From 7ec0aeb1531423c88406c5c7c87713316dbc6a04 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 20 May 2010 19:55:45 -0400 Subject: [PATCH 001/112] Adding restore script for rc.create_full_backup. First argument is the restore filename --- etc/rc.restore_full_backup | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100755 etc/rc.restore_full_backup diff --git a/etc/rc.restore_full_backup b/etc/rc.restore_full_backup new file mode 100755 index 0000000000..a5b890a689 --- /dev/null +++ b/etc/rc.restore_full_backup @@ -0,0 +1,11 @@ +#!/bin/sh + +if [ -f $1 ]; then + echo "One moment please while we restore $1" + tar xzvPfU $1 -C / + echo "Restore of $1 complete." +else + echo "Could not locate $1" + ls "Available backups:" + ls -lah /root | grep Backup +fi From 02bdb544c98e7d0d20feef37b58091b32e474604 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 20 May 2010 19:59:07 -0400 Subject: [PATCH 002/112] Use echo --- etc/rc.restore_full_backup | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/etc/rc.restore_full_backup b/etc/rc.restore_full_backup index a5b890a689..e3b8f681d2 100755 --- a/etc/rc.restore_full_backup +++ b/etc/rc.restore_full_backup @@ -6,6 +6,7 @@ if [ -f $1 ]; then echo "Restore of $1 complete." else echo "Could not locate $1" - ls "Available backups:" + echo + echo "Available backups:" ls -lah /root | grep Backup fi From ea546e4943780afb75f2db2fb3dfff5fac52397a Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 20 May 2010 22:14:28 -0400 Subject: [PATCH 003/112] Minor fixes --- etc/rc.restore_full_backup | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/etc/rc.restore_full_backup b/etc/rc.restore_full_backup index e3b8f681d2..44b63d2927 100755 --- a/etc/rc.restore_full_backup +++ b/etc/rc.restore_full_backup @@ -2,11 +2,9 @@ if [ -f $1 ]; then echo "One moment please while we restore $1" - tar xzvPfU $1 -C / + tar xzPfU $1 -C / echo "Restore of $1 complete." else - echo "Could not locate $1" - echo - echo "Available backups:" - ls -lah /root | grep Backup + echo "Could not locate ${1}. Available backups:" + ls -lah /root | grep backup fi From 6cf2e475ae05314c0a7e006305378829a91e94eb Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 20 May 2010 22:15:05 -0400 Subject: [PATCH 004/112] pipe to more --- etc/rc.restore_full_backup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/rc.restore_full_backup b/etc/rc.restore_full_backup index 44b63d2927..4d744666d2 100755 --- a/etc/rc.restore_full_backup +++ b/etc/rc.restore_full_backup @@ -6,5 +6,5 @@ if [ -f $1 ]; then echo "Restore of $1 complete." else echo "Could not locate ${1}. Available backups:" - ls -lah /root | grep backup + ls -lah /root | grep backup | more fi From 1f06d2170f731204d8991725b46471c6932b75e3 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 20 May 2010 22:16:13 -0400 Subject: [PATCH 005/112] Revise text --- etc/rc.restore_full_backup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/rc.restore_full_backup b/etc/rc.restore_full_backup index 4d744666d2..92c13949a0 100755 --- a/etc/rc.restore_full_backup +++ b/etc/rc.restore_full_backup @@ -1,7 +1,7 @@ #!/bin/sh if [ -f $1 ]; then - echo "One moment please while we restore $1" + echo "One moment, restoring ${1}..." tar xzPfU $1 -C / echo "Restore of $1 complete." else From d7f742c26558b1ff08a0d6f28f24a6b5acf537e8 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Fri, 21 May 2010 00:05:11 -0400 Subject: [PATCH 006/112] Do not process items in which we cannot resolve the config file --- etc/inc/pkg-utils.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/etc/inc/pkg-utils.inc b/etc/inc/pkg-utils.inc index f8c187c0ae..f06b98c721 100644 --- a/etc/inc/pkg-utils.inc +++ b/etc/inc/pkg-utils.inc @@ -740,6 +740,8 @@ function delete_package($pkg, $pkgid) { $pkg_info = $config['installedpackages']['package'][$pkgid]; $configfile = $pkg_info['configurationfile']; + if(empty($configfile)) + return; if(file_exists("/usr/local/pkg/" . $configfile)) { $static_output .= "\nLoading package configuration $configfile... "; update_output_window($static_output); From c099a98759a659267bf0729246a254d778d54a31 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Fri, 21 May 2010 00:23:06 -0400 Subject: [PATCH 007/112] Add space between the and forum --- usr/local/www/pkg_mgr.php | 2 +- usr/local/www/pkg_mgr_installed.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/pkg_mgr.php b/usr/local/www/pkg_mgr.php index 1445dcfb16..e82bba0471 100755 --- a/usr/local/www/pkg_mgr.php +++ b/usr/local/www/pkg_mgr.php @@ -195,7 +195,7 @@ include("head.inc"); $pkginfolink = $index['pkginfolink']; echo "Package Info"; } else { - echo gettext("No info, check the") . "" . gettext("forum") . ""; + echo gettext("No info, check the") . " " . gettext("forum") . ""; } ?> diff --git a/usr/local/www/pkg_mgr_installed.php b/usr/local/www/pkg_mgr_installed.php index 5db007f4f3..2708c783fe 100755 --- a/usr/local/www/pkg_mgr_installed.php +++ b/usr/local/www/pkg_mgr_installed.php @@ -134,7 +134,7 @@ include("head.inc"); $pkginfolink = $currentvers[$pkg['name']]['pkginfolink']; echo "" . gettext("Package Info") . ""; } else { - echo gettext("No info, check the") . "" . gettext("forum") . ""; + echo gettext("No info, check the") . " " . gettext("forum") . ""; } ?> From 61630681e0c36bbe9b05d2a51bf742a3c7b9a2de Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 21 May 2010 12:29:07 +0000 Subject: [PATCH 008/112] Remove unecessary check. --- etc/inc/gwlb.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 241189225d..80cfc40562 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -148,7 +148,7 @@ EOD; foreach($gateways_arr as $name => $gateway) { $gwref = $a_gateway_item[$gateway['attribute']]; /* for dynamic gateways without an IP address we subtitute a local one */ - if((is_numeric($gateway['attribute'])) && is_ipaddr($gwref['monitor'])) { + if(is_ipaddr($gwref['monitor'])) { $gateway['monitor'] = $gwref['monitor']; } else { if ($gateway['gateway'] == "dynamic") { From dc4f649eb85b3bd2476cfbd59c0f81571870c7a9 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Fri, 21 May 2010 12:42:11 -0400 Subject: [PATCH 009/112] Make Firewall Optimization Options text readable --- usr/local/www/system_advanced_firewall.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/system_advanced_firewall.php b/usr/local/www/system_advanced_firewall.php index 74a315b0f7..370c47c76f 100644 --- a/usr/local/www/system_advanced_firewall.php +++ b/usr/local/www/system_advanced_firewall.php @@ -254,7 +254,7 @@ function update_description(itemnum) {
- + From 6d1af0e9d8e4398f71a572bb1cf2b4174ac5503b Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 21 May 2010 13:31:33 -0400 Subject: [PATCH 010/112] Preserve DHCP numbered options when there is an input error. Fixes #494 --- usr/local/www/services_dhcp.php | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/usr/local/www/services_dhcp.php b/usr/local/www/services_dhcp.php index b72258fd7c..0a9bb460c3 100755 --- a/usr/local/www/services_dhcp.php +++ b/usr/local/www/services_dhcp.php @@ -193,6 +193,18 @@ if ($_POST) { $pconfig = $_POST; + $numberoptions = array(); + for($x=0; $x<99; $x++) { + if(isset($_POST["number{$x}"]) && ctype_digit($_POST["number{$x}"])) { + $numbervalue = array(); + $numbervalue['number'] = htmlspecialchars($_POST["number{$x}"]); + $numbervalue['value'] = htmlspecialchars($_POST["value{$x}"]); + $numberoptions['item'][] = $numbervalue; + } + } + // Reload the new pconfig variable that the forum uses. + $pconfig['numberoptions'] = $numberoptions; + /* input validation */ if ($_POST['enable']) { $reqdfields = explode(" ", "range_from range_to"); @@ -313,17 +325,8 @@ if ($_POST) { // Handle the custom options rowhelper if(isset($config['dhcpd'][$if]['numberoptions']['item'])) unset($config['dhcpd'][$if]['numberoptions']['item']); - for($x=0; $x<99; $x++) { - if(isset($_POST["number{$x}"]) && ctype_digit($_POST["number{$x}"])) { - $numbervalue = array(); - $numbervalue['number'] = htmlspecialchars($_POST["number{$x}"]); - $numbervalue['value'] = htmlspecialchars($_POST["value{$x}"]); - $config['dhcpd'][$if]['numberoptions']['item'][] = $numbervalue; - } - } - - // Reload the new pconfig variable that the forum uses. - $pconfig['numberoptions'] = $config['dhcpd'][$if]['numberoptions']; + + $config['dhcpd'][$if]['numberoptions'] = $numberoptions; write_config(); From de792e62e30ac90d0d5d96f119681c86836a366f Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 21 May 2010 13:45:24 -0400 Subject: [PATCH 011/112] Fix whitespace while I'm here. --- usr/local/www/services_dhcp.php | 666 ++++++++++++++++---------------- 1 file changed, 326 insertions(+), 340 deletions(-) diff --git a/usr/local/www/services_dhcp.php b/usr/local/www/services_dhcp.php index 0a9bb460c3..0bbb3bc4fe 100755 --- a/usr/local/www/services_dhcp.php +++ b/usr/local/www/services_dhcp.php @@ -47,7 +47,7 @@ if(!$g['services_dhcp_server_enable']) { exit; } -/* Fix failover DHCP problem +/* Fix failover DHCP problem * http://article.gmane.org/gmane.comp.security.firewalls.pfsense.support/18749 */ ini_set("memory_limit","64M"); @@ -120,8 +120,8 @@ $iflist = get_configured_interface_with_descr(); /* set the starting interface */ if (!$if || !isset($iflist[$if])) { foreach ($iflist as $ifent => $ifname) { - $oc = $config['interfaces'][$ifent]; - if ((is_array($config['dhcpd'][$ifent]) && !isset($config['dhcpd'][$ifent]['enable']) && (!is_ipaddr($oc['ipaddr']))) || + $oc = $config['interfaces'][$ifent]; + if ((is_array($config['dhcpd'][$ifent]) && !isset($config['dhcpd'][$ifent]['enable']) && (!is_ipaddr($oc['ipaddr']))) || (!is_array($config['dhcpd'][$ifent]) && (!is_ipaddr($oc['ipaddr'])))) continue; $if = $ifent; @@ -133,7 +133,7 @@ if (is_array($config['dhcpd'][$if])){ if (is_array($config['dhcpd'][$if]['range'])) { $pconfig['range_from'] = $config['dhcpd'][$if]['range']['from']; $pconfig['range_to'] = $config['dhcpd'][$if]['range']['to']; - } + } $pconfig['deftime'] = $config['dhcpd'][$if]['defaultleasetime']; $pconfig['maxtime'] = $config['dhcpd'][$if]['maxleasetime']; $pconfig['gateway'] = $config['dhcpd'][$if]['gateway']; @@ -156,8 +156,8 @@ if (is_array($config['dhcpd'][$if])){ $pconfig['failover_peerip'] = $config['dhcpd'][$if]['failover_peerip']; $pconfig['netmask'] = $config['dhcpd'][$if]['netmask']; $pconfig['numberoptions'] = $config['dhcpd'][$if]['numberoptions']; - if (!is_array($config['dhcpd'][$if]['staticmap'])) - $config['dhcpd'][$if]['staticmap'] = array(); + if (!is_array($config['dhcpd'][$if]['staticmap'])) + $config['dhcpd'][$if]['staticmap'] = array(); $a_maps = &$config['dhcpd'][$if]['staticmap']; } @@ -165,7 +165,7 @@ $ifcfgip = get_interface_ip($if); $ifcfgsn = get_interface_subnet($if); /* set the enabled flag which will tell us if DHCP relay is enabled - * on any interface. We will use this to disable DHCP server since + * on any interface. We will use this to disable DHCP server since * the two are not compatible with each other. */ @@ -211,31 +211,31 @@ if ($_POST) { $reqdfieldsn = explode(",", "Range begin,Range end"); do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); - - if (($_POST['range_from'] && !is_ipaddr($_POST['range_from']))) + + if (($_POST['range_from'] && !is_ipaddr($_POST['range_from']))) $input_errors[] = "A valid range must be specified."; - if (($_POST['range_to'] && !is_ipaddr($_POST['range_to']))) + if (($_POST['range_to'] && !is_ipaddr($_POST['range_to']))) $input_errors[] = "A valid range must be specified."; - if (($_POST['gateway'] && !is_ipaddr($_POST['gateway']))) + if (($_POST['gateway'] && !is_ipaddr($_POST['gateway']))) $input_errors[] = "A valid IP address must be specified for the gateway."; - if (($_POST['wins1'] && !is_ipaddr($_POST['wins1'])) || ($_POST['wins2'] && !is_ipaddr($_POST['wins2']))) + if (($_POST['wins1'] && !is_ipaddr($_POST['wins1'])) || ($_POST['wins2'] && !is_ipaddr($_POST['wins2']))) $input_errors[] = "A valid IP address must be specified for the primary/secondary WINS servers."; - if (($_POST['dns1'] && !is_ipaddr($_POST['dns1'])) || ($_POST['dns2'] && !is_ipaddr($_POST['dns2']))) + if (($_POST['dns1'] && !is_ipaddr($_POST['dns1'])) || ($_POST['dns2'] && !is_ipaddr($_POST['dns2']))) $input_errors[] = "A valid IP address must be specified for the primary/secondary DNS servers."; - if ($_POST['deftime'] && (!is_numeric($_POST['deftime']) || ($_POST['deftime'] < 60))) + if ($_POST['deftime'] && (!is_numeric($_POST['deftime']) || ($_POST['deftime'] < 60))) $input_errors[] = "The default lease time must be at least 60 seconds."; - if ($_POST['maxtime'] && (!is_numeric($_POST['maxtime']) || ($_POST['maxtime'] < 60) || ($_POST['maxtime'] <= $_POST['deftime']))) + if ($_POST['maxtime'] && (!is_numeric($_POST['maxtime']) || ($_POST['maxtime'] < 60) || ($_POST['maxtime'] <= $_POST['deftime']))) $input_errors[] = "The maximum lease time must be at least 60 seconds and higher than the default lease time."; - if (($_POST['ddnsdomain'] && !is_domain($_POST['ddnsdomain']))) + if (($_POST['ddnsdomain'] && !is_domain($_POST['ddnsdomain']))) $input_errors[] = "A valid domain name must be specified for the dynamic DNS registration."; - if (($_POST['ntp1'] && !is_ipaddr($_POST['ntp1'])) || ($_POST['ntp2'] && !is_ipaddr($_POST['ntp2']))) + if (($_POST['ntp1'] && !is_ipaddr($_POST['ntp1'])) || ($_POST['ntp2'] && !is_ipaddr($_POST['ntp2']))) $input_errors[] = "A valid IP address must be specified for the primary/secondary NTP servers."; if (($_POST['domain'] && !is_domain($_POST['domain']))) $input_errors[] = "A valid domain name must be specified for the DNS domain."; if (($_POST['tftp'] && (!is_ipaddr($_POST['tftp']) && !is_domain($_POST['tftp'])))) $input_errors[] = "A valid IP address or hostname must be specified for the TFTP server."; - if (($_POST['nextserver'] && !is_ipaddr($_POST['nextserver']))) + if (($_POST['nextserver'] && !is_ipaddr($_POST['nextserver']))) $input_errors[] = "A valid IP address must be specified for the network boot server."; if(gen_subnet($ifcfgip, $ifcfgsn) == $_POST['range_from']) @@ -246,8 +246,8 @@ if ($_POST) { // Disallow a range that includes the virtualip if (is_array($config['virtualip']['vip'])) { foreach($config['virtualip']['vip'] as $vip) { - if($vip['interface'] == $if) - if($vip['subnet'] && is_inrange($vip['subnet'], $_POST['range_from'], $_POST['range_to'])) + if($vip['interface'] == $if) + if($vip['subnet'] && is_inrange($vip['subnet'], $_POST['range_from'], $_POST['range_to'])) $input_errors[] = "The subnet range cannot overlap with virtual IP address {$vip['subnet']}."; } } @@ -283,7 +283,7 @@ if ($_POST) { $config['dhcpd'][$if]['maxleasetime'] = $_POST['maxtime']; $config['dhcpd'][$if]['netmask'] = $_POST['netmask']; $previous = $config['dhcpd'][$if]['failover_peerip']; - if($previous <> $_POST['failover_peerip']) + if($previous <> $_POST['failover_peerip']) mwexec("/bin/rm -rf /var/dhcpd/var/db/*"); $config['dhcpd'][$if]['failover_peerip'] = $_POST['failover_peerip']; @@ -346,12 +346,12 @@ if ($_POST) { if ($retvaldns == 0) { clear_subsystem_dirty('hosts'); clear_subsystem_dirty('staticmaps'); - } + } } else { - $retvaldhcp = services_dhcpd_configure(); + $retvaldhcp = services_dhcpd_configure(); if ($retvaldhcp == 0) clear_subsystem_dirty('staticmaps'); - } + } if($retvaldhcp == 1 || $retvaldns == 1) $retval = 1; $savemsg = get_std_save_message($retval); @@ -461,10 +461,10 @@ include("head.inc");
-"; echo ""; exit; @@ -474,15 +474,15 @@ include("head.inc"); You must apply the changes in order for them to take effect.");?>
- - - + + + + + + - - From e588bd54bddbd287fd85f348792600d6ee87c8b5 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 24 May 2010 16:43:51 -0400 Subject: [PATCH 071/112] Insulate some variables as they are used. --- etc/rc.firmware | 55 ++++++++++++++++++------------------------------- 1 file changed, 20 insertions(+), 35 deletions(-) diff --git a/etc/rc.firmware b/etc/rc.firmware index 8f76ecd298..1a01e4b11e 100755 --- a/etc/rc.firmware +++ b/etc/rc.firmware @@ -161,8 +161,8 @@ pfSenseNanoBSDupgrade) echo "" >> /conf/upgrade_log.txt - echo "Installing $IMG." >> /conf/upgrade_log.txt 2>&1 - echo "Installing $IMG." | wall + echo "Installing ${IMG}." >> /conf/upgrade_log.txt 2>&1 + echo "Installing ${IMG}." | wall # resolve glabel label that we booted from BOOT_DEVICE=`/sbin/mount | /usr/bin/grep pfsense | /usr/bin/cut -d'/' -f4 | /usr/bin/cut -d' ' -f1` @@ -190,11 +190,11 @@ pfSenseNanoBSDupgrade) fi # Output specifc information that this script is using - echo "SLICE $SLICE" >> /conf/upgrade_log.txt - echo "OLDSLICE $OLDSLICE" >> /conf/upgrade_log.txt - echo "TOFLASH $TOFLASH" >> /conf/upgrade_log.txt - echo "COMPLETE_PATH $COMPLETE_PATH" >> /conf/upgrade_log.txt - echo "GLABEL_SLICE $GLABEL_SLICE" >> /conf/upgrade_log.txt + echo "SLICE ${SLICE}" >> /conf/upgrade_log.txt + echo "OLDSLICE ${OLDSLICE}" >> /conf/upgrade_log.txt + echo "TOFLASH ${TOFLASH}" >> /conf/upgrade_log.txt + echo "COMPLETE_PATH ${COMPLETE_PATH}" >> /conf/upgrade_log.txt + echo "GLABEL_SLICE ${GLABEL_SLICE}" >> /conf/upgrade_log.txt # First ensure the new file can fit inside the # slice that we are going to be operating on. @@ -219,14 +219,9 @@ pfSenseNanoBSDupgrade) echo "" >> /conf/fdisk_upgrade_log.txt echo "Before upgrade fdisk/bsdlabel" >> /conf/fdisk_upgrade_log.txt fdisk $BOOT_DRIVE >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s1 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s2 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s3 >> /conf/fdisk_upgrade_log.txt echo "---------------------------------------------------------------" >> /conf/fdisk_upgrade_log.txt echo "" >> /conf/fdisk_upgrade_log.txt @@ -249,21 +244,16 @@ pfSenseNanoBSDupgrade) echo "" >> /conf/fdisk_upgrade_log.txt echo "After upgrade fdisk/bsdlabel" >> /conf/upgrade_log.txt fdisk $BOOT_DRIVE >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s1 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s2 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s3 >> /conf/fdisk_upgrade_log.txt echo "---------------------------------------------------------------" >> /conf/fdisk_upgrade_log.txt echo "" >> /conf/fdisk_upgrade_log.txt # Ensure that our new system is sound and bail if it is not and file a notice echo "" >> /conf/upgrade_log.txt - echo "/sbin/fsck_ufs -y /dev/$COMPLETE_PATH" >> /conf/upgrade_log.txt - /sbin/fsck_ufs -y /dev/$COMPLETE_PATH >> /conf/upgrade_log.txt 2>&1 + echo "/sbin/fsck_ufs -y /dev/${COMPLETE_PATH}" >> /conf/upgrade_log.txt + /sbin/fsck_ufs -y /dev/${COMPLETE_PATH} >> /conf/upgrade_log.txt 2>&1 if [ $? != 0 ]; then file_notice "UpgradeFailure" "{\$g['product_name']} upgrade has failed. Your system has been left in a usable state." rm -f $IMG @@ -278,8 +268,8 @@ pfSenseNanoBSDupgrade) # Add back the corresponding glabel echo "" >> /conf/upgrade_log.txt - echo "/sbin/tunefs -L ${GLABEL_SLICE} /dev/$COMPLETE_PATH" >> /conf/upgrade_log.txt - /sbin/tunefs -L ${GLABEL_SLICE} /dev/$COMPLETE_PATH >> /conf/upgrade_log.txt 2>&1 + echo "/sbin/tunefs -L ${GLABEL_SLICE} /dev/${COMPLETE_PATH}" >> /conf/upgrade_log.txt + /sbin/tunefs -L ${GLABEL_SLICE} /dev/${COMPLETE_PATH} >> /conf/upgrade_log.txt 2>&1 # restore config cp -p /tmp/configbak/* /conf 2>/dev/null @@ -342,14 +332,9 @@ pfSenseNanoBSDupgrade) echo "" >> /conf/fdisk_upgrade_log.txt echo "Final upgrade fdisk/bsdlabel" >> /conf/fdisk_upgrade_log.txt fdisk $BOOT_DRIVE >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs1a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs2a >> /conf/fdisk_upgrade_log.txt - fdisk $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs1 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs2 >> /conf/fdisk_upgrade_log.txt - bsdlabel -A $BOOT_DRIVEs3 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s1 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s2 >> /conf/fdisk_upgrade_log.txt + bsdlabel -A ${BOOT_DRIVE}s3 >> /conf/fdisk_upgrade_log.txt echo "---------------------------------------------------------------" >> /conf/fdisk_upgrade_log.txt echo "" >> /conf/fdisk_upgrade_log.txt From 9628bd1c30fd67a9532a3bd031a0461a13f0b01d Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 22:11:57 +0000 Subject: [PATCH 072/112] Actually use the radius WISPr(4) attribute 'url_redirection' if present. --- usr/local/captiveportal/index.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 904f268f57..7a87312cda 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -244,7 +244,7 @@ function portal_mac_radius($clientmac,$clientip) { function portal_allow($clientip,$clientmac,$username,$password = null, $attributes = null, $ruleno = null) { - global $redirurl, $g, $config, $url_redirection, $type, $passthrumac; + global $redirurl, $g, $config, $type, $passthrumac; /* See if a ruleno is passed, if not start locking the sessions because this means there isn't one atm */ $captiveshouldunlock = false; @@ -405,8 +405,8 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut write_config(); /* redirect user to desired destination */ - if ($url_redirection) - $my_redirurl = $url_redirection; + if (!empty($attributes['url_redirection'])) + $my_redirurl = $attributes['url_redirection']; else if ($config['captiveportal']['redirurl']) $my_redirurl = $config['captiveportal']['redirurl']; else @@ -501,4 +501,4 @@ function disconnect_client($sessionid, $logoutReason = "LOGOUT", $term_cause = 1 unlock($cplock); } -?> \ No newline at end of file +?> From 27588018f41b6935e0fdb4fc5d197eb56ce49e16 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 22:18:02 +0000 Subject: [PATCH 073/112] Actually match the description and send the wan interface ip as Called-Station-Id on default settings. --- usr/local/captiveportal/radius_authentication.inc | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/usr/local/captiveportal/radius_authentication.inc b/usr/local/captiveportal/radius_authentication.inc index 01ec063a98..7f37b03d3f 100644 --- a/usr/local/captiveportal/radius_authentication.inc +++ b/usr/local/captiveportal/radius_authentication.inc @@ -51,7 +51,7 @@ function RADIUS_AUTHENTICATION($username,$password,$radiusservers,$clientip,$cli global $config; $retvalue = array(); - $nas_mac = mac_format(get_interface_mac($config['interfaces']['wan']['if'])); + $nas_mac = mac_format(get_interface_mac(get_real_interface("wan"))); $clientmac = mac_format($clientmac); $nas_port = $ruleno; $radiusvendor = $config['captiveportal']['radiusvendor'] ? $config['captiveportal']['radiusvendor'] : null; @@ -66,7 +66,7 @@ function RADIUS_AUTHENTICATION($username,$password,$radiusservers,$clientip,$cli break; default: - $calledstationid = $nas_mac; + $calledstationid = get_interface_ip("wan"); $callingstationid = $clientmac; } @@ -74,13 +74,11 @@ function RADIUS_AUTHENTICATION($username,$password,$radiusservers,$clientip,$cli $rauth = new Auth_RADIUS_PAP($username, $password); /* - Add support for more then one radiusserver. - At most 10 servers may be specified. - When multiple servers are given, they are tried in round-robin fashion until a valid response is received - */ - + * Add support for more then one radiusserver. + * At most 10 servers may be specified. + * When multiple servers are given, they are tried in round-robin fashion until a valid response is received + */ foreach ($radiusservers as $radsrv) { - // Add a new server to our instance $rauth->addServer($radsrv['ipaddr'], $radsrv['port'], $radsrv['key']); From 0eb9b1b4a7f5c8455d5197fff121ddddfff4ad46 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 22:54:16 +0000 Subject: [PATCH 074/112] Actually use the radius WISPr(4) attribute 'url_redirection' when present. --- usr/local/captiveportal/index.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 7a87312cda..5735a2119a 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -161,7 +161,10 @@ exit; } else if ($auth_list['auth_val'] == 3) { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"FAILURE",$auth_list['reply_message']); - portal_reply_page($redirurl, "error", $auth_list['reply_message']); + if (!empty($auth_list['url_redirection'])) + header("Location: {$auth_list['url_redirection']}"); + else + portal_reply_page($redirurl, "error", $auth_list['reply_message']); } } else { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"ERROR"); @@ -239,6 +242,9 @@ function portal_mac_radius($clientmac,$clientip) { if ($auth_list['auth_val'] == 2) { return TRUE; } + if (!empty($auth_list['url_redirection'])) + header("Location: {$auth_list['url_redirection']}"); + return FALSE; } From d5c56d72260c089d4044c963eb471cd84359efa2 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 22:58:12 +0000 Subject: [PATCH 075/112] When editing a mac/ip passthru entry readd the rules again since values might have changed. --- usr/local/www/services_captiveportal_ip_edit.php | 11 +++++++---- usr/local/www/services_captiveportal_mac_edit.php | 11 +++++++++++ 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/usr/local/www/services_captiveportal_ip_edit.php b/usr/local/www/services_captiveportal_ip_edit.php index 09d8075725..cf5145b3a7 100755 --- a/usr/local/www/services_captiveportal_ip_edit.php +++ b/usr/local/www/services_captiveportal_ip_edit.php @@ -120,10 +120,13 @@ if ($_POST) { write_config(); if (isset($config['captiveportal']['enable']) && is_module_loaded("ipfw.ko")) { - $rules = captiveportal_allowedip_configure_entry($ip); - file_put_contents("{$g['tmp_path']}/allowedip_tmp", $rules); - mwexec("/sbin/ipfw {$g['tmp_path']}/allowedip_tmp"); - @unlink("{$g['tmp_path']}/allowedip_tmp"); + $rules = ""; + for ($i = 3; $i < 10; $i++) + $rules .= "table {$i} delete {$ip['ip']}\n"; + $rules .= captiveportal_allowedip_configure_entry($ip); + file_put_contents("{$g['tmp_path']}/allowedip_tmp{$id}", $rules); + mwexec("/sbin/ipfw -q {$g['tmp_path']}/allowedip_tmp{$id}"); + @unlink("{$g['tmp_path']}/allowedip_tmp{$id}"); } header("Location: services_captiveportal_ip.php"); diff --git a/usr/local/www/services_captiveportal_mac_edit.php b/usr/local/www/services_captiveportal_mac_edit.php index ac7b341982..0d46ec43d9 100755 --- a/usr/local/www/services_captiveportal_mac_edit.php +++ b/usr/local/www/services_captiveportal_mac_edit.php @@ -120,6 +120,17 @@ if ($_POST) { write_config(); + $ruleno = captiveportal_get_ipfw_passthru_ruleno($mac['mac']); + if ($ruleno) { + captiveportal_free_ipfw_ruleno($ruleno); + $rules = "delete {$ruleno}\n"; + $rules .= "delete " . ++$ruleno . "\n"; + $rules .= captiveportal_passthrumac_configure_entry($mac); + file_put_contents("{$g['tmp_path']}/tmpmacedit{$id}", $rules); + mwexec("/sbin/ipfw -q {$g['tmp_path']}/tmpmacedit{$id}"); + @unlink("{$g['tmp_path']}/tmpmacedit{$id}"); + } + header("Location: services_captiveportal_mac.php"); exit; } From f49c1b00d3c78270c722ea5cdf64109969581764 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 23:01:11 +0000 Subject: [PATCH 076/112] Actually use the previous configured mac/ip, if present, for finding rules to be deleted. --- usr/local/www/services_captiveportal_ip_edit.php | 9 ++++++--- usr/local/www/services_captiveportal_mac_edit.php | 9 ++++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/usr/local/www/services_captiveportal_ip_edit.php b/usr/local/www/services_captiveportal_ip_edit.php index cf5145b3a7..57e8476deb 100755 --- a/usr/local/www/services_captiveportal_ip_edit.php +++ b/usr/local/www/services_captiveportal_ip_edit.php @@ -111,10 +111,13 @@ if ($_POST) { $ip['bw_up'] = $_POST['bw_up']; if ($_POST['bw_down']) $ip['bw_down'] = $_POST['bw_down']; - if (isset($id) && $a_allowedips[$id]) + if (isset($id) && $a_allowedips[$id]) { + $oldip = $a_allowedips[$id]['ip']; $a_allowedips[$id] = $ip; - else + } else { + $oldip = $ip['ip']; $a_allowedips[] = $ip; + } allowedips_sort(); write_config(); @@ -122,7 +125,7 @@ if ($_POST) { if (isset($config['captiveportal']['enable']) && is_module_loaded("ipfw.ko")) { $rules = ""; for ($i = 3; $i < 10; $i++) - $rules .= "table {$i} delete {$ip['ip']}\n"; + $rules .= "table {$i} delete {$oldip}\n"; $rules .= captiveportal_allowedip_configure_entry($ip); file_put_contents("{$g['tmp_path']}/allowedip_tmp{$id}", $rules); mwexec("/sbin/ipfw -q {$g['tmp_path']}/allowedip_tmp{$id}"); diff --git a/usr/local/www/services_captiveportal_mac_edit.php b/usr/local/www/services_captiveportal_mac_edit.php index 0d46ec43d9..bc397b7e6e 100755 --- a/usr/local/www/services_captiveportal_mac_edit.php +++ b/usr/local/www/services_captiveportal_mac_edit.php @@ -112,15 +112,18 @@ if ($_POST) { $mac['descr'] = $_POST['descr']; - if (isset($id) && $a_passthrumacs[$id]) + if (isset($id) && $a_passthrumacs[$id]) { + $oldmac = $a_passthrumacs[$id]['mac']; $a_passthrumacs[$id] = $mac; - else + } else { + $oldmac = $mac['mac']; $a_passthrumacs[] = $mac; + } passthrumacs_sort(); write_config(); - $ruleno = captiveportal_get_ipfw_passthru_ruleno($mac['mac']); + $ruleno = captiveportal_get_ipfw_passthru_ruleno($oldmac); if ($ruleno) { captiveportal_free_ipfw_ruleno($ruleno); $rules = "delete {$ruleno}\n"; From 814992f747e5a7b78882ff73c9d40d695475b580 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 23:43:04 +0000 Subject: [PATCH 077/112] Use url_redirection even on successful login case if present. Add a redir functionality to portal_reply_page to keep the code centralized. --- usr/local/captiveportal/index.php | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 5735a2119a..03bd01a3fd 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -154,17 +154,19 @@ exit; if ($_POST['auth_user'] && $_POST['auth_pass']) { $auth_list = radius($_POST['auth_user'],$_POST['auth_pass'],$clientip,$clientmac,"USER LOGIN"); + $type = "error"; + if (!empty($auth_list['url_redirection'])) { + $redirurl = $auth_list['url_redirection']; + $type = "redir"; + } if ($auth_list['auth_val'] == 1) { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"ERROR",$auth_list['error']); - portal_reply_page($redirurl, "error", $auth_list['error']); + portal_reply_page($redirurl, $type, $auth_list['error']); } else if ($auth_list['auth_val'] == 3) { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"FAILURE",$auth_list['reply_message']); - if (!empty($auth_list['url_redirection'])) - header("Location: {$auth_list['url_redirection']}"); - else - portal_reply_page($redirurl, "error", $auth_list['reply_message']); + portal_reply_page($redirurl, $type, $auth_list['reply_message']); } } else { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"ERROR"); @@ -196,7 +198,10 @@ function portal_reply_page($redirurl, $type = null, $message = null, $clientmac global $g, $config; /* Get captive portal layout */ - if ($type == "login") + if ($type = "redir") { + header("Location: {$redirurl}"); + return; + } else if ($type == "login") $htmltext = get_include_contents("{$g['varetc_path']}/captiveportal.html"); else $htmltext = get_include_contents("{$g['varetc_path']}/captiveportal-error.html"); @@ -239,11 +244,10 @@ function portal_mac_radius($clientmac,$clientip) { /* authentication against the radius server */ $username = mac_format($clientmac); $auth_list = radius($username,$radmac_secret,$clientip,$clientmac,"MACHINE LOGIN"); - if ($auth_list['auth_val'] == 2) { + if ($auth_list['auth_val'] == 2) return TRUE; - } if (!empty($auth_list['url_redirection'])) - header("Location: {$auth_list['url_redirection']}"); + portal_reply_page($auth_list['url_redirection'], "redir"); return FALSE; } From cffe41cb24961fc08fccc438672a8424b751abd2 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 25 May 2010 15:22:52 +0000 Subject: [PATCH 078/112] Do not run netstat but use pfSense_get_interface_stats to gather interface statistics. This speedups a lot on nanobsd which needed some time to generate the statistics especially with dashboard --- etc/inc/pfsense-utils.inc | 73 +++++++++++---------------------------- 1 file changed, 21 insertions(+), 52 deletions(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index c30a818318..efacbe8447 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1185,49 +1185,30 @@ function get_ppp_uptime($port){ //returns interface information function get_interface_info($ifdescr) { - global $config, $linkinfo, $netstatrninfo, $g; + global $config, $g; $ifinfo = array(); - /* if list */ - $iflist = get_configured_interface_with_descr(false,true); - - $found = false; - foreach ($iflist as $if => $ifname) { - if ($ifdescr == $if || $ifdescr == $ifname) { - $ifinfo['hwif'] = $config['interfaces'][$if]['if']; - $ifinfo['if'] = get_real_interface($if); - $found = true; - break; - } - } - if ($found == false) + if (empty($config['interfaces'][$ifdescr])) return; + $ifinfo['hwif'] = $config['interfaces'][$if]['if']; + $ifinfo['if'] = get_real_interface($ifdescr); - /* run netstat to determine link info */ - - unset($linkinfo); $chkif = $ifinfo['if']; - - exec("/usr/bin/netstat -I {$chkif} -nWb -f link", $linkinfo); - $linkinfo = preg_split("/\s+/", $linkinfo[1]); - $ifinfotmp = pfSense_get_interface_addresses($chkif); $ifinfo['status'] = $ifinfotmp['status']; + if (empty($ifinfo['status'])) + $ifinfo['status'] = "down"; $ifinfo['macaddr'] = $ifinfotmp['macaddr']; $ifinfo['ipaddr'] = $ifinfotmp['ipaddr']; $ifinfo['subnet'] = $ifinfotmp['subnet']; if (isset($ifinfotmp['link0'])) $link0 = "down"; - - - if (preg_match("/^enc|^tun|^ppp|^pptp|^ovpn/i", $chkif)) { - $ifinfo['inpkts'] = $linkinfo[3]; - $ifinfo['outpkts'] = $linkinfo[6]; - } else { - $ifinfo['inerrs'] = $linkinfo[5]; - $ifinfo['outerrs'] = $linkinfo[9]; - $ifinfo['collisions'] = $linkinfo[11]; - } + $ifinfotmp = pfSense_get_interface_stats($chkif); + $ifinfo['inpkts'] = $ifinfotmp['inpkts']; + $ifinfo['outpkts'] = $ifinfotmp['outpkts']; + $ifinfo['inerrs'] = $ifinfotmp['inerrs']; + $ifinfo['outerrs'] = $ifinfotmp['outerrs']; + $ifinfo['collisions'] = $ifinfotmp['collisions']; /* Use pfctl for non wrapping 64 bit counters */ /* Pass */ @@ -1262,10 +1243,6 @@ function get_interface_info($ifdescr) { $ifconfiginfo = ""; - unset($linkinfo); - exec("/usr/bin/netstat -I " . $ifinfo['if'] . " -nWb -f link", $linkinfo); - $linkinfo = preg_split("/\s+/", $linkinfo[1]); - switch ($config['interfaces'][$ifdescr]['ipaddr']) { /* DHCP? -> see if dhclient is up */ case "dhcp": @@ -1279,35 +1256,27 @@ function get_interface_info($ifdescr) { break; /* PPPoE interface? -> get status from virtual interface */ case "pppoe": - if ("{$ifinfo['if']}*" == $linkinfo[0]) - $ifinfo['pppoelink'] = "down"; - else if ($ifinfo['if'] == $linkinfo[0] && !isset($link0)) - /* get PPPoE link status for dial on demand */ - $ifinfo['pppoelink'] = "up"; + if ($ifinfo['status'] == "up" && !isset($link0)) + /* get PPPoE link status for dial on demand */ + $ifinfo['pppoelink'] = "up"; else $ifinfo['pppoelink'] = "down"; break; /* PPTP interface? -> get status from virtual interface */ case "pptp": - if ("{$ifinfo['if']}*" == $linkinfo[0]) - $ifinfo['pptplink'] = "down"; - else if ($ifinfo['if'] == $linkinfo[0] && !isset($link0)) - /* get PPTP link status for dial on demand */ - $ifinfo['pptplink'] = "up"; + if ($ifinfo['status'] == "up" && !isset($link0)) + /* get PPTP link status for dial on demand */ + $ifinfo['pptplink'] = "up"; else $ifinfo['pptplink'] = "down"; break; /* PPP interface? -> get uptime for this session and cumulative uptime from the persistant log file in conf */ case "ppp": - if ("{$ifinfo['if']}*" == $linkinfo[0]) - $ifinfo['ppplink'] = "down"; - else if ($ifinfo['if'] == $linkinfo[0]) - $ifinfo['ppplink'] = "up"; + if ($ifinfo['status'] == "up") + $ifinfo['ppplink'] = "up"; else $ifinfo['ppplink'] = "down" ; - if (empty($ifinfo['status'])) - $ifinfo['status'] = "down"; $dev = $config['interfaces'][$if]['if']; if (empty($dev)) @@ -2053,4 +2022,4 @@ function get_include_contents($filename) { return false; } -?> \ No newline at end of file +?> From f2033fc7bb9da736c7b35a060930a61314db40ba Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 25 May 2010 16:19:38 +0000 Subject: [PATCH 079/112] Ticket #444. Use noatime even here. --- etc/inc/config.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/config.inc b/etc/inc/config.inc index 5ec98bee42..aa5fb692c7 100644 --- a/etc/inc/config.inc +++ b/etc/inc/config.inc @@ -184,7 +184,7 @@ else if ($g['booting'] and !file_exists($g['cf_conf_path'] . "/config.xml") ) { /* write out an fstab */ $fd = fopen("{$g['etc_path']}/fstab", "w"); - $fstab = "/dev/{$cfgpartition} {$g['cf_path']} {$cfgfstype} ro 1 1\n"; + $fstab = "/dev/{$cfgpartition} {$g['cf_path']} {$cfgfstype} ro,noatime 1 1\n"; $fstab .= "proc /proc procfs rw 0 0\n"; fwrite($fd, $fstab); From 9b1a8d98f600fadffea6a5865d135151a8e48e9c Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 25 May 2010 16:22:36 +0000 Subject: [PATCH 080/112] Ticket #444. Use noatime even here. --- etc/inc/pfsense-utils.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index efacbe8447..1015023acb 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1965,8 +1965,8 @@ function nanobsd_update_fstab($gslice, $complete_path, $oldufs, $newufs) { if (!file_exists($fstabpath)) { $fstab = << Date: Tue, 25 May 2010 11:14:57 -0400 Subject: [PATCH 081/112] Backup all of /conf including subdirectories during upgrade instead of just files in /conf/ --- etc/rc.firmware | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/etc/rc.firmware b/etc/rc.firmware index 1a01e4b11e..1568d2322e 100755 --- a/etc/rc.firmware +++ b/etc/rc.firmware @@ -157,7 +157,7 @@ pfSenseNanoBSDupgrade) # backup config /bin/mkdir -p /tmp/configbak - cp -p /conf/* /tmp/configbak 2>/dev/null + cp -Rp /conf/* /tmp/configbak 2>/dev/null echo "" >> /conf/upgrade_log.txt @@ -272,7 +272,7 @@ pfSenseNanoBSDupgrade) /sbin/tunefs -L ${GLABEL_SLICE} /dev/${COMPLETE_PATH} >> /conf/upgrade_log.txt 2>&1 # restore config - cp -p /tmp/configbak/* /conf 2>/dev/null + cp -Rp /tmp/configbak/* /conf 2>/dev/null # Remove upgrade file rm -f $IMG @@ -400,7 +400,7 @@ pfSenseupgrade) # backup config /bin/mkdir -p /tmp/configbak - cp -p /conf/* /tmp/configbak 2>/dev/null + cp -Rp /conf/* /tmp/configbak 2>/dev/null # tar explode image onto hd echo "Installing $IMG." >> /conf/upgrade_log.txt 2>&1 @@ -421,7 +421,7 @@ pfSenseupgrade) fi # restore config - cp -p /tmp/configbak/* /conf 2>/dev/null + cp -Rp /tmp/configbak/* /conf 2>/dev/null # restore /etc symlinks rm /etc/hosts From 78d7e759b6d67ee5fe3f91dde215ee9680346adb Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 25 May 2010 11:17:14 -0400 Subject: [PATCH 082/112] Standardize upgrade log filenames --- etc/rc.firmware | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/rc.firmware b/etc/rc.firmware index 1568d2322e..dbad338df6 100755 --- a/etc/rc.firmware +++ b/etc/rc.firmware @@ -11,10 +11,10 @@ # Reset file(s) echo "" >/conf/upgrade_log.txt -echo "" >/conf/firmware_update_misc.log +echo "" >/conf/firmware_update_misc_log.txt echo "" >/conf/fdisk_upgrade_log.txt -exec 3>&2 2>>/conf/firmware_update_misc.log +exec 3>&2 2>>/conf/firmware_update_misc_log.txt export ACTION=$1 export IMG=$2 From 2cd8563160aae75f624b0dfa3f9360480d19f555 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 25 May 2010 11:20:03 -0400 Subject: [PATCH 083/112] Remove logs from temp config backup so they aren't clobbered when restored. --- etc/rc.firmware | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/etc/rc.firmware b/etc/rc.firmware index dbad338df6..f752335b29 100755 --- a/etc/rc.firmware +++ b/etc/rc.firmware @@ -159,6 +159,9 @@ pfSenseNanoBSDupgrade) /bin/mkdir -p /tmp/configbak cp -Rp /conf/* /tmp/configbak 2>/dev/null + # Remove logs from backup dir to avoid clobbering upon restore. + rm /tmp/configbak/*_log.txt 2>/dev/null + echo "" >> /conf/upgrade_log.txt echo "Installing ${IMG}." >> /conf/upgrade_log.txt 2>&1 @@ -402,6 +405,9 @@ pfSenseupgrade) /bin/mkdir -p /tmp/configbak cp -Rp /conf/* /tmp/configbak 2>/dev/null + # Remove logs from backup dir to avoid clobbering upon restore. + rm /tmp/configbak/*_log.txt 2>/dev/null + # tar explode image onto hd echo "Installing $IMG." >> /conf/upgrade_log.txt 2>&1 cd / && /usr/bin/tar xzUPf $IMG >> /conf/upgrade_log.txt 2>&1 From b99544e86cb9e67df600c97d41d2b7c702454ad9 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 25 May 2010 13:39:16 -0400 Subject: [PATCH 084/112] Fix caps/grammar. --- etc/inc/dyndns.class | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/dyndns.class b/etc/inc/dyndns.class index bf442fb0ad..2e90386ce8 100644 --- a/etc/inc/dyndns.class +++ b/etc/inc/dyndns.class @@ -763,7 +763,7 @@ $error = 'phpDynDNS: (ERROR!) No Update URL Provided.'; break; case 10: - $error = 'phpDynDNS: No Change In My IP Address and/or 25 Days Has Not Past. Not Updating Dynamic DNS Entry.'; + $error = 'phpDynDNS: No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.'; break; default: $error = "phpDynDNS: (ERROR!) Unknown Response."; From 1cf76394eed899cdcd47cb9008ace6bed2353641 Mon Sep 17 00:00:00 2001 From: Erik Fonnesbeck Date: Tue, 25 May 2010 12:52:59 -0600 Subject: [PATCH 085/112] pfSense_get_interface_stats no longer gives the up/down status of the interface, so use pfSense_get_interface_addresses instead. --- etc/inc/interfaces.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 19af755c13..ade937ee31 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1827,7 +1827,7 @@ EOD; /* find which clones are up and bring them down */ $clones_up = array(); foreach ($clone_list as $clone_if) { - $clone_status = pfSense_get_interface_stats($clone_if); + $clone_status = pfSense_get_interface_addresses($clone_if); if ($clone_status['status'] == 'up') { $clones_up[] = $clone_if; mwexec("{$ifconfig} " . escapeshellarg($clone_if) . " down"); From 89e52df87f770ce191fa78e307afde080d6c22e4 Mon Sep 17 00:00:00 2001 From: Erik Fonnesbeck Date: Tue, 25 May 2010 13:03:35 -0600 Subject: [PATCH 086/112] Add a default setting to location type of wireless that leaves the setting at its default for the interface. --- usr/local/www/interfaces.php | 1 + 1 file changed, 1 insertion(+) diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php index 4667801bdd..f5cdf44c36 100755 --- a/usr/local/www/interfaces.php +++ b/usr/local/www/interfaces.php @@ -1400,6 +1400,7 @@ $types = array("none" => "None", "static" => "Static", "dhcp" => "DHCP", "pppoe"

Location
 - + From 505371be38a6ea75d4c5f5fc37918dcfa4051bfa Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 26 May 2010 14:15:38 -0300 Subject: [PATCH 093/112] Few cosmetic adjustments on classes to fix table borders --- usr/local/www/diag_routes.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/usr/local/www/diag_routes.php b/usr/local/www/diag_routes.php index c62aadbf07..1b136ab4c4 100644 --- a/usr/local/www/diag_routes.php +++ b/usr/local/www/diag_routes.php @@ -57,15 +57,16 @@ include('head.inc'); - -\n"); $j = 0; foreach (explode(' ', $line) as $entry) { if ($entry == '') continue; + if ($i == 1 && $j == $elements - 1) + $class = 'listhdr'; print("\n"); + if ($i > 1) + $class = 'listr'; $j++; } // The 'Expire' field might be blank From a2fb9e4842412fb5405bcca89b280c3ac0f65e31 Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 26 May 2010 15:14:05 -0400 Subject: [PATCH 094/112] Default to NOT backup RRD data. It can get quite large, and should be chosen deliberately by the user. --- usr/local/www/diag_backup.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/diag_backup.php b/usr/local/www/diag_backup.php index 243008dd70..417624d689 100755 --- a/usr/local/www/diag_backup.php +++ b/usr/local/www/diag_backup.php @@ -565,7 +565,7 @@ function backuparea_change(obj) { Enable Pass-through MAC automatic additions
If this option is set, a MAC passthrough entry is automatically added after the user has successfully authenticated. Users of that MAC address will never have to authenticate again. To remove the passthrough MAC entry you either have to log in and remove it manually from the Pass-through MAC tab or send a POST from another system to remove it. - If this is enabled, RADIUS MAC authentication cannot be used. Also, the logout window will not be shown. + If this is enabled, RADIUS MAC authentication cannot be used. Also, the logout window will not be shown. +

+ > + Enable Pass-through MAC automatic addition with username
+ If this option is set, with the automatically MAC passthrough entry created the username, used during authentication, will be saved. + To remove the passthrough MAC entry you either have to log in and remove it manually from the Pass-through MAC tab or send a POST from another system to remove it. + From 1b02631155b3b8aa4e01b929518179d03aa96299 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 19:28:09 +0000 Subject: [PATCH 101/112] Remove part of the message displayed some people might find its completely ok to use it. --- etc/inc/captiveportal.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 7c51201caa..d08b8fc6cb 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -155,7 +155,7 @@ function captiveportal_configure() {

{$g['product_name']} captive portal

-Welcome to the {$g['product_name']} Captive Portal! This is the default page since a custom page has not been defined. +Welcome to the {$g['product_name']} Captive Portal!

From ddd1fb7f19f6496cb772db67e722720972ce8d5b Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 27 May 2010 17:08:06 -0400 Subject: [PATCH 102/112] Add IPsec PSK field to User Manager. No backend code to use this value yet. --- usr/local/www/system_usermanager.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php index 1224f6a509..c3da004846 100644 --- a/usr/local/www/system_usermanager.php +++ b/usr/local/www/system_usermanager.php @@ -158,6 +158,7 @@ if (isAllowedPage("system_usermanager")) { $pconfig['uid'] = $a_user[$id]['uid']; $pconfig['authorizedkeys'] = base64_decode($a_user[$id]['authorizedkeys']); $pconfig['priv'] = $a_user[$id]['priv']; + $pconfig['ipsecpsk'] = $a_user[$id]['ipsecpsk']; $pconfig['disabled'] = isset($a_user[$id]['disabled']); } } @@ -270,6 +271,7 @@ if (isAllowedPage("system_usermanager")) { $userent['fullname'] = $_POST['fullname']; $userent['expires'] = $_POST['expires']; $userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']); + $userent['ipsecpsk'] = $_POST['ipsecpsk']; if($_POST['disabled']) $userent['disabled'] = true; @@ -728,6 +730,12 @@ function sshkeyClicked(obj) {

+ + + +
- + $ifname) { - $oc = $config['interfaces'][$ifent]; - if ((is_array($config['dhcpd'][$ifent]) && !isset($config['dhcpd'][$ifent]['enable']) && (!is_ipaddr($oc['ipaddr']))) || + $oc = $config['interfaces'][$ifent]; + if ((is_array($config['dhcpd'][$ifent]) && !isset($config['dhcpd'][$ifent]['enable']) && (!is_ipaddr($oc['ipaddr']))) || (!is_array($config['dhcpd'][$ifent]) && (!is_ipaddr($oc['ipaddr'])))) continue; if ($ifent == $if) @@ -500,189 +500,181 @@ include("head.inc"); exit; } display_top_tabs($tab_array); - ?> -
+?> +
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +
  - onClick="enable_change(false)"> - Enable DHCP server on - - interface
  - > - Deny unknown clients
- If this is checked, only the clients defined below will get DHCP leases from this server.
Subnet - -
Subnet mask - -
Available range - - - - -
Subnet Mask - -
Range - -  to  -
WINS servers -
- -
DNS servers -
-
- NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS forwarder is enabled, otherwise the servers configured on the General page. -
Gateway -
- The default is to use the IP on this interface of the firewall as the gateway. Specify an alternate gateway here if this is not the correct gateway for your network. -
Domain name -
- The default is to use the domain name of this system as the default domain name provided by DHCP. You may specify an alternate domain name here. -
Domain search list -
- The DHCP server can optionally provide a domain search list. -
Default lease time - - seconds
- This is used for clients that do not ask for a specific - expiration time.
- The default is 7200 seconds. -
Maximum lease time - - seconds
- This is the maximum lease time for clients that ask - for a specific expiration time.
- The default is 86400 seconds. -
Failover peer IP: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - - + + + - - + - - + + + + + - - - - - - + - - - - + + +
  + onClick="enable_change(false)"> + Enable DHCP server on + + interface
  + > + Deny unknown clients
+ If this is checked, only the clients defined below will get DHCP leases from this server.
Subnet + +
Subnet mask + +
Available range + + - + +
Subnet Mask + +
Range + +  to  +
WINS servers +
+ +
DNS servers +
+
+ NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS forwarder is enabled, otherwise the servers configured on the General page. +
Gateway +
+ The default is to use the IP on this interface of the firewall as the gateway. Specify an alternate gateway here if this is not the correct gateway for your network. +
Domain name +
+ The default is to use the domain name of this system as the default domain name provided by DHCP. You may specify an alternate domain name here. +
Domain search list +
+ The DHCP server can optionally provide a domain search list. +
Default lease time + + seconds
+ This is used for clients that do not ask for a specific + expiration time.
+ The default is 7200 seconds. +
Maximum lease time + + seconds
+ This is the maximum lease time for clients that ask + for a specific expiration time.
+ The default is 86400 seconds. +
Failover peer IP:
Leave blank to disable. Enter the interface IP address of the other machine. Machines must be using CARP.
- Static ARP - - - - - - - - - - -
- >  - - Enable Static ARP entries -
-   - - Note: Only the machines listed below will be able to communicate with the firewall on this NIC. -
- 		Static ARP + + + + + + + + + +
+ >  + Enable Static ARP entries
  + Note: Only the machines listed below will be able to communicate with the firewall on this NIC. +
+
- Dynamic DNS - -
- - Show Dynamic DNS -
- -
Dynamic DNS +
+ - Show Dynamic DNS +
+ +
NTP servers + NTP servers
- Show NTP configuration
@@ -693,102 +685,96 @@ include("head.inc");
- TFTP server - -
- - Show TFTP configuration +
TFTP server +
+ - Show TFTP configuration +
+ +
LDAP URI +
+ - Show LDAP configuration
-
LDAP URI -
- - Show LDAP configuration -
- -
Enable network booting -
- - Show Network booting -
- + 		Enable network booting +
+ - Show Network booting +
+
- Additional BOOTP/DHCP Options - -
- - Show Additional BOOTP/DHCP Options +
Additional BOOTP/DHCP Options +
+ - Show Additional BOOTP/DHCP Options +
+
-
"; +} + +function begin_quick_easy_install() { + unlink_if_exists("/tmp/install_complete"); + $disk = installer_find_first_disk(); + if(!$disk) { + // XXX: hide progress bar + $savemsg = "Could not find a suitable disk for installation"; + update_installer_status_win("Could not find a suitable disk for installation."); + return; + } + write_out_pc_sysinstaller_config($disk); + update_installer_status_win("Beginning installation on disk {$disk}."); + start_installation(); +} + +if($_REQUEST['state'] == "update_installer_status") { + update_installer_status(); + exit; +} + +if($_REQUEST['step1_post']) { + +} + +if($_REQUEST['step2_post']) { + +} + +if($_REQUEST['step3_post']) { + +} + +if($_REQUEST['step4_post']) { + +} + +$pfSversion = str_replace("\n", "", file_get_contents("/etc/version")); +if(strstr($pfSversion, "1.2")) + $one_two = true; + +$pgtitle = "pfSense: Installer"; +include("head.inc"); + +?> + + + + + + +

+ + + + + + + + + +
+
+ + + + +
+
+
+ + +
+
+
+
+
+EOF; + +} + +function quickeasyinstall_gui() { + echo << + + + + +
+
+ + + + +
+ +
+ Starting Installer... Please wait...

+ {{ Insert progressbar here }}

+ +

+
+
+
+ + +EOF; + +} + + +function installer_main() { +echo << + + + + +
+
+ + + + +
+ + +
+
+
+ +EOF; + +} + +?> + + + + + + + From f37caa93fe3382766f21e3c038e771664f9fbb1e Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 16:56:58 +0000 Subject: [PATCH 065/112] Add to the System->Advanced an option to disable the redirect from port 80 when on https. --- usr/local/www/system_advanced_admin.php | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/usr/local/www/system_advanced_admin.php b/usr/local/www/system_advanced_admin.php index 2dd53cb1df..8a6eae0687 100644 --- a/usr/local/www/system_advanced_admin.php +++ b/usr/local/www/system_advanced_admin.php @@ -52,6 +52,7 @@ require_once("shaper.inc"); $pconfig['webguiproto'] = $config['system']['webgui']['protocol']; $pconfig['webguiport'] = $config['system']['webgui']['port']; $pconfig['ssl-certref'] = $config['system']['webgui']['ssl-certref']; +$pconfig['disablehttpredirect'] = isset($config['system']['disablehttpredirect']); $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']); $pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']); $pconfig['enableserial'] = $config['system']['enableserial']; @@ -99,6 +100,14 @@ if ($_POST) { if (update_if_changed("webgui certificate", $config['system']['webgui']['ssl-certref'], $_POST['ssl-certref'])) $restart_webgui = true; + if ($_POST['disablehttpredirect'] == "yes") { + $config['system']['disablehttpredirect'] = true; + $restart_webgui = true; + } else { + unset($config['system']['disablehttpredirect']); + $restart_webgui = true; + } + if($_POST['disableconsolemenu'] == "yes") { $config['system']['disableconsolemenu'] = true; auto_login(); @@ -273,6 +282,18 @@ function prot_change() {
+ /> + +
+ +
From 0914b6bbe52483115638d0240e74112cac8cec96 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 17:49:12 +0000 Subject: [PATCH 066/112] Use mwexec where it does not make sense to use popen for something that does not take any parameters. Create a function to actually remove a user from its groups when the user itself is deleted. --- etc/inc/auth.inc | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 826582fbda..2e580b11bb 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -340,10 +340,10 @@ function local_user_del($user) { if($debug) log_error("Running: {$cmd}"); - $fd = popen($cmd, "w"); - fwrite($fd, $user['password']); - pclose($fd); + mwexec($cmd); + /* Delete user from groups needs a call to write_config() */ + local_group_del_user($user); } function local_user_set_password(& $user, $password) { @@ -421,6 +421,22 @@ function local_user_set_groups($user, $new_groups = NULL ) { local_group_set($group); } +function local_group_del_user($user) { + global $config; + + if (!is_array($config['system']['group'])) + return; + + foreach ($config['system']['group'] as $group) { + if (is_array($group['member'])) { + foreach ($group['member'] as $idx => $uid) { + if ($user['uid'] == $uid) + unset($config['system']['group']['member'][$idx]); + } + } + } +} + function local_group_set($group, $reset = false) { global $debug; @@ -446,9 +462,7 @@ function local_group_set($group, $reset = false) { if($debug) log_error("Running: {$cmd}"); - $fd = popen($cmd, "w"); - fwrite($fd, $user['password']); - pclose($fd); + mwexec($cmd); } @@ -460,10 +474,7 @@ function local_group_del($group) { if($debug) log_error("Running: {$cmd}"); - $fd = popen($cmd, "w"); - fwrite($fd, $user['password']); - pclose($fd); - + mwexec($cmd); } function ldap_test_connection($authcfg) { From 70d6b5c49167c6f35f421c11dccdf8b951bf209f Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 May 2010 18:10:50 +0000 Subject: [PATCH 067/112] Ticket #612. Correctly show the number of users as 0 on a group with no users. Also handle the case of empty arrays on the xmlparser. --- etc/inc/xmlparse.inc | 22 +++++++++++++--------- usr/local/www/system_groupmanager.php | 4 +++- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/etc/inc/xmlparse.inc b/etc/inc/xmlparse.inc index c19a3ae612..59b0eb4571 100644 --- a/etc/inc/xmlparse.inc +++ b/etc/inc/xmlparse.inc @@ -246,27 +246,31 @@ function dump_xml_config_sub($arr, $indent) { if (in_array(strtolower($ent), $listtags)) { foreach ($val as $cval) { if (is_array($cval)) { - $xmlconfig .= str_repeat("\t", $indent); - $xmlconfig .= "<$ent>\n"; - $xmlconfig .= dump_xml_config_sub($cval, $indent + 1); - $xmlconfig .= str_repeat("\t", $indent); - $xmlconfig .= "\n"; + if (empty($cval)) { + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent/>\n"; + } else { + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent>\n"; + $xmlconfig .= dump_xml_config_sub($cval, $indent + 1); + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "\n"; + } } else { - $xmlconfig .= str_repeat("\t", $indent); if($cval === false) continue; - if(($cval === true) || ($cval === "")) { + $xmlconfig .= str_repeat("\t", $indent); + if((is_bool($cval) && $cval == true) || ($cval === "")) { $xmlconfig .= "<$ent/>\n"; } else if (substr($ent, 0, 5) == "descr") { $xmlconfig .= "<$ent>\n"; } else { $xmlconfig .= "<$ent>" . htmlentities($cval) . "\n"; + } } } - } } else if (empty($val)) { $xmlconfig .= str_repeat("\t", $indent); $xmlconfig .= "<$ent/>\n"; - $xmlconfig .= str_repeat("\t", $indent); } else { /* it's an array */ $xmlconfig .= str_repeat("\t", $indent); diff --git a/usr/local/www/system_groupmanager.php b/usr/local/www/system_groupmanager.php index 579a7353d1..9c37c99ca8 100644 --- a/usr/local/www/system_groupmanager.php +++ b/usr/local/www/system_groupmanager.php @@ -137,7 +137,9 @@ if ($_POST) { $group['name'] = $_POST['groupname']; $group['description'] = $_POST['description']; - if ($group['gid'] != 1998) // all group + if (empty($_POST['members'])) + unset($group['member']); + else if ($group['gid'] != 1998) // all group $group['member'] = $_POST['members']; if (isset($id) && $a_group[$id]) From cd12fce3a6ea6dab37d35fa78c5faded0f704b9c Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 24 May 2010 12:38:02 -0400 Subject: [PATCH 068/112] Let these files stay since they were brought back (for now). --- etc/pfSense.obsoletedfiles | 2 -- 1 file changed, 2 deletions(-) diff --git a/etc/pfSense.obsoletedfiles b/etc/pfSense.obsoletedfiles index b1be7b0ae1..1e1b1194f2 100644 --- a/etc/pfSense.obsoletedfiles +++ b/etc/pfSense.obsoletedfiles @@ -26,8 +26,6 @@ /usr/local/www/vpn_ipsec_ca_edit.php /usr/local/www/vpn_ipsec_ca_edit_create_cert.php /usr/local/www/vpn_ipsec_edit.php -/usr/local/www/vpn_ipsec_keys.php -/usr/local/www/vpn_ipsec_keys_edit.php /usr/local/www/vpn_openvpn.php /usr/local/www/vpn_openvpn_ccd.php /usr/local/www/vpn_openvpn_ccd_edit.php From 08a5d2eb844f98e3ff1fa59dc28a7f9134b08306 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 24 May 2010 13:26:02 -0400 Subject: [PATCH 069/112] Properly generate a list of proxy arp VIPs for address drop-down list. --- usr/local/www/firewall_nat_edit.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php index d7806b1a1c..719e32f454 100755 --- a/usr/local/www/firewall_nat_edit.php +++ b/usr/local/www/firewall_nat_edit.php @@ -625,13 +625,13 @@ include("fbegin.inc"); ?> - From 042fa85c3bdc51b5b99b2afef24a5077968ef31d Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 24 May 2010 13:30:33 -0400 Subject: [PATCH 070/112] Fix VIP list generation here also. --- usr/local/www/firewall_nat_out_edit.php | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php index e5fb88af5d..df0487f9ba 100755 --- a/usr/local/www/firewall_nat_out_edit.php +++ b/usr/local/www/firewall_nat_out_edit.php @@ -421,14 +421,12 @@ any)
- + diff --git a/usr/local/www/interfaces_gre.php b/usr/local/www/interfaces_gre.php index 5ad7026e21..bcef63adbf 100644 --- a/usr/local/www/interfaces_gre.php +++ b/usr/local/www/interfaces_gre.php @@ -111,7 +111,7 @@ include("head.inc");
- + From d1eea5235e56d311312248e6ec0cb6b3311b6462 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 25 May 2010 22:24:02 +0000 Subject: [PATCH 090/112] On gre/gif case when the interface is saved do a reconfigure of the underlying interface itself. This helps when an interface is enabled/disabled as reported on http://forum.pfsense.org/index.php/topic,25329.0.html. --- etc/inc/interfaces.inc | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index ade937ee31..9ff2c40167 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1952,10 +1952,25 @@ function interface_configure($interface = "wan", $reloadall = false) { mwexec("/sbin/ifconfig " . escapeshellarg($realif) . " " . escapeshellarg($wancfg['ipaddr'] . "/" . $wancfg['subnet'])); + } else if (substr($realif, 0, 3) == "gre") { + if (is_array($config['gres']['gre'])) { + foreach ($config['gres']['gre'] as $gre) + if ($gre['greif'] == $realif) + interface_gre_configure($gre); + } + } else if (substr($realif, 0, 3) == "gif") { + if (is_array($config['gifs']['gif'])) { + foreach ($config['gifs']['gif'] as $gif) + if($gif['gifif'] == $interface) + interface_gif_configure($gif); + } + } else if (substr($realif, 0, 4) == "ovpn") { + /* XXX: Should be done anything?! */ } if (is_ipaddr($wancfg['gateway'])) file_put_contents("{$g['tmp_path']}/{$realif}_router", $wancfg['gateway']); + break; } if(does_interface_exist($wancfg['if'])) From e3a78007667dbaf58a1a7d1c60d449a092ba5e70 Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 25 May 2010 22:58:13 +0000 Subject: [PATCH 091/112] Actually send the wan ip address as calledstationid as advertised on captiveportal configuration page. The same fix was previously done to radius authentication code. --- usr/local/captiveportal/radius_accounting.inc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/usr/local/captiveportal/radius_accounting.inc b/usr/local/captiveportal/radius_accounting.inc index e60a21724d..688af74d5e 100644 --- a/usr/local/captiveportal/radius_accounting.inc +++ b/usr/local/captiveportal/radius_accounting.inc @@ -54,7 +54,7 @@ function RADIUS_ACCOUNTING_START($ruleno, $username, $sessionid, $radiusservers, global $config; $retvalue = array(); - $nas_mac = mac_format(get_interface_mac($config['interfaces']['wan']['if'])); + $nas_mac = mac_format(get_interface_mac("wan")); $clientmac = mac_format($clientmac); $nas_port = $ruleno; $radiusvendor = $config['captiveportal']['radiusvendor'] ? $config['captiveportal']['radiusvendor'] : null; @@ -67,7 +67,7 @@ function RADIUS_ACCOUNTING_START($ruleno, $username, $sessionid, $radiusservers, break; default: - $calledstationid = $nas_mac; + $calledstationid = get_interface_ip("wan"); $callingstationid = $clientmac; } @@ -165,7 +165,7 @@ function RADIUS_ACCOUNTING_STOP($ruleno,$username,$sessionid,$start_time,$radius global $config; $retvalue = array(); - $nas_mac = mac_format(get_interface_mac($config['interfaces']['wan']['if'])); + $nas_mac = mac_format(get_interface_mac("wan")); $clientmac = mac_format($clientmac); $nas_port = $ruleno; $radiusvendor = $config['captiveportal']['radiusvendor'] ? $config['captiveportal']['radiusvendor'] : null; @@ -185,7 +185,7 @@ function RADIUS_ACCOUNTING_STOP($ruleno,$username,$sessionid,$start_time,$radius break; default: - $calledstationid = $nas_mac; + $calledstationid = get_interface_ip("wan"); $callingstationid = $clientmac; } From 59d73709d50803b2115da8e74db496df9945fab0 Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 26 May 2010 11:59:13 -0400 Subject: [PATCH 092/112] Add nanobsd size to system info widget after platform. --- .../www/widgets/widgets/system_information.widget.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/usr/local/www/widgets/widgets/system_information.widget.php b/usr/local/www/widgets/widgets/system_information.widget.php index c9a6b65b5a..b395fc6048 100644 --- a/usr/local/www/widgets/widgets/system_information.widget.php +++ b/usr/local/www/widgets/widgets/system_information.widget.php @@ -90,7 +90,12 @@ $curcfg = $config['system']['firmware'];
Platform + + +
Name resolution + > Enable
Enable this to attempt to resolve names when displaying the tables. +
  +

@@ -94,13 +95,17 @@ include('head.inc'); if ($i == 1) $class = 'listhdrr'; else - $class = 'listr'; + $class = 'listlr'; print("
$entry
- + Do not backup RRD data (NOTE: RRD Data can consume 4+ megabytes of config.xml space!) From 2c9a4ed1b800dfa5ff285d65d05eabef889ec0dc Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 26 May 2010 16:46:37 -0400 Subject: [PATCH 095/112] Compress RRD backup data. Results are dramatic. --- usr/local/www/diag_backup.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/usr/local/www/diag_backup.php b/usr/local/www/diag_backup.php index 417624d689..e2cbacb25a 100755 --- a/usr/local/www/diag_backup.php +++ b/usr/local/www/diag_backup.php @@ -230,7 +230,7 @@ if ($_POST) { if($rrd_data) { $data .= "\t\t\n"; $data .= "\t\t\t{$rrd}\n"; - $data .= "\t\t\t" . base64_encode($rrd_data) . "\n"; + $data .= "\t\t\t" . base64_encode(gzdeflate($rrd_data)) . "\n"; $data .= "\t\t\n"; } } @@ -318,7 +318,16 @@ if ($_POST) { if($config['rrddata']) { foreach($config['rrddata']['rrddatafile'] as $rrd) { $rrd_fd = fopen("{$g['vardb_path']}/rrd/{$rrd['filename']}", "w"); - fwrite($rrd_fd, base64_decode($rrd['data'])); + $data = base64_decode($rrd['data']); + /* Try to decompress the data. */ + $dcomp = @gzinflate($data); + if ($dcomp) { + /* If the decompression worked, write the decompressed data */ + fwrite($rrd_fd, $dcomp); + } else { + /* If the decompression failed, it wasn't compressed, so write raw data */ + fwrite($rrd_fd, $data); + } fclose($rrd_fd); } unset($config['rrddata']); From 4fc68c5aa4f72e930d453266c7bfb166af057b18 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 18:35:06 +0000 Subject: [PATCH 096/112] Do comparions as meant not assignment. Pointy-hat: Myself --- usr/local/captiveportal/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 03bd01a3fd..b019b00cd9 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -198,7 +198,7 @@ function portal_reply_page($redirurl, $type = null, $message = null, $clientmac global $g, $config; /* Get captive portal layout */ - if ($type = "redir") { + if ($type == "redir") { header("Location: {$redirurl}"); return; } else if ($type == "login") From fac13a5eb382ce8773e6897d06d28e06abe07179 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 18:38:41 +0000 Subject: [PATCH 097/112] Add a function to find the mac address on a passthrough mac entry by username(if present) in the tag of the entry. --- etc/inc/captiveportal.inc | 12 ++++++++++++ usr/local/www/services_captiveportal_mac.php | 11 +++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 48f9dba99f..7c51201caa 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -785,6 +785,18 @@ function captiveportal_passthrumac_configure($lock = false) { return $rules; } +function captiveportal_passthrumac_findbyname($username) { + global $config; + + if (is_array($config['captiveportal']['passthrumac'])) { + foreach ($config['captiveportal']['passthrumac'] as $macent) { + if ($macent['username'] == $username) + return $macent; + } + } + return NULL; +} + /* * table (3=IN)/(4=OUT) hold allowed ip's without bw limits * table (5=IN)/(6=OUT) hold allowed ip's with bw limit. diff --git a/usr/local/www/services_captiveportal_mac.php b/usr/local/www/services_captiveportal_mac.php index 7c40b855d4..f7aa502249 100755 --- a/usr/local/www/services_captiveportal_mac.php +++ b/usr/local/www/services_captiveportal_mac.php @@ -64,8 +64,15 @@ if ($_POST) { clear_subsystem_dirty('passthrumac'); } - if ($_POST['delmac'] && $_POST['postafterlogin']) { - if (is_array($a_passthrumacs)) { + if ($_POST['postafterlogin']) { + if (!is_array($a_passthrumacs)) + exit; + if ($_POST['username']) { + $mac = captiveportal_passthrumac_findbyname($_POST['username']); + if (!empty($mac)) + $_POST['delmac'] = $mac['mac']; + } + if ($_POST['delmac']) { $found = false; foreach ($a_passthrumacs as $idx => $macent) { if ($macent['mac'] == $_POST['delmac']) { From 8ca2c9ab3919d4a3314e89b2e4c470a8ddd0421a Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 18:56:03 +0000 Subject: [PATCH 098/112] Remove stale code. --- etc/rc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/etc/rc b/etc/rc index fa18488240..f3dd0e3cb1 100755 --- a/etc/rc +++ b/etc/rc @@ -202,10 +202,6 @@ if [ ! -d /cf/conf/backup/ ]; then mkdir -p /cf/conf/backup/ fi -if [ ! -f /var/db/ez-ipupdate.cache ]; then - touch /var/db/ez-ipupdate.cache -fi - # OpenVPN storage if [ ! -d /var/etc/openvpn ]; then mkdir -p /var/etc/openvpn From 9a31a1cefa6f0437bd5e2ac3bec39e0defc688b7 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 18:59:12 +0000 Subject: [PATCH 099/112] Make sure to cleanup /tmp before using it. Solves config cache issue as a start. --- etc/rc | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/rc b/etc/rc index f3dd0e3cb1..57a5902cfc 100755 --- a/etc/rc +++ b/etc/rc @@ -171,6 +171,7 @@ if [ ! -h /tmp/tmp ]; then fi # Make sure our /tmp is 777 + Sticky +rm -rf /tmp/* chmod 1777 /tmp if [ ! "$PLATFORM" = "cdrom" ] ; then From 1c291e64f1273d2dc9a9d0ef5f714468b4ed49e7 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 19:16:24 +0000 Subject: [PATCH 100/112] Add the username to the auto added mac passthrough entry. Add an option to services->captiveportal page to activate/deactivate the auto-saving of username with the auto added mac passthrough. --- usr/local/captiveportal/index.php | 15 ++++++++++++++- usr/local/www/services_captiveportal.php | 10 +++++++++- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index b019b00cd9..52d177ae8d 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -286,7 +286,18 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut $remaining_time = $attributes['session_timeout']; /* Find an existing session */ - for ($i = 0; $i < count($cpdb); $i++) { + if ((isset($config['captiveportal']['noconcurrentlogins'])) && $passthrumac) { + if (isset($config['captiveportal']['passthrumacadd'])) { + $mac = captiveportal_passthrumac_findbyname($username); + if (!empty($mac)) { + portal_reply_page($redirurl, "error", "Username: {$username} is known with another mac address."); + exit; + } + } + } + + $nousers = count($cpdb); + for ($i = 0; $i < $nousers; $i++) { /* on the same ip */ if($cpdb[$i][2] == $clientip) { captiveportal_logportalauth($cpdb[$i][4],$cpdb[$i][3],$cpdb[$i][2],"CONCURRENT LOGIN - REUSING OLD SESSION"); @@ -342,6 +353,8 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut if ($passthrumac) { $mac = array(); $mac['mac'] = $clientmac; + if (isset($config['captiveportal']['passthrumacaddusername'])) + $mac['username'] = $username; $mac['descr'] = "Auto added pass-through MAC for user {$username}"; if (!empty($bw_up)) $mac['bw_up'] = $bw_up; diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index 6b024d30a1..8d79eb2a5a 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -93,6 +93,7 @@ $pconfig['radiuskey2'] = $config['captiveportal']['radiuskey2']; $pconfig['radiusvendor'] = $config['captiveportal']['radiusvendor']; $pconfig['radiussession_timeout'] = isset($config['captiveportal']['radiussession_timeout']); $pconfig['passthrumacadd'] = isset($config['captiveportal']['passthrumacadd']); +$pconfig['passthrumacaddusername'] = isset($config['captiveportal']['passthrumacaddusername']); $pconfig['radmac_format'] = $config['captiveportal']['radmac_format']; if ($_POST) { @@ -194,6 +195,7 @@ if ($_POST) { $config['captiveportal']['radiusvendor'] = $_POST['radiusvendor'] ? $_POST['radiusvendor'] : false; $config['captiveportal']['radiussession_timeout'] = $_POST['radiussession_timeout'] ? true : false; $config['captiveportal']['passthrumacadd'] = $_POST['passthrumacadd'] ? true : false; + $config['captiveportal']['passthrumacaddusername'] = $_POST['passthrumacaddusername'] ? true : false; $config['captiveportal']['radmac_format'] = $_POST['radmac_format'] ? $_POST['radmac_format'] : false; /* file upload? */ @@ -370,7 +372,13 @@ to access after they've authenticated.
Per-user bandwidth restriction
+ +
  From 4ed2dde76fe84de43d0296ac1926da4898642c5f Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 28 May 2010 14:31:40 -0400 Subject: [PATCH 103/112] Add per-user PSKs to racoon. --- etc/inc/vpn.inc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index c874a83b9e..f38a0ff486 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -291,10 +291,17 @@ function vpn_ipsec_configure($ipchg = false) } } + /* Add user PSKs */ + foreach ($config['system']['user'] as $user) { + if (!empty($user['ipsecpsk'])) { + $pskconf .= "{$user['name']}\t{$user['ipsecpsk']}\n"; + } + } + /* add PSKs for mobile clients */ if (is_array($ipseccfg['mobilekey'])) { foreach ($ipseccfg['mobilekey'] as $key) { - $pskconf .= "{$key['ident']} {$key['pre-shared-key']}\n"; + $pskconf .= "{$key['ident']}\t{$key['pre-shared-key']}\n"; } } From 66a72c9f60adbd38d2054f137b9576335d941f01 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 28 May 2010 16:11:18 -0400 Subject: [PATCH 104/112] Show user keys on PSK list, edit link reroutes to user edit page. --- usr/local/www/vpn_ipsec_keys.php | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/usr/local/www/vpn_ipsec_keys.php b/usr/local/www/vpn_ipsec_keys.php index 59bb57c628..2a232f31fe 100644 --- a/usr/local/www/vpn_ipsec_keys.php +++ b/usr/local/www/vpn_ipsec_keys.php @@ -46,6 +46,18 @@ if (!is_array($config['ipsec']['mobilekey'])) { ipsec_mobilekey_sort(); $a_secret = &$config['ipsec']['mobilekey']; +$userkeys = array(); +foreach ($config['system']['user'] as $id => $user) { + if (isset($user['ipsecpsk'])) { + $k = array(); + $k["ident"] = $user['name']; + $k["pre-shared-key"] = $user['ipsecpsk']; + $k["id"] = $id; + $userkeys[] = $k; + } +} + + if ($_GET['act'] == "del") { if ($a_secret[$_GET['id']]) { unset($a_secret[$_GET['id']]); @@ -98,6 +110,19 @@ if (is_subsystem_dirty('ipsec'))
+ + + + + + + + + +   + + + From 23e95c1a265382d6585328b71b12b040cac7f4e3 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 28 May 2010 16:12:08 -0400 Subject: [PATCH 105/112] Don't let someone add a custom PSK that conflicts with an existing username. While here, style formfields appropriately. --- usr/local/www/vpn_ipsec_keys_edit.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/usr/local/www/vpn_ipsec_keys_edit.php b/usr/local/www/vpn_ipsec_keys_edit.php index 6e0db5b1ef..20ac6c08bf 100644 --- a/usr/local/www/vpn_ipsec_keys_edit.php +++ b/usr/local/www/vpn_ipsec_keys_edit.php @@ -56,6 +56,10 @@ if (isset($id) && $a_secret[$id]) { } if ($_POST) { + $userids = array(); + foreach ($config['system']['user'] as $id => $user) { + $userids[$user['name']] = $id; + } unset($input_errors); $pconfig = $_POST; @@ -68,6 +72,9 @@ if ($_POST) { if (preg_match("/[^a-zA-Z0-9@\.\-]/", $_POST['ident'])) $input_errors[] = "The identifier contains invalid characters."; + + if (array_key_exists($_POST['ident'], $userids)) + $input_errors[] = "A user with this name already exists. Add the key to the user instead."; if (!$input_errors && !(isset($id) && $a_secret[$id])) { /* make sure there are no dupes */ @@ -117,7 +124,7 @@ include("head.inc"); Identifier - +
This can be either an IP address, fully qualified domain name or an e-mail address. @@ -125,7 +132,7 @@ This can be either an IP address, fully qualified domain name or an e-mail addre Pre-shared key - + From 72b9e452966668484e3a9ae15aedbc65df4a3bd0 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 20:15:30 +0000 Subject: [PATCH 106/112] Some configurations want to be able to ask users about replacing their existing mac during auto mac passthrough logins if they change equipment. Allow this in the backend by requiring the user to need posting a replacemacpassthru field with the post. Also add the possibility to send back with a portal_reply_page generated page the username and password posted. --- usr/local/captiveportal/index.php | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 52d177ae8d..204d6fa978 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -194,7 +194,7 @@ exit; exit; -function portal_reply_page($redirurl, $type = null, $message = null, $clientmac = null, $clientip = null) { +function portal_reply_page($redirurl, $type = null, $message = null, $clientmac = null, $clientip = null, $username = null, $password = null) { global $g, $config; /* Get captive portal layout */ @@ -232,6 +232,8 @@ function portal_reply_page($redirurl, $type = null, $message = null, $clientmac $htmltext = str_replace("#PORTAL_MESSAGE#", htmlspecialchars($message), $htmltext); $htmltext = str_replace("#CLIENT_MAC#", htmlspecialchars($clientmac), $htmltext); $htmltext = str_replace("#CLIENT_IP#", htmlspecialchars($clientip), $htmltext); + $htmltext = str_replace("#USERNAME#", htmlspecialchars($username), $htmltext); + $htmltext = str_replace("#PASSWORD#", htmlspecialchars($password), $htmltext); echo $htmltext; } @@ -254,7 +256,7 @@ function portal_mac_radius($clientmac,$clientip) { function portal_allow($clientip,$clientmac,$username,$password = null, $attributes = null, $ruleno = null) { - global $redirurl, $g, $config, $type, $passthrumac; + global $redirurl, $g, $config, $type, $passthrumac, $_POST; /* See if a ruleno is passed, if not start locking the sessions because this means there isn't one atm */ $captiveshouldunlock = false; @@ -285,13 +287,31 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut if ($attributes['voucher']) $remaining_time = $attributes['session_timeout']; + $writecfg = false; /* Find an existing session */ if ((isset($config['captiveportal']['noconcurrentlogins'])) && $passthrumac) { if (isset($config['captiveportal']['passthrumacadd'])) { $mac = captiveportal_passthrumac_findbyname($username); if (!empty($mac)) { - portal_reply_page($redirurl, "error", "Username: {$username} is known with another mac address."); - exit; + if ($_POST['replacemacpassthru']) { + foreach ($a_passthrumacs as $idx => $macent) { + if ($macent['mac'] == $mac['mac']) { + unset($config['captiveportal']['passthrumac'][$idx]); + $mac['mac'] = $clientmac; + $config['captiveportal']['passthrumac'][] = $mac; + $macrules = captiveportal_passthrumac_configure_entry($mac); + file_put_contents("{$g['tmp_path']}/macentry.rules.tmp", $macrules); + mwexec("/sbin/ipfw -q {$g['tmp_path']}/macentry.rules.tmp"); + $writecfg = true; + $sessionid = true; + break; + } + } + } else { + portal_reply_page($redirurl, "error", "Username: {$username} is known with another mac address.", + $clientmac, $clientip, $username, $password); + exit; + } } } } @@ -334,7 +354,6 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut return 0; // voucher already used and no time left } - $writecfg = false; if (!isset($sessionid)) { /* generate unique session ID */ From d462a851d8655e0636c9f1ca3912f3f09efcd223 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 21:01:51 +0000 Subject: [PATCH 107/112] Provide an error message to the call. --- usr/local/captiveportal/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 204d6fa978..59456d7f8f 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -170,7 +170,7 @@ exit; } } else { captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"ERROR"); - portal_reply_page($redirurl, "error"); + portal_reply_page($redirurl, "error", "Invalid username/password specified."); } } else if ($_POST['accept'] && $config['captiveportal']['auth_method'] == "local") { From 5b87b24e07c6bf29c1e905ed6f75b6859d4f5fd7 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 21:30:47 +0000 Subject: [PATCH 108/112] Make the logout page configurable like the other pages. The only difference is that this page/code will be treated as a .php page so it may contain internal php CP variables referenced. --- etc/inc/captiveportal.inc | 44 ++++++++++++++++++++++++ usr/local/captiveportal/index.php | 32 +---------------- usr/local/www/services_captiveportal.php | 20 +++++++++++ 3 files changed, 65 insertions(+), 31 deletions(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index d08b8fc6cb..885040b7f9 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -230,6 +230,50 @@ EOD; fclose($fd); } + /* write error page */ + if ($config['captiveportal']['page']['logouttext']) + $logouttext = base64_decode($config['captiveportal']['page']['logouttext']); + else { + /* example page */ + $logouttext = << +Redirecting... + + +Redirecting to {$my_redirurl}... + + + + + +EOD; + } + + $fd = @fopen("{$g['varetc_path']}/captiveportal-logout.html", "w"); + if ($fd) { + fwrite($fd, $logouttext); + fclose($fd); + } /* write elements */ captiveportal_write_elements(); diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index 59456d7f8f..bd5a91c100 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -467,38 +467,8 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut $logouturl = "http://{$ourhostname}/"; } - echo << -Redirecting... - - -Redirecting to {$my_redirurl}... - - - - - -EOD; } else { if($_POST['ORIGINAL_PORTAL_IP'] && $_SERVER['SERVER_NAME'] != $_POST['ORIGINAL_PORTAL_IP']) { header ('HTTP/1.1 301 Moved Permanently'); diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index 8d79eb2a5a..fcc5be677f 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -57,6 +57,9 @@ if ($_GET['act'] == "viewhtml") { } else if ($_GET['act'] == "viewerrhtml") { echo base64_decode($config['captiveportal']['page']['errtext']); exit; +} else if ($_GET['act'] == "viewlogouthtml") { + echo base64_decode($config['captiveportal']['page']['logouttext']); + exit; } $pconfig['cinterface'] = $config['captiveportal']['interface']; @@ -203,6 +206,8 @@ if ($_POST) { $config['captiveportal']['page']['htmltext'] = base64_encode(file_get_contents($_FILES['htmlfile']['tmp_name'])); if (is_uploaded_file($_FILES['errfile']['tmp_name'])) $config['captiveportal']['page']['errtext'] = base64_encode(file_get_contents($_FILES['errfile']['tmp_name'])); + if (is_uploaded_file($_FILES['logoutfile']['tmp_name'])) + $config['captiveportal']['page']['logouttext'] = base64_encode(file_get_contents($_FILES['logoutfile']['tmp_name'])); write_config(); @@ -257,6 +262,7 @@ function enable_change(enable_change) { document.iform.radiussession_timeout.disabled = radius_endis; document.iform.htmlfile.disabled = endis; document.iform.errfile.disabled = endis; + document.iform.logoutfile.disabled = endis; document.iform.radiusacctport.disabled = (radius_endis || !document.iform.radacct_enable.checked) && !enable_change; @@ -641,6 +647,20 @@ Example code for the form:

The contents of the HTML/PHP file that you upload here are displayed when an authentication error occurs. +You may include "$PORTAL_MESSAGE$", which will be replaced by the error or reply messages from the RADIUS server, if any. + + + Logout
+ page
+ contents + +
+ + View current page +
+
+ +The contents of the HTML/PHP file that you upload here are displayed when an authentication error occurs. You may include "$PORTAL_MESSAGE$", which will be replaced by the error or reply messages from the RADIUS server, if any. From fe383a26af8229e139d0853c11210e6252db6c0b Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 28 May 2010 22:40:27 +0000 Subject: [PATCH 109/112] Use REQUEST to hanle both POST/GET. --- usr/local/captiveportal/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/captiveportal/index.php b/usr/local/captiveportal/index.php index bd5a91c100..5990ec11ff 100755 --- a/usr/local/captiveportal/index.php +++ b/usr/local/captiveportal/index.php @@ -43,7 +43,7 @@ header("Cache-Control: post-check=0, pre-check=0", false); header("Pragma: no-cache"); $orig_host = $_ENV['HTTP_HOST']; -$orig_request = $_GET['redirurl']; +$orig_request = $_REQUEST['redirurl']; $clientip = $_SERVER['REMOTE_ADDR']; if (!$clientip) { From 943d4ad25d63bb74478baad804d63a70ac081a6b Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Fri, 28 May 2010 21:12:59 -0400 Subject: [PATCH 110/112] add auth logs tab to CP screens --- usr/local/www/services_captiveportal.php | 1 + usr/local/www/services_captiveportal_filemanager.php | 1 + usr/local/www/services_captiveportal_ip.php | 1 + usr/local/www/services_captiveportal_mac.php | 1 + usr/local/www/services_captiveportal_vouchers.php | 1 + 5 files changed, 5 insertions(+) diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index fcc5be677f..331708aadc 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -288,6 +288,7 @@ function enable_change(enable_change) { $tab_array[] = array("Allowed IP addresses", false, "services_captiveportal_ip.php"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); + $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_filemanager.php b/usr/local/www/services_captiveportal_filemanager.php index 328f293878..2c8d8156ad 100755 --- a/usr/local/www/services_captiveportal_filemanager.php +++ b/usr/local/www/services_captiveportal_filemanager.php @@ -137,6 +137,7 @@ include("head.inc"); $tab_array[] = array("Allowed IP addresses", false, "services_captiveportal_ip.php"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", true, "services_captiveportal_filemanager.php"); + $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_ip.php b/usr/local/www/services_captiveportal_ip.php index 4bf2cf99ac..61e05e5eb8 100755 --- a/usr/local/www/services_captiveportal_ip.php +++ b/usr/local/www/services_captiveportal_ip.php @@ -85,6 +85,7 @@ include("head.inc"); $tab_array[] = array("Allowed IP addresses", true, "services_captiveportal_ip.php"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); + $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_mac.php b/usr/local/www/services_captiveportal_mac.php index f7aa502249..3e459f48e2 100755 --- a/usr/local/www/services_captiveportal_mac.php +++ b/usr/local/www/services_captiveportal_mac.php @@ -125,6 +125,7 @@ include("head.inc"); $tab_array[] = array("Allowed IP addresses", false, "services_captiveportal_ip.php"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); + $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index c43de0814a..de305b7e82 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -244,6 +244,7 @@ function enable_change(enable_change) { $tab_array[] = array("Allowed IP addresses", false, "services_captiveportal_ip.php"); $tab_array[] = array("Vouchers", true, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); + $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); display_top_tabs($tab_array); ?> From 881eb09217613337da4dd5376a038446a0e18b1c Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Fri, 28 May 2010 21:26:04 -0400 Subject: [PATCH 111/112] add a status tab to the CP screens as well --- usr/local/www/services_captiveportal.php | 1 + usr/local/www/services_captiveportal_filemanager.php | 1 + usr/local/www/services_captiveportal_ip.php | 1 + usr/local/www/services_captiveportal_mac.php | 1 + usr/local/www/services_captiveportal_vouchers.php | 1 + 5 files changed, 5 insertions(+) diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index 331708aadc..aa24b3d077 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -289,6 +289,7 @@ function enable_change(enable_change) { $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); + $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_filemanager.php b/usr/local/www/services_captiveportal_filemanager.php index 2c8d8156ad..cc64bc9a72 100755 --- a/usr/local/www/services_captiveportal_filemanager.php +++ b/usr/local/www/services_captiveportal_filemanager.php @@ -138,6 +138,7 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", true, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); + $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_ip.php b/usr/local/www/services_captiveportal_ip.php index 61e05e5eb8..1b3f71e2de 100755 --- a/usr/local/www/services_captiveportal_ip.php +++ b/usr/local/www/services_captiveportal_ip.php @@ -86,6 +86,7 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); + $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_mac.php b/usr/local/www/services_captiveportal_mac.php index 3e459f48e2..d88da1a9a2 100755 --- a/usr/local/www/services_captiveportal_mac.php +++ b/usr/local/www/services_captiveportal_mac.php @@ -126,6 +126,7 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); + $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index de305b7e82..c4ee4bbe7a 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -245,6 +245,7 @@ function enable_change(enable_change) { $tab_array[] = array("Vouchers", true, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); + $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> From 40e18a72af0d2633251ef197ff6311325ce4eae9 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Fri, 28 May 2010 21:31:21 -0400 Subject: [PATCH 112/112] Revert "add a status tab to the CP screens as well", this is just a tad too long This reverts commit 881eb09217613337da4dd5376a038446a0e18b1c. --- usr/local/www/services_captiveportal.php | 1 - usr/local/www/services_captiveportal_filemanager.php | 1 - usr/local/www/services_captiveportal_ip.php | 1 - usr/local/www/services_captiveportal_mac.php | 1 - usr/local/www/services_captiveportal_vouchers.php | 1 - 5 files changed, 5 deletions(-) diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php index aa24b3d077..331708aadc 100755 --- a/usr/local/www/services_captiveportal.php +++ b/usr/local/www/services_captiveportal.php @@ -289,7 +289,6 @@ function enable_change(enable_change) { $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); - $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_filemanager.php b/usr/local/www/services_captiveportal_filemanager.php index cc64bc9a72..2c8d8156ad 100755 --- a/usr/local/www/services_captiveportal_filemanager.php +++ b/usr/local/www/services_captiveportal_filemanager.php @@ -138,7 +138,6 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", true, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); - $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_ip.php b/usr/local/www/services_captiveportal_ip.php index 1b3f71e2de..61e05e5eb8 100755 --- a/usr/local/www/services_captiveportal_ip.php +++ b/usr/local/www/services_captiveportal_ip.php @@ -86,7 +86,6 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); - $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_mac.php b/usr/local/www/services_captiveportal_mac.php index d88da1a9a2..3e459f48e2 100755 --- a/usr/local/www/services_captiveportal_mac.php +++ b/usr/local/www/services_captiveportal_mac.php @@ -126,7 +126,6 @@ include("head.inc"); $tab_array[] = array("Vouchers", false, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); - $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index c4ee4bbe7a..de305b7e82 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -245,7 +245,6 @@ function enable_change(enable_change) { $tab_array[] = array("Vouchers", true, "services_captiveportal_vouchers.php"); $tab_array[] = array("File Manager", false, "services_captiveportal_filemanager.php"); $tab_array[] = array("Auth Logs", false, "diag_logs_auth.php"); - $tab_array[] = array("Status", false, "status_captiveportal.php"); display_top_tabs($tab_array); ?>