From b85616219c38868cae9840cf701d30476adc3384 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 13:21:07 +0200 Subject: If disk cache gets disabled, delete the cachedir if it exists --- config/squid3/34/squid.inc | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index 7d2b08b7..aa81a6c9 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -138,10 +138,23 @@ function squid_dash_z($cache_action = 'none') { } // If the cache system is null, there is no need to initialize the (irrelevant) cache dir. + // If it already exists, delete it. if ($cachesettings['harddisk_cache_system'] == "null") { + if (is_dir($cachedir)) { + log_error("Deleting Squid cache dir {$cachedir} since 'Hard Disk Cache System' is set to null."); + // cannot nuke disk cache while Squid is running + squid_stop_monitor(); + if (is_service_running('squid')) { + stop_service("squid"); + } + rename($cachedir, "{$cachedir}.old"); + mwexec_bg("/bin/rm -rf {$cachedir}.old"); + squid_restart_services(); + } return; } - // Re-create the cachedir if clean is forced by cronjob/manually, or + + // Re-create the cachedir if clean is forced by cronjob/manually, // or if the cachedir changed, or level1_subdirs don't exist or the number of level1_subdirs changed if ($cache_action == "clean" || ((!is_dir($cachedir)) || (!is_dir($cachedir . '/00'))) || ($numdirs !== $currentdirs)) { // cannot nuke disk cache while Squid is running -- cgit v1.2.3 From 49050e47642d7fbfdbd286dfec149ef74b83f179 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 13:29:47 +0200 Subject: Some additional deinstall cleanups --- config/squid3/34/squid.inc | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index aa81a6c9..dbfcda89 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -394,18 +394,12 @@ function squid_deinstall_command() { update_status("Stopping services..."); /* kill all running services */ mwexec('/usr/local/etc/rc.d/sqp_monitor.sh stop'); - if (is_process_running("c-icap")) { - mwexec('/usr/local/etc/rc.d/c-icap stop'); - } - if (is_process_running("clamd")) { - mwexec('/usr/local/etc/rc.d/clamav-clamd stop'); - } - if (is_process_running("freshclam")) { - mwexec('/usr/local/etc/rc.d/clamav-freshclam stop'); - } - mwexec("/bin/ps awux | /usr/bin/grep \"squid\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); - mwexec("/bin/ps awux | /usr/bin/grep \"dnsserver\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); - mwexec("/bin/ps awux | /usr/bin/grep \"unlinkd\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[c]-icap' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[c]lamd' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[f]reshclam' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[s]quid' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[d]nsserver' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + mwexec("/bin/ps awux | /usr/bin/grep '[u]nlinkd' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); /* delete rc scripts */ unlink_if_exists('/usr/local/etc/rc.d/sqp_monitor.sh'); unlink_if_exists('/usr/local/etc/rc.d/c-icap'); @@ -434,7 +428,7 @@ function squid_deinstall_command() { if (is_dir("{$logdir}")) { mwexec("/bin/rm -rf {$logdir}"); } - $dirs = array("/var/run/c-icap", "/var/log/c-icap", "/var/log/clamav", "/var/run/clamav", "/var/db/clamav"); + $dirs = array("/var/run/c-icap", "/var/log/c-icap", "/var/log/clamav", "/var/run/clamav", "/var/db/clamav", "/var/run/squid", "/var/squid"); foreach ($dirs as $dir) { if (is_dir("{$dir}")) { mwexec("/bin/rm -rf {$dir}"); @@ -454,7 +448,6 @@ function squid_deinstall_command() { } } - update_status("Reloading filter..."); filter_configure(); } -- cgit v1.2.3 From b27ad1190a1a6360a9b61c488a9843f66d42125d Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 15:24:26 +0200 Subject: Do not leave orphaned cache dirs if harddisk_cache_location changed The old cache dir will ONLY get deleted when located under /var/squid/ to prevent nasty accidents. --- config/squid3/34/squid_cache.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_cache.xml b/config/squid3/34/squid_cache.xml index a5e73f80..2045005c 100755 --- a/config/squid3/34/squid_cache.xml +++ b/config/squid3/34/squid_cache.xml @@ -403,10 +403,40 @@ base64 + + + squid_validate_cache($_POST, $input_errors); + -- cgit v1.2.3 From 6239f50ae4a51f1f3fc99d48a62efc9c6f528ace Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 15:43:43 +0200 Subject: Put safety checks here to prevent shooting users from shooting themselves in foot. --- config/squid3/34/squid.inc | 53 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 12 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index dbfcda89..ed3367d3 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -141,15 +141,20 @@ function squid_dash_z($cache_action = 'none') { // If it already exists, delete it. if ($cachesettings['harddisk_cache_system'] == "null") { if (is_dir($cachedir)) { - log_error("Deleting Squid cache dir {$cachedir} since 'Hard Disk Cache System' is set to null."); - // cannot nuke disk cache while Squid is running - squid_stop_monitor(); - if (is_service_running('squid')) { - stop_service("squid"); + if (substr($cachedir, 0, 11) === "/var/squid/") { + log_error("Deleting Squid cache dir {$cachedir} since 'Hard Disk Cache System' is set to null."); + // cannot nuke disk cache while Squid is running + squid_stop_monitor(); + if (is_service_running('squid')) { + stop_service("squid"); + } + rename($cachedir, "{$cachedir}.old"); + mwexec_bg("/bin/rm -rf {$cachedir}.old"); + squid_restart_services(); + } else { + log_error("'Hard Disk Cache System' is set to null."); + log_error("Will NOT delete Squid cache dir '{$cachedir}' since it is not located under /var/squid. Delete manually if required."); } - rename($cachedir, "{$cachedir}.old"); - mwexec_bg("/bin/rm -rf {$cachedir}.old"); - squid_restart_services(); } return; } @@ -163,8 +168,12 @@ function squid_dash_z($cache_action = 'none') { stop_service("squid"); } if (is_dir($cachedir)) { - rename($cachedir, "{$cachedir}.old"); - mwexec_bg("/bin/rm -rf {$cachedir}.old"); + if (substr($cachedir, 0, 11) === "/var/squid/") { + rename($cachedir, "{$cachedir}.old"); + mwexec_bg("/bin/rm -rf {$cachedir}.old"); + } else { + log_error("Will NOT delete Squid cache dir '{$cachedir}' since it is not located under /var/squid. Delete manually if required."); + } } squid_create_cachedir(); squid_restart_services(); @@ -423,10 +432,18 @@ function squid_deinstall_command() { $logdir = ($squidsettings['log_dir'] ? $squidsettings['log_dir'] : '/var/squid/logs'); // XXX: Is it ok to remove cache and logs? It's going to happen every time package is updated if (is_dir("{$cachedir}")) { - mwexec_bg("/bin/rm -rf {$cachedir}"); + if (substr($cachedir, 0, 11) === "/var/squid/") { + mwexec_bg("/bin/rm -rf {$cachedir}"); + } else { + log_error("Will NOT delete Squid cache dir '{$cachedir}' since it is not located under /var/squid. Delete manually if required."); + } } if (is_dir("{$logdir}")) { - mwexec("/bin/rm -rf {$logdir}"); + if (substr($logdir, 0, 11) === "/var/squid/") { + mwexec("/bin/rm -rf {$logdir}"); + } else { + log_error("Will NOT delete Squid log dir '{$logdir}' since it is not located under /var/squid. Delete manually if required."); + } } $dirs = array("/var/run/c-icap", "/var/log/c-icap", "/var/log/clamav", "/var/run/clamav", "/var/db/clamav", "/var/run/squid", "/var/squid"); foreach ($dirs as $dir) { @@ -621,6 +638,18 @@ function squid_validate_cache($post, &$input_errors) { } } } + + if (substr($post['harddisk_cache_location'], -1, 1) == '/') { + $input_errors[] = 'Log location must not end with a / character.'; + } + + if ($post['harddisk_cache_location']{0} != '/') { + $input_errors[] = 'Log location must start with a / character.'; + } + + if (strlen($post['harddisk_cache_location']) <= 3) { + $input_errors[] = "Configured log location directory is not valid."; + } } function squid_validate_nac($post, &$input_errors) { -- cgit v1.2.3 From 109b1e565344581ebecfbefed8e482b1ebc48f37 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 16:19:25 +0200 Subject: If cache dir is located outside of /var/squid hierarchy, log some instructions and return --- config/squid3/34/swapstate_check.php | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'config/squid3/34') diff --git a/config/squid3/34/swapstate_check.php b/config/squid3/34/swapstate_check.php index 8b4c46bb..b144f6d8 100644 --- a/config/squid3/34/swapstate_check.php +++ b/config/squid3/34/swapstate_check.php @@ -36,12 +36,19 @@ global $config; $settings = $config['installedpackages']['squidcache']['config'][0]; // Only check the cache if Squid is actually caching. // If there is no cache then quietly do nothing. +// If cache dir is located outside of /var/squid hierarchy, log some instructions. if (isset($settings['harddisk_cache_system']) && $settings['harddisk_cache_system'] != "null") { $cachedir = ($settings['harddisk_cache_location'] ? $settings['harddisk_cache_location'] : '/var/squid/cache'); $swapstate = $cachedir . '/swap.state'; if (!file_exists($swapstate)) { return; } + if (substr($cachedir, 0, 11) !== "/var/squid/") { + log_error("swapstate_check.php will NOT manage Squid cache dir '{$cachedir}' since it is not located under /var/squid."); + log_error("Disable 'Clear Cache on Log Rotate' on the 'Local Cache' tab or relocate your cache dir under /var/squid."); + return; + } + $disktotal = disk_total_space(dirname($cachedir)); $diskfree = disk_free_space(dirname($cachedir)); $diskusedpct = round((($disktotal - $diskfree) / $disktotal) * 100); -- cgit v1.2.3 From 00749933c6c09280683271dfbe6d3f3140be1a4f Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 17:14:08 +0200 Subject: Fix log_dir location for C-ICAP to that it honors custom log_dir --- config/squid3/34/squid.inc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index ed3367d3..8188dfda 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1533,7 +1533,12 @@ EOF; $cicap_m[0] = "@Manager:Apassword\S+@"; $cicap_r[0] = ""; // XXX: Bug #4615 - $logdir = ($settings['log_dir'] ? $settings['log_dir'] : '/var/squid/logs'); + if (is_array($config['installedpackages']['squid'])) { + $squidsettings = $config['installedpackages']['squid']['config'][0]; + } else { + $squidsettings = array(); + } + $logdir = ($squidsettings['log_dir'] ? $squidsettings['log_dir'] : '/var/squid/logs'); $cicap_m[1] = "@DebugLevel\s1@"; $cicap_r[1] = "DebugLevel 0"; $cicap_m[2] = "@AccessLog /var/log/c-icap/access.log@"; -- cgit v1.2.3 From 21b9af726d7a7fd659e95312a985453fa059633e Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 19:37:55 +0200 Subject: Patch squidclamav.conf so that is uses WebGUI URL by default Stop nagging users with confusing nonsense and make it work out of the box. --- config/squid3/34/squid.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index 8188dfda..bbccd123 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1513,9 +1513,9 @@ EOF; if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default")) { $sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default"); $clamav_m[0] = "@/var/run/clamav/clamd.ctl@"; - $clamav_m[1] = "@cgi-bin/clwarn.cgi@"; + $clamav_m[1] = "@http\://proxy.domain.dom/cgi-bin/clwarn.cgi@"; $clamav_r[0] = "/var/run/clamav/clamd.sock"; - $clamav_r[1] = "squid_clwarn.php"; + $clamav_r[1] = "{$config['system']['webgui']['protocol']}://{$config['system']['hostname']}.{$config['system']['domain']}/squid_clwarn.php"; file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample", preg_replace($clamav_m, $clamav_r, $sample_file), LOCK_EX); } } -- cgit v1.2.3 From 7e7f7f3c7cde77ef92ae28a82a36412948189b0a Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 20:38:21 +0200 Subject: Add freshclam mirror settings, manual AV defs update and cron updates --- config/squid3/34/squid.inc | 103 +++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 94 insertions(+), 9 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index bbccd123..8c1e9628 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -119,6 +119,11 @@ function squid_check_clamav_user($user) { } } +function squid_update_clamav() { + log_error("Updating ClamAV definitions now... This will take a while. Check /var/log/clamav/freshclam.log for progress information."); + mwexec_bg(SQUID_BASE . "/bin/freshclam --config-file=" . SQUID_BASE . "/etc/freshclam.conf"); +} + /* setup cache */ function squid_dash_z($cache_action = 'none') { global $config; @@ -397,8 +402,9 @@ function squid_install_command() { function squid_deinstall_command() { global $config, $g; - /* remove cronjob */ + /* remove cronjobs */ squid_install_cron(false); + squid_install_freshclam_cron(false); update_status("Stopping services..."); /* kill all running services */ @@ -472,6 +478,12 @@ function squid_deinstall_command() { function squid_validate_antivirus($post, &$input_errors) { global $config; + /* Manual ClamAV database update */ + if ($post['submit'] == 'Update AV') { + squid_update_clamav(); + return; + } + if ($post['enable'] != "on") { return; } @@ -489,6 +501,15 @@ function squid_validate_antivirus($post, &$input_errors) { $input_errors[] = "Remove ldap configuration'{$c_match[1]}' from 'c-icap.conf' field."; } } + + if ($post['clamav_dbservers']) { + foreach (explode(";", $post['clamav_dbservers']) as $dbserver) { + $dbserver = trim($dbserver); + if (!empty($dbserver) && !is_ipaddr($dbserver) && !is_hostname($dbserver)) { + $input_errors[] = "'Optional ClamAV Database Update Servers' entry '$dbserver' is not a valid IP address or hostname."; + } + } + } } function squid_validate_general($post, &$input_errors) { @@ -900,6 +921,32 @@ function squid_install_cron($should_install) { } } +function squid_install_freshclam_cron($should_install) { + global $config; + + if (platform_booting()) { + return; + } + + if (is_array($config['installedpackages']['squidantivirus'])) { + $antivirus_config = $config['installedpackages']['squidantivirus']['config'][0]; + } else { + $antivirus_config = array(); + } + + $freshclam_cmd = (SQUID_BASE . "/bin/freshclam --config-file=" . SQUID_BASE . "/etc/freshclam.conf"); + if ($should_install) { + if ($antivirus_config['clamav_update'] != "0") { + $minutes = ($antivirus_config['clamav_update'] * 60); + install_cron_job("{$freshclam_cmd}", true, "*/{$minutes}", "*", "*", "*", "*", "clamav"); + } else { + install_cron_job("{$freshclam_cmd}", false); + } + } else { + install_cron_job("{$freshclam_cmd}", false); + } +} + function squid_check_ca_hashes() { global $config, $g; @@ -1444,10 +1491,11 @@ EOD; function squid_resync_antivirus() { global $config; - if (is_array($config['installedpackages']['squidantivirus'])) + if (is_array($config['installedpackages']['squidantivirus'])) { $antivirus_config = $config['installedpackages']['squidantivirus']['config'][0]; - else + } else { $antivirus_config = array(); + } if ($antivirus_config['enable'] == "on") { switch ($antivirus_config['client_info']) { @@ -1547,6 +1595,36 @@ EOF; $cicap_r[3] = "ServerLog $logdir/c-icap-server.log"; file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample", preg_replace($cicap_m, $cicap_r, $sample_file), LOCK_EX); } + // freshclam.conf + // make a backup of default freshclam.conf.sample first + if (!file_exists(SQUID_LOCALBASE . "/etc/freshclam.conf.default")) { + copy(SQUID_LOCALBASE . "/etc/freshclam.conf.sample", SQUID_LOCALBASE . "/etc/freshclam.conf.default"); + } + if (file_exists(SQUID_LOCALBASE . "/etc/freshclam.conf.default")) { + $sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/freshclam.conf.default"); + $freshclam_m[0] = "@#Example@"; + $freshclam_r[0] = ""; + $clamav_mirrors = ""; + if ($antivirus_config['clamav_dbregion'] != "") { + $clamav_mirrors .= "DatabaseMirror db.{$antivirus_config['clamav_dbregion']}.clamav.net\n"; + } + if ($antivirus_config['clamav_dbservers'] != "") { + foreach (explode(";", $antivirus_config['clamav_dbservers']) as $dbserver) { + $clamav_mirrors .= "DatabaseMirror {$dbserver}\n"; + } + } + if ($clamav_mirrors != "") { + $freshclam_m[1] = "@#DatabaseMirror db.XY.clamav.net@"; + $freshclam_r[1] = "{$clamav_mirrors}"; + } + file_put_contents(SQUID_LOCALBASE . "/etc/freshclam.conf.sample", preg_replace($freshclam_m, $freshclam_r, $sample_file), LOCK_EX); + } + // freshclam cronjob + if ($antivirus_config['enable'] == "on") { + squid_install_freshclam_cron(true); + } else { + squid_install_freshclam_cron(false); + } // check squidclamav files until PBIs are gone (https://redmine.pfsense.org/issues/4197) $ln_icap = array('bin/c-icap', 'bin/c-icap-client', 'c-icap-config', 'c-icap-libicapapi-config', 'c-icap-stretch', 'lib/c_icap', 'share/c_icap', 'etc/c-icap'); @@ -1572,6 +1650,10 @@ EOF; $config['installedpackages']['squidantivirus']['config'][0]['c-icap_magic'] = base64_encode(str_replace("\r", "", file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.magic.sample"))); $loadsample++; } + if ($antivirus_config['freshclam_conf'] == "" && file_exists(SQUID_LOCALBASE . "/etc/freshclam.conf.sample")) { + $config['installedpackages']['squidantivirus']['config'][0]['freshclam_conf'] = base64_encode(str_replace("\r", "", file_get_contents(SQUID_LOCALBASE . "/etc/freshclam.conf.sample"))); + $loadsample++; + } if ($loadsample > 0) { write_config(); $antivirus_config = $config['installedpackages']['squidantivirus']['config'][0]; @@ -1588,11 +1670,7 @@ EOF; safe_mkdir($dir_path, 0755); squid_chown_recursive($dir_path, $dir_user, "wheel"); } - // Check clamav database - if (count(glob("/var/db/clamav/*d")) == 0) { - log_error("Squid - Missing /var/db/clamav/*.cvd or *.cld files. Running freshclam in background."); - mwexec_bg(SQUID_BASE . "/bin/freshclam"); - } + $rcd_files = scandir(SQUID_LOCALBASE."/etc/rc.d"); foreach ($rcd_files as $rcd_file) { if (SQUID_LOCALBASE != '/usr/local' && !file_exists("/usr/local/etc/rc.d/{$rcd_file}")) { @@ -1600,10 +1678,17 @@ EOF; } } - // write advanced icap config files + // write advanced clamav/icap config files file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf", base64_decode($antivirus_config['squidclamav']), LOCK_EX); file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf", base64_decode($antivirus_config['c-icap_conf']), LOCK_EX); file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.magic", base64_decode($antivirus_config['c-icap_magic']), LOCK_EX); + file_put_contents(SQUID_LOCALBASE . "/etc/freshclam.conf", base64_decode($antivirus_config['freshclam_conf']), LOCK_EX); + + // Check clamav database + if (count(glob("/var/db/clamav/*d")) == 0) { + log_error("Squid - Missing /var/db/clamav/*.cvd or *.cld files. Running freshclam in background."); + mwexec_bg(SQUID_BASE . "/bin/freshclam"); + } // check antivirus daemons // check icap -- cgit v1.2.3 From ce7858d7585e1ef0ae21325551ccd7a2428566d6 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 20:39:15 +0200 Subject: Add freshclam mirror settings, manual AV defs update and cron updates --- config/squid3/34/squid_antivirus.xml | 79 +++++++++++++++++++++++++++++++++++- 1 file changed, 78 insertions(+), 1 deletion(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_antivirus.xml b/config/squid3/34/squid_antivirus.xml index 2e85ab19..e4d4ebe2 100755 --- a/config/squid3/34/squid_antivirus.xml +++ b/config/squid3/34/squid_antivirus.xml @@ -42,7 +42,7 @@ ]]> squidantivirus - 0.3.5 + 0.3.7 Proxy server: Antivirus /usr/local/pkg/squid.inc @@ -116,6 +116,74 @@ + + ClamAV Database Update + clamav_update + + + Select the desired frequency here.

+ + Click the button to update AV databases now.
+ Note: This will take a while. Check /var/log/clamav/freshclam.log for progress information. + ]]> + + select + 0 + + + + + + + + + + + + + + Regional ClamAV Database Update Mirror + clamav_dbregion + + + Note: It is strongly recommended to choose something here and/or configure your own mirrors manually below. + The default ClamAV database mirror performs extremely slow. + ]]> + + select + + + + + + + + + + + + + + + + + + + Optional ClamAV Database Update Servers + clamav_dbservers + + + Note: For official update mirrors, use db.XY.clamav.net format. (Replace XY with your country code.)
+ Note: Separate entries by semi-colons (;) + ]]> + + input + 60 + 5 + Advanced Options listtopic @@ -147,6 +215,15 @@ 85 15 + + freshclam.conf + freshclam_conf + freshclam.conf file. Leave empty to load sample file. Edit only if you know what are you doing. + textarea + base64 + 85 + 15 + squid_validate_antivirus($_POST, $input_errors); -- cgit v1.2.3 From dd50146443b450cecc4a767cb8ab16a2a5ae2e2b Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:25:52 +0200 Subject: When antivirus/C-ICAP is disabled, actually stop and disable related services --- config/squid3/34/squid.inc | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index 8c1e9628..0c26ff1f 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1729,7 +1729,34 @@ EOF; } else { mwexec_bg("/usr/local/etc/rc.d/clamav-clamd start"); } + } else { + // stop AV services and disable all C-ICAP/AV features + log_error("Squid antivirus features disabled."); + if (is_process_running("clamd")) { + log_error("Stopping ClamAV..."); + mwexec("/bin/ps awux | /usr/bin/grep '[c]lamd' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + } + if (is_process_running("c-icap")) { + log_error("Stopping C-ICAP..."); + mwexec_bg("/usr/local/etc/rc.d/c-icap stop"); + } + // freshclam cronjob + log_error("Removing freshclam cronjob..."); + squid_install_freshclam_cron(false); + + // check if clamav/c_icap is enabled in rc.conf.local + // XXX: This whole thing sucks and should be redone to install/enable services in pfSense way + if (file_exists("/etc/rc.conf.local")) { + log_error("Removing antivirus services from /etc/rc.conf.local..."); + $sample_file = file_get_contents("/etc/rc.conf.local"); + $rcconf_local_m[0] = "@c_icap_enable(.*)\n@"; + $rcconf_local_m[1] = "@clamav_clamd_enable(.*)\n@"; + $rcconf_local_r[0] = ""; + $rcconf_local_r[1] = ""; + file_put_contents("/etc/rc.conf.local", preg_replace($rcconf_local_m, $rcconf_local_r, $sample_file), LOCK_EX); + } } + return $conf; } -- cgit v1.2.3 From 77f503b6f9dbdc5f74061345f6340e3c3d989e87 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:35:31 +0200 Subject: Code style and comment tweaks --- config/squid3/34/squid.inc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index 0c26ff1f..d2013f83 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -394,8 +394,9 @@ function squid_install_command() { squid_chown_recursive($dir, SQUID_UID, SQUID_GID); } - if (!file_exists(SQUID_CONFBASE . '/mime.conf') && file_exists(SQUID_CONFBASE . '/mime.conf.default')) + if (!file_exists(SQUID_CONFBASE . '/mime.conf') && file_exists(SQUID_CONFBASE . '/mime.conf.default')) { copy(SQUID_CONFBASE . '/mime.conf.default', SQUID_CONFBASE . '/mime.conf'); + } } @@ -1534,7 +1535,7 @@ adaptation_access service_avi_resp allow all EOF; - // check if icap is enabled on rc.conf.local + // check if clamav/c_icap is enabled in rc.conf.local // XXX: This whole thing sucks and should be redone to install/enable services in pfSense way if (file_exists("/etc/rc.conf.local")) { $rc_old_file = file("/etc/rc.conf.local"); -- cgit v1.2.3 From ca4a5a1af57903b6d1c8607ab6ef33f5fe982705 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:38:15 +0200 Subject: Do not do useless checks for freshclam cronjob --- config/squid3/34/squid.inc | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index d2013f83..dce1f5d3 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1621,11 +1621,7 @@ EOF; file_put_contents(SQUID_LOCALBASE . "/etc/freshclam.conf.sample", preg_replace($freshclam_m, $freshclam_r, $sample_file), LOCK_EX); } // freshclam cronjob - if ($antivirus_config['enable'] == "on") { - squid_install_freshclam_cron(true); - } else { - squid_install_freshclam_cron(false); - } + squid_install_freshclam_cron(true); // check squidclamav files until PBIs are gone (https://redmine.pfsense.org/issues/4197) $ln_icap = array('bin/c-icap', 'bin/c-icap-client', 'c-icap-config', 'c-icap-libicapapi-config', 'c-icap-stretch', 'lib/c_icap', 'share/c_icap', 'etc/c-icap'); -- cgit v1.2.3 From 3c8f45ec4be4da9b194cbca9aed0da5ddf834a10 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:42:48 +0200 Subject: Fix squidclamav.conf.sample handling to match the rest of the config files --- config/squid3/34/squid.inc | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index dce1f5d3..a3134736 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1558,15 +1558,13 @@ EOF; squid_check_clamav_user('clamav'); // patch sample files to pfsense dirs // squidclamav.conf - if (!file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample")) { - if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default")) { - $sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default"); - $clamav_m[0] = "@/var/run/clamav/clamd.ctl@"; - $clamav_m[1] = "@http\://proxy.domain.dom/cgi-bin/clwarn.cgi@"; - $clamav_r[0] = "/var/run/clamav/clamd.sock"; - $clamav_r[1] = "{$config['system']['webgui']['protocol']}://{$config['system']['hostname']}.{$config['system']['domain']}/squid_clwarn.php"; - file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample", preg_replace($clamav_m, $clamav_r, $sample_file), LOCK_EX); - } + if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default")) { + $sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default"); + $clamav_m[0] = "@/var/run/clamav/clamd.ctl@"; + $clamav_m[1] = "@http\://proxy.domain.dom/cgi-bin/clwarn.cgi@"; + $clamav_r[0] = "/var/run/clamav/clamd.sock"; + $clamav_r[1] = "{$config['system']['webgui']['protocol']}://{$config['system']['hostname']}.{$config['system']['domain']}/squid_clwarn.php"; + file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample", preg_replace($clamav_m, $clamav_r, $sample_file), LOCK_EX); } // c-icap.conf // make a backup of default c-icap.conf.sample first -- cgit v1.2.3 From 3879148c01d2f47209ea3933776802af93ef416f Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:45:13 +0200 Subject: Add Google Safe Browsing feature --- config/squid3/34/squid.inc | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index a3134736..713d3758 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -1564,6 +1564,10 @@ EOF; $clamav_m[1] = "@http\://proxy.domain.dom/cgi-bin/clwarn.cgi@"; $clamav_r[0] = "/var/run/clamav/clamd.sock"; $clamav_r[1] = "{$config['system']['webgui']['protocol']}://{$config['system']['hostname']}.{$config['system']['domain']}/squid_clwarn.php"; + if ($antivirus_config['clamav_safebrowsing'] == "on") { + $clamav_m[2] = "@safebrowsing\s0@"; + $clamav_r[2] = "safebrowsing 1"; + } file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample", preg_replace($clamav_m, $clamav_r, $sample_file), LOCK_EX); } // c-icap.conf @@ -1616,6 +1620,10 @@ EOF; $freshclam_m[1] = "@#DatabaseMirror db.XY.clamav.net@"; $freshclam_r[1] = "{$clamav_mirrors}"; } + if ($antivirus_config['clamav_safebrowsing'] == "on") { + $freshclam_m[2] = "@#SafeBrowsing yes@"; + $freshclam_r[2] = "SafeBrowsing yes"; + } file_put_contents(SQUID_LOCALBASE . "/etc/freshclam.conf.sample", preg_replace($freshclam_m, $freshclam_r, $sample_file), LOCK_EX); } // freshclam cronjob @@ -1682,7 +1690,10 @@ EOF; // Check clamav database if (count(glob("/var/db/clamav/*d")) == 0) { log_error("Squid - Missing /var/db/clamav/*.cvd or *.cld files. Running freshclam in background."); - mwexec_bg(SQUID_BASE . "/bin/freshclam"); + mwexec_bg(SQUID_BASE . "/bin/freshclam --config-file=" . SQUID_BASE . "/etc/freshclam.conf"); + } elseif (($antivirus_config['clamav_safebrowsing'] == "on") && (!is_file("/var/db/clamav/safebrowsing.cvd"))) { + log_error("Squid - Google Safe Browsing is enabled but missing safebrowsing.cvd definitions. Running freshclam in background."); + mwexec_bg(SQUID_BASE . "/bin/freshclam --config-file=" . SQUID_BASE . "/etc/freshclam.conf"); } // check antivirus daemons -- cgit v1.2.3 From 640d382dd43d91f705938a0b7228c712f2e07d56 Mon Sep 17 00:00:00 2001 From: doktornotor Date: Wed, 30 Sep 2015 23:45:50 +0200 Subject: Add Google Safe Browsing feature --- config/squid3/34/squid_antivirus.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_antivirus.xml b/config/squid3/34/squid_antivirus.xml index e4d4ebe2..a257891d 100755 --- a/config/squid3/34/squid_antivirus.xml +++ b/config/squid3/34/squid_antivirus.xml @@ -116,6 +116,19 @@ + + Google Safe Browsing + clamav_safebrowsing + + Google Safe Browsing. + Google Safe Browsing database includes information about websites that may be phishing sites or possible sources of malware.
+ Note: This option consumes significant amount of RAM.
+ Important: Set 'ClamAV Database Update' below to 'every 1 hours' if you want to use this feature! + ]]> + + checkbox + ClamAV Database Update clamav_update -- cgit v1.2.3 From fb7850b74d9f51062d0e80165a402072cb1a476a Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 00:22:10 +0200 Subject: Improve some descriptions, nuke useless tags that do not show in rowhelpers --- config/squid3/34/squid_sync.xml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_sync.xml b/config/squid3/34/squid_sync.xml index 29585dd8..60e1190c 100755 --- a/config/squid3/34/squid_sync.xml +++ b/config/squid3/34/squid_sync.xml @@ -42,7 +42,7 @@ ]]> squidsync - 0.3.5 + 0.3.7 Proxy server: XMLRPC Sync /usr/local/pkg/squid.inc @@ -109,12 +109,12 @@ Sync Timeout synctimeout - Select sync max wait time. + XMLRPC timeout in seconds. select 250 - + @@ -129,14 +129,12 @@ IP Address ipaddress - IP address of remote server. input 20 - Password + Password (admin) password - Password for remote server. password 20 -- cgit v1.2.3 From 51f8edee1ddb4fa9c5a8c346ef59a707881bf03e Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 00:24:37 +0200 Subject: Improve some descriptions, nuke useless tags that do not show in rowhelpers --- config/squid3/34/squid_reverse_sync.xml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_reverse_sync.xml b/config/squid3/34/squid_reverse_sync.xml index 3b929c8e..eb52540f 100755 --- a/config/squid3/34/squid_reverse_sync.xml +++ b/config/squid3/34/squid_reverse_sync.xml @@ -42,7 +42,7 @@ ]]> squidsync - 0.3.5 + 0.3.7 Reverse Proxy Server: XMLRPC Sync /usr/local/pkg/squid.inc @@ -93,12 +93,12 @@ Sync Timeout synctimeout - Select sync max wait time. + XMLRPC timeout in seconds. select 250 - + @@ -113,14 +113,12 @@ IP Address ipaddress - IP address of remote server. input 20 - Password + Password (admin) password - Password for remote server. password 20 -- cgit v1.2.3 From bddb7e792c663d6e6d48bffe63fc79239c32579a Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 00:46:44 +0200 Subject: Move fielddescr away from rowhelperfield (another pkg_edit.php bug) --- config/squid3/34/squid_reverse_uri.xml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_reverse_uri.xml b/config/squid3/34/squid_reverse_uri.xml index 164d6374..9a493a15 100755 --- a/config/squid3/34/squid_reverse_uri.xml +++ b/config/squid3/34/squid_reverse_uri.xml @@ -42,7 +42,7 @@ ]]> squidreverseuri - 0.3.5 + 0.3.7 Reverse Proxy Server: Mappings /usr/local/pkg/squid.inc @@ -137,20 +137,20 @@ 05 - URIs + +
+ Enter URL regex to match.

+ Examples:
+ .mydomain.com .mydomain.com/test
+ www.mydomain.com http://www.mydomain.com/ ^http://www.mydomain.com/.*$ + ]]> + none URI to publish. rowhelper - - regex to match.

- Examples:
- .mydomain.com .mydomain.com/test
- www.mydomain.com http://www.mydomain.com/ ^http://www.mydomain.com/.*$ - ]]> - uri input 70 -- cgit v1.2.3 From 609068e2149936af25d2d2b02624044441fcd86e Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 00:53:19 +0200 Subject: Move fielddescr away from rowhelperfield (another pkg_edit.php bug) --- config/squid3/34/squid_reverse_redir.xml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid_reverse_redir.xml b/config/squid3/34/squid_reverse_redir.xml index 71653899..cf5fdb45 100755 --- a/config/squid3/34/squid_reverse_redir.xml +++ b/config/squid3/34/squid_reverse_redir.xml @@ -42,7 +42,7 @@ ]]> squidreverseredir - 0.3.5 + 0.3.7 Reverse Proxy Server: Redirects /usr/local/pkg/squid.inc @@ -138,19 +138,19 @@ - Blocked Domains + +
+ Enter the domains to match here.
+ Example: example.com sub.example.com www.example.com

+ Do NOT enter http:// or https:// here! Only the hostname is required. + ]]> + none Domains to redirect for. rowhelper - - - Example: example.com sub.example.com www.example.com

- Do NOT enter http:// or https:// here! Only the hostname is required. - ]]> - uri input 60 -- cgit v1.2.3 From d690ca09df4ad19280b622e7854d108e896230dd Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 02:49:55 +0200 Subject: Fix C-ICAP and cleanup useless things here --- config/squid3/34/squid.xml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.xml b/config/squid3/34/squid.xml index ec9855e8..dda924f8 100644 --- a/config/squid3/34/squid.xml +++ b/config/squid3/34/squid.xml @@ -42,7 +42,7 @@ ]]> squid - 0.3.5.1 + 0.3.7 Proxy Server: General Settings /usr/local/pkg/squid.inc @@ -71,7 +71,7 @@ c-icap - c-icap + c-icap.sh c-icap ICAP Inteface for Squid and ClamAV integration @@ -725,17 +725,14 @@ - squid_generate_rules -- cgit v1.2.3 From c55c010882627f6dd4680cc1eebfcecf5298919c Mon Sep 17 00:00:00 2001 From: doktornotor Date: Thu, 1 Oct 2015 03:30:38 +0200 Subject: Fix C-ICAP --- config/squid3/34/squid.inc | 72 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 50 insertions(+), 22 deletions(-) (limited to 'config/squid3/34') diff --git a/config/squid3/34/squid.inc b/config/squid3/34/squid.inc index 713d3758..db5f1b0c 100755 --- a/config/squid3/34/squid.inc +++ b/config/squid3/34/squid.inc @@ -369,6 +369,7 @@ function squid_install_command() { chgrp(SQUID_LOCALBASE . "/libexec/squid/pinger", SQUID_GID); } + // create squid rcfile squid_write_rcfile(); // XXX: Is it really necessary? mode is set to 0755 in squid.xml @@ -376,11 +377,15 @@ function squid_install_command() { @chmod("/usr/local/pkg/swapstate_check.php", 0755); } + // create squid monitor rcfile write_rcfile(array( "file" => "sqp_monitor.sh", "start" => "/usr/local/pkg/sqpmon.sh &", "stop" => "/bin/ps awux | /usr/bin/grep \"sqpmon\" | /usr/bin/grep -v \"grep\" | /usr/bin/grep -v \"php\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill") ); + + // create c-icap rcfile + squid_write_cicap_rcfile(); // make a backup of default c-icap config file on install; also see squid_resync_antivirus() function below if (!file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default")) { @@ -410,7 +415,9 @@ function squid_deinstall_command() { update_status("Stopping services..."); /* kill all running services */ mwexec('/usr/local/etc/rc.d/sqp_monitor.sh stop'); - mwexec("/bin/ps awux | /usr/bin/grep '[c]-icap' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); + if (is_process_running("c-icap")) { + mwexec('/bin/echo -n "stop" > /var/run/c-icap/c-icap.ctl'); + } mwexec("/bin/ps awux | /usr/bin/grep '[c]lamd' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); mwexec("/bin/ps awux | /usr/bin/grep '[f]reshclam' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); mwexec("/bin/ps awux | /usr/bin/grep '[s]quid' | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill"); @@ -419,6 +426,7 @@ function squid_deinstall_command() { /* delete rc scripts */ unlink_if_exists('/usr/local/etc/rc.d/sqp_monitor.sh'); unlink_if_exists('/usr/local/etc/rc.d/c-icap'); + unlink_if_exists("/usr/local/etc/rc.d/c-icap.sh"); unlink_if_exists('/usr/local/etc/rc.d/clamav-clamd'); unlink_if_exists('/usr/local/etc/rc.d/clamav-freshclam'); @@ -458,6 +466,7 @@ function squid_deinstall_command() { mwexec("/bin/rm -rf {$dir}"); } } + /* clean up created PBI symlinks */ update_status("Finishing package cleanup."); if (SQUID_LOCALBASE != '/usr/local') { @@ -472,6 +481,17 @@ function squid_deinstall_command() { } } + /* check if clamav/c_icap is enabled in rc.conf.local */ + if (file_exists("/etc/rc.conf.local")) { + update_status("Removing antivirus services from /etc/rc.conf.local..."); + $sample_file = file_get_contents("/etc/rc.conf.local"); + $rcconf_local_m[0] = "@c_icap_enable(.*)\n@"; + $rcconf_local_m[1] = "@clamav_clamd_enable(.*)\n@"; + $rcconf_local_r[0] = ""; + $rcconf_local_r[1] = ""; + file_put_contents("/etc/rc.conf.local", preg_replace($rcconf_local_m, $rcconf_local_r, $sample_file), LOCK_EX); + } + update_status("Reloading filter..."); filter_configure(); } @@ -1535,12 +1555,12 @@ adaptation_access service_avi_resp allow all EOF; - // check if clamav/c_icap is enabled in rc.conf.local + // check if clamav is enabled in rc.conf.local // XXX: This whole thing sucks and should be redone to install/enable services in pfSense way if (file_exists("/etc/rc.conf.local")) { $rc_old_file = file("/etc/rc.conf.local"); foreach ($rc_old_file as $rc_line) { - if (preg_match("/^(c_icap_enable|clamav_clamd_enable)/", $rc_line, $matches)) { + if (preg_match("/^clamav_clamd_enable/", $rc_line, $matches)) { $rc_file .= $matches[1] . '="YES"' . "\n"; ${$matches[1]} = "ok"; } else { @@ -1548,9 +1568,6 @@ EOF; } } } - if (!isset($c_icap_enable)) { - $rc_file .= 'c_icap_enable="YES"' . "\n"; - } if (!isset($clamav_clamd_enable)) { $rc_file .= 'clamav_clamd_enable="YES"' . "\n"; } @@ -1698,20 +1715,14 @@ EOF; // check antivirus daemons // check icap + $c_icap_rcfile = "/usr/local/etc/rc.d/c-icap.sh"; + if (!file_exists($c_icap_rcfile)) { + squid_write_cicap_rcfile(); + } if (is_process_running("c-icap")) { mwexec_bg('/bin/echo -n "reconfigure" > /var/run/c-icap/c-icap.ctl'); } else { - // check c-icap user on startup file - $c_icap_rcfile = "/usr/local/etc/rc.d/c-icap"; - if (file_exists($c_icap_rcfile)) { - $sample_file = file_get_contents($c_icap_rcfile); - $cicapm[0] = "@c_icap_user=.*}@"; - $cicapr[0] = 'c_icap_user="clamav"}'; - $cicapm[1] = "@/usr/local@"; - $cicapr[1] = SQUID_LOCALBASE; - file_put_contents($c_icap_rcfile, preg_replace($cicapm, $cicapr, $sample_file), LOCK_EX); - } - mwexec_bg("/usr/local/etc/rc.d/c-icap start"); + mwexec_bg("{$c_icap_rcfile} start"); } // check clamav/freshclam $rc_files = array("clamav-freshclam", "clamav-clamd"); @@ -1744,21 +1755,19 @@ EOF; } if (is_process_running("c-icap")) { log_error("Stopping C-ICAP..."); - mwexec_bg("/usr/local/etc/rc.d/c-icap stop"); + mwexec_bg("/usr/local/etc/rc.d/c-icap.sh stop"); } // freshclam cronjob log_error("Removing freshclam cronjob..."); squid_install_freshclam_cron(false); - // check if clamav/c_icap is enabled in rc.conf.local + // check if clamav is enabled in rc.conf.local // XXX: This whole thing sucks and should be redone to install/enable services in pfSense way if (file_exists("/etc/rc.conf.local")) { log_error("Removing antivirus services from /etc/rc.conf.local..."); $sample_file = file_get_contents("/etc/rc.conf.local"); - $rcconf_local_m[0] = "@c_icap_enable(.*)\n@"; - $rcconf_local_m[1] = "@clamav_clamd_enable(.*)\n@"; + $rcconf_local_m[0] = "@clamav_clamd_enable(.*)\n@"; $rcconf_local_r[0] = ""; - $rcconf_local_r[1] = ""; file_put_contents("/etc/rc.conf.local", preg_replace($rcconf_local_m, $rcconf_local_r, $sample_file), LOCK_EX); } } @@ -2633,6 +2642,25 @@ EOD; conf_mount_ro(); } +function squid_write_cicap_rcfile() { + $c_icap_rcfile = "c-icap.sh"; + $cicap_libdir = SQUID_LOCALBASE . "/lib"; + $cicap_bin = SQUID_LOCALBASE . "/bin/c-icap"; + $cicap_conf = SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf"; + $cicap_start_cmd = "LD_LIBRARY_PATH={$cicap_libdir} {$cicap_bin} -f {$cicap_conf}"; + $cicap_stop_cmd = '/bin/echo -n "stop" > /var/run/c-icap/c-icap.ctl'; + conf_mount_rw(); + write_rcfile(array( + "file" => "{$c_icap_rcfile}", + "start" => "{$cicap_start_cmd}", + "stop" => "{$cicap_stop_cmd}" + ) + ); + // force delete the PBI initscript that keeps creeping back + unlink_if_exists("/usr/local/etc/rc.d/c-icap"); + conf_mount_ro(); +} + /* Uses XMLRPC to synchronize the changes to a remote node */ function squid_sync_on_changes() { global $config, $g; -- cgit v1.2.3