###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2009 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2007-2012 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
my %checked=();
my %selected=();
-my @throttle_limits=(64,128,256,384,512,1024,2048,3072,5120);
-my $throttle_binary="bin|cab|exe|gz|rar|sea|tar|tgz|zip";
-my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi";
-my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|qt|ra?m";
+my @throttle_limits=(64,128,256,384,512,768,1024,1280,1536,1792,2048,2560,3072,3584,4096,5120,6144,7168,8192,10240,12288,16384,20480);
+my $throttle_binary="7z|arj|bin|bz2|cab|exe|gz|lzh|rar|sea|tar|tgz|xz|zip";
+my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi|vmdk";
+my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|ogg|qt|ra?m|ts|vob";
my $def_ports_safe="80 # http\n21 # ftp\n443 # https\n563 # snews\n70 # gopher\n210 # wais\n1025-65535 # unregistered ports\n280 # http-mgmt\n488 # gss-http\n591 # filemaker\n777 # multiling http\n800 # Squids port (for icons)\n";
my $def_ports_ssl="443 # https\n563 # snews\n";
my $cachemem=0;
my $proxy1='';
my $proxy2='';
-my $replybodymaxsize=0;
my $browser_regexp='';
my $needhup = 0;
my $errormessage='';
&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
+my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
+my $blue_cidr = "# Blue not defined";
+if ($netsettings{'BLUE_DEV'}) {
+ $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
+}
+
&Header::showhttpheaders();
$proxysettings{'ACTION'} = '';
$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
goto ERROR;
}
+ if (!($proxysettings{'UPSTREAM_PROXY'} eq '')) {
+ my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
+ if (!(&General::validip($temp[0]))) {
+ $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
+ goto ERROR;
+ }
+ }
if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
($proxysettings{'CACHE_SIZE'} < 10))
{
<tr><td class='base' >$Lang::tr{'processes'}<input type='text' name='CHILDREN' value='$proxysettings{'CHILDREN'}' size='5' /></td>
END
;
-my $count = `arp -a | wc -l`;
+my $count = `ip n| wc -l`;
if ( $count < 1 ){$count = 1;}
if ( -e "/usr/bin/squidclamav" ) {
print "<td class='base'><b>".$Lang::tr{'advproxy squidclamav'}."</b><br />";
- print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />";
- print "+ ".int(( $count**(1/3)) * 8);
+ if ( ! -e "/var/run/clamav/clamd.pid" ){
+ print "<font color='red'>clamav not running</font><br /><br />";
+ $proxysettings{'ENABLE_CLAMAV'} = 'off';
+ }
+ else {
+ print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />";
+ print "+ ".int(( $count**(1/3)) * 8);}
print "</td>";
} else {
print "<td></td>";
if (!$proxysettings{'SRC_SUBNETS'})
{
- print "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+ print "$green_cidr\n";
if ($netsettings{'BLUE_DEV'})
{
- print "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+ print "$blue_cidr\n";
}
} else { print $proxysettings{'SRC_SUBNETS'}; }
END
;
if (!$proxysettings{'IDENT_HOSTS'}) {
- print "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+ print "$green_cidr\n";
if ($netsettings{'BLUE_DEV'}) {
- print "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+ print "$blue_cidr\n";
}
} else {
print $proxysettings{'IDENT_HOSTS'};
flock(FILE, 2);
if (!$proxysettings{'SRC_SUBNETS'})
{
- print FILE "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+ print FILE "$green_cidr\n";
if ($netsettings{'BLUE_DEV'})
{
- print FILE "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+ print FILE "$blue_cidr\n";
}
} else { print FILE $proxysettings{'SRC_SUBNETS'}; }
close(FILE);
if (
(isPlainHostName(host)) ||
(dnsDomainIs(host, ".$mainsettings{'DOMAINNAME'}")) ||
+ (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
(isInNet(host, "10.0.0.0", "255.0.0.0")) ||
(isInNet(host, "172.16.0.0", "255.240.0.0")) ||
(isInNet(host, "192.168.0.0", "255.255.0.0")) ||
}
$_ = $proxysettings{'UPSTREAM_PROXY'};
- my ($remotehost, $remoteport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
+ my ($remotehost, $remoteport) = split(/:/,$_);
if ($remoteport eq '') { $remoteport = 80; }
END
;
- if ($proxysettings{'CACHE_SIZE'} eq '0')
+ if ($proxysettings{'CACHE_SIZE'} ne '0')
{
- print FILE "cache_dir null /var/tmp\n\n";
- } else {
print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
}
- if (($proxysettings{'ERR_DESIGN'} eq 'ipfire' ))
- {
- print FILE "error_directory $errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}\n\n";
- } else {
- print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
- }
+ print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
if ($proxysettings{'OFFLINE_MODE'} eq 'on') { print FILE "offline_mode on\n\n"; }
if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
{
+ print FILE "auth_param basic utf8 on\n";
print FILE "auth_param basic program $authdir/squid_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
if (!($proxysettings{'LDAP_BINDDN_USER'} eq '')) { print FILE " -D \"$proxysettings{'LDAP_BINDDN_USER'}\""; }
if (!($proxysettings{'LDAP_BINDDN_PASS'} eq '')) { print FILE " -w $proxysettings{'LDAP_BINDDN_PASS'}"; }
{
if ($proxysettings{'NTLM_ENABLE_INT_AUTH'} eq 'on')
{
- print FILE "auth_param ntlm program $authdir/ntlm_auth $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_PDC'}";
+ print FILE "auth_param ntlm program $authdir/ntlm_smb_lm_auth $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_PDC'}";
if ($proxysettings{'NTLM_BDC'} eq '') { print FILE "\n"; } else { print FILE " $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_BDC'}\n"; }
print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n";
if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
}
print FILE <<END
-acl all src 0.0.0.0/0.0.0.0
-acl localhost src 127.0.0.1/255.255.255.255
+#acl all src all
+acl localhost src 127.0.0.1/32
END
;
open (PORTS,"$acl_ports_ssl");
acl IPFire_ips dst $netsettings{'GREEN_ADDRESS'}
acl IPFire_networks src "$acl_src_subnets"
acl IPFire_servers dst "$acl_src_subnets"
-acl IPFire_green_network src $netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}
-acl IPFire_green_servers dst $netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}
+acl IPFire_green_network src $green_cidr
+acl IPFire_green_servers dst $green_cidr
END
;
- if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network src $netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}\n"; }
- if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers dst $netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}\n"; }
+ if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network src $blue_cidr\n"; }
+ if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers dst $blue_cidr\n"; }
if (!-z $acl_src_banned_ip) { print FILE "acl IPFire_banned_ips src \"$acl_src_banned_ip\"\n"; }
if (!-z $acl_src_banned_mac) { print FILE "acl IPFire_banned_mac arp \"$acl_src_banned_mac\"\n"; }
if (!-z $acl_src_unrestricted_ip) { print FILE "acl IPFire_unrestricted_ips src \"$acl_src_unrestricted_ip\"\n"; }
END
;
print FILE "deny_info ";
- if ((($proxysettings{'ERR_DESIGN'} eq 'ipfire') && (-e "$errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")) ||
- (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")))
+ if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
{
print FILE "ERR_ACCESS_DISABLED";
} else {
}
print FILE " IPFire_no_access_ips\n";
print FILE "deny_info ";
- if ((($proxysettings{'ERR_DESIGN'} eq 'ipfire') && (-e "$errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")) ||
- (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")))
+ if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
{
print FILE "ERR_ACCESS_DISABLED";
} else {
my $blue_net = ''; #BLUE empty by default
my $blue_ip = '';
if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
- $blue_net = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
+ $blue_net = "$blue_cidr";
$blue_ip = "$netsettings{'BLUE_ADDRESS'}";
}
if (!-z $acl_include)
print FILE "\n#Start of custom includes\n\n";
while (<ACL>) {
$_ =~ s/__GREEN_IP__/$netsettings{'GREEN_ADDRESS'}/;
- $_ =~ s/__GREEN_NET__/$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}/;
+ $_ =~ s/__GREEN_NET__/$green_cidr/;
$_ =~ s/__BLUE_IP__/$blue_ip/;
$_ =~ s/__BLUE_NET__/$blue_net/;
$_ =~ s/__PROXY_PORT__/$proxysettings{'PROXY_PORT'}/;
if ($proxysettings{'FORWARD_IPADDRESS'} eq 'off')
{
- print FILE "header_access X-Forwarded-For deny all\n";
+ print FILE "request_header_access X-Forwarded-For deny all\n";
+ print FILE "reply_header_access X-Forwarded-For deny all\n";
}
if ($proxysettings{'FORWARD_VIA'} eq 'off')
{
- print FILE "header_access Via deny all\n";
+ print FILE "request_header_access Via deny all\n";
+ print FILE "reply_header_access Via deny all\n";
}
if (!($proxysettings{'FAKE_USERAGENT'} eq ''))
{
- print FILE "header_access User-Agent deny all\n";
+ print FILE "request_header_access User-Agent deny all\n";
+ print FILE "reply_header_access User-Agent deny all\n";
}
if (!($proxysettings{'FAKE_REFERER'} eq ''))
{
- print FILE "header_access Referer deny all\n";
+ print FILE "request_header_access Referer deny all\n";
+ print FILE "reply_header_access Referer deny all\n";
}
print FILE "\n";
request_body_max_size $proxysettings{'MAX_OUTGOING_SIZE'} KB
END
;
- $replybodymaxsize = 1024 * $proxysettings{'MAX_INCOMING_SIZE'};
if ($proxysettings{'MAX_INCOMING_SIZE'} > 0) {
- if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size 0 deny IPFire_unrestricted_ips\n"; }
- if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size 0 deny IPFire_unrestricted_mac\n"; }
+ if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size none IPFire_unrestricted_ips\n"; }
+ if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size none IPFire_unrestricted_mac\n"; }
if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
{
- if (!-z $extgrp) { print FILE "reply_body_max_size 0 deny for_extended_users\n"; }
+ if (!-z $extgrp) { print FILE "reply_body_max_size none for_extended_users\n"; }
}
}
- print FILE "reply_body_max_size $replybodymaxsize deny all\n\n";
+
+ if ( $proxysettings{'MAX_INCOMING_SIZE'} != '0' )
+ {
+ print FILE "reply_body_max_size $proxysettings{'MAX_INCOMING_SIZE'} KB all\n\n";
+ }
print FILE "visible_hostname";
if ($proxysettings{'VISIBLE_HOSTNAME'} eq '')
print FILE "url_rewrite_program /usr/sbin/redirect_wrapper\n";
print FILE "url_rewrite_children $proxysettings{'CHILDREN'}\n\n";
}
+
+ # Include file with user defined settings.
+ if (-e "/etc/squid/squid.conf.local") {
+ print FILE "include /etc/squid/squid.conf.local\n";
+ }
close FILE;
}
return;
}
-# -------------------------------------------------------------------
\ No newline at end of file
+# -------------------------------------------------------------------