1 files changed, 330 insertions, 81 deletions

diff --git a/config/dansguardian/dansguardian.inc b/config/dansguardian/dansguardian.inc
index 3708e98c..c897f944 100755
--- a/config/dansguardian/dansguardian.inc
+++ b/config/dansguardian/dansguardian.inc
@@ -29,9 +29,18 @@
 */
 
 require_once("util.inc");
-require("globals.inc");
+require_once("globals.inc");
 #require("guiconfig.inc");
 
+$pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
+if ($pf_version > 2.0)
+        define('DANSGUARDIAN_DIR', '/usr/pbi/dansguardian-' . php_uname("m"));
+else
+  define('DANSGUARDIAN_DIR', '/usr/local');
+
+  $uname=posix_uname();
+if ($uname['machine']=='amd64')
+        ini_set('memory_limit', '250M');
 
 function dg_text_area_decode($text){
 	return preg_replace('/\r\n/', "\n",base64_decode($text));	
@@ -46,20 +55,55 @@ function dg_get_real_interface_address($iface) {
 	return array($ip, long2ip(hexdec($netmask)));
 }
 
-function sync_package_dansguardian() {
+function check_ca_hashes(){
 	global $config,$g;
-
-	#check if its booting
-	if ($g['booting']){
-		if (is_array($config['installedpackages']['dansguardian']))
-			if (!$config['installedpackages']['dansguardian']['config'][0]['enable'])
-				return;
-		if (file_exists("/var/run/dansguardian.pid")){
-			exec("/bin/ps -p `cat /var/run/dansguardian.pid` 2>&1",$return);
-			if (preg_match("/dansguardian/",$return[1]))
-				return;
+	
+	#check certificates
+	$cert_count=0;
+	if (is_dir('/usr/local/share/certs'))	
+		if ($handle = opendir('/usr/local/share/certs')) {
+    		while (false !== ($file = readdir($handle)))
+        		if (preg_match ("/\d+.0/",$file))
+            		$cert_count++;
+        	}
+    closedir($handle);
+	if ($cert_count < 10){
+		conf_mount_rw();
+		#create ca-root hashes from ca-root-nss package
+		log_error("Creating root certificate bundle hashes from the Mozilla Project");
+		$cas=file('/usr/local/share/certs/ca-root-nss.crt');
+		$cert=0;
+		foreach ($cas as $ca){
+	    	if (preg_match("/--BEGIN CERTIFICATE--/",$ca))
+				$cert=1;
+			if ($cert == 1)
+				$crt.=$ca;
+			if (preg_match("/-END CERTIFICATE-/",$ca)){
+				file_put_contents("/tmp/cert.pem",$crt, LOCK_EX);
+				$cert_hash=array();
+				exec("/usr/bin/openssl x509 -hash -noout -in /tmp/cert.pem",$cert_hash);
+				file_put_contents("/usr/local/share/certs/".$cert_hash[0].".0",$crt,LOCK_EX);
+				$crt="";
+				$cert=0;
+				}
+			}
 		}
+}
+
+function sync_package_dansguardian($via_rpc=false) {
+	global $config,$g;
+
+	# detect boot process
+	if (is_array($_POST)){
+		if (preg_match("/\w+/",$_POST['__csrf_magic']))
+			unset($boot_process);
+		else
+			$boot_process="on";
 	}
+
+	if (is_process_running('dansguardian') && isset($boot_process) && $via_rpc==false)
+		return;
+		
 	#assign xml arrays
 	if (!is_array($config['installedpackages']['dansguardian']))
 		$config['installedpackages']['dansguardian']['config'][0]=array('interface'=>'lo0',
@@ -94,14 +138,22 @@ function sync_package_dansguardian() {
 	$filterport=($dansguardian['filterports']?$dansguardian['filterports']:"8080");
 	$softrestart=(preg_match('/softrestart/',$dansguardian['daemon_options'])?"yes":"no");
 	$nodaemon=(preg_match('/nodaemon/',$dansguardian['daemon_options'])?"yes":"off");
-	if (preg_match("/\d+\/\d+/",$dansguardian['children']))
-		list($minchildren,$maxchildren) = split ("/", $dansguardian['children'], 2);
-	else
-		list($minchildren,$maxchildren) = split ("/", "8/120", 2);
-	if (preg_match("/\d+\/\d+/",$dansguardian['sparechildren']))
-		list($minsparechildren,$maxsparechildren) = split ("/", $dansguardian['sparechildren'], 2);
-	else
-		list($minsparechildren,$maxsparechildren) = split ("/", "8/64", 2);	
+	if (preg_match("/(\d+)\/(\d+)/",$dansguardian['children'],$matches)){
+		$minchildren=$matches[1];
+		$maxchildren=$matches[2];
+		}
+	else{
+		$minchildren=8;
+		$maxchildren=120;
+		}
+	if (preg_match("/(\d+)\/(\d+)/",$dansguardian['sparechildren'],$matches)){
+		$minsparechildren=$matches[1];
+		$maxsparechildren=$matches[2];
+		}
+	else{
+		$minsparechildren=8;
+		$maxsparechildren=64;
+		}
 	$maxagechildren=($dansguardian['maxagechildren']?$dansguardian['maxagechildren']:"500");
 	$maxips=($dansguardian['maxips']?$dansguardian['maxips']:"0");
 	$preforkchildren=($dansguardian['preforkchildren']?$dansguardian['preforkchildren']:"10");
@@ -132,7 +184,13 @@ function sync_package_dansguardian() {
 	$recheckreplacedurls=(preg_match('/icapscan/',$dansguardian_config['misc_options'])?"on":"off");
 	$usexforwardedfor=(preg_match('/usexforwardedfor/',$dansguardian_config['misc_options'])?"on":"off");
 	$authplugin=(preg_match('/usr/',$dansguardian_config['auth_plugin'])?"authplugin = '".$dansguardian_config['auth_plugin']."'":"");
-	
+	/*if ($dansguardian_config['auth_plugin']!=""){
+		$auth_plugins=explode(",",$dansguardian_config['auth_plugin']);
+		$authplugin="";
+		foreach ($auth_plugins as $auth_selected)
+			$authplugin.="authplugin = '".$auth_selected."'\n";
+	}
+	*/
 	#limits
 	$maxuploadsize=($dansguardian_limits['maxuploadsize']?$dansguardian_limits['maxuploadsize']:"-1");
 	$maxcontentfiltersize=($dansguardian_limits['maxcontentfiltersize']?$dansguardian_limits['maxcontentfiltersize']:"256");
@@ -143,6 +201,16 @@ function sync_package_dansguardian() {
 	
 	#report and log
 	$reportlevel=($dansguardian_log['report_level']?$dansguardian_log['report_level']:"3");
+	if ($reportlevel == 1 || $reportlevel== 2){
+		if (preg_match("@(\w+://[a-zA-Z0-9.:/\-]+)@",$dansguardian_log['reportingcgi'],$cgimatches)){
+			$accessdeniedaddress="accessdeniedaddress = '".$cgimatches[1]."'";
+			}
+		else{
+			log_error("dansguardian - " . $dansguardian_log['reportingcgi'] . " is not a valid access denied cgi url");
+			file_notice("dansguardian - " . $dansguardian_log['reportingcgi'] . " is not a valid access denied cgi url","");
+			}
+	}
+	$accessdenied=($dansguardian_log['reportingcgi']?$dansguardian_log['report_level']:"3");
 	$reportlanguage=($dansguardian_log['report_language']?$dansguardian_log['report_language']:"ukenglish");
 	$showweightedfound=(preg_match('/showweightedfound/',$dansguardian_log['report_options'])?"on":"off");
 	$usecustombannedflash=(preg_match('/usecustombannedflash/',$dansguardian_log['report_options'])?"on":"off");
@@ -198,10 +266,10 @@ function sync_package_dansguardian() {
 					"/lists/contentscanners/exceptionvirusmimetypelist",
 					"/lists/contentscanners/exceptionvirussitelist",
 					"/lists/contentscanners/exceptionvirusurllist",
+					"/lists/exceptioniplist",
 					"/lists/pics");
 	
-	
-	$dansguardian_dir="/usr/local/etc/dansguardian";
+	$dansguardian_dir= DANSGUARDIAN_DIR . "/etc/dansguardian";
 	foreach ($files as $file)
 		if (! file_exists($dansguardian_dir.$file.'.sample')){
 			$new_file="";
@@ -214,6 +282,36 @@ function sync_package_dansguardian() {
 		
 	$load_samples=0;
 	
+	#ssl men-in-the-middle feature
+	$dirs=array("/var/log/dansguardian/stats","/etc/ssl/demoCA","/etc/ssl/demoCA/private","/etc/ssl/demoCA/crl","/etc/ssl/demoCA/certs",$dansguardian_dir."/ssl/generatedcerts",$dansguardian_dir."/ssl/generatedlinks");
+	foreach ($dirs as $dir)
+		if (!is_dir($dir))
+			mkdir ($dir,0755,true);
+	$ca_cert = lookup_ca($dansguardian_config["dca"]);
+	if ($ca_cert != false) {
+		if(base64_decode($ca_cert['prv'])) {
+			file_put_contents("/etc/ssl/demoCA/private/cakey.pem",base64_decode($ca_cert['prv']));
+			$ca_pk = "caprivatekeypath = '/etc/ssl/demoCA/private/cakey.pem'";
+			}
+		if(base64_decode($ca_cert['crt'])) {
+			$cert_hash=array();
+			file_put_contents("/etc/ssl/demoCA/cacert.pem",base64_decode($ca_cert['crt']));
+			exec("/usr/bin/openssl x509 -hash -noout -in /etc/ssl/demoCA/cacert.pem",$cert_hash);
+			file_put_contents("/usr/local/share/certs/".$cert_hash[0].".0",base64_decode($ca_cert['crt']));
+			$ca_pem = "cacertificatepath = '/etc/ssl/demoCA/cacert.pem'";
+		$generatedcertpath= "generatedcertpath = '/etc/ssl/demoCA/certs/'";
+		#generatedcertpath = ".$dansguardian_dir . "/ssl/generatedcerts";
+		$generatedlinkpath= "generatedlinkpath = '".$dansguardian_dir . "/ssl/generatedlinks'";
+			}
+		$svr_cert = lookup_cert($dansguardian_config["dcert"]);
+		if ($svr_cert != false) {
+			if(base64_decode($svr_cert['prv'])) {
+				file_put_contents("/etc/ssl/demoCA/private/serverkey.pem",base64_decode($svr_cert['prv']));
+				$cert_key = "certprivatekeypath = '/etc/ssl/demoCA/private/serverkey.pem' ";
+			}
+		}
+	}
+	
 	#contentscanners preg_replace patterns
 	$match[0]="/(conf)/";
 	$match[1]="/(\/usr.local)/";
@@ -235,12 +333,12 @@ function sync_package_dansguardian() {
 	#phrase ACL
 	#create a default setup if not exists
 	if (!is_array($config['installedpackages']['dansguardianphraseacl']['config'])){
-		$banned_file=file("/usr/local/etc/dansguardian/lists/bannedphraselist");
+		$banned_file=file(DANSGUARDIAN_DIR . "/etc/dansguardian/lists/bannedphraselist");
 		foreach($banned_file as $file_line)
 			if (preg_match ("/^.Include<(\S+)>/",$file_line,$matches))
 			 	$banned_includes .= $matches[1].",";
 		
-		$weighted_file=file("/usr/local/etc/dansguardian/lists/weightedphraselist");
+		$weighted_file=file(DANSGUARDIAN_DIR . "/etc/dansguardian/lists/weightedphraselist");
 		foreach($weighted_file as $file_line)
 			if (preg_match ("/^.Include<(\S+)>/",$file_line,$matches))
 			 	$weighted_includes .= $matches[1].",";
@@ -331,7 +429,7 @@ function sync_package_dansguardian() {
 		file_put_contents($dansguardian_dir."/lists/logsitelist.".$dansguardian_site['name'],($dansguardian_site['urlsite_enabled']?dg_text_area_decode($config['installedpackages']['dansguardiansiteacl']['config'][$count]['log_sitelist']):""),LOCK_EX);	
 		$count++;
 	}	
-	
+
 	#URL ACL
 	#create a default setup if not exists
 	if (!is_array($config['installedpackages']['dansguardianurlacl']['config']))
@@ -579,7 +677,7 @@ function sync_package_dansguardian() {
 	if($dansguardian_antivirus['extension_list'] == "" && file_exists ($dansguardian_dir.'/lists/contentscanners/exceptionvirusextensionlist.sample')){
 		$config['installedpackages']['dansguardianantivirusacl']['config'][0]['extension_list']=base64_encode(file_get_contents($dansguardian_dir.'/lists/contentscanners/exceptionvirusextensionlist.sample'));
 		$load_samples++;
-	}	
+	}
 	file_put_contents($dansguardian_dir."/lists/contentscanners/exceptionvirusextensionlist",($dansguardian_antivirus['extension_enabled']?dg_text_area_decode($config['installedpackages']['dansguardianantivirusacl']['config'][0]['extension_list']):""),LOCK_EX);
 		
 	#log report
@@ -589,7 +687,17 @@ function sync_package_dansguardian() {
 		$config['installedpackages']['dansguardianlog']['config'][0]['report_file']=base64_encode($report_file);
 		$dansguardian_log['report_file']=base64_encode($report_file);
 		$load_samples++;
-	}	
+	}
+	
+	#exception ip list
+	#create a default setup if not exists
+	if (!is_array($config['installedpackages']['dansguardianips']['config']))
+		$config['installedpackages']['dansguardianips']['config'][0]=array("exceptioniplist" => "");
+	if($config['installedpackages']['dansguardianips']['config'][0]['exceptioniplist'] == "" && file_exists ($dansguardian_dir.'/lists/exceptioniplist.sample')){
+		$config['installedpackages']['dansguardianips']['config'][0]['exceptioniplist']=base64_encode(file_get_contents($dansguardian_dir.'/lists/exceptioniplist.sample'));
+		$load_samples++;
+	}
+	file_put_contents($dansguardian_dir."/lists/exceptioniplist",dg_text_area_decode($config['installedpackages']['dansguardianips']['config'][0]['exceptioniplist']),LOCK_EX);
 
 	if($load_samples > 0)
 		write_config();
@@ -608,7 +716,8 @@ function sync_package_dansguardian() {
 																				'urlacl'=> "Default",
 																				'group_options' => "scancleancache,infectionbypasserrorsonly",
 																				'reportinglevel'=>'3',
-																				'mode'=> "1");
+																				'mode'=> "1",
+																				'report_level'=>"global");
 
 	$groups=array("scancleancache","hexdecodecontent","blockdownloads","enablepics","deepurlanalysis","infectionbypasserrorsonly","disablecontentscan","sslcertcheck","sslmitm");
 	#loop on array
@@ -626,8 +735,88 @@ function sync_package_dansguardian() {
 		$dansguardian_groups['embeddedurlweight']=($dansguardian_groups['embeddedurlweight']?$dansguardian_groups['embeddedurlweight']:"0");
 		$dansguardian_groups['bypass']=($dansguardian_groups['bypass']?$dansguardian_groups['bypass']:"0");
 		$dansguardian_groups['infectionbypass']=($dansguardian_groups['infectionbypass']?$dansguardian_groups['infectionbypass']:"0");
+		$dansguardian_groups['mitmkey']=($dansguardian_groups['mitmkey']?$dansguardian_groups['mitmkey']:"dgs3dD3da");
+		switch ($dansguardian_groups['reportinglevel']){
+			case "1":
+			case "2":
+				$groupreportinglevel="reportinglevel = ".$dansguardian_groups['reportinglevel'];
+				if (preg_match("@(\w+://[a-zA-Z0-9.:/\-]+)@",$dansguardian_groups['reportingcgi'],$cgimatches)){
+					$groupaccessdeniedaddress="accessdeniedaddress = '".$cgimatches[1]."'";
+					}
+				else{
+					log_error('Dansguardian - Group '.$dansguardian_groups['name']. ' does not has a valid access denied cgi url.');
+					file_notice('Dansguardian - Group '.$dansguardian_groups['name']. ' does not has a valid access denied cgi url.',"");
+					}
+			break;		
+			case "-1": 
+			case "0":
+			case "3":
+				$groupreportinglevel="reportinglevel = ".$dansguardian_groups['reportinglevel'];
+				$groupaccessdeniedaddress="";
+			break;
+			default:
+				$groupreportinglevel="";
+				$groupaccessdeniedaddress="";
+		}
+
 		foreach ($groups as $group)
 			$dansguardian_groups[$group]=(preg_match("/$group/",$dansguardian_groups['group_options'])?"on":"off");
+		#create group list files
+		$lists=array("phraseacl"   => array("bannedphrase","weightedphrase","exceptionphrase"),
+					 "siteacl"     => array("bannedsite","greysite","exceptionsite","exceptionfilesite","logsite"),
+					 "urlacl"      => array("bannedurl","greyurl","exceptionurl","exceptionregexpurl","bannedregexpurl","urlregexp","exceptionfileurl","logurl","logregexpurl"),
+					 "contentacl"  => array("contentregexp"),
+					 "extensionacl"=> array("exceptionextension","exceptionmimetype","bannedextension","bannedmimetype"),
+					 "headeracl"   => array("headerregexp","bannedregexpheader"),
+					 "searchacl"   => array("searchengineregexp","bannedsearchterm","weightedsearchterm","exceptionsearchterm")
+					 );
+		foreach ($lists as $list_key => $list_array){
+			foreach ($list_array as $list_value){
+				#read all access lists applied tho this group option
+				foreach (explode(",",$dansguardian_groups[$list_key]) as $dacl){
+					if (! is_array(${$list_value}))
+						${$list_value}=array();
+					$file_temp=file_get_contents(DANSGUARDIAN_DIR . "/etc/dansguardian/lists/{$list_value}list.{$dacl}")."\n";
+					${$list_value}=array_merge(explode("\n",$file_temp),${$list_value});
+				}
+				#add a package warning
+				array_unshift(${$list_value},"#Do not edit this file.","#It's created by dansguardian package and overwrited every config save.");
+				#save group file and unset array
+				file_put_contents(DANSGUARDIAN_DIR . "/etc/dansguardian/lists/{$list_value}list.g_{$dansguardian_groups['name']}",implode("\n",array_unique(${$list_value}))."\n",LOCK_EX);
+				unset(${$list_value});
+				}		
+		}
+		/*
+		bannedphraselist = '/usr/local/etc/dansguardian/lists/bannedphraselist.{$dansguardian_groups['phraseacl']}'
+		weightedphraselist = '/usr/local/etc/dansguardian/lists/weightedphraselist.{$dansguardian_groups['phraseacl']}'
+		exceptionphraselist = '/usr/local/etc/dansguardian/lists/exceptionphraselist.{$dansguardian_groups['phraseacl']}'
+		bannedsitelist = '/usr/local/etc/dansguardian/lists/bannedsitelist.{$dansguardian_groups['siteacl']}'
+		greysitelist = '/usr/local/etc/dansguardian/lists/greysitelist.{$dansguardian_groups['siteacl']}'
+		exceptionsitelist = '/usr/local/etc/dansguardian/lists/exceptionsitelist.{$dansguardian_groups['siteacl']}'
+		bannedurllist = '/usr/local/etc/dansguardian/lists/bannedurllist.{$dansguardian_groups['urlacl']}'
+		greyurllist = '/usr/local/etc/dansguardian/lists/greyurllist.{$dansguardian_groups['urlacl']}'
+		exceptionurllist = '/usr/local/etc/dansguardian/lists/exceptionurllist.{$dansguardian_groups['urlacl']}'
+		exceptionregexpurllist = '/usr/local/etc/dansguardian/lists/exceptionregexpurllist.{$dansguardian_groups['urlacl']}'
+		bannedregexpurllist = '/usr/local/etc/dansguardian/lists/bannedregexpurllist.{$dansguardian_groups['urlacl']}'
+		contentregexplist = '/usr/local/etc/dansguardian/lists/contentregexplist.{$dansguardian_groups['contentacl']}'
+		urlregexplist = '/usr/local/etc/dansguardian/lists/urlregexplist.{$dansguardian_groups['urlacl']}'
+		exceptionextensionlist = '/usr/local/etc/dansguardian/lists/exceptionextensionlist.{$dansguardian_groups['extensionacl']}'
+		exceptionmimetypelist = '/usr/local/etc/dansguardian/lists/exceptionmimetypelist.{$dansguardian_groups['extensionacl']}'
+		bannedextensionlist = '/usr/local/etc/dansguardian/lists/bannedextensionlist.{$dansguardian_groups['extensionacl']}'
+		bannedmimetypelist = '/usr/local/etc/dansguardian/lists/bannedmimetypelist.{$dansguardian_groups['extensionacl']}'
+		exceptionfilesitelist = '/usr/local/etc/dansguardian/lists/exceptionfilesitelist.{$dansguardian_groups['siteacl']}'
+		exceptionfileurllist = '/usr/local/etc/dansguardian/lists/exceptionfileurllist.{$dansguardian_groups['urlacl']}'
+		logsitelist = '/usr/local/etc/dansguardian/lists/logsitelist.{$dansguardian_groups['siteacl']}'
+		logurllist = '/usr/local/etc/dansguardian/lists/logurllist.{$dansguardian_groups['urlacl']}'
+		logregexpurllist = '/usr/local/etc/dansguardian/lists/logregexpurllist.{$dansguardian_groups['urlacl']}'
+		headerregexplist = '/usr/local/etc/dansguardian/lists/headerregexplist.{$dansguardian_groups['headeracl']}'
+		bannedregexpheaderlist = '/usr/local/etc/dansguardian/lists/bannedregexpheaderlist.{$dansguardian_groups['headeracl']}'
+		searchengineregexplist = '/usr/local/etc/dansguardian/lists/searchengineregexplist.{$dansguardian_groups['searchacl']}'
+		bannedsearchtermlist = '/usr/local/etc/dansguardian/lists/bannedsearchtermlist.{$dansguardian_groups['searchacl']}'
+		weightedsearchtermlist = '/usr/local/etc/dansguardian/lists/weightedsearchtermlist.{$dansguardian_groups['searchacl']}'
+		exceptionsearchtermlist = '/usr/local/etc/dansguardian/lists/exceptionsearchtermlist.{$dansguardian_groups['searchacl']}'
+		*/ 
+		$dg_dir=DANSGUARDIAN_DIR;
 		include("/usr/local/pkg/dansguardianfx.conf.template");
 		file_put_contents($dansguardian_dir."/dansguardianf".$count.".conf", $dgf, LOCK_EX);
 		
@@ -700,7 +889,7 @@ EOF;
 			<fielddescr>Users</fielddescr>
 			<fieldname>info_checkbox</fieldname>
 			<type>checkbox</type>
-			<description><![CDATA[Dansguardian users are required only when you have more then one group.<br>All unauthenticated users or unlisted uses will match first filter group.]]></description>
+			<description><![CDATA[Dansguardian users are required only when you have more then one group.<br>All unauthenticated users or unlisted users will match first filter group.]]></description>
 		</field>
 EOF;
 	}
@@ -769,10 +958,11 @@ EOF;
 	$cron_found=0;
 	if (is_array($config['cron']['item']))
 		foreach($config['cron']['item'] as $cron)
-			if (!preg_match("/usr.local.(bin.freshclam|www.dansguardian.php)/",$cron["command"])){
+			if (preg_match("/usr.local.(bin.freshclam|www.dansguardian)/",$cron["command"]))
 				$cron_found++;
+			else
 				$new_cron['item'][]=$cron;
-			}
+				
 	$cron_cmd="/usr/local/bin/freshclam";
 	if($dansguardian_config['cron'] && preg_match("/clamd/",$dansguardian_config['content_scanners']))
 		switch ($dansguardian_config['cron']){
@@ -848,7 +1038,32 @@ EOF;
 				break;
 		}
 
-		
+	$cron_cmd="/usr/local/bin/php /usr/local/www/dansguardian_ldap.php";
+	if (is_array($config['installedpackages']['dansguardiangroups']['config']))
+	 foreach ($config['installedpackages']['dansguardiangroups']['config'] as $dansguardian_groups){
+	  if(preg_match('/(\d+)m/',$dansguardian_groups['freq'],$matches)){
+				$new_cron['item'][]=array(	"minute" =>	"*/".$matches[1],
+											"hour"	 =>	"*",
+											"mday" 	 =>	"*",
+											"month"  =>	"*",
+											"wday"	 =>	"*",
+											"who"	 =>	"root",
+											"command"=>	$cron_cmd." ".$dansguardian_groups['name']);
+				$config['cron']=$new_cron;
+				$cron_found++;
+		}
+	  if(preg_match('/(\d+)h/',$dansguardian_groups['freq'],$matches)){
+				$new_cron['item'][]=array(	"minute" =>	"0",
+											"hour"	 =>	"*/".$matches[1],
+											"mday" 	 =>	"*",
+											"month"  =>	"*",
+											"wday"	 =>	"*",
+											"who"	 =>	"root",
+											"command"=>	$cron_cmd." ".$dansguardian_groups['name']);
+				$config['cron']=$new_cron;
+				$cron_found++;
+		}
+	}
 	#write files
 	conf_mount_rw();
 
@@ -857,6 +1072,7 @@ EOF;
 	#update cron
 	if ($cron_found > 0){
 		$config['cron']=$new_cron;
+		write_config();
 		configure_cron();
 	}
 	
@@ -890,7 +1106,7 @@ EOF;
 			$replace[0]='YES';
 
 			#clamdscan.conf dansguardian file	
-			$cconf="/usr/local/etc/dansguardian/contentscanners/clamdscan.conf";
+			$cconf=DANSGUARDIAN_DIR . "/etc/dansguardian/contentscanners/clamdscan.conf";
 			$cconf_file=file_get_contents($cconf);
 			if (preg_match('/#clamdudsfile/',$cconf_file)){
 				$cconf_file=preg_replace('/#clamdudsfile/','clamdudsfile',$cconf_file);
@@ -906,8 +1122,9 @@ EOF;
 				$script_file=file($script);
 				foreach ($script_file as $script_line){
 					if(preg_match("/command=/",$script_line)){
-						$new_clamav_startup.= "/bin/mkdir /var/run/clamav\n";
-						$new_clamav_startup.= "chown ".$matches[1]." /var/run/clamav\n";
+						$new_clamav_startup.= 'if [ ! -d /var/run/clamav ];then /bin/mkdir /var/run/clamav;fi'."\n";
+						$new_clamav_startup.= "chown -R ".$matches[1]." /var/run/clamav\n";
+						$new_clamav_startup.= "chown -R ".$matches[1]." /var/log/clamav\n";
 						$new_clamav_startup.=$script_line;
 						}
 					elseif(!preg_match("/(mkdir|chown|sleep|mailscanner)/",$script_line)) {
@@ -916,50 +1133,70 @@ EOF;
 					}
 				file_put_contents($script, $new_clamav_startup, LOCK_EX);
 				chmod ($script,0755);
-				if (file_exists('/var/run/dansguardian.pid'))
+				if (file_exists('/var/run/dansguardian.pid') && is_process_running('clamd')){
+					log_error('Stopping clamav-clamd');
 					mwexec("$script stop");
+					}
 				unlink_if_exists("/tmp/.dguardianipc");
 				unlink_if_exists("/tmp/.dguardianurlipc");
-				mwexec_bg("$script start");
+				if (! is_process_running('clamd')){
+					log_error('Starting clamav-clamd');
+					mwexec_bg("$script start");
+				}
 			}	
 	}
 
-
-	$script='/usr/local/etc/rc.d/dansguardian';
-	if($config['installedpackages']['dansguardian']['config'][0]['enable']){
-		$script_file=file_get_contents($script);
-		if (preg_match('/NO/',$script_file)){
-			$script_file=preg_replace("/NO/","YES",$script_file);
-			file_put_contents($script, $script_file, LOCK_EX);
-			}
+	#check certificate hashed
+	
+	$script='/usr/local/etc/rc.d/dansguardian.sh';
+	unlink_if_exists('/usr/local/etc/rc.d/dansguardian');
+	if($config['installedpackages']['dansguardian']['config'][0]['enable']=="on"){
+		copy('/usr/local/pkg/dansguardian_rc.template',$script);
 		chmod ($script,0755);
-		mwexec("$script stop");			
-		mwexec_bg("$script start");
+		if (is_process_running('dansguardian')){
+			log_error('Reloading Dansguardian');
+			exec("/usr/local/sbin/dansguardian -r");
+			}
+		else{
+			log_error('Starting Dansguardian');
+			mwexec("$script start");
+			}
 	}
 	else{
-		mwexec("$script stop");
-		chmod ($script,0444);	
+		if (is_process_running('dansguardian')){
+			log_error('Dansguardian is disabled, stopping process...');
+			mwexec("$script stop");
+			}
+		if (file_exists($script))
+			chmod ($script,444);	
 	}
 	
-	if (!file_exists('/usr/local/etc/dansguardian/lists/phraselists/pornography/weighted_russian_utf8'))
-		file_put_contents('/usr/local/etc/dansguardian/lists/phraselists/pornography/weighted_russian_utf8',"",LOCK_EX);
-		
-	conf_mount_ro();
-	$synconchanges = $config['installedpackages']['dansguardiansync']['config'][0]['synconchanges'];
-	if(!$synconchanges && !$syncondbchanges) 
-		return;
-	log_error("[dansguardian] dansguardian_xmlrpc_sync.php is starting.");
-	foreach ($config['installedpackages']['dansguardiansync']['config'] as $rs ){
-		foreach($rs['row'] as $sh){
-		$sync_to_ip = $sh['ipaddress'];
-		$password   = $sh['password'];
-		$sync_type = $sh['sync_type'];
-		if($password && $sync_to_ip)
-			dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type);
-		}
-	}
-	log_error("[dansguardian] dansguardian_xmlrpc_sync.php is ending.");
+	if (!file_exists(DANSGUARDIAN_DIR . '/etc/dansguardian/lists/phraselists/pornography/weighted_russian_utf8'))
+		file_put_contents(DANSGUARDIAN_DIR . '/etc/dansguardian/lists/phraselists/pornography/weighted_russian_utf8',"",LOCK_EX);
+	
+	#check ca certs hashes	
+	check_ca_hashes();
 
+	#mount read only
+    conf_mount_ro();
+    
+    #avoid sync during boot process
+	if (!isset($boot_process)){
+	    $synconchanges = $config['installedpackages']['dansguardiansync']['config'][0]['synconchanges'];
+		if(!$synconchanges && !$syncondbchanges) 
+			return;
+		log_error("[dansguardian] dansguardian_xmlrpc_sync.php is starting.");
+		foreach ($config['installedpackages']['dansguardiansync']['config'] as $rs ){
+			foreach($rs['row'] as $sh){
+				$sync_to_ip = $sh['ipaddress'];
+				$password   = $sh['password'];
+				$sync_type = $sh['sync_type'];
+				if($password && $sync_to_ip)
+					dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type);
+				}
+			}
+		log_error("[dansguardian] dansguardian_xmlrpc_sync.php is ending.");
+		}
 }
 
 function dansguardian_validate_input($post, &$input_errors) {
@@ -970,20 +1207,30 @@ function dansguardian_validate_input($post, &$input_errors) {
 				$input_errors[] = "{$value} cannot be used as name.";
 		else if ($key == "name" && preg_match("/\W/",$value)) 
 				$input_errors[] = "{$value} cannot be used as name. Use only a-z 0-9 characters";
-				
+		else if (empty($value))
+				continue;
+		else if($key == "freq" && (!preg_match("/^\d+(h|m|d)$/",$value) || $value == 0))
+				$input_errors[] = "A valid number with a time reference is required for the field 'Update Frequency'";
 	}
 }
 
 function dansguardian_php_install_command() {
-	sync_package_dansguardian();
+		sync_package_dansguardian();
 }
 
 function dansguardian_php_deinstall_command() {
-	mwexec("/usr/local/etc/rc.d/dansguardian stop");
-	sleep(1);
-	conf_mount_rw();
-	chmod ("/usr/local/etc/rc.d/dansguardian",0444);
-	conf_mount_ro();
+	global $config,$g;
+	if(is_process_running('dansguardian')){
+		log_error("stopping dansguardian..");
+		mwexec("/usr/local/etc/rc.d/dansguardian.sh stop");
+		sleep(1);
+		}
+	
+	if (file_exists("/usr/local/etc/rc.d/dansguardian.sh")){
+		conf_mount_rw();
+		chmod ("/usr/local/etc/rc.d/dansguardian.sh",0444);
+		conf_mount_ro();
+	}
 }
 
 function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) {
@@ -1018,6 +1265,8 @@ function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) {
 		$xml['dansguardian'] = $config['installedpackages']['dansguardian'];
 		$xml['dansguardianantivirusacl'] = $config['installedpackages']['dansguardianantivirusacl'];
 		$xml['dansguardianconfig'] = $config['installedpackages']['dansguardianconfig'];
+		$xml['dansguardianblacklist'] = $config['installedpackages']['dansguardianblacklist'];
+		$xml['dansguardianldap'] = $config['installedpackages']['dansguardianldap'];
 		$xml['dansguardiancontentacl'] = $config['installedpackages']['dansguardiancontentacl'];
 		$xml['dansguardianfileacl'] = $config['installedpackages']['dansguardianfileacl'];
 		$xml['dansguardiangroups'] = $config['installedpackages']['dansguardiangroups'];
@@ -1048,15 +1297,15 @@ function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) {
 		$cli->setCredentials('admin', $password);
 		if($g['debug'])
 			$cli->setDebug(1);
-		/* send our XMLRPC message and timeout after 250 seconds */
-		$resp = $cli->send($msg, "250");
+		/* send our XMLRPC message and timeout after 30 seconds */
+		$resp = $cli->send($msg, "30");
 		if(!$resp) {
 			$error = "A communications error occurred while attempting dansguardian XMLRPC sync with {$url}:{$port}.";
 			log_error($error);
 			file_notice("sync_settings", $error, "dansguardian Settings Sync", "");
 		} elseif($resp->faultCode()) {
 			$cli->setDebug(1);
-			$resp = $cli->send($msg, "250");
+			$resp = $cli->send($msg, "30");
 			$error = "An error code was received while attempting dansguardian XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
 			log_error($error);
 			file_notice("sync_settings", $error, "dansguardian Settings Sync", "");
@@ -1067,7 +1316,7 @@ function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) {
 		/* tell dansguardian to reload our settings on the destionation sync host. */
 		$method = 'pfsense.exec_php';
 		$execcmd  = "require_once('/usr/local/pkg/dansguardian.inc');\n";
-		$execcmd .= "sync_package_dansguardian();";
+		$execcmd .= "sync_package_dansguardian(true);";
 		
 		/* assemble xmlrpc payload */
 		$params = array(
@@ -1079,14 +1328,14 @@ function dansguardian_do_xmlrpc_sync($sync_to_ip, $password,$sync_type) {
 		$msg = new XML_RPC_Message($method, $params);
 		$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
 		$cli->setCredentials('admin', $password);
-		$resp = $cli->send($msg, "250");
+		$resp = $cli->send($msg, "30");
 		if(!$resp) {
 			$error = "A communications error occurred while attempting dansguardian XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
 			log_error($error);
 			file_notice("sync_settings", $error, "dansguardian Settings Sync", "");
 		} elseif($resp->faultCode()) {
 			$cli->setDebug(1);
-			$resp = $cli->send($msg, "250");
+			$resp = $cli->send($msg, "30");
 			$error = "An error code was received while attempting dansguardian XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
 			log_error($error);
 			file_notice("sync_settings", $error, "dansguardian Settings Sync", "");