mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,726 Commits 27 Branches 53 Tags 494 MiB
e75a787fca
Commit Graph

12469 Commits

Author SHA1 Message Date
Ermal
bd53b624d4 Try to restore last working ruleset rather than staying without configuration at all 2014-03-20 15:59:12 +00:00
ayvis
91f026b02c replaced uppercase html tags with lowercase 
js files saved as UTF-8 / LF
language="JavaScript" deprecated, replaced with type="text/javascript"
 2014-03-19 23:38:56 +01:00
Ermal Luçi
f3bdba41f7 Merge pull request #907 from PiBa-NL/openvpn_client_usercredentials 
openvpn, allow for entering client user credentials in the WebGUI
 2014-03-19 16:50:01 +01:00
Renato Botelho
c3e4ef746f Merge pull request #953 from N0YB/Gateway_Quality_RRD 
Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set.
 2014-03-19 12:15:17 -03:00
ayvis
1d7ba68396 replaced <br>, <br/> with <br /> in ANSI encoded files. Converted these files to UTF-8 2014-03-18 16:09:05 -03:00
Ermal
d5d22d6e36 Disable default allow incoming rules for 6to4 and 6rd interfaces. This rule unintentionally allows all services on the interface to be reachble and maybe more! 2014-03-17 21:24:58 +00:00
Renato Botelho
7f7626ba44 Merge branch 'master-br' of https://github.com/ayvis/pfsense into ayvis-master-br 2014-03-17 11:17:29 -03:00
Chris Buechler
9c3b8c6edb fix typo 2014-03-14 20:12:34 -05:00
Chris Buechler
34e2973ed9 standardize URLs 2014-03-14 19:33:03 -05:00
Chris Buechler
e1a456e6a8 standardize URLs 2014-03-14 19:30:56 -05:00
Chris Buechler
0734024c9e standardize URLs 2014-03-14 19:28:10 -05:00
Chris Buechler
5775f32451 standardize URLs 2014-03-14 19:18:17 -05:00
Chris Buechler
184016fcb7 standardize on https on www.pfsense.org 2014-03-14 19:15:44 -05:00
Chris Buechler
ef459eb700 standardize on https://www.pfsense.org, point to packages.pfsense.org 2014-03-14 19:10:27 -05:00
Chris Buechler
5721595b8d standardize on https://www.pfsense.org 2014-03-14 19:08:43 -05:00
Ermal
0390090465 Make the Additional tags that may be supplied compliant with new schema 2014-03-14 21:06:37 +00:00
Ermal
6d84c956e0 Make the parser more efficient to test for keys rather than searching inside the array 2014-03-14 21:02:44 +00:00
Renato Botelho
ffd17097a7 Unbreak listtags(), it should return regular array 2014-03-14 17:47:03 -03:00
Ermal
703b1ce1c5 Correct variable name, while here unset some large var 2014-03-14 20:35:39 +00:00
ayvis
8cd558b61b xhtml Compliance 
replaced <br>, <br/> and </br> with <br />
 2014-03-14 21:24:03 +01:00
Ermal
20dad315ae Provide upgrade code after changes done for Ticket #3441 2014-03-14 10:42:35 -03:00
Renato Botelho
b824ff8d99 Merge pull request #1025 from florian-asche/patch-5 
Update dyndns.class
 2014-03-13 20:20:46 -03:00
Florian Asche
7dc42e4ac8 Update dyndns.class 2014-03-13 22:57:28 +01:00
PiBa-NL
3fe73243bf fix plugin method for packages to allow for multiple plugins in an 'item' array as 'plugin' is not allowed as array item by xmlparse.inc 2014-03-13 21:58:26 +01:00
Chris Buechler
4db99d5baf set package URL to https://packages.pfsense.org 2014-03-13 02:46:21 -05:00
Chris Buechler
1b92cc6149 use xmlrpcbaseurl here too, not product_website 2014-03-13 02:43:01 -05:00
Chris Buechler
f5e09d9201 we actually use xmlrpcbaseurl here, not product_website 2014-03-13 02:18:51 -05:00
Renato Botelho
f049d45e0a Merge pull request #1022 from PiBa-NL/carp_notification 
rc.carpmaster/rc.carpbackup notification method for packages.
 2014-03-12 18:35:27 -03:00
Florian Asche
cd8f7eee0e Update dyndns.class 
Only use IPv4_only function if ipv6 is false
 2014-03-12 22:31:53 +01:00
Ermal
d84faccb60 Add removed file to obsolete list 2014-03-12 18:49:57 +00:00
Ermal
8b4abd5932 More removal of racoon from referenced in sources 2014-03-12 18:48:25 +00:00
Ermal
1dcb00bb71 Remove remeants of racoon 2014-03-12 18:44:51 +00:00
Ermal
3eeac25687 Generate nat rules for ipsec when needed 2014-03-12 18:42:43 +00:00
Ermal
72a8c829fd Be more efficient, and ordered about thae tags and also syncrhonize tags with xmlreader 2014-03-12 16:34:38 +00:00
Ermal
b79ea46a95 Make this a bit more smart rather having the penalty going over explode 2014-03-12 16:19:50 +00:00
Ermal
055fa9e354 Try a different strategy for fixing #3514 just send a HUP to dhcp6 to get it to reload. 2014-03-12 14:49:35 +00:00
PiBa-NL
331166a85c -renamed function to pkg_call_plugins 
-added is_array()
-added function header text
-replaced fixed 'plugin_carp' by $plugin_type to allow for generic use
 2014-03-12 15:48:41 +01:00
PiBa-NL
eaee3af65b rc.carpmaster/rc.carpbackup notification method for packages. 2014-03-12 00:31:52 +01:00
Ermal
f0014c6499 Make this a bit more efficient 2014-03-11 15:40:27 +00:00
Renato Botelho
ac28b62eb8 Merge pull request #1018 from florian-asche/patch-3 
Update services.inc
 2014-03-11 09:42:48 -03:00
Renato Botelho
6b13f8d259 Do not delete linklocal address 2014-03-11 08:38:30 -03:00
Florian Asche
e6d708fe68 Update dyndns.class 
IPv4 ONLY? YEAH ;)
 2014-03-10 22:15:39 +01:00
Florian Asche
181386d613 Update services.inc 
Added CURL setops from dyndns.class
 2014-03-10 22:11:31 +01:00
Florian Asche
3c6f29c0b5 Update services.inc 
IPv4 ONLY
 2014-03-10 22:06:35 +01:00
Renato Botelho
56b4084469 Merge pull request #1012 from florian-asche/patch-1 
Update services.inc
 2014-03-10 16:41:36 -03:00
Florian Asche
5244c510a2 Update services.inc 
Prepared to make $hosttocheck configureable
 2014-03-10 19:42:41 +01:00
Florian Asche
5d1185ced7 Update services.inc 2014-03-10 19:18:21 +01:00
Ermal
b67e9e626c Fix for now 'IPv6 - LAN looses Prefix after link event'(forums) with a not elegant solution but works. Probably dhcpv6 client should solve this by itself and generate and event for it. For now just bump dhcpv6 client again to have the prefix interface reconfigured. 2014-03-10 15:12:53 +00:00
Renato Botelho
d130cd4674 pfSense_interface_deladdress() only knows how to delete an ip address, not a subnet. It should fix #3513 2014-03-10 10:17:33 -03:00
Florian Asche
09cb9dee69 Update services.inc 
Added missing usepublicip with dyndnsCheckIP
 2014-03-10 00:35:20 +01:00
Ermal
fac36dfddf Make the voucher auth through xmlrpc work. 2014-03-07 17:49:54 +00:00
Chris Buechler
fe3553d16d default openssl to 2048 2014-03-06 16:10:33 -06:00
Ermal
631597493e Better just use start here seems to be more reliable 2014-03-06 22:59:40 +01:00
Ermal
d623693ca0 Correct the step for phase2 algos as well 2014-03-06 21:38:50 +01:00
Ermal
d60eea555e Correct the generation of the config for mobile tunnels as well 2014-03-06 21:38:50 +01:00
Renato Botelho
8c3cba99f0 Merge pull request #995 from ayvis/master-syntax-errors 
syntax errors correction
 2014-03-06 16:57:37 -03:00
Chris Buechler
ad55629bc9 update link for 2.2 2014-03-06 13:19:29 -06:00
Ermal
f37e37bbdd Remove not needed anymore function 2014-03-06 20:19:38 +01:00
Ermal
9601df8ad5 Use a step of 64 here too to comply with what the daemon can parse/understand 2014-03-06 20:02:06 +01:00
Chris Buechler
da2ec3361e bring up appropriate interface for GRE/GIF. Ticket #3281 2014-03-06 00:51:20 -06:00
ayvis
56b490bad3 syntax errors corrected 2014-03-04 22:09:02 +01:00
Renato Botelho
ebe2b407b3 Merge pull request #984 from phil-davis/master 
Return GWG IP protocol (version) when no gateway IP
 2014-03-04 10:03:11 -03:00
Renato Botelho
faddd38108 Merge pull request #992 from Doncuppjr/master 
Add UEFI support to Network Boot options.
 2014-03-04 09:52:29 -03:00
Renato Botelho
ff9c579f37 Fix syntax 2014-03-03 18:00:08 -03:00
Renato Botelho
48047e3fdc s/unlink/unlink_if_exists/ 2014-03-03 16:21:23 -03:00
Donald A. Cupp Jr
fdb116a97b Put added option in dhcp config instead of dhcpv6 config. 
Use empty function instead of <> "" for null test in dhcp network booting config section.
	modified:   etc/inc/services.inc
 2014-03-03 11:20:44 -08:00
Renato Botelho
d07bc322c5 Remove broken 'dynamic6' gateway, we already have ipprotocol to tell us the IP version, leave it more simple using only 'dynamic'. It helps #3484 2014-03-03 13:31:01 -03:00
Renato Botelho
bf36dafa26 Fix typo on var name 2014-03-03 13:26:36 -03:00
Donald A. Cupp Jr
c10d55ba64 Add missing option code for uefi booting 
modified:   etc/inc/services.inc
 2014-03-02 23:14:43 -08:00
Donald A. Cupp Jr
c636d5172b Merge branch 'master' of https://github.com/Doncuppjr/pfsense 2014-03-02 21:59:35 -08:00
Charlie Root
7023c602bd Added support for UEFI booting to Network Booting configuration. 
modified:   conf.default/config.xml
	modified:   etc/inc/services.inc
	modified:   usr/local/www/services_dhcp.php
 2014-03-02 21:47:39 -08:00
Chris Buechler
3d8e954b3f sync up ALTQ-capable interfaces list 2014-03-01 16:55:22 -06:00
jim-p
68169a559e Wrap this in an is_array() test, or else if you have no manually configured DNS servers, saving the DHCP settings produces a PHP error. 2014-03-01 13:07:04 -05:00
Renato Botelho
dadb484675 Merge pull request #986 from andrespetralli/master 
Re-enabling static lease updates
 2014-02-28 15:46:28 -03:00
Andres Petralli
3cdef18753 Re-enabling static lease updates 2014-02-28 08:59:19 -08:00
Ermal
b31247af70 Small correction for clear code 2014-02-28 14:14:49 +00:00
Ermal
cdeaf91e14 Ticket #3484 Correct the case for GRE tunnels as well since they behave the same. GRE seems to need the prefixlen 128 specified all the time so do it explicitly to be on safe side 2014-02-28 14:11:46 +00:00
Ermal
d2c598080a Ticket #3484 Note that for now prefixlen is useless in ipv6 tunnels. IPv4 accepts them 2014-02-28 13:52:30 +00:00
Ermal
c32a6b82a7 Fixes #3484. Provide a dynamic gateway for gif v6 tunnels so it can be used on firewall rules etc. The guide for setting up this tunnels on docs need to change to leave the gif interface as none type. People upgrading need to fix this themselves with a not on release notes. This can be fixed if the kernel condition is relaxed to allow setting the prefixlen on the tunnel as ipv4 2014-02-28 13:49:44 +00:00
Phil Davis
f60003faf1 Return GWG IP protocol (version) when no gateway IP 
This is a resubmit of an older pull request I had closed. It came up again in the forum, with a user setting up a VM environment and wondering why he cannot make policy-routing rules to a gateway group. The gateway group names did not display because all his WANs were down at the time and so the existing code was too dumb to determine the IP protocol (version 4 or 6) when none of the WANs in the gateway group actually have an IP address yet.
 2014-02-27 18:54:51 -08:00
Ermal
c7fbdd6c8e Make the IPSec status page work with strongswan 2014-02-27 17:39:19 +01:00
Ermal
2124fad4d0 Oops forgot the query message 2014-02-26 16:26:40 +00:00
Ermal
df0878b018 Add a function to read the status of connections/SAs/SPDs from smp plugin of StrongSWAN. No need to go through the setkey dumps 2014-02-26 16:24:19 +00:00
Ermal
ddfe5e4380 Make xmlreader parse any document and properly consider listtags specified and attributes. Probably should be made the default due to its speed. 2014-02-26 14:25:30 +00:00
Ermal
8ffb5ccdee Parse even attributes when present 2014-02-26 11:55:48 +00:00
Ermal
c6efc8fd15 Push log changes for IPSec and fix generation of strongswan.conf and ipsec.secrets to be properly considered 2014-02-25 11:10:01 +01:00
Ermal
7335fa5380 * Correct logging to syslog and proper file for ipsec from strongswan 
* Use proper commands to reload strongswan rather than just the daemon
 2014-02-25 11:10:01 +01:00
Phil Davis
3ad6b569d6 Fix #3483 only use IPv4 DNS servers in DHCP v4 conf 2014-02-24 19:40:30 -08:00
Renato Botelho
04f5393f49 Make is_linklocal case-insensitive and fix #3433 2014-02-24 16:03:34 -03:00
Renato Botelho
b5388f033c Fix #2302, save custom uploaded l7 pattern files on config.xml and replicate it to slave 2014-02-24 12:25:59 -03:00
Renato Botelho
732b160dba Set variable after make sure it's defined and has elements 2014-02-24 12:25:59 -03:00
Renato Botelho
420b45385a Fix whitespace and indent 2014-02-24 12:25:59 -03:00
Ermal
62f965689c Properly detect when there are issues with communicating with syncip and to use the local DB for this. Otherwise detect if the remote says the voucher is not valid say its not valid. 2014-02-24 14:57:04 +00:00
Ermal
ac420abd1d Properly compile the query to insert the values. Pointy-hat: myself. While here respect the redirurl when passed to portal_allow and use proper function to do redirection. 2014-02-24 14:39:31 +00:00
Renato Botelho
037e7a6210 Merge pull request #959 from stilez/patch-3 
Tighten is_subnet() functions
 2014-02-24 07:57:29 -03:00
Ermal
34340c5649 Ticket #2627. Just pass the array over no need to traverse it 2014-02-21 13:45:19 +00:00
Ermal
929776169f Fixes #2627. When an interface goes down try to shut the RAs and dhcpd6 service on that interface 2014-02-21 13:23:29 +00:00
Ermal
d6101e2316 Avoid recursion of convert_real_interface_to_friendly_interface_name with get_parent and on linkup of parent interface properly configure especially useful on ppp type links 2014-02-21 11:58:11 +00:00
Renato Botelho
ad43847b97 Merge pull request #960 from stilez/patch-4 
Tighten is_validaliasname()
 2014-02-21 08:01:13 -03:00
Ermal
ef60dfa541 Be friendly to memory 2014-02-21 10:03:48 +00:00
Ermal
4d3277443f Fix problem with the voucher synching that was introduced during conversion to zones 2014-02-21 10:03:38 +00:00
stilez
4ad9a1e7ed Tighten is_validaliasname() 
is_validaliasname() treats "empty string" as a valid alias name, it probably shouldn't.

I suspect it also should not allow purely numeric names ('53'), or pure underscore ('_'), or reserved port names ('tcp', 'http'), as valid alias names for other things. Too much risk of issue/ambiguity which isn't helpful in a router/security device, and no obvious upside to it. 

Example: - Suppose I define '53' as an alias for '54' or 'tcp' as an alias for 'ssh' or 22 on some firewall..... which I can because is_validaliasname() will validate both? It's a subtle change, hard to spot as rules will look correct, easy to cause problems or wilfully misuse.)

"Pure numeric" aliases are also worryingly ambiguous since many other things that can be entered or appear on the GUI, such as port numbers, can be entered or will show as pure numeric or an alias, so there's scope for ambiguity which it means. (is '53' the port 53, or the alias 53 which I've redefined to mean 1053?)

This PR generally tightens the logic and regex expressions (shorter syntax, no '?:'s or '?' groups), and slightly but sanely limits valid alias names to remove ambiguity - specifically it bars 4 kinds of string (empty string, pure numeric, pure underscore, and PHP reserved names that are already hard-coded aliases for specific protocols/services) from being valid alias names any more, as a result. 

		(I think this is sane, if you agree!)
 2014-02-21 02:49:09 +00:00
stilez
a5e2a35f03 Tighten is_subnet() functions 
The is_subnet(), is_subnetv4() and is_subnetv6() functions have significant issues in their coding logic.

Issues:

1) Functions use is_numeric(), so they validate invalid bitcount parts such as '1.1.1.1/6.5' or '::8000/94.7' as valid subnet strings

2) Validation explodes to a list of 2 variables rather than testing the whole string, so it's possible to craft a malicious string or mis-enter text such as "::8000/24/;\nARBITRARYTEXT;", or any valid subnet followed by a third '/' character followed by arbitrary text, which always validates as permitted data. In v2.x this allows arbitrary or malformed text placement into core config files such as pf.conf, f/w tables, and probably exec() strings, from the GUI (reported previously)

3) is_subnet() and is_subnetv6() return false for the valid subnet /0 as a CIDR, although technically this is allowed and valid as a subnet (it may have unambiguous and useful meaning in a router or security context).

The existing code is easier to rewrite than fix. It's a lot shorter too. A single preg_match() does all the separating of valid subnet parts and identifies which if either type of subnet the string could be, by exactly matching EITHER (7-15 char string containing only 0-9.) OR (2-39 char string containing only 0-9a-f:) followed by '/' and (1-3 numeric digits). Depending which of the first two matches is non-empty, it then checks the "ip" part" and "numeric" part are each valid, and exits. Efficient and robust.

NOTE: - these functions returned a True/false value ( is_subnet() or !is_subnet() ). As any positive number evaluates in a Boolean sense to True, I have taken advantage of this to have "success" return 4 or 6 (not just "true") to say the type of subnet matched.  It's no extra effort or cost, and turns out to allow a lot of efficiency and code simplification elsewhere, since calling code that needs to validate a subnet *and* test if it's IPv4 or IPv6, a common situation, can now do this reliably with a single is_subnet() call:

  if (($sn = is_subnet($data)) {
      if ($sn == 4) 
         IPv4 handler code...
      else
         IPv6 handler code...
  } else
      error handler code...

I've used it here to write is_subnetv4() and is_subnetv6() to be single line near-aliases of is_subnet(), that just check the return value is indeed 4 or 6.
 2014-02-21 02:19:56 +00:00
Ermal
75aec77a87 Rather than having issues with not started radvd try to start radvd to discover by itself the prefix on the interface by using the special directive :: on the prefix declaration. Related to many tickets and forum posts 2014-02-20 23:36:20 +00:00
Ermal
8b731067d8 Correct obvious bug in IPv6.inc 2014-02-20 20:19:48 +00:00
Ermal
77148acc98 s/PEAR.php/PEAR.inc/ 2014-02-20 20:06:27 +00:00
Ermal
bf416e4996 Actually take latest one from github. It has some more checks and more execution time penalities but catches more errors 2014-02-20 20:05:37 +00:00
Ermal
03ab9b3028 Update IPV6.inc to latest 1.2.1 version 2014-02-20 20:00:01 +00:00
Ermal
7519cc29ae If set use the default bandwidth setting on the CP even for mac passthrough. Reported-by: https://forum.pfsense.org/index.php/topic,72761.0.html 2014-02-20 19:32:49 +00:00
Ermal
2e080989c4 Use the default bw specification if configured even for allowed ip and hostname. 2014-02-20 19:30:57 +00:00
N0YB
3f7f26ae16 Add the missing global $g 2014-02-20 10:37:57 -08:00
Ermal
315bdf65a1 Do some more error checking and put secondary radius attributes only if configured. Probably radius configuration should be merged with central server for logins! 2014-02-20 09:18:14 +00:00
Ermal
e570f0eb56 silence any errors 2014-02-20 09:02:55 +00:00
N0YB
d55cba63e7 Fix gateway quality RRD to have the correct granularity and be consistent with the pfSense graphs set. 
Create gateway quality RRD with settings suitable for pfSense graph set,  since apinger uses default step (300) and other settings that are not so  good/consistent with the pfSense graphs set.

Originally Submitted as Pull Request #672.
Resubmitting to Master.
 2014-02-19 18:18:07 -08:00
stilez
4caa9574b4 Tighten is_numeric() 
Improvements:

1) avoids 'expensive' preg_match() and is a more exact test
2) fixes logic whereby an empty string or anything converted to an empty string, is deemed a valid 'numeric' value

(If an empty string can validate as numeric, it's possible that in some cases a number is expected and missing in a string, but not detected, causing malformed rules or subnet bitcounts, and unexpected issues or vulnerabilities)

 -- also moved code to a more logical place in the .inc while doing this, not mixed in between IP handling functions
 2014-02-20 01:53:01 +00:00
Ermal
ec7bc948b7 More code fixes for ntpd 2014-02-19 15:43:37 +00:00
Ermal Luçi
59c37391b9 Merge pull request #929 from nagyrobi/patch-3 
Update system.inc
 2014-02-19 16:37:01 +01:00
Ermal Luçi
a5240b7a84 Merge pull request #928 from nagyrobi/patch-2 
Update rrd.inc
 2014-02-19 16:20:48 +01:00
Renato Botelho
e09da6c266 Fix #3469 
Before downloading file to process urltable, there is a random wait
time between 5 and 60 seconds. Because of this, the difference between
file mtime and current time can be less than $freq * 86400 and it'll be
skipped. Add 90 seconds (60 of max random wait + 30 just to be sure) to
avoid skipping a file that should be updated
 2014-02-19 09:26:06 -03:00
Renato Botelho
869dfb664a Fix #3468, wording fix 2014-02-19 08:48:14 -03:00
Renato Botelho
96fc5388ac Merge pull request #945 from phildd/master 
Enhance interface gateway data entry descriptions
 2014-02-19 08:23:47 -03:00
Renato Botelho
5a47e9b12e Only add dhcpv6 client allow rules if ipv6allow is set 2014-02-18 20:31:47 -03:00
Renato Botelho
a60c6356ee Move 'allow dhcpv6 client' rules above block bogonsv6 ones, it should fix #3395 2014-02-18 16:00:17 -03:00
nagyrobi
617f9edf58 Update rrd.inc 
corrected path
 2014-02-18 16:07:09 +01:00
nagyrobi
0fd64e94fa Update system.inc 
Corrections made as requested
 2014-02-18 16:06:07 +01:00
nagyrobi
142f7393a8 Update system.inc 
Add new NTPd functions
 2014-02-18 15:12:43 +01:00
nagyrobi
1f3eff9b66 Update rrd.inc 
Add NTP graphing to RRD
 2014-02-18 15:06:27 +01:00
nagyrobi
43c4687b6b Update priv.defs.inc 2014-02-18 15:01:04 +01:00
Renato Botelho
9e875e0c00 Revert "Replaced gethostbyname() with gethostbynamel() to get a list of all IPs associated with the dns name and add them to the allowed list" 
This change is not needed, filterdns will handle it.

This reverts commit d460371416.
 2014-02-18 08:35:44 -03:00
Ermal
8c14707759 Do not do any operations on system libraries. Nowdays pbis are used and those do not break things by definition 2014-02-18 11:25:35 +00:00
Renato Botelho
8f821cbcd9 Merge pull request #891 from PiBa-NL/captive_disable 
captive portal, don't generate rules for a disabled portal
 2014-02-18 07:38:20 -03:00
Renato Botelho
aecb7a7928 Merge pull request #890 from N0YB/Gateway_Monitor 
Gateway Monitor Advanced Settings
 2014-02-18 07:31:26 -03:00
Renato Botelho
9305e21931 Merge pull request #904 from dv-user1/master 
Replaced gethostbyname() with gethostbynamel() to get a list of all IPs ...
 2014-02-18 07:15:06 -03:00
Ermal
adf1c3fa27 Revert "Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357" 
This reverts commit cb431dbf47.
 2014-02-18 09:26:01 +00:00
Ermal
c79f717a58 Really need the interface where v6 is running toa dd the gateway/route rather than the one used for the configuration. This Fixes #3357 2014-02-18 09:25:41 +00:00
Ermal
cb431dbf47 Pass the family to the get_real_interface function to retrieve the correct real interface. Might help Ticket #3357 2014-02-18 08:59:42 +00:00
Ermal
2076dc46f1 Put a timeout of 30 seconds to aid with Ticket #3412 2014-02-17 20:00:26 +00:00
Ermal
ee9783e93e Move this global declaration to the proper file rather than backend code 2014-02-17 20:00:25 +00:00
Renato Botelho
bd94286059 Use correct parameter (bootfile-url) to configure netboot on DHCPdv6, it fixes #3421 2014-02-17 12:20:18 -03:00
Renato Botelho
547f1e6554 Fix typo on variable name and really add custom options for dhcpdv6 2014-02-17 12:20:18 -03:00
Ermal
11ad160eae Normally when an ip is set the interface comes up on BSD stacks. Though push this commit which Fixes #3281 2014-02-17 14:18:16 +00:00
Ermal
db9199d729 Whitespace fix 2014-02-17 14:18:15 +00:00
Renato Botelho
e4a4ec896f Grab exec result just to be careful 2014-02-17 11:11:23 -03:00
Ermal
6191b3215c Put a kludge for now which Fixes #3280. It should be improved later on to have proper handling and overloading of configuration functions 2014-02-17 14:03:42 +00:00
Ermal
bae729da39 Consider setting of noconcurrent login for passthrough expiry of users. Fixes #3340 2014-02-17 10:36:59 +00:00
Ermal
eae9130484 Merge 10 -> 10.1 and 10.1 -> 10.2 function upgrade since the recent changes done on 2.1.1 for Ticket #3441 2014-02-17 09:59:28 +00:00
Ermal
74a40221d6 Use the 11th column for the radius context rather than overriding the interim interval field with it. Fixes #3447 2014-02-17 09:34:14 +00:00
jim-p
bf4e62acc7 Add a knob to let the user select which console (video or serial) is preferred in cases where there are multiple consoles present. Also provide a way to force this preference. 2014-02-14 11:03:06 -05:00
jim-p
407fbf455b Add a mechanism by which the serial port can be forced on always regardless of the config setting. (useful for nano+vga setups) 2014-02-14 09:58:17 -05:00
Renato Botelho
aea33635c0 Add https to update URLs and replace RELENG_8_3 by RELENG_10_0 2014-02-14 08:19:17 -02:00
Renato Botelho
6635f5b90d Abort installation when pbi_add fails 2014-02-13 09:32:25 -02:00
Renato Botelho
25333e5a85 Obsolete old ipsec tools files 2014-02-12 12:08:41 -02:00
Ermal
ff3d516f3f Be specific on the authentication method to use since xauth-eap will be active as well 2014-02-12 15:05:44 +01:00
Ermal
ede14b2302 Correct script path 2014-02-12 10:42:48 +01:00
Ermal
6c576b2785 Remove references to racoon and correct some handling of ipsec configuration 2014-02-12 10:41:43 +01:00
Ermal
ecc379586e Remove copy paste leftover 2014-02-12 10:36:02 +01:00
Ermal
91287d1f46 If specified add authentication script configuration to strongswan.conf 2014-02-12 10:35:38 +01:00
Ermal
fe63645d95 Remove not used anymore parameters 2014-02-12 10:28:55 +01:00
Ermal
2a3e30575a Teach script to read authentication servers from environment 2014-02-12 10:13:09 +01:00
Renato Botelho
80d708deb6 Fix symlink calls adding full link name, it fixes issue reported at https://forum.pfsense.org/index.php/topic,72405.0.html 2014-02-11 12:30:33 -02:00
Ermal
443ba8c9e1 Properly set the configuration here based on https://forum.pfsense.org/index.php/topic,68531.0.html 2014-02-11 11:59:30 +01:00
Ermal
8c466abb74 Make improvement to the check 2014-02-11 10:30:50 +01:00
Phil Davis
6240ba7bd1 Check for tmp captiveportal dir before making it 
In forum: https://forum.pfsense.org/index.php/topic,72483.0.html
Warning: mkdir(): File exists in /etc/inc/system.inc on line 878
Not sure if you would rather call safe_mkdir here?
 2014-02-10 19:05:26 -08:00
jim-p
83491ba51c Declare $config global so we can test the pkg_nochecksig option 2014-02-10 13:55:01 -05:00
PiBa-NL
5f242576d3 openvpn, allow for entering client user credentials in the WebGUI 2014-02-09 19:23:25 +01:00
Francois Blanchette
d460371416 Replaced gethostbyname() with gethostbynamel() to get a list of all IPs associated with the dns name and add them to the allowed list 2014-02-07 15:11:58 -05:00
Phillip Davis
974fb32ccd Enhance interface gateway data entry descriptions 2014-02-07 09:50:06 -08:00
jim-p
59c6e2181f Add specific permission for easyrule. 2014-02-07 11:56:38 -05:00
Renato Botelho
e5b5e29c3b Add support for signed PBI, help ticket #3365: 
- Add an option to allow user to accept unsigned packages
- The only missing part is public key, that needs to be added to
/var/db/pbi/keys/pfSense.ssl
 2014-02-07 10:41:41 -02:00
jim-p
d292bd8d60 Fix test, allows restoring last backup in the list. Fixes #3438 2014-02-06 14:02:03 -05:00
Ermal
496acde137 First swing at converting from racoon to StrongSWAN. 
It allows to use existing configurations on xml to generate StrongSWAN configurations.
So its only IKEv1

* Missing support for dynamic ips(hostnames)
  - resolver plugin of StrongSWAN needs to be configured in strongswan.conf
* Authentication plugin with pfSense authentication framework
  - New plugin almost completed

* More testing hence this being pushed now to have more broader look

TODO
* Integrate IKEv2
* Move dynamic IP allocation to an SQLite backend
* Provide more options in authenticating as a client(initiator)
* Restrict interfaces where StrongSWAN listens for incoming connections to only those configured

FUTUTE
* Move all configuration to SQLite backend
* Integrate more authentication scenarios of IKEv2
 2014-02-06 12:49:24 +01:00
Renato Botelho
b3e1ccb5b8 escapeshellarg() is not required here 2014-02-05 12:29:53 -02:00
Warren Baker
5293c5c71a Teach php-fpm about our required environment path 2014-02-05 15:58:07 +02:00
Renato Botelho
275f4b5ad4 Revert "Set PATH before call pbi related binaries" 
This was pushed by mistake

This reverts commit 4c9bda43f5.
 2014-02-05 11:50:46 -02:00
Renato Botelho
3820702948 Silent recently added symlink() calls 2014-02-04 18:32:20 -02:00
Renato Botelho
7b27b18bef Fix some wrong escapeshellarg() calls 2014-02-04 18:14:41 -02:00
Renato Botelho
552f5a6a5f Use unlink_if_exists or @unlink to avoid PHP errors when file doesn't exist 2014-02-04 17:01:20 -02:00
Renato Botelho
873c1701a8 Add escapeshellarg() calls on exec parameters. While I'm here, replace some exec() calls by php functions like symlink, copy, unlink, mkdir 2014-02-04 12:34:41 -02:00
Renato Botelho
4f188f54ab Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
1d9b51c6b0 Add path for sysctl, also use -n param instead of awk 2014-02-04 12:34:41 -02:00
Renato Botelho
306f855610 Simplify logic 2014-02-04 12:34:41 -02:00
Renato Botelho
f177717459 Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
8340d95653 Add {} between variables inside quotes 2014-02-04 12:34:41 -02:00
Renato Botelho
e6867c81d1 Use php function to get hostname instead of exec() 2014-02-04 12:34:41 -02:00
Renato Botelho
3f4bd83b5a Add {} between variables inside quotes 2014-02-04 12:34:41 -02:00
Renato Botelho
4c9bda43f5 Set PATH before call pbi related binaries 2014-02-04 12:34:41 -02:00
jim-p
ca79de534b Using "limited" for ntp in this way denies client access. Issue #3384 2014-02-03 09:34:06 -05:00
Renato Botelho
03734bf71e Remove arch from fall back url since it's a single dir now 2014-01-30 15:46:13 -02:00
Warren Baker
327a4fc65f Make sure unbound starts 2014-01-30 12:03:20 +02:00
Warren Baker
8fccab671f Make sure ACLs are saved correctly 2014-01-29 21:51:33 +02:00
Warren Baker
1319d0f3f3 Add new xml array 2014-01-29 21:08:21 +02:00
Warren Baker
56a87b19c0 Add additional functionality for stats and preconfigure variables 2014-01-29 17:07:13 +02:00
Warren Baker
3b95d9ece3 Add EDNS support for to resolv.conf 2014-01-29 17:06:42 +02:00
Warren Baker
923e49b1ce Start and configure Unbound on boot 2014-01-29 13:29:46 +02:00
Warren Baker
175dc861c2 Add Unbound service configuration 2014-01-29 13:29:32 +02:00
Warren Baker
6671b7cde6 Add chroot for Unbound 2014-01-29 13:27:55 +02:00
Warren Baker
f20afeb6d8 Add Unbound code 2014-01-29 13:27:42 +02:00
Warren Baker
33232486d6 Add Unbound to the services list 2014-01-29 13:26:40 +02:00
Warren Baker
6d9a572da5 Add Unbound to the system password and group files 2014-01-29 11:29:10 +02:00
Renato Botelho
f4a4bcbc4c Fix typo on variable name, it fixes #3414 2014-01-28 17:01:02 -02:00
PiBa-NL
452eb31ed5 captive portal, don't generate rules for disabled portal 2014-01-25 21:06:08 +01:00
Renato Botelho
fbdd046649 Obsolete openssl from ports files and also base nsupdate 2014-01-25 16:26:24 -02:00
Renato Botelho
22cc6582a1 Fix nsupdate path 2014-01-25 14:56:53 -02:00
N0YB
3c6787ed65 Gateway Monitor Advanced Settings 
Exposes 3 additional apinger configuration options in the gateway monitor advanced section which can either be set manually, calculated based on interval, or use the hard coded defaults.
	1) Avg Delay Samples
	2) Avg Loss Samples
	3) Avg Loss Delay Samples

The current hard coded defaults are okay for a short interval such as the 1 second default.  But do not work well when a longer interval is required.
 2014-01-24 22:28:18 -08:00
Renato Botelho
c241a3e89d Merge pull request #888 from PiBa-NL/pkg-utils-append-log 
pkg-utils do not clear first part of installation log.
 2014-01-24 17:33:06 -08:00
PiBa-NL
206c15cc91 pkg-utils do not clear first part of installation log. 2014-01-25 00:14:21 +01:00
Renato Botelho
2ec95f1ffb Fix openssl path 2014-01-24 08:33:31 -02:00
Renato Botelho
5459701254 Replace regex by explode as suggested by Ermal 2014-01-21 16:49:35 -02:00
Renato Botelho
613a94b31b Fix typo on variable name 2014-01-21 16:38:14 -02:00
Ermal Luçi
b4d772dc03 Correct this i thought i already did. Thanks-to: Phil Davis for spotting 2014-01-20 19:59:16 +01:00
Ermal
d760445e72 Do not need to go in the internet world to start a package 2014-01-20 15:09:52 +00:00
Ermal
44b1929824 * Do not call stop service in the start command. 
* Add some more checks into the functions to avoid errors
* Also silence some output that can cause issues
 2014-01-20 15:00:27 +00:00
Renato Botelho
770a7759f0 Fix FreeBSD version detection for 10.x 2014-01-20 10:53:09 -02:00
Renato Botelho
c42d721bb9 Obsolete old ntp binaries 2014-01-20 09:35:05 -02:00
jim-p
fdfa8f43ed ports ntp moved to sbin, follow 2014-01-15 12:35:50 -05:00
jim-p
706ba0e4b1 Use "disable monitor" in NTP config to mitigate CVE-2013-5211. 2014-01-10 11:41:49 -05:00
Renato Botelho
6b66073164 Add 'limited' to ntpd restrict list to workaround CVE-2013-5211. It fixes #3384 2014-01-07 08:58:33 -02:00
jim-p
4410f6990a This might also say "icmpv6" here and lead to a bad rule. 2014-01-06 12:09:52 -05:00
Renato Botelho
81f1947666 Add an option to force a gateway to be down, it fixes #2847 2014-01-06 14:11:14 -02:00
Ermal
4e6405b9f8 Oops correct php syntax 2014-01-03 15:56:53 +00:00
Ermal
21f82ab623 Do not allocate the same pipe to everyone rather give each person its own! 2014-01-03 15:05:50 +00:00
Ermal
f38b383b7c Use empty here for testing even if the setting is unset 2014-01-03 14:53:36 +00:00
Ermal
a3a1b24ebf Move to zerocopy_enbale for bpf to optimize bpf logging which uses bpf interface. This should increase the general performance since pflog is always enabled. 2014-01-03 13:24:28 +00:00
Tuyan Ozipek
2bb933456e Update copyright_years to be calculated on the fly. 2014-01-02 10:57:30 -05:00
Renato Botelho
0350084d40 fix syntax 2014-01-02 09:13:17 -02:00
Renato Botelho
2a45e05fc5 Fix filter regex 2014-01-02 08:41:32 -02:00
blagynchy
9dc3f2bbb9 Happy New Year 2014! 
Optimal: Just updating the copyright years;

I wish to all of you all of health, happiness and good luck of earth to be in your hands for the new year! Other will come up later :)

And make pfsense better then before, more flexible for management/viewing from web (3rd party) using samba,ftp,whois,hw temp..etc.

Best regards.
 2014-01-02 01:54:39 +02:00
Ermal
31dce43084 Upgrade all firewall rules to include a tracker field. Add a tracker field even for nat for later usage while here. 2013-12-31 13:28:35 +01:00
Ermal
2006d7a4f0 Generate a tracker id for the filter rules for now. Maybe for nat rules as well? 2013-12-31 13:23:21 +01:00
Ermal
ba1c86d950 Remove scrub as well 2013-12-30 16:14:21 +00:00
Ermal
32fd170342 Remove even negating nat rules 2013-12-30 15:27:17 +00:00
Ermal
a03dfc60b0 Correct matching for single rule. Somehow the egrep did not work there! 2013-12-30 14:47:25 +00:00
Ermal
b80e29e486 Speed up a bit rule number identification by avoiding going into kernel but using the rules parsing of pf which gives the same effect. 2013-12-30 14:34:18 +00:00
Renato Botelho
239024ee66 Merge pull request #866 from andrespetralli/master 
Enabling advanced RFC 2136 configuration for DHCPd service
 2013-12-30 03:56:34 -08:00
Ermal
5a89049022 Modernize a bit the sshd sart file 2013-12-27 21:51:06 +00:00
Ermal
9be0ec8a0e Use the check properly! 2013-12-27 21:38:40 +00:00
Ermal
635c00d36d Correct the check to what was intended 2013-12-27 21:35:21 +00:00
Ermal
f6d89471d3 Make sense of interface mtu handling code. No need to do unneeded operations. This fixes slow boot times and proper handling of mtu for vlans though some work or better model is needed for other interface types. Manual merge of 53555bf2f7 2013-12-27 20:49:29 +00:00
jim-p
aaa78416a7 Add sshd service to list (if enabled) 2013-12-27 13:10:50 -05:00
Renato Botelho
ee574a9e33 Fix a bug introduced in commit 06b8d43c that breaks return_gateways_array() called with $disabled == false 2013-12-27 12:02:35 -02:00
Renato Botelho
63fee5762d No reason to set the same value to ipprotocol 2013-12-27 11:55:36 -02:00
jim-p
5c427ce7e8 Add support for local (push route) and remote (iroute) network definitions in an OpenVPN client-specific override entry. 2013-12-26 16:41:24 -05:00
jim-p
7cbfc26544 Add a "status" subcommand to the svc php shell script. 2013-12-26 15:47:23 -05:00
jim-p
c7a3356e6b Add a setting to allow the user to specify the clog file size so more (or less) entries may be kept in the raw logs. Retain previous default size values if the user has not specified a preferred size. Files can only be resized when initialized, so provide a "Reset All Logs" button as well to force clear all logs and set them up at the new size. 2013-12-26 15:27:40 -05:00
Ermal
7b03748b37 Correct the php-fpm configuration generation 2013-12-26 19:27:40 +00:00
Renato Botelho
3f248cb65a Fix #3354, savecore -C only expects dumpdev 2013-12-26 16:10:33 -02:00
jim-p
e1ebe9e226 Add an option for users to be able to adjust how many configuration revisions are kept in the local backup cache. 2013-12-26 12:53:30 -05:00
jim-p
bfe615ee53 Show backup file size in config history. 2013-12-26 11:07:13 -05:00
Renato Botelho
fd34b8b5c6 Fix syntax 2013-12-24 15:27:47 -02:00
Ermal
59257969ad Sprinkle some more unsets 2013-12-24 15:51:08 +00:00
Renato Botelho
5551d818ee Remove /var/run/booting early to be consistent with $g['booting'] 2013-12-24 13:04:13 -02:00
Renato Botelho
677a64261c Revert "Make sure functions called by rc.start_packages can see $g['booting'] when we are booting" 
This reverts commit 8a461f41db.
 2013-12-24 13:01:52 -02:00
Renato Botelho
afd33d687e Revert "Only unset $g['booting'] when it was set here" 
This reverts commit 47493bd326.
 2013-12-24 13:01:48 -02:00
Renato Botelho
47493bd326 Only unset $g['booting'] when it was set here 2013-12-24 12:42:45 -02:00
Renato Botelho
8a461f41db Make sure functions called by rc.start_packages can see $g['booting'] when we are booting 2013-12-24 12:15:44 -02:00
Ermal
15bec71856 While here unset some variables even on vouchers side 2013-12-24 10:52:38 +00:00
Ermal
1f965b69a8 Merge manually 4fd85b115e 3f2ae9d58f and e049c5e74f 2013-12-24 10:45:45 +00:00
Ermal
a2a42c72f4 Remove not relevant comment now. Also make the operation clear to avoid priority issues. 2013-12-24 10:34:15 +00:00
Andres Petralli
87019fc4e0 Enabling advanced RFC 2136 configuration for DHCPd service 
This change adds the ability to configure RFC 2136 domain name updates
using a hmac-md5 keyname/key.
 2013-12-23 20:20:32 -08:00
Renato Botelho
079c292762 Remove 'deny unknown clients' option from DHCPv6 since it's not supported, it fixes #3364 2013-12-23 14:40:50 -02:00
jim-p
26b6e7586e Make sure to give the zone a name during the upgrade, or else it comes through with a blank/null name. 2013-12-23 11:16:12 -05:00
Ermal
66cc4d430a Correct displaying states status and avoid divison by zero due to wrong data collected 2013-12-23 14:57:16 +00:00
Ermal
3e5933f2c3 Use return rather than exit to be friendly on CGI 2013-12-20 22:50:27 +00:00
Ermal
af8251cc74 Addapt rc.newwanipv6 to FCGI calling 2013-12-20 22:49:46 +00:00
Ermal
e800a773c4 Call rc.newwanipv6 efficently through FCGI 2013-12-20 22:45:25 +00:00
Ermal
362ec35df2 Do not register the _ENV superglobal since its not required and probably not very useful in a [F]CGI world and its limit is restricted nowdays in pfSense. 2013-12-20 22:32:21 +00:00
Ermal
aa205c3b69 Rmoeve register_long_arrays from php.ini and from php code the use of HTTP_*_VARS as its deprecated and luckily low use in pfSense to win memory and compativility 2013-12-20 22:08:34 +00:00
Ermal
cc2630208c Provide a setting to disable the auto added LAN SPDs in the DB 2013-12-19 14:52:59 +00:00
Ermal
85d0e9591d Make even ipsec script ready for GET arguments but later on it will be used as such 2013-12-19 09:20:32 +00:00
Ermal
b2af12ad48 Use closelog to explicitly close open resource. 2013-12-19 09:12:39 +00:00
Ermal
b95b40a135 Move also tls-verify to fcgicli to avoid forking php process. Maybe even this should be done as a plugin to avoid overhead of forking. 2013-12-19 09:10:50 +00:00
Ermal
5e28dad4a3 Migrate openvpn authentication to use fcgicli rather than forking a php process. Maybe should could consider to write a short library todo this 2013-12-19 08:53:32 +00:00
Ermal
00e8315b3d Correct issues not only with vlans but all other clonable interfaces(related to Ticket #3270. Also correct removing old ip addresses from the interface and handling the right interface on interface renabling. 2013-12-18 21:57:16 +00:00
Ermal
78c3673302 Use does_interface_exist rather than calling ifconfig directly 2013-12-18 21:45:09 +00:00
Ermal
e677dd0678 Set latest config version 2013-12-18 13:51:24 +00:00
Ermal
e7d35d846c Convert ipaliases over carp to new world order 2013-12-18 13:50:31 +00:00
jim-p
f3512fca87 Reduce the total minutes by the remote minutes used, do not use the value directly. Otherwise the voucher will be cut short or listed invalid when it otherwise should have time left over. 2013-12-17 14:41:17 -05:00
Ermal
00e550886c Register a function to unset certain globals after requests finish processing to release memory early 2013-12-16 13:57:11 +00:00
Ermal
5be2085a97 Rely on memory rather than LOWMEM boolean 2013-12-16 13:34:25 +00:00
Ermal
6d7ee1ab8f Use same value consistently for configuration and tolerate a bit more 2013-12-15 21:26:27 +00:00
Ermal
08b64f7914 Use events to start sshd rather than relying on forking 2013-12-15 21:15:46 +00:00
Ermal
815f1f77ed Support if called from fastcgi 2013-12-15 20:43:00 +00:00
Ermal
1c3d2cd32e Send events to check_reload_status for carp master/backup 2013-12-15 20:41:20 +00:00
Ermal
1590947b56 Call all php scripts in bootup with fcgicli. For rc.bootup only the part needing input needs to be abstracted 2013-12-15 19:11:15 +00:00
Ermal
83e46727fb Mute the output of the command since its not really useful 2013-12-14 21:42:35 +00:00
Ermal
73c3eed8e0 Remove deprecated sysctls. vfs.forcesync needs to be seen if the patch needs to be put in place again! 2013-12-14 21:39:05 +00:00
Ermal
9e0fb7010d Use system ident rather than php-fpm for system logs 2013-12-14 21:21:50 +00:00
Ermal
4aea91d808 Switch to php-fpm for lighty and check_reload_status will use it. Step by step will migrate the other calls 2013-12-14 19:20:55 +00:00
Ermal
c71b14fd9c Make scripts able to react when called from FCGI with GET method 2013-12-13 23:09:06 +00:00
jim-p
940ef0e3bd Fix parsing of the rule number in the pf log on FreeBSD 10.x, part of Bug #2122 2013-12-12 14:32:02 -05:00
Renato Botelho
aebf41dfa4 Use current racoon.conf syntax to avoid issues when deprecated one is removed, it fixes #3338 2013-12-10 12:08:16 -02:00
Phil Davis
5a997d96b2 Use correct vars for IPv6 when checking subnet start and end 2013-12-09 03:07:04 -08:00
Phil Davis
12f5a2d861 Check that DHCP end IP is >= DHCP start IP 2013-12-09 01:53:14 -08:00
Phil Davis
3038ece777 Fix checking DHCP end IP is in range 
Cut-paste bug
 2013-12-08 19:15:22 -08:00
Ermal
52d5ef8d14 Nice race on FreeBSD 10 for carp seems you cannot do on the same command line the carp config due to inherent races. Account for this 2013-12-07 19:29:15 +00:00
Ermal
84b23cce27 This needs to have alias added to not remove the interface ip 2013-12-07 18:54:37 +00:00
Ermal
7a7ba89a49 Correct curlies yet again 2013-12-07 18:05:38 +00:00
Ermal
0c21eb70b6 Use _vip as identified for CARP vip IPs to allow easier upgrade code. This way only ipaliases on carp need to be upgraded. 2013-12-06 19:16:34 +00:00
Ermal
86c135def2 Load only the options and nothing else 2013-12-06 14:04:18 +00:00
Renato Botelho
77a341a458 Add a knob to prefer IPv4 over IPv6, it fixes #2833 2013-12-06 11:39:29 -02:00
Renato Botelho
09e14acf5b Unbreak etc/sshd, add a missing quote 2013-12-06 11:37:19 -02:00
Renato Botelho
7a25652fae Check if dhcp start and end addresses are inside interface subnet, helps #3196 2013-12-06 09:42:11 -02:00
Renato Botelho
da6cb29eb5 Add function is_inrange() that calls is_inrange_v6 or is_inrange_v4 accordingly 2013-12-06 09:41:59 -02:00
Renato Botelho
bebf0fa8dc When user attempt to set network or broadcast address, ask again for the IP address. Issue #3196 2013-12-06 09:34:55 -02:00
Ermal
f2dd61a764 Identify vips where needed by @ symbol that will be used 2013-12-05 16:27:10 +00:00
Ermal
af93d29a09 Make more strict checks 2013-12-05 16:18:19 +00:00
Ermal
103b8e5ebe Remove not true comment 2013-12-05 15:41:47 +00:00
Ermal
049ed50d48 Correct syntax 2013-12-05 15:41:41 +00:00
Ermal
6363a6dec6 Create even elyptic curve keys 2013-12-05 15:13:07 +00:00
Ermal
b6877e065e Handle more carp enahancements for FreeBSD 10. the interface vips will be names $if@$vhid since the interface name is the same as other ips. 2013-12-05 10:51:25 +00:00
Ermal
0aa7293069 Optimize a bit 2013-12-05 10:51:25 +00:00
Renato Botelho
20dda76651 Prevent network or broadcast address to be set on interface (console, GUI and wizard). It should fix #3196 2013-12-04 18:21:18 -02:00
Ermal
f51fa0d411 Use proper interface here 2013-12-04 11:17:54 +00:00
Ermal
991bd7ad16 Correct only carp value changes 2013-12-04 11:17:54 +00:00
Ermal
77411fa70d Correct CARP events on devd and the argument processing on called scripts 2013-12-02 21:12:31 +00:00
Renato Botelho
61422dd487 When reset webConfigurator password, if authentication server is not Local Database, ask user to back to it. Fix #3341 2013-12-02 16:21:30 -02:00
Renato Botelho
992324efad Remove 0.0.0.0 from automatic outbound nat rules 2013-11-28 16:42:13 -02:00
Ermal
7238e0cfc8 Remove references to _vip interface and provide proper configuration for carp on FreeBSD 10. Still some places to deal with this and certainly missing upgrade code 2013-11-28 18:36:18 +00:00
Renato Botelho
d111342434 fix 0.0.0.0 subnet for automatic outbound NAT rules, fixes #2416 2013-11-26 19:23:48 -02:00
Renato Botelho
06b8d43c3f Add a new param to return_gateways_array and make it return gateways when interface doesn't exist. Default behavior didn't change. Also check the new gateway parameter (disabled) when filtering 2013-11-26 18:40:41 -02:00
Ermal
531b9f0e76 No need for a second rule forwarding http 2013-11-25 14:06:37 +00:00
Ermal
1c69dbb008 Correct generation of lighty configuration with zoneid changing to lower that 4000 value 2013-11-25 14:06:36 +00:00
Ermal
0a806969ee Since zoneid need to be less then 4096 provide some upgrade code to handle that from existing configs 2013-11-25 14:06:36 +00:00
Ermal Luçi
06dc05ace7 Merge pull request #858 from timdufrane/master 
Add DHCP without gateway capability
 2013-11-25 05:39:43 -08:00
Ermal
fcaf17090a Catch up with mac needed for all operations in the table nowdays. 2013-11-23 19:32:49 +00:00
Ermal
baec2b007f Properly create zones for the CP with the new command arguments and properly invoke ipfw for applying rules and other configuration options. 2013-11-21 21:18:00 +00:00
timdufrane
4208f7b1ba Add DHCP without gateway capability 2013-11-21 13:33:52 -05:00
Renato Botelho
d3b17c9a0b Fix #3331. Set interface subnet as destination when VIP is in the same subnet, otherwise use VIP subnet instead of IP address 2013-11-21 13:57:34 -02:00
Ermal
f7ec7bf9d1 FreeBSD 10 pf does not have a limit for table entries 2013-11-21 13:58:38 +00:00
Ermal Luçi
e6000a9bc6 Merge pull request #857 from Wraul/add_city_network_dyndns 
Added support for City Network to Dynamic DNS.
 2013-11-21 05:14:13 -08:00
Renato Botelho
23d9f68660 Fix an issue that changes wrong gateway entry when items are hidden 2013-11-21 09:37:02 -02:00
jim-p
33e71f1087 Don't flush interface cache on each call of the function when looping through all gateways. 2013-11-20 15:56:29 -05:00
Renato Botelho
e47914184a Add gettext() to recently added strings 2013-11-18 15:24:31 -02:00
Renato Botelho
3bb23264e1 Add an option to return outbound NAT automatic to nat hosts with description, ticket #2416 2013-11-18 15:09:13 -02:00
Renato Botelho
9bed0fcd6d Add subnet to 0.0.0.0 otherwise it's not added to table, ticket #2416 2013-11-18 10:09:13 -02:00
Renato Botelho
c437485d01 Make sure automatic rules are created even if mode is not set, ticket #2416 2013-11-18 09:56:22 -02:00
Renato Botelho
7997ed4440 Many fixes on privileges, ticket #3216: 
- Rename some privileges:
   page-diag-system-activity => page-diagnostics-system-activity
   page-interfacess-groups => page-interfaces-groups
   page-interfacess-lagg => page-interfaces-lagg
   page-interfacess-qinq => page-interfaces-qinq
- Write an upgrade function to replace above privileges by the new name
- Remove unused privilege page-diagnostics-logs-wireless
- Remove duplicated privileges
- Fix limiter-info, pf-info and system-pftop that were using wrong name
- Add privs for edit pages (interfaces_groups, interfaces_lagg,
  interfaces_qinq and services-igmpproxy)
- Fix ID for acptiveportal allowedhostnames and editallowedhostnames
- Fix some wrong matches
 2013-11-15 19:21:18 -02:00
Renato Botelho
2d845db7b8 Merge pull request #855 from ExolonDX/branch_01 
Tidy up the "Helper Icons"
 2013-11-15 10:20:24 -08:00
Mathias Andersson
2206f1b90f Added support for City Network to Dynamic DNS. 
City Network is a Swedish web hosting company.
They provide a dynamic DNS service for their customers.
This service uses the dyndns2 protocol.
 2013-11-14 22:06:03 +01:00
Renato Botelho
2b41df9c4d Provide a more safe way to avoid pw userdel being interactive because of a crontab existance 2013-11-14 15:54:05 -02:00
Renato Botelho
0f84dee3eb Revert "local_sync_accounts: provides empty STDIN to pw userdel command" 
This reverts commit c6b156bfa5.
 2013-11-14 15:54:05 -02:00
Renato Botelho
3afcc2380e Split automatic to nat hosts fill into a function to be able to call it from other place, ticket #2416 2013-11-14 12:34:34 -02:00
Colin Fleming
17b8c60a39 Tidy up the "Helper Icons" 
The "Helper Icons" at the top right of some service pages at present
produces 30+ HTML errors/warnings, this is due to the table cell being
wrapped in a span statement then in a div statement, table cells can
only be part of a table row then within a table statement.

- remove the table cell definitions from /etc/inc/service-utils.inc
- add the table cell definition from /etc/inc/service-utils.inc to
/usr/local/www/status_services.php and add some logic to determine if
the service is running which will then determine which class statement
to use and pad the icon with a space
- apply the same table cell definition and logic as above to
/usr/local/www/widgets/widgets/services_status.widget.php
 2013-11-14 13:44:59 +00:00
Renato Botelho
c39c8b8ffc Remove unused variables and fix automatic nat to alias-address 2013-11-14 10:38:37 -02:00
Renato Botelho
34f9597749 Merge pull request #854 from icyfork/provides_empty_STDIN_to_pw_command 
local_sync_accounts: provides empty STDIN to pw userdel command
 2013-11-14 02:19:15 -08:00
Renato Botelho
eef01b14df Add hybrid and disabled outbound NAT, fixes #2416: 
- Add 2 new outbound NAT modes, hybrid and disabled, manual and advanced
  keep working the same way
- Hybrid mode applies manual rules first, automatic after
- Disabled do no create any outbound NAT rules
- Remove ipsecpassthru config field and rename advancedoutbound to
  outbound
- Save mode on $config['nat']['outbound']['mode'] to simplify the logic
- Modify config.default to reflect changes
- Add code to upgrade config, and change latest_version to 10.3
- Use html to align modes and remove some hacks to align using &nbsp;
 2013-11-13 07:45:09 -02:00
Ky-Anh Huynh
c6b156bfa5 local_sync_accounts: provides empty STDIN to pw userdel command 
The /usr/sbin/pw command may wait for user input. For example,
if there is a manual crontab settings for :foobar account, then
when this account is requested to be deleted, the command will
ask if user wants to delete crontab settings for the account.

Because the command waits for user input, the boot process will
hang at the "Synchronizing user settings..." step, unless user
presses any key.

To avoid this problem, we use the /bin/echo command to give
empty input for /usr/bin/pw command. This is an alternative of
typing "no" or "n".

This is a not the best way. Maybe closing STDIN is good. Or
force users to change account settings from webUI.

See also #852 (pull request). Renato Botelho points out that
"pw userdel" will call "crontab -u %user -r" that is interative.
"pw groupdel" will never be interative, though.
 2013-11-13 06:29:53 +07:00
Renato Botelho
7facbef711 Merge pull request #850 from phil-davis/master 
Handle comma-separated list of remote networks when making vpn_networks table
 2013-11-12 09:05:46 -08:00
Renato Botelho
c4421dfa4f Add an option to set no-sync on rules to keep states from being synced via pfsync. Fix #2501 2013-11-12 10:45:29 -02:00
jim-p
6186cdc4be Rework the usage of the shell i/o during stop_packages(), fixes the "Syntax error: bad fd number" for the remaining people who still saw it on shutdown 2013-11-11 16:29:07 -05:00