Added option to allow IPsec/ESP-encapsulated IP fragments to System: Advanced setup

page.

git-svn-id: https://svn.m0n0.ch/wall/trunk@92 e36fee2c-cc09-0410-a7cc-ebac5c6737de

diff --git a/phpconf/config.xml b/phpconf/config.xml
index 5fc84a2a82170b544f19d9bf405ac964c40f076a..8e9cd57c71c10e6f36c4fcfcdd7979ed9a4d2ebd 100644 (file)
--- a/phpconf/config.xml
+++ b/phpconf/config.xml
@@ -344,6 +344,7 @@
        <filter>
                <!-- <tcpidletimeout></tcpidletimeout> -->
                <!-- <bypassstaticroutes/> -->
+               <!-- <allowipsecfrags/> -->
                <rule>
                        <type>pass</type>
                        <descr>Default LAN -&gt; any</descr>

diff --git a/phpconf/inc/filter.inc b/phpconf/inc/filter.inc
index caffe41bb61f431ac48d22728cec27499be29c35..ee20ef395e5623be5dcb2698181913b5c51e4bce 100644 (file)
--- a/phpconf/inc/filter.inc
+++ b/phpconf/inc/filter.inc
@@ -491,6 +491,10 @@ EOD;
                }
        }
 
+       $out_kf = "";
+       if (isset($config['filter']['allowipsecfrags']))
+               $out_kf = "keep frags";
+
        /* XXX - the first section is only needed because ipf refuses to
                parse rules that have "flags S/SAFR" and proto "tcp/udp" set because
                UDP does not have flags, but we still want to offer the TCP/UDP protocol
@@ -508,7 +512,7 @@ block in $log quick proto tcp all
 block in $log quick on $lanif all head 100
 
 # let out anything from the firewall host itself and decrypted IPsec traffic
-pass out quick on $lanif all keep state
+pass out quick on $lanif all keep state $out_kf
 
 #---------------------------------------------------------------------------
 # group head 200 - WAN interface
@@ -516,7 +520,7 @@ pass out quick on $lanif all keep state
 block in $log quick on $wanif all head 200
 
 # let out anything from the firewall host itself and decrypted IPsec traffic
-pass out quick on $wanif all keep state
+pass out quick on $wanif all keep state $out_kf
 
 EOD;
 
@@ -533,7 +537,7 @@ EOD;
 block in $log quick on {$oc['if']} all head {$ingroup}
 
 # let out anything from the firewall host itself and decrypted IPsec traffic
-pass out quick on {$oc['if']} all keep state
+pass out quick on {$oc['if']} all keep state $out_kf
 
 EOD;
        

diff --git a/webgui/system_advanced.php b/webgui/system_advanced.php
index 8ccf9870211be6bab757ab3973c974b9cd0fde28..ffcaef5c033291da3706e54733e3a80e9a75be4e 100755 (executable)
--- a/webgui/system_advanced.php
+++ b/webgui/system_advanced.php
@@ -39,6 +39,7 @@ $pconfig['cert'] = base64_decode($config['system']['webgui']['certificate']);
 $pconfig['key'] = base64_decode($config['system']['webgui']['private-key']);
 $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['disablefirmwarecheck'] = isset($config['system']['disablefirmwarecheck']);
+$pconfig['allowipsecfrags'] = isset($config['filter']['allowipsecfrags']);
 $pconfig['expanddiags'] = isset($config['system']['webgui']['expanddiags']);
 if ($g['platform'] == "generic-pc")
        $pconfig['harddiskstandby'] = $config['system']['harddiskstandby'];
@@ -83,6 +84,7 @@ if ($_POST) {
                $config['system']['webgui']['private-key'] = base64_encode($_POST['key']);
                $config['system']['disableconsolemenu'] = $_POST['disableconsolemenu'] ? true : false;
                $config['system']['disablefirmwarecheck'] = $_POST['disablefirmwarecheck'] ? true : false;
+               $config['filter']['allowipsecfrags'] = $_POST['allowipsecfrags'] ? true : false;
                $config['system']['webgui']['expanddiags'] = $_POST['expanddiags'] ? true : false;
                if ($g['platform'] == "generic-pc") {
                        $oldharddiskstandby = $config['system']['harddiskstandby'];
@@ -237,6 +239,13 @@ function enable_change(enable_over) {
     This will cause m0n0wall not to check for newer firmware versions when the <a href="system_firmware.php">System: Firmware</a> page is viewed.</span></td>
                            </tr>
                                <tr>
+                  <td valign="top" class="vncell">IPsec fragmented packets</td>
+                  <td class="vtable">
+                    <input name="allowipsecfrags" type="checkbox" id="allowipsecfrags" value="yes" <?php if ($pconfig['allowipsecfrags']) echo "checked"; ?>>
+                    <strong>Allow fragmented IPsec packets</strong><span class="vexpl"><br>
+    This will cause m0n0wall to allow fragmented IP packets that are encapsulated in IPsec ESP packets.</span></td>
+                           </tr>
+                               <tr>
                   <td valign="top" class="vncell">TCP idle timeout </td>
                   <td class="vtable">                    <span class="vexpl">
                     <input name="tcpidletimeout" type="text" class="formfld" id="tcpidletimeout" size="8" value="<?=htmlspecialchars($pconfig['tcpidletimeout']);?>">