Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

config/firewall/firewall-lib.pl

@@ -391,8 +391,9 @@ sub get_address
 	# IPsec networks.
 	} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
 		my $network_address = &get_ipsec_net_ip($value, 11);
-		if ($network_address) {
+		my @nets = split(/\|/, $network_address);
-			push(@ret, [$network_address, ""]);
+		foreach my $net (@nets) {
+			push(@ret, [$net, ""]);
 		}
 
 	# The firewall's own IP addresses.

config/rootfiles/common/armv5tel/initscripts

@@ -62,7 +62,6 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
 etc/rc.d/init.d/network-trigger
-etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
 etc/rc.d/init.d/networking/blue
@@ -232,7 +231,6 @@ etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
 etc/rc.d/rcsysinit.d/S90network-trigger
-etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo
 #etc/sysconfig

config/rootfiles/common/i586/initscripts

@@ -64,7 +64,6 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
 etc/rc.d/init.d/network-trigger
-etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
 etc/rc.d/init.d/networking/blue
@@ -237,7 +236,6 @@ etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
 etc/rc.d/rcsysinit.d/S90network-trigger
-etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo
 #etc/sysconfig

config/rootfiles/common/udev

@@ -29,6 +29,7 @@ lib/udev
 #lib/udev/init-net-rules.sh
 #lib/udev/mtd_probe
 #lib/udev/network-hotplug-rename
+#lib/udev/network-hotplug-vlan
 #lib/udev/rule_generator.functions
 #lib/udev/rules.d
 #lib/udev/rules.d/25-alsa.rules

config/rootfiles/core/95/filelists/files

@@ -0,0 +1,8 @@
+etc/system-release
+etc/issue
+lib/udev/network-hotplug-vlan
+lib/udev/rules.d/60-net.rules
+srv/web/ipfire/cgi-bin/connections.cgi
+srv/web/ipfire/cgi-bin/vpnmain.cgi
+usr/lib/firewall/firewall-lib.pl
+var/ipfire/langs

config/rootfiles/core/95/update.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 3 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2015 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+# Remove old core updates from pakfire cache to save space...
+core=95
+for (( i=1; i<=$core; i++ ))
+do
+	rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+# Remove files
+rm -f /etc/rc.d/init.d/network-vlans
+rm -f /etc/rc.d/rcsysinit.d/S91network-vlans
+
+# Stop services
+
+# Extract files
+extract_files
+
+# Update Language cache
+/usr/local/bin/update-lang-cache
+
+# Start services
+
+# This update need a reboot...
+#touch /var/run/need_reboot
+
+# Finish
+/etc/init.d/fireinfo start
+sendprofile
+# Update grub config to display new core version
+if [ -e /boot/grub/grub.cfg ]; then
+	grub-mkconfig -o /boot/grub/grub.cfg
+fi
+sync
+
+# Don't report the exitcode last command
+exit 0

config/rootfiles/oldcore/94/exclude

@@ -0,0 +1,22 @@
+boot/config.txt
+etc/alternatives
+etc/collectd.custom
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+etc/localtime
+etc/shadow
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+etc/sudoers
+etc/sysconfig/firewall.local
+etc/sysconfig/rc.local
+etc/udev/rules.d/30-persistent-network.rules
+srv/web/ipfire/html/proxy.pac
+var/ipfire/ovpn
+var/lib/alternatives
+var/log/cache
+var/state/dhcp/dhcpd.leases
+var/updatecache

config/rootfiles/oldcore/94/meta

@@ -0,0 +1 @@
+DEPS=""

config/udev/60-net.rules

@@ -1,3 +1,7 @@
 # Call a script that checks for the right name of the new device.
 # If it matches the configuration it will be renamed accordingly.
 ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-rename", RESULT=="?*", NAME="$result"
+
+# Call a script that will create all virtual devices for a parent device
+# that has just come up.
+ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-vlan"

config/udev/network-hotplug-vlan

@@ -17,10 +17,12 @@
 # along with IPFire; if not, write to the Free Software                    #
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
 #                                                                          #
-# Copyright (C) 2012 IPFire Team <info@ipfire.org>                         #
+# Copyright (C) 2015 IPFire Team <info@ipfire.org>                         #
 #                                                                          #
 ############################################################################
 
+[ -n "${INTERFACE}" ] || exit 2
+
 CONFIG_FILE="/var/ipfire/ethernet/vlans"
 
 # Skip immediately if no configuration file has been found.
@@ -28,9 +30,6 @@ CONFIG_FILE="/var/ipfire/ethernet/vlans"
 
 eval $(/usr/local/bin/readhash ${CONFIG_FILE})
 
-# This is start or stop.
-action=${1}
-
 for interface in green0 red0 blue0 orange0; do
 	case "${interface}" in
 		green*)
@@ -55,12 +54,9 @@ for interface in green0 red0 blue0 orange0; do
 			;;
 	esac
 
-	case "${action}" in
+	# If the parent device does not match the interface that
-		start)
+	# has just come up, we will go on for the next one.
-			# If no parent device has been configured, we assume
+	[ "${PARENT_DEV}" = "${INTERFACE}" ] || continue
-			# that this interface is not set up for VLANs and
-			# silently go on.
-			[ -z "${PARENT_DEV}" ] && continue
 
 	# Check if the interface does already exists.
 	# If so, we skip creating it.
@@ -69,12 +65,6 @@ for interface in green0 red0 blue0 orange0; do
 		continue
 	fi
 
-			# Check if the parent interface exists.
-			if [ ! -d "/sys/class/net/${PARENT_DEV}" ]; then
-				echo "${interface}: Parent device is not set or does not exist: ${PARENT_DEV}" >&2
-				continue
-			fi
-
 	if [ -z "${VLAN_ID}" ]; then
 		echo "${interface}: You did not set the VLAN ID." >&2
 		continue
@@ -92,22 +82,6 @@ for interface in green0 red0 blue0 orange0; do
 
 	# Bring up the parent device.
 	ip link set ${PARENT_DEV} up
-			;;
-
-		stop)
-			if [ ! -e "/proc/net/vlan/${interface}" ]; then
-				echo "${interface} is not a VLAN interface. Skipping."
-				continue
-			fi
-
-			echo "Removing VLAN interface ${interface}..."
-			ip link set ${interface} down
-			ip link delete ${interface}
-			;;
-		
-		*)
-			echo "Invalid action: ${action}"
-			exit 1
-			;;
-	esac
 done
+
+exit 0

html/cgi-bin/connections.cgi

@@ -261,7 +261,10 @@ close(IPSEC);
 
 foreach my $line (@ipsec) {
 	my @vpn = split(',', $line);
-	my ($network, $mask) = split("/", $vpn[12]);
+
+	my @subnets = split('|', $vpn[12]);
+	for my $subnet (@subnets) {
+		my ($network, $mask) = split("/", $subnet);
 
 		if (!&General::validip($mask)) {
 			$mask = ipv4_cidr2msk($mask);
@@ -271,6 +274,7 @@ foreach my $line (@ipsec) {
 		push(@masklen, $mask);
 		push(@colour, ${Header::colourvpn});
 	}
+}
 
 if (-e "${General::swroot}/ovpn/n2nconf") {
 	open(OVPNN2N, "${General::swroot}/ovpn/ovpnconfig");

html/cgi-bin/vpnmain.cgi

@@ -40,8 +40,7 @@ undef (@dummy);
 ###
 ### Initialize variables
 ###
-my $sleepDelay = 4;	# after a call to ipsecctrl S or R, wait this delay (seconds) before reading status
+my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status (let the ipsec do its job)
-			# (let the ipsec do its job)
 my %netsettings=();
 our %cgiparams=();
 our %vpnsettings=();
@@ -138,8 +137,7 @@ sub vpnenabled {
 ### old version: maintain serial number to one, without explication.
 ### this: let the counter go, so that each cert is numbered.
 ###
-sub cleanssldatabase
+sub cleanssldatabase {
-{
 	if (open(FILE, ">${General::swroot}/certs/serial")) {
 		print FILE "01";
 		close FILE;
@@ -152,8 +150,7 @@ sub cleanssldatabase
 	unlink ("${General::swroot}/certs/serial.old");
 	unlink ("${General::swroot}/certs/01.pem");
 }
-sub newcleanssldatabase
+sub newcleanssldatabase {
-{
 	if (! -s "${General::swroot}/certs/serial" ) {
 		open(FILE, ">${General::swroot}/certs/serial");
 		print FILE "01";
@@ -235,7 +232,6 @@ sub makeconnname ($) {
 ###
 ###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and
 ###		the side is always defined as 'left'.
-###		configihash[14]: 'VHOST' is allowed
 ###
 
 sub writeipsecfiles {
@@ -285,17 +281,13 @@ sub writeipsecfiles {
 
 		print CONF "conn $lconfighash{$key}[1]\n";
 		print CONF "\tleft=$localside\n";
-	my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
+		print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
-	print CONF "\tleftsubnet=$cidr_net\n";
 		print CONF "\tleftfirewall=yes\n";
 		print CONF "\tlefthostaccess=yes\n";
-
 		print CONF "\tright=$lconfighash{$key}[10]\n";
+
 		if ($lconfighash{$key}[3] eq 'net') {
-	    my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
+			print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
-	    print CONF "\trightsubnet=$cidr_net\n";
-	} elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
-	    print CONF "\trightsubnet=vhost:%no,%priv\n";
 		}
 
 		# Local Cert and Remote Cert (unless auth is DN dn-auth)
@@ -352,6 +344,7 @@ sub writeipsecfiles {
 		if (! $lconfighash{$key}[29]) {
 			$lconfighash{$key}[29] = "ikev1";
 		}
+
 		print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
 
 		# Lifetimes
@@ -445,6 +438,7 @@ if ($ENV{"REMOTE_ADDR"} eq "") {
 ###
 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
 	&General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
+
 	unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
 	|| $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
 		$errormessage = $Lang::tr{'invalid input for hostname'};
@@ -512,8 +506,8 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg
 			<tr>
 				<td align='center'>
 					<input type='hidden' name='AREUSURE' value='yes' />
-		<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
+					<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:&nbsp;$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
-		$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
+				</td>
 			</tr><tr>
 				<td align='center'>
 					<input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
@@ -687,8 +681,7 @@ END
 			<input type='hidden' name='AREUSURE' value='yes' /></td>
 					</tr><tr>
 						<td align='center'>
-		    <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>
+							<b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>&nbsp;$Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}</td>
-		    $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}</td>
 					</tr><tr>
 						<td align='center'>
 							<input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
@@ -1268,10 +1261,12 @@ END
 		$cgiparams{'PSK'}				= $confighash{$cgiparams{'KEY'}}[5];
 		#$cgiparams{'free'}				= $confighash{$cgiparams{'KEY'}}[6];
 		$cgiparams{'LOCAL_ID'}			= $confighash{$cgiparams{'KEY'}}[7];
-	$cgiparams{'LOCAL_SUBNET'} 	= $confighash{$cgiparams{'KEY'}}[8];
+		my @local_subnets = split(",", $confighash{$cgiparams{'KEY'}}[8]);
+		$cgiparams{'LOCAL_SUBNET'} 		= join(/\|/, @local_subnets);
 		$cgiparams{'REMOTE_ID'}			= $confighash{$cgiparams{'KEY'}}[9];
 		$cgiparams{'REMOTE'}			= $confighash{$cgiparams{'KEY'}}[10];
-	$cgiparams{'REMOTE_SUBNET'} 	= $confighash{$cgiparams{'KEY'}}[11];
+		my @remote_subnets = split(",", $confighash{$cgiparams{'KEY'}}[11]);
+		$cgiparams{'REMOTE_SUBNET'}		= join(/\|/, @remote_subnets);
 		$cgiparams{'REMARK'}			= $confighash{$cgiparams{'KEY'}}[25];
 		$cgiparams{'DPD_ACTION'}		= $confighash{$cgiparams{'KEY'}}[27];
 		$cgiparams{'IKE_VERSION'}		= $confighash{$cgiparams{'KEY'}}[29];
@@ -1289,7 +1284,6 @@ END
 		$cgiparams{'COMPRESSION'}		= $confighash{$cgiparams{'KEY'}}[13];
 		$cgiparams{'ONLY_PROPOSED'}		= $confighash{$cgiparams{'KEY'}}[24];
 		$cgiparams{'PFS'}				= $confighash{$cgiparams{'KEY'}}[28];
-	$cgiparams{'VHOST'}            	= $confighash{$cgiparams{'KEY'}}[14];
 		$cgiparams{'DPD_TIMEOUT'}		= $confighash{$cgiparams{'KEY'}}[30];
 		$cgiparams{'DPD_DELAY'}			= $confighash{$cgiparams{'KEY'}}[31];
 		$cgiparams{'FORCE_MOBIKE'}		= $confighash{$cgiparams{'KEY'}}[32];
@@ -1352,10 +1346,13 @@ END
 			}
 		}
 
-        unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
+		my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'});
+		foreach my $subnet (@local_subnets) {
+			unless (&Network::check_subnet($subnet)) {
 				$errormessage = $Lang::tr{'local subnet is invalid'};
 				goto VPNCONF_ERROR;
 			}
+		}
 
 		# Allow only one roadwarrior/psk without remote IP-address
 		if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
@@ -1368,10 +1365,16 @@ END
 				}
 			}
 		}
-	if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
+
+		if ($cgiparams{'TYPE'} eq 'net') {
+			my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'});
+			foreach my $subnet (@remote_subnets) {
+				unless (&Network::check_subnet($subnet)) {
 					$errormessage = $Lang::tr{'remote subnet is invalid'};
 					goto VPNCONF_ERROR;
 				}
+			}
+		}
 
 		if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
 			$errormessage = $Lang::tr{'invalid input'};
@@ -1790,10 +1793,12 @@ END
 		$confighash{$key}[4] = 'cert';
 	}
 	if ($cgiparams{'TYPE'} eq 'net') {
-	    $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
+		my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'});
+		$confighash{$key}[11] = join('|', @remote_subnets);
 	}
 	$confighash{$key}[7] = $cgiparams{'LOCAL_ID'};
-	$confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
+	my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'});
+	$confighash{$key}[8] = join('|', @local_subnets);
 	$confighash{$key}[9] = $cgiparams{'REMOTE_ID'};
 	$confighash{$key}[10] = $cgiparams{'REMOTE'};
 	$confighash{$key}[25] = $cgiparams{'REMARK'};
@@ -1801,7 +1806,7 @@ END
 	$confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
 	$confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
 
-	#dont forget advanced value
+	# don't forget advanced value
 	$confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
 	$confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'};
 	$confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'};
@@ -1814,7 +1819,6 @@ END
 	$confighash{$key}[13] = $cgiparams{'COMPRESSION'};
 	$confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
 	$confighash{$key}[28] = $cgiparams{'PFS'};
-	$confighash{$key}[14] = $cgiparams{'VHOST'};
 	$confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
 	$confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
 	$confighash{$key}[32] = $cgiparams{'FORCE_MOBIKE'};
@@ -1891,7 +1895,6 @@ END
 	$cgiparams{'COMPRESSION'}		= 'on'; #[13];
 	$cgiparams{'ONLY_PROPOSED'}		= 'off'; #[24];
 	$cgiparams{'PFS'}				= 'on'; #[28];
-	$cgiparams{'VHOST'}          = 'on'; 		#[14];
 }
 
 VPNCONF_ERROR:
@@ -1943,7 +1946,6 @@ END
 	<input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
 	<input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
 	<input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
-	<input type='hidden' name='VHOST' value='$cgiparams{'VHOST'}' />
 	<input type='hidden' name='DPD_ACTION' value='$cgiparams{'DPD_ACTION'}' />
 	<input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
 	<input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
@@ -1978,6 +1980,12 @@ EOF
 		$blob = "<img src='/blob.gif' alt='*' />";
 	};
 
+	my @local_subnets = split(/\|/, $cgiparams{'LOCAL_SUBNET'});
+	my $local_subnets = join(",", @local_subnets);
+
+	my @remote_subnets = split(/\|/, $cgiparams{'REMOTE_SUBNET'});
+	my $remote_subnets = join(",", @remote_subnets);
+
 	print <<END
 	<tr>
 		<td width='20%'>$Lang::tr{'enabled'}</td>
@@ -1986,7 +1994,7 @@ EOF
 		</td>
 		<td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
 		<td width='30%'>
-	        <input type='text' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' size="25" />
+			<input type='text' name='LOCAL_SUBNET' value='$local_subnets' />
 		</td>
 	</tr>
 	<tr>
@@ -1996,7 +2004,7 @@ EOF
 		</td>
 		<td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'remote subnet'}&nbsp;$blob</td>
 		<td width='30%'>
-	        <input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size="25" />
+			<input $disabled type='text' name='REMOTE_SUBNET' value='$remote_subnets' />
 		</td>
 	</tr>
 	<tr>
@@ -2130,11 +2138,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 	}
 
 	if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
-	# I didn't read any incompatibilities here....
-	#if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
-	#    $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
-	#    goto ADVANCED_ERROR;
-	#}
 		my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
 		if ($#temp < 0) {
 			$errormessage = $Lang::tr{'invalid input'};
@@ -2218,13 +2221,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 			goto ADVANCED_ERROR;
 		}
 
-	if (
+		if (($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
-	    ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
 			($cgiparams{'FORCE_MOBIKE'} !~ /^(|on|off)$/) ||
 			($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
-	    ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
+			($cgiparams{'PFS'} !~ /^(|on|off)$/)) {
-	    ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
-	){
 			$errormessage = $Lang::tr{'invalid input'};
 			goto ADVANCED_ERROR;
 		}
@@ -2252,7 +2252,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 		$confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
 		$confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
 		$confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
-	$confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
 		$confighash{$cgiparams{'KEY'}}[27] = $cgiparams{'DPD_ACTION'};
 		$confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
 		$confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
@@ -2280,7 +2279,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 		$cgiparams{'COMPRESSION'}		= $confighash{$cgiparams{'KEY'}}[13];
 		$cgiparams{'ONLY_PROPOSED'}		= $confighash{$cgiparams{'KEY'}}[24];
 		$cgiparams{'PFS'}				= $confighash{$cgiparams{'KEY'}}[28];
-	$cgiparams{'VHOST'}          = $confighash{$cgiparams{'KEY'}}[14];
 		$cgiparams{'DPD_ACTION'}		= $confighash{$cgiparams{'KEY'}}[27];
 		$cgiparams{'DPD_TIMEOUT'}		= $confighash{$cgiparams{'KEY'}}[30];
 		$cgiparams{'DPD_DELAY'}			= $confighash{$cgiparams{'KEY'}}[31];
@@ -2293,10 +2291,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 		if (!$cgiparams{'DPD_TIMEOUT'}) {
 			$cgiparams{'DPD_TIMEOUT'} = 120;
 		}
-
-	if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
-	    $cgiparams{'VHOST'}            = 'off';
-	}
 	}
 
 	ADVANCED_ERROR:
@@ -2382,7 +2376,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 	$checked{'FORCE_MOBIKE'} = $cgiparams{'FORCE_MOBIKE'} eq 'on' ? "checked='checked'" : '' ;
 	$checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
 	$checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
-    $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
 
 	$selected{'IKE_VERSION'}{'ikev1'} = '';
 	$selected{'IKE_VERSION'}{'ikev2'} = '';
@@ -2633,15 +2626,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 	</tr>
 EOF
 ;
-    if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
-	print "<tr><td><input type='hidden' name='VHOST' value='off' /></td></tr>";
-    } elsif ($confighash{$cgiparams{'KEY'}}[10]) {
-	print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} disabled='disabled' />";
-	print " $Lang::tr{'vpn vhost'}</label></td></tr>";
-    } else {
-	print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} />";
-	print " $Lang::tr{'vpn vhost'}</label></td></tr>";
-    }
 
 	print <<EOF;
 	<tr>
@@ -2793,8 +2777,7 @@ END
 	my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
 	foreach my $line (@status) {
 		if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
-	       ($line =~ /$confighash{$key}[1]\{.*INSTALLED/))
+		($line =~ /$confighash{$key}[1]\{.*INSTALLED/)) {
-	    {
 			$col1="bgcolor='${Header::colourgreen}'";
 			$active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
 		}
@@ -2825,7 +2808,8 @@ END
 		</form>
 		</td>
 END
-	; } else {
+;
+	} else {
 		print "<td width='2%' $col>&nbsp;</td>";
 	}
 	if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") {
@@ -2838,7 +2822,8 @@ END
 		</form>
 	</td>
 END
-	; } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
+;
+	} elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
 		print <<END
 		<td align='center' $col>
 		<form method='post' action='$ENV{'SCRIPT_NAME'}'>
@@ -2848,7 +2833,8 @@ END
 		</form>
 	</td>
 END
-	; } else {
+;
+	} else {
 		print "<td width='2%' $col>&nbsp;</td>";
 	}
 	print <<END
@@ -3132,3 +3118,16 @@ sub make_algos($$$$$) {
 
 	return &array_unique(\@algos);
 }
+
+sub make_subnets($) {
+	my $subnets = shift;
+
+	my @nets = split(/\|/, $subnets);
+	my @cidr_nets = ();
+	foreach my $net (@nets) {
+		my $cidr_net = &General::ipcidr($net);
+		push(@cidr_nets, $cidr_net);
+	}
+
+	return join(",", @cidr_nets);
+}

langs/de/cgi-bin/de.pl

@@ -2620,7 +2620,6 @@
 'vpn statistic n2n' => 'OpenVPN-Netz-zu-Netz-Statistik',
 'vpn statistic rw' => 'OpenVPN-Roadwarrior-Statistik',
 'vpn subjectaltname' => 'Subjekt Alternativer Name',
-'vpn vhost' => 'Roadwarrior virtuelle IP (manchmal auch Inner-IP genannt)',
 'vpn watch' => 'Netz-zu-Netz VPN neu starten, wenn sich Remote-IP ändert (DynDNS).',
 'waiting to synchronize clock' => 'Bitte warten, die Uhr wird synchronisiert',
 'warn when traffic reaches' => 'Warnen wenn Traffic x % erreicht',

langs/en/cgi-bin/en.pl

@@ -2664,7 +2664,6 @@
 'vpn statistic n2n' => 'OpenVPN Net-to-Net Statistics',
 'vpn statistic rw' => 'OpenVPN Roadwarrior Statistics',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',

langs/es/cgi-bin/es.pl

@@ -2107,7 +2107,6 @@
 'vpn red name' => 'Dirección IP pública o FQDN para la interfaz RED o<%defaultroute>',
 'vpn remote id' => 'ID Remoto',
 'vpn subjectaltname' => 'Nombre alternativo en Asunto',
-'vpn vhost' => 'IP virtual Roadwarris (también referida como ip-interior)',
 'vpn watch' => 'Reinciar vpn net-to-net cuando la ip remota cambie (dyndns)',
 'waiting to synchronize clock' => 'Esperando sincronización con el reloj',
 'warn when traffic reaches' => 'Advertir cuando el tráfico alcance x %',

langs/fr/cgi-bin/fr.pl

@@ -2111,7 +2111,6 @@
 'vpn red name' => 'IP publique ou nom de domaine complet pour l\'interface ROUGE ou <%defaultroute>',
 'vpn remote id' => 'ID Distant',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'IP Virtuelle Roadwarrior (parfois appelée Inner-IP)',
 'vpn watch' => 'Redémarrer net-to-net VPN si IP hôte distant change (dyndns).',
 'waiting to synchronize clock' => 'Attendre la synchronisation de l\'horloge',
 'warn when traffic reaches' => 'Avertir lorsque le trafic atteint x %',

langs/it/cgi-bin/it.pl

@@ -2586,7 +2586,6 @@
 'vpn red name' => 'IP pubblico o il nome di dominio completo per l\'interfaccia RED o <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',

langs/nl/cgi-bin/nl.pl

@@ -2529,7 +2529,6 @@
 'vpn red name' => 'Publiek IP of FQDN voor RODE interface of <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Onderwerp Alt Naam',
-'vpn vhost' => 'Roadwarrior virtual IP (Ook wel Inner-IP genoemd)',
 'vpn watch' => 'Herstart net-to-net vpn wanneer remote peer IP verandert (dyndns).',
 'waiting to synchronize clock' => 'Wachten op synchronisatie van klok',
 'warn when traffic reaches' => 'Waarschuw wanneer verkeer x % bereikt',

langs/pl/cgi-bin/pl.pl

@@ -2120,7 +2120,6 @@
 'vpn red name' => 'Publiczne IP lub FQDN interfejsu RED lub <%defaultroute>',
 'vpn remote id' => 'Zdalne ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Uruchom ponownie vpn net-to-net kiedy zmieni się IP zdalnej końcówki (dyndns).',
 'waiting to synchronize clock' => 'Oczekiwanie na synchronizację zegara',
 'warn when traffic reaches' => 'Ostrzegaj kiedy ruch osiągnie x %',

langs/ru/cgi-bin/ru.pl

@@ -2115,7 +2115,6 @@
 'vpn red name' => 'Внешний IP или FQDN для RED интерфейса или <%defaultroute>',
 'vpn remote id' => 'Удалённый ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Перезапускать net-to-net vpn когда удалённый IP меняется (dyndns).',
 'waiting to synchronize clock' => 'Ожидается синхронизация',
 'warn when traffic reaches' => 'Предупреждать когда трафик возрастает до x %',

langs/tr/cgi-bin/tr.pl

@@ -2609,7 +2609,6 @@
 'vpn red name' => 'KIRMIZI arabirim veya <%defaultroute> için gerçek IP veya FQDN',
 'vpn remote id' => 'Uzak kimlik (ID)',
 'vpn subjectaltname' => 'Alternatif konu adı',
-'vpn vhost' => 'Roadwarrior sanal IP (bazen iç IP olarakta adlandırılır)',
 'vpn watch' => 'Karşı eş IP değiştirdiğinde (dyndns) ağdan-ağa VPN bağlantısını yeniden başlat. Bu DPD ye yardımcı olur.',
 'waiting to synchronize clock' => 'Saat eşleştirmesi bekleniyor',
 'warn when traffic reaches' => 'Trafik x % değere ulaştığında uyar',

lfs/initscripts

@@ -177,7 +177,6 @@ $(TARGET) :
 	ln -sf ../init.d/localnet    /etc/rc.d/rcsysinit.d/S80localnet
 	ln -sf ../init.d/firewall    /etc/rc.d/rcsysinit.d/S85firewall
 	ln -sf ../init.d/network-trigger /etc/rc.d/rcsysinit.d/S90network-trigger
-	ln -sf ../init.d/network-vlans /etc/rc.d/rcsysinit.d/S91network-vlans
 	ln -sf ../init.d/rngd        /etc/rc.d/rcsysinit.d/S92rngd
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc0.d/K82wlanclient
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc3.d/S19wlanclient

lfs/udev

@@ -107,6 +107,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	# Install network rules.
 	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-rename \
 		/lib/udev/network-hotplug-rename
+	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-vlan \
+		/lib/udev/network-hotplug-vlan
 	install -v -m 644 $(DIR_SRC)/config/udev/60-net.rules \
 		/lib/udev/rules.d
 

make.sh

@@ -25,7 +25,7 @@
 NAME="IPFire"							# Software name
 SNAME="ipfire"							# Short name
 VERSION="2.17"							# Version number
-CORE="94"							# Core Level (Filename)
+CORE="95"							# Core Level (Filename)
 PAKFIRE_CORE="94"						# Core Level (PAKFIRE)
 GIT_BRANCH=`git rev-parse --abbrev-ref HEAD`			# Git Branch
 SLOGAN="www.ipfire.org"						# Software slogan