summaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAgeFilesLines
* Properly declare an error when a too-short voucher is submitted.jim-p2015-08-181-0/+3
|
* Don't lowercase the whole group namejim-p2015-08-121-2/+2
|
* Fix GUI auth from RADIUS to grab group names from the Class attribute. ↵jim-p2015-08-124-5/+28
| | | | | | Implements #935 The RADIUS server must populate the Class attribute with a string, semicolon-separated, of user groups. Similar to LDAP, local groups must exist with matching names, and privileges are determined by the local matching groups.
* only read file if it exists, and only foreach if an array.Chris Buechler2015-08-031-9/+13
|
* Merge pull request #1804 from phil-davis/bogons-not-existsRenato Botelho2015-08-031-5/+9
|\
| * Allow to create empty bogons on nanoBSDPhil Davis2015-07-301-5/+9
| | | | | | | | | | | | | | If for some reason the bogons file/s do not exist then this code creates empty ones before making any use of them in the rule set. On nanoBSD this can fail if the file system is mount RO. Protect against this possibility by use conf_mount_rw and conf_mount_ro
* | Drop support for jail platformRenato Botelho2015-07-317-65/+11
| |
* | Do not try to use a variable that is not set yetRenato Botelho2015-07-311-1/+1
| |
* | Remove extra parenthesisRenato Botelho2015-07-311-2/+2
| |
* | Add UUID to pkg user agentRenato Botelho2015-07-311-4/+14
| |
* | Define HTTP_USER_AGENT for pkg callsRenato Botelho2015-07-311-0/+2
| |
* | Introduce a new item to $g global, 'product_version' and stop reading ↵Renato Botelho2015-07-313-10/+9
| | | | | | | | /etc/version all around
* | remove the destination server's interface(s) from dhcrelay. Ticket #4908Chris Buechler2015-07-301-135/+6
| |
* | This is handled above now.jim-p2015-07-301-1/+0
| |
* | More safety belts on CP DB openjim-p2015-07-301-0/+13
| |
* | Remove unused ftmp referencesRenato Botelho2015-07-301-1/+0
| |
* | Take more care when attempting to open the CP database. Don't assume it's ↵jim-p2015-07-301-0/+10
| | | | | | | | valid before attempting to use it.
* | Reinitialize the captive portal database for a zone if it is ↵jim-p2015-07-301-10/+24
|/ | | | corrupt/unreadable. Fixes #4904
* remove old unused nopccard_platformsChris Buechler2015-07-291-1/+0
| | | | | Conflicts: etc/inc/globals.inc
* Use an alternate method to find VIP targets that should be allowed for ↵jim-p2015-07-292-20/+14
| | | | Captive Portal. Fixes #4903
* Merge pull request #1797 from phil-davis/patch-10Renato Botelho2015-07-271-1/+1
|\
| * Strip any \r when parsing URL table ports filePhil Davis2015-07-271-1/+1
| | | | | | | | If the URL table ports file at the URL specified has lines separated by "\r\n" rather than just "\n", then the code here ends up with ports that look like "80\r" "443\r" ... and group_ports() does not match any of those and the final file ends up empty. That seems a shame just because the file was made in some editor that put "\r\n" line breaks. I messed about for a while trying to make my URL table ports alias work until I realized this. This change first strips out any "\r" from the string, thus making it work with files that have either pure "\n" line breaks or "\r\n" line breaks.
* | Fix typo in variable name, spotted by Phil DavisRenato Botelho2015-07-271-1/+1
|/
* Consider url_port alias type when checking port-type aliases V2Phil Davis2015-07-271-1/+1
| | | | This time I have typed url_ports correctly.
* add a check to avoid foreach on non-arrayChris Buechler2015-07-271-0/+4
|
* Upgrade config to 11.9. Changes IPsec peer ID for EAP types to "any", to ↵Chris Buechler2015-07-251-0/+13
| | | | | | | retain previous behavior. Conflicts: etc/inc/upgrade_config.inc
* Change the log for CRLs with no data (exists but no certs revoked) to a ↵Chris Buechler2015-07-251-1/+1
| | | | warning since it's not technically an error.
* Add 'any' option for peer ID, for mobile IPsec scenarios where you can't or ↵Chris Buechler2015-07-252-1/+4
| | | | | | | don't want to check peer ID. Conflicts: usr/local/www/vpn_ipsec_phase1.php
* Only omit rightid for PSK mobile types. Flip the logic here as the 2_1 !Chris Buechler2015-07-231-2/+3
| | | | logic gets ugly.
* change iketype auto to ikev2 on upgrade. Ticket #4873Chris Buechler2015-07-231-0/+5
|
* Remove "auto", it's just a synonym for IKEv2. Ticket #4873Chris Buechler2015-07-231-3/+1
| | | | | Conflicts: usr/local/www/vpn_ipsec_phase1.php
* include vpn.inc so IPsec CRL reload works. require_once filter.inc inChris Buechler2015-07-231-0/+1
| | | | vpn.inc for callers there that haven't already included it.
* make the IPsec bypass LAN from LAN subnet to LAN subnet rather than fromChris Buechler2015-07-221-1/+1
| | | | | LAN subnet to LAN IP. Same end result except it'll work for VIPs on same interface now.
* Add IPsec advanced option for strict CRL checkingChris Buechler2015-07-221-0/+4
|
* write out built-in CRLs for strongswanChris Buechler2015-07-221-2/+18
|
* Merge pull request #1770 from phil-davis/patch-1Chris Buechler2015-07-211-0/+10
|\
| * Unset old CA and Cert in left system configPhil Davis2015-07-211-0/+8
| | | | | | Unset any old CA and Cert in the system section that might still be there from when upgrade_066_to_067 did not unset them. That will tidy up old configs that had the conversion done originally but these old sections were left behind.
| * Unset old CA and Cert in system configPhil Davis2015-07-211-0/+2
| | | | | | | | | | This looked odd. Why would we leave behind the old "ca" and "cert" section in $config["system"]? I guess it would do no harm, but seems confusing for the future to have some unused entries like this remaining in the config. Should a piece of code be put into the latest upgrade function to clean out these in any current config?
* | Merge pull request #1771 from phil-davis/patch-2Renato Botelho2015-07-211-3/+4
|\ \
| * | Allocate dnpipe and dnqueue numbers even if no filter rulesPhil Davis2015-07-211-3/+4
| |/ | | | | It would be quite unusual to have no filter rules array, but if that is indeed the case then the first part of this code that sets dnpipe and dnqueue numbers should execute anyway.
* | Captive Portal zoneid upgrade fix var name typoPhil Davis2015-07-211-1/+1
|/ | | With the typo, this empty() test would always have been true. So maybe on upgrade some existing captive portal zoneid values have been getting overwritten by this even number counter? Or?
* Merge pull request #1738 from phil-davis/Static-RoutesRenato Botelho2015-07-181-5/+5
|\
| * Fix #4813 validation of enable/disable of gateways and static routesPhil Davis2015-07-051-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) A disabled gateway can always be enabled - no extra validation needed. 2) When disabling an enabled gateway, check to see that the gateway is not used in any gateway group or enabled static route (similar tests to what is already checked before deleting a gateway). 3) A static route can always be disabled - no extra checks needed. 4) When enabling a static route, check that the selected gateway is enabled - you cannot have a static route enabled on a disabled gateway. 5) Do the address family cross-check between static route and gateway even when the static route is disabled - we do not want to save mismatched IP address families in any case. This covers all the cases I can see to ensure that the enable/disable status combinations of Gateways and Static Routes is always valid.
* | Merge pull request #1763 from doktornotor/patch-4Renato Botelho2015-07-181-4/+4
|\ \
| * | Add labels to some default firewall rulesdoktornotor2015-07-181-4/+4
| | | | | | | | | ... so that people can get useful descriptions in the System Logs - Firewall GUI, instead of useless tracker numbers. This is for master branch.
* | | Merge pull request #1759 from phil-davis/patch-2Renato Botelho2015-07-181-1/+2
|\ \ \ | |/ / |/| |
| * | Really avoid error loading rules for numeric host name in aliasPhil Davis2015-07-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create a host-type alias. Put just a number in "IP or FQDN" - e.g. I made alias name "Zqw" and a single host "23". The webGUI reports: There were error(s) loading the rules: /tmp/rules.debug:44: syntax error - The line in question reads [44]: table { 23 } and /tmp/rules.debug has: table { 23 } Zqw = "" which pf does not cope with. This change will differentiate between a number in the context of a port alias and a number that is_hostname. This time I think it really works :) The call to alias_get_type() needed to send the alias name as parameter. alias_get_type() is a bit expensive - it scans through the whole list of aliases looking for a match on the name. So I made this code just call it once for the name and then use that $alias_type var each time as it loops through all the addresses in an alias. I have tried this successfully with a few combinations of nested port/host/network aliases. But maybe there is some wacky combination of nested aliases possible that could still break this? I don't see how, but it needs testing on some configs that have all sorts of nested alias types.
* | | Fixes for IPSec ASN1.DN, ticket #4792Renato Botelho2015-07-171-7/+17
| | | | | | | | | | | | | | | | | | - Do not add leftid to confir when value is empty - When asn1dn param is in binary form, explicit type - Always add double quotes for asn1dn
* | | only add outgoing-interface if it's an IP. Ticket #4852Chris Buechler2015-07-171-2/+2
|/ /
* | Fix #4794:Renato Botelho2015-07-172-2/+23
| | | | | | | | | | - Add a upgrade code to fix asn1dn string format to match strongSwan needs - Bump config version to 11.8
OpenPOWER on IntegriCloud