Many performance and stability enhancements.

3 files changed, 496 insertions, 381 deletions

diff --git a/packages/squid_auth.inc b/packages/squid_auth.inc
index ae431f22..e5eb2d2a 100644
--- a/packages/squid_auth.inc
+++ b/packages/squid_auth.inc
@@ -31,21 +31,21 @@
 
 */
 
-function global_eval_auth_options(){
+function global_eval_auth_options() 
+{
+	global $config;
 	conf_mount_rw();
 	config_lock();
 	
-	global $config;
-	
-	$auth_method = $config['installedpackages']['squidauth']['config'][0]['auth_method'];
-	
-	switch ($auth_method) {
+	switch ($config['installedpackages']['squidauth']['config'][0]['auth_method']) {
 		case "none":
 			dynamic_auth_content("pkg_edit");
 			dynamic_no_auth();
 			break;
 		case "local_auth":
 			dynamic_auth_content("pkg");
+			/* create empty passwd file to prevent stat error with squid reload */
+			touch ("/usr/local/etc/squid/advanced/ncsa/passwd");
 			dynamic_local_auth();
 			break;
 		case "ldap_bind":
@@ -54,62 +54,31 @@ function global_eval_auth_options(){
 			break;
 		case "domain_auth":
 			$filecontents = file('/usr/local/pkg/squid_auth.xml');
-			
-			$fout = fopen("/usr/local/pkg/squid_auth.xml","w");
-			foreach($filecontents as $line) {
-				if (stristr($line, "<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>")) {
-					fwrite($fout, "			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>\n");
-				} else {
-					fwrite($fout, $line);
-				}
-			}
-					
+			dynamic_auth_content("pkg_edit");
 			dynamic_domain_auth();
 			break;
 		case "radius_auth":
 			$filecontents = file('/usr/local/pkg/squid_auth.xml');
-			
-			$fout = fopen("/usr/local/pkg/squid_auth.xml","w");
-			foreach($filecontents as $line) {
-				if (stristr($line, "<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>")) {
-					fwrite($fout, "			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>\n");
-				} else {
-					fwrite($fout, $line);
-				}
-			}
-					
+			dynamic_auth_content("pkg_edit");					
 			dynamic_radius_auth();
 			break;
 		default:
 			$filecontents = file('/usr/local/pkg/squid_auth.xml');
-			
-			$fout = fopen("/usr/local/pkg/squid_auth.xml","w");
-			foreach($filecontents as $line) {
-				if (stristr($line, "<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>")) {
-					fwrite($fout, "			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>\n");
-				} else {
-					fwrite($fout, $line);
-				}
-			}
-					
+			dynamic_auth_content("pkg_edit");					
 			dynamic_no_auth();
 			break;
 	}
 	
-	conf_mount_ro();
 	config_unlock();
+	conf_mount_ro();
 	
 } /* end function global_eval_auth_options */
 	
 function dynamic_no_auth() {
-	conf_mount_rw();
-	config_lock();
-	
 	global $config;
-	
-	$pkgfile = "/usr/local/pkg/squid_extauth.xml";
-	
-	$fout = fopen($pkgfile, "w");
+	conf_mount_rw();
+
+	$fout = fopen("/usr/local/pkg/squid_extauth.xml", "w");
 	
 	fwrite($fout, '<?xml version="1.0" encoding="utf-8" ?>' . "\n");
 	fwrite($fout, "<packagegui>\n");
@@ -175,23 +144,22 @@ function dynamic_no_auth() {
 	fwrite($fout, "</packagegui>\n");
 
 	fclose($fout);
+	
+	/* mount filesystem read-only */
+	conf_mount_ro();
 }		
 
 function dynamic_local_auth() {
-	conf_mount_rw();
-	config_lock();
-	
 	global $config;
+	conf_mount_rw();
 
-	$pkgfile = "/usr/local/pkg/squid_extauth.xml";
-	
-	$fout = fopen($pkgfile, "w");
+	$fout = fopen("/usr/local/pkg/squid_extauth.xml", "w");
 	
 	fwrite($fout, '<?xml version="1.0" encoding="utf-8" ?>' . "\n");
 	fwrite($fout, "\n");
 	fwrite($fout, "<packagegui>\n");
 	fwrite($fout, "	<name>squidextlocalauth</name>\n");
-	fwrite($fout, "	<title>Services: Proxy Server -> Extended Authentication Settings</title>\n");
+	fwrite($fout, "	<title>Services: Proxy Server -> Extended Auth Settings</title>\n");
 	fwrite($fout, "	<version>2.5.10_4</version>\n");
 	fwrite($fout, "	<configpath>installedpackages->package->squidextlocalauth->configuration->settings</configpath>\n");
 	fwrite($fout, "\n");
@@ -293,9 +261,7 @@ function dynamic_local_auth() {
 	fwrite($fout, "	<custom_add_php_command_late>\n");
 	fwrite($fout, '		require_once("/usr/local/pkg/squid_ng.inc");' . "\n");
 	fwrite($fout, "\n");
-	fwrite($fout, '		if ($password == $confirm_password) { ' . "\n");
-	fwrite($fout, "			mod_htpasswd();\n");
-	fwrite($fout, "		}\n");
+	fwrite($fout, "		mod_htpasswd();\n");
 	fwrite($fout, "		global_write_squid_config();\n");
 	fwrite($fout, '		mwexec("/usr/local/sbin/squid -k reconfigure");' . "\n");
 	fwrite($fout, "	</custom_add_php_command_late>\n");
@@ -304,19 +270,15 @@ function dynamic_local_auth() {
 		
 	fclose($fout);
 	
+	/* mount filesystem read-only */
 	conf_mount_ro();
-	config_unlock();
-} /* end function dynamic_local_auth */
+}
 
 function dynamic_ldap_auth() {
-	conf_mount_rw();
-	config_lock();
-	
 	global $config;
+	conf_mount_rw();	
 
-	$pkgfile = "/usr/local/pkg/squid_extauth.xml";
-	
-	$fout = fopen($pkgfile, "w");
+	$fout = fopen("/usr/local/pkg/squid_extauth.xml", "w");
 	
 	fwrite($fout, '<?xml version="1.0" encoding="utf-8" ?>' . "\n");
 	fwrite($fout, "\n");
@@ -374,7 +336,7 @@ function dynamic_ldap_auth() {
 	fwrite($fout, "		<field>\n");
 	fwrite($fout, "			<fielddescr>Base DN</fielddescr>\n");
 	fwrite($fout, "			<fieldname>ldap_basedn</fieldname>\n");
-	fwrite($fout, "			<description>This is the base where the LDAP search starts.  All subsequent organizational units (OUs)will be included.  Example: "ou=users,o=company" will search for users in and under the specified company.</description>\n");
+	fwrite($fout, '			<description>This is the base where the LDAP search starts.  All subsequent organizational units (OUs)will be included.  Example: "ou=users,o=company" will search for users in and under the specified company.</description>' . "\n");
 	fwrite($fout, "			<type>input</type>\n");
 	fwrite($fout, "			<size>50</size>\n");
 	fwrite($fout, "		</field>\n");
@@ -428,57 +390,59 @@ function dynamic_ldap_auth() {
 	fwrite($fout, "	<custom_add_php_command_late>\n");
 	fwrite($fout, '		require_once("/usr/local/pkg/squid_ng.inc");' . "\n");
 	fwrite($fout, "\n");
-	fwrite($fout, "		if ($password == $confirm_password) {\n");
-	fwrite($fout, '			mwexec("/usr/bin/htpasswd -b /usr/local/etc/squid/advanced/ncsa/passwd "' . $username . " " . $password . "\n");
-	fwrite($fout, "		}\n");
+	fwrite($fout, "		mod_htpasswd();\n");
 	fwrite($fout, "\n");
 	fwrite($fout, "		global_write_squid_config();\n");
 	fwrite($fout, '		mwexec("/usr/local/sbin/squid -k reconfigure");' . "\n");
 	fwrite($fout, "	</custom_add_php_command_late>\n");
 	fwrite($fout, "\n");
 	fwrite($fout, "</packagegui>\n");
+	
+	fclose($fout);
+	
+	/* mount filesystem read-only */
+	conf_mount_ro();
 }
 
 /* dynamically re-writes all squid xml files to handle adddeletecolumnitems properly */
 function dynamic_auth_content($pkgvar) {
-
-	if ($pkgvar == "pkg") {
-		if ($handle = opendir('/usr/local/pkg')) {
-			while (($file = readdir($handle)) != false) {
-				if (stristr($file, "squid_") && stristr($file, ".xml")) {
-				
-					$filecontents = file("/usr/local/pkg/" . $file);
-			
-					$fout = fopen("/usr/local/pkg/" . $file,"w");
-					foreach($filecontents as $line) {
-						if (stristr($line, "<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>")) {
-							fwrite($fout, "			<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>\n");
-						} else {
-							fwrite($fout, $line);
+	
+	switch ($pkgvar) {
+		case "pkg":
+			if ($handle = opendir('/usr/local/pkg')) {
+				while (($file = readdir($handle)) != false) {
+					if (stristr($file, "squid_") && stristr($file, ".xml")) {
+						$filecontents = file("/usr/local/pkg/" . $file);
+						$fout = fopen("/usr/local/pkg/" . $file, "w");
+						foreach($filecontents as $line) {
+							if (stristr($line, "<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>")) {
+								fwrite($fout, "			<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>\n");
+							} else {
+								fwrite($fout, $line);
+							}
 						}
 					}
 				}
-			}
-		}
-	} else {
+			}		
+			break;
+		
+		case "pkg_edit":
 			if ($handle = opendir('/usr/local/pkg')) {
-			while (($file = readdir($handle)) != false) {
-				if (stristr($file, "squid_") && stristr($file, ".xml")) {
-				
-					$filecontents = file("/usr/local/pkg/" . $file);
-			
-					$fout = fopen("/usr/local/pkg/" . $file,"w");
-					foreach($filecontents as $line) {
-						if (stristr($line, "<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>")) {
-							fwrite($fout, "			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>\n");
-						} else {
-							fwrite($fout, $line);
+				while (($file = readdir($handle)) != false) {
+					if (stristr($file, "squid_") && stristr($file, ".xml")) {
+						$filecontents = file("/usr/local/pkg/" . $file);
+						$fout = fopen("/usr/local/pkg/" . $file,"w");
+						foreach($filecontents as $line) {
+							if (stristr($line, "<url>/pkg.php?xml=squid_extauth.xml&amp;id=0</url>")) {
+								fwrite($fout, "			<url>/pkg_edit.php?xml=squid_extauth.xml&amp;id=0</url>\n");
+							} else {
+								fwrite($fout, $line);
+							}
 						}
 					}
 				}
 			}
-		}
+			break;
 	}
-} /* end function dynamic_auth_content */
-
-?>
\ No newline at end of file
+			
+} /* end function dynamic_auth_content */
\ No newline at end of file
diff --git a/packages/squid_ng.inc b/packages/squid_ng.inc
index 8c32ccf5..47a19635 100644
--- a/packages/squid_ng.inc
+++ b/packages/squid_ng.inc
@@ -31,12 +31,12 @@
 
 */
 
-function global_write_squid_config() {
+function global_write_squid_config() 
+{
+	global $config;
 	conf_mount_rw();
 	config_lock();
-	
-	global $config;
-				
+			
     /* define squid configuration file in variable for replace function */
     $squidconfig = "/usr/local/etc/squid/squid.conf";
             
@@ -109,217 +109,295 @@ function global_write_squid_config() {
 	$bind_dn_username	   = $config['installedpackages']['squidextldapauth']['config'][0]['bind_dn_username'];
 	$bind_dn_password	   = $config['installedpackages']['squidextldapauth']['config'][0]['bind_dn_password'];
 	
+	/* squid_extauth.xml (radius) values */
+	$radius_server		   = $config['installedpackages']['squidextradiusauth']['config'][0]['radius_server'];
+	$radius_port		   = $config['installedpackages']['squidextradiusauth']['config'][0]['radius_port'];
+	$radius_identifier	   = $config['installedpackages']['squidextradiusauth']['config'][0]['radius_identifier'];
+	$radius_secret		   = $config['installedpackages']['squidextradiusauth']['config'][0]['radius_secret'];
+	
 	/* static variable assignments for directory mapping */
 	$acldir    = "/usr/local/etc/squid/advanced/acls";
 	$ncsadir   = "/usr/local/etc/squid/advanced/ncsa";
 	$ntlmdir   = "/usr/local/etc/squid/advanced/ntlm";
 	$radiusdir = "/usr/local/etc/squid/advanced/radius";
-			
-    $fout = fopen($squidconfig,"w");
-            
-    /* option: shutdown_lifetime */
-    fwrite($fout, "shutdown_lifetime 5 seconds\n");
-    fwrite($fout, "\n");
+		
+    $fout = fopen($squidconfig, "w");
+        
+	$config_array = array('shutdown_lifetime 5 seconds' . "\n\n");
 
-	/* option: icp_port */	
-	if($icp_port == "") $icp_port="3130"; 
-	fwrite($fout, "icp_port " . $icp_port . "\n");
+	if (!isset($icp_port) or ($icp_port == "")) {
+		$icp_port = "3130"; 
+	}
+	$config_array[] = 'icp_port ' . $icp_port . "\n";
+	unset($icp_port);
 		
-	/* option: proxy_port */
-	if($proxy_port == "") $proxy_port="3128";
+	if(!isset($proxy_port) or ($proxy_port == "")) {
+		$proxy_port = "3128";
+	}
+	
 	if (isset($transparent_proxy) && ($transparent_proxy != "on")) {
 		$int = convert_friendly_interface_to_real_interface_name($active_interface);
 		$listen_ip = find_interface_ip($int);
 		
-		fwrite($fout, "http_port " . $listen_ip . ":" . $proxy_port . "\n");
-		fwrite($fout, "\n");
-			
-		fwrite($fout, "acl QUERY urlpath_regex cgi-bin \?\n");
-		fwrite($fout, "no_cache deny QUERY\n");		
+		$config_array[] = 'http_port ' . $listen_ip . ':' . $proxy_port . "\n\n";
+		$config_array[] = 'acl QUERY urlpath_regex cgi-bin \?' . "\n";
+		$config_array[] = 'no_cache deny QUERY' . "\n\n";		
 	}
+	unset($proxy_port);
+
+	if (isset($domain) && ($domain !== "")) {
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
+		
+		$aclout = fopen($acldir . "/dst_nocache.acl","w");
 			
-	/* option: acl no cache domains */
-	if (isset($domain) && $domain !== "") {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
-			$aclout = fopen($acldir . "/dst_nocache.acl","w");
-			
-			$domain_array = split(";",$domain);
-			foreach ($domain_array as $no_cache_domain) {
+		$domain_array = split("; ",$domain);
+		foreach ($domain_array as $no_cache_domain) {
 			fwrite($aclout, $no_cache_domain . "\n");
 		}
-				
+			
 		fclose($aclout);
 		
-		fwrite($fout, 'acl no_cache_domains dstdomain "' . $acldir . '/dst_nocache.acl"' . "\n");
-		fwrite($fout, "no_cache deny no_cache_domains\n");
+		$config_array[] = 'acl no_cache_domains dstdomain "' . $acldir . '/dst_nocache.acl"' . "\n";
+		$config_array[] = 'no_cache deny no_cache_domains' . "\n\n";
+	}
+	unset($no_cache_domain);
+	unset($domain_array);
+	unset($domain);
+						
+	$config_array[] = 'cache_effective_user squid' . "\n";
+	$config_array[] = 'cache_effective_group squid' . "\n\n";	
+	$config_array[] = 'pid_filename /var/run/squid.pid' . "\n\n";
+			
+	if (!isset($memory_cache_size) or ($memory_cache_size == "")) {
+		$memory_cache_size = "8";
+	}
+	$config_array[] = 'cache_mem ' . $memory_cache_size . ' MB' . "\n";
+	unset($memory_cache_size);
+	
+	if (!isset($harddisk_cache_size) or ($harddisk_cache_size == "")) {
+		$harddisk_cache_size = "500";
+	}
+	
+	if (!isset($level_subdirs) or ($level_subdirs == "")) {
+		$level_subdirs = "16";
 	}
+	
+	$config_array[] = 'cache_dir diskd /var/squid/cache ' . $harddisk_cache_size . ' ' . $level_subdirs . ' 256' . "\n\n";
+	unset($harddisk_cache_size);
+	unset($level_subdirs);
+			
+	if (!isset($error_language) or ($error_language == "")) {
+		$error_language = "English";
+	}
+	$config_array[] = 'error_directory /usr/local/etc/squid/errors/' . $error_language . "\n\n";
+	unset($error_language);
 			
-	fwrite($fout, "\n");
-					
-	fwrite($fout, "cache_effective_user squid\n");
-	fwrite($fout, "cache_effective_group squid\n");
-	fwrite($fout, "\n");
-			
-	fwrite($fout, "pid_filename /var/run/squid.pid\n");
-	fwrite($fout, "\n");
-			
-	if ($memory_cache_size == "") $memory_cache_size="8";
-	fwrite($fout, "cache_mem " . $memory_cache_size . " MB\n");
-	if ($harddisk_cache_size == "") $harddisk_cache_size="500";
-	if ($level_subdirs == "") $level_subdirs="16";
-	fwrite($fout, "cache_dir diskd /var/squid/cache " . $harddisk_cache_size . " " . $level_subdirs . " 256\n");
-	fwrite($fout, "\n");
-			
-	if ($error_language == "") $error_language="English";
-	fwrite($fout, "error_directory /usr/local/etc/squid/errors/" . $error_language . "\n");
-	fwrite($fout, "\n");
-			
-	if (isset($offline_mode) and ($offline_mode == "on")) {
-		fwrite($fout, "offline_mode on\n");
-		fwrite($fout, "\n");
+	if (isset($offline_mode) && ($offline_mode == "on")) {
+		$config_array[] = 'offline_mode on' . "\n\n";
 	} else {
-		fwrite($fout, "offline_mode off\n");
-		fwrite($fout, "\n");
+		$config_array[] = 'offline_mode off' . "\n\n";
 	}
 			
-	if (!isset($cache_replacement) or ($memory_replacement == "")) $memory_replacement="heap GDSF";
-	fwrite($fout, "memory_replacement_policy " . $memory_replacement . "\n");
-	if (!isset($cache_replacement) or ($cache_replacement == "")) $cache_replacement="heap GDSF";
-	fwrite($fout, "cache_replacement_policy " . $cache_replacement . "\n");
-	fwrite($fout, "\n");
+	if (!isset($memory_replacement) or ($memory_replacement == "")) {
+		$memory_replacement = "heap GDSF";
+	}
+	$config_array[] = 'memory_replacement_policy ' . $memory_replacement . "\n";
+	unset($memory_replacement);
+	
+	if (!isset($cache_replacement) or ($cache_replacement == "")) {
+		$cache_replacement="heap GDSF";
+	}
+	$config_array[] = 'cache_replacement_policy ' . $cache_replacement . "\n\n";
+	unset($cache_replacement);
 			
-	if ($log_enabled == "on" ) {
+	if (isset($log_enabled) && ($log_enabled == "on" )) {
 		if (!file_exists("/var/squid/logs")) {
 			mwexec("mkdir -p /var/squid/logs");
 			mwexec("chown squid:squid /var/squid/logs");
 		}
-		fwrite($fout, "cache_access_log /var/squid/logs/access.log\n");
-		fwrite($fout, "cache_log /var/squid/logs/cache.log\n");
-		fwrite($fout, "cache_store_log none\n");
+		$config_array[] = 'cache_access_log /var/squid/logs/access.log' . "\n";
+		$config_array[] = 'cache_log /var/squid/logs/cache.log' . "\n";
+		$config_array[] = 'cache_store_log none' . "\n";
 	} else {
-		fwrite($fout, "cache_access_log /dev/null\n");
-		fwrite($fout, "cache_log /dev/null\n");
-		fwrite($fout, "cache_store_log none\n");
+		$config_array[] = 'cache_access_log /dev/null' . "\n";
+		$config_array[] = 'cache_log /dev/null' . "\n";
+		$config_array[] = 'cache_store_log none' . "\n";
 	}
+	unset($log_enabled);
 
-	if ($log_query_terms == "on") {
-		fwrite($fout, "strip_query_terms off\n");
+	if (isset($log_query_terms) && ($log_query_terms == "on")) {
+		$config_array[] = 'strip_query_terms off' . "\n";
 	} else {
-		fwrite($fout, "strip_query_terms on\n");
+		$config_array[] = 'strip_query_terms on' . "\n";
 	}
+	unset($log_query_terms);
 				
-	if ($log_user_agents == "on") {
+	if (isset($log_user_agents) && ($log_user_agents == "on")) {
 		if (!file_exists("/var/squid/logs")) mwexec("mkdir -p /var/squid/logs");
-		fwrite($fout, "useragent_log /var/squid/logs/useragent.log\n");
+		$config_array[] = 'useragent_log /var/squid/logs/useragent.log' . "\n\n";
 	} 
-	fwrite($fout, "\n");
+	unset($log_user_agents);
 			
-	fwrite($fout, "log_mime_hdrs off\n");
-	fwrite($fout, "emulate_httpd_log on\n");
+	$config_array[] = 'log_mime_hdrs off' . "\n";
+	$config_array[] = 'emulate_httpd_log on' . "\n";
 	
 	switch ($user_forwarding) {
 		case "on":
-			fwrite($fout, "forwarded_for on\n");
+			$config_array[] = 'forwarded_for on' . "\n\n";
 			break;
 		case "off":
-			fwrite($fout, "forwarded_for off\n");
+			$config_array[] = 'forwarded_for off' . "\n\n";
 			break;
 		default:
-			fwrite($fout, "forwarded_for off\n");
+			$config_array[] = 'forwarded_for off' . "\n\n";
 			break;
 	}
-	fwrite($fout, "\n");
+	unset($user_forwarding);
 	
-	if ($no_auth == "on") {
-		fwrite($fout, "\n");
-	}
-			
 	switch ($auth_method) {
 		case "none":
 			break;
 		case "local_auth":
-			fwrite($fout, "auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/advanced/ncsa/passwd\n");
-			if (!isset($auth_processes) or ($auth_processes == "")) $auth_processes = "5";
-			fwrite($fout, "auth_param basic children " . $auth_processes . "\n");
-			
-			if (!isset($auth_realm_prompt) or ($auth_realm_prompt == "")) $auth_realm_prompt = "pfSense Advanced Proxy";
-			fwrite($fout, "auth_param basic realm " . $auth_realm_prompt . "\n");
-			
-			if (!isset($auth_cache_ttl) or ($auth_cache_ttl == "")) $auth_cache_ttl = "60";
-			fwrite($fout, "auth_param basic credentialsttl " . $auth_cache_ttl . " minutes\n");
-			fwrite($fout, "\n");
-			fwrite($fout, "acl for_inetusers proxy_auth REQUIRED\n");
-			fwrite($fout, "\n");
+			$config_array[] = 'auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/advanced/ncsa/passwd' . "\n";
+			if (!isset($auth_processes) or ($auth_processes == "")) {
+				$auth_processes = "5";
+			}
+			$config_array[] = 'auth_param basic children ' . $auth_processes . "\n";
+			
+			if (!isset($auth_realm_prompt) or ($auth_realm_prompt == "")) {
+				$auth_realm_prompt = "pfSense Advanced Proxy";
+			}
+			$config_array[] = 'auth_param basic realm ' . $auth_realm_prompt . "\n";
+			
+			if (!isset($auth_cache_ttl) or ($auth_cache_ttl == "")) {
+				$auth_cache_ttl = "60";
+			}
+			$config_array[] = 'auth_param basic credentialsttl ' . $auth_cache_ttl . ' minutes' . "\n\n";
+			$config_array[] = 'acl for_inetusers proxy_auth REQUIRED' . "\n\n";
+			
+			unset($auth_realm_prompt);
+			unset($auth_processes);
+			unset($auth_cache_ttl);			
+			
 			break;
 		case "radius_auth";
+			$config_array[] = 'auth_param basic program /usr/local/libexec/squid/squid_rad_auth -h ' . $radius_server . ' -p ' . $radius_port . ' -i ' . $radius_identifier . ' -w ' . $radius_secret . "\n";
+			if (!isset($auth_processes) or ($auth_processes == "")) {
+				$auth_processes = "5";
+			}
+			$config_array[] = 'auth_param basic children ' . $auth_processes . "\n";
+			
+			if (!isset($auth_realm_prompt) or ($auth_realm_prompt == "")) {
+				$auth_realm_prompt = "pfSense Advanced Proxy";
+			}
+			$config_array[] = 'auth_param basic realm ' . $auth_realm_prompt . "\n";
+			
+			if (!isset($auth_cache_ttl) or ($auth_cache_ttl == "")) {
+				$auth_cache_ttl = "60";
+			}	
+			$config_array[] = 'auth_param basic credentialsttl ' . $auth_cache_ttl . ' minutes' . "\n\n";
+			$config_array[] = 'acl for_inetusers proxy_auth REQUIRED' . "\n\n";		
+				
+			unset($auth_realm_prompt);
+			unset($auth_processes);
+			unset($auth_cache_ttl);
+				
 			break;
 		case "ldap_bind";
-			/* fwrite($fout, 'auth_param basic program /usr/local/libexec/squid_ldap_auth -b "' . $ldap_basedn . '" -D "' . $bind_dn_username . '" -w "' . $bind_dn_password . '" -f "(&(objectClass=person)(cn=%s))" -u -cn -P "' . $ldap_server . ":" . $ldap_port . "\n"); */
-			fwrite($fout, "auth_param basic program /usr/local/libexec/squid/squid_ldap_auth");
-			fwrite($fout, ' -b "' . $ldap_basedn . '"');
-			fwrite($fout, ' -D "' . $bind_dn_username . '"');
-			fwrite($fout, " -w " . $bind_dn_password);
-			fwrite($fout, ' -f "(&(objectClass=person)(cn=%s))"');
-			fwrite($fout, " -u cn -P " . $ldap_server . ":" . $ldap_port . "\n");
-			
-			if (!isset($auth_processes) or ($auth_processes == "")) $auth_processes = "5";
-			fwrite($fout, "auth_param basic children " . $auth_processes . "\n");
-			
-			if (!isset($auth_realm_prompt) or ($auth_realm_prompt == "")) $auth_realm_prompt = "pfSense Advanced Proxy";
-			fwrite($fout, "auth_param basic realm " . $auth_realm_prompt . "\n");
-			
-			if (!isset($auth_cache_ttl) or ($auth_cache_ttl == "")) $auth_cache_ttl = "60";
-			fwrite($fout, "auth_param basic credentialsttl " . $auth_cache_ttl . " minutes\n");
-			fwrite($fout, "\n");
-			fwrite($fout, "acl for_inetusers proxy_auth REQUIRED\n");
-			fwrite($fout, "\n");			
+			$config_array[] = 'auth_param basic program /usr/local/libexec/squid_ldap_auth -b "' . $ldap_basedn . '" -D "' . $bind_dn_username . '" -w "' . $bind_dn_password . '" -f "(&(objectClass=person)(cn=%s))" -u -cn -P "' . $ldap_server . ":" . $ldap_port . "\n"; 
+			$config_array[] = 'auth_param basic program /usr/local/libexec/squid/squid_ldap_auth';
+			$config_array[] = ' -b "' . $ldap_basedn . '"';
+			$config_array[] = ' -D "' . $bind_dn_username . '"';
+			$config_array[] = " -w " . $bind_dn_password;
+			$config_array[] = ' -f "(&(objectClass=person)(cn=%s))"';
+			$config_array[] = " -u cn -P " . $ldap_server . ":" . $ldap_port . "\n";
+			
+			if (!isset($auth_processes) or ($auth_processes == "")) {
+				$auth_processes = "5";
+			}
+			$config_array[] = 'auth_param basic children ' . $auth_processes . "\n";
+			
+			if (!isset($auth_realm_prompt) or ($auth_realm_prompt == "")) {
+				$auth_realm_prompt = "pfSense Advanced Proxy";
+			}
+			$config_array[] = 'auth_param basic realm ' . $auth_realm_prompt . "\n";
+			
+			if (!isset($auth_cache_ttl) or ($auth_cache_ttl == "")) {
+				$auth_cache_ttl = "60";
+			}
+			$config_array[] = 'auth_param basic credentialsttl ' . $auth_cache_ttl . ' minutes' . "\n\n";		
+			$config_array[] = 'acl for_inetusers proxy_auth REQUIRED' . "\n\n";
+			
+			unset($auth_realm_prompt);
+			unset($auth_processes);
+			unset($auth_cache_ttl);
+						
 			break;
 		case "windows_auth";
 			break;
-		default:
-			break;
 	}
 			
-	if (isset($throttle_binary_files) && $throttle_binary_files == "on") {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
-			$binary_out = "\.bin$\n\.cab$\n\.gz$\n\.rar$\n\.sea$\n\.tar$\n\.tgz$\n\.zip$\n";
+	if (isset($throttle_binary_files) && ($throttle_binary_files == "on")) {
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
+		
+		$binary_out = "\.bin$\n\.cab$\n\.gz$\n\.rar$\n\.sea$\n\.tar$\n\.tgz$\n\.zip$\n";
 
-			$throttle_out = fopen($acldir . "/dst_throttle_binary.acl", "w");
-			fwrite($throttle_out, $binary_out);
-			fclose($throttle_out);
-			fwrite($fout, 'acl for_throttled_binary url_regex -i "' . $acldir . '/dst_throttle_binary.acl"' . "\n");
-		} else {
-			if (file_exists($acldir . "/dst_throttle_binary.acl")) unlink($acldir . "/dst_throttle_binary.acl");
+		$throttle_out = fopen($acldir . "/dst_throttle_binary.acl", "w");
+		fwrite($throttle_out, $binary_out);
+		fclose($throttle_out);
+		$config_array[] = 'acl for_throttled_binary url_regex -i "' . $acldir . '/dst_throttle_binary.acl"' . "\n";
+	} else {
+		if (file_exists($acldir . "/dst_throttle_binary.acl")) unlink($acldir . "/dst_throttle_binary.acl");
 	}
+	unset($throttle_binary_files);
+	unset($throttle_out);
+	unset($binary_out);
 			
-	if (isset($throttle_cd_images) && $throttle_cd_images == "on") {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+	if (isset($throttle_cd_images) && ($throttle_cd_images == "on")) {
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 				
 		$cd_out = "\.b5t$\n\.bin$\n\.bwt$\n\.cdi$\n\.cue$\n\.gho$\n\.img$\n\.iso$\n\.mds$\n\.nrg$\n\.pqi$\n";
 				
 		$throttle_out = fopen($acldir . "/dst_throttle_cd.acl","w");
 		fwrite($throttle_out, $cd_out);
 		fclose($throttle_out);
-		fwrite($fout, 'acl for_throttled_cd url_regex -i "' . $acldir . '/dst_throttle_cd.acl"' . "\n");
+		$config_array[] = 'acl for_throttled_cd url_regex -i "' . $acldir . '/dst_throttle_cd.acl"' . "\n";
 	} else {
-		if (file_exists($acldir . "/dst_throttle_cd.acl")) unlink($acldir . "/dst_throttle_cd.acl");
+		if (file_exists($acldir . "/dst_throttle_cd.acl")) {
+			unlink($acldir . "/dst_throttle_cd.acl");
+		}
 	}
+	unset($throttle_cd_images);
+	unset($throttle_out);
+	unset($cd_out);
 			
-	if (isset($throttle_multimedia) && $throttle_multimedia == "on") {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+	if (isset($throttle_multimedia) && ($throttle_multimedia == "on")) {
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir); 
+		}
 			
 		$multimedia_out = "\.aiff?$\n\.asf$\n\.avi$\n\.divx$\n\.mov$\n\.mp3$\n\.mpe?g$\n\.qt$\n\.ra?m$\n";			
 			
 		$throttle_out = fopen($acldir . "/dst_throttle_multimedia.acl","w");
 		fwrite($throttle_out, $multimedia_out);
 		fclose($throttle_out);
-		fwrite($fout, 'acl for_throttled_multimedia url_regex -i "' . $acldir . '/dst_throttle_multimedia.acl"' . "\n");
+		$config_array[] = 'acl for_throttled_multimedia url_regex -i "' . $acldir . '/dst_throttle_multimedia.acl"' . "\n";
 	} else {
-		if (file_exists($acldir . "/dst_throttle_multimedia.acl")) unlink($acldir . "/dst_throttle_multimedia.acl");			
+		if (file_exists($acldir . "/dst_throttle_multimedia.acl")) {
+			unlink($acldir . "/dst_throttle_multimedia.acl");			
+		}
 	}	
+	unset($throttle_multimedia);
+	unset($multimedia_out);
+	unset($throttle_out);
 			
-	fwrite($fout, "acl within_timeframe time MTWHFAS 00:00-24:00\n");
-	fwrite($fout, "\n");
+	$config_array[] = 'acl within_timeframe time MTWHFAS 00:00-24:00' . "\n\n";
 			
     /* obtain interface subnet and address for Squid rules */
     $lactive_interface = strtolower($active_interface);
@@ -330,45 +408,48 @@ function global_write_squid_config() {
     $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']);
     $lansn = $lancfg['subnet'];			
 
-	fwrite($fout, "acl all src " . $lansa . "/" . $lansn . "\n");
-	fwrite($fout, "acl localnet src " . $lansa . "/" . $lansn . "\n");
-	fwrite($fout, "acl localhost src 127.0.0.1/255.255.255.255\n");					
-	fwrite($fout, "acl SSL_ports port 443 563 873 # https, snews, rsync\n");
-	fwrite($fout, "acl Safe_ports port 80 # http\n");
-	fwrite($fout, "acl Safe_ports port 21 # ftp\n");
-	fwrite($fout, "acl Safe_ports port 443 563 873 # https, snews, rsync\n");
-	fwrite($fout, "acl Safe_ports port 70 # gopher\n");
-	fwrite($fout, "acl Safe_ports port 210 # wais\n");
-	fwrite($fout, "acl Safe_ports port 1025-65535 # unregistered ports\n");
-	fwrite($fout, "acl Safe_ports port 280 # http-mgmt\n");
-	fwrite($fout, "acl Safe_ports port 488 # gss-http\n");
-	fwrite($fout, "acl Safe_ports port 591 # filemaker\n");
-	fwrite($fout, "acl Safe_ports port 777 # multiling http\n");
-	fwrite($fout, "acl Safe_ports port 800 # Squids port (for icons)\n");
-	fwrite($fout, "\n");
+	$config_array[] = 'acl all src ' . $lansa . '/' . $lansn . "\n";
+	$config_array[] = 'acl localnet src ' . $lansa . '/' . $lansn . "\n";
+	$config_array[] = 'acl localhost src 127.0.0.1/255.255.255.255' . "\n";					
+	$config_array[] = 'acl SSL_ports port 443 563 873 # https, snews, rsync' . "\n";
+	$config_array[] = 'acl Safe_ports port 80 # http' . "\n";
+	$config_array[] = 'acl Safe_ports port 21 # ftp' . "\n";
+	$config_array[] = 'acl Safe_ports port 443 563 873 # https, snews, rsync' . "\n";
+	$config_array[] = 'acl Safe_ports port 70 # gopher' . "\n";
+	$config_array[] = 'acl Safe_ports port 210 # wais' . "\n";
+	$config_array[] = 'acl Safe_ports port 1025-65535 # unregistered ports' . "\n";
+	$config_array[] = 'acl Safe_ports port 280 # http-mgmt' . "\n";
+	$config_array[] = 'acl Safe_ports port 488 # gss-http' . "\n";
+	$config_array[] = 'acl Safe_ports port 591 # filemaker' . "\n";
+	$config_array[] = 'acl Safe_ports port 777 # multiling http' . "\n";
+	$config_array[] = 'acl Safe_ports port 800 # Squids port (for icons)' . "\n\n";
 			
 	/* allow access through proxy for custom admin port */
     $custom_port = $config['system']['webgui']['port'];
 	if (isset($custom_port) && ($custom_port !== "")) {
-		fwrite($fout, "acl pf_admin_port port	" . $custom_port . "\n");
+		$config_array[] = 'acl pf_admin_port port	' . $custom_port . "\n";
+		unset($custom_port);
 	} else {
 		$admin_protocol = $config['system']['webgui']['protocol'];
 		switch ($admin_protocol) {
 			case "http";
-				fwrite($fout, "acl pf_admin_port port 80\n");
+				$config_array[] = 'acl pf_admin_port port 80' ."\n";
 				break;
 			case "https";
-				fwrite($fout, "acl pf_admin_port port 443\n");
+				$config_array[] = 'acl pf_admin_port port 443' . "\n";
 				break;
 			default;
-				fwrite($fout, "acl pf_admin_port port 80\n");
+				$config_array[] = 'acl pf_admin_port port 80' . "\n";
 				break;
 		}
+		unset($admin_protocol);
 	}
 	
 	/* define override hosts as specified in squid_nac.xml */
 	if (isset($override_hosts) && ($override_hosts !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 		
 		$aclout = fopen($acldir . "/src_override_hosts.acl", "w");
  
@@ -379,280 +460,327 @@ function global_write_squid_config() {
 		
 		fclose($aclout);
 		
-		fwrite($fout, 'acl override_hosts src "/usr/local/etc/squid/advanced/acls/src_override_hosts.acl"' . "\n");
+		$config_array[] = 'acl override_hosts src "/usr/local/etc/squid/advanced/acls/src_override_hosts.acl"' . "\n";
 	}	
+	/* clear variables */
+	unset($override_hosts_array);
+	unset($ind_override_host);
+	unset($override_hosts);
 			
 	/* define subnets allowed to utilize proxy service */
 	if (isset($allowed_subnets) && ($allowed_subnets !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 	
 		$aclout = fopen($acldir . "/src_subnets.acl","w");
 				
-		$allowed_subnets_array = split(";",$allowed_subnets);
+		$allowed_subnets_array = split("; ",$allowed_subnets);
 		foreach ($allowed_subnets_array as $ind_allowed_subnets) {
 			fwrite($aclout, $ind_allowed_subnets . "\n");
 		}
 				
-		fclose($aclout);
-				
-		fwrite($fout, 'acl pf_networks src "/usr/local/etc/squid/advanced/acls/src_subnets.acl"' . "\n");
+		fclose($aclout);			
 	} else {
+	
 		$aclout = fopen($acldir . "/src_subnets.acl","w");
 		fwrite($aclout, $lansa . "/" . $lansn . "\n");
 		fclose($aclout);
 	}
-		
+	
+	$config_array[] = 'acl pf_networks src "/usr/local/etc/squid/advanced/acls/src_subnets.acl"' . "\n";
+	
+	unset($allowed_subnets_array);
+	unset($ind_allowed_subnets);
+	unset($allowed_subnets);
 			
 	/* define ip addresses that have 'unrestricted' access */
 	if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 		
 		$aclout = fopen($acldir . "/src_unrestricted_ip.acl","w");
 		
-		$unrestricted_ip_array = split(";",$unrestricted_ip_addr);
+		$unrestricted_ip_array = split("; ",$unrestricted_ip_addr);
 		foreach ($unrestricted_ip_array as $ind_unrestricted_ip) {
 			fwrite($aclout, $ind_unrestricted_ip . "\n");
 		}
 				
 		fclose($aclout);
 		
-		fwrite($fout, 'acl pf_unrestricted_ip src "/usr/local/etc/squid/advanced/acls/src_unrestricted_ip.acl"' . "\n");
+		$config_array[] = 'acl pf_unrestricted_ip src "/usr/local/etc/squid/advanced/acls/src_unrestricted_ip.acl"' . "\n";
 	}
+	unset($unrestricted_ip_array);
+	unset($unrestricted_ip_addr);
+	unset($ind_unrestricted_ip);
 			
 	/* define mac addresses that have 'unrestricted' access */
 	if (isset($unrestricted_mac_addr) && ($unrestricted_mac_addr !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 
 		$aclout = fopen($acldir . "/src_unrestricted_mac.acl","w");
 			
-		$unrestricted_mac_array = split(";",$unrestricted_mac_addr);
+		$unrestricted_mac_array = split("; ",$unrestricted_mac_addr);
 		foreach ($unrestricted_mac_array as $ind_unrestricted_mac) {
 			fwrite($aclout, $ind_unrestricted_mac . "\n");
 		}
 			
 		fclose($aclout);
 		
-		fwrite($fout, 'acl pf_unrestricted_mac src "/usr/local/etc/squid/advanced/acls/src_unrestricted_mac.acl"' . "\n");
+		$config_array[] = 'acl pf_unrestricted_mac src "/usr/local/etc/squid/advanced/acls/src_unrestricted_mac.acl"' . "\n";
 	}
+	unset($unrestricted_mac_array);
+	unset($unrestricted_mac_addr);
+	unset($ind_unrestricted_mac);
 			
 	/* define ip addresses that are banned from using the proxy service */
 	if (isset($banned_ip_addr) && ($banned_ip_addr !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 
 		$aclout = fopen($acldir . "/src_banned_ip.acl","w");
 			
-		$banned_ip_array = split(";",$banned_ip_addr);
+		$banned_ip_array = split("; ",$banned_ip_addr);
 		foreach ($banned_ip_array as $ind_banned_ip) {
 			fwrite($aclout, $ind_banned_ip . "\n");
 		}
 				
 		fclose($aclout);
 		
-		fwrite($fout, 'acl pf_banned_ip src "/usr/local/etc/squid/advanced/acls/src_banned_ip.acl"' . "\n");
+		$config_array[] = 'acl pf_banned_ip src "/usr/local/etc/squid/advanced/acls/src_banned_ip.acl"' . "\n";
 	}
+	unset($banned_ip_addr);
+	unset($banned_ip_addr);
+	unset($ind_banned_ip);
 			
 	/* define mac addresses that are banned from using the proxy service */
 	if (isset($banned_mac_addr) && ($banned_mac_addr !== "")) {
-		if (!file_exists($acldir)) mwexec("/bin/mkdir -p " . $acldir);
+		if (!file_exists($acldir)) {
+			mwexec("/bin/mkdir -p " . $acldir);
+		}
 	
-			$aclout = fopen($acldir . "/src_banned_mac.acl","w");
+		$aclout = fopen($acldir . "/src_banned_mac.acl","w");
 			
-			$banned_mac_array = split(";",$banned_mac_addr);
-			foreach ($banned_mac_array as $ind_banned_mac) {
-				fwrite($aclout, $ind_banned_mac . "\n");
-			}
+		$banned_mac_array = split("; ",$banned_mac_addr);
+		foreach ($banned_mac_array as $ind_banned_mac) {
+			fwrite($aclout, $ind_banned_mac . "\n");
+		}
 				
 		fclose($aclout);
 		
-		fwrite($fout, 'acl pf_banned_mac src "/usr/local/etc/squid/advanced/acls/src_banned_mac.acl"' . "\n");
+		$config_array[] = 'acl pf_banned_mac src "/usr/local/etc/squid/advanced/acls/src_banned_mac.acl"' . "\n";
 	}
+	unset($banned_mac_array);
+	unset($banned_mac_addr);
+	unset($ind_banned_mac);
 	
-	fwrite($fout, "acl pf_ips	dst " . $lanip . "\n");
-	fwrite($fout, 'acl pf_networks	src "/usr/local/etc/squid/advanced/acls/src_subnets.acl"' . "\n");
-    fwrite($fout, "acl CONNECT method CONNECT\n");
-    fwrite($fout, "\n");
+	$config_array[] = 'acl pf_ips	dst ' . $lanip . "\n";
+    $config_array[] = 'acl CONNECT method CONNECT' . "\n\n";
             
-    fwrite($fout, "#access to squid; local machine; no restrictions\n");
-    if (isset($auth_method) && ($auth_method == "none")) fwrite($fout, "http_access allow localnet\n");
-    fwrite($fout, "http_access allow localhost\n");
+    if (isset($auth_method) && ($auth_method == "none")) {
+    	$config_array[] = 'http_access allow localnet' . "\n";
+    }
+    $config_array[] = 'http_access allow localhost' . "\n";
 	
-	if (isset($override_hosts) && ($override_hosts !== "")) fwrite($fout, "http_access allow override_hosts\n");
-	fwrite($fout, "\n");
+	if (isset($override_hosts) && ($override_hosts !== "")) {
+		$config_array[] = 'http_access allow override_hosts' . "\n";
+	}
+	$config_array[] = "\n";
 	
-	fwrite($fout, "#GUI admin to allow local connections\n");
-	if ($config['system']['webgui']['protocol'] == "http")  fwrite($fout, "http_access allow pf_ips pf_networks pf_admin_port\n");
-	if ($config['system']['webgui']['protocol'] == "https") fwrite($fout, "http_access allow CONNECT pf_ips pf_networks pf_admin_port\n");
+	switch ($config['system']['webgui']['protocol']) {
+		case "http":
+			$config_array[] = 'http_access allow pf_ips' . "\n";
+			$config_array[] = 'http_access allow pf_admin_port' . "\n";
+			$config_array[] = 'http_access deny !pf_networks' . "\n\n";
+			break;
+		case "https":
+			$config_array[] = 'http_access allow CONNECT pf_ips' . "\n";
+			$config_array[] = 'http_access allow CONNECT pf_admin_port' . "\n";
+			$config_array[] = 'http_access deny  CONNECT !pf_networks' . "\n\n";
+			break;
+	}
        		
-	fwrite($fout, "#Deny non web services\n");
-    fwrite($fout, "http_access deny !Safe_ports\n");
-    fwrite($fout, "http_access deny CONNECT !SSL_ports\n");
-    fwrite($fout, "\n");
+    $config_array[] = 'http_access deny !Safe_ports' . "\n";
+    $config_array[] = 'http_access deny CONNECT !SSL_ports' . "\n\n";
             
-    fwrite($fout, "#Set custom configured ACLs\n");
     if (isset($auth_method) && ($auth_method != "none")) {
-    	fwrite($fout, "http_access allow pf_networks for_inetusers within_timeframe\n");
+    	$config_array[] = 'http_access allow pf_networks for_inetusers within_timeframe' . "\n";
     }
     
-    fwrite($fout, "http_access deny all\n");
-    fwrite($fout, "\n");
+    $config_array[] = 'http_access deny all' . "\n\n";
             
 	if (isset($dl_overall) && ($dl_overall !== "") and isset($dl_per_host) && ($dl_per_host == "")) {
-		fwrite($fout, "#Set throttle and bandwidth restrictions\n");
-		
-       	fwrite($fout, "delay_pools 1\n");
-       	fwrite($fout, "delay_class 1 3\n");
+       	$config_array[] = 'delay_pools 1' . "\n";
+       	$config_array[] = 'delay_class 1 3' . "\n";
        	
        	if ($dl_overall == "unlimited") {
-       		fwrite($fout, "delay_parameters 1 -1/-1 -1/-1 " . ($dl_overall * 125) . "/" . ($dl_overall * 250) . "\n");
+       		$config_array[] = 'delay_parameters 1 -1/-1 -1/-1 ' . ($dl_overall * 125) . '/' . ($dl_overall * 250) . "\n";
        	} else {
-       		fwrite($fout, "delay_parameters 1 " . ($dl_overall * 125) . "/" . ($dl_overall * 250) . " -1/-1 -1/-1\n");
+       		$config_array[] = 'delay_parameters 1 ' . ($dl_overall * 125) . '/' . ($dl_overall * 250) . ' -1/-1 -1/-1' . "\n";
        	}
        	
    		/* if no unrestricted ip addresses are defined; this line is ignored */ 	      	
- 		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr == "")) fwrite($fout, "delay_access 1 deny pf_unrestricted_ip\n");
+ 		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr == "")) $config_array[] = 'delay_access 1 deny pf_unrestricted_ip' . "\n";
   	
-       	fwrite($fout, "#delay_access 1 deny for_extended_users\n");
-       	
    		/* this will define bandwidth delay restrictions for specified throttles */
    		if (isset($throttle_binary_files) && ($throttle_binary_files == "on")) {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_binary\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_binary' . "\n";
    		}
    		if (isset($throttle_cd_images) && ($throttle_cd_images == "on")) {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_cd\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_cd' . "\n";
    		}
    		if (isset($throttle_multimedia) && ($throttle_multimedia == "on")) {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_multimedia\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_multimedia' . "\n";
    		} else {
-   			fwrite($fout, "delay_access 1 allow all\n");
+   			$config_array[] = 'delay_access 1 allow all' . "\n";
    		}       	
-   		fwrite($fout, "delay_initial_bucket_level 100%\n\n");
+   		$config_array[] = 'delay_initial_bucket_level 100%' . "\n\n";
     }
             
     if (isset($dl_per_host) && ($dl_per_host !== "") and isset($dl_overall) && ($dl_overall == "")) {
-		fwrite($fout, "#Set throttle and bandwidth restrictions\n");   
-		
-       	fwrite($fout, "delay_pools 1\n");
-      	fwrite($fout, "delay_class 1 3\n");
+       	$config_array[] = 'delay_pools 1' . "\n";
+      	$config_array[] = 'delay_class 1 3' . "\n";
       	
       	if ($dl_per_host == "unlimited") {
-      		fwrite($fout, "delay_parameters 1 " . ($dl_per_host * 125) . "/" . ($dl_per_host * 250) . "-1/-1 -1/-1\n");
+      		$config_array[] = 'delay_parameters 1 ' . ($dl_per_host * 125) . '/' . ($dl_per_host * 250) . '-1/-1 -1/-1' . "\n";
       	} else {
-       		fwrite($fout, "delay_parameters 1 -1/-1 -1/-1 " . ($dl_per_host * 125) . "/" . ($dl_per_host * 250) . "\n");
+       		$config_array[] = 'delay_parameters 1 -1/-1 -1/-1 ' . ($dl_per_host * 125) . '/' . ($dl_per_host * 250) . "\n";
        	}
 
    		/* if no unrestricted ip addresses are defined; this line is ignored */ 	
- 		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) fwrite($fout, "delay_access 1 deny pf_unrestricted_ip\n");
+ 		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) $config_array[] = 'delay_access 1 deny pf_unrestricted_ip' . "\n";
   		
-       	fwrite($fout, "#delay_access 1 deny for_extended_users\n");
-       	
    		/* this will define bandwidth delay restrictions for specified throttles */     	
    		if ($throttle_binary_files == "on") {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_binary\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_binary' . "\n";
    		}
    		if ($throttle_cd_images == "on") {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_cd\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_cd' . "\n";
    		}
    		if ($throttle_multimedia == "on") {
-   			fwrite($fout, "delay_access 1 allow all for_throttled_multimedia\n");
+   			$config_array[] = 'delay_access 1 allow all for_throttled_multimedia' ."\n";
    		} else {
-   			fwrite($fout, "delay_access 1 allow all\n");
+   			$config_array[] = 'delay_access 1 allow all' . "\n";
    		}
-       	fwrite($fout, "delay_initial_bucket_level 100%\n\n");
-		fwrite($fout, "\n");  	
+       	$config_array[] = 'delay_initial_bucket_level 100%' . "\n\n\n";
     }
 	        
     if (isset($dl_overall) && ($dl_overall !== "") and isset($dl_per_host) && ($dl_per_host !== "")) {
     	/* if no bandwidth restrictions are specified, then these parameters are not necessary */
     	if ($dl_overall !== "unlimited" and $dl_per_host !== "unlimited") { 	
-			fwrite($fout, "#Set throttle and bandwidth restrictions\n");
 
    			if ((isset($dl_overall) && ($dl_overall == "unlimited")) and (isset($dl_per_host) && ($dl_per_host !== ""))) { 
-   				fwrite($fout, "delay_pools 1\n");
-   				fwrite($fout, "delay_class 1 3\n");
-   				fwrite($fout, "delay_parameters 1 -1/-1 -1/-1 " . ($dl_per_host * 125) . "/" . ($dl_overall * 250) . "\n");
+   				$config_array[] = 'delay_pools 1' . "\n";
+   				$config_array[] = 'delay_class 1 3' . "\n";
+   				$config_array[] = 'delay_parameters 1 -1/-1 -1/-1 ' . ($dl_per_host * 125) . '/' . ($dl_overall * 250) . "\n";
    			} elseif (isset($dl_overall) && ($dl_overall !== "") and isset($dl_per_host) && ($dl_per_host == "unlimited")) {
-   				fwrite($fout, "delay_pools 1\n");
-   				fwrite($fout, "delay_class 1 3\n");
-   				fwrite($fout, "delay_parameters 1 " . ($dl_overall * 125) . "/" . ($dl_overall * 250) . " -1/-1 -1/-1\n");
+   				$config_array[] = 'delay_pools 1' . "\n";
+   				$config_array[] = 'delay_class 1 3' . "\n";
+   				$config_array[] = 'delay_parameters 1 ' . ($dl_overall * 125) . '/' . ($dl_overall * 250) . ' -1/-1 -1/-1' . "\n";
    			}
    		}
    		
    		if ($dl_overall !== "unlimited" and $dl_per_host !== "unlimited") {
    		
    			/* if no unrestricted ip addresses are defined; this line is ignored */
-   			if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) fwrite($fout, "delay_access 1 deny pf_unrestricted_ip\n");
- 
-   			fwrite($fout, "#delay_access 1 deny for_extended_users\n");
-   		
+   			if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) $config_array[] = 'delay_access 1 deny pf_unrestricted_ip' . "\n";
+
    			/* this will define bandwidth delay restrictions for specified throttles */
    			if ($throttle_binary_files == "on") {
-   				fwrite($fout, "delay_access 1 allow all for_throttled_binary\n");
+   				$config_array[] = 'delay_access 1 allow all for_throttled_binary' . "\n";
    			}
    			if ($throttle_cd_images == "on") {
-   				fwrite($fout, "delay_access 1 allow all for_throttled_cd\n");
+   				$config_array[] = 'delay_access 1 allow all for_throttled_cd' . "\n";
    			}
    			if ($throttle_multimedia == "on") {
-   				fwrite($fout, "delay_access 1 allow all for_throttled_multimedia\n");
+   				$config_array[] = 'delay_access 1 allow all for_throttled_multimedia' . "\n";
    			} else {
-   				fwrite($fout, "delay_access 1 allow all\n");
+   				$config_array[] = 'delay_access 1 allow all' . "\n";
    			}
-   			fwrite($fout, "delay_initial_bucket_level 100%\n\n");
+   			$config_array[] = 'delay_initial_bucket_level 100%' . "\n\n";
    		}
     }
 
-    fwrite($fout, "#Strip HTTP Header\n");
-    fwrite($fout, "header_access X-Forwarded-For deny all\n");
-    fwrite($fout, "header_access Via deny all\n");
-    fwrite($fout, "\n");
+    $config_array[] = 'header_access X-Forwarded-For deny all' . "\n";
+    $config_array[] = 'header_access Via deny all' . "\n\n";
             
 	/* TODO: acl customization for snmp support */
-	fwrite($fout, "\n");           
+	/* fwrite($fout, "\n"); */
 
 	if (isset($urlfilter_enable) && ($urlfilter_enable == "on")) {
-		fwrite($fout, "redirect_program /usr/sbin/squidGuard");
-		fwrite($fout, "redirect_children 5");
-		fwrite($fout, "\n");
+		$config_array[] = 'redirect_program /usr/sbin/squidGuard' . "\n";
+		$config_array[] = 'redirect_children 5' . "\n\n";
 	}	
 						
 	if (isset($max_upload_size) && ($max_upload_size != "")) {
-		fwrite($fout, "request_body_max_size " . $max_download_size . "KB\n");
+		$config_array[] = 'request_body_max_size ' . $max_download_size . 'KB' . "\n";
 	}
 			
 	if (isset($max_download_size) && ($max_download_size != "")) {
-		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) fwrite($fout, "reply_body_max_size 0 allow pf_unrestricted_ip\n");
-		fwrite($fout, "#reply_body_max_size 0 allow for_extended_users\n");
-		fwrite($fout, "reply_body_max_size " . $max_download_size * 1024 . " allow all\n");
-		fwrite($fout, "\n");
+		if (isset($unrestricted_ip_addr) && ($unrestricted_ip_addr !== "")) $config_array[] = 'reply_body_max_size 0 allow pf_unrestricted_ip' . "\n";
+		/* fwrite($fout, "#reply_body_max_size 0 allow for_extended_users\n"); */
+		$config_array[] = 'reply_body_max_size ' . $max_download_size * 1024 . ' allow all' . "\n\n";
 	}
 			
-	if ($maximum_object_size == "") $maximum_object_size="4096";
-	if ($minimum_object_size == "") $minimum_object_size="0";
-	fwrite($fout, "maximum_object_size " . $maximum_object_size . " KB\n");
-	fwrite($fout, "minimum_object_size " . $minimum_object_size . " KB\n");
-	fwrite($fout, "\n");
+	/* set default value for maximum_object_size */
+	if (!isset($maximum_object_size) or ($maximum_object_size == "")) {
+		$maximum_object_size = "4096";
+	}
+	
+	/* set default value for minimum_object_size */
+	if (!isset($minimum_object_size) or ($minimum_object_size == "")) {
+		$minimum_object_size = "0";
+	}
+	$config_array[] = 'maximum_object_size ' . $maximum_object_size . ' KB' . "\n";
+	$config_array[] = 'minimum_object_size ' . $minimum_object_size . ' KB' . "\n\n";
 			
-	if ($proxy_forwarding == "on") {
-		fwrite($fout, "cache_peer " . $upstream_proxy . "parent " . $upstream_proxy_port . "3130 login=" . upstream_username . ":" . upstream_password . " default no-query\n");
-		fwrite($fout, "never_direct allow all\n");
+	if (isset($proxy_forwarding) && ($proxy_forwarding == "on")) {
+		$config_array[] = 'cache_peer ' . $upstream_proxy . 'parent ' . $upstream_proxy_port . '3130 login=' . upstream_username . ':' . upstream_password . ' default no-query' . "\n";
+		$config_array[] = 'never_direct allow all' . "\n";
 	}	
-			
-	if ($transparent_proxy == "on") {
-       	fwrite($fout, "httpd_accel_host virtual\n");
-      	fwrite($fout, "httpd_accel_port 80\n");
-       	fwrite($fout, "httpd_accel_with_proxy on\n");
-       	fwrite($fout, "httpd_accel_uses_host_header on\n");	
-       	fwrite($fout, "\n");			
+	unset($proxy_forwarding);
+	
+	
+	/* define default ruleset for transparent proxy operation */			
+	if (isset($transparent_proxy) && ($transparent_proxy == "on")) {
+       	$config_array[] = 'httpd_accel_host virtual' . "\n";
+      	$config_array[] = 'httpd_accel_port 80' . "\n";
+       	$config_array[] = 'httpd_accel_with_proxy on' . "\n";
+       	$config_array[] = 'httpd_accel_uses_host_header on' . "\n\n";	
     }
+   	unset($transparent_proxy);	
+
     
+    /* define visible hostname */
 	if (isset($visible_hostname) && ($visible_hostname !== "")) {
-		fwrite($fout, "visible_hostname " . $visible_hostname . "\n");
+		$config_array[] = 'visible_hostname ' . $visible_hostname . "\n";
 	} 
+	unset($visible_hostname);
 			
+	/* define cache administrators email address within error messages */
 	if (isset($cache_admin_email) && ($cache_admin_email !== "")) {
-		fwrite($fout, "cache_mgr " . $cache_admin_email . "\n");
-		fwrite($fout, "\n");
+		$config_array[] = 'cache_mgr ' . $cache_admin_email . "\n\n";
 	}    
-			
+	unset($cache_admin_email);
+	
+	/* write configuration file */
+	foreach ($config_array as $config_item) 
+	{ 
+		fwrite($fout, trim($config_item));
+	
+		if (stristr($config_item, "\n")) 
+		{		
+			for ($i = 1; $i < count(explode("\n", $config_item)); $i++) 
+			{
+				fwrite($fout, "\n");
+			}
+		}
+		
+	}
 	fclose($fout);
 			
 	conf_mount_ro();
@@ -662,15 +790,15 @@ function global_write_squid_config() {
 } /* end function write_squid_config */
 
 function mod_htpasswd() {
+	global $config;
 	conf_mount_rw();
 	config_lock();
-	global $config;
 	
 	if (!file_exists("/usr/local/etc/squid/advanced/ncsa")) mwexec("mkdir -p /usr/local/etc/squid/advanced/ncsa");
 	
 	$passfile = fopen("/usr/local/etc/squid/advanced/ncsa/passwd", "w+");
 
-	if($config['installedpackages']['squidextlocalauth']['config'] != "") {
+	if (isset($config['installedpackages']['squidextlocalauth']['config']) && $config['installedpackages']['squidextlocalauth']['config'] != "") {
 		foreach($config['installedpackages']['squidextlocalauth']['config'] as $rowhelper) {
 			$encpass = generate_htpasswd($rowhelper['username'], $rowhelper['password']);
 			fwrite($passfile, $rowhelper['username'] . ":" . $encpass . "\n");
diff --git a/packages/squid_ng.xml b/packages/squid_ng.xml
index 06a86634..ddb19bf8 100644
--- a/packages/squid_ng.xml
+++ b/packages/squid_ng.xml
@@ -271,9 +271,10 @@
 			fwrite($fout, "acl all src " . $lansa . "/" . $lansn . "\n");
 			fwrite($fout, "acl localnet src " . $lansa . "/" . $lansn . "\n");
 			fwrite($fout, "acl localhost src 127.0.0.1/255.255.255.255\n");
+			fwrite($fout, "acl SSL_ports port 443 563 873 # https, snews, rsync\n");
 			fwrite($fout, "acl Safe_ports port 80 # http\n");
 			fwrite($fout, "acl Safe_ports port 21 # ftp\n");
-			fwrite($fout, "acl Safe_ports port 443 563 # https, snews\n");
+			fwrite($fout, "acl Safe_ports port 443 563 873 # https, snews, rsync\n");
 			fwrite($fout, "acl Safe_ports port 70 # gopher\n");
 			fwrite($fout, "acl Safe_ports port 210 # wais\n");
 			fwrite($fout, "acl Safe_ports port 1025-65535 # unregistered ports\n");
@@ -294,7 +295,7 @@
        		
        		fwrite($fout, "#Deny non web services\n");
             fwrite($fout, "http_access deny !Safe_ports\n");
-            fwrite($fout, "http_access deny CONNECT\n");
+            fwrite($fout, "http_access deny CONNECT !SSL_ports\n");
             fwrite($fout, "\n");
             
             fwrite($fout, "#Set custom configured ACLs\n");
@@ -333,10 +334,12 @@
 	<custom_php_install_command>
 		write_static_squid_config();	<!-- write initial static config for transparent proxy -->
 		
+		touch("/tmp/custom_php_install_command">		
+
 		update_output_window("Creating Proxy Server initialization scripts...");
 		$fout = fopen("/usr/local/etc/rc.d/squid.sh","w");
 		fwrite($fout, "#!/bin/sh\n");
-		fwrite($fout, "#$pfSense: /usr/local/sbin/rc.d/squid.sh\n\n");
+		fwrite($fout, "#: /usr/local/etc/rc.d/squid.sh\n\n");
 		fwrite($fout, "touch /tmp/ro_root_mount\n");
 		fwrite($fout, "/usr/local/sbin/squid -D\n");
 		fwrite($fout, "touch /tmp/filter_dirty\n");
@@ -358,7 +361,6 @@
 		}
 		mwexec("/usr/sbin/chown squid:squid /var/squid/cache");
 		
-		
 		if (!file_exists("/usr/local/etc/squid/advanced/acls")) {
 			mwexec("mkdir -p /usr/local/etc/squid/advanced/acls");
 		}
@@ -379,6 +381,17 @@
 		}
 		mwexec("/usr/sbin/chown squid:squid /usr/local/etc/squid/advanced/radius");
 		
+		<-- EmanuelG: update pf group ownership settings to enhance squid performance and correct issue relating -->
+		<--           to error message: parseHttpRequest: PF open failed: (13) Permission denied                 -->
+		mwexec("chgrp squid /dev/pf");
+		mwexec("chmod g+rw /dev/pf");
+		
+		$devfs_file = fopen("/etc/devfs.conf", "a");
+		fwrite($devfs_file, "\n# Allow squid to query the packet filter bymaking is group-accessable. 
+		fwrite($devfs_file, "own pf root:squid");
+		fwrite($devfs_file, "perm pf 0640"); 
+		fclose($devfs_file);
+		
 		update_output_window("Initializing Cache... This may take a moment...");
 		mwexec("/usr/local/sbin/squid -z");
 		
@@ -389,9 +402,19 @@
 
 	<custom_php_deinstall_command>
 		update_output_window("Stopping proxy service...");
-		mwexec("/usr/local/sbin/squid -k shutdown");
+		
+		do while ((file_exists("/var/run/squid.pid") or ($i == 30)) {
+			mwexec("/usr/local/sbin/squid -k shutdown");
+			$i++;
+		}
+		
+		if ($i == 30) {
+			$pid = shell_exec('nohup squid > /dev/null & echo $!');
+			shell_exec('kill -9 ' . $pid . '/dev/null');
+		}
 	
 		update_output_window("Recursively removing directories hierarchies...");
+		update_output_window("If existant, log files in /var/squid/logs will remain...");
 		mwexec("rm -rf /usr/local/squid");
 		mwexec("rm -rf /var/squid/cache");	
 		mwexec("rm -rf /usr/local/etc/squid");