Project

General

Profile

Download (11.2 KB) Statistics
| Branch: | Tag: | Revision:
1 4668f9f7 Scott Ullrich
<?php
2 b46bfcf5 Bill Marquette
/* $Id$ */
3 5b237745 Scott Ullrich
/*
4 580182e2 Colin Smith
	system_firmware.php
5 1cecfbf7 Scott Ullrich
	Copyright (C) 2008 Scott Ullrich <sullrich@gmail.com>
6 ce77a9c4 Phil Davis
	Copyright (C) 2013-2015 Electric Sheep Fencing, LP
7 1cecfbf7 Scott Ullrich
	All rights reserved.
8 580182e2 Colin Smith
9 1cecfbf7 Scott Ullrich
	originally part of m0n0wall (http://m0n0.ch/wall)
10 580182e2 Colin Smith
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
11
	All rights reserved.
12
13
	Redistribution and use in source and binary forms, with or without
14
	modification, are permitted provided that the following conditions are met:
15
16
	1. Redistributions of source code must retain the above copyright notice,
17
	   this list of conditions and the following disclaimer.
18
19
	2. Redistributions in binary form must reproduce the above copyright
20
	   notice, this list of conditions and the following disclaimer in the
21
	   documentation and/or other materials provided with the distribution.
22
23
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
24
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
25
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
26
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
27
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32
	POSSIBILITY OF SUCH DAMAGE.
33 5b237745 Scott Ullrich
*/
34 1d333258 Scott Ullrich
/*
35 4b805dbc Renato Botelho
	pfSense_BUILDER_BINARIES:	/usr/bin/tar
36 5387537e sbeaver
	pfSense_MODULE: firmware
37 1d333258 Scott Ullrich
*/
38 5b237745 Scott Ullrich
39 6b07c15a Matthew Grooms
##|+PRIV
40
##|*IDENT=page-system-firmware-manualupdate
41
##|*NAME=System: Firmware: Manual Update page
42
##|*DESCR=Allow access to the 'System: Firmware: Manual Update' page.
43
##|*MATCH=system_firmware.php*
44
##|-PRIV
45
46 3958d63b Colin Smith
$d_isfwfile = 1;
47 7385a6b4 Scott Ullrich
$nocsrf = true;
48
49 f0394a03 Scott Ullrich
require_once("globals.inc");
50 c1605b35 Scott Ullrich
require_once("functions.inc");
51 6605faea Scott Ullrich
require_once("guiconfig.inc");
52 f03ed350 Ermal
require_once("xmlrpc_client.inc");
53 da55e467 Scott Ullrich
54
$curcfg = $config['system']['firmware'];
55
56 47d11b79 Mark Crane
/* Allow additional execution time 0 = no limit. */
57 8999038a Scott Ullrich
ini_set('max_execution_time', '9999');
58
ini_set('max_input_time', '9999');
59 0045dfd1 Scott Ullrich
60 d2d86ca3 Scott Ullrich
function file_is_for_platform($filename, $ul_name) {
61 f0394a03 Scott Ullrich
	global $g;
62 3350a691 Scott Ullrich
	if($g['platform'] == "nanobsd") {
63 d2d86ca3 Scott Ullrich
		if(stristr($ul_name, "nanobsd"))
64 7475fc0b Scott Ullrich
			return true;
65
		else
66 4b805dbc Renato Botelho
			return false;
67 7475fc0b Scott Ullrich
	}
68 e6d5af4b Ermal
	$_gb = exec("/usr/bin/tar xzf $filename -C /tmp/ etc/platform");
69
	unset($_gb);
70 4b805dbc Renato Botelho
	if(!file_exists("/tmp/etc/platform"))
71 fe38f1da Scott Ullrich
		return false;
72 e6d5af4b Ermal
	$upgrade_is_for_platform = trim(file_get_contents("/tmp/etc/platform", " \n\t\r"));
73
	if ($g['platform'] == $upgrade_is_for_platform) {
74
		@unlink("/tmp/etc/platform");
75 f0394a03 Scott Ullrich
		return true;
76
	}
77
	return false;
78
}
79
80 cdd3238d Scott Ullrich
function file_upload_error_message($error_code) {
81 4b805dbc Renato Botelho
	switch ($error_code) {
82
	case UPLOAD_ERR_INI_SIZE:
83
		return gettext('The uploaded file exceeds the upload_max_filesize directive in php.ini');
84
	case UPLOAD_ERR_FORM_SIZE:
85
		return gettext('The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form');
86
	case UPLOAD_ERR_PARTIAL:
87
		return gettext('The uploaded file was only partially uploaded');
88
	case UPLOAD_ERR_NO_FILE:
89
		return gettext('No file was uploaded');
90
	case UPLOAD_ERR_NO_TMP_DIR:
91
		return gettext('Missing a temporary folder');
92
	case UPLOAD_ERR_CANT_WRITE:
93
		return gettext('Failed to write file to disk');
94
	case UPLOAD_ERR_EXTENSION:
95
		return gettext('File upload stopped by extension');
96
	default:
97
		return gettext('Unknown upload error');
98
	}
99 cdd3238d Scott Ullrich
}
100
101 8b7c81d7 Scott Ullrich
/* if upgrade in progress, alert user */
102 a368a026 Ermal Lu?i
if(is_subsystem_dirty('firmwarelock')) {
103 1b4f376d Vinicius Coque
	$pgtitle = array(gettext("System"),gettext("Firmware"),gettext("Manual Update"));
104 8b7c81d7 Scott Ullrich
	include("head.inc");
105
	include("fbegin.inc");
106 5387537e sbeaver
	print_info_box(gettext("An upgrade is currently in progress. The firewall will reboot when the operation is complete.") . "<p><img src='/themes/{$g['theme']}/images/icons/icon_fw-update.gif' alt='update' /></p>");
107
	include("foot.inc");
108 8b7c81d7 Scott Ullrich
	exit;
109
}
110
111 4b805dbc Renato Botelho
if($_POST['backupbeforeupgrade'])
112 b2a67b55 Scott Ullrich
	touch("/tmp/perform_full_backup.txt");
113
114 aa08f46b Bill Marquette
/* Handle manual upgrade */
115 a368a026 Ermal Lu?i
if ($_POST && !is_subsystem_dirty('firmwarelock')) {
116 4b805dbc Renato Botelho
117 580182e2 Colin Smith
	unset($input_errors);
118
	unset($sig_warning);
119
120 4134b5e6 Carlos Eduardo Ramos
	if (stristr($_POST['Submit'], gettext("Enable")))
121 580182e2 Colin Smith
		$mode = "enable";
122 4134b5e6 Carlos Eduardo Ramos
	else if (stristr($_POST['Submit'], gettext("Disable")))
123 580182e2 Colin Smith
		$mode = "disable";
124 4134b5e6 Carlos Eduardo Ramos
	else if (stristr($_POST['Submit'], gettext("Upgrade")) || $_POST['sig_override'])
125 580182e2 Colin Smith
		$mode = "upgrade";
126
	else if ($_POST['sig_no']) {
127 709f48f0 Scott Ullrich
		if(file_exists("{$g['upload_path']}/firmware.tgz"))
128
				unlink("{$g['upload_path']}/firmware.tgz");
129 580182e2 Colin Smith
	}
130
	if ($mode) {
131
		if ($mode == "enable") {
132 b6f67235 Scott Ullrich
			conf_mount_rw();
133 a368a026 Ermal Lu?i
			mark_subsystem_dirty('firmware');
134 580182e2 Colin Smith
		} else if ($mode == "disable") {
135 b6f67235 Scott Ullrich
			conf_mount_ro();
136 a368a026 Ermal Lu?i
			clear_subsystem_dirty('firmware');
137 580182e2 Colin Smith
		} else if ($mode == "upgrade") {
138 cdd3238d Scott Ullrich
			if ($_FILES['ulfile']['error'])
139 4b805dbc Renato Botelho
				$errortext = "(" . file_upload_error_message($_FILES['ulfile']['error']) . ")";
140 580182e2 Colin Smith
			if (is_uploaded_file($_FILES['ulfile']['tmp_name'])) {
141
				/* verify firmware image(s) */
142 d2d86ca3 Scott Ullrich
				if (file_is_for_platform($_FILES['ulfile']['tmp_name'], $_FILES['ulfile']['name']) == false && !$_POST['sig_override'])
143 33a2693c Chris Buechler
					$input_errors[] = gettext("The uploaded image file is not for this platform.");
144 580182e2 Colin Smith
				else if (!file_exists($_FILES['ulfile']['tmp_name'])) {
145
					/* probably out of memory for the MFS */
146 1b4f376d Vinicius Coque
					$input_errors[] = gettext("Image upload failed (out of memory?)");
147 0d64af59 Ermal Lu?i
					mwexec("/etc/rc.firmware disable");
148 a368a026 Ermal Lu?i
					clear_subsystem_dirty('firmware');
149 580182e2 Colin Smith
				} else {
150
					/* move the image so PHP won't delete it */
151 1ef7b568 Scott Ullrich
					rename($_FILES['ulfile']['tmp_name'], "{$g['upload_path']}/firmware.tgz");
152 580182e2 Colin Smith
153
					/* check digital signature */
154 1ef7b568 Scott Ullrich
					$sigchk = verify_digital_signature("{$g['upload_path']}/firmware.tgz");
155 580182e2 Colin Smith
156
					if ($sigchk == 1)
157 1b4f376d Vinicius Coque
						$sig_warning = gettext("The digital signature on this image is invalid.");
158 a0116247 Ermal
					else if ($sigchk == 2 && !isset($config['system']['firmware']['allowinvalidsig']))
159 1b4f376d Vinicius Coque
						$sig_warning = gettext("This image is not digitally signed.");
160 a0116247 Ermal
					else if (($sigchk >= 3))
161 1b4f376d Vinicius Coque
						$sig_warning = gettext("There has been an error verifying the signature on this image.");
162 580182e2 Colin Smith
163 709f48f0 Scott Ullrich
					if (!verify_gzip_file("{$g['upload_path']}/firmware.tgz")) {
164 1b4f376d Vinicius Coque
						$input_errors[] = gettext("The image file is corrupt.");
165 1ef7b568 Scott Ullrich
						unlink("{$g['upload_path']}/firmware.tgz");
166 580182e2 Colin Smith
					}
167
				}
168
			}
169
170 1834f481 Scott Ullrich
			run_plugins("/usr/local/pkg/firmware_upgrade");
171
172 e6d5af4b Ermal
			/* Check for input errors, firmware locks, warnings, then check for firmware if sig_override is set */
173
			if (!$input_errors && !is_subsystem_dirty('firmwarelock') && (!$sig_warning || $_POST['sig_override'])) {
174
				if (file_exists("{$g['upload_path']}/firmware.tgz")) {
175
					/* fire up the update script in the background */
176
					mark_subsystem_dirty('firmwarelock');
177
					$savemsg = gettext("The firmware is now being updated. The firewall will reboot automatically.");
178
					if (stristr($_FILES['ulfile']['name'],"nanobsd") or $_POST['isnano'] == "yes")
179
						mwexec_bg("/etc/rc.firmware pfSenseNanoBSDupgrade {$g['upload_path']}/firmware.tgz");
180
					else if(stristr($_FILES['ulfile']['name'],"bdiff"))
181
						mwexec_bg("/etc/rc.firmware delta_update {$g['upload_path']}/firmware.tgz");
182
					else  {
183
						if($g['platform'] == "nanobsd")
184
							$whichone = "pfSenseNanoBSDupgrade";
185
						else
186
							$whichone = "pfSenseupgrade";
187
						mwexec_bg("/etc/rc.firmware {$whichone} {$g['upload_path']}/firmware.tgz");
188
						unset($whichone);
189
					}
190
				} else
191
					$savemsg = sprintf(gettext("Firmware image missing or other error, please try again %s."),$errortext);
192
			}
193 580182e2 Colin Smith
		}
194
	}
195 5b237745 Scott Ullrich
}
196 e2fa4962 Scott Ullrich
197 3c446c66 Erik Fonnesbeck
$pgtitle = array(gettext("System"),gettext("Firmware"));
198 52380979 Scott Ullrich
include("head.inc");
199
200 5387537e sbeaver
if ($input_errors)
201
	print_input_errors($input_errors);
202
203
if ($savemsg)
204
	print_info_box($savemsg);
205
206 1be02f50 sbeaver
if ($fwinfo != "")
207 5387537e sbeaver
	print_info_box($fwinfo);
208
209
$tab_array = array();
210
$tab_array[] = array(gettext("Manual Update"), true, "system_firmware.php");
211
$tab_array[] = array(gettext("Auto Update"), false, "system_firmware_check.php");
212
$tab_array[] = array(gettext("Updater Settings"), false, "system_firmware_settings.php");
213
if($g['hidedownloadbackup'] == false)
214
	$tab_array[] = array(gettext("Restore Full Backup"), false, "system_firmware_restorefullbackup.php");
215
216
display_top_tabs($tab_array);
217
218
// For a simple yes/no we can use an HTML form
219
if ($sig_warning && !$input_errors) {
220
	$sig_warning = gettext("The image you uploaded " .
221 77a89fb6 Scott Ullrich
		"is not an official/supported image and may lead to unexpected behavior or security " .
222
		"compromises. Only install images that come from sources that you trust, and make sure ".
223 8cd558b6 ayvis
		"that the image has not been tampered with.") . "<br /><br />".
224 1b4f376d Vinicius Coque
		gettext("Do you want to install this image anyway (on your own risk)?");
225 5387537e sbeaver
226
	print_info_box($sig_warning);
227 5b237745 Scott Ullrich
?>
228 5387537e sbeaver
	<form action="system_firmware.php" method="post" enctype="multipart/form-data">
229 38e06c66 Sjon Hortensius
		<input name="sig_override" type="submit" class="btn btn-danger" id="sig_override" value=" <?=gettext("Yes");?> " />
230
		<input name="sig_no" type="submit" class="btn btn-default" id="sig_no" value=" <?=gettext("No"); ?> " />
231
	</form>
232 4820d297 Scott Ullrich
<?php
233 5387537e sbeaver
234
} else {
235
	// This is where the work gets done so Forms.classes will be used from this point
236
	if (!is_subsystem_dirty('firmwarelock')) {
237
		require('classes/Form.class.php');
238
239
		if (!is_subsystem_dirty('rebootreq')) {
240 45e630d7 sbeaver
			// Provide a button to enable firmware upgrades. Upgrades should be disabled on initial page load
241
			if (!is_subsystem_dirty('firmware') || !$_POST) {
242 1be02f50 sbeaver
				$enablebtn = new Form_Button(
243
					'Submit',
244
					'Enable firmware upload'
245
					);
246
247 5387537e sbeaver
				$enablebtn->addClass('btn-warning');
248
				$form = new Form($enablebtn);
249
				$section = new Form_Section('Invoke ' . $g['product_name'] .' Manual Upgrade');
250
				$section->addInput(new Form_StaticText('Enable', 'Click the "Enable firmware upload" button below to begin.'));
251
			}
252
			else {
253 1be02f50 sbeaver
				// Upgrades are now enabled
254 38e06c66 Sjon Hortensius
				$form = new Form('Disable firmware upload');
255 5387537e sbeaver
256
				$form->setMultipartEncoding();
257
258
				$section = new Form_Section('Perform ' . $g['product_name'] .' Manual Upgrade');
259
260
				if (!session_id())
261
					$upload_id = uniqid();
262
				else
263
					$upload_id = session_id();
264
265
				$section->addInput(new Form_Input(
266
					'UPLOAD_IDENTIFIER',
267
					'',
268
					'hidden',
269 45e630d7 sbeaver
					$upload_id
270 5387537e sbeaver
					));
271
272
				if(stristr($_FILES['ulfile']['name'],"nanobsd")) {
273
					$section->addInput(new Form_Input(
274
						'isnano',
275
						'',
276
						'hidden',
277 45e630d7 sbeaver
						'yes'
278 5387537e sbeaver
						));
279
				}
280
281
				if ($g['platform'] == "nanobsd")
282
					$type = "*.img.gz";
283
				else
284
					$type = "*.tgz";
285
286
				$filepicker = new Form_Input(
287
					'ulfile',
288
					'File to upload (' . $type . ')',
289
					'file',
290 45e630d7 sbeaver
					''
291 5387537e sbeaver
				);
292
293
				$section->addInput($filepicker)->setHelp('Choose the file you wish to upload');
294
295
				if ($g['hidebackupbeforeupgrade'] === false) {
296
					$section->addInput(new Form_Checkbox(
297
						'backupbeforeupgrade',
298
						Backup,
299
						'Perform a full backup prior to upgrade"',
300
						false
301
					));
302
				}
303
304
				$section->addInput(new Form_Button(
305
					'submit',
306
					'Upgrade firmware'
307
				))->addClass('btn-danger btn-sm')->setHelp('Click the "Upgrade firmware" button below to start the upgrade process');
308
			}
309
310
			$form->add($section);
311
			print($form);
312
		}
313
	}
314
	else {
315
		print_info_box('<strong>' . gettext("You must reboot the system before you can upgrade the firmware.") . '</strong>');
316
	}
317
318
	if (is_subsystem_dirty('firmware') && !is_subsystem_dirty('firmwarelock')) {
319
		print_info_box('<strong>' . gettext("DO NOT ") . '</strong>' . gettext('abort the firmware upgrade once it ' .
320
			'has started. The firewall will reboot automatically after ' .
321
			'storing the new firmware. The configuration will be maintained.'));
322
	}
323
}
324
325
include("foot.inc"); ?>