Merge commit 'mainline/master'

1 files changed, 656 insertions, 0 deletions

diff --git a/config/havp/havp.inc b/config/havp/havp.inc
new file mode 100644
index 00000000..85427eb2
--- /dev/null
+++ b/config/havp/havp.inc
@@ -0,0 +1,656 @@
+<?php
+/*
+        havp.inc
+        Part of pfSense package
+        Copyright (C) 2008 Serg Dvorianceev
+        All rights reserved.
+
+        Redistribution and use in source and binary forms, with or without
+        modification, are permitted provided that the following conditions are met:
+
+        1. Redistributions of source code must retain the above copyright notice,
+           this list of conditions and the following disclaimer.
+
+        2. Redistributions in binary form must reproduce the above copyright
+           notice, this list of conditions and the following disclaimer in the
+           documentation and/or other materials provided with the distribution.
+
+        THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+        INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+        AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+        AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+        OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+        SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+        INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+        CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+        ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+        POSSIBILITY OF SUCH DAMAGE.
+*/
+
+/* ! ÍÀVP v.0.88 !*/
+
+require_once('globals.inc');
+require_once('config.inc');
+require_once('util.inc');
+require_once('pfsense-utils.inc');
+require_once('pkg-utils.inc');
+require_once('filter.inc');
+require_once('service-utils.inc');
+
+# defines
+define('HV_USER',          'havp');
+define('HV_AV_USER',       'havp');
+
+define('HV_WORKDIR',       '/usr/local/etc/havp');
+define('HV_CONFIGFILE',    '/havp.config');
+define('HV_WHITELISTFILE', '/whitelist');
+define('HV_BLACKLISTFILE', '/blacklist');
+
+define('HV_PIDFILE',       '/var/run/havp.pid');
+define('HV_LOGDIR',        '/var/log/havp');
+define('HV_AVLOGDIR',      '/var/log/clamav');
+define('HV_ACCESSLOG',     '/access.log');
+define('HV_LOG',           '/havp.log');
+define('HV_TEMPDIR',       '/var/tmp');
+define('HV_HAVPTEMPDIR',   '/var/tmp/havp');
+define('HV_SCANTEMPFILE',  '/havp/havp-XXXXXX');
+define('HV_DEFAULTPORT',   '3125');
+define('HV_DEFAULTADDR',   '127.0.0.1');
+define('HV_TEMPLATEPATH',  '/usr/local/share/examples/havp/templates');
+define('HV_CRONNAME_AVUPD','havp_av_update');
+define('HV_CRONCMD_AVUPD', '/usr/local/etc/rc.d/clamav-freshclam start');
+define('HV_CRONKEY_AVUPD', '/clamav-freshclam');
+define('HV_AVUPD_SCRIPT',  '/usr/local/etc/rc.d/havp_avupdate.sh');
+define('HV_FRESHCLAM_CONFIGFILE', '/usr/local/etc/freshclam.conf');
+
+# XML fields
+define('XML_HAVPENABLE',        'enable');
+define('XML_HAVPLANG',          'havplang');
+define('XML_PARENTPROXY',       'parentproxy');
+define('XML_WHITELIST',         'whitelist');
+define('XML_BLACKLIST',         'blacklist');
+define('XML_PROXYIFACE',        'proxyiface');
+define('XML_PROXYPORT',         'proxyport');
+define('XML_USEEXTIFACE',       'listenextinterface');
+define('XML_XFORWARDEDFOR',     'xforwardedfor');
+define('XML_FAILSCANERROR',     'failscanerror');
+define('XML_LANGUAGE',          'lang');
+define('XML_SCANIMG',           'scanimg');
+define('XML_SCANARC',           'scanarc');
+define('XML_SCANMAXSIZE',       'scanmaxsize');
+define('XML_MAXDOWNLOADSIZE',   'maxdownloadsize');
+define('XML_SYSLOG',            'syslog');
+define('XML_HAVPUPDATE',        'havpavupdate');
+# define('','');
+
+function havp_install(){
+    havp_check_system();
+}
+
+function havp_deinstall() {
+    havp_setup_cron(HV_CRONNAME_AVUPD,"", "");
+    mwexec("rm -rf " . HV_AVUPD_SCRIPT);
+    mwexec("rm -rf " . HV_PIDFILE);
+}
+
+function havp_resync() {
+    global $config;
+    $pfconf = $config['installedpackages']['havp']['config'][0];
+
+    havp_check_system();
+
+    # whitelist and blacklist
+    # also white-listed:
+    $whitelist = havp_whitelist_def() . "\n" . str_replace(" ", "\n", base64_decode($pfconf[XML_WHITELIST]));
+    $blacklist = str_replace(" ", "\n", base64_decode($pfconf[XML_BLACKLIST]));
+    # stupid havp parser - error on 0x0D:
+    $whitelist = str_replace("\r", "", $whitelist);
+    $blacklist = str_replace("\r", "", $blacklist);
+    file_put_contents(HV_WORKDIR . HV_WHITELISTFILE, $whitelist);
+    file_put_contents(HV_WORKDIR . HV_BLACKLISTFILE, $blacklist);
+
+    # config havp
+    file_put_contents(HV_WORKDIR . HV_CONFIGFILE, havp_config());
+    set_file_access(HV_WORKDIR, HV_USER, '0755');
+
+    # config freshclam
+    file_put_contents(HV_FRESHCLAM_CONFIGFILE, havp_config_freshclam());
+    set_file_access(HV_FRESHCLAM_CONFIGFILE, HV_AV_USER, '0664');
+
+    # cron task
+    $on = false;
+    $opt = array("0", "*", "*", "*", "*", "root", "/usr/bin/nice -n20 " . HV_AVUPD_SCRIPT);
+    switch($pfconf['havpavupdate']) {
+        case 'none':   $on = false; break;
+        case 'hv_01h': $on = true;  $opt[1]= "*/1";  break;
+        case 'hv_02h': $on = true;  $opt[1]= "*/2";  break;
+        case 'hv_03h': $on = true;  $opt[1]= "*/3";  break;
+        case 'hv_04h': $on = true;  $opt[1]= "*/4";  break;
+        case 'hv_06h': $on = true;  $opt[1]= "*/6";  break;
+        case 'hv_08h': $on = true;  $opt[1]= "*/8";  break;
+        case 'hv_12h': $on = true;  $opt[1]= "*/12"; break;
+        case 'hv_24h': $on = true;  $opt[1]= "0";    break;
+        default:       break;
+    }
+    havp_setup_cron(HV_CRONNAME_AVUPD, $opt, $on);
+
+    mwexec("killall havp");
+    mwexec("killall havp");
+    mwexec("/usr/local/sbin/havp -c /usr/local/etc/havp" . HV_CONFIGFILE);
+
+mountRAMdisk();
+
+}
+
+function havp_check_system() {
+
+    # workdir permissions
+    set_file_access(HV_WORKDIR, HV_USER, '');
+
+    # tempdir
+    if (!file_exists(HV_HAVPTEMPDIR)) mwexec("mkdir -p " . HV_HAVPTEMPDIR);
+    set_file_access(HV_HAVPTEMPDIR, HV_USER, '');
+
+    # template permissions
+    set_file_access(HV_TEMPLATEPATH, HV_USER, '');
+
+    # log files exists ?
+    if (!file_exists(HV_LOGDIR . HV_ACCESSLOG)) file_put_contents(HV_LOGDIR . HV_ACCESSLOG, '');
+    if (!file_exists(HV_LOGDIR . HV_LOG)) file_put_contents(HV_LOGDIR . HV_LOG, '');
+    # log dir permissions
+    set_file_access(HV_LOGDIR, HV_USER, '0764');
+
+    # pid file
+    if (!file_exists(HV_PIDFILE)) file_put_contents(HV_PIDFILE, '');
+    set_file_access(HV_PIDFILE, HV_USER, '0664');
+
+    # freshclam config permissions
+    if (!file_exists(HV_FRESHCLAM_CONFIGFILE)) file_put_contents(HV_FRESHCLAM_CONFIGFILE, '');
+    set_file_access(HV_FRESHCLAM_CONFIGFILE, HV_AV_USER, '0664');
+
+    # log files exists ?
+    if (!file_exists(HV_AVLOGDIR . '/clamd.log')) file_put_contents(HV_AVLOGDIR . '/clamd.log', '');
+    if (!file_exists(HV_AVLOGDIR . '/freshclam.log')) file_put_contents(HV_AVLOGDIR . '/freshclam.log', '');
+    # log dir permissions
+    set_file_access(HV_AVLOGDIR, HV_USER, '0777');
+
+    # checking dir's and permissions
+    # "DatabaseDirectory /var/db/clamav";
+    # "UpdateLogFile /var/log/clamav/freshclam.log";
+
+    # AV update script
+    file_put_contents(HV_AVUPD_SCRIPT, havp_AVupdate_script());
+    set_file_access(HV_AVUPD_SCRIPT, HV_AV_USER, '0755');
+}
+
+function havp_validate_settings($post, $input_errors) {
+    $submit = isset($_GET['submit']) ? $_GET['submit'] : $_POST['submit'];
+
+    # manual update AV database
+    if ($submit === 'Update_AV')
+        havp_update_AV();
+    else {
+        $prxport = trim($post[XML_PROXYPORT]);
+        if (!empty($prxport) && !is_port($prxport))
+            $input_errors[] = 'You must enter a valid port number in the \'Proxy port\' field';
+
+        # check whitelist
+        $lst = explode("\n", str_replace(" ", "\n", $post[XML_WHITELIST]));
+        foreach ($lst as $dm) {
+            $dm = trim($dm);
+            if ($dm && check_bw_domain($dm) === false)
+                $input_errors[] = "Invalid whitelist element '$dm'.";
+        }
+
+        # check blacklist
+        $lst = explode("\n", str_replace(" ", "\n", $post[XML_BLACKLIST]));
+        foreach ($lst as $dm) {
+            $dm = trim($dm);
+            if ($dm && check_bw_domain($dm) === false)
+                $input_errors[] = "Invalid blacklist element '$dm'.";
+        }
+    }
+
+}
+
+function havp_config() {
+    global $config;
+    $pfconf = $config['installedpackages']['havp']['config'][0];
+    $conf = array();
+
+    $conf[] =
+"# ============================================================
+# HAVP config file
+# This file generated automaticly with HAVP configurator (part of pfSense)
+# (C)2008 Serg Dvoriancev
+# email: dv_serg@mail.ru
+# ============================================================
+";
+
+    $conf[] = "USER "  . HV_USER;
+    $conf[] = "GROUP " . HV_USER;
+    $conf[] = "DAEMON true";
+    $conf[] = "PIDFILE " . HV_PIDFILE;
+    $conf[] = "\n# For single user home use, 8 should be minimum.";
+    $conf[] = "# For 500 users corporate use, start at 40.";
+    $conf[] = "SERVERNUMBER 3";
+    $conf[] = "MAXSERVERS 100";
+
+    # log
+    $conf[] = "\n# log ";
+    $conf[] = "ACCESSLOG " . HV_LOGDIR . HV_ACCESSLOG;
+    $conf[] = "ERRORLOG "  . HV_LOGDIR . HV_LOG;
+    # syslog
+    $syslog = ($pfconf[XML_SYSLOG] === 'on') ? 'true' : 'false';
+    $conf[] = "\n# syslog";
+    $conf[] = "USESYSLOG $syslog";  # use syslog?
+    $conf[] = "SYSLOGNAME havp";
+    $conf[] = "SYSLOGFACILITY daemon";
+    $conf[] = "SYSLOGLEVEL info";
+    #
+    $conf[] = "\n# Level of HAVP logging\n#  0 = Only serious errors and information\n#  1 = Less interesting information is included";
+    $conf[] = "LOG_OKS true";       # true - for debug, false - for work
+    $conf[] = "LOGLEVEL 1";         # 0 - work level, 1 - debug level
+
+    # temp
+    $conf[] = "\n# temp ";
+    $conf[] = "SCANTEMPFILE " . HV_TEMPDIR . HV_SCANTEMPFILE;
+    $conf[] = "TEMPDIR " . HV_TEMPDIR;
+
+    $conf[] = "\n#";
+    $conf[] = "DBRELOAD 180";
+    $conf[] = "TRANSPARENT false";
+    $conf[] = "FORWARDED_IP false";
+
+    # X-FORWARD
+    $conf[] = "\n# X-FORWARD: proxy can include system's IP address or name in the HTTP requests it forwards";
+    $v = ($pfconf[XML_XFORWARDEDFOR] === 'on') ? "true" : "false";
+    $conf[] = "X_FORWARDED_FOR $v";
+
+    # parent proxy = [proxy:port]
+    if (!empty($pfconf[XML_PARENTPROXY])) {
+        $prxy = str_replace(" ", ":", $pfconf[XML_PARENTPROXY]);
+        $prxy = explode(":", $prxy);
+        $conf[] = "\n# parent proxy ";
+        $conf[] = "PARENTPROXY {$prxy[0]}";
+        $conf[] = "PARENTPORT {$prxy[1]}";
+    }
+
+    # proxy listening on
+    $conf[] = "\n# havp is listening on ";
+    $pxyport = HV_DEFAULTPORT;
+    $pxyaddr = HV_DEFAULTADDR;
+    if (!empty($pfconf[XML_PROXYPORT])) $pxyport = $pfconf[XML_PROXYPORT];
+    if ($pfconf[XML_USEEXTIFACE] === 'on' && !empty($pfconf[XML_PROXYIFACE])) {
+        $pxyaddr = get_real_interface_address($pfconf[XML_PROXYIFACE]);
+        $pxyaddr = $pxyaddr[0];
+    }
+    $conf[] = "PORT $pxyport";
+    $conf[] = "BIND_ADDRESS $pxyaddr";
+
+    # template files language
+    $conf[] = "\n# Path to template files ";
+    if (!empty($pfconf[XML_LANGUAGE]))
+         $conf[] = "TEMPLATEPATH " . HV_TEMPLATEPATH . "/" . trim($pfconf[XML_LANGUAGE]);
+    else $conf[] = "TEMPLATEPATH " . HV_TEMPLATEPATH . "/en";
+
+    $conf[] = "\n# whitelist and blacklist";
+    $conf[] = "WHITELISTFIRST true";
+    $conf[] = "WHITELIST /usr/local/etc/havp" . HV_WHITELISTFILE;
+    $conf[] = "BLACKLIST /usr/local/etc/havp" . HV_BLACKLISTFILE;
+
+    # failscanerror - pass/block files if scanner error
+    $conf[] = "\n# block file if error scanning";
+    $v = ($pfconf[XML_FAILSCANERROR] === 'on') ? "true" : "false";
+    $conf[] = "FAILSCANERROR $v";
+
+    $conf[] = "\n# scanner ";
+    $conf[] = "SCANNERTIMEOUT 10";
+    $conf[] = "RANGE false";
+
+    $conf[] = "\n# stream";
+    $conf[] = "STREAMUSERAGENT Player Winamp iTunes QuickTime Audio RMA/ MAD/ Foobar2000 XMMS";
+    $conf[] = "STREAMSCANSIZE 20000";
+
+    # scan image
+    $v = ($pfconf[XML_SCANIMG] === 'on') ? "true" : "false";
+    $conf[] = "SCANIMAGES $v";
+
+    $val = (!empty($pfconf[XML_SCANMAXSIZE]) && is_numeric($pfconf[XML_SCANMAXSIZE])) ? $pfconf[XML_SCANMAXSIZE] : 0;
+    $conf[] = "MAXSCANSIZE $v";
+
+    $conf[] = "# KEEPBACKBUFFER 200000";
+    $conf[] = "# KEEPBACKTIME 5";
+
+    $conf[] = "# After Trickling Time (seconds), some bytes are sent to browser to keep the connection alive";
+    $conf[] = "TRICKLING 30";
+
+    $conf[] = "# Downloads larger than MAXDOWNLOADSIZE will be blocked.";
+    $val = (!empty($pfconf[XML_DOWNLOADMAXSIZE]) && is_numeric($pfconf[XML_DOWNLOADMAXSIZE])) ? $pfconf[XML_DOWNLOADMAXSIZE] : 0;
+    $conf[] = "MAXDOWNLOADSIZE $val";
+
+    $conf[] = "\n# ClamAV Library Scanner (libclamav) ";
+    $conf[] = "ENABLECLAMLIB true";
+    $conf[] = "# Should we block encrypted archives?";
+    $conf[] = "# CLAMBLOCKENCRYPTED false";
+    $conf[] = "# Should we block files that go over maximum archive limits?";
+    $conf[] = "# CLAMBLOCKMAX false";
+    $conf[] = "# Scanning limits inside archives (filesize = MB):";
+    $conf[] = "# CLAMMAXFILES 1000";
+    $conf[] = "# CLAMMAXFILESIZE 10";
+    $conf[] = "# CLAMMAXRECURSION 8";
+    $conf[] = "# CLAMMAXRATIO 250";
+
+    $conf[] = "";
+    return implode("\n", $conf);
+}
+
+function havp_config_freshclam()
+{
+    global $config;
+    $pfconf = $config['installedpackages']['havp']['config'][0];
+    $conf = array();
+
+    $conf[] =
+"# ============================================================
+# freshclam(HAVP) config file
+# This file generated automaticly with HAVP configurator (part of pfSense)
+# (C)2008 Serg Dvoriancev
+# email: dv_serg@mail.ru
+# ============================================================
+";
+    $conf[] = "DatabaseDirectory /var/db/clamav";
+# --
+# disable log to file while error not solved:
+# "ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log)."
+# --
+#    $conf[] = "UpdateLogFile /var/log/clamav/freshclam.log";
+
+    if ($pfconf[XML_SYSLOG] === 'on') {
+        $conf[] = "\n# syslog";
+        $conf[] = "LogSyslog yes";
+        $conf[] = "LogFacility LOG_LOCAL6"; # LOG_LOCAL6 | LOG_MAIL
+    }
+
+    $conf[] = "\n# pid";
+    $conf[] = "PidFile /var/run/clamav/freshclam.pid";
+
+    $conf[] = "\n# db";
+    $conf[] = "DatabaseOwner clamav";
+    $conf[] = "AllowSupplementaryGroups yes";
+    $conf[] = "DNSDatabaseInfo current.cvd.clamav.net";
+
+    $avsrv = $pfconf['avupdateserver'];
+    $avsrv = explode(" ", trim($avsrv));
+
+    foreach ($avsrv as $asr)
+    	if (!empty($asr))
+             $conf[] = "DatabaseMirror $asr";
+
+	# regional mirror
+    if (!empty($pfconf['dbregion'])) {
+    	$conf[] = '# regional db';
+		switch($pfconf['dbregion']) {
+			case 'au': $conf[] = "DatabaseMirror clamav.mirror.ayudahosting.com.au"; break; # australia
+			case 'ca': $conf[] = "DatabaseMirror clamav.mirror.rafal.ca"; break;  # canada
+			case 'cn': $conf[] = "DatabaseMirror 4most2.clamav.ialfa.net"; break; # china
+			case 'eu': $conf[] = "DatabaseMirror clamav.edpnet.net"; break;       # europe
+			case 'id': $conf[] = "DatabaseMirror db.clamav.or.id"; break;         # indonesia
+			case 'jp': $conf[] = "DatabaseMirror clamavdb2.ml-club.jp"; break;    # japan
+			case 'kr': $conf[] = "DatabaseMirror clamav.hostway.co.kr"; break;    # korea
+			case 'ml': $conf[] = "DatabaseMirror clamav.doubleukay.com"; break;   # malaysia
+			case 'ru': $conf[] = "DatabaseMirror clamav.citrin.ru"; break;        # russia
+			case 'sa': $conf[] = "DatabaseMirror clamav.dial-up.net"; break;      # south africa
+			case 'tw': $conf[] = "DatabaseMirror clamav.cs.pu.edu.tw"; break;     # taiwan
+			case 'uk': $conf[] = "DatabaseMirror clamav.oucs.ox.ac.uk"; break;    # united kingdom
+			case 'us': $conf[] = "DatabaseMirror clamav.catt.com "; break;        # united states
+			default: break;
+		}
+	}
+
+#    $conf[] = "DatabaseMirror db.ru.clamav.net";
+#    $conf[] = "DatabaseMirror db.us.clamav.net";
+
+    $conf[] = "\n# DO NOT TOUCH the following line ";
+    $conf[] = "DatabaseMirror database.clamav.net";
+
+    $conf[] = "\n# Number of database checks per day. Default: 12 (every two hours)";
+    $chks = 0;
+    switch($pfconf['havpavupdate']) {
+        case 'none':   $chks = 0;  break;
+        case 'hv_01h': $chks = 24; break;
+        case 'hv_02h': $chks = 12; break;
+        case 'hv_03h': $chks = 8;  break;
+        case 'hv_04h': $chks = 6;  break;
+        case 'hv_06h': $chks = 4;  break;
+        case 'hv_08h': $chks = 3;  break;
+        case 'hv_12h': $chks = 2;  break;
+        case 'hv_24h': $chks = 1;  break;
+    }
+    $conf[] = "Checks $chks";
+
+#    $conf[] = "# Proxy settings";  # future
+#HTTPProxyServer myproxy.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# MAKE GUI Errors display
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Enable debug messages in libclamav.
+# Default: disabled
+#Debug
+
+    $conf[] = "";
+    return implode("\n", $conf);
+}
+
+function havp_whitelist_def() {
+    $whitelist  = array();
+
+    $whitelist[] = "*sourceforge.net/*clamav-*";
+    $whitelist[] = "*pfsense.com/*";
+    $whitelist[] = "*.microsoft.com/*";
+    $whitelist[] = "*.windowsupdate.com/*";         # M$ & M$ update
+    # media and image extensions
+    $whitelist[] = "*/*.gif\n*/*.swf\n*/*.png\n*/*.jpg\n*/*.jpeg\n*/*.mov\n*/*.avi\n*/*.flv\n*/*.bmp\n*/*.ico\n*/*.pdf\n*/*.mp3\n*/*.wma\n*/*.wmv\n*/*.ogg";
+
+    return implode("\n", $whitelist);
+}
+
+# RAM disk
+#  Mem -  RAM
+# 128M -  16M
+# 256M -  32M
+# 512M -  64M
+#   1G - 128M
+#
+function mountRAMdisk()
+{
+# disabled for VMware
+# return;
+
+    # detach and free all resources used by /dev/md10:
+    mwexec("umount /var/tmp/havp");
+    mwexec("mdconfig -d -u 10");
+
+    # create and mount a 8MByte swap backed file system on /var/tmp/havp by /dev/md10:
+    mwexec("mdconfig -a -t swap -s 1M -u 10");
+    mwexec("newfs -U /dev/md10");
+    mwexec("mount /dev/md10 /var/tmp/havp");
+    mwexec("chmod 1777 /var/tmp/havp");
+}
+
+# ------------------------------------------------------------------------------
+function set_file_access($dir, $owner, $mod) {
+    mwexec("chgrp -R -v $owner $dir");
+    mwexec("chown -R -v $owner $dir");
+    if (!empty($mod)) {
+         mwexec( "chmod -R -v $mod $dir");
+    }
+}
+
+# Src from squid.inc
+# Copyright (C) 2006 Scott Ullrich
+# Copyright (C) 2006 Fernando Lemos
+function get_real_interface_address($iface) {
+        global $config;
+
+        $iface = convert_friendly_interface_to_real_interface_name($iface);
+        $line = trim(shell_exec("ifconfig $iface | grep inet | grep -v inet6"));
+        list($dummy, $ip, $dummy2, $netmask) = explode(" ", $line);
+
+        return array($ip, long2ip(hexdec($netmask)));
+}
+#-------------------------------------------------------------------------------
+
+function havp_update_AV() {
+    # AV update script
+    if (file_exists(HV_AVUPD_SCRIPT)) {
+        file_put_contents(HV_AVUPD_SCRIPT, havp_AVupdate_script());
+        set_file_access(HV_AVUPD_SCRIPT, HV_AV_USER, '0755');
+    }
+    mwexec(HV_AVUPD_SCRIPT);
+}
+
+# *** check black/white list domain ***
+# Lines can hold URLs with wildcards with following rules:
+# Line must cointain Domain/Path
+# Domains can have a wildcard at begin.
+# Pages can hav a wildcard at begin and end.
+# URLs without wildcards are exact
+# Examples:
+# (1) www.server-side.de    (Only this URL is whitelisted)
+# (2) www.server-side.de/*  (Domain is completely whitelisted)
+# (3) *server-side.de/index.html
+# (4) */*.gif               (All .gif are whitelisted)
+# (5) www.server-side.de/novirus*
+# (6) www.server-side.de/*novirus*
+
+function check_bw_domain($_dm) {
+    $domain = "";
+    $path = "";
+    $pos = strpos($_dm, "/");
+
+    if ($pos === false) {
+        $domain = $_dm;
+        $path = "";
+    }
+    else {
+        $domain = substr($_dm, 0, $pos);
+        $path   = substr($_dm, $pos+1);
+    }
+
+    $fmt  = "[a-zA-Z0-9_-]";
+
+    # Domains can have a wildcard at begin '*xxx.xxx' - *my.domain.com
+    if (!eregi("^(\*)|((\*){0,1}($fmt\.){0,}$fmt{1,})$", $domain)) return false;
+
+    # Path can have a wildcard at begin and end '*xxx*'
+    if ($path && !eregi("^(\*){0,1}(.[^\*][^=]){0,}(\*){0,1}$", $path)) return false;
+
+
+    return true;
+}
+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+function havp_AVupdate_script() {
+
+# *** AV update script ***
+
+$scr = <<<EOD
+#!/bin/sh
+# AV update script
+# This file was automatically generated
+# by the pfSense service handler.
+/usr/local/bin/freshclam
+wait
+/usr/local/bin/sigtool --unpack-current daily.cvd
+/usr/local/bin/sigtool --unpack-current main.cvd
+wait
+EOD;
+
+# --- AV update script ---
+
+    return $scr;
+}
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# === UNDER CONSTRUCTION ===
+
+# $day: 1, 2, .., 31, *, mon, tue, wed, thu, fri, sat, sun ; every day : [$day]
+# $mon: 1, 2, .., 12, * ; every mon: [$mon]      [15]-[01]-[2001]
+# $time = 'hh:mm': '12:00' - at 12:00; '*:*' - at any time; '/hh:/mm' - every hh every /mm
+# havp_crontask('my_task', '15', '/1', '15:30', 'root' 'start_cmd', true);
+function havp_crontask($task_name, $day, $mon, $time, $who, $cmd, $enabled)
+{
+
+}
+
+# / === UNDER CONSTRUCTION ===
+
+# $options: [0]='minute', [1]='hour', [2]='mday', [3]='month', [4]='wday', [5]='who', [6]='command'
+#
+function havp_setup_cron($task_name, $options, $on_off) {
+        global $config;
+	    $cron_item = array();
+
+        # $on_off = TRUE/FALSE - install/deinstall cron task:
+        # prepare new cron item
+        if (is_array($options)) {
+            $cron_item['task_name'] = $task_name;
+            $cron_item['minute']  =  $options[0];
+            $cron_item['hour']    =  $options[1];
+            $cron_item['mday']    =  $options[2];
+            $cron_item['month']   =  $options[3];
+            $cron_item['wday']    =  $options[4];
+            $cron_item['who']     = ($options[5]) ? $options[5] : 'nobody';
+            $cron_item['command'] =  $options[6];
+        }
+
+    	# unset old cron task with $task_name
+        if ($task_name !== "") {
+            $flag_cron_upd = false;
+
+            # delete old cron task if exists
+            foreach($config['cron']['item'] as $key => $val) {
+        	    if ($config['cron']['item'][$key]['task_name'] === $task_name) {
+                    unset($config['cron']['item'][$key]);
+                    $flag_cron_upd = true;
+
+                    # log ! cron task deleted !
+                    break;
+                }
+            }
+
+            # set new cron task
+            if (($on_off === true) and !empty($cron_item)) {
+                $config['cron']['item'][] = $cron_item;
+                $flag_cron_upd = true;
+
+                # log ! cron task installed !
+            }
+
+            # write config and configure cron only if cron task modified
+            if ($flag_cron_upd === true) {
+                write_config("Installed cron task '$task_name' for 'havp' package");
+                configure_cron();
+                # log ! cron stored !
+            }
+        }
+        else {
+            # ! error $name !
+
+            # if error - break function
+        	return;
+        }
+}
+?>