diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index ec794d0a55..8dc0fe7aee 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -367,6 +367,8 @@ function local_user_set(& $user) { $user_shell = "/usr/local/bin/scponly"; } elseif (userHasPrivilege($user, "user-ssh-tunnel")) { $user_shell = "/usr/local/sbin/ssh_tunnel_shell"; + } elseif (userHasPrivilege($user, "user-ipsec-xauth-dialin")) { + $user_shell = "/sbin/nologin"; } else { $user_shell = "/sbin/nologin"; $lock_account = true; diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 1b7766a703..859eb8ea4e 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -534,10 +534,17 @@ function write_config($desc="Unknown", $backup = true) { /* NOTE: We assume that the file can be parsed since we wrote it. */ $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); if ($config == -1) { + copy("{$g['conf_path']}/config.xml", "{$g['conf_path']}/config.xml.bad"); $last_backup = discover_last_backup(); - if ($last_backup) + if ($last_backup) { restore_backup("/cf/conf/backup/{$last_backup}"); - else + $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); + if ($g['booting']) { + echo "\n\n ************** WARNING **************"; + echo "\n\n Configuration could not be validated. A previous configuration was restored. \n"; + echo "\n The failed configuration file has been saved as {$g['conf_path']}/config.xml.bad} \n\n"; + } + } else log_error(gettext("Could not restore config.xml.")); } else generate_config_cache($config); diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 0424748e99..6ba15e7fa4 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1063,6 +1063,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta)); if(!empty($toadd_array)) { + $target = explode(" ", trim($target)); foreach($toadd_array as $tda) { if (empty($tda)) continue; @@ -1074,7 +1075,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $socktype = "stream"; $dash_u = ""; } - $target = explode(" ", trim($target)); foreach ($target as $targip) { if (empty($targip)) continue; @@ -2419,7 +2419,7 @@ EOD; } } /* PPTPd enabled? */ - if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) { + if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off") && !isset($config['system']['disablevpnrules'])) { if($pptpdcfg['mode'] == "server") $pptpdtarget = get_interface_ip(); else @@ -2870,6 +2870,9 @@ function filter_generate_ipsec_rules() { echo "filter_generate_ipsec_rules() being called $mt\n"; } + if (isset($config['system']['disablevpnrules'])) + return "\n# VPN Rules not added disabled in System->Advanced.\n"; + $ipfrules = "\n# VPN Rules\n"; /* Is IP Compression enabled? */ if(isset($config['ipsec']['ipcomp'])) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index cc9aa74837..f7cd6ab7da 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -372,6 +372,40 @@ function return_gateway_groups_array() { $gateways_arr = return_gateways_array(); $gateway_groups_array = array(); + /* + * NOTE: The code below is meant to replace the default gateway when it goes down. + * This facilitates services running on pfSense itself and are not handled by a PBR to continue working. + */ + $upgw = ""; + $dfltgwdown = false; + $dfltgwfound = false; + foreach ($gateways_arr as $gwname => $gwsttng) { + if (isset($gwsttng['defaultgw'])) { + $dfltgwfound = true; + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } + /* Keep a record of the last up gateway */ + if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) + $upgw = $gwname; + if ($dfltgwdown == true && !empty($upgw)) + break; + } + if ($dfltgwfound == false) { + $gwname = convert_friendly_interface_to_friendly_descr("wan"); + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } + if ($dfltgwdown == true && !empty($upgw)) { + if ($gateways_arr[$upgw]['gateway'] == "dynamic") + $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); + if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { + log_error("Default gateway down setting {$upgw} as default!"); + mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); + } + } + unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng); + if (is_array($config['gateways']['gateway_group'])) { foreach($config['gateways']['gateway_group'] as $group) { /* create array with group gateways members seperated by tier */ @@ -390,7 +424,7 @@ function return_gateway_groups_array() { $status = $gateways_status[$gwname]; $gwdown = false; if (stristr($status['status'], "down")) { - $msg = "MONITOR: {$gwname} has high latency, removing from routing group"; + $msg = "MONITOR: {$gwname} is down, removing from routing group"; $gwdown = true; } else if (stristr($status['status'], "loss") && strstr($group['trigger'], "loss")) { /* packet loss */ diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index df531c7d73..56f6cf5c46 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -382,13 +382,13 @@ function openvpn_reconfigure($mode, $settings) { // configure p2p/server modes switch($settings['mode']) { - case 'p2p_tls': case 'p2p_shared_key': $baselong = ip2long32($ip) & ip2long($mask); $ip1 = long2ip32($baselong + 1); $ip2 = long2ip32($baselong + 2); $conf .= "ifconfig $ip1 $ip2\n"; break; + case 'p2p_tls': case 'server_tls': case 'server_user': case 'server_tls_user': diff --git a/etc/inc/priv/user.priv.inc b/etc/inc/priv/user.priv.inc index 779f2bb15f..bfc7f59a73 100644 --- a/etc/inc/priv/user.priv.inc +++ b/etc/inc/priv/user.priv.inc @@ -21,6 +21,12 @@ $priv_list['user-ssh-tunnel']['descr'] = "Indicates whether the user is able to "Note: User - System - Copy files conflicts with ". "this privilege."; +$priv_list['user-ipsec-xauth-dialin'] = array(); +$priv_list['user-ipsec-xauth-dialin']['name'] = "User - VPN - IPsec xauth Dialin"; +$priv_list['user-ipsec-xauth-dialin']['descr'] = "Indicates whether the user is allowed to dial in via IPsec xauth ". + "(Note: Does not allow shell access, but may allow ". + "the user to create ssh tunnels)"; + $priv_list['user-l2tp-dialin'] = array(); $priv_list['user-l2tp-dialin']['name'] = "User - VPN - L2TP Dialin"; $priv_list['user-l2tp-dialin']['descr'] = "Indicates whether the user is allowed to dial in via L2TP"; diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 29514501a3..529080cfc6 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -813,9 +813,8 @@ function enable_rrd_graphing() { } function kill_traffic_collector() { - mwexec("killall top", true); mwexec("killall rrdtool", true); - mwexec("/bin/pkill -f updaterrd.sh", true); + mwexec("/bin/pkill -a -f updaterrd.sh", true); } ?> diff --git a/etc/inc/services.inc b/etc/inc/services.inc index a76496aa20..c7421d4fa1 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -770,14 +770,14 @@ EOD; function services_igmpproxy_configure() { global $config, $g; - $iflist = get_configured_interface_list(); - /* kill any running igmpproxy */ killbyname("igmpproxy"); if (!is_array($config['igmpproxy']['igmpentry'])) return 1; + $iflist = get_configured_interface_list(); + $igmpconf = << diff --git a/sbin/dhclient-script b/sbin/dhclient-script index e7fee7a4d8..e51132e04b 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -192,7 +192,10 @@ add_new_routes() { if [ "$new_ip_address" = "$router" -o "$router" = "255.255.255.255" ]; then $ROUTE add default -iface $interface echo $ROUTE add default -iface $interface | $LOGGER - echo $router > /tmp/${interface}_router + # NOTE: Do not activate this for all ones address since pf(4) will try to forward packets to it. + if [ "$new_ip_address" = "$router" ]; then + echo $router > /tmp/${interface}_router + fi else $ROUTE add default $router echo $ROUTE add default $router | $LOGGER diff --git a/usr/local/sbin/ntpdate_sync_once.sh b/usr/local/sbin/ntpdate_sync_once.sh index 508ce3e9fa..e328ac4b4d 100755 --- a/usr/local/sbin/ntpdate_sync_once.sh +++ b/usr/local/sbin/ntpdate_sync_once.sh @@ -2,16 +2,18 @@ NOTSYNCED="true" SERVER=`cat /cf/conf/config.xml | grep timeservers | cut -d">" -f2 | cut -d"<" -f1` +pkill -f ntpdate_sync_once.sh while [ "$NOTSYNCED" = "true" ]; do - ntpdate $SERVER + # Ensure that ntpd and ntpdate are not running so that the socket we want will be free. + killall ntpd 2>/dev/null + killall ntpdate + sleep 1 + ntpdate -s -t 5 $SERVER if [ "$?" = "0" ]; then NOTSYNCED="false" fi sleep 5 done -# Launch -- we have net. -killall ntpd 2>/dev/null -sleep 1 -/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf +/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf \ No newline at end of file diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index 8a9cb414a9..b35cc1b753 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -194,13 +194,13 @@ include("fbegin.inc");  "; else { diff --git a/usr/local/www/firewall_shaper.php b/usr/local/www/firewall_shaper.php index f3cdbab185..407c94766f 100755 --- a/usr/local/www/firewall_shaper.php +++ b/usr/local/www/firewall_shaper.php @@ -386,11 +386,8 @@ include("head.inc"); "; +if ($queue) echo $queue->build_javascript(); - echo ""; -} echo $newjavascript; include("fbegin.inc"); diff --git a/usr/local/www/head.inc b/usr/local/www/head.inc index 97c71115e8..a24be9e93e 100755 --- a/usr/local/www/head.inc +++ b/usr/local/www/head.inc @@ -7,7 +7,7 @@ * if user has selected a custom template, use it. * otherwise default to pfsense tempalte */ -if($config['theme'] <> "") +if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme']))) $g['theme'] = $config['theme']; else $g['theme'] = "pfsense"; diff --git a/usr/local/www/services_snmp.php b/usr/local/www/services_snmp.php index 432db3dea2..925cb7be8f 100755 --- a/usr/local/www/services_snmp.php +++ b/usr/local/www/services_snmp.php @@ -384,7 +384,7 @@ function enable_change(whichone) { > - + diff --git a/usr/local/www/system_advanced_firewall.php b/usr/local/www/system_advanced_firewall.php index 816592204a..e532b78f90 100644 --- a/usr/local/www/system_advanced_firewall.php +++ b/usr/local/www/system_advanced_firewall.php @@ -66,6 +66,7 @@ $pconfig['reflectiontimeout'] = $config['system']['reflectiontimeout']; $pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']); $pconfig['disablescrub'] = isset($config['system']['disablescrub']); $pconfig['tftpinterface'] = explode(",", $config['system']['tftpinterface']); +$pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']); if ($_POST) { @@ -96,6 +97,10 @@ if ($_POST) { else unset($config['system']['disablefilter']); + if($_POST['disablevpnrules'] == "yes") + $config['system']['disablevpnrules'] = true; + else + unset($config['system']['disablevpnrules']); if($_POST['rfc959workaround'] == "yes") $config['system']['rfc959workaround'] = "enabled"; else @@ -330,6 +335,16 @@ function update_description(itemnum) {
+ + Disable Auto-added VPN rules + + /> + +
+ + + + Disable reply-to diff --git a/usr/local/www/system_advanced_misc.php b/usr/local/www/system_advanced_misc.php index b93301d839..590a955d81 100644 --- a/usr/local/www/system_advanced_misc.php +++ b/usr/local/www/system_advanced_misc.php @@ -47,11 +47,13 @@ require("guiconfig.inc"); require_once("functions.inc"); require_once("filter.inc"); require_once("shaper.inc"); +require_once("ipsec.inc"); require_once("vpn.inc"); $pconfig['harddiskstandby'] = $config['system']['harddiskstandby']; $pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']); $pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']); +$pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']); $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']); $pconfig['maxmss'] = $config['system']['maxmss']; $pconfig['powerd_enable'] = isset($config['system']['powerd_enable']); @@ -85,6 +87,19 @@ if ($_POST) { else unset($config['ipsec']['preferoldsa']); + $need_racoon_restart = false; + if($_POST['racoondebug_enable'] == "yes") { + if (!isset($config['ipsec']['racoondebug'])) { + $config['ipsec']['racoondebug'] = true; + $need_racoon_restart = true; + } + } else { + if (isset($config['ipsec']['racoondebug'])) { + unset($config['ipsec']['racoondebug']); + $need_racoon_restart = true; + } + } + if($_POST['maxmss_enable'] == "yes") { $config['system']['maxmss_enable'] = true; $config['system']['maxmss'] = $_POST['maxmss']; @@ -125,6 +140,8 @@ if ($_POST) { activate_powerd(); load_glxsb(); vpn_ipsec_configure_preferoldsa(); + if ($need_racoon_restart) + vpn_ipsec_force_reload(); } } @@ -258,6 +275,17 @@ function maxmss_checked(obj) { "option to always prefer old SAs over new ones."); ?> + + + + /> + +
+
+ + + diff --git a/usr/local/www/themes/_corporate/rrdcolors.inc.php b/usr/local/www/themes/_corporate/rrdcolors.inc.php index e3153fd62c..09956ccc94 100644 --- a/usr/local/www/themes/_corporate/rrdcolors.inc.php +++ b/usr/local/www/themes/_corporate/rrdcolors.inc.php @@ -32,6 +32,7 @@ $colortrafficup = array("666666", "CCCCCC"); $colortrafficdown = array("990000", "CC0000"); +$colortraffic95 = array("660000", "FF0000"); $colorpacketsup = array("666666", "CCCCCC"); $colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); @@ -46,5 +47,7 @@ $colorqualityloss = "ee0000"; $colorwireless = array('333333','a83c3c','999999'); $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066'); $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600'); +$colorvpnusers = array('990000'); +$colorcaptiveportalusers = array('990000'); ?> diff --git a/usr/local/www/themes/nervecenter/rrdcolors.inc.php b/usr/local/www/themes/nervecenter/rrdcolors.inc.php index ca6a70fc08..1ed3027e20 100644 --- a/usr/local/www/themes/nervecenter/rrdcolors.inc.php +++ b/usr/local/www/themes/nervecenter/rrdcolors.inc.php @@ -48,5 +48,6 @@ $colorwireless = array('333333','a83c3c','999999'); $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066'); $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600'); $colorvpnusers = array('990000'); +$colorcaptiveportalusers = array('990000'); ?> diff --git a/usr/local/www/vpn_ipsec.php b/usr/local/www/vpn_ipsec.php index 16231abacc..7e5122ae21 100755 --- a/usr/local/www/vpn_ipsec.php +++ b/usr/local/www/vpn_ipsec.php @@ -418,7 +418,9 @@ include("head.inc"); :
 - . + .
+ .
+ .

diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php index d28315d029..4b9fc74e36 100644 --- a/usr/local/www/vpn_openvpn_client.php +++ b/usr/local/www/vpn_openvpn_client.php @@ -654,8 +654,6 @@ if ($savemsg) $caname = ""; $inuse = ""; $revoked = ""; - if (is_user_cert($cert['refid'])) - continue; $ca = lookup_ca($cert['caref']); if ($ca) $caname = " (CA: {$ca['descr']})"; diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index cc38e65ad5..204cb62be6 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -563,9 +563,9 @@ function netbios_change() { if (!$savemsg) $savemsg = ""; if (count($a_ca) == 0) - $savemsg .= "You have no Certificate Authorities defined. You must visit the Certificate Manager to make one."; + $savemsg .= "You have no Certificate Authorities defined. You can visit the Certificate Manager or use the Wizard. to create one. "; if (count($a_cert) == 0) - $savemsg .= "
You have no Certificates defined. You must visit the Certificate Manager to make one."; + $savemsg .= "
You have no Certificates defined. You can visit the Certificate Manager or use the Wizard. to create one. "; if ($input_errors) print_input_errors($input_errors); @@ -815,8 +815,6 @@ if ($savemsg) $caname = ""; $inuse = ""; $revoked = ""; - if (is_user_cert($cert['refid'])) - continue; $ca = lookup_ca($cert['caref']); if ($ca) $caname = " (CA: {$ca['descr']})";