From 3fa6d46229757e2316120a7160a806bb7d28a8ed Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 6 Jun 2018 16:23:10 -0400 Subject: [PATCH 01/22] Fix up user/group management save message descriptions, add logging for same. Fixes #8548 --- src/usr/local/www/system_groupmanager.php | 25 +++++++++--- .../www/system_groupmanager_addprivs.php | 7 +++- src/usr/local/www/system_usermanager.php | 40 +++++++++---------- .../local/www/system_usermanager_addprivs.php | 8 +++- .../www/system_usermanager_passwordmg.php | 9 +++-- 5 files changed, 58 insertions(+), 31 deletions(-) diff --git a/src/usr/local/www/system_groupmanager.php b/src/usr/local/www/system_groupmanager.php index 9b7ffb4e33..e1a5b42364 100644 --- a/src/usr/local/www/system_groupmanager.php +++ b/src/usr/local/www/system_groupmanager.php @@ -36,6 +36,9 @@ require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); +$logging_level = LOG_WARNING; +$logging_prefix = gettext("Local User Database"); + if (!is_array($config['system']['group'])) { $config['system']['group'] = array(); } @@ -72,8 +75,10 @@ if ($_POST['act'] == "delgroup") { unset($a_group[$id]); /* Reindex the array to avoid operating on an incorrect index https://redmine.pfsense.org/issues/7733 */ $a_group = array_values($a_group); - write_config(); - $savemsg = sprintf(gettext("Group %s successfully deleted."), $groupdeleted); + + $savemsg = sprintf(gettext("Successfully deleted group: %s"), $groupdeleted); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); } if ($_POST['act'] == "delpriv") { @@ -95,9 +100,11 @@ if ($_POST['act'] == "delpriv") { } } - write_config(); + $savemsg = sprintf(gettext("Removed Privilege \"%s\" from group %s"), $privdeleted, $a_group[$id]['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); + $act = "edit"; - $savemsg = sprintf(gettext("Privilege %s successfully deleted."), $privdeleted); } if ($act == "edit") { @@ -114,18 +121,22 @@ if ($act == "edit") { if (isset($_POST['dellall_x'])) { $del_groups = $_POST['delete_check']; + $deleted_groups = array(); if (!empty($del_groups)) { foreach ($del_groups as $groupid) { if (isset($a_group[$groupid]) && $a_group[$groupid]['scope'] != "system") { + $deleted_groups[] = $a_group[$groupid]['name']; local_group_del($a_group[$groupid]); unset($a_group[$groupid]); } } + + $savemsg = sprintf(gettext("Successfully deleted %s: %s"), (count($deleted_groups) == 1) ? gettext("group") : gettext("groups"), implode(', ', $deleted_groups)); /* Reindex the array to avoid operating on an incorrect index https://redmine.pfsense.org/issues/7733 */ $a_group = array_values($a_group); - $savemsg = gettext("Selected groups removed successfully."); write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); } } @@ -214,7 +225,9 @@ if (isset($_POST['save'])) { return strcmp($a['name'], $b['name']); }); - write_config(); + $savemsg = sprintf(gettext("Successfully %s group %s"), (strlen($id) > 0) ? gettext("edited") : gettext("created"), $group['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); header("Location: system_groupmanager.php"); exit; diff --git a/src/usr/local/www/system_groupmanager_addprivs.php b/src/usr/local/www/system_groupmanager_addprivs.php index 4afbb94a33..eb2f8685da 100644 --- a/src/usr/local/www/system_groupmanager_addprivs.php +++ b/src/usr/local/www/system_groupmanager_addprivs.php @@ -35,6 +35,9 @@ require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); +$logging_level = LOG_WARNING; +$logging_prefix = gettext("Local User Database"); + $groupid = $_REQUEST['groupid']; $pgtitle = array(gettext("System"), gettext("User Manager"), gettext("Groups"), gettext("Edit"), gettext("Add Privileges")); @@ -87,7 +90,9 @@ if ($_POST['save']) { } } - write_config(); + $savemsg = sprintf(gettext("Privileges changed for group: %s"), $a_group['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); pfSenseHeader("system_groupmanager.php?act=edit&groupid={$groupid}"); exit; diff --git a/src/usr/local/www/system_usermanager.php b/src/usr/local/www/system_usermanager.php index aa60a65803..4aca5d9238 100644 --- a/src/usr/local/www/system_usermanager.php +++ b/src/usr/local/www/system_usermanager.php @@ -37,6 +37,9 @@ require_once("certs.inc"); require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); +$logging_level = LOG_WARNING; +$logging_prefix = gettext("Local User Database"); + // start admin user code if (isset($_REQUEST['userid']) && is_numericint($_REQUEST['userid'])) { $id = $_REQUEST['userid']; @@ -96,8 +99,9 @@ if ($_POST['act'] == "deluser") { unset($a_user[$id]); /* Reindex the array to avoid operating on an incorrect index https://redmine.pfsense.org/issues/7733 */ $a_user = array_values($a_user); - write_config(); - $savemsg = sprintf(gettext("User %s successfully deleted."), $userdeleted); + $savemsg = sprintf(gettext("Successfully deleted user: %s"), $userdeleted); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); } } else if ($act == "new") { @@ -125,9 +129,7 @@ if ($_POST['act'] == "deluser") { if (isset($_POST['dellall'])) { $del_users = $_POST['delete_check']; - $deleted_users = ""; - $deleted_count = 0; - $comma = ""; + $deleted_users = array(); if (!empty($del_users)) { foreach ($del_users as $userid) { @@ -135,9 +137,7 @@ if (isset($_POST['dellall'])) { if ($a_user[$userid]['name'] == $_SESSION['Username']) { $delete_errors[] = sprintf(gettext("Cannot delete user %s because you are currently logged in as that user."), $a_user[$userid]['name']); } else { - $deleted_users = $deleted_users . $comma . $a_user[$userid]['name']; - $comma = ", "; - $deleted_count++; + $deleted_users[] = $a_user[$userid]['name']; local_user_del($a_user[$userid]); unset($a_user[$userid]); } @@ -146,15 +146,12 @@ if (isset($_POST['dellall'])) { } } - if ($deleted_count > 0) { - if ($deleted_count == 1) { - $savemsg = sprintf(gettext("User %s successfully deleted."), $deleted_users); - } else { - $savemsg = sprintf(gettext("Users %s successfully deleted."), $deleted_users); - } + if (count($deleted_users) > 0) { + $savemsg = sprintf(gettext("Successfully deleted %s: %s"), (count($deleted_users) == 1) ? gettext("user") : gettext("users"), implode(', ', $deleted_users)); /* Reindex the array to avoid operating on an incorrect index https://redmine.pfsense.org/issues/7733 */ $a_user = array_values($a_user); write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); } } } @@ -169,18 +166,20 @@ if ($_POST['act'] == "delcert") { $certdeleted = lookup_cert($a_user[$id]['cert'][$_POST['certid']]); $certdeleted = $certdeleted['descr']; unset($a_user[$id]['cert'][$_POST['certid']]); - write_config(); + $savemsg = sprintf(gettext("Removed certificate association \"%s\" from user %s"), $certdeleted, $a_user[$id]['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); $_POST['act'] = "edit"; - $savemsg = sprintf(gettext("Certificate %s association removed."), $certdeleted); } if ($_POST['act'] == "delprivid") { $privdeleted = $priv_list[$a_user[$id]['priv'][$_POST['privid']]]['name']; unset($a_user[$id]['priv'][$_POST['privid']]); local_user_set($a_user[$id]); - write_config(); + $savemsg = sprintf(gettext("Removed Privilege \"%s\" from user %s"), $privdeleted, $a_user[$id]['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); $_POST['act'] = "edit"; - $savemsg = sprintf(gettext("Privilege %s removed."), $privdeleted); } if ($_POST['save']) { @@ -454,8 +453,9 @@ if ($_POST['save']) { local_user_set($userent); /* Add user to groups again to ensure they are set everywhere, otherwise the user may not appear to be a member of the group. See commit:5372d26d9d25d751d16865ed9d46869d3b0ec5e1. */ local_user_set_groups($userent, $_POST['groups']); - write_config(); - + $savemsg = sprintf(gettext("Successfully %s user %s"), (isset($id)) ? gettext("edited") : gettext("created"), $userent['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); if (is_dir("/etc/inc/privhooks")) { run_plugins("/etc/inc/privhooks"); } diff --git a/src/usr/local/www/system_usermanager_addprivs.php b/src/usr/local/www/system_usermanager_addprivs.php index abc10c6da9..2f7ac2fe88 100644 --- a/src/usr/local/www/system_usermanager_addprivs.php +++ b/src/usr/local/www/system_usermanager_addprivs.php @@ -31,6 +31,9 @@ require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); +$logging_level = LOG_WARNING; +$logging_prefix = gettext("Local User Database"); + if (isset($_REQUEST['userid']) && is_numericint($_REQUEST['userid'])) { $userid = $_REQUEST['userid']; } @@ -77,7 +80,10 @@ if ($_POST['save']) { $a_user['priv'] = sort_user_privs($a_user['priv']); local_user_set($a_user); - write_config(); + + $savemsg = sprintf(gettext("Privileges changed for user: %s"), $a_user['name']); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); post_redirect("system_usermanager.php", array('act' => 'edit', 'userid' => $userid)); diff --git a/src/usr/local/www/system_usermanager_passwordmg.php b/src/usr/local/www/system_usermanager_passwordmg.php index 66e277b5c2..27686f93dc 100644 --- a/src/usr/local/www/system_usermanager_passwordmg.php +++ b/src/usr/local/www/system_usermanager_passwordmg.php @@ -30,6 +30,9 @@ require_once("auth.inc"); require_once("certs.inc"); require_once("guiconfig.inc"); +$logging_level = LOG_WARNING; +$logging_prefix = gettext("Local User Database"); + $pgtitle = array(gettext("System"), gettext("User Password")); if (isset($_POST['save'])) { @@ -51,12 +54,12 @@ if (isset($_POST['save'])) { $userent =& $config['system']['user'][$userindex[$_SESSION['Username']]]; local_user_set_password($userent, $_POST['passwordfld1']); local_user_set($userent); + $savemsg = sprintf(gettext("Password changed for user: %s"), $userent['name']); unset($userent); phpsession_end(true); - write_config(); - - $savemsg = gettext("Password successfully changed."); + write_config($savemsg); + syslog($logging_level, "{$logging_prefix}: {$savemsg}"); } } From 880363af764ab31f2bdf6ee7a7921aeaed577e76 Mon Sep 17 00:00:00 2001 From: Steve Beaver Date: Thu, 7 Jun 2018 10:05:45 -0400 Subject: [PATCH 02/22] Fixed #8539 --- src/usr/local/www/services_unbound_acls.php | 14 +++++++------- src/usr/local/www/wizards/setup_wizard.xml | 17 +++++++++++++---- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/src/usr/local/www/services_unbound_acls.php b/src/usr/local/www/services_unbound_acls.php index 92e6bb637f..1800a743d9 100644 --- a/src/usr/local/www/services_unbound_acls.php +++ b/src/usr/local/www/services_unbound_acls.php @@ -123,7 +123,7 @@ if ($_POST['save']) { } if (!$input_errors) { - if (strtolower($pconfig['save']) == gettext("save")) { + if (strtolower($pconfig['save']) == strtolower(gettext("save")) { $acl_entry = array(); $acl_entry['aclid'] = $pconfig['aclid']; $acl_entry['aclname'] = $pconfig['aclname']; @@ -152,12 +152,12 @@ if ($_POST['save']) { } $actionHelp = - sprintf(gettext('%1$sDeny:%2$s Stops queries from hosts within the netblock defined below.%3$s'), '', '', '
') . - sprintf(gettext('%1$sRefuse:%2$s Stops queries from hosts within the netblock defined below, but sends a DNS rcode REFUSED error message back to the client.%3$s'), '', '', '
') . - sprintf(gettext('%1$sAllow:%2$s Allow queries from hosts within the netblock defined below.%3$s'), '', '', '
') . - sprintf(gettext('%1$sAllow Snoop:%2$s Allow recursive and nonrecursive access from hosts within the netblock defined below. Used for cache snooping and ideally should only be configured for the administrative host.%3$s'), '', '', '
') . - sprintf(gettext('%1$sDeny Nonlocal:%2$s Allow only authoritative local-data queries from hosts within the netblock defined below. Messages that are disallowed are dropped.%3$s'), '', '', '
') . - sprintf(gettext('%1$sRefuse Nonlocal:%2$s Allow only authoritative local-data queries from hosts within the netblock defined below. Sends a DNS rcode REFUSED error message back to the client for messages that are disallowed.'), '', ''); + sprintf(gettext('%1$sDeny:%2$s Stops queries from hosts within the netblock defined below.%3$s'), '', '', '
') . + sprintf(gettext('%1$sRefuse:%2$s Stops queries from hosts within the netblock defined below, but sends a DNS rcode REFUSED error message back to the client.%3$s'), '', '', '
') . + sprintf(gettext('%1$sAllow:%2$s Allow queries from hosts within the netblock defined below.%3$s'), '', '', '
') . + sprintf(gettext('%1$sAllow Snoop:%2$s Allow recursive and nonrecursive access from hosts within the netblock defined below. Used for cache snooping and ideally should only be configured for the administrative host.%3$s'), '', '', '
') . + sprintf(gettext('%1$sDeny Nonlocal:%2$s Allow only authoritative local-data queries from hosts within the netblock defined below. Messages that are disallowed are dropped.%3$s'), '', '', '
') . + sprintf(gettext('%1$sRefuse Nonlocal:%2$s Allow only authoritative local-data queries from hosts within the netblock defined below. Sends a DNS rcode REFUSED error message back to the client for messages that are disallowed.'), '', ''); $pgtitle = array(gettext("Services"), gettext("DNS Resolver"), gettext("Access Lists")); $pglinks = array("", "services_unbound.php", "@self"); diff --git a/src/usr/local/www/wizards/setup_wizard.xml b/src/usr/local/www/wizards/setup_wizard.xml index 71ccdf859b..a8fc2a41ac 100644 --- a/src/usr/local/www/wizards/setup_wizard.xml +++ b/src/usr/local/www/wizards/setup_wizard.xml @@ -795,10 +795,19 @@ Congratulations! pfSense is now configured.

- Remember, we're here to help.

- Click here to learn about Netgate 24/7/365 support.

- Click here to continue on to pfSense webConfigurator.

+
+

Congratulations! pfSense is now configured.

+

+ We recommend that you check to see if there are any software updates available. Keeping your software up to date is + one of the most important things you can do to maintain the security of your network.

+ +

+

Remember, we're here to help.

+

+ Click here to learn about Netgate 24/7/365 support services.

+ +

+
]]> From a273f7bdff455a50156ab004358ba3909fa1fee7 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 7 Jun 2018 15:01:25 -0400 Subject: [PATCH 03/22] Do not put "route-to" on rules for traffic outbound from the firewall itself on ipsecX interfaces. Fixes #8551 --- src/etc/inc/filter.inc | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc index 2144e7eac0..c365143111 100644 --- a/src/etc/inc/filter.inc +++ b/src/etc/inc/filter.inc @@ -3624,8 +3624,9 @@ EOD; } $gw = get_interface_gateway($ifdescr); + $routeto = (substr($ifcfg['if'], 0, 5) != "ipsec") ? "route-to ( {$ifcfg['if']} {$gw} )" : ""; if (is_ipaddrv4($gw) && is_ipaddrv4($ifcfg['ip']) && is_subnetv4("{$ifcfg['sa']}/{$ifcfg['sn']}")) { - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} {$routeto} from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; if (is_array($ifcfg['vips'])) { foreach ($ifcfg['vips'] as $vip) { if ($vip['mode'] == "proxyarp") { @@ -3635,9 +3636,9 @@ EOD; continue; } if (ip_in_subnet($vip['ip'], "{$ifcfg['sa']}/{$ifcfg['sn']}")) { - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} {$routeto} from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } else { - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !" . gen_subnet($vip['ip'], $vip['sn']) . "/{$vip['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} {$routeto} from {$vip['ip']} to !" . gen_subnet($vip['ip'], $vip['sn']) . "/{$vip['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } } } @@ -3646,14 +3647,15 @@ EOD; $gwv6 = get_interface_gateway_v6($ifdescr); $stf = get_real_interface($ifdescr, "inet6"); $pdlen = 64 - calculate_ipv6_delegation_length($ifdescr); + $routeto = (substr($ifcfg['if'], 0, 5) != "ipsec") ? "route-to ( {$stf} {$gwv6} )" : ""; if (is_ipaddrv6($gwv6) && is_ipaddrv6($ifcfg['ipv6']) && is_subnetv6("{$ifcfg['ipv6']}/{$pdlen}")) { - $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$ifcfg['ipv6']} to !{$ifcfg['ipv6']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} {$routeto} inet6 from {$ifcfg['ipv6']} to !{$ifcfg['ipv6']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; if (is_array($ifcfg['vips6'])) { foreach ($ifcfg['vips6'] as $vip) { if (!is_ipaddrv6($vip['ip']) || !is_subnetv6("{$vip['ip']}/{$pdlen}")) { continue; } - $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$vip['ip']} to !{$vip['ip']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} {$routeto} inet6 from {$vip['ip']} to !{$vip['ip']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } } } From cc52daa63deb98f6fbcd5edbc24fc65b62eabbec Mon Sep 17 00:00:00 2001 From: Stephen Jones Date: Thu, 7 Jun 2018 14:20:07 -0500 Subject: [PATCH 04/22] Allow hostname/ip to be deleted if the captive portal is not enabled --- src/usr/local/www/services_captiveportal_hostname.php | 2 +- src/usr/local/www/services_captiveportal_ip.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/usr/local/www/services_captiveportal_hostname.php b/src/usr/local/www/services_captiveportal_hostname.php index 2d1409b53f..9372df7669 100644 --- a/src/usr/local/www/services_captiveportal_hostname.php +++ b/src/usr/local/www/services_captiveportal_hostname.php @@ -63,7 +63,7 @@ $pgtitle = array(gettext("Services"), gettext("Captive Portal"), $a_cp[$cpzone][ $pglinks = array("", "services_captiveportal_zones.php", "services_captiveportal.php?zone=" . $cpzone, "@self"); $shortcut_section = "captiveportal"; -if ($_POST['act'] == "del" && !empty($cpzone) && isset($cpzoneid)) { +if ($_POST['act'] == "del" && !empty($cpzone)) { $a_allowedhostnames =& $a_cp[$cpzone]['allowedhostname']; if ($a_allowedhostnames[$_POST['id']]) { $ipent = $a_allowedhostnames[$_POST['id']]; diff --git a/src/usr/local/www/services_captiveportal_ip.php b/src/usr/local/www/services_captiveportal_ip.php index f53efd7910..d55a8d31aa 100644 --- a/src/usr/local/www/services_captiveportal_ip.php +++ b/src/usr/local/www/services_captiveportal_ip.php @@ -60,7 +60,7 @@ $pgtitle = array(gettext("Services"), gettext("Captive Portal"), $a_cp[$cpzone][ $pglinks = array("", "services_captiveportal_zones.php", "services_captiveportal.php?zone=" . $cpzone, "@self"); $shortcut_section = "captiveportal"; -if ($_POST['act'] == "del" && !empty($cpzone) && isset($cpzoneid)) { +if ($_POST['act'] == "del" && !empty($cpzone)) { $a_allowedips =& $config['captiveportal'][$cpzone]['allowedip']; if ($a_allowedips[$_POST['id']]) { From 173356547e0005bfe21ba4b2345919dcb89a2fbf Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Jun 2018 08:17:59 -0400 Subject: [PATCH 05/22] Correct PHP syntax error. Fixes #8557 --- src/usr/local/www/services_unbound_acls.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/usr/local/www/services_unbound_acls.php b/src/usr/local/www/services_unbound_acls.php index 1800a743d9..00541d8eed 100644 --- a/src/usr/local/www/services_unbound_acls.php +++ b/src/usr/local/www/services_unbound_acls.php @@ -123,7 +123,7 @@ if ($_POST['save']) { } if (!$input_errors) { - if (strtolower($pconfig['save']) == strtolower(gettext("save")) { + if (strtolower($pconfig['save']) == strtolower(gettext("save"))) { $acl_entry = array(); $acl_entry['aclid'] = $pconfig['aclid']; $acl_entry['aclname'] = $pconfig['aclname']; From d4b43c48ed1636d3fcd6e47d73ba721bd63d883a Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Jun 2018 11:18:49 -0400 Subject: [PATCH 06/22] Make IPsec IKEv2 conn IDs consistent with IKEv1 or IKEv2 split. Also fix vti test for reqid. --- src/etc/inc/vpn.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/etc/inc/vpn.inc b/src/etc/inc/vpn.inc index dd87bb4d53..574f24a451 100644 --- a/src/etc/inc/vpn.inc +++ b/src/etc/inc/vpn.inc @@ -1444,12 +1444,12 @@ EOD; $ipsecfin = "\nconn con-mobile\n"; } else { - $ipsecfin = "\nconn con{$ph1ent['ikeid']}\n"; + $ipsecfin = "\nconn con{$ph1ent['ikeid']}000\n"; } //if (!empty($reqids[$idx])) { // $ipsecfin .= "\treqid = " . $reqids[0] . "\n"; //} - if (!empty($vtireq[$idx])) { + if (!empty($vtireq)) { $ipsecfin .= "\treqid = {$ph1ent['ikeid']}000\n"; } $ipsecfin .= $ipsecconnect; From 41160d19fe4ee21ef3ad1c55e19dca528aef2daf Mon Sep 17 00:00:00 2001 From: Stephen Jones Date: Fri, 8 Jun 2018 14:21:19 -0500 Subject: [PATCH 07/22] Fixed #8515 Queues should now be added either through manually creating them or through the wizard --- src/etc/inc/shaper.inc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/etc/inc/shaper.inc b/src/etc/inc/shaper.inc index 9af2c00053..0e9c3bc359 100644 --- a/src/etc/inc/shaper.inc +++ b/src/etc/inc/shaper.inc @@ -116,8 +116,13 @@ function &get_reference_to_me_in_config(&$mypath) { $ptr =& $config['shaper']; foreach ($mypath as $indeks) { - $t_ptr = $ptr['queue'][$indeks]; - $ptr =& $t_ptr; + if (!is_array($ptr['queue'])) { + $ptr['queue'] = array(); + } + if (!is_array($ptr['queue'][$indeks])) { + $ptr['queue'][$indeks] = array(); + } + $ptr =& $ptr['queue'][$indeks]; } return $ptr; From 0aa52fb21a21f58035f2e2fe3b9328a9c175ffb5 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Jun 2018 15:56:29 -0400 Subject: [PATCH 08/22] Fixup ipsec interface static route processing. Issue #8544 --- src/etc/inc/interfaces.inc | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/etc/inc/interfaces.inc b/src/etc/inc/interfaces.inc index 036bcded63..45901d3c84 100644 --- a/src/etc/inc/interfaces.inc +++ b/src/etc/inc/interfaces.inc @@ -1339,10 +1339,9 @@ function interface_ipsec_vti_configure($ph1ent) { file_put_contents("/tmp/{$ipsecif}_router{$gwtype}", $addr['right']); } } - } - - if (!platform_booting()) { - system_routing_configure($ipsecif); + if (!platform_booting()) { + system_routing_configure(convert_real_interface_to_friendly_interface_name($ipsecif)); + } } } From 8d22f4b19126cff52e6283a8c8de8849ad614992 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Fri, 8 Jun 2018 16:08:20 -0400 Subject: [PATCH 09/22] Do not build hybrid images to serial/ADI --- tools/builder_common.sh | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/tools/builder_common.sh b/tools/builder_common.sh index 24021104f6..52edfe0144 100644 --- a/tools/builder_common.sh +++ b/tools/builder_common.sh @@ -869,12 +869,9 @@ create_memstick_image() { create_distribution_tarball - FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') - - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ - ${FSLABEL} \ - ${_image_path} \ - ${INSTALLER_CHROOT_DIR} + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ + ${INSTALLER_CHROOT_DIR} \ + ${MEMSTICKPATH} if [ ! -f "${_image_path}" ]; then echo "ERROR! memstick image was not built" @@ -920,12 +917,9 @@ create_memstick_serial_image() { create_distribution_tarball - FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') - - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ - ${FSLABEL} \ - ${MEMSTICKSERIALPATH} \ - ${INSTALLER_CHROOT_DIR} + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ + ${INSTALLER_CHROOT_DIR} \ + ${MEMSTICKSERIALPATH} if [ ! -f "${MEMSTICKSERIALPATH}" ]; then echo "ERROR! memstick serial image was not built" From b66b246e02b3e3ef05c3493cb00b6473c435d635 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Sat, 9 Jun 2018 10:35:43 -0400 Subject: [PATCH 10/22] Revert "Do not build hybrid images to serial/ADI" This reverts commit 8d22f4b19126cff52e6283a8c8de8849ad614992. --- tools/builder_common.sh | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/tools/builder_common.sh b/tools/builder_common.sh index 52edfe0144..24021104f6 100644 --- a/tools/builder_common.sh +++ b/tools/builder_common.sh @@ -869,9 +869,12 @@ create_memstick_image() { create_distribution_tarball - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ - ${INSTALLER_CHROOT_DIR} \ - ${MEMSTICKPATH} + FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') + + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ + ${FSLABEL} \ + ${_image_path} \ + ${INSTALLER_CHROOT_DIR} if [ ! -f "${_image_path}" ]; then echo "ERROR! memstick image was not built" @@ -917,9 +920,12 @@ create_memstick_serial_image() { create_distribution_tarball - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ - ${INSTALLER_CHROOT_DIR} \ - ${MEMSTICKSERIALPATH} + FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') + + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ + ${FSLABEL} \ + ${MEMSTICKSERIALPATH} \ + ${INSTALLER_CHROOT_DIR} if [ ! -f "${MEMSTICKSERIALPATH}" ]; then echo "ERROR! memstick serial image was not built" From d84eec807d6216cfbc073438ce57e01f1c52a2f4 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Sat, 9 Jun 2018 10:38:02 -0400 Subject: [PATCH 11/22] Do not build hybrid images to serial/ADI --- tools/builder_common.sh | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/tools/builder_common.sh b/tools/builder_common.sh index 24021104f6..257ebf6bb5 100644 --- a/tools/builder_common.sh +++ b/tools/builder_common.sh @@ -920,12 +920,9 @@ create_memstick_serial_image() { create_distribution_tarball - FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') - - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ - ${FSLABEL} \ - ${MEMSTICKSERIALPATH} \ - ${INSTALLER_CHROOT_DIR} + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ + ${INSTALLER_CHROOT_DIR} \ + ${MEMSTICKSERIALPATH} if [ ! -f "${MEMSTICKSERIALPATH}" ]; then echo "ERROR! memstick serial image was not built" @@ -973,12 +970,9 @@ create_memstick_adi_image() { create_distribution_tarball - FSLABEL=$(echo ${PRODUCT_NAME} | tr '[:lower:]' '[:upper:]') - - sh ${FREEBSD_SRC_DIR}/release/${TARGET}/mkisoimages.sh -b \ - ${FSLABEL} \ - ${MEMSTICKADIPATH} \ - ${INSTALLER_CHROOT_DIR} + sh ${FREEBSD_SRC_DIR}/release/${TARGET}/make-memstick.sh \ + ${INSTALLER_CHROOT_DIR} \ + ${MEMSTICKADIPATH} if [ ! -f "${MEMSTICKADIPATH}" ]; then echo "ERROR! memstick ADI image was not built" From 2e6167e71e7f6d83f52094a22a9a5be6ea39859b Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 11 Jun 2018 09:58:34 -0400 Subject: [PATCH 12/22] Be specific with port fwd priv checks. Fixes #8563 This way, users with only privs to view but not edit port forwards can still see the entries, but not act upon them. --- src/usr/local/www/firewall_nat.php | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/src/usr/local/www/firewall_nat.php b/src/usr/local/www/firewall_nat.php index aa005a045a..4586b83719 100644 --- a/src/usr/local/www/firewall_nat.php +++ b/src/usr/local/www/firewall_nat.php @@ -43,7 +43,7 @@ if (!is_array($config['nat']['rule'])) { $a_nat = &$config['nat']['rule']; /* update rule order, POST[rule] is an array of ordered IDs */ -if (array_key_exists('order-store', $_REQUEST)) { +if (array_key_exists('order-store', $_REQUEST) && have_natpfruleint_access($natent['interface'])) { if (is_array($_REQUEST['rule']) && !empty($_REQUEST['rule'])) { $a_nat_new = array(); @@ -78,7 +78,7 @@ if ($_REQUEST['savemsg']) { $savemsg = $_REQUEST['savemsg']; } -if ($_POST['apply']) { +if ($_POST['apply'] && have_natpfruleint_access($natent['interface'])) { $retval = 0; @@ -93,7 +93,7 @@ if ($_POST['apply']) { } -if ($_POST['act'] == "del") { +if (($_POST['act'] == "del") && have_natpfruleint_access($natent['interface'])) { if ($a_nat[$_POST['id']]) { if (isset($a_nat[$_POST['id']]['associated-rule-id'])) { @@ -121,7 +121,7 @@ if ($_POST['act'] == "del") { } } -if (isset($_POST['del_x'])) { +if (isset($_POST['del_x']) && have_natpfruleint_access($natent['interface'])) { /* delete selected rules */ if (is_array($_POST['rule']) && count($_POST['rule'])) { @@ -154,7 +154,7 @@ if (isset($_POST['del_x'])) { header("Location: firewall_nat.php"); exit; } -} else if ($_POST['act'] == "toggle") { +} elseif (($_POST['act'] == "toggle") && have_natpfruleint_access($natent['interface'])) { if ($a_nat[$_POST['id']]) { if (isset($a_nat[$_POST['id']]['disabled'])) { unset($a_nat[$_POST['id']]['disabled']); @@ -188,7 +188,7 @@ if ($_POST['apply']) { print_apply_result_box($retval); } -if (is_subsystem_dirty('natconf')) { +if (is_subsystem_dirty('natconf') && have_natpfruleint_access($natent['interface'])) { print_apply_box(gettext('The NAT configuration has been changed.') . '
' . gettext('The changes must be applied for them to take effect.')); } @@ -268,11 +268,6 @@ foreach ($a_nat as $natent): $localport ); - /* if user does not have access to edit an interface skip on to the next record */ - if (!have_natpfruleint_access($natent['interface'])) { - continue; - } - if (isset($natent['disabled'])) { $iconfn = "pass_d"; $trclass = 'class="disabled"'; @@ -284,15 +279,19 @@ foreach ($a_nat as $natent): onClick="fr_toggle()" ondblclick="document.location='firewall_nat_edit.php?id=';"> + + + "> + +  "> - + " href="firewall_nat_edit.php?id="> " href="firewall_nat_edit.php?dup="> " href="firewall_nat.php?act=del&id=" usepost> + + - + + + + + From 5ffeceb606e7d4e957ca6748438c43e8da7a8c28 Mon Sep 17 00:00:00 2001 From: Stephen Jones Date: Fri, 15 Jun 2018 15:41:42 -0500 Subject: [PATCH 18/22] Fixed #8515 fixed error in queue defintion where it would repeat It should now create a new definition for each queue. Queues should now show up under status > queues. --- src/etc/inc/shaper.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/etc/inc/shaper.inc b/src/etc/inc/shaper.inc index 0e9c3bc359..3313e74076 100644 --- a/src/etc/inc/shaper.inc +++ b/src/etc/inc/shaper.inc @@ -4520,9 +4520,9 @@ function read_altq_config() { foreach ($a_int as $key => $conf) { $int = $conf['interface']; - $__tmp_root = new altq_root_queue(); $root =& $__tmp_root; + $root = new altq_root_queue(); $root->SetInterface($int); - $altq_list_queues[$root->GetInterface()] = &$root; + $altq_list_queues[$root->GetInterface()] = $root; $root->ReadConfig($conf); array_push($path, $key); $root->SetLink($path); From 480c21f44c42dd84f7ca0e0db62a7a731ed0278e Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 19 Jun 2018 10:05:20 -0400 Subject: [PATCH 19/22] Correct the gateway check when deleting a VIP. Fixes #4438 Now it checks to see if there are other VIPs in the same subnet left, and only prevents deleting the last VIP by which a gateway could be reached. --- src/usr/local/www/firewall_virtual_ip.php | 32 ++++++++++++++++++++--- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/src/usr/local/www/firewall_virtual_ip.php b/src/usr/local/www/firewall_virtual_ip.php index 662b34afbb..11ad2b9926 100644 --- a/src/usr/local/www/firewall_virtual_ip.php +++ b/src/usr/local/www/firewall_virtual_ip.php @@ -133,6 +133,9 @@ if ($_POST['act'] == "del") { $subnet .= "/" . $a_vip[$_POST['id']]['subnet_bits']; $if_subnet .= "/" . $if_subnet_bits; + /* Determine if this VIP is in the same subnet as any gateway + * which can only be reached by VIPs */ + $viponlygws = array(); if (is_array($config['gateways']['gateway_item'])) { foreach ($config['gateways']['gateway_item'] as $gateway) { if ($a_vip[$_POST['id']]['interface'] != $gateway['interface']) { @@ -147,15 +150,36 @@ if ($_POST['act'] == "del") { if (ip_in_subnet($gateway['gateway'], $if_subnet)) { continue; } - - if (ip_in_subnet($gateway['gateway'], $subnet)) { - $input_errors[] = gettext("This entry cannot be deleted because it is still referenced by at least one Gateway."); - break; + $viponlygws[] = $gateway; } } } + /* + * If gateways for this subnet are only reachable via VIPs, + * make sure this is not the last VIP through which that gateway + * can be reached. See https://redmine.pfsense.org/issues/4438 + */ + foreach ($viponlygws as $vgw) { + $numrefs = 0; + foreach ($a_vip as $refvip) { + if (($refvip['interface'] != $vgw['interface']) || + (is_ipaddrv4($refvip['subnet']) && ($vgw['ipprotocol'] == 'inet6')) || + (is_ipaddrv6($refvip['subnet']) && ($vgw['ipprotocol'] == 'inet'))) { + continue; + } + if (ip_in_subnet($vgw['gateway'], + gen_subnet($refvip['subnet'], $refvip['subnet_bits']) . '/' . $refvip['subnet_bits'])) { + $numrefs++; + } + } + if ($numrefs <= 1) { + $input_errors[] = sprintf(gettext("This entry cannot be deleted because it is required to reach Gateway: %s."), $vgw['name']); + break; + } + } + if ($a_vip[$_POST['id']]['mode'] == "ipalias") { $subnet = gen_subnet($a_vip[$_POST['id']]['subnet'], $a_vip[$_POST['id']]['subnet_bits']) . "/" . $a_vip[$_POST['id']]['subnet_bits']; $found_if = false; From 90b3235d6a47680655b8559618d2cd6841baf823 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 19 Jun 2018 11:57:44 -0400 Subject: [PATCH 20/22] Correct PHP syntax error that leads to a PHP 7 error. --- src/etc/rc.newwanipv6 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/rc.newwanipv6 b/src/etc/rc.newwanipv6 index 1a34cdf4da..1e4bbfee55 100755 --- a/src/etc/rc.newwanipv6 +++ b/src/etc/rc.newwanipv6 @@ -96,7 +96,7 @@ if (!empty($new_domain_name_servers)) { } } - if (count($valid_ns > 0)) { + if (count($valid_ns) > 0) { file_put_contents("{$g['varetc_path']}/nameserver_v6{$interface}", implode("\n", $valid_ns)); } } From b310666c2662044ab761f8c9798a46a064d1c6d5 Mon Sep 17 00:00:00 2001 From: "Carl P. Corliss" Date: Wed, 20 Jun 2018 01:07:30 -0400 Subject: [PATCH 21/22] misspelled ldap bind username variable * $ldapbndun -> $ldapbindun --- src/etc/inc/auth.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc index 86888c6655..f7b34aabc9 100644 --- a/src/etc/inc/auth.inc +++ b/src/etc/inc/auth.inc @@ -1014,7 +1014,7 @@ function ldap_test_bind($authcfg) { $ldapbindpw = $authcfg['ldap_bindpw']; $ldapver = $authcfg['ldap_protver']; $ldaptimeout = is_numeric($authcfg['ldap_timeout']) ? $authcfg['ldap_timeout'] : 5; - if (empty($ldapbndun) || empty($ldapbindpw)) { + if (empty($ldapbindun) || empty($ldapbindpw)) { $ldapanon = true; } else { $ldapanon = false; From 64564c4f3d130ac86fc18d71d40ede1ec14a8cda Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 20 Jun 2018 08:17:14 -0300 Subject: [PATCH 22/22] Adjust confs for new release-staging server --- tools/builder_defaults.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tools/builder_defaults.sh b/tools/builder_defaults.sh index fc4942cc65..10698a0408 100644 --- a/tools/builder_defaults.sh +++ b/tools/builder_defaults.sh @@ -203,8 +203,6 @@ if [ -z "${BUILTDATESTRING}" ]; then fi echo "$BUILTDATESTRING" > $BUILTDATESTRINGFILE -STAGING_HOSTNAME=${STAGING_HOSTNAME:-"release-staging.netgate.com"} - # Poudriere export ZFS_TANK=${ZFS_TANK:-"zroot"} export ZFS_ROOT=${ZFS_ROOT:-"/poudriere"} @@ -260,11 +258,13 @@ export BUILDER_PKG_DEPENDENCIES="devel/git ftp/curl net/rsync sysutils/screen \ emulators/qemu-user-static security/sssd security/pam_ldap \ security/pam_mkhomedir archivers/gtar textproc/xmlstarlet" +STAGING_HOSTNAME=${STAGING_HOSTNAME:-"release-staging.nyi.netgate.com"} + # Host to rsync pkg repos from poudriere -export PKG_RSYNC_HOSTNAME=${PKG_RSYNC_HOSTNAME:-${STAGING_HOSTNAME}} +export PKG_RSYNC_HOSTNAME=${PKG_RSYNC_HOSTNAME:-"nfs1.nyi.netgate.com"} export PKG_RSYNC_USERNAME=${PKG_RSYNC_USERNAME:-"wwwsync"} export PKG_RSYNC_SSH_PORT=${PKG_RSYNC_SSH_PORT:-"22"} -export PKG_RSYNC_DESTDIR=${PKG_RSYNC_DESTDIR:-"/staging/ce/packages"} +export PKG_RSYNC_DESTDIR=${PKG_RSYNC_DESTDIR:-"/storage/files/release-staging/ce/packages"} # Final packages server if [ -n "${_IS_RELEASE}" -o -n "${_IS_RC}" ]; then @@ -340,9 +340,9 @@ export VARIANTUPDATES="" # Rsync data to send snapshots if [ -n "${_IS_RELEASE}" -o -n "${SKIP_FINAL_RSYNC}" ]; then - export RSYNCIP=${RSYNCIP:-"release-staging.netgate.com"} + export RSYNCIP=${RSYNCIP:-"nfs1.nyi.netgate.com"} export RSYNCUSER=${RSYNCUSER:-"wwwsync"} - export RSYNCPATH=${RSYNCPATH:-"/staging/ce/images"} + export RSYNCPATH=${RSYNCPATH:-"/storage/files/release-staging/ce/images"} else export RSYNCIP=${RSYNCIP:-"nfs1.nyi.netgate.com"} export RSYNCUSER=${RSYNCUSER:-"wwwsync"}