'migrated',
'enable' => 'on',
'name' => $cache_peer[0],
'port' => $cache_peer[1],
'protocol' => $cache_peer[2]
);
}
}
}
// mappings
if (!is_array($config['installedpackages']['squidreverseuri'])) {
foreach (explode("\n", sq_text_area_decode($old_reverse_settings['reverse_acl'])) as $acls) {
foreach (explode(";", $acls) as $acl) {
array_push(${'peer_'.$acl[0]},$acl[1]);
}
}
foreach (explode("\n", sq_text_area_decode($old_reverse_settings['reverse_uri'])) as $uris) {
foreach (explode(";", $uris) as $uri) {
$peer_list = (is_array(${'peer_' . $uri[0]}) ? implode(",", ${'peer_' . $uri[0]}) : "");
$config['installedpackages']['squidreverseuri']['config'][] = array(
'description' => 'migrated',
'enable' => 'on',
'name' => $uri[0],
'uri' => $uri[1],
'vhost' => $uri[2],
'peers' => $peer_list
);
}
}
}
}
update_status("Writing configuration... One moment please...");
write_config();
/* make sure pinger is executable and suid root */
// XXX: Bug #5114
if (file_exists(SQUID_LOCALBASE . "/libexec/squid/pinger")) {
chgrp(SQUID_LOCALBASE . "/libexec/squid/pinger", SQUID_GID);
}
squid_write_rcfile();
// XXX: Is it really necessary? mode is set to 0755 in squid.xml
if (file_exists("/usr/local/pkg/swapstate_check.php")) {
@chmod("/usr/local/pkg/swapstate_check.php", 0755);
}
write_rcfile(array(
"file" => "sqp_monitor.sh",
"start" => "/usr/local/pkg/sqpmon.sh &",
"stop" => "/bin/ps awux | /usr/bin/grep \"sqpmon\" | /usr/bin/grep -v \"grep\" | /usr/bin/grep -v \"php\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill")
);
// make a backup of default c-icap config file on install; also see squid_resync_antivirus() function below
if (!file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default")) {
if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample")) {
copy(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample", SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default");
}
}
foreach (array(SQUID_CONFBASE, SQUID_ACLDIR, SQUID_SSL_DB) as $dir) {
safe_mkdir($dir, 0755);
squid_chown_recursive($dir, SQUID_UID, SQUID_GID);
}
if (!file_exists(SQUID_CONFBASE . '/mime.conf') && file_exists(SQUID_CONFBASE . '/mime.conf.default'))
copy(SQUID_CONFBASE . '/mime.conf.default', SQUID_CONFBASE . '/mime.conf');
}
function squid_deinstall_command() {
global $config, $g;
/* remove cronjob */
squid_install_cron(false);
update_status("Stopping services...");
/* kill all running services */
mwexec('/usr/local/etc/rc.d/sqp_monitor.sh stop');
if (is_process_running("c-icap")) {
mwexec('/usr/local/etc/rc.d/c-icap stop');
}
if (is_process_running("clamd")) {
mwexec('/usr/local/etc/rc.d/clamav-clamd stop');
}
if (is_process_running("freshclam")) {
mwexec('/usr/local/etc/rc.d/clamav-freshclam stop');
}
mwexec("/bin/ps awux | /usr/bin/grep \"squid\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill");
mwexec("/bin/ps awux | /usr/bin/grep \"dnsserver\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill");
mwexec("/bin/ps awux | /usr/bin/grep \"unlinkd\" | /usr/bin/grep -v \"grep\" | /usr/bin/awk '{ print $2 }' | /usr/bin/xargs kill");
/* delete rc scripts */
unlink_if_exists('/usr/local/etc/rc.d/sqp_monitor.sh');
unlink_if_exists('/usr/local/etc/rc.d/c-icap');
unlink_if_exists('/usr/local/etc/rc.d/clamav-clamd');
unlink_if_exists('/usr/local/etc/rc.d/clamav-freshclam');
/* clean up created directories */
update_status("Removing cache and logs ... One moment please...");
update_output_window("This operation may take quite some time, please be patient. Do not press stop or attempt to navigate away from this page during this process.");
if (is_array($config['installedpackages']['squidcache'])) {
$cachesettings = $config['installedpackages']['squidcache']['config'][0];
} else {
$cachesettings = array();
}
$cachedir = ($cachesettings['harddisk_cache_location'] ? $cachesettings['harddisk_cache_location'] : '/var/squid/cache');
if (is_array($config['installedpackages']['squid'])) {
$squidsettings = $config['installedpackages']['squid']['config'][0];
} else {
$squidsettings = array();
}
$logdir = ($squidsettings['log_dir'] ? $squidsettings['log_dir'] : '/var/squid/logs');
// XXX: Is it ok to remove cache and logs? It's going to happen every time package is updated
if (is_dir("{$cachedir}")) {
mwexec_bg("/bin/rm -rf {$cachedir}");
}
if (is_dir("{$logdir}")) {
mwexec("/bin/rm -rf {$logdir}");
}
$dirs = array("/var/run/c-icap", "/var/log/c-icap", "/var/log/clamav", "/var/run/clamav", "/var/db/clamav");
foreach ($dirs as $dir) {
if (is_dir("{$dir}")) {
mwexec("/bin/rm -rf {$dir}");
}
}
/* clean up created PBI symlinks */
update_status("Finishing package cleanup.");
if (SQUID_LOCALBASE != '/usr/local') {
$ln_icap = array('bin/c-icap', 'bin/c-icap-client', 'c-icap-config', 'c-icap-libicapapi-config', 'c-icap-stretch', 'lib/c_icap', 'share/c_icap', 'etc/c-icap');
foreach ($ln_icap as $ln) {
if (is_link("/usr/local/{$ln}")) {
unlink("/usr/local/{$ln}");
}
}
if (is_link("/usr/local/lib/libicapapi.so.3")) {
unlink("/usr/local/lib/libicapapi.so.3");
}
}
update_status("Reloading filter...");
filter_configure();
}
function squid_validate_antivirus($post, &$input_errors) {
global $config;
if ($post['enable'] != "on") {
return;
}
if ($post['squidclamav'] && preg_match("/(\S+proxy.domain\S+)/", $post['squidclamav'], $a_match)) {
$input_errors[] = "SquidClamav warnings redirect points to sample config domain ({$a_match[1]})";
$input_errors[] = "Change redirect info on 'squidclamav.conf' field to pfSense GUI or an external host.";
}
if ($post['c-icap_conf']) {
if (!preg_match("/squid_clamav/", $post['c-icap_conf'])) {
$input_errors[] = "c-icap Squidclamav service definition is not present.";
$input_errors[] = "Add 'Service squid_clamav squidclamav.so'(without quotes) to 'c-icap.conf' field in order to get it working.";
}
if (preg_match("/(Manager:Apassword\S+)/", $post['c-icap_conf'], $c_match)) {
$input_errors[] = "Remove ldap configuration'{$c_match[1]}' from 'c-icap.conf' field.";
}
}
}
function squid_validate_general($post, &$input_errors) {
global $config;
if (is_array($config['installedpackages']['squid'])) {
$settings = $config['installedpackages']['squid']['config'][0];
} else {
$settings = array();
}
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
$port = $post['proxy_port'] ? $post['proxy_port'] : $port;
$icp_port = trim($post['icp_port']);
if (!empty($icp_port) && !is_port($icp_port)) {
$input_errors[] = 'You must enter a valid port number in the \'ICP port\' field.';
}
if (substr($post['log_dir'], -1, 1) == '/') {
$input_errors[] = 'Log location must not end with a / character.';
}
if ($post['log_dir']{0} != '/') {
$input_errors[] = 'Log location must start with a / character.';
}
if (strlen($post['log_dir']) <= 3) {
$input_errors[] = "Configured log location directory is not valid.";
}
$log_rotate = trim($post['log_rotate']);
if (!empty($log_rotate) && (!is_numericint($log_rotate) or ($log_rotate < 1))) {
$input_errors[] = "You must enter a valid number of days in the 'Log rotate' field.";
}
$webgui_port = $config['system']['webgui']['port'];
if (($config['system']['webgui']['port'] == "") && ($config['system']['webgui']['protocol'] == "http")) {
$webgui_port = 80;
}
if (($config['system']['webgui']['port'] == "") && ($config['system']['webgui']['protocol'] == "https")) {
$webgui_port = 443;
}
if (($post['transparent_proxy'] != 'on') && ($port == $webgui_port)) {
$input_errors[] = "You can not run Squid on the same port as the pfSense WebGUI";
}
if (($post['ssl_proxy'] == 'on') && ( $post['dca'] == '')) {
$input_errors[] = "SSL interception cannot be enabled without a CA.";
}
foreach (array('defined_ip_proxy_off') as $hosts) {
foreach (explode(";", $post[$hosts]) as $host) {
$host = trim($host);
if (!empty($host) && !is_ipaddr($host) && !is_alias($host) && !is_hostname($host) && !is_subnet($host)) {
$input_errors[] = "'Bypass proxy for these source IPs' entry '$host' is not a valid IP address, hostname, or alias.";
}
}
}
foreach (array('defined_ip_proxy_off_dest') as $hosts) {
foreach (explode(";", $post[$hosts]) as $host) {
$host = trim($host);
if (!empty($host) && !is_ipaddr($host) && !is_alias($host) && !is_hostname($host) && !is_subnet($host)) {
$input_errors[] = "'Bypass proxy for these destination IPs' entry '$host' is not a valid IP address, hostname, or alias.";
}
}
}
if (!empty($post['dns_nameservers'])) {
$altdns = explode(";", ($post['dns_nameservers']));
foreach ($altdns as $dnssrv) {
if (!is_ipaddr($dnssrv)) {
$input_errors[] = "You must enter a valid IP address in the 'Alternate DNS servers' field.";
break;
}
}
}
}
function squid_validate_upstream($post, &$input_errors) {
if ($post['enabled'] != 'on') {
return;
}
$addr = trim($post['proxyaddr']);
if (empty($addr)) {
$input_errors[] = "The 'Proxy hostname' field is required";
} else {
if (!is_ipaddr($addr) && !is_domain($addr)) {
$input_errors[] = "You must enter a valid IP address or host name in the 'Proxy hostname' field.";
}
}
foreach (array('proxyport' => 'TCP port', 'icpport' => 'ICP port') as $field => $name) {
$port = trim($post[$field]);
if (empty($port)) {
$input_errors[] = "The '$name' field is required.";
} else {
if (!is_port($port)) {
$input_errors[] = "The '$name' field must contain a valid port number (1-65535).";
}
}
}
}
function squid_validate_cache($post, &$input_errors) {
$num_fields = array(
'harddisk_cache_size' => 'Hard disk cache size',
'memory_cache_size' => 'Memory cache size',
'maximum_object_size' => 'Maximum object size',
);
foreach ($num_fields as $field => $name) {
$value = trim($post[$field]);
if (!is_numericint($value)) {
$input_errors[] = "You must enter a valid value for '$field'.";
}
}
$value = trim($post['minimum_object_size']);
if (!is_numericint($value)) {
$input_errors[] = "You must enter a valid value for 'Minimum object size'.";
}
if (!empty($post['cache_swap_low'])) {
$value = trim($post['cache_swap_low']);
if (!is_numericint($value) || ($value > 100)) {
$input_errors[] = "You must enter a valid value for 'Low-water-mark'.";
}
}
if (!empty($post['cache_swap_high'])) {
$value = trim($post['cache_swap_high']);
if (!is_numericint($value) || ($value > 100)) {
$input_errors[] = "You must enter a valid value for 'High-water-mark'.";
}
}
if ($post['donotcache'] != "") {
foreach (split("\n", $post['donotcache']) as $host) {
$host = trim($host);
if (!is_ipaddr($host) && !is_domain($host)) {
$input_errors[] = "The host '$host' is not a valid IP or hostname.";
}
}
}
squid_dash_z();
}
function squid_validate_nac($post, &$input_errors) {
$allowed_subnets = explode("\n", $post['allowed_subnets']);
foreach ($allowed_subnets as $subnet) {
$subnet = trim($subnet);
if (!empty($subnet) && !is_subnet($subnet)) {
$input_errors[] = "The subnet '$subnet' is not a valid CIDR range.";
}
}
foreach (array('unrestricted_hosts', 'banned_hosts') as $hosts) {
if (preg_match_all("@([0-9.]+)(/[0-9.]+|)@", $_POST[$hosts], $matches)) {
for ($x = 0; $x < count($matches[1]); $x++) {
if ($matches[2][$x] == "") {
if (!is_ipaddr($matches[1][$x])) {
$input_errors[] = "'{$matches[1][$x]}' is not a valid IP address.";
}
} else {
if (!is_subnet($matches[0][$x])) {
$input_errors[] = "The subnet '{$matches[0][$x]}' is not a valid CIDR range.";
}
}
}
}
}
foreach (array('unrestricted_macs', 'banned_macs') as $macs) {
foreach (explode("\n", $post[$macs]) as $mac) {
$mac = trim($mac);
if (!empty($mac) && !is_macaddr($mac)) {
$input_errors[] = "'$mac' is not a valid MAC address.";
}
}
}
foreach (explode(",", $post['timelist']) as $time) {
$time = trim($time);
if (!empty($time) && !squid_is_timerange($time)) {
$input_errors[] = "The time range '$time' is not a valid time range.";
}
}
if (!empty($post['ext_cachemanager'])) {
$extmgr = explode(";", ($post['ext_cachemanager']));
foreach ($extmgr as $mgr) {
if (!is_ipaddr($mgr)) {
$input_errors[] = "You must enter a valid IP address in the 'External Cache Manager' field'.";
}
}
}
}
function squid_validate_traffic($post, &$input_errors) {
$num_fields = array(
'max_download_size' => 'Maximum download size',
'max_upload_size' => 'Maximum upload size',
'perhost_throttling' => 'Per-host bandwidth throttling',
'overall_throttling' => 'Overall bandwidth throttling',
);
foreach ($num_fields as $field => $name) {
$value = trim($post[$field]);
if (!is_numericint($value)) {
$input_errors[] = "The '$name' field must contain a positive integer.";
}
}
if (!empty($post['quick_abort_min'])) {
$value = trim($post['quick_abort_min']);
if ((!is_numericint($value)) && ($value !== -1)) {
$input_errors[] = "'Finish when remaining KB' must contain a positive integer or '-1'.";
}
}
if (!empty($post['quick_abort_max'])) {
$value = trim($post['quick_abort_max']);
if (!is_numericint($value)) {
$input_errors[] = "'Abort when remaining KB' must contain a positive integer.";
}
}
if (!empty($post['quick_abort_pct'])) {
$value = trim($post['quick_abort_pct']);
if (!is_numericint($value) || ($value > 100)) {
$input_errors[] = "'Finish when remaining %' must contain valid percentage (1-100).";
}
}
}
function squid_validate_reverse($post, &$input_errors) {
global $config;
if (!empty($post['reverse_ip'])) {
$reverse_ip = explode(";", ($post['reverse_ip']));
foreach ($reverse_ip as $reip) {
if (!is_ipaddr(trim($reip))) {
$input_errors[] = "You must enter a valid IP address in the 'User-defined reverse-proxy IPs' field. '$reip' is invalid.";
}
}
}
$fqdn = trim($post['reverse_external_fqdn']);
if (!empty($fqdn) && !is_domain($fqdn)) {
$input_errors[] = "'External FQDN' field must contain a valid domain name.";
}
$port = trim($post['reverse_http_port']);
preg_match("/(\d+)/", shell_exec("/sbin/sysctl net.inet.ip.portrange.reservedhigh"), $portrange);
if (!empty($port) && !is_port($port)) {
$input_errors[] = "'Reverse HTTP port' must contain a valid port number.";
}
if (!empty($port) && is_port($port) && $port <= $portrange[1]) {
$input_errors[] = "'Reverse HTTP port' must contain a port number higher than net.inet.ip.portrange.reservedhigh sysctl value({$portrange[1]}).";
$input_errors[] = "To listen on low ports, change portrange.reservedhigh sysctl value to 0 in system tunable options and restart Squid daemon.";
}
$port = trim($post['reverse_https_port']);
if (!empty($port) && !is_port($port)) {
$input_errors[] = "'Reverse HTTPS port' must contain a valid port number.";
}
if (!empty($port) && is_port($port) && $port <= $portrange[1]) {
$input_errors[] = "'Reverse HTTPS port' must contain a port number higher than net.inet.ip.portrange.reservedhigh sysctl value({$portrange[1]}).";
$input_errors[] = "To listen on low ports, change portrange.reservedhigh sysctl value to 0 in system tunable options and restart Squid daemon.";
}
if ($post['reverse_ssl_cert'] == 'none') {
$input_errors[] = 'A valid certificate for the external interface must be selected';
}
if (($post['reverse_https'] != 'on') && ($post['reverse_owa'] == 'on')) {
$input_errors[] = "You have to enable reverse HTTPS before enabling OWA support.";
}
if (!empty($post['reverse_owa_ip'])) {
$reverse_owa_ip = explode(";", ($post['reverse_owa_ip']));
foreach ($reverse_owa_ip as $reowaip) {
if (!is_ipaddr(trim($reowaip))) {
$input_errors[] = "You must enter a valid IP address in the 'CAS-Array / OWA frontend IP address' field. '$reowaip' is invalid.";
}
}
}
$contents = $post['reverse_cache_peer'];
if (!empty($contents)) {
$defs = explode("\r\n", ($contents));
foreach ($defs as $def) {
$cfg = explode(";", ($def));
if (!is_ipaddr($cfg[1])) {
$input_errors[] = "Please choose a valid IP in the cache peer configuration.";
}
if (!is_port($cfg[2])) {
$input_errors[] = "Please choose a valid port in the cache peer configuration.";
}
if (($cfg[3] != 'HTTPS') && ($cfg[3] != 'HTTP')) {
$input_errors[] = "Please choose HTTP or HTTPS in the cache peer configuration.";
}
}
}
}
function squid_validate_auth($post, &$input_errors) {
$num_fields = array(
array('auth_processes', 'Authentication processes', 1),
array('auth_ttl', 'Authentication TTL', 0),
);
foreach ($num_fields as $field) {
$value = trim($post[$field[0]]);
if (!empty($value) && (!is_numeric($value) || ($value < $field[2]))) {
$input_errors[] = "The '{$field[1]}' field must contain a valid number greater than {$field[2]}";
}
}
$auth_method = $post['auth_method'];
if (($auth_method != 'none') && ($auth_method != 'local') && ($auth_method != 'cp')) {
$server = trim($post['auth_server']);
if (empty($server)) {
$input_errors[] = "'Authentication server' is required.";
} elseif (!is_ipaddr($server) && !is_domain($server)) {
$input_errors[] = "'Authentication server' must contain a valid IP address or domain name.";
}
$port = trim($post['auth_server_port']);
if (!empty($port) && !is_port($port)) {
$input_errors[] = "'Authentication server port' must contain a valid port number.";
}
switch ($auth_method) {
case 'ldap':
$user = trim($post['ldap_user']);
if (empty($user)) {
$input_errors[] = "'LDAP server user DN' is required.";
} elseif (!$user) {
$input_errors[] = "'LDAP server user DN' must be a valid DN.";
}
break;
case 'radius':
$secret = trim($post['radius_secret']);
if (empty($secret)) {
$input_errors[] = "'RADIUS secret' is required.";
}
break;
case 'msnt':
foreach (explode(",", trim($post['msnt_secondary'])) as $server) {
if (!empty($server) && !is_ipaddr($server) && !is_domain($server)) {
$input_errors[] = "The host '$server' is not a valid IP address or domain name";
}
}
break;
}
$no_auth = explode("\n", $post['no_auth_hosts']);
foreach ($no_auth as $host) {
$host = trim($host);
if (!empty($host) && !is_subnet($host)) {
$input_errors[] = "The host '$host' is not a valid CIDR range";
}
}
}
}
function squid_install_cron($should_install) {
global $config;
if (platform_booting()) {
return;
}
parse_config(true);
if (is_array($config['installedpackages']['squidcache'])) {
$settings = $config['installedpackages']['squidcache']['config'][0];
} else {
$settings = array();
}
$cron_cmd = ($settings['clear_cache'] == 'on' ? "/usr/local/pkg/swapstate_check.php clean; " : "");
$cron_cmd .= SQUID_BASE . "/sbin/squid -k rotate -f " . SQUID_CONFFILE;
install_cron_job("{$cron_cmd}", $should_install, "0", "0", "*", "*", "*", "root");
$swapstate_cmd = "/usr/local/pkg/swapstate_check.php clean; ";
if ($should_install) {
if ($settings['clear_cache'] == 'on' ) {
install_cron_job("{$swapstate_cmd}", true, "*/360");
} else {
install_cron_job("{$swapstate_cmd}", false);
}
} else {
install_cron_job("{$swapstate_cmd}", false);
}
}
function squid_check_ca_hashes() {
global $config, $g;
// check certificates
$cert_count = 0;
if (is_dir(SQUID_LOCALBASE . '/share/certs')) {
if ($handle = opendir(SQUID_LOCALBASE . '/share/certs')) {
while (false !== ($file = readdir($handle))) {
if (preg_match ("/\d+.0/",$file)) {
$cert_count++;
}
}
closedir($handle);
}
}
if ($cert_count < 10) {
conf_mount_rw();
// create ca-root hashes from ca-root-nss package
log_error("Creating root certificate bundle hashes from the Mozilla Project");
$cas = file(SQUID_LOCALBASE . '/share/certs/ca-root-nss.crt');
$cert = 0;
foreach ($cas as $ca) {
if (preg_match("/--BEGIN CERTIFICATE--/", $ca)) {
$cert = 1;
}
if ($cert == 1) {
$crt .= $ca;
}
if (preg_match("/-END CERTIFICATE-/", $ca)) {
file_put_contents("/tmp/cert.pem", $crt, LOCK_EX);
$cert_hash = array();
exec("/usr/bin/openssl x509 -hash -noout -in /tmp/cert.pem", $cert_hash);
file_put_contents(SQUID_LOCALBASE . "/share/certs/" . $cert_hash[0] . ".0", $crt, LOCK_EX);
$crt = "";
$cert = 0;
}
}
}
}
function squid_resync_general() {
global $g, $config, $valid_acls;
if (is_array($config['installedpackages']['squid'])) {
$settings = $config['installedpackages']['squid']['config'][0];
} else {
$settings = array();
}
$conf = "# This file is automatically generated by pfSense\n";
$conf .= "# Do not edit manually !\n\n";
// Check ssl interception
if (($settings['ssl_proxy'] == 'on')) {
squid_check_ca_hashes();
$srv_cert = lookup_ca($settings["dca"]);
if ($srv_cert != false) {
if (base64_decode($srv_cert['prv'])) {
// check if ssl_db was initilized by Squid
if (!file_exists(SQUID_SSL_DB . "/serial")) {
if (is_dir(SQUID_SSL_DB)) {
mwexec("/bin/rm -rf " . SQUID_SSL_DB);
}
mwexec(SQUID_LOCALBASE . "/libexec/squid/ssl_crtd -c -s " . SQUID_SSL_DB);
}
// force squid user permission on /var/squid/lib/ssl_db/
squid_chown_recursive(SQUID_SSL_DB, SQUID_UID, SQUID_GID);
// cert, key, version, cipher, options, clientca, cafile, capath, crlfile, dhparams, sslflags, sslcontext
$crt_pk = SQUID_CONFBASE . "/serverkey.pem";
$crt_capath = SQUID_LOCALBASE . "/share/certs/";
file_put_contents($crt_pk, base64_decode($srv_cert['prv']) . base64_decode($srv_cert['crt']));
$sslcrtd_children = ($settings['sslcrtd_children'] ? $settings['sslcrtd_children'] : 5);
$ssl_interception .= "ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=" . ($sslcrtd_children*2) . "MB cert={$crt_pk} capath={$crt_capath}\n";
$interception_checks = "sslcrtd_program " . SQUID_LOCALBASE . "/libexec/squid/ssl_crtd -s " . SQUID_SSL_DB . " -M 4MB -b 2048\n";
$interception_checks .= "sslcrtd_children {$sslcrtd_children}\n";
$interception_checks .= "sslproxy_capath {$crt_capath}\n";
if (preg_match("/sslproxy_cert_error/", $settings["interception_checks"])) {
$interception_checks .= "sslproxy_cert_error allow all\n";
}
if (preg_match("/sslproxy_flags/", $settings["interception_checks"])) {
$interception_checks .= "sslproxy_flags DONT_VERIFY_PEER\n";
}
if ($settings["interception_adapt"] != "") {
foreach (explode(",", $settings["interception_adapt"]) as $adapt) {
$interception_checks .= "sslproxy_cert_adapt {$adapt} all\n";
}
}
}
}
}
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
$ssl_port = ($settings['ssl_proxy_port'] ? $settings['ssl_proxy_port'] : 3127);
// Read assigned interfaces
$real_ifaces = array();
if ($settings['active_interface']) {
$proxy_ifaces = explode(",", $settings['active_interface']);
} else {
$proxy_ifaces = array("lan");
}
if ($settings['transparent_proxy'] == "on") {
$transparent_ifaces = explode(",", $settings['transparent_active_interface']);
foreach ($transparent_ifaces as $t_iface) {
$t_iface_ip = squid_get_real_interface_address($t_iface);
if ($t_iface_ip[0]) {
$real_ifaces[] = $t_iface_ip;
}
}
} else {
$transparent_ifaces = array();
}
if ($settings['ssl_proxy'] == "on") {
$ssl_ifaces = explode(",", $settings['ssl_active_interface']);
foreach ($ssl_ifaces as $s_iface) {
$s_iface_ip = squid_get_real_interface_address($s_iface);
if ($s_iface_ip[0]) {
$real_ifaces[]=$s_iface_ip;
}
}
} else {
$ssl_ifaces = array();
}
// check all proxy interfaces selected
foreach ($proxy_ifaces as $iface) {
$iface_ip = squid_get_real_interface_address($iface);
if ($iface_ip[0]) {
$real_ifaces[] = $iface_ip;
if (in_array($iface,$ssl_ifaces)) {
$conf .= "http_port {$iface_ip[0]}:{$port} {$ssl_interception}\n";
} else {
$conf .= "http_port {$iface_ip[0]}:{$port}\n";
}
}
}
if (($settings['transparent_proxy'] == 'on')) {
if ($settings['ssl_proxy'] == "on" && count($ssl_ifaces) > 0) {
$conf .= "http_port 127.0.0.1:{$port} intercept {$ssl_interception}\n";
$conf .= "https_port 127.0.0.1:{$ssl_port} intercept {$ssl_interception}\n";
} else {
$conf .= "http_port 127.0.0.1:{$port} intercept\n";
}
}
$icp_port = ($settings['icp_port'] ? $settings['icp_port'] : 0);
$dns_v4_first = ($settings['dns_v4_first'] == "on" ? "on" : "off" );
$piddir = "{$g['varrun_path']}/squid";
$pidfile = "{$piddir}/squid.pid";
if (!is_dir($piddir)) {
safe_mkdir($piddir, 0755);
squid_chown_recursive($piddir, SQUID_UID, 'wheel');
}
$language = ($settings['error_language'] ? $settings['error_language'] : 'en');
$icondir = SQUID_CONFBASE . '/icons';
$hostname = ($settings['visible_hostname'] ? $settings['visible_hostname'] : 'localhost');
$email = ($settings['admin_email'] ? $settings['admin_email'] : 'admin@localhost');
$logdir = ($settings['log_dir'] ? $settings['log_dir'] : '/var/squid/logs');
if (!is_dir($logdir)) {
log_error("Creating Squid log dir $logdir");
safe_mkdir($logdir, 0755);
squid_chown_recursive($logdir, SQUID_UID, SQUID_GID);
}
$logdir_cache = $logdir . '/cache.log';
$logdir_access = ($settings['log_enabled'] == 'on' ? $logdir . '/access.log' : '/dev/null');
$pinger_helper = ($settings['disable_pinger']) == 'on' ? 'off' : 'on';
$pinger_program = SQUID_LOCALBASE . "/libexec/squid/pinger";
$squid_uid = SQUID_UID;
$squid_gid = SQUID_GID;
$conf .= <<< EOD
icp_port {$icp_port}
dns_v4_first {$dns_v4_first}
pid_filename {$pidfile}
cache_effective_user {$squid_uid}
cache_effective_group {$squid_gid}
error_default_language {$language}
icon_directory {$icondir}
visible_hostname {$hostname}
cache_mgr {$email}
access_log {$logdir_access}
cache_log {$logdir_cache}
cache_store_log none
netdb_filename {$logdir}/netdb.state
pinger_enable {$pinger_helper}
pinger_program {$pinger_program}
{$interception_checks}
EOD;
// Per squid docs, setting logfile_rotate to 0 is safe and causes a simple close/reopen.
$rotate = empty($settings['log_rotate']) ? 0 : $settings['log_rotate'];
$conf .= "logfile_rotate {$rotate}\n";
$conf .= "debug_options rotate={$rotate}\n";
squid_install_cron(true);
$conf .= <<< EOD
shutdown_lifetime 3 seconds
EOD;
if ($settings['allow_interface'] == 'on') {
$src = '';
foreach ($real_ifaces as $iface) {
list($ip, $mask) = $iface;
$ip = long2ip(ip2long($ip) & ip2long($mask));
$mask = 32-log((ip2long($mask) ^ ip2long('255.255.255.255'))+1,2);
if (!preg_match("@$ip/$mask@", $src)) {
$src .= " $ip/$mask";
}
}
$conf .= "# Allow local network(s) on interface(s)\n";
$conf .= "acl localnet src $src\n";
$valid_acls[] = 'localnet';
}
if ($settings['xforward_mode']) {
$conf .= "forwarded_for {$settings['xforward_mode']}\n";
} else {
// only used for first run
$conf .= "forwarded_for on\n";
}
if ($settings['disable_via']) {
$conf .= "via off\n";
}
if ($settings['disable_squidversion']) {
$conf .= "httpd_suppress_version_string on\n";
}
if (!empty($settings['uri_whitespace'])) {
$conf .= "uri_whitespace {$settings['uri_whitespace']}\n";
} else {
// only used for first run
$conf .= "uri_whitespace strip\n";
}
if (!empty($settings['dns_nameservers'])) {
$altdns = explode(";", ($settings['dns_nameservers']));
$conf .= "dns_nameservers ";
foreach ($altdns as $dnssrv) {
$conf .= $dnssrv . " ";
}
}
return $conf;
}
function squid_resync_cache() {
global $config, $g;
if (is_array($config['installedpackages']['squidcache'])) {
$settings = $config['installedpackages']['squidcache']['config'][0];
} else {
$settings = array();
}
// apply cache settings
$cachedir = ($settings['harddisk_cache_location'] ? $settings['harddisk_cache_location'] : '/var/squid/cache');
$disk_cache_size = ($settings['harddisk_cache_size'] ? $settings['harddisk_cache_size'] : 100);
$level1 = ($settings['level1_subdirs'] ? $settings['level1_subdirs'] : 16);
$memory_cache_size = ($settings['memory_cache_size'] ? $settings['memory_cache_size'] : 64);
$max_objsize = ($settings['maximum_object_size'] ? $settings['maximum_object_size'] . " MB" : "4 MB");
$min_objsize = ($settings['minimum_object_size'] ? $settings['minimum_object_size'] : 0);
$max_objsize_in_mem = ($settings['maximum_objsize_in_mem'] ? $settings['maximum_objsize_in_mem'] : 256);
$cache_policy = ($settings['cache_replacement_policy'] ? $settings['cache_replacement_policy'] : 'heap LFUDA');
$memory_policy = ($settings['memory_replacement_policy'] ? $settings['memory_replacement_policy'] : 'heap GDSF');
$offline_mode = ($settings['enable_offline'] == 'on' ? 'on' : 'off');
$conf = '';
if (!isset($settings['harddisk_cache_system'])) {
if ($g['platform'] == "nanobsd" || !is_array ($config['installedpackages']['squidcache']['config'])) {
$disk_cache_system = 'null';
} else {
$disk_cache_system = 'ufs';
}
} else {
$disk_cache_system = $settings['harddisk_cache_system'];
}
// 'null' storage type dropped. In-memory cache is always present. Remove all cache_dir options to prevent on-disk caching.
if ($disk_cache_system != "null") {
$disk_cache_opts = "cache_dir {$disk_cache_system} {$cachedir} {$disk_cache_size} {$level1} 256";
}
// check dynamic content
if (empty($settings['cache_dynamic_content'])) {
$conf .= 'acl dynamic urlpath_regex cgi-bin \?' . "\n";
$conf .= "cache deny dynamic\n";
} elseif (preg_match('/youtube/', $settings['refresh_patterns'])) {
// Broken (Bug #3847) and not working (http://wiki.squid-cache.org/ConfigExamples/DynamicContent/YouTube#Discussion)
/* $conf .= <<< EOC
# Break HTTP standard for flash videos. Keep them in cache even if asked not to.
refresh_pattern -i \.flv$ 10080 90% 999999 ignore-no-cache override-expire ignore-private
# Let the clients favorite video site through with full caching
acl youtube dstdomain .youtube.com
cache allow youtube
EOC;
*/
}
if (preg_match('/windows/', $settings['refresh_patterns'])) {
$conf .= <<< EOC
# Windows Update refresh_pattern
range_offset_limit -1
refresh_pattern -i microsoft.com/.*\.(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
refresh_pattern -i windowsupdate.com/.*\.(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
refresh_pattern -i windows.com/.*\.(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
EOC;
}
if (preg_match('/symantec/', $settings['refresh_patterns'])) {
$conf .= <<< EOC
# Symantec refresh_pattern
range_offset_limit -1
refresh_pattern liveupdate.symantecliveupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern symantecliveupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
EOC;
}
if (preg_match('/avast/', $settings['refresh_patterns'])) {
$conf .= <<< EOC
# Avast refresh_pattern
range_offset_limit -1
refresh_pattern avast.com/.*\.(vpu|cab|stamp|exe) 10080 100% 43200 reload-into-ims
EOC;
}
if (preg_match('/avira/', $settings['refresh_patterns'])) {
$conf.=<<< EOC
# Avira refresh_pattern
range_offset_limit -1
refresh_pattern personal.avira-update.com/.*\.(cab|exe|dll|msi|gz) 10080 100% 43200 reload-into-ims
EOC;
}
$refresh_conf = <<< EOC
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
EOC;
if ($settings['custom_refresh_patterns'] != "") {
$conf .= sq_text_area_decode($settings['custom_refresh_patterns']) . "\n";
}
$conf .= <<< EOD
cache_mem {$memory_cache_size} MB
maximum_object_size_in_memory {$max_objsize_in_mem} KB
memory_replacement_policy {$memory_policy}
cache_replacement_policy {$cache_policy}
minimum_object_size {$min_objsize} KB
maximum_object_size {$max_objsize}
{$disk_cache_opts}
offline_mode {$offline_mode}
EOD;
if (!empty($settings['cache_swap_low'])) {
$conf .= "cache_swap_low {$settings['cache_swap_low']}\n";
}
if (!empty($settings['cache_swap_high'])) {
$conf .= "cache_swap_high {$settings['cache_swap_high']}\n";
}
$donotcache = sq_text_area_decode($settings['donotcache']);
if (!empty($donotcache)) {
file_put_contents(SQUID_ACLDIR . '/donotcache.acl', $donotcache);
$conf .= 'acl donotcache dstdomain "' . SQUID_ACLDIR . "/donotcache.acl\"\n";
$conf .= "cache deny donotcache\n";
} elseif (file_exists(SQUID_ACLDIR . '/donotcache.acl')) {
unlink(SQUID_ACLDIR . '/donotcache.acl');
}
$conf .= "cache allow all\n";
return $conf.$refresh_conf;
}
function squid_resync_upstream() {
global $config;
if (!is_array($config['installedpackages']['squidremote']['config'])) {
$config['installedpackages']['squidremote']['config'] = array();
}
$conf = "\n#Remote proxies\n";
foreach ($config['installedpackages']['squidremote']['config'] as $settings) {
if ($settings['enable'] == 'on') {
$conf .= "cache_peer {$settings['proxyaddr']} {$settings['hierarchy']} {$settings['proxyport']} ";
if ($settings['icpport'] == '7') {
$conf .= "{$settings['icpport']} {$settings['icpoptions']} {$settings['peermethod']} {$settings['allowmiss']} ";
} else {
$conf .= "{$settings['icpport']} ";
}
// auth settings
if (!empty($settings['username']) && !empty($settings['password'])) {
$conf .= " login={$settings['username']}:{$settings['password']}";
} else {
$conf .= "{$settings['authoption']} ";
}
// other options settings
if (!empty($settings['weight'])) {
$conf .= "weight={$settings['weight']} ";
}
if (!empty($settings['basetime'])) {
$conf .= "basetime={$settings['basetime']} ";
}
if (!empty($settings['ttl'])) {
$conf .= "ttl={$settings['ttl']} ";
}
if (!empty($settings['nodelay'])) {
$conf .= "no-delay";
}
}
$conf .= "\n";
}
return $conf;
}
function squid_resync_redirector() {
global $config;
// XXX: What port provide squirm binary? It's not present
$httpav_enabled = ($config['installedpackages']['clamav']['config'][0]['scan_http'] == 'on');
$redirector = "/usr/local/bin/squirm";
if (($httpav_enabled) && is_executable($redirector)) {
$conf = "url_rewrite_program /usr/local/bin/squirm\n";
} else {
$conf = "# No redirector configured\n";
}
return $conf;
}
function squid_resync_nac() {
global $config, $valid_acls;
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
if (is_array($config['installedpackages']['squidnac'])) {
$settings = $config['installedpackages']['squidnac']['config'][0];
} else {
$settings = array();
}
$webgui_port = $config['system']['webgui']['port'];
$addtl_ports = $settings['addtl_ports'];
$addtl_sslports = $settings['addtl_sslports'];
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
$ssl_port = ($settings['ssl_proxy_port'] ? $settings['ssl_proxy_port'] : 3127);
$conf = <<< EOD
# Setup some default acls
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
# acl localhost src 127.0.0.1/32
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 $webgui_port $port $ssl_port 1025-65535 $addtl_ports
acl sslports port 443 563 $webgui_port $addtl_sslports
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
#acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS
EOD;
$allowed_subnets = preg_replace("/\s+/"," ", sq_text_area_decode($settings['allowed_subnets']));
if (!empty($allowed_subnets)) {
$conf .= "acl allowed_subnets src $allowed_subnets\n";
$valid_acls[] = 'allowed_subnets';
}
$options = array(
'unrestricted_hosts' => 'src',
'banned_hosts' => 'src',
'whitelist' => 'dstdom_regex -i',
'blacklist' => 'dstdom_regex -i',
'block_user_agent' => 'browser -i',
'block_reply_mime_type' => 'rep_mime_type -i',
);
foreach ($options as $option => $directive) {
$contents = sq_text_area_decode($settings[$option]);
if (!empty($contents)) {
file_put_contents(SQUID_ACLDIR . "/$option.acl", $contents);
$conf .= "acl $option $directive \"" . SQUID_ACLDIR . "/$option.acl\"\n";
$valid_acls[] = $option;
} elseif (file_exists(SQUID_ACLDIR . "/$option.acl")) {
unlink(SQUID_ACLDIR . "/$option.acl");
}
}
$conf .= <<< EOD
http_access allow manager localhost
EOD;
if (is_array($config['installedpackages']['squidcache'])) {
$settings_ch = $config['installedpackages']['squidcache']['config'][0];
if (!empty($settings_ch['ext_cachemanager'])) {
$extmgr = explode(";", ($settings_ch['ext_cachemanager']));
$conf .= "\n# Allow external cache managers\n";
foreach ($extmgr as $mgr) {
$conf .= "acl ext_manager src {$mgr}\n";
}
$conf .= "http_access allow manager ext_manager\n";
}
}
$conf .= <<< EOD
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports
# Always allow localhost connections
# From 3.2 further configuration cleanups have been done to make things easier and safer.
# The manager, localhost, and to_localhost ACL definitions are now built-in.
# http_access allow localhost
EOD;
return $conf;
}
function squid_resync_antivirus() {
global $config;
if (is_array($config['installedpackages']['squidantivirus']))
$antivirus_config = $config['installedpackages']['squidantivirus']['config'][0];
else
$antivirus_config = array();
if ($antivirus_config['enable'] == "on") {
switch ($antivirus_config['client_info']) {
case "both":
default:
$icap_send_client_ip = "on";
$icap_send_client_username = "on";
break;
case "ip":
$icap_send_client_ip = "on";
$icap_send_client_username = "off";
break;
case "username":
$icap_send_client_ip = "off";
$icap_send_client_username = "on";
break;
case "none":
$icap_send_client_ip = "off";
$icap_send_client_username = "off";
break;
}
$conf = <<< EOF
icap_enable on
icap_send_client_ip {$icap_send_client_ip}
icap_send_client_username {$icap_send_client_username}
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_preview_enable on
icap_preview_size 1024
icap_service service_avi_req reqmod_precache icap://[::1]:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://[::1]:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all
EOF;
// check if icap is enabled on rc.conf.local
// XXX: This whole thing sucks and should be redone to install/enable services in pfSense way
if (file_exists("/etc/rc.conf.local")) {
$rc_old_file = file("/etc/rc.conf.local");
foreach ($rc_old_file as $rc_line) {
if (preg_match("/^(c_icap_enable|clamav_clamd_enable)/", $rc_line, $matches)) {
$rc_file .= $matches[1] . '="YES"' . "\n";
${$matches[1]} = "ok";
} else {
$rc_file .= $rc_line;
}
}
}
if (!isset($c_icap_enable)) {
$rc_file .= 'c_icap_enable="YES"' . "\n";
}
if (!isset($clamav_clamd_enable)) {
$rc_file .= 'clamav_clamd_enable="YES"' . "\n";
}
file_put_contents("/etc/rc.conf.local", $rc_file, LOCK_EX);
squid_check_clamav_user('clamav');
// patch sample files to pfsense dirs
// squidclamav.conf
if (!file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample")) {
if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default")) {
$sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.default");
$clamav_m[0] = "@/var/run/clamav/clamd.ctl@";
$clamav_m[1] = "@cgi-bin/clwarn.cgi@";
$clamav_r[0] = "/var/run/clamav/clamd.sock";
$clamav_r[1] = "squid_clwarn.php";
file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample", preg_replace($clamav_m, $clamav_r, $sample_file), LOCK_EX);
}
}
// c-icap.conf
// make a backup of default c-icap.conf.sample first
// unlike with other config files, the file distributed in package is called c-icap.conf.sample, not c-icap.conf.default
if (!file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default")) {
copy(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample", SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default");
}
if (file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default")) {
$sample_file = file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.default");
if (!preg_match("/squid_clamav/", $sample_file)) {
$sample_file .= "\nService squid_clamav squidclamav.so\n";
}
$cicap_m[0] = "@Manager:Apassword\S+@";
$cicap_r[0] = "";
// XXX: Bug #4615
$logdir = ($settings['log_dir'] ? $settings['log_dir'] : '/var/squid/logs');
$cicap_m[1] = "@DebugLevel\s1@";
$cicap_r[1] = "DebugLevel 0";
$cicap_m[2] = "@AccessLog /var/log/c-icap/access.log@";
$cicap_r[2] = "AccessLog $logdir/c-icap-access.log";
$cicap_m[3] = "@ServerLog /var/log/c-icap/server.log@";
$cicap_r[3] = "ServerLog $logdir/c-icap-server.log";
file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample", preg_replace($cicap_m, $cicap_r, $sample_file), LOCK_EX);
}
// check squidclamav files until PBIs are gone (https://redmine.pfsense.org/issues/4197)
$ln_icap = array('bin/c-icap', 'bin/c-icap-client', 'c-icap-config', 'c-icap-libicapapi-config', 'c-icap-stretch', 'lib/c_icap', 'share/c_icap', 'etc/c-icap');
foreach ($ln_icap as $ln) {
if (SQUID_LOCALBASE != '/usr/local' && !file_exists("/usr/local/{$ln}") && file_exists(SQUID_LOCALBASE . "/{$ln}")) {
symlink(SQUID_LOCALBASE . "/{$ln}", "/usr/local/{$ln}");
}
}
if (SQUID_LOCALBASE != '/usr/local' && !file_exists("/usr/local/lib/libicapapi.so.3") && file_exists(SQUID_LOCALBASE . "/lib/libicapapi.so.3.0.5")) {
symlink(SQUID_LOCALBASE . "/lib/libicapapi.so.3.0.5", "/usr/local/lib/libicapapi.so.3");
}
$loadsample = 0;
if ($antivirus_config['squidclamav'] == "" && file_exists(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample")) {
$config['installedpackages']['squidantivirus']['config'][0]['squidclamav'] = base64_encode(str_replace("\r", "", file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf.sample")));
$loadsample++;
}
if ($antivirus_config['c-icap_conf'] == "" && file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample")) {
$config['installedpackages']['squidantivirus']['config'][0]['c-icap_conf'] = base64_encode(str_replace("\r", "", file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf.sample")));
$loadsample++;
}
if ($antivirus_config['c-icap_magic'] == "" && file_exists(SQUID_LOCALBASE . "/etc/c-icap/c-icap.magic.sample")) {
$config['installedpackages']['squidantivirus']['config'][0]['c-icap_magic'] = base64_encode(str_replace("\r", "", file_get_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.magic.sample")));
$loadsample++;
}
if ($loadsample > 0) {
write_config();
$antivirus_config = $config['installedpackages']['squidantivirus']['config'][0];
}
// check dirs
$dirs = array(
"/var/run/c-icap" => "clamav",
"/var/log/c-icap" => "clamav",
"/var/log/clamav" => "clamav",
"/var/run/clamav" => "clamav",
"/var/db/clamav" => "clamav"
);
foreach ($dirs as $dir_path => $dir_user) {
safe_mkdir($dir_path, 0755);
squid_chown_recursive($dir_path, $dir_user, "wheel");
}
// Check clamav database
if (count(glob("/var/db/clamav/*d")) == 0) {
log_error("Squid - Missing /var/db/clamav/*.cvd or *.cld files. Running freshclam in background.");
mwexec_bg(SQUID_BASE . "/bin/freshclam");
}
$rcd_files = scandir(SQUID_LOCALBASE."/etc/rc.d");
foreach ($rcd_files as $rcd_file) {
if (SQUID_LOCALBASE != '/usr/local' && !file_exists("/usr/local/etc/rc.d/{$rcd_file}")) {
symlink(SQUID_LOCALBASE . "/etc/rc.d/{$rcd_file}", "/usr/local/etc/rc.d/{$rcd_file}");
}
}
// write advanced icap config files
file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/squidclamav.conf", base64_decode($antivirus_config['squidclamav']), LOCK_EX);
file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.conf", base64_decode($antivirus_config['c-icap_conf']), LOCK_EX);
file_put_contents(SQUID_LOCALBASE . "/etc/c-icap/c-icap.magic", base64_decode($antivirus_config['c-icap_magic']), LOCK_EX);
// check antivirus daemons
// check icap
if (is_process_running("c-icap")) {
mwexec_bg('/bin/echo -n "reconfigure" > /var/run/c-icap/c-icap.ctl');
} else {
// check c-icap user on startup file
$c_icap_rcfile = "/usr/local/etc/rc.d/c-icap";
if (file_exists($c_icap_rcfile)) {
$sample_file = file_get_contents($c_icap_rcfile);
$cicapm[0] = "@c_icap_user=.*}@";
$cicapr[0] = 'c_icap_user="clamav"}';
$cicapm[1] = "@/usr/local@";
$cicapr[1] = SQUID_LOCALBASE;
file_put_contents($c_icap_rcfile, preg_replace($cicapm, $cicapr, $sample_file), LOCK_EX);
}
mwexec_bg("/usr/local/etc/rc.d/c-icap start");
}
// check clamav/freshclam
$rc_files = array("clamav-freshclam", "clamav-clamd");
$clamm[0] = "@/usr/local/(bin|sbin)@";
$clamm[1] = "@/local/(bin|sbin)@";
$clamm[2] = "@/usr/local/etc@";
$clamm[3] = "@enable:=NO@";
$clamr[0] = SQUID_BASE . "/bin";
$clamr[1] = "/bin";
$clamr[2] = SQUID_LOCALBASE . "/etc";
$clamr[3] = "enable:=YES";
foreach ($rc_files as $rc_file) {
$clamav_rcfile = "/usr/local/etc/rc.d/{$rc_file}";
if (file_exists($clamav_rcfile)) {
$sample_file = file_get_contents($clamav_rcfile);
file_put_contents($clamav_rcfile, preg_replace($clamm, $clamr, $sample_file), LOCK_EX);
}
}
if (is_process_running("clamd")) {
mwexec_bg("/usr/local/etc/rc.d/clamav-clamd reload");
} else {
mwexec_bg("/usr/local/etc/rc.d/clamav-clamd start");
}
}
return $conf;
}
function squid_resync_traffic() {
global $config, $valid_acls;
if (!is_array($valid_acls)) {
return;
}
if (is_array($config['installedpackages']['squidtraffic'])) {
$settings = $config['installedpackages']['squidtraffic']['config'][0];
} else {
$settings = array();
}
$conf = '';
if (!empty($settings['quick_abort_min']) || ($settings['quick_abort_min']) == "0") {
$conf .= "quick_abort_min {$settings['quick_abort_min']} KB\n";
}
if (!empty($settings['quick_abort_max']) || ($settings['quick_abort_max']) == "0") {
$conf .= "quick_abort_max {$settings['quick_abort_max']} KB\n";
}
if (!empty($settings['quick_abort_pct'])) {
$conf .= "quick_abort_pct {$settings['quick_abort_pct']}\n";
}
$up_limit = ($settings['max_upload_size'] ? $settings['max_upload_size'] : 0);
$down_limit = ($settings['max_download_size'] ? $settings['max_download_size'] : 0);
$conf .= "request_body_max_size $up_limit KB\n";
if ($down_limit != 0) {
$conf .= 'reply_body_max_size ' . $down_limit . " KB allsrc \n";
}
// Only apply throttling past 10MB
// XXX: Should this really be hardcoded?
$threshold = 10 * 1024 * 1024;
$overall = $settings['overall_throttling'];
if (!isset($overall) || ($overall == 0)) {
$overall = -1;
} else {
$overall *= 1024;
}
$perhost = $settings['perhost_throttling'];
if (!isset($perhost) || ($perhost == 0)) {
$perhost = -1;
} else {
$perhost *= 1024;
}
$conf .= <<< EOD
delay_pools 1
delay_class 1 2
delay_parameters 1 $overall/$overall $perhost/$perhost
delay_initial_bucket_level 100
EOD;
if (!empty($settings['unrestricted_hosts'])) {
foreach (array('unrestricted_hosts') as $item) {
if (in_array($item, $valid_acls)) {
$conf .= "# Do not throttle unrestricted hosts\n";
$conf .= "delay_access 1 deny $item\n";
}
}
}
if ($settings['throttle_specific'] == 'on') {
$exts = array();
$binaries = 'bin,cab,sea,ar,arj,tar,tgz,gz,tbz,bz2,zip,7z,exe,com';
$cdimages = 'iso,bin,mds,nrg,gho,bwt,b5t,pqi';
$multimedia = 'aiff?,asf,avi,divx,mov,mp3,mp4,wmv,mpe?g,qt,ra?m';
foreach (array('throttle_binaries' => $binaries, 'throttle_cdimages' => $cdimages, 'throttle_multimedia' => $multimedia) as $field => $set) {
if ($settings[$field] == 'on') {
$exts = array_merge($exts, explode(",", $set));
}
}
foreach (explode(",", $settings['throttle_others']) as $ext) {
if (!empty($ext)) {
$exts[] = $ext;
}
}
$contents = '';
foreach ($exts as $ext) {
$contents .= "\.$ext\$\n";
}
file_put_contents(SQUID_ACLDIR . '/throttle_exts.acl', $contents);
$conf .= "# Throttle extensions matched in the url\n";
$conf .= "acl throttle_exts urlpath_regex -i \"" . SQUID_ACLDIR . "/throttle_exts.acl\"\n";
$conf .= "delay_access 1 allow throttle_exts\n";
$conf .= "delay_access 1 deny allsrc\n";
} else {
$conf .= "delay_access 1 allow allsrc\n";
}
return $conf;
}
function squid_get_server_certs() {
global $config;
$cert_arr = array();
$cert_arr[] = array('refid' => 'none', 'descr' => 'none');
foreach ($config['cert'] as $cert) {
$cert_arr[] = array('refid' => $cert['refid'], 'descr' => $cert['descr']);
}
return $cert_arr;
}
// squid reverse
include('/usr/local/pkg/squid_reverse.inc');
function squid_resync_auth() {
global $config, $valid_acls;
$write_config = 0;
if (!is_array($config['installedpackages']['squidauth']['config'])) {
$config['installedpackages']['squidauth']['config'][] = array('auth_method'=> "none");
$write_config++;
}
$settings = $config['installedpackages']['squidauth']['config'][0];
if (is_array($config['installedpackages']['squidnac']['config'])) {
$settingsnac = $config['installedpackages']['squidnac']['config'][0];
} else {
$settingsnac = array();
}
if (is_array($config['installedpackages']['squid']['config'])) {
$settingsconfig = $config['installedpackages']['squid']['config'][0];
} else {
$settingsconfig = array();
}
if ($write_config > 0) {
write_config();
}
$conf = '';
// SSL interception acl options part 1
if ($settingsconfig['ssl_proxy'] == "on" && ! empty($settingsnac['whitelist'])) {
$conf .= "always_direct allow whitelist\n";
$conf .= "ssl_bump none whitelist\n";
}
// Package integration
if (!empty($settingsconfig['custom_options'])) {
$co_preg[0] = '/;/';
$co_rep[0] = "\n";
$co_preg[1] = "/redirect_program/";
$co_rep[1] = "url_rewrite_program";
$co_preg[2] = "/redirector_bypass/";
$co_rep[2] = "url_rewrite_bypass";
$conf .= "# Package Integration\n" . preg_replace($co_preg, $co_rep, $settingsconfig['custom_options']) . "\n\n";
}
// Custom User Options before authentication acls
$conf .= "# Custom options before auth\n" . sq_text_area_decode($settingsconfig['custom_options_squid3']) . "\n\n";
// Deny the banned guys before allowing the good guys
if (!empty($settingsnac['banned_hosts'])) {
if (squid_is_valid_acl('banned_hosts')) {
$conf .= "# These hosts are banned\n";
$conf .= "http_access deny banned_hosts\n";
}
}
if (!empty($settingsnac['banned_macs'])) {
if (squid_is_valid_acl('banned_macs')) {
$conf .= "# These macs are banned\n";
$conf .= "http_access deny banned_macs\n";
}
}
// Unrestricted hosts take precedence over blacklist
if (!empty($settingsnac['unrestricted_hosts'])) {
if (squid_is_valid_acl('unrestricted_hosts') && $settings['unrestricted_auth'] != "on") {
$conf .= "# These hosts do not have any restrictions\n";
$conf .= "http_access allow unrestricted_hosts\n";
}
}
if (!empty($settingsnac['unrestricted_macs'])) {
if (squid_is_valid_acl('unrestricted_macs')) {
$conf .= "# These hosts do not have any restrictions\n";
$conf .= "http_access allow unrestricted_macs\n";
}
}
// Whitelist and blacklist also take precedence over other allow rules
if (!empty($settingsnac['whitelist'])) {
if (squid_is_valid_acl('whitelist')) {
$conf .= "# Always allow access to whitelist domains\n";
$conf .= "http_access allow whitelist\n";
}
}
if (!empty($settingsnac['blacklist'])) {
if (squid_is_valid_acl('blacklist')) {
$conf .= "# Block access to blacklist domains\n";
$conf .= "http_access deny blacklist\n";
}
}
if (!empty($settingsnac['block_user_agent'])) {
if (squid_is_valid_acl('block_user_agent')) {
$conf .= "# Block access with user agents and browsers\n";
$conf .= "http_access deny block_user_agent\n";
}
}
if (!empty($settingsnac['block_reply_mime_type'])) {
if (squid_is_valid_acl('block_reply_mime_type')) {
$conf .= "# Block access with mime type in the reply\n";
$conf .= "http_reply_access deny block_reply_mime_type\n";
}
}
// Include squidguard denied acl log in squid
if ($settingsconfig['log_sqd']) {
$conf .= "acl sglog url_regex -i sgr=ACCESSDENIED\n";
}
$transparent_proxy = ($settingsconfig['transparent_proxy'] == 'on');
if ($transparent_proxy) {
if (preg_match ("/(none|cp)/", $settings['auth_method'])) {
$auth_method = $settings['auth_method'];
} else {
$auth_method = "none";
}
} else {
$auth_method = $settings['auth_method'];
}
// Allow the remaining ACLs if no authentication is set
if ($auth_method == 'none' || $auth_method == 'cp') {
// Include squidguard denied acl log in squid
if ($settingsconfig['log_sqd']) {
$conf .= "http_access deny sglog\n";
}
}
if ($auth_method == 'none') {
// SSL interception acl options part 2 without authentication
if ($settingsconfig['ssl_proxy'] == "on") {
$conf .= "always_direct allow all\n";
$conf .= "ssl_bump server-first all\n";
}
$conf .= "# Setup allowed acls\n";
$allowed = array('allowed_subnets');
if ($settingsconfig['allow_interface'] == 'on') {
$conf .= "# Allow local network(s) on interface(s)\n";
$allowed[] = "localnet";
}
$allowed = array_filter($allowed, 'squid_is_valid_acl');
foreach ($allowed as $acl) {
$conf .= "http_access allow $acl\n";
}
} else {
$noauth = implode(' ', explode("\n", base64_decode($settings['no_auth_hosts'])));
if (!empty($noauth)) {
$conf .= "acl noauth src $noauth\n";
$valid_acls[] = 'noauth';
}
// Set up the external authentication programs
$auth_ttl = ($settings['auth_ttl'] ? $settings['auth_ttl'] : 5);
$processes = ($settings['auth_processes'] ? $settings['auth_processes'] : 5);
$prompt = ($settings['auth_prompt'] ? $settings['auth_prompt'] : 'Please enter your credentials to access the proxy');
switch ($auth_method) {
case 'local':
$conf .= 'auth_param basic program ' . SQUID_LOCALBASE . '/libexec/squid/basic_ncsa_auth ' . SQUID_PASSWD . "\n";
break;
case 'ldap':
$port = (isset($settings['auth_server_port']) ? ":{$settings['auth_server_port']}" : '');
$password = (isset($settings['ldap_pass']) ? "-w {$settings['ldap_pass']}" : '');
$conf .= "auth_param basic program " . SQUID_LOCALBASE . "/libexec/squid/basic_ldap_auth -v {$settings['ldap_version']} -b {$settings['ldap_basedomain']} -D {$settings['ldap_user']} $password -f \"{$settings['ldap_filter']}\" -u {$settings['ldap_userattribute']} -P {$settings['auth_server']}$port\n";
break;
case 'radius':
$port = (isset($settings['auth_server_port']) ? "-p {$settings['auth_server_port']}" : '');
$conf .= "auth_param basic program ". SQUID_LOCALBASE . "/libexec/squid/basic_radius_auth -w {$settings['radius_secret']} -h {$settings['auth_server']} $port\n";
break;
case 'cp':
$conf .= "external_acl_type check_cp children-startup={$processes} ttl={$auth_ttl} %SRC " . SQUID_BASE . "/bin/check_ip.php\n";
$conf .= "acl password external check_cp\n";
break;
case 'msnt':
$conf .= "auth_param basic program " . SQUID_LOCALBASE . "/libexec/squid/basic_msnt_auth\n";
squid_resync_msnt();
break;
}
if ($auth_method != 'cp') {
$conf .= <<< EOD
auth_param basic children $processes
auth_param basic realm $prompt
auth_param basic credentialsttl $auth_ttl minutes
acl password proxy_auth REQUIRED
EOD;
}
// Custom User Options after authentication definition
$conf .= "# Custom options after auth\n" . sq_text_area_decode($settingsconfig['custom_options2_squid3']) . "\n\n";
// SSL interception acl options part 2
if ($settingsconfig['ssl_proxy'] == "on") {
$conf .= "always_direct allow all\n";
$conf .= "ssl_bump server-first all\n";
}
// Onto the ACLs
$password = array('localnet', 'allowed_subnets');
$passwordless = array('unrestricted_hosts');
if ($settings['unrestricted_auth'] == 'on') {
// Even the unrestricted hosts should authenticate
$password = array_merge($password, $passwordless);
$passwordless = array();
}
$passwordless[] = 'noauth';
$password = array_filter($password, 'squid_is_valid_acl');
$passwordless = array_filter($passwordless, 'squid_is_valid_acl');
// Allow the ACLs that don't need to authenticate
foreach ($passwordless as $acl) {
$conf .= "http_access allow $acl\n";
}
// Include squidguard denied acl log in squid
if ($settingsconfig['log_sqd']) {
$conf .= "http_access deny password sglog\n";
}
// Allow the other ACLs as long as they authenticate
foreach ($password as $acl) {
$conf .= "http_access allow password $acl\n";
}
}
$conf .= "# Default block all to be sure\n";
$conf .= "http_access deny allsrc\n";
return $conf;
}
function squid_resync_users() {
global $config;
$users = $config['installedpackages']['squidusers']['config'];
$contents = '';
if (is_array($users)) {
foreach ($users as $user) {
$contents .= $user['username'] . ':' . crypt($user['password'], base64_encode($user['password'])) . "\n";
}
}
file_put_contents(SQUID_PASSWD, $contents);
chown(SQUID_PASSWD, SQUID_UID);
chmod(SQUID_PASSWD, 0600);
}
function squid_resync_msnt() {
global $config;
if (is_array($config['installedpackages']['squidauth'])) {
$settings = $config['installedpackages']['squidauth']['config'][0];
} else {
$settings = array();
}
$pdcserver = $settings['auth_server'];
$bdcserver = str_replace(',', ' ', $settings['msnt_secondary']);
$ntdomain = $settings['auth_ntdomain'];
file_put_contents(SQUID_CONFBASE . "/msntauth.conf", "server {$pdcserver} {$bdcserver} {$ntdomain}");
chown(SQUID_CONFBASE . "/msntauth.conf", SQUID_UID);
chmod(SQUID_CONFBASE . "/msntauth.conf", 0600);
}
function squid_resync($via_rpc = "no") {
global $config;
// detect boot process
if (is_array($_POST)) {
if (!platform_booting()) {
unset($boot_process);
} else {
$boot_process = "on";
}
}
log_error("[Squid] - Squid_resync function call pr:" . is_process_running('squid') . " bp:" . isset($boot_process) . " rpc:" . $via_rpc);
if (is_process_running('squid') && isset($boot_process) && $via_rpc == "no") {
return;
}
conf_mount_rw();
foreach (array(SQUID_CONFBASE, SQUID_ACLDIR, SQUID_SSL_DB) as $dir) {
safe_mkdir($dir, 0755);
squid_chown_recursive($dir, SQUID_UID, SQUID_GID);
}
$conf = squid_resync_general() . "\n";
$conf .= squid_resync_cache() . "\n";
$conf .= squid_resync_redirector() . "\n";
$conf .= squid_resync_upstream() . "\n";
$conf .= squid_resync_nac() . "\n";
$conf .= squid_resync_traffic() . "\n";
$conf .= squid_resync_reverse() . "\n";
$conf .= squid_resync_auth() . "\n";
$conf .= squid_resync_antivirus();
squid_resync_users();
squid_write_rcfile();
if (!isset($boot_process) || $via_rpc == "yes") {
squid_sync_on_changes();
}
// write config file
file_put_contents(SQUID_CONFFILE, $conf);
/* make sure pinger is executable and suid root */
// XXX: Bug #5114
if (file_exists(SQUID_LOCALBASE . "/libexec/squid/pinger")) {
chgrp(SQUID_LOCALBASE . "/libexec/squid/pinger", SQUID_GID);
}
// check cache dir and create if necessary
squid_dash_z();
// restart Squid if enabled and reconfigure filter
squid_restart_services();
filter_configure();
conf_mount_ro();
}
function squid_stop_monitor() {
/* kill any running proxy alarm scripts */
log_error("Stopping any running proxy monitors");
if (exec("/bin/ps auxw | /usr/bin/grep '[s]qpmon'")) {
mwexec("/usr/local/etc/rc.d/sqp_monitor.sh stop");
}
sleep(1);
}
function squid_start_monitor() {
if (!exec("/bin/ps auxw | /usr/bin/grep '[s]qpmon'")) {
log_error("Starting a proxy monitor script");
mwexec_bg("/usr/local/etc/rc.d/sqp_monitor.sh start");
}
sleep(1);
}
function squid_restart_services() {
// reconfigure and (re)start service as needed if enabled, otherwise stop them
// do not (re)start squid services on boot
if (platform_booting()) {
return;
}
$squid_enabled = false;
if (is_array($config['installedpackages']['squid']['config'])) {
// check if Squid is enabled
if ($config['installedpackages']['squid']['config'][0]['active_interface'] != "") {
$squid_enabled = true;
}
} elseif (is_array($config['installedpackages']['squidreversegeneral']['config'])) {
// check if squidreverse is enabled
if ($config['installedpackages']['squidreversegeneral']['config'][0]['reverse_interface'] != "") {
$squid_enabled = true;
}
}
if ($squid_enabled) {
/* kill any running proxy alarm scripts */
squid_stop_monitor();
if (!is_service_running('squid')) {
log_error("Starting Squid");
mwexec(SQUID_BASE . "/sbin/squid -f " . SQUID_CONFFILE);
} else {
log_error("Reloading Squid for configuration sync");
mwexec(SQUID_BASE . "/sbin/squid -k reconfigure -f " . SQUID_CONFFILE);
}
// sleep for a couple seconds to give squid a chance to fire up fully.
for ($i = 0; $i < 10; $i++) {
if (!is_service_running('squid')) {
sleep(1);
}
}
/* restart proxy alarm scripts */
squid_start_monitor();
} else {
/* Squid is disabled - kill any running proxy alarm scripts and stop Squid services */
squid_stop_monitor();
if (is_service_running('squid')) {
log_error("Stopping Squid");
stop_service("squid");
}
}
}
function squid_print_javascript_auth() {
global $config;
$transparent_proxy = ($config['installedpackages']['squid']['config'][0]['transparent_proxy'] == 'on');
// No authentication for transparent proxy
if ($transparent_proxy and preg_match("/(local|ldap|radius|msnt|ntlm)/",$config['installedpackages']['squidauth']['config'][0]['auth_method'])) {
$javascript = <<< EOD
EOD;
} else {
$javascript = <<< EOD
EOD;
}
print($javascript);
}
function squid_print_javascript_auth2() {
print("\n");
}
function squid_generate_rules($type) {
global $config, $pfs_version;
$squid_conf = $config['installedpackages']['squid']['config'][0];
//check captive portal option
$cp_file = '/etc/inc/captiveportal.inc';
$port = ($settings['proxy_port'] ? $settings['proxy_port'] : 3128);
$cp_inc = file($cp_file);
$new_cp_inc = "";
$found_rule=0;
foreach ($cp_inc as $line) {
$new_line = $line;
//remove applied squid patch
if (preg_match('/skipto 65314 ip/', $line)) {
$found_rule++;
$new_line = "";
}
if (preg_match('/255.255.255.255/', $line) && $squid_conf['patch_cp']) {
$found_rule++;
$new_line .= "\t" . '$cprules .= "add {$rulenum} skipto 65314 ip from any to {$ips} ' . $port . ' in\n";' . "\n";
$new_line .= "\t" . '$cprules .= "add {$rulenum} skipto 65314 ip from {$ips} ' . $port . ' to any out\n";' . "\n";
}
$new_cp_inc .= $new_line;
}
if (!file_exists('/root/' . $pfs_version . '.captiveportal.inc.backup')) {
copy($cp_file, '/root/' . $pfs_version . '.captiveportal.inc.backup');
}
if ($found_rule > 0) {
file_put_contents($cp_file, $new_cp_inc, LOCK_EX);
}
// normal squid rule check
if (($squid_conf['transparent_proxy'] != 'on') || ($squid_conf['allow_interface'] != 'on')) {
return;
}
if (!is_service_running('squid')) {
log_error("Squid is installed but not started. Not installing \"{$type}\" rules.");
return;
}
// Read assigned interfaces
$proxy_ifaces = explode(",", $squid_conf['active_interface']);
$proxy_ifaces = array_map('convert_friendly_interface_to_real_interface_name', $proxy_ifaces);
if ($squid_conf['transparent_proxy'] == "on") {
$transparent_ifaces = explode(",", $squid_conf['transparent_active_interface']);
$transparent_ifaces = array_map('convert_friendly_interface_to_real_interface_name', $transparent_ifaces);
} else {
$transparent_ifaces=array();
}
if ($squid_conf['ssl_proxy'] == "on") {
$ssl_ifaces = explode(",", $squid_conf['ssl_active_interface']);
$ssl_ifaces = array_map('convert_friendly_interface_to_real_interface_name', $ssl_ifaces);
} else {
$ssl_ifaces=array();
}
$port = ($squid_conf['proxy_port'] ? $squid_conf['proxy_port'] : 3128);
$ssl_port = ($squid_conf['ssl_proxy_port'] ? $squid_conf['ssl_proxy_port'] : 3127);
$fw_aliases = filter_generate_aliases();
if (strstr($fw_aliases, "pptp =")) {
$PPTP_ALIAS = "\$pptp";
} else {
$PPTP_ALIAS = "\$PPTP";
}
if (strstr($fw_aliases, "PPPoE =")) {
$PPPOE_ALIAS = "\$PPPoE";
} else {
$PPPOE_ALIAS = "\$pppoe";
}
// define ports based on transparent options and ssl filtering
$pf_rule_port = ($squid_conf['ssl_proxy'] == "on" ? "{80,443}" : "80");
switch($type) {
case 'nat':
$rules .= "\n# Setup Squid proxy redirect\n";
if ($squid_conf['private_subnet_proxy_off'] == 'on') {
foreach ($transparent_ifaces as $iface) {
$pf_transparent_rule_port = (in_array($iface, $ssl_ifaces) ? "{80,443}" : "80");
$rules .= "no rdr on $iface proto tcp from any to { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } port {$pf_transparent_rule_port}\n";
}
/* Handle PPPOE case */
if (($config['pppoe']['mode'] == "server" && $config['pppoe']['localip']) || (function_exists("is_pppoe_server_enabled") && is_pppoe_server_enabled())) {
$rules .= "no rdr on $PPPOE_ALIAS proto tcp from any to { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } port {$pf_rule_port}\n";
}
/* Handle PPTP case */
if ($config['pptpd']['mode'] == "server" && $config['pptpd']['localip']) {
$rules .= "no rdr on $PPTP_ALIAS proto tcp from any to { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } port {$pf_rule_port}\n";
}
}
if (!empty($squid_conf['defined_ip_proxy_off'])) {
$defined_ip_proxy_off = explode(";", $squid_conf['defined_ip_proxy_off']);
$exempt_ip = "";
foreach ($defined_ip_proxy_off as $ip_proxy_off) {
if (!empty($ip_proxy_off)) {
$ip_proxy_off = trim($ip_proxy_off);
if (is_alias($ip_proxy_off)) {
$ip_proxy_off = '$' . $ip_proxy_off;
}
$exempt_ip .= ", $ip_proxy_off";
}
}
$exempt_ip = substr($exempt_ip, 2);
foreach ($transparent_ifaces as $iface) {
$pf_transparent_rule_port = (in_array($iface, $ssl_ifaces) ? "{80,443}" : "80");
$rules .= "no rdr on $iface proto tcp from { $exempt_ip } to any port {$pf_transparent_rule_port}\n";
}
/* Handle PPPOE case */
if (($config['pppoe']['mode'] == "server" && $config['pppoe']['localip']) || (function_exists("is_pppoe_server_enabled") && is_pppoe_server_enabled())) {
$rules .= "no rdr on $PPPOE_ALIAS proto tcp from { $exempt_ip } to any port {$pf_rule_port}\n";
}
/* Handle PPTP case */
if ($config['pptpd']['mode'] == "server" && $config['pptpd']['localip']) {
$rules .= "no rdr on $PPTP_ALIAS proto tcp from { $exempt_ip } to any port {$pf_rule_port}\n";
}
}
if (!empty($squid_conf['defined_ip_proxy_off_dest'])) {
$defined_ip_proxy_off_dest = explode(";", $squid_conf['defined_ip_proxy_off_dest']);
$exempt_dest = "";
foreach ($defined_ip_proxy_off_dest as $ip_proxy_off_dest) {
if (!empty($ip_proxy_off_dest)) {
$ip_proxy_off_dest = trim($ip_proxy_off_dest);
if (is_alias($ip_proxy_off_dest)) {
$ip_proxy_off_dest = '$' . $ip_proxy_off_dest;
}
$exempt_dest .= ", $ip_proxy_off_dest";
}
}
$exempt_dest = substr($exempt_dest, 2);
foreach ($transparent_ifaces as $iface) {
$pf_transparent_rule_port = (in_array($iface, $ssl_ifaces) ? "{80,443}" : "80");
$rules .= "no rdr on $iface proto tcp from any to { $exempt_dest } port {$pf_transparent_rule_port}\n";
}
/* Handle PPPOE case */
if (($config['pppoe']['mode'] == "server" && $config['pppoe']['localip']) || (function_exists("is_pppoe_server_enabled") && is_pppoe_server_enabled())) {
$rules .= "no rdr on $PPPOE_ALIAS proto tcp from any to { $exempt_dest } port {$pf_rule_port}\n";
}
/* Handle PPTP case */
if ($config['pptpd']['mode'] == "server" && $config['pptpd']['localip']) {
$rules .= "no rdr on $PPTP_ALIAS proto tcp from any to { $exempt_dest } port {$pf_rule_port}\n";
}
}
foreach ($transparent_ifaces as $t_iface) {
$pf_transparent_rule_port = (in_array($t_iface, $ssl_ifaces) ? "{80,443}" : "80");
$rules .= "rdr on $t_iface proto tcp from any to !($t_iface) port 80 -> 127.0.0.1 port {$port}\n";
if (in_array($t_iface, $ssl_ifaces)) {
$rules .= "rdr on $t_iface proto tcp from any to !($t_iface) port 443 -> 127.0.0.1 port {$ssl_port}\n";
}
}
/* Handle PPPOE case */
if (($config['pppoe']['mode'] == "server" && $config['pppoe']['localip']) || (function_exists("is_pppoe_server_enabled") && is_pppoe_server_enabled())) {
$rules .= "rdr on $PPPOE_ALIAS proto tcp from any to !127.0.0.1 port {$pf_rule_port} -> 127.0.0.1 port {$port}\n";
}
/* Handle PPTP case */
if ($config['pptpd']['mode'] == "server" && $config['pptpd']['localip']) {
$rules .= "rdr on $PPTP_ALIAS proto tcp from any to !127.0.0.1 port {$pf_rule_port} -> 127.0.0.1 port {$port}\n";
}
$rules .= "\n";
break;
case 'filter':
case 'rule':
foreach ($transparent_ifaces as $iface) {
$pf_transparent_rule_port = (in_array($iface, $ssl_ifaces) ? "{80,443,{$port},{$ssl_port}}" : "{80,{$port}}");
$rules .= "# Setup squid pass rules for proxy\n";
$rules .= "pass in quick on $iface proto tcp from any to !($iface) port {$pf_transparent_rule_port} flags S/SA keep state\n";
// $rules .= "pass in quick on $iface proto tcp from any to !($iface) port {$port} flags S/SA keep state\n";
$rules .= "\n";
}
if ($config['pppoe']['mode'] == "server" && $config['pppoe']['localip']) {
$rules .= "pass in quick on $PPPOE_ALIAS proto tcp from any to !127.0.0.1 port {$port} flags S/SA keep state\n";
}
if ($config['pptpd']['mode'] == "server" && $config['pptpd']['localip']) {
$rules .= "pass in quick on $PPTP_ALIAS proto tcp from any to !127.0.0.1 port {$port} flags S/SA keep state\n";
}
break;
default:
break;
}
return $rules;
}
function squid_write_rcfile() {
/* Declare a variable for the SQUID_CONFFILE constant. */
/* Then the variable can be referenced easily in the heredoc text that generates the rc file. */
$squid_conffile_var = SQUID_CONFFILE;
$squid_base = SQUID_BASE;
$rc = array();
$rc['file'] = 'squid.sh';
$rc['start'] = <<< EOD
#/sbin/sysctl net.inet.ip.portrange.reservedhigh=0
if [ -z "`/bin/ps auxw | /usr/bin/grep "[s]quid " | /usr/bin/awk '{print $2}'`" ]; then
{$squid_base}/sbin/squid -f {$squid_conffile_var}
fi
EOD;
$rc['stop'] = <<< EOD
{$squid_base}/sbin/squid -k shutdown -f {$squid_conffile_var}
# Just to be sure...
sleep 5
if [ -x /usr/bin/ipcs ]; then
# http://man.chinaunix.net/newsoft/squid/Squid_FAQ/FAQ-22.html#ss22.8
/usr/bin/ipcs | /usr/bin/grep '^[mq]' | /usr/bin/awk '{printf "ipcrm -%s %s\\n", $1, $2}' | /bin/sh
fi
/usr/bin/killall -9 squid 2>/dev/null
/usr/bin/killall pinger 2>/dev/null
EOD;
$rc['restart'] = <<< EOD
if [ -z "`ps auxw | /usr/bin/grep "[s]quid " | /usr/bin/awk '{print $2}'`" ]; then
{$squid_base}/sbin/squid -f {$squid_conffile_var}
else
{$squid_base}/sbin/squid -k reconfigure -f {$squid_conffile_var}
fi
EOD;
conf_mount_rw();
write_rcfile($rc);
conf_mount_ro();
}
/* Uses XMLRPC to synchronize the changes to a remote node */
function squid_sync_on_changes() {
global $config, $g;
if (is_array($config['installedpackages']['squidsync']['config'])) {
$squid_sync = $config['installedpackages']['squidsync']['config'][0];
$synconchanges = $squid_sync['synconchanges'];
$synctimeout = $squid_sync['synctimeout'];
switch ($synconchanges) {
case "manual":
if (is_array($squid_sync['row'])) {
$rs = $squid_sync['row'];
} else {
log_error("[squid] XMLRPC sync is enabled but there is no hosts to push on Squid config.");
return;
}
break;
case "auto":
if (is_array($config['installedpackages']['carpsettings']) && is_array($config['installedpackages']['carpsettings']['config'])) {
$system_carp = $config['installedpackages']['carpsettings']['config'][0];
$rs[0]['ipaddress'] = $system_carp['synchronizetoip'];
$rs[0]['username'] = $system_carp['username'];
$rs[0]['password'] = $system_carp['password'];
} else {
log_error("[squid] XMLRPC sync is enabled but there is no system backup hosts to push Squid config.");
return;
}
break;
default:
return;
break;
}
if (is_array($rs)) {
log_error("[squid] XMLRPC sync is starting.");
foreach ($rs as $sh) {
$sync_to_ip = $sh['ipaddress'];
$password = $sh['password'];
if ($sh['username']) {
$username = $sh['username'];
} else {
$username = 'admin';
}
if ($password && $sync_to_ip) {
squid_do_xmlrpc_sync($sync_to_ip, $username, $password, $synctimeout);
}
}
log_error("[squid] XMLRPC sync is ending.");
}
}
}
/* Do the actual XMLRPC sync */
function squid_do_xmlrpc_sync($sync_to_ip, $username, $password, $synctimeout) {
global $config, $g;
if (!$username) {
return;
}
if (!$password) {
return;
}
if (!$sync_to_ip) {
return;
}
if (!$synctimeout) {
$synctimeout = 250;
}
$xmlrpc_sync_neighbor = $sync_to_ip;
if ($config['system']['webgui']['protocol'] != "") {
$synchronizetoip = $config['system']['webgui']['protocol'];
$synchronizetoip .= "://";
}
$port = $config['system']['webgui']['port'];
/* If port is empty let's rely on the protocol selection */
if ($port == "") {
if ($config['system']['webgui']['protocol'] == "http")
$port = "80";
else
$port = "443";
}
$synchronizetoip .= $sync_to_ip;
/* XML will hold the sections to sync */
$xml = array();
$xml['squid'] = $config['installedpackages']['squid'];
$xml['squidupstream'] = $config['installedpackages']['squidupstream'];
$xml['squidcache'] = $config['installedpackages']['squidcache'];
$xml['squidantivirus'] = $config['installedpackages']['squidantivirus'];
$xml['squidnac'] = $config['installedpackages']['squidnac'];
$xml['squidtraffic'] = $config['installedpackages']['squidtraffic'];
$xml['squidreversegeneral'] = $config['installedpackages']['squidreversegeneral'];
$xml['squidreversepeer'] = $config['installedpackages']['squidreversepeer'];
$xml['squidreverseuri'] = $config['installedpackages']['squidreverseuri'];
$xml['squidauth'] = $config['installedpackages']['squidauth'];
$xml['squidusers'] = $config['installedpackages']['squidusers'];
/* Assemble XMLRPC payload */
$params = array(
XML_RPC_encode($password),
XML_RPC_encode($xml)
);
/* Set a few variables needed for sync */
$url = $synchronizetoip;
log_error("[squid] Beginning Squid XMLRPC sync to {$url}:{$port}.");
$method = 'pfsense.merge_installedpackages_section_xmlrpc';
$msg = new XML_RPC_Message($method, $params);
$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
$cli->setCredentials($username, $password);
if ($g['debug']) {
$cli->setDebug(1);
}
/* Send our XMLRPC message and timeout after defined sync timeout value*/
$resp = $cli->send($msg, $synctimeout);
if (!$resp) {
$error = "A communication error occurred while attempting Squid XMLRPC sync with {$url}:{$port}.";
log_error($error);
file_notice("sync_settings", $error, "Squid Settings Sync", "");
} elseif ($resp->faultCode()) {
$cli->setDebug(1);
$resp = $cli->send($msg, $synctimeout);
$error = "An error code was received while attempting Squid XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
log_error($error);
file_notice("sync_settings", $error, "Squid Settings Sync", "");
} else {
log_error("[squid] XMLRPC sync successfully completed with {$url}:{$port}.");
}
/* Tell Squid to reload our settings on the destination sync host. */
$method = 'pfsense.exec_php';
$execcmd = "require_once('/usr/local/pkg/squid.inc');\n";
$execcmd .= "squid_resync('yes');";
/* Assemble XMLRPC payload */
$params = array(
XML_RPC_encode($password),
XML_RPC_encode($execcmd)
);
log_error("[squid] XMLRPC reload data {$url}:{$port}.");
$msg = new XML_RPC_Message($method, $params);
$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
$cli->setCredentials($username, $password);
$resp = $cli->send($msg, $synctimeout);
if (!$resp) {
$error = "A communication error occurred while attempting Squid XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
log_error($error);
file_notice("sync_settings", $error, "Squid Settings Sync", "");
} elseif ($resp->faultCode()) {
$cli->setDebug(1);
$resp = $cli->send($msg, $synctimeout);
$error = "[Squid] An error code was received while attempting Squid XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
log_error($error);
file_notice("sync_settings", $error, "Squid Settings Sync", "");
} else {
log_error("Squid XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php).");
}
}
?>