,11 +144,10 @@ function system_resolvconf_generate($dynupdate = false) { $interface = $config['system'][$dnsgw]; if (($interface <> "") && ($interface <> "none")) { $gatewayip = get_interface_gateway($interface); - if(is_ipaddr($gatewayip)) { + if (is_ipaddr($gatewayip)) { /* dns server array starts at 0 */ $dnscountermo = $dnscounter - 1; - mwexec("route delete -host {$syscfg['dnsserver'][$dnscountermo]}", true); - mwexec("route add -host {$syscfg['dnsserver'][$dnscountermo]} {$gatewayip}"); + mwexec("route change -host " . $syscfg['dnsserver'][$dnscountermo] . " {$gatewayip}"); } } } @@ -398,53 +397,20 @@ function system_routing_configure($interface = "") { } } } - /* Create a array from the existing inet route table */ - exec("/usr/bin/netstat -rnf inet", $route_str); - array_shift($route_str); - array_shift($route_str); - array_shift($route_str); - array_shift($route_str); - $route_arr = array(); - foreach($route_str as $routeline) { - $items = preg_split("/[ ]+/i", $routeline); - $route_arr[$items[0]] = array($items[0], $items[1], $items[5]); - } if ($dont_add_route == false ) { if (!empty($interface) && $interface != $interfacegw) ; else if (($interfacegw <> "bgpd") && (is_ipaddrv4($gatewayip))) { - $action = "add"; - if(isset($route_arr['default'])) { - $action = "change"; - } - log_error("ROUTING: $action default route to $gatewayip"); - mwexec("/sbin/route {$action} -inet default " . escapeshellarg($gatewayip)); + log_error("ROUTING: setting default route to $gatewayip"); + mwexec("/sbin/route change -inet default " . escapeshellarg($gatewayip)); } - } - /* Create a array from the existing inet6 route table */ - exec("/usr/bin/netstat -rnf inet6", $routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - $routev6_arr = array(); - foreach($routev6_str as $routeline) { - $items = preg_split("/[ ]+/i", $routeline); - $routev6_arr[$items[0]] = array($items[0], $items[1], $items[5]); - } - - if ($dont_add_route == false ) { if (!empty($interface) && $interface != $interfacegwv6) ; else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) { - $action = "add"; - if(isset($routev6_arr['default'])) { - $action = "change"; - } - log_error("ROUTING: $action IPv6 default route to $gatewayipv6"); - mwexec("/sbin/route {$action} -inet6 default " . escapeshellarg($gatewayipv6)); + log_error("ROUTING: setting IPv6 default route to $gatewayipv6"); + mwexec("/sbin/route change -inet6 default " . escapeshellarg($gatewayipv6)); } } @@ -463,9 +429,6 @@ function system_routing_configure($interface = "") { $gatewayip = $gateway['gateway']; $interfacegw = $gateway['interface']; - $action = "add"; - if (isset($route_arr[$rtent['network']])) - $action = "change"; if(is_ipaddrv6($gatewayip)) { $inetfamily = "-inet6"; @@ -473,10 +436,10 @@ function system_routing_configure($interface = "") { $inetfamily = "-inet"; } if (is_ipaddr($gatewayip)) { - mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) . " " . escapeshellarg($gatewayip)); } else if (!empty($interfacegw)) { - mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) . " -iface " . escapeshellarg($interfacegw)); } } @@ -867,7 +830,7 @@ function system_generate_lighty_config($filename, $captive_portal_rewrite = "url.rewrite-once = ( \"(.*captiveportal.*)\" => \"$1\", \"(.*)\" => \"/index.php?redirurl=$1\" )\n"; $captive_portal_module = ""; $maxprocperip = $config['captiveportal']['maxprocperip']; - if(!$maxprocperip and $maxprocperip > 0) + if($maxprocperip and $maxprocperip > 0) $captive_portal_mod_evasive = "evasive.max-conns-per-ip = {$maxprocperip}"; else $captive_portal_mod_evasive = ""; @@ -1376,7 +1339,7 @@ function system_reboot_cleanup() { captiveportal_radius_stop_all(); require_once("voucher.inc"); voucher_save_db_to_config(); - // mwexec("/etc/rc.stop_packages"); + mwexec("/etc/rc.stop_packages"); } function system_do_shell_commands($early = 0) { diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 89c1a5e435..59e6d78587 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -35,7 +35,7 @@ /* pfSense_BUILDER_BINARIES: /usr/bin/killall /usr/local/sbin/sasyncd /sbin/ifconfig /sbin/sysctl - pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /usr/bin/netstat /sbin/route /bin/mkdir + pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /sbin/route /bin/mkdir pfSense_BUILDER_BINARIES: /usr/local/sbin/racoonctl /usr/local/sbin/racoon pfSense_BUILDER_BINARIES: /usr/local/sbin/filterdns /usr/local/sbin/mpd4 pfSense_MODULE: vpn @@ -126,10 +126,6 @@ function vpn_ipsec_configure($ipchg = false) /* fastforwarding is not compatible with ipsec tunnels */ mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0"); - /* this loads a route table which is used to determine if a route needs to be removed. */ - exec("/usr/bin/netstat -rnf inet", $route_arr, $retval); - $route_str = implode("\n", $route_arr); - /* resolve all local, peer addresses and setup pings */ $ipmap = array(); $rgmap = array(); @@ -419,6 +415,31 @@ function vpn_ipsec_configure($ipchg = false) $racoonconf .= "}\n\n"; } /* end mode_cfg section */ + + if ($a_client['user_source'] != "system") { + if (is_array($config['system']['authserver'])) { + foreach ($config['system']['authserver'] as $authcfg) { + if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source']) + $thisauthcfg = $authcfg; + } + + /* begin ldapcfg */ + $racoonconf .= "ldapcfg {\n"; + $racoonconf .= "\tversion 3;\n"; + $racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n"; + $lport = "389"; + if ($authcfg['port'] != "") + $lport = $authcfg['port']; + $racoonconf .= "\tport ".$lport.";\n"; + $racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n"; + $racoonconf .= "\tsubtree on;\n"; + $racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n"; + $racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n"; + $racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n"; + $racoonconf .= "}\n\n"; + /* end ldapcfg */ + } + } /* begin remote sections */ if (is_array($a_phase1) && count($a_phase1)) { @@ -894,15 +915,12 @@ EOD; /* FIXME: does adding route-to and reply-to on the in/outbound * rules fix this? smos@ 13-01-2009 */ // log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}"); - mwexec("/sbin/route delete -host {$rgip}; /sbin/route add -host {$rgip} {$gatewayip}", true); + mwexec("/sbin/route change -host {$rgip} {$gatewayip}", true); } } } - } elseif(is_ipaddr($rgip)) { - if(stristr($route_str, "{$rgip}")) { - mwexec("/sbin/route delete -host {$rgip}", true); - } - } + } else if(is_ipaddr($rgip)) + mwexec("/sbin/route delete -host {$rgip}", true); } fwrite($fd, $spdconf); @@ -1043,6 +1061,11 @@ function vpn_pptpd_configure() { unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.secret"); } + if (empty($pptpdcfg['n_pptp_units'])) { + log_error("Something wrong in the PPTPd configuration. Preventing starting the daemon because issues would arise."); + return; + } + /* make sure pptp-vpn directory exists */ if (!file_exists("{$g['varetc_path']}/pptp-vpn")) mkdir("{$g['varetc_path']}/pptp-vpn"); @@ -1196,8 +1219,11 @@ EOD; $mpdsecret = ""; if (is_array($pptpdcfg['user'])) { - foreach ($pptpdcfg['user'] as $user) - $mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n"; + foreach ($pptpdcfg['user'] as $user) { + $pass = str_replace('\\', '\\\\', $user['password']); + $pass = str_replace('"', '\"', $pass); + $mpdsecret .= "{$user['name']} \"{$pass}\" {$user['ip']}\n"; + } } fwrite($fd, $mpdsecret); diff --git a/etc/rc b/etc/rc index 8b807c938a..0070dffbc7 100755 --- a/etc/rc +++ b/etc/rc @@ -88,6 +88,10 @@ if grep -q cf /etc/fstab; then (/sbin/umount /cf; /sbin/fsck -fy /cf; /sbin/mount -w /cf) fi +# sync pw database after mount. +rm -f /etc/spwd.db.tmp +/usr/sbin/pwd_mkdb -d /etc/ /etc/master.passwd + product=`/usr/bin/grep product_name /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4` hideplatform=`/usr/bin/grep hideplatform /etc/inc/globals.inc | /usr/bin/wc -l` varrunpath=`/usr/bin/grep varrun_path /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4` diff --git a/etc/rc.stop_packages b/etc/rc.stop_packages index f20fa04287..43080e92fa 100755 --- a/etc/rc.stop_packages +++ b/etc/rc.stop_packages @@ -1,4 +1,6 @@ -#!/usr/local/bin/php -f +#!/bin/sh + +/usr/local/bin/php -q < +ENDPHP \ No newline at end of file diff --git a/usr/local/sbin/ppp-linkup b/usr/local/sbin/ppp-linkup index 12dda9b502..1e6cc01be9 100755 --- a/usr/local/sbin/ppp-linkup +++ b/usr/local/sbin/ppp-linkup @@ -10,14 +10,12 @@ if [ $ALLOWOVERRIDE -gt 0 ]; then # write nameservers to file if [ $6 = "dns1" ]; then echo $7 > /var/etc/nameserver_$1 - /sbin/route delete $7 - /sbin/route add $7 $4 + /sbin/route change $7 $4 fi if [ $8 = "dns2" ]; then echo $9 >> /var/etc/nameserver_$1 - /sbin/route delete $9 - /sbin/route add $9 $4 + /sbin/route change $9 $4 fi /usr/local/sbin/pfSctl -c 'service reload dns' /bin/sleep 1 diff --git a/usr/local/sbin/vpn-linkdown b/usr/local/sbin/vpn-linkdown index ac9ea2a353..4b6cff797d 100755 --- a/usr/local/sbin/vpn-linkdown +++ b/usr/local/sbin/vpn-linkdown @@ -2,4 +2,8 @@ # record logout /usr/bin/logger -p local3.info "logout,$1,$4,$5" -/sbin/pfctl -b $3/32 -b $4/32 +/sbin/pfctl -b 0.0.0.0/32 -b $4/32 +/sbin/pfctl -k $4/32 +/sbin/pfctl -k 0.0.0.0/32 $4/32 +/sbin/pfctl -K $4/32 +/sbin/pfctl -K 0.0.0.0/32 -K $4/32 diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index df482e27ce..b10e79c336 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -109,185 +109,183 @@ include("fbegin.inc"); ?> + + diff --git a/usr/local/www/interfaces_groups.php b/usr/local/www/interfaces_groups.php index 00bc613a43..e46652a342 100755 --- a/usr/local/www/interfaces_groups.php +++ b/usr/local/www/interfaces_groups.php @@ -47,11 +47,11 @@ $a_ifgroups = &$config['ifgroups']['ifgroupentry']; if ($_GET['act'] == "del") { if ($a_ifgroups[$_GET['id']]) { - $members = explode(" ", $a_ifgroups[$_GET[$id]]['members']); + $members = explode(" ", $a_ifgroups[$_GET['id']]['members']); foreach ($members as $ifs) { $realif = get_real_interface($ifs); if ($realif) - mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET[$id]]['ifname']); + mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET['id']]['ifname']); } unset($a_ifgroups[$_GET['id']]); write_config(); diff --git a/usr/local/www/status_gateways.php b/usr/local/www/status_gateways.php index 7e0ffc2d44..0aa6e56f6a 100755 --- a/usr/local/www/status_gateways.php +++ b/usr/local/www/status_gateways.php @@ -109,6 +109,9 @@ include("head.inc"); $online = gettext("Online"); $bgcolor = "lightgreen"; } + } else if (isset($gateway['monitor_disable'])) { + $online = gettext("Online"); + $bgcolor = "lightgreen"; } else { $online = gettext("Gathering data"); $bgcolor = "lightgray"; diff --git a/usr/local/www/status_openvpn.php b/usr/local/www/status_openvpn.php index 30c3a84960..4ad65d5d55 100644 --- a/usr/local/www/status_openvpn.php +++ b/usr/local/www/status_openvpn.php @@ -98,6 +98,7 @@ function kill_client($port, $remipp) { } $servers = openvpn_get_active_servers(); +$sk_servers = openvpn_get_active_servers("sharedkey"); $clients = openvpn_get_active_clients(); include("head.inc"); ?> @@ -141,13 +142,10 @@ include("head.inc"); ?>
+
+ -
- - - - - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + } + foreach ($interfaces as $iface => $ifacename): ?> + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + /* check to see if packet capture tcpdump is already running */ + $processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'"))); + + if ($processcheck != "") + $processisrunning = true; + else + $processisrunning = false; + + if (($action == gettext("Stop") or $action == "") and $processisrunning != true) + echo " "; + else { + echo " "; + } + if (file_exists($fp.$fn) and $processisrunning != true) { + echo ""; + echo "  (" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")"; + } +?> + + +
-
+ -
-
- -
-
- -
-
-
-
- -
-
-
- -
-
- -
" . gettext("Enter 0 (zero) for no count limit.");?> -
- -
" . - gettext("Note:") . " " . - gettext("This option does not affect the level of detail when downloading the packet capture.");?> -
- > -
-
: -
  - "; - else { - echo " "; - } - if (file_exists($fp.$fn) and $processisrunning != true) { - echo ""; - echo "  (" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")"; - } -?> -
-"; - if ($processisrunning == true) - echo("" . gettext("Packet Capture is running.") . "
"); - - if ($do_tcpdump) { - $matches = array(); - - if (($fam == "ip6") || ($fam == "ip")) - $matches[] = $fam; - - if ($port != "") - $matches[] = "port ".$port; - - if ($host != "") { - if (is_ipaddr($host)) - $matches[] = "host " . $host; - elseif (is_subnet($host)) - $matches[] = "net " . $host; - } - - if ($count != "0" ) { - $searchcount = "-c " . $count; - } else { - $searchcount = ""; - } - - $selectedif = convert_friendly_interface_to_real_interface_name($selectedif); - - if ($action == gettext("Start")) { - $matchstr = implode($matches, " and "); - echo("" . gettext("Packet Capture is running.") . "
"); - mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"); - // echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"; - } else { - //action = stop - echo("" . gettext("Packet Capture stopped.") . "

" . gettext("Packets Captured:") . "
"); -?> - - -
+ +
+
+ +
+
+
+
+ +
+
+
+ +
+
+ +
" . gettext("Enter 0 (zero) for no count limit.");?> +
+ +
" . + gettext("Note:") . " " . + gettext("This option does not affect the level of detail when downloading the packet capture.");?> +
+ > +
+
: +
  + - -
+ + + + + +
+"; + if ($processisrunning == true) + echo("" . gettext("Packet Capture is running.") . "
"); + + if ($do_tcpdump) { + $matches = array(); + + if (($fam == "ip6") || ($fam == "ip")) + $matches[] = $fam; + + if ($port != "") + $matches[] = "port ".$port; + + if ($host != "") { + if (is_ipaddr($host)) + $matches[] = "host " . $host; + elseif (is_subnet($host)) + $matches[] = "net " . $host; + } + + if ($count != "0" ) { + $searchcount = "-c " . $count; + } else { + $searchcount = ""; + } + + $selectedif = convert_friendly_interface_to_real_interface_name($selectedif); + + if ($action == gettext("Start")) { + $matchstr = implode($matches, " and "); + echo("" . gettext("Packet Capture is running.") . "
"); + mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"); + // echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"; + } else { + //action = stop + echo("" . gettext("Packet Capture stopped.") . "

" . gettext("Packets Captured:") . "
"); +?> + + +
+
$alias['name']) { foreach ($a_aliases as $aliasid => $aliasd) { @@ -581,6 +586,7 @@ EOD;
diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index da9abd1d22..8e61360f4e 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -409,11 +409,9 @@ if($_REQUEST['undodrag']) { $sshport = ""; if (isset($config['system']['enablesshd'])) { - $sshport = 22; - if($config['system']['ssh']['port'] <> "") - $sshport = $config['system']['ssh']['port']; + $sshport = ($config['system']['ssh']['port']) ? $config['system']['ssh']['port'] : 22; } - $sshport = "22
"; + $sshport = "{$sshport}
"; ?>
 
- - - -
- +
Status data is not available for shared key servers. @@ -194,19 +192,68 @@ include("head.inc"); ?>

+ + + + + + +
+ +
+ + + + + + + + + + + '> + + + + + + + + + +
+ + + + + + + + + + + + + +
+ + + + +
diff --git a/usr/local/www/system_crlmanager.php b/usr/local/www/system_crlmanager.php index 201d8ab6fa..8d975dbca4 100644 --- a/usr/local/www/system_crlmanager.php +++ b/usr/local/www/system_crlmanager.php @@ -39,6 +39,7 @@ require("guiconfig.inc"); require_once("certs.inc"); +require_once('openvpn.inc'); global $openssl_crl_status; @@ -145,7 +146,6 @@ if ($act == "addcert") { if (!$input_errors) { $reason = (empty($pconfig['crlreason'])) ? OCSP_REVOKED_STATUS_UNSPECIFIED : $pconfig['crlreason']; cert_revoke($cert, $crl, $reason); - require_once('openvpn.inc'); openvpn_refresh_crls(); write_config("Revoked cert {$cert['descr']} in CRL {$crl['descr']}."); pfSenseHeader("system_crlmanager.php"); @@ -173,7 +173,6 @@ if ($act == "delcert") { $name = $thiscert['descr']; if (cert_unrevoke($thiscert, $thiscrl)) { $savemsg = sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr']) . "
"; - require_once('openvpn.inc'); openvpn_refresh_crls(); write_config(sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr'])); } else { diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index f34df9fba9..5ff9578e75 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -66,6 +66,7 @@ if (isset($id) && $a_gateways[$id]) { $pconfig = array(); $pconfig['name'] = $a_gateways[$id]['name']; $pconfig['weight'] = $a_gateways[$id]['weight']; + $pconfig['interval'] = $a_gateways[$id]['interval']; $pconfig['interface'] = $a_gateways[$id]['interface']; $pconfig['friendlyiface'] = $a_gateways[$id]['friendlyiface']; if (isset($a_gateways[$id]['dynamic'])) @@ -78,6 +79,7 @@ if (isset($id) && $a_gateways[$id]) { $pconfig['losshigh'] = $a_gateway_item[$id]['losshigh']; $pconfig['down'] = $a_gateway_item[$id]['down']; $pconfig['monitor'] = $a_gateways[$id]['monitor']; + $pconfig['monitor_disable'] = isset($a_gateways[$id]['monitor_disable']); $pconfig['descr'] = $a_gateways[$id]['descr']; $pconfig['attribute'] = $a_gateways[$id]['attribute']; } @@ -232,8 +234,11 @@ if ($_POST) { $gateway['gateway'] = "dynamic"; $gateway['name'] = $_POST['name']; $gateway['weight'] = $_POST['weight']; + $gateway['interval'] = $_POST['interval']; $gateway['descr'] = $_POST['descr']; - if (is_ipaddr($_POST['monitor'])) + if ($_POST['monitor_disable'] == "yes") + $gateway['monitor_disable'] = true; + else if (is_ipaddr($_POST['monitor'])) $gateway['monitor'] = $_POST['monitor']; if ($_POST['defaultgw'] == "yes" || $_POST['defaultgw'] == "on") { @@ -307,6 +312,9 @@ function show_advanced_gateway() { aodiv = document.getElementById('showgatewayadv'); aodiv.style.display = "block"; } +function monitor_change() { + document.iform.monitor.disabled = document.iform.monitor_disable.checked; +} @@ -365,6 +373,14 @@ function show_advanced_gateway() { + + + + @@ -461,7 +485,7 @@ function show_advanced_gateway() { diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index b4b1b059c0..fe28963698 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -355,7 +355,19 @@ function login_banner_change() { diff --git a/usr/local/www/vpn_openvpn_csc.php b/usr/local/www/vpn_openvpn_csc.php index e980332d2f..91d4ea0f77 100644 --- a/usr/local/www/vpn_openvpn_csc.php +++ b/usr/local/www/vpn_openvpn_csc.php @@ -61,7 +61,7 @@ if ($_GET['act'] == "del") { exit; } - openvpn_delete_csc($$a_csc[$id]); + openvpn_delete_csc($a_csc[$id]); unset($a_csc[$id]); write_config(); $savemsg = gettext("Client Specific Override successfully deleted")."
"; diff --git a/usr/local/www/vpn_pptp.php b/usr/local/www/vpn_pptp.php index aee2416acd..52190eca05 100755 --- a/usr/local/www/vpn_pptp.php +++ b/usr/local/www/vpn_pptp.php @@ -353,9 +353,13 @@ function enable_change(enable_over) { +
+ . +
+ . +
+
+ . +
- +
+ onClick="monitor_change()" /> +
+ +
@@ -385,10 +401,10 @@ function show_advanced_gateway() {
-
1)) echo "style='display:none'"; ?>> +
1) || (isset($pconfig['interval']) && $pconfig['interval'])) echo "style='display:none'"; ?>> - Show advanced option
-
> +
> @@ -438,6 +454,14 @@ function show_advanced_gateway() {
+ + + + +
+ +
:  
-
- .
@@ -95,7 +96,7 @@ $clients = openvpn_get_active_clients(); @@ -140,14 +141,61 @@ $clients = openvpn_get_active_clients();
- Client connections for + Client connections
-
+ + + + + + +
+ Shared Key Server Instance Statistics +
+ + + + + + '> + + + + + '> + + + + +
Name/TimeRemote/Virtual IP
+ + + + + "; + ?> +
+ + + +
+
+ @@ -158,7 +206,7 @@ $clients = openvpn_get_active_clients(); - '> + '> @@ -178,7 +226,7 @@ $clients = openvpn_get_active_clients(); ?> - '> + '> diff --git a/usr/local/www/wizards/traffic_shaper_wizard.inc b/usr/local/www/wizards/traffic_shaper_wizard.inc index ee800cee1f..9676a31c89 100644 --- a/usr/local/www/wizards/traffic_shaper_wizard.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard.inc @@ -1056,7 +1056,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1295,7 +1295,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc b/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc index bb25f79c52..9cfb8f2608 100755 --- a/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc @@ -1119,7 +1119,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 3; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1359,7 +1359,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc b/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc index 519364fb5a..3e776d3974 100755 --- a/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc @@ -1167,7 +1167,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1409,7 +1409,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc b/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc index 9fdc3a375d..301aa553b7 100644 --- a/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc @@ -557,7 +557,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -802,7 +802,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") {
- OpenVPN client instances statistics + Client Instance Statistics