Merge remote-tracking branch 'mainline/master' into inc

Conflicts:
	etc/inc/gwlb.inc

11 files changed, 72 insertions, 28 deletions

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 8f1cde8..9d27da8 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -360,6 +360,8 @@ function local_user_set(& $user) {
 		$user_shell = "/usr/local/bin/scponly";
 	} elseif (userHasPrivilege($user, "user-ssh-tunnel")) {
 		$user_shell = "/usr/local/sbin/ssh_tunnel_shell";
+	} elseif (userHasPrivilege($user, "user-ipsec-xauth-dialin")) {
+		$user_shell = "/sbin/nologin";
 	} else {
 		$user_shell = "/sbin/nologin";
 		$lock_account = true;
diff --git a/etc/inc/config.console.inc b/etc/inc/config.console.inc
index 9512b95..03a9833 100644
--- a/etc/inc/config.console.inc
+++ b/etc/inc/config.console.inc
@@ -84,8 +84,8 @@ EOD;
 		$iflist = array();
 	} else {
 		foreach ($iflist as $iface => $ifa) {
-			echo sprintf("% -6s%s%s\t%s\n", $iface, $ifa['mac'],
-				$ifa['up'] ? "   (up)" : "   (down)", $ifa['dmesg']);
+			echo sprintf("% -6s%s %s %s\n", $iface, $ifa['mac'],
+				$ifa['up'] ? "  (up)" : "(down)", $ifa['dmesg']);
 		}
 	}
 
diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc
index 5b84cfa..7232d14 100644
--- a/etc/inc/config.lib.inc
+++ b/etc/inc/config.lib.inc
@@ -534,10 +534,17 @@ function write_config($desc="Unknown", $backup = true) {
 	/* NOTE: We assume that the file can be parsed since we wrote it. */
 	$config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']);
 	if ($config == -1) {
+		copy("{$g['conf_path']}/config.xml", "{$g['conf_path']}/config.xml.bad");
 		$last_backup = discover_last_backup();
-		if ($last_backup)
+		if ($last_backup) {
 			restore_backup("/cf/conf/backup/{$last_backup}");
-		else
+			$config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']);
+			if ($g['booting']) {
+				echo "\n\n ************** WARNING **************";
+				echo "\n\n Configuration could not be validated. A previous configuration was restored. \n";
+				echo "\n The failed configuration file has been saved as {$g['conf_path']}/config.xml.bad} \n\n";
+			}
+		} else
 			log_error(gettext("Could not restore config.xml."));
 	} else
 		generate_config_cache($config);
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 08b166f..4340f1c 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1060,6 +1060,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 				$toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta));
 
 				if(!empty($toadd_array)) {
+					$target = explode(" ", trim($target));
 					foreach($toadd_array as $tda) {
 						if (empty($tda))
 							continue;
@@ -1071,7 +1072,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
 								$socktype = "stream";
 								$dash_u = "";
 							}
-							$target = explode(" ", trim($target));
 							foreach ($target as $targip) {
 								if (empty($targip))
 									continue;
@@ -2268,7 +2268,7 @@ EOD;
 		}
 	}
 	/* PPTPd enabled? */
-	if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) {
+	if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off") && !isset($config['system']['disablevpnrules'])) {
 		if($pptpdcfg['mode'] == "server")
 			$pptpdtarget = get_interface_ip();
 		else
@@ -2701,6 +2701,9 @@ function filter_generate_ipsec_rules() {
 		echo "filter_generate_ipsec_rules() being called $mt\n";
 	}
 
+	if (isset($config['system']['disablevpnrules']))
+		return "\n# VPN Rules not added disabled in System->Advanced.\n";
+
 	$ipfrules = "\n# VPN Rules\n";
 	/* Is IP Compression enabled? */
 	if(isset($config['ipsec']['ipcomp']))
diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc
index 6c4cb9d..d2aaa39 100644
--- a/etc/inc/gwlb.inc
+++ b/etc/inc/gwlb.inc
@@ -373,23 +373,33 @@ function return_gateway_groups_array() {
 	 */
 	$upgw = "";
 	$dfltgwdown = false;
+	$dfltgwfound = false;
 	foreach ($gateways_arr as $gwname => $gwsttng) {
-		if ($gwsttng['defaultgw'] == true && stristr($gateways_status[$gwname]['status'], "down"))
-			$dfltgwdown = true;
+		if (isset($gwsttng['defaultgw'])) {
+			$dfltgwfound = true;
+			if (stristr($gateways_status[$gwname]['status'], "down"))
+				$dfltgwdown = true;
+		}
 		/* Keep a record of the last up gateway */
 		if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down"))
 			$upgw = $gwname;
-		if ($dfltgwdown == true && !empty($upgw)) {
-			if ($gateways_arr[$upgw]['gateway'] == "dynamic")
-				$gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']);
-			if (is_ipaddr($gateways_arr[$upgw]['gateway'])) {
-				log_error("Default gateway down setting {$upgw} as default!");
-				mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}");
-			}
+		if ($dfltgwdown == true && !empty($upgw))
 			break;
+	}
+	if ($dfltgwfound == false) {
+		$gwname = convert_friendly_interface_to_friendly_descr("wan");
+		if (stristr($gateways_status[$gwname]['status'], "down"))
+			$dfltgwdown = true;
+	}
+	if ($dfltgwdown == true && !empty($upgw)) {
+		if ($gateways_arr[$upgw]['gateway'] == "dynamic")
+			$gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']);
+		if (is_ipaddr($gateways_arr[$upgw]['gateway'])) {
+			log_error("Default gateway down setting {$upgw} as default!");
+			mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}");
 		}
 	}
-	unset($upgw, $dfltgwdown, $gwname, $gwsttng);
+	unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng);
 
 	if (is_array($config['gateways']['gateway_group'])) {
 		foreach($config['gateways']['gateway_group'] as $group) {
@@ -409,7 +419,7 @@ function return_gateway_groups_array() {
 					$status = $gateways_status[$gwname];
 					$gwdown = false;
 					if (stristr($status['status'], "down")) {
-						$msg = sprintf(gettext("MONITOR: %s has high latency, removing from routing group"), $gwname);
+						$msg = sprintf(gettext("MONITOR: %s is down, removing from routing group"), $gwname);
 						$gwdown = true;
 					} else if (stristr($status['status'], "loss") && strstr($group['trigger'], "loss")) {
 						/* packet loss */
@@ -423,6 +433,7 @@ function return_gateway_groups_array() {
 					if ($gwdown == true) {
 						log_error($msg);
 						notify_via_growl($msg);
+						notify_via_smtp($msg);
 					} else
 						/* Online add member */
 						$tiers[$tier][] = $gwname;
@@ -435,6 +446,7 @@ function return_gateway_groups_array() {
 					$msg = gettext("Gateways status could not be determined, considering all as up/active.");
 					log_error($msg);
 					notify_via_growl($msg);
+					notify_via_smtp($msg);
 				}
 				$tiers = $backupplan;
 			}
diff --git a/etc/inc/notices.inc b/etc/inc/notices.inc
index 54a8489..a35d148 100644
--- a/etc/inc/notices.inc
+++ b/etc/inc/notices.inc
@@ -345,6 +345,14 @@ function notify_via_smtp($message) {
 function notify_via_growl($message) {
 	require_once("growl.class");
 	global $config,$g;
+
+	/* Do NOT send the same message twice */
+	if(file_exists("/var/db/growlnotices_lastmsg.txt")) {
+		$lastmsg = trim(file_get_contents("/var/db/growlnotices_lastmsg.txt"));
+		if($lastmsg == $message)
+			return;
+	}
+
 	$hostname = $config['system']['hostname'] . "." . $config['system']['domain'];
 	$growl_ip = $config['notifications']['growl']['ipaddress'];
 	$growl_password = $config['notifications']['growl']['password'];
@@ -355,6 +363,11 @@ function notify_via_growl($message) {
 		$growl = new Growl($growl_ip, $growl_password, $growl_name);
 		$growl->notify("{$growl_notification}", gettext(sprintf("%s (%s) - Notification", $g['product_name'], $hostname)), "{$message}");
 	}
+
+	/* Store last message sent to avoid spamming */
+	$fd = fopen("/var/db/growlnotices_lastmsg.txt", "w");
+	fwrite($fd, $message);
+	fclose($fd);
 }
 
 /****f* notices/register_via_growl
diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 96ea1f9..17769bf 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -382,13 +382,13 @@ function openvpn_reconfigure($mode, $settings) {
 
 		// configure p2p/server modes
 		switch($settings['mode']) {
-			case 'p2p_tls':
 			case 'p2p_shared_key':
 				$baselong = ip2long32($ip) & ip2long($mask);
 				$ip1 = long2ip32($baselong + 1);
 				$ip2 = long2ip32($baselong + 2);
 				$conf .= "ifconfig $ip1 $ip2\n";
 				break;
+			case 'p2p_tls':
 			case 'server_tls':
 			case 'server_user':
 			case 'server_tls_user':
diff --git a/etc/inc/priv/user.priv.inc b/etc/inc/priv/user.priv.inc
index 779f2bb..bfc7f59 100644
--- a/etc/inc/priv/user.priv.inc
+++ b/etc/inc/priv/user.priv.inc
@@ -21,6 +21,12 @@ $priv_list['user-ssh-tunnel']['descr'] = "Indicates whether the user is able to
 										"Note: User - System - Copy files conflicts with ".
 										"this privilege.";
 
+$priv_list['user-ipsec-xauth-dialin'] = array();
+$priv_list['user-ipsec-xauth-dialin']['name'] = "User - VPN - IPsec xauth Dialin";
+$priv_list['user-ipsec-xauth-dialin']['descr'] = "Indicates whether the user is allowed to dial in via IPsec xauth ".
+										"(Note: Does not allow shell access, but may allow ".
+										"the user to create ssh tunnels)";
+
 $priv_list['user-l2tp-dialin'] = array();
 $priv_list['user-l2tp-dialin']['name'] = "User - VPN - L2TP Dialin";
 $priv_list['user-l2tp-dialin']['descr'] = "Indicates whether the user is allowed to dial in via L2TP";
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 0ccce7e..1b80378 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -1166,11 +1166,11 @@ function system_ntp_configure() {
 			$ips = array_map('find_interface_ip', $ifaces);
 			foreach ($ips as $ip) {
 				if (is_ipaddr($ip))
-					$ntpdcfg .= "listen on $ip\n";
+					$ntpcfg .= "listen on $ip\n";
 			}
 		}
 	}
-	$ntpdcfg .= "\n";
+	$ntpcfg .= "\n";
 
 	/* open configuration for wrting or bail */
 	$fd = fopen("{$g['varetc_path']}/ntpd.conf","w");
@@ -1192,9 +1192,6 @@ function system_ntp_configure() {
 	if(!is_dir("/var/empty"))
 		exec("/bin/mkdir -p /var/empty && chmod ug+rw /var/empty/.");
 
-	if ($g['booting'])
-		return;
-
 	/* start opentpd, set time now and use /var/etc/ntpd.conf */
 	exec("/usr/local/sbin/ntpd -s -f {$g['varetc_path']}/ntpd.conf");
 	
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index 8cdc97c..02825a1 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -1470,12 +1470,12 @@ function upgrade_051_to_052() {
 				$server['caref'] = $ca['refid'];
 
 				/* create a crl entry if needed */
-				if (!empty($server['crl'])) {
+				if (!empty($server['crl'][0])) {
 					$crl = array();
 					$crl['refid'] = uniqid();
 					$crl['descr'] = "Imported OpenVPN CRL #{$index}";
 					$crl['caref'] = $ca['refid'];
-					$crl['text'] = $server['crl'];
+					$crl['text'] = $server['crl'][0];
 					if(!is_array($config['crl']))
 						$config['crl'] = array();
 					$config['crl'][] = $crl;
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 702ad99..dbd947b 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -896,7 +896,8 @@ EOD;
 			mwexec("/usr/local/sbin/setkey -F", false);
  			sleep("0.1");
  			/* start racoon */
-			mwexec("/usr/local/sbin/racoon -f {$g['varetc_path']}/racoon.conf", false);
+			$ipsecdebug = isset($config['ipsec']['racoondebug']) ? "-d -v" : "";
+			mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/racoon.conf", false);
  			sleep("0.1");
  			/* load SPD */
 			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
@@ -1489,9 +1490,12 @@ l2tp_standard:
 
 EOD;
 
-			if (!empty($l2tpcfg['dns1'])) {
+			if (is_ipaddr($l2tpcfg['wins'])) {
+				$mpdconf .= "	set ipcp nbns {$l2tpcfg['wins']}\n";
+			}
+			if (is_ipaddr($l2tpcfg['dns1'])) {
 				$mpdconf .= "	set ipcp dns " . $l2tpcfg['dns1'];
-				if (!empty($l2tpcfg['dns2']))
+				if (is_ipaddr($l2tpcfg['dns2']))
 					$mpdconf .= " " . $l2tpcfg['dns2'];
 				$mpdconf .= "\n";
 			} elseif (isset ($config['dnsmasq']['enable'])) {