From 056df2d9f0af16083bb0f601cb519e87741f1013 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 4 Apr 2011 10:24:57 +0000 Subject: [PATCH 01/37] Add -a to include all updaterrd.sh scripts running and also remove top killing since its not used anymore in stat gathering. --- etc/inc/rrd.inc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 92764d037e..2406753f0c 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -811,9 +811,8 @@ function enable_rrd_graphing() { } function kill_traffic_collector() { - mwexec("killall top", true); mwexec("killall rrdtool", true); - mwexec("/bin/pkill -f updaterrd.sh", true); + mwexec("/bin/pkill -a -f updaterrd.sh", true); } ?> From f206afb57e34ea30c43477deea3dfabfe10ad565 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 4 Apr 2011 10:32:55 +0000 Subject: [PATCH 02/37] On interface ip change reload even igmpproxy. Reported-by: http://forum.pfsense.org/index.php/topic,34372.0.html --- etc/inc/services.inc | 4 ++-- etc/rc.newwanip | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 314a891c74..ebb1bf9fdf 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -399,14 +399,14 @@ EOD; function services_igmpproxy_configure() { global $config, $g; - $iflist = get_configured_interface_list(); - /* kill any running igmpproxy */ killbyname("igmpproxy"); if (!is_array($config['igmpproxy']['igmpentry'])) return 1; + $iflist = get_configured_interface_list(); + $igmpconf = << From 1d60ed9bb4901c5b85813d0dab32630e8a135d41 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 4 Apr 2011 11:09:06 +0000 Subject: [PATCH 03/37] Try to always keep pfSense with a default gateway to avoid errors for service running from pfSense itself. Previously PBR should be configured for such services. While PBR is a better fix this at least keeps users from complaining in simple setups. Reported by many. --- etc/inc/gwlb.inc | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index a192bd3ca6..75dc775d92 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -367,6 +367,30 @@ function return_gateway_groups_array() { $gateways_arr = return_gateways_array(); $gateway_groups_array = array(); + /* + * NOTE: The code below is meant to replace the default gateway when it goes down. + * This facilitates services running on pfSense itself and are not handled by a PBR to continue working. + */ + $upgw = ""; + $dfltgwdown = false; + foreach ($gateways_arr as $gwname => $gwsttng) { + if ($gwsttng['defaultgw'] == true && stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + /* Keep a record of the last up gateway */ + if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) + $upgw = $gwname; + if ($dfltgwdown == true && !empty($upgw)) { + if ($gateways_arr[$upgw]['gateway'] == "dynamic") + $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); + if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { + log_error("Default gateway down setting {$upgw} as default!"); + mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); + } + break; + } + } + unset($upgw, $dfltgwdown, $gwname, $gwsttng); + if (is_array($config['gateways']['gateway_group'])) { foreach($config['gateways']['gateway_group'] as $group) { /* create array with group gateways members seperated by tier */ @@ -532,4 +556,4 @@ function get_interface_gateway($interface, &$dynamic = false) { return ($gw); } -?> \ No newline at end of file +?> From 1309faddc84d101fb0ecba85782d97b04a2a1a9f Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 4 Apr 2011 15:05:59 +0000 Subject: [PATCH 04/37] "; +if ($queue) echo $queue->build_javascript(); - echo ""; -} echo $newjavascript; include("fbegin.inc"); From 0ef48aed8b6b9098c924229f725e12b3f7ec7013 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 4 Apr 2011 13:39:23 -0400 Subject: [PATCH 05/37] Make sure all themes have the right colors defined. --- usr/local/www/themes/_corporate/rrdcolors.inc.php | 3 +++ usr/local/www/themes/nervecenter/rrdcolors.inc.php | 1 + 2 files changed, 4 insertions(+) diff --git a/usr/local/www/themes/_corporate/rrdcolors.inc.php b/usr/local/www/themes/_corporate/rrdcolors.inc.php index e3153fd62c..09956ccc94 100644 --- a/usr/local/www/themes/_corporate/rrdcolors.inc.php +++ b/usr/local/www/themes/_corporate/rrdcolors.inc.php @@ -32,6 +32,7 @@ $colortrafficup = array("666666", "CCCCCC"); $colortrafficdown = array("990000", "CC0000"); +$colortraffic95 = array("660000", "FF0000"); $colorpacketsup = array("666666", "CCCCCC"); $colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); @@ -46,5 +47,7 @@ $colorqualityloss = "ee0000"; $colorwireless = array('333333','a83c3c','999999'); $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066'); $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600'); +$colorvpnusers = array('990000'); +$colorcaptiveportalusers = array('990000'); ?> diff --git a/usr/local/www/themes/nervecenter/rrdcolors.inc.php b/usr/local/www/themes/nervecenter/rrdcolors.inc.php index c681f78501..09956ccc94 100644 --- a/usr/local/www/themes/nervecenter/rrdcolors.inc.php +++ b/usr/local/www/themes/nervecenter/rrdcolors.inc.php @@ -48,5 +48,6 @@ $colorwireless = array('333333','a83c3c','999999'); $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066'); $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600'); $colorvpnusers = array('990000'); +$colorcaptiveportalusers = array('990000'); ?> From 5b64e3369ae2ad38e4384741160e7f59cd414c7b Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 5 Apr 2011 11:16:08 -0400 Subject: [PATCH 06/37] Fix variable name --- etc/inc/system.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 4821a8ae7f..c71fb38661 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1166,11 +1166,11 @@ function system_ntp_configure() { $ips = array_map('find_interface_ip', $ifaces); foreach ($ips as $ip) { if (is_ipaddr($ip)) - $ntpdcfg .= "listen on $ip\n"; + $ntpcfg .= "listen on $ip\n"; } } } - $ntpdcfg .= "\n"; + $ntpcfg .= "\n"; /* open configuration for wrting or bail */ $fd = fopen("{$g['varetc_path']}/ntpd.conf","w"); From 262595f0d5756ad4411e3e83023b24db1de8fdac Mon Sep 17 00:00:00 2001 From: Ermal Date: Tue, 5 Apr 2011 19:55:11 +0000 Subject: [PATCH 07/37] Unbreak inetd.conf generation to avoid entries containing Array entries. This gixes nat reflection and a spamming of the system with nc processes with wrong parameters. --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index e6b27d5eb1..cde7a5faeb 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1059,6 +1059,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta)); if(!empty($toadd_array)) { + $target = explode(" ", trim($target)); foreach($toadd_array as $tda) { if (empty($tda)) continue; @@ -1070,7 +1071,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $socktype = "stream"; $dash_u = ""; } - $target = explode(" ", trim($target)); foreach ($target as $targip) { if (empty($targip)) continue; From 5766add89187bf47c225f67697e37ca25b0dbc71 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 10:42:21 +0000 Subject: [PATCH 08/37] If the supplied gateway is all ones(255.255.255.255) do not report it as a gateway since its useless. --- sbin/dhclient-script | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index e7fee7a4d8..e51132e04b 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -192,7 +192,10 @@ add_new_routes() { if [ "$new_ip_address" = "$router" -o "$router" = "255.255.255.255" ]; then $ROUTE add default -iface $interface echo $ROUTE add default -iface $interface | $LOGGER - echo $router > /tmp/${interface}_router + # NOTE: Do not activate this for all ones address since pf(4) will try to forward packets to it. + if [ "$new_ip_address" = "$router" ]; then + echo $router > /tmp/${interface}_router + fi else $ROUTE add default $router echo $ROUTE add default $router | $LOGGER From d10da0f9958850c0417efdcfbee8a9ea746923a9 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 10:49:51 +0000 Subject: [PATCH 09/37] Resolves #1418. Correct test to actully do what's intended. --- usr/local/www/services_snmp.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/services_snmp.php b/usr/local/www/services_snmp.php index 432db3dea2..925cb7be8f 100755 --- a/usr/local/www/services_snmp.php +++ b/usr/local/www/services_snmp.php @@ -384,7 +384,7 @@ function enable_change(whichone) { > - + From 19d9146637b36dd8cb3d42e300c44d4a8ccfe6d2 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 14:58:27 +0000 Subject: [PATCH 10/37] Another sweep at keeping the default route always present when the default setup route is marked as down. This now adds checks for configuration where a defaultgw is not specified by the user but deduced automatically. --- etc/inc/gwlb.inc | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 75dc775d92..50bd5c35fc 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -373,23 +373,33 @@ function return_gateway_groups_array() { */ $upgw = ""; $dfltgwdown = false; + $dfltgwfound = false; foreach ($gateways_arr as $gwname => $gwsttng) { - if ($gwsttng['defaultgw'] == true && stristr($gateways_status[$gwname]['status'], "down")) - $dfltgwdown = true; + if (isset($gwsttng['defaultgw'])) { + $dfltgwfound = true; + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } /* Keep a record of the last up gateway */ if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) $upgw = $gwname; - if ($dfltgwdown == true && !empty($upgw)) { - if ($gateways_arr[$upgw]['gateway'] == "dynamic") - $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); - if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { - log_error("Default gateway down setting {$upgw} as default!"); - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); - } + if ($dfltgwdown == true && !empty($upgw)) break; + } + if ($dfltgwfound == false) { + $gwname = convert_friendly_interface_to_friendly_descr("wan"); + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } + if ($dfltgwdown == true && !empty($upgw)) { + if ($gateways_arr[$upgw]['gateway'] == "dynamic") + $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); + if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { + log_error("Default gateway down setting {$upgw} as default!"); + mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); } } - unset($upgw, $dfltgwdown, $gwname, $gwsttng); + unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng); if (is_array($config['gateways']['gateway_group'])) { foreach($config['gateways']['gateway_group'] as $group) { From 4c613f84820a88c9b047e554b200accab5201f24 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 14:59:30 +0000 Subject: [PATCH 11/37] Correct error message for gateways to report down when the gateway is down and not high latency. --- etc/inc/gwlb.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 50bd5c35fc..2a611f81c6 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -419,7 +419,7 @@ function return_gateway_groups_array() { $status = $gateways_status[$gwname]; $gwdown = false; if (stristr($status['status'], "down")) { - $msg = "MONITOR: {$gwname} has high latency, removing from routing group"; + $msg = "MONITOR: {$gwname} is down, removing from routing group"; $gwdown = true; } else if (stristr($status['status'], "loss") && strstr($group['trigger'], "loss")) { /* packet loss */ From 557300a7eb66a82d951d5696c80209593cccfd6f Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 6 Apr 2011 12:54:18 -0400 Subject: [PATCH 12/37] Actually re-parse the config if a valid config was not written. (Should help stop installs from blowing up on failed config upgrades). Save the bad config for inspection, and print a message to the console about what was done. --- etc/inc/config.lib.inc | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 1b7766a703..8b25a3a2cb 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -534,10 +534,17 @@ function write_config($desc="Unknown", $backup = true) { /* NOTE: We assume that the file can be parsed since we wrote it. */ $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); if ($config == -1) { + copy("{$g['conf_path']}/config.xml", "{$g['conf_path']}/config.xml.bad"); $last_backup = discover_last_backup(); - if ($last_backup) + if ($last_backup) { restore_backup("/cf/conf/backup/{$last_backup}"); - else + $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); + if ($g['booting']) { + echo "\n\n ************** WARNING **************"; + echo "\n\n New configuration could not be validated. Restored previous configuration. \n"; + echo "\n Failed configuration has been saved as {{$g['conf_path']}/config.xml.bad} \n\n"; + } + } else log_error(gettext("Could not restore config.xml.")); } else generate_config_cache($config); From 6177fd924c8eb8e946594fca9d55fd24acae8c4a Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 6 Apr 2011 13:14:50 -0400 Subject: [PATCH 13/37] Fixup text. --- etc/inc/config.lib.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 8b25a3a2cb..859eb8ea4e 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -541,8 +541,8 @@ function write_config($desc="Unknown", $backup = true) { $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); if ($g['booting']) { echo "\n\n ************** WARNING **************"; - echo "\n\n New configuration could not be validated. Restored previous configuration. \n"; - echo "\n Failed configuration has been saved as {{$g['conf_path']}/config.xml.bad} \n\n"; + echo "\n\n Configuration could not be validated. A previous configuration was restored. \n"; + echo "\n The failed configuration file has been saved as {$g['conf_path']}/config.xml.bad} \n\n"; } } else log_error(gettext("Could not restore config.xml.")); From ab75b4ee5475fe1be718cb0e93d0a34f293c5ed0 Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 6 Apr 2011 13:36:24 -0400 Subject: [PATCH 14/37] CRL is read in as an array now, so even in the imported config it will appear to be an array even though it can only have one value. Fixes #1358 --- etc/inc/upgrade_config.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index de5c6000f3..805bbccd1f 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1470,12 +1470,12 @@ function upgrade_051_to_052() { $server['caref'] = $ca['refid']; /* create a crl entry if needed */ - if (!empty($server['crl'])) { + if (!empty($server['crl'][0])) { $crl = array(); $crl['refid'] = uniqid(); $crl['descr'] = "Imported OpenVPN CRL #{$index}"; $crl['caref'] = $ca['refid']; - $crl['text'] = $server['crl']; + $crl['text'] = $server['crl'][0]; if(!is_array($config['crl'])) $config['crl'] = array(); $config['crl'][] = $crl; From 9a36dc9d241e004e7bcdec25def3b7b0c9d94cff Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 18:22:27 +0000 Subject: [PATCH 15/37] Resolves #1391. Bring back VPN auto rule disable advanced setting. --- etc/inc/filter.inc | 5 ++++- usr/local/www/system_advanced_firewall.php | 15 +++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index cde7a5faeb..8fdf752d71 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2267,7 +2267,7 @@ EOD; } } /* PPTPd enabled? */ - if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) { + if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off") && !isset($config['system']['disablevpnrules'])) { if($pptpdcfg['mode'] == "server") $pptpdtarget = get_interface_ip(); else @@ -2700,6 +2700,9 @@ function filter_generate_ipsec_rules() { echo "filter_generate_ipsec_rules() being called $mt\n"; } + if (isset($config['system']['disablevpnrules'])) + return "\n# VPN Rules not added disabled in System->Advanced.\n"; + $ipfrules = "\n# VPN Rules\n"; /* Is IP Compression enabled? */ if(isset($config['ipsec']['ipcomp'])) diff --git a/usr/local/www/system_advanced_firewall.php b/usr/local/www/system_advanced_firewall.php index 816592204a..12a7ba2b6b 100644 --- a/usr/local/www/system_advanced_firewall.php +++ b/usr/local/www/system_advanced_firewall.php @@ -66,6 +66,7 @@ $pconfig['reflectiontimeout'] = $config['system']['reflectiontimeout']; $pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']); $pconfig['disablescrub'] = isset($config['system']['disablescrub']); $pconfig['tftpinterface'] = explode(",", $config['system']['tftpinterface']); +$pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']); if ($_POST) { @@ -96,6 +97,10 @@ if ($_POST) { else unset($config['system']['disablefilter']); + if($_POST['disablevpnrules'] == "yes") + $config['system']['disablevpnrules'] = true; + else + unset($config['system']['disablevpnrules']); if($_POST['rfc959workaround'] == "yes") $config['system']['rfc959workaround'] = "enabled"; else @@ -330,6 +335,16 @@ function update_description(itemnum) {
+ + Disable Auto-added VPN rules + + /> + +
+ + + + Disable reply-to From 87bb66af3e5b88b6ff4c870ecbdae0820497255d Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 6 Apr 2011 18:23:24 +0000 Subject: [PATCH 16/37] Correct text to include PPTP as well. --- usr/local/www/system_advanced_firewall.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/system_advanced_firewall.php b/usr/local/www/system_advanced_firewall.php index 12a7ba2b6b..e532b78f90 100644 --- a/usr/local/www/system_advanced_firewall.php +++ b/usr/local/www/system_advanced_firewall.php @@ -341,7 +341,7 @@ function update_description(itemnum) { />
- + From 0930bd0184d581ef34814e729355fc98edbe9050 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Wed, 6 Apr 2011 19:41:52 -0400 Subject: [PATCH 17/37] Make the default openvpn cert authority message a bit relaxed and let user know about the wizard option as well --- usr/local/www/vpn_openvpn_server.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index cc38e65ad5..aace1a20b5 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -563,7 +563,7 @@ function netbios_change() { if (!$savemsg) $savemsg = ""; if (count($a_ca) == 0) - $savemsg .= "You have no Certificate Authorities defined. You must visit the Certificate Manager to make one."; + $savemsg .= "You have no Certificate Authorities defined. You can visit the Certificate Manager or use the Wizard. to create one. "; if (count($a_cert) == 0) $savemsg .= "
You have no Certificates defined. You must visit the Certificate Manager to make one."; From 8fee59d6fe426347e2552aaaba93ef79a19d70d5 Mon Sep 17 00:00:00 2001 From: jim-p Date: Wed, 6 Apr 2011 19:53:46 -0400 Subject: [PATCH 18/37] Fix link; use same message for missing certs. --- usr/local/www/vpn_openvpn_server.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index aace1a20b5..d9fe634b1f 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -563,9 +563,9 @@ function netbios_change() { if (!$savemsg) $savemsg = ""; if (count($a_ca) == 0) - $savemsg .= "You have no Certificate Authorities defined. You can visit the Certificate Manager or use the Wizard. to create one. "; + $savemsg .= "You have no Certificate Authorities defined. You can visit the Certificate Manager or use the Wizard. to create one. "; if (count($a_cert) == 0) - $savemsg .= "
You have no Certificates defined. You must visit the Certificate Manager to make one."; + $savemsg .= "
You have no Certificates defined. You can visit the Certificate Manager or use the Wizard. to create one. "; if ($input_errors) print_input_errors($input_errors); From 72d8453d3b5933e42e5fb77ac1ff326ad7b7c1b7 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 7 Apr 2011 11:46:16 -0400 Subject: [PATCH 19/37] Don't test if a cert is in use here, you could in theory use a cert for a user and a server. --- usr/local/www/vpn_openvpn_server.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index d9fe634b1f..204cb62be6 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -815,8 +815,6 @@ if ($savemsg) $caname = ""; $inuse = ""; $revoked = ""; - if (is_user_cert($cert['refid'])) - continue; $ca = lookup_ca($cert['caref']); if ($ca) $caname = " (CA: {$ca['descr']})"; From c76fc19f32a34b91ece34740593f86978f4a8911 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 7 Apr 2011 11:49:40 -0400 Subject: [PATCH 20/37] Don't test for a user cert here either, see previous commit. --- usr/local/www/vpn_openvpn_client.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php index d28315d029..4b9fc74e36 100644 --- a/usr/local/www/vpn_openvpn_client.php +++ b/usr/local/www/vpn_openvpn_client.php @@ -654,8 +654,6 @@ if ($savemsg) $caname = ""; $inuse = ""; $revoked = ""; - if (is_user_cert($cert['refid'])) - continue; $ca = lookup_ca($cert['caref']); if ($ca) $caname = " (CA: {$ca['descr']})"; From 5d7881615de2fbeb44c1f3ab8903b52969538f9c Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 12:00:32 -0400 Subject: [PATCH 21/37] When using ' variables are not expanded. Use double quotes so that the variable is exanded --- usr/local/www/diag_packet_capture.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index 8a9cb414a9..02d8217598 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -194,7 +194,7 @@ include("fbegin.inc"); Date: Thu, 7 Apr 2011 12:33:41 -0400 Subject: [PATCH 22/37] Unbreak check if capture is running --- usr/local/www/diag_packet_capture.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index 02d8217598..0f9d8fbea4 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -194,13 +194,15 @@ include("fbegin.inc");  "; else { From 7ec2a858afefa36b28776d2ec1b33cc6e5d8b995 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 12:34:23 -0400 Subject: [PATCH 23/37] Remove copy paste --- usr/local/www/diag_packet_capture.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index 0f9d8fbea4..a9fba1b396 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -194,7 +194,7 @@ include("fbegin.inc"); Date: Thu, 7 Apr 2011 12:35:00 -0400 Subject: [PATCH 24/37] Remove extra variable set --- usr/local/www/diag_packet_capture.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php index a9fba1b396..b35cc1b753 100644 --- a/usr/local/www/diag_packet_capture.php +++ b/usr/local/www/diag_packet_capture.php @@ -196,8 +196,6 @@ include("fbegin.inc"); /* check to see if packet capture tcpdump is already running */ $processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/grep -v pflog"))); - $processisrunning = false; - if ($processcheck != "") $processisrunning = true; else From 955f2d788edae3c65506ffa12de18e023fd95ae4 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 16:11:45 -0400 Subject: [PATCH 25/37] Use some Seth egrep foo to protect from compromised DHCP servers. CVE-2011-0997 --- sbin/dhclient-script | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index e51132e04b..0f409a3427 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -232,13 +232,14 @@ add_new_resolv_conf() { if [ -n "$new_domain_name_servers" ]; then /bin/rm -f /var/etc/nameserver_$interface for nameserver in $new_domain_name_servers; do + nameserver_sanitized=`echo '$nameserver' | egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)'` # Add a route to the nameserver out the correct interface # so that mulitple wans work correctly with multiple dns # also backup the nameserver for later route removal - echo $nameserver >>/var/etc/nameserver_$interface - $ROUTE add $nameserver -iface $interface + echo '$nameserver_sanitized' >>/var/etc/nameserver_$interface + $ROUTE add $nameserver_sanitized -iface $interface done - echo $new_domain_name >/var/etc/searchdomain_$interface + echo $new_domain_name | egrep -o "[0-9\.]+" >/var/etc/searchdomain_$interface fi return 0 From d0cc727eb79bcd1c62cbaa66886accc5c199d27c Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 16:15:55 -0400 Subject: [PATCH 26/37] Use full path to egrep --- sbin/dhclient-script | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index 0f409a3427..24b9f9d6c6 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -239,7 +239,7 @@ add_new_resolv_conf() { echo '$nameserver_sanitized' >>/var/etc/nameserver_$interface $ROUTE add $nameserver_sanitized -iface $interface done - echo $new_domain_name | egrep -o "[0-9\.]+" >/var/etc/searchdomain_$interface + echo $new_domain_name | /usr/bin/egrep -o "[0-9\.]+" >/var/etc/searchdomain_$interface fi return 0 From 1fd807da8a52ac87eb3c13726b6b80f40227e0c9 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 16:16:26 -0400 Subject: [PATCH 27/37] Use full path to egrep --- sbin/dhclient-script | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index 24b9f9d6c6..a41447dafc 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -232,7 +232,7 @@ add_new_resolv_conf() { if [ -n "$new_domain_name_servers" ]; then /bin/rm -f /var/etc/nameserver_$interface for nameserver in $new_domain_name_servers; do - nameserver_sanitized=`echo '$nameserver' | egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)'` + nameserver_sanitized=`echo '$nameserver' | /usr/bin/egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)'` # Add a route to the nameserver out the correct interface # so that mulitple wans work correctly with multiple dns # also backup the nameserver for later route removal From b510be5cc1539dbdd6fc3d5bfe8afded5e346cbc Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Thu, 7 Apr 2011 16:17:23 -0400 Subject: [PATCH 28/37] use same egrep statement for both checks --- sbin/dhclient-script | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index a41447dafc..ccbde7d684 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -239,7 +239,7 @@ add_new_resolv_conf() { echo '$nameserver_sanitized' >>/var/etc/nameserver_$interface $ROUTE add $nameserver_sanitized -iface $interface done - echo $new_domain_name | /usr/bin/egrep -o "[0-9\.]+" >/var/etc/searchdomain_$interface + echo $new_domain_name | /usr/bin/egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)' >/var/etc/searchdomain_$interface fi return 0 From 02d99511539a3312f8aab54b7dd1cdcaec9c0847 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 08:27:37 -0400 Subject: [PATCH 29/37] Putting client-config-dir in the config is valid also for p2p_tls servers. Fixes #1417. --- etc/inc/openvpn.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index df531c7d73..56f6cf5c46 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -382,13 +382,13 @@ function openvpn_reconfigure($mode, $settings) { // configure p2p/server modes switch($settings['mode']) { - case 'p2p_tls': case 'p2p_shared_key': $baselong = ip2long32($ip) & ip2long($mask); $ip1 = long2ip32($baselong + 1); $ip2 = long2ip32($baselong + 2); $conf .= "ifconfig $ip1 $ip2\n"; break; + case 'p2p_tls': case 'server_tls': case 'server_user': case 'server_tls_user': From fbfd675a532a85858530d9ad7bdd63d563189bec Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 08:59:50 -0400 Subject: [PATCH 30/37] Add an IPsec xauth permission. Try to use the nologin shell first (just unlock the account). Ticket #1202 --- etc/inc/auth.inc | 2 ++ etc/inc/priv/user.priv.inc | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 159e791cdc..239d7de4e5 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -360,6 +360,8 @@ function local_user_set(& $user) { $user_shell = "/usr/local/bin/scponly"; } elseif (userHasPrivilege($user, "user-ssh-tunnel")) { $user_shell = "/usr/local/sbin/ssh_tunnel_shell"; + } elseif (userHasPrivilege($user, "user-ipsec-xauth-dialin")) { + $user_shell = "/sbin/nologin"; } else { $user_shell = "/sbin/nologin"; $lock_account = true; diff --git a/etc/inc/priv/user.priv.inc b/etc/inc/priv/user.priv.inc index 779f2bb15f..bfc7f59a73 100644 --- a/etc/inc/priv/user.priv.inc +++ b/etc/inc/priv/user.priv.inc @@ -21,6 +21,12 @@ $priv_list['user-ssh-tunnel']['descr'] = "Indicates whether the user is able to "Note: User - System - Copy files conflicts with ". "this privilege."; +$priv_list['user-ipsec-xauth-dialin'] = array(); +$priv_list['user-ipsec-xauth-dialin']['name'] = "User - VPN - IPsec xauth Dialin"; +$priv_list['user-ipsec-xauth-dialin']['descr'] = "Indicates whether the user is allowed to dial in via IPsec xauth ". + "(Note: Does not allow shell access, but may allow ". + "the user to create ssh tunnels)"; + $priv_list['user-l2tp-dialin'] = array(); $priv_list['user-l2tp-dialin']['name'] = "User - VPN - L2TP Dialin"; $priv_list['user-l2tp-dialin']['descr'] = "Indicates whether the user is allowed to dial in via L2TP"; From 2db351a746212dbf43479440e6c12fcd592ebbfa Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 11:20:25 -0400 Subject: [PATCH 31/37] Send ntpdate output to syslog --- usr/local/sbin/ntpdate_sync_once.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/sbin/ntpdate_sync_once.sh b/usr/local/sbin/ntpdate_sync_once.sh index 508ce3e9fa..3983578aaa 100755 --- a/usr/local/sbin/ntpdate_sync_once.sh +++ b/usr/local/sbin/ntpdate_sync_once.sh @@ -4,7 +4,7 @@ NOTSYNCED="true" SERVER=`cat /cf/conf/config.xml | grep timeservers | cut -d">" -f2 | cut -d"<" -f1` while [ "$NOTSYNCED" = "true" ]; do - ntpdate $SERVER + ntpdate -s $SERVER if [ "$?" = "0" ]; then NOTSYNCED="false" fi From 54c185948cf9950c8bef29c9817633f3b9bdbef4 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 11:20:41 -0400 Subject: [PATCH 32/37] Don't unconditionally start ntpd after doing ntpdate, it might be disabled. --- usr/local/sbin/ntpdate_sync_once.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/usr/local/sbin/ntpdate_sync_once.sh b/usr/local/sbin/ntpdate_sync_once.sh index 3983578aaa..d2dc37b78b 100755 --- a/usr/local/sbin/ntpdate_sync_once.sh +++ b/usr/local/sbin/ntpdate_sync_once.sh @@ -10,8 +10,3 @@ while [ "$NOTSYNCED" = "true" ]; do fi sleep 5 done - -# Launch -- we have net. -killall ntpd 2>/dev/null -sleep 1 -/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf From edf99ce40cf56c804e02b54a22f11e212b556c6a Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 11:46:30 -0400 Subject: [PATCH 33/37] Rework ntpdate_sync_once.sh, so it makes sure ntp/ntpdate/itself are not running before trying to sync time, and then launch ntpd at the end for time sync (last commit was premature) --- usr/local/sbin/ntpdate_sync_once.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/usr/local/sbin/ntpdate_sync_once.sh b/usr/local/sbin/ntpdate_sync_once.sh index d2dc37b78b..e328ac4b4d 100755 --- a/usr/local/sbin/ntpdate_sync_once.sh +++ b/usr/local/sbin/ntpdate_sync_once.sh @@ -2,11 +2,18 @@ NOTSYNCED="true" SERVER=`cat /cf/conf/config.xml | grep timeservers | cut -d">" -f2 | cut -d"<" -f1` +pkill -f ntpdate_sync_once.sh while [ "$NOTSYNCED" = "true" ]; do - ntpdate -s $SERVER + # Ensure that ntpd and ntpdate are not running so that the socket we want will be free. + killall ntpd 2>/dev/null + killall ntpdate + sleep 1 + ntpdate -s -t 5 $SERVER if [ "$?" = "0" ]; then NOTSYNCED="false" fi sleep 5 done + +/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf \ No newline at end of file From ac6651c9458a7e86d33535932f89b43568a05b91 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 14:15:50 -0400 Subject: [PATCH 34/37] Make sure a theme directory actually exists before blindly using it. --- usr/local/www/head.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/head.inc b/usr/local/www/head.inc index 97c71115e8..84ad1e3d9f 100755 --- a/usr/local/www/head.inc +++ b/usr/local/www/head.inc @@ -7,7 +7,7 @@ * if user has selected a custom template, use it. * otherwise default to pfsense tempalte */ -if($config['theme'] <> "") +if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme'])) $g['theme'] = $config['theme']; else $g['theme'] = "pfsense"; From e9e06fb20532ecd9097854c053b43c474e9e4da5 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 8 Apr 2011 16:08:11 -0400 Subject: [PATCH 35/37] Fix copy/paste error --- usr/local/www/head.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/head.inc b/usr/local/www/head.inc index 84ad1e3d9f..a24be9e93e 100755 --- a/usr/local/www/head.inc +++ b/usr/local/www/head.inc @@ -7,7 +7,7 @@ * if user has selected a custom template, use it. * otherwise default to pfsense tempalte */ -if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme'])) +if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme']))) $g['theme'] = $config['theme']; else $g['theme'] = "pfsense"; From 4eb4b18a0fb3c39c5bbb241ad4f0366b6c5e890c Mon Sep 17 00:00:00 2001 From: jim-p Date: Sat, 9 Apr 2011 12:00:53 -0400 Subject: [PATCH 36/37] Revert changes to dhclient-script. Appears to have broken DNS servers from DHCP. Ticket #1428 --- sbin/dhclient-script | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sbin/dhclient-script b/sbin/dhclient-script index ccbde7d684..e51132e04b 100755 --- a/sbin/dhclient-script +++ b/sbin/dhclient-script @@ -232,14 +232,13 @@ add_new_resolv_conf() { if [ -n "$new_domain_name_servers" ]; then /bin/rm -f /var/etc/nameserver_$interface for nameserver in $new_domain_name_servers; do - nameserver_sanitized=`echo '$nameserver' | /usr/bin/egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)'` # Add a route to the nameserver out the correct interface # so that mulitple wans work correctly with multiple dns # also backup the nameserver for later route removal - echo '$nameserver_sanitized' >>/var/etc/nameserver_$interface - $ROUTE add $nameserver_sanitized -iface $interface + echo $nameserver >>/var/etc/nameserver_$interface + $ROUTE add $nameserver -iface $interface done - echo $new_domain_name | /usr/bin/egrep -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[0-9a-f]+:)' >/var/etc/searchdomain_$interface + echo $new_domain_name >/var/etc/searchdomain_$interface fi return 0 From 127eb8e0238061ca8a66e25c2089dddc1826ec4d Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 11 Apr 2011 16:58:13 -0400 Subject: [PATCH 37/37] Add a toggle under System > Advanced on the misc tab to enable/disable debug mode for racoon. --- etc/inc/vpn.inc | 3 ++- usr/local/www/system_advanced_misc.php | 28 ++++++++++++++++++++++++++ usr/local/www/vpn_ipsec.php | 4 +++- 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index f0641b7ba9..5ae79b455e 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -896,7 +896,8 @@ EOD; mwexec("/usr/local/sbin/setkey -F", false); sleep("0.1"); /* start racoon */ - mwexec("/usr/local/sbin/racoon -f {$g['varetc_path']}/racoon.conf", false); + $ipsecdebug = isset($config['ipsec']['racoondebug']) ? "-d -v" : ""; + mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/racoon.conf", false); sleep("0.1"); /* load SPD */ mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false); diff --git a/usr/local/www/system_advanced_misc.php b/usr/local/www/system_advanced_misc.php index b93301d839..590a955d81 100644 --- a/usr/local/www/system_advanced_misc.php +++ b/usr/local/www/system_advanced_misc.php @@ -47,11 +47,13 @@ require("guiconfig.inc"); require_once("functions.inc"); require_once("filter.inc"); require_once("shaper.inc"); +require_once("ipsec.inc"); require_once("vpn.inc"); $pconfig['harddiskstandby'] = $config['system']['harddiskstandby']; $pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']); $pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']); +$pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']); $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']); $pconfig['maxmss'] = $config['system']['maxmss']; $pconfig['powerd_enable'] = isset($config['system']['powerd_enable']); @@ -85,6 +87,19 @@ if ($_POST) { else unset($config['ipsec']['preferoldsa']); + $need_racoon_restart = false; + if($_POST['racoondebug_enable'] == "yes") { + if (!isset($config['ipsec']['racoondebug'])) { + $config['ipsec']['racoondebug'] = true; + $need_racoon_restart = true; + } + } else { + if (isset($config['ipsec']['racoondebug'])) { + unset($config['ipsec']['racoondebug']); + $need_racoon_restart = true; + } + } + if($_POST['maxmss_enable'] == "yes") { $config['system']['maxmss_enable'] = true; $config['system']['maxmss'] = $_POST['maxmss']; @@ -125,6 +140,8 @@ if ($_POST) { activate_powerd(); load_glxsb(); vpn_ipsec_configure_preferoldsa(); + if ($need_racoon_restart) + vpn_ipsec_force_reload(); } } @@ -258,6 +275,17 @@ function maxmss_checked(obj) { "option to always prefer old SAs over new ones."); ?> + + + + /> + +
+
+ + + diff --git a/usr/local/www/vpn_ipsec.php b/usr/local/www/vpn_ipsec.php index 40879f6660..465c6072cd 100755 --- a/usr/local/www/vpn_ipsec.php +++ b/usr/local/www/vpn_ipsec.php @@ -418,7 +418,9 @@ include("head.inc"); :
 - . + .
+ .
+ .