From 650b573bd8a435449178385a2d132f7f0002d309 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 18:45:25 +0000 Subject: [PATCH 01/22] Correctly handle aliases for the target on inetd rules. Otherwise bad parameters are passed to netcat(nc) and we DoS the host. --- etc/inc/filter.inc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 18f2d667e6..480b373f78 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1070,7 +1070,12 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $socktype = "stream"; $dash_u = ""; } - $reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n"; + $target = explode(" ", $target); + foreach ($target as $targip) { + if (empty($targip)) + continue; + $reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$targip} {$tda}\n"; + } } $inetdport++; } From 509e1202eb44b281f0fcbb295d1590331ba3b0d1 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 20:32:56 +0000 Subject: [PATCH 02/22] Correct log messages to not display port twice. --- etc/inc/voucher.inc | 4 ++-- etc/inc/xmlrpc_client.inc | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index f4b5e1ba1f..2d54f0765e 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -41,9 +41,9 @@ function xmlrpc_sync_voucher_disconnect($dbent, $syncip, $port, $password, $user global $g, $config; require_once("xmlrpc.inc"); if($port == "443") - $url = "https://{$syncip}:{$port}"; + $url = "https://{$syncip}"; else - $url = "http://{$syncip}:{$port}"; + $url = "http://{$syncip}"; /* Construct code that is run on remote machine */ $method = 'pfsense.exec_php'; diff --git a/etc/inc/xmlrpc_client.inc b/etc/inc/xmlrpc_client.inc index a3b9cad7aa..8b8a9a21bd 100644 --- a/etc/inc/xmlrpc_client.inc +++ b/etc/inc/xmlrpc_client.inc @@ -2077,4 +2077,4 @@ function XML_RPC_encode($php_val) * End: */ -?> \ No newline at end of file +?> From a34b8b3b774f1e967ce41fd4624a0ffeafc9578c Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 20:47:17 +0000 Subject: [PATCH 03/22] Display the correct error page if vouchers are active or if normal CP is active when default provided forms are used. --- etc/inc/captiveportal.inc | 78 +-------------------------------------- 1 file changed, 2 insertions(+), 76 deletions(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 7e93f464eb..6d71a42673 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -273,82 +273,8 @@ function captiveportal_configure() { if ($config['captiveportal']['page']['errtext']) $errtext = base64_decode($config['captiveportal']['page']['errtext']); else { - /* example page */ - $errtext = << - -
- -
- - - - - - - -
- - - {$g['product_name']} captive portal - - -
-
-
- - - - -
-
-
-
- - - - -
-
-
-
- - - \$PORTAL_MESSAGE\$ - - -
-
-
- - - - - - - - - -
Welcome to the {$g['product_name']} Captive Portal!
 
Username:
Password:
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- - - -EOD; + /* example page */ + $errtext = get_default_captive_portal_html(); } $fd = @fopen("{$g['varetc_path']}/captiveportal-error.html", "w"); From c5b3fa908a4a92d50542b0bd847765701de39c59 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 21:08:53 +0000 Subject: [PATCH 04/22] Allow to enable vouchers with the only things specified the voucher database synchronization since the other values will be fetched from it. --- .../www/services_captiveportal_vouchers.php | 57 +++++++++++-------- 1 file changed, 33 insertions(+), 24 deletions(-) diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index 2ad0217744..6c163fd400 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -168,33 +168,41 @@ if ($_POST) { /* input validation */ if ($_POST['enable']) { - $reqdfields = explode(" ", "charset rollbits ticketbits checksumbits publickey magic saveinterval"); - $reqdfieldsn = array(gettext("charset"),gettext("rollbits"),gettext("ticketbits"),gettext("checksumbits"),gettext("publickey"),gettext("magic"),gettext("saveinterval")); + if (!$_POST['vouchersyncusername']) { + $reqdfields = explode(" ", "charset rollbits ticketbits checksumbits publickey magic saveinterval"); + $reqdfieldsn = array(gettext("charset"),gettext("rollbits"),gettext("ticketbits"),gettext("checksumbits"),gettext("publickey"),gettext("magic"),gettext("saveinterval")); + } else { + $reqdfields = explode(" ", "vouchersyncdbip vouchersyncport vouchersyncpass vouchersyncusername"); + $reqdfieldsn = array(gettext("Synchronize Voucher Database IP"),gettext("Sync port"),gettext("Sync password"),gettext("Sync username")); + } do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); } - // Check for form errors - if ($_POST['charset'] && (strlen($_POST['charset'] < 2))) - $input_errors[] = gettext("Need at least 2 characters to create vouchers."); - if ($_POST['charset'] && (strpos($_POST['charset'],"\"")>0)) - $input_errors[] = gettext("Double quotes aren't allowed."); - if ($_POST['charset'] && (strpos($_POST['charset'],",")>0)) - $input_errors[] = "',' " . gettext("aren't allowed."); - if ($_POST['rollbits'] && (!is_numeric($_POST['rollbits']) || ($_POST['rollbits'] < 1) || ($_POST['rollbits'] > 31))) - $input_errors[] = gettext("# of Bits to store Roll Id needs to be between 1..31."); - if ($_POST['ticketbits'] && (!is_numeric($_POST['ticketbits']) || ($_POST['ticketbits'] < 1) || ($_POST['ticketbits'] > 16))) - $input_errors[] = gettext("# of Bits to store Ticket Id needs to be between 1..16."); - if ($_POST['checksumbits'] && (!is_numeric($_POST['checksumbits']) || ($_POST['checksumbits'] < 1) || ($_POST['checksumbits'] > 31))) - $input_errors[] = gettext("# of Bits to store checksum needs to be between 1..31."); - if ($_POST['saveinterval'] && (!is_numeric($_POST['saveinterval']) || ($_POST['saveinterval'] < 1))) - $input_errors[] = gettext("Save interval in minutes cant be negative."); - if ($_POST['publickey'] && (!strstr($_POST['publickey'],"BEGIN PUBLIC KEY"))) - $input_errors[] = gettext("This doesn't look like an RSA Public key."); - if ($_POST['privatekey'] && (!strstr($_POST['privatekey'],"BEGIN RSA PRIVATE KEY"))) - $input_errors[] = gettext("This doesn't look like an RSA Private key."); + if (!$_POST['vouchersyncusername']) { + // Check for form errors + if ($_POST['charset'] && (strlen($_POST['charset'] < 2))) + $input_errors[] = gettext("Need at least 2 characters to create vouchers."); + if ($_POST['charset'] && (strpos($_POST['charset'],"\"")>0)) + $input_errors[] = gettext("Double quotes aren't allowed."); + if ($_POST['charset'] && (strpos($_POST['charset'],",")>0)) + $input_errors[] = "',' " . gettext("aren't allowed."); + if ($_POST['rollbits'] && (!is_numeric($_POST['rollbits']) || ($_POST['rollbits'] < 1) || ($_POST['rollbits'] > 31))) + $input_errors[] = gettext("# of Bits to store Roll Id needs to be between 1..31."); + if ($_POST['ticketbits'] && (!is_numeric($_POST['ticketbits']) || ($_POST['ticketbits'] < 1) || ($_POST['ticketbits'] > 16))) + $input_errors[] = gettext("# of Bits to store Ticket Id needs to be between 1..16."); + if ($_POST['checksumbits'] && (!is_numeric($_POST['checksumbits']) || ($_POST['checksumbits'] < 1) || ($_POST['checksumbits'] > 31))) + $input_errors[] = gettext("# of Bits to store checksum needs to be between 1..31."); + if ($_POST['saveinterval'] && (!is_numeric($_POST['saveinterval']) || ($_POST['saveinterval'] < 1))) + $input_errors[] = gettext("Save interval in minutes cant be negative."); + if ($_POST['publickey'] && (!strstr($_POST['publickey'],"BEGIN PUBLIC KEY"))) + $input_errors[] = gettext("This doesn't look like an RSA Public key."); + if ($_POST['privatekey'] && (!strstr($_POST['privatekey'],"BEGIN RSA PRIVATE KEY"))) + $input_errors[] = gettext("This doesn't look like an RSA Private key."); + } if (!$input_errors) { + if (!$_POST['vouchersyncusername']) { $config['voucher']['enable'] = $_POST['enable'] ? true : false; $config['voucher']['charset'] = $_POST['charset']; $config['voucher']['rollbits'] = $_POST['rollbits']; @@ -206,6 +214,7 @@ if ($_POST) { $config['voucher']['privatekey'] = base64_encode($_POST['privatekey']); $config['voucher']['msgnoaccess'] = $_POST['msgnoaccess']; $config['voucher']['msgexpired'] = $_POST['msgexpired']; + } $config['voucher']['vouchersyncdbip'] = $_POST['vouchersyncdbip']; $config['voucher']['vouchersyncport'] = $_POST['vouchersyncport']; $config['voucher']['vouchersyncusername'] = $_POST['vouchersyncusername']; @@ -215,9 +224,9 @@ if ($_POST) { // Synchronize the voucher DB from the master node require_once("xmlrpc.inc"); if($config['voucher']['vouchersyncport'] == "443") - $url = "https://{$config['voucher']['vouchersyncdbip']}:{$config['voucher']['vouchersyncport']}"; + $url = "https://{$config['voucher']['vouchersyncdbip']}"; else - $url = "http://{$config['voucher']['vouchersyncdbip']}:{$config['voucher']['vouchersyncport']}"; + $url = "http://{$config['voucher']['vouchersyncdbip']}"; $execcmd = <<setCredentials($config['voucher']['vouchersyncusername'], $config['voucher']['vouchersyncpass']); $resp = $cli->send($msg, "250"); - if(!$resp) { + if(!is_object($resp)) { $error = "A communications error occurred while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; log_error($error); file_notice("CaptivePortalVoucherSync", $error, "Communications error occurred", ""); From 4fab0ce085c09fee4ed1383725fe45f880ddfe4e Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 21:20:07 +0000 Subject: [PATCH 05/22] Actually remember that the vouchers are enabled --- usr/local/www/services_captiveportal_vouchers.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index 6c163fd400..0bd442e72f 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -202,8 +202,8 @@ if ($_POST) { } if (!$input_errors) { + $config['voucher']['enable'] = $_POST['enable'] ? true : false; if (!$_POST['vouchersyncusername']) { - $config['voucher']['enable'] = $_POST['enable'] ? true : false; $config['voucher']['charset'] = $_POST['charset']; $config['voucher']['rollbits'] = $_POST['rollbits']; $config['voucher']['ticketbits'] = $_POST['ticketbits']; From 351b699013fb120fa78f7df17fe636f49c1285b8 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 21:56:38 +0000 Subject: [PATCH 06/22] Correctly synchronize the db of vouchers from master. Also correctly write it to the files since before it is only allowed during bootup and not from xmlrpc. --- etc/inc/voucher.inc | 13 ++- .../www/services_captiveportal_vouchers.php | 100 +++++++++--------- 2 files changed, 59 insertions(+), 54 deletions(-) diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index 2d54f0765e..5ff95ac8d0 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -301,8 +301,8 @@ function voucher_auth($voucher_received, $test = 0) { return $total_minutes; } -function voucher_configure() { - global $config, $g; +function voucher_configure($sync = false) { + global $config, $g; /* kill any running minicron */ killbypid("{$g['varrun_path']}/vouchercron.pid"); @@ -312,6 +312,8 @@ function voucher_configure() { if ($g['booting']) echo "Enabling voucher support... "; + if ($sync == true) + captiveportal_syslog("Writing voucher db from sync data..."); // start cron if we're asked to save runtime DB periodically // to XML config if it changed @@ -329,7 +331,7 @@ function voucher_configure() { $fd = fopen("{$g['varetc_path']}/voucher.public", "w"); if (!$fd) { captiveportal_syslog("Voucher error: cannot write voucher.public\n"); - unlock($voucherlck); + unlock($voucherlck); return 1; } fwrite($fd, $pubkey); @@ -348,7 +350,7 @@ function voucher_configure() { @chmod("{$g['varetc_path']}/voucher.cfg", 0600); unlock($voucherlck); - if ($g['booting'] && is_array($config['voucher']['roll'])) { + if (($g['booting'] || $sync == true) && is_array($config['voucher']['roll'])) { // create active and used DB per roll on ramdisk from config $a_roll = &$config['voucher']['roll']; @@ -375,7 +377,8 @@ function voucher_configure() { } unlock($voucherlck); - echo "done\n"; + if ($g['booting']) + echo "done\n"; } return 0; diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index 0bd442e72f..d6ffc55f4c 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -214,7 +214,9 @@ if ($_POST) { $config['voucher']['privatekey'] = base64_encode($_POST['privatekey']); $config['voucher']['msgnoaccess'] = $_POST['msgnoaccess']; $config['voucher']['msgexpired'] = $_POST['msgexpired']; - } + write_config(); + voucher_configure(); + } else { $config['voucher']['vouchersyncdbip'] = $_POST['vouchersyncdbip']; $config['voucher']['vouchersyncport'] = $_POST['vouchersyncport']; $config['voucher']['vouchersyncusername'] = $_POST['vouchersyncusername']; @@ -227,28 +229,22 @@ if ($_POST) { $url = "https://{$config['voucher']['vouchersyncdbip']}"; else $url = "http://{$config['voucher']['vouchersyncdbip']}"; + $execcmd = <<setCredentials($config['voucher']['vouchersyncusername'], $config['voucher']['vouchersyncpass']); $resp = $cli->send($msg, "250"); if(!is_object($resp)) { @@ -266,43 +262,47 @@ EOF; } else { log_error("The Captive Portal voucher database has been synchronized with {$url}:{$port} (pfsense.exec_php)."); } - $toreturn = XML_RPC_Decode($resp->value()); - if(!is_array($toreturn)) { - if($toreturn == "Authentication failed") - $input_errors[] = "Could not synchronize the voucher database: Authentication Failed."; - } else { - // If we received back the voucher roll and other information then store it. - if($toreturn['voucher']['roll']) - $config['voucher']['roll'] = $toreturn['voucher']['roll']; - if($toreturn['voucher']['rollbits']) - $config['voucher']['rollbits'] = $toreturn['voucher']['rollbits']; - if($toreturn['voucher']['ticketbits']) - $config['voucher']['ticketbits'] = $toreturn['voucher']['ticketbits']; - if($toreturn['voucher']['saveinterval']) - $config['voucher']['saveinterval'] = $toreturn['voucher']['saveinterval']; - if($toreturn['voucher']['checksumbits']) - $config['voucher']['checksumbits'] = $toreturn['voucher']['checksumbits']; - if($toreturn['voucher']['magic']) - $config['voucher']['magic'] = $toreturn['voucher']['magic']; - if($toreturn['voucher']['publickey']) - $config['voucher']['publickey'] = $toreturn['voucher']['publickey']; - if($toreturn['voucher']['privatekey']) - $config['voucher']['privatekey'] = $toreturn['voucher']['privatekey']; - if($toreturn['voucher']['msgnoaccess']) - $config['voucher']['msgnoaccess'] = $toreturn['voucher']['msgnoaccess']; - if($toreturn['voucher']['msgexpired']) - $config['voucher']['msgexpired'] = $toreturn['voucher']['msgexpired']; - if($toreturn['voucher']['msgnoaccess']) - $config['voucher']['msgnoaccess'] = $toreturn['voucher']['msgnoaccess']; - $savemsg = gettext("Voucher database has been synchronized from {$url}"); + if (!$input_errors) { + $toreturn = XML_RPC_Decode($resp->value()); + if(!is_array($toreturn)) { + if($toreturn == "Authentication failed") + $input_errors[] = "Could not synchronize the voucher database: Authentication Failed."; + } else { + // If we received back the voucher roll and other information then store it. + if($toreturn['voucher']['roll']) + $config['voucher']['roll'] = $toreturn['voucher']['roll']; + if($toreturn['voucher']['rollbits']) + $config['voucher']['rollbits'] = $toreturn['voucher']['rollbits']; + if($toreturn['voucher']['ticketbits']) + $config['voucher']['ticketbits'] = $toreturn['voucher']['ticketbits']; + if($toreturn['voucher']['saveinterval']) + $config['voucher']['saveinterval'] = $toreturn['voucher']['saveinterval']; + if($toreturn['voucher']['checksumbits']) + $config['voucher']['checksumbits'] = $toreturn['voucher']['checksumbits']; + if($toreturn['voucher']['magic']) + $config['voucher']['magic'] = $toreturn['voucher']['magic']; + if($toreturn['voucher']['publickey']) + $config['voucher']['publickey'] = $toreturn['voucher']['publickey']; + if($toreturn['voucher']['privatekey']) + $config['voucher']['privatekey'] = $toreturn['voucher']['privatekey']; + if($toreturn['voucher']['msgnoaccess']) + $config['voucher']['msgnoaccess'] = $toreturn['voucher']['msgnoaccess']; + if($toreturn['voucher']['msgexpired']) + $config['voucher']['msgexpired'] = $toreturn['voucher']['msgexpired']; + if($toreturn['voucher']['msgnoaccess']) + $config['voucher']['msgnoaccess'] = $toreturn['voucher']['msgnoaccess']; + $savemsg = gettext("Voucher database has been synchronized from {$url}:{$port}"); + + write_config(); + voucher_configure(true); + } } } - write_config(); - voucher_configure(); - if($savemsg && isset($config['voucher']['enable']) && !isset($config['captiveportal']['enable'])) - $savemsg .= "
"; - if (isset($config['voucher']['enable']) && !isset($config['captiveportal']['enable'])) - $savemsg .= gettext("Don't forget to configure and enable Captive Portal."); + } + if($savemsg && isset($config['voucher']['enable']) && !isset($config['captiveportal']['enable'])) + $savemsg .= "
"; + if (isset($config['voucher']['enable']) && !isset($config['captiveportal']['enable'])) + $savemsg .= gettext("Don't forget to configure and enable Captive Portal."); } } include("head.inc"); @@ -591,6 +591,8 @@ function enable_change(enable_change) {


+
+

From 3e404e0c6d1cf65bd95d3fbc5e4eedb38ee1feef Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 22:04:26 +0000 Subject: [PATCH 07/22] Make the two default page codes similar in regarding to redirurl in hope that when one voucher login succeeds it redirects to the url submmitted. --- etc/inc/captiveportal.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 6d71a42673..625695c418 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -57,6 +57,7 @@ function get_default_captive_portal_html() {
+
@@ -94,7 +95,6 @@ function get_default_captive_portal_html() {
Enter Voucher Code: -
From 2fe347eb723969d83ed57fc12bbeff9dabde36c8 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 22:33:52 +0000 Subject: [PATCH 08/22] Actually correctly report the timeleft in log messages. This is mostly cosmetic. --- etc/inc/voucher.inc | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index 5ff95ac8d0..55c03431a6 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -89,15 +89,15 @@ function xmlrpc_sync_used_voucher($voucher_received, $syncip, $port, $password, global $g, $config; require_once("xmlrpc.inc"); if($port == "443") - $url = "https://{$syncip}:{$port}"; + $url = "https://{$syncip}"; else - $url = "http://{$syncip}:{$port}"; + $url = "http://{$syncip}"; /* Construct code that is run on remote machine */ $method = 'pfsense.exec_php'; $execcmd = << count($config['voucher']['roll'])) { $config['voucher']['roll'] = $toreturn['voucher']['roll']; write_config("Captive Portal Voucher database synchronized with {$url}"); - voucher_configure(); + voucher_configure(true); } return $toreturn['timeleft']; @@ -230,12 +230,12 @@ function voucher_auth($voucher_received, $test = 0) { } } else { $test_result[] = "$voucher ($roll/$nr): not found on any registererd Roll"; - captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll"); + captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll"); } } else { // hmm, thats weird ... not what I expected $test_result[] = "$voucher invalid: $result !!"; - captiveportal_syslog("$voucher invalid: $result !!"); + captiveportal_syslog("$voucher invalid: $result !!"); $error++; } } @@ -247,7 +247,7 @@ function voucher_auth($voucher_received, $test = 0) { } else { $test_result[] = "Access granted for $total_minutes Minutes in total."; } - unlock($voucherlck); + unlock($voucherlck); return $test_result; } @@ -264,8 +264,8 @@ function voucher_auth($voucher_received, $test = 0) { // If we did a XMLRPC sync earlier check the timeleft if(!empty($a_voucher['vouchersyncdbip'])) - if($remote_time_used['timeleft'] < $total_minutes) - $total_minutes = $remote_time_used['timeleft']; + if($remote_time_used < $total_minutes) + $total_minutes = $remote_time_used; // All given vouchers were valid and this isn't simply a test. // Write back the used DB's From 3b68081f5a49e5b9eae96e35f8bf7f448acd89e1 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 22:44:13 +0000 Subject: [PATCH 09/22] Make the return values on error consistent with the normal return value. --- etc/inc/voucher.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index 55c03431a6..d5c040b8bc 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -119,12 +119,12 @@ EOF; $error = "A communications error occurred while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; log_error($error); file_notice("CaptivePortalVoucherSync", $error, "Communications error occurred", ""); - return array("timeleft" => "0"); + return 0; // $timeleft } elseif($resp->faultCode()) { $error = "An error code was received while attempting CaptivePortalVoucherSync XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); log_error($error); file_notice("CaptivePortalVoucherSync", $error, "Error code received", ""); - return array("timeleft" => "0"); + return 0; // $timeleft } else { log_error("CaptivePortalVoucherSync XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); } From cd2c71fcf695d1bc82d6c6c1b25a9a68e8a5837a Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 25 Mar 2011 23:33:45 +0000 Subject: [PATCH 10/22] Make sure that there is a value before using it as a redirection. --- etc/inc/captiveportal.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 625695c418..196d83cb1c 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -1740,7 +1740,7 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut /* redirect user to desired destination */ if (!empty($attributes['url_redirection'])) $my_redirurl = $attributes['url_redirection']; - else if ($config['captiveportal']['redirurl']) + else if (!empty($config['captiveportal']['redirurl'])) $my_redirurl = $config['captiveportal']['redirurl']; else $my_redirurl = $redirurl; From 63e18082bb98d51763e542d5c4094793b300eb60 Mon Sep 17 00:00:00 2001 From: jim-p Date: Sat, 26 Mar 2011 17:21:55 -0400 Subject: [PATCH 11/22] Backing this out to see if it unbreaks NanoBSD upgrades with packages involved. Revert "Workaround for conf_mount_rw/ro during boot to only allow it to change at the start and end. Fixes #1279" This reverts commit 548be1fd6697ab115cbb29d61bc5507744488094. --- etc/inc/config.lib.inc | 13 +++++-------- etc/rc.bootup | 4 ++-- etc/sshd | 6 +++--- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 586d6873b0..11e1ec3beb 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -301,16 +301,13 @@ EOD; * null ******/ /* mount flash card read/write */ -function conf_mount_rw($nobootcheck = false) { +function conf_mount_rw() { global $g; /* do not mount on cdrom platform */ if($g['platform'] == "cdrom" or $g['platform'] == "pfSense") return; - if($g['booting'] && !$nobootcheck) - return; - if (refcount_reference(1000) > 1) return; @@ -324,7 +321,7 @@ function conf_mount_rw($nobootcheck = false) { /* if the platform is soekris or wrap or pfSense, lets mount the * compact flash cards root. - */ + */ $status = mwexec("/sbin/mount -u -w -o sync,noatime /"); /* we could not mount this correctly. kick off fsck */ if($status <> 0) { @@ -342,14 +339,14 @@ function conf_mount_rw($nobootcheck = false) { * RESULT * null ******/ -function conf_mount_ro($nobootcheck = false) { +function conf_mount_ro() { global $g; /* do not umount on cdrom or pfSense platforms */ if($g['platform'] == "cdrom" or $g['platform'] == "pfSense") return; - if($g['booting'] && !$nobootcheck) + if($g['booting']) return; if (refcount_unreference(1000) > 0) @@ -855,4 +852,4 @@ function set_device_perms() { } } -?> \ No newline at end of file +?> diff --git a/etc/rc.bootup b/etc/rc.bootup index b7a632ea3c..6cff6accd6 100755 --- a/etc/rc.bootup +++ b/etc/rc.bootup @@ -129,7 +129,7 @@ $memory = get_memory(); $avail = $memory[0]; echo " done.\n"; -conf_mount_rw(true); +conf_mount_rw(); /* save dmesg output to file */ system_dmesg_save(); @@ -400,6 +400,6 @@ unset($g['booting']); led_normalize(); -conf_mount_ro(true); +conf_mount_ro(); ?> diff --git a/etc/sshd b/etc/sshd index 67fbe00258..28c8e55932 100755 --- a/etc/sshd +++ b/etc/sshd @@ -42,7 +42,7 @@ exit; } - conf_mount_rw(true); + conf_mount_rw(); function file_size($file) { $size = filesize($file); @@ -138,7 +138,7 @@ /* are we already running? if so exit */ if(is_subsystem_dirty('sshdkeys')) { - conf_mount_ro(true); + conf_mount_ro(); exit; } @@ -185,6 +185,6 @@ exec("mkdir /conf/sshd"); exec("/bin/cp -p /etc/ssh/ssh_host* /conf/sshd"); } - conf_mount_ro(true); + conf_mount_ro(); ?> From 974c5af72910433fbafeb9266018b1e2919a676a Mon Sep 17 00:00:00 2001 From: jim-p Date: Sat, 26 Mar 2011 17:27:33 -0400 Subject: [PATCH 12/22] Actually if /etc/sshd is already running, doing a conf_mount_ro() would be a bad thing, as the other process still expects rw. --- etc/sshd | 1 - 1 file changed, 1 deletion(-) diff --git a/etc/sshd b/etc/sshd index 28c8e55932..0664b219fd 100755 --- a/etc/sshd +++ b/etc/sshd @@ -138,7 +138,6 @@ /* are we already running? if so exit */ if(is_subsystem_dirty('sshdkeys')) { - conf_mount_ro(); exit; } From 17730d9d862d2bee9ca9e87c31ca10cf1bd460a7 Mon Sep 17 00:00:00 2001 From: jim-p Date: Sat, 26 Mar 2011 17:33:15 -0400 Subject: [PATCH 13/22] Only run conf_mount_rw here if there isn't another process going. --- etc/sshd | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/etc/sshd b/etc/sshd index 0664b219fd..a488729636 100755 --- a/etc/sshd +++ b/etc/sshd @@ -42,7 +42,10 @@ exit; } - conf_mount_rw(); + /* are we already running? if not, do conf_mount_rw(), otherwise it should already be rw */ + if(!is_subsystem_dirty('sshdkeys')) { + conf_mount_rw(); + } function file_size($file) { $size = filesize($file); From 7f2c8034fb5d31503ffb5921427a9be8f1eea0e3 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 28 Mar 2011 10:37:11 +0000 Subject: [PATCH 14/22] Test the existence of route_vpn_gateway variable and if set use it as a gateway. Recommended-by: http://forum.pfsense.org/index.php/topic,24436.msg158589.html#msg158589 --- usr/local/sbin/ovpn-linkup | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usr/local/sbin/ovpn-linkup b/usr/local/sbin/ovpn-linkup index 60489c2e6f..613822ccbb 100755 --- a/usr/local/sbin/ovpn-linkup +++ b/usr/local/sbin/ovpn-linkup @@ -2,7 +2,11 @@ # let the configuration system know that the ip has changed. #/usr/local/sbin/pfSctl -c "interface newip $interface" -/bin/echo $4 > /tmp/$1_router +if [ -n $route_vpn_gateway ]; then + /bin/echo $route_vpn_gateway > /tmp/$1_router +else + /bin/echo $4 > /tmp/$1_router +fi /usr/bin/touch /tmp/$1up # reload filter /usr/local/sbin/pfSctl -c "interface newip $1" From 8f587b1dbbac22da6b2198ca63c171bf25cf6d9c Mon Sep 17 00:00:00 2001 From: Warren Baker Date: Mon, 28 Mar 2011 16:46:57 +0200 Subject: [PATCH 15/22] Correct PPTP Clients alias address. The PPTP server address was been utlized instead, which resulted in an incorrect firewall rule when 'PPTP Clients' was configured. --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 480b373f78..a7c490fa7a 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1625,7 +1625,7 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { $src = "{$lansa}/{$lansn}"; break; case 'pptp': - $pptpsa = gen_subnet($FilterIflist['pptp']['ip'], $FilterIflist['pptp']['sn']); + $pptpsa = gen_subnet($FilterIflist['pptp']['sa'], $FilterIflist['pptp']['sn']); $pptpsn = $FilterIflist['pptp']['sn']; $src = "{$pptpsa}/{$pptpsn}"; break; From c6dfd2892306623d5b988a0955abb6eb343f9766 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 28 Mar 2011 12:16:08 -0400 Subject: [PATCH 16/22] In IPsec, s/mobileclients/client/, this was changed long ago in the config but not everywhere followed. --- etc/inc/easyrule.inc | 2 +- etc/inc/filter.inc | 4 ++-- usr/local/www/firewall_nat_1to1_edit.php | 2 +- usr/local/www/firewall_nat_edit.php | 2 +- usr/local/www/firewall_nat_out_edit.php | 2 +- usr/local/www/firewall_rules.php | 2 +- usr/local/www/firewall_rules_edit.php | 2 +- usr/local/www/status_graph.php | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/etc/inc/easyrule.inc b/etc/inc/easyrule.inc index 8ef72f4540..7b1c2b19a5 100644 --- a/etc/inc/easyrule.inc +++ b/etc/inc/easyrule.inc @@ -53,7 +53,7 @@ function easyrule_find_rule_interface($int) { $iflist['l2tp'] = "L2TP VPN"; /* add ipsec interfaces */ - if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])){ + if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])){ $iflist["enc0"] = "IPSEC"; } diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index a7c490fa7a..4ba78b361f 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -792,7 +792,7 @@ function filter_generate_optcfg_array() { $FilterIflist['pppoe'] = $oic; } /* add ipsec interfaces */ - if(isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) { + if(isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) { $oic = array(); $oic['if'] = 'enc0'; $oic['descr'] = 'IPsec'; @@ -2227,7 +2227,7 @@ EOD; /* add ipsec interfaces */ - if(isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) + if(isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) $ipfrules .= << $interfaces['pppoe'] = "PPPoE VPN"; /* add ipsec interfaces */ - if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) + if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) if(have_ruleint_access("enc0")) $interfaces["enc0"] = "IPsec"; diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php index db6d03d79d..4d960f2fa0 100755 --- a/usr/local/www/firewall_nat_out_edit.php +++ b/usr/local/www/firewall_nat_out_edit.php @@ -416,7 +416,7 @@ function poolopts_change() { $interfaces['pppoe'] = "PPPoE VPN"; /* add ipsec interfaces */ - if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) + if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) if(have_ruleint_access("enc0")) $interfaces["enc0"] = "IPsec"; diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index 8fa4670a8c..daf577a850 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -169,7 +169,7 @@ if (is_array($config['pppoes']['pppoe'])) { } /* add ipsec interfaces */ -if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) +if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) if(have_ruleint_access("enc0")) $iflist["enc0"] = "IPsec"; diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php index 29b0336ac1..c05151895e 100755 --- a/usr/local/www/firewall_rules_edit.php +++ b/usr/local/www/firewall_rules_edit.php @@ -692,7 +692,7 @@ include("head.inc"); if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) $interfaces['pppoe'] = "PPPoE VPN"; /* add ipsec interfaces */ - if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) + if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) if(have_ruleint_access("enc0")) $interfaces["enc0"] = "IPsec"; /* add openvpn/tun interfaces */ diff --git a/usr/local/www/status_graph.php b/usr/local/www/status_graph.php index 4527a71f2c..6c00da4242 100755 --- a/usr/local/www/status_graph.php +++ b/usr/local/www/status_graph.php @@ -163,7 +163,7 @@ function updateBandwidthHosts(data){ From 75c8044aa92930b8fac64874da9cd1a4457f07a5 Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 28 Mar 2011 13:51:35 -0400 Subject: [PATCH 17/22] Allow TCP and UDP for DHCP failover traffic. --- etc/inc/filter.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 4ba78b361f..709d1f6fd6 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2189,8 +2189,8 @@ EOD; if($config['dhcpd'][$on]['failover_peerip'] <> "") { $ipfrules .= << Date: Tue, 29 Mar 2011 08:19:50 +0000 Subject: [PATCH 18/22] Add back gre allowing rules since they are needed. --- etc/inc/filter.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 709d1f6fd6..a1c74ccc9a 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2158,6 +2158,7 @@ EOD; $ipfrules .= << Date: Tue, 29 Mar 2011 09:11:30 +0000 Subject: [PATCH 19/22] Trim spaces out to avoid problems from explode. --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index a1c74ccc9a..e6b27d5eb1 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1070,7 +1070,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $socktype = "stream"; $dash_u = ""; } - $target = explode(" ", $target); + $target = explode(" ", trim($target)); foreach ($target as $targip) { if (empty($targip)) continue; From 49bb5c074b918cf2f9e9992068ec04c329e1ee4b Mon Sep 17 00:00:00 2001 From: jim-p Date: Mon, 28 Mar 2011 16:42:23 -0400 Subject: [PATCH 20/22] Add some upgrade code for IPsec mobile clients. Passes php -l but needs more testing. --- etc/inc/upgrade_config.inc | 134 +++++++++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 268f903d00..207b1126df 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1090,6 +1090,140 @@ function upgrade_046_to_047() { $config['ipsec']['phase1'] = $a_phase1; $config['ipsec']['phase2'] = $a_phase2; } + + /* Upgrade Mobile IPsec */ + if (isset($config['ipsec']['mobileclients']) + && is_array($config['ipsec']['mobileclients']) + && is_array($config['ipsec']['mobileclients']['p1']) + && is_array($config['ipsec']['mobileclients']['p2'])) { + + if (isset($config['ipsec']['mobileclients']['enable'])) { + $config['ipsec']['client']['enable'] = true; + $config['ipsec']['client']['user_source'] = 'system'; + $config['ipsec']['client']['group_source'] = 'system'; + } + + $mobilecfg = $config['ipsec']['mobileclients']; + + $ph1ent = array(); + $ph1ent['ikeid'] = ++$ikeid; + + if (!isset($mobilecfg['enable'])) + $ph1ent['disabled'] = true; + + /* Assume WAN since mobile tunnels couldn't be on a separate interface on 1.2.x */ + $ph1ent['interface'] = 'wan'; + $ph1ent['descr'] = "Mobile Clients (upgraded)"; + $ph1ent['mode'] = $mobilecfg['p1']['mode']; + + if (isset($mobilecfg['p1']['myident']['myaddress'])) + $ph1ent['myid_type'] = "myaddress"; + if (isset($mobilecfg['p1']['myident']['address'])) { + $ph1ent['myid_type'] = "address"; + $ph1ent['myid_data'] = $mobilecfg['p1']['myident']['address']; + } + if (isset($mobilecfg['p1']['myident']['fqdn'])) { + $ph1ent['myid_type'] = "fqdn"; + $ph1ent['myid_data'] = $mobilecfg['p1']['myident']['fqdn']; + } + if (isset($mobilecfg['p1']['myident']['ufqdn'])) { + $ph1ent['myid_type'] = "user_fqdn"; + $ph1ent['myid_data'] = $mobilecfg['p1']['myident']['ufqdn']; + } + if (isset($mobilecfg['p1']['myident']['asn1dn'])) { + $ph1ent['myid_type'] = "asn1dn"; + $ph1ent['myid_data'] = $mobilecfg['p1']['myident']['asn1dn']; + } + if (isset($mobilecfg['p1']['myident']['dyn_dns'])) { + $ph1ent['myid_type'] = "dyn_dns"; + $ph1ent['myid_data'] = $mobilecfg['p1']['myident']['dyn_dns']; + } + $ph1ent['peerid_type'] = "fqdn"; + $ph1ent['peerid_data'] = ""; + + switch ($mobilecfg['p1']['encryption-algorithm']) { + case "des": + $ph1alg = array( 'name' => 'des' ); + break; + case "3des": + $ph1alg = array( 'name' => '3des' ); + break; + case "blowfish": + $ph1alg = array( 'name' => 'blowfish', 'keylen' => '128' ); + break; + case "cast128": + $ph1alg = array( 'name' => 'cast128' ); + break; + case "rijndael": + $ph1alg = array( 'name' => 'aes', 'keylen' => '128' ); + break; + case "rijndael 256": + $ph1alg = array( 'name' => 'aes', 'keylen' => '256' ); + break; + } + + $ph1ent['encryption-algorithm'] = $ph1alg; + $ph1ent['hash-algorithm'] = $mobilecfg['p1']['hash-algorithm']; + $ph1ent['dhgroup'] = $mobilecfg['p1']['dhgroup']; + $ph1ent['lifetime'] = $mobilecfg['p1']['lifetime']; + $ph1ent['authentication_method'] = $mobilecfg['p1']['authentication_method']; + + if (isset($mobilecfg['p1']['cert'])) + $ph1ent['cert'] = $mobilecfg['p1']['cert']; + if (isset($mobilecfg['p1']['peercert'])) + $ph1ent['peercert'] = $mobilecfg['p1']['peercert']; + if (isset($mobilecfg['p1']['private-key'])) + $ph1ent['private-key'] = $mobilecfg['p1']['private-key']; + + $ph1ent['nat_traversal'] = "on"; + $ph1ent['dpd_enable'] = 1; + $ph1ent['dpd_delay'] = 10; + $ph1ent['dpd_maxfail'] = 5; + $ph1ent['mobile'] = true; + + $ph2ent = array(); + $ph2ent['ikeid'] = $ph1ent['ikeid']; + $ph2ent['descr'] = "phase2 for ".$mobilecfg['descr']; + $ph2ent['localid'] = array('type' => 'none'); + $ph2ent['remoteid'] = array('type' => 'mobile'); + $ph2ent['protocol'] = $mobilecfg['p2']['protocol']; + + $aes_count = 0; + foreach( $mobilecfg['p2']['encryption-algorithm-option'] as $tunalg ) { + $aes_found = false; + switch ($tunalg) { + case "des": + $ph2alg = array( 'name' => 'des' ); + break; + case "3des": + $ph2alg = array( 'name' => '3des' ); + break; + case "blowfish": + $ph2alg = array( 'name' => 'blowfish', 'keylen' => 'auto' ); + break; + case "cast128": + $ph2alg = array( 'name' => 'cast128' ); + break; + case "rijndael": + case "rijndael 256": + $ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' ); + $aes_found = true; + $aes_count++; + break; + } + + if( !$aes_found || ($aes_count < 2)) + $ph2ent['encryption-algorithm-option'][] = $ph2alg; + } + $ph2ent['hash-algorithm-option'] = $mobilecfg['p2']['hash-algorithm-option']; + $ph2ent['pfsgroup'] = $mobilecfg['p2']['pfsgroup']; + $ph2ent['lifetime'] = $mobilecfg['p2']['lifetime']; + $ph2ent['mobile'] = true; + + $config['ipsec']['phase1'][] = $ph1ent; + $config['ipsec']['phase2'][] = $ph2ent; + unset($config['ipsec']['mobileclients']); + } } From 92273f2459a8883114eb44e4fae595ed95f18199 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 29 Mar 2011 11:06:33 -0400 Subject: [PATCH 21/22] Fix spamd rrd graph command. --- usr/local/www/status_rrd_graph_img.php | 72 +++++++++++++------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index 2094a87b04..22802bc23b 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -860,42 +860,42 @@ elseif((strstr($curdatabase, "-quality.rrd")) && (file_exists("$rrddbpath$curdat } elseif((strstr($curdatabase, "spamd.rrd")) && (file_exists("$rrddbpath$curdatabase"))) { /* graph a spamd statistics graph */ - $graphcmd = "$rrdtool graph $rrdtmppath$curdatabase-$curgraph.png "; - $graphcmd .= "--start $start --end $end "; - $graphcmd .= "--title \"`hostname` - {$prettydb} - {$hperiod} - {$havg} average\" "; - $graphcmd .= "--color SHADEA#eeeeee --color SHADEB#eeeeee "; - $graphcmd .= "--vertical-label=\"Conn / Time, sec.\" "; - $graphcmd .= "--height 200 --width 620 --no-gridfit "; - $graphcmd .= "--lower-limit 0 "; - $graphcmd .= "DEF:\"consmin=$rrddbpath$curdatabase:conn:MIN\" "; - $graphcmd .= "DEF:\"consavg=$rrddbpath$curdatabase:conn:AVERAGE\" "; - $graphcmd .= "DEF:\"consmax=$rrddbpath$curdatabase:conn:MAX\" "; - $graphcmd .= "DEF:\"timemin=$rrddbpath$curdatabase:time:MIN\" "; - $graphcmd .= "DEF:\"timeavg=$rrddbpath$curdatabase:time:AVERAGE\" "; - $graphcmd .= "DEF:\"timemax=$rrddbpath$curdatabase:time:MAX\" "; - $graphcmd .= "CDEF:\"timeminadj=timemin,0,86400,LIMIT,UN,0,timemin,IF\" "; - $graphcmd .= "CDEF:\"timeavgadj=timeavg,0,86400,LIMIT,UN,0,timeavg,IF\" "; - $graphcmd .= "CDEF:\"timemaxadj=timemax,0,86400,LIMIT,UN,0,timemax,IF\" "; - $graphcmd .= "CDEF:\"t1=timeminadj,timeavgadj,+,2,/,timeminadj,-\" "; - $graphcmd .= "CDEF:\"t2=timeavgadj,timemaxadj,+,2,/,timeminadj,-,t1,-\" "; - $graphcmd .= "CDEF:\"t3=timemaxadj,timeminadj,-,t1,-,t2,-\" "; - $graphcmd .= "AREA:\"timeminadj\" "; - $graphcmd .= "AREA:\"t1#$colorspamdtime[0]::STACK\" "; - $graphcmd .= "AREA:\"t2#$colorspamdtime[1]::STACK\" "; - $graphcmd .= "AREA:\"t3#$colorspamdtime[2]::STACK\" "; - $graphcmd .= "LINE2:\"timeavgadj#$colorspamdtime[3]:\"Time \" "; - $graphcmd .= "GPRINT:\"timeminadj:MIN:\"Min\\:%6.2lf\\t\" "; - $graphcmd .= "GPRINT:\"timeavgadj:AVERAGE:\"Avg\\:%6.2lf\\t\" "; - $graphcmd .= "GPRINT:\"timemaxadj:MAX:\"Max\\:%6.2lf\\n\" "; - $graphcmd .= "AREA:\"consmax#$colorspamdconn[0]\" "; - $graphcmd .= "AREA:\"consmin#$colorspamdconn[1]\" "; - $graphcmd .= "LINE1:\"consmin#$colorspamdconn[2]\" "; - $graphcmd .= "LINE1:\"consmax#$colorspamdconn[3]\" "; - $graphcmd .= "LINE1:\"consavg#$colorspamdconn[4]:\"Cons \" "; - $graphcmd .= "GPRINT:\"consmin:MIN:\"Min\\:%6.2lf\\t\" "; - $graphcmd .= "GPRINT:\"consavg:AVERAGE:\"Avg\\:%6.2lf\\t\" "; - $graphcmd .= "GPRINT:\"consmax:MAX:\"Max\\:%6.2lf\\n\" "; - $graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; + $graphcmd = "$rrdtool graph $rrdtmppath$curdatabase-$curgraph.png \\ + --start $start --end $end \\ + --title \"`hostname` - {$prettydb} - {$hperiod} - {$havg} average\" \\ + --color SHADEA#eeeeee --color SHADEB#eeeeee \\ + --vertical-label=\"Conn / Time, sec.\" \\ + --height 200 --width 620 --no-gridfit \\ + --lower-limit 0 \\ + DEF:consmin=$rrddbpath$curdatabase:conn:MIN \\ + DEF:consavg=$rrddbpath$curdatabase:conn:AVERAGE \\ + DEF:consmax=$rrddbpath$curdatabase:conn:MAX \\ + DEF:timemin=$rrddbpath$curdatabase:time:MIN \\ + DEF:timeavg=$rrddbpath$curdatabase:time:AVERAGE \\ + DEF:timemax=$rrddbpath$curdatabase:time:MAX \\ + \"CDEF:timeminadj=timemin,0,86400,LIMIT,UN,0,timemin,IF\" \\ + \"CDEF:timeavgadj=timeavg,0,86400,LIMIT,UN,0,timeavg,IF\" \\ + \"CDEF:timemaxadj=timemax,0,86400,LIMIT,UN,0,timemax,IF\" \\ + \"CDEF:t1=timeminadj,timeavgadj,+,2,/,timeminadj,-\" \\ + \"CDEF:t2=timeavgadj,timemaxadj,+,2,/,timeminadj,-,t1,-\" \\ + \"CDEF:t3=timemaxadj,timeminadj,-,t1,-,t2,-\" \\ + AREA:timeminadj \\ + AREA:t1#$colorspamdtime[0]::STACK \\ + AREA:t2#$colorspamdtime[1]::STACK \\ + AREA:t3#$colorspamdtime[2]::STACK \\ + LINE2:timeavgadj#$colorspamdtime[3]:\"Time \" \\ + GPRINT:timeminadj:MIN:\"Min\\:%6.2lf\\t\" \\ + GPRINT:timeavgadj:AVERAGE:\"Avg\\:%6.2lf\\t\" \\ + GPRINT:timemaxadj:MAX:\"Max\\:%6.2lf\\n\" \\ + AREA:consmax#$colorspamdconn[0] \\ + AREA:consmin#$colorspamdconn[1] \\ + LINE1:consmin#$colorspamdconn[2] \\ + LINE1:consmax#$colorspamdconn[3] \\ + LINE1:consavg#$colorspamdconn[4]:\"Cons \" \\ + GPRINT:consmin:MIN:\"Min\\:%6.2lf\\t\" \\ + GPRINT:consavg:AVERAGE:\"Avg\\:%6.2lf\\t\" \\ + GPRINT:consmax:MAX:\"Max\\:%6.2lf\\n\" \\ + COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; } elseif((strstr($curdatabase, "-cellular.rrd")) && (file_exists("$rrddbpath$curdatabase"))) { $graphcmd = "$rrdtool graph $rrdtmppath$curdatabase-$curgraph.png "; From a5187d43751edccce1aceb7efec96aae91d616dc Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 29 Mar 2011 12:00:02 -0400 Subject: [PATCH 22/22] Check for "aes 256" as IPsec encryption type, not just rijndael. --- etc/inc/upgrade_config.inc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 207b1126df..de5c6000f3 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -982,6 +982,7 @@ function upgrade_046_to_047() { $ph1alg = array( 'name' => 'aes', 'keylen' => '128' ); break; case "rijndael 256": + case "aes 256": $ph1alg = array( 'name' => 'aes', 'keylen' => '256' ); break; } @@ -1066,6 +1067,7 @@ function upgrade_046_to_047() { break; case "rijndael": case "rijndael 256": + case "aes 256": $ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' ); $aes_found = true; $aes_count++; @@ -1158,6 +1160,7 @@ function upgrade_046_to_047() { $ph1alg = array( 'name' => 'aes', 'keylen' => '128' ); break; case "rijndael 256": + case "aes 256": $ph1alg = array( 'name' => 'aes', 'keylen' => '256' ); break; } @@ -1206,6 +1209,7 @@ function upgrade_046_to_047() { break; case "rijndael": case "rijndael 256": + case "aes 256": $ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' ); $aes_found = true; $aes_count++;