Project

General

Profile

Download (84 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	Copyright (C) 2004-2009 Scott Ullrich <sullrich@gmail.com>
4
	All rights reserved.
5

    
6
	originally part of m0n0wall (http://m0n0.ch/wall)
7
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
8
	All rights reserved.
9

    
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12

    
13
1. Redistributions of source code must retain the above copyright notice,
14
	this list of conditions and the following disclaimer.
15

    
16
	2. Redistributions in binary form must reproduce the above copyright
17
	notice, this list of conditions and the following disclaimer in the
18
	documentation and/or other materials provided with the distribution.
19

    
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
	*/
31

    
32
/*
33
	pfSense_BUILDER_BINARIES:	/usr/bin/find	/bin/cd	/usr/local/bin/rrdtool	/usr/bin/nice
34
	pfSense_MODULE:	config
35
*/
36

    
37
if(!function_exists("dump_rrd_to_xml")) 
38
	require("rrd.inc");
39

    
40
/* Upgrade functions must be named:
41
*    upgrade_XXX_to_YYY
42
	* where XXX == previous version, zero padded, and YYY == next version, zero padded
43
	*/
44
function upgrade_010_to_011() {
45
	global $config;
46
	$opti = 1;
47
	$ifmap = array('lan' => 'lan', 'wan' => 'wan', 'pptp' => 'pptp');
48

    
49
	/* convert DMZ to optional, if necessary */
50
	if (isset($config['interfaces']['dmz'])) {
51

    
52
		$dmzcfg = &$config['interfaces']['dmz'];
53

    
54
		if ($dmzcfg['if']) {
55
			$config['interfaces']['opt' . $opti] = array();
56
			$optcfg = &$config['interfaces']['opt' . $opti];
57

    
58
			$optcfg['enable'] = $dmzcfg['enable'];
59
			$optcfg['descr'] = "DMZ";
60
			$optcfg['if'] = $dmzcfg['if'];
61
			$optcfg['ipaddr'] = $dmzcfg['ipaddr'];
62
			$optcfg['subnet'] = $dmzcfg['subnet'];
63

    
64
			$ifmap['dmz'] = "opt" . $opti;
65
			$opti++;
66
		}
67

    
68
		unset($config['interfaces']['dmz']);
69
	}
70

    
71
	/* convert WLAN1/2 to optional, if necessary */
72
	for ($i = 1; isset($config['interfaces']['wlan' . $i]); $i++) {
73

    
74
		if (!$config['interfaces']['wlan' . $i]['if']) {
75
			unset($config['interfaces']['wlan' . $i]);
76
			continue;
77
		}
78

    
79
		$wlancfg = &$config['interfaces']['wlan' . $i];
80
		$config['interfaces']['opt' . $opti] = array();
81
		$optcfg = &$config['interfaces']['opt' . $opti];
82

    
83
		$optcfg['enable'] = $wlancfg['enable'];
84
		$optcfg['descr'] = "WLAN" . $i;
85
		$optcfg['if'] = $wlancfg['if'];
86
		$optcfg['ipaddr'] = $wlancfg['ipaddr'];
87
		$optcfg['subnet'] = $wlancfg['subnet'];
88
		$optcfg['bridge'] = $wlancfg['bridge'];
89

    
90
		$optcfg['wireless'] = array();
91
		$optcfg['wireless']['mode'] = $wlancfg['mode'];
92
		$optcfg['wireless']['ssid'] = $wlancfg['ssid'];
93
		$optcfg['wireless']['channel'] = $wlancfg['channel'];
94
		$optcfg['wireless']['wep'] = $wlancfg['wep'];
95

    
96
		$ifmap['wlan' . $i] = "opt" . $opti;
97

    
98
		unset($config['interfaces']['wlan' . $i]);
99
		$opti++;
100
	}
101

    
102
	/* convert filter rules */
103
	$n = count($config['filter']['rule']);
104
	for ($i = 0; $i < $n; $i++) {
105

    
106
		$fr = &$config['filter']['rule'][$i];
107

    
108
		/* remap interface */
109
		if (array_key_exists($fr['interface'], $ifmap))
110
			$fr['interface'] = $ifmap[$fr['interface']];
111
		else {
112
			/* remove the rule */
113
			printf(gettext("%sWarning: filter rule removed " .
114
				"(interface '%s' does not exist anymore)."), "\n", $fr['interface']);
115
			unset($config['filter']['rule'][$i]);
116
			continue;
117
		}
118

    
119
		/* remap source network */
120
		if (isset($fr['source']['network'])) {
121
			if (array_key_exists($fr['source']['network'], $ifmap))
122
				$fr['source']['network'] = $ifmap[$fr['source']['network']];
123
			else {
124
				/* remove the rule */
125
				printf(gettext("%sWarning: filter rule removed " .
126
					"(source network '%s' does not exist anymore)."), "\n", $fr['source']['network']);
127
				unset($config['filter']['rule'][$i]);
128
				continue;
129
			}
130
		}
131

    
132
		/* remap destination network */
133
		if (isset($fr['destination']['network'])) {
134
			if (array_key_exists($fr['destination']['network'], $ifmap))
135
				$fr['destination']['network'] = $ifmap[$fr['destination']['network']];
136
			else {
137
				/* remove the rule */
138
				printf(gettext("%sWarning: filter rule removed " .
139
					"(destination network '%s' does not exist anymore)."), "\n", $fr['destination']['network']);
140
				unset($config['filter']['rule'][$i]);
141
				continue;
142
			}
143
		}
144
	}
145

    
146
	/* convert shaper rules */
147
	$n = count($config['pfqueueing']['rule']);
148
	if (is_array($config['pfqueueing']['rule']))
149
	for ($i = 0; $i < $n; $i++) {
150

    
151
		$fr = &$config['pfqueueing']['rule'][$i];
152

    
153
		/* remap interface */
154
		if (array_key_exists($fr['interface'], $ifmap))
155
			$fr['interface'] = $ifmap[$fr['interface']];
156
		else {
157
			/* remove the rule */
158
			printf(gettext("%sWarning: traffic shaper rule removed " .
159
				"(interface '%s' does not exist anymore)."), "\n", $fr['interface']);
160
			unset($config['pfqueueing']['rule'][$i]);
161
			continue;
162
		}
163

    
164
		/* remap source network */
165
		if (isset($fr['source']['network'])) {
166
			if (array_key_exists($fr['source']['network'], $ifmap))
167
				$fr['source']['network'] = $ifmap[$fr['source']['network']];
168
			else {
169
				/* remove the rule */
170
				printf(gettext("%sWarning: traffic shaper rule removed " .
171
					"(source network '%s' does not exist anymore)."), "\n", $fr['source']['network']);
172
				unset($config['pfqueueing']['rule'][$i]);
173
				continue;
174
			}
175
		}
176

    
177
		/* remap destination network */
178
		if (isset($fr['destination']['network'])) {
179
			if (array_key_exists($fr['destination']['network'], $ifmap))
180
				$fr['destination']['network'] = $ifmap[$fr['destination']['network']];
181
			else {
182
				/* remove the rule */
183
				printf(gettext("%sWarning: traffic shaper rule removed " .
184
					"(destination network '%s' does not exist anymore)."), "\n", $fr['destination']['network']);
185
				unset($config['pfqueueing']['rule'][$i]);
186
				continue;
187
			}
188
		}
189
	}
190
}
191

    
192

    
193
function upgrade_011_to_012() {
194
	global $config;
195
	/* move LAN DHCP server config */
196
	$tmp = $config['dhcpd'];
197
	$config['dhcpd'] = array();
198
	$config['dhcpd']['lan'] = $tmp;
199

    
200
	/* encrypt password */
201
	$config['system']['password'] = crypt($config['system']['password']);
202
}
203

    
204

    
205
function upgrade_012_to_013() {
206
	global $config;
207
	/* convert advanced outbound NAT config */
208
	for ($i = 0; isset($config['nat']['advancedoutbound']['rule'][$i]); $i++) {
209
		$curent = &$config['nat']['advancedoutbound']['rule'][$i];
210
		$src = $curent['source'];
211
		$curent['source'] = array();
212
		$curent['source']['network'] = $src;
213
		$curent['destination'] = array();
214
		$curent['destination']['any'] = true;
215
	}
216

    
217
	/* add an explicit type="pass" to all filter rules to make things consistent */
218
	for ($i = 0; isset($config['filter']['rule'][$i]); $i++) {
219
		$config['filter']['rule'][$i]['type'] = "pass";
220
	}
221
}
222

    
223

    
224
function upgrade_013_to_014() {
225
	global $config;
226
	/* convert shaper rules (make pipes) */
227
	if (is_array($config['pfqueueing']['rule'])) {
228
		$config['pfqueueing']['pipe'] = array();
229

    
230
		for ($i = 0; isset($config['pfqueueing']['rule'][$i]); $i++) {
231
			$curent = &$config['pfqueueing']['rule'][$i];
232

    
233
			/* make new pipe and associate with this rule */
234
			$newpipe = array();
235
			$newpipe['descr'] = $curent['descr'];
236
			$newpipe['bandwidth'] = $curent['bandwidth'];
237
			$newpipe['delay'] = $curent['delay'];
238
			$newpipe['mask'] = $curent['mask'];
239
			$config['pfqueueing']['pipe'][$i] = $newpipe;
240

    
241
			$curent['targetpipe'] = $i;
242

    
243
			unset($curent['bandwidth']);
244
			unset($curent['delay']);
245
			unset($curent['mask']);
246
		}
247
	}
248
}
249

    
250

    
251
function upgrade_014_to_015() {
252
	global $config;
253
	/* Default route moved */
254
	if (isset($config['interfaces']['wan']['gateway']))
255
		if ($config['interfaces']['wan']['gateway'] <> "")
256
		$config['interfaces']['wan']['gateway'] = $config['interfaces']['wan']['gateway'];
257
	unset($config['interfaces']['wan']['gateway']);
258

    
259
	/* Queues are no longer interface specific */
260
	if (isset($config['interfaces']['lan']['schedulertype']))
261
		unset($config['interfaces']['lan']['schedulertype']);
262
	if (isset($config['interfaces']['wan']['schedulertype']))
263
		unset($config['interfaces']['wan']['schedulertype']);
264

    
265
	for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) {
266
		if(isset($config['interfaces']['opt' . $i]['schedulertype']))
267
			unset($config['interfaces']['opt' . $i]['schedulertype']);
268
	}
269
}
270

    
271

    
272
function upgrade_015_to_016() {
273
	global $config;
274
	/* Alternate firmware URL moved */
275
	if (isset($config['system']['firmwareurl']) && isset($config['system']['firmwarename'])) { // Only convert if *both* are defined.
276
		$config['system']['alt_firmware_url'] = array();
277
		$config['system']['alt_firmware_url']['enabled'] = "";
278
		$config['system']['alt_firmware_url']['firmware_base_url'] = $config['system']['firmwareurl'];
279
		$config['system']['alt_firmware_url']['firmware_filename'] = $config['system']['firmwarename'];
280
		unset($config['system']['firmwareurl'], $config['system']['firmwarename']);
281
	} else {
282
		unset($config['system']['firmwareurl'], $config['system']['firmwarename']);
283
	}
284
}
285

    
286

    
287
function upgrade_016_to_017() {
288
	global $config;
289
	/* wipe previous shaper configuration */
290
	unset($config['shaper']['queue']);
291
	unset($config['shaper']['rule']);
292
	unset($config['interfaces']['wan']['bandwidth']);
293
	unset($config['interfaces']['wan']['bandwidthtype']);
294
	unset($config['interfaces']['lan']['bandwidth']);
295
	unset($config['interfaces']['lan']['bandwidthtype']);
296
	$config['shaper']['enable'] = FALSE;
297
}
298

    
299

    
300
function upgrade_017_to_018() {
301
	global $config;
302
	if(isset($config['proxyarp']) && is_array($config['proxyarp']['proxyarpnet'])) {
303
		$proxyarp = &$config['proxyarp']['proxyarpnet'];
304
		foreach($proxyarp as $arpent){
305
			$vip = array();
306
			$vip['mode'] = "proxyarp";
307
			$vip['interface'] = $arpent['interface'];
308
			$vip['descr'] = $arpent['descr'];
309
			if (isset($arpent['range'])) {
310
				$vip['range'] = $arpent['range'];
311
				$vip['type'] = "range";
312
			} else {
313
				$subnet = explode('/', $arpent['network']);
314
				$vip['subnet'] = $subnet[0];
315
				if (isset($subnet[1])) {
316
					$vip['subnet_bits'] = $subnet[1];
317
					$vip['type'] = "network";
318
				} else {
319
					$vip['subnet_bits'] = "32";
320
					$vip['type'] = "single";
321
				}
322
			}
323
			$config['virtualip']['vip'][] = $vip;
324
		}
325
		unset($config['proxyarp']);
326
	}
327
	if(isset($config['installedpackages']) && isset($config['installedpackages']['carp']) && is_array($config['installedpackages']['carp']['config'])) {
328
		$carp = &$config['installedpackages']['carp']['config'];
329
		foreach($carp as $carpent){
330
			$vip = array();
331
			$vip['mode'] = "carp";
332
			$vip['interface'] = "AUTO";
333
			$vip['descr'] = sprintf(gettext("CARP vhid %s"), $carpent['vhid']);
334
			$vip['type'] = "single";
335
			$vip['vhid'] = $carpent['vhid'];
336
			$vip['advskew'] = $carpent['advskew'];
337
			$vip['password'] = $carpent['password'];
338
			$vip['subnet'] = $carpent['ipaddress'];
339
			$vip['subnet_bits'] = $carpent['netmask'];
340
			$config['virtualip']['vip'][] = $vip;
341
		}
342
		unset($config['installedpackages']['carp']);
343
	}
344
	/* Server NAT is no longer needed */
345
	unset($config['nat']['servernat']);
346

    
347
	/* enable SSH */
348
	if ($config['version'] == "1.8") {
349
		$config['system']['sshenabled'] = true;
350
	}
351
}
352

    
353

    
354
function upgrade_018_to_019() {
355
	global $config;
356
	$config['theme']="metallic";
357
}
358

    
359

    
360
function upgrade_019_to_020() {
361
	global $config;
362
	if(is_array($config['ipsec']['tunnel'])) {
363
		reset($config['ipsec']['tunnel']);
364
		while (list($index, $tunnel) = each($config['ipsec']['tunnel'])) {
365
			/* Sanity check on required variables */
366
			/* This fixes bogus <tunnel> entries - remnant of bug #393 */
367
			if (!isset($tunnel['local-subnet']) && !isset($tunnel['remote-subnet'])) {
368
				unset($config['ipsec']['tunnel'][$tunnel]);
369
			}
370
		}
371
	}
372
}
373

    
374
function upgrade_020_to_021() {
375
	global $config;
376
	/* shaper scheduler moved */
377
	if(isset($config['system']['schedulertype'])) {
378
		$config['shaper']['schedulertype'] = $config['system']['schedulertype'];
379
		unset($config['system']['schedulertype']);
380
	}
381
}
382

    
383

    
384
function upgrade_021_to_022() {
385
	global $config;
386
	/* move gateway to wan interface */
387
	$config['interfaces']['wan']['gateway'] = $config['system']['gateway'];
388
}
389

    
390
function upgrade_022_to_023() {
391
	global $config;
392
	if(isset($config['shaper'])) {
393
		/* wipe previous shaper configuration */
394
		unset($config['shaper']);
395
	}
396
}
397

    
398

    
399
function upgrade_023_to_024() {
400
	global $config;
401
}
402

    
403

    
404
function upgrade_024_to_025() {
405
	global $config;
406
	$config['interfaces']['wan']['use_rrd_gateway'] = $config['system']['use_rrd_gateway'];
407
	unset($config['system']['use_rrd_gateway']);
408
}
409

    
410

    
411
function upgrade_025_to_026() {
412
	global $config;
413
	$cron_item = array();
414
	$cron_item['minute'] = "0";
415
	$cron_item['hour'] = "*";
416
	$cron_item['mday'] = "*";
417
	$cron_item['month'] = "*";
418
	$cron_item['wday'] = "*";
419
	$cron_item['who'] = "root";
420
	$cron_item['command'] = "/usr/bin/nice -n20 newsyslog";
421

    
422
	$config['cron']['item'][] = $cron_item;
423

    
424
	$cron_item = array();
425
	$cron_item['minute'] = "1,31";
426
	$cron_item['hour'] = "0-5";
427
	$cron_item['mday'] = "*";
428
	$cron_item['month'] = "*";
429
	$cron_item['wday'] = "*";
430
	$cron_item['who'] = "root";
431
	$cron_item['command'] = "/usr/bin/nice -n20 adjkerntz -a";
432

    
433
	$config['cron']['item'][] = $cron_item;
434

    
435
	$cron_item = array();
436
	$cron_item['minute'] = "1";
437
	$cron_item['hour'] = "*";
438
	$cron_item['mday'] = "1";
439
	$cron_item['month'] = "*";
440
	$cron_item['wday'] = "*";
441
	$cron_item['who'] = "root";
442
	$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.update_bogons.sh";
443

    
444
	$config['cron']['item'][] = $cron_item;
445

    
446
	$cron_item = array();
447
	$cron_item['minute'] = "*/60";
448
	$cron_item['hour'] = "*";
449
	$cron_item['mday'] = "*";
450
	$cron_item['month'] = "*";
451
	$cron_item['wday'] = "*";
452
	$cron_item['who'] = "root";
453
	$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout";
454

    
455
	$config['cron']['item'][] = $cron_item;
456

    
457
	$cron_item = array();
458
	$cron_item['minute'] = "1";
459
	$cron_item['hour'] = "1";
460
	$cron_item['mday'] = "*";
461
	$cron_item['month'] = "*";
462
	$cron_item['wday'] = "*";
463
	$cron_item['who'] = "root";
464
	$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.dyndns.update";
465

    
466
	$config['cron']['item'][] = $cron_item;
467

    
468
	$cron_item = array();
469
	$cron_item['minute'] = "*/60";
470
	$cron_item['hour'] = "*";
471
	$cron_item['mday'] = "*";
472
	$cron_item['month'] = "*";
473
	$cron_item['wday'] = "*";
474
	$cron_item['who'] = "root";
475
	$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot";
476

    
477
	$config['cron']['item'][] = $cron_item;
478

    
479
	$cron_item = array();
480
	$cron_item['minute'] = "*/60";
481
	$cron_item['hour'] = "*";
482
	$cron_item['mday'] = "*";
483
	$cron_item['month'] = "*";
484
	$cron_item['wday'] = "*";
485
	$cron_item['who'] = "root";
486
	$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 1800 snort2c";
487

    
488
	$config['cron']['item'][] = $cron_item;
489
}
490

    
491

    
492
function upgrade_026_to_027() {
493
	global $config;
494
}
495

    
496

    
497
function upgrade_027_to_028() {
498
	global $config;
499
}
500

    
501

    
502
function upgrade_028_to_029() {
503
	global $config;
504
	$rule_item = array();
505
	$a_filter = &$config['filter']['rule'];
506
	$rule_item['interface'] = "enc0";
507
	$rule_item['type'] = "pass";
508
	$rule_item['source']['any'] = true;
509
	$rule_item['destination']['any'] = true;
510
	$rule_item['descr'] = gettext("Permit IPsec traffic.");
511
	$rule_item['statetype'] = "keep state";
512
	$a_filter[] = $rule_item;
513
}
514

    
515

    
516
function upgrade_029_to_030() {
517
	global $config;
518
	/* enable the rrd config setting by default */
519
	$config['rrd']['enable'] = true;
520
}
521

    
522

    
523
function upgrade_030_to_031() {
524
	global $config;
525
	/* Insert upgrade code here */
526
}
527

    
528

    
529
function upgrade_031_to_032() {
530
	global $config;
531
	/* Insert upgrade code here */
532
}
533

    
534

    
535
function upgrade_032_to_033() {
536
	global $config;
537
	/* Insert upgrade code here */
538
}
539

    
540

    
541
function upgrade_033_to_034() {
542
	global $config;
543
	/* Insert upgrade code here */
544
}
545

    
546

    
547
function upgrade_034_to_035() {
548
	global $config;
549
	/* Insert upgrade code here */
550
}
551

    
552

    
553
function upgrade_035_to_036() {
554
	global $config;
555
	/* Insert upgrade code here */
556
}
557

    
558

    
559
function upgrade_036_to_037() {
560
	global $config;
561
	/* Insert upgrade code here */
562
}
563

    
564

    
565
function upgrade_037_to_038() {
566
	global $config;
567
	/* Insert upgrade code here */
568
}
569

    
570

    
571
function upgrade_038_to_039() {
572
	global $config;
573
	/* Insert upgrade code here */
574
}
575

    
576

    
577
function upgrade_039_to_040() {
578
	global $config;
579
	$config['system']['webgui']['auth_method'] = "session";
580
	$config['system']['webgui']['backing_method'] = "htpasswd";
581

    
582
	if (isset ($config['system']['username'])) {
583
		$config['system']['group'] = array();
584
		$config['system']['group'][0]['name'] = "admins";
585
		$config['system']['group'][0]['description'] = gettext("System Administrators");
586
		$config['system']['group'][0]['scope'] = "system";
587
		$config['system']['group'][0]['priv'] = "page-all";
588
		$config['system']['group'][0]['home'] = "index.php";
589
		$config['system']['group'][0]['gid'] = "110";
590

    
591
		$config['system']['user'] = array();
592
		$config['system']['user'][0]['name'] = "{$config['system']['username']}";
593
		$config['system']['user'][0]['descr'] = "System Administrator";
594
		$config['system']['user'][0]['scope'] = "system";
595
		$config['system']['user'][0]['groupname'] = "admins";
596
		$config['system']['user'][0]['password'] = "{$config['system']['password']}";
597
		$config['system']['user'][0]['uid'] = "0";
598
		/* Ensure that we follow what this new "admin" username should be in the session. */
599
		$_SESSION["Username"] = "{$config['system']['username']}";
600

    
601
		$config['system']['user'][0]['priv'] = array();
602
		$config['system']['user'][0]['priv'][0]['id'] = "lockwc";
603
		$config['system']['user'][0]['priv'][0]['name'] = "Lock webConfigurator";
604
		$config['system']['user'][0]['priv'][0]['descr'] = gettext("Indicates whether this user will lock access to the webConfigurator for other users.");
605
		$config['system']['user'][0]['priv'][1]['id'] = "lock-ipages";
606
		$config['system']['user'][0]['priv'][1]['name'] = "Lock individual pages";
607
		$config['system']['user'][0]['priv'][1]['descr'] = gettext("Indicates whether this user will lock individual HTML pages after having accessed a particular page (the lock will be freed if the user leaves or saves the page form).");
608
		$config['system']['user'][0]['priv'][2]['id'] = "hasshell";
609
		$config['system']['user'][0]['priv'][2]['name'] = "Has shell access";
610
		$config['system']['user'][0]['priv'][2]['descr'] = gettext("Indicates whether this user is able to login for example via SSH.");
611
		$config['system']['user'][0]['priv'][3]['id'] = "copyfiles";
612
		$config['system']['user'][0]['priv'][3]['name'] = "Is allowed to copy files";
613
		$config['system']['user'][0]['priv'][3]['descr'] = sprintf(gettext("Indicates whether this user is allowed to copy files onto the %s appliance via SCP/SFTP. If you are going to use this privilege, you must install scponly on the appliance (Hint: pkg_add -r scponly)."), $g['product_name']);
614
		$config['system']['user'][0]['priv'][4]['id'] = "isroot";
615
		$config['system']['user'][0]['priv'][4]['name'] = "Is root user";
616
		$config['system']['user'][0]['priv'][4]['descr'] = gettext("This user is associated with the UNIX root user (you should associate this privilege only with one single user).");
617

    
618
		$config['system']['nextuid'] = "111";
619
		$config['system']['nextgid'] = "111";
620

    
621
		/* wipe previous auth configuration */
622
		unset ($config['system']['username']);
623
		unset ($config['system']['password']);
624
	}
625
}
626

    
627
function upgrade_040_to_041() {
628
	global $config;
629
	if(!$config['sysctl']) {
630
		$config['sysctl']['item'] = array();
631

    
632
		$config['sysctl']['item'][0]['tunable'] = "net.inet.tcp.blackhole";
633
		$config['sysctl']['item'][0]['descr'] =    gettext("Drop packets to closed TCP ports without returning a RST");
634
		$config['sysctl']['item'][0]['value'] =   "default";
635

    
636
		$config['sysctl']['item'][1]['tunable'] = "net.inet.udp.blackhole";
637
		$config['sysctl']['item'][1]['descr'] =    gettext("Do not send ICMP port unreachable messages for closed UDP ports");
638
		$config['sysctl']['item'][1]['value'] =   "default";
639

    
640
		$config['sysctl']['item'][2]['tunable'] = "net.inet.ip.random_id";
641
		$config['sysctl']['item'][2]['descr'] =    gettext("Randomize the ID field in IP packets (default is 0: sequential IP IDs)");
642
		$config['sysctl']['item'][2]['value'] =   "default";
643

    
644
		$config['sysctl']['item'][3]['tunable'] = "net.inet.tcp.drop_synfin";
645
		$config['sysctl']['item'][3]['descr'] =    gettext("Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)");
646
		$config['sysctl']['item'][3]['value'] =   "default";
647

    
648
		$config['sysctl']['item'][4]['tunable'] = "net.inet.ip.redirect";
649
		$config['sysctl']['item'][4]['descr'] =    gettext("Sending of IPv4 ICMP redirects");
650
		$config['sysctl']['item'][4]['value'] =   "default";
651

    
652
		$config['sysctl']['item'][5]['tunable'] = "net.inet6.ip6.redirect";
653
		$config['sysctl']['item'][5]['descr'] =    gettext("Sending of IPv6 ICMP redirects");
654
		$config['sysctl']['item'][5]['value'] =   "default";
655

    
656
		$config['sysctl']['item'][6]['tunable'] = "net.inet.tcp.syncookies";
657
		$config['sysctl']['item'][6]['descr'] =    gettext("Generate SYN cookies for outbound SYN-ACK packets");
658
		$config['sysctl']['item'][6]['value'] =   "default";
659

    
660
		$config['sysctl']['item'][7]['tunable'] = "net.inet.tcp.recvspace";
661
		$config['sysctl']['item'][7]['descr'] =    gettext("Maximum incoming TCP datagram size");
662
		$config['sysctl']['item'][7]['value'] =   "default";
663

    
664
		$config['sysctl']['item'][8]['tunable'] = "net.inet.tcp.sendspace";
665
		$config['sysctl']['item'][8]['descr'] =    gettext("Maximum outgoing TCP datagram size");
666
		$config['sysctl']['item'][8]['value'] =   "default";
667

    
668
		$config['sysctl']['item'][9]['tunable'] = "net.inet.ip.fastforwarding";
669
		$config['sysctl']['item'][9]['descr'] =    gettext("Fastforwarding (see http://lists.freebsd.org/pipermail/freebsd-net/2004-January/002534.html)");
670
		$config['sysctl']['item'][9]['value'] =   "default";
671

    
672
		$config['sysctl']['item'][10]['tunable'] = "net.inet.tcp.delayed_ack";
673
		$config['sysctl']['item'][10]['descr'] =    gettext("Do not delay ACK to try and piggyback it onto a data packet");
674
		$config['sysctl']['item'][10]['value'] =   "default";
675

    
676
		$config['sysctl']['item'][11]['tunable'] = "net.inet.udp.maxdgram";
677
		$config['sysctl']['item'][11]['descr'] =    gettext("Maximum outgoing UDP datagram size");
678
		$config['sysctl']['item'][11]['value'] =   "default";
679

    
680
		$config['sysctl']['item'][12]['tunable'] = "net.link.bridge.pfil_onlyip";
681
		$config['sysctl']['item'][12]['descr'] =    gettext("Handling of non-IP packets which are not passed to pfil (see if_bridge(4))");
682
		$config['sysctl']['item'][12]['value'] =   "default";
683

    
684
		$config['sysctl']['item'][13]['tunable'] = "net.link.tap.user_open";
685
		$config['sysctl']['item'][13]['descr'] =    gettext("Allow unprivileged access to tap(4) device nodes");
686
		$config['sysctl']['item'][13]['value'] =   "default";
687

    
688
		$config['sysctl']['item'][15]['tunable'] = "kern.randompid";
689
		$config['sysctl']['item'][15]['descr'] =    gettext("Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())");
690
		$config['sysctl']['item'][15]['value'] =   "default";
691

    
692
		$config['sysctl']['item'][16]['tunable'] = "net.inet.tcp.inflight.enable";
693
		$config['sysctl']['item'][16]['descr'] =    gettext("The system will attempt to calculate the bandwidth delay product for each connection and limit the amount of data queued to the network to just the amount required to maintain optimum throughput. ");
694
		$config['sysctl']['item'][16]['value'] =   "default";
695

    
696
		$config['sysctl']['item'][17]['tunable'] = "net.inet.icmp.icmplim";
697
		$config['sysctl']['item'][17]['descr'] =    gettext("Set ICMP Limits");
698
		$config['sysctl']['item'][17]['value'] =   "default";
699

    
700
		$config['sysctl']['item'][18]['tunable'] = "net.inet.tcp.tso";
701
		$config['sysctl']['item'][18]['descr'] =    gettext("TCP Offload engine");
702
		$config['sysctl']['item'][18]['value'] =   "default";
703
		
704
		$config['sysctl']['item'][19]['tunable'] = "net.inet.ip.portrange.first";
705
		$config['sysctl']['item'][19]['descr'] =    "Set the ephemeral port range starting port";
706
		$config['sysctl']['item'][19]['value'] =   "default";
707

    
708
		$config['sysctl']['item'][20]['tunable'] = "hw.syscons.kbd_reboot";
709
		$config['sysctl']['item'][20]['descr'] =    "Enables ctrl+alt+delete";
710
		$config['sysctl']['item'][20]['value'] =   "default";
711

    
712
		$config['sysctl']['item'][21]['tunable'] = "kern.ipc.maxsockbuf";
713
		$config['sysctl']['item'][21]['descr'] =    "Maximum socket buffer size";
714
		$config['sysctl']['item'][21]['value'] =   "default";
715

    
716
	}
717
}
718

    
719

    
720
function upgrade_041_to_042() {
721
	global $config;
722
	if (isset($config['shaper']))
723
		unset($config['shaper']);
724
	if (isset($config['ezshaper']))
725
		unset($config['ezshaper']);
726
}
727

    
728

    
729
function upgrade_042_to_043() {
730
	global $config;
731
	/* migrate old interface gateway to the new gateways config */
732
	$iflist = get_configured_interface_list(false, true);
733
	$gateways = array();
734
	$i = 0;
735
	foreach($iflist as $ifname => $interface) {
736
		if(! interface_has_gateway($ifname)) {
737
			continue;
738
		}
739
		$config['gateways']['gateway_item'][$i] = array();
740
		if(is_ipaddr($config['interfaces'][$ifname]['gateway'])) {
741
			$config['gateways']['gateway_item'][$i]['gateway'] = $config['interfaces'][$ifname]['gateway'];
742
			$config['gateways']['gateway_item'][$i]['descr'] = sprintf(gettext("Interface %s Static Gateway"), $ifname);
743
		} else {
744
			$config['gateways']['gateway_item'][$i]['gateway'] = "dynamic";
745
			$config['gateways']['gateway_item'][$i]['descr'] = sprintf(gettext("Interface %s Dynamic Gateway"), $ifname);
746
		}
747
		$config['gateways']['gateway_item'][$i]['interface'] = $ifname;
748
		$config['gateways']['gateway_item'][$i]['name'] = "GW_" . strtoupper($ifname);
749
		/* add default gateway bit for wan on upgrade */
750
		if($ifname == "wan") {
751
			 $config['gateways']['gateway_item'][$i]['defaultgw'] = true;
752
		}
753
		if(is_ipaddr($config['interfaces'][$ifname]['use_rrd_gateway'])) {
754
			$config['gateways']['gateway_item'][$i]['monitor'] = $config['interfaces'][$ifname]['use_rrd_gateway'];
755
			unset($config['interfaces'][$ifname]['use_rrd_gateway']);
756
		}
757
		$config['interfaces'][$ifname]['gateway'] = $config['gateways']['gateway_item'][$i]['name'];
758

    
759
		/* Update all filter rules which might reference this gateway */
760
		$j = 0;
761
		foreach($config['filter']['rule'] as $rule) {
762
			if(is_ipaddr($rule['gateway'])) {
763
				if ($rule['gateway'] == $config['gateways']['gateway_item'][$i]['gateway'])
764
					$config['filter']['rule'][$j]['gateway'] = $config['gateways']['gateway_item'][$i]['name'];
765
				else if ($rule['gateway'] == $ifname)
766
					$config['filter']['rule'][$j]['gateway'] = $config['gateways']['gateway_item'][$i]['name'];
767
			}
768
			$j++;
769
		}
770

    
771
		/* rename old Quality RRD files in the process */
772
		$rrddbpath = "/var/db/rrd";
773
		$gwname = "GW_" . strtoupper($ifname);
774
		if(is_readable("{$rrddbpath}/{$ifname}-quality.rrd")) {
775
			rename("{$rrddbpath}/{$ifname}-quality.rrd", "{$rrddbpath}/{$gwname}-quality.rrd");
776
		}
777
		$i++;
778
	}
779
}
780

    
781

    
782
function upgrade_043_to_044() {
783
	global $config;
784

    
785
	/* migrate static routes to the new gateways config */
786
	$gateways = return_gateways_array(true);
787
	$i = 0;
788
	if (is_array($config['staticroutes']['route'])) {
789
		$gwmap = array();
790
		foreach ($config['staticroutes']['route'] as $idx => $sroute) {
791
			$found = false;
792
			foreach ($gateways as $gwname => $gw) {
793
				if ($gw['gateway'] == $sroute['gateway']) {
794
					$config['staticroutes']['route'][$idx]['gateway'] = $gwname;
795
					$found = true;
796
					break;
797
				}
798
			}
799
			if($gwmap[$sroute['gateway']]) {
800
				/* We already added a gateway name for this IP */
801
				$config['staticroutes']['route'][$idx]['gateway'] = "{$gwmap[$sroute['gateway']]}";
802
				$found = true;
803
			}			
804
			if ($found == false) {
805
				$gateway = array();
806
				$gateway['name'] = "SROUTE{$i}";
807
				$gwmap[$sroute['gateway']] = $gateway['name'];
808
				$gateway['gateway'] = $sroute['gateway'];
809
				$gateway['interface'] = $sroute['interface'];
810
				$gateway['descr'] = sprintf(gettext("Upgraded static route for %s"), $sroute['network']);
811
				if (!is_array($config['gateways']['gateway_item']))
812
					$config['gateways']['gateway_item'] = array();
813
				$config['gateways']['gateway_item'][] = $gateway;
814
				$config['staticroutes']['route'][$idx]['gateway'] = $gateway['name'];
815
				$i++;
816
			}
817
		}
818
	}
819
}
820

    
821

    
822
function upgrade_044_to_045() {
823
	global $config;
824
	$iflist = get_configured_interface_list(false, true);
825
	if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) {
826
		$i = 0;
827
		foreach ($config['vlans']['vlan'] as $id => $vlan) {
828
			/* Make sure to update the interfaces section with the right name */
829
			$vlan_name = "{$vlan['if']}_vlan{$vlan['tag']}";
830
			foreach($iflist as $ifname) {
831
				if($config['interfaces'][$ifname]['if'] == "vlan{$i}") {
832
					$config['interfaces'][$ifname]['if'] = $vlan_name;
833
					continue;
834
				}
835
			}
836
			$config['vlans']['vlan'][$i]['vlanif'] = "{$vlan_name}";
837
			$i++;			
838
		}
839
	}
840
}
841

    
842

    
843
function upgrade_045_to_046() {
844
	global $config;
845
	/* Load up monitors that are in the default config for 2.0 but not in 1.2.3 
846
		thus wouldn't be in an upgraded config. */
847
	$config['load_balancer']['monitor_type'] = array (
848
		array ( 'name' => 'ICMP',
849
			'type' => 'icmp',
850
			'descr' => 'ICMP',
851
			'options' => '',
852
		),
853
		array ( 'name' => 'TCP',
854
			'type' => 'tcp',
855
			'descr' => 'Generic TCP',
856
			'options' => '',
857
		),
858
		array ( 'name' => 'HTTP',
859
			'type' => 'http',
860
			'descr' => 'Generic HTTP',
861
			'options' =>
862
			array ( 'path' => '/',
863
				'host' => '',
864
				'code' => '200',
865
			),
866
		),
867
		array ( 'name' => 'HTTPS',
868
			'type' => 'https',
869
			'descr' => 'Generic HTTPS',
870
			'options' =>
871
			array ( 'path' => '/',
872
				'host' => '',
873
				'code' => '200',
874
			),
875
		),
876
		array ( 'name' => 'SMTP',
877
			'type' => 'send',
878
			'descr' => 'Generic SMTP',
879
			'options' =>
880
			array ( 'send' => '',
881
				'expect' => '220 *',
882
			),
883
		),
884
	);
885
	/* Upgrade load balancer from slb to relayd */
886
	if (is_array($config['load_balancer']['virtual_server']) && count($config['load_balancer']['virtual_server'])) {
887
		$vs_a = &$config['load_balancer']['virtual_server'];
888
		$pool_a = &$config['load_balancer']['lbpool'];
889
		$pools = array();
890
		/* Index pools by name */
891
		if(is_array($pool_a)) {
892
			for ($i = 0; isset($pool_a[$i]); $i++) {
893
				if($pool_a[$i]['type'] == "server") {
894
					$pools[$pool_a[$i]['name']] = $pool_a[$i];
895
				}
896
			}
897
		}
898
		/* Convert sitedown entries to pools and re-attach */
899
		for ($i = 0; isset($vs_a[$i]); $i++) {
900
			/* Set mode while we're here. */
901
			$vs_a[$i]['mode'] = "redirect_mode";
902
			if (isset($vs_a[$i]['sitedown'])) {
903
				$pool = array();
904
				$pool['type'] = 'server';
905
				$pool['behaviour'] = 'balance';
906
				$pool['name'] = "{$vs_a[$i]['name']}-sitedown";
907
				$pool['descr'] = sprintf(gettext("Sitedown pool for VS: %s"), $vs_a[$i]['name']);
908
				$pool['port'] = $pools[$vs_a[$i]['pool']]['port'];
909
				$pool['servers'] = array();
910
				$pool['servers'][] = $vs_a[$i]['sitedown'];
911
				$pool['monitor'] = $pools[$vs_a[$i]['pool']]['monitor'];
912
				$pool_a[] = $pool;
913
				$vs_a[$i]['sitedown'] = $pool['name'];
914
			}
915
		}
916
	}
917
	if(count($config['load_balancer']) == 0) {
918
		unset($config['load_balancer']);
919
	}
920
	mwexec('/usr/sbin/pw groupadd -n _relayd -g 913');
921
	mwexec('/usr/sbin/pw useradd -n _relayd -c "Relay Daemon" -d /var/empty -s /usr/sbin/nologin -u 913 -g 913');
922
}
923

    
924

    
925
function upgrade_046_to_047() {
926
	global $config;
927
	/* Upgrade IPsec from tunnel to phase1/phase2 */
928

    
929
	if(is_array($config['ipsec']['tunnel'])) {
930

    
931
		$a_phase1 = array();
932
		$a_phase2 = array();
933
		$ikeid = 0;
934

    
935
		foreach ($config['ipsec']['tunnel'] as $tunnel) {
936

    
937
			unset($ph1ent);
938
			unset($ph2ent);
939

    
940
			/*
941
				*  attempt to locate an enabled phase1
942
				*  entry that matches the peer gateway
943
				*/
944

    
945
			if (!isset($tunnel['disabled'])) {
946

    
947
				$remote_gateway = $tunnel['remote-gateway'];
948

    
949
				foreach ($a_phase1 as $ph1tmp) {
950
					if ($ph1tmp['remote-gateway'] == $remote_gateway) {
951
						$ph1ent = $ph1tmp;
952
						break;
953
					}
954
				}
955
			}
956

    
957
			/* none found, create a new one */
958

    
959
			if (!isset( $ph1ent )) {
960

    
961
				/* build new phase1 entry */
962

    
963
				$ph1ent = array();
964

    
965
				$ph1ent['ikeid'] = ++$ikeid;
966

    
967
				if (isset($tunnel['disabled']))
968
					$ph1ent['disabled'] = $tunnel['disabled'];
969

    
970
				/* convert to the new vip[$vhid] name */
971
				if(preg_match("/^carp/", $tunnel['interface'])) {
972
					$carpid = str_replace("carp", "", $tunnel['interface']);
973
					$tunnel['interface'] = "vip" . $config['virtualip']['vip'][$carpid]['vhid'];
974
				}
975
				$ph1ent['interface'] = $tunnel['interface'];
976
				$ph1ent['remote-gateway'] = $tunnel['remote-gateway'];
977
				$ph1ent['descr'] = $tunnel['descr'];
978

    
979
				$ph1ent['mode'] = $tunnel['p1']['mode'];
980

    
981
				if (isset($tunnel['p1']['myident']['myaddress']))
982
					$ph1ent['myid_type'] = "myaddress";
983
				if (isset($tunnel['p1']['myident']['address'])) {
984
					$ph1ent['myid_type'] = "address";
985
					$ph1ent['myid_data'] = $tunnel['p1']['myident']['address'];
986
				}
987
				if (isset($tunnel['p1']['myident']['fqdn'])) {
988
					$ph1ent['myid_type'] = "fqdn";
989
					$ph1ent['myid_data'] = $tunnel['p1']['myident']['fqdn'];
990
				}
991
				if (isset($tunnel['p1']['myident']['ufqdn'])) {
992
					$ph1ent['myid_type'] = "user_fqdn";
993
					$ph1ent['myid_data'] = $tunnel['p1']['myident']['ufqdn'];
994
				}
995
				if (isset($tunnel['p1']['myident']['asn1dn'])) {
996
					$ph1ent['myid_type'] = "asn1dn";
997
					$ph1ent['myid_data'] = $tunnel['p1']['myident']['asn1dn'];
998
				}
999
				if (isset($tunnel['p1']['myident']['dyn_dns'])) {
1000
					$ph1ent['myid_type'] = "dyn_dns";
1001
					$ph1ent['myid_data'] = $tunnel['p1']['myident']['dyn_dns'];
1002
				}
1003

    
1004
				$ph1ent['peerid_type'] = "peeraddress";
1005

    
1006
				switch ($tunnel['p1']['encryption-algorithm']) {
1007
					case "des":
1008
					$ph1alg = array( 'name' => 'des' );
1009
					break;
1010
					case "3des":
1011
					$ph1alg = array( 'name' => '3des' );
1012
					break;
1013
					case "blowfish":
1014
					$ph1alg = array( 'name' => 'blowfish', 'keylen' => '128'  );
1015
					break;
1016
					case "cast128":
1017
					$ph1alg = array( 'name' => 'cast128' );
1018
					break;
1019
					case "rijndael":
1020
					$ph1alg = array( 'name' => 'aes', 'keylen' => '128' );
1021
					break;
1022
					case "rijndael 256":
1023
					case "aes 256":
1024
					$ph1alg = array( 'name' => 'aes', 'keylen' => '256' );
1025
					break;
1026
				}
1027

    
1028
				$ph1ent['encryption-algorithm'] = $ph1alg;
1029
				$ph1ent['hash-algorithm'] = $tunnel['p1']['hash-algorithm'];
1030
				$ph1ent['dhgroup'] = $tunnel['p1']['dhgroup'];
1031
				$ph1ent['lifetime'] = $tunnel['p1']['lifetime'];
1032
				$ph1ent['authentication_method'] = $tunnel['p1']['authentication_method'];
1033

    
1034
				if (isset($tunnel['p1']['pre-shared-key']))
1035
					$ph1ent['pre-shared-key'] = $tunnel['p1']['pre-shared-key'];
1036
				if (isset($tunnel['p1']['cert']))
1037
					$ph1ent['cert'] = $tunnel['p1']['cert'];
1038
				if (isset($tunnel['p1']['peercert']))
1039
					$ph1ent['peercert'] = $tunnel['p1']['peercert'];
1040
				if (isset($tunnel['p1']['private-key']))
1041
					$ph1ent['private-key'] = $tunnel['p1']['private-key'];
1042

    
1043
				$ph1ent['nat_traversal'] = "on";
1044
				$ph1ent['dpd_enable'] = 1;
1045
				$ph1ent['dpd_delay'] = 10;
1046
				$ph1ent['dpd_maxfail'] = 5;
1047

    
1048
				$a_phase1[] = $ph1ent;
1049
			}
1050

    
1051
			/* build new phase2 entry */
1052

    
1053
			$ph2ent = array();
1054

    
1055
			$ph2ent['ikeid'] = $ph1ent['ikeid'];
1056

    
1057
			if (isset($tunnel['disabled']))
1058
				$ph1ent['disabled'] = $tunnel['disabled'];
1059

    
1060
			$ph2ent['descr'] = sprintf(gettext("phase2 for %s"), $tunnel['descr']);
1061

    
1062
			$type = "lan";
1063
			if ($tunnel['local-subnet']['network'])
1064
				$type = $tunnel['local-subnet']['network'];
1065
			if ($tunnel['local-subnet']['address']) {
1066
				list($address,$netbits) = explode("/",$tunnel['local-subnet']['address']);
1067
				if (is_null($netbits))
1068
					$type = "address";
1069
				else
1070
					$type = "network";
1071
			}
1072

    
1073
			switch ($type) {
1074
				case "address":
1075
				$ph2ent['localid'] = array('type' => $type,'address' => $address);
1076
				break;
1077
				case "network":
1078
				$ph2ent['localid'] = array('type' => $type,'address' => $address,'netbits' => $netbits);
1079
				break;
1080
				default:
1081
				$ph2ent['localid'] = array('type' => $type);
1082
				break;
1083
			}
1084

    
1085
			list($address,$netbits) = explode("/",$tunnel['remote-subnet']);
1086
			$ph2ent['remoteid'] = array('type' => 'network','address' => $address,'netbits' => $netbits);
1087

    
1088
			$ph2ent['protocol'] = $tunnel['p2']['protocol'];
1089

    
1090
			$aes_count = 0;
1091
			foreach( $tunnel['p2']['encryption-algorithm-option'] as $tunalg ) {
1092
				$aes_found = false;
1093
				switch ($tunalg) {
1094
					case "des":
1095
					$ph2alg = array( 'name' => 'des' );
1096
					break;
1097
					case "3des":
1098
					$ph2alg = array( 'name' => '3des' );
1099
					break;
1100
					case "blowfish":
1101
					$ph2alg = array( 'name' => 'blowfish', 'keylen' => 'auto'  );
1102
					break;
1103
					case "cast128":
1104
					$ph2alg = array( 'name' => 'cast128' );
1105
					break;
1106
					case "rijndael":
1107
					case "rijndael 256":
1108
					case "aes 256":
1109
					$ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' );
1110
					$aes_found = true;
1111
					$aes_count++;
1112
					break;
1113
				}
1114

    
1115
				if( !$aes_found || ($aes_count < 2))
1116
					$ph2ent['encryption-algorithm-option'][] = $ph2alg;
1117
			}
1118

    
1119
			$ph2ent['hash-algorithm-option'] = $tunnel['p2']['hash-algorithm-option'];
1120
			$ph2ent['pfsgroup'] = $tunnel['p2']['pfsgroup'];
1121
			$ph2ent['lifetime'] = $tunnel['p2']['lifetime'];
1122

    
1123
			if (isset($tunnel['pinghost']['pinghost']))
1124
				$ph2ent['pinghost'] = $tunnel['pinghost'];
1125

    
1126
			$a_phase2[] = $ph2ent;
1127
		}
1128

    
1129
		unset($config['ipsec']['tunnel']);
1130
		$config['ipsec']['phase1'] = $a_phase1;
1131
		$config['ipsec']['phase2'] = $a_phase2;
1132
	}
1133

    
1134
	/* Upgrade Mobile IPsec */
1135
	if (isset($config['ipsec']['mobileclients'])
1136
		&& is_array($config['ipsec']['mobileclients'])
1137
		&& is_array($config['ipsec']['mobileclients']['p1'])
1138
		&& is_array($config['ipsec']['mobileclients']['p2'])) {
1139

    
1140
		if (isset($config['ipsec']['mobileclients']['enable'])) {
1141
			$config['ipsec']['client']['enable'] = true;
1142
			$config['ipsec']['client']['user_source'] = 'system';
1143
			$config['ipsec']['client']['group_source'] = 'system';
1144
		}
1145

    
1146
		$mobilecfg = $config['ipsec']['mobileclients'];
1147

    
1148
		$ph1ent = array();
1149
		$ph1ent['ikeid'] = ++$ikeid;
1150

    
1151
		if (!isset($mobilecfg['enable']))
1152
			$ph1ent['disabled'] = true;
1153

    
1154
		/* Assume WAN since mobile tunnels couldn't be on a separate interface on 1.2.x */
1155
		$ph1ent['interface'] = 'wan';
1156
		$ph1ent['descr'] = "Mobile Clients (upgraded)";
1157
		$ph1ent['mode'] = $mobilecfg['p1']['mode'];
1158

    
1159
		if (isset($mobilecfg['p1']['myident']['myaddress']))
1160
			$ph1ent['myid_type'] = "myaddress";
1161
		if (isset($mobilecfg['p1']['myident']['address'])) {
1162
			$ph1ent['myid_type'] = "address";
1163
			$ph1ent['myid_data'] = $mobilecfg['p1']['myident']['address'];
1164
		}
1165
		if (isset($mobilecfg['p1']['myident']['fqdn'])) {
1166
			$ph1ent['myid_type'] = "fqdn";
1167
			$ph1ent['myid_data'] = $mobilecfg['p1']['myident']['fqdn'];
1168
		}
1169
		if (isset($mobilecfg['p1']['myident']['ufqdn'])) {
1170
			$ph1ent['myid_type'] = "user_fqdn";
1171
			$ph1ent['myid_data'] = $mobilecfg['p1']['myident']['ufqdn'];
1172
		}
1173
		if (isset($mobilecfg['p1']['myident']['asn1dn'])) {
1174
			$ph1ent['myid_type'] = "asn1dn";
1175
			$ph1ent['myid_data'] = $mobilecfg['p1']['myident']['asn1dn'];
1176
		}
1177
		if (isset($mobilecfg['p1']['myident']['dyn_dns'])) {
1178
			$ph1ent['myid_type'] = "dyn_dns";
1179
			$ph1ent['myid_data'] = $mobilecfg['p1']['myident']['dyn_dns'];
1180
		}
1181
		$ph1ent['peerid_type'] = "fqdn";
1182
		$ph1ent['peerid_data'] = "";
1183

    
1184
		switch ($mobilecfg['p1']['encryption-algorithm']) {
1185
			case "des":
1186
			$ph1alg = array( 'name' => 'des' );
1187
			break;
1188
			case "3des":
1189
			$ph1alg = array( 'name' => '3des' );
1190
			break;
1191
			case "blowfish":
1192
			$ph1alg = array( 'name' => 'blowfish', 'keylen' => '128'  );
1193
			break;
1194
			case "cast128":
1195
			$ph1alg = array( 'name' => 'cast128' );
1196
			break;
1197
			case "rijndael":
1198
			$ph1alg = array( 'name' => 'aes', 'keylen' => '128' );
1199
			break;
1200
			case "rijndael 256":
1201
			case "aes 256":
1202
			$ph1alg = array( 'name' => 'aes', 'keylen' => '256' );
1203
			break;
1204
		}
1205

    
1206
		$ph1ent['encryption-algorithm'] = $ph1alg;
1207
		$ph1ent['hash-algorithm'] = $mobilecfg['p1']['hash-algorithm'];
1208
		$ph1ent['dhgroup'] = $mobilecfg['p1']['dhgroup'];
1209
		$ph1ent['lifetime'] = $mobilecfg['p1']['lifetime'];
1210
		$ph1ent['authentication_method'] = $mobilecfg['p1']['authentication_method'];
1211

    
1212
		if (isset($mobilecfg['p1']['cert']))
1213
			$ph1ent['cert'] = $mobilecfg['p1']['cert'];
1214
		if (isset($mobilecfg['p1']['peercert']))
1215
			$ph1ent['peercert'] = $mobilecfg['p1']['peercert'];
1216
		if (isset($mobilecfg['p1']['private-key']))
1217
			$ph1ent['private-key'] = $mobilecfg['p1']['private-key'];
1218

    
1219
		$ph1ent['nat_traversal'] = "on";
1220
		$ph1ent['dpd_enable'] = 1;
1221
		$ph1ent['dpd_delay'] = 10;
1222
		$ph1ent['dpd_maxfail'] = 5;
1223
		$ph1ent['mobile'] = true;
1224

    
1225
		$ph2ent = array();
1226
		$ph2ent['ikeid'] = $ph1ent['ikeid'];
1227
		$ph2ent['descr'] = "phase2 for ".$mobilecfg['descr'];
1228
		$ph2ent['localid'] = array('type' => 'none');
1229
		$ph2ent['remoteid'] = array('type' => 'mobile');
1230
		$ph2ent['protocol'] = $mobilecfg['p2']['protocol'];
1231

    
1232
		$aes_count = 0;
1233
		foreach( $mobilecfg['p2']['encryption-algorithm-option'] as $tunalg ) {
1234
			$aes_found = false;
1235
			switch ($tunalg) {
1236
				case "des":
1237
				$ph2alg = array( 'name' => 'des' );
1238
				break;
1239
				case "3des":
1240
				$ph2alg = array( 'name' => '3des' );
1241
				break;
1242
				case "blowfish":
1243
				$ph2alg = array( 'name' => 'blowfish', 'keylen' => 'auto'  );
1244
				break;
1245
				case "cast128":
1246
				$ph2alg = array( 'name' => 'cast128' );
1247
				break;
1248
				case "rijndael":
1249
				case "rijndael 256":
1250
				case "aes 256":
1251
				$ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' );
1252
				$aes_found = true;
1253
				$aes_count++;
1254
				break;
1255
			}
1256

    
1257
			if( !$aes_found || ($aes_count < 2))
1258
				$ph2ent['encryption-algorithm-option'][] = $ph2alg;
1259
		}
1260
		$ph2ent['hash-algorithm-option'] = $mobilecfg['p2']['hash-algorithm-option'];
1261
		$ph2ent['pfsgroup'] = $mobilecfg['p2']['pfsgroup'];
1262
		$ph2ent['lifetime'] = $mobilecfg['p2']['lifetime'];
1263
		$ph2ent['mobile'] = true;
1264

    
1265
		$config['ipsec']['phase1'][] = $ph1ent;
1266
		$config['ipsec']['phase2'][] = $ph2ent;
1267
		unset($config['ipsec']['mobileclients']);
1268
	}
1269
}
1270

    
1271

    
1272
function upgrade_047_to_048() {
1273
	global $config;
1274
	if (!empty($config['dyndns'])) {
1275
		$config['dyndnses'] = array();
1276
		$config['dyndnses']['dyndns'] = array();
1277
		if(isset($config['dyndns'][0]['host'])) {
1278
			$tempdyn = array();
1279
			$tempdyn['enable'] = isset($config['dyndns'][0]['enable']);
1280
			$tempdyn['type'] = $config['dyndns'][0]['type'];
1281
			$tempdyn['wildcard'] = isset($config['dyndns'][0]['wildcard']);
1282
			$tempdyn['username'] = $config['dyndns'][0]['username'];
1283
			$tempdyn['password'] = $config['dyndns'][0]['password'];
1284
			$tempdyn['host'] = $config['dyndns'][0]['host'];
1285
			$tempdyn['mx'] = $config['dyndns'][0]['mx'];		
1286
			$tempdyn['interface'] = "wan";
1287
			$tempdyn['descr'] = sprintf(gettext("Upgraded Dyndns %s"), $tempdyn['type']);
1288
			$config['dyndnses']['dyndns'][] = $tempdyn;
1289
		}
1290
		unset($config['dyndns']);
1291
	}		
1292
	if (!empty($config['dnsupdate'])) {
1293
		$pconfig = $config['dnsupdate'][0];
1294
		if (!$pconfig['ttl'])
1295
			$pconfig['ttl'] = 60;
1296
		if (!$pconfig['keytype'])
1297
			$pconfig['keytype'] = "zone";
1298
		$pconfig['interface'] = "wan";
1299
		$config['dnsupdates']['dnsupdate'][] = $pconfig;
1300
		unset($config['dnsupdate']);
1301
	}
1302

    
1303
	if (is_array($config['pppoe']) && is_array($config['pppoe'][0])) {
1304
		$pconfig = array();
1305
		$pconfig['username'] = $config['pppoe'][0]['username'];
1306
		$pconfig['password'] = $config['pppoe'][0]['password'];
1307
		$pconfig['provider'] = $config['pppoe'][0]['provider'];
1308
		$pconfig['ondemand'] = isset($config['pppoe'][0]['ondemand']);
1309
		$pconfig['timeout'] = $config['pppoe'][0]['timeout'];
1310
		unset($config['pppoe']);
1311
		$config['interfaces']['wan']['pppoe_username'] = $pconfig['username'];
1312
		$config['interfaces']['wan']['pppoe_password'] = $pconfig['password'];
1313
		$config['interfaces']['wan']['provider'] = $pconfig['provider'];
1314
		$config['interfaces']['wan']['ondemand'] = isset($pconfig['ondemand']);
1315
		$config['interfaces']['wan']['timeout'] = $pconfig['timeout'];
1316
	}
1317
	if (is_array($config['pptp'])) {
1318
		$pconfig = array();
1319
		$pconfig['username'] = $config['pptp']['username'];
1320
		$pconfig['password'] = $config['pptp']['password'];
1321
		$pconfig['provider'] = $config['pptp']['provider'];
1322
		$pconfig['ondemand'] = isset($config['pptp']['ondemand']);
1323
		$pconfig['timeout'] = $config['pptp']['timeout'];
1324
		unset($config['pptp']);
1325
		$config['interfaces']['wan']['pptp_username'] = $pconfig['username'];
1326
		$config['interfaces']['wan']['pptp_password'] = $pconfig['password'];
1327
		$config['interfaces']['wan']['provider'] = $pconfig['provider'];
1328
		$config['interfaces']['wan']['ondemand'] = isset($pconfig['ondemand'] );
1329
		$config['interfaces']['wan']['timeout'] = $pconfig['timeout'];
1330
	}
1331
}
1332

    
1333

    
1334
function upgrade_048_to_049() {
1335
	global $config;
1336
	/* setup new all users group */
1337
	$all = array();
1338
	$all['name'] = "all";
1339
	$all['description'] = gettext("All Users");
1340
	$all['scope'] = "system";
1341
	$all['gid'] = 1998;
1342
	$all['member'] = array();
1343

    
1344
	if (!is_array($config['system']['user']))
1345
		$config['system']['user'] = array();
1346
	if (!is_array($config['system']['group']))
1347
		$config['system']['group'] = array();
1348

    
1349
	/* work around broken uid assignments */
1350
	$config['system']['nextuid'] = 2000;
1351
	foreach ($config['system']['user'] as & $user) {
1352
		if (isset($user['uid']) && !$user['uid'])
1353
			continue;
1354
		$user['uid'] = $config['system']['nextuid']++;
1355
	}
1356

    
1357
	/* work around broken gid assignments */
1358
	$config['system']['nextgid'] = 2000;
1359
	foreach ($config['system']['group'] as & $group) {
1360
		if ($group['name'] == $g['admin_group'])
1361
			$group['gid'] = 1999;
1362
		else
1363
			$group['gid'] = $config['system']['nextgid']++;
1364
	}
1365

    
1366
	/* build group membership information */
1367
	foreach ($config['system']['group'] as & $group) {
1368
		$group['member'] = array();
1369
		foreach ($config['system']['user'] as & $user) {
1370
			$groupnames = explode(",", $user['groupname']);
1371
			if (in_array($group['name'],$groupnames))
1372
				$group['member'][] = $user['uid'];
1373
		}
1374
	}
1375

    
1376
	/* reset user group information */
1377
	foreach ($config['system']['user'] as & $user) {
1378
		unset($user['groupname']);
1379
		$all['member'][] = $user['uid'];
1380
	}
1381

    
1382
	/* reset group scope information */
1383
	foreach ($config['system']['group'] as & $group)
1384
		if ($group['name'] != $g['admin_group'])
1385
		$group['scope'] = "user";
1386

    
1387
	/* insert new all group */
1388
	$groups = Array();
1389
	$groups[] = $all;
1390
	$groups = array_merge($config['system']['group'],$groups);
1391
	$config['system']['group'] = $groups;
1392
}
1393

    
1394

    
1395
function upgrade_049_to_050() {
1396
	global $config;
1397

    
1398
	if (!is_array($config['system']['user']))
1399
		$config['system']['user'] = array();
1400
	/* update user privileges */
1401
	foreach ($config['system']['user'] as & $user) {
1402
		$privs = array();
1403
		if (!is_array($user['priv'])) {
1404
			unset($user['priv']);
1405
			continue;
1406
		}
1407
		foreach ($user['priv'] as $priv) {
1408
			switch($priv['id']) {
1409
				case "hasshell":
1410
				$privs[] = "user-shell-access";
1411
				break;
1412
				case "copyfiles":
1413
				$privs[] = "user-copy-files";
1414
				break;
1415
			}
1416
		}
1417
		$user['priv'] = $privs;
1418
	}
1419

    
1420
	/* update group privileges */
1421
	foreach ($config['system']['group'] as & $group) {
1422
		$privs = array();
1423
		if (!is_array($group['pages'])) {
1424
			unset($group['pages']);
1425
			continue;
1426
		}
1427
		foreach ($group['pages'] as $page) {
1428
			$priv = map_page_privname($page);
1429
			if ($priv)
1430
				$privs[] = $priv;
1431
		}
1432
		unset($group['pages']);
1433
		$group['priv'] = $privs;
1434
	}
1435

    
1436
	/* sync all local account information */
1437
	local_sync_accounts();
1438
}
1439

    
1440

    
1441
function upgrade_050_to_051() {
1442
	global $config;
1443
	$pconfig = array();
1444
	$pconfig['descr'] = "Set to 0 to disable filtering on the incoming and outgoing member interfaces.";
1445
	$pconfig['tunable'] = "net.link.bridge.pfil_member";
1446
	$pconfig['value'] = "1";
1447
	$config['sysctl']['item'][] = $pconfig;
1448
	$pconfig = array();
1449
	$pconfig['descr'] = "Set to 1 to enable filtering on the bridge interface";
1450
	$pconfig['tunable'] = "net.link.bridge.pfil_bridge";
1451
	$pconfig['value'] = "0";
1452
	$config['sysctl']['item'][] = $pconfig;
1453

    
1454
	unset($config['bridge']);
1455

    
1456
	$convert_bridges = false;
1457
	foreach($config['interfaces'] as $intf) {
1458
		if (isset($intf['bridge']) && $intf['bridge'] <> "") {
1459
			$config['bridges'] = array();
1460
			$config['bridges']['bridged'] = array();
1461
			$convert_bridges = true;
1462
			break;
1463
		}
1464
	}
1465
	if ($convert_bridges == true) {
1466
		$i = 0;
1467
		foreach ($config['interfaces'] as $ifr => &$intf) {
1468
			if (isset($intf['bridge']) && $intf['bridge'] <> "") {
1469
				$nbridge = array();
1470
				$nbridge['members'] = "{$ifr},{$intf['bridge']}";
1471
				$nbridge['descr'] = sprintf(gettext("Converted bridged %s"), $ifr);
1472
				$nbridge['bridgeif'] = "bridge{$i}";
1473
				$config['bridges']['bridged'][] = $nbridge;
1474
				unset($intf['bridge']);
1475
				$i++;
1476
			}
1477
		}
1478
	}
1479
}
1480

    
1481

    
1482
function upgrade_051_to_052() {
1483
	global $config;
1484
	$config['openvpn'] = array();
1485
	if (!is_array($config['ca']))
1486
		$config['ca'] = array();
1487
	if (!is_array($config['cert']))
1488
		$config['cert'] = array();
1489

    
1490
	$vpnid = 1;
1491

    
1492
	/* openvpn server configurations */
1493
	if (is_array($config['installedpackages']['openvpnserver'])) {
1494
		$config['openvpn']['openvpn-server'] = array();
1495

    
1496
		$index = 1;
1497
		foreach($config['installedpackages']['openvpnserver']['config'] as $server) {
1498

    
1499
			if (!is_array($server))
1500
				continue;
1501

    
1502
			if ($server['auth_method'] == "pki") {
1503

    
1504
				/* create ca entry */
1505
				$ca = array();
1506
				$ca['refid'] = uniqid();
1507
				$ca['descr'] = "OpenVPN Server CA #{$index}";
1508
				$ca['crt'] = $server['ca_cert'];
1509
				$config['ca'][] = $ca;
1510

    
1511
				/* create ca reference */
1512
				unset($server['ca_cert']);
1513
				$server['caref'] = $ca['refid'];
1514

    
1515
				/* create a crl entry if needed */
1516
				if (!empty($server['crl'][0])) {
1517
					$crl = array();
1518
					$crl['refid'] = uniqid();
1519
					$crl['descr'] = "Imported OpenVPN CRL #{$index}";
1520
					$crl['caref'] = $ca['refid'];
1521
					$crl['text'] = $server['crl'][0];
1522
					if(!is_array($config['crl']))
1523
						$config['crl'] = array();
1524
					$config['crl'][] = $crl;
1525
					$server['crlref'] = $crl['refid'];
1526
				}
1527
				unset($server['crl']);
1528

    
1529
				/* create cert entry */
1530
				$cert = array();
1531
				$cert['refid'] = uniqid();
1532
				$cert['descr'] = "OpenVPN Server Certificate #{$index}";
1533
				$cert['crt'] = $server['server_cert'];
1534
				$cert['prv'] = $server['server_key'];
1535
				$config['cert'][] = $cert;
1536

    
1537
				/* create cert reference */
1538
				unset($server['server_cert']);
1539
				unset($server['server_key']);
1540
				$server['certref'] = $cert['refid'];
1541

    
1542
				$index++;
1543
			}
1544

    
1545
			/* determine operational mode */
1546
			if ($server['auth_method'] == 'pki') {
1547
				if($server['nopool']) {
1548
					$server['mode'] = "p2p_tls";
1549
				} else {
1550
					$server['mode'] = "server_tls";
1551
				}
1552
			} else {
1553
				$server['mode'] = "p2p_shared_key";
1554
			}
1555
			unset($server['auth_method']);
1556

    
1557
			/* modify configuration values */
1558
			$server['dh_length'] = 1024;
1559
			unset($server['dh_params']);
1560
			if (!$server['interface'])
1561
				$server['interface'] = 'wan';
1562
			$server['tunnel_network'] = $server['addresspool'];
1563
			unset($server['addresspool']);
1564
			if (isset($server['use_lzo'])) {
1565
				$server['compression'] = "on";
1566
				unset($server['use_lzo']);
1567
			}
1568
			if ($server['nopool'])
1569
				$server['pool_enable'] = false;
1570
			else
1571
				$server['pool_enable'] = "yes";
1572
			unset($server['nopool']);
1573
			$server['dns_domain'] = $server['dhcp_domainname'];
1574
			unset($server['dhcp_domainname']);
1575
			$server['dns_server1'] = $server['dhcp_dns'];
1576
			unset($server['dhcp_dns']);
1577
			$server['ntp_server1'] = $server['dhcp_ntp'];
1578
			unset($server['dhcp_ntp']);
1579
			if ($server['dhcp_nbtdisable'])
1580
				$server['netbios_enable'] = false;
1581
			else
1582
				$server['netbios_enable'] = "yes";
1583
			unset($server['dhcp_nbtdisable']);
1584
			$server['netbios_ntype'] = $server['dhcp_nbttype'];
1585
			unset($server['dhcp_nbttype']);
1586
			$server['netbios_scope'] = $server['dhcp_nbtscope'];
1587
			unset($server['dhcp_nbtscope']);
1588
			$server['nbdd_server1'] = $server['dhcp_nbdd'];
1589
			unset($server['dhcp_nbdd']);
1590
			$server['wins_server1'] = $server['dhcp_wins'];
1591
			unset($server['dhcp_wins']);
1592

    
1593
			if (!empty($server['disable']))
1594
				$server['disable'] = true;
1595
			else
1596
				unset($server['disable']);
1597

    
1598
			/* allocate vpnid */
1599
			$server['vpnid'] = $vpnid++;
1600

    
1601
			if (!empty($server['custom_options'])) {
1602
				$cstmopts = array();
1603
				$tmpcstmopts = explode(";", $server['custom_options']);
1604
				$assigned = false;
1605
				$tmpstr = "";
1606
				foreach ($tmpcstmopts as $tmpcstmopt) {
1607
					$tmpstr = str_replace(" ", "", $tmpcstmopt);
1608
					if (substr($tmpstr,0 ,6) == "devtun") {
1609
						$assigned = true;
1610
						continue;
1611
					} else if (substr($tmpstr, 0, 5) == "local") {
1612
						$localip = substr($tmpstr, 5);
1613
						$server['ipaddr'] = str_replace("\n", "", $localip);
1614
					} else
1615
						$cstmopts[] = $tmpcstmopt;
1616
				}
1617
				$server['custom_options'] = implode(";", $cstmopts);
1618
				if ($assigned == true) {
1619
					$realif = substr($tmpstr, 3);
1620
					foreach ($config['interfaces'] as $iface => $cfgif) {
1621
						if ($cfgif['if'] == $realif) {
1622
							$config['interfaces'][$iface]['if'] = "ovpns{$server['vpnid']}";
1623
							break;
1624
						}
1625
					}
1626
				}
1627
			}
1628

    
1629
			$config['openvpn']['openvpn-server'][] = $server;
1630
		}
1631
		unset($config['installedpackages']['openvpnserver']);
1632
	}
1633

    
1634
	/* openvpn client configurations */
1635
	if (is_array($config['installedpackages']['openvpnclient'])) {
1636
		$config['openvpn']['openvpn-client'] = array();
1637

    
1638
		$index = 1;
1639
		foreach($config['installedpackages']['openvpnclient']['config'] as $client) {
1640

    
1641
			if (!is_array($client))
1642
				continue;
1643

    
1644
			if ($client['auth_method'] == "pki") {
1645

    
1646
				/* create ca entry */
1647
				$ca = array();
1648
				$ca['refid'] = uniqid();
1649
				$ca['descr'] = "OpenVPN Client CA #{$index}";
1650
				$ca['crt'] = $client['ca_cert'];
1651
				$ca['crl'] = $client['crl'];
1652
				$config['ca'][] = $ca;
1653

    
1654
				/* create ca reference */
1655
				unset($client['ca_cert']);
1656
				unset($client['crl']);
1657
				$client['caref'] = $ca['refid'];
1658

    
1659
				/* create cert entry */
1660
				$cert = array();
1661
				$cert['refid'] = uniqid();
1662
				$cert['descr'] = "OpenVPN Client Certificate #{$index}";
1663
				$cert['crt'] = $client['client_cert'];
1664
				$cert['prv'] = $client['client_key'];
1665
				$config['cert'][] = $cert;
1666

    
1667
				/* create cert reference */
1668
				unset($client['client_cert']);
1669
				unset($client['client_key']);
1670
				$client['certref'] = $cert['refid'];
1671

    
1672
				$index++;
1673
			}
1674

    
1675
			/* determine operational mode */
1676
			if ($client['auth_method'] == 'pki')
1677
				$client['mode'] = "p2p_tls";
1678
			else
1679
				$client['mode'] = "p2p_shared_key";
1680
			unset($client['auth_method']);
1681

    
1682
			/* modify configuration values */
1683
			if (!$client['interface'])
1684
				$client['interface'] = 'wan';
1685
			$client['tunnel_network'] = $client['interface_ip'];
1686
			unset($client['interface_ip']);
1687
			$client['server_addr'] = $client['serveraddr'];
1688
			unset($client['serveraddr']);
1689
			$client['server_port'] = $client['serverport'];
1690
			unset($client['serverport']);
1691
			$client['proxy_addr'] = $client['poxy_hostname'];
1692
			unset($client['proxy_addr']);
1693
			if (isset($client['use_lzo'])) {
1694
				$client['compression'] = "on";
1695
				unset($client['use_lzo']);
1696
			}
1697
			$client['resolve_retry'] = $client['infiniteresolvretry'];
1698
			unset($client['infiniteresolvretry']);
1699

    
1700
			/* allocate vpnid */
1701
			$client['vpnid'] = $vpnid++;
1702

    
1703
			if (!empty($client['custom_options'])) {
1704
				$cstmopts = array();
1705
				$tmpcstmopts = explode(";", $client['custom_options']);
1706
				$assigned = false;
1707
				$tmpstr = "";
1708
				foreach ($tmpcstmopts as $tmpcstmopt) {
1709
					$tmpstr = str_replace(" ", "", $tmpcstmopt);
1710
					if (substr($tmpstr,0 ,6) == "devtun") {
1711
						$assigned = true;
1712
						continue;
1713
					} else if (substr($tmpstr, 0, 5) == "local") {
1714
                                                $localip = substr($tmpstr, 5);
1715
                                                $client['ipaddr'] = str_replace("\n", "", $localip);
1716
					} else
1717
						$cstmopts[] = $tmpcstmopt;
1718
				}
1719
				$client['custom_options'] = implode(";", $cstmopts);
1720
				if ($assigned == true) {
1721
					$realif = substr($tmpstr, 3);
1722
					foreach ($config['interfaces'] as $iface => $cfgif) {
1723
						if ($cfgif['if'] == $realif) {
1724
							$config['interfaces'][$iface]['if'] = "ovpnc{$client['vpnid']}";
1725
							break;
1726
						}
1727
					}
1728
				}
1729
			}
1730

    
1731
			if (!empty($client['disable']))
1732
				$client['disable'] = true;
1733
			else
1734
				unset($client['disable']);
1735

    
1736
			$config['openvpn']['openvpn-client'][] = $client;
1737
		}
1738

    
1739
		unset($config['installedpackages']['openvpnclient']);
1740
	}
1741

    
1742
	/* openvpn client specific configurations */
1743
	if (is_array($config['installedpackages']['openvpncsc'])) {
1744
		$config['openvpn']['openvpn-csc'] = array();
1745

    
1746
		foreach($config['installedpackages']['openvpncsc']['config'] as $csc) {
1747

    
1748
			if (!is_array($csc))
1749
				continue;
1750

    
1751
			/* modify configuration values */
1752
			$csc['common_name'] = $csc['commonname'];
1753
			unset($csc['commonname']);
1754
			$csc['tunnel_network'] = $csc['ifconfig_push'];
1755
			unset($csc['ifconfig_push']);
1756
			$csc['dns_domain'] = $csc['dhcp_domainname'];
1757
			unset($csc['dhcp_domainname']);
1758
			$csc['dns_server1'] = $csc['dhcp_dns'];
1759
			unset($csc['dhcp_dns']);
1760
			$csc['ntp_server1'] = $csc['dhcp_ntp'];
1761
			unset($csc['dhcp_ntp']);
1762
			if ($csc['dhcp_nbtdisable'])
1763
				$csc['netbios_enable'] = false;
1764
			else
1765
				$csc['netbios_enable'] = "yes";
1766
			unset($csc['dhcp_nbtdisable']);
1767
			$csc['netbios_ntype'] = $csc['dhcp_nbttype'];
1768
			unset($csc['dhcp_nbttype']);
1769
			$csc['netbios_scope'] = $csc['dhcp_nbtscope'];
1770
			unset($csc['dhcp_nbtscope']);
1771
			$csc['nbdd_server1'] = $csc['dhcp_nbdd'];
1772
			unset($csc['dhcp_nbdd']);
1773
			$csc['wins_server1'] = $csc['dhcp_wins'];
1774
			unset($csc['dhcp_wins']);
1775

    
1776
			if (!empty($csc['disable']))
1777
				$csc['disable'] = true;
1778
			else
1779
				unset($csc['disable']);
1780

    
1781
			$config['openvpn']['openvpn-csc'][] = $csc;
1782
		}
1783

    
1784
		unset($config['installedpackages']['openvpncsc']);
1785
	}
1786

    
1787
	if (count($config['openvpn']['openvpn-server']) > 0 ||
1788
		count($config['openvpn']['openvpn-client']) > 0) {
1789
		$ovpnrule = array();
1790
                $ovpnrule['type'] = "pass";
1791
                $ovpnrule['interface'] = "openvpn";
1792
                $ovpnrule['statetype'] = "keep state";
1793
                $ovpnrule['source'] = array();
1794
                $ovpnrule['destination'] = array();
1795
                $ovpnrule['source']['any'] = true;
1796
                $ovpnrule['destination']['any'] = true;
1797
                $ovpnrule['descr'] = gettext("Auto added OpenVPN rule from config upgrade.");
1798
		$config['filter']['rule'][] = $ovpnrule;
1799
	}
1800

    
1801
	/*
1802
		* FIXME: hack to keep things working with no installedpackages
1803
		* or carp array in the configuration data.
1804
		*/
1805
	if (!is_array($config['installedpackages']))
1806
		$config['installedpackages'] = array();
1807
	if (!is_array($config['installedpackages']['carp']))
1808
		$config['installedpackages']['carp'] = array();
1809

    
1810
}
1811

    
1812

    
1813
function upgrade_052_to_053() {
1814
	global $config;
1815
	if (!is_array($config['ca']))
1816
		$config['ca'] = array();
1817
	if (!is_array($config['cert']))
1818
		$config['cert'] = array();
1819

    
1820
	/* migrate advanced admin page webui ssl to certifcate mngr */
1821
	if ($config['system']['webgui']['certificate'] &&
1822
	$config['system']['webgui']['private-key']) {
1823

    
1824
		/* create cert entry */
1825
		$cert = array();
1826
		$cert['refid'] = uniqid();
1827
		$cert['descr'] = "webConfigurator SSL Certificate";
1828
		$cert['crt'] = $config['system']['webgui']['certificate'];
1829
		$cert['prv'] = $config['system']['webgui']['private-key'];
1830
		$config['cert'][] = $cert;
1831

    
1832
		/* create cert reference */
1833
		unset($config['system']['webgui']['certificate']);
1834
		unset($config['system']['webgui']['private-key']);
1835
		$config['system']['webgui']['ssl-certref'] = $cert['refid'];
1836
	}
1837

    
1838
	/* migrate advanced admin page ssh keys to user manager */
1839
	if ($config['system']['ssh']['authorizedkeys']) {
1840
		$admin_user =& getUserEntryByUID(0);
1841
		$admin_user['authorizedkeys'] = $config['system']['ssh']['authorizedkeys'];
1842
		unset($config['system']['ssh']['authorizedkeys']);
1843
	}
1844
}
1845

    
1846

    
1847
function upgrade_053_to_054() {
1848
	global $config;
1849
	if(is_array($config['load_balancer']['lbpool'])) {
1850
		$lbpool_arr = $config['load_balancer']['lbpool'];
1851
		$lbpool_srv_arr = array();
1852
		$gateway_group_arr = array();
1853
		$gateways = return_gateways_array();
1854
		$group_name_changes = array();
1855
		if (! is_array($config['gateways']['gateway_item']))
1856
			$config['gateways']['gateway_item'] = array();
1857

    
1858
		$a_gateways =& $config['gateways']['gateway_item'];
1859
		foreach($lbpool_arr as $lbpool) {
1860
			if($lbpool['type'] == "gateway") {
1861
				// Gateway Groups have to have valid names in pf, old lb pools did not. Clean them up.
1862
				$group_name = ereg_replace("[^A-Za-z0-9]", "", $lbpool['name'] );
1863
				// If we made and changes, check for collisions and note the change.
1864
				if ($group_name != $lbpool['name']) {
1865
					// Make sure the name isn't already in use.
1866
					foreach ($gateway_group_arr as $gwg) {
1867
						// If the name is in use, add some random bits to avoid collision.
1868
						if ($gwg['name'] == $group_name)
1869
							$group_name .= uniqid();
1870
					}
1871
					$group_name_changes[$lbpool['name']] = $group_name;
1872
				}
1873
				$gateway_group['name'] = $group_name;
1874
				$gateway_group['descr'] = $lbpool['descr'];
1875
				$gateway_group['trigger'] = "down";
1876
				$gateway_group['item'] = array();
1877
				$i = 0;
1878
				foreach($lbpool['servers'] as $member) {
1879
					$split = split("\|", $member);
1880
					$interface = $split[0];
1881
					$monitor = $split[1];
1882
					/* on static upgraded configuration we automatically prepend GW_ */
1883
					$static_name = "GW_" . strtoupper($interface);
1884
					if(is_ipaddr($monitor))
1885
						foreach ($a_gateways as & $gw)
1886
							if ($gw['name'] == $static_name)
1887
								$gw['monitor'] = $monitor;
1888

    
1889
					/* on failover increment tier. Else always assign 1 */
1890
					if($lbpool['behaviour'] == "failover") {
1891
						$i++;
1892
					} else {
1893
						$i = 1;
1894
					}
1895
					$gateway_group['item'][] = "$static_name|$i";
1896
				}
1897
				$gateway_group_arr[] = $gateway_group;
1898
			} else {
1899
				$lbpool_srv_arr[] = $lbpool;
1900
			}
1901
		}
1902
		$config['load_balancer']['lbpool'] = $lbpool_srv_arr;
1903
		$config['gateways']['gateway_group'] = $gateway_group_arr;
1904
	}
1905
	// Unset lbpool if we no longer have any server pools
1906
	if (count($lbpool_srv_arr) == 0) {
1907
		if(empty($config['load_balancer'])) {
1908
			unset($config['load_balancer']);
1909
		} else {
1910
			unset($config['load_balancer']['lbpool']);
1911
		}
1912
	} else {
1913
		$config['load_balancer']['lbpool'] = $lbpool_srv_arr;
1914
	}
1915
	// Only set the gateway group array if we converted any
1916
	if (count($gateway_group_arr) != 0) {
1917
		$config['gateways']['gateway_group'] = $gateway_group_arr;
1918
		// Update any rules that had a gateway change, if any.
1919
		if (count($group_name_changes) > 0)
1920
			foreach ($config['filter']['rule'] as & $rule)
1921
				if (!empty($rule["gateway"]) && array_key_exists($rule["gateway"], $group_name_changes))
1922
					$rule["gateway"] = $group_name_changes[$rule["gateway"]];
1923
	}
1924
}
1925

    
1926

    
1927
function upgrade_054_to_055() {
1928
	global $config;
1929
	global $g;
1930

    
1931
	/* RRD files changed for quality, traffic and packets graphs */
1932
	//ini_set("max_execution_time", "1800");
1933
	/* convert traffic RRD file */
1934
	global $parsedcfg, $listtags;
1935
	$listtags = array("ds", "v", "rra", "row");
1936

    
1937
	$rrddbpath = "/var/db/rrd/";
1938
	$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
1939
	if ($g['platform'] != "pfSense") {
1940
		/* restore the databases, if we have one */
1941
		if (file_exists("{$g['cf_conf_path']}/rrd.tgz")) {
1942
			exec("cd /;LANG=C /usr/bin/tar -xzf {$g['cf_conf_path']}/rrd.tgz 2>&1", $rrdrestore, $rrdreturn);                        $rrdrestore = implode(" ", $rrdrestore);
1943
			if($rrdreturn <> 0) {
1944
				log_error("RRD restore failed exited with $rrdreturn, the error is: $rrdrestore\n");
1945
			}
1946
			/* Make sure to move the rrd backup out of the way. We will make a new one after converting. */
1947
			exec("/bin/mv {$g['cf_conf_path']}/rrd.tgz {$g['cf_conf_path']}/backup");
1948
		}
1949
	}
1950

    
1951
	$rrdinterval = 60;
1952
	$valid = $rrdinterval * 2;
1953

    
1954
	/* Asume GigE for now */
1955
	$downstream = 125000000;
1956
	$upstream = 125000000;
1957

    
1958
	/* build a list of quality databases */
1959
	/* roundtrip has become delay */
1960
	function divide_delay($delayval) {
1961
		$delayval = floatval($delayval);
1962
		$delayval = ($delayval / 1000);
1963
		$delayval = " ". sprintf("%1.10e", $delayval) ." ";
1964
		return $delayval;
1965
	}
1966
	/* the roundtrip times need to be divided by 1000 to get seconds, really */
1967
	$databases = array();
1968
	if (!file_exists($rrddbpath))
1969
		@mkdir($rrddbpath);
1970
	chdir($rrddbpath);
1971
	$databases = glob("*-quality.rrd");
1972
	rsort($databases);
1973
	foreach($databases as $database) {
1974
		$xmldump = "{$database}.old.xml";
1975
		$xmldumpnew = "{$database}.new.xml";
1976

    
1977
		if ($g['booting'])
1978
			echo "Migrate RRD database {$database} to new format for IPv6 \n";
1979
		mwexec("$rrdtool tune {$rrddbpath}{$database} -r roundtrip:delay 2>&1");
1980

    
1981
		dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}");
1982
		$rrdold = xml2array(file_get_contents("{$g['tmp_path']}/{$xmldump}"), 1, "tag");
1983
		$rrdold = $rrdold['rrd'];
1984

    
1985
		$i = 0;
1986
		foreach($rrdold['rra'] as $rra) {
1987
			$l = 0;
1988
			foreach($rra['database']['row'] as $row) {
1989
				$vnew = divide_delay($row['v'][1]);
1990
				$rrdold['rra'][$i]['database']['row'][$l]['v'][1] = $vnew;
1991
				$l++;
1992
			}
1993
			$i++;
1994
		}
1995

    
1996
		$rrdxml = dump_xml_config_raw($rrdold, "rrd");
1997
		file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml);
1998
		mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1");
1999

    
2000
		unset($rrdold);
2001
		unset($rrdxmlarray);
2002
	}
2003
	/* let apinger recreate required files */
2004
	setup_gateways_monitor();
2005

    
2006
	/* build a list of traffic and packets databases */
2007
	$databases = array();
2008
	exec("cd $rrddbpath;/usr/bin/find *-traffic.rrd *-packets.rrd", $databases);
2009
	rsort($databases);
2010
	foreach($databases as $database) {
2011
		$databasetmp = "{$database}.tmp";
2012
		$xmldump = "{$database}.old.xml";
2013
		$xmldumptmp = "{$database}.tmp.xml";
2014
		$xmldumpnew = "{$database}.new.xml";
2015

    
2016
		if ($g['booting'])
2017
			echo "Migrate RRD database {$database} to new format \n";
2018
		/* rename DS source */
2019
		mwexec("$rrdtool tune {$rrddbpath}/{$database} -r in:inpass 2>&1");
2020
		mwexec("$rrdtool tune {$rrddbpath}/{$database} -r out:outpass 2>71");
2021

    
2022
		/* dump contents to xml and move database out of the way */
2023
		dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}");
2024

    
2025
		/* create new rrd database file */
2026
		$rrdcreate = "$rrdtool create {$g['tmp_path']}/{$databasetmp} --step $rrdinterval ";
2027
		$rrdcreate .= "DS:inpass:COUNTER:$valid:0:$downstream ";
2028
		$rrdcreate .= "DS:outpass:COUNTER:$valid:0:$upstream ";
2029
		$rrdcreate .= "DS:inblock:COUNTER:$valid:0:$downstream ";
2030
		$rrdcreate .= "DS:outblock:COUNTER:$valid:0:$upstream ";
2031
		$rrdcreate .= "RRA:AVERAGE:0.5:1:1000 ";
2032
		$rrdcreate .= "RRA:AVERAGE:0.5:5:1000 ";
2033
		$rrdcreate .= "RRA:AVERAGE:0.5:60:1000 ";
2034
		$rrdcreate .= "RRA:AVERAGE:0.5:720:1000 ";
2035

    
2036
		create_new_rrd("$rrdcreate");
2037
		/* create temporary xml from new RRD */
2038
		dump_rrd_to_xml("{$g['tmp_path']}/{$databasetmp}", "{$g['tmp_path']}/{$xmldumptmp}");
2039

    
2040
		$rrdold = xml2array(file_get_contents("{$g['tmp_path']}/{$xmldump}"), 1, "tag");
2041
		$rrdold = $rrdold['rrd'];
2042

    
2043
		$rrdnew = xml2array(file_get_contents("{$g['tmp_path']}/{$xmldumptmp}"), 1, "tag");
2044
		$rrdnew = $rrdnew['rrd'];
2045

    
2046
		/* remove any MAX RRA's. Not needed for traffic. */
2047
		$i = 0;
2048
		foreach ($rrdold['rra'] as $rra) {
2049
			if(trim($rra['cf']) == "MAX") {
2050
				unset($rrdold['rra'][$i]);
2051
			}
2052
			$i++;
2053
		}
2054

    
2055
		$rrdxmlarray = migrate_rrd_format($rrdold, $rrdnew);
2056
		$rrdxml = dump_xml_config_raw($rrdxmlarray, "rrd");
2057
		file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml);
2058
		mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1");
2059
		/* we now have the rrd with the new fields, adjust the size now. */
2060
		/* RRA 2 is 60 minutes, RRA 3 is 720 minutes */
2061
		mwexec("/bin/sync");
2062
		mwexec("$rrdtool resize {$rrddbpath}/{$database} 2 GROW 2000;/bin/mv resize.rrd {$rrddbpath}/{$database} 2>&1");
2063
		mwexec("/bin/sync");
2064
		mwexec("$rrdtool resize {$rrddbpath}/{$database} 3 GROW 2000;/bin/mv resize.rrd {$rrddbpath}/{$database} 2>&1");
2065
		unset($rrdold);
2066
		unset($rrdnew);
2067
		unset($rrdxmlarray);
2068
	}
2069
	enable_rrd_graphing();
2070
	/* Let's save the RRD graphs after we run enable RRD graphing */
2071
	/* The function will restore the rrd.tgz so we will save it after */
2072
	exec("cd /;LANG=C /usr/bin/tar -czf {$g['cf_conf_path']}/rrd.tgz -C / var/db/rrd/*.rrd");
2073
	if ($g['booting'])
2074
		echo "Updating configuration...";
2075
}
2076

    
2077

    
2078
function upgrade_055_to_056() {
2079
	global $config;
2080

    
2081
	if (!is_array($config['ca']))
2082
		$config['ca'] = array();
2083
	if (!is_array($config['cert']))
2084
		$config['cert'] = array();
2085

    
2086
	/* migrate ipsec ca's to cert manager */
2087
	if (is_array($config['ipsec']['cacert'])) {
2088
		foreach($config['ipsec']['cacert'] as & $cacert) {
2089
			$ca = array();
2090
			$ca['refid'] = uniqid();
2091
			if (is_array($cacert['cert']))
2092
				$ca['crt'] = $cacert['cert'][0];
2093
			else
2094
				$ca['crt'] = $cacert['cert'];
2095
			$ca['descr'] = $cacert['ident'];
2096
			$config['ca'][] = $ca;
2097
		}
2098
		unset($config['ipsec']['cacert']);
2099
	}
2100

    
2101
	/* migrate phase1 certificates to cert manager */
2102
	if (is_array($config['ipsec']['phase1'])) {
2103
		foreach($config['ipsec']['phase1'] as & $ph1ent) {
2104
			$cert = array();
2105
			$cert['refid'] = uniqid();
2106
			$cert['descr'] = "IPsec Peer {$ph1ent['remote-gateway']} Certificate";
2107
			if (is_array($ph1ent['cert']))
2108
				$cert['crt'] = $ph1ent['cert'][0];
2109
			else
2110
				$cert['crt'] = $ph1ent['cert'];
2111
			$cert['prv'] = $ph1ent['private-key'];
2112
			$config['cert'][] = $cert;
2113
			$ph1ent['certref'] = $cert['refid'];
2114
			if ($ph1ent['cert'])
2115
				unset($ph1ent['cert']);
2116
			if ($ph1ent['private-key'])
2117
				unset($ph1ent['private-key']);
2118
			if ($ph1ent['peercert'])
2119
				unset($ph1ent['peercert']);
2120
		}
2121
	}
2122
}
2123

    
2124

    
2125
function upgrade_056_to_057() {
2126
	global $config;
2127

    
2128
	if (!is_array($config['system']['user']))
2129
		$config['system']['user'] = array();
2130
	/* migrate captivate portal to user manager */
2131
	if (is_array($config['captiveportal']['user'])) {
2132
		foreach($config['captiveportal']['user'] as $user) {
2133
			// avoid user conflicts
2134
			$found = false;
2135
			foreach ($config['system']['user'] as $userent) {
2136
				if ($userent['name'] == $user['name']) {
2137
					$found = true;
2138
					break;
2139
				}
2140
			}
2141
			if ($found)
2142
				continue;
2143
			$user['scope'] = "user";
2144
			if (isset($user['expirationdate'])) {
2145
				$user['expires'] = $user['expirationdate'];
2146
				unset($user['expirationdate']);
2147
			}
2148
			if (isset($user['password'])) {
2149
				$user['md5-hash'] = $user['password'];
2150
				unset($user['password']);
2151
			}
2152
			$user['uid'] = $config['system']['nextuid']++;
2153
			$config['system']['user'][] = $user;
2154
		}
2155
		unset($config['captiveportal']['user']);
2156
	}
2157
}
2158

    
2159
function upgrade_057_to_058() {
2160
	global $config;
2161
	/* set all phase2 entries to tunnel mode */
2162
	if (is_array($config['ipsec']['phase2']))
2163
		foreach($config['ipsec']['phase2'] as & $ph2ent)
2164
			$ph2ent['mode'] = 'tunnel';
2165
}
2166

    
2167
function upgrade_058_to_059() {
2168
	global $config;
2169

    
2170
	if (is_array($config['schedules']['schedule'])) {
2171
		foreach ($config['schedules']['schedule'] as & $schedl)
2172
			$schedl['schedlabel'] = uniqid();
2173
	}
2174
}
2175

    
2176
function upgrade_059_to_060() {
2177
	global $config;
2178
	require_once("/etc/inc/certs.inc");
2179
	if (is_array($config['ca'])) {
2180
		/* Locate issuer for all CAs */
2181
		foreach ($config['ca'] as & $ca) {
2182
			$subject = cert_get_subject($ca['crt']);
2183
			$issuer = cert_get_issuer($ca['crt']);
2184
			if($issuer <> $subject) {
2185
				$issuer_crt =& lookup_ca_by_subject($issuer);
2186
				if($issuer_crt)
2187
					$ca['caref'] = $issuer_crt['refid'];
2188
			}
2189
		}
2190
		
2191
		/* Locate issuer for all certificates */
2192
		if (is_array($config['cert'])) {
2193
			foreach ($config['cert'] as & $cert) {
2194
				$subject = cert_get_subject($cert['crt']);
2195
				$issuer = cert_get_issuer($cert['crt']);
2196
				if($issuer <> $subject) {
2197
					$issuer_crt =& lookup_ca_by_subject($issuer);
2198
					if($issuer_crt)
2199
						$cert['caref'] = $issuer_crt['refid'];
2200
				}
2201
			}
2202
		}
2203
	}
2204
}
2205

    
2206
function upgrade_060_to_061() {
2207
	global $config;
2208

    
2209
	if (is_array($config['interfaces']['wan']))
2210
		$config['interfaces']['wan']['enable'] = true;
2211
	if (is_array($config['interfaces']['lan']))
2212
		$config['interfaces']['lan']['enable'] = true;
2213

    
2214
	/* On 1.2.3 the "mtu" field adjusted MSS.
2215
	   On 2.x the "mtu" field is actually the MTU. Rename accordingly.
2216
	   See redmine ticket #1886
2217
	*/
2218
	foreach ($config['interfaces'] as $ifr => &$intf) {
2219
		if (isset($intf['mtu']) && is_numeric($intf['mtu'])) {
2220
			$intf['mss'] = $intf['mtu'];
2221
			unset($intf['mtu']);
2222
		}
2223
	}
2224
}
2225

    
2226
function upgrade_061_to_062() {
2227
	global $config;
2228

    
2229
	/* Convert NAT port forwarding rules */
2230
	if (is_array($config['nat']['rule'])) {
2231
		$a_nat = &$config['nat']['rule'];
2232

    
2233
		foreach ($a_nat as &$natent) {
2234
			$natent['disabled'] = false;
2235
			$natent['nordr']    = false;
2236

    
2237
			$natent['source'] = array(
2238
				"not"     => false,
2239
				"any"     => true,
2240
				"port"    => ""
2241
			);
2242

    
2243
			$natent['destination'] = array(
2244
				"not"     => false,
2245
				"address" => $natent['external-address'],
2246
				"port"    => $natent['external-port']
2247
			);
2248

    
2249
			if (empty($natent['destination']['address'])) {
2250
				unset($natent['destination']['address']);
2251
				$natent['destination']['network'] = $natent['interface'] . 'ip';
2252
			} else if ($natent['destination']['address'] == 'any') {
2253
				unset($natent['destination']['address']);
2254
				$natent['destination']['any'] = true;
2255
			}
2256

    
2257
			unset($natent['external-address']);
2258
			unset($natent['external-port']);
2259
		}
2260

    
2261
		unset($natent);
2262
	}
2263
}
2264

    
2265
function upgrade_062_to_063() {
2266
	/* Upgrade legacy Themes to the new pfsense_ng */
2267
	global $config;
2268

    
2269
	switch($config['theme']) {
2270
		case "nervecenter":
2271
			$config['theme'] = "pfsense_ng";
2272
			break;
2273
	}
2274
	
2275
}
2276

    
2277
function upgrade_063_to_064() {
2278
	global $config;
2279
	$j=0;
2280
	$ifcfg = &$config['interfaces'];
2281
	
2282
	if (is_array($config['ppps']['ppp']) && count($config['ppps']['ppp'])) {	
2283
		foreach ($config['ppps']['ppp'] as $pppid => $ppp) {
2284
			$config['ppps']['ppp'][$pppid]['if'] = "ppp".$j;
2285
			$config['ppps']['ppp'][$pppid]['ptpid'] = $j;
2286
			$j++;
2287
			if (isset($ppp['port'])){
2288
				$config['ppps']['ppp'][$pppid]['ports'] = $ppp['port'];
2289
				unset($config['ppps']['ppp'][$pppid]['port']);
2290
			}
2291
			if (!isset($ppp['type'])){
2292
				$config['ppps']['ppp'][$pppid]['type'] = "ppp";
2293
			}
2294
			if (isset($ppp['defaultgw']))
2295
				unset($config['ppps']['ppp'][$pppid]['defaultgw']);
2296
		}
2297
	}
2298
	
2299
	if (!is_array($config['ppps']['ppp']))
2300
		$config['ppps']['ppp'] = array();
2301
	$a_ppps = &$config['ppps']['ppp'];
2302

    
2303
	foreach ($ifcfg as $ifname => $ifinfo) {
2304
		$ppp = array();
2305
		// For pppoe conversion
2306
		if ($ifinfo['ipaddr'] == "pppoe" || $ifinfo['ipaddr'] == "pptp"){
2307
			if (isset($ifinfo['ptpid']))
2308
				continue;
2309
			$ppp['ptpid'] =  $j;
2310
			$ppp['type'] = $ifinfo['ipaddr'];
2311
			$ppp['if'] = $ifinfo['ipaddr'].$j;
2312
			$ppp['ports'] = $ifinfo['if'];
2313
			if ($ifinfo['ipaddr'] == "pppoe"){
2314
				$ppp['username'] = $ifinfo['pppoe_username'];
2315
				$ppp['password'] = base64_encode($ifinfo['pppoe_password']);
2316
			}
2317
			if ($ifinfo['ipaddr'] == "pptp"){
2318
				$ppp['username'] = $ifinfo['pptp_username'];
2319
				$ppp['password'] = base64_encode($ifinfo['pptp_password']);
2320
			}
2321
			
2322
			if (isset($ifinfo['provider']))
2323
				$ppp['provider'] = $ifinfo['provider'];
2324
			if (isset($ifinfo['ondemand']))
2325
				$ppp['ondemand'] = true;
2326
			if (isset($ifinfo['timeout']))
2327
				$ppp['idletimeout'] = $ifinfo['timeout'];
2328
			if (isset($ifinfo['pppoe']['pppoe-reset-type'])){
2329
				$ppp['pppoe-reset-type'] = $ifinfo['pppoe']['pppoe-reset-type'];
2330
				if (is_array($config['cron']['item'])) {
2331
					for ($i = 0; $i < count($config['cron']['item']); $i++) {
2332
						$item = $config['cron']['item'][$i];
2333
						if (strpos($item['command'], "/conf/pppoe{$ifname}restart") !== false)
2334
							$config['cron']['item'][$i]['command'] = "/var/etc/pppoe_restart_" . $ppp['if'];
2335
					}
2336
				}
2337
			}
2338
			if (isset($ifinfo['local']))
2339
				$ppp['localip'] = $ifinfo['local'];
2340
			if (isset($ifinfo['subnet']))
2341
				$ppp['subnet'] = $ifinfo['subnet'];
2342
			if (isset($ifinfo['remote']))
2343
				$ppp['gateway'] = $ifinfo['remote'];
2344

    
2345
			$ifcfg[$ifname]['if'] = $ifinfo['ipaddr'].$j;
2346
			$j++;
2347
			
2348
			unset($ifcfg[$ifname]['pppoe_username']);
2349
			unset($ifcfg[$ifname]['pppoe_password']);
2350
			unset($ifcfg[$ifname]['provider']);
2351
			unset($ifcfg[$ifname]['ondemand']);
2352
			unset($ifcfg[$ifname]['timeout']);
2353
			unset($ifcfg[$ifname]['pppoe_reset']);
2354
			unset($ifcfg[$ifname]['pppoe_preset']);
2355
			unset($ifcfg[$ifname]['pppoe']);
2356
			unset($ifcfg[$ifname]['pptp_username']);
2357
			unset($ifcfg[$ifname]['pptp_password']);
2358
			unset($ifcfg[$ifname]['local']);
2359
			unset($ifcfg[$ifname]['subnet']);
2360
			unset($ifcfg[$ifname]['remote']);
2361
			
2362
			$a_ppps[] = $ppp;
2363
			
2364
		}
2365
	}
2366
}
2367

    
2368
function upgrade_064_to_065() {
2369
	/* Disable TSO and LRO in upgraded configs */
2370
	global $config;
2371
	$config['system']['disablesegmentationoffloading'] = true;
2372
	$config['system']['disablelargereceiveoffloading'] = true;
2373
}
2374

    
2375
function upgrade_065_to_066() {
2376
	global $config;
2377

    
2378
	$dhcrelaycfg =& $config['dhcrelay'];
2379

    
2380
        if (is_array($dhcrelaycfg)) {
2381
        	$dhcrelayifs = array();
2382
		$foundifs = false;
2383
        	/* DHCPRelay enabled on any interfaces? */
2384
                foreach ($dhcrelaycfg as $dhcrelayif => $dhcrelayifconf) {
2385
                        if (isset($dhcrelayifconf['enable'])) {
2386
				$dhcrelayifs[] = $dhcrelayif;
2387
				unset($dhcrelaycfg['dhcrelayif']);
2388
				$foundifs = true;
2389
			}
2390
                }
2391
		if ($foundifs == true)
2392
			$dhcrelaycfg['interface'] = implode(",", $dhcrelayifs);
2393
        }
2394
}
2395

    
2396
function upgrade_066_to_067() {
2397
	global $config;
2398
	if (isset($config['system']['ca'])) {
2399
		$config['ca'] = $config['system']['ca'];
2400
	}
2401
	if (isset($config['system']['cert'])) {
2402
		$config['cert'] = $config['system']['cert'];
2403
	}
2404
}
2405

    
2406
function upgrade_067_to_068() {
2407
	global $config;
2408

    
2409
	if (!empty($config['pppoe'])) {
2410
		$config['pppoes'] = array();
2411
		$config['pppoes']['pppoe'] = array();
2412
		$config['pppoes']['pppoe'][] = $config['pppoe'][0];
2413

    
2414
		if (is_array($config['pppoe']['user'])) {
2415
			$username = array(); 
2416
			foreach ($config['pppoe']['user'] as $user) {
2417
				$usr = $user['name'] . ":" . base64_encode($user['password']);
2418
				if ($user['ip'])
2419
					$usr .= ":{$user['ip']}";
2420
				$username[] = $usr;
2421
			}
2422
			$config['pppoes']['pppoe'][0]['username'] = implode(" ", $username);
2423
		}
2424
		unset($config['pppoe']);
2425
	}
2426
}
2427

    
2428
function upgrade_068_to_069() {
2429
	global $config;
2430
	if (!is_array($config['system']['user']))
2431
		return;
2432
	foreach ($config['system']['user'] as & $user) {
2433
		if (!is_array($user['cert']))
2434
			continue;
2435
		$rids = array();
2436
		foreach ($user['cert'] as $id => $cert) {
2437
			if (!isset($cert['descr']))
2438
				continue;
2439
			$tcert = $cert;
2440
			// Make sure each cert gets a refid
2441
			if (!isset($tcert['refid']))
2442
				$tcert['refid'] = uniqid();
2443
			// Keep the cert references for this user
2444
			$rids[] = $tcert['refid'];
2445
			$config['cert'][] = $tcert;
2446
		}
2447
		// Replace user certs with cert references instead.
2448
		if (count($rids) > 0)
2449
			$user['cert'] = $rids;
2450
	}
2451
}
2452

    
2453
function upgrade_069_to_070() {
2454
	global $config;
2455

    
2456
	/* Convert NAT 1:1 rules */
2457
	if (is_array($config['nat']['onetoone'])) {
2458
		foreach ($config['nat']['onetoone'] as $nidx => $natent) {
2459
			if ($natent['subnet'] == 32)
2460
				$config['nat']['onetoone'][$nidx]['source'] = array("address" => $natent['internal']);
2461
			else
2462
				$config['nat']['onetoone'][$nidx]['source'] = array("address" => $natent['internal'] . "/" . $natent['subnet']);
2463

    
2464
			$config['nat']['onetoone'][$nidx]['destination'] = array("any" => true);
2465

    
2466
			unset($config['nat']['onetoone'][$nidx]['internal']);
2467
			unset($config['nat']['onetoone'][$nidx]['subnet']);
2468
		}
2469

    
2470
		unset($natent);
2471
	}
2472
}
2473

    
2474
function upgrade_070_to_071() {
2475
	global $config;
2476

    
2477
	if (is_array($config['cron']['item'])) {
2478
		foreach($config['cron']['item'] as $idx => $cronitem) {
2479
			if(stristr($cronitem['command'], "checkreload.sh")) {
2480
				unset($config['cron']['item'][$idx]);
2481
				break;
2482
			}
2483
		}
2484
	}
2485
}
2486

    
2487
function rename_field(& $section, $oldname, $newname) {
2488
	if (is_array($section)) {
2489
		foreach($section as & $item) {
2490
			if (is_array($item) && !empty($item[$oldname]))
2491
				$item[$newname] = $item[$oldname];
2492
			if (is_array($item) && isset($item[$oldname]))
2493
				unset($item[$oldname]);
2494
		}
2495
	}
2496
}
2497

    
2498
function upgrade_071_to_072() {
2499
	global $config;
2500
	if (is_array($config['sysctl']) && is_array($config['sysctl']['item']))
2501
		rename_field($config['sysctl']['item'], 'desc', 'descr');
2502
}
2503

    
2504
function upgrade_072_to_073() {
2505
	global $config;
2506
	if (!is_array($config['load_balancer']))
2507
		return;
2508
	if (is_array($config['load_balancer']['monitor_type']))
2509
		rename_field($config['load_balancer']['monitor_type'], 'desc', 'descr');
2510
	if (is_array($config['load_balancer']['lbpool']))
2511
		rename_field($config['load_balancer']['lbpool'], 'desc', 'descr');
2512
	if (is_array($config['load_balancer']['lbaction']))
2513
		rename_field($config['load_balancer']['lbaction'], 'desc', 'descr');
2514
	if (is_array($config['load_balancer']['lbprotocol']))
2515
		rename_field($config['load_balancer']['lbprotocol'], 'desc', 'descr');
2516
	if (is_array($config['load_balancer']['virtual_server']))
2517
		rename_field($config['load_balancer']['virtual_server'], 'desc', 'descr');
2518
}
2519

    
2520
function upgrade_073_to_074() {
2521
	global $config;
2522
	rename_field($config['system']['user'], 'fullname', 'descr');
2523
}
2524

    
2525
function upgrade_074_to_075() {
2526
	global $config;
2527
	if (is_array($config['ca']))
2528
		rename_field($config['ca'], 'name', 'descr');
2529
	if (is_array($config['cert']))
2530
		rename_field($config['cert'], 'name', 'descr');
2531
	if (is_array($config['crl']))
2532
		rename_field($config['crl'], 'name', 'descr');
2533
}
2534

    
2535
function upgrade_075_to_076() {
2536
	global $config;
2537
	$cron_item = array();
2538
	$cron_item['minute'] = "30";
2539
	$cron_item['hour'] = "12";
2540
	$cron_item['mday'] = "*";
2541
	$cron_item['month'] = "*";
2542
	$cron_item['wday'] = "*";
2543
	$cron_item['who'] = "root";
2544
	$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.update_urltables";
2545
	$config['cron']['item'][] = $cron_item;
2546
}
2547

    
2548
function upgrade_076_to_077() {
2549
	global $config;
2550
	foreach($config['filter']['rule'] as & $rule) {
2551
	if (isset($rule['protocol']) && !empty($rule['protocol']))
2552
		$rule['protocol'] = strtolower($rule['protocol']);
2553
	}
2554
}
2555

    
2556
function upgrade_077_to_078() {
2557
	if (is_array($config['pptpd']) && is_array($config['pptpd']['radius'])
2558
		&& !is_array($config['pptpd']['radius']['server'])) {
2559
		$radarr = array();
2560
		$radsvr = array();
2561
		$radsvr['ip'] = $config['pptpd']['radius']['server'];
2562
		$radsvr['secret'] = $config['pptpd']['radius']['secret'];
2563
		$radsvr['port'] = 1812;
2564
		$radsvr['acctport'] = 1813;
2565
		$radsvr['enable'] = isset($config['pptpd']['radius']['enable']);
2566
		$radarr['accounting'] = isset($config['pptpd']['radius']['accounting']);
2567
		if ($radarr['accounting'])
2568
			$radarr['acct_update'] = $radsvr['ip'];
2569
		$radarr['server'] = $radsvr;
2570
		$config['pptpd']['radius'] = $radarr;
2571
	}
2572
}
2573
function upgrade_078_to_079() {
2574
	global $g;
2575
	/* Delete old and unused RRD file */
2576
	unlink_if_exists("{$g['vardb_path']}/rrd/captiveportal-totalusers.rrd");
2577
}
2578

    
2579
function upgrade_079_to_080() {
2580
	global $config;
2581

    
2582
	/* Upgrade config in 1.2.3 specifying a username other than admin for synching. */
2583
	if (!empty($config['system']['username']) && is_array($config['installedpackages']['carpsettings']) &&
2584
		is_array($config['installedpackages']['carpsettings']['config'])) {
2585
		$config['installedpackages']['carpsettings']['config'][0]['username'] = $config['system']['username'];
2586
		unset($config['system']['username']);
2587
	}
2588
}
2589

    
2590
function upgrade_080_to_081() {
2591
	global $config;
2592
	global $g;
2593

    
2594
	/* RRD files changed for quality, traffic and packets graphs */
2595
	/* convert traffic RRD file */
2596
	global $parsedcfg, $listtags;
2597
	$listtags = array("ds", "v", "rra", "row");
2598

    
2599
	$rrddbpath = "/var/db/rrd/";
2600
	$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
2601

    
2602
	$rrdinterval = 60;
2603
	$valid = $rrdinterval * 2;
2604

    
2605
	/* Asume GigE for now */
2606
	$downstream = 125000000;
2607
	$upstream = 125000000;
2608

    
2609
	/* build a list of traffic and packets databases */
2610
	$databases = array();
2611
	exec("cd $rrddbpath;/usr/bin/find *-traffic.rrd *-packets.rrd", $databases);
2612
	rsort($databases);
2613
	foreach($databases as $database) {
2614
		$databasetmp = "{$database}.tmp";
2615
		$xmldump = "{$database}.old.xml";
2616
		$xmldumptmp = "{$database}.tmp.xml";
2617
		$xmldumpnew = "{$database}.new.xml";
2618

    
2619
		if ($g['booting'])
2620
			echo "Migrate RRD database {$database} to new format for IPv6.\n";
2621

    
2622
		/* dump contents to xml and move database out of the way */
2623
		dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}");
2624

    
2625
		/* create new rrd database file */
2626
		$rrdcreate = "$rrdtool create {$g['tmp_path']}/{$databasetmp} --step $rrdinterval ";
2627
		$rrdcreate .= "DS:inpass:COUNTER:$valid:0:$downstream ";
2628
		$rrdcreate .= "DS:outpass:COUNTER:$valid:0:$upstream ";
2629
		$rrdcreate .= "DS:inblock:COUNTER:$valid:0:$downstream ";
2630
		$rrdcreate .= "DS:outblock:COUNTER:$valid:0:$upstream ";
2631
		$rrdcreate .= "DS:inpass6:COUNTER:$valid:0:$downstream ";
2632
		$rrdcreate .= "DS:outpass6:COUNTER:$valid:0:$upstream ";
2633
		$rrdcreate .= "DS:inblock6:COUNTER:$valid:0:$downstream ";
2634
		$rrdcreate .= "DS:outblock6:COUNTER:$valid:0:$upstream ";
2635
		$rrdcreate .= "RRA:AVERAGE:0.5:1:1000 ";
2636
		$rrdcreate .= "RRA:AVERAGE:0.5:5:1000 ";
2637
		$rrdcreate .= "RRA:AVERAGE:0.5:60:1000 ";
2638
		$rrdcreate .= "RRA:AVERAGE:0.5:720:3000 ";
2639

    
2640
		create_new_rrd("$rrdcreate");
2641
		/* create temporary xml from new RRD */
2642
		dump_rrd_to_xml("{$g['tmp_path']}/{$databasetmp}", "{$g['tmp_path']}/{$xmldumptmp}");
2643

    
2644
		$rrdoldxml = file_get_contents("{$g['tmp_path']}/{$xmldump}");
2645
		$rrdold = xml2array($rrdoldxml, 1, "tag");
2646
		$rrdold = $rrdold['rrd'];
2647

    
2648
		$rrdnewxml = file_get_contents("{$g['tmp_path']}/{$xmldumptmp}");
2649
		$rrdnew = xml2array($rrdnewxml, 1, "tag");
2650
		$rrdnew = $rrdnew['rrd'];
2651

    
2652
		/* remove any MAX RRA's. Not needed for traffic. */
2653
		$i = 0;
2654
		foreach ($rrdold['rra'] as $rra) {
2655
			if(trim($rra['cf']) == "MAX") {
2656
				unset($rrdold['rra'][$i]);
2657
			}
2658
			$i++;
2659
		}
2660

    
2661
		$rrdxmlarray = migrate_rrd_format($rrdold, $rrdnew);
2662
		$rrdxml = dump_xml_config_raw($rrdxmlarray, "rrd");
2663
		file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml);
2664
		mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1");
2665

    
2666
	}
2667
	enable_rrd_graphing();
2668
	if ($g['booting'])
2669
		echo "Updating configuration...";
2670
	foreach($config['filter']['rule'] as & $rule) {
2671
		if (isset($rule['protocol']) && !empty($rule['protocol']))
2672
			$rule['protocol'] = strtolower($rule['protocol']);
2673
	}
2674
}
2675

    
2676
function upgrade_081_to_082() {
2677
	global $config;
2678
	/* enable the allow IPv6 toggle */
2679
	$config['system']['ipv6allow'] = true;
2680
}
2681

    
2682
function upgrade_082_to_083() {
2683
	global $config;
2684
	/* Upgrade captiveportal config */
2685
	if (!empty($config['captiveportal'])) {
2686
		$tmpcp = $config['captiveportal'];
2687
		$config['captiveportal'] = array();
2688
		$config['captiveportal']['cpZone'] = array();
2689
		$config['captiveportal']['cpZone'] = $tmpcp;
2690
		$config['captiveportal']['cpZone']['zoneid'] = 8000;
2691
	}
2692
}
2693
?>
(50-50/63)