commit 1cf24f0aed3d67c4ba99c74ad951590d28474acc
Author: jim-p <jimp@pfsense.org>
Date:   Tue Jul 9 12:00:43 2013 -0400

    Add independent logging choices to disable logging of bogon network rules and private network rules. Add upgrade code to obey the existing behavior for users (if default block logging was disabled, so is bogon/private rule blocking). Also add a checkbox to disable the lighttpd log for people who don't want their system log spammed by lighty.

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index c562be2f2b..699ef962e0 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2613,17 +2613,22 @@ EOD;
 		/* block bogon networks */
 		/* http://www.cymru.com/Documents/bogon-bn-nonagg.txt */
 		/* file is automatically in cron every 3000 minutes */
+		if(!isset($config['syslog']['nologbogons']))
+			$bogonlog = "log";
+		else
+			$bogonlog = "";
+
 		if(isset($config['interfaces'][$on]['blockbogons'])) {
 			$ipfrules .= <<<EOD
 # block bogon networks
 # http://www.cymru.com/Documents/bogon-bn-nonagg.txt
 # http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
-block in $log quick on \${$oc['descr']} from <bogons> to any label "block bogon IPv4 networks from {$oc['descr']}"
+block in $bogonlog quick on \${$oc['descr']} from <bogons> to any label "block bogon IPv4 networks from {$oc['descr']}"
 
 EOD;
 			if(isset($config['system']['ipv6allow'])) {
 				$ipfrules .= <<<EOD
-block in $log quick on \${$oc['descr']} from <bogonsv6> to any label "block bogon IPv6 networks from {$oc['descr']}"
+block in $bogonlog quick on \${$oc['descr']} from <bogonsv6> to any label "block bogon IPv6 networks from {$oc['descr']}"
 
 EOD;
 			}
@@ -2640,17 +2645,22 @@ EOD;
 		if($oc['ip'] && !($isbridged) && isset($oc['spoofcheck']))
 			$ipfrules .= filter_rules_spoofcheck_generate($on, $oc['if'], $oc['sa'], $oc['sn'], $log);
 		/* block private networks ? */
+		if(!isset($config['syslog']['nologprivatenets']))
+			$privnetlog = "log";
+		else
+			$privnetlog = "";
+
 		if(isset($config['interfaces'][$on]['blockpriv'])) {
 			if($isbridged == false) {
 				$ipfrules .= <<<EOD
 # block anything from private networks on interfaces with the option set
 antispoof for \${$oc['descr']}
-block in $log quick on \${$oc['descr']} from 10.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 10/8"
-block in $log quick on \${$oc['descr']} from 127.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 127/8"
-block in $log quick on \${$oc['descr']} from 100.64.0.0/10 to any label "Block private networks from {$oc['descr']} block 100.64/10"
-block in $log quick on \${$oc['descr']} from 172.16.0.0/12 to any label "Block private networks from {$oc['descr']} block 172.16/12"
-block in $log quick on \${$oc['descr']} from 192.168.0.0/16 to any label "Block private networks from {$oc['descr']} block 192.168/16"
-block in $log quick on \${$oc['descr']} from fc00::/7 to any label "Block ULA networks from {$oc['descr']} block fc00::/7"
+block in $privnetlog quick on \${$oc['descr']} from 10.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 10/8"
+block in $privnetlog quick on \${$oc['descr']} from 127.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 127/8"
+block in $privnetlog quick on \${$oc['descr']} from 100.64.0.0/10 to any label "Block private networks from {$oc['descr']} block 100.64/10"
+block in $privnetlog quick on \${$oc['descr']} from 172.16.0.0/12 to any label "Block private networks from {$oc['descr']} block 172.16/12"
+block in $privnetlog quick on \${$oc['descr']} from 192.168.0.0/16 to any label "Block private networks from {$oc['descr']} block 192.168/16"
+block in $privnetlog quick on \${$oc['descr']} from fc00::/7 to any label "Block ULA networks from {$oc['descr']} block fc00::/7"
 
 EOD;
 			}
diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc
index 84139f8ed8..07dd4133a9 100644
--- a/etc/inc/globals.inc
+++ b/etc/inc/globals.inc
@@ -71,7 +71,7 @@ $g = array(
 	"disablecrashreporter" => false,
 	"crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php",
 	"debug" => false,
-	"latest_config" => "9.6",
+	"latest_config" => "9.7",
 	"nopkg_platforms" => array("cdrom"),
 	"minimum_ram_warning" => "101",
 	"minimum_ram_warning_text" => "128 MB",
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 5f5e179eae..0a5fba5bcb 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -963,6 +963,14 @@ function system_generate_lighty_config($filename,
 	else
 		$fast_cgi_path = "{$g['tmp_path']}/php-fastcgi.socket";
 
+	if(!isset($config['syslog']['nologlighttpd'])) {
+		$lighty_use_syslog = <<<EOD
+## where to send error-messages to
+server.errorlog-use-syslog="enable"
+EOD;
+	}
+
+
 	$fastcgi_config = <<<EOD
 #### fastcgi module
 ## read fastcgi.txt for more info
@@ -1011,8 +1019,7 @@ server.document-root        = "{$document_root}"
 # Maximum idle time with nothing being written (php downloading)
 server.max-write-idle = 999
 
-## where to send error-messages to
-server.errorlog-use-syslog="enable"
+{$lighty_use_syslog}
 
 # files to check for if .../ is requested
 server.indexfiles           = ( "index.php", "index.html",
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index fad204e3ed..f7c5240b20 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -3111,4 +3111,12 @@ function upgrade_095_to_096() {
 	enable_rrd_graphing();
 }
 
+function upgrade_096_to_097() {
+	global $config, $g;
+	/* If the user had disabled default block rule logging before, then bogon/private network logging was already off, so respect their choice. */
+	if (isset($config['syslog']['nologdefaultblock'])) {
+		$config['syslog']['nologbogons'] = true;
+		$config['syslog']['nologprivatenets'] = true;
+	}
+}
 ?>
diff --git a/usr/local/www/diag_logs_settings.php b/usr/local/www/diag_logs_settings.php
index 42cf79ee07..ee4fdd8972 100755
--- a/usr/local/www/diag_logs_settings.php
+++ b/usr/local/www/diag_logs_settings.php
@@ -63,6 +63,9 @@ $pconfig['logall'] = isset($config['syslog']['logall']);
 $pconfig['system'] = isset($config['syslog']['system']);
 $pconfig['enable'] = isset($config['syslog']['enable']);
 $pconfig['logdefaultblock'] = !isset($config['syslog']['nologdefaultblock']);
+$pconfig['logbogons'] = !isset($config['syslog']['nologbogons']);
+$pconfig['logprivatenets'] = !isset($config['syslog']['nologprivatenets']);
+$pconfig['loglighttpd'] = !isset($config['syslog']['nologlighttpd']);
 $pconfig['rawfilter'] = isset($config['syslog']['rawfilter']);
 $pconfig['filterdescriptions'] = $config['syslog']['filterdescriptions'];
 $pconfig['disablelocallogging'] = isset($config['syslog']['disablelocallogging']);
@@ -115,7 +118,13 @@ if ($_POST) {
 		$config['syslog']['disablelocallogging'] = $_POST['disablelocallogging'] ? true : false;
 		$config['syslog']['enable'] = $_POST['enable'] ? true : false;
 		$oldnologdefaultblock = isset($config['syslog']['nologdefaultblock']);
+		$oldnologbogons = isset($config['syslog']['nologbogons']);
+		$oldnologprivatenets = isset($config['syslog']['nologprivatenets']);
+		$oldnologlighttpd = isset($config['syslog']['nologlighttpd']);
 		$config['syslog']['nologdefaultblock'] = $_POST['logdefaultblock'] ? false : true;
+		$config['syslog']['nologbogons'] = $_POST['logbogons'] ? false : true;
+		$config['syslog']['nologprivatenets'] = $_POST['logprivatenets'] ? false : true;
+		$config['syslog']['nologlighttpd'] = $_POST['loglighttpd'] ? false : true;
 		$config['syslog']['rawfilter'] = $_POST['rawfilter'] ? true : false;
 		if (is_numeric($_POST['filterdescriptions']) && $_POST['filterdescriptions'] > 0)
 			$config['syslog']['filterdescriptions'] = $_POST['filterdescriptions'];
@@ -131,12 +140,22 @@ if ($_POST) {
 
 		$retval = 0;
 		$retval = system_syslogd_start();
-		if ($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock']))
+		if (($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock']))
+			|| ($oldnologbogons !== isset($config['syslog']['nologbogons']))
+			|| ($oldnologprivatenets !== isset($config['syslog']['nologprivatenets'])))
 			$retval |= filter_configure();
 
-		filter_pflog_start(true);
-
 		$savemsg = get_std_save_message($retval);
+
+		if ($oldnologlighttpd !== isset($config['syslog']['nologlighttpd'])) {
+			ob_flush();
+			flush();
+			log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
+			send_event("service restart webgui");
+			$savemsg .= "<br />" . gettext("WebGUI process is restarting.");
+		}
+
+		filter_pflog_start(true);
 	}
 }
 
@@ -253,11 +272,23 @@ function check_everything() {
 		</tr>
 		<tr>
 			<td valign="top" class="vtable">Log Firewall Default Blocks</td>
-			<td class="vtable"> <input name="logdefaultblock" type="checkbox" id="logdefaultblock" value="yes" <?php if ($pconfig['logdefaultblock']) echo "checked"; ?>>
-			<strong><?=gettext("Log packets blocked by the default rule");?></strong><br>
-				<?=gettext("Hint: packets that are blocked by the " .
-				"implicit default block rule will not be logged " .
-				"if you uncheck this option. Per-rule logging options are still respected.");?></td>
+			<td class="vtable">
+				<input name="logdefaultblock" type="checkbox" id="logdefaultblock" value="yes" <?php if ($pconfig['logdefaultblock']) echo "checked"; ?>>
+				<strong><?=gettext("Log packets blocked by the default rule");?></strong><br/>
+				<?=gettext("Hint: packets that are blocked by the implicit default block rule will not be logged if you uncheck this option. Per-rule logging options are still respected.");?>
+				<br/>
+				<input name="logbogons" type="checkbox" id="logbogons" value="yes" <?php if ($pconfig['logbogons']) echo "checked"; ?>>
+				<strong><?=gettext("Log packets blocked by 'Block Bogon Networks' rules");?></strong><br/>
+				<br/>
+				<input name="logprivatenets" type="checkbox" id="logprivatenets" value="yes" <?php if ($pconfig['logprivatenets']) echo "checked"; ?>>
+				<strong><?=gettext("Log packets blocked by 'Block Private Networks' rules");?></strong><br/>
+			</td>
+		</tr>
+		<tr>
+			<td valign="top" class="vtable">Web Server Log</td>
+			<td class="vtable"> <input name="loglighttpd" type="checkbox" id="loglighttpd" value="yes" <?php if ($pconfig['loglighttpd']) echo "checked"; ?>>
+			<strong><?=gettext("Log errors from the web server process.");?></strong><br>
+			<?=gettext("Hint: If this is checked, errors from the lighttpd web server process for the GUI or Captive Portal will appear in the main system log.");?></td>
 		</tr>
 		<tr>
 			<td valign="top" class="vtable">Raw Logs</td>
