From 55eddd7accf2c5f9b0f52b22a010c4c4b7c130d1 Mon Sep 17 00:00:00 2001 From: Bill Marquette Date: Fri, 6 Feb 2009 19:18:00 -0600 Subject: mv packages to config dir to match web layout --- config/squid-head/squid.inc | 862 +++++++++++++++++++++++++++++++++++ config/squid-head/squid.xml | 215 +++++++++ config/squid-head/squid_auth.xml | 202 ++++++++ config/squid-head/squid_cache.xml | 180 ++++++++ config/squid-head/squid_monitor.sh | 69 +++ config/squid-head/squid_nac.xml | 147 ++++++ config/squid-head/squid_traffic.xml | 179 ++++++++ config/squid-head/squid_upstream.xml | 133 ++++++ config/squid-head/squid_users.xml | 120 +++++ 9 files changed, 2107 insertions(+) create mode 100644 config/squid-head/squid.inc create mode 100644 config/squid-head/squid.xml create mode 100644 config/squid-head/squid_auth.xml create mode 100644 config/squid-head/squid_cache.xml create mode 100644 config/squid-head/squid_monitor.sh create mode 100644 config/squid-head/squid_nac.xml create mode 100644 config/squid-head/squid_traffic.xml create mode 100644 config/squid-head/squid_upstream.xml create mode 100644 config/squid-head/squid_users.xml (limited to 'config/squid-head') diff --git a/config/squid-head/squid.inc b/config/squid-head/squid.inc new file mode 100644 index 00000000..08cf3121 --- /dev/null +++ b/config/squid-head/squid.inc @@ -0,0 +1,862 @@ +/dev/null +sleep 1 +killall squid 2>/dev/null + +EOD; + $rc['restart'] = << $names[$i], 'value' => $values[$i]); +} + +function squid_validate_general($post, $input_errors) { + $icp_port = trim($post['icp_port']); + if (!empty($icp_port) && !is_port($icp_port)) + $input_errors[] = 'You must enter a valid port number in the \'ICP port\' field'; + + $children = $post['redirect_children']; + if (!empty($children) && !is_numeric($children)) + $input_errors[] = 'You must enter a valid number for the \'Redirect children\' field'; +} + +function squid_validate_upstream($post, $input_errors) { + if ($post['proxy_forwarding'] == 'on') { + $addr = trim($post['proxy_addr']); + if (empty($addr)) + $input_errors[] = 'The field \'Hostname\' is required'; + else { + if (!is_ipaddr($addr) && !is_domain($addr)) + $input_errors[] = 'You must enter a valid IP address or host name in the \'Proxy hostname\' field'; + } + + foreach (array('proxy_port' => 'TCP port', 'icp_port' => 'ICP port') as $field => $name) { + $port = trim($post[$field]); + if (empty($port)) + $input_errors[] = "The field '$name' is required"; + else { + if (!is_port($port)) + $input_errors[] = "The field '$name' must contain a valid port number, between 0 and 65535"; + } + } + } +} + +function squid_validate_cache($post, $input_errors) { + $num_fields = array( 'harddisk_cache_size' => 'Hard disk cache size', + 'memory_cache_size' => 'Memory cache size', + 'maximum_object_size' => 'Maximum object size', + ); + foreach ($num_fields as $field => $name) { + $value = trim($post[$field]); + if (!is_numeric($value) || ($value < 1)) + $input_errors[] = "You must enter a valid value for '$field'"; + } + + $value = trim($post['minimum_object_size']); + if (!is_numeric($value) || ($value < 0)) + $input_errors[] = 'You must enter a valid value for \'Minimum object size\''; + + foreach (explode(',', $post['donotcache']) as $host) { + $host = trim($host); + if (!is_ipaddr($host) && !is_domain($host)) + $input_errors[] = "$host is not a valid IP or host name"; + } +} + +function squid_validate_nac($post, $input_errors) { + $allowed_subnets = explode(',', trim($post['allowed_subnets'])); + foreach ($allowed_subnets as $subnet) { + $subnet = trim($subnet); + if (!empty($subnet) && !is_subnet($subnet)) + $input_errors[] = "'$subnet' is not a valid CIDR range"; + } + + foreach (array( 'unrestricted_hosts', + 'banned_hosts', + 'whitelist', + 'blacklist', + ) as $hosts) { + foreach (explode(',', $post[$hosts]) as $host) { + $host = trim($host); + if (!empty($host) && !is_ipaddr($host)) + $input_errors[] = "'$host' is not a valid IP address"; + } + } + + foreach (array('unrestricted_macs', 'banned_macs') as $macs) { + foreach (explode(',', $post[$macs]) as $mac) { + $mac = trim($mac); + if (!empty($mac) && !is_macaddr($mac)) + $input_errors[] = "'$mac' is not a valid MAC address"; + } + } + + foreach (explode(',', $post['timelist']) as $time) { + $time = trim($time); + if (!empty($time) && !squid_is_timerange($time)) + $input_errors[] = "'$time' is not a valid time range"; + } +} + +function squid_validate_traffic($post, $input_errors) { + $num_fields = array( + 'max_download_size' => 'Maximum download size', + 'max_upload_size' => 'Maximum upload size', + 'perhost_capping' => 'Per-host bandwidth capping', + 'overall_capping' => 'Overall bandwidth capping', + 'perhost_throttling' => 'Per-host bandwidth throttling', + 'overall_throttling' => 'Overall bandwidth throttling', + 'initial_bucket_level' => 'Initial bucket level', + ); + foreach ($num_fields as $field => $name) { + $value = trim($post[$field]); + if (!is_numeric($value) || ($value < 0)) + $input_errors[] = "The field '$name' must contain a positive number"; + } +} + +function squid_validate_auth($post, $input_errors) { + $num_fields = array( array('auth_processes', 'Authentication processes', 1), + array('auth_ttl', 'Authentication TTL', 0), + ); + foreach ($num_fields as $field) { + $value = trim($post[$field[0]]); + if (!empty($value) && (!is_numeric($value) || ($value < $field[2]))) + $input_errors[] = "The field '{$field[1]}' must contain a valid number greater than {$field[2]}"; + } + + $auth_method = $post['auth_method']; + if (($auth_method != 'none') && ($auth_method != 'local')) { + $server = trim($post['auth_server']); + if (empty($server)) + $input_errors[] = 'The field \'Authentication server\' is required'; + else if (!is_ipaddr($server) && !is_domain($server)) + $input_errors[] = 'The field \'Authentication server\' must contain a valid IP address or domain name'; + + $port = trim($post['auth_server_port']); + if (!empty($port) && !is_port($port)) + $input_errors[] = 'The field \'Authentication server port\' must contain a valid port number'; + + switch ($auth_method) { + case 'ldap': + $required = array( + 'ldap_basedn' => 'LDAP base DN', + 'ldap_filter' => 'LDAP filter', + ); + foreach ($required as $field => $descr) { + $value = trim($post[$field]); + if (empty($value)) + $input_errors[] = "The field '$descr' is required"; + } + + $user = trim($post['ldap_user']); + $password = trim($post['ldap_password']); + if (!empty($password) && empty($user)) + $input_errors[] = 'You must specify an username if you specify a password'; + + break; + case 'radius': + $secret = trim($post['radius_secret']); + if (empty($secret)) + $input_errors[] = 'The field \'RADIUS secret\' is required'; + break; + case 'msnt': + $bdc = $post['msnt_bdc']; + if (!empty($bdc) && !is_ipaddr($bdc) && !is_domain($bdc)) + $input_errors[] = "'$bdc' isn't a valid IP address or domain name"; + $domain = $post['msnt_domain']; + if (empty($domain) || !is_domain($domain)) + $input_errors[] = 'You must enter a valid domain name in the \'NT domain\' field'; + break; + } + + $no_auth = explode(',', trim($post['no_auth_hosts'])); + foreach ($no_auth as $host) { + $host = trim($host); + if (!empty($host) && !is_subnet($host)) + $input_errors[] = "'$host' isn't a valid CIDR range"; + } + } +} + +function squid_resync_general() { + global $g, $config, $valid_acls; + + $settings = $config['installedpackages']['squid']['config'][0]; + $conf = ''; + + if ($settings['transparent_proxy'] == 'on') { + $conf .= << $iface) { + $real_ifaces[] = squid_get_real_interface_address($iface); + if (!empty($real_ifaces[$i][0])) + $conf .= "http_port {$real_ifaces[$i][0]}:$port\n"; + } + + $icp_port = $settings['icp_port'] ? $settings['icp_port'] : 0; + + $pidfile = "{$g['varrun_path']}/squid.pid"; + $language = $settings['error_language'] ? $settings['error_language'] : 'English'; + $errordir = SQUID_CONFBASE . '/errors/' . $language; + $hostname = $settings['visible_hostname'] ? $settings['visible_hostname'] : 'localhost'; + $email = $settings['admin_email'] ? $settings['admin_email'] : 'admin@localhost'; + + $logdir_cache = SQUID_LOGDIR . '/cache.log'; + $logdir_access = $settings['log_enabled'] == 'on' ? SQUID_LOGDIR . '/access.log' : '/dev/null'; + + $conf .= << 'src', + 'unrestricted_macs' => 'arp', + 'banned_hosts' => 'src', + 'banned_macs' => 'arp', + 'whitelist' => 'url_regex -i', + 'blacklist' => 'url_regex -i', + ); + foreach ($options as $option => $directive) { + $contents = trim(implode("\n", array_map('trim', explode(',', $settings[$option])))); + if (!empty($contents)) { + file_put_contents(SQUID_ACLDIR . "/$option.acl", $contents); + $conf .= "acl $option $directive \"" . SQUID_ACLDIR . "/$option.acl\"\n"; + $valid_acls[] = $option; + } + } + + $conf .= << $binaries, + 'throttle_cdimages' => $cdimages, + 'throttle_multimedia' => $multimedia) as $field => $set) { + if ($settings[$field] == 'on') + $exts = array_merge($exts, explode(',', $set)); + } + + foreach (explode(',', $settings['throttle_others']) as $ext) { + if (!empty($ext)) $exts[] = $ext; + } + + $contents = ''; + foreach ($exts as $ext) + $contents .= "\.$ext\$\n"; + file_put_contents(SQUID_ACLDIR . '/throttle_exts.acl', $contents); + + if (!empty($contents)) { // avoid crashing Squid + $conf .= 'acl throttle_exts url_regex -i "' . SQUID_ACLDIR . "/throttle_exts.acl\"\n"; + $conf .= "delay_access 1 allow throttle_exts\n"; + $conf .= "delay_access 1 deny all\n"; + } + } + else + $conf .= "delay_access 1 allow all\n"; + + return $conf; +} + +function squid_resync_auth() { + global $config, $valid_acls; + + $settings = $config['installedpackages']['squidauth']['config'][0]; + $conf = ''; + + // Deny the banned guys before allowing the good guys + $banned = array( 'banned_hosts', + 'banned_macs', + ); + $banned = array_filter($banned, 'squid_is_valid_acl'); + foreach ($banned as $acl) + $conf .= "http_access deny $acl\n"; + + // Whitelist and blacklist also take precendence + if (squid_is_valid_acl('whitelist')) + $conf .= "http_access allow whitelist\n"; + if (squid_is_valid_acl('blacklist')) + $conf .= "http_access deny blacklist\n"; + + $transparent_proxy = $config['installedpackages']['squid']['config'][0]['transparent_proxy'] == 'on'; + $auth_method = ($settings['auth_method'] && !$transparent_proxy) ? $settings['auth_method'] : 'none'; + + // Allow the remaining ACLs if no authentication is set + if ($auth_method == 'none') { + $allowed = array('localnet', 'allowed_subnets', 'unrestricted_hosts', 'unrestricted_macs'); + $allowed = array_filter($allowed, 'squid_is_valid_acl'); + foreach ($allowed as $acl) + $conf .= "http_access allow $acl\n"; + } + + else { + $noauth = implode(' ', array_map('trim', explode(',', $settings['no_auth_hosts']))); + if (!empty($noauth)) { + $conf .= "acl noauth src $noauth\n"; + $valid_acls[] = 'noauth'; + } + + // Set up the external authentication programs + $auth_ttl = $settings['auth_ttl'] ? $settings['auth_ttl'] : 60; + $processes = $settings['auth_processes'] ? $settings['auth_processes'] : 5; + $prompt = $settings['auth_prompt'] ? $settings['auth_prompt'] : 'Please enter your credentials to access the proxy'; + switch ($auth_method) { + case 'local': + $conf .= 'auth_param basic program /usr/local/libexec/squid/ncsa_auth ' . SQUID_PASSWD . "\n"; + break; + case 'ldap': + $port = isset($settings['auth_port']) ? ":{$settings['auth_port']}" : ''; + $user = isset($settings['ldap_user']) ? "-D {$settings['ldap_user']}" : ''; + $password = isset($settings['ldap_password']) ? "-w '{$settings['ldap_password']}'" : ''; + $filter = isset($settings['ldap_filter']) ? "-f '{$settings['ldap_filter']}'" : ''; + $conf .= "auth_param basic program /usr/local/libexec/squid/squid_ldap_auth -b {$settings['ldap_basedn']} $user $password $filter {$settings['auth_server']}$port\n"; + break; + case 'radius': + $port = isset($settings['auth_port']) ? "-p {$settings['auth_server_port']}" : ''; + $conf .= "auth_param basic program /usr/local/libexec/squid/squid_radius_auth -w {$settings['radius_secret']} -h {$settings['auth_server']} $port\n"; + break; + case 'msnt': + $conf .= "auth_param basic program /usr/local/libexec/squid/msnt_auth\n"; + + $bdc = trim($settings['msnt_bdc']); + if (empty($bdc)) $bdc = $settings['auth_server']; + $msntauth_conf = "server {$settings['auth_server']} $bdc {$settings['msnt_domain']}\n"; + file_put_contents(MSNTAUTH_CONF, $msntauth_conf); + + break; + } + $conf .= << + + + +EOD; + } + else { + $javascript = << + + + +EOD; + } + + print($javascript); +} + +function squid_print_javascript_auth2() { + print("\n"); +} + +function squid_generate_rules($type) { + global $config; + + $squid_conf = $config['installedpackages']['squid']['config'][0]; + if (!is_service_running('squid') || ($squid_conf['transparent_proxy'] != 'on')) { + log_error('Squid is installed but not started. Not installing redirect rules.'); + return; + } + + $port = isset($squid_conf['proxy_port']) ? $squid_conf['proxy_port'] : 3128; + $ifaces = explode(',', $squid_conf['active_interface']); + $ifaces = array_map('convert_friendly_interface_to_real_interface_name', $ifaces); + + switch($type) { + case 'nat': + foreach ($ifaces as $iface) + $rules .= "rdr on $iface inet proto tcp from any to !($iface) port 80 -> ($iface) port $port\n"; + break; + case 'filter': + foreach ($ifaces as $iface) + $rules .= "pass quick on $iface inet proto tcp from any to !($iface) port 80 flags S/SA keep state\n"; + break; + } + + return $rules; +} +?> diff --git a/config/squid-head/squid.xml b/config/squid-head/squid.xml new file mode 100644 index 00000000..67f4c2aa --- /dev/null +++ b/config/squid-head/squid.xml @@ -0,0 +1,215 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squid + none + Proxy server: General settings + squid.inc + + + Web proxy cache + Modify the web proxy cache's settings +
Services
+ /pkg_edit.php?xml=squid.xml&id=0 + + + Squid + squid.sh + squid + Web proxy cache. + + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + http://www.pfsense.org/packages/config/squid.inc + + + http://www.pfsense.org/packages/config/squid_cache.xml + + + http://www.pfsense.org/packages/config/squid_nac.xml + + + http://www.pfsense.org/packages/config/squid_traffic.xml + + + http://www.pfsense.org/packages/config/squid_upstream.xml + + + http://www.pfsense.org/packages/config/squid_auth.xml + + + http://www.pfsense.org/packages/config/squid_users.xml + + + /usr/local/bin/ + 0755 + http://www.pfsense.org/packages/All/squid_monitor.sh + + + + Proxy interface + active_interface + The interface(s) the proxy server will bind to. + interfaces_selection + + lan + + + + Allow users on interface + allow_interface + If this field is checked, the users connected to the interface selected in the 'Proxy interface' field will be allowed to use the proxy, i.e., there will be no need to add the interface's subnet to the list of allowed subnets. This is just a shortcut. + checkbox + + on + + + Transparent proxy + transparent_proxy + If transparent mode is enabled, all requests for destination port 80 will be forwarded to the proxy server without any additional configuration necessary. + checkbox + + + + Enabled logging + log_enabled + This will enable the access log. Don't switch this on if you don't have much disk space left. + checkbox + log_query_terms,log_user_agents + + + Proxy port + proxy_port + This is the port the proxy server will listen on. + input + 5 + + 3128 + + + ICP port + icp_port + This is the port the proxy server will send and receive ICP queries to and from neighbor caches. Leave this blank if you don't want the proxy server to communicate with neighbor caches through ICP. + input + 5 + + + Visible hostname + visible_hostname + This is the hostname to be displayed in proxy server error messages. + input + localhost + + + Administrator email + admin_email + This is the email address displayed in error messages to the users. + input + admin@localhost + + + Language + error_language + Select the language in which the proxy server will display error messages to users. + select + English + + + Redirect children + redirect_children + Specify the number of redirectors to spawn (if using redirectors at all) when launching Squid. If you leave this field blank, Squid will start 5 redirector processes. If your network load is high, feel free to increase this value (at the expense of a higher memory consumption). + input + 5 + + + + squid_before_form_general(&$pkg); + + + squid_validate_general($_POST, &$input_errors); + + + squid_resync(); + + + squid_install_command(); + + + squid_deinstall_command(); + + diff --git a/config/squid-head/squid_auth.xml b/config/squid-head/squid_auth.xml new file mode 100644 index 00000000..15910f97 --- /dev/null +++ b/config/squid-head/squid_auth.xml @@ -0,0 +1,202 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidauth + none + Proxy server: Authentication + squid.inc + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + + Local users + /pkg.php?xml=squid_users.xml + + + + + Authentication method + auth_method + Select an authentication method. This will allow users to be authenticated by local or external services. + select + none + + + + + + + + on_auth_method_changed() + + + Authentication server + auth_server + Enter here the IP or hostname of the server that will perform the authentication. For NT domain authentication, this is the Primary Domain Controller (PDC). + input + + + Authentication server port + auth_server_port + Enter here the port to use to connect to the authentication server. Leave this field blank to use the authentication method's default port. + input + + + LDAP server user DN + ldap_user + Enter here the user distinguished name (DN) to bind to connect to the LDAP server (e.g., "cn=Administrator,cn=Users,dc=foobar,dc=com"). You can leave this field blank if you don't want to use authentication. + input + + + LDAP password + ldap_password + Enter here the password to use to connect to the LDAP server. You may leave this field unfilled. + password + + + LDAP base DN + ldap_basedn + For LDAP authentication, enter here the base DN for the search (e.g., "cn=Users,dc=foobar,dc=com"). + input + + + LDAP filter + ldap_filter + Enter the string to be used to filter the results of the search, or leave this blank to get the results unfiltered. This must be in compliance with RFC 2254, and ocurrences of the string "%s" will be set to the username given to the proxy. You generally want something like '(sAMAccountName=%s)' here. + input + (sAMAccountName=%s) + + + RADIUS secret + radius_secret + The RADIUS secret for RADIUS authentication. + password + + + Backup Domain Controller + msnt_bdc + Enter the address of the Backup Domain Controller (BDC) or leave this field blank if you don't want to use a backup controller. + input + + + NT domain + msnt_domain + Enter the NT domain to be used. + input + + + Authentication prompt + auth_prompt + This string will be displayed at the top of the authentication request window. + input + Please enter your credentials to access the proxy + + + Authentication processes + auth_processes + The number of authenticator processes to spawn. If many authentications are expected within a short timeframe, increase this number accordingly. + input + 5 + + + Authentication TTL + auth_ttl + This specifies for how long (in minutes) the proxy server assumes an externally validated username and password combination is valid (Time To Live). When the TTL expires, the user will be prompted for credentials again. + input + 60 + + + Requiere authentication for unrestricted hosts + unrestricted_auth + If this option is enabled, even users tagged as unrestricted through access control are required to authenticate to use the proxy. + checkbox + + + Subnets that don't need authentication + no_auth_hosts + A comma-separated list of subnets (in CIDR range, e.g.: 10.5.0.0/16, 192.168.1.50/32) whose hosts won't be asked for authentication to access the proxy. + textarea + 50 + 5 + + + + squid_validate_auth($_POST, &$input_errors); + + + squid_print_javascript_auth2(); + + + squid_resync(); + + + squid_print_javascript_auth(); + + diff --git a/config/squid-head/squid_cache.xml b/config/squid-head/squid_cache.xml new file mode 100644 index 00000000..3fe0475f --- /dev/null +++ b/config/squid-head/squid_cache.xml @@ -0,0 +1,180 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidcache + none + Proxy server: Cache management + squid.inc + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + Hard disk cache size + harddisk_cache_size + This is the amount of disk space (in megabytes) to use for cached objects. + input + + 100 + + + Memory cache size + memory_cache_size + This is the amount of physical RAM (in megabytes) to be used for negative cache and in-transit objects. This value should not exceed more than 50% of the installed RAM. The minimum value is 1MB. + input + + 8 + + + Minimum object size + minimum_object_size + Objects smaller than the size specified (in kilobytes) will not be saved on disk. The default value is 0, meaning there is no minimum. + input + + 0 + + + Maximum object size + maximum_object_size + Objects larger than the size specified (in kilobytes) will not be saved on disk. If you wish to increase speed more than you want to save bandwidth, this should be set to a low value. + input + + 4 + + + Level 1 subdirectories + level1_subdirs + Each level 1 (L1) directory contains 256 subdirectories, so a value of 256 L1 directories will use a total of 65536 directories for the hard disk cache. This will significantly slow down the startup process of the proxy service, but can speed up the caching under certain conditions. + select + 16 + + + + + + + + + + + + Memory replacement policy + memory_replacement + The memory replacement policy determines which objects are purged from memory when space is needed. The default policy for memory replacement is GDSF. + select + heap GDSF + + + + + + + + + Cache replacement policy + cache_replacement + The cache replacement policy decides which objects will remain in cache and which objects are replaced to create space for the new objects. The default policy for cache replacement is LFUDA. + select + heap LFUDA + + + + + + + + + Do not cache + donotcache + The specified domains or IP addresses (separated by commas) will never be cached. + textarea + 50 + 5 + + + Enable offline mode + enable_offline + Enable this option and the proxy server will never try to validate cached objects. The offline mode also gives access to more cached information than the proposed feature would allow (stale cached versions, where the origin server should have been contacted). + checkbox + + + + + squid_validate_cache($_POST, &$input_errors); + + + squid_resync(); + + diff --git a/config/squid-head/squid_monitor.sh b/config/squid-head/squid_monitor.sh new file mode 100644 index 00000000..d0035d1a --- /dev/null +++ b/config/squid-head/squid_monitor.sh @@ -0,0 +1,69 @@ +#!/bin/sh +# $Id$ */ +# +# proxy_monitor.sh +# Copyright (C) 2006 Scott Ullrich +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: +# +# 1. Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +# AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, +# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +# POSSIBILITY OF SUCH DAMAGE. +# + +set -e + +LOOP_SLEEP=300 + +if [ -f /var/run/squid_alarm ]; then + rm /var/run/squid_alarm +fi + +# Squid monitor 1.0 +while [ /bin/true ]; do + if [ ! -f /var/run/squid_alarm ]; then + NUM_PROCS=`ps awux | grep "squid -D" | grep -v "grep" | wc -l | awk '{ print $1 }'` + if [ $NUM_PROCS -lt 1 ]; then + # squid is down + echo "Squid has exited. Reconfiguring filter." | \ + logger -p daemon.info -i -t Squid_Alarm + echo "Attempting restart..." | logger -p daemon.info -i -t Squid_Alarm + /usr/local/etc/rc.d/squid.sh start + sleep 3 + echo "Reconfiguring filter..." | logger -p daemon.info -i -t Squid_Alarm + /etc/rc.filter_configure_sync + touch /var/run/squid_alarm + fi + fi + NUM_PROCS=`ps awux | grep "squid -D" | grep -v "grep" | wc -l | awk '{ print $1 }'` + if [ $NUM_PROCS -gt 0 ]; then + if [ -f /var/run/squid_alarm ]; then + echo "Squid has resumed. Reconfiguring filter." | \ + logger -p daemon.info -i -t Squid_Alarm + /etc/rc.filter_configure_sync + rm /var/run/squid_alarm + fi + fi + sleep $LOOP_SLEEP +done + +if [ -f /var/run/squid_alarm ]; then + rm /var/run/squid_alarm +fi + diff --git a/config/squid-head/squid_nac.xml b/config/squid-head/squid_nac.xml new file mode 100644 index 00000000..db49a1ba --- /dev/null +++ b/config/squid-head/squid_nac.xml @@ -0,0 +1,147 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidnac + none + Proxy server: Access control + squid.inc + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + Allowed subnets + allowed_subnets + Those are the subnets (separated by commas) that are allowed to use the proxy. The subnets must be expressed as CIDR ranges (e.g.: 192.168.1.0/24). Note that the proxy interface subnet is already an allowed subnet. All the other subnets won't be able to use the proxy. + textarea + 50 + 5 + + + Unrestricted IPs + unrestricted_hosts + The IP addresses specified here (separated by commas) won't be filtered out by the other access control directives set in this page. + textarea + 50 + 5 + + + Unrestricted MAC Addresses + unrestricted_macs + The MAC addresses specified here (separated by commas) won't be filtered out by the other access control directives set in this page. + textarea + 50 + 5 + + + Banned host addresses + banned_hosts + The IP addresses specified here (separated by commas) won't be allowed to use the proxy. + textarea + 50 + 5 + + + Banned MAC addresses + banned_macs + The MAC addresses specified here (separated by commas) won't be allowed to use the proxy. + textarea + 50 + 5 + + + Whitelist + whitelist + Those are the sites (separated by commas) that will be accessable to the users that are allowed to use the proxy. + textarea + 50 + 5 + + + Blacklist + blacklist + Those are the sites (separated by commas) that will be blocked to the users that are allowed to use the proxy. + textarea + 50 + 5 + + + + squid_validate_nac($_POST, &$input_errors); + + + squid_resync(); + + diff --git a/config/squid-head/squid_traffic.xml b/config/squid-head/squid_traffic.xml new file mode 100644 index 00000000..d69f2510 --- /dev/null +++ b/config/squid-head/squid_traffic.xml @@ -0,0 +1,179 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidtraffic + none + Proxy server: Traffic management + squid.inc + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + Maximum download size + max_download_size + Limit the maximum total download size to the size specified here (in kilobytes). Downloads bigger than the specified size will be denied. Set to 0 to disable. + input + + 0 + + + Maximum upload size + max_upload_size + Limit the maximum total upload size to the size specified here (in kilobytes). Uploads bigger than the specified size will be denied. Set to 0 to disable. + input + + 0 + + + Overall capping + overall_capping + Caps the download speeds of the network that connects to the proxy as a whole at the specified size (in kilobytes per second). Set to 0 to disable. + input + + 0 + + + Per-host capping + perhost_capping + Caps the download speeds of each user that connects to the proxy at the specified size (in kilobytes per second). Set to 0 to disable. + input + + 0 + + + Overall bandwidth throttling + overall_throttling + This value specifies (in kilobytes per second) the bandwidth throttle for downloads. Users will gradually have their download speed increased according to this value. Set to 0 to disable bandwidth throttling. + input + + 0 + + + Per-host throttling + perhost_throttling + This value specifies the download throttling per host. Set to 0 to disable this. + input + + 0 + + + Initial bucket level + initial_bucket_level + The initial bucket level is used to determine how much is put in each bucket when a connection is established. Set to 0 to set the initial bucket level to 100%. + input + + 0 + + + Throttle only specific extensions + throttle_specific + Leave this checked to be able to choose the extensions that throttling will be applied to. Otherwise, all files will be throttled. + checkbox + throttle_binaries,throttle_cdimages,throttle_multimedia,throttle_others + on + + + Throttle binary files + throttle_binaries + Check this to apply bandwidth throttle to binary files. This includes compressed archives and executables. + checkbox + + + Throttle CD images + throttle_cdimages + Check this to apply bandwidth throttle to CD image files. + checkbox + + + Throttle multimedia files + throttle_multimedia + Check this to apply bandwidth throttle to multimedia files, such as movies or songs. + checkbox + + + Throttle other extensions + throttle_others + Comma-separated list of extensions to apply bandwidth throttle to. + input + + + + squid_validate_traffic($_POST, &$input_errors); + + + squid_resync(); + + diff --git a/config/squid-head/squid_upstream.xml b/config/squid-head/squid_upstream.xml new file mode 100644 index 00000000..b02a21b4 --- /dev/null +++ b/config/squid-head/squid_upstream.xml @@ -0,0 +1,133 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidupstream + none + Proxy server: Upstream proxy settings + squid.inc + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + Enable forwarding + proxy_forwarding + This option enables the proxy server to forward requests to an upstream server. + checkbox + proxy_addr,proxy_port,icp_port,username,password + + + + Hostname + proxy_addr + Enter here the IP address or host name of the upstream proxy. + input + + + TCP port + proxy_port + Enter the port to use to connect to the upstream proxy. + input + 5 + 3128 + + + ICP port + icp_port + Enter the port to connect to the upstream proxy for the ICP protocol. Use port number 7 to disable ICP communication between the proxies. + input + 5 + 7 + + + Username + username + If the upstream proxy requires a username, specify it here. + input + + + Password + password + If the upstream proxy requires a password, specify it here. + password + + + + squid_validate_upstream($_POST, &$input_errors); + + + squid_resync(); + + diff --git a/config/squid-head/squid_users.xml b/config/squid-head/squid_users.xml new file mode 100644 index 00000000..34260817 --- /dev/null +++ b/config/squid-head/squid_users.xml @@ -0,0 +1,120 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + squidusers + none + Proxy server: Local users + squid.inc + A proxy server user has been deleted. + A proxy server user has been created/modified. + + + General settings + /pkg_edit.php?xml=squid.xml&id=0 + + + Upstream proxy + /pkg_edit.php?xml=squid_upstream.xml&id=0 + + + Cache management + /pkg_edit.php?xml=squid_cache.xml&id=0 + + + Access control + /pkg_edit.php?xml=squid_nac.xml&id=0 + + + Traffic management + /pkg_edit.php?xml=squid_traffic.xml&id=0 + + + Auth settings + /pkg_edit.php?xml=squid_auth.xml&id=0 + + + Local users + /pkg.php?xml=squid_users.xml + + + + + + Username + username + + + Description + description + + + + + Username + username + Enter the username here. + input + + + + Password + password + Enter the password here. + password + + + + Description + description + You may enter a description here for your reference (not parsed). + input + + + + squid_resync_users(); + + -- cgit v1.2.3