The Squid package... Countless changes. You might need some stuff from HEAD to make this work properly (you need make_dirs from HEAD to at least install it). This might not work out of the box. In fact, it should not work out of the box in RELENG_1. Please be patient.

8 files changed, 1229 insertions, 717 deletions

diff --git a/packages/squid.inc b/packages/squid.inc
new file mode 100644
index 00000000..af0d7bda
--- /dev/null
+++ b/packages/squid.inc
@@ -0,0 +1,770 @@
+<?php
+require_once('globals.inc');
+require_once('config.inc');
+require_once('util.inc');
+require_once('pfsense-utils.inc');
+require_once('pkg-utils.inc');
+require_once('filter.inc');
+require_once('service-utils.inc');
+
+define('SQUID_CONFBASE', '/usr/local/etc/squid');
+define('SQUID_LOGDIR', '/var/squid/log');
+define('SQUID_CACHEDIR', '/var/squid/cache');
+define('SQUID_ACLDIR', '/var/squid/acl');
+define('SQUID_PASSWD', '/var/etc/squid.passwd');
+
+$valid_acls = array();
+
+
+function squid_get_real_interface_address($iface) {
+	global $config;
+
+	$iface = convert_friendly_interface_to_real_interface_name($iface);
+	$line = trim(shell_exec("ifconfig $iface | grep inet | grep -v inet6"));
+	list($dummy, $ip, $dummy2, $netmask) = explode(' ', $line);
+
+	return array($ip, long2ip(hexdec($netmask)));
+}
+
+function squid_chown_recursive($dir, $user, $group) {
+	chown($dir, $user); 
+	chgrp($dir, $group); 
+	$handle = opendir($dir) ; 
+	while (($item = readdir($handle)) !== false) { 
+		if (($item != ".") && ($item != "..")) { 
+			$path = "$dir/$item";
+			if (is_dir($path))
+				squid_chown_recursive($path, $user, $group); 
+			else {
+				chown($path, $user); 
+				chgrp($path, $group); 
+			}
+		} 
+	} 
+}
+
+function squid_is_valid_acl($acl) {
+	global $valid_acls;
+
+	return in_array($acl, $valid_acls);
+}
+
+function squid_install_command() {
+	$rc = array();
+	$rc['file'] = 'squid.sh';
+	$rc['start'] = 'squid -D';
+	$rc['stop'] = <<<EOD
+squid -k shutdown
+# Just to be sure...
+killall squid 2>/dev/null
+sleep 1
+killall squid 2>/dev/null
+
+EOD;
+	$rc['restart'] = <<<EOD
+if [ -z "`pgrep squid`" ]; then
+		squid -D
+	else
+		squid -k reconfigure
+	fi
+
+EOD;
+	write_rcfile($rc);
+
+	foreach (array(	SQUID_CONFBASE,
+			SQUID_LOGDIR,
+			SQUID_CACHEDIR,
+			SQUID_ACLDIR,
+	) as $dir) {
+			make_dirs($dir);
+			squid_chown_recursive($dir, 'proxy', 'proxy');
+	}
+
+	if (!file_exists(SQUID_CONFBASE . '/mime.conf') && file_exists(SQUID_CONFBASE . '/mime.conf.default'))
+		copy(SQUID_CONFBASE . '/mime.conf.default', SQUID_CONFBASE . '/mime.conf');
+}
+
+function squid_deinstall_command() {
+	mwexec('rm -rf ' . CACHEDIR);
+	filter_configure();
+}
+
+function squid_before_form_general($pkg) {
+	$values = get_dir(SQUID_CONFBASE . '/errors/');
+	// Get rid of '..' and '.'
+	array_shift($values);
+	array_shift($values);
+	$name = array();
+	foreach ($values as $value)
+		$names[] = implode(' ', explode('_', $value));
+
+	$i = 0;
+	foreach ($pkg['fields']['field'] as $field) {
+		if ($field['fieldname'] == 'error_language')
+			break;
+		$i++;
+	}
+	$field = &$pkg['fields']['field'][$i];
+
+	for ($i = 0; $i < count($values) - 1; $i++)
+		$field['options']['option'][] = array('name' => $names[$i], 'value' => $values[$i]);
+}
+
+function squid_validate_general($post, $input_errors) {
+	$icp_port = trim($post['icp_port']);
+	if (!empty($icp_port) && !is_port($icp_port))
+		$input_errors[] = 'You must enter a valid port number in the \'ICP port\' field';
+}
+
+function squid_validate_upstream($post, $input_errors) {
+	if ($post['proxy_forwarding'] == 'on') {
+		$addr = trim($post['proxy_addr']);
+		if (empty($addr))
+			$input_errors[] = 'The field \'Hostname\' is required';
+		else {
+			if (!is_ipaddr($addr) && !is_domain($addr))
+				$input_errors[] = 'You must enter a valid IP address or host name in the \'Proxy hostname\' field';
+		}
+
+		foreach (array('proxy_port' => 'TCP port', 'icp_port' => 'ICP port') as $field => $name) {
+			$port = trim($post[$field]);
+			if (empty($port))
+				$input_errors[] = "The field '$name' is required";
+			else {
+					if (!is_port($port))
+					$input_errors[] = "The field '$name' must contain a valid port number, between 0 and 65535";
+			}
+		}
+	}
+}
+
+function squid_validate_cache($post, $input_errors) {
+	$num_fields = array(	'harddisk_cache_size' => 'Hard disk cache size',
+				'memory_cache_size' => 'Memory cache size',
+				'maximum_object_size' => 'Maximum object size',
+	);
+	foreach ($num_fields as $field => $name) {
+		$value = trim($post[$field]);
+		if (!is_numeric($value) || ($value < 1))
+			$input_errors[] = "You must enter a valid value for '$field'";
+	}
+
+	$value = trim($post['minimum_object_size']);
+	if (!is_numeric($value) || ($value < 0))
+		$input_errors[] = 'You must enter a valid value for \'Minimum object size\'';
+
+	foreach (explode(',', $post['donotcache']) as $host) {
+		$host = trim($host);
+		if (!is_ipaddr($host) && !is_domain($host))
+			$input_errors[] = "$host is not a valid IP or host name";
+	}
+}
+
+function squid_validate_nac($post, $input_errors) {
+	$allowed_subnets = explode(',', trim($post['allowed_subnets']));
+	foreach ($allowed_subnets as $subnet) {
+		$subnet = trim($subnet);
+		if (!is_subnet($subnet))
+			$input_errors[] = "'$subnet' is not a valid CIDR range";
+	}
+
+	foreach (array(	'unrestricted_hosts',
+			'banned_hosts',
+			'whitelist',
+			'blacklist',
+	) as $hosts) {
+		foreach (explode(',', $post[$hosts]) as $host) {
+			$host = trim($host);
+			if (!empty($host) && !is_ipaddr($host))
+				$input_errors[] = "'$host' is not a valid IP address";
+		}
+	}
+
+	foreach (array('unrestricted_macs', 'banned_macs') as $macs) {
+		foreach (explode(',', $post[$macs]) as $mac) {
+			$mac = trim($mac);
+			if (!empty($mac) && !is_macaddr($mac))
+				$input_errors[] = "'$mac' is not a valid MAC address";
+		}
+	}
+
+	foreach (explode(',', $post['timelist']) as $time) {
+		$time = trim($time);
+		if (!empty($time) && !squid_is_timerange($time))
+			$input_errors[] = "'$time' is not a valid time range";
+	}
+}
+
+function squid_validate_traffic($post, $input_errors) {
+	$num_fields = array(	'max_download_size' => 'Maximum download size',
+				'max_upload_size' => 'Maximum upload size',
+				'perhost_throttling' => 'Per-host bandwidth throttling',
+				'overall_throttling' => 'Overall bandwidth throttling',
+	);
+	foreach ($num_fields as $field => $name) {
+		$value = trim($post[$field]);
+		if (!is_numeric($value) || ($value < 0))
+			$input_errors[] = "The field '$name' must contain a positive number";
+	}
+}
+
+function squid_validate_auth($post, $input_errors) {
+	$num_fields = array(	array('auth_processes', 'Authentication processes', 1),
+				array('auth_ttl', 'Authentication TTL', 0),
+	);
+	foreach ($num_fields as $field) {
+		$value = trim($post[$field[0]]);
+		if (!empty($value) && (!is_numeric($value) || ($value < $field[2])))
+			$input_errors[] = "The field '{$field[1]}' must contain a valid number greater than {$field[2]}";
+	}
+
+	$auth_method = $post['auth_method'];
+	if (($auth_method != 'none') && ($auth_method != 'local')) {
+		$server = trim($post['auth_server']);
+		if (empty($server))
+			$input_errors[] = 'The field \'Authentication server\' is required';
+		else if (!is_ipaddr($server) && !is_domain($server))
+			$input_errors[] = 'The field \'Authentication server\' must contain a valid IP address or domain name';
+
+		$port = trim($post['auth_server_port']);
+		if (!empty($port) && !is_port($port))
+			$input_errors[] = 'The field \'Authentication server port\' must contain a valid port number';
+
+		switch ($auth_method) {
+			case 'ldap':
+				$user = trim($post['ldap_user']);
+				if (empty($user))
+					$input_errors[] = 'The field \'LDAP server user DN\' is required';
+				else if (!is_domain($user))
+					$input_errors[] = 'The field \'LDAP server user DN\' must be a valid domain name';
+				break;
+			case 'radius':
+				$secret = trim($post['radius_secret']);
+				if (empty($secret))
+					$input_errors[] = 'The field \'RADIUS secret\' is required';
+				break;
+			case 'msnt':
+				foreach (explode(trim($post['msnt_secondary'])) as $server) {
+					if (!empty($server) && !is_ipaddr($server) && !is_domain($server))
+						$input_errors[] = "'$server' isn't a valid IP address or domain name";
+				}
+				break;
+		}
+
+		$no_auth = explode(',', trim($post['no_auth_hosts']));
+		foreach ($no_auth as $host) {
+			$host = trim($host);
+			if (!empty($host) && !is_subnet($host))
+				$input_errors[] = "'$host' isn't a valid CIDR range";
+		}
+	}
+}
+
+function squid_resync_general() {
+	global $g, $config, $valid_acls;
+
+	$settings = $config['installedpackages']['squid']['config'][0];
+	$conf = '';
+
+	if ($settings['transparent_proxy'] == 'on') {
+		$conf .= <<<EOD
+httpd_accel_host virtual
+httpd_accel_port 80
+httpd_accel_with_proxy on
+httpd_accel_uses_host_header on
+
+EOD;
+	}
+
+	$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
+	$ifaces = ($settings['active_interface'] ? $settings['active_interface'] : 'lan');
+	$real_ifaces = array();
+	foreach (explode(',', $ifaces) as $i => $iface) {
+		$real_ifaces[] = squid_get_real_interface_address($iface);
+		$conf .= "http_port {$real_ifaces[$i][0]}:$port\n";
+	}
+
+	$icp_port = ($settings['icp_port'] ? $settings['icp_port'] : 0);
+
+	$pidfile = "{$g['varrun_path']}/squid.pid";
+	$language = ($settings['error_language'] ? $settings['error_language'] : 'English');
+	$errordir = SQUID_CONFBASE . '/errors/' . $language;
+	$hostname = ($settings['visible_hostname'] ? $settings['visible_hostname'] : 'localhost');
+	$email = ($settings['admin_email'] ? $settings['admin_email'] : 'admin@localhost');
+
+	$logdir_cache = SQUID_LOGDIR . '/cache.log';
+	$logdir_access = ($settings['log_enabled'] == 'on' ? SQUID_LOGDIR . '/access.log' : '/dev/null');
+
+	$conf .= <<<EOD
+icp_port $icp_port
+
+pid_filename $pidfile
+cache_effective_user proxy
+cache_effective_group proxy
+error_directory $errordir
+visible_hostname $hostname
+cache_mgr $email
+
+cache_access_log $logdir_access
+cache_log $logdir_cache
+cache_store_log none
+
+EOD;
+
+	if ($settings['allow_interface'] == 'on') {
+		$src = '';
+		foreach ($real_ifaces as $iface) {
+			list($ip, $mask) = $iface;
+			$ip = long2ip(ip2long($ip) & ip2long($mask));
+			$src .= " $ip/$mask";
+		}
+		$conf .= "acl localnet src $src\n";
+		$valid_acls[] = 'localnet';
+	}
+
+	return $conf;
+}
+
+function squid_resync_cache() {
+	global $config;
+
+	$settings = $config['installedpackages']['squidcache']['config'][0];
+
+	$cachedir = SQUID_CACHEDIR;
+	$disk_cache_size = ($settings['harddisk_cache_size'] ? $settings['harddisk_cache_size'] : 100);
+	$level1 = ($settings['level1_subdirs'] ? $settings['level1_subdirs'] : 16);
+	$memory_cache_size = ($settings['memory_cache_size'] ? $settings['memory_cache_size'] : 8);
+	$max_objsize = ($settings['maximum_object_size'] ? $settings['maximum_object_size'] : 4);
+	$min_objsize = ($settings['minimum_object_size'] ? $settings['minimum_object_size'] : 0);
+	$cache_policy = ($settings['cache_replacement_policy'] ? $settings['cache_replacement_policy'] : 'heap LFUDA');
+	$memory_policy = ($settings['memory_replacement_policy'] ? $settings['memory_replacement_policy'] : 'heap GSDF');
+	$offline_mode = ($settings['enable_offline'] == 'on' ? 'on' : 'off');
+
+	$conf = <<<EOD
+cache_dir diskd $cachedir $disk_cache_size $level1 256
+cache_mem $memory_cache_size MB
+maximum_object_size $max_objsize KB
+minimum_object_size $min_objsize KB
+cache_replacement_policy $cache_policy
+memory_replacement_policy $memory_policy
+offline_mode $offline_mode
+
+EOD;
+
+	$donotcache = trim(implode("\n", array_map('trim', explode(',', $settings['donotcache']))));
+	if (!empty($donotcache)) {
+		file_put_contents(SQUID_ACLDIR . '/donotcache.acl', $donotcache);
+		$conf .= 'acl donotcache dstdomain "' . SQUID_ACLDIR . "/donotcache.acl\"\n";
+		$conf .= 'no_cache deny donotcache';
+	}
+
+	return $conf;
+}
+
+function squid_resync_upstream() {
+	global $config;
+	$settings = $config['installedpackages']['squidupstream']['config'][0];
+
+	$conf = '';
+	if ($settings['proxy_forwarding'] == 'on') {
+		$conf .= "cache_peer {$settings['proxy_addr']} parent {$settings['proxy_port']} {$settings['icp_port']} ";
+
+		if (!empty($settings['username']))
+			$conf .= " login={$settings['username']}";
+		if (!empty($settings['password']))
+			$conf .= ":{$settings['password']}";
+	}
+
+	return $conf;
+}
+
+function squid_resync_redirector() {
+	global $config;
+
+	$httpav_enabled = ($config['installedpackages']['clamav']['config'][0]['scan_http'] == 'on');
+	if ($httpav_enabled)
+		return ('redirect_program /usr/local/bin/squirm');
+	return '# No redirector configured';
+}
+
+function squid_resync_nac() {
+	global $config, $valid_acls;
+
+	$settings = $config['installedpackages']['squidnac']['config'][0];
+
+	$conf = <<<EOD
+acl all src 0.0.0.0/0
+acl localhost src 127.0.0.1
+acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 1025-65535
+acl sslports port 443 563
+acl manager proto cache_object
+acl purge method PURGE
+acl connect method CONNECT
+acl dynamic urlpath_regex cgi-bin \?
+
+EOD;
+
+	$allowed = implode(' ', array_map('trim', explode(',', $settings['allowed_subnets'])));
+	if (!empty($allowed)) {
+		$conf .= "acl allowed_subnets src $allowed\n";
+		$valid_acls[] = 'allowed_subnets';
+	}
+
+	$options = array(	'unrestricted_hosts' => 'src',
+				'unrestricted_macs' => 'arp',
+				'banned_hosts' => 'src',
+				'banned_macs' => 'arp',
+				'whitelist' => 'url_regex -i',
+				'blacklist' => 'url_regex -i',
+	);
+	foreach ($options as $option => $directive) {
+		$contents = trim(implode("\n", array_map('trim', explode(',', $settings[$option]))));
+		if (!empty($contents)) {
+			file_put_contents(SQUID_ACLDIR . "/$option.acl", $contents);
+			$conf .= "acl $option $directive \"" . SQUID_ACLDIR . "/$option.acl\"\n";
+			$valid_acls[] = $option;
+		}
+	}
+
+	$conf .= <<<EOD
+no_cache deny dynamic
+http_access allow manager localhost
+http_access deny manager
+http_access allow purge localhost
+http_access deny purge
+http_access deny !safeports
+http_access deny CONNECT !sslports
+
+http_access allow localhost
+
+EOD;
+
+	return $conf;
+}
+
+function squid_resync_traffic() {
+	global $config, $valid_acls;
+
+	$settings = $config['installedpackages']['squidtraffic']['config'][0];
+	$conf = '';
+
+	$up_limit = ($settings['max_upload_size'] ? $settings['max_upload_size'] : 0);
+	$down_limit = ($settings['max_download_size'] ? $settings['max_download_suze'] : 0);
+	$conf .= "request_body_max_size $up_limit KB\n";
+	$conf .= 'reply_body_max_size ' . ($down_limit * 1024) . " allow all\n";
+
+	// Only apply throttling past 10MB
+	// XXX: Should this really be hardcoded?
+	$threshold = 10 * 1024 * 1024;
+	$overall = $settings['overall_throttling'];
+	if (!isset($overall) || ($overall == 0))
+		$overall = -1;
+	else
+		$overall *= 1024;
+	$perhost = $settings['perhost_throttling'];
+	if (!isset($perhost) || ($perhost == 0))
+		$perhost = -1;
+	else
+		$perhost *= 1024;
+	$conf .= <<<EOD
+delay_pools 1
+delay_class 1 2
+delay_parameters 1 $overall/$threshold $perhost/$threshold
+delay_initial_bucket_level 100%
+
+EOD;
+
+	foreach (array('unrestricted_hosts', 'unrestricted_macs') as $item) {
+		if (in_array($item, $valid_acls))
+			$conf .= "delay_access 1 deny $item\n";
+	}
+
+	if ($settings['throttle_specific'] == 'on') {
+		$exts = array();
+		$binaries = 'bin,cab,sea,ar,arj,tar,tgz,gz,tbz,bz2,zip,exe,com';
+		$cdimages = 'iso,bin,mds,nrg,gho,bwt,b5t,pqi';
+		$multimedia = 'aiff?,asf,avi,divx,mov,mp3,mp4,mpe?g,qt,ra?m';
+		foreach (array(	'throttle_binaries' => $binaries,
+				'throttle_cdimages' => $cdimages,
+				'throttle_multimedia' => $multimedia) as $field => $set) {
+			if ($settings[$field] == 'on')
+				$exts = array_merge($exts, explode(',', $set));
+		}
+
+		foreach (explode(',', $settings['throttle_others']) as $ext) {
+			if (!empty($ext)) $exts[] = $ext;
+		}
+
+		$contents = '';
+		foreach ($exts as $ext)
+			$contents .= "\.$ext\$\n";
+		file_put_contents(SQUID_ACLDIR . '/throttle_exts.acl', $contents);
+
+		$conf .= 'acl throttle_exts url_regex -i "' . SQUID_ACLDIR . '/throttle_exts.acl"';
+		$conf .= "delay_access 1 allow throttle_exts\n";
+		$conf .= "delay_access 1 deny all\n";
+	}
+	else
+		$conf .= "delay_access 1 allow all\n";
+
+	return $conf;
+}
+
+function squid_resync_auth() {
+	global $config, $valid_acls;
+
+	$settings = $config['installedpackages']['squidauth']['config'][0];
+	$conf = '';
+
+	// Deny the banned guys before allowing the good guys
+	$banned = array(	'banned_hosts',
+				'banned_macs',
+	);
+	$banned = array_filter($banned, 'squid_is_valid_acl');
+	foreach ($banned as $acl)
+			$conf .= "http_access deny $acl\n";
+
+	// Whitelist and blacklist also take precendence
+	if (squid_is_valid_acl('whitelist'))
+		$conf .= "http_access allow whitelist\n";
+	if (squid_is_valid_acl('blacklist'))
+		$conf .= "http_access deny blacklist\n";
+
+	$transparent_proxy = ($config['installedpackages']['squid']['config'][0]['transparent_proxy'] == 'on');
+	$auth_method = (($settings['auth_method'] && !$transparent_proxy) ? $settings['auth_method'] : 'none');
+
+	// Allow the remaining ACLs if no authentication is set
+	if ($auth_method == 'none') {
+		$allowed = array('localnet', 'allowed_subnets', 'unrestricted_hosts', 'unrestricted_macs');
+		$allowed = array_filter($allowed, 'squid_is_valid_acl');
+		foreach ($allowed as $acl)
+			$conf .= "http_access allow $acl\n";
+	}
+
+	else {
+		$noauth = implode(' ', array_map('trim', explode(',', $settings['no_auth_hosts'])));
+		if (!empty($noauth)) {
+			$conf .= "acl noauth src $noauth\n";
+			$valid_acls[] = 'noauth';
+		}
+
+		// Set up the external authentication programs
+		$auth_ttl = ($settings['auth_ttl'] ? $settings['auth_ttl'] : 60);
+		$processes = ($settings['auth_processes'] ? $settings['auth_processes'] : 5);
+		$prompt = ($settings['auth_prompt'] ? $settings['auth_prompt'] : 'Please enter your credentials to access the proxy');
+		switch ($auth_method) {
+			case 'local':
+				$conf .= 'auth_param basic program /usr/local/libexec/squid/ncsa_auth ' . SQUID_PASSWD . "\n";
+				break;
+			case 'ldap':
+				$port = (isset($settings['auth_port']) ? ":{$settings['auth_port']}" : '');
+				$password = (isset($settings['ldap_pass']) ? "-w {$settings['ldap_pass']}" : '');
+				$conf .= "auth_param basic program /usr/local/libexec/squid/squid_ldap_auth -b {$settings['ldap_basedomain']} -D {$settings['ldap_user']} $password -f \"(&(objectClass=person)(cn=%s))\" -u cn -P {$settings['auth_server']}$port\n";
+				break;
+			case 'radius':
+				$port = (isset($settings['auth_port']) ? "-p {$settings['auth_server_port']}" : '');
+				$conf .= "auth_param basic program /usr/local/libexec/squid/squid_radius_auth -w {$settings['radius_secret']} -h {$settings['auth_server']} $port\n";
+				break;
+			case 'msnt':
+				$conf .= "auth_param basic program /usr/local/libexec/squid/msnt_auth\n";
+				break;
+		}
+		$conf .= <<<EOD
+auth_param basic children $processes
+auth_param basic realm $prompt
+auth_param basic credentialsttl $auth_ttl minutes
+acl password proxy_auth REQUIRED
+
+EOD;
+
+		// Onto the ACLs
+		$password = array('localnet', 'allowed_subnets');
+		$passwordless = array('unrestricted_hosts', 'unrestricted_macs');
+		if ($settings['unrestricted_auth'] == 'on') {
+			// Even the unrestricted hosts should authenticate
+			$password = array_merge($password, $passwordless);
+			$passwordless = array();
+		}
+		$passwordless[] = 'noauth';
+		$password = array_filter($password, 'squid_is_valid_acl');
+		$passwordless = array_filter($passwordless, 'squid_is_valid_acl');
+
+		// Allow the ACLs that don't need to authenticate
+		foreach ($passwordless as $acl)
+			$conf .= "http_access allow $acl\n";
+
+		// Allow the other ACLs as long as they authenticate
+		foreach ($password as $acl)
+			$conf .= "http_access allow password $acl\n";
+	}
+
+
+	$conf .= "http_access deny all\n";
+
+	return $conf;
+}
+
+function squid_resync_users() {
+	global $config;
+
+	$users = $config['installedpackages']['squidusers']['config'];
+	$contents = '';
+	if (is_array($users)) {
+		foreach ($users as $user)
+			$contents .= $user['username'] . ':' . crypt($user['password'], base64_encode($user['password'])) . "\n";
+	}
+	file_put_contents(SQUID_PASSWD, $contents);
+	chown(SQUID_PASSWD, 'proxy');
+	chmod(SQUID_PASSWD, 0600);
+}
+
+function squid_resync() {
+	$conf = squid_resync_general() . "\n";
+	$conf .= squid_resync_cache() . "\n";
+	$conf .= squid_resync_redirector() . "\n";
+	$conf .= squid_resync_upstream() . "\n";
+	$conf .= squid_resync_nac() . "\n";
+	$conf .= squid_resync_traffic() . "\n";
+	$conf .= squid_resync_auth();
+	squid_resync_users();
+
+	file_put_contents(SQUID_CONFBASE . '/squid.conf', $conf);
+	restart_service('squid');
+
+	filter_configure();
+}
+
+function squid_print_javascript_auth() {
+	global $config;
+	$transparent_proxy = ($config['installedpackages']['squid']['config'][0]['transparent_proxy'] == 'on');
+
+	// No authentication for transparent proxy
+	if ($transparent_proxy) {
+		$javascript = <<<EOD
+<script language="JavaScript">
+<!--
+function on_auth_method_changed() {
+	document.iform.auth_method.disabled = 1;
+	document.iform.auth_server.disabled = 1;
+	document.iform.auth_server_port.disabled = 1;
+	document.iform.ldap_user.disabled = 1;
+	document.iform.ldap_password.disabled = 1;
+	document.iform.ldap_basedomain.disabled = 1;
+	document.iform.radius_secret.disabled = 1;
+	document.iform.msnt_secondary.disabled = 1;
+	document.iform.auth_prompt.disabled = 1;
+	document.iform.auth_processes.disabled = 1;
+	document.iform.auth_ttl.disabled = 1;
+	document.iform.unrestricted_auth.disabled = 1;
+	document.iform.no_auth_hosts.disabled = 1;
+}
+-->
+</script>
+
+EOD;
+	}
+	else {
+		$javascript = <<<EOD
+<script language="JavaScript">
+<!--
+function on_auth_method_changed() {
+	var field = document.iform.auth_method;
+	var auth_method = field.options[field.selectedIndex].value;
+
+	if (auth_method == 'none') {
+		document.iform.auth_server.disabled = 1;
+		document.iform.auth_server_port.disabled = 1;
+		document.iform.ldap_user.disabled = 1;
+		document.iform.ldap_password.disabled = 1;
+		document.iform.ldap_basedomain.disabled = 1;
+		document.iform.radius_secret.disabled = 1;
+		document.iform.msnt_secondary.disabled = 1;
+		document.iform.auth_prompt.disabled = 1;
+		document.iform.auth_processes.disabled = 1;
+		document.iform.auth_ttl.disabled = 1;
+		document.iform.unrestricted_auth.disabled = 1;
+		document.iform.no_auth_hosts.disabled = 1;
+	}
+	else {
+		document.iform.auth_prompt.disabled = 0;
+		document.iform.auth_processes.disabled = 0;
+		document.iform.auth_ttl.disabled = 0;
+		document.iform.unrestricted_auth.disabled = 0;
+		document.iform.no_auth_hosts.disabled = 0;
+	}
+
+	switch (auth_method) {
+		case 'local':
+			document.iform.auth_server.disabled = 1;
+			document.iform.auth_server_port.disabled = 1;
+			document.iform.ldap_user.disabled = 1;
+			document.iform.ldap_password.disabled = 1;
+			document.iform.ldap_basedomain.disabled = 1;
+			document.iform.radius_secret.disabled = 1;
+			document.iform.msnt_secondary.disabled = 1;
+			break;
+		case 'ldap':
+			document.iform.auth_server.disabled = 0;
+			document.iform.auth_server_port.disabled = 0;
+			document.iform.ldap_user.disabled = 0;
+			document.iform.ldap_password.disabled = 0;
+			document.iform.ldap_basedomain.disabled = 0;
+			document.iform.radius_secret.disabled = 1;
+			document.iform.msnt_secondary.disabled = 1;
+			break;
+		case 'radius':
+			document.iform.auth_server.disabled = 0;
+			document.iform.auth_server_port.disabled = 0;
+			document.iform.ldap_user.disabled = 1;
+			document.iform.ldap_password.disabled = 1;
+			document.iform.ldap_basedomain.disabled = 1;
+			document.iform.radius_secret.disabled = 0;
+			document.iform.msnt_secondary.disabled = 1;
+			break;
+		case 'msnt':
+			document.iform.auth_server.disabled = 0;
+			document.iform.auth_server_port.disabled = 1;
+			document.iform.ldap_user.disabled = 1;
+			document.iform.ldap_password.disabled = 1;
+			document.iform.ldap_basedomain.disabled = 1;
+			document.iform.radius_secret.disabled = 1;
+			document.iform.msnt_secondary.disabled = 0;
+			break;
+	}
+}
+-->
+</script>
+
+EOD;
+	}
+
+	print($javascript);
+}
+
+function squid_print_javascript_auth2() {
+	print("<script language=\"JavaScript\">on_auth_method_changed()</script>\n");
+}
+
+function squid_generate_rules($type) {
+	global $config;
+
+	$squid_conf = $config['installedpackages']['squid']['config'][0];
+	if (!is_service_running('squid') || ($squid_conf['transparent_proxy'] != 'on')) return;
+
+	$port = $squid_conf['proxy_port'];
+	$ifaces = explode(',', $squid_conf['active_interface']);
+	$ifaces = array_map('convert_friendly_interface_to_real_interface_name', $ifaces);
+
+	if ($type == 'nat') {
+		foreach ($ifaces as $iface)
+			$rules .= "rdr on $iface inet proto tcp to !($iface) port 80 -> ($iface) port $port\n";
+	}
+
+	else {
+		foreach ($ifaces as $iface)
+			$rules .= "pass quick on $iface inet proto tcp to !($iface) port 80 flags S/SA keep state\n";
+	}
+
+	return $rules;
+}
+?>
diff --git a/packages/squid.xml b/packages/squid.xml
index 1acb0dc4..b6fe58c5 100644
--- a/packages/squid.xml
+++ b/packages/squid.xml
@@ -1,434 +1,162 @@
-<?xml version="1.0" encoding="utf-8" ?>
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
-	<name>squid</name>
-	<title>Services: Proxy Server</title>
-	<category>Security</category>
-	<version>2.5.10_4</version>
-	<configpath>installedpackages->package->squidng->configuration->settings</configpath>
-	
-	<aftersaveredirect>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</aftersaveredirect>
-	
-	<menu>
-		<name>Squid</name>
-		<tooltiptext>Modify settings for Proxy Server</tooltiptext>
-		<section>Services</section>
-		<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
-	</menu>
-		
-	<!-- TODO: Add xml to parse proxy logs into readable format
-	<menu>
-		<name>Proxy Log</name>
-		<section>Status</section>
-		<configfile>squid_log.xml</configfile>
-	</menu> -->
-			
+	<include_file>squid.inc</include_file>
+
+	<!-- Installation -->
 	<additional_files_needed>
-		<prefix>/usr/local/pkg/</prefix>
-		<chmod>0755</chmod>
-		<item>http://www.pfsense.com/packages/config/squid_cache.xml</item>
+		<item>http://www.pfsense.org/packages/config/squid.inc</item>
 	</additional_files_needed>
-	
-    <additional_files_needed>
-	    <prefix>/usr/local/pkg/</prefix>
-	    <chmod>0755</chmod>
-	    <item>http://www.pfsense.com/packages/config/squid_nac.xml</item>
+	<additional_files_needed>
+		<item>http://www.pfsense.org/packages/config/squid_cache.xml</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<item>http://www.pfsense.org/packages/config/squid_nac.xml</item>
 	</additional_files_needed>
-    	
-    <additional_files_needed>
-	    <prefix>/usr/local/pkg/</prefix>
-	    <chmod>0755</chmod>
-	    <item>http://www.pfsense.com/packages/config/squid_ng.inc</item>
+	<additional_files_needed>
+		<item>http://www.pfsense.org/packages/config/squid_ng.xml</item>
 	</additional_files_needed>
-    
-   	<additional_files_needed>
-	    <prefix>/usr/local/pkg/</prefix>
-	    <chmod>0755</chmod>
-	    <item>http://www.pfsense.com/packages/config/squid_traffic.xml</item>
+	<additional_files_needed>
+		<item>http://www.pfsense.org/packages/config/squid_traffic.xml</item>
 	</additional_files_needed>
-	
 	<additional_files_needed>
-	    <prefix>/usr/local/pkg/</prefix>
-	    <chmod>0755</chmod>
-	    <item>http://www.pfsense.com/packages/config/squid_upstream.xml</item>
+		<item>http://www.pfsense.org/packages/config/squid_upstream.xml</item>
 	</additional_files_needed>
-
 	<additional_files_needed>
-		<prefix>/usr/local/pkg/</prefix>
-		<chmod>0755</chmod>
-		<item>http://www.pfsense.com/packages/config/squid_auth.xml</item>
+		<item>http://www.pfsense.org/packages/config/squid_auth.xml</item>
 	</additional_files_needed>
-	
 	<additional_files_needed>
-		<prefix>/usr/local/pkg/</prefix>
-		<chmod>0755</chmod>
-		<item>http://www.pfsense.com/packages/config/squid_extauth.xml</item>
+		<item>http://www.pfsense.org/packages/config/squid_users.xml</item>
 	</additional_files_needed>
-	
+	<custom_php_install_command>
+		squid_install_command();
+	</custom_php_install_command>
+	<custom_php_deinstall_command>
+		squid_deinstall_command();
+	</custom_php_deinstall_command>
+	<menu>
+		<name>Proxy server</name>
+		<tooltiptext>Modify the proxy server's settings</tooltiptext>
+		<section>Services</section>
+		<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
+	</menu>
+	<service>
+		<name>Squid</name>
+		<description>Web proxy cache.</description>
+		<rcfile>squid.sh</rcfile>
+		<executable>squid</executable>
+	</service>
+
+	<!-- Interface -->
+	<name>squid</name>
+	<title>Proxy server: General settings</title>
 	<tabs>
 		<tab>
-			<text>General Settings</text>
+			<text>General settings</text>
 			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 			<active/>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.xml</url>
 		</tab>
 	</tabs>
-	
-	<fields>	
+	<fields>
 		<field>
-			<fielddescr>Proxy Listening Interface</fielddescr>
 			<fieldname>active_interface</fieldname>
-			<description>This defines the active listening interface to which the proxy server will listen for its requests.</description>
+			<fielddescr>Proxy interface</fielddescr>
+			<description>The interface(s) the proxy server will bind to.</description>
+			<default_value>lan</default_value>
+			<required/>
 			<type>interfaces_selection</type>
+			<multiple/>
 		</field>
-		
-		<field>
-			<fielddescr>Transparent Proxy</fielddescr>
-			<fieldname>transparent_proxy</fieldname>
-			<description>If transparent mode is enabled; all requests for destination port 80 will be forwarded to the proxy server without any additional configuration necessary.</description>
-			<type>checkbox</type>
-		</field>
-		
-		<field>
-			<fielddescr>Log Enabled</fielddescr>
-			<fieldname>log_enabled</fieldname>
-			<description>This enables the Web Proxy logging feature.  All clients requests will be written to a log file viewable under Services -> Proxy Log.</description>
-			<type>checkbox</type>
-		</field>
-		
 		<field>
-			<fielddescr>URL Filtering Enabled</fielddescr>
-			<fieldname>urlfilter_enable</fieldname>
-			<description>This enables the advanced functionality in conjunction with squidGuard to provide an array of URL filtering options.  This squidGuard functionality can be additionally configured from Services -> Advanced Proxy Filtering</description>
+			<fieldname>allow_interface</fieldname>
+			<fielddescr>Allow users on interface</fielddescr>
+			<description>If this field is checked, the users connected to the interface selected in the 'Proxy interface' field will be allowed to use the proxy, i.e., there will be no need to add the interface's subnet to the list of allowed subnets. This is just a shortcut.</description>
+			<default_value>on</default_value>
+			<required/>
 			<type>checkbox</type>
 		</field>
-		
 		<field>
-			<fielddescr>Log Query Terms</fielddescr>
-			<fieldname>log_query_terms</fieldname>
-			<description>This will log the complete URL rather than the part of the URL containing dynamic queries.</description>
+			<fieldname>transparent_proxy</fieldname>
+			<fielddescr>Transparent proxy</fielddescr>
+			<description>If transparent mode is enabled, all requests for destination port 80 will be forwarded to the proxy server without any additional configuration necessary.</description>
+			<required/>
 			<type>checkbox</type>
 		</field>
-		
 		<field>
-			<fielddescr>Log User Agents</fielddescr>
-			<fieldname>log_user_agents</fieldname>
-			<description>This will enable the useragent string to be written to a separate log.  The results are not shown in the GUI and should only be used for debugging purposes.</description>
+			<fieldname>log_enabled</fieldname>
+			<fielddescr>Enabled logging</fielddescr>
+			<description>This will enable the access log. Don't switch this on if you don't have much disk space left.</description>
+			<enablefields>log_query_terms,log_user_agents</enablefields>
 			<type>checkbox</type>
 		</field>
-		
 		<field>
-			<combinefieldsend>true</combinefieldsend>
-			<fielddescr>Proxy Port</fielddescr>
 			<fieldname>proxy_port</fieldname>
-			<description>This is the port the Proxy Server will listen for client requests on.  The default is 3128.</description>
-			<size>4</size>
+			<fielddescr>Proxy port</fielddescr>
+			<description>This is the port the proxy server will listen on.</description>
+			<required/>
 			<type>input</type>
+			<size>5</size>
+			<default_value>3128</default_value>
 		</field>
-		
 		<field>
-			<fielddescr>ICP Port</fielddescr>
 			<fieldname>icp_port</fieldname>
-			<description>This is the port the Proxy Server will send and receive ICP queries to and from neighbor caches.  The default value is 0, which means this function is disabled.</description>
-			<size>4</size>
+			<fielddescr>ICP port</fielddescr>
+			<description>This is the port the Proxy Server will send and receive ICP queries to and from neighbor caches. Leave this blank if you don't want the proxy server to communicate with neighbor caches through ICP.</description>
 			<type>input</type>
+			<size>5</size>
 		</field>
-		
 		<field>
-			<fielddescr>Visible Hostname</fielddescr>
 			<fieldname>visible_hostname</fieldname>
-			<description>This URL is displayed on the Proxy Server error messages.</description>
-			<size>35</size>
+			<fielddescr>Visible hostname</fielddescr>
+			<description>This is the URL to be displayed in proxy server error messages.</description>
+			<default_value>localhost</default_value>
 			<type>input</type>
 		</field>
-		
 		<field>
-			<fielddescr>Cache Administrator E-Mail</fielddescr>
-			<fieldname>cache_admin_email</fieldname>
-			<description>This E-Mail address is displayed on the Proxy Server error messages.</description>
-			<size>35</size>
+			<fieldname>admin_email</fieldname>
+			<fielddescr>Administrator email</fielddescr>
+			<description>This is the email address displayed in error messages to the users.</description>
+			<default_value>admin@localhost</default_value>
 			<type>input</type>
 		</field>
-		
 		<field>
-			<fielddescr>Error Messages Language</fielddescr>
+			<fielddescr>Language</fielddescr>
 			<fieldname>error_language</fieldname>
-			<description>Select the language in which the Proxy Server shall display error messages to users.</description>
+			<description>Select the language in which the proxy server will display error messages to users.</description>
+			<default_value>English</default_value>
 			<type>select</type>
-			<options>
-				<option><name>Bulgarian</name><value>Bulgarian</value></option>
-				<option><name>Catalan</name><value>Catalan</value></option>
-				<option><name>Czech</name><value>Czech</value></option>
-				<option><name>Danish</name><value>Danish</value></option>
-				<option><name>Dutch</name><value>Dutch</value></option>
-				<option><name>English</name><value>English</value></option>
-				<option><name>Estonian</name><value>Estonian</value></option>
-				<option><name>Finnish</name><value>Finnish</value></option>
-				<option><name>French</name><value>French</value></option>
-				<option><name>German</name><value>German</value></option>
-				<option><name>Hebrew</name><value>Hebrew</value></option>
-				<option><name>Hungarian</name><value>Hungarian</value></option>
-				<option><name>Italian</name><value>Italian</value></option>
-				<option><name>Japanese</name><value>Japanese</value></option>
-				<option><name>Korean</name><value>Korean</value></option>
-				<option><name>Lithuanian</name><value>Lithuanian</value></option>
-				<option><name>Polish</name><value>Polish</value></option>
-				<option><name>Portuguese</name><value>Portuguese</value></option>
-				<option><name>Romanian</name><value>Romanian</value></option>
-				<option><name>Russian-1251</name><value>Russian-1251</value></option>
-				<option><name>Russian-koi8-r</name><value>Russian-koi8-r</value></option>
-				<option><name>Serbian</name><value>Serbian</value></option>
-				<option><name>Simplify Chinese</name><value>Simplify Chinese</value></option>
-				<option><name>Slovak</name><value>Slovak</value></option>
-				<option><name>Spanish</name><value>Spanish</value></option>
-				<option><name>Swedish</name><value>Swedish</value></option>
-				<option><name>Traditional Chinese</name><value>Traditional Chinese</value></option>
-				<option><name>Turkish</name><value>Turkish</value></option>
-			</options>
 		</field>
-				
 	</fields>
-	
-	<!-- The below writes the configuration as defined by the GUI options -->
-	<custom_php_global_functions>
-		function write_static_squid_config() {
-        	global $config;
-		$lancfg = $config['interfaces']['lan'];
-		$lanif = $lancfg['if'];
-		$lanip = $lancfg['ipaddr'];
-		$lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']);
-		$lansn = $lancfg['subnet'];
-		
-		$fout = fopen("/usr/local/etc/squid/squid.conf","w");
-		fwrite($fout, "#\n");
-		fwrite($fout, "# This file was automatically generated by the pfSense package manager.\n");
-		fwrite($fout, "# This default policy enables transparent proxy with no local disk logging.\n");
-		fwrite($fout, "#\n");
-		fwrite($fout, "shutdown_lifetime 5 seconds\n");            
-		fwrite($fout, "icp_port 0\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "acl QUERY urlpath_regex cgi-bin \?\n");
-		fwrite($fout, "no_cache deny QUERY\n");
-		fwrite($fout, "\n");
-			   
-		fwrite($fout, "pid_filename /var/run/squid.pid\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "cache_mem 8 MB\n");
-		fwrite($fout, "cache_dir diskd /var/squid/cache 500 16 256\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "error_directory /usr/local/etc/squid/errors/English\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "memory_replacement_policy heap GDSF\n");
-		fwrite($fout, "cache_replacement_policy heap GDSF\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "cache_access_log /dev/null\n");
-		fwrite($fout, "cache_log /dev/null\n");
-		fwrite($fout, "cache_store_log none\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "log_mime_hdrs off\n");
-		fwrite($fout, "emulate_httpd_log on\n");
-		fwrite($fout, "forwarded_for off\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "acl within_timeframe time MTWHFAS 00:00-24:00\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "acl all src " . $lansa . "/" . $lansn . "\n");
-		fwrite($fout, "acl localnet src " . $lansa . "/" . $lansn . "\n");
-		fwrite($fout, "acl localhost src 127.0.0.1/255.255.255.255\n");
-		fwrite($fout, "acl SSL_ports port 443 563 873 # https, snews, rsync\n");
-		fwrite($fout, "acl Safe_ports port 80 # http\n");
-		fwrite($fout, "acl Safe_ports port 21 # ftp\n");
-		fwrite($fout, "acl Safe_ports port 443 563 873 # https, snews, rsync\n");
-		fwrite($fout, "acl Safe_ports port 70 # gopher\n");
-		fwrite($fout, "acl Safe_ports port 210 # wais\n");
-		fwrite($fout, "acl Safe_ports port 1025-65535 # unregistered ports\n");
-		fwrite($fout, "acl Safe_ports port 280 # http-mgmt\n");
-		fwrite($fout, "acl Safe_ports port 488 # gss-http\n");
-		fwrite($fout, "acl Safe_ports port 591 # filemaker\n");
-		fwrite($fout, "acl Safe_ports port 777 # multiling http\n");
-		fwrite($fout, "acl Safe_ports port 800 # Squids port (for icons)\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "acl CONNECT method CONNECT\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "#access to squid; local machine; no restrictions\n");
-		fwrite($fout, "http_access allow localnet\n");
-		fwrite($fout, "http_access allow localhost\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "#Deny non web services\n");
-		fwrite($fout, "http_access deny !Safe_ports\n");
-		fwrite($fout, "http_access deny CONNECT !SSL_ports\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "#Set custom configured ACLs\n");
-		fwrite($fout, "http_access deny all\n");
-		fwrite($fout, "visible_hostname pfSense\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "cache_effective_user squid\n");
-		fwrite($fout, "cache_effective_group squid\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "maximum_object_size 4096 KB\n");
-		fwrite($fout, "minimum_object_size 0 KB\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "request_body_max_size 0 KB\n");
-		fwrite($fout, "reply_body_max_size 0 allow all\n");
-		fwrite($fout, "\n");
-		
-		fwrite($fout, "httpd_accel_host virtual\n");
-		fwrite($fout, "httpd_accel_port 80\n");
-		fwrite($fout, "httpd_accel_with_proxy on\n");
-		fwrite($fout, "httpd_accel_uses_host_header on\n");            
-		
-		fclose($fout);	
-		}
-	</custom_php_global_functions>
-	
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-
-		global_write_squid_config();
-		mwexec("/usr/local/sbin/squid -k reconfigure");
-	</custom_add_php_command_late>
-	
-	<custom_php_install_command>
-		write_static_squid_config();
-		
-		touch("/tmp/custom_php_install_command");
-
-		update_output_window("Creating Proxy Server initialization scripts...");
-		$fout = fopen("/usr/local/etc/rc.d/squid.sh","w");
-		fwrite($fout, "#!/bin/sh\n");
-		fwrite($fout, "#: /usr/local/etc/rc.d/squid.sh\n\n");
-		fwrite($fout, "touch /tmp/ro_root_mount\n");
-		fwrite($fout, "/usr/local/sbin/squid -D\n");
-		fwrite($fout, "touch /tmp/filter_dirty\n");
-		fclose($fout);
-		
-		mwexec("chmod 755 /usr/local/etc/rc.d/squid.sh");
-			
-		/* create log directory hierarchies if they don't exist */
-		update_output_window("Creating required directory hierarchies...");
-		
-		if (!file_exists("/var/squid/logs")) {
-			mwexec("mkdir -p /var/squid/logs");
-		}
-		mwexec("/usr/sbin/chown squid:squid /var/squid/logs");
-		
-		if (!file_exists("/var/squid/cache")) {
-			mwexec("mkdir -p /var/squid/cache");
-		}
-		mwexec("/usr/sbin/chown squid:squid /var/squid/cache");
-		
-		if (!file_exists("/usr/local/etc/squid/advanced/acls")) {
-			mwexec("mkdir -p /usr/local/etc/squid/advanced/acls");
-		}
-		mwexec("/usr/sbin/chown squid:squid /usr/local/etc/squid/advanced/acls");
-		
-		if (!file_exists("/usr/local/etc/squid/advanced/ncsa")) {
-			mwexec("mkdir -p /usr/local/etc/squid/advanced/ncsa");
-		}
-		mwexec("/usr/sbin/chown squid:squid /usr/local/etc/squid/advanced/ncsa");
-			
-		if (!file_exists("/usr/local/etc/squid/advanced/ntlm")) {
-			mwexec("mkdir -p /usr/local/etc/squid/advanced/ntlm");
-		}
-		mwexec("/usr/sbin/chown squid:squid /usr/local/etc/squid/advanced/ntlm");		
-		
-		if (!file_exists("/usr/local/etc/squid/advanced/radius")) {
-			mwexec("mkdir -p /usr/local/etc/squid/advanced/radius");
-		}
-		mwexec("/usr/sbin/chown squid:squid /usr/local/etc/squid/advanced/radius");
-		
-		/*    EmanuelG: update pf group ownership settings to enhance squid performance and correct issue relating 
-		 *              to error message: parseHttpRequest: PF open failed: (13) Permission denied
-		 */
-		mwexec("chgrp squid /dev/pf");
-		mwexec("chmod g+rw /dev/pf");
-		
-		$devfs_file = fopen("/etc/devfs.conf", "a");
-		fwrite($devfs_file, "\n# Allow squid to query the packet filter bymaking is group-accessable. ");
-		fwrite($devfs_file, "own pf root:squid");
-		fwrite($devfs_file, "perm pf 0640"); 
-		fclose($devfs_file);
-		
-		update_output_window("Initializing Cache... This may take a moment...");
-		mwexec("/usr/local/sbin/squid -z");
-		
-		write_static_squid_config();
-		
-		update_output_window("Starting Proxy Server...");
-		mwexec("/usr/local/etc/rc.d/squid.sh");
-		filter_configure();	
-	</custom_php_install_command>
-
-	<custom_php_deinstall_command>
-		update_output_window("Stopping proxy service...");
-		
-		do while ((file_exists("/var/run/squid.pid") or ($i == 30)) {
-			mwexec("/usr/local/sbin/squid -k shutdown");
-			$i++;
-		}
-		
-		/* brute force any remaining squid processes out */
-		mwxec("/usr/bin/killall squid");
-	
-		update_output_window("Recursively removing directories hierarchies...");
-		update_output_window("If existant, log files in /var/squid/logs will remain...");
-		mwexec("rm -rf /usr/local/squid");
-		mwexec("rm -rf /var/squid/cache");	
-		mwexec("rm -rf /usr/local/etc/squid");
-		
-		update_output_window("Removing configuration files...");
-		unlink_if_exists("/usr/local/etc/rc.d/squid.sh");
-		unlink_if_exists("/usr/local/etc/squid");
-		unlink_if_exists("/usr/local/libexec/squid");
-		
-		filter_configure();
-	</custom_php_deinstall_command>
-	
-	<start_command>/usr/local/etc/rc.d/squid.sh</start_command>
-	
-	<process_kill_command>/usr/local/sbin/squid -k shutdown</process_kill_command>
-	
+	<custom_php_command_before_form>
+		squid_before_form_general(&amp;$pkg);
+	</custom_php_command_before_form>
+	<custom_php_validation_command>
+		squid_validate_general($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
 </packagegui>
-			
diff --git a/packages/squid_auth.xml b/packages/squid_auth.xml
index f1d0d14c..4cc7a38b 100644
--- a/packages/squid_auth.xml
+++ b/packages/squid_auth.xml
@@ -1,136 +1,144 @@
-<?xml version="1.0" encoding="utf-8" ?>
-
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
+	<include_file>squid.inc</include_file>
 	<name>squidauth</name>
-	<title>Services: Proxy Server -> Authentication Settings</title>
-	<category>Security</category>
-	<version>2.5.10_4</version>
-	<configpath>installedpackages->package->squidauth->configuration->settings</configpath>
-
-	<files></files>
-	<menu></menu>
-	
-	<aftersaveredirect>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</aftersaveredirect>
-	
+	<title>Proxy server: Authentication</title>
 	<tabs>
 		<tab>
-			<text>General Settings</text>
-			<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 			<active/>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>
-		</tab>		
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.xml</url>
+		</tab>
 	</tabs>
-	
 	<fields>
 		<field>
-			<fielddescr>Authentication Methods</fielddescr>
+			<fielddescr>Authentication method</fielddescr>
 			<fieldname>auth_method</fieldname>
-			<description>Select a valid authentication method.  This will allow users to be authenticated by external entities or a minimum, a local password in order to access websites.  The default value is "None".</description>
+			<description>Select an authentication method. This will allow users to be authenticated by local or external services.</description>
+			<default_value>none</default_value>
+			<required/>
 			<type>select</type>
 			<options>
 				<option><name>None</name><value>none</value></option>
-				<option><name>Local Authentication</name><value>local_auth</value></option>
-				<option><name>LDAP Authentication</name><value>ldap_bind</value></option>
-				<option><name>NT Domain Authentication</name><value>domain_auth</value></option>
-				<option><name>RADIUS Authentication</name><value>radius_auth</value></option>
+				<option><name>Local</name><value>local</value></option>
+				<option><name>LDAP</name><value>ldap</value></option>
+				<option><name>RADIUS</name><value>radius</value></option>
+				<option><name>NT domain</name><value>msnt</value></option>
 			</options>
+			<onchange>on_auth_method_changed()</onchange>
 		</field>
-	
 		<field>
-			<fielddescr>Number of Authentication Processes</fielddescr>
-			<fieldname>auth_processes</fieldname>
-			<description>The number of authenticator processes to spawn at one time.  If many authentications are expected within a short timeframe, increase this number accordingly.  The default value is 5.</description>
+			<fieldname>auth_server</fieldname>
+			<fielddescr>Authentication server</fielddescr>
+			<description>Enter here the IP or hostname of the server that will perform the authentication.</description>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>Authentication Cache TTL (in minutes)</fielddescr>
-			<fieldname>auth_cache_ttl</fieldname>
-			<description>This specifies how long Squid assumes an externally validated username and password combination is valid for.  Upon reaching the timeframe set within this value, user(s) will be re-prompted to authenticate.</description>
+			<fieldname>auth_server_port</fieldname>
+			<fielddescr>Authentication server port</fielddescr>
+			<description>Enter here the port to use to connect to the authentication server. Leave this field blank to use the authentication method's default port.</description>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>Limit IP Addresses per User</fielddescr>
-			<fieldname>limit_ip_addr</fieldname>
-			<description>A number can be specified to enforce restrictions to prevent potential replay attacks limiting the number of times a user can login from a different source IP address.  The default value is 2.</description>
+			<fieldname>ldap_user</fieldname>
+			<fielddescr>LDAP server user DN</fielddescr>
+			<description>Enter here the user DN to use to connect to the LDAP server.</description>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>User/IP Cache TTL (in minutes)</fielddescr>
-			<fieldname>user_ip_cache_ttl</fieldname>
-			<description>This value controls how long the proxy will remember the IP address that is associated with a user.  This is used in conjuction with the above option.</description>
+			<fieldname>ldap_password</fieldname>
+			<fielddescr>LDAP password</fielddescr>
+			<description>Enter here the password to use to connect to the LDAP server.</description>
+			<type>password</type>
+		</field>
+		<field>
+			<fieldname>ldap_basedomain</fieldname>
+			<fielddescr>LDAP base domain</fielddescr>
+			<description>For LDAP authentication, enter here the base domain in the LDAP server.</description>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>Require Authentication for Unrestricted Source Addresses</fielddescr>
-			<fieldname>req_unrestricted_auth</fieldname>
-			<description></description>
-			<type>checkbox</type>
+			<fieldname>radius_secret</fieldname>
+			<fielddescr>RADIUS secret</fielddescr>
+			<description>The RADIUS secret for RADIUS authentication.</description>
+			<type>password</type>
+		</field>
+		<field>
+			<fieldname>msnt_secondary</fieldname>
+			<fielddescr>Secondary NT servers</fielddescr>
+			<description>Comma-separated list of secondary servers to be used for NT domain authentication.</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>auth_prompt</fieldname>
+			<fielddescr>Authentication prompt</fielddescr>
+			<description>This string will be displayed at the top of the authentication request window.</description>
+			<default_value>Please enter your credentials to access the proxy</default_value>
+			<type>input</type>
 		</field>
-		
 		<field>
-			<fielddescr>Authentication Realm Prompt</fielddescr>
-			<fieldname>auth_realm_prompt</fieldname>
-			<description>This text will be displayed at the top of the authentication request window.</description>
+			<fieldname>auth_processes</fieldname>
+			<fielddescr>Authentication processes</fielddescr>
+			<description>The number of authenticator processes to spawn. If many authentications are expected within a short timeframe, increase this number accordingly.</description>
+			<default_value>5</default_value>
 			<type>input</type>
-			<size>40</size>
 		</field>
-		
 		<field>
-			<fielddescr>Domains Without Authentication</fielddescr>
-			<fieldname>no_domain_auth</fieldname>
-			<description></description>
+			<fieldname>auth_ttl</fieldname>
+			<fielddescr>Authentication TTL</fielddescr>
+			<description>This specifies for how long (in minutes) the proxy server assumes an externally validated username and password combination is valid (Time To Live).  When the TTL expires, the user will be prompted for credentials again.</description>
+			<default_value>60</default_value>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>unrestricted_auth</fieldname>
+			<fielddescr>Requiere authentication for unrestricted hosts</fielddescr>
+			<description>If this option is enabled, even users tagged as unrestricted through access control are required to authenticate to use the proxy.</description>
+			<type>checkbox</type>
+		</field>
+		<field>
+			<fieldname>no_auth_hosts</fieldname>
+			<fielddescr>Subnets that don't need authentication</fielddescr>
+			<description>A comma-separated list of subnets (in CIDR range, e.g.: 10.5.0.0/16, 192.168.1.50/32) whose hosts won't be asked for authentication to access the proxy.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-
 	</fields>
-	
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-		require_once("/usr/local/pkg/squid_auth.inc");
-						
-		global_eval_auth_options();
-		
-		global_write_squid_config();
-		mwexec_bg("/usr/local/sbin/squid -k reconfigure");		
-	</custom_add_php_command_late>
-
-</packagegui>
\ No newline at end of file
+	<custom_php_after_head_command>
+		squid_print_javascript_auth();
+	</custom_php_after_head_command>
+	<custom_php_validation_command>
+		squid_validate_auth($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_after_form_command>
+		squid_print_javascript_auth2();
+	</custom_php_after_form_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/packages/squid_cache.xml b/packages/squid_cache.xml
index 33fc5f5e..b70c1052 100644
--- a/packages/squid_cache.xml
+++ b/packages/squid_cache.xml
@@ -1,93 +1,81 @@
-<?xml version="1.0" encoding="utf-8" ?>
-
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
+	<include_file>squid.inc</include_file>
 	<name>squidcache</name>
-	<title>Services: Proxy Server -> Cache Management</title>		
-	<configpath>installedpackages->package->squidcache->configuration->settings</configpath>
-		
-	<aftersaveredirect>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</aftersaveredirect>
-
+	<title>Proxy server: Cache management</title>		
 	<tabs>
 		<tab>
-			<text>General Settings</text>
-			<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 			<active/>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.inc</url>
 		</tab>
 	</tabs>
-	
 	<fields>
 		<field>
-			<fielddescr>Memory Cache Size (MB)</fielddescr>
-			<fieldname>memory_cache_size</fieldname>
-			<description>This is the amount of physical RAM to be used for negative cache and in-transit objects.  This value should not exceed more than 50% of installed RAM.  The minimum value is 1MB; the default is 8MB</description>
-			<size>4</size>
+			<fielddescr>Hard disk cache size</fielddescr>
+			<fieldname>harddisk_cache_size</fieldname>
+			<description>This is the amount of disk space (in megabytes) to use for cached objects.</description>
+			<required/>
+			<default_value>100</default_value>
 			<type>input</type>
-			<validation>number</validation>
 		</field>
-		
 		<field>
-			<fielddescr>Hard Disk Cache Size (MB)</fielddescr>
-			<fieldname>harddisk_cache_size</fieldname>
-			<description>This is the amount of disk space (MB) to use for cached objects.  The default is 50MB.</description>
-			<size>4</size>
+			<fielddescr>Memory cache size</fielddescr>
+			<fieldname>memory_cache_size</fieldname>
+			<description>This is the amount of physical RAM (in megabytes) to be used for negative cache and in-transit objects.  This value should not exceed more than 50% of the installed RAM. The minimum value is 1MB.</description>
+			<required/>
+			<default_value>8</default_value>
 			<type>input</type>
-			<validation>number</validation>
 		</field>
-		
 		<field>
-			<fielddescr>Minimum Object Size (KB)</fielddescr>
+			<fielddescr>Minimum object size</fielddescr>
 			<fieldname>minimum_object_size</fieldname>
-			<description>Objects smaller than the size specified will not be saved on disk.  This value is specified in kilobytes and the default is 0, meaning there is no minimum.</description>
-			<size>4</size>
+			<description>Objects smaller than the size specified (in kilobytes) will not be saved on disk. The default value is 0, meaning there is no minimum.</description>
+			<required/>
+			<default_value>0</default_value>
 			<type>input</type>
-			<validation>number</validation>
 		</field>
-		
 		<field>
-			<fielddescr>Maximum Object Size (KB)</fielddescr>
+			<fielddescr>Maximum object size</fielddescr>
 			<fieldname>maximum_object_size</fieldname>
-			<description>Objects larger than the size specified will not be saved on disk.  This value is specified in kilobytes and the default is 4MB.  If you wish to increase speed more than you want to save bandwidth, this should be set to a low value.</description>
-			<size>4</size>
+			<description>Objects larger than the size specified (in kilobytes) will not be saved on disk. If you wish to increase speed more than you want to save bandwidth, this should be set to a low value.</description>
+			<required/>
+			<default_value>4</default_value>
 			<type>input</type>
-			<validation>number</validation>
 		</field>
-		
 		<field>
-			<fielddescr>Number of Level-1 Subdirectories</fielddescr>
-			<fieldname>level_subdirs</fieldname>
-			<description>The default for this value is 16.  Each level-1 directory contains 256 subdirectories, so a value of 256 level-1 directories will use a total of 65536 directories for the hard disk cache.  This will significantly slow down the startup process of the proxy service, but can speed up the caching under certain conditions.</description>
+			<fielddescr>Level 1 subdirectories</fielddescr>
+			<fieldname>level1_subdirs</fieldname>
+			<description>Each level-1 directory contains 256 subdirectories, so a value of 256 level-1 directories will use a total of 65536 directories for the hard disk cache.  This will significantly slow down the startup process of the proxy service, but can speed up the caching under certain conditions.</description>
+			<default_value>16</default_value>
 			<type>select</type>
 			<options>
+				<option><name>4</name><value>4</value></option>
+				<option><name>8</name><value>8</value></option>
 				<option><name>16</name><value>16</value></option>
 				<option><name>32</name><value>32</value></option>
 				<option><name>64</name><value>64</value></option>
@@ -95,11 +83,11 @@
 				<option><name>256</name><value>256</value></option>
 			</options>
 		</field>
-		
 		<field>
-			<fielddescr>Memory Replacement Policy</fielddescr>
+			<fielddescr>Memory replacement policy</fielddescr>
 			<fieldname>memory_replacement</fieldname>
 			<description>The memory replacement policy determines which objects are purged from memory when space is needed.  The default policy for memory replacement is GSDF.  &lt;p&gt; &lt;b&gt; LRU: Last Recently Used Policy &lt;/b&gt; - The LRU policies keep recently referenced objects.  i.e., it replaces the object that has not been accessed for the longest time. &lt;p&gt; &lt;b&gt; Heap GSDF: Greedy-Dual Size Frequency &lt;/b&gt; - The Heap GSDF policy optimizes object-hit rate by keeping smaller, popular objects in cache.  It achieves a lower byte hit rate than LFUDA though, since it evicts larger (possibly popular) objects.  &lt;p&gt; &lt;b&gt; Heap LFUDA: Least Frequently Used with Dynamic Aging &lt;/b&gt; - The Heap LFUDA policy keeps popular objects in cache regardless of their size and thus optimizes byte hit rate at the expense of hit rate since one large, popular object will prevent many smaller, slightly less popular objects from being cached.  &lt;p&gt; &lt;b&gt; Heap LRU: Last Recently Used &lt;/b&gt; - Works like LRU, but uses a heap instead. &lt;p&gt; Note: If using the LFUDA replacement policy, the value of Maximum Object Size should be increased above its default of 4096 KB to maximuze the potential byte hit rate improvement of LFUDA.</description>
+			<default_value>heap GSDF</default_value>
 			<type>select</type>
 			<options>
 				<option><name>LRU</name><value>lru</value></option>
@@ -108,11 +96,11 @@
 				<option><name>Heap LRU</name><value>heap LRU</value></option>
 			</options>
 		</field>
-		
 		<field>
-			<fielddescr>Cache Replacement Policy</fielddescr>
+			<fielddescr>Cache replacement policy</fielddescr>
 			<fieldname>cache_replacement</fieldname>
 			<description>The cache replacement policy decides which objects will remain in cache and which objects are replaced to create space for the new objects.  The default policy for cache replacement is LFUDA.  Please see the type descriptions specified in the memory replacement policy for additional detail.</description>
+			<default_value>heap LFUDA</default_value>
 			<type>select</type>
 			<options>
 				<option><name>LRU</name><value>lru</value></option>
@@ -121,30 +109,26 @@
 				<option><name>Heap LRU</name><value>heap LRU</value></option>
 			</options>
 		</field>
-	
 		<field>
-			<fielddescr>Domain</fielddescr>
-			<fieldname>domain</fieldname>
-			<description>If required, the specified domains will never be cached.  Enter domains separated by a semicolon (;).</description>
+			<fielddescr>Do not cache</fielddescr>
+			<fieldname>donotcache</fieldname>
+			<description>The specified domains or IP addresses (separated by commas) will never be cached.</description>
 			<type>textarea</type>
-			<rows>10</rows>
+			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-
 		<field>
-			<fielddescr>Enable Offline Mode</fielddescr>
+			<fielddescr>Enable offline mode</fielddescr>
 			<fieldname>enable_offline</fieldname>
-			<description></description>
+			<description>Enable this option and the proxy server will never try to validate cached objects. The offline mode gives access to more cached information than the proposed feature would allow (stale cached versions, where the origin server should have been contacted).</description>
+			<required/>
 			<type>checkbox</type>
 		</field>
-					
 	</fields>
-	
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-
-		global_write_squid_config();
-		mwexec("/usr/local/sbin/squid -k reconfigure");
-	</custom_add_php_command_late>
-	
-</packagegui>
\ No newline at end of file
+	<custom_php_validation_command>
+		squid_validate_cache($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/packages/squid_nac.xml b/packages/squid_nac.xml
index 3b4833e8..bcf25a8e 100644
--- a/packages/squid_nac.xml
+++ b/packages/squid_nac.xml
@@ -1,112 +1,101 @@
-<?xml version="1.0" encoding="utf-8" ?>
-
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
+	<include_file>squid.inc</include_file>
 	<name>squidnac</name>
-	<title>Services: Proxy Server -> Network Access Control</title>		
-	<configpath>installedpackages->package->squidnac->configuration->settings</configpath>		
-
-	<aftersaveredirect>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</aftersaveredirect>
-
+	<title>Proxy server: Access control</title>
 	<tabs>
 		<tab>
-			<text>General Settings</text>
-			<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 			<active/>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>
-		</tab>		
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.inc</url>
+		</tab>
 	</tabs>
-	
 	<fields>
 		<field>
-			<fielddescr>Allowed Subnets</fielddescr>
 			<fieldname>allowed_subnets</fieldname>
-			<description>Subnets must be entered in the format of Network Address / Subnet Mask (e.g.: 192.168.1.0/24).  Enter domains separated by a semicolon (;).</description>
+			<fielddescr>Allowed subnets</fielddescr>
+			<description>Those are the subnets (separated by commas) that are allowed to use the proxy. The subnets must be expressed as CIDR ranges (e.g.: 192.168.1.0/24). Note that the proxy interface subnet is already an allowed subnet. All the other subnets won't be able to use the proxy.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-		
 		<field>
-			<fielddescr>Unrestricted IP Addresses</fielddescr>
-			<fieldname>unrestricted_ip_address</fieldname>
-			<description>Specify each unrestricted IP address separated by a semicolon (;).</description>
+			<fieldname>unrestricted_hosts</fieldname>
+			<fielddescr>Unrestricted IPs</fielddescr>
+			<description>The IP addresses specified here (separated by commas) won't be filtered out by the other access control directives set in this page.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-		
 		<field>
+			<fieldname>unrestricted_macs</fieldname>
 			<fielddescr>Unrestricted MAC Addresses</fielddescr>
-			<fieldname>unrestricted_mac_addresses</fieldname>
-			<description>Specify each unrestricted MAC address separated by a semicolon (;).</description>
+			<description>The MAC addresses specified here (separated by commas) won't be filtered out by the other access control directives set in this page.</description>
 			<type>textarea</type>
 			<rows>5</rows>
-			<cols>50</cols>		
+			<cols>50</cols>
 		</field>
-		
 		<field>
-			<fielddescr>Banned IP Addresses</fielddescr>
-			<fieldname>banned_ip_addresses</fieldname>
-			<description>Specify each banned IP address separated by a semicolon (l).</description>
+			<fieldname>banned_hosts</fieldname>
+			<fielddescr>Banned host addresses</fielddescr>
+			<description>The IP addresses specified here (separated by commas) won't be allowed to use the proxy.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>	
-		
 		<field>
-			<fielddescr>Banned MAC Addresses</fielddescr>
-			<fieldname>banned_mac_addresses</fieldname>
-			<description>Specify each banned MAC address separated by a semicolon (;).</description>
+			<fieldname>banned_macs</fieldname>
+			<fielddescr>Banned MAC addresses</fielddescr>
+			<description>The MAC addresses specified here (separated by commas) won't be allowed to use the proxy.</description>
+			<type>textarea</type>
+			<rows>5</rows>
+			<cols>50</cols>
+		</field>
+		<field>
+			<fieldname>whitelist</fieldname>
+			<fielddescr>Whitelist</fielddescr>
+			<description>Those are the sites (separated by commas) that will be accessable to the users that are allowed to use the proxy.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-		
 		<field>
-			<fielddescr>Override Host(s)</fielddescr>
-			<fieldname>override_hosts</fieldname>
-			<description>In order to allow override hosts where proxy authentication, if configured, will be bypassed and allowed transparent, please specify each host (IP or FQDN) separated by a semicolon (;).</description>
+			<fieldname>blacklist</fieldname>
+			<fielddescr>Blacklist</fielddescr>
+			<description>Those are the sites (separated by commas) that will be blocked to the users that are allowed to use the proxy.</description>
 			<type>textarea</type>
 			<rows>5</rows>
 			<cols>50</cols>
 		</field>
-	
 	</fields>
-
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-
-		global_write_squid_config();
-		mwexec("/usr/local/sbin/squid -k reconfigure");
-	</custom_add_php_command_late>
-
-</packagegui>
\ No newline at end of file
+	<custom_php_validation_command>
+		squid_validate_nac($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/packages/squid_traffic.xml b/packages/squid_traffic.xml
index 45b1ca76..05e614b6 100644
--- a/packages/squid_traffic.xml
+++ b/packages/squid_traffic.xml
@@ -1,128 +1,109 @@
-<?xml version="1.0" encoding="utf-8" ?>
-
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
+	<include_file>squid.inc</include_file>
 	<name>squidtraffic</name>
-	<title>Services: Proxy Server -> Traffic Management</title>		
-	<configpath>installedpackages->package->squidtraffic->configuration->settings</configpath>
-		
-	<aftersaveredirect>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</aftersaveredirect>
-
+	<title>Proxy server: Traffic management</title>		
 	<tabs>
 		<tab>
-			<text>General Settings</text>
-			<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 			<active/>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.inc</url>
 		</tab>
 	</tabs>
-	
 	<fields>
 		<field>
-			<fielddescr>Maximum Download Size (KB)</fielddescr>
 			<fieldname>max_download_size</fieldname>
-			<description>This value allows limitation to download size (in KB) for each download request.  The default value is 0, which disables the limitation.</description>
+			<fielddescr>Maximum download size</fielddescr>
+			<description>Limit the maximum total download size to the size specified here (in kilobytes). Set to 0 to disable.</description>
+			<default_value>0</default_value>
+			<required/>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>Maximum Upload Size (KB)</fielddescr>
 			<fieldname>max_upload_size</fieldname>
-			<description>This value allows limitation to upload size (in KB) for each upload request.  The default value is 0, which disables the limitation.</description>
+			<fielddescr>Maximum upload size</fielddescr>
+			<description>Limit the maximum total upload size to the size specified here (in kilobytes). Set to 0 to disable.</description>
+			<default_value>0</default_value>
+			<required/>
 			<type>input</type>
-			<size>4</size>
 		</field>
-		
 		<field>
-			<fielddescr>Download Throttle on Interface</fielddescr>
-			<fieldname>dl_overall</fieldname>
-			<description>This value specifies the bandwidth throttle on the interface if desired.</description>
-			<type>select</type>
-			<options>
-				<option><name>64 kBit/s</name><value>64</value></option>
-				<option><name>128 kBit/s</name><value>128</value></option>
-				<option><name>256 kBit/s</name><value>256</value></option>
-				<option><name>512 kBit/s</name><value>512</value></option>
-				<option><name>1024 kBit/s</name><value>1024</value></option>
-				<option><name>2048 kBit/s</name><value>2048</value></option>
-				<option><name>3072 kBit/s</name><value>3072</value></option>
-				<option><name>5120 kBit/s</name><value>5120</value></option>
-				<option><name>Unlimited</name><value>unlimited</value></option>
-			</options>
+			<fieldname>overall_throttling</fieldname>
+			<fielddescr>Overall bandwidth throttling</fielddescr>
+			<description>This value specifies (in kilobytes per second) the bandwidth throttle for downloads. Users will gradually have their download speed increased according to this value. Set to 0 to disable bandwidth throttling.</description>
+			<default_value>0</default_value>
+			<required/>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>perhost_throttling</fieldname>
+			<fielddescr>Per-host throttling</fielddescr>
+			<description>This value specifies the download throttling per host. Set to 0 to disable this.</description>
+			<default_value>0</default_value>
+			<required/>
+			<type>input</type>
 		</field>
-	
 		<field>
-			<fielddescr>Download Limit Per Host</fielddescr>
-			<fieldname>dl_per_host</fieldname>
-			<description>This value specifies the download limit per host if desired.</description>
-			<type>select</type>
-			<options>
-				<option><name>64 kBit/s</name><value>64</value></option>
-				<option><name>128 kBit/s</name><value>128</value></option>
-				<option><name>256 kBit/s</name><value>256</value></option>
-				<option><name>512 kBit/s</name><value>512</value></option>
-				<option><name>1024 kBit/s</name><value>1024</value></option>
-				<option><name>2048 kBit/s</name><value>2048</value></option>
-				<option><name>3072 kBit/s</name><value>3072</value></option>
-				<option><name>5120 kBit/s</name><value>5120</value></option>
-				<option><name>Unlimited</name><value>unlimited</value></option>
-			</options>
+			<fieldname>throttle_specific</fieldname>
+			<fielddescr>Throttle only specific extensions</fielddescr>
+			<description>Leave this checked to be able to choose the extensions that throttling will be applied to. Otherwise, all files will be throttled.</description>
+			<default_value>on</default_value>
+			<type>checkbox</type>
+			<enablefields>throttle_binaries,throttle_cdimages,throttle_multimedia,throttle_others</enablefields>
 		</field>
-		
 		<field>
-			<fielddescr>Throttle Binary Files</fielddescr>
-			<fieldname>throttle_binary_files</fieldname>
+			<fieldname>throttle_binaries</fieldname>
+			<fielddescr>Throttle binary files</fielddescr>
+			<description>Check this to apply bandwidth throttle to binary files. This includes compressed archives and executables.</description>
 			<type>checkbox</type>
 		</field>
-		
 		<field>
-			<fielddescr>Throttle CD Images</fielddescr>
-			<fieldname>throttle_cd_images</fieldname>
+			<fieldname>throttle_cdimages</fieldname>
+			<fielddescr>Throttle CD images</fielddescr>
+			<description>Check this to apply bandwidth throttle to CD image files.</description>
 			<type>checkbox</type>
 		</field>
-		
 		<field>
-			<fielddescr>Throttle Multimedia</fielddescr>
 			<fieldname>throttle_multimedia</fieldname>
+			<fielddescr>Throttle multimedia files</fielddescr>
+			<description>Check this to apply bandwidth throttle to multimedia files, such as movies or songs.</description>
 			<type>checkbox</type>
 		</field>
-			
+		<field>
+			<fieldname>throttle_others</fieldname>
+			<fielddescr>Throttle other extensions</fielddescr>
+			<description>Comma-separated list of extensions to apply bandwidth throttle to.</description>
+			<type>input</type>
+		</field>
 	</fields>
-	
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-
-		global_write_squid_config();
-		mwexec("/usr/local/sbin/squid -k reconfigure");
-	</custom_add_php_command_late>
-	
-</packagegui>
\ No newline at end of file
+	<custom_php_validation_command>
+		squid_validate_traffic($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/packages/squid_upstream.xml b/packages/squid_upstream.xml
index 06782610..37ec80ff 100644
--- a/packages/squid_upstream.xml
+++ b/packages/squid_upstream.xml
@@ -1,109 +1,87 @@
-<?xml version="1.0" encoding="utf-8" ?>
-
+<?xml version="1.0" encoding="utf-8"?>
 <packagegui>
+	<include_file>squid.inc</include_file>
 	<name>squidupstream</name>
-	<title>Services: Proxy Server -> Upstream Proxy Settings</title>		
-	<configpath>installedpackages->package->squidupstream->configuration->settings</configpath>
-	
-	<aftersaveredirect>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</aftersaveredirect>
-
+	<title>Proxy server: Upstream proxy settings</title>		
 	<tabs>
 		<tab>
-			<text>General Settings</text>
-			<url>/pkg_edit.php?xml=squid_ng.xml&amp;id=0</url>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Upstream Proxy</text>
+			<text>Upstream proxy</text>
 			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
 			<active/>
 		</tab>
-		
 		<tab>
-			<text>Cache Mgmt</text>
+			<text>Cache management</text>
 			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Network Access Control</text>
+			<text>Access control</text>
 			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Traffic Mgmt</text>
+			<text>Traffic management</text>
 			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
 		</tab>
-			
 		<tab>
-			<text>Auth Settings</text>
+			<text>Auth settings</text>
 			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
 		</tab>
-		
 		<tab>
-			<text>Extended Auth Settings</text>
-			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.in</url>
 		</tab>
 	</tabs>
-	
 	<fields>
 		<field>
-			<fielddescr>Proxy Address Forwarding</fielddescr>
+			<fielddescr>Enable forwarding</fielddescr>
 			<fieldname>proxy_forwarding</fieldname>
-			<description>This option will enable the Proxy Server to forward requests to an upstream server.</description>
+			<description>This option enables the proxy server to forward requests to an upstream server.</description>
+			<required/>
 			<type>checkbox</type>
+			<enablefields>proxy_addr,proxy_port,icp_port,username,password</enablefields>
 		</field>
-		
 		<field>
-			<fielddescr>Client IP Address Forwarding</fielddescr>
-			<fieldname>client_ip_forwarding</fieldname>
-			<description>This option will enable the client IP address to be forwarded to the upstream proxy server.</description>
-			<type>checkbox</type>
-		</field>
-		
-		<field>
-			<fielddescr>Username Forwarding</fielddescr>
-			<fieldname>user_forwarding</fieldname>
-			<description>This option will enable the username to be forwarded to the upstream proxy server.</description>
-			<type>checkbox</type>
+			<fielddescr>Hostname</fielddescr>
+			<fieldname>proxy_addr</fieldname>
+			<description>Enter here the IP address or host name of the upstream proxy.</description>
+			<type>input</type>
 		</field>
-		
 		<field>
-			<fielddescr>Upstream Proxy Hostname</fielddescr>
-			<fieldname>upstream_proxy</fieldname>
-			<description>Enter the IP address or host name of the upstream proxy server.</description>
+			<fielddescr>TCP port</fielddescr>
+			<fieldname>proxy_port</fieldname>
+			<description>Enter the port to use to connect to the upstream proxy.</description>
+			<default_value>3128</default_value>
 			<type>input</type>
-			<validation>number</validation>
+			<size>5</size>
 		</field>
-		
 		<field>
-			<fielddescr>Upstream Proxy Port</fielddescr>
-			<fieldname>upstream_proxy_port</fieldname>
-			<description>Enter the port to use with the upstream proxy server.  If no port is specified, the default is set to port "80".</description>
-			<size>4</size>
+			<fielddescr>ICP port</fielddescr>
+			<fieldname>icp_port</fieldname>
+			<description>Enter the port to connect to the upstream proxy for the ICP protocol. Use port number 7 to disable ICP communication between the proxies.</description>
+			<default_value>7</default_value>
 			<type>input</type>
-			<validation>number</validation>
+			<size>5</size>
 		</field>
-		
 		<field>
-			<fielddescr>Upstream Username</fielddescr>
-			<fieldname>upstream_username</fieldname>
+			<fielddescr>Username</fielddescr>
+			<fieldname>username</fieldname>
 			<description>If the upstream proxy requires a username, specify it here.</description>
 			<type>input</type>
 		</field>
-		
 		<field>
-			<fielddescr>Upstream Password</fielddescr>
-			<fieldname>upstream_password</fieldname>
-			<description>If the upstream proxy server requires a password with the above username, specify it here.</description>
+			<fielddescr>Password</fielddescr>
+			<fieldname>password</fieldname>
+			<description>If the upstream proxy requires a password, specify it here.</description>
 			<type>password</type>
 		</field>
 	</fields>
-	
-	<custom_add_php_command_late>	
-		require_once("/usr/local/pkg/squid_ng.inc");
-
-		global_write_squid_config();
-		mwexec("/usr/local/sbin/squid -k reconfigure");
-	</custom_add_php_command_late>
-			
-</packagegui>	
\ No newline at end of file
+	<custom_php_validation_command>
+		squid_validate_upstream($_POST, &amp;$input_errors);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		squid_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/packages/squid_users.xml b/packages/squid_users.xml
new file mode 100644
index 00000000..4e70b7de
--- /dev/null
+++ b/packages/squid_users.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packagegui>
+	<include_file>squid.inc</include_file>
+	<name>squidusers</name>
+	<title>Proxy server: Local users</title>
+	<delete_string>A proxy server user has been deleted.</delete_string>
+	<addedit_string>A proxy server user has been created/modified.</addedit_string>
+	<tabs>
+		<tab>
+			<text>General settings</text>
+			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Upstream proxy</text>
+			<url>/pkg_edit.php?xml=squid_upstream.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Cache management</text>
+			<url>/pkg_edit.php?xml=squid_cache.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Access control</text>
+			<url>/pkg_edit.php?xml=squid_nac.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Traffic management</text>
+			<url>/pkg_edit.php?xml=squid_traffic.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Auth settings</text>
+			<url>/pkg_edit.php?xml=squid_auth.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Local users</text>
+			<url>/pkg.php?xml=squid_users.inc</url>
+			<active/>
+		</tab>
+	</tabs>
+	<adddeleteeditpagefields>
+		<columnitem>
+			<fieldname>username</fieldname>
+			<fielddescr>Username</fielddescr>
+		</columnitem>
+		<columnitem>
+			<fieldname>description</fieldname>
+			<fielddescr>Description</fielddescr>
+		</columnitem>
+	</adddeleteeditpagefields>
+	<fields>
+		<field>
+			<fieldname>username</fieldname>
+			<fielddescr>Username</fielddescr>
+			<description>Enter the username here.</description>
+			<required/>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>password</fieldname>
+			<fielddescr>Password</fielddescr>
+			<description>Enter the password here.</description>
+			<required/>
+			<type>password</type>
+		</field>
+		<field>
+			<fieldname>description</fieldname>
+			<fielddescr>Description</fielddescr>
+			<description>You may enter a description here for your reference (not parsed).</description>
+			<type>input</type>
+		</field>
+	</fields>
+	<custom_php_resync_config_command>
+		squid_resync_users();
+	</custom_php_resync_config_command>
+</packagegui>