diff options
Diffstat (limited to 'etc/inc')
-rw-r--r-- | etc/inc/auth.inc | 2 | ||||
-rw-r--r-- | etc/inc/config.console.inc | 4 | ||||
-rw-r--r-- | etc/inc/config.lib.inc | 11 | ||||
-rw-r--r-- | etc/inc/filter.inc | 7 | ||||
-rw-r--r-- | etc/inc/gwlb.inc | 34 | ||||
-rw-r--r-- | etc/inc/notices.inc | 13 | ||||
-rw-r--r-- | etc/inc/openvpn.inc | 2 | ||||
-rw-r--r-- | etc/inc/priv/user.priv.inc | 6 | ||||
-rw-r--r-- | etc/inc/system.inc | 7 | ||||
-rw-r--r-- | etc/inc/upgrade_config.inc | 4 | ||||
-rw-r--r-- | etc/inc/vpn.inc | 10 |
11 files changed, 72 insertions, 28 deletions
diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 8f1cde8..9d27da8 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -360,6 +360,8 @@ function local_user_set(& $user) { $user_shell = "/usr/local/bin/scponly"; } elseif (userHasPrivilege($user, "user-ssh-tunnel")) { $user_shell = "/usr/local/sbin/ssh_tunnel_shell"; + } elseif (userHasPrivilege($user, "user-ipsec-xauth-dialin")) { + $user_shell = "/sbin/nologin"; } else { $user_shell = "/sbin/nologin"; $lock_account = true; diff --git a/etc/inc/config.console.inc b/etc/inc/config.console.inc index 9512b95..03a9833 100644 --- a/etc/inc/config.console.inc +++ b/etc/inc/config.console.inc @@ -84,8 +84,8 @@ EOD; $iflist = array(); } else { foreach ($iflist as $iface => $ifa) { - echo sprintf("% -6s%s%s\t%s\n", $iface, $ifa['mac'], - $ifa['up'] ? " (up)" : " (down)", $ifa['dmesg']); + echo sprintf("% -6s%s %s %s\n", $iface, $ifa['mac'], + $ifa['up'] ? " (up)" : "(down)", $ifa['dmesg']); } } diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc index 5b84cfa..7232d14 100644 --- a/etc/inc/config.lib.inc +++ b/etc/inc/config.lib.inc @@ -534,10 +534,17 @@ function write_config($desc="Unknown", $backup = true) { /* NOTE: We assume that the file can be parsed since we wrote it. */ $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); if ($config == -1) { + copy("{$g['conf_path']}/config.xml", "{$g['conf_path']}/config.xml.bad"); $last_backup = discover_last_backup(); - if ($last_backup) + if ($last_backup) { restore_backup("/cf/conf/backup/{$last_backup}"); - else + $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); + if ($g['booting']) { + echo "\n\n ************** WARNING **************"; + echo "\n\n Configuration could not be validated. A previous configuration was restored. \n"; + echo "\n The failed configuration file has been saved as {$g['conf_path']}/config.xml.bad} \n\n"; + } + } else log_error(gettext("Could not restore config.xml.")); } else generate_config_cache($config); diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 08b166f..4340f1c 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1060,6 +1060,7 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta)); if(!empty($toadd_array)) { + $target = explode(" ", trim($target)); foreach($toadd_array as $tda) { if (empty($tda)) continue; @@ -1071,7 +1072,6 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_ $socktype = "stream"; $dash_u = ""; } - $target = explode(" ", trim($target)); foreach ($target as $targip) { if (empty($targip)) continue; @@ -2268,7 +2268,7 @@ EOD; } } /* PPTPd enabled? */ - if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) { + if($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off") && !isset($config['system']['disablevpnrules'])) { if($pptpdcfg['mode'] == "server") $pptpdtarget = get_interface_ip(); else @@ -2701,6 +2701,9 @@ function filter_generate_ipsec_rules() { echo "filter_generate_ipsec_rules() being called $mt\n"; } + if (isset($config['system']['disablevpnrules'])) + return "\n# VPN Rules not added disabled in System->Advanced.\n"; + $ipfrules = "\n# VPN Rules\n"; /* Is IP Compression enabled? */ if(isset($config['ipsec']['ipcomp'])) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 6c4cb9d..d2aaa39 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -373,23 +373,33 @@ function return_gateway_groups_array() { */ $upgw = ""; $dfltgwdown = false; + $dfltgwfound = false; foreach ($gateways_arr as $gwname => $gwsttng) { - if ($gwsttng['defaultgw'] == true && stristr($gateways_status[$gwname]['status'], "down")) - $dfltgwdown = true; + if (isset($gwsttng['defaultgw'])) { + $dfltgwfound = true; + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } /* Keep a record of the last up gateway */ if (empty($upgw) && !stristr($gateways_status[$gwname]['status'], "down")) $upgw = $gwname; - if ($dfltgwdown == true && !empty($upgw)) { - if ($gateways_arr[$upgw]['gateway'] == "dynamic") - $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); - if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { - log_error("Default gateway down setting {$upgw} as default!"); - mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); - } + if ($dfltgwdown == true && !empty($upgw)) break; + } + if ($dfltgwfound == false) { + $gwname = convert_friendly_interface_to_friendly_descr("wan"); + if (stristr($gateways_status[$gwname]['status'], "down")) + $dfltgwdown = true; + } + if ($dfltgwdown == true && !empty($upgw)) { + if ($gateways_arr[$upgw]['gateway'] == "dynamic") + $gateways_arr[$upgw]['gateway'] = get_interface_gateway($gateways_arr[$upgw]['friendlyiface']); + if (is_ipaddr($gateways_arr[$upgw]['gateway'])) { + log_error("Default gateway down setting {$upgw} as default!"); + mwexec("/sbin/route delete -inet default; /sbin/route add -inet default {$gateways_arr[$upgw]['gateway']}"); } } - unset($upgw, $dfltgwdown, $gwname, $gwsttng); + unset($upgw, $dfltgwfound, $dfltgwdown, $gwname, $gwsttng); if (is_array($config['gateways']['gateway_group'])) { foreach($config['gateways']['gateway_group'] as $group) { @@ -409,7 +419,7 @@ function return_gateway_groups_array() { $status = $gateways_status[$gwname]; $gwdown = false; if (stristr($status['status'], "down")) { - $msg = sprintf(gettext("MONITOR: %s has high latency, removing from routing group"), $gwname); + $msg = sprintf(gettext("MONITOR: %s is down, removing from routing group"), $gwname); $gwdown = true; } else if (stristr($status['status'], "loss") && strstr($group['trigger'], "loss")) { /* packet loss */ @@ -423,6 +433,7 @@ function return_gateway_groups_array() { if ($gwdown == true) { log_error($msg); notify_via_growl($msg); + notify_via_smtp($msg); } else /* Online add member */ $tiers[$tier][] = $gwname; @@ -435,6 +446,7 @@ function return_gateway_groups_array() { $msg = gettext("Gateways status could not be determined, considering all as up/active."); log_error($msg); notify_via_growl($msg); + notify_via_smtp($msg); } $tiers = $backupplan; } diff --git a/etc/inc/notices.inc b/etc/inc/notices.inc index 54a8489..a35d148 100644 --- a/etc/inc/notices.inc +++ b/etc/inc/notices.inc @@ -345,6 +345,14 @@ function notify_via_smtp($message) { function notify_via_growl($message) { require_once("growl.class"); global $config,$g; + + /* Do NOT send the same message twice */ + if(file_exists("/var/db/growlnotices_lastmsg.txt")) { + $lastmsg = trim(file_get_contents("/var/db/growlnotices_lastmsg.txt")); + if($lastmsg == $message) + return; + } + $hostname = $config['system']['hostname'] . "." . $config['system']['domain']; $growl_ip = $config['notifications']['growl']['ipaddress']; $growl_password = $config['notifications']['growl']['password']; @@ -355,6 +363,11 @@ function notify_via_growl($message) { $growl = new Growl($growl_ip, $growl_password, $growl_name); $growl->notify("{$growl_notification}", gettext(sprintf("%s (%s) - Notification", $g['product_name'], $hostname)), "{$message}"); } + + /* Store last message sent to avoid spamming */ + $fd = fopen("/var/db/growlnotices_lastmsg.txt", "w"); + fwrite($fd, $message); + fclose($fd); } /****f* notices/register_via_growl diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc index 96ea1f9..17769bf 100644 --- a/etc/inc/openvpn.inc +++ b/etc/inc/openvpn.inc @@ -382,13 +382,13 @@ function openvpn_reconfigure($mode, $settings) { // configure p2p/server modes switch($settings['mode']) { - case 'p2p_tls': case 'p2p_shared_key': $baselong = ip2long32($ip) & ip2long($mask); $ip1 = long2ip32($baselong + 1); $ip2 = long2ip32($baselong + 2); $conf .= "ifconfig $ip1 $ip2\n"; break; + case 'p2p_tls': case 'server_tls': case 'server_user': case 'server_tls_user': diff --git a/etc/inc/priv/user.priv.inc b/etc/inc/priv/user.priv.inc index 779f2bb..bfc7f59 100644 --- a/etc/inc/priv/user.priv.inc +++ b/etc/inc/priv/user.priv.inc @@ -21,6 +21,12 @@ $priv_list['user-ssh-tunnel']['descr'] = "Indicates whether the user is able to "Note: User - System - Copy files conflicts with ". "this privilege."; +$priv_list['user-ipsec-xauth-dialin'] = array(); +$priv_list['user-ipsec-xauth-dialin']['name'] = "User - VPN - IPsec xauth Dialin"; +$priv_list['user-ipsec-xauth-dialin']['descr'] = "Indicates whether the user is allowed to dial in via IPsec xauth ". + "(Note: Does not allow shell access, but may allow ". + "the user to create ssh tunnels)"; + $priv_list['user-l2tp-dialin'] = array(); $priv_list['user-l2tp-dialin']['name'] = "User - VPN - L2TP Dialin"; $priv_list['user-l2tp-dialin']['descr'] = "Indicates whether the user is allowed to dial in via L2TP"; diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 0ccce7e..1b80378 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1166,11 +1166,11 @@ function system_ntp_configure() { $ips = array_map('find_interface_ip', $ifaces); foreach ($ips as $ip) { if (is_ipaddr($ip)) - $ntpdcfg .= "listen on $ip\n"; + $ntpcfg .= "listen on $ip\n"; } } } - $ntpdcfg .= "\n"; + $ntpcfg .= "\n"; /* open configuration for wrting or bail */ $fd = fopen("{$g['varetc_path']}/ntpd.conf","w"); @@ -1192,9 +1192,6 @@ function system_ntp_configure() { if(!is_dir("/var/empty")) exec("/bin/mkdir -p /var/empty && chmod ug+rw /var/empty/."); - if ($g['booting']) - return; - /* start opentpd, set time now and use /var/etc/ntpd.conf */ exec("/usr/local/sbin/ntpd -s -f {$g['varetc_path']}/ntpd.conf"); diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc index 8cdc97c..02825a1 100644 --- a/etc/inc/upgrade_config.inc +++ b/etc/inc/upgrade_config.inc @@ -1470,12 +1470,12 @@ function upgrade_051_to_052() { $server['caref'] = $ca['refid']; /* create a crl entry if needed */ - if (!empty($server['crl'])) { + if (!empty($server['crl'][0])) { $crl = array(); $crl['refid'] = uniqid(); $crl['descr'] = "Imported OpenVPN CRL #{$index}"; $crl['caref'] = $ca['refid']; - $crl['text'] = $server['crl']; + $crl['text'] = $server['crl'][0]; if(!is_array($config['crl'])) $config['crl'] = array(); $config['crl'][] = $crl; diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 702ad99..dbd947b 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -896,7 +896,8 @@ EOD; mwexec("/usr/local/sbin/setkey -F", false); sleep("0.1"); /* start racoon */ - mwexec("/usr/local/sbin/racoon -f {$g['varetc_path']}/racoon.conf", false); + $ipsecdebug = isset($config['ipsec']['racoondebug']) ? "-d -v" : ""; + mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/racoon.conf", false); sleep("0.1"); /* load SPD */ mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false); @@ -1489,9 +1490,12 @@ l2tp_standard: EOD; - if (!empty($l2tpcfg['dns1'])) { + if (is_ipaddr($l2tpcfg['wins'])) { + $mpdconf .= " set ipcp nbns {$l2tpcfg['wins']}\n"; + } + if (is_ipaddr($l2tpcfg['dns1'])) { $mpdconf .= " set ipcp dns " . $l2tpcfg['dns1']; - if (!empty($l2tpcfg['dns2'])) + if (is_ipaddr($l2tpcfg['dns2'])) $mpdconf .= " " . $l2tpcfg['dns2']; $mpdconf .= "\n"; } elseif (isset ($config['dnsmasq']['enable'])) { |