From 5132312f763cf5b4fbbd2e66257eeea46b72accd Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 11 Feb 2015 06:59:02 -0200 Subject: [PATCH 1/8] Remove unset variable, spotted by phil-davis --- etc/inc/unbound.inc | 1 - 1 file changed, 1 deletion(-) diff --git a/etc/inc/unbound.inc b/etc/inc/unbound.inc index bf7f285ecd..b77f09a2ef 100644 --- a/etc/inc/unbound.inc +++ b/etc/inc/unbound.inc @@ -304,7 +304,6 @@ rrset-cache-size: {$rrset_cache_size}m {$optimization['rrset_cache_slabs']} {$optimization['infra_cache_slabs']} {$optimization['key_cache_slabs']} -{$optimization['rrset_cache_size']} outgoing-range: 4096 {$optimization['so_rcvbuf']} {$anchor_file} From 4ab7f8f4e8517fb4dfba4706327b992a9676a521 Mon Sep 17 00:00:00 2001 From: Phil Davis Date: Wed, 11 Feb 2015 13:13:58 +0545 Subject: [PATCH 2/8] Fix typo in class in bridge edit Fixing this makes nice little pencil icons appear in front of the text entry fields. --- usr/local/www/interfaces_bridge_edit.php | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/usr/local/www/interfaces_bridge_edit.php b/usr/local/www/interfaces_bridge_edit.php index 0fd62f0863..bb68e63b26 100644 --- a/usr/local/www/interfaces_bridge_edit.php +++ b/usr/local/www/interfaces_bridge_edit.php @@ -344,7 +344,7 @@ function show_source_port_range() { - +
- +
- +
- +
- +
$ifdescr) - echo ""; + echo ""; ?>
{$ifdescr}
{$ifdescr}
@@ -407,7 +407,7 @@ function show_source_port_range() { $ifdescr) - echo ""; + echo ""; ?>
{$ifdescr}
{$ifdescr}
@@ -424,7 +424,7 @@ function show_source_port_range() { - +
@@ -434,7 +434,7 @@ function show_source_port_range() { - +
Date: Wed, 11 Feb 2015 12:52:14 +0545 Subject: [PATCH 3/8] Random text typos that I noticed. --- etc/inc/captiveportal.inc | 2 +- etc/inc/interfaces.inc | 16 ++++++++-------- etc/inc/system.inc | 6 +++--- etc/inc/upgrade_config.inc | 6 +++--- etc/inc/voucher.inc | 16 ++++++++-------- usr/local/www/system_camanager.php | 2 +- usr/local/www/system_certmanager.php | 2 +- 7 files changed, 25 insertions(+), 25 deletions(-) diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index a0da275601..f6c09309c8 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -795,7 +795,7 @@ function captiveportal_prune_old() { captiveportal_prune_old_automac(); if ($voucher_needs_sync == true) - /* Triger a sync of the vouchers on config */ + /* Trigger a sync of the vouchers on config */ send_event("service sync vouchers"); /* write database */ diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 16ad94c0d1..7903f6a0a7 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -171,7 +171,7 @@ function interface_netgraph_needed($interface = "wan") { pfSense_ngctl_detach("{$realif}:", $realif); } /* NOTE: We make sure for this on interface_ppps_configure() - * no need to do it here agan. + * no need to do it here again. * else * pfSense_ngctl_attach(".", $realif); */ @@ -1507,7 +1507,7 @@ function interface_ppps_configure($interface) { } break; default: - log_error(sprintf(gettext("Unkown %s configured as ppp interface."), $type)); + log_error(sprintf(gettext("Unknown %s configured as ppp interface."), $type)); break; } } @@ -2113,7 +2113,7 @@ function interface_carp_configure(&$vip) { if ($vip['mode'] != "carp") return; - /* NOTE: Maybe its useless nowdays */ + /* NOTE: Maybe its useless nowadays */ $realif = get_real_interface($vip['interface']); if (!does_interface_exist($realif)) { file_notice("CARP", sprintf(gettext("Interface specified for the virtual IP address %s does not exist. Skipping this VIP."), $vip['subnet']), "Firewall: Virtual IP", ""); @@ -2369,7 +2369,7 @@ function interface_wireless_configure($if, &$wl, &$wlcfg) { $wlcmd[] = "-mediaopt adhoc"; } - /* Not neccesary to set BSS mode as this is default if adhoc and/or hostap is NOT set */ + /* Not necessary to set BSS mode as this is default if adhoc and/or hostap is NOT set */ /* handle hide ssid option */ if(isset($wlcfg['hidessid']['enable'])) { @@ -3120,10 +3120,10 @@ function interface_track6_configure($interface = "lan", $wancfg, $linkupevent = case "dhcp6": if ($linkupevent == true) { /* - * NOTE: Usually come here from rc.linkup calling so just call directly intead of generating event + * NOTE: Usually come here from rc.linkup calling so just call directly instead of generating event * Instead of disrupting all other v4 configuration just restart DHCPv6 client for now * - * XXX: Probably DHCPv6 client should handle this autmagically itself? + * XXX: Probably DHCPv6 client should handle this automagically itself? */ $parentrealif = get_real_interface($wancfg['track6-interface']); $pidv6 = find_dhcp6c_process($parentrealif); @@ -3907,7 +3907,7 @@ function DHCP_Config_File_Substitutions($wancfg, $wanif, $dhclientconf) { $res = stripos($dhclientconf, $various_mac_type . $various_mac_case . $various_mac_delimiter); if ($res !== false) { - /* Get MAC Address as ASCII String With Colon (:) Celimiters */ + /* Get MAC Address as ASCII String With Colon (:) delimiters */ if ("$various_mac_case" == "U") $dhcpclientconf_mac = strtoupper(get_interface_mac($wanif)); if ("$various_mac_case" == "L") $dhcpclientconf_mac = strtolower(get_interface_mac($wanif)); @@ -4214,7 +4214,7 @@ function get_real_interface($interface = "wan", $family = "all", $realv6iface = $wanif = "ppp"; break; default: - // If a real interface was alread passed simply + // If a real interface was already passed simply // pass the real interface back. This encourages // the usage of this function in more cases so that // we can combine logic for more flexibility. diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 205515c218..3f81e0e13f 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -939,7 +939,7 @@ function system_webgui_create_certificate() { 'organizationName' => "{$g['product_name']} webConfigurator Self-Signed Certificate", 'emailAddress' => "admin@{$config['system']['hostname']}.{$config['system']['domain']}", 'commonName' => "{$config['system']['hostname']}-{$cert['refid']}"); - $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warings directly to a page screwing menu tab */ + $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warnings directly to a page screwing menu tab */ if (!cert_create($cert, null, 2048, 2000, $dn, "self-signed", "sha256")){ while($ssl_err = openssl_error_string()){ log_error("Error creating WebGUI Certificate: openssl library returns: " . $ssl_err); @@ -1235,7 +1235,7 @@ mimetype.assign = ( url.access-deny = ( "~", ".inc" ) -######### Options that are good to be but not neccesary to be changed ####### +######### Options that are good to be but not necessary to be changed ####### ## bind to port (default: 80) @@ -1746,7 +1746,7 @@ function system_ntp_configure($start_ntpd=true) { } } - /* open configuration for wrting or bail */ + /* open configuration for writing or bail */ if (!@file_put_contents("{$g['varetc_path']}/ntpd.conf", $ntpcfg)) { log_error("Could not open {$g['varetc_path']}/ntpd.conf for writing"); return; diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 690db4596f..59f12e83d2 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1869,7 +1869,7 @@ function upgrade_052_to_053() { if (!is_array($config['cert'])) $config['cert'] = array(); - /* migrate advanced admin page webui ssl to certifcate mngr */ + /* migrate advanced admin page webui ssl to certificate manager */ if ($config['system']['webgui']['certificate'] && $config['system']['webgui']['private-key']) { @@ -2631,7 +2631,7 @@ function upgrade_078_to_079() { function upgrade_079_to_080() { global $config; - /* Upgrade config in 1.2.3 specifying a username other than admin for synching. */ + /* Upgrade config in 1.2.3 specifying a username other than admin for syncing. */ if (!empty($config['system']['username']) && is_array($config['installedpackages']['carpsettings']) && is_array($config['installedpackages']['carpsettings']['config'])) { $config['installedpackages']['carpsettings']['config'][0]['username'] = $config['system']['username']; @@ -2985,7 +2985,7 @@ function upgrade_088_to_089() { if (!is_array($config['cert'])) $config['cert'] = array(); - /* migrate captive portal ssl to certifcate mngr */ + /* migrate captive portal ssl to certificate manager */ if (is_array($config['captiveportal'])) { foreach ($config['captiveportal'] as $id => &$setting) { if (isset($setting['httpslogin'])) { diff --git a/etc/inc/voucher.inc b/etc/inc/voucher.inc index f9b41b35f5..f6b7248a20 100644 --- a/etc/inc/voucher.inc +++ b/etc/inc/voucher.inc @@ -284,7 +284,7 @@ function voucher_expire($voucher_received) { $unsetindexes[] = $cpentry[5]; } } else - captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll"); + captiveportal_syslog("$voucher ($roll/$nr): not found on any registered Roll"); } else // hmm, thats weird ... not what I expected captiveportal_syslog("$voucher invalid: {$output[0]}!!"); @@ -296,7 +296,7 @@ function voucher_expire($voucher_received) { voucher_write_active_db($roll, $active); unset($active_vouchers); - /* Triger a sync of the vouchers on config */ + /* Trigger a sync of the vouchers on config */ send_event("service sync vouchers"); } @@ -412,8 +412,8 @@ function voucher_auth($voucher_received, $test = 0) { } } } else { - $test_result[] = "$voucher ($roll/$nr): not found on any registererd Roll"; - captiveportal_syslog("$voucher ($roll/$nr): not found on any registererd Roll"); + $test_result[] = "$voucher ($roll/$nr): not found on any registered Roll"; + captiveportal_syslog("$voucher ($roll/$nr): not found on any registered Roll"); } } else { // hmm, thats weird ... not what I expected @@ -480,7 +480,7 @@ function voucher_auth($voucher_received, $test = 0) { $active_vouchers[$first_voucher_roll][$first_voucher] = "$timestamp,$minutes"; voucher_write_active_db($first_voucher_roll, $active_vouchers[$first_voucher_roll]); - /* Triger a sync of the vouchers on config */ + /* Trigger a sync of the vouchers on config */ send_event("service sync vouchers"); unlock($voucherlck); @@ -560,7 +560,7 @@ function voucher_configure_zone($sync = false) { $timestamp = $activent['timestamp']; $minutes = $activent['minutes']; // its tempting to check for expired timestamps, but during - // bootup, we most likely don't have the correct time time. + // bootup, we most likely don't have the correct time. $active_vouchers[$voucher] = "$timestamp,$minutes"; } } @@ -613,7 +613,7 @@ function voucher_read_active_db($roll) { if ($dirty) { // if we found expired entries, lets save our snapshot voucher_write_active_db($roll, $active); - /* Triger a sync of the vouchers on config */ + /* Trigger a sync of the vouchers on config */ send_event("service sync vouchers"); } } @@ -735,7 +735,7 @@ function voucher_save_db_to_config_zone() { unlock($voucherlck); - write_config("Synching vouchers"); + write_config("Syncing vouchers"); return; } diff --git a/usr/local/www/system_camanager.php b/usr/local/www/system_camanager.php index a4bcea64d7..cc73b519e0 100644 --- a/usr/local/www/system_camanager.php +++ b/usr/local/www/system_camanager.php @@ -253,7 +253,7 @@ if ($_POST) { if (!empty($pconfig['key'])) $ca['prv'] = base64_encode($pconfig['key']); } else { - $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warings directly to a page screwing menu tab */ + $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warnings directly to a page screwing menu tab */ if ($pconfig['method'] == "existing") ca_import($ca, $pconfig['cert'], $pconfig['key'], $pconfig['serial']); diff --git a/usr/local/www/system_certmanager.php b/usr/local/www/system_certmanager.php index 8082cd69d9..e6c7551b48 100644 --- a/usr/local/www/system_certmanager.php +++ b/usr/local/www/system_certmanager.php @@ -339,7 +339,7 @@ if ($_POST) { $cert['descr'] = $pconfig['descr']; - $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warings directly to a page screwing menu tab */ + $old_err_level = error_reporting(0); /* otherwise openssl_ functions throw warnings directly to a page screwing menu tab */ if ($pconfig['method'] == "import") cert_import($cert, $pconfig['cert'], $pconfig['key']); From 302cb96e7b4eb0515f406d69d7911dbca61cbee7 Mon Sep 17 00:00:00 2001 From: Phil Davis Date: Tue, 10 Feb 2015 23:35:16 +0545 Subject: [PATCH 4/8] Check if notification is disabled in send_smtp_message() Other packages like arpwatch sm.php and cron job output as reported in forum https://forum.pfsense.org/index.php?topic=88347.0 call send_smtp_message() directly, currently bypassing notification disabled checks. I think those packages [are intended to | should be] respecting the notifications disabled setting. People in the forum certainly expect them to respect this setting. If we add the $force parameter here, passing it through from notify_via_smtp() then the default behavior of send_smtp_message() can be to respect the "disable" setting. That should stop other package callers from spamming people who have disabled SMTP notifications. If a package really wants/needs to send regardless, then it can set $force, just like the "Test SMTP" button does. --- etc/inc/notices.inc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/inc/notices.inc b/etc/inc/notices.inc index 044453533d..bad3a32600 100644 --- a/etc/inc/notices.inc +++ b/etc/inc/notices.inc @@ -295,15 +295,18 @@ function notify_via_smtp($message, $force = false) { fwrite($fd, $message); fclose($fd); - send_smtp_message($message, "{$config['system']['hostname']}.{$config['system']['domain']} - Notification"); + send_smtp_message($message, "{$config['system']['hostname']}.{$config['system']['domain']} - Notification", $force); return; } -function send_smtp_message($message, $subject = "(no subject)") { +function send_smtp_message($message, $subject = "(no subject)", $force = false) { global $config, $g; require_once("sasl.inc"); require_once("smtp.inc"); + if(isset($config['notifications']['smtp']['disable']) && !$force) + return; + if(!$config['notifications']['smtp']['ipaddress']) return; From 2de650f6117f4b80c3db4f9b46ad83d75d5b9130 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ermal=20LU=C3=87I?= Date: Wed, 11 Feb 2015 20:26:48 +0100 Subject: [PATCH 5/8] Fixes #4389 The VIP interfaces cannot be assigned since they are just an identification of the VIP for tracking. Consider that when configuring gif/gre. Also on bridges you cannot set a vip interface as its member. --- etc/inc/interfaces.inc | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 7903f6a0a7..88bdeff7d3 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -421,8 +421,6 @@ function interfaces_bridge_configure($checkmember = 0, $realif = "") { } } else if ($checkmember == 2) { - if (!strstr($bridge['if'], "_vip")) - continue; $members = explode(',', $bridge['members']); foreach ($members as $member) { if (empty($config['interfaces'][$bridge['if']]) || $config['interfaces'][$bridge['if']]['ipaddrv6'] != "track6") @@ -725,9 +723,7 @@ function interfaces_gre_configure($checkparent = 0, $realif = "") { continue; } else if ($checkparent == 2) { - if (!strstr($gre['if'], "_vip")) - continue; - if (empty($config['interfaces'][$gre['if']]) || $config['interfaces'][$gre['if']]['ipaddrv6'] != "track6") + if (!strstr($gre['if'], "_vip") && (empty($config['interfaces'][$gre['if']]) || $config['interfaces'][$gre['if']]['ipaddrv6'] != "track6")) continue; } /* XXX: Maybe we should report any errors?! */ @@ -806,9 +802,7 @@ function interfaces_gif_configure($checkparent = 0, $realif = "") { continue; } else if ($checkparent == 2) { - if (!strstr($gif['if'], "_vip")) - continue; - if (empty($config['interfaces'][$gif['if']]) || $config['interfaces'][$gif['if']]['ipaddrv6'] != "track6") + if (!strstr($gif['if'], "_vip") && (empty($config['interfaces'][$gif['if']]) || $config['interfaces'][$gif['if']]['ipaddrv6'] != "track6")) continue; } /* XXX: Maybe we should report any errors?! */ From 657932fd09b1bbe7fe43eba1c01e161ad6e766ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ermal=20LU=C3=87I?= Date: Wed, 11 Feb 2015 20:34:47 +0100 Subject: [PATCH 6/8] Remove dead code and unset vars so next time the code works properly avoiding cache issues. --- usr/local/www/firewall_virtual_ip_edit.php | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index a26f61a184..5e5692bd70 100644 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -180,16 +180,6 @@ if ($_POST) { if (empty($_POST['password'])) $input_errors[] = gettext("You must specify a CARP password that is shared between the two VHID members."); - if (is_ipaddrv4($_POST['subnet'])) { - $parent_ip = get_interface_ip($_POST['interface']); - $parent_sn = get_interface_subnet($_POST['interface']); - $subnet = gen_subnet($parent_ip, $parent_sn); - } else if (is_ipaddrv6($_POST['subnet'])) { - $parent_ip = get_interface_ipv6($_POST['interface']); - $parent_sn = get_interface_subnetv6($_POST['interface']); - $subnet = gen_subnetv6($parent_ip, $parent_sn); - } - if ($_POST['interface'] == 'lo0') $input_errors[] = gettext("For this type of vip localhost is not allowed."); else if (strpos($_POST['interface'], '_vip')) @@ -211,6 +201,7 @@ if ($_POST) { $cannot_find = $_POST['subnet'] . "/" . $_POST['subnet_bits'] ; $input_errors[] = sprintf(gettext("Sorry, we could not locate an interface with a matching subnet for %s. Please add an IP alias in this subnet on this interface."),$cannot_find); } + unset($parent_ip, $parent_sn, $subnet); } break; default: From 810b36ac0c363c21ea2f1b963f2c1be142fc59a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ermal=20LU=C3=87I?= Date: Wed, 11 Feb 2015 21:17:03 +0100 Subject: [PATCH 7/8] Fixes #4390 Properly return the vip subnet now that the CARP might not match its parent interface subnet. --- etc/inc/interfaces.inc | 14 ++++++-------- etc/inc/util.inc | 4 ++-- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 88bdeff7d3..be6a32f062 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -4790,7 +4790,7 @@ function ip_in_interface_alias_subnet($interface, $ipalias) { function get_interface_ip($interface = "wan") { $realif = get_failover_interface($interface); - if (!$realif) { + if (empty($realif)) { if (strstr($interface, "_vip")) return get_configured_carp_interface_list($interface); else @@ -4808,7 +4808,7 @@ function get_interface_ipv6($interface = "wan", $flush = false) { global $config; $realif = get_failover_interface($interface, "inet6"); - if (!$realif) { + if (empty($realif)) { if (strstr($interface, "_vip")) return get_configured_carp_interface_list($interface, "inet6"); else @@ -4863,10 +4863,9 @@ function get_interface_linklocal($interface = "wan") { function get_interface_subnet($interface = "wan") { $realif = get_real_interface($interface); - if (!$realif) { + if (empty($realif)) { if (strstr($interface, "_vip")) { - list($interface, $vhid) = explode("_vip", $interface); - $realif = get_real_interface($interface); + return get_configured_carp_interface_list($interface, 'inet', 'subnet'); } else return null; } @@ -4882,10 +4881,9 @@ function get_interface_subnetv6($interface = "wan") { global $config; $realif = get_real_interface($interface, "inet6"); - if (!$realif) { + if (empty($realif)) { if (strstr($interface, "_vip")) { - list($interface, $vhid) = explode("_vip", $interface); - $realif = get_real_interface($interface); + return get_configured_carp_interface_list($interface, 'inet6', 'subnet'); } else return null; } diff --git a/etc/inc/util.inc b/etc/inc/util.inc index 1630b477a7..97c1267227 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -956,9 +956,9 @@ function get_configured_carp_interface_list($carpinterface = '', $family = 'inet switch ($what) { case 'subnet': if ($family == 'inet' && is_ipaddrv4($vip['subnet'])) - return "{$vip['subnet']}/{$vip['subnet_bits']}"; + return $vip['subnet_bits']; else if ($family == 'inet6' && is_ipaddrv6($vip['subnet'])) - return "{$vip['subnet']}/{$vip['subnet_bits']}"; + return $vip['subnet_bits']; break; case 'iface': if ($family == 'inet' && is_ipaddrv4($vip['subnet'])) From 377b1faaaf7f5f6e342e8ff8acea00e0c62806da Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Wed, 11 Feb 2015 16:59:27 -0600 Subject: [PATCH 8/8] DHCPv6 client rules MUST come before bogons. Add a comment that hopefully sticks out so this stops getting broken. Ticket #3395 --- etc/inc/filter.inc | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 68b007a835..45a0ca9e77 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2903,6 +2903,20 @@ EOD; $bogontableinstalled = 0; foreach ($FilterIflist as $on => $oc) { + $saved_tracker += 10; + $tracker = $saved_tracker; + + if(isset($config['system']['ipv6allow']) && ($oc['type6'] == "slaac" || $oc['type6'] == "dhcp6")) { + // The DHCPv6 client rules ***MUST BE ABOVE BOGONSV6!*** https://redmine.pfsense.org/issues/3395 + $ipfrules .= <<