mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
25,884 Commits 27 Branches 53 Tags 494 MiB
ac565fab92
Commit Graph

25884 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris Buechler
ac565fab92 remove wrap and net4501 platforms, they haven't existed for years. 2015-07-29 23:01:59 -05:00
jim-p
4379f31869 Check both greater and less than for the configuration version in XMLRPC sync. Fixes #4902 2015-07-29 15:50:52 -04:00
jim-p
6538d22fcb Use an alternate method to find VIP targets that should be allowed for Captive Portal. Fixes #4903 2015-07-29 14:40:52 -04:00
jim-p
83a05b663a Add "sockstat" output to status.php 2015-07-29 11:40:38 -04:00
Renato Botelho
31e66b412d Move cleargpt.sh and cleargmirror.sh scripts to main repo 2015-07-27 17:05:05 -03:00
Renato Botelho
f8948f8637 Merge pull request #1797 from phil-davis/patch-10 2015-07-27 14:53:22 -03:00
Renato Botelho
626ed2abdd Fix typo in variable name, spotted by Phil Davis 2015-07-27 14:51:17 -03:00
Phil Davis
2b869fa154 Strip any \r when parsing URL table ports file 
If the URL table ports file at the URL specified has lines separated by "\r\n" rather than just "\n", then the code here ends up with ports that look like "80\r" "443\r" ... and group_ports() does not match any of those and the final file ends up empty. That seems a shame just because the file was made in some editor that put "\r\n" line breaks. I messed about for a while trying to make my URL table ports alias work until I realized this.
This change first strips out any "\r" from the string, thus making it work with files that have either pure "\n" line breaks or "\r\n" line breaks.
 2015-07-27 23:36:03 +05:45
Phil Davis
8e24ffdd7a Consider url_port alias type when checking port-type aliases V2 
This time I have typed url_ports correctly.
 2015-07-27 14:47:25 -03:00
Chris Buechler
2da055f086 add a check to avoid foreach on non-array 2015-07-27 01:57:58 -05:00
Chris Buechler
a34e980753 Bring back the ability to specify file and URL as command line arguments. Clean it up a bit. 2015-07-26 03:20:44 -05:00
Chris Buechler
8691632cf7 Upgrade config to 11.9. Changes IPsec peer ID for EAP types to "any", to retain previous behavior. 
Conflicts:
	etc/inc/upgrade_config.inc
 2015-07-25 19:51:19 -05:00
Chris Buechler
905205a2a7 Change the log for CRLs with no data (exists but no certs revoked) to a warning since it's not technically an error. 2015-07-25 19:45:15 -05:00
Chris Buechler
b099481141 Add 'any' option for peer ID, for mobile IPsec scenarios where you can't or don't want to check peer ID. 
Conflicts:
	usr/local/www/vpn_ipsec_phase1.php
 2015-07-25 17:00:57 -05:00
Chris Buechler
f674922ee9 Lower LoginGraceTime to 30s, should be plenty long for users, and mitigates the password login attempt bypass bug in OpenSSH. Ticket #4875 2015-07-23 23:09:35 -05:00
Chris Buechler
021a97b58a Only omit rightid for PSK mobile types. Flip the logic here as the 2_1 ! 
logic gets ugly.
 2015-07-23 18:17:32 -05:00
Chris Buechler
bdd9efb37f change iketype auto to ikev2 on upgrade. Ticket #4873 2015-07-23 15:03:29 -05:00
Chris Buechler
4d7568404c Remove "auto", it's just a synonym for IKEv2. Ticket #4873 
Conflicts:
	usr/local/www/vpn_ipsec_phase1.php
 2015-07-23 14:47:56 -05:00
Chris Buechler
0dea741f39 include vpn.inc so IPsec CRL reload works. require_once filter.inc in 
vpn.inc for callers there that haven't already included it.
 2015-07-23 14:31:05 -05:00
Renato Botelho
0dd333945e Obsolete device.hints_wrap, it's not being used 2015-07-23 15:21:27 -03:00
Renato Botelho
2c9d970a71 Move mfs related rc.d scripts from tools to main repo 2015-07-23 09:58:34 -03:00
Renato Botelho
b42ee10079 Obsolete /etc/rc.d/uzip and stop using it 2015-07-23 09:54:14 -03:00
Chris Buechler
d55f6326c4 Most of the flowtable bits were removed some time ago, take out the last of them too. 2015-07-23 00:34:14 -05:00
Chris Buechler
6141f51ac4 When a CRL is updated, refresh strongswan's CRLs. 2015-07-23 00:21:23 -05:00
Chris Buechler
1d3c9c9f3b Merge pull request #1778 from phil-davis/patch-1 2015-07-22 21:57:35 -05:00
Phil Davis
a95acf1210 Add isset check for strictcrlpolicy 
To be consistent with the checks in the rest of this code.
 2015-07-23 06:39:27 +05:45
Chris Buechler
699e20745b make the IPsec bypass LAN from LAN subnet to LAN subnet rather than from 
LAN subnet to LAN IP. Same end result except it'll work for VIPs on same
interface now.
 2015-07-22 15:08:58 -05:00
Chris Buechler
df4de32d34 Add IPsec advanced option for strict CRL checking 2015-07-22 15:03:56 -05:00
Chris Buechler
0be67fe5fe fix typo 2015-07-22 13:31:41 -05:00
Chris Buechler
3453cbfc6c Merge pull request #1777 from phil-davis/patch-1 2015-07-22 13:22:22 -05:00
Chris Buechler
14ec7c4bf8 write out built-in CRLs for strongswan 2015-07-22 13:06:17 -05:00
Phil Davis
a607968ab4 Handle IPsec Advanced Settings save before IPsec is enabled 
If the Advanced Settings are saved before any other IPsec is set up then $config['ipsec'] can be just the empty string. As a result you can get:
a) If you select some debug settings then those are not saved. The code to save those settings was only executed when $config['ipsec'] was already an array. Actually the code already did the necessary "if isset() then unset()" stuuf. So I just took the the "if is_array()" away from the code block.

b) Some potential unset() can go wrong with errors like:
Fatal error: Cannot unset string offsets in /usr/local/www/vpn_ipsec_settings.php on line 168
This is corrected by adding more "if (isset())" checks.

Fixes Redmine #4865
 2015-07-22 19:36:09 +05:45
Chris Buechler
fcb477c057 Merge pull request #1774 from phil-davis/interfaces-widget 2015-07-21 23:54:29 -05:00
Phil Davis
9cbdb6e3c3 Interfaces widget use more obscure separator 
when acquiring the interface data. In particular the media information
can have commas in it already as reported in Redmine bug #4859
 2015-07-22 09:36:27 +05:45
Chris Buechler
909d9ec10b Merge pull request #1770 from phil-davis/patch-1 2015-07-21 19:25:20 -05:00
Phil Davis
564f135646 Unset old CA and Cert in left system config 
Unset any old CA and Cert in the system section that might still be there from when upgrade_066_to_067 did not unset them. That will tidy up old configs that had the conversion done originally but these old sections were left behind.
 2015-07-21 23:50:44 +05:45
Renato Botelho
0ec6cc2900 Merge pull request #1771 from phil-davis/patch-2 2015-07-21 13:50:03 -03:00
Renato Botelho
cc781c44c8 Merge pull request #1772 from phil-davis/patch-3 2015-07-21 13:41:00 -03:00
Phil Davis
55fae310d0 Captive Portal zoneid upgrade fix var name typo 
With the typo, this empty() test would always have been true. So maybe on upgrade some existing captive portal zoneid values have been getting overwritten by this even number counter? Or?
 2015-07-21 22:12:05 +05:45
Phil Davis
3482335668 Allocate dnpipe and dnqueue numbers even if no filter rules 
It would be quite unusual to have no filter rules array, but if that is indeed the case then the first part of this code that sets dnpipe and dnqueue numbers should execute anyway.
 2015-07-21 21:47:12 +05:45
Phil Davis
661de3e792 Unset old CA and Cert in system config 
This looked odd. Why would we leave behind the old "ca" and "cert" section in $config["system"]?
I guess it would do no harm, but seems confusing for the future to have some unused entries like this remaining in the config.
Should a piece of code be put into the latest upgrade function to clean out these in any current config?
 2015-07-21 21:18:30 +05:45
jim-p
775b46fa4b Add "netstat -ni" to status.php 2015-07-21 08:48:24 -04:00
jim-p
abad402c6b Allow pre-filling (but no automatic action) of the download filename on exec.php. Setup a link to download the status output.tgz in status.php 2015-07-21 08:47:59 -04:00
Chris Buechler
34cd534810 Reverting this for master, needs review in context of uniqid changes. Opening redmine ticket. Revert "sync up rc.carpmaster with RELENG_2_2. Ticket #4854, plus removal of unnecessary loop that'll amplify notifications unnecessarily." 
This reverts commit 401adacfef.
 2015-07-21 00:34:12 -05:00
Chris Buechler
f3dadbb4c6 Going back to prior to earlier commit. Revert "fix indent my editor broke in an earlier commit." 
This reverts commit 948bbc9baf.
 2015-07-21 00:33:51 -05:00
Chris Buechler
948bbc9baf fix indent my editor broke in an earlier commit. 2015-07-21 00:22:03 -05:00
Chris Buechler
66ed8787c4 Add IPsec IKE Intermediate EKU to server certificates. The serverAuth EKU already added suffices for Windows clients, though strongswan docs suggest setting this as well. 2015-07-20 23:50:47 -05:00
Chris Buechler
ed2265217a Specify keyUsage and extendedKeyUsage in openssl.cnf, use crl_ext. 2015-07-20 20:21:33 -05:00
Renato Botelho
c85fe8b1d6 Merge pull request #1764 from doktornotor/patch-2 2015-07-19 07:53:35 -03:00
doktornotor
7b2811fb46 Fix caps 2015-07-18 21:59:49 +02:00