From cf288f26b0f8e8146abce79a418b63be811c17b8 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 11 Jun 2013 09:07:23 -0400
Subject: Add another carp status check to quagga package.

---
 config/quagga_ospfd/quagga_ospfd.inc | 13 +++++++++++++
 config/quagga_ospfd/quagga_ospfd.xml |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index 46037bd9..591b9772 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -243,6 +243,18 @@ function quagga_ospfd_install_conf() {
 	fwrite($fd, $zebraconffile);
 	fclose($fd);
 
+	$carp_ip_status_check = "";
+	if (is_ipaddr($ospfd_conf['carpstatusip'])) {
+		$carpcheckinterface = trim(find_carp_interface($ospfd_conf['carpstatusip']));
+		$carp_ip_status_check = <<<EOF
+CARP_STATUS=`/sbin/ifconfig ${carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print $2;}'`
+if [ \${CARP_STATUS} != "MASTER" ]; then
+	exit;
+fi
+EOF;
+	}
+
+
 	// Create rc.d file
 	$rc_file_stop = <<<EOF
 if [ -e /var/run/quagga/zebra.pid ]; then
@@ -274,6 +286,7 @@ fi
 killall -9 zebra 2>/dev/null
 killall -9 ospfd 2>/dev/null
 sleep 1
+{$carp_ip_status_check}
 /usr/local/sbin/zebra -d -f {$quagga_config_base}/zebra.conf
 /usr/local/sbin/ospfd -d -f {$quagga_config_base}/ospfd.conf
 EOF;
diff --git a/config/quagga_ospfd/quagga_ospfd.xml b/config/quagga_ospfd/quagga_ospfd.xml
index c48d0f47..a03f9e3c 100644
--- a/config/quagga_ospfd/quagga_ospfd.xml
+++ b/config/quagga_ospfd/quagga_ospfd.xml
@@ -1,6 +1,6 @@
 <packagegui>
 	<name>quagga_ospfd</name>
-	<version>0.5.3</version>
+	<version>0.5.4</version>
 	<title>Services: Quagga OSPFd</title>
 	<include_file>/usr/local/pkg/quagga_ospfd.inc</include_file>
 	<aftersaveredirect>pkg_edit.php?xml=quagga_ospfd.xml&amp;id=0</aftersaveredirect>
-- 
cgit v1.2.3


From 783714c840c66b12f81e754d60b217774ef45295 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 11 Jun 2013 09:23:01 -0400
Subject: add a couple of newlines here for spacing.

---
 config/quagga_ospfd/quagga_ospfd.inc | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'config')

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index 591b9772..84bf8c4d 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -247,10 +247,12 @@ function quagga_ospfd_install_conf() {
 	if (is_ipaddr($ospfd_conf['carpstatusip'])) {
 		$carpcheckinterface = trim(find_carp_interface($ospfd_conf['carpstatusip']));
 		$carp_ip_status_check = <<<EOF
+
 CARP_STATUS=`/sbin/ifconfig ${carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print $2;}'`
 if [ \${CARP_STATUS} != "MASTER" ]; then
 	exit;
 fi
+
 EOF;
 	}
 
-- 
cgit v1.2.3


From 0db05d262ce546590a04ee21230456ac3a98c59e Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 11 Jun 2013 09:27:28 -0400
Subject: Escape this $ here.

---
 config/quagga_ospfd/quagga_ospfd.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index 84bf8c4d..5e23dbf8 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -248,7 +248,7 @@ function quagga_ospfd_install_conf() {
 		$carpcheckinterface = trim(find_carp_interface($ospfd_conf['carpstatusip']));
 		$carp_ip_status_check = <<<EOF
 
-CARP_STATUS=`/sbin/ifconfig ${carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print $2;}'`
+CARP_STATUS=`/sbin/ifconfig ${carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print \$2;}'`
 if [ \${CARP_STATUS} != "MASTER" ]; then
 	exit;
 fi
-- 
cgit v1.2.3


From be606c90326bed5d93897cda32a1dfd9c97df8cd Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 11 Jun 2013 09:28:37 -0400
Subject: And fix this bracketing

---
 config/quagga_ospfd/quagga_ospfd.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index 5e23dbf8..402e6a30 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -248,7 +248,7 @@ function quagga_ospfd_install_conf() {
 		$carpcheckinterface = trim(find_carp_interface($ospfd_conf['carpstatusip']));
 		$carp_ip_status_check = <<<EOF
 
-CARP_STATUS=`/sbin/ifconfig ${carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print \$2;}'`
+CARP_STATUS=`/sbin/ifconfig {$carpcheckinterface} | /usr/bin/grep carp: | /usr/bin/awk '{print \$2;}'`
 if [ \${CARP_STATUS} != "MASTER" ]; then
 	exit;
 fi
-- 
cgit v1.2.3


From 79ae84ea07e66d2b592b6fdca045ca8a611595c8 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 11 Jun 2013 10:17:38 -0400
Subject: Trim here to avoid an error from output containing a newline

---
 config/quagga_ospfd/quagga_ospfd.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index 402e6a30..aabd27a8 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -378,7 +378,7 @@ function quagga_ospfd_put_raw_config($conffile) {
 }
 
 function quagga_get_carp_status_by_ip($ipaddr) {
-	$iface = find_carp_interface($ipaddr);
+	$iface = trim(find_carp_interface($ipaddr));
 	if ($iface) {
 		$status = get_carp_interface_status($iface);
 		// If there is no status for that interface, return null.
-- 
cgit v1.2.3


From d875d5fc73d74403488288e65cdd7a0befac6939 Mon Sep 17 00:00:00 2001
From: Warren Baker <warren@decoy.co.za>
Date: Thu, 13 Jun 2013 11:34:34 +0200
Subject: only display 128 subnet if v6 function is available

---
 config/unbound/unbound_acls.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/unbound/unbound_acls.php b/config/unbound/unbound_acls.php
index 721d3adb..59738aab 100644
--- a/config/unbound/unbound_acls.php
+++ b/config/unbound/unbound_acls.php
@@ -139,7 +139,8 @@ include("head.inc");
 <script type="text/javascript">
 	function mask_field(fieldname, fieldsize, n) {
 		return '<select name="' + fieldname + n + '" class="formselect" id="' + fieldname + n + '"><?php
-			for ($i = 128; $i >= 0; $i--) {
+			$start = 24; if (function_exists("is_ipaddrv6")) $start = "128";
+			for ($i = $start; $i >= 0; $i--) {
 					echo "<option value=\"$i\">$i</option>";
 			}
 		?></select>';
-- 
cgit v1.2.3


From 6751b1db500c831eac7968a4cdd748b9cbc07949 Mon Sep 17 00:00:00 2001
From: Warren Baker <warren@decoy.co.za>
Date: Thu, 13 Jun 2013 16:21:44 +0200
Subject: Make sure virtual IPs are skipped as they would be covered in the
 interfaces access list

---
 config/unbound/unbound.inc | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'config')

diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc
index 2dd33bcd..156b14fc 100644
--- a/config/unbound/unbound.inc
+++ b/config/unbound/unbound.inc
@@ -275,12 +275,14 @@ function unbound_get_network_interface_addresses() {
 								log_error("Unbound DNS: There was a problem setting up the Virtual IP for the interface ".link_ip_to_carp_interface($vip['subnet']));
 							} else {
 								$unbound_interfaces[$i]['virtual']['ipaddr'] = $virtual_ip;
+								$unbound_interfaces[$i]['virtual']['subnet'] = $vip['subnet_bits'];
+								$unbound_interfaces[$i]['virtual']['network'] = $virtual_ip;
 							}
 						}
 					}
 				}
 			}
-		} else if(isset($interfaces[$unboundif]['ipaddr'])) {
+		} else if (isset($interfaces[$unboundif]['ipaddr'])) {
 			/* Find the interface IP address for
 			 * XXX - this only works for IPv4 currently - the pfSense module needs IPv6 love
 			 */
@@ -378,7 +380,7 @@ function unbound_acls_config() {
 	global $config;
 
 	/* Configure the ACLs */
-	if(is_array($config['installedpackages']['unboundacls']['config'])) {
+	if (is_array($config['installedpackages']['unboundacls']['config'])) {
 		$unbound_acls = $config['installedpackages']['unboundacls']['config'];
 		$unboundcfg = "";
 		foreach($unbound_acls as $unbound_acl){
@@ -409,9 +411,9 @@ function unbound_resync_config() {
 	$unbound_allowed_networks = "";
 	$unboundnetcfg = unbound_get_network_interface_addresses();
 	foreach($unboundnetcfg as $netent) {
-		foreach($netent as $entry) {
+		foreach($netent as $nettype => $entry) {
 			$unbound_bind_interfaces .="interface: {$entry['ipaddr']}\n";
-			if($entry['ipaddr'] != "127.0.0.1" && $entry['ipaddr'] != "::1")
+			if($entry['ipaddr'] != "127.0.0.1" && $entry['ipaddr'] != "::1" && $nettype != "virtual")
 				$unbound_allowed_networks .= "access-control: {$entry['network']}/{$entry['subnet']} allow\n";
 		}
 	}
-- 
cgit v1.2.3


From 4431280099dae7401d5b570a9dfe7ab574e0d2df Mon Sep 17 00:00:00 2001
From: Warren Baker <warren@decoy.co.za>
Date: Thu, 13 Jun 2013 20:12:22 +0200
Subject: Work out the recommended *-slabs setting dynamically. Kudos to
 Reiner030 on the forum

---
 config/unbound/unbound.inc | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

(limited to 'config')

diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc
index 156b14fc..8cd186fb 100644
--- a/config/unbound/unbound.inc
+++ b/config/unbound/unbound.inc
@@ -621,23 +621,19 @@ function unbound_optimization() {
 	// Set the number of threads equal to number of CPUs.
 	// Use 1 (disable threading) if for some reason this sysctl fails.
 	$numprocs = intval(trim(`/sbin/sysctl kern.smp.cpus | /usr/bin/cut -d" " -f2`));
-	if($numprocs > 0)
+	if($numprocs > 1) {
 		$optimization['number_threads'] = "num-threads: {$numprocs}";
-	else
+		$optimize_num = pow(2,floor(log($numprocs,2)));
+	} else {
 		$optimization['number_threads'] = "num-threads: 1";
+		$optimize_num = 4;
+	}
 
 	// Slabs to help reduce lock contention.
-	if ($numprocs > 4) {
-		$optimization['msg_cache_slabs'] = "msg-cache-slabs: {$numprocs}";
-		$optimization['rrset_cache_slabs'] = "rrset-cache-slabs: {$numprocs}";
-		$optimization['infra_cache_slabs'] = "infra-cache-slabs: {$numprocs}";
-		$optimization['key_cache_slabs'] = "key-cache-slabs: {$numprocs}";
-	} else {
-		$optimization['msg_cache_slabs'] = "msg-cache-slabs: 4";
-		$optimization['rrset_cache_slabs'] = "rrset-cache-slabs: 4";
-		$optimization['infra_cache_slabs'] = "infra-cache-slabs: 4";
-		$optimization['key_cache_slabs'] = "key-cache-slabs: 4";
-	}
+	$optimization['msg_cache_slabs'] = "msg-cache-slabs: {$optimize_num}";
+	$optimization['rrset_cache_slabs'] = "rrset-cache-slabs: {$optimize_num}";
+	$optimization['infra_cache_slabs'] = "infra-cache-slabs: {$optimize_num}";
+	$optimization['key_cache_slabs'] = "key-cache-slabs: {$optimize_num}";
 
 	// Memory usage - default is 4Mb if nothing has been selected
 	if(isset($unbound_config['msg_cache_size'])) {
-- 
cgit v1.2.3


From 11e9c582d5529d35a07fec6bfe63811d0a45f88b Mon Sep 17 00:00:00 2001
From: Warren Baker <warren@decoy.co.za>
Date: Thu, 13 Jun 2013 20:56:47 +0200
Subject: We make use of libevent so up these default values

---
 config/unbound/unbound.inc          | 12 ++----------
 config/unbound/unbound_advanced.xml |  3 ++-
 2 files changed, 4 insertions(+), 11 deletions(-)

(limited to 'config')

diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc
index 8cd186fb..f1d68eb7 100644
--- a/config/unbound/unbound.inc
+++ b/config/unbound/unbound.inc
@@ -487,7 +487,7 @@ EOF;
 	$outgoing_num_tcp = (!empty($unbound_config['outgoing_num_tcp'])) ? $unbound_config['outgoing_num_tcp'] : "10";
 	$incoming_num_tcp = (!empty($unbound_config['incoming_num_tcp'])) ? $unbound_config['incoming_num_tcp'] : "10";
 	$edns_buffer_size = (!empty($unbound_config['edns_buffer_size'])) ? $unbound_config['edns_buffer_size'] : "4096";
-	$num_queries_per_thread = (!empty($unbound_config['num_queries_per_thread'])) ? $unbound_config['num_queries_per_thread'] : "1024";
+	$num_queries_per_thread = (!empty($unbound_config['num_queries_per_thread'])) ? $unbound_config['num_queries_per_thread'] : "4096";
 	$jostle_timeout = (!empty($unbound_config['jostle_timeout'])) ? $unbound_config['jostle_timeout'] : "200";
 	$cache_max_ttl = (!empty($unbound_config['cache_max_ttl'])) ? $unbound_config['cache_max_ttl'] : "86400";
 	$cache_min_ttl = (!empty($unbound_config['cache_min_ttl'])) ? $unbound_config['cache_min_ttl'] : "0";
@@ -545,7 +545,7 @@ harden-dnssec-stripped: {$harden_dnssec_stripped}
 {$optimization['key_cache_slabs']}
 {$optimization['msg_cache_size']}
 {$optimization['rrset_cache_size']}
-{$optimization['outgoing_range']}
+outgoing-range: 8192
 {$optimization['so_rcvbuf']}
 
 # Interface IP(s) to bind to
@@ -645,14 +645,6 @@ function unbound_optimization() {
 		$optimization['rrset_cache_size'] = "rrset-cache-size: 8m";
 	}
 
-	// More outgoing connections per thread otherwise assign a default of 4096 for a single thread
-	if($numprocs > 0) {
-		$or = (1024/$numprocs) - 50;
-		$optimization['outgoing_range'] = "outgoing-range: {$or}";
-	} else {
-		$optimization['outgoing_range'] = "outgoing-range: {4096}";
-	}
-
 	// Larger socket buffer for busy servers
 	// Check that it is set to 4MB (by default the OS has it configured to 4MB)
 	foreach ($config['sysctl']['item'] as $tunable) {
diff --git a/config/unbound/unbound_advanced.xml b/config/unbound/unbound_advanced.xml
index 7603d0aa..2da5b505 100644
--- a/config/unbound/unbound_advanced.xml
+++ b/config/unbound/unbound_advanced.xml
@@ -219,11 +219,12 @@
 			<fieldname>num_queries_per_thread</fieldname>
 			<description>The number of queries that every thread will service simultaneously. If more queries arrive that need to be serviced, and no queries can be jostled, then these queries are dropped.</description>
 			<type>select</type>
-			<default_value>1024</default_value>
+			<default_value>4096</default_value>
 			<options>
 				<option><name>512</name><value>512</value></option>
 				<option><name>1024</name><value>1024</value></option>
 				<option><name>2048</name><value>2048</value></option>
+				<option><name>4096</name><value>4096</value></option>
 			</options>
 			<advancedfield/>
 		</field>
-- 
cgit v1.2.3


From 355ebce27aeb941f949f26f9c70d08150f37a7db Mon Sep 17 00:00:00 2001
From: Alexander Wilke <nachtfalkeaw@web.de>
Date: Sun, 16 Jun 2013 18:54:33 +0300
Subject: freeradius2: m-OTP allow negative offset

---
 config/freeradius2/freeradius.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc
index b2df3d0b..bf48dd06 100644
--- a/config/freeradius2/freeradius.inc
+++ b/config/freeradius2/freeradius.inc
@@ -4003,7 +4003,7 @@ USERNAME=`echo -n "\$1" | sed 's/[^0-9a-zA-Z._-]/X/g' `
 PASSWD=`echo -n "\$2" | sed 's/[^0-9a-f]/0/g' `
 SECRET=`echo -n "\$3" | sed 's/[^0-9a-f]/0/g' `
 PIN=`echo -n "\$4" | sed 's/[^0-9]/0/g' `
-OFFSET=`echo -n "\$5" | sed 's/[^0-9]/0/g' `
+OFFSET=`echo -n "\$5" | sed 's/[^0-9-]/0/g' `
 EPOCHTIME=`date +%s` ; EPOCHTIME=`chop \$EPOCHTIME`
 
 # delete old logins
-- 
cgit v1.2.3


From 1548fc4c34422829948e1be45f4c89242cb367b7 Mon Sep 17 00:00:00 2001
From: Alexander Wilke <nachtfalkeaw@web.de>
Date: Sun, 16 Jun 2013 18:56:03 +0300
Subject: freeradius2: m-OTP allow negative offset

---
 config/freeradius2/freeradius.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/freeradius2/freeradius.xml b/config/freeradius2/freeradius.xml
index c9381c81..8e3105ef 100644
--- a/config/freeradius2/freeradius.xml
+++ b/config/freeradius2/freeradius.xml
@@ -275,7 +275,7 @@
 			
 									1. Write down the first 9 digits of the Epoch-Time on the client.<br>
 									2. Check with <b>date +%s</b> the Epoch-Time on your FreeRADIUS server and write down the first 9 digits.<br>
-									3. Subtract both values, multiply the result with 10 and enter the value in this field. (Default: 0)]]></description>
+									3. Subtract both values, multiply the result with 10 and enter the value in this field. Example: 30 or -180 (Default: 0)]]></description>
 			<type>input</type>
 			<default_value>0</default_value>
 		</field>
-- 
cgit v1.2.3


From b373b72bb60dea4a33b4f6c8b87cf1860cca4de3 Mon Sep 17 00:00:00 2001
From: PiBa-NL <pba_2k3@yahoo.com>
Date: Mon, 17 Jun 2013 23:13:23 +0200
Subject: haproxy-devel updated to version 1.5dev19, including support for
 'transparent proxy'

---
 config/haproxy-devel/haproxy.inc           | 2 ++
 config/haproxy-devel/haproxy_pool_edit.php | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

(limited to 'config')

diff --git a/config/haproxy-devel/haproxy.inc b/config/haproxy-devel/haproxy.inc
index 954e933f..4095f8cd 100644
--- a/config/haproxy-devel/haproxy.inc
+++ b/config/haproxy-devel/haproxy.inc
@@ -934,6 +934,8 @@ function haproxy_check_run($reload) {
 
 	if(use_transparent_clientip_proxying())
 		load_ipfw_rules();
+	else
+		mwexec("/usr/local/sbin/ipfw_context -d haproxy", true);
 	
 	if(isset($a_global['enable'])) {
 		if (isset($a_global['carpdev'])) {
diff --git a/config/haproxy-devel/haproxy_pool_edit.php b/config/haproxy-devel/haproxy_pool_edit.php
index 4b93632f..a7a56b1c 100644
--- a/config/haproxy-devel/haproxy_pool_edit.php
+++ b/config/haproxy-devel/haproxy_pool_edit.php
@@ -491,7 +491,7 @@ foreach($simplefields as $field){
 				</table>
 			</td>
 		</tr>
-		<tr align="left" style="display:none;">
+		<tr align="left">
 			<td width="22%" valign="top" class="vncell">Transparent ClientIP</td>
 			<td width="78%" class="vtable" colspan="2">
 				<input id="transparent_clientip" name="transparent_clientip" type="checkbox" value="yes" <?php if ($pconfig['transparent_clientip']=='yes') echo "checked"; ?> onclick='updatevisibility();'>
-- 
cgit v1.2.3