From 64f3141f5fdb26e5d68cc4e3a93390062d50c462 Mon Sep 17 00:00:00 2001 From: Bryan Haase Date: Fri, 22 Jul 2011 08:18:55 -0500 Subject: [PATCH 01/38] Ipsec xAuth patch --- etc/inc/upgrade_config.inc | 2 +- etc/inc/vpn.inc | 16 ++++++++++++++++ usr/local/www/vpn_ipsec_mobile.php | 1 + 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 1abc8c57c6..f1bb57d527 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1139,7 +1139,7 @@ function upgrade_046_to_047() { if (isset($config['ipsec']['mobileclients']['enable'])) { $config['ipsec']['client']['enable'] = true; - $config['ipsec']['client']['user_source'] = 'system'; + $config['ipsec']['client']['enable'] = $config['ipsec']['mobileclients']['user_source']; $config['ipsec']['client']['group_source'] = 'system'; } diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 89c1a5e435..47bced9ad8 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -419,6 +419,22 @@ function vpn_ipsec_configure($ipchg = false) $racoonconf .= "}\n\n"; } /* end mode_cfg section */ + + /* begin ldapcfg */ + $authcfg = $config['system']['authserver'][0]; + $racoonconf .= "ldapcfg {\n"; + $racoonconf .= "\tversion 3;\n"; + $racoonconf .= "\thost \"".$authcfg['host']."\";\n"; + $lport = "389"; + if ($authcfg['port'] != "") {$lport = $authcfg['port'];}; + $racoonconf .= "\tport ".$lport.";\n"; + $racoonconf .= "\tbase \"".$authcfg['ldap_basedn']."\";\n"; + $racoonconf .= "\tsubtree on;\n"; + $racoonconf .= "\tbind_dn \"".$authcfg['ldap_binddn']."\";\n"; + $racoonconf .= "\tbind_pw \"".$authcfg['ldap_bindpw']."\";\n"; + $racoonconf .= "\tattr_user \"".$authcfg['ldap_attr_user']."\";\n"; + $racoonconf .= "}\n\n"; + /* end ldapcfg */ /* begin remote sections */ if (is_array($a_phase1) && count($a_phase1)) { diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index b4b1b059c0..281ee5e24e 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -355,6 +355,7 @@ function login_banner_change() { :   From e9ccd9b1cb91ef975a11429ec6bc08c1c149c11d Mon Sep 17 00:00:00 2001 From: Bryan Haase Date: Fri, 22 Jul 2011 09:18:20 -0500 Subject: [PATCH 02/38] More sanity checking --- etc/inc/vpn.inc | 25 ++++++++++++++++--------- usr/local/www/vpn_ipsec_mobile.php | 8 +++++++- 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 47bced9ad8..b01d0309d8 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -420,22 +420,29 @@ function vpn_ipsec_configure($ipchg = false) } /* end mode_cfg section */ - /* begin ldapcfg */ - $authcfg = $config['system']['authserver'][0]; + if ($a_client['user_source'] = "ldap") + { + foreach ($config['system']['authserver'] as $authcfg) { + if ($authcfg['type'] == 'ldap') { + $thisauthcfg = $authcfg; + } + } + + /* begin ldapcfg */ $racoonconf .= "ldapcfg {\n"; $racoonconf .= "\tversion 3;\n"; - $racoonconf .= "\thost \"".$authcfg['host']."\";\n"; + $racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n"; $lport = "389"; if ($authcfg['port'] != "") {$lport = $authcfg['port'];}; $racoonconf .= "\tport ".$lport.";\n"; - $racoonconf .= "\tbase \"".$authcfg['ldap_basedn']."\";\n"; + $racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n"; $racoonconf .= "\tsubtree on;\n"; - $racoonconf .= "\tbind_dn \"".$authcfg['ldap_binddn']."\";\n"; - $racoonconf .= "\tbind_pw \"".$authcfg['ldap_bindpw']."\";\n"; - $racoonconf .= "\tattr_user \"".$authcfg['ldap_attr_user']."\";\n"; + $racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n"; + $racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n"; + $racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n"; $racoonconf .= "}\n\n"; - /* end ldapcfg */ - + /* end ldapcfg */ + } /* begin remote sections */ if (is_array($a_phase1) && count($a_phase1)) { /* begin remote */ diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index 281ee5e24e..34b72d11c1 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -355,7 +355,13 @@ function login_banner_change() { :   From e3d357047cfb5e12d9dc1cb4121d20f604c8a29a Mon Sep 17 00:00:00 2001 From: Bryan Haase Date: Fri, 22 Jul 2011 09:20:14 -0500 Subject: [PATCH 03/38] format error --- etc/inc/vpn.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index b01d0309d8..407a490a26 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -420,8 +420,8 @@ function vpn_ipsec_configure($ipchg = false) } /* end mode_cfg section */ - if ($a_client['user_source'] = "ldap") - { + if ($a_client['user_source'] = "ldap") + { foreach ($config['system']['authserver'] as $authcfg) { if ($authcfg['type'] == 'ldap') { $thisauthcfg = $authcfg; From ca3537ba31f597404bd53cb91823fb8bb83b18a1 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 25 Jul 2011 10:58:21 -0400 Subject: [PATCH 04/38] Sync password database right after mount, in case it is corrupt. (Except on CD-ROM platform). --- etc/rc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/etc/rc b/etc/rc index 8b807c938a..0dd694665e 100755 --- a/etc/rc +++ b/etc/rc @@ -88,6 +88,12 @@ if grep -q cf /etc/fstab; then (/sbin/umount /cf; /sbin/fsck -fy /cf; /sbin/mount -w /cf) fi +# sync pw database after mount. +if [ ! "$PLATFORM" = "cdrom" ] ; then + rm -f /etc/spwd.db.tmp + /usr/sbin/pwd_mkdb -d /etc/ /etc/master.passwd +fi + product=`/usr/bin/grep product_name /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4` hideplatform=`/usr/bin/grep hideplatform /etc/inc/globals.inc | /usr/bin/wc -l` varrunpath=`/usr/bin/grep varrun_path /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4` From 01656166186ac300c4e06d1e74766f3dc404cd06 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 25 Jul 2011 11:01:15 -0400 Subject: [PATCH 05/38] Run on CD-ROM, too, it should be writable after rc.cdrom --- etc/rc | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/etc/rc b/etc/rc index 0dd694665e..0070dffbc7 100755 --- a/etc/rc +++ b/etc/rc @@ -89,10 +89,8 @@ if grep -q cf /etc/fstab; then fi # sync pw database after mount. -if [ ! "$PLATFORM" = "cdrom" ] ; then - rm -f /etc/spwd.db.tmp - /usr/sbin/pwd_mkdb -d /etc/ /etc/master.passwd -fi +rm -f /etc/spwd.db.tmp +/usr/sbin/pwd_mkdb -d /etc/ /etc/master.passwd product=`/usr/bin/grep product_name /etc/inc/globals.inc | /usr/bin/cut -d'"' -f4` hideplatform=`/usr/bin/grep hideplatform /etc/inc/globals.inc | /usr/bin/wc -l` From 6813d6e7cff0d488c489f284dabf47ee4384a64c Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Mon, 25 Jul 2011 11:07:58 -0400 Subject: [PATCH 06/38] Add a flag that defaults to on allowing the control of delete states from external callers such as pfCenter --- etc/inc/filter.inc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 1b1afa2d39..c575adc56c 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -183,7 +183,7 @@ function filter_delete_states_for_down_gateways() { } /* reload filter sync */ -function filter_configure_sync() { +function filter_configure_sync($delete_states_if_needed = true) { global $config, $g, $after_filter_configure_run, $FilterIflist; global $time_based_rules, $filterdns, $aliases; @@ -397,8 +397,10 @@ function filter_configure_sync() { if($g['booting'] == true) echo "."; - update_filter_reload_status(gettext("Processing down interface states")); - filter_delete_states_for_down_gateways(); + if($delete_states_if_needed) { + update_filter_reload_status(gettext("Processing down interface states")); + filter_delete_states_for_down_gateways(); + } update_filter_reload_status(gettext("Running plugins")); From b368b35a6751d5b29c17ba1c5ec29fdd4a4861d1 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 17:56:25 +0000 Subject: [PATCH 07/38] Resolve issues that made php core dump or eat a lot of memory when big routing tables are present. --- etc/inc/system.inc | 48 ++++++---------------------------------------- 1 file changed, 6 insertions(+), 42 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 15d38e5185..0d04de6833 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -31,7 +31,7 @@ /* pfSense_BUILDER_BINARIES: /usr/sbin/powerd /usr/bin/killall /sbin/sysctl /sbin/route - pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/bin/netstat /usr/sbin/syslogd + pfSense_BUILDER_BINARIES: /bin/hostname /bin/ls /usr/sbin/syslogd pfSense_BUILDER_BINARIES: /usr/sbin/pccardd /usr/local/sbin/lighttpd /bin/chmod /bin/mkdir pfSense_BUILDER_BINARIES: /usr/bin/tar /usr/local/sbin/ntpd /usr/sbin/ntpdate pfSense_BUILDER_BINARIES: /usr/bin/nohup /sbin/dmesg /usr/local/sbin/atareinit /sbin/kldload @@ -398,52 +398,19 @@ function system_routing_configure($interface = "") { } } } - /* Create a array from the existing inet route table */ - exec("/usr/bin/netstat -rnf inet", $route_str); - array_shift($route_str); - array_shift($route_str); - array_shift($route_str); - array_shift($route_str); - $route_arr = array(); - foreach($route_str as $routeline) { - $items = preg_split("/[ ]+/i", $routeline); - $route_arr[$items[0]] = array($items[0], $items[1], $items[5]); - } if ($dont_add_route == false ) { if (!empty($interface) && $interface != $interfacegw) ; else if (($interfacegw <> "bgpd") && (is_ipaddrv4($gatewayip))) { - $action = "add"; - if(isset($route_arr['default'])) { - $action = "change"; - } - log_error("ROUTING: $action default route to $gatewayip"); - mwexec("/sbin/route {$action} -inet default " . escapeshellarg($gatewayip)); + log_error("ROUTING: setting default route to $gatewayip"); + mwexec("/sbin/route change -inet default " . escapeshellarg($gatewayip)); } - } - /* Create a array from the existing inet6 route table */ - exec("/usr/bin/netstat -rnf inet6", $routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - array_shift($routev6_str); - $routev6_arr = array(); - foreach($routev6_str as $routeline) { - $items = preg_split("/[ ]+/i", $routeline); - $routev6_arr[$items[0]] = array($items[0], $items[1], $items[5]); - } - - if ($dont_add_route == false ) { if (!empty($interface) && $interface != $interfacegwv6) ; else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) { - $action = "add"; - if(isset($routev6_arr['default'])) { - $action = "change"; - } - log_error("ROUTING: $action IPv6 default route to $gatewayipv6"); + log_error("ROUTING: setting IPv6 default route to $gatewayipv6"); mwexec("/sbin/route {$action} -inet6 default " . escapeshellarg($gatewayipv6)); } } @@ -463,9 +430,6 @@ function system_routing_configure($interface = "") { $gatewayip = $gateway['gateway']; $interfacegw = $gateway['interface']; - $action = "add"; - if (isset($route_arr[$rtent['network']])) - $action = "change"; if(is_ipaddrv6($gatewayip)) { $inetfamily = "-inet6"; @@ -473,10 +437,10 @@ function system_routing_configure($interface = "") { $inetfamily = "-inet"; } if (is_ipaddr($gatewayip)) { - mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) . " " . escapeshellarg($gatewayip)); } else if (!empty($interfacegw)) { - mwexec("/sbin/route {$action} {$inetfamily} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route change {$inetfamily} " . escapeshellarg($rtent['network']) . " -iface " . escapeshellarg($interfacegw)); } } From 073cd52e5836a961bcaf677d34b2252964fc9e10 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 19:05:47 +0000 Subject: [PATCH 08/38] Resolves #1703. Correct array key value. --- usr/local/www/interfaces_groups.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/interfaces_groups.php b/usr/local/www/interfaces_groups.php index 00bc613a43..e46652a342 100755 --- a/usr/local/www/interfaces_groups.php +++ b/usr/local/www/interfaces_groups.php @@ -47,11 +47,11 @@ $a_ifgroups = &$config['ifgroups']['ifgroupentry']; if ($_GET['act'] == "del") { if ($a_ifgroups[$_GET['id']]) { - $members = explode(" ", $a_ifgroups[$_GET[$id]]['members']); + $members = explode(" ", $a_ifgroups[$_GET['id']]['members']); foreach ($members as $ifs) { $realif = get_real_interface($ifs); if ($realif) - mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET[$id]]['ifname']); + mwexec("/sbin/ifconfig {$realif} -group " . $a_ifgroups[$_GET['id']]['ifname']); } unset($a_ifgroups[$_GET['id']]); write_config(); From 74dafdec2bdf51929db6a8880dd3ec20263e9565 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 19:36:18 +0000 Subject: [PATCH 09/38] Use change here to be cleaner and less disruptive. --- etc/inc/gwlb.inc | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 0caa84061d..382bfba8f1 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -216,8 +216,7 @@ EOD; */ if (is_ipaddr($gateway['gateway']) && $gateway['monitor'] != $gateway['gateway']) { log_error(sprintf(gettext('Removing static route for monitor %1$s and adding a new route through %2$s'), $gateway['monitor'], $gateway['gateway'])); - mwexec("/sbin/route delete -host " . escapeshellarg($gateway['monitor']), true); - mwexec("/sbin/route add -host " . escapeshellarg($gateway['monitor']) . + mwexec("/sbin/route change -host " . escapeshellarg($gateway['monitor']) . " " . escapeshellarg($gateway['gateway']), true); } @@ -403,12 +402,12 @@ function return_gateway_groups_array() { $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { log_error("Default gateway down setting {$upgw} as default!"); - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); + mwexec("/sbin/route change -inet default {$gateways_arr[$upgw]['gateway']}"); } } else { $defaultgw = trim(`/sbin/route -n get -inet default | /usr/bin/grep gateway | /usr/bin/sed 's/gateway://g'`, " \n"); if ($defaultgw != $gateways_arr[$dfltgwname]['gateway']) - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$dfltgwname]['gateway']}"); + mwexec("/sbin/route change -inet default {$gateways_arr[$dfltgwname]['gateway']}"); } unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng); From 8ff6b72c27c014a17a35da9aed0f02bc4e43d6fe Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 19:39:07 +0000 Subject: [PATCH 10/38] Use the new change to be less distuptive --- etc/inc/vpn.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 89c1a5e435..7434f102ba 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -894,7 +894,7 @@ EOD; /* FIXME: does adding route-to and reply-to on the in/outbound * rules fix this? smos@ 13-01-2009 */ // log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}"); - mwexec("/sbin/route delete -host {$rgip}; /sbin/route add -host {$rgip} {$gatewayip}", true); + mwexec("/sbin/route change -host {$rgip} {$gatewayip}", true); } } } From 6390cdac26862ed5494106797ea9e7a876fdea43 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 19:42:22 +0000 Subject: [PATCH 11/38] Use the new change to be less distuptive --- usr/local/sbin/ppp-linkup | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/usr/local/sbin/ppp-linkup b/usr/local/sbin/ppp-linkup index 12dda9b502..1e6cc01be9 100755 --- a/usr/local/sbin/ppp-linkup +++ b/usr/local/sbin/ppp-linkup @@ -10,14 +10,12 @@ if [ $ALLOWOVERRIDE -gt 0 ]; then # write nameservers to file if [ $6 = "dns1" ]; then echo $7 > /var/etc/nameserver_$1 - /sbin/route delete $7 - /sbin/route add $7 $4 + /sbin/route change $7 $4 fi if [ $8 = "dns2" ]; then echo $9 >> /var/etc/nameserver_$1 - /sbin/route delete $9 - /sbin/route add $9 $4 + /sbin/route change $9 $4 fi /usr/local/sbin/pfSctl -c 'service reload dns' /bin/sleep 1 From 320bba6494cf42e6cec3ef9ee7635f528a9e62c6 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 25 Jul 2011 21:10:47 +0000 Subject: [PATCH 12/38] Always send the route delete command even if it fails its ok. This avoids having to dump the routing table. --- etc/inc/vpn.inc | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 7434f102ba..921743f091 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -35,7 +35,7 @@ /* pfSense_BUILDER_BINARIES: /usr/bin/killall /usr/local/sbin/sasyncd /sbin/ifconfig /sbin/sysctl - pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /usr/bin/netstat /sbin/route /bin/mkdir + pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /sbin/route /bin/mkdir pfSense_BUILDER_BINARIES: /usr/local/sbin/racoonctl /usr/local/sbin/racoon pfSense_BUILDER_BINARIES: /usr/local/sbin/filterdns /usr/local/sbin/mpd4 pfSense_MODULE: vpn @@ -126,10 +126,6 @@ function vpn_ipsec_configure($ipchg = false) /* fastforwarding is not compatible with ipsec tunnels */ mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0"); - /* this loads a route table which is used to determine if a route needs to be removed. */ - exec("/usr/bin/netstat -rnf inet", $route_arr, $retval); - $route_str = implode("\n", $route_arr); - /* resolve all local, peer addresses and setup pings */ $ipmap = array(); $rgmap = array(); @@ -898,11 +894,8 @@ EOD; } } } - } elseif(is_ipaddr($rgip)) { - if(stristr($route_str, "{$rgip}")) { - mwexec("/sbin/route delete -host {$rgip}", true); - } - } + } else if(is_ipaddr($rgip)) + mwexec("/sbin/route delete -host {$rgip}", true); } fwrite($fd, $spdconf); From 6b2dcac596477f7201a0c6b5734ab8f1b9a04c5e Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 26 Jul 2011 21:30:38 +0000 Subject: [PATCH 13/38] Resolves #1719. Prevent disabled client/servers from being displayed on the widget. --- etc/inc/openvpn.inc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index eb6ed738c9..6a1ddc3f34 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -780,7 +780,10 @@ function openvpn_get_active_servers() { $servers = array(); if (is_array($config['openvpn']['openvpn-server'])) { foreach ($config['openvpn']['openvpn-server'] as & $settings) { - + + if (empty($settings) || isset($settings['disable'])) + continue; + $prot = $settings['protocol']; $port = $settings['local_port']; @@ -866,6 +869,9 @@ function openvpn_get_active_clients() { if (is_array($config['openvpn']['openvpn-client'])) { foreach ($config['openvpn']['openvpn-client'] as & $settings) { + if (empty($settings) || isset($settings['disable'])) + continue; + $prot = $settings['protocol']; $port = $settings['local_port']; From 2c189c8cb110bc293acbb88c6930e636e19db5d4 Mon Sep 17 00:00:00 2001 From: Bryan Haase Date: Wed, 27 Jul 2011 08:47:10 -0500 Subject: [PATCH 14/38] Improved ipsec ldap xauth --- etc/inc/vpn.inc | 5 +++-- usr/local/www/vpn_ipsec_mobile.php | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 407a490a26..6bf55b8e6a 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -420,10 +420,11 @@ function vpn_ipsec_configure($ipchg = false) } /* end mode_cfg section */ - if ($a_client['user_source'] = "ldap") + if ($a_client['user_source'] != "system") { foreach ($config['system']['authserver'] as $authcfg) { - if ($authcfg['type'] == 'ldap') { + if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source']) + { $thisauthcfg = $authcfg; } } diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index 34b72d11c1..9d81c53f90 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -358,11 +358,13 @@ function login_banner_change() { ldap'; + $selected = ""; + if ($pconfig['user_source'] == $authcfg['name']) $selected = "selected"; + print ''; } } ?> - + From 95305736abcdf964f9ea03ebd628b1abbfeab5fc Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 27 Jul 2011 11:36:08 -0400 Subject: [PATCH 15/38] Rework OpenVPN status, show status for shared key servers. --- etc/inc/openvpn.inc | 284 +++++++++--------- usr/local/www/status_openvpn.php | 59 +++- .../www/widgets/widgets/openvpn.widget.php | 58 +++- 3 files changed, 250 insertions(+), 151 deletions(-) diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index 6a1ddc3f34..53f4a741e6 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -774,13 +774,12 @@ function openvpn_resync_all($interface = "") { } -function openvpn_get_active_servers() { +function openvpn_get_active_servers($type="ssl") { global $config, $g; $servers = array(); if (is_array($config['openvpn']['openvpn-server'])) { foreach ($config['openvpn']['openvpn-server'] as & $settings) { - if (empty($settings) || isset($settings['disable'])) continue; @@ -788,7 +787,7 @@ function openvpn_get_active_servers() { $port = $settings['local_port']; $server = array(); - $server['port'] = $settings['local_port']; + $server['port'] = ($settings['local_port']) ? $settings['local_port'] : 1194; $server['mode'] = $settings['mode']; if ($settings['description']) $server['name'] = "{$settings['description']} {$prot}:{$port}"; @@ -797,71 +796,75 @@ function openvpn_get_active_servers() { $server['conns'] = array(); $vpnid = $settings['vpnid']; - $mode_id = "server{$vpnid}"; + $mode_id = "server{$vpnid}"; $server['mgmt'] = $mode_id; - $tcpsrv = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; - $errval; - $errstr; - - /* open a tcp connection to the management port of each server */ - $fp = @stream_socket_client($tcpsrv, $errval, $errstr, 1); - if ($fp) { - stream_set_timeout($fp, 1); - - /* send our status request */ - fputs($fp, "status 2\n"); - - /* recv all response lines */ - while (!feof($fp)) { - - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - - /* parse header list line */ - if (strstr($line, "HEADER")) - continue; - - /* parse end of output line */ - if (strstr($line, "END") || strstr($line, "ERROR")) - break; - - /* parse client list line */ - if (strstr($line, "CLIENT_LIST")) { - $list = explode(",", $line); - $conn = array(); - $conn['common_name'] = $list[1]; - $conn['remote_host'] = $list[2]; - $conn['virtual_addr'] = $list[3]; - $conn['bytes_recv'] = $list[4]; - $conn['bytes_sent'] = $list[5]; - $conn['connect_time'] = $list[6]; - $server['conns'][] = $conn; - } - } - - /* cleanup */ - fclose($fp); - } else { - $conn = array(); - $conn['common_name'] = "[error]"; - $conn['remote_host'] = "Management Daemon Unreachable"; - $conn['virtual_addr'] = ""; - $conn['bytes_recv'] = 0; - $conn['bytes_sent'] = 0; - $conn['connect_time'] = 0; - $server['conns'][] = $conn; - } - - $servers[] = $server; + $socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; + if (($server['mode'] == "p2p_shared_key") && ($type == "sharedkey")) + $servers[] = openvpn_get_client_status($server, $socket); + elseif (($server['mode'] != "p2p_shared_key") && ($type == "ssl")) + $servers[] = openvpn_get_server_status($server, $socket); } } return $servers; } +function openvpn_get_server_status($server, $socket) { + $errval; + $errstr; + $fp = @stream_socket_client($socket, $errval, $errstr, 1); + if ($fp) { + stream_set_timeout($fp, 1); + + /* send our status request */ + fputs($fp, "status 2\n"); + + /* recv all response lines */ + while (!feof($fp)) { + + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + /* parse header list line */ + if (strstr($line, "HEADER")) + continue; + + /* parse end of output line */ + if (strstr($line, "END") || strstr($line, "ERROR")) + break; + + /* parse client list line */ + if (strstr($line, "CLIENT_LIST")) { + $list = explode(",", $line); + $conn = array(); + $conn['common_name'] = $list[1]; + $conn['remote_host'] = $list[2]; + $conn['virtual_addr'] = $list[3]; + $conn['bytes_recv'] = $list[4]; + $conn['bytes_sent'] = $list[5]; + $conn['connect_time'] = $list[6]; + $server['conns'][] = $conn; + } + } + + /* cleanup */ + fclose($fp); + } else { + $conn = array(); + $conn['common_name'] = "[error]"; + $conn['remote_host'] = "Management Daemon Unreachable"; + $conn['virtual_addr'] = ""; + $conn['bytes_recv'] = 0; + $conn['bytes_sent'] = 0; + $conn['connect_time'] = 0; + $server['conns'][] = $conn; + } + return $server; +} + function openvpn_get_active_clients() { global $config, $g; @@ -873,99 +876,100 @@ function openvpn_get_active_clients() { continue; $prot = $settings['protocol']; - $port = $settings['local_port']; + $port = ($settings['local_port']) ? ":{$settings['local_port']}" : ""; $client = array(); $client['port'] = $settings['local_port']; if ($settings['description']) - $client['name'] = "{$settings['description']} {$prot}:{$port}"; + $client['name'] = "{$settings['description']} {$prot}{$port}"; else - $client['name'] = "Client {$prot}:{$port}"; + $client['name'] = "Client {$prot}{$port}"; $vpnid = $settings['vpnid']; - $mode_id = "client{$vpnid}"; + $mode_id = "client{$vpnid}"; $client['mgmt'] = $mode_id; - $tcpcli = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; - $errval; - $errstr; - + $socket = "unix://{$g['varetc_path']}/openvpn/{$mode_id}.sock"; $client['status']="down"; - - /* open a tcp connection to the management port of each cli */ - $fp = @stream_socket_client($tcpcli, $errval, $errstr, 1); - if ($fp) { - stream_set_timeout($fp, 1); - /* send our status request */ - fputs($fp, "state 1\n"); - - /* recv all response lines */ - while (!feof($fp)) { - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - /* Get the client state */ - if (strstr($line,"CONNECTED")) { - $client['status']="up"; - $list = explode(",", $line); - - $client['connect_time'] = date("D M j G:i:s Y", $list[0]); - $client['virtual_addr'] = $list[3]; - $client['remote_host'] = $list[4]; - } - /* parse end of output line */ - if (strstr($line, "END") || strstr($line, "ERROR")) - break; - } - - /* If up, get read/write stats */ - if (strcmp($client['status'], "up") == 0) { - fputs($fp, "status 2\n"); - /* recv all response lines */ - while (!feof($fp)) { - /* read the next line */ - $line = fgets($fp, 1024); - - $info = stream_get_meta_data($fp); - if ($info['timed_out']) - break; - - if (strstr($line,"TCP/UDP read bytes")) { - $list = explode(",", $line); - $client['bytes_recv'] = $list[1]; - } - - if (strstr($line,"TCP/UDP write bytes")) { - $list = explode(",", $line); - $client['bytes_sent'] = $list[1]; - } - - /* parse end of output line */ - if (strstr($line, "END")) - break; - } - } - - fclose($fp); - - } else { - $DisplayNote=true; - $client['remote_host'] = "No Management Daemon"; - $client['virtual_addr'] = "See Note Below"; - $client['bytes_recv'] = 0; - $client['bytes_sent'] = 0; - $client['connect_time'] = 0; - } - - $clients[] = $client; + $clients[] = openvpn_get_client_status($client, $socket); } } return $clients; } +function openvpn_get_client_status($client, $socket) { + $errval; + $errstr; + $fp = @stream_socket_client($socket, $errval, $errstr, 1); + if ($fp) { + stream_set_timeout($fp, 1); + /* send our status request */ + fputs($fp, "state 1\n"); + + /* recv all response lines */ + while (!feof($fp)) { + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + /* Get the client state */ + if (strstr($line,"CONNECTED")) { + $client['status']="up"; + $list = explode(",", $line); + + $client['connect_time'] = date("D M j G:i:s Y", $list[0]); + $client['virtual_addr'] = $list[3]; + $client['remote_host'] = $list[4]; + } + /* parse end of output line */ + if (strstr($line, "END") || strstr($line, "ERROR")) + break; + } + + /* If up, get read/write stats */ + if (strcmp($client['status'], "up") == 0) { + fputs($fp, "status 2\n"); + /* recv all response lines */ + while (!feof($fp)) { + /* read the next line */ + $line = fgets($fp, 1024); + + $info = stream_get_meta_data($fp); + if ($info['timed_out']) + break; + + if (strstr($line,"TCP/UDP read bytes")) { + $list = explode(",", $line); + $client['bytes_recv'] = $list[1]; + } + + if (strstr($line,"TCP/UDP write bytes")) { + $list = explode(",", $line); + $client['bytes_sent'] = $list[1]; + } + + /* parse end of output line */ + if (strstr($line, "END")) + break; + } + } + + fclose($fp); + + } else { + $DisplayNote=true; + $client['remote_host'] = "No Management Daemon"; + $client['virtual_addr'] = "See Note Below"; + $client['bytes_recv'] = 0; + $client['bytes_sent'] = 0; + $client['connect_time'] = 0; + } + return $client; +} + function openvpn_refresh_crls() { global $g, $config; diff --git a/usr/local/www/status_openvpn.php b/usr/local/www/status_openvpn.php index 30c3a84960..4ad65d5d55 100644 --- a/usr/local/www/status_openvpn.php +++ b/usr/local/www/status_openvpn.php @@ -98,6 +98,7 @@ function kill_client($port, $remipp) { } $servers = openvpn_get_active_servers(); +$sk_servers = openvpn_get_active_servers("sharedkey"); $clients = openvpn_get_active_clients(); include("head.inc"); ?> @@ -141,13 +142,10 @@ include("head.inc"); ?> - - - -
- +
Status data is not available for shared key servers. @@ -194,19 +192,68 @@ include("head.inc"); ?>

+ + + + + + +
+ +
+ + + + + + + + + + + '> + + + + + + + + + +
+ + + + + + + + + + + + + +
+ + + + +
diff --git a/usr/local/www/widgets/widgets/openvpn.widget.php b/usr/local/www/widgets/widgets/openvpn.widget.php index c93c708408..4d186f0abc 100644 --- a/usr/local/www/widgets/widgets/openvpn.widget.php +++ b/usr/local/www/widgets/widgets/openvpn.widget.php @@ -55,6 +55,7 @@ function kill_client($port, $remipp) { } $servers = openvpn_get_active_servers(); +$sk_servers = openvpn_get_active_servers("sharedkey"); $clients = openvpn_get_active_clients(); ?> @@ -95,7 +96,7 @@ $clients = openvpn_get_active_clients();
- +
@@ -140,14 +141,61 @@ $clients = openvpn_get_active_clients();
- Client connections for + Client connections
-
+ + + + + + +
+ Shared Key Server Instance Statistics +
+ + + + + + '> + + + + + '> + + + + +
Name/TimeRemote/Virtual IP
+ + + + + "; + ?> +
+ + + +
+ + + @@ -158,7 +206,7 @@ $clients = openvpn_get_active_clients(); - '> + '> @@ -178,7 +226,7 @@ $clients = openvpn_get_active_clients(); ?> - '> + '> From e6af6518c1940310548d0c6e94283caf76084f1c Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 27 Jul 2011 11:50:16 -0400 Subject: [PATCH 16/38] Fix variable so CSC/Overrides for OpenVPN are actually deleted from the fs when deleted from the GUI. --- usr/local/www/vpn_openvpn_csc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/vpn_openvpn_csc.php b/usr/local/www/vpn_openvpn_csc.php index e980332d2f..91d4ea0f77 100644 --- a/usr/local/www/vpn_openvpn_csc.php +++ b/usr/local/www/vpn_openvpn_csc.php @@ -61,7 +61,7 @@ if ($_GET['act'] == "del") { exit; } - openvpn_delete_csc($$a_csc[$id]); + openvpn_delete_csc($a_csc[$id]); unset($a_csc[$id]); write_config(); $savemsg = gettext("Client Specific Override successfully deleted")."
"; From 94efbf8b2a61426395c902e7980f16c87dc0a168 Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 27 Jul 2011 12:05:06 -0400 Subject: [PATCH 17/38] Shift OpenVPN require, it was causing CRLs to not save changes properly. --- usr/local/www/system_crlmanager.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/usr/local/www/system_crlmanager.php b/usr/local/www/system_crlmanager.php index 201d8ab6fa..8d975dbca4 100644 --- a/usr/local/www/system_crlmanager.php +++ b/usr/local/www/system_crlmanager.php @@ -39,6 +39,7 @@ require("guiconfig.inc"); require_once("certs.inc"); +require_once('openvpn.inc'); global $openssl_crl_status; @@ -145,7 +146,6 @@ if ($act == "addcert") { if (!$input_errors) { $reason = (empty($pconfig['crlreason'])) ? OCSP_REVOKED_STATUS_UNSPECIFIED : $pconfig['crlreason']; cert_revoke($cert, $crl, $reason); - require_once('openvpn.inc'); openvpn_refresh_crls(); write_config("Revoked cert {$cert['descr']} in CRL {$crl['descr']}."); pfSenseHeader("system_crlmanager.php"); @@ -173,7 +173,6 @@ if ($act == "delcert") { $name = $thiscert['descr']; if (cert_unrevoke($thiscert, $thiscrl)) { $savemsg = sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr']) . "
"; - require_once('openvpn.inc'); openvpn_refresh_crls(); write_config(sprintf(gettext("Deleted Certificate %s from CRL %s"), $name, $thiscrl['descr'])); } else { From 9140006bc3cc940ce1280b41d2919151335aa2d3 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 27 Jul 2011 16:19:05 +0000 Subject: [PATCH 18/38] Correct issue with adding IPv6 default gateway reported http://forum.pfsense.org/index.php/topic,39344.0/topicseen.html --- etc/inc/system.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 0d04de6833..df6c3b71dd 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -411,7 +411,7 @@ function system_routing_configure($interface = "") { ; else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) { log_error("ROUTING: setting IPv6 default route to $gatewayipv6"); - mwexec("/sbin/route {$action} -inet6 default " . escapeshellarg($gatewayipv6)); + mwexec("/sbin/route change -inet6 default " . escapeshellarg($gatewayipv6)); } } From 4cf82d52943b00c2710b7867387230a0e58225be Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 27 Jul 2011 12:49:55 -0400 Subject: [PATCH 19/38] Relax PPTP password restrictions, just prevent starting with a !, and limit to common printable/keyboard characters so it doesn't result in invalid xml. Fixes #1720 --- etc/inc/vpn.inc | 6 ++++-- usr/local/www/vpn_pptp_users_edit.php | 6 +++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 921743f091..128f4037b6 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -1189,8 +1189,10 @@ EOD; $mpdsecret = ""; if (is_array($pptpdcfg['user'])) { - foreach ($pptpdcfg['user'] as $user) - $mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n"; + foreach ($pptpdcfg['user'] as $user) { + $pass = str_replace('"', '\"', $user['password']); + $mpdsecret .= "{$user['name']} \"{$pass}\" {$user['ip']}\n"; + } } fwrite($fd, $mpdsecret); diff --git a/usr/local/www/vpn_pptp_users_edit.php b/usr/local/www/vpn_pptp_users_edit.php index b1b4811c8e..7ddf34818b 100755 --- a/usr/local/www/vpn_pptp_users_edit.php +++ b/usr/local/www/vpn_pptp_users_edit.php @@ -84,12 +84,12 @@ if ($_POST) { if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['username'])) $input_errors[] = gettext("The username contains invalid characters."); - if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['password'])) - $input_errors[] = gettext("The password contains invalid characters."); - if (preg_match("/^!/", $_POST['password'])) $input_errors[] = gettext("The password cannot start with '!'."); + if (!preg_match("/^[\x20-\x7E]*$/", $_POST['password'])) + $input_errors[] = gettext("The password contains invalid characters."); + if (($_POST['password']) && ($_POST['password'] != $_POST['password2'])) { $input_errors[] = gettext("The passwords do not match."); } From 1fb8d3140624206d6c455f9247a2f1671c23c26c Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 27 Jul 2011 17:39:57 +0000 Subject: [PATCH 20/38] Prevent php from coring if the wrong parameters are passed to ip2long --- etc/inc/filter.inc | 13 ++++++++++--- etc/inc/vpn.inc | 5 +++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index c575adc56c..bf5f296f12 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1402,7 +1402,10 @@ function filter_nat_rules_generate() { } /* PPTP subnet */ if(($config['pptpd']['mode'] == "server" ) && is_private_ip($config['pptpd']['remoteip'])) { - $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units'])) + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + else + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip']))); $numberofnathosts += count($pptp_subnets); $tonathosts .= implode(" ", $pptp_subnets) . " "; } @@ -1765,9 +1768,13 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { $src = "{$lansa}/{$lansn}"; break; case 'pptp': - $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + if (isset($config['pptpd']['n_pptp_units']) && is_numeric($config['pptpd']['n_pptp_units'])) + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip'])+($config['pptpd']['n_pptp_units']-1))); + else + $pptp_subnets = ip_range_to_subnet_array($config['pptpd']['remoteip'], long2ip32(ip2long($config['pptpd']['remoteip']))); + if (empty($pptp_subnets)) + return ""; $src = "{ " . implode(" ", $pptp_subnets) . " }"; - $src = "{$pptpsa}/{$pptpsn}"; break; case 'pppoe': /* XXX: This needs to be fixed somehow! */ diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 128f4037b6..94af6e2857 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -1036,6 +1036,11 @@ function vpn_pptpd_configure() { unlink_if_exists("{$g['varetc_path']}/pptp-vpn/mpd.secret"); } + if (empty($pptpdcfg['n_pptp_units'])) { + log_error("Something wrong in the PPTPd configuration. Preventing starting the daemon because issues would arise."); + return; + } + /* make sure pptp-vpn directory exists */ if (!file_exists("{$g['varetc_path']}/pptp-vpn")) mkdir("{$g['varetc_path']}/pptp-vpn"); From f9199cd3ac0b38770e672f5fbda64d7eead036e8 Mon Sep 17 00:00:00 2001 From: Bryan Haase Date: Wed, 27 Jul 2011 14:41:55 -0500 Subject: [PATCH 21/38] Check for null Array and move option system to top --- usr/local/www/vpn_ipsec_mobile.php | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index 9d81c53f90..f0df0b7a37 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -355,16 +355,19 @@ function login_banner_change() { From 9626710723f5495d1b9fcb0f902ac1d91f9df86b Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 27 Jul 2011 20:31:30 +0000 Subject: [PATCH 22/38] Correct whitespace and some problems in the just merged ldap auth sorce for racoon --- etc/inc/upgrade_config.inc | 2 +- etc/inc/vpn.inc | 45 +++++++++++++++--------------- usr/local/www/vpn_ipsec_mobile.php | 12 ++++---- 3 files changed, 30 insertions(+), 29 deletions(-) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index f1bb57d527..1abc8c57c6 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1139,7 +1139,7 @@ function upgrade_046_to_047() { if (isset($config['ipsec']['mobileclients']['enable'])) { $config['ipsec']['client']['enable'] = true; - $config['ipsec']['client']['enable'] = $config['ipsec']['mobileclients']['user_source']; + $config['ipsec']['client']['user_source'] = 'system'; $config['ipsec']['client']['group_source'] = 'system'; } diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index fe373e5e37..703ac7a62e 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -416,30 +416,31 @@ function vpn_ipsec_configure($ipchg = false) } /* end mode_cfg section */ - if ($a_client['user_source'] != "system") - { - foreach ($config['system']['authserver'] as $authcfg) { - if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source']) - { - $thisauthcfg = $authcfg; - } - } + if ($a_client['user_source'] != "system") { + if (is_array($config['system']['authserver'])) { + foreach ($config['system']['authserver'] as $authcfg) { + if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source']) + $thisauthcfg = $authcfg; + } - /* begin ldapcfg */ - $racoonconf .= "ldapcfg {\n"; - $racoonconf .= "\tversion 3;\n"; - $racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n"; - $lport = "389"; - if ($authcfg['port'] != "") {$lport = $authcfg['port'];}; - $racoonconf .= "\tport ".$lport.";\n"; - $racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n"; - $racoonconf .= "\tsubtree on;\n"; - $racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n"; - $racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n"; - $racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n"; - $racoonconf .= "}\n\n"; - /* end ldapcfg */ + /* begin ldapcfg */ + $racoonconf .= "ldapcfg {\n"; + $racoonconf .= "\tversion 3;\n"; + $racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n"; + $lport = "389"; + if ($authcfg['port'] != "") + $lport = $authcfg['port']; + $racoonconf .= "\tport ".$lport.";\n"; + $racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n"; + $racoonconf .= "\tsubtree on;\n"; + $racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n"; + $racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n"; + $racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n"; + $racoonconf .= "}\n\n"; + /* end ldapcfg */ + } } + /* begin remote sections */ if (is_array($a_phase1) && count($a_phase1)) { /* begin remote */ diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index f0df0b7a37..fe28963698 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -356,18 +356,18 @@ function login_banner_change() { :   From 6968b356b9328305c4517405e031e87b58f72090 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 27 Jul 2011 20:39:56 +0000 Subject: [PATCH 23/38] Correct check as per http://forum.pfsense.org/index.php/topic,39155.0.html --- etc/inc/system.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index df6c3b71dd..4b0127a7e7 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -831,7 +831,7 @@ function system_generate_lighty_config($filename, $captive_portal_rewrite = "url.rewrite-once = ( \"(.*captiveportal.*)\" => \"$1\", \"(.*)\" => \"/index.php?redirurl=$1\" )\n"; $captive_portal_module = ""; $maxprocperip = $config['captiveportal']['maxprocperip']; - if(!$maxprocperip and $maxprocperip > 0) + if($maxprocperip and $maxprocperip > 0) $captive_portal_mod_evasive = "evasive.max-conns-per-ip = {$maxprocperip}"; else $captive_portal_mod_evasive = ""; From 439cc13f26320a697751bce8047b0993b2db9604 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Wed, 27 Jul 2011 19:03:26 -0400 Subject: [PATCH 24/38] Add hooks --- usr/local/www/firewall_aliases_edit.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php index adaa2c7e32..275cdd69c7 100755 --- a/usr/local/www/firewall_aliases_edit.php +++ b/usr/local/www/firewall_aliases_edit.php @@ -285,6 +285,9 @@ if ($_POST) { $input_errors[] = sprintf(gettext('The alias(es): %s cannot be nested because they are not of the same type.'), $wrongaliases); } + // Allow extending of the firewall edit page and include custom input validation + pfSense_handle_custom_code("/usr/local/pkg/firewall_aliases_edit/input_validation"); + if (!$input_errors) { $alias['address'] = is_array($address) ? implode(" ", $address) : $address; $alias['descr'] = $_POST['descr']; @@ -581,6 +584,7 @@ EOD; + From 89fae3e74ce776e4ac0450bf9339032fe096513f Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 28 Jul 2011 14:29:41 -0400 Subject: [PATCH 30/38] Fix whitespace formatting --- usr/local/www/diag_packet_capture.php | 342 +++++++++++++------------- 1 file changed, 169 insertions(+), 173 deletions(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index df482e27ce..0f14e649bc 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -109,185 +109,181 @@ include("fbegin.inc"); ?>
- OpenVPN client instances statistics + Client Instance Statistics
:  
From b22bf161fd5c3e918a6a56cf5c2690950093bfdf Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Wed, 27 Jul 2011 19:24:01 -0400 Subject: [PATCH 25/38] Adding hook --- usr/local/www/firewall_aliases_edit.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php index 275cdd69c7..6413c8fb5a 100755 --- a/usr/local/www/firewall_aliases_edit.php +++ b/usr/local/www/firewall_aliases_edit.php @@ -324,6 +324,8 @@ if ($_POST) { update_alias_names_upon_change(array('aliases', 'alias'), array('address'), $_POST['name'], $origname); } + pfSense_handle_custom_code("/usr/local/pkg/firewall_aliases_edit/pre_write_config"); + if (isset($id) && $a_aliases[$id]) { if ($a_aliases[$id]['name'] <> $alias['name']) { foreach ($a_aliases as $aliasid => $aliasd) { From f829cd3573fc0896ba387fbaaf2c7028415eb2f2 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 07:57:48 +0000 Subject: [PATCH 26/38] Do not add any reply-to information to rules with action match. Reported-by: http://forum.pfsense.org/index.php/topic,39247.msg202728.html#msg202728 --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index bf5f296f12..7bd9cfe86b 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1921,7 +1921,7 @@ function filter_generate_user_rule($rule) { update_filter_reload_status(sprintf(gettext("Setting up pass/block rules %s"), $rule['descr'])); /* do not process reply-to for gateway'd rules */ - if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto'])) { + if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($config['system']['disablereplyto']) && $type != "match") { if($rule['ipprotocol'] == "inet6") { $rg = get_interface_gateway_v6($rule['interface']); if(is_ipaddrv6($rg)) { From 1f33a7128ba03c1f8f58f778ea6f8c43a11064a3 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 08:16:50 +0000 Subject: [PATCH 27/38] Correct priority number to not have clashes with PRIQ which do not allow same priority numbers for two different queues. --- usr/local/www/wizards/traffic_shaper_wizard.inc | 4 ++-- usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc | 4 ++-- usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc | 4 ++-- usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/usr/local/www/wizards/traffic_shaper_wizard.inc b/usr/local/www/wizards/traffic_shaper_wizard.inc index ee800cee1f..9676a31c89 100644 --- a/usr/local/www/wizards/traffic_shaper_wizard.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard.inc @@ -1056,7 +1056,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1295,7 +1295,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc b/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc index bb25f79c52..9cfb8f2608 100755 --- a/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_dedicated.inc @@ -1119,7 +1119,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 3; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1359,7 +1359,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc b/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc index 519364fb5a..3e776d3974 100755 --- a/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_multi_all.inc @@ -1167,7 +1167,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -1409,7 +1409,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { diff --git a/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc b/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc index 9fdc3a375d..301aa553b7 100644 --- a/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc +++ b/usr/local/www/wizards/traffic_shaper_wizard_multi_lan.inc @@ -557,7 +557,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qLink"; - $tmpcf['priority'] = 1; + $tmpcf['priority'] = 2; $tmpcf['enabled'] = "on"; $tmpcf['default'] = "on"; $tmpcf['qlimit'] = 500; @@ -802,7 +802,7 @@ function apply_all_choosen_items() { $q =& new hfsc_queue(); $tmpcf = array(); $tmpcf['name'] = "qOthersLow"; - $tmpcf['priority'] = 2; + $tmpcf['priority'] = 3; $tmpcf['ecn'] = "on"; $tmpcf['enabled'] = "on"; if ($sched == "CBQ") { From 4222087e90badb854274109fc32de422c5c25221 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 28 Jul 2011 08:23:46 -0400 Subject: [PATCH 28/38] Also escape \ in pptp passwords. --- etc/inc/vpn.inc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 703ac7a62e..59e6d78587 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -1220,7 +1220,8 @@ EOD; if (is_array($pptpdcfg['user'])) { foreach ($pptpdcfg['user'] as $user) { - $pass = str_replace('"', '\"', $user['password']); + $pass = str_replace('\\', '\\\\', $user['password']); + $pass = str_replace('"', '\"', $pass); $mpdsecret .= "{$user['name']} \"{$pass}\" {$user['ip']}\n"; } } From d3347fdf2bbe02f1ab45da556f60f45133491851 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 28 Jul 2011 14:23:02 -0400 Subject: [PATCH 29/38] Fix display of ssh port on anti-lockout rule display in GUI. --- usr/local/www/firewall_rules.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index da9abd1d22..8e61360f4e 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -409,11 +409,9 @@ if($_REQUEST['undodrag']) { $sshport = ""; if (isset($config['system']['enablesshd'])) { - $sshport = 22; - if($config['system']['ssh']['port'] <> "") - $sshport = $config['system']['ssh']['port']; + $sshport = ($config['system']['ssh']['port']) ? $config['system']['ssh']['port'] : 22; } - $sshport = "22
"; + $sshport = "{$sshport}
"; ?>
 
+ +
+
+ -
- - - - - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + } + foreach ($interfaces as $iface => $ifacename): ?> + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + /* check to see if packet capture tcpdump is already running */ + $processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'"))); + + if ($processcheck != "") + $processisrunning = true; + else + $processisrunning = false; + + if (($action == gettext("Stop") or $action == "") and $processisrunning != true) + echo " "; + else { + echo " "; + } + if (file_exists($fp.$fn) and $processisrunning != true) { + echo ""; + echo "  (" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")"; + } +?> + + + + + +
-
+ -
-
- -
-
- -
-
-
-
- -
-
-
- -
-
- -
" . gettext("Enter 0 (zero) for no count limit.");?> -
- -
" . - gettext("Note:") . " " . - gettext("This option does not affect the level of detail when downloading the packet capture.");?> -
- > -
-
: -
  - "; - else { - echo " "; - } - if (file_exists($fp.$fn) and $processisrunning != true) { - echo ""; - echo "  (" . gettext("The packet capture file was last updated:") . " " . date("F jS, Y g:i:s a.", filemtime($fp.$fn)) . ")"; - } -?> -
-"; - if ($processisrunning == true) - echo("" . gettext("Packet Capture is running.") . "
"); - - if ($do_tcpdump) { - $matches = array(); - - if (($fam == "ip6") || ($fam == "ip")) - $matches[] = $fam; - - if ($port != "") - $matches[] = "port ".$port; - - if ($host != "") { - if (is_ipaddr($host)) - $matches[] = "host " . $host; - elseif (is_subnet($host)) - $matches[] = "net " . $host; - } - - if ($count != "0" ) { - $searchcount = "-c " . $count; - } else { - $searchcount = ""; - } - - $selectedif = convert_friendly_interface_to_real_interface_name($selectedif); - - if ($action == gettext("Start")) { - $matchstr = implode($matches, " and "); - echo("" . gettext("Packet Capture is running.") . "
"); - mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"); - // echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"; - } else { - //action = stop - echo("" . gettext("Packet Capture stopped.") . "

" . gettext("Packets Captured:") . "
"); -?> - - -
+ +
+
+ +
+
+
+
+ +
+
+
+ +
+
+ +
" . gettext("Enter 0 (zero) for no count limit.");?> +
+ +
" . + gettext("Note:") . " " . + gettext("This option does not affect the level of detail when downloading the packet capture.");?> +
+ > +
+
: +
  + - -
+"; + if ($processisrunning == true) + echo("" . gettext("Packet Capture is running.") . "
"); + + if ($do_tcpdump) { + $matches = array(); + + if (($fam == "ip6") || ($fam == "ip")) + $matches[] = $fam; + + if ($port != "") + $matches[] = "port ".$port; + + if ($host != "") { + if (is_ipaddr($host)) + $matches[] = "host " . $host; + elseif (is_subnet($host)) + $matches[] = "net " . $host; + } + + if ($count != "0" ) { + $searchcount = "-c " . $count; + } else { + $searchcount = ""; + } + + $selectedif = convert_friendly_interface_to_real_interface_name($selectedif); + + if ($action == gettext("Start")) { + $matchstr = implode($matches, " and "); + echo("" . gettext("Packet Capture is running.") . "
"); + mwexec_bg ("/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"); + // echo "/usr/sbin/tcpdump -i $selectedif $searchcount -s $packetlength -w $fp$fn $matchstr"; + } else { + //action = stop + echo("" . gettext("Packet Capture stopped.") . "

" . gettext("Packets Captured:") . "
"); +?> + + +
+ +
Date: Thu, 28 Jul 2011 14:31:31 -0400 Subject: [PATCH 31/38] Move the textarea displaying packet capture outside of the form tag, or else a browser will try to submit the contents of the textarea when hitting a button. If you were viewing a large capture, that can be quite a long time it's wasting on uploading data that serves no purpose. --- usr/local/www/diag_packet_capture.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index 0f14e649bc..b10e79c336 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -228,6 +228,9 @@ include("fbegin.inc"); ?>
+ +
- From e151744e908bda123e300fc7bd6e41552b347597 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 19:35:03 +0000 Subject: [PATCH 32/38] Just break states based on the remote host ip and not with localip. The later might be the same as address used by other services and might interrupt them --- usr/local/sbin/vpn-linkdown | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usr/local/sbin/vpn-linkdown b/usr/local/sbin/vpn-linkdown index ac9ea2a353..4b6cff797d 100755 --- a/usr/local/sbin/vpn-linkdown +++ b/usr/local/sbin/vpn-linkdown @@ -2,4 +2,8 @@ # record logout /usr/bin/logger -p local3.info "logout,$1,$4,$5" -/sbin/pfctl -b $3/32 -b $4/32 +/sbin/pfctl -b 0.0.0.0/32 -b $4/32 +/sbin/pfctl -k $4/32 +/sbin/pfctl -k 0.0.0.0/32 $4/32 +/sbin/pfctl -K $4/32 +/sbin/pfctl -K 0.0.0.0/32 -K $4/32 From 0124456b0c4d602adea538cee35fc67c977e9f2e Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 28 Jul 2011 15:43:52 -0400 Subject: [PATCH 33/38] Rework rc.stop_packages a little. Fixes #1564 --- etc/inc/system.inc | 2 +- etc/rc.stop_packages | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 4b0127a7e7..1585b8ba3f 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1340,7 +1340,7 @@ function system_reboot_cleanup() { captiveportal_radius_stop_all(); require_once("voucher.inc"); voucher_save_db_to_config(); - // mwexec("/etc/rc.stop_packages"); + mwexec("/etc/rc.stop_packages"); } function system_do_shell_commands($early = 0) { diff --git a/etc/rc.stop_packages b/etc/rc.stop_packages index f20fa04287..43080e92fa 100755 --- a/etc/rc.stop_packages +++ b/etc/rc.stop_packages @@ -1,4 +1,6 @@ -#!/usr/local/bin/php -f +#!/bin/sh + +/usr/local/bin/php -q < +ENDPHP \ No newline at end of file From 4c41b626539a103834a9e93f5be34afcfa6777a9 Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 19:58:04 +0000 Subject: [PATCH 34/38] Use route change here as well to avoid leaving the routing table without a destination for a short period. --- etc/inc/system.inc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 1585b8ba3f..3b5e108b50 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -144,11 +144,10 @@ function system_resolvconf_generate($dynupdate = false) { $interface = $config['system'][$dnsgw]; if (($interface <> "") && ($interface <> "none")) { $gatewayip = get_interface_gateway($interface); - if(is_ipaddr($gatewayip)) { + if (is_ipaddr($gatewayip)) { /* dns server array starts at 0 */ $dnscountermo = $dnscounter - 1; - mwexec("route delete -host {$syscfg['dnsserver'][$dnscountermo]}", true); - mwexec("route add -host {$syscfg['dnsserver'][$dnscountermo]} {$gatewayip}"); + mwexec("route change -host " . $syscfg['dnsserver'][$dnscountermo] . " {$gatewayip}"); } } } From 33c06ef791a58d95df4c6674a8e87e5b1186689c Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 20:31:46 +0000 Subject: [PATCH 35/38] Add a new option to allow disabling of gateway monitoring. This gateways will always be reported as up. --- etc/inc/gwlb.inc | 16 +++++++++++----- usr/local/www/system_gateways_edit.php | 18 ++++++++++++++++-- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 382bfba8f1..6b54c077e8 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -137,6 +137,9 @@ target default { EOD; foreach($gateways_arr as $name => $gateway) { + /* Do not monitor if such was requested */ + if (isset($gateway['monitor_disable'])) + continue; if (empty($gateway['monitor']) || !is_ipaddr($gateway['monitor'])) { if (is_ipaddr($gateway['gateway'])) $gateway['monitor'] = $gateway['gateway']; @@ -287,7 +290,9 @@ function return_gateways_array($disabled = false) { $gateway['gateway'] = "dynamic"; $gateway['dynamic'] = true; } - if(empty($gateway['monitor'])) + if (isset($gateway['monitor_disable'])) + $gateway['monitor_disable'] = true; + else if (empty($gateway['monitor'])) $gateway['monitor'] = $gateway['gateway']; $gateway['friendlyiface'] = $gateway['interface']; @@ -383,18 +388,18 @@ function return_gateway_groups_array() { if (isset($gwsttng['defaultgw'])) { $dfltgwfound = true; $dfltgwname = $gwname; - if (stristr($gateways_status[$gwname]['status'], "down")) + if (!isset($gwsttng['monitor_disable']) && stristr($gateways_status[$gwname]['status'], "down")) $dfltgwdown = true; } /* Keep a record of the last up gateway */ - if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) + if (empty($upgw) && (isset($gwsttng['monitor_disable']) || !stristr($gateways_status[$gwname]['status'], "down"))) $upgw = $gwname; if ($dfltgwdown == true && !empty($upgw)) break; } if ($dfltgwfound == false) { $gwname = convert_friendly_interface_to_friendly_descr("wan"); - if (stristr($gateways_status[$gwname]['status'], "down")) + if (!empty($gateways_status[$gwname]) && stristr($gateways_status[$gwname]['status'], "down")) $dfltgwdown = true; } if ($dfltgwdown == true && !empty($upgw)) { @@ -449,7 +454,8 @@ function return_gateway_groups_array() { } else /* Online add member */ $tiers[$tier][] = $gwname; - } + } else if (isset($gateways_arr[$gwname]['monitor_disable'])) + $tiers[$tier][] = $gwname; } $tiers_count = count($tiers); if($tiers_count == 0) { diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index f34df9fba9..0d35424810 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -78,6 +78,7 @@ if (isset($id) && $a_gateways[$id]) { $pconfig['losshigh'] = $a_gateway_item[$id]['losshigh']; $pconfig['down'] = $a_gateway_item[$id]['down']; $pconfig['monitor'] = $a_gateways[$id]['monitor']; + $pconfig['monitor_disable'] = isset($a_gateways[$id]['monitor_disable']); $pconfig['descr'] = $a_gateways[$id]['descr']; $pconfig['attribute'] = $a_gateways[$id]['attribute']; } @@ -233,7 +234,9 @@ if ($_POST) { $gateway['name'] = $_POST['name']; $gateway['weight'] = $_POST['weight']; $gateway['descr'] = $_POST['descr']; - if (is_ipaddr($_POST['monitor'])) + if ($_POST['monitor_disable'] == "yes") + $gateway['monitor_disable'] = true; + else if (is_ipaddr($_POST['monitor'])) $gateway['monitor'] = $_POST['monitor']; if ($_POST['defaultgw'] == "yes" || $_POST['defaultgw'] == "on") { @@ -307,6 +310,9 @@ function show_advanced_gateway() { aodiv = document.getElementById('showgatewayadv'); aodiv.style.display = "block"; } +function monitor_change() { + document.iform.monitor.disabled = document.iform.monitor_disable.checked; +}
@@ -365,6 +371,14 @@ function show_advanced_gateway() { + + + + onClick="monitor_change()" /> +
+ + + @@ -461,7 +475,7 @@ function show_advanced_gateway() {
From db07cc25af08bc731ba96c3c01c0bbd25d476aaa Mon Sep 17 00:00:00 2001 From: Ermal Date: Thu, 28 Jul 2011 20:35:08 +0000 Subject: [PATCH 36/38] Fix status page of gateways to show gateways with monitoring disabled as up. --- usr/local/www/status_gateways.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/usr/local/www/status_gateways.php b/usr/local/www/status_gateways.php index 7e0ffc2d44..0aa6e56f6a 100755 --- a/usr/local/www/status_gateways.php +++ b/usr/local/www/status_gateways.php @@ -109,6 +109,9 @@ include("head.inc"); $online = gettext("Online"); $bgcolor = "lightgreen"; } + } else if (isset($gateway['monitor_disable'])) { + $online = gettext("Online"); + $bgcolor = "lightgreen"; } else { $online = gettext("Gathering data"); $bgcolor = "lightgray"; From 6d1ae23c9e8966f55205a2522e079e9f392d56c2 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 28 Jul 2011 16:44:27 -0400 Subject: [PATCH 37/38] Clarify notes for pptp "Server address" --- usr/local/www/vpn_pptp.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/usr/local/www/vpn_pptp.php b/usr/local/www/vpn_pptp.php index aee2416acd..52190eca05 100755 --- a/usr/local/www/vpn_pptp.php +++ b/usr/local/www/vpn_pptp.php @@ -353,9 +353,13 @@ function enable_change(enable_over) { -
- . +
+ . +
+ . +
+
+ . Date: Thu, 28 Jul 2011 20:52:08 +0000 Subject: [PATCH 38/38] Add an override for default interval to send icmp --- etc/inc/gwlb.inc | 2 ++ usr/local/www/system_gateways_edit.php | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 6b54c077e8..e26adb1455 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -160,6 +160,8 @@ EOD; $apingercfg = "target \"{$gateway['monitor']}\" {\n"; $apingercfg .= " description \"{$name}\"\n"; $apingercfg .= " srcip \"{$gwifip}\"\n"; + if (!empty($gateway['interval']) && intval($gateway['interval']) > 1) + $apingercfg .= " interval " . intval($gateway['interval']) . "s\n"; $alarms = ""; $alarmscfg = ""; $override = false; diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 0d35424810..5ff9578e75 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -66,6 +66,7 @@ if (isset($id) && $a_gateways[$id]) { $pconfig = array(); $pconfig['name'] = $a_gateways[$id]['name']; $pconfig['weight'] = $a_gateways[$id]['weight']; + $pconfig['interval'] = $a_gateways[$id]['interval']; $pconfig['interface'] = $a_gateways[$id]['interface']; $pconfig['friendlyiface'] = $a_gateways[$id]['friendlyiface']; if (isset($a_gateways[$id]['dynamic'])) @@ -233,6 +234,7 @@ if ($_POST) { $gateway['gateway'] = "dynamic"; $gateway['name'] = $_POST['name']; $gateway['weight'] = $_POST['weight']; + $gateway['interval'] = $_POST['interval']; $gateway['descr'] = $_POST['descr']; if ($_POST['monitor_disable'] == "yes") $gateway['monitor_disable'] = true; @@ -399,10 +401,10 @@ function monitor_change() { -
1)) echo "style='display:none'"; ?>> +
1) || (isset($pconfig['interval']) && $pconfig['interval'])) echo "style='display:none'"; ?>> - Show advanced option
-
> +
> @@ -452,6 +454,14 @@ function monitor_change() {
+ + + + +
+ +