mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,726 Commits 27 Branches 53 Tags 494 MiB
e75a787fca
Commit Graph

12469 Commits

Author SHA1 Message Date
Renato Botelho
770f4ee5b8 Missed pbi_prefix here 2014-04-22 16:36:18 -03:00
Renato Botelho
384e26472d Fix PBI symlink creation and deletion under /usr/local following .pbiopt files, also drop setup_library_paths() since it's not necessary anymore 2014-04-22 15:37:35 -03:00
Phil Davis
6f931ad24e Make sure /usr/local/etc/rc.d exists 
On 2.2-ALPHA (i386)built on Mon Apr 21 13:01:11 CDT 2014 (for example) there was /usr/local/etc but not /usr/local/etc/rc.d - when I tried to install bandwidthd, that called write_rcfile() which failed because /usr/local/etc/rc.d did not already exist.
Best to check for it and make it if it does not exist.
(I am guessing that the 2.1.n image builds already had /usr/local/etc/rc.d bnefore any packages were installed, otherwise this problem should have already been an issue prior to 2.2)
 2014-04-22 11:10:26 -07:00
Ermal
635f9eb560 Merge pull request #1116 from PiBa-NL/interface_has_gateway-ipv4_gif_gre 2014-04-22 09:32:35 +00:00
Ermal
1147bd002a Merge pull request #1115 from PiBa-NL/reply-to_IPv6gateway 2014-04-22 09:30:06 +00:00
Ermal
ebafd47038 Load if_stf module when needed 2014-04-22 06:52:00 +00:00
Phil Davis
80571c81a4 Cut paste bug fix in Remote Syslog DHCP events 
apinger is repeated here from the code above, but it should be dhcp.
Forum https://forum.pfsense.org/index.php?topic=73734.0
Selecting to remote syslog "Gateway Monitor events" would also switch on "DHCP service events" unintentionally.
 2014-04-20 21:57:58 -07:00
derelict-pf
b7b461fc14 Add nohttpsforwards option to captive portal 2014-04-19 08:35:28 -07:00
PiBa-NL
2700ef9631 add gre and gif checks for for IPv4 function interface_has_gateway($friendly), like they are already for IPv6 2014-04-19 15:20:55 +02:00
PiBa-NL
93f1d233b2 check gateway for IPv6 also for reply-to rules. 2014-04-19 15:15:50 +02:00
Ermal
928dc66a43 Be smarter at using kenv 2014-04-18 15:24:34 +00:00
Camlin
dd8d9bdcaa pfSense - Bug #3607: Fix issue whereby the ICMP6 messages sometimes have the wrong source IP when a monitor gateway has been set. 2014-04-18 10:55:28 +01:00
Camlin
8c7e38ff68 [pfSense - Bug #3607] Ensure gateway detection can cope with the gateway being a dynamically assigned PPoE interface. 2014-04-18 10:43:48 +01:00
Ermal
302c005e11 Unload the ZFS module if its not in use to not consume uselss memory 2014-04-17 20:19:29 +00:00
Frank Wall
5e5c72be38 support symlinked RC scripts from PBI packages 2014-04-17 14:21:50 +02:00
Ermal
4010266acd GC unused code and do not set this to 0 for now since it is not anymore relevant 2014-04-17 08:35:36 +00:00
Phil Davis
45f4d7628a Fix susbstr-substr typo 
I just got this error again on 14 Apr 2014 2.2 snapshot. I can see the fix in 2.1 branch. I could have sworn it got fixed in Master also, but I can't see it. So here is the fix for Master.
 2014-04-15 07:06:13 -07:00
Ermal
4a97aa344f Correct the sense of the check to allow openvpn to work 2014-04-14 19:11:34 +00:00
Ermal
57ab9f7d52 Correct auth-user-pass-verify to include parameters properly so openvpn can start 2014-04-14 18:52:01 +00:00
Ermal
c760c69cee Fixup update URL 2014-04-14 18:05:17 +00:00
Ermal
05dd0c3246 Use the FreeBSD script for ldconfig to catch all libs 2014-04-14 15:13:43 +00:00
Ermal
df8e43cc56 Avoid warnings later on if no config for layer7 exists 2014-04-14 13:48:39 +00:00
Ermal
e61f548f2c Get rid of embedded platform. Its time to GC this 2014-04-14 13:06:28 +00:00
Renato Botelho
115b7b8183 Start using filterlog 2014-04-14 09:47:32 -03:00
Ermal
2a438d7e4c Switch over to filterlog sooner than later 2014-04-14 12:43:04 +00:00
Ermal
b13567f04d Unset also here 2014-04-14 12:34:34 +00:00
Phil Davis
ee34e13739 Do not allow upgrade_101_to_102 to exit early 
This upgrade step does both Captive Portal stuff and OpenVPN stuff. So do not return early just because there is no Captive Portal config.
Both Captive Portal and OpenVPN tests changed to be positive tests, to make sure that everything is checked/tested and there is no chance to return early.
 2014-04-14 04:23:18 -07:00
PiBa-NL
146ee078fe console, reload firewall rules after enabling SSH 2014-04-14 10:33:38 +00:00
Phil Davis
c30639e445 Get real interface when dhcrelay uses default GW 
If the DHCP Relay server is not on any local subnet, and not on any subnet that has an internal static route, but is somewhere that no specific route is known, then this code finds the default gateway and uses that in the DHCP relay "-i" parameter. The current code gets just the interface name (like "wan", "opt1"). But DHCP Relay command needs to be fed the actual device name "vr0", "vr1" etc.
To break this I simply enabled DHCP Relay, select "LAN" interface, and put Destination Server 1.2.3.4
Making this changed fixed it.
Forum: https://forum.pfsense.org/index.php?topic=75010.0
 2014-04-14 10:27:22 +00:00
Ermal
33f537179b Merge pull request #1072 from marcelloc/patch-3 2014-04-14 10:19:16 +00:00
Chris Buechler
d471a8901f tls-verify requires quotes around the command to be executed. Ticket #3596 2014-04-14 06:35:57 -03:00
Ermal
f03ed3505d Nowdays there is no real difference between the kernels apart the ZFS support. So do not keep a distinction anymore 2014-04-14 08:09:19 +00:00
m0se
bb8f3ce115 fixing typo for GIF tunnels to work over IPv6 
the call of get_interface_gatewayv6() in the creation of a GIF tunnel over IPv6 leads to a "Fatal error: Call to undefined function get_interface_gatewayv6() in /etc/inc/interfaces.inc on line 934". changeing the function call to get_interface_gateway_v6() fixed it for me on my local system.
 2014-04-12 16:29:43 +00:00
Ermal
faf20ee4a7 Also add similar checks on rc.newwanipv6 as in the v4 version 2014-04-12 11:28:43 +00:00
Ermal
83c0dc1d1e Forgot to remove the problematic part from previous OpenVPN loop fix commit 2014-04-12 11:24:43 +00:00
Ermal
91571af53a Take care of the loops reported for OpenVPN in tap mode. Also fixes the problems of tap disappearing from bridge if its a member. 2014-04-12 06:21:12 +00:00
Marcello Coutinho
da1d016527 fix git path calls and CODIR 
it may need some checks/fixes on pkg-utils.inc as git downloads but not installs.

After manual pbi install of git, "pfSsh.php playback gitsync master" works fine with this fix.
 2014-04-09 17:53:13 -03:00
Ermal
ca321bfde9 Correct typo on function name that has slipped unnoticed. Reported-by: https://forum.pfsense.org/index.php?topic=74688.0 2014-04-07 15:30:19 +00:00
Renato Botelho
539d94b31b Merge pull request #1055 from ExolonDX/branch_master_10 2014-04-07 11:43:57 -03:00
jim-p
69e593c14f Make extra sure that we do not start multiple instances of dhcpleases if, for example, the PID is stale/invalid and there is still a running instance. 2014-04-07 10:10:48 -04:00
Ermal
a7ee038bce Put the fix to be more generic to prevent any other leak possible in the long run. Fixes #3062 2014-04-07 09:06:04 +00:00
dsiunicaen
39f3d843dc Update captiveportal.inc 
Release unused pipeno when client is already authenticated.

Bug #3062
 2014-04-07 09:01:54 +00:00
Warren Baker
bb7843fd20 Indentation 2014-04-07 10:10:04 +02:00
Warren Baker
2a2b603d0c Indentation 2014-04-07 10:09:48 +02:00
Warren Baker
c2fe67ebe0 Dont check for 'checked' but rather if it is just set 2014-04-07 10:09:15 +02:00
Colin Fleming
5a2b90cda9 Tidy up "functions.inc" 
Escape single quotes for TABLE and HREF
Updated closing TR tag
 2014-04-04 17:08:21 +01:00
Renato Botelho
01f4a81de1 Make rc.php_ini_setup ready for php 5.5 2014-04-02 10:58:40 -03:00
Colin Fleming
a4b1bf88bb Tidy up "functions.inc" 
Remove unnecessary semi-colon.
 2014-04-01 16:59:20 +01:00
jim-p
291e0a1c88 Remove TRIM_set and TRIM_unset support. This method isn't very elegant and isn't necessary in the long run. It's better handled in the installer stage and not after the fact. 2014-03-31 10:42:41 -04:00
Chris Buechler
efecff7fc9 Merge pull request #1041 from PiBa-NL/carp_maintenance_2.2 
carp, provide a way to 'permanently' set carp to 'maintenance mode' (advskew 254) persisting a reboot
 2014-03-30 22:14:03 -04:00
PiBa-NL
783f1ee210 carp, provide a way to 'permanently' set carp to 'maintenance mode' (advskew 254) persisting a reboot 
Option to set CARP interfaces to 'maintenance mode', persisting through a reboot so the primary machines stays as backup/inactive.
This is required when there are some problems (possibly with the hardware) and the primary machine needs to be booted and checked again before becoming 'master'. Currently it will take back the master state during reboot even though there might still be problems or some re-configuring to do.

p.s. it is for some reason not possible to reset advskew back to '0'.. should that number be removed as an option, and use 1 as a minimal value ?
 2014-03-30 00:09:30 +01:00
Warren Baker
f66e049aa5 Add privileges 2014-03-29 15:06:32 +02:00
Warren Baker
5bb1c49527 Reflect the service name when starting it 2014-03-29 14:59:07 +02:00
Warren Baker
4e8e8cc80e Add localhost as always allowed and ensure to include the access lists 2014-03-29 14:52:33 +02:00
Warren Baker
58d00e65c9 Write out the access list correctly 2014-03-29 14:47:43 +02:00
Warren Baker
16a3108ff2 Configure acls for local networks and ensure listening interfaces are correctly set 2014-03-29 12:58:38 +02:00
Warren Baker
0ae676cd0c Add missing new line 2014-03-29 11:23:56 +02:00
Warren Baker
ece2988fc2 Correct reference 2014-03-29 08:16:51 +02:00
Warren Baker
1b6e3c30fb Ensure TXT support on host descriptions actually works 2014-03-29 08:09:43 +02:00
Ermal
3ae8292396 Remove even unused pamd.conf 2014-03-28 23:13:34 +01:00
Ermal
e0c725641c Remove utterly old libmap.conf file 2014-03-28 23:09:44 +01:00
Ermal
c70a987869 Update disktab to FreeBSD 10 2014-03-28 23:06:02 +01:00
Ermal
1b60c644c9 Remove cvsup file from pfSense tree 2014-03-28 22:58:12 +01:00
Ermal
4cc0dce5cf Another remenant from old days 2014-03-28 22:57:01 +01:00
Ermal
362fdc4cc3 Remove remenants of pccardd from FreeBSD 5 2014-03-28 22:54:12 +01:00
Ermal
b110f1ba98 Update protocols file as well 2014-03-28 22:45:54 +01:00
Ermal
2c9325f6a1 Remove unused files 2014-03-28 22:34:35 +01:00
Ermal
a02fa5ec3c Do not use the version_kernel ad version_base files since they are not relevant anyway 2014-03-28 22:34:01 +01:00
Ermal
255596d901 Use proper variable name for the interface 2014-03-28 16:41:38 +00:00
Ermal
fe291564ea Correct check that was broken even before to actually make the ieee8021x enable from proper setting. Reported-by: https://forum.pfsense.org/index.php?topic=74013.0 2014-03-28 15:19:39 +00:00
Ermal
59c0272ec7 Log everything when selected to do so 2014-03-26 20:55:36 +00:00
Ermal
e047c72a70 Correct the generation of antifpoof rules with tracker. Also honor the log directive. While here remove a duplicate antispoof declaration further down 2014-03-26 20:28:10 +00:00
Ermal
2553d943aa Give each rule hardcoded on the ruleset a tracker so log entries give up proper results there 2014-03-26 19:17:17 +00:00
Ermal
b305f79584 Make this a global so no errors occur 2014-03-26 16:54:25 +00:00
Chris Buechler
f3109faca5 send crash reports via HTTPS 2014-03-26 03:40:20 -05:00
Renato Botelho
000a8d1dcd Change default charset on pages to utf-8 2014-03-25 14:44:41 -03:00
Renato Botelho
6fba8620e5 Merge pull request #1031 from ayvis/master-br-patch 
replaced uppercase html tags with lowercase
 2014-03-25 14:35:55 -03:00
Renato Botelho
8702dceaab Merge pull request #1035 from packetwerk/rc_permissions 
fix permissions on two rc scripts
 2014-03-25 05:54:42 -03:00
Franco Fichtner
ced541bb82 fix permissions on two rc scripts 2014-03-25 09:46:22 +01:00
Ermal
0fcae2eca8 Fixes #3543, correct the typo in spelling 2014-03-24 20:44:11 +00:00
Ermal
cfa53879d6 While here escape the passed valuye to avoid problems with input 2014-03-24 20:14:19 +00:00
Ermal
3b68d29cb2 Somehow these got changed to /usr/local/sbin/ipfw instead of /sbin/ipfw 2014-03-24 20:07:21 +00:00
Ermal
375eba1448 Fix this for master 2014-03-24 19:58:14 +00:00
Renato Botelho
dae77fe374 Fix deletion of ipfw rules and pipes for passthru mac, it fixes #3538 2014-03-24 16:26:16 -03:00
Ermal
e26e5e256f Make this more usable by putting a delimiter in there 2014-03-24 21:01:56 +01:00
Ermal
543c91ffa3 Also configure log levels any time the daemon is restarted. 2014-03-24 20:36:42 +01:00
Ermal
b7b3bc7113 Try to put the connection name in the logs for easy identification 2014-03-24 20:35:29 +01:00
vsquared56
2a08b81457 Return full issuer for DN with multiple attribute values 
e.g. CN=Some Root CA,OU=Certificates Department,OU=(c) Copyright SomeCorp,O=SomeCorp,C=US
 2014-03-24 02:17:41 -05:00
Warren Baker
ae5bbb6499 Fix file name for domain overrides and ensure trust anchor is referencing the correct file. 2014-03-21 20:07:40 +02:00
Warren Baker
19b1ea6c54 Use the correct xml tag to check against 2014-03-21 20:02:39 +02:00
Warren Baker
75e6d1b2f4 Only display config title if option is enabled 2014-03-20 21:59:51 +02:00
Warren Baker
be5aa31086 Rather put forwarding for DNS servers into the configuration file 2014-03-20 21:57:37 +02:00
Warren Baker
d12889b0c2 Ensure if port is configured it is then used 2014-03-20 21:34:00 +02:00
Warren Baker
d5ee020872 Add privileges for accessing DNS Resolver 2014-03-20 21:34:00 +02:00
Ermal
1c62178aca Use array_flip even for the package parsers 2014-03-20 19:28:07 +00:00
Ermal
1b34f8a73f Add require_once where needed to avoid redeclaration from nested includes 2014-03-20 19:26:41 +00:00
Ermal
00a6fcb7fb Configure first the vhid and than pass the vhid when configuring the carp this makes the ip assigned to carp as well 2014-03-20 18:54:51 +00:00
Ermal
a63e5eadef Remove balancing reference that does not exist anymore 2014-03-20 18:38:32 +00:00
Ermal
e3b98f81d1 Do not garble the error logging message 2014-03-20 16:19:15 +00:00
jim-p
8b650e57d6 Avoid placing an empty "interface listen" directive in ntpd.conf 2014-03-20 12:09:16 -04:00
Ermal
bd53b624d4 Try to restore last working ruleset rather than staying without configuration at all 2014-03-20 15:59:12 +00:00
ayvis
91f026b02c replaced uppercase html tags with lowercase 
js files saved as UTF-8 / LF
language="JavaScript" deprecated, replaced with type="text/javascript"
 2014-03-19 23:38:56 +01:00
Ermal Luçi
f3bdba41f7 Merge pull request #907 from PiBa-NL/openvpn_client_usercredentials 
openvpn, allow for entering client user credentials in the WebGUI
 2014-03-19 16:50:01 +01:00
Renato Botelho
c3e4ef746f Merge pull request #953 from N0YB/Gateway_Quality_RRD 
Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set.
 2014-03-19 12:15:17 -03:00
ayvis
1d7ba68396 replaced <br>, <br/> with <br /> in ANSI encoded files. Converted these files to UTF-8 2014-03-18 16:09:05 -03:00
Ermal
d5d22d6e36 Disable default allow incoming rules for 6to4 and 6rd interfaces. This rule unintentionally allows all services on the interface to be reachble and maybe more! 2014-03-17 21:24:58 +00:00
Renato Botelho
7f7626ba44 Merge branch 'master-br' of https://github.com/ayvis/pfsense into ayvis-master-br 2014-03-17 11:17:29 -03:00
Chris Buechler
9c3b8c6edb fix typo 2014-03-14 20:12:34 -05:00
Chris Buechler
34e2973ed9 standardize URLs 2014-03-14 19:33:03 -05:00
Chris Buechler
e1a456e6a8 standardize URLs 2014-03-14 19:30:56 -05:00
Chris Buechler
0734024c9e standardize URLs 2014-03-14 19:28:10 -05:00
Chris Buechler
5775f32451 standardize URLs 2014-03-14 19:18:17 -05:00
Chris Buechler
184016fcb7 standardize on https on www.pfsense.org 2014-03-14 19:15:44 -05:00
Chris Buechler
ef459eb700 standardize on https://www.pfsense.org, point to packages.pfsense.org 2014-03-14 19:10:27 -05:00
Chris Buechler
5721595b8d standardize on https://www.pfsense.org 2014-03-14 19:08:43 -05:00
Ermal
0390090465 Make the Additional tags that may be supplied compliant with new schema 2014-03-14 21:06:37 +00:00
Ermal
6d84c956e0 Make the parser more efficient to test for keys rather than searching inside the array 2014-03-14 21:02:44 +00:00
Renato Botelho
ffd17097a7 Unbreak listtags(), it should return regular array 2014-03-14 17:47:03 -03:00
Ermal
703b1ce1c5 Correct variable name, while here unset some large var 2014-03-14 20:35:39 +00:00
ayvis
8cd558b61b xhtml Compliance 
replaced <br>, <br/> and </br> with <br />
 2014-03-14 21:24:03 +01:00
Ermal
20dad315ae Provide upgrade code after changes done for Ticket #3441 2014-03-14 10:42:35 -03:00
Renato Botelho
b824ff8d99 Merge pull request #1025 from florian-asche/patch-5 
Update dyndns.class
 2014-03-13 20:20:46 -03:00
Florian Asche
7dc42e4ac8 Update dyndns.class 2014-03-13 22:57:28 +01:00
PiBa-NL
3fe73243bf fix plugin method for packages to allow for multiple plugins in an 'item' array as 'plugin' is not allowed as array item by xmlparse.inc 2014-03-13 21:58:26 +01:00
Chris Buechler
4db99d5baf set package URL to https://packages.pfsense.org 2014-03-13 02:46:21 -05:00
Chris Buechler
1b92cc6149 use xmlrpcbaseurl here too, not product_website 2014-03-13 02:43:01 -05:00
Chris Buechler
f5e09d9201 we actually use xmlrpcbaseurl here, not product_website 2014-03-13 02:18:51 -05:00
Renato Botelho
f049d45e0a Merge pull request #1022 from PiBa-NL/carp_notification 
rc.carpmaster/rc.carpbackup notification method for packages.
 2014-03-12 18:35:27 -03:00
Florian Asche
cd8f7eee0e Update dyndns.class 
Only use IPv4_only function if ipv6 is false
 2014-03-12 22:31:53 +01:00
Ermal
d84faccb60 Add removed file to obsolete list 2014-03-12 18:49:57 +00:00
Ermal
8b4abd5932 More removal of racoon from referenced in sources 2014-03-12 18:48:25 +00:00
Ermal
1dcb00bb71 Remove remeants of racoon 2014-03-12 18:44:51 +00:00
Ermal
3eeac25687 Generate nat rules for ipsec when needed 2014-03-12 18:42:43 +00:00
Ermal
72a8c829fd Be more efficient, and ordered about thae tags and also syncrhonize tags with xmlreader 2014-03-12 16:34:38 +00:00
Ermal
b79ea46a95 Make this a bit more smart rather having the penalty going over explode 2014-03-12 16:19:50 +00:00
Ermal
055fa9e354 Try a different strategy for fixing #3514 just send a HUP to dhcp6 to get it to reload. 2014-03-12 14:49:35 +00:00
PiBa-NL
331166a85c -renamed function to pkg_call_plugins 
-added is_array()
-added function header text
-replaced fixed 'plugin_carp' by $plugin_type to allow for generic use
 2014-03-12 15:48:41 +01:00
PiBa-NL
eaee3af65b rc.carpmaster/rc.carpbackup notification method for packages. 2014-03-12 00:31:52 +01:00
Ermal
f0014c6499 Make this a bit more efficient 2014-03-11 15:40:27 +00:00
Renato Botelho
ac28b62eb8 Merge pull request #1018 from florian-asche/patch-3 
Update services.inc
 2014-03-11 09:42:48 -03:00
Renato Botelho
6b13f8d259 Do not delete linklocal address 2014-03-11 08:38:30 -03:00
Florian Asche
e6d708fe68 Update dyndns.class 
IPv4 ONLY? YEAH ;)
 2014-03-10 22:15:39 +01:00
Florian Asche
181386d613 Update services.inc 
Added CURL setops from dyndns.class
 2014-03-10 22:11:31 +01:00
Florian Asche
3c6f29c0b5 Update services.inc 
IPv4 ONLY
 2014-03-10 22:06:35 +01:00
Renato Botelho
56b4084469 Merge pull request #1012 from florian-asche/patch-1 
Update services.inc
 2014-03-10 16:41:36 -03:00
Florian Asche
5244c510a2 Update services.inc 
Prepared to make $hosttocheck configureable
 2014-03-10 19:42:41 +01:00
Florian Asche
5d1185ced7 Update services.inc 2014-03-10 19:18:21 +01:00
Ermal
b67e9e626c Fix for now 'IPv6 - LAN looses Prefix after link event'(forums) with a not elegant solution but works. Probably dhcpv6 client should solve this by itself and generate and event for it. For now just bump dhcpv6 client again to have the prefix interface reconfigured. 2014-03-10 15:12:53 +00:00
Renato Botelho
d130cd4674 pfSense_interface_deladdress() only knows how to delete an ip address, not a subnet. It should fix #3513 2014-03-10 10:17:33 -03:00
Florian Asche
09cb9dee69 Update services.inc 
Added missing usepublicip with dyndnsCheckIP
 2014-03-10 00:35:20 +01:00
Ermal
fac36dfddf Make the voucher auth through xmlrpc work. 2014-03-07 17:49:54 +00:00
Chris Buechler
fe3553d16d default openssl to 2048 2014-03-06 16:10:33 -06:00
Ermal
631597493e Better just use start here seems to be more reliable 2014-03-06 22:59:40 +01:00
Ermal
d623693ca0 Correct the step for phase2 algos as well 2014-03-06 21:38:50 +01:00
Ermal
d60eea555e Correct the generation of the config for mobile tunnels as well 2014-03-06 21:38:50 +01:00
Renato Botelho
8c3cba99f0 Merge pull request #995 from ayvis/master-syntax-errors 
syntax errors correction
 2014-03-06 16:57:37 -03:00
Chris Buechler
ad55629bc9 update link for 2.2 2014-03-06 13:19:29 -06:00
Ermal
f37e37bbdd Remove not needed anymore function 2014-03-06 20:19:38 +01:00
Ermal
9601df8ad5 Use a step of 64 here too to comply with what the daemon can parse/understand 2014-03-06 20:02:06 +01:00
Chris Buechler
da2ec3361e bring up appropriate interface for GRE/GIF. Ticket #3281 2014-03-06 00:51:20 -06:00
ayvis
56b490bad3 syntax errors corrected 2014-03-04 22:09:02 +01:00
Renato Botelho
ebe2b407b3 Merge pull request #984 from phil-davis/master 
Return GWG IP protocol (version) when no gateway IP
 2014-03-04 10:03:11 -03:00
Renato Botelho
faddd38108 Merge pull request #992 from Doncuppjr/master 
Add UEFI support to Network Boot options.
 2014-03-04 09:52:29 -03:00
Renato Botelho
ff9c579f37 Fix syntax 2014-03-03 18:00:08 -03:00
Renato Botelho
48047e3fdc s/unlink/unlink_if_exists/ 2014-03-03 16:21:23 -03:00
Donald A. Cupp Jr
fdb116a97b Put added option in dhcp config instead of dhcpv6 config. 
Use empty function instead of <> "" for null test in dhcp network booting config section.
	modified:   etc/inc/services.inc
 2014-03-03 11:20:44 -08:00
Renato Botelho
d07bc322c5 Remove broken 'dynamic6' gateway, we already have ipprotocol to tell us the IP version, leave it more simple using only 'dynamic'. It helps #3484 2014-03-03 13:31:01 -03:00
Renato Botelho
bf36dafa26 Fix typo on var name 2014-03-03 13:26:36 -03:00
Donald A. Cupp Jr
c10d55ba64 Add missing option code for uefi booting 
modified:   etc/inc/services.inc
 2014-03-02 23:14:43 -08:00
Donald A. Cupp Jr
c636d5172b Merge branch 'master' of https://github.com/Doncuppjr/pfsense 2014-03-02 21:59:35 -08:00
Charlie Root
7023c602bd Added support for UEFI booting to Network Booting configuration. 
modified:   conf.default/config.xml
	modified:   etc/inc/services.inc
	modified:   usr/local/www/services_dhcp.php
 2014-03-02 21:47:39 -08:00
Chris Buechler
3d8e954b3f sync up ALTQ-capable interfaces list 2014-03-01 16:55:22 -06:00
jim-p
68169a559e Wrap this in an is_array() test, or else if you have no manually configured DNS servers, saving the DHCP settings produces a PHP error. 2014-03-01 13:07:04 -05:00
Renato Botelho
dadb484675 Merge pull request #986 from andrespetralli/master 
Re-enabling static lease updates
 2014-02-28 15:46:28 -03:00
Andres Petralli
3cdef18753 Re-enabling static lease updates 2014-02-28 08:59:19 -08:00
Ermal
b31247af70 Small correction for clear code 2014-02-28 14:14:49 +00:00
Ermal
cdeaf91e14 Ticket #3484 Correct the case for GRE tunnels as well since they behave the same. GRE seems to need the prefixlen 128 specified all the time so do it explicitly to be on safe side 2014-02-28 14:11:46 +00:00
Ermal
d2c598080a Ticket #3484 Note that for now prefixlen is useless in ipv6 tunnels. IPv4 accepts them 2014-02-28 13:52:30 +00:00
Ermal
c32a6b82a7 Fixes #3484. Provide a dynamic gateway for gif v6 tunnels so it can be used on firewall rules etc. The guide for setting up this tunnels on docs need to change to leave the gif interface as none type. People upgrading need to fix this themselves with a not on release notes. This can be fixed if the kernel condition is relaxed to allow setting the prefixlen on the tunnel as ipv4 2014-02-28 13:49:44 +00:00
Phil Davis
f60003faf1 Return GWG IP protocol (version) when no gateway IP 
This is a resubmit of an older pull request I had closed. It came up again in the forum, with a user setting up a VM environment and wondering why he cannot make policy-routing rules to a gateway group. The gateway group names did not display because all his WANs were down at the time and so the existing code was too dumb to determine the IP protocol (version 4 or 6) when none of the WANs in the gateway group actually have an IP address yet.
 2014-02-27 18:54:51 -08:00
Ermal
c7fbdd6c8e Make the IPSec status page work with strongswan 2014-02-27 17:39:19 +01:00
Ermal
2124fad4d0 Oops forgot the query message 2014-02-26 16:26:40 +00:00
Ermal
df0878b018 Add a function to read the status of connections/SAs/SPDs from smp plugin of StrongSWAN. No need to go through the setkey dumps 2014-02-26 16:24:19 +00:00
Ermal
ddfe5e4380 Make xmlreader parse any document and properly consider listtags specified and attributes. Probably should be made the default due to its speed. 2014-02-26 14:25:30 +00:00
Ermal
8ffb5ccdee Parse even attributes when present 2014-02-26 11:55:48 +00:00
Ermal
c6efc8fd15 Push log changes for IPSec and fix generation of strongswan.conf and ipsec.secrets to be properly considered 2014-02-25 11:10:01 +01:00
Ermal
7335fa5380 * Correct logging to syslog and proper file for ipsec from strongswan 
* Use proper commands to reload strongswan rather than just the daemon
 2014-02-25 11:10:01 +01:00
Phil Davis
3ad6b569d6 Fix #3483 only use IPv4 DNS servers in DHCP v4 conf 2014-02-24 19:40:30 -08:00
Renato Botelho
04f5393f49 Make is_linklocal case-insensitive and fix #3433 2014-02-24 16:03:34 -03:00
Renato Botelho
b5388f033c Fix #2302, save custom uploaded l7 pattern files on config.xml and replicate it to slave 2014-02-24 12:25:59 -03:00
Renato Botelho
732b160dba Set variable after make sure it's defined and has elements 2014-02-24 12:25:59 -03:00
Renato Botelho
420b45385a Fix whitespace and indent 2014-02-24 12:25:59 -03:00
Ermal
62f965689c Properly detect when there are issues with communicating with syncip and to use the local DB for this. Otherwise detect if the remote says the voucher is not valid say its not valid. 2014-02-24 14:57:04 +00:00
Ermal
ac420abd1d Properly compile the query to insert the values. Pointy-hat: myself. While here respect the redirurl when passed to portal_allow and use proper function to do redirection. 2014-02-24 14:39:31 +00:00
Renato Botelho
037e7a6210 Merge pull request #959 from stilez/patch-3 
Tighten is_subnet() functions
 2014-02-24 07:57:29 -03:00
Ermal
34340c5649 Ticket #2627. Just pass the array over no need to traverse it 2014-02-21 13:45:19 +00:00
Ermal
929776169f Fixes #2627. When an interface goes down try to shut the RAs and dhcpd6 service on that interface 2014-02-21 13:23:29 +00:00
Ermal
d6101e2316 Avoid recursion of convert_real_interface_to_friendly_interface_name with get_parent and on linkup of parent interface properly configure especially useful on ppp type links 2014-02-21 11:58:11 +00:00
Renato Botelho
ad43847b97 Merge pull request #960 from stilez/patch-4 
Tighten is_validaliasname()
 2014-02-21 08:01:13 -03:00
Ermal
ef60dfa541 Be friendly to memory 2014-02-21 10:03:48 +00:00
Ermal
4d3277443f Fix problem with the voucher synching that was introduced during conversion to zones 2014-02-21 10:03:38 +00:00
stilez
4ad9a1e7ed Tighten is_validaliasname() 
is_validaliasname() treats "empty string" as a valid alias name, it probably shouldn't.

I suspect it also should not allow purely numeric names ('53'), or pure underscore ('_'), or reserved port names ('tcp', 'http'), as valid alias names for other things. Too much risk of issue/ambiguity which isn't helpful in a router/security device, and no obvious upside to it. 

Example: - Suppose I define '53' as an alias for '54' or 'tcp' as an alias for 'ssh' or 22 on some firewall..... which I can because is_validaliasname() will validate both? It's a subtle change, hard to spot as rules will look correct, easy to cause problems or wilfully misuse.)

"Pure numeric" aliases are also worryingly ambiguous since many other things that can be entered or appear on the GUI, such as port numbers, can be entered or will show as pure numeric or an alias, so there's scope for ambiguity which it means. (is '53' the port 53, or the alias 53 which I've redefined to mean 1053?)

This PR generally tightens the logic and regex expressions (shorter syntax, no '?:'s or '?' groups), and slightly but sanely limits valid alias names to remove ambiguity - specifically it bars 4 kinds of string (empty string, pure numeric, pure underscore, and PHP reserved names that are already hard-coded aliases for specific protocols/services) from being valid alias names any more, as a result. 

		(I think this is sane, if you agree!)
 2014-02-21 02:49:09 +00:00
stilez
a5e2a35f03 Tighten is_subnet() functions 
The is_subnet(), is_subnetv4() and is_subnetv6() functions have significant issues in their coding logic.

Issues:

1) Functions use is_numeric(), so they validate invalid bitcount parts such as '1.1.1.1/6.5' or '::8000/94.7' as valid subnet strings

2) Validation explodes to a list of 2 variables rather than testing the whole string, so it's possible to craft a malicious string or mis-enter text such as "::8000/24/;\nARBITRARYTEXT;", or any valid subnet followed by a third '/' character followed by arbitrary text, which always validates as permitted data. In v2.x this allows arbitrary or malformed text placement into core config files such as pf.conf, f/w tables, and probably exec() strings, from the GUI (reported previously)

3) is_subnet() and is_subnetv6() return false for the valid subnet /0 as a CIDR, although technically this is allowed and valid as a subnet (it may have unambiguous and useful meaning in a router or security context).

The existing code is easier to rewrite than fix. It's a lot shorter too. A single preg_match() does all the separating of valid subnet parts and identifies which if either type of subnet the string could be, by exactly matching EITHER (7-15 char string containing only 0-9.) OR (2-39 char string containing only 0-9a-f:) followed by '/' and (1-3 numeric digits). Depending which of the first two matches is non-empty, it then checks the "ip" part" and "numeric" part are each valid, and exits. Efficient and robust.

NOTE: - these functions returned a True/false value ( is_subnet() or !is_subnet() ). As any positive number evaluates in a Boolean sense to True, I have taken advantage of this to have "success" return 4 or 6 (not just "true") to say the type of subnet matched.  It's no extra effort or cost, and turns out to allow a lot of efficiency and code simplification elsewhere, since calling code that needs to validate a subnet *and* test if it's IPv4 or IPv6, a common situation, can now do this reliably with a single is_subnet() call:

  if (($sn = is_subnet($data)) {
      if ($sn == 4) 
         IPv4 handler code...
      else
         IPv6 handler code...
  } else
      error handler code...

I've used it here to write is_subnetv4() and is_subnetv6() to be single line near-aliases of is_subnet(), that just check the return value is indeed 4 or 6.
 2014-02-21 02:19:56 +00:00
Ermal
75aec77a87 Rather than having issues with not started radvd try to start radvd to discover by itself the prefix on the interface by using the special directive :: on the prefix declaration. Related to many tickets and forum posts 2014-02-20 23:36:20 +00:00
Ermal
8b731067d8 Correct obvious bug in IPv6.inc 2014-02-20 20:19:48 +00:00
Ermal
77148acc98 s/PEAR.php/PEAR.inc/ 2014-02-20 20:06:27 +00:00
Ermal
bf416e4996 Actually take latest one from github. It has some more checks and more execution time penalities but catches more errors 2014-02-20 20:05:37 +00:00
Ermal
03ab9b3028 Update IPV6.inc to latest 1.2.1 version 2014-02-20 20:00:01 +00:00
Ermal
7519cc29ae If set use the default bandwidth setting on the CP even for mac passthrough. Reported-by: https://forum.pfsense.org/index.php/topic,72761.0.html 2014-02-20 19:32:49 +00:00
Ermal
2e080989c4 Use the default bw specification if configured even for allowed ip and hostname. 2014-02-20 19:30:57 +00:00
N0YB
3f7f26ae16 Add the missing global $g 2014-02-20 10:37:57 -08:00
Ermal
315bdf65a1 Do some more error checking and put secondary radius attributes only if configured. Probably radius configuration should be merged with central server for logins! 2014-02-20 09:18:14 +00:00
Ermal
e570f0eb56 silence any errors 2014-02-20 09:02:55 +00:00
N0YB
d55cba63e7 Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set. 
Create gateway quality RRD with settings suitable for pfSense graph set,  since apinger uses default step (300) and other settings that are not so  good/consistent with the pfSense graphs set.

Originally Submitted as Pull Request #672.
Resubmitting to Master.
 2014-02-19 18:18:07 -08:00
stilez
4caa9574b4 Tighten is_numeric() 
Improvements:

1) avoids 'expensive' preg_match() and is a more exact test
2) fixes logic whereby an empty string or anything converted to an empty string, is deemed a valid 'numeric' value

(If an empty string can validate as numeric, it's possible that in some cases a number is expected and missing in a string, but not detected, causing malformed rules or subnet bitcounts, and unexpected issues or vulnerabilities)

 -- also moved code to a more logical place in the .inc while doing this, not mixed in between IP handling functions
 2014-02-20 01:53:01 +00:00
Ermal
ec7bc948b7 More code fixes for ntpd 2014-02-19 15:43:37 +00:00
Ermal Luçi
59c37391b9 Merge pull request #929 from nagyrobi/patch-3 
Update system.inc
 2014-02-19 16:37:01 +01:00
Ermal Luçi
a5240b7a84 Merge pull request #928 from nagyrobi/patch-2 
Update rrd.inc
 2014-02-19 16:20:48 +01:00
Renato Botelho
e09da6c266 Fix #3469 
Before downloading file to process urltable, there is a random wait
time between 5 and 60 seconds. Because of this, the difference between
file mtime and current time can be less than $freq * 86400 and it'll be
skipped. Add 90 seconds (60 of max random wait + 30 just to be sure) to
avoid skipping a file that should be updated
 2014-02-19 09:26:06 -03:00
Renato Botelho
869dfb664a Fix #3468, wording fix 2014-02-19 08:48:14 -03:00
Renato Botelho
96fc5388ac Merge pull request #945 from phildd/master 
Enhance interface gateway data entry descriptions
 2014-02-19 08:23:47 -03:00
Renato Botelho
5a47e9b12e Only add dhcpv6 client allow rules if ipv6allow is set 2014-02-18 20:31:47 -03:00
Renato Botelho
a60c6356ee Move 'allow dhcpv6 client' rules above block bogonsv6 ones, it should fix #3395 2014-02-18 16:00:17 -03:00
nagyrobi
617f9edf58 Update rrd.inc 
corrected path
 2014-02-18 16:07:09 +01:00
nagyrobi
0fd64e94fa Update system.inc 
Corrections made as requested
 2014-02-18 16:06:07 +01:00
nagyrobi
142f7393a8 Update system.inc 
Add new NTPd functions
 2014-02-18 15:12:43 +01:00
nagyrobi
1f3eff9b66 Update rrd.inc 
Add NTP graphing to RRD
 2014-02-18 15:06:27 +01:00
nagyrobi
43c4687b6b Update priv.defs.inc 2014-02-18 15:01:04 +01:00
Renato Botelho
9e875e0c00 Revert "Replaced gethostbyname() with gethostbynamel() to get a list of all IPs associated with the dns name and add them to the allowed list" 
This change is not needed, filterdns will handle it.

This reverts commit d460371416.
 2014-02-18 08:35:44 -03:00
Ermal
8c14707759 Do not do any operations on system libraries. Nowdays pbis are used and those do not break things by definition 2014-02-18 11:25:35 +00:00
Renato Botelho
8f821cbcd9 Merge pull request #891 from PiBa-NL/captive_disable 
captive portal, don't generate rules for a disabled portal
 2014-02-18 07:38:20 -03:00
Renato Botelho
aecb7a7928 Merge pull request #890 from N0YB/Gateway_Monitor 
Gateway Monitor Advanced Settings
 2014-02-18 07:31:26 -03:00
Renato Botelho
9305e21931 Merge pull request #904 from dv-user1/master 
Replaced gethostbyname() with gethostbynamel() to get a list of all IPs ...
 2014-02-18 07:15:06 -03:00
Ermal
adf1c3fa27 Revert "Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357" 
This reverts commit cb431dbf47.
 2014-02-18 09:26:01 +00:00
Ermal
c79f717a58 Really need the interface where v6 is running toa dd the gateway/route rather than the one used for the configuration. This Fixes #3357 2014-02-18 09:25:41 +00:00
Ermal
cb431dbf47 Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357 2014-02-18 08:59:42 +00:00
Ermal
2076dc46f1 Put a timeout of 30 seconds to aid with Ticket #3412 2014-02-17 20:00:26 +00:00
Ermal
ee9783e93e Move this global declaration to the proper file rather than backend code 2014-02-17 20:00:25 +00:00
Renato Botelho
bd94286059 Use correct parameter (bootfile-url) to configure netboot on DHCPdv6, it fixes #3421 2014-02-17 12:20:18 -03:00
Renato Botelho
547f1e6554 Fix typo on variable name and really add custom options for dhcpdv6 2014-02-17 12:20:18 -03:00
Ermal
11ad160eae Normally when an ip is set the interface comes up on BSD stacks. Though push this commit which Fixes #3281 2014-02-17 14:18:16 +00:00
Ermal
db9199d729 Whitespace fix 2014-02-17 14:18:15 +00:00
Renato Botelho
e4a4ec896f Grab exec result just to be careful 2014-02-17 11:11:23 -03:00
Ermal
6191b3215c Put a kludge for now which Fixes #3280. It should be improved later on to have proper handling and overloading of configuration functions 2014-02-17 14:03:42 +00:00
Ermal
bae729da39 Consider setting of noconcurrent login for passthrough expiry of users. Fixes #3340 2014-02-17 10:36:59 +00:00
Ermal
eae9130484 Merge 10 -> 10.1 and 10.1 -> 10.2 function upgrade since the recent changes done on 2.1.1 for Ticket #3441 2014-02-17 09:59:28 +00:00
Ermal
74a40221d6 Use the 11th column for the radius context rather than overriding the interim interval field with it. Fixes #3447 2014-02-17 09:34:14 +00:00
jim-p
bf4e62acc7 Add a knob to let the user select which console (video or serial) is preferred in cases where there are multiple consoles present. Also provide a way to force this preference. 2014-02-14 11:03:06 -05:00
jim-p
407fbf455b Add a mechanism by which the serial port can be forced on always regardless of the config setting. (useful for nano+vga setups) 2014-02-14 09:58:17 -05:00
Renato Botelho
aea33635c0 Add https to update URLs and replace RELENG_8_3 by RELENG_10_0 2014-02-14 08:19:17 -02:00