From 47593ac6ff761622a43e16cacb421acecede209d Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 22 Oct 2010 13:28:51 +0200 Subject: [PATCH 001/225] Allow for configuring a IPv6 address on the interfaces page. Add code to verify a ipv6 address Let is_ipaddr() return true on a v4 and v6 address. Change system gateways edit to fetch the global ipv6 interface ipv6 addresses and subnets The current ipv6 function might need folding into filter_var() when that catches some documented corner cases. The ajax widget on interfaces.php does not currently work for saving a IPv6 gateway address. Gateways edit screen does not complain when using it's own IP address as the gateway. FIXME. --- etc/inc/interfaces.inc | 79 ++++++++ etc/inc/util.inc | 47 ++++- usr/local/www/interfaces.php | 258 ++++++++++++++++++++++--- usr/local/www/system_gateways_edit.php | 6 +- 4 files changed, 365 insertions(+), 25 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 89915bdcdb..980371bd0b 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -3124,6 +3124,29 @@ function find_interface_ip($interface, $flush = false) return $interface_ip_arr_cache[$interface]; } +/* + * find_interface_ipv6($interface): return the interface ip (first found) + */ +function find_interface_ipv6($interface, $flush = false) +{ + global $interface_ipv6_arr_cache; + global $interface_snv6_arr_cache; + + $interface = str_replace("\n", "", $interface); + + if (!does_interface_exist($interface)) + return; + + /* Setup IP cache */ + if (!isset($interface_ipv6_arr_cache[$interface]) or $flush) { + $ifinfo = pfSense_get_interface_addresses($interface); + $interface_ipv6_arr_cache[$interface] = $ifinfo['ipaddrv6']; + $interface_snv6_arr_cache[$interface] = $ifinfo['subnetbitsv6']; + } + + return $interface_ipv6_arr_cache[$interface]; +} + function find_interface_subnet($interface, $flush = false) { global $interface_sn_arr_cache; @@ -3142,6 +3165,24 @@ function find_interface_subnet($interface, $flush = false) return $interface_sn_arr_cache[$interface]; } +function find_interface_subnetv6($interface, $flush = false) +{ + global $interface_snv6_arr_cache; + global $interface_ipv6_arr_cache; + + $interface = str_replace("\n", "", $interface); + if (does_interface_exist($interface) == false) + return; + + if (!isset($interface_snv6_arr_cache[$interface]) or $flush) { + $ifinfo = pfSense_get_interface_addresses($interface); + $interface_ipv6_arr_cache[$interface] = $ifinfo['ipaddrv6']; + $interface_snv6_arr_cache[$interface] = $ifinfo['subnetbitsv6']; + } + + return $interface_snv6_arr_cache[$interface]; +} + function ip_in_interface_alias_subnet($interface, $ipalias) { global $config; @@ -3182,6 +3223,25 @@ function get_interface_ip($interface = "wan") return null; } +function get_interface_ipv6($interface = "wan") +{ + $realif = get_real_interface($interface); + if (!$realif) { + if (preg_match("/^carp/i", $interface)) + $realif = $interface; + else if (preg_match("/^vip/i", $interface)) + $realif = $interface; + else + return null; + } + + $curip = find_interface_ipv6($realif); + if ($curip && is_ipaddrv6($curip) && ($curip != "::")) + return $curip; + else + return null; +} + function get_interface_subnet($interface = "wan") { $realif = get_real_interface($interface); @@ -3201,6 +3261,25 @@ function get_interface_subnet($interface = "wan") return null; } +function get_interface_subnetv6($interface = "wan") +{ + $realif = get_real_interface($interface); + if (!$realif) { + if (preg_match("/^carp/i", $interface)) + $realif = $interface; + else if (preg_match("/^vip/i", $interface)) + $realif = $interface; + else + return null; + } + + $cursn = find_interface_subnetv6($realif); + if (!empty($cursn)) + return $cursn; + + return null; +} + /* return outside interfaces with a gateway */ function get_interfaces_with_gateway() { global $config; diff --git a/etc/inc/util.inc b/etc/inc/util.inc index 90a5f9f7e9..10fa6a5926 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -382,8 +382,53 @@ function is_numericint($arg) { return (preg_match("/[^0-9]/", $arg) ? false : true); } -/* returns true if $ipaddr is a valid dotted IPv4 address */ + +/* returns true if $ipaddr is a valid dotted IPv4 address or a IPv6 */ function is_ipaddr($ipaddr) { + if(is_ipaddrv4($ipaddr)) { + return true; + } + if(is_ipaddrv6($ipaddr)) { + return true; + } + return false; +} + +function is_ipaddrv6($ipaddr) { + /* Not using filter_var here. It misses some test cases */ + /* http://crisp.tweakblogs.net/blog/2031 */ + // fast exit for localhost + if (strlen($ipaddr) < 3) + return $ipaddr == '::'; + + // Check if part is in IPv4 format + if (strpos($ipaddr, '.')) { + $lastcolon = strrpos($ipaddr, ':'); + if (!($lastcolon && validateIPv4(substr(ipaddr, $lastcolon + 1)))) + return false; + + // replace IPv4 part with dummy + $ipaddr = substr($ipaddr, 0, $lastcolon) . ':0:0'; + } + + // check uncompressed + if (strpos($ipaddr, '::') === false) { + return preg_match('/^(?:[a-f0-9]{1,4}:){7}[a-f0-9]{1,4}$/i', $ipaddr); + } + + // check colon-count for compressed format + if (substr_count($ipaddr, ':') < 8) { + return preg_match('/^(?::|(?:[a-f0-9]{1,4}:)+):(?:(?:[a-f0-9]{1,4}:)*[a-f0-9]{1,4})?$/i', $ipaddr); + } + return false; +} + +function validateIPv4($ipaddr) { + return $ipaddr == long2ip(ip2long($ipaddr)); +} + +/* returns true if $ipaddr is a valid dotted IPv4 address */ +function is_ipaddrv4($ipaddr) { if (!is_string($ipaddr)) return false; diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php index f08ca3ca3b..d2e3269f31 100755 --- a/usr/local/www/interfaces.php +++ b/usr/local/www/interfaces.php @@ -172,7 +172,6 @@ if($if == "wan" && !$wancfg['descr']) { $wancfg['descr'] = "LAN"; } $pconfig['descr'] = remove_bad_chars($wancfg['descr']); - $pconfig['enable'] = isset($wancfg['enable']); if (is_array($config['aliases']['alias'])) { @@ -198,16 +197,39 @@ switch($wancfg['ipaddr']) { break; default: if(is_ipaddr($wancfg['ipaddr'])) { - $pconfig['type'] = "static"; + $pconfig['type'] = "staticv4"; $pconfig['ipaddr'] = $wancfg['ipaddr']; $pconfig['subnet'] = $wancfg['subnet']; $pconfig['gateway'] = $wancfg['gateway']; + if((is_ipaddr($wancfg['ipaddrv6'])) && (is_ipaddr($wancfg['ipaddr']))) { + $pconfig['type'] = "staticv4v6"; + } } else { $pconfig['type'] = "none"; } break; } +switch($wancfg['ipaddrv6']) { + case "dhcpv6": + $pconfig['type'] = "dhcpv6"; + break; + default: + /* if we have dual stack we need a combined type */ + if(is_ipaddr($wancfg['ipaddrv6'])) { + $pconfig['type'] = "staticv6"; + $pconfig['ipaddrv6'] = $wancfg['ipaddrv6']; + $pconfig['subnetv6'] = $wancfg['subnetv6']; + $pconfig['gatewayv6'] = $wancfg['gatewayv6']; + if((is_ipaddr($wancfg['ipaddrv6'])) && (is_ipaddr($wancfg['ipaddr']))) { + $pconfig['type'] = "staticv4v6"; + } + } + break; +} + +// print_r($pconfig); + $pconfig['blockpriv'] = isset($wancfg['blockpriv']); $pconfig['blockbogons'] = isset($wancfg['blockbogons']); $pconfig['spoofmac'] = $wancfg['spoofmac']; @@ -370,9 +392,19 @@ if ($_POST) { $input_errors[] = gettext("The DHCP Server is active on this interface and it can be used only with a static IP configuration. Please disable the DHCP Server service on this interface first, then change the interface configuration."); switch($_POST['type']) { - case "static": + case "staticv4": $reqdfields = explode(" ", "ipaddr subnet gateway"); - $reqdfieldsn = array(gettext("IP address"),gettext("Subnet bit count"),gettext("Gateway")); + $reqdfieldsn = array(gettext("IPv4 address"),gettext("Subnet bit count"),gettext("Gateway")); + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); + break; + case "staticv6": + $reqdfields = explode(" ", "ipaddrv6 subnetv6 gatewayv6"); + $reqdfieldsn = array(gettext("IPv6 address"),gettext("Subnet bit count"),gettext("Gateway")); + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); + break; + case "staticv4v6": + $reqdfields = explode(" ", "ipaddr subnet gateway ipaddrv6 subnetv6 gatewayv6"); + $reqdfieldsn = array(gettext("IPv4 address"),gettext("Subnet bit count"),gettext("Gateway"),gettext("IPv6 address"),gettext("Subnet bit count"),gettext("Gateway")); do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); break; case "none": @@ -386,6 +418,10 @@ if ($_POST) { if (in_array($wancfg['ipaddr'], array("ppp", "pppoe", "pptp", "l2tp"))) $input_errors[] = gettext("You have to reassign the interface to be able to configure as {$_POST['type']}."); break; + case "dhcpv6": + if (in_array($wancfg['ipaddrv6'], array("ppp", "pppoe", "pptp", "l2tp"))) + $input_errors[] = gettext("You have to reassign the interface to be able to configure as {$_POST['type']}."); + break; case "ppp": $reqdfields = explode(" ", "port phone"); $reqdfieldsn = array(gettext("Modem Port"),gettext("Phone Number")); @@ -416,20 +452,29 @@ if ($_POST) { /* normalize MAC addresses - lowercase and convert Windows-ized hyphenated MACs to colon delimited */ $_POST['spoofmac'] = strtolower(str_replace("-", ":", $_POST['spoofmac'])); if (($_POST['ipaddr'] && !is_ipaddr($_POST['ipaddr']))) - $input_errors[] = gettext("A valid IP address must be specified."); + $input_errors[] = gettext("A valid IPv4 address must be specified."); + if (($_POST['ipaddrv6'] && !is_ipaddr($_POST['ipaddrv6']))) + $input_errors[] = gettext("A valid IPv6 address must be specified."); if (($_POST['subnet'] && !is_numeric($_POST['subnet']))) $input_errors[] = gettext("A valid subnet bit count must be specified."); + if (($_POST['subnetv6'] && !is_numeric($_POST['subnetv6']))) + $input_errors[] = gettext("A valid subnet bit count must be specified."); if (($_POST['alias-address'] && !is_ipaddr($_POST['alias-address']))) $input_errors[] = gettext("A valid alias IP address must be specified."); if (($_POST['alias-subnet'] && !is_numeric($_POST['alias-subnet']))) $input_errors[] = gettext("A valid alias subnet bit count must be specified."); - if ($_POST['gateway'] != "none") { + if (($_POST['gateway'] != "none") || ($_POST['gatewayv6'] != "none")) { $match = false; foreach($a_gateways as $gateway) { if(in_array($_POST['gateway'], $gateway)) { $match = true; } } + foreach($a_gateways as $gateway) { + if(in_array($_POST['gatewayv6'], $gateway)) { + $match = true; + } + } if(!$match) { $input_errors[] = gettext("A valid gateway must be specified."); } @@ -512,8 +557,12 @@ if ($_POST) { $ppp = array(); if ($wancfg['ipaddr'] != "ppp") unset($wancfg['ipaddr']); + if ($wancfg['ipaddrv6'] != "ppp") + unset($wancfg['ipaddrv6']); unset($wancfg['subnet']); unset($wancfg['gateway']); + unset($wancfg['subnetv6']); + unset($wancfg['gatewayv6']); unset($wancfg['dhcphostname']); unset($wancfg['pppoe_username']); unset($wancfg['pppoe_password']); @@ -525,7 +574,6 @@ if ($_POST) { if (isset($wancfg['pppoe']['pppoe-reset-type'])) unset($wancfg['pppoe']['pppoe-reset-type']); unset($wancfg['local']); - unset($wancfg['subnet']); unset($wancfg['remote']); unset($a_ppps[$pppid]['apn']); unset($a_ppps[$pppid]['phone']); @@ -551,7 +599,7 @@ if ($_POST) { } } if($skip == false) { - $gateway_item['gateway'] = gettext("dynamic"); + $gateway_item['gateway'] = "dynamic"; $gateway_item['descr'] = gettext("Interface") . $if . gettext("dynamic gateway"); $gateway_item['name'] = "GW_" . strtoupper($if); $gateway_item['interface'] = "{$if}"; @@ -561,13 +609,32 @@ if ($_POST) { } switch($_POST['type']) { - case "static": + case "staticv4": $wancfg['ipaddr'] = $_POST['ipaddr']; $wancfg['subnet'] = $_POST['subnet']; if ($_POST['gateway'] != "none") { $wancfg['gateway'] = $_POST['gateway']; } break; + case "staticv6": + $wancfg['ipaddrv6'] = $_POST['ipaddrv6']; + $wancfg['subnetv6'] = $_POST['subnetv6']; + if ($_POST['gatewayv6'] != "none") { + $wancfg['gatewayv6'] = $_POST['gatewayv6']; + } + break; + case "staticv4v6": + $wancfg['ipaddr'] = $_POST['ipaddr']; + $wancfg['subnet'] = $_POST['subnet']; + if ($_POST['gateway'] != "none") { + $wancfg['gateway'] = $_POST['gateway']; + } + $wancfg['ipaddrv6'] = $_POST['ipaddrv6']; + $wancfg['subnetv6'] = $_POST['subnetv6']; + if ($_POST['gatewayv6'] != "none") { + $wancfg['gatewayv6'] = $_POST['gatewayv6']; + } + break; case "dhcp": $wancfg['ipaddr'] = "dhcp"; $wancfg['dhcphostname'] = $_POST['dhcphostname']; @@ -577,6 +644,15 @@ if ($_POST) { $a_gateways[] = $gateway_item; } break; + case "dhcpv6": + $wancfg['ipaddrv6'] = "dhcpv6"; + $wancfg['dhcphostname'] = $_POST['dhcphostname']; + $wancfg['alias-address'] = $_POST['alias-address']; + $wancfg['alias-subnet'] = $_POST['alias-subnet']; + if($gateway_item) { + $a_gateways[] = $gateway_item; + } + break; case "carpdev-dhcp": $wancfg['ipaddr'] = "carpdev-dhcp"; $wancfg['dhcphostname'] = $_POST['dhcphostname']; @@ -865,7 +941,7 @@ $statusurl = "status_interfaces.php"; $closehead = false; include("head.inc"); -$types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" => gettext("DHCP"), "ppp" => gettext("PPP"), "pppoe" => gettext("PPPoE"), "pptp" => gettext("PPTP") /* , "carpdev-dhcp" => "CarpDev"*/); +$types = array("none" => gettext("None"), "staticv4" => gettext("Static IPv4"), "staticv6" => gettext("Static IPv6"), "staticv4v6" => gettext("Static IPv4 + IPv6"), "dhcp" => gettext("DHCP"), "dhcpv6" => gettext("DHCPv6"), "ppp" => gettext("PPP"), "pppoe" => gettext("PPPoE"), "pptp" => gettext("PPTP") /* , "carpdev-dhcp" => "CarpDev"*/); ?> @@ -878,28 +954,42 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" function updateType(t) { switch(t) { case "none": { - $('static','dhcp','pppoe','pptp', 'ppp').invoke('hide'); + $('staticv4','staticv6','dhcp','dhcpv6','pppoe','pptp', 'ppp').invoke('hide'); break; } - case "static": { - $('none','dhcp','pppoe','pptp', 'ppp').invoke('hide'); + case "staticv4": { + $('none','staticv6','dhcp','dhcpv6','pppoe','pptp', 'ppp').invoke('hide'); + break; + } + case "staticv6": { + $('none','staticv4','dhcp','dhcpv6','pppoe','pptp', 'ppp').invoke('hide'); + break; + } + case "staticv4v6": { + $('none','dhcp','dhcpv6','pppoe','pptp', 'ppp').invoke('hide'); + $('staticv4').show(); + $('staticv6').show(); break; } case "dhcp": { - $('none','static','pppoe','pptp', 'ppp').invoke('hide'); + $('none','staticv4','staticv6','dhcpv6','pppoe','pptp', 'ppp').invoke('hide'); + break; + } + case "dhcpv6": { + $('none','staticv4','staticv6','dhcp','pppoe','pptp', 'ppp').invoke('hide'); break; } case "ppp": { - $('none','static','dhcp','pptp', 'pppoe').invoke('hide'); + $('none','staticv4','staticv6','dhcp','dhcpv6','pptp', 'pppoe').invoke('hide'); country_list(); break; } case "pppoe": { - $('none','static','dhcp','pptp', 'ppp').invoke('hide'); + $('none','staticv4','staticv6','dhcp','dhcpv6','pptp', 'ppp').invoke('hide'); break; } case "pptp": { - $('none','static','dhcp','pppoe', 'ppp').invoke('hide'); + $('none','staticv4','staticv6','dhcp','dhcpv6','pppoe', 'ppp').invoke('hide'); break; } } @@ -1118,14 +1208,14 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" - + - + - + - + @@ -1221,11 +1311,114 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
/ @@ -1150,7 +1240,7 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp" 0) { foreach ($a_gateways as $gateway) { - if($gateway['interface'] == $if) { + if(($gateway['interface'] == $if) && (is_ipaddrv4($gateway['gateway']))) { ?> ">
+ + + + + + + + + + + + + + +
+ + / + +
+ +
+
+ +
+
+
+
+
+ +
+ + - + @@ -1259,6 +1452,25 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
+ + + + + + + + + + +
+ +
+ +
+ + diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 4848bed5e5..8db28530f9 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -113,7 +113,11 @@ if ($_POST) { if (is_ipaddr($config['interfaces'][$_POST['interface']]['ipaddr']) && (empty($_POST['gateway']) || $_POST['gateway'] == "dynamic")) $input_errors[] = gettext("Dynamic gateway values cannot be specified for interfaces with a static ip configuration."); } - $parent_ip = get_interface_ip($_POST['interface']); + if(is_ipaddrv6($_POST['gateway'])) { + $parent_ip = get_interface_ipv6($_POST['interface']); + } else { + $parent_ip = get_interface_ip($_POST['interface']); + } if (is_ipaddr($parent_ip)) { $parent_sn = get_interface_subnet($_POST['interface']); if(!ip_in_subnet($_POST['gateway'], gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn)) { From 5a5413bb5227e084703515007cc28fd746183c9b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 22 Oct 2010 16:01:30 +0200 Subject: [PATCH 002/225] Add the default ipv4 route and the default ipv6 route, check both routing tables before adding or changing. set the ipv6 IP address via a mwexec() until the pfsense module is adapted. FIXME. Add filter rules for ipv6 to let traffic out of the firewall. FilterIflist not cooperating yet. --- etc/inc/filter.inc | 21 ++++++++++--- etc/inc/gwlb.inc | 71 +++++++++++++++++++++++++++++------------- etc/inc/interfaces.inc | 14 +++++++++ etc/inc/system.inc | 67 +++++++++++++++++++++++++++++++++++---- 4 files changed, 141 insertions(+), 32 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 01e37ce36f..26f8c15aa9 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -723,17 +723,21 @@ function filter_generate_optcfg_array() { if (!does_interface_exist($oic['if'])) continue; $oic['ip'] = get_interface_ip($if); + $oic['ipv6'] = get_interface_ipv6($if); if(!is_ipaddr($oc['ipaddr']) && !empty($oc['ipaddr'])) $oic['type'] = $oc['ipaddr']; $oic['sn'] = get_interface_subnet($if); + $oic['snv6'] = get_interface_subnetv6($if); $oic['mtu'] = empty($oc['mtu']) ? 1500 : $oc['mtu']; $oic['mss'] = empty($oc['mss']) ? '' : $oc['mss']; $oic['descr'] = $ifdetail; $oic['sa'] = gen_subnet($oic['ip'], $oic['sn']); + $oic['sav6'] = gen_subnet($oic['ipv6'], $oic['snv6']); $oic['nonat'] = $oc['nonat']; $oic['alias-address'] = $oc['alias-address']; $oic['alias-subnet'] = $oc['alias-subnet']; $oic['gateway'] = $oc['gateway']; + $oic['gatewayv6'] = $oc['gatewayv6']; $oic['spoofcheck'] = "yes"; $oic['bridge'] = link_interface_to_bridge($if); $FilterIflist[$if] = $oic; @@ -1981,8 +1985,8 @@ EOD; if(!isset($config['system']['ipv6allow'])) { $ipfrules .= "# Block all IPv6\n"; - $ipfrules .= "block in quick inet6 all\n"; - $ipfrules .= "block out quick inet6 all\n"; + $ipfrules .= "block in inet6 all label \"Default Deny ipv6 rule\"\n"; + $ipfrules .= "block out inet6 all label \"Default Deny ipv6 rule\"\n"; } $ipfrules .= << $ifcfg) { - if(isset($ifcfg['virtual'])) - continue; + if(isset($ifcfg['virtual'])) + continue; + $gw = get_interface_gateway($ifdescr); + echo "gw $gw, ip {$ifcfg['ip']} \n"; if (is_ipaddr($gw) && is_ipaddr($ifcfg['ip'])) $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; - } + $gwv6 = get_interface_gateway_v6($ifdescr); + echo "gwv6 $gwv6, ip {$ifcfg['ipv6']}\n"; + if (is_ipaddrv6($gwv6) && is_ipaddrv6($ifcfg['ipv6'])) + $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gwv6} ) from {$ifcfg['ipv6']} to !{$ifcfg['sav6']}/{$ifcfg['snv6']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + } + /* add ipsec interfaces */ if(isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 540a0a742c..d8bd05a4bf 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -501,35 +501,64 @@ function lookup_gateway_interface_by_name($name) { } function get_interface_gateway($interface, &$dynamic = false) { - global $config, $g; + global $config, $g; - $gw = NULL; + $gw = NULL; - $gwcfg = $config['interfaces'][$interface]; - if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) { - foreach($config['gateways']['gateway_item'] as $gateway) { - if ($gateway['name'] == $gwcfg['gateway']) { - $gw = $gateway['gateway']; + $gwcfg = $config['interfaces'][$interface]; + if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) { + foreach($config['gateways']['gateway_item'] as $gateway) { + if(($gateway['name'] == $gwcfg['gateway']) && (is_ipaddrv4($gateway['gateway']))) { + $gw = $gateway['gateway']; break; } - } + } } - // for dynamic interfaces we handle them through the $interface_router file. - if (!is_ipaddr($gw) && !is_ipaddr($gwcfg['ipaddr'])) { - $realif = get_real_interface($interface); - if (file_exists("{$g['tmp_path']}/{$realif}_router")) { - $gw = trim(file_get_contents("{$g['tmp_path']}/{$realif}_router"), " \n"); - $dynamic = true; - } - if (file_exists("{$g['tmp_path']}/{$realif}_defaultgw")) - $dynamic = "default"; + // for dynamic interfaces we handle them through the $interface_router file. + if (!is_ipaddr($gw) && !is_ipaddr($gwcfg['ipaddr'])) { + $realif = get_real_interface($interface); + if (file_exists("{$g['tmp_path']}/{$realif}_router")) { + $gw = trim(file_get_contents("{$g['tmp_path']}/{$realif}_router"), " \n"); + $dynamic = true; + } + if (file_exists("{$g['tmp_path']}/{$realif}_defaultgw")) + $dynamic = "default"; - - } + } - /* return gateway */ - return ($gw); + /* return gateway */ + return ($gw); +} + +function get_interface_gateway_v6($interface, &$dynamic = false) { + global $config, $g; + + $gw = NULL; + + $gwcfg = $config['interfaces'][$interface]; + if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) { + foreach($config['gateways']['gateway_item'] as $gateway) { + if(($gateway['name'] == $gwcfg['gateway']) && (is_ipaddrv6($gateway['gateway']))) { + $gw = $gateway['gateway']; + break; + } + } + } + + // for dynamic interfaces we handle them through the $interface_router file. + if (!is_ipaddrv6($gw) && !is_ipaddr($gwcfg['ipaddrv6'])) { + $realif = get_real_interface($interface); + if (file_exists("{$g['tmp_path']}/{$realif}_routerv6")) { + $gw = trim(file_get_contents("{$g['tmp_path']}/{$realif}_routerv6"), " \n"); + $dynamic = true; + } + if (file_exists("{$g['tmp_path']}/{$realif}_defaultgwv6")) + $dynamic = "default"; + + } + /* return gateway */ + return ($gw); } ?> diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 980371bd0b..aacacfd157 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -2467,6 +2467,8 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven get_interface_arr(true); unset($interface_ip_arr_cache[$realif]); unset($interface_sn_arr_cache[$realif]); + unset($interface_ipv6_arr_cache[$realif]); + unset($interface_snv6_arr_cache[$realif]); switch ($wancfg['ipaddr']) { case 'carpdev-dhcp': @@ -2502,6 +2504,18 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven break; } + switch ($wancfg['ipaddrv6']) { + case 'dhcpv6': + interface_dhcpv6_configure($interface); + break; + default: + if ($wancfg['ipaddrv6'] <> "" && $wancfg['subnetv6'] <> "") { + pfSense_interface_setaddress($realif, "{$wancfg['ipaddrv6']}/{$wancfg['subnetv6']}"); + mwexec("/sbin/ifconfig {$realif} inet6 {$wancfg['ipaddrv6']} prefixlen {$wancfg['subnetv6']} "); + } + break; + } + if(does_interface_exist($wancfg['if'])) interfaces_bring_up($wancfg['if']); diff --git a/etc/inc/system.inc b/etc/inc/system.inc index ba9ad05cff..022e1be683 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -307,11 +307,14 @@ function system_routing_configure($interface = "") { $gatewayip = ""; $interfacegw = ""; $foundgw = false; + $gatewayipv6 = ""; + $interfacegwv6 = ""; + $foundgwv6 = false; /* tack on all the hard defined gateways as well */ if (is_array($config['gateways']['gateway_item'])) { mwexec("/bin/rm {$g['tmp_path']}/*_defaultgw", true); foreach ($config['gateways']['gateway_item'] as $gateway) { - if (isset($gateway['defaultgw'])) { + if (isset($gateway['defaultgw']) && (is_ipaddrv4($gateway['gateway']))) { if ($gateway['gateway'] == "dynamic") $gateway['gateway'] = get_interface_gateway($gateway['interface']); $gatewayip = $gateway['gateway']; @@ -325,6 +328,21 @@ function system_routing_configure($interface = "") { break; } } + foreach ($config['gateways']['gateway_item'] as $gateway) { + if (isset($gateway['defaultgw']) && (is_ipaddrv6($gateway['gateway']))) { + if ($gateway['gateway'] == "dynamic") + $gateway['gateway'] = get_interface_gateway_v6($gateway['interface']); + $gatewayipv6 = $gateway['gateway']; + $interfacegwv6 = $gateway['interface']; + if (!empty($interfacegwv6)) { + $defaultif = get_real_interface($gateway['interface']); + if ($defaultif) + @file_put_contents("{$g['tmp_path']}/{$defaultif}_defaultgwv6", $gatewayipv6); + } + $foundgwv6 = true; + break; + } + } } if ($foundgw == false) { $defaultif = get_real_interface("wan"); @@ -332,6 +350,12 @@ function system_routing_configure($interface = "") { $gatewayip = get_interface_gateway("wan"); @touch("{$g['tmp_path']}/{$defaultif}_defaultgw"); } + if ($foundgwv6 == false) { + $defaultif = get_real_interface("wan"); + $interfacegw = "wan"; + $gatewayip = get_interface_gateway_v6("wan"); + @touch("{$g['tmp_path']}/{$defaultif}_defaultgwv6"); + } $dont_add_route = false; /* if OLSRD is enabled, allow WAN to house DHCP. */ if($config['installedpackages']['olsrd']) { @@ -342,7 +366,7 @@ function system_routing_configure($interface = "") { } } } - /* Create a array from the existing route table */ + /* Create a array from the existing inet route table */ exec("/usr/bin/netstat -rnf inet", $route_str); array_shift($route_str); array_shift($route_str); @@ -357,16 +381,42 @@ function system_routing_configure($interface = "") { if ($dont_add_route == false ) { if (!empty($interface) && $interface != $interfacegw) ; - else if (($interfacegw <> "bgpd") && (is_ipaddr($gatewayip))) { + else if (($interfacegw <> "bgpd") && (is_ipaddrv4($gatewayip))) { $action = "add"; if(isset($route_arr['default'])) { $action = "change"; } - log_error("ROUTING: $action default route to $gatewayip"); + log_error("ROUTING: $action IPv4 default route to $gatewayip"); mwexec("/sbin/route {$action} default " . escapeshellarg($gatewayip)); } } + /* Create a array from the existing inet6 route table */ + exec("/usr/bin/netstat -rnf inet6", $routev6_str); + array_shift($routev6_str); + array_shift($routev6_str); + array_shift($routev6_str); + array_shift($routev6_str); + array_shift($routev6_str); + $routev6_arr = array(); + foreach($routev6_str as $routeline) { + $items = preg_split("/[ ]+/i", $routeline); + $route_arr[$items[0]] = array($items[0], $items[1], $items[5]); + } + + if ($dont_add_route == false ) { + if (!empty($interface) && $interface != $interfacegw) + ; + else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) { + $action = "add"; + if(isset($routev6_arr['default'])) { + $action = "change"; + } + log_error("ROUTING: $action IPv6 default route to $gatewayipv6"); + mwexec("/sbin/route {$action} -inet6 default " . escapeshellarg($gatewayipv6)); + } + } + if (is_array($config['staticroutes']['route'])) { $gateways_arr = return_gateways_array(); @@ -385,11 +435,16 @@ function system_routing_configure($interface = "") { if (isset($route_arr[$rtent['network']])) $action = "change"; + if(is_ipaddrv6($gatewayip)) { + $inet6 = "-inet6"; + } else { + $inet6 = ""; + } if (is_ipaddr($gatewayip)) { - mwexec("/sbin/route {$action} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route {$action} {$inet6} " . escapeshellarg($rtent['network']) . " " . escapeshellarg($gatewayip)); } else if (!empty($interfacegw)) { - mwexec("/sbin/route {$action} " . escapeshellarg($rtent['network']) . + mwexec("/sbin/route {$action} {$inet6} " . escapeshellarg($rtent['network']) . " -iface " . escapeshellarg($interfacegw)); } } From 86551a0623d80616bc7c6cc3a5ca6e122274b8c6 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 12:19:11 +0200 Subject: [PATCH 003/225] Do a gethostbyname() on the host address to get a IP address, then perform ping or ping6 for correct type. --- usr/local/www/diag_ping.php | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/usr/local/www/diag_ping.php b/usr/local/www/diag_ping.php index 0bbc7d59ab..3715cf8c82 100755 --- a/usr/local/www/diag_ping.php +++ b/usr/local/www/diag_ping.php @@ -61,7 +61,7 @@ if ($_POST || $_REQUEST['host']) { if (!$input_errors) { $do_ping = true; - $host = $_REQUEST['host']; + $host = gethostbyname($_REQUEST['host']); $interface = $_REQUEST['interface']; $count = $_POST['count']; if (preg_match('/[^0-9]/', $count) ) @@ -125,11 +125,21 @@ include("head.inc"); ?> echo ""; echo "" . gettext("Ping output") . ":
"; echo('
');
-					$ifaddr = get_interface_ip($interface);
-					if ($ifaddr)
-						system("/sbin/ping -S$ifaddr -c$count " . escapeshellarg($host));
-					else
-						system("/sbin/ping -c$count " . escapeshellarg($host));
+					if(is_ipaddrv4($host)) {
+						$ifaddr = get_interface_ip($interface);
+						if ($ifaddr)
+							system("/sbin/ping -S$ifaddr -c$count " . escapeshellarg($host));
+						else
+							system("/sbin/ping -c$count " . escapeshellarg($host));
+					}
+					if(is_ipaddrv6($host)) {
+						$ifaddr = get_interface_ipv6($interface);
+						if ($ifaddr)
+							system("/sbin/ping6 -S$ifaddr -c$count " . escapeshellarg($host));
+						else
+							system("/sbin/ping6 -c$count " . escapeshellarg($host));
+					}
+					
 					echo('
'); } ?> From 8bea96391f790fa48156d2e26c6e75455e50138b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 12:28:14 +0200 Subject: [PATCH 004/225] So gethostbyname() does not work for ipv6, instead run both ping and ping6. That works too. --- usr/local/www/diag_ping.php | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/usr/local/www/diag_ping.php b/usr/local/www/diag_ping.php index 3715cf8c82..155f0f7466 100755 --- a/usr/local/www/diag_ping.php +++ b/usr/local/www/diag_ping.php @@ -29,7 +29,7 @@ */ /* - pfSense_BUILDER_BINARIES: /sbin/ping + pfSense_BUILDER_BINARIES: /sbin/ping /sbin/ping6 pfSense_MODULE: routing */ @@ -61,7 +61,7 @@ if ($_POST || $_REQUEST['host']) { if (!$input_errors) { $do_ping = true; - $host = gethostbyname($_REQUEST['host']); + $host = $_REQUEST['host']; $interface = $_REQUEST['interface']; $count = $_POST['count']; if (preg_match('/[^0-9]/', $count) ) @@ -125,20 +125,16 @@ include("head.inc"); ?> echo ""; echo "" . gettext("Ping output") . ":
"; echo('
');
-					if(is_ipaddrv4($host)) {
-						$ifaddr = get_interface_ip($interface);
-						if ($ifaddr)
-							system("/sbin/ping -S$ifaddr -c$count " . escapeshellarg($host));
-						else
-							system("/sbin/ping -c$count " . escapeshellarg($host));
-					}
-					if(is_ipaddrv6($host)) {
-						$ifaddr = get_interface_ipv6($interface);
-						if ($ifaddr)
-							system("/sbin/ping6 -S$ifaddr -c$count " . escapeshellarg($host));
-						else
-							system("/sbin/ping6 -c$count " . escapeshellarg($host));
-					}
+					$ifaddr = get_interface_ip($interface);
+					if ($ifaddr)
+						system("/sbin/ping -S$ifaddr -c$count " . escapeshellarg($host));
+					else
+						system("/sbin/ping -c$count " . escapeshellarg($host));
+					$ifaddr = get_interface_ipv6($interface);
+					if ($ifaddr)
+						system("/sbin/ping6 -S$ifaddr -c$count " . escapeshellarg($host));
+					else
+						system("/sbin/ping6 -c$count " . escapeshellarg($host));
 					
 					echo('
'); } From 66e0ff494c2892058c8903dde7ba43d810c8aa41 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 12:32:23 +0200 Subject: [PATCH 005/225] Run both traceroute and traceroute6 for ipv6 functionaility --- usr/local/www/diag_traceroute.php | 1 + 1 file changed, 1 insertion(+) diff --git a/usr/local/www/diag_traceroute.php b/usr/local/www/diag_traceroute.php index 6c9df57d02..5a94f4c57f 100755 --- a/usr/local/www/diag_traceroute.php +++ b/usr/local/www/diag_traceroute.php @@ -125,6 +125,7 @@ if (!isset($do_traceroute)) { else $useicmp = ""; system("/usr/sbin/traceroute $useicmp -w 2 -m " . escapeshellarg($ttl) . " " . escapeshellarg($host)); + system("/usr/sbin/traceroute6 $useicmp -w 2 -m " . escapeshellarg($ttl) . " " . escapeshellarg($host)); echo(''); } ?> From 640b3a9ac1d40dd9a0b5354c848045f5cb301fd3 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 12:49:19 +0200 Subject: [PATCH 006/225] remove some debugging from filter inc, show correct ipv6 gateway from function --- etc/inc/filter.inc | 2 -- etc/inc/gwlb.inc | 10 +++++++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 26f8c15aa9..4b98a59e97 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2139,12 +2139,10 @@ EOD; continue; $gw = get_interface_gateway($ifdescr); - echo "gw $gw, ip {$ifcfg['ip']} \n"; if (is_ipaddr($gw) && is_ipaddr($ifcfg['ip'])) $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; $gwv6 = get_interface_gateway_v6($ifdescr); - echo "gwv6 $gwv6, ip {$ifcfg['ipv6']}\n"; if (is_ipaddrv6($gwv6) && is_ipaddrv6($ifcfg['ipv6'])) $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gwv6} ) from {$ifcfg['ipv6']} to !{$ifcfg['sav6']}/{$ifcfg['snv6']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index d8bd05a4bf..3d1ec939f1 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -147,7 +147,12 @@ EOD; } /* Interface ip is needed since apinger will bind a socket to it. */ - $gwifip = find_interface_ip($gateway['interface'], true); + if (is_ipaddrv4($gateway['gateway'])) { + $gwifip = find_interface_ip($gateway['interface'], true); + } + if (is_ipaddrv6($gateway['gateway'])) { + $gwifip = find_interface_ipv6($gateway['interface'], true); + } if (!is_ipaddr($gwifip)) continue; //Skip this target @@ -535,11 +540,10 @@ function get_interface_gateway_v6($interface, &$dynamic = false) { global $config, $g; $gw = NULL; - $gwcfg = $config['interfaces'][$interface]; if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) { foreach($config['gateways']['gateway_item'] as $gateway) { - if(($gateway['name'] == $gwcfg['gateway']) && (is_ipaddrv6($gateway['gateway']))) { + if(($gateway['name'] == $gwcfg['gatewayv6']) && (is_ipaddrv6($gateway['gateway']))) { $gw = $gateway['gateway']; break; } From 6538e6605a7f8b91fb3d62fc578827750ea7bb68 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 12:54:23 +0200 Subject: [PATCH 007/225] fix filter rule error --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 4b98a59e97..e39bf06160 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -732,7 +732,7 @@ function filter_generate_optcfg_array() { $oic['mss'] = empty($oc['mss']) ? '' : $oc['mss']; $oic['descr'] = $ifdetail; $oic['sa'] = gen_subnet($oic['ip'], $oic['sn']); - $oic['sav6'] = gen_subnet($oic['ipv6'], $oic['snv6']); + $oic['sav6'] = "{$oic['ipv6']}"; $oic['nonat'] = $oc['nonat']; $oic['alias-address'] = $oc['alias-address']; $oic['alias-subnet'] = $oc['alias-subnet']; From bbcc0f9c816a707969e2dfea0d62c28063f037a6 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 21:26:02 +0200 Subject: [PATCH 008/225] splay the IPv6 information on status interfaces. --- usr/local/www/status_interfaces.php | 30 ++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/usr/local/www/status_interfaces.php b/usr/local/www/status_interfaces.php index d6fdcede2f..047a053afd 100755 --- a/usr/local/www/status_interfaces.php +++ b/usr/local/www/status_interfaces.php @@ -167,7 +167,7 @@ include("head.inc"); - + - + - + + + + + + + + + + + + + + + + + From 2bbb79cbe1cef645d0bb95ca36987f68fe8b4703 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 23 Oct 2010 21:27:17 +0200 Subject: [PATCH 009/225] tack on the ipv6 information via the old fashioned way until the pfsense module is up to speed --- etc/inc/pfsense-utils.inc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index ba774b76d4..4c9e2b565a 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1124,6 +1124,8 @@ function get_interface_info($ifdescr) { $ifinfo['macaddr'] = $ifinfotmp['macaddr']; $ifinfo['ipaddr'] = $ifinfotmp['ipaddr']; $ifinfo['subnet'] = $ifinfotmp['subnet']; + $ifinfo['ipaddrv6'] = get_interface_ipv6($ifdescr);; + $ifinfo['subnetv6'] = get_interface_subnetv6($ifdescr);; if (isset($ifinfotmp['link0'])) $link0 = "down"; $ifinfotmp = pfSense_get_interface_stats($chkif); @@ -1276,8 +1278,10 @@ function get_interface_info($ifdescr) { } /* lookup the gateway */ - if (interface_has_gateway($ifdescr)) + if (interface_has_gateway($ifdescr)) { $ifinfo['gateway'] = get_interface_gateway($ifdescr); + $ifinfo['gatewayv6'] = get_interface_gateway_v6($ifdescr); + } } $bridge = ""; From a268a57678ab9d41c2e83a805d0970080d82358e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 24 Oct 2010 17:34:10 +0200 Subject: [PATCH 010/225] Add a rule so that the bare icmp ipv6 traffic can get out, otherwise the box can not communicate properly on ipv6 --- etc/inc/filter.inc | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index e39bf06160..2c638d448c 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1975,10 +1975,12 @@ function filter_rules_generate() { #--------------------------------------------------------------------------- block in $log all label "Default deny rule" block out $log all label "Default deny rule" +block in $log inet6 all label "Default deny rule IPv6" +block out $log inet6 all label "Default deny rule IPv6" # We use the mighty pf, we cannot be fooled. -block quick proto { tcp, udp } from any port = 0 to any -block quick proto { tcp, udp } from any to any port = 0 +#block quick inet proto { tcp, udp } from any port = 0 to any +#block quick inet proto { tcp, udp } from any to any port = 0 EOD; @@ -2124,6 +2126,8 @@ anchor "spoofing" anchor "loopback" pass in on \$loopback all label "pass loopback" pass out on \$loopback all label "pass loopback" +pass in on \$loopback inet6 all label "pass loopback" +pass out on \$loopback inet6 all label "pass loopback" anchor "firewallout" @@ -2131,7 +2135,13 @@ EOD; $ipfrules .= << $ifcfg) { @@ -2144,7 +2154,7 @@ EOD; $gwv6 = get_interface_gateway_v6($ifdescr); if (is_ipaddrv6($gwv6) && is_ipaddrv6($ifcfg['ipv6'])) - $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gwv6} ) from {$ifcfg['ipv6']} to !{$ifcfg['sav6']}/{$ifcfg['snv6']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out route-to ( {$ifcfg['if']} {$gwv6} ) inet6 from {$ifcfg['ipv6']} to !{$ifcfg['sav6']}/{$ifcfg['snv6']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } From 1306c7dd6b66bdf41d5e06e03905ea1ddcc6a30d Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 25 Oct 2010 12:59:33 +0200 Subject: [PATCH 011/225] Change the firewall rule generation to look for the ipprotocol tag which defines inet or inet6. This makes sure that we use ipv6 addresses and change to the correct ipv6-icmp tag. --- etc/inc/filter.inc | 163 ++++++++++++++++++-------- etc/inc/util.inc | 11 +- usr/local/www/firewall_rules_edit.php | 23 ++++ 3 files changed, 144 insertions(+), 53 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 2c638d448c..45c47464bb 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1514,50 +1514,89 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { if(strstr($rule[$target]['network'], "opt")) { $optmatch = ""; $matches = ""; - if(preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { - $opt_ip = $FilterIflist["opt{$optmatch[1]}"]['ip']; - if(!is_ipaddr($opt_ip)) - return ""; - $src = $opt_ip . "/" . - $FilterIflist["opt{$optmatch[1]}"]['sn']; - /* check for opt$NUMip here */ - } else if(preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { - $src = $FilterIflist["opt{$matches[1]}"]['ip']; - if(!is_ipaddr($src)) - return ""; + if($rule['ipprotocol'] == "inet6") { + if(preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { + $opt_ip = $FilterIflist["opt{$optmatch[1]}"]['ipv6']; + if(!is_ipaddr($opt_ip)) + return ""; + $src = $opt_ip . "/" . + $FilterIflist["opt{$optmatch[1]}"]['snv6']; + /* check for opt$NUMip here */ + } else if(preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { + $src = $FilterIflist["opt{$matches[1]}"]['ipv6']; + if(!is_ipaddr($src)) + return ""; + } + if(isset($rule[$target]['not'])) + $src = " !{$src}"; + } else { + if(preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { + $opt_ip = $FilterIflist["opt{$optmatch[1]}"]['ip']; + if(!is_ipaddr($opt_ip)) + return ""; + $src = $opt_ip . "/" . + $FilterIflist["opt{$optmatch[1]}"]['sn']; + /* check for opt$NUMip here */ + } else if(preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { + $src = $FilterIflist["opt{$matches[1]}"]['ip']; + if(!is_ipaddr($src)) + return ""; + } + if(isset($rule[$target]['not'])) + $src = " !{$src}"; } - if(isset($rule[$target]['not'])) - $src = " !{$src}"; } else { - switch ($rule[$target]['network']) { - case 'wan': - $wansa = $FilterIflist['wan']['sa']; - $wansn = $FilterIflist['wan']['sn']; - $src = "{$wansa}/{$wansn}"; - break; - case 'wanip': - $src = $FilterIflist["wan"]['ip']; - break; - case 'lanip': - $src = $FilterIflist["lan"]['ip']; - break; - case 'lan': - $lansa = $FilterIflist['lan']['sa']; - $lansn = $FilterIflist['lan']['sn']; - $src = "{$lansa}/{$lansn}"; - break; - case 'pptp': - $pptpsa = gen_subnet($FilterIflist['pptp']['ip'], $FilterIflist['pptp']['sn']); - $pptpsn = $FilterIflist['pptp']['sn']; - $src = "{$pptpsa}/{$pptpsn}"; - break; - case 'pppoe': - $pppoesa = gen_subnet($FilterIflist['pppoe']['ip'], $FilterIflist['pppoe']['sn']); - $pppoesn = $FilterIflist['pppoe']['sn']; - $src = "{$pppoesa}/{$pppoesn}"; - break; + if($rule['ipprotocol'] == "inet6") { + switch ($rule[$target]['network']) { + case 'wan': + $wansa = $FilterIflist['wan']['sav6']; + $wansn = $FilterIflist['wan']['snv6']; + $src = "{$wansa}/{$wansn}"; + break; + case 'wanip': + $src = $FilterIflist["wan"]['ipv6']; + break; + case 'lanip': + $src = $FilterIflist["lan"]['ipv6']; + break; + case 'lan': + $lansa = $FilterIflist['lan']['sav6']; + $lansn = $FilterIflist['lan']['snv6']; + $src = "{$lansa}/{$lansn}"; + break; + } + if(isset($rule[$target]['not'])) $src = "!{$src}"; + } else { + switch ($rule[$target]['network']) { + case 'wan': + $wansa = $FilterIflist['wan']['sa']; + $wansn = $FilterIflist['wan']['sn']; + $src = "{$wansa}/{$wansn}"; + break; + case 'wanip': + $src = $FilterIflist["wan"]['ip']; + break; + case 'lanip': + $src = $FilterIflist["lan"]['ip']; + break; + case 'lan': + $lansa = $FilterIflist['lan']['sa']; + $lansn = $FilterIflist['lan']['sn']; + $src = "{$lansa}/{$lansn}"; + break; + case 'pptp': + $pptpsa = gen_subnet($FilterIflist['pptp']['ip'], $FilterIflist['pptp']['sn']); + $pptpsn = $FilterIflist['pptp']['sn']; + $src = "{$pptpsa}/{$pptpsn}"; + break; + case 'pppoe': + $pppoesa = gen_subnet($FilterIflist['pppoe']['ip'], $FilterIflist['pppoe']['sn']); + $pppoesn = $FilterIflist['pppoe']['sn']; + $src = "{$pppoesa}/{$pppoesn}"; + break; + } + if(isset($rule[$target]['not'])) $src = "!{$src}"; } - if(isset($rule[$target]['not'])) $src = "!{$src}"; } } else if($rule[$target]['address']) { $expsrc = alias_expand($rule[$target]['address']); @@ -1641,6 +1680,17 @@ function filter_generate_user_rule($rule) { return "# source network or destination network == pptp on " . $rule['descr']; } + if(isset($rule['iprotocol']) && $rule['ipprotocol'] <> "") { + switch($rule['ipprotocol']) { + case "inet": + $aline['ipprotocol'] = "inet"; + break; + case "inet": + $aline['ipprotocol'] = "inet6"; + break; + } + } + /* check for unresolvable aliases */ if($rule['source']['address'] && !alias_expand($rule['source']['address'])) { file_notice("Filter_Reload", "# unresolvable source aliases {$rule['descr']}"); @@ -1677,12 +1727,23 @@ function filter_generate_user_rule($rule) { /* do not process reply-to for gateway'd rules */ if($rule['gateway'] == "" && interface_has_gateway($rule['interface']) && !isset($rule['disablereplyto'])) { - $rg = get_interface_gateway($rule['interface']); - if(is_ipaddr($rg)) { - $aline['reply'] = "reply-to ( {$ifcfg['if']} {$rg} ) "; + if($rule['ipprotocol'] == "inet6") { + $rg = get_interface_gateway_v6($rule['interface']); + if(is_ipaddrv6($rg)) { + $aline['reply'] = "reply-to ( {$ifcfg['if']} {$rg} ) "; + } else { + if($rule['interface'] <> "pptp") { + log_error("Could not find gateway for interface({$rule['interface']})."); + } + } } else { - if($rule['interface'] <> "pptp") { - log_error("Could not find gateway for interface({$rule['interface']})."); + $rg = get_interface_gateway($rule['interface']); + if(is_ipaddr($rg)) { + $aline['reply'] = "reply-to ( {$ifcfg['if']} {$rg} ) "; + } else { + if($rule['interface'] <> "pptp") { + log_error("Could not find gateway for interface({$rule['interface']})."); + } } } } @@ -1698,6 +1759,8 @@ function filter_generate_user_rule($rule) { if(isset($rule['protocol'])) { if($rule['protocol'] == "tcp/udp") $aline['prot'] = " proto { tcp udp } "; + elseif(($rule['protocol'] == "icmp") && ($rule['ipprotocol'] == "inet6")) + $aline['prot'] = " inet6 proto ipv6-icmp "; elseif($rule['protocol'] == "icmp") $aline['prot'] = " inet proto icmp "; else @@ -1737,6 +1800,8 @@ function filter_generate_user_rule($rule) { } if(($rule['protocol'] == "icmp") && $rule['icmptype']) $aline['icmp-type'] = "icmp-type {$rule['icmptype']} "; + if(($rule['protocol'] == "icmp6") && $rule['icmptype']) + $aline['icmp6-type'] = "icmp-type {$rule['icmptype']} "; if(!empty($rule['tag'])) $aline['tag'] = " tag " .$rule['tag']. " "; if(!empty($rule['tagged'])) @@ -1892,8 +1957,8 @@ function filter_generate_user_rule($rule) { /* negate VPN/PPTP/PPPoE networks for load balancer/gateway rules */ $vpns = " to "; $line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . - $aline['interface'] . $aline['prot'] . $aline['src'] . $aline['os'] . - $vpns . $aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . + $aline['interface'] . $aline['ipprotocol'] . $aline['prot'] . $aline['src'] . $aline['os'] . + $vpns . $aline['icmp-type'] . $aline['icmp6-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'] . $aline['schedlabel'] . " label \"NEGATE_ROUTE: Negate policy route for vpn(s)\"\n"; @@ -1901,7 +1966,7 @@ function filter_generate_user_rule($rule) { } /* piece together the actual user rule */ $line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . - $aline['reply'] . $aline['route'] . $aline['prot'] . $aline['src'] . $aline['os'] . $aline['dst'] . + $aline['reply'] . $aline['route'] . $aline['ipprotocol'] . $aline['prot'] . $aline['src'] . $aline['os'] . $aline['dst'] . $aline['divert'] . $aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'] . $aline['schedlabel']; diff --git a/etc/inc/util.inc b/etc/inc/util.inc index 10fa6a5926..e28192a75c 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -218,10 +218,13 @@ function is_module_loaded($module_name) { /* return the subnet address given a host address and a subnet bit count */ function gen_subnet($ipaddr, $bits) { - if (!is_ipaddr($ipaddr) || !is_numeric($bits)) - return ""; - - return long2ip(ip2long($ipaddr) & gen_subnet_mask_long($bits)); + if(is_ipaddrv6($ipaddr)) { + return "{$ipaddr}/{$bits}"; + } else { + if (!is_ipaddr($ipaddr) || !is_numeric($bits)) + return ""; + return long2ip(ip2long($ipaddr) & gen_subnet_mask_long($bits)); + } } /* return the highest (broadcast) address in the subnet given a host address and a subnet bit count */ diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php index a51fdf2164..cc3fdfcf84 100755 --- a/usr/local/www/firewall_rules_edit.php +++ b/usr/local/www/firewall_rules_edit.php @@ -95,6 +95,9 @@ if (isset($id) && $a_filter[$id]) { if (isset($a_filter[$id]['direction'])) $pconfig['direction'] = $a_filter[$id]['direction']; + if (isset($a_filter[$id]['ipprotocol'])) + $pconfig['ipprotocol'] = $a_filter[$id]['ipprotocol']; + if (isset($a_filter[$id]['protocol'])) $pconfig['proto'] = $a_filter[$id]['protocol']; else @@ -401,6 +404,9 @@ if ($_POST) { if (isset($_POST['interface'] )) $filterent['interface'] = $_POST['interface']; + if (isset($_POST['ipprotocol'] )) + $filterent['ipprotocol'] = $_POST['ipprotocol']; + if ($_POST['tcpflags_any']) { $filterent['tcpflags_any'] = true; } else { @@ -532,6 +538,7 @@ if ($_POST) { $filterent['icmptype'] = $a_filter[$id]['icmptype']; else if (isset($filterent['icmptype'])) unset($filterent['icmptype']); + $filterent['source'] = $a_filter[$id]['source']; $filterent['destination'] = $a_filter[$id]['destination']; $filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; @@ -717,6 +724,22 @@ include("head.inc"); + + + + + + + +
  @@ -175,19 +175,43 @@ include("head.inc");
+ +   +
+ +
+ + +
+ +
+
From 290797ea64be6e28c97e563dd688e373263f0154 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 25 Oct 2010 13:48:12 +0200 Subject: [PATCH 012/225] Fix the filter.inc rule generation for icmp to prevent a double inet6 in the rule Add inet6 for user defined rules to ipv6 addresses. --- etc/inc/filter.inc | 8 ++++---- usr/local/www/firewall_rules.php | 12 ++++++++++++ 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 45c47464bb..6905e6165b 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1680,12 +1680,12 @@ function filter_generate_user_rule($rule) { return "# source network or destination network == pptp on " . $rule['descr']; } - if(isset($rule['iprotocol']) && $rule['ipprotocol'] <> "") { + if(isset($rule['ipprotocol'])) { switch($rule['ipprotocol']) { case "inet": $aline['ipprotocol'] = "inet"; break; - case "inet": + case "inet6": $aline['ipprotocol'] = "inet6"; break; } @@ -1760,7 +1760,7 @@ function filter_generate_user_rule($rule) { if($rule['protocol'] == "tcp/udp") $aline['prot'] = " proto { tcp udp } "; elseif(($rule['protocol'] == "icmp") && ($rule['ipprotocol'] == "inet6")) - $aline['prot'] = " inet6 proto ipv6-icmp "; + $aline['prot'] = " proto ipv6-icmp "; elseif($rule['protocol'] == "icmp") $aline['prot'] = " inet proto icmp "; else @@ -1967,7 +1967,7 @@ function filter_generate_user_rule($rule) { /* piece together the actual user rule */ $line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['reply'] . $aline['route'] . $aline['ipprotocol'] . $aline['prot'] . $aline['src'] . $aline['os'] . $aline['dst'] . - $aline['divert'] . $aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . + $aline['divert'] . $aline['icmp-type'] . $aline['icmp6-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'] . $aline['schedlabel']; diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index cdd417a9e5..b3533e2f4b 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -632,6 +632,18 @@ if($_REQUEST['undodrag']) { Date: Mon, 25 Oct 2010 15:54:46 +0200 Subject: [PATCH 013/225] up the subnet bits from 32 to 128 so that the access can be locked down to the host for ipv6. This will require a javascript routine that prevents a subnet mask higher then 32 bits for a ipv4 address. Alternatively the subnet bits should be steered by javascript to prevent use of more then 32 bits on a ipv4 address. When a hostname is used all bets are off, even worse if the hostname is a combined ipv4/ipv6. --- usr/local/www/firewall_aliases_edit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php index 457198cf17..8aa43f67fc 100755 --- a/usr/local/www/firewall_aliases_edit.php +++ b/usr/local/www/firewall_aliases_edit.php @@ -632,7 +632,7 @@ EOD; From 22b5abac48ce99350c7e3d750bfeb0748663bd26 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 26 Oct 2010 11:44:25 +0200 Subject: [PATCH 014/225] Switch over the IPv6 functions from IPv6.inc, these are from the PHP PEAR library --- etc/inc/config.inc | 4 +++- etc/inc/filter.inc | 2 +- etc/inc/util.inc | 50 ++++++++++++---------------------------------- 3 files changed, 17 insertions(+), 39 deletions(-) diff --git a/etc/inc/config.inc b/etc/inc/config.inc index 724615a53a..a00f910ef8 100644 --- a/etc/inc/config.inc +++ b/etc/inc/config.inc @@ -60,6 +60,8 @@ require_once('config.lib.inc'); if($g['booting']) echo "."; require_once("util.inc"); if($g['booting']) echo "."; +require_once("IPv6.inc"); +if($g['booting']) echo "."; if(file_exists("/cf/conf/use_xmlreader")) require_once("xmlreader.inc"); else @@ -211,4 +213,4 @@ if($config_parsed == true) { } } -?> \ No newline at end of file +?> diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 6905e6165b..170de9038a 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -732,7 +732,7 @@ function filter_generate_optcfg_array() { $oic['mss'] = empty($oc['mss']) ? '' : $oc['mss']; $oic['descr'] = $ifdetail; $oic['sa'] = gen_subnet($oic['ip'], $oic['sn']); - $oic['sav6'] = "{$oic['ipv6']}"; + $oic['sav6'] = gen_subnetv6($oic['ipv6'], $oic['snv6']); $oic['nonat'] = $oc['nonat']; $oic['alias-address'] = $oc['alias-address']; $oic['alias-subnet'] = $oc['alias-subnet']; diff --git a/etc/inc/util.inc b/etc/inc/util.inc index e28192a75c..af88d2c5f7 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -218,13 +218,16 @@ function is_module_loaded($module_name) { /* return the subnet address given a host address and a subnet bit count */ function gen_subnet($ipaddr, $bits) { - if(is_ipaddrv6($ipaddr)) { - return "{$ipaddr}/{$bits}"; - } else { - if (!is_ipaddr($ipaddr) || !is_numeric($bits)) - return ""; - return long2ip(ip2long($ipaddr) & gen_subnet_mask_long($bits)); - } + if (!is_ipaddr($ipaddr) || !is_numeric($bits)) + return ""; + return long2ip(ip2long($ipaddr) & gen_subnet_mask_long($bits)); +} + +/* return the subnet address given a host address and a subnet bit count */ +function gen_subnetv6($ipaddr, $bits) { + if (!is_ipaddrv6($ipaddr) || !is_numeric($bits)) + return ""; + return Net_IPv6::getNetmask($ipaddr, $bits); } /* return the highest (broadcast) address in the subnet given a host address and a subnet bit count */ @@ -397,37 +400,10 @@ function is_ipaddr($ipaddr) { return false; } +/* returns true if $ipaddr is a valid IPv6 address */ function is_ipaddrv6($ipaddr) { - /* Not using filter_var here. It misses some test cases */ - /* http://crisp.tweakblogs.net/blog/2031 */ - // fast exit for localhost - if (strlen($ipaddr) < 3) - return $ipaddr == '::'; - - // Check if part is in IPv4 format - if (strpos($ipaddr, '.')) { - $lastcolon = strrpos($ipaddr, ':'); - if (!($lastcolon && validateIPv4(substr(ipaddr, $lastcolon + 1)))) - return false; - - // replace IPv4 part with dummy - $ipaddr = substr($ipaddr, 0, $lastcolon) . ':0:0'; - } - - // check uncompressed - if (strpos($ipaddr, '::') === false) { - return preg_match('/^(?:[a-f0-9]{1,4}:){7}[a-f0-9]{1,4}$/i', $ipaddr); - } - - // check colon-count for compressed format - if (substr_count($ipaddr, ':') < 8) { - return preg_match('/^(?::|(?:[a-f0-9]{1,4}:)+):(?:(?:[a-f0-9]{1,4}:)*[a-f0-9]{1,4})?$/i', $ipaddr); - } - return false; -} - -function validateIPv4($ipaddr) { - return $ipaddr == long2ip(ip2long($ipaddr)); + $result = Net_IPv6::checkIPv6($ipaddr); + return $result; } /* returns true if $ipaddr is a valid dotted IPv4 address */ From 9b1ff0286c36c76e71f01a6664901b69d7c8c598 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 26 Oct 2010 15:40:37 +0200 Subject: [PATCH 015/225] Allow for creation of a ipv6 tunnel for he.net by creating a gif interface. This is the recommended procedure as advised by he.net This allows for using ipv6 local and remote addresses, you will need to add a ipv6 default gateway on the routing tab --- etc/inc/config.gui.inc | 3 ++- etc/inc/interfaces.inc | 8 ++++++-- usr/local/www/interfaces_gif_edit.php | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/etc/inc/config.gui.inc b/etc/inc/config.gui.inc index eea6f33eb8..b41073f428 100644 --- a/etc/inc/config.gui.inc +++ b/etc/inc/config.gui.inc @@ -63,6 +63,7 @@ ini_set("memory_limit","128M"); require_once('config.lib.inc'); require_once("notices.inc"); require_once("util.inc"); +require_once("IPv6.inc"); if(file_exists("/cf/conf/use_xmlreader")) require_once("xmlreader.inc"); else @@ -92,4 +93,4 @@ if($config_parsed == true) { } } -?> \ No newline at end of file +?> diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index aacacfd157..d9b70ae584 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -665,7 +665,11 @@ function interface_gif_configure(&$gif) { /* Do not change the order here for more see gif(4) NOTES section. */ mwexec("/sbin/ifconfig {$gifif} tunnel {$realifip} {$gif['remote-addr']}"); - mwexec("/sbin/ifconfig {$gifif} {$gif['tunnel-local-addr']} {$gif['tunnel-remote-addr']} netmask " . gen_subnet_mask($gif['tunnel-remote-net'])); + if((is_ipaddrv6($gif['tunnel-local-addr'])) || (is_ipaddrv6($gif['tunnel-remote-addr']))) { + mwexec("/sbin/ifconfig {$gifif} inet6 {$gif['tunnel-local-addr']} {$gif['tunnel-remote-addr']} prefixlen {$gif['tunnel-remote-net']} "); + } else { + mwexec("/sbin/ifconfig {$gifif} {$gif['tunnel-local-addr']} {$gif['tunnel-remote-addr']} netmask " . gen_subnet_mask($gif['tunnel-remote-net'])); + } if (isset($gif['link0']) && $gif['link0']) pfSense_interface_flags($gifif, IFF_LINK0); if (isset($gif['link1']) && $gif['link1']) @@ -675,7 +679,7 @@ function interface_gif_configure(&$gif) { else log_error("could not bring gifif up -- variable not defined"); - /* XXX: Needed?! */ + /* XXX: Needed?! Let them use the defined gateways instead */ //mwexec("/sbin/route add {$gif['tunnel-remote-addr']}/{$gif['tunnel-remote-net']} -iface {$gifif}"); file_put_contents("{$g['tmp_path']}/{$gifif}_router", $gif['tunnel-remote-addr']); diff --git a/usr/local/www/interfaces_gif_edit.php b/usr/local/www/interfaces_gif_edit.php index fdde8d4e72..18fa3a2b43 100644 --- a/usr/local/www/interfaces_gif_edit.php +++ b/usr/local/www/interfaces_gif_edit.php @@ -167,7 +167,7 @@ include("head.inc"); +
+ $ifname) { + $oc = $config['interfaces'][$ifent]; + if ((is_array($config['dhcpdv6'][$ifent]) && !isset($config['dhcpdv6'][$ifent]['enable']) && (!is_ipaddrv6($oc['ipaddrv6']))) || + (!is_array($config['dhcpdv6'][$ifent]) && (!is_ipaddrv6($oc['ipaddrv6'])))) + continue; + if ($ifent == $if) + $active = true; + else + $active = false; + $tab_array[] = array($ifname, $active, "services_dhcpv6.php?if={$ifent}"); + $tabscounter++; + } + if ($tabscounter == 0) { + echo "
"; + include("fend.inc"); + echo ""; + echo ""; + exit; + } + display_top_tabs($tab_array); +?> +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
  + onClick="enable_change(false)"> +
  + > +
+
+ +
+ bits +
+ + - + +
+ +
+ +    +
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+ +
+ +
+
+ +
+ +
+
+ +
+
+ +
+ + + + + + + + + +
+ >  +
  + +
+
+
+ "> - +
+ +
+
+ "> - +
+ +
+
+ "> - +
+ +
+
+ "> - +
+ +
+
+ "> - +
+ +
+
+ "> - +
+ + +
  + + " onclick="enable_change(true)"> +
 


+ ,
+
+
+

+
+ + + + + + + + + + + "" or $mapent['ipaddr'] <> ""): ?> + + + + + + + + + + + + + + +
+ + + + + +
+
+ + +   + +   + +   + + + + + + +
')">
+
+ + + + + +
+
+
+
+ + + + + From 65b1e7d56bf793bc302918d1a127e3ccf5faa337 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 28 Oct 2010 12:56:26 +0200 Subject: [PATCH 021/225] Make sure that if either v4 or v6 dhcp servers are enabled that is_dhcp_enabled() will trigger --- etc/inc/pfsense-utils.inc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index 4c9e2b565a..4372daae44 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1054,7 +1054,7 @@ function is_dhcp_server_enabled() $dhcpdenable = false; - if (!is_array($config['dhcpd'])) + if ((!is_array($config['dhcpd'])) && (!is_array($config['dhcpdv6']))) return false; $Iflist = get_configured_interface_list(); @@ -1066,6 +1066,13 @@ function is_dhcp_server_enabled() } } + foreach ($config['dhcpdv6'] as $dhcpv6if => $dhcpv6ifconf) { + if (isset($dhcpv6ifconf['enable']) && isset($Iflist[$dhcpv6if])) { + $dhcpdenable = true; + break; + } + } + return $dhcpdenable; } From 2a1bd0273dcd9ef5748dc9790b103fb9f3ace64e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 28 Oct 2010 14:29:23 +0200 Subject: [PATCH 022/225] Add the rtadvd deamon to advertise the routing. We still need to make a proper config file if we want it to advertise the Carp IP instead of the interface IP Also added safety guard for empty dhcp configs --- etc/inc/services.inc | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index a68c537672..a18bb487e3 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -51,8 +51,10 @@ function services_dhcpd_configure() { } /* kill any running dhcpd */ - if(is_process_running("dhcpd")) + if(is_process_running("dhcpd")) { mwexec("killall dhcpd", true); + mwexec("killall -9 rtadvd", true); + } /* DHCP enabled on any interfaces? */ if (!is_dhcp_server_enabled()) @@ -630,11 +632,16 @@ EOD; /* fire up dhcpd in a chroot */ - mwexec("/usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpd.conf " . - join(" ", $dhcpdifs)); - mwexec("/usr/local/sbin/dhcpd -6 -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpdv6.conf " . - join(" ", $dhcpdv6ifs)); + if(count($dhcpdifs) > 0) { + mwexec("/usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpd.conf " . + join(" ", $dhcpdifs)); + } + if(count($dhcpdv6ifs) > 0) { + mwexec("/usr/local/sbin/dhcpd -6 -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpdv6.conf " . + join(" ", $dhcpdv6ifs)); + mwexec("/usr/sbin/rtadvd " . join(" ", $dhcpdv6ifs)); + } if ($g['booting']) { print "done.\n"; } From ce76a45cc910be25d9e024753811e37a77bf95c0 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 28 Oct 2010 14:50:44 +0200 Subject: [PATCH 023/225] Add icmp6 rules so that stateless autoconfiguration can be used, this also requires that link local addresses work. --- etc/inc/filter.inc | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 170de9038a..e94720acb7 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1762,7 +1762,7 @@ function filter_generate_user_rule($rule) { elseif(($rule['protocol'] == "icmp") && ($rule['ipprotocol'] == "inet6")) $aline['prot'] = " proto ipv6-icmp "; elseif($rule['protocol'] == "icmp") - $aline['prot'] = " inet proto icmp "; + $aline['prot'] = " proto icmp "; else $aline['prot'] = " proto {$rule['protocol']} "; } else { @@ -2044,8 +2044,8 @@ block in $log inet6 all label "Default deny rule IPv6" block out $log inet6 all label "Default deny rule IPv6" # We use the mighty pf, we cannot be fooled. -#block quick inet proto { tcp, udp } from any port = 0 to any -#block quick inet proto { tcp, udp } from any to any port = 0 +block quick inet proto { tcp, udp } from any port = 0 to any +block quick inet proto { tcp, udp } from any to any port = 0 EOD; @@ -2174,6 +2174,18 @@ pass in on \${$oc['descr']} proto udp from any port = 68 to 255.255.255.255 port pass in on \${$oc['descr']} proto udp from any port = 68 to {$oc['ip']} port = 67 label "allow access to DHCP server" pass out on \${$oc['descr']} proto udp from {$oc['ip']} port = 67 to any port = 68 label "allow access to DHCP server" + +EOD; + } + if(isset($config['dhcpdv6'][$on]['enable'])) { + $ipfrules .= << Date: Thu, 28 Oct 2010 15:37:39 +0200 Subject: [PATCH 024/225] Fix typo in services_dhcp_configure() for dhcp6 naming --- etc/inc/services.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index a18bb487e3..4f7cd03a19 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -485,7 +485,7 @@ EOD; $dnscfgv6 = ""; if ($dhcpv6ifconf['domain']) { - $dnscfgv6 .= " dhcp6.option domain-name \"{$dhcpv6ifconf['domain']}\";\n"; + $dnscfgv6 .= " option dhcp6.domain-name \"{$dhcpv6ifconf['domain']}\";\n"; } if($dhcpv6ifconf['domainsearchlist'] <> "") { @@ -512,7 +512,7 @@ EOD; /* is failover dns setup? */ if (is_array($dhcpv6ifconf['dnsserver']) && $dhcpv6ifconf['dnsserver'][0] <> "") { - $dhcpdv6conf .= " option domain-name-servers {$dhcpv6ifconf['dnsserver'][0]}"; + $dhcpdv6conf .= " option dhcp6.name-servers {$dhcpv6ifconf['dnsserver'][0]}"; if($dhcpv6ifconf['dnsserver'][1] <> "") $dhcpdv6conf .= ",{$dhcpv6ifconf['dnsserver'][1]}"; $dhcpdv6conf .= ";\n"; From c75a81850258cbfb62c43e0302b7cea985e7ed77 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 31 Oct 2010 22:36:27 +0100 Subject: [PATCH 025/225] Add function for generating ipv6 subnet mask end, hook into ipv4 subnet mask check as well. --- etc/inc/util.inc | 50 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/etc/inc/util.inc b/etc/inc/util.inc index af88d2c5f7..7bea4898e3 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -238,6 +238,49 @@ function gen_subnet_max($ipaddr, $bits) { return long2ip32(ip2long($ipaddr) | ~gen_subnet_mask_long($bits)); } +/* Generate end number for a given ipv6 subnet mask + * no, it does not perform math */ +function gen_subnetv6_max($ipaddr, $bits) { + if(!is_ipaddrv6($ipaddr)) + return false; + + $subnetstart = gen_subnetv6($ipaddr, $bits); + /* we should have a expanded full ipv6 subnet starting at 0. + * Now split those by the semicolon so we can do 16 bit math */ + $parts = explode(":", $subnetstart); + if(count($parts) <> 8) + return false; + + /* reverse the array, we start with the lsb */ + $parts = array_reverse($parts); + /* set the itteration count properly */ + $bitsleft = 128 - $bits; + $i = 0; + foreach($parts as $part) { + /* foreach 16 bits we go to the next part */ + /* no this isn't proper hex math, neither does it overflow properly */ + while($bitsleft > 0) { + if($part == "0") { + $part = "f"; + } else { + $part = $part . "f"; + } + $bitsleft = $bitsleft - 4; + $j++; + if($j == 4) { + $parts[$i] = $part; + $j = 0; + $i++; + continue 2; + } + } + $i++; + } + $parts = array_reverse($parts); + $subnet_end = implode(":", $parts); + return $subnet_end; +} + /* returns a subnet mask (long given a bit count) */ function gen_subnet_mask_long($bits) { $sm = 0; @@ -920,6 +963,13 @@ function ipcmp($a, $b) { /* return true if $addr is in $subnet, false if not */ function ip_in_subnet($addr,$subnet) { + if(is_ipaddrv6($addr)) { + $result = Net_IPv6::IsInNetmask($addr, $subnet); + if($result) + return true; + else + return false; + } list($ip, $mask) = explode('/', $subnet); $mask = (0xffffffff << (32 - $mask)) & 0xffffffff; return ((ip2long($addr) & $mask) == (ip2long($ip) & $mask)); From a8a98fb45f17db850c79f6915fb78ac5e3a60498 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 1 Nov 2010 08:31:20 +0100 Subject: [PATCH 026/225] Do not throw warnings on empty dhcpd arrays --- etc/inc/pfsense-utils.inc | 20 ++++++++++++-------- etc/inc/services.inc | 6 ++++-- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index 4372daae44..9214b6aa2a 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1059,17 +1059,21 @@ function is_dhcp_server_enabled() $Iflist = get_configured_interface_list(); - foreach ($config['dhcpd'] as $dhcpif => $dhcpifconf) { - if (isset($dhcpifconf['enable']) && isset($Iflist[$dhcpif])) { - $dhcpdenable = true; - break; + if(is_array($config['dhcpd'])) { + foreach ($config['dhcpd'] as $dhcpif => $dhcpifconf) { + if (isset($dhcpifconf['enable']) && isset($Iflist[$dhcpif])) { + $dhcpdenable = true; + break; + } } } - foreach ($config['dhcpdv6'] as $dhcpv6if => $dhcpv6ifconf) { - if (isset($dhcpv6ifconf['enable']) && isset($Iflist[$dhcpv6if])) { - $dhcpdenable = true; - break; + if(is_array($config['dhcpdv6'])) { + foreach ($config['dhcpdv6'] as $dhcpv6if => $dhcpv6ifconf) { + if (isset($dhcpv6ifconf['enable']) && isset($Iflist[$dhcpv6if])) { + $dhcpdenable = true; + break; + } } } diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 4f7cd03a19..65e50ff7cf 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -112,8 +112,10 @@ function services_dhcpd_configure() { } $syscfg = $config['system']; - $dhcpdcfg = $config['dhcpd']; - $dhcpdv6cfg = $config['dhcpdv6']; + if (!is_array($config['dhcpd'])) + $config['dhcpd'] = array(); + if (!is_array($config['dhcpdv6'])) + $config['dhcpdv6'] = array(); $Iflist = get_configured_interface_list(); if ($g['booting']) From d57293a4f7c48035b026592feaf550f43feca6f3 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 2 Nov 2010 10:13:51 +0100 Subject: [PATCH 027/225] Fix services.inc dhcp6 configuration, add route advertising deamon config --- etc/inc/filter.inc | 51 +++++++++++++++-------------- etc/inc/services.inc | 78 +++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 100 insertions(+), 29 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 7448ac4a7f..15282eba29 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1514,35 +1514,34 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { if(strstr($rule[$target]['network'], "opt")) { $optmatch = ""; $matches = ""; - if($rule['ipprotocol'] == "inet6") { - /* check for opt$NUMip here */ - if (preg_match("/opt([0-9]*)ip/", $rule[$target]['networkv6'], $matches)) { - $src = $FilterIflist["opt{$matches[1]}"]['ipv6']; - if(!is_ipaddrv6($src)) + if(preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { + $opt_ip = $FilterIflist["opt{$optmatch[1]}"]['ipv6']; + if(!is_ipaddr($opt_ip)) return ""; - } else if (preg_match("/opt([0-9]*)$/", $rule[$target]['networkv6'], $optmatch)) { - $opt_ipv6 = $FilterIflist["opt{$optmatch[1]}"]['ipv6']; - if(!is_ipaddr($opt_ipv6)) - return ""; - $src = $opt_ipv6 . "/" . + $src = $opt_ip . "/" . $FilterIflist["opt{$optmatch[1]}"]['snv6']; - + /* check for opt$NUMip here */ + } else if(preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { + $src = $FilterIflist["opt{$matches[1]}"]['ipv6']; + if(!is_ipaddr($src)) + return ""; + } if(isset($rule[$target]['not'])) $src = " !{$src}"; } else { - /* check for opt$NUMip here */ - if (preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { - $src = $FilterIflist["opt{$matches[1]}"]['ip']; - if(!is_ipaddr($src)) - return ""; - } else if (preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { + if(preg_match("/opt([0-9]*)$/", $rule[$target]['network'], $optmatch)) { $opt_ip = $FilterIflist["opt{$optmatch[1]}"]['ip']; if(!is_ipaddr($opt_ip)) return ""; $src = $opt_ip . "/" . $FilterIflist["opt{$optmatch[1]}"]['sn']; - + /* check for opt$NUMip here */ + } else if(preg_match("/opt([0-9]*)ip/", $rule[$target]['network'], $matches)) { + $src = $FilterIflist["opt{$matches[1]}"]['ip']; + if(!is_ipaddr($src)) + return ""; + } if(isset($rule[$target]['not'])) $src = " !{$src}"; } @@ -1596,8 +1595,7 @@ function filter_generate_address(& $rule, $target = "source", $isnat = false) { $src = "{$pppoesa}/{$pppoesn}"; break; } - if(isset($rule[$target]['not'])) - $src = "!{$src}"; + if(isset($rule[$target]['not'])) $src = "!{$src}"; } } } else if($rule[$target]['address']) { @@ -2170,23 +2168,26 @@ EOD; /* allow access to DHCP server on interfaces */ if(isset($config['dhcpd'][$on]['enable'])) { $ipfrules .= << $dhcpv6ifconf) { + $rtadvdnum++; + $realif = get_real_interface($dhcpv6if); + $rtadvdifs[] = $realif; + + $ifcfgipv6 = get_interface_ipv6($dhcpv6if); + $ifcfgsnv6 = get_interface_subnetv6($dhcpv6if); + $subnetv6 = gen_subnetv6($ifcfgipv6, $ifcfgsnv6); + $subnetmaskv6 = gen_subnet_mask($ifcfgsnv6); + + $rtadvdconf .= "{$realif}:\\\n"; + $rtadvdconf .= "\t:addr=\"{$subnetv6}\":\\\n"; + $rtadvdconf .= "\t:prefixlen#{$ifcfgsnv6}:\\\n"; + $rtadvdconf .= "\t:raflags#192:\n"; + $rtadvdconf .= "\n"; + + } + + fwrite($fd, $rtadvdconf); + fclose($fd); + + if(count($rtadvdifs) > 0) { + mwexec("/usr/sbin/rtadvd -d -c {$g['varetc_path']}/rtadvd.conf " . join(" ", $rtadvdifs)); + } + return 0; +} + function services_dhcpd_configure() { global $config, $g; @@ -53,7 +117,6 @@ function services_dhcpd_configure() { /* kill any running dhcpd */ if(is_process_running("dhcpd")) { mwexec("killall dhcpd", true); - mwexec("killall -9 rtadvd", true); } /* DHCP enabled on any interfaces? */ @@ -116,6 +179,8 @@ function services_dhcpd_configure() { $config['dhcpd'] = array(); if (!is_array($config['dhcpdv6'])) $config['dhcpdv6'] = array(); + $dhcpdcfg = $config['dhcpd']; + $dhcpdv6cfg = $config['dhcpdv6']; $Iflist = get_configured_interface_list(); if ($g['booting']) @@ -477,8 +542,8 @@ EOD; continue; $ifcfgipv6 = get_interface_ipv6($dhcpv6if); $ifcfgsnv6 = get_interface_subnetv6($dhcpv6if); - $subnetv6 = gen_subnetv6($ifcfgip, $ifcfgsn); - $subnetmaskv6 = gen_subnet_mask($ifcfgsn); + $subnetv6 = gen_subnetv6($ifcfgipv6, $ifcfgsnv6); + $subnetmaskv6 = gen_subnet_mask($ifcfgsnv6); if($is_olsr_enabled == true) if($dhcpv6ifconf['netmask']) @@ -644,6 +709,10 @@ EOD; join(" ", $dhcpdv6ifs)); mwexec("/usr/sbin/rtadvd " . join(" ", $dhcpdv6ifs)); } + + /* start ipv6 route advertising if required */ + services_rtadvd_configure(); + if ($g['booting']) { print "done.\n"; } @@ -869,6 +938,7 @@ function services_dyndns_configure_client($conf) { $dnsWilcard = $conf['wildcard'], $dnsMX = $conf['mx'], $dnsIf = "{$conf['interface']}"); + } function services_dyndns_configure($int = "") { From 27b82e7cee50762b61b796223602ec896b32136c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 2 Nov 2010 14:21:32 +0100 Subject: [PATCH 028/225] Remove debug flag from rtadvd --- etc/inc/services.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 6067d93072..f3e9cd3e4c 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -98,7 +98,7 @@ function services_rtadvd_configure() { fclose($fd); if(count($rtadvdifs) > 0) { - mwexec("/usr/sbin/rtadvd -d -c {$g['varetc_path']}/rtadvd.conf " . join(" ", $rtadvdifs)); + mwexec("/usr/sbin/rtadvd -c {$g['varetc_path']}/rtadvd.conf " . join(" ", $rtadvdifs)); } return 0; } From 7617e245bb6886848a23cd453fb720eefe2bff8b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 2 Nov 2010 21:43:07 +0100 Subject: [PATCH 029/225] Verify that we validate against a ipv6 subnet properly. This should help for static route gateways --- usr/local/www/system_gateways_edit.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 8db28530f9..166e6ab8bc 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -118,12 +118,18 @@ if ($_POST) { } else { $parent_ip = get_interface_ip($_POST['interface']); } - if (is_ipaddr($parent_ip)) { + if (is_ipaddrv4($parent_ip)) { $parent_sn = get_interface_subnet($_POST['interface']); if(!ip_in_subnet($_POST['gateway'], gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn)) { $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet."), $_POST['gateway']); } } + if (is_ipaddrv6($parent_ip)) { + $parent_sn = get_interface_subnetv6($_POST['interface']); + if(!ip_in_subnet($_POST['gateway'], gen_subnetv6($parent_ip, $parent_sn) . "/" . $parent_sn)) { + $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet."), $_POST['gateway']); + } + } } if (($_POST['monitor'] <> "") && !is_ipaddr($_POST['monitor']) && $_POST['monitor'] != "dynamic") { $input_errors[] = gettext("A valid monitor IP address must be specified."); From 14f565b4210af36dc26af97a3cecdd966af791a9 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 2 Nov 2010 22:00:05 +0100 Subject: [PATCH 030/225] Allow the entry of ipv6 networks, needs verification to prevent ipv4 gateways for ipv6 networks and vice versa --- usr/local/www/system_routes_edit.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/usr/local/www/system_routes_edit.php b/usr/local/www/system_routes_edit.php index 96d24d5851..d48c542da8 100755 --- a/usr/local/www/system_routes_edit.php +++ b/usr/local/www/system_routes_edit.php @@ -104,7 +104,12 @@ if ($_POST) { } /* check for overlaps */ - $osn = gen_subnet($_POST['network'], $_POST['network_subnet']) . "/" . $_POST['network_subnet']; + if(is_ipaddrv6($_POST['network'])) { + $osn = Net_IPv6::compress(gen_subnetv6($_POST['network'], $_POST['network_subnet'])) . "/" . $_POST['network_subnet']; + } + if(is_ipaddrv4($POST['network'])) { + $osn = gen_subnet($_POST['network'], $_POST['network_subnet']) . "/" . $_POST['network_subnet']; + } foreach ($a_routes as $route) { if (isset($id) && ($a_routes[$id]) && ($a_routes[$id] === $route)) continue; From 4ebde16510a7626f411253e70be0143c8376ae18 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 2 Nov 2010 23:01:40 +0100 Subject: [PATCH 031/225] Make sure that the filter rules for static routes are correctly generated for ipv4 and ipv6 --- etc/inc/filter.inc | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 15282eba29..2b338583b9 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2347,19 +2347,37 @@ EOD; $friendly = $GatewaysList[$route['gateway']]['friendlyiface']; if(is_array($FilterIflist[$friendly])) { $oc = $FilterIflist[$friendly]; - if($oc['ip']) { - $sa = $oc['sa']; - $sn = $oc['sn']; - $if = $oc['if']; - } - if($sa) { - $ipfrules .= << Date: Wed, 3 Nov 2010 10:30:03 +0100 Subject: [PATCH 032/225] Make it possible to create a inet6 carp address. This works surprisingly What doesn't work is removing the previous IPv6 address from a interface. This should be hooked into the edit page --- etc/inc/interfaces.inc | 35 +++++++++++++++++----- usr/local/www/firewall_virtual_ip_edit.php | 34 +++++++++++++++------ 2 files changed, 52 insertions(+), 17 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 2227788de2..f1b7179013 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1701,12 +1701,23 @@ function interface_carp_configure(&$vip) { return; } - /* Ensure CARP IP really exists prior to loading up. */ - $ww_subnet_ip = find_interface_ip($realif); - $ww_subnet_bits = find_interface_subnet($realif); - if (!ip_in_subnet($vip['subnet'], gen_subnet($ww_subnet_ip, $ww_subnet_bits) . "/" . $ww_subnet_bits) && !ip_in_interface_alias_subnet($vip['interface'], $vip['subnet'])) { - file_notice("CARP", "Sorry but we could not find a matching real interface subnet for the virtual IP address {$vip['subnet']}.", "Firewall: Virtual IP", ""); - return; + if(is_ipaddrv4($vip['subnet'])) { + /* Ensure CARP IP really exists prior to loading up. */ + $ww_subnet_ip = find_interface_ip($realif); + $ww_subnet_bits = find_interface_subnet($realif); + if (!ip_in_subnet($vip['subnet'], gen_subnet($ww_subnet_ip, $ww_subnet_bits) . "/" . $ww_subnet_bits) && !ip_in_interface_alias_subnet($vip['interface'], $vip['subnet'])) { + file_notice("CARP", "Sorry but we could not find a matching real interface subnet for the virtual IP address {$vip['subnet']}.", "Firewall: Virtual IP", ""); + return; + } + } + if(is_ipaddrv6($vip['subnet'])) { + /* Ensure CARP IP really exists prior to loading up. */ + $ww_subnet_ip = find_interface_ipv6($realif); + $ww_subnet_bits = find_interface_subnetv6($realif); + if (!ip_in_subnet($vip['subnet'], gen_subnetv6($ww_subnet_ip, $ww_subnet_bits) . "/" . $ww_subnet_bits) && !ip_in_interface_alias_subnet($vip['interface'], $vip['subnet'])) { + file_notice("CARP", "Sorry but we could not find a matching real interface subnet for the virtual IPv6 address {$vip['subnet']}.", "Firewall: Virtual IP", ""); + return; + } } /* create the carp interface and setup */ @@ -1721,8 +1732,14 @@ function interface_carp_configure(&$vip) { /* invalidate interface cache */ get_interface_arr(true); - $broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']); - mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$password}"); + if(is_ipaddrv4($vip['subnet'])) { + $broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']); + mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$password}"); + } + if(is_ipaddrv6($vip['subnet'])) { + $broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']); + mwexec("/sbin/ifconfig {$vipif} inet6 {$vip['subnet']} prefixlen {$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$password}"); + } interfaces_bring_up($vipif); @@ -2347,6 +2364,7 @@ function find_dhclient_process($interface) { function interface_configure($interface = "wan", $reloadall = false, $linkupevent = false) { global $config, $g; global $interface_sn_arr_cache, $interface_ip_arr_cache; + global $interface_snv6_arr_cache, $interface_ipv6_arr_cache; $wancfg = $config['interfaces'][$interface]; @@ -2355,6 +2373,7 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven if (!$g['booting']) { /* remove all IPv4 addresses */ while (mwexec("/sbin/ifconfig " . escapeshellarg($realif) . " -alias", true) == 0); + while (mwexec("/sbin/ifconfig " . escapeshellarg($realif) . " inet6 -alias", true) == 0); switch ($wancfg['ipaddr']) { case 'pppoe': diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index 79398bd076..1706cfd421 100755 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -116,9 +116,14 @@ if ($_POST) { $input_errors[] = sprintf(gettext("The %s IP address may not be used in a virtual entry."),$natdescr); } - if($_POST['subnet_bits'] == "32" and $_POST['type'] == "carp") - $input_errors[] = gettext("The /32 subnet mask is invalid for CARP IPs."); - + if(is_ipaddrv4($_POST['subnet'])) { + if($_POST['subnet_bits'] == "32" and $_POST['type'] == "carp") + $input_errors[] = gettext("The /32 subnet mask is invalid for CARP IPs."); + } + if(is_ipaddrv6($_POST['subnet'])) { + if($_POST['subnet_bits'] == "128" and $_POST['type'] == "carp") + $input_errors[] = gettext("The /128 subnet mask is invalid for CARP IPs."); + } /* check for overlaps with other virtual IP */ foreach ($a_vip as $vipent) { if (isset($id) && ($a_vip[$id]) && ($a_vip[$id] === $vipent)) @@ -144,11 +149,22 @@ if ($_POST) { if($_POST['password'] == "") $input_errors[] = gettext("You must specify a CARP password that is shared between the two VHID members."); - $parent_ip = get_interface_ip($_POST['interface']); - $parent_sn = get_interface_subnet($_POST['interface']); - if (!ip_in_subnet($_POST['subnet'], gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn) && !ip_in_interface_alias_subnet($_POST['interface'], $_POST['subnet'])) { - $cannot_find = $_POST['subnet'] . "/" . $_POST['subnet_bits'] ; - $input_errors[] = sprintf(gettext("Sorry, we could not locate an interface with a matching subnet for %s. Please add an IP alias in this subnet on this interface."),$cannot_find); + if(is_ipaddrv4($_POST['subnet'])) { + $parent_ip = get_interface_ip($_POST['interface']); + $parent_sn = get_interface_subnet($_POST['interface']); + if (!ip_in_subnet($_POST['subnet'], gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn) && !ip_in_interface_alias_subnet($_POST['interface'], $_POST['subnet'])) { + $cannot_find = $_POST['subnet'] . "/" . $_POST['subnet_bits'] ; + $input_errors[] = sprintf(gettext("Sorry, we could not locate an interface with a matching subnet for %s. Please add an IP alias in this subnet on this interface."),$cannot_find); + } + } + if(is_ipaddrv6($_POST['subnet'])) { + $parent_ip = get_interface_ipv6($_POST['interface']); + $parent_sn = get_interface_subnetv6($_POST['interface']); + $subnet = gen_subnetv6($parent_ip, $parent_sn); + if (!ip_in_subnet($_POST['subnet'], gen_subnetv6($parent_ip, $parent_sn) . "/" . $parent_sn) && !ip_in_interface_alias_subnet($_POST['interface'], $_POST['subnet'])) { + $cannot_find = $_POST['subnet'] . "/" . $_POST['subnet_bits'] ; + $input_errors[] = sprintf(gettext("Sorry, we could not locate an interface with a matching subnet for %s. Please add an IP alias in this subnet on this interface."),$cannot_find); + } } } @@ -400,7 +416,7 @@ function typesel_change() {    / +
- +
- + autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value=""> / @@ -932,7 +932,8 @@ include("head.inc"); / diff --git a/usr/local/www/system_routes_edit.php b/usr/local/www/system_routes_edit.php index 3fb4fba15c..08deb77544 100755 --- a/usr/local/www/system_routes_edit.php +++ b/usr/local/www/system_routes_edit.php @@ -173,7 +173,7 @@ include("head.inc"); / > +
+ + + + + +
+ .
+ . + + + + + > + +
+ +
+
+ + + + + +
   + / + +
+
+ + + + + + + > + +
+ +
+
+ + + + + +
   + + / + +
+
+
+ + + + + +
+ + +   + + "> " onclick="history.back()"> + + + + + + + + + + From 462f9006075313e1bdeb0cfe07db54e3156fda16 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 21 Jan 2011 09:48:53 +0100 Subject: [PATCH 060/225] Add filter code for adding the binat rules required for Network Prefix Translation --- etc/inc/filter.inc | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 72435de4bf..c3044bd861 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1228,6 +1228,35 @@ function filter_nat_rules_generate() { $reflection_txt .= filter_generate_reflection_nat($rule, $route_table, $nat_if_list, "", $srcaddr, $srcip, $sn); } } + + /* Add binat rules for Network Prefix translation */ + if(is_array($config['nat']['npt'])) { + foreach ($config['nat']['npt'] as $rule) { + if (isset($rule['disabled'])) + continue; + + if (!$rule['interface']) + $natif = "wan"; + else + $natif = $rule['interface']; + if (!isset($FilterIflist[$natif])) + continue; + + $srcaddr = filter_generate_address($rule, 'source'); + $dstaddr = filter_generate_address($rule, 'destination'); + + $srcaddr = trim($srcaddr); + $dstaddr = trim($dstaddr); + + $natif = $FilterIflist[$natif]['descr']; + + $natrules .= "binat on \${$natif} from {$srcaddr} to any -> {$dstaddr}\n"; + $natrules .= "binat on \${$natif} from any to {$dstaddr} -> {$srcaddr}\n"; + + } + } + + $natrules .= "\n# Outbound NAT rules\n"; /* outbound rules - advanced or standard */ if(isset($config['nat']['advancedoutbound']['enable'])) { From e5d83b70cfb8ee128cc71b842e080abc7f8b218b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sat, 22 Jan 2011 22:04:45 +0100 Subject: [PATCH 061/225] Fix dhcp server group --- etc/inc/services.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 1d923b05be..0fa3c98ee3 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -717,12 +717,12 @@ EOD; /* fire up dhcpd in a chroot */ if(count($dhcpdifs) > 0) { - mwexec("/usr/local/sbin/dhcpd -user dhcpd -group dhcpd -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpd.conf " . + mwexec("/usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpd.conf " . join(" ", $dhcpdifs)); } if(count($dhcpdv6ifs) > 0) { - mwexec("/usr/local/sbin/dhcpd -6 -user dhcpd -group dhcpd -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpdv6.conf " . + mwexec("/usr/local/sbin/dhcpd -6 -user dhcpd -group _dhcp -chroot {$g['dhcpd_chroot_path']} -cf /etc/dhcpdv6.conf " . join(" ", $dhcpdv6ifs)); mwexec("/usr/sbin/rtadvd " . join(" ", $dhcpdv6ifs)); } From 29bed6ca0b1755508fe94e4e73cc4eb306d1f2e8 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 11:41:16 +0100 Subject: [PATCH 062/225] Adjust the loopback firewall rules for inet and inet6 and give them unique labels --- etc/inc/filter.inc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index c3044bd861..1be7faa570 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2280,10 +2280,10 @@ EOD; $ipfrules .= << Date: Wed, 26 Jan 2011 11:43:27 +0100 Subject: [PATCH 063/225] Adjust firewall rule to reflect inet or inet6 --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 1be7faa570..686462492b 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2289,7 +2289,7 @@ EOD; $ipfrules .= << Date: Wed, 26 Jan 2011 11:45:11 +0100 Subject: [PATCH 064/225] Setup packet spoofing rules for inet and inet6 Adjust the default Deny All rules for inet and inet6, rename labels --- etc/inc/filter.inc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 686462492b..091f026d16 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2082,14 +2082,16 @@ function filter_rules_generate() { #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- -block in $log all label "Default deny rule" -block out $log all label "Default deny rule" +block in $log inet all label "Default deny rule IPv4" +block out $log inet all label "Default deny rule IPv4" block in $log inet6 all label "Default deny rule IPv6" block out $log inet6 all label "Default deny rule IPv6" # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any block quick inet proto { tcp, udp } from any to any port = 0 +block quick inet6 proto { tcp, udp } from any port = 0 to any +block quick inet6 proto { tcp, udp } from any to any port = 0 EOD; From b0538842600fe7bd8af9124d637a31c232ccc35d Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 11:54:36 +0100 Subject: [PATCH 065/225] Add the IPv6 fc00::/7 and fEc0::/10 to the Private block on WAN --- etc/inc/filter.inc | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 091f026d16..b6c39dcfc4 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2214,10 +2214,12 @@ EOD; $ipfrules .= << Date: Wed, 26 Jan 2011 12:53:20 +0100 Subject: [PATCH 066/225] Add the bogonsv6 table for the IPv6 bogons --- etc/rc.update_bogons.sh | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/etc/rc.update_bogons.sh b/etc/rc.update_bogons.sh index 52cfc1abf3..52ec92f151 100755 --- a/etc/rc.update_bogons.sh +++ b/etc/rc.update_bogons.sh @@ -28,6 +28,15 @@ if [ ! -f /tmp/bogons ]; then exit fi +/usr/bin/fetch -q -o /tmp/bogonsv6 "http://files.pfsense.org/mirrors/fullbogons-ipv6.txt" +if [ ! -f /tmp/bogonsv6 ]; then + echo "Could not download http://files.pfsense.org/mirrors/fullbogons-ipv6.txt" | logger + # Relaunch and sleep + sh /etc/rc.update_bogons.sh & + exit +fi + + BOGON_MD5=`/usr/bin/fetch -q -o - "http://files.pfsense.org/mirrors/bogon-bn-nonagg.txt.md5" | awk '{ print $4 }'` ON_DISK_MD5=`md5 /tmp/bogons | awk '{ print $4 }'` if [ "$BOGON_MD5" = "$ON_DISK_MD5" ]; then @@ -42,5 +51,19 @@ else sh /etc/rc.update_bogons.sh & fi +BOGON_MD5=`/usr/bin/fetch -q -o - "http://files.pfsense.org/mirrors/fullbogons-ipv6.txt.md5" | awk '{ print $4 }'` +ON_DISK_MD5=`md5 /tmp/bogonsv6 | awk '{ print $4 }'` +if [ "$BOGON_MD5" = "$ON_DISK_MD5" ]; then + egrep -v "^#" /tmp/bogonsv6 > /etc/bogonsv6 + /etc/rc.conf_mount_ro + RESULT=`/sbin/pfctl -t bogonsv6 -T replace -f /etc/bogonsv6 2>&1` + rm /tmp/bogons + echo "Bogons files downloaded: $RESULT" | logger +else + echo "Could not download http://files.pfsense.org/mirrors/fullbogons-ipv6.txt.md5 (md5 mismatch)" | logger + # Relaunch and sleep + sh /etc/rc.update_bogons.sh & +fi + echo "rc.update_bogons.sh is ending the update cycle." | logger From 1525ca4c9dcf2816f76ced484eb3b9c7b4dc035c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 12:55:22 +0100 Subject: [PATCH 067/225] reference the IPv6 bogons table as well --- etc/inc/filter.inc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index b6c39dcfc4..ad7a98651f 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2189,10 +2189,13 @@ EOD; if(isset($config['interfaces'][$on]['blockbogons'])) { if($bogontableinstalled == 0) $ipfrules .= "table persist file \"/etc/bogons\"\n"; + $ipfrules .= "table persist file \"/etc/bogonsv6\"\n"; $ipfrules .= << to any label "block bogon networks from {$oc['descr']}" +# http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt +block in $log quick on \${$oc['descr']} from to any label "block bogon IPv4 networks from {$oc['descr']}" +block in $log quick on \${$oc['descr']} from to any label "block bogon IPv6 networks from {$oc['descr']}" EOD; $bogontableinstalled++; From 80766f711abe51660dd18cf721452aff48aad370 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 13:14:00 +0100 Subject: [PATCH 068/225] Do not block fec0::/10 as this includes fe80:: local link addresses which breaks everything else --- etc/inc/filter.inc | 1 - 1 file changed, 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index ad7a98651f..635afbd70e 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2222,7 +2222,6 @@ block in $log quick on \${$oc['descr']} from 127.0.0.0/8 to any label "Block pri block in $log quick on \${$oc['descr']} from 172.16.0.0/12 to any label "Block private networks from {$oc['descr']} block 172.16/12" block in $log quick on \${$oc['descr']} from 192.168.0.0/16 to any label "Block private networks from {$oc['descr']} block 192.168/16" block in $log quick on \${$oc['descr']} from fc00::/7 to any label "Block ULA networks from {$oc['descr']} block fc00::/7" -block in $log quick on \${$oc['descr']} from fec0::/10 to any label "Block ULA networks from {$oc['descr']} block fec0::/10" EOD; } From 1f321f668f823128894465f9f764a369b4abc22b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 13:22:46 +0100 Subject: [PATCH 069/225] Move the ICMP rules further to the top in order for normal neighbour contact via icmp6 to work --- etc/inc/filter.inc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 635afbd70e..ae54409d37 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2087,6 +2087,11 @@ block out $log inet all label "Default deny rule IPv4" block in $log inet6 all label "Default deny rule IPv6" block out $log inet6 all label "Default deny rule IPv6" +# IPv6 ICMP is not auxilary, it is required for operation +#pass out quick proto ipv6-icmp from any to any keep state +# Allow only bare essential icmpv6 packets (NS, NA, and RA) +pass quick inet6 proto ipv6-icmp from any to any icmp6-type {neighbradv,neighbrsol,routeradv} + # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any block quick inet proto { tcp, udp } from any to any port = 0 @@ -2298,11 +2303,6 @@ EOD; pass out inet all keep state allow-opts label "let out anything IPv4 from firewall host itself" pass out inet6 all keep state allow-opts label "let out anything IPv6 from firewall host itself" -# IPv6 ICMP is not auxilary, it is required for operation -#pass out quick proto ipv6-icmp from any to any keep state -# Allow only bare essential icmpv6 packets (NS, NA, and RA) -pass quick inet6 proto ipv6-icmp from any to any icmp6-type {neighbradv,neighbrsol,routeradv} - EOD; foreach ($FilterIflist as $ifdescr => $ifcfg) { if(isset($ifcfg['virtual'])) From 2259901018552f8a8432e295b8d6064fa918cda0 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 14:27:08 +0100 Subject: [PATCH 070/225] Show the TCP protocol for ipv6 filter rules --- etc/inc/filter_log.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/inc/filter_log.inc b/etc/inc/filter_log.inc index ed4b311790..1c0e9ef6fe 100644 --- a/etc/inc/filter_log.inc +++ b/etc/inc/filter_log.inc @@ -135,6 +135,8 @@ function parse_filter_line($line) { * boolean FALSE because it could return a valid answer of 0 upon success. */ if (!(strpos($details, 'proto ') === FALSE)) { preg_match("/.*\sproto\s(.*)\s\(/", $details, $proto); + } elseif (!(strpos($details, 'next-header ') === FALSE)) { + preg_match("/.*\snext-header\s(.*)\s\(/", $details, $proto); } elseif (!(strpos($details, 'proto: ') === FALSE)) { preg_match("/.*\sproto\:(.*)\s\(/", $details, $proto); } elseif (!(strpos($leftovers, 'sum ok] ') === FALSE)) { @@ -279,4 +281,4 @@ function handle_ajax($nentries, $tail = 50) { } } -?> \ No newline at end of file +?> From 9caffe86931b6db4002c4323ec6ec4bced96e422 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 26 Jan 2011 17:21:29 +0100 Subject: [PATCH 071/225] Remove duplicate advbase in ifconfig command --- etc/inc/interfaces.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 035a6c293e..fa1203b249 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1852,11 +1852,11 @@ function interface_carp_configure(&$vip) { if(is_ipaddrv4($vip['subnet'])) { $broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']); - mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} advbase {$advbase} {$password}"); + mwexec("/sbin/ifconfig {$vipif} {$vip['subnet']}/{$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$advbase} {$password}"); } if(is_ipaddrv6($vip['subnet'])) { $broadcast_address = gen_subnet_max($vip['subnet'], $vip['subnet_bits']); - mwexec("/sbin/ifconfig {$vipif} inet6 {$vip['subnet']} prefixlen {$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} advbase {$advbase} {$password}"); + mwexec("/sbin/ifconfig {$vipif} inet6 {$vip['subnet']} prefixlen {$vip['subnet_bits']} vhid {$vip['vhid']} advskew {$vip['advskew']} {$advbase} {$password}"); } interfaces_bring_up($vipif); From 6ac28fbd1c8337dac96dd25a06b7d3d47ca13a98 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 27 Jan 2011 08:34:35 +0100 Subject: [PATCH 072/225] Add the bogonsv6 file, it's empty for now --- etc/bogonsv6 | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 etc/bogonsv6 diff --git a/etc/bogonsv6 b/etc/bogonsv6 new file mode 100644 index 0000000000..e69de29bb2 From b3cf4d5abd6b3b186c54c98dd4f04dcdbec6b20f Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 28 Jan 2011 15:17:04 +0100 Subject: [PATCH 073/225] adjust the firewall rules to allow for proper ICMP6 allow so that normal pmtu works --- etc/inc/filter.inc | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 6fbcbcaa69..e9537cb330 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1380,8 +1380,6 @@ function filter_nat_rules_generate() { } if($numberofnathosts > 0): foreach ($FilterIflist as $if => $ifcfg) { - if (substr($ifcfg['if'], 0, 4) == "ovpn") - continue; update_filter_reload_status("Creating outbound rules {$if} - ({$ifcfg['descr']})"); if(interface_has_gateway($if)) { $target = $ifcfg['ip']; @@ -2090,9 +2088,22 @@ block in $log inet6 all label "Default deny rule IPv6" block out $log inet6 all label "Default deny rule IPv6" # IPv6 ICMP is not auxilary, it is required for operation -#pass out quick proto ipv6-icmp from any to any keep state -# Allow only bare essential icmpv6 packets (NS, NA, and RA) -pass quick inet6 proto ipv6-icmp from any to any icmp6-type {neighbradv,neighbrsol,routeradv} +# See man icmp6(4) +# 1 unreach Destination unreachable +# 2 toobig Packet too big +# 128 echoreq Echo service request +# 129 echorep Echo service reply +# 133 routersol Router solicitation +# 134 routeradv Router advertisement +# 135 neighbrsol Neighbor solicitation +# 136 neighbradv Neighbor advertisement +pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,128,129,135,136} keep state + +# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) +pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} keep state +pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} keep state +pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} keep state +pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {129,133,134,135,136} keep state # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any From 161cc65b3f28bd50ef53eab3493cea23786d722e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 28 Jan 2011 15:27:59 +0100 Subject: [PATCH 074/225] Activate the firewall rules for DHCPDv6. Add pass in to port 546, pass out to 547 --- etc/inc/filter.inc | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index e9537cb330..8628fee896 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2285,11 +2285,9 @@ EOD; # allow access to DHCPv6 server on {$oc['descr']} anchor "dhcpv6server{$oc['descr']}" # We need inet6 icmp for stateless autoconfig and dhcpv6 -pass in on \${$oc['descr']} inet6 proto ipv6-icmp from fe80::/10 to ff02::/10 label "allow access to DHCPv6 server" -pass out on \${$oc['descr']} inet6 proto ipv6-icmp from fe80::/10 to ff02::/10 label "allow access to DHCPv6 server" -#pass in on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/10 port = 546 label "allow access to DHCPv6 server" -#pass in on \${$oc['descr']} inet6 proto udp from fe80::/10 to {$oc['ipv6']} port = 546 label "allow access to DHCPv6 server" -#pass out on \${$oc['descr']} inet6 proto udp from {$oc['ipv6']} port = 546 to any label "allow access to DHCPv6 server" +pass in on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/16 port = 546 label "allow access to DHCPv6 server" +pass in on \${$oc['descr']} inet6 proto udp from fe80::/10 to {$oc['ipv6']} port = 546 label "allow access to DHCPv6 server" +pass out on \${$oc['descr']} inet6 proto udp from {$oc['ipv6']} port = 547 to fe80::/10 label "allow access to DHCPv6 server" EOD; } From 9bc8b6b61d92d1dea51a325337d07f305ddac816 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 31 Jan 2011 20:36:24 +0100 Subject: [PATCH 075/225] Add support for IPv6 counters to the RRD graphs. This adds 4 more data sources in the rrd file. The graphing code colors are currently a mismatch and sorts waiting for someone with eyes to adjust to something useful Other themes still need adjusting Packets graph isn't done, that needs the same modification as the traffic counters. updaterrd.sh shell script needs simplyfying and using variables instead of huge amounts of pfctl commands --- etc/inc/globals.inc | 2 +- etc/inc/rrd.inc | 24 ++++-- etc/inc/upgrade_config.inc | 84 ++++++++++++++++++- usr/local/www/status_rrd_graph_img.php | 80 ++++++++++++++++-- .../www/themes/pfsense_ng/rrdcolors.inc.php | 8 +- .../www/themes/the_wall/rrdcolors.inc.php | 8 +- 6 files changed, 182 insertions(+), 24 deletions(-) diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc index 6f64478e23..b20700420e 100644 --- a/etc/inc/globals.inc +++ b/etc/inc/globals.inc @@ -89,7 +89,7 @@ $g = array( "disablehelpmenu" => false, "disablehelpicon" => false, "debug" => false, - "latest_config" => "7.6", + "latest_config" => "7.7", "nopkg_platforms" => array("cdrom"), "minimum_ram_warning" => "105", "minimum_ram_warning_text" => "128 MB", diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 21de58bc39..7ff761f31e 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -278,6 +278,10 @@ function enable_rrd_graphing() { $rrdcreate .= "DS:outpass:COUNTER:$trafficvalid:0:$upstream "; $rrdcreate .= "DS:inblock:COUNTER:$trafficvalid:0:$downstream "; $rrdcreate .= "DS:outblock:COUNTER:$trafficvalid:0:$upstream "; + $rrdcreate .= "DS:inpass6:COUNTER:$trafficvalid:0:$downstream "; + $rrdcreate .= "DS:outpass6:COUNTER:$trafficvalid:0:$upstream "; + $rrdcreate .= "DS:inblock6:COUNTER:$trafficvalid:0:$downstream "; + $rrdcreate .= "DS:outblock6:COUNTER:$trafficvalid:0:$upstream "; $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; $rrdcreate .= "RRA:AVERAGE:0.5:5:1000 "; $rrdcreate .= "RRA:AVERAGE:0.5:60:1000 "; @@ -288,14 +292,16 @@ function enable_rrd_graphing() { /* enter UNKNOWN values in the RRD so it knows we rebooted. */ if($g['booting']) { - mwexec("$rrdtool update $rrddbpath$ifname$traffic N:U:U:U:U"); + mwexec("$rrdtool update $rrddbpath$ifname$traffic N:U:U:U:U:U:U:U:U"); } $rrdupdatesh .= "\n"; - $rrdupdatesh .= "# polling traffic for interface $ifname $realif \n"; + $rrdupdatesh .= "# polling traffic for interface $ifname $realif IPv4/IPv6 counters \n"; $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$traffic N:\\\n"; $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass/ {printf \$6 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$6 \":\"}'|sed -e 's/.\$//'`\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$6 \":\"}'`\\\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Pass|Out6\/Pass/ {printf \$6 \":\"}'`\\\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Block|Out6\/Block/ {printf \$6 \":\"}'|sed -e 's/.\$//'`\n"; /* PACKETS, set up the rrd file */ if (!file_exists("$rrddbpath$ifname$packets")) { @@ -304,6 +310,10 @@ function enable_rrd_graphing() { $rrdcreate .= "DS:outpass:COUNTER:$packetsvalid:0:$upstream "; $rrdcreate .= "DS:inblock:COUNTER:$packetsvalid:0:$downstream "; $rrdcreate .= "DS:outblock:COUNTER:$packetsvalid:0:$upstream "; + $rrdcreate .= "DS:inpass6:COUNTER:$packetsvalid:0:$downstream "; + $rrdcreate .= "DS:outpass6:COUNTER:$packetsvalid:0:$upstream "; + $rrdcreate .= "DS:inblock6:COUNTER:$packetsvalid:0:$downstream "; + $rrdcreate .= "DS:outblock6:COUNTER:$packetsvalid:0:$upstream "; $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; $rrdcreate .= "RRA:AVERAGE:0.5:5:1000 "; $rrdcreate .= "RRA:AVERAGE:0.5:60:1000 "; @@ -314,14 +324,16 @@ function enable_rrd_graphing() { /* enter UNKNOWN values in the RRD so it knows we rebooted. */ if($g['booting']) { - mwexec("$rrdtool update $rrddbpath$ifname$packets N:U:U:U:U"); + mwexec("$rrdtool update $rrddbpath$ifname$packets N:U:U:U:U:U:U:U:U"); } $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling packets for interface $ifname $realif \n"; $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$packets N:\\\n"; $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass/ {printf \$4 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$4 \":\"}'`\\\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Pass|Out6\/Pass/ {printf \$4 \":\"}'`\\\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Block|Out6\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; /* WIRELESS, set up the rrd file */ if($config['interfaces'][$ifname]['wireless']['mode'] == "bss") { @@ -695,4 +707,4 @@ function kill_traffic_collector() { mwexec("/bin/pkill -f updaterrd.sh", true); } -?> \ No newline at end of file +?> diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 0454475980..3da149ac4c 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1748,7 +1748,7 @@ function upgrade_054_to_055() { $xmldumpnew = "{$database}.new.xml"; if ($g['booting']) - echo "Migrate RRD database {$database} to new format \n"; + echo "Migrate RRD database {$database} to new format for IPv6 \n"; mwexec("$rrdtool tune {$rrddbpath}{$database} -r roundtrip:delay 2>&1"); dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}"); @@ -2298,4 +2298,86 @@ function upgrade_075_to_076() { $config['cron']['item'][] = $cron_item; } +function upgrade_076_to_077() { + global $config; + global $g; + + /* RRD files changed for quality, traffic and packets graphs */ + /* convert traffic RRD file */ + global $parsedcfg, $listtags; + $listtags = array("ds", "v", "rra", "row"); + + $rrddbpath = "/var/db/rrd/"; + $rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool"; + + $rrdinterval = 60; + $valid = $rrdinterval * 2; + + /* Asume GigE for now */ + $downstream = 125000000; + $upstream = 125000000; + + /* build a list of traffic and packets databases */ + $databases = array(); + exec("cd $rrddbpath;/usr/bin/find *-traffic.rrd *-packets.rrd", $databases); + rsort($databases); + foreach($databases as $database) { + $databasetmp = "{$database}.tmp"; + $xmldump = "{$database}.old.xml"; + $xmldumptmp = "{$database}.tmp.xml"; + $xmldumpnew = "{$database}.new.xml"; + + if ($g['booting']) + echo "Migrate RRD database {$database} to new format.\n"; + + /* dump contents to xml and move database out of the way */ + dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}"); + + /* create new rrd database file */ + $rrdcreate = "$rrdtool create {$g['tmp_path']}/{$databasetmp} --step $rrdinterval "; + $rrdcreate .= "DS:inpass:COUNTER:$valid:0:$downstream "; + $rrdcreate .= "DS:outpass:COUNTER:$valid:0:$upstream "; + $rrdcreate .= "DS:inblock:COUNTER:$valid:0:$downstream "; + $rrdcreate .= "DS:outblock:COUNTER:$valid:0:$upstream "; + $rrdcreate .= "DS:inpass6:COUNTER:$valid:0:$downstream "; + $rrdcreate .= "DS:outpass6:COUNTER:$valid:0:$upstream "; + $rrdcreate .= "DS:inblock6:COUNTER:$valid:0:$downstream "; + $rrdcreate .= "DS:outblock6:COUNTER:$valid:0:$upstream "; + $rrdcreate .= "RRA:AVERAGE:0.5:1:1000 "; + $rrdcreate .= "RRA:AVERAGE:0.5:5:1000 "; + $rrdcreate .= "RRA:AVERAGE:0.5:60:1000 "; + $rrdcreate .= "RRA:AVERAGE:0.5:720:3000 "; + + create_new_rrd("$rrdcreate"); + /* create temporary xml from new RRD */ + dump_rrd_to_xml("{$g['tmp_path']}/{$databasetmp}", "{$g['tmp_path']}/{$xmldumptmp}"); + + $rrdoldxml = file_get_contents("{$g['tmp_path']}/{$xmldump}"); + $rrdold = xml2array($rrdoldxml, 1, "tag"); + $rrdold = $rrdold['rrd']; + + $rrdnewxml = file_get_contents("{$g['tmp_path']}/{$xmldumptmp}"); + $rrdnew = xml2array($rrdnewxml, 1, "tag"); + $rrdnew = $rrdnew['rrd']; + + /* remove any MAX RRA's. Not needed for traffic. */ + $i = 0; + foreach ($rrdold['rra'] as $rra) { + if(trim($rra['cf']) == "MAX") { + unset($rrdold['rra'][$i]); + } + $i++; + } + + $rrdxmlarray = migrate_rrd_format($rrdold, $rrdnew); + $rrdxml = dump_xml_config_raw($rrdxmlarray, "rrd"); + file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml); + mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1"); + + } + enable_rrd_graphing(); + if ($g['booting']) + echo "Updating configuration..."; +} + ?> diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index 46102337b2..a7bd375fb8 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -192,10 +192,10 @@ if(file_exists($rrdcolors)) { include($rrdcolors); } else { log_error(sprintf(gettext("rrdcolors.inc.php for theme %s does not exist, using defaults!"),$g['theme'])); - $colortrafficup = array("666666", "CCCCCC"); - $colortrafficdown = array("990000", "CC0000"); - $colorpacketsup = array("666666", "CCCCCC"); - $colorpacketsdown = array("990000", "CC0000"); + $colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); + $colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); @@ -281,67 +281,131 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "DEF:$curif-in_bytes_block=$rrddbpath$curdatabase:inblock:AVERAGE "; $graphcmd .= "DEF:$curif-out_bytes_block=$rrddbpath$curdatabase:outblock:AVERAGE "; + $graphcmd .= "DEF:$curif-in6_bytes_pass=$rrddbpath$curdatabase:inpass6:AVERAGE "; + $graphcmd .= "DEF:$curif-out6_bytes_pass=$rrddbpath$curdatabase:outpass6:AVERAGE "; + $graphcmd .= "DEF:$curif-in6_bytes_block=$rrddbpath$curdatabase:inblock6:AVERAGE "; + $graphcmd .= "DEF:$curif-out6_bytes_block=$rrddbpath$curdatabase:outblock6:AVERAGE "; + $graphcmd .= "CDEF:\"$curif-in_bits_pass=$curif-in_bytes_pass,8,*\" "; $graphcmd .= "CDEF:\"$curif-out_bits_pass=$curif-out_bytes_pass,8,*\" "; $graphcmd .= "CDEF:\"$curif-in_bits_block=$curif-in_bytes_block,8,*\" "; $graphcmd .= "CDEF:\"$curif-out_bits_block=$curif-out_bytes_block,8,*\" "; + $graphcmd .= "CDEF:\"$curif-in6_bits_pass=$curif-in6_bytes_pass,8,*\" "; + $graphcmd .= "CDEF:\"$curif-out6_bits_pass=$curif-out6_bytes_pass,8,*\" "; + $graphcmd .= "CDEF:\"$curif-in6_bits_block=$curif-in6_bytes_block,8,*\" "; + $graphcmd .= "CDEF:\"$curif-out6_bits_block=$curif-out6_bytes_block,8,*\" "; + $graphcmd .= "CDEF:\"$curif-in_bytes=$curif-in_bytes_pass,$curif-in_bytes_block,+\" "; $graphcmd .= "CDEF:\"$curif-out_bytes=$curif-out_bytes_pass,$curif-out_bytes_block,+\" "; $graphcmd .= "CDEF:\"$curif-in_bits=$curif-in_bits_pass,$curif-in_bits_block,+\" "; $graphcmd .= "CDEF:\"$curif-out_bits=$curif-out_bits_pass,$curif-out_bits_block,+\" "; + $graphcmd .= "CDEF:\"$curif-in6_bytes=$curif-in6_bytes_pass,$curif-in6_bytes_block,+\" "; + $graphcmd .= "CDEF:\"$curif-out6_bytes=$curif-out6_bytes_pass,$curif-out6_bytes_block,+\" "; + $graphcmd .= "CDEF:\"$curif-in6_bits=$curif-in6_bits_pass,$curif-in6_bits_block,+\" "; + $graphcmd .= "CDEF:\"$curif-out6_bits=$curif-out6_bits_pass,$curif-out6_bits_block,+\" "; + $graphcmd .= "CDEF:\"$curif-bits_io=$curif-in_bits,$curif-out_bits,+\" "; $graphcmd .= "CDEF:\"$curif-out_bits_block_neg=$curif-out_bits_block,$multiplier,*\" "; $graphcmd .= "CDEF:\"$curif-out_bits_pass_neg=$curif-out_bits_pass,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-bits6_io=$curif-in6_bits,$curif-out6_bits,+\" "; + $graphcmd .= "CDEF:\"$curif-out6_bits_block_neg=$curif-out6_bits_block,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-out6_bits_pass_neg=$curif-out6_bits_pass,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in_pass=$curif-in_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-in_bytes_pass,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_out_pass=$curif-out_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-out_bytes_pass,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_in_block=$curif-in_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-in_bytes_block,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_out_block=$curif-out_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-out_bytes_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in6_pass=$curif-in6_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-in6_bytes_pass,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_out6_pass=$curif-out6_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-out6_bytes_pass,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in6_block=$curif-in6_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-in6_bytes_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_out6_block=$curif-out6_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-out6_bytes_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_pass=$curif-bytes_in_pass,$curif-bytes_out_pass,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_block=$curif-bytes_in_block,$curif-bytes_out_block,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_pass6=$curif-bytes_in6_pass,$curif-bytes_out6_pass,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_block6=$curif-bytes_in6_block,$curif-bytes_out6_block,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in_t_pass=$curif-in_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-in_bytes_pass,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_out_t_pass=$curif-out_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-out_bytes_pass,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_in_t_block=$curif-in_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-in_bytes_block,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-bytes_out_t_block=$curif-out_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-out_bytes_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in6_t_pass=$curif-in6_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-in6_bytes_pass,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_out6_t_pass=$curif-out6_bytes_pass,0,$speedlimit,LIMIT,UN,0,$curif-out6_bytes_pass,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_in6_t_block=$curif-in6_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-in6_bytes_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_out6_t_block=$curif-out6_bytes_block,0,$speedlimit,LIMIT,UN,0,$curif-out6_bytes_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-bytes_t_pass=$curif-bytes_in_t_pass,$curif-bytes_out_t_pass,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_t_block=$curif-bytes_in_t_block,$curif-bytes_out_t_block,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_t=$curif-bytes_in_t_pass,$curif-bytes_out_t_block,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_t_pass6=$curif-bytes_in6_t_pass,$curif-bytes_out6_t_pass,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_t_block6=$curif-bytes_in6_t_block,$curif-bytes_out6_t_block,+\" "; + $graphcmd .= "CDEF:\"$curif-bytes_t6=$curif-bytes_in6_t_pass,$curif-bytes_out6_t_block,+\" "; + $graphcmd .= "AREA:\"$curif-in_bits_block#{$colortrafficdown[1]}:$curif-in-block\" "; $graphcmd .= "AREA:\"$curif-in_bits_pass#{$colortrafficdown[0]}:$curif-in-pass:STACK\" "; + $graphcmd .= "AREA:\"$curif-in6_bits_block#{$colortrafficdown[3]}:$curif-in6-block\" "; + $graphcmd .= "AREA:\"$curif-in6_bits_pass#{$colortrafficdown[2]}:$curif-in6-pass:STACK\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_block_neg#{$colortrafficup[1]}:$curif-out-block\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_pass_neg#{$colortrafficup[0]}:$curif-out-pass:STACK\" "; + $graphcmd .= "{$AREA}:\"$curif-out6_bits_block_neg#{$colortrafficup[3]}:$curif-out6-block\" "; + $graphcmd .= "{$AREA}:\"$curif-out6_bits_pass_neg#{$colortrafficup[2]}:$curif-out6-pass:STACK\" "; $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t maximum average current period\\n\" "; - $graphcmd .= "COMMENT:\"in-pass\t\" "; + $graphcmd .= "COMMENT:\"IPv4 in-pass\t\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:LAST:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-bytes_in_t_pass:AVERAGE:%7.2lf %sB i\" "; $graphcmd .= "COMMENT:\"\\n\" "; - $graphcmd .= "COMMENT:\"out-pass\t\" "; + $graphcmd .= "COMMENT:\"IPv4 out-pass\t\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_pass:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_pass:LAST:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-bytes_out_t_pass:AVERAGE:%7.2lf %sB o\" "; $graphcmd .= "COMMENT:\"\\n\" "; - $graphcmd .= "COMMENT:\"in-block\t\" "; + $graphcmd .= "COMMENT:\"IPv4 in-block\t\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_block:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_block:AVERAGE:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_block:LAST:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-bytes_in_t_block:AVERAGE:%7.2lf %sB i\" "; $graphcmd .= "COMMENT:\"\\n\" "; - $graphcmd .= "COMMENT:\"out-block\t\" "; + $graphcmd .= "COMMENT:\"IPv4 out-block\t\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_block:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_block:AVERAGE:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-out_bits_block:LAST:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-bytes_out_t_block:AVERAGE:%7.2lf %sB o\" "; $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"IPv6 in-pass\t\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_pass:MAX:%7.2lf %sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_pass:LAST:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-bytes_in6_t_pass:AVERAGE:%7.2lf %sB i\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"IPv6 out-pass\t\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_pass:MAX:%7.2lf %sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_pass:LAST:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-bytes_out6_t_pass:AVERAGE:%7.2lf %sB o\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"IPv6 in-block\t\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_block:MAX:%7.2lf %sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_block:AVERAGE:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-in6_bits_block:LAST:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-bytes_in6_t_block:AVERAGE:%7.2lf %sB i\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"IPv6 out-block\t\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_block:MAX:%7.2lf %sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_block:AVERAGE:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-out6_bits_block:LAST:%7.2lf %Sb/s\" "; + $graphcmd .= "GPRINT:\"$curif-bytes_out6_t_block:AVERAGE:%7.2lf %sB o\" "; + $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; } elseif(strstr($curdatabase, "-throughput.rrd")) { diff --git a/usr/local/www/themes/pfsense_ng/rrdcolors.inc.php b/usr/local/www/themes/pfsense_ng/rrdcolors.inc.php index 8e7454552a..246b717d76 100644 --- a/usr/local/www/themes/pfsense_ng/rrdcolors.inc.php +++ b/usr/local/www/themes/pfsense_ng/rrdcolors.inc.php @@ -30,10 +30,10 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); + $colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); + $colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/the_wall/rrdcolors.inc.php b/usr/local/www/themes/the_wall/rrdcolors.inc.php index 8e7454552a..246b717d76 100644 --- a/usr/local/www/themes/the_wall/rrdcolors.inc.php +++ b/usr/local/www/themes/the_wall/rrdcolors.inc.php @@ -30,10 +30,10 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); + $colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); + $colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); + $colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); From d55ea9701f45ea85d840ca850f44382aa138014c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 09:12:22 +0100 Subject: [PATCH 076/225] Change wording --- etc/inc/upgrade_config.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 3da149ac4c..1ae34d13d4 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -2328,7 +2328,7 @@ function upgrade_076_to_077() { $xmldumpnew = "{$database}.new.xml"; if ($g['booting']) - echo "Migrate RRD database {$database} to new format.\n"; + echo "Migrate RRD database {$database} to new format for IPv6.\n"; /* dump contents to xml and move database out of the way */ dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}"); From 41dfef338f87734930eb2bea25450057e22d237a Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 09:19:07 +0100 Subject: [PATCH 077/225] Show IPv6 addresses in the banner message --- etc/rc.banner | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/etc/rc.banner b/etc/rc.banner index 6f81cb99a2..d80ed07b74 100755 --- a/etc/rc.banner +++ b/etc/rc.banner @@ -70,15 +70,23 @@ break; } $ipaddr = get_interface_ip($ifname); + $subnet = get_interface_subnet($ifname); + $ipaddr6 = get_interface_ipv6($ifname); + $subnet6 = get_interface_subnetv6($ifname); $realif = get_real_interface($ifname); $tobanner = "{$friendly} ({$ifname})"; - printf("\n %-25s -> %-10s -> %s %s", + $ipaddr ? $ipaddr : "NONE"; + + printf("\n %-18s -> %-8s -> %s/%s %s/%s %s", $tobanner, $realif, - $ipaddr ? $ipaddr : "NONE", + $ipaddr, + $subnet, + $ipaddr6, + $subnet6, $class ); } -?> \ No newline at end of file +?> From eef5ca2e53e2c56aeae86029a3efbda6731a895c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 09:41:09 +0100 Subject: [PATCH 078/225] Simplify the updaterrd.sh to reduce the amount of pfctl calls --- etc/inc/rrd.inc | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 7ff761f31e..6914b2ea02 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -298,10 +298,7 @@ function enable_rrd_graphing() { $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling traffic for interface $ifname $realif IPv4/IPv6 counters \n"; $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$traffic N:\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass/ {printf \$6 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$6 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Pass|Out6\/Pass/ {printf \$6 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Block|Out6\/Block/ {printf \$6 \":\"}'|sed -e 's/.\$//'`\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass|In6\/Pass|Out6\/Pass|In4\/Block|Out4\/Block|In6\/Block|Out6\/Block/ {printf \$6 \":\"}'|sed -e 's/.\$//'`\n"; /* PACKETS, set up the rrd file */ if (!file_exists("$rrddbpath$ifname$packets")) { @@ -330,10 +327,7 @@ function enable_rrd_graphing() { $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling packets for interface $ifname $realif \n"; $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$packets N:\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass/ {printf \$4 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Block|Out4\/Block/ {printf \$4 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Pass|Out6\/Pass/ {printf \$4 \":\"}'`\\\n"; - $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In6\/Block|Out6\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; + $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass|In6\/Pass|Out6\/Pass|In4\/Block|Out4\/Block|In6\/Block|Out6\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; /* WIRELESS, set up the rrd file */ if($config['interfaces'][$ifname]['wireless']['mode'] == "bss") { From f668cbcf712a5f19e9e9261ae9757914da285435 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 09:53:46 +0100 Subject: [PATCH 079/225] Make interface name 2 longer --- etc/rc.banner | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/rc.banner b/etc/rc.banner index d80ed07b74..7a3d50ffb3 100755 --- a/etc/rc.banner +++ b/etc/rc.banner @@ -78,7 +78,7 @@ $ipaddr ? $ipaddr : "NONE"; - printf("\n %-18s -> %-8s -> %s/%s %s/%s %s", + printf("\n %-18s -> %-10s -> %s/%s %s/%s %s", $tobanner, $realif, $ipaddr, From fea1b66d061a6b7b42f9d791ac03db156bc4b145 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 10:02:23 +0100 Subject: [PATCH 080/225] Further rc.banner display adjustment --- etc/rc.banner | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/etc/rc.banner b/etc/rc.banner index 7a3d50ffb3..1134565f83 100755 --- a/etc/rc.banner +++ b/etc/rc.banner @@ -76,15 +76,13 @@ $realif = get_real_interface($ifname); $tobanner = "{$friendly} ({$ifname})"; - $ipaddr ? $ipaddr : "NONE"; - - printf("\n %-18s -> %-10s -> %s/%s %s/%s %s", + printf("\n %-15s -> %-10s -> %s/%s %s/%s %s", $tobanner, $realif, - $ipaddr, - $subnet, - $ipaddr6, - $subnet6, + $ipaddr ? $ipaddr : "NONE", + $subnet ? $subnet : "NONE", + $ipaddr6 ? $ipaddr6 : "NONE", + $subnet6 ? $subnet6 : "NONE", $class ); } From 2845d097c35cf32aca6c227c4d32c7a6519e28f5 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 10:08:04 +0100 Subject: [PATCH 081/225] Further improvements on the ICMP6 allow rules --- etc/inc/filter.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 8628fee896..8b6b5d21fa 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2104,6 +2104,7 @@ pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {129,133,134,135,136} keep state +pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe02::/16 icmp6-type {129,133,134,135,136} keep state # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any From 9991ff2c7f1f06068d0184d63e907c2e118063ce Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 10:43:02 +0100 Subject: [PATCH 082/225] Fix the find_subnet v6 function to properly return the tunnel subnet --- etc/inc/interfaces.inc | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index fa1203b249..05427c7018 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -3424,7 +3424,10 @@ function find_interface_ipv6($interface, $flush = false) $parts = explode(" ", $line); if(! preg_match("/fe80::/", $parts[1])) { $ifinfo['ipaddrv6'] = $parts[1]; - $ifinfo['subnetbitsv6'] = $parts[3]; + if($parts[2] == "-->") + $ifinfo['subnetbitsv6'] = $parts[5]; + else + $ifinfo['subnetbitsv6'] = $parts[3]; } } } @@ -3464,6 +3467,19 @@ function find_interface_subnetv6($interface, $flush = false) if (!isset($interface_snv6_arr_cache[$interface]) or $flush) { $ifinfo = pfSense_get_interface_addresses($interface); + exec("/sbin/ifconfig {$interface} inet6", $output); + foreach($output as $line) { + if(preg_match("/inet6/", $line)) { + $parts = explode(" ", $line); + if(! preg_match("/fe80::/", $parts[1])) { + $ifinfo['ipaddrv6'] = $parts[1]; + if($parts[2] == "-->") + $ifinfo['subnetbitsv6'] = $parts[5]; + else + $ifinfo['subnetbitsv6'] = $parts[3]; + } + } + } $interface_ipv6_arr_cache[$interface] = $ifinfo['ipaddrv6']; $interface_snv6_arr_cache[$interface] = $ifinfo['subnetbitsv6']; } From d49816e58e8b46fc946c2637295ba18afbc4767a Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 12:28:41 +0100 Subject: [PATCH 083/225] kill rrdtool before killing shellscripts --- etc/inc/rrd.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index 6914b2ea02..d811a8561b 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -698,6 +698,8 @@ function enable_rrd_graphing() { } function kill_traffic_collector() { + mwexec("killall rrdtool", true); + sleep(1); mwexec("/bin/pkill -f updaterrd.sh", true); } From bf7c16747836677c90c68716372691fb5c88c02b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 15:16:42 +0100 Subject: [PATCH 084/225] Add the IPv6 counters to the packets graph, also make all traffic counters stack --- usr/local/www/status_rrd_graph_img.php | 59 +++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 2 deletions(-) diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index a7bd375fb8..6f924982a6 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -350,11 +350,11 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "AREA:\"$curif-in_bits_block#{$colortrafficdown[1]}:$curif-in-block\" "; $graphcmd .= "AREA:\"$curif-in_bits_pass#{$colortrafficdown[0]}:$curif-in-pass:STACK\" "; - $graphcmd .= "AREA:\"$curif-in6_bits_block#{$colortrafficdown[3]}:$curif-in6-block\" "; + $graphcmd .= "AREA:\"$curif-in6_bits_block#{$colortrafficdown[3]}:$curif-in6-block:STACK\" "; $graphcmd .= "AREA:\"$curif-in6_bits_pass#{$colortrafficdown[2]}:$curif-in6-pass:STACK\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_block_neg#{$colortrafficup[1]}:$curif-out-block\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_pass_neg#{$colortrafficup[0]}:$curif-out-pass:STACK\" "; - $graphcmd .= "{$AREA}:\"$curif-out6_bits_block_neg#{$colortrafficup[3]}:$curif-out6-block\" "; + $graphcmd .= "{$AREA}:\"$curif-out6_bits_block_neg#{$colortrafficup[3]}:$curif-out6-block:STACK\" "; $graphcmd .= "{$AREA}:\"$curif-out6_bits_pass_neg#{$colortrafficup[2]}:$curif-out6-pass:STACK\" "; $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t maximum average current period\\n\" "; @@ -549,33 +549,64 @@ elseif((strstr($curdatabase, "-packets.rrd")) && (file_exists("$rrddbpath$curdat $graphcmd .= "DEF:\"$curif-in_pps_block=$rrddbpath$curdatabase:inblock:AVERAGE\" "; $graphcmd .= "DEF:\"$curif-out_pps_block=$rrddbpath$curdatabase:outblock:AVERAGE\" "; + $graphcmd .= "DEF:\"$curif-in6_pps_pass=$rrddbpath$curdatabase:inpass6:AVERAGE\" "; + $graphcmd .= "DEF:\"$curif-out6_pps_pass=$rrddbpath$curdatabase:outpass6:AVERAGE\" "; + $graphcmd .= "DEF:\"$curif-in6_pps_block=$rrddbpath$curdatabase:inblock6:AVERAGE\" "; + $graphcmd .= "DEF:\"$curif-out6_pps_block=$rrddbpath$curdatabase:outblock6:AVERAGE\" "; + $graphcmd .= "CDEF:\"$curif-in_pps=$curif-in_pps_pass,$curif-in_pps_block,+\" "; $graphcmd .= "CDEF:\"$curif-out_pps=$curif-out_pps_pass,$curif-out_pps_block,+\" "; $graphcmd .= "CDEF:\"$curif-out_pps_pass_neg=$curif-out_pps_pass,$multiplier,*\" "; $graphcmd .= "CDEF:\"$curif-out_pps_block_neg=$curif-out_pps_block,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-in6_pps=$curif-in6_pps_pass,$curif-in6_pps_block,+\" "; + $graphcmd .= "CDEF:\"$curif-out6_pps=$curif-out6_pps_pass,$curif-out6_pps_block,+\" "; + $graphcmd .= "CDEF:\"$curif-out6_pps_pass_neg=$curif-out6_pps_pass,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-out6_pps_block_neg=$curif-out6_pps_block,$multiplier,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_in_pass=$curif-in_pps_pass,0,12500000,LIMIT,UN,0,$curif-in_pps_pass,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-pps_out_pass=$curif-out_pps_pass,0,12500000,LIMIT,UN,0,$curif-out_pps_pass,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-pps_in_block=$curif-in_pps_block,0,12500000,LIMIT,UN,0,$curif-in_pps_block,IF,$average,*\" "; $graphcmd .= "CDEF:\"$curif-pps_out_block=$curif-out_pps_block,0,12500000,LIMIT,UN,0,$curif-out_pps_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_in6_pass=$curif-in6_pps_pass,0,12500000,LIMIT,UN,0,$curif-in6_pps_pass,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_out6_pass=$curif-out6_pps_pass,0,12500000,LIMIT,UN,0,$curif-out6_pps_pass,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_in6_block=$curif-in6_pps_block,0,12500000,LIMIT,UN,0,$curif-in6_pps_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_out6_block=$curif-out6_pps_block,0,12500000,LIMIT,UN,0,$curif-out6_pps_block,IF,$average,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_io=$curif-in_pps,$curif-out_pps,+\" "; $graphcmd .= "CDEF:\"$curif-pps_pass=$curif-pps_in_pass,$curif-pps_out_pass,+\" "; $graphcmd .= "CDEF:\"$curif-pps_block=$curif-pps_in_block,$curif-pps_out_block,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_io6=$curif-in6_pps,$curif-out6_pps,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_pass6=$curif-pps_in6_pass,$curif-pps_out6_pass,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_block6=$curif-pps_in6_block,$curif-pps_out6_block,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_in_t_pass=$curif-in_pps_pass,0,12500000,LIMIT,UN,0,$curif-in_pps_pass,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-pps_out_t_pass=$curif-out_pps_pass,0,12500000,LIMIT,UN,0,$curif-out_pps_pass,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-pps_in_t_block=$curif-in_pps_block,0,12500000,LIMIT,UN,0,$curif-in_pps_block,IF,$seconds,*\" "; $graphcmd .= "CDEF:\"$curif-pps_out_t_block=$curif-out_pps_block,0,12500000,LIMIT,UN,0,$curif-out_pps_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_in6_t_pass=$curif-in6_pps_pass,0,12500000,LIMIT,UN,0,$curif-in6_pps_pass,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_out6_t_pass=$curif-out6_pps_pass,0,12500000,LIMIT,UN,0,$curif-out6_pps_pass,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_in6_t_block=$curif-in6_pps_block,0,12500000,LIMIT,UN,0,$curif-in6_pps_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_out6_t_block=$curif-out6_pps_block,0,12500000,LIMIT,UN,0,$curif-out6_pps_block,IF,$seconds,*\" "; + $graphcmd .= "CDEF:\"$curif-pps_t_pass=$curif-pps_in_t_pass,$curif-pps_out_t_pass,+\" "; $graphcmd .= "CDEF:\"$curif-pps_t_block=$curif-pps_in_t_block,$curif-pps_out_t_block,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_t_pass6=$curif-pps_in6_t_pass,$curif-pps_out6_t_pass,+\" "; + $graphcmd .= "CDEF:\"$curif-pps_t_block6=$curif-pps_in6_t_block,$curif-pps_out6_t_block,+\" "; + $graphcmd .= "AREA:\"$curif-in_pps_block#{$colorpacketsdown[1]}:$curif-in-block\" "; $graphcmd .= "AREA:\"$curif-in_pps_pass#{$colorpacketsdown[0]}:$curif-in-pass:STACK\" "; + $graphcmd .= "AREA:\"$curif-in6_pps_block#{$colorpacketsdown[3]}:$curif-in6-block:STACK\" "; + $graphcmd .= "AREA:\"$curif-in6_pps_pass#{$colorpacketsdown[2]}:$curif-in6-pass:STACK\" "; $graphcmd .= "$AREA:\"$curif-out_pps_block_neg#{$colorpacketsup[1]}:$curif-out-block\" "; $graphcmd .= "$AREA:\"$curif-out_pps_pass_neg#{$colorpacketsup[0]}:$curif-out-pass:STACK\" "; + $graphcmd .= "$AREA:\"$curif-out6_pps_block_neg#{$colorpacketsup[3]}:$curif-out6-block:STACK\" "; + $graphcmd .= "$AREA:\"$curif-out6_pps_pass_neg#{$colorpacketsup[2]}:$curif-out6-pass:STACK\" "; $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t maximum average current period\\n\" "; @@ -603,6 +634,30 @@ elseif((strstr($curdatabase, "-packets.rrd")) && (file_exists("$rrddbpath$curdat $graphcmd .= "GPRINT:\"$curif-out_pps_block:LAST:%7.2lf %S pps\" "; $graphcmd .= "GPRINT:\"$curif-pps_out_t_block:AVERAGE:%7.2lf %s pkts\" "; $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"in-pass6\t\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_pass:MAX:%7.2lf %s pps\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_pass:AVERAGE:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_pass:LAST:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-pps_in6_t_pass:AVERAGE:%7.2lf %s pkts\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"out-pass6\t\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_pass:MAX:%7.2lf %s pps\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_pass:AVERAGE:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_pass:LAST:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-pps_out6_t_pass:AVERAGE:%7.2lf %s pkts\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"in-block6\t\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_block:MAX:%7.2lf %s pps\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_block:AVERAGE:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-in6_pps_block:LAST:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-pps_in6_t_block:AVERAGE:%7.2lf %s pkts\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"out-pass6\t\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_block:MAX:%7.2lf %s pps\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_block:AVERAGE:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-out6_pps_block:LAST:%7.2lf %S pps\" "; + $graphcmd .= "GPRINT:\"$curif-pps_out6_t_block:AVERAGE:%7.2lf %s pkts\" "; + $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t\t\t\t\t\t\t\t\t\t\t\t`date +\"%b %d %H\:%M\:%S %Y\"`\" "; } elseif((strstr($curdatabase, "-wireless.rrd")) && (file_exists("$rrddbpath$curdatabase"))) { From cebd086a856086529728d2d8592ebd9687451ca3 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 15:23:27 +0100 Subject: [PATCH 085/225] Adjust layout --- usr/local/www/status_rrd_graph_img.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index 6f924982a6..3943b514dd 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -352,6 +352,8 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "AREA:\"$curif-in_bits_pass#{$colortrafficdown[0]}:$curif-in-pass:STACK\" "; $graphcmd .= "AREA:\"$curif-in6_bits_block#{$colortrafficdown[3]}:$curif-in6-block:STACK\" "; $graphcmd .= "AREA:\"$curif-in6_bits_pass#{$colortrafficdown[2]}:$curif-in6-pass:STACK\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "{$AREA}:\"$curif-out_bits_block_neg#{$colortrafficup[1]}:$curif-out-block\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_pass_neg#{$colortrafficup[0]}:$curif-out-pass:STACK\" "; $graphcmd .= "{$AREA}:\"$curif-out6_bits_block_neg#{$colortrafficup[3]}:$curif-out6-block:STACK\" "; @@ -382,6 +384,7 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "GPRINT:\"$curif-out_bits_block:LAST:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-bytes_out_t_block:AVERAGE:%7.2lf %sB o\" "; $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"IPv6 in-pass\t\" "; $graphcmd .= "GPRINT:\"$curif-in6_bits_pass:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in6_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; @@ -602,7 +605,7 @@ elseif((strstr($curdatabase, "-packets.rrd")) && (file_exists("$rrddbpath$curdat $graphcmd .= "AREA:\"$curif-in_pps_pass#{$colorpacketsdown[0]}:$curif-in-pass:STACK\" "; $graphcmd .= "AREA:\"$curif-in6_pps_block#{$colorpacketsdown[3]}:$curif-in6-block:STACK\" "; $graphcmd .= "AREA:\"$curif-in6_pps_pass#{$colorpacketsdown[2]}:$curif-in6-pass:STACK\" "; - + $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "$AREA:\"$curif-out_pps_block_neg#{$colorpacketsup[1]}:$curif-out-block\" "; $graphcmd .= "$AREA:\"$curif-out_pps_pass_neg#{$colorpacketsup[0]}:$curif-out-pass:STACK\" "; $graphcmd .= "$AREA:\"$curif-out6_pps_block_neg#{$colorpacketsup[3]}:$curif-out6-block:STACK\" "; @@ -633,6 +636,8 @@ elseif((strstr($curdatabase, "-packets.rrd")) && (file_exists("$rrddbpath$curdat $graphcmd .= "GPRINT:\"$curif-out_pps_block:AVERAGE:%7.2lf %S pps\" "; $graphcmd .= "GPRINT:\"$curif-out_pps_block:LAST:%7.2lf %S pps\" "; $graphcmd .= "GPRINT:\"$curif-pps_out_t_block:AVERAGE:%7.2lf %s pkts\" "; + $graphcmd .= "COMMENT:\"\\n\" "; + $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"in-pass6\t\" "; $graphcmd .= "GPRINT:\"$curif-in6_pps_pass:MAX:%7.2lf %s pps\" "; From 01ee74a8cef5f8ba29e0ab6d8faa0bba48c5e4de Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Feb 2011 16:08:59 +0100 Subject: [PATCH 086/225] Add a tab between ipv4 and ipv6 addresses --- etc/rc.banner | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/rc.banner b/etc/rc.banner index 1134565f83..2e016ceb87 100755 --- a/etc/rc.banner +++ b/etc/rc.banner @@ -76,7 +76,7 @@ $realif = get_real_interface($ifname); $tobanner = "{$friendly} ({$ifname})"; - printf("\n %-15s -> %-10s -> %s/%s %s/%s %s", + printf("\n %-15s -> %-10s -> %s/%s\t%s/%s %s", $tobanner, $realif, $ipaddr ? $ipaddr : "NONE", From 9d7dd0be5ba6525dc787ada121fcb55df4a90ef6 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 2 Feb 2011 13:57:07 +0100 Subject: [PATCH 087/225] Add a newline to this command --- etc/inc/rrd.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index cdb90c1379..e698a19ca7 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -571,7 +571,7 @@ function enable_rrd_graphing() { $rrdupdatesh .= "printf \"$rrdtool update $rrddbpath$ifname$proc \" } \\\n"; $rrdupdatesh .= "{ if ( \$2 == \"processes:\" ) { processes = \$1; } \\\n"; $rrdupdatesh .= "else if ( \$1 == \"CPU:\" ) { user = \$2; nice = \$4; sys = \$6; interrupt = \$8; } \\\n"; - $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes }'`\n\n"; + $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes \"\\\n\"}'`\n\n"; /* End CPU statistics */ From 31a7477d2819afae9ea82117b69a78d872d60f85 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 2 Feb 2011 15:24:00 +0100 Subject: [PATCH 088/225] Fix the TERM setting in the updaterrd script. Only get the last part of the top outpuT --- etc/inc/rrd.inc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index e698a19ca7..a419c29883 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -252,6 +252,7 @@ function enable_rrd_graphing() { /* db update script */ $rrdupdatesh = "#!/bin/sh\n"; $rrdupdatesh .= "\n"; + $rrdupdatesh .= "export TERM=dumb\n"; $rrdupdatesh .= "counter=1\n"; $rrdupdatesh .= "while [ \"\$counter\" -ne 0 ]\n"; $rrdupdatesh .= "do\n"; @@ -567,11 +568,11 @@ function enable_rrd_graphing() { } /* the CPU stats gathering function. */ - $rrdupdatesh .= "`$top -d 2 -s 1 0 | $awk '{gsub(/%/, \"\")} BEGIN { \\\n"; + $rrdupdatesh .= "`$top -d 2 -s 1 0 | tail -n7 | $awk '{gsub(/%/, \"\")} BEGIN { \\\n"; $rrdupdatesh .= "printf \"$rrdtool update $rrddbpath$ifname$proc \" } \\\n"; $rrdupdatesh .= "{ if ( \$2 == \"processes:\" ) { processes = \$1; } \\\n"; $rrdupdatesh .= "else if ( \$1 == \"CPU:\" ) { user = \$2; nice = \$4; sys = \$6; interrupt = \$8; } \\\n"; - $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes \"\\\n\"}'`\n\n"; + $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes }'`\n\n"; /* End CPU statistics */ From 396243e9b5dd4ea6a0eb0d59adaaf96782e1d5e2 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 2 Feb 2011 16:26:45 +0100 Subject: [PATCH 089/225] Alter the traffic collector kill function, alter the output of top from a pipe to a file. We can now have /tmp/top_output.txt for status --- etc/inc/rrd.inc | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index a419c29883..56d00fc98a 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -252,7 +252,7 @@ function enable_rrd_graphing() { /* db update script */ $rrdupdatesh = "#!/bin/sh\n"; $rrdupdatesh .= "\n"; - $rrdupdatesh .= "export TERM=dumb\n"; + $rrdupdatesh .= "export TERM=serial\n"; $rrdupdatesh .= "counter=1\n"; $rrdupdatesh .= "while [ \"\$counter\" -ne 0 ]\n"; $rrdupdatesh .= "do\n"; @@ -568,11 +568,12 @@ function enable_rrd_graphing() { } /* the CPU stats gathering function. */ - $rrdupdatesh .= "`$top -d 2 -s 1 0 | tail -n7 | $awk '{gsub(/%/, \"\")} BEGIN { \\\n"; - $rrdupdatesh .= "printf \"$rrdtool update $rrddbpath$ifname$proc \" } \\\n"; + $rrdupdatesh .= "$top -d 2 -s 1 0 | tail -n7 > /tmp/top_output.txt\n"; + $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$proc N:\\\n"; + $rrdupdatesh .= "`$awk < /tmp/top_output.txt '{gsub(/%/, \"\")} \\\n"; $rrdupdatesh .= "{ if ( \$2 == \"processes:\" ) { processes = \$1; } \\\n"; $rrdupdatesh .= "else if ( \$1 == \"CPU:\" ) { user = \$2; nice = \$4; sys = \$6; interrupt = \$8; } \\\n"; - $rrdupdatesh .= "} END { printf \"N:\"user\":\"nice\":\"sys\":\"interrupt\":\"processes }'`\n\n"; + $rrdupdatesh .= "} END { printf user\":\"nice\":\"sys\":\"interrupt\":\"processes }'`\n\n"; /* End CPU statistics */ @@ -776,8 +777,8 @@ function enable_rrd_graphing() { } function kill_traffic_collector() { + mwexec("killall top", true); mwexec("killall rrdtool", true); - sleep(1); mwexec("/bin/pkill -f updaterrd.sh", true); } From a23a99cb13af898ec662872dcd2ba544ea4ccbad Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Feb 2011 22:38:54 +0100 Subject: [PATCH 090/225] Lie to the system and report a subnetmask of 127 instead of 128. This should fix the subnetmask check --- etc/inc/interfaces.inc | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index 05427c7018..c12f0f6599 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -3424,10 +3424,12 @@ function find_interface_ipv6($interface, $flush = false) $parts = explode(" ", $line); if(! preg_match("/fe80::/", $parts[1])) { $ifinfo['ipaddrv6'] = $parts[1]; - if($parts[2] == "-->") + if($parts[2] == "-->") { + $parts[5] = "127"; $ifinfo['subnetbitsv6'] = $parts[5]; - else + } else { $ifinfo['subnetbitsv6'] = $parts[3]; + } } } } @@ -3473,10 +3475,12 @@ function find_interface_subnetv6($interface, $flush = false) $parts = explode(" ", $line); if(! preg_match("/fe80::/", $parts[1])) { $ifinfo['ipaddrv6'] = $parts[1]; - if($parts[2] == "-->") + if($parts[2] == "-->") { + $parts[5] = "127"; $ifinfo['subnetbitsv6'] = $parts[5]; - else + } else { $ifinfo['subnetbitsv6'] = $parts[3]; + } } } } From cf6bc278670a76710a364ccc42ab77a2b061ba14 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Feb 2011 23:07:52 +0100 Subject: [PATCH 091/225] Fix the subnet check for gif tunnels by dropping the bits to 126. Always compress the subnet address for easier reading --- etc/inc/interfaces.inc | 4 ++-- etc/inc/util.inc | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index c12f0f6599..bc8fdb84b3 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -3425,7 +3425,7 @@ function find_interface_ipv6($interface, $flush = false) if(! preg_match("/fe80::/", $parts[1])) { $ifinfo['ipaddrv6'] = $parts[1]; if($parts[2] == "-->") { - $parts[5] = "127"; + $parts[5] = "126"; $ifinfo['subnetbitsv6'] = $parts[5]; } else { $ifinfo['subnetbitsv6'] = $parts[3]; @@ -3476,7 +3476,7 @@ function find_interface_subnetv6($interface, $flush = false) if(! preg_match("/fe80::/", $parts[1])) { $ifinfo['ipaddrv6'] = $parts[1]; if($parts[2] == "-->") { - $parts[5] = "127"; + $parts[5] = "126"; $ifinfo['subnetbitsv6'] = $parts[5]; } else { $ifinfo['subnetbitsv6'] = $parts[3]; diff --git a/etc/inc/util.inc b/etc/inc/util.inc index f3cb60b2a9..4d939dd0a7 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -226,7 +226,10 @@ function gen_subnet($ipaddr, $bits) { function gen_subnetv6($ipaddr, $bits) { if (!is_ipaddrv6($ipaddr) || !is_numeric($bits)) return ""; - return Net_IPv6::getNetmask($ipaddr, $bits); + + $address = Net_IPv6::getNetmask($ipaddr, $bits); + $address = Net_IPv6::Compress($address); + return $address; } /* return the highest (broadcast) address in the subnet given a host address and a subnet bit count */ From 54ac51b569af3db2a0d4fe29563090265355725e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Feb 2011 23:08:58 +0100 Subject: [PATCH 092/225] Make the subnet check failure better readable --- usr/local/www/system_gateways_edit.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 8db8764ec4..66ee192275 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -120,14 +120,16 @@ if ($_POST) { } if (is_ipaddrv4($parent_ip)) { $parent_sn = get_interface_subnet($_POST['interface']); - if(!ip_in_subnet($_POST['gateway'], gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn) && !ip_in_interface_alias_subnet($_POST['interface'], $_POST['gateway'])) { - $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet."), $_POST['gateway']); + $subnet = gen_subnet($parent_ip, $parent_sn) . "/" . $parent_sn; + if(!ip_in_subnet($_POST['gateway'], $subnet) && !ip_in_interface_alias_subnet($_POST['interface'], $_POST['gateway'])) { + $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet '{$subnet}'."), $_POST['gateway']); } } if (is_ipaddrv6($parent_ip)) { $parent_sn = get_interface_subnetv6($_POST['interface']); - if(!ip_in_subnet($_POST['gateway'], gen_subnetv6($parent_ip, $parent_sn) . "/" . $parent_sn)) { - $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet."), $_POST['gateway']); + $subnet = gen_subnetv6($parent_ip, $parent_sn) . "/" . $parent_sn; + if(!ip_in_subnet($_POST['gateway'], $subnet)) { + $input_errors[] = sprintf(gettext("The gateway address %s does not lie within the chosen interface's subnet '{$subnet}'."), $_POST['gateway']); } } } From 3fc4a490effa9575dfc53d42739ee8fa1a4acd64 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 4 Feb 2011 15:18:26 +0100 Subject: [PATCH 093/225] Remove this compress line, it breaks the dhcpv6 config --- etc/inc/util.inc | 1 - 1 file changed, 1 deletion(-) diff --git a/etc/inc/util.inc b/etc/inc/util.inc index 4d939dd0a7..370f89192d 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -228,7 +228,6 @@ function gen_subnetv6($ipaddr, $bits) { return ""; $address = Net_IPv6::getNetmask($ipaddr, $bits); - $address = Net_IPv6::Compress($address); return $address; } From 56f024e8f9779273e3143730ad03df2f1feaec98 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Sun, 6 Feb 2011 16:32:06 -0500 Subject: [PATCH 094/225] Add
between ipv6 and ipv4 blocks --- usr/local/www/interfaces.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php index 76f618bb26..86d795bc9e 100755 --- a/usr/local/www/interfaces.php +++ b/usr/local/www/interfaces.php @@ -1338,6 +1338,9 @@ $types = array("none" => gettext("None"), "staticv4" => gettext("Static IPv4"), + + + From 7f00aface2d9208199e965c0372f9a0272bee778 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 7 Feb 2011 08:23:06 +0100 Subject: [PATCH 095/225] Remove the icmp6 ping requests from the mandatory allow rulE --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index fc3f73471f..b694677273 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2100,7 +2100,7 @@ block out $log inet6 all label "Default deny rule IPv6" # 134 routeradv Router advertisement # 135 neighbrsol Neighbor solicitation # 136 neighbradv Neighbor advertisement -pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,128,129,135,136} keep state +pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} keep state # Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} keep state From 2f14d0213c1dd0c9759adba87ba4ce503a0990df Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 7 Feb 2011 08:34:33 +0100 Subject: [PATCH 096/225] Make it possible to set the default gateway bit for 1 ipv4 gateway and 1 ipv6 gateway --- usr/local/www/system_gateways_edit.php | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 66ee192275..6eef520da5 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -238,10 +238,18 @@ if ($_POST) { if ($_POST['defaultgw'] == "yes" || $_POST['defaultgw'] == "on") { $i = 0; + /* remove the default gateway bits for all gateways with the same address family */ foreach($a_gateway_item as $gw) { - unset($config['gateways']['gateway_item'][$i]['defaultgw']); - if ($gw['interface'] != $_POST['interface'] && $gw['defaultgw']) - $reloadif = $gw['interface']; + if(is_ipaddrv4($gateway['gateway']) && is_ipaddrv4($gw['gateway'])) { + unset($config['gateways']['gateway_item'][$i]['defaultgw']); + if ($gw['interface'] != $_POST['interface'] && $gw['defaultgw']) + $reloadif = $gw['interface']; + } + if(is_ipaddrv6($gateway['gateway']) && is_ipaddrv6($gw['gateway'])) { + unset($config['gateways']['gateway_item'][$i]['defaultgw']); + if ($gw['interface'] != $_POST['interface'] && $gw['defaultgw']) + $reloadif = $gw['interface']; + } $i++; } $gateway['defaultgw'] = true; From aa0103f5d3c98fddb32866d3665ee8ecf8e9f108 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 8 Feb 2011 16:18:40 +0100 Subject: [PATCH 097/225] Disable the wins server input boxes, these don't work on v6 --- etc/inc/services.inc | 6 ------ usr/local/www/services_dhcpv6.php | 17 ----------------- 2 files changed, 23 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 0fa3c98ee3..d40accb3b2 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -632,12 +632,6 @@ EOD; if ($dhcpv6ifconf['maxleasetime']) $dhcpdv6conf .= " max-lease-time {$dhcpv6ifconf['maxleasetime']};\n"; - // netbios-name* - if (is_array($dhcpv6ifconf['winsserver']) && $dhcpv6ifconf['winsserver'][0]) { - $dhcpdv6conf .= " option netbios-name-servers " . join(",", $dhcpv6ifconf['winsserver']) . ";\n"; - $dhcpdv6conf .= " option netbios-node-type 8;\n"; - } - // ntp-servers if (is_array($dhcpv6ifconf['ntpserver']) && $dhcpv6ifconf['ntpserver'][0]) $dhcpdv6conf .= " option ntp-servers " . join(",", $dhcpv6ifconf['ntpserver']) . ";\n"; diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 08776d3eba..1e9a918ccf 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -143,8 +143,6 @@ if (is_array($config['dhcpdv6'][$if])){ $pconfig['gateway'] = $config['dhcpdv6'][$if]['gateway']; $pconfig['domain'] = $config['dhcpdv6'][$if]['domain']; $pconfig['domainsearchlist'] = $config['dhcpdv6'][$if]['domainsearchlist']; - list($pconfig['wins1'],$pconfig['wins2']) = $config['dhcpdv6'][$if]['winsserver']; - list($pconfig['dns1'],$pconfig['dns2']) = $config['dhcpdv6'][$if]['dnsserver']; $pconfig['enable'] = isset($config['dhcpdv6'][$if]['enable']); $pconfig['denyunknown'] = isset($config['dhcpdv6'][$if]['denyunknown']); $pconfig['staticarp'] = isset($config['dhcpdv6'][$if]['staticarp']); @@ -223,8 +221,6 @@ if ($_POST) { $input_errors[] = gettext("A valid range must be specified."); if (($_POST['gateway'] && !is_ipaddrv6($_POST['gateway']))) $input_errors[] = gettext("A valid IPv6 address must be specified for the gateway."); - if (($_POST['wins1'] && !is_ipaddrv6($_POST['wins1'])) || ($_POST['wins2'] && !is_ipaddrv6($_POST['wins2']))) - $input_errors[] = gettext("A valid IPv6 address must be specified for the primary/secondary WINS servers."); if (($_POST['dns1'] && !is_ipaddrv6($_POST['dns1'])) || ($_POST['dns2'] && !is_ipaddrv6($_POST['dns2']))) $input_errors[] = gettext("A valid IPv6 address must be specified for the primary/secondary DNS servers."); @@ -320,10 +316,6 @@ if ($_POST) { $config['dhcpdv6'][$if]['failover_peerip'] = $_POST['failover_peerip']; unset($config['dhcpdv6'][$if]['winsserver']); - if ($_POST['wins1']) - $config['dhcpdv6'][$if]['winsserver'][] = $_POST['wins1']; - if ($_POST['wins2']) - $config['dhcpdv6'][$if]['winsserver'][] = $_POST['wins2']; unset($config['dhcpdv6'][$if]['dnsserver']); if ($_POST['dns1']) @@ -426,8 +418,6 @@ include("head.inc"); endis = !(document.iform.enable.checked || enable_over); document.iform.range_from.disabled = endis; document.iform.range_to.disabled = endis; - document.iform.wins1.disabled = endis; - document.iform.wins2.disabled = endis; document.iform.dns1.disabled = endis; document.iform.dns2.disabled = endis; document.iform.deftime.disabled = endis; @@ -607,13 +597,6 @@ include("head.inc"); - - - - Date: Wed, 16 Feb 2011 16:40:43 -0500 Subject: [PATCH 104/225] Minor english fixes from Bill --- usr/local/www/interfaces_gif_edit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/interfaces_gif_edit.php b/usr/local/www/interfaces_gif_edit.php index 73cd456d17..958b5c05fa 100644 --- a/usr/local/www/interfaces_gif_edit.php +++ b/usr/local/www/interfaces_gif_edit.php @@ -184,7 +184,7 @@ include("head.inc"); ?>
- + From 2936a57e2e9c378edafe2ab936b8b3ad90cf83fe Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 1 Mar 2011 14:11:23 +0100 Subject: [PATCH 105/225] add subnet mask clarification for IPv6 and correct default count to 128 bits --- usr/local/www/firewall_aliases_edit.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php index 5bc44bcab7..825bbae312 100755 --- a/usr/local/www/firewall_aliases_edit.php +++ b/usr/local/www/firewall_aliases_edit.php @@ -396,7 +396,7 @@ function typesel_change() { for(i=0; i Date: Thu, 3 Mar 2011 21:12:57 +0100 Subject: [PATCH 106/225] Add the IPv6 Neighbour list status page --- usr/local/www/diag_ndp.php | 163 +++++++++++++++++++++++++++++++++++++ 1 file changed, 163 insertions(+) create mode 100755 usr/local/www/diag_ndp.php diff --git a/usr/local/www/diag_ndp.php b/usr/local/www/diag_ndp.php new file mode 100755 index 0000000000..c99da4e005 --- /dev/null +++ b/usr/local/www/diag_ndp.php @@ -0,0 +1,163 @@ + + Copyright (C) 2011 Seth Mos + + + originally part of m0n0wall (http://m0n0.ch/wall) + Copyright (C) 2005 Paul Taylor (paultaylor@winndixie.com) and Manuel Kasper . + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* + pfSense_BUILDER_BINARIES: /bin/cat /usr/sbin/arp + pfSense_MODULE: arp +*/ + +##|+PRIV +##|*IDENT=page-diagnostics-ndptable +##|*NAME=Diagnostics: NDP Table page +##|*DESCR=Allow access to the 'Diagnostics: NDP Table' page. +##|*MATCH=diag_ndp.php* +##|-PRIV + +@ini_set('zlib.output_compression', 0); +@ini_set('implicit_flush', 1); + +require("guiconfig.inc"); + +exec("/usr/sbin/ndp -na", $rawdata); + +$i = 0; + +/* if list */ +$ifdescrs = get_configured_interface_with_descr(); + +foreach ($ifdescrs as $key =>$interface) { + $hwif[$config['interfaces'][$key]['if']] = $interface; +} + +/* Array ( [0] => Neighbor [1] => Linklayer [2] => Address +[3] => Netif [4] => Expire [5] => S +[6] => Flags ) */ +$data = array(); +array_shift($rawdata); +foreach ($rawdata as $line) { + $elements = preg_split('/[ ]+/', $line); + + $ndpent = array(); + $ndpent['ipv6'] = trim($elements[0]); + $ndpent['mac'] = trim($elements[1]); + $ndpent['interface'] = trim($elements[2]); + $data[] = $ndpent; +} + +/* FIXME: Not ipv6 compatible dns resolving. PHP needs fixing */ +function _getHostName($mac,$ip) +{ + if(is_ipaddr($ip)) { + if(gethostbyaddr($ip) <> "" and gethostbyaddr($ip) <> $ip) + return gethostbyaddr($ip); + else + return ""; + } +} + +// Resolve hostnames and replace Z_ with "". The intention +// is to sort the list by hostnames, alpha and then the non +// resolvable addresses will appear last in the list. +foreach ($data as &$entry) { + $dns = trim(_getHostName($entry['mac'], $entry['ipv6'])); + if(trim($dns)) + $entry['dnsresolve'] = "$dns"; + else + $entry['dnsresolve'] = "Z_ "; +} + +// Sort the data alpha first +$data = msort($data, "dnsresolve"); + +$pgtitle = array(gettext("Diagnostics"),gettext("NDP Table")); +include("head.inc"); + +?> + + + + + +
+ +

  +

+ + +
 
-
- -

From 8b0041e092274a63002f716515faaa082dfc0693 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 9 Feb 2011 16:41:41 +0100 Subject: [PATCH 098/225] Fix typo in the subnetmask for the unblockable icmp types. This makes the all-routers work again --- etc/inc/filter.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index b694677273..438b1c8f0f 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2107,7 +2107,7 @@ pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128 pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {129,133,134,135,136} keep state -pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe02::/16 icmp6-type {129,133,134,135,136} keep state +pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} keep state # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any From 6715c2a295ecdee663e5d185284c72dff815518e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 10 Feb 2011 11:18:28 +0100 Subject: [PATCH 099/225] Fix the IP address check to allow for interfaces that just have a IPv6 address but no IPv4 --- usr/local/www/firewall_virtual_ip_edit.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index 3dbb31c8a0..e5581ca312 100755 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -112,8 +112,8 @@ if ($_POST) { $natiflist = get_configured_interface_with_descr(); foreach ($natiflist as $natif => $natdescr) { - if ($_POST['interface'] == $natif && empty($config['interfaces'][$natif]['ipaddr'])) - $input_errors[] = gettext("The interface chosen for the VIP has no ip configured so it cannot be used as a parent for the VIP."); + if ($_POST['interface'] == $natif && (empty($config['interfaces'][$natif]['ipaddr']) && empty($config['interfaces'][$natif]['ipaddrv6']))) + $input_errors[] = gettext("The interface chosen for the VIP has no IPv4 or IPv6 address configured so it cannot be used as a parent for the VIP."); if ($_POST['subnet'] == get_interface_ip($natif)) $input_errors[] = sprintf(gettext("The %s IP address may not be used in a virtual entry."),$natdescr); } From 9103d9ee6c46a3fd36f2dfb5cd624a8e6a5366a8 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 10 Feb 2011 16:05:27 +0100 Subject: [PATCH 100/225] Fix static routes, typo in the variable name --- usr/local/www/system_routes_edit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/system_routes_edit.php b/usr/local/www/system_routes_edit.php index 08deb77544..5847011996 100755 --- a/usr/local/www/system_routes_edit.php +++ b/usr/local/www/system_routes_edit.php @@ -107,7 +107,7 @@ if ($_POST) { if(is_ipaddrv6($_POST['network'])) { $osn = Net_IPv6::compress(gen_subnetv6($_POST['network'], $_POST['network_subnet'])) . "/" . $_POST['network_subnet']; } - if(is_ipaddrv4($POST['network'])) { + if(is_ipaddrv4($_POST['network'])) { $osn = gen_subnet($_POST['network'], $_POST['network_subnet']) . "/" . $_POST['network_subnet']; } foreach ($a_routes as $route) { From 07dfd12159413d2bcb91c5e17952284e9b128ab7 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 11 Feb 2011 09:09:06 +0100 Subject: [PATCH 101/225] Add a IPv6 enable option in the mpd5 config --- etc/inc/interfaces.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index bc8fdb84b3..a0741f9592 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -1303,6 +1303,7 @@ startup: default: {$ppp['type']}client: create bundle static {$interface} + set bundle enable ipv6cp set iface name {$pppif} EOD; From d610946897da3d693ae4b372ce2edf0545d29daf Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 11 Feb 2011 09:28:11 +0100 Subject: [PATCH 102/225] Delay resolving dynamic DNS tunnels during boot --- etc/inc/vpn.inc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index caf8006544..ea4940ea67 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -1677,8 +1677,13 @@ function reload_tunnel_spd_policy($phase1, $phase2, $old_phase1, $old_phase2) { /* see if this tunnel has a hostname for the remote-gateway, and if so, * try to resolve it now and add it to the list for filterdns */ if (!is_ipaddr($phase1['remote-gateway'])) { - $rgip = resolve_retry($phase1['remote-gateway']); - add_hostname_to_watch($phase1['remote-gateway']); + if(! $g['booting']) { + $rgip = resolve_retry($phase1['remote-gateway']); + add_hostname_to_watch($phase1['remote-gateway']); + return false; + } else { + add_hostname_to_watch($phase1['remote-gateway']); + } if (!$rgip) { log_error("Could not determine VPN endpoint for '{$phase1['descr']}'"); return false; From bd40781aaa7aa947e924f21e2845d87be5993bbd Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Feb 2011 22:27:46 +0100 Subject: [PATCH 103/225] add a ipprotocol variable to the easy add rules --- etc/inc/easyrule.inc | 14 ++++++++------ usr/local/www/diag_logs_filter.php | 6 ++++-- usr/local/www/easyrule.php | 4 ++-- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/etc/inc/easyrule.inc b/etc/inc/easyrule.inc index b5b162074f..45d3f748c0 100644 --- a/etc/inc/easyrule.inc +++ b/etc/inc/easyrule.inc @@ -46,7 +46,7 @@ function easyrule_find_rule_interface($int) { if ($config['pptpd']['mode'] == "server") $iflist['pptp'] = "PPTP VPN"; - if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) + if ($config['pppoe']['mode'] == "server") $iflist['pppoe'] = "PPPoE VPN"; if ($config['l2tp']['mode'] == "server") @@ -229,7 +229,7 @@ function easyrule_block_host_add($host, $int = 'wan') { } } -function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport) { +function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport, $ipproto) { global $config; /* No rules, start a new array */ @@ -244,6 +244,7 @@ function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport) { $filterent = array(); $filterent['type'] = 'pass'; $filterent['interface'] = $int; + $filterent['ipprotocol'] = $ipproto; $filterent['descr'] = "Easy Rule: Passed from Firewall Log View"; if ($proto != "any") @@ -271,7 +272,8 @@ function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport) { } } -function easyrule_parse_block($int, $src) { +function easyrule_parse_block($int, $src, $ipproto) { + $filterent['ipprotocol'] = $ipproto; if (!empty($src) && !empty($int)) { if (!is_ipaddr($src)) { return "Tried to block invalid IP: " . htmlspecialchars($src); @@ -290,7 +292,7 @@ function easyrule_parse_block($int, $src) { } return "Unknown block error."; } -function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0) { +function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0, $ipproto = inet) { /* Check for valid int, srchost, dsthost, dstport, and proto */ global $protocols_with_ports; @@ -319,7 +321,7 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0) { $dstport = 0; } /* Should have valid input... */ - if (easyrule_pass_rule_add($int, $proto, $src, $dst, $dstport)) { + if (easyrule_pass_rule_add($int, $proto, $src, $dst, $dstport, $ipproto)) { return "Successfully added pass rule!"; } else { return "Failed to add pass rule."; @@ -330,4 +332,4 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0) { return "Unknown pass error."; } -?> \ No newline at end of file +?> diff --git a/usr/local/www/diag_logs_filter.php b/usr/local/www/diag_logs_filter.php index 5fb94cff68..ec56ce0d93 100755 --- a/usr/local/www/diag_logs_filter.php +++ b/usr/local/www/diag_logs_filter.php @@ -150,18 +150,20 @@ include("head.inc"); 		"> - " title="" onclick="return confirm('')"> + " title="" onclick="return confirm('')"> "> - " title="" onclick="return confirm('')"> + " title="" onclick="return confirm('')">
+ + + +
+ + + + + + + + + + + + + + + + +
+ + + +
+
+ + + + From aed4775862015400017397b95b187aebbb7d5c03 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Mar 2011 21:16:13 +0100 Subject: [PATCH 107/225] Fix the link to point to the v6 edit page instead --- usr/local/www/services_dhcpv6.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 1e9a918ccf..4d6251a9b4 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -835,7 +835,7 @@ include("head.inc"); - +
@@ -844,22 +844,22 @@ include("head.inc"); "" or $mapent['ipaddr'] <> ""): ?> - + - +   - +   - +   - +
')">
@@ -874,7 +874,7 @@ include("head.inc"); - +
From 11085d2abc88851f5dca2ffd3f1e8053d822d593 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Mar 2011 21:18:05 +0100 Subject: [PATCH 108/225] Add the neighbour table to the menu --- usr/local/www/fbegin.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/usr/local/www/fbegin.inc b/usr/local/www/fbegin.inc index ed07813da9..e88df50657 100755 --- a/usr/local/www/fbegin.inc +++ b/usr/local/www/fbegin.inc @@ -188,6 +188,7 @@ $diagnostics_menu[] = array("Edit File", "/edit.php"); $diagnostics_menu[] = array("Factory Defaults", "/diag_defaults.php"); $diagnostics_menu[] = array("Halt System", "/halt.php" ); $diagnostics_menu[] = array("Limiter Info", "/diag_limiter_info.php" ); +$diagnostics_menu[] = array("NDP Table", "/diag_ndp.php" ); $diagnostics_menu[] = array("Tables", "/diag_tables.php"); $diagnostics_menu[] = array("Ping", "/diag_ping.php"); From 4e8e7662c0309f6c83ca9b2ee3eb2e9f1aa95e52 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 3 Mar 2011 21:30:06 +0100 Subject: [PATCH 109/225] Blind coded a edit page for IPv6. the subnet check needs to be written entirely. Checking if the IP address falls within the v6 subnet isn't so hard, what is harder is making sure that the ip does not fall within the dynamic subnet. For that we need proper subnet math calculus. Which we don't have yet. --- usr/local/www/services_dhcpv6.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 4d6251a9b4..27c4443786 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -848,7 +848,7 @@ include("head.inc"); -   +     From 4f33246696457207f14e18dbfa4c543e9e71ace4 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 4 Mar 2011 16:51:39 +0100 Subject: [PATCH 110/225] Fix broken gateway logic that mixed up v4 and v6 --- etc/inc/system.inc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 4403c6f1db..4ed6813f6d 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -353,8 +353,8 @@ function system_routing_configure($interface = "") { $gatewayipv6 = $gateway['gateway']; $interfacegwv6 = $gateway['interface']; if (!empty($interfacegwv6)) { - $defaultif = get_real_interface($gateway['interface']); - if ($defaultif) + $defaultifv6 = get_real_interface($gateway['interface']); + if ($defaultifv6) @file_put_contents("{$g['tmp_path']}/{$defaultif}_defaultgwv6", $gatewayipv6); } $foundgwv6 = true; @@ -369,9 +369,9 @@ function system_routing_configure($interface = "") { @touch("{$g['tmp_path']}/{$defaultif}_defaultgw"); } if ($foundgwv6 == false) { - $defaultif = get_real_interface("wan"); - $interfacegw = "wan"; - $gatewayip = get_interface_gateway_v6("wan"); + $defaultifv6 = get_real_interface("wan"); + $interfacegwv6 = "wan"; + $gatewayipv6 = get_interface_gateway_v6("wan"); @touch("{$g['tmp_path']}/{$defaultif}_defaultgwv6"); } $dont_add_route = false; From 17a5b09514ef2f9b56324c2ec42408506775d42c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 4 Mar 2011 17:01:52 +0100 Subject: [PATCH 111/225] Correct one more variable in the process --- etc/inc/system.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 4ed6813f6d..535b4d8da0 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -355,7 +355,7 @@ function system_routing_configure($interface = "") { if (!empty($interfacegwv6)) { $defaultifv6 = get_real_interface($gateway['interface']); if ($defaultifv6) - @file_put_contents("{$g['tmp_path']}/{$defaultif}_defaultgwv6", $gatewayipv6); + @file_put_contents("{$g['tmp_path']}/{$defaultifv6}_defaultgwv6", $gatewayipv6); } $foundgwv6 = true; break; @@ -373,7 +373,7 @@ function system_routing_configure($interface = "") { $interfacegwv6 = "wan"; $gatewayipv6 = get_interface_gateway_v6("wan"); @touch("{$g['tmp_path']}/{$defaultif}_defaultgwv6"); - } + } $dont_add_route = false; /* if OLSRD is enabled, allow WAN to house DHCP. */ if($config['installedpackages']['olsrd']) { @@ -422,7 +422,7 @@ function system_routing_configure($interface = "") { } if ($dont_add_route == false ) { - if (!empty($interface) && $interface != $interfacegw) + if (!empty($interface) && $interface != $interfacegwv6) ; else if (($interfacegwv6 <> "bgpd") && (is_ipaddrv6($gatewayipv6))) { $action = "add"; From de1407305813f8ea41a62775a023a4b70cb9f7da Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 6 Mar 2011 20:17:01 +0100 Subject: [PATCH 112/225] First stab at generating a link local address for the bridge interface if it's used by DHCP. --- etc/inc/services.inc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 1afc23ae73..3e22efb144 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -693,7 +693,13 @@ EOD; } } - $dhcpdv6ifs[] = get_real_interface($dhcpv6if); + + $realif = escapeshellcmd(get_real_interface($dhcpv6if)); + $dhcpdv6ifs[] = $realif; + /* Create link local address for bridges */ + if(stristr("$realif", "bridge")) { + mwexec("$ifconfig {$realif} inet6 fe80::/64 eui64"); + } } fwrite($fd, $dhcpdconf); From 283e918079536f7f5fda6cb4866fd82f4ec4421e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 6 Mar 2011 20:44:18 +0100 Subject: [PATCH 113/225] More fixes to differentiate between v4 and v6 gateways on the same interface. --- etc/inc/interfaces.inc | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc index be86bac26b..3405838def 100644 --- a/etc/inc/interfaces.inc +++ b/etc/inc/interfaces.inc @@ -735,7 +735,10 @@ function interface_gre_configure(&$gre, $grekey = "") { if (isset($gre['link1']) && $gre['link1']) mwexec("/sbin/route add {$gre['tunnel-remote-addr']}/{$gre['tunnel-remote-net']} {$gre['tunnel-local-addr']}"); - file_put_contents("{$g['tmp_path']}/{$greif}_router", $gre['tunnel-remote-addr']); + if(is_ipaddrv4($gre['tunnel-remote-addr'])) + file_put_contents("{$g['tmp_path']}/{$greif}_router", $gre['tunnel-remote-addr']); + if(is_ipaddrv6($gre['tunnel-remote-addr'])) + file_put_contents("{$g['tmp_path']}/{$greif}_routerv6", $gre['tunnel-remote-addr']); return $greif; } @@ -794,7 +797,11 @@ function interface_gif_configure(&$gif, $gifkey = "") { /* XXX: Needed?! Let them use the defined gateways instead */ //mwexec("/sbin/route add {$gif['tunnel-remote-addr']}/{$gif['tunnel-remote-net']} -iface {$gifif}"); - file_put_contents("{$g['tmp_path']}/{$gifif}_router", $gif['tunnel-remote-addr']); + + if(is_ipaddrv4($gif['tunnel-remote-addr'])) + file_put_contents("{$g['tmp_path']}/{$gifif}_router", $gif['tunnel-remote-addr']); + if(is_ipaddrv6($gif['tunnel-remote-addr'])) + file_put_contents("{$g['tmp_path']}/{$gifif}_routerv6", $gif['tunnel-remote-addr']); return $gifif; } From ae091de305647e9c3e294a8647fa781dae3d36a9 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 7 Mar 2011 09:13:38 +0100 Subject: [PATCH 114/225] Commit the forgotten edit page for the dhcpv6 reservations --- usr/local/www/services_dhcpv6_edit.php | 254 +++++++++++++++++++++++++ 1 file changed, 254 insertions(+) create mode 100644 usr/local/www/services_dhcpv6_edit.php diff --git a/usr/local/www/services_dhcpv6_edit.php b/usr/local/www/services_dhcpv6_edit.php new file mode 100644 index 0000000000..2c9f5744a9 --- /dev/null +++ b/usr/local/www/services_dhcpv6_edit.php @@ -0,0 +1,254 @@ +. + Copyright (C) 2011 Seth Mos . + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ +/* + pfSense_BUILDER_BINARIES: /usr/sbin/arp + pfSense_MODULE: dhcpserver +*/ + +##|+PRIV +##|*IDENT=page-services-dhcpserverv6-editstaticmapping +##|*NAME=Services: DHCPv6 Server : Edit static mapping page +##|*DESCR=Allow access to the 'Services: DHCPv6 Server : Edit static mapping' page. +##|*MATCH=services_dhcpv6_edit.php* +##|-PRIV + +function staticmapcmp($a, $b) { + return ipcmp($a['ipaddrv6'], $b['ipaddrv6']); +} + +function staticmaps_sort($ifgui) { + global $g, $config; + + usort($config['dhcpd'][$ifgui]['staticmap'], "staticmapcmp"); +} + +require_once('globals.inc'); + +if(!$g['services_dhcp_server_enable']) { + Header("Location: /"); + exit; +} + +require("guiconfig.inc"); + +$if = $_GET['if']; +if ($_POST['if']) + $if = $_POST['if']; + +if (!$if) { + header("Location: services_dhcpv6.php"); + exit; +} + +if (!is_array($config['dhcpdv6'][$if]['staticmap'])) { + $config['dhcpdv6'][$if]['staticmap'] = array(); +} + +$static_arp_enabled=isset($config['dhcpdv6'][$if]['staticarp']); +$netboot_enabled=isset($config['dhcpdv6'][$if]['netboot']); +$a_maps = &$config['dhcpdv6'][$if]['staticmap']; +$ifcfgipv6 = get_interface_ipv6($if); +$ifcfgsnv6 = get_interface_subnetv6($if); +$ifcfgdescr = convert_friendly_interface_to_friendly_descr($if); + +$id = $_GET['id']; +if (isset($_POST['id'])) + $id = $_POST['id']; + +if (isset($id) && $a_maps[$id]) { + $pconfig['mac'] = $a_maps[$id]['mac']; + $pconfig['hostname'] = $a_maps[$id]['hostname']; + $pconfig['ipaddrv6'] = $a_maps[$id]['ipaddrv6']; + $pconfig['netbootfile'] = $a_maps[$id]['netbootfile']; + $pconfig['descr'] = $a_maps[$id]['descr']; +} else { + $pconfig['mac'] = $_GET['mac']; + $pconfig['hostname'] = $_GET['hostname']; + $pconfig['netbootfile'] = $_GET['netbootfile']; + $pconfig['descr'] = $_GET['descr']; +} + +if ($_POST) { + + unset($input_errors); + $pconfig = $_POST; + + /* input validation */ + $reqdfields = explode(" ", "mac"); + $reqdfieldsn = array(gettext("MAC address")); + + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); + + /* normalize MAC addresses - lowercase and convert Windows-ized hyphenated MACs to colon delimited */ + $_POST['mac'] = strtolower(str_replace("-", ":", $_POST['mac'])); + + if ($_POST['hostname']) { + preg_match("/^[0-9]/", $_POST['hostname'], $matches); + if($matches) + $input_errors[] = gettext("The hostname cannot start with a numeric character according to RFC952"); + preg_match("/\-\$/", $_POST['hostname'], $matches); + if($matches) + $input_errors[] = gettext("The hostname cannot end with a hyphen according to RFC952"); + if (!is_hostname($_POST['hostname'])) { + $input_errors[] = gettext("The hostname can only contain the characters A-Z, 0-9 and '-'."); + } else { + if (strpos($_POST['hostname'],'.')) { + $input_errors[] = gettext("A valid hostname is specified, but the domain name part should be omitted"); + } + } + } + if (($_POST['ipaddrv6'] && !is_ipaddrv6($_POST['ipaddrv6']))) { + $input_errors[] = gettext("A valid IPv6 address must be specified."); + } + if (($_POST['mac'] && !is_macaddr($_POST['mac']))) { + $input_errors[] = gettext("A valid MAC address must be specified."); + } + if($static_arp_enabled && !$_POST['ipaddrv6']) { + $input_errors[] = gettext("Static ARP is enabled. You must specify an IPv6 address."); + } + + /* check for overlaps */ + foreach ($a_maps as $mapent) { + if (isset($id) && ($a_maps[$id]) && ($a_maps[$id] === $mapent)) + continue; + + if ((($mapent['hostname'] == $_POST['hostname']) && $mapent['hostname']) || ($mapent['mac'] == $_POST['mac'])) { + $input_errors[] = gettext("This Hostname, IP or MAC address already exists."); + break; + } + } + + /* make sure it's not within the dynamic subnet */ + if ($_POST['ipaddrv6']) { + /* oh boy, we need to be able to somehow do this at some point. skip */ + } + + if (!$input_errors) { + $mapent = array(); + $mapent['mac'] = $_POST['mac']; + $mapent['ipaddrv6'] = $_POST['ipaddrv6']; + $mapent['hostname'] = $_POST['hostname']; + $mapent['descr'] = $_POST['descr']; + $mapent['netbootfile'] = $_POST['netbootfile']; + + if (isset($id) && $a_maps[$id]) + $a_maps[$id] = $mapent; + else + $a_maps[] = $mapent; + staticmaps_sort($if); + + write_config(); + + if(isset($config['dhcpdv6'][$if]['enable'])) { + mark_subsystem_dirty('staticmaps'); + if (isset($config['dnsmasq']['regdhcpstatic'])) + mark_subsystem_dirty('hosts'); + } + + header("Location: services_dhcpv6.php?if={$if}"); + exit; + } +} + +$pgtitle = array(gettext("Services"),gettext("DHCPv6"),gettext("Edit static mapping")); +$statusurl = "status_dhcpv6_leases.php"; +$logurl = "diag_logs_dhcp.php"; + +include("head.inc"); + +?> + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + +
+
+ +
+
+ +
Netboot filename + +
Name of the file that should be loaded when this host boots off of the network, overrides setting on main page.
+ +
  + "> " onclick="history.back()"> + + + + +
+
+ + + From d2627d7c7c3ddb9f2d65fdaf8fa737a57a34e33e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 8 Mar 2011 09:14:46 +0100 Subject: [PATCH 115/225] Correct the link to the proper page for deleting a static mapping --- usr/local/www/services_dhcpv6.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 27c4443786..2c7f6bfaa6 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -860,7 +860,7 @@ include("head.inc"); - +
')">')">
From 9956b38ae11ca0abd75a367f54009052a2126181 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 9 Mar 2011 08:20:27 +0100 Subject: [PATCH 116/225] Merge the config upgrade code, there was a mismatch, the one who merged this wrong should get a pointy hat. --- etc/inc/globals.inc | 2 +- etc/inc/upgrade_config.inc | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc index 21460c548c..4e150f82ef 100644 --- a/etc/inc/globals.inc +++ b/etc/inc/globals.inc @@ -91,7 +91,7 @@ $g = array( "disablecrashreporter" => false, "crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php", "debug" => false, - "latest_config" => "7.7", + "latest_config" => "7.8", "nopkg_platforms" => array("cdrom"), "minimum_ram_warning" => "101", "minimum_ram_warning_text" => "128 MB", diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index fee37864a5..df4ede83c0 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -2307,6 +2307,14 @@ function upgrade_075_to_076() { } function upgrade_076_to_077() { + global $config; + foreach($config['filter']['rule'] as & $rule) { + if (isset($rule['protocol']) && !empty($rule['protocol'])) + $rule['protocol'] = strtolower($rule['protocol']); + } +} + +function upgrade_077_to_078() { global $config; global $g; From 9c5ad16762b0922cc7224ef3b1531a778100551b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 9 Mar 2011 12:50:05 +0100 Subject: [PATCH 117/225] unbreak the broken merge --- etc/inc/rrd.inc | 8 -------- 1 file changed, 8 deletions(-) diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc index c5171feb11..56d00fc98a 100644 --- a/etc/inc/rrd.inc +++ b/etc/inc/rrd.inc @@ -332,16 +332,8 @@ function enable_rrd_graphing() { $rrdupdatesh .= "\n"; $rrdupdatesh .= "# polling packets for interface $ifname $realif \n"; -<<<<<<< HEAD $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$packets N:\\\n"; $rrdupdatesh .= "`$pfctl -vvsI -i {$realif} | awk '/In4\/Pass|Out4\/Pass|In6\/Pass|Out6\/Pass|In4\/Block|Out4\/Block|In6\/Block|Out6\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; -======= - $rrdupdatesh .= "unset PACKETS \n"; - $rrdupdatesh .= "PACKETS=`cat \$TMPFILE | awk '/In4\/Pass|Out4\/Pass/ {printf \$4 \":\"}'`\\\n"; - $rrdupdatesh .= "`cat \$TMPFILE | awk '/In4\/Block|Out4\/Block/ {printf \$4 \":\"}'|sed -e 's/.\$//'`\n"; - $rrdupdatesh .= "$rrdtool update $rrddbpath$ifname$packets N:\$PACKETS\n"; - $rrdupdatesh .= "rm \$TMPFILE \n"; ->>>>>>> upstream/master /* WIRELESS, set up the rrd file */ if($config['interfaces'][$ifname]['wireless']['mode'] == "bss") { From 354796f06cdd0ca8e7fae3cac3245ae3cea3a803 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 9 Mar 2011 14:40:24 +0100 Subject: [PATCH 118/225] Unbreak the rrd graph img page --- usr/local/www/status_rrd_graph_img.php | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php index 0242f33a34..2838a68894 100644 --- a/usr/local/www/status_rrd_graph_img.php +++ b/usr/local/www/status_rrd_graph_img.php @@ -346,14 +346,11 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "CDEF:\"$curif-bytes_t_block=$curif-bytes_in_t_block,$curif-bytes_out_t_block,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_t=$curif-bytes_in_t_pass,$curif-bytes_out_t_block,+\" "; -<<<<<<< HEAD $graphcmd .= "CDEF:\"$curif-bytes_t_pass6=$curif-bytes_in6_t_pass,$curif-bytes_out6_t_pass,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_t_block6=$curif-bytes_in6_t_block,$curif-bytes_out6_t_block,+\" "; $graphcmd .= "CDEF:\"$curif-bytes_t6=$curif-bytes_in6_t_pass,$curif-bytes_out6_t_block,+\" "; -======= $graphcmd .= "VDEF:\"$curif-in_bits_95=$curif-in_bits,95,PERCENT\" "; $graphcmd .= "VDEF:\"$curif-out_bits_95=$curif-out_bits,95,PERCENT\" "; ->>>>>>> upstream/master $graphcmd .= "AREA:\"$curif-in_bits_block#{$colortrafficdown[1]}:$curif-in-block\" "; $graphcmd .= "AREA:\"$curif-in_bits_pass#{$colortrafficdown[0]}:$curif-in-pass:STACK\" "; @@ -363,21 +360,13 @@ if((strstr($curdatabase, "-traffic.rrd")) && (file_exists("$rrddbpath$curdatabas $graphcmd .= "{$AREA}:\"$curif-out_bits_block_neg#{$colortrafficup[1]}:$curif-out-block\" "; $graphcmd .= "{$AREA}:\"$curif-out_bits_pass_neg#{$colortrafficup[0]}:$curif-out-pass:STACK\" "; -<<<<<<< HEAD $graphcmd .= "{$AREA}:\"$curif-out6_bits_block_neg#{$colortrafficup[3]}:$curif-out6-block:STACK\" "; $graphcmd .= "{$AREA}:\"$curif-out6_bits_pass_neg#{$colortrafficup[2]}:$curif-out6-pass:STACK\" "; - $graphcmd .= "COMMENT:\"\\n\" "; - $graphcmd .= "COMMENT:\"\t\t maximum average current period\\n\" "; - $graphcmd .= "COMMENT:\"IPv4 in-pass\t\" "; -======= $graphcmd .= "HRULE:\"$curif-in_bits_95#{$colortraffic95[1]}:$curif-in (95%)\" "; $graphcmd .= "HRULE:\"$curif-out_bits_95#{$colortraffic95[0]}:$curif-out (95%)\" "; - $graphcmd .= "COMMENT:\"\\n\" "; $graphcmd .= "COMMENT:\"\t\t maximum average current period 95th percentile\\n\" "; - - $graphcmd .= "COMMENT:\"in-pass\t\" "; ->>>>>>> upstream/master + $graphcmd .= "COMMENT:\"IPv4 in-pass\t\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:MAX:%7.2lf %sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:AVERAGE:%7.2lf %Sb/s\" "; $graphcmd .= "GPRINT:\"$curif-in_bits_pass:LAST:%7.2lf %Sb/s\" "; From 1529458011a6aabcf39f01592a9971bf2c337696 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 9 Mar 2011 22:21:14 +0100 Subject: [PATCH 119/225] Add the IPv6 tag to the version so that BSD perimeter can seen these installs from a mile away --- conf.default/config.xml | 2 +- etc/version | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/conf.default/config.xml b/conf.default/config.xml index 6074c02b92..42662f709c 100644 --- a/conf.default/config.xml +++ b/conf.default/config.xml @@ -1,7 +1,7 @@ - 7.6 + 7.8 pfsense_ng diff --git a/etc/version b/etc/version index 73a14bbb3f..e252e34bdb 100644 --- a/etc/version +++ b/etc/version @@ -1 +1 @@ -2.0-RC1 +2.0-RC1-IPv6 From 3795d067c95977ec4b4ddf95714236185cce5ac5 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 11 Mar 2011 22:34:53 +0100 Subject: [PATCH 120/225] Add the ability to differentiate between v4 and v6 tunnels. Bill says he can test --- etc/inc/ipsec.inc | 3 ++- usr/local/www/vpn_ipsec_phase2.php | 30 +++++++++++++++++++++--------- 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/etc/inc/ipsec.inc b/etc/inc/ipsec.inc index e15a14c6c9..76f94ec78f 100644 --- a/etc/inc/ipsec.inc +++ b/etc/inc/ipsec.inc @@ -82,7 +82,8 @@ $p1_authentication_methods = array( 'pre_shared_key' => array( 'name' => 'Mutual PSK', 'mobile' => false ) ); $p2_modes = array( - 'tunnel' => 'Tunnel', + 'tunnel' => 'Tunnel v4', + 'tunnel6' => 'Tunnel v6', 'transport' => 'Transport'); $p2_protos = array( diff --git a/usr/local/www/vpn_ipsec_phase2.php b/usr/local/www/vpn_ipsec_phase2.php index d45b0d69dc..a4dcbdb1a3 100644 --- a/usr/local/www/vpn_ipsec_phase2.php +++ b/usr/local/www/vpn_ipsec_phase2.php @@ -118,7 +118,7 @@ if ($_POST) { do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); - if($pconfig['mode'] == "tunnel") + if(($pconfig['mode'] == "tunnel") || ($pconfig['mode'] == "tunnel6")) { switch ($pconfig['localid_type']) { case "network": @@ -158,7 +158,7 @@ if ($_POST) { $ph2ent['mode'] = $pconfig['mode']; $ph2ent['disabled'] = $pconfig['disabled'] ? true : false; - if($ph2ent['mode'] == "tunnel") { + if(($ph2ent['mode'] == "tunnel") || ($ph2ent['mode'] == "tunnel6")){ $ph2ent['localid'] = pconfig_to_idinfo("local",$pconfig); $ph2ent['remoteid'] = pconfig_to_idinfo("remote",$pconfig); } @@ -216,7 +216,7 @@ include("head.inc"); function change_mode() { index = document.iform.mode.selectedIndex; value = document.iform.mode.options[index].value; - if (value == 'tunnel') { + if ((value == 'tunnel') || (value == 'tunnel6')) { document.getElementById('opt_localid').style.display = ''; document.getElementById('opt_remoteid').style.display = ''; @@ -231,8 +231,14 @@ function change_mode() { function typesel_change_local(bits) { - if (typeof(bits)=="undefined") - bits = 24; + if (typeof(bits)=="undefined") { + if (value == 'tunnel') { + bits = 24; + } + if (value == 'tunnel6') { + bits = 64; + } + } switch (document.iform.localid_type.selectedIndex) { case 0: /* single */ @@ -262,8 +268,14 @@ function typesel_change_local(bits) { function typesel_change_remote(bits) { - if (typeof(bits)=="undefined") - bits = 24; + if (typeof(bits)=="undefined") { + if (value == 'tunnel') { + bits = 24; + } + if (value == 'tunnel6') { + bits = 64; + } + } switch (document.iform.remoteid_type.selectedIndex) { case 0: /* single */ @@ -376,7 +388,7 @@ function change_protocol() { / / + + +"> + + +"> + + + +

?

+ + + + + From fbcbfa44ee959ebbebf51cb1a20237fba54ce584 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Mar 2011 21:30:45 +0100 Subject: [PATCH 125/225] Add the dhcp v6 page to the menu, eventhough it is broken. Tabs for later integration --- usr/local/www/fbegin.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/usr/local/www/fbegin.inc b/usr/local/www/fbegin.inc index e88df50657..e2f5d72267 100755 --- a/usr/local/www/fbegin.inc +++ b/usr/local/www/fbegin.inc @@ -153,6 +153,7 @@ $status_menu[] = array("CARP (failover)", "/carp_status.php"); $status_menu[] = array("Dashboard", "/index.php"); $status_menu[] = array("Gateways", "/status_gateways.php"); $status_menu[] = array("DHCP Leases", "/status_dhcp_leases.php"); +$status_menu[] = array("DHCPv6 Leases", "/status_dhcpv6_leases.php"); $status_menu[] = array("Filter Reload", "/status_filter_reload.php"); $status_menu[] = array("Interfaces", "/status_interfaces.php"); $status_menu[] = array("IPsec", "/diag_ipsec.php"); From 6c4f3b54a05b20bfe5fbc52206a1980308b539b3 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Mar 2011 21:40:12 +0100 Subject: [PATCH 126/225] Make sure to note the limitations to gethostbyname, it does not work for Quad A records. Fix resolve_retry in the process, use that. --- etc/inc/ipsec.inc | 2 +- etc/inc/util.inc | 1 + etc/inc/vpn.inc | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/etc/inc/ipsec.inc b/etc/inc/ipsec.inc index 76f94ec78f..c7cbcf6744 100644 --- a/etc/inc/ipsec.inc +++ b/etc/inc/ipsec.inc @@ -270,7 +270,7 @@ function ipsec_phase1_status(& $ph1ent) { function ipsec_phase2_status(& $spd,& $sad,& $ph1ent,& $ph2ent) { $loc_ip = ipsec_get_phase1_src($ph1ent); - $rmt_ip = gethostbyname(ipsec_get_phase1_dst($ph1ent)); + $rmt_ip = resolve_retry(ipsec_get_phase1_dst($ph1ent)); $loc_id = ipsec_idinfo_to_cidr($ph2ent['localid'],true); $rmt_id = ipsec_idinfo_to_cidr($ph2ent['remoteid'],true); diff --git a/etc/inc/util.inc b/etc/inc/util.inc index cf531cee1d..48b1de136c 100644 --- a/etc/inc/util.inc +++ b/etc/inc/util.inc @@ -1102,6 +1102,7 @@ function resolve_retry($hostname, $retries = 5) { return $hostname; for ($i = 0; $i < $retries; $i++) { + // FIXME: gethostbyname does not work for AAAA hostnames, boo, hiss $ip = gethostbyname($hostname); if ($ip && $ip != $hostname) { diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 6f48820bff..a1d4cef81f 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -436,7 +436,7 @@ function vpn_ipsec_configure($ipchg = false) case "dyn_dns": $myid_type = "address"; - $myid_data = gethostbyname($ph1ent['myid_data']); + $myid_data = resolve_retry($ph1ent['myid_data']); break; case "address"; From e79b24ab3534ac2af7d832038155a99902bc2c49 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Mar 2011 22:02:50 +0100 Subject: [PATCH 127/225] Extend the IPsec configuration with a protocol family for the phase 1 --- etc/inc/ipsec.inc | 15 +++++++++++---- usr/local/www/vpn_ipsec_phase1.php | 18 ++++++++++++++++++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/etc/inc/ipsec.inc b/etc/inc/ipsec.inc index c7cbcf6744..adfea0524c 100644 --- a/etc/inc/ipsec.inc +++ b/etc/inc/ipsec.inc @@ -127,14 +127,21 @@ function ipsec_get_phase1_src(& $ph1ent) { if ($ph1ent['interface']) { if (!is_ipaddr($ph1ent['interface'])) { $if = $ph1ent['interface']; - $interfaceip = get_interface_ip($if); + if($ph1ent['protocol'] == "inet6") { + $interfaceip = get_interface_ipv6($if); + } else { + $interfaceip = get_interface_ip($if); + } } else { $interfaceip=$ph1ent['interface']; } - } - else { + } else { $if = "wan"; - $interfaceip = get_interface_ip($if); + if($ph1ent['protocol'] == "inet6") { + $interfaceip = get_interface_ipv6($if); + } else { + $interfaceip = get_interface_ip($if); + } } return $interfaceip; diff --git a/usr/local/www/vpn_ipsec_phase1.php b/usr/local/www/vpn_ipsec_phase1.php index 12bb235a5a..c537f9f28e 100644 --- a/usr/local/www/vpn_ipsec_phase1.php +++ b/usr/local/www/vpn_ipsec_phase1.php @@ -80,6 +80,7 @@ if (isset($p1index) && $a_phase1[$p1index]) { $pconfig['remotegw'] = $a_phase1[$p1index]['remote-gateway']; $pconfig['mode'] = $a_phase1[$p1index]['mode']; + $pconfig['protocol'] = $a_phase1[$p1index]['protocol']; $pconfig['myid_type'] = $a_phase1[$p1index]['myid_type']; $pconfig['myid_data'] = $a_phase1[$p1index]['myid_data']; $pconfig['peerid_type'] = $a_phase1[$p1index]['peerid_type']; @@ -113,6 +114,7 @@ if (isset($p1index) && $a_phase1[$p1index]) { if($config['interfaces']['lan']) $pconfig['localnet'] = "lan"; $pconfig['mode'] = "aggressive"; + $pconfig['protocol'] = "inet"; $pconfig['myid_type'] = "myaddress"; $pconfig['peerid_type'] = "peeraddress"; $pconfig['authentication_method'] = "pre_shared_key"; @@ -292,6 +294,7 @@ if ($_POST) { $ph1ent['remote-gateway'] = $pconfig['remotegw']; $ph1ent['mode'] = $pconfig['mode']; + $ph1ent['protocol'] = $pconfig['protocol']; $ph1ent['myid_type'] = $pconfig['myid_type']; $ph1ent['myid_data'] = $pconfig['myid_data']; @@ -509,6 +512,21 @@ function dpdchkbox_change() { + + + +
. + + From fb17f629ee27e837735aeb48b93ead69d2a64754 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Mar 2011 22:03:54 +0100 Subject: [PATCH 128/225] Commit the backend function that writes out the racoon.conf --- etc/inc/vpn.inc | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index a1d4cef81f..d1eb8d88ca 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -142,7 +142,7 @@ function vpn_ipsec_configure($ipchg = false) continue; $ep = ipsec_get_phase1_src($ph1ent); - if (!$ep) + if (!is_ipaddr($ep)) continue; if(!in_array($ep,$ipmap)) @@ -186,16 +186,30 @@ function vpn_ipsec_configure($ipchg = false) if ($ph2ent['pinghost']) { $iflist = get_configured_interface_list(); foreach ($iflist as $ifent => $ifname) { - $interface_ip = get_interface_ip($ifent); - $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true); - if (ip_in_subnet($interface_ip, $local_subnet)) { - $srcip = $interface_ip; - break; + if(is_ipaddrv6($ph1ent['src'])) { + $interface_ip = get_interface_ipv6($ifent); + $local_subnetv6 = ipsec_idinfo_to_cidr($ph2ent['localid'], true); + if (ip_in_subnetv6($interface_ip, $local_subnet)) { + $srcip = $interface_ip; + break; + } + } else { + $interface_ip = get_interface_ip($ifent); + $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true); + if (ip_in_subnet($interface_ip, $local_subnet)) { + $srcip = $interface_ip; + break; + } } } $dstip = $ph2ent['pinghost']; + if(is_ipaddrv6($srcip)) { + $family = "inet6"; + } else { + $family = "inet"; + } if (is_ipaddr($srcip)) - $ipsecpinghosts .= "{$srcip}|{$dstip}|3\n"; + $ipsecpinghosts .= "{$srcip}|{$dstip}|3|{$family}\n"; } } $pfd = fopen("{$g['vardb_path']}/ipsecpinghosts", "w"); From 1778480dbe583323acbacd0805bbfd9cbf3ef5b0 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 14 Mar 2011 22:09:47 +0100 Subject: [PATCH 129/225] Show the proper Phase entry for the IPv6 tunnels --- usr/local/www/vpn_ipsec.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/usr/local/www/vpn_ipsec.php b/usr/local/www/vpn_ipsec.php index 40879f6660..16231abacc 100755 --- a/usr/local/www/vpn_ipsec.php +++ b/usr/local/www/vpn_ipsec.php @@ -281,7 +281,7 @@ include("head.inc"); - + @@ -317,11 +317,11 @@ include("head.inc"); "tunnel") { + if(($ph2ent['mode'] <> "tunnel") and ($ph2ent['mode'] <> "tunnel6")) { echo ""; } ?> - + + + + + + + + + +
+
+ 		+
+
+ + From 8336846a33ef73a335cf2acbb296ed7b28f34a21 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 15 Mar 2011 12:05:15 +0100 Subject: [PATCH 133/225] More html fine tuning --- usr/local/www/widgets/widgets/interfaces.widget.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/widgets/widgets/interfaces.widget.php b/usr/local/www/widgets/widgets/interfaces.widget.php index c05e99b72d..d2db3b19ee 100644 --- a/usr/local/www/widgets/widgets/interfaces.widget.php +++ b/usr/local/www/widgets/widgets/interfaces.widget.php @@ -71,7 +71,7 @@ require_once("/usr/local/www/widgets/include/interfaces.inc"); ?> - +
@@ -648,7 +648,7 @@ include("head.inc"); @@ -681,7 +681,7 @@ include("head.inc"); > 

-
+

@@ -694,8 +694,8 @@ include("head.inc"); "> -

@@ -734,9 +734,9 @@ include("head.inc");

- + -
+

- diff --git a/usr/local/www/services_dhcpv6_edit.php b/usr/local/www/services_dhcpv6_edit.php index 2c9f5744a9..bc51f83f26 100644 --- a/usr/local/www/services_dhcpv6_edit.php +++ b/usr/local/www/services_dhcpv6_edit.php @@ -212,21 +212,21 @@ include("head.inc");

From c271c485ea62a4ecca2136c1d8c9400bd0f2bd09 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 17 Mar 2011 12:45:09 +0100 Subject: [PATCH 143/225] enlarge various address fields for IPv6 addresses --- usr/local/www/firewall_virtual_ip_edit.php | 6 +++--- usr/local/www/interfaces.php | 2 +- usr/local/www/system.php | 2 +- usr/local/www/vpn_ipsec_phase1.php | 2 +- usr/local/www/vpn_ipsec_phase2.php | 6 +++--- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index e5581ca312..dd10780027 100755 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -464,7 +464,7 @@ function typesel_change() { - - */ diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php index 86d795bc9e..ad253a1e4f 100755 --- a/usr/local/www/interfaces.php +++ b/usr/local/www/interfaces.php @@ -1347,7 +1347,7 @@ $types = array("none" => gettext("None"), "staticv4" => gettext("Static IPv4"), diff --git a/usr/local/www/vpn_ipsec_phase2.php b/usr/local/www/vpn_ipsec_phase2.php index a4dcbdb1a3..5957c9ecac 100644 --- a/usr/local/www/vpn_ipsec_phase2.php +++ b/usr/local/www/vpn_ipsec_phase2.php @@ -385,7 +385,7 @@ function change_protocol() { From 9498c8d7280f59b5ff15dd12b50dfd5ca3273c89 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 17 Mar 2011 12:52:26 +0100 Subject: [PATCH 144/225] Fix field lengths for IPv6 addresses --- usr/local/www/system_gateways_edit.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index 6eef520da5..02fac7c51f 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -354,7 +354,7 @@ function show_advanced_gateway() { @@ -374,7 +374,7 @@ function show_advanced_gateway() { else $monitor = htmlspecialchars($pconfig['monitor']); ?> - +
Date: Fri, 18 Mar 2011 10:06:48 +0100 Subject: [PATCH 145/225] Fix edit bug that duplicated records. --- usr/local/www/firewall_nat_npt_edit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/firewall_nat_npt_edit.php b/usr/local/www/firewall_nat_npt_edit.php index e06cc13bbc..3537186a89 100644 --- a/usr/local/www/firewall_nat_npt_edit.php +++ b/usr/local/www/firewall_nat_npt_edit.php @@ -268,7 +268,7 @@ external prefix."); From 755405c1c775fa830b0880b4639bf4368d663832 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Fri, 18 Mar 2011 10:18:50 +0100 Subject: [PATCH 146/225] fix filter rules for requested ipv6 icmp types --- etc/inc/filter.inc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 77e27b4e49..6c56bc85b2 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1839,16 +1839,16 @@ function filter_generate_user_rule($rule) { $aline['reply'] = "reply-to ( {$ifcfg['if']} {$rg} ) "; } else { if($rule['interface'] <> "pptp") { - log_error("Could not find gateway for interface({$rule['interface']})."); + log_error("Could not find IPv6 gateway for interface({$rule['interface']})."); } } } else { $rg = get_interface_gateway($rule['interface']); - if(is_ipaddr($rg)) { + if(is_ipaddrv4($rg)) { $aline['reply'] = "reply-to ( {$ifcfg['if']} {$rg} ) "; } else { if($rule['interface'] <> "pptp") { - log_error("Could not find gateway for interface({$rule['interface']})."); + log_error("Could not find IPv4 gateway for interface({$rule['interface']})."); } } } @@ -1904,10 +1904,10 @@ function filter_generate_user_rule($rule) { $l7_structures = $l7rule->get_unique_structures(); $aline['divert'] = "divert " . $l7rule->GetRPort() . " "; } - if(($rule['protocol'] == "icmp") && $rule['icmptype']) + if(($rule['protocol'] == "icmp") && $rule['icmptype'] && ($rule['ipprotocol'] == "inet")) $aline['icmp-type'] = "icmp-type {$rule['icmptype']} "; - if(($rule['protocol'] == "icmp6") && $rule['icmptype']) - $aline['icmp6-type'] = "icmp-type {$rule['icmptype']} "; + if(($rule['protocol'] == "icmp") && $rule['icmptype'] && ($rule['ipprotocol'] == "inet6")) + $aline['icmp6-type'] = "icmp6-type {$rule['icmptype']} "; if(!empty($rule['tag'])) $aline['tag'] = " tag " .$rule['tag']. " "; if(!empty($rule['tagged'])) From 0999192417ca0457d681a62ab61ce139246a732b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 20 Mar 2011 10:12:26 +0100 Subject: [PATCH 147/225] Merge commit from Bill M for ipv6 counters and interface stats --- etc/inc/pfsense-utils.inc | 44 +++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 16 deletions(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index 27641354b1..a65f27caaf 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1121,13 +1121,13 @@ function get_interface_info($ifdescr) { $ifinfo['macaddr'] = $ifinfotmp['macaddr']; $ifinfo['ipaddr'] = $ifinfotmp['ipaddr']; $ifinfo['subnet'] = $ifinfotmp['subnet']; - $ifinfo['ipaddrv6'] = get_interface_ipv6($ifdescr);; - $ifinfo['subnetv6'] = get_interface_subnetv6($ifdescr);; + $ifinfo['ipaddrv6'] = get_interface_ipv6($ifdescr); + $ifinfo['subnetv6'] = get_interface_subnetv6($ifdescr); if (isset($ifinfotmp['link0'])) $link0 = "down"; $ifinfotmp = pfSense_get_interface_stats($chkif); - $ifinfo['inpkts'] = $ifinfotmp['inpkts']; - $ifinfo['outpkts'] = $ifinfotmp['outpkts']; + // $ifinfo['inpkts'] = $ifinfotmp['inpkts']; + // $ifinfo['outpkts'] = $ifinfotmp['outpkts']; $ifinfo['inerrs'] = $ifinfotmp['inerrs']; $ifinfo['outerrs'] = $ifinfotmp['outerrs']; $ifinfo['collisions'] = $ifinfotmp['collisions']; @@ -1137,31 +1137,43 @@ function get_interface_info($ifdescr) { exec("/sbin/pfctl -vvsI -i {$chkif}", $pfctlstats); $pf_in4_pass = preg_split("/ +/ ", $pfctlstats[3]); $pf_out4_pass = preg_split("/ +/", $pfctlstats[5]); + $pf_in6_pass = preg_split("/ +/ ", $pfctlstats[7]); + $pf_out6_pass = preg_split("/ +/", $pfctlstats[9]); $in4_pass = $pf_in4_pass[5]; $out4_pass = $pf_out4_pass[5]; $in4_pass_packets = $pf_in4_pass[3]; $out4_pass_packets = $pf_out4_pass[3]; - $ifinfo['inbytespass'] = $in4_pass; - $ifinfo['outbytespass'] = $out4_pass; - $ifinfo['inpktspass'] = $in4_pass_packets; - $ifinfo['outpktspass'] = $out4_pass_packets; + $in6_pass = $pf_in6_pass[5]; + $out6_pass = $pf_out6_pass[5]; + $in6_pass_packets = $pf_in6_pass[3]; + $out6_pass_packets = $pf_out6_pass[3]; + $ifinfo['inbytespass'] = $in4_pass + $in6_pass; + $ifinfo['outbytespass'] = $out4_pass + $out6_pass; + $ifinfo['inpktspass'] = $in4_pass_packets + $in6_pass_packets; + $ifinfo['outpktspass'] = $out4_pass_packets + $in6_pass_packets; /* Block */ $pf_in4_block = preg_split("/ +/", $pfctlstats[4]); $pf_out4_block = preg_split("/ +/", $pfctlstats[6]); + $pf_in6_block = preg_split("/ +/", $pfctlstats[8]); + $pf_out6_block = preg_split("/ +/", $pfctlstats[10]); $in4_block = $pf_in4_block[5]; $out4_block = $pf_out4_block[5]; $in4_block_packets = $pf_in4_block[3]; $out4_block_packets = $pf_out4_block[3]; - $ifinfo['inbytesblock'] = $in4_block; - $ifinfo['outbytesblock'] = $out4_block; - $ifinfo['inpktsblock'] = $in4_block_packets; - $ifinfo['outpktsblock'] = $out4_block_packets; + $in6_block = $pf_in6_block[5]; + $out6_block = $pf_out6_block[5]; + $in6_block_packets = $pf_in6_block[3]; + $out6_block_packets = $pf_out6_block[3]; + $ifinfo['inbytesblock'] = $in4_block + $in6_block; + $ifinfo['outbytesblock'] = $out4_block + $out6_block; + $ifinfo['inpktsblock'] = $in4_block_packets + $in6_block_packets; + $ifinfo['outpktsblock'] = $out4_block_packets + $out6_block_packets; - $ifinfo['inbytes'] = $in4_pass + $in4_block; - $ifinfo['outbytes'] = $out4_pass + $out4_block; - $ifinfo['inpkts'] = $in4_pass_packets + $in4_block_packets; - $ifinfo['outpkts'] = $in4_pass_packets + $out4_block_packets; + $ifinfo['inbytes'] = $in4_pass + $in6_pass; + $ifinfo['outbytes'] = $out4_pass + $out6_pass; + $ifinfo['inpkts'] = $in4_pass_packets + $in6_pass_packets; + $ifinfo['outpkts'] = $in4_pass_packets + $out6_pass_packets; $ifconfiginfo = ""; $link_type = $config['interfaces'][$ifdescr]['ipaddr']; From 22dae8531b63c10e4d9708ff42377cc9a202c3da Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 20 Mar 2011 23:07:09 +0100 Subject: [PATCH 148/225] Add a function that will calculate the ipv6 address for a given hardware address --- etc/inc/pfsense-utils.inc | 78 +++++++++++++++++++++++++-------------- 1 file changed, 50 insertions(+), 28 deletions(-) diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc index a65f27caaf..d2fb4b5939 100644 --- a/etc/inc/pfsense-utils.inc +++ b/etc/inc/pfsense-utils.inc @@ -1121,13 +1121,13 @@ function get_interface_info($ifdescr) { $ifinfo['macaddr'] = $ifinfotmp['macaddr']; $ifinfo['ipaddr'] = $ifinfotmp['ipaddr']; $ifinfo['subnet'] = $ifinfotmp['subnet']; - $ifinfo['ipaddrv6'] = get_interface_ipv6($ifdescr); - $ifinfo['subnetv6'] = get_interface_subnetv6($ifdescr); + $ifinfo['ipaddrv6'] = get_interface_ipv6($ifdescr);; + $ifinfo['subnetv6'] = get_interface_subnetv6($ifdescr);; if (isset($ifinfotmp['link0'])) $link0 = "down"; $ifinfotmp = pfSense_get_interface_stats($chkif); - // $ifinfo['inpkts'] = $ifinfotmp['inpkts']; - // $ifinfo['outpkts'] = $ifinfotmp['outpkts']; + $ifinfo['inpkts'] = $ifinfotmp['inpkts']; + $ifinfo['outpkts'] = $ifinfotmp['outpkts']; $ifinfo['inerrs'] = $ifinfotmp['inerrs']; $ifinfo['outerrs'] = $ifinfotmp['outerrs']; $ifinfo['collisions'] = $ifinfotmp['collisions']; @@ -1137,43 +1137,31 @@ function get_interface_info($ifdescr) { exec("/sbin/pfctl -vvsI -i {$chkif}", $pfctlstats); $pf_in4_pass = preg_split("/ +/ ", $pfctlstats[3]); $pf_out4_pass = preg_split("/ +/", $pfctlstats[5]); - $pf_in6_pass = preg_split("/ +/ ", $pfctlstats[7]); - $pf_out6_pass = preg_split("/ +/", $pfctlstats[9]); $in4_pass = $pf_in4_pass[5]; $out4_pass = $pf_out4_pass[5]; $in4_pass_packets = $pf_in4_pass[3]; $out4_pass_packets = $pf_out4_pass[3]; - $in6_pass = $pf_in6_pass[5]; - $out6_pass = $pf_out6_pass[5]; - $in6_pass_packets = $pf_in6_pass[3]; - $out6_pass_packets = $pf_out6_pass[3]; - $ifinfo['inbytespass'] = $in4_pass + $in6_pass; - $ifinfo['outbytespass'] = $out4_pass + $out6_pass; - $ifinfo['inpktspass'] = $in4_pass_packets + $in6_pass_packets; - $ifinfo['outpktspass'] = $out4_pass_packets + $in6_pass_packets; + $ifinfo['inbytespass'] = $in4_pass; + $ifinfo['outbytespass'] = $out4_pass; + $ifinfo['inpktspass'] = $in4_pass_packets; + $ifinfo['outpktspass'] = $out4_pass_packets; /* Block */ $pf_in4_block = preg_split("/ +/", $pfctlstats[4]); $pf_out4_block = preg_split("/ +/", $pfctlstats[6]); - $pf_in6_block = preg_split("/ +/", $pfctlstats[8]); - $pf_out6_block = preg_split("/ +/", $pfctlstats[10]); $in4_block = $pf_in4_block[5]; $out4_block = $pf_out4_block[5]; $in4_block_packets = $pf_in4_block[3]; $out4_block_packets = $pf_out4_block[3]; - $in6_block = $pf_in6_block[5]; - $out6_block = $pf_out6_block[5]; - $in6_block_packets = $pf_in6_block[3]; - $out6_block_packets = $pf_out6_block[3]; - $ifinfo['inbytesblock'] = $in4_block + $in6_block; - $ifinfo['outbytesblock'] = $out4_block + $out6_block; - $ifinfo['inpktsblock'] = $in4_block_packets + $in6_block_packets; - $ifinfo['outpktsblock'] = $out4_block_packets + $out6_block_packets; + $ifinfo['inbytesblock'] = $in4_block; + $ifinfo['outbytesblock'] = $out4_block; + $ifinfo['inpktsblock'] = $in4_block_packets; + $ifinfo['outpktsblock'] = $out4_block_packets; - $ifinfo['inbytes'] = $in4_pass + $in6_pass; - $ifinfo['outbytes'] = $out4_pass + $out6_pass; - $ifinfo['inpkts'] = $in4_pass_packets + $in6_pass_packets; - $ifinfo['outpkts'] = $in4_pass_packets + $out6_pass_packets; + $ifinfo['inbytes'] = $in4_pass + $in4_block; + $ifinfo['outbytes'] = $out4_pass + $out4_block; + $ifinfo['inpkts'] = $in4_pass_packets + $in4_block_packets; + $ifinfo['outpkts'] = $in4_pass_packets + $out4_block_packets; $ifconfiginfo = ""; $link_type = $config['interfaces'][$ifdescr]['ipaddr']; @@ -2185,4 +2173,38 @@ function filter_rules_compare($a, $b) { return compare_interface_friendly_names($a['interface'], $b['interface']); } +function generate_ipv6_from_mac($mac) { + $elements = explode(":", $mac); + if(count($elements) <> 6) + return false; + + $i = 0; + $ipv6 = ""; + foreach($elements as $byte) { + if($i == 0) { + $hexadecimal = substr($byte, 1, 2); + $bitmap = base_convert($hexadecimal, 16, 2); + $bitmap = str_pad($bitmap, 4, "0", STR_PAD_LEFT); + $bitmap = substr($bitmap, 0, 2) ."1". substr($bitmap, 3,4); + $byte = substr($byte, 0, 1) . base_convert($bitmap, 2, 16); + } + $ipv6 .= $byte; + if($i == 1) { + $ipv6 .= ":"; + } + if($i == 3) { + $ipv6 .= ":"; + } + if($i == 5) { + $ipv6 .= ":"; + } + if($i == 2) { + $ipv6 .= "ff:fe"; + $i++; + } + + $i++; + } + return $ipv6; +} ?> From 32018396bac5f070139a339762ee449bf7c51f5b Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Sun, 20 Mar 2011 23:11:17 +0100 Subject: [PATCH 149/225] Attempt to manually generate a ipv6 address --- etc/inc/services.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 873b06f32c..ae8b9a8a9a 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -701,7 +701,9 @@ EOD; $dhcpdv6ifs[] = $realif; /* Create link local address for bridges */ if(stristr("$realif", "bridge")) { - mwexec("$ifconfig {$realif} inet6 fe80::/64 eui64"); + exec("ifconfig {$realif}|awk '/ether/ {print \$NF}'", $mac); + $autoaddress = generate_ipv6_from_mac($mac); + mwexec("$ifconfig {$realif} inet6 fe80::{autoaddress}/64"); } } From 5ceb19429be99993a905dab84ed060a1e8e3df41 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 21 Mar 2011 09:17:25 +0100 Subject: [PATCH 150/225] Further fixup the fetch Mac address exec() this hopefully works --- etc/inc/services.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index ae8b9a8a9a..b65c0fc1b0 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -701,8 +701,8 @@ EOD; $dhcpdv6ifs[] = $realif; /* Create link local address for bridges */ if(stristr("$realif", "bridge")) { - exec("ifconfig {$realif}|awk '/ether/ {print \$NF}'", $mac); - $autoaddress = generate_ipv6_from_mac($mac); + exec("ifconfig {$realif}|awk '/ether/ {print \$2}'", $mac); + $autoaddress = generate_ipv6_from_mac(trim($mac[0])); mwexec("$ifconfig {$realif} inet6 fe80::{autoaddress}/64"); } } From 656f17638f5f72ecf218a7b23228be9b54c18353 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Mon, 21 Mar 2011 16:40:22 +0100 Subject: [PATCH 151/225] Correct typo in array name. Add select box for operating mode of rtadvd and dhcpv6 combination --- etc/inc/services.inc | 27 ++++++++++++++++++-------- usr/local/www/services_dhcpv6.php | 15 +++++++++++++- usr/local/www/services_dhcpv6_edit.php | 2 +- 3 files changed, 34 insertions(+), 10 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index b65c0fc1b0..d4ad63a492 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -96,7 +96,18 @@ function services_rtadvd_configure() { $rtadvdconf .= "{$realif}:\\\n"; $rtadvdconf .= "\t:addr=\"{$subnetv6}\":\\\n"; $rtadvdconf .= "\t:prefixlen#{$ifcfgsnv6}:\\\n"; - $rtadvdconf .= "\t:raflags#192:\n"; + switch($dhcpv6ifconf['mode']) { + case "managed": + $rtadvdconf .= "\t:raflags#64:\n"; + break; + case "assist": + $rtadvdconf .= "\t:raflags#192:\n"; + break; + default: + $rtadvdconf .= "\t:raflags#0:\n"; + break; + + } $rtadvdconf .= "\n"; } @@ -697,13 +708,13 @@ EOD; } */ - $realif = escapeshellcmd(get_real_interface($dhcpv6if)); - $dhcpdv6ifs[] = $realif; - /* Create link local address for bridges */ - if(stristr("$realif", "bridge")) { - exec("ifconfig {$realif}|awk '/ether/ {print \$2}'", $mac); - $autoaddress = generate_ipv6_from_mac(trim($mac[0])); - mwexec("$ifconfig {$realif} inet6 fe80::{autoaddress}/64"); + if($config['dhcpdv6'][$dhcpv6if]['mode'] <> "unmanaged") { + $realif = escapeshellcmd(get_real_interface($dhcpv6if)); + $dhcpdv6ifs[] = $realif; + /* Create link local address for bridges */ + if(stristr("$realif", "bridge")) { + mwexec("$ifconfig {$realif} inet6 fe80::/64 eui64"); + } } } diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 7d00b0c761..701d87e7f8 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -138,6 +138,7 @@ if (is_array($config['dhcpdv6'][$if])){ $pconfig['range_from'] = $config['dhcpdv6'][$if]['range']['from']; $pconfig['range_to'] = $config['dhcpdv6'][$if]['range']['to']; } + $pconfig['mode'] = $config['dhcpdv6'][$if]['mode']; $pconfig['deftime'] = $config['dhcpdv6'][$if]['defaultleasetime']; $pconfig['maxtime'] = $config['dhcpdv6'][$if]['maxleasetime']; $pconfig['gateway'] = $config['dhcpdv6'][$if]['gateway']; @@ -190,6 +191,8 @@ function is_inrange($test, $start, $end) { return false; } +$modes = array("unmanaged" => "Unmanaged", "managed" => "Managed", "assist" => "Assisted"); + if ($_POST) { unset($input_errors); @@ -304,6 +307,7 @@ if ($_POST) { if (!is_array($config['dhcpdv6'][$if]['range'])) $config['dhcpdv6'][$if]['range'] = array(); + $config['dhcpdv6'][$if]['mode'] = $_POST['mode']; $config['dhcpdv6'][$if]['range']['from'] = $_POST['range_from']; $config['dhcpdv6'][$if]['range']['to'] = $_POST['range_to']; $config['dhcpdv6'][$if]['defaultleasetime'] = $_POST['deftime']; @@ -415,7 +419,7 @@ include("head.inc");
From 1f116988a9bf5ca043e1211ccd5473ae589c1680 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 15 Mar 2011 16:41:48 +0100 Subject: [PATCH 134/225] Enable the IPv6 allow toggle, otherwise the other IPv6 rules do not work. --- etc/inc/globals.inc | 2 +- etc/inc/upgrade_config.inc | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc index 4e150f82ef..da1a87fade 100644 --- a/etc/inc/globals.inc +++ b/etc/inc/globals.inc @@ -91,7 +91,7 @@ $g = array( "disablecrashreporter" => false, "crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php", "debug" => false, - "latest_config" => "7.8", + "latest_config" => "7.9", "nopkg_platforms" => array("cdrom"), "minimum_ram_warning" => "101", "minimum_ram_warning_text" => "128 MB", diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index df4ede83c0..0177461ffe 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -2400,4 +2400,10 @@ function upgrade_077_to_078() { } } +function upgrade_078_to_079() { + global $config; + /* enable the allow IPv6 toggle */ + $config['system']['ipv6allow'] = true; +} + ?> From e2faab6d55975fd9af4167756406f848bcd910c9 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Tue, 15 Mar 2011 18:10:24 +0100 Subject: [PATCH 135/225] Unbreak firewall logs --- usr/local/www/diag_logs_filter.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/diag_logs_filter.php b/usr/local/www/diag_logs_filter.php index 64de45830d..877d5bd75d 100755 --- a/usr/local/www/diag_logs_filter.php +++ b/usr/local/www/diag_logs_filter.php @@ -150,7 +150,7 @@ include("head.inc"); Date: Tue, 15 Mar 2011 21:43:51 +0100 Subject: [PATCH 136/225] Add more colors to themes --- usr/local/www/themes/code-red/rrdcolors.inc.php | 8 ++++---- usr/local/www/themes/metallic/rrdcolors.inc.php | 8 ++++---- usr/local/www/themes/nervecenter/rrdcolors.inc.php | 8 ++++---- usr/local/www/themes/pfsense-dropdown/rrdcolors.inc.php | 8 ++++---- usr/local/www/themes/pfsense/rrdcolors.inc.php | 8 ++++---- usr/local/www/themes/the_wall/rrdcolors.inc.php | 9 +++++---- 6 files changed, 25 insertions(+), 24 deletions(-) diff --git a/usr/local/www/themes/code-red/rrdcolors.inc.php b/usr/local/www/themes/code-red/rrdcolors.inc.php index 869727f6af..529377b8fe 100755 --- a/usr/local/www/themes/code-red/rrdcolors.inc.php +++ b/usr/local/www/themes/code-red/rrdcolors.inc.php @@ -30,11 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colortraffic95 = array("660000", "FF0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/metallic/rrdcolors.inc.php b/usr/local/www/themes/metallic/rrdcolors.inc.php index 09956ccc94..1ed3027e20 100644 --- a/usr/local/www/themes/metallic/rrdcolors.inc.php +++ b/usr/local/www/themes/metallic/rrdcolors.inc.php @@ -30,11 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colortraffic95 = array("660000", "FF0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/nervecenter/rrdcolors.inc.php b/usr/local/www/themes/nervecenter/rrdcolors.inc.php index c681f78501..ca6a70fc08 100644 --- a/usr/local/www/themes/nervecenter/rrdcolors.inc.php +++ b/usr/local/www/themes/nervecenter/rrdcolors.inc.php @@ -30,11 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colortraffic95 = array("660000", "FF0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/pfsense-dropdown/rrdcolors.inc.php b/usr/local/www/themes/pfsense-dropdown/rrdcolors.inc.php index 09956ccc94..1ed3027e20 100644 --- a/usr/local/www/themes/pfsense-dropdown/rrdcolors.inc.php +++ b/usr/local/www/themes/pfsense-dropdown/rrdcolors.inc.php @@ -30,11 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colortraffic95 = array("660000", "FF0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/pfsense/rrdcolors.inc.php b/usr/local/www/themes/pfsense/rrdcolors.inc.php index 09956ccc94..1ed3027e20 100644 --- a/usr/local/www/themes/pfsense/rrdcolors.inc.php +++ b/usr/local/www/themes/pfsense/rrdcolors.inc.php @@ -30,11 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ -$colortrafficup = array("666666", "CCCCCC"); -$colortrafficdown = array("990000", "CC0000"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); $colortraffic95 = array("660000", "FF0000"); -$colorpacketsup = array("666666", "CCCCCC"); -$colorpacketsdown = array("990000", "CC0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); diff --git a/usr/local/www/themes/the_wall/rrdcolors.inc.php b/usr/local/www/themes/the_wall/rrdcolors.inc.php index fc662539b4..1ed3027e20 100644 --- a/usr/local/www/themes/the_wall/rrdcolors.inc.php +++ b/usr/local/www/themes/the_wall/rrdcolors.inc.php @@ -30,10 +30,11 @@ /* This file is included by the RRD graphing page and sets the colors */ - $colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); - $colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); - $colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); - $colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); +$colortrafficup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colortrafficdown = array("990000", "CC0000", "b36666", "bd9090"); +$colorpacketsup = array("666666", "CCCCCC", "b36666", "bd9090"); +$colorpacketsdown = array("990000", "CC0000", "b36666", "bd9090"); +$colortraffic95 = array("660000", "FF0000"); $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colorprocessor = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); $colormemory = array('990000','a83c3c','b36666','bd9090','cccccc','000000'); From 413a327e1ee4a8e3e0e8112bba8f8d8764fd4d8c Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 16 Mar 2011 11:37:02 +0100 Subject: [PATCH 137/225] Add v6 entries to the logs --- usr/local/www/diag_logs_ipsec.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/usr/local/www/diag_logs_ipsec.php b/usr/local/www/diag_logs_ipsec.php index 560cd1aa43..d196b30f27 100755 --- a/usr/local/www/diag_logs_ipsec.php +++ b/usr/local/www/diag_logs_ipsec.php @@ -56,13 +56,17 @@ if(is_array($config['ipsec']['phase1'])) $gateway = ipsec_get_phase1_dst($ph1ent); if(!is_ipaddr($gateway)) continue; - $search[] = "/(racoon: )([A-Z:].*?)({$gateway}\[[0-9].+\]|{$gateway})(.*)/i"; + $search[] = "/(racoon: )(INFO[:].*?)({$gateway}\[[0-9].+\]|{$gateway})(.*)/i"; + $search[] = "/(racoon: )(\[{$gateway}\]|{$gateway})(.*)/i"; + $replace[] = "$1[{$ph1ent['descr']}]: $2$3$4"; $replace[] = "$1[{$ph1ent['descr']}]: $2$3$4"; } /* collect all our own ip addresses */ -exec("/sbin/ifconfig | /usr/bin/awk '/inet / {print $2}'", $ip_address_list); +exec("/sbin/ifconfig | /usr/bin/awk '/inet/ {print $2}'", $ip_address_list); foreach($ip_address_list as $address) { - $search[] = "/(racoon: )([A-Z:].*?)({$address}\[[0-9].+\])(.*isakmp.*)/i"; + $search[] = "/(racoon: )(INFO[:].*?)({$address}\[[0-9].+\])/i"; + $search[] = "/(racoon: )(\[{$address}\]|{$address})(.*)/i"; + $replace[] = "$1[Self]: $2$3$4"; $replace[] = "$1[Self]: $2$3$4"; } From 80c1e99fb100bf79f74a22d66a04e6fec079c35f Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 16 Mar 2011 13:18:06 +0100 Subject: [PATCH 138/225] Correct ping hosts functionality for > 1 tunnel. Add v6 functionality --- etc/inc/vpn.inc | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index ccddb80038..f6557b556c 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -137,6 +137,7 @@ function vpn_ipsec_configure($ipchg = false) if (is_array($a_phase1) && count($a_phase1)) { /* step through each phase1 entry */ + $ipsecpinghosts = ""; foreach ($a_phase1 as $ph1ent) { if (isset($ph1ent['disabled'])) continue; @@ -171,7 +172,6 @@ function vpn_ipsec_configure($ipchg = false) $rgmap[$ph1ent['remote-gateway']] = $rg; /* step through each phase2 entry */ - $ipsecpinghosts = ""; foreach ($a_phase2 as $ph2ent) { $ikeid = $ph2ent['ikeid']; @@ -182,19 +182,24 @@ function vpn_ipsec_configure($ipchg = false) if ($ikeid != $ph1ent['ikeid']) continue; + $ph2ent['localid']['mode'] = $ph2ent['mode']; /* add an ipsec pinghosts entry */ if ($ph2ent['pinghost']) { $iflist = get_configured_interface_list(); foreach ($iflist as $ifent => $ifname) { - if(is_ipaddrv6($ph1ent['src'])) { + if(is_ipaddrv6($ph2ent['pinghost'])) { $interface_ip = get_interface_ipv6($ifent); - $local_subnetv6 = ipsec_idinfo_to_cidr($ph2ent['localid'], true); - if (ip_in_subnetv6($interface_ip, $local_subnet)) { + if(!is_ipaddrv6($interface_ip)) + continue; + $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true); + if (ip_in_subnet($interface_ip, $local_subnet)) { $srcip = $interface_ip; break; } } else { $interface_ip = get_interface_ip($ifent); + if(!is_ipaddrv4($interface_ip)) + continue; $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true); if (ip_in_subnet($interface_ip, $local_subnet)) { $srcip = $interface_ip; @@ -203,20 +208,17 @@ function vpn_ipsec_configure($ipchg = false) } } $dstip = $ph2ent['pinghost']; - if(is_ipaddrv6($srcip)) { + if(is_ipaddrv6($dstip)) { $family = "inet6"; } else { $family = "inet"; } if (is_ipaddr($srcip)) - $ipsecpinghosts .= "{$srcip}|{$dstip}|3|{$family}\n"; + $ipsecpinghosts[] = "{$srcip}|{$dstip}|3|{$family}|\n"; + } } - $pfd = fopen("{$g['vardb_path']}/ipsecpinghosts", "w"); - if ($pfd) { - fwrite($pfd, $ipsecpinghosts); - fclose($pfd); - } + file_put_contents("{$g['vardb_path']}/ipsecpinghosts", $ipsecpinghosts); } } From 840d845fdac96ec4284a06ca3152e534b33bfc7e Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 16 Mar 2011 13:19:19 +0100 Subject: [PATCH 139/225] Add more helpful logging --- usr/local/www/diag_logs_ipsec.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/usr/local/www/diag_logs_ipsec.php b/usr/local/www/diag_logs_ipsec.php index d196b30f27..9ed65a5224 100755 --- a/usr/local/www/diag_logs_ipsec.php +++ b/usr/local/www/diag_logs_ipsec.php @@ -70,6 +70,15 @@ foreach($ip_address_list as $address) { $replace[] = "$1[Self]: $2$3$4"; } +$search[] = "/(time up waiting for phase1)/i"; +$search[] = "/(failed to pre-process ph1 packet)/i"; +$search[] = "/(failed to pre-process ph2 packet)/i"; +$search[] = "/(no proposal chosen)/i"; +$replace[] = "$1 [Remote Side not responding]"; +$replace[] = "$1 [Check Phase 1 settings, lifetime, algorithm]"; +$replace[] = "$1 [Check Phase 2 settings, networks]"; +$replace[] = "$1 [Check Phase 2 settings, algorithm]"; + $nentries = $config['syslog']['nentries']; if (!$nentries) $nentries = 50; From e3e85044d1889a95c4d4a7245b09ca7b80512894 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 16 Mar 2011 13:26:46 +0100 Subject: [PATCH 140/225] Add field 8 for address family --- usr/local/bin/ping_hosts.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/usr/local/bin/ping_hosts.sh b/usr/local/bin/ping_hosts.sh index 97629c45de..19a6161905 100755 --- a/usr/local/bin/ping_hosts.sh +++ b/usr/local/bin/ping_hosts.sh @@ -13,6 +13,7 @@ # Field 5: Script to run once service is restored # Field 6: Ping time threshold # Field 7: Wan ping time threshold +# Field 8: Address family # Read in ipsec ping hosts and check the CARP status if [ -f /var/db/ipsecpinghosts ]; then @@ -66,9 +67,15 @@ for TOPING in $PINGHOSTS ; do SERVICERESTOREDSCRIPT=`echo $TOPING | cut -d"|" -f5` THRESHOLD=`echo $TOPING | cut -d"|" -f6` WANTHRESHOLD=`echo $TOPING | cut -d"|" -f7` + AF=`echo $TOPING | cut -d"|" -f8` + if [ "$AF" == "inet" ]; then + PINGCMD=ping + else + PINGCMD=ping6 + fi echo Processing $DSTIP # Look for a service being down - ping -c $COUNT -S $SRCIP $DSTIP + $PINGCMD -c $COUNT -S $SRCIP $DSTIP if [ $? -eq 0 ]; then # Host is up # Read in previous status @@ -97,7 +104,7 @@ for TOPING in $PINGHOSTS ; do fi echo "Checking ping time $DSTIP" # Look at ping values themselves - PINGTIME=`ping -c 1 -S $SRCIP $DSTIP | awk '{ print $7 }' | grep time | cut -d "=" -f2` + PINGTIME=`$PINGCMD -c 1 -S $SRCIP $DSTIP | awk '{ print $7 }' | grep time | cut -d "=" -f2` echo "Ping returned $?" echo $PINGTIME > /var/db/pingmsstatus/$DSTIP if [ "$THRESHOLD" != "" ]; then From aff70640bfe35f14176b6134359f05d565c83511 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Wed, 16 Mar 2011 13:28:39 +0100 Subject: [PATCH 141/225] Swap if statement, add fields into ipsecpinghosts file --- etc/inc/vpn.inc | 2 +- usr/local/bin/ping_hosts.sh | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index f6557b556c..c40c472853 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -214,7 +214,7 @@ function vpn_ipsec_configure($ipchg = false) $family = "inet"; } if (is_ipaddr($srcip)) - $ipsecpinghosts[] = "{$srcip}|{$dstip}|3|{$family}|\n"; + $ipsecpinghosts[] = "{$srcip}|{$dstip}|3|||||{$family}|\n"; } } diff --git a/usr/local/bin/ping_hosts.sh b/usr/local/bin/ping_hosts.sh index 19a6161905..c0de5a15fc 100755 --- a/usr/local/bin/ping_hosts.sh +++ b/usr/local/bin/ping_hosts.sh @@ -68,10 +68,10 @@ for TOPING in $PINGHOSTS ; do THRESHOLD=`echo $TOPING | cut -d"|" -f6` WANTHRESHOLD=`echo $TOPING | cut -d"|" -f7` AF=`echo $TOPING | cut -d"|" -f8` - if [ "$AF" == "inet" ]; then - PINGCMD=ping - else + if [ "$AF" == "inet6" ]; then PINGCMD=ping6 + else + PINGCMD=ping fi echo Processing $DSTIP # Look for a service being down From 8a3b09efccdced78db90eefba0ce208c0927bf36 Mon Sep 17 00:00:00 2001 From: Seth Mos Date: Thu, 17 Mar 2011 11:59:38 +0100 Subject: [PATCH 142/225] Comment out static mappings, this needs more research --- etc/inc/services.inc | 5 ++++- usr/local/www/services_dhcpv6.php | 30 +++++++++++++------------- usr/local/www/services_dhcpv6_edit.php | 6 +++--- 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/etc/inc/services.inc b/etc/inc/services.inc index 3e22efb144..873b06f32c 100644 --- a/etc/inc/services.inc +++ b/etc/inc/services.inc @@ -668,6 +668,9 @@ EOD; EOD; /* add static mappings */ + /* Does not work for IPv6 + /* You can not use a hardware parameter for DHCPv6 hosts + /* Needs to be figured out if (is_array($dhcpv6ifconf['staticmap'])) { $i = 0; @@ -692,7 +695,7 @@ EOD; $i++; } } - + */ $realif = escapeshellcmd(get_real_interface($dhcpv6if)); $dhcpdv6ifs[] = $realif; diff --git a/usr/local/www/services_dhcpv6.php b/usr/local/www/services_dhcpv6.php index 2c7f6bfaa6..7d00b0c761 100644 --- a/usr/local/www/services_dhcpv6.php +++ b/usr/local/www/services_dhcpv6.php @@ -577,8 +577,8 @@ include("head.inc");
- -    + +   
-
-
+
+
-
+
-
+
-
+
-
+
- +
- +
Netboot filename - +
Name of the file that should be loaded when this host boots off of the network, overrides setting on main page.
   + /
Range:   + - - +
- + /
- + diff --git a/usr/local/www/vpn_ipsec_phase1.php b/usr/local/www/vpn_ipsec_phase1.php index c537f9f28e..edfc36b336 100644 --- a/usr/local/www/vpn_ipsec_phase1.php +++ b/usr/local/www/vpn_ipsec_phase1.php @@ -556,7 +556,7 @@ function dpdchkbox_change() {
- +
   - + / :   - + /
- +
- "> + ">
  "> " onclick="history.back()"> - +