diff --git a/src/etc/config.xml.sample b/src/etc/config.xml.sample
index 26d2e2606..619150ab1 100644
--- a/src/etc/config.xml.sample
+++ b/src/etc/config.xml.sample
@@ -256,7 +256,6 @@
aesni11
- 1admins
diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc
index 3daea58c3..e043946cf 100644
--- a/src/etc/inc/filter.inc
+++ b/src/etc/inc/filter.inc
@@ -123,29 +123,6 @@ function filter_configure()
}
}
-function filter_should_trigger_kill_states()
-{
- global $config;
- if (empty($config['system']['kill_states'])) {
- $a_gateways = return_gateways_status();
- $ifdetails = legacy_interfaces_details();
- $any_gateway_down = false;
- foreach ((new \OPNsense\Routing\Gateways($ifdetails))->gatewaysIndexedByName(false, true) as $gateway) {
- if (empty($gateway['monitor']) || empty($a_gateways[$gateway['name']])) {
- continue;
- } elseif (!is_ipaddr($gateway['monitor']) || strstr($gateway['monitor'], '127.0.0.')) {
- continue;
- }
- if (stristr($a_gateways[$gateway['name']]['status'], 'down')) {
- $any_gateway_down = true;
- break;
- }
- }
- return $any_gateway_down;
- }
- return false;
-}
-
/**
* sync interface groups, but leave the ones not managed by us intact.
*/
@@ -207,7 +184,7 @@ function is_interface_group($if)
return false;
}
-function filter_configure_sync($verbose = false, $flush_states = false, $load_aliases = true)
+function filter_configure_sync($verbose = false, $load_aliases = true)
{
global $config;
$sched_kill_states = array(); // kill states for schedules
@@ -562,15 +539,6 @@ function filter_configure_sync($verbose = false, $flush_states = false, $load_al
flush();
}
- if ($flush_states) {
- mwexec('/sbin/pfctl -Fs');
- }
-
- if ($verbose) {
- echo '.';
- flush();
- }
-
if ($load_aliases) {
configd_run('template reload OPNsense/Filter');
configd_run('filter refresh_aliases', true);
diff --git a/src/etc/rc.filter_configure b/src/etc/rc.filter_configure
index 009e16daa..8dcc3df83 100755
--- a/src/etc/rc.filter_configure
+++ b/src/etc/rc.filter_configure
@@ -33,20 +33,6 @@ require_once("filter.inc");
require_once("system.inc");
require_once("interfaces.inc");
-$event_arg = count($argv) >= 1 ? $argv[1] : "";
+$event_arg = count($argv) >= 1 ? $argv[1] : '';
-if ($event_arg == 'skip_alias' ) {
- filter_configure_sync(true, false, false);
-} else {
- if ($event_arg == 'gateway' && filter_should_trigger_kill_states()) {
- /**
- * XXX: When "Kill states" on gateway monitoring is used, we should reset states after this event.
- * Originally filter_configure_sync() reset states after each event. Although the feature isn't great
- * in terms of what it does (not really fine grained, just kill all), for historic reasons we probably should
- * leave it in.
- */
- filter_configure_sync(true, true);
- } else {
- filter_configure_sync(true);
- }
-}
+filter_configure_sync(true, $event_arg != 'skip_alias');
diff --git a/src/etc/rc.newwanip b/src/etc/rc.newwanip
index 56f405e95..08080837d 100755
--- a/src/etc/rc.newwanip
+++ b/src/etc/rc.newwanip
@@ -152,10 +152,13 @@ if (!is_ipaddr($cacheip) || $ip != $cacheip || !is_ipaddr($configip)) {
system_routing_configure(false, $interface);
plugins_configure('monitor');
- filter_configure_sync(false, isset($config['system']['ip_change_kill_states']));
- if (is_ipaddr($cacheip) && $ip != $cacheip && !isset($config['system']['ip_change_kill_states'])) {
+ filter_configure_sync();
+ if (isset($config['system']['ip_change_kill_states'])) {
+ log_error('IP address renew, killing all previous states');
+ mwexec('/sbin/pfctl -Fs');
+ } else if (is_ipaddr($cacheip) && $ip != $cacheip) {
log_error("IP address change detected, killing states of old ip $cacheip");
- mwexec('/sbin/pfctl -k ' . $cacheip);
+ mwexecf('/sbin/pfctl -k %s', $cacheip);
}
if (is_ipaddr($ip)) {
diff --git a/src/www/system_advanced_firewall.php b/src/www/system_advanced_firewall.php
index f6fe41fb1..cfac87fb3 100644
--- a/src/www/system_advanced_firewall.php
+++ b/src/www/system_advanced_firewall.php
@@ -51,7 +51,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
$pconfig['disablereplyto'] = isset($config['system']['disablereplyto']);
$pconfig['bogonsinterval'] = !empty($config['system']['bogons']['interval']) ? $config['system']['bogons']['interval'] : null;
$pconfig['schedule_states'] = isset($config['system']['schedule_states']);
- $pconfig['kill_states'] = !empty($config['system']['kill_states']);
$pconfig['skip_rules_gw_down'] = isset($config['system']['skip_rules_gw_down']);
$pconfig['lb_use_sticky'] = isset($config['system']['lb_use_sticky']);
$pconfig['pf_share_forward'] = isset($config['system']['pf_share_forward']);
@@ -202,12 +201,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
unset($config['system']['schedule_states']);
}
- if (!empty($pconfig['kill_states'])) {
- $config['system']['kill_states'] = true;
- } elseif (isset($config['system']['kill_states'])) {
- unset($config['system']['kill_states']);
- }
-
if (!empty($pconfig['skip_rules_gw_down'])) {
$config['system']['skip_rules_gw_down'] = true;
} elseif (isset($config['system']['skip_rules_gw_down'])) {
@@ -348,16 +341,6 @@ include("head.inc");
= gettext('Gateway Monitoring') ?>
-
-
=gettext("Kill states");?>
-
- />
- =gettext("Disable State Killing on Gateway Failure"); ?>
-
- =gettext("The monitoring process will flush states for a gateway that goes down if this box is not checked. Check this box to disable this behavior."); ?>
-