Commit Graph

13511 Commits

Author SHA1 Message Date
Renato Botelho
ca052b35b1 Initialize $stop_time inside foreach to make sure it resets to proper value each iteration since it's changed inside loop. Reported on https://github.com/pfsense/pfsense/pull/2487 2016-01-20 15:22:00 -02:00
Renato Botelho
b5b8f1117b Bump version to 2.2.7-DEVELOPMENT 2016-01-19 12:48:08 -02:00
Chris Buechler
fdc515af33 Update URL for dyns to match their current docs. Reported by GP^ on IRC 2016-01-11 16:25:58 -06:00
jim-p
392796a461 Encode parameters in shaper queues before display. 2015-12-21 15:37:25 -05:00
jim-p
4fa888b46c Encode hostname before printing; remove some related dead code. 2015-12-21 10:15:30 -05:00
Chris Buechler
d59733f55e bump to 2.2.6-RELEASE 2015-12-18 18:27:47 -06:00
Chris Buechler
07917f7df5 Flush zone's tables if its db must be reset to avoid leaving behind any table entries. Ticket #5622 2015-12-17 18:59:08 -06:00
Chris Buechler
7c4b3b2060 Add busytimeout of 60 seconds for CP database access. This matches the default value PHP uses with sqlite 2.x versions (pfSense 2.1.x and earlier) and prevents the issues noted in Ticket #5622 2015-12-17 16:17:59 -06:00
Chris Buechler
1eb6993723 add these three strongswan libs to the obsoletedfiles list. They haven't been included in any releases, but were briefly included in snapshots in mid April 2015. 2015-12-16 23:21:26 -06:00
jim-p
012e80df44 Fix handling of 0-byte files uploaded to the CP file manager. 2015-12-15 15:12:25 -05:00
Renato Botelho
919916d426 Merge pull request #2213 from PiBa-NL/pferrormessage-22 2015-12-14 08:03:07 -02:00
PiBa-NL
55752439f4 fix showing when a error happens parsing pf rules
For example a queue interface speed mismatch could go unnoticed.

backport from 2.3 of #2165
2015-12-12 19:14:52 +01:00
Renato Botelho
c33fd4cc00 Fix typo, gateway entry in config has a field called monitor, not monitorip 2015-12-11 11:06:26 -02:00
Renato Botelho
03fff067bc Merge pull request #2162 from phil-davis/patch-1 2015-12-07 13:24:49 -02:00
Phil Davis
6ae579b560 Redmine #4279 Package reinstall displayed when shutting down before upgrade
Use a different flag file to indicate that a package reinstall is
required after a reboot is done first. This avoids the possibility that
the user navigates in the webGUI during the time while the shutdown is
in progress and is accidentally presented with the reinstall all
packages GUI button.
Early in rc.bootup switch the flag file to use its ordinary name, so
that all subsequent code in boot scripts and webGUI will work as it
already does to handle the package reinstall and notifying the user that
a package reinstall is about to be done or in progress...
2015-12-07 11:14:16 +05:45
Phil Davis
026e2441bb Fix duplicate syslog messages - Redmine #5606 for RELENG_2_2
The generated syslog.conf needs to have the system.log selections combined into a single line in 2 places. The OP on redmine 5606 just showed 1 place in the diff there.
On my system, this gets rid of the duplicated message on login:
php-fpm[11074]: /index.php: Successful login for user 'my.name' from: 10.11.12.13

Note: for some reason old line 848 includes local4.none - but local4.none does not appear in old line 864. What is that about? Is that another different bug?
I did not mess with that, but I noticed that the OPs diff listing did also add in local4.none where it seems to be missing.
2015-12-06 22:58:31 +05:45
jim-p
2bfa7dbfb4 Include ipsec.inc here otherwise the global is undefined when called when restoring a config in the GUI. 2015-12-04 15:39:43 -05:00
Chris Buechler
43180e9c49 Sanitize the session_id/logout_id in captive portal. 2015-12-02 18:22:55 -06:00
Phil Davis
baa4325b0c Backport #5512 RADIUS secret
Another little easy thing to backport just in case.
2015-11-23 21:56:04 +05:45
Renato Botelho
da6e3b6447 Merge pull request #2014 from phil-davis/patch-1 2015-11-19 07:42:37 -02:00
Renato Botelho
fa49ec387e Merge pull request #2069 from jean-m-cyr/RELENG_2_2 2015-11-19 07:26:51 -02:00
Jean Cyr
f6fb637223 Add missing stratum parameter
Add missing stratum parameter  in ntpd.conf when specified on Serial GPS
page.
2015-11-15 22:36:36 -05:00
Phil Davis
f2220c6848 Ticket #5451 for RELENG_2_2
Actually this can be fixed by adding just a space after "from any".
The code here builds up $tmprule and each time it adds a new clause it puts a space at the end, ready for if there is another clause to come. The "from any" here was the only offender in this scheme.
It seems good to me to still backport little easy fixes to RELENG_2_2. That way production users can get them easily if they like (with system patches or...).
2015-11-15 17:00:50 +05:45
Renato Botelho
eb836ace21 Change version to 2.2.6-DEVELOPMENT 2015-11-06 12:41:35 -02:00
Renato Botelho
de0ecc0e07 A new fix for #4130:
The fix added for this bug, that check xml file size is < 200 to decide
if file must or not be read created a new issue, single entry is not
showed.

Instead of doing this, check parse_xml_config() return and return empty
array when it's -1

While here, prevent errors saying parse_xml_config() doesn't exist and
make sure xmlparse.inc is required
2015-11-03 17:54:57 -02:00
Renato Botelho
d6d9144e20 Only call pfSense_ipsec_list_sa() when IPsec is enabled 2015-11-03 16:58:58 -02:00
Chris Buechler
b31b713d68 bump to 2.2.5-RELEASE 2015-11-02 21:01:39 -06:00
Chris Buechler
f2fcc67c9f fix whitespace 2015-11-02 17:37:12 -06:00
Phil Davis
5196767911 Fix firewall log dynamic rule lookup
for rows that are dynamically added as time goes by.
2015-11-02 21:06:48 +05:45
Renato Botelho
2bd69a578a Deprecate strongswan smp components 2015-10-30 16:11:12 -02:00
Renato Botelho
93277f2c87 Remove ipsec_smp_dump_status(), last dependency of strongswan XMP module 2015-10-30 16:03:57 -02:00
jim-p
50de9fa885 Set leftsendcert=always for IKEv2 configurations with certificates to better accommodate OS X and iOS manual configurations. Fixes #5353 2015-10-28 13:49:24 -04:00
Chris Buechler
52005a0642 fix logging config upgrade. Ticket #5340 2015-10-26 15:41:36 -05:00
Chris Buechler
42ef62a45e terminate argument parsing before giving the log level. Ticket #5340 2015-10-26 14:30:38 -05:00
Chris Buechler
5d6dde8af7 Use 1-6 rather than 0-5 for IPsec logging levels, to stay away from complications of 0 due to PHP stupidity. Upgrade config to add 1 to any configured log levels. Default to 1 as log level where none is configured by the user. Ticket #5340 2015-10-26 00:23:37 -05:00
Chris Buechler
add49a3a21 IKE auto mode is back, remove this config upgrade code unsetting it. 2015-10-24 01:46:01 -05:00
Chris Buechler
d7f5b68ab3 Check unbound root.key file contents, and remove it if invalid, before unbound-anchor runs otherwise it will fail and unbound will fail to start. fsync the file after writing to prevent the problem. Ticket #5334 2015-10-21 19:54:10 -05:00
Matt Smith
f3ee8205e6 Make setting charon.plugins.attr.subnet conditional on net_list being set. Set
it's value to list of subnets configured as P2's for mobile IPsec. Fixes #5327.
2015-10-21 08:34:47 -05:00
Chris Buechler
cce44072c4 Disable strongswan logging under auth since it's all logged under daemon,
so nothing is duplicated. Ticket #5242
2015-10-20 16:08:11 -05:00
Chris Buechler
4f1bf9029c Check whether the P2 or its associated P1 are disabled before adding NAT
rules. Ticket #5320
2015-10-20 12:56:07 -05:00
Luiz Otavio O Souza
d1e172a96b Disable zero copy buffers in bpf.
This was a no-op before my changes (so this was never really enabled) and
now it is known to cause issues with tcpdump and hostapd.

Disable this until we fix all the raised issues.

Issue:		#5257
2015-10-19 16:41:27 -05:00
Luiz Otavio O Souza
28c54319ca Cherry-pick 98bf4991dc:
Fixes #4150. Move to tables to accomodate unlimited number of interfaces.

Cherry-pick 52fe0465b463dd8b8f4b2099d562254da320e704:

Fix the captive portal rules after 98bf4991dc.

The malformed rules breaks the parsing of initialisation rules.

Issue:          #4746
2015-10-19 10:06:07 -05:00
Matt Smith
c9c3104700 Add 'caref' attribute to the ca object passed into ca_inter_create so a
relationship to the signing CA can be maintained. Fixes #5313.
2015-10-16 08:54:10 -05:00
Matt Smith
c345288bf1 Limit strongswan trusted CA certificates to those required for authentication of
the configured IPsec SA's instead of trusting all known CA's. Fixes #5243.
2015-10-16 08:32:53 -05:00
Chris Buechler
6d134679cf only use daemon and not auth for strongswan logging. As it was, all logs were duplicated. Ticket #5242 2015-10-15 15:19:13 -05:00
Chris Buechler
1f290d6244 fix comparison here. Ticket #4558 2015-10-15 11:54:44 -05:00
Matt Smith
cd4aa77ca3 Set rightca for IPsec phase 1 using Mutual RSA, Mutual RSA + xauth, or EAP-TLS. Fixes #5241. 2015-10-15 10:32:29 -05:00
Renato Botelho
b7e3ab94e2 s/ip/IP/ it got lost on revert. Spotted by @phil-davis 2015-10-14 09:36:47 -03:00
Chris Buechler
71afb77560 This is necessary for dhcrelay to function. Revert "remove the destination server's interface(s) from dhcrelay"
This reverts commit 97613114b5.
2015-10-14 02:06:32 -05:00
Chris Buechler
5944736981 Auto-add firewall rules for DHCP Relay, same as is done for DHCP Server. Add filter reload to DHCP Relay config so rules are immediately added/removed. Ticket #4558 2015-10-14 01:25:22 -05:00