mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
25,554 Commits 27 Branches 53 Tags 494 MiB
d25eda8d75
Commit Graph

13478 Commits

Author SHA1 Message Date
Chris Buechler
42ef62a45e terminate argument parsing before giving the log level. Ticket #5340 2015-10-26 14:30:38 -05:00
Chris Buechler
5d6dde8af7 Use 1-6 rather than 0-5 for IPsec logging levels, to stay away from complications of 0 due to PHP stupidity. Upgrade config to add 1 to any configured log levels. Default to 1 as log level where none is configured by the user. Ticket #5340 2015-10-26 00:23:37 -05:00
Chris Buechler
add49a3a21 IKE auto mode is back, remove this config upgrade code unsetting it. 2015-10-24 01:46:01 -05:00
Chris Buechler
d7f5b68ab3 Check unbound root.key file contents, and remove it if invalid, before unbound-anchor runs otherwise it will fail and unbound will fail to start. fsync the file after writing to prevent the problem. Ticket #5334 2015-10-21 19:54:10 -05:00
Matt Smith
f3ee8205e6 Make setting charon.plugins.attr.subnet conditional on net_list being set. Set 
it's value to list of subnets configured as P2's for mobile IPsec. Fixes #5327.
 2015-10-21 08:34:47 -05:00
Chris Buechler
cce44072c4 Disable strongswan logging under auth since it's all logged under daemon, 
so nothing is duplicated. Ticket #5242
 2015-10-20 16:08:11 -05:00
Chris Buechler
4f1bf9029c Check whether the P2 or its associated P1 are disabled before adding NAT 
rules. Ticket #5320
 2015-10-20 12:56:07 -05:00
Luiz Otavio O Souza
d1e172a96b Disable zero copy buffers in bpf. 
This was a no-op before my changes (so this was never really enabled) and
now it is known to cause issues with tcpdump and hostapd.

Disable this until we fix all the raised issues.

Issue:		#5257
 2015-10-19 16:41:27 -05:00
Luiz Otavio O Souza
28c54319ca Cherry-pick 98bf4991dc: 
Fixes #4150. Move to tables to accomodate unlimited number of interfaces.

Cherry-pick 52fe0465b463dd8b8f4b2099d562254da320e704:

Fix the captive portal rules after 98bf4991dc.

The malformed rules breaks the parsing of initialisation rules.

Issue:          #4746
 2015-10-19 10:06:07 -05:00
Matt Smith
c9c3104700 Add 'caref' attribute to the ca object passed into ca_inter_create so a 
relationship to the signing CA can be maintained. Fixes #5313.
 2015-10-16 08:54:10 -05:00
Matt Smith
c345288bf1 Limit strongswan trusted CA certificates to those required for authentication of 
the configured IPsec SA's instead of trusting all known CA's. Fixes #5243.
 2015-10-16 08:32:53 -05:00
Chris Buechler
6d134679cf only use daemon and not auth for strongswan logging. As it was, all logs were duplicated. Ticket #5242 2015-10-15 15:19:13 -05:00
Chris Buechler
1f290d6244 fix comparison here. Ticket #4558 2015-10-15 11:54:44 -05:00
Matt Smith
cd4aa77ca3 Set rightca for IPsec phase 1 using Mutual RSA, Mutual RSA + xauth, or EAP-TLS. Fixes #5241. 2015-10-15 10:32:29 -05:00
Renato Botelho
b7e3ab94e2 s/ip/IP/ it got lost on revert. Spotted by @phil-davis 2015-10-14 09:36:47 -03:00
Chris Buechler
71afb77560 This is necessary for dhcrelay to function. Revert "remove the destination server's interface(s) from dhcrelay" 
This reverts commit 97613114b5.
 2015-10-14 02:06:32 -05:00
Chris Buechler
5944736981 Auto-add firewall rules for DHCP Relay, same as is done for DHCP Server. Add filter reload to DHCP Relay config so rules are immediately added/removed. Ticket #4558 2015-10-14 01:25:22 -05:00
Chris Buechler
6f4c051cb8 Remove original rightsourceip. Ticket #5284 2015-10-13 21:38:17 -05:00
Renato Botelho
176fee0d31 PHP chmod() doesn't like 1777, gives it 01777 then 2015-10-13 12:08:43 -03:00
Renato Botelho
18be8e81d1 Add missing ; and also mute chmod 2015-10-13 12:02:34 -03:00
Renato Botelho
8aec82088c Preserve /tmp permission, it fixes #5298 2015-10-13 11:34:23 -03:00
Chris Buechler
f248cdc0fe Remove strongswan's cert directories and repopulate them, to ensure no removed CAs, certs, or CRLs remain. Ticket #5238 2015-10-12 22:03:59 -05:00
Chris Buechler
54a5275743 Fix up strongswan logging levels. Remove charondebug since strongswan.conf settings take precedence. Set logging levels in strongswan.conf to match what's set on a running system via 'ipsec stroke loglevel', and remove log levels that were hard coded in strongswan.conf. Ticket #5242 2015-10-12 21:42:02 -05:00
doktornotor
1bdbada63d Add SVG MIME type - RELENG_2_2 
Because it breaks traffic graphs for people.https://forum.pfsense.org/index.php?topic=87390.0
 2015-10-09 10:25:25 +02:00
Chris Buechler
5d0fd04e25 Do curl_init above any curl_setopt, and take it out of that if block since it applies to all types. 2015-10-08 22:36:16 -05:00
Matt Smith
db322752eb https://redmine.pfsense.org/issues/5207 
change auth methods for both peers when using hybrid RSA + xauth with IKEv1
 2015-10-07 15:28:08 -05:00
Matt Smith
5bf321b6dd Add support for an IPv6 pool for mobile clients. 2015-10-07 14:15:54 -05:00
Chris Buechler
23ec30ee67 Where doing a dynamic DNS update on IPv4, force curl to resolve IPv4 IPs. Ticket #3858 2015-10-03 00:07:00 -05:00
Chris Buechler
2cf5f94a6f Fix typo 2015-10-02 01:00:17 -05:00
Chris Buechler
acdcdb2d54 Specify PSK for mobile configurations without the leading ID selectors. Fixes PSK mismatches from iOS clients. 2015-10-02 00:03:33 -05:00
jim-p
7788baf845 When using eap-radius, if the virtual address pool is left blank, pull the IP addresses from RADIUS instead. (Will need an IP address defined for each account.) Doesn't seem to be possible to pull from either RADIUS *or* a local pool that I can see from experimenting and looking at strongSwan's docs. 2015-10-01 19:54:10 -04:00
Chris Buechler
46545f30a0 Specify %any where identifier is "any", so the note on these pages 
actually works.
 2015-10-01 13:19:42 -05:00
Chris Buechler
8ed4a13929 Only need to check 'vip' here. 2015-09-30 20:58:38 -05:00
Chris Buechler
1dc9bd3c0c Can't use continue here as it continues the foreach, which skips the 
"ipfw zone" command, breaking CP for any system that doesn't have VIPs
defined.
 2015-09-30 18:11:04 -05:00
Chris Buechler
d6bc309116 Bring this back, I'll fix issues afterwards. Revert "Remove "auto", it's just a synonym for IKEv2. Ticket #4873" 
This reverts commit 47f802694a.
 2015-09-29 19:24:20 -05:00
Chris Buechler
e0c822a1f3 Use the appropriate parent interface with gateway groups using CARP VIPs. 
Ticket #4990
 2015-09-29 18:57:12 -05:00
Chris Buechler
069df7d65d Disable DHS as a dynamic DNS provider option. It's never worked, and 
fixing is more complex than just fixing the variable screw up and
disabling cert validation for their SSLLabs F-graded site. Updates made on
their site even take quite some time to be reflected, seems to be a largely
abandoned service.
 2015-09-29 15:45:22 -05:00
Chris Buechler
0e512ee3a5 Use self rather than any in auto-added IPsec rules to prevent 
over-matching. Ticket #5211
 2015-09-28 15:37:07 -05:00
Renato Botelho
a5bf7adb7b Merge pull request #1938 from phil-davis/patch-5 2015-09-28 14:29:08 -03:00
doktornotor
aac2557e4d Fix comment language 2015-09-28 08:42:34 +02:00
doktornotor
0c2f769c0a Remove syslog.conf entries on package uninstall (Bug #5210) - RELENG_2_2 
The remove_text_from_file() is not needed at all. However, system_syslogd_start() must be run after the package entries are gone from config.xml, otherwise system_syslogd_start() just re-adds the (now almost removed) package logging configuration from there.
 2015-09-27 18:35:06 +02:00
Phil Davis
c5863ca184 Redmine #5200 be less aggressive about DHCP Pool Notice V2 
This one will log_error() the DHCP pool message when it detects the inconsistency at the end of the setup wizard during reload all.
That way it can still be seen in the system log that this happened, and one day someone might chase down all the steps in the "reload all" process.
Compare this with https://github.com/pfsense/pfsense/pull/1935 and choose which way you would like to go.
 2015-09-26 15:23:32 +05:45
Chris Buechler
2f1e2ad9c1 Use get_interface rather than find_interface here. It'll work for VIPs on gateway groups this way, and cache doesn't really matter here. Partial fix for Ticket #4990 2015-09-23 23:47:46 -05:00
Luiz Otavio O Souza
4ccf7dd97a Do not pass vouchers shorter than 5 characters to voucher application, they 
are too short to be a valid voucher.

Discussed with:		Jim P
Issue:			#4985
 2015-09-22 07:57:05 -05:00
Renato Botelho
c6ca12a66a Merge pull request #1790 from phil-davis/pkg-install-4884-RELENG_2_2 2015-09-21 17:11:14 -03:00
mortencombat
809ffcdbaa GratisDNS support for hosts without subdomains 
Resubmit of #1793
 2015-09-21 17:00:05 -03:00
TarasSavchuk
03ae5544b5 Add L2TP server's interface to mpd.conf 
https://redmine.pfsense.org/issues/4830
https://forum.pfsense.org/index.php?topic=95908.0
 2015-09-21 16:49:26 -03:00
Renato Botelho
62f3a0ea27 Merge pull request #1916 from doktornotor/patch-15 2015-09-21 16:02:27 -03:00
Renato Botelho
adbf3f4652 Merge pull request #1807 from miken32/RELENG_2_2 2015-09-21 14:59:16 -03:00
Renato Botelho
4478765839 Merge pull request #1836 from phil-davis/patch-4 2015-09-21 14:43:23 -03:00