summaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAgeFilesLines
* make the IPsec bypass LAN from LAN subnet to LAN subnet rather than fromChris Buechler2015-07-221-1/+1
| | | | | LAN subnet to LAN IP. Same end result except it'll work for VIPs on same interface now.
* Add IPsec advanced option for strict CRL checkingChris Buechler2015-07-221-0/+4
|
* write out built-in CRLs for strongswanChris Buechler2015-07-221-2/+18
|
* Merge pull request #1770 from phil-davis/patch-1Chris Buechler2015-07-211-0/+10
|\
| * Unset old CA and Cert in left system configPhil Davis2015-07-211-0/+8
| | | | | | Unset any old CA and Cert in the system section that might still be there from when upgrade_066_to_067 did not unset them. That will tidy up old configs that had the conversion done originally but these old sections were left behind.
| * Unset old CA and Cert in system configPhil Davis2015-07-211-0/+2
| | | | | | | | | | This looked odd. Why would we leave behind the old "ca" and "cert" section in $config["system"]? I guess it would do no harm, but seems confusing for the future to have some unused entries like this remaining in the config. Should a piece of code be put into the latest upgrade function to clean out these in any current config?
* | Merge pull request #1771 from phil-davis/patch-2Renato Botelho2015-07-211-3/+4
|\ \
| * | Allocate dnpipe and dnqueue numbers even if no filter rulesPhil Davis2015-07-211-3/+4
| |/ | | | | It would be quite unusual to have no filter rules array, but if that is indeed the case then the first part of this code that sets dnpipe and dnqueue numbers should execute anyway.
* | Captive Portal zoneid upgrade fix var name typoPhil Davis2015-07-211-1/+1
|/ | | With the typo, this empty() test would always have been true. So maybe on upgrade some existing captive portal zoneid values have been getting overwritten by this even number counter? Or?
* Merge pull request #1738 from phil-davis/Static-RoutesRenato Botelho2015-07-181-5/+5
|\
| * Fix #4813 validation of enable/disable of gateways and static routesPhil Davis2015-07-051-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) A disabled gateway can always be enabled - no extra validation needed. 2) When disabling an enabled gateway, check to see that the gateway is not used in any gateway group or enabled static route (similar tests to what is already checked before deleting a gateway). 3) A static route can always be disabled - no extra checks needed. 4) When enabling a static route, check that the selected gateway is enabled - you cannot have a static route enabled on a disabled gateway. 5) Do the address family cross-check between static route and gateway even when the static route is disabled - we do not want to save mismatched IP address families in any case. This covers all the cases I can see to ensure that the enable/disable status combinations of Gateways and Static Routes is always valid.
* | Merge pull request #1763 from doktornotor/patch-4Renato Botelho2015-07-181-4/+4
|\ \
| * | Add labels to some default firewall rulesdoktornotor2015-07-181-4/+4
| | | | | | | | | ... so that people can get useful descriptions in the System Logs - Firewall GUI, instead of useless tracker numbers. This is for master branch.
* | | Merge pull request #1759 from phil-davis/patch-2Renato Botelho2015-07-181-1/+2
|\ \ \ | |/ / |/| |
| * | Really avoid error loading rules for numeric host name in aliasPhil Davis2015-07-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create a host-type alias. Put just a number in "IP or FQDN" - e.g. I made alias name "Zqw" and a single host "23". The webGUI reports: There were error(s) loading the rules: /tmp/rules.debug:44: syntax error - The line in question reads [44]: table { 23 } and /tmp/rules.debug has: table { 23 } Zqw = "" which pf does not cope with. This change will differentiate between a number in the context of a port alias and a number that is_hostname. This time I think it really works :) The call to alias_get_type() needed to send the alias name as parameter. alias_get_type() is a bit expensive - it scans through the whole list of aliases looking for a match on the name. So I made this code just call it once for the name and then use that $alias_type var each time as it loops through all the addresses in an alias. I have tried this successfully with a few combinations of nested port/host/network aliases. But maybe there is some wacky combination of nested aliases possible that could still break this? I don't see how, but it needs testing on some configs that have all sorts of nested alias types.
* | | Fixes for IPSec ASN1.DN, ticket #4792Renato Botelho2015-07-171-7/+17
| | | | | | | | | | | | | | | | | | - Do not add leftid to confir when value is empty - When asn1dn param is in binary form, explicit type - Always add double quotes for asn1dn
* | | only add outgoing-interface if it's an IP. Ticket #4852Chris Buechler2015-07-171-2/+2
|/ /
* | Fix #4794:Renato Botelho2015-07-172-2/+23
| | | | | | | | | | - Add a upgrade code to fix asn1dn string format to match strongSwan needs - Bump config version to 11.8
* | Add leftid and rightid value between double quotes on ipsec config when type ↵Renato Botelho2015-07-162-3/+8
| | | | | | | | is asn1dn. Ticket #4792
* | Revert "Avoid error loading rules for numeric host name in alias"Renato Botelho2015-07-151-1/+1
| | | | | | | | This reverts commit 81a73bcba3b3a79bb3a7add2e14a46e6af748f50.
* | Merge pull request #1741 from phil-davis/patch-2Renato Botelho2015-07-151-6/+6
|\ \
| * | Fix issue_ip_type var name spellingPhil Davis2015-07-121-6/+6
| | | | | | | | | Actually there was no real problem, but having a mis-spelling like this means that English speakers will waste time (like I did) double-checking to see if the mis-spelling would cause a real problem.
* | | Merge pull request #1744 from phil-davis/patch-5Renato Botelho2015-07-151-1/+1
|\ \ \
| * | | Avoid error loading rules for numeric host name in aliasPhil Davis2015-07-121-1/+1
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | Create a host-type alias. Put just a number in "IP or FQDN" - e.g. I made alias name "Zqw" and a single host "23". The webGUI reports: There were error(s) loading the rules: /tmp/rules.debug:44: syntax error - The line in question reads [44]: table { 23 } and /tmp/rules.debug has: table <Zqw> { 23 } Zqw = "<Zqw>" which pf does not cope with. It is possible to have a host name that is a number, and end up with a domain name like 23.mycompany.com - unfortunately some Wally allowed such things in standards many years ago, so it can be rather difficult to tell the difference between a number and a host name. This change improves the check when looking through alias entries and deciding if they are meant to be a name or a "bottom-level" value (address, subnet, port, port range). Anything that ends up looking like a host name gets given to filterdns to sort out. "Names" like "23" now get given to filterdns instead of being put directly into the table in pf. This makes things happier. Even if filterdns cannot resolve "23", at least it tries and nothing barfs.
* | | Fix GratisDNS supportmortencombat2015-07-141-2/+2
|/ / | | | | The current implementation is not working for me, maybe the interface was changed by GratisDNS? I tested the update URL manually with the IP added ("&i=<ip>") which fixed the issue for me. Code adjusted to include IP.
* | fix fsync, thanks Phil Davis for noticingChris Buechler2015-07-101-1/+1
| |
* | fix fsyncChris Buechler2015-07-101-1/+1
| |
* | fsync after fclose here, clean up some white space while here.Chris Buechler2015-07-101-2/+9
| | | | | | | | | | Conflicts: etc/inc/config.lib.inc
* | fsync conf_path here tooChris Buechler2015-07-101-0/+1
| |
* | fix typoChris Buechler2015-07-101-1/+1
| |
* | Make sure config.xml is safe on disk when restoring a backup, ticket #4803Renato Botelho2015-07-061-0/+1
| |
* | Make sure temporary config file is safe on disk before rename, ticket #4803Renato Botelho2015-07-061-1/+1
| |
* | Remove reference to vfs.forcesyncRenato Botelho2015-07-061-1/+0
| |
* | Use right function pfSense_fsync to make sure config file is safe on disk, ↵Renato Botelho2015-07-061-4/+2
|/ | | | ticket #4803
* remove debug.pfftpproxy, it no longer exists.Chris Buechler2015-07-041-1/+0
|
* Fix keyid identifers, and go back to using %any in ipsec.secrets as in ↵Chris Buechler2015-07-031-2/+4
| | | | previous versions, fixing a variety of other ID issues. Latter will break some mobile IPsec circumstances, fix for that to come after more testing. Ticket #4811
* Improve handling of port ranges in relayd, fixes #4810jim-p2015-07-011-1/+5
|
* Fix install_package() return for failureRenato Botelho2015-07-011-1/+1
|
* Stop using undefined variable and create a single package debug fileRenato Botelho2015-07-011-1/+1
|
* Improve debug messagesRenato Botelho2015-07-011-2/+5
|
* Fix call to undefined function read_pkg_configRenato Botelho2015-07-011-1/+1
|
* Only try to remove pkg if it's installed, otherwise just cleanup xml partRenato Botelho2015-07-011-1/+6
|
* Implement get_pkg_info()Renato Botelho2015-07-011-12/+40
|
* Make pkg_delete() more verboseRenato Botelho2015-07-011-2/+3
|
* Remove packages from cache after install, also add debug messagesRenato Botelho2015-07-011-2/+6
|
* Mute call to 'pkg info -e' used to check if pkg is installedRenato Botelho2015-07-011-1/+1
|
* Re-implement pkg_call() using proc_open() and stream_select() and also ↵Renato Botelho2015-07-011-4/+124
| | | | implement pkg_exec()
* pfsense-utils.inc is being required, there is no chance of update_status() ↵Renato Botelho2015-07-011-11/+2
| | | | and update_output_window() don't exist
* Use interface-automatic for Unbound when the interfaces list is empty (same ↵jim-p2015-06-261-0/+2
| | | | as All) otherwise it breaks with a default CARP config.
* Add D1540-XG.Matt Smith2015-06-231-0/+3
|
OpenPOWER on IntegriCloud