|
1
|
<?php
|
|
2
|
/*
|
|
3
|
* system_hasync.php
|
|
4
|
*
|
|
5
|
* part of pfSense (https://www.pfsense.org)
|
|
6
|
* Copyright (c) 2004-2013 BSD Perimeter
|
|
7
|
* Copyright (c) 2013-2016 Electric Sheep Fencing
|
|
8
|
* Copyright (c) 2014-2024 Rubicon Communications, LLC (Netgate)
|
|
9
|
* All rights reserved.
|
|
10
|
*
|
|
11
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
12
|
* you may not use this file except in compliance with the License.
|
|
13
|
* You may obtain a copy of the License at
|
|
14
|
*
|
|
15
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
16
|
*
|
|
17
|
* Unless required by applicable law or agreed to in writing, software
|
|
18
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
19
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
20
|
* See the License for the specific language governing permissions and
|
|
21
|
* limitations under the License.
|
|
22
|
*/
|
|
23
|
|
|
24
|
##|+PRIV
|
|
25
|
##|*IDENT=page-system-hasync
|
|
26
|
##|*NAME=System: High Availability Sync
|
|
27
|
##|*DESCR=Allow access to the 'System: High Availability Sync' page.
|
|
28
|
##|*MATCH=system_hasync.php*
|
|
29
|
##|-PRIV
|
|
30
|
|
|
31
|
require_once("guiconfig.inc");
|
|
32
|
|
|
33
|
config_init_path('hasync');
|
|
34
|
$a_hasync = config_get_path('hasync');
|
|
35
|
|
|
36
|
$checkbox_names = array(
|
|
37
|
'pfsyncenabled',
|
|
38
|
'adminsync',
|
|
39
|
'synchronizeusers',
|
|
40
|
'synchronizeauthservers',
|
|
41
|
'synchronizecerts',
|
|
42
|
'synchronizerules',
|
|
43
|
'synchronizeschedules',
|
|
44
|
'synchronizealiases',
|
|
45
|
'synchronizenat',
|
|
46
|
'synchronizeipsec',
|
|
47
|
'synchronizeopenvpn',
|
|
48
|
'synchronizedhcpd',
|
|
49
|
'synchronizedhcrelay',
|
|
50
|
'synchronizekea6',
|
|
51
|
'synchronizedhcrelay6',
|
|
52
|
'synchronizewol',
|
|
53
|
'synchronizestaticroutes',
|
|
54
|
'synchronizevirtualip',
|
|
55
|
'synchronizetrafficshaper',
|
|
56
|
'synchronizetrafficshaperlimiter',
|
|
57
|
'synchronizednsforwarder',
|
|
58
|
'synchronizecaptiveportal');
|
|
59
|
|
|
60
|
if ($_POST) {
|
|
61
|
$pconfig = $_POST;
|
|
62
|
foreach ($checkbox_names as $name) {
|
|
63
|
$a_hasync[$name] = $pconfig[$name] ? $pconfig[$name] : false;
|
|
64
|
}
|
|
65
|
$old_pfhostid = isset($a_hasync['pfhostid']) ? $a_hasync['pfhostid'] : '';
|
|
66
|
$a_hasync['pfhostid'] = strtolower(trim($pconfig['pfhostid']));
|
|
67
|
$a_hasync['pfsyncpeerip'] = $pconfig['pfsyncpeerip'];
|
|
68
|
$a_hasync['pfsyncinterface'] = $pconfig['pfsyncinterface'];
|
|
69
|
$a_hasync['synchronizetoip'] = $pconfig['synchronizetoip'];
|
|
70
|
$a_hasync['username'] = $pconfig['username'];
|
|
71
|
|
|
72
|
if ($pconfig['passwordfld'] == $pconfig['passwordfld_confirm']) {
|
|
73
|
if ($pconfig['passwordfld'] != DMYPWD) {
|
|
74
|
$a_hasync['password'] = $pconfig['passwordfld'];
|
|
75
|
}
|
|
76
|
} else {
|
|
77
|
$input_errors[] = gettext("Password and confirmation must match.");
|
|
78
|
}
|
|
79
|
|
|
80
|
if ((!empty($pconfig['pfhostid']) &&
|
|
81
|
!(ctype_xdigit($pconfig['pfhostid']) &&
|
|
82
|
(strlen($pconfig['pfhostid']) <= 8))) ||
|
|
83
|
($pconfig['pfhostid'] === "0")) {
|
|
84
|
$input_errors[] = gettext("Invalid Host ID. Must be a non-zero hexadecimal string 8 characters or less.");
|
|
85
|
}
|
|
86
|
|
|
87
|
if (!empty($pconfig['pfsyncpeerip']) && !is_ipaddrv4($pconfig['pfsyncpeerip'])) {
|
|
88
|
$input_errors[] = gettext("pfsync Synchronize Peer IP must be an IPv4 IP.");
|
|
89
|
}
|
|
90
|
|
|
91
|
if (!empty($pconfig['synchronizetoip']) && !is_ipaddr($pconfig['synchronizetoip'])) {
|
|
92
|
$input_errors[] = gettext("Synchronize Config to IP must be a valid IP address.");
|
|
93
|
}
|
|
94
|
|
|
95
|
if (!$input_errors) {
|
|
96
|
config_set_path('hasync', $a_hasync);
|
|
97
|
write_config("Updated High Availability Sync configuration");
|
|
98
|
interfaces_sync_setup();
|
|
99
|
if ($old_pfhostid != $a_hasync['pfhostid']) {
|
|
100
|
filter_configure();
|
|
101
|
}
|
|
102
|
header("Location: system_hasync.php");
|
|
103
|
exit();
|
|
104
|
}
|
|
105
|
}
|
|
106
|
|
|
107
|
foreach ($checkbox_names as $name) {
|
|
108
|
$pconfig[$name] = $a_hasync[$name];
|
|
109
|
}
|
|
110
|
$pconfig['pfhostid'] = $a_hasync['pfhostid'];
|
|
111
|
$pconfig['pfsyncpeerip'] = $a_hasync['pfsyncpeerip'];
|
|
112
|
$pconfig['pfsyncinterface'] = $a_hasync['pfsyncinterface'];
|
|
113
|
$pconfig['synchronizetoip'] = $a_hasync['synchronizetoip'];
|
|
114
|
$pconfig['username'] = $a_hasync['username'];
|
|
115
|
$pconfig['passwordfld'] = $a_hasync['password'];
|
|
116
|
|
|
117
|
$ifaces = get_configured_interface_with_descr();
|
|
118
|
$ifaces["lo0"] = "loopback";
|
|
119
|
|
|
120
|
$pgtitle = array(gettext('System'), gettext('High Availability'));
|
|
121
|
$shortcut_section = 'carp';
|
|
122
|
|
|
123
|
// Build a list of available interfaces
|
|
124
|
$iflist = array();
|
|
125
|
foreach ($ifaces as $ifname => $iface) {
|
|
126
|
$iflist[$ifname] = $iface;
|
|
127
|
}
|
|
128
|
|
|
129
|
include("head.inc");
|
|
130
|
|
|
131
|
if ($input_errors) {
|
|
132
|
print_input_errors($input_errors);
|
|
133
|
}
|
|
134
|
|
|
135
|
$form = new Form;
|
|
136
|
|
|
137
|
$section = new Form_Section(gettext('State Synchronization Settings (pfsync)'));
|
|
138
|
|
|
139
|
$section->addInput(new Form_Checkbox(
|
|
140
|
'pfsyncenabled',
|
|
141
|
gettext('Synchronize states'),
|
|
142
|
gettext('pfsync transfers state insertion, update, and deletion messages between firewalls.'),
|
|
143
|
($pconfig['pfsyncenabled'] === 'on'),
|
|
144
|
'on'
|
|
145
|
))->setHelp(gettext('Each firewall sends these messages out via multicast on a specified interface, using the PFSYNC protocol (IP Protocol 240).' .
|
|
146
|
' It also listens on that interface for similar messages from other firewalls, and imports them into the local state table.%1$s' .
|
|
147
|
'This setting should be enabled on all members of a failover group.%1$s' .
|
|
148
|
'Clicking "Save" will force a configuration sync if it is enabled! (see Configuration Synchronization Settings below)'), '<br />');
|
|
149
|
|
|
150
|
$section->addInput(new Form_Select(
|
|
151
|
'pfsyncinterface',
|
|
152
|
gettext('Synchronize Interface'),
|
|
153
|
$pconfig['pfsyncinterface'],
|
|
154
|
$iflist
|
|
155
|
))->setHelp(gettext('If Synchronize States is enabled this interface will be used for communication.%1$s' .
|
|
156
|
'It is recommended to set this to an interface other than LAN! A dedicated interface works the best.%1$s' .
|
|
157
|
'An IP must be defined on each machine participating in this failover group.%1$s' .
|
|
158
|
'An IP must be assigned to the interface on any participating sync nodes.'), '<br />');
|
|
159
|
|
|
160
|
$section->addInput(new Form_Input(
|
|
161
|
'pfhostid',
|
|
162
|
gettext('Filter Host ID'),
|
|
163
|
'text',
|
|
164
|
$pconfig['pfhostid'],
|
|
165
|
['placeholder' => substr(system_get_uniqueid(), -8)]
|
|
166
|
))->setHelp(gettext('Custom pf host identifier carried in state data to uniquely identify which host created a firewall state.%1$s' .
|
|
167
|
'Must be a non-zero hexadecimal string 8 characters or less (e.g. 1, 2, ff01, abcdef01).%1$s' .
|
|
168
|
'Each node participating in state synchronization must have a different ID.'), '<br />');
|
|
169
|
|
|
170
|
$section->addInput(new Form_Input(
|
|
171
|
'pfsyncpeerip',
|
|
172
|
gettext('pfsync Synchronize Peer IP'),
|
|
173
|
'text',
|
|
174
|
$pconfig['pfsyncpeerip'],
|
|
175
|
['placeholder' => 'IP Address']
|
|
176
|
))->setHelp(gettext('Setting this option will force pfsync to synchronize its state table to this IP address. The default is directed multicast.'));
|
|
177
|
|
|
178
|
$form->add($section);
|
|
179
|
|
|
180
|
$section = new Form_Section(gettext('Configuration Synchronization Settings (XMLRPC Sync)'));
|
|
181
|
|
|
182
|
$section->addInput(new Form_Input(
|
|
183
|
'synchronizetoip',
|
|
184
|
gettext('Synchronize Config to IP'),
|
|
185
|
'text',
|
|
186
|
$pconfig['synchronizetoip'],
|
|
187
|
['placeholder' => 'IP Address']
|
|
188
|
))->setHelp(gettext('Enter the IP address of the firewall to which the selected configuration sections should be synchronized.%1$s%1$s' .
|
|
189
|
'XMLRPC sync is currently only supported over connections using the same protocol and port as this system - make sure the remote system\'s port and protocol are set accordingly!%1$s' .
|
|
190
|
'Do not use the Synchronize Config to IP and password option on backup cluster members!'), '<br />');
|
|
191
|
|
|
192
|
$section->addInput(new Form_Input(
|
|
193
|
'username',
|
|
194
|
gettext('Remote System Username'),
|
|
195
|
'text',
|
|
196
|
$pconfig['username'],
|
|
197
|
['autocomplete' => 'new-password']
|
|
198
|
))->setHelp(gettext('Enter the webConfigurator username of the system entered above for synchronizing the configuration.%1$s' .
|
|
199
|
'Do not use the Synchronize Config to IP and username option on backup cluster members!'), '<br />');
|
|
200
|
|
|
201
|
$section->addPassword(new Form_Input(
|
|
202
|
'passwordfld',
|
|
203
|
gettext('Remote System Password'),
|
|
204
|
'password',
|
|
205
|
$pconfig['passwordfld']
|
|
206
|
))->setHelp(gettext('Enter the webConfigurator password of the system entered above for synchronizing the configuration.%1$s' .
|
|
207
|
'Do not use the Synchronize Config to IP and password option on backup cluster members!'), '<br />');
|
|
208
|
|
|
209
|
$section->addInput(new Form_Checkbox(
|
|
210
|
'adminsync',
|
|
211
|
gettext('Synchronize admin'),
|
|
212
|
gettext('synchronize admin accounts and autoupdate sync password.'),
|
|
213
|
($pconfig['adminsync'] === 'on'),
|
|
214
|
'on'
|
|
215
|
))->setHelp(gettext('By default, the admin account does not synchronize, and each node may have a different admin password.%1$s' .
|
|
216
|
'This option automatically updates XMLRPC Remote System Password when the password is changed on
|
|
217
|
the Remote System Username account.'), '<br />');
|
|
218
|
|
|
219
|
$group = new Form_MultiCheckboxGroup(gettext('Select options to sync'));
|
|
220
|
|
|
221
|
$group->add(new Form_MultiCheckbox(
|
|
222
|
'synchronizeusers',
|
|
223
|
gettext('Synchronize Users and Groups'),
|
|
224
|
gettext('User manager users and groups'),
|
|
225
|
($pconfig['synchronizeusers'] === 'on'),
|
|
226
|
'on'
|
|
227
|
));
|
|
228
|
|
|
229
|
$group->add(new Form_MultiCheckbox(
|
|
230
|
'synchronizeauthservers',
|
|
231
|
gettext('Synchronize Auth Servers'),
|
|
232
|
gettext('Authentication servers (e.g. LDAP, RADIUS)'),
|
|
233
|
($pconfig['synchronizeauthservers'] === 'on'),
|
|
234
|
'on'
|
|
235
|
));
|
|
236
|
|
|
237
|
$group->add(new Form_MultiCheckbox(
|
|
238
|
'synchronizecerts',
|
|
239
|
gettext('Synchronize Certificates'),
|
|
240
|
gettext('Certificate Authorities, Certificates, and Certificate Revocation Lists'),
|
|
241
|
($pconfig['synchronizecerts'] === 'on'),
|
|
242
|
'on'
|
|
243
|
));
|
|
244
|
|
|
245
|
$group->add(new Form_MultiCheckbox(
|
|
246
|
'synchronizerules',
|
|
247
|
gettext('Synchronize Rules'),
|
|
248
|
gettext('Firewall rules'),
|
|
249
|
($pconfig['synchronizerules'] === 'on'),
|
|
250
|
'on'
|
|
251
|
));
|
|
252
|
|
|
253
|
$group->add(new Form_MultiCheckbox(
|
|
254
|
'synchronizeschedules',
|
|
255
|
gettext('Synchronize Firewall schedules'),
|
|
256
|
gettext('Firewall schedules'),
|
|
257
|
($pconfig['synchronizeschedules'] === 'on'),
|
|
258
|
'on'
|
|
259
|
));
|
|
260
|
|
|
261
|
$group->add(new Form_MultiCheckbox(
|
|
262
|
'synchronizealiases',
|
|
263
|
gettext('Synchronize Firewall aliases'),
|
|
264
|
gettext('Firewall aliases'),
|
|
265
|
($pconfig['synchronizealiases'] === 'on'),
|
|
266
|
'on'
|
|
267
|
));
|
|
268
|
|
|
269
|
$group->add(new Form_MultiCheckbox(
|
|
270
|
'synchronizenat',
|
|
271
|
gettext('Synchronize NAT'),
|
|
272
|
gettext('NAT configuration'),
|
|
273
|
($pconfig['synchronizenat'] === 'on'),
|
|
274
|
'on'
|
|
275
|
));
|
|
276
|
|
|
277
|
$group->add(new Form_MultiCheckbox(
|
|
278
|
'synchronizeipsec',
|
|
279
|
gettext('Synchronize IPsec'),
|
|
280
|
gettext('IPsec configuration'),
|
|
281
|
($pconfig['synchronizeipsec'] === 'on'),
|
|
282
|
'on'
|
|
283
|
));
|
|
284
|
|
|
285
|
$group->add(new Form_MultiCheckbox(
|
|
286
|
'synchronizeopenvpn',
|
|
287
|
gettext('Synchronize OpenVPN'),
|
|
288
|
gettext('OpenVPN configuration (Implies CA/Cert/CRL Sync)'),
|
|
289
|
($pconfig['synchronizeopenvpn'] === 'on'),
|
|
290
|
'on'
|
|
291
|
));
|
|
292
|
|
|
293
|
$group->add(new Form_MultiCheckbox(
|
|
294
|
'synchronizedhcpd',
|
|
295
|
gettext('Synchronize DHCPD'),
|
|
296
|
gettext('DHCP Server settings'),
|
|
297
|
($pconfig['synchronizedhcpd'] === 'on'),
|
|
298
|
'on'
|
|
299
|
));
|
|
300
|
|
|
301
|
$group->add(new Form_MultiCheckbox(
|
|
302
|
'synchronizedhcrelay',
|
|
303
|
gettext('Synchronize DHCP Relay'),
|
|
304
|
gettext('DHCP Relay settings'),
|
|
305
|
($pconfig['synchronizedhcrelay'] === 'on'),
|
|
306
|
'on'
|
|
307
|
));
|
|
308
|
|
|
309
|
if (dhcp_is_backend('kea')) {
|
|
310
|
$group->add(new Form_MultiCheckbox(
|
|
311
|
'synchronizekea6',
|
|
312
|
gettext('Synchronize Kea DHCPv6'),
|
|
313
|
gettext('DHCPv6 Server settings'),
|
|
314
|
($pconfig['synchronizekea6'] === 'on'),
|
|
315
|
'on'
|
|
316
|
));
|
|
317
|
}
|
|
318
|
|
|
319
|
$group->add(new Form_MultiCheckbox(
|
|
320
|
'synchronizedhcrelay6',
|
|
321
|
gettext('Synchronize DHCPv6 Relay'),
|
|
322
|
gettext('DHCPv6 Relay settings'),
|
|
323
|
($pconfig['synchronizedhcrelay6'] === 'on'),
|
|
324
|
'on'
|
|
325
|
));
|
|
326
|
|
|
327
|
$group->add(new Form_MultiCheckbox(
|
|
328
|
'synchronizewol',
|
|
329
|
gettext('Synchronize Wake-on-LAN'),
|
|
330
|
gettext('WoL Server settings'),
|
|
331
|
($pconfig['synchronizewol'] === 'on'),
|
|
332
|
'on'
|
|
333
|
));
|
|
334
|
|
|
335
|
$group->add(new Form_MultiCheckbox(
|
|
336
|
'synchronizestaticroutes',
|
|
337
|
gettext('Synchronize Static Routes'),
|
|
338
|
gettext('Static Route configuration'),
|
|
339
|
($pconfig['synchronizestaticroutes'] === 'on'),
|
|
340
|
'on'
|
|
341
|
));
|
|
342
|
|
|
343
|
$group->add(new Form_MultiCheckbox(
|
|
344
|
'synchronizevirtualip',
|
|
345
|
gettext('Synchronize Virtual IPs'),
|
|
346
|
gettext('Virtual IPs'),
|
|
347
|
($pconfig['synchronizevirtualip'] === 'on'),
|
|
348
|
'on'
|
|
349
|
));
|
|
350
|
|
|
351
|
$group->add(new Form_MultiCheckbox(
|
|
352
|
'synchronizetrafficshaper',
|
|
353
|
gettext('Synchronize traffic shaper (queues)'),
|
|
354
|
gettext('Traffic Shaper configuration'),
|
|
355
|
($pconfig['synchronizetrafficshaper'] === 'on'),
|
|
356
|
'on'
|
|
357
|
));
|
|
358
|
|
|
359
|
$group->add(new Form_MultiCheckbox(
|
|
360
|
'synchronizetrafficshaperlimiter',
|
|
361
|
gettext('Synchronize traffic shaper (limiter)'),
|
|
362
|
gettext('Traffic Shaper Limiters configuration'),
|
|
363
|
($pconfig['synchronizetrafficshaperlimiter'] === 'on'),
|
|
364
|
'on'
|
|
365
|
));
|
|
366
|
|
|
367
|
$group->add(new Form_MultiCheckbox(
|
|
368
|
'synchronizednsforwarder',
|
|
369
|
gettext('Synchronize DNS (Forwarder/Resolver)'),
|
|
370
|
gettext('DNS Forwarder and DNS Resolver configurations'),
|
|
371
|
($pconfig['synchronizednsforwarder'] === 'on'),
|
|
372
|
'on'
|
|
373
|
));
|
|
374
|
|
|
375
|
$group->add(new Form_MultiCheckbox(
|
|
376
|
'synchronizecaptiveportal',
|
|
377
|
gettext('Synchronize Captive Portal'),
|
|
378
|
gettext('Captive Portal'),
|
|
379
|
($pconfig['synchronizecaptiveportal'] === 'on'),
|
|
380
|
'on'
|
|
381
|
));
|
|
382
|
|
|
383
|
$section->add($group);
|
|
384
|
|
|
385
|
$form->add($section);
|
|
386
|
|
|
387
|
print($form);
|
|
388
|
|
|
389
|
include("foot.inc");
|