mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,726 Commits 27 Branches 53 Tags 494 MiB
e75a787fca
Commit Graph

12469 Commits

Author SHA1 Message Date
PiBa-NL
783f1ee210 carp, provide a way to 'permanently' set carp to 'maintenance mode' (advskew 254) persisting a reboot 
Option to set CARP interfaces to 'maintenance mode', persisting through a reboot so the primary machines stays as backup/inactive.
This is required when there are some problems (possibly with the hardware) and the primary machine needs to be booted and checked again before becoming 'master'. Currently it will take back the master state during reboot even though there might still be problems or some re-configuring to do.

p.s. it is for some reason not possible to reset advskew back to '0'.. should that number be removed as an option, and use 1 as a minimal value ?
 2014-03-30 00:09:30 +01:00
Warren Baker
f66e049aa5 Add privileges 2014-03-29 15:06:32 +02:00
Warren Baker
5bb1c49527 Reflect the service name when starting it 2014-03-29 14:59:07 +02:00
Warren Baker
4e8e8cc80e Add localhost as always allowed and ensure to include the access lists 2014-03-29 14:52:33 +02:00
Warren Baker
58d00e65c9 Write out the access list correctly 2014-03-29 14:47:43 +02:00
Warren Baker
16a3108ff2 Configure acls for local networks and ensure listening interfaces are correctly set 2014-03-29 12:58:38 +02:00
Warren Baker
0ae676cd0c Add missing new line 2014-03-29 11:23:56 +02:00
Warren Baker
ece2988fc2 Correct reference 2014-03-29 08:16:51 +02:00
Warren Baker
1b6e3c30fb Ensure TXT support on host descriptions actually works 2014-03-29 08:09:43 +02:00
Ermal
3ae8292396 Remove even unused pamd.conf 2014-03-28 23:13:34 +01:00
Ermal
e0c725641c Remove utterly old libmap.conf file 2014-03-28 23:09:44 +01:00
Ermal
c70a987869 Update disktab to FreeBSD 10 2014-03-28 23:06:02 +01:00
Ermal
1b60c644c9 Remove cvsup file from pfSense tree 2014-03-28 22:58:12 +01:00
Ermal
4cc0dce5cf Another remenant from old days 2014-03-28 22:57:01 +01:00
Ermal
362fdc4cc3 Remove remenants of pccardd from FreeBSD 5 2014-03-28 22:54:12 +01:00
Ermal
b110f1ba98 Update protocols file as well 2014-03-28 22:45:54 +01:00
Ermal
2c9325f6a1 Remove unused files 2014-03-28 22:34:35 +01:00
Ermal
a02fa5ec3c Do not use the version_kernel ad version_base files since they are not relevant anyway 2014-03-28 22:34:01 +01:00
Ermal
255596d901 Use proper variable name for the interface 2014-03-28 16:41:38 +00:00
Ermal
fe291564ea Correct check that was broken even before to actually make the ieee8021x enable from proper setting. Reported-by: https://forum.pfsense.org/index.php?topic=74013.0 2014-03-28 15:19:39 +00:00
Ermal
59c0272ec7 Log everything when selected to do so 2014-03-26 20:55:36 +00:00
Ermal
e047c72a70 Correct the generation of antifpoof rules with tracker. Also honor the log directive. While here remove a duplicate antispoof declaration further down 2014-03-26 20:28:10 +00:00
Ermal
2553d943aa Give each rule hardcoded on the ruleset a tracker so log entries give up proper results there 2014-03-26 19:17:17 +00:00
Ermal
b305f79584 Make this a global so no errors occur 2014-03-26 16:54:25 +00:00
Chris Buechler
f3109faca5 send crash reports via HTTPS 2014-03-26 03:40:20 -05:00
Renato Botelho
000a8d1dcd Change default charset on pages to utf-8 2014-03-25 14:44:41 -03:00
Renato Botelho
6fba8620e5 Merge pull request #1031 from ayvis/master-br-patch 
replaced uppercase html tags with lowercase
 2014-03-25 14:35:55 -03:00
Renato Botelho
8702dceaab Merge pull request #1035 from packetwerk/rc_permissions 
fix permissions on two rc scripts
 2014-03-25 05:54:42 -03:00
Franco Fichtner
ced541bb82 fix permissions on two rc scripts 2014-03-25 09:46:22 +01:00
Ermal
0fcae2eca8 Fixes #3543, correct the typo in spelling 2014-03-24 20:44:11 +00:00
Ermal
cfa53879d6 While here escape the passed valuye to avoid problems with input 2014-03-24 20:14:19 +00:00
Ermal
3b68d29cb2 Somehow these got changed to /usr/local/sbin/ipfw instead of /sbin/ipfw 2014-03-24 20:07:21 +00:00
Ermal
375eba1448 Fix this for master 2014-03-24 19:58:14 +00:00
Renato Botelho
dae77fe374 Fix deletion of ipfw rules and pipes for passthru mac, it fixes #3538 2014-03-24 16:26:16 -03:00
Ermal
e26e5e256f Make this more usable by putting a delimiter in there 2014-03-24 21:01:56 +01:00
Ermal
543c91ffa3 Also configure log levels any time the daemon is restarted. 2014-03-24 20:36:42 +01:00
Ermal
b7b3bc7113 Try to put the connection name in the logs for easy identification 2014-03-24 20:35:29 +01:00
vsquared56
2a08b81457 Return full issuer for DN with multiple attribute values 
e.g. CN=Some Root CA,OU=Certificates Department,OU=(c) Copyright SomeCorp,O=SomeCorp,C=US
 2014-03-24 02:17:41 -05:00
Warren Baker
ae5bbb6499 Fix file name for domain overrides and ensure trust anchor is referencing the correct file. 2014-03-21 20:07:40 +02:00
Warren Baker
19b1ea6c54 Use the correct xml tag to check against 2014-03-21 20:02:39 +02:00
Warren Baker
75e6d1b2f4 Only display config title if option is enabled 2014-03-20 21:59:51 +02:00
Warren Baker
be5aa31086 Rather put forwarding for DNS servers into the configuration file 2014-03-20 21:57:37 +02:00
Warren Baker
d12889b0c2 Ensure if port is configured it is then used 2014-03-20 21:34:00 +02:00
Warren Baker
d5ee020872 Add privileges for accessing DNS Resolver 2014-03-20 21:34:00 +02:00
Ermal
1c62178aca Use array_flip even for the package parsers 2014-03-20 19:28:07 +00:00
Ermal
1b34f8a73f Add require_once where needed to avoid redeclaration from nested includes 2014-03-20 19:26:41 +00:00
Ermal
00a6fcb7fb Configure first the vhid and than pass the vhid when configuring the carp this makes the ip assigned to carp as well 2014-03-20 18:54:51 +00:00
Ermal
a63e5eadef Remove balancing reference that does not exist anymore 2014-03-20 18:38:32 +00:00
Ermal
e3b98f81d1 Do not garble the error logging message 2014-03-20 16:19:15 +00:00
jim-p
8b650e57d6 Avoid placing an empty "interface listen" directive in ntpd.conf 2014-03-20 12:09:16 -04:00
Ermal
bd53b624d4 Try to restore last working ruleset rather than staying without configuration at all 2014-03-20 15:59:12 +00:00
ayvis
91f026b02c replaced uppercase html tags with lowercase 
js files saved as UTF-8 / LF
language="JavaScript" deprecated, replaced with type="text/javascript"
 2014-03-19 23:38:56 +01:00
Ermal Luçi
f3bdba41f7 Merge pull request #907 from PiBa-NL/openvpn_client_usercredentials 
openvpn, allow for entering client user credentials in the WebGUI
 2014-03-19 16:50:01 +01:00
Renato Botelho
c3e4ef746f Merge pull request #953 from N0YB/Gateway_Quality_RRD 
Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set.
 2014-03-19 12:15:17 -03:00
ayvis
1d7ba68396 replaced <br>, <br/> with <br /> in ANSI encoded files. Converted these files to UTF-8 2014-03-18 16:09:05 -03:00
Ermal
d5d22d6e36 Disable default allow incoming rules for 6to4 and 6rd interfaces. This rule unintentionally allows all services on the interface to be reachble and maybe more! 2014-03-17 21:24:58 +00:00
Renato Botelho
7f7626ba44 Merge branch 'master-br' of https://github.com/ayvis/pfsense into ayvis-master-br 2014-03-17 11:17:29 -03:00
Chris Buechler
9c3b8c6edb fix typo 2014-03-14 20:12:34 -05:00
Chris Buechler
34e2973ed9 standardize URLs 2014-03-14 19:33:03 -05:00
Chris Buechler
e1a456e6a8 standardize URLs 2014-03-14 19:30:56 -05:00
Chris Buechler
0734024c9e standardize URLs 2014-03-14 19:28:10 -05:00
Chris Buechler
5775f32451 standardize URLs 2014-03-14 19:18:17 -05:00
Chris Buechler
184016fcb7 standardize on https on www.pfsense.org 2014-03-14 19:15:44 -05:00
Chris Buechler
ef459eb700 standardize on https://www.pfsense.org, point to packages.pfsense.org 2014-03-14 19:10:27 -05:00
Chris Buechler
5721595b8d standardize on https://www.pfsense.org 2014-03-14 19:08:43 -05:00
Ermal
0390090465 Make the Additional tags that may be supplied compliant with new schema 2014-03-14 21:06:37 +00:00
Ermal
6d84c956e0 Make the parser more efficient to test for keys rather than searching inside the array 2014-03-14 21:02:44 +00:00
Renato Botelho
ffd17097a7 Unbreak listtags(), it should return regular array 2014-03-14 17:47:03 -03:00
Ermal
703b1ce1c5 Correct variable name, while here unset some large var 2014-03-14 20:35:39 +00:00
ayvis
8cd558b61b xhtml Compliance 
replaced <br>, <br/> and </br> with <br />
 2014-03-14 21:24:03 +01:00
Ermal
20dad315ae Provide upgrade code after changes done for Ticket #3441 2014-03-14 10:42:35 -03:00
Renato Botelho
b824ff8d99 Merge pull request #1025 from florian-asche/patch-5 
Update dyndns.class
 2014-03-13 20:20:46 -03:00
Florian Asche
7dc42e4ac8 Update dyndns.class 2014-03-13 22:57:28 +01:00
PiBa-NL
3fe73243bf fix plugin method for packages to allow for multiple plugins in an 'item' array as 'plugin' is not allowed as array item by xmlparse.inc 2014-03-13 21:58:26 +01:00
Chris Buechler
4db99d5baf set package URL to https://packages.pfsense.org 2014-03-13 02:46:21 -05:00
Chris Buechler
1b92cc6149 use xmlrpcbaseurl here too, not product_website 2014-03-13 02:43:01 -05:00
Chris Buechler
f5e09d9201 we actually use xmlrpcbaseurl here, not product_website 2014-03-13 02:18:51 -05:00
Renato Botelho
f049d45e0a Merge pull request #1022 from PiBa-NL/carp_notification 
rc.carpmaster/rc.carpbackup notification method for packages.
 2014-03-12 18:35:27 -03:00
Florian Asche
cd8f7eee0e Update dyndns.class 
Only use IPv4_only function if ipv6 is false
 2014-03-12 22:31:53 +01:00
Ermal
d84faccb60 Add removed file to obsolete list 2014-03-12 18:49:57 +00:00
Ermal
8b4abd5932 More removal of racoon from referenced in sources 2014-03-12 18:48:25 +00:00
Ermal
1dcb00bb71 Remove remeants of racoon 2014-03-12 18:44:51 +00:00
Ermal
3eeac25687 Generate nat rules for ipsec when needed 2014-03-12 18:42:43 +00:00
Ermal
72a8c829fd Be more efficient, and ordered about thae tags and also syncrhonize tags with xmlreader 2014-03-12 16:34:38 +00:00
Ermal
b79ea46a95 Make this a bit more smart rather having the penalty going over explode 2014-03-12 16:19:50 +00:00
Ermal
055fa9e354 Try a different strategy for fixing #3514 just send a HUP to dhcp6 to get it to reload. 2014-03-12 14:49:35 +00:00
PiBa-NL
331166a85c -renamed function to pkg_call_plugins 
-added is_array()
-added function header text
-replaced fixed 'plugin_carp' by $plugin_type to allow for generic use
 2014-03-12 15:48:41 +01:00
PiBa-NL
eaee3af65b rc.carpmaster/rc.carpbackup notification method for packages. 2014-03-12 00:31:52 +01:00
Ermal
f0014c6499 Make this a bit more efficient 2014-03-11 15:40:27 +00:00
Renato Botelho
ac28b62eb8 Merge pull request #1018 from florian-asche/patch-3 
Update services.inc
 2014-03-11 09:42:48 -03:00
Renato Botelho
6b13f8d259 Do not delete linklocal address 2014-03-11 08:38:30 -03:00
Florian Asche
e6d708fe68 Update dyndns.class 
IPv4 ONLY? YEAH ;)
 2014-03-10 22:15:39 +01:00
Florian Asche
181386d613 Update services.inc 
Added CURL setops from dyndns.class
 2014-03-10 22:11:31 +01:00
Florian Asche
3c6f29c0b5 Update services.inc 
IPv4 ONLY
 2014-03-10 22:06:35 +01:00
Renato Botelho
56b4084469 Merge pull request #1012 from florian-asche/patch-1 
Update services.inc
 2014-03-10 16:41:36 -03:00
Florian Asche
5244c510a2 Update services.inc 
Prepared to make $hosttocheck configureable
 2014-03-10 19:42:41 +01:00
Florian Asche
5d1185ced7 Update services.inc 2014-03-10 19:18:21 +01:00
Ermal
b67e9e626c Fix for now 'IPv6 - LAN looses Prefix after link event'(forums) with a not elegant solution but works. Probably dhcpv6 client should solve this by itself and generate and event for it. For now just bump dhcpv6 client again to have the prefix interface reconfigured. 2014-03-10 15:12:53 +00:00
Renato Botelho
d130cd4674 pfSense_interface_deladdress() only knows how to delete an ip address, not a subnet. It should fix #3513 2014-03-10 10:17:33 -03:00
Florian Asche
09cb9dee69 Update services.inc 
Added missing usepublicip with dyndnsCheckIP
 2014-03-10 00:35:20 +01:00
Ermal
fac36dfddf Make the voucher auth through xmlrpc work. 2014-03-07 17:49:54 +00:00
Chris Buechler
fe3553d16d default openssl to 2048 2014-03-06 16:10:33 -06:00
Ermal
631597493e Better just use start here seems to be more reliable 2014-03-06 22:59:40 +01:00
Ermal
d623693ca0 Correct the step for phase2 algos as well 2014-03-06 21:38:50 +01:00
Ermal
d60eea555e Correct the generation of the config for mobile tunnels as well 2014-03-06 21:38:50 +01:00
Renato Botelho
8c3cba99f0 Merge pull request #995 from ayvis/master-syntax-errors 
syntax errors correction
 2014-03-06 16:57:37 -03:00
Chris Buechler
ad55629bc9 update link for 2.2 2014-03-06 13:19:29 -06:00
Ermal
f37e37bbdd Remove not needed anymore function 2014-03-06 20:19:38 +01:00
Ermal
9601df8ad5 Use a step of 64 here too to comply with what the daemon can parse/understand 2014-03-06 20:02:06 +01:00
Chris Buechler
da2ec3361e bring up appropriate interface for GRE/GIF. Ticket #3281 2014-03-06 00:51:20 -06:00
ayvis
56b490bad3 syntax errors corrected 2014-03-04 22:09:02 +01:00
Renato Botelho
ebe2b407b3 Merge pull request #984 from phil-davis/master 
Return GWG IP protocol (version) when no gateway IP
 2014-03-04 10:03:11 -03:00
Renato Botelho
faddd38108 Merge pull request #992 from Doncuppjr/master 
Add UEFI support to Network Boot options.
 2014-03-04 09:52:29 -03:00
Renato Botelho
ff9c579f37 Fix syntax 2014-03-03 18:00:08 -03:00
Renato Botelho
48047e3fdc s/unlink/unlink_if_exists/ 2014-03-03 16:21:23 -03:00
Donald A. Cupp Jr
fdb116a97b Put added option in dhcp config instead of dhcpv6 config. 
Use empty function instead of <> "" for null test in dhcp network booting config section.
	modified:   etc/inc/services.inc
 2014-03-03 11:20:44 -08:00
Renato Botelho
d07bc322c5 Remove broken 'dynamic6' gateway, we already have ipprotocol to tell us the IP version, leave it more simple using only 'dynamic'. It helps #3484 2014-03-03 13:31:01 -03:00
Renato Botelho
bf36dafa26 Fix typo on var name 2014-03-03 13:26:36 -03:00
Donald A. Cupp Jr
c10d55ba64 Add missing option code for uefi booting 
modified:   etc/inc/services.inc
 2014-03-02 23:14:43 -08:00
Donald A. Cupp Jr
c636d5172b Merge branch 'master' of https://github.com/Doncuppjr/pfsense 2014-03-02 21:59:35 -08:00
Charlie Root
7023c602bd Added support for UEFI booting to Network Booting configuration. 
modified:   conf.default/config.xml
	modified:   etc/inc/services.inc
	modified:   usr/local/www/services_dhcp.php
 2014-03-02 21:47:39 -08:00
Chris Buechler
3d8e954b3f sync up ALTQ-capable interfaces list 2014-03-01 16:55:22 -06:00
jim-p
68169a559e Wrap this in an is_array() test, or else if you have no manually configured DNS servers, saving the DHCP settings produces a PHP error. 2014-03-01 13:07:04 -05:00
Renato Botelho
dadb484675 Merge pull request #986 from andrespetralli/master 
Re-enabling static lease updates
 2014-02-28 15:46:28 -03:00
Andres Petralli
3cdef18753 Re-enabling static lease updates 2014-02-28 08:59:19 -08:00
Ermal
b31247af70 Small correction for clear code 2014-02-28 14:14:49 +00:00
Ermal
cdeaf91e14 Ticket #3484 Correct the case for GRE tunnels as well since they behave the same. GRE seems to need the prefixlen 128 specified all the time so do it explicitly to be on safe side 2014-02-28 14:11:46 +00:00
Ermal
d2c598080a Ticket #3484 Note that for now prefixlen is useless in ipv6 tunnels. IPv4 accepts them 2014-02-28 13:52:30 +00:00
Ermal
c32a6b82a7 Fixes #3484. Provide a dynamic gateway for gif v6 tunnels so it can be used on firewall rules etc. The guide for setting up this tunnels on docs need to change to leave the gif interface as none type. People upgrading need to fix this themselves with a not on release notes. This can be fixed if the kernel condition is relaxed to allow setting the prefixlen on the tunnel as ipv4 2014-02-28 13:49:44 +00:00
Phil Davis
f60003faf1 Return GWG IP protocol (version) when no gateway IP 
This is a resubmit of an older pull request I had closed. It came up again in the forum, with a user setting up a VM environment and wondering why he cannot make policy-routing rules to a gateway group. The gateway group names did not display because all his WANs were down at the time and so the existing code was too dumb to determine the IP protocol (version 4 or 6) when none of the WANs in the gateway group actually have an IP address yet.
 2014-02-27 18:54:51 -08:00
Ermal
c7fbdd6c8e Make the IPSec status page work with strongswan 2014-02-27 17:39:19 +01:00
Ermal
2124fad4d0 Oops forgot the query message 2014-02-26 16:26:40 +00:00
Ermal
df0878b018 Add a function to read the status of connections/SAs/SPDs from smp plugin of StrongSWAN. No need to go through the setkey dumps 2014-02-26 16:24:19 +00:00
Ermal
ddfe5e4380 Make xmlreader parse any document and properly consider listtags specified and attributes. Probably should be made the default due to its speed. 2014-02-26 14:25:30 +00:00
Ermal
8ffb5ccdee Parse even attributes when present 2014-02-26 11:55:48 +00:00
Ermal
c6efc8fd15 Push log changes for IPSec and fix generation of strongswan.conf and ipsec.secrets to be properly considered 2014-02-25 11:10:01 +01:00
Ermal
7335fa5380 * Correct logging to syslog and proper file for ipsec from strongswan 
* Use proper commands to reload strongswan rather than just the daemon
 2014-02-25 11:10:01 +01:00
Phil Davis
3ad6b569d6 Fix #3483 only use IPv4 DNS servers in DHCP v4 conf 2014-02-24 19:40:30 -08:00
Renato Botelho
04f5393f49 Make is_linklocal case-insensitive and fix #3433 2014-02-24 16:03:34 -03:00
Renato Botelho
b5388f033c Fix #2302, save custom uploaded l7 pattern files on config.xml and replicate it to slave 2014-02-24 12:25:59 -03:00
Renato Botelho
732b160dba Set variable after make sure it's defined and has elements 2014-02-24 12:25:59 -03:00
Renato Botelho
420b45385a Fix whitespace and indent 2014-02-24 12:25:59 -03:00
Ermal
62f965689c Properly detect when there are issues with communicating with syncip and to use the local DB for this. Otherwise detect if the remote says the voucher is not valid say its not valid. 2014-02-24 14:57:04 +00:00
Ermal
ac420abd1d Properly compile the query to insert the values. Pointy-hat: myself. While here respect the redirurl when passed to portal_allow and use proper function to do redirection. 2014-02-24 14:39:31 +00:00
Renato Botelho
037e7a6210 Merge pull request #959 from stilez/patch-3 
Tighten is_subnet() functions
 2014-02-24 07:57:29 -03:00
Ermal
34340c5649 Ticket #2627. Just pass the array over no need to traverse it 2014-02-21 13:45:19 +00:00
Ermal
929776169f Fixes #2627. When an interface goes down try to shut the RAs and dhcpd6 service on that interface 2014-02-21 13:23:29 +00:00
Ermal
d6101e2316 Avoid recursion of convert_real_interface_to_friendly_interface_name with get_parent and on linkup of parent interface properly configure especially useful on ppp type links 2014-02-21 11:58:11 +00:00
Renato Botelho
ad43847b97 Merge pull request #960 from stilez/patch-4 
Tighten is_validaliasname()
 2014-02-21 08:01:13 -03:00
Ermal
ef60dfa541 Be friendly to memory 2014-02-21 10:03:48 +00:00
Ermal
4d3277443f Fix problem with the voucher synching that was introduced during conversion to zones 2014-02-21 10:03:38 +00:00
stilez
4ad9a1e7ed Tighten is_validaliasname() 
is_validaliasname() treats "empty string" as a valid alias name, it probably shouldn't.

I suspect it also should not allow purely numeric names ('53'), or pure underscore ('_'), or reserved port names ('tcp', 'http'), as valid alias names for other things. Too much risk of issue/ambiguity which isn't helpful in a router/security device, and no obvious upside to it. 

Example: - Suppose I define '53' as an alias for '54' or 'tcp' as an alias for 'ssh' or 22 on some firewall..... which I can because is_validaliasname() will validate both? It's a subtle change, hard to spot as rules will look correct, easy to cause problems or wilfully misuse.)

"Pure numeric" aliases are also worryingly ambiguous since many other things that can be entered or appear on the GUI, such as port numbers, can be entered or will show as pure numeric or an alias, so there's scope for ambiguity which it means. (is '53' the port 53, or the alias 53 which I've redefined to mean 1053?)

This PR generally tightens the logic and regex expressions (shorter syntax, no '?:'s or '?' groups), and slightly but sanely limits valid alias names to remove ambiguity - specifically it bars 4 kinds of string (empty string, pure numeric, pure underscore, and PHP reserved names that are already hard-coded aliases for specific protocols/services) from being valid alias names any more, as a result. 

		(I think this is sane, if you agree!)
 2014-02-21 02:49:09 +00:00
stilez
a5e2a35f03 Tighten is_subnet() functions 
The is_subnet(), is_subnetv4() and is_subnetv6() functions have significant issues in their coding logic.

Issues:

1) Functions use is_numeric(), so they validate invalid bitcount parts such as '1.1.1.1/6.5' or '::8000/94.7' as valid subnet strings

2) Validation explodes to a list of 2 variables rather than testing the whole string, so it's possible to craft a malicious string or mis-enter text such as "::8000/24/;\nARBITRARYTEXT;", or any valid subnet followed by a third '/' character followed by arbitrary text, which always validates as permitted data. In v2.x this allows arbitrary or malformed text placement into core config files such as pf.conf, f/w tables, and probably exec() strings, from the GUI (reported previously)

3) is_subnet() and is_subnetv6() return false for the valid subnet /0 as a CIDR, although technically this is allowed and valid as a subnet (it may have unambiguous and useful meaning in a router or security context).

The existing code is easier to rewrite than fix. It's a lot shorter too. A single preg_match() does all the separating of valid subnet parts and identifies which if either type of subnet the string could be, by exactly matching EITHER (7-15 char string containing only 0-9.) OR (2-39 char string containing only 0-9a-f:) followed by '/' and (1-3 numeric digits). Depending which of the first two matches is non-empty, it then checks the "ip" part" and "numeric" part are each valid, and exits. Efficient and robust.

NOTE: - these functions returned a True/false value ( is_subnet() or !is_subnet() ). As any positive number evaluates in a Boolean sense to True, I have taken advantage of this to have "success" return 4 or 6 (not just "true") to say the type of subnet matched.  It's no extra effort or cost, and turns out to allow a lot of efficiency and code simplification elsewhere, since calling code that needs to validate a subnet *and* test if it's IPv4 or IPv6, a common situation, can now do this reliably with a single is_subnet() call:

  if (($sn = is_subnet($data)) {
      if ($sn == 4) 
         IPv4 handler code...
      else
         IPv6 handler code...
  } else
      error handler code...

I've used it here to write is_subnetv4() and is_subnetv6() to be single line near-aliases of is_subnet(), that just check the return value is indeed 4 or 6.
 2014-02-21 02:19:56 +00:00
Ermal
75aec77a87 Rather than having issues with not started radvd try to start radvd to discover by itself the prefix on the interface by using the special directive :: on the prefix declaration. Related to many tickets and forum posts 2014-02-20 23:36:20 +00:00
Ermal
8b731067d8 Correct obvious bug in IPv6.inc 2014-02-20 20:19:48 +00:00
Ermal
77148acc98 s/PEAR.php/PEAR.inc/ 2014-02-20 20:06:27 +00:00
Ermal
bf416e4996 Actually take latest one from github. It has some more checks and more execution time penalities but catches more errors 2014-02-20 20:05:37 +00:00
Ermal
03ab9b3028 Update IPV6.inc to latest 1.2.1 version 2014-02-20 20:00:01 +00:00
Ermal
7519cc29ae If set use the default bandwidth setting on the CP even for mac passthrough. Reported-by: https://forum.pfsense.org/index.php/topic,72761.0.html 2014-02-20 19:32:49 +00:00
Ermal
2e080989c4 Use the default bw specification if configured even for allowed ip and hostname. 2014-02-20 19:30:57 +00:00
N0YB
3f7f26ae16 Add the missing global $g 2014-02-20 10:37:57 -08:00
Ermal
315bdf65a1 Do some more error checking and put secondary radius attributes only if configured. Probably radius configuration should be merged with central server for logins! 2014-02-20 09:18:14 +00:00
Ermal
e570f0eb56 silence any errors 2014-02-20 09:02:55 +00:00
N0YB
d55cba63e7 Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set. 
Create gateway quality RRD with settings suitable for pfSense graph set,  since apinger uses default step (300) and other settings that are not so  good/consistent with the pfSense graphs set.

Originally Submitted as Pull Request #672.
Resubmitting to Master.
 2014-02-19 18:18:07 -08:00
stilez
4caa9574b4 Tighten is_numeric() 
Improvements:

1) avoids 'expensive' preg_match() and is a more exact test
2) fixes logic whereby an empty string or anything converted to an empty string, is deemed a valid 'numeric' value

(If an empty string can validate as numeric, it's possible that in some cases a number is expected and missing in a string, but not detected, causing malformed rules or subnet bitcounts, and unexpected issues or vulnerabilities)

 -- also moved code to a more logical place in the .inc while doing this, not mixed in between IP handling functions
 2014-02-20 01:53:01 +00:00
Ermal
ec7bc948b7 More code fixes for ntpd 2014-02-19 15:43:37 +00:00
Ermal Luçi
59c37391b9 Merge pull request #929 from nagyrobi/patch-3 
Update system.inc
 2014-02-19 16:37:01 +01:00
Ermal Luçi
a5240b7a84 Merge pull request #928 from nagyrobi/patch-2 
Update rrd.inc
 2014-02-19 16:20:48 +01:00
Renato Botelho
e09da6c266 Fix #3469 
Before downloading file to process urltable, there is a random wait
time between 5 and 60 seconds. Because of this, the difference between
file mtime and current time can be less than $freq * 86400 and it'll be
skipped. Add 90 seconds (60 of max random wait + 30 just to be sure) to
avoid skipping a file that should be updated
 2014-02-19 09:26:06 -03:00
Renato Botelho
869dfb664a Fix #3468, wording fix 2014-02-19 08:48:14 -03:00
Renato Botelho
96fc5388ac Merge pull request #945 from phildd/master 
Enhance interface gateway data entry descriptions
 2014-02-19 08:23:47 -03:00
Renato Botelho
5a47e9b12e Only add dhcpv6 client allow rules if ipv6allow is set 2014-02-18 20:31:47 -03:00
Renato Botelho
a60c6356ee Move 'allow dhcpv6 client' rules above block bogonsv6 ones, it should fix #3395 2014-02-18 16:00:17 -03:00
nagyrobi
617f9edf58 Update rrd.inc 
corrected path
 2014-02-18 16:07:09 +01:00
nagyrobi
0fd64e94fa Update system.inc 
Corrections made as requested
 2014-02-18 16:06:07 +01:00
nagyrobi
142f7393a8 Update system.inc 
Add new NTPd functions
 2014-02-18 15:12:43 +01:00
nagyrobi
1f3eff9b66 Update rrd.inc 
Add NTP graphing to RRD
 2014-02-18 15:06:27 +01:00
nagyrobi
43c4687b6b Update priv.defs.inc 2014-02-18 15:01:04 +01:00
Renato Botelho
9e875e0c00 Revert "Replaced gethostbyname() with gethostbynamel() to get a list of all IPs associated with the dns name and add them to the allowed list" 
This change is not needed, filterdns will handle it.

This reverts commit d460371416.
 2014-02-18 08:35:44 -03:00
Ermal
8c14707759 Do not do any operations on system libraries. Nowdays pbis are used and those do not break things by definition 2014-02-18 11:25:35 +00:00
Renato Botelho
8f821cbcd9 Merge pull request #891 from PiBa-NL/captive_disable 
captive portal, don't generate rules for a disabled portal
 2014-02-18 07:38:20 -03:00
Renato Botelho
aecb7a7928 Merge pull request #890 from N0YB/Gateway_Monitor 
Gateway Monitor Advanced Settings
 2014-02-18 07:31:26 -03:00
Renato Botelho
9305e21931 Merge pull request #904 from dv-user1/master 
Replaced gethostbyname() with gethostbynamel() to get a list of all IPs ...
 2014-02-18 07:15:06 -03:00
Ermal
adf1c3fa27 Revert "Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357" 
This reverts commit cb431dbf47.
 2014-02-18 09:26:01 +00:00
Ermal
c79f717a58 Really need the interface where v6 is running toa dd the gateway/route rather than the one used for the configuration. This Fixes #3357 2014-02-18 09:25:41 +00:00
Ermal
cb431dbf47 Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357 2014-02-18 08:59:42 +00:00
Ermal
2076dc46f1 Put a timeout of 30 seconds to aid with Ticket #3412 2014-02-17 20:00:26 +00:00
Ermal
ee9783e93e Move this global declaration to the proper file rather than backend code 2014-02-17 20:00:25 +00:00
Renato Botelho
bd94286059 Use correct parameter (bootfile-url) to configure netboot on DHCPdv6, it fixes #3421 2014-02-17 12:20:18 -03:00
Renato Botelho
547f1e6554 Fix typo on variable name and really add custom options for dhcpdv6 2014-02-17 12:20:18 -03:00
Ermal
11ad160eae Normally when an ip is set the interface comes up on BSD stacks. Though push this commit which Fixes #3281 2014-02-17 14:18:16 +00:00
Ermal
db9199d729 Whitespace fix 2014-02-17 14:18:15 +00:00
Renato Botelho
e4a4ec896f Grab exec result just to be careful 2014-02-17 11:11:23 -03:00
Ermal
6191b3215c Put a kludge for now which Fixes #3280. It should be improved later on to have proper handling and overloading of configuration functions 2014-02-17 14:03:42 +00:00
Ermal
bae729da39 Consider setting of noconcurrent login for passthrough expiry of users. Fixes #3340 2014-02-17 10:36:59 +00:00
Ermal
eae9130484 Merge 10 -> 10.1 and 10.1 -> 10.2 function upgrade since the recent changes done on 2.1.1 for Ticket #3441 2014-02-17 09:59:28 +00:00
Ermal
74a40221d6 Use the 11th column for the radius context rather than overriding the interim interval field with it. Fixes #3447 2014-02-17 09:34:14 +00:00
jim-p
bf4e62acc7 Add a knob to let the user select which console (video or serial) is preferred in cases where there are multiple consoles present. Also provide a way to force this preference. 2014-02-14 11:03:06 -05:00
jim-p
407fbf455b Add a mechanism by which the serial port can be forced on always regardless of the config setting. (useful for nano+vga setups) 2014-02-14 09:58:17 -05:00
Renato Botelho
aea33635c0 Add https to update URLs and replace RELENG_8_3 by RELENG_10_0 2014-02-14 08:19:17 -02:00
Renato Botelho
6635f5b90d Abort installation when pbi_add fails 2014-02-13 09:32:25 -02:00
Renato Botelho
25333e5a85 Obsolete old ipsec tools files 2014-02-12 12:08:41 -02:00
Ermal
ff3d516f3f Be specific on the authentication method to use since xauth-eap will be active as well 2014-02-12 15:05:44 +01:00
Ermal
ede14b2302 Correct script path 2014-02-12 10:42:48 +01:00
Ermal
6c576b2785 Remove references to racoon and correct some handling of ipsec configuration 2014-02-12 10:41:43 +01:00
Ermal
ecc379586e Remove copy paste leftover 2014-02-12 10:36:02 +01:00
Ermal
91287d1f46 If specified add authentication script configuration to strongswan.conf 2014-02-12 10:35:38 +01:00
Ermal
fe63645d95 Remove not used anymore parameters 2014-02-12 10:28:55 +01:00
Ermal
2a3e30575a Teach script to read authentication servers from environment 2014-02-12 10:13:09 +01:00
Renato Botelho
80d708deb6 Fix symlink calls adding full link name, it fixes issue reported at https://forum.pfsense.org/index.php/topic,72405.0.html 2014-02-11 12:30:33 -02:00
Ermal
443ba8c9e1 Properly set the configuration here based on https://forum.pfsense.org/index.php/topic,68531.0.html 2014-02-11 11:59:30 +01:00
Ermal
8c466abb74 Make improvement to the check 2014-02-11 10:30:50 +01:00
Phil Davis
6240ba7bd1 Check for tmp captiveportal dir before making it 
In forum: https://forum.pfsense.org/index.php/topic,72483.0.html
Warning: mkdir(): File exists in /etc/inc/system.inc on line 878
Not sure if you would rather call safe_mkdir here?
 2014-02-10 19:05:26 -08:00
jim-p
83491ba51c Declare $config global so we can test the pkg_nochecksig option 2014-02-10 13:55:01 -05:00
PiBa-NL
5f242576d3 openvpn, allow for entering client user credentials in the WebGUI 2014-02-09 19:23:25 +01:00
Francois Blanchette
d460371416 Replaced gethostbyname() with gethostbynamel() to get a list of all IPs associated with the dns name and add them to the allowed list 2014-02-07 15:11:58 -05:00
Phillip Davis
974fb32ccd Enhance interface gateway data entry descriptions 2014-02-07 09:50:06 -08:00
jim-p
59c6e2181f Add specific permission for easyrule. 2014-02-07 11:56:38 -05:00
Renato Botelho
e5b5e29c3b Add support for signed PBI, help ticket #3365: 
- Add an option to allow user to accept unsigned packages
- The only missing part is public key, that needs to be added to
/var/db/pbi/keys/pfSense.ssl
 2014-02-07 10:41:41 -02:00
jim-p
d292bd8d60 Fix test, allows restoring last backup in the list. Fixes #3438 2014-02-06 14:02:03 -05:00
Ermal
496acde137 First swing at converting from racoon to StrongSWAN. 
It allows to use existing configurations on xml to generate StrongSWAN configurations.
So its only IKEv1

* Missing support for dynamic ips(hostnames)
  - resolver plugin of StrongSWAN needs to be configured in strongswan.conf
* Authentication plugin with pfSense authentication framework
  - New plugin almost completed

* More testing hence this being pushed now to have more broader look

TODO
* Integrate IKEv2
* Move dynamic IP allocation to an SQLite backend
* Provide more options in authenticating as a client(initiator)
* Restrict interfaces where StrongSWAN listens for incoming connections to only those configured

FUTUTE
* Move all configuration to SQLite backend
* Integrate more authentication scenarios of IKEv2
 2014-02-06 12:49:24 +01:00
Renato Botelho
b3e1ccb5b8 escapeshellarg() is not required here 2014-02-05 12:29:53 -02:00
Warren Baker
5293c5c71a Teach php-fpm about our required environment path 2014-02-05 15:58:07 +02:00
Renato Botelho
275f4b5ad4 Revert "Set PATH before call pbi related binaries" 
This was pushed by mistake

This reverts commit 4c9bda43f5.
 2014-02-05 11:50:46 -02:00
Renato Botelho
3820702948 Silent recently added symlink() calls 2014-02-04 18:32:20 -02:00
Renato Botelho
7b27b18bef Fix some wrong escapeshellarg() calls 2014-02-04 18:14:41 -02:00
Renato Botelho
552f5a6a5f Use unlink_if_exists or @unlink to avoid PHP errors when file doesn't exist 2014-02-04 17:01:20 -02:00
Renato Botelho
873c1701a8 Add escapeshellarg() calls on exec parameters. While I'm here, replace some exec() calls by php functions like symlink, copy, unlink, mkdir 2014-02-04 12:34:41 -02:00
Renato Botelho
4f188f54ab Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
1d9b51c6b0 Add path for sysctl, also use -n param instead of awk 2014-02-04 12:34:41 -02:00
Renato Botelho
306f855610 Simplify logic 2014-02-04 12:34:41 -02:00
Renato Botelho
f177717459 Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
8340d95653 Add {} between variables inside quotes 2014-02-04 12:34:41 -02:00
Renato Botelho
e6867c81d1 Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
3f4bd83b5a Add {} between variables inside quotes 2014-02-04 12:34:41 -02:00
Renato Botelho
4c9bda43f5 Set PATH before call pbi related binaries 2014-02-04 12:34:41 -02:00
jim-p
ca79de534b Using "limited" for ntp in this way denies client access. Issue #3384 2014-02-03 09:34:06 -05:00
Renato Botelho
03734bf71e Remove arch from fall back url since it's a single dir now 2014-01-30 15:46:13 -02:00
Warren Baker
327a4fc65f Make sure unbound starts 2014-01-30 12:03:20 +02:00
Warren Baker
8fccab671f Make sure ACLs are saved correctly 2014-01-29 21:51:33 +02:00
Warren Baker
1319d0f3f3 Add new xml array 2014-01-29 21:08:21 +02:00
Warren Baker
56a87b19c0 Add additional functionality for stats and preconfigure variables 2014-01-29 17:07:13 +02:00
Warren Baker
3b95d9ece3 Add EDNS support for to resolv.conf 2014-01-29 17:06:42 +02:00
Warren Baker
923e49b1ce Start and configure Unbound on boot 2014-01-29 13:29:46 +02:00
Warren Baker
175dc861c2 Add Unbound service configuration 2014-01-29 13:29:32 +02:00
Warren Baker
6671b7cde6 Add chroot for Unbound 2014-01-29 13:27:55 +02:00
Warren Baker
f20afeb6d8 Add Unbound code 2014-01-29 13:27:42 +02:00
Warren Baker
33232486d6 Add Unbound to the services list 2014-01-29 13:26:40 +02:00
Warren Baker
6d9a572da5 Add Unbound to the system password and group files 2014-01-29 11:29:10 +02:00
Renato Botelho
f4a4bcbc4c Fix typo on variable name, it fixes #3414 2014-01-28 17:01:02 -02:00
PiBa-NL
452eb31ed5 captive portal, don't generate rules for disabled portal 2014-01-25 21:06:08 +01:00
Renato Botelho
fbdd046649 Obsolete openssl from ports files and also base nsupdate 2014-01-25 16:26:24 -02:00
Renato Botelho
22cc6582a1 Fix nsupdate path 2014-01-25 14:56:53 -02:00
N0YB
3c6787ed65 Gateway Monitor Advanced Settings 
Exposes 3 additional apinger configuration options in the gateway monitor advanced section which can either be set manually, calculated based on interval, or use the hard coded defaults.
	1) Avg Delay Samples
	2) Avg Loss Samples
	3) Avg Loss Delay Samples

The current hard coded defaults are okay for a short interval such as the 1 second default.  But do not work well when a longer interval is required.
 2014-01-24 22:28:18 -08:00
Renato Botelho
c241a3e89d Merge pull request #888 from PiBa-NL/pkg-utils-append-log 
pkg-utils do not clear first part of installation log.
 2014-01-24 17:33:06 -08:00
PiBa-NL
206c15cc91 pkg-utils do not clear first part of installation log. 2014-01-25 00:14:21 +01:00
Renato Botelho
2ec95f1ffb Fix openssl path 2014-01-24 08:33:31 -02:00
Renato Botelho
5459701254 Replace regex by explode as suggested by Ermal 2014-01-21 16:49:35 -02:00
Renato Botelho
613a94b31b Fix typo on variable name 2014-01-21 16:38:14 -02:00
Ermal Luçi
b4d772dc03 Correct this i thought i already did. Thanks-to: Phil Davis for spotting 2014-01-20 19:59:16 +01:00
Ermal
d760445e72 Do not need to go in the internet world to start a package 2014-01-20 15:09:52 +00:00
Ermal
44b1929824 * Do not call stop service in the start command. 
* Add some more checks into the functions to avoid errors
* Also silence some output that can cause issues
 2014-01-20 15:00:27 +00:00
Renato Botelho
770a7759f0 Fix FreeBSD version detection for 10.x 2014-01-20 10:53:09 -02:00
Renato Botelho
c42d721bb9 Obsolete old ntp binaries 2014-01-20 09:35:05 -02:00
jim-p
fdfa8f43ed ports ntp moved to sbin, follow 2014-01-15 12:35:50 -05:00
jim-p
706ba0e4b1 Use "disable monitor" in NTP config to mitigate CVE-2013-5211. 2014-01-10 11:41:49 -05:00
Renato Botelho
6b66073164 Add 'limited' to ntpd restrict list to workaround CVE-2013-5211. It fixes #3384 2014-01-07 08:58:33 -02:00
jim-p
4410f6990a This might also say "icmpv6" here and lead to a bad rule. 2014-01-06 12:09:52 -05:00
Renato Botelho
81f1947666 Add an option to force a gateway to be down, it fixes #2847 2014-01-06 14:11:14 -02:00
Ermal
4e6405b9f8 Oops correct php syntax 2014-01-03 15:56:53 +00:00
Ermal
21f82ab623 Do not allocate the same pipe to everyone rather give each person its own! 2014-01-03 15:05:50 +00:00
Ermal
f38b383b7c Use empty here for testing even if the setting is unset 2014-01-03 14:53:36 +00:00
Ermal
a3a1b24ebf Move to zerocopy_enbale for bpf to optimize bpf logging which uses bpf interface. This should increase the general performance since pflog is always enabled. 2014-01-03 13:24:28 +00:00
Tuyan Ozipek
2bb933456e Update copyright_years to be calculated on the fly. 2014-01-02 10:57:30 -05:00
Renato Botelho
0350084d40 fix syntax 2014-01-02 09:13:17 -02:00
Renato Botelho
2a45e05fc5 Fix filter regex 2014-01-02 08:41:32 -02:00
blagynchy
9dc3f2bbb9 Happy New Year 2014! 
Optimal: Just updating the copyright years;

I wish to all of you all of health, happiness and good luck of earth to be in your hands for the new year! Other will come up later :)

And make pfsense better then before, more flexible for management/viewing from web (3rd party) using samba,ftp,whois,hw temp..etc.

Best regards.
 2014-01-02 01:54:39 +02:00
Ermal
31dce43084 Upgrade all firewall rules to include a tracker field. Add a tracker field even for nat for later usage while here. 2013-12-31 13:28:35 +01:00
Ermal
2006d7a4f0 Generate a tracker id for the filter rules for now. Maybe for nat rules as well? 2013-12-31 13:23:21 +01:00
Ermal
ba1c86d950 Remove scrub as well 2013-12-30 16:14:21 +00:00
Ermal
32fd170342 Remove even negating nat rules 2013-12-30 15:27:17 +00:00
Ermal
a03dfc60b0 Correct matching for single rule. Somehow the egrep did not work there! 2013-12-30 14:47:25 +00:00
Ermal
b80e29e486 Speed up a bit rule number identification by avoiding going into kernel but using the rules parsing of pf which gives the same effect. 2013-12-30 14:34:18 +00:00
Renato Botelho
239024ee66 Merge pull request #866 from andrespetralli/master 
Enabling advanced RFC 2136 configuration for DHCPd service
 2013-12-30 03:56:34 -08:00
Ermal
5a89049022 Modernize a bit the sshd sart file 2013-12-27 21:51:06 +00:00
Ermal
9be0ec8a0e Use the check properly! 2013-12-27 21:38:40 +00:00
Ermal
635c00d36d Correct the check to what was intended 2013-12-27 21:35:21 +00:00
Ermal
f6d89471d3 Make sense of interface mtu handling code. No need to do unneeded operations. This fixes slow boot times and proper handling of mtu for vlans though some work or better model is needed for other interface types. Manual merge of 53555bf2f7 2013-12-27 20:49:29 +00:00
jim-p
aaa78416a7 Add sshd service to list (if enabled) 2013-12-27 13:10:50 -05:00
Renato Botelho
ee574a9e33 Fix a bug introduced in commit 06b8d43c that breaks return_gateways_array() called with $disabled == false 2013-12-27 12:02:35 -02:00
Renato Botelho
63fee5762d No reason to set the same value to ipprotocol 2013-12-27 11:55:36 -02:00
jim-p
5c427ce7e8 Add support for local (push route) and remote (iroute) network definitions in an OpenVPN client-specific override entry. 2013-12-26 16:41:24 -05:00
jim-p
7cbfc26544 Add a "status" subcommand to the svc php shell script. 2013-12-26 15:47:23 -05:00
jim-p
c7a3356e6b Add a setting to allow the user to specify the clog file size so more (or less) entries may be kept in the raw logs. Retain previous default size values if the user has not specified a preferred size. Files can only be resized when initialized, so provide a "Reset All Logs" button as well to force clear all logs and set them up at the new size. 2013-12-26 15:27:40 -05:00
Ermal
7b03748b37 Correct the php-fpm configuration generation 2013-12-26 19:27:40 +00:00
Renato Botelho
3f248cb65a Fix #3354, savecore -C only expects dumpdev 2013-12-26 16:10:33 -02:00
jim-p
e1ebe9e226 Add an option for users to be able to adjust how many configuration revisions are kept in the local backup cache. 2013-12-26 12:53:30 -05:00
jim-p
bfe615ee53 Show backup file size in config history. 2013-12-26 11:07:13 -05:00
Renato Botelho
fd34b8b5c6 Fix syntax 2013-12-24 15:27:47 -02:00
Ermal
59257969ad Sprinkle some more unsets 2013-12-24 15:51:08 +00:00