mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add a GUI field to increase the pf frag entries limit. Fixes ticket #4775

Browse Source
This commit is contained in:
jim-p 2015-06-18 09:30:10 -04:00
parent f6a4fe06f9
commit 9e8ce1e25b
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/inc/filter.inc
View File

@ -359,6 +359,11 @@ function filter_configure_sync($delete_states_if_needed = true) {
$limitrules .= "set limit src-nodes {$max_states}\n";
}
/* Frag limit. pf default is 5000 */
if ($config['system']['maximumfrags'] <> "" && is_numeric($config['system']['maximumfrags'])) {
$limitrules .= "set limit frags {$config['system']['maximumfrags']}\n";
}
if (isset($config['system']['lb_use_sticky']) && is_numeric($config['system']['srctrack']) && ($config['system']['srctrack'] > 0))
$limitrules .= "set timeout src.track {$config['system']['srctrack']}\n";

17
usr/local/www/system_advanced_firewall.php
View File

@ -61,6 +61,7 @@ $pconfig['aliasesresolveinterval'] = $config['system']['aliasesresolveinterval']
$old_aliasesresolveinterval = $config['system']['aliasesresolveinterval'];
$pconfig['checkaliasesurlcert'] = isset($config['system']['checkaliasesurlcert']);
$pconfig['maximumtableentries'] = $config['system']['maximumtableentries'];
$pconfig['maximumfrags'] = $config['system']['maximumfrags'];
$pconfig['disablereplyto'] = isset($config['system']['disablereplyto']);
$pconfig['disablenegate'] = isset($config['system']['disablenegate']);
$pconfig['bogonsinterval'] = $config['system']['bogons']['interval'];
@ -109,6 +110,9 @@ if ($_POST) {
if ($_POST['maximumtableentries'] && !is_numericint($_POST['maximumtableentries'])) {
$input_errors[] = gettext("The Firewall Maximum Table Entries value must be an integer.");
}
if ($_POST['maximumfrags'] && !is_numericint($_POST['maximumfrags'])) {
$input_errors[] = gettext("The Firewall Maximum Fragment Entries value must be an integer.");
}
if ($_POST['tcpidletimeout'] && !is_numericint($_POST['tcpidletimeout'])) {
$input_errors[] = gettext("The TCP idle timeout must be an integer.");
}
@ -205,6 +209,7 @@ if ($_POST) {
$config['system']['maximumstates'] = $_POST['maximumstates'];
$config['system']['aliasesresolveinterval'] = $_POST['aliasesresolveinterval'];
$config['system']['maximumtableentries'] = $_POST['maximumtableentries'];
$config['system']['maximumfrags'] = $_POST['maximumfrags'];
if (!empty($_POST['tcpfirsttimeout'])) {
$config['system']['tcpfirsttimeout'] = $_POST['tcpfirsttimeout'];
@ -521,6 +526,18 @@ function update_description(itemnum) {
</span>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Firewall Maximum Fragment Entries");?></td>
<td width="78%" class="vtable">
<input name="maximumfrags" type="text" id="maximumfrags" value="<?php echo htmlspecialchars($pconfig['maximumfrags']); ?>" />
<br />
<strong><?=gettext("Maximum number of packet fragments to hold for reassembly by scrub rules.");?></strong>
<br />
<span class="vexpl">
<?=gettext("Note: Leave this blank for the default (5000).");?>
</span>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Static route filtering");?></td>
<td width="78%" class="vtable">