pfSense

<?php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 *

 * originally part of m0n0wall (http://m0n0.ch/wall)

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

define('VIP_CARP', 2);

define('VIP_IPALIAS', 3);

define('SPECIALNET_NONE', 0);

define('SPECIALNET_ANY', 1);

define('SPECIALNET_COMPAT_ADDR', 22);

define('SPECIALNET_ADDR', 2);

define('SPECIALNET_COMPAT_ADDRAL', 33);

define('SPECIALNET_ADDRAL', 3);

define('SPECIALNET_NET', 4);

define('SPECIALNET_NETAL', 5);

define('SPECIALNET_SELF', 6);

define('SPECIALNET_CLIENTS', 7);

define('SPECIALNET_IFADDR', 8);

define('SPECIALNET_IFSUB', 9);

define('SPECIALNET_IFNET', 10);

define('SPECIALNET_GROUP', 11);

define('SPECIALNET_VIPS', 12);

define('SPECIALNET_CHECKPERM', 98);

define('SPECIALNET_EXCLUDE', 99);

	return sigkillbypid($pidfile, "TERM", $waitfor);

	}

	return false;

		exec("/bin/pgrep -anx " . escapeshellarg($process), $output, $retval);

		return (intval($retval) == 0);

	}

	return false;

		while(isvalidpid($pidfile) && $waitcounter > 0) {

			$waitcounter = $waitcounter - 1;

			usleep(100000);

		}

		return $result;

}

/* kill a process by name */

function sigkillbyname($procname, $sig) {

/* kill a process by name */

function killbyname($procname) {

	global $g;

	return false;

}

function mark_subsystem_dirty($subsystem = "") {

	global $g;

function clear_subsystem_dirty($subsystem = "") {

	global $g;

	@unlink("{$g['varrun_path']}/{$subsystem}.dirty");

}

	clear_subsystem_dirty('aliases');

	clear_subsystem_dirty('filter');

	clear_subsystem_dirty('natconf');

	clear_subsystem_dirty('shaper');

}

	}

		@touch("{$g['tmp_path']}/{$lock}.lock");

		@chmod("{$g['tmp_path']}/{$lock}.lock", 0666);

	}

	if ($fp = fopen("{$g['tmp_path']}/{$lock}.lock", "w")) {

		$trycounter = 0;

				fclose($fp);

				return NULL;

			}

			sleep(1);

			$trycounter++;

		}

		return $fp;

	}

	return NULL;

}

{

	if (!is_resource($cfglckkey))

		return;

	flock($cfglckkey, LOCK_UN);

	fclose($cfglckkey);

function unlock_force($lock) {

	global $g;

	@unlink("{$g['tmp_path']}/{$lock}.lock");

}

	global $g;

	while ($try < 3) {

			fwrite($fd, $cmd);

			$resp = fread($fd, 4096);

			$try = 3;

}

function send_multiple_events($cmds) {

			foreach ($cmds as $cmd) {

				fwrite($fd, $cmd);

				$resp = fread($fd, 4096);

			fclose($fd);

			$try = 3;

	}

 * Test if a kernel module exists on disk in well-known locations

 *

 * Locations:

 *   > /boot/kernel

 *   > /bood/modules

 *

 * @param string $module_name		The name of the kernel module

 * @param string ...$add_dirs		Additional directories to search

 *

 * @return bool

 */

function is_module_available(string $module_name, string ...$add_dirs): bool

{

	/* bail if module is already loaded */

	if (is_module_loaded($module_name)) {

		return (true);

	}

	/* ensure the $module_name ends with .ko */

	if (!str_ends_with($module_name, '.ko')) {

		$module_name .= '.ko';

	}

	/* build list of well-known locations */

	$mod_dirs = [

		'/boot/kernel',

		'/boot/modules',

		...$add_dirs

	];

	/* filter list of well-known locations and cast to bool */

	return ((bool) array_filter($mod_dirs, function($mod_dir) use ($module_name) {

		return (file_exists($mod_dir . '/' . $module_name));

	}));

}

/**

 * Test if a kernel module is loaded

 *

 * @param string $module_name	The name of the kernel module

 *

 * @param bool

 */

function is_module_loaded(string $module_name): bool

{

	/* sanitize input */

	$module_name = escapeshellarg(rtrim($module_name, '.ko'));

	$base_cmd = ['/sbin/kldstat', '-q'];

	/* first pass test by module name, tests for in-kernel modules */

	$cmd = implode(' ', [...$base_cmd, '-m', $module_name]);

	exec($cmd, $out, $rc);

	/* bailout early if we found it */

	if ($rc === 0) {

		return (true);

	/* last pass test by file name */

	$cmd = implode(' ', [...$base_cmd, '-n', $module_name]);

	exec($cmd, $out, $rc);

	return ($rc === 0);

function is_numericint($arg) {

}

function gen_subnetv4($ipaddr, $bits) {

	if (is_ipaddrv4($ipaddr) && is_numericint($bits) && $bits <= 32) {

	}

	return "";

}

function gen_subnetv4_max($ipaddr, $bits) {

	if (is_ipaddrv4($ipaddr) && is_numericint($bits) && $bits <= 32) {

	return "";

		return bin_to_compressed_ip6($endip_bin);

	return "";

function gen_subnet_mask_long($bits) {

	$sm = 0;

	for ($i = 0; $i < $bits; $i++) {

		$sm >>= 1;

		$sm |= 0x80000000;

	}

	return $sm;

}

/* same as above but returns a string */

function gen_subnet_mask($bits) {

	return long2ip(gen_subnet_mask_long($bits));

}

function gen_subnet_mask_v6($bits) {

	/* Binary representation of the prefix length */

	$bin = str_repeat('1', $bits);

	/* Pad right with zeroes to reach the full address length */

	$bin = str_pad($bin, 128, '0', STR_PAD_RIGHT);

	/* Convert back to an IPv6 address style notation */

}

   Returns '' if not valid IPv4. */

   Returns '' if not valid IPv4. */

 * Convert IPv6 address to binary

 *

 * Obtained from: pear-Net_IPv6

 */

function ip6_to_bin($ip) {

	$binstr = '';

	$ip = Net_IPv6::removeNetmaskSpec($ip);

	$ip = Net_IPv6::Uncompress($ip);

	$parts = explode(':', $ip);

	foreach ( $parts as $v ) {

		$str     = base_convert($v, 16, 2);

		$binstr .= str_pad($str, 16, '0', STR_PAD_LEFT);

	}

	return $binstr;

}

/*

 * Convert IPv6 binary to uncompressed address

 *

 * Obtained from: pear-Net_IPv6

 */

function bin_to_ip6($bin) {

	$ip = "";

	if (strlen($bin) < 128) {

		$bin = str_pad($bin, 128, '0', STR_PAD_LEFT);

	}

	$parts = str_split($bin, "16");

	foreach ( $parts as $v ) {

		$str = base_convert($v, 2, 16);

		$ip .= $str.":";

	}

	$ip = substr($ip, 0, -1);

	return $ip;

}

/*

 * Convert IPv6 binary to compressed address

 */

function bin_to_compressed_ip6($bin) {

}

/*

 * Convert textual IPv6 address string to compressed address

 */

function text_to_compressed_ip6($text) {

	// Force re-compression by passing parameter 2 (force) true.

	// This ensures that supposedly-compressed formats are uncompressed

	// first then re-compressed into strictly correct form.

	// e.g. 2001:0:0:4:0:0:0:1

	// 2001::4:0:0:0:1 is a strictly-incorrect compression,

	// but maybe the user entered it like that.

	// The "force" parameter will ensure it is returned as:

	// 2001:0:0:4::1

	return Net_IPv6::compress($text, true);

 *  e.g. 192.168.0.0 to 192.168.0.255 returns 256

 */

	if (is_ipaddrv4($startip) && is_ipaddrv4($endip)) {

		//   when crossing over from 127.255.255.255 / 128.0.0.0 barrier

		return abs(ip2ulong($startip) - ip2ulong($endip)) + 1;

	}

	return -1;

}

/* Find the smallest possible subnet mask which can contain a given number of IPs

 *  e.g. 512 IPs can fit in a /23, but 513 IPs need a /22

 */

	for ($b=32; $b > 0; $b--) {

	return (32-$smallest);

}

/* Return the previous IP address before the given address */

	return long2ip32(ip2long($ip) - $offset);

/* Return the next IP address after the given address */

	return long2ip32(ip2long($ip) + $offset);

/* Return true if the first IP is 'before' the second */

function ip_less_than($ip1, $ip2) {

	// Compare as unsigned long because otherwise it wouldn't work when

	//   crossing over from 127.255.255.255 / 128.0.0.0 barrier

	return ip2ulong($ip1) < ip2ulong($ip2);

}

/* Return true if the first IP is 'after' the second */

function ip_greater_than($ip1, $ip2) {

	// Compare as unsigned long because otherwise it wouldn't work

	//   when crossing over from 127.255.255.255 / 128.0.0.0 barrier

	return ip2ulong($ip1) > ip2ulong($ip2);

}

function ipcmp($a, $b) {

	if (is_subnet($b)) {

/* Note: IPv6 ranges are not yet supported here. */

function ip_range_to_address_array($startip, $endip, $max_size = 5000) {

	if (!is_ipaddrv4($startip) || !is_ipaddrv4($endip)) {

		return false;

	}

	if (ip_greater_than($startip, $endip)) {

		// Swap start and end so we can process sensibly.

		$temp = $startip;

		$startip = $endip;

		$endip = $temp;

	}

	$rangeaddresses = array();

	$end_int = ip2ulong($endip);

	for ($ip_int = ip2ulong($startip); $ip_int <= $end_int; $ip_int++) {

		$rangeaddresses[] = long2ip($ip_int);

	}

	return $rangeaddresses;

}

 * Convert an IPv4 or IPv6 IP range to an array of subnets which can contain the range.

 * Algorithm and embodying code PD'ed by Stilez - enjoy as you like :-)

 *

 * Documented on pfsense dev list 19-20 May 2013. Summary:

 *

 * The algorithm looks at patterns of 0's and 1's in the least significant bit(s), whether IPv4 or IPv6.

 * These are all that needs checking to identify a _guaranteed_ correct, minimal and optimal subnet array.

 *

 * As a result, string/binary pattern matching of the binary IP is very efficient. It uses just 2 pattern-matching rules

 * to chop off increasingly larger subnets at both ends that can't be part of larger subnets, until nothing's left.

 *

 * (a) If any range has EITHER low bit 1 (in startip) or 0 (in endip), that end-point is _always guaranteed_ to be optimally

 * represented by its own 'single IP' CIDR; the remaining range then shrinks by one IP up or down, causing the new end-point's

 * low bit to change from 1->0 (startip) or 0->1 (endip). Only one edge case needs checking: if a range contains exactly 2

 * adjacent IPs of this format, then the two IPs themselves are required to span it, and we're done.

 * Once this rule is applied, the remaining range is _guaranteed_ to end in 0's and 1's so rule (b) can now be used, and its

 * low bits can now be ignored.

 *

 * (b) If any range has BOTH startip and endip ending in some number of 0's and 1's respectively, these low bits can

 * *always* be ignored and "bit-shifted" for subnet spanning. So provided we remember the bits we've place-shifted, we can

 * _always_ right-shift and chop off those bits, leaving a smaller range that has EITHER startip ending in 1 or endip ending

 * in 0 (ie can now apply (a) again) or the entire range has vanished and we're done.

 * We then loop to redo (a) again on the remaining (place shifted) range until after a few loops, the remaining (place shifted)

 * range 'vanishes' by meeting the exit criteria of (a) or (b), and we're done.

 */

		$proto = 'ipv4';  // for clarity

		$bits = 32;

		$ip1bin = decbin(ip2long32($ip1));

		$ip2bin = decbin(ip2long32($ip2));

	} elseif (is_ipaddrv6($ip1) && is_ipaddrv6($ip2)) {

		$proto = 'ipv6';

		$bits = 128;

		$ip2bin = ip6_to_bin($ip2);

	$ip1bin = str_pad($ip1bin, $bits, '0', STR_PAD_LEFT);

	$ip2bin = str_pad($ip2bin, $bits, '0', STR_PAD_LEFT);

	if ($ip1bin > $ip2bin) {

	$netsize = 0;

	do {

		// at loop start, $ip1 is guaranteed strictly less than $ip2 (important for edge case trapping and preventing accidental binary wrapround)

		// which means the assignments $ip1 += 1 and $ip2 -= 1 will always be "binary-wrapround-safe"

		// step #1 if start ip (as shifted) ends in any '1's, then it must have a single cidr to itself (any cidr would include the '0' below it)

			// the start ip must be in a separate one-IP cidr range

			$new_subnet_ip = substr($ip1bin, $netsize, $bits - $netsize) . str_repeat('0', $netsize);

			$rangesubnets[$new_subnet_ip] = $bits - $netsize;

			$n = strrpos($ip1bin, '0');  //can't be all 1's

			$ip1bin = ($n == 0 ? '' : substr($ip1bin, 0, $n)) . '1' . str_repeat('0', $bits - $n - 1);  // BINARY VERSION OF $ip1 += 1

		// step #2, if end ip (as shifted) ends in any zeros then that must have a cidr to itself (as cidr cant span the 1->0 gap)

			// the end ip must be in a separate one-IP cidr range

			$new_subnet_ip = substr($ip2bin, $netsize, $bits - $netsize) . str_repeat('0', $netsize);

			$rangesubnets[$new_subnet_ip] = $bits - $netsize;

			$n = strrpos($ip2bin, '1');  //can't be all 0's

			$ip2bin = ($n == 0 ? '' : substr($ip2bin, 0, $n)) . '0' . str_repeat('1', $bits - $n - 1);  // BINARY VERSION OF $ip2 -= 1

			// already checked for the edge case where end = start+1 and start ends in 0x1, above, so it's safe

		if ($ip2bin < $ip1bin) {