pfSense

<?php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * Copyright (c) 2014-2019 Rubicon Communications, LLC (Netgate)

 *

 * originally part of m0n0wall (http://m0n0.ch/wall)

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

define('VIP_CARP', 2);

define('VIP_IPALIAS', 3);

	return sigkillbypid($pidfile, "TERM", $waitfor);

	}

	return false;

		while(isvalidpid($pidfile) && $waitcounter > 0) {

			$waitcounter = $waitcounter - 1;

			usleep(100000);

		}

		return $result;

}

/* kill a process by name */

function sigkillbyname($procname, $sig) {

/* kill a process by name */

function killbyname($procname) {

	global $g;

	return false;

}

function mark_subsystem_dirty($subsystem = "") {

	global $g;

function clear_subsystem_dirty($subsystem = "") {

	global $g;

	@unlink("{$g['varrun_path']}/{$subsystem}.dirty");

}

	}

		@touch("{$g['tmp_path']}/{$lock}.lock");

		@chmod("{$g['tmp_path']}/{$lock}.lock", 0666);

	}

	if ($fp = fopen("{$g['tmp_path']}/{$lock}.lock", "w")) {

		$trycounter = 0;

				fclose($fp);

				return NULL;

			}

			sleep(1);

			$trycounter++;

		}

		return $fp;

	}

	return NULL;

}

function unlock($cfglckkey = 0) {

function unlock_force($lock) {

	global $g;

	@unlink("{$g['tmp_path']}/{$lock}.lock");

}

	global $g;

	while ($try < 3) {

		$fd = @fsockopen($g['event_address']);

		if ($fd) {

			fwrite($fd, $cmd);

			$resp = fread($fd, 4096);

			$try = 3;

}

function send_multiple_events($cmds) {

		$fd = @fsockopen($g['event_address']);

		if ($fd) {

			foreach ($cmds as $cmd) {

				fwrite($fd, $cmd);

				$resp = fread($fd, 4096);

			fclose($fd);

			$try = 3;

	}

	$running = 0;

function is_numericint($arg) {

}

function gen_subnetv4($ipaddr, $bits) {

	if (is_ipaddrv4($ipaddr) && is_numericint($bits) && $bits <= 32) {

	}

	return "";

}

function gen_subnetv4_max($ipaddr, $bits) {

	if (is_ipaddrv4($ipaddr) && is_numericint($bits) && $bits <= 32) {

	return "";

		return bin_to_compressed_ip6($endip_bin);

	return "";

function gen_subnet_mask_long($bits) {

	$sm = 0;

	for ($i = 0; $i < $bits; $i++) {

		$sm >>= 1;

		$sm |= 0x80000000;

	}

	return $sm;

}

/* same as above but returns a string */

function gen_subnet_mask($bits) {

	return long2ip(gen_subnet_mask_long($bits));

}

function gen_subnet_mask_v6($bits) {

	/* Binary representation of the prefix length */

	$bin = str_repeat('1', $bits);

	/* Pad right with zeroes to reach the full address length */

	$bin = str_pad($bin, 128, '0', STR_PAD_RIGHT);

	/* Convert back to an IPv6 address style notation */

}

   Returns '' if not valid IPv4. */

   Returns '' if not valid IPv4. */

 * Convert IPv6 address to binary

 *

 * Obtained from: pear-Net_IPv6

 */

function ip6_to_bin($ip) {

	$binstr = '';

	$ip = Net_IPv6::removeNetmaskSpec($ip);

	$ip = Net_IPv6::Uncompress($ip);

	$parts = explode(':', $ip);

	foreach ( $parts as $v ) {

		$str     = base_convert($v, 16, 2);

		$binstr .= str_pad($str, 16, '0', STR_PAD_LEFT);

	}

	return $binstr;

}

/*

 * Convert IPv6 binary to uncompressed address

 *

 * Obtained from: pear-Net_IPv6

 */

function bin_to_ip6($bin) {

	$ip = "";

	if (strlen($bin) < 128) {

		$bin = str_pad($bin, 128, '0', STR_PAD_LEFT);

	}

	$parts = str_split($bin, "16");

	foreach ( $parts as $v ) {

		$str = base_convert($v, 2, 16);

		$ip .= $str.":";

	}

	$ip = substr($ip, 0, -1);

	return $ip;

}

/*

 * Convert IPv6 binary to compressed address

 */

function bin_to_compressed_ip6($bin) {

}

/*

 * Convert textual IPv6 address string to compressed address

 */

function text_to_compressed_ip6($text) {

	// Force re-compression by passing parameter 2 (force) true.

	// This ensures that supposedly-compressed formats are uncompressed

	// first then re-compressed into strictly correct form.

	// e.g. 2001:0:0:4:0:0:0:1

	// 2001::4:0:0:0:1 is a strictly-incorrect compression,

	// but maybe the user entered it like that.

	// The "force" parameter will ensure it is returned as:

	// 2001:0:0:4::1

	return Net_IPv6::compress($text, true);

 *  e.g. 192.168.0.0 to 192.168.0.255 returns 256

 */

	if (is_ipaddrv4($startip) && is_ipaddrv4($endip)) {

		//   when crossing over from 127.255.255.255 / 128.0.0.0 barrier

		return abs(ip2ulong($startip) - ip2ulong($endip)) + 1;

	}

	return -1;

}

/* Find the smallest possible subnet mask which can contain a given number of IPs

 *  e.g. 512 IPs can fit in a /23, but 513 IPs need a /22

 */

	for ($b=32; $b > 0; $b--) {

	return (32-$smallest);

}

/* Return the previous IP address before the given address */

	return long2ip32(ip2long($ip) - $offset);

/* Return the next IP address after the given address */

	return long2ip32(ip2long($ip) + $offset);

/* Return true if the first IP is 'before' the second */

function ip_less_than($ip1, $ip2) {

	// Compare as unsigned long because otherwise it wouldn't work when

	//   crossing over from 127.255.255.255 / 128.0.0.0 barrier

	return ip2ulong($ip1) < ip2ulong($ip2);

}

/* Return true if the first IP is 'after' the second */

function ip_greater_than($ip1, $ip2) {

	// Compare as unsigned long because otherwise it wouldn't work

	//   when crossing over from 127.255.255.255 / 128.0.0.0 barrier

	return ip2ulong($ip1) > ip2ulong($ip2);

}

function ipcmp($a, $b) {

/* Note: IPv6 ranges are not yet supported here. */

function ip_range_to_address_array($startip, $endip, $max_size = 5000) {

	if (!is_ipaddrv4($startip) || !is_ipaddrv4($endip)) {

		return false;

	}

	if (ip_greater_than($startip, $endip)) {

		// Swap start and end so we can process sensibly.

		$temp = $startip;

		$startip = $endip;

		$endip = $temp;

	}

	$rangeaddresses = array();

	$end_int = ip2ulong($endip);

	for ($ip_int = ip2ulong($startip); $ip_int <= $end_int; $ip_int++) {

		$rangeaddresses[] = long2ip($ip_int);

	}

	return $rangeaddresses;

}

 * Convert an IPv4 or IPv6 IP range to an array of subnets which can contain the range.

 * Algorithm and embodying code PD'ed by Stilez - enjoy as you like :-)

 *

 * Documented on pfsense dev list 19-20 May 2013. Summary:

 *

 * The algorithm looks at patterns of 0's and 1's in the least significant bit(s), whether IPv4 or IPv6.

 * These are all that needs checking to identify a _guaranteed_ correct, minimal and optimal subnet array.

 *

 * As a result, string/binary pattern matching of the binary IP is very efficient. It uses just 2 pattern-matching rules

 * to chop off increasingly larger subnets at both ends that can't be part of larger subnets, until nothing's left.

 *

 * (a) If any range has EITHER low bit 1 (in startip) or 0 (in endip), that end-point is _always guaranteed_ to be optimally

 * represented by its own 'single IP' CIDR; the remaining range then shrinks by one IP up or down, causing the new end-point's

 * low bit to change from 1->0 (startip) or 0->1 (endip). Only one edge case needs checking: if a range contains exactly 2

 * adjacent IPs of this format, then the two IPs themselves are required to span it, and we're done.

 * Once this rule is applied, the remaining range is _guaranteed_ to end in 0's and 1's so rule (b) can now be used, and its

 * low bits can now be ignored.

 *

 * (b) If any range has BOTH startip and endip ending in some number of 0's and 1's respectively, these low bits can

 * *always* be ignored and "bit-shifted" for subnet spanning. So provided we remember the bits we've place-shifted, we can

 * _always_ right-shift and chop off those bits, leaving a smaller range that has EITHER startip ending in 1 or endip ending

 * in 0 (ie can now apply (a) again) or the entire range has vanished and we're done.

 * We then loop to redo (a) again on the remaining (place shifted) range until after a few loops, the remaining (place shifted)

 * range 'vanishes' by meeting the exit criteria of (a) or (b), and we're done.

 */

		$proto = 'ipv4';  // for clarity

		$bits = 32;

		$ip1bin = decbin(ip2long32($ip1));

		$ip2bin = decbin(ip2long32($ip2));

	} elseif (is_ipaddrv6($ip1) && is_ipaddrv6($ip2)) {

		$proto = 'ipv6';

		$bits = 128;

		$ip2bin = ip6_to_bin($ip2);

	$ip1bin = str_pad($ip1bin, $bits, '0', STR_PAD_LEFT);

	$ip2bin = str_pad($ip2bin, $bits, '0', STR_PAD_LEFT);

	if ($ip1bin > $ip2bin) {

	$netsize = 0;

	do {

		// at loop start, $ip1 is guaranteed strictly less than $ip2 (important for edge case trapping and preventing accidental binary wrapround)

		// which means the assignments $ip1 += 1 and $ip2 -= 1 will always be "binary-wrapround-safe"

		// step #1 if start ip (as shifted) ends in any '1's, then it must have a single cidr to itself (any cidr would include the '0' below it)

			// the start ip must be in a separate one-IP cidr range

			$new_subnet_ip = substr($ip1bin, $netsize, $bits - $netsize) . str_repeat('0', $netsize);

			$rangesubnets[$new_subnet_ip] = $bits - $netsize;

			$n = strrpos($ip1bin, '0');  //can't be all 1's

			$ip1bin = ($n == 0 ? '' : substr($ip1bin, 0, $n)) . '1' . str_repeat('0', $bits - $n - 1);  // BINARY VERSION OF $ip1 += 1

		// step #2, if end ip (as shifted) ends in any zeros then that must have a cidr to itself (as cidr cant span the 1->0 gap)

			// the end ip must be in a separate one-IP cidr range

			$new_subnet_ip = substr($ip2bin, $netsize, $bits - $netsize) . str_repeat('0', $netsize);

			$rangesubnets[$new_subnet_ip] = $bits - $netsize;

			$n = strrpos($ip2bin, '1');  //can't be all 0's

			$ip2bin = ($n == 0 ? '' : substr($ip2bin, 0, $n)) . '0' . str_repeat('1', $bits - $n - 1);  // BINARY VERSION OF $ip2 -= 1

			// already checked for the edge case where end = start+1 and start ends in 0x1, above, so it's safe

		if ($ip2bin < $ip1bin) {

		// step #3 the start and end ip MUST now end in '0's and '1's respectively

		// so we have a non-trivial range AND the last N bits are no longer important for CIDR purposes.

		$shift = $bits - max(strrpos($ip1bin, '0'), strrpos($ip2bin, '1'));  // num of low bits which are '0' in ip1 and '1' in ip2

		$ip1bin = str_repeat('0', $shift) . substr($ip1bin, 0, $bits - $shift);

		$ip2bin = str_repeat('0', $shift) . substr($ip2bin, 0, $bits - $shift);

		$netsize += $shift;

		if ($ip1bin == $ip2bin) {

			// we're done.

			$new_subnet_ip = substr($ip1bin, $netsize, $bits - $netsize) . str_repeat('0', $netsize);

			$rangesubnets[$new_subnet_ip] = $bits - $netsize;

			continue;

	} while ($ip1bin < $ip2bin);

	$out = array();

		if ($proto == 'ipv4') {

			$i = str_split($ip, 8);

		} else {

	true (numeric 4 or 6) - if valid, gives type of addresses */

	if (substr_count($range, '-') != 1) {

		return false;

	}

	list($ip1, $ip2) = explode ('-', $range);

	if (is_ipaddrv6($ip1) && is_ipaddrv6($ip2)) {

	true (numeric 4 or 6) - if valid, gives type of address */

	return false;

}

	 * While Net_IPv6::checkIPv6() considers IPv6/mask a valid IPv6,

	 * is_ipaddrv6() needs to be more strict to keep the compatibility

	 * with is_ipaddrv4().

	 */

	if (strstr($ipaddr, "/")) {

		return false;

	}

		$tmpip = explode("%", $ipaddr);