X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=html%2Fcgi-bin%2Fproxy.cgi;h=870042ae519e2044119d8fbe06bd8a848626e197;hb=2e99ab8bf8a1dc79d1c411281bd82a19acf1c9dc;hp=6d0fe545e3b4798f67c1bc86dea613253160354e;hpb=725e3869f4bd93dfc3d6a9d0fc24e61e638a451a;p=people%2Fteissler%2Fipfire-2.x.git

diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index 6d0fe545e..870042ae5 100644
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -55,10 +55,10 @@ my %mainsettings=();
 my %checked=();
 my %selected=();
 
-my @throttle_limits=(64,128,256,384,512,1024,2048,3072,5120);
-my $throttle_binary="bin|cab|exe|gz|rar|sea|tar|tgz|zip";
-my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi";
-my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|qt|ra?m";
+my @throttle_limits=(64,128,256,384,512,768,1024,1280,1536,1792,2048,2560,3072,3584,4096,5120,6144,7168,8192,10240,12288,16384,20480);
+my $throttle_binary="7z|arj|bin|bz2|cab|exe|gz|lzh|rar|sea|tar|tgz|xz|zip";
+my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi|vmdk";
+my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|ogg|qt|ra?m|ts|vob";
 
 my $def_ports_safe="80 # http\n21 # ftp\n443 # https\n563 # snews\n70 # gopher\n210 # wais\n1025-65535 # unregistered ports\n280 # http-mgmt\n488 # gss-http\n591 # filemaker\n777 # multiling http\n800 # Squids port (for icons)\n";
 my $def_ports_ssl="443 # https\n563 # snews\n";
@@ -221,6 +221,7 @@ $proxysettings{'MEM_POLICY'} = 'LRU';
 $proxysettings{'CACHE_POLICY'} = 'LRU';
 $proxysettings{'L1_DIRS'} = '16';
 $proxysettings{'OFFLINE_MODE'} = 'off';
+$proxysettings{'CACHE_DIGESTS'} = 'off';
 $proxysettings{'CLASSROOM_EXT'} = 'off';
 $proxysettings{'SUPERVISOR_PASSWORD'} = '';
 $proxysettings{'NO_PROXY_LOCAL'} = 'off';
@@ -348,11 +349,28 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		$errormessage = $Lang::tr{'invalid input'};
 		goto ERROR;
 	}
+	if($proxysettings{'CACHE_MEM'} > $proxysettings{'CACHE_SIZE'} && $proxysettings{'CACHE_SIZE'} > 0){
+		$errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'};
+		goto ERROR;
+	}
+	
 	if (!(&General::validport($proxysettings{'PROXY_PORT'})))
 	{
 		$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
 		goto ERROR;
 	}
+	if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
+	{
+		my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
+		if (!(&General::validip($temp[0])))
+		{
+			if (!(&General::validdomainname($temp[0])))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
+				goto ERROR;
+			}
+		}
+        }
 	if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
 		($proxysettings{'CACHE_SIZE'} < 10))
 	{
@@ -363,7 +381,7 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		}
 	}
 	if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
-		($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 16384))
+		($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 65536))
 	{
 		$errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
 		goto ERROR;
@@ -500,8 +518,11 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		}
 		if (!&General::validip($proxysettings{'LDAP_SERVER'}))
 		{
-			$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
-			goto ERROR;
+			if (!&General::validdomainname($proxysettings{'LDAP_SERVER'}))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
+				goto ERROR;
+			}
 		}
 		if (!&General::validport($proxysettings{'LDAP_PORT'}))
 		{
@@ -678,6 +699,16 @@ if (!$errormessage)
 	&read_acls;
 }
 
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+        writeconfig();
+        exit(0);
+}
+
+# -------------------------------------------------------------------
+
 $checked{'ENABLE'}{'off'} = '';
 $checked{'ENABLE'}{'on'} = '';
 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
@@ -717,6 +748,9 @@ $selected{'L1_DIRS'}{$proxysettings{'L1_DIRS'}} = "selected='selected'";
 $checked{'OFFLINE_MODE'}{'off'} = '';
 $checked{'OFFLINE_MODE'}{'on'} = '';
 $checked{'OFFLINE_MODE'}{$proxysettings{'OFFLINE_MODE'}} = "checked='checked'";
+$checked{'CACHE_DIGESTS'}{'off'} = '';
+$checked{'CACHE_DIGESTS'}{'on'} = '';
+$checked{'CACHE_DIGESTS'}{$proxysettings{'CACHE_DIGESTS'}} = "checked='checked'";
 
 $checked{'LOGGING'}{'off'} = '';
 $checked{'LOGGING'}{'on'} = '';
@@ -984,7 +1018,7 @@ print <<END
 <tr><td class='base' >$Lang::tr{'processes'}<input type='text' name='CHILDREN' value='$proxysettings{'CHILDREN'}' size='5' /></td>
 END
 ;
-my $count = `arp -a | wc -l`;
+my $count = `ip n| wc -l`;
 if ( $count < 1 ){$count = 1;}
 if ( -e "/usr/bin/squidclamav" ) {
 	print "<td class='base'><b>".$Lang::tr{'advproxy squidclamav'}."</b><br />";
@@ -1150,6 +1184,10 @@ print <<END
 	<td class='base'>$Lang::tr{'advproxy offline mode'}:</td>
 	<td><input type='checkbox' name='OFFLINE_MODE' $checked{'OFFLINE_MODE'}{'on'} /></td>
 </tr>
+<tr>
+	<td class='base'>$Lang::tr{'advproxy cache-digest'}:</td>
+        <td><input type='checkbox' name='CACHE_DIGESTS' $checked{'CACHE_DIGESTS'}{'on'} /></td>
+</tr>
 </table>
 <hr size='1'>
 <table width='100%'>
@@ -3013,7 +3051,7 @@ sub writeconfig
 	}
 
 	$_ = $proxysettings{'UPSTREAM_PROXY'};
-	my ($remotehost, $remoteport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
+        my ($remotehost, $remoteport) = split(/:/,$_);
 
 	if ($remoteport eq '') { $remoteport = 80; }
 
@@ -3033,6 +3071,12 @@ icp_port 0
 
 END
 	;
+
+	# Include file with user defined settings.
+	if (-e "/etc/squid/squid.conf.pre.local") {
+		print FILE "include /etc/squid/squid.conf.pre.local\n\n";
+	}
+
 	print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
 	if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
 	if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
@@ -3074,16 +3118,11 @@ pid_filename /var/run/squid.pid
 cache_mem $proxysettings{'CACHE_MEM'} MB
 END
 	;
-
-	if ($proxysettings{'CACHE_SIZE'} ne '0')
-	{
-		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
-	}
-
 	print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
 
 	if ($proxysettings{'OFFLINE_MODE'} eq 'on') {  print FILE "offline_mode on\n\n"; }
-
+	if ($proxysettings{'CACHE_DIGESTS'} eq 'on') {  print FILE "digest_generation on\n\n"; } else {  print FILE "digest_generation off\n\n"; }
+	
 	if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU')))
 	{
 		if (!($proxysettings{'MEM_POLICY'} eq 'LRU'))
@@ -3097,6 +3136,11 @@ END
 		print FILE "\n";
 	}
 
+	if ($proxysettings{'CACHE_SIZE'} ne '0')
+	{
+		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
+	}
+
 	if ($proxysettings{'LOGGING'} eq 'on')
 	{
 		print FILE <<END
@@ -3414,6 +3458,19 @@ END
 		close (ACL);
 	}
 	if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+		print FILE "\n#Settings for squidclamav:\n";
+		print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'} transparent\n";
+		print FILE "acl to_localhost dst 127.0.0.0/8\n";
+		print FILE "acl purge method PURGE\n";
+		print FILE "http_access deny to_localhost\n";
+		print FILE "http_access allow localhost\n";
+		print FILE "http_access allow purge localhost\n";
+		print FILE "http_access deny purge\n";
+		print FILE "url_rewrite_access deny localhost\n";
+	}
 	print FILE <<END
 
 #Access to squid:
@@ -3537,15 +3594,15 @@ if ($delaypools) {
 
 if ($proxysettings{'NO_PROXY_LOCAL'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access to Green\n";
-	print FILE "http_access deny IPFire_green_servers !IPFire_green_network\n\n";
+	print FILE "#Prevent internal proxy access to Green except IPFire itself\n";
+	print FILE "http_access deny IPFire_green_servers !IPFire_ips !IPFire_green_network\n\n";
 }
 
 if ($proxysettings{'NO_PROXY_LOCAL_BLUE'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access from Blue\n";
+	print FILE "#Prevent internal proxy access from Blue except IPFire itself\n";
 	print FILE "http_access allow IPFire_blue_network IPFire_blue_servers\n";
-	print FILE "http_access deny  IPFire_blue_network IPFire_servers\n\n";
+	print FILE "http_access deny  IPFire_blue_network !IPFire_ips IPFire_servers\n\n";
 }
 
 	print FILE <<END
@@ -3923,7 +3980,24 @@ END
 		print FILE "url_rewrite_program /usr/sbin/redirect_wrapper\n";
 		print FILE "url_rewrite_children $proxysettings{'CHILDREN'}\n\n";
 	}
+
+	# Include file with user defined settings.
+	if (-e "/etc/squid/squid.conf.local") {
+		print FILE "include /etc/squid/squid.conf.local\n";
+	}
 	close FILE;
+
+	# Proxy settings for squidclamav - if installed.
+	#
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+		my $configfile='/etc/squidclamav.conf';
+
+		my $data = &General::read_file_utf8($configfile);
+		$data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+		&General::write_file_utf8($configfile, $data);
+	}
 }
 
 # -------------------------------------------------------------------