aboutsummaryrefslogtreecommitdiffstats
path: root/config/squid3/34/squid.inc
diff options
context:
space:
mode:
Diffstat (limited to 'config/squid3/34/squid.inc')
-rwxr-xr-xconfig/squid3/34/squid.inc156
1 files changed, 118 insertions, 38 deletions
diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc
index aab4d134..952d50d8 100755
--- a/config/squid3/34/squid.inc
+++ b/config/squid3/34/squid.inc
@@ -66,7 +66,7 @@ define('SQUID_CONFBASE', SQUID_LOCALBASE .'/etc/squid');
define('SQUID_CONFFILE', SQUID_CONFBASE . '/squid.conf');
define('SQUID_ACLDIR', '/var/squid/acl');
define('SQUID_PASSWD', '/var/etc/squid.passwd');
-define('SQUID_SSL_DB','/var/squid/lib/ssl_db');
+define('SQUID_SSL_DB', '/var/squid/lib/ssl_db');
$valid_acls = array();
@@ -148,15 +148,11 @@ function squid_enabled() {
// check whether Squid is enabled ...
if ($config['installedpackages']['squid']['config'][0]['enable_squid'] == "on") {
// ... and has at least one interface configured ...
- if ($config['installedpackages']['squid']['config'][0]['active_interface'] != "") {
+ if (!empty($config['installedpackages']['squid']['config'][0]['active_interface'])) {
+ $proxy_enabled = true;
+ // ... or whether Squid reverse proxy is enabled
+ } elseif (squid_reverse_enabled()) {
$proxy_enabled = true;
- } else {
- // ... or has at least one reverse interface configured
- if (is_array($config['installedpackages']['squidreversegeneral']['config'])) {
- if ($config['installedpackages']['squidreversegeneral']['config'][0]['reverse_interface'] != "") {
- $proxy_enabled = true;
- }
- }
}
}
}
@@ -724,16 +720,27 @@ function squid_validate_general($post, &$input_errors) {
// force users to configure cache
if (!is_array($config['installedpackages']['squidcache']['config'])) {
- $input_errors[] = 'Please, configure and save \'Local Cache\' settings first.';
+ $input_errors[] = "Please, configure and save 'Local Cache' settings first.";
}
- $port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
- $port = $post['proxy_port'] ? $post['proxy_port'] : $port;
+ // force users to select at least one proxy or reverse proxy interface when enabling Squid
+ if ($post['enable_squid'] == "on") {
+ // if reverse proxy is configured, perhaps the user wants to use the reverse proxy features only
+ if (!squid_reverse_enabled()) {
+ if (empty($post['active_interface'])) {
+ $input_errors[] = "You must select at least one interface under 'Proxy Interface(s)' to enable Squid proxy.";
+ $input_errors[] = "If you intend to use Squid as reverse proxy ONLY, then visit Services: Squid Proxy Server: General, configure and save the reverse proxy settings first.";
+ }
+ } else {
+ log_error("[squid] Enabled as reverse proxy ONLY. If this is not what you intended, visit Services: Squid Proxy Server: General and configure proxy interfaces.");
+ }
+ }
$icp_port = trim($post['icp_port']);
if (!empty($icp_port) && !is_port($icp_port)) {
- $input_errors[] = 'You must enter a valid port number in the \'ICP port\' field.';
+ $input_errors[] = "You must enter a valid port number in the 'ICP port' field.";
}
+ unset($icp_port);
if (substr($post['log_dir'], -1, 1) == '/') {
$input_errors[] = 'Log location must not end with a / character.';
@@ -748,26 +755,63 @@ function squid_validate_general($post, &$input_errors) {
}
$log_rotate = trim($post['log_rotate']);
-
if (!empty($log_rotate) && (!is_numericint($log_rotate) or ($log_rotate < 1))) {
$input_errors[] = "You must enter a valid number of days in the 'Log rotate' field.";
}
+ unset($log_rotate);
+ // check that the proxy port does not clash with WebGUI
+ $port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
+ $port = $post['proxy_port'] ? $post['proxy_port'] : $port;
$webgui_port = $config['system']['webgui']['port'];
-
if (($config['system']['webgui']['port'] == "") && ($config['system']['webgui']['protocol'] == "http")) {
$webgui_port = 80;
}
if (($config['system']['webgui']['port'] == "") && ($config['system']['webgui']['protocol'] == "https")) {
$webgui_port = 443;
}
-
if (($post['transparent_proxy'] != 'on') && ($port == $webgui_port)) {
$input_errors[] = "You can not run Squid on the same port as the pfSense WebGUI";
}
+ unset($port, $webgui_port);
+
+ if ($post['transparent_proxy'] == 'on') {
+ if (empty($post['transparent_active_interface'])) {
+ $input_errors[] = "You must select at least one interface under 'Transparent Proxy Interface(s)' when 'Transparent HTTP Proxy' is enabled.";
+ } else {
+ // allow transparent proxy only on interfaces where Squid is actually running to keep configuration sane
+ $a_ifaces = $post['active_interface'] ?: array();
+ $t_ifaces = $post['transparent_active_interface'];
+ foreach ($t_ifaces as $t_iface) {
+ if (!in_array($t_iface, $a_ifaces)) {
+ $err_iface = convert_friendly_interface_to_friendly_descr($t_iface);
+ $input_errors[] = "'Transparent Proxy Interface(s)' may only contain interfaces also selected in 'Proxy Interface(s)' above. '{$err_iface}' is not valid.";
+ unset($err_iface);
+ }
+ }
+ unset($a_ifaces, $t_iface, $t_ifaces);
+ }
+ }
- if (($post['ssl_proxy'] == 'on') && ( $post['dca'] == '')) {
- $input_errors[] = "SSL interception cannot be enabled without a CA.";
+ if ($post['ssl_proxy'] == 'on') {
+ if ($post['dca'] == 'none') {
+ $input_errors[] = "SSL interception cannot be enabled without a CA.";
+ }
+ if (empty($post['ssl_active_interface'])) {
+ $input_errors[] = "You must select at least one interface under 'SSL Intercept Interface(s)' when 'HTTPS/SSL Interception' is enabled.";
+ } else {
+ // allow HTTPS/SSL Interception only on interfaces where Squid is actually running to keep configuration sane
+ $a_ifaces = $post['active_interface'] ?: array();
+ $s_ifaces = $post['ssl_active_interface'];
+ foreach ($s_ifaces as $s_iface) {
+ if (!in_array($s_iface, $a_ifaces)) {
+ $err_iface = convert_friendly_interface_to_friendly_descr($s_iface);
+ $input_errors[] = "'SSL Intercept Interface(s)' may only contain interfaces also selected in 'Proxy Interface(s)' above. '{$err_iface}' is not valid.";
+ unset($err_iface);
+ }
+ }
+ unset($a_ifaces, $s_ifaces, $s_iface);
+ }
}
foreach (array('defined_ip_proxy_off') as $hosts) {
@@ -778,6 +822,8 @@ function squid_validate_general($post, &$input_errors) {
}
}
}
+ unset($host, $hosts);
+
foreach (array('defined_ip_proxy_off_dest') as $hosts) {
foreach (explode(";", $post[$hosts]) as $host) {
$host = trim($host);
@@ -786,6 +832,7 @@ function squid_validate_general($post, &$input_errors) {
}
}
}
+ unset($host, $hosts);
if (!empty($post['dns_nameservers'])) {
$altdns = explode(";", ($post['dns_nameservers']));
@@ -796,6 +843,7 @@ function squid_validate_general($post, &$input_errors) {
}
}
}
+ unset($altdns, $dnssrv);
}
/* Proxy Server: Remote Proxy Settings input validation */
@@ -823,6 +871,7 @@ function squid_validate_upstream($post, &$input_errors) {
}
}
}
+ unset($port);
}
/* Proxy Server: Cache Management input validation */
@@ -846,17 +895,20 @@ function squid_validate_cache($post, &$input_errors) {
$input_errors[] = "You must enter a valid value for '$field'.";
}
}
+ unset($num_fields);
$value = trim($post['minimum_object_size']);
if (!is_numericint($value)) {
$input_errors[] = "You must enter a valid value for 'Minimum object size'.";
}
+ unset($value);
if (!empty($post['cache_swap_low'])) {
$value = trim($post['cache_swap_low']);
if (!is_numericint($value) || ($value > 100)) {
$input_errors[] = "You must enter a valid value for 'Low-water-mark'.";
}
+ unset($value);
}
if (!empty($post['cache_swap_high'])) {
@@ -864,6 +916,7 @@ function squid_validate_cache($post, &$input_errors) {
if (!is_numericint($value) || ($value > 100)) {
$input_errors[] = "You must enter a valid value for 'High-water-mark'.";
}
+ unset($value);
}
if ($post['donotcache'] != "") {
@@ -873,6 +926,7 @@ function squid_validate_cache($post, &$input_errors) {
$input_errors[] = "The host '$host' is not a valid IP or hostname.";
}
}
+ unset($host);
}
if (substr($post['harddisk_cache_location'], -1, 1) == '/') {
@@ -897,6 +951,7 @@ function squid_validate_nac($post, &$input_errors) {
$input_errors[] = "'Allowed Subnets' must be a valid CIDR range or 'all'. The subnet '$subnet' is not valid.";
}
}
+ unset($allowed_subnets);
foreach (array('unrestricted_hosts', 'banned_hosts') as $hosts) {
if (preg_match_all("@([0-9.]+)(/[0-9.]+|)@", $_POST[$hosts], $matches)) {
@@ -921,6 +976,7 @@ function squid_validate_nac($post, &$input_errors) {
$input_errors[] = "'$mac' is not a valid MAC address.";
}
}
+ unset($mac);
}
foreach (explode(",", $post['timelist']) as $time) {
@@ -929,6 +985,7 @@ function squid_validate_nac($post, &$input_errors) {
$input_errors[] = "The time range '$time' is not a valid time range.";
}
}
+ unset($time);
if (!empty($post['ext_cachemanager'])) {
$extmgr = explode(";", ($post['ext_cachemanager']));
@@ -938,6 +995,7 @@ function squid_validate_nac($post, &$input_errors) {
}
}
}
+ unset($extmgr);
}
/* Proxy server: Traffic Management input validation */
@@ -955,6 +1013,7 @@ function squid_validate_traffic($post, &$input_errors) {
$input_errors[] = "The '$name' field must contain a positive integer.";
}
}
+ unset($num_fields);
if (!empty($post['quick_abort_min'])) {
$value = trim($post['quick_abort_min']);
@@ -982,6 +1041,7 @@ function squid_validate_traffic($post, &$input_errors) {
if ($post['throttle_binaries'] == "" && $post['throttle_cdimages'] == "" && $post['throttle_multimedia'] == "" && $others == "") {
$input_errors[] = "'Throttle Only Specific Extensions' enabled but no extensions specified. Select some options under 'Squid Transfer Extension Settings' or disable this option.";
}
+ unset($others);
}
}
@@ -999,6 +1059,7 @@ function squid_validate_auth($post, &$input_errors) {
$input_errors[] = "The '{$field[1]}' field must contain a valid number greater than {$field[2]}";
}
}
+ unset($num_fields);
$auth_method = $post['auth_method'];
if (($auth_method != 'none') && ($auth_method != 'local') && ($auth_method != 'cp')) {
@@ -1046,6 +1107,7 @@ function squid_validate_auth($post, &$input_errors) {
}
}
}
+ unset($auth_method, $port, $server, $secret, $user);
}
/* Proxy Server: General Settings configuration handler */
@@ -1108,7 +1170,7 @@ function squid_resync_general() {
}
}
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
- $ssl_port = ($settings['ssl_proxy_port'] ? $settings['ssl_proxy_port'] : 3127);
+ $ssl_port = ($settings['ssl_proxy_port'] ? $settings['ssl_proxy_port'] : 3129);
// Read assigned interfaces
$real_ifaces = array();
@@ -1116,7 +1178,7 @@ function squid_resync_general() {
if ($settings['active_interface']) {
$proxy_ifaces = explode(",", $settings['active_interface']);
} else {
- $proxy_ifaces = array("lan");
+ $proxy_ifaces = array();
}
if ($settings['transparent_proxy'] == "on") {
@@ -1136,7 +1198,7 @@ function squid_resync_general() {
foreach ($ssl_ifaces as $s_iface) {
$s_iface_ip = squid_get_real_interface_address($s_iface);
if ($s_iface_ip[0]) {
- $real_ifaces[]=$s_iface_ip;
+ $real_ifaces[] = $s_iface_ip;
}
}
} else {
@@ -1147,11 +1209,16 @@ function squid_resync_general() {
foreach ($proxy_ifaces as $iface) {
$iface_ip = squid_get_real_interface_address($iface);
if ($iface_ip[0]) {
- $real_ifaces[] = $iface_ip;
- if (in_array($iface, $ssl_ifaces)) {
- $conf .= "http_port {$iface_ip[0]}:{$port} {$ssl_interception}\n";
+ // do not add loopback twice when transparent proxy is enabled
+ if ($iface_ip[0] == "127.0.0.1" && $settings['transparent_proxy'] == "on") {
+ continue;
} else {
- $conf .= "http_port {$iface_ip[0]}:{$port}\n";
+ $real_ifaces[] = $iface_ip;
+ if (in_array($iface, $ssl_ifaces)) {
+ $conf .= "http_port {$iface_ip[0]}:{$port} {$ssl_interception}\n";
+ } else {
+ $conf .= "http_port {$iface_ip[0]}:{$port}\n";
+ }
}
}
}
@@ -1165,7 +1232,7 @@ function squid_resync_general() {
}
}
$icp_port = ($settings['icp_port'] ? $settings['icp_port'] : 0);
- $dns_v4_first = ($settings['dns_v4_first'] == "on" ? "on" : "off" );
+ $dns_v4_first = ($settings['dns_v4_first'] == "on" ? "on" : "off");
$piddir = "{$g['varrun_path']}/squid";
$pidfile = "{$piddir}/squid.pid";
if (!is_dir($piddir)) {
@@ -1237,9 +1304,11 @@ EOD;
}
}
}
- $conf .= "# Allow local network(s) on interface(s)\n";
- $conf .= "acl localnet src $src\n";
- $valid_acls[] = 'localnet';
+ if (!empty($src)) {
+ $conf .= "# Allow local network(s) on interface(s)\n";
+ $conf .= "acl localnet src $src\n";
+ $valid_acls[] = 'localnet';
+ }
}
if ($settings['xforward_mode']) {
@@ -1411,25 +1480,33 @@ function squid_resync_upstream() {
function squid_resync_nac() {
global $config, $valid_acls;
- $port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
if (is_array($config['installedpackages']['squidnac'])) {
$settings = $config['installedpackages']['squidnac']['config'][0];
} else {
$settings = array();
}
+ if (is_array($config['installedpackages']['squid'])) {
+ $squidsettings = $config['installedpackages']['squid']['config'][0];
+ } else {
+ $squidsettings = array();
+ }
+
$webgui_port = $config['system']['webgui']['port'];
$addtl_ports = $settings['addtl_ports'];
$addtl_sslports = $settings['addtl_sslports'];
- $port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
- $ssl_port = ($settings['ssl_proxy_port'] ? $settings['ssl_proxy_port'] : 3127);
+ // do not add (default) proxy ports when using Squid as reverse proxy only
+ if (!empty($squidsettings['active_interface'])) {
+ $port = $squidsettings['proxy_port'] ? $squidsettings['proxy_port'] : 3128;
+ $ssl_port = $squidsettings['ssl_proxy_port'] ? $squidsettings['ssl_proxy_port'] : 3129;
+ }
$conf = <<< EOD
# Setup some default acls
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
# acl localhost src 127.0.0.1/32
acl allsrc src all
-acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 $webgui_port $port $ssl_port 1025-65535 $addtl_ports
-acl sslports port 443 563 $webgui_port $addtl_sslports
+acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 {$webgui_port} {$port} {$ssl_port} 1025-65535 {$addtl_ports}
+acl sslports port 443 563 {$webgui_port} {$addtl_sslports}
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
#acl manager proto cache_object
@@ -1731,9 +1808,9 @@ function squid_resync_auth() {
$conf .= "always_direct allow all\n";
$conf .= "ssl_bump server-first all\n";
}
- $conf .= "# Setup allowed acls\n";
+ $conf .= "# Setup allowed ACLs\n";
$allowed = array('allowed_subnets');
- if ($settingsconfig['allow_interface'] == 'on') {
+ if ($settingsconfig['allow_interface'] == 'on' && !empty($settingsconfig['active_interface'])) {
$conf .= "# Allow local network(s) on interface(s)\n";
$allowed[] = "localnet";
}
@@ -1952,10 +2029,13 @@ function squid_generate_rules($type) {
file_put_contents($cp_file, $new_cp_inc, LOCK_EX);
}
- // do not install any firewall rules if Squid is disabled
+ // do not install any firewall rules if Squid is disabled or used as reverse proxy only
if (!squid_enabled()) {
log_error("[squid] Installed but disabled. Not installing '{$type}' rules.");
return;
+ } elseif (empty($squid_conf['active_interface'])) {
+ log_error("[squid] Configured as reverse proxy only. Not installing '{$type}' rules.");
+ return;
}
// normal squid rule check
@@ -1984,7 +2064,7 @@ function squid_generate_rules($type) {
}
$port = ($squid_conf['proxy_port'] ? $squid_conf['proxy_port'] : 3128);
- $ssl_port = ($squid_conf['ssl_proxy_port'] ? $squid_conf['ssl_proxy_port'] : 3127);
+ $ssl_port = ($squid_conf['ssl_proxy_port'] ? $squid_conf['ssl_proxy_port'] : 3129);
$fw_aliases = filter_generate_aliases();
if (strstr($fw_aliases, "pptp =")) {