mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote branch 'upstream/master'

Browse Source
This commit is contained in:
Seth Mos 2011-04-12 10:40:44 +02:00
commit af8f910eeb
25 changed files with 141 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
etc/inc/auth.inc
View File

@ -367,6 +367,8 @@ function local_user_set(& $user) {
$user_shell = "/usr/local/bin/scponly";
} elseif (userHasPrivilege($user, "user-ssh-tunnel")) {
$user_shell = "/usr/local/sbin/ssh_tunnel_shell";
} elseif (userHasPrivilege($user, "user-ipsec-xauth-dialin")) {
$user_shell = "/sbin/nologin";
} else {
$user_shell = "/sbin/nologin";
$lock_account = true;

11
etc/inc/config.lib.inc
View File

@ -534,10 +534,17 @@ function write_config($desc="Unknown", $backup = true) {
/* NOTE: We assume that the file can be parsed since we wrote it. */
$config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']);
if ($config == -1) {
copy("{$g['conf_path']}/config.xml", "{$g['conf_path']}/config.xml.bad");
$last_backup = discover_last_backup();
if ($last_backup)
if ($last_backup) {
restore_backup("/cf/conf/backup/{$last_backup}");
else
$config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']);
if ($g['booting']) {
echo "\n\n ************** WARNING **************";
echo "\n\n Configuration could not be validated. A previous configuration was restored. \n";
echo "\n The failed configuration file has been saved as {$g['conf_path']}/config.xml.bad} \n\n";
}
} else
log_error(gettext("Could not restore config.xml."));
} else
generate_config_cache($config);

7
etc/inc/filter.inc
View File

@ -1063,6 +1063,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
$toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta));
if(!empty($toadd_array)) {
$target = explode(" ", trim($target));
foreach($toadd_array as $tda) {
if (empty($tda))
continue;
@ -1074,7 +1075,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
$socktype = "stream";
$dash_u = "";
}
$target = explode(" ", trim($target));
foreach ($target as $targip) {
if (empty($targip))
continue;
@ -2419,7 +2419,7 @@ EOD;
}
}
/* PPTPd enabled? */
if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) {
if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off") && !isset($config['system']['disablevpnrules'])) {
if($pptpdcfg['mode'] == "server")
$pptpdtarget = get_interface_ip();
else
@ -2870,6 +2870,9 @@ function filter_generate_ipsec_rules() {
echo "filter_generate_ipsec_rules() being called $mt\n";
}
if (isset($config['system']['disablevpnrules']))
return "\n# VPN Rules not added disabled in System->Advanced.\n";
$ipfrules = "\n# VPN Rules\n";
/* Is IP Compression enabled? */
if(isset($config['ipsec']['ipcomp']))

36
etc/inc/gwlb.inc
View File

@ -372,6 +372,40 @@ function return_gateway_groups_array() {
$gateways_arr = return_gateways_array();
$gateway_groups_array = array();
/*
* NOTE: The code below is meant to replace the default gateway when it goes down.
* This facilitates services running on pfSense itself and are not handled by a PBR to continue working.
*/
$upgw = "";
$dfltgwdown = false;
$dfltgwfound = false;
foreach ($gateways_arr as $gwname => $gwsttng) {
if (isset($gwsttng['defaultgw'])) {
$dfltgwfound = true;
if (stristr($gateways_status[$gwname]['status'], "down"))
$dfltgwdown = true;
}
/* Keep a record of the last up gateway */
if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down"))
$upgw = $gwname;
if ($dfltgwdown == true && !empty($upgw))
break;
}
if ($dfltgwfound == false) {
$gwname = convert_friendly_interface_to_friendly_descr("wan");
if (stristr($gateways_status[$gwname]['status'], "down"))
$dfltgwdown = true;
}
if ($dfltgwdown == true && !empty($upgw)) {
if ($gateways_arr[$upgw]['gateway'] == "dynamic")
$gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']);
if (is_ipaddr($gateways_arr[$upgw]['gateway'])) {
log_error("Default gateway down setting {$upgw} as default!");
mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}");
}
}
unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng);
if (is_array($config['gateways']['gateway_group'])) {
foreach($config['gateways']['gateway_group'] as $group) {
/* create array with group gateways members seperated by tier */
@ -390,7 +424,7 @@ function return_gateway_groups_array() {
$status = $gateways_status[$gwname];
$gwdown = false;
if (stristr($status['status'], "down")) {
$msg = "MONITOR: {$gwname} has high latency, removing from routing group";
$msg = "MONITOR: {$gwname} is down, removing from routing group";
$gwdown = true;
} else if (stristr($status['status'], "loss") && strstr($group['trigger'], "loss")) {
/* packet loss */

2
etc/inc/openvpn.inc
View File

@ -382,13 +382,13 @@ function openvpn_reconfigure($mode, $settings) {
// configure p2p/server modes
switch($settings['mode']) {
case 'p2p_tls':
case 'p2p_shared_key':
$baselong = ip2long32($ip) & ip2long($mask);
$ip1 = long2ip32($baselong + 1);
$ip2 = long2ip32($baselong + 2);
$conf .= "ifconfig $ip1 $ip2\n";
break;
case 'p2p_tls':
case 'server_tls':
case 'server_user':
case 'server_tls_user':

6
etc/inc/priv/user.priv.inc
View File

@ -21,6 +21,12 @@ $priv_list['user-ssh-tunnel']['descr'] = "Indicates whether the user is able to
"Note: User - System - Copy files conflicts with ".
"this privilege.";
$priv_list['user-ipsec-xauth-dialin'] = array();
$priv_list['user-ipsec-xauth-dialin']['name'] = "User - VPN - IPsec xauth Dialin";
$priv_list['user-ipsec-xauth-dialin']['descr'] = "Indicates whether the user is allowed to dial in via IPsec xauth ".
"(Note: Does not allow shell access, but may allow ".
"the user to create ssh tunnels)";
$priv_list['user-l2tp-dialin'] = array();
$priv_list['user-l2tp-dialin']['name'] = "User - VPN - L2TP Dialin";
$priv_list['user-l2tp-dialin']['descr'] = "Indicates whether the user is allowed to dial in via L2TP";

3
etc/inc/rrd.inc
View File

@ -813,9 +813,8 @@ function enable_rrd_graphing() {
}
function kill_traffic_collector() {
mwexec("killall top", true);
mwexec("killall rrdtool", true);
mwexec("/bin/pkill -f updaterrd.sh", true);
mwexec("/bin/pkill -a -f updaterrd.sh", true);
}
?>

4
etc/inc/services.inc
View File

@ -770,14 +770,14 @@ EOD;
function services_igmpproxy_configure() {
global $config, $g;
$iflist = get_configured_interface_list();
/* kill any running igmpproxy */
killbyname("igmpproxy");
if (!is_array($config['igmpproxy']['igmpentry']))
return 1;
$iflist = get_configured_interface_list();
$igmpconf = <<<EOD
##------------------------------------------------------

4
etc/inc/system.inc
View File

@ -1261,11 +1261,11 @@ function system_ntp_configure() {
$ips = array_map('find_interface_ip', $ifaces);
foreach ($ips as $ip) {
if (is_ipaddr($ip))
$ntpdcfg .= "listen on $ip\n";
$ntpcfg .= "listen on $ip\n";
}
}
}
$ntpdcfg .= "\n";
$ntpcfg .= "\n";
/* open configuration for wrting or bail */
$fd = fopen("{$g['varetc_path']}/ntpd.conf","w");

4
etc/inc/upgrade_config.inc
View File

@ -1470,12 +1470,12 @@ function upgrade_051_to_052() {
$server['caref'] = $ca['refid'];
/* create a crl entry if needed */
if (!empty($server['crl'])) {
if (!empty($server['crl'][0])) {
$crl = array();
$crl['refid'] = uniqid();
$crl['descr'] = "Imported OpenVPN CRL #{$index}";
$crl['caref'] = $ca['refid'];
$crl['text'] = $server['crl'];
$crl['text'] = $server['crl'][0];
if(!is_array($config['crl']))
$config['crl'] = array();
$config['crl'][] = $crl;

3
etc/inc/vpn.inc
View File

@ -926,7 +926,8 @@ EOD;
mwexec("/usr/local/sbin/setkey -F", false);
sleep("0.1");
/* start racoon */
mwexec("/usr/local/sbin/racoon -f {$g['varetc_path']}/racoon.conf", false);
$ipsecdebug = isset($config['ipsec']['racoondebug']) ? "-d -v" : "";
mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/racoon.conf", false);
sleep("0.1");
/* load SPD */
mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);

3
etc/rc.newwanip
View File

@ -138,6 +138,9 @@ if (substr($interface_real, 0, 4) != "ovpn")
/* reload graphing functions */
enable_rrd_graphing();
/* reload igmpproxy */
services_igmpproxy_configure();
restart_packages();
?>

5
sbin/dhclient-script
View File

@ -192,7 +192,10 @@ add_new_routes() {
if [ "$new_ip_address" = "$router" -o "$router" = "255.255.255.255" ]; then
$ROUTE add default -iface $interface
echo $ROUTE add default -iface $interface | $LOGGER
echo $router > /tmp/${interface}_router
# NOTE: Do not activate this for all ones address since pf(4) will try to forward packets to it.
if [ "$new_ip_address" = "$router" ]; then
echo $router > /tmp/${interface}_router
fi
else
$ROUTE add default $router
echo $ROUTE add default $router | $LOGGER

12
usr/local/sbin/ntpdate_sync_once.sh
View File

@ -2,16 +2,18 @@
NOTSYNCED="true"
SERVER=`cat /cf/conf/config.xml | grep timeservers | cut -d">" -f2 | cut -d"<" -f1`
pkill -f ntpdate_sync_once.sh
while [ "$NOTSYNCED" = "true" ]; do
ntpdate $SERVER
# Ensure that ntpd and ntpdate are not running so that the socket we want will be free.
killall ntpd 2>/dev/null
killall ntpdate
sleep 1
ntpdate -s -t 5 $SERVER
if [ "$?" = "0" ]; then
NOTSYNCED="false"
fi
sleep 5
done
# Launch -- we have net.
killall ntpd 2>/dev/null
sleep 1
/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf
/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf

10
usr/local/www/diag_packet_capture.php
View File

@ -194,13 +194,13 @@ include("fbegin.inc");
<?php
/* check to see if packet capture tcpdump is already running */
$processcheck = (trim(shell_exec('/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep $fn | /usr/bin/grep -v pflog')));
$processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/grep -v pflog")));
$processisrunning = false;
if ($processcheck != false)
if ($processcheck != "")
$processisrunning = true;
else
$processisrunning = false;
if (($action == gettext("Stop") or $action == "") and $processisrunning != true)
echo "<input type=\"submit\" name=\"startbtn\" value=\"" . gettext("Start") . "\">&nbsp;";
else {

5
usr/local/www/firewall_shaper.php
View File

@ -386,11 +386,8 @@ include("head.inc");
<link rel="stylesheet" type="text/css" media="all" href="./tree/tree.css" />
<script type="text/javascript" src="./tree/tree.js"></script>
<?php
if ($queue) {
echo "<script type=\"text/javascript\">";
if ($queue)
echo $queue->build_javascript();
echo "</script>";
}
echo $newjavascript;
include("fbegin.inc");

2
usr/local/www/head.inc
View File

@ -7,7 +7,7 @@
* if user has selected a custom template, use it.
* otherwise default to pfsense tempalte
*/
if($config['theme'] <> "")
if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme'])))
$g['theme'] = $config['theme'];
else
$g['theme'] = "pfsense";

2
usr/local/www/services_snmp.php
View File

@ -384,7 +384,7 @@ function enable_change(whichone) {
<input name="hostres" type="checkbox" id="hostres" value="yes" onClick="check_deps()" <?php if ($pconfig['hostres']) echo "checked"; ?> ><?=gettext("Host Resources (Requires MibII)");?>
</td>
</tr>
<?php if(!$config['interfaces']['lan']): ?>
<?php if($config['interfaces']['lan']): ?>
<tr>
<td width="22%" valign="top" class="vtable"></td>
<td width="78%" class="vtable">

15
usr/local/www/system_advanced_firewall.php
View File

@ -66,6 +66,7 @@ $pconfig['reflectiontimeout'] = $config['system']['reflectiontimeout'];
$pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']);
$pconfig['disablescrub'] = isset($config['system']['disablescrub']);
$pconfig['tftpinterface'] = explode(",", $config['system']['tftpinterface']);
$pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']);
if ($_POST) {
@ -96,6 +97,10 @@ if ($_POST) {
else
unset($config['system']['disablefilter']);
if($_POST['disablevpnrules'] == "yes")
$config['system']['disablevpnrules'] = true;
else
unset($config['system']['disablevpnrules']);
if($_POST['rfc959workaround'] == "yes")
$config['system']['rfc959workaround'] = "enabled";
else
@ -330,6 +335,16 @@ function update_description(itemnum) {
<br/>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell">Disable Auto-added VPN rules</td>
<td width="78%" class="vtable">
<input name="disablevpnrules" type="checkbox" id="disablevpnrules" value="yes" <?php if (isset($config['system']['disablevpnrules'])) echo "checked"; ?> />
<strong><?=gettext("Disable all auto-added VPN rules.");?></strong>
<br />
<span class="vexpl"><?=gettext("Note: This disables automatically added rules for IPsec, PPTP.");?>
</span>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell">Disable reply-to</td>
<td width="78%" class="vtable">

28
usr/local/www/system_advanced_misc.php
View File

@ -47,11 +47,13 @@ require("guiconfig.inc");
require_once("functions.inc");
require_once("filter.inc");
require_once("shaper.inc");
require_once("ipsec.inc");
require_once("vpn.inc");
$pconfig['harddiskstandby'] = $config['system']['harddiskstandby'];
$pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']);
$pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']);
$pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']);
$pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);
$pconfig['maxmss'] = $config['system']['maxmss'];
$pconfig['powerd_enable'] = isset($config['system']['powerd_enable']);
@ -85,6 +87,19 @@ if ($_POST) {
else
unset($config['ipsec']['preferoldsa']);
$need_racoon_restart = false;
if($_POST['racoondebug_enable'] == "yes") {
if (!isset($config['ipsec']['racoondebug'])) {
$config['ipsec']['racoondebug'] = true;
$need_racoon_restart = true;
}
} else {
if (isset($config['ipsec']['racoondebug'])) {
unset($config['ipsec']['racoondebug']);
$need_racoon_restart = true;
}
}
if($_POST['maxmss_enable'] == "yes") {
$config['system']['maxmss_enable'] = true;
$config['system']['maxmss'] = $_POST['maxmss'];
@ -125,6 +140,8 @@ if ($_POST) {
activate_powerd();
load_glxsb();
vpn_ipsec_configure_preferoldsa();
if ($need_racoon_restart)
vpn_ipsec_force_reload();
}
}
@ -258,6 +275,17 @@ function maxmss_checked(obj) {
"option to always prefer old SAs over new ones."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("IPsec Debug"); ?></td>
<td width="78%" class="vtable">
<input name="racoondebug_enable" type="checkbox" id="racoondebug_enable" value="yes" <?php if ($pconfig['racoondebug_enable']) echo "checked"; ?> />
<strong><?=gettext("Start racoon in debug mode"); ?></strong>
<br />
<?=gettext("Launches racoon in debug mode so that more verbose logs " .
"will be generated to aid in troubleshooting."); ?><br/>
<?=gettext("NOTE: Changing this setting will restart racoon."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Maximum MSS"); ?></td>
<td width="78%" class="vtable">

3
usr/local/www/themes/_corporate/rrdcolors.inc.php
View File

@ -32,6 +32,7 @@
$colortrafficup = array("666666", "CCCCCC");
$colortrafficdown = array("990000", "CC0000");
$colortraffic95 = array("660000", "FF0000");
$colorpacketsup = array("666666", "CCCCCC");
$colorpacketsdown = array("990000", "CC0000");
$colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000');
@ -46,5 +47,7 @@ $colorqualityloss = "ee0000";
$colorwireless = array('333333','a83c3c','999999');
$colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066');
$colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600');
$colorvpnusers = array('990000');
$colorcaptiveportalusers = array('990000');
?>

1
usr/local/www/themes/nervecenter/rrdcolors.inc.php
View File

@ -48,5 +48,6 @@ $colorwireless = array('333333','a83c3c','999999');
$colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066');
$colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600');
$colorvpnusers = array('990000');
$colorcaptiveportalusers = array('990000');
?>

4
usr/local/www/vpn_ipsec.php
View File

@ -418,7 +418,9 @@ include("head.inc");
<span class="red">
<strong><?=gettext("Note"); ?>:<br></strong>
</span>
<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.
<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.<br/>
<?=gettext("IPsec Debug Mode can be enabled at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.<br/>
<?=gettext("IPsec can be set to prefer older SAs at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.
</span>
</p>
</td>

2
usr/local/www/vpn_openvpn_client.php
View File

@ -654,8 +654,6 @@ if ($savemsg)
$caname = "";
$inuse = "";
$revoked = "";
if (is_user_cert($cert['refid']))
continue;
$ca = lookup_ca($cert['caref']);
if ($ca)
$caname = " (CA: {$ca['descr']})";

6
usr/local/www/vpn_openvpn_server.php
View File

@ -563,9 +563,9 @@ function netbios_change() {
if (!$savemsg)
$savemsg = "";
if (count($a_ca) == 0)
$savemsg .= "You have no Certificate Authorities defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
$savemsg .= "You have no Certificate Authorities defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
if (count($a_cert) == 0)
$savemsg .= "<br/>You have no Certificates defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
$savemsg .= "<br/>You have no Certificates defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
if ($input_errors)
print_input_errors($input_errors);
@ -815,8 +815,6 @@ if ($savemsg)
$caname = "";
$inuse = "";
$revoked = "";
if (is_user_cert($cert['refid']))
continue;
$ca = lookup_ca($cert['caref']);
if ($ca)
$caname = " (CA: {$ca['descr']})";