###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2012 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2013 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
$proxysettings{'CACHE_POLICY'} = 'LRU';
$proxysettings{'L1_DIRS'} = '16';
$proxysettings{'OFFLINE_MODE'} = 'off';
+$proxysettings{'CACHE_DIGESTS'} = 'off';
$proxysettings{'CLASSROOM_EXT'} = 'off';
$proxysettings{'SUPERVISOR_PASSWORD'} = '';
$proxysettings{'NO_PROXY_LOCAL'} = 'off';
$errormessage = $Lang::tr{'invalid input'};
goto ERROR;
}
+ if($proxysettings{'CACHE_MEM'} > $proxysettings{'CACHE_SIZE'} && $proxysettings{'CACHE_SIZE'} > 0){
+ $errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'};
+ goto ERROR;
+ }
+
if (!(&General::validport($proxysettings{'PROXY_PORT'})))
{
$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
goto ERROR;
}
- if (!($proxysettings{'UPSTREAM_PROXY'} eq '')) {
- my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
- if (!(&General::validip($temp[0]))) {
- $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
- goto ERROR;
- }
+ if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
+ {
+ my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
+ if (!(&General::validip($temp[0])))
+ {
+ if (!(&General::validdomainname($temp[0])))
+ {
+ $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
+ goto ERROR;
+ }
+ }
}
if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
($proxysettings{'CACHE_SIZE'} < 10))
}
}
if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
- ($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 16384))
+ ($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 65536))
{
$errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
goto ERROR;
}
if (!&General::validip($proxysettings{'LDAP_SERVER'}))
{
- $errormessage = $Lang::tr{'advproxy errmsg ldap server'};
- goto ERROR;
+ if (!&General::validdomainname($proxysettings{'LDAP_SERVER'}))
+ {
+ $errormessage = $Lang::tr{'advproxy errmsg ldap server'};
+ goto ERROR;
+ }
}
if (!&General::validport($proxysettings{'LDAP_PORT'}))
{
&read_acls;
}
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+ writeconfig();
+ exit(0);
+}
+
+# -------------------------------------------------------------------
+
$checked{'ENABLE'}{'off'} = '';
$checked{'ENABLE'}{'on'} = '';
$checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
$checked{'OFFLINE_MODE'}{'off'} = '';
$checked{'OFFLINE_MODE'}{'on'} = '';
$checked{'OFFLINE_MODE'}{$proxysettings{'OFFLINE_MODE'}} = "checked='checked'";
+$checked{'CACHE_DIGESTS'}{'off'} = '';
+$checked{'CACHE_DIGESTS'}{'on'} = '';
+$checked{'CACHE_DIGESTS'}{$proxysettings{'CACHE_DIGESTS'}} = "checked='checked'";
$checked{'LOGGING'}{'off'} = '';
$checked{'LOGGING'}{'on'} = '';
<td class='base'>$Lang::tr{'advproxy offline mode'}:</td>
<td><input type='checkbox' name='OFFLINE_MODE' $checked{'OFFLINE_MODE'}{'on'} /></td>
</tr>
+<tr>
+ <td class='base'>$Lang::tr{'advproxy cache-digest'}:</td>
+ <td><input type='checkbox' name='CACHE_DIGESTS' $checked{'CACHE_DIGESTS'}{'on'} /></td>
+</tr>
</table>
<hr size='1'>
<table width='100%'>
END
;
+
+ # Include file with user defined settings.
+ if (-e "/etc/squid/squid.conf.pre.local") {
+ print FILE "include /etc/squid/squid.conf.pre.local\n\n";
+ }
+
print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
cache_mem $proxysettings{'CACHE_MEM'} MB
END
;
-
- if ($proxysettings{'CACHE_SIZE'} ne '0')
- {
- print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
- }
-
print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
if ($proxysettings{'OFFLINE_MODE'} eq 'on') { print FILE "offline_mode on\n\n"; }
-
+ if ($proxysettings{'CACHE_DIGESTS'} eq 'on') { print FILE "digest_generation on\n\n"; } else { print FILE "digest_generation off\n\n"; }
+
if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU')))
{
if (!($proxysettings{'MEM_POLICY'} eq 'LRU'))
print FILE "\n";
}
+ if ($proxysettings{'CACHE_SIZE'} ne '0')
+ {
+ print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
+ }
+
if ($proxysettings{'LOGGING'} eq 'on')
{
print FILE <<END
close (ACL);
}
if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+ # Check if squidclamav is enabled.
+ if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+ print FILE "\n#Settings for squidclamav:\n";
+ print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'} transparent\n";
+ print FILE "acl to_localhost dst 127.0.0.0/8\n";
+ print FILE "acl purge method PURGE\n";
+ print FILE "http_access deny to_localhost\n";
+ print FILE "http_access allow localhost\n";
+ print FILE "http_access allow purge localhost\n";
+ print FILE "http_access deny purge\n";
+ print FILE "url_rewrite_access deny localhost\n";
+ }
print FILE <<END
#Access to squid:
if ($proxysettings{'NO_PROXY_LOCAL'} eq 'on')
{
- print FILE "#Prevent internal proxy access to Green\n";
- print FILE "http_access deny IPFire_green_servers !IPFire_green_network\n\n";
+ print FILE "#Prevent internal proxy access to Green except IPFire itself\n";
+ print FILE "http_access deny IPFire_green_servers !IPFire_ips !IPFire_green_network\n\n";
}
if ($proxysettings{'NO_PROXY_LOCAL_BLUE'} eq 'on')
{
- print FILE "#Prevent internal proxy access from Blue\n";
+ print FILE "#Prevent internal proxy access from Blue except IPFire itself\n";
print FILE "http_access allow IPFire_blue_network IPFire_blue_servers\n";
- print FILE "http_access deny IPFire_blue_network IPFire_servers\n\n";
+ print FILE "http_access deny IPFire_blue_network !IPFire_ips IPFire_servers\n\n";
}
print FILE <<END
print FILE "include /etc/squid/squid.conf.local\n";
}
close FILE;
+
+ # Proxy settings for squidclamav - if installed.
+ #
+ # Check if squidclamav is enabled.
+ if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+ my $configfile='/etc/squidclamav.conf';
+
+ my $data = &General::read_file_utf8($configfile);
+ $data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+ &General::write_file_utf8($configfile, $data);
+ }
}
# -------------------------------------------------------------------