pfSense

fix syntax error in ipfw command to disable on inactive interfaces

Change status.php state dump to use -vvss for more verbose info, add kenv and pbi_info.

Merge pull request #2061 from phil-davis/patch-7

Fix typo, gateway entry in config has a field called monitor, not monitorip

Redmine #4279 Package reinstall displayed when shutting down before upgrade

Use a different flag file to indicate that a package reinstall is
required after a reboot is done first. This avoids the possibility that
the user navigates in the webGUI during the time while the shutdown is...

Address a potential LFI in pkg.php and wizard.php without breaking the ability to pass relative paths
Restricts them to files under their intended base directories.

Remove txtsupport from Unbound. Of limited use, and the back end code was never ported over from the package (and is messy to do so). Ticket #5545

Merge pull request #2049 from phil-davis/patch-4

Merge pull request #2083 from phil-davis/patch-10

Merge pull request #2082 from phil-davis/patch-9

Make block bogon rule display consistent - RELENG_2_2

The block private networks and anti-lockout rules display in the firewall rules display with the schedule column blank. But the block bogon networks has an asterisk. That looks odd. I noticed it just now when looking at firewall rules in 2.3....

Backport fix #5467 to RELENG_2_2

Backport Redmine #5440 to RELENG_2_2

The code in RELENG_2_2 for system_usermanager_settings.php seems to work OK in RELENG_2_2 so I did not touch anything there.
But diag_authentication.php had nothing about $pconfig on initial page load. This extra code makes it select a reasonable default auth server when the page first loads. After that, each time the user does "Test", the page comes back with the previously selected auth server, user name and password (like it did already) - so that seems good.

Limit alias info popup size #5415 RELENG_2_2

This is code for RELENG_2_2 pfSense 2.2.5 that will limit the number of rows in the alias info popup to 100.

diag_ipsec.php - show button for child SAs only when some are established. Fix ID used by child SA disconnect button.

Unbound advanced Invoming TCP Buffers validation

There is a variable cut-paste error here. Actually it never makes any difference in practice because outgoing_num_tcp and incoming_num_tcp are both set, so the logic comes out the same.
I noticed this while reviewing stuff in master for 2.3-ALPHA - might as well back-port stuff like this so that nobody who notices will worry about it in RELENG_2_2.

Fix syntax

Let the code ready for strongswan 5.3.4, where key used to track nat were committed with a different name

Only call pfSense_ipsec_list_sa() when IPsec is enabled

Remove a redundant if and fix indentation accordingly. Fix is_array that should be an isset on the remote SPI field.

Update license on diag_ipsec.php. Keep required attributions and reference
the original m0n0wall BSD 2 clause.

Remove port information from diag_ipsec.php since it's not available on VICI, also use local-nat-t and remote-nat-t to detect when NAT-T is being used

Rework ipsec widget to use VICI

Remove diag_ipsec_xml.php, not being used

Make IPsec status page retrieve status with VICI instead of SMP

Fix up descriptive text for logging levels. Ticket #5340

Default log level where none is selected should be 3 here. Ticket #5340

Correct available log levels. Ticket #5340

Logging fixes. Ticket #5340

Merge pull request #1986 from phil-davis/patch-6

Merge pull request #1984 from phil-davis/patch-4

Use 1-6 rather than 0-5 for IPsec logging levels, to stay away from complications of 0 due to PHP stupidity. Upgrade config to add 1 to any configured log levels. Default to 1 as log level where none is configured by the user. Ticket #5340

Fix Command Prompt Download and Upload when not in English - Redmine #5343 for RELENG_2_2

Fix multi-lingual save of NAT mode Redmine # for RELENG_2_2

and forum https://forum.pfsense.org/index.php?topic=101276.0

interfaces_assign tab_array numbering

This was fixed in master for 2.3 by https://github.com/pfsense/pfsense/commit/50e6c063e6ec148917ff0bcb0bce8b0a08df5792 - in master all of these $tab_array entries, in each file that they appear in, had been modified to just use the $tab_array[] = form....

Merge pull request #1971 from doktornotor/patch-5

Limit the auth methods where "My Certificate Authority" is displayed/saved for
mobile clients. Fixes #5323.

Point people to 'Clear Package Lock' if the reinstall of packages got stuck (RELENG_2_2)

Validate that the Mobile Client settings have a valid RADIUS server selected
as the source for user authentication when EAP-RADIUS is selected as the phase
1 authentication method for mobile IPsec. Fixes #5219.

Auto-add firewall rules for DHCP Relay, same as is done for DHCP Server. Add filter reload to DHCP Relay config so rules are immediately added/removed. Ticket #4558

set enabled/disabled status accordingly on initial page load. Ticket #5284

clean up empty lines

Add all remaining log types to status.php. Ticket #5304

Merge pull request #1958 from phil-davis/patch-11

Redmine #5294 Do not delete a system group

This code checks if the user has somehow posted a group deletion for a group that has "system" scope. If so, then the delete is not done and an input error is displayed.
Note that in normal use the group manager page does not display a delete button for "system" groups, so normally this does not happen - only if the user manually messes with the $POST variables.

Redmine #5294 Do not delete a system user

This code checks if the user has somehow posted a user deletion for a user that has "system" scope. If so, then the delete iscnot done and an input error is displayed.
Note that in normal use the user manager page does not display a delete button for "system" users, so normally this does not happen - only if the user manually messes with the $POST variables.

Merge pull request #1953 from phil-davis/patch-10

correct htmlentities unintentionally removed by earlier commit

Wording of alias_info_popup tip

I noticed this while comparing alias popup behavior between 2.2.5-DEVELOPMENT and 2.3
Might as well fix the grammar here for 2.2.5
This tip does not exist in 2.3 because the popup works more nicely there and so this text is not needed....

Add support for an IPv6 pool for mobile clients.

Don't enforce the use of only IPv4 or IPv6 when using IKEv2 since it works fine with IKEv2

Specify %any where identifier is "any", so the note on these pages
actually works.

Fix up IKE auto mode

Correctly show v1/v2/auto on vpn_ipsec.php

Bring this back, I'll fix issues afterwards. Revert "Remove "auto", it's just a synonym for IKEv2. Ticket #4873"

This reverts commit 47f802694a1e1dfbbd011d7ec431c0948358b5c3.

Do a service reload of dyndns when changing gateways in case something has
changed. Ticket #5214

Ensure this only contains a partial name, not a path, before attempting to craft a full name and read the file. Fixes #5203.

Reset the value of a package field before this test in case it has no default. Fixes #5199

Redmine #5196 Remove incorrect text about DNS servers - RELENG_2_2

The correct text is already displayed under the DNS server boxes at line 892.
This should also be done to master once the conversion of services_dhcp.php to bootstrap is stable.

Redmine #4568 Preserve MLPPP settings when saving interface settings RELENG_2_2 Vagain

with errors fixed.
Supersedes https://github.com/pfsense/pfsense/pull/1781

Merge pull request #1907 from doktornotor/patch-5

Merge pull request #1921 from doktornotor/patch-20

Redmine #5162 do not allow alias rename to an existing name - RELENG_2_2

show openvpn interfaces while reassigning the interfaces for a restored config backup - RELENG_2_2

pkg_edit.php - fix issue where default value was not being populated for newly added fields

Backport from PR #1906 / PR #1787 for RELENG_2_2.

Check if the actual $fieldname element is present in the $a_pkg[$id] array before trying to assign its value. Do same with default_value. Fixes issue where default value was not being populated for newly added fields.

Merge pull request #1842 from phil-davis/GW-Widget-Monitor-IP-2-2

Merge pull request #1888 from phil-davis/TGdesc22

allow port ranges for natport. Ticket #5156

Merge pull request #1811 from phil-davis/patch-10

Work around a chicken-and-egg problem in user syncing. See #5152
See also: 5372d26d9d25d751d16865ed9d46869d3b0ec5e1

Misc encoding/display issues in the Load Balancer code

Encode server name in OpenVPN widget

Add description as a display option on Traffic Graph RELENG_2_2

Backport from master

Encode auth server name before display.

Encode alias description details before attempting to display them.

Encode the rule description before displaying back to the user in an error when attempting to delete an in-use alias.

Encode OpenVPN descriptions before display on OpenVPN status

Encode the OpenVPN server description before display on OpenVPN status

Ensure the current RRD graph category is encoded before display

Fix titles in status.php, filename can't have a slash.

• Include "ipsec statusall" output
• Include the last 100 lines of the IPsec log
• Increase system log to 500 lines
• Fix captive portal rule display to include the zone name not ID number

Fix source address selection on Test Port to handle VIPs properly.

Fix a potential XSS in voucher testing.

Add support for LDAP RFC2307 style group membership. Implements #4923

To activate, check the box for RFC2307 in the LDAP server settings and fill in the group object class (typically posixGroup).

Provide an LDAP server timeout field. Default to 25 seconds. Part of ticket #3383

Previous default was ~1m20sec.

Fix GUI auth from RADIUS to grab group names from the Class attribute. Implements #935

The RADIUS server must populate the Class attribute with a string, semicolon-separated, of user groups. Similar to LDAP, local groups must exist with matching names, and privileges are determined by the local matching groups.

Compare package version strings with compare_pkg_versions

This fixes redmine #4924

remove more old, unused platform stuff

Fix killing of individual states for IPv6. Ticket #4906

fix whitespace

Use the appropriate source and dest IPs for all state types. Ticket #4907

Add "sockstat" output to status.php

Add 'any' option for peer ID, for mobile IPsec scenarios where you can't or don't want to check peer ID.

Display monitor IP on Gateways widget

This version is for system patches to 2.2.4 systems

Remove "auto", it's just a synonym for IKEv2. Ticket #4873

include vpn.inc so IPsec CRL reload works. require_once filter.inc in
vpn.inc for callers there that haven't already included it.

Most of the flowtable bits were removed some time ago, take out the last of them too.

When a CRL is updated, refresh strongswan's CRLs.

Merge pull request #1775 from phil-davis/Interfaces-Widget-2-2

Add isset check for strictcrlpolicy

To be consistent with the checks in the rest of this code.