diff options
Diffstat (limited to 'etc')
50 files changed, 11088 insertions, 0 deletions
diff --git a/etc/auth.conf b/etc/auth.conf new file mode 100644 index 0000000..3062d37 --- /dev/null +++ b/etc/auth.conf @@ -0,0 +1,10 @@ +# +# $FreeBSD: src/etc/auth.conf,v 1.4.2.1 2001/07/13 14:37:26 dd Exp $ +# +# This file contains information on what types of authentication to use. +# It is just the beginnings of a greater scheme. + +# crypt_default = md5 des +# auth_list = passwd kerberos + +auth_list = passwd diff --git a/etc/disktab b/etc/disktab new file mode 100644 index 0000000..43ebdf9 --- /dev/null +++ b/etc/disktab @@ -0,0 +1,235 @@ +# $FreeBSD: src/etc/etc.i386/disktab,v 1.20.2.2 2002/04/15 00:44:15 dougb Exp $ +# +# Disk geometry and partition layout tables. +# Key: +# dt controller type +# ty type of disk (fixed, removeable, simulated) +# d[0-4] drive-type-dependent parameters +# ns #sectors/track +# nt #tracks/cylinder +# nc #cylinders/disk +# sc #sectors/cylinder, ns*nt default +# su #sectors/unit, sc*nc default +# se sector size, DEV_BSIZE default +# rm rpm, 3600 default +# sf supports bad144-style bad sector forwarding +# sk sector skew per track, default 0 +# cs sector skew per cylinder, default 0 +# hs headswitch time, default 0 +# ts one-cylinder seek time, default 0 +# il sector interleave (n:1), 1 default +# bs boot block size, default BBSIZE +# sb superblock size, default SBSIZE +# o[a-h] partition offsets in sectors +# p[a-h] partition sizes in sectors +# b[a-h] partition block sizes in bytes +# f[a-h] partition fragment sizes in bytes +# t[a-h] partition types (filesystem, swap, etc) +# +# All partition sizes reserve space for bad sector tables. +# (5 cylinders needed for maintenance + replacement sectors) +# + +# +# Floppy formats: +# +# To make a filesystem on a floppy: +# fdformat [-f <size>] fd<drive>[.<size>] +# disklabel -B -r -w fd<drive>[.<size>] fd<size> +# newfs <opts> fd<drive>[.<size>] +# +# with <opts>: +# -t 2 - two heads +# -u 9|15|18 - sectors per track +# (using the default value of 1/4096 is not much useful for floppies) +# -l 1 - interleave 1 (for most floppies) +# -i 65536 - bytes of data per i-node +# (the default -i value will render you with a floppy wasting way +# too much space in i-node areas) +# + +fd360:\ + :ty=floppy:se#512:nt#2:rm#300:ns#9:nc#40:\ + :pa#720:oa#0:ba#4096:fa#512:\ + :pb#720:ob#0:bb#4096:fb#512:\ + :pc#720:oc#0:bc#4096:fc#512: + +fd720:\ + :ty=floppy:se#512:nt#2:rm#300:ns#9:nc#80:\ + :pa#1440:oa#0:ba#4096:fa#512:\ + :pb#1440:ob#0:bb#4096:fb#512:\ + :pc#1440:oc#0:bc#4096:fc#512: + +fd1200|floppy5|5in|5.25in High Density Floppy:\ + :ty=floppy:se#512:nt#2:rm#360:ns#15:nc#80:\ + :pa#2400:oa#0:ba#4096:fa#512:\ + :pb#2400:ob#0:bb#4096:fb#512:\ + :pc#2400:oc#0:bc#4096:fc#512: + +fd1440|floppy|floppy3|3in|3.5in High Density Floppy:\ + :ty=floppy:se#512:nt#2:rm#300:ns#18:nc#80:\ + :pa#2880:oa#0:ba#4096:fa#512:\ + :pb#2880:ob#0:bb#4096:fb#512:\ + :pc#2880:oc#0:bc#4096:fc#512: + +# +# Stressed floppy-formats. No guarantees given. +# + +fd800:\ + :ty=floppy:se#512:nt#2:rm#300:ns#10:nc#80:\ + :pa#1600:oa#0:ba#4096:fa#512:\ + :pb#1600:ob#0:bb#4096:fb#512:\ + :pc#1600:oc#0:bc#4096:fc#512: + +fd820:\ + :ty=floppy:se#512:nt#2:rm#300:ns#10:nc#82:\ + :pa#1640:oa#0:ba#4096:fa#512:\ + :pb#1640:ob#0:bb#4096:fb#512:\ + :pc#1640:oc#0:bc#4096:fc#512: + +fd1480:\ + :ty=floppy:se#512:nt#2:rm#300:ns#18:nc#82:\ + :pa#2952:oa#0:ba#4096:fa#512:\ + :pb#2952:ob#0:bb#4096:fb#512:\ + :pc#2952:oc#0:bc#4096:fc#512: + +fd1720:\ + :ty=floppy:se#512:nt#2:rm#300:ns#21:nc#82:\ + :pa#3444:oa#0:ba#4096:fa#512:\ + :pb#3444:ob#0:bb#4096:fb#512:\ + :pc#3444:oc#0:bc#4096:fc#512: + +# +# LS-120 floppy-format. +# +fd120m|floppy120|floppy120m|3.5in LS-120 Floppy:\ + :ty=floppy:se#512:nt#8:rm#300:ns#32:nc#963:\ + :pa#246528:oa#0:ba#4096:fa#512:\ + :pb#246528:ob#0:bb#4096:fb#512:\ + :pc#246528:oc#0:bc#4096:fc#512: + +# +# Harddisk formats +# +qp120at|Quantum Peripherals 120MB IDE:\ + :dt=ESDI:ty=winchester:se#512:nt#9:ns#32:nc#813:sf: \ + :pa#13824:oa#0:ta=4.2BSD:ba#4096:fa#512: \ + :pb#13824:ob#13824:tb=swap: \ + :pc#234144:oc#0: \ + :ph#206496:oh#27648:th=4.2BSD:bh#4096:fh#512: + +pan60|Panasonic Laptop's 60MB IDE:\ + :dt=ST506:ty=winchester:se#512:nt#13:ns#17:nc#565:\ + :pa#13260:oa#0:ta=4.2BSD:ba#4096:fa#512:\ + :pb#13260:ob#13260:tb=swap: \ + :pc#124865:oc#0: \ + :ph#97682:oh#26520:th=4.2BSD:bh#4096:fh#512: + +mk156|toshiba156|Toshiba MK156 156Mb:\ + :dt=SCSI:ty=winchester:se#512:nt#10:ns#35:nc#825:\ + :pa#15748:oa#0:ba#4096:fa#512:ta=4.2BSD:\ + :pb#15748:ob#15748:tb=swap:\ + :pc#288750:oc#0:\ + :ph#257250:oh#31500:bh#4096:fh#512:th=4.2BSD: + +cp3100|Connor Peripherals 100MB IDE:\ + :dt=ST506:ty=winchester:se#512:nt#8:ns#33:nc#766: \ + :pa#12144:oa#0:ta=4.2BSD:ba#4096:fa#512: \ + :pb#12144:ob#12144:tb=swap: \ + :pc#202224:oc#0: \ + :ph#177936:oh#24288:th=4.2BSD:bh#4096:fh#512: + +# a == root +# b == swap +# c == d == whole disk +# e == /var +# f == scratch +# h == /usr + +cp3100new|Connor Peripherals 100MB IDE, with a different configuration:\ + :dt=ST506:ty=winchester:se#512:nt#8:ns#33:nc#766: \ + :pa#15840:oa#0:ta=4.2BSD:ba#4096:fa#512: \ + :pb#24288:ob#15840:tb=swap: \ + :pc#202224:oc#0: \ + :pd#202224:od#0: \ + :pe#15840:oe#40128:te=4.2BSD:be#4096:fe#512: \ + :pg#15840:og#55968:tg=4.2BSD:bg#4096:fg#512: \ + :ph#130416:oh#71808:th=4.2BSD:bh#4096:fh#512: + +maxtor4380|Maxtor XT4380E ESDI :\ + :dt=ESDI:ty=winchester:se#512:nt#15:ns#36:nc#1222:sf: \ + :pa#21600:oa#0:ta=4.2BSD:ba#4096:fa#512:\ + :pb#21600:ob#21600:tb=swap: \ + :pc#659880:oc#0: \ + :pd#216000:od#53200:td=4.2BSD:bd#4096:fd#512: \ + :ph#398520:oh#269200:th=4.2BSD:bh#4096:fh#512: + +miniscribe9380|compaq38|Miniscribe 9380 ESDI :\ + :ty=winchester:dt=ESDI:se#512:nt#15:ns#35:nc#1223:rm#3600:sf: \ + :pa#21000:oa#0:ba#8192:fa#1024:ta=4.2BSD: \ + :pb#42000:ob#21000:tb=swap: \ + :pc#642075:oc#0: \ + :pd#21000:od#63000:bd#8192:fd#1024:td=4.2BSD: \ + :ph#556500:oh#84000:bh#8192:fh#1024:th=4.2BSD: + +ida4|compaq88|Compaq IDA (4 drives) :\ + :ty=winchester:dt=IDA:se#512:nt#16:ns#63:nc#1644:rm#3600:\ + :pa#20160:oa#0:ba#8192:fa#1024:ta=4.2BSD: \ + :pb#80640:ob#20160:tb=swap: \ + :pc#1659168:oc#0: \ + :pd#201600:od#100800:bd#8192:fd#1024:td=4.2BSD: \ + :pe#20160:oe#1310400:be#8192:fe#1024:te=4.2BSD: \ + :ph#1008000:oh#302400:bh#8192:fh#1024:th=4.2BSD: \ + :pg#302400:og#1330560:bg#4096:fg#512:tg=4.2BSD: + +fuji513|Fujitsu M22XXXX: \ + :ty=winchester:dt=ESDI:se#512:nt#16:ns#63:nc#954:rm#3600:\ + :pa#20160:oa#82656:ba#4096:fa#512:ta=4.2BSD: \ + :pb#40320:ob#102816:tb=swap: \ + :pc#961632:oc#0: \ + :ph#656208:oh#143136:bh#4096:fh#512:th=4.2BSD: + +sony650|Sony 650 MB MOD|\ + :ty=removable:dt=SCSI:se#512:nt#1:ns#31:nc#18600:ts#1:rm#4800:\ + :pc#576600:oc#0:\ + :pa#576600:oa#0:ta=4.2BSD:ba#8192:fa#1024: + +mta3230|mo230|IBM MTA-3230 230 Meg 3.5inch Magneto-Optical:\ + :ty=removeable:dt=SCSI:rm#3600:\ + :se#512:nt#64:ns#32:nc#216:sc#2048:su#444384:\ + :pa#444384:oa#0:ba#4096:fa#0:ta=4.2BSD:\ + :pc#444384:oc#0: + +minimum:ty=mfs:se#512:nt#1:rm#300:\ + :ns#2880:nc#1:\ + :pa#2880:oa#0:ba#4096:fa#512:\ + :pc#2880:oc#0:bc#4096:fc#512: + +minimum2:ty=mfs:se#512:nt#1:rm#300:\ + :ns#5760:nc#1:\ + :pa#5760:oa#0:ba#4096:fa#512:\ + :pc#5760:oc#0:bc#4096:fc#512: + +minimum3:ty=mfs:se#512:nt#1:rm#300:\ + :ns#8640:nc#1:\ + :pa#8640:oa#0:ba#4096:fa#512:\ + :pc#8640:oc#0:bc#4096:fc#512: + +zip100|zip 100:\ + :ty=removable:se#512:nc#96:nt#64:ns#32:\ + :pa#196608:oa#0:ba#4096:fa#512:\ + :pb#196608:ob#0:bb#4096:fb#512:\ + :pc#196608:oc#0:bc#4096:fc#512: + +zip250|zip 250:\ + :ty=removable:se#512:nc#239:nt#64:ns#32:\ + :pa#489472:oa#0:ba#4096:fa#512:\ + :pb#489472:ob#0:bb#4096:fb#512:\ + :pc#489472:oc#0:bc#4096:fc#512: + +orb2200|orb22|orb:\ + :ty=removable:ns#63:nt#128:nc#4273:sc#1008:su#4307184:se#512:\ + :pa#4307184:oa#0:ba#8192:fa#1024:\ + :pc#4307184:oc#0:bc#8192:fc#1024: + diff --git a/etc/fbtab b/etc/fbtab new file mode 100644 index 0000000..06d2d61 --- /dev/null +++ b/etc/fbtab @@ -0,0 +1,4 @@ +# $FreeBSD: src/etc/fbtab,v 1.3 1999/09/13 17:09:07 peter Exp $ +# +#/dev/ttyv0 0600 /dev/console +#/dev/ttyv0 0600 /dev/pcaudio:/dev/pcaudioctl diff --git a/etc/group b/etc/group new file mode 100644 index 0000000..cac3e1e --- /dev/null +++ b/etc/group @@ -0,0 +1,15 @@ +wheel:*:0:root,admin +daemon:*:1:daemon +kmem:*:2:root +sys:*:3:root +tty:*:4:root +operator:*:5:root +bin:*:7: +staff:*:20:root +guest:*:31:root +dialer:*:68: +network:*:69: +www:*:80: +nogroup:*:65533: +nobody:*:65534: +admin:*:101: diff --git a/etc/host.conf b/etc/host.conf new file mode 100644 index 0000000..6643c7f --- /dev/null +++ b/etc/host.conf @@ -0,0 +1,7 @@ +# $FreeBSD: src/etc/host.conf,v 1.6 1999/08/27 23:23:41 peter Exp $ +# First try the /etc/hosts file +hosts +# Now try the nameserver next. +bind +# If you have YP/NIS configured, uncomment the next line +# nis diff --git a/etc/hosts.allow b/etc/hosts.allow new file mode 100644 index 0000000..ab11cc0 --- /dev/null +++ b/etc/hosts.allow @@ -0,0 +1,5 @@ +# +# hosts.allow access control file for "tcp wrapped" applications. +# +ALL : ALL : allow + diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc new file mode 100644 index 0000000..d5d78b1 --- /dev/null +++ b/etc/inc/captiveportal.inc @@ -0,0 +1,642 @@ +<?php +/* + captiveportal.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); +require_once("radius_accounting.inc") ; + +function captiveportal_configure() { + global $config, $g; + + if (isset($config['captiveportal']['enable']) && + (($config['captiveportal']['interface'] == "lan") || + isset($config['interfaces'][$config['captiveportal']['interface']]['enable']))) { + + if ($g['booting']) + echo "Starting captive portal... "; + + /* kill any running mini_httpd */ + killbypid("{$g['varrun_path']}/mini_httpd.cp.pid"); + killbypid("{$g['varrun_path']}/mini_httpd.cps.pid"); + + /* kill any running minicron */ + killbypid("{$g['varrun_path']}/minicron.pid"); + + /* generate ipfw rules */ + $cprules = captiveportal_rules_generate(); + + /* make sure ipfw is loaded */ + mwexec("/sbin/kldload ipfw"); + + /* stop accounting on all clients */ + captiveportal_radius_stop_all() ; + + /* remove old information */ + unlink_if_exists("{$g['vardb_path']}/captiveportal.nextrule"); + unlink_if_exists("{$g['vardb_path']}/captiveportal.db"); + unlink_if_exists("{$g['vardb_path']}/captiveportal_mac.db"); + unlink_if_exists("{$g['vardb_path']}/captiveportal_ip.db"); + unlink_if_exists("{$g['vardb_path']}/captiveportal_radius.db"); + + /* write portal page */ + if ($config['captiveportal']['page']['htmltext']) + $htmltext = base64_decode($config['captiveportal']['page']['htmltext']); + else { + /* example/template page */ + $htmltext = <<<EOD +<html> +<head> +<title>m0n0wall captive portal</title> +</head> +<body> +<h2>m0n0wall captive portal</h2> +<p>This is the default captive portal page. Please upload your own custom HTML file on the <em>Services: Captive portal</em> screen in the m0n0wall webGUI.</p> +<form method="post" action=""> + <input name="accept" type="submit" value="Continue"> +</form> +</body> +</html> + +EOD; + } + + $fd = @fopen("{$g['varetc_path']}/captiveportal.html", "w"); + if ($fd) { + fwrite($fd, $htmltext); + fclose($fd); + } + + /* write error page */ + if ($config['captiveportal']['page']['errtext']) + $errtext = base64_decode($config['captiveportal']['page']['errtext']); + else { + /* example page */ + $errtext = <<<EOD +<html> +<head> +<title>Authentication error</title> +</head> +<body> +<font color="#cc0000"><h2>Authentication error</h2></font> +<b> +Username and/or password invalid. +<br><br> +<a href="javascript:history.back()">Go back</a> +</b> +</body> +</html> + +EOD; + } + + $fd = @fopen("{$g['varetc_path']}/captiveportal-error.html", "w"); + if ($fd) { + fwrite($fd, $errtext); + fclose($fd); + } + + /* load rules */ + mwexec("/sbin/ipfw -f delete set 1"); + mwexec("/sbin/ipfw -f delete set 2"); + mwexec("/sbin/ipfw -f delete set 3"); + + /* XXX - seems like ipfw cannot accept rules directly on stdin, + so we have to write them to a temporary file first */ + $fd = @fopen("{$g['tmp_path']}/ipfw.cp.rules", "w"); + if (!$fd) { + printf("Cannot open ipfw.cp.rules in captiveportal_configure()\n"); + return 1; + } + + fwrite($fd, $cprules); + fclose($fd); + + mwexec("/sbin/ipfw {$g['tmp_path']}/ipfw.cp.rules"); + + unlink("{$g['tmp_path']}/ipfw.cp.rules"); + + /* filter on layer2 as well so we can check MAC addresses */ + mwexec("/sbin/sysctl net.link.ether.ipfw=1"); + + chdir($g['captiveportal_path']); + + /* start web server */ + mwexec("/usr/local/sbin/mini_httpd -a -M 0 -u root -maxproc 16" . + " -p 8000 -i {$g['varrun_path']}/mini_httpd.cp.pid"); + + /* fire up another one for HTTPS if requested */ + if (isset($config['captiveportal']['httpslogin']) && + $config['captiveportal']['certificate'] && $config['captiveportal']['private-key']) { + + $cert = base64_decode($config['captiveportal']['certificate']); + $key = base64_decode($config['captiveportal']['private-key']); + + $fd = fopen("{$g['varetc_path']}/cert-portal.pem", "w"); + if (!$fd) { + printf("Error: cannot open cert-portal.pem in system_webgui_start().\n"); + return 1; + } + chmod("{$g['varetc_path']}/cert-portal.pem", 0600); + fwrite($fd, $cert); + fwrite($fd, "\n"); + fwrite($fd, $key); + fclose($fd); + + mwexec("/usr/local/sbin/mini_httpd -S -a -M 0 -E {$g['varetc_path']}/cert-portal.pem" . + " -u root -maxproc 16 -p 8001" . + " -i {$g['varrun_path']}/mini_httpd.cps.pid"); + } + + /* start pruning process (interval = 60 seconds) */ + mwexec("/usr/local/bin/minicron 60 {$g['varrun_path']}/minicron.pid " . + "/etc/rc.prunecaptiveportal"); + + /* generate passthru mac database */ + captiveportal_passthrumac_configure() ; + /* create allowed ip database and insert ipfw rules to make it so */ + captiveportal_allowedip_configure() ; + + /* generate radius server database */ + if($config['captiveportal']['radiusip']) { + $radiusip = $config['captiveportal']['radiusip'] ; + + if($config['captiveportal']['radiusport']) + $radiusport = $config['captiveportal']['radiusport'] ; + else + $radiusport = 1812; + + if($config['captiveportal']['radiusacctport']) + $radiusacctport = $config['captiveportal']['radiusacctport'] ; + else + $radiusacctport = 1813; + + $radiuskey = $config['captiveportal']['radiuskey']; + + $fd = @fopen("{$g['vardb_path']}/captiveportal_radius.db", "w"); + if (!$fd) { + printf("Error: cannot open radius DB file in captiveportal_configure().\n"); + return 1; + } else { + fwrite($fd,$radiusip . "," . $radiusport . "," . $radiusacctport . "," . $radiuskey) ; + } + fclose($fd) ; + } + + + if ($g['booting']) + echo "done\n"; + + } else { + killbypid("{$g['varrun_path']}/mini_httpd.cp.pid"); + killbypid("{$g['varrun_path']}/minicron.pid"); + captiveportal_radius_stop_all() ; + mwexec("/sbin/sysctl net.link.ether.ipfw=0"); + if (!isset($config['shaper']['enable'])) { + /* unload ipfw */ + mwexec("/sbin/kldunload ipfw"); + } else { + /* shaper is on - just remove our rules */ + mwexec("/sbin/ipfw -f delete set 1"); + mwexec("/sbin/ipfw -f delete set 2"); + mwexec("/sbin/ipfw -f delete set 3"); + } + } + + return 0; +} + +function captiveportal_rules_generate() { + global $config, $g; + + $cpifn = $config['captiveportal']['interface']; + $cpif = $config['interfaces'][$cpifn]['if']; + $cpip = $config['interfaces'][$cpifn]['ipaddr']; + + /* note: the captive portal daemon inserts all pass rules for authenticated + clients as skipto 50000 rules to make traffic shaping work */ + + $cprules = ""; + + /* captive portal on LAN interface? */ + if ($cpifn == "lan") { + /* add anti-lockout rules */ + $cprules .= <<<EOD +add 500 set 1 pass all from $cpip to any out via $cpif +add 501 set 1 pass all from any to $cpip in via $cpif + +EOD; + } + + $cprules .= <<<EOD +# skip to traffic shaper if not on captive portal interface +add 1000 set 1 skipto 50000 all from any to any not layer2 not via $cpif +# pass all layer2 traffic on other interfaces +add 1001 set 1 pass layer2 not via $cpif + +# layer 2: pass ARP +add 1100 set 1 pass layer2 mac-type arp +# layer 2: block anything else non-IP +add 1101 set 1 deny layer2 not mac-type ip +# layer 2: check if MAC addresses of authenticated clients are correct +add 1102 set 1 skipto 20000 layer2 + +# allow access to our DHCP server (which needs to be able to ping clients as well) +add 1200 set 1 pass udp from any 68 to 255.255.255.255 67 in +add 1201 set 1 pass udp from any 68 to $cpip 67 in +add 1202 set 1 pass udp from $cpip 67 to any 68 out +add 1203 set 1 pass icmp from $cpip to any out icmptype 8 +add 1204 set 1 pass icmp from any to $cpip in icmptype 0 + +# allow access to our DNS forwarder +add 1300 set 1 pass udp from any to $cpip 53 in +add 1301 set 1 pass udp from $cpip 53 to any out + +# allow access to our web server +add 1302 set 1 pass tcp from any to $cpip 8000 in +add 1303 set 1 pass tcp from $cpip 8000 to any out + +EOD; + + if (isset($config['captiveportal']['httpslogin'])) { + $cprules .= <<<EOD +add 1304 set 1 pass tcp from any to $cpip 8001 in +add 1305 set 1 pass tcp from $cpip 8001 to any out + +EOD; + } + + $cprules .= <<<EOD + +# ... 10000-19899: rules per authenticated client go here... + +# redirect non-authenticated clients to captive portal +add 19900 set 1 fwd 127.0.0.1,8000 tcp from any to any 80 in +# let the responses from the captive portal web server back out +add 19901 set 1 pass tcp from any 80 to any out +# block everything else +add 19902 set 1 deny all from any to any + +# ... 20000-29899: layer2 block rules per authenticated client go here... + +# pass everything else on layer2 +add 29900 set 1 pass all from any to any layer2 + +EOD; + + return $cprules; +} + +/* remove clients that have been around for longer than the specified amount of time */ +/* db file structure: timestamp,ipfw_rule_no,clientip,clientmac,username,sessionid */ +function captiveportal_prune_old() { + + global $g, $config; + + /* check for expired entries */ + if ($config['captiveportal']['timeout']) + $timeout = $config['captiveportal']['timeout'] * 60; + else + $timeout = 0; + + if ($config['captiveportal']['idletimeout']) + $idletimeout = $config['captiveportal']['idletimeout'] * 60; + else + $idletimeout = 0; + + if (!$timeout && !$idletimeout) + return; + + captiveportal_lock(); + + /* read database */ + $cpdb = captiveportal_read_db(); + + $radiusservers = captiveportal_get_radius_servers(); + + for ($i = 0; $i < count($cpdb); $i++) { + + $timedout = false; + + /* hard timeout? */ + if ($timeout) { + if ((time() - $cpdb[$i][0]) >= $timeout) + $timedout = true; + } + + /* if an idle timeout is specified, get last activity timestamp from ipfw */ + if (!$timedout && $idletimeout) { + $lastact = captiveportal_get_last_activity($cpdb[$i][1]); + if ($lastact && ((time() - $lastact) >= $idletimeout)) + $timedout = true; + } + + if ($timedout) { + /* this client needs to be deleted - remove ipfw rules */ + if (isset($config['captiveportal']['radacct_enable']) && isset($radiusservers[0])) { + RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno + $cpdb[$i][4], // username + $cpdb[$i][5], // sessionid + $cpdb[$i][0], // start time + $radiusservers[0]['ipaddr'], + $radiusservers[0]['acctport'], + $radiusservers[0]['key']); + } + mwexec("/sbin/ipfw delete " . $cpdb[$i][1] . " " . ($cpdb[$i][1]+10000)); + unset($cpdb[$i]); + } + } + + /* write database */ + captiveportal_write_db($cpdb); + + captiveportal_unlock(); +} + +/* remove a single client by ipfw rule number */ +function captiveportal_disconnect_client($id) { + + global $g, $config; + + captiveportal_lock(); + + /* read database */ + $cpdb = captiveportal_read_db(); + $radiusservers = captiveportal_get_radius_servers(); + + /* find entry */ + for ($i = 0; $i < count($cpdb); $i++) { + if ($cpdb[$i][1] == $id) { + /* this client needs to be deleted - remove ipfw rules */ + if (isset($config['captiveportal']['radacct_enable']) && isset($radiusservers[0])) { + RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno + $cpdb[$i][4], // username + $cpdb[$i][5], // sessionid + $cpdb[$i][0], // start time + $radiusservers[0]['ipaddr'], + $radiusservers[0]['acctport'], + $radiusservers[0]['key']); + } + mwexec("/sbin/ipfw delete " . $cpdb[$i][1] . " " . ($cpdb[$i][1]+10000)); + unset($cpdb[$i]); + break; + } + } + + /* write database */ + captiveportal_write_db($cpdb); + + captiveportal_unlock(); +} + +/* send RADIUS acct stop for all current clients */ +function captiveportal_radius_stop_all() { + global $g, $config; + + captiveportal_lock() ; + $cpdb = captiveportal_read_db() ; + + $radiusservers = captiveportal_get_radius_servers(); + + if (isset($radiusservers[0])) { + for ($i = 0; $i < count($cpdb); $i++) { + RADIUS_ACCOUNTING_STOP($cpdb[$i][1], // ruleno + $cpdb[$i][4], // username + $cpdb[$i][5], // sessionid + $cpdb[$i][0], // start time + $radiusservers[0]['ipaddr'], + $radiusservers[0]['acctport'], + $radiusservers[0]['key']); + } + } + captiveportal_unlock() ; +} + +function captiveportal_passthrumac_configure() { + global $config, $g; + + /* clear out passthru macs, if necessary */ + if (file_exists("{$g['vardb_path']}/captiveportal_mac.db")) { + unlink("{$g['vardb_path']}/captiveportal_mac.db"); + } + + if (is_array($config['captiveportal']['passthrumac'])) { + + $fd = @fopen("{$g['vardb_path']}/captiveportal_mac.db", "w"); + if (!$fd) { + printf("Error: cannot open passthru mac DB file in captiveportal_passthrumac_configure().\n"); + return 1; + } + + foreach ($config['captiveportal']['passthrumac'] as $macent) { + /* record passthru mac so it can be recognized and let thru */ + fwrite($fd, $macent['mac'] . "\n"); + } + + fclose($fd); + } + + return 0; +} + +function captiveportal_allowedip_configure() { + global $config, $g; + + captiveportal_lock() ; + + /* clear out existing allowed ips, if necessary */ + if (file_exists("{$g['vardb_path']}/captiveportal_ip.db")) { + $fd = @fopen("{$g['vardb_path']}/captiveportal_ip.db", "r"); + if ($fd) { + while (!feof($fd)) { + $line = trim(fgets($fd)); + if($line) { + list($ip,$rule) = explode(",",$line); + mwexec("/sbin/ipfw delete $rule") ; + } + } + } + fclose($fd) ; + unlink("{$g['vardb_path']}/captiveportal_ip.db"); + } + + /* get next ipfw rule number */ + if (file_exists("{$g['vardb_path']}/captiveportal.nextrule")) + $ruleno = trim(file_get_contents("{$g['vardb_path']}/captiveportal.nextrule")); + if (!$ruleno) + $ruleno = 10000; /* first rule number */ + + if (is_array($config['captiveportal']['allowedip'])) { + + $fd = @fopen("{$g['vardb_path']}/captiveportal_ip.db", "w"); + if (!$fd) { + printf("Error: cannot open allowed ip DB file in captiveportal_allowedip_configure().\n"); + captiveportal_unlock() ; + return 1; + } + + foreach ($config['captiveportal']['allowedip'] as $ipent) { + /* record allowed ip so it can be recognized and removed later */ + fwrite($fd, $ipent['ip'] . "," . $ruleno ."\n"); + /* insert ipfw rule to allow ip thru */ + if($ipent['dir'] == "from") { + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from ".$ipent['ip']." to any in") ; + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to ".$ipent['ip']." out") ; + } else { + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to ".$ipent['ip']." in") ; + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from ".$ipent['ip']." to any out") ; + } + $ruleno++ ; + if ($ruleno > 19899) + $ruleno = 10000; + } + + fclose($fd); + + /* write next rule number */ + $fd = @fopen("{$g['vardb_path']}/captiveportal.nextrule", "w"); + if ($fd) { + fwrite($fd, $ruleno); + fclose($fd); + } + } + + captiveportal_unlock() ; + return 0; +} + +/* get last activity timestamp given ipfw rule number */ +function captiveportal_get_last_activity($ruleno) { + + exec("/sbin/ipfw -T list {$ruleno} 2>/dev/null", $ipfwoutput); + + /* in */ + if ($ipfwoutput[0]) { + $ri = explode(" ", $ipfwoutput[0]); + if ($ri[1]) + return $ri[1]; + } + + return 0; +} + +/* read captive portal DB into array */ +function captiveportal_read_db() { + + global $g; + + $cpdb = array(); + $fd = @fopen("{$g['vardb_path']}/captiveportal.db", "r"); + if ($fd) { + while (!feof($fd)) { + $line = trim(fgets($fd)); + if ($line) { + $cpdb[] = explode(",", $line); + } + } + fclose($fd); + } + return $cpdb; +} + +/* write captive portal DB */ +function captiveportal_write_db($cpdb) { + + global $g; + + $fd = @fopen("{$g['vardb_path']}/captiveportal.db", "w"); + if ($fd) { + foreach ($cpdb as $cpent) { + fwrite($fd, join(",", $cpent) . "\n"); + } + fclose($fd); + } +} + +/* read RADIUS servers into array */ +function captiveportal_get_radius_servers() { + + global $g; + + if (file_exists("{$g['vardb_path']}/captiveportal_radius.db")) { + $fd = @fopen("{$g['vardb_path']}/captiveportal_radius.db","r"); + if ($fd) { + $radiusservers = array(); + while (!feof($fd)) { + $line = trim(fgets($fd)); + if ($line) { + $radsrv = array(); + list($radsrv['ipaddr'],$radsrv['port'],$radsrv['acctport'],$radsrv['key']) = explode(",",$line); + $radiusservers[] = $radsrv; + } + } + fclose($fd); + + return $radiusservers; + } + } + + return false; +} + +/* lock captive portal information, decide that the lock file is stale after + 10 seconds */ +function captiveportal_lock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/captiveportal.lock"; + + $n = 0; + while ($n < 10) { + /* open the lock file in append mode to avoid race condition */ + if ($fd = @fopen($lockfile, "x")) { + /* succeeded */ + fclose($fd); + return; + } else { + /* file locked, wait and try again */ + sleep(1); + $n++; + } + } +} + +/* unlock configuration file */ +function captiveportal_unlock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/captiveportal.lock"; + + if (file_exists($lockfile)) + unlink($lockfile); +} + +?> diff --git a/etc/inc/config.inc b/etc/inc/config.inc new file mode 100644 index 0000000..58202aa --- /dev/null +++ b/etc/inc/config.inc @@ -0,0 +1,551 @@ +<?php +/* + config.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include globals/utility/XML parser files */ +require_once("globals.inc"); +require_once("util.inc"); +require_once("xmlparse.inc"); + +/* read platform */ +if (file_exists("{$g['etc_path']}/platform")) { + $g['platform'] = chop(file_get_contents("{$g['etc_path']}/platform")); +} else { + $g['platform'] = "unknown"; +} + +if ($g['booting']) { + /* find the device where config.xml resides and write out an fstab */ + unset($cfgdevice); + + /* check if there's already an fstab (NFS booting?) */ + if (!file_exists("{$g['etc_path']}/fstab")) { + + if (strstr($g['platform'], "cdrom")) { + /* config is on floppy disk for CD-ROM version */ + $cfgdevice = $cfgpartition = "fd0"; + $cfgfstype = "msdos"; + } else { + /* probe kernel known disks until we find one with config.xml */ + $disks = explode(" ", trim(preg_replace("/kern.disks: /", "", exec("/sbin/sysctl kern.disks")))); + foreach ($disks as $mountdisk) { + /* skip mfs mounted filesystems */ + if (strstr($mountdisk, "md")) + continue; + if (mwexec("/sbin/mount -r /dev/{$mountdisk}a {$g['cf_path']}") == 0) { + if (file_exists("{$g['cf_conf_path']}/config.xml")) { + /* found it */ + $cfgdevice = $mountdisk; + $cfgpartition = $cfgdevice . "a"; + $cfgfstype = "ufs"; + echo "Found configuration on $cfgdevice.\n"; + } + + mwexec("/sbin/umount -f {$g['cf_path']}"); + + if ($cfgdevice) + break; + } + } + } + + if (!$cfgdevice) { + /* no device found, print an error and die */ + echo <<<EOD + + +******************************************************************************* +* FATAL ERROR * +* The device that contains the configuration file (config.xml) could not be * +* found. m0n0wall cannot continue booting. * +******************************************************************************* + + +EOD; + + mwexec("/sbin/halt"); + exit; + } + + /* write device name to a file for rc.firmware */ + $fd = fopen("{$g['varetc_path']}/cfdevice", "w"); + fwrite($fd, $cfgdevice . "\n"); + fclose($fd); + + /* write out an fstab */ + $fd = fopen("{$g['etc_path']}/fstab", "w"); + + $fstab = "/dev/{$cfgpartition} {$g['cf_path']} {$cfgfstype} ro 1 1\n"; + $fstab .= "proc /proc procfs rw 0 0\n"; + + fwrite($fd, $fstab); + fclose($fd); + } + + /* mount all filesystems */ + mwexec("/sbin/mount -a"); +} + +/* parse configuration */ +if (!$noparseconfig) { + + config_lock(); + + /* see if there's a newer cache file */ + if (file_exists("{$g['tmp_path']}/config.cache") && + (filemtime("{$g['tmp_path']}/config.cache") >= + filemtime("{$g['conf_path']}/config.xml"))) { + + /* read cache */ + $config = unserialize(file_get_contents("{$g['tmp_path']}/config.cache")); + } else { + + if (!file_exists("{$g['conf_path']}/config.xml")) { + if ($g['booting']) { + if (strstr($g['platform'], "cdrom")) { + /* try copying the default config. to the floppy */ + reset_factory_defaults(); + + echo "No XML configuration file found - using factory defaults.\n"; + echo "Make sure that the configuration floppy disk with the conf/config.xml\n"; + echo "file is inserted. If it isn't, your configuration changes will be lost\n"; + echo "on reboot.\n"; + } else { + echo "XML configuration file not found. m0n0wall cannot continue booting.\n"; + mwexec("/sbin/halt"); + exit; + } + } else { + config_unlock(); + exit(0); + } + } + + $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); + + if ((float)$config['version'] > (float)$g['latest_config']) { + if ($g['booting']) { + echo <<<EOD + + +******************************************************************************* +* WARNING! * +* The current configuration has been created with a newer version of m0n0wall * +* than this one! This can lead to serious misbehavior and even security * +* holes! You are urged to either upgrade to a newer version of m0n0wall or * +* revert to the default configuration immediately! * +******************************************************************************* + + +EOD; + } + } + + /* write config cache */ + $fd = @fopen("{$g['tmp_path']}/config.cache", "wb"); + if ($fd) { + fwrite($fd, serialize($config)); + fclose($fd); + } + } + + config_unlock(); + + /* make alias table (for faster lookups) */ + alias_make_table(); +} + +/* mount flash card read/write */ +function conf_mount_rw() { + global $g; + + /* don't use mount -u anymore + (doesn't sync the files properly and /bin/sync won't help either) */ + mwexec("/sbin/umount -f {$g['cf_path']}"); + mwexec("/sbin/mount -w -o noatime {$g['cf_path']}"); +} + +/* mount flash card read only */ +function conf_mount_ro() { + global $g; + + mwexec("/sbin/umount -f {$g['cf_path']}"); + mwexec("/sbin/mount -r {$g['cf_path']}"); +} + +/* convert configuration, if necessary */ +function convert_config() { + global $config, $g; + + if ($config['version'] == $g['latest_config']) + return; /* already at latest version */ + + if ($g['booting']) + echo "Converting configuration... "; + + /* convert 1.0 -> 1.1 */ + if ($config['version'] == "1.0") { + $opti = 1; + $ifmap = array('lan' => 'lan', 'wan' => 'wan', 'pptp' => 'pptp'); + + /* convert DMZ to optional, if necessary */ + if (isset($config['interfaces']['dmz'])) { + + $dmzcfg = &$config['interfaces']['dmz']; + + if ($dmzcfg['if']) { + $config['interfaces']['opt' . $opti] = array(); + $optcfg = &$config['interfaces']['opt' . $opti]; + + $optcfg['enable'] = $dmzcfg['enable']; + $optcfg['descr'] = "DMZ"; + $optcfg['if'] = $dmzcfg['if']; + $optcfg['ipaddr'] = $dmzcfg['ipaddr']; + $optcfg['subnet'] = $dmzcfg['subnet']; + + $ifmap['dmz'] = "opt" . $opti; + $opti++; + } + + unset($config['interfaces']['dmz']); + } + + /* convert WLAN1/2 to optional, if necessary */ + for ($i = 1; isset($config['interfaces']['wlan' . $i]); $i++) { + + if (!$config['interfaces']['wlan' . $i]['if']) { + unset($config['interfaces']['wlan' . $i]); + continue; + } + + $wlancfg = &$config['interfaces']['wlan' . $i]; + $config['interfaces']['opt' . $opti] = array(); + $optcfg = &$config['interfaces']['opt' . $opti]; + + $optcfg['enable'] = $wlancfg['enable']; + $optcfg['descr'] = "WLAN" . $i; + $optcfg['if'] = $wlancfg['if']; + $optcfg['ipaddr'] = $wlancfg['ipaddr']; + $optcfg['subnet'] = $wlancfg['subnet']; + $optcfg['bridge'] = $wlancfg['bridge']; + + $optcfg['wireless'] = array(); + $optcfg['wireless']['mode'] = $wlancfg['mode']; + $optcfg['wireless']['ssid'] = $wlancfg['ssid']; + $optcfg['wireless']['channel'] = $wlancfg['channel']; + $optcfg['wireless']['wep'] = $wlancfg['wep']; + + $ifmap['wlan' . $i] = "opt" . $opti; + + unset($config['interfaces']['wlan' . $i]); + $opti++; + } + + /* convert filter rules */ + $n = count($config['filter']['rule']); + for ($i = 0; $i < $n; $i++) { + + $fr = &$config['filter']['rule'][$i]; + + /* remap interface */ + if (array_key_exists($fr['interface'], $ifmap)) + $fr['interface'] = $ifmap[$fr['interface']]; + else { + /* remove the rule */ + echo "\nWarning: filter rule removed " . + "(interface '{$fr['interface']}' does not exist anymore)."; + unset($config['filter']['rule'][$i]); + continue; + } + + /* remap source network */ + if (isset($fr['source']['network'])) { + if (array_key_exists($fr['source']['network'], $ifmap)) + $fr['source']['network'] = $ifmap[$fr['source']['network']]; + else { + /* remove the rule */ + echo "\nWarning: filter rule removed " . + "(source network '{$fr['source']['network']}' does not exist anymore)."; + unset($config['filter']['rule'][$i]); + continue; + } + } + + /* remap destination network */ + if (isset($fr['destination']['network'])) { + if (array_key_exists($fr['destination']['network'], $ifmap)) + $fr['destination']['network'] = $ifmap[$fr['destination']['network']]; + else { + /* remove the rule */ + echo "\nWarning: filter rule removed " . + "(destination network '{$fr['destination']['network']}' does not exist anymore)."; + unset($config['filter']['rule'][$i]); + continue; + } + } + } + + /* convert shaper rules */ + $n = count($config['pfqueueing']['rule']); + if (is_array($config['pfqueueing']['rule'])) + for ($i = 0; $i < $n; $i++) { + + $fr = &$config['pfqueueing']['rule'][$i]; + + /* remap interface */ + if (array_key_exists($fr['interface'], $ifmap)) + $fr['interface'] = $ifmap[$fr['interface']]; + else { + /* remove the rule */ + echo "\nWarning: traffic shaper rule removed " . + "(interface '{$fr['interface']}' does not exist anymore)."; + unset($config['pfqueueing']['rule'][$i]); + continue; + } + + /* remap source network */ + if (isset($fr['source']['network'])) { + if (array_key_exists($fr['source']['network'], $ifmap)) + $fr['source']['network'] = $ifmap[$fr['source']['network']]; + else { + /* remove the rule */ + echo "\nWarning: traffic shaper rule removed " . + "(source network '{$fr['source']['network']}' does not exist anymore)."; + unset($config['pfqueueing']['rule'][$i]); + continue; + } + } + + /* remap destination network */ + if (isset($fr['destination']['network'])) { + if (array_key_exists($fr['destination']['network'], $ifmap)) + $fr['destination']['network'] = $ifmap[$fr['destination']['network']]; + else { + /* remove the rule */ + echo "\nWarning: traffic shaper rule removed " . + "(destination network '{$fr['destination']['network']}' does not exist anymore)."; + unset($config['pfqueueing']['rule'][$i]); + continue; + } + } + } + + $config['version'] = "1.1"; + } + + /* convert 1.1 -> 1.2 */ + if ($config['version'] == "1.1") { + /* move LAN DHCP server config */ + $tmp = $config['dhcpd']; + $config['dhcpd'] = array(); + $config['dhcpd']['lan'] = $tmp; + + /* encrypt password */ + $config['system']['password'] = crypt($config['system']['password']); + + $config['version'] = "1.2"; + } + + /* convert 1.2 -> 1.3 */ + if ($config['version'] == "1.2") { + /* convert advanced outbound NAT config */ + for ($i = 0; isset($config['nat']['advancedoutbound']['rule'][$i]); $i++) { + $curent = &$config['nat']['advancedoutbound']['rule'][$i]; + $src = $curent['source']; + $curent['source'] = array(); + $curent['source']['network'] = $src; + $curent['destination'] = array(); + $curent['destination']['any'] = true; + } + + /* add an explicit type="pass" to all filter rules to make things consistent */ + for ($i = 0; isset($config['filter']['rule'][$i]); $i++) { + $config['filter']['rule'][$i]['type'] = "pass"; + } + + $config['version'] = "1.3"; + } + + /* convert 1.3 -> 1.4 */ + if ($config['version'] == "1.3") { + /* convert shaper rules (make pipes) */ + if (is_array($config['pfqueueing']['rule'])) { + $config['pfqueueing']['pipe'] = array(); + + for ($i = 0; isset($config['pfqueueing']['rule'][$i]); $i++) { + $curent = &$config['pfqueueing']['rule'][$i]; + + /* make new pipe and associate with this rule */ + $newpipe = array(); + $newpipe['descr'] = $curent['descr']; + $newpipe['bandwidth'] = $curent['bandwidth']; + $newpipe['delay'] = $curent['delay']; + $newpipe['mask'] = $curent['mask']; + $config['pfqueueing']['pipe'][$i] = $newpipe; + + $curent['targetpipe'] = $i; + + unset($curent['bandwidth']); + unset($curent['delay']); + unset($curent['mask']); + } + } + + $config['version'] = "1.4"; + } + + write_config(); + + if ($g['booting']) + echo "done\n"; +} + +/* save the system configuration */ +function write_config() { + + global $config, $g; + + config_lock(); + + conf_mount_rw(); + + if (time() > mktime(0, 0, 0, 9, 1, 2004)) /* make sure the clock settings is plausible */ + $config['lastchange'] = time(); + + /* generate configuration XML */ + $xmlconfig = dump_xml_config($config, $g['xml_rootobj']); + + /* write configuration */ + $fd = fopen("{$g['cf_conf_path']}/config.xml", "w"); + + if (!$fd) + die("Unable to open config.xml for writing in write_config()\n"); + + fwrite($fd, $xmlconfig); + fclose($fd); + + conf_mount_ro(); + + /* re-read configuration */ + $config = parse_xml_config("{$g['conf_path']}/config.xml", $g['xml_rootobj']); + + /* write config cache */ + $fd = @fopen("{$g['tmp_path']}/config.cache", "wb"); + if ($fd) { + fwrite($fd, serialize($config)); + fclose($fd); + } + + config_unlock(); +} + +function reset_factory_defaults() { + + global $g; + + config_lock(); + + conf_mount_rw(); + + /* create conf directory, if necessary */ + if (!file_exists("{$g['cf_conf_path']}")) + @mkdir("{$g['cf_conf_path']}"); + + /* clear out /conf */ + $dh = opendir($g['conf_path']); + while ($filename = readdir($dh)) { + if (($filename != ".") && ($filename != "..")) { + unlink($g['conf_path'] . "/" . $filename); + } + } + closedir($dh); + + /* copy default configuration */ + @copy("{$g['conf_default_path']}/config.xml", "{$g['conf_path']}/config.xml"); + + conf_mount_ro(); + + config_unlock(); + + return 0; +} + +function config_install($conffile) { + + global $config, $g; + + if (!file_exists($conffile)) + return 1; + + config_lock(); + conf_mount_rw(); + + copy($conffile, "{$g['conf_path']}/config.xml"); + + conf_mount_ro(); + config_unlock(); + + return 0; +} + +/* lock configuration file, decide that the lock file is stale after + 10 seconds */ +function config_lock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/config.lock"; + + $n = 0; + while ($n < 10) { + /* open the lock file in append mode to avoid race condition */ + if ($fd = @fopen($lockfile, "x")) { + /* succeeded */ + fclose($fd); + return; + } else { + /* file locked, wait and try again */ + sleep(1); + $n++; + } + } +} + +/* unlock configuration file */ +function config_unlock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/config.lock"; + + if (file_exists($lockfile)) + unlink($lockfile); +} + +?> diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc new file mode 100644 index 0000000..1b409f8 --- /dev/null +++ b/etc/inc/filter.inc @@ -0,0 +1,946 @@ +<?php +/* + filter.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function filter_resync() { + global $config, $g; + + mwexec("/sbin/pfctl -y"); /* XXX */ +} + +function filter_ipmon_start() { + global $config, $g; + + mwexec("/pflogd -sD"); +} + +function filter_configure() { + global $config, $g; + + if ($g['booting']) + echo "Configuring firewall... "; + + /* set TCP timeouts */ + $tcpidletimeout = 9000; + if ($config['filter']['tcpidletimeout']) + $tcpidletimeout = $config['filter']['tcpidletimeout']; + mwexec("/sbin/sysctl net.inet.ipf.fr_tcpidletimeout={$tcpidletimeout}"); + mwexec("/sbin/sysctl net.inet.ipf.fr_tcphalfclosed=480"); + + /* generate pfctl rules */ + $natrules = filter_nat_rules_generate(); + /* generate pfctl rules */ + $pfrules = filter_rules_generate(); + /* generate altq interface setup parms */ + $altq_ints = filter_setup_altq_interfaces(); + /* generate altq queues */ + $altq_queues = filter_generate_altq_queues(); + + mwexec("/sbin/pfctl -e"); + mwexec("/sbin/pfctl -F nat"); + mwexec("/sbin/pfctl -F rules"); + + /* get our wan interface? */ + $wanif = get_real_wan_interface(); + + $fd = fopen("/tmp/rules.debug", "w"); + fwrite($fd, "set loginterface $wanif \n"); + fwrite($fd, "set optimization aggressive\n"); + fwrite($fd, $altq_ints); + fwrite($fd, $altq_queues); + fwrite($fd, $natrules); + fwrite($fd, $pfrules); + fclose($fd); + + mwexec("chmod a+x /tmp/rules.debug"); + mwexec("/sbin/pfctl -f /tmp/rules.debug"); + + /* set up MSS clamping */ + if ($config['interfaces']['wan']['mtu']) + $mssclamp = $config['interfaces']['wan']['mtu'] - 40; + else if ($config['interfaces']['wan']['ipaddr'] == "pppoe") + $mssclamp = 1452; + else + $mssclamp = 0; + + mwexec("/sbin/sysctl net.inet.ipf.fr_mssif={$wanif}"); + mwexec("/sbin/sysctl net.inet.ipf.fr_mssclamp={$mssclamp}"); + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function filter_generate_altq_queues() { + global $config; + $altq_rules = ""; + if (is_array($config['pfqueueing']['queue'])) { + foreach ($config['pfqueueing']['queue'] as $rule) { + $altq_rules .= "queue " . $rule['name'] . " "; + if (isset($rule['bandwidth'])) + $altq_rules .= "bandwidth " . $rule['bandwidth'] . " "; + if (isset($rule['priority'])) + $altq_rules .= "priority " . $rule['priority'] . " "; + if (isset($rule['options'])) /* XXX turn options into an xml array */ + $altq_rules .= $rule['schedulertype'] . "(". $rule['options'] . ")"; + if (isset($rule['subqueue'])) { + $altq_rules .= "{ "; + $fsq = ""; + foreach ($rule['subqueue'] as $sq) { + if($fsq) $altq_rules .= ","; + $altq_rules .= $sq['name']; + $fsq = "1"; + } + $altq_rules .= " }"; + } + $altq_rules .= "\n"; + } + } + return $altq_rules; +} + +function filter_setup_altq_interfaces() { + global $config; + $altq_rules = ""; + $queue_names = ""; + $is_first = ""; + if (is_array($config['pfqueueing']['queue'])) { + foreach ($config['pfqueueing']['queue'] as $queue) { + if(is_subqueue($queue['name']) == 0) { + if($is_first) $queue_names .= ", "; + $queue_names .= $queue['name']; + $is_first = "1"; + } + } + } + if (is_array($config['interfaces'])) { + foreach ($config['interfaces'] as $ifname) { + if(isset($ifname['bandwidth'])) { + $subnet = $ifname['ipaddr'] . "/" . $ifname['subnet']; + $altq_rules .= "altq on " . $ifname['if'] . " "; + $altq_rules .= $ifname['schedulertype'] . " bandwidth " . $ifname['bandwidth'] . " "; + if($queue_names <> "") + $altq_rules .= "queue { " . $queue_names . " }"; + $altq_rules .= "\n"; + } + } + } + return $altq_rules; +} + +function is_subqueue($name) { + global $config; + $status = ""; + if (is_array($config['pfqueueing']['queue'])) { + foreach ($config['pfqueueing']['queue'] as $queue) { + if(is_array($queue['subqueue'])) { + foreach ($queue['subqueue'] as $sq) { + if($sq['name'] == $name) return 1; + } + } + } + } + return 0; +} + +function filter_flush_nat_table() { + global $config, $g; + + return mwexec("/sbin/pfctl -F nat"); +} + +function filter_flush_state_table() { + global $config, $g; + + return mwexec("/sbin/pfctl -F state"); +} + +function filter_nat_rules_generate_if($if, $src, $dst, $target) { + + if ($target) + $tgt = $target . "/32"; + else + $tgt = "0/32"; + + $natrule = <<<EOD +nat on $if from $src to any -> $if + +EOD; + + return $natrule; +} + +function filter_nat_rules_generate() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + $lancfg = $config['interfaces']['lan']; + + $pptpdcfg = $config['pptpd']; + $wanif = get_real_wan_interface(); + + $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); + + $natrules = ""; + + /* any 1:1 mappings? */ + if (is_array($config['nat']['onetoone'])) { + foreach ($config['nat']['onetoone'] as $natent) { + if (!is_numeric($natent['subnet'])) + $sn = 32; + else + $sn = $natent['subnet']; + + if (!$natent['interface'] || ($natent['interface'] == "wan")) + $natif = $wanif; + else + $natif = $config['interfaces'][$natent['interface']]['if']; + + $natrules .= "binat on {$natif} from {$natent['internal']}/{$sn} to any -> {$natent['external']}\n"; + } + } + + /* outbound rules - advanced or standard */ + if (isset($config['nat']['advancedoutbound']['enable'])) { + /* advanced outbound rules */ + if (is_array($config['nat']['advancedoutbound']['rule'])) { + foreach ($config['nat']['advancedoutbound']['rule'] as $obent) { + $dst = ""; + $src = ""; + if (!isset($obent['destination']['any'])) { + $src = "from "; + if (isset($obent['destination']['not'])) + $dst = "! to "; + else + $dst = "to "; + $dst .= $obent['destination']['network']; + } + $src .= $obent['source']['network']; + + if (!$obent['interface'] || ($obent['interface'] == "wan")) + $natif = $wanif; + else + $natif = $config['interfaces'][$obent['interface']]['if']; + + $natrules .= filter_nat_rules_generate_if($natif, $src, $dst, + $obent['target']); + } + } + } else { + /* standard outbound rules (one for each interface) */ + $natrules .= filter_nat_rules_generate_if($wanif, + $lansa . "/" . $lancfg['subnet'], "", null); + + /* optional interfaces */ + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { + $optcfg = $config['interfaces']['opt' . $i]; + + if (isset($optcfg['enable']) && !$optcfg['bridge']) { + $optsa = gen_subnet($optcfg['ipaddr'], $optcfg['subnet']); + $natrules .= filter_nat_rules_generate_if($wanif, + $optsa . "/" . $optcfg['subnet'], "", null); + } + } + + /* PPTP subnet */ + if ($pptpdcfg['mode'] == "server") { + $natrules .= filter_nat_rules_generate_if($wanif, + $pptpdcfg['remoteip'] . "/" . $g['pptp_subnet'], "", null); + } + + /* static routes */ + if (is_array($config['staticroutes']['route'])) { + foreach ($config['staticroutes']['route'] as $route) { + if ($route['interface'] != "wan") + $natrules .= filter_nat_rules_generate_if($wanif, + $route['network'], "", null); + } + } + } + + /* DIAG: add ipv6 NAT, if requested */ + if (isset($config['diag']['ipv6nat']['enable'])) { + $natrules .= "rdr on $wanif proto ipv6 from any to any port 0 -> " . + "{$config['diag']['ipv6nat']['ipaddr']}\n"; + } + + if (isset($config['nat']['rule'])) { + foreach ($config['nat']['rule'] as $rule) { + + $extport = explode("-", $rule['external-port']); + $target = alias_expand_host($rule['target']); + + if (!$target) + continue; /* unresolvable alias */ + + if ($rule['external-address']) + $extaddr = $rule['external-address'] . "/32"; + else + $extaddr = "0/0"; + + if (!$rule['interface'] || ($rule['interface'] == "wan")) + $natif = $wanif; + else + $natif = $config['interfaces'][$rule['interface']]['if']; + + $lanif = $lancfg['if']; + + if ((!$extport[1]) || ($extport[0] == $extport[1])) { + $natrules .= + "rdr on $natif proto " . $rule['protocol'] . " from any to any port {$extport[0]} -> {$target} \n"; + } else { + $natrules .= + "rdr on $natif proto " . $rule['protocol']. " from any to any port {$extport[0]}:{$extport[1]} " . + "-> {$target} \n"; + } + + $natrules .= "\n"; + } + } + + if ($pptpdcfg['mode'] && $pptpdcfg['mode'] != "off") { + + if ($pptpdcfg['mode'] == "server") + $pptpdtarget = "127.0.0.1"; + else if ($pptpdcfg['mode'] == "redir") + $pptpdtarget = $pptpdcfg['redir']; + + if ($pptpdtarget) { + + $natrules .= <<<EOD + +# PPTP +rdr on $wanif proto gre from any to any port 0 -> $pptpdtarget +rdr on $wanif proto tcp from any to any port 1723 -> $pptpdtarget + +EOD; + } + } + + return $natrules; +} + +function filter_rules_generate() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + $lancfg = $config['interfaces']['lan']; + $pptpdcfg = $config['pptpd']; + + $lanif = $lancfg['if']; + $wanif = get_real_wan_interface(); + + /* rule groups (optional interfaces: see below) */ + $ifgroups = array("lan" => 100, "wan" => 200); + + $lanip = $lancfg['ipaddr']; + $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); + $lansn = $lancfg['subnet']; + + /* optional interfaces */ + $optcfg = array(); + + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { + $oc = $config['interfaces']['opt' . $i]; + + if (isset($oc['enable']) && $oc['if']) { + $oic = array(); + $oic['if'] = $oc['if']; + + if ($oc['bridge']) { + if (!strstr($oc['bridge'], "opt") || + isset($config['interfaces'][$oc['bridge']]['enable'])) { + if (is_ipaddr($config['interfaces'][$oc['bridge']]['ipaddr'])) { + $oic['ip'] = $config['interfaces'][$oc['bridge']]['ipaddr']; + $oic['sn'] = $config['interfaces'][$oc['bridge']]['subnet']; + $oic['sa'] = gen_subnet($oic['ip'], $oic['sn']); + } + } + $oic['bridge'] = 1; + } else { + $oic['ip'] = $oc['ipaddr']; + $oic['sn'] = $oc['subnet']; + $oic['sa'] = gen_subnet($oic['ip'], $oic['sn']); + } + + $optcfg['opt' . $i] = $oic; + $ifgroups['opt' . $i] = ($i * 100) + 200; + } + } + + if ($pptpdcfg['mode'] == "server") { + $pptpip = $pptpdcfg['localip']; + $pptpsa = $pptpdcfg['remoteip']; + $pptpsn = $g['pptp_subnet']; + } + + /* default block logging? */ + if (!isset($config['syslog']['nologdefaultblock'])) + $log = "log"; + else + $log = ""; + + $ipfrules = <<<EOD + +# loopback +pass in quick on lo0 all +pass out quick on lo0 all + +# allow access to DHCP server on LAN +pass in quick on $lanif proto udp from any port = 68 to 255.255.255.255 port = 67 +pass in quick on $lanif proto udp from any port = 68 to $lanip port = 67 +pass out quick on $lanif proto udp from $lanip port = 67 to any port = 68 + +EOD; + + /* allow access to DHCP server on optional interfaces */ + foreach ($optcfg as $on => $oc) { + if (isset($config['dhcpd'][$on]['enable']) && (!$oc['bridge'])) { + $ipfrules .= <<<EOD + +# allow access to DHCP server on {$on} +pass in quick on {$oc['if']} proto udp from any port = 68 to 255.255.255.255 port = 67 +pass in quick on {$oc['if']} proto udp from any port = 68 to {$oc['ip']} port = 67 +pass out quick on {$oc['if']} proto udp from {$oc['ip']} port = 67 to any port = 68 + +EOD; + } + } + + /* pass traffic between statically routed subnets and the subnet on the + interface in question to avoid problems with complicated routing + topologies */ + if (is_array($config['staticroutes']['route']) && count($config['staticroutes']['route'])) { + foreach ($config['staticroutes']['route'] as $route) { + unset($sa); + + if ($route['interface'] == "lan") { + $sa = $lansa; + $sn = $lansn; + $if = $lanif; + } else if (strstr($route['interface'], "opt")) { + $oc = $optcfg[$route['interface']]; + if ($oc['ip']) { + $sa = $oc['sa']; + $sn = $oc['sn']; + $if = $oc['if']; + } + } + + if ($sa) { + $ipfrules .= <<<EOD +pass in quick on {$if} from {$sa}/{$sn} to {$route['network']} +pass in quick on {$if} from {$route['network']} to {$sa}/{$sn} +pass out quick on {$if} from {$sa}/{$sn} to {$route['network']} +pass out quick on {$if} from {$route['network']} to {$sa}/{$sn} + +EOD; + } + } + } + + $ipfrules .= <<<EOD + +# WAN spoof check +block in $log quick on $wanif from $lansa/$lansn to any + +EOD; + + foreach ($optcfg as $oc) { + if (!$oc['bridge']) + $ipfrules .= "block in $log quick on $wanif from {$oc['sa']}/{$oc['sn']} to any\n"; + } + + /* allow PPTP traffic if PPTP client is enabled on WAN */ + if ($wancfg['ipaddr'] == "pptp") { + $ipfrules .= <<<EOD + +# allow PPTP client +pass in quick on {$wancfg['if']} proto gre from any to any +pass out quick on {$wancfg['if']} proto gre from any to any +pass in quick on {$wancfg['if']} proto tcp from any port = 1723 to any +pass out quick on {$wancfg['if']} proto tcp from any to any port = 1723 + +EOD; + } + + $ipfrules .= <<<EOD + +# allow our DHCP client out to the WAN +# XXX - should be more restrictive +# (not possible at the moment - need 'me' like in ipfw) +pass out quick on $wanif proto udp from any port = 68 to any port = 67 +block in $log quick on $wanif proto udp from any port = 67 to $lansa/$lansn port = 68 +pass in quick on $wanif proto udp from any port = 67 to any port = 68 + +# LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses) + +EOD; + + /* LAN spoof check */ + $ipfrules .= filter_rules_spoofcheck_generate('lan', $lanif, $lansa, $lansn, $log); + + /* OPT spoof check */ + foreach ($optcfg as $on => $oc) { + if ($oc['ip']) + $ipfrules .= filter_rules_spoofcheck_generate($on, $oc['if'], $oc['sa'], $oc['sn'], $log); + } + + /* block private networks on WAN? */ + if (isset($config['interfaces']['wan']['blockpriv'])) { + $ipfrules .= <<<EOD + +# block anything from private networks on WAN interface +block in $log quick on $wanif from 10.0.0.0/8 to any +block in $log quick on $wanif from 127.0.0.0/8 to any +block in $log quick on $wanif from 172.16.0.0/12 to any +block in $log quick on $wanif from 192.168.0.0/16 to any + +EOD; + } + + /* IPsec enabled? */ + if (isset($config['ipsec']['enable']) && + ((is_array($config['ipsec']['tunnel']) && + count($config['ipsec']['tunnel'])) || + isset($config['ipsec']['mobileclients']['enable']))) { + + $curwanip = get_current_wan_address(); + + if ($curwanip) + $ipfrules .= filter_rules_ipsec_generate($wanif, $curwanip); + + $ipfrules .= filter_rules_ipsec_generate($lanif, $lanip); + + foreach ($optcfg as $on => $oc) { + if ($oc['ip']) + $ipfrules .= filter_rules_ipsec_generate($oc['if'], $oc['ip']); + } + } + + /* XXX - the first section is only needed because pfctl refuses to + parse rules that have "flags S/SAFR" and proto "tcp/udp" set because + UDP does not have flags, but we still want to offer the TCP/UDP protocol + option to the user */ + + $ipfrules .= <<<EOD + + +# let out anything from the firewall host itself and decrypted IPsec traffic +pass out quick on $wanif all keep state + +EOD; + + /* group heads for optional interfaces */ + foreach ($optcfg as $on => $oc) { + + $ingroup = $ifgroups[$on]; + + $ipfrules .= <<<EOD + + +# let out anything from the firewall host itself and decrypted IPsec traffic +pass out quick on {$oc['if']} all keep state + +EOD; + + } + + if (!isset($config['system']['webgui']['noantilockout'])) { + + $ipfrules .= <<<EOD + +# make sure the user cannot lock himself out of the webGUI +pass in quick from $lansa/$lansn to $lanip keep state +# group 100 + +EOD; + } + + /* PPTPd enabled? */ + if ($pptpdcfg['mode'] && ($pptpdcfg['mode'] != "off")) { + + if ($pptpdcfg['mode'] == "server") + $pptpdtarget = "127.0.0.1"; + else + $pptpdtarget = $pptpdcfg['redir']; + + $ipfrules .= <<<EOD + +# PPTP rules +pass in quick proto gre from any to $pptpdtarget keep state +# group 200 +pass in quick proto tcp from any to $pptpdtarget port = 1723 keep state +# group 200 + +EOD; + } + + /* BigPond client enabled? */ + if ($wancfg['ipaddr'] == "bigpond") { + + $ipfrules .= <<<EOD + +# BigPond heartbeat rules +pass in quick proto udp from any to any port = 5050 keep state +# group 200 + +EOD; + } + + $i = 0; + + $ipfrules .= "\n# User-defined rules follow\n"; + + if (isset($config['filter']['rule'])) + foreach ($config['filter']['rule'] as $rule) { + + /* don't include disabled rules */ + if (isset($rule['disabled'])) { + $i++; + continue; + } + + /* does the rule deal with a PPTP interface? */ + if ($rule['interface'] == "pptp") { + + if ($pptpdcfg['mode'] != "server") { + $i++; + continue; + } + + $nif = $g['n_pptp_units']; + $ispptp = true; + } else { + + if (strstr($rule['interface'], "opt")) { + if (!array_key_exists($rule['interface'], $optcfg)) { + $i++; + continue; + } + } + + $nif = 1; + $ispptp = false; + } + + if ($pptpdcfg['mode'] != "server") { + if (($rule['source']['network'] == "pptp") || + ($rule['destination']['network'] == "pptp")) { + $i++; + continue; + } + } + + if ($rule['source']['network'] && strstr($rule['source']['network'], "opt")) { + if (!array_key_exists($rule['source']['network'], $optcfg)) { + $i++; + continue; + } + } + if ($rule['destination']['network'] && strstr($rule['destination']['network'], "opt")) { + if (!array_key_exists($rule['destination']['network'], $optcfg)) { + $i++; + continue; + } + } + + /* check for unresolvable aliases */ + if ($rule['source']['address'] && !alias_expand($rule['source']['address'])) { + $i++; + continue; + } + if ($rule['destination']['address'] && !alias_expand($rule['destination']['address'])) { + $i++; + continue; + } + + for ($iif = 0; $iif < $nif; $iif++) { + + if (!$ispptp) { + + $groupnum = $ifgroups[$rule['interface']]; + + if (!$groupnum) { + printf("Invalid interface name in rule $i\n"); + break; + } + } + + $type = $rule['type']; + if ($type != "pass" && $type != "block" && $type != "reject") { + /* default (for older rules) is pass */ + $type = "pass"; + } + + if ($type == "reject") { + /* special reject packet */ + if ($rule['protocol'] == "tcp") { + $line = "block return-rst"; + } else if ($rule['protocol'] == "udp") { + $line = "block return-icmp"; + } else { + $line = "block"; + } + } else { + $line = $type; + } + + if(!isset($rule['direction'])) { + $line .= " in "; + } else { + $line .= " " . $rule['direction'] . " "; + } + + if (isset($rule['log'])) + $line .= "log "; + + $line .= "quick "; + + if ($ispptp) { + $line .= "on ng" . ($iif+1) . " "; + } + + if (isset($rule['protocol'])) { + $line .= "proto {$rule['protocol']} "; + } + + /* source address */ + if (isset($rule['source']['any'])) { + $src = "any"; + } else if ($rule['source']['network']) { + + if (strstr($rule['source']['network'], "opt")) { + $src = $optcfg[$rule['source']['network']]['sa'] . "/" . + $optcfg[$rule['source']['network']]['sn']; + } else { + switch ($rule['source']['network']) { + case 'lan': + $src = "$lansa/$lansn"; + break; + case 'pptp': + $src = "$pptpsa/$pptpsn"; + break; + } + } + } else if ($rule['source']['address']) { + $src = alias_expand($rule['source']['address']); + } + + if (!$src || ($src == "/")) { + //printf("No source address found in rule $i\n"); + break; + } + + if (isset($rule['source']['not'])) { + $line .= "from !$src "; + } else { + $line .= "from $src "; + } + + if (in_array($rule['protocol'], array("tcp","udp","tcp/udp"))) { + + if ($rule['source']['port']) { + $srcport = explode("-", $rule['source']['port']); + + if ((!$srcport[1]) || ($srcport[0] == $srcport[1])) { + $line .= "port = {$srcport[0]} "; + } else if (($srcport[0] == 1) && ($srcport[1] == 65535)) { + /* no need for a port statement here */ + } else if ($srcport[1] == 65535) { + $line .= "port >= {$srcport[0]} "; + } else if ($srcport[0] == 1) { + $line .= "port <= {$srcport[1]} "; + } else { + $srcport[0]--; + $srcport[1]++; + $line .= "port {$srcport[0]} >< {$srcport[1]} "; + } + } + } + + /* destination address */ + if (isset($rule['destination']['any'])) { + $dst = "any"; + } else if ($rule['destination']['network']) { + + if (strstr($rule['destination']['network'], "opt")) { + $dst = $optcfg[$rule['destination']['network']]['sa'] . "/" . + $optcfg[$rule['destination']['network']]['sn']; + } else { + switch ($rule['destination']['network']) { + case 'lan': + $dst = "$lansa/$lansn"; + break; + case 'pptp': + $dst = "$pptpsa/$pptpsn"; + break; + } + } + } else if ($rule['destination']['address']) { + $dst = alias_expand($rule['destination']['address']); + } + + if (!$dst || ($dst == "/")) { + //printf("No destination address found in rule $i\n"); + break; + } + + if (isset($rule['destination']['not'])) { + $line .= "to !$dst "; + } else { + $line .= "to $dst "; + } + + if (in_array($rule['protocol'], array("tcp","udp","tcp/udp"))) { + + if ($rule['destination']['port']) { + $dstport = explode("-", $rule['destination']['port']); + + if ((!$dstport[1]) || ($dstport[0] == $dstport[1])) { + $line .= "port = {$dstport[0]} "; + } else if (($dstport[0] == 1) && ($dstport[1] == 65535)) { + /* no need for a port statement here */ + } else if ($dstport[1] == 65535) { + $line .= "port >= {$dstport[0]} "; + } else if ($dstport[0] == 1) { + $line .= "port <= {$dstport[1]} "; + } else { + $dstport[0]--; + $dstport[1]++; + $line .= "port {$dstport[0]} >< {$dstport[1]} "; + } + } + } + + if (($rule['protocol'] == "icmp") && $rule['icmptype']) { + $line .= "icmp-type {$rule['icmptype']} "; + } + + if ($type == "pass") { + $line .= "keep state "; + + if (isset($rule['frags'])) + $line .= "keep frags "; + } + + if ($type == "reject" && $rule['protocol'] == "tcp") { + /* special reject packet */ + $line .= "flags S/SA "; + } + + if (isset($rule['flags'])) { + $line .= "flags " . $rule['flags'] . " "; + } + + if (!$ispptp) { + #$line .= "group $groupnum "; + } + + if (isset($rule['queuename'])) { + $line .= "queue " . $rule['queuename']; + } + + $line .= "\n"; + + $ipfrules .= $line; + } + + $i++; + } + + $ipfrules .= <<<EOD + +#--------------------------------------------------------------------------- +# default rules (just to be sure) +#--------------------------------------------------------------------------- +block in $log quick all +block out $log quick all + +EOD; + + return $ipfrules; +} + +function filter_rules_spoofcheck_generate($ifname, $if, $sa, $sn, $log) { + + global $g, $config; + + $ipfrules = ""; + + if (is_array($config['staticroutes']['route']) && count($config['staticroutes']['route'])) { + /* count rules */ + $n = 1; + foreach ($config['staticroutes']['route'] as $route) { + if ($route['interface'] == $ifname) + $n++; + } + + /* output skip rules */ + foreach ($config['staticroutes']['route'] as $route) { + if ($route['interface'] == $ifname) { + $ipfrules .= "skip $n in on $if from {$route['network']} to any\n"; + $n--; + } + } + $ipfrules .= "skip 1 in on $if from $sa/$sn to any\n"; + $ipfrules .= "#block in $log quick on $if all\n"; + } else { + $ipfrules .= "#block in $log quick on $if from ! $sa/$sn to any\n"; + } + + return $ipfrules; +} + +function filter_rules_ipsec_generate($ifname, $ip) { + + $ipfrules = <<<EOD + +# Pass IKE packets +pass in quick on {$ifname} proto udp from any to {$ip} port = 500 +pass out quick on {$ifname} proto udp from {$ip} port = 500 to any + +# Pass ESP packets +pass in quick on {$ifname} proto esp from any to {$ip} +pass out quick on {$ifname} proto esp from {$ip} to any + +# Pass AH packets +pass in quick on {$ifname} proto ah from any to {$ip} +pass out quick on {$ifname} proto ah from {$ip} to any + +EOD; + + return $ipfrules; +} + +?> diff --git a/etc/inc/functions.inc b/etc/inc/functions.inc new file mode 100644 index 0000000..eab4b82 --- /dev/null +++ b/etc/inc/functions.inc @@ -0,0 +1,41 @@ +<?php +/* + functions.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("system.inc"); +require_once("interfaces.inc"); +require_once("services.inc"); +require_once("filter.inc"); +require_once("shaper.inc"); +require_once("vpn.inc"); +require_once("captiveportal.inc"); +require_once("openvpn.inc"); + +?> diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc new file mode 100644 index 0000000..eef6cff --- /dev/null +++ b/etc/inc/globals.inc @@ -0,0 +1,54 @@ +<?php +/* + globals.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +$g = array( + "varrun_path" => "/var/run", + "varetc_path" => "/var/etc", + "vardb_path" => "/var/db", + "varlog_path" => "/var/log", + "etc_path" => "/etc", + "tmp_path" => "/tmp", + "conf_path" => "/conf", + "ftmp_path" => "/ftmp", + "conf_default_path" => "/conf.default", + "cf_path" => "/cf", + "cf_conf_path" => "/cf/conf", + "www_path" => "/usr/local/www", + "captiveportal_path" => "/usr/local/captiveportal", + "xml_rootobj" => "m0n0wall", + "pppoe_interface" => "ng0", + "n_pptp_units" => 16, + "pptp_subnet" => 28, + "debug" => false, + "latest_config" => "1.4", + "nopccard_platforms" => array("wrap", "net48xx") +); + +?> diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc new file mode 100644 index 0000000..00331c1 --- /dev/null +++ b/etc/inc/interfaces.inc @@ -0,0 +1,740 @@ +<?php +/* + interfaces.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function interfaces_loopback_configure() { + global $config, $g; + + mwexec("/sbin/ifconfig lo0 127.0.0.1"); + + return 0; +} + +function interfaces_vlan_configure() { + global $config, $g; + + if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) { + + /* load the VLAN module */ + mwexec("/sbin/kldload if_vlan"); + + /* devices with native VLAN support */ + $vlan_native_supp = explode(" ", "bge em gx nge ti txp"); + + /* devices with long frame support */ + $vlan_long_supp = explode(" ", "dc fxp sis ste tl tx xl"); + + $i = 0; + + foreach ($config['vlans']['vlan'] as $vlan) { + + $cmd = "/sbin/ifconfig vlan{$i} create vlan " . + escapeshellarg($vlan['tag']) . " vlandev " . + escapeshellarg($vlan['if']); + + /* get driver name */ + for ($j = 0; $j < strlen($vlan['if']); $j++) { + if ($vlan['if'][$j] >= '0' && $vlan['if'][$j] <= '9') + break; + } + $drvname = substr($vlan['if'], 0, $j); + + if (in_array($drvname, $vlan_native_supp)) + $cmd .= " link0"; + else if (in_array($drvname, $vlan_long_supp)) + $cmd .= " mtu 1500"; + + mwexec($cmd); + + /* make sure the parent interface is up */ + mwexec("/sbin/ifconfig " . escapeshellarg($vlan['if']) . " up"); + + $i++; + } + } + + return 0; +} + +function interfaces_lan_configure() { + global $config, $g; + + if ($g['booting']) + echo "Configuring LAN interface... "; + + $lancfg = $config['interfaces']['lan']; + + /* wireless configuration? */ + if (is_array($lancfg['wireless'])) + interfaces_wireless_configure($lancfg['if'], $lancfg['wireless']); + + /* MAC spoofing? */ + if ($lancfg['spoofmac']) + mwexec("/sbin/ifconfig " . escapeshellarg($lancfg['if']) . + " link " . escapeshellarg($lancfg['spoofmac'])); + + /* media */ + if ($lancfg['media'] || $lancfg['mediaopt']) { + $cmd = "/sbin/ifconfig " . escapeshellarg($lancfg['if']); + if ($lancfg['media']) + $cmd .= " media " . escapeshellarg($lancfg['media']); + if ($lancfg['mediaopt']) + $cmd .= " mediaopt " . escapeshellarg($lancfg['mediaopt']); + mwexec($cmd); + } + + mwexec("/sbin/ifconfig " . escapeshellarg($lancfg['if']) . " " . + escapeshellarg($lancfg['ipaddr'] . "/" . $lancfg['subnet'])); + + if (!$g['booting']) { + /* make new hosts file */ + system_hosts_generate(); + + /* reconfigure static routes (kernel may have deleted them) */ + system_routing_configure(); + + /* reload ipfilter (address may have changed) */ + filter_configure(); + + /* reload shaper (subnet may have changed) */ + shaper_configure(); + + /* reload IPsec tunnels */ + vpn_ipsec_configure(); + + /* reload dhcpd (gateway may have changed) */ + services_dhcpd_configure(); + + /* reload dnsmasq */ + services_dnsmasq_configure(); + + /* reload webgui */ + system_webgui_start(); + + /* reload captive portal */ + captiveportal_configure(); + } + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function interfaces_optional_configure() { + global $config, $g; + global $bridgeconfig; + + /* Reset bridge configuration. Interfaces will add to it. */ + $bridgeconfig = ""; + + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { + interfaces_optional_configure_if($i); + } + + if ($bridgeconfig) { + /* Set the system bridge configuration and enable bridging. */ + mwexec("/sbin/sysctl net.link.ether.bridge_cfg=" . $bridgeconfig); + + if (isset($config['bridge']['filteringbridge'])) + mwexec("/sbin/sysctl net.link.ether.bridge_ipf=1"); + + mwexec("/sbin/sysctl net.link.ether.bridge=1"); + } else { + mwexec("/sbin/sysctl net.link.ether.bridge_ipf=0"); + mwexec("/sbin/sysctl net.link.ether.bridge=0"); + } + + if (!$g['booting']) { + /* reconfigure static routes (kernel may have deleted them) */ + system_routing_configure(); + + /* reload ipfilter (address may have changed) */ + filter_configure(); + + /* reload shaper (address may have changed) */ + shaper_configure(); + + /* reload IPsec tunnels */ + vpn_ipsec_configure(); + + /* reload dhcpd (interface enabled/disabled/bridged status may have changed) */ + services_dhcpd_configure(); + + /* restart dnsmasq */ + services_dnsmasq_configure(); + } + + return 0; +} + +function interfaces_optional_configure_if($opti) { + global $config, $g; + global $bridgeconfig; + + $optcfg = $config['interfaces']['opt' . $opti]; + + if ($g['booting']) { + $optdescr = ""; + if ($optcfg['descr']) + $optdescr = " ({$optcfg['descr']})"; + echo "Configuring OPT{$opti}{$optdescr} interface... "; + } + + if (isset($optcfg['enable'])) { + /* wireless configuration? */ + if (is_array($optcfg['wireless'])) + interfaces_wireless_configure($optcfg['if'], $optcfg['wireless']); + + /* MAC spoofing? */ + if ($optcfg['spoofmac']) + mwexec("/sbin/ifconfig " . escapeshellarg($optcfg['if']) . + " link " . escapeshellarg($optcfg['spoofmac'])); + + /* media */ + if ($optcfg['media'] || $optcfg['mediaopt']) { + $cmd = "/sbin/ifconfig " . escapeshellarg($optcfg['if']); + if ($optcfg['media']) + $cmd .= " media " . escapeshellarg($optcfg['media']); + if ($optcfg['mediaopt']) + $cmd .= " mediaopt " . escapeshellarg($optcfg['mediaopt']); + mwexec($cmd); + } + + /* OpenVPN configuration? */ + if (isset($optcfg['ovpn'])) { + if (strstr($if, "tap")) + ovpn_link_tap(); + } + + /* bridged? */ + if ($optcfg['bridge']) { + mwexec("/sbin/ifconfig " . escapeshellarg($optcfg['if']) . + " delete up"); + + if ($bridgeconfig != "") + $bridgeconfig .= ","; + + $bridgeconfig .= $optcfg['if'] . ":" . $opti . "," . + $config['interfaces'][$optcfg['bridge']]['if'] . + ":" . $opti; + } else { + mwexec("/sbin/ifconfig " . escapeshellarg($optcfg['if']) . " " . + escapeshellarg($optcfg['ipaddr'] . "/" . $optcfg['subnet'])); + } + } else { + mwexec("/sbin/ifconfig " . escapeshellarg($optcfg['if']) . + " delete down"); + } + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function interfaces_wireless_configure($if, $wlcfg) { + global $config, $g; + + /* wireless configuration */ + $ifcargs = escapeshellarg($if) . + " ssid " . escapeshellarg($wlcfg['ssid']) . " channel " . + escapeshellarg($wlcfg['channel']) . " "; + + if ($wlcfg['stationname']) + $ifcargs .= "stationname " . escapeshellarg($wlcfg['stationname']) . " "; + + if (isset($wlcfg['wep']['enable']) && is_array($wlcfg['wep']['key'])) { + $ifcargs .= "wepmode on "; + + $i = 1; + foreach ($wlcfg['wep']['key'] as $wepkey) { + $ifcargs .= "wepkey " . escapeshellarg("{$i}:{$wepkey['value']}") . " "; + if (isset($wepkey['txkey'])) { + $ifcargs .= "weptxkey {$i} "; + } + $i++; + } + } else { + $ifcargs .= "wepmode off "; + } + + switch ($wlcfg['mode']) { + case 'hostap': + if (strstr($if, "wi")) + $ifcargs .= "-mediaopt ibss mediaopt hostap "; + break; + case 'ibss': + case 'IBSS': + if (strstr($if, "wi")) + $ifcargs .= "-mediaopt hostap mediaopt ibss "; + else if (strstr($if, "an")) + $ifcargs .= "mediaopt adhoc "; + break; + case 'bss': + case 'BSS': + if (strstr($if, "wi")) + $ifcargs .= "-mediaopt hostap -mediaopt ibss "; + else if (strstr($if, "an")) + $ifcargs .= "-mediaopt adhoc "; + break; + } + + $ifcargs .= "up"; + + mwexec("/sbin/ifconfig " . $ifcargs); + + return 0; +} + +function interfaces_wan_configure() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + + if ($g['booting']) + echo "Configuring WAN interface... "; + else { + /* kill dhclient */ + killbypid("{$g['varrun_path']}/dhclient.pid"); + + /* kill PPPoE client (mpd) */ + killbypid("{$g['varrun_path']}/mpd.pid"); + + /* wait for processes to die */ + sleep(2); + + /* remove dhclient.conf, if it exists */ + if (file_exists("{$g['varetc_path']}/dhclient.conf")) { + unlink("{$g['varetc_path']}/dhclient.conf"); + } + /* remove mpd.conf, if it exists */ + if (file_exists("{$g['varetc_path']}/mpd.conf")) { + unlink("{$g['varetc_path']}/mpd.conf"); + } + /* remove mpd.links, if it exists */ + if (file_exists("{$g['varetc_path']}/mpd.links")) { + unlink("{$g['varetc_path']}/mpd.links"); + } + /* remove wanip, if it exists */ + if (file_exists("{$g['vardb_path']}/wanip")) { + unlink("{$g['vardb_path']}/wanip"); + } + } + + /* remove all addresses first */ + while (mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . " -alias") == 0); + mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . " down"); + + /* wireless configuration? */ + if (is_array($wancfg['wireless'])) + interfaces_wireless_configure($wancfg['if'], $wancfg['wireless']); + + if ($wancfg['spoofmac']) + mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . + " link " . escapeshellarg($wancfg['spoofmac'])); + + /* media */ + if ($wancfg['media'] || $wancfg['mediaopt']) { + $cmd = "/sbin/ifconfig " . escapeshellarg($wancfg['if']); + if ($wancfg['media']) + $cmd .= " media " . escapeshellarg($wancfg['media']); + if ($wancfg['mediaopt']) + $cmd .= " mediaopt " . escapeshellarg($wancfg['mediaopt']); + mwexec($cmd); + } + + switch ($wancfg['ipaddr']) { + + case 'dhcp': + interfaces_wan_dhcp_configure(); + break; + + case 'pppoe': + interfaces_wan_pppoe_configure(); + break; + + case 'pptp': + interfaces_wan_pptp_configure(); + break; + + case 'bigpond': + /* just configure DHCP for now; fire up bpalogin when we've got the lease */ + interfaces_wan_dhcp_configure(); + break; + + default: + mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . " " . + escapeshellarg($wancfg['ipaddr'] . "/" . $wancfg['subnet'])); + + /* install default route */ + mwexec("/sbin/route delete default"); + mwexec("/sbin/route add default " . escapeshellarg($wancfg['gateway'])); + + /* resync ipfilter (done automatically for DHCP/PPPoE/PPTP) */ + filter_resync(); + } + + if (!$g['booting']) { + /* reconfigure static routes (kernel may have deleted them) */ + system_routing_configure(); + + /* reload ipfilter */ + filter_configure(); + + /* reload shaper */ + shaper_configure(); + + /* reload ipsec tunnels */ + vpn_ipsec_configure(); + + /* restart ez-ipupdate */ + services_dyndns_configure(); + + /* restart dnsmasq */ + services_dnsmasq_configure(); + } + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function interfaces_wan_dhcp_configure() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + + /* generate dhclient.conf */ + $fd = fopen("{$g['varetc_path']}/dhclient.conf", "w"); + if (!$fd) { + printf("Error: cannot open dhclient.conf in interfaces_wan_dhcp_configure().\n"); + return 1; + } + + $dhclientconf = ""; + + if ($wancfg['dhcphostname']) { + $dhclientconf .= <<<EOD +send dhcp-client-identifier "{$wancfg['dhcphostname']}"; +interface "{$wancfg['if']}" { + send host-name "{$wancfg['dhcphostname']}"; +} + +EOD; + } + + fwrite($fd, $dhclientconf); + fclose($fd); + + /* fire up dhclient - don't wait for the lease (-nw) */ + mwexec("/sbin/dhclient -nw -cf {$g['varetc_path']}/dhclient.conf " . + escapeshellarg($wancfg['if']) . " &"); + + return 0; +} + +function interfaces_wan_pppoe_configure() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + $pppoecfg = $config['pppoe']; + + /* generate mpd.conf */ + $fd = fopen("{$g['varetc_path']}/mpd.conf", "w"); + if (!$fd) { + printf("Error: cannot open mpd.conf in interfaces_wan_pppoe_configure().\n"); + return 1; + } + + $idle = 0; + + if (isset($pppoecfg['ondemand'])) { + $ondemand = "enable"; + if ($pppoecfg['timeout']) + $idle = $pppoecfg['timeout']; + } else { + $ondemand = "disable"; + } + + $mpdconf = <<<EOD +pppoe: + new -i ng0 pppoe pppoe + set iface route default + set iface {$ondemand} on-demand + set iface idle {$idle} + set iface up-script /usr/local/sbin/ppp-linkup + +EOD; + + if (isset($pppoecfg['ondemand'])) { + $mpdconf .= <<<EOD + set iface addrs 10.0.0.1 10.0.0.2 + +EOD; + } + + $mpdconf .= <<<EOD + set bundle disable multilink + set bundle authname "{$pppoecfg['username']}" + set bundle password "{$pppoecfg['password']}" + set link keep-alive 10 60 + set link max-redial 0 + set link no acfcomp protocomp + set link disable pap chap + set link accept chap + set link mtu 1492 + set ipcp yes vjcomp + set ipcp ranges 0.0.0.0/0 0.0.0.0/0 + set ipcp enable req-pri-dns + set ipcp enable req-sec-dns + open iface + +EOD; + + fwrite($fd, $mpdconf); + fclose($fd); + + /* generate mpd.links */ + $fd = fopen("{$g['varetc_path']}/mpd.links", "w"); + if (!$fd) { + printf("Error: cannot open mpd.links in interfaces_wan_pppoe_configure().\n"); + return 1; + } + + $mpdconf = <<<EOD +pppoe: + set link type pppoe + set pppoe iface {$wancfg['if']} + set pppoe service "{$pppoecfg['provider']}" + set pppoe enable originate + set pppoe disable incoming + +EOD; + + fwrite($fd, $mpdconf); + fclose($fd); + + /* fire up mpd */ + mwexec("/usr/local/sbin/mpd -b -d {$g['varetc_path']} -p {$g['varrun_path']}/mpd.pid pppoe"); + + return 0; +} + +function interfaces_wan_pptp_configure() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + $pptpcfg = $config['pptp']; + + /* generate mpd.conf */ + $fd = fopen("{$g['varetc_path']}/mpd.conf", "w"); + if (!$fd) { + printf("Error: cannot open mpd.conf in interfaces_wan_pptp_configure().\n"); + return 1; + } + + $idle = 0; + + if (isset($pptpcfg['ondemand'])) { + $ondemand = "enable"; + if ($pptpcfg['timeout']) + $idle = $pptpcfg['timeout']; + } else { + $ondemand = "disable"; + } + + $mpdconf = <<<EOD +pptp: + new -i ng0 pptp pptp + set iface route default + set iface {$ondemand} on-demand + set iface idle {$idle} + set iface up-script /usr/local/sbin/ppp-linkup + +EOD; + + if (isset($pptpcfg['ondemand'])) { + $mpdconf .= <<<EOD + set iface addrs {$pptpcfg['local']} {$pptpcfg['remote']} + +EOD; + } + + $mpdconf .= <<<EOD + set bundle disable multilink + set bundle authname "{$pptpcfg['username']}" + set bundle password "{$pptpcfg['password']}" + set link keep-alive 10 60 + set link max-redial 0 + set link no acfcomp protocomp + set link disable pap chap + set link accept chap + set ipcp no vjcomp + set ipcp ranges 0.0.0.0/0 0.0.0.0/0 + set ipcp enable req-pri-dns + set ipcp enable req-sec-dns + open + +EOD; + + fwrite($fd, $mpdconf); + fclose($fd); + + /* generate mpd.links */ + $fd = fopen("{$g['varetc_path']}/mpd.links", "w"); + if (!$fd) { + printf("Error: cannot open mpd.links in interfaces_wan_pptp_configure().\n"); + return 1; + } + + $mpdconf = <<<EOD +pptp: + set link type pptp + set pptp enable originate outcall + set pptp disable windowing + set pptp self {$pptpcfg['local']} + set pptp peer {$pptpcfg['remote']} + +EOD; + + fwrite($fd, $mpdconf); + fclose($fd); + + /* configure interface */ + mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . " " . + escapeshellarg($pptpcfg['local'] . "/" . $pptpcfg['subnet'])); + + /* fire up mpd */ + mwexec("/usr/local/sbin/mpd -b -d {$g['varetc_path']} -p {$g['varrun_path']}/mpd.pid pptp"); + + return 0; +} + +function interfaces_wan_bigpond_configure($curwanip) { + global $config, $g; + + $bpcfg = $config['bigpond']; + + if (!$curwanip) { + /* IP address not configured yet, exit */ + return 0; + } + + /* kill bpalogin */ + killbyname("bpalogin"); + + /* wait a moment */ + sleep(1); + + /* get the default domain */ + $nfd = @fopen("{$g['varetc_path']}/defaultdomain.conf", "r"); + if ($nfd) { + $defaultdomain = trim(fgets($nfd)); + fclose($nfd); + } + + /* generate bpalogin.conf */ + $fd = fopen("{$g['varetc_path']}/bpalogin.conf", "w"); + if (!$fd) { + printf("Error: cannot open bpalogin.conf in interfaces_wan_bigpond_configure().\n"); + return 1; + } + + if (!$bpcfg['authserver']) + $bpcfg['authserver'] = "dce-server"; + if (!$bpcfg['authdomain']) + $bpcfg['authdomain'] = $defaultdomain; + + $bpconf = <<<EOD +username {$bpcfg['username']} +password {$bpcfg['password']} +authserver {$bpcfg['authserver']} +authdomain {$bpcfg['authdomain']} +localport 5050 + +EOD; + + if ($bpcfg['minheartbeatinterval']) + $bpconf .= "minheartbeatinterval {$bpcfg['minheartbeatinterval']}\n"; + + fwrite($fd, $bpconf); + fclose($fd); + + /* fire up bpalogin */ + mwexec("/usr/local/sbin/bpalogin -c {$g['varetc_path']}/bpalogin.conf"); + + return 0; +} + +function get_real_wan_interface() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + + $wanif = $wancfg['if']; + if (($wancfg['ipaddr'] == "pppoe") || ($wancfg['ipaddr'] == "pptp")) { + $wanif = $g['pppoe_interface']; + } + + return $wanif; +} + +function get_current_wan_address() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + + if (in_array($wancfg['ipaddr'], array('pppoe','dhcp','pptp','bigpond'))) { + /* dynamic WAN IP address, find out which one */ + $wanif = get_real_wan_interface(); + + /* get interface info with netstat */ + exec("/usr/bin/netstat -nWI " . escapeshellarg($wanif) . " -f inet", $ifinfo); + + if (isset($ifinfo[1])) { + $aif = preg_split("/\s+/", $ifinfo[1]); + $curwanip = chop($aif[3]); + + if ($curwanip && is_ipaddr($curwanip) && ($curwanip != "0.0.0.0")) + return $curwanip; + } + + return null; + } else { + /* static WAN IP address */ + return $wancfg['ipaddr']; + } +} + +?> diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc new file mode 100644 index 0000000..2414ae0 --- /dev/null +++ b/etc/inc/openvpn.inc @@ -0,0 +1,559 @@ +<?php +/* + openvpn.inc + + Copyright (C) 2004 Peter Curran (peter@closeconsultants.com). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("globals.inc"); +require_once("config.inc"); +require_once("functions.inc"); + +function ovpn_configure() { + global $config; + if (is_array($config['ovpn']['server'])) + ovpn_config_server(); + if (is_array($config['ovpn']['client'])) + ovpn_config_client(); + return; +} + +function ovpn_link_tap() { + /* Add a reference to the tap KLM. If ref count = 1, load it */ + global $g; + + if (!is_file($g['vardb_path'] ."/ovpn_tap_link")){ + $link_count = 1; + mwexec("/sbin/kldload if_tap"); + $fd = fopen($g['vardb_path'] ."/ovpn_tap_link", 'w'); + } + else { + $fd = fopen($g['vardb_path'] ."/ovpn_tap_link", 'r+'); + $link_count = fread($fd); + $link_count ++; + } + fwrite($fd, $link_count); + fclose($fd); + return true; +} + +function ovpn_unlink_tap() { + /* Remove a reference to the tap KLM. If ref count = 0, unload it */ + global $g; + + if (!is_file($g['vardb_path'] ."/ovpn_tap_link")) + return false; //no file, no links so why are we called? + + $fd = fopen($g['vardb_path'] ."/ovpn_tap_link", 'r+'); + $link_count = fread($fd); + $link_count --; + fwrite($fd, $link_count); + fclose($fd); + + if ($link_count == 0) + mwexec("/sbin/kldunload if_tap"); + return true; +} + +/*****************************/ +/* Server-related functions */ + +/* Configure the server */ +function ovpn_config_server() { + global $config, $g; + + if (isset($config['ovpn']['server']['enable'])) { + + if ($g['booting']) + echo "Starting OpenVPN server... "; + + /* kill any running openvpn daemon */ + killbypid($g['varrun_path']."/ovpn_srv.pid"); + + /* Remove old certs & keys */ + unlink_if_exists("{$g['vardb_path']}/ovpn_ca_cert.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_srv_cert.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_srv_key.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_dh.pem"); + + /* Copy the TLS-Server certs & keys to disk */ + $fd = @fopen("{$g['vardb_path']}/ovpn_ca_cert.pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($config['ovpn']['server']['ca_cert'])."\n"); + fclose($fd); + } + $fd = @fopen("{$g['vardb_path']}/ovpn_srv_cert.pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($config['ovpn']['server']['srv_cert'])."\n"); + fclose($fd); + } + $fd = @fopen("{$g['vardb_path']}/ovpn_srv_key.pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($config['ovpn']['server']['srv_key'])."\n"); + fclose($fd); + } + $fd = @fopen("{$g['vardb_path']}/ovpn_dh.pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($config['ovpn']['server']['dh_param'])."\n"); + fclose($fd); + } + + /* Start the openvpn daemon */ + mwexec("/usr/local/sbin/openvpn " . ovpn_srv_config_generate()); + + if ($g['booting']) + /* Send the boot message */ + echo "done\n"; + } + else { + if (!$g['booting']){ + /* stop any processes, unload the tap module */ + /* Remove old certs & keys */ + unlink_if_exists("{$g['vardb_path']}/ovpn_ca_cert.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_srv_cert.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_srv_key.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_dh.pem"); + killbypid("{$g['varrun_path']}/ovpn_srv.pid"); + if ($config['ovpn']['server']['tun_iface'] == 'tap0') + ovpn_unlink_tap(); + } + } + return 0; +} + +/* Generate the config for a OpenVPN server */ +function ovpn_srv_config_generate() { + global $config, $g; + $server = $config['ovpn']['server']; + + /* First the generic stuff: + - We are a server + - We are a TLS Server (for authentication) + - We will run without privilege + */ + $ovpn_config = "--daemon --user nobody --group nobody --verb {$server['verb']} "; + + /* pid file */ + $ovpn_config .= "--writepid {$g['varrun_path']}/ovpn_srv.pid "; + + /* interface */ + $ovpn_config .= "--dev {$server['tun_iface']} "; + + /* port */ + $ovpn_config .= "--port {$server['port']} "; + + /* Interface binding - 1 or all */ + if ($server['bind_iface'] != 'all') { + if ($ipaddr = ovpn_get_ip($server['bind_iface'])) + $ovpn_config .= "--local $ipaddr "; + else + return "Interface bridged"; + + } + + /* Client to client routing (off by default) */ + if (isset($server['cli2cli'])) + $ovpn_config .= "--client-to-client "; + + /* Set maximum simultaneous clients */ + $ovpn_config .= "--max-clients {$server['maxcli']} "; + + /* New --server macro simplifies config */ + $mask = ovpn_calc_mask($server['prefix']); + $ovpn_config .= "--server {$server['ipblock']} {$mask} "; + + /* TLS-Server params */ + $ovpn_config .= "--ca {$g['vardb_path']}/ovpn_ca_cert.pem "; + $ovpn_config .= "--cert {$g['vardb_path']}/ovpn_srv_cert.pem "; + $ovpn_config .= "--key {$g['vardb_path']}/ovpn_srv_key.pem "; + $ovpn_config .= "--dh {$g['vardb_path']}/ovpn_dh.pem "; + + /* Data channel encryption cipher*/ + $ovpn_config .= "--cipher {$server['crypto']} "; + + /* Duplicate CNs */ + if (isset($server['dupcn'])) + $ovpn_config .= "--duplicate-cn "; + + /* Client push - redirect gateway */ + if (isset($server['psh_options']['redir'])){ + if (isset($server['psh_options']['redir_loc'])) + $ovpn_config .= "--push \"redirect-gateway 'local'\" "; + else + $ovpn_config .= "--push \"redirect-gateway\" "; + } + + /* Client push - route delay */ + if (isset($server['psh_options']['rte_delay'])) + $ovpn_config .= "--push \"route-delay {$server['psh_options']['rte_delay']}\" "; + + /* Client push - ping (note we set both server and client) */ + if (isset ($server['psh_options']['ping'])){ + $ovpn_config .= "--ping {$server['psh_options']['ping']} "; + $ovpn_config .= "--push \"ping {$server['psh_options']['ping']}\" "; + } + + /* Client push - ping-restart (note server uses 2 x client interval) */ + if (isset ($server['psh_options']['pingrst'])){ + $interval = $server['psh_options']['pingrst']; + $ovpn_config .= "--ping-restart " . ($interval * 2) . " "; + $ovpn_config .= "--push \"ping-restart $interval\" "; + } + + /* Client push - ping-exit (set on client) */ + if (isset ($server['psh_options']['pingexit'])){ + $ovpn_config .= "--ping-exit {$server['psh_options']['pingexit']} "; + $ovpn_config .= "--push \"ping-exit {$server['psh_options']['pingexit']}\" "; + } + + /* Client push - inactive (set on client) */ + if (isset ($server['psh_options']['inact'])){ + $ovpn_config .= "--inactive {$server['psh_options']['pingexit']} "; + $ovpn_config .= "--push \"inactive {$server['psh_options']['inact']}\" "; + } + + //trigger_error("OVPN: $ovpn_config", E_USER_NOTICE); + return $ovpn_config; +} + +/* Define an OVPN Server tunnel interface in the interfaces array and assign a name */ +function ovpn_server_iface(){ + global $config, $g; + + $i = 1; + while (true) { + $ifname = 'opt' . $i; + if (is_array($config['interfaces'][$ifname])) { + if ((isset($config['interfaces'][$ifname]['ovpn'])) + && ($config['interfaces'][$ifname]['ovpn'] == 'server')) + /* Already an interface defined - overwrite */ + break; + } + else { + /* No existing entry, this is first unused */ + $config['interfaces'][$ifname] = array(); + break; + } + $i++; + } + $config['interfaces'][$ifname]['descr'] = "OVPN server"; + $config['interfaces'][$ifname]['if'] = $config['ovpn']['server']['tun_iface']; + $config['interfaces'][$ifname]['ipaddr'] = long2ip( ip2long($config['ovpn']['server']['ipblock']) + 1); + $config['interfaces'][$ifname]['subnet'] = $config['ovpn']['server']['prefix']; + $config['interfaces'][$ifname]['enable'] = isset($config['ovpn']['server']['enable']) ? true : false; + $config['interfaces'][$ifname]['ovpn'] = 'server'; + + write_config(); + + return "OpenVPN server interface defined"; +} + +/********************************************************/ +/* Client related functions */ +function ovpn_config_client() { + /* Boot time configuration */ + global $config, $g; + + foreach ($config['ovpn']['client']['tunnel'] as $id => $client) { + if (isset($client['enable'])) { + + if ($g['booting']) + echo "Starting OpenVPN client $id... "; + + /* kill any running openvpn daemon */ + killbypid("{$g['varrun_path']}/ovpn_client{$id}.pid"); + + /* Remove old certs & keys */ + unlink_if_exists("{$g['vardb_path']}/ovpn_ca_cert_{$id}.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_cli_cert_{$id}.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_cli_key_{$id}.pem"); + + /* Copy the TLS-Client certs & keys to disk */ + /*$fd = @fopen("{$g['vardb_path']}/ovpn_ca_cert_{$id}.pem", "w");*/ + $fd = fopen("{$g['vardb_path']}/ovpn_ca_cert_{$id}.pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($client['ca_cert'])."\n"); + fclose($fd); + } + else + trigger_error("OVPN: No open for CA", E_USER_NOTICE); + $fd = fopen($g['vardb_path']."/ovpn_cli_cert_".$id.".pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($client['cli_cert'])."\n"); + fclose($fd); + } + $fd = fopen($g['vardb_path']."/ovpn_cli_key_".$id.".pem", "w"); + if ($fd) { + fwrite($fd, base64_decode($client['cli_key'])."\n"); + fclose($fd); + } + + /* Start openvpn for this client */ + mwexec("/usr/local/sbin/openvpn " . ovpn_cli_config_generate($id)); + + if ($g['booting']) + /* Send the boot message */ + echo "done\n"; + } + else { + if (!$g['booting']){ + /* stop any processes, unload the tap module */ + /* Remove old certs & keys */ + unlink_if_exists("{$g['vardb_path']}/ovpn_ca_cert_{$id}.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_cli_cert_{$id}.pem"); + unlink_if_exists("{$g['vardb_path']}/ovpn_cli_key_{$id}.pem"); + killbypid("{$g['varrun_path']}/ovpn_client{$id}.pid"); + if ($client['type'] == "tap") + ovpn_unlink_tap(); + } + } + } + return 0; + +} + +/* Kill off a running client process */ +function ovpn_client_kill($id) { + global $g; + + killbypid("{$g['varrun_path']}/ovpn_client{$id}.pid"); + return 0; +} + +function ovpn_cli_config_generate($id) { + /* configure the named client */ + global $config, $g; + $client = $config['ovpn']['client']['tunnel']; + + /* Client support in 2.0 is very simple */ + + $ovpn_config = "--client --daemon --verb 1 "; + + /* pid file */ + $ovpn_config .= "--writepid {$g['varrun_path']}/ovpn_client{$id}.pid "; + + /* interface */ + $ovpn_config .= "--dev {$client[$id]['if']} "; + + /* protocol */ + $ovpn_config .= "--proto {$client[$id]['proto']} "; + + /* port */ + $ovpn_config .= "--lport {$client[$id]['cport']} "; + + /* server location */ + $ovpn_config .= "--remote {$client[$id]['saddr']} {$client[$id]['sport']} "; + + /* TLS-Server params */ + $ovpn_config .= "--ca {$g['vardb_path']}/ovpn_ca_cert_{$id}.pem "; + $ovpn_config .= "--cert {$g['vardb_path']}/ovpn_cli_cert_{$id}.pem "; + $ovpn_config .= "--key {$g['vardb_path']}/ovpn_cli_key_{$id}.pem "; + + /* Data channel encryption cipher*/ + $ovpn_config .= "--cipher {$client[$id]['crypto']} "; + + //trigger_error("OVPN: $ovpn_config", E_USER_NOTICE); + return $ovpn_config; +} + +/* Define an OVPN tunnel interface in the interfaces array for each client */ +function ovpn_client_iface(){ + global $config; + + foreach ($config['ovpn']['client']['tunnel'] as $id => $client) { + if (isset($client['enable'])) { + $i = 1; + while (true) { + $ifname = 'opt' . $i; + if (is_array($config['interfaces'][$ifname])) { + if ((isset($config['interfaces'][$ifname]['ovpn'])) + && ($config['interfaces'][$ifname]['ovpn'] == "client{$id}")) + /* Already an interface defined - overwrite */ + break; + } + else { + /* No existing entry, this is first unused */ + $config['interfaces'][$ifname] = array(); + break; + } + $i++; + } + if (isset($client['descr'])) + $config['interfaces'][$ifname]['descr'] = $client['descr']; + else + $config['interfaces'][$ifname]['descr'] = "OVPN client-{$id}"; + $config['interfaces'][$ifname]['if'] = $client['if']; + $config['interfaces'][$ifname]['ipaddr'] = "0.0.0.0"; + $config['interfaces'][$ifname]['subnet'] = "0"; + $config['interfaces'][$ifname]['enable'] = isset($client['enable']) ? true : false; + $config['interfaces'][$ifname]['ovpn'] = "client{$id}"; + write_config(); + } + } + return "OpenVPN client interfaces defined"; +} + +/* Delete a client interface definition */ +function ovpn_client_iface_del($id) { + global $config; + + $i = 1; + while (true) { + $ifname = 'opt' . $i; + if (is_array($config['interfaces'][$ifname])) { + if ((isset($config['interfaces'][$ifname]['ovpn'])) + && ($config['interfaces'][$ifname]['ovpn'] == "client{$id}")) + unset($config['interfaces'][$ifname]); + } + } +} + +/******************/ +/* Misc functions */ + +/* Calculate the last address in a range given the start and /prefix */ +function ovpn_calc_end($start, $prefix){ + + $first = ip2long($start); + $last = pow(2,(32 - $prefix)) - 1 + $first; + return long2ip($last); +} + +/* Calculate a mask given a /prefix */ +function ovpn_calc_mask($prefix){ + + return long2ip(ip2long("255.255.255.255") - (pow( 2, (32 - $prefix)) - 1)); +} + +/* Read in a file from the $_FILES array */ +function ovpn_get_file($file){ + global $g; + + if (!is_uploaded_file($_FILES[$file]['tmp_name'])){ + trigger_error("Bad file upload".$_FILES[$file]['error'], E_USER_NOTICE); + return NULL; + } + $contents = file_get_contents($_FILES[$file]['tmp_name']); + return $contents; +} + + +/* Get the IP address of a specified interface */ +function ovpn_get_ip($iface){ + global $config; + + if ($iface == 'wan') + return get_current_wan_address(); + + if ($config['interfaces'][$iface]['bridge']) + /* No bridging (yet) */ + return false; + return $config['interfaces'][$iface]['ipaddr']; +} + +/* Get a list of the cipher options supported by OpenVPN */ +function ovpn_get_cipher_list(){ + +/* exec("/usr/local/sbin/openvpn --show-ciphers", $raw); + print_r ($raw); + + $ciphers = preg_grep('/ bit default key /', $raw); + + for($i = 0; $i <count($ciphers); $i++){ + $tmp = explode(' ',$ciphers[$i]); + $cipher_list["$tmp[0]"] = "{$tmp[0]} ({$tmp[1]} {$tmp[2]})"; + } +*/ + $cipher_list = array('DES-CBC' => 'DES-CBC (64 bit)', + 'RC2-CBC' => 'RC2-CBC (128 bit)', + 'DES-EDE-CBC' => 'DES-EDE-CBC (128 bit)', + 'DES-EDE3-CBC' => 'DES-EDE3-CBC (192 bit)', + 'DESX-CBC' => 'DESX-CBC (192 bit)', + 'BF-CBC' => 'BF-CBC (128 bit)', + 'RC2-40-CBC' => 'RC2-40-CBC (40 bit)', + 'CAST5-CBC' => 'CAST5-CBC (128 bit)', + 'RC5-CBC' => 'RC5-CBC (128 bit)', + 'RC2-64-CBC' => 'RC2-64-CBC (64 bit)', + 'AES-128-CBC' => 'AES-128-CBC (128 bit)', + 'AES-192-CBC' => 'AES-192-CBC (192 bit)', + 'AES-256-CBC' => 'AES-256-CBC (256 bit)'); + return $cipher_list; +} + + +/* Build a list of the current real interfaces */ +function ovpn_real_interface_list(){ + global $config; + + $interfaces = array('all' => 'ALL', + 'lan' => 'LAN', + 'wan' => 'WAN'); + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { + if (isset($config['interfaces']['opt' . $i]['ovpn'])) + /* Hide our own interface */ + break; + if (isset($config['interfaces']['opt' . $i]['enable'])) + $interfaces['opt' . $i] = $config['interfaces']['opt' . $i]['descr']; + } + return $interfaces; +} + + +/* lock openvpn information, decide that the lock file is stale after + 10 seconds */ +function ovpn_lock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/ovpn.lock"; + + $n = 0; + while ($n < 10) { + /* open the lock file in append mode to avoid race condition */ + if ($fd = @fopen($lockfile, "x")) { + /* succeeded */ + fclose($fd); + return; + } else { + /* file locked, wait and try again */ + sleep(1); + $n++; + } + } +} + +/* unlock configuration file */ +function ovpn_unlock() { + + global $g; + + $lockfile = "{$g['varrun_path']}/ovpn.lock"; + + if (file_exists($lockfile)) + unlink($lockfile); +} + +?> diff --git a/etc/inc/services.inc b/etc/inc/services.inc new file mode 100644 index 0000000..17bc959 --- /dev/null +++ b/etc/inc/services.inc @@ -0,0 +1,440 @@ +<?php +/* + services.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function services_dhcpd_configure() { + global $config, $g; + + /* kill any running dhcpd */ + killbypid("{$g['varrun_path']}/dhcpd.pid"); + + $syscfg = $config['system']; + $dhcpdcfg = $config['dhcpd']; + + /* DHCP enabled on any interfaces? */ + $dhcpdenable = false; + foreach ($dhcpdcfg as $dhcpif => $dhcpifconf) { + if (isset($dhcpifconf['enable']) && + (($dhcpif == "lan") || + (isset($config['interfaces'][$dhcpif]['enable']) && + $config['interfaces'][$dhcpif]['if'] && (!$config['interfaces'][$dhcpif]['bridge'])))) + $dhcpdenable = true; + } + + if (!$dhcpdenable) + return 0; + + if ($g['booting']) + echo "Starting DHCP service... "; + else + sleep(1); + + /* write dhcpd.conf */ + $fd = fopen("{$g['varetc_path']}/dhcpd.conf", "w"); + if (!$fd) { + printf("Error: cannot open dhcpd.conf in services_dhcpd_configure().\n"); + return 1; + } + + $dhcpdconf = <<<EOD +option domain-name "{$syscfg['domain']}"; +default-lease-time 7200; +max-lease-time 86400; +authoritative; +log-facility local7; +ddns-update-style none; + +EOD; + + $dhcpdifs = array(); + foreach ($dhcpdcfg as $dhcpif => $dhcpifconf) { + + $ifcfg = $config['interfaces'][$dhcpif]; + + if (!isset($dhcpifconf['enable']) || + (($dhcpif != "lan") && + (!isset($ifcfg['enable']) || !$ifcfg['if'] || $ifcfg['bridge']))) + continue; + + $subnet = gen_subnet($ifcfg['ipaddr'], $ifcfg['subnet']); + $subnetmask = gen_subnet_mask($ifcfg['subnet']); + + $dnscfg = ""; + + if ($dhcpifconf['domain']) { + $dnscfg .= " option domain-name \"{$dhcpifconf['domain']}\";\n"; + } + + if (is_array($dhcpifconf['dnsserver']) && ($dhcpifconf['dnsserver'][0])) { + $dnscfg .= " option domain-name-servers " . join(",", $dhcpifconf['dnsserver']) . ";"; + } else if (isset($config['dnsmasq']['enable'])) { + $dnscfg .= " option domain-name-servers " . $ifcfg['ipaddr'] . ";"; + } else if (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) { + $dnscfg .= " option domain-name-servers " . join(",", $syscfg['dnsserver']) . ";"; + } + + $dhcpdconf .= "subnet $subnet netmask $subnetmask {\n"; + $dhcpdconf .= " pool {\n"; + if (isset($dhcpifconf['denyunknown'])) + $dhcpdconf .= " deny unknown clients;\n"; + + if ($dhcpifconf['gateway']) + $routers = $dhcpifconf['gateway']; + else + $routers = $ifcfg['ipaddr']; + + $dhcpdconf .= <<<EOD + range {$dhcpifconf['range']['from']} {$dhcpifconf['range']['to']}; + } + option routers {$routers}; +$dnscfg + +EOD; + + if ($dhcpifconf['defaultleasetime']) + $dhcpdconf .= " default-lease-time {$dhcpifconf['defaultleasetime']};\n"; + if ($dhcpifconf['maxleasetime']) + $dhcpdconf .= " max-lease-time {$dhcpifconf['maxleasetime']};\n"; + + if (is_array($dhcpifconf['winsserver']) && $dhcpifconf['winsserver'][0]) { + $dhcpdconf .= " option netbios-name-servers " . join(",", $dhcpifconf['winsserver']) . ";\n"; + $dhcpdconf .= " option netbios-node-type 8;\n"; + } + + if ($dhcpifconf['next-server']) + $dhcpdconf .= " next-server {$dhcpifconf['next-server']};\n"; + if ($dhcpifconf['filename']) + $dhcpdconf .= " filename \"{$dhcpifconf['filename']}\";\n"; + + $dhcpdconf .= <<<EOD +} + +EOD; + + /* add static mappings */ + if (is_array($dhcpifconf['staticmap'])) { + + $i = 0; + foreach ($dhcpifconf['staticmap'] as $sm) { + $dhcpdconf .= <<<EOD +host s_{$dhcpif}_{$i} { + hardware ethernet {$sm['mac']}; + +EOD; + if ($sm['ipaddr']) + $dhcpdconf .= " fixed-address {$sm['ipaddr']};\n"; + + $dhcpdconf .= "}\n"; + $i++; + } + } + + $dhcpdifs[] = $ifcfg['if']; + } + + fwrite($fd, $dhcpdconf); + fclose($fd); + + /* create an empty leases database */ + touch("{$g['vardb_path']}/dhcpd.leases"); + + /* fire up dhcpd */ + mwexec("/usr/local/sbin/dhcpd -cf {$g['varetc_path']}/dhcpd.conf " . + join(" ", $dhcpdifs)); + + if (!$g['booting']) { + filter_configure(); + } else + echo "done\n"; + + return 0; +} + +function services_dhcrelay_configure() { + global $config, $g; + + /* kill any running dhcrelay */ + killbypid("{$g['varrun_path']}/dhcrelay.pid"); + + $dhcrelaycfg = $config['dhcrelay']; + + /* DHCPRelay enabled on any interfaces? */ + $dhcrelayenable = false; + foreach ($dhcrelaycfg as $dhcrelayif => $dhcrelayifconf) { + if (isset($dhcrelayifconf['enable']) && + (($dhcrelayif == "lan") || + (isset($config['interfaces'][$dhcrelayif]['enable']) && + $config['interfaces'][$dhcrelayif]['if'] && (!$config['interfaces'][$dhcrelayif]['bridge'])))) + $dhcrelayenable = true; + } + + if (!$dhcrelayenable) + return 0; + + if ($g['booting']) + echo "Starting DHCP relay service... "; + else + sleep(1); + + $dhcrelayifs = array(); + foreach ($dhcrelaycfg as $dhcrelayif => $dhcrelayifconf) { + + $ifcfg = $config['interfaces'][$dhcrelayif]; + + if (!isset($dhcrelayifconf['enable']) || + (($dhcrelayif != "lan") && + (!isset($ifcfg['enable']) || !$ifcfg['if'] || $ifcfg['bridge']))) + continue; + + $dhcrelayifs[] = $ifcfg['if']; + } + + /* In order for the relay to work, it needs to be active on the + interface in which the destination server sits */ + foreach ($config['interfaces'] as $ifname) { + $subnet = $ifname['ipaddr'] . "/" . $ifname['subnet']; + if (ip_in_subnet($dhcrelaycfg['server'],$subnet)) + $destif = $ifname['if']; + } + + if (!isset($destif)) + $destif = $config['interfaces']['wan']['if']; + + $dhcrelayifs[] = $destif; + $dhcrelayifs = array_unique($dhcrelayifs); + + /* fire up dhcrelay */ + $cmd = "/usr/local/sbin/dhcrelay -i " . join(" -i ", $dhcrelayifs); + + if (isset($dhcrelaycfg['agentoption'])) + $cmd .= " -a -m replace"; + + $cmd .= " {$dhcrelaycfg['server']}"; + mwexec($cmd); + + if (!$g['booting']) { + filter_configure(); + } else + echo "done\n"; + + return 0; +} + +function services_dyndns_reset() { + global $config, $g; + + if (file_exists("{$g['vardb_path']}/ez-ipupdate.cache")) { + unlink("{$g['vardb_path']}/ez-ipupdate.cache"); + } + + if (file_exists("{$g['conf_path']}/ez-ipupdate.cache")) { + conf_mount_rw(); + unlink("{$g['conf_path']}/ez-ipupdate.cache"); + conf_mount_ro(); + } + + return 0; +} + +function services_dyndns_configure() { + global $config, $g; + + /* kill any running ez-ipupdate */ + /* ez-ipupdate needs SIGQUIT instead of SIGTERM */ + sigkillbypid("{$g['varrun_path']}/ez-ipupdate.pid", "QUIT"); + + $dyndnscfg = $config['dyndns']; + $wancfg = $config['interfaces']['wan']; + + if (isset($dyndnscfg['enable'])) { + + if ($g['booting']) + echo "Starting DynDNS client... "; + else + sleep(1); + + /* determine WAN interface name */ + $wanif = get_real_wan_interface(); + + /* write ez-ipupdate.conf */ + $fd = fopen("{$g['varetc_path']}/ez-ipupdate.conf", "w"); + if (!$fd) { + printf("Error: cannot open ez-ipupdate.conf in services_dyndns_configure().\n"); + return 1; + } + + $ezipupdateconf = <<<EOD +service-type={$dyndnscfg['type']} +user={$dyndnscfg['username']}:{$dyndnscfg['password']} +host={$dyndnscfg['host']} +interface=$wanif +max-interval=2073600 +pid-file={$g['varrun_path']}/ez-ipupdate.pid +cache-file={$g['vardb_path']}/ez-ipupdate.cache +execute=/etc/rc.dyndns.storecache +daemon + +EOD; + + /* enable MX? */ + if ($dyndnscfg['mx']) { + $ezipupdateconf .= "mx={$dyndnscfg['mx']}\n"; + } + + /* enable wildcards? */ + if (isset($dyndnscfg['wildcard'])) { + $ezipupdateconf .= "wildcard\n"; + } + + fwrite($fd, $ezipupdateconf); + fclose($fd); + + /* if we're booting, copy the cache file from /conf */ + if ($g['booting']) { + if (file_exists("{$g['conf_path']}/ez-ipupdate.cache")) { + copy("{$g['conf_path']}/ez-ipupdate.cache", "{$g['vardb_path']}/ez-ipupdate.cache"); + } + } + + /* run ez-ipupdate */ + mwexec("/usr/local/bin/ez-ipupdate -c {$g['varetc_path']}/ez-ipupdate.conf"); + + if ($g['booting']) + echo "done\n"; + } + + return 0; +} + +function services_dnsmasq_configure() { + global $config, $g; + + /* kill any running dnsmasq */ + sigkillbypid("{$g['varrun_path']}/dnsmasq.pid", "TERM"); + + if (isset($config['dnsmasq']['enable'])) { + + if ($g['booting']) + echo "Starting DNS forwarder... "; + else + sleep(1); + + /* generate hosts file */ + system_hosts_generate(); + + $args = ""; + + if (isset($config['dnsmasq']['regdhcp'])) { + + $args .= " -l {$g['vardb_path']}/dhcpd.leases" . + " -s {$config['system']['domain']}"; + } + + /* run dnsmasq */ + mwexec("/usr/local/sbin/dnsmasq {$args}"); + + if ($g['booting']) + echo "done\n"; + } + + if (!$g['booting']) { + services_dhcpd_configure(); + } + + return 0; +} + +function services_snmpd_configure() { + global $config, $g; + + /* kill any running snmpd */ + sigkillbypid("{$g['varrun_path']}/snmpd.pid", "TERM"); + + if (isset($config['snmpd']['enable'])) { + + if ($g['booting']) + echo "Starting SNMP agent... "; + + /* generate snmpd.conf */ + $fd = fopen("{$g['varetc_path']}/snmpd.conf", "w"); + if (!$fd) { + printf("Error: cannot open snmpd.conf in services_snmpd_configure().\n"); + return 1; + } + + $snmpdconf = <<<EOD +syslocation "{$config['snmpd']['syslocation']}" +syscontact "{$config['snmpd']['syscontact']}" +rocommunity "{$config['snmpd']['rocommunity']}" + +EOD; + + fwrite($fd, $snmpdconf); + fclose($fd); + + /* run snmpd */ + mwexec("/usr/local/sbin/snmpd -c {$g['varetc_path']}/snmpd.conf" . + " -P {$g['varrun_path']}/snmpd.pid"); + + if ($g['booting']) + echo "done\n"; + } + + return 0; +} + +function services_proxyarp_configure() { + global $config, $g; + + /* kill any running choparp */ + killbyname("choparp"); + + if (is_array($config['proxyarp']) && count($config['proxyarp']) && + (is_ipaddr($config['interfaces']['wan']['ipaddr']) || + ($config['interfaces']['wan']['ipaddr'] == "dhcp") || + ($config['interfaces']['wan']['ipaddr'] == "bigpond"))) { + + $args = $config['interfaces']['wan']['if'] . " auto"; + + foreach ($config['proxyarp']['proxyarpnet'] as $paent) { + if (isset($paent['network'])) + $args .= " " . escapeshellarg($paent['network']); + else if (isset($paent['range'])) + $args .= " " . escapeshellarg($paent['range']['from'] . "-" . + $paent['range']['to']); + } + + mwexec_bg("/usr/local/sbin/choparp " . $args); + } +} + +?> diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc new file mode 100644 index 0000000..71e0575 --- /dev/null +++ b/etc/inc/shaper.inc @@ -0,0 +1,403 @@ +<?php +/* + shaper.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function shaper_configure() { + global $config, $g; + + if (isset($config['pfqueueing']['enable'])) { + + if ($g['booting']) + echo "Starting traffic shaper... "; + + /* generate shaper rules */ + $shaperrules = shaper_rules_generate(); + + /* make sure ipfw and dummynet are loaded */ + mwexec("/sbin/kldload ipfw"); + mwexec("/sbin/kldload dummynet"); + + /* change one_pass to 1 so ipfw stops checking after + a rule has matched */ + mwexec("/sbin/sysctl net.inet.ip.fw.one_pass=1"); + + /* load shaper rules */ + mwexec("/sbin/ipfw -f delete set 4"); + mwexec("/sbin/ipfw -f pipe flush"); + + /* XXX - seems like ipfw cannot accept rules directly on stdin, + so we have to write them to a temporary file first */ + $fd = fopen("{$g['tmp_path']}/ipfw.rules", "w"); + if (!$fd) { + printf("Cannot open ipfw.rules in shaper_configure()\n"); + return 1; + } + + fwrite($fd, $shaperrules); + fclose($fd); + + mwexec("/sbin/ipfw {$g['tmp_path']}/ipfw.rules"); + + unlink("{$g['tmp_path']}/ipfw.rules"); + + /* make sure bridged packets are shaped as well */ + mwexec("/sbin/sysctl net.link.ether.bridge_ipfw=1"); + + if ($g['booting']) + echo "done\n"; + + } else { + mwexec("/sbin/sysctl net.link.ether.bridge_ipfw=0"); + if (!isset($config['captiveportal']['enable'])) { + /* unload ipfw and dummynet */ + #mwexec("/sbin/kldunload dummynet"); + #mwexec("/sbin/kldunload ipfw"); + } else { + /* captive portal is on - just remove our rules */ + mwexec("/sbin/ipfw -f delete set 4"); + mwexec("/sbin/ipfw -f pipe flush"); + } + } + + return 0; +} + +function shaper_rules_generate() { + global $config, $g; + + $wancfg = $config['interfaces']['wan']; + $lancfg = $config['interfaces']['lan']; + $pptpdcfg = $config['pptpd']; + + $lanif = $lancfg['if']; + $wanif = get_real_wan_interface(); + + $lanip = $lancfg['ipaddr']; + $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); + $lansn = $lancfg['subnet']; + + /* optional interfaces */ + $optcfg = array(); + + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { + $oc = $config['interfaces']['opt' . $i]; + + if (isset($oc['enable']) && $oc['if']) { + $oic = array(); + $oic['ip'] = $oc['ipaddr']; + $oic['if'] = $oc['if']; + $oic['sa'] = gen_subnet($oc['ipaddr'], $oc['subnet']); + $oic['sn'] = $oc['subnet']; + + $optcfg['opt' . $i] = $oic; + } + } + + if ($pptpdcfg['mode'] == "server") { + $pptpip = $pptpdcfg['localip']; + $pptpsa = $pptpdcfg['remoteip']; + $pptpsn = $g['pptp_subnet']; + } + + $rulei = 50000; + + /* add a rule to pass all traffic from/to the firewall, + so the user cannot lock himself out of the webGUI */ + $shaperrules = "add $rulei set 4 pass all from $lanip to any\n"; $rulei++; + $shaperrules .= "add $rulei set 4 pass all from any to $lanip\n"; $rulei++; + + /* generate rules */ + if (isset($config['pfqueueing']['rule'])) + foreach ($config['pfqueueing']['rule'] as $rule) { + + /* don't include disabled rules */ + if (isset($rule['disabled'])) { + $i++; + continue; + } + + /* does the rule deal with a PPTP interface? */ + if ($rule['interface'] == "pptp") { + + if ($pptpdcfg['mode'] != "server") { + $i++; + continue; + } + + $nif = $g['n_pptp_units']; + $ispptp = true; + } else { + + if (strstr($rule['interface'], "opt")) { + if (!array_key_exists($rule['interface'], $optcfg)) { + $i++; + continue; + } + } + + $nif = 1; + $ispptp = false; + } + + if ($pptpdcfg['mode'] != "server") { + if (($rule['source']['network'] == "pptp") || + ($rule['destination']['network'] == "pptp")) { + $i++; + continue; + } + } + + if (strstr($rule['source']['network'], "opt")) { + if (!array_key_exists($rule['source']['network'], $optcfg)) { + $i++; + continue; + } + } + if (strstr($rule['destination']['network'], "opt")) { + if (!array_key_exists($rule['destination']['network'], $optcfg)) { + $i++; + continue; + } + } + + /* check for unresolvable aliases */ + if ($rule['source']['address'] && !alias_expand($rule['source']['address'])) { + $i++; + continue; + } + if ($rule['destination']['address'] && !alias_expand($rule['destination']['address'])) { + $i++; + continue; + } + + for ($iif = 0; $iif < $nif; $iif++) { + + /* pipe or queue? */ + if (isset($rule['targetpipe']) && isset($config['pfqueueing']['pipe'][$rule['targetpipe']])) { + $pipen = $rule['targetpipe'] + 1; + $line = "add $rulei set 4 pipe $pipen "; $rulei++; + } else if (isset($rule['targetqueue']) && isset($config['pfqueueing']['queue'][$rule['targetqueue']])) { + $queuen = $rule['targetqueue'] + 1; + $line = "add $rulei set 4 queue $queuen "; $rulei++; + } else { + printf("Neither existing pipe nor queue found in rule $i\n"); + break; + } + + if (isset($rule['protocol'])) { + $line .= "{$rule['protocol']} "; + } else { + $line .= "all "; + } + + /* source address */ + if (isset($rule['source']['any'])) { + $src = "any"; + } else if ($rule['source']['network']) { + + if (strstr($rule['source']['network'], "opt")) { + $src = $optcfg[$rule['source']['network']]['sa'] . "/" . + $optcfg[$rule['source']['network']]['sn']; + } else { + switch ($rule['source']['network']) { + case 'lan': + $src = "$lansa/$lansn"; + break; + case 'pptp': + $src = "$pptpsa/$pptpsn"; + break; + } + } + } else if ($rule['source']['address']) { + $src = alias_expand($rule['source']['address']); + } + + if (!$src) { + printf("No source address found in rule $i\n"); + break; + } + + if (isset($rule['source']['not'])) { + $line .= "from not $src "; + } else { + $line .= "from $src "; + } + + if (!isset($rule['protocol']) || in_array($rule['protocol'], array("tcp","udp"))) { + + if ($rule['source']['port']) { + $srcport = explode("-", $rule['source']['port']); + + if ((!$srcport[1]) || ($srcport[0] == $srcport[1])) { + $line .= "{$srcport[0]} "; + } else { + $line .= "{$srcport[0]}-{$srcport[1]} "; + } + } + } + + /* destination address */ + if (isset($rule['destination']['any'])) { + $dst = "any"; + } else if ($rule['destination']['network']) { + + if (strstr($rule['destination']['network'], "opt")) { + $dst = $optcfg[$rule['destination']['network']]['sa'] . "/" . + $optcfg[$rule['destination']['network']]['sn']; + } else { + switch ($rule['destination']['network']) { + case 'lan': + $dst = "$lansa/$lansn"; + break; + case 'pptp': + $dst = "$pptpsa/$pptpsn"; + break; + } + } + } else if ($rule['destination']['address']) { + $dst = alias_expand($rule['destination']['address']); + } + + if (!$dst) { + printf("No destination address found in rule $i\n"); + break; + } + + if (isset($rule['destination']['not'])) { + $line .= "to not $dst "; + } else { + $line .= "to $dst "; + } + + if (!isset($rule['protocol']) || in_array($rule['protocol'], array("tcp","udp"))) { + + if ($rule['destination']['port']) { + $dstport = explode("-", $rule['destination']['port']); + + if ((!$dstport[1]) || ($dstport[0] == $dstport[1])) { + $line .= "{$dstport[0]} "; + } else { + $line .= "{$dstport[0]}-{$dstport[1]} "; + } + } + } + + if ($rule['iplen']) + $line .= "iplen {$rule['iplen']} "; + + if ($rule['iptos']) + $line .= "iptos {$rule['iptos']} "; + + if ($rule['tcpflags']) + $line .= "tcpflags {$rule['tcpflags']} "; + + if ($rule['direction'] == "in") + $line .= "in "; + else if ($rule['direction'] == "out") + $line .= "out "; + + if ($ispptp) { + $line .= "via ng" . ($iif+1); + } else { + if ($rule['interface'] == "wan") + $if = $wanif; + else + $if = $config['interfaces'][$rule['interface']]['if']; + + $line .= "via {$if}"; + } + + $line .= "\n"; + $shaperrules .= $line; + } + + $i++; + } + + /* generate pipes */ + if (isset($config['pfqueueing']['pipe'])) { + $pipei = 1; + foreach ($config['pfqueueing']['pipe'] as $pipe) { + $line = "pipe $pipei config bw {$pipe['bandwidth']}Kbit/s "; + + if ($pipe['delay']) { + $line .= "delay {$pipe['delay']} "; + } + + switch ($pipe['mask']) { + case 'source': + $line .= "mask src-ip 0xffffffff "; + break; + case 'destination': + $line .= "mask dst-ip 0xffffffff "; + break; + } + + $line .= "\n"; + $shaperrules .= $line; + $pipei++; + } + } + + /* generate queues */ + if (isset($config['pfqueueing']['queue'])) { + $queuei = 1; + foreach ($config['pfqueueing']['queue'] as $queue) { + + $pipen = $queue['targetpipe'] + 1; + if (!isset($queue['targetpipe']) || !isset($config['pfqueueing']['pipe'][$queue['targetpipe']])) { + printf("Pipe $pipen for queue $queuei not found!\n"); + continue; + } + + $line = "queue $queuei config pipe {$pipen}"; + $line .= " weight {$queue['weight']}"; + + switch ($queue['mask']) { + case 'source': + $line .= " mask src-ip 0xffffffff "; + break; + case 'destination': + $line .= " mask dst-ip 0xffffffff "; + break; + } + + $line .= "\n"; + $shaperrules .= $line; + $queuei++; + } + } + + return $shaperrules; +} + +?> diff --git a/etc/inc/system.inc b/etc/inc/system.inc new file mode 100644 index 0000000..d2c0b33 --- /dev/null +++ b/etc/inc/system.inc @@ -0,0 +1,563 @@ +<?php +/* + system.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function system_resolvconf_generate($dynupdate = false) { + global $config, $g; + + $syscfg = $config['system']; + + $fd = fopen("{$g['varetc_path']}/resolv.conf", "w"); + if (!$fd) { + printf("Error: cannot open resolv.conf in system_resolvconf_generate().\n"); + return 1; + } + + $resolvconf = "domain {$syscfg['domain']}\n"; + + $havedns = false; + + if (isset($syscfg['dnsallowoverride'])) { + /* get dynamically assigned DNS servers (if any) */ + $nfd = @fopen("{$g['varetc_path']}/nameservers.conf", "r"); + if ($nfd) { + while (!feof($nfd)) { + $dnss = trim(fgets($nfd)); + if ($dnss) { + $resolvconf .= "nameserver $dnss\n"; + $havedns = true; + } + } + fclose($nfd); + } + } + if (!$havedns && is_array($syscfg['dnsserver'])) { + foreach ($syscfg['dnsserver'] as $ns) { + if ($ns) + $resolvconf .= "nameserver $ns\n"; + $havedns = true; + } + } + + fwrite($fd, $resolvconf); + fclose($fd); + + if (!$g['booting']) { + /* restart dhcpd (nameservers may have changed) */ + if (!$dynupdate) + services_dhcpd_configure(); + } + + return 0; +} + +function system_hosts_generate() { + global $config, $g; + + $syscfg = $config['system']; + $lancfg = $config['interfaces']['lan']; + $dnsmasqcfg = $config['dnsmasq']; + + if (!is_array($dnsmasqcfg['hosts'])) { + $dnsmasqcfg['hosts'] = array(); + } + $hostscfg = $dnsmasqcfg['hosts']; + + $fd = fopen("{$g['varetc_path']}/hosts", "w"); + if (!$fd) { + printf("Error: cannot open hosts file in system_hosts_generate().\n"); + return 1; + } + + $hosts = <<<EOD +127.0.0.1 localhost localhost.{$syscfg['domain']} +{$lancfg['ipaddr']} {$syscfg['hostname']}.{$syscfg['domain']} {$syscfg['hostname']} + +EOD; + + foreach ($hostscfg as $host) { + if ($host['host']) + $hosts .= "{$host['ip']} {$host['host']}.{$host['domain']} {$host['host']}\n"; + else + $hosts .= "{$host['ip']} {$host['domain']}\n"; + } + fwrite($fd, $hosts); + fclose($fd); + + return 0; +} + +function system_hostname_configure() { + global $config, $g; + + $syscfg = $config['system']; + + /* set hostname */ + return mwexec("/bin/hostname " . + escapeshellarg("{$syscfg['hostname']}.{$syscfg['domain']}")); +} + +function system_routing_configure() { + global $config, $g; + + /* clear out old routes, if necessary */ + if (file_exists("{$g['vardb_path']}/routes.db")) { + $fd = fopen("{$g['vardb_path']}/routes.db", "r"); + if (!$fd) { + printf("Error: cannot open routes DB file in system_routing_configure().\n"); + return 1; + } + while (!feof($fd)) { + $oldrt = fgets($fd); + if ($oldrt) + mwexec("/sbin/route delete " . escapeshellarg($oldrt)); + } + fclose($fd); + unlink("{$g['vardb_path']}/routes.db"); + } + + if (is_array($config['staticroutes']['route'])) { + + $fd = fopen("{$g['vardb_path']}/routes.db", "w"); + if (!$fd) { + printf("Error: cannot open routes DB file in system_routing_configure().\n"); + return 1; + } + + foreach ($config['staticroutes']['route'] as $rtent) { + mwexec("/sbin/route add " . escapeshellarg($rtent['network']) . + " " . escapeshellarg($rtent['gateway'])); + + /* record route so it can be easily removed later (if necessary) */ + fwrite($fd, $rtent['network'] . "\n"); + } + + fclose($fd); + } + + return 0; +} + +function system_routing_enable() { + global $config, $g; + + return mwexec("/sbin/sysctl net.inet.ip.forwarding=1"); +} + +function system_syslogd_start() { + global $config, $g; + + $syslogcfg = $config['syslog']; + + if ($g['booting']) + echo "Starting syslog service... "; + else + killbypid("{$g['varrun_path']}/syslog.pid"); + + if (isset($syslogcfg['enable'])) { + + /* write syslog.conf */ + $fd = fopen("{$g['varetc_path']}/syslog.conf", "w"); + if (!$fd) { + printf("Error: cannot open syslog.conf in system_syslogd_start().\n"); + return 1; + } + + $syslogconf = <<<EOD +local0.* %/var/log/filter.log +local3.* %/var/log/vpn.log +local7.* %/var/log/dhcpd.log +*.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local3.none;local7.none %/var/log/system.log +security.* %/var/log/system.log +auth.info;authpriv.info;daemon.info %/var/log/system.log +*.emerg * + +EOD; + + if (isset($syslogcfg['filter'])) { + $syslogconf .= <<<EOD +local0.* @{$syslogcfg['remoteserver']} + +EOD; + } + + if (isset($syslogcfg['vpn'])) { + $syslogconf .= <<<EOD +local3.* @{$syslogcfg['remoteserver']} + +EOD; + } + + if (isset($syslogcfg['dhcp'])) { + $syslogconf .= <<<EOD +local7.* @{$syslogcfg['remoteserver']} + +EOD; + } + + if (isset($syslogcfg['system'])) { + $syslogconf .= <<<EOD +*.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none @{$syslogcfg['remoteserver']} +security.* @{$syslogcfg['remoteserver']} +auth.info;authpriv.info;daemon.info @{$syslogcfg['remoteserver']} +*.emerg @{$syslogcfg['remoteserver']} + +EOD; + } + + fwrite($fd, $syslogconf); + fclose($fd); + + $retval = mwexec("/usr/sbin/syslogd -s -f {$g['varetc_path']}/syslog.conf"); + + } else { + $retval = mwexec("/usr/sbin/syslogd -ss"); + } + + if ($g['booting']) + echo "done\n"; + + return $retval; +} + +function system_pccard_start() { + global $config, $g; + + if ($g['booting']) + echo "Initializing PC cards... "; + + /* kill any running pccardd */ + killbypid("{$g['varrun_path']}/pccardd.pid"); + + /* fire up pccardd */ + $res = mwexec("/usr/sbin/pccardd -z -f {$g['etc_path']}/pccard.conf"); + + if ($g['booting']) { + if ($res == 0) + echo "done\n"; + else + echo "failed (probably no PC card controller present)\n"; + } + + return $res; +} + +function system_webgui_start() { + global $config, $g; + + if ($g['booting']) + echo "Starting webGUI... "; + + /* kill any running mini_httpd */ + killbypid("{$g['varrun_path']}/mini_httpd.pid"); + + /* generate password file */ + system_password_configure(); + + chdir($g['www_path']); + + /* non-standard port? */ + if ($config['system']['webgui']['port']) + $portarg = "-p {$config['system']['webgui']['port']}"; + else + $portarg = ""; + + if ($config['system']['webgui']['protocol'] == "https") { + + if ($config['system']['webgui']['certificate'] && $config['system']['webgui']['private-key']) { + $cert = base64_decode($config['system']['webgui']['certificate']); + $key = base64_decode($config['system']['webgui']['private-key']); + } else { + /* default certificate/key */ + $cert = <<<EOD +-----BEGIN CERTIFICATE----- +MIIBlDCB/gIBADANBgkqhkiG9w0BAQQFADATMREwDwYDVQQKEwhtMG4wd2FsbDAe +Fw0wMzA5MDgxNzAzNDZaFw0wNDA5MDcxNzAzNDZaMBMxETAPBgNVBAoTCG0wbjB3 +YWxsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAShszhFz+o8lsMWTGgTxs +TMPR+v4+qL5jXDyY97MLTGFK7aqQOtpIQc+TcTc4jklgOVlHoR7oBXrsi8YrbCd+ +83LPQmQoSPC0VqhfU3uYf3NzxiK8r97aPCsmWgwT2pQ6TcESTm6sF7nLprOf/zFP +C4jE2fvjkbzyVolPywBuewIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAK2D8NqQSlUs +pFCe5J9ue1LrjfGHHy4HE9zA9avgrz3Qju+1JOshEwy/1BJjZ93tQUbiRS7RwvDO +4crGG4IejjhFczzA2CIX3rd2rYM2oGpojKgm5YuuhV5lYPwAHUOLbBaLOVqlLhzw +VqjD7R2DkXUIfhJ5ZekqK5ZwzqJXta8U +-----END CERTIFICATE----- + +EOD; + + $key = <<<EOD +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQDAShszhFz+o8lsMWTGgTxsTMPR+v4+qL5jXDyY97MLTGFK7aqQ +OtpIQc+TcTc4jklgOVlHoR7oBXrsi8YrbCd+83LPQmQoSPC0VqhfU3uYf3NzxiK8 +r97aPCsmWgwT2pQ6TcESTm6sF7nLprOf/zFPC4jE2fvjkbzyVolPywBuewIDAQAB +AoGAbJJrQW9fQrggJuLMz/hwsYW2m31oyOBmf5u463YQtjRuSuxe/gj87weZuNqY +H2rXq2k2K+ehl8hgW+egASyUL3L7kCkEAsVREujKTEyhSqqIRDPWTxo9S/YA9Gvn +2ZnJvkrcKjqCO9aHX3rvJOK/ErYI6akctgI3KmgkYw5XNmECQQDuZU97RTWH9rmP +aQr57ysNXxgFsyhetOOqeYkPtIVwpOiNbfwE1zi5RGdtO4Ku3fG1lV4J2UoWJ9yD +awdoyYIHAkEAzn0xJ90IjPsHk+8SODEj5JGdHSZPNu1tgtrbjEi9sfGWg4K7XTxr +QW90pWb1bKKU1uh5FzW6OhnFfuQXt1kC7QJAPSthqY+onKqCEnoxhtAHi/bKgyvl +P+fKQwPMV2tKkgy+XwvJjrRqqZ8TqsOKVLQ+QQmCh6RpjiXMPyxHSmvqIQJBAKLR +HF1ucDuaBROkwx0DwmWMW/KMLpIFDQDNSaiIAuu4rxHrl4mhBoGGPNffI04RtILw +s+qVNs5xW8T+XaT4ztECQQDFHPnZeoPWE5z+AX/UUQIUWaDExz3XRzmIxRbOrlFi +CsF1s0TdJLi/wzNQRAL37A8vqCeVFR/ng3Xpg96Yg+8Z +-----END RSA PRIVATE KEY----- + +EOD; + } + + $fd = fopen("{$g['varetc_path']}/cert.pem", "w"); + if (!$fd) { + printf("Error: cannot open cert.pem in system_webgui_start().\n"); + return 1; + } + chmod("{$g['varetc_path']}/cert.pem", 0600); + fwrite($fd, $cert); + fwrite($fd, "\n"); + fwrite($fd, $key); + fclose($fd); + + $res = mwexec("/usr/local/sbin/mini_httpd -S -E {$g['varetc_path']}/cert.pem" . + " -c \"**.php|**.cgi\" -u root -maxproc 16 $portarg" . + " -i {$g['varrun_path']}/mini_httpd.pid"); + } else { + $res = mwexec("/usr/local/sbin/mini_httpd -c \"**.php|**.cgi\" -u root" . + " -maxproc 16 $portarg -i {$g['varrun_path']}/mini_httpd.pid"); + } + + if ($g['booting']) { + if ($res == 0) + echo "done\n"; + else + echo "failed\n"; + } + + return $res; +} + +function system_password_configure() { + global $config, $g; + + $fd = fopen("{$g['varrun_path']}/htpasswd", "w"); + if (!$fd) { + printf("Error: cannot open htpasswd in system_password_configure().\n"); + return 1; + } + + if ($config['system']['username']) + $username = $config['system']['username']; + else + $username = "admin"; + + fwrite($fd, $username . ":" . $config['system']['password'] . "\n"); + fclose($fd); + chmod("{$g['varrun_path']}/htpasswd", 0600); + + return 0; +} + +function system_timezone_configure() { + global $config, $g; + + $syscfg = $config['system']; + + if ($g['booting']) + echo "Initializing timezone... "; + + /* extract appropriate timezone file */ + $timezone = $syscfg['timezone']; + if (!$timezone) + $timezone = "Etc/UTC"; + + exec("/usr/bin/tar xzfO /usr/share/zoneinfo.tgz " . + escapeshellarg($timezone) . " > /etc/localtime"); + + if ($g['booting']) + echo "done\n"; +} + +function system_ntp_configure() { + global $config, $g; + + $syscfg = $config['system']; + + if ($g['booting']) + echo "Starting NTP client... "; + else { + killbypid("{$g['varrun_path']}/runmsntp.pid"); + killbypid("{$g['varrun_path']}/msntp.pid"); + } + + /* start ntp client if needed - needs to be forced into background */ + $updateinterval = $syscfg['time-update-interval']; + + if ($updateinterval > 0) { + if ($updateinterval < 6) + $updateinterval = 6; + + $timeservers = ""; + foreach (explode(' ', $syscfg['timeservers']) as $ts) + $timeservers .= " " . $ts; + + mwexec_bg("/usr/local/bin/runmsntp.sh " . + escapeshellarg("{$g['varrun_path']}/runmsntp.pid") . " " . + escapeshellarg("{$g['varrun_path']}/msntp.pid") . " " . + escapeshellarg($updateinterval) . " " . + escapeshellarg($timeservers)); + } + + if ($g['booting']) + echo "done\n"; +} + +function system_reboot() { + global $g; + + system_reboot_cleanup(); + + mwexec("nohup /etc/rc.reboot > /dev/null 2>&1 &"); +} + +function system_reboot_sync() { + global $g; + + system_reboot_cleanup(); + + mwexec("/etc/rc.reboot > /dev/null 2>&1"); +} + +function system_reboot_cleanup() { + captiveportal_radius_stop_all(); +} + +function system_do_shell_commands($early = 0) { + global $config, $g; + + if ($early) + $cmdn = "earlyshellcmd"; + else + $cmdn = "shellcmd"; + + if (is_array($config['system'][$cmdn])) { + + foreach ($config['system'][$cmdn] as $cmd) { + exec($cmd); + } + } +} + +function system_do_extensions() { + global $config, $g; + + if (!is_dir("{$g['etc_path']}/inc/ext")) + return; + + $dh = @opendir("{$g['etc_path']}/inc/ext"); + if ($dh) { + while (($extd = readdir($dh)) !== false) { + if (($extd === ".") || ($extd === "..")) + continue; + $rcfile = "{$g['etc_path']}/inc/ext/" . $extd . "/rc"; + if (file_exists($rcfile)) + passthru($rcfile); + } + closedir($dh); + } +} + +function system_console_configure() { + global $config, $g; + + if (isset($config['system']['disableconsolemenu'])) { + touch("{$g['varetc_path']}/disableconsole"); + } else { + unlink_if_exists("{$g['varetc_path']}/disableconsole"); + } +} + +function system_dmesg_save() { + global $g; + + exec("/sbin/dmesg", $dmesg); + + /* find last copyright line (output from previous boots may be present) */ + $lastcpline = 0; + + for ($i = 0; $i < count($dmesg); $i++) { + if (strstr($dmesg[$i], "Copyright (c) 1992-")) + $lastcpline = $i; + } + + $fd = fopen("{$g['varlog_path']}/dmesg.boot", "w"); + if (!$fd) { + printf("Error: cannot open dmesg.boot in system_dmesg_save().\n"); + return 1; + } + + for ($i = $lastcpline; $i < count($dmesg); $i++) + fwrite($fd, $dmesg[$i] . "\n"); + + fclose($fd); + + return 0; +} + +function system_set_harddisk_standby() { + global $g, $config; + + if ($g['platform'] != "generic-pc") + return; + + if (isset($config['system']['harddiskstandby'])) { + if ($g['booting']) { + echo 'Setting harddisk standby time... '; + } + + $standby = $config['system']['harddiskstandby']; + // Check for a numeric value + if (is_numeric($standby)) { + // Sync the disk(s) + mwexec('/bin/sync'); + if (!mwexec('/sbin/sysctl hw.ata.standby=' . ((int)$standby))) { + // Reinitialize ATA-drives + mwexec('/usr/local/sbin/atareinit'); + if ($g['booting']) { + echo "done\n"; + } + } else if ($g['booting']) { + echo "failed\n"; + } + } else if ($g['booting']) { + echo "failed\n"; + } + } +} + +?> diff --git a/etc/inc/util.inc b/etc/inc/util.inc new file mode 100644 index 0000000..2b3fa67 --- /dev/null +++ b/etc/inc/util.inc @@ -0,0 +1,421 @@ +<?php +/* + util.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* kill a process by pid file */ +function killbypid($pidfile) { + sigkillbypid($pidfile, "TERM"); +} + +/* sigkill a process by pid file */ +function sigkillbypid($pidfile, $sig) { + if (file_exists($pidfile)) { + mwexec("/bin/kill -s $sig `/bin/cat " . $pidfile . "`"); + } +} + +/* kill a process by name */ +function killbyname($procname) { + mwexec("/usr/bin/killall " . escapeshellarg($procname)); +} + +/* return the subnet address given a host address and a subnet bit count */ +function gen_subnet($ipaddr, $bits) { + if (!is_ipaddr($ipaddr) || !is_numeric($bits)) + return ""; + + return long2ip(ip2long($ipaddr) & gen_subnet_mask_long($bits)); +} + +/* return the highest (broadcast) address in the subnet given a host address and a subnet bit count */ +function gen_subnet_max($ipaddr, $bits) { + if (!is_ipaddr($ipaddr) || !is_numeric($bits)) + return ""; + + return long2ip(ip2long($ipaddr) | ~gen_subnet_mask_long($bits)); +} + +/* returns a subnet mask (long given a bit count) */ +function gen_subnet_mask_long($bits) { + $sm = 0; + for ($i = 0; $i < $bits; $i++) { + $sm >>= 1; + $sm |= 0x80000000; + } + return $sm; +} + +/* same as above but returns a string */ +function gen_subnet_mask($bits) { + return long2ip(gen_subnet_mask_long($bits)); +} + +function is_numericint($arg) { + return (preg_match("/[^0-9]/", $arg) ? false : true); +} + +/* returns true if $ipaddr is a valid dotted IPv4 address */ +function is_ipaddr($ipaddr) { + if (!is_string($ipaddr)) + return false; + + $ip_long = ip2long($ipaddr); + $ip_reverse = long2ip($ip_long); + + if ($ipaddr == $ip_reverse) + return true; + else + return false; +} + +/* returns true if $ipaddr is a valid dotted IPv4 address or an alias thereof */ +function is_ipaddroralias($ipaddr) { + + global $aliastable; + + if (isset($aliastable[$ipaddr]) && is_ipaddr($aliastable[$ipaddr])) + return true; + else + return is_ipaddr($ipaddr); +} + +/* returns true if $ipaddr is a valid dotted IPv4 address or any alias */ +function is_ipaddroranyalias($ipaddr) { + + global $aliastable; + + if (isset($aliastable[$ipaddr])) + return true; + else + return is_ipaddr($ipaddr); +} + +/* returns true if $subnet is a valid subnet in CIDR format */ +function is_subnet($subnet) { + if (!is_string($subnet)) + return false; + + list($hp,$np) = explode('/', $subnet); + + if (!is_ipaddr($hp)) + return false; + + if (!is_numeric($np) || ($np < 1) || ($np > 32)) + return false; + + return true; +} + +/* returns true if $subnet is a valid subnet in CIDR format or an alias thereof */ +function is_subnetoralias($subnet) { + + global $aliastable; + + if (isset($aliastable[$subnet]) && is_subnet($aliastable[$subnet])) + return true; + else + return is_subnet($subnet); +} + +/* returns true if $hostname is a valid hostname */ +function is_hostname($hostname) { + if (!is_string($hostname)) + return false; + + if (preg_match("/^[a-z0-9\-]+$/i", $hostname)) + return true; + else + return false; +} + +/* returns true if $domain is a valid domain name */ +function is_domain($domain) { + if (!is_string($domain)) + return false; + + if (preg_match("/^([a-z0-9\-]+\.?)*$/i", $domain)) + return true; + else + return false; +} + +/* returns true if $uname is a valid DynDNS username */ +function is_dyndns_username($uname) { + if (!is_string($uname)) + return false; + + if (preg_match("/[^a-z0-9\-.@_]/i", $uname)) + return false; + else + return true; +} + +/* returns true if $macaddr is a valid MAC address */ +function is_macaddr($macaddr) { + if (!is_string($macaddr)) + return false; + + $maca = explode(":", $macaddr); + if (count($maca) != 6) + return false; + + foreach ($maca as $macel) { + if (($macel === "") || (strlen($macel) > 2)) + return false; + if (preg_match("/[^0-9a-f]/i", $macel)) + return false; + } + + return true; +} + +/* returns true if $name is a valid name for an alias */ +function is_validaliasname($name) { + if (!preg_match("/[^a-zA-Z0-9]/", $name)) + return true; + else + return false; +} + +/* returns true if $port is a valid TCP/UDP port */ +function is_port($port) { + if (!is_numericint($port)) + return false; + + if (($port < 1) || ($port > 65535)) + return false; + else + return true; +} + +/* returns a list of interfaces with MAC addresses + (skips VLAN and other virtual interfaces) */ +function get_interface_list() { + + global $g; + + /* build interface list with netstat */ + exec("/usr/bin/netstat -inW -f link", $linkinfo); + array_shift($linkinfo); + + $iflist = array(); + + foreach ($linkinfo as $link) { + $alink = preg_split("/\s+/", $link); + $ifname = chop($alink[0]); + + if (substr($ifname, -1) == "*") + $ifname = substr($ifname, 0, strlen($ifname) - 1); + + if (!preg_match("/^(ppp|sl|gif|faith|lo|ng|vlan)/", $ifname)) { + $iflist[$ifname] = array(); + + $iflist[$ifname]['mac'] = chop($alink[3]); + $iflist[$ifname]['up'] = false; + + /* find out if the link on this interface is up */ + unset($ifinfo); + exec("/sbin/ifconfig {$ifname}", $ifinfo); + + foreach ($ifinfo as $ifil) { + if (preg_match("/status: (.*)$/", $ifil, $matches)) { + if ($matches[1] == "active") + $iflist[$ifname]['up'] = true; + break; + } + } + } + } + + return $iflist; +} + +/* wrapper for exec() */ +function mwexec($command) { + + global $g; + + if ($g['debug']) { + if (!$_SERVER['REMOTE_ADDR']) + echo "mwexec(): $command\n"; + passthru($command, $retval); + } else { + exec("$command > /dev/null 2>&1", $oarr, $retval); + } + + return $retval; +} + +/* wrapper for exec() in background */ +function mwexec_bg($command) { + + global $g; + + if ($g['debug']) { + if (!$_SERVER['REMOTE_ADDR']) + echo "mwexec(): $command\n"; + } + + exec("nohup $command > /dev/null 2>&1 &"); +} + +/* unlink a file, if it exists */ +function unlink_if_exists($fn) { + if (file_exists($fn)) + unlink($fn); +} + +/* make a global alias table (for faster lookups) */ +function alias_make_table() { + + global $config, $g, $aliastable; + + $aliastable = array(); + + if (is_array($config['aliases']['alias'])) { + foreach ($config['aliases']['alias'] as $alias) { + if ($alias['name']) + $aliastable[$alias['name']] = $alias['address']; + } + } +} + +/* check if an alias exists */ +function is_alias($name) { + + global $aliastable; + + return isset($aliastable[$name]); +} + +/* expand a host or network alias, if necessary */ +function alias_expand($name) { + + global $aliastable; + + if (isset($aliastable[$name])) + return $aliastable[$name]; + else if (is_ipaddr($name) || is_subnet($name)) + return $name; + else + return null; +} + +/* expand a host alias, if necessary */ +function alias_expand_host($name) { + + global $aliastable; + + if (isset($aliastable[$name]) && is_ipaddr($aliastable[$name])) + return $aliastable[$name]; + else if (is_ipaddr($name)) + return $name; + else + return null; +} + +/* expand a network alias, if necessary */ +function alias_expand_net($name) { + + global $aliastable; + + if (isset($aliastable[$name]) && is_subnet($aliastable[$name])) + return $aliastable[$name]; + else if (is_subnet($name)) + return $name; + else + return null; +} + +/* find out whether two subnets overlap */ +function check_subnets_overlap($subnet1, $bits1, $subnet2, $bits2) { + + if (!is_numeric($bits1)) + $bits1 = 32; + if (!is_numeric($bits2)) + $bits2 = 32; + + if ($bits1 < $bits2) + $relbits = $bits1; + else + $relbits = $bits2; + + $sn1 = gen_subnet_mask_long($relbits) & ip2long($subnet1); + $sn2 = gen_subnet_mask_long($relbits) & ip2long($subnet2); + + if ($sn1 == $sn2) + return true; + else + return false; +} + +/* compare two IP addresses */ +function ipcmp($a, $b) { + if (ip2long($a) < ip2long($b)) + return -1; + else if (ip2long($a) > ip2long($b)) + return 1; + else + return 0; +} + +/* return true if $addr is in $subnet, false if not */ +function ip_in_subnet($addr,$subnet) { + list($ip, $mask) = explode('/', $subnet); + $mask = 0xffffffff << (32 - $mask); + return ((ip2long($addr) & $mask) == (ip2long($ip) & $mask)); +} + +/* verify (and remove) the digital signature on a file - returns 0 if OK */ +function verify_digital_signature($fname) { + + global $g; + + return mwexec("/usr/local/bin/verifysig " . + escapeshellarg("{$g['etc_path']}/pubkey.pem") . " " . + escapeshellarg($fname)); +} + +/* obtain MAC address given an IP address by looking at the ARP table */ +function arp_get_mac_by_ip($ip) { + exec("/usr/sbin/arp -n {$ip}", $arpoutput); + + if ($arpoutput[0]) { + $arpi = explode(" ", $arpoutput[0]); + $macaddr = $arpi[3]; + if (is_macaddr($macaddr)) + return $macaddr; + else + return false; + } + + return false; +} + +?> diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc new file mode 100644 index 0000000..b73af46 --- /dev/null +++ b/etc/inc/vpn.inc @@ -0,0 +1,559 @@ +<?php +/* + vpn.inc + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* include all configuration functions */ +require_once("functions.inc"); + +function vpn_ipsec_configure($ipchg = false) { + global $config, $g; + + $curwanip = get_current_wan_address(); + + $syscfg = $config['system']; + $ipseccfg = $config['ipsec']; + $lancfg = $config['interfaces']['lan']; + $lanip = $lancfg['ipaddr']; + $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); + $lansn = $lancfg['subnet']; + + if ($g['booting']) { + if (!isset($ipseccfg['enable'])) + return 0; + + echo "Configuring IPsec VPN... "; + } else { + /* kill racoon */ + killbypid("{$g['varrun_path']}/racoon.pid"); + + /* wait for process to die */ + sleep(2); + + /* send a SIGKILL to be sure */ + sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL"); + } + + /* flush SPD and SAD */ + mwexec("/usr/sbin/setkey -FP"); + mwexec("/usr/sbin/setkey -F"); + + /* prefer old SAs only for 30 seconds, then use the new one */ + mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30"); + + if (isset($ipseccfg['enable'])) { + + if (!$curwanip) { + /* IP address not configured yet, exit */ + if ($g['booting']) + echo "done\n"; + return 0; + } + + if ((is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) || + isset($ipseccfg['mobileclients']['enable'])) { + + if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) { + + /* generate spd.conf */ + $fd = fopen("{$g['varetc_path']}/spd.conf", "w"); + if (!$fd) { + printf("Error: cannot open spd.conf in vpn_ipsec_configure().\n"); + return 1; + } + + $spdconf = ""; + + $spdconf .= "spdadd {$lansa}/{$lansn} {$lanip}/32 any -P in none;\n"; + $spdconf .= "spdadd {$lanip}/32 {$lansa}/{$lansn} any -P out none;\n"; + + foreach ($ipseccfg['tunnel'] as $tunnel) { + + if (isset($tunnel['disabled'])) + continue; + + $ep = vpn_endpoint_determine($tunnel, $curwanip); + if (!$ep) + continue; + + vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn); + + $spdconf .= "spdadd {$sa}/{$sn} " . + "{$tunnel['remote-subnet']} any -P out ipsec " . + "{$tunnel['p2']['protocol']}/tunnel/{$ep}-" . + "{$tunnel['remote-gateway']}/unique;\n"; + + $spdconf .= "spdadd {$tunnel['remote-subnet']} " . + "{$sa}/{$sn} any -P in ipsec " . + "{$tunnel['p2']['protocol']}/tunnel/{$tunnel['remote-gateway']}-" . + "{$ep}/unique;\n"; + } + + fwrite($fd, $spdconf); + fclose($fd); + + /* load SPD */ + mwexec("/usr/sbin/setkey -c < {$g['varetc_path']}/spd.conf"); + } + + /* generate racoon.conf */ + $fd = fopen("{$g['varetc_path']}/racoon.conf", "w"); + if (!$fd) { + printf("Error: cannot open racoon.conf in vpn_ipsec_configure().\n"); + return 1; + } + + $racoonconf = "path pre_shared_key \"{$g['varetc_path']}/psk.txt\";\n\n"; + + if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) + foreach ($ipseccfg['tunnel'] as $tunnel) { + + if (isset($tunnel['disabled'])) + continue; + + $ep = vpn_endpoint_determine($tunnel, $curwanip); + if (!$ep) + continue; + + vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn); + + if (isset($tunnel['p1']['myident']['myaddress'])) { + $myidentt = "address"; + $myident = $ep; + } else if (isset($tunnel['p1']['myident']['address'])) { + $myidentt = "address"; + $myident = $tunnel['p1']['myident']['address']; + } else if (isset($tunnel['p1']['myident']['fqdn'])) { + $myidentt = "fqdn"; + $myident = $tunnel['p1']['myident']['fqdn']; + } else if (isset($tunnel['p1']['myident']['ufqdn'])) { + $myidentt = "user_fqdn"; + $myident = $tunnel['p1']['myident']['ufqdn']; + } + + $racoonconf .= <<<EOD +remote {$tunnel['remote-gateway']} \{ + exchange_mode {$tunnel['p1']['mode']}; + my_identifier {$myidentt} "{$myident}"; + peers_identifier address {$tunnel['remote-gateway']}; + initial_contact on; + support_proxy on; + proposal_check obey; + + proposal \{ + encryption_algorithm {$tunnel['p1']['encryption-algorithm']}; + hash_algorithm {$tunnel['p1']['hash-algorithm']}; + authentication_method pre_shared_key; + dh_group {$tunnel['p1']['dhgroup']}; + +EOD; + if ($tunnel['p1']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; + + $racoonconf .= " }\n"; + + if ($tunnel['p1']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; + + $racoonconf .= "}\n\n"; + + $p2ealgos = join(",", $tunnel['p2']['encryption-algorithm-option']); + $p2halgos = join(",", $tunnel['p2']['hash-algorithm-option']); + + $racoonconf .= <<<EOD +sainfo address {$sa}/{$sn} any address {$tunnel['remote-subnet']} any \{ + encryption_algorithm {$p2ealgos}; + authentication_algorithm {$p2halgos}; + compression_algorithm deflate; + +EOD; + + if ($tunnel['p2']['pfsgroup']) + $racoonconf .= " pfs_group {$tunnel['p2']['pfsgroup']};\n"; + + if ($tunnel['p2']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p2']['lifetime']} secs;\n"; + + $racoonconf .= "}\n\n"; + } + + /* mobile clients? */ + if (isset($ipseccfg['mobileclients']['enable'])) { + + $tunnel = $ipseccfg['mobileclients']; + + if (isset($tunnel['p1']['myident']['myaddress'])) { + $myidentt = "address"; + $myident = $curwanip; + } else if (isset($tunnel['p1']['myident']['address'])) { + $myidentt = "address"; + $myident = $tunnel['p1']['myident']['address']; + } else if (isset($tunnel['p1']['myident']['fqdn'])) { + $myidentt = "fqdn"; + $myident = $tunnel['p1']['myident']['fqdn']; + } else if (isset($tunnel['p1']['myident']['ufqdn'])) { + $myidentt = "user_fqdn"; + $myident = $tunnel['p1']['myident']['ufqdn']; + } + + $racoonconf .= <<<EOD +remote anonymous \{ + exchange_mode {$tunnel['p1']['mode']}; + my_identifier {$myidentt} "{$myident}"; + initial_contact on; + passive on; + generate_policy on; + support_proxy on; + proposal_check obey; + + proposal \{ + encryption_algorithm {$tunnel['p1']['encryption-algorithm']}; + hash_algorithm {$tunnel['p1']['hash-algorithm']}; + authentication_method pre_shared_key; + dh_group {$tunnel['p1']['dhgroup']}; + +EOD; + if ($tunnel['p1']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; + + $racoonconf .= " }\n"; + + if ($tunnel['p1']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; + + $racoonconf .= "}\n\n"; + + $p2ealgos = join(",", $tunnel['p2']['encryption-algorithm-option']); + $p2halgos = join(",", $tunnel['p2']['hash-algorithm-option']); + + $racoonconf .= <<<EOD +sainfo anonymous \{ + encryption_algorithm {$p2ealgos}; + authentication_algorithm {$p2halgos}; + compression_algorithm deflate; + +EOD; + + if ($tunnel['p2']['pfsgroup']) + $racoonconf .= " pfs_group {$tunnel['p2']['pfsgroup']};\n"; + + if ($tunnel['p2']['lifetime']) + $racoonconf .= " lifetime time {$tunnel['p2']['lifetime']} secs;\n"; + + $racoonconf .= "}\n\n"; + } + + fwrite($fd, $racoonconf); + fclose($fd); + + /* generate psk.txt */ + $fd = fopen("{$g['varetc_path']}/psk.txt", "w"); + if (!$fd) { + printf("Error: cannot open psk.txt in vpn_ipsec_configure().\n"); + return 1; + } + + $pskconf = ""; + + if (is_array($ipseccfg['tunnel'])) { + foreach ($ipseccfg['tunnel'] as $tunnel) { + if (isset($tunnel['disabled'])) + continue; + $pskconf .= "{$tunnel['remote-gateway']} {$tunnel['p1']['pre-shared-key']}\n"; + } + } + + /* add PSKs for mobile clients */ + if (is_array($ipseccfg['mobilekey'])) { + foreach ($ipseccfg['mobilekey'] as $key) { + $pskconf .= "{$key['ident']} {$key['pre-shared-key']}\n"; + } + } + + fwrite($fd, $pskconf); + fclose($fd); + chmod("{$g['varetc_path']}/psk.txt", 0600); + + /* start racoon */ + mwexec("/usr/local/sbin/racoon -d -f {$g['varetc_path']}/racoon.conf"); + + foreach ($ipseccfg['tunnel'] as $tunnel) { + if (isset($tunnel['auto'])) { + $remotehost = substr($tunnel['remote-subnet'],0,strpos($tunnel['remote-subnet'],"/")); + $srchost = vpn_endpoint_determine($tunnel, $curwanip); + if ($srchost) + mwexec_bg("/sbin/ping -c 1 -S {$srchost} {$remotehost}"); + } + } + } + } + + if (!$g['booting']) { + /* reload the filter */ + filter_configure(); + } + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function vpn_pptpd_configure() { + global $config, $g; + + $syscfg = $config['system']; + $pptpdcfg = $config['pptpd']; + + if ($g['booting']) { + if (!$pptpdcfg['mode'] || ($pptpdcfg['mode'] == "off")) + return 0; + + echo "Configuring PPTP VPN service... "; + } else { + /* kill mpd */ + killbypid("{$g['varrun_path']}/mpd-vpn.pid"); + + /* wait for process to die */ + sleep(2); + + /* remove mpd.conf, if it exists */ + unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.conf"); + unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.links"); + unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.secret"); + } + + /* make sure mpd-vpn directory exists */ + if (!file_exists("{$g['varetc_path']}/mpd-vpn")) + mkdir("{$g['varetc_path']}/mpd-vpn"); + + switch ($pptpdcfg['mode']) { + + case 'server': + + /* write mpd.conf */ + $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.conf", "w"); + if (!$fd) { + printf("Error: cannot open mpd.conf in vpn_pptpd_configure().\n"); + return 1; + } + + $mpdconf = <<<EOD +pptpd: + +EOD; + + for ($i = 0; $i < $g['n_pptp_units']; $i++) { + $mpdconf .= " load pt{$i}\n"; + } + + for ($i = 0; $i < $g['n_pptp_units']; $i++) { + + $clientip = long2ip(ip2long($pptpdcfg['remoteip']) + $i); + $ngif = "ng" . ($i+1); + + $mpdconf .= <<<EOD + +pt{$i}: + new -i {$ngif} pt{$i} pt{$i} + set ipcp ranges {$pptpdcfg['localip']}/32 {$clientip}/32 + load pts + +EOD; + } + + $mpdconf .= <<<EOD + +pts: + set iface disable on-demand + set iface enable proxy-arp + set iface enable tcpmssfix + set iface idle 1800 + set iface up-script /usr/local/sbin/vpn-linkup + set iface down-script /usr/local/sbin/vpn-linkdown + set bundle enable multilink + set bundle enable crypt-reqd + set link yes acfcomp protocomp + set link no pap chap + set link enable chap-msv2 + set link mtu 1460 + set link keep-alive 10 60 + set ipcp yes vjcomp + set bundle enable compression + set ccp yes mppc + set ccp yes mpp-e128 + set ccp yes mpp-stateless + +EOD; + + if (!isset($pptpdcfg['req128'])) { + $mpdconf .= <<<EOD + set ccp yes mpp-e40 + set ccp yes mpp-e56 + +EOD; + } + + if (isset($config['dnsmasq']['enable'])) { + $mpdconf .= " set ipcp dns " . $config['interfaces']['lan']['ipaddr']; + if ($syscfg['dnsserver'][0]) + $mpdconf .= " " . $syscfg['dnsserver'][0]; + $mpdconf .= "\n"; + } else if (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) { + $mpdconf .= " set ipcp dns " . join(" ", $syscfg['dnsserver']) . "\n"; + } + + if (isset($pptpdcfg['radius']['enable'])) { + $mpdconf .= <<<EOD + set radius server {$pptpdcfg['radius']['server']} "{$pptpdcfg['radius']['secret']}" + set radius retries 3 + set radius timeout 10 + set bundle enable radius-auth + set bundle disable radius-fallback + +EOD; + + if (isset($pptpdcfg['radius']['accounting'])) { + $mpdconf .= <<<EOD + set bundle enable radius-acct + +EOD; + } + } + + fwrite($fd, $mpdconf); + fclose($fd); + + /* write mpd.links */ + $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.links", "w"); + if (!$fd) { + printf("Error: cannot open mpd.links in vpn_pptpd_configure().\n"); + return 1; + } + + $mpdlinks = ""; + + for ($i = 0; $i < $g['n_pptp_units']; $i++) { + $mpdlinks .= <<<EOD + +pt{$i}: + set link type pptp + set pptp enable incoming + set pptp disable originate + set pptp disable windowing + set pptp self 127.0.0.1 + +EOD; + } + + fwrite($fd, $mpdlinks); + fclose($fd); + + /* write mpd.secret */ + $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.secret", "w"); + if (!$fd) { + printf("Error: cannot open mpd.secret in vpn_pptpd_configure().\n"); + return 1; + } + + $mpdsecret = ""; + + if (is_array($pptpdcfg['user'])) { + foreach ($pptpdcfg['user'] as $user) + $mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n"; + } + + fwrite($fd, $mpdsecret); + fclose($fd); + chmod("{$g['varetc_path']}/mpd-vpn/mpd.secret", 0600); + + /* fire up mpd */ + mwexec("/usr/local/sbin/mpd -b -d {$g['varetc_path']}/mpd-vpn -p {$g['varrun_path']}/mpd-vpn.pid pptpd"); + + break; + + case 'redir': + break; + } + + if (!$g['booting']) { + /* reload the filter */ + filter_configure(); + } + + if ($g['booting']) + echo "done\n"; + + return 0; +} + +function vpn_localnet_determine($adr, &$sa, &$sn) { + global $config, $g; + + if (isset($adr)) { + if ($adr['network']) { + switch ($adr['network']) { + case 'lan': + $sn = $config['interfaces']['lan']['subnet']; + $sa = gen_subnet($config['interfaces']['lan']['ipaddr'], $sn); + break; + } + } else if ($adr['address']) { + list($sa,$sn) = explode("/", $adr['address']); + if (is_null($sn)) + $sn = 32; + } + } else { + $sn = $config['interfaces']['lan']['subnet']; + $sa = gen_subnet($config['interfaces']['lan']['ipaddr'], $sn); + } +} + +function vpn_endpoint_determine($tunnel, $curwanip) { + + global $g, $config; + + if ((!$tunnel['interface']) || ($tunnel['interface'] == "wan")) { + if ($curwanip) + return $curwanip; + else + return null; + } else if ($tunnel['interface'] == "lan") { + return $config['interfaces']['lan']['ipaddr']; + } else { + $oc = $config['interfaces'][$tunnel['interface']]; + + if (isset($oc['enable']) && $oc['if']) { + return $oc['ipaddr']; + } + } + + return null; +} + +?> diff --git a/etc/inc/xmlparse.inc b/etc/inc/xmlparse.inc new file mode 100644 index 0000000..1fdadac --- /dev/null +++ b/etc/inc/xmlparse.inc @@ -0,0 +1,205 @@ +<?php +/* + xmlparse.inc + functions to parse/dump configuration files in XML format + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* tags that are always to be handled as lists */ +$listtags = explode(" ", "rule user key subqueue dnsserver winsserver " . + "encryption-algorithm-option hash-algorithm-option hosts tunnel onetoone " . + "staticmap route alias pipe queue shellcmd earlyshellcmd mobilekey " . + "servernat proxyarpnet passthrumac allowedip wolentry vlan"); + +function startElement($parser, $name, $attrs) { + global $depth, $curpath, $config, $havedata, $listtags; + + array_push($curpath, strtolower($name)); + + $ptr =& $config; + foreach ($curpath as $path) { + $ptr =& $ptr[$path]; + } + + /* is it an element that belongs to a list? */ + if (in_array(strtolower($name), $listtags)) { + + /* is there an array already? */ + if (!is_array($ptr)) { + /* make an array */ + $ptr = array(); + } + + array_push($curpath, count($ptr)); + + } else if (isset($ptr)) { + /* multiple entries not allowed for this element, bail out */ + die(sprintf("XML error: %s at line %d cannot occur more than once\n", + $name, + xml_get_current_line_number($parser))); + } + + $depth++; + $havedata = $depth; +} + +function endElement($parser, $name) { + global $depth, $curpath, $config, $havedata, $listtags; + + if ($havedata == $depth) { + $ptr =& $config; + foreach ($curpath as $path) { + $ptr =& $ptr[$path]; + } + $ptr = ""; + } + + array_pop($curpath); + + if (in_array(strtolower($name), $listtags)) + array_pop($curpath); + + $depth--; +} + +function cData($parser, $data) { + global $depth, $curpath, $config, $havedata; + + $data = trim($data, "\t\n\r"); + + if ($data != "") { + $ptr =& $config; + foreach ($curpath as $path) { + $ptr =& $ptr[$path]; + } + + if (is_string($ptr)) { + $ptr .= $data; + } else { + if (trim($data, " ") != "") { + $ptr = $data; + $havedata++; + } + } + } +} + +function parse_xml_config($cffile, $rootobj) { + + global $depth, $curpath, $config, $havedata, $listtags; + + $config = array(); + $curpath = array(); + $depth = 0; + $havedata = 0; + + $xml_parser = xml_parser_create(); + + xml_set_element_handler($xml_parser, "startElement", "endElement"); + xml_set_character_data_handler($xml_parser, "cdata"); + + if (!($fp = fopen($cffile, "r"))) { + die("Error: could not open XML input\n"); + } + + while ($data = fread($fp, 4096)) { + if (!xml_parse($xml_parser, $data, feof($fp))) { + die(sprintf("XML error: %s at line %d\n", + xml_error_string(xml_get_error_code($xml_parser)), + xml_get_current_line_number($xml_parser))); + } + } + xml_parser_free($xml_parser); + + if (!$config[$rootobj]) { + die("XML error: no $rootobj object found!\n"); + } + + return $config[$rootobj]; +} + +function dump_xml_config_sub($arr, $indent) { + + global $listtags; + + $xmlconfig = ""; + + foreach ($arr as $ent => $val) { + if (is_array($val)) { + /* is it just a list of multiple values? */ + if (in_array(strtolower($ent), $listtags)) { + foreach ($val as $cval) { + if (is_array($cval)) { + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent>\n"; + $xmlconfig .= dump_xml_config_sub($cval, $indent + 1); + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "</$ent>\n"; + } else { + $xmlconfig .= str_repeat("\t", $indent); + if ((is_bool($cval) && ($cval == true)) || + ($cval === "")) + $xmlconfig .= "<$ent/>\n"; + else if (!is_bool($cval)) + $xmlconfig .= "<$ent>" . htmlspecialchars($cval) . "</$ent>\n"; + } + } + } else { + /* it's an array */ + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent>\n"; + $xmlconfig .= dump_xml_config_sub($val, $indent + 1); + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "</$ent>\n"; + } + } else { + if ((is_bool($val) && ($val == true)) || ($val === "")) { + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent/>\n"; + } else if (!is_bool($val)) { + $xmlconfig .= str_repeat("\t", $indent); + $xmlconfig .= "<$ent>" . htmlspecialchars($val) . "</$ent>\n"; + } + } + } + + return $xmlconfig; +} + +function dump_xml_config($arr, $rootobj) { + + $xmlconfig = "<?xml version=\"1.0\"?" . ">\n"; + $xmlconfig .= "<$rootobj>\n"; + + $xmlconfig .= dump_xml_config_sub($arr, 1); + + $xmlconfig .= "</$rootobj>\n"; + + return $xmlconfig; +} + +?> diff --git a/etc/login.conf b/etc/login.conf new file mode 100644 index 0000000..fc6b37c --- /dev/null +++ b/etc/login.conf @@ -0,0 +1,316 @@ +# login.conf - login class capabilities database. +# +# Remember to rebuild the database after each change to this file: +# +# cap_mkdb /etc/login.conf +# +# This file controls resource limits, accounting limits and +# default user environment settings. +# +# $FreeBSD: src/etc/login.conf,v 1.34.2.6 2002/07/02 20:06:18 dillon Exp $ +# + +# Default settings effectively disable resource limits, see the +# examples below for a starting point to enable them. + +# defaults +# These settings are used by login(1) by default for classless users +# Note that entries like "cputime" set both "cputime-cur" and "cputime-max" + +default:\ + :passwd_format=md5:\ + :copyright=/etc/COPYRIGHT:\ + :welcome=/etc/motd:\ + :setenv=MAIL=/var/mail/$,BLOCKSIZE=K,FTP_PASSIVE_MODE=YES:\ + :path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin /usr/X11R6/bin ~/bin:\ + :nologin=/var/run/nologin:\ + :cputime=unlimited:\ + :datasize=unlimited:\ + :stacksize=unlimited:\ + :memorylocked=unlimited:\ + :memoryuse=unlimited:\ + :filesize=unlimited:\ + :coredumpsize=unlimited:\ + :openfiles=unlimited:\ + :maxproc=unlimited:\ + :sbsize=unlimited:\ + :vmemoryuse=unlimited:\ + :priority=0:\ + :ignoretime@:\ + :umask=022: + + +# +# A collection of common class names - forward them all to 'default' +# (login would normally do this anyway, but having a class name +# here suppresses the diagnostic) +# +standard:\ + :tc=default: +xuser:\ + :tc=default: +staff:\ + :tc=default: +daemon:\ + :tc=default: +news:\ + :tc=default: +dialer:\ + :tc=default: + +# +# Root can always login +# +# N.B. login_getpwclass(3) will use this entry for the root account, +# in preference to 'default'. +root:\ + :ignorenologin:\ + :tc=default: + +# +# Russian Users Accounts. Setup proper environment variables. +# +russian|Russian Users Accounts:\ + :charset=KOI8-R:\ + :lang=ru_RU.KOI8-R:\ + :tc=default: + + +###################################################################### +###################################################################### +## +## Example entries +## +###################################################################### +###################################################################### + +## Example defaults +## These settings are used by login(1) by default for classless users +## Note that entries like "cputime" set both "cputime-cur" and "cputime-max" +# +#default:\ +# :cputime=infinity:\ +# :datasize-cur=22M:\ +# :stacksize-cur=8M:\ +# :memorylocked-cur=10M:\ +# :memoryuse-cur=30M:\ +# :filesize=infinity:\ +# :coredumpsize=infinity:\ +# :maxproc-cur=64:\ +# :openfiles-cur=64:\ +# :priority=0:\ +# :requirehome@:\ +# :umask=022:\ +# :tc=auth-defaults: +# +# +## +## standard - standard user defaults +## +#standard:\ +# :copyright=/etc/COPYRIGHT:\ +# :welcome=/etc/motd:\ +# :setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\ +# :path=~/bin /bin /usr/bin /usr/local/bin:\ +# :manpath=/usr/share/man /usr/local/man:\ +# :nologin=/var/run/nologin:\ +# :cputime=1h30m:\ +# :datasize=8M:\ +# :vmemoryuse=100M:\ +# :stacksize=2M:\ +# :memorylocked=4M:\ +# :memoryuse=8M:\ +# :filesize=8M:\ +# :coredumpsize=8M:\ +# :openfiles=24:\ +# :maxproc=32:\ +# :priority=0:\ +# :requirehome:\ +# :passwordtime=90d:\ +# :umask=002:\ +# :ignoretime@:\ +# :tc=default: +# +# +## +## users of X (needs more resources!) +## +#xuser:\ +# :manpath=/usr/share/man /usr/X11R6/man /usr/local/man:\ +# :cputime=4h:\ +# :datasize=12M:\ +# :vmemoryuse=infinity:\ +# :stacksize=4M:\ +# :filesize=8M:\ +# :memoryuse=16M:\ +# :openfiles=32:\ +# :maxproc=48:\ +# :tc=standard: +# +# +## +## Staff users - few restrictions and allow login anytime +## +#staff:\ +# :ignorenologin:\ +# :ignoretime:\ +# :requirehome@:\ +# :accounted@:\ +# :path=~/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin:\ +# :umask=022:\ +# :tc=standard: +# +# +## +## root - fallback for root logins +## +#root:\ +# :path=~/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin:\ +# :cputime=infinity:\ +# :datasize=infinity:\ +# :stacksize=infinity:\ +# :memorylocked=infinity:\ +# :memoryuse=infinity:\ +# :filesize=infinity:\ +# :coredumpsize=infinity:\ +# :openfiles=infinity:\ +# :maxproc=infinity:\ +# :memoryuse-cur=32M:\ +# :maxproc-cur=64:\ +# :openfiles-cur=1024:\ +# :priority=0:\ +# :requirehome@:\ +# :umask=022:\ +# :tc=auth-root-defaults: +# +# +## +## Settings used by /etc/rc +## +#daemon:\ +# :coredumpsize@:\ +# :coredumpsize-cur=0:\ +# :datasize=infinity:\ +# :datasize-cur@:\ +# :maxproc=512:\ +# :maxproc-cur@:\ +# :memoryuse-cur=64M:\ +# :memorylocked-cur=64M:\ +# :openfiles=1024:\ +# :openfiles-cur@:\ +# :stacksize=16M:\ +# :stacksize-cur@:\ +# :tc=default: +# +# +## +## Settings used by news subsystem +## +#news:\ +# :path=/usr/local/news/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin:\ +# :cputime=infinity:\ +# :filesize=128M:\ +# :datasize-cur=64M:\ +# :stacksize-cur=32M:\ +# :coredumpsize-cur=0:\ +# :maxmemorysize-cur=128M:\ +# :memorylocked=32M:\ +# :maxproc=128:\ +# :openfiles=256:\ +# :tc=default: +# +# +## +## The dialer class should be used for a dialup PPP/SLIP accounts +## Welcome messages/news suppressed +## +#dialer:\ +# :hushlogin:\ +# :requirehome@:\ +# :cputime=unlimited:\ +# :filesize=2M:\ +# :datasize=2M:\ +# :stacksize=4M:\ +# :coredumpsize=0:\ +# :memoryuse=4M:\ +# :memorylocked=1M:\ +# :maxproc=16:\ +# :openfiles=32:\ +# :tc=standard: +# +# +## +## Site full-time 24/7 PPP/SLIP connections +## - no time accounting, restricted to access via dialin lines +## +#site:\ +# :ignoretime:\ +# :passwordtime@:\ +# :refreshtime@:\ +# :refreshperiod@:\ +# :sessionlimit@:\ +# :autodelete@:\ +# :expireperiod@:\ +# :graceexpire@:\ +# :gracetime@:\ +# :warnexpire@:\ +# :warnpassword@:\ +# :idletime@:\ +# :sessiontime@:\ +# :daytime@:\ +# :weektime@:\ +# :monthtime@:\ +# :warntime@:\ +# :accounted@:\ +# :tc=dialer:\ +# :tc=staff: +# +# +## +## Example standard accounting entries for subscriber levels +## +# +#subscriber|Subscribers:\ +# :accounted:\ +# :refreshtime=180d:\ +# :refreshperiod@:\ +# :sessionlimit@:\ +# :autodelete=30d:\ +# :expireperiod=180d:\ +# :graceexpire=7d:\ +# :gracetime=10m:\ +# :warnexpire=7d:\ +# :warnpassword=7d:\ +# :idletime=30m:\ +# :sessiontime=4h:\ +# :daytime=6h:\ +# :weektime=40h:\ +# :monthtime=120h:\ +# :warntime=4h:\ +# :tc=standard: +# +# +## +## Subscriber accounts. These accounts have their login times +## accounted and have access limits applied. +## +#subppp|PPP Subscriber Accounts:\ +# :tc=dialer:\ +# :tc=subscriber: +# +# +#subslip|SLIP Subscriber Accounts:\ +# :tc=dialer:\ +# :tc=subscriber: +# +# +#subshell|Shell Subscriber Accounts:\ +# :tc=subscriber: +# +## +## If you want some of the accounts to use traditional UNIX DES based +## password hashes. +## +#des_users:\ +# :passwd_format=des:\ +# :tc=default: diff --git a/etc/master.passwd b/etc/master.passwd new file mode 100644 index 0000000..88b0dd1 --- /dev/null +++ b/etc/master.passwd @@ -0,0 +1,26 @@ +# $FreeBSD: src/etc/master.passwd,v 1.39 2004/08/01 21:33:47 markm Exp $ +# +root::0:0::0:0:Charlie &:/root:/etc/rc.initial +toor:*:0:0::0:0:Bourne-again Superuser:/root: +daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin +operator:*:2:5::0:0:System &:/:/usr/sbin/nologin +bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin +tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin +kmem:*:5:65533::0:0:KMem Sandbox:/:/usr/sbin/nologin +games:*:7:13::0:0:Games pseudo-user:/usr/games:/usr/sbin/nologin +news:*:8:8::0:0:News Subsystem:/:/usr/sbin/nologin +man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/usr/sbin/nologin +sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin +smmsp:*:25:25::0:0:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin +mailnull:*:26:26::0:0:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin +bind:*:53:53::0:0:Bind Sandbox:/:/usr/sbin/nologin +proxy:*:62:62::0:0:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin +_pflogd:*:64:64::0:0:pflogd privsep user:/var/empty:/usr/sbin/nologin +uucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico +pop:*:68:6::0:0:Post Office Owner:/nonexistent:/usr/sbin/nologin +www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin +nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin +distcc:*:1001:1001::0:0:Distcc:/home/distcc:/sbin/nologin +dhcpd:*:1002:1002::0:0:DHCP Daemon:/nonexistent:/sbin/nologin +admin:*:101:101::0:0:Admin User:/home/admin:/etc/rc.initial + diff --git a/etc/networks b/etc/networks new file mode 100644 index 0000000..92982b5 --- /dev/null +++ b/etc/networks @@ -0,0 +1,17 @@ +# $FreeBSD: src/etc/networks,v 1.3 1999/08/27 23:23:42 peter Exp $ +# @(#)networks 5.1 (Berkeley) 6/30/90 +# +# Your Local Networks Database +# +your-net 127 # your comment +your-netmask 255.255.255 # subnet mask for your-net + +# +# Your subnets +# +subnet1 127.0.1 alias1 # comment 1 +subnet2 127.0.2 alias2 # comment 2 + +# +# Internet networks (from nic.ddn.mil) +# diff --git a/etc/pamd.conf b/etc/pamd.conf new file mode 100644 index 0000000..78df63d --- /dev/null +++ b/etc/pamd.conf @@ -0,0 +1,55 @@ +# Configuration file for Pluggable Authentication Modules (PAM). +# +# This file controls the authentication methods that login and other +# utilities use. See pam(8) for a description of its format. +# +# $FreeBSD: src/etc/pam.conf,v 1.6.2.18 2003/02/15 17:20:27 des Exp $ +# +# service-name module-type control-flag module-path arguments +# +# module-type: +# auth: prompt for a password to authenticate that the user is +# who they say they are, and set any credentials. +# account: non-authentication based authorization, based on time, +# resources, etc. +# session: housekeeping before and/or after login. +# password: update authentication tokens. +# +# control-flag: How libpam handles success or failure of the module. +# required: success is required, and on failure all remaining +# modules are run. +# requisite: success is required, and on failure no remaining +# modules are run. +# sufficient: success is sufficient, and if no previous required +# module failed, no remaining modules are run. +# optional: ignored unless the other modules return PAM_IGNORE. +# +# arguments: +# Passed to the module; module-specific plus some generic ones: +# debug: syslog debug info. +# no_warn: return no warning messages to the application. +# use_first_pass: try authentication using password from the +# preceding auth module. +# try_first_pass: first try authentication using password from +# the preceding auth module, and if that fails +# prompt for a new password. +# use_mapped_pass: convert cleartext password to a crypto key. +# expose_account: allow printing more info about the user when +# prompting. +# +# Each final entry must say "required" -- otherwise, things don't +# work quite right. If you delete a final entry, be sure to change +# "sufficient" to "required" in the entry before it. +# +## OpenSSH with PAM support requires similar modules. The session one is +## a bit strange, though... +sshd auth sufficient pam_skey.so +sshd auth sufficient pam_opie.so no_fake_prompts +#sshd auth requisite pam_opieaccess.so +#sshd auth sufficient pam_kerberosIV.so try_first_pass +#sshd auth sufficient pam_krb5.so try_first_pass +sshd auth required pam_unix.so try_first_pass +sshd account required pam_unix.so +sshd password required pam_permit.so +sshd session required pam_permit.so + diff --git a/etc/passwd b/etc/passwd new file mode 100644 index 0000000..86c9b58 --- /dev/null +++ b/etc/passwd @@ -0,0 +1,10 @@ +root:*:0:0:Charlie &:/root:/etc/rc.initial +toor:*:0:0:Bourne-again Superuser:/root: +daemon:*:1:1:Owner of many system processes:/root:/sbin/nologin +operator:*:2:5:System &:/:/sbin/nologin +bin:*:3:7:Binaries Commands and Source:/:/sbin/nologin +tty:*:4:65533:Tty Sandbox:/:/sbin/nologin +kmem:*:5:65533:KMem Sandbox:/:/sbin/nologin +www:*:80:80:World Wide Web Owner:/nonexistent:/sbin/nologin +nobody:*:65534:65534:Unprivileged user:/nonexistent:/sbin/nologin +admin:*:101:101:Admin Account:/home/admin:/bin/sh diff --git a/etc/pccard.conf b/etc/pccard.conf new file mode 100644 index 0000000..75fa24a --- /dev/null +++ b/etc/pccard.conf @@ -0,0 +1,435 @@ + +# Generally available IO ports +io 0x240-0x360 +# on i386 IRQs can be any of 3 4 5 7 9 10 11 12 14 15 +# on pc98 IRQs can be any of 3 5 6 9 10 11 12 13 +# but *MUST* *NOT* be used by anything else, unless you are using current +# and a PCI cardbus bridge that allows sharing. Even then, the rules +# for interrupt sharing can be tricky. +# Generally available IRQs (Built-in sound-card owners remove 5) +irq 3 5 10 11 15 +# Available memory slots +memory 0xd4000 96k +# Debug level, so you know how to get more info for maintainers. Put it +# in /etc/pccard.conf +#debuglevel 4 + +########## an ########## + +# Aironet PC4500 2Mbps 802.11 wireless NIC +card "Aironet" "PC4500" + config 0x5 "an0" ? + config 0x5 "an1" ? + config 0x5 "an2" ? + +# Aironet PC4800 11Mbps 802.11 wireless NIC +card "Aironet" "PC4800" + config 0x5 "an0" ? + config 0x5 "an1" ? + config 0x5 "an2" ? + +# Aironet 340 Series 11Mbps 802.11 wireless NIC +card "Cisco Systems" "340 Series Wireless LAN Adapter" + config auto "an0" ? + config auto "an1" ? + config auto "an2" ? + +# Aironet 350 Series 11Mbps 802.11 wireless NIC +card "Cisco Systems" "350 Series Wireless LAN Adapter" + config auto "an0" ? + config auto "an1" ? + config auto "an2" ? + +# Xircom sells a rebaded unit +card "Xircom" "Wireless Ethernet Adapter" + config 0x5 "an0" ? + config 0x5 "an1" ? + config 0x5 "an2" ? + +########## wi ########## + +# OEM ID 0x5 unlabelled PRISM2.5 card +card " " "IEEE 802.11 Wireless LAN/PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# 3com 3crwe737A AirConnect Wireless LAN PC Card +card "3Com" "3CRWE737A AirConnect Wireless LAN PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Accton airDirect WN3301 +card "Accton" "IEEE802.11 PC Card Adapter" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Actiontec PRISM wireless +card "ACTIONTEC" "PRISM Wireless LAN PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Addtron AWP-100 +card "Addtron" "AWP-100 Wireless PCMCIA" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# ADLINK340APC +card "ADTEC" "ADLINK/340C" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Home Wireless Networks +card "AirWay" "802.11 Adapter (PCMCIA)" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Allied Telesis WR211PCM +card "Allied Telesis K.K." "WR211PCM" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Avaya Wireless PC Card +card "Avaya Communication" "Avaya Wireless PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Belkin wireless card +card "Belkin" "11Mbps Wireless Notebook Network Adapter" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# BreezeNET +card "BreezeNET" "PC-DS.11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Buffalo WLI-CF-S11G +card "BUFFALO" "WLI-CF-S11G" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Melco Airconnect 3.3V version +card "BUFFALO" "WLI-PCM-S11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Melco Airconnect (128bit WEP) +card "BUFFALO" "WLI-PCM-L11G" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Cabletron RoamAbout, WaveLAN/IEEE clone +card "Cabletron" "RoamAbout 802.11 DS" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# Compaq WL100 +card "Compaq" "WL100_11Mbps_Wireless_PC_Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Compaq WL110 +card "Compaq" "Compaq WL110 PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Compaq WL200 +card "Compaq" "WL200_11Mbps_Wireless_PCI_Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Compaq WL200 (might be wrong) +card "Compaq" "Compaq WL200_11Mbps_Wireless_PCI_Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Corega KK Wireless LAN PCC-11 +card "corega K.K." "Wireless LAN PCC-11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Corega KK Wireless LAN PCCA-11 +card "corega K.K." "Wireless LAN PCCA-11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Corega KK Wireless LAN PCCB-11 +card "corega_K.K." "Wireless_LAN_PCCB-11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Corega KK Wireless LAN PCCL-11 +card "corega" "WL PCCL-11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# D Link DWL-650 11Mbps WLAN Card +card "D" "Link DWL-650 11Mbps WLAN Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# DLink Air DWL-660 Wireless PC Card +card "D-Link" "D-Link Air DWL-660 Wireless PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Dell TrueMobile (OEMed Lucent WaveLAN/IEEE) +card "Dell" "TrueMobile 1150 Series PC Card" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# ELECOM Air@Hawk/LD-WL11/PCC (0.7.5) +card "ELECOM" "Air@Hark/LD-WL11/PCC" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# ELECOM Air@Hawk/LD-WL11/PCC (0.7.6 and later) +card "ELECOM" "Air@Hawk/LD-WL11/PCC" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# ELSA Air Lancer +card "ELSA" "AirLancer MC-11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Fujitsu Siemens CONNECT2AIR WLAN C-1100 CF-Card +card "Fujitsu Siemens Computers" "CONNECT2AIR WLAN C-1100 CF-Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# PLANEX GeoWave/GW-NS11S +card "Geowave" "GW-NS11S" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Linksys Instant Wireless WPC11 +card "/Instant Wireless */" " Network PC CARD" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Intel PRO/Wireless 2011 LAN PC Card +card "Intel" "PRO/Wireless 2011 LAN PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# ICOM SL-1100 +card "ICOM" "SL-1100" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# OEM PRISM cards +card "INTERSIL" "HFA384x/IEEE" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# IO Data WN-B11/PCM +card "IO DATA" "WNB11PCM" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# IBM's rebadged Lucent WaveLAN/IEEE. The FCC IDs are identical to +# those for the Lucent card, so presumably everything else is as well. +card "IBM Corporation" "IBM High Rate Wireless LAN PC Card" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# Lucent WaveLAN/IEEE +card "Lucent Technologies" "WaveLAN/IEEE" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# Melco Airconnect +card "MELCO" "WLI-PCM-L11" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# nanospeed card of some flavor. +card "NANOSPEED" "HFA384x/IEEE" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# NCR WaveLAN/IEEE +card "NCR" "WaveLAN/IEEE" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# NEC Wireless Card CMZ-RT-WP +card "NEC" "Wireless Card CMZ-RT-WP" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# NEC WL11C (PC-WL/11C) +card "NEC Aterm" "WL11C (PC-WL/11C)" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# NEC Corporation PK-WL001 +card "NEC Corporation" "Wireless PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Netgear MA401 +card "NETGEAR MA401 Wireless PC" "Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Netgear MA401RA +card "NETGEAR MA401RA Wireless PC" "Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Nortel eMobility +card "Nortel Networks" "emobility 802.11 Wireless LAN PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Generic PRISM2.5 card +card "PCMCIA" "11M WLAN Card v2.5" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# PLANEX GeoWave/GW-NS110 +card "PLANEX" "GeoWave/GW-NS110" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# PLANEX GW-NS11H +card "PLANEX" "GW-NS11H Wireless LAN PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Proxim Harmony +card "PROXIM" "Harmony 802.11b/LAN PC CARD" + config 0x1 "wi0" ? + config 0x1 "wi1" ? + config 0x1 "wi2" ? + +# Proxim RangeLAN-DS (OEM of Zcommax - Prism2 card) +card "PROXIM" "RangeLAN-DS/LAN PC CARD" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# SAMSUNG SWL-2000P PCI Card +card "SAMSUNG" "11Mbps WLAN PCI Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# SMC's SMC2632W (also matches the 3.3V SMC2602W) +card "SMC" "SMC2632W" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Sony PCWA-C100 WaveLAN +card "Sony Corporation" "PCWA-C100" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# German Telekom T-Sinus 130card, unknown original manufactor +card "T-Sinus" "130card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# TDK LAK-CD011WL +card "TDK" "LAK-CD011WL for Wireless LAN" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Linksys Instant Wireless WPC11 v2.5 +card "The Linksys Group, Inc." "Instant Wireless Network PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Toshibas wireless lan card +card "TOSHIBA" "Wireless LAN Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# U.S. Robotics Wireless Card 2410 +card "U.S. Robotics" "IEEE 802.11b PC-CARD" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Taiwanese Blue Concentric Circle CF Wireless LAN Model WL-379F +# This is a card sold in Taiwan. +card "Wireless LAN" "11Mbps PC Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# Wisecom WS-WP100W +card "OEM" "PRISM25 IEEE 802.11 PC-Card" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# YIS YWL-11B +card "YIS Corp." "YWL-11b" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? + +# ZoomAir 802.11 +card "ZoomAir 11Mbps High" "Rate wireless Networking" + config auto "wi0" ? + config auto "wi1" ? + config auto "wi2" ? diff --git a/etc/platform b/etc/platform new file mode 100644 index 0000000..f964569 --- /dev/null +++ b/etc/platform @@ -0,0 +1 @@ +net45xx diff --git a/etc/protocols b/etc/protocols new file mode 100644 index 0000000..20e2741 --- /dev/null +++ b/etc/protocols @@ -0,0 +1,146 @@ +# +# Internet protocols +# +# $FreeBSD: src/etc/protocols,v 1.13.2.3 2002/02/27 03:39:00 dd Exp $ +# from: @(#)protocols 5.1 (Berkeley) 4/17/89 +# +# See also http://www.iana.org/assignments/protocol-numbers +# +ip 0 IP # internet protocol, pseudo protocol number +#hopopt 0 HOPOPT # hop-by-hop options for ipv6 +icmp 1 ICMP # internet control message protocol +igmp 2 IGMP # internet group management protocol +ggp 3 GGP # gateway-gateway protocol +ipencap 4 IP-ENCAP # IP encapsulated in IP (officially ``IP'') +st2 5 ST2 # ST2 datagram mode (RFC 1819) +tcp 6 TCP # transmission control protocol +cbt 7 CBT # CBT, Tony Ballardie <A.Ballardie@cs.ucl.ac.uk> +egp 8 EGP # exterior gateway protocol +igp 9 IGP # any private interior gateway (Cisco: for IGRP) +bbn-rcc 10 BBN-RCC-MON # BBN RCC Monitoring +nvp 11 NVP-II # Network Voice Protocol +pup 12 PUP # PARC universal packet protocol +argus 13 ARGUS # ARGUS +emcon 14 EMCON # EMCON +xnet 15 XNET # Cross Net Debugger +chaos 16 CHAOS # Chaos +udp 17 UDP # user datagram protocol +mux 18 MUX # Multiplexing protocol +dcn 19 DCN-MEAS # DCN Measurement Subsystems +hmp 20 HMP # host monitoring protocol +prm 21 PRM # packet radio measurement protocol +xns-idp 22 XNS-IDP # Xerox NS IDP +trunk-1 23 TRUNK-1 # Trunk-1 +trunk-2 24 TRUNK-2 # Trunk-2 +leaf-1 25 LEAF-1 # Leaf-1 +leaf-2 26 LEAF-2 # Leaf-2 +rdp 27 RDP # "reliable datagram" protocol +irtp 28 IRTP # Internet Reliable Transaction Protocol +iso-tp4 29 ISO-TP4 # ISO Transport Protocol Class 4 +netblt 30 NETBLT # Bulk Data Transfer Protocol +mfe-nsp 31 MFE-NSP # MFE Network Services Protocol +merit-inp 32 MERIT-INP # MERIT Internodal Protocol +sep 33 SEP # Sequential Exchange Protocol +3pc 34 3PC # Third Party Connect Protocol +idpr 35 IDPR # Inter-Domain Policy Routing Protocol +xtp 36 XTP # Xpress Tranfer Protocol +ddp 37 DDP # Datagram Delivery Protocol +idpr-cmtp 38 IDPR-CMTP # IDPR Control Message Transport Proto +tp++ 39 TP++ # TP++ Transport Protocol +il 40 IL # IL Transport Protocol +ipv6 41 IPV6 # ipv6 +sdrp 42 SDRP # Source Demand Routing Protocol +ipv6-route 43 IPV6-ROUTE # routing header for ipv6 +ipv6-frag 44 IPV6-FRAG # fragment header for ipv6 +idrp 45 IDRP # Inter-Domain Routing Protocol +rsvp 46 RSVP # Resource ReSerVation Protocol +gre 47 GRE # Generic Routing Encapsulation +mhrp 48 MHRP # Mobile Host Routing Protocol +bna 49 BNA # BNA +esp 50 ESP # encapsulating security payload +ah 51 AH # authentication header +i-nlsp 52 I-NLSP # Integrated Net Layer Security TUBA +swipe 53 SWIPE # IP with Encryption +narp 54 NARP # NBMA Address Resolution Protocol +mobile 55 MOBILE # IP Mobility +tlsp 56 TLSP # Transport Layer Security Protocol +skip 57 SKIP # SKIP +ipv6-icmp 58 IPV6-ICMP # ICMP for IPv6 +ipv6-nonxt 59 IPV6-NONXT # no next header for ipv6 +ipv6-opts 60 IPV6-OPTS # destination options for ipv6 +# 61 # any host internal protocol +cftp 62 CFTP # CFTP +# 63 # any local network +sat-expak 64 SAT-EXPAK # SATNET and Backroom EXPAK +kryptolan 65 KRYPTOLAN # Kryptolan +rvd 66 RVD # MIT Remote Virtual Disk Protocol +ippc 67 IPPC # Internet Pluribus Packet Core +# 68 # any distributed file system +sat-mon 69 SAT-MON # SATNET Monitoring +visa 70 VISA # VISA Protocol +ipcv 71 IPCV # Internet Packet Core Utility +cpnx 72 CPNX # Computer Protocol Network Executive +cphb 73 CPHB # Computer Protocol Heart Beat +wsn 74 WSN # Wang Span Network +pvp 75 PVP # Packet Video Protocol +br-sat-mon 76 BR-SAT-MON # Backroom SATNET Monitoring +sun-nd 77 SUN-ND # SUN ND PROTOCOL-Temporary +wb-mon 78 WB-MON # WIDEBAND Monitoring +wb-expak 79 WB-EXPAK # WIDEBAND EXPAK +iso-ip 80 ISO-IP # ISO Internet Protocol +vmtp 81 VMTP # Versatile Message Transport +secure-vmtp 82 SECURE-VMTP # SECURE-VMTP +vines 83 VINES # VINES +ttp 84 TTP # TTP +nsfnet-igp 85 NSFNET-IGP # NSFNET-IGP +dgp 86 DGP # Dissimilar Gateway Protocol +tcf 87 TCF # TCF +eigrp 88 EIGRP # Enhanced Interior Routing Protocol (Cisco) +ospf 89 OSPFIGP # Open Shortest Path First IGP +sprite-rpc 90 Sprite-RPC # Sprite RPC Protocol +larp 91 LARP # Locus Address Resolution Protocol +mtp 92 MTP # Multicast Transport Protocol +ax.25 93 AX.25 # AX.25 Frames +ipip 94 IPIP # Yet Another IP encapsulation +micp 95 MICP # Mobile Internetworking Control Pro. +scc-sp 96 SCC-SP # Semaphore Communications Sec. Pro. +etherip 97 ETHERIP # Ethernet-within-IP Encapsulation +encap 98 ENCAP # Yet Another IP encapsulation +# 99 # any private encryption scheme +gmtp 100 GMTP # GMTP +ifmp 101 IFMP # Ipsilon Flow Management Protocol +pnni 102 PNNI # PNNI over IP +pim 103 PIM # Protocol Independent Multicast +aris 104 ARIS # ARIS +scps 105 SCPS # SCPS +qnx 106 QNX # QNX +a/n 107 A/N # Active Networks +ipcomp 108 IPComp # IP Payload Compression Protocol +snp 109 SNP # Sitara Networks Protocol +compaq-peer 110 Compaq-Peer # Compaq Peer Protocol +ipx-in-ip 111 IPX-in-IP # IPX in IP +vrrp 112 VRRP # Virtual Router Redundancy Protocol +pgm 113 PGM # PGM Reliable Transport Protocol +# 114 # any 0-hop protocol +l2tp 115 L2TP # Layer Two Tunneling Protocol +ddx 116 DDX # D-II Data Exchange +iatp 117 IATP # Interactive Agent Transfer Protocol +st 118 ST # Schedule Transfer +srp 119 SRP # SpectraLink Radio Protocol +uti 120 UTI # UTI +smp 121 SMP # Simple Message Protocol +sm 122 SM # SM +ptp 123 PTP # Performance Transparency Protocol +isis 124 ISIS # ISIS over IPv4 +fire 125 FIRE +crtp 126 CRTP # Combat Radio Transport Protocol +crudp 127 CRUDP # Combat Radio User Datagram +sscopmce 128 SSCOPMCE +iplt 129 IPLT +sps 130 SPS # Secure Packet Shield +pipe 131 PIPE # Private IP Encapsulation within IP +sctp 132 SCTP # Stream Control Transmission Protocol +fc 133 FC # Fibre Channel +# 134-254 # Unassigned +divert 254 DIVERT # Divert pseudo-protocol [non IANA] +# 255 # Reserved diff --git a/etc/pubkey.pem b/etc/pubkey.pem new file mode 100644 index 0000000..f935cb5 --- /dev/null +++ b/etc/pubkey.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH/03JimtLfN8ggkf26hOCdAaE +5Ha+c9cqoms2/AXPMWjapkalizztGhvffTk5v1Y/mDwgkI09kqArnXqRCGFSyRDB +utGizQ4OghmsBgWzBKw/biLiXZcfXpaZxfAsJ2aSDOy+ezIoPblRfqnVBzg49RPM +Pe9HoJqCn1GxIhHrKwIDAQAB +-----END PUBLIC KEY----- @@ -0,0 +1,62 @@ +#!/bin/sh + +# /etc/rc +# part of m0n0wall (http://neon1.net/m0n0wall) +# +# Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. +# All rights reserved. + +stty status '^T' + +trap : 2 +trap : 3 + +HOME=/ +PATH=/sbin:/bin:/usr/sbin:/usr/bin +export HOME PATH + +/sbin/mount -a || fsck -y && mount -a + +set -T +trap "echo 'Reboot interrupted'; exit 1" 3 + +# make some directories in /var +mkdir /var/run /var/log /var/etc /var/db/ipf 2>/dev/null +chmod 0755 /var/db/ipf +rm -rf /var/log/* + +# generate circular logfiles +clog -i -s 262144 /var/log/system.log +clog -i -s 262144 /var/log/filter.log +clog -i -s 32768 /var/log/dhcpd.log +clog -i -s 32768 /var/log/vpn.log +chmod 0600 /var/log/system.log /var/log/filter.log /var/log/dhcpd.log /var/log/vpn.log + +adjkerntz -i + +#mount_devfs devfs /dev + +# Create an initial utmp file +cd /var/run && cp /dev/null utmp && chmod 644 utmp + +# Build devices database +#dev_mkdb + +# Run ldconfig +/sbin/ldconfig -elf /usr/lib + +echo +echo "Starting LiveBSD.com's m0n0wall 1.2b2 PF ..." +echo + +# let the PHP-based configuration subsystem set up the system now +/etc/rc.bootup + +/usr/sbin/pfctl -f /tmp/rules.debug +/usr/sbin/pfctl -e + +echo Starting Secure Shell Services ... +/etc/sshd + +exit 0 + diff --git a/etc/rc.banner b/etc/rc.banner new file mode 100755 index 0000000..0f5b8e5 --- /dev/null +++ b/etc/rc.banner @@ -0,0 +1,59 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.banner + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $version = chop(file_get_contents("{$g['etc_path']}/version")); + $buildtime = chop(file_get_contents("{$g['etc_path']}/version.buildtime")); + + echo <<<EOD + +*** This is LiveBSD.com's m0n0wall version {$version} + Copyright 2004 Scott Ullrich. All rights reserved. + Originally based on m0n0wall, version 1.2b1 + m0n0wall is Copyright 2002-2004 by Manuel Kasper. All rights reserved + + LAN IP address: {$config['interfaces']['lan']['ipaddr']} + + Port configurations: + + LAN -> {$config['interfaces']['lan']['if']} + WAN -> {$config['interfaces']['wan']['if']} +EOD; + + for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) + echo " OPT{$i} -> {$config['interfaces']['opt' . $i]['if']} " . + "({$config['interfaces']['opt' . $i]['descr']})\n"; +?> + + diff --git a/etc/rc.bootup b/etc/rc.bootup new file mode 100755 index 0000000..04f8266 --- /dev/null +++ b/etc/rc.bootup @@ -0,0 +1,147 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.bootup + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + require_once("globals.inc"); + + /* let the other functions know we're booting */ + $g['booting'] = TRUE; + touch("{$g['varrun_path']}/booting"); + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + /* convert configuration, if necessary */ + convert_config(); + + /* run any early shell commands specified in config.xml */ + system_do_shell_commands(1); + + /* save dmesg output to file */ + system_dmesg_save(); + + /* set up our timezone */ + system_timezone_configure(); + + /* set up our hostname */ + system_hostname_configure(); + + /* make hosts file */ + system_hosts_generate(); + + /* generate resolv.conf */ + system_resolvconf_generate(); + + /* start pccardd */ + if (!in_array($g['platform'], $g['nopccard_platforms'])) + system_pccard_start(); + + /* establish ipfilter ruleset */ + filter_configure(); + + /* configure loopback interface */ + interfaces_loopback_configure(); + + /* set up VLAN virtual interfaces */ + interfaces_vlan_configure(); + + /* set up LAN interface */ + interfaces_lan_configure(); + + /* set up WAN interface */ + interfaces_wan_configure(); + + /* set up Optional interfaces */ + interfaces_optional_configure(); + + /* start OpenVPN server & clients */ + ovpn_configure(); + + /* resync ipfilter */ + filter_resync(); + + /* start ipmon */ + filter_ipmon_start(); + + /* set up static routes */ + system_routing_configure(); + + /* enable routing */ + system_routing_enable(); + + /* start syslogd */ + system_syslogd_start(); + + /* start web server */ + system_webgui_start(); + + /* configure console menu */ + system_console_configure(); + + /* start dnsmasq service */ + services_dnsmasq_configure(); + + /* start dyndns service */ + services_dyndns_configure(); + + /* start DHCP service */ + services_dhcpd_configure(); + + /* start SNMP service */ + services_snmpd_configure(); + + /* start proxy ARP service */ + services_proxyarp_configure(); + + /* start the NTP client */ + system_ntp_configure(); + + /* start pptpd */ + vpn_pptpd_configure(); + + /* start traffic shaper */ + shaper_configure(); + + /* start IPsec tunnels */ + vpn_ipsec_configure(); + + /* start the captive portal */ + captiveportal_configure(); + + /* execute the rc scripts of extensions */ + system_do_extensions(); + + /* run any shell commands specified in config.xml */ + system_do_shell_commands(); + + /* done */ + unlink("{$g['varrun_path']}/booting"); +?> diff --git a/etc/rc.dyndns.storecache b/etc/rc.dyndns.storecache new file mode 100755 index 0000000..180662e --- /dev/null +++ b/etc/rc.dyndns.storecache @@ -0,0 +1,8 @@ +#!/bin/sh + +# copy cache file to /conf for permanent storage +/sbin/umount -f /cf +/sbin/mount -w -o noatime /cf +/bin/cp /var/db/ez-ipupdate.cache /conf +/sbin/umount -f /cf +/sbin/mount -r /cf diff --git a/etc/rc.firmware b/etc/rc.firmware new file mode 100755 index 0000000..56fc7a4 --- /dev/null +++ b/etc/rc.firmware @@ -0,0 +1,55 @@ +#!/bin/sh + +# /etc/rc.firmware +# part of m0n0wall (http://neon1.net/m0n0wall) +# +# Copyright (C) 2003 Manuel Kasper <mk@neon1.net>. +# All rights reserved. + +CFDEVICE=`cat /var/etc/cfdevice` + +if [ $1 != "upgrade" ]; then + /sbin/umount -f /ftmp > /dev/null 2>&1 +fi + +case $1 in +enable) + /sbin/mount_mfs -s 15360 -T qp120at -b 8192 -f 1024 dummy /ftmp \ + > /dev/null 2>&1 + ;; +upgrade) + # wait 5 seconds before beginning + sleep 5 + + exec </dev/console >/dev/console 2>/dev/console + + echo + echo "Firmware upgrade in progress..." + + # backup config + mkdir /tmp/configbak + cp -p /conf/* /tmp/configbak + + # unmount /cf + /sbin/umount -f /cf + + # dd image onto card + if [ -r $2 ]; then + /usr/bin/gunzip -S "" -c $2 | dd of=/dev/r$CFDEVICE bs=16k > /dev/null 2>&1 + echo "Image installed." + fi + + # mount /cf + /sbin/mount -w -o noatime /cf + + # restore config + cp -p /tmp/configbak/* /conf + + # remount /cf ro + /sbin/umount -f /cf + /sbin/mount -r /cf + + echo "Done - rebooting system..." + /sbin/reboot + ;; +esac diff --git a/etc/rc.initial b/etc/rc.initial new file mode 100755 index 0000000..bece644 --- /dev/null +++ b/etc/rc.initial @@ -0,0 +1,76 @@ +#!/bin/sh + +# /etc/rc.initial +# part of m0n0wall (http://neon1.net/m0n0wall) +# +# Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. +# All rights reserved. + +# make sure the user can't kill us by pressing Ctrl-C +trap : 2 +trap : 3 +trap : 4 + +if [ -r /var/etc/disableconsole ]; then + +while : ; do + +echo +echo +echo "*** Console menu disabled. ***" +echo + +read tmp + +done + +else + +# endless loop +while : ; do + +/etc/rc.banner + +# display a cheap menu +echo "m0n0wall console setup" +echo "**********************" +echo "1) Interfaces: assign network ports" +echo "2) Set up LAN IP address" +echo "3) Reset webGUI password" +echo "4) Reset to factory defaults" +echo "5) Reboot system" +echo "6) Ping host" +echo "7) Shell" +echo + +read -p "Enter a number: " opmode + +# see what the user has chosen +case ${opmode} in +1) + /etc/rc.initial.setports + ;; +2) + /etc/rc.initial.setlanip + ;; +3) + /etc/rc.initial.password + ;; +4) + /etc/rc.initial.defaults + ;; +5) + /etc/rc.initial.reboot + ;; +6) + /etc/rc.initial.ping + ;; +7) + set prompt = "\n`/bin/hostname -s`# " + /bin/sh + ;; +esac + +done + +fi diff --git a/etc/rc.initial.defaults b/etc/rc.initial.defaults new file mode 100755 index 0000000..8e33fd2 --- /dev/null +++ b/etc/rc.initial.defaults @@ -0,0 +1,61 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.defaults + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* don't parse the config so we can restore in case it's broken */ + $noparseconfig = 1; + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + echo <<<EOD + +You are about to reset the firewall to factory defaults. +The firewall will reboot after resetting the configuration. + +Do you want to proceed? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) { + + reset_factory_defaults(); + + echo <<<EOD + +The firewall is rebooting now. + +EOD; + + system_reboot_sync(); + } +?> diff --git a/etc/rc.initial.password b/etc/rc.initial.password new file mode 100755 index 0000000..7859e2c --- /dev/null +++ b/etc/rc.initial.password @@ -0,0 +1,65 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.password + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + echo <<<EOD + +The webGUI password will be reset to the default (which is 'mono'). + +Do you want to proceed? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) { + + $config['system']['password'] = crypt("mono"); + + write_config(); + system_password_configure(); + + echo <<<EOD + +The password for the webGUI has been reset. + +Remember to set the password to something else than +the default as soon as you have logged into the webGUI. + +Press ENTER to continue. + +EOD; + + fgets($fp); + } +?> diff --git a/etc/rc.initial.ping b/etc/rc.initial.ping new file mode 100755 index 0000000..d069566 --- /dev/null +++ b/etc/rc.initial.ping @@ -0,0 +1,47 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.ping + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + echo "\nEnter a host name or IP address: "; + + $pinghost = chop(fgets($fp)); + if ($pinghost) { + echo "\n"; + passthru("/sbin/ping -c 3 -n " . escapeshellarg($pinghost)); + echo "\nPress ENTER to continue.\n"; + fgets($fp); + } +?> diff --git a/etc/rc.initial.reboot b/etc/rc.initial.reboot new file mode 100755 index 0000000..053d492 --- /dev/null +++ b/etc/rc.initial.reboot @@ -0,0 +1,55 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.reboot + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + echo <<<EOD + +The firewall will reboot. This may take one minute. + +Do you want to proceed? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) { + + echo <<<EOD + +The firewall is rebooting now. + +EOD; + + system_reboot_sync(); + } +?> diff --git a/etc/rc.initial.setlanip b/etc/rc.initial.setlanip new file mode 100755 index 0000000..99fd922 --- /dev/null +++ b/etc/rc.initial.setlanip @@ -0,0 +1,117 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.setlanip + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + do { + echo "\nEnter the new LAN IP address: "; + $lanip = chop(fgets($fp)); + if ($lanip === "") { + exit(0); + } + } while (!is_ipaddr($lanip)); + + echo "\nSubnet masks are entered as bit counts (as in CIDR notation) in m0n0wall.\n"; + echo "e.g. 255.255.255.0 = 24\n"; + echo " 255.255.0.0 = 16\n"; + echo " 255.0.0.0 = 8\n\n"; + + do { + echo "Enter the new LAN subnet bit count: "; + $lanbits = chop(fgets($fp)); + if ($lanbits === "") { + exit(0); + } + } while (!is_numeric($lanbits) || ($lanbits < 1) || ($lanbits > 31)); + + $config['interfaces']['lan']['ipaddr'] = $lanip; + $config['interfaces']['lan']['subnet'] = $lanbits; + + echo "\nDo you want to enable the DHCP server on LAN? (y/n) "; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) { + do { + echo "Enter the start address of the client address range: "; + $dhcpstartip = chop(fgets($fp)); + if ($dhcpstartip === "") { + exit(0); + } + } while (!is_ipaddr($dhcpstartip)); + + do { + echo "Enter the end address of the client address range: "; + $dhcpendip = chop(fgets($fp)); + if ($dhcpendip === "") { + exit(0); + } + } while (!is_ipaddr($dhcpendip)); + + $config['dhcpd']['lan']['enable'] = true; + $config['dhcpd']['lan']['range']['from'] = $dhcpstartip; + $config['dhcpd']['lan']['range']['to'] = $dhcpendip; + } else { + unset($config['dhcpd']['lan']['enable']); + } + + if ($config['system']['webgui']['protocol'] == "https") { + + echo "\nDo you want to revert to HTTP as the webGUI protocol? (y/n) "; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) + $config['system']['webgui']['protocol'] = "http"; + } + + if (isset($config['system']['webgui']['noantilockout'])) { + echo "\nNote: the anti-lockout rule on LAN has been re-enabled.\n"; + unset($config['system']['webgui']['noantilockout']); + } + + write_config(); + interfaces_lan_configure(); + + echo <<<EOD + +The LAN IP address has been set to $lanip/$lanbits. +You can now access the webGUI by opening the following URL +in your browser: + +http://$lanip/ + +Press ENTER to continue. + +EOD; + + fgets($fp); +?> diff --git a/etc/rc.initial.setports b/etc/rc.initial.setports new file mode 100755 index 0000000..049879a --- /dev/null +++ b/etc/rc.initial.setports @@ -0,0 +1,303 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.initial.setports + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + $fp = fopen('php://stdin', 'r'); + + $iflist = get_interface_list(); + + echo <<<EOD + +Valid interfaces are: + + +EOD; + + foreach ($iflist as $iface => $ifa) { + echo sprintf("% -8s%s%s\n", $iface, $ifa['mac'], + $ifa['up'] ? " (up)" : ""); + } + + echo <<<EOD + +Do you want to set up VLANs first? +If you're not going to use VLANs, or only for optional interfaces, you +should say no here and use the webGUI to configure VLANs later, if required. + +Do you want to set up VLANs now? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) + vlan_setup(); + + if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) { + + echo "\n\nVLAN interfaces:\n\n"; + $i = 0; + foreach ($config['vlans']['vlan'] as $vlan) { + + echo sprintf("% -8s%s\n", "vlan{$i}", + "VLAN tag {$vlan['tag']}, interface {$vlan['if']}"); + + $iflist['vlan' . $i] = array(); + $i++; + } + } + + echo <<<EOD + +If you don't know the names of your interfaces, you may choose to use +auto-detection. In that case, disconnect all interfaces before you begin, +and reconnect each one when prompted to do so. + +EOD; + + do { + echo "\nEnter the LAN interface name or 'a' for auto-detection: "; + $lanif = chop(fgets($fp)); + if ($lanif === "") { + exit(0); + } + + if ($lanif === "a") + $lanif = autodetect_interface("LAN", $fp); + else if (!array_key_exists($lanif, $iflist)) { + echo "\nInvalid interface name '{$lanif}'\n"; + unset($lanif); + continue; + } + } while (!$lanif); + + do { + echo "\nEnter the WAN interface name or 'a' for auto-detection: "; + $wanif = chop(fgets($fp)); + if ($wanif === "") { + exit(0); + } + if ($wanif === "a") + $wanif = autodetect_interface("WAN", $fp); + else if (!array_key_exists($wanif, $iflist)) { + echo "\nInvalid interface name '{$wanif}'\n"; + unset($wanif); + continue; + } + } while (!$wanif); + + /* optional interfaces */ + $i = 0; + $optif = array(); + + while (1) { + if ($optif[$i]) + $i++; + $i1 = $i + 1; + echo "\nEnter the Optional {$i1} interface name or 'a' for auto-detection\n" . + "(or nothing if finished): "; + $optif[$i] = chop(fgets($fp)); + + if ($optif[$i]) { + if ($optif[$i] === "a") { + $ad = autodetect_interface("Optional " . $i1, $fp); + if ($ad) + $optif[$i] = $ad; + else + unset($optif[$i]); + } else if (!array_key_exists($optif[$i], $iflist)) { + echo "\nInvalid interface name '{$optif[$i]}'\n"; + unset($optif[$i]); + continue; + } + } else { + unset($optif[$i]); + break; + } + } + + /* check for double assignments */ + $ifarr = array_merge(array($lanif, $wanif), $optif); + + for ($i = 0; $i < (count($ifarr)-1); $i++) { + for ($j = ($i+1); $j < count($ifarr); $j++) { + if ($ifarr[$i] == $ifarr[$j]) { + echo <<<EOD + +Error: you can't assign the same interface name twice! + +EOD; + + exit(0); + } + } + } + + echo <<<EOD + +The interfaces will be assigned as follows: + +LAN -> {$lanif} +WAN -> {$wanif} + +EOD; + + for ($i = 0; $i < count($optif); $i++) { + echo "OPT" . ($i+1) . " -> " . $optif[$i] . "\n"; + } + +echo <<<EOD + +The firewall will reboot after saving the changes. + +Do you want to proceed? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") == 0) { + + $config['interfaces']['lan']['if'] = $lanif; + if (preg_match("/^(wi|awi|an)/", $lanif)) { + if (!is_array($config['interfaces']['lan']['wireless'])) + $config['interfaces']['lan']['wireless'] = array(); + } else { + unset($config['interfaces']['lan']['wireless']); + } + + $config['interfaces']['wan']['if'] = $wanif; + if (preg_match("/^(wi|awi|an)/", $wanif)) { + if (!is_array($config['interfaces']['wan']['wireless'])) + $config['interfaces']['wan']['wireless'] = array(); + } else { + unset($config['interfaces']['wan']['wireless']); + } + + for ($i = 0; $i < count($optif); $i++) { + if (!is_array($config['interfaces']['opt' . ($i+1)])) + $config['interfaces']['opt' . ($i+1)] = array(); + + $config['interfaces']['opt' . ($i+1)]['if'] = $optif[$i]; + + /* wireless interface? */ + if (preg_match("/^(wi|awi|an)/", $optif[$i])) { + if (!is_array($config['interfaces']['opt' . ($i+1)]['wireless'])) + $config['interfaces']['opt' . ($i+1)]['wireless'] = array(); + } else { + unset($config['interfaces']['opt' . ($i+1)]['wireless']); + } + + unset($config['interfaces']['opt' . ($i+1)]['enable']); + $config['interfaces']['opt' . ($i+1)]['descr'] = "OPT" . ($i+1); + } + + /* remove all other (old) optional interfaces */ + for (; isset($config['interfaces']['opt' . ($i+1)]); $i++) + unset($config['interfaces']['opt' . ($i+1)]); + + write_config(); + + echo <<<EOD + +The firewall is rebooting now. + +EOD; + + system_reboot_sync(); + } + + function autodetect_interface($ifname, $fp) { + $iflist_prev = get_interface_list(); + echo <<<EOD + +Connect the {$ifname} interface now and make sure that the link is up. +Then press ENTER to continue. + +EOD; + fgets($fp); + $iflist = get_interface_list(); + + foreach ($iflist_prev as $ifn => $ifa) { + if (!$ifa['up'] && $iflist[$ifn]['up']) { + echo "Detected link-up on interface {$ifn}.\n"; + return $ifn; + } + } + + echo "No link-up detected.\n"; + + return null; + } + + function vlan_setup() { + global $iflist, $config, $g, $fp; + + if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) { + + echo <<<EOD + +WARNING: all existing VLANs will be cleared if you proceed! + +Do you want to proceed? (y/n) +EOD; + + if (strcasecmp(chop(fgets($fp)), "y") != 0) + return; + } + + $config['vlans']['vlan'] = array(); + echo "\n"; + + while (1) { + $vlan = array(); + + echo "\nEnter the parent interface name for the new VLAN (or nothing if finished): "; + $vlan['if'] = chop(fgets($fp)); + + if ($vlan['if']) { + if (!array_key_exists($vlan['if'], $iflist)) { + echo "\nInvalid interface name '{$vlan['if']}'\n"; + continue; + } + } else { + break; + } + + echo "Enter the VLAN tag (1-4094): "; + $vlan['tag'] = chop(fgets($fp)); + + if (!is_numericint($vlan['tag']) || ($vlan['tag'] < 1) || ($vlan['tag'] > 4094)) { + echo "\nInvalid VLAN tag '{$vlan['tag']}'\n"; + continue; + } + + $config['vlans']['vlan'][] = $vlan; + } + } +?> diff --git a/etc/rc.newwanip b/etc/rc.newwanip new file mode 100755 index 0000000..5328028 --- /dev/null +++ b/etc/rc.newwanip @@ -0,0 +1,83 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.newwanip + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + /* WAN IP address has changed */ + + /* make sure to wait until the boot scripts have finished + while (file_exists("{$g['varrun_path']}/booting")) { + sleep(1); + } + */ + + $curwanip = get_current_wan_address(); + + /* dhclient or MPD told us that the IP address has changed; + let's see if that's really true to avoid reloading things + when it's not really necessary (dhclient likes to + execute its dhclient-exit-hooks also on renewals) + */ + if (file_exists("{$g['vardb_path']}/wanip")) { + $oldwanip = chop(file_get_contents("{$g['vardb_path']}/wanip")); + + if ($curwanip == $oldwanip) + return 0; /* nothing to do */ + } + + /* resync ipfilter */ + filter_resync(); + + /* flush NAT table */ + filter_flush_nat_table(); + + /* reconfigure IPsec tunnels */ + vpn_ipsec_configure(true); + + /* regenerate resolv.conf if DNS overrides are allowed or the BigPond + client is enabled */ + if (isset($config['system']['dnsallowoverride']) || + ($config['interfaces']['wan']['ipaddr'] == "bigpond")) + system_resolvconf_generate(true); + + /* fire up the BigPond client, if necessary */ + if ($config['interfaces']['wan']['ipaddr'] == "bigpond") + interfaces_wan_bigpond_configure($curwanip); + + /* write current WAN IP to file */ + $fd = @fopen("{$g['vardb_path']}/wanip", "w"); + if ($fd) { + fwrite($fd, $curwanip); + fclose($fd); + } +?> diff --git a/etc/rc.prunecaptiveportal b/etc/rc.prunecaptiveportal new file mode 100755 index 0000000..108b029 --- /dev/null +++ b/etc/rc.prunecaptiveportal @@ -0,0 +1,37 @@ +#!/usr/local/bin/php -f +<?php +/* + rc.prunecaptiveportal + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + + /* parse the configuration and include all functions used below */ + require_once("config.inc"); + require_once("functions.inc"); + + captiveportal_prune_old(); +?> diff --git a/etc/rc.reboot b/etc/rc.reboot new file mode 100755 index 0000000..2b3eb08 --- /dev/null +++ b/etc/rc.reboot @@ -0,0 +1,5 @@ +#!/bin/sh + +sleep 1 + +/sbin/reboot diff --git a/etc/rc.shutdown b/etc/rc.shutdown new file mode 100755 index 0000000..1deb79a --- /dev/null +++ b/etc/rc.shutdown @@ -0,0 +1,17 @@ +#!/bin/sh + +stty status '^T' + +# Set shell to ignore SIGINT (2), but not children; +# shell catches SIGQUIT (3) and returns to single user after fsck. +trap : 2 +trap : 3 # shouldn't be needed + +HOME=/ +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin +export HOME PATH + +# Insert other shutdown procedures here + +exit 0 + diff --git a/etc/services b/etc/services new file mode 100644 index 0000000..c583eac --- /dev/null +++ b/etc/services @@ -0,0 +1,2106 @@ +# +# Network services, Internet style +# +# Note that it is presently the policy of IANA to assign a single well-known +# port number for both TCP and UDP; hence, most entries here have two entries +# even if the protocol doesn't support UDP operations. +# +# The latest IANA port assignments can be gotten from +# +# http://www.iana.org/assignments/port-numbers +# +# The Well Known Ports are those from 0 through 1023. +# The Registered Ports are those from 1024 through 49151 +# The Dynamic and/or Private Ports are those from 49152 through 65535 +# +# Kerberos services are for Kerberos v4, and are unofficial. Sites running +# v5 should uncomment v5 entries and comment v4 entries. +# +# $FreeBSD: src/etc/services,v 1.62.2.12 2003/02/01 16:48:17 schweikh Exp $ +# From: @(#)services 5.8 (Berkeley) 5/9/91 +# +# WELL KNOWN PORT NUMBERS +# +rtmp 1/ddp #Routing Table Maintenance Protocol +tcpmux 1/tcp #TCP Port Service Multiplexer +tcpmux 1/udp #TCP Port Service Multiplexer +nbp 2/ddp #Name Binding Protocol +compressnet 2/tcp #Management Utility +compressnet 2/udp #Management Utility +compressnet 3/tcp #Compression Process +compressnet 3/udp #Compression Process +echo 4/ddp #AppleTalk Echo Protocol +rje 5/tcp #Remote Job Entry +rje 5/udp #Remote Job Entry +zip 6/ddp #Zone Information Protocol +echo 7/tcp +echo 7/udp +discard 9/tcp sink null +discard 9/udp sink null +systat 11/tcp users #Active Users +systat 11/udp users #Active Users +daytime 13/tcp +daytime 13/udp +qotd 17/tcp quote #Quote of the Day +qotd 17/udp quote #Quote of the Day +msp 18/tcp #Message Send Protocol +msp 18/udp #Message Send Protocol +chargen 19/tcp ttytst source #Character Generator +chargen 19/udp ttytst source #Character Generator +ftp-data 20/tcp #File Transfer [Default Data] +ftp-data 20/udp #File Transfer [Default Data] +ftp 21/tcp #File Transfer [Control] +ftp 21/udp #File Transfer [Control] +ssh 22/tcp #Secure Shell Login +ssh 22/udp #Secure Shell Login +telnet 23/tcp +telnet 23/udp +# 24/tcp any private mail system +# 24/udp any private mail system +smtp 25/tcp mail #Simple Mail Transfer +smtp 25/udp mail #Simple Mail Transfer +nsw-fe 27/tcp #NSW User System FE +nsw-fe 27/udp #NSW User System FE +msg-icp 29/tcp #MSG ICP +msg-icp 29/udp #MSG ICP +msg-auth 31/tcp #MSG Authentication +msg-auth 31/udp #MSG Authentication +dsp 33/tcp #Display Support Protocol +dsp 33/udp #Display Support Protocol +# 35/tcp any private printer server +# 35/udp any private printer server +time 37/tcp timserver +time 37/udp timserver +rap 38/tcp #Route Access Protocol +rap 38/udp #Route Access Protocol +rlp 39/tcp resource #Resource Location Protocol +rlp 39/udp resource #Resource Location Protocol +graphics 41/tcp +graphics 41/udp +nameserver 42/tcp name #Host Name Server +nameserver 42/udp name #Host Name Server +nicname 43/tcp whois +nicname 43/udp whois +mpm-flags 44/tcp #MPM FLAGS Protocol +mpm-flags 44/udp #MPM FLAGS Protocol +mpm 45/tcp #Message Processing Module [recv] +mpm 45/udp #Message Processing Module [recv] +mpm-snd 46/tcp #MPM [default send] +mpm-snd 46/udp #MPM [default send] +ni-ftp 47/tcp #NI FTP +ni-ftp 47/udp #NI FTP +auditd 48/tcp #Digital Audit Daemon +auditd 48/udp #Digital Audit Daemon +tacacs 49/tcp #Login Host Protocol (TACACS) +tacacs 49/udp #Login Host Protocol (TACACS) +re-mail-ck 50/tcp #Remote Mail Checking Protocol +re-mail-ck 50/udp #Remote Mail Checking Protocol +la-maint 51/tcp #IMP Logical Address Maintenance +la-maint 51/udp #IMP Logical Address Maintenance +xns-time 52/tcp #XNS Time Protocol +xns-time 52/udp #XNS Time Protocol +domain 53/tcp #Domain Name Server +domain 53/udp #Domain Name Server +xns-ch 54/tcp #XNS Clearinghouse +xns-ch 54/udp #XNS Clearinghouse +isi-gl 55/tcp #ISI Graphics Language +isi-gl 55/udp #ISI Graphics Language +xns-auth 56/tcp #XNS Authentication +xns-auth 56/udp #XNS Authentication +mtp 57/tcp # deprecated +#PROBLEMS!============================================================== +# 57/tcp any private terminal access +#PROBLEMS!============================================================== +# 57/udp any private terminal access +xns-mail 58/tcp #XNS Mail +xns-mail 58/udp #XNS Mail +# 59/tcp any private file service +# 59/udp any private file service +ni-mail 61/tcp #NI MAIL +ni-mail 61/udp #NI MAIL +acas 62/tcp #ACA Services +acas 62/udp #ACA Services +whois++ 63/tcp +whois++ 63/udp +covia 64/tcp #Communications Integrator (CI) +covia 64/udp #Communications Integrator (CI) +tacacs-ds 65/tcp #TACACS-Database Service +tacacs-ds 65/udp #TACACS-Database Service +sql*net 66/tcp #Oracle SQL*NET +sql*net 66/udp #Oracle SQL*NET +bootps 67/tcp dhcps #Bootstrap Protocol Server +bootps 67/udp dhcps #Bootstrap Protocol Server +bootpc 68/tcp dhcpc #Bootstrap Protocol Client +bootpc 68/udp dhcpc #Bootstrap Protocol Client +tftp 69/tcp #Trivial File Transfer +tftp 69/udp #Trivial File Transfer +gopher 70/tcp +gopher 70/udp +netrjs-1 71/tcp #Remote Job Service +netrjs-1 71/udp #Remote Job Service +netrjs-2 72/tcp #Remote Job Service +netrjs-2 72/udp #Remote Job Service +netrjs-3 73/tcp #Remote Job Service +netrjs-3 73/udp #Remote Job Service +netrjs-4 74/tcp #Remote Job Service +netrjs-4 74/udp #Remote Job Service +# 75/tcp any private dial out service +# 75/udp any private dial out service +deos 76/tcp #Distributed External Object Store +deos 76/udp #Distributed External Object Store +netrjs 77/tcp +#PROBLEMS!============================================================== +# 77/tcp any private RJE service +#PROBLEMS!============================================================== +# 77/udp any private RJE service +vettcp 78/tcp +vettcp 78/udp +finger 79/tcp +finger 79/udp +http 80/tcp www www-http #World Wide Web HTTP +http 80/udp www www-http #World Wide Web HTTP +hosts2-ns 81/tcp #HOSTS2 Name Server +hosts2-ns 81/udp #HOSTS2 Name Server +xfer 82/tcp #XFER Utility +xfer 82/udp #XFER Utility +mit-ml-dev 83/tcp #MIT ML Device +mit-ml-dev 83/udp #MIT ML Device +ctf 84/tcp #Common Trace Facility +ctf 84/udp #Common Trace Facility +mit-ml-dev 85/tcp #MIT ML Device +mit-ml-dev 85/udp #MIT ML Device +mfcobol 86/tcp #Micro Focus Cobol +mfcobol 86/udp #Micro Focus Cobol +ttylink 87/tcp +#PROBLEMS!=========================================================== +# 87/tcp any private terminal link +#PROBLEMS!=========================================================== +# 87/udp any private terminal link +kerberos-sec 88/tcp kerberos # krb5 # Kerberos (v5) +kerberos-sec 88/udp kerberos # krb5 # Kerberos (v5) +su-mit-tg 89/tcp #SU/MIT Telnet Gateway +su-mit-tg 89/udp #SU/MIT Telnet Gateway +dnsix 90/tcp #DNSIX Securit Attribute Token Map +dnsix 90/udp #DNSIX Securit Attribute Token Map +mit-dov 91/tcp #MIT Dover Spooler +mit-dov 91/udp #MIT Dover Spooler +npp 92/tcp #Network Printing Protocol +npp 92/udp #Network Printing Protocol +dcp 93/tcp #Device Control Protocol +dcp 93/udp #Device Control Protocol +objcall 94/tcp #Tivoli Object Dispatcher +objcall 94/udp #Tivoli Object Dispatcher +supdup 95/tcp +supdup 95/udp +dixie 96/tcp #DIXIE Protocol Specification +dixie 96/udp #DIXIE Protocol Specification +swift-rvf 97/tcp #Swift Remote Virtural File Protocol +swift-rvf 97/udp #Swift Remote Virtural File Protocol +tacnews 98/tcp #TAC News, Unofficial: Red Hat linuxconf +tacnews 98/udp #TAC News, Unofficial: Red Hat linuxconf +metagram 99/tcp #Metagram Relay +metagram 99/udp #Metagram Relay +newacct 100/tcp #[unauthorized use] +hostname 101/tcp hostnames #NIC Host Name Server +hostname 101/udp hostnames #NIC Host Name Server +iso-tsap 102/tcp tsap #ISO-TSAP Class 0 +iso-tsap 102/udp tsap #ISO-TSAP Class 0 +gppitnp 103/tcp #Genesis Point-to-Point Trans Net +gppitnp 103/udp #Genesis Point-to-Point Trans Net +acr-nema 104/tcp #ACR-NEMA Digital Imag. & Comm. 300 +acr-nema 104/udp #ACR-NEMA Digital Imag. & Comm. 300 +csnet-ns 105/tcp cso-ns cso #Mailbox Name Nameserver +csnet-ns 105/udp cso-ns cso #Mailbox Name Nameserver +pop3pw 106/tcp 3com-tsmux #Eudora compatible PW changer +3com-tsmux 106/udp +rtelnet 107/tcp #Remote Telnet Service +rtelnet 107/udp #Remote Telnet Service +snagas 108/tcp #SNA Gateway Access Server +snagas 108/udp #SNA Gateway Access Server +pop2 109/tcp postoffice #Post Office Protocol - Version 2 +pop2 109/udp postoffice #Post Office Protocol - Version 2 +pop3 110/tcp #Post Office Protocol - Version 3 +pop3 110/udp #Post Office Protocol - Version 3 +sunrpc 111/tcp rpcbind #SUN Remote Procedure Call +sunrpc 111/udp rpcbind #SUN Remote Procedure Call +mcidas 112/tcp #McIDAS Data Transmission Protocol +mcidas 112/udp #McIDAS Data Transmission Protocol +auth 113/tcp ident tap #Authentication Service +auth 113/udp ident tap #Authentication Service +audionews 114/tcp #Audio News Multicast +audionews 114/udp #Audio News Multicast +sftp 115/tcp #Simple File Transfer Protocol +sftp 115/udp #Simple File Transfer Protocol +ansanotify 116/tcp #ANSA REX Notify +ansanotify 116/udp #ANSA REX Notify +uucp-path 117/tcp #UUCP Path Service +uucp-path 117/udp #UUCP Path Service +sqlserv 118/tcp #SQL Services +sqlserv 118/udp #SQL Services +nntp 119/tcp usenet #Network News Transfer Protocol +nntp 119/udp usenet #Network News Transfer Protocol +cfdptkt 120/tcp +cfdptkt 120/udp +erpc 121/tcp #Encore Expedited Remote Pro.Call +erpc 121/udp #Encore Expedited Remote Pro.Call +smakynet 122/tcp +smakynet 122/udp +ntp 123/tcp #Network Time Protocol +ntp 123/udp #Network Time Protocol +ansatrader 124/tcp #ANSA REX Trader +ansatrader 124/udp #ANSA REX Trader +locus-map 125/tcp #Locus PC-Interface Net Map Ser +locus-map 125/udp #Locus PC-Interface Net Map Ser +unitary 126/tcp #Unisys Unitary Login +unitary 126/udp #Unisys Unitary Login +locus-con 127/tcp #Locus PC-Interface Conn Server +locus-con 127/udp #Locus PC-Interface Conn Server +gss-xlicen 128/tcp #GSS X License Verification +gss-xlicen 128/udp #GSS X License Verification +pwdgen 129/tcp #Password Generator Protocol +pwdgen 129/udp #Password Generator Protocol +cisco-fna 130/tcp #cisco FNATIVE +cisco-fna 130/udp #cisco FNATIVE +cisco-tna 131/tcp #cisco TNATIVE +cisco-tna 131/udp #cisco TNATIVE +cisco-sys 132/tcp #cisco SYSMAINT +cisco-sys 132/udp #cisco SYSMAINT +statsrv 133/tcp #Statistics Service +statsrv 133/udp #Statistics Service +ingres-net 134/tcp #INGRES-NET Service +ingres-net 134/udp #INGRES-NET Service +loc-srv 135/tcp epmap #Location Service +loc-srv 135/udp epmap #Location Service +profile 136/tcp #PROFILE Naming System +profile 136/udp #PROFILE Naming System +netbios-ns 137/tcp #NETBIOS Name Service +netbios-ns 137/udp #NETBIOS Name Service +netbios-dgm 138/tcp #NETBIOS Datagram Service +netbios-dgm 138/udp #NETBIOS Datagram Service +netbios-ssn 139/tcp #NETBIOS Session Service +netbios-ssn 139/udp #NETBIOS Session Service +emfis-data 140/tcp #EMFIS Data Service +emfis-data 140/udp #EMFIS Data Service +emfis-cntl 141/tcp #EMFIS Control Service +emfis-cntl 141/udp #EMFIS Control Service +bl-idm 142/tcp #Britton-Lee IDM +bl-idm 142/udp #Britton-Lee IDM +imap 143/tcp imap2 imap4 #Interim Mail Access Protocol v2 +imap 143/udp imap2 imap4 #Interim Mail Access Protocol v2 +NeWS 144/tcp # Window System +NeWS 144/udp # Window System +#PROBLEMS!============================================================== +#uma 144/tcp #Universal Management Architecture +#uma 144/udp #Universal Management Architecture +#PROBLEMS!============================================================== +uaac 145/tcp #UAAC Protocol +uaac 145/udp #UAAC Protocol +iso-tp0 146/tcp +iso-tp0 146/udp +iso-ip 147/tcp +iso-ip 147/udp +cronus 148/tcp jargon #CRONUS-SUPPORT +cronus 148/udp jargon #CRONUS-SUPPORT +aed-512 149/tcp #AED 512 Emulation Service +aed-512 149/udp #AED 512 Emulation Service +sql-net 150/tcp +sql-net 150/udp +hems 151/tcp +hems 151/udp +bftp 152/tcp #Background File Transfer Program +bftp 152/udp #Background File Transfer Program +sgmp 153/tcp +sgmp 153/udp +netsc-prod 154/tcp +netsc-prod 154/udp +netsc-dev 155/tcp +netsc-dev 155/udp +sqlsrv 156/tcp #SQL Service +sqlsrv 156/udp #SQL Service +knet-cmp 157/tcp #KNET/VM Command/Message Protocol +knet-cmp 157/udp #KNET/VM Command/Message Protocol +pcmail-srv 158/tcp #PCMail Server +pcmail-srv 158/udp #PCMail Server +nss-routing 159/tcp +nss-routing 159/udp +sgmp-traps 160/tcp +sgmp-traps 160/udp +snmp 161/tcp +snmp 161/udp +snmptrap 162/tcp snmp-trap +snmptrap 162/udp snmp-trap +cmip-man 163/tcp #CMIP/TCP Manager +cmip-man 163/udp #CMIP/TCP Manager +cmip-agent 164/tcp #CMIP/TCP Agent +smip-agent 164/udp #CMIP/TCP Agent +xns-courier 165/tcp #Xerox +xns-courier 165/udp #Xerox +s-net 166/tcp #Sirius Systems +s-net 166/udp #Sirius Systems +namp 167/tcp +namp 167/udp +rsvd 168/tcp +rsvd 168/udp +send 169/tcp +send 169/udp +print-srv 170/tcp #Network PostScript +print-srv 170/udp #Network PostScript +multiplex 171/tcp #Network Innovations Multiplex +multiplex 171/udp #Network Innovations Multiplex +cl/1 172/tcp #Network Innovations CL/1 +cl/1 172/udp #Network Innovations CL/1 +xyplex-mux 173/tcp +xyplex-mux 173/udp +mailq 174/tcp +mailq 174/udp +vmnet 175/tcp +vmnet 175/udp +genrad-mux 176/tcp +genrad-mux 176/udp +xdmcp 177/tcp #X Display Manager Control Protocol +xdmcp 177/udp #X Display Manager Control Protocol +NextStep 178/tcp nextstep NeXTStep #NextStep Window Server +NextStep 178/udp nextstep NeXTStep #NextStep Window Server +bgp 179/tcp #Border Gateway Protocol +bgp 179/udp #Border Gateway Protocol +ris 180/tcp #Intergraph +ris 180/udp #Intergraph +unify 181/tcp +unify 181/udp +audit 182/tcp #Unisys Audit SITP +audit 182/udp #Unisys Audit SITP +ocbinder 183/tcp +ocbinder 183/udp +ocserver 184/tcp +ocserver 184/udp +remote-kis 185/tcp +remote-kis 185/udp +kis 186/tcp #KIS Protocol +kis 186/udp #KIS Protocol +aci 187/tcp #Application Communication Interface +aci 187/udp #Application Communication Interface +mumps 188/tcp #Plus Five's MUMPS +mumps 188/udp #Plus Five's MUMPS +qft 189/tcp #Queued File Transport +qft 189/udp #Queued File Transport +gacp 190/tcp #Gateway Access Control Protocol +gacp 190/udp cacp #Gateway Access Control Protocol +prospero 191/tcp #Prospero Directory Service +prospero 191/udp #Prospero Directory Service +osu-nms 192/tcp #OSU Network Monitoring System +osu-nms 192/udp #OSU Network Monitoring System +srmp 193/tcp #Spider Remote Monitoring Protocol +srmp 193/udp #Spider Remote Monitoring Protocol +irc 194/tcp #Internet Relay Chat Protocol +irc 194/udp #Internet Relay Chat Protocol +dn6-nlm-aud 195/tcp #DNSIX Network Level Module Audit +dn6-nlm-aud 195/udp #DNSIX Network Level Module Audit +dn6-smm-red 196/tcp #DNSIX Session Mgt Module Audit Redir +dn6-smm-red 196/udp #DNSIX Session Mgt Module Audit Redir +dls 197/tcp #Directory Location Service +dls 197/udp #Directory Location Service +dls-mon 198/tcp #Directory Location Service Monitor +dls-mon 198/udp #Directory Location Service Monitor +smux 199/tcp +smux 199/udp +src 200/tcp #IBM System Resource Controller +src 200/udp #IBM System Resource Controller +at-rtmp 201/tcp #AppleTalk Routing Maintenance +at-rtmp 201/udp #AppleTalk Routing Maintenance +at-nbp 202/tcp #AppleTalk Name Binding +at-nbp 202/udp #AppleTalk Name Binding +at-3 203/tcp #AppleTalk Unused +at-3 203/udp #AppleTalk Unused +at-echo 204/tcp #AppleTalk Echo +at-echo 204/udp #AppleTalk Echo +at-5 205/tcp #AppleTalk Unused +at-5 205/udp #AppleTalk Unused +at-zis 206/tcp #AppleTalk Zone Information +at-zis 206/udp #AppleTalk Zone Information +at-7 207/tcp #AppleTalk Unused +at-7 207/udp #AppleTalk Unused +at-8 208/tcp #AppleTalk Unused +at-8 208/udp #AppleTalk Unused +qmtp 209/tcp #The Quick Mail Transfer Protocol +qmtp 209/udp #The Quick Mail Transfer Protocol +#PROBLEMS!============================================================== +#tam 209/tcp #Trivial Authenticated Mail Protocol +#tam 209/udp #Trivial Authenticated Mail Protocol +#PROBLEMS!============================================================== +z39.50 210/tcp wais #ANSI Z39.50 +z39.50 210/udp wais #ANSI Z39.50 +914c/g 211/tcp #Texas Instruments 914C/G Terminal +914c/g 211/udp #Texas Instruments 914C/G Terminal +anet 212/tcp #ATEXSSTR +anet 212/udp #ATEXSSTR +ipx 213/tcp +ipx 213/udp +vmpwscs 214/tcp +vmpwscs 214/udp +softpc 215/tcp #Insignia Solutions +softpc 215/udp #Insignia Solutions +CAIlic 216/tcp atls #Computer Associates Int'l License Server +CAIlic 216/udp atls #Computer Associates Int'l License Server +dbase 217/tcp #dBASE Unix +dbase 217/udp #dBASE Unix +mpp 218/tcp #Netix Message Posting Protocol +mpp 218/udp #Netix Message Posting Protocol +uarps 219/tcp #Unisys ARPs +uarps 219/udp #Unisys ARPs +#imap3@220 was never used and never should have been allocated. See PR 46294. +#imap3 220/tcp #Interactive Mail Access Protocol v3 +#imap3 220/udp #Interactive Mail Access Protocol v3 +fln-spx 221/tcp #Berkeley rlogind with SPX auth +fln-spx 221/udp #Berkeley rlogind with SPX auth +rsh-spx 222/tcp #Berkeley rshd with SPX auth +rsh-spx 222/udp #Berkeley rshd with SPX auth +cdc 223/tcp #Certificate Distribution Center +cdc 223/udp #Certificate Distribution Center +direct 242/tcp +direct 242/udp +sur-meas 243/tcp #Survey Measurement +sur-meas 243/udp #Survey Measurement +dayna 244/tcp +dayna 244/udp +link 245/tcp +link 245/udp +dsp3270 246/tcp #Display Systems Protocol +dsp3270 246/udp #Display Systems Protocol +subntbcst_tftp 247/tcp #subntbcst_tftp +subntbcst_tftp 247/udp #subntbcst_tftp +bhfhs 248/tcp +bhfhs 248/udp +# 249-255 reserved +rap 256/tcp +rap 256/udp +set 257/tcp #secure electronic transaction +set 257/udp #secure electronic transaction +yak-chat 258/tcp #yak winsock personal chat +yak-chat 258/udp #yak winsock personal chat +esro-gen 259/tcp #efficient short remote operations +esro-gen 259/udp #efficient short remote operations +openport 260/tcp +openport 260/udp +nsiiops 261/tcp #iiop name service over tls/ssl +nsiiops 261/udp #iiop name service over tls/ssl +arcisdms 262/tcp +arcisdms 262/udp +hdap 263/tcp +hdap 263/udp +bgmp 264/tcp +bgmp 264/udp +# 265-279 unassigned +http-mgmt 280/tcp +http-mgmt 280/udp +personal-link 281/tcp +personal-link 281/udp +cableport-ax 282/tcp #cable port a/x +cableport-ax 282/udp #cable port a/x +# 283-307 unassigned +novastorbakcup 308/tcp #novastor backup +novastorbakcup 308/udp #novastor backup +entrusttime 309/tcp +entrusttime 309/udp +bhmds 310/tcp +bhmds 310/udp +asip-webadmin 311/tcp #appleshare ip webadmin +asip-webadmin 311/udp #appleshare ip webadmin +vslmp 312/tcp +vslmp 312/udp +magenta-logic 313/tcp +magenta-logic 313/udp +opalis-robot 314/tcp +opalis-robot 314/udp +dpsi 315/tcp +dpsi 315/udp +decauth 316/tcp +decauth 316/udp +zannet 317/tcp +zannet 317/udp +# 318-320 #unassigned +pip 321/tcp +pip 321/udp +# 322-343 #unassigned +pdap 344/tcp #Prospero Data Access Protocol +pdap 344/udp #Prospero Data Access Protocol +pawserv 345/tcp #Perf Analysis Workbench +pawserv 345/udp #Perf Analysis Workbench +zserv 346/tcp #Zebra server +zserv 346/udp #Zebra server +fatserv 347/tcp #Fatmen Server +fatserv 347/udp #Fatmen Server +csi-sgwp 348/tcp #Cabletron Management Protocol +csi-sgwp 348/udp #Cabletron Management Protocol +mftp 349/tcp +mftp 349/udp +matip-type-a 350/tcp #MATIP Type A +matip-type-a 350/udp +matip-type-b 351/tcp #MATIP Type B +matip-type-b 351/udp +bhoetty 351/tcp #unassigned but widespread use +bhoetty 351/udp #unassigned but widespread use +dtag-ste-sb 352/tcp #DTAG +dtag-ste-sb 352/udp #DTAG +bhoedap4 352/tcp #unassigned but widespread use +bhoedap4 352/udp #unassigned but widespread use +ndsauth 353/tcp +ndsauth 353/udp +bh611 354/tcp +bh611 354/udp +datex-asn 355/tcp +datex-asn 355/udp +cloanto-net-1 356/tcp #Cloanto Net 1 +cloanto-net-1 356/udp +bhevent 357/tcp +bhevent 357/udp +shrinkwrap 358/tcp +shrinkwrap 358/udp +tenebris_nts 359/tcp #Tenebris Network Trace Service +tenebris_nts 359/udp #Tenebris Network Trace Service +scoi2odialog 360/tcp +scoi2odialog 360/udp +semantix 361/tcp +semantix 361/udp +srssend 362/tcp #SRS Send +srssend 362/udp #SRS Send +rsvp_tunnel 363/tcp +rsvp_tunnel 363/udp +aurora-cmgr 364/tcp +aurora-cmgr 364/udp +dtk 365/tcp #Deception Tool Kit - Fred Cohen <fc@all.net> +dtk 365/udp #Deception Tool Kit - Fred Cohen <fc@all.net> +odmr 366/tcp +odmr 366/udp +mortgageware 367/tcp +mortgageware 367/udp +qbikgdp 368/tcp #QbikGDP +qbikgdp 368/udp +rpc2portmap 369/tcp +rpc2portmap 369/udp +codaauth2 370/tcp +codaauth2 370/udp +clearcase 371/tcp +clearcase 371/udp +ulistserv 372/tcp ulistproc #Unix Listserv +ulistserv 372/udp ulistproc #Unix Listserv +legent-1 373/tcp #Legent Corporation (now Computer Associates Intl.) +legent-1 373/udp #Legent Corporation (now Computer Associates Intl.) +legent-2 374/tcp #Legent Corporation (now Computer Associates Intl.) +legent-2 374/udp #Legent Corporation (now Computer Associates Intl.) +hassle 375/tcp +hassle 375/udp +nip 376/tcp #Amiga Envoy Network Inquiry Proto +nip 376/udp #Amiga Envoy Network Inquiry Proto +tnETOS 377/tcp #NEC Corporation +tnETOS 377/udp #NEC Corporation +dsETOS 378/tcp #NEC Corporation +dsETOS 378/udp #NEC Corporation +is99c 379/tcp #TIA/EIA/IS-99 modem client +is99c 379/udp #TIA/EIA/IS-99 modem client +is99s 380/tcp #TIA/EIA/IS-99 modem server +is99s 380/udp #TIA/EIA/IS-99 modem server +hp-collector 381/tcp #hp performance data collector +hp-collector 381/udp #hp performance data collector +hp-managed-node 382/tcp #hp performance data managed node +hp-managed-node 382/udp #hp performance data managed node +hp-alarm-mgr 383/tcp #hp performance data alarm manager +hp-alarm-mgr 383/udp #hp performance data alarm manager +arns 384/tcp #A Remote Network Server System +arns 384/udp #A Remote Network Server System +ibm-app 385/tcp #IBM Application +ibm-app 385/udp #IBM Application +asa 386/tcp #ASA Message Router Object Def. +asa 386/udp #ASA Message Router Object Def. +aurp 387/tcp #Appletalk Update-Based Routing Pro. +aurp 387/udp #Appletalk Update-Based Routing Pro. +unidata-ldm 388/tcp #Unidata LDM Version 4 +unidata-ldm 388/udp #Unidata LDM Version 4 +ldap 389/tcp #Lightweight Directory Access Protocol +ldap 389/udp #Lightweight Directory Access Protocol +uis 390/tcp +uis 390/udp +synotics-relay 391/tcp #SynOptics SNMP Relay Port +synotics-relay 391/udp #SynOptics SNMP Relay Port +synotics-broker 392/tcp #SynOptics Port Broker Port +synotics-broker 392/udp #SynOptics Port Broker Port +dis 393/tcp #Data Interpretation System +dis 393/udp #Data Interpretation System +embl-ndt 394/tcp #EMBL Nucleic Data Transfer +embl-ndt 394/udp #EMBL Nucleic Data Transfer +netcp 395/tcp #NETscout Control Protocol +netcp 395/udp #NETscout Control Protocol +netware-ip 396/tcp #Novell Netware over IP +netware-ip 396/udp #Novell Netware over IP +mptn 397/tcp #Multi Protocol Trans. Net. +mptn 397/udp #Multi Protocol Trans. Net. +kryptolan 398/tcp +kryptolan 398/udp +iso-tsap-c2 399/tcp #ISO-TSAP Class 2 +iso-tsap-c2 399/udp #ISO-TSAP Class 2 +work-sol 400/tcp #Workstation Solutions +work-sol 400/udp #Workstation Solutions +ups 401/tcp #Uninterruptible Power Supply +ups 401/udp #Uninterruptible Power Supply +genie 402/tcp #Genie Protocol +genie 402/udp #Genie Protocol +decap 403/tcp +decap 403/udp +nced 404/tcp +nced 404/udp +ncld 405/tcp +ncld 405/udp +imsp 406/tcp #Interactive Mail Support Protocol +imsp 406/udp #Interactive Mail Support Protocol +timbuktu 407/tcp +timbuktu 407/udp +prm-sm 408/tcp #Prospero Resource Manager Sys. Man. +prm-sm 408/udp #Prospero Resource Manager Sys. Man. +prm-nm 409/tcp #Prospero Resource Manager Node Man. +prm-nm 409/udp #Prospero Resource Manager Node Man. +decladebug 410/tcp #DECLadebug Remote Debug Protocol +decladebug 410/udp #DECLadebug Remote Debug Protocol +rmt 411/tcp #Remote MT Protocol +rmt 411/udp #Remote MT Protocol +synoptics-trap 412/tcp #Trap Convention Port +synoptics-trap 412/udp #Trap Convention Port +smsp 413/tcp +smsp 413/udp +infoseek 414/tcp +infoseek 414/udp +bnet 415/tcp +bnet 415/udp +silverplatter 416/tcp +silverplatter 416/udp +onmux 417/tcp +onmux 417/udp +hyper-g 418/tcp +hyper-g 418/udp +ariel1 419/tcp +ariel1 419/udp +smpte 420/tcp +smpte 420/udp +ariel2 421/tcp +ariel2 421/udp +ariel3 422/tcp +ariel3 422/udp +opc-job-start 423/tcp #IBM Operations Planning and Control Start +opc-job-start 423/udp #IBM Operations Planning and Control Start +opc-job-track 424/tcp #IBM Operations Planning and Control Track +opc-job-track 424/udp #IBM Operations Planning and Control Track +icad-el 425/tcp +icad-el 425/udp +smartsdp 426/tcp +smartsdp 426/udp +svrloc 427/tcp #Server Location +svrloc 427/udp #Server Location +ocs_cmu 428/tcp +ocs_cmu 428/udp +ocs_amu 429/tcp +ocs_amu 429/udp +utmpsd 430/tcp +utmpsd 430/udp +utmpcd 431/tcp +utmpcd 431/udp +iasd 432/tcp +iasd 432/udp +nnsp 433/tcp +nnsp 433/udp +mobileip-agent 434/tcp +mobileip-agent 434/udp +mobilip-mn 435/tcp +mobilip-mn 435/udp +dna-cml 436/tcp +dna-cml 436/udp +comscm 437/tcp +comscm 437/udp +dsfgw 438/tcp +dsfgw 438/udp +dasp 439/tcp +dasp 439/udp +sgcp 440/tcp +sgcp 440/udp +decvms-sysmgt 441/tcp +decvms-sysmgt 441/udp +cvc_hostd 442/tcp +cvc_hostd 442/udp +https 443/tcp +https 443/udp +snpp 444/tcp #Simple Network Paging Protocol +snpp 444/udp #Simple Network Paging Protocol +# [RFC1568] +microsoft-ds 445/tcp +microsoft-ds 445/udp +ddm-rdb 446/tcp +ddm-rdb 446/udp +ddm-dfm 447/tcp +ddm-dfm 447/udp +ddm-ssl 448/tcp ddm-byte +ddm-ssl 448/udp ddm-byte +as-servermap 449/tcp #AS Server Mapper +as-servermap 449/udp #AS Server Mapper +tserver 450/tcp +tserver 450/udp +sfs-smp-net 451/tcp #Cray Network Semaphore server +sfs-smp-net 451/udp #Cray Network Semaphore server +sfs-config 452/tcp #Cray SFS config server +sfs-config 452/udp #Cray SFS config server +creativeserver 453/tcp #CreativeServer +creativeserver 453/udp #CreativeServer +contentserver 454/tcp #ContentServer +contentserver 454/udp #ContentServer +creativepartnr 455/tcp #CreativePartnr +creativepartnr 455/udp #CreativePartnr +macon-tcp 456/tcp +macon-udp 456/udp +scohelp 457/tcp +scohelp 457/udp +appleqtc 458/tcp #apple quick time +appleqtc 458/udp #apple quick time +ampr-rcmd 459/tcp +ampr-rcmd 459/udp +skronk 460/tcp +skronk 460/udp +datasurfsrv 461/tcp +datasurfsrv 461/udp +datasurfsrvsec 462/tcp +datasurfsrvsec 462/udp +alpes 463/tcp +alpes 463/udp +# +kpasswd5 464/tcp # Kerberos (v5) +kpasswd5 464/udp # Kerberos (v5) +#PROBLEMS!============================================================== +# IANA has offically assigned these two ports as ``kpasswd'' +#kpasswd 464/tcp # Kerberos (v5) +#kpasswd 464/udp # Kerberos (v5) +#PROBLEMS!============================================================== +smtps 465/tcp #smtp protocol over TLS/SSL (was ssmtp) +smtps 465/udp #smtp protocol over TLS/SSL (was ssmtp) +digital-vrc 466/tcp +digital-vrc 466/udp +mylex-mapd 467/tcp +mylex-mapd 467/udp +photuris 468/tcp +photuris 468/udp +rcp 469/tcp #Radio Control Protocol +rcp 469/udp #Radio Control Protocol +scx-proxy 470/tcp +scx-proxy 470/udp +mondex 471/tcp +mondex 471/udp +ljk-login 472/tcp +ljk-login 472/udp +hybrid-pop 473/tcp +hybrid-pop 473/udp +tn-tl-w1 474/tcp +tn-tl-w2 474/udp +tcpnethaspsrv 475/tcp +tcpnethaspsrv 475/udp +tn-tl-fd1 476/tcp +tn-tl-fd1 476/udp +ss7ns 477/tcp +ss7ns 477/udp +spsc 478/tcp +spsc 478/udp +iafserver 479/tcp +iafserver 479/udp +iafdbase 480/tcp +iafdbase 480/udp +ph 481/tcp +ph 481/udp +bgs-nsi 482/tcp +bgs-nsi 482/udp +ulpnet 483/tcp +ulpnet 483/udp +integra-sme 484/tcp #Integra Software Management Environment +integra-sme 484/udp #Integra Software Management Environment +powerburst 485/tcp #Air Soft Power Burst +powerburst 485/udp #Air Soft Power Burst +avian 486/tcp +avian 486/udp +saft 487/tcp #saft Simple Asynchronous File Transfer +saft 487/udp #saft Simple Asynchronous File Transfer +gss-http 488/tcp +gss-http 488/udp +nest-protocol 489/tcp +nest-protocol 489/udp +micom-pfs 490/tcp +micom-pfs 490/udp +go-login 491/tcp +go-login 491/udp +ticf-1 492/tcp #Transport Independent Convergence for FNA +ticf-1 492/udp #Transport Independent Convergence for FNA +ticf-2 493/tcp #Transport Independent Convergence for FNA +ticf-2 493/udp #Transport Independent Convergence for FNA +pov-ray 494/tcp +pov-ray 494/udp +intecourier 495/tcp +intecourier 495/udp +pim-rp-disc 496/tcp +pim-rp-disc 496/udp +dantz 497/tcp +dantz 497/udp +siam 498/tcp +siam 498/udp +iso-ill 499/tcp #ISO ILL Protocol +iso-ill 499/udp #ISO ILL Protocol +isakmp 500/tcp +isakmp 500/udp +stmf 501/tcp +stmf 501/udp +asa-appl-proto 502/tcp +asa-appl-proto 502/udp +intrinsa 503/tcp +intrinsa 503/udp +citadel 504/tcp +citadel 504/udp +mailbox-lm 505/tcp +mailbox-lm 505/udp +ohimsrv 506/tcp +ohimsrv 506/udp +crs 507/tcp +crs 507/udp +xvttp 508/tcp +xvttp 508/udp +snare 509/tcp +snare 509/udp +fcp 510/tcp #FirstClass Protocol +fcp 510/udp #FirstClass Protocol +passgo 511/tcp +passgo 511/udp +# +# Berkeley-specific services +# +exec 512/tcp #remote process execution; +# authentication performed using +# passwords and UNIX login names +biff 512/udp comsat #used by mail system to notify users +# of new mail received; currently +# receives messages only from +# processes on the same machine +login 513/tcp #remote login a la telnet; +# automatic authentication performed +# based on priviledged port numbers +# and distributed data bases which +# identify "authentication domains" +who 513/udp whod #maintains data bases showing who's +# logged in to machines on a local +# net and the load average of the +# machine +shell 514/tcp cmd #like exec, but automatic +# authentication is performed as for +# login server +syslog 514/udp +printer 515/tcp spooler +printer 515/udp spooler +videotex 516/tcp +videotex 516/udp +talk 517/tcp #like tenex link, but across +# machine - unfortunately, doesn't +# use link protocol (this is actually +# just a rendezvous port from which a +# tcp connection is established) +talk 517/udp #like tenex link, but across +# machine - unfortunately, doesn't +# use link protocol (this is actually +# just a rendezvous port from which a +# tcp connection is established) +ntalk 518/tcp +ntalk 518/udp +utime 519/tcp unixtime +utime 519/udp unixtime +efs 520/tcp #extended file name server +router 520/udp route routed #local routing process (on site); +# uses variant of Xerox NS routing +# information protocol +ripng 521/tcp +ripng 521/udp +ulp 522/tcp +ulp 522/udp +ibm-db2 523/tcp +ibm-db2 523/udp +ncp 524/tcp +ncp 524/udp +timed 525/tcp timeserver +timed 525/udp timeserver +tempo 526/tcp newdate +tempo 526/udp newdate +stx 527/tcp #Stock IXChange +stx 527/udp #Stock IXChange +custix 528/tcp #Customer IXChange +custix 528/udp #Customer IXChange +irc-serv 529/tcp +irc-serv 529/udp +courier 530/tcp rpc +courier 530/udp rpc +conference 531/tcp chat +conference 531/udp chat +netnews 532/tcp readnews +netnews 532/udp readnews +netwall 533/tcp #for emergency broadcasts +netwall 533/udp #for emergency broadcasts +mm-admin 534/tcp #MegaMedia Admin +mm-admin 534/udp #MegaMedia Admin +iiop 535/tcp +iiop 535/udp +opalis-rdv 536/tcp +opalis-rdv 536/udp +nmsp 537/tcp #Networked Media Streaming Protocol +nmsp 537/udp #Networked Media Streaming Protocol +gdomap 538/tcp +gdomap 538/udp +apertus-ldp 539/tcp #Apertus Technologies Load Determination +apertus-ldp 539/udp #Apertus Technologies Load Determination +uucp 540/tcp uucpd +uucp 540/udp uucpd +uucp-rlogin 541/tcp +uucp-rlogin 541/udp +commerce 542/tcp +commerce 542/udp +klogin 543/tcp # Kerberos (v4/v5) +klogin 543/udp # Kerberos (v4/v5) +kshell 544/tcp krcmd # Kerberos (v4/v5) +kshell 544/udp krcmd # Kerberos (v4/v5) +appleqtcsrvr 545/tcp +appleqtcsrvr 545/udp +dhcpv6-client 546/tcp #DHCPv6 Client +dhcpv6-client 546/udp #DHCPv6 Client +dhcpv6-server 547/tcp #DHCPv6 Server +dhcpv6-server 547/udp #DHCPv6 Server +afpovertcp 548/tcp #AFP over TCP +afpovertcp 548/udp #AFP over TCP +idfp 549/tcp +idfp 549/udp +new-rwho 550/tcp new-who +new-rwho 550/udp new-who +cybercash 551/tcp +cybercash 551/udp +deviceshare 552/tcp +deviceshare 552/udp +pirp 553/tcp +pirp 553/udp +rtsp 554/tcp #Real Time Stream Control Protocol +rtsp 554/udp #Real Time Stream Control Protocol +dsf 555/tcp +dsf 555/udp +remotefs 556/tcp rfs rfs_server # Brunhoff remote filesystem +remotefs 556/udp rfs rfs_server # Brunhoff remote filesystem +openvms-sysipc 557/tcp +openvms-sysipc 557/udp +sdnskmp 558/tcp +sdnskmp 558/udp +teedtap 559/tcp +teedtap 559/udp +rmonitor 560/tcp rmonitord +rmonitor 560/udp rmonitord +monitor 561/tcp +monitor 561/udp +chshell 562/tcp chcmd +chshell 562/udp chcmd +nntps 563/tcp snntp #nntp protocol over TLS/SSL +nntps 563/udp snntp #nntp protocol over TLS/SSL +9pfs 564/tcp #plan 9 file service +9pfs 564/udp #plan 9 file service +whoami 565/tcp +whoami 565/udp +streettalk 566/tcp +banyan-rpc 567/tcp +banyan-rpc 567/udp +ms-shuttle 568/tcp #Microsoft shuttle +ms-shuttle 568/udp #Microsoft shuttle +ms-rome 569/tcp #Microsoft rome +ms-rome 569/udp #Microsoft rome +meter 570/tcp #demon +meter 570/udp #demon +umeter 571/tcp #udemon +umeter 571/udp #udemon +sonar 572/tcp +sonar 572/udp +banyan-vip 573/tcp +banyan-vip 573/udp +ftp-agent 574/tcp #FTP Software Agent System +ftp-agent 574/udp #FTP Software Agent System +vemmi 575/tcp +vemmi 575/udp +ipcd 576/tcp +ipcd 576/udp +vnas 577/tcp +vnas 577/udp +ipdd 578/tcp +ipdd 578/udp +decbsrv 579/tcp +decbsrv 579/udp +sntp-heartbeat 580/tcp +sntp-heartbeat 580/udp +bdp 581/tcp #Bundle Discovery Protocol +bdp 581/udp #Bundle Discovery Protocol +scc-security 582/tcp +scc-security 582/udp +philips-vc 583/tcp #Philips Video-Conferencing +philips-vc 583/udp #Philips Video-Conferencing +keyserver 584/tcp +keyserver 584/udp +#imap4-ssl@585 never should have been allocated. See PR 46294. +#imap4-ssl 585/tcp #IMAP4+SSL (use of 585 is not recommended, +#imap4-ssl 585/udp # use 993 instead) +password-chg 586/tcp +password-chg 586/udp +submission 587/tcp +submission 587/udp +cal 588/tcp +cal 588/udp +eyelink 589/tcp +eyelink 589/udp +tns-cml 590/tcp +tns-cml 590/udp +http-alt 591/tcp #FileMaker, Inc. - HTTP Alternate (see Port 80) +http-alt 591/udp #FileMaker, Inc. - HTTP Alternate (see Port 80) +eudora-set 592/tcp +eudora-set 592/udp +http-rpc-epmap 593/tcp #HTTP RPC Ep Map +http-rpc-epmap 593/udp #HTTP RPC Ep Map +tpip 594/tcp +tpip 594/udp +cab-protocol 595/tcp +cab-protocol 595/udp +smsd 596/tcp +smsd 596/udp +ptcnameservice 597/tcp #PTC Name Service +ptcnameservice 597/udp #PTC Name Service +sco-websrvrmg3 598/tcp #SCO Web Server Manager 3 +sco-websrvrmg3 598/udp #SCO Web Server Manager 3 +acp 599/tcp #Aeolon Core Protocol +acp 599/udp #Aeolon Core Protocol +ipcserver 600/tcp #Sun IPC server +ipcserver 600/udp #Sun IPC server +nqs 607/tcp +nqs 607/udp +urm 606/tcp #Cray Unified Resource Manager +urm 606/udp #Cray Unified Resource Manager +sift-uft 608/tcp #Sender-Initiated/Unsolicited File Transfer +sift-uft 608/udp #Sender-Initiated/Unsolicited File Transfer +npmp-trap 609/tcp +npmp-trap 609/udp +npmp-local 610/tcp +npmp-local 610/udp +npmp-gui 611/tcp +npmp-gui 611/udp +sshell 614/tcp #SSLshell +sshell 614/udp +ipp 631/tcp #IPP (Internet Printing Protocol) +ipp 631/udp #IPP (Internet Printing Protocol) +ginad 634/tcp +ginad 634/udp +ldaps 636/tcp sldap #ldap protocol over TLS/SSL +ldaps 636/udp sldap +mdqs 666/tcp +mdqs 666/udp +#PROBLEMS!=============================================== +doom 666/tcp #doom Id Software +doom 666/udp #doom Id Software +#PROBLEMS!=============================================== +acap 674/tcp #Application Configuration Access Protocol +acap 674/udp #Application Configuration Access Protocol +elcsd 704/tcp #errlog copy/server daemon +elcsd 704/udp #errlog copy/server daemon +entrustmanager 709/tcp #EntrustManager +entrustmanager 709/udp #EntrustManager +netviewdm1 729/tcp #IBM NetView DM/6000 Server/Client +netviewdm1 729/udp #IBM NetView DM/6000 Server/Client +netviewdm2 730/tcp #IBM NetView DM/6000 send/tcp +netviewdm2 730/udp #IBM NetView DM/6000 send/tcp +netviewdm3 731/tcp #IBM NetView DM/6000 receive/tcp +netviewdm3 731/udp #IBM NetView DM/6000 receive/tcp +netgw 741/tcp +netgw 741/udp +netrcs 742/tcp #Network based Rev. Cont. Sys. +netrcs 742/udp #Network based Rev. Cont. Sys. +flexlm 744/tcp #Flexible License Manager +flexlm 744/udp #Flexible License Manager +fujitsu-dev 747/tcp #Fujitsu Device Control +fujitsu-dev 747/udp #Fujitsu Device Control +ris-cm 748/tcp #Russell Info Sci Calendar Manager +ris-cm 748/udp #Russell Info Sci Calendar Manager +kerberos-adm 749/tcp #Kerberos administration (v5) +kerberos-adm 749/udp #Kerberos administration (v5) +kerberos-iv 750/udp kdc # Kerberos (v4) +kerberos-iv 750/tcp kdc # Kerberos (v4) +#PROBLEMS!======================================================== +#rfile 750/tcp +#loadav 750/udp +#PROBLEMS!======================================================== +kerberos_master 751/tcp # Kerberos `kadmin' (v4) +kerberos_master 751/udp # Kerberos `kadmin' (v4) +#PROBLEMS!======================================================== +pump 751/tcp +pump 751/udp +#PROBLEMS!======================================================== +qrh 752/tcp +qrh 752/udp +rrh 753/tcp +rrh 753/udp +krb_prop 754/tcp krb5_prop # kerberos/v5 server propagation +#PROBLEMS!======================================================== +tell 754/tcp #send +#PROBLEMS!======================================================== +tell 754/udp #send +nlogin 758/tcp +nlogin 758/udp +con 759/tcp +con 759/udp +krbupdate 760/tcp kreg # Kerberos (v4) registration +#PROBLEMS!======================================================== +ns 760/tcp +#PROBLEMS!======================================================== +ns 760/udp +kpasswd 761/tcp kpwd # Kerberos (v4) "passwd" +#PROBLEMS!======================================================== +rxe 761/tcp +#PROBLEMS!======================================================== +rxe 761/udp +quotad 762/tcp +quotad 762/udp +cycleserv 763/tcp +cycleserv 763/udp +omserv 764/tcp +omserv 764/udp +webster 765/tcp +webster 765/udp +phonebook 767/tcp #phone +phonebook 767/udp #phone +vid 769/tcp +vid 769/udp +cadlock 770/tcp +cadlock 770/udp +rtip 771/tcp +rtip 771/udp +cycleserv2 772/tcp +cycleserv2 772/udp +submit 773/tcp +notify 773/udp +rpasswd 774/tcp +acmaint_dbd 774/udp +entomb 775/tcp +acmaint_transd 775/udp +wpages 776/tcp +wpages 776/udp +wpgs 780/tcp +wpgs 780/udp +concert 786/tcp +concert 786/udp +mdbs_daemon 800/tcp +mdbs_daemon 800/udp +device 801/tcp +device 801/udp +supfilesrv 871/tcp # for SUP +rsync 873/tcp +rsync 873/udp +accessbuilder 888/tcp +accessbuilder 888/udp +swat 901/tcp # samba web configuration tool +ftps-data 989/tcp # ftp protocol, data, over TLS/SSL +ftps-data 989/udp +ftps 990/tcp # ftp protocol, control, over TLS/SSL +ftps 990/udp +telnets 992/tcp # telnet protocol over TLS/SSL +telnets 992/udp +imaps 993/tcp # imap4 protocol over TLS/SSL +imaps 993/udp +ircs 994/tcp # irc protocol over TLS/SSL +ircs 994/udp +pop3s 995/tcp spop3 # pop3 protocol over TLS/SSL +pop3s 995/udp spop3 +vsinet 996/tcp +vsinet 996/udp +maitrd 997/tcp +maitrd 997/udp +busboy 998/tcp +puparp 998/udp +garcon 999/tcp +applix 999/udp #Applix ac +puprouter 999/tcp +puprouter 999/udp +cadlock 1000/tcp +ock 1000/udp +# +# REGISTERED PORT NUMBERS +# +blackjack 1025/tcp #network blackjack +blackjack 1025/udp #network blackjack +iad1 1030/tcp #BBN IAD +iad1 1030/udp #BBN IAD +iad2 1031/tcp #BBN IAD +iad2 1031/udp #BBN IAD +iad3 1032/tcp #BBN IAD +iad3 1032/udp #BBN IAD +nim 1058/tcp +nim 1058/udp +nimreg 1059/tcp +nimreg 1059/udp +instl_boots 1067/tcp #Installation Bootstrap Proto. Serv. +instl_boots 1067/udp #Installation Bootstrap Proto. Serv. +instl_bootc 1068/tcp #Installation Bootstrap Proto. Cli. +instl_bootc 1068/udp #Installation Bootstrap Proto. Cli. +socks 1080/tcp +socks 1080/udp +ansoft-lm-1 1083/tcp #Anasoft License Manager +ansoft-lm-1 1083/udp #Anasoft License Manager +ansoft-lm-2 1084/tcp #Anasoft License Manager +ansoft-lm-2 1084/udp #Anasoft License Manager +webobjects 1085/tcp #Web Objects +webobjects 1085/udp #Web Objects +kpop 1109/tcp #Unofficial +kpop 1109/udp #Unofficial +nfsd-status 1110/tcp #Cluster status info +nfsd-keepalive 1110/udp #Client status info +supfiledbg 1127/tcp # for SUP +nfa 1155/tcp #Network File Access +nfa 1155/udp #Network File Access +phone 1167/udp #conference calling +skkserv 1178/tcp #SKK (kanji input) +lupa 1212/tcp +lupa 1212/udp +nerv 1222/tcp #SNI R&D network +nerv 1222/udp #SNI R&D network +hermes 1248/tcp +hermes 1248/udp +healthd 1281/tcp #healthd +healthd 1281/udp #healthd +alta-ana-lm 1346/tcp #Alta Analytics License Manager +alta-ana-lm 1346/udp #Alta Analytics License Manager +bbn-mmc 1347/tcp #multi media conferencing +bbn-mmc 1347/udp #multi media conferencing +bbn-mmx 1348/tcp #multi media conferencing +bbn-mmx 1348/udp #multi media conferencing +sbook 1349/tcp #Registration Network Protocol +sbook 1349/udp #Registration Network Protocol +editbench 1350/tcp #Registration Network Protocol +editbench 1350/udp #Registration Network Protocol +equationbuilder 1351/tcp #Digital Tool Works (MIT) +equationbuilder 1351/udp #Digital Tool Works (MIT) +lotusnote 1352/tcp #Lotus Note +lotusnote 1352/udp #Lotus Note +relief 1353/tcp #Relief Consulting +relief 1353/udp #Relief Consulting +rightbrain 1354/tcp #RightBrain Software +rightbrain 1354/udp #RightBrain Software +intuitive-edge 1355/tcp #Intuitive Edge +intuitive-edge 1355/udp #Intuitive Edge +cuillamartin 1356/tcp #CuillaMartin Company +cuillamartin 1356/udp #CuillaMartin Company +pegboard 1357/tcp #Electronic PegBoard +pegboard 1357/udp #Electronic PegBoard +connlcli 1358/tcp +connlcli 1358/udp +ftsrv 1359/tcp +ftsrv 1359/udp +mimer 1360/tcp +mimer 1360/udp +linx 1361/tcp +linx 1361/udp +timeflies 1362/tcp +timeflies 1362/udp +ndm-requester 1363/tcp #Network DataMover Requester +ndm-requester 1363/udp #Network DataMover Requester +ndm-server 1364/tcp #Network DataMover Server +ndm-server 1364/udp #Network DataMover Server +adapt-sna 1365/tcp #Network Software Associates +adapt-sna 1365/udp #Network Software Associates +netware-csp 1366/tcp #Novell NetWare Comm Service Platform +netware-csp 1366/udp #Novell NetWare Comm Service Platform +dcs 1367/tcp +dcs 1367/udp +screencast 1368/tcp +screencast 1368/udp +gv-us 1369/tcp #GlobalView to Unix Shell +gv-us 1369/udp #GlobalView to Unix Shell +us-gv 1370/tcp #Unix Shell to GlobalView +us-gv 1370/udp #Unix Shell to GlobalView +fc-cli 1371/tcp #Fujitsu Config Protocol +fc-cli 1371/udp #Fujitsu Config Protocol +fc-ser 1372/tcp #Fujitsu Config Protocol +fc-ser 1372/udp #Fujitsu Config Protocol +chromagrafx 1373/tcp +chromagrafx 1373/udp +molly 1374/tcp #EPI Software Systems +molly 1374/udp #EPI Software Systems +bytex 1375/tcp +bytex 1375/udp +ibm-pps 1376/tcp #IBM Person to Person Software +ibm-pps 1376/udp #IBM Person to Person Software +cichlid 1377/tcp #Cichlid License Manager +cichlid 1377/udp #Cichlid License Manager +elan 1378/tcp #Elan License Manager +elan 1378/udp #Elan License Manager +dbreporter 1379/tcp #Integrity Solutions +dbreporter 1379/udp #Integrity Solutions +telesis-licman 1380/tcp #Telesis Network License Manager +telesis-licman 1380/udp #Telesis Network License Manager +apple-licman 1381/tcp #Apple Network License Manager +apple-licman 1381/udp #Apple Network License Manager +#udt_os 1382/tcp +#udt_os 1382/udp +gwha 1383/tcp #GW Hannaway Network License Manager +gwha 1383/udp #GW Hannaway Network License Manager +os-licman 1384/tcp #Objective Solutions License Manager +os-licman 1384/udp #Objective Solutions License Manager +atex_elmd 1385/tcp #Atex Publishing License Manager +atex_elmd 1385/udp #Atex Publishing License Manager +checksum 1386/tcp #CheckSum License Manager +checksum 1386/udp #CheckSum License Manager +cadsi-lm 1387/tcp #Computer Aided Design Software Inc LM +cadsi-lm 1387/udp #Computer Aided Design Software Inc LM +objective-dbc 1388/tcp #Objective Solutions DataBase Cache +objective-dbc 1388/udp #Objective Solutions DataBase Cache +iclpv-dm 1389/tcp #Document Manager +iclpv-dm 1389/udp #Document Manager +iclpv-sc 1390/tcp #Storage Controller +iclpv-sc 1390/udp #Storage Controller +iclpv-sas 1391/tcp #Storage Access Server +iclpv-sas 1391/udp #Storage Access Server +iclpv-pm 1392/tcp #Print Manager +iclpv-pm 1392/udp #Print Manager +iclpv-nls 1393/tcp #Network Log Server +iclpv-nls 1393/udp #Network Log Server +iclpv-nlc 1394/tcp #Network Log Client +iclpv-nlc 1394/udp #Network Log Client +iclpv-wsm 1395/tcp #PC Workstation Manager software +iclpv-wsm 1395/udp #PC Workstation Manager software +dvl-activemail 1396/tcp #DVL Active Mail +dvl-activemail 1396/udp #DVL Active Mail +audio-activmail 1397/tcp #Audio Active Mail +audio-activmail 1397/udp #Audio Active Mail +video-activmail 1398/tcp #Video Active Mail +video-activmail 1398/udp #Video Active Mail +cadkey-licman 1399/tcp #Cadkey License Manager +cadkey-licman 1399/udp #Cadkey License Manager +cadkey-tablet 1400/tcp #Cadkey Tablet Daemon +cadkey-tablet 1400/udp #Cadkey Tablet Daemon +goldleaf-licman 1401/tcp #Goldleaf License Manager +goldleaf-licman 1401/udp #Goldleaf License Manager +prm-sm-np 1402/tcp #Prospero Resource Manager +prm-sm-np 1402/udp #Prospero Resource Manager +prm-nm-np 1403/tcp #Prospero Resource Manager +prm-nm-np 1403/udp #Prospero Resource Manager +igi-lm 1404/tcp #Infinite Graphics License Manager +igi-lm 1404/udp #Infinite Graphics License Manager +ibm-res 1405/tcp #IBM Remote Execution Starter +ibm-res 1405/udp #IBM Remote Execution Starter +netlabs-lm 1406/tcp #NetLabs License Manager +netlabs-lm 1406/udp #NetLabs License Manager +dbsa-lm 1407/tcp #DBSA License Manager +dbsa-lm 1407/udp #DBSA License Manager +sophia-lm 1408/tcp #Sophia License Manager +sophia-lm 1408/udp #Sophia License Manager +here-lm 1409/tcp #Here License Manager +here-lm 1409/udp #Here License Manager +hiq 1410/tcp #HiQ License Manager +hiq 1410/udp #HiQ License Manager +af 1411/tcp #AudioFile +af 1411/udp #AudioFile +innosys 1412/tcp +innosys 1412/udp +innosys-acl 1413/tcp +innosys-acl 1413/udp +ibm-mqseries 1414/tcp #IBM MQSeries +ibm-mqseries 1414/udp #IBM MQSeries +dbstar 1415/tcp +dbstar 1415/udp +novell-lu6.2 1416/tcp #Novell LU6.2 +novell-lu6.2 1416/udp #Novell LU6.2 +timbuktu-srv1 1417/tcp #Timbuktu Service 1 Port +timbuktu-srv1 1417/udp #Timbuktu Service 1 Port +timbuktu-srv2 1418/tcp #Timbuktu Service 2 Port +timbuktu-srv2 1418/udp #Timbuktu Service 2 Port +timbuktu-srv3 1419/tcp #Timbuktu Service 3 Port +timbuktu-srv3 1419/udp #Timbuktu Service 3 Port +timbuktu-srv4 1420/tcp #Timbuktu Service 4 Port +timbuktu-srv4 1420/udp #Timbuktu Service 4 Port +gandalf-lm 1421/tcp #Gandalf License Manager +gandalf-lm 1421/udp #Gandalf License Manager +autodesk-lm 1422/tcp #Autodesk License Manager +autodesk-lm 1422/udp #Autodesk License Manager +essbase 1423/tcp #Essbase Arbor Software +essbase 1423/udp #Essbase Arbor Software +hybrid 1424/tcp #Hybrid Encryption Protocol +hybrid 1424/udp #Hybrid Encryption Protocol +zion-lm 1425/tcp #Zion Software License Manager +zion-lm 1425/udp #Zion Software License Manager +sas-1 1426/tcp #Satellite-data Acquisition System 1 +sas-1 1426/udp #Satellite-data Acquisition System 1 +mloadd 1427/tcp #mloadd monitoring tool +mloadd 1427/udp #mloadd monitoring tool +informatik-lm 1428/tcp #Informatik License Manager +informatik-lm 1428/udp #Informatik License Manager +nms 1429/tcp #Hypercom NMS +nms 1429/udp #Hypercom NMS +tpdu 1430/tcp #Hypercom TPDU +tpdu 1430/udp #Hypercom TPDU +rgtp 1431/tcp #Reverse Gossip Transport +rgtp 1431/udp #Reverse Gossip Transport +blueberry-lm 1432/tcp #Blueberry Software License Manager +blueberry-lm 1432/udp #Blueberry Software License Manager +ms-sql-s 1433/tcp #Microsoft-SQL-Server +ms-sql-s 1433/udp #Microsoft-SQL-Server +ms-sql-m 1434/tcp #Microsoft-SQL-Monitor +ms-sql-m 1434/udp #Microsoft-SQL-Monitor +ibm-cics 1435/tcp +ibm-cics 1435/udp +sas-2 1436/tcp #Satellite-data Acquisition System 2 +sas-2 1436/udp #Satellite-data Acquisition System 2 +tabula 1437/tcp +tabula 1437/udp +eicon-server 1438/tcp #Eicon Security Agent/Server +eicon-server 1438/udp #Eicon Security Agent/Server +eicon-x25 1439/tcp #Eicon X25/SNA Gateway +eicon-x25 1439/udp #Eicon X25/SNA Gateway +eicon-slp 1440/tcp #Eicon Service Location Protocol +eicon-slp 1440/udp #Eicon Service Location Protocol +cadis-1 1441/tcp #Cadis License Management +cadis-1 1441/udp #Cadis License Management +cadis-2 1442/tcp #Cadis License Management +cadis-2 1442/udp #Cadis License Management +ies-lm 1443/tcp #Integrated Engineering Software +ies-lm 1443/udp #Integrated Engineering Software +marcam-lm 1444/tcp #Marcam License Management +marcam-lm 1444/udp #Marcam License Management +proxima-lm 1445/tcp #Proxima License Manager +proxima-lm 1445/udp #Proxima License Manager +ora-lm 1446/tcp #Optical Research Associates License Manager +ora-lm 1446/udp #Optical Research Associates License Manager +apri-lm 1447/tcp #Applied Parallel Research LM +apri-lm 1447/udp #Applied Parallel Research LM +oc-lm 1448/tcp #OpenConnect License Manager +oc-lm 1448/udp #OpenConnect License Manager +peport 1449/tcp +peport 1449/udp +dwf 1450/tcp #Tandem Distributed Workbench Facility +dwf 1450/udp #Tandem Distributed Workbench Facility +infoman 1451/tcp #IBM Information Management +infoman 1451/udp #IBM Information Management +gtegsc-lm 1452/tcp #GTE Government Systems License Man +gtegsc-lm 1452/udp #GTE Government Systems License Man +genie-lm 1453/tcp #Genie License Manager +genie-lm 1453/udp #Genie License Manager +interhdl_elmd 1454/tcp #interHDL License Manager +interhdl_elmd 1454/udp #interHDL License Manager +esl-lm 1455/tcp #ESL License Manager +esl-lm 1455/udp #ESL License Manager +dca 1456/tcp +dca 1456/udp +valisys-lm 1457/tcp #Valisys License Manager +valisys-lm 1457/udp #Valisys License Manager +nrcabq-lm 1458/tcp #Nichols Research Corp. +nrcabq-lm 1458/udp #Nichols Research Corp. +proshare1 1459/tcp #Proshare Notebook Application +proshare1 1459/udp #Proshare Notebook Application +proshare2 1460/tcp #Proshare Notebook Application +proshare2 1460/udp #Proshare Notebook Application +ibm_wrless_lan 1461/tcp #IBM Wireless LAN +ibm_wrless_lan 1461/udp #IBM Wireless LAN +world-lm 1462/tcp #World License Manager +world-lm 1462/udp #World License Manager +nucleus 1463/tcp +nucleus 1463/udp +msl_lmd 1464/tcp #MSL License Manager +msl_lmd 1464/udp #MSL License Manager +pipes 1465/tcp #Pipes Platform +pipes 1465/udp #Pipes Platform mfarlin@peerlogic.com +oceansoft-lm 1466/tcp #Ocean Software License Manager +oceansoft-lm 1466/udp #Ocean Software License Manager +csdmbase 1467/tcp +csdmbase 1467/udp +csdm 1468/tcp +csdm 1468/udp +aal-lm 1469/tcp #Active Analysis Limited License Manager +aal-lm 1469/udp #Active Analysis Limited License Manager +uaiact 1470/tcp #Universal Analytics +uaiact 1470/udp #Universal Analytics +csdmbase 1471/tcp +csdmbase 1471/udp +csdm 1472/tcp +csdm 1472/udp +openmath 1473/tcp +openmath 1473/udp +telefinder 1474/tcp +telefinder 1474/udp +taligent-lm 1475/tcp #Taligent License Manager +taligent-lm 1475/udp #Taligent License Manager +clvm-cfg 1476/tcp +clvm-cfg 1476/udp +ms-sna-server 1477/tcp +ms-sna-server 1477/udp +ms-sna-base 1478/tcp +ms-sna-base 1478/udp +dberegister 1479/tcp +dberegister 1479/udp +pacerforum 1480/tcp +pacerforum 1480/udp +airs 1481/tcp +airs 1481/udp +miteksys-lm 1482/tcp #Miteksys License Manager +miteksys-lm 1482/udp #Miteksys License Manager +afs 1483/tcp #AFS License Manager +afs 1483/udp #AFS License Manager +confluent 1484/tcp #Confluent License Manager +confluent 1484/udp #Confluent License Manager +lansource 1485/tcp +lansource 1485/udp +nms_topo_serv 1486/tcp +nms_topo_serv 1486/udp +localinfosrvr 1487/tcp +localinfosrvr 1487/udp +docstor 1488/tcp +docstor 1488/udp +dmdocbroker 1489/tcp +dmdocbroker 1489/udp +insitu-conf 1490/tcp +insitu-conf 1490/udp +anynetgateway 1491/tcp +anynetgateway 1491/udp +stone-design-1 1492/tcp +stone-design-1 1492/udp +netmap_lm 1493/tcp +netmap_lm 1493/udp +ica 1494/tcp +ica 1494/udp +cvc 1495/tcp +cvc 1495/udp +liberty-lm 1496/tcp +liberty-lm 1496/udp +rfx-lm 1497/tcp +rfx-lm 1497/udp +watcom-sql 1498/tcp +watcom-sql 1498/udp +fhc 1499/tcp #Federico Heinz Consultora +fhc 1499/udp #Federico Heinz Consultora +vlsi-lm 1500/tcp #VLSI License Manager +vlsi-lm 1500/udp #VLSI License Manager +sas-3 1501/tcp #Satellite-data Acquisition System 3 +sas-3 1501/udp #Satellite-data Acquisition System 3 +shivadiscovery 1502/tcp #Shiva +shivadiscovery 1502/udp #Shiva +imtc-mcs 1503/tcp #Databeam +imtc-mcs 1503/udp #Databeam +evb-elm 1504/tcp #EVB Software Engineering License Manager +evb-elm 1504/udp #EVB Software Engineering License Manager +funkproxy 1505/tcp #Funk Software, Inc. +funkproxy 1505/udp #Funk Software, Inc. +utcd 1506/tcp #Universal Time daemon (utcd) +utcd 1506/udp #Universal Time daemon (utcd) +symplex 1507/tcp +symplex 1507/udp +diagmond 1508/tcp +diagmond 1508/udp +robcad-lm 1509/tcp #Robcad, Ltd. License Manager +robcad-lm 1509/udp #Robcad, Ltd. License Manager +mvx-lm 1510/tcp #Midland Valley Exploration Ltd. Lic. Man. +mvx-lm 1510/udp #Midland Valley Exploration Ltd. Lic. Man. +3l-l1 1511/tcp +3l-l1 1511/udp +wins 1512/tcp #Microsoft's Windows Internet Name Service +wins 1512/udp #Microsoft's Windows Internet Name Service +fujitsu-dtc 1513/tcp #Fujitsu Systems Business of America, Inc +fujitsu-dtc 1513/udp #Fujitsu Systems Business of America, Inc +fujitsu-dtcns 1514/tcp #Fujitsu Systems Business of America, Inc +fujitsu-dtcns 1514/udp #Fujitsu Systems Business of America, Inc +ifor-protocol 1515/tcp +ifor-protocol 1515/udp +vpad 1516/tcp #Virtual Places Audio data +vpad 1516/udp #Virtual Places Audio data +vpac 1517/tcp #Virtual Places Audio control +vpac 1517/udp #Virtual Places Audio control +vpvd 1518/tcp #Virtual Places Video data +vpvd 1518/udp #Virtual Places Video data +vpvc 1519/tcp #Virtual Places Video control +vpvc 1519/udp #Virtual Places Video control +atm-zip-office 1520/tcp #atm zip office +atm-zip-office 1520/udp #atm zip office +ncube-lm 1521/tcp #nCube License Manager +ncube-lm 1521/udp #nCube License Manager +rna-lm 1522/tcp #Ricardo North America License Manager +rna-lm 1522/udp #Ricardo North America License Manager +cichild-lm 1523/tcp +cichild-lm 1523/udp +ingreslock 1524/tcp #ingres +ingreslock 1524/udp #ingres +prospero-np 1525/tcp #Prospero Directory Service non-priv +prospero-np 1525/udp #Prospero Directory Service non-priv +#PROBLEMS!======================================================== +orasrv 1525/tcp #oracle +orasrv 1525/udp #oracle +#PROBLEMS!======================================================== +pdap-np 1526/tcp #Prospero Data Access Prot non-priv +pdap-np 1526/udp #Prospero Data Access Prot non-priv +tlisrv 1527/tcp #oracle +tlisrv 1527/udp #oracle +mciautoreg 1528/tcp +mciautoreg 1528/udp +support 1529/tcp prmsd gnatsd # cygnus bug tracker +coauthor 1529/tcp #oracle +coauthor 1529/udp #oracle +rap-service 1530/tcp +rap-service 1530/udp +rap-listen 1531/tcp +rap-listen 1531/udp +miroconnect 1532/tcp +miroconnect 1532/udp +virtual-places 1533/tcp #Virtual Places Software +virtual-places 1533/udp #Virtual Places Software +micromuse-lm 1534/tcp +micromuse-lm 1534/udp +ampr-info 1535/tcp +ampr-info 1535/udp +ampr-inter 1536/tcp +ampr-inter 1536/udp +sdsc-lm 1537/tcp +sdsc-lm 1537/udp +3ds-lm 1538/tcp +3ds-lm 1538/udp +intellistor-lm 1539/tcp #Intellistor License Manager +intellistor-lm 1539/udp #Intellistor License Manager +rds 1540/tcp +rds 1540/udp +rds2 1541/tcp +rds2 1541/udp +gridgen-elmd 1542/tcp +gridgen-elmd 1542/udp +simba-cs 1543/tcp +simba-cs 1543/udp +aspeclmd 1544/tcp +aspeclmd 1544/udp +vistium-share 1545/tcp +vistium-share 1545/udp +abbaccuray 1546/tcp +abbaccuray 1546/udp +laplink 1547/tcp +laplink 1547/udp +axon-lm 1548/tcp #Axon License Manager +axon-lm 1548/udp #Axon License Manager +shivahose 1549/tcp #Shiva Hose +shivasound 1549/udp #Shiva Sound +3m-image-lm 1550/tcp #Image Storage license manager 3M Company +3m-image-lm 1550/udp #Image Storage license manager 3M Company +hecmtl-db 1551/tcp +hecmtl-db 1551/udp +pciarray 1552/tcp +pciarray 1552/udp +issd 1600/tcp +issd 1600/udp +# IMPORTANT NOTE: Ports 1645/1646 are the traditional radius ports used by +# many vendors without obtaining official IANA assignment. The official +# assignment is now ports 1812/1813 and users are encouraged to migrate +# when possible to these new ports. +#radius 1645/udp #RADIUS authentication protocol (old) +#radacct 1646/udp #RADIUS accounting protocol (old) +nkd 1650/tcp +nkd 1650/udp +shiva_confsrvr 1651/tcp +shiva_confsrvr 1651/udp +xnmp 1652/tcp +xnmp 1652/udp +netview-aix-1 1661/tcp +netview-aix-1 1661/udp +netview-aix-2 1662/tcp +netview-aix-2 1662/udp +netview-aix-3 1663/tcp +netview-aix-3 1663/udp +netview-aix-4 1664/tcp +netview-aix-4 1664/udp +netview-aix-5 1665/tcp +netview-aix-5 1665/udp +netview-aix-6 1666/tcp +netview-aix-6 1666/udp +netview-aix-7 1667/tcp +netview-aix-7 1667/udp +netview-aix-8 1668/tcp +netview-aix-8 1668/udp +netview-aix-9 1669/tcp +netview-aix-9 1669/udp +netview-aix-10 1670/tcp +netview-aix-10 1670/udp +netview-aix-11 1671/tcp +netview-aix-11 1671/udp +netview-aix-12 1672/tcp +netview-aix-12 1672/udp +l2f 1701/tcp #l2f +l2f 1701/udp #l2f +l2tp 1701/tcp #Layer 2 Tunnelling Protocol +l2tp 1701/udp #Layer 2 Tunnelling Protocol +pptp 1723/tcp #Point-to-point tunnelling protocol +# IMPORTANT NOTE: See comments for ports 1645/1646 when using older equipment +radius 1812/udp #RADIUS authentication protocol (IANA sanctioned) +radacct 1813/udp #RADIUS accounting protocol (IANA sanctioned) +licensedaemon 1986/tcp #cisco license management +licensedaemon 1986/udp #cisco license management +tr-rsrb-p1 1987/tcp #cisco RSRB Priority 1 port +tr-rsrb-p1 1987/udp #cisco RSRB Priority 1 port +tr-rsrb-p2 1988/tcp #cisco RSRB Priority 2 port +tr-rsrb-p2 1988/udp #cisco RSRB Priority 2 port +tr-rsrb-p3 1989/tcp #cisco RSRB Priority 3 port +tr-rsrb-p3 1989/udp #cisco RSRB Priority 3 port +#PROBLEMS!=================================================== +mshnet 1989/tcp #MHSnet system +mshnet 1989/udp #MHSnet system +#PROBLEMS!=================================================== +stun-p1 1990/tcp #cisco STUN Priority 1 port +stun-p1 1990/udp #cisco STUN Priority 1 port +stun-p2 1991/tcp #cisco STUN Priority 2 port +stun-p2 1991/udp #cisco STUN Priority 2 port +stun-p3 1992/tcp #cisco STUN Priority 3 port +stun-p3 1992/udp #cisco STUN Priority 3 port +#PROBLEMS!=================================================== +ipsendmsg 1992/tcp +ipsendmsg 1992/udp +#PROBLEMS!=================================================== +snmp-tcp-port 1993/tcp #cisco SNMP TCP port +snmp-tcp-port 1993/udp #cisco SNMP TCP port +stun-port 1994/tcp #cisco serial tunnel port +stun-port 1994/udp #cisco serial tunnel port +perf-port 1995/tcp #cisco perf port +perf-port 1995/udp #cisco perf port +tr-rsrb-port 1996/tcp #cisco Remote SRB port +tr-rsrb-port 1996/udp #cisco Remote SRB port +gdp-port 1997/tcp #cisco Gateway Discovery Protocol +gdp-port 1997/udp #cisco Gateway Discovery Protocol +x25-svc-port 1998/tcp #cisco X.25 service (XOT) +x25-svc-port 1998/udp #cisco X.25 service (XOT) +tcp-id-port 1999/tcp #cisco identification port +tcp-id-port 1999/udp #cisco identification port +callbook 2000/tcp +callbook 2000/udp +dc 2001/tcp +wizard 2001/udp #curry +globe 2002/tcp +globe 2002/udp +cfingerd 2003/tcp #GNU finger +mailbox 2004/tcp +emce 2004/udp #CCWS mm conf +berknet 2005/tcp +oracle 2005/udp +invokator 2006/tcp +raid-cc 2006/udp #raid +dectalk 2007/tcp +raid-am 2007/udp +conf 2008/tcp +terminaldb 2008/udp +news 2009/tcp +whosockami 2009/udp +search 2010/tcp +pipe_server 2010/udp +raid-cc 2011/tcp #raid +servserv 2011/udp +ttyinfo 2012/tcp +raid-ac 2012/udp +raid-am 2013/tcp +raid-cd 2013/udp +troff 2014/tcp +raid-sf 2014/udp +cypress 2015/tcp +raid-cs 2015/udp +bootserver 2016/tcp +bootserver 2016/udp +cypress-stat 2017/tcp +bootclient 2017/udp +terminaldb 2018/tcp +rellpack 2018/udp +whosockami 2019/tcp +about 2019/udp +xinupageserver 2020/tcp +xinupageserver 2020/udp +servexec 2021/tcp +xinuexpansion1 2021/udp +down 2022/tcp +xinuexpansion2 2022/udp +xinuexpansion3 2023/tcp +xinuexpansion3 2023/udp +xinuexpansion4 2024/tcp +xinuexpansion4 2024/udp +ellpack 2025/tcp +xribs 2025/udp +scrabble 2026/tcp +scrabble 2026/udp +shadowserver 2027/tcp +shadowserver 2027/udp +submitserver 2028/tcp +submitserver 2028/udp +device2 2030/tcp +device2 2030/udp +blackboard 2032/tcp +blackboard 2032/udp +glogger 2033/tcp +glogger 2033/udp +scoremgr 2034/tcp +scoremgr 2034/udp +imsldoc 2035/tcp +imsldoc 2035/udp +objectmanager 2038/tcp +objectmanager 2038/udp +lam 2040/tcp +lam 2040/udp +interbase 2041/tcp +interbase 2041/udp +isis 2042/tcp +isis 2042/udp +isis-bcast 2043/tcp +isis-bcast 2043/udp +rimsl 2044/tcp +rimsl 2044/udp +cdfunc 2045/tcp +cdfunc 2045/udp +sdfunc 2046/tcp +sdfunc 2046/udp +#dls 2047/tcp +#dls 2047/udp +dls-monitor 2048/tcp +dls-monitor 2048/udp +nfsd 2049/tcp nfs # NFS server daemon +nfsd 2049/udp nfs # NFS server daemon +#PROBLEMS!============================================================= +#shilp 2049/tcp +#shilp 2049/udp +#PROBLEMS!============================================================= +dlsrpn 2065/tcp #Data Link Switch Read Port Number +dlsrpn 2065/udp #Data Link Switch Read Port Number +dlswpn 2067/tcp #Data Link Switch Write Port Number +dlswpn 2067/udp #Data Link Switch Write Port Number +zephyr-clt 2103/udp #Zephyr serv-hm connection +zephyr-hm 2104/udp #Zephyr hostmanager +#PROBLEMS!============================================================= +#zephyr-hm-srv 2105/udp #Zephyr hm-serv connection +#PROBLEMS!============================================================= +eklogin 2105/tcp #Kerberos (v4) encrypted rlogin +eklogin 2105/udp #Kerberos (v4) encrypted rlogin +ekshell 2106/tcp #Kerberos (v4) encrypted rshell +ekshell 2106/udp #Kerberos (v4) encrypted rshell +rkinit 2108/tcp #Kerberos (v4) remote initialization +rkinit 2108/udp #Kerberos (v4) remote initialization +ats 2201/tcp #Advanced Training System Program +ats 2201/udp #Advanced Training System Program +ivs-video 2232/tcp #IVS Video default +ivs-video 2232/udp #IVS Video default +ivsd 2241/tcp #IVS Daemon +ivsd 2241/udp #IVS Daemon +pehelp 2307/tcp +pehelp 2307/udp +cvspserver 2401/tcp #CVS network server +cvspserver 2401/udp #CVS network server +venus 2430/tcp #venus +venus 2430/udp #venus +venus-se 2431/tcp #venus-se +venus-se 2431/udp #venus-se +codasrv 2432/tcp #codasrv +codasrv 2432/udp #codasrv +codasrv-se 2433/tcp #codasrv-se +codasrv-se 2433/udp #codasrv-se +rtsserv 2500/tcp #Resource Tracking system server +rtsserv 2500/udp #Resource Tracking system server +rtsclient 2501/tcp #Resource Tracking system client +rtsclient 2501/udp #Resource Tracking system client +hp-3000-telnet 2564/tcp #HP 3000 NS/VT block mode telnet +zebrasrv 2600/tcp #zebra service +zebra 2601/tcp #zebra vty +ripd 2602/tcp #RIPd vty +ripngd 2603/tcp #RIPngd vty +ospfd 2604/tcp #OSPFd vty +bgpd 2605/tcp #BGPd vty +ospf6d 2606/tcp #OSPF6d vty +listen 2766/tcp #System V listener port +www-dev 2784/tcp #world wide web - development +www-dev 2784/udp #world wide web - development +dict 2628/tcp #RFC 2229 +dict 2628/udp #RFC 2229 +eppc 3031/tcp #Remote AppleEvents/PPC Toolbox +eppc 3031/udp #Remote AppleEvents/PPC Toolbox +NSWS 3049/tcp +NSWS 3049/udp +sj3 3086/tcp #SJ3 (kanji input) +vmodem 3141/tcp +vmodem 3141/udp +ccmail 3264/tcp #cc:mail/lotus +ccmail 3264/udp #cc:mail/lotus +dec-notes 3333/tcp #DEC Notes +dec-notes 3333/udp #DEC Notes +rsvp-encap 3455/udp #RSVP encapsulated in UDP +mapper-nodemgr 3984/tcp #MAPPER network node manager +mapper-nodemgr 3984/udp #MAPPER network node manager +mapper-mapethd 3985/tcp #MAPPER TCP/IP server +mapper-mapethd 3985/udp #MAPPER TCP/IP server +mapper-ws_ethd 3986/tcp #MAPPER workstation server +mapper-ws_ethd 3986/udp #MAPPER workstation server +bmap 3421/tcp #Bull Apprise portmapper +bmap 3421/udp #Bull Apprise portmapper +prsvp 3455/tcp #RSVP Port +prsvp 3455/udp #RSVP Port +vat 3456/tcp #VAT default data +vat 3456/udp #VAT default data +vat-control 3457/tcp #VAT default control +vat-control 3457/udp #VAT default control +udt_os 3900/tcp #Unidata UDT OS +udt_os 3900/udp #Unidata UDT OS +netcheque 4008/tcp #NetCheque accounting +netcheque 4008/udp #NetCheque accounting +lockd 4045/udp # NFS lock daemon/manager +lockd 4045/tcp +nuts_dem 4132/tcp #NUTS Daemon +nuts_dem 4132/udp #NUTS Daemon +nuts_bootp 4133/tcp #NUTS Bootp Server +nuts_bootp 4133/udp #NUTS Bootp Server +rwhois 4321/tcp #Remote Who Is +rwhois 4321/udp #Remote Who Is +unicall 4343/tcp +unicall 4343/udp +krb524 4444/tcp +krb524 4444/udp +# PROBLEM krb524 assigned the port, +# PROBLEM nv used it without an assignment +nv-video 4444/tcp #NV Video default +nv-video 4444/udp #NV Video default +sae-urn 4500/tcp +sae-urn 4500/udp +fax 4557/tcp #FAX transmission service +hylafax 4559/tcp #HylaFAX client-server protocol +rfa 4672/tcp #remote file access server +rfa 4672/udp #remote file access server +commplex-main 5000/tcp +commplex-main 5000/udp +commplex-link 5001/tcp +commplex-link 5001/udp +rfe 5002/tcp #radio free ethernet +rfe 5002/udp #radio free ethernet +telelpathstart 5010/tcp +telelpathstart 5010/udp +telelpathattack 5011/tcp +telelpathattack 5011/udp +mmcc 5050/tcp #multimedia conference control tool +mmcc 5050/udp #multimedia conference control tool +rmonitor_secure 5145/tcp +rmonitor_secure 5145/udp +aol 5190/tcp #America-Online +aol 5190/udp #America-Online +aol-1 5191/tcp #AmericaOnline1 +aol-1 5191/udp #AmericaOnline1 +aol-2 5192/tcp #AmericaOnline2 +aol-2 5192/udp #AmericaOnline2 +aol-3 5193/tcp #AmericaOnline3 +aol-3 5193/udp #AmericaOnline3 +jabber-client 5222/tcp #Jabber Client Connection +jabber-client 5222/udp #Jabber Client Connection +padl2sim 5236/tcp +padl2sim 5236/udp +jabber-server 5269/tcp #Jabber Server Connection +jabber-server 5269/udp #Jabber Server Connection +hacl-hb 5300/tcp # HA cluster heartbeat +hacl-hb 5300/udp # HA cluster heartbeat +hacl-gs 5301/tcp # HA cluster general services +hacl-gs 5301/udp # HA cluster general services +hacl-cfg 5302/tcp # HA cluster configuration +hacl-cfg 5302/udp # HA cluster configuration +hacl-probe 5303/tcp # HA cluster probing +hacl-probe 5303/udp # HA cluster probing +hacl-local 5304/tcp +hacl-local 5304/udp +hacl-test 5305/tcp +hacl-test 5305/udp +cfengine 5308/tcp +cfengine 5308/udp +postgresql 5432/tcp #PostgreSQL Database +postgresql 5432/udp #PostgreSQL Database +rplay 5555/udp +canna 5680/tcp #Canna (Japanese Input) +proshareaudio 5713/tcp #proshare conf audio +proshareaudio 5713/udp #proshare conf audio +prosharevideo 5714/tcp #proshare conf video +prosharevideo 5714/udp #proshare conf video +prosharedata 5715/tcp #proshare conf data +prosharedata 5715/udp #proshare conf data +prosharerequest 5716/tcp #proshare conf request +prosharerequest 5716/udp #proshare conf request +prosharenotify 5717/tcp #proshare conf notify +prosharenotify 5717/udp #proshare conf notify +cvsup 5999/tcp #CVSup file transfer/John Polstra/FreeBSD +x11 6000/tcp #6000-6063 are assigned to X Window System +x11 6000/udp +x11-ssh 6010/tcp #Unofficial name, for convenience +x11-ssh 6010/udp +softcm 6110/tcp #HP SoftBench CM +softcm 6110/udp #HP SoftBench CM +spc 6111/tcp #HP SoftBench Sub-Process Control +spc 6111/udp #HP SoftBench Sub-Process Control +meta-corp 6141/tcp #Meta Corporation License Manager +meta-corp 6141/udp #Meta Corporation License Manager +aspentec-lm 6142/tcp #Aspen Technology License Manager +aspentec-lm 6142/udp #Aspen Technology License Manager +watershed-lm 6143/tcp #Watershed License Manager +watershed-lm 6143/udp #Watershed License Manager +statsci1-lm 6144/tcp #StatSci License Manager - 1 +statsci1-lm 6144/udp #StatSci License Manager - 1 +statsci2-lm 6145/tcp #StatSci License Manager - 2 +statsci2-lm 6145/udp #StatSci License Manager - 2 +lonewolf-lm 6146/tcp #Lone Wolf Systems License Manager +lonewolf-lm 6146/udp #Lone Wolf Systems License Manager +montage-lm 6147/tcp #Montage License Manager +montage-lm 6147/udp #Montage License Manager +ricardo-lm 6148/tcp #Ricardo North America License Manager +ricardo-lm 6148/udp #Ricardo North America License Manager +xdsxdm 6558/tcp +xdsxdm 6558/udp +ircd 6667/tcp #Internet Relay Chat (unoffical) +acmsoda 6969/tcp +acmsoda 6969/udp +afs3-fileserver 7000/tcp #file server itself +afs3-fileserver 7000/udp #file server itself +afs3-callback 7001/tcp #callbacks to cache managers +afs3-callback 7001/udp #callbacks to cache managers +afs3-prserver 7002/tcp #users & groups database +afs3-prserver 7002/udp #users & groups database +afs3-vlserver 7003/tcp #volume location database +afs3-vlserver 7003/udp #volume location database +afs3-kaserver 7004/tcp #AFS/Kerberos authentication service +afs3-kaserver 7004/udp #AFS/Kerberos authentication service +afs3-volser 7005/tcp #volume management server +afs3-volser 7005/udp #volume management server +afs3-errors 7006/tcp #error interpretation service +afs3-errors 7006/udp #error interpretation service +afs3-bos 7007/tcp #basic overseer process +afs3-bos 7007/udp #basic overseer process +afs3-update 7008/tcp #server-to-server updater +afs3-update 7008/udp #server-to-server updater +afs3-rmtsys 7009/tcp #remote cache manager service +afs3-rmtsys 7009/udp #remote cache manager service +afs3-resserver 7010/tcp #MR-AFS residence server +afs3-resserver 7010/udp #MR-AFS residence server +afs3-remio 7011/tcp #MR-AFS remote IO server +afs3-remio 7011/udp #MR-AFS remote IO server +ups-onlinet 7010/tcp #onlinet uninterruptable power supplies +ups-onlinet 7010/udp #onlinet uninterruptable power supplies +font-service 7100/tcp #X Font Service +font-service 7100/udp #X Font Service +fodms 7200/tcp #FODMS FLIP +fodms 7200/udp #FODMS FLIP +dlip 7201/tcp +dlip 7201/udp +natd 8668/divert # Network Address Translation +jetdirect 9100/tcp #HP JetDirect card +man 9535/tcp +man 9535/udp +sd 9876/tcp #Session Director +sd 9876/udp #Session Director +amanda 10080/udp #Dump server control +amandaidx 10082/tcp #Amanda indexing +amidxtape 10083/tcp #Amanda tape indexing +isode-dua 17007/tcp +isode-dua 17007/udp +biimenu 18000/tcp #Beckman Instruments, Inc. +biimenu 18000/udp #Beckman Instruments, Inc. +dbbrowse 47557/tcp #Databeam Corporation +dbbrowse 47557/udp #Databeam Corporation +wnn4 22273/tcp #Wnn4 (Japanese input) +wnn4_Cn 22289/tcp #Wnn4 (Chinese input) +wnn4_Tw 22321/tcp #Wnn4 (Taiwanse input) +wnn4_Kr 22305/tcp #Wnn4 (Korean input) +wnn6 22273/tcp #Wnn6 (Japanese input) +wnn6_Cn 22289/tcp #Wnn6 (Chinese input) +wnn6_Tw 22321/tcp #Wnn6 (Taiwanse input) +wnn6_Kr 22305/tcp #Wnn6 (Korean input) +wnn6_DS 26208/tcp #Wnn6 (Dserver) diff --git a/etc/shells b/etc/shells new file mode 100644 index 0000000..ae7f33c --- /dev/null +++ b/etc/shells @@ -0,0 +1,12 @@ +# $FreeBSD: src/etc/shells,v 1.5 2000/04/27 21:58:46 ache Exp $ +# +# List of acceptable shells for chpass(1). +# Ftpd will not allow users to connect who are not using +# one of these shells. + +/bin/sh +/bin/csh +/bin/tcsh +/usr/local/bin/bash +/etc/rc.initial + diff --git a/etc/sshd b/etc/sshd new file mode 100755 index 0000000..58c3dbe --- /dev/null +++ b/etc/sshd @@ -0,0 +1,62 @@ +#! /usr/local/bin/php -f +<?php +/* + sshd - Modified to work on disk based system + Copyright 2004 Scott K Ullrich + + Original Copyright (C) 2004 Fred Mol <fredmol@xs4all.nl>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + require_once("config.inc"); + + $stderr = fopen("php://stderr", "w"); + fwrite($stderr, "Initializing module ssh...\n"); + + if (!is_dir("/var/empty")) { + // Home directory of sshd. + mkdir("/var/empty", 0555); + } + + if(!file_exists("")) { + // Login related files. + touch("/var/log/lastlog"); + } + + // Make the root password the same as the admin password of m0n0. + $fd = popen("/usr/sbin/pw usermod -n root -H 0", "w"); + fwrite($fd, $config['system']['password']); + pclose($fd); + + $sshConfigDir = "/etc/ssh"; + if (!file_exists("$sshConfigDir/ssh_host_key")) { + system("/usr/bin/ssh-keygen -t rsa1 -N '' -f $sshConfigDir/ssh_host_key"); + system("/usr/bin/ssh-keygen -t rsa -N '' -f $sshConfigDir/ssh_host_rsa_key"); + system("/usr/bin/ssh-keygen -t dsa -N '' -f $sshConfigDir/ssh_host_dsa_key"); + } + + // And finally ... + system("sshd"); + fwrite($stderr, "Done.\n"); +?> + diff --git a/etc/syslog.conf b/etc/syslog.conf new file mode 100644 index 0000000..6b7fbd9 --- /dev/null +++ b/etc/syslog.conf @@ -0,0 +1,7 @@ +local0.* %/var/log/filter.log +local3.* %/var/log/vpn.log +local7.* %/var/log/dhcpd.log +*.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local3.none;local7.none %/var/log/system.log +security.* %/var/log/system.log +auth.info;authpriv.info;daemon.info %/var/log/system.log +*.emerg * diff --git a/etc/ttys b/etc/ttys new file mode 100644 index 0000000..5cbe714 --- /dev/null +++ b/etc/ttys @@ -0,0 +1,291 @@ +# +# $FreeBSD: src/etc/etc.i386/ttys,v 1.10 2003/10/24 15:44:08 simokawa Exp $ +# @(#)ttys 5.1 (Berkeley) 4/17/89 +# +# This file specifies various information about terminals on the system. +# It is used by several different programs. Common entries for the +# various columns include: +# +# name The name of the terminal device. +# +# getty The program to start running on the terminal. Typically a +# getty program, as the name implies. Other common entries +# include none, when no getty is needed, and xdm, to start the +# X Window System. +# +# type The initial terminal type for this port. For hardwired +# terminal lines, this will contain the type of terminal used. +# For virtual consoles, the correct type is typically cons25, but +# vt220 will work better if you need interoperability with other +# systems like Solaris or GNU/Linux. +# Other common values include network for network connections on +# pseudo-terminals, dialup for incoming modem ports, and unknown +# when the terminal type cannot be predetermined. +# +# status Must be on or off. If on, init will run the getty program on +# the specified port. If the word "secure" appears, this tty +# allows root login. +# +# name getty type status comments +# +# If console is marked "insecure", then init will ask for the root password +# when going to single-user mode. +console none unknown off secure +# +ttyv0 "/usr/libexec/getty Pc" cons25 on secure +ttyp0 none network +ttyp1 none network +ttyp2 none network +ttyp3 none network +ttyp4 none network +ttyp5 none network +ttyp6 none network +ttyp7 none network +ttyp8 none network +ttyp9 none network +ttypa none network +ttypb none network +ttypc none network +ttypd none network +ttype none network +ttypf none network +ttypg none network +ttyph none network +ttypi none network +ttypj none network +ttypk none network +ttypl none network +ttypm none network +ttypn none network +ttypo none network +ttypp none network +ttypq none network +ttypr none network +ttyps none network +ttypt none network +ttypu none network +ttypv none network +ttyq0 none network +ttyq1 none network +ttyq2 none network +ttyq3 none network +ttyq4 none network +ttyq5 none network +ttyq6 none network +ttyq7 none network +ttyq8 none network +ttyq9 none network +ttyqa none network +ttyqb none network +ttyqc none network +ttyqd none network +ttyqe none network +ttyqf none network +ttyqg none network +ttyqh none network +ttyqi none network +ttyqj none network +ttyqk none network +ttyql none network +ttyqm none network +ttyqn none network +ttyqo none network +ttyqp none network +ttyqq none network +ttyqr none network +ttyqs none network +ttyqt none network +ttyqu none network +ttyqv none network +ttyr0 none network +ttyr1 none network +ttyr2 none network +ttyr3 none network +ttyr4 none network +ttyr5 none network +ttyr6 none network +ttyr7 none network +ttyr8 none network +ttyr9 none network +ttyra none network +ttyrb none network +ttyrc none network +ttyrd none network +ttyre none network +ttyrf none network +ttyrg none network +ttyrh none network +ttyri none network +ttyrj none network +ttyrk none network +ttyrl none network +ttyrm none network +ttyrn none network +ttyro none network +ttyrp none network +ttyrq none network +ttyrr none network +ttyrs none network +ttyrt none network +ttyru none network +ttyrv none network +ttys0 none network +ttys1 none network +ttys2 none network +ttys3 none network +ttys4 none network +ttys5 none network +ttys6 none network +ttys7 none network +ttys8 none network +ttys9 none network +ttysa none network +ttysb none network +ttysc none network +ttysd none network +ttyse none network +ttysf none network +ttysg none network +ttysh none network +ttysi none network +ttysj none network +ttysk none network +ttysl none network +ttysm none network +ttysn none network +ttyso none network +ttysp none network +ttysq none network +ttysr none network +ttyss none network +ttyst none network +ttysu none network +ttysv none network +ttyP0 none network +ttyP1 none network +ttyP2 none network +ttyP3 none network +ttyP4 none network +ttyP5 none network +ttyP6 none network +ttyP7 none network +ttyP8 none network +ttyP9 none network +ttyPa none network +ttyPb none network +ttyPc none network +ttyPd none network +ttyPe none network +ttyPf none network +ttyPg none network +ttyPh none network +ttyPi none network +ttyPj none network +ttyPk none network +ttyPl none network +ttyPm none network +ttyPn none network +ttyPo none network +ttyPp none network +ttyPq none network +ttyPr none network +ttyPs none network +ttyPt none network +ttyPu none network +ttyPv none network +ttyQ0 none network +ttyQ1 none network +ttyQ2 none network +ttyQ3 none network +ttyQ4 none network +ttyQ5 none network +ttyQ6 none network +ttyQ7 none network +ttyQ8 none network +ttyQ9 none network +ttyQa none network +ttyQb none network +ttyQc none network +ttyQd none network +ttyQe none network +ttyQf none network +ttyQg none network +ttyQh none network +ttyQi none network +ttyQj none network +ttyQk none network +ttyQl none network +ttyQm none network +ttyQn none network +ttyQo none network +ttyQp none network +ttyQq none network +ttyQr none network +ttyQs none network +ttyQt none network +ttyQu none network +ttyQv none network +ttyR0 none network +ttyR1 none network +ttyR2 none network +ttyR3 none network +ttyR4 none network +ttyR5 none network +ttyR6 none network +ttyR7 none network +ttyR8 none network +ttyR9 none network +ttyRa none network +ttyRb none network +ttyRc none network +ttyRd none network +ttyRe none network +ttyRf none network +ttyRg none network +ttyRh none network +ttyRi none network +ttyRj none network +ttyRk none network +ttyRl none network +ttyRm none network +ttyRn none network +ttyRo none network +ttyRp none network +ttyRq none network +ttyRr none network +ttyRs none network +ttyRt none network +ttyRu none network +ttyRv none network +ttyS0 none network +ttyS1 none network +ttyS2 none network +ttyS3 none network +ttyS4 none network +ttyS5 none network +ttyS6 none network +ttyS7 none network +ttyS8 none network +ttyS9 none network +ttySa none network +ttySb none network +ttySc none network +ttySd none network +ttySe none network +ttySf none network +ttySg none network +ttySh none network +ttySi none network +ttySj none network +ttySk none network +ttySl none network +ttySm none network +ttySn none network +ttySo none network +ttySp none network +ttySq none network +ttySr none network +ttySs none network +ttySt none network +ttySu none network +ttySv none network diff --git a/etc/version b/etc/version new file mode 100644 index 0000000..5b526c0 --- /dev/null +++ b/etc/version @@ -0,0 +1 @@ +1.2b2 |
