mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
24,092 Commits 27 Branches 53 Tags 494 MiB
24516832ea
Commit Graph

12623 Commits

Author SHA1 Message Date
Chris Buechler
1ae41bfe84 Kill states associated with the old WAN IP when WAN IP has changed. Retain 
hidden config option to wipe all states on IP change, as there seemed to
be circumstances where the 'pfctl -k $oldip' didn't suffice for others
(much of history in redmine ticket, some on forum and elsewhere). ticket
 2014-10-30 16:37:14 -05:00
Ermal
737b18f23b Allow accept_unencrypted_mainmode_messages to be enabled if needed 2014-10-30 21:35:51 +01:00
Chris Buechler
461eac099b only kill all states if the IP changed. ticket #1629 2014-10-30 13:15:41 -05:00
Chris Buechler
5274102ea4 Hide burst for limiters, since it doesn't do anything. more details in 
ticket #3933
 2014-10-29 15:39:15 -05:00
Chris Buechler
002d286c9c fix up text 2014-10-29 01:08:03 -05:00
Chris Buechler
eea2ad5d61 FreeBSD fails to set advskew back to 0 after you set it to any other 
value. That's a separate issue that needs fixing upstream, but in the mean
time, we can work around it by removing all CARP VIPs in the same way we
do when "Temporarily Disable CARP" is chosen before adding them all back.
Ticket #3910
 2014-10-28 16:33:09 -05:00
Chris Buechler
569e2fdfac Add option to kill all states on IP change, currently a hidden option for more testing. ticket #1629 2014-10-28 13:31:51 -05:00
Renato Botelho
0a8dd27b5f Remove redundancy as pointed out by phil-davis 2014-10-28 14:55:07 -02:00
Renato Botelho
7c1997914f Merge pull request #1297 from phil-davis/patch-23 2014-10-28 14:26:51 -02:00
Renato Botelho
143c22f771 Decode recently created cert and key. It fixes #3964. While here, fix logical condition to create a new cert if crt or key is not present 2014-10-28 10:17:16 -02:00
Chris Buechler
e8b5f72496 domain and search should not both be defined in resolv.conf per FreeBSD man page and handbook (only the latter is actually used). Change this to just not use domain, and set the search to the system's domain where not using the function that generates the search list for dynamic WANs. 2014-10-25 22:11:45 -05:00
Ermal
23ed5b7871 Enable unity plugin as per request from https://forum.pfsense.org/index.php?topic=79737.msg452808#msg452808 2014-10-24 19:18:15 +02:00
Phil Davis
bb67ac32bc Support converting an IP range to an array of addresses 
so that it can be used for expanding ranges in host alias input.
 2014-10-24 20:17:04 +05:45
Renato Botelho
095707fe9e Merge pull request #1313 from phil-davis/patch-9 2014-10-23 12:24:58 -02:00
Chris Buechler
687d0a6d05 remove the command number shown in the shell prompt, it's a pointless 
waste of screen space
 2014-10-21 12:46:38 -05:00
Phil Davis
99ba943ad4 Prevent Internal Server Error if range is backwards 
Fixes redmine #3950 - ip_range_to_subnet_array can easily swap the input parameters if the caller has passed/entered them the wrong way around. That is both friendly to the caller and ensures that a hostile caller can't blow up the routine.
This patch is for master (2.2)
 2014-10-21 15:17:17 +05:45
Chris Buechler
2fb6694858 hostnames can end with a . (and actually always do, it's just usually implied), so allow that here. Fixes wrong input validation in parts of nsupdate GUI, among other things. 2014-10-21 00:40:22 -05:00
Renato Botelho
a23adfbaa0 Merge pull request #1306 from phil-davis/patch-3 2014-10-20 12:00:54 -05:00
Renato Botelho
6d9514581a Let user decide if he wants to proceed to the upgrade when sha256 fails to download. Fixes #3576 2014-10-20 10:41:12 -05:00
Chris Buechler
bc12ae8a7b Underscores are valid characters in domains. Fixes #3219 2014-10-19 18:38:13 -05:00
Ermal
621fed0e0f Ticket #3932 For more than 100 entries create pipes in line with the rules file to speedup the process 2014-10-18 01:33:42 +02:00
jim-p
b6dbbebc0f Add command line script to generate and activate a new GUI certificate. 2014-10-15 14:01:55 -04:00
jim-p
2cf2c62b27 Fix descriptions and cn on generated GUI cert to be consistent. 2014-10-15 14:01:00 -04:00
Ermal
2f5488df44 Reintroduce the vfs.forcesync systl 2014-10-15 16:23:29 +02:00
Renato Botelho
29fb23d449 Merge pull request #1309 from phil-davis/patch-5 2014-10-15 08:49:48 -05:00
jim-p
5ff7f58e59 Tame the poodle. Disable SSLv3. 2014-10-15 08:40:36 -04:00
Phil Davis
5d49ceac8b Fix #3935 Properly allow WAN without LAN 
Was broken by bd0b5d2dc7
 2014-10-15 10:04:57 +05:45
Ermal
8ff85c397c rename interfaces_carp_setup to interfaces_sync_setup and call it during bootup since it does not only relate to carp interfaces. 2014-10-15 01:39:56 +02:00
Ermal
664adf3845 Ticket #3789. Put a start at using the proxyurl/proxyport from system configured settings for bogons. It still does not consider the user/pass configured 2014-10-15 00:55:00 +02:00
Ermal
e02ea742a5 Fixes #3213. Allow up to 2900 limiters. This was set to 30 since limiters are to be controlled by mask and not created manually! 2014-10-15 00:36:27 +02:00
Ermal
febe0112e1 Make proper check here 2014-10-14 23:21:50 +02:00
jim-p
7c4c77ee62 Teach the certificate generation code how to make a self-signed certificate, and change the GUI cert generation code to use it. Also, move the GUI cert generation code to its own function so we can add a GUI option to regenerate it later. 
Also use some more sane defaults for the contents of the default self-signed certificate's fields so it will be more unique and less likely to trigger problems in browser certificate storage handling.
 2014-10-14 15:30:33 -04:00
Chris Buechler
1f4ad8f4cf update comment to reflect breakage caused here and reference associated redmine ticket, not high priority, can be fixed later 2014-10-14 13:44:56 -05:00
Chris Buechler
eb71461cc0 block IPv4 link-local. Per RFC 3927, hosts "MUST NOT send the packet to 
any router for forwarding", and "any network device receiving such a
packet MUST NOT forward it". FreeBSD won't route it (route-to can override in
some circumstances), so it can't be in use as a real network anywhere with
the possible exception of local-only networks. Unlikely any such situation
exists anywhere.
Fixes ticket #2073
 2014-10-14 13:21:45 -05:00
Renato Botelho
5a42d9ef42 Fix initial console menu layout, it fixes #3884 2014-10-14 12:23:01 -05:00
Renato Botelho
71c26c2220 Properly set MTU for lagg interface, it fixes #3922 2014-10-13 12:36:55 -05:00
Chris Buechler
b22f436afb s/removing/omitting/g for gateway monitor log entires. "Removing" is not necessarily correct, there are many circumstances where this runs where it wasn't there to begin with, and is potentially misleading. 2014-10-10 19:09:57 -05:00
Renato Botelho
1f237bb460 Fix pf syntax s/divert/divert-to/. It should fix #3921 2014-10-10 11:17:52 -03:00
Renato Botelho
9da083fc4d Fix an error introduced in bd0b5d2dc7 that makes system believe interfaces always mismatch 2014-10-08 08:54:38 -03:00
Chris Buechler
bd0b5d2dc7 Remove the minimum NIC warning, this dates back to when minimum 2 NICs were supported and it made sense to throw this message at people. It's obvious a network appliance requires at least one NIC. 2014-10-07 23:33:55 -05:00
Ermal
b4bd9c56c1 Update the URL for snapshots update 2014-10-07 20:17:14 +02:00
Renato Botelho
86ce2df7fd Be more strict when checking if olsrd is enabled, otherwise when package is deinstalled and configuration is kept dhcpd will consider it's always as enabled 2014-10-07 14:44:54 -03:00
Phil Davis
8cbb140a5c Support up to 4 DNS Servers in DHCP 2014-10-07 07:37:44 +05:45
Ermal
a3cc8dcc60 Add an option to restart php-fpm from console 2014-10-06 18:05:50 +02:00
Ermal
2d5fd3c23c Remove function that is not implemented properly. Nothing seems to use it. 2014-10-06 08:22:10 +00:00
Ermal
4aa7f542a3 Merge pull request #1303 from PiBa-NL/carp_without_matching_subnet 2014-10-06 08:21:24 +00:00
Ermal
042f0d12b3 Merge pull request #1304 from sselph/powerd_normal_mode 2014-10-06 08:16:46 +00:00
Phil Davis
fb0a4e7a0e Fix not rules for OPTn network case 
Reported in forum https://forum.pfsense.org/index.php?topic=82319.0
The "if (is_subnet($src)) ... filter_address_add_vips_subnets" code needs to go outside all of the if that checks for opt interfaces (not just in the else part). That makes filter_address_add_vips_subnets get called in all cases, including when optn network is specified. (line 2264, 2265)
Then filter_address_add_vips_subnets needs to process the "not" code early, before checking if there are any VIPs (which was causing the routine to exit early in simple cases) - lines 2093-2100 chunk. This should also fix cases of using "LANnet", "WANnet" and "not" in rules on an interface that has just a plain address (no VIPs).
Lines 2144 and 2158 are no functional change. The formatting of the multi-line statement was odd, so I put it back all on 1 line.
 2014-10-06 10:33:10 +05:45
Steven Selph
3d77cc359f Add powerd normal mode flag (-n) 2014-10-05 18:35:08 -04:00
Renato Botelho
4665dbdd51 Make proper check if IP address is configured on another interfaces and ignore current one. It fixes #3807 2014-10-03 12:15:44 -03:00