|
1
|
<?php
|
|
2
|
/*
|
|
3
|
* system_hasync.php
|
|
4
|
*
|
|
5
|
* part of pfSense (https://www.pfsense.org)
|
|
6
|
* Copyright (c) 2004-2013 BSD Perimeter
|
|
7
|
* Copyright (c) 2013-2016 Electric Sheep Fencing
|
|
8
|
* Copyright (c) 2014-2022 Rubicon Communications, LLC (Netgate)
|
|
9
|
* All rights reserved.
|
|
10
|
*
|
|
11
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
12
|
* you may not use this file except in compliance with the License.
|
|
13
|
* You may obtain a copy of the License at
|
|
14
|
*
|
|
15
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
16
|
*
|
|
17
|
* Unless required by applicable law or agreed to in writing, software
|
|
18
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
19
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
20
|
* See the License for the specific language governing permissions and
|
|
21
|
* limitations under the License.
|
|
22
|
*/
|
|
23
|
|
|
24
|
##|+PRIV
|
|
25
|
##|*IDENT=page-system-hasync
|
|
26
|
##|*NAME=System: High Availability Sync
|
|
27
|
##|*DESCR=Allow access to the 'System: High Availability Sync' page.
|
|
28
|
##|*MATCH=system_hasync.php*
|
|
29
|
##|-PRIV
|
|
30
|
|
|
31
|
require_once("guiconfig.inc");
|
|
32
|
|
|
33
|
init_config_arr(array('hasync'));
|
|
34
|
$a_hasync = &$config['hasync'];
|
|
35
|
|
|
36
|
$checkbox_names = array(
|
|
37
|
'pfsyncenabled',
|
|
38
|
'adminsync',
|
|
39
|
'synchronizeusers',
|
|
40
|
'synchronizeauthservers',
|
|
41
|
'synchronizecerts',
|
|
42
|
'synchronizerules',
|
|
43
|
'synchronizeschedules',
|
|
44
|
'synchronizealiases',
|
|
45
|
'synchronizenat',
|
|
46
|
'synchronizeipsec',
|
|
47
|
'synchronizeopenvpn',
|
|
48
|
'synchronizedhcpd',
|
|
49
|
'synchronizedhcrelay',
|
|
50
|
'synchronizedhcrelay6',
|
|
51
|
'synchronizewol',
|
|
52
|
'synchronizestaticroutes',
|
|
53
|
'synchronizevirtualip',
|
|
54
|
'synchronizetrafficshaper',
|
|
55
|
'synchronizetrafficshaperlimiter',
|
|
56
|
'synchronizednsforwarder',
|
|
57
|
'synchronizecaptiveportal');
|
|
58
|
|
|
59
|
if ($_POST) {
|
|
60
|
$pconfig = $_POST;
|
|
61
|
foreach ($checkbox_names as $name) {
|
|
62
|
$a_hasync[$name] = $pconfig[$name] ? $pconfig[$name] : false;
|
|
63
|
}
|
|
64
|
$a_hasync['pfsyncpeerip'] = $pconfig['pfsyncpeerip'];
|
|
65
|
$a_hasync['pfsyncinterface'] = $pconfig['pfsyncinterface'];
|
|
66
|
$a_hasync['synchronizetoip'] = $pconfig['synchronizetoip'];
|
|
67
|
$a_hasync['username'] = $pconfig['username'];
|
|
68
|
|
|
69
|
if ($pconfig['passwordfld'] == $pconfig['passwordfld_confirm']) {
|
|
70
|
if ($pconfig['passwordfld'] != DMYPWD) {
|
|
71
|
$a_hasync['password'] = $pconfig['passwordfld'];
|
|
72
|
}
|
|
73
|
} else {
|
|
74
|
$input_errors[] = gettext("Password and confirmation must match.");
|
|
75
|
}
|
|
76
|
|
|
77
|
if (!empty($pconfig['pfsyncpeerip']) && !is_ipaddrv4($pconfig['pfsyncpeerip'])) {
|
|
78
|
$input_errors[] = gettext("pfsync Synchronize Peer IP must be an IPv4 IP.");
|
|
79
|
}
|
|
80
|
|
|
81
|
if (!empty($pconfig['synchronizetoip']) && !is_ipaddr($pconfig['synchronizetoip'])) {
|
|
82
|
$input_errors[] = gettext("Synchronize Config to IP must be a valid IP address.");
|
|
83
|
}
|
|
84
|
|
|
85
|
if (!$input_errors) {
|
|
86
|
write_config("Updated High Availability Sync configuration");
|
|
87
|
interfaces_sync_setup();
|
|
88
|
header("Location: system_hasync.php");
|
|
89
|
exit();
|
|
90
|
}
|
|
91
|
}
|
|
92
|
|
|
93
|
foreach ($checkbox_names as $name) {
|
|
94
|
$pconfig[$name] = $a_hasync[$name];
|
|
95
|
}
|
|
96
|
$pconfig['pfsyncpeerip'] = $a_hasync['pfsyncpeerip'];
|
|
97
|
$pconfig['pfsyncinterface'] = $a_hasync['pfsyncinterface'];
|
|
98
|
$pconfig['synchronizetoip'] = $a_hasync['synchronizetoip'];
|
|
99
|
$pconfig['username'] = $a_hasync['username'];
|
|
100
|
$pconfig['passwordfld'] = $a_hasync['password'];
|
|
101
|
|
|
102
|
$ifaces = get_configured_interface_with_descr();
|
|
103
|
$ifaces["lo0"] = "loopback";
|
|
104
|
|
|
105
|
$pgtitle = array(gettext("System"), gettext("High Availability Sync"));
|
|
106
|
$shortcut_section = "carp";
|
|
107
|
|
|
108
|
// Build a list of available interfaces
|
|
109
|
$iflist = array();
|
|
110
|
foreach ($ifaces as $ifname => $iface) {
|
|
111
|
$iflist[$ifname] = $iface;
|
|
112
|
}
|
|
113
|
|
|
114
|
include("head.inc");
|
|
115
|
|
|
116
|
if ($input_errors) {
|
|
117
|
print_input_errors($input_errors);
|
|
118
|
}
|
|
119
|
|
|
120
|
$form = new Form;
|
|
121
|
|
|
122
|
$section = new Form_Section('State Synchronization Settings (pfsync)');
|
|
123
|
|
|
124
|
$section->addInput(new Form_Checkbox(
|
|
125
|
'pfsyncenabled',
|
|
126
|
'Synchronize states',
|
|
127
|
'pfsync transfers state insertion, update, and deletion messages between firewalls.',
|
|
128
|
($pconfig['pfsyncenabled'] === 'on'),
|
|
129
|
'on'
|
|
130
|
))->setHelp('Each firewall sends these messages out via multicast on a specified interface, using the PFSYNC protocol (IP Protocol 240).' .
|
|
131
|
' It also listens on that interface for similar messages from other firewalls, and imports them into the local state table.%1$s' .
|
|
132
|
'This setting should be enabled on all members of a failover group.%1$s' .
|
|
133
|
'Clicking "Save" will force a configuration sync if it is enabled! (see Configuration Synchronization Settings below)', '<br />');
|
|
134
|
|
|
135
|
$section->addInput(new Form_Select(
|
|
136
|
'pfsyncinterface',
|
|
137
|
'Synchronize Interface',
|
|
138
|
$pconfig['pfsyncinterface'],
|
|
139
|
$iflist
|
|
140
|
))->setHelp('If Synchronize States is enabled this interface will be used for communication.%1$s' .
|
|
141
|
'It is recommended to set this to an interface other than LAN! A dedicated interface works the best.%1$s' .
|
|
142
|
'An IP must be defined on each machine participating in this failover group.%1$s' .
|
|
143
|
'An IP must be assigned to the interface on any participating sync nodes.', '<br />');
|
|
144
|
|
|
145
|
$section->addInput(new Form_Input(
|
|
146
|
'pfsyncpeerip',
|
|
147
|
'pfsync Synchronize Peer IP',
|
|
148
|
'text',
|
|
149
|
$pconfig['pfsyncpeerip'],
|
|
150
|
['placeholder' => 'IP Address']
|
|
151
|
))->setHelp('Setting this option will force pfsync to synchronize its state table to this IP address. The default is directed multicast.');
|
|
152
|
|
|
153
|
$form->add($section);
|
|
154
|
|
|
155
|
$section = new Form_Section('Configuration Synchronization Settings (XMLRPC Sync)');
|
|
156
|
|
|
157
|
$section->addInput(new Form_Input(
|
|
158
|
'synchronizetoip',
|
|
159
|
'Synchronize Config to IP',
|
|
160
|
'text',
|
|
161
|
$pconfig['synchronizetoip'],
|
|
162
|
['placeholder' => 'IP Address']
|
|
163
|
))->setHelp('Enter the IP address of the firewall to which the selected configuration sections should be synchronized.%1$s%1$s' .
|
|
164
|
'XMLRPC sync is currently only supported over connections using the same protocol and port as this system - make sure the remote system\'s port and protocol are set accordingly!%1$s' .
|
|
165
|
'Do not use the Synchronize Config to IP and password option on backup cluster members!', '<br />');
|
|
166
|
|
|
167
|
$section->addInput(new Form_Input(
|
|
168
|
'username',
|
|
169
|
'Remote System Username',
|
|
170
|
'text',
|
|
171
|
$pconfig['username'],
|
|
172
|
['autocomplete' => 'new-password']
|
|
173
|
))->setHelp('Enter the webConfigurator username of the system entered above for synchronizing the configuration.%1$s' .
|
|
174
|
'Do not use the Synchronize Config to IP and username option on backup cluster members!', '<br />');
|
|
175
|
|
|
176
|
$section->addPassword(new Form_Input(
|
|
177
|
'passwordfld',
|
|
178
|
'Remote System Password',
|
|
179
|
'password',
|
|
180
|
$pconfig['passwordfld']
|
|
181
|
))->setHelp('Enter the webConfigurator password of the system entered above for synchronizing the configuration.%1$s' .
|
|
182
|
'Do not use the Synchronize Config to IP and password option on backup cluster members!', '<br />');
|
|
183
|
|
|
184
|
$section->addInput(new Form_Checkbox(
|
|
185
|
'adminsync',
|
|
186
|
'Synchronize admin',
|
|
187
|
'synchronize admin accounts and autoupdate sync password.',
|
|
188
|
($pconfig['adminsync'] === 'on'),
|
|
189
|
'on'
|
|
190
|
))->setHelp('By default, the admin account does not synchronize, and each node may have a different admin password.%1$s' .
|
|
191
|
'This option automatically updates XMLRPC Remote System Password when the password is changed on
|
|
192
|
the Remote System Username account.', '<br />');
|
|
193
|
|
|
194
|
$group = new Form_MultiCheckboxGroup('Select options to sync');
|
|
195
|
|
|
196
|
$group->add(new Form_MultiCheckbox(
|
|
197
|
'synchronizeusers',
|
|
198
|
'Synchronize Users and Groups',
|
|
199
|
'User manager users and groups',
|
|
200
|
($pconfig['synchronizeusers'] === 'on'),
|
|
201
|
'on'
|
|
202
|
));
|
|
203
|
|
|
204
|
$group->add(new Form_MultiCheckbox(
|
|
205
|
'synchronizeauthservers',
|
|
206
|
'Synchronize Auth Servers',
|
|
207
|
'Authentication servers (e.g. LDAP, RADIUS)',
|
|
208
|
($pconfig['synchronizeauthservers'] === 'on'),
|
|
209
|
'on'
|
|
210
|
));
|
|
211
|
|
|
212
|
$group->add(new Form_MultiCheckbox(
|
|
213
|
'synchronizecerts',
|
|
214
|
'Synchronize Certificates',
|
|
215
|
'Certificate Authorities, Certificates, and Certificate Revocation Lists',
|
|
216
|
($pconfig['synchronizecerts'] === 'on'),
|
|
217
|
'on'
|
|
218
|
));
|
|
219
|
|
|
220
|
$group->add(new Form_MultiCheckbox(
|
|
221
|
'synchronizerules',
|
|
222
|
'Synchronize Rules',
|
|
223
|
'Firewall rules ',
|
|
224
|
($pconfig['synchronizerules'] === 'on'),
|
|
225
|
'on'
|
|
226
|
));
|
|
227
|
|
|
228
|
$group->add(new Form_MultiCheckbox(
|
|
229
|
'synchronizeschedules',
|
|
230
|
'Synchronize Firewall schedules',
|
|
231
|
'Firewall schedules ',
|
|
232
|
($pconfig['synchronizeschedules'] === 'on'),
|
|
233
|
'on'
|
|
234
|
));
|
|
235
|
|
|
236
|
$group->add(new Form_MultiCheckbox(
|
|
237
|
'synchronizealiases',
|
|
238
|
'Synchronize Firewall aliases',
|
|
239
|
'Firewall aliases ',
|
|
240
|
($pconfig['synchronizealiases'] === 'on'),
|
|
241
|
'on'
|
|
242
|
));
|
|
243
|
|
|
244
|
$group->add(new Form_MultiCheckbox(
|
|
245
|
'synchronizenat',
|
|
246
|
'Synchronize NAT',
|
|
247
|
'NAT configuration ',
|
|
248
|
($pconfig['synchronizenat'] === 'on'),
|
|
249
|
'on'
|
|
250
|
));
|
|
251
|
|
|
252
|
$group->add(new Form_MultiCheckbox(
|
|
253
|
'synchronizeipsec',
|
|
254
|
'Synchronize IPsec',
|
|
255
|
'IPsec configuration ',
|
|
256
|
($pconfig['synchronizeipsec'] === 'on'),
|
|
257
|
'on'
|
|
258
|
));
|
|
259
|
|
|
260
|
$group->add(new Form_MultiCheckbox(
|
|
261
|
'synchronizeopenvpn',
|
|
262
|
'Synchronize OpenVPN',
|
|
263
|
'OpenVPN configuration (Implies CA/Cert/CRL Sync) ',
|
|
264
|
($pconfig['synchronizeopenvpn'] === 'on'),
|
|
265
|
'on'
|
|
266
|
));
|
|
267
|
|
|
268
|
$group->add(new Form_MultiCheckbox(
|
|
269
|
'synchronizedhcpd',
|
|
270
|
'Synchronize DHCPD',
|
|
271
|
'DHCP Server settings ',
|
|
272
|
($pconfig['synchronizedhcpd'] === 'on'),
|
|
273
|
'on'
|
|
274
|
));
|
|
275
|
|
|
276
|
$group->add(new Form_MultiCheckbox(
|
|
277
|
'synchronizedhcrelay',
|
|
278
|
'Synchronize DHCP Relay',
|
|
279
|
'DHCP Relay settings ',
|
|
280
|
($pconfig['synchronizedhcrelay'] === 'on'),
|
|
281
|
'on'
|
|
282
|
));
|
|
283
|
|
|
284
|
$group->add(new Form_MultiCheckbox(
|
|
285
|
'synchronizedhcrelay6',
|
|
286
|
'Synchronize DHCPv6 Relay',
|
|
287
|
'DHCPv6 Relay settings',
|
|
288
|
($pconfig['synchronizedhcrelay6'] === 'on'),
|
|
289
|
'on'
|
|
290
|
));
|
|
291
|
|
|
292
|
$group->add(new Form_MultiCheckbox(
|
|
293
|
'synchronizewol',
|
|
294
|
'Synchronize Wake-on-LAN',
|
|
295
|
'WoL Server settings ',
|
|
296
|
($pconfig['synchronizewol'] === 'on'),
|
|
297
|
'on'
|
|
298
|
));
|
|
299
|
|
|
300
|
$group->add(new Form_MultiCheckbox(
|
|
301
|
'synchronizestaticroutes',
|
|
302
|
'Synchronize Static Routes',
|
|
303
|
'Static Route configuration ',
|
|
304
|
($pconfig['synchronizestaticroutes'] === 'on'),
|
|
305
|
'on'
|
|
306
|
));
|
|
307
|
|
|
308
|
$group->add(new Form_MultiCheckbox(
|
|
309
|
'synchronizevirtualip',
|
|
310
|
'Synchronize Virtual IPs',
|
|
311
|
'Virtual IPs ',
|
|
312
|
($pconfig['synchronizevirtualip'] === 'on'),
|
|
313
|
'on'
|
|
314
|
));
|
|
315
|
|
|
316
|
$group->add(new Form_MultiCheckbox(
|
|
317
|
'synchronizetrafficshaper',
|
|
318
|
'Synchronize traffic shaper (queues)',
|
|
319
|
'Traffic Shaper configuration ',
|
|
320
|
($pconfig['synchronizetrafficshaper'] === 'on'),
|
|
321
|
'on'
|
|
322
|
));
|
|
323
|
|
|
324
|
$group->add(new Form_MultiCheckbox(
|
|
325
|
'synchronizetrafficshaperlimiter',
|
|
326
|
'Synchronize traffic shaper (limiter)',
|
|
327
|
'Traffic Shaper Limiters configuration ',
|
|
328
|
($pconfig['synchronizetrafficshaperlimiter'] === 'on'),
|
|
329
|
'on'
|
|
330
|
));
|
|
331
|
|
|
332
|
$group->add(new Form_MultiCheckbox(
|
|
333
|
'synchronizednsforwarder',
|
|
334
|
'Synchronize DNS (Forwarder/Resolver)',
|
|
335
|
'DNS Forwarder and DNS Resolver configurations ',
|
|
336
|
($pconfig['synchronizednsforwarder'] === 'on'),
|
|
337
|
'on'
|
|
338
|
));
|
|
339
|
|
|
340
|
$group->add(new Form_MultiCheckbox(
|
|
341
|
'synchronizecaptiveportal',
|
|
342
|
'Synchronize Captive Portal)',
|
|
343
|
'Captive Portal ',
|
|
344
|
($pconfig['synchronizecaptiveportal'] === 'on'),
|
|
345
|
'on'
|
|
346
|
));
|
|
347
|
|
|
348
|
$section->add($group);
|
|
349
|
|
|
350
|
$form->add($section);
|
|
351
|
|
|
352
|
print($form);
|
|
353
|
|
|
354
|
include("foot.inc");
|
