|
1
|
<?php
|
|
2
|
/*
|
|
3
|
Copyright (C) 2004-2009 Scott Ullrich <sullrich@gmail.com>
|
|
4
|
All rights reserved.
|
|
5
|
|
|
6
|
originally part of m0n0wall (http://m0n0.ch/wall)
|
|
7
|
Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
|
|
8
|
All rights reserved.
|
|
9
|
|
|
10
|
Redistribution and use in source and binary forms, with or without
|
|
11
|
modification, are permitted provided that the following conditions are met:
|
|
12
|
|
|
13
|
1. Redistributions of source code must retain the above copyright notice,
|
|
14
|
this list of conditions and the following disclaimer.
|
|
15
|
|
|
16
|
2. Redistributions in binary form must reproduce the above copyright
|
|
17
|
notice, this list of conditions and the following disclaimer in the
|
|
18
|
documentation and/or other materials provided with the distribution.
|
|
19
|
|
|
20
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
21
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
22
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
23
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
|
24
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
25
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
26
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
27
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
28
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
29
|
POSSIBILITY OF SUCH DAMAGE.
|
|
30
|
*/
|
|
31
|
|
|
32
|
|
|
33
|
/* Upgrade functions must be named:
|
|
34
|
* upgrade_XXX_to_YYY
|
|
35
|
* where XXX == previous version, zero padded, and YYY == next version, zero padded
|
|
36
|
*/
|
|
37
|
|
|
38
|
function upgrade_010_to_011() {
|
|
39
|
global $config;
|
|
40
|
$opti = 1;
|
|
41
|
$ifmap = array('lan' => 'lan', 'wan' => 'wan', 'pptp' => 'pptp');
|
|
42
|
|
|
43
|
/* convert DMZ to optional, if necessary */
|
|
44
|
if (isset($config['interfaces']['dmz'])) {
|
|
45
|
|
|
46
|
$dmzcfg = &$config['interfaces']['dmz'];
|
|
47
|
|
|
48
|
if ($dmzcfg['if']) {
|
|
49
|
$config['interfaces']['opt' . $opti] = array();
|
|
50
|
$optcfg = &$config['interfaces']['opt' . $opti];
|
|
51
|
|
|
52
|
$optcfg['enable'] = $dmzcfg['enable'];
|
|
53
|
$optcfg['descr'] = "DMZ";
|
|
54
|
$optcfg['if'] = $dmzcfg['if'];
|
|
55
|
$optcfg['ipaddr'] = $dmzcfg['ipaddr'];
|
|
56
|
$optcfg['subnet'] = $dmzcfg['subnet'];
|
|
57
|
|
|
58
|
$ifmap['dmz'] = "opt" . $opti;
|
|
59
|
$opti++;
|
|
60
|
}
|
|
61
|
|
|
62
|
unset($config['interfaces']['dmz']);
|
|
63
|
}
|
|
64
|
|
|
65
|
/* convert WLAN1/2 to optional, if necessary */
|
|
66
|
for ($i = 1; isset($config['interfaces']['wlan' . $i]); $i++) {
|
|
67
|
|
|
68
|
if (!$config['interfaces']['wlan' . $i]['if']) {
|
|
69
|
unset($config['interfaces']['wlan' . $i]);
|
|
70
|
continue;
|
|
71
|
}
|
|
72
|
|
|
73
|
$wlancfg = &$config['interfaces']['wlan' . $i];
|
|
74
|
$config['interfaces']['opt' . $opti] = array();
|
|
75
|
$optcfg = &$config['interfaces']['opt' . $opti];
|
|
76
|
|
|
77
|
$optcfg['enable'] = $wlancfg['enable'];
|
|
78
|
$optcfg['descr'] = "WLAN" . $i;
|
|
79
|
$optcfg['if'] = $wlancfg['if'];
|
|
80
|
$optcfg['ipaddr'] = $wlancfg['ipaddr'];
|
|
81
|
$optcfg['subnet'] = $wlancfg['subnet'];
|
|
82
|
$optcfg['bridge'] = $wlancfg['bridge'];
|
|
83
|
|
|
84
|
$optcfg['wireless'] = array();
|
|
85
|
$optcfg['wireless']['mode'] = $wlancfg['mode'];
|
|
86
|
$optcfg['wireless']['ssid'] = $wlancfg['ssid'];
|
|
87
|
$optcfg['wireless']['channel'] = $wlancfg['channel'];
|
|
88
|
$optcfg['wireless']['wep'] = $wlancfg['wep'];
|
|
89
|
|
|
90
|
$ifmap['wlan' . $i] = "opt" . $opti;
|
|
91
|
|
|
92
|
unset($config['interfaces']['wlan' . $i]);
|
|
93
|
$opti++;
|
|
94
|
}
|
|
95
|
|
|
96
|
/* convert filter rules */
|
|
97
|
$n = count($config['filter']['rule']);
|
|
98
|
for ($i = 0; $i < $n; $i++) {
|
|
99
|
|
|
100
|
$fr = &$config['filter']['rule'][$i];
|
|
101
|
|
|
102
|
/* remap interface */
|
|
103
|
if (array_key_exists($fr['interface'], $ifmap))
|
|
104
|
$fr['interface'] = $ifmap[$fr['interface']];
|
|
105
|
else {
|
|
106
|
/* remove the rule */
|
|
107
|
echo "\nWarning: filter rule removed " .
|
|
108
|
"(interface '{$fr['interface']}' does not exist anymore).";
|
|
109
|
unset($config['filter']['rule'][$i]);
|
|
110
|
continue;
|
|
111
|
}
|
|
112
|
|
|
113
|
/* remap source network */
|
|
114
|
if (isset($fr['source']['network'])) {
|
|
115
|
if (array_key_exists($fr['source']['network'], $ifmap))
|
|
116
|
$fr['source']['network'] = $ifmap[$fr['source']['network']];
|
|
117
|
else {
|
|
118
|
/* remove the rule */
|
|
119
|
echo "\nWarning: filter rule removed " .
|
|
120
|
"(source network '{$fr['source']['network']}' does not exist anymore).";
|
|
121
|
unset($config['filter']['rule'][$i]);
|
|
122
|
continue;
|
|
123
|
}
|
|
124
|
}
|
|
125
|
|
|
126
|
/* remap destination network */
|
|
127
|
if (isset($fr['destination']['network'])) {
|
|
128
|
if (array_key_exists($fr['destination']['network'], $ifmap))
|
|
129
|
$fr['destination']['network'] = $ifmap[$fr['destination']['network']];
|
|
130
|
else {
|
|
131
|
/* remove the rule */
|
|
132
|
echo "\nWarning: filter rule removed " .
|
|
133
|
"(destination network '{$fr['destination']['network']}' does not exist anymore).";
|
|
134
|
unset($config['filter']['rule'][$i]);
|
|
135
|
continue;
|
|
136
|
}
|
|
137
|
}
|
|
138
|
}
|
|
139
|
|
|
140
|
/* convert shaper rules */
|
|
141
|
$n = count($config['pfqueueing']['rule']);
|
|
142
|
if (is_array($config['pfqueueing']['rule']))
|
|
143
|
for ($i = 0; $i < $n; $i++) {
|
|
144
|
|
|
145
|
$fr = &$config['pfqueueing']['rule'][$i];
|
|
146
|
|
|
147
|
/* remap interface */
|
|
148
|
if (array_key_exists($fr['interface'], $ifmap))
|
|
149
|
$fr['interface'] = $ifmap[$fr['interface']];
|
|
150
|
else {
|
|
151
|
/* remove the rule */
|
|
152
|
echo "\nWarning: traffic shaper rule removed " .
|
|
153
|
"(interface '{$fr['interface']}' does not exist anymore).";
|
|
154
|
unset($config['pfqueueing']['rule'][$i]);
|
|
155
|
continue;
|
|
156
|
}
|
|
157
|
|
|
158
|
/* remap source network */
|
|
159
|
if (isset($fr['source']['network'])) {
|
|
160
|
if (array_key_exists($fr['source']['network'], $ifmap))
|
|
161
|
$fr['source']['network'] = $ifmap[$fr['source']['network']];
|
|
162
|
else {
|
|
163
|
/* remove the rule */
|
|
164
|
echo "\nWarning: traffic shaper rule removed " .
|
|
165
|
"(source network '{$fr['source']['network']}' does not exist anymore).";
|
|
166
|
unset($config['pfqueueing']['rule'][$i]);
|
|
167
|
continue;
|
|
168
|
}
|
|
169
|
}
|
|
170
|
|
|
171
|
/* remap destination network */
|
|
172
|
if (isset($fr['destination']['network'])) {
|
|
173
|
if (array_key_exists($fr['destination']['network'], $ifmap))
|
|
174
|
$fr['destination']['network'] = $ifmap[$fr['destination']['network']];
|
|
175
|
else {
|
|
176
|
/* remove the rule */
|
|
177
|
echo "\nWarning: traffic shaper rule removed " .
|
|
178
|
"(destination network '{$fr['destination']['network']}' does not exist anymore).";
|
|
179
|
unset($config['pfqueueing']['rule'][$i]);
|
|
180
|
continue;
|
|
181
|
}
|
|
182
|
}
|
|
183
|
}
|
|
184
|
}
|
|
185
|
|
|
186
|
|
|
187
|
function upgrade_011_to_012() {
|
|
188
|
global $config;
|
|
189
|
/* move LAN DHCP server config */
|
|
190
|
$tmp = $config['dhcpd'];
|
|
191
|
$config['dhcpd'] = array();
|
|
192
|
$config['dhcpd']['lan'] = $tmp;
|
|
193
|
|
|
194
|
/* encrypt password */
|
|
195
|
$config['system']['password'] = crypt($config['system']['password']);
|
|
196
|
}
|
|
197
|
|
|
198
|
|
|
199
|
function upgrade_012_to_013() {
|
|
200
|
global $config;
|
|
201
|
/* convert advanced outbound NAT config */
|
|
202
|
for ($i = 0; isset($config['nat']['advancedoutbound']['rule'][$i]); $i++) {
|
|
203
|
$curent = &$config['nat']['advancedoutbound']['rule'][$i];
|
|
204
|
$src = $curent['source'];
|
|
205
|
$curent['source'] = array();
|
|
206
|
$curent['source']['network'] = $src;
|
|
207
|
$curent['destination'] = array();
|
|
208
|
$curent['destination']['any'] = true;
|
|
209
|
}
|
|
210
|
|
|
211
|
/* add an explicit type="pass" to all filter rules to make things consistent */
|
|
212
|
for ($i = 0; isset($config['filter']['rule'][$i]); $i++) {
|
|
213
|
$config['filter']['rule'][$i]['type'] = "pass";
|
|
214
|
}
|
|
215
|
}
|
|
216
|
|
|
217
|
|
|
218
|
function upgrade_013_to_014() {
|
|
219
|
global $config;
|
|
220
|
/* convert shaper rules (make pipes) */
|
|
221
|
if (is_array($config['pfqueueing']['rule'])) {
|
|
222
|
$config['pfqueueing']['pipe'] = array();
|
|
223
|
|
|
224
|
for ($i = 0; isset($config['pfqueueing']['rule'][$i]); $i++) {
|
|
225
|
$curent = &$config['pfqueueing']['rule'][$i];
|
|
226
|
|
|
227
|
/* make new pipe and associate with this rule */
|
|
228
|
$newpipe = array();
|
|
229
|
$newpipe['descr'] = $curent['descr'];
|
|
230
|
$newpipe['bandwidth'] = $curent['bandwidth'];
|
|
231
|
$newpipe['delay'] = $curent['delay'];
|
|
232
|
$newpipe['mask'] = $curent['mask'];
|
|
233
|
$config['pfqueueing']['pipe'][$i] = $newpipe;
|
|
234
|
|
|
235
|
$curent['targetpipe'] = $i;
|
|
236
|
|
|
237
|
unset($curent['bandwidth']);
|
|
238
|
unset($curent['delay']);
|
|
239
|
unset($curent['mask']);
|
|
240
|
}
|
|
241
|
}
|
|
242
|
}
|
|
243
|
|
|
244
|
|
|
245
|
function upgrade_014_to_015() {
|
|
246
|
global $config;
|
|
247
|
/* Default route moved */
|
|
248
|
if (isset($config['interfaces']['wan']['gateway']))
|
|
249
|
if ($config['interfaces']['wan']['gateway'] <> "")
|
|
250
|
$config['interfaces']['wan']['gateway'] = $config['interfaces']['wan']['gateway'];
|
|
251
|
unset($config['interfaces']['wan']['gateway']);
|
|
252
|
|
|
253
|
/* Queues are no longer interface specific */
|
|
254
|
if (isset($config['interfaces']['lan']['schedulertype']))
|
|
255
|
unset($config['interfaces']['lan']['schedulertype']);
|
|
256
|
if (isset($config['interfaces']['wan']['schedulertype']))
|
|
257
|
unset($config['interfaces']['wan']['schedulertype']);
|
|
258
|
|
|
259
|
for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) {
|
|
260
|
if(isset($config['interfaces']['opt' . $i]['schedulertype']))
|
|
261
|
unset($config['interfaces']['opt' . $i]['schedulertype']);
|
|
262
|
}
|
|
263
|
}
|
|
264
|
|
|
265
|
|
|
266
|
function upgrade_015_to_016() {
|
|
267
|
global $config;
|
|
268
|
/* Alternate firmware URL moved */
|
|
269
|
if (isset($config['system']['firmwareurl']) && isset($config['system']['firmwarename'])) { // Only convert if *both* are defined.
|
|
270
|
$config['system']['alt_firmware_url'] = array();
|
|
271
|
$config['system']['alt_firmware_url']['enabled'] = "";
|
|
272
|
$config['system']['alt_firmware_url']['firmware_base_url'] = $config['system']['firmwareurl'];
|
|
273
|
$config['system']['alt_firmware_url']['firmware_filename'] = $config['system']['firmwarename'];
|
|
274
|
unset($config['system']['firmwareurl'], $config['system']['firmwarename']);
|
|
275
|
} else {
|
|
276
|
unset($config['system']['firmwareurl'], $config['system']['firmwarename']);
|
|
277
|
}
|
|
278
|
}
|
|
279
|
|
|
280
|
|
|
281
|
function upgrade_016_to_017() {
|
|
282
|
global $config;
|
|
283
|
/* wipe previous shaper configuration */
|
|
284
|
unset($config['shaper']['queue']);
|
|
285
|
unset($config['shaper']['rule']);
|
|
286
|
unset($config['interfaces']['wan']['bandwidth']);
|
|
287
|
unset($config['interfaces']['wan']['bandwidthtype']);
|
|
288
|
unset($config['interfaces']['lan']['bandwidth']);
|
|
289
|
unset($config['interfaces']['lan']['bandwidthtype']);
|
|
290
|
$config['shaper']['enable'] = FALSE;
|
|
291
|
}
|
|
292
|
|
|
293
|
|
|
294
|
function upgrade_017_to_018() {
|
|
295
|
global $config;
|
|
296
|
if(isset($config['proxyarp']) && is_array($config['proxyarp']['proxyarpnet'])) {
|
|
297
|
$proxyarp = &$config['proxyarp']['proxyarpnet'];
|
|
298
|
foreach($proxyarp as $arpent){
|
|
299
|
$vip = array();
|
|
300
|
$vip['mode'] = "proxyarp";
|
|
301
|
$vip['interface'] = $arpent['interface'];
|
|
302
|
$vip['descr'] = $arpent['descr'];
|
|
303
|
if (isset($arpent['range'])) {
|
|
304
|
$vip['range'] = $arpent['range'];
|
|
305
|
$vip['type'] = "range";
|
|
306
|
} else {
|
|
307
|
$subnet = explode('/', $arpent['network']);
|
|
308
|
$vip['subnet'] = $subnet[0];
|
|
309
|
if (isset($subnet[1])) {
|
|
310
|
$vip['subnet_bits'] = $subnet[1];
|
|
311
|
$vip['type'] = "network";
|
|
312
|
} else {
|
|
313
|
$vip['subnet_bits'] = "32";
|
|
314
|
$vip['type'] = "single";
|
|
315
|
}
|
|
316
|
}
|
|
317
|
$config['virtualip']['vip'][] = $vip;
|
|
318
|
}
|
|
319
|
unset($config['proxyarp']);
|
|
320
|
}
|
|
321
|
if(isset($config['installedpackages']) && isset($config['installedpackages']['carp']) && is_array($config['installedpackages']['carp']['config'])) {
|
|
322
|
$carp = &$config['installedpackages']['carp']['config'];
|
|
323
|
foreach($carp as $carpent){
|
|
324
|
$vip = array();
|
|
325
|
$vip['mode'] = "carp";
|
|
326
|
$vip['interface'] = "AUTO";
|
|
327
|
$vip['descr'] = "CARP vhid {$carpent['vhid']}";
|
|
328
|
$vip['type'] = "single";
|
|
329
|
$vip['vhid'] = $carpent['vhid'];
|
|
330
|
$vip['advskew'] = $carpent['advskew'];
|
|
331
|
$vip['password'] = $carpent['password'];
|
|
332
|
$vip['subnet'] = $carpent['ipaddress'];
|
|
333
|
$vip['subnet_bits'] = $carpent['netmask'];
|
|
334
|
$config['virtualip']['vip'][] = $vip;
|
|
335
|
}
|
|
336
|
unset($config['installedpackages']['carp']);
|
|
337
|
}
|
|
338
|
/* Server NAT is no longer needed */
|
|
339
|
unset($config['nat']['servernat']);
|
|
340
|
|
|
341
|
/* enable SSH */
|
|
342
|
if ($config['version'] == "1.8") {
|
|
343
|
$config['system']['sshenabled'] = true;
|
|
344
|
}
|
|
345
|
}
|
|
346
|
|
|
347
|
|
|
348
|
function upgrade_018_to_019() {
|
|
349
|
global $config;
|
|
350
|
$config['theme']="metallic";
|
|
351
|
}
|
|
352
|
|
|
353
|
|
|
354
|
function upgrade_019_to_020() {
|
|
355
|
global $config;
|
|
356
|
if(is_array($config['ipsec']['tunnel'])) {
|
|
357
|
reset($config['ipsec']['tunnel']);
|
|
358
|
while (list($index, $tunnel) = each($config['ipsec']['tunnel'])) {
|
|
359
|
/* Sanity check on required variables */
|
|
360
|
/* This fixes bogus <tunnel> entries - remnant of bug #393 */
|
|
361
|
if (!isset($tunnel['local-subnet']) && !isset($tunnel['remote-subnet'])) {
|
|
362
|
unset($config['ipsec']['tunnel'][$tunnel]);
|
|
363
|
}
|
|
364
|
}
|
|
365
|
}
|
|
366
|
}
|
|
367
|
|
|
368
|
function upgrade_020_to_021() {
|
|
369
|
global $config;
|
|
370
|
/* shaper scheduler moved */
|
|
371
|
if(isset($config['system']['schedulertype'])) {
|
|
372
|
$config['shaper']['schedulertype'] = $config['system']['schedulertype'];
|
|
373
|
unset($config['system']['schedulertype']);
|
|
374
|
}
|
|
375
|
}
|
|
376
|
|
|
377
|
|
|
378
|
function upgrade_021_to_022() {
|
|
379
|
global $config;
|
|
380
|
/* move gateway to wan interface */
|
|
381
|
$config['interfaces']['wan']['gateway'] = $config['system']['gateway'];
|
|
382
|
}
|
|
383
|
|
|
384
|
function upgrade_022_to_023() {
|
|
385
|
global $config;
|
|
386
|
if(isset($config['shaper'])) {
|
|
387
|
/* wipe previous shaper configuration */
|
|
388
|
unset($config['shaper']);
|
|
389
|
}
|
|
390
|
}
|
|
391
|
|
|
392
|
|
|
393
|
function upgrade_023_to_024() {
|
|
394
|
global $config;
|
|
395
|
}
|
|
396
|
|
|
397
|
|
|
398
|
function upgrade_024_to_025() {
|
|
399
|
global $config;
|
|
400
|
$config['interfaces']['wan']['use_rrd_gateway'] = $config['system']['use_rrd_gateway'];
|
|
401
|
unset($config['system']['use_rrd_gateway']);
|
|
402
|
}
|
|
403
|
|
|
404
|
|
|
405
|
function upgrade_025_to_026() {
|
|
406
|
global $config;
|
|
407
|
$cron_item = array();
|
|
408
|
$cron_item['minute'] = "0";
|
|
409
|
$cron_item['hour'] = "*";
|
|
410
|
$cron_item['mday'] = "*";
|
|
411
|
$cron_item['month'] = "*";
|
|
412
|
$cron_item['wday'] = "*";
|
|
413
|
$cron_item['who'] = "root";
|
|
414
|
$cron_item['command'] = "/usr/bin/nice -n20 newsyslog";
|
|
415
|
|
|
416
|
$config['cron']['item'][] = $cron_item;
|
|
417
|
|
|
418
|
$cron_item = array();
|
|
419
|
$cron_item['minute'] = "1,31";
|
|
420
|
$cron_item['hour'] = "0-5";
|
|
421
|
$cron_item['mday'] = "*";
|
|
422
|
$cron_item['month'] = "*";
|
|
423
|
$cron_item['wday'] = "*";
|
|
424
|
$cron_item['who'] = "root";
|
|
425
|
$cron_item['command'] = "/usr/bin/nice -n20 adjkerntz -a";
|
|
426
|
|
|
427
|
$config['cron']['item'][] = $cron_item;
|
|
428
|
|
|
429
|
$cron_item = array();
|
|
430
|
$cron_item['minute'] = "1";
|
|
431
|
$cron_item['hour'] = "*";
|
|
432
|
$cron_item['mday'] = "1";
|
|
433
|
$cron_item['month'] = "*";
|
|
434
|
$cron_item['wday'] = "*";
|
|
435
|
$cron_item['who'] = "root";
|
|
436
|
$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.update_bogons.sh";
|
|
437
|
|
|
438
|
$config['cron']['item'][] = $cron_item;
|
|
439
|
|
|
440
|
$cron_item = array();
|
|
441
|
$cron_item['minute'] = "*/60";
|
|
442
|
$cron_item['hour'] = "*";
|
|
443
|
$cron_item['mday'] = "*";
|
|
444
|
$cron_item['month'] = "*";
|
|
445
|
$cron_item['wday'] = "*";
|
|
446
|
$cron_item['who'] = "root";
|
|
447
|
$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout";
|
|
448
|
|
|
449
|
$config['cron']['item'][] = $cron_item;
|
|
450
|
|
|
451
|
$cron_item = array();
|
|
452
|
$cron_item['minute'] = "1";
|
|
453
|
$cron_item['hour'] = "1";
|
|
454
|
$cron_item['mday'] = "*";
|
|
455
|
$cron_item['month'] = "*";
|
|
456
|
$cron_item['wday'] = "*";
|
|
457
|
$cron_item['who'] = "root";
|
|
458
|
$cron_item['command'] = "/usr/bin/nice -n20 /etc/rc.dyndns.update";
|
|
459
|
|
|
460
|
$config['cron']['item'][] = $cron_item;
|
|
461
|
|
|
462
|
$cron_item = array();
|
|
463
|
$cron_item['minute'] = "*/60";
|
|
464
|
$cron_item['hour'] = "*";
|
|
465
|
$cron_item['mday'] = "*";
|
|
466
|
$cron_item['month'] = "*";
|
|
467
|
$cron_item['wday'] = "*";
|
|
468
|
$cron_item['who'] = "root";
|
|
469
|
$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot";
|
|
470
|
|
|
471
|
$config['cron']['item'][] = $cron_item;
|
|
472
|
|
|
473
|
$cron_item = array();
|
|
474
|
$cron_item['minute'] = "*/60";
|
|
475
|
$cron_item['hour'] = "*";
|
|
476
|
$cron_item['mday'] = "*";
|
|
477
|
$cron_item['month'] = "*";
|
|
478
|
$cron_item['wday'] = "*";
|
|
479
|
$cron_item['who'] = "root";
|
|
480
|
$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 1800 snort2c";
|
|
481
|
|
|
482
|
$config['cron']['item'][] = $cron_item;
|
|
483
|
|
|
484
|
$cron_item = array();
|
|
485
|
$cron_item['minute'] = "*/5";
|
|
486
|
$cron_item['hour'] = "*";
|
|
487
|
$cron_item['mday'] = "*";
|
|
488
|
$cron_item['month'] = "*";
|
|
489
|
$cron_item['wday'] = "*";
|
|
490
|
$cron_item['who'] = "root";
|
|
491
|
$cron_item['command'] = "/usr/local/bin/checkreload.sh";
|
|
492
|
|
|
493
|
$config['cron']['item'][] = $cron_item;
|
|
494
|
}
|
|
495
|
|
|
496
|
|
|
497
|
function upgrade_026_to_027() {
|
|
498
|
global $config;
|
|
499
|
}
|
|
500
|
|
|
501
|
|
|
502
|
function upgrade_027_to_028() {
|
|
503
|
global $config;
|
|
504
|
$founditem = false;
|
|
505
|
foreach($config['cron']['item'] as $cronitem) {
|
|
506
|
if($cronitem['command'] == "/usr/local/bin/checkreload.sh")
|
|
507
|
$founditem = true;
|
|
508
|
}
|
|
509
|
if($founditem == false) {
|
|
510
|
$cron_item = array();
|
|
511
|
$cron_item['minute'] = "*/5";
|
|
512
|
$cron_item['hour'] = "*";
|
|
513
|
$cron_item['mday'] = "*";
|
|
514
|
$cron_item['month'] = "*";
|
|
515
|
$cron_item['wday'] = "*";
|
|
516
|
$cron_item['who'] = "root";
|
|
517
|
$cron_item['command'] = "/usr/local/bin/checkreload.sh";
|
|
518
|
$config['cron']['item'][] = $cron_item;
|
|
519
|
}
|
|
520
|
}
|
|
521
|
|
|
522
|
|
|
523
|
function upgrade_028_to_029() {
|
|
524
|
global $config;
|
|
525
|
$rule_item = array();
|
|
526
|
$a_filter = &$config['filter']['rule'];
|
|
527
|
$rule_item['interface'] = "enc0";
|
|
528
|
$rule_item['type'] = "pass";
|
|
529
|
$rule_item['source']['any'] = true;
|
|
530
|
$rule_item['destination']['any'] = true;
|
|
531
|
$rule_item['descr'] = "Permit IPsec traffic.";
|
|
532
|
$rule_item['statetype'] = "keep state";
|
|
533
|
$a_filter[] = $rule_item;
|
|
534
|
}
|
|
535
|
|
|
536
|
|
|
537
|
function upgrade_029_to_030() {
|
|
538
|
global $config;
|
|
539
|
/* enable the rrd config setting by default */
|
|
540
|
$config['rrd']['enable'] = true;
|
|
541
|
}
|
|
542
|
|
|
543
|
|
|
544
|
function upgrade_030_to_031() {
|
|
545
|
global $config;
|
|
546
|
/* Insert upgrade code here */
|
|
547
|
}
|
|
548
|
|
|
549
|
|
|
550
|
function upgrade_031_to_032() {
|
|
551
|
global $config;
|
|
552
|
/* Insert upgrade code here */
|
|
553
|
}
|
|
554
|
|
|
555
|
|
|
556
|
function upgrade_032_to_033() {
|
|
557
|
global $config;
|
|
558
|
/* Insert upgrade code here */
|
|
559
|
}
|
|
560
|
|
|
561
|
|
|
562
|
function upgrade_033_to_034() {
|
|
563
|
global $config;
|
|
564
|
/* Insert upgrade code here */
|
|
565
|
}
|
|
566
|
|
|
567
|
|
|
568
|
function upgrade_034_to_035() {
|
|
569
|
global $config;
|
|
570
|
/* Insert upgrade code here */
|
|
571
|
}
|
|
572
|
|
|
573
|
|
|
574
|
function upgrade_035_to_036() {
|
|
575
|
global $config;
|
|
576
|
/* Insert upgrade code here */
|
|
577
|
}
|
|
578
|
|
|
579
|
|
|
580
|
function upgrade_036_to_037() {
|
|
581
|
global $config;
|
|
582
|
/* Insert upgrade code here */
|
|
583
|
}
|
|
584
|
|
|
585
|
|
|
586
|
function upgrade_037_to_038() {
|
|
587
|
global $config;
|
|
588
|
/* Insert upgrade code here */
|
|
589
|
}
|
|
590
|
|
|
591
|
|
|
592
|
function upgrade_038_to_039() {
|
|
593
|
global $config;
|
|
594
|
/* Insert upgrade code here */
|
|
595
|
}
|
|
596
|
|
|
597
|
|
|
598
|
function upgrade_039_to_040() {
|
|
599
|
global $config;
|
|
600
|
$config['system']['webgui']['auth_method'] = "session";
|
|
601
|
$config['system']['webgui']['backing_method'] = "htpasswd";
|
|
602
|
|
|
603
|
if (isset ($config['system']['username'])) {
|
|
604
|
$config['system']['group'] = array();
|
|
605
|
$config['system']['group'][0]['name'] = "admins";
|
|
606
|
$config['system']['group'][0]['description'] = "System Administrators";
|
|
607
|
$config['system']['group'][0]['scope'] = "system";
|
|
608
|
$config['system']['group'][0]['pages'] = "ANY";
|
|
609
|
$config['system']['group'][0]['home'] = "index.php";
|
|
610
|
$config['system']['group'][0]['gid'] = "110";
|
|
611
|
|
|
612
|
$config['system']['user'] = array();
|
|
613
|
$config['system']['user'][0]['name'] = "{$config['system']['username']}";
|
|
614
|
$config['system']['user'][0]['fullname'] = "System Administrator";
|
|
615
|
$config['system']['user'][0]['scope'] = "system";
|
|
616
|
$config['system']['user'][0]['groupname'] = "admins";
|
|
617
|
$config['system']['user'][0]['password'] = "{$config['system']['password']}";
|
|
618
|
$config['system']['user'][0]['uid'] = "0";
|
|
619
|
|
|
620
|
$config['system']['user'][0]['priv'] = array();
|
|
621
|
$config['system']['user'][0]['priv'][0]['id'] = "lockwc";
|
|
622
|
$config['system']['user'][0]['priv'][0]['name'] = "Lock webConfigurator";
|
|
623
|
$config['system']['user'][0]['priv'][0]['descr'] = "Indicates whether this user will lock access to the webConfigurator for other users.";
|
|
624
|
$config['system']['user'][0]['priv'][1]['id'] = "lock-ipages";
|
|
625
|
$config['system']['user'][0]['priv'][1]['name'] = "Lock individual pages";
|
|
626
|
$config['system']['user'][0]['priv'][1]['descr'] = "Indicates whether this user will lock individual HTML pages after having accessed a particular page (the lock will be freed if the user leaves or saves the page form).";
|
|
627
|
$config['system']['user'][0]['priv'][2]['id'] = "hasshell";
|
|
628
|
$config['system']['user'][0]['priv'][2]['name'] = "Has shell access";
|
|
629
|
$config['system']['user'][0]['priv'][2]['descr'] = "Indicates whether this user is able to login for example via SSH.";
|
|
630
|
$config['system']['user'][0]['priv'][3]['id'] = "copyfiles";
|
|
631
|
$config['system']['user'][0]['priv'][3]['name'] = "Is allowed to copy files";
|
|
632
|
$config['system']['user'][0]['priv'][3]['descr'] = "Indicates whether this user is allowed to copy files onto the {$g['product_name']} appliance via SCP/SFTP. If you are going to use this privilege, you must install scponly on the appliance (Hint: pkg_add -r scponly).";
|
|
633
|
$config['system']['user'][0]['priv'][4]['id'] = "isroot";
|
|
634
|
$config['system']['user'][0]['priv'][4]['name'] = "Is root user";
|
|
635
|
$config['system']['user'][0]['priv'][4]['descr'] = "This user is associated with the UNIX root user (you should associate this privilege only with one single user).";
|
|
636
|
|
|
637
|
$config['system']['nextuid'] = "111";
|
|
638
|
$config['system']['nextgid'] = "111";
|
|
639
|
|
|
640
|
/* wipe previous auth configuration */
|
|
641
|
unset ($config['system']['username']);
|
|
642
|
unset ($config['system']['password']);
|
|
643
|
}
|
|
644
|
}
|
|
645
|
|
|
646
|
function upgrade_040_to_041() {
|
|
647
|
global $config;
|
|
648
|
if(!$config['sysctl']) {
|
|
649
|
$config['sysctl']['item'] = array();
|
|
650
|
|
|
651
|
$config['sysctl']['item'][0]['tunable'] = "net.inet.tcp.blackhole";
|
|
652
|
$config['sysctl']['item'][0]['desc'] = "Drop packets to closed TCP ports without returning a RST";
|
|
653
|
$config['sysctl']['item'][0]['value'] = "2";
|
|
654
|
|
|
655
|
$config['sysctl']['item'][1]['tunable'] = "net.inet.udp.blackhole";
|
|
656
|
$config['sysctl']['item'][1]['desc'] = "Do not send ICMP port unreachable messages for closed UDP ports";
|
|
657
|
$config['sysctl']['item'][1]['value'] = "1";
|
|
658
|
|
|
659
|
$config['sysctl']['item'][2]['tunable'] = "net.inet.ip.random_id";
|
|
660
|
$config['sysctl']['item'][2]['desc'] = "Randomize the ID field in IP packets (default is 0: sequential IP IDs)";
|
|
661
|
$config['sysctl']['item'][2]['value'] = "1";
|
|
662
|
|
|
663
|
$config['sysctl']['item'][3]['tunable'] = "net.inet.tcp.drop_synfin";
|
|
664
|
$config['sysctl']['item'][3]['desc'] = "Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)";
|
|
665
|
$config['sysctl']['item'][3]['value'] = "1";
|
|
666
|
|
|
667
|
$config['sysctl']['item'][4]['tunable'] = "net.inet.ip.redirect";
|
|
668
|
$config['sysctl']['item'][4]['desc'] = "Disable sending IPv4 redirects";
|
|
669
|
$config['sysctl']['item'][4]['value'] = "0";
|
|
670
|
|
|
671
|
$config['sysctl']['item'][5]['tunable'] = "net.inet6.ip6.redirect";
|
|
672
|
$config['sysctl']['item'][5]['desc'] = "Disable sending IPv6 redirects";
|
|
673
|
$config['sysctl']['item'][5]['value'] = "0";
|
|
674
|
|
|
675
|
$config['sysctl']['item'][6]['tunable'] = "net.inet.tcp.syncookies";
|
|
676
|
$config['sysctl']['item'][6]['desc'] = "Generate SYN cookies for outbound SYN-ACK packets";
|
|
677
|
$config['sysctl']['item'][6]['value'] = "1";
|
|
678
|
|
|
679
|
$config['sysctl']['item'][7]['tunable'] = "net.inet.tcp.recvspace";
|
|
680
|
$config['sysctl']['item'][7]['desc'] = "Maximum incoming TCP datagram size";
|
|
681
|
$config['sysctl']['item'][7]['value'] = "65228";
|
|
682
|
|
|
683
|
$config['sysctl']['item'][8]['tunable'] = "net.inet.tcp.sendspace";
|
|
684
|
$config['sysctl']['item'][8]['desc'] = "Maximum outgoing TCP datagram size";
|
|
685
|
$config['sysctl']['item'][8]['value'] = "65228";
|
|
686
|
|
|
687
|
$config['sysctl']['item'][9]['tunable'] = "net.inet.ip.fastforwarding";
|
|
688
|
$config['sysctl']['item'][9]['desc'] = "Fastforwarding (see http://lists.freebsd.org/pipermail/freebsd-net/2004-January/002534.html)";
|
|
689
|
$config['sysctl']['item'][9]['value'] = "1";
|
|
690
|
|
|
691
|
$config['sysctl']['item'][10]['tunable'] = "net.inet.tcp.delayed_ack";
|
|
692
|
$config['sysctl']['item'][10]['desc'] = "Do not delay ACK to try and piggyback it onto a data packet";
|
|
693
|
$config['sysctl']['item'][10]['value'] = "0";
|
|
694
|
|
|
695
|
$config['sysctl']['item'][11]['tunable'] = "net.inet.udp.maxdgram";
|
|
696
|
$config['sysctl']['item'][11]['desc'] = "Maximum outgoing UDP datagram size";
|
|
697
|
$config['sysctl']['item'][11]['value'] = "57344";
|
|
698
|
|
|
699
|
$config['sysctl']['item'][12]['tunable'] = "net.link.bridge.pfil_onlyip";
|
|
700
|
$config['sysctl']['item'][12]['desc'] = "Handling of non-IP packets which are not passed to pfil (see if_bridge(4))";
|
|
701
|
$config['sysctl']['item'][12]['value'] = "0";
|
|
702
|
|
|
703
|
$config['sysctl']['item'][13]['tunable'] = "net.link.tap.user_open";
|
|
704
|
$config['sysctl']['item'][13]['desc'] = "Allow unprivileged access to tap(4) device nodes";
|
|
705
|
$config['sysctl']['item'][13]['value'] = "1";
|
|
706
|
|
|
707
|
$config['sysctl']['item'][14]['tunable'] = "kern.rndtest.verbose";
|
|
708
|
$config['sysctl']['item'][14]['desc'] = "Verbosity of the rndtest driver (0: do not display results on console)";
|
|
709
|
$config['sysctl']['item'][14]['value'] = "0";
|
|
710
|
|
|
711
|
$config['sysctl']['item'][15]['tunable'] = "kern.randompid";
|
|
712
|
$config['sysctl']['item'][15]['desc'] = "Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())";
|
|
713
|
$config['sysctl']['item'][15]['value'] = "347";
|
|
714
|
|
|
715
|
$config['sysctl']['item'][16]['tunable'] = "net.inet.tcp.inflight.enable";
|
|
716
|
$config['sysctl']['item'][16]['desc'] = "The system will attempt to calculate the bandwidth delay product for each connection and limit the amount of data queued to the network to just the amount required to maintain optimum throughput. ";
|
|
717
|
$config['sysctl']['item'][16]['value'] = "1";
|
|
718
|
|
|
719
|
$config['sysctl']['item'][17]['tunable'] = "net.inet.icmp.icmplim";
|
|
720
|
$config['sysctl']['item'][17]['desc'] = "Set ICMP Limits";
|
|
721
|
$config['sysctl']['item'][17]['value'] = "750";
|
|
722
|
|
|
723
|
$config['sysctl']['item'][18]['tunable'] = "net.inet.tcp.tso";
|
|
724
|
$config['sysctl']['item'][18]['desc'] = "TCP Offload engine";
|
|
725
|
$config['sysctl']['item'][18]['value'] = "0";
|
|
726
|
|
|
727
|
$config['sysctl']['item'][19]['tunable'] = "hw.bce.tso_enable";
|
|
728
|
$config['sysctl']['item'][19]['desc'] = "TCP Offload engine - BCE";
|
|
729
|
$config['sysctl']['item'][19]['value'] = "0";
|
|
730
|
}
|
|
731
|
}
|
|
732
|
|
|
733
|
|
|
734
|
function upgrade_041_to_042() {
|
|
735
|
global $config;
|
|
736
|
if (isset($config['shaper']))
|
|
737
|
unset($config['shaper']);
|
|
738
|
if (isset($config['ezshaper']))
|
|
739
|
unset($config['ezshaper']);
|
|
740
|
}
|
|
741
|
|
|
742
|
|
|
743
|
function upgrade_042_to_043() {
|
|
744
|
global $config;
|
|
745
|
/* migrate old interface gateway to the new gateways config */
|
|
746
|
$old_gateways = array();
|
|
747
|
$gateways = array();
|
|
748
|
$i = 0;
|
|
749
|
$old_gateways = get_interfaces_with_gateway();
|
|
750
|
foreach($old_gateways as $ifname => $interface) {
|
|
751
|
if(is_ipaddr($config['interfaces'][$ifname]['gateway'])) {
|
|
752
|
$config['gateways'][$i][$ifname]['gateway'] = $config['interfaces'][$ifname]['gateway'];
|
|
753
|
$config['gateways'][$i][$ifname]['interface'] = $ifname;
|
|
754
|
$config['gateways'][$i][$ifname]['name'] = $ifname ."-". $config['interfaces'][$ifname]['gateway'];
|
|
755
|
if(is_ipaddr($config['interfaces'][$ifname]['use_rrd_gateway'])) {
|
|
756
|
$config['gateways'][$i][$ifname]['monitor'] = $config['interfaces'][$ifname]['use_rrd_gateway'];
|
|
757
|
unset($config['interfaces'][$ifname]['use_rrd_gateway']);
|
|
758
|
}
|
|
759
|
$config['interfaces'][$ifname]['gateway'] = $config['gateways'][$i][$ifname]['name'];
|
|
760
|
$i++;
|
|
761
|
}
|
|
762
|
}
|
|
763
|
}
|
|
764
|
|
|
765
|
|
|
766
|
function upgrade_043_to_044() {
|
|
767
|
global $config;
|
|
768
|
}
|
|
769
|
|
|
770
|
|
|
771
|
function upgrade_044_to_045() {
|
|
772
|
global $config;
|
|
773
|
if (is_array($config['vlans']['vlan']) && count($config['vlans']['vlan'])) {
|
|
774
|
foreach ($config['vlans']['vlan'] as $id => &$vlan)
|
|
775
|
$vlan['vlanif'] = "{$vlan['if']}_vlan{$vlan['tag']}";
|
|
776
|
}
|
|
777
|
}
|
|
778
|
|
|
779
|
|
|
780
|
function upgrade_045_to_046() {
|
|
781
|
global $config;
|
|
782
|
/* Upgrade load balancer from slb to relayd */
|
|
783
|
if (is_array($config['load_balancer']['virtual_server']) && count($config['load_balancer']['virtual_server'])) {
|
|
784
|
$vs_a = &$config['load_balancer']['virtual_server'];
|
|
785
|
$pool_a = &$config['load_balancer']['lbpool'];
|
|
786
|
$pools = array();
|
|
787
|
/* Index pools by name */
|
|
788
|
if(is_array($pool_a)) {
|
|
789
|
for ($i = 0; isset($pool_a[$i]); $i++) {
|
|
790
|
if ($pool_a[$i]['type'] == "server") {
|
|
791
|
$pools[$pool_a[$i]['name']] = $pool_a[$i];
|
|
792
|
}
|
|
793
|
}
|
|
794
|
}
|
|
795
|
/* Convert sitedown entries to pools and re-attach */
|
|
796
|
for ($i = 0; isset($vs_a[$i]); $i++) {
|
|
797
|
if (isset($vs_a[$i]['sitedown'])) {
|
|
798
|
$pool = array();
|
|
799
|
$pool['type'] = 'server';
|
|
800
|
$pool['behaviour'] = 'balance';
|
|
801
|
$pool['name'] = "{$vs_a[$i]['name']}-sitedown";
|
|
802
|
$pool['desc'] = "Sitedown pool for VS: {$vs_a[$i]['name']}";
|
|
803
|
$pool['port'] = $pools[$vs_a[$i]['pool']]['port'];
|
|
804
|
$pool['servers'] = array();
|
|
805
|
$pool['servers'][] = $vs_a[$i]['sitedown'];
|
|
806
|
$pool['monitor'] = $pools[$vs_a[$i]['pool']]['monitor'];
|
|
807
|
$pool_a[] = $pool;
|
|
808
|
$vs_a[$i]['sitedown'] = $pool['name'];
|
|
809
|
}
|
|
810
|
}
|
|
811
|
}
|
|
812
|
}
|
|
813
|
|
|
814
|
|
|
815
|
function upgrade_046_to_047() {
|
|
816
|
global $config;
|
|
817
|
/* Upgrade IPsec from tunnel to phase1/phase2 */
|
|
818
|
|
|
819
|
if(is_array($config['ipsec']['tunnel'])) {
|
|
820
|
|
|
821
|
$a_phase1 = array();
|
|
822
|
$a_phase2 = array();
|
|
823
|
$ikeid = 0;
|
|
824
|
|
|
825
|
foreach ($config['ipsec']['tunnel'] as $tunnel) {
|
|
826
|
|
|
827
|
unset($ph1ent);
|
|
828
|
unset($ph2ent);
|
|
829
|
|
|
830
|
/*
|
|
831
|
* attempt to locate an enabled phase1
|
|
832
|
* entry that matches the peer gateway
|
|
833
|
*/
|
|
834
|
|
|
835
|
if (!isset($tunnel['disabled'])) {
|
|
836
|
|
|
837
|
$remote_gateway = $tunnel['remote-gateway'];
|
|
838
|
|
|
839
|
foreach ($a_phase1 as $ph1tmp) {
|
|
840
|
if ($ph1tmp['remote-gateway'] == $remote_gateway) {
|
|
841
|
$ph1ent = $ph1tmp;
|
|
842
|
break;
|
|
843
|
}
|
|
844
|
}
|
|
845
|
}
|
|
846
|
|
|
847
|
/* none found, create a new one */
|
|
848
|
|
|
849
|
if (!isset( $ph1ent )) {
|
|
850
|
|
|
851
|
/* build new phase1 entry */
|
|
852
|
|
|
853
|
$ph1ent = array();
|
|
854
|
|
|
855
|
$ph1ent['ikeid'] = ++$ikeid;
|
|
856
|
|
|
857
|
if (isset($tunnel['disabled']))
|
|
858
|
$ph1ent['disabled'] = $tunnel['disabled'];
|
|
859
|
|
|
860
|
$ph1ent['interface'] = $tunnel['interface'];
|
|
861
|
$ph1ent['remote-gateway'] = $tunnel['remote-gateway'];
|
|
862
|
$ph1ent['descr'] = $tunnel['descr'];
|
|
863
|
|
|
864
|
$ph1ent['mode'] = $tunnel['p1']['mode'];
|
|
865
|
|
|
866
|
if (isset($tunnel['p1']['myident']['myaddress']))
|
|
867
|
$ph1ent['myid_type'] = "myaddress";
|
|
868
|
if (isset($tunnel['p1']['myident']['address'])) {
|
|
869
|
$ph1ent['myid_type'] = "address";
|
|
870
|
$ph1ent['myid_data'] = $tunnel['p1']['myident']['address'];
|
|
871
|
}
|
|
872
|
if (isset($tunnel['p1']['myident']['fqdn'])) {
|
|
873
|
$ph1ent['myid_type'] = "fqdn";
|
|
874
|
$ph1ent['myid_data'] = $tunnel['p1']['myident']['fqdn'];
|
|
875
|
}
|
|
876
|
if (isset($tunnel['p1']['myident']['user_fqdn'])) {
|
|
877
|
$ph1ent['myid_type'] = "user_fqdn";
|
|
878
|
$ph1ent['myid_data'] = $tunnel['p1']['myident']['user_fqdn'];
|
|
879
|
}
|
|
880
|
if (isset($tunnel['p1']['myident']['asn1dn'])) {
|
|
881
|
$ph1ent['myid_type'] = "asn1dn";
|
|
882
|
$ph1ent['myid_data'] = $tunnel['p1']['myident']['asn1dn'];
|
|
883
|
}
|
|
884
|
if (isset($tunnel['p1']['myident']['dyn_dns'])) {
|
|
885
|
$ph1ent['myid_type'] = "dyn_dns";
|
|
886
|
$ph1ent['myid_data'] = $tunnel['p1']['myident']['dyn_dns'];
|
|
887
|
}
|
|
888
|
|
|
889
|
$ph1ent['peerid_type'] = "peeraddress";
|
|
890
|
|
|
891
|
switch ($tunnel['p1']['encryption-algorithm']) {
|
|
892
|
case "des":
|
|
893
|
$ph1alg = array( 'name' => 'des' );
|
|
894
|
break;
|
|
895
|
case "3des":
|
|
896
|
$ph1alg = array( 'name' => '3des' );
|
|
897
|
break;
|
|
898
|
case "blowfish":
|
|
899
|
$ph1alg = array( 'name' => 'blowfish', 'keylen' => '128' );
|
|
900
|
break;
|
|
901
|
case "cast128":
|
|
902
|
$ph1alg = array( 'name' => 'cast128' );
|
|
903
|
break;
|
|
904
|
case "rijndael":
|
|
905
|
$ph1alg = array( 'name' => 'aes', 'keylen' => '128' );
|
|
906
|
break;
|
|
907
|
case "rijndael 256":
|
|
908
|
$ph1alg = array( 'name' => 'aes', 'keylen' => '256' );
|
|
909
|
break;
|
|
910
|
}
|
|
911
|
|
|
912
|
$ph1ent['encryption-algorithm'] = $ph1alg;
|
|
913
|
$ph1ent['hash-algorithm'] = $tunnel['p1']['hash-algorithm'];
|
|
914
|
$ph1ent['dhgroup'] = $tunnel['p1']['dhgroup'];
|
|
915
|
$ph1ent['lifetime'] = $tunnel['p1']['lifetime'];
|
|
916
|
$ph1ent['authentication_method'] = $tunnel['p1']['authentication_method'];
|
|
917
|
|
|
918
|
if (isset($tunnel['p1']['pre-shared-key']))
|
|
919
|
$ph1ent['pre-shared-key'] = $tunnel['p1']['pre-shared-key'];
|
|
920
|
if (isset($tunnel['p1']['cert']))
|
|
921
|
$ph1ent['cert'] = $tunnel['p1']['cert'];
|
|
922
|
if (isset($tunnel['p1']['peercert']))
|
|
923
|
$ph1ent['peercert'] = $tunnel['p1']['peercert'];
|
|
924
|
if (isset($tunnel['p1']['private-key']))
|
|
925
|
$ph1ent['private-key'] = $tunnel['p1']['private-key'];
|
|
926
|
|
|
927
|
$ph1ent['nat_traversal'] = "on";
|
|
928
|
$ph1ent['dpd_enable'] = 1;
|
|
929
|
$ph1ent['dpd_delay'] = 10;
|
|
930
|
$ph1ent['dpd_maxfail'] = 5;
|
|
931
|
|
|
932
|
$a_phase1[] = $ph1ent;
|
|
933
|
}
|
|
934
|
|
|
935
|
/* build new phase2 entry */
|
|
936
|
|
|
937
|
$ph2ent = array();
|
|
938
|
|
|
939
|
$ph2ent['ikeid'] = $ph1ent['ikeid'];
|
|
940
|
|
|
941
|
if (isset($tunnel['disabled']))
|
|
942
|
$ph1ent['disabled'] = $tunnel['disabled'];
|
|
943
|
|
|
944
|
$ph2ent['descr'] = "phase2 for ".$tunnel['descr'];
|
|
945
|
|
|
946
|
$type = "lan";
|
|
947
|
if ($tunnel['local-subnet']['network'])
|
|
948
|
$type = $tunnel['local-subnet']['network'];
|
|
949
|
if ($tunnel['local-subnet']['address']) {
|
|
950
|
list($address,$netbits) = explode("/",$tunnel['local-subnet']['address']);
|
|
951
|
if (is_null($netbits))
|
|
952
|
$type = "address";
|
|
953
|
else
|
|
954
|
$type = "network";
|
|
955
|
}
|
|
956
|
|
|
957
|
switch ($type) {
|
|
958
|
case "address":
|
|
959
|
$ph2ent['localid'] = array('type' => $type,'address' => $address);
|
|
960
|
break;
|
|
961
|
case "network":
|
|
962
|
$ph2ent['localid'] = array('type' => $type,'address' => $address,'netbits' => $netbits);
|
|
963
|
break;
|
|
964
|
default:
|
|
965
|
$ph2ent['localid'] = array('type' => $type);
|
|
966
|
break;
|
|
967
|
}
|
|
968
|
|
|
969
|
list($address,$netbits) = explode("/",$tunnel['remote-subnet']);
|
|
970
|
$ph2ent['remoteid'] = array('type' => 'network','address' => $address,'netbits' => $netbits);
|
|
971
|
|
|
972
|
$ph2ent['protocol'] = $tunnel['p2']['protocol'];
|
|
973
|
|
|
974
|
$aes_count = 0;
|
|
975
|
foreach( $tunnel['p2']['encryption-algorithm-option'] as $tunalg ) {
|
|
976
|
$aes_found = false;
|
|
977
|
switch ($tunalg) {
|
|
978
|
case "des":
|
|
979
|
$ph2alg = array( 'name' => 'des' );
|
|
980
|
break;
|
|
981
|
case "3des":
|
|
982
|
$ph2alg = array( 'name' => '3des' );
|
|
983
|
break;
|
|
984
|
case "blowfish":
|
|
985
|
$ph2alg = array( 'name' => 'blowfish', 'keylen' => 'auto' );
|
|
986
|
break;
|
|
987
|
case "cast128":
|
|
988
|
$ph2alg = array( 'name' => 'cast128' );
|
|
989
|
break;
|
|
990
|
case "rijndael":
|
|
991
|
case "rijndael 256":
|
|
992
|
$ph2alg = array( 'name' => 'aes', 'keylen' => 'auto' );
|
|
993
|
$aes_found = true;
|
|
994
|
$aes_count++;
|
|
995
|
break;
|
|
996
|
}
|
|
997
|
|
|
998
|
if( !$aes_found || ($aes_count < 2))
|
|
999
|
$ph2ent['encryption-algorithm-option'][] = $ph2alg;
|
|
1000
|
}
|
|
1001
|
|
|
1002
|
$ph2ent['hash-algorithm-option'] = $tunnel['p2']['hash-algorithm-option'];
|
|
1003
|
$ph2ent['pfsgroup'] = $tunnel['p2']['pfsgroup'];
|
|
1004
|
$ph2ent['lifetime'] = $tunnel['p2']['lifetime'];
|
|
1005
|
|
|
1006
|
if (isset($tunnel['pinghost']['pinghost']))
|
|
1007
|
$ph2ent['pinghost'] = $tunnel['pinghost'];
|
|
1008
|
|
|
1009
|
$a_phase2[] = $ph2ent;
|
|
1010
|
}
|
|
1011
|
|
|
1012
|
unset($config['ipsec']['tunnel']);
|
|
1013
|
$config['ipsec']['phase1'] = $a_phase1;
|
|
1014
|
$config['ipsec']['phase2'] = $a_phase2;
|
|
1015
|
}
|
|
1016
|
}
|
|
1017
|
|
|
1018
|
|
|
1019
|
function upgrade_047_to_048() {
|
|
1020
|
global $config;
|
|
1021
|
$config['dyndnses']['dyndns'] = array();
|
|
1022
|
if (isset($config['dyndns']['enable'])) {
|
|
1023
|
$tempdyn = array();
|
|
1024
|
$tempdyn['enable'] = isset($config['dyndns']['enable']);
|
|
1025
|
$tempdyn['type'] = $config['dyndns']['type'];
|
|
1026
|
$tempdyn['wildcard'] = isset($config['dyndns']['wildcard']);
|
|
1027
|
$tempdyn['usernamefld'] = $config['dyndns']['username'];
|
|
1028
|
$tempdyn['passwordfld'] = $config['dyndns']['password'];
|
|
1029
|
$tempdyn['host'] = $config['dyndns']['host'];
|
|
1030
|
$tempdyn['mx'] = $config['dyndns']['mx'];
|
|
1031
|
$config['dyndnses']['dyndns'][] = $tempdyn;
|
|
1032
|
unset($config['dyndns']);
|
|
1033
|
}
|
|
1034
|
$config['dnsupdates']['dnsupdate'] = array();
|
|
1035
|
if (isset($config['dnsupdate']['enable'])) {
|
|
1036
|
$pconfig = array();
|
|
1037
|
$pconfig['dnsupdate_enable'] = isset($config['dnsupdate']['enable']);
|
|
1038
|
$pconfig['dnsupdate_host'] = $config['dnsupdate']['host'];
|
|
1039
|
$pconfig['dnsupdate_ttl'] = $config['dnsupdate']['ttl'];
|
|
1040
|
if (!$pconfig['dnsupdate_ttl'])
|
|
1041
|
$pconfig['dnsupdate_ttl'] = 60;
|
|
1042
|
$pconfig['dnsupdate_keydata'] = $config['dnsupdate']['keydata'];
|
|
1043
|
$pconfig['dnsupdate_keyname'] = $config['dnsupdate']['keyname'];
|
|
1044
|
$pconfig['dnsupdate_keytype'] = $config['dnsupdate']['keytype'];
|
|
1045
|
if (!$pconfig['dnsupdate_keytype'])
|
|
1046
|
$pconfig['dnsupdate_keytype'] = "zone";
|
|
1047
|
$pconfig['dnsupdate_server'] = $config['dnsupdate']['server'];
|
|
1048
|
$pconfig['dnsupdate_usetcp'] = isset($config['dnsupdate']['usetcp']);
|
|
1049
|
$config['dnsupdates']['dnsupdate'][] = $pconfig;
|
|
1050
|
unset($config['dnsupdate']);
|
|
1051
|
}
|
|
1052
|
|
|
1053
|
if (is_array($config['pppoe'])) {
|
|
1054
|
$pconfig = array();
|
|
1055
|
$pconfig['username'] = $config['pppoe']['username'];
|
|
1056
|
$pconfig['password'] = $config['pppoe']['password'];
|
|
1057
|
$pconfig['provider'] = $config['pppoe']['provider'];
|
|
1058
|
$pconfig['ondemand'] = isset($config['pppoe']['ondemand']);
|
|
1059
|
$pconfig['timeout'] = $config['pppoe']['timeout'];
|
|
1060
|
unset($config['pppoe']);
|
|
1061
|
$config['interfaces']['wan']['pppoe_username'] = $pconfig['username'];
|
|
1062
|
$config['interfaces']['wan']['pppoe_password'] = $pconfig['password'];
|
|
1063
|
$config['interfaces']['wan']['provider'] = $pconfig['provider'];
|
|
1064
|
$config['interfaces']['wan']['ondemand'] = isset($pconfig['ondemand']);
|
|
1065
|
$config['interfaces']['wan']['timeout'] = $pconfig['timeout'];
|
|
1066
|
}
|
|
1067
|
if (is_array($config['pptp'])) {
|
|
1068
|
$pconfig = array();
|
|
1069
|
$pconfig['username'] = $config['pptp']['username'];
|
|
1070
|
$pconfig['password'] = $config['pptp']['password'];
|
|
1071
|
$pconfig['provider'] = $config['pptp']['provider'];
|
|
1072
|
$pconfig['ondemand'] = isset($config['pptp']['ondemand']);
|
|
1073
|
$pconfig['timeout'] = $config['pptp']['timeout'];
|
|
1074
|
unset($config['pptp']);
|
|
1075
|
$config['interfaces']['wan']['pptp_username'] = $pconfig['username'];
|
|
1076
|
$config['interfaces']['wan']['pptp_password'] = $pconfig['password'];
|
|
1077
|
$config['interfaces']['wan']['provider'] = $pconfig['provider'];
|
|
1078
|
$config['interfaces']['wan']['ondemand'] = isset($pconfig['ondemand'] );
|
|
1079
|
$config['interfaces']['wan']['timeout'] = $pconfig['timeout'];
|
|
1080
|
}
|
|
1081
|
}
|
|
1082
|
|
|
1083
|
|
|
1084
|
function upgrade_048_to_049() {
|
|
1085
|
global $config;
|
|
1086
|
/* setup new all users group */
|
|
1087
|
$all = array();
|
|
1088
|
$all['name'] = "all";
|
|
1089
|
$all['description'] = "All Users";
|
|
1090
|
$all['scope'] = "system";
|
|
1091
|
$all['gid'] = 1998;
|
|
1092
|
$all['member'] = array();
|
|
1093
|
|
|
1094
|
if (!is_array($config['system']['group']))
|
|
1095
|
$config['system']['group'] = array();
|
|
1096
|
|
|
1097
|
/* work around broken uid assignments */
|
|
1098
|
$config['system']['nextuid'] = 2000;
|
|
1099
|
foreach ($config['system']['user'] as & $user) {
|
|
1100
|
if (isset($user['uid']) && !$user['uid'])
|
|
1101
|
continue;
|
|
1102
|
$user['uid'] = $config['system']['nextuid']++;
|
|
1103
|
}
|
|
1104
|
|
|
1105
|
/* work around broken gid assignments */
|
|
1106
|
$config['system']['nextgid'] = 2000;
|
|
1107
|
foreach ($config['system']['group'] as & $group) {
|
|
1108
|
if ($group['name'] == $g['admin_group'])
|
|
1109
|
$group['gid'] = 1999;
|
|
1110
|
else
|
|
1111
|
$group['gid'] = $config['system']['nextgid']++;
|
|
1112
|
}
|
|
1113
|
|
|
1114
|
/* build group membership information */
|
|
1115
|
foreach ($config['system']['group'] as & $group) {
|
|
1116
|
$group['member'] = array();
|
|
1117
|
foreach ($config['system']['user'] as & $user) {
|
|
1118
|
$groupnames = explode(",", $user['groupname']);
|
|
1119
|
if (in_array($group['name'],$groupnames))
|
|
1120
|
$group['member'][] = $user['uid'];
|
|
1121
|
}
|
|
1122
|
}
|
|
1123
|
|
|
1124
|
/* reset user group information */
|
|
1125
|
foreach ($config['system']['user'] as & $user) {
|
|
1126
|
unset($user['groupname']);
|
|
1127
|
$all['member'][] = $user['uid'];
|
|
1128
|
}
|
|
1129
|
|
|
1130
|
/* reset group scope information */
|
|
1131
|
foreach ($config['system']['group'] as & $group)
|
|
1132
|
if ($group['name'] != $g['admin_group'])
|
|
1133
|
$group['scope'] = "user";
|
|
1134
|
|
|
1135
|
/* insert new all group */
|
|
1136
|
$groups = Array();
|
|
1137
|
$groups[] = $all;
|
|
1138
|
$groups = array_merge($config['system']['group'],$groups);
|
|
1139
|
$config['system']['group'] = $groups;
|
|
1140
|
}
|
|
1141
|
|
|
1142
|
|
|
1143
|
function upgrade_049_to_050() {
|
|
1144
|
global $config;
|
|
1145
|
/* update user privileges */
|
|
1146
|
foreach ($config['system']['user'] as & $user) {
|
|
1147
|
$privs = array();
|
|
1148
|
if (!is_array($user['priv'])) {
|
|
1149
|
unset($user['priv']);
|
|
1150
|
continue;
|
|
1151
|
}
|
|
1152
|
foreach ($user['priv'] as $priv) {
|
|
1153
|
switch($priv['id']) {
|
|
1154
|
case "hasshell":
|
|
1155
|
$privs[] = "user-shell-access";
|
|
1156
|
break;
|
|
1157
|
case "copyfiles":
|
|
1158
|
$privs[] = "user-copy-files";
|
|
1159
|
break;
|
|
1160
|
}
|
|
1161
|
}
|
|
1162
|
$user['priv'] = $privs;
|
|
1163
|
}
|
|
1164
|
|
|
1165
|
/* update group privileges */
|
|
1166
|
foreach ($config['system']['group'] as & $group) {
|
|
1167
|
$privs = array();
|
|
1168
|
if (!is_array($group['pages'])) {
|
|
1169
|
unset($group['pages']);
|
|
1170
|
continue;
|
|
1171
|
}
|
|
1172
|
foreach ($group['pages'] as $page) {
|
|
1173
|
$priv = map_page_privname($page);
|
|
1174
|
if ($priv)
|
|
1175
|
$privs[] = $priv;
|
|
1176
|
}
|
|
1177
|
unset($group['pages']);
|
|
1178
|
$group['priv'] = $privs;
|
|
1179
|
}
|
|
1180
|
|
|
1181
|
/* sync all local account information */
|
|
1182
|
local_sync_accounts();
|
|
1183
|
}
|
|
1184
|
|
|
1185
|
|
|
1186
|
function upgrade_050_to_051() {
|
|
1187
|
global $config;
|
|
1188
|
$pconfig = array();
|
|
1189
|
$pconfig['desc'] = "Set to 0 to disable filtering on the incoming and outgoing member interfaces.";
|
|
1190
|
$pconfig['tunable'] = "net.link.bridge.pfil_member";
|
|
1191
|
$pconfig['value'] = "1";
|
|
1192
|
$config['sysctl']['item'][] = $pconfig;
|
|
1193
|
$pconfig = array();
|
|
1194
|
$pconfig['desc'] = "Set to 1 to enable filtering on the bridge interface";
|
|
1195
|
$pconfig['tunable'] = "net.link.bridge.pfil_bridge";
|
|
1196
|
$pconfig['value'] = "0";
|
|
1197
|
$config['sysctl']['item'][] = $pconfig;
|
|
1198
|
|
|
1199
|
unset($config['bridge']);
|
|
1200
|
|
|
1201
|
$convert_bridges = false;
|
|
1202
|
foreach($config['interfaces'] as $intf) {
|
|
1203
|
if (isset($intf['bridge']) && $intf['bridge'] <> "") {
|
|
1204
|
$config['bridges'] = array();
|
|
1205
|
$config['bridges']['bridged'] = array();
|
|
1206
|
$convert_bridges = true;
|
|
1207
|
break;
|
|
1208
|
}
|
|
1209
|
}
|
|
1210
|
if ($convert_bridges == true) {
|
|
1211
|
$i = 0;
|
|
1212
|
foreach ($config['interfaces'] as $ifr => &$intf) {
|
|
1213
|
if (isset($intf['bridge']) && $intf['bridge'] <> "") {
|
|
1214
|
$nbridge = array();
|
|
1215
|
$nbridge['members'] = "{$ifr},{$intf['bridge']}";
|
|
1216
|
$nbridge['descr'] = "Converted bridged {$ifr}";
|
|
1217
|
$nbridge['bridgeif'] = "bridge{$i}";
|
|
1218
|
$config['bridges']['bridged'][] = $nbridge;
|
|
1219
|
unset($intf['bridge']);
|
|
1220
|
$i++;
|
|
1221
|
}
|
|
1222
|
}
|
|
1223
|
}
|
|
1224
|
}
|
|
1225
|
|
|
1226
|
|
|
1227
|
function upgrade_051_to_052() {
|
|
1228
|
global $config;
|
|
1229
|
$config['openvpn'] = array();
|
|
1230
|
if (!is_array($config['system']['ca']))
|
|
1231
|
$config['system']['ca'] = array();
|
|
1232
|
if (!is_array($config['system']['cert']))
|
|
1233
|
$config['system']['cert'] = array();
|
|
1234
|
|
|
1235
|
$vpnid = 1;
|
|
1236
|
|
|
1237
|
/* openvpn server configurations */
|
|
1238
|
if (is_array($config['installedpackages']['openvpnserver'])) {
|
|
1239
|
$config['openvpn']['openvpn-server'] = array();
|
|
1240
|
|
|
1241
|
$index = 1;
|
|
1242
|
foreach($config['installedpackages']['openvpnserver']['config'] as $server) {
|
|
1243
|
|
|
1244
|
if (!is_array($server))
|
|
1245
|
continue;
|
|
1246
|
|
|
1247
|
if ($server['auth_method'] == "pki") {
|
|
1248
|
|
|
1249
|
/* create ca entry */
|
|
1250
|
$ca = array();
|
|
1251
|
$ca['refid'] = uniqid();
|
|
1252
|
$ca['name'] = "OpenVPN Server CA #{$index}";
|
|
1253
|
$ca['crt'] = $server['ca_cert'];
|
|
1254
|
$ca['crl'] = $server['crl'];
|
|
1255
|
$config['system']['ca'][] = $ca;
|
|
1256
|
|
|
1257
|
/* create ca reference */
|
|
1258
|
unset($server['ca_cert']);
|
|
1259
|
unset($server['crl']);
|
|
1260
|
$server['caref'] = $ca['refid'];
|
|
1261
|
|
|
1262
|
/* create cert entry */
|
|
1263
|
$cert = array();
|
|
1264
|
$cert['refid'] = uniqid();
|
|
1265
|
$cert['name'] = "OpenVPN Server Certificate #{$index}";
|
|
1266
|
$cert['crt'] = $server['server_cert'];
|
|
1267
|
$cert['prv'] = $server['server_key'];
|
|
1268
|
$config['system']['cert'][] = $cert;
|
|
1269
|
|
|
1270
|
/* create cert reference */
|
|
1271
|
unset($server['server_cert']);
|
|
1272
|
unset($server['server_key']);
|
|
1273
|
$server['certref'] = $cert['refid'];
|
|
1274
|
|
|
1275
|
$index++;
|
|
1276
|
}
|
|
1277
|
|
|
1278
|
/* determine operational mode */
|
|
1279
|
if ($server['auth_method'] == 'pki') {
|
|
1280
|
if($server['nopool']) {
|
|
1281
|
$server['mode'] = "p2p_tls";
|
|
1282
|
} else {
|
|
1283
|
$server['mode'] = "server_tls";
|
|
1284
|
}
|
|
1285
|
} else {
|
|
1286
|
$server['mode'] = "p2p_shared_key";
|
|
1287
|
}
|
|
1288
|
unset($server['auth_method']);
|
|
1289
|
|
|
1290
|
/* modify configuration values */
|
|
1291
|
$server['dh_length'] = 1024;
|
|
1292
|
unset($server['dh_params']);
|
|
1293
|
if (!$server['interface'])
|
|
1294
|
$server['interface'] = 'wan';
|
|
1295
|
$server['tunnel_network'] = $server['addresspool'];
|
|
1296
|
unset($server['addresspool']);
|
|
1297
|
$server['compress'] = $server['use_lzo'];
|
|
1298
|
unset($server['use_lzo']);
|
|
1299
|
if ($server['nopool'])
|
|
1300
|
$server['pool_enable'] = false;
|
|
1301
|
else
|
|
1302
|
$server['pool_enable'] = "yes";
|
|
1303
|
unset($server['nopool']);
|
|
1304
|
$server['dns_domain'] = $server['dhcp_domainname'];
|
|
1305
|
unset($server['dhcp_domainname']);
|
|
1306
|
$server['dns_server1'] = $server['dhcp_dns'];
|
|
1307
|
unset($server['dhcp_dns']);
|
|
1308
|
$server['ntp_server1'] = $server['dhcp_ntp'];
|
|
1309
|
unset($server['dhcp_ntp']);
|
|
1310
|
if ($server['dhcp_nbtdisable'])
|
|
1311
|
$server['netbios_enable'] = false;
|
|
1312
|
else
|
|
1313
|
$server['netbios_enable'] = "yes";
|
|
1314
|
unset($server['dhcp_nbtdisable']);
|
|
1315
|
$server['netbios_ntype'] = $server['dhcp_nbttype'];
|
|
1316
|
unset($server['dhcp_nbttype']);
|
|
1317
|
$server['netbios_scope'] = $server['dhcp_nbtscope'];
|
|
1318
|
unset($server['dhcp_nbtscope']);
|
|
1319
|
$server['nbdd_server1'] = $server['dhcp_nbdd'];
|
|
1320
|
unset($server['dhcp_nbdd']);
|
|
1321
|
$server['wins_server1'] = $server['dhcp_wins'];
|
|
1322
|
unset($server['dhcp_wins']);
|
|
1323
|
|
|
1324
|
/* allocate vpnid */
|
|
1325
|
$server['vpnid'] = $vpnid++;
|
|
1326
|
|
|
1327
|
$config['openvpn']['openvpn-server'][] = $server;
|
|
1328
|
}
|
|
1329
|
unset($config['installedpackages']['openvpnserver']);
|
|
1330
|
}
|
|
1331
|
|
|
1332
|
/* openvpn client configurations */
|
|
1333
|
if (is_array($config['installedpackages']['openvpnclient'])) {
|
|
1334
|
$config['openvpn']['openvpn-client'] = array();
|
|
1335
|
|
|
1336
|
$index = 1;
|
|
1337
|
foreach($config['installedpackages']['openvpnclient']['config'] as $client) {
|
|
1338
|
|
|
1339
|
if (!is_array($client))
|
|
1340
|
continue;
|
|
1341
|
|
|
1342
|
if ($client['auth_method'] == "pki") {
|
|
1343
|
|
|
1344
|
/* create ca entry */
|
|
1345
|
$ca = array();
|
|
1346
|
$ca['refid'] = uniqid();
|
|
1347
|
$ca['name'] = "OpenVPN Client CA #{$index}";
|
|
1348
|
$ca['crt'] = $client['ca_cert'];
|
|
1349
|
$ca['crl'] = $client['crl'];
|
|
1350
|
$config['system']['ca'][] = $ca;
|
|
1351
|
|
|
1352
|
/* create ca reference */
|
|
1353
|
unset($client['ca_cert']);
|
|
1354
|
unset($client['crl']);
|
|
1355
|
$client['caref'] = $ca['refid'];
|
|
1356
|
|
|
1357
|
/* create cert entry */
|
|
1358
|
$cert = array();
|
|
1359
|
$cert['refid'] = uniqid();
|
|
1360
|
$cert['name'] = "OpenVPN Client Certificate #{$index}";
|
|
1361
|
$cert['crt'] = $client['client_cert'];
|
|
1362
|
$cert['prv'] = $client['client_key'];
|
|
1363
|
$config['system']['cert'][] = $cert;
|
|
1364
|
|
|
1365
|
/* create cert reference */
|
|
1366
|
unset($client['client_cert']);
|
|
1367
|
unset($client['client_key']);
|
|
1368
|
$client['certref'] = $cert['refid'];
|
|
1369
|
|
|
1370
|
$index++;
|
|
1371
|
}
|
|
1372
|
|
|
1373
|
/* determine operational mode */
|
|
1374
|
if ($client['auth_method'] == 'pki')
|
|
1375
|
$client['mode'] = "p2p_tls";
|
|
1376
|
else
|
|
1377
|
$client['mode'] = "p2p_shared_key";
|
|
1378
|
unset($client['auth_method']);
|
|
1379
|
|
|
1380
|
/* modify configuration values */
|
|
1381
|
if (!$client['interface'])
|
|
1382
|
$client['interface'] = 'wan';
|
|
1383
|
$client['tunnel_network'] = $client['interface_ip'];
|
|
1384
|
unset($client['interface_ip']);
|
|
1385
|
$client['server_addr'] = $client['serveraddr'];
|
|
1386
|
unset($client['serveraddr']);
|
|
1387
|
$client['server_port'] = $client['serverport'];
|
|
1388
|
unset($client['serverport']);
|
|
1389
|
$client['proxy_addr'] = $client['poxy_hostname'];
|
|
1390
|
unset($client['proxy_addr']);
|
|
1391
|
$client['compress'] = $client['use_lzo'];
|
|
1392
|
unset($client['use_lzo']);
|
|
1393
|
$client['resolve_retry'] = $client['infiniteresolvretry'];
|
|
1394
|
unset($client['infiniteresolvretry']);
|
|
1395
|
|
|
1396
|
/* allocate vpnid */
|
|
1397
|
$client['vpnid'] = $vpnid++;
|
|
1398
|
|
|
1399
|
$config['openvpn']['openvpn-client'][] = $client;
|
|
1400
|
}
|
|
1401
|
|
|
1402
|
unset($config['installedpackages']['openvpnclient']);
|
|
1403
|
}
|
|
1404
|
|
|
1405
|
/* openvpn client specific configurations */
|
|
1406
|
if (is_array($config['installedpackages']['openvpncsc'])) {
|
|
1407
|
$config['openvpn']['openvpn-csc'] = array();
|
|
1408
|
|
|
1409
|
foreach($config['installedpackages']['openvpncsc']['config'] as $csc) {
|
|
1410
|
|
|
1411
|
if (!is_array($csc))
|
|
1412
|
continue;
|
|
1413
|
|
|
1414
|
/* modify configuration values */
|
|
1415
|
$csc['common_name'] = $csc['commonname'];
|
|
1416
|
unset($csc['commonname']);
|
|
1417
|
$csc['tunnel_network'] = $csc['ifconfig_push'];
|
|
1418
|
unset($csc['ifconfig_push']);
|
|
1419
|
$csc['dns_domain'] = $csc['dhcp_domainname'];
|
|
1420
|
unset($csc['dhcp_domainname']);
|
|
1421
|
$csc['dns_server1'] = $csc['dhcp_dns'];
|
|
1422
|
unset($csc['dhcp_dns']);
|
|
1423
|
$csc['ntp_server1'] = $csc['dhcp_ntp'];
|
|
1424
|
unset($csc['dhcp_ntp']);
|
|
1425
|
if ($csc['dhcp_nbtdisable'])
|
|
1426
|
$csc['netbios_enable'] = false;
|
|
1427
|
else
|
|
1428
|
$csc['netbios_enable'] = "yes";
|
|
1429
|
unset($csc['dhcp_nbtdisable']);
|
|
1430
|
$csc['netbios_ntype'] = $csc['dhcp_nbttype'];
|
|
1431
|
unset($csc['dhcp_nbttype']);
|
|
1432
|
$csc['netbios_scope'] = $csc['dhcp_nbtscope'];
|
|
1433
|
unset($csc['dhcp_nbtscope']);
|
|
1434
|
$csc['nbdd_server1'] = $csc['dhcp_nbdd'];
|
|
1435
|
unset($csc['dhcp_nbdd']);
|
|
1436
|
$csc['wins_server1'] = $csc['dhcp_wins'];
|
|
1437
|
unset($csc['dhcp_wins']);
|
|
1438
|
|
|
1439
|
$config['openvpn']['openvpn-csc'][] = $csc;
|
|
1440
|
}
|
|
1441
|
|
|
1442
|
unset($config['installedpackages']['openvpncsc']);
|
|
1443
|
}
|
|
1444
|
|
|
1445
|
/*
|
|
1446
|
* FIXME: hack to keep things working with no installedpackages
|
|
1447
|
* or carp array in the configuration data.
|
|
1448
|
*/
|
|
1449
|
if (!is_array($config['installedpackages']))
|
|
1450
|
$config['installedpackages'] = array();
|
|
1451
|
if (!is_array($config['installedpackages']['carp']))
|
|
1452
|
$config['installedpackages']['carp'] = array();
|
|
1453
|
|
|
1454
|
}
|
|
1455
|
|
|
1456
|
|
|
1457
|
function upgrade_052_to_053() {
|
|
1458
|
global $config;
|
|
1459
|
if (!is_array($config['system']['ca']))
|
|
1460
|
$config['system']['ca'] = array();
|
|
1461
|
if (!is_array($config['system']['cert']))
|
|
1462
|
$config['system']['cert'] = array();
|
|
1463
|
|
|
1464
|
/* migrate advanced admin page webui ssl to certifcate mngr */
|
|
1465
|
if ($config['system']['webgui']['certificate'] &&
|
|
1466
|
$config['system']['webgui']['private-key']) {
|
|
1467
|
|
|
1468
|
/* create cert entry */
|
|
1469
|
$cert = array();
|
|
1470
|
$cert['refid'] = uniqid();
|
|
1471
|
$cert['name'] = "webConfigurator SSL Certificate";
|
|
1472
|
$cert['crt'] = $config['system']['webgui']['certificate'];
|
|
1473
|
$cert['prv'] = $config['system']['webgui']['private-key'];
|
|
1474
|
$config['system']['cert'][] = $cert;
|
|
1475
|
|
|
1476
|
/* create cert reference */
|
|
1477
|
unset($config['system']['webgui']['certificate']);
|
|
1478
|
unset($config['system']['webgui']['private-key']);
|
|
1479
|
$config['system']['webgui']['ssl-certref'] = $cert['refid'];
|
|
1480
|
}
|
|
1481
|
|
|
1482
|
/* migrate advanced admin page ssh keys to user manager */
|
|
1483
|
if ($config['system']['ssh']['authorizedkeys']) {
|
|
1484
|
$admin_user =& getUserEntryByUID(0);
|
|
1485
|
$admin_user['authorizedkeys'] = $config['system']['ssh']['authorizedkeys'];
|
|
1486
|
unset($config['system']['ssh']['authorizedkeys']);
|
|
1487
|
}
|
|
1488
|
}
|
|
1489
|
|
|
1490
|
|
|
1491
|
function upgrade_053_to_054() {
|
|
1492
|
global $config;
|
|
1493
|
if(is_array($config['loadbalancer']['lbpool'])) {
|
|
1494
|
$lbpool_arr = $config['loadbalancer']['lbpool'];
|
|
1495
|
$lbpool_srv_arr = array();
|
|
1496
|
$gateway_group_arr = array();
|
|
1497
|
foreach($lbpool_arr as $lbpool) {
|
|
1498
|
if($lbpool['type'] == "gateway") {
|
|
1499
|
$gateway_group['name'] = $lbpool['name'];
|
|
1500
|
$gateway_group['descr'] = $lbpool['desc'];
|
|
1501
|
$gateway_group['trigger'] = "down";
|
|
1502
|
$gateway_group['item'] = array();
|
|
1503
|
$i=0;
|
|
1504
|
foreach($lbpool['servers'] as $member) {
|
|
1505
|
$split = split("\|", $member);
|
|
1506
|
$interface = $split[0];
|
|
1507
|
$monitor = $split[1];
|
|
1508
|
if($lbpool['behaviour'] == "failover") { $i++; }
|
|
1509
|
$gateway_group['item'][] = "$interface|$i";
|
|
1510
|
$config['interfaces'][$interface]['monitorip'] = "$monitor";
|
|
1511
|
}
|
|
1512
|
$gateway_group_arr[] = $gateway_group;
|
|
1513
|
} else {
|
|
1514
|
$lbpool_srv_arr[] = $lbpool;
|
|
1515
|
}
|
|
1516
|
}
|
|
1517
|
$config['loadbalancer']['lbpool'] = $lbpool_srv_arr;
|
|
1518
|
$config['gateways']['gateway_group'] = $gateway_group_arr;
|
|
1519
|
}
|
|
1520
|
// Unset lbpool if we no longer have any server pools
|
|
1521
|
if (count($lbpool_srv_arr) == 0) {
|
|
1522
|
unset($config['load_balancer']['lbpool']);
|
|
1523
|
} else {
|
|
1524
|
$config['load_balancer']['lbpool'] = $lbpool_srv_arr;
|
|
1525
|
}
|
|
1526
|
// Only set the gateway group array if we converted any
|
|
1527
|
if (count($gateway_group_arr) != 0) {
|
|
1528
|
$config['gateways']['gateway_group'] = $gateway_group_arr;
|
|
1529
|
}
|
|
1530
|
}
|
|
1531
|
|
|
1532
|
|
|
1533
|
function upgrade_054_to_055() {
|
|
1534
|
global $config;
|
|
1535
|
/* RRD files changed for quality, traffic and packets graphs */
|
|
1536
|
ini_set("max_execution_time", "1800");
|
|
1537
|
/* convert traffic RRD file */
|
|
1538
|
global $parsedcfg, $listtags;
|
|
1539
|
$listtags = array("ds", "v", "rra", "row");
|
|
1540
|
|
|
1541
|
$rrddbpath = "/var/db/rrd/";
|
|
1542
|
$rrdtool = "/usr/bin/nice -n20 /usr/local/bin/rrdtool";
|
|
1543
|
|
|
1544
|
$rrdinterval = 60;
|
|
1545
|
$valid = $rrdinterval * 2;
|
|
1546
|
|
|
1547
|
/* Asume GigE for now */
|
|
1548
|
$downstream = 125000000;
|
|
1549
|
$upstream = 125000000;
|
|
1550
|
|
|
1551
|
/* build a list of quality databases */
|
|
1552
|
/* roundtrip has become delay */
|
|
1553
|
function divide_delay($delayval) {
|
|
1554
|
$delayval = floatval($delayval);
|
|
1555
|
$delayval = ($delayval / 1000);
|
|
1556
|
$delayval = " ". sprintf("%1.10e", $delayval) ." ";
|
|
1557
|
return $delayval;
|
|
1558
|
}
|
|
1559
|
/* the roundtrip times need to be divided by 1000 to get seconds, really */
|
|
1560
|
$databases = array();
|
|
1561
|
exec("cd $rrddbpath;/usr/bin/find *-quality.rrd", $databases);
|
|
1562
|
rsort($databases);
|
|
1563
|
foreach($databases as $database) {
|
|
1564
|
$xmldump = "{$database}.old.xml";
|
|
1565
|
$xmldumpnew = "{$database}.new.xml";
|
|
1566
|
|
|
1567
|
echo "Migrate RRD database {$database} to new format \n";
|
|
1568
|
mwexec("$rrdtool tune {$rrddbpath}{$database} -r roundtrip:delay 2>&1");
|
|
1569
|
|
|
1570
|
dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}");
|
|
1571
|
$rrdoldxml = file_get_contents("{$g['tmp_path']}/{$xmldump}");
|
|
1572
|
$rrdold = xml2array($rrdoldxml, 1, "tag");
|
|
1573
|
$rrdold = $rrdold['rrd'];
|
|
1574
|
|
|
1575
|
$i = 0;
|
|
1576
|
foreach($rrdold['rra'] as $rra) {
|
|
1577
|
$l = 0;
|
|
1578
|
foreach($rra['database']['row'] as $row) {
|
|
1579
|
$vnew = divide_delay($row['v'][1]);
|
|
1580
|
$rrdold['rra'][$i]['database']['row'][$l]['v'][1] = $vnew;
|
|
1581
|
$l++;
|
|
1582
|
}
|
|
1583
|
$i++;
|
|
1584
|
}
|
|
1585
|
|
|
1586
|
$rrdxml = dump_xml_config_raw($rrdold, "rrd");
|
|
1587
|
file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml);
|
|
1588
|
mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1");
|
|
1589
|
|
|
1590
|
}
|
|
1591
|
/* let apinger recreate required files */
|
|
1592
|
setup_gateways_monitor();
|
|
1593
|
|
|
1594
|
/* build a list of traffic and packets databases */
|
|
1595
|
$databases = array();
|
|
1596
|
exec("cd $rrddbpath;/usr/bin/find *-traffic.rrd *-packets.rrd", $databases);
|
|
1597
|
rsort($databases);
|
|
1598
|
foreach($databases as $database) {
|
|
1599
|
$databasetmp = "{$database}.tmp";
|
|
1600
|
$xmldump = "{$database}.old.xml";
|
|
1601
|
$xmldumptmp = "{$database}.tmp.xml";
|
|
1602
|
$xmldumpnew = "{$database}.new.xml";
|
|
1603
|
|
|
1604
|
echo "Migrate RRD database {$database} to new format \n";
|
|
1605
|
/* rename DS source */
|
|
1606
|
mwexec("$rrdtool tune {$rrddbpath}/{$database} -r in:inpass 2>&1");
|
|
1607
|
mwexec("$rrdtool tune {$rrddbpath}/{$database} -r out:outpass 2>71");
|
|
1608
|
|
|
1609
|
/* dump contents to xml and move database out of the way */
|
|
1610
|
dump_rrd_to_xml("{$rrddbpath}/{$database}", "{$g['tmp_path']}/{$xmldump}");
|
|
1611
|
|
|
1612
|
/* create new rrd database file */
|
|
1613
|
$rrdcreate = "$rrdtool create {$g['tmp_path']}/{$databasetmp} --step $rrdinterval ";
|
|
1614
|
$rrdcreate .= "DS:inpass:COUNTER:$valid:0:$downstream ";
|
|
1615
|
$rrdcreate .= "DS:outpass:COUNTER:$valid:0:$upstream ";
|
|
1616
|
$rrdcreate .= "DS:inblock:COUNTER:$valid:0:$downstream ";
|
|
1617
|
$rrdcreate .= "DS:outblock:COUNTER:$valid:0:$upstream ";
|
|
1618
|
$rrdcreate .= "RRA:AVERAGE:0.5:1:1000 ";
|
|
1619
|
$rrdcreate .= "RRA:AVERAGE:0.5:5:1000 ";
|
|
1620
|
$rrdcreate .= "RRA:AVERAGE:0.5:60:1000 ";
|
|
1621
|
$rrdcreate .= "RRA:AVERAGE:0.5:720:3000 ";
|
|
1622
|
|
|
1623
|
create_new_rrd("$rrdcreate");
|
|
1624
|
/* create temporary xml from new RRD */
|
|
1625
|
dump_rrd_to_xml("{$g['tmp_path']}/{$databasetmp}", "{$g['tmp_path']}/{$xmldumptmp}");
|
|
1626
|
|
|
1627
|
$rrdoldxml = file_get_contents("{$g['tmp_path']}/{$xmldump}");
|
|
1628
|
$rrdold = xml2array($rrdoldxml, 1, "tag");
|
|
1629
|
$rrdold = $rrdold['rrd'];
|
|
1630
|
|
|
1631
|
$rrdnewxml = file_get_contents("{$g['tmp_path']}/{$xmldumptmp}");
|
|
1632
|
$rrdnew = xml2array($rrdnewxml, 1, "tag");
|
|
1633
|
$rrdnew = $rrdnew['rrd'];
|
|
1634
|
|
|
1635
|
/* remove any MAX RRA's. Not needed for traffic. */
|
|
1636
|
$i = 0;
|
|
1637
|
foreach ($rrdold['rra'] as $rra) {
|
|
1638
|
if(trim($rra['cf']) == "MAX") {
|
|
1639
|
unset($rrdold['rra'][$i]);
|
|
1640
|
}
|
|
1641
|
$i++;
|
|
1642
|
}
|
|
1643
|
|
|
1644
|
$rrdxmlarray = migrate_rrd_format($rrdold, $rrdnew);
|
|
1645
|
$rrdxml = dump_xml_config_raw($rrdxmlarray, "rrd");
|
|
1646
|
file_put_contents("{$g['tmp_path']}/{$xmldumpnew}", $rrdxml);
|
|
1647
|
mwexec("$rrdtool restore -f {$g['tmp_path']}/{$xmldumpnew} {$rrddbpath}/{$database} 2>&1");
|
|
1648
|
|
|
1649
|
}
|
|
1650
|
enable_rrd_graphing();
|
|
1651
|
}
|
|
1652
|
|
|
1653
|
|
|
1654
|
function upgrade_055_to_056() {
|
|
1655
|
global $config;
|
|
1656
|
|
|
1657
|
if (!is_array($config['system']['ca']))
|
|
1658
|
$config['system']['ca'] = array();
|
|
1659
|
if (!is_array($config['system']['cert']))
|
|
1660
|
$config['system']['cert'] = array();
|
|
1661
|
|
|
1662
|
/* migrate ipsec ca's to cert manager */
|
|
1663
|
if (is_array($config['ipsec']['cacert'])) {
|
|
1664
|
foreach($config['ipsec']['cacert'] as & $cacert) {
|
|
1665
|
$ca = array();
|
|
1666
|
$ca['refid'] = uniqid();
|
|
1667
|
if (is_array($cacert['cert']))
|
|
1668
|
$ca['crt'] = $cacert['cert'][0];
|
|
1669
|
else
|
|
1670
|
$ca['crt'] = $cacert['cert'];
|
|
1671
|
$ca['name'] = $cacert['ident'];
|
|
1672
|
$config['system']['ca'][] = $ca;
|
|
1673
|
}
|
|
1674
|
unset($config['ipsec']['cacert']);
|
|
1675
|
}
|
|
1676
|
|
|
1677
|
/* migrate phase1 certificates to cert manager */
|
|
1678
|
if (is_array($config['ipsec']['phase1'])) {
|
|
1679
|
foreach($config['ipsec']['phase1'] as & $ph1ent) {
|
|
1680
|
$cert = array();
|
|
1681
|
$cert['refid'] = uniqid();
|
|
1682
|
$cert['name'] = "IPsec Peer {$ph1ent['remote-gateway']} Certificate";
|
|
1683
|
if (is_array($ph1ent['cert']))
|
|
1684
|
$cert['crt'] = $ph1ent['cert'][0];
|
|
1685
|
else
|
|
1686
|
$cert['crt'] = $ph1ent['cert'];
|
|
1687
|
$cert['prv'] = $ph1ent['private-key'];
|
|
1688
|
$config['system']['cert'][] = $cert;
|
|
1689
|
$ph1ent['certref'] = $cert['refid'];
|
|
1690
|
if ($ph1ent['cert'])
|
|
1691
|
unset($ph1ent['cert']);
|
|
1692
|
if ($ph1ent['private-key'])
|
|
1693
|
unset($ph1ent['private-key']);
|
|
1694
|
if ($ph1ent['peercert'])
|
|
1695
|
unset($ph1ent['peercert']);
|
|
1696
|
}
|
|
1697
|
}
|
|
1698
|
}
|
|
1699
|
|
|
1700
|
|
|
1701
|
function upgrade_056_to_057() {
|
|
1702
|
global $config;
|
|
1703
|
/* migrate captivate portal to user manager */
|
|
1704
|
if (is_array($config['captiveportal']['user'])) {
|
|
1705
|
foreach($config['captiveportal']['user'] as $user) {
|
|
1706
|
// avoid user conflicts
|
|
1707
|
if ($config['system']['user'][$user['name']])
|
|
1708
|
continue;
|
|
1709
|
$user['scope'] = "user";
|
|
1710
|
if (isset($user['expirationdate'])) {
|
|
1711
|
$user['expires'] = $user['expirationdate'];
|
|
1712
|
unset($user['expirationdate']);
|
|
1713
|
}
|
|
1714
|
if (isset($user['password'])) {
|
|
1715
|
$user['md5-hash'] = $user['password'];
|
|
1716
|
unset($user['password']);
|
|
1717
|
}
|
|
1718
|
$config['system']['user'][] = $user;
|
|
1719
|
}
|
|
1720
|
unset($config['captiveportal']['user']);
|
|
1721
|
}
|
|
1722
|
}
|
|
1723
|
|
|
1724
|
function upgrade_057_to_058() {
|
|
1725
|
global $config;
|
|
1726
|
/* set all phase2 entries to tunnel mode */
|
|
1727
|
if (is_array($config['ipsec']['phase2']))
|
|
1728
|
foreach($config['ipsec']['phase2'] as & $ph2ent)
|
|
1729
|
$ph2ent['mode'] = 'tunnel';
|
|
1730
|
}
|
|
1731
|
|
|
1732
|
function upgrade_058_to_059() {
|
|
1733
|
global $config;
|
|
1734
|
|
|
1735
|
if (is_array($config['schedules']['schedule'])) {
|
|
1736
|
foreach ($config['schedules']['schedule'] as & $schedl)
|
|
1737
|
$schedl['schedlabel'] = uniqid();
|
|
1738
|
}
|
|
1739
|
}
|
|
1740
|
|
|
1741
|
function upgrade_059_to_060() {
|
|
1742
|
global $config;
|
|
1743
|
require_once("/etc/inc/certs.inc");
|
|
1744
|
if (is_array($config['system']['ca'])) {
|
|
1745
|
/* Locate issuer for all CAs */
|
|
1746
|
foreach ($config['system']['ca'] as & $ca) {
|
|
1747
|
$subject = cert_get_subject($ca['crt']);
|
|
1748
|
$issuer = cert_get_issuer($ca['crt']);
|
|
1749
|
if($issuer <> $subject) {
|
|
1750
|
$issuer_crt =& lookup_ca_by_subject($issuer);
|
|
1751
|
if($issuer_crt)
|
|
1752
|
$ca['caref'] = $issuer_crt['refid'];
|
|
1753
|
}
|
|
1754
|
}
|
|
1755
|
|
|
1756
|
/* Locate issuer for all certificates */
|
|
1757
|
if (is_array($config['system']['cert'])) {
|
|
1758
|
foreach ($config['system']['cert'] as & $cert) {
|
|
1759
|
$subject = cert_get_subject($cert['crt']);
|
|
1760
|
$issuer = cert_get_issuer($cert['crt']);
|
|
1761
|
if($issuer <> $subject) {
|
|
1762
|
$issuer_crt =& lookup_ca_by_subject($issuer);
|
|
1763
|
if($issuer_crt)
|
|
1764
|
$cert['caref'] = $issuer_crt['refid'];
|
|
1765
|
}
|
|
1766
|
}
|
|
1767
|
}
|
|
1768
|
}
|
|
1769
|
}
|
|
1770
|
|
|
1771
|
?>
|