Merge remote-tracking branch 'mainline/master' into inc

Conflicts:
	etc/inc/gwlb.inc

14 files changed, 117 insertions, 26 deletions

diff --git a/usr/local/sbin/ntpdate_sync_once.sh b/usr/local/sbin/ntpdate_sync_once.sh
index 508ce3e..e328ac4 100755
--- a/usr/local/sbin/ntpdate_sync_once.sh
+++ b/usr/local/sbin/ntpdate_sync_once.sh
@@ -2,16 +2,18 @@
 
 NOTSYNCED="true"
 SERVER=`cat /cf/conf/config.xml | grep timeservers | cut -d">" -f2 | cut -d"<" -f1`
+pkill -f ntpdate_sync_once.sh
 
 while [ "$NOTSYNCED" = "true" ]; do
-	ntpdate $SERVER
+	# Ensure that ntpd and ntpdate are not running so that the socket we want will be free.
+	killall ntpd 2>/dev/null
+	killall ntpdate
+	sleep 1
+	ntpdate -s -t 5 $SERVER
 	if [ "$?" = "0" ]; then
 		NOTSYNCED="false"
 	fi
 	sleep 5
 done
 
-# Launch -- we have net.
-killall ntpd 2>/dev/null
-sleep 1
-/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf
+/usr/local/sbin/ntpd -s -f /var/etc/ntpd.conf
\ No newline at end of file
diff --git a/usr/local/www/diag_packet_capture.php b/usr/local/www/diag_packet_capture.php
index 8a9cb41..684011c 100644
--- a/usr/local/www/diag_packet_capture.php
+++ b/usr/local/www/diag_packet_capture.php
@@ -72,7 +72,7 @@ if ($_POST) {
 
 	} elseif ($_POST['stopbtn']!= "") {
 		$action = gettext("Stop");
-		$processes_running = trim(shell_exec('/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep '.$fn.' | /usr/bin/grep -v pflog'));
+		$processes_running = trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'"));
 
 		//explode processes into an array, (delimiter is new line)
 		$processes_running_array = explode("\n", $processes_running);
@@ -194,13 +194,13 @@ include("fbegin.inc");
 <?php
 
                     /* check to see if packet capture tcpdump is already running */
-					$processcheck = (trim(shell_exec('/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep $fn | /usr/bin/grep -v pflog')));
+					$processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep {$fn} | /usr/bin/egrep -v '(pflog|grep)'")));
 					
-					$processisrunning = false;
-
-					if ($processcheck != false)
+					if ($processcheck != "")
 						$processisrunning = true;
-						
+					else 
+						$processisrunning = false;
+
 					if (($action == gettext("Stop") or $action == "") and $processisrunning != true)
 						echo "<input type=\"submit\" name=\"startbtn\" value=\"" . gettext("Start") . "\">&nbsp;";
 				  	else {
diff --git a/usr/local/www/head.inc b/usr/local/www/head.inc
index 97c7111..a24be9e 100755
--- a/usr/local/www/head.inc
+++ b/usr/local/www/head.inc
@@ -7,7 +7,7 @@
  *   if user has selected a custom template, use it.
  *   otherwise default to pfsense tempalte
  */
-if($config['theme'] <> "")
+if($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme'])))
 	$g['theme'] = $config['theme'];
 else
 	$g['theme'] = "pfsense";
diff --git a/usr/local/www/interfaces.php b/usr/local/www/interfaces.php
index 2469631..ec8d3ee 100755
--- a/usr/local/www/interfaces.php
+++ b/usr/local/www/interfaces.php
@@ -1200,10 +1200,10 @@ $types = array("none" => gettext("None"), "static" => gettext("Static"), "dhcp"
 														}
 													}
 													?>
-											</select>
+											</select> -or- <a OnClick="show_add_gateway();" href="#"><?=gettext("add a new one."); ?></a>
 											<br/>
 											<div id='addgwbox'>
-												<?=gettext("If this interface is an Internet connection, select an existing Gateway from the list or"); ?> <a OnClick="show_add_gateway();" href="#"><?=gettext("add a new one."); ?></a>
+												<?=gettext("If this interface is an Internet connection, select an existing Gateway from the list or add one using the link above"); ?>
 											</div>
 											<div id='notebox'>
 											</div>
diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php
index d6ffc55..203906a 100644
--- a/usr/local/www/services_captiveportal_vouchers.php
+++ b/usr/local/www/services_captiveportal_vouchers.php
@@ -167,7 +167,7 @@ if ($_POST) {
 	$pconfig = $_POST;
 
 	/* input validation */
-	if ($_POST['enable']) {
+	if ($_POST['enable'] == "yes") {
 		if (!$_POST['vouchersyncusername']) { 
 			$reqdfields = explode(" ", "charset rollbits ticketbits checksumbits publickey magic saveinterval");
 			$reqdfieldsn = array(gettext("charset"),gettext("rollbits"),gettext("ticketbits"),gettext("checksumbits"),gettext("publickey"),gettext("magic"),gettext("saveinterval"));
@@ -202,8 +202,11 @@ if ($_POST) {
 	}
 
 	if (!$input_errors) {
-		$config['voucher']['enable'] = $_POST['enable'] ? true : false;
-		if (!$_POST['vouchersyncusername']) { 
+		if ($_POST['enable'] == "yes")
+			$config['voucher']['enable'] = true;
+		else
+			unset($config['voucher']['enable']);
+		if (empty($_POST['vouchersyncusername'])) {
 			$config['voucher']['charset'] = $_POST['charset'];
 			$config['voucher']['rollbits'] = $_POST['rollbits'];
 			$config['voucher']['ticketbits'] = $_POST['ticketbits'];
diff --git a/usr/local/www/services_snmp.php b/usr/local/www/services_snmp.php
index 432db3d..925cb7b 100755
--- a/usr/local/www/services_snmp.php
+++ b/usr/local/www/services_snmp.php
@@ -384,7 +384,7 @@ function enable_change(whichone) {
 		    <input name="hostres" type="checkbox" id="hostres" value="yes" onClick="check_deps()" <?php if ($pconfig['hostres']) echo "checked"; ?> ><?=gettext("Host Resources (Requires MibII)");?>
 		  </td>
 		</tr>
-<?php if(!$config['interfaces']['lan']): ?>
+<?php if($config['interfaces']['lan']): ?>
 		 <tr> 
 		   <td width="22%" valign="top" class="vtable"></td>
 		   <td width="78%" class="vtable"> 
diff --git a/usr/local/www/system_advanced_firewall.php b/usr/local/www/system_advanced_firewall.php
index 8165922..0cdaad7 100644
--- a/usr/local/www/system_advanced_firewall.php
+++ b/usr/local/www/system_advanced_firewall.php
@@ -66,6 +66,7 @@ $pconfig['reflectiontimeout'] = $config['system']['reflectiontimeout'];
 $pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']);
 $pconfig['disablescrub'] = isset($config['system']['disablescrub']);
 $pconfig['tftpinterface'] = explode(",", $config['system']['tftpinterface']);
+$pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']);
 
 if ($_POST) {
 
@@ -96,6 +97,10 @@ if ($_POST) {
 		else
 			unset($config['system']['disablefilter']);
 
+		if($_POST['disablevpnrules'] == "yes")
+			$config['system']['disablevpnrules'] = true;
+		else
+			unset($config['system']['disablevpnrules']);
 		if($_POST['rfc959workaround'] == "yes")
 			$config['system']['rfc959workaround'] = "enabled";
 		else
@@ -139,7 +144,7 @@ if ($_POST) {
 
 		if($_POST['bypassstaticroutes'] == "yes")
 			$config['filter']['bypassstaticroutes'] = $_POST['bypassstaticroutes'];
-		else
+		elseif(isset($config['filter']['bypassstaticroutes']))
 			unset($config['filter']['bypassstaticroutes']);
 
 		if($_POST['disablescrub'] == "yes")
@@ -331,6 +336,16 @@ function update_description(itemnum) {
 								</td>
 							</tr>
 							<tr>
+								<td width="22%" valign="top" class="vncell">Disable Auto-added VPN rules</td>
+								<td width="78%" class="vtable">
+									<input name="disablevpnrules" type="checkbox" id="disablevpnrules" value="yes" <?php if (isset($config['system']['disablevpnrules'])) echo "checked"; ?> />
+									<strong><?=gettext("Disable all auto-added VPN rules.");?></strong>
+									<br />
+									<span class="vexpl"><?=gettext("Note: This disables automatically added rules for IPsec, PPTP.");?> 
+									</span>
+								</td>
+							</tr>
+							<tr>
 								<td width="22%" valign="top" class="vncell">Disable reply-to</td>
 								<td width="78%" class="vtable">
 									<input name="disablereplyto" type="checkbox" id="disablereplyto" value="yes" <?php if ($pconfig['disablereplyto']) echo "checked"; ?> />
diff --git a/usr/local/www/system_advanced_misc.php b/usr/local/www/system_advanced_misc.php
index b93301d..590a955 100644
--- a/usr/local/www/system_advanced_misc.php
+++ b/usr/local/www/system_advanced_misc.php
@@ -47,11 +47,13 @@ require("guiconfig.inc");
 require_once("functions.inc");
 require_once("filter.inc");
 require_once("shaper.inc");
+require_once("ipsec.inc");
 require_once("vpn.inc");
 
 $pconfig['harddiskstandby'] = $config['system']['harddiskstandby'];
 $pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']);
 $pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']);
+$pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']);
 $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);
 $pconfig['maxmss'] = $config['system']['maxmss'];
 $pconfig['powerd_enable'] = isset($config['system']['powerd_enable']);
@@ -85,6 +87,19 @@ if ($_POST) {
 		else
 			unset($config['ipsec']['preferoldsa']);
 
+		$need_racoon_restart = false;
+		if($_POST['racoondebug_enable'] == "yes") {
+			if (!isset($config['ipsec']['racoondebug'])) {
+				$config['ipsec']['racoondebug'] = true;
+				$need_racoon_restart = true;
+			}
+		} else {
+			if (isset($config['ipsec']['racoondebug'])) {
+				unset($config['ipsec']['racoondebug']);
+				$need_racoon_restart = true;
+			}
+		}
+
 		if($_POST['maxmss_enable'] == "yes") {
                         $config['system']['maxmss_enable'] = true;
 			$config['system']['maxmss'] = $_POST['maxmss'];
@@ -125,6 +140,8 @@ if ($_POST) {
 		activate_powerd();
 		load_glxsb();
 		vpn_ipsec_configure_preferoldsa();
+		if ($need_racoon_restart)
+			vpn_ipsec_force_reload();
 	}
 }
 
@@ -259,6 +276,17 @@ function maxmss_checked(obj) {
 								</td>
 							</tr>
 							<tr>
+								<td width="22%" valign="top" class="vncell"><?=gettext("IPsec Debug"); ?></td>
+								<td width="78%" class="vtable">
+									<input name="racoondebug_enable" type="checkbox" id="racoondebug_enable" value="yes" <?php if ($pconfig['racoondebug_enable']) echo "checked"; ?> />
+									<strong><?=gettext("Start racoon in debug mode"); ?></strong>
+									<br />
+									<?=gettext("Launches racoon in debug mode so that more verbose logs " .
+									"will be generated to aid in troubleshooting."); ?><br/>
+									<?=gettext("NOTE: Changing this setting will restart racoon."); ?>
+								</td>
+							</tr>
+							<tr>
 								<td width="22%" valign="top" class="vncell"><?=gettext("Maximum MSS"); ?></td>
 								<td width="78%" class="vtable">
 									<input name="maxmss_enable" type="checkbox" id="maxmss_enable" value="yes" <?php if ($pconfig['maxmss_enable'] == true) echo "checked"; ?> onClick="maxmss_checked(this)" />
diff --git a/usr/local/www/themes/_corporate/rrdcolors.inc.php b/usr/local/www/themes/_corporate/rrdcolors.inc.php
index e3153fd..09956cc 100644
--- a/usr/local/www/themes/_corporate/rrdcolors.inc.php
+++ b/usr/local/www/themes/_corporate/rrdcolors.inc.php
@@ -32,6 +32,7 @@
 
 $colortrafficup = array("666666", "CCCCCC");
 $colortrafficdown = array("990000", "CC0000");
+$colortraffic95 = array("660000", "FF0000");
 $colorpacketsup = array("666666", "CCCCCC");
 $colorpacketsdown = array("990000", "CC0000");
 $colorstates = array('990000','a83c3c','b36666','bd9090','cccccc','000000');
@@ -46,5 +47,7 @@ $colorqualityloss = "ee0000";
 $colorwireless = array('333333','a83c3c','999999');
 $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066');
 $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600');
+$colorvpnusers = array('990000');
+$colorcaptiveportalusers = array('990000');
 
 ?>
diff --git a/usr/local/www/themes/nervecenter/rrdcolors.inc.php b/usr/local/www/themes/nervecenter/rrdcolors.inc.php
index c681f78..09956cc 100644
--- a/usr/local/www/themes/nervecenter/rrdcolors.inc.php
+++ b/usr/local/www/themes/nervecenter/rrdcolors.inc.php
@@ -48,5 +48,6 @@ $colorwireless = array('333333','a83c3c','999999');
 $colorspamdtime = array('DDDDFF', 'AAAAFF', 'DDDDFF', '000066');
 $colorspamdconn = array('00AA00BB', 'FFFFFFFF', '00660088', 'FFFFFF88', '006600');
 $colorvpnusers = array('990000');
+$colorcaptiveportalusers = array('990000');
 
 ?>
diff --git a/usr/local/www/vpn_ipsec.php b/usr/local/www/vpn_ipsec.php
index 40879f6..465c607 100755
--- a/usr/local/www/vpn_ipsec.php
+++ b/usr/local/www/vpn_ipsec.php
@@ -418,7 +418,9 @@ include("head.inc");
 									<span class="red">
 										<strong><?=gettext("Note"); ?>:<br></strong>
 									</span>
-									<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.
+								<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.<br/>
+									<?=gettext("IPsec Debug Mode can be enabled at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.<br/>
+									<?=gettext("IPsec can be set to prefer older SAs at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.
 								</span>
 							</p>
 						</td>
diff --git a/usr/local/www/vpn_l2tp.php b/usr/local/www/vpn_l2tp.php
index 3cb6e4e..37eac0f 100644
--- a/usr/local/www/vpn_l2tp.php
+++ b/usr/local/www/vpn_l2tp.php
@@ -50,6 +50,9 @@ $pconfig['localip'] = $l2tpcfg['localip'];
 $pconfig['l2tp_subnet'] = $l2tpcfg['l2tp_subnet'];
 $pconfig['mode'] = $l2tpcfg['mode'];
 $pconfig['interface'] = $l2tpcfg['interface'];
+$pconfig['l2tp_dns1'] = $l2tpcfg['dns1'];
+$pconfig['l2tp_dns2'] = $l2tpcfg['dns2'];
+$pconfig['wins'] = $l2tpcfg['wins'];
 $pconfig['radiusenable'] = isset($l2tpcfg['radius']['enable']);
 $pconfig['radacct_enable'] = isset($l2tpcfg['radius']['accounting']);
 $pconfig['radiusserver'] = $l2tpcfg['radius']['server'];
@@ -126,8 +129,26 @@ if ($_POST) {
 		$l2tpcfg['radius']['secret'] = $_POST['radiussecret'];
 		$l2tpcfg['secret'] = $_POST['secret'];
 
+		if($_POST['wins'])
+			$l2tpcfg['wins'] = $_POST['wins'];
+		else
+			unset($l2tpcfg['wins']);
+
 		$l2tpcfg['paporchap'] = $_POST['paporchap'];
 
+
+		if ($_POST['l2tp_dns1'] == "") {
+			if (isset($l2tpcfg['dns1']))
+				unset($l2tpcfg['dns1']);
+			} else
+				$l2tpcfg['dns1'] = $_POST['l2tp_dns1'];
+
+			if ($_POST['l2tp_dns2'] == "") {
+				if (isset($l2tpcfg['dns2']))
+					unset($l2tpcfg['dns2']);
+			} else
+				$l2tpcfg['dns2'] = $_POST['l2tp_dns2'];
+
 		if($_POST['radiusenable'] == "yes")
 			$l2tpcfg['radius']['enable'] = true;
 		else
@@ -183,6 +204,8 @@ function enable_change(enable_over) {
 		document.iform.interface.disabled = 0;
 		document.iform.n_l2tp_units.disabled = 0;
 		document.iform.secret.disabled = 0;
+		document.iform.l2tp_dns1.disabled = 0;
+		document.iform.l2tp_dns2.disabled = 0;
     /* fix colors */
 		document.iform.remoteip.style.backgroundColor = '#FFFFFF';
 		document.iform.localip.style.backgroundColor = '#FFFFFF';
@@ -218,6 +241,8 @@ function enable_change(enable_over) {
 		document.iform.interface.disabled = 1;
 		document.iform.n_l2tp_units.disabled = 1;
 		document.iform.l2tp_subnet.disabled = 1;
+		document.iform.l2tp_dns1.disabled = 1;
+		document.iform.l2tp_dns2.disabled = 1;
 		document.iform.paporchap.disabled = 1;
 		document.iform.remoteip.disabled = 1;
 		document.iform.localip.disabled = 1;
@@ -360,6 +385,22 @@ function enable_change(enable_over) {
                     <?=gettext("Specifies which protocol to use for authentication.");?><br />
                     </td>
                 </tr>
+		<tr>
+		  <td width="22%" valign="top" class="vncell"><?=gettext("L2TP DNS Servers"); ?></td>
+		  <td width="78%" class="vtable">
+		    <?=$mandfldhtml;?><input name="l2tp_dns1" type="text" class="formfld unknown" id="l2tp_dns1" size="20" value="<?=htmlspecialchars($pconfig['l2tp_dns1']);?>">
+		   	<br>
+				<input name="l2tp_dns2" type="text" class="formfld unknown" id="l2tp_dns2" size="20" value="<?=htmlspecialchars($pconfig['l2tp_dns2']);?>">
+			<br>
+		   <?=gettext("primary and secondary DNS servers assigned to L2TP clients"); ?><br>
+		  </td>
+		</tr>
+		<tr>
+		  <td width="22%" valign="top" class="vncell"><?=gettext("WINS Server"); ?></td>
+		  <td width="78%" valign="top" class="vtable">
+		      <input name="wins" class="formfld unknown" id="wins" size="20" value="<?=htmlspecialchars($pconfig['wins']);?>">
+		  </td>
+		</tr>
                 <tr>
                   <td width="22%" valign="top" class="vncell"><?=gettext("RADIUS"); ?></td>
                   <td width="78%" class="vtable">
diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php
index d28315d..4b9fc74 100644
--- a/usr/local/www/vpn_openvpn_client.php
+++ b/usr/local/www/vpn_openvpn_client.php
@@ -654,8 +654,6 @@ if ($savemsg)
 								$caname = "";
 								$inuse = "";
 								$revoked = "";
-								if (is_user_cert($cert['refid']))
-									continue;
 								$ca = lookup_ca($cert['caref']);
 								if ($ca)
 									$caname = " (CA: {$ca['descr']})";
diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php
index cc38e65..204cb62 100644
--- a/usr/local/www/vpn_openvpn_server.php
+++ b/usr/local/www/vpn_openvpn_server.php
@@ -563,9 +563,9 @@ function netbios_change() {
 if (!$savemsg)
 	$savemsg = "";
 if (count($a_ca) == 0)
-	$savemsg .= "You have no Certificate Authorities defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
+	$savemsg .= "You have no Certificate Authorities defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
 if (count($a_cert) == 0)
-	$savemsg .= "<br/>You have no Certificates defined. You must visit the <a href=\"system_camanager.php\">Certificate Manager</a> to make one.";
+	$savemsg .= "<br/>You have no Certificates defined. You can visit the <a href=\"system_camanager.php\">Certificate Manager</a> or use the <a href=\"wizard.php?xml=openvpn_wizard.xml\">Wizard.</a> to create one. ";
 
 if ($input_errors)
 	print_input_errors($input_errors);
@@ -815,8 +815,6 @@ if ($savemsg)
 								$caname = "";
 								$inuse = "";
 								$revoked = "";
-								if (is_user_cert($cert['refid']))
-									continue;
 								$ca = lookup_ca($cert['caref']);
 								if ($ca)
 									$caname = " (CA: {$ca['descr']})";